From 10ebccf2ff282532d7ca6faebc5c72d47f5aff07 Mon Sep 17 00:00:00 2001 From: liuzh Date: Thu, 23 May 2024 13:29:00 +0800 Subject: [PATCH 1/2] update HAOC patch and spec for 6.6.0-27.0.0 --- 0005-haoc-kernel.patch | 3133 +++++++++------------ haoc-kernel.spec | 6010 +++++++++++++++++++++++++++++++++++++++- 2 files changed, 7339 insertions(+), 1804 deletions(-) diff --git a/0005-haoc-kernel.patch b/0005-haoc-kernel.patch index ceb1a93..c5bc614 100644 --- a/0005-haoc-kernel.patch +++ b/0005-haoc-kernel.patch @@ -1,68 +1,110 @@ -From 5e3439b082bd2c50d5d99776cc09875b58c6986f Mon Sep 17 00:00:00 2001 +From 099672494b5fbd626031f313bbdbc42d1eb3f02d Mon Sep 17 00:00:00 2001 From: liuzh -Date: Wed, 20 Mar 2024 10:54:11 +0800 +Date: Wed, 22 May 2024 16:36:55 +0800 Subject: [PATCH] Squashed commit of the following: -commit ec1ca7489f99f8ae78f59846bbde576ba8c1d17d +commit 909ad06b3bf629d9af4e143347c1d1ef8a3a5808 +Author: liuzh +Date: Wed May 22 16:23:13 2024 +0800 + + fix mte_sync_tags() parameters after rebase to 6.6.0-27.0.0. + +commit 1cbf51371b0539a45f816419b2da82cf36162b4a +Author: ljl +Date: Mon Mar 25 08:01:32 2024 +0000 + + IEE SI: Removed redundant codes. + +commit 0178bfc79ad1769a36f4165348a671d2182cff55 +Author: zhangsy +Date: Mon Mar 25 11:01:11 2024 +0800 + + Fix bugs on qemu when opening CONFIG_CREDP. + +commit 8e714f6e8f2ace5a6fc900b4bce6b03c83c41870 +Author: ljl +Date: Thu Mar 21 04:44:26 2024 +0000 + + IEE SI: Remove PAN operations as BTLB BUG is already fixed. + +commit 7b5fc74cb99e377d3bc59da81612cd6f3dd8a4d8 +Author: ljl +Date: Wed Mar 20 18:31:47 2024 +0800 + + IEE SI: Migration of iee rwx gate. + +commit aad2c7e89c9c4ad8ff0fb3ee53cd1b974144a283 Author: liuzh Date: Mon Mar 18 15:32:43 2024 +0800 modify slub.c set_track_prepare() -commit b0a92d4bdf6e5b70566d40a9eaca212c25a861be +commit 7452bac06ec09bf8321dfdbfb8b6a429d2cd8637 +Author: zhangsy +Date: Thu Mar 21 11:26:19 2024 +0800 + + Set pgd of lm Privileged. + +commit 33934cfc3eed798a3a687bf86c6bd92697e68ba9 +Author: zhangsy +Date: Tue Mar 19 17:14:32 2024 +0800 + + Delete some redundant code and put trans_pgd into IEE. + +commit 2bfe9008a72f8b8ac237bc7a5f99f9d40e84c247 Author: zhangshiyang17@mails.ucas.ac.cn Date: Mon Mar 18 11:47:50 2024 +0000 Fix bugs on physical when opening CONFIG_IEE and CONFIG_PTP. -commit 70bd0cd14fadd8de90c24f7d068ce0c178926978 +commit dafa2df600757511ce3e8f178e05e28adabdf39b Author: zhangsy Date: Mon Mar 18 10:40:42 2024 +0800 Fix bugs on qemu when opening CONFIG_IEE and CONFIG_PTP. -commit c2354a983b6815d92fe9186c4633029701a0c961 +commit 9231a9f6b34c62090b5f202c9c64a52bfdac7a73 Author: zhangsy Date: Thu Mar 14 16:34:53 2024 +0800 Fix compiling bugs of CONFIG_PTP. -commit 0705cba2c67808b11fe921683bdf03035059cb71 +commit 6469df3bcce32896c2cb297d3cd7ead82c33f35d Author: zhangsy Date: Thu Mar 14 11:10:00 2024 +0800 Fix bugs on qemu when opening CONFIG_IEE and CONFIG_INTERRUPTABLE. -commit 51cb50831e41ed95736a62a29dfc3c0a4a6fa912 +commit 5f1773dada622a3514c9ed6aa72dd50e918f2664 Author: zhangsy Date: Wed Mar 13 17:31:39 2024 +0800 Fix bugs on qemu when opening CONFIG_IEE. -commit 911534e59d6d1aa89255021f6740cd68b3284149 +commit 73f433a093fa84cffa5e11e86bed6f17c9b30a39 Author: liuzh Date: Tue Mar 12 15:32:29 2024 +0800 fix the map of IEE_SI_TEXT. -commit 5ec57031b813c9283059dc3236295ad45db97ad6 +commit 9b92deb4b2338093d9b04f4b81f162855b31c983 Author: liuzh Date: Sun Mar 10 16:11:13 2024 +0800 modified to be able to compile. can start the kernel with qemu and successfully reach `start_kernel()`. -commit 8d808438b6335c47da6d60d2903125eeb4b4cb41 +commit e892ec4790d72e9433b48b0221e7e6dc4c361dd9 Author: liuzh Date: Thu Mar 7 14:27:45 2024 +0800 fix some conflicts -commit e0349b6ad5963f985b36a726ba63ff91ac68874d +commit fdec7e39345e81e867e01258487f88801b790b02 Author: liuzh Date: Wed Mar 6 12:31:11 2024 +0800 - rebase to 6.6.0-12.0.0 for update. + migrate openeuler-commit code. (need some fix before compiling) --- .gitignore | 4 + Makefile | 3 +- @@ -73,52 +115,55 @@ Date: Wed Mar 6 12:31:11 2024 +0800 arch/arm64/include/asm/fixmap.h | 3 + arch/arm64/include/asm/hw_breakpoint.h | 12 + arch/arm64/include/asm/iee-access.h | 36 + - arch/arm64/include/asm/iee-cred.h | 145 ++ - arch/arm64/include/asm/iee-def.h | 73 + - arch/arm64/include/asm/iee-si.h | 69 + + arch/arm64/include/asm/iee-cred.h | 150 ++ + arch/arm64/include/asm/iee-def.h | 74 + + arch/arm64/include/asm/iee-si.h | 64 + arch/arm64/include/asm/iee-slab.h | 23 + arch/arm64/include/asm/iee-token.h | 40 + arch/arm64/include/asm/iee.h | 10 + arch/arm64/include/asm/kernel-pgtable.h | 21 + - arch/arm64/include/asm/koi.h | 335 ++++ + arch/arm64/include/asm/koi.h | 335 +++++ arch/arm64/include/asm/memory.h | 24 + - arch/arm64/include/asm/mmu_context.h | 12 + + arch/arm64/include/asm/mmu_context.h | 20 + arch/arm64/include/asm/pgalloc.h | 4 + - arch/arm64/include/asm/pgtable-hwdef.h | 4 + - arch/arm64/include/asm/pgtable.h | 313 +++- - arch/arm64/include/asm/sysreg.h | 56 + + arch/arm64/include/asm/pgtable-hwdef.h | 11 + + arch/arm64/include/asm/pgtable.h | 304 +++- + arch/arm64/include/asm/pointer_auth.h | 5 + + arch/arm64/include/asm/sysreg.h | 58 + arch/arm64/include/asm/tlb.h | 9 + arch/arm64/include/asm/tlbflush.h | 58 +- arch/arm64/kernel/Makefile | 2 + arch/arm64/kernel/armv8_deprecated.c | 16 + arch/arm64/kernel/asm-offsets.c | 11 + arch/arm64/kernel/cpu_errata.c | 12 + - arch/arm64/kernel/cpufeature.c | 18 + + arch/arm64/kernel/cpufeature.c | 79 + arch/arm64/kernel/debug-monitors.c | 4 + arch/arm64/kernel/entry-common.c | 4 + - arch/arm64/kernel/entry.S | 656 +++++++ - arch/arm64/kernel/head.S | 52 + - arch/arm64/kernel/hibernate.c | 8 + - arch/arm64/kernel/hw_breakpoint.c | 99 + + arch/arm64/kernel/entry.S | 611 ++++++++ + arch/arm64/kernel/fpsimd.c | 4 + + arch/arm64/kernel/head.S | 56 + + arch/arm64/kernel/hibernate.c | 14 + + arch/arm64/kernel/hw_breakpoint.c | 99 ++ arch/arm64/kernel/iee/Makefile | 1 + - arch/arm64/kernel/iee/iee-func.c | 189 ++ - arch/arm64/kernel/iee/iee-gate.S | 231 +++ - arch/arm64/kernel/iee/iee.c | 1359 ++++++++++++++ + arch/arm64/kernel/iee/iee-func.c | 187 +++ + arch/arm64/kernel/iee/iee-gate.S | 174 +++ + arch/arm64/kernel/iee/iee.c | 1360 +++++++++++++++++ arch/arm64/kernel/koi/Makefile | 1 + - arch/arm64/kernel/koi/koi.c | 1327 ++++++++++++++ + arch/arm64/kernel/koi/koi.c | 1327 +++++++++++++++++ arch/arm64/kernel/mte.c | 5 + - arch/arm64/kernel/process.c | 13 + + arch/arm64/kernel/process.c | 19 +- arch/arm64/kernel/proton-pack.c | 8 + - arch/arm64/kernel/setup.c | 35 + - arch/arm64/kernel/traps.c | 25 + - arch/arm64/kernel/vmlinux.lds.S | 70 + - arch/arm64/mm/context.c | 92 +- - arch/arm64/mm/fault.c | 4 + + arch/arm64/kernel/setup.c | 33 + + arch/arm64/kernel/traps.c | 26 + + arch/arm64/kernel/vmlinux.lds.S | 61 + + arch/arm64/mm/context.c | 91 +- + arch/arm64/mm/fault.c | 9 + arch/arm64/mm/fixmap.c | 74 +- arch/arm64/mm/init.c | 34 + - arch/arm64/mm/mmu.c | 2224 ++++++++++++++++++++--- + arch/arm64/mm/mmu.c | 1780 +++++++++++++++++++---- arch/arm64/mm/pgd.c | 39 + - arch/arm64/mm/proc.S | 23 + + arch/arm64/mm/proc.S | 28 + + arch/arm64/mm/trans_pgd.c | 46 + drivers/firmware/efi/arm-runtime.c | 4 + drivers/firmware/efi/memmap.c | 20 + drivers/tty/serial/earlycon.c | 4 + @@ -131,7 +176,7 @@ Date: Wed Mar 6 12:31:11 2024 +0800 fs/nfsd/nfs4callback.c | 12 +- fs/nfsd/nfs4recover.c | 9 + fs/nfsd/nfsfh.c | 9 + - fs/open.c | 24 + + fs/open.c | 26 + fs/overlayfs/dir.c | 9 + fs/overlayfs/super.c | 12 + fs/smb/client/cifs_spnego.c | 9 + @@ -145,15 +190,13 @@ Date: Wed Mar 6 12:31:11 2024 +0800 include/linux/iee-func.h | 27 + include/linux/module.h | 1 + include/linux/sched.h | 19 + - include/linux/stacktrace.h | 5 + - init/main.c | 158 ++ - kernel/cred.c | 170 ++ + init/main.c | 28 +- + kernel/cred.c | 182 +++ kernel/exit.c | 8 + kernel/fork.c | 316 ++-- kernel/groups.c | 7 + kernel/kthread.c | 13 + kernel/smpboot.c | 9 + - kernel/stacktrace.c | 38 + kernel/sys.c | 107 ++ kernel/umh.c | 10 + kernel/user_namespace.c | 18 + @@ -164,17 +207,15 @@ Date: Wed Mar 6 12:31:11 2024 +0800 mm/huge_memory.c | 30 +- mm/init-mm.c | 17 + mm/memory.c | 14 + - mm/mm_init.c | 6 + - mm/slub.c | 220 ++- + mm/slub.c | 198 ++- mm/sparse-vmemmap.c | 21 + - mm/swap.c | 13 + mm/vmalloc.c | 2 +- net/dns_resolver/dns_key.c | 9 + - security/commoncap.c | 153 ++ + security/commoncap.c | 169 +++ security/keys/keyctl.c | 23 + - security/keys/process_keys.c | 52 + + security/keys/process_keys.c | 53 + security/security.c | 15 + - 110 files changed, 9485 insertions(+), 447 deletions(-) + 109 files changed, 8945 insertions(+), 397 deletions(-) create mode 100644 arch/arm64/include/asm/iee-access.h create mode 100644 arch/arm64/include/asm/iee-cred.h create mode 100644 arch/arm64/include/asm/iee-def.h @@ -211,7 +252,7 @@ index 0bbae167bf93..77b3024b92d5 100644 +#command +command.txt diff --git a/Makefile b/Makefile -index e458c8265d75..1c2293c9204d 100644 +index 8e6d9b894b1e..20c367b5957d 100644 --- a/Makefile +++ b/Makefile @@ -554,7 +554,7 @@ LINUXINCLUDE := \ @@ -232,10 +273,10 @@ index e458c8265d75..1c2293c9204d 100644 KBUILD_CPPFLAGS := -D__KERNEL__ KBUILD_RUSTFLAGS := $(rust_common_flags) \ diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index b6088df74edd..47325c81abd2 100644 +index 2a875546bdc7..7448afc90c0a 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig -@@ -1653,6 +1653,24 @@ config UNMAP_KERNEL_AT_EL0 +@@ -1730,6 +1730,24 @@ config UNMAP_KERNEL_AT_EL0 If unsure, say Y. @@ -255,13 +296,13 @@ index b6088df74edd..47325c81abd2 100644 +# Config for credentials isolation +config CREDP + depends on IEE -+ def_bool n ++ def_bool y + config MITIGATE_SPECTRE_BRANCH_HISTORY bool "Mitigate Spectre style attacks against branch history" if EXPERT default y diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h -index 7712c532ce1e..358df7be2570 100644 +index 38b23786aeb4..6af10d509c2e 100644 --- a/arch/arm64/include/asm/assembler.h +++ b/arch/arm64/include/asm/assembler.h @@ -26,6 +26,41 @@ @@ -310,11 +351,11 @@ index 7712c532ce1e..358df7be2570 100644 .macro disable_daif disable_allint -+#ifdef CONFIG_IEE -+ msr daifset, #0x7 -+#else ++// #ifdef CONFIG_IEE ++// msr daifset, #0x7 ++// #else msr daifset, #0xf -+#endif ++// #endif .endm .macro enable_daif @@ -322,11 +363,11 @@ index 7712c532ce1e..358df7be2570 100644 .endm .macro restore_irq, flags -+#ifdef CONFIG_IEE -+ iee_si_restore_daif \flags -+#else ++// #ifdef CONFIG_IEE ++// iee_si_restore_daif \flags ++// #else msr daif, \flags -+#endif ++// #endif .endm .macro enable_dbg @@ -376,26 +417,26 @@ index 7712c532ce1e..358df7be2570 100644 .endm diff --git a/arch/arm64/include/asm/daifflags.h b/arch/arm64/include/asm/daifflags.h -index 2417cc6b1631..4e2a812fc898 100644 +index 2417cc6b1631..cb5b4c2e03b8 100644 --- a/arch/arm64/include/asm/daifflags.h +++ b/arch/arm64/include/asm/daifflags.h @@ -26,11 +26,19 @@ static inline void local_daif_mask(void) (read_sysreg_s(SYS_ICC_PMR_EL1) == (GIC_PRIO_IRQOFF | GIC_PRIO_PSR_I_SET))); -+#ifdef CONFIG_IEE -+ asm volatile( -+ "msr daifset, #0x7 // local_daif_mask\n" -+ : -+ : -+ : "memory"); -+#else ++// #ifdef CONFIG_IEE ++// asm volatile( ++// "msr daifset, #0x7 // local_daif_mask\n" ++// : ++// : ++// : "memory"); ++// #else asm volatile( "msr daifset, #0xf // local_daif_mask\n" : : : "memory"); -+#endif ++// #endif /* Don't really care for a dsb here, we don't intend to enable IRQs */ if (system_uses_irq_prio_masking()) @@ -403,11 +444,11 @@ index 2417cc6b1631..4e2a812fc898 100644 gic_write_pmr(pmr); } -+#ifdef CONFIG_IEE -+ iee_si_write_daif(flags); -+#else ++// #ifdef CONFIG_IEE ++// iee_si_write_daif(flags); ++// #else write_sysreg(flags, daif); -+#endif ++// #endif /* If we can take asynchronous errors we can take NMIs */ if (system_uses_nmi()) { @@ -415,27 +456,27 @@ index 2417cc6b1631..4e2a812fc898 100644 * system_has_prio_mask_debugging() won't restore the I bit if it can * use the pmr instead. */ -+#ifdef CONFIG_IEE -+ iee_si_write_daif(flags); -+#else ++// #ifdef CONFIG_IEE ++// iee_si_write_daif(flags); ++// #else write_sysreg(flags, daif); -+#endif ++// #endif /* The ALLINT field is at the same position in pstate and ALLINT */ if (system_uses_nmi()) { diff --git a/arch/arm64/include/asm/efi.h b/arch/arm64/include/asm/efi.h -index bcd5622aa096..c13059f17f04 100644 +index bcd5622aa096..76c4bd6c2b20 100644 --- a/arch/arm64/include/asm/efi.h +++ b/arch/arm64/include/asm/efi.h @@ -58,7 +58,11 @@ void arch_efi_call_virt_teardown(void); #define arch_efi_save_flags(state_flags) \ ((void)((state_flags) = read_sysreg(daif))) -+#ifdef CONFIG_IEE -+#define arch_efi_restore_flags(state_flags) iee_si_write_daif(state_flags) -+#else ++// #ifdef CONFIG_IEE ++// #define arch_efi_restore_flags(state_flags) iee_si_write_daif(state_flags) ++// #else #define arch_efi_restore_flags(state_flags) write_sysreg(state_flags, daif) -+#endif ++// #endif /* arch specific definitions used by the stub code */ @@ -521,10 +562,10 @@ index 000000000000..79604c21a510 \ No newline at end of file diff --git a/arch/arm64/include/asm/iee-cred.h b/arch/arm64/include/asm/iee-cred.h new file mode 100644 -index 000000000000..d98e3645d8a3 +index 000000000000..b8c3bb53f98a --- /dev/null +++ b/arch/arm64/include/asm/iee-cred.h -@@ -0,0 +1,145 @@ +@@ -0,0 +1,150 @@ +#ifndef _LINUX_IEE_CRED_H +#define _LINUX_IEE_CRED_H + @@ -589,6 +630,11 @@ index 000000000000..d98e3645d8a3 + iee_rw_gate(IEE_OP_SET_CRED_USER_NS,cred,user_ns); +} + ++static void __maybe_unused iee_set_cred_ucounts(struct cred *cred, struct ucounts *ucounts) ++{ ++ iee_rw_gate(IEE_OP_SET_CRED_UCOUNTS,cred,ucounts); ++} ++ +static void __maybe_unused iee_set_cred_group_info(struct cred *cred, struct group_info *group_info) +{ + iee_rw_gate(IEE_OP_SET_CRED_GROUP_INFO,cred,group_info); @@ -673,10 +719,10 @@ index 000000000000..d98e3645d8a3 \ No newline at end of file diff --git a/arch/arm64/include/asm/iee-def.h b/arch/arm64/include/asm/iee-def.h new file mode 100644 -index 000000000000..ff37f352f823 +index 000000000000..76e59259e4d1 --- /dev/null +++ b/arch/arm64/include/asm/iee-def.h -@@ -0,0 +1,73 @@ +@@ -0,0 +1,74 @@ +// Function Identifiers with Parameters Description + +#define IEE_WRITE_IN_BYTE 0 // Parameters: void *ptr, __u64 data, int length @@ -728,22 +774,23 @@ index 000000000000..ff37f352f823 +#define IEE_FREE_TOKEN 46 // Parameters: struct task_struct *tsk +#define IEE_READ_TOKEN_STACK 47 // Parameters: struct task_struct *tsk +#define IEE_WRITE_ENTRY_TASK 48 // Parameters: struct task_struct *tsk ++#define IEE_OP_SET_CRED_UCOUNTS 49 // Parameters: struct cred *cred, struct ucounts *ucounts +#ifdef CONFIG_KOI -+#define IEE_READ_KOI_STACK 49 // Parameters: struct task_struct *tsk -+#define IEE_WRITE_KOI_STACK 50 // Parameters: struct task_struct *tsk, unsigned long koi_stack -+#define IEE_READ_TOKEN_TTBR1 51 // Parameters: struct task_struct *tsk -+#define IEE_WRITE_TOKEN_TTBR1 52 // Parameters: struct task_struct *tsk, unsigned long current_ttbr1 -+#define IEE_READ_KOI_KERNEL_STACK 53 // Parameters: struct task_struct *tsk -+#define IEE_WRITE_KOI_KERNEL_STACK 54 // Parameters: struct task_struct *tsk, unsigned long kernel_stack -+#define IEE_READ_KOI_STACK_BASE 55 // Parameters: struct task_struct *tsk -+#define IEE_WRITE_KOI_STACK_BASE 56 // Parameters: struct task_struct *tsk, unsigned long koi_stack_base ++#define IEE_READ_KOI_STACK 50 // Parameters: struct task_struct *tsk ++#define IEE_WRITE_KOI_STACK 51 // Parameters: struct task_struct *tsk, unsigned long koi_stack ++#define IEE_READ_TOKEN_TTBR1 52 // Parameters: struct task_struct *tsk ++#define IEE_WRITE_TOKEN_TTBR1 53 // Parameters: struct task_struct *tsk, unsigned long current_ttbr1 ++#define IEE_READ_KOI_KERNEL_STACK 54 // Parameters: struct task_struct *tsk ++#define IEE_WRITE_KOI_KERNEL_STACK 55 // Parameters: struct task_struct *tsk, unsigned long kernel_stack ++#define IEE_READ_KOI_STACK_BASE 56 // Parameters: struct task_struct *tsk ++#define IEE_WRITE_KOI_STACK_BASE 57 // Parameters: struct task_struct *tsk, unsigned long koi_stack_base +#endif + +/* Add new IEE ops here */ + -+#define AT_INC 1 ++#define AT_ADD 1 +#define AT_INC_NOT_ZERO 2 -+#define AT_DEC_AND_TEST 3 ++#define AT_SUB_AND_TEST 3 +/* Atomic ops for atomic_t */ + +#ifdef CONFIG_KOI @@ -753,36 +800,28 @@ index 000000000000..ff37f352f823 \ No newline at end of file diff --git a/arch/arm64/include/asm/iee-si.h b/arch/arm64/include/asm/iee-si.h new file mode 100644 -index 000000000000..064975632cd1 +index 000000000000..e67d81db66a5 --- /dev/null +++ b/arch/arm64/include/asm/iee-si.h -@@ -0,0 +1,69 @@ +@@ -0,0 +1,64 @@ +#ifndef _LINUX_IEE_SI_H +#define _LINUX_IEE_SI_H + +#include +#define __iee_si_code __section(".iee.si_text") -+#define __iee_si_base __section(".iee.si_base") +#define __iee_si_data __section(".iee.si_data") + +/* Used for copying globals that iee rwx gate needs. */ -+// extern unsigned long iee_base_kimage_voffset; -+// extern unsigned long iee_base_memstart_addr; -+extern unsigned long iee_base_iee_pg_dir; -+extern unsigned long iee_base_swapper_pg_dir; +extern unsigned long iee_base_idmap_pg_dir; +extern unsigned long iee_base_reserved_pg_dir; +extern unsigned long iee_base__bp_harden_el1_vectors; -+extern pgd_t iee_pg_dir[PTRS_PER_PGD]; +extern bool iee_init_done; -+ -+DECLARE_PER_CPU(unsigned long, iee_si_user_bvr0); -+DECLARE_PER_CPU(unsigned long, iee_si_user_bcr0); ++extern unsigned long iee_si_tcr; + +/* The following are __init functions used for iee si initialization. */ -+extern void iee_si_set_base_swapper_cnp(void); -+extern void isolate_iee_si(void); ++extern void iee_si_prepare_data(void); + ++extern unsigned long __iee_si_start[]; +// Handler function for sensitive inst +u64 iee_si_handler(int flag, ...); +/* @@ -802,7 +841,7 @@ index 000000000000..064975632cd1 +#define IEE_WRITE_TCR 4 +#define IEE_WRITE_MDSCR 5 +#define IEE_CONTEXT_SWITCH 6 -+#define IEE_WRITE_AFSR0 10 ++// #define IEE_WRITE_AFSR0 10 +/* Provide ttbr1 switch gate for KOI */ +#ifdef CONFIG_KOI +#define IEE_SWITCH_TO_KERNEL 7 @@ -810,10 +849,13 @@ index 000000000000..064975632cd1 +#endif +/* MASK modify-permitted bits on IEE protected sys registers */ +#define IEE_SCTLR_MASK (SCTLR_EL1_CP15BEN | SCTLR_EL1_SED | SCTLR_EL1_UCT | SCTLR_EL1_UCI |\ -+ SCTLR_EL1_BT0 | SCTLR_EL1_BT1 | SCTLR_EL1_TCF0_MASK | SCTLR_ELx_DSSBS) ++ SCTLR_EL1_BT0 | SCTLR_EL1_BT1 | SCTLR_EL1_TCF0_MASK | SCTLR_ELx_DSSBS |\ ++ SCTLR_ELx_ENIA | SCTLR_ELx_ENIB | SCTLR_ELx_ENDA | SCTLR_ELx_ENDB|\ ++ SCTLR_EL1_SPINTMASK | SCTLR_EL1_NMI | SCTLR_EL1_TIDCP | SCTLR_EL1_MSCEn|\ ++ SCTLR_ELx_ENTP2 | SCTLR_EL1_TCF_MASK) +#define IEE_TTBR0_MASK ~0 +#define IEE_TTBR1_MASK ~0 -+#define IEE_TCR_MASK (TCR_HD | TCR_T0SZ_MASK) ++#define IEE_TCR_MASK (TCR_HD | TCR_T0SZ_MASK | TCR_E0PD1) +#define IEE_MDSCR_MASK (DBG_MDSCR_SS | DBG_MDSCR_MDE) + +#define IEE_DBGBCR_BT 0b0000 << 20 @@ -1293,7 +1335,7 @@ index 000000000000..48d9a1378a1d +} \ No newline at end of file diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h -index fde4186cc387..c9047b1eba01 100644 +index fde4186cc387..6309e5514a16 100644 --- a/arch/arm64/include/asm/memory.h +++ b/arch/arm64/include/asm/memory.h @@ -190,6 +190,13 @@ extern u64 vabits_actual; @@ -1315,14 +1357,14 @@ index fde4186cc387..c9047b1eba01 100644 #define __phys_to_kimg(x) ((unsigned long)((x) + kimage_voffset)) +#ifdef CONFIG_KOI -+#define KOI_OFFSET ((unsigned long)0x4 << 44) ++#define KOI_OFFSET ((unsigned long)BIT(vabits_actual - 2)) +#endif + +#ifdef CONFIG_IEE +#ifdef CONFIG_IEE_OFFSET +#define IEE_OFFSET ((CONFIG_IEE_OFFSET) - LOGICAL_RANDOM) +#else -+#define IEE_OFFSET (((unsigned long)0x4 << 44) - LOGICAL_RANDOM) ++#define IEE_OFFSET (((unsigned long)BIT(vabits_actual - 2)) - LOGICAL_RANDOM) +#endif +#define __phys_to_iee(x) (__phys_to_virt(x) + IEE_OFFSET) +#define SET_UPAGE(x) __pgprot(pgprot_val(x) | PTE_USER) @@ -1335,14 +1377,25 @@ index fde4186cc387..c9047b1eba01 100644 * Convert a page to/from a physical address */ diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h -index a6fb325424e7..273f39919e31 100644 +index a6fb325424e7..cca5994dabfb 100644 --- a/arch/arm64/include/asm/mmu_context.h +++ b/arch/arm64/include/asm/mmu_context.h -@@ -43,7 +43,11 @@ static inline void cpu_set_reserved_ttbr0_nosync(void) +@@ -24,6 +24,9 @@ + #include + #include + #include ++#ifdef CONFIG_IEE ++#define INIT_ASID 0x2 ++#endif + + extern bool rodata_full; + +@@ -43,7 +46,12 @@ static inline void cpu_set_reserved_ttbr0_nosync(void) { unsigned long ttbr = phys_to_ttbr(__pa_symbol(reserved_pg_dir)); +#ifdef CONFIG_IEE ++ ttbr |= FIELD_PREP(TTBR_ASID_MASK, 1); + iee_rwx_gate_entry(IEE_WRITE_ttbr0_el1, ttbr); +#else write_sysreg(ttbr, ttbr0_el1); @@ -1350,7 +1403,7 @@ index a6fb325424e7..273f39919e31 100644 } static inline void cpu_set_reserved_ttbr0(void) -@@ -79,7 +83,11 @@ static inline void __cpu_set_tcr_t0sz(unsigned long t0sz) +@@ -79,7 +87,11 @@ static inline void __cpu_set_tcr_t0sz(unsigned long t0sz) tcr &= ~TCR_T0SZ_MASK; tcr |= t0sz << TCR_T0SZ_OFFSET; @@ -1362,7 +1415,19 @@ index a6fb325424e7..273f39919e31 100644 isb(); } -@@ -174,6 +182,10 @@ static inline void cpu_replace_ttbr1(pgd_t *pgdp, pgd_t *idmap) +@@ -144,7 +156,11 @@ static inline void cpu_install_ttbr0(phys_addr_t ttbr0, unsigned long t0sz) + __cpu_set_tcr_t0sz(t0sz); + + /* avoid cpu_switch_mm() and its SW-PAN and CNP interactions */ ++ #ifdef CONFIG_IEE ++ iee_rwx_gate_entry(IEE_WRITE_ttbr0_el1, ttbr0); ++ #else + write_sysreg(ttbr0, ttbr0_el1); ++ #endif + isb(); + } + +@@ -174,6 +190,10 @@ static inline void cpu_replace_ttbr1(pgd_t *pgdp, pgd_t *idmap) ttbr1 |= TTBR_CNP_BIT; } @@ -1389,13 +1454,16 @@ index 237224484d0f..4e3304da8421 100644 pmdval_t prot) { diff --git a/arch/arm64/include/asm/pgtable-hwdef.h b/arch/arm64/include/asm/pgtable-hwdef.h -index e4944d517c99..3442d1f910de 100644 +index e4944d517c99..7f60e568c964 100644 --- a/arch/arm64/include/asm/pgtable-hwdef.h +++ b/arch/arm64/include/asm/pgtable-hwdef.h -@@ -84,6 +84,10 @@ +@@ -84,6 +84,13 @@ #define CONT_PMD_SIZE (CONT_PMDS * PMD_SIZE) #define CONT_PMD_MASK (~(CONT_PMD_SIZE - 1)) ++#ifdef CONFIG_IEE ++#define PGD_APT_RO (_AT(pudval_t, 1) << 62) ++#endif +#define PGD_APT (_AT(pudval_t, 1) << 61) +#define PGD_PXN (_AT(pudval_t, 1) << 59) +#define PGD_UXN (_AT(pudval_t, 1) << 60) @@ -1403,8 +1471,19 @@ index e4944d517c99..3442d1f910de 100644 /* * Hardware page table definitions. * +@@ -285,6 +292,10 @@ + #define TCR_TCMA0 (UL(1) << 57) + #define TCR_TCMA1 (UL(1) << 58) + ++#ifdef CONFIG_IEE ++#define TCR_HPD1 (UL(1) << 42) ++#endif ++ + /* + * TTBR. + */ diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h -index 7f7d9b1df4e5..dee52c1838dc 100644 +index 8d68d00de0a4..6f8d5b85bfd7 100644 --- a/arch/arm64/include/asm/pgtable.h +++ b/arch/arm64/include/asm/pgtable.h @@ -34,6 +34,9 @@ @@ -1417,7 +1496,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 #ifdef CONFIG_TRANSPARENT_HUGEPAGE #define __HAVE_ARCH_FLUSH_PMD_TLB_RANGE -@@ -157,6 +160,30 @@ static inline pteval_t __phys_to_pte_val(phys_addr_t phys) +@@ -156,6 +159,30 @@ static inline pteval_t __phys_to_pte_val(phys_addr_t phys) #define pud_access_permitted(pud, write) \ (pte_access_permitted(pud_pte(pud), (write))) @@ -1448,11 +1527,34 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 static inline pte_t clear_pte_bit(pte_t pte, pgprot_t prot) { pte_val(pte) &= ~pgprot_val(prot); -@@ -261,8 +288,40 @@ static inline pte_t pte_mkdevmap(pte_t pte) - return set_pte_bit(pte, __pgprot(PTE_DEVMAP | PTE_SPECIAL)); - } +@@ -262,6 +289,64 @@ static inline pte_t pte_mkdevmap(pte_t pte) --static inline void set_pte(pte_t *ptep, pte_t pte) + static inline void __set_pte(pte_t *ptep, pte_t pte) + { ++#ifdef CONFIG_KOI ++ if (!pte_none(pte)) { ++ pte = __pte(pte_val(pte) | PTE_NG); ++ } ++#endif ++#ifdef CONFIG_PTP ++ iee_rw_gate(IEE_OP_SET_PTE, ptep, pte); ++ dsb(ishst); ++ isb(); ++#else ++ WRITE_ONCE(*ptep, pte); ++ ++ /* ++ * Only if the new pte is valid and kernel, otherwise TLB maintenance ++ * or update_mmu_cache() have the necessary barriers. ++ */ ++ if (pte_valid_not_user(pte)) { ++ dsb(ishst); ++ isb(); ++ } ++#endif ++} ++ ++ +#ifdef CONFIG_PTP +static inline void iee_set_bm_pte(pte_t *ptep, pte_t pte) +{ @@ -1481,7 +1583,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 +} + +static inline void iee_set_fixmap_pte_pre_init(pte_t *ptep, pte_t pte) - { ++{ +#ifdef CONFIG_KOI + if (!pte_none(pte)) { + pte = __pte(pte_val(pte) | PTE_NG); @@ -1490,32 +1592,18 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 WRITE_ONCE(*ptep, pte); /* -@@ -274,6 +333,57 @@ static inline void set_pte(pte_t *ptep, pte_t pte) +@@ -273,6 +358,7 @@ static inline void __set_pte(pte_t *ptep, pte_t pte) isb(); } } +#endif -+ -+static inline void set_pte(pte_t *ptep, pte_t pte) -+{ -+#ifdef CONFIG_KOI -+ if (!pte_none(pte)) { -+ pte = __pte(pte_val(pte) | PTE_NG); -+ } -+#endif -+#ifdef CONFIG_PTP -+ iee_rw_gate(IEE_OP_SET_PTE, ptep, pte); -+ dsb(ishst); -+ isb(); -+#else -+ WRITE_ONCE(*ptep, pte); -+ if (pte_valid_not_user(pte)) { -+ dsb(ishst); -+ isb(); -+ } -+#endif -+} -+ + + static inline pte_t __ptep_get(pte_t *ptep) + { +@@ -546,6 +632,95 @@ static inline void __set_pte_at(struct mm_struct *mm, + __set_pte(ptep, pte); + } + +#ifdef CONFIG_IEE +static inline void iee_set_pte_upage(pte_t *ptep, pte_t pte) +{ @@ -1545,13 +1633,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 + } +} +#endif - - extern void __sync_icache_dcache(pte_t pteval); - bool pgattr_change_is_safe(u64 old, u64 new); -@@ -531,6 +641,65 @@ static inline pmd_t pmd_mkdevmap(pmd_t pmd) - #define pud_pfn(pud) ((__pud_to_phys(pud) & PUD_MASK) >> PAGE_SHIFT) - #define pfn_pud(pfn,prot) __pud(__phys_to_pud_val((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot)) - ++ +#ifdef CONFIG_PTP +static inline void set_pmd(pmd_t *pmdp, pmd_t pmd); +static inline void __set_pmd_at(struct mm_struct *mm, unsigned long addr, @@ -1568,7 +1650,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 + */ + if (system_supports_mte() && pte_access_permitted(pmd_pte(pmd), false) && + !pte_special(pmd_pte(pmd)) && pte_tagged(pmd_pte(pmd))) -+ mte_sync_tags(pmd_pte(pmd)); ++ mte_sync_tags(pmd_pte(pmd), PMD_SIZE >> PAGE_SHIFT); + + __check_safe_pte_update(mm, (pte_t *)pmdp, pmd_pte(pmd)); + @@ -1597,7 +1679,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 + */ + if (system_supports_mte() && pte_access_permitted(pud_pte(pud), false) && + !pte_special(pud_pte(pud)) && pte_tagged(pud_pte(pud))) -+ mte_sync_tags(pud_pte(pud)); ++ mte_sync_tags(pud_pte(pud), PUD_SIZE >> PAGE_SHIFT); + + __check_safe_pte_update(mm, (pte_t *)pudp, pud_pte(pud)); + @@ -1614,36 +1696,20 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 static inline void set_pmd_at(struct mm_struct *mm, unsigned long addr, pmd_t *pmdp, pmd_t pmd) { -@@ -544,7 +713,7 @@ static inline void set_pud_at(struct mm_struct *mm, unsigned long addr, - page_table_check_pud_set(mm, pudp, pud); - return __set_pte_at(mm, addr, (pte_t *)pudp, pud_pte(pud)); +@@ -561,7 +736,7 @@ static inline void set_pud_at(struct mm_struct *mm, unsigned long addr, + return __set_pte_at(mm, addr, (pte_t *)pudp, pud_pte(pud), + PUD_SIZE >> PAGE_SHIFT); } - +#endif #define __p4d_to_phys(p4d) __pte_to_phys(p4d_pte(p4d)) #define __phys_to_p4d_val(phys) __phys_to_pte_val(phys) -@@ -611,6 +780,7 @@ static inline bool pud_table(pud_t pud) { return true; } - extern pgd_t init_pg_dir[PTRS_PER_PGD]; - extern pgd_t init_pg_end[]; - extern pgd_t swapper_pg_dir[PTRS_PER_PGD]; -+extern pgd_t iee_pg_dir[PTRS_PER_PGD]; - extern pgd_t idmap_pg_dir[PTRS_PER_PGD]; - extern pgd_t tramp_pg_dir[PTRS_PER_PGD]; - extern pgd_t reserved_pg_dir[PTRS_PER_PGD]; -@@ -623,7 +793,22 @@ static inline bool in_swapper_pgdir(void *addr) +@@ -640,7 +815,14 @@ static inline bool in_swapper_pgdir(void *addr) ((unsigned long)swapper_pg_dir & PAGE_MASK); } -static inline void set_pmd(pmd_t *pmdp, pmd_t pmd) -+#ifdef CONFIG_IEE -+static inline bool in_iee_pgdir(void *addr) -+{ -+ return ((unsigned long)addr & PAGE_MASK) == -+ ((unsigned long)iee_pg_dir & PAGE_MASK); -+} -+#endif -+ +#ifdef CONFIG_PTP +static inline bool in_tramp_pgdir(void *addr) +{ @@ -1655,7 +1721,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 { #ifdef __PAGETABLE_PMD_FOLDED if (in_swapper_pgdir(pmdp)) { -@@ -631,7 +816,6 @@ static inline void set_pmd(pmd_t *pmdp, pmd_t pmd) +@@ -648,7 +830,6 @@ static inline void set_pmd(pmd_t *pmdp, pmd_t pmd) return; } #endif /* __PAGETABLE_PMD_FOLDED */ @@ -1663,7 +1729,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 WRITE_ONCE(*pmdp, pmd); if (pmd_valid(pmd)) { -@@ -639,6 +823,32 @@ static inline void set_pmd(pmd_t *pmdp, pmd_t pmd) +@@ -656,6 +837,32 @@ static inline void set_pmd(pmd_t *pmdp, pmd_t pmd) isb(); } } @@ -1696,7 +1762,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 static inline void pmd_clear(pmd_t *pmdp) { -@@ -658,6 +868,12 @@ static inline unsigned long pmd_page_vaddr(pmd_t pmd) +@@ -675,6 +882,12 @@ static inline unsigned long pmd_page_vaddr(pmd_t pmd) /* Find an entry in the third-level page table. */ #define pte_offset_phys(dir,addr) (pmd_page_paddr(READ_ONCE(*(dir))) + pte_index(addr) * sizeof(pte_t)) @@ -1709,7 +1775,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 #define pte_set_fixmap(addr) ((pte_t *)set_fixmap_offset(FIX_PTE, addr)) #define pte_set_fixmap_offset(pmd, addr) pte_set_fixmap(pte_offset_phys(pmd, addr)) #define pte_clear_fixmap() clear_fixmap(FIX_PTE) -@@ -686,7 +902,9 @@ static inline unsigned long pmd_page_vaddr(pmd_t pmd) +@@ -703,7 +916,9 @@ static inline unsigned long pmd_page_vaddr(pmd_t pmd) #define pud_user(pud) pte_user(pud_pte(pud)) #define pud_user_exec(pud) pte_user_exec(pud_pte(pud)) @@ -1720,7 +1786,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 { #ifdef __PAGETABLE_PUD_FOLDED if (in_swapper_pgdir(pudp)) { -@@ -694,7 +912,6 @@ static inline void set_pud(pud_t *pudp, pud_t pud) +@@ -711,7 +926,6 @@ static inline void set_pud(pud_t *pudp, pud_t pud) return; } #endif /* __PAGETABLE_PUD_FOLDED */ @@ -1728,7 +1794,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 WRITE_ONCE(*pudp, pud); if (pud_valid(pud)) { -@@ -702,6 +919,33 @@ static inline void set_pud(pud_t *pudp, pud_t pud) +@@ -719,6 +933,33 @@ static inline void set_pud(pud_t *pudp, pud_t pud) isb(); } } @@ -1762,7 +1828,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 static inline void pud_clear(pud_t *pudp) { -@@ -721,6 +965,12 @@ static inline pmd_t *pud_pgtable(pud_t pud) +@@ -738,6 +979,12 @@ static inline pmd_t *pud_pgtable(pud_t pud) /* Find an entry in the second-level page table. */ #define pmd_offset_phys(dir, addr) (pud_page_paddr(READ_ONCE(*(dir))) + pmd_index(addr) * sizeof(pmd_t)) @@ -1775,7 +1841,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 #define pmd_set_fixmap(addr) ((pmd_t *)set_fixmap_offset(FIX_PMD, addr)) #define pmd_set_fixmap_offset(pud, addr) pmd_set_fixmap(pmd_offset_phys(pud, addr)) #define pmd_clear_fixmap() clear_fixmap(FIX_PMD) -@@ -752,15 +1002,30 @@ static inline pmd_t *pud_pgtable(pud_t pud) +@@ -769,15 +1016,26 @@ static inline pmd_t *pud_pgtable(pud_t pud) #define p4d_none(p4d) (!p4d_val(p4d)) #define p4d_bad(p4d) (!(p4d_val(p4d) & 2)) #define p4d_present(p4d) (p4d_val(p4d)) @@ -1784,11 +1850,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 static inline void set_p4d(p4d_t *p4dp, p4d_t p4d) { - if (in_swapper_pgdir(p4dp)) { -+ #ifdef CONFIG_IEE -+ if (in_swapper_pgdir(p4dp) | in_iee_pgdir(p4dp)) -+ #else + if (in_swapper_pgdir(p4dp)) -+ #endif + { set_swapper_pgd((pgd_t *)p4dp, __pgd(p4d_val(p4d))); return; @@ -1807,7 +1869,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 dsb(ishst); isb(); } -@@ -783,6 +1048,12 @@ static inline pud_t *p4d_pgtable(p4d_t p4d) +@@ -800,6 +1058,12 @@ static inline pud_t *p4d_pgtable(p4d_t p4d) /* Find an entry in the first-level page table. */ #define pud_offset_phys(dir, addr) (p4d_page_paddr(READ_ONCE(*(dir))) + pud_index(addr) * sizeof(pud_t)) @@ -1820,7 +1882,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 #define pud_set_fixmap(addr) ((pud_t *)set_fixmap_offset(FIX_PUD, addr)) #define pud_set_fixmap_offset(p4d, addr) pud_set_fixmap(pud_offset_phys(p4d, addr)) #define pud_clear_fixmap() clear_fixmap(FIX_PUD) -@@ -809,6 +1080,10 @@ static inline pud_t *p4d_pgtable(p4d_t p4d) +@@ -826,6 +1090,10 @@ static inline pud_t *p4d_pgtable(p4d_t p4d) #define pgd_ERROR(e) \ pr_err("%s:%d: bad pgd %016llx.\n", __FILE__, __LINE__, pgd_val(e)) @@ -1831,7 +1893,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 #define pgd_set_fixmap(addr) ((pgd_t *)set_fixmap_offset(FIX_PGD, addr)) #define pgd_clear_fixmap() clear_fixmap(FIX_PGD) -@@ -888,8 +1163,13 @@ static inline int __ptep_test_and_clear_young(pte_t *ptep) +@@ -912,8 +1180,13 @@ static inline int __ptep_test_and_clear_young(struct vm_area_struct *vma, do { old_pte = pte; pte = pte_mkold(pte); @@ -1845,8 +1907,8 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 } while (pte_val(pte) != pte_val(old_pte)); return pte_young(pte); -@@ -937,8 +1217,12 @@ static inline int pmdp_test_and_clear_young(struct vm_area_struct *vma, - static inline pte_t ptep_get_and_clear(struct mm_struct *mm, +@@ -952,8 +1225,12 @@ static inline int pmdp_test_and_clear_young(struct vm_area_struct *vma, + static inline pte_t __ptep_get_and_clear(struct mm_struct *mm, unsigned long address, pte_t *ptep) { + #ifdef CONFIG_PTP @@ -1859,7 +1921,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 page_table_check_pte_clear(mm, pte); return pte; -@@ -949,7 +1233,12 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, +@@ -995,7 +1272,12 @@ static inline pte_t __get_and_clear_full_ptes(struct mm_struct *mm, static inline pmd_t pmdp_huge_get_and_clear(struct mm_struct *mm, unsigned long address, pmd_t *pmdp) { @@ -1872,7 +1934,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 page_table_check_pmd_clear(mm, pmd); -@@ -970,8 +1259,12 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addres +@@ -1012,8 +1294,12 @@ static inline void ___ptep_set_wrprotect(struct mm_struct *mm, do { old_pte = pte; pte = pte_wrprotect(pte); @@ -1885,7 +1947,7 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 } while (pte_val(pte) != pte_val(old_pte)); } -@@ -988,7 +1281,11 @@ static inline pmd_t pmdp_establish(struct vm_area_struct *vma, +@@ -1049,7 +1335,11 @@ static inline pmd_t pmdp_establish(struct vm_area_struct *vma, unsigned long address, pmd_t *pmdp, pmd_t pmd) { page_table_check_pmd_set(vma->vm_mm, pmdp, pmd); @@ -1897,17 +1959,37 @@ index 7f7d9b1df4e5..dee52c1838dc 100644 } #endif +diff --git a/arch/arm64/include/asm/pointer_auth.h b/arch/arm64/include/asm/pointer_auth.h +index d2e0306e65d3..8352e92d4536 100644 +--- a/arch/arm64/include/asm/pointer_auth.h ++++ b/arch/arm64/include/asm/pointer_auth.h +@@ -108,8 +108,13 @@ static __always_inline void ptrauth_enable(void) + { + if (!system_supports_address_auth()) + return; ++ #ifdef CONFIG_IEE ++ sysreg_clear_set_iee_si(sctlr_el1, 0, (SCTLR_ELx_ENIA | SCTLR_ELx_ENIB | ++ SCTLR_ELx_ENDA | SCTLR_ELx_ENDB)); ++ #else + sysreg_clear_set(sctlr_el1, 0, (SCTLR_ELx_ENIA | SCTLR_ELx_ENIB | + SCTLR_ELx_ENDA | SCTLR_ELx_ENDB)); ++ #endif + isb(); + } + diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h -index 0086a617dfa1..3f0def06add5 100644 +index 42358b8d678e..1e2d11e57fe3 100644 --- a/arch/arm64/include/asm/sysreg.h +++ b/arch/arm64/include/asm/sysreg.h -@@ -1113,6 +1113,62 @@ +@@ -1116,6 +1116,64 @@ write_sysreg_s(__scs_new, sysreg); \ } while (0) + +#ifdef CONFIG_IEE + ++#define SYS_TCR_IEE_SI TCR_HPD1 | TCR_A1 ++ +extern void iee_rwx_gate_entry(int flag, ...); +#define IEE_SI_TEST 0 +#define IEE_WRITE_sctlr_el1 1 @@ -1965,7 +2047,7 @@ index 0086a617dfa1..3f0def06add5 100644 u64 par; \ asm(ALTERNATIVE("nop", "dmb sy", ARM64_WORKAROUND_1508412)); \ diff --git a/arch/arm64/include/asm/tlb.h b/arch/arm64/include/asm/tlb.h -index 2c29239d05c3..108f6e01776b 100644 +index 2c29239d05c3..955f99317790 100644 --- a/arch/arm64/include/asm/tlb.h +++ b/arch/arm64/include/asm/tlb.h @@ -11,8 +11,17 @@ @@ -1981,13 +2063,13 @@ index 2c29239d05c3..108f6e01776b 100644 +#ifdef CONFIG_PTP + unsigned long iee_addr = __phys_to_iee(page_to_phys((struct page *)_table)); + set_iee_page_invalid(iee_addr); -+ iee_set_logical_mem_rw((unsigned long)_table); ++ iee_set_logical_mem_rw((unsigned long)page_address((struct page *)_table)); +#endif free_page_and_swap_cache((struct page *)_table); } diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h -index b149cf9f91bc..ab07d1bcb040 100644 +index 831c314d75ff..7775628528c6 100644 --- a/arch/arm64/include/asm/tlbflush.h +++ b/arch/arm64/include/asm/tlbflush.h @@ -49,6 +49,7 @@ @@ -1998,7 +2080,7 @@ index b149cf9f91bc..ab07d1bcb040 100644 #define __tlbi_user(op, arg) do { \ if (arm64_kernel_unmapped_at_el0()) \ __tlbi(op, (arg) | USER_ASID_FLAG); \ -@@ -252,6 +253,10 @@ static inline void flush_tlb_mm(struct mm_struct *mm) +@@ -258,6 +259,10 @@ static inline void flush_tlb_mm(struct mm_struct *mm) asid = __TLBI_VADDR(0, ASID(mm)); __tlbi(aside1is, asid); __tlbi_user(aside1is, asid); @@ -2009,7 +2091,7 @@ index b149cf9f91bc..ab07d1bcb040 100644 dsb(ish); mmu_notifier_arch_invalidate_secondary_tlbs(mm, 0, -1UL); } -@@ -267,6 +272,10 @@ static inline void __flush_tlb_page_nosync(struct mm_struct *mm, +@@ -273,6 +278,10 @@ static inline void __flush_tlb_page_nosync(struct mm_struct *mm, __tlbi_user(vale1is, addr); mmu_notifier_arch_invalidate_secondary_tlbs(mm, uaddr & PAGE_MASK, (uaddr & PAGE_MASK) + PAGE_SIZE); @@ -2020,37 +2102,11 @@ index b149cf9f91bc..ab07d1bcb040 100644 } static inline void flush_tlb_page_nosync(struct vm_area_struct *vma, -@@ -364,6 +373,7 @@ static inline void arch_tlbbatch_flush(struct arch_tlbflush_unmap_batch *batch) - * scale or num = 0 and scale + 1. The loop below favours the latter - * since num is limited to 30 by the __TLBI_RANGE_NUM() macro. +@@ -366,6 +375,45 @@ static inline void arch_tlbbatch_flush(struct arch_tlbflush_unmap_batch *batch) + * 2. If there is 1 page remaining, flush it through non-range operations. Range + * operations can only span an even number of pages. */ +#if defined(CONFIG_IEE) || defined(CONFIG_KOI) - #define __flush_tlb_range_op(op, start, pages, stride, \ - asid, tlb_level, tlbi_user) \ - do { \ -@@ -376,6 +386,8 @@ do { \ - pages % 2 == 1) { \ - addr = __TLBI_VADDR(start, asid); \ - __tlbi_level(op, addr, tlb_level); \ -+ if (!arm64_kernel_unmapped_at_el0()) /* added for IEE */ \ -+ __tlbi_level(op, addr | USER_ASID_FLAG, tlb_level); \ - if (tlbi_user) \ - __tlbi_user_level(op, addr, tlb_level); \ - start += stride; \ -@@ -388,6 +400,8 @@ do { \ - addr = __TLBI_VADDR_RANGE(start, asid, scale, \ - num, tlb_level); \ - __tlbi(r##op, addr); \ -+ if (!arm64_kernel_unmapped_at_el0()) /* added for IEE */ \ -+ __tlbi(r##op, addr | USER_ASID_FLAG); \ - if (tlbi_user) \ - __tlbi_user(r##op, addr); \ - start += __TLBI_RANGE_PAGES(num, scale) << PAGE_SHIFT; \ -@@ -397,6 +411,42 @@ do { \ - } \ - } while (0) - -+#else +#define __flush_tlb_range_op(op, start, pages, stride, \ + asid, tlb_level, tlbi_user) \ +do { \ @@ -2063,6 +2119,8 @@ index b149cf9f91bc..ab07d1bcb040 100644 + pages % 2 == 1) { \ + addr = __TLBI_VADDR(start, asid); \ + __tlbi_level(op, addr, tlb_level); \ ++ if (!arm64_kernel_unmapped_at_el0()) /* added for IEE */ \ ++ __tlbi_level(op, addr | USER_ASID_FLAG, tlb_level); \ + if (tlbi_user) \ + __tlbi_user_level(op, addr, tlb_level); \ + start += stride; \ @@ -2075,6 +2133,8 @@ index b149cf9f91bc..ab07d1bcb040 100644 + addr = __TLBI_VADDR_RANGE(start, asid, scale, \ + num, tlb_level); \ + __tlbi(r##op, addr); \ ++ if (!arm64_kernel_unmapped_at_el0()) /* added for IEE */ \ ++ __tlbi(r##op, addr | USER_ASID_FLAG); \ + if (tlbi_user) \ + __tlbi_user(r##op, addr); \ + start += __TLBI_RANGE_PAGES(num, scale) << PAGE_SHIFT; \ @@ -2084,12 +2144,20 @@ index b149cf9f91bc..ab07d1bcb040 100644 + } \ +} while (0) + ++#else + #define __flush_tlb_range_op(op, start, pages, stride, \ + asid, tlb_level, tlbi_user) \ + do { \ +@@ -399,6 +447,8 @@ do { \ + } \ + } while (0) + +#endif //if defined(CONFIG_IEE) || defined(CONFIG_KOI) + #define __flush_s2_tlb_range_op(op, start, pages, stride, tlb_level) \ __flush_tlb_range_op(op, start, pages, stride, 0, tlb_level, false) -@@ -456,7 +506,7 @@ static inline void flush_tlb_kernel_range(unsigned long start, unsigned long end +@@ -467,7 +517,7 @@ static inline void flush_tlb_kernel_range(unsigned long start, unsigned long end return; } @@ -2098,7 +2166,7 @@ index b149cf9f91bc..ab07d1bcb040 100644 end = __TLBI_VADDR(end, 0); dsb(ishst); -@@ -472,9 +522,9 @@ static inline void flush_tlb_kernel_range(unsigned long start, unsigned long end +@@ -483,9 +533,9 @@ static inline void flush_tlb_kernel_range(unsigned long start, unsigned long end */ static inline void __flush_tlb_kernel_pgtable(unsigned long kaddr) { @@ -2191,7 +2259,7 @@ index e997ad275afb..e105f633355a 100644 #endif #ifdef CONFIG_AARCH32_EL0 diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c -index a686a96d966a..7b8bd91262e2 100644 +index 46813132a09f..412006aa323c 100644 --- a/arch/arm64/kernel/cpu_errata.c +++ b/arch/arm64/kernel/cpu_errata.c @@ -80,7 +80,11 @@ hisilicon_1980005_enable(const struct arm64_cpu_capabilities *__unused) @@ -2231,10 +2299,21 @@ index a686a96d966a..7b8bd91262e2 100644 #ifdef CONFIG_HISILICON_ERRATUM_HIP08_RU_PREFETCH diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c -index 316c57b19c93..ed2d72575420 100644 +index 74e445251b51..ebc1e776b175 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c -@@ -1622,7 +1622,11 @@ static void cpu_emulate_effective_ctr(const struct arm64_cpu_capabilities *__unu +@@ -94,6 +94,10 @@ + #include + #include + ++#ifdef CONFIG_IEE ++#include ++#endif ++ + /* Kernel representation of AT_HWCAP and AT_HWCAP2 */ + static DECLARE_BITMAP(elf_hwcap, MAX_CPU_FEATURES) __read_mostly; + +@@ -1612,7 +1616,11 @@ static void cpu_emulate_effective_ctr(const struct arm64_cpu_capabilities *__unu * value. */ if (!(read_cpuid_cachetype() & BIT(CTR_EL0_IDC_SHIFT))) @@ -2246,7 +2325,7 @@ index 316c57b19c93..ed2d72575420 100644 } static bool has_cache_dic(const struct arm64_cpu_capabilities *entry, -@@ -1883,7 +1887,11 @@ static inline void __cpu_enable_hw_dbm(void) +@@ -1873,7 +1881,11 @@ static inline void __cpu_enable_hw_dbm(void) { u64 tcr = read_sysreg(tcr_el1) | TCR_HD; @@ -2258,7 +2337,7 @@ index 316c57b19c93..ed2d72575420 100644 isb(); local_flush_tlb_all(); } -@@ -2066,7 +2074,9 @@ static void cpu_enable_pan(const struct arm64_cpu_capabilities *__unused) +@@ -2056,7 +2068,9 @@ static void cpu_enable_pan(const struct arm64_cpu_capabilities *__unused) */ WARN_ON_ONCE(in_interrupt()); @@ -2268,7 +2347,7 @@ index 316c57b19c93..ed2d72575420 100644 set_pstate_pan(1); } #endif /* CONFIG_ARM64_PAN */ -@@ -2131,7 +2141,11 @@ static bool has_generic_auth(const struct arm64_cpu_capabilities *entry, +@@ -2121,7 +2135,11 @@ static bool has_generic_auth(const struct arm64_cpu_capabilities *entry, static void cpu_enable_e0pd(struct arm64_cpu_capabilities const *cap) { if (this_cpu_has_cap(ARM64_HAS_E0PD)) @@ -2280,7 +2359,19 @@ index 316c57b19c93..ed2d72575420 100644 } #endif /* CONFIG_ARM64_E0PD */ -@@ -2234,7 +2248,11 @@ static void bti_enable(const struct arm64_cpu_capabilities *__unused) +@@ -2214,7 +2232,11 @@ static void nmi_enable(const struct arm64_cpu_capabilities *__unused) + * avoid leaving things masked. + */ + _allint_clear(); ++ #ifdef CONFIG_IEE ++ sysreg_clear_set_iee_si(sctlr_el1, SCTLR_EL1_SPINTMASK, SCTLR_EL1_NMI); ++ #else + sysreg_clear_set(sctlr_el1, SCTLR_EL1_SPINTMASK, SCTLR_EL1_NMI); ++ #endif + isb(); + } + #endif +@@ -2229,7 +2251,11 @@ static void bti_enable(const struct arm64_cpu_capabilities *__unused) * So, be strict and forbid other BRs using other registers to * jump onto a PACIxSP instruction: */ @@ -2292,6 +2383,97 @@ index 316c57b19c93..ed2d72575420 100644 isb(); } #endif /* CONFIG_ARM64_BTI */ +@@ -2237,7 +2263,11 @@ static void bti_enable(const struct arm64_cpu_capabilities *__unused) + #ifdef CONFIG_ARM64_MTE + static void cpu_enable_mte(struct arm64_cpu_capabilities const *cap) + { ++ #ifdef CONFIG_IEE ++ sysreg_clear_set_iee_si(sctlr_el1, 0, SCTLR_ELx_ATA | SCTLR_EL1_ATA0); ++ #else + sysreg_clear_set(sctlr_el1, 0, SCTLR_ELx_ATA | SCTLR_EL1_ATA0); ++ #endif + + mte_cpu_setup(); + +@@ -2271,7 +2301,11 @@ static bool is_kvm_protected_mode(const struct arm64_cpu_capabilities *entry, in + + static void cpu_trap_el0_impdef(const struct arm64_cpu_capabilities *__unused) + { ++ #ifdef CONFIG_IEE ++ sysreg_clear_set_iee_si(sctlr_el1, 0, SCTLR_EL1_TIDCP); ++ #else + sysreg_clear_set(sctlr_el1, 0, SCTLR_EL1_TIDCP); ++ #endif + } + + static void cpu_enable_dit(const struct arm64_cpu_capabilities *__unused) +@@ -2281,7 +2315,11 @@ static void cpu_enable_dit(const struct arm64_cpu_capabilities *__unused) + + static void cpu_enable_mops(const struct arm64_cpu_capabilities *__unused) + { ++ #ifdef CONFIG_IEE ++ sysreg_clear_set_iee_si(sctlr_el1, 0, SCTLR_EL1_MSCEn); ++ #else + sysreg_clear_set(sctlr_el1, 0, SCTLR_EL1_MSCEn); ++ #endif + } + + /* Internal helper functions to match cpu capability type */ +@@ -3475,6 +3513,43 @@ static void __init setup_system_capabilities(void) + enable_cpu_capabilities(SCOPE_ALL & ~SCOPE_BOOT_CPU); + } + ++#ifdef CONFIG_IEE ++ ++static void iee_si_test_end(void) ++{ ++ pr_info("IEE: testing iee_exec_entry sctlr...\n"); ++ iee_rwx_gate_entry(IEE_WRITE_SCTLR, read_sysreg(sctlr_el1)& ~SCTLR_ELx_M); ++ pr_info("IEE: testing iee_exec_entry ttbr0_el1...\n"); ++ iee_rwx_gate_entry(IEE_WRITE_TTBR0, read_sysreg(ttbr0_el1)); ++ pr_info("IEE: testing iee_exec_entry vbar...\n"); ++ iee_rwx_gate_entry(IEE_WRITE_VBAR, read_sysreg(vbar_el1)); ++ pr_info("IEE: testing iee_exec_entry tcr...\n"); ++ iee_rwx_gate_entry(IEE_WRITE_TCR, read_sysreg(tcr_el1)); ++ // pr_info("IEE: testing iee_exec_entry mdscr...\n"); ++ // iee_rwx_gate_entry(IEE_WRITE_MDSCR, read_sysreg(mdscr_el1)); ++ // pr_info("IEE: testing iee_exec_entry afsr0...\n"); ++ // iee_rwx_gate_entry(IEE_WRITE_AFSR0); ++ #ifdef CONFIG_KOI ++ write_sysreg(read_sysreg(ttbr0_el1)+0x3000000000000, ttbr0_el1); ++ pr_info("IEE: current TTBR1_EL1:%llx, TTBR0:%llx\n", read_sysreg(ttbr1_el1), read_sysreg(ttbr0_el1)); ++ pr_info("IEE: testing iee_exec_entry switch to koi...\n"); ++ iee_rwx_gate_entry(IEE_SWITCH_TO_KOI, phys_to_ttbr(__pa_symbol(swapper_pg_dir))); ++ pr_info("IEE: current TTBR1_EL1:%llx, TTBR0:%llx\n", read_sysreg(ttbr1_el1), read_sysreg(ttbr0_el1)); ++ pr_info("IEE: testing iee_exec_entry switch to kernel...\n"); ++ iee_rwx_gate_entry(IEE_SWITCH_TO_KERNEL); ++ #endif ++} ++ ++/* Finish iee rwx gate initializations. */ ++static void __init iee_si_init_done(void) ++{ ++ // Prepare data for iee rwx gate ++ iee_si_prepare_data(); ++ // All initialization is done. Do some simple tests. ++ iee_si_test_end(); ++} ++#endif ++ + void __init setup_cpu_features(void) + { + u32 cwg; +@@ -3502,6 +3577,10 @@ void __init setup_cpu_features(void) + if (!cwg) + pr_warn("No Cache Writeback Granule information, assuming %d\n", + ARCH_DMA_MINALIGN); ++ ++ #ifdef CONFIG_IEE ++ iee_si_init_done(); ++ #endif + } + + static int enable_mismatched_32bit_el0(unsigned int cpu) diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c index 745aefddd9a3..265417e0ad81 100644 --- a/arch/arm64/kernel/debug-monitors.c @@ -2328,10 +2510,10 @@ index 08274e4317b2..0d259e355c90 100644 regs->lockdep_hardirqs = lockdep_hardirqs_enabled(); diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S -index a6030913cd58..4f8dd74aceeb 100644 +index 7fcbee0f6c0e..dee813ee6aad 100644 --- a/arch/arm64/kernel/entry.S +++ b/arch/arm64/kernel/entry.S -@@ -29,12 +29,390 @@ +@@ -29,12 +29,391 @@ #include #include @@ -2341,6 +2523,7 @@ index a6030913cd58..4f8dd74aceeb 100644 +#define BAD_SP_EL0 0 +#define BAD_ELR_EL1 1 +#define BAD_TCR_EL1 2 ++#define BAD_IEE_SI 4 +#endif + .macro clear_gp_regs @@ -2722,7 +2905,7 @@ index a6030913cd58..4f8dd74aceeb 100644 .macro kernel_ventry, el:req, ht:req, regsize:req, label:req .align 7 .Lventry_start\@: -@@ -151,6 +529,17 @@ alternative_else_nop_endif +@@ -151,6 +530,17 @@ alternative_else_nop_endif #endif .endm @@ -2740,7 +2923,7 @@ index a6030913cd58..4f8dd74aceeb 100644 /* Clear the MTE asynchronous tag check faults */ .macro clear_mte_async_tcf thread_sctlr #ifdef CONFIG_ARM64_MTE -@@ -224,6 +613,14 @@ alternative_cb_end +@@ -224,6 +614,14 @@ alternative_cb_end ldr_this_cpu tsk, __entry_task, x20 msr sp_el0, tsk @@ -2755,7 +2938,7 @@ index a6030913cd58..4f8dd74aceeb 100644 /* * Ensure MDSCR_EL1.SS is clear, since we can unmask debug exceptions * when scheduling. -@@ -276,6 +673,13 @@ alternative_else_nop_endif +@@ -276,6 +674,13 @@ alternative_else_nop_endif scs_load_current .else @@ -2769,7 +2952,7 @@ index a6030913cd58..4f8dd74aceeb 100644 add x21, sp, #PT_REGS_SIZE get_current_task tsk .endif /* \el == 0 */ -@@ -333,9 +737,11 @@ alternative_else_nop_endif +@@ -333,9 +738,11 @@ alternative_else_nop_endif .endm .macro kernel_exit, el @@ -2781,7 +2964,7 @@ index a6030913cd58..4f8dd74aceeb 100644 #ifdef CONFIG_ARM64_PSEUDO_NMI alternative_if_not ARM64_HAS_GIC_PRIO_MASKING -@@ -411,6 +817,50 @@ alternative_else_nop_endif +@@ -411,6 +818,41 @@ alternative_else_nop_endif msr elr_el1, x21 // set up the return data msr spsr_el1, x22 @@ -2807,15 +2990,6 @@ index a6030913cd58..4f8dd74aceeb 100644 + b.ne 5f + #endif + -+ // write dbg ctrl registers for breakpoint 0 to serve user ptrace. -+ //mrs x5, afsr0_el1 -+ //cbz x5, 1145f // skip if not used by user -+ //ldr_this_cpu x1, iee_si_user_bvr0, x2 -+ //ldr_this_cpu x3, iee_si_user_bcr0, x4 -+ //msr dbgbvr0_el1, x1 -+ //msr dbgbcr0_el1, x3 -+1145: -+ + .endif + +#else @@ -2832,25 +3006,7 @@ index a6030913cd58..4f8dd74aceeb 100644 ldp x0, x1, [sp, #16 * 0] ldp x2, x3, [sp, #16 * 1] ldp x4, x5, [sp, #16 * 2] -@@ -447,6 +897,17 @@ alternative_else_nop_endif - add sp, sp, #PT_REGS_SIZE // restore sp - br x29 - #endif -+ -+#ifdef CONFIG_IEE -+5: -+ // ELR_EL1 check fail -+ mov x0, sp -+ mov x1, #BAD_ELR_EL1 -+ mrs x2, esr_el1 -+ bl iee_bad_mode -+ ASM_BUG() -+#endif -+ - .else - ldr lr, [sp, #S_LR] - add sp, sp, #PT_REGS_SIZE // restore sp -@@ -565,12 +1026,193 @@ SYM_CODE_START_LOCAL(__bad_stack) +@@ -569,12 +1011,167 @@ SYM_CODE_START_LOCAL(__bad_stack) SYM_CODE_END(__bad_stack) #endif /* CONFIG_VMAP_STACK */ @@ -2859,45 +3015,19 @@ index a6030913cd58..4f8dd74aceeb 100644 + */ + .macro iee_exception_entry, el + -+ /* skip setting breakpoint 0 if user hasn't change it. */ -+ //.if \el == 0 -+ //mrs x0, afsr0_el1 -+ //cbz x0, 1148f -+ //.endif -+ -+ //b 1147f -+ /* enable breakpoint 0 to proctect iee rwx gate */ -+ //adrp x1, iee_rwx_gate_entry -+ //add x1, x1, #:lo12:iee_rwx_gate_entry -+#ifdef CONFIG_KOI -+ //add x1, x1, #120 -+#else -+ //add x1, x1, #36 -+#endif -+1145: -+ //msr dbgbvr0_el1, x1 -+ //mov x2, 0x21e7 -+1146: -+ //msr dbgbcr0_el1, x2 -+ //isb -+ -+1147: -+ /* check val of dbg ctrl registers */ -+ //mrs x3, dbgbvr0_el1 -+ //adrp x1, iee_rwx_gate_entry -+ //add x1, x1, #:lo12:iee_rwx_gate_entry -+#ifdef CONFIG_KOI -+ //add x1, x1, #120 -+#else -+ //add x1, x1, #36 -+#endif -+ //cmp x1, x3 -+ //bne 1145b -+ //mov x2, 0x21e7 -+ //mrs x0, dbgbcr0_el1 -+ //cmp x2, x0 -+ //bne 1146b -+ //enable_dbg ++ /* Check whether exception is permmited. */ ++ ldr x1, =__iee_si_no_irq ++ cmp x1, x22 ++ b.hi 1148f ++ ldr x1, =__iee_si_end ++ cmp x1, x22 ++ b.lo 1148f ++ /* ELR check fail */ ++ mov x0, sp ++ mov x1, #BAD_IEE_SI ++ mrs x2, esr_el1 ++ bl iee_bad_mode ++ ASM_BUG() +1148: + + /* el0 set hpds */ @@ -3044,7 +3174,7 @@ index a6030913cd58..4f8dd74aceeb 100644 .if \el == 0 b ret_to_user .else -@@ -840,6 +1482,13 @@ SYM_FUNC_START(cpu_switch_to) +@@ -844,6 +1441,13 @@ SYM_FUNC_START(cpu_switch_to) ldr lr, [x8] mov sp, x9 msr sp_el0, x1 @@ -3058,7 +3188,7 @@ index a6030913cd58..4f8dd74aceeb 100644 ptrauth_keys_install_kernel x1, x8, x9, x10 scs_save x0 scs_load_current -@@ -1029,6 +1678,13 @@ SYM_CODE_START(__sdei_asm_handler) +@@ -1033,6 +1637,13 @@ SYM_CODE_START(__sdei_asm_handler) mrs x28, sp_el0 ldr_this_cpu dst=x0, sym=__entry_task, tmp=x1 msr sp_el0, x0 @@ -3072,8 +3202,24 @@ index a6030913cd58..4f8dd74aceeb 100644 /* If we interrupted the kernel point to the previous stack/frame. */ and x0, x3, #0xc +diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c +index 5cdfcc9e3e54..c0af965bd92e 100644 +--- a/arch/arm64/kernel/fpsimd.c ++++ b/arch/arm64/kernel/fpsimd.c +@@ -1309,7 +1309,11 @@ void sme_kernel_enable(const struct arm64_cpu_capabilities *__always_unused p) + isb(); + + /* Allow EL0 to access TPIDR2 */ ++ #ifdef CONFIG_IEE ++ iee_rwx_gate_entry(IEE_WRITE_sctlr_el1, read_sysreg(SCTLR_EL1) | SCTLR_ELx_ENTP2); ++ #else + write_sysreg(read_sysreg(SCTLR_EL1) | SCTLR_ELx_ENTP2, SCTLR_EL1); ++ #endif + isb(); + } + diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S -index 7b236994f0e1..b1ecb594c968 100644 +index 6517bf2644a0..5c75e069d877 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -464,6 +464,42 @@ SYM_FUNC_END(create_kernel_mapping) @@ -3119,7 +3265,7 @@ index 7b236994f0e1..b1ecb594c968 100644 /* * The following fragment of code is executed with the MMU enabled. * -@@ -656,6 +692,18 @@ SYM_FUNC_START_LOCAL(secondary_startup) +@@ -661,6 +697,18 @@ SYM_FUNC_START_LOCAL(secondary_startup) SYM_FUNC_END(secondary_startup) .text @@ -3138,7 +3284,7 @@ index 7b236994f0e1..b1ecb594c968 100644 SYM_FUNC_START_LOCAL(__secondary_switched) mov x0, x20 bl set_cpu_boot_mode_flag -@@ -672,7 +720,11 @@ SYM_FUNC_START_LOCAL(__secondary_switched) +@@ -677,7 +725,11 @@ SYM_FUNC_START_LOCAL(__secondary_switched) ldr x2, [x0, #CPU_BOOT_TASK] cbz x2, __secondary_too_slow @@ -3150,8 +3296,19 @@ index 7b236994f0e1..b1ecb594c968 100644 #ifdef CONFIG_ARM64_PTR_AUTH ptrauth_keys_init_cpu x2, x3, x4, x5 +@@ -746,6 +798,10 @@ SYM_FUNC_START(__enable_mmu) + cmp x3, #ID_AA64MMFR0_EL1_TGRAN_SUPPORTED_MAX + b.gt __no_granule_support + phys_to_ttbr x2, x2 ++#ifdef CONFIG_IEE ++ mov x3, #1 ++ bfi x2, x3, #48, #16 // ASID 1 is used by IEE rwx gate. ++#endif + msr ttbr0_el1, x2 // load TTBR0 + load_ttbr1 x1, x1, x3 + diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c -index 02870beb271e..02cdb79f8af7 100644 +index 02870beb271e..1c14428a3ed4 100644 --- a/arch/arm64/kernel/hibernate.c +++ b/arch/arm64/kernel/hibernate.c @@ -34,6 +34,10 @@ @@ -3165,7 +3322,7 @@ index 02870beb271e..02cdb79f8af7 100644 /* * Hibernate core relies on this value being 0 on resume, and marks it * __nosavedata assuming it will keep the resume kernel's '0' value. This -@@ -197,6 +201,9 @@ static int create_safe_exec_page(void *src_start, size_t length, +@@ -197,12 +201,22 @@ static int create_safe_exec_page(void *src_start, size_t length, phys_addr_t trans_ttbr0; unsigned long t0sz; int rc; @@ -3175,14 +3332,19 @@ index 02870beb271e..02cdb79f8af7 100644 if (!page) return -ENOMEM; -@@ -207,6 +214,7 @@ static int create_safe_exec_page(void *src_start, size_t length, + + memcpy(page, src_start, length); + caches_clean_inval_pou((unsigned long)page, (unsigned long)page + length); ++ ++ #ifdef CONFIG_PTP ++ iee_addr = __phys_to_iee(__pa(page_address(page))); ++ set_iee_page_valid(iee_addr); ++ iee_set_logical_mem_ro((unsigned long)page_address(page)); ++ #endif ++ + rc = trans_pgd_idmap_page(&trans_info, &trans_ttbr0, &t0sz, page); if (rc) return rc; - -+ // zgcXXX: lack a lot of things. - cpu_install_ttbr0(trans_ttbr0, t0sz); - *phys_dst_addr = virt_to_phys(page); - diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c index d39a8787edf2..b5ac4b7670bc 100644 --- a/arch/arm64/kernel/hw_breakpoint.c @@ -3340,10 +3502,10 @@ index 000000000000..123c68c5cc4e \ No newline at end of file diff --git a/arch/arm64/kernel/iee/iee-func.c b/arch/arm64/kernel/iee/iee-func.c new file mode 100644 -index 000000000000..8ef0b769af73 +index 000000000000..7764dbd41555 --- /dev/null +++ b/arch/arm64/kernel/iee/iee-func.c -@@ -0,0 +1,189 @@ +@@ -0,0 +1,187 @@ +#include "asm/pgtable.h" +#include +#include @@ -3365,7 +3527,7 @@ index 000000000000..8ef0b769af73 + pte_t *ptep = pte_offset_kernel(pmdp, addr); + pte_t pte = READ_ONCE(*ptep); + -+ if((addr < (((unsigned long)0xffff << 48) + IEE_OFFSET)) | (addr > (((unsigned long)0xffff8 << 44)))) ++ if((addr < (PAGE_OFFSET + IEE_OFFSET)) | (addr > (PAGE_OFFSET + BIT(vabits_actual - 1)))) + return; + + pte = __pte(pte_val(pte) | 0x1); @@ -3388,7 +3550,7 @@ index 000000000000..8ef0b769af73 + pte_t *ptep = pte_offset_kernel(pmdp, addr); + pte_t pte = READ_ONCE(*ptep); + -+ if((addr < (((unsigned long)0xffff << 48) + IEE_OFFSET)) | (addr > (((unsigned long)0xffff8 << 44)))) ++ if((addr < (PAGE_OFFSET + IEE_OFFSET)) | (addr > (PAGE_OFFSET + BIT(vabits_actual - 1)))) + return; + + pte = __pte(pte_val(pte) & ~0x1); @@ -3411,7 +3573,7 @@ index 000000000000..8ef0b769af73 + pte_t *ptep = pte_offset_kernel(pmdp, addr); + pte_t pte = READ_ONCE(*ptep); + -+ if(addr < ((unsigned long)0xffff << 48)) ++ if(addr < PAGE_OFFSET) + return; + + pte = __pte((pte_val(pte) | PTE_RDONLY) & ~PTE_DBM); @@ -3434,7 +3596,7 @@ index 000000000000..8ef0b769af73 + pte_t *ptep = pte_offset_kernel(pmdp, addr); + pte_t pte = READ_ONCE(*ptep); + -+ if((addr < ((unsigned long)0xffff << 48)) | (addr > ((unsigned long)0xffff4 << 44))) ++ if((addr < PAGE_OFFSET) | (addr > (PAGE_OFFSET + BIT(vabits_actual - 2)))) + return; + + pte = __pte(pte_val(pte) | PTE_DBM); @@ -3521,8 +3683,6 @@ index 000000000000..8ef0b769af73 + pte_t *ptep = pte_offset_kernel(pmdp, addr); + + int i; -+ -+ __p4d_populate(p4dp, __p4d_to_phys(p4d), PGD_APT | PUD_TYPE_TABLE); + for(i = 0; i < 4; i++) + { + pte_t pte = READ_ONCE(*ptep); @@ -3536,10 +3696,10 @@ index 000000000000..8ef0b769af73 \ No newline at end of file diff --git a/arch/arm64/kernel/iee/iee-gate.S b/arch/arm64/kernel/iee/iee-gate.S new file mode 100644 -index 000000000000..b2e847995ff1 +index 000000000000..6de99a018bde --- /dev/null +++ b/arch/arm64/kernel/iee/iee-gate.S -@@ -0,0 +1,231 @@ +@@ -0,0 +1,174 @@ +#include +#include +#include @@ -3626,100 +3786,47 @@ index 000000000000..b2e847995ff1 + .popsection + +#include -+#define BAD_IEE 3 ++#define BAD_IEE 4 ++#define BAD_IEE_SI 5 ++ ++#define SYS_TCR_EL1_HPD1 0x40000000000 ++#define SYS_TCR_EL1_A1 0x400000 + + .pushsection ".iee.exec_entry", "ax" + +SYM_FUNC_START(iee_rwx_gate_entry) + /* Disable irq first. */ + mrs x15, daif // use x15 to restore daif -+ msr DAIFSet, #0x2 -+ -+ msr dbgbvr0_el1, xzr // clear breakpoint 0 ++ msr DAIFSet, #0xf + isb + -+ msr pan, #0 -+#ifdef CONFIG_KOI -+ cmp x0, #7 -+ b.lo 3f -+ -+ /* Use x13 to mark KOI switch branches. */ -+ mov x13, #1 -+ -+ /* Get ASID from ttbr0 to calculate ASID of TTBR1. */ -+ mrs x10, ttbr0_el1 -+ ubfx x12, x10, #48, #16 -+ /* ASID of ttbr0 must be odd number except 1 when KOI switch. */ -+ tbz x12, #0, error -+ cmp x12, #1 -+ b.eq error -+ bic x12, x12, #1 -+ -+ cmp x0, #7 -+ b.eq 2f -+ /* Branch of switching to KOI pgd. */ -+ /* TODO: verify the incomming pdg addr val. */ -+ mov x9, x1 -+ bfi x9, x12, #48, #16 -+ b 1f -+2: /* Branch of switching back to kernel. */ -+ adrp x9, iee_base_swapper_pg_dir -+ ldr x9, [x9, #:lo12:iee_base_swapper_pg_dir] -+ bfi x9, x12, #48, #16 -+ b 1f -+3: /* Branch of switching to IEE pgd. */ -+ mov x13, #0 -+#endif -+// trans va of iee_pg_dir to pa to switch ttbr1 -+ mrs x14, ttbr1_el1 // use x14 to restore ttbr1 -+ adrp x9, iee_base_iee_pg_dir -+ ldr x9, [x9, #:lo12:iee_base_iee_pg_dir] -+ movk x9, #1, lsl 48 -+1: -+ msr ttbr1_el1, x9 ++ /* Set HPD1 = 0 to exec follwing codes in U RWX page */ ++ mrs x9, tcr_el1 ++ bic x9, x9, #SYS_TCR_EL1_HPD1 ++ bic x9, x9, #SYS_TCR_EL1_A1 ++ msr tcr_el1, x9 + isb -+ /* Reset dbgbvr0_el1 and check its value to prevent reuse attack */ -+4: -+ adr x9, 1b -+ msr dbgbvr0_el1, x9 // protect msr ttbr1 inst -+ isb -+ mrs x10, dbgbvr0_el1 -+ adr x11, 1b -+ cmp x10, x11 -+ b.ne 4b -+#ifdef CONFIG_KOI -+ cbz x13, 5f -+ /* Restore PAN and DAIF to end KOI switch */ -+ msr pan, #1 -+ msr daif, x15 -+ ret -+5: -+#endif -+ /* jump to iee si codes which are only visible to iee pgd. */ ++ + b iee_rwx_gate_tramp -+error: -+/* -+ mov x0, sp -+ mov x1, #BAD_TTBR0_ASID -+ mrs x2, esr_el1 -+ bl iee_bad_mode -+*/ -+ ASM_BUG() +SYM_FUNC_END(iee_rwx_gate_entry) -+EXPORT_SYMBOL(iee_rwx_gate_entry) -+ + .popsection + -+ .pushsection ".iee.si_text", "ax" ++ .pushsection ".iee.si_text", "awx" + +SYM_FUNC_START(iee_rwx_gate_tramp) -+ /* use x13 to store current stack */ ++ /* Check tcr val. */ ++ mrs x10, tcr_el1 ++ adrp x12, iee_si_tcr // tcr val shall be const after init ++ ldr x12, [x12, #:lo12:iee_si_tcr] ++ cbz x12, 1f ++ cmp x12, x10 ++ b.ne 3f ++1: + mov x13, sp -+ -+ /* If iee hasn't initialized, skip stack switch. */ -+ ldr x11, =iee_init_done; ++ /* If iee hasn't been initialized, skip stack switch. */ ++ ldr x11, =iee_init_done + ldr x10, [x11] -+ cbz x10, 1f ++ cbz x10, 2f + + /* Switch to iee stack */ + mrs x9, sp_el0 // x9 -> task_struct @@ -3729,39 +3836,35 @@ index 000000000000..b2e847995ff1 + // load iee stack + ldr x10, [x11, #iee_from_token_offset] + mov sp, x10 -+1: -+ str x13, [sp, #-16]! // Switch stack end + -+ /* In context switch, change x14 here to modify ASID of TTBR1 when iee exits */ -+ cmp w0, #6 // for IEE_CONTEXT_SWITCH -+ b.ne 2f -+ ubfx x10, x1, #48, #16 // get ASID field of incomming TTBR0 value. -+ bic x10, x10, #1 -+ bfi x14, x10, #48, #16 // insert new ASID to x14 -+ -+ /* x15 stores daif and x14 stores previous ttbr1 */ ++ /* x15 stores daif and x13 stores previous sp */ +2: -+ stp x15, x14, [sp, #-32]! ++ stp x15, x13, [sp, #-32]! + stp x29, x30, [sp, #16] + bl iee_si_handler // enter actual handler + ldp x29, x30, [sp, #16] + + b iee_rwx_gate_exit // jump to iee exit ++3: ++ mov x0, sp ++ mov x1, #BAD_IEE_SI ++ mrs x2, esr_el1 ++ bl iee_bad_mode ++ ASM_BUG() +SYM_FUNC_END(iee_rwx_gate_tramp) -+ ++ + .popsection + + .pushsection ".iee.exec_exit", "ax" + +SYM_FUNC_START(iee_rwx_gate_exit) -+ ldp x15, x14, [sp], #32 -+// switch to kernel stack -+ ldr x13, [sp], #16 -+ mov sp, x13 -+// switch end -+ msr pan, #1 -+ /* Switch back to kernel PGD. ASID maybe changed by iee_rwx_gate_tramp. */ -+ msr ttbr1_el1, x14 ++ ldp x15, x13, [sp], #32 ++ mov sp, x13 // switch to kernel stack ++ mrs x9, tcr_el1 ++ orr x9, x9, #SYS_TCR_EL1_HPD1 ++ orr x9, x9, #SYS_TCR_EL1_A1 ++ msr tcr_el1, x9 ++/* --------Page boundary-------- */ + isb + msr daif, x15 + isb @@ -3773,10 +3876,10 @@ index 000000000000..b2e847995ff1 +#endif diff --git a/arch/arm64/kernel/iee/iee.c b/arch/arm64/kernel/iee/iee.c new file mode 100644 -index 000000000000..d73be9f005d3 +index 000000000000..6b9f7d40df67 --- /dev/null +++ b/arch/arm64/kernel/iee/iee.c -@@ -0,0 +1,1359 @@ +@@ -0,0 +1,1360 @@ +#include "linux/sched.h" +#include +#include @@ -3813,6 +3916,7 @@ index 000000000000..d73be9f005d3 +void __iee_code _iee_set_cred_fsgid(struct cred *cred, kgid_t fsgid); +void __iee_code _iee_set_cred_user(struct cred *cred, struct user_struct *user); +void __iee_code _iee_set_cred_user_ns(struct cred *cred, struct user_namespace *user_ns); ++void __iee_code _iee_set_cred_ucounts(struct cred *cred, struct ucounts *ucounts); +void __iee_code _iee_set_cred_group_info(struct cred *cred, struct group_info *group_info); +void __iee_code _iee_set_cred_securebits(struct cred *cred, unsigned securebits); +void __iee_code _iee_set_cred_cap_inheritable(struct cred *cred, kernel_cap_t cap_inheritable); @@ -3827,7 +3931,7 @@ index 000000000000..d73be9f005d3 +void __iee_code _iee_set_cred_request_key_auth(struct cred *cred, struct key *request_key_auth); +void __iee_code _iee_set_cred_non_rcu(struct cred *cred, int non_rcu); +void __iee_code _iee_set_cred_atomic_set_usage(struct cred *cred, int i); -+bool __iee_code _iee_set_cred_atomic_op_usage(struct cred *cred, int flag); ++bool __iee_code _iee_set_cred_atomic_op_usage(struct cred *cred, int flag, int nr); +void __iee_code _iee_set_cred_security(struct cred *cred, void *security); +void __iee_code _iee_set_cred_rcu(struct cred *cred, struct rcu_head *rcu); +void __iee_code _iee_memset(void *ptr, int data, size_t n); @@ -3985,6 +4089,12 @@ index 000000000000..d73be9f005d3 + _iee_set_cred_user_ns(cred, user_ns); +} + ++void __iee_code iee_wrapper_set_cred_ucounts(va_list args) { ++ struct cred *cred = va_arg(args, struct cred *); ++ struct ucounts *ucounts = va_arg(args, struct ucounts *); ++ _iee_set_cred_ucounts(cred, ucounts); ++} ++ +void __iee_code iee_wrapper_set_cred_group_info(va_list args) { + struct cred *cred = va_arg(args, struct cred *); + struct group_info *group_info = va_arg(args, struct group_info *); @@ -4072,7 +4182,8 @@ index 000000000000..d73be9f005d3 +u64 __iee_code iee_wrapper_set_cred_atomic_op_usage(va_list args) { + struct cred *cred = va_arg(args, struct cred *); + int flag = va_arg(args, int); -+ return (u64)_iee_set_cred_atomic_op_usage(cred, flag); ++ int nr = va_arg(args, int); ++ return (u64)_iee_set_cred_atomic_op_usage(cred, flag, nr); +} + +void __iee_code iee_wrapper_set_cred_security(va_list args) { @@ -4252,6 +4363,7 @@ index 000000000000..d73be9f005d3 + iee_wrapper_free_token, + (iee_wrapper_func)iee_wrapper_read_token_stack, + iee_wrapper_write_entry_task, ++ iee_wrapper_set_cred_ucounts, +#ifdef CONFIG_KOI + (iee_wrapper_func)iee_wrapper_read_koi_stack, + iee_wrapper_write_koi_stack, @@ -4324,7 +4436,7 @@ index 000000000000..d73be9f005d3 + default: + { + #ifndef CONFIG_KOI -+ if((flag < IEE_WRITE_IN_BYTE) | (flag > IEE_WRITE_ENTRY_TASK)) ++ if((flag < IEE_WRITE_IN_BYTE) | (flag > IEE_OP_SET_CRED_UCOUNTS)) + panic("Invalid iee flag.\n"); + #else + if((flag < IEE_WRITE_IN_BYTE) | (flag > IEE_WRITE_KOI_STACK_BASE)) @@ -4506,20 +4618,20 @@ index 000000000000..d73be9f005d3 + cred->security = security; +} + -+bool __iee_code _iee_set_cred_atomic_op_usage(struct cred *cred, int flag) ++bool __iee_code _iee_set_cred_atomic_op_usage(struct cred *cred, int flag, int nr) +{ + cred = (struct cred *)__phys_to_iee(__pa(cred)); + switch (flag) + { -+ case AT_INC: { -+ atomic_long_inc(&cred->usage); ++ case AT_ADD: { ++ atomic_long_add(nr, &cred->usage); + return 0; + } + case AT_INC_NOT_ZERO: { + return atomic_long_inc_not_zero(&cred->usage); + } -+ case AT_DEC_AND_TEST: { -+ return atomic_long_dec_and_test(&cred->usage); ++ case AT_SUB_AND_TEST: { ++ return atomic_long_sub_and_test(nr, &cred->usage); + } + } + return 0; @@ -4609,6 +4721,12 @@ index 000000000000..d73be9f005d3 + cred->group_info = group_info; +} + ++void __iee_code _iee_set_cred_ucounts(struct cred *cred, struct ucounts *ucounts) ++{ ++ cred = (struct cred *)__phys_to_iee(__pa(cred)); ++ cred->ucounts = ucounts; ++} ++ +void __iee_code _iee_set_cred_user_ns(struct cred *cred, struct user_namespace *user_ns) +{ + cred = (struct cred *)__phys_to_iee(__pa(cred)); @@ -4749,7 +4867,7 @@ index 000000000000..d73be9f005d3 + if ((pgd_val(pgd) & PMD_TABLE_BIT) && !check_addr_in_iee_valid(__phys_to_iee(__pgd_to_phys(pgd)))) + panic("You can't use non-iee-pgtable\n"); + -+ if((pgdp >= pgd_offset_pgd((pgd_t *)swapper_pg_dir, (unsigned long)0xffff4 << 44)) && (pgdp < pgd_offset_pgd((pgd_t *)swapper_pg_dir, (unsigned long)0xffff8 << 44)) && !(pgd_val(pgd) & PGD_APT)) ++ if((pgdp >= pgd_offset_pgd((pgd_t *)swapper_pg_dir, PAGE_OFFSET + BIT(vabits_actual - 2))) && (pgdp < pgd_offset_pgd((pgd_t *)swapper_pg_dir, PAGE_OFFSET + BIT(vabits_actual - 1))) && !(pgd_val(pgd) & PGD_APT)) + panic("Set IEE pgd U page.\n"); + + WRITE_ONCE(*((pgd_t *)(__phys_to_iee(__pa_symbol(pgdp)))), pgd); @@ -5001,29 +5119,11 @@ index 000000000000..d73be9f005d3 +} + +/* Data in iee_si_base is visible to all pgd while iee_si_data is private. */ -+unsigned long iee_base_swapper_pg_dir __iee_si_base; -+unsigned long iee_base_iee_pg_dir __iee_si_base; +unsigned long iee_base_idmap_pg_dir __iee_si_data; +unsigned long iee_base_reserved_pg_dir __iee_si_data; +unsigned long iee_base__bp_harden_el1_vectors __iee_si_data; +bool iee_init_done __iee_si_data; -+ -+DEFINE_PER_CPU(unsigned long, iee_si_user_bvr0); -+DEFINE_PER_CPU(unsigned long, iee_si_user_bcr0); -+EXPORT_SYMBOL(iee_si_user_bvr0); -+EXPORT_SYMBOL(iee_si_user_bcr0); -+ -+// unsigned long iee_base_kimage_voffset __iee_si_base; -+// unsigned long iee_base_memstart_addr __iee_si_data; -+// /* replace __pa macro inside IEE rwx gate. */ -+// #define __iee_si_is_lm_address(addr) (((u64)(addr) ^ PAGE_OFFSET) < (PAGE_END - PAGE_OFFSET)) -+// #define __iee_si_lm_to_phys(addr) (((addr) & ~PAGE_OFFSET) + iee_base_memstart_addr) -+// #define __iee_si_kimg_to_phys(addr) ((addr) - iee_base_kimage_voffset) -+ -+// #define __iee_si_virt_to_phys(x) ({ -+// __iee_si_is_lm_address(x) ? __iee_si_lm_to_phys(x) : __iee_si_kimg_to_phys(x); -+// }) -+// #define __iee_si_pa(x) __iee_si_virt_to_phys((unsigned long)(x)) ++unsigned long iee_si_tcr __iee_si_data; + +static u64 __iee_si_code inline iee_si_mask(unsigned long mask, unsigned long new_val, unsigned long old_val) +{ @@ -5059,13 +5159,22 @@ index 000000000000..d73be9f005d3 + new_asid = new_val >> 48; + + // Check ASID first -+ if (new_asid!=0 && (new_asid == 1 || new_asid % 2 ==0)) -+ panic("IEE SI warning: TTBR0 ASID invalid: %llx:%llx", new_asid, new_val); ++ if (new_phys == iee_base_reserved_pg_dir){ ++ if (new_asid != 1) ++ panic("IEE SI warning: reserved_pg_dir ASID invalid: %llx:%llx", new_asid, new_val); ++ } ++ // Already reserved asid 1 for iee rwx gate. ++ else if (new_asid == 0){ ++ new_val |= FIELD_PREP(TTBR_ASID_MASK, 1); ++ printk("IEE SI: Modify ASID of %llx to 1.", new_val); ++ } + // TO DO: operations to protect idmap_pg_dir -+ if (new_phys == iee_base_idmap_pg_dir) ++ else if (new_phys == iee_base_idmap_pg_dir) + { -+ printk("IEE SI: switch to idmap_pg_dir."); ++ // printk("IEE SI: switch to idmap_pg_dir.); + } ++ else if (new_asid % 2 ==0) ++ panic("IEE SI warning: TTBR0 ASID invalid: %llx:%llx", new_asid, new_val); + + /* Skip verification if iee hasn't been initialized. */ + if (iee_init_done){ @@ -5090,6 +5199,12 @@ index 000000000000..d73be9f005d3 + } + // all checks are done. + write_sysreg(new_val, ttbr0_el1); ++ ++ // SET ASID in TTBR1 when context switch ++ if (flag == IEE_CONTEXT_SWITCH){ ++ new_val = (read_sysreg(ttbr1_el1) & ~TTBR_ASID_MASK) | FIELD_PREP(TTBR_ASID_MASK, new_asid-1); ++ write_sysreg(new_val, ttbr1_el1); ++ } + break; + } + case IEE_WRITE_VBAR: { @@ -5115,17 +5230,6 @@ index 000000000000..d73be9f005d3 + write_sysreg(new_val, mdscr_el1); + break; + } -+ /* To protect IEE rwx gate by DBG Breakpoint 0 */ -+ case IEE_WRITE_AFSR0: { -+ u64 user_bcr0; -+ /* iee_si_user_bcr0 = 0 means user proc doesn't use breakpoint 0 */ -+ user_bcr0 = this_cpu_read(iee_si_user_bcr0); -+ if (user_bcr0 == 0) -+ write_sysreg(1, afsr0_el1); -+ else -+ write_sysreg(0, afsr0_el1); -+ break; -+ } + } + va_end(pArgs); + return 0; @@ -6480,7 +6584,7 @@ index 000000000000..716ba16ab358 +EXPORT_SYMBOL(koi_map_kostack); \ No newline at end of file diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c -index 4edecaac8f91..6c25c1e7895d 100644 +index cea96ee75d22..cbddc8e464e4 100644 --- a/arch/arm64/kernel/mte.c +++ b/arch/arm64/kernel/mte.c @@ -79,8 +79,13 @@ int memcmp_pages(struct page *page1, struct page *page2) @@ -6498,7 +6602,7 @@ index 4edecaac8f91..6c25c1e7895d 100644 pr_info_once("MTE: enabled in %s mode at EL1\n", mode); diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c -index 068e5bb2661b..82240fc6c421 100644 +index 068e5bb2661b..c98bc1a24fc7 100644 --- a/arch/arm64/kernel/process.c +++ b/arch/arm64/kernel/process.c @@ -467,11 +467,24 @@ static void ssbs_thread_switch(struct task_struct *next) @@ -6526,6 +6630,23 @@ index 068e5bb2661b..82240fc6c421 100644 } /* +@@ -506,11 +519,15 @@ static void erratum_1418040_new_exec(void) + */ + void update_sctlr_el1(u64 sctlr) + { +- /* ++ /* + * EnIA must not be cleared while in the kernel as this is necessary for + * in-kernel PAC. It will be cleared on kernel exit if needed. + */ ++ #ifdef CONFIG_IEE ++ sysreg_clear_set_iee_si(sctlr_el1, SCTLR_USER_MASK & ~SCTLR_ELx_ENIA, sctlr); ++ #else + sysreg_clear_set(sctlr_el1, SCTLR_USER_MASK & ~SCTLR_ELx_ENIA, sctlr); ++ #endif + + /* ISB required for the kernel uaccess routines when setting TCF0. */ + isb(); diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c index 58a97861bfc5..c7839247327d 100644 --- a/arch/arm64/kernel/proton-pack.c @@ -6555,7 +6676,7 @@ index 58a97861bfc5..c7839247327d 100644 } diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c -index 95cb22c083c8..11ff7d3f4392 100644 +index 95cb22c083c8..df73a583a733 100644 --- a/arch/arm64/kernel/setup.c +++ b/arch/arm64/kernel/setup.c @@ -33,6 +33,11 @@ @@ -6570,7 +6691,7 @@ index 95cb22c083c8..11ff7d3f4392 100644 #include #include #include -@@ -335,10 +340,32 @@ u64 cpu_logical_map(unsigned int cpu) +@@ -335,10 +340,30 @@ u64 cpu_logical_map(unsigned int cpu) return __cpu_logical_map[cpu]; } @@ -6578,16 +6699,14 @@ index 95cb22c083c8..11ff7d3f4392 100644 +/* used for secure modification of vbar*/ +extern char __bp_harden_el1_vectors[]; +/* prepare iee rwx gate for senario of ttbr1=init_pg_dir */ -+static void __init iee_si_init_pgd_early(void) ++static void __init iee_si_init_early(void) +{ + /* prepare data used for iee rwx gate. */ -+ iee_base_swapper_pg_dir = phys_to_ttbr(__pa_symbol(swapper_pg_dir)); -+ iee_base_iee_pg_dir = phys_to_ttbr(__pa_symbol(iee_pg_dir)); + iee_base_idmap_pg_dir = phys_to_ttbr(__pa_symbol(idmap_pg_dir)); -+ iee_base_reserved_pg_dir = phys_to_ttbr(__pa_symbol(reserved_pg_dir)); ++ iee_base_reserved_pg_dir = phys_to_ttbr(__pa_symbol(reserved_pg_dir)) ++ | FIELD_PREP(TTBR_ASID_MASK, 1); + iee_base__bp_harden_el1_vectors = (unsigned long)__bp_harden_el1_vectors; -+ // copy init_pg_dir totoally to simplify ttbr1 switch in iee rwx gate. -+ memcpy(iee_pg_dir, init_pg_dir, PAGE_SIZE); ++ iee_si_tcr = 0; +} +#endif + @@ -6597,13 +6716,13 @@ index 95cb22c083c8..11ff7d3f4392 100644 + #ifdef CONFIG_IEE + init_new_context(&init_task, &init_mm); -+ atomic64_set(&init_mm.context.id, (1UL << get_cpu_asid_bits()) | 0x2); ++ atomic64_set(&init_mm.context.id, (1UL << get_cpu_asid_bits()) | INIT_ASID); + #endif + *cmdline_p = boot_command_line; kaslr_init(); -@@ -371,6 +398,14 @@ void __init __no_sanitize_address setup_arch(char **cmdline_p) +@@ -371,6 +396,14 @@ void __init __no_sanitize_address setup_arch(char **cmdline_p) */ local_daif_restore(DAIF_PROCCTX_NOIRQ); @@ -6612,17 +6731,17 @@ index 95cb22c083c8..11ff7d3f4392 100644 + * Map iee si codes to init_pg_dir to run the following + * cpu_uninstall_idmap() which writes ttbr0. + */ -+ iee_si_init_pgd_early(); ++ iee_si_init_early(); +#endif + /* * TTBR0 is only used for the identity mapping at this stage. Make it * point to zero page to avoid speculatively fetching new entries. diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c -index b7b7afb4a8c7..cad7b0a5dd09 100644 +index b7b7afb4a8c7..168a9390d6e9 100644 --- a/arch/arm64/kernel/traps.c +++ b/arch/arm64/kernel/traps.c -@@ -902,6 +902,31 @@ const char *esr_get_class_string(unsigned long esr) +@@ -902,6 +902,32 @@ const char *esr_get_class_string(unsigned long esr) return esr_class_str[ESR_ELx_EC(esr)]; } @@ -6633,6 +6752,7 @@ index b7b7afb4a8c7..cad7b0a5dd09 100644 + "ELR_EL1", + "TCR_EL1", + "TTBR0 ASID" ++ "IEE_SI" +}; + +asmlinkage void notrace iee_bad_mode(struct pt_regs *regs, int reason, unsigned int esr) @@ -6655,10 +6775,10 @@ index b7b7afb4a8c7..cad7b0a5dd09 100644 * bad_el0_sync handles unexpected, but potentially recoverable synchronous * exceptions taken from EL0. diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S -index 3cd7e76cc562..58785cd99a4b 100644 +index 3cd7e76cc562..287eaba7a15b 100644 --- a/arch/arm64/kernel/vmlinux.lds.S +++ b/arch/arm64/kernel/vmlinux.lds.S -@@ -134,6 +134,56 @@ jiffies = jiffies_64; +@@ -134,6 +134,52 @@ jiffies = jiffies_64; #define UNWIND_DATA_SECTIONS #endif @@ -6676,27 +6796,23 @@ index 3cd7e76cc562..58785cd99a4b 100644 + +#ifdef CONFIG_IEE +#define IEE_SI_TEXT \ -+ . = ALIGN(PAGE_SIZE); \ -+ __iee_si_base_start = .; \ -+ *(.iee.si_base) \ + . = ALIGN(PAGE_SIZE); \ -+ __iee_exec_entry_start = .; \ ++ __iee_si_data_start = .; \ ++ *(.iee.si_data) \ ++ . = ALIGN(PAGE_SIZE); \ ++ __iee_exec_entry_start = .; \ ++ __iee_si_no_irq = . + (16); \ + *(.iee.exec_entry) \ -+ . = ALIGN(PAGE_SIZE); \ -+ __iee_exec_entry_end = .; \ -+ __iee_si_text_start = .; \ ++ . = ALIGN(PAGE_SIZE); \ ++ __iee_si_start = .; \ + *(.iee.si_text) \ -+ . = ALIGN(PAGE_SIZE); \ -+ __iee_si_data_start = .; \ -+ *(.iee.si_data) \ -+ . = ALIGN(PAGE_SIZE); \ -+ __iee_si_data_end = .; \ -+ . += PAGE_SIZE - (20); \ -+ __iee_exec_exit = .; \ -+ __iee_exec_exit_pg = . + (20); \ -+ *(.iee.exec_exit) \ -+ . = ALIGN(PAGE_SIZE); \ -+ __iee_exec_exit_end = .; ++ . = ALIGN(PAGE_SIZE); \ ++ . += PAGE_SIZE - (24); \ ++ __iee_si_end = . + (24); \ ++ __iee_exec_exit = .; \ ++ *(.iee.exec_exit) \ ++ . = ALIGN(PAGE_SIZE); ++ +#else +#define IEE_SI_TEXT +#endif @@ -6715,7 +6831,7 @@ index 3cd7e76cc562..58785cd99a4b 100644 /* * The size of the PE/COFF section that covers the kernel image, which * runs from _stext to _edata, must be a round multiple of the PE/COFF -@@ -176,10 +226,13 @@ SECTIONS +@@ -176,10 +222,13 @@ SECTIONS SOFTIRQENTRY_TEXT ENTRY_TEXT TEXT_TEXT @@ -6729,19 +6845,7 @@ index 3cd7e76cc562..58785cd99a4b 100644 *(.gnu.warning) } -@@ -223,6 +276,11 @@ SECTIONS - swapper_pg_dir = .; - . += PAGE_SIZE; - -+#ifdef CONFIG_IEE -+ iee_pg_dir = .; -+ . += PAGE_SIZE; -+#endif -+ - . = ALIGN(SEGMENT_ALIGN); - __init_begin = .; - __inittext_begin = .; -@@ -318,6 +376,18 @@ SECTIONS +@@ -318,6 +367,18 @@ SECTIONS . += INIT_DIR_SIZE; init_pg_end = .; @@ -6761,7 +6865,7 @@ index 3cd7e76cc562..58785cd99a4b 100644 __pecoff_data_size = ABSOLUTE(. - __initdata_begin); _end = .; diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c -index 188197590fc9..a72a3382b045 100644 +index 188197590fc9..97e1f86046cf 100644 --- a/arch/arm64/mm/context.c +++ b/arch/arm64/mm/context.c @@ -17,6 +17,10 @@ @@ -6836,17 +6940,14 @@ index 188197590fc9..a72a3382b045 100644 unsigned long asid = ASID(mm); unsigned long ttbr0 = phys_to_ttbr(pgd_phys); -@@ -360,14 +402,31 @@ void cpu_do_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm) +@@ -360,14 +402,28 @@ void cpu_do_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm) if (IS_ENABLED(CONFIG_ARM64_SW_TTBR0_PAN)) ttbr0 |= FIELD_PREP(TTBR_ASID_MASK, asid); - /* Set ASID in TTBR1 since TCR.A1 is set */ + #ifdef CONFIG_IEE + ttbr0 |= FIELD_PREP(TTBR_ASID_MASK, asid+1); -+ // ttbr1 &= ~TTBR_ASID_MASK; -+ // ttbr1 |= FIELD_PREP(TTBR_ASID_MASK, asid); + iee_rwx_gate_entry(IEE_CONTEXT_SWITCH, ttbr0); -+ // TODO : IEE-SI + // TODO : if defined CONFIG_IEE and defined CONFIG_KOI + #else + /* Set ASID in TTBR0 since TCR.A1 is set 0*/ @@ -6870,7 +6971,7 @@ index 188197590fc9..a72a3382b045 100644 post_ttbr_update_workaround(); } -@@ -375,11 +434,20 @@ static int asids_update_limit(void) +@@ -375,11 +431,21 @@ static int asids_update_limit(void) { unsigned long num_available_asids = NUM_USER_ASIDS; @@ -6884,6 +6985,7 @@ index 188197590fc9..a72a3382b045 100644 + if (pinned_asid_map) { + unsigned int len = BITS_TO_LONGS(NUM_USER_ASIDS) * sizeof(unsigned long); + memset(pinned_asid_map, 0xaa, len); ++ __set_bit(INIT_ASID, pinned_asid_map); + } + #else + if (arm64_kernel_unmapped_at_el0()) { @@ -6896,7 +6998,7 @@ index 188197590fc9..a72a3382b045 100644 /* * Expect allocation after rollover to fail if we don't have at least * one more ASID than CPUs. ASID #0 is reserved for init_mm. -@@ -400,6 +468,10 @@ arch_initcall(asids_update_limit); +@@ -400,6 +466,10 @@ arch_initcall(asids_update_limit); static int asids_init(void) { @@ -6907,18 +7009,19 @@ index 188197590fc9..a72a3382b045 100644 asid_bits = get_cpu_asid_bits(); atomic64_set(&asid_generation, ASID_FIRST_VERSION); asid_map = bitmap_zalloc(NUM_USER_ASIDS, GFP_KERNEL); -@@ -410,6 +482,10 @@ static int asids_init(void) +@@ -410,6 +480,11 @@ static int asids_init(void) pinned_asid_map = bitmap_zalloc(NUM_USER_ASIDS, GFP_KERNEL); nr_pinned_asids = 0; + #if defined(CONFIG_IEE) || defined(CONFIG_KOI) + len = BITS_TO_LONGS(NUM_USER_ASIDS) * sizeof(unsigned long); + memset(asid_map, 0xaa, len); ++ __set_bit(INIT_ASID, asid_map); + #else /* * We cannot call set_reserved_asid_bits() here because CPU * caps are not finalized yet, so it is safer to assume KPTI -@@ -417,6 +493,8 @@ static int asids_init(void) +@@ -417,6 +492,8 @@ static int asids_init(void) */ if (IS_ENABLED(CONFIG_UNMAP_KERNEL_AT_EL0)) set_kpti_asid_bits(asid_map); @@ -6928,10 +7031,10 @@ index 188197590fc9..a72a3382b045 100644 } early_initcall(asids_init); diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c -index c376e58e8cf0..d5b4f48cd616 100644 +index 4ea07caba71c..de1d57c2b30f 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c -@@ -261,7 +261,11 @@ int ptep_set_access_flags(struct vm_area_struct *vma, +@@ -261,7 +261,11 @@ int __ptep_set_access_flags(struct vm_area_struct *vma, pteval ^= PTE_RDONLY; pteval |= pte_val(entry); pteval ^= PTE_RDONLY; @@ -6943,8 +7046,22 @@ index c376e58e8cf0..d5b4f48cd616 100644 } while (pteval != old_pteval); /* Invalidate a stale read-only entry */ +@@ -376,8 +380,13 @@ static void do_tag_recovery(unsigned long addr, unsigned long esr, + * It will be done lazily on the other CPUs when they will hit a + * tag fault. + */ ++ #ifdef CONFIG_IEE ++ sysreg_clear_set_iee_si(sctlr_el1, SCTLR_EL1_TCF_MASK, ++ SYS_FIELD_PREP_ENUM(SCTLR_EL1, TCF, NONE)); ++ #else + sysreg_clear_set(sctlr_el1, SCTLR_EL1_TCF_MASK, + SYS_FIELD_PREP_ENUM(SCTLR_EL1, TCF, NONE)); ++ #endif + isb(); + } + diff --git a/arch/arm64/mm/fixmap.c b/arch/arm64/mm/fixmap.c -index c0a3301203bd..cccb9a7716ba 100644 +index bfc02568805a..580ecb596d2d 100644 --- a/arch/arm64/mm/fixmap.c +++ b/arch/arm64/mm/fixmap.c @@ -32,6 +32,22 @@ static pte_t bm_pte[NR_BM_PTE_TABLES][PTRS_PER_PTE] __page_aligned_bss; @@ -7047,13 +7164,13 @@ index c0a3301203bd..cccb9a7716ba 100644 + #ifdef CONFIG_PTP + iee_set_bm_pte(ptep, pfn_pte(phys >> PAGE_SHIFT, flags)); + #else - set_pte(ptep, pfn_pte(phys >> PAGE_SHIFT, flags)); + __set_pte(ptep, pfn_pte(phys >> PAGE_SHIFT, flags)); + #endif } else { + #ifdef CONFIG_PTP + iee_set_bm_pte(ptep, __pte(0)); + #else - pte_clear(&init_mm, addr, ptep); + __pte_clear(&init_mm, addr, ptep); + #endif flush_tlb_kernel_range(addr, addr+PAGE_SIZE); } @@ -7089,7 +7206,7 @@ index c0a3301203bd..cccb9a7716ba 100644 BUG(); } diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c -index 8c8d7653ba84..729df5277d1d 100644 +index 8c8d7653ba84..4190f5c10d68 100644 --- a/arch/arm64/mm/init.c +++ b/arch/arm64/mm/init.c @@ -55,8 +55,19 @@ @@ -7130,10 +7247,10 @@ index 8c8d7653ba84..729df5277d1d 100644 /* Remove memory above our supported physical address size */ + #ifdef CONFIG_IEE + // If config iee, phys size can not be above 0x400000000000 -+ if(__pa_symbol(_end) > 1ULL << 46) ++ if(__pa_symbol(_end) > BIT_ULL(vabits_actual - 2)) + panic("Image on too high phys mem.\n"); + else -+ memblock_remove(1ULL << 46, ULLONG_MAX); ++ memblock_remove(BIT_ULL(vabits_actual - 2), ULLONG_MAX); + #else memblock_remove(1ULL << PHYS_MASK_SHIFT, ULLONG_MAX); + #endif @@ -7158,14 +7275,14 @@ index 8c8d7653ba84..729df5277d1d 100644 + koi_offset = memstart_addr - memstart_addr_init + KOI_OFFSET; + #endif + #ifdef CONFIG_IEE -+ iee_offset = memstart_addr - memstart_addr_init + ((unsigned long)0x4 << 44); ++ iee_offset = memstart_addr - memstart_addr_init + ((unsigned long)BIT(vabits_actual - 2)); + #endif + //printk(KERN_ERR "koi_offset: 0x%16llx\n", koi_offset); /* * Register the kernel text, kernel data, initrd, and initial diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c -index 58d228de4808..33abc832b2ab 100644 +index 4142a75a414e..094f3798441d 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -6,6 +6,7 @@ @@ -7188,7 +7305,7 @@ index 58d228de4808..33abc832b2ab 100644 #define NO_BLOCK_MAPPINGS BIT(0) #define NO_CONT_MAPPINGS BIT(1) -@@ -76,8 +82,286 @@ EXPORT_SYMBOL(empty_zero_page); +@@ -76,8 +82,282 @@ EXPORT_SYMBOL(empty_zero_page); static DEFINE_SPINLOCK(swapper_pgdir_lock); static DEFINE_MUTEX(fixmap_lock); @@ -7197,12 +7314,10 @@ index 58d228de4808..33abc832b2ab 100644 + +extern unsigned long init_iee_stack_begin[]; +extern unsigned long init_iee_stack_end[]; -+extern unsigned long __iee_si_base_start[]; -+extern unsigned long __iee_exec_entry_start[]; +extern unsigned long __iee_si_data_start[]; -+extern unsigned long __iee_si_data_end[]; -+extern unsigned long __iee_exec_exit_pg[]; -+extern unsigned long __iee_exec_exit_end[]; ++extern unsigned long __iee_exec_entry_start[]; ++extern unsigned long __iee_si_start[]; ++extern unsigned long __iee_si_end[]; + +extern void *bm_pte_addr; +extern void *bm_pmd_addr; @@ -7301,8 +7416,6 @@ index 58d228de4808..33abc832b2ab 100644 + iee_set_pmd_pre_init(pmdp, __pmd(__phys_to_pmd_val(ptep) | prot)); +} + -+#define set_pgd_init(pgdptr, pgdval) iee_set_p4d_pre_init((p4d_t *)(pgdptr), (p4d_t) { pgdval }) -+ +/* Funcs to set fixmap before iee initialized. */ +bool pgattr_change_is_safe(u64 old, u64 new); +static int iee_pud_set_huge_fixmap(pud_t *pudp, phys_addr_t phys, pgprot_t prot) @@ -7475,7 +7588,7 @@ index 58d228de4808..33abc832b2ab 100644 pgd_t *fixmap_pgdp; spin_lock(&swapper_pgdir_lock); -@@ -90,6 +374,7 @@ void set_swapper_pgd(pgd_t *pgdp, pgd_t pgd) +@@ -90,6 +370,7 @@ void set_swapper_pgd(pgd_t *pgdp, pgd_t pgd) */ pgd_clear_fixmap(); spin_unlock(&swapper_pgdir_lock); @@ -7483,7 +7596,7 @@ index 58d228de4808..33abc832b2ab 100644 } pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn, -@@ -118,7 +403,11 @@ static phys_addr_t __init early_pgtable_alloc(int shift) +@@ -118,7 +399,11 @@ static phys_addr_t __init early_pgtable_alloc(int shift) * slot will be free, so we can (ab)use the FIX_PTE slot to initialise * any level of table. */ @@ -7495,7 +7608,7 @@ index 58d228de4808..33abc832b2ab 100644 memset(ptr, 0, PAGE_SIZE); -@@ -126,11 +415,16 @@ static phys_addr_t __init early_pgtable_alloc(int shift) +@@ -126,11 +411,16 @@ static phys_addr_t __init early_pgtable_alloc(int shift) * Implicit barriers also ensure the zeroed page is visible to the page * table walker */ @@ -7512,19 +7625,19 @@ index 58d228de4808..33abc832b2ab 100644 bool pgattr_change_is_safe(u64 old, u64 new) { /* -@@ -178,7 +472,11 @@ static void init_pte(pmd_t *pmdp, unsigned long addr, unsigned long end, +@@ -178,7 +468,11 @@ static void init_pte(pmd_t *pmdp, unsigned long addr, unsigned long end, do { - pte_t old_pte = READ_ONCE(*ptep); + pte_t old_pte = __ptep_get(ptep); + #ifdef CONFIG_PTP + iee_set_fixmap_pte_pre_init(ptep, pfn_pte(__phys_to_pfn(phys), prot)); + #else - set_pte(ptep, pfn_pte(__phys_to_pfn(phys), prot)); + __set_pte(ptep, pfn_pte(__phys_to_pfn(phys), prot)); + #endif /* * After the PTE entry has been populated once, we -@@ -211,7 +509,11 @@ static void alloc_init_cont_pte(pmd_t *pmdp, unsigned long addr, +@@ -211,7 +505,11 @@ static void alloc_init_cont_pte(pmd_t *pmdp, unsigned long addr, pmdval |= PMD_TABLE_PXN; BUG_ON(!pgtable_alloc); pte_phys = pgtable_alloc(PAGE_SHIFT); @@ -7536,7 +7649,7 @@ index 58d228de4808..33abc832b2ab 100644 pmd = READ_ONCE(*pmdp); } BUG_ON(pmd_bad(pmd)); -@@ -248,7 +550,11 @@ static void init_pmd(pud_t *pudp, unsigned long addr, unsigned long end, +@@ -248,7 +546,11 @@ static void init_pmd(pud_t *pudp, unsigned long addr, unsigned long end, /* try section mapping first */ if (((addr | next | phys) & ~PMD_MASK) == 0 && (flags & NO_BLOCK_MAPPINGS) == 0) { @@ -7548,7 +7661,7 @@ index 58d228de4808..33abc832b2ab 100644 /* * After the PMD entry has been populated once, we -@@ -289,7 +595,11 @@ static void alloc_init_cont_pmd(pud_t *pudp, unsigned long addr, +@@ -289,7 +591,11 @@ static void alloc_init_cont_pmd(pud_t *pudp, unsigned long addr, pudval |= PUD_TABLE_PXN; BUG_ON(!pgtable_alloc); pmd_phys = pgtable_alloc(PMD_SHIFT); @@ -7561,7 +7674,7 @@ index 58d228de4808..33abc832b2ab 100644 pud = READ_ONCE(*pudp); } BUG_ON(pud_bad(pud)); -@@ -345,7 +655,11 @@ static void alloc_init_pud(pgd_t *pgdp, unsigned long addr, unsigned long end, +@@ -345,7 +651,11 @@ static void alloc_init_pud(pgd_t *pgdp, unsigned long addr, unsigned long end, if (pud_sect_supported() && ((addr | next | phys) & ~PUD_MASK) == 0 && (flags & NO_BLOCK_MAPPINGS) == 0) { @@ -7573,7 +7686,26 @@ index 58d228de4808..33abc832b2ab 100644 /* * After the PUD entry has been populated once, we -@@ -393,7 +707,6 @@ static void __create_pgd_mapping_locked(pgd_t *pgdir, phys_addr_t phys, +@@ -374,6 +684,10 @@ static void __create_pgd_mapping_locked(pgd_t *pgdir, phys_addr_t phys, + { + unsigned long addr, end, next; + pgd_t *pgdp = pgd_offset_pgd(pgdir, virt); ++ #ifdef CONFIG_IEE ++ p4d_t *p4dp; ++ p4d_t p4d; ++ #endif + + /* + * If the virtual and physical address don't have the same offset +@@ -390,10 +704,14 @@ static void __create_pgd_mapping_locked(pgd_t *pgdir, phys_addr_t phys, + next = pgd_addr_end(addr, end); + alloc_init_pud(pgdp, addr, next, phys, prot, pgtable_alloc, + flags); ++ #ifdef CONFIG_IEE ++ p4dp = p4d_offset(pgdp, addr); ++ p4d = READ_ONCE(*p4dp); ++ __p4d_populate(p4dp, __p4d_to_phys(p4d), (PGD_APT | PUD_TYPE_TABLE)); ++ #endif phys += next - addr; } while (pgdp++, addr = next, addr != end); } @@ -7581,7 +7713,7 @@ index 58d228de4808..33abc832b2ab 100644 static void __create_pgd_mapping(pgd_t *pgdir, phys_addr_t phys, unsigned long virt, phys_addr_t size, pgprot_t prot, -@@ -413,194 +726,1419 @@ void create_kpti_ng_temp_pgd(pgd_t *pgdir, phys_addr_t phys, unsigned long virt, +@@ -413,162 +731,844 @@ void create_kpti_ng_temp_pgd(pgd_t *pgdir, phys_addr_t phys, unsigned long virt, phys_addr_t (*pgtable_alloc)(int), int flags); #endif @@ -7780,9 +7912,17 @@ index 58d228de4808..33abc832b2ab 100644 + pmdp = pmd_set_fixmap_offset_init(pudp, addr); + do { + pmd_t old_pmd = READ_ONCE(*pmdp); -+ + +- kfence_pool = memblock_phys_alloc(KFENCE_POOL_SIZE, PAGE_SIZE); +- if (!kfence_pool) { +- pr_err("failed to allocate kfence pool\n"); +- kfence_early_init = false; +- return 0; +- } + next = pmd_addr_end(addr, end); -+ + +- /* Temporarily mark as NOMAP. */ +- memblock_mark_nomap(kfence_pool, KFENCE_POOL_SIZE); + /* try section mapping first */ + if (((addr | next | phys) & ~PMD_MASK) == 0 && + (flags & NO_BLOCK_MAPPINGS) == 0) { @@ -7912,6 +8052,8 @@ index 58d228de4808..33abc832b2ab 100644 +{ + unsigned long addr, end, next; + pgd_t *pgdp = pgd_offset_pgd(pgdir, virt); ++ p4d_t *p4dp; ++ p4d_t p4d; + + /* + * If the virtual and physical address don't have the same offset @@ -7928,6 +8070,9 @@ index 58d228de4808..33abc832b2ab 100644 + next = pgd_addr_end(addr, end); + iee_alloc_init_pud_pre_init(pgdp, addr, next, phys, prot, pgtable_alloc, + flags); ++ p4dp = p4d_offset(pgdp, addr); ++ p4d = READ_ONCE(*p4dp); ++ __iee_p4d_populate_pre_init(p4dp, __p4d_to_phys(p4d), (PGD_APT | PUD_TYPE_TABLE)); + phys += next - addr; + } while (pgdp++, addr = next, addr != end); +} @@ -8167,7 +8312,8 @@ index 58d228de4808..33abc832b2ab 100644 + __map_memblock(pgdp, start, end, pgprot_tagged(PAGE_KERNEL), + flags); + } -+ + +- return kfence_pool; + /* + * Map the linear alias of the [_stext, __init_begin) interval + * as non-executable now, and remove the write permission in @@ -8289,6 +8435,48 @@ index 58d228de4808..33abc832b2ab 100644 + ID_AA64PFR1_EL1_BT_SHIFT); +} + ++#ifdef CONFIG_IEE ++/* Set PMD APTable of iee si codes as (1,1) to revert it to ROX P pages when HPD1=0. */ ++static void __init iee_si_set_pmd_APtable(unsigned long addr, pgd_t *pgdir) ++{ ++ pgd_t *pgdp = pgd_offset_pgd(pgdir, addr); ++ ++ p4d_t *p4dp = p4d_offset(pgdp, addr); ++ ++ #ifdef CONFIG_PTP ++ pud_t *pudp = pud_set_fixmap_offset_init(p4dp, addr); ++ ++ pmd_t *pmdp = pmd_set_fixmap_offset_init(pudp, addr); ++ ++ pmd_t pmd = READ_ONCE(*pmdp); ++ ++ __iee_pmd_populate_pre_init(pmdp, __pmd_to_phys(pmd), PGD_APT_RO | PGD_APT | PMD_TYPE_TABLE); ++ ++ pud_clear_fixmap_init(); ++ pmd_clear_fixmap_init(); ++ #else ++ pud_t *pudp = pud_set_fixmap_offset(p4dp, addr); ++ ++ pmd_t *pmdp = pmd_set_fixmap_offset(pudp, addr); ++ ++ pmd_t pmd = READ_ONCE(*pmdp); ++ ++ __pmd_populate(pmdp, __pmd_to_phys(pmd), PGD_APT_RO | PGD_APT | PMD_TYPE_TABLE); ++ ++ pud_clear_fixmap(); ++ pmd_clear_fixmap(); ++ #endif ++} ++/* Set PMD APTable of iee si codes as (1,1) to revert it to ROX P pages when HPD1=0. */ ++static void __init mark_iee_si_pmd_APtable(pgd_t *pgdir) ++{ ++ unsigned long addr = (unsigned long)__iee_si_start; ++ iee_si_set_pmd_APtable(addr, pgdir); ++ // iee rwx gate exit may be mapped by another pmd. ++ iee_si_set_pmd_APtable(addr + PAGE_SIZE, pgdir); ++} ++#endif ++ +/* + * Create fine-grained mappings for the kernel. + */ @@ -8298,8 +8486,7 @@ index 58d228de4808..33abc832b2ab 100644 + vmlinux_initdata, vmlinux_data; + + #ifdef CONFIG_IEE -+ static struct vm_struct vmlinux_text_idmap, vmlinux_iee_base, vmlinux_iee_code, -+ vmlinux_iee_data, vmlinux_text_end; ++ static struct vm_struct vmlinux_iee_code, vmlinux_iee_data, vmlinux_iee_gate, vmlinux_text_end; + #endif + + /* @@ -8322,25 +8509,22 @@ index 58d228de4808..33abc832b2ab 100644 + * all other segments are allowed to use contiguous mappings. + */ + #ifdef CONFIG_IEE -+ map_kernel_segment(pgdp, _stext, __iee_si_base_start, text_prot, &vmlinux_text, ++ map_kernel_segment(pgdp, _stext, __iee_si_data_start, text_prot, &vmlinux_text, + 0, VM_NO_GUARD); -+ /* -+ * Cancel contiguous mappings of idmap and iee si sections to -+ * simplify modifications later. -+ */ -+ // map_kernel_segment(pgdp, __idmap_text_start, __iee_si_base_start, text_prot, &vmlinux_text_idmap, -+ // NO_CONT_MAPPINGS | NO_BLOCK_MAPPINGS, VM_NO_GUARD); -+ /* -+ * Map iee_si_base and iee_si_data as RW page, iee codes as NG page. -+ */ -+ map_kernel_segment(pgdp, __iee_si_base_start, __iee_exec_entry_start, SET_NG(PAGE_KERNEL), &vmlinux_iee_base, -+ NO_CONT_MAPPINGS | NO_BLOCK_MAPPINGS, VM_NO_GUARD); -+ map_kernel_segment(pgdp, __iee_exec_entry_start, __iee_si_data_start, SET_NG(text_prot), &vmlinux_iee_code, -+ NO_CONT_MAPPINGS | NO_BLOCK_MAPPINGS, VM_NO_GUARD); -+ map_kernel_segment(pgdp, __iee_si_data_start, __iee_si_data_end, SET_NG(PAGE_KERNEL), &vmlinux_iee_data, -+ NO_CONT_MAPPINGS | NO_BLOCK_MAPPINGS, VM_NO_GUARD); -+ map_kernel_segment(pgdp, __iee_si_data_end, _etext, SET_NG(text_prot), &vmlinux_text_end, ++ /* Set iee si data RW. */ ++ map_kernel_segment(pgdp, __iee_si_data_start, __iee_exec_entry_start, SET_NG(PAGE_KERNEL), ++ &vmlinux_iee_data, NO_CONT_MAPPINGS | NO_BLOCK_MAPPINGS, VM_NO_GUARD); ++ /* Set iee entry codes NG. */ ++ map_kernel_segment(pgdp, __iee_exec_entry_start, __iee_si_start, SET_NG(text_prot), &vmlinux_iee_gate, + NO_CONT_MAPPINGS | NO_BLOCK_MAPPINGS, VM_NO_GUARD); ++ /* Map __iee_si_start - __iee_si_end as U RWX pages and set PMD APTABLE = (1,1). */ ++ map_kernel_segment(pgdp, __iee_si_start, __iee_si_end, SET_NG((PAGE_KERNEL_EXEC)), ++ &vmlinux_iee_code, NO_CONT_MAPPINGS | NO_BLOCK_MAPPINGS, VM_NO_GUARD); ++ mark_iee_si_pmd_APtable(pgdp); ++ ++ map_kernel_segment(pgdp, __iee_si_end, _etext, text_prot, &vmlinux_text_end, 0, ++ VM_NO_GUARD); ++ + map_kernel_segment(pgdp, __start_rodata, __inittext_begin, PAGE_KERNEL, + &vmlinux_rodata, NO_CONT_MAPPINGS | NO_BLOCK_MAPPINGS, VM_NO_GUARD); + map_kernel_segment(pgdp, __inittext_begin, __inittext_end, text_prot, @@ -8423,12 +8607,7 @@ index 58d228de4808..33abc832b2ab 100644 + */ + if (WARN_ON((phys ^ virt) & ~PAGE_MASK)) + return; - -- kfence_pool = memblock_phys_alloc(KFENCE_POOL_SIZE, PAGE_SIZE); -- if (!kfence_pool) { -- pr_err("failed to allocate kfence pool\n"); -- kfence_early_init = false; -- return 0; ++ + phys &= PAGE_MASK; + addr = virt & PAGE_MASK; + end = PAGE_ALIGN(virt + size); @@ -8463,11 +8642,21 @@ index 58d228de4808..33abc832b2ab 100644 + __create_pgd_mapping_for_iee_locked(pgdir, phys, virt, size, prot, + pgtable_alloc, flags); + mutex_unlock(&fixmap_lock); -+} -+ + } + +-static void __init arm64_kfence_map_pool(phys_addr_t kfence_pool, pgd_t *pgdp) +static void __init __map_memblock_for_iee(pgd_t *pgdp, phys_addr_t start, + phys_addr_t end, pgprot_t prot, int flags) -+{ + { +- if (!kfence_pool) +- return; +- +- /* KFENCE pool needs page-level mapping. */ +- __map_memblock(pgdp, kfence_pool, kfence_pool + KFENCE_POOL_SIZE, +- pgprot_tagged(PAGE_KERNEL), +- NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS); +- memblock_clear_nomap(kfence_pool, KFENCE_POOL_SIZE); +- __kfence_pool = phys_to_virt(kfence_pool); + #ifdef CONFIG_PTP + __create_pgd_mapping_for_iee(pgdp, start, __phys_to_iee(start), end - start, + prot, early_pgtable_alloc, flags); @@ -8475,542 +8664,194 @@ index 58d228de4808..33abc832b2ab 100644 + __create_pgd_mapping_for_iee(pgdp, start, __phys_to_iee(start), end - start, + prot, early_pgtable_alloc, flags); + #endif -+} -+ + } +-#else /* CONFIG_KFENCE */ + +-static inline phys_addr_t arm64_kfence_alloc_pool(void) { return 0; } +-static inline void arm64_kfence_map_pool(phys_addr_t kfence_pool, pgd_t *pgdp) { } +- +-#endif /* CONFIG_KFENCE */ +- +-static void __init map_mem(pgd_t *pgdp) +static void __init map_iee(pgd_t *pgdp) -+{ -+ static const u64 direct_map_end = _PAGE_END(VA_BITS_MIN); -+ phys_addr_t kernel_start = __pa_symbol(_stext); -+ phys_addr_t kernel_end = __pa_symbol(__init_begin); -+ phys_addr_t start, end; -+ phys_addr_t early_kfence_pool; -+ int flags = NO_EXEC_MAPPINGS; -+ u64 i; -+ + { + static const u64 direct_map_end = _PAGE_END(VA_BITS_MIN); + phys_addr_t kernel_start = __pa_symbol(_stext); +@@ -578,6 +1578,8 @@ static void __init map_mem(pgd_t *pgdp) + int flags = NO_EXEC_MAPPINGS; + u64 i; + + flags |= NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS; + -+ /* -+ * Setting hierarchical PXNTable attributes on table entries covering -+ * the linear region is only possible if it is guaranteed that no table -+ * entries at any level are being shared between the linear region and -+ * the vmalloc region. Check whether this is true for the PGD level, in -+ * which case it is guaranteed to be true for all other levels as well. -+ */ -+ BUILD_BUG_ON(pgd_index(direct_map_end - 1) == pgd_index(direct_map_end)); -+ -+ early_kfence_pool = arm64_kfence_alloc_pool(); -+ -+ /* -+ * Take care not to create a writable alias for the -+ * read-only text and rodata sections of the kernel image. -+ * So temporarily mark them as NOMAP to skip mappings in -+ * the following for-loop -+ */ -+ memblock_mark_nomap(kernel_start, kernel_end - kernel_start); -+ -+ /* map all the memory banks */ -+ for_each_mem_range(i, &start, &end) { -+ if (start >= end) -+ break; -+ /* -+ * The linear map must allow allocation tags reading/writing -+ * if MTE is present. Otherwise, it has the same attributes as -+ * PAGE_KERNEL. -+ */ + /* + * Setting hierarchical PXNTable attributes on table entries covering + * the linear region is only possible if it is guaranteed that no table +@@ -589,9 +1591,6 @@ static void __init map_mem(pgd_t *pgdp) + + early_kfence_pool = arm64_kfence_alloc_pool(); + +- if (can_set_direct_map()) +- flags |= NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS; +- + /* + * Take care not to create a writable alias for the + * read-only text and rodata sections of the kernel image. +@@ -609,12 +1608,11 @@ static void __init map_mem(pgd_t *pgdp) + * if MTE is present. Otherwise, it has the same attributes as + * PAGE_KERNEL. + */ +- __map_memblock(pgdp, start, end, pgprot_tagged(PAGE_KERNEL), +- flags); + __map_memblock_for_iee(pgdp, start, end, SET_NG(SET_INVALID(SET_UPAGE(PAGE_KERNEL))), flags); } -- /* Temporarily mark as NOMAP. */ -- memblock_mark_nomap(kfence_pool, KFENCE_POOL_SIZE); -+ /* + /* +- * Map the linear alias of the [_stext, __init_begin) interval + * Map the linear alias of the [_text, __init_begin) interval -+ * as non-executable now, and remove the write permission in -+ * mark_linear_text_alias_ro() below (which will be called after -+ * alternative patching has completed). This makes the contents -+ * of the region accessible to subsystems such as hibernate, -+ * but protects it from inadvertent modification or execution. -+ * Note that contiguous mappings cannot be remapped in this way, -+ * so we should avoid them here. -+ */ + * as non-executable now, and remove the write permission in + * mark_linear_text_alias_ro() below (which will be called after + * alternative patching has completed). This makes the contents +@@ -623,178 +1621,384 @@ static void __init map_mem(pgd_t *pgdp) + * Note that contiguous mappings cannot be remapped in this way, + * so we should avoid them here. + */ +- __map_memblock(pgdp, kernel_start, kernel_end, +- PAGE_KERNEL, NO_CONT_MAPPINGS); + __map_memblock_for_iee(pgdp, kernel_start, kernel_end, + SET_NG(SET_INVALID(SET_UPAGE(PAGE_KERNEL))), flags); -+ memblock_clear_nomap(kernel_start, kernel_end - kernel_start); -+ arm64_kfence_map_pool(early_kfence_pool, pgdp); -+} -+ + memblock_clear_nomap(kernel_start, kernel_end - kernel_start); + arm64_kfence_map_pool(early_kfence_pool, pgdp); + } + +-void mark_rodata_ro(void) +/* + * Change page access permission, whereas not handling huge pages. + * Only used on IEE init functions. + */ -+static int __init iee_si_set_page_attr(unsigned long addr, pteval_t attr) -+{ ++static void __init iee_si_set_page_attr(unsigned long addr, pteval_t attr) + { +- unsigned long section_size; ++ unsigned long flag; + pgd_t *pgdir = swapper_pg_dir; + pgd_t *pgdp = pgd_offset_pgd(pgdir, addr); -+ + +- /* +- * mark .rodata as read only. Use __init_begin rather than __end_rodata +- * to cover NOTES and EXCEPTION_TABLE. +- */ +- section_size = (unsigned long)__init_begin - (unsigned long)__start_rodata; +- update_mapping_prot(__pa_symbol(__start_rodata), (unsigned long)__start_rodata, +- section_size, PAGE_KERNEL_RO); + p4d_t *p4dp = p4d_offset(pgdp, addr); -+ + +- debug_checkwx(); + pud_t *pudp = pud_offset(p4dp, addr); + + pmd_t *pmdp = pmd_offset(pudp, addr); + + pte_t *ptep = pte_offset_kernel(pmdp, addr); + pte_t pte = READ_ONCE(*ptep); -+ pr_info("IEE: page access permission changed on address 0x%lx, curr pte val: 0x%lx", -+ addr, (unsigned long)pte_val(pte)); ++ + if(attr & PTE_RDONLY) + pte = __pte((pte_val(pte) | PTE_RDONLY) & ~PTE_DBM); + pte = __pte(pte_val(pte) | attr); -+ if((pte_val(pte) & PTE_USER) && !(pte_val(*ptep) & PTE_USER)) -+ { -+ iee_set_pte_upage(ptep, __pte(pte_val(*ptep) | PTE_USER)); -+ set_pte(ptep, pte); -+ } -+ else -+ set_pte(ptep, pte); -+ pr_info("IEE: modified pte val: 0x%lx", (unsigned long)pte_val(pte)); -+ return 1; ++ #ifdef CONFIG_PTP ++ // Write pgtable in IEE directly. ++ flag = local_daif_save(); ++ asm volatile ("msr pan, #0"); ++ WRITE_ONCE(*((pte_t *)(__phys_to_iee(__pa(ptep)))), pte); ++ asm volatile ("msr pan, #1"); ++ local_daif_restore(flag); ++ #else ++ WRITE_ONCE(*ptep, pte); ++ #endif +} + -+/* -+ * Copy one pte. Returns 0 if succeeded. -+ */ -+static inline int iee_si_copy_present_pte(pte_t *dst_pte, pte_t *src_pte, -+ unsigned long addr) ++/* Prepare data used for iee rwx gates. These data are setted only once. */ ++void __init iee_si_prepare_data(void) +{ -+ pte_t pte = *src_pte; -+ -+ // if ((pte_val(pte) & PTE_NG) == 0) { -+ // printk(KERN_ERR "global pte found: 0x%16llx\n", pte); -+ // } else { -+ // printk(KERN_ERR "non global pte found: 0x%16llx\n", pte); -+ // } -+ set_pte(dst_pte, pte); -+ /* Clear src pte after copy to hide this page from kernel. */ -+ printk("IEE: Copy src pte %lx to %lx done. Hiding it new...", (unsigned long)src_pte, (unsigned long)dst_pte); -+ set_pte(src_pte, __pte(0)); -+ return 0; -+} -+ -+/* -+ * copy huge pmd entry from kernel to iee. -+ */ -+static int __init iee_si_copy_huge_pmd(struct mm_struct *mm, pmd_t *dst_pmd, -+ pmd_t *src_pmd, unsigned long addr) -+{ -+ pmd_t pmd; -+ int ret = -ENOMEM; -+ -+ ret = -EAGAIN; -+ pmd = *src_pmd; -+ mm_inc_nr_ptes(mm); -+ -+ set_pte((pte_t *)dst_pmd, pmd_pte(pmd)); -+ ret = 0; -+ return ret; -+} -+/* -+ * Allocate page table directory for IEE SI codes. -+ * Would do pmd_populate anyway and overwrite pmd entry. -+ */ -+static int __init __iee_si_pte_alloc_kernel(pmd_t *pmd) -+{ -+ unsigned long iee_addr; -+ pte_t *new = pte_alloc_one_kernel(&init_mm); -+ if (!new) -+ return -ENOMEM; -+ -+ smp_wmb(); /* See comment in __pte_alloc */ -+ -+ spin_lock(&init_mm.page_table_lock); -+ pmd_populate_kernel(&init_mm, pmd, new); -+ spin_unlock(&init_mm.page_table_lock); -+ return 0; -+} -+ -+#define iee_si_pte_alloc_kernel(pmd, address) \ -+ ((__iee_si_pte_alloc_kernel(pmd))? \ -+ NULL: pte_offset_kernel(pmd, address)) -+ -+/* -+ * Copy pte table from kernel mappings to iee mappings -+ */ -+static int __init iee_si_copy_pte_range(struct mm_struct *mm, pmd_t *dst_pmd, -+ pmd_t *src_pmd, unsigned long addr, unsigned long end) -+{ -+ pte_t *src_pte, *dst_pte; -+ unsigned long src_pte_t_pg, dst_pte_t_pg; -+ int ret = 0; -+again: -+ dst_pte = iee_si_pte_alloc_kernel(dst_pmd, addr); -+ if (!dst_pte) { -+ ret = -ENOMEM; -+ goto out; -+ } -+ src_pte = pte_offset_kernel(src_pmd, addr); -+ -+ #ifdef CONFIG_PTP -+ // Get va of new and old pte table page. -+ dst_pte_t_pg = (unsigned long)__phys_to_iee(pmd_page_paddr(*dst_pmd)); -+ src_pte_t_pg = (unsigned long)__phys_to_iee(pmd_page_paddr(*src_pmd)); -+ // printk("IEE: src_pte_t:%lx, dst_pte_t:%lx", src_pte_t_pg, dst_pte_t_pg); -+ // Copy all content from source pte table. Disable pan to manipulate inside iee. -+ asm volatile("msr pan, #0"); -+ memcpy((void *)dst_pte_t_pg, (void *)src_pte_t_pg, PAGE_SIZE); -+ asm volatile("msr pan, #1"); -+ #else -+ // Get va of new and old pte table page. -+ dst_pte_t_pg = (unsigned long)__va(pmd_page_paddr(*dst_pmd)); -+ src_pte_t_pg = (unsigned long)__va(pmd_page_paddr(*src_pmd)); -+ // printk("IEE: src_pte_t:%lx, dst_pte_t:%lx", src_pte_t_pg, dst_pte_t_pg); -+ // Copy all content from source pte table. Disable pan to manipulate inside iee. -+ memcpy(dst_pte_t_pg, src_pte_t_pg, PAGE_SIZE); -+ #endif -+ -+ arch_enter_lazy_mmu_mode(); -+ do { -+ if (pte_none(*src_pte)) -+ continue; -+ if (unlikely(!pte_present(*src_pte))) { -+ continue; -+ } -+ ret = iee_si_copy_present_pte(dst_pte, src_pte, addr); -+ if (unlikely(ret == -EAGAIN)) -+ break; -+ } while (dst_pte++, src_pte++, addr += PAGE_SIZE, addr != end); -+ arch_leave_lazy_mmu_mode(); -+ -+ if (ret) { -+ WARN_ON_ONCE(ret != -EAGAIN); -+ ret = 0; -+ } -+ if (addr != end) -+ goto again; -+out: -+ return ret; -+} -+ -+#if defined(__PAGETABLE_PMD_FOLDED) || !defined(CONFIG_MMU) -+static inline int __iee_si_pmd_alloc(struct mm_struct *mm, pud_t *pud, -+ unsigned long address) -+{ -+ return 0; -+} -+#endif -+ -+#ifndef __PAGETABLE_PMD_FOLDED -+/* -+ * Allocate page middle directory for IEE SI codes. -+ * Would do pud_populate anyway and overwrite pud entry. -+ */ -+static int __init __iee_si_pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address) -+{ -+ unsigned long iee_addr; -+ spinlock_t *ptl; -+ pmd_t *new = pmd_alloc_one(mm, address); -+ if (!new) -+ return -ENOMEM; -+ -+ smp_wmb(); /* See comment in __pte_alloc */ -+ -+ ptl = pud_lock(mm, pud); -+ #ifdef CONFIG_PTP -+ /* Valid iee mapping of the allocated page. */ -+ iee_addr = __phys_to_iee(__pa(new)); -+ set_iee_page_valid(iee_addr); -+ iee_set_logical_mem_ro((unsigned long)new); -+ #endif -+ mm_inc_nr_pmds(mm); -+ pud_populate(mm, pud, new); -+ spin_unlock(ptl); -+ return 0; -+} -+#endif /* __PAGETABLE_PMD_FOLDED */ -+ -+static inline pmd_t *iee_si_pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address) -+{ -+ return (__iee_si_pmd_alloc(mm, pud, address))? -+ NULL: pmd_offset(pud, address); -+} -+ -+/* -+ * Copy pmd table from kernel mappings to iee mappings -+ */ -+static inline int iee_si_copy_pmd_range(struct mm_struct *mm, pud_t *dst_pud, -+ pud_t *src_pud, unsigned long addr, -+ unsigned long end) -+{ -+ pmd_t *src_pmd, *dst_pmd; -+ unsigned long next, src_pmd_t_pg, dst_pmd_t_pg; -+ int err; -+ -+ dst_pmd = iee_si_pmd_alloc(mm, dst_pud, addr); -+ if (!dst_pmd) { -+ return -ENOMEM; -+ } -+ src_pmd = pmd_offset(src_pud, addr); -+ #ifdef CONFIG_PTP -+ // Get va of new and old pmd table page. -+ dst_pmd_t_pg = (unsigned long)__phys_to_iee(pud_page_paddr(*dst_pud)); -+ src_pmd_t_pg = (unsigned long)__phys_to_iee(pud_page_paddr(*src_pud)); -+ // printk("IEE: src_pmd_t:%lx, dst_pmd_t:%lx", src_pmd_t_pg, dst_pmd_t_pg); -+ // Copy all content from source pmd table. Disable pan to manipulate inside iee. -+ asm volatile("msr pan, #0"); -+ memcpy((void *)dst_pmd_t_pg, (void *)src_pmd_t_pg, PAGE_SIZE); -+ asm volatile("msr pan, #1"); -+ #else -+ // Get va of new and old pmd table page. -+ dst_pmd_t_pg = (unsigned long)__va(pud_page_paddr(*dst_pud)); -+ src_pmd_t_pg = (unsigned long)__va(pud_page_paddr(*src_pud)); -+ // printk("IEE: src_pmd_t:%lx, dst_pmd_t:%lx", src_pmd_t_pg, dst_pmd_t_pg); -+ // Copy all content from source pmd table. Disable pan to manipulate inside iee. -+ memcpy(dst_pmd_t_pg, src_pmd_t_pg, PAGE_SIZE); -+ #endif -+ do { -+ next = pmd_addr_end(addr, end); -+ // CONFIG_TRANSPARENT_HUGEPAGE is enabled, so we must add copy_huge_pmd -+ if (is_swap_pmd(*src_pmd) || pmd_trans_huge(*src_pmd) || -+ (pmd_devmap(*src_pmd))) { -+ err = iee_si_copy_huge_pmd(mm, dst_pmd, src_pmd, -+ addr); -+ if (err == -ENOMEM) -+ return -ENOMEM; -+ if (!err) -+ continue; -+ } -+ if (pmd_none_or_clear_bad(src_pmd)) { -+ continue; -+ } -+ if (iee_si_copy_pte_range(mm, dst_pmd, src_pmd, addr, next)) -+ return -ENOMEM; -+ } while (dst_pmd++, src_pmd++, addr = next, addr != end); -+ return 0; -+} -+ -+#if defined(__PAGETABLE_PUD_FOLDED) || !defined(CONFIG_MMU) -+static inline int __iee_si_pud_alloc(struct mm_struct *mm, p4d_t *p4d, -+ unsigned long address) -+{ -+ return 0; -+} -+#endif -+ -+#ifndef __PAGETABLE_PUD_FOLDED -+/* -+ * Allocate page upper directory for IEE SI codes. -+ * Would do p4d_populate anyway and overwrite p4d entry. -+ */ -+static int __init __iee_si_pud_alloc(struct mm_struct *mm, p4d_t *p4d, unsigned long address) -+{ -+ unsigned long iee_addr; -+ pud_t *new = pud_alloc_one(mm, address); -+ if (!new) -+ return -ENOMEM; -+ -+ smp_wmb(); /* See comment in __pte_alloc */ -+ -+ spin_lock(&mm->page_table_lock); -+ #ifdef CONFIG_PTP -+ /* Valid iee mapping of the allocated page. */ -+ iee_addr = __phys_to_iee(__pa(new)); -+ set_iee_page_valid(iee_addr); -+ iee_set_logical_mem_ro((unsigned long)new); -+ // printk("IEE: allocated new pud, set iee:%lx valid...", iee_addr); -+ #endif -+ mm_inc_nr_puds(mm); -+ // printk("IEE: populating to p4d, new val:%lx", new); -+ p4d_populate(mm, p4d, new); -+ spin_unlock(&mm->page_table_lock); -+ return 0; -+} -+#endif /* __PAGETABLE_PUD_FOLDED */ -+ -+static inline pud_t *iee_si_pud_alloc(struct mm_struct *mm, p4d_t *p4d, -+ unsigned long address) -+{ -+ return (__iee_si_pud_alloc(mm, p4d, address)) ? -+ NULL : pud_offset(p4d, address); -+} -+ -+/* -+ * Copy pud table from kernel mappings to iee mappings -+ */ -+static inline int iee_si_copy_pud_range(struct mm_struct *mm, p4d_t *dst_p4d, -+ p4d_t *src_p4d, unsigned long addr, -+ unsigned long end) -+{ -+ pud_t *src_pud, *dst_pud; -+ unsigned long next, src_pud_t_pg, dst_pud_t_pg; -+ dst_pud = iee_si_pud_alloc(mm, dst_p4d, addr); -+ if (!dst_pud) -+ return -ENOMEM; -+ src_pud = pud_offset(src_p4d, addr); -+ #ifdef CONFIG_PTP -+ // Get iee va of new and old PUD table page. -+ // printk("IEE: src_p4d_t:%lx, dst_p4d_t:%lx", src_p4d, dst_p4d); -+ dst_pud_t_pg = (unsigned long)__phys_to_iee(p4d_page_paddr(*dst_p4d)); -+ src_pud_t_pg = (unsigned long)__phys_to_iee(p4d_page_paddr(*src_p4d)); -+ // printk("IEE: src_pud_t:%lx, dst_pud_t:%lx", src_pud_t_pg, dst_pud_t_pg); -+ // Copy all content from source PUD table. Disable pan to manipulate inside iee. -+ asm volatile("msr pan, #0"); -+ memcpy((void *)dst_pud_t_pg, (void *)src_pud_t_pg, PAGE_SIZE); -+ asm volatile("msr pan, #1"); -+ #else -+ // Get iee va of new and old PUD table page. -+ // printk("IEE: src_p4d_t:%lx, dst_p4d_t:%lx", src_p4d, dst_p4d); -+ dst_pud_t_pg = (unsigned long)__va(p4d_page_paddr(*dst_p4d)); -+ src_pud_t_pg = (unsigned long)__va(p4d_page_paddr(*src_p4d)); -+ // printk("IEE: src_pud_t:%lx, dst_pud_t:%lx", src_pud_t_pg, dst_pud_t_pg); -+ // Copy all content from source PUD table. Disable pan to manipulate inside iee. -+ memcpy(dst_pud_t_pg, src_pud_t_pg, PAGE_SIZE); -+ #endif -+ do { -+ next = pud_addr_end(addr, end); -+ if (pud_trans_huge(*src_pud) || pud_devmap(*src_pud)) { -+ continue; -+ /* fall through */ -+ } -+ if (pud_none_or_clear_bad(src_pud)) -+ continue; -+ if (iee_si_copy_pmd_range(mm, dst_pud, src_pud, addr, next)) -+ return -ENOMEM; -+ } while (dst_pud++, src_pud++, addr = next, addr != end); -+ return 0; -+} -+ -+/** -+ * Copy mappings from kernel pagetables to iee pagetables level by level -+ * @mm: the corresponding mm_struct of the new pgd. -+ * @dst_pgd: destination pgd entry -+ * @src_pgd: source pgd entry -+ * @addr: the start address of protected zone -+ * @end: the end address of protected zone -+ */ -+static inline int iee_si_copy_p4d_range(struct mm_struct *mm, pgd_t *dst_pgd, -+ pgd_t *src_pgd, unsigned long addr, -+ unsigned long end) -+{ -+ p4d_t *src_p4d, *dst_p4d; -+ unsigned long next; -+ dst_p4d = p4d_alloc(mm, dst_pgd, addr); -+ if (!dst_p4d) -+ return -ENOMEM; -+ src_p4d = p4d_offset(src_pgd, addr); -+ do { -+ next = p4d_addr_end(addr, end); -+ if (p4d_none_or_clear_bad(src_p4d)) -+ continue; -+ if (iee_si_copy_pud_range(mm, dst_p4d, src_p4d, addr, next)) { -+ return -ENOMEM; -+ } -+ } while (dst_p4d++, src_p4d++, addr = next, addr != end); -+ return 0; -+} -+ -+/** -+ * int iee_si_copy_and_clear - Copy mappings of given address range from kernel to iee, -+ * and clear them on kernel pgd to make the isolation. -+ * The given region would be protected and invisible to kernel. -+ * Remind that iee_pg_dir would reuse kernel pgtable entries so iee can access kernel easily. -+ * @mm: the corresponding mm_struct of the new pgd. if it is not init_mm then kernel would take -+ * this pgd as users. -+ * @src_pg_dir: original kernel pgd, swapper_pg_dir -+ * @addr: the starting address of protected area -+ * @end: the end address of protected area -+ */ -+static int __init iee_si_copy_and_clear(struct mm_struct *mm, pgd_t *src_pg_dir, -+ unsigned long addr, unsigned long end) -+{ -+ int ret = 0; -+ unsigned long next; -+ pgd_t *src_pgd, *dst_pgd; -+ // Copy all entries from src_pg_dir first to reuse the original mappings. -+ memcpy(iee_pg_dir, src_pg_dir, PAGE_SIZE); -+ -+ src_pgd = pgd_offset_pgd(src_pg_dir, addr); -+ dst_pgd = pgd_offset_pgd(iee_pg_dir, addr); -+ // printk("IEE: src_pgd:%lx, dst_pgd:%lx", src_pgd, dst_pgd); -+ do { -+ next = pgd_addr_end(addr, end); -+ if (pgd_none_or_clear_bad(src_pgd)) -+ continue; -+ if (unlikely(iee_si_copy_p4d_range(mm, dst_pgd, src_pgd, addr, -+ next))) { -+ ret = -ENOMEM; -+ break; -+ } -+ } while (dst_pgd++, src_pgd++, addr = next, addr != end); -+ -+ return ret; -+} -+ -+void inline iee_si_set_base_swapper_cnp(void) -+{ -+ /* phys_to_ttbr() zeros lower 2 bits of ttbr with 52-bit PA */ -+ if (system_supports_cnp()) { -+ iee_base_swapper_pg_dir |= TTBR_CNP_BIT; -+ } -+} -+ -+extern unsigned long __iee_si_text_start[]; -+extern unsigned long __iee_exec_exit_pg[]; -+ -+/* Remap protected area on iee pgd to achieve the isolation. */ -+void __init isolate_iee_si(void) -+{ -+ /* Modify page prot of iee si setions before copy mappings. */ -+ unsigned long va = (unsigned long)__iee_si_base_start; -+ iee_si_set_page_attr(va, PTE_PXN | PTE_UXN | PTE_USER | PTE_RDONLY | PTE_NG); ++ unsigned long va; ++ // Record current TCR val after system init. ++ iee_si_tcr = read_sysreg(tcr_el1) & ~(SYS_TCR_IEE_SI); ++ // Mark iee data as RO and move it to iee after setting up. + va = (unsigned long)__iee_si_data_start; -+ iee_si_set_page_attr(va, PTE_PXN | PTE_UXN | PTE_USER | PTE_RDONLY | PTE_NG); -+ -+ /* Build the isolation on two mappings. */ -+ if(iee_si_copy_and_clear(&init_mm, swapper_pg_dir,(unsigned long)__iee_si_text_start, -+ (unsigned long)__iee_exec_exit_pg) == 0) -+ pr_info("IEE: isolated region is built successfully."); -+} ++ iee_si_set_page_attr(va, PTE_RDONLY); ++ iee_si_set_page_attr(lm_alias(va)+iee_offset, 0x1 | PTE_RDONLY); ++ // Set iee sensitive inst code page U RWX here to hide it from kernel. ++ va = (unsigned long)__iee_si_start; ++ iee_si_set_page_attr(va, PTE_USER); ++ va = (unsigned long)__iee_si_start + PAGE_SIZE; ++ iee_si_set_page_attr(va, PTE_USER); ++ flush_tlb_all(); + } + +-static void __init map_kernel_segment(pgd_t *pgdp, void *va_start, void *va_end, +- pgprot_t prot, struct vm_struct *vma, +- int flags, unsigned long vm_flags) +#endif + +#ifdef CONFIG_PTP +// Attention : Using set_xxx without adding offset. +static void __init set_iee_valid_pre_init(unsigned long addr) -+{ + { +- phys_addr_t pa_start = __pa_symbol(va_start); +- unsigned long size = va_end - va_start; + pgd_t *pgdir = swapper_pg_dir; + pgd_t *pgdp = pgd_offset_pgd(pgdir, addr); -+ + +- BUG_ON(!PAGE_ALIGNED(pa_start)); +- BUG_ON(!PAGE_ALIGNED(size)); + p4d_t *p4dp = p4d_offset(pgdp, addr); -+ + +- __create_pgd_mapping(pgdp, pa_start, (unsigned long)va_start, size, prot, +- early_pgtable_alloc, flags); + pud_t *pudp = pud_offset(p4dp, addr); -+ + +- if (!(vm_flags & VM_NO_GUARD)) +- size += PAGE_SIZE; + pmd_t *pmdp = pmd_offset(pudp, addr); -+ + +- vma->addr = va_start; +- vma->phys_addr = pa_start; +- vma->size = size; +- vma->flags = VM_MAP | vm_flags; +- vma->caller = __builtin_return_address(0); + pte_t *ptep = pte_offset_kernel(pmdp, addr); + pte_t pte = READ_ONCE(*ptep); -+ -+ if((addr < (((unsigned long)0xffff << 48) + IEE_OFFSET)) | (addr > (((unsigned long)0xffff8 << 44)))) + +- vm_area_add_early(vma); ++ if((addr < (PAGE_OFFSET + IEE_OFFSET)) | (addr > (PAGE_OFFSET + BIT(vabits_actual - 1)))) + return; + + pte = __pte(pte_val(pte) | 0x1); + iee_set_pte_pre_init(ptep, pte); + flush_tlb_kernel_range(addr, addr+PAGE_SIZE); + isb(); -+} -+ + } + +-static pgprot_t kernel_exec_prot(void) +static void __init move_pte_table_into_iee(pmd_t *pmdp, unsigned long addr, unsigned long end) -+{ + { +- return rodata_enabled ? PAGE_KERNEL_ROX : PAGE_KERNEL_EXEC; + pmd_t pmd = READ_ONCE(*pmdp); + unsigned long iee_addr = __phys_to_iee(__pmd_to_phys(pmd)); + set_iee_valid_pre_init(iee_addr); -+} -+ + } + +-#ifdef CONFIG_UNMAP_KERNEL_AT_EL0 +-static int __init map_entry_trampoline(void) +static void __init move_pmd_table_into_iee(pud_t *pudp, unsigned long addr, unsigned long end) -+{ + { +- int i; + unsigned long next; + pud_t pud = READ_ONCE(*pudp); + pmd_t *pmdp; + pmd_t pmd; + unsigned long iee_addr = __phys_to_iee(__pud_to_phys(pud)); + set_iee_valid_pre_init(iee_addr); -+ + +- pgprot_t prot = kernel_exec_prot(); +- phys_addr_t pa_start = __pa_symbol(__entry_tramp_text_start); + pmdp = pmd_offset(pudp, addr); + do { + next = pmd_addr_end(addr, end); @@ -9025,7 +8866,9 @@ index 58d228de4808..33abc832b2ab 100644 + } + } while (pmdp++, addr = next, addr != end); +} -+ + +- /* The trampoline is always mapped and can therefore be global */ +- pgprot_val(prot) &= ~PTE_NG; +static void __init move_pud_table_into_iee(pgd_t *pgdp, unsigned long addr, unsigned long end) +{ + unsigned long next; @@ -9036,7 +8879,11 @@ index 58d228de4808..33abc832b2ab 100644 + unsigned long iee_addr = __phys_to_iee(__p4d_to_phys(p4d)); + set_iee_valid_pre_init(iee_addr); -- return kfence_pool; +- /* Map only the text into the trampoline page table */ +- memset(tramp_pg_dir, 0, PGD_SIZE); +- __create_pgd_mapping(tramp_pg_dir, pa_start, TRAMP_VALIAS, +- entry_tramp_text_size(), prot, +- __pgd_pgtable_alloc, NO_BLOCK_MAPPINGS); + pudp = pud_offset(p4dp, addr); + do { + next = pud_addr_end(addr, end); @@ -9050,72 +8897,43 @@ index 58d228de4808..33abc832b2ab 100644 + move_pmd_table_into_iee(pudp, addr, next); + } + } while (pudp++, addr = next, addr != end); - } ++} --static void __init arm64_kfence_map_pool(phys_addr_t kfence_pool, pgd_t *pgdp) +- /* Map both the text and data into the kernel page table */ +- for (i = 0; i < DIV_ROUND_UP(entry_tramp_text_size(), PAGE_SIZE); i++) +- __set_fixmap(FIX_ENTRY_TRAMP_TEXT1 - i, +- pa_start + i * PAGE_SIZE, prot); +static void __init init_iee_for_one_region(pgd_t *pgdir, unsigned long va_start, unsigned long va_end) - { -- if (!kfence_pool) -- return; -- -- /* KFENCE pool needs page-level mapping. */ -- __map_memblock(pgdp, kfence_pool, kfence_pool + KFENCE_POOL_SIZE, -- pgprot_tagged(PAGE_KERNEL), -- NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS); -- memblock_clear_nomap(kfence_pool, KFENCE_POOL_SIZE); -- __kfence_pool = phys_to_virt(kfence_pool); --} --#else /* CONFIG_KFENCE */ ++{ + unsigned long addr, end, next; + pgd_t *pgdp = pgd_offset_pgd(pgdir, va_start); --static inline phys_addr_t arm64_kfence_alloc_pool(void) { return 0; } --static inline void arm64_kfence_map_pool(phys_addr_t kfence_pool, pgd_t *pgdp) { } +- if (IS_ENABLED(CONFIG_RELOCATABLE)) +- __set_fixmap(FIX_ENTRY_TRAMP_TEXT1 - i, +- pa_start + i * PAGE_SIZE, PAGE_KERNEL_RO); + addr = va_start & PAGE_MASK; + end = PAGE_ALIGN(va_end); --#endif /* CONFIG_KFENCE */ +- return 0; + do { + next = pgd_addr_end(addr, end); + move_pud_table_into_iee(pgdp, addr, next); + } while (pgdp++, addr = next, addr != end); -+} + } +-core_initcall(map_entry_trampoline); +-#endif --static void __init map_mem(pgd_t *pgdp) +-/* +- * Open coded check for BTI, only for use to determine configuration +- * for early mappings for before the cpufeature code has run. +- */ +-static bool arm64_early_this_cpu_has_bti(void) +static void __init init_iee(void) { -- static const u64 direct_map_end = _PAGE_END(VA_BITS_MIN); -- phys_addr_t kernel_start = __pa_symbol(_stext); -- phys_addr_t kernel_end = __pa_symbol(__init_begin); +- u64 pfr1; + unsigned long iee_addr; - phys_addr_t start, end; -- phys_addr_t early_kfence_pool; -- int flags = NO_EXEC_MAPPINGS; - u64 i; -- -- /* -- * Setting hierarchical PXNTable attributes on table entries covering -- * the linear region is only possible if it is guaranteed that no table -- * entries at any level are being shared between the linear region and -- * the vmalloc region. Check whether this is true for the PGD level, in -- * which case it is guaranteed to be true for all other levels as well. -- */ -- BUILD_BUG_ON(pgd_index(direct_map_end - 1) == pgd_index(direct_map_end)); -- -- early_kfence_pool = arm64_kfence_alloc_pool(); -- -- if (can_set_direct_map()) -- flags |= NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS; -- -- /* -- * Take care not to create a writable alias for the -- * read-only text and rodata sections of the kernel image. -- * So temporarily mark them as NOMAP to skip mappings in -- * the following for-loop -- */ -- memblock_mark_nomap(kernel_start, kernel_end - kernel_start); -- -- /* map all the memory banks */ ++ phys_addr_t start, end; ++ u64 i; + pgd_t *pgdp; + + #ifdef CONFIG_UNMAP_KERNEL_AT_EL0 @@ -9127,9 +8945,6 @@ index 58d228de4808..33abc832b2ab 100644 + pgdp = swapper_pg_dir; + iee_addr = (unsigned long)__phys_to_iee(__pa_symbol(swapper_pg_dir)); + set_iee_valid_pre_init(iee_addr); -+ // put iee_pg_dir inside iee for sensitive inst isolation -+ iee_addr = (unsigned long)__phys_to_iee(__pa_symbol(iee_pg_dir)); -+ set_iee_valid_pre_init(iee_addr); + // handling 2/3/4-level page table for kernel + init_iee_for_one_region(pgdp, (unsigned long)_text, (unsigned long)_etext); + init_iee_for_one_region(pgdp, (unsigned long)__start_rodata, (unsigned long)__inittext_begin); @@ -9144,83 +8959,39 @@ index 58d228de4808..33abc832b2ab 100644 + iee_addr = (unsigned long)__phys_to_iee(__pa_symbol(bm_pud_addr)); + set_iee_valid_pre_init(iee_addr); + // handling 2/3/4-level page table for logical mem and iee - for_each_mem_range(i, &start, &end) { - if (start >= end) - break; -@@ -609,192 +2147,193 @@ static void __init map_mem(pgd_t *pgdp) - * if MTE is present. Otherwise, it has the same attributes as - * PAGE_KERNEL. - */ -- __map_memblock(pgdp, start, end, pgprot_tagged(PAGE_KERNEL), -- flags); ++ for_each_mem_range(i, &start, &end) { ++ if (start >= end) ++ break; ++ /* ++ * The linear map must allow allocation tags reading/writing ++ * if MTE is present. Otherwise, it has the same attributes as ++ * PAGE_KERNEL. ++ */ + init_iee_for_one_region(pgdp, (unsigned long)__va(start), (unsigned long)__va(end)); + init_iee_for_one_region(pgdp, (unsigned long)__phys_to_iee(start), (unsigned long)__phys_to_iee(end)); - } -- -- /* -- * Map the linear alias of the [_stext, __init_begin) interval -- * as non-executable now, and remove the write permission in -- * mark_linear_text_alias_ro() below (which will be called after -- * alternative patching has completed). This makes the contents -- * of the region accessible to subsystems such as hibernate, -- * but protects it from inadvertent modification or execution. -- * Note that contiguous mappings cannot be remapped in this way, -- * so we should avoid them here. -- */ -- __map_memblock(pgdp, kernel_start, kernel_end, -- PAGE_KERNEL, NO_CONT_MAPPINGS); -- memblock_clear_nomap(kernel_start, kernel_end - kernel_start); -- arm64_kfence_map_pool(early_kfence_pool, pgdp); - } ++ } ++} --void mark_rodata_ro(void) +- if (!IS_ENABLED(CONFIG_ARM64_BTI_KERNEL)) +- return false; +static void iee_set_kernel_upage_pre_init(unsigned long addr) - { -- unsigned long section_size; -- -- /* -- * mark .rodata as read only. Use __init_begin rather than __end_rodata -- * to cover NOTES and EXCEPTION_TABLE. -- */ -- section_size = (unsigned long)__init_begin - (unsigned long)__start_rodata; -- update_mapping_prot(__pa_symbol(__start_rodata), (unsigned long)__start_rodata, -- section_size, PAGE_KERNEL_RO); -- -- debug_checkwx(); --} ++{ + pgd_t *pgdir = swapper_pg_dir; + pgd_t *pgdp = pgd_offset_pgd(pgdir, addr); --static void __init map_kernel_segment(pgd_t *pgdp, void *va_start, void *va_end, -- pgprot_t prot, struct vm_struct *vma, -- int flags, unsigned long vm_flags) --{ -- phys_addr_t pa_start = __pa_symbol(va_start); -- unsigned long size = va_end - va_start; +- pfr1 = __read_sysreg_by_encoding(SYS_ID_AA64PFR1_EL1); +- return cpuid_feature_extract_unsigned_field(pfr1, +- ID_AA64PFR1_EL1_BT_SHIFT); + p4d_t *p4dp = p4d_offset(pgdp, addr); + p4d_t p4d = READ_ONCE(*p4dp); - -- BUG_ON(!PAGE_ALIGNED(pa_start)); -- BUG_ON(!PAGE_ALIGNED(size)); ++ + pud_t *pudp = pud_offset(p4dp, addr); - -- __create_pgd_mapping(pgdp, pa_start, (unsigned long)va_start, size, prot, -- early_pgtable_alloc, flags); ++ + pmd_t *pmdp = pmd_offset(pudp, addr); - -- if (!(vm_flags & VM_NO_GUARD)) -- size += PAGE_SIZE; ++ + pte_t *ptep = pte_offset_kernel(pmdp, addr); - -- vma->addr = va_start; -- vma->phys_addr = pa_start; -- vma->size = size; -- vma->flags = VM_MAP | vm_flags; -- vma->caller = __builtin_return_address(0); ++ + int i; - -- vm_area_add_early(vma); -+ __iee_p4d_populate_pre_init(p4dp, __p4d_to_phys(p4d), PGD_APT | PUD_TYPE_TABLE); + for(i = 0; i < 4; i++) + { + pte_t pte = READ_ONCE(*ptep); @@ -9232,41 +9003,27 @@ index 58d228de4808..33abc832b2ab 100644 + isb(); } --static pgprot_t kernel_exec_prot(void) +-/* +- * Create fine-grained mappings for the kernel. +- */ +-static void __init map_kernel(pgd_t *pgdp) +static void __init iee_set_pte_table_ro(pmd_t *pmdp, unsigned long addr, unsigned long end) { -- return rodata_enabled ? PAGE_KERNEL_ROX : PAGE_KERNEL_EXEC; +- static struct vm_struct vmlinux_text, vmlinux_rodata, vmlinux_inittext, +- vmlinux_initdata, vmlinux_data; + pmd_t pmd = READ_ONCE(*pmdp); + unsigned long logical_addr = (unsigned long)__va(__pmd_to_phys(pmd)); + iee_set_logical_mem_ro(logical_addr); - } ++} --#ifdef CONFIG_UNMAP_KERNEL_AT_EL0 --static int __init map_entry_trampoline(void) +- /* +- * External debuggers may need to write directly to the text +- * mapping to install SW breakpoints. Allow this (only) when +- * explicitly requested with rodata=off. +- */ +- pgprot_t text_prot = kernel_exec_prot(); +static void __init iee_set_pmd_table_ro(pud_t *pudp, unsigned long addr, unsigned long end) - { -- int i; -- -- pgprot_t prot = kernel_exec_prot(); -- phys_addr_t pa_start = __pa_symbol(__entry_tramp_text_start); -- -- /* The trampoline is always mapped and can therefore be global */ -- pgprot_val(prot) &= ~PTE_NG; -- -- /* Map only the text into the trampoline page table */ -- memset(tramp_pg_dir, 0, PGD_SIZE); -- __create_pgd_mapping(tramp_pg_dir, pa_start, TRAMP_VALIAS, -- entry_tramp_text_size(), prot, -- __pgd_pgtable_alloc, NO_BLOCK_MAPPINGS); -- -- /* Map both the text and data into the kernel page table */ -- for (i = 0; i < DIV_ROUND_UP(entry_tramp_text_size(), PAGE_SIZE); i++) -- __set_fixmap(FIX_ENTRY_TRAMP_TEXT1 - i, -- pa_start + i * PAGE_SIZE, prot); -- -- if (IS_ENABLED(CONFIG_RELOCATABLE)) -- __set_fixmap(FIX_ENTRY_TRAMP_TEXT1 - i, -- pa_start + i * PAGE_SIZE, PAGE_KERNEL_RO); ++{ + unsigned long next; + pud_t pud = READ_ONCE(*pudp); + pmd_t *pmdp; @@ -9274,7 +9031,13 @@ index 58d228de4808..33abc832b2ab 100644 + unsigned long logical_addr = (unsigned long)__va(__pud_to_phys(pud)); + iee_set_logical_mem_ro(logical_addr); -- return 0; +- /* +- * If we have a CPU that supports BTI and a kernel built for +- * BTI then mark the kernel executable text as guarded pages +- * now so we don't have to rewrite the page tables later. +- */ +- if (arm64_early_this_cpu_has_bti()) +- text_prot = __pgprot_modify(text_prot, PTE_GP, PTE_GP); + pmdp = pmd_offset(pudp, addr); + do { + next = pmd_addr_end(addr, end); @@ -9288,21 +9051,23 @@ index 58d228de4808..33abc832b2ab 100644 + iee_set_pte_table_ro(pmdp, addr, next); + } + } while (pmdp++, addr = next, addr != end); - } --core_initcall(map_entry_trampoline); --#endif ++} --/* -- * Open coded check for BTI, only for use to determine configuration -- * for early mappings for before the cpufeature code has run. -- */ --static bool arm64_early_this_cpu_has_bti(void) +- /* +- * Only rodata will be remapped with different permissions later on, +- * all other segments are allowed to use contiguous mappings. +- */ +- map_kernel_segment(pgdp, _stext, _etext, text_prot, &vmlinux_text, 0, +- VM_NO_GUARD); +- map_kernel_segment(pgdp, __start_rodata, __inittext_begin, PAGE_KERNEL, +- &vmlinux_rodata, NO_CONT_MAPPINGS, VM_NO_GUARD); +- map_kernel_segment(pgdp, __inittext_begin, __inittext_end, text_prot, +- &vmlinux_inittext, 0, VM_NO_GUARD); +- map_kernel_segment(pgdp, __initdata_begin, __initdata_end, PAGE_KERNEL, +- &vmlinux_initdata, 0, VM_NO_GUARD); +- map_kernel_segment(pgdp, _data, _end, PAGE_KERNEL, &vmlinux_data, 0, 0); +static void __init iee_set_pud_table_ro(pgd_t *pgdp, unsigned long addr, unsigned long end) - { -- u64 pfr1; -- -- if (!IS_ENABLED(CONFIG_ARM64_BTI_KERNEL)) -- return false; ++{ + unsigned long next; + p4d_t *p4dp = p4d_offset(pgdp, addr); + p4d_t p4d = READ_ONCE(*p4dp); @@ -9311,9 +9076,8 @@ index 58d228de4808..33abc832b2ab 100644 + unsigned long logical_addr = (unsigned long)__va(__p4d_to_phys(p4d)); + iee_set_logical_mem_ro(logical_addr); -- pfr1 = __read_sysreg_by_encoding(SYS_ID_AA64PFR1_EL1); -- return cpuid_feature_extract_unsigned_field(pfr1, -- ID_AA64PFR1_EL1_BT_SHIFT); +- fixmap_copy(pgdp); +- kasan_copy_shadow(pgdp); + pudp = pud_offset(p4dp, addr); + do { + next = pud_addr_end(addr, end); @@ -9329,64 +9093,16 @@ index 58d228de4808..33abc832b2ab 100644 + } while (pudp++, addr = next, addr != end); } --/* -- * Create fine-grained mappings for the kernel. -- */ --static void __init map_kernel(pgd_t *pgdp) -+static void __init iee_mark_pgtable_for_one_region_ro(pgd_t *pgdir, unsigned long va_start, unsigned long va_end) - { -- static struct vm_struct vmlinux_text, vmlinux_rodata, vmlinux_inittext, -- vmlinux_initdata, vmlinux_data; -- -- /* -- * External debuggers may need to write directly to the text -- * mapping to install SW breakpoints. Allow this (only) when -- * explicitly requested with rodata=off. -- */ -- pgprot_t text_prot = kernel_exec_prot(); -- -- /* -- * If we have a CPU that supports BTI and a kernel built for -- * BTI then mark the kernel executable text as guarded pages -- * now so we don't have to rewrite the page tables later. -- */ -- if (arm64_early_this_cpu_has_bti()) -- text_prot = __pgprot_modify(text_prot, PTE_GP, PTE_GP); -+ unsigned long addr, end, next; -+ pgd_t *pgdp = pgd_offset_pgd(pgdir, va_start); - -- /* -- * Only rodata will be remapped with different permissions later on, -- * all other segments are allowed to use contiguous mappings. -- */ -- map_kernel_segment(pgdp, _stext, _etext, text_prot, &vmlinux_text, 0, -- VM_NO_GUARD); -- map_kernel_segment(pgdp, __start_rodata, __inittext_begin, PAGE_KERNEL, -- &vmlinux_rodata, NO_CONT_MAPPINGS, VM_NO_GUARD); -- map_kernel_segment(pgdp, __inittext_begin, __inittext_end, text_prot, -- &vmlinux_inittext, 0, VM_NO_GUARD); -- map_kernel_segment(pgdp, __initdata_begin, __initdata_end, PAGE_KERNEL, -- &vmlinux_initdata, 0, VM_NO_GUARD); -- map_kernel_segment(pgdp, _data, _end, PAGE_KERNEL, &vmlinux_data, 0, 0); -+ addr = va_start & PAGE_MASK; -+ end = PAGE_ALIGN(va_end); - -- fixmap_copy(pgdp); -- kasan_copy_shadow(pgdp); -+ do { -+ next = pgd_addr_end(addr, end); -+ iee_set_pud_table_ro(pgdp, addr, next); -+ } while (pgdp++, addr = next, addr != end); - } - -static void __init create_idmap(void) -+static void __init iee_mark_all_lm_pgtable_ro(void) ++static void __init iee_mark_pgtable_for_one_region_ro(pgd_t *pgdir, unsigned long va_start, unsigned long va_end) { - u64 start = __pa_symbol(__idmap_text_start); - u64 size = __pa_symbol(__idmap_text_end) - start; - pgd_t *pgd = idmap_pg_dir; - u64 pgd_phys; -- ++ unsigned long addr, end, next; ++ pgd_t *pgdp = pgd_offset_pgd(pgdir, va_start); + - /* check if we need an additional level of translation */ - if (VA_BITS < 48 && idmap_t0sz < (64 - VA_BITS_MIN)) { - pgd_phys = early_pgtable_alloc(PAGE_SHIFT); @@ -9396,11 +9112,20 @@ index 58d228de4808..33abc832b2ab 100644 - } - __create_pgd_mapping(pgd, start, start, size, PAGE_KERNEL_ROX, - early_pgtable_alloc, 0); -- ++ addr = va_start & PAGE_MASK; ++ end = PAGE_ALIGN(va_end); + - if (IS_ENABLED(CONFIG_UNMAP_KERNEL_AT_EL0)) { - extern u32 __idmap_kpti_flag; - u64 pa = __pa_symbol(&__idmap_kpti_flag); -- ++ do { ++ next = pgd_addr_end(addr, end); ++ iee_set_pud_table_ro(pgdp, addr, next); ++ } while (pgdp++, addr = next, addr != end); ++} + ++static void __init iee_mark_all_lm_pgtable_ro(void) ++{ + unsigned long logical_addr; + phys_addr_t start, end; + u64 i; @@ -9490,14 +9215,13 @@ index 58d228de4808..33abc832b2ab 100644 extern pgd_t init_idmap_pg_dir[]; idmap_t0sz = 63UL - __fls(__pa_symbol(_end) | GENMASK(VA_BITS_MIN - 1, 0)); -@@ -802,7 +2341,24 @@ void __init paging_init(void) +@@ -802,7 +2006,17 @@ void __init paging_init(void) map_kernel(pgdp); map_mem(pgdp); + // Map the whole physical mem into IEE, but set invalid. + #ifdef CONFIG_IEE + map_iee(pgdp); -+ // map_iee_si(pgdp); + #endif + + // Avoid using iee code to modify pgtable before iee initialized. @@ -9505,17 +9229,11 @@ index 58d228de4808..33abc832b2ab 100644 + pgd_clear_fixmap_init(); + #else pgd_clear_fixmap(); -+ #endif -+ -+ #ifdef CONFIG_IEE -+ // Initialize iee_pg_dir. -+ memcpy(iee_pg_dir, swapper_pg_dir, PAGE_SIZE); -+ flush_tlb_all(); + #endif cpu_replace_ttbr1(lm_alias(swapper_pg_dir), init_idmap_pg_dir); init_mm.pgd = swapper_pg_dir; -@@ -813,6 +2369,80 @@ void __init paging_init(void) +@@ -813,6 +2027,80 @@ void __init paging_init(void) memblock_allow_resize(); create_idmap(); @@ -9663,7 +9381,7 @@ index 4a64089e5771..894bda11c389 100644 kmem_cache_free(pgd_cache, pgd); } diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S -index 14fdf645edc8..2d71303363e6 100644 +index 14fdf645edc8..230b2b883a51 100644 --- a/arch/arm64/mm/proc.S +++ b/arch/arm64/mm/proc.S @@ -22,6 +22,8 @@ @@ -9717,8 +9435,139 @@ index 14fdf645edc8..2d71303363e6 100644 msr ttbr1_el1, x0 isb +@@ -452,6 +475,11 @@ SYM_FUNC_START(__cpu_setup) + orr tcr, tcr, #TCR_HA // hardware Access flag update + 1: + #endif /* CONFIG_ARM64_HW_AFDBM */ ++ ++#ifdef CONFIG_IEE ++ orr tcr, tcr, #TCR_HPD1 // Hierarchical permission disables ++#endif ++ + msr mair_el1, mair + msr tcr_el1, tcr + +diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c +index 5139a28130c0..15d2a3faa048 100644 +--- a/arch/arm64/mm/trans_pgd.c ++++ b/arch/arm64/mm/trans_pgd.c +@@ -25,6 +25,9 @@ + #include + #include + #include ++#ifdef CONFIG_PTP ++#include ++#endif + + static void *trans_alloc(struct trans_pgd_info *info) + { +@@ -65,10 +68,18 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp, + pte_t *src_ptep; + pte_t *dst_ptep; + unsigned long addr = start; ++ #ifdef CONFIG_PTP ++ unsigned long iee_addr; ++ #endif + + dst_ptep = trans_alloc(info); + if (!dst_ptep) + return -ENOMEM; ++ #ifdef CONFIG_PTP ++ iee_addr = __phys_to_iee(__pa(dst_ptep)); ++ set_iee_page_valid(iee_addr); ++ iee_set_logical_mem_ro((unsigned long)dst_ptep); ++ #endif + pmd_populate_kernel(NULL, dst_pmdp, dst_ptep); + dst_ptep = pte_offset_kernel(dst_pmdp, start); + +@@ -87,11 +98,19 @@ static int copy_pmd(struct trans_pgd_info *info, pud_t *dst_pudp, + pmd_t *dst_pmdp; + unsigned long next; + unsigned long addr = start; ++ #ifdef CONFIG_PTP ++ unsigned long iee_addr; ++ #endif + + if (pud_none(READ_ONCE(*dst_pudp))) { + dst_pmdp = trans_alloc(info); + if (!dst_pmdp) + return -ENOMEM; ++ #ifdef CONFIG_PTP ++ iee_addr = __phys_to_iee(__pa(dst_pmdp)); ++ set_iee_page_valid(iee_addr); ++ iee_set_logical_mem_ro((unsigned long)dst_pmdp); ++ #endif + pud_populate(NULL, dst_pudp, dst_pmdp); + } + dst_pmdp = pmd_offset(dst_pudp, start); +@@ -123,11 +142,19 @@ static int copy_pud(struct trans_pgd_info *info, p4d_t *dst_p4dp, + pud_t *src_pudp; + unsigned long next; + unsigned long addr = start; ++ #ifdef CONFIG_PTP ++ unsigned long iee_addr; ++ #endif + + if (p4d_none(READ_ONCE(*dst_p4dp))) { + dst_pudp = trans_alloc(info); + if (!dst_pudp) + return -ENOMEM; ++ #ifdef CONFIG_PTP ++ iee_addr = __phys_to_iee(__pa(dst_pudp)); ++ set_iee_page_valid(iee_addr); ++ iee_set_logical_mem_ro((unsigned long)dst_pudp); ++ #endif + p4d_populate(NULL, dst_p4dp, dst_pudp); + } + dst_pudp = pud_offset(dst_p4dp, start); +@@ -212,6 +239,12 @@ int trans_pgd_create_copy(struct trans_pgd_info *info, pgd_t **dst_pgdp, + return -ENOMEM; + } + ++ #ifdef CONFIG_PTP ++ unsigned long iee_addr = __phys_to_iee(__pa(trans_pgd)); ++ set_iee_page_valid(iee_addr); ++ iee_set_logical_mem_ro((unsigned long)trans_pgd); ++ #endif ++ + rc = copy_page_tables(info, trans_pgd, start, end); + if (!rc) + *dst_pgdp = trans_pgd; +@@ -238,6 +271,9 @@ int trans_pgd_idmap_page(struct trans_pgd_info *info, phys_addr_t *trans_ttbr0, + int bits_mapped = PAGE_SHIFT - 4; + unsigned long level_mask, prev_level_entry, *levels[4]; + int this_level, index, level_lsb, level_msb; ++ #ifdef CONFIG_PTP ++ unsigned long iee_addr; ++ #endif + + dst_addr &= PAGE_MASK; + prev_level_entry = pte_val(pfn_pte(pfn, PAGE_KERNEL_ROX)); +@@ -247,12 +283,22 @@ int trans_pgd_idmap_page(struct trans_pgd_info *info, phys_addr_t *trans_ttbr0, + if (!levels[this_level]) + return -ENOMEM; + ++ #ifdef CONFIG_PTP ++ iee_addr = __phys_to_iee(__pa(levels[this_level])); ++ set_iee_page_valid(iee_addr); ++ iee_set_logical_mem_ro((unsigned long)levels[this_level]); ++ #endif ++ + level_lsb = ARM64_HW_PGTABLE_LEVEL_SHIFT(this_level); + level_msb = min(level_lsb + bits_mapped, max_msb); + level_mask = GENMASK_ULL(level_msb, level_lsb); + + index = (dst_addr & level_mask) >> level_lsb; ++ #ifdef CONFIG_PTP ++ set_pte((pte_t *)(levels[this_level] + index), __pte(prev_level_entry)); ++ #else + *(levels[this_level] + index) = prev_level_entry; ++ #endif + + pfn = virt_to_pfn(levels[this_level]); + prev_level_entry = pte_val(pfn_pte(pfn, diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c -index 83f5bb57fa4c..85c4d6c191da 100644 +index 83092d93f36a..fb12e7d0660a 100644 --- a/drivers/firmware/efi/arm-runtime.c +++ b/drivers/firmware/efi/arm-runtime.c @@ -94,7 +94,11 @@ static int __init arm_enable_runtime_services(void) @@ -9824,7 +9673,7 @@ index 9d235fa14ab9..72be355903ca 100644 } diff --git a/fs/exec.c b/fs/exec.c -index 73b833e8b548..cae7ef0d3592 100644 +index 04fb89656cc3..3689c5f008ba 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -76,6 +76,14 @@ @@ -9842,7 +9691,7 @@ index 73b833e8b548..cae7ef0d3592 100644 static int bprm_creds_from_file(struct linux_binprm *bprm); int suid_dumpable = 0; -@@ -1004,6 +1012,10 @@ static int exec_mmap(struct mm_struct *mm) +@@ -1005,6 +1013,10 @@ static int exec_mmap(struct mm_struct *mm) if (!IS_ENABLED(CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM)) local_irq_enable(); activate_mm(active_mm, mm); @@ -9853,7 +9702,7 @@ index 73b833e8b548..cae7ef0d3592 100644 if (IS_ENABLED(CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM)) local_irq_enable(); lru_gen_add_mm(mm); -@@ -1614,12 +1626,20 @@ static void bprm_fill_uid(struct linux_binprm *bprm, struct file *file) +@@ -1618,12 +1630,20 @@ static void bprm_fill_uid(struct linux_binprm *bprm, struct file *file) if (mode & S_ISUID) { bprm->per_clear |= PER_CLEAR_ON_SETID; @@ -9875,7 +9724,7 @@ index 73b833e8b548..cae7ef0d3592 100644 } diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c -index ef817a0475ff..7b6a3b2a57ce 100644 +index 3e724cb7ef01..e32e136e4271 100644 --- a/fs/nfs/flexfilelayout/flexfilelayout.c +++ b/fs/nfs/flexfilelayout/flexfilelayout.c @@ -15,6 +15,10 @@ @@ -10113,7 +9962,7 @@ index 355bf0db3235..6cb276dde4e9 100644 put_cred(new); } else { diff --git a/fs/open.c b/fs/open.c -index 54723fceb776..fd08622430c2 100644 +index 54723fceb776..d83901dc50ff 100644 --- a/fs/open.c +++ b/fs/open.c @@ -35,6 +35,11 @@ @@ -10128,7 +9977,7 @@ index 54723fceb776..fd08622430c2 100644 #include "internal.h" int do_truncate(struct mnt_idmap *idmap, struct dentry *dentry, -@@ -414,17 +419,32 @@ static const struct cred *access_override_creds(void) +@@ -414,17 +419,34 @@ static const struct cred *access_override_creds(void) * routine. */ @@ -10146,7 +9995,9 @@ index 54723fceb776..fd08622430c2 100644 if (!uid_eq(override_cred->uid, root_uid)) + #ifdef CONFIG_CREDP + do { -+ iee_set_cred_cap_effective(override_cred, __cap_empty_set); ++ kernel_cap_t tmp_cap = override_cred->cap_effective; ++ tmp_cap.val = 0; ++ iee_set_cred_cap_effective(override_cred, tmp_cap); + } while (0); + #else cap_clear(override_cred->cap_effective); @@ -10161,7 +10012,7 @@ index 54723fceb776..fd08622430c2 100644 } /* -@@ -444,7 +464,11 @@ static const struct cred *access_override_creds(void) +@@ -444,7 +466,11 @@ static const struct cred *access_override_creds(void) * expecting RCU freeing. But normal thread-synchronous * cred accesses will keep things non-RCY. */ @@ -10203,7 +10054,7 @@ index 033fc0458a3d..2afa31ead2b5 100644 attr->mode, &dentry->d_name, old_cred, override_cred); diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c -index c71d185980c0..d84624b4c506 100644 +index 2c056d737c27..9ede99ddb04b 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -21,6 +21,10 @@ @@ -10217,7 +10068,7 @@ index c71d185980c0..d84624b4c506 100644 MODULE_AUTHOR("Miklos Szeredi "); MODULE_DESCRIPTION("Overlay filesystem"); MODULE_LICENSE("GPL"); -@@ -1482,7 +1486,15 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc) +@@ -1485,7 +1489,15 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc) sb->s_export_op = &ovl_export_fid_operations; /* Never override disk quota limits or use reserved space */ @@ -10450,7 +10301,7 @@ index c75d4a753849..506ff9662e02 100644 } diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h -index 5896b7bc981f..ac15daf6c949 100644 +index 200853042fc7..9d733afced53 100644 --- a/include/asm-generic/vmlinux.lds.h +++ b/include/asm-generic/vmlinux.lds.h @@ -346,6 +346,17 @@ @@ -10471,7 +10322,7 @@ index 5896b7bc981f..ac15daf6c949 100644 /* * .data section */ -@@ -371,8 +382,8 @@ +@@ -370,8 +381,8 @@ BRANCH_PROFILE() \ TRACE_PRINTKS() \ BPF_RAW_TP() \ @@ -10482,7 +10333,7 @@ index 5896b7bc981f..ac15daf6c949 100644 /* * Data section helpers */ -@@ -1099,6 +1110,14 @@ +@@ -1093,6 +1104,14 @@ * They will fit only a subset of the architectures */ @@ -10497,7 +10348,7 @@ index 5896b7bc981f..ac15daf6c949 100644 /* * Writeable data. -@@ -1116,6 +1135,7 @@ +@@ -1110,6 +1129,7 @@ . = ALIGN(PAGE_SIZE); \ .data : AT(ADDR(.data) - LOAD_OFFSET) { \ INIT_TASK_DATA(inittask) \ @@ -10506,7 +10357,7 @@ index 5896b7bc981f..ac15daf6c949 100644 PAGE_ALIGNED_DATA(pagealigned) \ CACHELINE_ALIGNED_DATA(cacheline) \ diff --git a/include/linux/cred.h b/include/linux/cred.h -index e01c6d094a30..0c288ef3a7ee 100644 +index e01c6d094a30..cceb4842b619 100644 --- a/include/linux/cred.h +++ b/include/linux/cred.h @@ -18,6 +18,10 @@ @@ -10532,10 +10383,10 @@ index e01c6d094a30..0c288ef3a7ee 100644 + *(int *)(&(((struct rcu_head *)(cred->rcu.func))->next)) = non_rcu; +} + -+static bool noinline iee_set_cred_atomic_op_usage(struct cred *cred, int flag) ++static bool noinline iee_set_cred_atomic_op_usage(struct cred *cred, int flag, int nr) +{ + bool ret; -+ ret = iee_rw_gate(IEE_OP_SET_CRED_ATOP_USAGE,cred,flag); ++ ret = iee_rw_gate(IEE_OP_SET_CRED_ATOP_USAGE,cred,flag,nr); + return ret; +} +#endif @@ -10543,15 +10394,23 @@ index e01c6d094a30..0c288ef3a7ee 100644 extern void __put_cred(struct cred *); extern void exit_creds(struct task_struct *); extern int copy_creds(struct task_struct *, unsigned long); -@@ -202,7 +222,11 @@ static inline struct cred *get_new_cred_many(struct cred *cred, int nr) +@@ -189,7 +209,11 @@ static inline bool cap_ambient_invariant_ok(const struct cred *cred) + */ + static inline struct cred *get_new_cred_many(struct cred *cred, int nr) + { ++ #ifdef CONFIG_CREDP ++ iee_set_cred_atomic_op_usage(cred, AT_ADD, nr); ++ #else + atomic_long_add(nr, &cred->usage); ++ #endif + return cred; + } + +@@ -202,7 +226,7 @@ static inline struct cred *get_new_cred_many(struct cred *cred, int nr) */ static inline struct cred *get_new_cred(struct cred *cred) { - return get_new_cred_many(cred, 1); -+ #ifdef CONFIG_CREDP -+ iee_set_cred_atomic_op_usage(cred,AT_INC); -+ return cred; -+ #endif + return get_new_cred_many(cred, 1); // XXXzgc atomic_inc -> get_new_cred_many } @@ -10573,7 +10432,7 @@ index e01c6d094a30..0c288ef3a7ee 100644 if (!cred) return NULL; + #ifdef CONFIG_CREDP -+ if (!iee_set_cred_atomic_op_usage(nonconst_cred,AT_INC_NOT_ZERO)) ++ if (!iee_set_cred_atomic_op_usage(nonconst_cred,AT_INC_NOT_ZERO,0)) + return NULL; + #else if (!atomic_long_inc_not_zero(&nonconst_cred->usage)) @@ -10593,7 +10452,7 @@ index e01c6d094a30..0c288ef3a7ee 100644 if (cred) { + #ifdef CONFIG_CREDP -+ if (iee_set_cred_atomic_op_usage(cred,AT_DEC_AND_TEST)) ++ if (iee_set_cred_atomic_op_usage(cred,AT_SUB_AND_TEST,nr)) + __put_cred(cred); + #else if (atomic_long_sub_and_test(nr, &cred->usage)) @@ -10603,10 +10462,10 @@ index e01c6d094a30..0c288ef3a7ee 100644 } diff --git a/include/linux/efi.h b/include/linux/efi.h -index 4e89a4aac75a..c8e8b574f095 100644 +index 9ed79128458c..970cc4f7068b 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h -@@ -735,6 +735,15 @@ extern int __init __efi_memmap_init(struct efi_memory_map_data *data); +@@ -740,6 +740,15 @@ extern int __init __efi_memmap_init(struct efi_memory_map_data *data); extern int __init efi_memmap_init_early(struct efi_memory_map_data *data); extern int __init efi_memmap_init_late(phys_addr_t addr, unsigned long size); extern void __init efi_memmap_unmap(void); @@ -10669,7 +10528,7 @@ index 4db2878d9e42..ef8d51994017 100644 #ifndef MODULE_ARCH_INIT #define MODULE_ARCH_INIT {} diff --git a/include/linux/sched.h b/include/linux/sched.h -index c3452e1830ca..23b500afb7ae 100644 +index f40411aa7b70..297becfbc8e3 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -773,6 +773,24 @@ struct task_struct_resvd { @@ -10705,27 +10564,11 @@ index c3452e1830ca..23b500afb7ae 100644 refcount_t usage; /* Per task flags (PF_*), defined further below: */ unsigned int flags; -diff --git a/include/linux/stacktrace.h b/include/linux/stacktrace.h -index 97455880ac41..bfbb84f06180 100644 ---- a/include/linux/stacktrace.h -+++ b/include/linux/stacktrace.h -@@ -8,6 +8,11 @@ - struct task_struct; - struct pt_regs; - -+#ifdef CONFIG_IEE -+unsigned int stack_trace_save_iee(unsigned long *store, unsigned int size, -+ unsigned int skipnr); -+#endif -+ - #ifdef CONFIG_ARCH_STACKWALK - - /** diff --git a/init/main.c b/init/main.c -index ba7da8fe83ea..71eb2999b513 100644 +index 803332dd3d90..0f8d6e2744c2 100644 --- a/init/main.c +++ b/init/main.c -@@ -101,6 +101,12 @@ +@@ -102,6 +102,12 @@ #include #include @@ -10738,7 +10581,7 @@ index ba7da8fe83ea..71eb2999b513 100644 #include #include #include -@@ -111,6 +117,10 @@ +@@ -112,6 +118,10 @@ #include @@ -10749,7 +10592,7 @@ index ba7da8fe83ea..71eb2999b513 100644 static int kernel_init(void *); /* -@@ -877,6 +887,9 @@ void start_kernel(void) +@@ -880,6 +890,9 @@ void start_kernel(void) { char *command_line; char *after_dashes; @@ -10759,7 +10602,7 @@ index ba7da8fe83ea..71eb2999b513 100644 set_task_stack_end_magic(&init_task); smp_setup_processor_id(); -@@ -901,6 +914,16 @@ void start_kernel(void) +@@ -904,6 +917,16 @@ void start_kernel(void) setup_command_line(command_line); setup_nr_cpu_ids(); setup_per_cpu_areas(); @@ -10776,171 +10619,27 @@ index ba7da8fe83ea..71eb2999b513 100644 smp_prepare_boot_cpu(); /* arch-specific boot-cpu hooks */ boot_cpu_hotplug_init(); -@@ -1431,6 +1454,125 @@ void __weak free_initmem(void) - free_initmem_default(POISON_FREE_INITMEM); - } - -+#ifdef CONFIG_IEE -+ -+// Set up breakpoint control registers to protect iee rwx gate -+static void __init iee_si_init_dbg(void) -+{ -+ unsigned long mdscr; -+ unsigned long dbgbcr, dbgbvr; -+ -+ // use afsr0_el1 to mark whether user proc user breakpoint 0 -+ write_sysreg(0, afsr0_el1); -+ -+ // set mdscr_el1.MDE to enable breakpoint exception -+ mdscr = read_sysreg(mdscr_el1); -+ mdscr |= DBG_MDSCR_MDE | DBG_MDSCR_KDE; -+ write_sysreg(mdscr, mdscr_el1); -+ -+ // set breakpoint control registers -+ dbgbcr = IEE_DBGBCR; -+ // calculate the location of msr ttbr1 inst. -+#ifdef CONFIG_KOI -+ dbgbvr = (unsigned long)(iee_rwx_gate_entry + 120); -+#else -+ dbgbvr = (unsigned long)(iee_rwx_gate_entry + 36); -+#endif -+ write_sysreg(dbgbcr, dbgbcr0_el1); -+ write_sysreg(dbgbvr, dbgbvr0_el1); -+ isb(); -+} -+ -+/* All software preparation for iee rwx gate is done after this function. */ -+static void __init iee_si_sw_init_end(void) -+{ -+ // void (*__jump_to_iee_si)(int flag, ...); -+ // remove exec permission of idmap functions inside kernel image. -+ // mark_idmap_vmallc_map_ROU(); -+ // test 0: jump to the start of protected area -+ // __jump_to_iee_si = IEE_SI_PGD_ENTRY; -+ -+ // test 1: jump to the inst of msr ttbr1 to test breakpoint prot -+ // iee_si_init_dbg(); -+ // asm volatile("mrs x13, daif"); -+ // asm volatile("msr daifset, #0b1010"); -+ // __jump_to_iee_si = IEE_SI_PGD_ENTRY - 36; -+ // __jump_to_iee_si(IEE_SI_TEST); -+ // asm volatile("msr daif, x13"); -+ -+ /* Cpu features has been initialized now. Check whether cnp is enabled.*/ -+ iee_si_set_base_swapper_cnp(); -+ /* -+ * Finally finish isolation by remap iee si setions and clear their kernel mapping. -+ */ -+ isolate_iee_si(); -+ // iee_si_handler(IEE_SI_TEST); -+ flush_tlb_all(); -+} -+ -+atomic_t __initdata iee_si_cpu_cnt; -+ -+static int __init iee_si_hw_init_cpu(void *__unused) -+{ -+ int total_cpu; -+ iee_si_init_dbg(); -+ // loop until setting all cpus -+ atomic_inc(&iee_si_cpu_cnt); -+ total_cpu = num_online_cpus(); -+ while (atomic_read(&iee_si_cpu_cnt) < total_cpu) -+ cpu_relax(); -+ -+ return 0; -+} -+// setup hw features on all online cpus -+static void __init iee_si_hw_init(void) -+{ -+ atomic_set(&iee_si_cpu_cnt, 0); -+ stop_machine(iee_si_hw_init_cpu, NULL, cpu_online_mask); -+ pr_info("IEE hw config done.\n"); -+} -+ -+static void __init iee_si_init_end(void) -+{ -+ iee_si_hw_init(); -+ // protect iee si metadata to finish initialization. -+ iee_si_sw_init_end(); -+} -+ -+static void iee_si_test_end(void) -+{ -+ pr_info("IEE: testing iee_exec_entry sctlr...\n"); -+ iee_rwx_gate_entry(IEE_WRITE_SCTLR, read_sysreg(sctlr_el1)& ~SCTLR_ELx_M); -+ pr_info("IEE: testing iee_exec_entry ttbr0_el1...\n"); -+ iee_rwx_gate_entry(IEE_WRITE_TTBR0, read_sysreg(ttbr0_el1)); -+ pr_info("IEE: testing iee_exec_entry vbar...\n"); -+ iee_rwx_gate_entry(IEE_WRITE_VBAR, read_sysreg(vbar_el1)); -+ pr_info("IEE: testing iee_exec_entry tcr...\n"); -+ iee_rwx_gate_entry(IEE_WRITE_TCR, read_sysreg(tcr_el1)); -+ pr_info("IEE: testing iee_exec_entry mdscr...\n"); -+ iee_rwx_gate_entry(IEE_WRITE_MDSCR, read_sysreg(mdscr_el1)); -+ pr_info("IEE: testing iee_exec_entry afsr0...\n"); -+ iee_rwx_gate_entry(IEE_WRITE_AFSR0); -+ #ifdef CONFIG_KOI -+ write_sysreg(read_sysreg(ttbr0_el1)+0x3000000000000, ttbr0_el1); -+ pr_info("IEE: current TTBR1_EL1:%llx, TTBR0:%llx\n", read_sysreg(ttbr1_el1), read_sysreg(ttbr0_el1)); -+ pr_info("IEE: testing iee_exec_entry switch to koi...\n"); -+ iee_rwx_gate_entry(IEE_SWITCH_TO_KOI, phys_to_ttbr(__pa_symbol(swapper_pg_dir))); -+ pr_info("IEE: current TTBR1_EL1:%llx, TTBR0:%llx\n", read_sysreg(ttbr1_el1), read_sysreg(ttbr0_el1)); -+ pr_info("IEE: testing iee_exec_entry switch to kernel...\n"); -+ iee_rwx_gate_entry(IEE_SWITCH_TO_KERNEL); -+ #endif -+} -+#else -+static void __init iee_si_hw_init(void){}; -+ -+static void iee_si_test_end(void) -+{ -+ pr_info("IEE: CONFIG_IEE not selected.\n"); -+} -+ -+#endif -+ - static int __ref kernel_init(void *unused) - { - int ret; -@@ -1441,6 +1583,13 @@ static int __ref kernel_init(void *unused) +@@ -1446,6 +1469,9 @@ static int __ref kernel_init(void *unused) wait_for_completion(&kthreadd_done); kernel_init_freeable(); + #ifdef CONFIG_PTP + iee_set_logical_mem_ro((unsigned long)bm_pte_addr); + #endif -+ #ifdef CONFIG_IEE -+ // init hw features that iee_si uses -+ iee_si_init_end(); -+ #endif /* need to finish all async __init code before freeing the memory */ async_synchronize_full(); -@@ -1458,6 +1607,9 @@ static int __ref kernel_init(void *unused) +@@ -1462,7 +1488,7 @@ static int __ref kernel_init(void *unused) + * to finalize PTI. */ pti_finalize(); - -+ // test iee_si_code. -+ iee_si_test_end(); +- + system_state = SYSTEM_RUNNING; numa_default_policy(); -@@ -1544,6 +1696,12 @@ static noinline void __init kernel_init_freeable(void) - if (disable_sdei_nmi_watchdog) - lockup_detector_init(); - -+ // zgcXXX: should it happen before `lockup_detector_init()` ? -+ #ifdef CONFIG_IEE -+ /* Copy swapper to iee_pg_dir again before smp init to handle KASLR issues. */ -+ memcpy(iee_pg_dir, swapper_pg_dir, PAGE_SIZE); -+ #endif -+ - smp_init(); - sched_init_smp(); - diff --git a/kernel/cred.c b/kernel/cred.c -index c033a201c808..ed4c54a18a57 100644 +index c033a201c808..2e44530976d5 100644 --- a/kernel/cred.c +++ b/kernel/cred.c @@ -20,6 +20,11 @@ @@ -11120,7 +10819,7 @@ index c033a201c808..ed4c54a18a57 100644 get_group_info(new->group_info); get_uid(new->user); get_user_ns(new->user_ns); -@@ -232,7 +334,11 @@ struct cred *prepare_creds(void) +@@ -232,10 +334,18 @@ struct cred *prepare_creds(void) #endif #ifdef CONFIG_SECURITY @@ -11131,8 +10830,15 @@ index c033a201c808..ed4c54a18a57 100644 +#endif #endif ++ #ifdef CONFIG_CREDP ++ iee_set_cred_ucounts(new, get_ucounts(new->ucounts)); ++ #else new->ucounts = get_ucounts(new->ucounts); -@@ -265,15 +371,30 @@ struct cred *prepare_exec_creds(void) ++ #endif + if (!new->ucounts) + goto error; + +@@ -265,15 +375,30 @@ struct cred *prepare_exec_creds(void) #ifdef CONFIG_KEYS /* newly exec'd tasks don't get a thread keyring */ key_put(new->thread_keyring); @@ -11163,7 +10869,7 @@ index c033a201c808..ed4c54a18a57 100644 return new; } -@@ -327,7 +448,11 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags) +@@ -327,7 +452,11 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags) * had one */ if (new->thread_keyring) { key_put(new->thread_keyring); @@ -11175,7 +10881,7 @@ index c033a201c808..ed4c54a18a57 100644 if (clone_flags & CLONE_THREAD) install_thread_keyring_to_cred(new); } -@@ -337,7 +462,11 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags) +@@ -337,7 +466,11 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags) */ if (!(clone_flags & CLONE_THREAD)) { key_put(new->process_keyring); @@ -11187,7 +10893,19 @@ index c033a201c808..ed4c54a18a57 100644 } #endif -@@ -606,8 +735,21 @@ int set_cred_ucounts(struct cred *new) +@@ -594,7 +727,11 @@ int set_cred_ucounts(struct cred *new) + if (!(new_ucounts = alloc_ucounts(new->user_ns, new->uid))) + return -EAGAIN; + ++ #ifdef CONFIG_CREDP ++ iee_set_cred_ucounts(new, new_ucounts); ++ #else + new->ucounts = new_ucounts; ++ #endif + put_ucounts(old_ucounts); + + return 0; +@@ -606,8 +743,21 @@ int set_cred_ucounts(struct cred *new) void __init cred_init(void) { /* allocate a slab in which we can store credentials */ @@ -11209,7 +10927,7 @@ index c033a201c808..ed4c54a18a57 100644 } /** -@@ -638,27 +780,50 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon) +@@ -638,29 +788,56 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon) if (!new) return NULL; @@ -11256,11 +10974,17 @@ index c033a201c808..ed4c54a18a57 100644 + iee_set_cred_security(new,NULL); +#else new->security = NULL; -+#endif #endif ++#endif ++ #ifdef CONFIG_CREDP ++ iee_set_cred_ucounts(new, get_ucounts(new->ucounts)); ++ #else new->ucounts = get_ucounts(new->ucounts); ++ #endif if (!new->ucounts) -@@ -727,8 +892,13 @@ int set_create_files_as(struct cred *new, struct inode *inode) + goto error; + +@@ -727,8 +904,13 @@ int set_create_files_as(struct cred *new, struct inode *inode) { if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid)) return -EINVAL; @@ -11301,7 +11025,7 @@ index 21a59a6e1f2e..d21a109f0497 100644 enter_lazy_tlb(mm, current); local_irq_enable(); diff --git a/kernel/fork.c b/kernel/fork.c -index caa8a5530883..df1800be0a18 100644 +index e033388b11bd..c93e18a4f0b3 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -115,6 +115,10 @@ @@ -11468,7 +11192,7 @@ index caa8a5530883..df1800be0a18 100644 { struct vm_area_struct *mpnt, *tmp; int retval; -@@ -751,7 +803,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, +@@ -773,7 +825,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, flush_dcache_mmap_lock(mapping); /* insert tmp into the share list, just after mpnt */ vma_interval_tree_insert_after(tmp, mpnt, @@ -11477,7 +11201,7 @@ index caa8a5530883..df1800be0a18 100644 flush_dcache_mmap_unlock(mapping); i_mmap_unlock_write(mapping); } -@@ -823,7 +875,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm) +@@ -842,7 +894,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm) mmap_write_unlock(oldmm); return 0; } @@ -11486,7 +11210,7 @@ index caa8a5530883..df1800be0a18 100644 #define mm_free_pgd(mm) #endif /* CONFIG_MMU */ -@@ -831,20 +883,22 @@ static void check_mm(struct mm_struct *mm) +@@ -850,20 +902,22 @@ static void check_mm(struct mm_struct *mm) { int i; @@ -11497,7 +11221,7 @@ index caa8a5530883..df1800be0a18 100644 + "Please make sure 'struct resident_page_types[]' is updated as well"); for (i = 0; i < NR_MM_COUNTERS; i++) { - long x = percpu_counter_sum(&mm->rss_stat[i]); + long x = mm_counter_sum(mm, i); if (unlikely(x)) - pr_alert("BUG: Bad rss-counter state mm:%p type:%s val:%ld\n", @@ -11514,7 +11238,7 @@ index caa8a5530883..df1800be0a18 100644 #if defined(CONFIG_TRANSPARENT_HUGEPAGE) && !USE_SPLIT_PMD_PTLOCKS VM_BUG_ON_MM(mm->pmd_huge_pte, mm); -@@ -995,14 +1049,6 @@ void __put_task_struct(struct task_struct *tsk) +@@ -1014,14 +1068,6 @@ void __put_task_struct(struct task_struct *tsk) } EXPORT_SYMBOL_GPL(__put_task_struct); @@ -11529,7 +11253,7 @@ index caa8a5530883..df1800be0a18 100644 void __init __weak arch_task_cache_init(void) { } /* -@@ -1020,8 +1066,8 @@ static void set_max_threads(unsigned int max_threads_suggested) +@@ -1039,8 +1085,8 @@ static void set_max_threads(unsigned int max_threads_suggested) if (fls64(nr_pages) + fls64(PAGE_SIZE) > 64) threads = MAX_THREADS; else @@ -11540,7 +11264,7 @@ index caa8a5530883..df1800be0a18 100644 if (threads > max_threads_suggested) threads = max_threads_suggested; -@@ -1056,17 +1102,24 @@ void __init fork_init(void) +@@ -1075,17 +1121,24 @@ void __init fork_init(void) int i; #ifndef CONFIG_ARCH_TASK_STRUCT_ALLOCATOR #ifndef ARCH_MIN_TASKALIGN @@ -11567,7 +11291,7 @@ index caa8a5530883..df1800be0a18 100644 #endif /* do the arch specific task caches init */ -@@ -1074,8 +1127,8 @@ void __init fork_init(void) +@@ -1093,8 +1146,8 @@ void __init fork_init(void) set_max_threads(MAX_THREADS); @@ -11578,7 +11302,7 @@ index caa8a5530883..df1800be0a18 100644 init_task.signal->rlim[RLIMIT_SIGPENDING] = init_task.signal->rlim[RLIMIT_NPROC]; -@@ -1088,8 +1141,8 @@ void __init fork_init(void) +@@ -1107,8 +1160,8 @@ void __init fork_init(void) set_userns_rlimit_max(&init_user_ns, UCOUNT_RLIMIT_MEMLOCK, RLIM_INFINITY); #ifdef CONFIG_VMAP_STACK @@ -11589,7 +11313,7 @@ index caa8a5530883..df1800be0a18 100644 #endif scs_init(); -@@ -1099,7 +1152,7 @@ void __init fork_init(void) +@@ -1118,7 +1171,7 @@ void __init fork_init(void) } int __weak arch_dup_task_struct(struct task_struct *dst, @@ -11598,7 +11322,7 @@ index caa8a5530883..df1800be0a18 100644 { *dst = *src; return 0; -@@ -1110,14 +1163,14 @@ void set_task_stack_end_magic(struct task_struct *tsk) +@@ -1129,14 +1182,14 @@ void set_task_stack_end_magic(struct task_struct *tsk) unsigned long *stackend; stackend = end_of_stack(tsk); @@ -11616,7 +11340,7 @@ index caa8a5530883..df1800be0a18 100644 if (!dst->_resvd) return false; -@@ -1290,7 +1343,7 @@ static void mm_init_uprobes_state(struct mm_struct *mm) +@@ -1309,7 +1362,7 @@ static void mm_init_uprobes_state(struct mm_struct *mm) } static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, @@ -11625,7 +11349,7 @@ index caa8a5530883..df1800be0a18 100644 { mt_init_flags(&mm->mm_mt, MM_MT_FLAGS); mt_set_external_lock(&mm->mm_mt, &mm->mmap_lock); -@@ -1412,8 +1465,8 @@ EXPORT_SYMBOL_GPL(mmput); +@@ -1425,8 +1478,8 @@ EXPORT_SYMBOL_GPL(mmput); #ifdef CONFIG_MMU static void mmput_async_fn(struct work_struct *work) { @@ -11636,7 +11360,7 @@ index caa8a5530883..df1800be0a18 100644 __mmput(mm); } -@@ -1589,13 +1642,12 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode) +@@ -1602,13 +1655,12 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode) struct mm_struct *mm; int err; @@ -11652,7 +11376,7 @@ index caa8a5530883..df1800be0a18 100644 mmput(mm); mm = ERR_PTR(-EACCES); } -@@ -1618,7 +1670,7 @@ static void complete_vfork_done(struct task_struct *tsk) +@@ -1631,7 +1683,7 @@ static void complete_vfork_done(struct task_struct *tsk) } static int wait_for_vfork_done(struct task_struct *child, @@ -11661,7 +11385,7 @@ index caa8a5530883..df1800be0a18 100644 { unsigned int state = TASK_UNINTERRUPTIBLE|TASK_KILLABLE|TASK_FREEZABLE; int killed; -@@ -1669,8 +1721,8 @@ static void mm_release(struct task_struct *tsk, struct mm_struct *mm) +@@ -1682,8 +1734,8 @@ static void mm_release(struct task_struct *tsk, struct mm_struct *mm) * not set up a proper pointer then tough luck. */ put_user(0, tsk->clear_child_tid); @@ -11672,7 +11396,7 @@ index caa8a5530883..df1800be0a18 100644 } tsk->clear_child_tid = NULL; } -@@ -1754,6 +1806,10 @@ static int copy_mm(unsigned long clone_flags, struct task_struct *tsk) +@@ -1767,6 +1819,10 @@ static int copy_mm(unsigned long clone_flags, struct task_struct *tsk) #endif tsk->mm = NULL; @@ -11683,7 +11407,7 @@ index caa8a5530883..df1800be0a18 100644 tsk->active_mm = NULL; /* -@@ -1775,6 +1831,10 @@ static int copy_mm(unsigned long clone_flags, struct task_struct *tsk) +@@ -1798,6 +1854,10 @@ static int copy_mm(unsigned long clone_flags, struct task_struct *tsk) } tsk->mm = mm; @@ -11694,7 +11418,7 @@ index caa8a5530883..df1800be0a18 100644 tsk->active_mm = mm; sched_mm_cid_fork(tsk); return 0; -@@ -1992,8 +2052,8 @@ static inline void init_task_pid_links(struct task_struct *task) +@@ -2015,8 +2075,8 @@ static inline void init_task_pid_links(struct task_struct *task) INIT_HLIST_NODE(&task->pid_links[type]); } @@ -11705,7 +11429,7 @@ index caa8a5530883..df1800be0a18 100644 { if (type == PIDTYPE_PID) task->thread_pid = pid; -@@ -2254,6 +2314,12 @@ static void copy_oom_score_adj(u64 clone_flags, struct task_struct *tsk) +@@ -2277,6 +2337,12 @@ static void copy_oom_score_adj(u64 clone_flags, struct task_struct *tsk) mutex_unlock(&oom_adj_mutex); } @@ -11718,7 +11442,7 @@ index caa8a5530883..df1800be0a18 100644 #ifdef CONFIG_RV static void rv_task_fork(struct task_struct *p) { -@@ -2286,15 +2352,21 @@ __latent_entropy struct task_struct *copy_process( +@@ -2309,15 +2375,21 @@ __latent_entropy struct task_struct *copy_process( struct file *pidfile = NULL; const u64 clone_flags = args->flags; struct nsproxy *nsp = current->nsproxy; @@ -11742,7 +11466,7 @@ index caa8a5530883..df1800be0a18 100644 return ERR_PTR(-EINVAL); /* -@@ -2319,7 +2391,7 @@ __latent_entropy struct task_struct *copy_process( +@@ -2342,7 +2414,7 @@ __latent_entropy struct task_struct *copy_process( * from creating siblings. */ if ((clone_flags & CLONE_PARENT) && @@ -11751,7 +11475,7 @@ index caa8a5530883..df1800be0a18 100644 return ERR_PTR(-EINVAL); /* -@@ -2364,6 +2436,15 @@ __latent_entropy struct task_struct *copy_process( +@@ -2387,6 +2459,15 @@ __latent_entropy struct task_struct *copy_process( p = dup_task_struct(current, node); if (!p) goto fork_out; @@ -11767,7 +11491,7 @@ index caa8a5530883..df1800be0a18 100644 p->flags &= ~PF_KTHREAD; if (args->kthread) p->flags |= PF_KTHREAD; -@@ -2385,7 +2466,8 @@ __latent_entropy struct task_struct *copy_process( +@@ -2408,7 +2489,8 @@ __latent_entropy struct task_struct *copy_process( /* * Clear TID on mm_release()? */ @@ -11777,7 +11501,7 @@ index caa8a5530883..df1800be0a18 100644 ftrace_graph_init_task(p); -@@ -2496,10 +2578,10 @@ __latent_entropy struct task_struct *copy_process( +@@ -2519,10 +2601,10 @@ __latent_entropy struct task_struct *copy_process( #endif #ifdef CONFIG_TRACE_IRQFLAGS memset(&p->irqtrace, 0, sizeof(p->irqtrace)); @@ -11792,7 +11516,7 @@ index caa8a5530883..df1800be0a18 100644 #endif p->pagefault_disabled = 0; -@@ -2512,8 +2594,8 @@ __latent_entropy struct task_struct *copy_process( +@@ -2535,8 +2617,8 @@ __latent_entropy struct task_struct *copy_process( p->blocked_on = NULL; /* not blocked yet */ #endif #ifdef CONFIG_BCACHE @@ -11803,7 +11527,7 @@ index caa8a5530883..df1800be0a18 100644 #endif #ifdef CONFIG_BPF_SYSCALL RCU_INIT_POINTER(p->bpf_storage, NULL); -@@ -2600,7 +2682,7 @@ __latent_entropy struct task_struct *copy_process( +@@ -2623,7 +2705,7 @@ __latent_entropy struct task_struct *copy_process( /* * sigaltstack should be cleared when sharing the same VM */ @@ -11812,7 +11536,7 @@ index caa8a5530883..df1800be0a18 100644 sas_ss_reset(p); /* -@@ -2679,7 +2761,7 @@ __latent_entropy struct task_struct *copy_process( +@@ -2702,7 +2784,7 @@ __latent_entropy struct task_struct *copy_process( write_lock_irq(&tasklist_lock); /* CLONE_PARENT re-uses the old parent */ @@ -11821,7 +11545,7 @@ index caa8a5530883..df1800be0a18 100644 p->real_parent = current->real_parent; p->parent_exec_id = current->parent_exec_id; if (clone_flags & CLONE_THREAD) -@@ -2743,8 +2825,9 @@ __latent_entropy struct task_struct *copy_process( +@@ -2766,8 +2848,9 @@ __latent_entropy struct task_struct *copy_process( * tasklist_lock with adding child to the process tree * for propagate_has_child_subreaper optimization. */ @@ -11833,7 +11557,7 @@ index caa8a5530883..df1800be0a18 100644 list_add_tail(&p->sibling, &p->real_parent->children); list_add_tail_rcu(&p->tasks, &init_task.tasks); attach_pid(p, PIDTYPE_TGID); -@@ -2895,8 +2978,8 @@ struct task_struct * __init fork_idle(int cpu) +@@ -2918,8 +3001,8 @@ struct task_struct * __init fork_idle(int cpu) */ struct task_struct *create_io_thread(int (*fn)(void *), void *arg, int node) { @@ -11844,7 +11568,7 @@ index caa8a5530883..df1800be0a18 100644 struct kernel_clone_args args = { .flags = ((lower_32_bits(flags) | CLONE_VM | CLONE_UNTRACED) & ~CSIGNAL), -@@ -3060,8 +3143,8 @@ SYSCALL_DEFINE0(fork) +@@ -3083,8 +3166,8 @@ SYSCALL_DEFINE0(fork) SYSCALL_DEFINE0(vfork) { struct kernel_clone_args args = { @@ -11855,7 +11579,7 @@ index caa8a5530883..df1800be0a18 100644 }; return kernel_clone(&args); -@@ -3071,35 +3154,30 @@ SYSCALL_DEFINE0(vfork) +@@ -3094,35 +3177,30 @@ SYSCALL_DEFINE0(vfork) #ifdef __ARCH_WANT_SYS_CLONE #ifdef CONFIG_CLONE_BACKWARDS SYSCALL_DEFINE5(clone, unsigned long, clone_flags, unsigned long, newsp, @@ -11907,7 +11631,7 @@ index caa8a5530883..df1800be0a18 100644 }; return kernel_clone(&args); -@@ -3155,21 +3233,21 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs, +@@ -3178,21 +3256,21 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs, return -EINVAL; *kargs = (struct kernel_clone_args){ @@ -11941,7 +11665,7 @@ index caa8a5530883..df1800be0a18 100644 return -EFAULT; kargs->set_tid = kset_tid; -@@ -3264,7 +3342,8 @@ SYSCALL_DEFINE2(clone3, struct clone_args __user *, uargs, size_t, size) +@@ -3287,7 +3365,8 @@ SYSCALL_DEFINE2(clone3, struct clone_args __user *, uargs, size_t, size) } #endif @@ -11951,7 +11675,7 @@ index caa8a5530883..df1800be0a18 100644 { struct task_struct *leader, *parent, *child; int res; -@@ -3272,8 +3351,8 @@ void walk_process_tree(struct task_struct *top, proc_visitor visitor, void *data +@@ -3295,8 +3374,8 @@ void walk_process_tree(struct task_struct *top, proc_visitor visitor, void *data read_lock(&tasklist_lock); leader = top = top->group_leader; down: @@ -11962,7 +11686,7 @@ index caa8a5530883..df1800be0a18 100644 res = visitor(child, data); if (res) { if (res < 0) -@@ -3281,8 +3360,7 @@ void walk_process_tree(struct task_struct *top, proc_visitor visitor, void *data +@@ -3304,8 +3383,7 @@ void walk_process_tree(struct task_struct *top, proc_visitor visitor, void *data leader = child; goto down; } @@ -11972,7 +11696,7 @@ index caa8a5530883..df1800be0a18 100644 } } -@@ -3359,11 +3437,11 @@ void __init proc_caches_init(void) +@@ -3382,11 +3460,11 @@ void __init proc_caches_init(void) */ static int check_unshare_flags(unsigned long unshare_flags) { @@ -11989,7 +11713,7 @@ index caa8a5530883..df1800be0a18 100644 return -EINVAL; /* * Not implemented, but pretend it works if there is nothing -@@ -3474,7 +3552,7 @@ int ksys_unshare(unsigned long unshare_flags) +@@ -3497,7 +3575,7 @@ int ksys_unshare(unsigned long unshare_flags) * to a new ipc namespace, the semaphore arrays from the old * namespace are unreachable. */ @@ -11998,7 +11722,7 @@ index caa8a5530883..df1800be0a18 100644 do_sysvsem = 1; err = unshare_fs(unshare_flags, &new_fs); if (err) -@@ -3485,8 +3563,8 @@ int ksys_unshare(unsigned long unshare_flags) +@@ -3508,8 +3586,8 @@ int ksys_unshare(unsigned long unshare_flags) err = unshare_userns(unshare_flags, &new_cred); if (err) goto bad_unshare_cleanup_fd; @@ -12009,7 +11733,7 @@ index caa8a5530883..df1800be0a18 100644 if (err) goto bad_unshare_cleanup_cred; -@@ -3583,8 +3661,8 @@ int unshare_files(void) +@@ -3606,8 +3684,8 @@ int unshare_files(void) return 0; } @@ -12112,71 +11836,8 @@ index f47d8f375946..60c7d365c0e1 100644 } } -diff --git a/kernel/stacktrace.c b/kernel/stacktrace.c -index 9ed5ce989415..85ded4f4b630 100644 ---- a/kernel/stacktrace.c -+++ b/kernel/stacktrace.c -@@ -15,6 +15,10 @@ - #include - #include - -+#ifdef CONFIG_IEE -+#include -+#endif -+ - /** - * stack_trace_print - Print the entries in the stack trace - * @entries: Pointer to storage array -@@ -94,6 +98,23 @@ static bool stack_trace_consume_entry(void *cookie, unsigned long addr) - return c->len < c->size; - } - -+#ifdef CONFIG_IEE -+static bool stack_trace_consume_entry_iee(void *cookie, unsigned long addr) -+{ -+ struct stacktrace_cookie *c = cookie; -+ -+ if (c->len >= c->size) -+ return false; -+ -+ if (c->skip > 0) { -+ c->skip--; -+ return true; -+ } -+ iee_write_in_byte(&(c->store[c->len++]), addr, 8); -+ return c->len < c->size; -+} -+#endif -+ - static bool stack_trace_consume_entry_nosched(void *cookie, unsigned long addr) - { - if (in_sched_functions(addr)) -@@ -124,6 +145,23 @@ unsigned int stack_trace_save(unsigned long *store, unsigned int size, - } - EXPORT_SYMBOL_GPL(stack_trace_save); - -+#ifdef CONFIG_IEE -+unsigned int stack_trace_save_iee(unsigned long *store, unsigned int size, -+ unsigned int skipnr) -+{ -+ stack_trace_consume_fn consume_entry = stack_trace_consume_entry_iee; -+ struct stacktrace_cookie c = { -+ .store = store, -+ .size = size, -+ .skip = skipnr + 1, -+ }; -+ -+ arch_stack_walk(consume_entry, &c, current, NULL); -+ return c.len; -+} -+EXPORT_SYMBOL_GPL(stack_trace_save_iee); -+#endif -+ - /** - * stack_trace_save_tsk - Save a task stack trace into a storage array - * @task: The task to examine diff --git a/kernel/sys.c b/kernel/sys.c -index 7a4ae6d5aecd..a4a607e8d1c2 100644 +index 44b575990333..fbc47f83af50 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -75,6 +75,10 @@ @@ -12499,7 +12160,7 @@ index 1d8e47bed3f1..9f1921025539 100644 static unsigned long enforced_nproc_rlimit(void) diff --git a/mm/Kconfig b/mm/Kconfig -index cdbb1ceaa554..0540d445eedb 100644 +index 45d4139c959c..eb9d41768c15 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -530,6 +530,18 @@ config NUMA_KEEP_MEMINFO @@ -12534,10 +12195,10 @@ index d25d99cb5f2b..2ea51f559d4e 100644 folio_set_young(folio); diff --git a/mm/debug_vm_pgtable.c b/mm/debug_vm_pgtable.c -index 48e329ea5ba3..495848c451b6 100644 +index 13f0d1192707..60dc95c5b286 100644 --- a/mm/debug_vm_pgtable.c +++ b/mm/debug_vm_pgtable.c -@@ -444,7 +444,11 @@ static void __init pmd_huge_tests(struct pgtable_debug_args *args) +@@ -452,7 +452,11 @@ static void __init pmd_huge_tests(struct pgtable_debug_args *args) * X86 defined pmd_set_huge() verifies that the given * PMD is not a populated non-leaf entry. */ @@ -12549,7 +12210,7 @@ index 48e329ea5ba3..495848c451b6 100644 WARN_ON(!pmd_set_huge(args->pmdp, __pfn_to_phys(args->fixed_pmd_pfn), args->page_prot)); WARN_ON(!pmd_clear_huge(args->pmdp)); pmd = READ_ONCE(*args->pmdp); -@@ -464,7 +468,11 @@ static void __init pud_huge_tests(struct pgtable_debug_args *args) +@@ -472,7 +476,11 @@ static void __init pud_huge_tests(struct pgtable_debug_args *args) * X86 defined pud_set_huge() verifies that the given * PUD is not a populated non-leaf entry. */ @@ -12561,7 +12222,7 @@ index 48e329ea5ba3..495848c451b6 100644 WARN_ON(!pud_set_huge(args->pudp, __pfn_to_phys(args->fixed_pud_pfn), args->page_prot)); WARN_ON(!pud_clear_huge(args->pudp)); pud = READ_ONCE(*args->pudp); -@@ -503,7 +511,11 @@ static void __init pud_clear_tests(struct pgtable_debug_args *args) +@@ -511,7 +519,11 @@ static void __init pud_clear_tests(struct pgtable_debug_args *args) pr_debug("Validating PUD clear\n"); pud = __pud(pud_val(pud) | RANDOM_ORVALUE); @@ -12573,7 +12234,7 @@ index 48e329ea5ba3..495848c451b6 100644 pud_clear(args->pudp); pud = READ_ONCE(*args->pudp); WARN_ON(!pud_none(pud)); -@@ -540,7 +552,11 @@ static void __init p4d_clear_tests(struct pgtable_debug_args *args) +@@ -548,7 +560,11 @@ static void __init p4d_clear_tests(struct pgtable_debug_args *args) pr_debug("Validating P4D clear\n"); p4d = __p4d(p4d_val(p4d) | RANDOM_ORVALUE); @@ -12585,7 +12246,7 @@ index 48e329ea5ba3..495848c451b6 100644 p4d_clear(args->p4dp); p4d = READ_ONCE(*args->p4dp); WARN_ON(!p4d_none(p4d)); -@@ -574,7 +590,11 @@ static void __init pgd_clear_tests(struct pgtable_debug_args *args) +@@ -582,7 +598,11 @@ static void __init pgd_clear_tests(struct pgtable_debug_args *args) pr_debug("Validating PGD clear\n"); pgd = __pgd(pgd_val(pgd) | RANDOM_ORVALUE); @@ -12597,7 +12258,7 @@ index 48e329ea5ba3..495848c451b6 100644 pgd_clear(args->pgdp); pgd = READ_ONCE(*args->pgdp); WARN_ON(!pgd_none(pgd)); -@@ -642,7 +662,11 @@ static void __init pmd_clear_tests(struct pgtable_debug_args *args) +@@ -650,7 +670,11 @@ static void __init pmd_clear_tests(struct pgtable_debug_args *args) pr_debug("Validating PMD clear\n"); pmd = __pmd(pmd_val(pmd) | RANDOM_ORVALUE); @@ -12693,12 +12354,12 @@ index ce06b2884789..a039c7a50ec5 100644 void __init __iomem * early_ioremap(resource_size_t phys_addr, unsigned long size) diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index 5a2131be4540..88b29e607032 100644 +index 763bb25e4f99..80bb2c0abeda 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c -@@ -38,6 +38,10 @@ - #include +@@ -39,6 +39,10 @@ #include + #include +#ifdef CONFIG_PTP +#include @@ -12707,7 +12368,7 @@ index 5a2131be4540..88b29e607032 100644 #include #include #include "internal.h" -@@ -2217,6 +2221,10 @@ static void __split_huge_zero_page_pmd(struct vm_area_struct *vma, +@@ -2489,6 +2493,10 @@ static void __split_huge_zero_page_pmd(struct vm_area_struct *vma, unsigned long addr; pte_t *pte; int i; @@ -12718,7 +12379,7 @@ index 5a2131be4540..88b29e607032 100644 /* * Leave pmd empty until pte is filled note that it is fine to delay -@@ -2229,7 +2237,14 @@ static void __split_huge_zero_page_pmd(struct vm_area_struct *vma, +@@ -2501,7 +2509,14 @@ static void __split_huge_zero_page_pmd(struct vm_area_struct *vma, old_pmd = pmdp_huge_clear_flush(vma, haddr, pmd); pgtable = pgtable_trans_huge_withdraw(mm, pmd); @@ -12734,7 +12395,7 @@ index 5a2131be4540..88b29e607032 100644 pte = pte_offset_map(&_pmd, haddr); VM_BUG_ON(!pte); -@@ -2261,6 +2276,10 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, +@@ -2534,6 +2549,10 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, unsigned long addr; pte_t *pte; int i; @@ -12745,7 +12406,7 @@ index 5a2131be4540..88b29e607032 100644 VM_BUG_ON(haddr & ~HPAGE_PMD_MASK); VM_BUG_ON_VMA(vma->vm_start > haddr, vma); -@@ -2387,7 +2406,14 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, +@@ -2671,7 +2690,14 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, * This's critical for some architectures (Power). */ pgtable = pgtable_trans_huge_withdraw(mm, pmd); @@ -12787,7 +12448,7 @@ index 24c809379274..07d060fca6f0 100644 +} +#endif diff --git a/mm/memory.c b/mm/memory.c -index 9a0b8f2f6f4b..4384f5aac0a9 100644 +index 4ef917a182f9..28da89a19e30 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -80,6 +80,10 @@ @@ -12801,7 +12462,7 @@ index 9a0b8f2f6f4b..4384f5aac0a9 100644 #include #include -@@ -5661,6 +5665,11 @@ int __pud_alloc(struct mm_struct *mm, p4d_t *p4d, unsigned long address) +@@ -5872,6 +5876,11 @@ int __pud_alloc(struct mm_struct *mm, p4d_t *p4d, unsigned long address) spin_lock(&mm->page_table_lock); if (!p4d_present(*p4d)) { @@ -12813,7 +12474,7 @@ index 9a0b8f2f6f4b..4384f5aac0a9 100644 mm_inc_nr_puds(mm); smp_wmb(); /* See comment in pmd_install() */ p4d_populate(mm, p4d, new); -@@ -5685,6 +5694,11 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address) +@@ -5896,6 +5905,11 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address) ptl = pud_lock(mm, pud); if (!pud_present(*pud)) { @@ -12825,23 +12486,8 @@ index 9a0b8f2f6f4b..4384f5aac0a9 100644 mm_inc_nr_pmds(mm); smp_wmb(); /* See comment in pmd_install() */ pud_populate(mm, pud, new); -diff --git a/mm/mm_init.c b/mm/mm_init.c -index 0a3c20a00318..a32dc6d50952 100644 ---- a/mm/mm_init.c -+++ b/mm/mm_init.c -@@ -2829,4 +2829,10 @@ void __init mm_core_init(void) - pti_init(); - kmsan_init_runtime(); - mm_cache_init(); -+ -+ #ifdef CONFIG_IEE -+ /* Copy swapper to iee_pg_dir again after vmemmap is built. */ -+ memcpy(iee_pg_dir, swapper_pg_dir, PAGE_SIZE); -+ flush_tlb_all(); -+ #endif - } diff --git a/mm/slub.c b/mm/slub.c -index f7940048138c..199e5e9c3781 100644 +index ee3e32cdb7fd..20a45a7feed5 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -42,6 +42,11 @@ @@ -12856,7 +12502,7 @@ index f7940048138c..199e5e9c3781 100644 #include #include -@@ -302,6 +307,7 @@ static inline bool kmem_cache_has_cpu_partial(struct kmem_cache *s) +@@ -317,6 +322,7 @@ static inline bool kmem_cache_has_cpu_partial(struct kmem_cache *s) /* * Tracking user of a slab. */ @@ -12864,7 +12510,7 @@ index f7940048138c..199e5e9c3781 100644 #define TRACK_ADDRS_COUNT 16 struct track { unsigned long addr; /* Called from address */ -@@ -314,6 +320,7 @@ struct track { +@@ -329,6 +335,7 @@ struct track { }; enum track_item { TRACK_ALLOC, TRACK_FREE }; @@ -12872,7 +12518,7 @@ index f7940048138c..199e5e9c3781 100644 #ifdef SLAB_SUPPORTS_SYSFS static int sysfs_slab_add(struct kmem_cache *); -@@ -364,7 +371,9 @@ static struct workqueue_struct *flushwq; +@@ -379,7 +386,9 @@ static struct workqueue_struct *flushwq; * freeptr_t represents a SLUB freelist pointer, which might be encoded * and not dereferenceable if CONFIG_SLAB_FREELIST_HARDENED is enabled. */ @@ -12882,7 +12528,7 @@ index f7940048138c..199e5e9c3781 100644 /* * Returns freelist pointer (ptr). With hardening, this is obfuscated -@@ -449,7 +458,14 @@ static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp) +@@ -464,7 +473,14 @@ static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp) #endif freeptr_addr = (unsigned long)kasan_reset_tag((void *)freeptr_addr); @@ -12897,32 +12543,7 @@ index f7940048138c..199e5e9c3781 100644 } /* Loop over all objects in a slab */ -@@ -782,6 +798,24 @@ static noinline depot_stack_handle_t set_track_prepare(void) - - return handle; - } -+#ifdef CONFIG_IEE -+static noinline depot_stack_handle_t set_track_prepare_iee(struct kmem_cache *s) -+{ -+ depot_stack_handle_t handle; -+ unsigned long entries[TRACK_ADDRS_COUNT]; -+ unsigned int nr_entries; -+ -+ if (IS_ENABLED(CONFIG_CREDP) && strcmp(s->name, "cred_jar") == 0) { -+ nr_entries = stack_trace_save_iee(entries, ARRAY_SIZE(entries), 3); -+ } -+ else { -+ nr_entries = stack_trace_save(entries, ARRAY_SIZE(entries), 3); -+ } -+ handle = stack_depot_save(entries, nr_entries, GFP_NOWAIT); -+ -+ return handle; -+} -+#endif - #else - static inline depot_stack_handle_t set_track_prepare(void) - { -@@ -794,7 +828,34 @@ static void set_track_update(struct kmem_cache *s, void *object, +@@ -809,7 +825,34 @@ static void set_track_update(struct kmem_cache *s, void *object, depot_stack_handle_t handle) { struct track *p = get_track(s, object, alloc); @@ -12957,7 +12578,7 @@ index f7940048138c..199e5e9c3781 100644 #ifdef CONFIG_STACKDEPOT p->handle = handle; #endif -@@ -802,12 +863,17 @@ static void set_track_update(struct kmem_cache *s, void *object, +@@ -817,6 +860,7 @@ static void set_track_update(struct kmem_cache *s, void *object, p->cpu = smp_processor_id(); p->pid = current->pid; p->when = jiffies; @@ -12965,17 +12586,7 @@ index f7940048138c..199e5e9c3781 100644 } static __always_inline void set_track(struct kmem_cache *s, void *object, - enum track_item alloc, unsigned long addr) - { -+#ifdef CONFIG_IEE -+ depot_stack_handle_t handle = set_track_prepare_iee(s); -+#else - depot_stack_handle_t handle = set_track_prepare(); -+#endif - - set_track_update(s, object, alloc, addr, handle); - } -@@ -820,7 +886,14 @@ static void init_tracking(struct kmem_cache *s, void *object) +@@ -835,7 +879,14 @@ static void init_tracking(struct kmem_cache *s, void *object) return; p = get_track(s, object, TRACK_ALLOC); @@ -12990,7 +12601,7 @@ index f7940048138c..199e5e9c3781 100644 } static void print_track(const char *s, struct track *t, unsigned long pr_time) -@@ -1030,7 +1103,14 @@ static void init_object(struct kmem_cache *s, void *object, u8 val) +@@ -1045,7 +1096,14 @@ static void init_object(struct kmem_cache *s, void *object, u8 val) unsigned int poison_size = s->object_size; if (s->flags & SLAB_RED_ZONE) { @@ -13005,7 +12616,7 @@ index f7940048138c..199e5e9c3781 100644 if (slub_debug_orig_size(s) && val == SLUB_RED_ACTIVE) { /* -@@ -1043,12 +1123,34 @@ static void init_object(struct kmem_cache *s, void *object, u8 val) +@@ -1058,12 +1116,34 @@ static void init_object(struct kmem_cache *s, void *object, u8 val) } if (s->flags & __OBJECT_POISON) { @@ -13041,7 +12652,7 @@ index f7940048138c..199e5e9c3781 100644 } static void restore_bytes(struct kmem_cache *s, char *message, u8 data, -@@ -1418,7 +1520,14 @@ void setup_slab_debug(struct kmem_cache *s, struct slab *slab, void *addr) +@@ -1433,7 +1513,14 @@ void setup_slab_debug(struct kmem_cache *s, struct slab *slab, void *addr) return; metadata_access_enable(); @@ -13056,7 +12667,7 @@ index f7940048138c..199e5e9c3781 100644 metadata_access_disable(); } -@@ -2001,6 +2110,9 @@ static struct slab *allocate_slab(struct kmem_cache *s, gfp_t flags, int node) +@@ -2015,6 +2102,9 @@ static struct slab *allocate_slab(struct kmem_cache *s, gfp_t flags, int node) void *start, *p, *next; int idx; bool shuffle; @@ -13066,7 +12677,7 @@ index f7940048138c..199e5e9c3781 100644 flags &= gfp_allowed_mask; -@@ -2015,6 +2127,9 @@ static struct slab *allocate_slab(struct kmem_cache *s, gfp_t flags, int node) +@@ -2029,6 +2119,9 @@ static struct slab *allocate_slab(struct kmem_cache *s, gfp_t flags, int node) alloc_gfp = (alloc_gfp | __GFP_NOMEMALLOC) & ~__GFP_RECLAIM; slab = alloc_slab_page(alloc_gfp, node, oo); @@ -13076,7 +12687,7 @@ index f7940048138c..199e5e9c3781 100644 if (unlikely(!slab)) { oo = s->min; alloc_gfp = flags; -@@ -2023,6 +2138,9 @@ static struct slab *allocate_slab(struct kmem_cache *s, gfp_t flags, int node) +@@ -2037,6 +2130,9 @@ static struct slab *allocate_slab(struct kmem_cache *s, gfp_t flags, int node) * Try a lower order alloc if possible */ slab = alloc_slab_page(alloc_gfp, node, oo); @@ -13086,7 +12697,7 @@ index f7940048138c..199e5e9c3781 100644 if (unlikely(!slab)) return NULL; stat(s, ORDER_FALLBACK); -@@ -2032,6 +2150,45 @@ static struct slab *allocate_slab(struct kmem_cache *s, gfp_t flags, int node) +@@ -2046,6 +2142,45 @@ static struct slab *allocate_slab(struct kmem_cache *s, gfp_t flags, int node) slab->inuse = 0; slab->frozen = 0; @@ -13132,7 +12743,7 @@ index f7940048138c..199e5e9c3781 100644 account_slab(slab, oo_order(oo), s, flags); slab->slab_cache = s; -@@ -2084,6 +2241,67 @@ static void __free_slab(struct kmem_cache *s, struct slab *slab) +@@ -2098,6 +2233,67 @@ static void __free_slab(struct kmem_cache *s, struct slab *slab) __folio_clear_slab(folio); mm_account_reclaimed_pages(pages); unaccount_slab(slab, order, s); @@ -13258,42 +12869,11 @@ index a2cbe44c48e1..7cf05d293312 100644 return p; } -diff --git a/mm/swap.c b/mm/swap.c -index cd8f0150ba3a..32b3b9818dc8 100644 ---- a/mm/swap.c -+++ b/mm/swap.c -@@ -38,6 +38,10 @@ - #include - #include - -+#ifdef CONFIG_PTP -+#include -+#endif -+ - #include "internal.h" - - #define CREATE_TRACE_POINTS -@@ -121,6 +125,15 @@ static void __folio_put_large(struct folio *folio) - - void __folio_put(struct folio *folio) - { -+#ifdef CONFIG_PTP -+ if(folio_ref_count(folio) == 0) -+ { -+ unsigned long iee_addr = __phys_to_iee(__pa(page_address(&folio->page))); -+ set_iee_page_invalid(iee_addr); -+ iee_set_logical_mem_rw((unsigned long)page_address(&folio->page)); -+ } -+#endif -+ - if (unlikely(folio_is_zone_device(folio))) - free_zone_device_page(&folio->page); - else if (unlikely(folio_test_large(folio))) diff --git a/mm/vmalloc.c b/mm/vmalloc.c -index 31761425d7a8..7145b071185c 100644 +index e6058942a084..27a006728009 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c -@@ -2949,7 +2949,7 @@ static int vmap_pfn_apply(pte_t *pte, unsigned long addr, void *private) +@@ -3431,7 +3431,7 @@ static int vmap_pfn_apply(pte_t *pte, unsigned long addr, void *private) if (WARN_ON_ONCE(pfn_valid(pfn))) return -EINVAL; @@ -13303,7 +12883,7 @@ index 31761425d7a8..7145b071185c 100644 set_pte_at(&init_mm, addr, pte, ptent); diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c -index 01e54b46ae0b..b94f8dd54281 100644 +index c42ddd85ff1f..4714b4f2be08 100644 --- a/net/dns_resolver/dns_key.c +++ b/net/dns_resolver/dns_key.c @@ -34,6 +34,10 @@ @@ -13317,7 +12897,7 @@ index 01e54b46ae0b..b94f8dd54281 100644 MODULE_DESCRIPTION("DNS Resolver"); MODULE_AUTHOR("Wang Lei"); MODULE_LICENSE("GPL"); -@@ -358,8 +362,13 @@ static int __init init_dns_resolver(void) +@@ -365,8 +369,13 @@ static int __init init_dns_resolver(void) /* instruct request_key() to use this special keyring as a cache for * the results it looks up */ set_bit(KEY_FLAG_ROOT_CAN_CLEAR, &keyring->flags); @@ -13332,7 +12912,7 @@ index 01e54b46ae0b..b94f8dd54281 100644 kdebug("DNS resolver keyring: %d\n", key_serial(keyring)); diff --git a/security/commoncap.c b/security/commoncap.c -index bc0521104197..09e7a26102c9 100644 +index bc0521104197..d7d3b7cc13e8 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -26,6 +26,10 @@ @@ -13387,13 +12967,15 @@ index bc0521104197..09e7a26102c9 100644 if (caps->permitted.val & ~new->cap_permitted.val) /* insufficient to execute correctly */ -@@ -726,7 +747,13 @@ static int get_file_caps(struct linux_binprm *bprm, struct file *file, +@@ -726,7 +747,15 @@ static int get_file_caps(struct linux_binprm *bprm, struct file *file, int rc = 0; struct cpu_vfs_cap_data vcaps; + #ifdef CONFIG_CREDP + do { -+ iee_set_cred_cap_permitted(bprm->cred, __cap_empty_set); ++ kernel_cap_t tmp_cap = bprm->cred->cap_permitted; ++ tmp_cap.val = 0; ++ iee_set_cred_cap_permitted(bprm->cred, tmp_cap); + } while (0); + #else cap_clear(bprm->cred->cap_permitted); @@ -13401,13 +12983,15 @@ index bc0521104197..09e7a26102c9 100644 if (!file_caps_enabled) return 0; -@@ -757,7 +784,13 @@ static int get_file_caps(struct linux_binprm *bprm, struct file *file, +@@ -757,7 +786,15 @@ static int get_file_caps(struct linux_binprm *bprm, struct file *file, out: if (rc) + #ifdef CONFIG_CREDP + do { -+ iee_set_cred_cap_permitted(bprm->cred, __cap_empty_set); ++ kernel_cap_t tmp_cap = bprm->cred->cap_permitted; ++ tmp_cap.val = 0; ++ iee_set_cred_cap_permitted(bprm->cred, tmp_cap); + } while (0); + #else cap_clear(bprm->cred->cap_permitted); @@ -13415,7 +12999,7 @@ index bc0521104197..09e7a26102c9 100644 return rc; } -@@ -809,8 +842,13 @@ static void handle_privileged_root(struct linux_binprm *bprm, bool has_fcap, +@@ -809,8 +846,13 @@ static void handle_privileged_root(struct linux_binprm *bprm, bool has_fcap, */ if (__is_eff(root_uid, new) || __is_real(root_uid, new)) { /* pP' = (cap_bset & ~0) | (pI & ~0) */ @@ -13429,7 +13013,7 @@ index bc0521104197..09e7a26102c9 100644 } /* * If only the real uid is 0, we do not set the effective bit. -@@ -919,34 +957,69 @@ int cap_bprm_creds_from_file(struct linux_binprm *bprm, struct file *file) +@@ -919,34 +961,71 @@ int cap_bprm_creds_from_file(struct linux_binprm *bprm, struct file *file) /* downgrade; they get no more than they had, and maybe less */ if (!ns_capable(new->user_ns, CAP_SETUID) || (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)) { @@ -13464,7 +13048,9 @@ index bc0521104197..09e7a26102c9 100644 if (has_fcap || is_setid) + #ifdef CONFIG_CREDP + do { -+ iee_set_cred_cap_ambient(new, __cap_empty_set); ++ kernel_cap_t tmp_cap = new->cap_ambient; ++ tmp_cap.val = 0; ++ iee_set_cred_cap_ambient(new, tmp_cap); + } while (0); + #else cap_clear(new->cap_ambient); @@ -13499,7 +13085,7 @@ index bc0521104197..09e7a26102c9 100644 if (WARN_ON(!cap_ambient_invariant_ok(new))) return -EPERM; -@@ -957,7 +1030,11 @@ int cap_bprm_creds_from_file(struct linux_binprm *bprm, struct file *file) +@@ -957,7 +1036,11 @@ int cap_bprm_creds_from_file(struct linux_binprm *bprm, struct file *file) return ret; } @@ -13511,16 +13097,20 @@ index bc0521104197..09e7a26102c9 100644 if (WARN_ON(!cap_ambient_invariant_ok(new))) return -EPERM; -@@ -1092,8 +1169,17 @@ static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old) +@@ -1092,8 +1175,21 @@ static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old) !uid_eq(new->euid, root_uid) && !uid_eq(new->suid, root_uid))) { if (!issecure(SECURE_KEEP_CAPS)) { + #ifdef CONFIG_CREDP + do { -+ iee_set_cred_cap_permitted(new, __cap_empty_set); ++ kernel_cap_t tmp_cap = new->cap_permitted; ++ tmp_cap.val = 0; ++ iee_set_cred_cap_permitted(new, tmp_cap); + } while (0); + do { -+ iee_set_cred_cap_effective(new, __cap_empty_set); ++ kernel_cap_t tmp_cap = new->cap_effective; ++ tmp_cap.val = 0; ++ iee_set_cred_cap_effective(new, tmp_cap); + } while (0); + #else cap_clear(new->cap_permitted); @@ -13529,13 +13119,15 @@ index bc0521104197..09e7a26102c9 100644 } /* -@@ -1101,12 +1187,28 @@ static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old) +@@ -1101,12 +1197,32 @@ static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old) * by exec to drop capabilities. We should make sure that * this remains the case. */ + #ifdef CONFIG_CREDP + do { -+ iee_set_cred_cap_ambient(new, __cap_empty_set); ++ kernel_cap_t tmp_cap = new->cap_ambient; ++ tmp_cap.val = 0; ++ iee_set_cred_cap_ambient(new, tmp_cap); + } while (0); + #else cap_clear(new->cap_ambient); @@ -13544,7 +13136,9 @@ index bc0521104197..09e7a26102c9 100644 if (uid_eq(old->euid, root_uid) && !uid_eq(new->euid, root_uid)) + #ifdef CONFIG_CREDP + do { -+ iee_set_cred_cap_effective(new, __cap_empty_set); ++ kernel_cap_t tmp_cap = new->cap_effective; ++ tmp_cap.val = 0; ++ iee_set_cred_cap_effective(new, tmp_cap); + } while (0); + #else cap_clear(new->cap_effective); @@ -13558,7 +13152,7 @@ index bc0521104197..09e7a26102c9 100644 } /** -@@ -1142,13 +1244,22 @@ int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags) +@@ -1142,13 +1258,22 @@ int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags) if (!issecure(SECURE_NO_SETUID_FIXUP)) { kuid_t root_uid = make_kuid(old->user_ns, 0); if (uid_eq(old->fsuid, root_uid) && !uid_eq(new->fsuid, root_uid)) @@ -13581,7 +13175,7 @@ index bc0521104197..09e7a26102c9 100644 } break; -@@ -1243,7 +1354,15 @@ static int cap_prctl_drop(unsigned long cap) +@@ -1243,7 +1368,15 @@ static int cap_prctl_drop(unsigned long cap) new = prepare_creds(); if (!new) return -ENOMEM; @@ -13597,7 +13191,7 @@ index bc0521104197..09e7a26102c9 100644 return commit_creds(new); } -@@ -1319,7 +1438,11 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3, +@@ -1319,7 +1452,11 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3, new = prepare_creds(); if (!new) return -ENOMEM; @@ -13609,7 +13203,7 @@ index bc0521104197..09e7a26102c9 100644 return commit_creds(new); case PR_GET_SECUREBITS: -@@ -1338,9 +1461,17 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3, +@@ -1338,9 +1475,17 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3, if (!new) return -ENOMEM; if (arg2) @@ -13627,13 +13221,15 @@ index bc0521104197..09e7a26102c9 100644 return commit_creds(new); case PR_CAP_AMBIENT: -@@ -1351,7 +1482,13 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3, +@@ -1351,7 +1496,15 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3, new = prepare_creds(); if (!new) return -ENOMEM; + #ifdef CONFIG_CREDP + do { -+ iee_set_cred_cap_ambient(new, __cap_empty_set); ++ kernel_cap_t tmp_cap = new->cap_ambient; ++ tmp_cap.val = 0; ++ iee_set_cred_cap_ambient(new, tmp_cap); + } while (0); + #else cap_clear(new->cap_ambient); @@ -13641,7 +13237,7 @@ index bc0521104197..09e7a26102c9 100644 return commit_creds(new); } -@@ -1375,9 +1512,25 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3, +@@ -1375,9 +1528,25 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3, if (!new) return -ENOMEM; if (arg2 == PR_CAP_AMBIENT_RAISE) @@ -13736,7 +13332,7 @@ index 19be69fa4d05..6cb164dfc19b 100644 put_cred(cred); return ret; diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c -index b5d5333ab330..3dc8dc430300 100644 +index b5d5333ab330..aaa2a2347d84 100644 --- a/security/keys/process_keys.c +++ b/security/keys/process_keys.c @@ -19,6 +19,10 @@ @@ -13798,7 +13394,7 @@ index b5d5333ab330..3dc8dc430300 100644 if (unlikely(current->flags & PF_EXITING)) { put_cred(new); -@@ -925,6 +945,37 @@ void key_change_session_keyring(struct callback_head *twork) +@@ -925,6 +945,38 @@ void key_change_session_keyring(struct callback_head *twork) return; } @@ -13819,6 +13415,7 @@ index b5d5333ab330..3dc8dc430300 100644 + iee_set_cred_sgid(new,old-> sgid); + iee_set_cred_fsgid(new,old->fsgid); + iee_set_cred_user(new,get_uid(old->user)); ++ iee_set_cred_ucounts(new, old->ucounts); + iee_set_cred_user_ns(new,get_user_ns(old->user_ns)); + iee_set_cred_group_info(new,get_group_info(old->group_info)); + @@ -13836,7 +13433,7 @@ index b5d5333ab330..3dc8dc430300 100644 new-> uid = old-> uid; new-> euid = old-> euid; new-> suid = old-> suid; -@@ -948,6 +999,7 @@ void key_change_session_keyring(struct callback_head *twork) +@@ -948,6 +1000,7 @@ void key_change_session_keyring(struct callback_head *twork) new->jit_keyring = old->jit_keyring; new->thread_keyring = key_get(old->thread_keyring); new->process_keyring = key_get(old->process_keyring); @@ -13845,7 +13442,7 @@ index b5d5333ab330..3dc8dc430300 100644 security_transfer_creds(new, old); diff --git a/security/security.c b/security/security.c -index 23b129d482a7..6dc42370d573 100644 +index 407b51719f79..74ffd7ea3f37 100644 --- a/security/security.c +++ b/security/security.c @@ -30,6 +30,9 @@ @@ -13878,7 +13475,7 @@ index 23b129d482a7..6dc42370d573 100644 if (cred->security == NULL) return -ENOMEM; return 0; -@@ -2932,7 +2943,11 @@ void security_cred_free(struct cred *cred) +@@ -2950,7 +2961,11 @@ void security_cred_free(struct cred *cred) call_void_hook(cred_free, cred); kfree(cred->security); @@ -13891,5 +13488,5 @@ index 23b129d482a7..6dc42370d573 100644 /** -- -2.33.0 +2.34.1 diff --git a/haoc-kernel.spec b/haoc-kernel.spec index f4a12cb..27d305c 100644 --- a/haoc-kernel.spec +++ b/haoc-kernel.spec @@ -16,16 +16,49 @@ %define modsign_cmd %{SOURCE10} -%global Arch $(echo %{_host_cpu} | sed -e s/i.86/x86/ -e s/x86_64/x86/ -e s/aarch64.*/arm64/ -e s/riscv.*/riscv/) +%if 0%{?openEuler_sign_rsa} +# Use the open-source signature when the EBS permission is insufficient. +# Now only the admin user in EBS can send the signature request. But the +# user triggering the acces control build task and the personal build +# task is non-admin. Inorder to avoid build failures caused by failed +# signing, use the open-source signature. +# The flag_openEuler_has_sign_perm used in the rpm execution phase +# The openEuler_has_sign_perm used in the rpm execution phase + +%define openEuler_check_EBS_perm openEuler_has_sign_perm=0 \ +echo "" >> test_openEuler_sign.ko \ +sh /usr/lib/rpm/brp-ebs-sign --module test_openEuler_sign.ko || \ +[ $? -ne 2 ] && openEuler_has_sign_perm=1 \ +%global flag_openEuler_has_sign_perm $openEuler_has_sign_perm \ +rm -f test_openEuler_sign.ko test_openEuler_sign.ko.sig +%endif + +%global Arch $(echo %{_host_cpu} | sed -e s/i.86/x86/ -e s/x86_64/x86/ -e s/aarch64.*/arm64/ -e s/riscv.*/riscv/ -e s/powerpc64le/powerpc/ -e s/loongarch64/loongarch/) %global KernelVer %{version}-%{release}.%{_target_cpu} %global debuginfodir /usr/lib/debug %global upstream_version 6.6 %global upstream_sublevel 0 -%global devel_release 12 +%global devel_release 27 %global maintenance_release .0.0 -%global pkg_release .9 +%global pkg_release .32 + +%global openeuler_lts 1 +%global openeuler_major 2403 +%global openeuler_minor 0 + +# +# Support input parameter to overwrite the preceding version numbers. +# + +%bcond_with openeuler_version + +%if %{with openeuler_version} +%global openeuler_lts %{?_openeuler_lts} %{?!_openeuler_lts: 0} +%global openeuler_major %{?_openeuler_major} %{?!_openeuler_major: 0} +%global openeuler_minor %{?_openeuler_minor} %{?!_openeuler_minor: 0} +%endif %define with_debuginfo 1 # Do not recompute the build-id of vmlinux in find-debuginfo.sh @@ -64,10 +97,11 @@ Source0: kernel.tar.gz Source10: sign-modules Source11: x509.genkey Source12: extra_certificates -# openEuler RPM PGP certificates: -# 1. openeuler -Source13: RPM-GPG-KEY-openEuler-compass-ci -Source14: process_pgp_certs.sh + +%if 0%{?openEuler_sign_rsa} +Source15: openeuler_kernel_cert.cer +Source16: sign-modules-openeuler +%endif %if 0%{?with_kabichk} Source18: check-kabi @@ -87,6 +121,7 @@ Source9002: series.conf Source9998: patches.tar.bz2 %endif +Patch0001: 0001-riscv-kernel.patch Patch0002: 0002-cpupower-clang-compile-support.patch Patch0003: 0003-x86_energy_perf_policy-clang-compile-support.patch Patch0004: 0004-turbostat-clang-compile-support.patch @@ -117,10 +152,6 @@ BuildRequires: rpm-build, elfutils BuildRequires: numactl-devel python3-devel glibc-static python3-docutils BuildRequires: perl-generators perl(Carp) libunwind-devel gtk2-devel libbabeltrace-devel java-1.8.0-openjdk java-1.8.0-openjdk-devel perl-devel -%if 0%{?openEuler_sign_rsa} -BuildRequires: sign-openEuler -%endif - AutoReq: no AutoProv: yes @@ -135,12 +166,15 @@ Provides: kernel-uname-r = %{KernelVer} kernel=%{KernelVer} Requires: dracut >= 001-7 grubby >= 8.28-2 initscripts >= 8.11.1-1 linux-firmware >= 20100806-2 module-init-tools >= 3.16-2 -ExclusiveArch: noarch aarch64 i686 x86_64 riscv64 +ExclusiveArch: noarch aarch64 i686 x86_64 riscv64 ppc64le loongarch64 ExclusiveOS: Linux %if %{with_perf} BuildRequires: flex xz-devel libzstd-devel BuildRequires: java-devel +%ifarch aarch64 +BuildRequires: OpenCSD +%endif %endif BuildRequires: dwarves @@ -285,7 +319,6 @@ package or when debugging this package.\ %endif %prep - %setup -q -n kernel-%{version} -c %if 0%{?with_patch} @@ -295,12 +328,6 @@ tar -xjf %{SOURCE9998} mv kernel linux-%{KernelVer} cd linux-%{KernelVer} -# process PGP certs -cp %{SOURCE13} . -cp %{SOURCE14} . -sh %{SOURCE14} -cp pubring.gpg certs - %if 0%{?with_patch} cp %{SOURCE9000} . cp %{SOURCE9001} . @@ -329,14 +356,20 @@ Applypatches() Applypatches series.conf %{_builddir}/kernel-%{version}/linux-%{KernelVer} %endif +# haoc-kernel patch +%patch0005 -p1 + +# riscv-kernel patch +%ifarch riscv64 +%patch0001 -p1 +%endif + %if "%toolchain" == "clang" %patch0002 -p1 %patch0003 -p1 %patch0004 -p1 %endif -%patch0005 -p1 - find . \( -name "*.orig" -o -name "*~" \) -exec rm -f {} \; >/dev/null find . -name .gitignore -exec rm -f {} \; >/dev/null @@ -356,6 +389,10 @@ cp -a tools/perf tools/python3-perf cd linux-%{KernelVer} perl -p -i -e "s/^EXTRAVERSION.*/EXTRAVERSION = -%{release}.%{_target_cpu}/" Makefile +perl -p -i -e "s/^OPENEULER_LTS.*/OPENEULER_LTS = %{openeuler_lts}/" Makefile.oever +perl -p -i -e "s/^OPENEULER_MAJOR.*/OPENEULER_MAJOR = %{openeuler_major}/" Makefile.oever +perl -p -i -e "s/^OPENEULER_MINOR.*/OPENEULER_MINOR = %{openeuler_minor}/" Makefile.oever +perl -p -i -e "s/^OPENEULER_RELEASE.*/OPENEULER_RELEASE = \"%{release}\"/" Makefile.oever ## make linux make mrproper %{_smp_mflags} @@ -386,7 +423,21 @@ sed -i arch/arm64/configs/openeuler_defconfig -e 's/^CONFIG_ARM64_VA_BITS_.*/CON %global make %{__make} %{?clang_make_opts} HOSTCFLAGS="%{?build_cflags}" HOSTLDFLAGS="%{?build_ldflags}" +%ifarch loongarch64 + +%if 0%{with_signmodules} +echo "CONFIG_MODULE_SIG=y" >>arch/loongarch/configs/loongson3_defconfig +%endif + +%if 0%{with_debuginfo} +echo "CONFIG_DEBUG_INFO=y" >>arch/loongarch/configs/loongson3_defconfig +%endif + +make ARCH=%{Arch} loongson3_defconfig + +%else %{make} ARCH=%{Arch} openeuler_defconfig +%endif %if %{with clang_lto} scripts/config -e LTO_CLANG_FULL @@ -394,6 +445,17 @@ sed -i 's/# CONFIG_LTO_CLANG_FULL is not set/CONFIG_LTO_CLANG_FULL=y/' .config sed -i 's/CONFIG_LTO_NONE=y/# CONFIG_LTO_NONE is not set/' .config %endif +%if 0%{?openEuler_sign_rsa} + %{openEuler_check_EBS_perm} + if [ $openEuler_has_sign_perm -eq 1 ]; then + cp %{SOURCE15} ./certs/openeuler-cert.pem + # close kernel native signature + sed -i 's/CONFIG_MODULE_SIG_KEY=.*$/CONFIG_MODULE_SIG_KEY=""/g' .config + sed -i 's/CONFIG_SYSTEM_TRUSTED_KEYS=.*$/CONFIG_SYSTEM_TRUSTED_KEYS="certs\/openeuler-cert.pem"/g' .config + sed -i 's/CONFIG_MODULE_SIG_ALL=y$/CONFIG_MODULE_SIG_ALL=n/g' .config + fi +%endif + TargetImage=$(basename $(make -s image_name)) %{make} ARCH=%{Arch} $TargetImage %{?_smp_mflags} @@ -416,8 +478,14 @@ TargetImage=$(basename $(make -s image_name)) ## make tools %if %{with_perf} # perf +%ifarch aarch64 +# aarch64 make perf with CORESIGHT=1 +%global perf_make \ + make %{?clang_make_opts} EXTRA_LDFLAGS="%[ "%{toolchain}" == "clang" ? "-z now" : "" ]" EXTRA_CFLAGS="%[ "%{toolchain}" == "clang" ? "" : "-Wl,-z,now" ] -g -Wall -fstack-protector-strong -fPIC" EXTRA_PERFLIBS="-fpie -pie" %{?_smp_mflags} -s V=1 WERROR=0 NO_LIBUNWIND=1 HAVE_CPLUS_DEMANGLE=1 NO_GTK2=1 NO_LIBNUMA=1 NO_STRLCPY=1 CORESIGHT=1 prefix=%{_prefix} +%else %global perf_make \ make %{?clang_make_opts} EXTRA_LDFLAGS="%[ "%{toolchain}" == "clang" ? "-z now" : "" ]" EXTRA_CFLAGS="%[ "%{toolchain}" == "clang" ? "" : "-Wl,-z,now" ] -g -Wall -fstack-protector-strong -fPIC" EXTRA_PERFLIBS="-fpie -pie" %{?_smp_mflags} -s V=1 WERROR=0 NO_LIBUNWIND=1 HAVE_CPLUS_DEMANGLE=1 NO_GTK2=1 NO_LIBNUMA=1 NO_STRLCPY=1 prefix=%{_prefix} +%endif %if 0%{?with_python2} %global perf_python2 -C tools/perf PYTHON=%{__python2} %global perf_python3 -C tools/python3-perf PYTHON=%{__python3} @@ -482,6 +550,14 @@ popd pushd tools/kvm/kvm_stat/ %{make} %{?_smp_mflags} man popd +# libbpf.a and bpf_helper_defs.h +pushd tools/lib/bpf +%{make} +popd +# netacc +pushd tools/netacc +%{make} BPFTOOL=../../tools/bpf/bpftool/bpftool +popd %install %if 0%{?with_source} @@ -502,22 +578,32 @@ cd linux-%{KernelVer} mkdir -p $RPM_BUILD_ROOT/boot dd if=/dev/zero of=$RPM_BUILD_ROOT/boot/initramfs-%{KernelVer}.img bs=1M count=20 +%ifarch loongarch64 +strip -s vmlinux -o vmlinux.elf +install -m 755 vmlinux.elf $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer} +%else install -m 755 $(make -s image_name) $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer} +%endif %if 0%{?openEuler_sign_rsa} - echo "start sign" - %ifarch %arm aarch64 - gunzip -c $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}>$RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip.efi - /opt/sign-openEuler/client --config /opt/sign-openEuler/config.toml add --key-name default-x509ee --file-type efi-image --key-type x509ee --sign-type authenticode $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip.efi - mv $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip.efi $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip - gzip -c $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip>$RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer} - rm -f $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip - %endif - %ifarch x86_64 - mv $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer} $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.efi - /opt/sign-openEuler/client --config /opt/sign-openEuler/config.toml add --key-name default-x509ee --file-type efi-image --key-type x509ee --sign-type authenticode $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.efi - mv $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.efi $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer} - %endif + %{openEuler_check_EBS_perm} + if [ $openEuler_has_sign_perm -eq 1 ]; then + echo "start sign" + %ifarch %arm aarch64 + gunzip -c $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}>$RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip.efi + sh /usr/lib/rpm/brp-ebs-sign --efi $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip.efi + mv $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip.efi.sig $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip.efi + mv $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip.efi $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip + gzip -c $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip>$RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer} + rm -f $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.unzip + %endif + %ifarch x86_64 + mv $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer} $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.efi + sh /usr/lib/rpm/brp-ebs-sign --efi $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.efi + mv $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.efi.sig $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.efi + mv $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer}.efi $RPM_BUILD_ROOT/boot/vmlinuz-%{KernelVer} + %endif + fi %endif pushd $RPM_BUILD_ROOT/boot @@ -600,6 +686,22 @@ popd find $RPM_BUILD_ROOT/lib/modules/ -type f -name '*.ko' | xargs -n1 -P`nproc --all` xz; \ %{nil} +%if 0%{?openEuler_sign_rsa} +%define __modsign_install_post \ + if [ "%{with_signmodules}" -eq "1" ];then \ + if [ %flag_openEuler_has_sign_perm -eq 1 ]; then \ + sh %{SOURCE16} $RPM_BUILD_ROOT/lib/modules/%{KernelVer} || exit 1 \ + else \ + cp certs/signing_key.pem . \ + cp certs/signing_key.x509 . \ + chmod 0755 %{modsign_cmd} \ + %{modsign_cmd} $RPM_BUILD_ROOT/lib/modules/%{KernelVer} || exit 1 \ + fi \ + fi \ + find $RPM_BUILD_ROOT/lib/modules/ -type f -name '*.ko' | xargs -n1 -P`nproc --all` xz; \ +%{nil} +%endif + # deal with header %{make} ARCH=%{Arch} INSTALL_HDR_PATH=$RPM_BUILD_ROOT/usr KBUILD_SRC= headers_install find $RPM_BUILD_ROOT/usr/include -name "\.*" -exec rm -rf {} \; @@ -612,7 +714,9 @@ find $RPM_BUILD_ROOT/usr/include -name "\.*" -exec rm -rf {} \; %endif # deal with vdso +%ifnarch ppc64le %{make} -s ARCH=%{Arch} INSTALL_MOD_PATH=$RPM_BUILD_ROOT vdso_install KERNELRELEASE=%{KernelVer} +%endif if [ ! -s ldconfig-kernel.conf ]; then echo "# Placeholder file, no vDSO hwcap entries used in this kernel." >ldconfig-kernel.conf fi @@ -778,6 +882,10 @@ popd pushd tools/kvm/kvm_stat %{make} INSTALL_ROOT=%{buildroot} install-tools popd +# netacc +pushd tools/netacc +%{make} INSTALL_ROOT=%{buildroot} install +popd %define __spec_install_post\ %{?__debug_package:%{__debug_install_post}}\ @@ -806,6 +914,12 @@ fi if [ -d /lib/modules/%{KernelVer} ] && [ "`ls -A /lib/modules/%{KernelVer}`" = "" ]; then rm -rf /lib/modules/%{KernelVer} fi +if [ `uname -i` == "loongarch64" ];then + [ -f /etc/grub2.cfg ] && GRUB_CFG=`readlink -f /etc/grub2.cfg` + [ "x${GRUB_CFG}" == "x" ] && [ -f /etc/grub2-efi.cfg ] && GRUB_CFG=`readlink -f /etc/grub2-efi.cfg` + [ "x${GRUB_CFG}" == "x" ] && [ -f /boot/efi/EFI/openEuler/grub.cfg ] && GRUB_CFG=/boot/efi/EFI/openEuler/grub.cfg + [ "x${GRUB_CFG}" != "x" ] && grub2-mkconfig -o ${GRUB_CFG} +fi %posttrans %{_sbindir}/new-kernel-pkg --package kernel --mkinitrd --dracut --depmod --update %{KernelVer} || exit $? @@ -814,6 +928,13 @@ if [ `uname -i` == "aarch64" ] && [ -f /boot/EFI/grub2/grub.cfg ]; then /usr/bin/sh %{_sbindir}/mkgrub-menu-%{version}-%{devel_release}%{?maintenance_release}%{?pkg_release}.sh %{version}-%{release}.aarch64 /boot/EFI/grub2/grub.cfg update fi +if [ `uname -i` == "loongarch64" ];then + [ -f /etc/grub2.cfg ] && GRUB_CFG=`readlink -f /etc/grub2.cfg` + [ "x${GRUB_CFG}" == "x" ] && [ -f /etc/grub2-efi.cfg ] && GRUB_CFG=`readlink -f /etc/grub2-efi.cfg` + [ "x${GRUB_CFG}" == "x" ] && [ -f /boot/efi/EFI/openEuler/grub.cfg ] && GRUB_CFG=/boot/efi/EFI/openEuler/grub.cfg + [ "x${GRUB_CFG}" != "x" ] && grub2-mkconfig -o ${GRUB_CFG} + grubby --set-default=/boot/vmlinuz-%{KernelVer} +fi if [ -x %{_sbindir}/weak-modules ] then %{_sbindir}/weak-modules --add-kernel %{KernelVer} || exit $? @@ -873,6 +994,8 @@ fi %files headers %defattr (-, root, root) /usr/include/* +%exclude %{_includedir}/cpufreq.h +%exclude %{_includedir}/cpuidle.h %if %{with_perf} %files -n perf @@ -924,6 +1047,8 @@ fi %{_bindir}/gpio-watch %{_mandir}/man1/kvm_stat* %{_bindir}/kvm_stat +%{_sbindir}/net-acc +%{_sbindir}/tuned_acc/netacc %{_libdir}/libcpupower.so.1 %{_libdir}/libcpupower.so.0.0.1 %license linux-%{KernelVer}/COPYING @@ -958,8 +1083,5821 @@ fi %endif %changelog -* Tue Mar 26 2024 Liu Zhehui - 6.6.0-12.0.0.9 -- Add HAOC patch and spec for openEuler-24.03-LTS +* Thu May 23 2024 Liu Zhehui - 6.6.0-27.0.0.32 +- update HAOC patch and spec for 6.6.0-27.0.0 +* Sat May 18 2024 ZhangPeng - 6.6.0-27.0.0.31 +- !7527 ext4 iomap performance optimize +- ext4: fallback to generic_perform_write once iov_iter_count <= PAGE_SIZE +- iomap: export __iomap_write_{begin|end} +- !7530 mm: more thp control for large folio +- mm: correct the docs for thp_fault_alloc and thp_fault_fallback +- mm: add docs for per-order mTHP counters and transhuge_page ABI +- mm: add per-order mTHP anon_swpout and anon_swpout_fallback counters +- mm: add per-order mTHP anon_fault_alloc and anon_fault_fallback counters +- mm: add control to allow specified high-order pages stored on PCP list +- mm: huge_memory: add thp mapping align control +- mm: huge_memory: add folio_get_unmapped_area() +- mm: filemap: make mTHP configurable for exec mapping +- mm/filemap: Allow arch to request folio size for exec memory +- mm/memcontrol: remove __mod_lruvec_page_state() +- mm/khugepaged: use a folio more in collapse_file() +- mm: remove inc/dec lruvec page state functions +- !7521 v2 Avoiding false sharing in field access of tk_core +- openeuler_defconfig: Enable CONFIG_ARCH_LLC_128_LINE_SIZE for Hisilicon platforms +- timekeeping: Avoiding false sharing in field access of tk_core +- !7182 v3 mm: mglru: reuse some legacy trace +- mm: multi-gen LRU: reuse some legacy trace events +- mm, vmscan: remove ISOLATE_UNMAPPED +- trace-vmscan-postprocess: sync with tracepoints updates +- !7219 Hygon model 6h L3 PMU event duplicate creating issue fix +- perf/x86/uncore: Create L3 event strictly to the CPU vendor +- !7474 sched/fair: set burst to zero when cfs bandwidth is cancelled +- sched/fair: set burst to zero when set max to cpu.max +- sched/fair: limit burst to zero when cfs bandwidth is toggled off +- !7475 Makefile.oever: add OPENEULER_RELEASE for version.h +- Makefile.oever: add OPENEULER_RELEASE for version.h +- !6241 add pmu support for loongarch kvm +- LoongArch: KVM: Add PMU support +- !5654 [OLK-6.6] USB: UAS: return ENODEV when submit urbs fail with device not attached +- USB: UAS: return ENODEV when submit urbs fail with device not attached +- !5218 [OLK-6.6] Add HGSC_CERT_IMPORT ioctl interface for Hygon CPUs. +- crypto: ccp: Implement CSV_HGSC_CERT_IMPORT ioctl command +- crypto: ccp: Move the fixup code for Hygon psp to Hygon specific files +- crypto: ccp: Bind specific sp_dev_vdata for Hygon secure processor +- crypto: ccp: Introduce hygon specific interface to support driver +- !6311 v2 ima: Avoid blocking in RCU read-side critical section +- ima: Avoid blocking in RCU read-side critical section +- !6837 fs: sysfs: Fix reference leak in sysfs_break_active_protection() +- fs: sysfs: Fix reference leak in sysfs_break_active_protection() +- !5644 [OLK-6.6] x86/mce: Set bios_cmci_threshold for CMCI threshold +- x86/mce: Set bios_cmci_threshold for CMCI threshold +- !7454 add new kvm_type for Confidential VMs +- kvm: add macro CONFIG_CVM_HOST to defconfig +- kvm: add new kvm_type for cvm +- !7405 v2 mm: prepare to support weighted interleaving mempolicy +- mm: prepare to support weighted interleaving mempolicy +- !7370 v2 sched: smart_grid: silence complier error +- sched: smart_grid: silence complier error +- !7227 arm64: arm_pmuv3: Correctly extract and check the PMUVer +- arm64: arm_pmuv3: Correctly extract and check the PMUVer +- !5291 [OLK-6.6] iommu/dma: Fix not fully traversing iova reservations issue +- iommu/dma: Fix not fully traversing iova reservations issue +- !6774 [OLK-6.6] merge upstream 4 wangxun related patches to fix i2c bug +- Revert "net: txgbe: fix clk_name exceed MAX_DEV_ID limits" +- Revert "net: txgbe: fix i2c dev name cannot match clkdev" +- net: wangxun: add ethtool_ops for channel number +- clkdev: Update clkdev id usage to allow for longer names +- !7206 v2 sched: programmable: Allow set tag for pid 1. +- sched: programmable: Allow set tag for pid 1. + +* Sat May 11 2024 ZhangPeng - 6.6.0-26.0.0.30 +- !7198 v2 mm: prepare more high-order pages on pcplist +- mm: prepare more high-order pages to be stored on the per-cpu lists +- mm: page_alloc: use the correct THP order for THP PCP +- !7196 v3 Backport folio feature and bugfix +- mm: madvise: avoid split during MADV_PAGEOUT and MADV_COLD +- mm: vmscan: avoid split during shrink_folio_list() +- mm: swap: allow storage of all mTHP orders +- mm: swap: update get_swap_pages() to take folio order +- mm: swap: simplify struct percpu_cluster +- mm: swap: free_swap_and_cache_nr() as batched free_swap_and_cache() +- mm: swap: remove CLUSTER_FLAG_HUGE from swap_cluster_info:flags +- mm/madvise: don't forget to leave lazy MMU mode in madvise_cold_or_pageout_pte_range() +- mm/madvise: add cond_resched() in madvise_cold_or_pageout_pte_range() +- mm: support multi-size THP numa balancing +- mm: factor out the numa mapping rebuilding into a new helper +- mm: alloc_anon_folio: avoid doing vma_thp_gfp_mask in fallback cases +- huge_memory.c: document huge page splitting rules more thoroughly +- mm: convert folio_estimated_sharers() to folio_likely_mapped_shared() +- mm/migrate: split source folio if it is on deferred split list +- mm: hold PTL from the first PTE while reclaiming a large folio +- madvise:madvise_cold_or_pageout_pte_range(): allow split while folio_estimated_sharers = 0 +- mm/filemap: don't decrease mmap_miss when folio has workingset flag +- mm/readahead: break read-ahead loop if filemap_add_folio return -ENOMEM +- arm64: mm: swap: support THP_SWAP on hardware with MTE +- mm: remove PageAnonExclusive assertions in unuse_pte() +- mm: remove struct page from get_shadow_from_swap_cache +- selftests: mm: fix unused and uninitialized variable warning +- XArray: set the marks correctly when splitting an entry +- mm/huge_memory: check new folio order when split a folio +- mm: huge_memory: enable debugfs to split huge pages to any order +- mm: thp: split huge page to any lower order pages +- mm: page_owner: add support for splitting to any order in split page_owner +- mm: memcg: make memcg huge page split support any order split +- mm/page_owner: use order instead of nr in split_page_owner() +- mm/memcg: use order instead of nr in split_page_memcg() +- mm: support order-1 folios in the page cache +- mm/huge_memory: only split PMD mapping when necessary in unmap_folio() +- selftests/mm: split_huge_page_test: conform test to TAP format output +- mm: huge_memory: use more folio api in __split_huge_page_tail() +- mm/vmalloc: fix return value of vb_alloc if size is 0 +- mm: use memalloc_nofs_save() in page_cache_ra_order() +- mm: madvise: pageout: ignore references rather than clearing young +- mm: ratelimit stat flush from workingset shrinker +- mm, oom:dump_tasks add rss detailed information printing +- arm64/mm: improve comment in contpte_ptep_get_lockless() +- arm64/mm: export contpte symbols only to GPL users +- mm: page_alloc: enforce minimum zone size to do high atomic reserves +- mm: page_alloc: correct high atomic reserve calculations +- mm: fix draining remote pageset +- !7190 entry: inline syscall enter/exit functions +- entry: Move syscall_enter_from_user_mode() to header file +- entry: Move enter_from_user_mode() to header file +- entry: Move exit to usermode functions to header file +- !7130 v2 openeuler_defconfig: update oedefconfig for the minimum set +- openeuler_defconfig: update oedefconfig for the minimum set +- !7141 spi: hisi-kunpeng: Add validation for the minimum value of speed_hz +- spi: hisi-kunpeng: Add validation for the minimum value of speed_hz +- spi: Add verification for the max_frequency provided by the firmware +- !7136 Fix failed in acpi_gpiochip_find() by adding parent node match +- gpiolib: acpi: Fix failed in acpi_gpiochip_find() by adding parent node match +- !6778 v2 Fix two soc bugs of hip09 +- irqchip: gicv3: Add workaround for hip09 erratum 162200806 +- irqchip: gicv3: Add workaround for hip09 erratum 162200803 +- !7165 v2 tick/broadcast-hrtimer: Prevent the timer device on broadcast duty CPU from being disabled +- tick/broadcast-hrtimer: Prevent the timer device on broadcast duty CPU from being disabled +- !7184 v3 md: do not delete safemode_timer in mddev_suspend +- md: do not delete safemode_timer in mddev_suspend +- !7131 net: hns3: Fix ROH mac address initialization. +- net: hns3: Fix ROH mac address initialization. +- !7126 net: hns3: some bugfixes for hns3 driver +- net: hns3: fix kernel crash when devlink reload during initialization +- net: hns3: direct return when receive a unknown mailbox message +- net: hns3: release PTP resources if pf initialization failed +- net: hns3: change type of numa_node_mask as nodemask_t +- net: hns3: using cpumask_copy when set value to cpumask_t +- net: hns3: set irq affinity directly +- net: hns3: use appropriate barrier function after setting a bit value +- net: hns3: don't need to check an unsigned number is less than 0 +- net: hns3: add +- net: hns3: using user configure after hardware reset +- net: hns3: add cond_resched() to hns3 ring buffer init process +- net: hns3: fix kernel crash problem in concurrent scenario +- net: hns3: fix port vlan filter not disabled issue +- net: hns3: revert "net: hns3: fix port vlan filter not disabled problem in dynamic vlan mode" +- !7159 【OLK 6.6】 backport some mailist patches for perf +- drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset() +- drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group +- drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group +- !7068 kernfs: RCU protect kernfs_nodes and avoid kernfs_idr_lock in kernfs_find_and_get_node_by_id() +- kernfs: RCU protect kernfs_nodes and avoid kernfs_idr_lock in kernfs_find_and_get_node_by_id() +- !7153 Backports for OLK-6.6 +- netfilter: br_netfilter: skip conntrack input hook for promisc packets +- netfilter: bridge: confirm multicast packets before passing them up the stack +- !7069 ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() +- ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() +- !7075 RDMA/hns: Some bugfixes and cleanups +- RDMA/hns: Fix soft lockup under heavy CEQE load +- RDMA/hns: Fix sleeping in spin_lock critical section +- RDMA/hns: Fix Use-After-Free of rsv_qp +- RDMA/hns: Fix a missing check of atomic wr length +- !3184 [OLK-6.6] add support for Zhaoxin ZXPAUSE instruction +- x86/delay: add support for Zhaoxin ZXPAUSE instruction +- !7078 v2 Backport four conflict stable patch +- mm: turn folio_test_hugetlb into a PageType +- mm/hugetlb: fix missing hugetlb_lock for resv uncharge +- fork: defer linking file vma until vma is fully initialized +- mm, treewide: introduce NR_PAGE_ORDERS +- !7067 crypto: hisilicon fix some issues +- uacce: fix for cdev memory leak +- crypto: hisilicon/qm - adjust the internal processing sequence of the vf enable and disable +- crypto: hisilicon/zip - optimize the address offset of the reg query function +- !4084 riscv64: initial LIVEPATCH_WO_FTRACE support +- riscv64: add initial livepatch support +- livepatch: add arch hook before doing klp_resolve_symbols +- !6868 irqchip/loongson-pch-pic: Update interrupt registration policy +- irqchip/loongson-pch-pic: Update interrupt registration policy +- !6004 [OLK-6.6] fix bug：ethtool -S and ethtool -x/X for mucse rnpm drvier +- mucse: ethtool -S and ethtool -x/X for mucse rnpm drvier + + at the end when print msg +* Sat May 11 2024 Mingzheng Xing - 6.6.0-25.0.0.29 +- Add riscv-kernel patch, which adds support for sg2042 and th1520 RISC-V SoCs. +- This patch only applies to the RISC-V architecture, the related commit list: +- +- th1520: riscv: config: Enable th1520 support +- riscv: thead: Use the wback_inv instead of wback_only +- riscv: errata: thead: use pa based instructions for CMO +- riscv: errata: thead: use riscv_nonstd_cache_ops for CMO +- Revert "riscv: errata: thead: use riscv_nonstd_cache_ops for CMO" +- Revert "riscv: errata: thead: use pa based instructions for CMO" +- riscv: mm: fix NOCACHE_THEAD does not set bit[61] correctly +- riscv: mm: update T-Head memory type definitions +- Revert "sg2042: riscv: changing T-Head PBMT attributes" +- riscv: remove compression for riscv Image +- th1520: cpufreq: correct typo in config name +- th1520: riscv: dts: thead: Add Milk-V Meles board +- th1520: cpufreq: light-mpw-cpufreq: fix -Wunused-variable in panic_cpufreq_notifier_call +- th1520: cpufreq: light-mpw-cpufreq: fix cpu_pll1 already disabled warning +- riscv: Add th1520-lichee-cluster-4a dts support (8G/16G) +- riscv: dts: th1520-beaglev-ahead: add alias for emmc & sd +- riscv: dts: th1520-lichee-pi-4a: add alias for emmc & sd +- riscv: dts: lpi4a 16g support +- th1520: perf vendor events riscv: add T-HEAD C9xx JSON file +- th1520: riscv: dts: thead: Add PMU event node +- riscv: pinctrl: th1520: fix build +- riscv: dts: th1520: lpi4a: add rpmsg node +- riscv: dts: th1520: add mbox client node +- riscv: rpmsg: mailbox-client: sync thead sdk 1.4.2 +- riscv: panic: add thead sdk quirks +- riscv: dts: add watchdog node +- th1520: riscv: dts: Add th1520 reset device tree +- th1520: reset: Add th1520 reset driver support +- th1520: dt-bindings: reset: Document th1520 reset control +- riscv: light_wdt: update sdk 1.4.2 +- th1520_light_event: update sdk 1.4.2 +- th1520_aon: update sdk 1.4.2 +- th1520: fix compile th1520-beaglev-ahead error +- th1520: add TH1520 cpu frequency driver +- th1520: riscv: errata: thead: use pa based instructions for CMO +- th1520: riscv: errata: thead: use riscv_nonstd_cache_ops for CMO +- riscv: dts: thead: Add TH1520 CPU reset node +- th1520: riscv: dts: thead: Enable Lichee Pi 4A USB +- th1520: riscv: dts: thead: Add Lichee Pi 4A IO expansions +- th1520: riscv: dts: thead: Add TH1520 USB nodes +- th1520: riscv: dts: thead: Add TH1520 I2C nodes +- th1520: usb: dwc3: add T-HEAD TH1520 usb driver +- th1520: dt-bindings: usb: Add T-HEAD TH1520 USB controller +- th1520: riscv: dts: thead: Add BeagleV Ahead SDIO0 pins +- th1520: riscv: dts: thead: Add Lichee Pi 4A SDIO0 pins +- th1520: riscv: dts: thead: Add TH1520 ethernet nodes +- th1520: net: stmmac: add glue layer for T-HEAD TH1520 SoC +- th1520: dt-bindings: net: add T-HEAD dwmac support +- th1520: dt-bindings: net: snps,dwmac: allow dwmac-3.70a to set pbl properties +- th1520: riscv: dts: thead: Enable Lichee Pi 4A PWM fan +- th1520: riscv: dts: thead: Add TH1520 PVT node +- th1520: riscv: dts: thead: Add TH1520 PWM node +- th1520: pwm: add T-HEAD PWM driver +- th1520: dt-bindings: pwm: Add T-HEAD PWM controller +- th1520: gpio: dwapb: Use generic request, free and set_config +- riscv: dts: thead: Enable LicheePi 4A eMMC and microSD +- riscv: dts: thead: Enable BeagleV Ahead eMMC and microSD +- riscv: dts: thead: Add TH1520 mmc controllers and sdhci clock +- riscv: defconfig: Enable mmc and dma drivers for T-Head TH1520 +- mmc: sdhci-of-dwcmshc: Add support for T-Head TH1520 +- mmc: sdhci: add __sdhci_execute_tuning() to header +- dt-bindings: mmc: sdhci-of-dwcmhsc: Add T-Head TH1520 support +- th1520: riscv: dtb: thead: Add BeagleV Ahead LEDs +- th1520: riscv: dts: thead: Add TH1520 pinctrl settings for UART0 +- th1520: riscv: dts: thead: Adjust TH1520 GPIO labels +- th1520: riscv: dts: thead: Add TH1520 GPIO ranges +- th1520: riscv: dts: thead: Add TH1520 pin control nodes +- th1520: pinctrl: Add driver for the T-Head TH1520 SoC +- th1520: dt-bindings: pinctrl: Add thead,th1520-pinctrl bindings +- th1520: dt-bindings: gpio: dwapb: allow gpio-ranges +- sg2042: riscv: config: Enable sg2042 support +- sg2042: riscv: changing T-Head PBMT attributes +- sg2042: kconfig: Enable DW_APB_TIMER_OF in ARCH_SOPHGO +- sg2042: pcie contronller msi-x whitelist add device_id +- sg2042: nvidia hda: force msi +- sg2042: radeon hack: force 64-bit msi to fit top intc +- sg2042: amdgpu: disable rebar +- sg2042: ttm: disallow cached mapping +- sg2042: mango pci hack: broadcast when no MSI source known +- sg2042: riscv: dts: separate sg2042 mtime and mtimecmp to fit aclint format +- sg2042: dt-bindings: timer: thead,c900-aclint-mtimer: separate mtime and mtimecmp regs +- sg2042: riscv: dts: modify the PCIe range +- sg2042: drivers: clk: turn off non-essential clocks by default +- sg2042: drivers: clk: Avoid the problem of serial port garbled characters +- sg2042: mm: Modify __find_max_addr for memory hole +- sg2042: riscv: dts: Add timer apb clock +- sg2042: riscv: dts: Remove cma node +- sg2042: riscv: dts: Add uart apb clock and remove sysdma clock +- sg2042: riscv: dts: Move memory node from dts to zsbl +- sg2042: riscv: dts: Reduce bootargs +- sg2042: riscv: dts: Configure external interrupt in m mode +- sg2042: rebase: v6.6-rc1: Fix some compile warnings +- sg2042: riscv: dts: Remove nvme paremeter in bootargs +- sg2042: riscv: dtsi: confirm correspondence between PMU events and IDs +- sg2042: driver: pcie: support msix for top intr +- sg2042: driver: mmc: add config for MMC_SDHCI_SOPHGO +- sg2042: riscv: Kconfig: Set vector as default no +- sg2042: driver: soc: Add sophgo sg2042 soc support +- sg2042: driver: net: Add sophgo sg2042 soc support +- sg2042: driver: mmc: Add sophgo sg2042 soc support +- sg2042: driver: pcie: Add sophgo sg2042 soc support +- sg2042: driver: reset: Add sophgo sg2042 soc support +- sg2042: driver: pinctrl: Add sophgo sg2042 soc support +- sg2042: driver: clk: Add sophgo sg2042 soc support +- sg2042: riscv: dts: Add sophgo sg2042 soc support +- sg2042: riscv: defconfig: enable SOPHGO SoC +- sg2042: riscv: dts: sophgo: add Milk-V Pioneer board device tree +- sg2042: riscv: dts: add initial Sophgo SG2042 SoC device tree +- sg2042: dt-bindings: interrupt-controller: Add Sophgo sg2042 CLINT mswi +- sg2042: dt-bindings: timer: Add Sophgo sg2042 CLINT timer +- sg2042: dt-bindings: interrupt-controller: Add Sophgo SG2042 PLIC +- sg2042: dt-bindings: riscv: Add T-HEAD C920 compatibles +- sg2042: dt-bindings: riscv: add sophgo sg2042 bindings +- sg2042: dt-bindings: vendor-prefixes: add milkv/sophgo +- sg2042: riscv: Add SOPHGO SOC family Kconfig support + +* Thu May 09 2024 ZhangPeng - 6.6.0-25.0.0.28 +- !6930 fix general protection fault in update_cpumask +- cgroup/cpuset: fix general protection fault in update_cpumask +- !6905 v2 arm64: mmap: disable align larger anonymous mappings on THP boundaries +- arm64: mmap: disable align larger anonymous mappings on THP boundaries +- !7015 Fixes and cleanups to fs-writeback +- fs/writeback: remove unnecessary return in writeback_inodes_sb +- fs/writeback: correct comment of __wakeup_flusher_threads_bdi +- fs/writeback: only calculate dirtied_before when b_io is empty +- fs/writeback: remove unused parameter wb of finish_writeback_work +- fs/writeback: bail out if there is no more inodes for IO and queued once +- fs/writeback: avoid to writeback non-expired inode in kupdate writeback +- !6581 LoongArch: fix KASLR can not be disabled by nokaslr when boot from old BPI +- LoongArch: fix KASLR can not be disabled by nokaslr when boot from old BPI +- !6483 LoongArch: fix boot error caused by ioremap_page_range error +- LoongArch: fix boot error caused by ioremap_page_range error +- !6759 net: hns3: backport some maillist patches +- net: hns3: move constants from hclge_debugfs.h to hclge_debugfs.c +- net: hns3: dump more reg info based on ras mod +- net: hns3: add command queue trace for hns3 +- net: hns3: add support to query scc version by devlink info +- net: hns3: revert "net: hns3: dump more reg info based on ras mod" +- net: hns3: revert "net: hns3: add command queue trace for hns3" +- net: hns3: revert "net: hns3: add support to query scc version by devlink info" +- !7011 v3 bugfix patches from OLK-5.10 +- x86/quirks: Add parameter to clear MSIs early on boot +- x86/PCI: Export find_cap() to be used in early PCI code +- !6844 block: fix deadlock between bd_link_disk_holder and partition scan +- block: fix deadlock between bd_link_disk_holder and partition scan +- !5879 [OLK-6.6] Fix 'duplicate symbol rnp10_netdev_ops' error for RNPGBE driver with x86_64-allyesconfig +- RNPGBE: NET: Fix 'duplicate symbol rnp10_netdev_ops' errors +- !5836 [OLK-6.6] Fix "'snprintf' output between 10 and 37 bytes into a destination of size 24" warning for RNP driver with loongarch-allmodconfig +- RNP: NET: Fix "'snprintf' output between 10 and 37 bytes into a destination of size 24" wanrings + +* Wed May 08 2024 ZhangPeng - 6.6.0-24.0.0.27 +- !6824 Introduce CONFIG_ARCH_CUSTOM_NUMA_DISTANCE +- config: enable COBFIG_ARCH_CUSTOM_NUMA_DISTANCE for arm64 +- arm64/numa: Support node_reclaim_distance adjust for arch +- !6877 maple_tree: avoid checking other gaps after getting the largest gap +- maple_tree: avoid checking other gaps after getting the largest gap +- !6859 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.23-6.6.30 LTS Patches +- x86: update openeuler_defconfig for x86_64 +- bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS +- net/mlx5e: Advertise mlx5 ethernet driver updates sk_buff md_dst for MACsec +- macsec: Detect if Rx skb is macsec-related for offloading devices that update md_dst +- macsec: Enable devices to advertise whether they update sk_buff md_dst during offloads +- Revert "riscv: kdump: fix crashkernel reserving problem on RISC-V" +- ovl: fix memory leak in ovl_parse_param() +- phy: qcom: qmp-combo: fix VCO div offset on v5_5nm and v6 +- i2c: smbus: fix NULL function pointer dereference +- sched/eevdf: Prevent vlag from going out of bounds in reweight_eevdf() +- sched/eevdf: Fix miscalculation in reweight_entity() when se is not curr +- sched/eevdf: Always update V if se->on_rq when reweighting +- phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered +- riscv: Fix loading 64-bit NOMMU kernels past the start of RAM +- riscv: Fix TASK_SIZE on 64-bit NOMMU +- riscv: fix VMALLOC_START definition +- dmaengine: idxd: Fix oops during rmmod on single-CPU platforms +- dma: xilinx_dpdma: Fix locking +- dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue +- phy: qcom: m31: match requested regulator name with dt schema +- phy: rockchip: naneng-combphy: Fix mux on rk3588 +- phy: rockchip-snps-pcie3: fix clearing PHP_GRF_PCIESEL_CON bits +- phy: rockchip-snps-pcie3: fix bifurcation on rk3588 +- phy: freescale: imx8m-pcie: fix pcie link-up instability +- phy: marvell: a3700-comphy: Fix hardcoded array size +- phy: marvell: a3700-comphy: Fix out of bounds read +- soundwire: amd: fix for wake interrupt handling for clockstop mode +- idma64: Don't try to serve interrupts when device is powered off +- dmaengine: tegra186: Fix residual calculation +- dmaengine: owl: fix register access functions +- x86/tdx: Preserve shared bit on mprotect() +- phy: qcom: qmp-combo: Fix VCO div offset on v3 +- phy: qcom: qmp-combo: Fix register base for QSERDES_DP_PHY_MODE +- mtd: diskonchip: work around ubsan link failure +- udp: preserve the connected status if only UDP cmsg +- fbdev: fix incorrect address computation in deferred IO +- stackdepot: respect __GFP_NOLOCKDEP allocation flag +- net: b44: set pause params only when interface is up +- ethernet: Add helper for assigning packet type when dest address does not match device address +- ACPI: CPPC: Fix access width used for PCC registers +- ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro +- ACPI: CPPC: Use access_width over bit_width for system memory accesses +- irqchip/gic-v3-its: Prevent double free on error +- drm/amdgpu: Fix leak when GPU memory allocation fails +- drm/amdgpu: Assign correct bits for SDMA HDP flush +- drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3 +- arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma +- arm64: dts: qcom: sm8450: Fix the msi-map entries +- arm64: dts: qcom: sc8280xp: add missing PCIe minimum OPP +- LoongArch: Fix access error when read fault on a write-only VMA +- LoongArch: Fix callchain parse error with kernel tracepoint events +- cpu: Re-enable CPU mitigations by default for !X86 architectures +- btrfs: fix information leak in btrfs_ioctl_logical_to_ino() +- btrfs: scrub: run relocation repair when/only needed +- btrfs: fix wrong block_start calculation for btrfs_drop_extent_map_range() +- btrfs: fallback if compressed IO fails for ENOSPC +- HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up +- smb3: fix lock ordering potential deadlock in cifs_sync_mid_result +- smb3: missing lock when picking channel +- smb: client: Fix struct_group() usage in __packed structs +- mm: support page_mapcount() on page_has_type() pages +- mm: create FOLIO_FLAG_FALSE and FOLIO_TYPE_OPS macros +- mmc: sdhci-msm: pervent access to suspended controller +- mtd: rawnand: qcom: Fix broken OP_RESET_DEVICE command in qcom_misc_cmd_type_exec() +- Bluetooth: qca: fix NULL-deref on non-serdev setup +- Bluetooth: qca: fix NULL-deref on non-serdev suspend +- Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853 +- Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() +- rust: remove `params` from `module` macro example +- kbuild: rust: force `alloc` extern to allow "empty" Rust files +- kbuild: rust: remove unneeded `@rustc_cfg` to avoid ICE +- rust: make mutually exclusive with CFI_CLANG +- rust: init: remove impl Zeroable for Infallible +- rust: don't select CONSTRUCTORS +- x86/cpu: Fix check for RDPKRU in __show_regs() +- selftests/seccomp: Handle EINVAL on unshare(CLONE_NEWPID) +- selftests/seccomp: Change the syscall used in KILL_THREAD test +- selftests/seccomp: user_notification_addfd check nextfd is available +- Squashfs: check the inode number is not the invalid value of zero +- squashfs: convert to new timestamp accessors +- drm/amdgpu: fix visible VRAM handling during faults +- drm/amdgpu: add shared fdinfo stats +- drm: add drm_gem_object_is_shared_for_memory_stats() helper +- mm/madvise: make MADV_POPULATE_(READ|WRITE) handle VM_FAULT_RETRY properly +- mm/gup: explicitly define and check internal GUP flags, disallow FOLL_TOUCH +- KVM: x86/pmu: Set enable bits for GP counters in PERF_GLOBAL_CTRL at "RESET" +- KVM: x86/pmu: Zero out PMU metadata on AMD if PMU is disabled +- af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc(). +- tls: fix lockless read of strp->msg_ready in ->poll +- net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets +- ice: fix LAG and VF lock dependency in ice_reset_vf() +- iavf: Fix TC config comparison with existing adapter TC config +- i40e: Report MFS in decimal base instead of hex +- i40e: Do not use WQ_MEM_RECLAIM flag for workqueue +- net: ti: icssg-prueth: Fix signedness bug in prueth_init_rx_chns() +- net: phy: dp83869: Fix MII mode failure +- netfilter: nf_tables: honor table dormant flag from netdev release event path +- ARM: dts: imx6ull-tarragon: fix USB over-current polarity +- eth: bnxt: fix counting packets discarded due to OOM and netpoll +- mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work +- mlxsw: spectrum_acl_tcam: Fix incorrect list API usage +- mlxsw: spectrum_acl_tcam: Fix warning during rehash +- mlxsw: spectrum_acl_tcam: Fix memory leak during rehash +- mlxsw: spectrum_acl_tcam: Rate limit error message +- mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash +- mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update +- mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work +- mlxsw: spectrum_acl_tcam: Fix race in region ID allocation +- mlxsw: Use refcount_t for reference counting +- net: openvswitch: Fix Use-After-Free in ovs_ct_exit +- ipvs: Fix checksumming on GSO of SCTP packets +- Bluetooth: qca: set power_ctrl_enabled on NULL returned by gpiod_get_optional() +- Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor +- Bluetooth: btusb: mediatek: Fix double free of skb in coredump +- Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID +- Bluetooth: hci_event: Fix sending HCI_OP_READ_ENC_KEY_SIZE +- Bluetooth: btusb: Fix triggering coredump implementation for QCA +- gpio: tegra186: Fix tegra186_gpio_is_accessible() check +- net: phy: mediatek-ge-soc: follow netdev LED trigger semantics +- net: gtp: Fix Use-After-Free in gtp_dellink +- net: usb: ax88179_178a: stop lying about skb->truesize +- ipv4: check for NULL idev in ip_route_use_hint() +- net: fix sk_memory_allocated_{add|sub} vs softirqs +- net: make SK_MEMORY_PCPU_RESERV tunable +- tools: ynl: don't ignore errors in NLMSG_DONE messages +- ax25: Fix netdev refcount issue +- NFC: trf7970a: disable all regulators on removal +- net: dsa: mv88e6xx: fix supported_interfaces setup in mv88e6250_phylink_get_caps() +- cxl/core: Fix potential payload size confusion in cxl_mem_get_poison() +- bnxt_en: Fix the PCI-AER routines +- bnxt_en: refactor reset close code +- bridge/br_netlink.c: no need to return void function +- icmp: prevent possible NULL dereferences from icmp_build_probe() +- ARM: dts: microchip: at91-sama7g5ek: Replace regulator-suspend-voltage with the valid property +- mlxsw: core_env: Fix driver initialization with old firmware +- mlxsw: core: Unregister EMAD trap using FORWARD action +- net: bcmasp: fix memory leak when bringing down interface +- vxlan: drop packets from invalid src-address +- net: libwx: fix alloc msix vectors failed +- wifi: mac80211: fix unaligned le16 access +- wifi: mac80211: remove link before AP +- wifi: mac80211_hwsim: init peer measurement result +- drm/gma500: Remove lid code +- wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd +- wifi: iwlwifi: mvm: remove old PASN station when adding a new one +- wifi: mac80211: split mesh fast tx cache into local/proxied/forwarded +- wifi: mac80211: clean up assignments to pointer cache. +- ARC: [plat-hsdk]: Remove misplaced interrupt-cells property +- gpio: tangier: Use correct type for the IRQ chip data +- arm64: dts: qcom: sc8180x: Fix ss_phy_irq for secondary USB controller +- arm64: dts: rockchip: regulator for sd needs to be always on for BPI-R2Pro +- arm64: dts: mediatek: mt2712: fix validation errors +- arm64: dts: mediatek: mt7986: prefix BPI-R3 cooling maps with "map-" +- arm64: dts: mediatek: mt7986: drop invalid thermal block clock +- arm64: dts: mediatek: mt7986: reorder nodes +- arm64: dts: mediatek: mt7986: drop "#reset-cells" from Ethernet controller +- arm64: dts: mediatek: mt7986: drop invalid properties from ethsys +- arm64: dts: mediatek: mt7986: reorder properties +- arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block +- arm64: dts: mediatek: mt7622: fix ethernet controller "compatible" +- arm64: dts: mediatek: mt7622: fix IR nodename +- arm64: dts: mediatek: mt7622: fix clock controllers +- arm64: dts: mediatek: mt8183-kukui: Use default min voltage for MT6358 +- arm64: dts: mediatek: mt8195-cherry: Update min voltage constraint for MT6315 +- arm64: dts: mediatek: mt8192-asurada: Update min voltage constraint for MT6315 +- arm64: dts: mediatek: cherry: Describe CPU supplies +- arm64: dts: mediatek: cherry: Add platform thermal configuration +- arm64: dts: mediatek: mt8195: Add missing gce-client-reg to mutex1 +- arm64: dts: mediatek: mt8195: Add missing gce-client-reg to mutex +- arm64: dts: mediatek: mt8195: Add missing gce-client-reg to vpp/vdosys +- arm64: dts: mediatek: mt8192: Add missing gce-client-reg to mutex +- arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfg +- arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro dts +- arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma +- arm64: dts: rockchip: fix alphabetical ordering RK3399 puma +- arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 Puma +- arm64: dts: rockchip: set PHY address of MT7531 switch to 0x1f +- HID: logitech-dj: allow mice to use all types of reports +- HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc +- cifs: reinstate original behavior again for forceuid/forcegid +- smb: client: fix rename(2) regression against samba +- cifs: Fix reacquisition of volume cookie on still-live connection +- selftests: kselftest: Fix build failure with NOLIBC +- thunderbolt: Reset only non-USB4 host routers in resume +- PCI/ASPM: Fix deadlock when enabling ASPM +- ksmbd: common: use struct_group_attr instead of struct_group for network_open_info +- ksmbd: clear RENAME_NOREPLACE before calling vfs_rename +- ksmbd: validate request buffer size in smb2_allocate_rsp_buf() +- ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf +- powerpc/ftrace: Ignore ftrace locations in exit text sections +- virtio_net: Do not send RSS key if it is not supported +- net: dsa: mt7530: fix enabling EEE on MT7531 switch on all boards +- net: dsa: mt7530: fix improper frames on all 25MHz and 40MHz XTAL MT7530 +- nilfs2: fix OOB in nilfs_set_de_type +- bootconfig: use memblock_free_late to free xbc memory to buddy +- nouveau: fix instmem race condition around ptr stores +- drm/vmwgfx: Fix crtc's atomic check conditional +- drm/vmwgfx: Sort primary plane formats by order of preference +- drm/vmwgfx: Fix prime import/export +- drm/amdgpu: remove invalid resource->start check v2 +- drm/amdkfd: Fix memory leak in create_process failure +- drm/amdgpu: validate the parameters of bo mapping operations more clearly +- fuse: fix leaked ENOSYS error on first statx call +- mm/shmem: inline shmem_is_huge() for disabled transparent hugepages +- mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled +- mm,swapops: update check in is_pfn_swap_entry for hwpoison entries +- mm/userfaultfd: allow hugetlb change protection upon poison entry +- init/main.c: Fix potential static_command_line memory overflow +- arm64: hibernate: Fix level3 translation fault in swsusp_save() +- arm64/head: Disable MMU at EL2 before clearing HCR_EL2.E2H +- KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status +- KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD platforms +- KVM: x86/pmu: Disable support for adaptive PEBS +- KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel compatible +- sched: Add missing memory barrier in switch_mm_cid +- fs: sysfs: Fix reference leak in sysfs_break_active_protection() +- speakup: Avoid crash on very long word +- mei: me: disable RPL-S on SPS and IGN firmwares +- usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error +- usb: Disable USB3 LPM at shutdown +- usb: dwc2: host: Fix dereference issue in DDMA completion flow. +- Revert "usb: cdc-wdm: close race between read and workqueue" +- USB: serial: option: add Telit FN920C04 rmnet compositions +- USB: serial: option: add Rolling RW101-GL and RW135-GL support +- USB: serial: option: support Quectel EM060K sub-models +- USB: serial: option: add Lonsung U8300/U9300 product +- USB: serial: option: add support for Fibocom FM650/FG650 +- USB: serial: option: add Fibocom FM135-GL variants +- serial: core: Fix missing shutdown and startup for serial base port +- serial: core: Clearing the circular buffer before NULLifying it +- serial: stm32: Reset .throttled state in .startup() +- serial: stm32: Return IRQ_NONE in the ISR if no handling happend +- serial/pmac_zilog: Remove flawed mitigation for rx irq flood +- serial: mxs-auart: add spinlock around changing cts state +- comedi: vmk80xx: fix incomplete endpoint checking +- thunderbolt: Fix wake configurations after device unplug +- thunderbolt: Avoid notify PM core about runtime PM resume +- binder: check offset alignment in binder_get_object() +- ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC +- ALSA: hda/realtek: Add quirks for Huawei Matebook D14 NBLB-WAX9N +- ALSA: hda/tas2781: Add new vendor_id and subsystem_id to support ThinkPad ICE-1 +- ALSA: hda/tas2781: correct the register for pow calibrated data +- ALSA: seq: ump: Fix conversion from MIDI2 to MIDI1 UMP messages +- net/mlx5: E-switch, store eswitch pointer before registering devlink_param +- x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ +- x86/bugs: Fix BHI retpoline check +- clk: mediatek: Do a runtime PM get on controllers during probe +- clk: Get runtime PM before walking tree for clk_summary +- clk: Show active consumers of clocks in debugfs +- clk: Get runtime PM before walking tree during disable_unused +- clk: Initialize struct clk_core kref earlier +- clk: Remove prepare_lock hold assertion in __clk_release() +- interconnect: Don't access req_list while it's being manipulated +- platform/x86/amd/pmc: Extend Framework 13 quirk to more BIOSes +- usb: new quirk to reduce the SET_ADDRESS request timeout +- usb: xhci: Add timeout argument in address_device USB HCD callback +- drm: panel-orientation-quirks: Add quirk for Lenovo Legion Go +- ALSA: scarlett2: Rename scarlett_gen2 to scarlett2 +- PCI: Simplify pcie_capability_clear_and_set_word() to ..._clear_word() +- PCI/DPC: Use FIELD_GET() +- ALSA: scarlett2: Add Focusrite Clarett 2Pre and 4Pre USB support +- ALSA: scarlett2: Add Focusrite Clarett+ 2Pre and 4Pre support +- ALSA: scarlett2: Add correct product series name to messages +- ALSA: scarlett2: Default mixer driver to enabled +- thunderbolt: Reset topology created by the boot firmware +- thunderbolt: Make tb_switch_reset() support Thunderbolt 2, 3 and USB4 routers +- thunderbolt: Introduce tb_path_deactivate_hop() +- thunderbolt: Introduce tb_port_reset() +- ASoC: ti: Convert Pandora ASoC to GPIO descriptors +- ALSA: scarlett2: Add support for Clarett 8Pre USB +- ALSA: scarlett2: Move USB IDs out from device_info struct +- drm/radeon: make -fstrict-flex-arrays=3 happy +- drm/panel: visionox-rm69299: don't unregister DSI device +- drm: nv04: Fix out of bounds access +- s390/cio: fix race condition during online processing +- s390/qdio: handle deferred cc1 +- perf lock contention: Add a missing NULL check +- RDMA/mlx5: Fix port number for counter query in multi-port configuration +- RDMA/cm: Print the old state when cm_destroy_id gets timeout +- RDMA/rxe: Fix the problem "mutex_destroy missing" +- drm/i915/mst: Limit MST+DSC to TGL+ +- net: ethernet: ti: am65-cpsw-nuss: cleanup DMA Channels before using them +- net: ethernet: mtk_eth_soc: fix WED + wifi reset +- gpiolib: swnode: Remove wrong header inclusion +- s390/ism: Properly fix receive message buffer allocation +- net: dsa: mt7530: fix port mirroring for MT7988 SoC switch +- net: dsa: mt7530: fix mirroring frames received on local port +- tun: limit printing rate when illegal packet received by tun dev +- ice: Fix checking for unsupported keys on non-tunnel device +- ice: tc: allow zero flags in parsing tc flower +- ice: tc: check src_vsi in case of traffic from VF +- net: stmmac: Fix IP-cores specific MAC capabilities +- net: stmmac: Fix max-speed being ignored on queue re-init +- net: stmmac: Apply half-duplex-less constraint for DW QoS Eth only +- octeontx2-pf: fix FLOW_DIS_IS_FRAGMENT implementation +- net: change maximum number of UDP segments to 128 +- net/mlx5e: Prevent deadlock while disabling aRFS +- net/mlx5: Lag, restore buckets number to default after hash LAG deactivation +- net: sparx5: flower: fix fragment flags handling +- af_unix: Don't peek OOB data without MSG_OOB. +- af_unix: Call manage_oob() for every skb in unix_stream_read_generic(). +- netfilter: flowtable: incorrect pppoe tuple +- netfilter: flowtable: validate pppoe header +- netfilter: nft_set_pipapo: do not free live element +- netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() +- netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() +- scsi: ufs: qcom: Add missing interconnect bandwidth values for Gear 5 +- arm64: tlb: Fix TLBI RANGE operand +- arm64/mm: Modify range-based tlbi to decrement scale +- net: usb: ax88179_178a: avoid writing the mac address before first reading +- scsi: core: Fix handling of SCMD_FAIL_IF_RECOVERING +- random: handle creditable entropy from atomic process context +- selftests/ftrace: Limit length in subsystem-enable tests +- SUNRPC: Fix rpcgss_context trace event acceptor field +- drm/i915/vma: Fix UAF on destroy against retire race +- io_uring: Fix io_cqring_wait() not restoring sigmask on get_timespec64() failure +- media: videobuf2: request more buffers for vb2_read +- drm/msm/dpu: populate SSPP scaler block version +- selftests: timers: Fix posix_timers ksft_print_msg() warning +- ceph: redirty page before returning AOP_WRITEPAGE_ACTIVATE +- ceph: rename _to_client() to _to_fs_client() +- ceph: pass the mdsc to several helpers +- drm/amd/display: Do not recursively call manual trigger programming +- selftests/timers/posix_timers: Reimplement check_timer_distribution() +- selftests: timers: Convert posix_timers test to generate KTAP output +- drm/i915: Disable live M/N updates when using bigjoiner +- drm/i915: Adjust seamless_m_n flag behaviour +- drm/i915: Enable VRR later during fastsets +- drm/i915: Extract intel_crtc_vblank_evade_scanlines() +- drm/i915: Change intel_pipe_update_{start,end}() calling convention +- drm/i915/cdclk: Fix voltage_level programming edge case +- drm/i915/mst: Reject FEC+MST on ICL +- drm/i915: Fix FEC pipe A vs. DDI A mixup +- smb: client: refresh referral without acquiring refpath_lock +- smb: client: guarantee refcounted children from parent session +- smb3: show beginning time for per share stats +- smb: client: fix UAF in smb2_reconnect_server() +- smb: client: remove extra @chan_count check in __cifs_put_smb_ses() +- drm/amd/display: fix disable otg wa logic in DCN316 +- drm/amd/display: Set VSC SDP Colorimetry same way for MST and SST +- drm/amd/display: Program VSC SDP colorimetry for all DP sinks >= 1.4 +- drm/amdgpu: fix incorrect number of active RBs for gfx11 +- drm/amdgpu: always force full reset for SOC21 +- drm/amdgpu: Reset dGPU if suspend got aborted +- drm/i915: Disable port sync when bigjoiner is used +- drm/i915/cdclk: Fix CDCLK programming order when pipes are active +- x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI +- x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto +- x86/bugs: Clarify that syscall hardening isn't a BHI mitigation +- x86/bugs: Fix BHI handling of RRSBA +- x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' +- x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES +- x86/bugs: Fix BHI documentation +- x86/bugs: Fix return type of spectre_bhi_state() +- irqflags: Explicitly ignore lockdep_hrtimer_exit() argument +- x86/apic: Force native_apic_mem_read() to use the MOV instruction +- selftests: timers: Fix abs() warning in posix_timers test +- x86/cpu: Actually turn off mitigations by default for SPECULATION_MITIGATIONS=n +- perf/x86: Fix out of range data +- vhost: Add smp_rmb() in vhost_enable_notify() +- vhost: Add smp_rmb() in vhost_vq_avail_empty() +- arm64: dts: imx8-ss-dma: fix spi lpcg indices +- arm64: dts: imx8-ss-lsio: fix pwm lpcg indices +- arm64: dts: imx8-ss-conn: fix usb lpcg indices +- arm64: dts: imx8-ss-dma: fix adc lpcg indices +- arm64: dts: imx8-ss-dma: fix can lpcg indices +- arm64: dts: imx8qm-ss-dma: fix can lpcg indices +- drm/client: Fully protect modes[] with dev->mode_config.mutex +- drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr() +- drm/ast: Fix soft lockup +- drm/amdkfd: Reset GPU on queue preemption failure +- drm/i915/vrr: Disable VRR when using bigjoiner +- drm/vmwgfx: Enable DMA mappings with SEV +- accel/ivpu: Fix deadlock in context_xa +- scsi: sg: Avoid race in error handling & drop bogus warn +- scsi: sg: Avoid sg device teardown race +- kprobes: Fix possible use-after-free issue on kprobe registration +- io_uring/net: restore msg_control on sendzc retry +- btrfs: qgroup: convert PREALLOC to PERTRANS after record_root_in_trans +- btrfs: record delayed inode root in transaction +- btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations +- btrfs: qgroup: correctly model root qgroup rsv in convert +- selftests: mptcp: use += operator to append strings +- iommu/vt-d: Allocate local memory for page request queue +- iommu/vt-d: Fix wrong use of pasid config +- tracing: hide unused ftrace_event_id_fops +- net: ena: Set tx_info->xdpf value to NULL +- net: ena: Use tx_ring instead of xdp_ring for XDP channel TX +- net: ena: Pass ena_adapter instead of net_device to ena_xmit_common() +- net: ena: Move XDP code to its new files +- net: ena: Fix incorrect descriptor free behavior +- net: ena: Wrong missing IO completions check order +- net: ena: Fix potential sign extension issue +- af_unix: Fix garbage collector racing against connect() +- af_unix: Do not use atomic ops for unix_sk(sk)->inflight. +- net: dsa: mt7530: trap link-local frames regardless of ST Port State +- Revert "s390/ism: fix receive message buffer allocation" +- net: sparx5: fix wrong config being used when reconfiguring PCS +- net/mlx5e: Do not produce metadata freelist entries in Tx port ts WQE xmit +- net/mlx5e: HTB, Fix inconsistencies with QoS SQs number +- net/mlx5e: Fix mlx5e_priv_init() cleanup flow +- net/mlx5: Correctly compare pkt reformat ids +- net/mlx5: Properly link new fs rules into the tree +- net/mlx5: offset comp irq index in name by one +- net/mlx5: Register devlink first under devlink lock +- net/mlx5: SF, Stop waiting for FW as teardown was called +- netfilter: complete validation of user input +- Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit +- Bluetooth: SCO: Fix not validating setsockopt user input +- Bluetooth: hci_sync: Fix using the same interval and window for Coded PHY +- Bluetooth: hci_sync: Use QoS to determine which PHY to scan +- Bluetooth: ISO: Don't reject BT_ISO_QOS if parameters are unset +- Bluetooth: ISO: Align broadcast sync_timeout with connection timeout +- ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr +- ipv4/route: avoid unused-but-set-variable warning +- ipv6: fib: hide unused 'pn' variable +- octeontx2-af: Fix NIX SQ mode and BP config +- af_unix: Clear stale u->oob_skb. +- net: ks8851: Handle softirqs at the end of IRQ thread to fix hang +- net: ks8851: Inline ks8851_rx_skb() +- bnxt_en: Reset PTP tx_avail after possible firmware reset +- bnxt_en: Fix error recovery for RoCE ulp client +- bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init() +- s390/ism: fix receive message buffer allocation +- geneve: fix header validation in geneve[6]_xmit_skb +- block: fix q->blkg_list corruption during disk rebind +- octeontx2-pf: Fix transmit scheduler resource leak +- xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING +- u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file +- net: openvswitch: fix unwanted error log on timeout policy probing +- scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() +- nouveau: fix function cast warning +- Revert "drm/qxl: simplify qxl_fence_wait" +- cxl/core: Fix initialization of mbox_cmd.size_out in get event +- arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order +- drm/msm/dpu: don't allow overriding data from catalog +- cxl/core/regs: Fix usage of map->reg_type in cxl_decode_regblock() before assigned +- cxl/mem: Fix for the index of Clear Event Record Handle +- firmware: arm_scmi: Make raw debugfs entries non-seekable +- ARM: OMAP2+: fix USB regression on Nokia N8x0 +- mmc: omap: restore original power up/down steps +- mmc: omap: fix deferred probe +- mmc: omap: fix broken slot switch lookup +- ARM: OMAP2+: fix N810 MMC gpiod table +- ARM: OMAP2+: fix bogus MMC GPIO labels on Nokia N8x0 +- media: cec: core: remove length check of Timer Status +- PM: s2idle: Make sure CPUs will wakeup directly on resume +- ACPI: scan: Do not increase dep_unmet for already met dependencies +- platform/chrome: cros_ec_uart: properly fix race condition +- drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 +- Bluetooth: Fix memory leak in hci_req_sync_complete() +- ring-buffer: Only update pages_touched when a new page is touched +- raid1: fix use-after-free for original bio in raid1_write_request() +- ARM: dts: imx7s-warp: Pass OV2680 link-frequencies +- batman-adv: Avoid infinite loop trying to resize local TT +- ata: libata-scsi: Fix ata_scsi_dev_rescan() error path +- ata: libata-core: Allow command duration limits detection for ACS-4 drives +- smb3: fix Open files on server counter going negative +- drm: Check polling initialized before enabling in drm_helper_probe_single_connector_modes +- Revert "drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()" +- VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() +- net: mpls: error out if inner headers are not set +- Bluetooth: btintel: Fixe build regression +- platform/x86: intel-vbtn: Update tablet mode switch at end of probe +- randomize_kstack: Improve entropy diffusion +- media: mediatek: vcodec: adding lock to protect encoder context list +- media: mediatek: vcodec: adding lock to protect decoder context list +- media: mediatek: vcodec: Fix oops when HEVC init fails +- selftests: mptcp: display simult in extra_msg +- gcc-plugins/stackleak: Avoid .head.text section +- ALSA: hda/realtek: Add quirks for some Clevo laptops +- fbmon: prevent division by zero in fb_videomode_from_videomode() +- drivers/nvme: Add quirks for device 126f:2262 +- modpost: fix null pointer dereference +- io_uring: clear opcode specific data for an early failure +- fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 +- x86/xen: attempt to inflate the memory balloon on PVH +- ASoC: soc-core.c: Skip dummy codec when adding platforms +- thermal/of: Assume polling-delay(-passive) 0 when absent +- ASoC: amd: yc: Fix non-functional mic on ASUS M7600RE +- usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined +- usb: typec: tcpci: add generic tcpci fallback compatible +- thunderbolt: Keep the domain powered when USB4 port is in redrive mode +- usb: typec: ucsi: Limit read size on v1.2 +- usb: gadget: uvc: mark incomplete frames with UVC_STREAM_ERR +- bus: mhi: host: Add MHI_PM_SYS_ERR_FAIL state +- tools: iio: replace seekdir() in iio_generic_buffer +- ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment +- Input: xpad - add support for Snakebyte GAMEPADs +- ktest: force $buildonly = 1 for 'make_warnings_file' test type +- ALSA: hda/realtek: Add quirk for Lenovo Yoga 9 14IMH9 +- platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet +- Input: allocate keycode for Display refresh rate toggle +- Input: imagis - use FIELD_GET where applicable +- RDMA/cm: add timeout to cm_destroy_id wait +- block: prevent division by zero in blk_rq_stat_sum() +- input/touchscreen: imagis: Correct the maximum touch area value +- libperf evlist: Avoid out-of-bounds access +- Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default" +- PCI: Disable D3cold on Asus B1400 PCI-NVMe bridge +- SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int +- drm: Check output polling initialized before disabling +- drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init() +- HID: input: avoid polling stylus battery on Chromebook Pompom +- i2c: designware: Fix RX FIFO depth define on Wangxun 10Gb NIC +- accel/habanalabs: increase HL_MAX_STR to 64 bytes to avoid warnings +- drm/amd/display: Fix nanosec stat overflow +- ext4: forbid commit inconsistent quota data when errors=remount-ro +- ext4: add a hint for block bitmap corrupt state in mb_groups +- ASoC: Intel: avs: Populate board selection with new I2S entries +- ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block counter +- media: sta2x11: fix irq handler cast +- Julia Lawall reported this null pointer dereference, this should fix it. +- rcu-tasks: Repair RCU Tasks Trace quiescence check +- rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock() +- ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710) laptops +- isofs: handle CDs with bad root inode but good Joliet root directory +- scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() +- sysv: don't call sb_bread() with pointers_lock held +- pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs +- drm/ttm: return ENOSPC from ttm_bo_mem_space v3 +- ASoC: SOF: amd: Optimize quirk for Valve Galileo +- drm: panel-orientation-quirks: Add quirk for GPD Win Mini +- Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails +- drm/vc4: don't check if plane->state->fb == state->fb +- Bluetooth: Add new quirk for broken read key length on ATS2851 +- Bluetooth: btmtk: Add MODULE_FIRMWARE() for MT7922 +- Bluetooth: btintel: Fix null ptr deref in btintel_read_version +- net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() +- ice: use relative VSI index for VFs instead of PF VSI number +- btrfs: send: handle path ref underflow in header iterate_inode_ref() +- btrfs: export: handle invalid inode or root reference in btrfs_get_parent() +- btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() +- wifi: cfg80211: check A-MSDU format more carefully +- wifi: iwlwifi: Add missing MODULE_FIRMWARE() for *.pnvm +- overflow: Allow non-type arg to type_max() and type_min() +- cpufreq: Don't unregister cpufreq cooling on CPU hotplug +- wifi: ath11k: decrease MHI channel buffer length to 8KB +- dma-direct: Leak pages on dma_set_decrypted() failure +- net: pcs: xpcs: Return EINVAL in the internal methods +- tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num() +- pstore/zone: Add a null pointer check to the psz_kmsg_read +- ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of CONFIG_X86_ANDROID_TABLETS +- wifi: mt76: mt7996: add locking for accessing mapped registers +- wifi: mt76: mt7996: disable AMSDU for non-data frames +- wifi: mt76: mt7915: add locking for accessing mapped registers +- wifi: brcmfmac: Add DMI nvram filename quirk for ACEPC W5 Pro +- firmware: tegra: bpmp: Return directly after a failed kzalloc() in get_filename() +- net: skbuff: add overflow debug check to pull/push helpers +- ionic: set adminq irq affinity +- pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain +- pmdomain: ti: Add a null pointer check to the omap_prm_domain_init +- net: add netdev_lockdep_set_classes() to virtual drivers +- arm64: dts: rockchip: fix rk3399 hdmi ports node +- arm64: dts: rockchip: fix rk3328 hdmi ports node +- ARM: dts: rockchip: fix rk322x hdmi ports node +- ARM: dts: rockchip: fix rk3288 hdmi ports node +- cpuidle: Avoid potential overflow in integer multiplication +- panic: Flush kernel log buffer at the end +- printk: For @suppress_panic_printk check for other CPU in panic +- wifi: iwlwifi: pcie: Add the PCI device id for new hardware +- VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() +- wifi: rtw89: pci: enlarge RX DMA buffer to consider size of RX descriptor +- net: phy: phy_device: Prevent nullptr exceptions on ISR +- net: stmmac: dwmac-starfive: Add support for JH7100 SoC +- bnx2x: Fix firmware version string character counts +- wifi: rtw89: fix null pointer access when abort scan +- wifi: ath9k: fix LNA selection in ath_ant_try_scan() +- amdkfd: use calloc instead of kzalloc to avoid integer overflow +- x86: set SPECTRE_BHI_ON as default +- KVM: x86: Add BHI_NO +- x86/bhi: Mitigate KVM by default +- x86/bhi: Add BHI mitigation knob +- x86/bhi: Enumerate Branch History Injection (BHI) bug +- x86/bhi: Define SPEC_CTRL_BHI_DIS_S +- x86/bhi: Add support for clearing branch history at syscall entry +- x86/syscall: Don't force use of indirect calls for system calls +- x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file +- x86/boot: Move mem_encrypt= parsing to the decompressor +- x86/efistub: Remap kernel text read-only before dropping NX attribute +- x86/sev: Move early startup code into .head.text section +- x86/sme: Move early SME kernel encryption handling into .head.text +- efi/libstub: Add generic support for parsing mem_encrypt= +- x86/head/64: Move the __head definition to +- bpf: put uprobe link's path and task in release callback +- mptcp: don't account accept() of non-MPC client as fallback to TCP +- mptcp: don't overwrite sock_ops in mptcp_is_tcpsk() +- selftests: mptcp: connect: fix shellcheck warnings +- of: module: prevent NULL pointer dereference in vsnprintf() +- Revert "x86/mpparse: Register APIC address only once" +- drm/i915/gt: Enable only one CCS for compute workload +- drm/i915/gt: Do not generate the command streamer for all the CCS +- drm/i915/gt: Disable HW load balancing for CCS +- smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() +- smb: client: fix potential UAF in smb2_is_network_name_deleted() +- smb: client: fix potential UAF in is_valid_oplock_break() +- smb: client: fix potential UAF in smb2_is_valid_lease_break() +- smb: client: fix potential UAF in smb2_is_valid_oplock_break() +- smb: client: fix potential UAF in cifs_dump_full_key() +- smb: client: fix potential UAF in cifs_stats_proc_show() +- smb: client: fix potential UAF in cifs_stats_proc_write() +- smb: client: fix potential UAF in cifs_debug_files_proc_show() +- smb3: retrying on failed server close +- smb: client: serialise cifs_construct_tcon() with cifs_mount_mutex +- smb: client: handle DFS tcons in cifs_construct_tcon() +- riscv: process: Fix kernel gp leakage +- riscv: Fix spurious errors from __get/put_kernel_nofault +- s390/entry: align system call table on 8 bytes +- selftests/mm: include strings.h for ffsl +- mm/secretmem: fix GUP-fast succeeding on secretmem folios +- arm64/ptrace: Use saved floating point state type to determine SVE layout +- perf/x86/intel/ds: Don't clear ->pebs_data_cfg for the last PEBS event +- x86/coco: Require seeding RNG with RDRAND on CoCo systems +- x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() +- x86/mm/pat: fix VM_PAT handling in COW mappings +- of: dynamic: Synchronize of_changeset_destroy() with the devlink removals +- driver core: Introduce device_link_wait_removal() +- io_uring/kbuf: hold io_buffer_list reference over mmap +- io_uring: use private workqueue for exit work +- io_uring/kbuf: protect io_buffer_list teardown with a reference +- io_uring/kbuf: get rid of bl->is_ready +- io_uring/kbuf: get rid of lower BGID lists +- ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone +- ALSA: hda/realtek - Fix inactive headset mic jack +- ksmbd: do not set SMB2_GLOBAL_CAP_ENCRYPTION for SMB 3.1.1 +- ksmbd: validate payload size in ipc response +- ksmbd: don't send oplock break if rename fails +- gpio: cdev: fix missed label sanitizing in debounce_setup() +- gpio: cdev: check for NULL labels when sanitizing them for irqs +- x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk +- ice: fix typo in assignment +- nfsd: hold a lighter-weight client reference over CB_RECALL_ANY +- riscv: Disable preemption when using patch_map() +- ASoC: SOF: amd: fix for false dsp interrupts +- ata: sata_mv: Fix PCI device ID table declaration compilation warning +- spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe +- cifs: Fix caching to try to do open O_WRONLY as rdwr on server +- Revert "ALSA: emu10k1: fix synthesizer sample playback position and caching" +- scsi: mylex: Fix sysfs buffer lengths +- ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit +- regmap: maple: Fix uninitialized symbol 'ret' warnings +- ASoC: amd: acp: fix for acp_init function error handling +- spi: s3c64xx: Use DMA mode from fifo size +- spi: s3c64xx: determine the fifo depth only once +- spi: s3c64xx: allow full FIFO masks +- spi: s3c64xx: define a magic value +- spi: s3c64xx: remove else after return +- spi: s3c64xx: explicitly include +- spi: s3c64xx: sort headers alphabetically +- spi: s3c64xx: Extract FIFO depth calculation to a dedicated macro +- ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw +- ASoC: rt722-sdca-sdw: fix locking sequence +- ASoC: rt712-sdca-sdw: fix locking sequence +- ASoC: rt711-sdw: fix locking sequence +- ASoC: rt711-sdca: fix locking sequence +- ASoC: rt5682-sdw: fix locking sequence +- drm/prime: Unbreak virtgpu dma-buf export +- nouveau/uvmm: fix addr/range calcs for remap operations +- drm/panfrost: fix power transition timeout warnings +- ALSA: hda: cs35l56: Add ACPI device match tables +- regmap: maple: Fix cache corruption in regcache_maple_drop() +- RISC-V: Update AT_VECTOR_SIZE_ARCH for new AT_MINSIGSTKSZ +- drivers/perf: riscv: Disable PERF_SAMPLE_BRANCH_* while not supported +- ASoC: wm_adsp: Fix missing mutex_lock in wm_adsp_write_ctl() +- 9p: Fix read/write debug statements to report server reply +- fs/pipe: Fix lockdep false-positive in watchqueue pipe_write() +- KVM: SVM: Add support for allowing zero SEV ASIDs +- KVM: SVM: Use unsigned integers when dealing with ASIDs +- net: ravb: Always update error counters +- net: ravb: Always process TX descriptor ring +- net: ravb: Let IP-specific receive function to interrogate descriptors +- e1000e: move force SMBUS from enable ulp function to avoid PHY loss issue +- e1000e: Minor flow correction in e1000_shutdown function +- e1000e: Workaround for sporadic MDI error on Meteor Lake systems +- intel: legacy: field get conversion +- intel: add bit macro includes where needed +- i40e: Remove circular header dependencies and fix headers +- i40e: Split i40e_osdep.h +- i40e: Move memory allocation structures to i40e_alloc.h +- i40e: Simplify memory allocation functions +- virtchnl: Add header dependencies +- i40e: Refactor I40E_MDIO_CLAUSE* macros +- i40e: Remove back pointer from i40e_hw structure +- i40e: Enforce software interrupt during busy-poll exit +- i40e: Remove _t suffix from enum type names +- drm/amd: Flush GFXOFF requests in prepare stage +- drm/amd: Add concept of running prepare_suspend() sequence for IP blocks +- drm/amd: Evict resources during PM ops prepare() callback +- drm/amd/display: Prevent crash when disable stream +- drm/amd/display: Fix DPSTREAM CLK on and off sequence +- usb: typec: ucsi: Fix race between typec_switch and role_switch +- i40e: fix vf may be used uninitialized in this function warning +- i40e: fix i40e_count_filters() to count only active/new filters +- octeontx2-af: Add array index check +- octeontx2-pf: check negative error code in otx2_open() +- octeontx2-af: Fix issue with loading coalesced KPU profiles +- udp: prevent local UDP tunnel packets from being GROed +- udp: do not transition UDP GRO fraglist partial checksums to unnecessary +- udp: do not accept non-tunnel GSO skbs landing in a tunnel +- r8169: skip DASH fw status checks when DASH is disabled +- mlxbf_gige: stop interface during shutdown +- ipv6: Fix infinite recursion in fib6_dump_done(). +- ax25: fix use-after-free bugs caused by ax25_ds_del_timer +- tcp: Fix bind() regression for v6-only wildcard and v4(-mapped-v6) non-wildcard addresses. +- selftests: reuseaddr_conflict: add missing new line at the end of the output +- erspan: make sure erspan_base_hdr is present in skb->head +- i40e: Fix VF MAC filter removal +- ice: fix enabling RX VLAN filtering +- gro: fix ownership transfer +- selftests: net: gro fwd: update vxlan GRO test expectations +- net: dsa: mv88e6xxx: fix usable ports on 88e6020 +- net: phy: micrel: Fix potential null pointer dereference +- net: fec: Set mac_managed_pm during probe +- net: txgbe: fix i2c dev name cannot match clkdev +- net: phy: micrel: lan8814: Fix when enabling/disabling 1-step timestamping +- net: stmmac: fix rx queue priority assignment +- net/sched: fix lockdep splat in qdisc_tree_reduce_backlog() +- net: dsa: sja1105: Fix parameters order in sja1110_pcs_mdio_write_c45() +- net/sched: act_skbmod: prevent kernel-infoleak +- KVM: arm64: Ensure target address is granule-aligned for range TLBI +- x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO +- bpf, sockmap: Prevent lock inversion deadlock in map delete elem +- vboxsf: Avoid an spurious warning if load_nls_xxx() fails +- netfilter: validate user input for expected length +- netfilter: nf_tables: discard table flag update with pending basechain deletion +- netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() +- netfilter: nf_tables: flush pending destroy work before exit_net release +- netfilter: nf_tables: reject new basechain after table flag update +- x86/bugs: Fix the SRSO mitigation on Zen3/4 +- x86/nospec: Refactor UNTRAIN_RET[_*] +- x86/srso: Disentangle rethunk-dependent options +- x86/srso: Improve i-cache locality for alias mitigation +- vsock/virtio: fix packet delivery to tap device +- net: mana: Fix Rx DMA datasize and skb_over_panic +- net: usb: ax88179_178a: avoid the interface always configured as random address +- net/rds: fix possible cp null dereference +- xen-netfront: Add missing skb_mark_for_recycle +- selftests: mptcp: join: fix dev in check_endpoint +- netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path +- netfilter: nf_tables: release batch on table validation from abort path +- Bluetooth: Fix TOCTOU in HCI debugfs implementation +- Bluetooth: hci_event: set the conn encrypted before conn establishes +- Bluetooth: add quirk for broken address properties +- Bluetooth: qca: fix device-address endianness +- arm64: dts: qcom: sc7180-trogdor: mark bluetooth address as broken +- Revert "Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT" +- x86/bpf: Fix IP after emitting call depth accounting +- r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d +- selinux: avoid dereference of garbage after mount failure +- KVM: arm64: Fix host-programmed guest events in nVHE +- RISC-V: KVM: Fix APLIC in_clrip[x] read emulation +- RISC-V: KVM: Fix APLIC setipnum_le/be write emulation +- gpio: cdev: sanitize the label before requesting the interrupt +- modpost: do not make find_tosym() return NULL +- btrfs: fix race when detecting delalloc ranges during fiemap +- btrfs: ensure fiemap doesn't race with writes when FIEMAP_FLAG_SYNC is given +- Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped." +- mm/treewide: replace pud_large() with pud_leaf() +- dm integrity: fix out-of-range warning +- drm/i915/mtl: Update workaround 14018575942 +- drm/i915/xelpg: Extend some workarounds/tuning to gfx version 12.74 +- drm/i915/mtl: Update workaround 14016712196 +- drm/i915: Replace several IS_METEORLAKE with proper IP version checks +- drm/i915: Eliminate IS_MTL_GRAPHICS_STEP +- drm/i915/xelpg: Call Xe_LPG workaround functions based on IP version +- drm/i915: Consolidate condition for Wa_22011802037 +- drm/i915: Tidy workaround definitions +- drm/i915/dg2: Drop pre-production GT workarounds +- inet: inet_defrag: prevent sk release while still in use +- Octeontx2-af: fix pause frame configuration in GMP mode +- net: lan743x: Add set RFE read fifo threshold for PCI1x1x chips +- net: bcmasp: Bring up unimac after PHY link up +- netfilter: nf_tables: skip netdev hook unregistration if table is dormant +- netfilter: nf_tables: reject table flag and netdev basechain updates +- netfilter: nf_tables: reject destroy command to remove basechain hooks +- cifs: Fix duplicate fscache cookie warnings +- bpf: Protect against int overflow for stack access size +- mlxbf_gige: call request_irq() after NAPI initialized +- tls: get psock ref after taking rxlock to avoid leak +- tls: adjust recv return with async crypto and failed copy to userspace +- tls: recv: process_rx_list shouldn't use an offset with kvec +- net: hns3: mark unexcuted loopback test result as UNEXECUTED +- net: hns3: fix kernel crash when devlink reload during pf initialization +- net: hns3: fix index limit to support all queue stats +- ACPICA: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields() +- selftests: vxlan_mdb: Fix failures with old libnet +- net: wwan: t7xx: Split 64bit accesses to fix alignment issues +- tcp: properly terminate timers for kernel sockets +- net: hsr: hsr_slave: Fix the promiscuous mode in offload mode +- s390/qeth: handle deferred cc1 +- igc: Remove stale comment about Tx timestamping +- ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa() +- ice: fix memory corruption bug with suspend and rebuild +- ice: realloc VSI stats arrays +- ice: Refactor FW data type and fix bitmap casting issue +- ALSA: hda: cs35l56: Set the init_done flag before component_add() +- wifi: iwlwifi: mvm: include link ID when releasing frames +- wifi: iwlwifi: disable multi rx queue for 9000 +- wifi: iwlwifi: mvm: rfi: fix potential response leaks +- mlxbf_gige: stop PHY during open() error paths +- tools: ynl: fix setting presence bits in simple nests +- nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet +- arm64: bpf: fix 32bit unconditional bswap +- dma-buf: Fix NULL pointer dereference in sanitycheck() +- bpf, arm64: fix bug in BPF_LDX_MEMSX +- s390/bpf: Fix bpf_plt pointer arithmetic +- scripts/bpf_doc: Use silent mode when exec make cmd +- drm/i915: Pre-populate the cursor physical dma address +- drm/i915/display: Use i915_gem_object_get_dma_address to get dma address +- Revert "workqueue.c: Increase workqueue name length" +- Revert "workqueue: Move pwq->max_active to wq->max_active" +- Revert "workqueue: Factor out pwq_is_empty()" +- Revert "workqueue: Replace pwq_activate_inactive_work() with [__]pwq_activate_work()" +- Revert "workqueue: Move nr_active handling into helpers" +- Revert "workqueue: Make wq_adjust_max_active() round-robin pwqs while activating" +- Revert "workqueue: Introduce struct wq_node_nr_active" +- Revert "workqueue: Shorten events_freezable_power_efficient name" +- drm/amdgpu: fix use-after-free bug +- tools/resolve_btfids: fix build with musl libc +- x86/sev: Skip ROM range scans and validation for SEV-SNP guests +- scsi: lpfc: Correct size for wqe for memset() +- scsi: lpfc: Correct size for cmdwqe/rspwqe for memset() +- usb: dwc3: pci: Drop duplicate ID +- Revert "x86/bugs: Use fixed addressing for VERW operand" +- x86/bugs: Use fixed addressing for VERW operand +- scsi: qla2xxx: Delay I/O Abort on PCI error +- scsi: qla2xxx: Change debug message during driver unload +- scsi: qla2xxx: Fix double free of fcport +- scsi: qla2xxx: Fix double free of the ha->vp_map pointer +- scsi: qla2xxx: Fix command flush on cable pull +- scsi: qla2xxx: NVME|FCP prefer flag not being honored +- scsi: qla2xxx: Update manufacturer detail +- scsi: qla2xxx: Split FCE|EFT trace control +- scsi: qla2xxx: Fix N2N stuck connection +- scsi: qla2xxx: Prevent command send on chip reset +- usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset +- usb: typec: ucsi_acpi: Refactor and fix DELL quirk +- usb: typec: ucsi: Ack unsupported commands +- usb: typec: ucsi: Clear EVENT_PENDING under PPM lock +- usb: typec: Return size of buffer if pd_set operation succeeds +- usb: udc: remove warning when queue disabled ep +- usb: dwc2: gadget: LPM flow fix +- usb: dwc2: gadget: Fix exiting from clock gating +- usb: dwc2: host: Fix ISOC flow in DDMA mode +- usb: dwc2: host: Fix hibernation flow +- usb: dwc2: host: Fix remote wakeup from hibernation +- USB: core: Fix deadlock in port "disable" sysfs attribute +- USB: core: Add hub_get() and hub_put() routines +- USB: core: Fix deadlock in usb_deauthorize_interface() +- usb: dwc3: Properly set system wakeup +- staging: vc04_services: fix information leak in create_component() +- staging: vc04_services: changen strncpy() to strscpy_pad() +- scsi: core: Fix unremoved procfs host directory regression +- scsi: sd: Fix TCG OPAL unlock on system resume +- vfio/pds: Make sure migration file isn't accessed after reset +- drm/amd/display: Clear OPTC mem select on disable +- drm/amd/display: Disconnect phantom pipe OPP from OPTC being disabled +- drm/amd/display: Fix hang/underflow when transitioning to ODM4:1 +- USB: UAS: return ENODEV when submit urbs fail with device not attached +- usb: cdc-wdm: close race between read and workqueue +- Revert "usb: phy: generic: Get the vbus supply" +- mtd: spinand: Add support for 5-byte IDs +- Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync +- drm/i915/gt: Reset queue_priority_hint on parking +- drm/i915: Do not match JSL in ehl_combo_pll_div_frac_wa_needed() +- drm/i915/dsi: Go back to the previous INIT_OTP/DISPLAY_ON order, mostly +- drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode() +- drm/i915/hwmon: Fix locking inversion in sysfs getter +- drm/amdgpu: fix deadlock while reading mqd from debugfs +- drm/amdkfd: fix TLB flush after unmap for GFX9.4.2 +- drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed +- net: ll_temac: platform_get_resource replaced by wrong function +- nouveau/dmem: handle kcalloc() allocation failure +- thermal: devfreq_cooling: Fix perf state when calculate dfc res_util +- block: Do not force full zone append completion in req_bio_endio() +- sdhci-of-dwcmshc: disable PM runtime in dwcmshc_remove() +- mmc: core: Avoid negative index with array access +- mmc: core: Initialize mmc_blk_ioc_data +- mmc: sdhci-omap: re-tuning is needed after a pm transition to support emmc HS200 mode +- selftests/mm: fix ARM related issue with fork after pthread_create +- selftests/mm: sigbus-wp test requires UFFD_FEATURE_WP_HUGETLBFS_SHMEM +- mm: cachestat: fix two shmem bugs +- hexagon: vmlinux.lds.S: handle attributes section +- exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack() +- Revert "drm/amd/display: Fix sending VSC (+ colorimetry) packets for DP/eDP displays without PSR" +- wifi: iwlwifi: fw: don't always use FW dump trig +- wifi: iwlwifi: mvm: disable MLO for the time being +- wifi: cfg80211: add a flag to disable wireless extensions +- wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes +- btrfs: zoned: use zone aware sb location for scrub +- btrfs: zoned: don't skip block groups with 100% zone unusable +- btrfs: fix race in read_extent_buffer_pages() +- tmpfs: fix race on handling dquot rbtree +- ARM: prctl: reject PR_SET_MDWE on pre-ARMv6 +- prctl: generalize PR_SET_MDWE support check to be per-arch +- x86/efistub: Reinstate soft limit for initrd loading +- x86/efistub: Add missing boot_params for mixed mode compat entry +- init: open /initrd.image with O_LARGEFILE +- ALSA: hda/tas2781: add locks to kcontrols +- ALSA: hda/tas2781: remove digital gain kcontrol +- perf top: Use evsel's cpus to replace user_requested_cpus +- selftests/mm: Fix build with _FORTIFY_SOURCE +- selftests/mm: gup_test: conform test to TAP format output +- pwm: img: fix pwm clock lookup +- efi: fix panic in kdump kernel +- x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD +- x86/mpparse: Register APIC address only once +- kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address +- irqchip/renesas-rzg2l: Prevent spurious interrupts when setting trigger type +- irqchip/renesas-rzg2l: Rename rzg2l_irq_eoi() +- irqchip/renesas-rzg2l: Rename rzg2l_tint_eoi() +- irqchip/renesas-rzg2l: Add macro to retrieve TITSR register offset based on register's index +- irqchip/renesas-rzg2l: Flush posted write in irq_eoi() +- irqchip/renesas-rzg2l: Implement restriction when writing ISCR register +- printk: Update @console_may_schedule in console_trylock_spinning() +- iommu/dma: Force swiotlb_max_mapping_size on an untrusted device +- swiotlb: Fix alignment checks when both allocation and DMA masks are present +- swiotlb: Honour dma_alloc_coherent() alignment in swiotlb_alloc() +- swiotlb: Fix double-allocation of slots due to broken alignment handling +- entry: Respect changes to system call number by trace_sys_enter() +- ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses +- ARM: 9352/1: iwmmxt: Remove support for PJ4/PJ4B cores +- clocksource/drivers/arm_global_timer: Fix maximum prescaler value +- x86/sev: Fix position dependent variable references in startup code +- x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT +- vfio/fsl-mc: Block calling interrupt handler without trigger +- vfio/platform: Create persistent IRQ handlers +- vfio/pci: Create persistent INTx handler +- vfio: Introduce interface to flush virqfd inject workqueue +- btrfs: fix deadlock with fiemap and extent locking +- xfs: remove conditional building of rt geometry validator functions +- xfs: reset XFS_ATTR_INCOMPLETE filter on node removal +- xfs: update dir3 leaf block metadata after swap +- xfs: ensure logflagsp is initialized in xfs_bmap_del_extent_real +- xfs: short circuit xfs_growfs_data_private() if delta is zero +- xfs: initialise di_crc in xfs_log_dinode +- xfs: add missing nrext64 inode flag check to scrub +- xfs: force all buffers to be written during btree bulk load +- xfs: fix an off-by-one error in xreap_agextent_binval +- xfs: recompute growfsrtfree transaction reservation while growing rt volume +- xfs: remove unused fields from struct xbtree_ifakeroot +- xfs: make xchk_iget safer in the presence of corrupt inode btrees +- xfs: don't allow overly small or large realtime volumes +- xfs: fix 32-bit truncation in xfs_compute_rextslog +- xfs: make rextslog computation consistent with mkfs +- xfs: transfer recovered intent item ownership in ->iop_recover +- xfs: pass the xfs_defer_pending object to iop_recover +- xfs: use xfs_defer_pending objects to recover intent items +- xfs: don't leak recovered attri intent items +- xfs: consider minlen sized extents in xfs_rtallocate_extent_block +- xfs: convert rt bitmap extent lengths to xfs_rtbxlen_t +- xfs: move the xfs_rtbitmap.c declarations to xfs_rtbitmap.h +- wifi: rtw88: 8821cu: Fix connection failure +- wifi: iwlwifi: pcie: fix RB status reading +- ASoC: amd: yc: Revert "Fix non-functional mic on Lenovo 21J2" +- x86/efistub: Call mixed mode boot services on the firmware's stack +- drm/amd/display: handle range offsets in VRR ranges +- drm/i915: Don't explode when the dig port we don't have an AUX CH +- iio: imu: inv_mpu6050: fix FIFO parsing when empty +- iio: imu: inv_mpu6050: fix frequency setting when chip is off +- i2c: i801: Avoid potential double call to gpiod_remove_lookup_table +- iio: accel: adxl367: fix I2C FIFO data register +- iio: accel: adxl367: fix DEVID read after reset +- arm64: dts: qcom: sc8280xp-x13s: limit pcie4 link speed +- mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations +- ARM: imx_v6_v7_defconfig: Restore CONFIG_BACKLIGHT_CLASS_DEVICE +- tee: optee: Fix kernel panic caused by incorrect error handling +- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook +- ALSA: hda/realtek - Add Headset Mic supported Acer NB platform +- fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion +- Revert "tty: serial: simplify qcom_geni_serial_send_chunk_fifo()" +- vt: fix unicode buffer corruption when deleting characters +- mei: me: add arrow lake point H DID +- mei: me: add arrow lake point S DID +- serial: port: Don't suspend if the port is still busy +- misc: fastrpc: Pass proper arguments to scm call +- misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume +- tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled +- xhci: Fix failure to detect ring expansion need. +- usb: port: Don't try to peer unused USB ports based on location +- usb: gadget: ncm: Fix handling of zero block length packets +- usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group +- USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command +- ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform +- drm/i915: Check before removing mm notifier +- tty: serial: imx: Fix broken RS485 +- drm/amdgpu/pm: Fix the error of pwm1_enable setting +- tracing: Use .flush() call to wake up readers +- SEV: disable SEV-ES DebugSwap by default +- KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() +- KVM: x86: Mark target gfn of emulated atomic instruction as dirty +- firewire: ohci: prevent leak of left-over IRQ on unbind +- init/Kconfig: lower GCC version check for -Warray-bounds +- Input: xpad - add additional HyperX Controller Identifiers +- cgroup/cpuset: Fix retval in update_cpumask() +- usb: typec: tpcm: Fix PORT_RESET behavior for self powered devices +- selftests: mptcp: diag: return KSFT_FAIL not test_cnt +- mm, mmap: fix vma_merge() case 7 with vma_ops->close +- xfrm: Avoid clang fortify warning in copy_to_user_tmpl() +- crypto: sun8i-ce - Fix use after free in unprepare +- crypto: rk3288 - Fix use after free in unprepare +- drm/nouveau: fix stale locked mutex in nouveau_gem_ioctl_pushbuf +- nouveau: lock the client object tree. +- Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory +- netfilter: nf_tables: reject constant set with timeout +- netfilter: nf_tables: disallow anonymous set with timeout flag +- netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout +- net: fix IPSTATS_MIB_OUTPKGS increment in OutForwDatagrams. +- drm/amd/display: Use freesync when `DRM_EDID_FEATURE_CONTINUOUS_FREQ` found +- workqueue: Shorten events_freezable_power_efficient name +- drm/bridge: lt8912b: do not return negative values from .get_modes() +- drm/bridge: lt8912b: clear the EDID property on failures +- drm/bridge: lt8912b: use drm_bridge_edid_read() +- drm/bridge: add ->edid_read hook and drm_bridge_edid_read() +- drm/ttm: Make sure the mapped tt pages are decrypted when needed +- wifi: brcmfmac: Demote vendor-specific attach/detach messages to info +- wifi: brcmfmac: cfg80211: Use WSEC to set SAE password +- wifi: brcmfmac: add per-vendor feature detection callback +- x86/pm: Work around false positive kmemleak report in msr_build_context() +- dm snapshot: fix lockup in dm_exception_table_exit +- drm/amd/display: Fix noise issue on HDMI AV mute +- drm/amd/display: Return the correct HDCP error code +- drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag +- ahci: asm1064: asm1166: don't limit reported ports +- ahci: asm1064: correct count of reported ports +- wireguard: selftests: set RISCV_ISA_FALLBACK on riscv{32,64} +- wireguard: netlink: access device through ctx instead of peer +- wireguard: netlink: check for dangling peer via is_dead instead of empty list +- LoongArch/crypto: Clean up useless assignment operations +- LoongArch: Define the __io_aw() hook as mmiowb() +- LoongArch: Change __my_cpu_offset definition to avoid mis-optimization +- virtio: reenable config if freezing device failed +- cxl/trace: Properly initialize cxl_poison region name +- net: hns3: tracing: fix hclgevf trace event strings +- drm/i915: Add missing ; to __assign_str() macros in tracepoint code +- NFSD: Fix nfsd_clid_class use of __string_len() macro +- net: esp: fix bad handling of pages from page_pool +- x86/CPU/AMD: Update the Zenbleed microcode revisions +- cpufreq: dt: always allocate zeroed cpumask +- mtd: rawnand: Constrain even more when continuous reads are enabled +- mtd: rawnand: Fix and simplify again the continuous read derivations +- cifs: open_cached_dir(): add FILE_READ_EA to desired access +- cifs: reduce warning log level for server not advertising interfaces +- cifs: make cifs_chan_update_iface() a void function +- cifs: delete unnecessary NULL checks in cifs_chan_update_iface() +- cifs: do not let cifs_chan_update_iface deallocate channels +- cifs: make sure server interfaces are requested only for SMB3+ +- cifs: add xid to query server interface call +- nilfs2: prevent kernel bug at submit_bh_wbc() +- nilfs2: fix failure to detect DAT corruption in btree and direct mappings +- f2fs: truncate page cache before clearing flags when aborting atomic write +- f2fs: mark inode dirty for FI_ATOMIC_COMMITTED flag +- Revert "block/mq-deadline: use correct way to throttling write requests" +- memtest: use {READ,WRITE}_ONCE in memory scanning +- drm/vc4: hdmi: do not return negative values from .get_modes() +- drm/imx/ipuv3: do not return negative values from .get_modes() +- drm/exynos: do not return negative values from .get_modes() +- drm/panel: do not return negative error codes from drm_panel_get_modes() +- drm/probe-helper: warn about negative .get_modes() +- s390/zcrypt: fix reference counting on zcrypt card objects +- soc: fsl: qbman: Use raw spinlock for cgr_lock +- soc: fsl: qbman: Always disable interrupts when taking cgr_lock +- dlm: fix user space lkb refcounting +- ring-buffer: Use wait_event_interruptible() in ring_buffer_wait() +- ring-buffer: Fix full_waiters_pending in poll +- ring-buffer: Fix resetting of shortest_full +- ring-buffer: Do not set shortest_full when full target is hit +- ring-buffer: Fix waking up ring buffer readers +- io_uring: clean rings on NO_MMAP alloc fail +- platform/x86/intel/tpmi: Change vsec offset to u64 +- ksmbd: retrieve number of blocks using vfs_getattr in set_file_allocation_info +- ksmbd: replace generic_fillattr with vfs_getattr +- server: convert to new timestamp accessors +- vfio/platform: Disable virqfds on cleanup +- vfio/pci: Lock external INTx masking ops +- vfio/pci: Disable auto-enable of exclusive INTx IRQ +- thermal/drivers/mediatek: Fix control buffer enablement on MT7896 +- cifs: allow changing password during remount +- cifs: prevent updating file size from server if we have a read/write lease +- smb: client: stop revalidating reparse points unnecessarily +- PCI: hv: Fix ring buffer size calculation +- PCI: dwc: endpoint: Fix advertised resizable BAR size +- PCI: qcom: Enable BDF to SID translation properly +- kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1 +- NFS: Read unlock folio on nfs_page_create_from_folio() error +- nfs: fix UAF in direct writes +- sparc32: Fix parport build with sparc32 +- io_uring: fix mshot io-wq checks +- io_uring/net: correctly handle multishot recvmsg retry setup +- PCI/AER: Block runtime suspend when handling errors +- speakup: Fix 8bit characters from direct synth +- usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic +- phy: tegra: xusb: Add API to retrieve the port number of phy +- slimbus: core: Remove usage of the deprecated ida_simple_xx() API +- nvmem: meson-efuse: fix function pointer type mismatch +- ext4: fix corruption during on-line resize +- hwmon: (amc6821) add of_match table +- landlock: Warn once if a Landlock action is requested while disabled +- drm/etnaviv: Restore some id values +- leds: trigger: netdev: Fix kernel panic on interface rename trig notify +- Bluetooth: btnxpuart: Fix btnxpuart_close +- mmc: core: Fix switch on gp3 partition +- mm: swap: fix race between free_swap_and_cache() and swapoff() +- mac802154: fix llsec key resources release in mac802154_llsec_key_del +- block: Fix page refcounts for unaligned buffers in __bio_release_pages() +- powerpc: xor_vmx: Add '-mhard-float' to CFLAGS +- dm-raid: fix lockdep waring in "pers->hot_add_disk" +- PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports +- PCI/PM: Drain runtime-idle callbacks before driver removal +- wifi: rtw88: Add missing VID/PIDs for 8811CU and 8821CU +- btrfs: fix off-by-one chunk length calculation at contains_pending_extent() +- btrfs: qgroup: always free reserved space for extent records +- serial: Lock console when calling into driver before registration +- serial: core: only stop transmit when HW fifo is empty +- usb: dwc3-am62: Disable wakeup at remove +- usb: dwc3-am62: fix module unload/reload behavior +- usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros +- fuse: don't unhash root +- fuse: fix root lookup with nonzero generation +- fuse: replace remaining make_bad_inode() with fuse_make_bad() +- mmc: tmio: avoid concurrent runs of mmc_request_done() +- PM: sleep: wakeirq: fix wake irq warning in system suspend +- USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M +- KVM: x86/xen: inject vCPU upcall vector when local APIC is enabled +- USB: serial: option: add MeiG Smart SLM320 product +- USB: serial: cp210x: add ID for MGP Instruments PDS100 +- USB: serial: add device ID for VeriFone adapter +- USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB +- powerpc/fsl: Fix mfpmr build errors with newer binutils +- usb: xhci: Add error handling in xhci_map_urb_for_dma +- clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays +- clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays +- clk: qcom: gcc-ipq9574: fix terminating of frequency table arrays +- clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays +- clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays +- clk: qcom: gcc-ipq5018: fix terminating of frequency table arrays +- vfio/pds: Always clear the save/restore FDs on reset +- PM: suspend: Set mem_sleep_current during kernel command line setup +- cpufreq: Limit resolving a frequency to policy min/max +- docs: Restore "smart quotes" for quotes +- iio: adc: rockchip_saradc: use mask for write_enable bitfield +- iio: adc: rockchip_saradc: fix bitmask for channels on SARADCv2 +- md/raid5: fix atomicity violation in raid5_cache_count +- parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds +- parisc: Fix csum_ipv6_magic on 64-bit systems +- parisc: Fix csum_ipv6_magic on 32-bit systems +- parisc: Fix ip_fast_csum +- parisc: Avoid clobbering the C/B bits in the PSW with tophys and tovirt macros +- parisc/unaligned: Rewrite 64-bit inline assembly of emulate_ldd() +- x86/nmi: Fix the inverse "in NMI handler" check +- md/md-bitmap: fix incorrect usage for sb_index +- mtd: rawnand: meson: fix scrambling mode value in command macro +- ubi: correct the calculation of fastmap size +- ubifs: Set page uptodate in the correct place +- fuse: fix VM_MAYSHARE and direct_io_allow_mmap +- fat: fix uninitialized field in nostale filehandles +- bounds: support non-power-of-two CONFIG_NR_CPUS +- kasan/test: avoid gcc warning for intentional overflow +- block: Clear zone limits for a non-zoned stacked queue +- ext4: correct best extent lstart adjustment logic +- selftests/mqueue: Set timeout to 180 seconds +- sparc: vDSO: fix return value of __setup handler +- sparc64: NMI watchdog: fix return value of __setup handler +- powerpc/smp: Increase nr_cpu_ids to include the boot CPU +- powerpc/smp: Adjust nr_cpu_ids to cover all threads of a core +- powercap: intel_rapl_tpmi: Fix System Domain probing +- powercap: intel_rapl_tpmi: Fix a register bug +- powercap: intel_rapl: Fix locking in TPMI RAPL +- sched: Simplify tg_set_cfs_bandwidth() +- powercap: intel_rapl: Fix a NULL pointer dereference +- thermal/intel: Fix intel_tcc_get_temp() to support negative CPU temperature +- cpufreq: amd-pstate: Fix min_perf assignment in amd_pstate_adjust_perf() +- arm64: dts: qcom: sm8550-mtp: correct WCD9385 TX port mapping +- arm64: dts: qcom: sm8550-qrd: correct WCD9385 TX port mapping +- KVM: Always flush async #PF workqueue when vCPU is being destroyed +- media: nxp: imx8-isi: Mark all crossbar sink pads as MUST_CONNECT +- media: mc: Expand MUST_CONNECT flag to always require an enabled link +- media: mc: Rename pad variable to clarify intent +- media: mc: Add num_links flag to media_pad +- media: nxp: imx8-isi: Check whether crossbar pad is non-NULL before access +- media: mc: Fix flags handling when creating pad links +- media: mc: Add local pad to pipeline regardless of the link state +- media: xc4000: Fix atomicity violation in xc4000_get_frequency +- pci_iounmap(): Fix MMIO mapping leak +- drm/vmwgfx: Fix the lifetime of the bo cursor memory +- serial: max310x: fix NULL pointer dereference in I2C instantiation +- drm/vmwgfx: Fix possible null pointer derefence with invalid contexts +- arm: dts: marvell: Fix maxium->maxim typo in brownstone dts +- smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity() +- smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr() +- clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd +- remoteproc: virtio: Fix wdg cannot recovery remote processor +- arm64: dts: qcom: sc7280: Add additional MSI interrupts +- media: staging: ipu3-imgu: Set fields before media_entity_pads_init() +- wifi: brcmfmac: avoid invalid list operation when vendor attach fails +- wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach +- drm/vmwgfx: Unmap the surface before resetting it on a plane state +- KVM: x86: Use a switch statement and macros in __feature_translate() +- KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace +- x86/efistub: Don't clear BSS twice in mixed mode +- x86/efistub: Clear decompressor BSS in native EFI entrypoint +- dm-integrity: align the outgoing bio in integrity_recheck +- dm io: Support IO priority +- selftests: forwarding: Fix ping failure due to short timeout +- spi: spi-mt65xx: Fix NULL pointer access in interrupt handler +- netfilter: nf_tables: Fix a memory leak in nf_tables_updchain +- net: dsa: mt7530: fix handling of all link-local frames +- net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports +- bpf: report RCU QS in cpumap kthread +- net: report RCU QS on threaded NAPI repolling +- rcu: add a helper to report consolidated flavor QS +- netfilter: nf_tables: do not compare internal table flags on updates +- netfilter: nft_set_pipapo: release elements in clone only from destroy path +- octeontx2-af: Use separate handlers for interrupts +- octeontx2-pf: Send UP messages to VF only when VF is up. +- octeontx2-pf: Use default max_active works instead of one +- octeontx2-pf: Wait till detach_resources msg is complete +- octeontx2: Detect the mbox up or down message via register +- devlink: fix port new reply cmd type +- net/bnx2x: Prevent access to a freed page in page_pool +- dm-integrity: fix a memory leak when rechecking the data +- net: phy: fix phy_read_poll_timeout argument type in genphy_loopback +- ceph: stop copying to iter at EOF on sync reads +- ipv4: raw: Fix sending packets from raw sockets via IPsec tunnels +- hsr: Handle failures in module init +- rds: introduce acquire/release ordering in acquire/release_in_xmit() +- wireguard: receive: annotate data-race around receiving_counter.counter +- virtio: packed: fix unmap leak for indirect desc table +- vdpa/mlx5: Allow CVQ size changes +- vdpa_sim: reset must not run +- drm: Fix drm_fixp2int_round() making it add 0.5 +- spi: spi-imx: fix off-by-one in mx51 CPU mode burst length +- net: dsa: mt7530: prevent possible incorrect XTAL frequency selection +- net: veth: do not manipulate GRO when using XDP +- xfrm: Allow UDP encapsulation only in offload modes +- packet: annotate data-races around ignore_outgoing +- xen/events: increment refcnt only if event channel is refcounted +- xen/evtchn: avoid WARN() when unbinding an event channel +- riscv: Fix compilation error with FAST_GUP and rv32 +- io_uring: fix poll_remove stalled req completion +- net: ethernet: mtk_eth_soc: fix PPE hanging issue +- net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is up +- nvme: fix reconnection fail due to reserved tag allocation +- net: txgbe: fix clk_name exceed MAX_DEV_ID limits +- hsr: Fix uninit-value access in hsr_get_node() +- vmxnet3: Fix missing reserved tailroom +- tcp: Fix refcnt handling in __inet_hash_connect(). +- io_uring: Fix release of pinned pages when __io_uaddr_map fails +- cpufreq: Fix per-policy boost behavior on SoCs using cpufreq_boost_set_sw() +- soc: fsl: dpio: fix kcalloc() argument order +- net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check +- s390/vtime: fix average steal time calculation +- octeontx2-af: Use matching wake_up API variant in CGX command interface +- rds: tcp: Fix use-after-free of net in reqsk_timer_handler(). +- tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() +- nouveau: reset the bo resource bus info after an eviction +- ASoC: rockchip: i2s-tdm: Fix inaccurate sampling rates +- spi: lpspi: Avoid potential use-after-free in probe() +- io_uring: don't save/restore iowait state +- thermal/drivers/qoriq: Fix getting tmu range +- thermal/drivers/mediatek/lvts_thermal: Fix a memory leak in an error handling path +- ASoC: tlv320adc3xxx: Don't strip remove function when driver is builtin +- x86/hyperv: Use per cpu initial stack for vtl context +- usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin +- staging: greybus: fix get_channel_from_mode() failure path +- serial: 8250_exar: Don't remove GPIO device on suspend +- rtc: mt6397: select IRQ_DOMAIN instead of depending on it +- bus: mhi: ep: check the correct variable in mhi_ep_register_controller() +- iio: gts-helper: Fix division loop +- kconfig: fix infinite loop when expanding a macro at the end of file +- coresight: etm4x: Set skip_power_up in etm4_init_arch_data function +- coresight: Fix issue where a source device's helpers aren't disabled +- arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells +- tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT +- serial: max310x: fix syntax error in IRQ error message +- tty: vt: fix 20 vs 0x20 typo in EScsiignore +- usb: phy: generic: Get the vbus supply +- iio: pressure: mprls0025pa fix off-by-one enum +- remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef +- remoteproc: stm32: Fix incorrect type in assignment for va +- mei: gsc_proxy: match component when GSC is on different bus +- comedi: comedi_test: Prevent timers rescheduling during deletion +- io_uring/net: correct the type of variable +- afs: Revert "afs: Hide silly-rename files from userspace" +- f2fs: zone: fix to remove pow2 check condition for zoned block device +- f2fs: compress: fix reserve_cblocks counting error when out of space +- f2fs: compress: relocate some judgments in f2fs_reserve_compress_blocks +- NFSv4.1/pnfs: fix NFS with TLS in pnfs +- NFS: Fix an off by one in root_nfs_cat() +- NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interrupt +- Input: iqs7222 - add support for IQS7222D v1.1 and v1.2 +- RDMA/mana_ib: Fix bug in creation of dma regions +- f2fs: ro: compress: fix to avoid caching unaligned extent +- f2fs: fix to use correct segment type in f2fs_allocate_data_block() +- watchdog: stm32_iwdg: initialize default timeout +- watchdog: starfive: Check pm_runtime_enabled() before decrementing usage counter +- f2fs: check number of blocks in a current section +- f2fs: compress: fix to check compress flag w/ .i_sem lock +- NFSv4.2: fix listxattr maximum XDR buffer size +- NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 +- net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr() +- f2fs: compress: fix to check zstd compress level correctly in mount option +- f2fs: fix to create selinux label during whiteout initialization +- scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn +- RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store() +- RDMA/device: Fix a race between mad_client and cm_client init +- i3c: dw: Disable IBI IRQ depends on hot-join and SIR enabling +- scsi: csiostor: Avoid function pointer casts +- f2fs: fix to avoid potential panic during recovery +- f2fs: compress: fix to cover f2fs_disable_compressed_file() w/ i_sem +- f2fs: zone: fix to wait completion of last bio in zone correctly +- f2fs: fix to remove unnecessary f2fs_bug_on() to avoid panic +- f2fs: compress: fix to avoid inconsistence bewteen i_blocks and dnode +- f2fs: update blkaddr in __set_data_blkaddr() for cleanup +- f2fs: introduce get_dnode_addr() to clean up codes +- f2fs: delete obsolete FI_DROP_CACHE +- f2fs: delete obsolete FI_FIRST_BLOCK_WRITTEN +- f2fs: compress: fix to check unreleased compressed cluster +- f2fs: compress: fix to cover normal cluster write with cp_rwsem +- f2fs: compress: fix to guarantee persisting compressed blocks by CP +- RDMA/srpt: Do not register event handler until srpt device is fully setup +- RDMA/irdma: Remove duplicate assignment +- ALSA: usb-audio: Stop parsing channels bits when all channels are found. +- ALSA: hda/tas2781: restore power state after system_resume +- ALSA: hda/tas2781: configure the amp after firmware load +- ALSA: hda/tas2781: do not call pm_runtime_force_* in system_resume/suspend +- ALSA: hda/tas2781: add ptrs to calibration functions +- ALSA: hda/tas2781: do not reset cur_* values in runtime_suspend +- ALSA: hda/tas2781: add lock to system_suspend +- ALSA: hda/tas2781: use dev_dbg in system_resume +- ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops +- cifs: Fix writeback data corruption +- cifs: Don't use certain unnecessary folio_*() functions +- smb: do not test the return value of folio_start_writeback() +- PCI: brcmstb: Fix broken brcm_pcie_mdio_write() polling +- clk: zynq: Prevent null pointer dereference caused by kmalloc failure +- clk: Fix clk_core_get NULL dereference +- sparc32: Fix section mismatch in leon_pci_grpci +- backlight: lp8788: Fully initialize backlight_properties during probe +- backlight: lm3639: Fully initialize backlight_properties during probe +- backlight: da9052: Fully initialize backlight_properties during probe +- backlight: lm3630a: Don't set bl->props.brightness in get_brightness +- backlight: lm3630a: Initialize backlight_properties on init +- backlight: ktz8866: Correct the check for of_property_read_u32 +- leds: sgm3140: Add missing timer cleanup and flash gpio control +- leds: aw2013: Unlock mutex before destroying it +- powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc. +- mfd: cs42l43: Fix wrong GPIO_FN_SEL and SPI_CLK_CONFIG1 defaults +- modules: wait do_free_init correctly +- drm/msm/dpu: add division of drm_display_mode's hskew parameter +- clk: qcom: gcc-ipq5018: fix register offset for GCC_UBI0_AXI_ARES reset +- clk: qcom: gcc-ipq5018: fix 'halt_reg' offset of 'gcc_pcie1_pipe_clk' +- clk: qcom: gcc-ipq5018: fix 'enable_reg' offset of 'gcc_gmac0_sys_clk' +- powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks +- powerpc/pseries: Fix potential memleak in papr_get_attr() +- mfd: cs42l43: Fix wrong register defaults +- drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip +- gpio: nomadik: fix offset bug in nmk_pmx_set() +- drm/amd/pm: Fix esm reg mask use to get pcie speed +- drm/tests: helpers: Include missing drm_drv header +- arm64: ftrace: Don't forbid CALL_OPS+CC_OPTIMIZE_FOR_SIZE with Clang +- media: mediatek: vcodec: avoid -Wcast-function-type-strict warning +- media: ttpci: fix two memleaks in budget_av_attach +- media: go7007: fix a memleak in go7007_load_encoder +- media: dvb-frontends: avoid stack overflow warnings with clang +- drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int() +- HID: amd_sfh: Avoid disabling the interrupt +- HID: amd_sfh: Update HPD sensor structure elements +- perf pmu: Fix a potential memory leak in perf_pmu__lookup() +- ASoC: meson: axg-tdm-interface: add frame rate constraint +- ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs +- mtd: rawnand: lpc32xx_mlc: fix irq handler prototype +- mtd: maps: physmap-core: fix flash size larger than 32-bit +- clk: imx: imx8mp: Fix SAI_MCLK_SEL definition +- drm/tidss: Fix sync-lost issue with two displays +- drm/tidss: Fix initial plane zpos values +- crypto: jitter - fix CRYPTO_JITTERENTROPY help text +- crypto: ccp - Avoid discarding errors in psp_send_platform_access_msg() +- crypto: arm/sha - fix function cast warnings +- perf print-events: make is_event_supported() more robust +- mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref +- mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref +- media: i2c: imx290: Fix IMX920 typo +- media: ivsc: csi: Swap SINK and SOURCE pads +- drm/tegra: put drm_gem_object ref on error in tegra_fb_create +- clk: mediatek: mt7981-topckgen: flag SGM_REG_SEL as critical +- clk: mediatek: mt8183: Correct parent of CLK_INFRA_SSPM_32K_SELF +- clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe() +- clk: mediatek: mt8135: Fix an error handling path in clk_mt8135_apmixed_probe() +- clk: hisilicon: hi3559a: Fix an erroneous devm_kfree() +- clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister() +- pinctrl: renesas: Allow the compiler to optimize away sh_pfc_pm +- PCI: Mark 3ware-9650SE Root Port Extended Tags as broken +- drm/mediatek: dsi: Fix DSI RGB666 formats and definitions +- drm/panel: boe-tv101wum-nl6: make use of prepare_prev_first +- drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()' +- clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times +- media: pvrusb2: fix pvr2_stream_callback casts +- media: pvrusb2: remove redundant NULL check +- media: go7007: add check of return value of go7007_read_addr() +- media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak +- media: sun8i-di: Fix chroma difference threshold +- media: sun8i-di: Fix power on/off sequences +- media: sun8i-di: Fix coefficient writes +- media: cedrus: h265: Fix configuring bitstream size +- NTB: fix possible name leak in ntb_register_device() +- drm: ci: use clk_ignore_unused for apq8016 +- ASoC: SOF: Add some bounds checking to firmware data +- powerpc: Force inlining of arch_vmap_p{u/m}d_supported() +- ASoC: meson: t9015: fix function pointer type mismatch +- ASoC: meson: aiu: fix function pointer type mismatch +- perf metric: Don't remove scale from counts +- perf stat: Avoid metric-only segv +- perf expr: Fix "has_event" function for metric style events +- ALSA: seq: fix function cast warnings +- clk: renesas: r8a779f0: Correct PFC/GPIO parent clock +- clk: renesas: r8a779g0: Correct PFC/GPIO parent clocks +- drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini() +- drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode() +- drm/msm/dpu: Only enable DSC_MODE_MULTIPLEX if dsc_merge is enabled +- drm/msm/dpu: fix the programming of INTF_CFG2_DATA_HCTL_EN +- dt-bindings: msm: qcom, mdss: Include ommited fam-b compatible +- perf srcline: Add missed addr2line closes +- perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str() +- drivers/ps3: select VIDEO to provide cmdline functions +- crypto: xilinx - call finalize with bh disabled +- PCI: switchtec: Fix an error handling path in switchtec_pci_probe() +- PCI/P2PDMA: Fix a sleeping issue in a RCU read section +- quota: Properly annotate i_dquot arrays with __rcu +- quota: Fix rcu annotations of inode dquot pointers +- clk: qcom: reset: Ensure write completion on reset de/assertion +- clk: qcom: reset: Commonize the de/assert functions +- drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' +- pinctrl: mediatek: Drop bogus slew rate register range for MT8192 +- pinctrl: mediatek: Drop bogus slew rate register range for MT8186 +- media: edia: dvbdev: fix a use-after-free +- mtd: spinand: esmt: Extend IDs to 5 bytes +- media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity +- media: v4l2-tpg: fix some memleaks in tpg_alloc +- media: em28xx: annotate unchecked call to media_device_register() +- clk: meson: Add missing clocks to axg_clk_regmaps +- perf bpf: Clean up the generated/copied vmlinux.h +- perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample() +- media: v4l2: cci: print leading 0 on error +- clk: samsung: exynos850: Propagate SPI IPCLK rate change +- pinctrl: renesas: r8a779g0: Add missing SCIF_CLK2 pin group/function +- drm/vmwgfx: Fix vmw_du_get_cursor_mob fencing of newly-created MOBs +- ASoC: sh: rz-ssi: Fix error message print +- drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()' +- perf pmu: Treat the msr pmu as software +- drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()' +- HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd +- perf record: Check conflict between '--timestamp-filename' option and pipe mode before recording +- perf top: Uniform the event name for the hybrid machine +- perf record: Fix possible incorrect free in record__switch_output() +- PCI/DPC: Print all TLP Prefixes, not just the first +- media: cadence: csi2rx: use match fwnode for media link +- media: tc358743: register v4l2 async device only after successful setup +- dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA +- ASoC: SOF: amd: Fix memory leak in amd_sof_acp_probe() +- ASoC: amd: acp: Add missing error handling in sof-mach +- drm/lima: fix a memleak in lima_heap_alloc +- drm/panel-edp: use put_sync in unprepare +- drm/rockchip: lvds: do not print scary message when probing defer +- drm/rockchip: lvds: do not overwrite error code +- drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node +- drm/vkms: Avoid reading beyond LUT array +- drm: Don't treat 0 as -1 in drm_fixp2int_ceil +- drm/rockchip: inno_hdmi: Fix video timing +- drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe() +- drm/tegra: rgb: Fix missing clk_put() in the error handling paths of tegra_dc_rgb_probe() +- drm/tegra: rgb: Fix some error handling paths in tegra_dc_rgb_probe() +- drm/tegra: hdmi: Fix some error handling paths in tegra_hdmi_probe() +- drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe() +- drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe() +- drm/tegra: dpaux: Fix PM disable depth imbalance in tegra_dpaux_probe +- drm/tegra: dsi: Add missing check for of_find_device_by_node +- dm: call the resume method on internal suspend +- dm raid: fix false positive for requeue needed during reshape +- bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes() +- nfp: flower: handle acti_netdevs allocation failure +- net/x25: fix incorrect parameter validation in the x25_getsockopt() function +- net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function +- udp: fix incorrect parameter validation in the udp_lib_getsockopt() function +- l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function +- ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function +- tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function +- OPP: debugfs: Fix warning around icc_get_name() +- erofs: fix lockdep false positives on initializing erofs_pseudo_mnt +- net: phy: dp83822: Fix RGMII TX delay configuration +- Bluetooth: Fix eir name length +- net: phy: fix phy_get_internal_delay accessing an empty array +- net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() +- ipv6: fib6_rules: flush route cache when rule is changed +- iommu: Fix compilation without CONFIG_IOMMU_INTEL +- bpf: Fix stackmap overflow check on 32-bit arches +- bpf: Fix hashtab overflow check on 32-bit arches +- bpf: Fix DEVMAP_HASH overflow check on 32-bit arches +- s390/cache: prevent rebuild of shared_cpu_list +- Bluetooth: fix use-after-free in accessing skb after sending it +- Bluetooth: af_bluetooth: Fix deadlock +- Bluetooth: btusb: Fix memory leak +- Bluetooth: msft: Fix memory leak +- Bluetooth: msft: __hci_cmd_sync() doesn't return NULL +- Bluetooth: hci_core: Fix possible buffer overflow +- Bluetooth: btrtl: fix out of bounds memory access +- Bluetooth: hci_h5: Add ability to allocate memory for private data +- Bluetooth: hci_sync: Fix overwriting request callback +- Bluetooth: hci_core: Cancel request on command timeout +- Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with gpiod_get_optional() +- Bluetooth: hci_event: Fix not indicating new connection for BIG Sync +- Bluetooth: Remove BT_HS +- Bluetooth: Remove superfluous call to hci_conn_check_pending() +- Bluetooth: mgmt: Remove leftover queuing of power_off work +- Bluetooth: Remove HCI_POWER_OFF_TIMEOUT +- ice: fix stats being updated by way too large values +- igb: Fix missing time sync events +- igc: Fix missing time sync events +- iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected +- PCI: Make pci_dev_is_disconnected() helper public for other drivers +- wifi: brcm80211: handle pmk_op allocation failure +- wifi: rtw88: 8821c: Fix false alarm count +- wifi: rtw88: 8821c: Fix beacon loss and disconnect +- wifi: rtw88: 8821cu: Fix firmware upload fail +- ACPI: CPPC: enable AMD CPPC V2 support for family 17h processors +- mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function +- arm64: dts: qcom: sm8550: Fix SPMI channels size +- SUNRPC: fix some memleaks in gssx_dec_option_array +- SUNRPC: fix a memleak in gss_import_v2_context +- x86, relocs: Ignore relocations in .notes section +- objtool: Fix UNWIND_HINT_{SAVE,RESTORE} across basic blocks +- arm64: dts: rockchip: drop rockchip,trcm-sync-tx-only from rk3588 i2s +- arm64: dts: rockchip: fix reset-names for rk356x i2s2 controller +- arm64: dts: rockchip: add missing interrupt-names for rk356x vdpu +- ACPI: scan: Fix device check notification handling +- ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override +- ACPI: resource: Do IRQ override on Lunnen Ground laptops +- ACPI: resource: Add Infinity laptops to irq1_edge_low_force_override +- arm64: dts: marvell: reorder crypto interrupts on Armada SoCs +- gpiolib: Pass consumer device through to core in devm_fwnode_gpiod_get_index() +- regulator: userspace-consumer: add module device table +- arm64: dts: imx8mp-evk: Fix hdmi@3d node +- arm64: dts: imx8mp: Set SPI NOR to max 40 MHz on Data Modul i.MX8M Plus eDM SBC +- ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node +- ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address +- arm64: dts: allwinner: h6: Add RX DMA channel for SPDIF +- pstore: inode: Only d_invalidate() is needed +- pstore: inode: Convert mutex usage to guard(mutex) +- net: mctp: copy skb ext data when fragmenting +- arm64: dts: renesas: r8a779g0: Correct avb[01] reg sizes +- arm64: dts: renesas: r8a779a0: Correct avb[01] reg sizes +- arm64: dts: renesas: rzg2l: Add missing interrupts to IRQC nodes +- wifi: mt76: mt792x: fix a potential loading failure of the 6Ghz channel config from ACPI +- wifi: mt76: mt7921e: fix use-after-free in free_irq() +- wifi: mt76: mt792x: fix ethtool warning +- wifi: mt76: mt7996: fix HIF_TXD_V2_1 value +- wifi: mt76: mt7996: fix efuse reading issue +- wifi: mt76: mt7996: fix HE beamformer phy cap for station vif +- wifi: mt76: mt7996: fix incorrect interpretation of EHT MCS caps +- wifi: mt76: mt7996: fix TWT issues +- memory: tegra: Correct DLA client names +- ARM: dts: arm: realview: Fix development chip ROM compatible value +- wifi: wilc1000: revert reset line logic flip +- arm64: dts: ti: k3-am62p: Fix memory ranges for DMSS +- firmware: arm_scmi: Fix double free in SMC transport cleanup path +- arm64: dts: ti: Add common1 register space for AM62x SoC +- arm64: dts: ti: Add common1 register space for AM65x SoC +- arm64: dts: mt8195-cherry-tomato: change watchdog reset boot flow +- arm64: dts: ti: k3-am64-main: Fix ITAP/OTAP values for MMC +- arm64: dts: ti: k3-am64: Enable SDHCI nodes at the board level +- arm64: dts: ti: k3-am642-sk: Add boot phase tags marking +- arm64: dts: ti: k3-am642-evm: Add boot phase tags marking +- arm64: dts: ti: k3-j784s4-evm: Remove Pinmux for CTS and RTS in wkup_uart0 +- arm64: dts: ti: k3-j721s2-common-proc-board: Remove Pinmux for CTS and RTS in wkup_uart0 +- arm64: dts: ti: k3-j7200-common-proc-board: Remove clock-frequency from mcu_uart0 +- arm64: dts: ti: k3-j7200-common-proc-board: Modify Pinmux for wkup_uart0 and mcu_uart0 +- net: ena: Remove ena_select_queue +- powercap: dtpm_cpu: Fix error check against freq_qos_add_request() +- arm64: dts: qcom: sm8150: correct PCIe wake-gpios +- arm64: dts: qcom: sm8150: use 'gpios' suffix for PCI GPIOs +- arm64: dts: qcom: sdm845-db845c: correct PCIe wake-gpios +- wifi: brcmsmac: avoid function pointer casts +- iommu/amd: Mark interrupt as managed +- bus: tegra-aconnect: Update dependency to ARCH_TEGRA +- arm64: dts: ti: k3-am62-main: disable usb lpm +- wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces +- cpufreq: qcom-hw: add CONFIG_COMMON_CLK dependency +- arm64: dts: mediatek: mt8186: Add missing xhci clock to usb controllers +- arm64: dts: mediatek: mt8186: Add missing clocks to ssusb power domains +- ARM: dts: qcom: msm8974: correct qfprom node size +- soc: qcom: llcc: Check return value on Broadcast_OR reg read +- arm64: dts: qcom: sdm845: Use the Low Power Island CX/MX for SLPI +- bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly +- wifi: iwlwifi: mvm: Fix the listener MAC filter flags +- can: m_can: Start/Cancel polling timer together with interrupts +- arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes +- arm64: dts: mediatek: mt8186: fix VENC power domain clocks +- arm64: dts: mediatek: mt8192: fix vencoder clock name +- arm64: dts: mediatek: mt8192-asurada: Remove CrosEC base detection node +- arm64: dts: mediatek: mt7986: add "#reset-cells" to infracfg +- arm64: dts: mediatek: mt7986: drop "#clock-cells" from PWM +- arm64: dts: mediatek: mt7986: fix SPI nodename +- arm64: dts: mediatek: mt7986: fix SPI bus width properties +- arm64: dts: mediatek: mt7986: drop crypto's unneeded/invalid clock name +- arm64: dts: mediatek: mt7986: fix reference to PWM in fan node +- arm64: dts: mt8183: Move CrosEC base detection node to kukui-based DTs +- ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down() +- selftests: forwarding: Add missing multicast routing config entries +- selftests: forwarding: Add missing config entries +- s390/vdso: drop '-fPIC' from LDFLAGS +- s390/pai: fix attr_event_free upper limit for pai device drivers +- wifi: iwlwifi: mvm: don't set replay counters to 0xff +- wifi: iwlwifi: mvm: don't set the MFP flag for the GTK +- wifi: iwlwifi: mvm: fix erroneous queue index mask +- wifi: iwlwifi: support EHT for WH +- tools/resolve_btfids: Fix cross-compilation to non-host endianness +- tools/resolve_btfids: Refactor set sorting with types from btf_ids.h +- pwm: sti: Fix capture for st,pwm-num-chan < st,capture-num-chan +- printk: Disable passing console lock owner completely during panic() +- wifi: ath12k: fix incorrect logic of calculating vdev_stats_id +- arm64: dts: qcom: sm6115: declare VLS CLAMP register for USB3 PHY +- arm64: dts: qcom: qcm2290: declare VLS CLAMP register for USB3 PHY +- wifi: wfx: fix memory leak when starting AP +- libbpf: Use OPTS_SET() macro in bpf_xdp_query() +- wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() +- wifi: ath11k: initialize rx_mcs_80 and rx_mcs_160 before use +- arm64: dts: ti: k3-j784s4: Fix power domain for VTM node +- arm64: dts: ti: k3-j721s2: Fix power domain for VTM node +- net: blackhole_dev: fix build warning for ethh set but not used +- pwm: atmel-hlcdc: Fix clock imbalance related to suspend support +- arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS +- gpio: vf610: allow disabling the vf610 driver +- wifi: iwlwifi: read BIOS PNVM only for non-Intel SKU +- wifi: iwlwifi: mvm: fix the TLC command after ADD_STA +- wifi: iwlwifi: mvm: d3: fix IPN byte order +- wifi: iwlwifi: fix EWRD table validity check +- wifi: iwlwifi: mvm: initialize rates in FW earlier +- wifi: iwlwifi: acpi: fix WPFC reading +- wifi: iwlwifi: dbg-tlv: ensure NUL termination +- wifi: iwlwifi: mvm: report beacon protection failures +- wifi: ath12k: fix fetching MCBC flag for QCN9274 +- wifi: ath12k: Update Qualcomm Innovation Center, Inc. copyrights +- wifi: ath11k: change to move WMI_VDEV_PARAM_SET_HEMU_MODE before WMI_PEER_ASSOC_CMDID +- wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete +- libbpf: Add missing LIBBPF_API annotation to libbpf_set_memlock_rlim API +- arm64: dts: imx8mm-kontron: Fix interrupt for RTC on OSM-S i.MX8MM module +- arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL board +- arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL OSM-S board +- arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL board +- arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL OSM-S board +- arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on SL/BL i.MX8MM +- arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on OSM-S i.MX8MM +- selftests/bpf: Disable IPv6 for lwt_redirect test +- arm64: dts: renesas: r8a779g0: Add missing SCIF_CLK2 +- arm64: dts: renesas: r8a779g0: Restore sort order +- arm64: dts: qcom: sa8540p: Drop gfx.lvl as power-domain for gpucc +- pmdomain: qcom: rpmhpd: Drop SA8540P gfx.lvl +- libbpf: Fix faccessat() usage on Android +- cpufreq: mediatek-hw: Don't error out if supply is not found +- arm64: dts: qcom: sdm845-oneplus-common: improve DAI node naming +- soc: qcom: socinfo: rename PM2250 to PM4125 +- arm64: dts: qcom: sm8450: Add missing interconnects to serial +- af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc(). +- selftests/bpf: Wait for the netstamp_needed_key static key to be turned on +- selftests/bpf: Fix the flaky tc_redirect_dtime test +- selftests/bpf: Add netkit to tc_redirect selftest +- selftests/bpf: De-veth-ize the tc_redirect test case +- wifi: ath12k: Fix issues in channel list update +- selftest/bpf: Add map_in_maps with BPF_MAP_TYPE_PERF_EVENT_ARRAY values +- libbpf: Apply map_set_def_max_entries() for inner_maps on creation +- selftests/bpf: Fix potential premature unload in bpf_testmod +- bpftool: Silence build warning about calloc() +- inet_diag: annotate data-races around inet_diag_table[] +- sock_diag: annotate data-races around sock_diag_handlers[family] +- cpufreq: mediatek-hw: Wait for CPU supplies before probing +- cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value +- arm64: dts: qcom: sc8180x: Shrink aoss_qmp register space size +- arm64: dts: qcom: sc8180x: Require LOW_SVS vote for MMCX if DISPCC is on +- arm64: dts: qcom: sc8180x: Don't hold MDP core clock at FMAX +- arm64: dts: qcom: sc8180x: Fix eDP PHY power-domains +- arm64: dts: qcom: sc8180x: Add missing CPU off state +- arm64: dts: qcom: sc8180x: Fix up big CPU idle state entry latency +- arm64: dts: qcom: sc8180x: Hook up VDD_CX as GCC parent domain +- ARM: dts: renesas: r8a73a4: Fix external clocks and clock rate +- wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir() +- wifi: wilc1000: fix multi-vif management when deleting a vif +- wifi: wilc1000: do not realloc workqueue everytime an interface is added +- wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work +- wifi: wilc1000: fix RCU usage in connect path +- wifi: wilc1000: fix declarations ordering +- wifi: b43: Disable QoS for bcm4331 +- wifi: b43: Stop correct queue in DMA worker when QoS is disabled +- wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled +- wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled +- wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() +- timekeeping: Fix cross-timestamp interpolation for non-x86 +- timekeeping: Fix cross-timestamp interpolation corner case decision +- timekeeping: Fix cross-timestamp interpolation on counter wrap +- x86/sme: Fix memory encryption setting if enabled by default and not overridden +- x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type +- aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts +- io_uring/net: fix overflow check in io_recvmsg_mshot_prep() +- io_uring/net: move receive multishot out of the generic msghdr path +- io_uring/net: unify how recvmsg and sendmsg copy in the msghdr +- rtc: test: Fix invalid format specifier. +- time: test: Fix incorrect format specifier +- lib: memcpy_kunit: Fix an invalid format specifier in an assertion msg +- lib/cmdline: Fix an invalid format specifier in an assertion msg +- kunit: test: Log the correct filter string in executor_test +- ovl: Always reject mounting over case-insensitive directories +- ovl: add support for appending lowerdirs one by one +- ovl: refactor layer parsing helpers +- ovl: store and show the user provided lowerdir mount option +- ovl: remove unused code in lowerdir param parsing +- md: Don't clear MD_CLOSING when the raid is about to stop +- fs/select: rework stack allocation hack for clang +- rcu/exp: Handle RCU expedited grace period kworker allocation failure +- rcu/exp: Fix RCU expedited parallel grace period kworker allocation failure recovery +- s390/dasd: fix double module refcount decrement +- s390/dasd: Use dev_*() for device log messages +- io_uring: remove unconditional looping in local task_work handling +- io_uring: remove looping around handling traditional task_work +- fs: Fix rw_hint validation +- workqueue: Introduce struct wq_node_nr_active +- workqueue: Make wq_adjust_max_active() round-robin pwqs while activating +- workqueue: Move nr_active handling into helpers +- workqueue: Replace pwq_activate_inactive_work() with [__]pwq_activate_work() +- workqueue: Factor out pwq_is_empty() +- workqueue: Move pwq->max_active to wq->max_active +- workqueue.c: Increase workqueue name length +- ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll +- ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode +- ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC +- Input: gpio_keys_polled - suppress deferred probe error for gpio +- xfrm: set skb control buffer based on packet offload as well +- xfrm: fix xfrm child route lookup for packet offload +- ASoC: amd: yc: Add HP Pavilion Aero Laptop 13-be2xxx(8BD6) into DMI quirk table +- x86/hyperv: Allow 15-bit APIC IDs for VTL platforms +- ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet +- arm64: tegra: Set the correct PHY mode for MGBE +- perf: RISCV: Fix panic on pmu overflow handler +- firewire: core: use long bus reset on gap count error +- Bluetooth: mgmt: Fix limited discoverable off timeout +- ASoC: amd: yc: Fix non-functional mic on Lenovo 21J2 +- drm/amdgpu: Enable gpu reset for S3 abort cases on Raven series +- ALSA: hda/realtek - ALC285 reduce pop noise from Headphone port +- scsi: mpt3sas: Prevent sending diag_reset when the controller is ready +- ASoC: amd: yc: Add Lenovo ThinkBook 21J0 into DMI quirk table +- drm/ttm/tests: depend on UML || COMPILE_TEST +- wifi: mac80211: only call drv_sta_rc_update for uploaded stations +- net: smsc95xx: add support for SYS TEC USB-SPEmodule1 +- regulator: max5970: Fix regulator child node name +- ARM: dts: renesas: rcar-gen2: Add missing #interrupt-cells to DA9063 nodes +- arm64: dts: qcom: Fix interrupt-map cell sizes +- arm: dts: Fix dtc interrupt_map warnings +- arm64: dts: Fix dtc interrupt_provider warnings +- arm: dts: Fix dtc interrupt_provider warnings +- dm-verity, dm-crypt: align "struct bvec_iter" correctly +- platform/x86: x86-android-tablets: Fix acer_b1_750_goodix_gpios name +- perf: CXL: fix CPMU filter value mask length +- cxl/region: Allow out of order assembly of autodiscovered regions +- cxl/region: Handle endpoint decoders in cxl_region_find_decoder() +- block: sed-opal: handle empty atoms when parsing response +- parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check +- net/iucv: fix the allocation size of iucv_path_table array +- x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() +- x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h +- riscv: dts: sifive: add missing #interrupt-cells to pmic +- ARM: dts: rockchip: Drop interrupts property from pwm-rockchip nodes +- RDMA/mlx5: Relax DEVX access upon modify commands +- RDMA/mlx5: Fix fortify source warning while accessing Eth segment +- arm64: dts: rockchip: mark system power controller on rk3588-evb1 +- soc: microchip: Fix POLARFIRE_SOC_SYS_CTRL input prompt +- arm64/sve: Lower the maximum allocation for the SVE ptrace regset +- gen_compile_commands: fix invalid escape sequence warning +- ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend +- HID: multitouch: Add required quirk for Synaptics 0xcddc device +- MIPS: Clear Cause.BD in instruction_pointer_set +- x86/xen: Add some null pointer checking to smp.c +- ASoC: amd: yc: Fix non-functional mic on Lenovo 82UU +- regmap: kunit: Ensure that changed bytes are actually different +- spi: intel-pci: Add support for Lunar Lake-M SPI serial flash +- ASoC: rt5645: Make LattePanda board DMI match more precise +- selftests: tls: use exact comparison in recv_partial +- selftests: openvswitch: Add validation for the recursion test +- perf/arm-cmn: Workaround AmpereOneX errata AC04_MESH_1 (incorrect child count) +- wifi: iwlwifi: mvm: use correct address 3 in A-MSDU +- ASoC: cs42l43: Handle error from devm_pm_runtime_enable +- media: rkisp1: Fix IRQ handling due to shared interrupts +- soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free +- io_uring: drop any code related to SCM_RIGHTS +- io_uring/unix: drop usage of io_uring socket +- platform/x86: p2sb: On Goldmont only cache P2SB and SPI devfn BAR +- !6730 quota: Fix potential NULL pointer dereference +- quota: Fix potential NULL pointer dereference +- !6782 i2c: hisi: Add I2C controller reset and initialization proccess in bus recovery action +- i2c: hisi: Correct the description comment for PIN_MUX METHOD +- i2c: hisi: Add I2C controller reset and initialization proccess in bus recovery action +- !6760 spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs +- spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs +- !3176 [OLK-6.6] Turning off Zhaoxin ahci controller runtime pm +- Turning off Zhaoxin ahci controller runtime pm +- !6403 iommu/arm-smmu-v3: fix using uninitialized or unchecked symbol +- iommu/arm-smmu-v3: fix using uninitialized or unchecked symbol +- !6479 do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak +- do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak +- !6005 [OLK-6.6]Add Yunsilicon eth driver and rdma driver +- drivers: support for xsc drivers from Yunsilicon Technology +- !6595 A Solution to Re-enable hugetlb vmemmap optimize on ARM64 +- arm64: update openeuler_defconfig for HVO enable +- arm64: mm: Re-enable OPTIMIZE_HUGETLB_VMEMMAP +- arm64: mm: HVO: support BBM of vmemmap pgtable safely +- mm: HVO: introduce helper function to update and flush pgtable +- !6731 [OLK-6.6] watchdog: Fix call trace when failed to initialize sdei +- watchdog: Fix call trace when failed to initialize sdei +- !6651 [OLK - 6.6]net: hns3: add support for Hisilicon ptp sync device +- net: hns3: add support for Hisilicon ptp sync device +- !6385 ipvlan: Fix warning while IPVLAN_L2E disabled +- ipvlan: Fix warning while IPVLAN_L2E disabled +- !6409 [OLK-6.6] irqchip: gic-v3: Collection table support muti pages +- irqchip: gic-v3: Collection table support muti pages +- !6735 v2 SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP +- SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP +- !6590 v6 Introduce BPF_READAHEAD option for optimizing read performance +- arch: Add BPF_READAHEAD config options for supported architectures +- mm, fs: Add BPF_READAHEAD build option for bpf readhead +- !6681 v2 btrfs: fix data races when accessing the reserved amount of block reserves +- btrfs: fix data races when accessing the reserved amount of block reserves + +* Sun Apr 28 2024 ZhangPeng - 6.6.0-23.0.0.26 +- !6306 【OLK-6.6】fix compiling problem in bzwx N5/N6 series NIC drivers +- drivers: fix compiling problem in bzwx N5/N6 series NIC drivers +- !6692 ipvlan: enable CONFIG_IPVLAN_L2E option in openeuler config +- ipvlan: enable CONFIG_IPVLAN_L2E option in openeuler config +- !6632 ext4: use iomap for regular file's buffered IO path and enable large foilo +- ext4: add mount option for buffered IO iomap path +- ext4: don't mark IOMAP_F_DIRTY for buffer write +- ext4: enable large folio for regular file with iomap buffered IO path +- filemap: support disable large folios on active inode +- ext4: partial enable iomap for regular file's buffered IO path +- ext4: fall back to buffer_head path for defrag +- ext4: writeback partial blocks before zeroing out range +- ext4: implement zero_range iomap path +- ext4: implement mmap iomap path +- ext4: implement writeback iomap path +- ext4: implement buffered write iomap path +- ext4: implement buffered read iomap path +- ext4: add a new iomap aops for regular file's buffered IO path +- ext4: introduce seq counter for the extent status entry +- ext4: factor out ext4_map_create_blocks() to allocate new blocks +- ext4: use reserved metadata blocks when splitting extent on endio +- ext4: make ext4_da_map_blocks() buffer_head unaware +- ext4: make ext4_insert_delayed_block() insert multi-blocks +- ext4: factor out check for whether a cluster is allocated +- ext4: make ext4_da_reserve_space() reserve multi-clusters +- ext4: make ext4_es_insert_delayed_block() insert multi-blocks +- ext4: drop iblock parameter +- ext4: trim delalloc extent +- ext4: check the extent status again before inserting delalloc block +- ext4: factor out a common helper to query extent map +- ext4: make ext4_set_iomap() recognize IOMAP_DELALLOC map type +- ext4: make ext4_map_blocks() distinguish delalloc only extent +- ext4: add a hole extent entry in cache after punch +- ext4: convert to exclusive lock while inserting delalloc extents +- ext4: refactor ext4_da_map_blocks() +- iomap: do some small logical cleanup in buffered write +- iomap: make iomap_write_end() return a boolean +- iomap: use a new variable to handle the written bytes in iomap_write_iter() +- iomap: don't increase i_size if it's not a write operation +- iomap: drop the write failure handles when unsharing and zeroing +- xfs: convert delayed extents to unwritten when zeroing post eof blocks +- xfs: make xfs_bmapi_convert_delalloc() to allocate the target offset +- xfs: make the seq argument to xfs_bmapi_convert_delalloc() optional +- xfs: match lock mode in xfs_buffered_write_iomap_begin() +- iomap: add pos and dirty_len into trace_iomap_writepage_map +- iomap: pass the length of the dirty region to ->map_blocks +- iomap: map multiple blocks at a time +- iomap: submit ioends immediately +- iomap: factor out a iomap_writepage_map_block helper +- iomap: only call mapping_set_error once for each failed bio +- iomap: don't chain bios +- iomap: move the iomap_sector sector calculation out of iomap_add_to_ioend +- iomap: clean up the iomap_alloc_ioend calling convention +- iomap: move all remaining per-folio logic into iomap_writepage_map +- iomap: factor out a iomap_writepage_handle_eof helper +- iomap: move the PF_MEMALLOC check to iomap_writepages +- iomap: move the io_folios field out of struct iomap_ioend +- iomap: treat inline data in iomap_writepage_map as an I/O error +- iomap: clear the per-folio dirty bits on all writeback failures +- !6625 v2 perf data convert: Fix segfault when converting to json when cpu_desc isn't set +- perf data convert: Fix segfault when converting to json when cpu_desc isn't set +- !6647 infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver +- infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver +- net/ethernet/huawei/hinic3: Add the CQM on which the RDMA depends +- !6624 hisi-acc-vfio-pci:add DFX for acc migration driver +- hisi_acc_vfio_pci: add exception error handling +- hisi-acc-vfio-pci:add DFX for acc migration driver +- !6658 sched: disable sched_autogroup by default +- sched: disable sched_autogroup by default +- !6626 Backport page fault and fork optimization +- mm: swapfile: check usable swap device in __folio_throttle_swaprate() +- mm/filemap: optimize filemap folio adding +- lib/xarray: introduce a new helper xas_get_order +- lib/xarray: introduce a new helper xas_get_order +- mm/filemap: clean up hugetlb exclusion code +- mm/filemap: return early if failed to allocate memory for split +- mm: memory: check userfaultfd_wp() in vmf_orig_pte_uffd_wp() +- !6179 crypto: hisilicon - fixed some code security review issues +- crypto: hisilicon/debugfs - Resolve the problem of applying for redundant space in sq dump +- crypto: hisilicon/sec - Fix memory leak for sec resource release +- crypto: hisilicon - Adjust debugfs creation and release order +- crypto: hisilicon/qm - Add the default processing branch +- crypto: hisilicon/debugfs - Fix the processing logic issue in the debugfs creation +- crypto: hisilicon/sgl - Delete redundant parameter verification +- crypto: hisilicon/debugfs - Fix debugfs uninit process issue +- crypto: hisilicon/sec - Add the condition for configuring the sriov function +- crypto: hisilicon/zip - fix the missing CRYPTO_ALG_ASYNC in cra_flags +- !6400 btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve +- btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve +- !6444 Fix CVE-2024-26869 +- f2fs: fix to truncate meta inode pages forcely +- f2fs: introduce f2fs_invalidate_internal_cache() for cleanup +- !6585 ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() +- ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() +- !6251 ubi: Check for too small LEB size in VTBL code +- ubi: Check for too small LEB size in VTBL code +- !6418 media: pvrusb2: fix uaf in pvr2_context_set_notify +- media: pvrusb2: fix uaf in pvr2_context_set_notify + +* Wed Apr 24 2024 Zheng Zengkai - 6.6.0-22.0.0.25 +- !6467 RDMA/hns: Some bugfixes and cleanups +- RDMA/hns: Fix incorrect variable usage in scc_attr_is_visible() +- RDMA/hns: Fix null pointer when alloc_scc_param() fails +- RDMA/hns: Fix scc_param delay_work to execute after sysfs shutdown +- RDMA/hns: Add mutex_destroy() to destroy the mutex +- RDMA/hns: Fix a potential Sleep-in-Atomic-Context +- !6468 v2 scsi: fnic: Move fnic_fnic_flush_tx() to a work queue +- scsi: fnic: Move fnic_fnic_flush_tx() to a work queue +- !6439 v3 m: convert mm's rss stats to use atomic mode +- mm: convert mm's rss stats to use atomic mode +- percpu_counter: introduce atomic mode for percpu_counter +- !6424 mm/migrate: correct nr_failed in migrate_pages_sync() +- mm/migrate: add nr_split to trace_mm_migrate_pages stats. +- mm/migrate: correct nr_failed in migrate_pages_sync() +- !6390 nfs: fix panic when nfs4_ff_layout_prepare_ds() fails +- nfs: fix panic when nfs4_ff_layout_prepare_ds() fails +- !5482 [OLK-6.6] crypto: update zhaoxin-aes for __pcpu_unique_paes_last_cword +- crypto: update zhaoxin-aes for __pcpu_unique_paes_last_cword +- !3171 [OLK-6.6] ata: libata: disabling PhyRdy Change Interrupt based on actual LPM capability +- ata: libata: disabling PhyRdy Change Interrupt based on actual LPM capability +- !6443 f2fs: fix NULL pointer dereference in f2fs_submit_page_write() +- f2fs: fix NULL pointer dereference in f2fs_submit_page_write() +- !6261 RDMA/hns: Some bugfixes and cleanups +- RDMA/hns: Modify the print level of CQE error +- RDMA/hns: Add mutex_destroy() +- RDMA/hns: Fix GMV table pagesize +- RDMA/hns: Fix mismatch exception rollback +- RDMA/hns: Fix UAF for cq async event +- RDMA/hns: Fix deadlock on SRQ async events. +- RDMA/hns: Remove unused parameters and variables +- RDMA/hns: Use macro instead of magic number +- RDMA/hns: Fix return value in hns_roce_map_mr_sg +- !6265 tpm_tis: Avoid warning splat at shutdown +- tpm,tpm_tis: Avoid warning splat at shutdown +- !6402 bpf: Add missing BPF_LINK_TYPE invocations +- bpf: Add missing BPF_LINK_TYPE invocations +- !6256 [OLK-6.6] bugfix from upstream v6.9 for AMD EPYC perf +- perf/x86/amd/core: Define a proper ref-cycles event for Zen 4 and later +- perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and later +- perf/x86/amd/lbr: Use freeze based on availability +- !6134 v3 rootfs: Fix support for rootfstype= when root= is given +- rootfs: Fix support for rootfstype= when root= is given + +* Tue Apr 23 2024 Hongchen Zhang - 6.6.0-21.0.0.24 +- add LoongArch support + +* Tue Apr 23 2024 Hongchen Zhang - 6.6.0-21.0.0.23 +- exclude cpufreq.h and cpuidle.h from kernel-headers package + +* Sat Apr 20 2024 ZhangPeng - 6.6.0-21.0.0.22 +- !6201 v2 mm: some optimization about hugetlb and thp +- mm: filemap: try to enable THP for exec mapping +- mm/khugepaged: keep mm in mm_slot without MMF_DISABLE_THP check +- mm/khugepaged: bypassing unnecessary scans with MMF_DISABLE_THP check +- mm: mmap: no need to call khugepaged_enter_vma() for stack +- mm: remove VM_EXEC requirement for THP eligibility +- mm: thp_get_unmapped_area must honour topdown preference +- mm: huge_memory: don't force huge page alignment on 32 bit +- mm: mmap: map MAP_STACK to VM_NOHUGEPAGE +- mm: align larger anonymous mappings on THP boundaries +- fs/hugetlbfs/inode.c: mm/memory-failure.c: fix hugetlbfs hwpoison handling +- mm/hugetlb: have CONFIG_HUGETLB_PAGE select CONFIG_XARRAY_MULTI +- mm/filemap: remove hugetlb special casing in filemap.c +- mm/filemap: clarify filemap_fault() comments for not uptodate case +- mm: huge_memory: batch tlb flush when splitting a pte-mapped THP +- !6230 xarray: inline xas_descend to improve performance +- xarray: inline xas_descend to improve performance +- !5891 Fix several compilation warnings for hinic driver +- net/hinic: Fix several compilation warnings with aarch64-openEuler-linux toolchain +- !6244 arm64: enable CONFIG_ARM64_MPAM in openeuler_defconfig +- arm64: enable CONFIG_ARM64_MPAM in openeuler_defconfig +- !6105 fix some issues for arm64 machine check safe +- ACPI: APEI: handle synchronous exceptions in task work to send correct SIGBUS si_code +- mm: memory-failure: move return value documentation to function declaration +- ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered +- arm64: add machine check safe sysctl interface +- arm64: introduce copy_mc_to_kernel() implementation +- arm64: support copy_mc_[user]_highpage() +- arm64: Get rid of ARM64_HAS_NO_HW_PREFETCH +- mm/hwpoison: return -EFAULT when copy fail in copy_mc_[user]_highpage() +- arm64: add support for ARCH_HAS_COPY_MC +- Revert "arm64: add support for machine check error safe" +- Revert "arm64: add uaccess to machine check safe" +- Revert "mm/hwpoison: return -EFAULT when copy fail in copy_mc_[user]_highpage()" +- Revert "arm64: support copy_mc_[user]_highpage()" +- Revert "arm64: introduce copy_mc_to_kernel() implementation" +- Revert "arm64: add machine check safe sysctl interface" +- Revert "kasan: fix the compilation error for memcpy_mcs()" + +* Tue Apr 16 2024 Zheng Zengkai - 6.6.0-20.0.0.21 +- !6048 improve 3SNIC 910/920/930 NIC driver +- improve 3SNIC 910/920/930 NIC driver +- !5815 v2 Support NMI in the virtual machine +- KVM: arm64: vgic-v3: Handle traps of ICV_NMIAR1_EL1 +- arm64: Decouple KVM from CONFIG_ARM64_NMI +- KVM: arm64: Handle traps of ALLINT +- KVM: arm64: Allow GICv3.3 NMI if the host supports it +- KVM: arm64: vgic-v3: Don't inject an NMI if the vcpu doesn't have FEAT_NMI +- KVM: arm64: Don't trap ALLINT accesses if the vcpu has FEAT_NMI +- KVM: arm64: Allow userspace to control ID_AA64PFR1_EL1.NMI +- KVM: arm64: vgic-debug: Add the NMI field to the debug output +- KVM: arm64: vgic-v3: Add userspace selection for GICv3.3 NMI +- KVM: arm64: vgic-v3: Add support for GIC{D,R}_INMIR registers +- KVM: arm64: vgic-v3: Use the NMI attribute as part of the AP-list sorting +- KVM: arm64: vgic-v4: Propagate the NMI state into the GICv4.1 VSGI configuration +- KVM: arm64: vgic-v3: Make NMI priority RES0 +- KVM: arm64: vgic-v3: Allow the NMI state to make it into the LRs +- KVM: arm64: vgic-v3: Upgrade AP1Rn to 64bit. +- !5752 【OLK-6.6】Add Chengdu BeiZhongWangXin Technology N5/N6 Series Network Card Driver +- drivers: add Chengdu BeiZhongWangXin Technology N5/N6 Series Network Card Driver +- !5730 [OLK-6.6] Fix warnings for RNPGBEVF driver +- RNPGBEVF: NET: Fix wanrings +- !5726 [OLK-6.6] Fix warnings for RNPVF driver +- RNPVF: NET: Fix wanrings +- !5854 [OLK-6.6] Make Cluster Scheduling Configurable +- scheduler: Disable cluster scheduling by default +- scheduler: Add boot time enabling/disabling of cluster scheduling +- scheduler: Add runtime knob sysctl_sched_cluster +- scheduler: Create SDTL_SKIP flag to skip topology level +- !6068 mm: batch mm counter updating in filemap_map_pages() +- mm: filemap: batch mm counter updating in filemap_map_pages() +- mm: move mm counter updating out of set_pte_range() +- !5931 irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801 +- irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801 +- !5678 v2 KVM: arm64: Translate logic cluster id to physical cluster id when updating lsudvmbm +- KVM: arm64: Translate logic cluster id to physical cluster id when updating lsudvmbm +- !5972 Perf-related bugfix +- docs: perf: Fix build warning of hisi-pcie-pmu.rst +- drivers/perf: hisi_pcie: Merge find_related_event() and get_event_idx() +- drivers/perf: hisi_pcie: Relax the check on related events +- drivers/perf: hisi_pcie: Check the target filter properly +- drivers/perf: hisi_pcie: Add more events for counting TLP bandwidth +- drivers/perf: hisi_pcie: Fix incorrect counting under metric mode +- drivers/perf: hisi_pcie: Introduce hisi_pcie_pmu_get_event_ctrl_val() +- drivers/perf: hisi_pcie: Rename hisi_pcie_pmu_{config,clear}_filter() +- drivers/perf: hisi: Enable HiSilicon Erratum 162700402 quirk for HIP09 +- docs: perf: Update usage for target filter of hisi-pcie-pmu +- !6063 RDMA/hns: Some bugfixes and cleanups +- RDMA/hns: Fix long waiting cmd event when reset +- RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range() +- RDMA/hns: Fix simultaneous reset and resource deregistration +- RDMA/hns: Fix cpu stuck by printings during reset +- RDMA/hns: Fix missing capacities in query_device() +- RDMA/hns: Fix missing resetting notify +- RDMA/hns: Remove extra blank line in get_sge_num_from_max_inl_data() +- RDMA/hns: Use complete parentheses in macros +- RDMA/hns: fix iommu_map_sg() failed when MR bigger than 4G +- !6069 RDMA/hns: support roh +- RDMA/hns: Support RDMA_CM in ROH mode +- RDMA/hns: Support for ROH +- RDMA/hns: Add new device ID +- !6008 locking/osq_lock: Avoid false sharing in optimistic_spin_node +- locking/osq_lock: Avoid false sharing in optimistic_spin_node +- !5774 irqdomain: Fix driver re-inserting failures when IRQs not being freed +- irqdomain: Fix driver re-inserting failures when IRQs not being freed +- !5709 【OLK-6.6】configs: arm64: Enable CONFIG_DLM +- configs: arm64: Enable CONFIG_DLM +- !5971 RDMA/hns: Support hns roce DCA mode +- RDMA/hns: Fix DCA's dependence on ib_uverbs +- RDMA/hns: Fixes concurrent ressetting and post_recv in DCA mode +- RDMA/hns: Optimize user DCA perfermance by sharing DCA status +- RDMA/hns: Add debugfs support for DCA +- RDMA/hns: Add DCA support for kernel space +- RDMA/hns: Add method to query WQE buffer's address +- RDMA/hns: Add method to detach WQE buffer +- RDMA/hns: Setup the configuration of WQE addressing to QPC +- RDMA/hns: Add method for attaching WQE buffer +- RDMA/hns: Configure DCA mode for the userspace QP +- RDMA/hns: Add method for shrinking DCA memory pool +- RDMA/hns: Introduce DCA for RC QP + +* Fri Apr 12 2024 Jin Lun - 6.6.0-19.0.0.20 +- Remove PGP certificates. +- Optimize the signing process, if the project has no permission + to send sign request, use the kernel native signing. + +* Wed Apr 10 2024 ZhangPeng - 6.6.0-19.0.0.19 +- !5877 optimize eevdf scheduler +- sched/eevdf: Skip eligibility check for current entity during wakeup preemption +- sched/eevdf: O(1) fastpath for task selection +- sched/eevdf: Sort the rbtree by virtual deadline +- !5922 Some fixes and cleanups for SAS +- Revert "scsi: hisi_sas: Disable SATA disk phy for severe I_T nexus reset failure" +- scsi: hisi_sas: Add slave_destroy interface for v3 hw +- scsi: hisi_sas: Modify the deadline for ata_wait_after_reset() +- scsi: libsas: Allocation SMP request is aligned to ARCH_DMA_MINALIGN +- scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type() +- scsi: libsas: Fix disk not being scanned in after being removed +- scsi: hisi_sas: Remove redundant checks for automatic debugfs dump +- scsi: hisi_sas: Check usage count only when the runtime PM status is RPM_SUSPENDING +- scsi: hisi_sas: Handle the NCQ error returned by D2H frame +- scsi: hisi_sas: Remove hisi_hba->timer for v3 hw +- scsi: hisi_sas: Check whether debugfs is enabled before removing or releasing it +- scsi: hisi_sas: Fix a deadlock issue related to automatic dump +- scsi: hisi_sas: Allocate DFX memory during dump trigger +- scsi: hisi_sas: Directly call register snapshot instead of using workqueue +- !5546 support 3snic NIC +- support 3SNIC 910/920/930 NIC +- !5869 KVM: arm64: vgic-its: use vgic_get_irq_kref() before vgic_put_irq() +- KVM: arm64: vgic-its: use vgic_get_irq_kref() before vgic_put_irq() +- !5878 ima:Dont check xattr when loading digest lists +- ima:Dont check xattr when loading digest lists +- !5800 firmware: arm_sdei: Move sdei_cpuhp_up/down() before lockup_detector_online_cpu() +- firmware: arm_sdei: Move sdei_cpuhp_up/down() before lockup_detector_online_cpu() +- !3175 [OLK-6.6] x86/tsc: Make cur->adjusted values in package#1 to be the same +- x86/tsc: Make cur->adjusted values in package#1 to be the same +- !5022 [devel-6.6] perf/x86/zhaoxin/uncore: Add KX-7000 support +- perf/x86/zhaoxin/uncore: Add KX-7000 support +- !5652 [OLK-6.6] i2c: zhaoxin: update support for Zhaoxin I2C controller +- i2c: zhaoxin: update support for Zhaoxin I2C controller +- !4475 [OLK-6.6] Update zhaoxin cputemp driver with using the same MSR uniformly +- Update zhaoxin cputemp driver with using the same MSR uniformly +- !5813 [intel]OLK-tdx-guest-configs-6.6 +- Enable Intel TDX guest as kernel module +- !5723 vfio/migration: some bugfix +- hisi_acc_vfio_pci: obtain the mailbox configuration at one time +- vfio/migration: remove unused local variable +- vfio/migration: bugfix cache write-back issue +- vfio/migration: add eq and aeq interruption restore +- vfio/migration: bugfix some driver code +- vfio/migration: added map length page alignment +- !5707 [OLK-6.6] Fix warnings for RNPGBE driver +- RNPGBE: NET: Fix wanrings +- !5659 [OLK-6.6] Fix warnings for RNP driver +- RNP: Fix warnings + +* Mon Apr 08 2024 Ren Zhijie - 6.6.0-18.0.0.18 +- add support for arch ppc64le + +* Mon Apr 08 2024 Zheng Zengkai - 6.6.0-18.0.0.17 +- !5768 resctrl: fix undefined reference to lockdep_is_cpus_held() +- fs/resctrl: Move rdtgroup_setup_default() out of init.text section +- resctrl: fix undefined reference to lockdep_is_cpus_held() +- !5769 Revert "KVM: arm64: Disable MPAM visibility by default, and handle traps" +- Revert "KVM: arm64: Disable MPAM visibility by default, and handle traps" +- !5744 Backport maple_tree: iterator state changes +- lib/maple_tree.c: fix build error due to hotfix alteration +- maple_tree: mtree_range_walk() clean up +- maple_tree: don't find node end in mtree_lookup_walk() +- maple_tree: use maple state end for write operations +- maple_tree: remove mas_searchable() +- maple_tree: separate ma_state node from status +- maple_tree: clean up inlines for some functions +- maple_tree: use cached node end in mas_destroy() +- maple_tree: use cached node end in mas_next() +- maple_tree: add end of node tracking to the maple state +- maple_tree: move debug check to __mas_set_range() +- maple_tree: make mas_erase() more robust +- maple_tree: remove unnecessary default labels from switch statements +- !5725 ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs +- ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs + +* Sun Apr 07 2024 Zheng Zengkai - 6.6.0-17.0.0.16 +- !5695 v2 Disable OLK-6.6 configs +- arm64: configs: Disable PROBE_EVENTS_BTF_ARGS +- x86: configs: Disable PROBE_EVENTS_BTF_ARGS +- x86: configs: Disable X86_KERNEL_IBT +- x86: configs: Disable CRASH_HOTPLUG +- !5733 fix port vlan filter not disabled problem in dynamic vlan mode +- net: hns3: fix port vlan filter not disabled problem in dynamic vlan mode +- !5734 arch/mm/fault: accelerate pagefault when badaccess +- x86: mm: accelerate pagefault when badaccess +- arm64: mm: accelerate pagefault when VM_FAULT_BADACCESS +- !5657 Backport slub performance optimization +- mm/slub: remove unused parameter in next_freelist_entry() +- mm/slub: remove full list manipulation for non-debug slab +- mm/slub: directly load freelist from cpu partial slab in the likely case +- slub: Update frozen slabs documentations in the source +- slub: Rename all *unfreeze_partials* functions to *put_partials* +- slub: Optimize deactivate_slab() +- slub: Delay freezing of partial slabs +- slub: Introduce freeze_slab() +- slub: Prepare __slab_free() for unfrozen partial slab out of node partial list +- slub: Keep track of whether slub is on the per-node partial list +- slub: Change get_partial() interfaces to return slab +- slub: Reflow ___slab_alloc() +- !5699 sr9800: Add check for usbnet_get_endpoints +- sr9800: Add check for usbnet_get_endpoints + +* Tue Apr 02 2024 Zheng Zengkai - 6.6.0-16.0.0.15 +- !5647 hisilicon - some bugfix and cleanup +- crypto: hisilicon/sec2: fix memory use-after-free issue +- crypto: hisilicon/qm - hardware error does not reset during binding/unbinding +- crypto: hisilicon/qm - check device status before sending mailbox +- crypto: hisilicon/qm - mask error bit before flr +- crypto: hisilicon/qm - fix the pf2vf timeout when global reset +- crypto: hisilicon/qm - obtain the mailbox configuration at one time +- crypto: hisilicon/hpre - mask cluster timeout error +- crypto: hisilicon/qm - disable same error report before resetting +- crypto: hisilicon/qm - modify interrupt processing resource application +- crypto: hisilicon/qm - reset device before enabling it +- openeuler_defconfig: enable HISI_ACC_VFIO_PCI=m +- Revert "openeuler_defconfig: enable HISI_ACC_VFIO_PCI=m" +- !5509 ext4: Validate inode pa before using preallocation blocks +- ext4: Validate inode pa before using preallocation blocks +- !5630 scsi: sd: try more retries of START_STOP when resuming scsi device +- scsi: sd: try more retries of START_STOP when resuming scsi device +- !5561 roh: backport roh driver feature support +- roh/hns3: Fix the processing flow of ROH CMDq during the reset process. +- roh/core: Synchronously update the mac address of the vlan device when configuring the vlan device ip +- roh/hns3: Fix ROH multi-BD cmdq issue +- roh/hns3: Add support for roh dfx(debugfs) +- roh/hns3: Add support for roh reset +- roh/core: Add support for inetaddr notifier in roh/core +- roh/hns3: Add support for roh abnormal interruption +- roh/core: Add roh device sysfs node +- roh/hns3: Add ROH cmdq interface support +- roh/hns3: Add ROH hns3 driver and register a ROH device +- roh/core: Add ROH device driver +- net: hns3: add support for ROH reset +- net: hns3: intercept invalid MAC address setting in ROH +- !5703 openeuler_defconfig: Disable CONFIG_PREEMPT_DYNAMIC for x86 +- openeuler_defconfig: Disable CONFIG_PREEMPT_DYNAMIC for x86 +- !5513 [OLK-6.6] SCSI: SSSRAID: Support 3SNIC 3S5XX serial RAID/HBA controllers +- SCSI: SSSRAID: Support 3SNIC 3S5XX serial RAID/HBA controllers +- !5582 [OLK-6.6]Open CONFIG_LZ4_COMPRESS option for x86_64 architecture +- Open CONFIG_LZ4_COMPRESS option for x86_64 architecture +- !5688 v3 Optimize compaction +- mm/compaction: optimize >0 order folio compaction with free page split. +- mm/compaction: add support for >0 order folio memory compaction. +- mm/compaction: enable compacting >0 order folios. +- mm/page_alloc: remove unused fpi_flags in free_pages_prepare() +- mm/compaction: introduce NR_PAGE_ORDERS and MAX_PAGE_ORDER +- mm: compaction: limit the suitable target page order to be less than cc->order +- mm: compaction: update the cc->nr_migratepages when allocating or freeing the freepages +- mm: compaction: avoid fast_isolate_freepages blindly choose improper pageblock +- mm: add page_rmappable_folio() wrapper +- mm: page_alloc: check the order of compound page even when the order is zero +- mm/compaction: factor out code to test if we should run compaction for target order +- mm/compaction: improve comment of is_via_compact_memory +- mm/compaction: remove repeat compact_blockskip_flush check in reset_isolation_suitable +- mm/compaction: correctly return failure with bogus compound_order in strict mode +- mm/compaction: call list_is_{first}/{last} more intuitively in move_freelist_{head}/{tail} +- mm/compaction: use correct list in move_freelist_{head}/{tail} +- !5655 add steal time software breakpoint pv ipi support for loongarch kvm +- LoongArch: Add steal time support in guest side +- LoongArch: KVM: Add steal time support in kvm side +- irqchip/loongson-eiointc: Add virt extension support +- LoongArch: KVM: Add software breakpoint support +- Documentation: KVM: Add hypercall for LoongArch +- LoongArch: Add pv ipi support on guest kernel side +- LoongArch: KVM: Add pv ipi support on kvm side +- LoongArch: KVM: Add vcpu search support from physical cpuid +- LoongArch: KVM: Add cpucfg area for kvm hypervisor +- LoongArch: KVM: Add hypercall instruction emulation support +- LoongArch/smp: Refine some ipi functions on LoongArch platform +- !5653 arm64: Enable hardware NMI for perf events NMI +- arm64: Enable hardware NMI for perf events NMI +- !5667 configs: arm64: Enable CONFIG_ACPI_AGDI and CONFIG_ACPI_FFH +- configs: arm64: Enable CONFIG_ACPI_AGDI and CONFIG_ACPI_FFH +- !5669 disable CONFIG_CMDLINE_FROM_BOOTLOADER CONFIG_INITRAMFS_PRESERVE_MTIME in 6.6 +- configs: disable CONFIG_CMDLINE_FROM_BOOTLOADER CONFIG_INITRAMFS_PRESERVE_MTIME in 6.6 +- !5663 arm64: transparent contiguous PTEs for user mappings +- arm64: configs: enable ARM64_CONTPTE +- tools/mm: add thpmaps script to dump THP usage info +- mm: make folio_pte_batch available outside of mm/memory.c +- arm64/mm: automatically fold contpte mappings +- arm64/mm: __always_inline to improve fork() perf +- arm64/mm: implement pte_batch_hint() +- mm: add pte_batch_hint() to reduce scanning in folio_pte_batch() +- arm64/mm: implement new [get_and_]clear_full_ptes() batch APIs +- arm64/mm: implement new wrprotect_ptes() batch API +- arm64/mm: wire up PTE_CONT for user mappings +- arm64/mm: dplit __flush_tlb_range() to elide trailing DSB +- arm64/mm: new ptep layer to manage contig bit +- arm64/mm: convert ptep_clear() to ptep_get_and_clear() +- arm64/mm: convert set_pte_at() to set_ptes(..., 1) +- arm64/mm: convert READ_ONCE(*ptep) to ptep_get(ptep) +- mm: tidy up pte_next_pfn() definition +- x86/mm: convert pte_next_pfn() to pte_advance_pfn() +- arm64/mm: convert pte_next_pfn() to pte_advance_pfn() +- mm: introduce pte_advance_pfn() and use for pte_next_pfn() +- mm: thp: batch-collapse PMD with set_ptes() +- mm: clarify the spec for set_ptes() +- mm: memory: move mem_cgroup_charge() into alloc_anon_folio() +- mm: memory: use folio_prealloc() in wp_page_copy() +- mm: memory: use a folio in do_cow_fault() +- mm: memory: rename page_copy_prealloc() to folio_prealloc() +- !5662 v4 Introduce dynamic pool feature part 2 +- mm/dynamic_pool: Wrap some core functions with dpool prefix +- mm/dynamic_pool: disable irq for dynamic_pool lock +- mm/dynamic_pool: don't set subpool for page from dynamic pool +- mm/dynamic_pool: skip unexpected migration +- mm/mem_reliable: Fallback to dpool if reliable memory is not enough +- mm/mem_reliable: Treat page from dhugetlb pool as unreliable page +- mm/dynamic_pool: Stop alloc reliable page from dynamic pool +- !5621 irqchip/gic-v3: Fix a system stall when using pseudo NMI with CONFIG_ARM64_NMI closed +- irqchip/gic-v3: Fix a system stall when using pseudo NMI with CONFIG_ARM64_NMI closed +- !5656 v3 mm: backport fork/unmap/zap optimize +- mm/memory: fix missing pte marker for !page on pte zaps +- mm/memory: optimize unmap/zap with PTE-mapped THP +- mm/mmu_gather: improve cond_resched() handling with large folios and expensive page freeing +- mm/mmu_gather: add __tlb_remove_folio_pages() +- mm/mmu_gather: add tlb_remove_tlb_entries() +- mm/mmu_gather: define ENCODED_PAGE_FLAG_DELAY_RMAP +- mm/mmu_gather: pass "delay_rmap" instead of encoded page to __tlb_remove_page_size() +- mm/memory: factor out zapping folio pte into zap_present_folio_pte() +- mm/memory: further separate anon and pagecache folio handling in zap_present_pte() +- mm/memory: handle !page case in zap_present_pte() separately +- mm/memory: factor out zapping of present pte into zap_present_pte() +- mm/memory: ignore writable bit in folio_pte_batch() +- mm/memory: ignore dirty/accessed/soft-dirty bits in folio_pte_batch() +- mm/memory: optimize fork() with PTE-mapped THP +- mm/memory: pass PTE to copy_present_pte() +- mm/memory: factor out copying the actual PTE in copy_present_pte() +- powerpc/mm: use pte_next_pfn() in set_ptes() +- arm/mm: use pte_next_pfn() in set_ptes() +- mm/pgtable: make pte_next_pfn() independent of set_ptes() +- sparc/pgtable: define PFN_PTE_SHIFT +- s390/pgtable: define PFN_PTE_SHIFT +- riscv/pgtable: define PFN_PTE_SHIFT +- powerpc/pgtable: define PFN_PTE_SHIFT +- nios2/pgtable: define PFN_PTE_SHIFT +- arm/pgtable: define PFN_PTE_SHIFT +- arm64/mm: make set_ptes() robust when OAs cross 48-bit boundary +- arm64: Mark the 'addr' argument to set_ptes() and __set_pte_at() as unused +- arm64/mm: Hoist synchronization out of set_ptes() loop +- mm: convert mm_counter_file() to take a folio +- mm: convert mm_counter() to take a folio +- mm: convert to should_zap_page() to should_zap_folio() +- mm: use pfn_swap_entry_folio() in copy_nonpresent_pte() +- mm: use pfn_swap_entry_to_folio() in zap_huge_pmd() +- mm: use pfn_swap_entry_folio() in __split_huge_pmd_locked() +- s390: use pfn_swap_entry_folio() in ptep_zap_swap_entry() +- mprotect: use pfn_swap_entry_folio +- mm: add pfn_swap_entry_folio() + +* Tue Apr 2 2024 Jin Lun - 6.6.0-15.0.0.14 +- Support generating moudle/kernel signature with openEuler signature platform + +* Sat Mar 30 2024 Liu Jian - 6.6.0-15.0.0.13 +- And net-acc tool to kernel-tools. + +* Fri Mar 29 2024 Zheng Zengkai - 6.6.0-15.0.0.12 +- !5470 [OLK-6.6] Add support for Mucse Virtual Function Network Adapter(N500/n210) +- drivers: initial support for rnpgbevf drivers from Mucse Technology +- !3164 [OLK-6.6] Fix CRC32C instruction low performance issue +- crypto: x86/crc32c-intel - Don't match some Zhaoxin CPUs +- !5547 Synchronizing upstream patch +- LoongArch: KVM: Set reserved bits as zero in CPUCFG +- LoongArch: KVM: Do not restart SW timer when it is expired +- LoongArch: KVM: Start SW timer only when vcpu is blocking +- irqchip/loongson-eiointc: Remove explicit interrupt affinity restore on resume +- irqchip/loongson-eiointc: Skip handling if there is no pending irq +- !3182 [OLK-6.6] Add support for Zhaoxin GMI SM2 Secure Hash algorithm +- configs: add CONFIG_CRYPTO_SM2_ZHAOXIN_GMI to m +- Add support for Zhaoxin GMI SM2 Secure Hash algorithm +- !5578 SCSI: hisi_raid: support SPxxx serial RAID/HBA controllers +- SCSI: hisi_raid: support SPxxx serial RAID/HBA controllers +- !5641 userfaultfd: early return in dup_userfaultfd() +- userfaultfd: early return in dup_userfaultfd() +- !5629 v3 Mitigate a vmap lock contention +- mm: vmalloc: refactor vmalloc_dump_obj() function +- mm: vmalloc: improve description of vmap node layer +- mm: vmalloc: add a shrinker to drain vmap pools +- mm: vmalloc: set nr_nodes based on CPUs in a system +- mm: vmalloc: support multiple nodes in vmallocinfo +- mm: vmalloc: support multiple nodes in vread_iter +- mm: vmalloc: add a scan area of VA only once +- mm: vmalloc: offload free_vmap_area_lock lock +- mm: vmalloc: remove global purge_vmap_area_root rb-tree +- mm/vmalloc: remove vmap_area_list +- mm: vmalloc: remove global vmap_area_root rb-tree +- mm: vmalloc: move vmap_init_free_space() down in vmalloc.c +- mm: vmalloc: rename adjust_va_to_fit_type() function +- mm: vmalloc: add va_alloc() helper +- mm: Introduce vmap_page_range() to map pages in PCI address space +- mm: Introduce VM_SPARSE kind and vm_area_[un]map_pages(). +- mm: Enforce VM_IOREMAP flag and range in ioremap_page_range. +- mm/vmalloc: fix the unchecked dereference warning in vread_iter() +- !5609 Adding Huawei BMA driver +- configs: add config BMA to config files +- Huawei BMA: Adding Huawei BMA driver: cdev_veth_drv +- Huawei BMA: Adding Huawei BMA driver: host_kbox_drv +- Huawei BMA: Adding Huawei BMA driver: host_veth_drv +- Huawei BMA: Adding Huawei BMA driver: host_cdev_drv +- Huawei BMA: Adding Huawei BMA driver: host_edma_drv +- !5613 mm: backport rmap interface overhaul +- mm/memory: fix folio_set_dirty() vs. folio_mark_dirty() in zap_pte_range() +- mm/huge_memory: fix folio_set_dirty() vs. folio_mark_dirty() +- mm/rmap: silence VM_WARN_ON_FOLIO() in __folio_rmap_sanity_checks() +- mm: remove one last reference to page_add_*_rmap() +- mm/rmap: rename COMPOUND_MAPPED to ENTIRELY_MAPPED +- mm: convert page_try_share_anon_rmap() to folio_try_share_anon_rmap_[pte|pmd]() +- mm/rmap: remove page_try_dup_anon_rmap() +- mm/memory: page_try_dup_anon_rmap() -> folio_try_dup_anon_rmap_pte() +- mm/huge_memory: page_try_dup_anon_rmap() -> folio_try_dup_anon_rmap_pmd() +- mm/rmap: introduce folio_try_dup_anon_rmap_[pte|ptes|pmd]() +- mm/rmap: convert page_dup_file_rmap() to folio_dup_file_rmap_[pte|ptes|pmd]() +- mm/rmap: remove page_remove_rmap() +- Documentation: stop referring to page_remove_rmap() +- mm: userswap: page_remove_rmap() -> folio_remove_rmap_pte() +- mm/rmap: page_remove_rmap() -> folio_remove_rmap_pte() +- mm/migrate_device: page_remove_rmap() -> folio_remove_rmap_pte() +- mm/memory: page_remove_rmap() -> folio_remove_rmap_pte() +- mm/ksm: page_remove_rmap() -> folio_remove_rmap_pte() +- mm/khugepaged: page_remove_rmap() -> folio_remove_rmap_pte() +- mm/huge_memory: page_remove_rmap() -> folio_remove_rmap_pmd() +- kernel/events/uprobes: page_remove_rmap() -> folio_remove_rmap_pte() +- mm/rmap: introduce folio_remove_rmap_[pte|ptes|pmd]() +- mm/rmap: remove RMAP_COMPOUND +- mm/rmap: remove page_add_anon_rmap() +- mm/memory: page_add_anon_rmap() -> folio_add_anon_rmap_pte() +- mm/swapfile: page_add_anon_rmap() -> folio_add_anon_rmap_pte() +- mm/ksm: page_add_anon_rmap() -> folio_add_anon_rmap_pte() +- mm/migrate: page_add_anon_rmap() -> folio_add_anon_rmap_pte() +- mm/huge_memory: page_add_anon_rmap() -> folio_add_anon_rmap_pmd() +- mm/huge_memory: batch rmap operations in __split_huge_pmd_locked() +- mm/rmap: introduce folio_add_anon_rmap_[pte|ptes|pmd]() +- mm/rmap: factor out adding folio mappings into __folio_add_rmap() +- mm/rmap: remove page_add_file_rmap() +- mm/userfaultfd: page_add_file_rmap() -> folio_add_file_rmap_pte() +- mm/migrate: page_add_file_rmap() -> folio_add_file_rmap_pte() +- mm/huge_memory: page_add_file_rmap() -> folio_add_file_rmap_pmd() +- mm/memory: page_add_file_rmap() -> folio_add_file_rmap_[pte|pmd]() +- mm/rmap: convert folio_add_file_rmap_range() into folio_add_file_rmap_[pte|ptes|pmd]() +- mm/rmap: add hugetlb sanity checks for anon rmap handling +- mm/rmap: introduce and use hugetlb_try_share_anon_rmap() +- mm/rmap: introduce and use hugetlb_try_dup_anon_rmap() +- mm/rmap: introduce and use hugetlb_add_file_rmap() +- mm/rmap: introduce and use hugetlb_remove_rmap() +- mm/rmap: rename hugepage_add* to hugetlb_add* +- mm/khugepaged: convert collapse_pte_mapped_thp() to use folios +- mm/khugepaged: convert alloc_charge_hpage() to use folios +- mm/khugepaged: convert is_refcount_suitable() to use folios +- mm/khugepaged: convert hpage_collapse_scan_pmd() to use folios +- mm/khugepaged: convert __collapse_huge_page_isolate() to use folios +- !5543 v2 locking/qspinlock: Add CNA support for ARM64 +- config/arm64: Enable numa aware qspinlock by default +- locking/qspinlock: Add CNA support for ARM64 without pvspinlock +- !5555 v2 ACPI/arm64: add support for virtual cpu hotplug +- arm64/psci: Add undefined error message printing for psci_x_cpu_on +- cpumask: Add enabled cpumask for present CPUs that can be brought online +- ACPI: Add _OSC bits to advertise OS support for toggling CPU present/enabled +- arm64: document virtual CPU hotplug's expectations +- ACPI: processor: Only call arch_unregister_cpu() if HOTPLUG_CPU is selected +- ACPI: add support to register CPUs based on the _STA enabled bit +- arm64: psci: Ignore DENIED CPUs +- irqchip/gic-v3: Add support for ACPI's disabled but 'online capable' CPUs +- irqchip/gic-v3: Don't return errors from gic_acpi_match_gicc() +- ACPICA: Add new MADT GICC flags fields +- arm64: acpi: Move get_cpu_for_acpi_id() to a header +- ACPI: Warn when the present bit changes but the feature is not enabled +- ACPI: Check _STA present bit before making CPUs not present +- ACPI: convert acpi_processor_post_eject() to use IS_ENABLED() +- ACPI: Add post_eject to struct acpi_scan_handler for cpu hotplug +- ACPI: Rename acpi_processor_hotadd_init and remove pre-processor guards +- ACPI: Move acpi_bus_trim_one() before acpi_scan_hot_remove() +- ACPI: Rename ACPI_HOTPLUG_CPU to include 'present' +- ACPI: processor: Register all CPUs from acpi_processor_get_info() +- ACPI: processor: Register CPUs that are online, but not described in the DSDT +- ACPI: processor: Add support for processors described as container packages +- ACPI: Only enumerate enabled (or functional) devices +- !5461 [OLK-6.6] Add support for Mucse Virtual Function Network Adapter(N10) +- drivers: initial support for rnpvf drivers from Mucse Technology +- !5526 Intel: Backport QuickAssist Technology(QAT) in-tree driver +- Enable Intel QAT_4XXX as kernel module +- crypto: qat - make ring to service map common for QAT GEN4 +- crypto: qat - fix ring to service map for dcc in 420xx +- crypto: qat - fix ring to service map for dcc in 4xxx +- crypto: qat - fix comment structure +- crypto: qat - remove unnecessary description from comment +- crypto: qat - remove double initialization of value +- crypto: qat - avoid division by zero +- crypto: qat - removed unused macro in adf_cnv_dbgfs.c +- crypto: qat - remove unused macros in qat_comp_alg.c +- crypto: qat - uninitialized variable in adf_hb_error_inject_write() +- Documentation: qat: fix auto_reset section +- crypto: qat - resolve race condition during AER recovery +- crypto: qat - change SLAs cleanup flow at shutdown +- crypto: qat - improve aer error reset handling +- crypto: qat - limit heartbeat notifications +- crypto: qat - add auto reset on error +- crypto: qat - add fatal error notification +- crypto: qat - re-enable sriov after pf reset +- crypto: qat - update PFVF protocol for recovery +- crypto: qat - disable arbitration before reset +- crypto: qat - add fatal error notify method +- crypto: qat - add heartbeat error simulator +- crypto: qat - use kcalloc_node() instead of kzalloc_node() +- crypto: qat - avoid memcpy() overflow warning +- crypto: qat - fix arbiter mapping generation algorithm for QAT 402xx +- crypto: qat - generate dynamically arbiter mappings +- crypto: qat - add support for ring pair level telemetry +- crypto: qat - add support for device telemetry +- crypto: qat - add admin msgs for telemetry +- crypto: qat - include pci.h for GET_DEV() +- crypto: qat - add support for 420xx devices +- crypto: qat - move fw config related structures +- crypto: qat - relocate portions of qat_4xxx code +- crypto: qat - change signature of uof_get_num_objs() +- crypto: qat - relocate and rename get_service_enabled() +- crypto: qat - add NULL pointer check +- crypto: qat - fix mutex ordering in adf_rl +- crypto: qat - fix error path in add_update_sla() +- crypto: qat - add sysfs_added flag for rate limiting +- crypto: qat - add sysfs_added flag for ras +- crypto: qat - prevent underflow in rp2srv_store() +- units: add missing header +- seq_file: add helper macro to define attribute for rw file +- crypto: qat - move adf_cfg_services +- crypto: qat - add num_rps sysfs attribute +- crypto: qat - add rp2svc sysfs attribute +- crypto: qat - add rate limiting sysfs interface +- crypto: qat - add rate limiting feature to qat_4xxx +- crypto: qat - add retrieval of fw capabilities +- crypto: qat - add bits.h to icp_qat_hw.h +- units: Add BYTES_PER_*BIT +- crypto: qat - move admin api +- crypto: qat - count QAT GEN4 errors +- crypto: qat - add error counters +- crypto: qat - add handling of errors from ERRSOU3 for QAT GEN4 +- crypto: qat - add adf_get_aram_base() helper function +- crypto: qat - add handling of compression related errors for QAT GEN4 +- crypto: qat - add handling of errors from ERRSOU2 for QAT GEN4 +- crypto: qat - add reporting of errors from ERRSOU1 for QAT GEN4 +- crypto: qat - add reporting of correctable errors for QAT GEN4 +- crypto: qat - add infrastructure for error reporting +- crypto: qat - add cnv_errors debugfs file +- crypto: qat - add pm_status debugfs file +- crypto: qat - refactor included headers +- crypto: qat - add namespace to driver +- crypto: qat - Remove zlib-deflate +- crypto: qat - Annotate struct adf_fw_counters with __counted_by +- crypto: qat - do not shadow error code +- crypto: qat - refactor deprecated strncpy +- crypto: qat - Use list_for_each_entry() helper +- Documentation: ABI: debugfs-driver-qat: fix fw_counters path + +* Thu Mar 28 2024 Bing Xia - 6.6.0-14.0.0.11 +- perf: add CoreSight trace component support on aarch64 platform + +* Wed Mar 27 2024 Zheng Zengkai - 6.6.0-14.0.0.10 +- !5524 [OLK-6.6] fix 0day bugs reported by CI robot for Mont-TSSE +- fix 0 day bugs for Mont-TSSE Driver +- !5284 [OLK-6.6] fs/address_space: move i_mmap_rwsem to mitigate a false sharing with i_mmap. +- fs/address_space: move i_mmap_rwsem to mitigate a false sharing with i_mmap. +- !5280 Add Huawei Intelligent Network Card Driver: hinic3 +- net/hinic3: add huawei/hinic3 driver +- !5179 Update Huawei Intelligent Network Card Driver: hinic +- net/hinic: Update Huawei Intelligent Network Card Driver: hinic +- !5523 enable openeuler_defconfig HISI_ACC_VFIO_PCI=m +- openeuler_defconfig: enable HISI_ACC_VFIO_PCI=m +- !5529 arch/powerpc: open BTF relevant configs in openuler defconfig +- arch/powerpc: open BTF relevant configs in openuler defconfig +- !5541 RDMA/hns: Backport bugfixes +- RDMA/hns: Refactor hns_roce_alloc_ucontext() +- RDMA/hns: Fix missing reset notification by user space driver +- RDMA/hns: Kernel notify usr space to stop ring db +- RDMA/hns: Support flexible wqe buffer page size +- !5464 net: hns3: backport some driver feature enhancement +- net: hns3: default select PAGE_POOL_STATS +- net: hns3: support set/get VxLAN rule of rx flow director by ethtool +- net: ethtool: add VxLAN to the NFC API +- net: hns3: add support for ROH ras +- net: hns3: fix bug for init roh client instance +- net: hns3: HNAE3 framework add support for ROH client +- net: hns3: add support handling tx dhcp packets for ROH +- net: hns3: support arp proxy +- net: hns3: add arp proxy switch in ethtool +- net: hns3: support tc limit rate +- net: hns3: support tc command with max rate parameter +- net: hns3: add ROH MAC type definitions and support query MAC type +- net: hns3: Add support for some CMIS transceiver modules +- net: sfp: Synchronize some CMIS transceiver modules from ethtool +- net: hns3: add command queue trace for hns3 +- net: hns3: dump more reg info based on ras mod +- net: hns3: add support for page_pool_get_stats +- net: hns3: add support to query scc version by devlink info +- net: hns3: correct the logic of hclge_sync_vf_qb_mode() +- net: hns3: add support for FD counter +- net: hns3: allocate fd counter for queue bonding +- net: hns3: refactor the debugfs for dumping FD tcam +- net: hns3: add queue bonding mode support for VF +- net: hns3: add support for queue bonding mode of flow director +- !5426 BTC's bugfix for openeuler OLK-6.6 +- ipmi: Add erratum 162102203 config to enable workaround for SMS message processing timeout +- ipmi: Errata workaround to prevent SMS message processing timeout +- !5049 [OLK-6.6]Add pcie acs and no-bus-reset quirk for mucse Nics +- Add pcie acs and no-bus-reset quirk for mucse Nics +- !5354 iommu/arm-smmu-v3: Disable ECMDQ before reset +- iommu/arm-smmu-v3: Disable ECMDQ before reset +- !5061 [OLK-6.6] riscv: Update openeuler_defconfig to support sg2042 SoC +- riscv: Update openeuler_defconfig to support sg2042 SoC +- !5427 crypto/trng: Remove the automatic loading of the hisi_trng driver +- crypto/trng: Remove the automatic loading of the hisi_trng driver +- crypto: hisilicon/trng - use %u to print u32 variables +- !5492 Backport Introduce __mt_dup() to improve the performance of fork() +- fork: use __mt_dup() to duplicate maple tree in dup_mmap() +- maple_tree: preserve the tree attributes when destroying maple tree +- maple_tree: update check_forking() and bench_forking() +- maple_tree: skip other tests when BENCH is enabled +- maple_tree: update the documentation of maple tree +- maple_tree: add test for mtree_dup() +- radix tree test suite: align kmem_cache_alloc_bulk() with kernel behavior. +- maple_tree: introduce interfaces __mt_dup() and mtree_dup() +- maple_tree: introduce {mtree,mas}_lock_nested() +- maple_tree: add mt_free_one() and mt_attr() helpers +- radix tree test suite: fix allocation calculation in kmem_cache_alloc_bulk() +- !5334 v4 iommu/iova: avoid softlockup in fq_flush_timeout +- iommu/iova: avoid softlockup in fq_flush_timeout +- !5412 [OLK-6.6] perf/x86/amd: Miscellaneous fixes +- perf vendor events amd: Fix Zen 4 cache latency events +- perf/x86/amd/lbr: Discard erroneous branch entries +- perf/x86/amd/core: Avoid register reset when CPU is dead +- !5376 Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security +- Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security + +* Fri Mar 22 2024 Zheng Zengkai - 6.6.0-13.0.0.9 +- !5424 block: Fix iterating over an empty bio with bio_for_each_folio_all +- block: Fix iterating over an empty bio with bio_for_each_folio_all +- !5425 nbd: always initialize struct msghdr completely +- nbd: always initialize struct msghdr completely +- !5255 CVE-2024-26627 +- scsi: core: Move scsi_host_busy() out of host lock if it is for per-command +- scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler +- !5221 powerpc/mm: Fix null-pointer dereference in pgtable_cache_add +- powerpc/mm: Fix null-pointer dereference in pgtable_cache_add +- !5045 [OLK-6.6] Add support for Mont-TSSE firmware update and fix 0day bugs +- add firmware update function for Mont-TSSE +- fix 0day bugs for Mont-TSSE in CI test +- !5363 [OLK-6.6] ima: Support modsig verify using trusted keys +- ima: Enable modsig appraisal by default +- ima: Support modsig verify using trusted keys +- !5369 Backport 6.6.9-6.6.22 LTS +- KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests +- x86/rfds: Mitigate Register File Data Sampling (RFDS) +- Documentation/hw-vuln: Add documentation for RFDS +- x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set +- selftests: mptcp: decrease BW in simult flows +- readahead: avoid multiple marked readahead pages +- KVM: s390: vsie: fix race during shadow creation +- KVM: s390: add stat counter for shadow gmap events +- net: pds_core: Fix possible double free in error handling path +- netrom: Fix data-races around sysctl_net_busy_read +- netrom: Fix a data-race around sysctl_netrom_link_fails_count +- netrom: Fix a data-race around sysctl_netrom_routing_control +- netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout +- netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size +- netrom: Fix a data-race around sysctl_netrom_transport_busy_delay +- netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay +- netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries +- netrom: Fix a data-race around sysctl_netrom_transport_timeout +- netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser +- netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser +- netrom: Fix a data-race around sysctl_netrom_default_path_quality +- erofs: apply proper VMA alignment for memory mapped files on THP +- netfilter: nf_conntrack_h323: Add protection for bmp length out of range +- netfilter: nft_ct: fix l3num expectations with inet pseudo family +- net/rds: fix WARNING in rds_conn_connect_if_down +- net: dsa: microchip: fix register write order in ksz8_ind_write8() +- cpumap: Zero-initialise xdp_rxq_info struct before running XDP program +- selftests/bpf: Fix up xdp bonding test wrt feature flags +- xdp, bonding: Fix feature flags when there are no slave devs anymore +- bpf: check bpf_func_state->callback_depth when pruning states +- net/ipv6: avoid possible UAF in ip6_route_mpath_notify() +- igc: avoid returning frame twice in XDP_REDIRECT +- net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() +- ice: virtchnl: stop pretending to support RSS over AQ or registers +- net: sparx5: Fix use after free inside sparx5_del_mact_entry +- geneve: make sure to pull inner header in geneve_rx() +- tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string +- net/mlx5e: Switch to using _bh variant of of spinlock API in port timestamping NAPI poll context +- net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map +- net/mlx5e: Fix MACsec state loss upon state update in offload path +- net/mlx5e: Change the warning when ignore_flow_level is not supported +- net/mlx5: Check capability for fw_reset +- net/mlx5: E-switch, Change flow rule destination checking +- Revert "net/mlx5e: Check the number of elements before walk TC rhashtable" +- Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" +- ice: reorder disabling IRQ and NAPI in ice_qp_dis +- i40e: disable NAPI right after disabling irqs when handling xsk_pool +- ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able +- net: lan78xx: fix runtime PM count underflow on link stop +- xfrm: Pass UDP encapsulation in TX packet offload +- mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index +- ceph: switch to corrected encoding of max_xattr_size in mdsmap +- dmaengine: fsl-edma: correct max_segment_size setting +- dmaengine: fsl-edma: utilize common dt-binding header file +- dt-bindings: dma: fsl-edma: Add fsl-edma.h to prevent hardcoding in dts +- drm/nouveau: don't fini scheduler before entity flush +- selftests: mptcp: rm subflow with v4/v4mapped addr +- selftests: mptcp: add mptcp_lib_is_v6 +- selftests: mptcp: update userspace pm test helpers +- selftests: mptcp: add chk_subflows_total helper +- selftests: mptcp: add evts_get_info helper +- KVM/VMX: Move VERW closer to VMentry for MDS mitigation +- KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH +- x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key +- x86/entry_32: Add VERW just before userspace transition +- x86/entry_64: Add VERW just before userspace transition +- block: define bvec_iter as __packed __aligned(4) +- gpio: fix resource unwinding order in error path +- gpiolib: Fix the error path order in gpiochip_add_data_with_key() +- gpio: 74x164: Enable output pins after registers are reset +- powerpc/rtas: use correct function name for resetting TCE tables +- powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV +- dmaengine: idxd: Ensure safe user copy of completion record +- dmaengine: idxd: Remove shadow Event Log head stored in idxd +- phy: freescale: phy-fsl-imx8-mipi-dphy: Fix alias name to use dashes +- dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup +- dmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup +- dmaengine: dw-edma: Add HDMA remote interrupt configuration +- dmaengine: dw-edma: HDMA_V0_REMOTEL_STOP_INT_EN typo fix +- dmaengine: dw-edma: Fix wrong interrupt bit set for HDMA +- dmaengine: dw-edma: Fix the ch_count hdma callback +- ASoC: cs35l56: fix reversed if statement in cs35l56_dspwait_asp1tx_put() +- af_unix: Drop oob_skb ref before purging queue in GC. +- af_unix: Fix task hung while purging oob_skb in GC. +- NFS: Fix data corruption caused by congestion. +- mptcp: fix possible deadlock in subflow diag +- mptcp: fix double-free on socket dismantle +- mptcp: fix potential wake-up event loss +- mptcp: fix snd_wnd initialization for passive socket +- selftests: mptcp: join: add ss mptcp support check +- mptcp: push at DSS boundaries +- mptcp: avoid printing warning once on client side +- mptcp: map v4 address to v6 when destroying subflow +- x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers +- x86/e820: Don't reserve SETUP_RNG_SEED in e820 +- mm/debug_vm_pgtable: fix BUG_ON with pud advanced test +- pmdomain: qcom: rpmhpd: Fix enabled_corner aggregation +- efivarfs: Request at most 512 bytes for variable names +- kbuild: Add -Wa,--fatal-warnings to as-instr invocation +- riscv: add CALLER_ADDRx support +- RISC-V: Drop invalid test from CONFIG_AS_HAS_OPTION_ARCH +- mmc: sdhci-xenon: fix PHY init clock stability +- mmc: sdhci-xenon: add timeout for PHY init complete +- mmc: core: Fix eMMC initialization with 1-bit bus connection +- mmc: mmci: stm32: fix DMA API overlapping mappings warning +- dmaengine: fsl-qdma: init irq after reg initialization +- dmaengine: fsl-edma: correct calculation of 'nbytes' in multi-fifo scenario +- dmaengine: ptdma: use consistent DMA masks +- crypto: arm64/neonbs - fix out-of-bounds access on short input +- dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read +- soc: qcom: pmic_glink: Fix boot when QRTR=m +- drm/amd/display: Add monitor patch for specific eDP +- drm/buddy: fix range bias +- Revert "drm/amd/pm: resolve reboot exception for si oland" +- btrfs: send: don't issue unnecessary zero writes for trailing hole +- btrfs: dev-replace: properly validate device names +- btrfs: fix double free of anonymous device after snapshot creation failure +- wifi: nl80211: reject iftype change with mesh ID change +- mtd: rawnand: marvell: fix layouts +- gtp: fix use-after-free and null-ptr-deref in gtp_newlink() +- landlock: Fix asymmetric private inodes referring +- Bluetooth: hci_bcm4377: do not mark valid bd_addr as invalid +- ALSA: hda/realtek: Add special fixup for Lenovo 14IRP8 +- ALSA: hda/realtek: fix mute/micmute LED For HP mt440 +- ALSA: hda/realtek: Enable Mute LED on HP 840 G8 (MB 8AB8) +- ALSA: hda/realtek: tas2781: enable subwoofer volume control +- ALSA: ump: Fix the discard error code from snd_ump_legacy_open() +- ALSA: firewire-lib: fix to check cycle continuity +- tomoyo: fix UAF write bug in tomoyo_write_control() +- of: property: fw_devlink: Fix stupid bug in remote-endpoint parsing +- btrfs: fix race between ordered extent completion and fiemap +- riscv: Sparse-Memory/vmemmap out-of-bounds fix +- riscv: Fix pte_leaf_size() for NAPOT +- Revert "riscv: mm: support Svnapot in huge vmap" +- drivers: perf: ctr_get_width function for legacy is not defined +- drivers: perf: added capabilities for legacy PMU +- afs: Fix endless loop in directory parsing +- fbcon: always restore the old font data in fbcon_do_set_font() +- drm/tegra: Remove existing framebuffer only if we support display +- RISC-V: Ignore V from the riscv,isa DT property on older T-Head CPUs +- ASoC: soc-card: Fix missing locking in snd_soc_card_get_kcontrol() +- ASoC: cs35l56: Fix deadlock in ASP1 mixer register initialization +- ASoC: cs35l56: Fix misuse of wm_adsp 'part' string for silicon revision +- ASoC: cs35l56: Fix for initializing ASP1 mixer registers +- ASoC: cs35l56: Don't add the same register patch multiple times +- ASoC: cs35l56: cs35l56_component_remove() must clean up wm_adsp +- ASoC: cs35l56: cs35l56_component_remove() must clear cs35l56->component +- riscv: Fix build error if !CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION +- ASoC: qcom: Fix uninitialized pointer dmactl +- ASoC: qcom: convert not to use asoc_xxx() +- ASoC: soc.h: convert asoc_xxx() to snd_soc_xxx() +- ALSA: Drop leftover snd-rtctimer stuff from Makefile +- ASoC: cs35l56: Must clear HALO_STATE before issuing SYSTEM_RESET +- power: supply: bq27xxx-i2c: Do not free non existing IRQ +- efi/capsule-loader: fix incorrect allocation size +- tls: fix use-after-free on failed backlog decryption +- tls: separate no-async decryption request handling from async +- tls: fix peeking with sync+async decryption +- tls: decrement decrypt_pending if no async completion will be called +- net: hsr: Use correct offset for HSR TLV values in supervisory HSR frames +- igb: extend PTP timestamp adjustments to i211 +- rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back +- tools: ynl: fix handling of multiple mcast groups +- netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate() +- Bluetooth: qca: Fix triggering coredump implementation +- Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT +- Bluetooth: qca: Fix wrong event type for patch config command +- Bluetooth: Enforce validation on max value of connection interval +- Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST +- Bluetooth: hci_event: Fix wrongly recorded wakeup BD_ADDR +- Bluetooth: hci_sync: Fix accept_list when attempting to suspend +- Bluetooth: Avoid potential use-after-free in hci_error_reset +- Bluetooth: hci_sync: Check the correct flag before starting a scan +- stmmac: Clear variable when destroying workqueue +- uapi: in6: replace temporary label with rfc9486 +- net: lan78xx: fix "softirq work is pending" error +- net: usb: dm9601: fix wrong return value in dm9601_mdio_read +- veth: try harder when allocating queue memory +- lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected +- ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() +- net: veth: clear GRO when clearing XDP even when down +- cpufreq: intel_pstate: fix pstate limits enforcement for adjust_perf call back +- tun: Fix xdp_rxq_info's queue_index when detaching +- net: dpaa: fman_memac: accept phy-interface-type = "10gbase-r" in the device tree +- net: mctp: take ownership of skb in mctp_local_output +- net: ip_tunnel: prevent perpetual headroom growth +- netlink: add nla be16/32 types to minlen array +- netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter +- spi: cadence-qspi: fix pointer reference in runtime PM hooks +- mtd: spinand: gigadevice: Fix the get ecc status issue +- ublk: move ublk_cancel_dev() out of ub->mutex +- ksmbd: fix wrong allocation size update in smb2_open() +- ASoC: cs35l34: Fix GPIO name and drop legacy include +- fs/ntfs3: fix build without CONFIG_NTFS3_LZX_XPRESS +- ahci: Extend ASM1061 43-bit DMA address quirk to other ASM106x parts +- ata: ahci: add identifiers for ASM2116 series adapters +- mptcp: add needs_id for netlink appending addr +- mptcp: userspace pm send RM_ADDR for ID 0 +- selftests: mptcp: add mptcp_lib_get_counter +- selftests: mptcp: join: stop transfer when check is done (part 2) +- mm: zswap: fix missing folio cleanup in writeback race path +- mm/zswap: invalidate duplicate entry when !zswap_enabled +- selftests: mptcp: join: stop transfer when check is done (part 1) +- i2c: imx: when being a target, mark the last read as processed +- drm/amd/display: Fix memory leak in dm_sw_fini() +- drm/syncobj: handle NULL fence in syncobj_eventfd_entry_func +- drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set +- net: phy: realtek: Fix rtl8211f_config_init() for RTL8211F(D)(I)-VD-CG PHY +- Fix write to cloned skb in ipv6_hop_ioam() +- phonet/pep: fix racy skb_queue_empty() use +- phonet: take correct lock to peek at the RX queue +- net: sparx5: Add spinlock for frame transmission from CPU +- net/sched: flower: Add lock protection when remove filter handle +- devlink: fix port dump cmd type +- tools: ynl: don't leak mcast_groups on init error +- tools: ynl: make sure we always pass yarg to mnl_cb_run +- net: mctp: put sock on tag allocation failure +- netfilter: nf_tables: use kzalloc for hook allocation +- netfilter: nf_tables: register hooks last when adding new chain/flowtable +- netfilter: nft_flow_offload: release dst in case direct xmit path is used +- netfilter: nft_flow_offload: reset dst in route object after setting up flow +- netfilter: nf_tables: set dormant flag on hook register failure +- tls: don't skip over different type records from the rx_list +- tls: stop recv() if initial process_rx_list gave us non-DATA +- tls: break out of main loop when PEEK gets a non-data record +- hwmon: (nct6775) Fix access to temperature configuration registers +- cache: ax45mp_cache: Align end size to cache boundary in ax45mp_dma_cache_wback() +- bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready() +- s390: use the correct count for __iowrite64_copy() +- net: ipa: don't overrun IPA suspend interrupt registers +- octeontx2-af: Consider the action set by PF +- drm/i915/tv: Fix TV mode +- platform/x86: thinkpad_acpi: Only update profile if successfully converted +- arm64/sme: Restore SMCR_EL1.EZT0 on exit from suspend +- arm64/sme: Restore SME registers on exit from suspend +- arp: Prevent overflow in arp_req_get(). +- devlink: fix possible use-after-free and memory leaks in devlink_init() +- ipv6: sr: fix possible use-after-free and null-ptr-deref +- afs: Increase buffer size in afs_update_volume_status() +- parisc: Fix stack unwinder +- bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel +- ata: ahci_ceva: fix error handling for Xilinx GT PHY support +- selftests: bonding: set active slave to primary eth1 specifically +- powerpc/pseries/iommu: DLPAR add doesn't completely initialize pci_controller +- net: bcmasp: Sanity check is off by one +- net: bcmasp: Indicate MAC is in charge of PHY PM +- ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid +- ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid +- net: stmmac: Fix incorrect dereference in interrupt handlers +- x86/numa: Fix the sort compare func used in numa_fill_memblks() +- x86/numa: Fix the address overlap check in numa_fill_memblks() +- nouveau: fix function cast warnings +- net/sched: act_mirred: don't override retval if we already lost the skb +- net/sched: act_mirred: use the backlog for mirred ingress +- net/sched: act_mirred: Create function tcf_mirred_to_dev and improve readability +- dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished(). +- net: bridge: switchdev: Ensure deferred event delivery on unoffload +- net: bridge: switchdev: Skip MDB replays of deferred events on offload +- scsi: jazz_esp: Only build if SCSI core is builtin +- scsi: smartpqi: Fix disable_managed_interrupts +- bpf, scripts: Correct GPL license name +- RDMA/srpt: fix function pointer cast warnings +- xsk: Add truesize to skb_add_rx_frag(). +- arm64: dts: rockchip: Correct Indiedroid Nova GPIO Names +- arm64: dts: rockchip: set num-cs property for spi on px30 +- RDMA/qedr: Fix qedr_create_user_qp error flow +- bus: imx-weim: fix valid range check +- arm64: dts: tqma8mpql: fix audio codec iov-supply +- RDMA/srpt: Support specifying the srpt_service_guid parameter +- RDMA/irdma: Add AE for too many RNRS +- RDMA/irdma: Set the CQ read threshold for GEN 1 +- RDMA/irdma: Validate max_send_wr and max_recv_wr +- RDMA/irdma: Fix KASAN issue with tasklet +- arm64: dts: imx8mp: Disable UART4 by default on Data Modul i.MX8M Plus eDM SBC +- IB/mlx5: Don't expose debugfs entries for RRoCE general parameters if not supported +- RDMA/bnxt_re: Add a missing check in bnxt_qplib_query_srq +- RDMA/bnxt_re: Return error for SRQ resize +- IB/hfi1: Fix a memleak in init_credit_return +- bpf: Derive source IP addr via bpf_*_fib_lookup() +- xen/events: fix error code in xen_bind_pirq_msi_to_irq() +- Revert "drm/amd/display: increased min_dcfclk_mhz and min_fclk_mhz" +- drm/amd/display: Fix buffer overflow in 'get_host_router_total_dp_tunnel_bw()' +- drm/amd/display: Avoid enum conversion warning +- smb3: add missing null server pointer check +- selftests: mptcp: diag: unique 'cestab' subtest names +- selftests: mptcp: diag: unique 'in use' subtest names +- selftests: mptcp: diag: fix bash warnings on older kernels +- selftests: mptcp: diag: check CURRESTAB counters +- selftests: mptcp: pm nl: avoid error msg on older kernels +- selftests: mptcp: pm nl: also list skipped tests +- selftests: mptcp: simult flows: fix some subtest names +- selftests: mptcp: userspace_pm: unique subtest names +- mptcp: fix duplicate subflow creation +- mptcp: fix data races on remote_id +- mptcp: fix data races on local_id +- mptcp: fix lockless access in subflow ULP diag +- mptcp: add needs_id for userspace appending addr +- usb: roles: don't get/set_role() when usb_role_switch is unregistered +- usb: roles: fix NULL pointer issue when put module's reference +- usb: gadget: omap_udc: fix USB gadget regression on Palm TE +- usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs +- usb: cdns3: fix memory double free when handle zero packet +- usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable() +- usb: cdnsp: fixed issue with incorrect detecting CDNSP family controllers +- usb: cdnsp: blocked some cdns3 specific code +- usb: dwc3: gadget: Don't disconnect if not started +- serial: amba-pl011: Fix DMA transmission in RS485 mode +- serial: stm32: do not always set SER_RS485_RX_DURING_TX if RS485 is enabled +- Revert "usb: typec: tcpm: reset counter when enter into unattached state after try role" +- erofs: fix refcount on the metabuf used for inode lookup +- dm-integrity, dm-verity: reduce stack usage for recheck +- ARM: ep93xx: Add terminator to gpiod_lookup_table +- l2tp: pass correct message length to ip6_append_data +- PCI/MSI: Prevent MSI hardware interrupt number truncation +- irqchip/sifive-plic: Enable interrupt if needed before EOI +- irqchip/gic-v3-its: Do not assume vPE tables are preallocated +- irqchip/mbigen: Don't use bus_get_dev_root() to find the parent +- crypto: virtio/akcipher - Fix stack overflow on memcpy +- gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() +- accel/ivpu: Don't enable any tiles by default on VPU40xx +- KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() +- KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler +- md: Fix missing release of 'active_io' for flush +- sparc: Fix undefined reference to fb_is_primary_device +- platform/x86: touchscreen_dmi: Allow partial (prefix) matches for ACPI names +- platform/x86: intel-vbtn: Stop calling "VBDL" from notify_handler +- mm/damon/reclaim: fix quota stauts loss due to online tunings +- mm: memcontrol: clarify swapaccount=0 deprecation warning +- mm/damon/lru_sort: fix quota status loss due to online tunings +- mm/swap: fix race when skipping swapcache +- selftests/mm: uffd-unit-test check if huge page size is 0 +- scsi: core: Consult supported VPD page list prior to fetching page +- scsi: target: pscsi: Fix bio_put() for error case +- scsi: sd: usb_storage: uas: Access media prior to querying device properties +- cxl/acpi: Fix load failures due to single window creation failure +- dm-verity: recheck the hash after a failure +- dm-crypt: don't modify the data when using authenticated encryption +- dm-integrity: recheck the integrity tag after a failure +- Revert "parisc: Only list existing CPUs in cpu_possible_mask" +- dm-crypt: recheck the integrity tag after a failure +- lib/Kconfig.debug: TEST_IOV_ITER depends on MMU +- fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio +- ata: libata-core: Do not try to set sleeping devices to standby +- s390/cio: fix invalid -EBUSY on ccw_device_start +- drm/amd/display: adjust few initialization order in dm +- drm/meson: Don't remove bridges which are created by other drivers +- drm/ttm: Fix an invalid freeing on already freed page in error path +- btrfs: defrag: avoid unnecessary defrag caused by incorrect extent size +- LoongArch: Update cpu_sibling_map when disabling nonboot CPUs +- LoongArch: Disable IRQ before init_fn() for nonboot CPUs +- LoongArch: Call early_init_fdt_scan_reserved_mem() earlier +- docs: Instruct LaTeX to cope with deeper nesting +- x86/bugs: Add asm helpers for executing VERW +- IB/hfi1: Fix sdma.h tx->num_descs off-by-one error +- xen/events: close evtchn after mapping cleanup +- xen/events: modify internal [un]bind interfaces +- xen/events: drop xen_allocate_irqs_dynamic() +- xen/events: remove some simple helpers from events_base.c +- xen/events: reduce externally visible helper functions +- xen: evtchn: Allow shared registration of IRQ handers +- drm/amd/display: fixed integer types and null check locations +- drm/amd/display: Request usb4 bw for mst streams +- drm/amd/display: Add dpia display mode validation logic +- mptcp: corner case locking for rx path fields initialization +- mptcp: fix more tx path fields initialization +- mptcp: use mptcp_set_state +- mptcp: add CurrEstab MIB counter support +- smb3: clarify mount warning +- cifs: handle cases where multiple sessions share connection +- cifs: change tcon status when need_reconnect is set on it +- virtio-blk: Ensure no requests in virtqueues before deleting vqs. +- smb: client: set correct d_type for reparse points under DFS mounts +- drm/amdgpu: Fix HDP flush for VFs on nbio v7.9 +- drm/amdgpu: Fix shared buff copy to user +- drm/amdgpu: reset gpu for s3 suspend abort case +- drm/amdgpu: skip to program GFXDEC registers for suspend abort +- libceph: fail sparse-read if the data length doesn't match +- firewire: core: send bus reset promptly on gap count error +- accel/ivpu/40xx: Stop passing SKU boot parameters to FW +- accel/ivpu: Disable d3hot_delay on all NPU generations +- accel/ivpu: Force snooping for MMU writes +- LoongArch: vDSO: Disable UBSAN instrumentation +- LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC] +- LoongArch: Select HAVE_ARCH_SECCOMP to use the common SECCOMP menu +- LoongArch: Select ARCH_ENABLE_THP_MIGRATION instead of redefining it +- scsi: ufs: core: Remove the ufshcd_release() in ufshcd_err_handling_prepare() +- scsi: ufs: core: Fix shift issue in ufshcd_clear_cmd() +- scsi: lpfc: Use unsigned type for num_sge +- hwmon: (coretemp) Enlarge per package core count limit +- efi: Don't add memblocks for soft-reserved memory +- efi: runtime: Fix potential overflow of soft-reserved region size +- wifi: iwlwifi: do not announce EPCS support +- wifi: mac80211: accept broadcast probe responses on 6 GHz +- wifi: mac80211: adding missing drv_mgd_complete_tx() call +- wifi: mac80211: set station RX-NSS on reconfig +- fs/ntfs3: Fix oob in ntfs_listxattr +- fs/ntfs3: Update inode->i_size after success write into compressed file +- fs/ntfs3: Fixed overflow check in mi_enum_attr() +- fs/ntfs3: Correct function is_rst_area_valid +- fs/ntfs3: Use i_size_read and i_size_write +- fs/ntfs3: Prevent generic message "attempt to access beyond end of device" +- fs/ntfs3: use non-movable memory for ntfs3 MFT buffer cache +- fs/ntfs3: Use kvfree to free memory allocated by kvmalloc +- fs/ntfs3: Disable ATTR_LIST_ENTRY size check +- fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame() +- fs/ntfs3: ntfs3_forced_shutdown use int instead of bool +- fs/ntfs3: Implement super_operations::shutdown +- fs/ntfs3: Drop suid and sgid bits as a part of fpunch +- fs/ntfs3: Add file_modified +- fs/ntfs3: Fix detected field-spanning write (size 8) of single field "le->name" +- fs/ntfs3: Fix multithreaded stress test +- fs/ntfs3: Reduce stack usage +- fs/ntfs3: Print warning while fixing hard links count +- fs/ntfs3: Correct hard links updating when dealing with DOS names +- fs/ntfs3: Improve ntfs_dir_count +- fs/ntfs3: Modified fix directory element type detection +- fs/ntfs3: Improve alternative boot processing +- Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table +- ext4: correct the hole length returned by ext4_map_blocks() +- smb: client: increase number of PDUs allowed in a compound request +- cifs: do not search for channel if server is terminating +- nvmet-fc: take ref count on tgtport before delete assoc +- nvmet-fc: avoid deadlock on delete association path +- nvmet-fc: abort command when there is no binding +- nvmet-fc: hold reference on hostport match +- nvmet-fc: defer cleanup using RCU properly +- nvmet-fc: release reference on target port +- nvmet-fcloop: swap the list_add_tail arguments +- nvme-fc: do not wait in vain when unloading module +- ALSA: usb-audio: Ignore clock selector errors for single connection +- ASoC: wm_adsp: Don't overwrite fwf_name with the default +- cifs: make sure that channel scaling is done only once +- drm/amd/display: increased min_dcfclk_mhz and min_fclk_mhz +- drm/amdkfd: Use correct drm device for cgroup permission check +- netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new +- misc: open-dice: Fix spurious lockdep warning +- Input: xpad - add Lenovo Legion Go controllers +- spi: sh-msiof: avoid integer overflow in constants +- regulator (max5970): Fix IRQ handler +- ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616 +- ALSA: usb-audio: Check presence of valid altsetting control +- usb: ucsi_acpi: Quirk to ack a connector change ack cmd +- nvmet-tcp: fix nvme tcp ida memory leak +- HID: nvidia-shield: Add missing null pointer checks to LED initialization +- ALSA: hda: Increase default bdl_pos_adj for Apollo Lake +- ALSA: hda: Replace numeric device IDs with constant values +- HID: logitech-hidpp: add support for Logitech G Pro X Superlight 2 +- regulator: pwm-regulator: Add validity checks in continuous .get_voltage +- ASoC: amd: acp: Add check for cpu dai link initialization +- dmaengine: ti: edma: Add some null pointer checks to the edma_probe +- Input: goodix - accept ACPI resources with gpio_count == 3 && gpio_int_idx == 0 +- ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() +- ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() +- ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt +- platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus tablet +- MIPS: reserve exception vector space ONLY ONCE +- ARM: dts: Fix TPM schema violations +- ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers +- spi: cs42l43: Handle error from devm_pm_runtime_enable +- aoe: avoid potential deadlock at set_capacity +- ahci: asm1166: correct count of reported ports +- cifs: helper function to check replayable error codes +- cifs: translate network errors on send to -ECONNABORTED +- cifs: cifs_pick_channel should try selecting active channels +- smb: Work around Clang __bdos() type confusion +- block: Fix WARNING in _copy_from_iter +- spi: intel-pci: Add support for Arrow Lake SPI serial flash +- platform/mellanox: mlxbf-tmfifo: Drop Tx network packet when Tx TmFIFO is full +- fbdev: sis: Error out if pixclock equals zero +- fbdev: savage: Error out if pixclock equals zero +- wifi: mac80211: fix race condition on enabling fast-xmit +- wifi: cfg80211: fix missing interfaces when dumping +- dmaengine: dw-edma: increase size of 'name' in debugfs code +- dmaengine: fsl-qdma: increase size of 'irq_name' +- dmaengine: shdma: increase size of 'dev_id' +- cifs: open_cached_dir should not rely on primary channel +- scsi: target: core: Add TMF to tmr_list handling +- tools: selftests: riscv: Fix compile warnings in mm tests +- tools: selftests: riscv: Fix compile warnings in vector tests +- scsi: smartpqi: Fix logical volume rescan race condition +- scsi: smartpqi: Add new controller PCI IDs +- dmaengine: apple-admac: Keep upper bits of REG_BUS_WIDTH +- riscv/efistub: Ensure GP-relative addressing is not used +- PCI: dwc: Fix a 64bit bug in dw_pcie_ep_raise_msix_irq() +- sched/rt: Disallow writing invalid values to sched_rt_period_us +- tracing: Fix a NULL vs IS_ERR() bug in event_subsystem_dir() +- tracing: Make system_callback() function static +- Documentation/arch/ia64/features.rst: fix kernel-feat directive +- nilfs2: fix potential bug in end_buffer_async_write +- of: property: Add in-ports/out-ports support to of_graph_get_port_parent() +- sched/membarrier: reduce the ability to hammer on sys_membarrier +- x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section +- x86/boot: Increase section and file alignment to 4k/512 +- x86/boot: Split off PE/COFF .data section +- x86/boot: Drop PE/COFF .reloc section +- x86/boot: Construct PE/COFF .text section from assembler +- x86/boot: Derive file size from _edata symbol +- x86/boot: Define setup size in linker script +- x86/boot: Set EFI handover offset directly in header asm +- x86/boot: Grab kernel_info offset from zoffset header directly +- x86/boot: Drop references to startup_64 +- x86/boot: Drop redundant code setting the root device +- x86/boot: Omit compression buffer from PE/COFF image memory footprint +- x86/boot: Remove the 'bugger off' message +- x86/efi: Drop alignment flags from PE section headers +- x86/efi: Disregard setup header of loaded image +- x86/efi: Drop EFI stub .bss from .data section +- nfsd: don't take fi_lock in nfsd_break_deleg_cb() +- eventfs: Keep all directory links at 1 +- eventfs: Remove fsnotify*() functions from lookup() +- eventfs: Restructure eventfs_inode structure to be more condensed +- eventfs: Warn if an eventfs_inode is freed without is_freed being set +- eventfs: Get rid of dentry pointers without refcounts +- eventfs: Clean up dentry ops and add revalidate function +- eventfs: Remove unused d_parent pointer field +- tracefs: dentry lookup crapectomy +- tracefs: Avoid using the ei->dentry pointer unnecessarily +- eventfs: Initialize the tracefs inode properly +- tracefs: Zero out the tracefs_inode when allocating it +- tracefs: remove stale update_gid code +- eventfs: Save directory inodes in the eventfs_inode structure +- eventfs: Use kcalloc() instead of kzalloc() +- eventfs: Do not create dentries nor inodes in iterate_shared +- eventfs: Have the inodes all for files and directories all be the same +- eventfs: Shortcut eventfs_iterate() by skipping entries already read +- eventfs: Read ei->entries before ei->children in eventfs_iterate() +- eventfs: Do ctx->pos update for all iterations in eventfs_iterate() +- eventfs: Have eventfs_iterate() stop immediately if ei->is_freed is set +- tracefs/eventfs: Use root and instance inodes as default ownership +- eventfs: Stop using dcache_readdir() for getdents() +- eventfs: Remove "lookup" parameter from create_dir/file_dentry() +- eventfs: Fix bitwise fields for "is_events" +- tracefs: Check for dentry->d_inode exists in set_gid() +- eventfs: Fix file and directory uid and gid ownership +- eventfs: Have event files and directories default to parent uid and gid +- eventfs: Fix events beyond NAME_MAX blocking tasks +- eventfs: Make sure that parent->d_inode is locked in creating files/dirs +- eventfs: Do not allow NULL parent to eventfs_start_creating() +- eventfs: Move taking of inode_lock into dcache_dir_open_wrapper() +- eventfs: Use GFP_NOFS for allocation when eventfs_mutex is held +- eventfs: Do not invalidate dentry in create_file/dir_dentry() +- eventfs: Remove expectation that ei->is_freed means ei->dentry == NULL +- eventfs: Use simple_recursive_removal() to clean up dentries +- eventfs: Remove special processing of dput() of events directory +- eventfs: Delete eventfs_inode when the last dentry is freed +- eventfs: Hold eventfs_mutex when calling callback functions +- eventfs: Save ownership and mode +- eventfs: Test for ei->is_freed when accessing ei->dentry +- eventfs: Have a free_ei() that just frees the eventfs_inode +- eventfs: Remove "is_freed" union with rcu head +- eventfs: Fix kerneldoc of eventfs_remove_rec() +- eventfs: Remove extra dget() in eventfs_create_events_dir() +- eventfs: Fix typo in eventfs_inode union comment +- eventfs: Fix WARN_ON() in create_file_dentry() +- tracefs/eventfs: Modify mismatched function name +- eventfs: Fix failure path in eventfs_create_events_dir() +- eventfs: Use ERR_CAST() in eventfs_create_events_dir() +- eventfs: Use eventfs_remove_events_dir() +- eventfs: Remove eventfs_file and just use eventfs_inode +- Revert "eventfs: Remove "is_freed" union with rcu head" +- Revert "eventfs: Save ownership and mode" +- Revert "eventfs: Delete eventfs_inode when the last dentry is freed" +- Revert "eventfs: Use simple_recursive_removal() to clean up dentries" +- Revert "eventfs: Check for NULL ef in eventfs_set_attr()" +- Revert "eventfs: Do not allow NULL parent to eventfs_start_creating()" +- parisc: Fix random data corruption from exception handler +- netfilter: ipset: Missing gc cancellations fixed +- netfilter: ipset: fix performance regression in swap operation +- block: fix partial zone append completion handling in req_bio_endio() +- tracing: Inform kmemleak of saved_cmdlines allocation +- tracing: Fix HAVE_DYNAMIC_FTRACE_WITH_REGS ifdef +- fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() +- pmdomain: core: Move the unused cleanup to a _sync initcall +- can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) +- can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock +- can: netlink: Fix TDCO calculation using the old data bittiming +- of: property: fix typo in io-channels +- docs: kernel_feat.py: fix build error for missing files +- blk-wbt: Fix detection of dirty-throttled tasks +- LoongArch: Fix earlycon parameter if KASAN enabled +- mm: hugetlb pages should not be reserved by shmat() if SHM_NORESERVE +- ceph: prevent use-after-free in encode_cap_msg() +- hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed +- net: stmmac: protect updates of 64-bit statistics counters +- pmdomain: renesas: r8a77980-sysc: CR7 must be always on +- net: ethernet: ti: cpsw_new: enable mac_managed_pm to fix mdio +- s390/qeth: Fix potential loss of L3-IP@ in case of network issues +- net: ethernet: ti: cpsw: enable mac_managed_pm to fix mdio +- fs: relax mount_setattr() permission checks +- tools/rtla: Fix Makefile compiler options for clang +- tools/rtla: Fix uninitialized bucket/data->bucket_size warning +- tools/rtla: Exit with EXIT_SUCCESS when help is invoked +- tools/rtla: Fix clang warning about mount_point var size +- tools/rtla: Replace setting prio with nice for SCHED_OTHER +- tools/rtla: Remove unused sched_getattr() function +- tools/rv: Fix Makefile compiler options for clang +- tools/rv: Fix curr_reactor uninitialized variable +- ASoC: amd: yc: Add DMI quirk for Lenovo Ideapad Pro 5 16ARP8 +- ASoC: tas2781: add module parameter to tascodec_init() +- ASoC: SOF: IPC3: fix message bounds on ipc ops +- arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata +- arm64/signal: Don't assume that TIF_SVE means we saved SVE state +- mmc: sdhci-pci-o2micro: Fix a warm reboot issue that disk can't be detected by BIOS +- zonefs: Improve error handling +- KVM: arm64: Fix circular locking dependency +- smb: Fix regression in writes when non-standard maximum write size negotiated +- smb: client: set correct id, uid and cruid for multiuser automounts +- thunderbolt: Fix setting the CNS bit in ROUTER_CS_5 +- irqchip/gic-v3-its: Fix GICv4.1 VPE affinity update +- irqchip/gic-v3-its: Restore quirk probing for ACPI-based systems +- irqchip/irq-brcmstb-l2: Add write memory barrier before exit +- wifi: iwlwifi: mvm: fix a crash when we run out of stations +- wifi: mac80211: reload info pointer in ieee80211_tx_dequeue() +- wifi: cfg80211: fix wiphy delayed work queueing +- wifi: iwlwifi: fix double-free bug +- nfp: flower: prevent re-adding mac index for bonded port +- nfp: enable NETDEV_XDP_ACT_REDIRECT feature flag +- nfp: use correct macro for LengthSelect in BAR config +- crypto: algif_hash - Remove bogus SGL free on zero-length error path +- crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked +- nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() +- nilfs2: fix data corruption in dsync block recovery for small block sizes +- ALSA: hda/realtek: add IDs for Dell dual spk platform +- ALSA: hda/conexant: Add quirk for SWS JS201D +- ALSA: hda/realtek: fix mute/micmute LED For HP mt645 +- mmc: slot-gpio: Allow non-sleeping GPIO ro +- io_uring/net: fix multishot accept overflow handling +- x86/mm/ident_map: Use gbpages only where full GB page should be mapped. +- KVM: x86/pmu: Fix type length error when reading pmu->fixed_ctr_ctrl +- KVM: x86: make KVM_REQ_NMI request iff NMI pending for vcpu +- x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6 +- serial: mxs-auart: fix tx +- serial: core: introduce uart_port_tx_flags() +- powerpc/pseries: fix accuracy of stolen time +- powerpc/cputable: Add missing PPC_FEATURE_BOOKE on PPC64 Book-E +- powerpc/64: Set task pt_regs->link to the LR value on scv entry +- ftrace: Fix DIRECT_CALLS to use SAVE_REGS by default +- serial: max310x: prevent infinite while() loop in port startup +- serial: max310x: fail probe if clock crystal is unstable +- serial: max310x: improve crystal stable clock detection +- serial: max310x: set default value when reading clock ready bit +- nfp: flower: fix hardware offload for the transfer layer port +- nfp: flower: add hardware offload check for post ct entry +- net: dsa: mv88e6xxx: Fix failed probe due to unsupported C45 reads +- ring-buffer: Clean ring_buffer_poll_wait() error return +- hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove +- drm/amd/display: Preserve original aspect ratio in create stream +- drm/amd/display: Increase frame-larger-than for all display_mode_vba files +- drm/amd/display: Fix MST Null Ptr for RV +- drm/amdgpu/soc21: update VCN 4 max HEVC encoding resolution +- drm/prime: Support page array >= 4GB +- drm/amd/display: Add align done check +- drm/msm: Wire up tlb ops +- ksmbd: free aux buffer if ksmbd_iov_pin_rsp_read fails +- media: rc: bpf attach/detach requires write permission +- pmdomain: mediatek: fix race conditions with genpd +- iio: pressure: bmp280: Add missing bmp085 to SPI id table +- iio: imu: bno055: serdev requires REGMAP +- iio: imu: adis: ensure proper DMA alignment +- iio: adc: ad_sigma_delta: ensure proper DMA alignment +- iio: accel: bma400: Fix a compilation problem +- iio: commom: st_sensors: ensure proper DMA alignment +- iio: core: fix memleak in iio_device_register_sysfs +- iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC +- staging: iio: ad5933: fix type mismatch regression +- tracing/probes: Fix to search structure fields correctly +- tracing/probes: Fix to set arg size and fmt after setting type from BTF +- tracing/probes: Fix to show a parse error for bad type for $comm +- tracing/synthetic: Fix trace_string() return value +- tracing: Fix wasted memory in saved_cmdlines logic +- tracing/timerlat: Move hrtimer_init to timerlat_fd open() +- ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks() +- ext4: fix double-free of blocks due to wrong extents moved_len +- misc: fastrpc: Mark all sessions as invalid in cb_remove +- binder: signal epoll threads of self-work +- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power +- ALSA: hda/cs8409: Suppress vmaster control for Dolphin models +- ASoC: codecs: wcd938x: handle deferred probe +- ALSA: hda/realtek - Add speaker pin verbtable for Dell dual speaker platform +- ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL +- usb: typec: tpcm: Fix issues with power being removed during reset +- modpost: Add '.ltext' and '.ltext.*' to TEXT_SECTIONS +- linux/init: remove __memexit* annotations +- um: Fix adding '-no-pie' for clang +- xen-netback: properly sync TX responses +- parisc: BTLB: Fix crash when setting up BTLB at CPU bringup +- net: stmmac: do not clear TBS enable bit on link up/down +- net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame() +- nfc: nci: free rx_data_reassembly skb on NCI device cleanup +- kbuild: Fix changing ELF file type for output of gen_btf for big endian +- ALSA: hda/realtek: Apply headset jack quirk for non-bass alc287 thinkpads +- firewire: core: correct documentation of fw_csr_string() kernel API +- lsm: fix the logic in security_inode_getsecctx() +- lsm: fix default return value of the socket_getpeersec_*() hooks +- drm/amd: Don't init MEC2 firmware when it fails to load +- drm/amdgpu: Reset IH OVERFLOW_CLEAR bit +- drm/virtio: Set segment size for virtio_gpu device +- connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" +- Revert "drm/msm/gpu: Push gpu lock down past runpm" +- Revert "drm/amd: flush any delayed gfxoff on suspend entry" +- scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" +- media: Revert "media: rkisp1: Drop IRQF_SHARED" +- Revert "powerpc/pseries/iommu: Fix iommu initialisation during DLPAR add" +- mptcp: really cope with fastopen race +- mptcp: check addrs list in userspace_pm_get_local_id +- mptcp: fix rcv space initialization +- mptcp: drop the push_pending field +- selftests: mptcp: add mptcp_lib_kill_wait +- selftests: mptcp: allow changing subtests prefix +- selftests: mptcp: increase timeout to 30 min +- selftests: mptcp: add missing kconfig for NF Mangle +- selftests: mptcp: add missing kconfig for NF Filter in v6 +- selftests: mptcp: add missing kconfig for NF Filter +- mptcp: fix data re-injection from stale subflow +- kallsyms: ignore ARMv4 thunks along with others +- modpost: trim leading spaces when processing source files list +- i2c: i801: Fix block process call transactions +- i2c: pasemi: split driver into two separate modules +- powerpc/kasan: Limit KASAN thread size increase to 32KB +- irqchip/gic-v3-its: Handle non-coherent GICv4 redistributors +- i2c: qcom-geni: Correct I2C TRE sequence +- cifs: fix underflow in parse_server_interfaces() +- iio: adc: ad4130: only set GPIO_CTRL if pin is unused +- iio: adc: ad4130: zero-initialize clock init data +- PCI: Fix active state requirement in PME polling +- Revert "kobject: Remove redundant checks for whether ktype is NULL" +- powerpc/kasan: Fix addr error caused by page alignment +- powerpc/6xx: set High BAT Enable flag on G2_LE cores +- powerpc/pseries/iommu: Fix iommu initialisation during DLPAR add +- driver core: fw_devlink: Improve detection of overlapping cycles +- media: ir_toy: fix a memleak in irtoy_tx +- interconnect: qcom: sm8550: Enable sync_state +- interconnect: qcom: sc8180x: Mark CO0 BCM keepalive +- usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend +- usb: core: Prevent null pointer dereference in update_port_device_state +- usb: chipidea: core: handle power lost in workqueue +- usb: f_mass_storage: forbid async queue when shutdown happen +- USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT +- usb: ucsi_acpi: Fix command completion handling +- usb: ulpi: Fix debugfs directory leak +- usb: ucsi: Add missing ppm_lock +- iio: hid-sensor-als: Return 0 for HID_USAGE_SENSOR_TIME_TIMESTAMP +- HID: wacom: Do not register input devices until after hid_hw_start +- HID: wacom: generic: Avoid reporting a serial of '0' to userspace +- HID: i2c-hid-of: fix NULL-deref on failed power up +- HID: bpf: actually free hdev memory after attaching a HID-BPF program +- HID: bpf: remove double fdget() +- ALSA: hda/realtek: Enable Mute LED on HP Laptop 14-fq0xxx +- ALSA: hda/realtek: Fix the external mic not being recognised for Acer Swift 1 SF114-32 +- parisc: Prevent hung tasks when printing inventory on serial console +- ASoC: amd: yc: Add DMI quirk for MSI Bravo 15 C7VF +- dm-crypt, dm-verity: disable tasklets +- nouveau: offload fence uevents work to workqueue +- scsi: storvsc: Fix ring buffer size calculation +- selftests: mm: fix map_hugetlb failure on 64K page size systems +- selftests/mm: Update va_high_addr_switch.sh to check CPU for la57 flag +- mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again +- selftests/mm: switch to bash from sh +- tracing/trigger: Fix to return error if failed to alloc snapshot +- scs: add CONFIG_MMU dependency for vfree_atomic() +- selftests/mm: ksm_tests should only MADV_HUGEPAGE valid memory +- userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb +- i40e: Fix waiting for queues of all VSIs to be disabled +- i40e: Do not allow untrusted VF to remove administratively set MAC +- mm/memory: Use exception ip to search exception tables +- ptrace: Introduce exception_ip arch hook +- MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler +- nouveau/svm: fix kvcalloc() argument order +- net: sysfs: Fix /sys/class/net/ path for statistics +- ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work() +- spi: ppc4xx: Drop write-only variable +- net: tls: fix returned read length with async decrypt +- net: tls: fix use-after-free with partial reads and async decrypt +- net: tls: handle backlogging of crypto requests +- tls: fix race between tx work scheduling and socket close +- tls: fix race between async notify and socket close +- net: tls: factor out tls_*crypt_async_wait() +- tls: extract context alloc/initialization out of tls_set_sw_offload +- lan966x: Fix crash when adding interface under a lag +- net: openvswitch: limit the number of recursions from action sets +- selftests: forwarding: Fix bridge locked port test flakiness +- selftests: forwarding: Suppress grep warnings +- selftests: bridge_mdb: Use MDB get instead of dump +- selftests: forwarding: Fix bridge MDB test flakiness +- selftests: forwarding: Fix layer 2 miss test flakiness +- selftests: net: Fix bridge backup port test flakiness +- selftests/net: convert test_bridge_backup_port.sh to run it in unique namespace +- perf: CXL: fix mismatched cpmu event opcode +- ALSA: hda/cs35l56: select intended config FW_CS_DSP +- of: property: Improve finding the supplier of a remote-endpoint property +- of: property: Improve finding the consumer of a remote-endpoint property +- devlink: Fix command annotation documentation +- bonding: do not report NETDEV_XDP_ACT_XSK_ZEROCOPY +- net/handshake: Fix handshake_req_destroy_test1 +- ASoC: SOF: ipc3-topology: Fix pipeline tear down logic +- wifi: iwlwifi: uninitialized variable in iwl_acpi_get_ppag_table() +- wifi: iwlwifi: Fix some error codes +- KVM: selftests: Fix a semaphore imbalance in the dirty ring logging test +- spi: imx: fix the burst length at DMA mode and CPU mode +- drm/msm/gem: Fix double resv lock aquire +- of: unittest: Fix compile in the non-dynamic case +- KVM: selftests: Avoid infinite loop in hyperv_features when invtsc is missing +- KVM: selftests: Delete superfluous, unused "stage" variable in AMX test +- selftests/landlock: Fix fs_test build with old libc +- driver core: Fix device_link_flag_is_sync_state_only() +- btrfs: don't drop extent_map for free space inode on write error +- btrfs: reject encoded write if inode has nodatasum flag set +- btrfs: don't reserve space for checksums when writing to nocow files +- btrfs: send: return EOPNOTSUPP on unknown flags +- btrfs: forbid deleting live subvol qgroup +- btrfs: do not ASSERT() if the newly created subvolume already got read +- btrfs: forbid creating subvol qgroups +- btrfs: do not delete unused block group if it may be used soon +- btrfs: add and use helper to check if block group is used +- update workarounds for gcc "asm goto" issue +- work around gcc bugs with 'asm goto' with outputs +- netfilter: nft_set_rbtree: skip end interval element from gc +- net: stmmac: xgmac: fix a typo of register name in DPP safety handling +- ALSA: usb-audio: Sort quirk table entries +- net: stmmac: xgmac: use #define for string constants +- io_uring/net: limit inline multishot retries +- io_uring/poll: add requeue return code from poll multishot handling +- io_uring/net: un-indent mshot retry path in io_recv_finish() +- io_uring/poll: move poll execution helpers higher up +- io_uring/net: fix sr->len for IORING_OP_RECV with MSG_WAITALL and buffers +- media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c) +- Revert "ASoC: amd: Add new dmi entries for acp5x platform" +- Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID +- Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU +- hrtimer: Report offline hrtimer enqueue +- usb: dwc3: pci: add support for the Intel Arrow Lake-H +- xhci: handle isoc Babble and Buffer Overrun events properly +- xhci: process isoc TD properly when there was a transaction error mid TD. +- usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK +- usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK +- x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups +- Revert "usb: typec: tcpm: fix cc role at port reset" +- USB: serial: cp210x: add ID for IMST iM871A-USB +- USB: serial: option: add Fibocom FM101-GL variant +- USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e +- ALSA: usb-audio: add quirk for RODE NT-USB+ +- ALSA: usb-audio: Add a quirk for Yamaha YIT-W12TX transmitter +- ALSA: usb-audio: Add delay quirk for MOTU M Series 2nd revision +- blk-iocost: Fix an UBSAN shift-out-of-bounds warning +- riscv: declare overflow_stack as exported from traps.c +- riscv: Fix arch_hugetlb_migration_supported() for NAPOT +- libceph: just wait for more data to be available on the socket +- libceph: rename read_sparse_msg_*() to read_partial_sparse_msg_*() +- riscv: Flush the tlb when a page directory is freed +- scsi: core: Move scsi_host_busy() out of host lock if it is for per-command +- riscv: Fix hugetlb_mask_last_page() when NAPOT is enabled +- riscv: Fix set_huge_pte_at() for NAPOT mapping +- riscv: mm: execute local TLB flush after populating vmemmap +- mm: Introduce flush_cache_vmap_early() +- riscv: Improve flush_tlb_kernel_range() +- riscv: Make __flush_tlb_range() loop over pte instead of flushing the whole tlb +- riscv: Improve tlb_flush() +- fs/ntfs3: Fix an NULL dereference bug +- netfilter: nft_set_pipapo: remove scratch_aligned pointer +- netfilter: nft_set_pipapo: add helper to release pcpu scratch area +- netfilter: nft_set_pipapo: store index in scratch maps +- netfilter: nft_ct: reject direction for ct id +- drm/amd/display: Implement bounds check for stream encoder creation in DCN301 +- drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()' +- drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()' +- netfilter: nft_compat: restrict match/target protocol to u16 +- netfilter: nft_compat: reject unused compat flag +- netfilter: nft_compat: narrow down revision to unsigned 8-bits +- selftests: cmsg_ipv6: repeat the exact packet +- ppp_async: limit MRU to 64K +- af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC. +- tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() +- selftests: net: let big_tcp test cope with slow env +- rxrpc: Fix counting of new acks and nacks +- rxrpc: Fix response to PING RESPONSE ACKs to a dead call +- rxrpc: Fix delayed ACKs to not set the reference serial number +- rxrpc: Fix generation of serial numbers to skip zero +- drm/i915/gvt: Fix uninitialized variable in handle_mmio() +- inet: read sk->sk_family once in inet_recv_error() +- hwmon: (coretemp) Fix bogus core_id to attr name mapping +- hwmon: (coretemp) Fix out-of-bounds memory access +- hwmon: (aspeed-pwm-tacho) mutex for tach reading +- octeontx2-pf: Fix a memleak otx2_sq_init +- atm: idt77252: fix a memleak in open_card_ubr0 +- tunnels: fix out of bounds access when building IPv6 PMTU error +- tsnep: Fix mapping for zero copy XDP_TX action +- selftests: net: avoid just another constant wait +- selftests: net: fix tcp listener handling in pmtu.sh +- selftests/net: change shebang to bash to support "source" +- selftests/net: convert pmtu.sh to run it in unique namespace +- selftests/net: convert unicast_extensions.sh to run it in unique namespace +- selftests: net: cut more slack for gro fwd tests. +- net: atlantic: Fix DMA mapping for PTP hwts ring +- netdevsim: avoid potential loop in nsim_dev_trap_report_work() +- wifi: brcmfmac: Adjust n_channels usage for __counted_by +- wifi: iwlwifi: exit eSR only after the FW does +- wifi: mac80211: fix waiting for beacons logic +- wifi: mac80211: fix RCU use in TDLS fast-xmit +- net: stmmac: xgmac: fix handling of DPP safety error for DMA channels +- x86/efistub: Avoid placing the kernel below LOAD_PHYSICAL_ADDR +- x86/efistub: Give up if memory attribute protocol returns an error +- drm/msm/dpu: check for valid hw_pp in dpu_encoder_helper_phys_cleanup +- drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case +- drm/msms/dp: fixed link clock divider bits be over written in BPC unknown case +- xfs: respect the stable writes flag on the RT device +- xfs: clean up FS_XFLAG_REALTIME handling in xfs_ioctl_setattr_xflags +- xfs: dquot recovery does not validate the recovered dquot +- xfs: clean up dqblk extraction +- xfs: inode recovery does not validate the recovered inode +- xfs: fix again select in kconfig XFS_ONLINE_SCRUB_STATS +- xfs: fix internal error from AGFL exhaustion +- xfs: up(ic_sema) if flushing data device fails +- xfs: only remap the written blocks in xfs_reflink_end_cow_extent +- xfs: allow read IO and FICLONE to run concurrently +- xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space +- xfs: introduce protection for drop nlink +- xfs: make sure maxlen is still congruent with prod when rounding down +- xfs: fix units conversion error in xfs_bmap_del_extent_delay +- xfs: rt stubs should return negative errnos when rt disabled +- xfs: prevent rt growfs when quota is enabled +- xfs: hoist freeing of rt data fork extent mappings +- xfs: bump max fsgeom struct version +- MAINTAINERS: add Catherine as xfs maintainer for 6.6.y +- rust: upgrade to Rust 1.73.0 +- rust: print: use explicit link in documentation +- rust: task: remove redundant explicit link +- rust: upgrade to Rust 1.72.1 +- rust: arc: add explicit `drop()` around `Box::from_raw()` +- cifs: failure to add channel on iface should bump up weight +- cifs: avoid redundant calls to disable multichannel +- phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP +- dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV +- perf evlist: Fix evlist__new_default() for > 1 core PMU +- phy: renesas: rcar-gen3-usb2: Fix returning wrong error code +- dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA +- dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA +- dmaengine: ti: k3-udma: Report short packet errors +- dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools +- pds_core: Prevent health thread from running during reset/remove +- drm/amdgpu: Fix missing error code in 'gmc_v6/7/8/9_0_hw_init()' +- ASoC: codecs: wsa883x: fix PA volume control +- ASoC: codecs: lpass-wsa-macro: fix compander volume hack +- ASoC: codecs: wcd938x: fix headphones volume controls +- ASoC: qcom: sc8280xp: limit speaker volumes +- bonding: remove print in bond_verify_device_path +- selftests/bpf: Remove flaky test_btf_id test +- LoongArch/smp: Call rcutree_report_cpu_starting() at tlb_init() +- drm/msm/dsi: Enable runtime PM +- Revert "drm/amd/display: Disable PSR-SU on Parade 0803 TCON again" +- mm, kmsan: fix infinite recursion due to RCU critical section +- arm64: irq: set the correct node for shadow call stack +- selftests: net: enable some more knobs +- selftests: net: add missing config for NF_TARGET_TTL +- selftests: bonding: Check initial state +- selftests: team: Add missing config options +- net: sysfs: Fix /sys/class/net/ path +- octeontx2-pf: Remove xdp queues on program detach +- selftests: net: don't access /dev/stdout in pmtu.sh +- selftests: net: fix available tunnels detection +- selftests: net: add missing config for pmtu.sh tests +- selftests: net: add missing config for nftables-backed iptables +- pds_core: Rework teardown/setup flow to be more common +- pds_core: Clear BARs on reset +- pds_core: Prevent race issues involving the adminq +- pds_core: implement pci reset handlers +- pds_core: Use struct pdsc for the pdsc_adminq_isr private data +- pds_core: Cancel AQ work on teardown +- af_unix: fix lockdep positive in sk_diag_dump_icons() +- net: ipv4: fix a memleak in ip_setup_cork +- netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations +- netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger +- netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV +- netfilter: conntrack: correct window scaling with retransmitted SYN +- selftests: net: add missing config for GENEVE +- devlink: Fix referring to hw_addr attribute during state validation +- bridge: mcast: fix disabled snooping after long uptime +- selftests: net: Add missing matchall classifier +- llc: call sock_orphan() at release time +- ipv6: Ensure natural alignment of const ipv6 loopback and router addresses +- net: dsa: qca8k: fix illegal usage of GPIO +- ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550() +- ixgbe: Refactor overtemp event handling +- ixgbe: Refactor returning internal error codes +- e1000e: correct maximum frequency adjustment values +- tcp: add sanity checks to rx zerocopy +- net: lan966x: Fix port configuration when using SGMII interface +- ipmr: fix kernel panic when forwarding mcast packets +- net: dsa: mt7530: fix 10M/100M speed on MT7988 switch +- ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() +- selftests: net: give more time for GRO aggregation +- selftests: net: add missing required classifier +- selftests: net: add missing config for big tcp tests +- net: phy: mediatek-ge-soc: sync driver with MediaTek SDK +- net: ethernet: mtk_eth_soc: set DMA coherent mask to get PPE working +- gve: Fix skb truesize underestimation +- selftests: net: explicitly wait for listener ready +- selftests: net: remove dependency on ebpf tests +- HID: hidraw: fix a problem of memory leak in hidraw_release() +- scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler +- regulator: ti-abb: don't use devm_platform_ioremap_resource_byname for shared interrupt register +- kunit: run test suites only after module initialization completes +- scsi: isci: Fix an error code problem in isci_io_request_build() +- riscv: Fix build error on rv32 + XIP +- drm/amdkfd: only flush mes process context if mes support is there +- drm: using mul_u32_u32() requires linux/math64.h +- wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update +- perf: Fix the nr_addr_filters fix +- i2c: rk3x: Adjust mask/value offset for i2c2 on rv1126 +- drm/amdkfd: Fix 'node' NULL check in 'svm_range_get_range_boundaries()' +- drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()' +- drm/amdgpu: Fix with right return code '-EIO' in 'amdgpu_gmc_vram_checking()' +- drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in 'get_platform_power_management_table()' +- drm/amdgpu: fix avg vs input power reporting on smu7 +- ceph: fix invalid pointer access if get_quota_realm return ERR_PTR +- ceph: reinitialize mds feature bit even when session in open +- virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings +- drm/amdkfd: Fix lock dependency warning with srcu +- drm/amdkfd: Fix lock dependency warning +- libsubcmd: Fix memory leak in uniq() +- misc: lis3lv02d_i2c: Add missing setting of the reg_ctrl callback +- usb: xhci-plat: fix usb disconnect issue after s4 +- 9p: Fix initialisation of netfs_inode for 9p +- PCI/AER: Decode Requester ID when no error info found +- PCI: Fix 64GT/s effective data rate calculation +- spmi: mediatek: Fix UAF on device remove +- fs/kernfs/dir: obey S_ISGID +- tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE +- selftests/sgx: Fix linker script asserts +- usb: hub: Add quirk to decrease IN-ep poll interval for Microchip USB491x hub +- usb: hub: Replace hardcoded quirk value with BIT() macro +- extcon: fix possible name leak in extcon_dev_register() +- perf cs-etm: Bump minimum OpenCSD version to ensure a bugfix is present +- PCI: switchtec: Fix stdev_release() crash after surprise hot remove +- PCI: Only override AMD USB controller if required +- mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt +- mfd: ti_am335x_tscadc: Fix TI SoC dependencies +- xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import +- riscv: Make XIP bootable again +- i3c: master: cdns: Update maximum prescaler value for i2c clock +- um: time-travel: fix time corruption +- um: net: Fix return type of uml_net_start_xmit() +- um: Don't use vfprintf() for os_info() +- um: Fix naming clash between UML and scheduler +- leds: trigger: panic: Don't register panic notifier if creating the trigger failed +- pinctrl: baytrail: Fix types of config value in byt_pin_config_set() +- ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140 +- drm/amdgpu: apply the RV2 system aperture fix to RN/CZN as well +- drm/amdkfd: Fix iterator used outside loop in 'kfd_add_peer_prop()' +- drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()' +- drm/amdgpu: Fix '*fw' from request_firmware() not released in 'amdgpu_ucode_request()' +- Re-revert "drm/amd/display: Enable Replay for static screen use cases" +- drm/amdgpu: Let KFD sync with VM fences +- drm/amd/display: Fix minor issues in BW Allocation Phase2 +- drm/amdgpu: Fix ecc irq enable/disable unpaired +- clk: imx: clk-imx8qxp: fix LVDS bypass, pixel and phy clocks +- drm/amd/display: Only clear symclk otg flag for HDMI +- drm/amd/display: make flip_timestamp_in_us a 64-bit variable +- accel/habanalabs: add support for Gaudi2C device +- watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786 +- watchdog: starfive: add lock annotations to fix context imbalances +- clk: mmp: pxa168: Fix memory leak in pxa168_clk_init() +- clk: hi3620: Fix memory leak in hi3620_mmc_clk_init() +- drm/amdgpu: fix ftrace event amdgpu_bo_move always move on same heap +- drm/msm/dpu: fix writeback programming for YUV cases +- drm/msm/dpu: Ratelimit framedone timeout msgs +- drm/msm/dpu: enable writeback on SM8450 +- drm/msm/dpu: enable writeback on SM8350 +- drm/amdkfd: fix mes set shader debugger process management +- drm/amd/display: Force p-state disallow if leaving no plane config +- drm/amd/display: For prefetch mode > 0, extend prefetch if possible +- media: i2c: imx335: Fix hblank min/max values +- media: ddbridge: fix an error code problem in ddb_probe +- media: amphion: remove mutext lock in condition of wait_event +- IB/ipoib: Fix mcast list locking +- drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time +- hwmon: (hp-wmi-sensors) Fix failure to load on EliteDesk 800 G6 +- hwmon: (nct6775) Fix fan speed set failure in automatic mode +- media: rkisp1: resizer: Stop manual allocation of v4l2_subdev_state +- media: rkisp1: Fix IRQ disable race issue +- media: rkisp1: Store IRQ lines +- media: rkisp1: Fix IRQ handler return values +- media: rkisp1: Drop IRQF_SHARED +- media: uvcvideo: Fix power line control for SunplusIT camera +- media: uvcvideo: Fix power line control for a Chicony camera +- drm/msm/dp: Add DisplayPort controller for SM8650 +- ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL +- ALSA: hda: Intel: add HDA_ARL PCI ID support +- PCI: add INTEL_HDA_ARL to pci_ids.h +- media: rockchip: rga: fix swizzling for RGB formats +- media: stk1160: Fixed high volume of stk1160_dbg messages +- drm/mipi-dsi: Fix detach call without attach +- drm/framebuffer: Fix use of uninitialized variable +- drm/drm_file: fix use of uninitialized variable +- drm/amd/display: Fix MST PBN/X.Y value calculations +- ASoC: amd: Add new dmi entries for acp5x platform +- f2fs: fix write pointers on zoned device after roll forward +- drm/amd/display: Fix tiled display misalignment +- drm/bridge: anx7625: Fix Set HPD irq detect window to 2ms +- drm/panel-edp: Add override_edid_mode quirk for generic edp +- RDMA/IPoIB: Fix error code return in ipoib_mcast_join +- reiserfs: Avoid touching renamed directory if parent does not change +- fast_dput(): handle underflows gracefully +- ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument +- ALSA: hda: Refer to correct stream index at loops +- f2fs: fix to check return value of f2fs_reserve_new_block() +- net: dsa: qca8k: put MDIO bus OF node on qca8k_mdio_register() failure +- net: kcm: fix direct access to bv_len +- octeontx2-af: Fix max NPC MCAM entry check while validating ref_entry +- i40e: Fix VF disable behavior to block all traffic +- arm64: dts: sprd: Change UMS512 idle-state nodename to match bindings +- arm64: dts: sprd: Add clock reference for pll2 on UMS512 +- bridge: cfm: fix enum typo in br_cc_ccm_tx_parse +- net/smc: disable SEID on non-s390 archs where virtual ISM may be used +- Bluetooth: L2CAP: Fix possible multiple reject send +- Bluetooth: hci_sync: fix BR/EDR wakeup bug +- Bluetooth: ISO: Avoid creating child socket if PA sync is terminating +- Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066 +- wifi: cfg80211: free beacon_ies when overridden from hidden BSS +- wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() +- libbpf: Fix NULL pointer dereference in bpf_object__collect_prog_relos +- wifi: rtw89: coex: Fix wrong Wi-Fi role info and FDDT parameter members +- wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices +- arm64: dts: amlogic: fix format for s4 uart node +- ice: fix pre-shifted bit usage +- arm64: dts: qcom: Fix coresight warnings in in-ports and out-ports +- arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property +- arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property +- block: prevent an integer overflow in bvec_try_merge_hw_page +- net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path +- net: atlantic: eliminate double free in error handling logic +- ice: fix ICE_AQ_VSI_Q_OPT_RSS_* register values +- scsi: hisi_sas: Set .phy_attached before notifing phyup event HISI_PHYE_PHY_UP_PM +- scsi: lpfc: Move determination of vmid_flag after VMID reinitialization completes +- scsi: lpfc: Reinitialize an NPIV's VMID data structures after FDISC +- ARM: dts: imx23/28: Fix the DMA controller node name +- ARM: dts: imx23-sansa: Use preferred i2c-gpios properties +- ARM: dts: imx27-apf27dev: Fix LED name +- ARM: dts: imx25/27: Pass timing0 +- ARM: dts: imx25: Fix the iim compatible string +- selftests/bpf: fix compiler warnings in RELEASE=1 mode +- arm64: zynqmp: Fix clock node name in kv260 cards +- arm64: zynqmp: Move fixed clock to / for kv260 +- block/rnbd-srv: Check for unlikely string overflow +- ionic: bypass firmware cmds when stuck in reset +- ionic: pass opcode to devcmd_wait +- net: phy: at803x: fix passing the wrong reference for config_intr +- ARM: dts: imx1: Fix sram node +- ARM: dts: imx27: Fix sram node +- ARM: dts: imx: Use flash@0,0 pattern +- ARM: dts: imx25/27-eukrea: Fix RTC node name +- ARM: dts: rockchip: fix rk3036 hdmi ports node +- wifi: ath12k: fix the issue that the multicast/broadcast indicator is not read correctly for WCN7850 +- bpf: Set uattr->batch.count as zero before batched update or deletion +- wifi: mt76: mt7996: add PCI IDs for mt7992 +- wifi: mt76: connac: fix EHT phy mode check +- arm64: dts: qcom: sm8350: Fix remoteproc interrupt type +- arm64: dts: qcom: sm8450: fix soundwire controllers node name +- arm64: dts: qcom: sm8550: fix soundwire controllers node name +- net: mvmdio: Avoid excessive sleeps in polled mode +- minmax: relax check to allow comparison between unsigned arguments and signed constants +- minmax: allow comparisons of 'int' against 'unsigned char/short' +- minmax: fix indentation of __cmp_once() and __clamp_once() +- minmax: allow min()/max()/clamp() if the arguments have the same signedness. +- minmax: add umin(a, b) and umax(a, b) +- minmax: fix header inclusions +- minmax: deduplicate __unconst_integer_typeof() +- scsi: libfc: Fix up timeout error in fc_fcp_rec_error() +- scsi: libfc: Don't schedule abort twice +- wifi: ath12k: fix and enable AP mode for WCN7850 +- bpf: Set need_defer as false when clearing fd array during map free +- bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers +- wifi: rtw89: fix misbehavior of TX beacon in concurrent mode +- wifi: ath11k: fix race due to setting ATH11K_FLAG_EXT_IRQ_ENABLED too early +- wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() +- bpf: Fix a few selftest failures due to llvm18 change +- ARM: dts: imx7s: Fix nand-controller #size-cells +- ARM: dts: imx7s: Fix lcdif compatible +- ARM: dts: imx7d: Fix coresight funnel ports +- scsi: arcmsr: Support new PCI device IDs 1883 and 1886 +- scsi: mpi3mr: Add PCI checks where SAS5116 diverges from SAS4116 +- scsi: mpi3mr: Add support for SAS5116 PCI IDs +- net: usb: ax88179_178a: avoid two consecutive device resets +- bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk +- PCI: Add no PM reset quirk for NVIDIA Spectrum devices +- net: phy: micrel: fix ts_info value in case of no phc +- ARM: dts: samsung: s5pv210: fix camera unit addresses/ranges +- ARM: dts: samsung: exynos4: fix camera unit addresses/ranges +- scsi: lpfc: Fix possible file string name overflow when updating firmware +- soc: xilinx: fix unhandled SGI warning message +- soc: xilinx: Fix for call trace due to the usage of smp_processor_id() +- ARM: dts: qcom: msm8660: fix PMIC node labels +- ARM: dts: qcom: mdm9615: fix PMIC node labels +- ARM: dts: qcom: strip prefix from PMIC files +- selftests/bpf: Fix issues in setup_classid_environment() +- wifi: rt2x00: correct wrong BBP register in RxDCOC calibration +- selftests/bpf: Fix pyperf180 compilation failure with clang18 +- libbpf: Fix potential uninitialized tail padding with LIBBPF_OPTS_RESET +- selftests/bpf: satisfy compiler by having explicit return in btf test +- selftests/bpf: fix RELEASE=1 build for tc_opts +- wifi: rt2x00: restart beacon queue when hardware reset +- wifi: rtw89: fix timeout calculation in rtw89_roc_end() +- ext4: avoid online resizing failures due to oversized flex bg +- ext4: remove unnecessary check from alloc_flex_gd() +- ext4: unify the type of flexbg_size to unsigned int +- ext4: fix inconsistent between segment fstrim and full fstrim +- ecryptfs: Reject casefold directory inodes +- smb: client: fix hardlinking of reparse points +- smb: client: fix renaming of reparse points +- ext4: treat end of range as exclusive in ext4_zero_range() +- SUNRPC: Fix a suspicious RCU usage warning +- sysctl: Fix out of bounds access for empty sysctl registers +- KVM: s390: fix setting of fpc register +- s390/ptrace: handle setting of fpc register correctly +- s390/vfio-ap: fix sysfs status attribute for AP queue devices +- arch: consolidate arch_irq_work_raise prototypes +- s390/boot: always align vmalloc area on segment boundary +- jfs: fix array-index-out-of-bounds in diNewExt +- rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock() +- afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*() +- afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu() +- crypto: stm32/crc32 - fix parsing list of devices +- erofs: fix ztailpacking for subpage compressed blocks +- crypto: octeontx2 - Fix cptvf driver cleanup +- crypto: starfive - Fix dev_err_probe return error +- erofs: fix up compacted indexes for block size < 4096 +- pstore/ram: Fix crash when setting number of cpus to an odd number +- crypto: p10-aes-gcm - Avoid -Wstringop-overflow warnings +- hwrng: starfive - Fix dev_err_probe return error +- jfs: fix uaf in jfs_evict_inode +- jfs: fix array-index-out-of-bounds in dbAdjTree +- jfs: fix slab-out-of-bounds Read in dtSearch +- UBSAN: array-index-out-of-bounds in dtSplitRoot +- FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree +- thermal: core: Fix thermal zone suspend-resume synchronization +- ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events +- PM / devfreq: Synchronize devfreq_monitor_[start/stop] +- kunit: tool: fix parsing of test attributes +- ACPI: NUMA: Fix the logic of getting the fake_pxm value +- selftests/nolibc: fix testcase status alignment +- ACPI: extlog: fix NULL pointer dereference check +- PNP: ACPI: fix fortify warning +- ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop +- audit: Send netlink ACK before setting connection in auditd_set +- regulator: core: Only increment use_count when enable_count changes +- debugobjects: Stop accessing objects after releasing hash bucket lock +- perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file +- x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel +- powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE +- x86/boot: Ignore NMIs during very early boot +- powerpc/64s: Fix CONFIG_NUMA=n build due to create_section_mapping() +- powerpc/mm: Fix build failures due to arch_reserved_kernel_pages() +- powerpc: Fix build error due to is_valid_bugaddr() +- drivers/perf: pmuv3: don't expose SW_INCR event in sysfs +- arm64: irq: set the correct node for VMAP stack +- powerpc/mm: Fix null-pointer dereference in pgtable_cache_add +- asm-generic: make sparse happy with odd-sized put_unaligned_*() +- Documentation/sphinx: fix Python string escapes +- thermal: trip: Drop lockdep assertion from thermal_zone_trip_id() +- serial: core: fix kernel-doc for uart_port_unlock_irqrestore() +- x86/entry/ia32: Ensure s32 is sign extended to s64 +- tick/sched: Preserve number of idle sleeps across CPU hotplug events +- clocksource: Skip watchdog check for large watchdog intervals +- genirq: Initialize resend_node hlist for all interrupt descriptors +- mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan +- cxl/region：Fix overflow issue in alloc_hpa() +- drm: bridge: samsung-dsim: Don't use FORCE_STOP_STATE +- MIPS: lantiq: register smp_ops on non-smp platforms +- spi: fix finalize message on error return +- cifs: fix stray unlock in cifs_chan_skip_or_disable +- spi: spi-cadence: Reverse the order of interleaved write and read operations +- spi: bcm-qspi: fix SFDP BFPT read by usig mspi read +- cpufreq/amd-pstate: Fix setting scaling max/min freq values +- drm/bridge: anx7625: Ensure bridge is suspended in disable() +- block: Move checking GENHD_FL_NO_PART to bdev_add_partition() +- spi: intel-pci: Remove Meteor Lake-S SoC PCI ID from the list +- ARM: dts: exynos4212-tab3: add samsung,invert-vclk flag to fimd +- gpio: eic-sprd: Clear interrupt after set the interrupt type +- firmware: arm_scmi: Use xa_insert() when saving raw queues +- firmware: arm_scmi: Use xa_insert() to store opps +- drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume +- drm/exynos: fix accidental on-stack copy of exynos_drm_plane +- memblock: fix crash when reserved memory is not added to memory +- drm/bridge: parade-ps8640: Make sure we drop the AUX mutex in the error case +- drm/bridge: parade-ps8640: Ensure bridge is suspended in .post_disable() +- drm/bridge: sii902x: Fix audio codec unregistration +- drm/bridge: sii902x: Fix probing race issue +- drm/panel: samsung-s6d7aa0: drop DRM_BUS_FLAG_DE_HIGH for lsl080al02 +- drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33] +- drm/bridge: parade-ps8640: Wait for HPD when doing an AUX transfer +- drm/amdgpu/gfx11: set UNORD_DISPATCH in compute MQDs +- drm/amdgpu/gfx10: set UNORD_DISPATCH in compute MQDs +- drm/panel-edp: drm/panel-edp: Fix AUO B116XTN02 name +- drm/panel-edp: drm/panel-edp: Fix AUO B116XAK01 name and timing +- drm/panel-edp: Add AUO B116XTN02, BOE NT116WHM-N21,836X2, NV116WHM-N49 V8.0 +- drm/i915/psr: Only allow PSR in LPSP mode on HSW non-ULT +- drm/i915/lnl: Remove watchdog timers for PSR +- btrfs: zoned: optimize hint byte for zoned allocator +- btrfs: zoned: factor out prepare_allocation_zoned() +- serial: sc16is7xx: fix unconditional activation of THRI interrupt +- serial: sc16is7xx: Use port lock wrappers +- serial: core: Provide port lock wrappers +- mm: migrate: fix getting incorrect page mapping during page migration +- mm: migrate: record the mlocked page status to remove unnecessary lru drain +- thermal: gov_power_allocator: avoid inability to reset a cdev +- thermal: core: Store trip pointer in struct thermal_instance +- thermal: trip: Drop redundant trips check from for_each_thermal_trip() +- media: i2c: imx290: Properly encode registers as little-endian +- media: v4l2-cci: Add support for little-endian encoded registers +- media: v4l: cci: Add macros to obtain register width and address +- media: v4l: cci: Include linux/bits.h +- pipe: wakeup wr_wait after setting max_usage +- fs/pipe: move check to pipe_has_watch_queue() +- thermal: intel: hfi: Add syscore callbacks for system-wide PM +- thermal: intel: hfi: Disable an HFI instance when all its CPUs go offline +- thermal: intel: hfi: Refactor enabling code into helper functions +- net/bpf: Avoid unused "sin_addr_len" warning when CONFIG_CGROUP_BPF is not set +- drm/amd/display: Fix uninitialized variable usage in core_link_ 'read_dpcd() & write_dpcd()' functions +- drm/amdgpu/pm: Fix the power source flag error +- drm/amd/display: Fix late derefrence 'dsc' check in 'link_set_dsc_pps_packet()' +- drm/amd/display: Align the returned error code with legacy DP +- drm/amd/display: Port DENTIST hang and TDR fixes to OTG disable W/A +- drm/amd/display: Fix variable deferencing before NULL check in edp_setup_replay() +- drm/amdgpu: correct the cu count for gfx v11 +- drm/bridge: nxp-ptn3460: simplify some error checking +- Revert "drm/amd/display: fix bandwidth validation failure on DCN 2.1" +- drm/amd/display: Disable PSR-SU on Parade 0803 TCON again +- drm/amd/display: fix bandwidth validation failure on DCN 2.1 +- drm: Allow drivers to indicate the damage helpers to ignore damage clips +- drm/virtio: Disable damage clipping if FB changed since last page-flip +- drm: Disable the cursor plane on atomic contexts with virtualized drivers +- drm/tidss: Fix atomic_flush check +- drm: Fix TODO list mentioning non-KMS drivers +- drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking +- drm: Don't unref the same fb many times by mistake due to deadlock handling +- Revert "drm/i915/dsi: Do display on sequence later on icl+" +- cpufreq: intel_pstate: Refine computation of P-state for given frequency +- gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04 +- xfs: read only mounts with fsopen mount API are busted +- drm/amdgpu: Fix the null pointer when load rlc firmware +- Revert "drivers/firmware: Move sysfb_init() from device_initcall to subsys_initcall_sync" +- firmware: arm_scmi: Check mailbox/SMT channel for consistency +- ksmbd: fix global oob in ksmbd_nl_policy +- platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe +- platform/x86: intel-uncore-freq: Fix types in sysfs callbacks +- netfilter: nf_tables: reject QUEUE/DROP verdict parameters +- netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain +- hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes +- nfsd: fix RELEASE_LOCKOWNER +- wifi: iwlwifi: fix a memory corruption +- exec: Fix error handling in begin_new_exec() +- rbd: don't move requests to the running list on errors +- btrfs: don't abort filesystem when attempting to snapshot deleted subvolume +- btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args +- btrfs: don't warn if discard range is not aligned to sector +- btrfs: tree-checker: fix inline ref size in error messages +- btrfs: ref-verify: free ref cache before clearing mount opt +- btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume being deleted +- btrfs: zoned: fix lock ordering in btrfs_zone_activate() +- tsnep: Fix XDP_RING_NEED_WAKEUP for empty fill ring +- tsnep: Remove FCS for XDP data path +- net: fec: fix the unhandled context fault from smmu +- selftests: bonding: do not test arp/ns target with mode balance-alb/tlb +- fjes: fix memleaks in fjes_hw_setup +- i40e: update xdp_rxq_info::frag_size for ZC enabled Rx queue +- i40e: set xdp_rxq_info::frag_size +- xdp: reflect tail increase for MEM_TYPE_XSK_BUFF_POOL +- ice: update xdp_rxq_info::frag_size for ZC enabled Rx queue +- intel: xsk: initialize skb_frag_t::bv_offset in ZC drivers +- ice: remove redundant xdp_rxq_info registration +- i40e: handle multi-buffer packets that are shrunk by xdp prog +- ice: work on pre-XDP prog frag count +- xsk: fix usage of multi-buffer BPF helpers for ZC XDP +- bpf: Add bpf_sock_addr_set_sun_path() to allow writing unix sockaddr from bpf +- bpf: Propagate modified uaddrlen from cgroup sockaddr programs +- xsk: make xsk_buff_pool responsible for clearing xdp_buff::flags +- xsk: recycle buffer in case Rx queue was full +- selftests: netdevsim: fix the udp_tunnel_nic test +- selftests: net: fix rps_default_mask with >32 CPUs +- net: mvpp2: clear BM pool before initialization +- net: stmmac: Wait a bit for the reset to take effect +- netfilter: nf_tables: validate NFPROTO_* family +- netfilter: nf_tables: restrict anonymous set and map names to 16 bytes +- netfilter: nft_limit: reject configurations that cause integer overflow +- rcu: Defer RCU kthreads wakeup when CPU is dying +- net/mlx5e: fix a potential double-free in fs_any_create_groups +- net/mlx5e: fix a double-free in arfs_create_groups +- net/mlx5e: Ignore IPsec replay window values on sender side +- net/mlx5e: Allow software parsing when IPsec crypto is enabled +- net/mlx5: Use mlx5 device constant for selecting CQ period mode for ASO +- net/mlx5: DR, Can't go to uplink vport on RX rule +- net/mlx5: DR, Use the right GVMI number for drop action +- net/mlx5: Bridge, fix multicast packets sent to uplink +- net/mlx5: Bridge, Enable mcast in smfs steering mode +- net/mlx5: Fix a WARN upon a callback command failure +- net/mlx5e: Fix peer flow lists handling +- net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context +- net/sched: flower: Fix chain template offload +- selftests: fill in some missing configs for net +- ipv6: init the accept_queue's spinlocks in inet6_create +- netlink: fix potential sleeping issue in mqueue_flush_file +- selftest: Don't reuse port for SO_INCOMING_CPU test. +- tcp: Add memory barrier to tcp_push() +- afs: Hide silly-rename files from userspace +- tracing: Ensure visibility when inserting an element into tracing_map +- netfs, fscache: Prevent Oops in fscache_put_cache() +- net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv +- net: micrel: Fix PTP frame parsing for lan8814 +- tun: add missing rx stats accounting in tun_xdp_act +- tun: fix missing dropped counter in tun_xdp_act +- net: fix removing a namespace with conflicting altnames +- udp: fix busy polling +- llc: Drop support for ETH_P_TR_802_2. +- llc: make llc_ui_sendmsg() more robust against bonding changes +- vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING +- bnxt_en: Prevent kernel warning when running offline self test +- bnxt_en: Wait for FLR to complete during probe +- tcp: make sure init the accept_queue's spinlocks once +- selftests: bonding: Increase timeout to 1200s +- net/smc: fix illegal rmb_desc access in SMC-D connection dump +- wifi: mac80211: fix potential sta-link leak +- SUNRPC: use request size to initialize bio_vec in svc_udp_sendto() +- cifs: after disabling multichannel, mark tcon for reconnect +- cifs: fix a pending undercount of srv_count +- cifs: fix lock ordering while disabling multichannel +- Revert "drm/amd: Enable PCIe PME from D3" +- selftests/bpf: check if max number of bpf_loop iterations is tracked +- bpf: keep track of max number of bpf_loop callback iterations +- selftests/bpf: test widening for iterating callbacks +- bpf: widening for callback iterators +- selftests/bpf: tests for iterating callbacks +- bpf: verify callbacks as if they are called unknown number of times +- bpf: extract setup_func_entry() utility function +- bpf: extract __check_reg_arg() utility function +- selftests/bpf: track string payload offset as scalar in strobemeta +- selftests/bpf: track tcp payload offset as scalar in xdp_synproxy +- bpf: print full verifier states on infinite loop detection +- selftests/bpf: test if state loops are detected in a tricky case +- bpf: correct loop detection for iterators convergence +- selftests/bpf: tests with delayed read/precision makrs in loop body +- bpf: exact states comparison for iterator convergence checks +- bpf: extract same_callsites() as utility function +- bpf: move explored_state() closer to the beginning of verifier.c +- dt-bindings: net: snps,dwmac: Tx coe unsupported +- ksmbd: Add missing set_freezable() for freezable kthread +- ksmbd: send lease break notification on FILE_RENAME_INFORMATION +- ksmbd: don't increment epoch if current state and request state are same +- ksmbd: fix potential circular locking issue in smb2_set_ea() +- ksmbd: set v2 lease version on lease upgrade +- serial: Do not hold the port lock when setting rx-during-tx GPIO +- mm: page_alloc: unreserve highatomic page blocks before oom +- LoongArch/smp: Call rcutree_report_cpu_starting() earlier +- serial: sc16is7xx: improve do/while loop in sc16is7xx_irq() +- serial: sc16is7xx: remove obsolete loop in sc16is7xx_port_irq() +- serial: sc16is7xx: fix invalid sc16is7xx_lines bitfield in case of probe error +- serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO +- serial: sc16is7xx: change EFR lock to operate on each channels +- serial: sc16is7xx: remove unused line structure member +- serial: sc16is7xx: remove global regmap from struct sc16is7xx_port +- serial: sc16is7xx: remove wasteful static buffer in sc16is7xx_regmap_name() +- serial: sc16is7xx: improve regmap debugfs by using one regmap per port +- rename(): fix the locking of subdirectories +- mm/sparsemem: fix race in accessing memory_section->usage +- mm/rmap: fix misplaced parenthesis of a likely() +- selftests: mm: hugepage-vmemmap fails on 64K page size systems +- kexec: do syscore_shutdown() in kernel_kexec +- ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path +- nouveau/vmm: don't set addr on the fail path to avoid warning +- rtc: Extend timeout for waiting for UIP to clear to 1s +- rtc: Add support for configuring the UIP timeout for RTC reads +- rtc: mc146818-lib: Adjust failure return code for mc146818_get_time() +- rtc: Adjust failure return code for cmos_set_alarm() +- rtc: cmos: Use ACPI alarm for non-Intel x86 systems too +- arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD +- arm64/sme: Always exit sme_alloc() early with existing storage +- arm64: errata: Add Cortex-A510 speculative unprivileged load workaround +- arm64: Rename ARM64_WORKAROUND_2966298 +- riscv: mm: Fixup compat mode boot failure +- riscv: mm: Fixup compat arch_get_mmap_end +- media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run +- media: mtk-jpeg: Fix timeout schedule error in mtk_jpegdec_worker. +- media: i2c: st-mipid02: correct format propagation +- mmc: mmc_spi: remove custom DMA mapped buffers +- mmc: core: Use mrq.sbc in close-ended ffu +- media: videobuf2-dma-sg: fix vmap callback +- scripts/get_abi: fix source path leak +- docs: kernel_abi.py: fix command injection +- dlm: use kernel_connect() and kernel_bind() +- lsm: new security_file_ioctl_compat() hook +- ARM: dts: qcom: sdx55: fix USB SS wakeup +- arm64: dts: qcom: sdm670: fix USB SS wakeup +- arm64: dts: qcom: sdm670: fix USB DP/DM HS PHY interrupts +- arm64: dts: qcom: sc8180x: fix USB SS wakeup +- arm64: dts: qcom: sc8180x: fix USB DP/DM HS PHY interrupts +- arm64: dts: qcom: sm8150: fix USB SS wakeup +- arm64: dts: qcom: sm8150: fix USB DP/DM HS PHY interrupts +- arm64: dts: qcom: sdm845: fix USB SS wakeup +- arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts +- ARM: dts: qcom: sdx55: fix USB DP/DM HS PHY interrupts +- arm64: dts: qcom: Add missing vio-supply for AW2013 +- arm64: dts: qcom: sc7280: fix usb_1 wakeup interrupt types +- arm64: dts: qcom: sc8180x: fix USB wakeup interrupt types +- arm64: dts: qcom: sm8150: fix USB wakeup interrupt types +- arm64: dts: qcom: sdm670: fix USB wakeup interrupt types +- arm64: dts: qcom: sdm845: fix USB wakeup interrupt types +- arm64: dts: qcom: sc7180: fix USB wakeup interrupt types +- arm64: dts: qcom: msm8939: Make blsp_dma controlled-remotely +- arm64: dts: qcom: msm8916: Make blsp_dma controlled-remotely +- arm64: dts: rockchip: Fix rk3588 USB power-domain clocks +- arm64: dts: rockchip: configure eth pad driver strength for orangepi r1 plus lts +- arm64: dts: sprd: fix the cpu node for UMS512 +- ARM: dts: qcom: sdx55: fix pdc '#interrupt-cells' +- ARM: dts: samsung: exynos4210-i9100: Unconditionally enable LDO12 +- ARM: dts: qcom: sdx55: fix USB wakeup interrupt types +- arm64: dts: qcom: sc8280xp-crd: fix eDP phy compatible +- ARM: dts: imx6q-apalis: add can power-up delay on ixora board +- parisc/power: Fix power soft-off button emulation on qemu +- parisc/firmware: Fix F-extend for PDC addresses +- bus: mhi: host: Add spinlock to protect WP access when queueing TREs +- bus: mhi: host: Drop chan lock before queuing buffers +- bus: mhi: host: Add alignment check for event ring read pointer +- mips: Fix max_mapnr being uninitialized on early stages +- nbd: always initialize struct msghdr completely +- s390/vfio-ap: do not reset queue removed from host config +- s390/vfio-ap: reset queues associated with adapter for queue unbound from driver +- s390/vfio-ap: reset queues filtered from the guest's AP config +- s390/vfio-ap: let on_scan_complete() callback filter matrix and update guest's APCB +- s390/vfio-ap: loop over the shadow APCB when filtering guest's AP configuration +- soc: fsl: cpm1: qmc: Fix rx channel reset +- soc: fsl: cpm1: qmc: Fix __iomem addresses declaration +- soc: fsl: cpm1: tsa: Fix __iomem addresses declaration +- media: ov01a10: Enable runtime PM before registering async sub-device +- media: ov13b10: Enable runtime PM before registering async sub-device +- media: ov9734: Enable runtime PM before registering async sub-device +- rpmsg: virtio: Free driver_override when rpmsg_remove() +- media: imx355: Enable runtime PM before registering async sub-device +- soc: qcom: pmic_glink_altmode: fix port sanity check +- mtd: rawnand: Clarify conditions to enable continuous reads +- mtd: rawnand: Prevent sequential reads with on-die ECC engines +- mtd: rawnand: Fix core interference with sequential reads +- mtd: rawnand: Prevent crossing LUN boundaries during sequential reads +- mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters +- PM / devfreq: Fix buffer overflow in trans_stat_show +- s390/vfio-ap: unpin pages on gisc registration failure +- crypto: s390/aes - Fix buffer overread in CTR mode +- hwrng: core - Fix page fault dead lock on mmap-ed hwrng +- PM: hibernate: Enforce ordering during image compression/decompression +- crypto: api - Disallow identical driver names +- crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init +- btrfs: sysfs: validate scrub_speed_max value +- OPP: Pass rounded rate to _set_opp() +- arm64: properly install vmlinuz.efi +- PM: sleep: Fix possible deadlocks in core system-wide PM code +- async: Introduce async_schedule_dev_nocall() +- async: Split async_schedule_node_domain() +- ext4: allow for the last group to be marked as trimmed +- powerpc/ps3_defconfig: Disable PPC64_BIG_ENDIAN_ELF_ABI_V2 +- cifs: update iface_last_update on each query-and-update +- cifs: handle servers that still advertise multichannel after disabling +- cifs: reconnect worker should take reference on server struct unconditionally +- Revert "cifs: reconnect work should have reference on server struct" +- cifs: handle when server stops supporting multichannel +- cifs: handle when server starts supporting multichannel +- cifs: reconnect work should have reference on server struct +- cifs: handle cases where a channel is closed +- smb: client: fix parsing of SMB3.1.1 POSIX create context +- sh: ecovec24: Rename missed backlight field from fbdev to dev +- scsi: core: Kick the requeue list after inserting when flushing +- riscv: Fix an off-by-one in get_early_cmdline() +- scsi: ufs: core: Remove the ufshcd_hba_exit() call from ufshcd_async_scan() +- dmaengine: idxd: Move dma_free_coherent() out of spinlocked context +- dmaengine: fix NULL pointer in channel unregistration function +- dmaengine: fsl-edma: fix eDMAv4 channel allocation issue +- iio: adc: ad7091r: Enable internal vref if external vref is not supplied +- iio: adc: ad7091r: Allow users to configure device events +- iio: adc: ad7091r: Set alert bit in config register +- net: stmmac: Prevent DSA tags from breaking COE +- net: stmmac: Tx coe sw fallback +- soundwire: fix initializing sysfs for same devices on different buses +- soundwire: bus: introduce controller_id +- serial: core: set missing supported flag for RX during TX GPIO +- serial: core: Simplify uart_get_rs485_mode() +- docs: kernel_feat.py: fix potential command injection +- docs: sparse: add sparse.rst to toctree +- docs: sparse: move TW sparse.txt to TW dev-tools +- Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"" +- arm64: dts: armada-3720-turris-mox: set irq type for RTC +- Revert "KEYS: encrypted: Add check for strsep" +- riscv: Fix wrong usage of lm_alias() when splitting a huge linear mapping +- i2c: s3c24xx: fix transferring more than one message in polling mode +- i2c: s3c24xx: fix read transfers in polling mode +- ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work +- selftests: mlxsw: qos_pfc: Adjust the test to support 8 lanes +- mlxsw: spectrum_router: Register netdevice notifier before nexthop +- mlxsw: spectrum_acl_tcam: Fix stack corruption +- mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path +- mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure +- loop: fix the the direct I/O support check when used on top of block devices +- ethtool: netlink: Add missing ethnl_ops_begin/complete +- arm64/ptrace: Don't flush ZA/ZT storage when writing ZA via ptrace +- kdb: Fix a potential buffer overflow in kdb_local() +- io_uring: adjust defer tw counting +- ipvs: avoid stat macros calls from preemptible context +- netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description +- netfilter: nf_tables: skip dead set elements in netlink dump +- netfilter: nf_tables: do not allow mismatch field size and set key length +- netfilter: bridge: replace physindev with physinif in nf_bridge_info +- netfilter: propagate net to nf_bridge_get_physindev +- netfilter: nf_queue: remove excess nf_bridge variable +- netfilter: nfnetlink_log: use proper helper for fetching physinif +- netfilter: nft_limit: do not ignore unsupported flags +- netfilter: nf_tables: reject invalid set policy +- net: netdevsim: don't try to destroy PHC on VFs +- mptcp: relax check on MPC passive fallback +- LoongArch: BPF: Prevent out-of-bounds memory access +- net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe +- bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS +- net: stmmac: ethtool: Fixed calltrace caused by unbalanced disable_irq_wake calls +- selftests: bonding: Change script interpreter +- drm/amdgpu: fall back to INPUT power for AVG power via INFO IOCTL +- drm/amdkfd: fixes for HMM mem allocation +- ASoC: SOF: ipc4-loader: remove the CPC check warnings +- gpio: mlxbf3: add an error code check in mlxbf3_gpio_probe +- dt-bindings: gpio: xilinx: Fix node address in gpio +- net: ravb: Fix dma_addr_t truncation in error case +- net: tls, fix WARNIING in __sk_msg_free +- bpf: Avoid iter->offset making backward progress in bpf_iter_udp +- bpf: iter_udp: Retry with a larger batch size without going back to the previous bucket +- net: netdev_queue: netdev_txq_completed_mb(): fix wake condition +- net: add more sanity check in virtio_net_hdr_to_skb() +- udp: annotate data-races around up->pending +- net: stmmac: Fix ethool link settings ops for integrated PCS +- block: ensure we hold a queue reference when using queue limits +- mptcp: refine opt_mp_capable determination +- mptcp: use OPTION_MPTCP_MPJ_SYN in subflow_check_req() +- mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() +- mptcp: strict validation before using mp_opt->hmac +- mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN +- ALSA: hda: Properly setup HDMI stream +- net: phy: micrel: populate .soft_reset for KSZ9131 +- net: micrel: Fix PTP frame parsing for lan8841 +- amt: do not use overwrapped cb area +- net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames +- octeontx2-af: CN10KB: Fix FIFO length calculation for RPM2 +- rxrpc: Fix use of Don't Fragment flag +- net: qualcomm: rmnet: fix global oob in rmnet_policy +- s390/pci: fix max size calculation in zpci_memcpy_toio() +- ASoC: mediatek: sof-common: Add NULL check for normal_link string +- PCI: mediatek-gen3: Fix translation window size calculation +- PCI: keystone: Fix race condition when initializing PHYs +- nvmet-tcp: Fix the H2C expected PDU len calculation +- nvme: trace: avoid memcpy overflow warning +- nvmet: re-fix tracing strncpy() warning +- hisi_acc_vfio_pci: Update migration data pointer correctly on saving/resume +- spi: coldfire-qspi: Remove an erroneous clk_disable_unprepare() from the remove function +- cxl/port: Fix missing target list lock +- perf db-export: Fix missing reference count get in call_path_from_sample() +- serial: apbuart: fix console prompt on qemu +- serial: imx: Correct clock error message in function probe() +- usb: xhci-mtk: fix a short packet issue of gen1 isoc-in transfer +- apparmor: avoid crash when parsed profile name is empty +- apparmor: fix possible memory leak in unpack_trans_table +- cxl/region: fix x9 interleave typo +- perf stat: Fix hard coded LL miss units +- perf env: Avoid recursively taking env->bpf_progs.lock +- nvmet-tcp: fix a crash in nvmet_req_complete() +- nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length +- apparmor: Fix ref count leak in task_kill +- vdpa: Fix an error handling path in eni_vdpa_probe() +- power: supply: Fix null pointer dereference in smb2_probe +- usb: gadget: webcam: Make g_webcam loadable again +- spmi: mtk-pmif: Serialize PMIF status check and command submission +- usb: cdc-acm: return correct error code on unsupported break +- tty: use 'if' in send_break() instead of 'goto' +- tty: don't check for signal_pending() in send_break() +- tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK +- PCI: epf-mhi: Fix the DMA data direction of dma_unmap_single() +- bus: mhi: ep: Pass mhi_ep_buf_info struct to read/write APIs +- bus: mhi: ep: Use slab allocator where applicable +- bus: mhi: ep: Do not allocate event ring element on stack +- perf unwind-libunwind: Fix base address for .eh_frame +- perf unwind-libdw: Handle JIT-generated DSOs properly +- perf genelf: Set ELF program header addresses properly +- perf header: Fix one memory leakage in perf_event__fprintf_event_update() +- iio: adc: ad9467: fix scale setting +- iio: adc: ad9467: add mutex to struct ad9467_state +- iio: adc: ad9467: don't ignore error codes +- iio: adc: ad9467: fix reset gpio handling +- selftests/sgx: Skip non X86_64 platform +- selftests/sgx: Include memory clobber for inline asm in test enclave +- selftests/sgx: Fix uninitialized pointer dereferences in encl_get_entry +- selftests/sgx: Fix uninitialized pointer dereference in error path +- serial: imx: fix tx statemachine deadlock +- software node: Let args be NULL in software_node_get_reference_args +- acpi: property: Let args be NULL in __acpi_node_get_property_reference +- base/node.c: initialize the accessor list before registering +- perf stat: Exit perf stat if parse groups fails +- perf mem: Fix error on hybrid related to availability of mem event in a PMU +- perf vendor events arm64 AmpereOne: Rename BPU_FLUSH_MEM_FAULT to GPC_FLUSH_MEM_FAULT +- vfio/pds: Fix calculations in pds_vfio_dirty_sync +- perf test record user-regs: Fix mask for vg register +- libapi: Add missing linux/types.h header to get the __u64 type on io.h +- perf header: Fix segfault on build_mem_topology() error path +- perf test: Remove atomics from test_loop to avoid test failures +- power: supply: bq256xx: fix some problem in bq256xx_hw_init +- power: supply: cw2015: correct time_to_empty units in sysfs +- MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup() +- MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup() +- riscv: Fixed wrong register in XIP_FIXUP_FLASH_OFFSET macro +- riscv: Fix set_direct_map_default_noflush() to reset _PAGE_EXEC +- riscv: Fix set_memory_XX() and set_direct_map_XX() by splitting huge linear mappings +- riscv: Fix module_alloc() that did not reset the linear mapping permissions +- riscv: Check if the code to patch lies in the exit section +- um: virt-pci: fix platform map offset +- mips: Fix incorrect max_low_pfn adjustment +- mips: dmi: Fix early remap on MIPS32 +- srcu: Use try-lock lockdep annotation for NMI-safe access. +- mfd: intel-lpss: Fix the fractional clock divider flags +- mfd: tps6594: Add null pointer check to tps6594_device_init() +- leds: aw200xx: Fix write to DIM parameter +- leds: aw2013: Select missing dependency REGMAP_I2C +- mfd: syscon: Fix null pointer dereference in of_syscon_register() +- mfd: cs42l43: Correct SoundWire port list +- mfd: rk8xx: fixup devices registration with PLATFORM_DEVID_AUTO +- ARM: 9330/1: davinci: also select PINCTRL +- serial: sc16is7xx: set safe default SPI clock frequency +- serial: sc16is7xx: add check for unsupported SPI modes during probe +- HID: wacom: Correct behavior when processing some confidence == false touches +- HID: sensor-hub: Enable hid core report processing for all devices +- iio: adc: ad7091r: Pass iio_dev to event handler +- KVM: x86/pmu: Reset the PMU, i.e. stop counters, before refreshing +- KVM: x86/pmu: Move PMU reset logic to common x86 code +- KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache +- x86/kvm: Do not try to disable kvmclock if it was not enabled +- PCI: mediatek: Clear interrupt status before dispatching handler +- PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support +- x86/pci: Reserve ECAM if BIOS didn't include it in PNP0C02 _CRS +- PCI/P2PDMA: Remove reference to pci_p2pdma_map_sg() +- cxl/port: Fix decoder initialization when nr_targets > interleave_ways +- Revert "nSVM: Check for reserved encodings of TLB_CONTROL in nested VMCB" +- Revert "net: rtnetlink: Enslave device before bringing it up" +- net: stmmac: fix ethtool per-queue statistics +- wifi: mwifiex: fix uninitialized firmware_stat +- wifi: mwifiex: configure BSSID consistently when starting AP +- wifi: mwifiex: add extra delay for firmware ready +- wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors +- wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code +- wifi: mt76: fix broken precal loading from MTD for mt7915 +- iommu/arm-smmu-qcom: Add missing GMU entry to match table +- bpf: Fix re-attachment branch in bpf_tracing_prog_attach +- Bluetooth: Fix atomicity violation in {min,max}_key_size_set +- md/raid1: Use blk_opf_t for read and write operations +- pwm: Fix out-of-bounds access in of_pwm_single_xlate() +- pwm: jz4740: Don't use dev_err_probe() in .request() +- netfilter: nf_tables: check if catch-all set element is active in next generation +- block: Fix iterating over an empty bio with bio_for_each_folio_all +- block: Remove special-casing of compound pages +- drm/amd: Enable PCIe PME from D3 +- scsi: mpi3mr: Block PEL Enable Command on Controller Reset and Unrecoverable State +- scsi: mpi3mr: Clean up block devices post controller reset +- scsi: mpi3mr: Refresh sdev queue depth after controller reset +- scsi: target: core: add missing file_{start,end}_write() +- scsi: ufs: core: Simplify power management during async scan +- fbdev: flush deferred IO before closing +- fbdev: flush deferred work in fb_deferred_io_fsync() +- fbdev/acornfb: Fix name of fb_ops initializer macro +- io_uring: ensure local task_work is run on wait timeout +- io_uring/rw: ensure io->bytes_done is always initialized +- io_uring: don't check iopoll if request completes +- LoongArch: Fix and simplify fcsr initialization on execve() +- ceph: select FS_ENCRYPTION_ALGS if FS_ENCRYPTION +- ksmbd: only v2 leases handle the directory +- ksmbd: fix UAF issue in ksmbd_tcp_new_connection() +- ksmbd: validate mech token in session setup +- ALSA: hda/realtek: Enable headset mic on Lenovo M70 Gen5 +- ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on HP ZBook +- ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx +- ALSA: oxygen: Fix right channel of capture volume mixer +- serial: omap: do not override settings for RS485 support +- serial: 8250_exar: Set missing rs485_supported flag +- serial: imx: Ensure that imx_uart_rs485_config() is called with enabled clock +- serial: core, imx: do not set RS485 enabled if it is not supported +- serial: 8250_bcm2835aux: Restore clock error handling +- serial: core: make sure RS485 cannot be enabled when it is not supported +- serial: core: fix sanitizing check for RTS settings +- dt-bindings: phy: qcom,sc8280xp-qmp-usb43dp-phy: fix path to header +- usb: mon: Fix atomicity violation in mon_bin_vma_fault +- usb: typec: class: fix typec_altmode_put_partner to put plugs +- Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs" +- usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled +- usb: cdns3: fix iso transfer error when mult is not zero +- usb: cdns3: fix uvc failure work since sg support enabled +- usb: chipidea: wait controller resume finished for wakeup irq +- Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-only" +- Revert "usb: dwc3: Soft reset phy on probe for host" +- usb: dwc3: gadget: Queue PM runtime idle on disconnect event +- usb: dwc3: gadget: Handle EP0 request dequeuing properly +- usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart +- usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host() +- Revert "usb: gadget: f_uvc: change endpoint allocation in uvc_function_bind()" +- tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug +- powerpc/64s: Increase default stack size to 32KB +- clocksource/drivers/timer-ti-dm: Fix make W=n kerneldoc warnings +- binder: fix race between mmput() and do_exit() +- xen-netback: don't produce zero-size SKB frags +- Revert "drm/amdkfd: Relocate TBA/TMA to opposite side of VM hole" +- rust: Ignore preserve-most functions +- Input: atkbd - use ab83 as id when skipping the getid command +- mips/smp: Call rcutree_report_cpu_starting() earlier +- binder: fix unused alloc->free_async_space +- binder: fix async space check for 0-sized buffers +- keys, dns: Fix size check of V1 server-list header +- selftests/bpf: Add assert for user stacks in test_task_stack +- Revert "kernfs: convert kernfs_idr_lock to an irq safe raw spinlock" +- kernfs: convert kernfs_idr_lock to an irq safe raw spinlock +- class: fix use-after-free in class_register() +- of: unittest: Fix of_count_phandle_with_args() expected value message +- fbdev: imxfb: fix left margin setting +- of: Fix double free in of_parse_phandle_with_args_map +- ksmbd: validate the zero field of packet header +- kselftest/alsa - conf: Stringify the printed errno in sysfs_get() +- kselftest/alsa - mixer-test: Fix the print format specifier warning +- kselftest/alsa - mixer-test: fix the number of parameters to ksft_exit_fail_msg() +- drm/amd/display: avoid stringop-overflow warnings for dp_decide_lane_settings() +- drm/amd/pm/smu7: fix a memleak in smu7_hwmgr_backend_init +- drm/amdkfd: Confirm list is non-empty before utilizing list_first_entry in kfd_topology.c +- IB/iser: Prevent invalidating wrong MR +- gpio: sysfs: drop the mention of gpiochip_find() from sysfs code +- gpiolib: provide gpio_device_find() +- gpiolib: make gpio_device_get() and gpio_device_put() public +- drm/amdkfd: Fix type of 'dbg_flags' in 'struct kfd_process' +- mmc: sdhci_omap: Fix TI SoC dependencies +- mmc: sdhci_am654: Fix TI SoC dependencies +- ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put() +- ALSA: scarlett2: Add missing error checks to *_ctl_get() +- ALSA: scarlett2: Allow passing any output to line_out_remap() +- ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config() +- ALSA: scarlett2: Add missing error check to scarlett2_config_save() +- ASoC: rt5645: Drop double EF20 entry from dmi_platform_data[] +- pwm: stm32: Fix enable count for clk in .probe() +- pwm: stm32: Use hweight32 in stm32_pwm_detect_channels +- clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw +- clk: qcom: dispcc-sm8550: Update disp PLL settings +- clk: qcom: gcc-sm8550: Mark RCGs shared where applicable +- clk: qcom: gcc-sm8550: use collapse-voting for PCIe GDSCs +- clk: qcom: gcc-sm8550: Mark the PCIe GDSCs votable +- clk: qcom: gcc-sm8550: Add the missing RETAIN_FF_ENABLE GDSC flag +- accel/habanalabs: fix information leak in sec_attest_info() +- drm/mediatek: dp: Add phy_mtk_dp module as pre-dependency +- ASoC: tas2781: add support for FW version 0x0503 +- ASoC: amd: vangogh: Drop conflicting ACPI-based probing +- clk: si5341: fix an error code problem in si5341_output_clk_set_rate +- clk: rs9: Fix DIF OEn bit placement on 9FGV0241 +- watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused +- watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling +- watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO +- watchdog: set cdev owner before adding +- drivers: clk: zynqmp: update divider round rate logic +- drivers: clk: zynqmp: calculate closest mux rate +- clk: sp7021: fix return value check in sp7021_clk_probe() +- clk: qcom: videocc-sm8150: Add missing PLL config property +- clk: qcom: videocc-sm8150: Update the videocc resets +- dt-bindings: clock: Update the videocc resets for sm8150 +- f2fs: fix to check return value of f2fs_recover_xattr_data +- drm/amd/pm: fix a double-free in amdgpu_parse_extended_power_table +- gpu/drm/radeon: fix two memleaks in radeon_vm_init +- drivers/amd/pm: fix a use-after-free in kv_parse_power_table +- drm/amd/pm: fix a double-free in si_dpm_init +- drm/amdgpu/debugfs: fix error code when smc register accessors are NULL +- drm/mediatek: Fix underrun in VDO1 when switches off the layer +- drm/mediatek: Remove the redundant driver data for DPI +- drm/mediatek: Return error if MDP RDMA failed to enable the clock +- drm/msm/dpu: Drop enable and frame_count parameters from dpu_hw_setup_misr() +- drm/msm/dpu: Set input_sel bit for INTF +- clk: renesas: rzg2l: Check reset monitor registers +- clk: renesas: rzg2l-cpg: Reuse code in rzg2l_cpg_reset() +- media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path of m88ds3103_probe() +- media: dvbdev: drop refcount on error path in dvb_device_open() +- f2fs: fix to update iostat correctly in f2fs_filemap_fault() +- f2fs: fix to check compress file in f2fs_move_file_range() +- f2fs: fix to wait on block writeback for post_read case +- drm/panel: st7701: Fix AVCL calculation +- drm/msm/adreno: Fix A680 chip id +- media: rkisp1: Fix media device memory leak +- media: dt-bindings: media: rkisp1: Fix the port description for the parallel interface +- media: imx-mipi-csis: Drop extra clock enable at probe() +- media: imx-mipi-csis: Fix clock handling in remove() +- media: bttv: add back vbi hack +- media: bttv: start_streaming should return a proper error code +- clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config +- media: cx231xx: fix a memleak in cx231xx_init_isoc +- drm/bridge: tc358767: Fix return value on error case +- drm/bridge: cdns-mhdp8546: Fix use of uninitialized variable +- drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table +- drm/radeon/dpm: fix a memleak in sumo_parse_power_table +- drm/msm/dpu: correct clk bit for WB2 block +- drm/panfrost: Ignore core_mask for poweroff and disable PWRTRANS irq +- ASoC: SOF: topology: Use partial match for disconnecting DAI link and DAI widget +- ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx->headset_codec_dev = NULL +- ASoC: Intel: glk_rt5682_max98357a: fix board id mismatch +- media: v4l: async: Fix duplicated list deletion +- drm/drv: propagate errors from drm_modeset_register_all() +- drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks +- drm/msm/dpu: Add missing safe_lut_tbl in sc8180x catalog +- drm/msm/mdp4: flush vblank event on disable +- ASoC: cs35l33: Fix GPIO name and drop legacy include +- drm/imx/lcdc: Fix double-free of driver data +- drm/tidss: Fix dss reset +- drm/tidss: Check for K2G in in dispc_softreset() +- drm/tidss: Return error value from from softreset +- drm/tidss: Move reset to the end of dispc_init() +- drm/radeon: check return value of radeon_ring_lock() +- drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check() +- drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg() +- drm/bridge: Fix typo in post_disable() description +- media: amphion: Fix VPU core alias name +- media: rkvdec: Hook the (TRY_)DECODER_CMD stateless ioctls +- media: verisilicon: Hook the (TRY_)DECODER_CMD stateless ioctls +- media: visl: Hook the (TRY_)DECODER_CMD stateless ioctls +- media: mtk-jpeg: Remove cancel worker in mtk_jpeg_remove to avoid the crash of multi-core JPEG devices +- media: pvrusb2: fix use after free on context disconnection +- drm/tilcdc: Fix irq free on unload +- drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function +- drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer +- drm/panel-elida-kd35t133: hold panel in reset for unprepare +- drm/panel: nv3051d: Hold panel in reset for unprepare +- RDMA/usnic: Silence uninitialized symbol smatch warnings +- drm/panfrost: Really power off GPU cores in panfrost_gpu_power_off() +- drm/dp_mst: Fix fractional DSC bpp handling +- Revert "drm/omapdrm: Annotate dma-fence critical section in commit path" +- Revert "drm/tidss: Annotate dma-fence critical section in commit path" +- ARM: davinci: always select CONFIG_CPU_ARM926T +- ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() +- rxrpc: Fix skbuff cleanup of call's recvmsg_queue and rx_oos_queue +- mlxbf_gige: Enable the GigE port in mlxbf_gige_open +- mlxbf_gige: Fix intermittent no ip issue +- net/sched: act_ct: fix skb leak and crash on ooo frags +- blk-cgroup: fix rcu lockdep warning in blkg_lookup() +- sctp: fix busy polling +- sctp: support MSG_ERRQUEUE flag in recvmsg() +- bpf: sockmap, fix proto update hook to avoid dup calls +- wifi: cfg80211: parse all ML elements in an ML probe response +- wifi: cfg80211: correct comment about MLD ID +- arm64: dts: rockchip: Fix led pinctrl of lubancat 1 +- null_blk: don't cap max_hw_sectors to BLK_DEF_MAX_SECTORS +- Bluetooth: btmtkuart: fix recv_buf() return value +- Bluetooth: btnxpuart: fix recv_buf() return value +- Bluetooth: Fix bogus check for re-auth no supported with non-ssp +- netfilter: nf_tables: validate chain type update if available +- netfilter: nf_tables: mark newset as dead on transaction abort +- wifi: iwlwifi: assign phy_ctxt before eSR activation +- wifi: iwlwifi: fix out of bound copy_from_user +- wifi: iwlwifi: mvm: send TX path flush in rfkill +- wifi: iwlwifi: mvm: set siso/mimo chains to 1 in FW SMPS request +- wifi: rtlwifi: rtl8192se: using calculate_bit_shift() +- wifi: rtlwifi: rtl8192ee: using calculate_bit_shift() +- wifi: rtlwifi: rtl8192de: using calculate_bit_shift() +- wifi: rtlwifi: rtl8192ce: using calculate_bit_shift() +- wifi: rtlwifi: rtl8192cu: using calculate_bit_shift() +- wifi: rtlwifi: rtl8192c: using calculate_bit_shift() +- wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift() +- wifi: rtlwifi: add calculate_bit_shift() +- bpf: Use c->unit_size to select target cache during free +- bpf: Use pcpu_alloc_size() in bpf_mem_free{_rcu}() +- bpf: Re-enable unit_size checking for global per-cpu allocator +- arm64: dts: qcom: sc8180x: Fix up PCIe nodes +- arm64: dts: qcom: sc8180x: switch PCIe QMP PHY to new style of bindings +- arm64: dts: qcom: sc8180x: Mark PCIe hosts cache-coherent +- arm64: dts: qcom: sm8550: Update idle state time requirements +- arm64: dts: qcom: sm8550: Separate out X3 idle state +- arm64: dts: qcom: ipq6018: fix clock rates for GCC_USB0_MOCK_UTMI_CLK +- arm64: dts: qcom: sc7280: Mark SDHCI hosts as cache-coherent +- soc: qcom: llcc: Fix LLCC_TRP_ATTR2_CFGn offset +- arm64: dts: qcom: sm8150-hdk: fix SS USB regulators +- arm64: dts: qcom: sm8150: make dispcc cast minimal vote on MMCX +- arm64: dts: qcom: sm6375: Hook up MPM +- arm64: dts: qcom: sm6375: fix USB wakeup interrupt types +- soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration +- arm64: dts: qcom: acer-aspire1: Correct audio codec definition +- bpf: Limit the number of kprobes when attaching program to multiple kprobes +- bpf: Limit the number of uprobes when attaching program to multiple uprobes +- dma-mapping: clear dev->dma_mem to NULL after freeing it +- virtio/vsock: send credit update during setting SO_RCVLOWAT +- virtio/vsock: fix logic which reduces credit update messages +- ipmr: support IP_PKTINFO on cache report IGMP msg +- selftests/net: fix grep checking for fib_nexthop_multiprefix +- bpf: Fix a race condition between btf_put() and map_free() +- ARM: dts: stm32: don't mix SCMI and non-SCMI board compatibles +- scsi: hisi_sas: Correct the number of global debugfs registers +- scsi: hisi_sas: Rollback some operations if FLR failed +- scsi: hisi_sas: Check before using pointer variables +- scsi: hisi_sas: Replace with standard error code return value +- scsi: ufs: qcom: Fix the return value when platform_get_resource_byname() fails +- scsi: ufs: qcom: Fix the return value of ufs_qcom_ice_program_key() +- arm64: dts: imx8mm: Reduce GPU to nominal speed +- arm64: dts: renesas: white-hawk-cpu: Fix missing serial console pin control +- arm64: dts: xilinx: Apply overlays to base dtbs +- selftests/bpf: Relax time_tai test for equal timestamps in tai_forward +- wifi: iwlwifi: don't support triggered EHT CQI feedback +- wifi: mt76: mt7921: fix country count limitation for CLC +- arm64: dts: mediatek: mt8186: fix address warning for ADSP mailboxes +- arm64: dts: mediatek: mt8186: Fix alias prefix for ovl_2l0 +- arm64: dts: mediatek: mt8195: revise VDOSYS RDMA node name +- arm64: dts: mediatek: mt8183: correct MDP3 DMA-related nodes +- dt-bindings: media: mediatek: mdp3: correct RDMA and WROT node with generic names +- bpf: Fix accesses to uninit stack slots +- bpf: Guard stack limits against 32bit overflow +- arm64: dts: hisilicon: hikey970-pmic: fix regulator cells properties +- bpf: Fix verification of indirect var-off stack access +- wifi: mt76: mt7921s: fix workqueue problem causes STA association fail +- wifi: mt76: mt7915: also MT7981 is 3T3R but nss2 on 5 GHz band +- wifi: mt76: mt7915: fix EEPROM offset of TSSI flag on MT7981 +- wifi: mt76: mt7996: fix rate usage of inband discovery frames +- wifi: mt76: mt7996: fix the size of struct bss_rate_tlv +- wifi: mt76: mt7915: fallback to non-wed mode if platform_get_resource fails in mt7915_mmio_wed_init() +- wifi: mt76: fix typo in mt76_get_of_eeprom_from_nvmem function +- arm64: dts: qcom: sm8550: fix USB wakeup interrupt types +- arm64: dts: qcom: sc7280: fix usb_2 wakeup interrupt types +- arm64: dts: qcom: sa8775p: fix USB wakeup interrupt types +- arm64: dts: qcom: sc7280: Mark Adreno SMMU as DMA coherent +- arm64: dts: qcom: sc7280: Fix up GPU SIDs +- arm64: dts: qcom: sm8350: Fix DMA0 address +- arm64: dts: qcom: sm6125: add interrupts to DWC3 USB controller +- arm64: dts: qcom: sdm845-db845c: correct LED panic indicator +- arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator +- arm64: dts: qcom: qrb2210-rb1: use USB host mode +- arm64: dts: qcom: qrb2210-rb1: Hook up USB3 +- scsi: fnic: Return error if vmalloc() failed +- bpf: fix check for attempt to corrupt spilled pointer +- selftests/net: specify the interface when do arping +- bpf: Defer the free of inner map when necessary +- bpf: Add map and need_defer parameters to .map_fd_put_ptr() +- arm64: dts: qcom: sm6350: Make watchdog bark interrupt edge triggered +- arm64: dts: qcom: sc8280xp: Make watchdog bark interrupt edge triggered +- arm64: dts: qcom: sa8775p: Make watchdog bark interrupt edge triggered +- arm64: dts: qcom: sm8250: Make watchdog bark interrupt edge triggered +- arm64: dts: qcom: sm8150: Make watchdog bark interrupt edge triggered +- arm64: dts: qcom: sdm845: Make watchdog bark interrupt edge triggered +- arm64: dts: qcom: sc7280: Make watchdog bark interrupt edge triggered +- arm64: dts: qcom: sc7280: Mark some nodes as 'reserved' +- arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered +- arm64: dts: qcom: sm8550: correct TX Soundwire clock +- arm64: dts: qcom: sm8450: correct TX Soundwire clock +- arm64: dts: qcom: sc8180x-primus: Fix HALL_INT polarity +- dt-bindings: arm: qcom: Fix html link +- ARM: dts: qcom: sdx65: correct SPMI node name +- ARM: dts: qcom: sdx65: correct PCIe EP phy-names +- bpf: enforce precision of R0 on callback return +- selftests/bpf: Fix erroneous bitmask operation +- wifi: rtw88: sdio: Honor the host max_req_size in the RX path +- arm64: dts: ti: iot2050: Re-add aliases +- arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type +- arm64: dts: ti: k3-am62a-main: Fix GPIO pin count in DT nodes +- wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior +- scsi: bfa: Use the proper data type for BLIST flags +- firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create() +- net/ncsi: Fix netlink major/minor version numbers +- ARM: dts: qcom: apq8064: correct XOADC register address +- wifi: libertas: stop selecting wext +- wifi: ath11k: Defer on rproc_get failure +- bpf: Add crosstask check to __bpf_get_stack +- bpf, lpm: Fix check prefixlen before walking trie +- wifi: rtw88: fix RX filter in FIF_ALLMULTI flag +- wifi: plfxlc: check for allocation failure in plfxlc_usb_wreq_async() +- ARM: dts: qcom: msm8226: provide dsi phy clocks to mmcc +- arm64: dts: qcom: sc8280xp-x13s: add missing camera LED pin config +- arm64: dts: qcom: sc8280xp-x13s: Use the correct DP PHY compatible +- arm64: dts: qcom: qrb4210-rb2: don't force usb peripheral mode +- asm-generic: Fix 32 bit __generic_cmpxchg_local +- pNFS: Fix the pnfs block driver's calculation of layoutget size +- SUNRPC: fix _xprt_switch_find_current_entry logic +- NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT +- NFS: Use parent's objective cred in nfs_access_login_time() +- blocklayoutdriver: Fix reference leak of pnfs_device_node +- csky: fix arch_jump_label_transform_static override +- crypto: scomp - fix req->dst buffer overflow +- crypto: sahara - do not resize req->src when doing hash operations +- crypto: sahara - fix processing hash requests with req->nbytes < sg->length +- crypto: sahara - improve error handling in sahara_sha_process() +- crypto: sahara - fix wait_for_completion_timeout() error handling +- crypto: sahara - fix ahash reqsize +- crypto: sahara - handle zero-length aes requests +- crypto: sahara - avoid skcipher fallback code duplication +- crypto: virtio - Wait for tasklet to complete on device remove +- dlm: fix format seq ops type 4 +- gfs2: fix kernel BUG in gfs2_quota_cleanup +- fs: indicate request originates from old mount API +- erofs: fix memory leak on short-lived bounced pages +- pstore: ram_core: fix possible overflow in persistent_ram_init_ecc() +- crypto: sahara - fix error handling in sahara_hw_descriptor_create() +- crypto: sahara - fix processing requests with cryptlen < sg->length +- crypto: sahara - fix ahash selftest failure +- crypto: sahara - fix cbc selftest failure +- crypto: sahara - remove FLAGS_NEW_KEY logic +- crypto: safexcel - Add error handling for dma_map_sg() calls +- crypto: af_alg - Disallow multiple in-flight AIO requests +- crypto: ccp - fix memleak in ccp_init_dm_workarea +- crypto: sa2ul - Return crypto_aead_setkey to transfer the error +- crypto: virtio - Handle dataq logic with tasklet +- crypto: jh7110 - Correct deferred probe return +- crypto: rsa - add a check for allocation failure +- selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket +- drivers/thermal/loongson2_thermal: Fix incorrect PTR_ERR() judgment +- cpuidle: haltpoll: Do not enable interrupts when entering idle +- kunit: debugfs: Fix unchecked dereference in debugfs_print_results() +- thermal: core: Fix NULL pointer dereference in zone registration error path +- ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error +- ACPI: LPSS: Fix the fractional clock divider flags +- spi: sh-msiof: Enforce fixed DTDL for R-Car H3 +- efivarfs: Free s_fs_info on unmount +- calipso: fix memory leak in netlbl_calipso_add_pass() +- cpufreq: scmi: process the result of devm_of_clk_add_hw_provider() +- platform/x86/intel/vsec: Fix xa_alloc memory leak +- spi: cadence-quadspi: add missing clk_disable_unprepare() in cqspi_probe() +- KEYS: encrypted: Add check for strsep +- ACPI: LPIT: Avoid u32 multiplication overflow +- ACPI: video: check for error while searching for backlight device parent +- mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response +- spi: spi-zynqmp-gqspi: fix driver kconfig dependencies +- perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology() +- sched/fair: Update min_vruntime for reweight_entity() correctly +- powerpc/imc-pmu: Add a null pointer check in update_events_in_group() +- powerpc/powernv: Add a null pointer check in opal_powercap_init() +- powerpc/powernv: Add a null pointer check in opal_event_init() +- powerpc/powernv: Add a null pointer check to scom_debug_init_one() +- powerpc/rtas: Avoid warning on invalid token argument to sys_rtas() +- powerpc/hv-gpci: Add return value check in affinity_domain_via_partition_show function +- selftests/powerpc: Fix error handling in FPU/VMX preemption tests +- KVM: PPC: Book3S HV: Handle pending exceptions on guest entry with MSR_EE +- KVM: PPC: Book3S HV: Introduce low level MSR accessor +- KVM: PPC: Book3S HV: Use accessors for VCPU registers +- drivers/perf: hisi: Fix some event id for HiSilicon UC pmu +- perf/arm-cmn: Fix HN-F class_occup_id events +- powerpc/pseries/memhp: Fix access beyond end of drmem array +- powerpc/44x: select I2C for CURRITUCK +- x86: Fix CPUIDLE_FLAG_IRQ_ENABLE leaking timer reprogram +- powerpc: add crtsavres.o to always-y instead of extra-y +- EDAC/thunderx: Fix possible out-of-bounds string access +- x86/mce/inject: Clear test status value +- x86/lib: Fix overflow when counting digits +- mm/memory_hotplug: fix memmap_on_memory sysfs value retrieval +- scripts/decode_stacktrace.sh: optionally use LLVM utilities +- coresight: etm4x: Fix width of CCITMIN field +- PCI: Add ACS quirk for more Zhaoxin Root Ports +- leds: ledtrig-tty: Free allocated ttyname buffer on deactivate +- parport: parport_serial: Add Brainboxes device IDs and geometry +- parport: parport_serial: Add Brainboxes BAR details +- uio: Fix use-after-free in uio_open +- binder: fix comment on binder_alloc_new_buf() return value +- binder: fix trivial typo of binder_free_buf_locked() +- binder: fix use-after-free in shinker's callback +- binder: use EPOLLERR from eventpoll.h +- ksmbd: free ppace array on error in parse_dacl +- ksmbd: don't allow O_TRUNC open on read-only share +- drm/amd/display: Pass pwrseq inst for backlight and ABM +- ASoC: SOF: Intel: hda-codec: Delay the codec device registration +- bus: moxtet: Add spi device table +- bus: moxtet: Mark the irq as shared +- ACPI: resource: Add another DMI match for the TongFang GMxXGxx +- ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 13-ay0xxx +- drm/crtc: fix uninitialized variable use +- x86/csum: clean up `csum_partial' further +- x86/csum: Remove unnecessary odd handling +- ARM: sun9i: smp: fix return code check of of_property_match_string +- connector: Fix proc_event_num_listeners count not cleared +- net: qrtr: ns: Return 0 if server port is not present +- nfc: Do not send datagram if socket state isn't LLCP_BOUND +- virtio_blk: fix snprintf truncation compiler warning +- ida: Fix crash in ida_free when the bitmap is empty +- posix-timers: Get rid of [COMPAT_]SYS_NI() uses +- pinctrl: cy8c95x0: Fix get_pincfg +- pinctrl: cy8c95x0: Fix regression +- pinctrl: cy8c95x0: Fix typo +- drm/amd/display: get dprefclk ss info from integration info table +- drm/amd/display: Add case for dcn35 to support usb4 dmub hpd event +- drm/amdkfd: svm range always mapped flag not working on APU +- i2c: rk3x: fix potential spinlock recursion on poll +- smb: client: fix potential OOB in smb2_dump_detail() +- HID: nintendo: Prevent divide-by-zero on code +- dm audit: fix Kconfig so DM_AUDIT depends on BLK_DEV_DM +- ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models +- ASoC: Intel: bytcr_rt5640: Add new swapped-speakers quirk +- ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346 +- platform/x86/amd/pmc: Disable keyboard wakeup on AMD Framework 13 +- platform/x86/amd/pmc: Move keyboard wakeup disablement detection to pmc-quirks +- platform/x86/amd/pmc: Only run IRQ1 firmware version check on Cezanne +- platform/x86/amd/pmc: Move platform defines to header +- platform/x86: thinkpad_acpi: fix for incorrect fan reporting on some ThinkPad systems +- HID: nintendo: fix initializer element is not constant error +- kselftest: alsa: fixed a print formatting warning +- driver core: Add a guard() definition for the device_lock() +- Input: xpad - add Razer Wolverine V2 support +- wifi: iwlwifi: pcie: avoid a NULL pointer dereference +- ARC: fix smatch warning +- ARC: fix spare error +- s390/scm: fix virtual vs physical address confusion +- ASoC: cs35l45: Prevents spinning during runtime suspend +- ASoC: cs35l45: Prevent IRQ handling when suspending/resuming +- ASoC: cs35l45: Use modern pm_ops +- pinctrl: amd: Mask non-wake source pins with interrupt enabled at suspend +- Input: i8042 - add nomux quirk for Acer P459-G2-M +- Input: atkbd - skip ATKBD_CMD_GETID in translated mode +- reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning +- Input: psmouse - enable Synaptics InterTouch for ThinkPad L14 G1 +- ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI +- tracing: Fix uaf issue when open the hist or hist_debug file +- MIPS: dts: loongson: drop incorrect dwmac fallback compatible +- stmmac: dwmac-loongson: drop useless check for compatible fallback +- tracing: Add size check when printing trace_marker output +- tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing +- jbd2: fix soft lockup in journal_finish_inode_data_buffers() +- efi/loongarch: Use load address to calculate kernel entry address +- platform/x86: intel-vbtn: Fix missing tablet-mode-switch events +- neighbour: Don't let neigh_forced_gc() disable preemption for long +- drm/crtc: Fix uninit-value bug in drm_mode_setcrtc +- jbd2: increase the journal IO's priority +- jbd2: correct the printing of write_flags in jbd2_write_superblock() +- soundwire: intel_ace2x: fix AC timing setting for ACE2.x +- clk: rockchip: rk3128: Fix HCLK_OTG gate register +- clk: rockchip: rk3568: Add PLL rate for 292.5MHz +- LoongArch: Preserve syscall nr across execve() +- LoongArch: Set unwind stack type to unknown rather than set error flag +- LoongArch: Apply dynamic relocations for LLD +- hwmon: (corsair-psu) Fix probe when built-in +- ALSA: pcmtest: stop timer before buffer is released +- drm/exynos: fix a wrong error checking +- drm/exynos: fix a potential error pointer dereference +- drm/amdgpu: Add NULL checks for function pointers +- drm/amd/display: Add monitor patch for specific eDP +- arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru +- nvme: fix deadlock between reset and scan +- nvme: prevent potential spectre v1 gadget +- nvme-ioctl: move capable() admin check to the end +- nvme: ensure reset state check ordering +- nvme: introduce helper function to get ctrl state +- ASoC: da7219: Support low DC impedance headset +- net/tg3: fix race condition in tg3_reset_task() +- pds_vdpa: set features order +- pds_vdpa: clear config callback when status goes to 0 +- pds_vdpa: fix up format-truncation complaint +- ASoC: SOF: ipc4-topology: Correct data structures for the GAIN module +- ASoC: SOF: ipc4-topology: Correct data structures for the SRC module +- ASoC: hdac_hda: Conditionally register dais for HDMI and Analog +- ASoC: amd: yc: Add DMI entry to support System76 Pangolin 13 +- nouveau/tu102: flush all pdbs on vmm flush +- ASoC: SOF: sof-audio: Modify logic for enabling/disabling topology cores +- ASoC: SOF: ipc4-topology: Add core_mask in struct snd_sof_pipeline +- ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not available +- ASoC: fsl_xcvr: refine the requested phy clock frequency +- ASoC: rt5650: add mutex to avoid the jack detection failure +- ASoC: fsl_xcvr: Enable 2 * TX bit clock for spdif only case +- ASoC: cs43130: Fix incorrect frame delay configuration +- ASoC: cs43130: Fix the position of const qualifier +- ASoC: Intel: Skylake: mem leak in skl register function +- ASoC: SOF: topology: Fix mem leak in sof_dai_load() +- ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16 +- ASoC: Intel: Skylake: Fix mem leak in few functions +- arm64: dts: rockchip: fix rk356x pcie msg interrupt name +- ASoC: wm8974: Correct boost mixer inputs +- ASoC: amd: yc: Add HP 255 G10 into quirk table +- nvme-core: check for too small lba shift +- blk-mq: don't count completed flush data request as inflight in case of quiesce +- smb: client, common: fix fortify warnings +- drm/amdgpu: Use another offset for GC 9.4.3 remap +- drm/amdkfd: Free gang_ctx_bo and wptr_bo in pqm_uninit +- drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer +- drm/amd/display: update dcn315 lpddr pstate latency +- drm/amdkfd: Use common function for IP version check +- drm/amdgpu: Do not issue gpu reset from nbio v7_9 bif interrupt +- block: warn once for each partition in bio_check_ro() +- io_uring: use fget/fput consistently +- nvme-core: fix a memory leak in nvme_ns_info_from_identify() +- ALSA: hda: intel-nhlt: Ignore vbps when looking for DMIC 32 bps format +- debugfs: fix automount d_fsdata usage +- wifi: mac80211: handle 320 MHz in ieee80211_ht_cap_ie_to_sta_ht_cap +- wifi: avoid offset calculation on NULL pointer +- wifi: cfg80211: lock wiphy mutex for rfkill poll +- mptcp: fix uninit-value in mptcp_incoming_options +- ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro +- pinctrl: lochnagar: Don't build on MIPS +- pinctrl: s32cc: Avoid possible string truncation +- nfsd: drop the nfsd_put helper +- media: qcom: camss: Comment CSID dt_id field +- cxl/memdev: Hold region_rwsem during inject and clear poison ops +- cxl/hdm: Fix a benign lockdep splat +- cxl: Add cxl_num_decoders_committed() usage to cxl_test +- mmc: sdhci-sprd: Fix eMMC init failure after hw reset +- mmc: core: Cancel delayed work before releasing host +- mmc: rpmb: fixes pause retune on all RPMB partitions. +- mmc: meson-mx-sdhc: Fix initialization frozen issue +- drm/amd/display: Fix sending VSC (+ colorimetry) packets for DP/eDP displays without PSR +- drm/amd/display: add nv12 bounding box +- drm/amdgpu: skip gpu_info fw loading on navi12 +- mm: fix unmap_mapping_range high bits shift bug +- i2c: core: Fix atomic xfer check for non-preempt config +- x86/kprobes: fix incorrect return address calculation in kprobe_emulate_call_indirect +- firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards +- mm/mglru: skip special VMAs in lru_gen_look_around() +- net: constify sk_dst_get() and __sk_dst_get() argument +- cxl/pmu: Ensure put_device on pmu devices +- net: prevent mss overflow in skb_segment() +- powerpc/pseries/vas: Migration suspend waits for no in-progress open windows +- RISCV: KVM: update external interrupt atomically for IMSIC swfile +- dmaengine: fsl-edma: fix wrong pointer check in fsl_edma3_attach_pd() +- dmaengine: idxd: Protect int_handle field in hw descriptor +- drm/amd/display: Increase frame warning limit with KASAN or KCSAN in dml +- kernel/resource: Increment by align value in get_free_mem_region() +- cxl/core: Always hold region_rwsem while reading poison lists +- cxl: Add cxl_decoders_committed() helper +- drm/amd/display: Increase num voltage states to 40 +- drm/i915: Call intel_pre_plane_updates() also for pipes getting enabled +- clk: rockchip: rk3128: Fix SCLK_SDMMC's clock name +- clk: rockchip: rk3128: Fix aclk_peri_src's parent +- phy: sunplus: return negative error code in sp_usb_phy_probe +- phy: mediatek: mipi: mt8183: fix minimal supported frequency +- iio: imu: adis16475: use bit numbers in assign_bit() +- dmaengine: fsl-edma: Add judgment on enabling round robin arbitration +- dmaengine: fsl-edma: Do not suspend and resume the masked dma channel when the system is sleeping +- dmaengine: ti: k3-psil-am62a: Fix SPI PDMA data +- dmaengine: ti: k3-psil-am62: Fix SPI PDMA data +- phy: ti: gmii-sel: Fix register offset when parent is not a syscon node +- KVM: s390: vsie: fix wrong VIR 37 when MSO is used +- riscv: don't probe unaligned access speed if already done +- rcu/tasks-trace: Handle new PF_IDLE semantics +- rcu/tasks: Handle new PF_IDLE semantics +- rcu: Introduce rcu_cpu_online() +- rcu: Break rcu_node_0 --> &rq->__lock order +- ACPI: thermal: Fix acpi_thermal_unregister_thermal_zone() cleanup +- RDMA/mlx5: Fix mkey cache WQ flush +- clk: si521xx: Increase stack based print buffer size in probe +- vfio/mtty: Overhaul mtty interrupt handling +- crypto: qat - fix double free during reset +- crypto: xts - use 'spawn' for underlying single-block cipher +- bpftool: Align output skeleton ELF code +- bpftool: Fix -Wcast-qual warning +- tcp: derive delack_max from rto_min +- media: qcom: camss: Fix genpd cleanup +- media: qcom: camss: Fix V4L2 async notifier error path +- xsk: add multi-buffer support for sockets sharing umem +- mm/memory-failure: pass the folio and the page to collect_procs() +- mm: convert DAX lock/unlock page to lock/unlock folio +- net: Implement missing SO_TIMESTAMPING_NEW cmsg support +- bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters() +- net: ravb: Wait for operating mode to be applied +- asix: Add check for usbnet_get_endpoints +- octeontx2-af: Re-enable MAC TX in otx2_stop processing +- octeontx2-af: Always configure NIX TX link credits based on max frame size +- net/smc: fix invalid link access in dumping SMC-R connections +- net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues +- virtio_net: fix missing dma unmap for resize +- virtio_net: avoid data-races on dev->stats fields +- apparmor: Fix move_mount mediation by detecting if source is detached +- igc: Fix hicredit calculation +- i40e: Restore VF MSI-X state during PCI reset +- ASoC: meson: g12a-tohdmitx: Fix event generation for S/PDIF mux +- ASoC: meson: g12a-toacodec: Fix event generation +- ASoC: meson: g12a-tohdmitx: Validate written enum values +- ASoC: meson: g12a-toacodec: Validate written enum values +- i40e: fix use-after-free in i40e_aqc_add_filters() +- net: Save and restore msg_namelen in sock_sendmsg +- netfilter: nft_immediate: drop chain reference counter on error +- netfilter: nf_nat: fix action not being set for all ct states +- net: bcmgenet: Fix FCS generation for fragmented skbuffs +- sfc: fix a double-free bug in efx_probe_filters +- ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init +- selftests: bonding: do not set port down when adding to bond +- net: Implement missing getsockopt(SO_TIMESTAMPING_NEW) +- r8169: Fix PCI error on system resume +- net: sched: em_text: fix possible memory leak in em_text_destroy() +- mlxbf_gige: fix receive packet race condition +- ASoC: mediatek: mt8186: fix AUD_PAD_TOP register and offset +- ASoC: fsl_rpmsg: Fix error handler with pm_runtime_enable +- igc: Check VLAN EtherType mask +- igc: Check VLAN TCI mask +- igc: Report VLAN EtherType matching back to user +- i40e: Fix filter input checks to prevent config with invalid values +- ice: Shut down VSI with "link-down-on-close" enabled +- ice: Fix link_down_on_close message +- drm/i915/perf: Update handling of MMIO triggered reports +- drm/i915/dp: Fix passing the correct DPCD_REV for drm_dp_set_phy_test_pattern +- octeontx2-af: Fix marking couple of structure as __packed +- nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local +- netfilter: nf_tables: set transport offset from mac header for netdev/egress +- drm/bridge: ps8640: Fix size mismatch warning w/ len +- drm/bridge: ti-sn65dsi86: Never store more than msg->size bytes in AUX xfer +- drm/bridge: parade-ps8640: Never store more than msg->size bytes in AUX xfer +- wifi: iwlwifi: pcie: don't synchronize IRQs from IRQ +- accel/qaic: Implement quirk for SOC_HW_VERSION +- accel/qaic: Fix GEM import path code +- KVM: x86/pmu: fix masking logic for MSR_CORE_PERF_GLOBAL_CTRL +- cifs: do not depend on release_iface for maintaining iface_list +- cifs: cifs_chan_is_iface_active should be called with chan_lock held +- drm/mgag200: Fix gamma lut not initialized for G200ER, G200EV, G200SE +- Revert "PCI/ASPM: Remove pcie_aspm_pm_state_change()" +- mptcp: prevent tcp diag from closing listener subflows +- drm/amd/display: pbn_div need be updated for hotplug event +- ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP ProBook 440 G6 +- ALSA: hda/realtek: fix mute/micmute LEDs for a HP ZBook +- ALSA: hda/realtek: enable SND_PCI_QUIRK for hp pavilion 14-ec1xxx series +- ALSA: hda/tas2781: remove sound controls in unbind +- ALSA: hda/tas2781: move set_drv_data outside tasdevice_init +- ALSA: hda/tas2781: do not use regcache +- keys, dns: Fix missing size check of V1 server-list header +- Revert "platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe" +- netfilter: nf_tables: skip set commit for deleted/destroyed sets +- wifi: nl80211: fix deadlock in nl80211_set_cqm_rssi (6.6.x) +- wifi: cfg80211: fix CQM for non-range use +- tracing: Fix blocked reader of snapshot buffer +- ftrace: Fix modification of direct_function hash while in use +- ring-buffer: Fix wake ups when buffer_percent is set to 100 +- Revert "nvme-fc: fix race between error recovery and creating association" +- mm/memory-failure: check the mapcount of the precise page +- mm/memory-failure: cast index to loff_t before shifting it +- mm: migrate high-order folios in swap cache correctly +- mm/filemap: avoid buffered read/write race to read inconsistent data +- selftests: secretmem: floor the memory size to the multiple of page_size +- maple_tree: do not preallocate nodes for slot stores +- platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe +- platform/x86/intel/pmc: Move GBE LTR ignore to suspend callback +- platform/x86/intel/pmc: Allow reenabling LTRs +- platform/x86/intel/pmc: Add suspend callback +- block: renumber QUEUE_FLAG_HW_WC +- mptcp: fix inconsistent state on fastopen race +- mptcp: fix possible NULL pointer dereference on close +- mptcp: refactor sndbuf auto-tuning +- linux/export: Ensure natural alignment of kcrctab array +- linux/export: Fix alignment for 64-bit ksymtab entries +- kexec: select CRYPTO from KEXEC_FILE instead of depending on it +- kexec: fix KEXEC_FILE dependencies +- virtio_ring: fix syncs DMA memory with different direction +- fs: cifs: Fix atime update check +- client: convert to new timestamp accessors +- fs: new accessor methods for atime and mtime +- ksmbd: avoid duplicate opinfo_put() call on error of smb21_lease_break_ack() +- ksmbd: lazy v2 lease break on smb2_write() +- ksmbd: send v2 lease break notification for directory +- ksmbd: downgrade RWH lease caching state to RH for directory +- ksmbd: set v2 lease capability +- ksmbd: set epoch in create context v2 lease +- ksmbd: don't update ->op_state as OPLOCK_STATE_NONE on error +- ksmbd: move setting SMB2_FLAGS_ASYNC_COMMAND and AsyncId +- ksmbd: release interim response after sending status pending response +- ksmbd: move oplock handling after unlock parent dir +- ksmbd: separately allocate ci per dentry +- ksmbd: prevent memory leak on error return +- ksmbd: fix kernel-doc comment of ksmbd_vfs_kern_path_locked() +- ksmbd: no need to wait for binded connection termination at logoff +- ksmbd: add support for surrogate pair conversion +- ksmbd: fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev() +- ksmbd: fix kernel-doc comment of ksmbd_vfs_setxattr() +- ksmbd: reorganize ksmbd_iov_pin_rsp() +- ksmbd: Remove unused field in ksmbd_user struct +- spi: cadence: revert "Add SPI transfer delays" +- x86/smpboot/64: Handle X2APIC BIOS inconsistency gracefully +- x86/alternatives: Disable interrupts and sync when optimizing NOPs in place +- x86/alternatives: Sync core before enabling interrupts +- KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy +- KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy() +- KVM: arm64: vgic: Simplify kvm_vgic_destroy() +- thunderbolt: Fix memory leak in margining_port_remove() +- lib/vsprintf: Fix %pfwf when current node refcount == 0 +- gpio: dwapb: mask/unmask IRQ when disable/enale it +- bus: ti-sysc: Flush posted write only after srst_udelay +- pinctrl: starfive: jh7100: ignore disabled device tree nodes +- pinctrl: starfive: jh7110: ignore disabled device tree nodes +- selftests: mptcp: join: fix subflow_send_ack lookup +- dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata() +- tracing / synthetic: Disable events after testing in synth_event_gen_test_init() +- scsi: core: Always send batch on reset or error handling command +- Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity" +- nvmem: brcm_nvram: store a copy of NVRAM content +- spi: atmel: Fix clock issue when using devices with different polarities +- spi: atmel: Prevent spi transfers from being killed +- spi: atmel: Do not cancel a transfer upon any signal +- ring-buffer: Fix slowpath of interrupted event +- ring-buffer: Remove useless update to write_stamp in rb_try_to_discard() +- ring-buffer: Fix 32-bit rb_time_read() race with rb_time_cmpxchg() +- 9p: prevent read overrun in protocol dump tracepoint +- drm/i915/dmc: Don't enable any pipe DMC events +- drm/i915: Reject async flips with bigjoiner +- smb: client: fix OOB in smbCalcSize() +- smb: client: fix OOB in SMB2_query_info_init() +- smb: client: fix potential OOB in cifs_dump_detail() +- smb: client: fix OOB in cifsd when receiving compounded resps +- nfsd: call nfsd_last_thread() before final nfsd_put() +- dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp +- net: stmmac: fix incorrect flag check in timestamp interrupt +- net: avoid build bug in skb extension length calculation +- net: ks8851: Fix TX stall caused by TX buffer overrun +- net: rfkill: gpio: set GPIO direction +- net: 9p: avoid freeing uninit memory in p9pdu_vreadf +- Input: soc_button_array - add mapping for airplane mode button +- net: usb: ax88179_178a: avoid failed operations when device is disconnected +- usb: fotg210-hcd: delete an incorrect bounds test +- usb: typec: ucsi: fix gpio-based orientation detection +- Bluetooth: Add more enc key size check +- Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE +- Bluetooth: L2CAP: Send reject on command corrupted request +- Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg +- Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent +- ASoC: tas2781: check the validity of prm_no/cfg_no +- ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA +- ALSA: hda/tas2781: select program 0, conf 0 by default +- USB: serial: option: add Quectel RM500Q R13 firmware support +- USB: serial: option: add Foxconn T99W265 with new baseline +- USB: serial: option: add Quectel EG912Y module support +- USB: serial: ftdi_sio: update Actisense PIDs constant names +- wifi: cfg80211: fix certs build to not depend on file order +- wifi: cfg80211: Add my certificate +- wifi: mt76: fix crash with WED rx support enabled +- usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3 +- ARM: dts: Fix occasional boot hang for am3 usb +- ALSA: usb-audio: Increase delay in MOTU M quirk +- iio: triggered-buffer: prevent possible freeing of wrong buffer +- iio: tmag5273: fix temperature offset +- iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma() +- iio: imu: adis16475: add spi_device_id table +- iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table +- iio: adc: imx93: add four channels for imx93 adc +- iio: kx022a: Fix acceleration value scaling +- scsi: ufs: core: Let the sq_lock protect sq_tail_slot access +- scsi: ufs: qcom: Return ufs_qcom_clk_scale_*() errors in ufs_qcom_clk_scale_notify() +- scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() +- iio: adc: meson: add separate config for axg SoC family +- Input: ipaq-micro-keys - add error handling for devm_kmemdup +- interconnect: qcom: sm8250: Enable sync_state +- iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw +- interconnect: Treat xlate() returning NULL node as an error +- nvme-pci: fix sleeping function called from interrupt context +- gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl() +- pinctrl: at91-pio4: use dedicated lock class for IRQ +- x86/xen: add CPU dependencies for 32-bit build +- i2c: aspeed: Handle the coalesced stop conditions with the start conditions. +- drm/amdgpu: re-create idle bo's PTE during VM state machine reset +- i2c: qcom-geni: fix missing clk_disable_unprepare() and geni_se_resources_off() +- ASoC: fsl_sai: Fix channel swap issue on i.MX8MP +- ASoC: hdmi-codec: fix missing report for jack initial status +- drm/i915/mtl: Fix HDMI/DP PLL clock selection +- drm/i915/hwmon: Fix static analysis tool reported issues +- afs: Fix use-after-free due to get/remove race in volume tree +- afs: Fix overwriting of result of DNS query +- keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry +- net: check dev->gso_max_size in gso_features_check() +- net/ipv6: Revert remove expired routes with a separated list of routes +- net: ethernet: mtk_wed: fix possible NULL pointer dereference in mtk_wed_wo_queue_tx_clean() +- afs: Fix dynamic root lookup DNS check +- afs: Fix the dynamic root's d_delete to always delete unused dentries +- net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() +- net: mana: select PAGE_POOL +- ice: Fix PF with enabled XDP going no-carrier after reset +- ice: alter feature support check for SRIOV and LAG +- ice: stop trashing VF VSI aggregator node ID information +- net: phy: skip LED triggers on PHYs on SFP modules +- bnxt_en: do not map packet buffers twice +- Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis +- Bluetooth: hci_event: shut up a false-positive warning +- Bluetooth: Fix deadlock in vhci_send_frame +- Bluetooth: Fix not notifying when connection encryption changes +- net/rose: fix races in rose_kill_by_device() +- ethernet: atheros: fix a memleak in atl1e_setup_ring_resources +- net: sched: ife: fix potential use-after-free +- net: Return error from sk_stream_wait_connect() if sk_wait_event() fails +- octeontx2-pf: Fix graceful exit during PFC configuration failure +- net: mscc: ocelot: fix pMAC TX RMON stats for bucket 256-511 and above +- net: mscc: ocelot: fix eMAC TX RMON stats for bucket 256-511 and above +- net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors +- net/mlx5e: Correct snprintf truncation handling for fw_version buffer +- net/mlx5e: Fix error codes in alloc_branch_attr() +- net/mlx5e: Fix error code in mlx5e_tc_action_miss_mapping_get() +- net/mlx5: Refactor mlx5_flow_destination->rep pointer to vport num +- net/mlx5: Fix fw tracer first block check +- net/mlx5e: XDP, Drop fragmented packets larger than MTU size +- net/mlx5e: Decrease num_block_tc when unblock tc offload +- net/mlx5e: Fix overrun reported by coverity +- net/mlx5e: fix a potential double-free in fs_udp_create_groups +- net/mlx5e: Fix a race in command alloc flow +- net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list() +- Revert "net/mlx5e: fix double free of encap_header" +- Revert "net/mlx5e: fix double free of encap_header in update funcs" +- bpf: syzkaller found null ptr deref in unix_bpf proto add +- ice: fix theoretical out-of-bounds access in ethtool link modes +- wifi: mac80211: mesh_plink: fix matches_local logic +- wifi: mac80211: mesh: check element parsing succeeded +- wifi: mac80211: check defragmentation succeeded +- wifi: mac80211: don't re-add debugfs during reconfig +- wifi: mac80211: check if the existing link config remains unchanged +- wifi: iwlwifi: pcie: add another missing bh-disable for rxq->lock +- wifi: ieee80211: don't require protected vendor action frames +- SUNRPC: Revert 5f7fc5d69f6e92ec0b38774c387f5cf7812c5806 +- platform/x86/intel/pmc: Fix hang in pmc_core_send_ltr_ignore() +- s390/vx: fix save/restore of fpu kernel context +- reset: Fix crash when freeing non-existent optional resets +- ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init +- ARM: dts: dra7: Fix DRA7 L3 NoC node register size +- arm64: dts: allwinner: h616: update emac for Orange Pi Zero 3 +- spi: spi-imx: correctly configure burst length when using dma +- drm: Fix FD ownership check in drm_master_check_perm() +- drm: Update file owner during use +- drm/i915/edp: don't write to DP_LINK_BW_SET when using rate select +- drm/i915: Introduce crtc_state->enhanced_framing +- drm/i915: Fix FEC state dump +- drm/amd/display: fix hw rotated modes when PSR-SU is enabled +- btrfs: free qgroup pertrans reserve on transaction abort +- btrfs: qgroup: use qgroup_iterator in qgroup_convert_meta() +- btrfs: qgroup: iterate qgroups without memory allocation for qgroup_reserve() +- mm/damon/core: make damon_start() waits until kdamond_fn() starts +- mm/damon/core: use number of passed access sampling as a timer +- bpf: Fix prog_array_map_poke_run map poke update +- !5451 arm64: Delete macro in the scsnp feature +- arm64: Delete macro in the scsnp feature +- !5037 [OLK-6.6] Add support for Mucse Network Adapter(N500/N210) +- drivers: initial support for rnpgbe drivers from Mucse Technology +- !4782 [OLK-6.6] Add drivers support for Mucse Network Adapter rnpm (N10/N400) +- drivers: initial support for rnpm drivers from Mucse Technology +- !5340 CVE-2023-52593 +- wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap() +- !5341 powerpc/lib: Validate size for vector operations +- powerpc/lib: Validate size for vector operations +- !5346 v2 s390/vfio-ap: always filter entire AP matrix +- s390/vfio-ap: always filter entire AP matrix +- !5248 mm: cachestat: fix folio read-after-free in cache walk +- mm: cachestat: fix folio read-after-free in cache walk +- !5212 [OLK-6.6] Support PSPCCP/NTBCCP identification for Hygon 2th and 3th CPU +- crypto: ccp: Add Hygon CSV support +- crypto: ccp: Fixup the capability of Hygon PSP during initialization +- !5318 Backport 6.6.8 LTS Patches +- RDMA/mlx5: Change the key being sent for MPV device affiliation +- x86/speculation, objtool: Use absolute relocations for annotations +- ring-buffer: Have rb_time_cmpxchg() set the msb counter too +- ring-buffer: Do not try to put back write_stamp +- ring-buffer: Fix a race in rb_time_cmpxchg() for 32 bit archs +- ring-buffer: Fix writing to the buffer with max_data_size +- ring-buffer: Have saved event hold the entire event +- ring-buffer: Do not update before stamp when switching sub-buffers +- tracing: Update snapshot buffer on resize if it is allocated +- ring-buffer: Fix memory leak of free page +- smb: client: fix OOB in smb2_query_reparse_point() +- smb: client: fix NULL deref in asn1_ber_decoder() +- smb: client: fix potential OOBs in smb2_parse_contexts() +- drm/i915: Fix remapped stride with CCS on ADL+ +- drm/i915: Fix intel_atomic_setup_scalers() plane_state handling +- drm/i915: Fix ADL+ tiled plane stride when the POT stride is smaller than the original +- drm/amd/display: Disable PSR-SU on Parade 0803 TCON again +- drm/amd/display: Restore guard against default backlight value < 1 nit +- drm/edid: also call add modes in EDID connector update fallback +- drm/amdgpu: fix tear down order in amdgpu_vm_pt_free +- btrfs: don't clear qgroup reserved bit in release_folio +- btrfs: fix qgroup_free_reserved_data int overflow +- btrfs: free qgroup reserve when ORDERED_IOERR is set +- kexec: drop dependency on ARCH_SUPPORTS_KEXEC from CRASH_DUMP +- mm/shmem: fix race in shmem_undo_range w/THP +- mm/mglru: reclaim offlined memcgs harder +- mm/mglru: respect min_ttl_ms with memcgs +- mm/mglru: try to stop at high watermarks +- mm/mglru: fix underprotected page cache +- dmaengine: fsl-edma: fix DMA channel leak in eDMAv4 +- dmaengine: stm32-dma: avoid bitfield overflow assertion +- drm/mediatek: Fix access violation in mtk_drm_crtc_dma_dev_get +- drm/amdgpu/sdma5.2: add begin/end_use ring callbacks +- team: Fix use-after-free when an option instance allocation fails +- arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify +- Revert "selftests: error out if kernel header files are not yet built" +- ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS +- soundwire: stream: fix NULL pointer dereference for multi_link +- cxl/hdm: Fix dpa translation locking +- btrfs: do not allow non subvolume root targets for snapshot +- perf: Fix perf_event_validate_size() lockdep splat +- HID: hid-asus: add const to read-only outgoing usb buffer +- arm64: add dependency between vmlinuz.efi and Image +- smb: client: set correct file type from NFS reparse points +- smb: client: introduce ->parse_reparse_point() +- smb: client: implement ->query_reparse_point() for SMB1 +- net: usb: qmi_wwan: claim interface 4 for ZTE MF290 +- eventfs: Do not allow NULL parent to eventfs_start_creating() +- asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation +- scripts/checkstack.pl: match all stack sizes for s390 +- nfc: virtual_ncidev: Add variable to check if ndev is running +- HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad +- HID: hid-asus: reset the backlight brightness level on resume +- HID: add ALWAYS_POLL quirk for Apple kb +- HID: glorious: fix Glorious Model I HID report +- HID: apple: add Jamesdonkey and A3R to non-apple keyboards list +- HID: mcp2221: Allow IO to start during probe +- HID: mcp2221: Set driver data before I2C adapter add +- platform/x86: intel_telemetry: Fix kernel doc descriptions +- LoongArch: Mark {dmw,tlb}_virt_to_page() exports as non-GPL +- LoongArch: Silence the boot warning about 'nokaslr' +- LoongArch: Record pc instead of offset in la_abs relocation +- LoongArch: Add dependency between vmlinuz.efi and vmlinux.efi +- selftests/bpf: fix bpf_loop_bench for new callback verification scheme +- nvme: catch errors from nvme_configure_metadata() +- nvme-auth: set explanation code for failure2 msgs +- bcache: avoid NULL checking to c->root in run_cache_set() +- bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() +- bcache: remove redundant assignment to variable cur_idx +- bcache: avoid oversize memory allocation by small stripe_size +- blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" +- rxrpc: Fix some minor issues with bundle tracing +- stmmac: dwmac-loongson: Add architecture dependency +- usb: aqc111: check packet for fixup for true limit +- x86/hyperv: Fix the detection of E820_TYPE_PRAM in a Gen2 VM +- selftests/mm: cow: print ksft header before printing anything else +- drm/i915: Use internal class when counting engine resets +- drm/i915/selftests: Fix engine reset count storage for multi-tile +- accel/ivpu/37xx: Fix interrupt_clear_with_0 WA initialization +- accel/ivpu: Print information about used workarounds +- drm/mediatek: Add spinlock for setting vblank event in atomic_begin +- drm/mediatek: fix kernel oops if no crtc is found +- PCI: vmd: Fix potential deadlock when enabling ASPM +- ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE +- PCI/ASPM: Add pci_enable_link_state_locked() +- PCI: loongson: Limit MRRS to 256 +- Revert "PCI: acpiphp: Reassign resources on bridge if necessary" +- ALSA: hda/tas2781: reset the amp before component_add +- ALSA: hda/tas2781: call cleanup functions only once +- ALSA: hda/tas2781: handle missing EFI calibration data +- ALSA: hda/tas2781: leave hda_component in usable state +- ALSA: hda/realtek: Apply mute LED quirk for HP15-db +- ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170 variants +- ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB +- io_uring/cmd: fix breakage in SOCKET_URING_OP_SIOC* implementation +- fuse: dax: set fc->dax to NULL in fuse_dax_conn_free() +- fuse: disable FOPEN_PARALLEL_DIRECT_WRITES with FUSE_DIRECT_IO_ALLOW_MMAP +- fuse: share lookup state between submount and its parent +- fuse: Rename DIRECT_IO_RELAX to DIRECT_IO_ALLOW_MMAP +- HID: Add quirk for Labtec/ODDOR/aikeec handbrake +- HID: i2c-hid: Add IDEA5002 to i2c_hid_acpi_blacklist[] +- net: atlantic: fix double free in ring reinit logic +- appletalk: Fix Use-After-Free in atalk_ioctl +- net: stmmac: Handle disabled MDIO busses from devicetree +- net: stmmac: dwmac-qcom-ethqos: Fix drops in 10M SGMII RX +- dpaa2-switch: do not ask for MDB, VLAN and FDB replay +- dpaa2-switch: fix size of the dma_unmap +- vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() +- sign-file: Fix incorrect return values check +- stmmac: dwmac-loongson: Make sure MDIO is initialized before use +- net: ena: Fix XDP redirection error +- net: ena: Fix DMA syncing in XDP path when SWIOTLB is on +- net: ena: Fix xdp drops handling due to multibuf packets +- net: ena: Destroy correct number of xdp queues upon failure +- net: Remove acked SYN flag from packet in the transmit queue correctly +- qed: Fix a potential use-after-free in qed_cxt_tables_alloc +- iavf: Fix iavf_shutdown to call iavf_remove instead iavf_close +- iavf: Handle ntuple on/off based on new state machines for flow director +- iavf: Introduce new state machines for flow director +- net/rose: Fix Use-After-Free in rose_ioctl +- atm: Fix Use-After-Free in do_vcc_ioctl +- octeontx2-af: Fix pause frame configuration +- octeontx2-af: Update RSS algorithm index +- octeontx2-pf: Fix promisc mcam entry action +- octeon_ep: explicitly test for firmware ready value +- net/sched: act_ct: Take per-cb reference to tcf_ct_flow_table +- octeontx2-af: fix a use-after-free in rvu_nix_register_reporters +- net: fec: correct queue selection +- atm: solos-pci: Fix potential deadlock on &tx_queue_lock +- atm: solos-pci: Fix potential deadlock on &cli_queue_lock +- bnxt_en: Fix HWTSTAMP_FILTER_ALL packet timestamp logic +- bnxt_en: Fix wrong return value check in bnxt_close_nic() +- bnxt_en: Fix skb recycling logic in bnxt_deliver_skb() +- bnxt_en: Clear resource reservation during resume +- qca_spi: Fix reset behavior +- qca_debug: Fix ethtool -G iface tx behavior +- qca_debug: Prevent crash on TX ring changes +- net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX +- net/mlx5: Fix a NULL vs IS_ERR() check +- net/mlx5e: Check netdev pointer before checking its net ns +- net/mlx5: Nack sync reset request when HotPlug is enabled +- net/mlx5e: TC, Don't offload post action rule if not supported +- net/mlx5e: Fix possible deadlock on mlx5e_tx_timeout_work +- net/mlx5e: Disable IPsec offload support if not FW steering +- RDMA/mlx5: Send events from IB driver about device affiliation state +- net/mlx5e: Check the number of elements before walk TC rhashtable +- net/mlx5e: Reduce eswitch mode_lock protection context +- net/mlx5e: Tidy up IPsec NAT-T SA discovery +- net/mlx5e: Unify esw and normal IPsec status table creation/destruction +- net/mlx5e: Ensure that IPsec sequence packet number starts from 1 +- net/mlx5e: Honor user choice of IPsec replay window size +- HID: lenovo: Restrict detection of patched firmware only to USB cptkbd +- afs: Fix refcount underflow from error handling race +- efi/x86: Avoid physical KASLR on older Dell systems +- ksmbd: fix memory leak in smb2_lock() +- ext4: fix warning in ext4_dio_write_end_io() +- r8152: add vendor/device ID pair for ASUS USB-C2500 +- !5239 crypto: hisilicon support no-sva feature +- crypto: hisilicon/qm - register to UACCE subsystem in UACCE_MODE_NOIOMMU mode +- crypto: hisilicon/qm - get the type of iommu +- uacce: support UACCE_MODE_NOIOMMU mode +- !5256 net: hns3: some bugfix for the HNS3 ethernet driver +- net: hns3: add checking for vf id of mailbox +- net: hns3: fix port duplex configure error in IMP reset +- net: hns3: fix reset timeout under full functions and queues +- net: hns3: fix delete tc fail issue +- net: hns3: fix kernel crash when 1588 is received on HIP08 devices +- net: hns3: Disable SerDes serial loopback for HiLink H60 +- net: hns3: add new 200G link modes for hisilicon device +- net: hns3: fix wrong judgment condition issue +- !5250 f2fs: fix to tag gcing flag on page during block migration +- f2fs: fix to tag gcing flag on page during block migration +- !5249 btrfs: scrub: avoid use-after-free when chunk length is not 64K aligned +- btrfs: scrub: avoid use-after-free when chunk length is not 64K aligned +- !5244 ceph: fix deadlock or deadcode of misusing dget() +- ceph: fix deadlock or deadcode of misusing dget() +- !5180 RDMA/hns: Support hns RoCE Bonding +- RDMA/hns: Fix the concurrency error between bond and reset. +- RDMA/hns: Fix the device loss after unbinding RoCE bond resource slave +- RDMA/hns: Fix wild pointer error of RoCE bonding when rmmod hns3 +- RDMA/hns: Support reset recovery for RoCE bonding +- RDMA/hns: Add functions to obtain netdev and bus_num from an hr_dev +- RDMA/hns: Support dispatching IB event for RoCE bonding +- RDMA/hns: Set IB port state depending on upper device for RoCE bonding +- RDMA/hns: Support RoCE bonding + * Thu Mar 14 2024 Zheng Zengkai - 6.6.0-12.0.0.8 - !5174 [OLK-6.6][sync from OLK-5.10] Introduce multiple LPI translation caches - KVM:arm64:vgic update openEuler's config's to enable MULTI_LPI_TRANSLATE_CACHE From c887853a77d3cdac7b92d65a44a680fae18ddf25 Mon Sep 17 00:00:00 2001 From: liuzh Date: Thu, 23 May 2024 15:38:19 +0800 Subject: [PATCH 2/2] fix haoc-kernel patch file. --- 0005-haoc-kernel.patch | 20 -------------------- 1 file changed, 20 deletions(-) diff --git a/0005-haoc-kernel.patch b/0005-haoc-kernel.patch index c5bc614..2d9484f 100644 --- a/0005-haoc-kernel.patch +++ b/0005-haoc-kernel.patch @@ -106,7 +106,6 @@ Date: Wed Mar 6 12:31:11 2024 +0800 migrate openeuler-commit code. (need some fix before compiling) --- - .gitignore | 4 + Makefile | 3 +- arch/arm64/Kconfig | 18 + arch/arm64/include/asm/assembler.h | 67 + @@ -232,25 +231,6 @@ Date: Wed Mar 6 12:31:11 2024 +0800 create mode 100644 arch/arm64/kernel/koi/koi.c create mode 100644 include/linux/iee-func.h -diff --git a/.gitignore b/.gitignore -index 0bbae167bf93..77b3024b92d5 100644 ---- a/.gitignore -+++ b/.gitignore -@@ -51,6 +51,7 @@ - *.tar - *.xz - *.zst -+*.log - Module.symvers - modules.order - -@@ -170,3 +171,6 @@ sphinx_*/ - - # Rust analyzer configuration - /rust-project.json -+ -+#command -+command.txt diff --git a/Makefile b/Makefile index 8e6d9b894b1e..20c367b5957d 100644 --- a/Makefile