commit: d4630fe751cd5a8ff485433d08677e44f878f704 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Sun Aug 8 13:36:39 2021 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Sun Aug 8 13:36:39 2021 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d4630fe7
Linux patch 5.10.57 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1056_linux-5.10.57.patch | 1905 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1909 insertions(+) diff --git a/0000_README b/0000_README index f79bdd7..5f127c2 100644 --- a/0000_README +++ b/0000_README @@ -267,6 +267,10 @@ Patch: 1055_linux-5.10.56.patch From: http://www.kernel.org Desc: Linux 5.10.56 +Patch: 1056_linux-5.10.57.patch +From: http://www.kernel.org +Desc: Linux 5.10.57 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1056_linux-5.10.57.patch b/1056_linux-5.10.57.patch new file mode 100644 index 0000000..d23eda4 --- /dev/null +++ b/1056_linux-5.10.57.patch @@ -0,0 +1,1905 @@ +diff --git a/Makefile b/Makefile +index 0090f53846e9c..e9621a90e752f 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 10 +-SUBLEVEL = 56 ++SUBLEVEL = 57 + EXTRAVERSION = + NAME = Dare mighty things + +diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c +index 1377ec76a45db..def8a84d1611b 100644 +--- a/drivers/firmware/arm_scmi/bus.c ++++ b/drivers/firmware/arm_scmi/bus.c +@@ -113,6 +113,9 @@ int scmi_driver_register(struct scmi_driver *driver, struct module *owner, + { + int retval; + ++ if (!driver->probe) ++ return -EINVAL; ++ + driver->driver.bus = &scmi_bus_type; + driver->driver.name = driver->name; + driver->driver.owner = owner; +diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c +index 8c9663258d5d4..7632232486645 100644 +--- a/drivers/firmware/arm_scmi/driver.c ++++ b/drivers/firmware/arm_scmi/driver.c +@@ -436,8 +436,12 @@ int scmi_do_xfer_with_response(const struct scmi_handle *handle, + xfer->async_done = &async_response; + + ret = scmi_do_xfer(handle, xfer); +- if (!ret && !wait_for_completion_timeout(xfer->async_done, timeout)) +- ret = -ETIMEDOUT; ++ if (!ret) { ++ if (!wait_for_completion_timeout(xfer->async_done, timeout)) ++ ret = -ETIMEDOUT; ++ else if (xfer->hdr.status) ++ ret = scmi_to_linux_errno(xfer->hdr.status); ++ } + + xfer->async_done = NULL; + return ret; +diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c +index d8bc013406861..38722d2009e20 100644 +--- a/drivers/firmware/efi/mokvar-table.c ++++ b/drivers/firmware/efi/mokvar-table.c +@@ -180,7 +180,10 @@ void __init efi_mokvar_table_init(void) + pr_err("EFI MOKvar config table is not valid\n"); + return; + } +- efi_mem_reserve(efi.mokvar_table, map_size_needed); ++ ++ if (md.type == EFI_BOOT_SERVICES_DATA) ++ efi_mem_reserve(efi.mokvar_table, map_size_needed); ++ + efi_mokvar_table_size = map_size_needed; + } + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +index 1812ec7ee11bb..cfe85ba1018e8 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +@@ -2077,8 +2077,10 @@ int dcn20_populate_dml_pipes_from_context( + - timing->v_border_bottom; + pipes[pipe_cnt].pipe.dest.htotal = timing->h_total; + pipes[pipe_cnt].pipe.dest.vtotal = v_total; +- pipes[pipe_cnt].pipe.dest.hactive = timing->h_addressable; +- pipes[pipe_cnt].pipe.dest.vactive = timing->v_addressable; ++ pipes[pipe_cnt].pipe.dest.hactive = ++ timing->h_addressable + timing->h_border_left + timing->h_border_right; ++ pipes[pipe_cnt].pipe.dest.vactive = ++ timing->v_addressable + timing->v_border_top + timing->v_border_bottom; + pipes[pipe_cnt].pipe.dest.interlaced = timing->flags.INTERLACE; + pipes[pipe_cnt].pipe.dest.pixel_rate_mhz = timing->pix_clk_100hz/10000.0; + if (timing->timing_3d_format == TIMING_3D_FORMAT_HW_FRAME_PACKING) +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c +index 367c82b5ab4c1..c09bca3350687 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c +@@ -4888,7 +4888,7 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + } + } while ((locals->PrefetchSupported[i][j] != true || locals->VRatioInPrefetchSupported[i][j] != true) + && (mode_lib->vba.NextMaxVStartup != mode_lib->vba.MaxMaxVStartup[0][0] +- || mode_lib->vba.NextPrefetchMode < mode_lib->vba.MaxPrefetchMode)); ++ || mode_lib->vba.NextPrefetchMode <= mode_lib->vba.MaxPrefetchMode)); + + if (locals->PrefetchSupported[i][j] == true && locals->VRatioInPrefetchSupported[i][j] == true) { + mode_lib->vba.BandwidthAvailableForImmediateFlip = locals->ReturnBWPerState[i][0]; +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +index bd3046e5a9348..e5ac0936a5871 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +@@ -24,7 +24,6 @@ + #include "i915_gem_clflush.h" + #include "i915_gem_context.h" + #include "i915_gem_ioctls.h" +-#include "i915_sw_fence_work.h" + #include "i915_trace.h" + #include "i915_user_extensions.h" + +@@ -1401,6 +1400,10 @@ static u32 *reloc_gpu(struct i915_execbuffer *eb, + int err; + struct intel_engine_cs *engine = eb->engine; + ++ /* If we need to copy for the cmdparser, we will stall anyway */ ++ if (eb_use_cmdparser(eb)) ++ return ERR_PTR(-EWOULDBLOCK); ++ + if (!reloc_can_use_engine(engine)) { + engine = engine->gt->engine_class[COPY_ENGINE_CLASS][0]; + if (!engine) +@@ -2267,152 +2270,6 @@ shadow_batch_pin(struct i915_execbuffer *eb, + return vma; + } + +-struct eb_parse_work { +- struct dma_fence_work base; +- struct intel_engine_cs *engine; +- struct i915_vma *batch; +- struct i915_vma *shadow; +- struct i915_vma *trampoline; +- unsigned long batch_offset; +- unsigned long batch_length; +-}; +- +-static int __eb_parse(struct dma_fence_work *work) +-{ +- struct eb_parse_work *pw = container_of(work, typeof(*pw), base); +- +- return intel_engine_cmd_parser(pw->engine, +- pw->batch, +- pw->batch_offset, +- pw->batch_length, +- pw->shadow, +- pw->trampoline); +-} +- +-static void __eb_parse_release(struct dma_fence_work *work) +-{ +- struct eb_parse_work *pw = container_of(work, typeof(*pw), base); +- +- if (pw->trampoline) +- i915_active_release(&pw->trampoline->active); +- i915_active_release(&pw->shadow->active); +- i915_active_release(&pw->batch->active); +-} +- +-static const struct dma_fence_work_ops eb_parse_ops = { +- .name = "eb_parse", +- .work = __eb_parse, +- .release = __eb_parse_release, +-}; +- +-static inline int +-__parser_mark_active(struct i915_vma *vma, +- struct intel_timeline *tl, +- struct dma_fence *fence) +-{ +- struct intel_gt_buffer_pool_node *node = vma->private; +- +- return i915_active_ref(&node->active, tl->fence_context, fence); +-} +- +-static int +-parser_mark_active(struct eb_parse_work *pw, struct intel_timeline *tl) +-{ +- int err; +- +- mutex_lock(&tl->mutex); +- +- err = __parser_mark_active(pw->shadow, tl, &pw->base.dma); +- if (err) +- goto unlock; +- +- if (pw->trampoline) { +- err = __parser_mark_active(pw->trampoline, tl, &pw->base.dma); +- if (err) +- goto unlock; +- } +- +-unlock: +- mutex_unlock(&tl->mutex); +- return err; +-} +- +-static int eb_parse_pipeline(struct i915_execbuffer *eb, +- struct i915_vma *shadow, +- struct i915_vma *trampoline) +-{ +- struct eb_parse_work *pw; +- int err; +- +- GEM_BUG_ON(overflows_type(eb->batch_start_offset, pw->batch_offset)); +- GEM_BUG_ON(overflows_type(eb->batch_len, pw->batch_length)); +- +- pw = kzalloc(sizeof(*pw), GFP_KERNEL); +- if (!pw) +- return -ENOMEM; +- +- err = i915_active_acquire(&eb->batch->vma->active); +- if (err) +- goto err_free; +- +- err = i915_active_acquire(&shadow->active); +- if (err) +- goto err_batch; +- +- if (trampoline) { +- err = i915_active_acquire(&trampoline->active); +- if (err) +- goto err_shadow; +- } +- +- dma_fence_work_init(&pw->base, &eb_parse_ops); +- +- pw->engine = eb->engine; +- pw->batch = eb->batch->vma; +- pw->batch_offset = eb->batch_start_offset; +- pw->batch_length = eb->batch_len; +- pw->shadow = shadow; +- pw->trampoline = trampoline; +- +- /* Mark active refs early for this worker, in case we get interrupted */ +- err = parser_mark_active(pw, eb->context->timeline); +- if (err) +- goto err_commit; +- +- err = dma_resv_reserve_shared(pw->batch->resv, 1); +- if (err) +- goto err_commit; +- +- /* Wait for all writes (and relocs) into the batch to complete */ +- err = i915_sw_fence_await_reservation(&pw->base.chain, +- pw->batch->resv, NULL, false, +- 0, I915_FENCE_GFP); +- if (err < 0) +- goto err_commit; +- +- /* Keep the batch alive and unwritten as we parse */ +- dma_resv_add_shared_fence(pw->batch->resv, &pw->base.dma); +- +- /* Force execution to wait for completion of the parser */ +- dma_resv_add_excl_fence(shadow->resv, &pw->base.dma); +- +- dma_fence_work_commit_imm(&pw->base); +- return 0; +- +-err_commit: +- i915_sw_fence_set_error_once(&pw->base.chain, err); +- dma_fence_work_commit_imm(&pw->base); +- return err; +- +-err_shadow: +- i915_active_release(&shadow->active); +-err_batch: +- i915_active_release(&eb->batch->vma->active); +-err_free: +- kfree(pw); +- return err; +-} +- + static struct i915_vma *eb_dispatch_secure(struct i915_execbuffer *eb, struct i915_vma *vma) + { + /* +@@ -2494,13 +2351,11 @@ static int eb_parse(struct i915_execbuffer *eb) + eb->batch_flags |= I915_DISPATCH_SECURE; + } + +- batch = eb_dispatch_secure(eb, shadow); +- if (IS_ERR(batch)) { +- err = PTR_ERR(batch); +- goto err_trampoline; +- } +- +- err = eb_parse_pipeline(eb, shadow, trampoline); ++ err = intel_engine_cmd_parser(eb->engine, ++ eb->batch->vma, ++ eb->batch_start_offset, ++ eb->batch_len, ++ shadow, trampoline); + if (err) + goto err_unpin_batch; + +@@ -2522,7 +2377,6 @@ secure_batch: + err_unpin_batch: + if (batch) + i915_vma_unpin(batch); +-err_trampoline: + if (trampoline) + i915_vma_unpin(trampoline); + err_shadow: +diff --git a/drivers/gpu/drm/i915/i915_cmd_parser.c b/drivers/gpu/drm/i915/i915_cmd_parser.c +index 9ce174950340b..635aae9145cb2 100644 +--- a/drivers/gpu/drm/i915/i915_cmd_parser.c ++++ b/drivers/gpu/drm/i915/i915_cmd_parser.c +@@ -1143,27 +1143,30 @@ find_reg(const struct intel_engine_cs *engine, u32 addr) + /* Returns a vmap'd pointer to dst_obj, which the caller must unmap */ + static u32 *copy_batch(struct drm_i915_gem_object *dst_obj, + struct drm_i915_gem_object *src_obj, +- unsigned long offset, unsigned long length) ++ u32 offset, u32 length) + { +- bool needs_clflush; ++ unsigned int src_needs_clflush; ++ unsigned int dst_needs_clflush; + void *dst, *src; + int ret; + ++ ret = i915_gem_object_prepare_write(dst_obj, &dst_needs_clflush); ++ if (ret) ++ return ERR_PTR(ret); ++ + dst = i915_gem_object_pin_map(dst_obj, I915_MAP_FORCE_WB); ++ i915_gem_object_finish_access(dst_obj); + if (IS_ERR(dst)) + return dst; + +- ret = i915_gem_object_pin_pages(src_obj); ++ ret = i915_gem_object_prepare_read(src_obj, &src_needs_clflush); + if (ret) { + i915_gem_object_unpin_map(dst_obj); + return ERR_PTR(ret); + } + +- needs_clflush = +- !(src_obj->cache_coherent & I915_BO_CACHE_COHERENT_FOR_READ); +- + src = ERR_PTR(-ENODEV); +- if (needs_clflush && i915_has_memcpy_from_wc()) { ++ if (src_needs_clflush && i915_has_memcpy_from_wc()) { + src = i915_gem_object_pin_map(src_obj, I915_MAP_WC); + if (!IS_ERR(src)) { + i915_unaligned_memcpy_from_wc(dst, +@@ -1185,7 +1188,7 @@ static u32 *copy_batch(struct drm_i915_gem_object *dst_obj, + * validate up to the end of the batch. + */ + remain = length; +- if (!(dst_obj->cache_coherent & I915_BO_CACHE_COHERENT_FOR_READ)) ++ if (dst_needs_clflush & CLFLUSH_BEFORE) + remain = round_up(remain, + boot_cpu_data.x86_clflush_size); + +@@ -1195,7 +1198,7 @@ static u32 *copy_batch(struct drm_i915_gem_object *dst_obj, + int len = min(remain, PAGE_SIZE - x); + + src = kmap_atomic(i915_gem_object_get_page(src_obj, n)); +- if (needs_clflush) ++ if (src_needs_clflush) + drm_clflush_virt_range(src + x, len); + memcpy(ptr, src + x, len); + kunmap_atomic(src); +@@ -1206,11 +1209,10 @@ static u32 *copy_batch(struct drm_i915_gem_object *dst_obj, + } + } + +- i915_gem_object_unpin_pages(src_obj); ++ i915_gem_object_finish_access(src_obj); + + memset32(dst + length, 0, (dst_obj->base.size - length) / sizeof(u32)); + +- /* dst_obj is returned with vmap pinned */ + return dst; + } + +@@ -1417,6 +1419,7 @@ static unsigned long *alloc_whitelist(u32 batch_length) + * Return: non-zero if the parser finds violations or otherwise fails; -EACCES + * if the batch appears legal but should use hardware parsing + */ ++ + int intel_engine_cmd_parser(struct intel_engine_cs *engine, + struct i915_vma *batch, + unsigned long batch_offset, +@@ -1437,7 +1440,8 @@ int intel_engine_cmd_parser(struct intel_engine_cs *engine, + batch->size)); + GEM_BUG_ON(!batch_length); + +- cmd = copy_batch(shadow->obj, batch->obj, batch_offset, batch_length); ++ cmd = copy_batch(shadow->obj, batch->obj, ++ batch_offset, batch_length); + if (IS_ERR(cmd)) { + DRM_DEBUG("CMD: Failed to copy batch\n"); + return PTR_ERR(cmd); +diff --git a/drivers/gpu/drm/i915/i915_request.c b/drivers/gpu/drm/i915/i915_request.c +index 0e813819b041b..d8fef42ca38e1 100644 +--- a/drivers/gpu/drm/i915/i915_request.c ++++ b/drivers/gpu/drm/i915/i915_request.c +@@ -1285,10 +1285,8 @@ i915_request_await_execution(struct i915_request *rq, + + do { + fence = *child++; +- if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags)) { +- i915_sw_fence_set_error_once(&rq->submit, fence->error); ++ if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags)) + continue; +- } + + if (fence->context == rq->fence.context) + continue; +@@ -1386,10 +1384,8 @@ i915_request_await_dma_fence(struct i915_request *rq, struct dma_fence *fence) + + do { + fence = *child++; +- if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags)) { +- i915_sw_fence_set_error_once(&rq->submit, fence->error); ++ if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags)) + continue; +- } + + /* + * Requests on the same timeline are explicitly ordered, along +diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c +index cd882c4533942..caeef25c89bb1 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c +@@ -474,14 +474,18 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + + spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); + +- if (!qed_mcp_has_pending_cmd(p_hwfn)) ++ if (!qed_mcp_has_pending_cmd(p_hwfn)) { ++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + break; ++ } + + rc = qed_mcp_update_pending_cmd(p_hwfn, p_ptt); +- if (!rc) ++ if (!rc) { ++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + break; +- else if (rc != -EAGAIN) ++ } else if (rc != -EAGAIN) { + goto err; ++ } + + spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + +@@ -498,6 +502,8 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + return -EAGAIN; + } + ++ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); ++ + /* Send the mailbox command */ + qed_mcp_reread_offsets(p_hwfn, p_ptt); + seq_num = ++p_hwfn->mcp_info->drv_mb_seq; +@@ -524,14 +530,18 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + + spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); + +- if (p_cmd_elem->b_is_completed) ++ if (p_cmd_elem->b_is_completed) { ++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + break; ++ } + + rc = qed_mcp_update_pending_cmd(p_hwfn, p_ptt); +- if (!rc) ++ if (!rc) { ++ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + break; +- else if (rc != -EAGAIN) ++ } else if (rc != -EAGAIN) { + goto err; ++ } + + spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + } while (++cnt < max_retries); +@@ -554,6 +564,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn, + return -EAGAIN; + } + ++ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock); + qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem); + spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock); + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 95e27fb7d2c10..105622e1defab 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -5282,9 +5282,10 @@ static int rtl8152_close(struct net_device *netdev) + tp->rtl_ops.down(tp); + + mutex_unlock(&tp->control); ++ } + ++ if (!res) + usb_autopm_put_interface(tp->intf); +- } + + free_all_mem(tp); + +diff --git a/drivers/nvme/host/trace.h b/drivers/nvme/host/trace.h +index daaf700eae799..35bac7a254227 100644 +--- a/drivers/nvme/host/trace.h ++++ b/drivers/nvme/host/trace.h +@@ -56,7 +56,7 @@ TRACE_EVENT(nvme_setup_cmd, + __field(u8, fctype) + __field(u16, cid) + __field(u32, nsid) +- __field(u64, metadata) ++ __field(bool, metadata) + __array(u8, cdw10, 24) + ), + TP_fast_assign( +@@ -66,13 +66,13 @@ TRACE_EVENT(nvme_setup_cmd, + __entry->flags = cmd->common.flags; + __entry->cid = cmd->common.command_id; + __entry->nsid = le32_to_cpu(cmd->common.nsid); +- __entry->metadata = le64_to_cpu(cmd->common.metadata); ++ __entry->metadata = !!blk_integrity_rq(req); + __entry->fctype = cmd->fabrics.fctype; + __assign_disk_name(__entry->disk, req->rq_disk); + memcpy(__entry->cdw10, &cmd->common.cdw10, + sizeof(__entry->cdw10)); + ), +- TP_printk("nvme%d: %sqid=%d, cmdid=%u, nsid=%u, flags=0x%x, meta=0x%llx, cmd=(%s %s)", ++ TP_printk("nvme%d: %sqid=%d, cmdid=%u, nsid=%u, flags=0x%x, meta=0x%x, cmd=(%s %s)", + __entry->ctrl_id, __print_disk_name(__entry->disk), + __entry->qid, __entry->cid, __entry->nsid, + __entry->flags, __entry->metadata, +diff --git a/drivers/regulator/rtmv20-regulator.c b/drivers/regulator/rtmv20-regulator.c +index 4bca64de0f672..2ee334174e2b0 100644 +--- a/drivers/regulator/rtmv20-regulator.c ++++ b/drivers/regulator/rtmv20-regulator.c +@@ -37,7 +37,7 @@ + #define RTMV20_WIDTH2_MASK GENMASK(7, 0) + #define RTMV20_LBPLVL_MASK GENMASK(3, 0) + #define RTMV20_LBPEN_MASK BIT(7) +-#define RTMV20_STROBEPOL_MASK BIT(1) ++#define RTMV20_STROBEPOL_MASK BIT(0) + #define RTMV20_VSYNPOL_MASK BIT(1) + #define RTMV20_FSINEN_MASK BIT(7) + #define RTMV20_ESEN_MASK BIT(6) +diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c +index 8f2d112f0b5d4..83e56ee62649d 100644 +--- a/drivers/spi/spi-mt65xx.c ++++ b/drivers/spi/spi-mt65xx.c +@@ -433,24 +433,15 @@ static int mtk_spi_fifo_transfer(struct spi_master *master, + mtk_spi_prepare_transfer(master, xfer); + mtk_spi_setup_packet(master); + +- cnt = xfer->len / 4; +- if (xfer->tx_buf) ++ if (xfer->tx_buf) { ++ cnt = xfer->len / 4; + iowrite32_rep(mdata->base + SPI_TX_DATA_REG, xfer->tx_buf, cnt); +- +- if (xfer->rx_buf) +- ioread32_rep(mdata->base + SPI_RX_DATA_REG, xfer->rx_buf, cnt); +- +- remainder = xfer->len % 4; +- if (remainder > 0) { +- reg_val = 0; +- if (xfer->tx_buf) { ++ remainder = xfer->len % 4; ++ if (remainder > 0) { ++ reg_val = 0; + memcpy(®_val, xfer->tx_buf + (cnt * 4), remainder); + writel(reg_val, mdata->base + SPI_TX_DATA_REG); + } +- if (xfer->rx_buf) { +- reg_val = readl(mdata->base + SPI_RX_DATA_REG); +- memcpy(xfer->rx_buf + (cnt * 4), ®_val, remainder); +- } + } + + mtk_spi_enable_transfer(master); +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 8f91f8705eeea..a6dfc8fef20cd 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -917,15 +917,18 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id) + ier = readl_relaxed(spi->base + STM32H7_SPI_IER); + + mask = ier; +- /* EOTIE is triggered on EOT, SUSP and TXC events. */ ++ /* ++ * EOTIE enables irq from EOT, SUSP and TXC events. We need to set ++ * SUSP to acknowledge it later. TXC is automatically cleared ++ */ ++ + mask |= STM32H7_SPI_SR_SUSP; + /* +- * When TXTF is set, DXPIE and TXPIE are cleared. So in case of +- * Full-Duplex, need to poll RXP event to know if there are remaining +- * data, before disabling SPI. ++ * DXPIE is set in Full-Duplex, one IT will be raised if TXP and RXP ++ * are set. So in case of Full-Duplex, need to poll TXP and RXP event. + */ +- if (spi->rx_buf && !spi->cur_usedma) +- mask |= STM32H7_SPI_SR_RXP; ++ if ((spi->cur_comm == SPI_FULL_DUPLEX) && !spi->cur_usedma) ++ mask |= STM32H7_SPI_SR_TXP | STM32H7_SPI_SR_RXP; + + if (!(sr & mask)) { + dev_warn(spi->dev, "spurious IT (sr=0x%08x, ier=0x%08x)\n", +diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c +index 519a539eeb9e8..a370a185a41c4 100644 +--- a/drivers/watchdog/iTCO_wdt.c ++++ b/drivers/watchdog/iTCO_wdt.c +@@ -73,8 +73,6 @@ + #define TCOBASE(p) ((p)->tco_res->start) + /* SMI Control and Enable Register */ + #define SMI_EN(p) ((p)->smi_res->start) +-#define TCO_EN (1 << 13) +-#define GBL_SMI_EN (1 << 0) + + #define TCO_RLD(p) (TCOBASE(p) + 0x00) /* TCO Timer Reload/Curr. Value */ + #define TCOv1_TMR(p) (TCOBASE(p) + 0x01) /* TCOv1 Timer Initial Value*/ +@@ -359,12 +357,8 @@ static int iTCO_wdt_set_timeout(struct watchdog_device *wd_dev, unsigned int t) + + tmrval = seconds_to_ticks(p, t); + +- /* +- * If TCO SMIs are off, the timer counts down twice before rebooting. +- * Otherwise, the BIOS generally reboots when the SMI triggers. +- */ +- if (p->smi_res && +- (SMI_EN(p) & (TCO_EN | GBL_SMI_EN)) != (TCO_EN | GBL_SMI_EN)) ++ /* For TCO v1 the timer counts down twice before rebooting */ ++ if (p->iTCO_version == 1) + tmrval /= 2; + + /* from the specs: */ +@@ -529,7 +523,7 @@ static int iTCO_wdt_probe(struct platform_device *pdev) + * Disables TCO logic generating an SMI# + */ + val32 = inl(SMI_EN(p)); +- val32 &= ~TCO_EN; /* Turn off SMI clearing watchdog */ ++ val32 &= 0xffffdfff; /* Turn off SMI clearing watchdog */ + outl(val32, SMI_EN(p)); + } + +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index 4b913de2f24fb..f36928efcf92d 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -6443,7 +6443,6 @@ void btrfs_log_new_name(struct btrfs_trans_handle *trans, + struct btrfs_inode *inode, struct btrfs_inode *old_dir, + struct dentry *parent) + { +- struct btrfs_fs_info *fs_info = trans->fs_info; + struct btrfs_log_ctx ctx; + + /* +@@ -6457,8 +6456,8 @@ void btrfs_log_new_name(struct btrfs_trans_handle *trans, + * if this inode hasn't been logged and directory we're renaming it + * from hasn't been logged, we don't need to log it + */ +- if (inode->logged_trans <= fs_info->last_trans_committed && +- (!old_dir || old_dir->logged_trans <= fs_info->last_trans_committed)) ++ if (!inode_logged(trans, inode) && ++ (!old_dir || !inode_logged(trans, old_dir))) + return; + + btrfs_init_log_ctx(&ctx, &inode->vfs_inode); +diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h +index 37dac195adbb4..6ad3b89a8a2e0 100644 +--- a/include/acpi/acpi_bus.h ++++ b/include/acpi/acpi_bus.h +@@ -689,7 +689,8 @@ acpi_dev_get_first_match_dev(const char *hid, const char *uid, s64 hrv); + + static inline void acpi_dev_put(struct acpi_device *adev) + { +- put_device(&adev->dev); ++ if (adev) ++ put_device(&adev->dev); + } + #else /* CONFIG_ACPI */ + +diff --git a/include/linux/mfd/rt5033-private.h b/include/linux/mfd/rt5033-private.h +index f812105c538c8..f2271bfb3273f 100644 +--- a/include/linux/mfd/rt5033-private.h ++++ b/include/linux/mfd/rt5033-private.h +@@ -200,13 +200,13 @@ enum rt5033_reg { + #define RT5033_REGULATOR_BUCK_VOLTAGE_MIN 1000000U + #define RT5033_REGULATOR_BUCK_VOLTAGE_MAX 3000000U + #define RT5033_REGULATOR_BUCK_VOLTAGE_STEP 100000U +-#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM 32 ++#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM 21 + + /* RT5033 regulator LDO output voltage uV */ + #define RT5033_REGULATOR_LDO_VOLTAGE_MIN 1200000U + #define RT5033_REGULATOR_LDO_VOLTAGE_MAX 3000000U + #define RT5033_REGULATOR_LDO_VOLTAGE_STEP 100000U +-#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM 32 ++#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM 19 + + /* RT5033 regulator SAFE LDO output voltage uV */ + #define RT5033_REGULATOR_SAFE_LDO_VOLTAGE 4900000U +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 0854f1b35683c..86ebfc6ae6986 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -1713,6 +1713,14 @@ int hci_dev_do_close(struct hci_dev *hdev) + + BT_DBG("%s %p", hdev->name, hdev); + ++ if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) && ++ !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && ++ test_bit(HCI_UP, &hdev->flags)) { ++ /* Execute vendor specific shutdown routine */ ++ if (hdev->shutdown) ++ hdev->shutdown(hdev); ++ } ++ + cancel_delayed_work(&hdev->power_off); + + hci_request_cancel_all(hdev); +@@ -1788,14 +1796,6 @@ int hci_dev_do_close(struct hci_dev *hdev) + clear_bit(HCI_INIT, &hdev->flags); + } + +- if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) && +- !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && +- test_bit(HCI_UP, &hdev->flags)) { +- /* Execute vendor specific shutdown routine */ +- if (hdev->shutdown) +- hdev->shutdown(hdev); +- } +- + /* flush cmd work */ + flush_work(&hdev->cmd_work); + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 2d27aae6d36ff..825e6b9880030 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2922,8 +2922,11 @@ skb_zerocopy_headlen(const struct sk_buff *from) + + if (!from->head_frag || + skb_headlen(from) < L1_CACHE_BYTES || +- skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS) ++ skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS) { + hlen = skb_headlen(from); ++ if (!hlen) ++ hlen = from->len; ++ } + + if (skb_has_frag_list(from)) + hlen = from->len; +diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c +index d9878173ff898..2e41b8c169e5b 100644 +--- a/sound/soc/codecs/rt5682.c ++++ b/sound/soc/codecs/rt5682.c +@@ -971,10 +971,14 @@ int rt5682_headset_detect(struct snd_soc_component *component, int jack_insert) + rt5682_enable_push_button_irq(component, false); + snd_soc_component_update_bits(component, RT5682_CBJ_CTRL_1, + RT5682_TRIG_JD_MASK, RT5682_TRIG_JD_LOW); +- if (!snd_soc_dapm_get_pin_status(dapm, "MICBIAS")) ++ if (!snd_soc_dapm_get_pin_status(dapm, "MICBIAS") && ++ !snd_soc_dapm_get_pin_status(dapm, "PLL1") && ++ !snd_soc_dapm_get_pin_status(dapm, "PLL2B")) + snd_soc_component_update_bits(component, + RT5682_PWR_ANLG_1, RT5682_PWR_MB, 0); +- if (!snd_soc_dapm_get_pin_status(dapm, "Vref2")) ++ if (!snd_soc_dapm_get_pin_status(dapm, "Vref2") && ++ !snd_soc_dapm_get_pin_status(dapm, "PLL1") && ++ !snd_soc_dapm_get_pin_status(dapm, "PLL2B")) + snd_soc_component_update_bits(component, + RT5682_PWR_ANLG_1, RT5682_PWR_VREF2, 0); + snd_soc_component_update_bits(component, RT5682_PWR_ANLG_3, +diff --git a/sound/soc/codecs/tlv320aic31xx.h b/sound/soc/codecs/tlv320aic31xx.h +index 81952984613d2..2513922a02923 100644 +--- a/sound/soc/codecs/tlv320aic31xx.h ++++ b/sound/soc/codecs/tlv320aic31xx.h +@@ -151,8 +151,8 @@ struct aic31xx_pdata { + #define AIC31XX_WORD_LEN_24BITS 0x02 + #define AIC31XX_WORD_LEN_32BITS 0x03 + #define AIC31XX_IFACE1_MASTER_MASK GENMASK(3, 2) +-#define AIC31XX_BCLK_MASTER BIT(2) +-#define AIC31XX_WCLK_MASTER BIT(3) ++#define AIC31XX_BCLK_MASTER BIT(3) ++#define AIC31XX_WCLK_MASTER BIT(2) + + /* AIC31XX_DATA_OFFSET */ + #define AIC31XX_DATA_OFFSET_MASK GENMASK(7, 0) +diff --git a/sound/soc/ti/j721e-evm.c b/sound/soc/ti/j721e-evm.c +index a7c0484d44ec7..265bbc5a2f96a 100644 +--- a/sound/soc/ti/j721e-evm.c ++++ b/sound/soc/ti/j721e-evm.c +@@ -197,7 +197,7 @@ static int j721e_configure_refclk(struct j721e_priv *priv, + return ret; + } + +- if (priv->hsdiv_rates[domain->parent_clk_id] != scki) { ++ if (domain->parent_clk_id == -1 || priv->hsdiv_rates[domain->parent_clk_id] != scki) { + dev_dbg(priv->dev, + "%s configuration for %u Hz: %s, %dxFS (SCKI: %u Hz)\n", + audio_domain == J721E_AUDIO_DOMAIN_CPB ? "CPB" : "IVI", +@@ -278,23 +278,29 @@ static int j721e_audio_startup(struct snd_pcm_substream *substream) + j721e_rule_rate, &priv->rate_range, + SNDRV_PCM_HW_PARAM_RATE, -1); + +- mutex_unlock(&priv->mutex); + + if (ret) +- return ret; ++ goto out; + + /* Reset TDM slots to 32 */ + ret = snd_soc_dai_set_tdm_slot(cpu_dai, 0x3, 0x3, 2, 32); + if (ret && ret != -ENOTSUPP) +- return ret; ++ goto out; + + for_each_rtd_codec_dais(rtd, i, codec_dai) { + ret = snd_soc_dai_set_tdm_slot(codec_dai, 0x3, 0x3, 2, 32); + if (ret && ret != -ENOTSUPP) +- return ret; ++ goto out; + } + +- return 0; ++ if (ret == -ENOTSUPP) ++ ret = 0; ++out: ++ if (ret) ++ domain->active--; ++ mutex_unlock(&priv->mutex); ++ ++ return ret; + } + + static int j721e_audio_hw_params(struct snd_pcm_substream *substream, +diff --git a/tools/testing/selftests/bpf/progs/bpf_iter_task.c b/tools/testing/selftests/bpf/progs/bpf_iter_task.c +index 4983087852a09..b7f32c160f4e2 100644 +--- a/tools/testing/selftests/bpf/progs/bpf_iter_task.c ++++ b/tools/testing/selftests/bpf/progs/bpf_iter_task.c +@@ -11,9 +11,10 @@ int dump_task(struct bpf_iter__task *ctx) + { + struct seq_file *seq = ctx->meta->seq; + struct task_struct *task = ctx->task; ++ static char info[] = " === END ==="; + + if (task == (void *)0) { +- BPF_SEQ_PRINTF(seq, " === END ===\n"); ++ BPF_SEQ_PRINTF(seq, "%s\n", info); + return 0; + } + +diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c +index 9be395d9dc648..a4c55fcb0e7b1 100644 +--- a/tools/testing/selftests/bpf/test_verifier.c ++++ b/tools/testing/selftests/bpf/test_verifier.c +@@ -1036,7 +1036,7 @@ static void do_test_single(struct bpf_test *test, bool unpriv, + } + } + +- if (test->insn_processed) { ++ if (!unpriv && test->insn_processed) { + uint32_t insn_processed; + char *proc; + +diff --git a/tools/testing/selftests/bpf/verifier/and.c b/tools/testing/selftests/bpf/verifier/and.c +index ca8fdb1b3f015..7d7ebee5cc7a8 100644 +--- a/tools/testing/selftests/bpf/verifier/and.c ++++ b/tools/testing/selftests/bpf/verifier/and.c +@@ -61,6 +61,8 @@ + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R1 !read_ok", ++ .result_unpriv = REJECT, + .result = ACCEPT, + .retval = 0 + }, +diff --git a/tools/testing/selftests/bpf/verifier/basic_stack.c b/tools/testing/selftests/bpf/verifier/basic_stack.c +index b56f8117c09d2..f995777dddb3f 100644 +--- a/tools/testing/selftests/bpf/verifier/basic_stack.c ++++ b/tools/testing/selftests/bpf/verifier/basic_stack.c +@@ -4,7 +4,7 @@ + BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0), + BPF_EXIT_INSN(), + }, +- .errstr = "invalid stack", ++ .errstr = "invalid write to stack", + .result = REJECT, + }, + { +diff --git a/tools/testing/selftests/bpf/verifier/bounds.c b/tools/testing/selftests/bpf/verifier/bounds.c +index 57ed67b860746..e061e8799ce23 100644 +--- a/tools/testing/selftests/bpf/verifier/bounds.c ++++ b/tools/testing/selftests/bpf/verifier/bounds.c +@@ -261,8 +261,6 @@ + }, + .fixup_map_hash_8b = { 3 }, + /* not actually fully unbounded, but the bound is very high */ +- .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds, pointer arithmetic with it prohibited for !root", +- .result_unpriv = REJECT, + .errstr = "value -4294967168 makes map_value pointer be out of bounds", + .result = REJECT, + }, +@@ -298,9 +296,6 @@ + BPF_EXIT_INSN(), + }, + .fixup_map_hash_8b = { 3 }, +- /* not actually fully unbounded, but the bound is very high */ +- .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds, pointer arithmetic with it prohibited for !root", +- .result_unpriv = REJECT, + .errstr = "value -4294967168 makes map_value pointer be out of bounds", + .result = REJECT, + }, +@@ -513,6 +508,8 @@ + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, -1), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R0 invalid mem access 'inv'", ++ .result_unpriv = REJECT, + .result = ACCEPT + }, + { +@@ -533,6 +530,8 @@ + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, -1), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R0 invalid mem access 'inv'", ++ .result_unpriv = REJECT, + .result = ACCEPT + }, + { +@@ -574,6 +573,8 @@ + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R0 min value is outside of the allowed memory range", ++ .result_unpriv = REJECT, + .fixup_map_hash_8b = { 3 }, + .result = ACCEPT, + }, +@@ -594,6 +595,8 @@ + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R0 min value is outside of the allowed memory range", ++ .result_unpriv = REJECT, + .fixup_map_hash_8b = { 3 }, + .result = ACCEPT, + }, +@@ -614,6 +617,8 @@ + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R0 min value is outside of the allowed memory range", ++ .result_unpriv = REJECT, + .fixup_map_hash_8b = { 3 }, + .result = ACCEPT, + }, +@@ -679,6 +684,8 @@ + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R0 min value is outside of the allowed memory range", ++ .result_unpriv = REJECT, + .fixup_map_hash_8b = { 3 }, + .result = ACCEPT, + }, +@@ -700,6 +707,8 @@ + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R0 min value is outside of the allowed memory range", ++ .result_unpriv = REJECT, + .fixup_map_hash_8b = { 3 }, + .result = ACCEPT, + }, +diff --git a/tools/testing/selftests/bpf/verifier/bounds_deduction.c b/tools/testing/selftests/bpf/verifier/bounds_deduction.c +index c162498a64fc6..91869aea6d641 100644 +--- a/tools/testing/selftests/bpf/verifier/bounds_deduction.c ++++ b/tools/testing/selftests/bpf/verifier/bounds_deduction.c +@@ -6,7 +6,7 @@ + BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), + BPF_EXIT_INSN(), + }, +- .errstr_unpriv = "R0 tried to sub from different maps, paths, or prohibited types", ++ .errstr_unpriv = "R1 has pointer with unsupported alu operation", + .errstr = "R0 tried to subtract pointer from scalar", + .result = REJECT, + }, +@@ -21,7 +21,7 @@ + BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0), + BPF_EXIT_INSN(), + }, +- .errstr_unpriv = "R1 tried to sub from different maps, paths, or prohibited types", ++ .errstr_unpriv = "R1 has pointer with unsupported alu operation", + .result_unpriv = REJECT, + .result = ACCEPT, + .retval = 1, +@@ -34,22 +34,23 @@ + BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), + BPF_EXIT_INSN(), + }, +- .errstr_unpriv = "R0 tried to sub from different maps, paths, or prohibited types", ++ .errstr_unpriv = "R1 has pointer with unsupported alu operation", + .errstr = "R0 tried to subtract pointer from scalar", + .result = REJECT, + }, + { + "check deducing bounds from const, 4", + .insns = { ++ BPF_MOV64_REG(BPF_REG_6, BPF_REG_1), + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1), + BPF_EXIT_INSN(), + BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1), + BPF_EXIT_INSN(), +- BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0), ++ BPF_ALU64_REG(BPF_SUB, BPF_REG_6, BPF_REG_0), + BPF_EXIT_INSN(), + }, +- .errstr_unpriv = "R1 tried to sub from different maps, paths, or prohibited types", ++ .errstr_unpriv = "R6 has pointer with unsupported alu operation", + .result_unpriv = REJECT, + .result = ACCEPT, + }, +@@ -61,7 +62,7 @@ + BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), + BPF_EXIT_INSN(), + }, +- .errstr_unpriv = "R0 tried to sub from different maps, paths, or prohibited types", ++ .errstr_unpriv = "R1 has pointer with unsupported alu operation", + .errstr = "R0 tried to subtract pointer from scalar", + .result = REJECT, + }, +@@ -74,7 +75,7 @@ + BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), + BPF_EXIT_INSN(), + }, +- .errstr_unpriv = "R0 tried to sub from different maps, paths, or prohibited types", ++ .errstr_unpriv = "R1 has pointer with unsupported alu operation", + .errstr = "R0 tried to subtract pointer from scalar", + .result = REJECT, + }, +@@ -88,7 +89,7 @@ + offsetof(struct __sk_buff, mark)), + BPF_EXIT_INSN(), + }, +- .errstr_unpriv = "R1 tried to sub from different maps, paths, or prohibited types", ++ .errstr_unpriv = "R1 has pointer with unsupported alu operation", + .errstr = "dereference of modified ctx ptr", + .result = REJECT, + .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, +@@ -103,7 +104,7 @@ + offsetof(struct __sk_buff, mark)), + BPF_EXIT_INSN(), + }, +- .errstr_unpriv = "R1 tried to add from different maps, paths, or prohibited types", ++ .errstr_unpriv = "R1 has pointer with unsupported alu operation", + .errstr = "dereference of modified ctx ptr", + .result = REJECT, + .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, +@@ -116,7 +117,7 @@ + BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1), + BPF_EXIT_INSN(), + }, +- .errstr_unpriv = "R0 tried to sub from different maps, paths, or prohibited types", ++ .errstr_unpriv = "R1 has pointer with unsupported alu operation", + .errstr = "R0 tried to subtract pointer from scalar", + .result = REJECT, + }, +diff --git a/tools/testing/selftests/bpf/verifier/bounds_mix_sign_unsign.c b/tools/testing/selftests/bpf/verifier/bounds_mix_sign_unsign.c +index 9baca7a75c42a..c2aa6f26738b4 100644 +--- a/tools/testing/selftests/bpf/verifier/bounds_mix_sign_unsign.c ++++ b/tools/testing/selftests/bpf/verifier/bounds_mix_sign_unsign.c +@@ -19,7 +19,6 @@ + }, + .fixup_map_hash_8b = { 3 }, + .errstr = "unbounded min value", +- .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", + .result = REJECT, + }, + { +@@ -43,7 +42,6 @@ + }, + .fixup_map_hash_8b = { 3 }, + .errstr = "unbounded min value", +- .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", + .result = REJECT, + }, + { +@@ -69,7 +67,6 @@ + }, + .fixup_map_hash_8b = { 3 }, + .errstr = "unbounded min value", +- .errstr_unpriv = "R8 has unknown scalar with mixed signed bounds", + .result = REJECT, + }, + { +@@ -94,7 +91,6 @@ + }, + .fixup_map_hash_8b = { 3 }, + .errstr = "unbounded min value", +- .errstr_unpriv = "R8 has unknown scalar with mixed signed bounds", + .result = REJECT, + }, + { +@@ -141,7 +137,6 @@ + }, + .fixup_map_hash_8b = { 3 }, + .errstr = "unbounded min value", +- .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", + .result = REJECT, + }, + { +@@ -210,7 +205,6 @@ + }, + .fixup_map_hash_8b = { 3 }, + .errstr = "unbounded min value", +- .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", + .result = REJECT, + }, + { +@@ -260,7 +254,6 @@ + }, + .fixup_map_hash_8b = { 3 }, + .errstr = "unbounded min value", +- .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", + .result = REJECT, + }, + { +@@ -287,7 +280,6 @@ + }, + .fixup_map_hash_8b = { 3 }, + .errstr = "unbounded min value", +- .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", + .result = REJECT, + }, + { +@@ -313,7 +305,6 @@ + }, + .fixup_map_hash_8b = { 3 }, + .errstr = "unbounded min value", +- .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", + .result = REJECT, + }, + { +@@ -342,7 +333,6 @@ + }, + .fixup_map_hash_8b = { 3 }, + .errstr = "unbounded min value", +- .errstr_unpriv = "R7 has unknown scalar with mixed signed bounds", + .result = REJECT, + }, + { +@@ -372,7 +362,6 @@ + }, + .fixup_map_hash_8b = { 4 }, + .errstr = "unbounded min value", +- .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", + .result = REJECT, + }, + { +@@ -400,7 +389,5 @@ + }, + .fixup_map_hash_8b = { 3 }, + .errstr = "unbounded min value", +- .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds", + .result = REJECT, +- .result_unpriv = REJECT, + }, +diff --git a/tools/testing/selftests/bpf/verifier/calls.c b/tools/testing/selftests/bpf/verifier/calls.c +index c4f5d909e58a7..eb888c8479c32 100644 +--- a/tools/testing/selftests/bpf/verifier/calls.c ++++ b/tools/testing/selftests/bpf/verifier/calls.c +@@ -1228,7 +1228,7 @@ + .prog_type = BPF_PROG_TYPE_XDP, + .fixup_map_hash_8b = { 23 }, + .result = REJECT, +- .errstr = "invalid read from stack off -16+0 size 8", ++ .errstr = "invalid read from stack R7 off=-16 size=8", + }, + { + "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test1", +@@ -1958,7 +1958,7 @@ + BPF_EXIT_INSN(), + }, + .fixup_map_hash_48b = { 6 }, +- .errstr = "invalid indirect read from stack off -8+0 size 8", ++ .errstr = "invalid indirect read from stack R2 off -8+0 size 8", + .result = REJECT, + .prog_type = BPF_PROG_TYPE_XDP, + }, +diff --git a/tools/testing/selftests/bpf/verifier/const_or.c b/tools/testing/selftests/bpf/verifier/const_or.c +index 6c214c58e8d4a..0719b0ddec040 100644 +--- a/tools/testing/selftests/bpf/verifier/const_or.c ++++ b/tools/testing/selftests/bpf/verifier/const_or.c +@@ -23,7 +23,7 @@ + BPF_EMIT_CALL(BPF_FUNC_probe_read_kernel), + BPF_EXIT_INSN(), + }, +- .errstr = "invalid stack type R1 off=-48 access_size=58", ++ .errstr = "invalid indirect access to stack R1 off=-48 size=58", + .result = REJECT, + .prog_type = BPF_PROG_TYPE_TRACEPOINT, + }, +@@ -54,7 +54,7 @@ + BPF_EMIT_CALL(BPF_FUNC_probe_read_kernel), + BPF_EXIT_INSN(), + }, +- .errstr = "invalid stack type R1 off=-48 access_size=58", ++ .errstr = "invalid indirect access to stack R1 off=-48 size=58", + .result = REJECT, + .prog_type = BPF_PROG_TYPE_TRACEPOINT, + }, +diff --git a/tools/testing/selftests/bpf/verifier/dead_code.c b/tools/testing/selftests/bpf/verifier/dead_code.c +index 5cf361d8eb1cc..721ec9391be5a 100644 +--- a/tools/testing/selftests/bpf/verifier/dead_code.c ++++ b/tools/testing/selftests/bpf/verifier/dead_code.c +@@ -8,6 +8,8 @@ + BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 10, -4), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R9 !read_ok", ++ .result_unpriv = REJECT, + .result = ACCEPT, + .retval = 7, + }, +diff --git a/tools/testing/selftests/bpf/verifier/helper_access_var_len.c b/tools/testing/selftests/bpf/verifier/helper_access_var_len.c +index 87c4e79000833..0ab7f1dfc97ac 100644 +--- a/tools/testing/selftests/bpf/verifier/helper_access_var_len.c ++++ b/tools/testing/selftests/bpf/verifier/helper_access_var_len.c +@@ -39,7 +39,7 @@ + BPF_EMIT_CALL(BPF_FUNC_probe_read_kernel), + BPF_EXIT_INSN(), + }, +- .errstr = "invalid indirect read from stack off -64+0 size 64", ++ .errstr = "invalid indirect read from stack R1 off -64+0 size 64", + .result = REJECT, + .prog_type = BPF_PROG_TYPE_TRACEPOINT, + }, +@@ -59,7 +59,7 @@ + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, +- .errstr = "invalid stack type R1 off=-64 access_size=65", ++ .errstr = "invalid indirect access to stack R1 off=-64 size=65", + .result = REJECT, + .prog_type = BPF_PROG_TYPE_TRACEPOINT, + }, +@@ -136,7 +136,7 @@ + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, +- .errstr = "invalid stack type R1 off=-64 access_size=65", ++ .errstr = "invalid indirect access to stack R1 off=-64 size=65", + .result = REJECT, + .prog_type = BPF_PROG_TYPE_TRACEPOINT, + }, +@@ -156,7 +156,7 @@ + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, +- .errstr = "invalid stack type R1 off=-64 access_size=65", ++ .errstr = "invalid indirect access to stack R1 off=-64 size=65", + .result = REJECT, + .prog_type = BPF_PROG_TYPE_TRACEPOINT, + }, +@@ -194,7 +194,7 @@ + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, +- .errstr = "invalid indirect read from stack off -64+0 size 64", ++ .errstr = "invalid indirect read from stack R1 off -64+0 size 64", + .result = REJECT, + .prog_type = BPF_PROG_TYPE_TRACEPOINT, + }, +@@ -584,7 +584,7 @@ + BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16), + BPF_EXIT_INSN(), + }, +- .errstr = "invalid indirect read from stack off -64+32 size 64", ++ .errstr = "invalid indirect read from stack R1 off -64+32 size 64", + .result = REJECT, + .prog_type = BPF_PROG_TYPE_TRACEPOINT, + }, +diff --git a/tools/testing/selftests/bpf/verifier/int_ptr.c b/tools/testing/selftests/bpf/verifier/int_ptr.c +index ca3b4729df66c..070893fb29007 100644 +--- a/tools/testing/selftests/bpf/verifier/int_ptr.c ++++ b/tools/testing/selftests/bpf/verifier/int_ptr.c +@@ -27,7 +27,7 @@ + }, + .result = REJECT, + .prog_type = BPF_PROG_TYPE_CGROUP_SYSCTL, +- .errstr = "invalid indirect read from stack off -16+0 size 8", ++ .errstr = "invalid indirect read from stack R4 off -16+0 size 8", + }, + { + "ARG_PTR_TO_LONG half-uninitialized", +@@ -59,7 +59,7 @@ + }, + .result = REJECT, + .prog_type = BPF_PROG_TYPE_CGROUP_SYSCTL, +- .errstr = "invalid indirect read from stack off -16+4 size 8", ++ .errstr = "invalid indirect read from stack R4 off -16+4 size 8", + }, + { + "ARG_PTR_TO_LONG misaligned", +@@ -125,7 +125,7 @@ + }, + .result = REJECT, + .prog_type = BPF_PROG_TYPE_CGROUP_SYSCTL, +- .errstr = "invalid stack type R4 off=-4 access_size=8", ++ .errstr = "invalid indirect access to stack R4 off=-4 size=8", + }, + { + "ARG_PTR_TO_LONG initialized", +diff --git a/tools/testing/selftests/bpf/verifier/jmp32.c b/tools/testing/selftests/bpf/verifier/jmp32.c +index bd5cae4a7f733..1c857b2fbdf0a 100644 +--- a/tools/testing/selftests/bpf/verifier/jmp32.c ++++ b/tools/testing/selftests/bpf/verifier/jmp32.c +@@ -87,6 +87,8 @@ + BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R9 !read_ok", ++ .result_unpriv = REJECT, + .result = ACCEPT, + }, + { +@@ -150,6 +152,8 @@ + BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R9 !read_ok", ++ .result_unpriv = REJECT, + .result = ACCEPT, + }, + { +@@ -213,6 +217,8 @@ + BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R9 !read_ok", ++ .result_unpriv = REJECT, + .result = ACCEPT, + }, + { +@@ -280,6 +286,8 @@ + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R0 invalid mem access 'inv'", ++ .result_unpriv = REJECT, + .result = ACCEPT, + .retval = 2, + }, +@@ -348,6 +356,8 @@ + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R0 invalid mem access 'inv'", ++ .result_unpriv = REJECT, + .result = ACCEPT, + .retval = 2, + }, +@@ -416,6 +426,8 @@ + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R0 invalid mem access 'inv'", ++ .result_unpriv = REJECT, + .result = ACCEPT, + .retval = 2, + }, +@@ -484,6 +496,8 @@ + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R0 invalid mem access 'inv'", ++ .result_unpriv = REJECT, + .result = ACCEPT, + .retval = 2, + }, +@@ -552,6 +566,8 @@ + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R0 invalid mem access 'inv'", ++ .result_unpriv = REJECT, + .result = ACCEPT, + .retval = 2, + }, +@@ -620,6 +636,8 @@ + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R0 invalid mem access 'inv'", ++ .result_unpriv = REJECT, + .result = ACCEPT, + .retval = 2, + }, +@@ -688,6 +706,8 @@ + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R0 invalid mem access 'inv'", ++ .result_unpriv = REJECT, + .result = ACCEPT, + .retval = 2, + }, +@@ -756,6 +776,8 @@ + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R0 invalid mem access 'inv'", ++ .result_unpriv = REJECT, + .result = ACCEPT, + .retval = 2, + }, +diff --git a/tools/testing/selftests/bpf/verifier/jset.c b/tools/testing/selftests/bpf/verifier/jset.c +index 8dcd4e0383d57..11fc68da735ea 100644 +--- a/tools/testing/selftests/bpf/verifier/jset.c ++++ b/tools/testing/selftests/bpf/verifier/jset.c +@@ -82,8 +82,8 @@ + BPF_EXIT_INSN(), + }, + .prog_type = BPF_PROG_TYPE_SOCKET_FILTER, +- .retval_unpriv = 1, +- .result_unpriv = ACCEPT, ++ .errstr_unpriv = "R9 !read_ok", ++ .result_unpriv = REJECT, + .retval = 1, + .result = ACCEPT, + }, +@@ -141,7 +141,8 @@ + BPF_EXIT_INSN(), + }, + .prog_type = BPF_PROG_TYPE_SOCKET_FILTER, +- .result_unpriv = ACCEPT, ++ .errstr_unpriv = "R9 !read_ok", ++ .result_unpriv = REJECT, + .result = ACCEPT, + }, + { +@@ -162,6 +163,7 @@ + BPF_EXIT_INSN(), + }, + .prog_type = BPF_PROG_TYPE_SOCKET_FILTER, +- .result_unpriv = ACCEPT, ++ .errstr_unpriv = "R9 !read_ok", ++ .result_unpriv = REJECT, + .result = ACCEPT, + }, +diff --git a/tools/testing/selftests/bpf/verifier/map_ptr.c b/tools/testing/selftests/bpf/verifier/map_ptr.c +index 92a1dc8e17462..2f551cb24cf7c 100644 +--- a/tools/testing/selftests/bpf/verifier/map_ptr.c ++++ b/tools/testing/selftests/bpf/verifier/map_ptr.c +@@ -75,7 +75,7 @@ + }, + .fixup_map_hash_16b = { 4 }, + .result_unpriv = REJECT, +- .errstr_unpriv = "R1 tried to add from different maps, paths, or prohibited types", ++ .errstr_unpriv = "R1 has pointer with unsupported alu operation", + .result = ACCEPT, + }, + { +@@ -93,6 +93,6 @@ + }, + .fixup_map_hash_16b = { 4 }, + .result_unpriv = REJECT, +- .errstr_unpriv = "R1 tried to add from different maps, paths, or prohibited types", ++ .errstr_unpriv = "R0 has pointer with unsupported alu operation", + .result = ACCEPT, + }, +diff --git a/tools/testing/selftests/bpf/verifier/raw_stack.c b/tools/testing/selftests/bpf/verifier/raw_stack.c +index 193d9e87d5a90..cc8e8c3cdc03d 100644 +--- a/tools/testing/selftests/bpf/verifier/raw_stack.c ++++ b/tools/testing/selftests/bpf/verifier/raw_stack.c +@@ -11,7 +11,7 @@ + BPF_EXIT_INSN(), + }, + .result = REJECT, +- .errstr = "invalid read from stack off -8+0 size 8", ++ .errstr = "invalid read from stack R6 off=-8 size=8", + .prog_type = BPF_PROG_TYPE_SCHED_CLS, + }, + { +@@ -59,7 +59,7 @@ + BPF_EXIT_INSN(), + }, + .result = REJECT, +- .errstr = "invalid stack type R3", ++ .errstr = "invalid zero-sized read", + .prog_type = BPF_PROG_TYPE_SCHED_CLS, + }, + { +@@ -205,7 +205,7 @@ + BPF_EXIT_INSN(), + }, + .result = REJECT, +- .errstr = "invalid stack type R3 off=-513 access_size=8", ++ .errstr = "invalid indirect access to stack R3 off=-513 size=8", + .prog_type = BPF_PROG_TYPE_SCHED_CLS, + }, + { +@@ -221,7 +221,7 @@ + BPF_EXIT_INSN(), + }, + .result = REJECT, +- .errstr = "invalid stack type R3 off=-1 access_size=8", ++ .errstr = "invalid indirect access to stack R3 off=-1 size=8", + .prog_type = BPF_PROG_TYPE_SCHED_CLS, + }, + { +@@ -285,7 +285,7 @@ + BPF_EXIT_INSN(), + }, + .result = REJECT, +- .errstr = "invalid stack type R3 off=-512 access_size=0", ++ .errstr = "invalid zero-sized read", + .prog_type = BPF_PROG_TYPE_SCHED_CLS, + }, + { +diff --git a/tools/testing/selftests/bpf/verifier/stack_ptr.c b/tools/testing/selftests/bpf/verifier/stack_ptr.c +index 8bfeb77c60bd3..8ab94d65f3d54 100644 +--- a/tools/testing/selftests/bpf/verifier/stack_ptr.c ++++ b/tools/testing/selftests/bpf/verifier/stack_ptr.c +@@ -44,7 +44,7 @@ + BPF_EXIT_INSN(), + }, + .result = REJECT, +- .errstr = "invalid stack off=-79992 size=8", ++ .errstr = "invalid write to stack R1 off=-79992 size=8", + .errstr_unpriv = "R1 stack pointer arithmetic goes out of range", + }, + { +@@ -57,7 +57,7 @@ + BPF_EXIT_INSN(), + }, + .result = REJECT, +- .errstr = "invalid stack off=0 size=8", ++ .errstr = "invalid write to stack R1 off=0 size=8", + }, + { + "PTR_TO_STACK check high 1", +@@ -106,7 +106,7 @@ + BPF_EXIT_INSN(), + }, + .errstr_unpriv = "R1 stack pointer arithmetic goes out of range", +- .errstr = "invalid stack off=0 size=1", ++ .errstr = "invalid write to stack R1 off=0 size=1", + .result = REJECT, + }, + { +@@ -119,7 +119,8 @@ + BPF_EXIT_INSN(), + }, + .result = REJECT, +- .errstr = "invalid stack off", ++ .errstr_unpriv = "R1 stack pointer arithmetic goes out of range", ++ .errstr = "invalid write to stack R1", + }, + { + "PTR_TO_STACK check high 6", +@@ -131,7 +132,8 @@ + BPF_EXIT_INSN(), + }, + .result = REJECT, +- .errstr = "invalid stack off", ++ .errstr_unpriv = "R1 stack pointer arithmetic goes out of range", ++ .errstr = "invalid write to stack", + }, + { + "PTR_TO_STACK check high 7", +@@ -183,7 +185,7 @@ + BPF_EXIT_INSN(), + }, + .errstr_unpriv = "R1 stack pointer arithmetic goes out of range", +- .errstr = "invalid stack off=-513 size=1", ++ .errstr = "invalid write to stack R1 off=-513 size=1", + .result = REJECT, + }, + { +@@ -208,7 +210,8 @@ + BPF_EXIT_INSN(), + }, + .result = REJECT, +- .errstr = "invalid stack off", ++ .errstr_unpriv = "R1 stack pointer arithmetic goes out of range", ++ .errstr = "invalid write to stack", + }, + { + "PTR_TO_STACK check low 6", +@@ -220,7 +223,8 @@ + BPF_EXIT_INSN(), + }, + .result = REJECT, +- .errstr = "invalid stack off", ++ .errstr = "invalid write to stack", ++ .errstr_unpriv = "R1 stack pointer arithmetic goes out of range", + }, + { + "PTR_TO_STACK check low 7", +@@ -291,8 +295,6 @@ + BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0), + BPF_EXIT_INSN(), + }, +- .result_unpriv = REJECT, +- .errstr_unpriv = "invalid stack off=0 size=1", + .result = ACCEPT, + .retval = 42, + }, +diff --git a/tools/testing/selftests/bpf/verifier/unpriv.c b/tools/testing/selftests/bpf/verifier/unpriv.c +index 0d621c841db14..9dfb68c8c78d9 100644 +--- a/tools/testing/selftests/bpf/verifier/unpriv.c ++++ b/tools/testing/selftests/bpf/verifier/unpriv.c +@@ -108,8 +108,9 @@ + BPF_EXIT_INSN(), + }, + .fixup_map_hash_8b = { 3 }, +- .errstr = "invalid indirect read from stack off -8+0 size 8", +- .result = REJECT, ++ .errstr_unpriv = "invalid indirect read from stack R2 off -8+0 size 8", ++ .result_unpriv = REJECT, ++ .result = ACCEPT, + }, + { + "unpriv: mangle pointer on stack 1", +@@ -418,6 +419,8 @@ + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0), + BPF_EXIT_INSN(), + }, ++ .errstr_unpriv = "R7 invalid mem access 'inv'", ++ .result_unpriv = REJECT, + .result = ACCEPT, + .retval = 0, + }, +@@ -503,7 +506,7 @@ + BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8), + BPF_EXIT_INSN(), + }, +- .errstr_unpriv = "R1 tried to add from different maps, paths, or prohibited types", ++ .errstr_unpriv = "R1 stack pointer arithmetic goes out of range", + .result_unpriv = REJECT, + .result = ACCEPT, + }, +diff --git a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c +index feb91266db39a..a3e593ddfafc9 100644 +--- a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c ++++ b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c +@@ -21,8 +21,6 @@ + .fixup_map_hash_16b = { 5 }, + .fixup_map_array_48b = { 8 }, + .result = ACCEPT, +- .result_unpriv = REJECT, +- .errstr_unpriv = "R1 tried to add from different maps", + .retval = 1, + }, + { +@@ -122,7 +120,7 @@ + .fixup_map_array_48b = { 1 }, + .result = ACCEPT, + .result_unpriv = REJECT, +- .errstr_unpriv = "R2 tried to add from different pointers or scalars", ++ .errstr_unpriv = "R2 pointer comparison prohibited", + .retval = 0, + }, + { +@@ -161,7 +159,8 @@ + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + // fake-dead code; targeted from branch A to +- // prevent dead code sanitization ++ // prevent dead code sanitization, rejected ++ // via branch B however + BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0), + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), +@@ -169,7 +168,7 @@ + .fixup_map_array_48b = { 1 }, + .result = ACCEPT, + .result_unpriv = REJECT, +- .errstr_unpriv = "R2 tried to add from different maps, paths, or prohibited types", ++ .errstr_unpriv = "R0 invalid mem access 'inv'", + .retval = 0, + }, + { +@@ -302,8 +301,6 @@ + }, + .fixup_map_array_48b = { 3 }, + .result = ACCEPT, +- .result_unpriv = REJECT, +- .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range", + .retval = 1, + }, + { +@@ -373,8 +370,6 @@ + }, + .fixup_map_array_48b = { 3 }, + .result = ACCEPT, +- .result_unpriv = REJECT, +- .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range", + .retval = 1, + }, + { +@@ -474,8 +469,6 @@ + }, + .fixup_map_array_48b = { 3 }, + .result = ACCEPT, +- .result_unpriv = REJECT, +- .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range", + .retval = 1, + }, + { +@@ -768,8 +761,6 @@ + }, + .fixup_map_array_48b = { 3 }, + .result = ACCEPT, +- .result_unpriv = REJECT, +- .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range", + .retval = 1, + }, + { +diff --git a/tools/testing/selftests/bpf/verifier/var_off.c b/tools/testing/selftests/bpf/verifier/var_off.c +index 8504ac9378098..eab1f7f56e2f0 100644 +--- a/tools/testing/selftests/bpf/verifier/var_off.c ++++ b/tools/testing/selftests/bpf/verifier/var_off.c +@@ -18,7 +18,7 @@ + .prog_type = BPF_PROG_TYPE_LWT_IN, + }, + { +- "variable-offset stack access", ++ "variable-offset stack read, priv vs unpriv", + .insns = { + /* Fill the top 8 bytes of the stack */ + BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), +@@ -31,14 +31,109 @@ + * we don't know which + */ + BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10), +- /* dereference it */ ++ /* dereference it for a stack read */ ++ BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 0), ++ BPF_MOV64_IMM(BPF_REG_0, 0), ++ BPF_EXIT_INSN(), ++ }, ++ .result = ACCEPT, ++ .result_unpriv = REJECT, ++ .errstr_unpriv = "R2 variable stack access prohibited for !root", ++ .prog_type = BPF_PROG_TYPE_CGROUP_SKB, ++}, ++{ ++ "variable-offset stack read, uninitialized", ++ .insns = { ++ /* Get an unknown value */ ++ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0), ++ /* Make it small and 4-byte aligned */ ++ BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4), ++ BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8), ++ /* add it to fp. We now have either fp-4 or fp-8, but ++ * we don't know which ++ */ ++ BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10), ++ /* dereference it for a stack read */ + BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 0), ++ BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, +- .errstr = "variable stack access var_off=(0xfffffffffffffff8; 0x4)", + .result = REJECT, ++ .errstr = "invalid variable-offset read from stack R2", + .prog_type = BPF_PROG_TYPE_LWT_IN, + }, ++{ ++ "variable-offset stack write, priv vs unpriv", ++ .insns = { ++ /* Get an unknown value */ ++ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0), ++ /* Make it small and 8-byte aligned */ ++ BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 8), ++ BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 16), ++ /* Add it to fp. We now have either fp-8 or fp-16, but ++ * we don't know which ++ */ ++ BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10), ++ /* Dereference it for a stack write */ ++ BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0), ++ /* Now read from the address we just wrote. This shows ++ * that, after a variable-offset write, a priviledged ++ * program can read the slots that were in the range of ++ * that write (even if the verifier doesn't actually know ++ * if the slot being read was really written to or not. ++ */ ++ BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_2, 0), ++ BPF_MOV64_IMM(BPF_REG_0, 0), ++ BPF_EXIT_INSN(), ++ }, ++ /* Variable stack access is rejected for unprivileged. ++ */ ++ .errstr_unpriv = "R2 variable stack access prohibited for !root", ++ .result_unpriv = REJECT, ++ .result = ACCEPT, ++}, ++{ ++ "variable-offset stack write clobbers spilled regs", ++ .insns = { ++ /* Dummy instruction; needed because we need to patch the next one ++ * and we can't patch the first instruction. ++ */ ++ BPF_MOV64_IMM(BPF_REG_6, 0), ++ /* Make R0 a map ptr */ ++ BPF_LD_MAP_FD(BPF_REG_0, 0), ++ /* Get an unknown value */ ++ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0), ++ /* Make it small and 8-byte aligned */ ++ BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 8), ++ BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 16), ++ /* Add it to fp. We now have either fp-8 or fp-16, but ++ * we don't know which. ++ */ ++ BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10), ++ /* Spill R0(map ptr) into stack */ ++ BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8), ++ /* Dereference the unknown value for a stack write */ ++ BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0), ++ /* Fill the register back into R2 */ ++ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8), ++ /* Try to dereference R2 for a memory load */ ++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), ++ BPF_EXIT_INSN(), ++ }, ++ .fixup_map_hash_8b = { 1 }, ++ /* The unpriviledged case is not too interesting; variable ++ * stack access is rejected. ++ */ ++ .errstr_unpriv = "R2 variable stack access prohibited for !root", ++ .result_unpriv = REJECT, ++ /* In the priviledged case, dereferencing a spilled-and-then-filled ++ * register is rejected because the previous variable offset stack ++ * write might have overwritten the spilled pointer (i.e. we lose track ++ * of the spilled register when we analyze the write). ++ */ ++ .errstr = "R2 invalid mem access 'inv'", ++ .result = REJECT, ++}, + { + "indirect variable-offset stack access, unbounded", + .insns = { +@@ -63,7 +158,7 @@ + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, +- .errstr = "R4 unbounded indirect variable offset stack access", ++ .errstr = "invalid unbounded variable-offset indirect access to stack R4", + .result = REJECT, + .prog_type = BPF_PROG_TYPE_SOCK_OPS, + }, +@@ -88,7 +183,7 @@ + BPF_EXIT_INSN(), + }, + .fixup_map_hash_8b = { 5 }, +- .errstr = "R2 max value is outside of stack bound", ++ .errstr = "invalid variable-offset indirect access to stack R2", + .result = REJECT, + .prog_type = BPF_PROG_TYPE_LWT_IN, + }, +@@ -113,7 +208,7 @@ + BPF_EXIT_INSN(), + }, + .fixup_map_hash_8b = { 5 }, +- .errstr = "R2 min value is outside of stack bound", ++ .errstr = "invalid variable-offset indirect access to stack R2", + .result = REJECT, + .prog_type = BPF_PROG_TYPE_LWT_IN, + }, +@@ -138,7 +233,7 @@ + BPF_EXIT_INSN(), + }, + .fixup_map_hash_8b = { 5 }, +- .errstr = "invalid indirect read from stack var_off", ++ .errstr = "invalid indirect read from stack R2 var_off", + .result = REJECT, + .prog_type = BPF_PROG_TYPE_LWT_IN, + }, +@@ -163,7 +258,7 @@ + BPF_EXIT_INSN(), + }, + .fixup_map_hash_8b = { 5 }, +- .errstr = "invalid indirect read from stack var_off", ++ .errstr = "invalid indirect read from stack R2 var_off", + .result = REJECT, + .prog_type = BPF_PROG_TYPE_LWT_IN, + }, +@@ -189,7 +284,7 @@ + BPF_EXIT_INSN(), + }, + .fixup_map_hash_8b = { 6 }, +- .errstr_unpriv = "R2 stack pointer arithmetic goes out of range, prohibited for !root", ++ .errstr_unpriv = "R2 variable stack access prohibited for !root", + .result_unpriv = REJECT, + .result = ACCEPT, + .prog_type = BPF_PROG_TYPE_CGROUP_SKB, +@@ -217,7 +312,7 @@ + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, +- .errstr = "invalid indirect read from stack var_off", ++ .errstr = "invalid indirect read from stack R4 var_off", + .result = REJECT, + .prog_type = BPF_PROG_TYPE_SOCK_OPS, + },
