Merge tag 'io_uring-7.3-20261002' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linuxgrafted

Pull io_uring fixes from Jens Axboe:

 - Fix a task_work add use-after-free with SQPOLL.

   The sqpoll thread could pop and complete the last request while
   io_req_normal_work_add() was still looking at them after the mpscq
   push.

   Use the same approach as DEFER_TASKRUN to protect from that, holding
   an RCU read lock across the add, and have exit wait for an RCU grace
   period for SQPOLL rings as well.

 - CQE32 ring fixes: correct the free entry check for 32b CQEs, zero the
   big_cqe for aux CQEs, and only post the dummy skip CQE on CQE_MIXED
   rings

 - Mark the source filter table as COW when cloning bpf filters, so
   registering another filter on the source doesn't modify the shared
   table in place

 - Initialize the task context before running the BPF loop

 - Requeue zcrx multishot receives stopped by a local resource

 - End a TX_TIMESTAMP multishot cmd when the CQ is full (lollipopkit)

* tag 'io_uring-7.3-20261002' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring: fix task_work add use-after-free with SQPOLL
  io_uring/cmd_net: end TX_TIMESTAMP multishot when the CQ is full
  io_uring/zcrx: requeue multishot receives stopped by a local resource
  io_uring: initialize task context before running the BPF loop
  io_uring: zero big_cqe for aux CQEs on CQE32 rings
  io_uring: fix free entry check for 32b CQEs on CQE32 rings
  io_uring: only post the dummy skip CQE on CQE_MIXED rings
  io_uring/bpf_filter: mark source as COW when cloning filters

3 files changed, 121 insertions, 0 deletions

diff --git a/arch/sh/include/cpu-sh2/cpu/cache.h b/arch/sh/include/cpu-sh2/cpu/cache.h
new file mode 100644
index 000000000..070aa9f50
--- /dev/null
+++ b/arch/sh/include/cpu-sh2/cpu/cache.h
@@ -0,0 +1,40 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * include/asm-sh/cpu-sh2/cache.h
+ *
+ * Copyright (C) 2003 Paul Mundt
+ */
+#ifndef __ASM_CPU_SH2_CACHE_H
+#define __ASM_CPU_SH2_CACHE_H
+
+#define L1_CACHE_SHIFT	4
+
+#define SH_CACHE_VALID		1
+#define SH_CACHE_UPDATED	2
+#define SH_CACHE_COMBINED	4
+#define SH_CACHE_ASSOC		8
+
+#if defined(CONFIG_CPU_SUBTYPE_SH7619)
+#define SH_CCR		0xffffffec
+
+#define CCR_CACHE_CE	0x01	/* Cache enable */
+#define CCR_CACHE_WT	0x02    /* CCR[bit1=1,bit2=1] */
+				/* 0x00000000-0x7fffffff: Write-through  */
+				/* 0x80000000-0x9fffffff: Write-back     */
+                                /* 0xc0000000-0xdfffffff: Write-through  */
+#define CCR_CACHE_CB	0x04    /* CCR[bit1=0,bit2=0] */
+				/* 0x00000000-0x7fffffff: Write-back     */
+				/* 0x80000000-0x9fffffff: Write-through  */
+                                /* 0xc0000000-0xdfffffff: Write-back     */
+#define CCR_CACHE_CF	0x08	/* Cache invalidate */
+
+#define CACHE_OC_ADDRESS_ARRAY	0xf0000000
+#define CACHE_OC_DATA_ARRAY	0xf1000000
+
+#define CCR_CACHE_ENABLE	CCR_CACHE_CE
+#define CCR_CACHE_INVALIDATE	CCR_CACHE_CF
+#define CACHE_PHYSADDR_MASK	0x1ffffc00
+
+#endif
+
+#endif /* __ASM_CPU_SH2_CACHE_H */
diff --git a/arch/sh/include/cpu-sh2/cpu/freq.h b/arch/sh/include/cpu-sh2/cpu/freq.h
new file mode 100644
index 000000000..fb2e5d283
--- /dev/null
+++ b/arch/sh/include/cpu-sh2/cpu/freq.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * include/asm-sh/cpu-sh2/freq.h
+ *
+ * Copyright (C) 2006  Yoshinori Sato
+ */
+#ifndef __ASM_CPU_SH2_FREQ_H
+#define __ASM_CPU_SH2_FREQ_H
+
+#if defined(CONFIG_CPU_SUBTYPE_SH7619)
+#define FREQCR	0xf815ff80
+#endif
+
+#endif /* __ASM_CPU_SH2_FREQ_H */
+
diff --git a/arch/sh/include/cpu-sh2/cpu/watchdog.h b/arch/sh/include/cpu-sh2/cpu/watchdog.h
new file mode 100644
index 000000000..141fe296d
--- /dev/null
+++ b/arch/sh/include/cpu-sh2/cpu/watchdog.h
@@ -0,0 +1,66 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * include/asm-sh/cpu-sh2/watchdog.h
+ *
+ * Copyright (C) 2002, 2003 Paul Mundt
+ */
+#ifndef __ASM_CPU_SH2_WATCHDOG_H
+#define __ASM_CPU_SH2_WATCHDOG_H
+
+/*
+ * More SH-2 brilliance .. its not good enough that we can't read
+ * and write the same sizes to WTCNT, now we have to read and write
+ * with different sizes at different addresses for WTCNT _and_ RSTCSR.
+ *
+ * At least on the bright side no one has managed to screw over WTCSR
+ * in this fashion .. yet.
+ */
+/* Register definitions */
+#define WTCNT		0xfffffe80
+#define WTCSR		0xfffffe80
+#define RSTCSR		0xfffffe82
+
+#define WTCNT_R		(WTCNT + 1)
+#define RSTCSR_R	(RSTCSR + 1)
+
+/* Bit definitions */
+#define WTCSR_IOVF	0x80
+#define WTCSR_WT	0x40
+#define WTCSR_TME	0x20
+#define WTCSR_RSTS	0x00
+
+#define RSTCSR_RSTS	0x20
+
+/**
+ * 	sh_wdt_read_rstcsr - Read from Reset Control/Status Register
+ *
+ *	Reads back the RSTCSR value.
+ */
+static inline __u8 sh_wdt_read_rstcsr(void)
+{
+	/*
+	 * Same read/write brain-damage as for WTCNT here..
+	 */
+	return __raw_readb(RSTCSR_R);
+}
+
+/**
+ * 	sh_wdt_write_csr - Write to Reset Control/Status Register
+ *
+ * 	@val: Value to write
+ *
+ * 	Writes the given value @val to the lower byte of the control/status
+ * 	register. The upper byte is set manually on each write.
+ */
+static inline void sh_wdt_write_rstcsr(__u8 val)
+{
+	/*
+	 * Note: Due to the brain-damaged nature of this register,
+	 * we can't presently touch the WOVF bit, since the upper byte
+	 * has to be swapped for this. So just leave it alone..
+	 */
+	__raw_writeb((WTCNT_HIGH << 8) | (__u16)val, RSTCSR);
+}
+
+#endif /* __ASM_CPU_SH2_WATCHDOG_H */
+