lael-labs/linux

Documentation/devicetree/bindings/interrupt-controller/ingenic,intc.yaml+1−0

@@ -23,6 +23,7 @@ properties: · 22 unmodified lines
23	- enum:	23	- enum:
24	- ingenic,jz4775-intc	24	- ingenic,jz4775-intc
25	- ingenic,jz4770-intc	25	- ingenic,jz4770-intc
		26	- ingenic,jz4760b-intc
26	- const: ingenic,jz4760-intc	27	- const: ingenic,jz4760-intc
27	- items:	28	- items:
28	- const: ingenic,x1000-intc	29	- const: ingenic,x1000-intc

Documentation/gpu/todo.rst+21−0

@@ -613,6 +613,27 @@ Some of these date from the very introduction of KMS in 2008 ... · 612 unmodified lines
613		613
614	Level: Intermediate	614	Level: Intermediate
615		615
		616	Remove automatic page mapping from dma-buf importing
		617	----------------------------------------------------
		618
		619	When importing dma-bufs, the dma-buf and PRIME frameworks automatically map
		620	imported pages into the importer's DMA area. drm_gem_prime_fd_to_handle() and
		621	drm_gem_prime_handle_to_fd() require that importers call dma_buf_attach()
		622	even if they never do actual device DMA, but only CPU access through
		623	dma_buf_vmap(). This is a problem for USB devices, which do not support DMA
		624	operations.
		625
		626	To fix the issue, automatic page mappings should be removed from the
		627	buffer-sharing code. Fixing this is a bit more involved, since the import/export
		628	cache is also tied to &drm_gem_object.import_attach. Meanwhile we paper over
		629	this problem for USB devices by fishing out the USB host controller device, as
		630	long as that supports DMA. Otherwise importing can still needlessly fail.
		631
		632	Contact: Thomas Zimmermann <tzimmermann@suse.de>, Daniel Vetter
		633
		634	Level: Advanced
		635
		636
616	Better Testing	637	Better Testing
617	==============	638	==============
618		639

Documentation/networking/bonding.rst+1−1

@@ -1988,7 +1988,7 @@ netif_carrier. · 1987 unmodified lines
1988	If use_carrier is 0, then the MII monitor will first query the	1988	If use_carrier is 0, then the MII monitor will first query the
1989	device's (via ioctl) MII registers and check the link state. If that	1989	device's (via ioctl) MII registers and check the link state. If that
1990	request fails (not just that it returns carrier down), then the MII	1990	request fails (not just that it returns carrier down), then the MII
1991	monitor will make an ethtool ETHOOL_GLINK request to attempt to obtain	1991	monitor will make an ethtool ETHTOOL_GLINK request to attempt to obtain
1992	the same information. If both methods fail (i.e., the driver either	1992	the same information. If both methods fail (i.e., the driver either
1993	does not support or had some error in processing both the MII register	1993	does not support or had some error in processing both the MII register
1994	and ethtool requests), then the MII monitor will assume the link is	1994	and ethtool requests), then the MII monitor will assume the link is

Documentation/networking/netdev-FAQ.rst+6−66

@@ -142,73 +142,13 @@ Please send incremental versions on top of what has been merged in order to fix · 141 unmodified lines
142	the patches the way they would look like if your latest patch series was to be	142	the patches the way they would look like if your latest patch series was to be
143	merged.	143	merged.
144		144
145	How can I tell what patches are queued up for backporting to the various stable releases?	145	Are there special rules regarding stable submissions on netdev?
146	-----------------------------------------------------------------------------------------
147	Normally Greg Kroah-Hartman collects stable commits himself, but for
148	networking, Dave collects up patches he deems critical for the
149	networking subsystem, and then hands them off to Greg.
150
151	There is a patchworks queue that you can see here:
152
153	https://patchwork.kernel.org/bundle/netdev/stable/?state=*
154
155	It contains the patches which Dave has selected, but not yet handed off
156	to Greg. If Greg already has the patch, then it will be here:
157
158	https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git
159
160	A quick way to find whether the patch is in this stable-queue is to
161	simply clone the repo, and then git grep the mainline commit ID, e.g.
162	::
163
164	stable-queue$ git grep -l 284041ef21fdf2e
165	releases/3.0.84/ipv6-fix-possible-crashes-in-ip6_cork_release.patch
166	releases/3.4.51/ipv6-fix-possible-crashes-in-ip6_cork_release.patch
167	releases/3.9.8/ipv6-fix-possible-crashes-in-ip6_cork_release.patch
168	stable/stable-queue$
169
170	I see a network patch and I think it should be backported to stable. Should I request it via stable@vger.kernel.org like the references in the kernel's Documentation/process/stable-kernel-rules.rst file say?
171	---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
172	No, not for networking. Check the stable queues as per above first
173	to see if it is already queued. If not, then send a mail to netdev,
174	listing the upstream commit ID and why you think it should be a stable
175	candidate.
176
177	Before you jump to go do the above, do note that the normal stable rules
178	in :ref:`Documentation/process/stable-kernel-rules.rst <stable_kernel_rules>`
179	still apply. So you need to explicitly indicate why it is a critical
180	fix and exactly what users are impacted. In addition, you need to
181	convince yourself that you really think it has been overlooked,
182	vs. having been considered and rejected.
183
184	Generally speaking, the longer it has had a chance to "soak" in
185	mainline, the better the odds that it is an OK candidate for stable. So
186	scrambling to request a commit be added the day after it appears should
187	be avoided.
188
189	I have created a network patch and I think it should be backported to stable. Should I add a Cc: stable@vger.kernel.org like the references in the kernel's Documentation/ directory say?
190	-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
191	No. See above answer. In short, if you think it really belongs in
192	stable, then ensure you write a decent commit log that describes who
193	gets impacted by the bug fix and how it manifests itself, and when the
194	bug was introduced. If you do that properly, then the commit will get
195	handled appropriately and most likely get put in the patchworks stable
196	queue if it really warrants it.
197
198	If you think there is some valid information relating to it being in
199	stable that does not belong in the commit log, then use the three dash
200	marker line as described in
201	:ref:`Documentation/process/submitting-patches.rst <the_canonical_patch_format>`
202	to temporarily embed that information into the patch that you send.
203
204	Are all networking bug fixes backported to all stable releases?
205	---------------------------------------------------------------	146	---------------------------------------------------------------
206	Due to capacity, Dave could only take care of the backports for the	147	While it used to be the case that netdev submissions were not supposed
207	last two stable releases. For earlier stable releases, each stable	148	to carry explicit ``CC: stable@vger.kernel.org`` tags that is no longer
208	branch maintainer is supposed to take care of them. If you find any	149	the case today. Please follow the standard stable rules in
209	patch is missing from an earlier stable branch, please notify	150	:ref:`Documentation/process/stable-kernel-rules.rst <stable_kernel_rules>`,
210	stable@vger.kernel.org with either a commit ID or a formal patch	151	and make sure you include appropriate Fixes tags!
211	backported, and CC Dave and other relevant networking developers.
212		152
213	Is the comment style convention different for the networking content?	153	Is the comment style convention different for the networking content?
214	---------------------------------------------------------------------	154	---------------------------------------------------------------------

Documentation/process/stable-kernel-rules.rst+0−6

 Procedure for submitting patches to the -stable tree
 ----------------------------------------------------
- - If the patch covers files in net/ or drivers/net please follow netdev stable
-   submission guidelines as described in
-   :ref:`Documentation/networking/netdev-FAQ.rst <netdev-FAQ>`
-   after first checking the stable networking queue at
-   https://patchwork.kernel.org/bundle/netdev/stable/?state=*
-   to ensure the requested patch is not already queued up.
  - Security patches should not be handled (solely) by the -stable review
    process but should follow the procedures in
    :ref:`Documentation/admin-guide/security-bugs.rst <securitybugs>`.

Documentation/process/submitting-patches.rst+0−5

@@ -250,11 +250,6 @@ should also read · 249 unmodified lines
250	:ref:`Documentation/process/stable-kernel-rules.rst <stable_kernel_rules>`	250	:ref:`Documentation/process/stable-kernel-rules.rst <stable_kernel_rules>`
251	in addition to this file.	251	in addition to this file.
252		252
253	Note, however, that some subsystem maintainers want to come to their own
254	conclusions on which patches should go to the stable trees. The networking
255	maintainer, in particular, would rather not see individual developers
256	adding lines like the above to their patches.
257
258	If changes affect userland-kernel interfaces, please send the MAN-PAGES	253	If changes affect userland-kernel interfaces, please send the MAN-PAGES
259	maintainer (as listed in the MAINTAINERS file) a man-pages patch, or at	254	maintainer (as listed in the MAINTAINERS file) a man-pages patch, or at
260	least a notification of the change, so that some information makes its way	255	least a notification of the change, so that some information makes its way

Documentation/virt/kvm/api.rst+3−0

@@ -182,6 +182,9 @@ is dependent on the CPU capability and the kernel configuration. The limit can · 181 unmodified lines
182	be retrieved using KVM_CAP_ARM_VM_IPA_SIZE of the KVM_CHECK_EXTENSION	182	be retrieved using KVM_CAP_ARM_VM_IPA_SIZE of the KVM_CHECK_EXTENSION
183	ioctl() at run-time.	183	ioctl() at run-time.
184		184
		185	Creation of the VM will fail if the requested IPA size (whether it is
		186	implicit or explicit) is unsupported on the host.
		187
185	Please note that configuring the IPA size does not affect the capability	188	Please note that configuring the IPA size does not affect the capability
186	exposed by the guest CPUs in ID_AA64MMFR0_EL1[PARange]. It only affects	189	exposed by the guest CPUs in ID_AA64MMFR0_EL1[PARange]. It only affects
187	size of the address translated by the stage2 level (guest physical to	190	size of the address translated by the stage2 level (guest physical to

MAINTAINERS+6−5

 L:	linux-api@vger.kernel.org
 F:	include/linux/syscalls.h
 F:	kernel/sys_ni.c
-F:	include/uapi/
+X:	include/uapi/
-F:	arch/*/include/uapi/
+X:	arch/*/include/uapi/
 ABIT UGURU 1,2 HARDWARE MONITOR DRIVER
 M:	Hans de Goede <hdegoede@redhat.com>
 M:	Daniel Vetter <daniel@ffwll.ch>
 L:	dri-devel@lists.freedesktop.org
 S:	Maintained
-B:	https://bugs.freedesktop.org/
+B:	https://gitlab.freedesktop.org/drm
 C:	irc://chat.freenode.net/dri-devel
 T:	git git://anongit.freedesktop.org/drm/drm
 F:	Documentation/devicetree/bindings/display/
 MARVELL MWIFIEX WIRELESS DRIVER
 M:	Amitkumar Karwar <amitkarwar@gmail.com>
-M:	Ganapathi Bhat <ganapathi.bhat@nxp.com>
+M:	Ganapathi Bhat <ganapathi017@gmail.com>
+M:	Sharvari Harisangam <sharvari.harisangam@nxp.com>
 M:	Xinming Hu <huxinming820@gmail.com>
 L:	linux-wireless@vger.kernel.org
 S:	Maintained
 F:	drivers/infiniband/hw/vmw_pvrdma/
 VMware PVSCSI driver
-M:	Jim Gill <jgill@vmware.com>
+M:	Vishal Bhakta <vbhakta@vmware.com>
 M:	VMware PV-Drivers <pv-drivers@vmware.com>
 L:	linux-scsi@vger.kernel.org
 S:	Maintained

Makefile+4−2

 VERSION = 5
 PATCHLEVEL = 12
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
 NAME = Frozen Wasteland
 # *DOCUMENTATION*
 			 $(version_h) headers headers_% archheaders archscripts \
 			 %asm-generic kernelversion %src-pkg dt_binding_check \
 			 outputmakefile
-no-sync-config-targets := $(no-dot-config-targets) %install kernelrelease
+no-sync-config-targets := $(no-dot-config-targets) %install kernelrelease \
+			  image_name
 single-targets := %.a %.i %.ko %.lds %.ll %.lst %.mod %.o %.s %.symtypes %/
 config-build	:=
 		-I$(objtree)/arch/$(SRCARCH)/include/generated/uapi \
 		-I$(srctree)/include/uapi \
 		-I$(objtree)/include/generated/uapi \
+                -include $(srctree)/include/linux/compiler-version.h \
                 -include $(srctree)/include/linux/kconfig.h
 # Use LINUXINCLUDE when you must reference the include/ directory.

arch/Kconfig+1−2

 	def_bool y
 	# Clang >= 11: https://github.com/ClangBuiltLinux/linux/issues/510
 	depends on CC_IS_CLANG && CLANG_VERSION >= 110000 && LD_IS_LLD
-	depends on $(success,test $(LLVM) -eq 1)
 	depends on $(success,test $(LLVM_IAS) -eq 1)
 	depends on $(success,$(NM) --help | head -n 1 | grep -qi llvm)
 	depends on $(success,$(AR) --help | head -n 1 | grep -qi llvm)
 	depends on ARCH_SUPPORTS_LTO_CLANG
 	depends on !FTRACE_MCOUNT_USE_RECORDMCOUNT
-	depends on !KASAN
+	depends on !KASAN || KASAN_HW_TAGS
 	depends on !GCOV_KERNEL
 	help
 	  The compiler and Kconfig options support building with Clang's

arch/arm/Kconfig+1−0

@@ -348,6 +348,7 @@ config ARCH_EP93XX · 347 unmodified lines
348	select ARM_AMBA	348	select ARM_AMBA
349	imply ARM_PATCH_PHYS_VIRT	349	imply ARM_PATCH_PHYS_VIRT
350	select ARM_VIC	350	select ARM_VIC
		351	select GENERIC_IRQ_MULTI_HANDLER
351	select AUTO_ZRELADDR	352	select AUTO_ZRELADDR
352	select CLKDEV_LOOKUP	353	select CLKDEV_LOOKUP
353	select CLKSRC_MMIO	354	select CLKSRC_MMIO

arch/arm/xen/p2m.c+2−3

 #include <xen/xen.h>
 #include <xen/interface/memory.h>
+#include <xen/grant_table.h>
 #include <xen/page.h>
 #include <xen/swiotlb-xen.h>
 		map_ops[i].status = GNTST_general_error;
 		unmap.host_addr = map_ops[i].host_addr,
 		unmap.handle = map_ops[i].handle;
-		map_ops[i].handle = ~0;
+		map_ops[i].handle = INVALID_GRANT_HANDLE;
 		if (map_ops[i].flags & GNTMAP_device_map)
 			unmap.dev_bus_addr = map_ops[i].dev_bus_addr;
 		else
 	return 0;
 }
-EXPORT_SYMBOL_GPL(set_foreign_p2m_mapping);
 int clear_foreign_p2m_mapping(struct gnttab_unmap_grant_ref *unmap_ops,
 			      struct gnttab_unmap_grant_ref *kunmap_ops,
 	return 0;
 }
-EXPORT_SYMBOL_GPL(clear_foreign_p2m_mapping);
 bool __set_phys_to_machine_multi(unsigned long pfn,
 		unsigned long mfn, unsigned long nr_pages)

arch/arm64/Kconfig+2−10

 config SYS_SUPPORTS_HUGETLBFS
 	def_bool y
-config ARCH_WANT_HUGE_PMD_SHARE
 config ARCH_HAS_CACHE_LINE_SIZE
 	def_bool y
 config FORCE_MAX_ZONEORDER
 	int
-	default "14" if (ARM64_64K_PAGES && TRANSPARENT_HUGEPAGE)
+	default "14" if ARM64_64K_PAGES
-	default "12" if (ARM64_16K_PAGES && TRANSPARENT_HUGEPAGE)
+	default "12" if ARM64_16K_PAGES
 	default "11"
 	help
 	  The kernel memory allocator divides physically contiguous memory
 	  the boot loader doesn't provide any, the default kernel command
 	  string provided in CMDLINE will be used.
-config CMDLINE_EXTEND
-	bool "Extend bootloader kernel arguments"
-	help
-	  The command-line arguments provided by the boot loader will be
-	  appended to the default kernel command string.
 config CMDLINE_FORCE
 	bool "Always use the default kernel command string"
 	help

arch/arm64/include/asm/kvm_asm.h+4−4

 #define __KVM_HOST_SMCCC_FUNC___kvm_flush_vm_context		2
 #define __KVM_HOST_SMCCC_FUNC___kvm_tlb_flush_vmid_ipa		3
 #define __KVM_HOST_SMCCC_FUNC___kvm_tlb_flush_vmid		4
-#define __KVM_HOST_SMCCC_FUNC___kvm_tlb_flush_local_vmid	5
+#define __KVM_HOST_SMCCC_FUNC___kvm_flush_cpu_context		5
 #define __KVM_HOST_SMCCC_FUNC___kvm_timer_set_cntvoff		6
 #define __KVM_HOST_SMCCC_FUNC___kvm_enable_ssbs			7
-#define __KVM_HOST_SMCCC_FUNC___vgic_v3_get_ich_vtr_el2		8
+#define __KVM_HOST_SMCCC_FUNC___vgic_v3_get_gic_config		8
 #define __KVM_HOST_SMCCC_FUNC___vgic_v3_read_vmcr		9
 #define __KVM_HOST_SMCCC_FUNC___vgic_v3_write_vmcr		10
 #define __KVM_HOST_SMCCC_FUNC___vgic_v3_init_lrs		11
 #define __bp_harden_hyp_vecs	CHOOSE_HYP_SYM(__bp_harden_hyp_vecs)
 extern void __kvm_flush_vm_context(void);
+extern void __kvm_flush_cpu_context(struct kvm_s2_mmu *mmu);
 extern void __kvm_tlb_flush_vmid_ipa(struct kvm_s2_mmu *mmu, phys_addr_t ipa,
 				     int level);
 extern void __kvm_tlb_flush_vmid(struct kvm_s2_mmu *mmu);
-extern void __kvm_tlb_flush_local_vmid(struct kvm_s2_mmu *mmu);
 extern void __kvm_timer_set_cntvoff(u64 cntvoff);
 extern int __kvm_vcpu_run(struct kvm_vcpu *vcpu);
-extern u64 __vgic_v3_get_ich_vtr_el2(void);
+extern u64 __vgic_v3_get_gic_config(void);
 extern u64 __vgic_v3_read_vmcr(void);
 extern void __vgic_v3_write_vmcr(u32 vmcr);
 extern void __vgic_v3_init_lrs(void);

arch/arm64/include/asm/kvm_hyp.h+7−1

 void __debug_switch_to_guest(struct kvm_vcpu *vcpu);
 void __debug_switch_to_host(struct kvm_vcpu *vcpu);
+#ifdef __KVM_NVHE_HYPERVISOR__
+void __debug_save_host_buffers_nvhe(struct kvm_vcpu *vcpu);
+void __debug_restore_host_buffers_nvhe(struct kvm_vcpu *vcpu);
+#endif
 void __fpsimd_save_state(struct user_fpsimd_state *fp_regs);
 void __fpsimd_restore_state(struct user_fpsimd_state *fp_regs);
 void __noreturn hyp_panic(void);
 #ifdef __KVM_NVHE_HYPERVISOR__
-void __noreturn __hyp_do_panic(bool restore_host, u64 spsr, u64 elr, u64 par);
+void __noreturn __hyp_do_panic(struct kvm_cpu_context *host_ctxt, u64 spsr,
+			       u64 elr, u64 par);
 #endif
 #endif /* __ARM64_KVM_HYP_H__ */

arch/arm64/include/asm/memory.h+5−0

 #define ARCH_PFN_OFFSET		((unsigned long)PHYS_PFN_OFFSET)
 #if !defined(CONFIG_SPARSEMEM_VMEMMAP) || defined(CONFIG_DEBUG_VIRTUAL)
+#define page_to_virt(x)	({						\
+	__typeof__(x) __page = x;					\
+	void *__addr = __va(page_to_phys(__page));			\
+	(void *)__tag_set((const void *)__addr, page_kasan_tag(__page));\
+})
 #define virt_to_page(x)		pfn_to_page(virt_to_pfn(x))
 #else
 #define page_to_virt(x)	({						\

arch/arm64/include/asm/mmu_context.h+0−17

@@ -63,23 +63,6 @@ static inline void cpu_switch_mm(pgd_t pgd, struct mm_struct mm) · 62 unmodified lines
63	extern u64 idmap_t0sz;	63	extern u64 idmap_t0sz;
64	extern u64 idmap_ptrs_per_pgd;	64	extern u64 idmap_ptrs_per_pgd;
65		65
66	static inline bool __cpu_uses_extended_idmap(void)
67	{
68	if (IS_ENABLED(CONFIG_ARM64_VA_BITS_52))
69	return false;
70
71	return unlikely(idmap_t0sz != TCR_T0SZ(VA_BITS));
72	}
73
74	/*
75	* True if the extended ID map requires an extra level of translation table
76	* to be configured.
77	*/
78	static inline bool __cpu_uses_extended_idmap_level(void)
79	{
80	return ARM64_HW_PGTABLE_LEVELS(64 - idmap_t0sz) > CONFIG_PGTABLE_LEVELS;
81	}
82
83	/*	66	/*
84	* Ensure TCR.T0SZ is set to the provided value.	67	* Ensure TCR.T0SZ is set to the provided value.
85	*/	68	*/

arch/arm64/include/asm/pgtable-prot.h+0−1

@@ -66,7 +66,6 @@ extern bool arm64_use_ng_mappings; · 65 unmodified lines
66	#define _PAGE_DEFAULT (_PROT_DEFAULT \| PTE_ATTRINDX(MT_NORMAL))	66	#define _PAGE_DEFAULT (_PROT_DEFAULT \| PTE_ATTRINDX(MT_NORMAL))
67		67
68	#define PAGE_KERNEL __pgprot(PROT_NORMAL)	68	#define PAGE_KERNEL __pgprot(PROT_NORMAL)
69	#define PAGE_KERNEL_TAGGED __pgprot(PROT_NORMAL_TAGGED)
70	#define PAGE_KERNEL_RO __pgprot((PROT_NORMAL & ~PTE_WRITE) \| PTE_RDONLY)	69	#define PAGE_KERNEL_RO __pgprot((PROT_NORMAL & ~PTE_WRITE) \| PTE_RDONLY)
71	#define PAGE_KERNEL_ROX __pgprot((PROT_NORMAL & ~(PTE_WRITE \| PTE_PXN)) \| PTE_RDONLY)	70	#define PAGE_KERNEL_ROX __pgprot((PROT_NORMAL & ~(PTE_WRITE \| PTE_PXN)) \| PTE_RDONLY)
72	#define PAGE_KERNEL_EXEC __pgprot(PROT_NORMAL & ~PTE_PXN)	71	#define PAGE_KERNEL_EXEC __pgprot(PROT_NORMAL & ~PTE_PXN)

arch/arm64/include/asm/pgtable.h+3−0

 	__pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC) | PTE_PXN | PTE_UXN)
 #define pgprot_device(prot) \
 	__pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_nGnRE) | PTE_PXN | PTE_UXN)
+#define pgprot_tagged(prot) \
+	__pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_TAGGED))
+#define pgprot_mhp	pgprot_tagged
 /*
  * DMA allocations for non-coherent devices use what the Arm architecture calls
  * "Normal non-cacheable" memory, which permits speculation, unaligned accesses

arch/arm64/include/asm/sysreg.h+14−6

 #define ID_AA64MMFR0_PARANGE_48		0x5
 #define ID_AA64MMFR0_PARANGE_52		0x6
+#define ID_AA64MMFR0_TGRAN_2_SUPPORTED_DEFAULT	0x0
+#define ID_AA64MMFR0_TGRAN_2_SUPPORTED_NONE	0x1
+#define ID_AA64MMFR0_TGRAN_2_SUPPORTED_MIN	0x2
+#define ID_AA64MMFR0_TGRAN_2_SUPPORTED_MAX	0x7
 #ifdef CONFIG_ARM64_PA_BITS_52
 #define ID_AA64MMFR0_PARANGE_MAX	ID_AA64MMFR0_PARANGE_52
 #else
 #define ID_PFR1_PROGMOD_SHIFT		0
 #if defined(CONFIG_ARM64_4K_PAGES)
-#define ID_AA64MMFR0_TGRAN_SHIFT	ID_AA64MMFR0_TGRAN4_SHIFT
+#define ID_AA64MMFR0_TGRAN_SHIFT		ID_AA64MMFR0_TGRAN4_SHIFT
-#define ID_AA64MMFR0_TGRAN_SUPPORTED	ID_AA64MMFR0_TGRAN4_SUPPORTED
+#define ID_AA64MMFR0_TGRAN_SUPPORTED_MIN	ID_AA64MMFR0_TGRAN4_SUPPORTED
+#define ID_AA64MMFR0_TGRAN_SUPPORTED_MAX	0x7
 #elif defined(CONFIG_ARM64_16K_PAGES)
-#define ID_AA64MMFR0_TGRAN_SHIFT	ID_AA64MMFR0_TGRAN16_SHIFT
+#define ID_AA64MMFR0_TGRAN_SHIFT		ID_AA64MMFR0_TGRAN16_SHIFT
-#define ID_AA64MMFR0_TGRAN_SUPPORTED	ID_AA64MMFR0_TGRAN16_SUPPORTED
+#define ID_AA64MMFR0_TGRAN_SUPPORTED_MIN	ID_AA64MMFR0_TGRAN16_SUPPORTED
+#define ID_AA64MMFR0_TGRAN_SUPPORTED_MAX	0xF
 #elif defined(CONFIG_ARM64_64K_PAGES)
-#define ID_AA64MMFR0_TGRAN_SHIFT	ID_AA64MMFR0_TGRAN64_SHIFT
+#define ID_AA64MMFR0_TGRAN_SHIFT		ID_AA64MMFR0_TGRAN64_SHIFT
-#define ID_AA64MMFR0_TGRAN_SUPPORTED	ID_AA64MMFR0_TGRAN64_SUPPORTED
+#define ID_AA64MMFR0_TGRAN_SUPPORTED_MIN	ID_AA64MMFR0_TGRAN64_SUPPORTED
+#define ID_AA64MMFR0_TGRAN_SUPPORTED_MAX	0x7
 #endif
 #define MVFR2_FPMISC_SHIFT		4

arch/arm64/kernel/head.S+5−3

 	 */
 	adrp	x5, __idmap_text_end
 	clz	x5, x5
-	cmp	x5, TCR_T0SZ(VA_BITS)	// default T0SZ small enough?
+	cmp	x5, TCR_T0SZ(VA_BITS_MIN) // default T0SZ small enough?
 	b.ge	1f			// .. then skip VA range extension
 	adr_l	x6, idmap_t0sz
 SYM_FUNC_START(__enable_mmu)
 	mrs	x2, ID_AA64MMFR0_EL1
 	ubfx	x2, x2, #ID_AA64MMFR0_TGRAN_SHIFT, 4
-	cmp	x2, #ID_AA64MMFR0_TGRAN_SUPPORTED
+	cmp     x2, #ID_AA64MMFR0_TGRAN_SUPPORTED_MIN
-	b.ne	__no_granule_support
+	b.lt    __no_granule_support
+	cmp     x2, #ID_AA64MMFR0_TGRAN_SUPPORTED_MAX
+	b.gt    __no_granule_support
 	update_early_cpu_boot_status 0, x2, x3
 	adrp	x2, idmap_pg_dir
 	phys_to_ttbr x1, x1

arch/arm64/kernel/idreg-override.c+23−20

@@ -163,33 +163,36 @@ static __init void __parse_cmdline(const char *cmdline, bool parse_aliases) · 162 unmodified lines
163	} while (1);	163	} while (1);
164	}	164	}
165		165
166	static __init void parse_cmdline(void)	166	static __init const u8 *get_bootargs_cmdline(void)
167	{	167	{
168	if (!IS_ENABLED(CONFIG_CMDLINE_FORCE)) {	168	const u8 *prop;
169	const u8 *prop;	169	void *fdt;
170	void *fdt;	170	int node;
171	int node;
172		171
173	fdt = get_early_fdt_ptr();	172	fdt = get_early_fdt_ptr();
174	if (!fdt)	173	if (!fdt)
175	goto out;	174	return NULL;
176		175
177	node = fdt_path_offset(fdt, "/chosen");	176	node = fdt_path_offset(fdt, "/chosen");
178	if (node < 0)	177	if (node < 0)
179	goto out;	178	return NULL;
180		179
181	prop = fdt_getprop(fdt, node, "bootargs", NULL);	180	prop = fdt_getprop(fdt, node, "bootargs", NULL);
182	if (!prop)	181	if (!prop)
183	goto out;	182	return NULL;
184		183
185	__parse_cmdline(prop, true);	184	return strlen(prop) ? prop : NULL;
		185	}
186		186
187	if (!IS_ENABLED(CONFIG_CMDLINE_EXTEND))	187	static __init void parse_cmdline(void)
188	return;	188	{
189	}	189	const u8 *prop = get_bootargs_cmdline();
190		190
191	out:	191	if (IS_ENABLED(CONFIG_CMDLINE_FORCE) \|\| !prop)
192	__parse_cmdline(CONFIG_CMDLINE, true);	192	__parse_cmdline(CONFIG_CMDLINE, true);
		193
		194	if (!IS_ENABLED(CONFIG_CMDLINE_FORCE) && prop)
		195	__parse_cmdline(prop, true);
193	}	196	}
194		197
195	/* Keep checkers quiet */	198	/* Keep checkers quiet */

arch/arm64/kernel/image-vars.h+3−0

@@ -101,6 +101,9 @@ KVM_NVHE_ALIAS(__stop___kvm_ex_table); · 100 unmodified lines
101	/* Array containing bases of nVHE per-CPU memory regions. */	101	/* Array containing bases of nVHE per-CPU memory regions. */
102	KVM_NVHE_ALIAS(kvm_arm_hyp_percpu_base);	102	KVM_NVHE_ALIAS(kvm_arm_hyp_percpu_base);
103		103
		104	/* PMU available static key */
		105	KVM_NVHE_ALIAS(kvm_arm_pmu_available);
		106
104	#endif /* CONFIG_KVM */	107	#endif /* CONFIG_KVM */
105		108
106	#endif /* __ARM64_KERNEL_IMAGE_VARS_H */	109	#endif /* __ARM64_KERNEL_IMAGE_VARS_H */

arch/arm64/kernel/perf_event.c+1−1

@@ -460,7 +460,7 @@ static inline int armv8pmu_counter_has_overflowed(u32 pmnc, int idx) · 459 unmodified lines
460	return pmnc & BIT(ARMV8_IDX_TO_COUNTER(idx));	460	return pmnc & BIT(ARMV8_IDX_TO_COUNTER(idx));
461	}	461	}
462		462
463	static inline u32 armv8pmu_read_evcntr(int idx)	463	static inline u64 armv8pmu_read_evcntr(int idx)
464	{	464	{
465	u32 counter = ARMV8_IDX_TO_COUNTER(idx);	465	u32 counter = ARMV8_IDX_TO_COUNTER(idx);
466		466

arch/arm64/kvm/arm.c+6−1

 	last_ran = this_cpu_ptr(mmu->last_vcpu_ran);
 	/*
+	 * We guarantee that both TLBs and I-cache are private to each
+	 * vcpu. If detecting that a vcpu from the same VM has
+	 * previously run on the same physical CPU, call into the
+	 * hypervisor code to nuke the relevant contexts.
+	 *
 	 * We might get preempted before the vCPU actually runs, but
 	 * over-invalidation doesn't affect correctness.
 	 */
 	if (*last_ran != vcpu->vcpu_id) {
-		kvm_call_hyp(__kvm_tlb_flush_local_vmid, mmu);
+		kvm_call_hyp(__kvm_flush_cpu_context, mmu);
 		*last_ran = vcpu->vcpu_id;
 	}

arch/arm64/kvm/hyp/entry.S+5−3

 	// If the hyp context is loaded, go straight to hyp_panic
 	get_loaded_vcpu x0, x1
-	cbz	x0, hyp_panic
+	cbnz	x0, 1f
+	b	hyp_panic
+1:
 	// The hyp context is saved so make sure it is restored to allow
 	// hyp_panic to run at hyp and, subsequently, panic to run in the host.
 	// This makes use of __guest_exit to avoid duplication but sets the
 	// current state is saved to the guest context but it will only be
 	// accurate if the guest had been completely restored.
 	adr_this_cpu x0, kvm_hyp_ctxt, x1
-	adr	x1, hyp_panic
+	adr_l	x1, hyp_panic
 	str	x1, [x0, #CPU_XREG_OFFSET(30)]
 	get_vcpu_ptr	x1, x0
 	// Now restore the hyp regs
 	restore_callee_saved_regs x2
-	set_loaded_vcpu xzr, x1, x2
+	set_loaded_vcpu xzr, x2, x3
 alternative_if ARM64_HAS_RAS_EXTN
 	// If we have the RAS extensions we can consume a pending error

arch/arm64/kvm/hyp/include/hyp/switch.h+6−3

 	 * counter, which could make a PMXEVCNTR_EL0 access UNDEF at
 	 * EL1 instead of being trapped to EL2.
 	 */
-	write_sysreg(0, pmselr_el0);
+	if (kvm_arm_support_pmu_v3()) {
-	write_sysreg(ARMV8_PMU_USERENR_MASK, pmuserenr_el0);
+		write_sysreg(0, pmselr_el0);
+		write_sysreg(ARMV8_PMU_USERENR_MASK, pmuserenr_el0);
+	}
 	write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2);
 }
 static inline void __deactivate_traps_common(void)
 {
 	write_sysreg(0, hstr_el2);
-	write_sysreg(0, pmuserenr_el0);
+	if (kvm_arm_support_pmu_v3())
+		write_sysreg(0, pmuserenr_el0);
 }
 static inline void ___activate_traps(struct kvm_vcpu *vcpu)

arch/arm64/kvm/hyp/nvhe/debug-sr.c+10−2

 	write_sysreg_s(pmscr_el1, SYS_PMSCR_EL1);
 }
-void __debug_switch_to_guest(struct kvm_vcpu *vcpu)
+void __debug_save_host_buffers_nvhe(struct kvm_vcpu *vcpu)
 {
 	/* Disable and flush SPE data generation */
 	__debug_save_spe(&vcpu->arch.host_debug_state.pmscr_el1);
+}
+void __debug_switch_to_guest(struct kvm_vcpu *vcpu)
+{
 	__debug_switch_to_guest_common(vcpu);
 }
-void __debug_switch_to_host(struct kvm_vcpu *vcpu)
+void __debug_restore_host_buffers_nvhe(struct kvm_vcpu *vcpu)
 {
 	__debug_restore_spe(vcpu->arch.host_debug_state.pmscr_el1);
+}
+void __debug_switch_to_host(struct kvm_vcpu *vcpu)
+{
 	__debug_switch_to_host_common(vcpu);
 }

arch/arm64/kvm/hyp/nvhe/host.S+8−7

@@ -71,7 +71,8 @@ SYM_FUNC_START(__host_enter) · 70 unmodified lines
71	SYM_FUNC_END(__host_enter)	71	SYM_FUNC_END(__host_enter)
72		72
73	/*	73	/*
74	* void __noreturn __hyp_do_panic(bool restore_host, u64 spsr, u64 elr, u64 par);	74	* void __noreturn __hyp_do_panic(struct kvm_cpu_context *host_ctxt, u64 spsr,
		75	* u64 elr, u64 par);
75	*/	76	*/
76	SYM_FUNC_START(__hyp_do_panic)	77	SYM_FUNC_START(__hyp_do_panic)
77	/* Prepare and exit to the host's panic funciton. */	78	/* Prepare and exit to the host's panic funciton. */
@@ -82,9 +83,11 @@ SYM_FUNC_START(__hyp_do_panic) · 4 unmodified lines
82	hyp_kimg_va lr, x6	83	hyp_kimg_va lr, x6
83	msr elr_el2, lr	84	msr elr_el2, lr
84		85
85	/* Set the panic format string. Use the, now free, LR as scratch. */	86	mov x29, x0
86	ldr lr, =__hyp_panic_string	87
87	hyp_kimg_va lr, x6	88	/* Load the format string into x0 and arguments into x1-7 */
		89	ldr x0, =__hyp_panic_string
		90	hyp_kimg_va x0, x6
88		91
89	/* Load the format arguments into x1-7. */	92	/* Load the format arguments into x1-7. */
90	mov x6, x3	93	mov x6, x3
@@ -94,9 +97,7 @@ SYM_FUNC_START(__hyp_do_panic) · 3 unmodified lines
94	mrs x5, hpfar_el2	97	mrs x5, hpfar_el2
95		98
96	/* Enter the host, conditionally restoring the host context. */	99	/* Enter the host, conditionally restoring the host context. */
97	cmp x0, xzr	100	cbz x29, __host_enter_without_restoring
98	mov x0, lr
99	b.eq __host_enter_without_restoring
100	b __host_enter_for_panic	101	b __host_enter_for_panic
101	SYM_FUNC_END(__hyp_do_panic)	102	SYM_FUNC_END(__hyp_do_panic)
102		103

arch/arm64/kvm/hyp/nvhe/hyp-main.c+6−6

@@ -46,11 +46,11 @@ static void handle___kvm_tlb_flush_vmid(struct kvm_cpu_context *host_ctxt) · 45 unmodified lines
46	__kvm_tlb_flush_vmid(kern_hyp_va(mmu));	46	__kvm_tlb_flush_vmid(kern_hyp_va(mmu));
47	}	47	}
48		48
49	static void handle___kvm_tlb_flush_local_vmid(struct kvm_cpu_context *host_ctxt)	49	static void handle___kvm_flush_cpu_context(struct kvm_cpu_context *host_ctxt)
50	{	50	{
51	DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1);	51	DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1);
52		52
53	__kvm_tlb_flush_local_vmid(kern_hyp_va(mmu));	53	__kvm_flush_cpu_context(kern_hyp_va(mmu));
54	}	54	}
55		55
56	static void handle___kvm_timer_set_cntvoff(struct kvm_cpu_context *host_ctxt)	56	static void handle___kvm_timer_set_cntvoff(struct kvm_cpu_context *host_ctxt)
@@ -67,9 +67,9 @@ static void handle___kvm_enable_ssbs(struct kvm_cpu_context *host_ctxt) · 10 unmodified lines
67	write_sysreg_el2(tmp, SYS_SCTLR);	67	write_sysreg_el2(tmp, SYS_SCTLR);
68	}	68	}
69		69
70	static void handle___vgic_v3_get_ich_vtr_el2(struct kvm_cpu_context *host_ctxt)	70	static void handle___vgic_v3_get_gic_config(struct kvm_cpu_context *host_ctxt)
71	{	71	{
72	cpu_reg(host_ctxt, 1) = __vgic_v3_get_ich_vtr_el2();	72	cpu_reg(host_ctxt, 1) = __vgic_v3_get_gic_config();
73	}	73	}
74		74
75	static void handle___vgic_v3_read_vmcr(struct kvm_cpu_context *host_ctxt)	75	static void handle___vgic_v3_read_vmcr(struct kvm_cpu_context *host_ctxt)
@@ -115,10 +115,10 @@ static const hcall_t host_hcall[] = { · 39 unmodified lines
115	HANDLE_FUNC(__kvm_flush_vm_context),	115	HANDLE_FUNC(__kvm_flush_vm_context),
116	HANDLE_FUNC(__kvm_tlb_flush_vmid_ipa),	116	HANDLE_FUNC(__kvm_tlb_flush_vmid_ipa),
117	HANDLE_FUNC(__kvm_tlb_flush_vmid),	117	HANDLE_FUNC(__kvm_tlb_flush_vmid),
118	HANDLE_FUNC(__kvm_tlb_flush_local_vmid),	118	HANDLE_FUNC(__kvm_flush_cpu_context),
119	HANDLE_FUNC(__kvm_timer_set_cntvoff),	119	HANDLE_FUNC(__kvm_timer_set_cntvoff),
120	HANDLE_FUNC(__kvm_enable_ssbs),	120	HANDLE_FUNC(__kvm_enable_ssbs),
121	HANDLE_FUNC(__vgic_v3_get_ich_vtr_el2),	121	HANDLE_FUNC(__vgic_v3_get_gic_config),
122	HANDLE_FUNC(__vgic_v3_read_vmcr),	122	HANDLE_FUNC(__vgic_v3_read_vmcr),
123	HANDLE_FUNC(__vgic_v3_write_vmcr),	123	HANDLE_FUNC(__vgic_v3_write_vmcr),
124	HANDLE_FUNC(__vgic_v3_init_lrs),	124	HANDLE_FUNC(__vgic_v3_init_lrs),

arch/arm64/kvm/hyp/nvhe/switch.c+11−3

 	pmu_switch_needed = __pmu_switch_to_guest(host_ctxt);
 	__sysreg_save_state_nvhe(host_ctxt);
+	/*
+	 * We must flush and disable the SPE buffer for nVHE, as
+	 * the translation regime(EL1&0) is going to be loaded with
+	 * that of the guest. And we must do this before we change the
+	 * translation regime to EL2 (via MDCR_EL2_E2PB == 0) and
+	 * before we load guest Stage1.
+	 */
+	__debug_save_host_buffers_nvhe(vcpu);
 	__adjust_pc(vcpu);
 	if (vcpu->arch.flags & KVM_ARM64_FP_ENABLED)
 		__fpsimd_save_fpexc32(vcpu);
+	__debug_switch_to_host(vcpu);
 	/*
 	 * This must come after restoring the host sysregs, since a non-VHE
 	 * system may enable SPE here and make use of the TTBRs.
 	 */
-	__debug_switch_to_host(vcpu);
+	__debug_restore_host_buffers_nvhe(vcpu);
 	if (pmu_switch_needed)
 		__pmu_switch_to_host(host_ctxt);
 	u64 spsr = read_sysreg_el2(SYS_SPSR);
 	u64 elr = read_sysreg_el2(SYS_ELR);
 	u64 par = read_sysreg_par();
-	bool restore_host = true;
 	struct kvm_cpu_context *host_ctxt;
 	struct kvm_vcpu *vcpu;
 		__sysreg_restore_state_nvhe(host_ctxt);
 	}
-	__hyp_do_panic(restore_host, spsr, elr, par);
+	__hyp_do_panic(host_ctxt, spsr, elr, par);
 	unreachable();
 }

arch/arm64/kvm/hyp/nvhe/tlb.c+2−1

 	__tlb_switch_to_host(&cxt);
 }
-void __kvm_tlb_flush_local_vmid(struct kvm_s2_mmu *mmu)
+void __kvm_flush_cpu_context(struct kvm_s2_mmu *mmu)
 {
 	struct tlb_inv_context cxt;
 	__tlb_switch_to_guest(mmu, &cxt);
 	__tlbi(vmalle1);
+	asm volatile("ic iallu");
 	dsb(nsh);
 	isb();

arch/arm64/kvm/hyp/pgtable.c+1−0

@@ -223,6 +223,7 @@ static inline int __kvm_pgtable_visit(struct kvm_pgtable_walk_data *data, · 222 unmodified lines
223	goto out;	223	goto out;
224		224
225	if (!table) {	225	if (!table) {
		226	data->addr = ALIGN_DOWN(data->addr, kvm_granule_size(level));
226	data->addr += kvm_granule_size(level);	227	data->addr += kvm_granule_size(level);
227	goto out;	228	goto out;
228	}	229	}

arch/arm64/kvm/hyp/vgic-v3-sr.c+38−2

@@ -405,9 +405,45 @@ void __vgic_v3_init_lrs(void) · 404 unmodified lines
405	__gic_v3_set_lr(0, i);	405	__gic_v3_set_lr(0, i);
406	}	406	}
407		407
408	u64 __vgic_v3_get_ich_vtr_el2(void)	408	/*
		409	* Return the GIC CPU configuration:
		410	* - [31:0] ICH_VTR_EL2
		411	* - [62:32] RES0
		412	* - [63] MMIO (GICv2) capable
		413	*/
		414	u64 __vgic_v3_get_gic_config(void)
409	{	415	{
410	return read_gicreg(ICH_VTR_EL2);	416	u64 val, sre = read_gicreg(ICC_SRE_EL1);
		417	unsigned long flags = 0;
		418
		419	/*
		420	* To check whether we have a MMIO-based (GICv2 compatible)
		421	* CPU interface, we need to disable the system register
		422	* view. To do that safely, we have to prevent any interrupt
		423	* from firing (which would be deadly).
		424	*
		425	* Note that this only makes sense on VHE, as interrupts are
		426	* already masked for nVHE as part of the exception entry to
		427	* EL2.
		428	*/
		429	if (has_vhe())
		430	flags = local_daif_save();
		431
		432	write_gicreg(0, ICC_SRE_EL1);
		433	isb();
		434
		435	val = read_gicreg(ICC_SRE_EL1);
		436
		437	write_gicreg(sre, ICC_SRE_EL1);
		438	isb();
		439
		440	if (has_vhe())
		441	local_daif_restore(flags);
		442
		443	val = (val & ICC_SRE_EL1_SRE) ? 0 : (1ULL << 63);
		444	val \|= read_gicreg(ICH_VTR_EL2);
		445
		446	return val;
411	}	447	}
412		448
413	u64 __vgic_v3_read_vmcr(void)	449	u64 __vgic_v3_read_vmcr(void)

arch/arm64/kvm/hyp/vhe/tlb.c+2−1

 	__tlb_switch_to_host(&cxt);
 }
-void __kvm_tlb_flush_local_vmid(struct kvm_s2_mmu *mmu)
+void __kvm_flush_cpu_context(struct kvm_s2_mmu *mmu)
 {
 	struct tlb_inv_context cxt;
 	__tlb_switch_to_guest(mmu, &cxt);
 	__tlbi(vmalle1);
+	asm volatile("ic iallu");
 	dsb(nsh);
 	isb();

arch/arm64/kvm/mmu.c+1−2

@@ -1312,8 +1312,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, · 1311 unmodified lines
1312	* Prevent userspace from creating a memory region outside of the IPA	1312	* Prevent userspace from creating a memory region outside of the IPA
1313	* space addressable by the KVM guest IPA space.	1313	* space addressable by the KVM guest IPA space.
1314	*/	1314	*/
1315	if (memslot->base_gfn + memslot->npages >=	1315	if ((memslot->base_gfn + memslot->npages) > (kvm_phys_size(kvm) >> PAGE_SHIFT))
1316	(kvm_phys_size(kvm) >> PAGE_SHIFT))
1317	return -EFAULT;	1316	return -EFAULT;
1318		1317
1319	mmap_read_lock(current->mm);	1318	mmap_read_lock(current->mm);

arch/arm64/kvm/perf.c+10−0

 #include <asm/kvm_emulate.h>
+DEFINE_STATIC_KEY_FALSE(kvm_arm_pmu_available);
 static int kvm_is_in_guest(void)
 {
         return kvm_get_running_vcpu() != NULL;
 int kvm_perf_init(void)
 {
+	/*
+	 * Check if HW_PERF_EVENTS are supported by checking the number of
+	 * hardware performance counters. This could ensure the presence of
+	 * a physical PMU and CONFIG_PERF_EVENT is selected.
+	 */
+	if (IS_ENABLED(CONFIG_ARM_PMU) && perf_num_counters() > 0)
+		static_branch_enable(&kvm_arm_pmu_available);
 	return perf_register_guest_info_callbacks(&kvm_guest_cbs);
 }

arch/arm64/kvm/pmu-emul.c+0−10

@@ -823,16 +823,6 @@ u64 kvm_pmu_get_pmceid(struct kvm_vcpu *vcpu, bool pmceid1) · 822 unmodified lines
823	return val & mask;	823	return val & mask;
824	}	824	}
825		825
826	bool kvm_arm_support_pmu_v3(void)
827	{
828	/*
829	* Check if HW_PERF_EVENTS are supported by checking the number of
830	* hardware performance counters. This could ensure the presence of
831	* a physical PMU and CONFIG_PERF_EVENT is selected.
832	*/
833	return (perf_num_counters() > 0);
834	}
835
836	int kvm_arm_pmu_v3_enable(struct kvm_vcpu *vcpu)	826	int kvm_arm_pmu_v3_enable(struct kvm_vcpu *vcpu)
837	{	827	{
838	if (!kvm_vcpu_has_pmu(vcpu))	828	if (!kvm_vcpu_has_pmu(vcpu))

arch/arm64/kvm/reset.c+14−8

 	}
 	switch (cpuid_feature_extract_unsigned_field(mmfr0, tgran_2)) {
-	default:
+	case ID_AA64MMFR0_TGRAN_2_SUPPORTED_NONE:
-	case 1:
 		kvm_err("PAGE_SIZE not supported at Stage-2, giving up\n");
 		return -EINVAL;
-	case 0:
+	case ID_AA64MMFR0_TGRAN_2_SUPPORTED_DEFAULT:
 		kvm_debug("PAGE_SIZE supported at Stage-2 (default)\n");
 		break;
-	case 2:
+	case ID_AA64MMFR0_TGRAN_2_SUPPORTED_MIN ... ID_AA64MMFR0_TGRAN_2_SUPPORTED_MAX:
 		kvm_debug("PAGE_SIZE supported at Stage-2 (advertised)\n");
 		break;
+	default:
+		kvm_err("Unsupported value for TGRAN_2, giving up\n");
+		return -EINVAL;
 	}
 	kvm_ipa_limit = id_aa64mmfr0_parange_to_phys_shift(parange);
-	WARN(kvm_ipa_limit < KVM_PHYS_SHIFT,
+	kvm_info("IPA Size Limit: %d bits%s\n", kvm_ipa_limit,
-	     "KVM IPA Size Limit (%d bits) is smaller than default size\n",
+		 ((kvm_ipa_limit < KVM_PHYS_SHIFT) ?
-	     kvm_ipa_limit);
+		  " (Reduced IPA size, limited VM/VMM compatibility)" : ""));
-	kvm_info("IPA Size Limit: %d bits\n", kvm_ipa_limit);
 	return 0;
 }
 			return -EINVAL;
 	} else {
 		phys_shift = KVM_PHYS_SHIFT;
+		if (phys_shift > kvm_ipa_limit) {
+			pr_warn_once("%s using unsupported default IPA limit, upgrade your VMM\n",
+				     current->comm);
+			return -EINVAL;
+		}
 	}
 	mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1);

arch/arm64/kvm/vgic/vgic-v3.c+9−3

  */
 int vgic_v3_probe(const struct gic_kvm_info *info)
 {
-	u32 ich_vtr_el2 = kvm_call_hyp_ret(__vgic_v3_get_ich_vtr_el2);
+	u64 ich_vtr_el2 = kvm_call_hyp_ret(__vgic_v3_get_gic_config);
+	bool has_v2;
 	int ret;
+	has_v2 = ich_vtr_el2 >> 63;
+	ich_vtr_el2 = (u32)ich_vtr_el2;
 	/*
 	 * The ListRegs field is 5 bits, but there is an architectural
 	 * maximum of 16 list registers. Just ignore bit 4...
 			 gicv4_enable ? "en" : "dis");
 	}
+	kvm_vgic_global_state.vcpu_base = 0;
 	if (!info->vcpu.start) {
 		kvm_info("GICv3: no GICV resource entry\n");
-		kvm_vgic_global_state.vcpu_base = 0;
+	} else if (!has_v2) {
+		pr_warn(FW_BUG "CPU interface incapable of MMIO access\n");
 	} else if (!PAGE_ALIGNED(info->vcpu.start)) {
 		pr_warn("GICV physical address 0x%llx not page aligned\n",
 			(unsigned long long)info->vcpu.start);
-		kvm_vgic_global_state.vcpu_base = 0;
 	} else {
 		kvm_vgic_global_state.vcpu_base = info->vcpu.start;
 		kvm_vgic_global_state.can_emulate_gicv2 = true;

arch/arm64/mm/init.c+26−3

@@ -219,17 +219,40 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max) · 218 unmodified lines
219		219
220	int pfn_valid(unsigned long pfn)	220	int pfn_valid(unsigned long pfn)
221	{	221	{
222	phys_addr_t addr = pfn << PAGE_SHIFT;	222	phys_addr_t addr = PFN_PHYS(pfn);
223		223
224	if ((addr >> PAGE_SHIFT) != pfn)	224	/*
		225	* Ensure the upper PAGE_SHIFT bits are clear in the
		226	* pfn. Else it might lead to false positives when
		227	* some of the upper bits are set, but the lower bits
		228	* match a valid pfn.
		229	*/
		230	if (PHYS_PFN(addr) != pfn)
225	return 0;	231	return 0;
226		232
227	#ifdef CONFIG_SPARSEMEM	233	#ifdef CONFIG_SPARSEMEM
		234	{
		235	struct mem_section *ms;
		236
228	if (pfn_to_section_nr(pfn) >= NR_MEM_SECTIONS)	237	if (pfn_to_section_nr(pfn) >= NR_MEM_SECTIONS)
229	return 0;	238	return 0;
230		239
231	if (!valid_section(__pfn_to_section(pfn)))	240	ms = __pfn_to_section(pfn);
		241	if (!valid_section(ms))
232	return 0;	242	return 0;
		243
		244	/*
		245	* ZONE_DEVICE memory does not have the memblock entries.
		246	* memblock_is_map_memory() check for ZONE_DEVICE based
		247	* addresses will always fail. Even the normal hotplugged
		248	* memory will never have MEMBLOCK_NOMAP flag set in their
		249	* memblock entries. Skip memblock search for all non early
		250	* memory sections covering all of hotplug memory including
		251	* both normal and ZONE_DEVICE based.
		252	*/
		253	if (!early_section(ms))
		254	return pfn_section_valid(ms, pfn);
		255	}
233	#endif	256	#endif
234	return memblock_is_map_memory(addr);	257	return memblock_is_map_memory(addr);
235	}	258	}

arch/arm64/mm/mmu.c+3−2

 #define NO_BLOCK_MAPPINGS	BIT(0)
 #define NO_CONT_MAPPINGS	BIT(1)
-u64 idmap_t0sz = TCR_T0SZ(VA_BITS);
+u64 idmap_t0sz = TCR_T0SZ(VA_BITS_MIN);
 u64 idmap_ptrs_per_pgd = PTRS_PER_PGD;
 u64 __section(".mmuoff.data.write") vabits_actual;
 		 * if MTE is present. Otherwise, it has the same attributes as
 		 * PAGE_KERNEL.
 		 */
-		__map_memblock(pgdp, start, end, PAGE_KERNEL_TAGGED, flags);
+		__map_memblock(pgdp, start, end, pgprot_tagged(PAGE_KERNEL),
+			       flags);
 	}
 	/*

arch/ia64/include/asm/syscall.h+1−1

@@ -32,7 +32,7 @@ static inline void syscall_rollback(struct task_struct *task, · 31 unmodified lines
32	static inline long syscall_get_error(struct task_struct *task,	32	static inline long syscall_get_error(struct task_struct *task,
33	struct pt_regs *regs)	33	struct pt_regs *regs)
34	{	34	{
35	return regs->r10 == -1 ? regs->r8:0;	35	return regs->r10 == -1 ? -regs->r8:0;
36	}	36	}
37		37
38	static inline long syscall_get_return_value(struct task_struct *task,	38	static inline long syscall_get_return_value(struct task_struct *task,

arch/ia64/kernel/ptrace.c+18−6

 {
 	struct syscall_get_set_args *args = data;
 	struct pt_regs *pt = args->regs;
-	unsigned long *krbs, cfm, ndirty;
+	unsigned long *krbs, cfm, ndirty, nlocals, nouts;
 	int i, count;
 	if (unw_unwind_to_user(info) < 0)
 		return;
+	/*
+	 * We get here via a few paths:
+	 * - break instruction: cfm is shared with caller.
+	 *   syscall args are in out= regs, locals are non-empty.
+	 * - epsinstruction: cfm is set by br.call
+	 *   locals don't exist.
+	 *
+	 * For both cases argguments are reachable in cfm.sof - cfm.sol.
+	 * CFM: [ ... | sor: 17..14 | sol : 13..7 | sof : 6..0 ]
+	 */
 	cfm = pt->cr_ifs;
+	nlocals = (cfm >> 7) & 0x7f; /* aka sol */
+	nouts = (cfm & 0x7f) - nlocals; /* aka sof - sol */
 	krbs = (unsigned long *)info->task + IA64_RBS_OFFSET/8;
 	ndirty = ia64_rse_num_regs(krbs, krbs + (pt->loadrs >> 19));
 	count = 0;
 	if (in_syscall(pt))
-		count = min_t(int, args->n, cfm & 0x7f);
+		count = min_t(int, args->n, nouts);
+	/* Iterate over outs. */
 	for (i = 0; i < count; i++) {
+		int j = ndirty + nlocals + i + args->i;
 		if (args->rw)
-			*ia64_rse_skip_regs(krbs, ndirty + i + args->i) =
+			*ia64_rse_skip_regs(krbs, j) = args->args[i];
-				args->args[i];
 		else
-			args->args[i] = *ia64_rse_skip_regs(krbs,
+			args->args[i] = *ia64_rse_skip_regs(krbs, j);
-				ndirty + i + args->i);
 	}
 	if (!args->rw) {

arch/m68k/include/asm/page_mm.h+1−1

@@ -171,7 +171,7 @@ static inline __attribute_const__ int __virt_to_node_shift(void) · 170 unmodified lines
171	#include <asm-generic/memory_model.h>	171	#include <asm-generic/memory_model.h>
172	#endif	172	#endif
173		173
174	#define virt_addr_valid(kaddr) ((void )(kaddr) >= (void )PAGE_OFFSET && (void *)(kaddr) < high_memory)	174	#define virt_addr_valid(kaddr) ((unsigned long)(kaddr) >= PAGE_OFFSET && (unsigned long)(kaddr) < (unsigned long)high_memory)
175	#define pfn_valid(pfn) virt_addr_valid(pfn_to_virt(pfn))	175	#define pfn_valid(pfn) virt_addr_valid(pfn_to_virt(pfn))
176		176
177	#endif /* __ASSEMBLY__ */	177	#endif /* __ASSEMBLY__ */

arch/m68k/include/asm/page_no.h+2−2

@@ -30,8 +30,8 @@ extern unsigned long memory_end; · 29 unmodified lines
30	#define page_to_pfn(page) virt_to_pfn(page_to_virt(page))	30	#define page_to_pfn(page) virt_to_pfn(page_to_virt(page))
31	#define pfn_valid(pfn) ((pfn) < max_mapnr)	31	#define pfn_valid(pfn) ((pfn) < max_mapnr)
32		32
33	#define virt_addr_valid(kaddr) (((void )(kaddr) >= (void )PAGE_OFFSET) && \	33	#define virt_addr_valid(kaddr) (((unsigned long)(kaddr) >= PAGE_OFFSET) && \
34	((void )(kaddr) < (void )memory_end))	34	((unsigned long)(kaddr) < memory_end))
35		35
36	#endif /* __ASSEMBLY__ */	36	#endif /* __ASSEMBLY__ */
37		37

arch/mips/boot/compressed/decompress.c+8−0

 #include <asm/addrspace.h>
 #include <asm/unaligned.h>
+#include <asm-generic/vmlinux.lds.h>
 /*
  * These two variables specify the free mem region
 		/* last four bytes is always image size in little endian */
 		image_size = get_unaligned_le32((void *)&__image_end - 4);
+		/* The device tree's address must be properly aligned  */
+		image_size = ALIGN(image_size, STRUCT_ALIGNMENT);
+		puts("Copy device tree to address  ");
+		puthex(VMLINUX_LOAD_ADDRESS_ULL + image_size);
+		puts("\n");
 		/* copy dtb to where the booted kernel will expect it */
 		memcpy((void *)VMLINUX_LOAD_ADDRESS_ULL + image_size,
 		       __appended_dtb, dtb_size);

arch/mips/crypto/Makefile+2−2

@@ -12,8 +12,8 @@ AFLAGS_chacha-core.o += -O2 # needed to fill branch delay slots · 11 unmodified lines
12	obj-$(CONFIG_CRYPTO_POLY1305_MIPS) += poly1305-mips.o	12	obj-$(CONFIG_CRYPTO_POLY1305_MIPS) += poly1305-mips.o
13	poly1305-mips-y := poly1305-core.o poly1305-glue.o	13	poly1305-mips-y := poly1305-core.o poly1305-glue.o
14		14
15	perlasm-flavour-$(CONFIG_CPU_MIPS32) := o32	15	perlasm-flavour-$(CONFIG_32BIT) := o32
16	perlasm-flavour-$(CONFIG_CPU_MIPS64) := 64	16	perlasm-flavour-$(CONFIG_64BIT) := 64
17		17
18	quiet_cmd_perlasm = PERLASM $@	18	quiet_cmd_perlasm = PERLASM $@
19	cmd_perlasm = $(PERL) $(<) $(perlasm-flavour-y) $(@)	19	cmd_perlasm = $(PERL) $(<) $(perlasm-flavour-y) $(@)

arch/mips/include/asm/traps.h+3−0

 extern void (*board_cache_error_setup)(void);
 extern int register_nmi_notifier(struct notifier_block *nb);
+extern void reserve_exception_space(phys_addr_t addr, unsigned long size);
 extern char except_vec_nmi[];
+#define VECTORSPACING 0x100	/* for EI/VI mode */
 #define nmi_notifier(fn, pri)						\
 ({									\
 	static struct notifier_block fn##_nb = {			\

arch/mips/kernel/cpu-probe.c+6−0

 #include <asm/elf.h>
 #include <asm/pgtable-bits.h>
 #include <asm/spram.h>
+#include <asm/traps.h>
 #include <linux/uaccess.h>
 #include "fpu-probe.h"
 		c->cputype = CPU_BMIPS3300;
 		__cpu_name[cpu] = "Broadcom BMIPS3300";
 		set_elf_platform(cpu, "bmips3300");
+		reserve_exception_space(0x400, VECTORSPACING * 64);
 		break;
 	case PRID_IMP_BMIPS43XX: {
 		int rev = c->processor_id & PRID_REV_MASK;
 			__cpu_name[cpu] = "Broadcom BMIPS4380";
 			set_elf_platform(cpu, "bmips4380");
 			c->options |= MIPS_CPU_RIXI;
+			reserve_exception_space(0x400, VECTORSPACING * 64);
 		} else {
 			c->cputype = CPU_BMIPS4350;
 			__cpu_name[cpu] = "Broadcom BMIPS4350";
 			__cpu_name[cpu] = "Broadcom BMIPS5000";
 		set_elf_platform(cpu, "bmips5000");
 		c->options |= MIPS_CPU_ULRI | MIPS_CPU_RIXI;
+		reserve_exception_space(0x1000, VECTORSPACING * 64);
 		break;
 	}
 }
 	if (cpu == 0)
 		__ua_limit = ~((1ull << cpu_vmbits) - 1);
 #endif
+	reserve_exception_space(0, 0x1000);
 }
 void cpu_report(void)

arch/mips/kernel/cpu-r3k-probe.c+3−0

 #include <asm/fpu.h>
 #include <asm/mipsregs.h>
 #include <asm/elf.h>
+#include <asm/traps.h>
 #include "fpu-probe.h"
 		cpu_set_fpu_opts(c);
 	else
 		cpu_set_nofpu_opts(c);
+	reserve_exception_space(0, 0x400);
 }
 void cpu_report(void)

arch/mips/kernel/traps.c+5−5

 	nmi_exit();
 }
-#define VECTORSPACING 0x100	/* for EI/VI mode */
 unsigned long ebase;
 EXPORT_SYMBOL_GPL(ebase);
 unsigned long exception_handlers[32];
 unsigned long vi_handlers[64];
+void reserve_exception_space(phys_addr_t addr, unsigned long size)
+{
+	memblock_reserve(addr, size);
+}
 void __init *set_except_vector(int n, void *addr)
 {
 	unsigned long handler = (unsigned long) addr;
 	if (!cpu_has_mips_r2_r6) {
 		ebase = CAC_BASE;
-		ebase_pa = virt_to_phys((void *)ebase);
 		vec_size = 0x400;
-		memblock_reserve(ebase_pa, vec_size);
 	} else {
 		if (cpu_has_veic || cpu_has_vint)
 			vec_size = 0x200 + VECTORSPACING*64;

arch/mips/kernel/vmlinux.lds.S+6−0

 	}
 #ifdef CONFIG_MIPS_ELF_APPENDED_DTB
+	STRUCT_ALIGN();
 	.appended_dtb : AT(ADDR(.appended_dtb) - LOAD_OFFSET) {
 		*(.appended_dtb)
 		KEEP(*(.appended_dtb))
 #endif
 #ifdef CONFIG_MIPS_RAW_APPENDED_DTB
+	.fill : {
+		FILL(0);
+		BYTE(0);
+		. = ALIGN(8);
+	}
 	__appended_dtb = .;
 	/* leave space for appended DTB */
 	. += 0x100000;

arch/parisc/Kconfig+5−2

 	def_bool y
 	depends on PA8X00 || PA7200
+config PARISC_HUGE_KERNEL
+	def_bool y if !MODULES || UBSAN || FTRACE || COMPILE_TEST
 config MLONGCALLS
-	def_bool y if !MODULES || UBSAN || FTRACE
+	def_bool y if PARISC_HUGE_KERNEL
-	bool "Enable the -mlong-calls compiler option for big kernels" if MODULES && !UBSAN && !FTRACE
+	bool "Enable the -mlong-calls compiler option for big kernels" if !PARISC_HUGE_KERNEL
 	depends on PA8X00
 	help
 	  If you configure the kernel to include many drivers built-in instead

arch/parisc/kernel/ptrace.c+0−2

@@ -567,8 +567,6 @@ static const struct user_regset_view user_parisc_native_view = { · 566 unmodified lines
567	};	567	};
568		568
569	#ifdef CONFIG_64BIT	569	#ifdef CONFIG_64BIT
570	#include <linux/compat.h>
571
572	static int gpr32_get(struct task_struct *target,	570	static int gpr32_get(struct task_struct *target,
573	const struct user_regset *regset,	571	const struct user_regset *regset,
574	struct membuf to)	572	struct membuf to)

arch/powerpc/include/asm/code-patching.h+4−3

@@ -73,9 +73,10 @@ void __patch_exception(int exc, unsigned long addr); · 72 unmodified lines
73	#endif	73	#endif
74		74
75	#define OP_RT_RA_MASK 0xffff0000UL	75	#define OP_RT_RA_MASK 0xffff0000UL
76	#define LIS_R2 0x3c020000UL	76	#define LIS_R2 (PPC_INST_ADDIS \| __PPC_RT(R2))
77	#define ADDIS_R2_R12 0x3c4c0000UL	77	#define ADDIS_R2_R12 (PPC_INST_ADDIS \| __PPC_RT(R2) \| __PPC_RA(R12))
78	#define ADDI_R2_R2 0x38420000UL	78	#define ADDI_R2_R2 (PPC_INST_ADDI \| __PPC_RT(R2) \| __PPC_RA(R2))
		79
79		80
80	static inline unsigned long ppc_function_entry(void *func)	81	static inline unsigned long ppc_function_entry(void *func)
81	{	82	{

arch/powerpc/include/asm/dcr-native.h+4−4

@@ -53,8 +53,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val) · 52 unmodified lines
53	#define mfdcr(rn) \	53	#define mfdcr(rn) \
54	({unsigned int rval; \	54	({unsigned int rval; \
55	if (__builtin_constant_p(rn) && rn < 1024) \	55	if (__builtin_constant_p(rn) && rn < 1024) \
56	asm volatile("mfdcr %0," __stringify(rn) \	56	asm volatile("mfdcr %0, %1" : "=r" (rval) \
57	: "=r" (rval)); \	57	: "n" (rn)); \
58	else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \	58	else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \
59	rval = mfdcrx(rn); \	59	rval = mfdcrx(rn); \
60	else \	60	else \
@@ -64,8 +64,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val) · 3 unmodified lines
64	#define mtdcr(rn, v) \	64	#define mtdcr(rn, v) \
65	do { \	65	do { \
66	if (__builtin_constant_p(rn) && rn < 1024) \	66	if (__builtin_constant_p(rn) && rn < 1024) \
67	asm volatile("mtdcr " __stringify(rn) ",%0" \	67	asm volatile("mtdcr %0, %1" \
68	: : "r" (v)); \	68	: : "n" (rn), "r" (v)); \
69	else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \	69	else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \
70	mtdcrx(rn, v); \	70	mtdcrx(rn, v); \
71	else \	71	else \

arch/powerpc/include/asm/interrupt.h+2−1

 DECLARE_INTERRUPT_HANDLER(CacheLockingException);
 DECLARE_INTERRUPT_HANDLER(SPEFloatingPointException);
 DECLARE_INTERRUPT_HANDLER(SPEFloatingPointRoundException);
-DECLARE_INTERRUPT_HANDLER(unrecoverable_exception);
 DECLARE_INTERRUPT_HANDLER(WatchdogException);
 DECLARE_INTERRUPT_HANDLER(kernel_bad_stack);
 DECLARE_INTERRUPT_HANDLER_ASYNC(TAUException);
+void unrecoverable_exception(struct pt_regs *regs);
 void replay_system_reset(void);
 void replay_soft_interrupts(void);

arch/powerpc/include/asm/mmu.h+2−2

@@ -228,7 +228,7 @@ enum { · 227 unmodified lines
228	#define MMU_FTRS_ALWAYS 0	228	#define MMU_FTRS_ALWAYS 0
229	#endif	229	#endif
230		230
231	static inline bool early_mmu_has_feature(unsigned long feature)	231	static __always_inline bool early_mmu_has_feature(unsigned long feature)
232	{	232	{
233	if (MMU_FTRS_ALWAYS & feature)	233	if (MMU_FTRS_ALWAYS & feature)
234	return true;	234	return true;
@@ -286,7 +286,7 @@ static inline void mmu_feature_keys_init(void) · 51 unmodified lines
286		286
287	}	287	}
288		288
289	static inline bool mmu_has_feature(unsigned long feature)	289	static __always_inline bool mmu_has_feature(unsigned long feature)
290	{	290	{
291	return early_mmu_has_feature(feature);	291	return early_mmu_has_feature(feature);
292	}	292	}

arch/powerpc/include/asm/ptrace.h+2−2

arch/powerpc/include/asm/switch_to.h+10−0

@@ -71,6 +71,16 @@ static inline void disable_kernel_vsx(void) · 70 unmodified lines
71	{	71	{
72	msr_check_and_clear(MSR_FP\|MSR_VEC\|MSR_VSX);	72	msr_check_and_clear(MSR_FP\|MSR_VEC\|MSR_VSX);
73	}	73	}
		74	#else
		75	static inline void enable_kernel_vsx(void)
		76	{
		77	BUILD_BUG();
		78	}
		79
		80	static inline void disable_kernel_vsx(void)
		81	{
		82	BUILD_BUG();
		83	}
74	#endif	84	#endif
75		85
76	#ifdef CONFIG_SPE	86	#ifdef CONFIG_SPE

arch/powerpc/include/asm/vio.h+1−1

@@ -113,7 +113,7 @@ struct vio_driver { · 112 unmodified lines
113	const char *name;	113	const char *name;
114	const struct vio_device_id *id_table;	114	const struct vio_device_id *id_table;
115	int (probe)(struct vio_dev dev, const struct vio_device_id *id);	115	int (probe)(struct vio_dev dev, const struct vio_device_id *id);
116	int (remove)(struct vio_dev dev);	116	void (remove)(struct vio_dev dev);
117	/* A driver must have a get_desired_dma() function to	117	/* A driver must have a get_desired_dma() function to
118	* be loaded in a CMO environment if it uses DMA.	118	* be loaded in a CMO environment if it uses DMA.
119	*/	119	*/

arch/powerpc/kernel/exceptions-64s.S+1−1

@@ -466,7 +466,7 @@ DEFINE_FIXED_SYMBOL(\name\()_common_real) · 465 unmodified lines
466		466
467	ld r10,PACAKMSR(r13) /* get MSR value for kernel */	467	ld r10,PACAKMSR(r13) /* get MSR value for kernel */
468	/* MSR[RI] is clear iff using SRR regs */	468	/* MSR[RI] is clear iff using SRR regs */
469	.if IHSRR == EXC_HV_OR_STD	469	.if IHSRR_IF_HVMODE
470	BEGIN_FTR_SECTION	470	BEGIN_FTR_SECTION
471	xori r10,r10,MSR_RI	471	xori r10,r10,MSR_RI
472	END_FTR_SECTION_IFCLR(CPU_FTR_HVMODE)	472	END_FTR_SECTION_IFCLR(CPU_FTR_HVMODE)

arch/powerpc/kernel/head_book3s_32.S+6−3

 	cmplw	0,r1,r3
 #endif
 	mfspr	r2, SPRN_SDR1
-	li	r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC
+	li	r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC | _PAGE_USER
 	rlwinm	r2, r2, 28, 0xfffff000
 #ifdef CONFIG_MODULES
 	bgt-	112f
 	lis	r2, (swapper_pg_dir - PAGE_OFFSET)@ha	/* if kernel address, use */
+	li	r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC
 	addi	r2, r2, (swapper_pg_dir - PAGE_OFFSET)@l	/* kernel page table */
 #endif
 112:	rlwimi	r2,r3,12,20,29		/* insert top 10 bits of address */
 	lis	r1, TASK_SIZE@h		/* check if kernel address */
 	cmplw	0,r1,r3
 	mfspr	r2, SPRN_SDR1
-	li	r1, _PAGE_PRESENT | _PAGE_ACCESSED
+	li	r1, _PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_USER
 	rlwinm	r2, r2, 28, 0xfffff000
 	bgt-	112f
 	lis	r2, (swapper_pg_dir - PAGE_OFFSET)@ha	/* if kernel address, use */
+	li	r1, _PAGE_PRESENT | _PAGE_ACCESSED
 	addi	r2, r2, (swapper_pg_dir - PAGE_OFFSET)@l	/* kernel page table */
 112:	rlwimi	r2,r3,12,20,29		/* insert top 10 bits of address */
 	lwz	r2,0(r2)		/* get pmd entry */
 	lis	r1, TASK_SIZE@h		/* check if kernel address */
 	cmplw	0,r1,r3
 	mfspr	r2, SPRN_SDR1
-	li	r1, _PAGE_RW | _PAGE_DIRTY | _PAGE_PRESENT | _PAGE_ACCESSED
+	li	r1, _PAGE_RW | _PAGE_DIRTY | _PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_USER
 	rlwinm	r2, r2, 28, 0xfffff000
 	bgt-	112f
 	lis	r2, (swapper_pg_dir - PAGE_OFFSET)@ha	/* if kernel address, use */
+	li	r1, _PAGE_RW | _PAGE_DIRTY | _PAGE_PRESENT | _PAGE_ACCESSED
 	addi	r2, r2, (swapper_pg_dir - PAGE_OFFSET)@l	/* kernel page table */
 112:	rlwimi	r2,r3,12,20,29		/* insert top 10 bits of address */
 	lwz	r2,0(r2)		/* get pmd entry */

arch/powerpc/kernel/interrupt.c+1−2

  * enabled when the interrupt handler returns (indicating a process-context /
  * synchronous interrupt) then irqs_enabled should be true.
  */
-static notrace inline bool __prep_irq_for_enabled_exit(bool clear_ri)
+static notrace __always_inline bool __prep_irq_for_enabled_exit(bool clear_ri)
 {
 	/* This must be done with RI=1 because tracing may touch vmaps */
 	trace_hardirqs_on();
 	return ret;
 }
-void unrecoverable_exception(struct pt_regs *regs);
 void preempt_schedule_irq(void);
 notrace unsigned long interrupt_exit_kernel_prepare(struct pt_regs *regs, unsigned long msr)

arch/powerpc/kernel/traps.c+1−1

@@ -2170,7 +2170,7 @@ DEFINE_INTERRUPT_HANDLER(SPEFloatingPointRoundException) · 2169 unmodified lines
2170	* in the MSR is 0. This indicates that SRR0/1 are live, and that	2170	* in the MSR is 0. This indicates that SRR0/1 are live, and that
2171	* we therefore lost state by taking this exception.	2171	* we therefore lost state by taking this exception.
2172	*/	2172	*/
2173	DEFINE_INTERRUPT_HANDLER(unrecoverable_exception)	2173	void unrecoverable_exception(struct pt_regs *regs)
2174	{	2174	{
2175	pr_emerg("Unrecoverable exception %lx at %lx (msr=%lx)\n",	2175	pr_emerg("Unrecoverable exception %lx at %lx (msr=%lx)\n",
2176	regs->trap, regs->nip, regs->msr);	2176	regs->trap, regs->nip, regs->msr);

arch/powerpc/lib/sstep.c+2−2

@@ -904,7 +904,7 @@ static nokprobe_inline int do_vsx_load(struct instruction_op *op, · 903 unmodified lines
904	if (!address_ok(regs, ea, size) \|\| copy_mem_in(mem, ea, size, regs))	904	if (!address_ok(regs, ea, size) \|\| copy_mem_in(mem, ea, size, regs))
905	return -EFAULT;	905	return -EFAULT;
906		906
907	nr_vsx_regs = size / sizeof(__vector128);	907	nr_vsx_regs = max(1ul, size / sizeof(__vector128));
908	emulate_vsx_load(op, buf, mem, cross_endian);	908	emulate_vsx_load(op, buf, mem, cross_endian);
909	preempt_disable();	909	preempt_disable();
910	if (reg < 32) {	910	if (reg < 32) {
@@ -951,7 +951,7 @@ static nokprobe_inline int do_vsx_store(struct instruction_op *op, · 40 unmodified lines
951	if (!address_ok(regs, ea, size))	951	if (!address_ok(regs, ea, size))
952	return -EFAULT;	952	return -EFAULT;
953		953
954	nr_vsx_regs = size / sizeof(__vector128);	954	nr_vsx_regs = max(1ul, size / sizeof(__vector128));
955	preempt_disable();	955	preempt_disable();
956	if (reg < 32) {	956	if (reg < 32) {
957	/* FP regs + extensions */	957	/* FP regs + extensions */

arch/powerpc/perf/core-book3s.c+2−2

@@ -222,7 +222,7 @@ static inline void perf_get_data_addr(struct perf_event event, struct pt_regs · 221 unmodified lines
222	if (!(mmcra & MMCRA_SAMPLE_ENABLE) \|\| sdar_valid)	222	if (!(mmcra & MMCRA_SAMPLE_ENABLE) \|\| sdar_valid)
223	*addrp = mfspr(SPRN_SDAR);	223	*addrp = mfspr(SPRN_SDAR);
224		224
225	if (is_kernel_addr(mfspr(SPRN_SDAR)) && perf_allow_kernel(&event->attr) != 0)	225	if (is_kernel_addr(mfspr(SPRN_SDAR)) && event->attr.exclude_kernel)
226	*addrp = 0;	226	*addrp = 0;
227	}	227	}
228		228
@@ -507,7 +507,7 @@ static void power_pmu_bhrb_read(struct perf_event event, struct cpu_hw_events · 278 unmodified lines
507	* addresses, hence include a check before filtering code	507	* addresses, hence include a check before filtering code
508	*/	508	*/
509	if (!(ppmu->flags & PPMU_ARCH_31) &&	509	if (!(ppmu->flags & PPMU_ARCH_31) &&
510	is_kernel_addr(addr) && perf_allow_kernel(&event->attr) != 0)	510	is_kernel_addr(addr) && event->attr.exclude_kernel)
511	continue;	511	continue;
512		512
513	/* Branches are read most recent first (ie. mfbhrb 0 is	513	/* Branches are read most recent first (ie. mfbhrb 0 is

arch/powerpc/platforms/pseries/msi.c+23−2

@@ -4,6 +4,7 @@ · 3 unmodified lines
4	* Copyright 2006-2007 Michael Ellerman, IBM Corp.	4	* Copyright 2006-2007 Michael Ellerman, IBM Corp.
5	*/	5	*/
6		6
		7	#include <linux/crash_dump.h>
7	#include <linux/device.h>	8	#include <linux/device.h>
8	#include <linux/irq.h>	9	#include <linux/irq.h>
9	#include <linux/msi.h>	10	#include <linux/msi.h>
@@ -458,8 +459,28 @@ again: · 448 unmodified lines
458	return hwirq;	459	return hwirq;
459	}	460	}
460		461
461	virq = irq_create_mapping_affinity(NULL, hwirq,	462	/*
462	entry->affinity);	463	* Depending on the number of online CPUs in the original
		464	* kernel, it is likely for CPU #0 to be offline in a kdump
		465	* kernel. The associated IRQs in the affinity mappings
		466	* provided by irq_create_affinity_masks() are thus not
		467	* started by irq_startup(), as per-design for managed IRQs.
		468	* This can be a problem with multi-queue block devices driven
		469	* by blk-mq : such a non-started IRQ is very likely paired
		470	* with the single queue enforced by blk-mq during kdump (see
		471	* blk_mq_alloc_tag_set()). This causes the device to remain
		472	* silent and likely hangs the guest at some point.
		473	*
		474	* We don't really care for fine-grained affinity when doing
		475	* kdump actually : simply ignore the pre-computed affinity
		476	* masks in this case and let the default mask with all CPUs
		477	* be used when creating the IRQ mappings.
		478	*/
		479	if (is_kdump_kernel())
		480	virq = irq_create_mapping(NULL, hwirq);
		481	else
		482	virq = irq_create_mapping_affinity(NULL, hwirq,
		483	entry->affinity);
463		484
464	if (!virq) {	485	if (!virq) {
465	pr_debug("rtas_msi: Failed mapping hwirq %d\n", hwirq);	486	pr_debug("rtas_msi: Failed mapping hwirq %d\n", hwirq);

arch/powerpc/platforms/pseries/vio.c+3−4

 	struct vio_dev *viodev = to_vio_dev(dev);
 	struct vio_driver *viodrv = to_vio_driver(dev->driver);
 	struct device *devptr;
-	int ret = 1;
 	/*
 	 * Hold a reference to the device after the remove function is called
 	devptr = get_device(dev);
 	if (viodrv->remove)
-		ret = viodrv->remove(viodev);
+		viodrv->remove(viodev);
-	if (!ret && firmware_has_feature(FW_FEATURE_CMO))
+	if (firmware_has_feature(FW_FEATURE_CMO))
 		vio_cmo_bus_remove(viodev);
 	put_device(devptr);
-	return ret;
+	return 0;
 }
 /**

arch/s390/configs/debug_defconfig+3−13

 CONFIG_IP_VS_SH=m
 CONFIG_IP_VS_SED=m
 CONFIG_IP_VS_NQ=m
+CONFIG_IP_VS_TWOS=m
 CONFIG_IP_VS_FTP=m
 CONFIG_IP_VS_PE_SIP=m
-CONFIG_NF_TABLES_IPV4=y
 CONFIG_NFT_FIB_IPV4=m
 CONFIG_NF_TABLES_ARP=y
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NF_TABLES_IPV6=y
 CONFIG_NFT_FIB_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 # CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_VENDOR_ATHEROS is not set
-# CONFIG_NET_VENDOR_AURORA is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
 # CONFIG_NET_VENDOR_BROCADE is not set
 # CONFIG_NET_VENDOR_CADENCE is not set
 CONFIG_VIRTIO_INPUT=y
 CONFIG_VHOST_NET=m
 CONFIG_VHOST_VSOCK=m
-# CONFIG_SURFACE_PLATFORMS is not set
 CONFIG_S390_CCW_IOMMU=y
 CONFIG_S390_AP_IOMMU=y
 CONFIG_EXT4_FS=y
 CONFIG_PROC_KCORE=y
 CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_TMPFS_INODE64=y
 CONFIG_HUGETLBFS=y
 CONFIG_CONFIGFS_FS=m
 CONFIG_ECRYPT_FS=m
 CONFIG_CRYPTO_CRC32=m
 CONFIG_CRYPTO_BLAKE2S=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
-CONFIG_CRYPTO_RMD128=m
 CONFIG_CRYPTO_RMD160=m
-CONFIG_CRYPTO_RMD256=m
-CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA3=m
-CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_DES=m
 CONFIG_CRYPTO_FCRYPT=m
 CONFIG_CRYPTO_KHAZAD=m
-CONFIG_CRYPTO_SALSA20=m
 CONFIG_CRYPTO_SEED=m
 CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_SM4=m
 CONFIG_DEBUG_OBJECTS_PERCPU_COUNTER=y
 CONFIG_SLUB_DEBUG_ON=y
 CONFIG_SLUB_STATS=y
-CONFIG_DEBUG_KMEMLEAK=y
-CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF=y
 CONFIG_DEBUG_STACK_USAGE=y
 CONFIG_DEBUG_VM=y
 CONFIG_DEBUG_VM_VMACACHE=y
-CONFIG_DEBUG_VM_RB=y
 CONFIG_DEBUG_VM_PGFLAGS=y
 CONFIG_DEBUG_MEMORY_INIT=y
 CONFIG_MEMORY_NOTIFIER_ERROR_INJECT=m
 CONFIG_HIST_TRIGGERS=y
 CONFIG_FTRACE_STARTUP_TEST=y
 # CONFIG_EVENT_TRACE_STARTUP_TEST is not set
+CONFIG_DEBUG_ENTRY=y
 CONFIG_NOTIFIER_ERROR_INJECTION=m
 CONFIG_NETDEV_NOTIFIER_ERROR_INJECT=m
 CONFIG_FAULT_INJECTION=y
 CONFIG_ATOMIC64_SELFTEST=y
 CONFIG_TEST_BITOPS=m
 CONFIG_TEST_BPF=m
-CONFIG_DEBUG_ENTRY=y

arch/s390/configs/defconfig+2−9

 CONFIG_IP_VS_SH=m
 CONFIG_IP_VS_SED=m
 CONFIG_IP_VS_NQ=m
+CONFIG_IP_VS_TWOS=m
 CONFIG_IP_VS_FTP=m
 CONFIG_IP_VS_PE_SIP=m
-CONFIG_NF_TABLES_IPV4=y
 CONFIG_NFT_FIB_IPV4=m
 CONFIG_NF_TABLES_ARP=y
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NF_TABLES_IPV6=y
 CONFIG_NFT_FIB_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 # CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_VENDOR_ATHEROS is not set
-# CONFIG_NET_VENDOR_AURORA is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
 # CONFIG_NET_VENDOR_BROCADE is not set
 # CONFIG_NET_VENDOR_CADENCE is not set
 CONFIG_VIRTIO_INPUT=y
 CONFIG_VHOST_NET=m
 CONFIG_VHOST_VSOCK=m
-# CONFIG_SURFACE_PLATFORMS is not set
 CONFIG_S390_CCW_IOMMU=y
 CONFIG_S390_AP_IOMMU=y
 CONFIG_EXT4_FS=y
 CONFIG_PROC_KCORE=y
 CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_TMPFS_INODE64=y
 CONFIG_HUGETLBFS=y
 CONFIG_CONFIGFS_FS=m
 CONFIG_ECRYPT_FS=m
 CONFIG_CRYPTO_CRC32=m
 CONFIG_CRYPTO_BLAKE2S=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
-CONFIG_CRYPTO_RMD128=m
 CONFIG_CRYPTO_RMD160=m
-CONFIG_CRYPTO_RMD256=m
-CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA3=m
-CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_DES=m
 CONFIG_CRYPTO_FCRYPT=m
 CONFIG_CRYPTO_KHAZAD=m
-CONFIG_CRYPTO_SALSA20=m
 CONFIG_CRYPTO_SEED=m
 CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_SM4=m

arch/s390/configs/zfcpdump_defconfig+0−3

 # CONFIG_SECCOMP is not set
 # CONFIG_GCC_PLUGINS is not set
 CONFIG_PARTITION_ADVANCED=y
-CONFIG_IBM_PARTITION=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 # CONFIG_COMPACTION is not set
 # CONFIG_MIGRATION is not set
 # CONFIG_HID is not set
 # CONFIG_VIRTIO_MENU is not set
 # CONFIG_VHOST_MENU is not set
-# CONFIG_SURFACE_PLATFORMS is not set
 # CONFIG_IOMMU_SUPPORT is not set
 # CONFIG_DNOTIFY is not set
 # CONFIG_INOTIFY_USER is not set
-CONFIG_CONFIGFS_FS=y
 # CONFIG_MISC_FILESYSTEMS is not set
 # CONFIG_NETWORK_FILESYSTEMS is not set
 CONFIG_LSM="yama,loadpin,safesetid,integrity"

arch/s390/include/asm/idle.h+6−6

@@ -14,12 +14,12 @@ · 13 unmodified lines
14		14
15	struct s390_idle_data {	15	struct s390_idle_data {
16	seqcount_t seqcount;	16	seqcount_t seqcount;
17	unsigned long long idle_count;	17	unsigned long idle_count;
18	unsigned long long idle_time;	18	unsigned long idle_time;
19	unsigned long long clock_idle_enter;	19	unsigned long clock_idle_enter;
20	unsigned long long clock_idle_exit;	20	unsigned long clock_idle_exit;
21	unsigned long long timer_idle_enter;	21	unsigned long timer_idle_enter;
22	unsigned long long timer_idle_exit;	22	unsigned long timer_idle_exit;
23	unsigned long mt_cycles_enter[8];	23	unsigned long mt_cycles_enter[8];
24	};	24	};
25		25

arch/s390/include/asm/timex.h+18−18

@@ -98,10 +98,10 @@ extern unsigned char ptff_function_mask[16]; · 97 unmodified lines
98		98
99	/* Query TOD offset result */	99	/* Query TOD offset result */
100	struct ptff_qto {	100	struct ptff_qto {
101	unsigned long long physical_clock;	101	unsigned long physical_clock;
102	unsigned long long tod_offset;	102	unsigned long tod_offset;
103	unsigned long long logical_tod_offset;	103	unsigned long logical_tod_offset;
104	unsigned long long tod_epoch_difference;	104	unsigned long tod_epoch_difference;
105	} __packed;	105	} __packed;
106		106
107	static inline int ptff_query(unsigned int nr)	107	static inline int ptff_query(unsigned int nr)
@@ -151,9 +151,9 @@ struct ptff_qui { · 43 unmodified lines
151	rc; \	151	rc; \
152	})	152	})
153		153
154	static inline unsigned long long local_tick_disable(void)	154	static inline unsigned long local_tick_disable(void)
155	{	155	{
156	unsigned long long old;	156	unsigned long old;
157		157
158	old = S390_lowcore.clock_comparator;	158	old = S390_lowcore.clock_comparator;
159	S390_lowcore.clock_comparator = clock_comparator_max;	159	S390_lowcore.clock_comparator = clock_comparator_max;
@@ -161,7 +161,7 @@ static inline unsigned long long local_tick_disable(void) · 1 unmodified line
161	return old;	161	return old;
162	}	162	}
163		163
164	static inline void local_tick_enable(unsigned long long comp)	164	static inline void local_tick_enable(unsigned long comp)
165	{	165	{
166	S390_lowcore.clock_comparator = comp;	166	S390_lowcore.clock_comparator = comp;
167	set_clock_comparator(S390_lowcore.clock_comparator);	167	set_clock_comparator(S390_lowcore.clock_comparator);
@@ -169,9 +169,9 @@ static inline void local_tick_enable(unsigned long long comp) · 1 unmodified line
169		169
170	#define CLOCK_TICK_RATE 1193180 /* Underlying HZ */	170	#define CLOCK_TICK_RATE 1193180 /* Underlying HZ */
171		171
172	typedef unsigned long long cycles_t;	172	typedef unsigned long cycles_t;
173		173
174	static inline unsigned long long get_tod_clock(void)	174	static inline unsigned long get_tod_clock(void)
175	{	175	{
176	union tod_clock clk;	176	union tod_clock clk;
177		177
@@ -179,10 +179,10 @@ static inline unsigned long long get_tod_clock(void) · 1 unmodified line
179	return clk.tod;	179	return clk.tod;
180	}	180	}
181		181
182	static inline unsigned long long get_tod_clock_fast(void)	182	static inline unsigned long get_tod_clock_fast(void)
183	{	183	{
184	#ifdef CONFIG_HAVE_MARCH_Z9_109_FEATURES	184	#ifdef CONFIG_HAVE_MARCH_Z9_109_FEATURES
185	unsigned long long clk;	185	unsigned long clk;
186		186
187	asm volatile("stckf %0" : "=Q" (clk) : : "cc");	187	asm volatile("stckf %0" : "=Q" (clk) : : "cc");
188	return clk;	188	return clk;
@@ -208,9 +208,9 @@ extern union tod_clock tod_clock_base; · 19 unmodified lines
208	* Therefore preemption must be disabled, otherwise the returned	208	* Therefore preemption must be disabled, otherwise the returned
209	* value is not guaranteed to be monotonic.	209	* value is not guaranteed to be monotonic.
210	*/	210	*/
211	static inline unsigned long long get_tod_clock_monotonic(void)	211	static inline unsigned long get_tod_clock_monotonic(void)
212	{	212	{
213	unsigned long long tod;	213	unsigned long tod;
214		214
215	preempt_disable_notrace();	215	preempt_disable_notrace();
216	tod = get_tod_clock() - tod_clock_base.tod;	216	tod = get_tod_clock() - tod_clock_base.tod;
@@ -237,7 +237,7 @@ static inline unsigned long long get_tod_clock_monotonic(void) · 20 unmodified lines
237	* -> ns = (th * 125) + ((tl * 125) >> 9);	237	* -> ns = (th * 125) + ((tl * 125) >> 9);
238	*	238	*
239	*/	239	*/
240	static inline unsigned long long tod_to_ns(unsigned long long todval)	240	static inline unsigned long tod_to_ns(unsigned long todval)
241	{	241	{
242	return ((todval >> 9) * 125) + (((todval & 0x1ff) * 125) >> 9);	242	return ((todval >> 9) * 125) + (((todval & 0x1ff) * 125) >> 9);
243	}	243	}
@@ -249,10 +249,10 @@ static inline unsigned long long tod_to_ns(unsigned long long todval) · 5 unmodified lines
249	*	249	*
250	* Returns: true if a is later than b	250	* Returns: true if a is later than b
251	*/	251	*/
252	static inline int tod_after(unsigned long long a, unsigned long long b)	252	static inline int tod_after(unsigned long a, unsigned long b)
253	{	253	{
254	if (MACHINE_HAS_SCC)	254	if (MACHINE_HAS_SCC)
255	return (long long) a > (long long) b;	255	return (long) a > (long) b;
256	return a > b;	256	return a > b;
257	}	257	}
258		258
@@ -263,10 +263,10 @@ static inline int tod_after(unsigned long long a, unsigned long long b) · 4 unmodified lines
263	*	263	*
264	* Returns: true if a is later than b	264	* Returns: true if a is later than b
265	*/	265	*/
266	static inline int tod_after_eq(unsigned long long a, unsigned long long b)	266	static inline int tod_after_eq(unsigned long a, unsigned long b)
267	{	267	{
268	if (MACHINE_HAS_SCC)	268	if (MACHINE_HAS_SCC)
269	return (long long) a >= (long long) b;	269	return (long) a >= (long) b;
270	return a >= b;	270	return a >= b;
271	}	271	}
272		272

arch/s390/include/uapi/asm/hwctrset.hrenamed from arch/s390/include/uapi/asm/perf_cpum_cf_diag.h+0−0

File renamed without changes.

arch/s390/kernel/idle.c+6−6

@@ -47,7 +47,7 @@ void account_idle_time_irq(void) · 46 unmodified lines
47	void arch_cpu_idle(void)	47	void arch_cpu_idle(void)
48	{	48	{
49	struct s390_idle_data *idle = this_cpu_ptr(&s390_idle);	49	struct s390_idle_data *idle = this_cpu_ptr(&s390_idle);
50	unsigned long long idle_time;	50	unsigned long idle_time;
51	unsigned long psw_mask;	51	unsigned long psw_mask;
52		52
53	/* Wait for external, I/O or machine check interrupt. */	53	/* Wait for external, I/O or machine check interrupt. */
@@ -73,7 +73,7 @@ static ssize_t show_idle_count(struct device *dev, · 19 unmodified lines
73	struct device_attribute attr, char buf)	73	struct device_attribute attr, char buf)
74	{	74	{
75	struct s390_idle_data *idle = &per_cpu(s390_idle, dev->id);	75	struct s390_idle_data *idle = &per_cpu(s390_idle, dev->id);
76	unsigned long long idle_count;	76	unsigned long idle_count;
77	unsigned int seq;	77	unsigned int seq;
78		78
79	do {	79	do {
@@ -82,14 +82,14 @@ static ssize_t show_idle_count(struct device *dev, · 2 unmodified lines
82	if (READ_ONCE(idle->clock_idle_enter))	82	if (READ_ONCE(idle->clock_idle_enter))
83	idle_count++;	83	idle_count++;
84	} while (read_seqcount_retry(&idle->seqcount, seq));	84	} while (read_seqcount_retry(&idle->seqcount, seq));
85	return sprintf(buf, "%llu\n", idle_count);	85	return sprintf(buf, "%lu\n", idle_count);
86	}	86	}
87	DEVICE_ATTR(idle_count, 0444, show_idle_count, NULL);	87	DEVICE_ATTR(idle_count, 0444, show_idle_count, NULL);
88		88
89	static ssize_t show_idle_time(struct device *dev,	89	static ssize_t show_idle_time(struct device *dev,
90	struct device_attribute attr, char buf)	90	struct device_attribute attr, char buf)
91	{	91	{
92	unsigned long long now, idle_time, idle_enter, idle_exit, in_idle;	92	unsigned long now, idle_time, idle_enter, idle_exit, in_idle;
93	struct s390_idle_data *idle = &per_cpu(s390_idle, dev->id);	93	struct s390_idle_data *idle = &per_cpu(s390_idle, dev->id);
94	unsigned int seq;	94	unsigned int seq;
95		95
@@ -109,14 +109,14 @@ static ssize_t show_idle_time(struct device *dev, · 13 unmodified lines
109	}	109	}
110	}	110	}
111	idle_time += in_idle;	111	idle_time += in_idle;
112	return sprintf(buf, "%llu\n", idle_time >> 12);	112	return sprintf(buf, "%lu\n", idle_time >> 12);
113	}	113	}
114	DEVICE_ATTR(idle_time_us, 0444, show_idle_time, NULL);	114	DEVICE_ATTR(idle_time_us, 0444, show_idle_time, NULL);
115		115
116	u64 arch_cpu_idle_time(int cpu)	116	u64 arch_cpu_idle_time(int cpu)
117	{	117	{
118	struct s390_idle_data *idle = &per_cpu(s390_idle, cpu);	118	struct s390_idle_data *idle = &per_cpu(s390_idle, cpu);
119	unsigned long long now, idle_enter, idle_exit, in_idle;	119	unsigned long now, idle_enter, idle_exit, in_idle;
120	unsigned int seq;	120	unsigned int seq;
121		121
122	do {	122	do {

arch/s390/kernel/perf_cpum_cf.c+1−1

@@ -269,7 +269,7 @@ static int __hw_perf_event_init(struct perf_event *event, unsigned int type) · 268 unmodified lines
269	case CPUMF_CTR_SET_MAX:	269	case CPUMF_CTR_SET_MAX:
270	/* The counter could not be associated to a counter set */	270	/* The counter could not be associated to a counter set */
271	return -EINVAL;	271	return -EINVAL;
272	};	272	}
273		273
274	/* Initialize for using the CPU-measurement counter facility */	274	/* Initialize for using the CPU-measurement counter facility */
275	if (!atomic_inc_not_zero(&num_events)) {	275	if (!atomic_inc_not_zero(&num_events)) {

arch/s390/kernel/perf_cpum_cf_diag.c+3−17

@@ -26,12 +26,10 @@ · 25 unmodified lines
26	#include <asm/timex.h>	26	#include <asm/timex.h>
27	#include <asm/debug.h>	27	#include <asm/debug.h>
28		28
29	#include <asm/perf_cpum_cf_diag.h>	29	#include <asm/hwctrset.h>
30		30
31	#define CF_DIAG_CTRSET_DEF 0xfeef /* Counter set header mark */	31	#define CF_DIAG_CTRSET_DEF 0xfeef /* Counter set header mark */
32	#define CF_DIAG_MIN_INTERVAL 60 /* Minimum counter set read */
33	/* interval in seconds */	32	/* interval in seconds */
34	static unsigned long cf_diag_interval = CF_DIAG_MIN_INTERVAL;
35	static unsigned int cf_diag_cpu_speed;	33	static unsigned int cf_diag_cpu_speed;
36	static debug_info_t *cf_diag_dbg;	34	static debug_info_t *cf_diag_dbg;
37		35
@@ -729,7 +727,6 @@ static DEFINE_MUTEX(cf_diag_ctrset_mutex); · 691 unmodified lines
729	static struct cf_diag_ctrset {	727	static struct cf_diag_ctrset {
730	unsigned long ctrset; /* Bit mask of counter set to read */	728	unsigned long ctrset; /* Bit mask of counter set to read */
731	cpumask_t mask; /* CPU mask to read from */	729	cpumask_t mask; /* CPU mask to read from */
732	time64_t lastread; /* Epoch counter set last read */
733	} cf_diag_ctrset;	730	} cf_diag_ctrset;
734		731
735	static void cf_diag_ctrset_clear(void)	732	static void cf_diag_ctrset_clear(void)
@@ -866,27 +863,16 @@ static int cf_diag_all_read(unsigned long arg) · 130 unmodified lines
866	{	863	{
867	struct cf_diag_call_on_cpu_parm p;	864	struct cf_diag_call_on_cpu_parm p;
868	cpumask_var_t mask;	865	cpumask_var_t mask;
869	time64_t now;	866	int rc;
870	int rc = 0;
871		867
872	debug_sprintf_event(cf_diag_dbg, 5, "%s\n", __func__);	868	debug_sprintf_event(cf_diag_dbg, 5, "%s\n", __func__);
873	if (!alloc_cpumask_var(&mask, GFP_KERNEL))	869	if (!alloc_cpumask_var(&mask, GFP_KERNEL))
874	return -ENOMEM;	870	return -ENOMEM;
875	now = ktime_get_seconds();	871
876	if (cf_diag_ctrset.lastread + cf_diag_interval > now) {
877	debug_sprintf_event(cf_diag_dbg, 5, "%s now %lld "
878	" lastread %lld\n", __func__, now,
879	cf_diag_ctrset.lastread);
880	rc = -EAGAIN;
881	goto out;
882	} else {
883	cf_diag_ctrset.lastread = now;
884	}
885	p.sets = cf_diag_ctrset.ctrset;	872	p.sets = cf_diag_ctrset.ctrset;
886	cpumask_and(mask, &cf_diag_ctrset.mask, cpu_online_mask);	873	cpumask_and(mask, &cf_diag_ctrset.mask, cpu_online_mask);
887	on_each_cpu_mask(mask, cf_diag_cpu_read, &p, 1);	874	on_each_cpu_mask(mask, cf_diag_cpu_read, &p, 1);
888	rc = cf_diag_all_copy(arg, mask);	875	rc = cf_diag_all_copy(arg, mask);
889	out:
890	free_cpumask_var(mask);	876	free_cpumask_var(mask);
891	debug_sprintf_event(cf_diag_dbg, 5, "%s rc %d\n", __func__, rc);	877	debug_sprintf_event(cf_diag_dbg, 5, "%s rc %d\n", __func__, rc);
892	return rc;	878	return rc;

arch/s390/kernel/time.c+14−14

@@ -68,10 +68,10 @@ EXPORT_SYMBOL(s390_epoch_delta_notifier); · 67 unmodified lines
68		68
69	unsigned char ptff_function_mask[16];	69	unsigned char ptff_function_mask[16];
70		70
71	static unsigned long long lpar_offset;	71	static unsigned long lpar_offset;
72	static unsigned long long initial_leap_seconds;	72	static unsigned long initial_leap_seconds;
73	static unsigned long long tod_steering_end;	73	static unsigned long tod_steering_end;
74	static long long tod_steering_delta;	74	static long tod_steering_delta;
75		75
76	/*	76	/*
77	* Get time offsets with PTFF	77	* Get time offsets with PTFF
@@ -96,7 +96,7 @@ void __init time_early_init(void) · 18 unmodified lines
96		96
97	/* get initial leap seconds */	97	/* get initial leap seconds */
98	if (ptff_query(PTFF_QUI) && ptff(&qui, sizeof(qui), PTFF_QUI) == 0)	98	if (ptff_query(PTFF_QUI) && ptff(&qui, sizeof(qui), PTFF_QUI) == 0)
99	initial_leap_seconds = (unsigned long long)	99	initial_leap_seconds = (unsigned long)
100	((long) qui.old_leap * 4096000000L);	100	((long) qui.old_leap * 4096000000L);
101	}	101	}
102		102
@@ -222,7 +222,7 @@ void __init read_persistent_wall_and_boot_offset(struct timespec64 *wall_time, · 119 unmodified lines
222		222
223	static u64 read_tod_clock(struct clocksource *cs)	223	static u64 read_tod_clock(struct clocksource *cs)
224	{	224	{
225	unsigned long long now, adj;	225	unsigned long now, adj;
226		226
227	preempt_disable(); /* protect from changes to steering parameters */	227	preempt_disable(); /* protect from changes to steering parameters */
228	now = get_tod_clock();	228	now = get_tod_clock();
@@ -362,7 +362,7 @@ static inline int check_sync_clock(void) · 133 unmodified lines
362	* Apply clock delta to the global data structures.	362	* Apply clock delta to the global data structures.
363	* This is called once on the CPU that performed the clock sync.	363	* This is called once on the CPU that performed the clock sync.
364	*/	364	*/
365	static void clock_sync_global(unsigned long long delta)	365	static void clock_sync_global(unsigned long delta)
366	{	366	{
367	unsigned long now, adj;	367	unsigned long now, adj;
368	struct ptff_qto qto;	368	struct ptff_qto qto;
@@ -378,7 +378,7 @@ static void clock_sync_global(unsigned long long delta) · 9 unmodified lines
378	-(adj >> 15) : (adj >> 15);	378	-(adj >> 15) : (adj >> 15);
379	tod_steering_delta += delta;	379	tod_steering_delta += delta;
380	if ((abs(tod_steering_delta) >> 48) != 0)	380	if ((abs(tod_steering_delta) >> 48) != 0)
381	panic("TOD clock sync offset %lli is too large to drift\n",	381	panic("TOD clock sync offset %li is too large to drift\n",
382	tod_steering_delta);	382	tod_steering_delta);
383	tod_steering_end = now + (abs(tod_steering_delta) << 15);	383	tod_steering_end = now + (abs(tod_steering_delta) << 15);
384	vdso_data->arch_data.tod_steering_end = tod_steering_end;	384	vdso_data->arch_data.tod_steering_end = tod_steering_end;
@@ -394,7 +394,7 @@ static void clock_sync_global(unsigned long long delta) · 9 unmodified lines
394	* Apply clock delta to the per-CPU data structures of this CPU.	394	* Apply clock delta to the per-CPU data structures of this CPU.
395	* This is called for each online CPU after the call to clock_sync_global.	395	* This is called for each online CPU after the call to clock_sync_global.
396	*/	396	*/
397	static void clock_sync_local(unsigned long long delta)	397	static void clock_sync_local(unsigned long delta)
398	{	398	{
399	/* Add the delta to the clock comparator. */	399	/* Add the delta to the clock comparator. */
400	if (S390_lowcore.clock_comparator != clock_comparator_max) {	400	if (S390_lowcore.clock_comparator != clock_comparator_max) {
@@ -418,7 +418,7 @@ static void __init time_init_wq(void) · 17 unmodified lines
418	struct clock_sync_data {	418	struct clock_sync_data {
419	atomic_t cpus;	419	atomic_t cpus;
420	int in_sync;	420	int in_sync;
421	unsigned long long clock_delta;	421	unsigned long clock_delta;
422	};	422	};
423		423
424	/*	424	/*
@@ -538,7 +538,7 @@ static int stpinfo_valid(void) · 113 unmodified lines
538	static int stp_sync_clock(void *data)	538	static int stp_sync_clock(void *data)
539	{	539	{
540	struct clock_sync_data *sync = data;	540	struct clock_sync_data *sync = data;
541	unsigned long long clock_delta, flags;	541	u64 clock_delta, flags;
542	static int first;	542	static int first;
543	int rc;	543	int rc;
544		544
@@ -720,8 +720,8 @@ static ssize_t ctn_id_show(struct device *dev, · 175 unmodified lines
720		720
721	mutex_lock(&stp_mutex);	721	mutex_lock(&stp_mutex);
722	if (stpinfo_valid())	722	if (stpinfo_valid())
723	ret = sprintf(buf, "%016llx\n",	723	ret = sprintf(buf, "%016lx\n",
724	(unsigned long long ) stp_info.ctnid);	724	(unsigned long ) stp_info.ctnid);
725	mutex_unlock(&stp_mutex);	725	mutex_unlock(&stp_mutex);
726	return ret;	726	return ret;
727	}	727	}
@@ -794,7 +794,7 @@ static ssize_t leap_seconds_scheduled_show(struct device *dev, · 66 unmodified lines
794	if (!stzi.lsoib.p)	794	if (!stzi.lsoib.p)
795	return sprintf(buf, "0,0\n");	795	return sprintf(buf, "0,0\n");
796		796
797	return sprintf(buf, "%llu,%d\n",	797	return sprintf(buf, "%lu,%d\n",
798	tod_to_ns(stzi.lsoib.nlsout - TOD_UNIX_EPOCH) / NSEC_PER_SEC,	798	tod_to_ns(stzi.lsoib.nlsout - TOD_UNIX_EPOCH) / NSEC_PER_SEC,
799	stzi.lsoib.nlso - stzi.lsoib.also);	799	stzi.lsoib.nlso - stzi.lsoib.also);
800	}	800	}

arch/s390/kernel/topology.c+0−2

 			}
 			info = info->next;
 		}
-		if (cpumask_empty(&mask))
-			cpumask_copy(&mask, cpumask_of(cpu));
 		break;
 	case TOPOLOGY_MODE_PACKAGE:
 		cpumask_copy(&mask, cpu_present_mask);

arch/s390/kvm/interrupt.c+1−1

@@ -1287,7 +1287,7 @@ static u64 __calculate_sltime(struct kvm_vcpu *vcpu) · 1286 unmodified lines
1287	/* already expired? */	1287	/* already expired? */
1288	if (cputm >> 63)	1288	if (cputm >> 63)
1289	return 0;	1289	return 0;
1290	return min(sltime, tod_to_ns(cputm));	1290	return min_t(u64, sltime, tod_to_ns(cputm));
1291	}	1291	}
1292	} else if (cpu_timer_interrupts_enabled(vcpu)) {	1292	} else if (cpu_timer_interrupts_enabled(vcpu)) {
1293	sltime = kvm_s390_get_cpu_timer(vcpu);	1293	sltime = kvm_s390_get_cpu_timer(vcpu);

arch/sparc/configs/sparc64_defconfig+1−3

 CONFIG_NET_ETHERNET=y
 CONFIG_MII=m
 CONFIG_SUNLANCE=m
-CONFIG_HAPPYMEAL=m
+CONFIG_HAPPYMEAL=y
 CONFIG_SUNGEM=m
 CONFIG_SUNVNET=m
 CONFIG_LDMVSW=m
 CONFIG_CRC16=m
 CONFIG_LIBCRC32C=m
 CONFIG_VCC=m
-CONFIG_ATA=y
 CONFIG_PATA_CMD64X=y
-CONFIG_HAPPYMEAL=y
 CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
 CONFIG_DEVTMPFS=y

arch/sparc/include/asm/elf_64.h+0−1

@@ -8,7 +8,6 @@ · 7 unmodified lines
8		8
9	#include <asm/ptrace.h>	9	#include <asm/ptrace.h>
10	#include <asm/processor.h>	10	#include <asm/processor.h>
11	#include <asm/extable_64.h>
12	#include <asm/spitfire.h>	11	#include <asm/spitfire.h>
13	#include <asm/adi.h>	12	#include <asm/adi.h>
14		13

arch/sparc/include/asm/extable.hrenamed from arch/sparc/include/asm/extable_64.h+2−2

@@ -1,6 +1,6 @@
1	/* SPDX-License-Identifier: GPL-2.0 */	1	/* SPDX-License-Identifier: GPL-2.0 */
2	#ifndef __ASM_EXTABLE64_H	2	#ifndef __ASM_EXTABLE_H
3	#define __ASM_EXTABLE64_H	3	#define __ASM_EXTABLE_H
4	/*	4	/*
5	* The exception table consists of pairs of addresses: the first is the	5	* The exception table consists of pairs of addresses: the first is the
6	* address of an instruction that is allowed to fault, and the second is	6	* address of an instruction that is allowed to fault, and the second is

arch/sparc/include/asm/processor_32.h+1−5

 	unsigned long   fsr;
 	unsigned long   fpqdepth;
 	struct fpq	fpqueue[16];
-	unsigned long flags;
 	mm_segment_t current_ds;
 };
-#define SPARC_FLAG_KTHREAD      0x1    /* task is a kernel thread */
-#define SPARC_FLAG_UNALIGNED    0x2    /* is allowed to do unaligned accesses */
 #define INIT_THREAD  { \
-	.flags = SPARC_FLAG_KTHREAD, \
 	.current_ds = KERNEL_DS, \
+	.kregs = (struct pt_regs *)(init_stack+THREAD_SIZE)-1 \
 }
 /* Do necessary setup to start up a newly executed thread. */

arch/sparc/include/asm/thread_info_64.h+1−0

@@ -118,6 +118,7 @@ struct thread_info { · 117 unmodified lines
118	.task = &tsk, \	118	.task = &tsk, \
119	.current_ds = ASI_P, \	119	.current_ds = ASI_P, \
120	.preempt_count = INIT_PREEMPT_COUNT, \	120	.preempt_count = INIT_PREEMPT_COUNT, \
		121	.kregs = (struct pt_regs *)(init_stack+THREAD_SIZE)-1 \
121	}	122	}
122		123
123	/* how to get the thread information struct from C */	124	/* how to get the thread information struct from C */

arch/sparc/include/asm/uaccess.h+3−0

@@ -1,6 +1,9 @@
1	/* SPDX-License-Identifier: GPL-2.0 */	1	/* SPDX-License-Identifier: GPL-2.0 */
2	#ifndef ___ASM_SPARC_UACCESS_H	2	#ifndef ___ASM_SPARC_UACCESS_H
3	#define ___ASM_SPARC_UACCESS_H	3	#define ___ASM_SPARC_UACCESS_H
		4
		5	#include <asm/extable.h>
		6
4	#if defined(__sparc__) && defined(__arch64__)	7	#if defined(__sparc__) && defined(__arch64__)
5	#include <asm/uaccess_64.h>	8	#include <asm/uaccess_64.h>
6	#else	9	#else

arch/sparc/include/asm/uaccess_32.h+0−38

@@ -13,9 +13,6 @@ · 12 unmodified lines
13		13
14	#include <asm/processor.h>	14	#include <asm/processor.h>
15		15
16	#define ARCH_HAS_SORT_EXTABLE
17	#define ARCH_HAS_SEARCH_EXTABLE
18
19	/* Sparc is not segmented, however we need to be able to fool access_ok()	16	/* Sparc is not segmented, however we need to be able to fool access_ok()
20	* when doing system calls from kernel mode legitimately.	17	* when doing system calls from kernel mode legitimately.
21	*	18	*
@@ -40,36 +37,6 @@ · 18 unmodified lines
40	#define __access_ok(addr, size) (__user_ok((addr) & get_fs().seg, (size)))	37	#define __access_ok(addr, size) (__user_ok((addr) & get_fs().seg, (size)))
41	#define access_ok(addr, size) __access_ok((unsigned long)(addr), size)	38	#define access_ok(addr, size) __access_ok((unsigned long)(addr), size)
42		39
43	/*
44	* The exception table consists of pairs of addresses: the first is the
45	* address of an instruction that is allowed to fault, and the second is
46	* the address at which the program should continue. No registers are
47	* modified, so it is entirely up to the continuation code to figure out
48	* what to do.
49	*
50	* All the routines below use bits of fixup code that are out of line
51	* with the main instruction path. This means when everything is well,
52	* we don't even have to jump over them. Further, they do not intrude
53	* on our cache or tlb entries.
54	*
55	* There is a special way how to put a range of potentially faulting
56	* insns (like twenty ldd/std's with now intervening other instructions)
57	* You specify address of first in insn and 0 in fixup and in the next
58	* exception_table_entry you specify last potentially faulting insn + 1
59	* and in fixup the routine which should handle the fault.
60	* That fixup code will get
61	* (faulting_insn_address - first_insn_in_the_range_address)/4
62	* in %g2 (ie. index of the faulting instruction in the range).
63	*/
64
65	struct exception_table_entry
66	{
67	unsigned long insn, fixup;
68	};
69
70	/* Returns 0 if exception not found and fixup otherwise. */
71	unsigned long search_extables_range(unsigned long addr, unsigned long *g2);
72
73	/* Uh, these should become the main single-value transfer routines..	40	/* Uh, these should become the main single-value transfer routines..
74	* They automatically use the right size if we just have the right	41	* They automatically use the right size if we just have the right
75	* pointer type..	42	* pointer type..
@@ -252,12 +219,7 @@ static inline unsigned long __clear_user(void __user *addr, unsigned long size) · 176 unmodified lines
252	unsigned long ret;	219	unsigned long ret;
253		220
254	__asm__ __volatile__ (	221	__asm__ __volatile__ (
255	".section __ex_table,#alloc\n\t"
256	".align 4\n\t"
257	".word 1f,3\n\t"
258	".previous\n\t"
259	"mov %2, %%o1\n"	222	"mov %2, %%o1\n"
260	"1:\n\t"
261	"call __bzero\n\t"	223	"call __bzero\n\t"
262	" mov %1, %%o0\n\t"	224	" mov %1, %%o0\n\t"
263	"mov %%o0, %0\n"	225	"mov %%o0, %0\n"

arch/sparc/include/asm/uaccess_64.h+0−1

@@ -10,7 +10,6 @@ · 9 unmodified lines
10	#include <linux/string.h>	10	#include <linux/string.h>
11	#include <asm/asi.h>	11	#include <asm/asi.h>
12	#include <asm/spitfire.h>	12	#include <asm/spitfire.h>
13	#include <asm/extable_64.h>
14		13
15	#include <asm/processor.h>	14	#include <asm/processor.h>
16		15

arch/sparc/kernel/head_32.S+1−1

@@ -515,7 +515,7 @@ continue_boot: · 514 unmodified lines
515		515
516	/* I want a kernel stack NOW! */	516	/* I want a kernel stack NOW! */
517	set init_thread_union, %g1	517	set init_thread_union, %g1
518	set (THREAD_SIZE - STACKFRAME_SZ), %g2	518	set (THREAD_SIZE - STACKFRAME_SZ - TRACEREG_SZ), %g2
519	add %g1, %g2, %sp	519	add %g1, %g2, %sp
520	mov 0, %fp /* And for good luck */	520	mov 0, %fp /* And for good luck */
521		521

arch/sparc/kernel/head_64.S+1−1

@@ -706,7 +706,7 @@ tlb_fixup_done: · 705 unmodified lines
706	wr %g0, ASI_P, %asi	706	wr %g0, ASI_P, %asi
707	mov 1, %g1	707	mov 1, %g1
708	sllx %g1, THREAD_SHIFT, %g1	708	sllx %g1, THREAD_SHIFT, %g1
709	sub %g1, (STACKFRAME_SZ + STACK_BIAS), %g1	709	sub %g1, (STACKFRAME_SZ + STACK_BIAS + TRACEREG_SZ), %g1
710	add %g6, %g1, %sp	710	add %g6, %g1, %sp
711		711
712	/* Set per-cpu pointer initially to zero, this makes	712	/* Set per-cpu pointer initially to zero, this makes

arch/sparc/kernel/process_32.c+0−12

 		clear_thread_flag(TIF_USEDFPU);
 #endif
 	}
-	/* This task is no longer a kernel thread. */
-	if (current->thread.flags & SPARC_FLAG_KTHREAD) {
-		current->thread.flags &= ~SPARC_FLAG_KTHREAD;
-		/* We must fixup kregs as well. */
-		/* XXX This was not fixed for ti for a while, worked. Unused? */
-		current->thread.kregs = (struct pt_regs *)
-		    (task_stack_page(current) + (THREAD_SIZE - TRACEREG_SZ));
-	}
 }
 static inline struct sparc_stackf __user *
 		extern int nwindows;
 		unsigned long psr;
 		memset(new_stack, 0, STACKFRAME_SZ + TRACEREG_SZ);
-		p->thread.flags |= SPARC_FLAG_KTHREAD;
 		p->thread.current_ds = KERNEL_DS;
 		ti->kpc = (((unsigned long) ret_from_kernel_thread) - 0x8);
 		childregs->u_regs[UREG_G1] = sp; /* function */
 	}
 	memcpy(new_stack, (char *)regs - STACKFRAME_SZ, STACKFRAME_SZ + TRACEREG_SZ);
 	childregs->u_regs[UREG_FP] = sp;
-	p->thread.flags &= ~SPARC_FLAG_KTHREAD;
 	p->thread.current_ds = USER_DS;
 	ti->kpc = (((unsigned long) ret_from_fork) - 0x8);
 	ti->kpsr = current->thread.fork_kpsr | PSR_PIL;

arch/sparc/kernel/setup_32.c+0−3

 }
 struct tt_entry *sparc_ttable;
-static struct pt_regs fake_swapper_regs;
 /* Called from head_32.S - before we have setup anything
  * in the kernel. Be very careful with what you do here.
 		(*(linux_dbvec->teach_debugger))();
 	}
-	init_task.thread.kregs = &fake_swapper_regs;
 	/* Run-time patch instructions to match the cpu model */
 	per_cpu_patch();

arch/sparc/kernel/setup_64.c+0−4

 char reboot_command[COMMAND_LINE_SIZE];
-static struct pt_regs fake_swapper_regs = { { 0, }, 0, 0, 0, 0 };
 static void __init per_cpu_patch(void)
 {
 	struct cpuid_patch_entry *p;
 	rd_image_start = ram_flags & RAMDISK_IMAGE_START_MASK;
 #endif
-	task_thread_info(&init_task)->kregs = &fake_swapper_regs;
 #ifdef CONFIG_IP_PNP
 	if (!ic_set_manually) {
 		phandle chosen = prom_finddevice("/chosen");

arch/sparc/kernel/traps_64.c+6−7

 			asi = (regs->tstate >> 24); /* saved %asi       */
 		else
 			asi = (insn >> 5);	    /* immediate asi    */
-		if ((asi & 0xf2) == ASI_PNF) {
+		if ((asi & 0xf6) == ASI_PNF) {
-			if (insn & 0x1000000) {     /* op3[5:4]=3       */
+			if (insn & 0x200000)        /* op3[2], stores   */
-				handle_ldf_stq(insn, regs);
-				return true;
-			} else if (insn & 0x200000) { /* op3[2], stores */
 				return false;
-			}
+			if (insn & 0x1000000)       /* op3[5:4]=3 (fp)  */
-			handle_ld_nf(insn, regs);
+				handle_ldf_stq(insn, regs);
+			else
+				handle_ld_nf(insn, regs);
 			return true;
 		}
 	}

arch/sparc/kernel/unaligned_32.c+6−100

@@ -16,6 +16,7 @@ · 15 unmodified lines
16	#include <linux/uaccess.h>	16	#include <linux/uaccess.h>
17	#include <linux/smp.h>	17	#include <linux/smp.h>
18	#include <linux/perf_event.h>	18	#include <linux/perf_event.h>
		19	#include <linux/extable.h>
19		20
20	#include <asm/setup.h>	21	#include <asm/setup.h>
21		22
@@ -213,10 +214,10 @@ static inline int ok_for_kernel(unsigned int insn) · 191 unmodified lines
213		214
214	static void kernel_mna_trap_fault(struct pt_regs *regs, unsigned int insn)	215	static void kernel_mna_trap_fault(struct pt_regs *regs, unsigned int insn)
215	{	216	{
216	unsigned long g2 = regs->u_regs [UREG_G2];	217	const struct exception_table_entry *entry;
217	unsigned long fixup = search_extables_range(regs->pc, &g2);
218		218
219	if (!fixup) {	219	entry = search_exception_tables(regs->pc);
		220	if (!entry) {
220	unsigned long address = compute_effective_address(regs, insn);	221	unsigned long address = compute_effective_address(regs, insn);
221	if(address < PAGE_SIZE) {	222	if(address < PAGE_SIZE) {
222	printk(KERN_ALERT "Unable to handle kernel NULL pointer dereference in mna handler");	223	printk(KERN_ALERT "Unable to handle kernel NULL pointer dereference in mna handler");
@@ -232,9 +233,8 @@ static void kernel_mna_trap_fault(struct pt_regs *regs, unsigned int insn) · 9 unmodified lines
232	die_if_kernel("Oops", regs);	233	die_if_kernel("Oops", regs);
233	/* Not reached */	234	/* Not reached */
234	}	235	}
235	regs->pc = fixup;	236	regs->pc = entry->fixup;
236	regs->npc = regs->pc + 4;	237	regs->npc = regs->pc + 4;
237	regs->u_regs [UREG_G2] = g2;
238	}	238	}
239		239
240	asmlinkage void kernel_unaligned_trap(struct pt_regs *regs, unsigned int insn)	240	asmlinkage void kernel_unaligned_trap(struct pt_regs *regs, unsigned int insn)
@@ -274,103 +274,9 @@ asmlinkage void kernel_unaligned_trap(struct pt_regs *regs, unsigned int insn) · 33 unmodified lines
274	}	274	}
275	}	275	}
276		276
277	static inline int ok_for_user(struct pt_regs *regs, unsigned int insn,	277	asmlinkage void user_unaligned_trap(struct pt_regs *regs, unsigned int insn)
278	enum direction dir)
279	{
280	unsigned int reg;
281	int size = ((insn >> 19) & 3) == 3 ? 8 : 4;
282
283	if ((regs->pc \| regs->npc) & 3)
284	return 0;
285
286	/* Must access_ok() in all the necessary places. */
287	#define WINREG_ADDR(regnum) \
288	((void __user )(((unsigned long )regs->u_regs[UREG_FP])+(regnum)))
289
290	reg = (insn >> 25) & 0x1f;
291	if (reg >= 16) {
292	if (!access_ok(WINREG_ADDR(reg - 16), size))
293	return -EFAULT;
294	}
295	reg = (insn >> 14) & 0x1f;
296	if (reg >= 16) {
297	if (!access_ok(WINREG_ADDR(reg - 16), size))
298	return -EFAULT;
299	}
300	if (!(insn & 0x2000)) {
301	reg = (insn & 0x1f);
302	if (reg >= 16) {
303	if (!access_ok(WINREG_ADDR(reg - 16), size))
304	return -EFAULT;
305	}
306	}
307	#undef WINREG_ADDR
308	return 0;
309	}
310
311	static void user_mna_trap_fault(struct pt_regs *regs, unsigned int insn)
312	{	278	{
313	send_sig_fault(SIGBUS, BUS_ADRALN,	279	send_sig_fault(SIGBUS, BUS_ADRALN,
314	(void __user *)safe_compute_effective_address(regs, insn),	280	(void __user *)safe_compute_effective_address(regs, insn),
315	0, current);	281	0, current);
316	}	282	}
317
318	asmlinkage void user_unaligned_trap(struct pt_regs *regs, unsigned int insn)
319	{
320	enum direction dir;
321
322	if(!(current->thread.flags & SPARC_FLAG_UNALIGNED) \|\|
323	(((insn >> 30) & 3) != 3))
324	goto kill_user;
325	dir = decode_direction(insn);
326	if(!ok_for_user(regs, insn, dir)) {
327	goto kill_user;
328	} else {
329	int err, size = decode_access_size(insn);
330	unsigned long addr;
331
332	if(floating_point_load_or_store_p(insn)) {
333	printk("User FPU load/store unaligned unsupported.\n");
334	goto kill_user;
335	}
336
337	addr = compute_effective_address(regs, insn);
338	perf_sw_event(PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, regs, addr);
339	switch(dir) {
340	case load:
341	err = do_int_load(fetch_reg_addr(((insn>>25)&0x1f),
342	regs),
343	size, (unsigned long *) addr,
344	decode_signedness(insn));
345	break;
346
347	case store:
348	err = do_int_store(((insn>>25)&0x1f), size,
349	(unsigned long *) addr, regs);
350	break;
351
352	case both:
353	/*
354	* This was supported in 2.4. However, we question
355	* the value of SWAP instruction across word boundaries.
356	*/
357	printk("Unaligned SWAP unsupported.\n");
358	err = -EFAULT;
359	break;
360
361	default:
362	unaligned_panic("Impossible user unaligned trap.");
363	goto out;
364	}
365	if (err)
366	goto kill_user;
367	else
368	advance(regs);
369	goto out;
370	}
371
372	kill_user:
373	user_mna_trap_fault(regs, insn);
374	out:
375	;
376	}

arch/sparc/lib/checksum_32.S+27−37

         .text;                                  \
         .align  4
-#define EXT(start,end)				\
-        .section __ex_table,ALLOC;		\
-        .align  4;                              \
-        .word   start, 0, end, cc_fault;         \
-        .text;                                  \
-        .align  4
 	/* This aligned version executes typically in 8.5 superscalar cycles, this
 	 * is the best I can do.  I say 8.5 because the final add will pair with
 	 * the next ldd in the main unrolled loop.  Thus the pipe is always full.
 	 * please check the fixup code below as well.
 	 */
 #define CSUMCOPY_BIGCHUNK_ALIGNED(src, dst, sum, off, t0, t1, t2, t3, t4, t5, t6, t7)	\
-	ldd	[src + off + 0x00], t0;							\
+	EX(ldd	[src + off + 0x00], t0);						\
-	ldd	[src + off + 0x08], t2;							\
+	EX(ldd	[src + off + 0x08], t2);						\
 	addxcc	t0, sum, sum;								\
-	ldd	[src + off + 0x10], t4;							\
+	EX(ldd	[src + off + 0x10], t4);						\
 	addxcc	t1, sum, sum;								\
-	ldd	[src + off + 0x18], t6;							\
+	EX(ldd	[src + off + 0x18], t6);						\
 	addxcc	t2, sum, sum;								\
-	std	t0, [dst + off + 0x00];							\
+	EX(std	t0, [dst + off + 0x00]);						\
 	addxcc	t3, sum, sum;								\
-	std	t2, [dst + off + 0x08];							\
+	EX(std	t2, [dst + off + 0x08]);						\
 	addxcc	t4, sum, sum;								\
-	std	t4, [dst + off + 0x10];							\
+	EX(std	t4, [dst + off + 0x10]);						\
 	addxcc	t5, sum, sum;								\
-	std	t6, [dst + off + 0x18];							\
+	EX(std	t6, [dst + off + 0x18]);						\
 	addxcc	t6, sum, sum;								\
 	addxcc	t7, sum, sum;
 	 * Viking MXCC into streaming mode.  Ho hum...
 	 */
 #define CSUMCOPY_BIGCHUNK(src, dst, sum, off, t0, t1, t2, t3, t4, t5, t6, t7)	\
-	ldd	[src + off + 0x00], t0;						\
+	EX(ldd	[src + off + 0x00], t0);					\
-	ldd	[src + off + 0x08], t2;						\
+	EX(ldd	[src + off + 0x08], t2);					\
-	ldd	[src + off + 0x10], t4;						\
+	EX(ldd	[src + off + 0x10], t4);					\
-	ldd	[src + off + 0x18], t6;						\
+	EX(ldd	[src + off + 0x18], t6);					\
-	st	t0, [dst + off + 0x00];						\
+	EX(st	t0, [dst + off + 0x00]);					\
 	addxcc	t0, sum, sum;							\
-	st	t1, [dst + off + 0x04];						\
+	EX(st	t1, [dst + off + 0x04]);					\
 	addxcc	t1, sum, sum;							\
-	st	t2, [dst + off + 0x08];						\
+	EX(st	t2, [dst + off + 0x08]);					\
 	addxcc	t2, sum, sum;							\
-	st	t3, [dst + off + 0x0c];						\
+	EX(st	t3, [dst + off + 0x0c]);					\
 	addxcc	t3, sum, sum;							\
-	st	t4, [dst + off + 0x10];						\
+	EX(st	t4, [dst + off + 0x10]);					\
 	addxcc	t4, sum, sum;							\
-	st	t5, [dst + off + 0x14];						\
+	EX(st	t5, [dst + off + 0x14]);					\
 	addxcc	t5, sum, sum;							\
-	st	t6, [dst + off + 0x18];						\
+	EX(st	t6, [dst + off + 0x18]);					\
 	addxcc	t6, sum, sum;							\
-	st	t7, [dst + off + 0x1c];						\
+	EX(st	t7, [dst + off + 0x1c]);					\
 	addxcc	t7, sum, sum;
 	/* Yuck, 6 superscalar cycles... */
 #define CSUMCOPY_LASTCHUNK(src, dst, sum, off, t0, t1, t2, t3)	\
-	ldd	[src - off - 0x08], t0;				\
+	EX(ldd	[src - off - 0x08], t0);			\
-	ldd	[src - off - 0x00], t2;				\
+	EX(ldd	[src - off - 0x00], t2);			\
 	addxcc	t0, sum, sum;					\
-	st	t0, [dst - off - 0x08];				\
+	EX(st	t0, [dst - off - 0x08]);			\
 	addxcc	t1, sum, sum;					\
-	st	t1, [dst - off - 0x04];				\
+	EX(st	t1, [dst - off - 0x04]);			\
 	addxcc	t2, sum, sum;					\
-	st	t2, [dst - off - 0x00];				\
+	EX(st	t2, [dst - off - 0x00]);			\
 	addxcc	t3, sum, sum;					\
-	st	t3, [dst - off + 0x04];
+	EX(st	t3, [dst - off + 0x04]);
 	/* Handle the end cruft code out of band for better cache patterns. */
 cc_end_cruft:
 	CSUMCOPY_BIGCHUNK(%o0,%o1,%g7,0x20,%o4,%o5,%g2,%g3,%g4,%g5,%o2,%o3)
 	CSUMCOPY_BIGCHUNK(%o0,%o1,%g7,0x40,%o4,%o5,%g2,%g3,%g4,%g5,%o2,%o3)
 	CSUMCOPY_BIGCHUNK(%o0,%o1,%g7,0x60,%o4,%o5,%g2,%g3,%g4,%g5,%o2,%o3)
-10:	EXT(5b, 10b)			! note for exception handling
 	sub	%g1, 128, %g1		! detract from length
 	addx	%g0, %g7, %g7		! add in last carry bit
 	andcc	%g1, 0xffffff80, %g0	! more to csum?
 	CSUMCOPY_LASTCHUNK(%o0,%o1,%g7,0x28,%g2,%g3,%g4,%g5)
 	CSUMCOPY_LASTCHUNK(%o0,%o1,%g7,0x18,%g2,%g3,%g4,%g5)
 	CSUMCOPY_LASTCHUNK(%o0,%o1,%g7,0x08,%g2,%g3,%g4,%g5)
-12:	EXT(cctbl, 12b)			! note for exception table handling
+12:	addx	%g0, %g7, %g7
-	addx	%g0, %g7, %g7
 	andcc	%o3, 0xf, %g0		! check for low bits set
 ccte:	bne	cc_end_cruft		! something left, handle it out of band
 	 andcc	%o3, 8, %g0		! begin checks for that code
 	CSUMCOPY_BIGCHUNK_ALIGNED(%o0,%o1,%g7,0x20,%o4,%o5,%g2,%g3,%g4,%g5,%o2,%o3)
 	CSUMCOPY_BIGCHUNK_ALIGNED(%o0,%o1,%g7,0x40,%o4,%o5,%g2,%g3,%g4,%g5,%o2,%o3)
 	CSUMCOPY_BIGCHUNK_ALIGNED(%o0,%o1,%g7,0x60,%o4,%o5,%g2,%g3,%g4,%g5,%o2,%o3)
-11:	EXT(ccdbl, 11b)			! note for exception table handling
 	sub	%g1, 128, %g1		! detract from length
 	addx	%g0, %g7, %g7		! add in last carry bit
 	andcc	%g1, 0xffffff80, %g0	! more to csum?

arch/sparc/lib/copy_user.S+112−203

 /* Work around cpp -rob */
 #define ALLOC #alloc
 #define EXECINSTR #execinstr
+#define EX_ENTRY(l1, l2)			\
+	.section __ex_table,ALLOC;		\
+	.align	4;				\
+	.word	l1, l2;				\
+	.text;
 #define EX(x,y,a,b) 				\
 98: 	x,y;					\
 	.section .fixup,ALLOC,EXECINSTR;	\
 	.align	4;				\
-99:	ba fixupretl;				\
+99:	retl;					\
-	 a, b, %g3;				\
+	 a, b, %o0;				\
-	.section __ex_table,ALLOC;		\
+	EX_ENTRY(98b, 99b)
-	.align	4;				\
-	.word	98b, 99b;			\
-	.text;					\
-	.align	4
 #define EX2(x,y,c,d,e,a,b) 			\
 98: 	x,y;					\
 	.section .fixup,ALLOC,EXECINSTR;	\
 	.align	4;				\
 99:	c, d, e;				\
-	ba fixupretl;				\
+	retl;					\
-	 a, b, %g3;				\
+	 a, b, %o0;				\
-	.section __ex_table,ALLOC;		\
+	EX_ENTRY(98b, 99b)
-	.align	4;				\
-	.word	98b, 99b;			\
-	.text;					\
-	.align	4
 #define EXO2(x,y) 				\
 98: 	x, y;					\
-	.section __ex_table,ALLOC;		\
+	EX_ENTRY(98b, 97f)
-	.align	4;				\
-	.word	98b, 97f;			\
-	.text;					\
-	.align	4
-#define EXT(start,end,handler)			\
+#define LD(insn, src, offset, reg, label)	\
-	.section __ex_table,ALLOC;		\
+98:	insn [%src + (offset)], %reg;		\
-	.align	4;				\
+	.section .fixup,ALLOC,EXECINSTR;	\
-	.word	start, 0, end, handler;		\
+99:	ba	label;				\
-	.text;					\
+	 mov	offset, %g5;			\
-	.align	4
+	EX_ENTRY(98b, 99b)
-/* Please do not change following macros unless you change logic used
+#define ST(insn, dst, offset, reg, label)	\
- * in .fixup at the end of this file as well
+98:	insn %reg, [%dst + (offset)];		\
- */
+	.section .fixup,ALLOC,EXECINSTR;	\
+99:	ba	label;				\
+	 mov	offset, %g5;			\
+	EX_ENTRY(98b, 99b)
 /* Both these macros have to start with exactly the same insn */
+/* left: g7 + (g1 % 128) - offset */
 #define MOVE_BIGCHUNK(src, dst, offset, t0, t1, t2, t3, t4, t5, t6, t7) \
-	ldd	[%src + (offset) + 0x00], %t0; \
+	LD(ldd, src, offset + 0x00, t0, bigchunk_fault)	\
-	ldd	[%src + (offset) + 0x08], %t2; \
+	LD(ldd, src, offset + 0x08, t2, bigchunk_fault)	\
-	ldd	[%src + (offset) + 0x10], %t4; \
+	LD(ldd, src, offset + 0x10, t4, bigchunk_fault)	\
-	ldd	[%src + (offset) + 0x18], %t6; \
+	LD(ldd, src, offset + 0x18, t6, bigchunk_fault)	\
-	st	%t0, [%dst + (offset) + 0x00]; \
+	ST(st, dst, offset + 0x00, t0, bigchunk_fault)	\
-	st	%t1, [%dst + (offset) + 0x04]; \
+	ST(st, dst, offset + 0x04, t1, bigchunk_fault)	\
-	st	%t2, [%dst + (offset) + 0x08]; \
+	ST(st, dst, offset + 0x08, t2, bigchunk_fault)	\
-	st	%t3, [%dst + (offset) + 0x0c]; \
+	ST(st, dst, offset + 0x0c, t3, bigchunk_fault)	\
-	st	%t4, [%dst + (offset) + 0x10]; \
+	ST(st, dst, offset + 0x10, t4, bigchunk_fault)	\
-	st	%t5, [%dst + (offset) + 0x14]; \
+	ST(st, dst, offset + 0x14, t5, bigchunk_fault)	\
-	st	%t6, [%dst + (offset) + 0x18]; \
+	ST(st, dst, offset + 0x18, t6, bigchunk_fault)	\
-	st	%t7, [%dst + (offset) + 0x1c];
+	ST(st, dst, offset + 0x1c, t7, bigchunk_fault)
+/* left: g7 + (g1 % 128) - offset */
 #define MOVE_BIGALIGNCHUNK(src, dst, offset, t0, t1, t2, t3, t4, t5, t6, t7) \
-	ldd	[%src + (offset) + 0x00], %t0; \
+	LD(ldd, src, offset + 0x00, t0, bigchunk_fault)	\
-	ldd	[%src + (offset) + 0x08], %t2; \
+	LD(ldd, src, offset + 0x08, t2, bigchunk_fault)	\
-	ldd	[%src + (offset) + 0x10], %t4; \
+	LD(ldd, src, offset + 0x10, t4, bigchunk_fault)	\
-	ldd	[%src + (offset) + 0x18], %t6; \
+	LD(ldd, src, offset + 0x18, t6, bigchunk_fault)	\
-	std	%t0, [%dst + (offset) + 0x00]; \
+	ST(std, dst, offset + 0x00, t0, bigchunk_fault)	\
-	std	%t2, [%dst + (offset) + 0x08]; \
+	ST(std, dst, offset + 0x08, t2, bigchunk_fault)	\
-	std	%t4, [%dst + (offset) + 0x10]; \
+	ST(std, dst, offset + 0x10, t4, bigchunk_fault)	\
-	std	%t6, [%dst + (offset) + 0x18];
+	ST(std, dst, offset + 0x18, t6, bigchunk_fault)
+	.section .fixup,#alloc,#execinstr
+bigchunk_fault:
+	sub	%g7, %g5, %o0
+	and	%g1, 127, %g1
+	retl
+	 add	%o0, %g1, %o0
+/* left: offset + 16 + (g1 % 16) */
 #define MOVE_LASTCHUNK(src, dst, offset, t0, t1, t2, t3) \
-	ldd	[%src - (offset) - 0x10], %t0; \
+	LD(ldd, src, -(offset + 0x10), t0, lastchunk_fault)	\
-	ldd	[%src - (offset) - 0x08], %t2; \
+	LD(ldd, src, -(offset + 0x08), t2, lastchunk_fault)	\
-	st	%t0, [%dst - (offset) - 0x10]; \
+	ST(st, dst, -(offset + 0x10), t0, lastchunk_fault)	\
-	st	%t1, [%dst - (offset) - 0x0c]; \
+	ST(st, dst, -(offset + 0x0c), t1, lastchunk_fault)	\
-	st	%t2, [%dst - (offset) - 0x08]; \
+	ST(st, dst, -(offset + 0x08), t2, lastchunk_fault)	\
-	st	%t3, [%dst - (offset) - 0x04];
+	ST(st, dst, -(offset + 0x04), t3, lastchunk_fault)
-#define MOVE_HALFCHUNK(src, dst, offset, t0, t1, t2, t3) \
+	.section .fixup,#alloc,#execinstr
-	lduh	[%src + (offset) + 0x00], %t0; \
+lastchunk_fault:
-	lduh	[%src + (offset) + 0x02], %t1; \
+	and	%g1, 15, %g1
-	lduh	[%src + (offset) + 0x04], %t2; \
+	retl
-	lduh	[%src + (offset) + 0x06], %t3; \
+	 sub	%g1, %g5, %o0
-	sth	%t0, [%dst + (offset) + 0x00]; \
-	sth	%t1, [%dst + (offset) + 0x02]; \
-	sth	%t2, [%dst + (offset) + 0x04]; \
-	sth	%t3, [%dst + (offset) + 0x06];
+/* left: o3 + (o2 % 16) - offset */
+#define MOVE_HALFCHUNK(src, dst, offset, t0, t1, t2, t3) \
+	LD(lduh, src, offset + 0x00, t0, halfchunk_fault)	\
+	LD(lduh, src, offset + 0x02, t1, halfchunk_fault)	\
+	LD(lduh, src, offset + 0x04, t2, halfchunk_fault)	\
+	LD(lduh, src, offset + 0x06, t3, halfchunk_fault)	\
+	ST(sth, dst, offset + 0x00, t0, halfchunk_fault)	\
+	ST(sth, dst, offset + 0x02, t1, halfchunk_fault)	\
+	ST(sth, dst, offset + 0x04, t2, halfchunk_fault)	\
+	ST(sth, dst, offset + 0x06, t3, halfchunk_fault)
+/* left: o3 + (o2 % 16) + offset + 2 */
 #define MOVE_SHORTCHUNK(src, dst, offset, t0, t1) \
-	ldub	[%src - (offset) - 0x02], %t0; \
+	LD(ldub, src, -(offset + 0x02), t0, halfchunk_fault)	\
-	ldub	[%src - (offset) - 0x01], %t1; \
+	LD(ldub, src, -(offset + 0x01), t1, halfchunk_fault)	\
-	stb	%t0, [%dst - (offset) - 0x02]; \
+	ST(stb, dst, -(offset + 0x02), t0, halfchunk_fault)	\
-	stb	%t1, [%dst - (offset) - 0x01];
+	ST(stb, dst, -(offset + 0x01), t1, halfchunk_fault)
+	.section .fixup,#alloc,#execinstr
+halfchunk_fault:
+	and	%o2, 15, %o2
+	sub	%o3, %g5, %o3
+	retl
+	 add	%o2, %o3, %o0
+/* left: offset + 2 + (o2 % 2) */
+#define MOVE_LAST_SHORTCHUNK(src, dst, offset, t0, t1) \
+	LD(ldub, src, -(offset + 0x02), t0, last_shortchunk_fault)	\
+	LD(ldub, src, -(offset + 0x01), t1, last_shortchunk_fault)	\
+	ST(stb, dst, -(offset + 0x02), t0, last_shortchunk_fault)	\
+	ST(stb, dst, -(offset + 0x01), t1, last_shortchunk_fault)
+	.section .fixup,#alloc,#execinstr
+last_shortchunk_fault:
+	and	%o2, 1, %o2
+	retl
+	 sub	%o2, %g5, %o0
 	.text
 	.align	4
 	MOVE_BIGCHUNK(o1, o0, 0x20, o2, o3, o4, o5, g2, g3, g4, g5)
 	MOVE_BIGCHUNK(o1, o0, 0x40, o2, o3, o4, o5, g2, g3, g4, g5)
 	MOVE_BIGCHUNK(o1, o0, 0x60, o2, o3, o4, o5, g2, g3, g4, g5)
-80:
-	EXT(5b, 80b, 50f)
 	subcc	%g7, 128, %g7
 	add	%o1, 128, %o1
 	bne	5b
 	jmpl	%o5 + %lo(copy_user_table_end), %g0
 	 add	%o0, %g7, %o0
-copy_user_table:
 	MOVE_LASTCHUNK(o1, o0, 0x60, g2, g3, g4, g5)
 	MOVE_LASTCHUNK(o1, o0, 0x50, g2, g3, g4, g5)
 	MOVE_LASTCHUNK(o1, o0, 0x40, g2, g3, g4, g5)
 	MOVE_LASTCHUNK(o1, o0, 0x10, g2, g3, g4, g5)
 	MOVE_LASTCHUNK(o1, o0, 0x00, g2, g3, g4, g5)
 copy_user_table_end:
-	EXT(copy_user_table, copy_user_table_end, 51f)
 	be	copy_user_last7
 	 andcc	%g1, 4, %g0
 	MOVE_BIGALIGNCHUNK(o1, o0, 0x20, o2, o3, o4, o5, g2, g3, g4, g5)
 	MOVE_BIGALIGNCHUNK(o1, o0, 0x40, o2, o3, o4, o5, g2, g3, g4, g5)
 	MOVE_BIGALIGNCHUNK(o1, o0, 0x60, o2, o3, o4, o5, g2, g3, g4, g5)
-81:
-	EXT(ldd_std, 81b, 52f)
 	subcc	%g7, 128, %g7
 	add	%o1, 128, %o1
 	bne	ldd_std
 10:
 	MOVE_HALFCHUNK(o1, o0, 0x00, g2, g3, g4, g5)
 	MOVE_HALFCHUNK(o1, o0, 0x08, g2, g3, g4, g5)
-82:
-	EXT(10b, 82b, 53f)
 	subcc	%o3, 0x10, %o3
 	add	%o1, 0x10, %o1
 	bne	10b
 	MOVE_SHORTCHUNK(o1, o0, -0x0c, g2, g3)
 	MOVE_SHORTCHUNK(o1, o0, -0x0e, g2, g3)
 	MOVE_SHORTCHUNK(o1, o0, -0x10, g2, g3)
-83:
-	EXT(byte_chunk, 83b, 54f)
 	subcc	%o3, 0x10, %o3
 	add	%o1, 0x10, %o1
 	bne	byte_chunk
 	add	%o1, %o3, %o1
 	jmpl	%o5 + %lo(short_table_end), %g0
 	 andcc	%o2, 1, %g0
-84:
+	MOVE_LAST_SHORTCHUNK(o1, o0, 0x0c, g2, g3)
-	MOVE_SHORTCHUNK(o1, o0, 0x0c, g2, g3)
+	MOVE_LAST_SHORTCHUNK(o1, o0, 0x0a, g2, g3)
-	MOVE_SHORTCHUNK(o1, o0, 0x0a, g2, g3)
+	MOVE_LAST_SHORTCHUNK(o1, o0, 0x08, g2, g3)
-	MOVE_SHORTCHUNK(o1, o0, 0x08, g2, g3)
+	MOVE_LAST_SHORTCHUNK(o1, o0, 0x06, g2, g3)
-	MOVE_SHORTCHUNK(o1, o0, 0x06, g2, g3)
+	MOVE_LAST_SHORTCHUNK(o1, o0, 0x04, g2, g3)
-	MOVE_SHORTCHUNK(o1, o0, 0x04, g2, g3)
+	MOVE_LAST_SHORTCHUNK(o1, o0, 0x02, g2, g3)
-	MOVE_SHORTCHUNK(o1, o0, 0x02, g2, g3)
+	MOVE_LAST_SHORTCHUNK(o1, o0, 0x00, g2, g3)
-	MOVE_SHORTCHUNK(o1, o0, 0x00, g2, g3)
 short_table_end:
-	EXT(84b, short_table_end, 55f)
 	be	1f
 	 nop
 	EX(ldub	[%o1], %g2, add %g0, 1)
 	.section .fixup,#alloc,#execinstr
 	.align	4
 97:
-	mov	%o2, %g3
-fixupretl:
 	retl
-	 mov	%g3, %o0
+	 mov	%o2, %o0
-/* exception routine sets %g2 to (broken_insn - first_insn)>>2 */
-50:
-/* This magic counts how many bytes are left when crash in MOVE_BIGCHUNK
- * happens. This is derived from the amount ldd reads, st stores, etc.
- * x = g2 % 12;
- * g3 = g1 + g7 - ((g2 / 12) * 32 + (x < 4) ? 0 : (x - 4) * 4);
- * o0 += (g2 / 12) * 32;
- */
-	cmp	%g2, 12
-	add	%o0, %g7, %o0
-	bcs	1f
-	 cmp	%g2, 24
-	bcs	2f
-	 cmp	%g2, 36
-	bcs	3f
-	 nop
-	sub	%g2, 12, %g2
-	sub	%g7, 32, %g7
-3:	sub	%g2, 12, %g2
-	sub	%g7, 32, %g7
-2:	sub	%g2, 12, %g2
-	sub	%g7, 32, %g7
-1:	cmp	%g2, 4
-	bcs,a	60f
-	 clr	%g2
-	sub	%g2, 4, %g2
-	sll	%g2, 2, %g2
-60:	and	%g1, 0x7f, %g3
-	sub	%o0, %g7, %o0
-	add	%g3, %g7, %g3
-	ba	fixupretl
-	 sub	%g3, %g2, %g3
-51:
-/* i = 41 - g2; j = i % 6;
- * g3 = (g1 & 15) + (i / 6) * 16 + (j < 4) ? (j + 1) * 4 : 16;
- * o0 -= (i / 6) * 16 + 16;
- */
-	neg	%g2
-	and	%g1, 0xf, %g1
-	add	%g2, 41, %g2
-	add	%o0, %g1, %o0
-1:	cmp	%g2, 6
-	bcs,a	2f
-	 cmp	%g2, 4
-	add	%g1, 16, %g1
-	b	1b
-	 sub	%g2, 6, %g2
-2:	bcc,a	2f
-	 mov	16, %g2
-	inc	%g2
-	sll	%g2, 2, %g2
-2:	add	%g1, %g2, %g3
-	ba	fixupretl
-	 sub	%o0, %g3, %o0
-52:
-/* g3 = g1 + g7 - (g2 / 8) * 32 + (g2 & 4) ? (g2 & 3) * 8 : 0;
-   o0 += (g2 / 8) * 32 */
-	andn	%g2, 7, %g4
-	add	%o0, %g7, %o0
-	andcc	%g2, 4, %g0
-	and	%g2, 3, %g2
-	sll	%g4, 2, %g4
-	sll	%g2, 3, %g2
-	bne	60b
-	 sub	%g7, %g4, %g7
-	ba	60b
-	 clr	%g2
-53:
-/* g3 = o3 + (o2 & 15) - (g2 & 8) - (g2 & 4) ? (g2 & 3) * 2 : 0;
-   o0 += (g2 & 8) */
-	and	%g2, 3, %g4
-	andcc	%g2, 4, %g0
-	and	%g2, 8, %g2
-	sll	%g4, 1, %g4
-	be	1f
-	 add	%o0, %g2, %o0
-	add	%g2, %g4, %g2
-1:	and	%o2, 0xf, %g3
-	add	%g3, %o3, %g3
-	ba	fixupretl
-	 sub	%g3, %g2, %g3
-54:
-/* g3 = o3 + (o2 & 15) - (g2 / 4) * 2 - (g2 & 2) ? (g2 & 1) : 0;
-   o0 += (g2 / 4) * 2 */
-	srl	%g2, 2, %o4
-	and	%g2, 1, %o5
-	srl	%g2, 1, %g2
-	add	%o4, %o4, %o4
-	and	%o5, %g2, %o5
-	and	%o2, 0xf, %o2
-	add	%o0, %o4, %o0
-	sub	%o3, %o5, %o3
-	sub	%o2, %o4, %o2
-	ba	fixupretl
-	 add	%o2, %o3, %g3
-55:
-/* i = 27 - g2;
-   g3 = (o2 & 1) + i / 4 * 2 + !(i & 3);
-   o0 -= i / 4 * 2 + 1 */
-	neg	%g2
-	and	%o2, 1, %o2
-	add	%g2, 27, %g2
-	srl	%g2, 2, %o5
-	andcc	%g2, 3, %g0
-	mov	1, %g2
-	add	%o5, %o5, %o5
-	be,a	1f
-	 clr	%g2
-1:	add	%g2, %o5, %g3
-	sub	%o0, %g3, %o0
-	ba	fixupretl
-	 add	%g3, %o2, %g3
 	.globl  __copy_user_end
 __copy_user_end:

arch/sparc/lib/memset.S+33−54

 98: 	x,y;					\
 	.section .fixup,ALLOC,EXECINSTR;	\
 	.align	4;				\
-99:	ba 30f;					\
+99:	retl;					\
 	 a, b, %o0;				\
 	.section __ex_table,ALLOC;		\
 	.align	4;				\
 	.text;					\
 	.align	4
-#define EXT(start,end,handler) 			\
+#define STORE(source, base, offset, n)		\
+98: 	std source, [base + offset + n];	\
+	.section .fixup,ALLOC,EXECINSTR;	\
+	.align	4;				\
+99:	ba 30f;					\
+	 sub %o3, n - offset, %o3;		\
 	.section __ex_table,ALLOC;		\
 	.align	4;				\
-	.word	start, 0, end, handler;		\
+	.word	98b, 99b;			\
 	.text;					\
-	.align	4
+	.align	4;
+#define STORE_LAST(source, base, offset, n)	\
+	EX(std source, [base - offset - n],	\
+	   add %o1, offset + n);
 /* Please don't change these macros, unless you change the logic
  * in the .fixup section below as well.
  * Store 64 bytes at (BASE + OFFSET) using value SOURCE. */
-#define ZERO_BIG_BLOCK(base, offset, source)    \
+#define ZERO_BIG_BLOCK(base, offset, source)	\
-	std	source, [base + offset + 0x00]; \
+	STORE(source, base, offset, 0x00);	\
-	std	source, [base + offset + 0x08]; \
+	STORE(source, base, offset, 0x08);	\
-	std	source, [base + offset + 0x10]; \
+	STORE(source, base, offset, 0x10);	\
-	std	source, [base + offset + 0x18]; \
+	STORE(source, base, offset, 0x18);	\
-	std	source, [base + offset + 0x20]; \
+	STORE(source, base, offset, 0x20);	\
-	std	source, [base + offset + 0x28]; \
+	STORE(source, base, offset, 0x28);	\
-	std	source, [base + offset + 0x30]; \
+	STORE(source, base, offset, 0x30);	\
-	std	source, [base + offset + 0x38];
+	STORE(source, base, offset, 0x38);
 #define ZERO_LAST_BLOCKS(base, offset, source)	\
-	std	source, [base - offset - 0x38]; \
+	STORE_LAST(source, base, offset, 0x38);	\
-	std	source, [base - offset - 0x30]; \
+	STORE_LAST(source, base, offset, 0x30); \
-	std	source, [base - offset - 0x28]; \
+	STORE_LAST(source, base, offset, 0x28);	\
-	std	source, [base - offset - 0x20]; \
+	STORE_LAST(source, base, offset, 0x20);	\
-	std	source, [base - offset - 0x18]; \
+	STORE_LAST(source, base, offset, 0x18);	\
-	std	source, [base - offset - 0x10]; \
+	STORE_LAST(source, base, offset, 0x10);	\
-	std	source, [base - offset - 0x08]; \
+	STORE_LAST(source, base, offset, 0x08);	\
-	std	source, [base - offset - 0x00];
+	STORE_LAST(source, base, offset, 0x00);
 	.text
 	.align 4
 	.globl	memset
 	EXPORT_SYMBOL(__bzero)
 	EXPORT_SYMBOL(memset)
-	.globl	__memset_start, __memset_end
-__memset_start:
 memset:
 	mov	%o0, %g1
 	mov	1, %g4
 	ZERO_BIG_BLOCK(%o0, 0x00, %g2)
 	subcc	%o3, 128, %o3
 	ZERO_BIG_BLOCK(%o0, 0x40, %g2)
-11:
-	EXT(10b, 11b, 20f)
 	bne	10b
 	 add	%o0, 128, %o0
 	jmp	%o4
 	 add	%o0, %o2, %o0
-12:
 	ZERO_LAST_BLOCKS(%o0, 0x48, %g2)
 	ZERO_LAST_BLOCKS(%o0, 0x08, %g2)
 13:
-	EXT(12b, 13b, 21f)
 	be	8f
 	 andcc	%o1, 4, %g0
 5:
 	retl
 	 clr	%o0
-__memset_end:
 	.section .fixup,#alloc,#execinstr
 	.align	4
-20:
-	cmp	%g2, 8
-	bleu	1f
-	 and	%o1, 0x7f, %o1
-	sub	%g2, 9, %g2
-	add	%o3, 64, %o3
-1:
-	sll	%g2, 3, %g2
-	add	%o3, %o1, %o0
-	b 30f
-	 sub	%o0, %g2, %o0
-21:
-	mov	8, %o0
-	and	%o1, 7, %o1
-	sub	%o0, %g2, %o0
-	sll	%o0, 3, %o0
-	b 30f
-	 add	%o0, %o1, %o0
 30:
-/* %o4 is faulting address, %o5 is %pc where fault occurred */
+	and	%o1, 0x7f, %o1
-	save	%sp, -104, %sp
+	retl
-	mov	%i5, %o0
+	 add	%o3, %o1, %o0
-	mov	%i7, %o1
-	call	lookup_fault
-	 mov	%i4, %o2
-	ret
-	 restore
 	.globl __bzero_end
 __bzero_end:

arch/sparc/mm/Makefile+1−1

@@ -8,7 +8,7 @@ ccflags-y := -Werror · 7 unmodified lines
8	obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o	8	obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o
9	obj-y += fault_$(BITS).o	9	obj-y += fault_$(BITS).o
10	obj-y += init_$(BITS).o	10	obj-y += init_$(BITS).o
11	obj-$(CONFIG_SPARC32) += extable.o srmmu.o iommu.o io-unit.o	11	obj-$(CONFIG_SPARC32) += srmmu.o iommu.o io-unit.o
12	obj-$(CONFIG_SPARC32) += srmmu_access.o	12	obj-$(CONFIG_SPARC32) += srmmu_access.o
13	obj-$(CONFIG_SPARC32) += hypersparc.o viking.o tsunami.o swift.o	13	obj-$(CONFIG_SPARC32) += hypersparc.o viking.o tsunami.o swift.o
14	obj-$(CONFIG_SPARC32) += leon_mm.o	14	obj-$(CONFIG_SPARC32) += leon_mm.o

arch/sparc/mm/extable.c+0−107

@@ -1,107 +0,0 @@
1	// SPDX-License-Identifier: GPL-2.0
2	/*
3	* linux/arch/sparc/mm/extable.c
4	*/
5
6	#include <linux/module.h>
7	#include <linux/extable.h>
8	#include <linux/uaccess.h>
9
10	void sort_extable(struct exception_table_entry *start,
11	struct exception_table_entry *finish)
12	{
13	}
14
15	/* Caller knows they are in a range if ret->fixup == 0 */
16	const struct exception_table_entry *
17	search_extable(const struct exception_table_entry *base,
18	const size_t num,
19	unsigned long value)
20	{
21	int i;
22
23	/* Single insn entries are encoded as:
24	* word 1: insn address
25	* word 2: fixup code address
26	*
27	* Range entries are encoded as:
28	* word 1: first insn address
29	* word 2: 0
30	* word 3: last insn address + 4 bytes
31	* word 4: fixup code address
32	*
33	* Deleted entries are encoded as:
34	* word 1: unused
35	* word 2: -1
36	*
37	* See asm/uaccess.h for more details.
38	*/
39
40	/* 1. Try to find an exact match. */
41	for (i = 0; i < num; i++) {
42	if (base[i].fixup == 0) {
43	/* A range entry, skip both parts. */
44	i++;
45	continue;
46	}
47
48	/* A deleted entry; see trim_init_extable */
49	if (base[i].fixup == -1)
50	continue;
51
52	if (base[i].insn == value)
53	return &base[i];
54	}
55
56	/* 2. Try to find a range match. */
57	for (i = 0; i < (num - 1); i++) {
58	if (base[i].fixup)
59	continue;
60
61	if (base[i].insn <= value && base[i + 1].insn > value)
62	return &base[i];
63
64	i++;
65	}
66
67	return NULL;
68	}
69
70	#ifdef CONFIG_MODULES
71	/* We could memmove them around; easier to mark the trimmed ones. */
72	void trim_init_extable(struct module *m)
73	{
74	unsigned int i;
75	bool range;
76
77	for (i = 0; i < m->num_exentries; i += range ? 2 : 1) {
78	range = m->extable[i].fixup == 0;
79
80	if (within_module_init(m->extable[i].insn, m)) {
81	m->extable[i].fixup = -1;
82	if (range)
83	m->extable[i+1].fixup = -1;
84	}
85	if (range)
86	i++;
87	}
88	}
89	#endif /* CONFIG_MODULES */
90
91	/* Special extable search, which handles ranges. Returns fixup */
92	unsigned long search_extables_range(unsigned long addr, unsigned long *g2)
93	{
94	const struct exception_table_entry *entry;
95
96	entry = search_exception_tables(addr);
97	if (!entry)
98	return 0;
99
100	/* Inside range? Fix g2 and return correct fixup */
101	if (!entry->fixup) {
102	*g2 = (addr - entry->insn) / 4;
103	return (entry + 1)->fixup;
104	}
105
106	return entry->fixup;
107	}

arch/sparc/mm/fault_32.c+10−70

@@ -23,6 +23,7 @@ · 22 unmodified lines
23	#include <linux/interrupt.h>	23	#include <linux/interrupt.h>
24	#include <linux/kdebug.h>	24	#include <linux/kdebug.h>
25	#include <linux/uaccess.h>	25	#include <linux/uaccess.h>
		26	#include <linux/extable.h>
26		27
27	#include <asm/page.h>	28	#include <asm/page.h>
28	#include <asm/openprom.h>	29	#include <asm/openprom.h>
@@ -54,54 +55,6 @@ static void __noreturn unhandled_fault(unsigned long address, · 25 unmodified lines
54	die_if_kernel("Oops", regs);	55	die_if_kernel("Oops", regs);
55	}	56	}
56		57
57	asmlinkage int lookup_fault(unsigned long pc, unsigned long ret_pc,
58	unsigned long address)
59	{
60	struct pt_regs regs;
61	unsigned long g2;
62	unsigned int insn;
63	int i;
64
65	i = search_extables_range(ret_pc, &g2);
66	switch (i) {
67	case 3:
68	/* load & store will be handled by fixup */
69	return 3;
70
71	case 1:
72	/* store will be handled by fixup, load will bump out */
73	/* for _to_ macros */
74	insn = ((unsigned int ) pc);
75	if ((insn >> 21) & 1)
76	return 1;
77	break;
78
79	case 2:
80	/* load will be handled by fixup, store will bump out */
81	/* for _from_ macros */
82	insn = ((unsigned int ) pc);
83	if (!((insn >> 21) & 1) \|\| ((insn>>19)&0x3f) == 15)
84	return 2;
85	break;
86
87	default:
88	break;
89	}
90
91	memset(&regs, 0, sizeof(regs));
92	regs.pc = pc;
93	regs.npc = pc + 4;
94	__asm__ __volatile__(
95	"rd %%psr, %0\n\t"
96	"nop\n\t"
97	"nop\n\t"
98	"nop\n" : "=r" (regs.psr));
99	unhandled_fault(address, current, &regs);
100
101	/* Not reached */
102	return 0;
103	}
104
105	static inline void	58	static inline void
106	show_signal_msg(struct pt_regs *regs, int sig, int code,	59	show_signal_msg(struct pt_regs *regs, int sig, int code,
107	unsigned long address, struct task_struct *tsk)	60	unsigned long address, struct task_struct *tsk)
@@ -162,8 +115,6 @@ asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write, · 54 unmodified lines
162	struct vm_area_struct *vma;	115	struct vm_area_struct *vma;
163	struct task_struct *tsk = current;	116	struct task_struct *tsk = current;
164	struct mm_struct *mm = tsk->mm;	117	struct mm_struct *mm = tsk->mm;
165	unsigned int fixup;
166	unsigned long g2;
167	int from_user = !(regs->psr & PSR_PS);	118	int from_user = !(regs->psr & PSR_PS);
168	int code;	119	int code;
169	vm_fault_t fault;	120	vm_fault_t fault;
@@ -281,30 +232,19 @@ bad_area_nosemaphore: · 111 unmodified lines
281		232
282	/* Is this in ex_table? */	233	/* Is this in ex_table? */
283	no_context:	234	no_context:
284	g2 = regs->u_regs[UREG_G2];
285	if (!from_user) {	235	if (!from_user) {
286	fixup = search_extables_range(regs->pc, &g2);	236	const struct exception_table_entry *entry;
287	/* Values below 10 are reserved for other things */
288	if (fixup > 10) {
289	extern const unsigned int __memset_start[];
290	extern const unsigned int __memset_end[];
291		237
		238	entry = search_exception_tables(regs->pc);
292	#ifdef DEBUG_EXCEPTIONS	239	#ifdef DEBUG_EXCEPTIONS
293	printk("Exception: PC<%08lx> faddr<%08lx>\n",	240	printk("Exception: PC<%08lx> faddr<%08lx>\n",
294	regs->pc, address);	241	regs->pc, address);
295	printk("EX_TABLE: insn<%08lx> fixup<%08x> g2<%08lx>\n",	242	printk("EX_TABLE: insn<%08lx> fixup<%08x>\n",
296	regs->pc, fixup, g2);	243	regs->pc, entry->fixup);
297	#endif	244	#endif
298	if ((regs->pc >= (unsigned long)__memset_start &&	245	regs->pc = entry->fixup;
299	regs->pc < (unsigned long)__memset_end)) {	246	regs->npc = regs->pc + 4;
300	regs->u_regs[UREG_I4] = address;	247	return;
301	regs->u_regs[UREG_I5] = regs->pc;
302	}
303	regs->u_regs[UREG_G2] = g2;
304	regs->pc = fixup;
305	regs->npc = regs->pc + 4;
306	return;
307	}
308	}	248	}
309		249
310	unhandled_fault(address, tsk, regs);	250	unhandled_fault(address, tsk, regs);

arch/sparc/mm/mm_32.h+0−2

@@ -1,7 +1,5 @@
1	/* SPDX-License-Identifier: GPL-2.0 */	1	/* SPDX-License-Identifier: GPL-2.0 */
2	/* fault_32.c - visible as they are called from assembler */	2	/* fault_32.c - visible as they are called from assembler */
3	asmlinkage int lookup_fault(unsigned long pc, unsigned long ret_pc,
4	unsigned long address);
5	asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,	3	asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
6	unsigned long address);	4	unsigned long address);
7		5

arch/x86/entry/common.c+2−1

@@ -128,7 +128,8 @@ static noinstr bool __do_fast_syscall_32(struct pt_regs *regs) · 127 unmodified lines
128	regs->ax = -EFAULT;	128	regs->ax = -EFAULT;
129		129
130	instrumentation_end();	130	instrumentation_end();
131	syscall_exit_to_user_mode(regs);	131	local_irq_disable();
		132	irqentry_exit_to_user_mode(regs);
132	return false;	133	return false;
133	}	134	}
134		135

arch/x86/entry/entry_64_compat.S+2−0

@@ -210,6 +210,8 @@ SYM_CODE_START(entry_SYSCALL_compat) · 209 unmodified lines
210	/* Switch to the kernel stack */	210	/* Switch to the kernel stack */
211	movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp	211	movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp
212		212
		213	SYM_INNER_LABEL(entry_SYSCALL_compat_safe_stack, SYM_L_GLOBAL)
		214
213	/* Construct struct pt_regs on stack */	215	/* Construct struct pt_regs on stack */
214	pushq $__USER32_DS /* pt_regs->ss */	216	pushq $__USER32_DS /* pt_regs->ss */
215	pushq %r8 /* pt_regs->sp */	217	pushq %r8 /* pt_regs->sp */

arch/x86/events/core.c+6−9

 DEFINE_STATIC_CALL_NULL(x86_pmu_drain_pebs,   *x86_pmu.drain_pebs);
 DEFINE_STATIC_CALL_NULL(x86_pmu_pebs_aliases, *x86_pmu.pebs_aliases);
-DEFINE_STATIC_CALL_NULL(x86_pmu_guest_get_msrs,  *x86_pmu.guest_get_msrs);
+/*
+ * This one is magic, it will get called even when PMU init fails (because
+ * there is no PMU), in which case it should simply return NULL.
+ */
+DEFINE_STATIC_CALL_RET0(x86_pmu_guest_get_msrs, *x86_pmu.guest_get_msrs);
 u64 __read_mostly hw_cache_event_ids
 				[PERF_COUNT_HW_CACHE_MAX]
 	x86_perf_event_update(event);
 }
-static inline struct perf_guest_switch_msr *
-perf_guest_get_msrs_nop(int *nr)
-{
-	*nr = 0;
-	return NULL;
-}
 static int __init init_hw_perf_events(void)
 {
 	struct x86_pmu_quirk *quirk;
 		x86_pmu.read = _x86_pmu_read;
 	if (!x86_pmu.guest_get_msrs)
-		x86_pmu.guest_get_msrs = perf_guest_get_msrs_nop;
+		x86_pmu.guest_get_msrs = (void *)&__static_call_return0;
 	x86_pmu_static_call_update();

arch/x86/events/intel/core.c+4−1

 		if (!(event->attr.freq || (event->attr.wakeup_events && !event->attr.watermark))) {
 			event->hw.flags |= PERF_X86_EVENT_AUTO_RELOAD;
 			if (!(event->attr.sample_type &
-			      ~intel_pmu_large_pebs_flags(event)))
+			      ~intel_pmu_large_pebs_flags(event))) {
 				event->hw.flags |= PERF_X86_EVENT_LARGE_PEBS;
+				event->attach_state |= PERF_ATTACH_SCHED_CB;
+			}
 		}
 		if (x86_pmu.pebs_aliases)
 			x86_pmu.pebs_aliases(event);
 		ret = intel_pmu_setup_lbr_filter(event);
 		if (ret)
 			return ret;
+		event->attach_state |= PERF_ATTACH_SCHED_CB;
 		/*
 		 * BTS is set up earlier in this path, so don't account twice

arch/x86/include/asm/insn-eval.h+2−0

@@ -23,6 +23,8 @@ unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx); · 22 unmodified lines
23	int insn_get_code_seg_params(struct pt_regs *regs);	23	int insn_get_code_seg_params(struct pt_regs *regs);
24	int insn_fetch_from_user(struct pt_regs *regs,	24	int insn_fetch_from_user(struct pt_regs *regs,
25	unsigned char buf[MAX_INSN_SIZE]);	25	unsigned char buf[MAX_INSN_SIZE]);
		26	int insn_fetch_from_user_inatomic(struct pt_regs *regs,
		27	unsigned char buf[MAX_INSN_SIZE]);
26	bool insn_decode(struct insn insn, struct pt_regs regs,	28	bool insn_decode(struct insn insn, struct pt_regs regs,
27	unsigned char buf[MAX_INSN_SIZE], int buf_size);	29	unsigned char buf[MAX_INSN_SIZE], int buf_size);
28		30

arch/x86/include/asm/kvm_host.h+2−2

@@ -963,7 +963,7 @@ struct kvm_arch { · 962 unmodified lines
963	struct kvm_pit *vpit;	963	struct kvm_pit *vpit;
964	atomic_t vapics_in_nmi_mode;	964	atomic_t vapics_in_nmi_mode;
965	struct mutex apic_map_lock;	965	struct mutex apic_map_lock;
966	struct kvm_apic_map *apic_map;	966	struct kvm_apic_map __rcu *apic_map;
967	atomic_t apic_map_dirty;	967	atomic_t apic_map_dirty;
968		968
969	bool apic_access_page_done;	969	bool apic_access_page_done;
@@ -1036,7 +1036,7 @@ struct kvm_arch { · 66 unmodified lines
1036		1036
1037	bool bus_lock_detection_enabled;	1037	bool bus_lock_detection_enabled;
1038		1038
1039	struct kvm_pmu_event_filter *pmu_event_filter;	1039	struct kvm_pmu_event_filter __rcu *pmu_event_filter;
1040	struct task_struct *nx_lpage_recovery_thread;	1040	struct task_struct *nx_lpage_recovery_thread;
1041		1041
1042	#ifdef CONFIG_X86_64	1042	#ifdef CONFIG_X86_64

arch/x86/include/asm/proto.h+1−0

@@ -25,6 +25,7 @@ void __end_SYSENTER_singlestep_region(void); · 24 unmodified lines
25	void entry_SYSENTER_compat(void);	25	void entry_SYSENTER_compat(void);
26	void __end_entry_SYSENTER_compat(void);	26	void __end_entry_SYSENTER_compat(void);
27	void entry_SYSCALL_compat(void);	27	void entry_SYSCALL_compat(void);
		28	void entry_SYSCALL_compat_safe_stack(void);
28	void entry_INT80_compat(void);	29	void entry_INT80_compat(void);
29	#ifdef CONFIG_XEN_PV	30	#ifdef CONFIG_XEN_PV
30	void xen_entry_INT80_compat(void);	31	void xen_entry_INT80_compat(void);

arch/x86/include/asm/ptrace.h+15−0

@@ -94,6 +94,8 @@ struct pt_regs { · 93 unmodified lines
94	#include <asm/paravirt_types.h>	94	#include <asm/paravirt_types.h>
95	#endif	95	#endif
96		96
		97	#include <asm/proto.h>
		98
97	struct cpuinfo_x86;	99	struct cpuinfo_x86;
98	struct task_struct;	100	struct task_struct;
99		101
@@ -175,6 +177,19 @@ static inline bool any_64bit_mode(struct pt_regs *regs) · 75 unmodified lines
175	#ifdef CONFIG_X86_64	177	#ifdef CONFIG_X86_64
176	#define current_user_stack_pointer() current_pt_regs()->sp	178	#define current_user_stack_pointer() current_pt_regs()->sp
177	#define compat_user_stack_pointer() current_pt_regs()->sp	179	#define compat_user_stack_pointer() current_pt_regs()->sp
		180
		181	static inline bool ip_within_syscall_gap(struct pt_regs *regs)
		182	{
		183	bool ret = (regs->ip >= (unsigned long)entry_SYSCALL_64 &&
		184	regs->ip < (unsigned long)entry_SYSCALL_64_safe_stack);
		185
		186	#ifdef CONFIG_IA32_EMULATION
		187	ret = ret \|\| (regs->ip >= (unsigned long)entry_SYSCALL_compat &&
		188	regs->ip < (unsigned long)entry_SYSCALL_compat_safe_stack);
		189	#endif
		190
		191	return ret;
		192	}
178	#endif	193	#endif
179		194
180	static inline unsigned long kernel_stack_pointer(struct pt_regs *regs)	195	static inline unsigned long kernel_stack_pointer(struct pt_regs *regs)

arch/x86/include/asm/smap.h+4−6

 	unsigned long flags;
 	asm volatile ("# smap_save\n\t"
-		      ALTERNATIVE("jmp 1f", "", X86_FEATURE_SMAP)
+		      ALTERNATIVE("", "pushf; pop %0; " __ASM_CLAC "\n\t",
-		      "pushf; pop %0; " __ASM_CLAC "\n\t"
+				  X86_FEATURE_SMAP)
-		      "1:"
 		      : "=rm" (flags) : : "memory", "cc");
 	return flags;
 static __always_inline void smap_restore(unsigned long flags)
 {
 	asm volatile ("# smap_restore\n\t"
-		      ALTERNATIVE("jmp 1f", "", X86_FEATURE_SMAP)
+		      ALTERNATIVE("", "push %0; popf\n\t",
-		      "push %0; popf\n\t"
+				  X86_FEATURE_SMAP)
-		      "1:"
 		      : : "g" (flags) : "memory", "cc");
 }

arch/x86/kernel/kvmclock.c+9−10

@@ -268,21 +268,20 @@ static void __init kvmclock_init_mem(void) · 267 unmodified lines
268		268
269	static int __init kvm_setup_vsyscall_timeinfo(void)	269	static int __init kvm_setup_vsyscall_timeinfo(void)
270	{	270	{
271	#ifdef CONFIG_X86_64	271	kvmclock_init_mem();
272	u8 flags;
273		272
274	if (!per_cpu(hv_clock_per_cpu, 0) \|\| !kvmclock_vsyscall)	273	#ifdef CONFIG_X86_64
275	return 0;	274	if (per_cpu(hv_clock_per_cpu, 0) && kvmclock_vsyscall) {
		275	u8 flags;
276		276
277	flags = pvclock_read_flags(&hv_clock_boot[0].pvti);	277	flags = pvclock_read_flags(&hv_clock_boot[0].pvti);
278	if (!(flags & PVCLOCK_TSC_STABLE_BIT))	278	if (!(flags & PVCLOCK_TSC_STABLE_BIT))
279	return 0;	279	return 0;
280		280
281	kvm_clock.vdso_clock_mode = VDSO_CLOCKMODE_PVCLOCK;	281	kvm_clock.vdso_clock_mode = VDSO_CLOCKMODE_PVCLOCK;
		282	}
282	#endif	283	#endif
283		284
284	kvmclock_init_mem();
285
286	return 0;	285	return 0;
287	}	286	}
288	early_initcall(kvm_setup_vsyscall_timeinfo);	287	early_initcall(kvm_setup_vsyscall_timeinfo);

arch/x86/kernel/sev-es.c+17−5

 	cea_set_pte((void *)vaddr, pa, PAGE_KERNEL);
 }
-static __always_inline bool on_vc_stack(unsigned long sp)
+static __always_inline bool on_vc_stack(struct pt_regs *regs)
 {
+	unsigned long sp = regs->sp;
+	/* User-mode RSP is not trusted */
+	if (user_mode(regs))
+		return false;
+	/* SYSCALL gap still has user-mode RSP */
+	if (ip_within_syscall_gap(regs))
+		return false;
 	return ((sp >= __this_cpu_ist_bottom_va(VC)) && (sp < __this_cpu_ist_top_va(VC)));
 }
 	old_ist = __this_cpu_read(cpu_tss_rw.x86_tss.ist[IST_INDEX_VC]);
 	/* Make room on the IST stack */
-	if (on_vc_stack(regs->sp))
+	if (on_vc_stack(regs))
 		new_ist = ALIGN_DOWN(regs->sp, 8) - sizeof(old_ist);
 	else
 		new_ist = old_ist - sizeof(old_ist);
 	int res;
 	if (user_mode(ctxt->regs)) {
-		res = insn_fetch_from_user(ctxt->regs, buffer);
+		res = insn_fetch_from_user_inatomic(ctxt->regs, buffer);
 		if (!res) {
 			ctxt->fi.vector     = X86_TRAP_PF;
 			ctxt->fi.error_code = X86_PF_INSTR | X86_PF_USER;
 DEFINE_IDTENTRY_VC_SAFE_STACK(exc_vmm_communication)
 {
 	struct sev_es_runtime_data *data = this_cpu_read(runtime_data);
+	irqentry_state_t irq_state;
 	struct ghcb_state state;
 	struct es_em_ctxt ctxt;
 	enum es_result result;
 	struct ghcb *ghcb;
-	lockdep_assert_irqs_disabled();
 	/*
 	 * Handle #DB before calling into !noinstr code to avoid recursive #DB.
 	 */
 		return;
 	}
+	irq_state = irqentry_nmi_enter(regs);
+	lockdep_assert_irqs_disabled();
 	instrumentation_begin();
 	/*
 out:
 	instrumentation_end();
+	irqentry_nmi_exit(regs, irq_state);
 	return;

arch/x86/kernel/traps.c+1−2

 	 * In the SYSCALL entry path the RSP value comes from user-space - don't
 	 * trust it and switch to the current kernel stack
 	 */
-	if (regs->ip >= (unsigned long)entry_SYSCALL_64 &&
+	if (ip_within_syscall_gap(regs)) {
-	    regs->ip <  (unsigned long)entry_SYSCALL_64_safe_stack) {
 		sp = this_cpu_read(cpu_current_top_of_stack);
 		goto sync;
 	}

arch/x86/kernel/unwind_orc.c+7−7

@@ -13,7 +13,7 @@ · 12 unmodified lines
13		13
14	#define orc_warn_current(args...) \	14	#define orc_warn_current(args...) \
15	({ \	15	({ \
16	if (state->task == current) \	16	if (state->task == current && !state->error) \
17	orc_warn(args); \	17	orc_warn(args); \
18	})	18	})
19		19
@@ -367,8 +367,8 @@ static bool deref_stack_regs(struct unwind_state *state, unsigned long addr, · 347 unmodified lines
367	if (!stack_access_ok(state, addr, sizeof(struct pt_regs)))	367	if (!stack_access_ok(state, addr, sizeof(struct pt_regs)))
368	return false;	368	return false;
369		369
370	*ip = regs->ip;	370	*ip = READ_ONCE_NOCHECK(regs->ip);
371	*sp = regs->sp;	371	*sp = READ_ONCE_NOCHECK(regs->sp);
372	return true;	372	return true;
373	}	373	}
374		374
@@ -380,8 +380,8 @@ static bool deref_stack_iret_regs(struct unwind_state *state, unsigned long addr · 5 unmodified lines
380	if (!stack_access_ok(state, addr, IRET_FRAME_SIZE))	380	if (!stack_access_ok(state, addr, IRET_FRAME_SIZE))
381	return false;	381	return false;
382		382
383	*ip = regs->ip;	383	*ip = READ_ONCE_NOCHECK(regs->ip);
384	*sp = regs->sp;	384	*sp = READ_ONCE_NOCHECK(regs->sp);
385	return true;	385	return true;
386	}	386	}
387		387
@@ -402,12 +402,12 @@ static bool get_reg(struct unwind_state *state, unsigned int reg_off, · 14 unmodified lines
402	return false;	402	return false;
403		403
404	if (state->full_regs) {	404	if (state->full_regs) {
405	val = ((unsigned long )state->regs)[reg];	405	val = READ_ONCE_NOCHECK(((unsigned long )state->regs)[reg]);
406	return true;	406	return true;
407	}	407	}
408		408
409	if (state->prev_regs) {	409	if (state->prev_regs) {
410	val = ((unsigned long )state->prev_regs)[reg];	410	val = READ_ONCE_NOCHECK(((unsigned long )state->prev_regs)[reg]);
411	return true;	411	return true;
412	}	412	}
413		413

arch/x86/kvm/lapic.c+11−1

 	}
 	if (kvm_use_posted_timer_interrupt(apic->vcpu)) {
-		kvm_wait_lapic_expire(vcpu);
+		/*
+		 * Ensure the guest's timer has truly expired before posting an
+		 * interrupt.  Open code the relevant checks to avoid querying
+		 * lapic_timer_int_injected(), which will be false since the
+		 * interrupt isn't yet injected.  Waiting until after injecting
+		 * is not an option since that won't help a posted interrupt.
+		 */
+		if (vcpu->arch.apic->lapic_timer.expired_tscdeadline &&
+		    vcpu->arch.apic->lapic_timer.timer_advance_ns)
+			__kvm_wait_lapic_expire(vcpu);
 		kvm_apic_inject_pending_timer_irqs(apic);
 		return;
 	}
 	apic_update_ppr(apic);
 	hrtimer_cancel(&apic->lapic_timer.timer);
+	apic->lapic_timer.expired_tscdeadline = 0;
 	apic_update_lvtt(apic);
 	apic_manage_nmi_watchdog(apic, kvm_lapic_get_reg(apic, APIC_LVT0));
 	update_divide_count(apic);

arch/x86/kvm/mmu/tdp_mmu.c+11−0

@@ -337,7 +337,18 @@ static void handle_removed_tdp_mmu_page(struct kvm kvm, u64 pt, · 336 unmodified lines
337	cpu_relax();	337	cpu_relax();
338	}	338	}
339	} else {	339	} else {
		340	/*
		341	* If the SPTE is not MMU-present, there is no backing
		342	* page associated with the SPTE and so no side effects
		343	* that need to be recorded, and exclusive ownership of
		344	* mmu_lock ensures the SPTE can't be made present.
		345	* Note, zapping MMIO SPTEs is also unnecessary as they
		346	* are guarded by the memslots generation, not by being
		347	* unreachable.
		348	*/
340	old_child_spte = READ_ONCE(*sptep);	349	old_child_spte = READ_ONCE(*sptep);
		350	if (!is_shadow_present_pte(old_child_spte))
		351	continue;
341		352
342	/*	353	/*
343	* Marking the SPTE as a removed SPTE is not	354	* Marking the SPTE as a removed SPTE is not

arch/x86/kvm/svm/svm.c+13−12

 	{ .index = MSR_INVALID,				.always = false },
 };
-/* enable NPT for AMD64 and X86 with PAE */
-#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
-bool npt_enabled = true;
-#else
-bool npt_enabled;
-#endif
 /*
  * These 2 parameters are used to config the controls for Pause-Loop Exiting:
  * pause_filter_count: On processors that support Pause filtering(indicated
 static unsigned short pause_filter_count_max = KVM_SVM_DEFAULT_PLE_WINDOW_MAX;
 module_param(pause_filter_count_max, ushort, 0444);
-/* allow nested paging (virtualized MMU) for all guests */
+/*
-static int npt = true;
+ * Use nested page tables by default.  Note, NPT may get forced off by
-module_param(npt, int, S_IRUGO);
+ * svm_hardware_setup() if it's unsupported by hardware or the host kernel.
+ */
+bool npt_enabled = true;
+module_param_named(npt, npt_enabled, bool, 0444);
 /* allow nested virtualization in KVM/SVM */
 static int nested = true;
 			goto err;
 	}
-	if (!boot_cpu_has(X86_FEATURE_NPT))
+	/*
+	 * KVM's MMU doesn't support using 2-level paging for itself, and thus
+	 * NPT isn't supported if the host is using 2-level paging since host
+	 * CR4 is unchanged on VMRUN.
+	 */
+	if (!IS_ENABLED(CONFIG_X86_64) && !IS_ENABLED(CONFIG_X86_PAE))
 		npt_enabled = false;
-	if (npt_enabled && !npt)
+	if (!boot_cpu_has(X86_FEATURE_NPT))
 		npt_enabled = false;
 	kvm_configure_mmu(npt_enabled, get_max_npt_level(), PG_LEVEL_1G);

arch/x86/kvm/vmx/vmx.c+1−1

@@ -6580,8 +6580,8 @@ static void atomic_switch_perf_msrs(struct vcpu_vmx *vmx) · 6579 unmodified lines
6580	int i, nr_msrs;	6580	int i, nr_msrs;
6581	struct perf_guest_switch_msr *msrs;	6581	struct perf_guest_switch_msr *msrs;
6582		6582
		6583	/* Note, nr_msrs may be garbage if perf_guest_get_msrs() returns NULL. */
6583	msrs = perf_guest_get_msrs(&nr_msrs);	6584	msrs = perf_guest_get_msrs(&nr_msrs);
6584
6585	if (!msrs)	6585	if (!msrs)
6586	return;	6586	return;
6587		6587

arch/x86/kvm/x86.c+1−1

@@ -10601,7 +10601,7 @@ void __user * __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, · 10600 unmodified lines
10601	return (void __user *)hva;	10601	return (void __user *)hva;
10602	} else {	10602	} else {
10603	if (!slot \|\| !slot->npages)	10603	if (!slot \|\| !slot->npages)
10604	return 0;	10604	return NULL;
10605		10605
10606	old_npages = slot->npages;	10606	old_npages = slot->npages;
10607	hva = slot->userspace_addr;	10607	hva = slot->userspace_addr;

arch/x86/lib/insn-eval.c+52−14

@@ -1415,6 +1415,25 @@ void __user insn_get_addr_ref(struct insn insn, struct pt_regs *regs) · 1414 unmodified lines
1415	}	1415	}
1416	}	1416	}
1417		1417
		1418	static unsigned long insn_get_effective_ip(struct pt_regs *regs)
		1419	{
		1420	unsigned long seg_base = 0;
		1421
		1422	/*
		1423	* If not in user-space long mode, a custom code segment could be in
		1424	* use. This is true in protected mode (if the process defined a local
		1425	* descriptor table), or virtual-8086 mode. In most of the cases
		1426	* seg_base will be zero as in USER_CS.
		1427	*/
		1428	if (!user_64bit_mode(regs)) {
		1429	seg_base = insn_get_seg_base(regs, INAT_SEG_REG_CS);
		1430	if (seg_base == -1L)
		1431	return 0;
		1432	}
		1433
		1434	return seg_base + regs->ip;
		1435	}
		1436
1418	/**	1437	/**
1419	* insn_fetch_from_user() - Copy instruction bytes from user-space memory	1438	* insn_fetch_from_user() - Copy instruction bytes from user-space memory
1420	* @regs: Structure with register values as seen when entering kernel mode	1439	* @regs: Structure with register values as seen when entering kernel mode
@@ -1431,24 +1450,43 @@ void __user insn_get_addr_ref(struct insn insn, struct pt_regs *regs) · 10 unmodified lines
1431	*/	1450	*/
1432	int insn_fetch_from_user(struct pt_regs *regs, unsigned char buf[MAX_INSN_SIZE])	1451	int insn_fetch_from_user(struct pt_regs *regs, unsigned char buf[MAX_INSN_SIZE])
1433	{	1452	{
1434	unsigned long seg_base = 0;	1453	unsigned long ip;
1435	int not_copied;	1454	int not_copied;
1436		1455
1437	/*	1456	ip = insn_get_effective_ip(regs);
1438	* If not in user-space long mode, a custom code segment could be in	1457	if (!ip)
1439	* use. This is true in protected mode (if the process defined a local	1458	return 0;
1440	* descriptor table), or virtual-8086 mode. In most of the cases	1459
1441	* seg_base will be zero as in USER_CS.	1460	not_copied = copy_from_user(buf, (void __user *)ip, MAX_INSN_SIZE);
1442	*/
1443	if (!user_64bit_mode(regs)) {
1444	seg_base = insn_get_seg_base(regs, INAT_SEG_REG_CS);
1445	if (seg_base == -1L)
1446	return 0;
1447	}
1448		1461
		1462	return MAX_INSN_SIZE - not_copied;
		1463	}
		1464
		1465	/**
		1466	* insn_fetch_from_user_inatomic() - Copy instruction bytes from user-space memory
		1467	* while in atomic code
		1468	* @regs: Structure with register values as seen when entering kernel mode
		1469	* @buf: Array to store the fetched instruction
		1470	*
		1471	* Gets the linear address of the instruction and copies the instruction bytes
		1472	* to the buf. This function must be used in atomic context.
		1473	*
		1474	* Returns:
		1475	*
		1476	* Number of instruction bytes copied.
		1477	*
		1478	* 0 if nothing was copied.
		1479	*/
		1480	int insn_fetch_from_user_inatomic(struct pt_regs *regs, unsigned char buf[MAX_INSN_SIZE])
		1481	{
		1482	unsigned long ip;
		1483	int not_copied;
		1484
		1485	ip = insn_get_effective_ip(regs);
		1486	if (!ip)
		1487	return 0;
1449		1488
1450	not_copied = copy_from_user(buf, (void __user *)(seg_base + regs->ip),	1489	not_copied = __copy_from_user_inatomic(buf, (void __user *)ip, MAX_INSN_SIZE);
1451	MAX_INSN_SIZE);
1452		1490
1453	return MAX_INSN_SIZE - not_copied;	1491	return MAX_INSN_SIZE - not_copied;
1454	}	1492	}

arch/x86/net/bpf_jit_comp.c+7−3

 			    insn->imm == (BPF_XOR | BPF_FETCH)) {
 				u8 *branch_target;
 				bool is64 = BPF_SIZE(insn->code) == BPF_DW;
+				u32 real_src_reg = src_reg;
 				/*
 				 * Can't be implemented with a single x86 insn.
 				/* Will need RAX as a CMPXCHG operand so save R0 */
 				emit_mov_reg(&prog, true, BPF_REG_AX, BPF_REG_0);
+				if (src_reg == BPF_REG_0)
+					real_src_reg = BPF_REG_AX;
 				branch_target = prog;
 				/* Load old value */
 				emit_ldx(&prog, BPF_SIZE(insn->code),
 				 * put the result in the AUX_REG.
 				 */
 				emit_mov_reg(&prog, is64, AUX_REG, BPF_REG_0);
-				maybe_emit_mod(&prog, AUX_REG, src_reg, is64);
+				maybe_emit_mod(&prog, AUX_REG, real_src_reg, is64);
 				EMIT2(simple_alu_opcodes[BPF_OP(insn->imm)],
-				      add_2reg(0xC0, AUX_REG, src_reg));
+				      add_2reg(0xC0, AUX_REG, real_src_reg));
 				/* Attempt to swap in new value */
 				err = emit_atomic(&prog, BPF_CMPXCHG,
 						  dst_reg, AUX_REG, insn->off,
 				 */
 				EMIT2(X86_JNE, -(prog - branch_target) - 2);
 				/* Return the pre-modification value */
-				emit_mov_reg(&prog, is64, src_reg, BPF_REG_0);
+				emit_mov_reg(&prog, is64, real_src_reg, BPF_REG_0);
 				/* Restore R0 after clobbering RAX */
 				emit_mov_reg(&prog, true, BPF_REG_0, BPF_REG_AX);
 				break;

arch/x86/xen/p2m.c+2−4

 		map_ops[i].status = GNTST_general_error;
 		unmap[0].host_addr = map_ops[i].host_addr,
 		unmap[0].handle = map_ops[i].handle;
-		map_ops[i].handle = ~0;
+		map_ops[i].handle = INVALID_GRANT_HANDLE;
 		if (map_ops[i].flags & GNTMAP_device_map)
 			unmap[0].dev_bus_addr = map_ops[i].dev_bus_addr;
 		else
 			kmap_ops[i].status = GNTST_general_error;
 			unmap[1].host_addr = kmap_ops[i].host_addr,
 			unmap[1].handle = kmap_ops[i].handle;
-			kmap_ops[i].handle = ~0;
+			kmap_ops[i].handle = INVALID_GRANT_HANDLE;
 			if (kmap_ops[i].flags & GNTMAP_device_map)
 				unmap[1].dev_bus_addr = kmap_ops[i].dev_bus_addr;
 			else
 out:
 	return ret;
 }
-EXPORT_SYMBOL_GPL(set_foreign_p2m_mapping);
 int clear_foreign_p2m_mapping(struct gnttab_unmap_grant_ref *unmap_ops,
 			      struct gnttab_unmap_grant_ref *kunmap_ops,
 	return ret;
 }
-EXPORT_SYMBOL_GPL(clear_foreign_p2m_mapping);
 #ifdef CONFIG_XEN_DEBUG_FS
 #include <linux/debugfs.h>

block/bio.c+7−7

@@ -33,7 +33,7 @@ static struct biovec_slab { · 32 unmodified lines
33	{ .nr_vecs = 16, .name = "biovec-16" },	33	{ .nr_vecs = 16, .name = "biovec-16" },
34	{ .nr_vecs = 64, .name = "biovec-64" },	34	{ .nr_vecs = 64, .name = "biovec-64" },
35	{ .nr_vecs = 128, .name = "biovec-128" },	35	{ .nr_vecs = 128, .name = "biovec-128" },
36	{ .nr_vecs = BIO_MAX_PAGES, .name = "biovec-max" },	36	{ .nr_vecs = BIO_MAX_VECS, .name = "biovec-max" },
37	};	37	};
38		38
39	static struct biovec_slab *biovec_slab(unsigned short nr_vecs)	39	static struct biovec_slab *biovec_slab(unsigned short nr_vecs)
@@ -46,7 +46,7 @@ static struct biovec_slab *biovec_slab(unsigned short nr_vecs) · 6 unmodified lines
46	return &bvec_slabs[1];	46	return &bvec_slabs[1];
47	case 65 ... 128:	47	case 65 ... 128:
48	return &bvec_slabs[2];	48	return &bvec_slabs[2];
49	case 129 ... BIO_MAX_PAGES:	49	case 129 ... BIO_MAX_VECS:
50	return &bvec_slabs[3];	50	return &bvec_slabs[3];
51	default:	51	default:
52	BUG();	52	BUG();
@@ -151,9 +151,9 @@ out: · 98 unmodified lines
151		151
152	void bvec_free(mempool_t pool, struct bio_vec bv, unsigned short nr_vecs)	152	void bvec_free(mempool_t pool, struct bio_vec bv, unsigned short nr_vecs)
153	{	153	{
154	BIO_BUG_ON(nr_vecs > BIO_MAX_PAGES);	154	BIO_BUG_ON(nr_vecs > BIO_MAX_VECS);
155		155
156	if (nr_vecs == BIO_MAX_PAGES)	156	if (nr_vecs == BIO_MAX_VECS)
157	mempool_free(bv, pool);	157	mempool_free(bv, pool);
158	else if (nr_vecs > BIO_INLINE_VECS)	158	else if (nr_vecs > BIO_INLINE_VECS)
159	kmem_cache_free(biovec_slab(nr_vecs)->slab, bv);	159	kmem_cache_free(biovec_slab(nr_vecs)->slab, bv);
@@ -186,15 +186,15 @@ struct bio_vec bvec_alloc(mempool_t pool, unsigned short *nr_vecs, · 26 unmodified lines
186	/*	186	/*
187	* Try a slab allocation first for all smaller allocations. If that	187	* Try a slab allocation first for all smaller allocations. If that
188	* fails and __GFP_DIRECT_RECLAIM is set retry with the mempool.	188	* fails and __GFP_DIRECT_RECLAIM is set retry with the mempool.
189	* The mempool is sized to handle up to BIO_MAX_PAGES entries.	189	* The mempool is sized to handle up to BIO_MAX_VECS entries.
190	*/	190	*/
191	if (*nr_vecs < BIO_MAX_PAGES) {	191	if (*nr_vecs < BIO_MAX_VECS) {
192	struct bio_vec *bvl;	192	struct bio_vec *bvl;
193		193
194	bvl = kmem_cache_alloc(bvs->slab, bvec_alloc_gfp(gfp_mask));	194	bvl = kmem_cache_alloc(bvs->slab, bvec_alloc_gfp(gfp_mask));
195	if (likely(bvl) \|\| !(gfp_mask & __GFP_DIRECT_RECLAIM))	195	if (likely(bvl) \|\| !(gfp_mask & __GFP_DIRECT_RECLAIM))
196	return bvl;	196	return bvl;
197	*nr_vecs = BIO_MAX_PAGES;	197	*nr_vecs = BIO_MAX_VECS;
198	}	198	}
199		199
200	return mempool_alloc(pool, gfp_mask);	200	return mempool_alloc(pool, gfp_mask);

block/blk-cgroup-rwstat.c+2−1

 	lockdep_assert_held(&blkg->q->queue_lock);
+	memset(sum, 0, sizeof(*sum));
 	rcu_read_lock();
 	blkg_for_each_descendant_pre(pos_blkg, pos_css, blkg) {
 		struct blkg_rwstat *rwstat;
 			rwstat = (void *)pos_blkg + off;
 		for (i = 0; i < BLKG_RWSTAT_NR; i++)
-			sum->cnt[i] = blkg_rwstat_read_counter(rwstat, i);
+			sum->cnt[i] += blkg_rwstat_read_counter(rwstat, i);
 	}
 	rcu_read_unlock();
 }

block/blk-crypto-fallback.c+1−1

@@ -219,7 +219,7 @@ static bool blk_crypto_split_bio_if_needed(struct bio **bio_ptr) · 218 unmodified lines
219		219
220	bio_for_each_segment(bv, bio, iter) {	220	bio_for_each_segment(bv, bio, iter) {
221	num_sectors += bv.bv_len >> SECTOR_SHIFT;	221	num_sectors += bv.bv_len >> SECTOR_SHIFT;
222	if (++i == BIO_MAX_PAGES)	222	if (++i == BIO_MAX_VECS)
223	break;	223	break;
224	}	224	}
225	if (num_sectors < bio_sectors(bio)) {	225	if (num_sectors < bio_sectors(bio)) {

block/blk-lib.c+1−1

@@ -296,7 +296,7 @@ static unsigned int __blkdev_sectors_to_bio_pages(sector_t nr_sects) · 295 unmodified lines
296	{	296	{
297	sector_t pages = DIV_ROUND_UP_SECTOR_T(nr_sects, PAGE_SIZE / 512);	297	sector_t pages = DIV_ROUND_UP_SECTOR_T(nr_sects, PAGE_SIZE / 512);
298		298
299	return min(pages, (sector_t)BIO_MAX_PAGES);	299	return min(pages, (sector_t)BIO_MAX_VECS);
300	}	300	}
301		301
302	static int __blkdev_issue_zero_pages(struct block_device *bdev,	302	static int __blkdev_issue_zero_pages(struct block_device *bdev,

block/blk-map.c+1−1

@@ -249,7 +249,7 @@ static int bio_map_user_iov(struct request rq, struct iov_iter iter, · 248 unmodified lines
249	if (!iov_iter_count(iter))	249	if (!iov_iter_count(iter))
250	return -EINVAL;	250	return -EINVAL;
251		251
252	bio = bio_kmalloc(gfp_mask, iov_iter_npages(iter, BIO_MAX_PAGES));	252	bio = bio_kmalloc(gfp_mask, iov_iter_npages(iter, BIO_MAX_VECS));
253	if (!bio)	253	if (!bio)
254	return -ENOMEM;	254	return -ENOMEM;
255	bio->bi_opf \|= req_op(rq);	255	bio->bi_opf \|= req_op(rq);

block/blk-zoned.c+37−3

@@ -240,7 +240,7 @@ int blkdev_zone_mgmt(struct block_device *bdev, enum req_opf op, · 239 unmodified lines
240	*/	240	*/
241	if (op == REQ_OP_ZONE_RESET &&	241	if (op == REQ_OP_ZONE_RESET &&
242	blkdev_allow_reset_all_zones(bdev, sector, nr_sectors)) {	242	blkdev_allow_reset_all_zones(bdev, sector, nr_sectors)) {
243	bio->bi_opf = REQ_OP_ZONE_RESET_ALL;	243	bio->bi_opf = REQ_OP_ZONE_RESET_ALL \| REQ_SYNC;
244	break;	244	break;
245	}	245	}
246		246
@@ -318,6 +318,22 @@ int blkdev_report_zones_ioctl(struct block_device *bdev, fmode_t mode, · 71 unmodified lines
318	return 0;	318	return 0;
319	}	319	}
320		320
		321	static int blkdev_truncate_zone_range(struct block_device *bdev, fmode_t mode,
		322	const struct blk_zone_range *zrange)
		323	{
		324	loff_t start, end;
		325
		326	if (zrange->sector + zrange->nr_sectors <= zrange->sector \|\|
		327	zrange->sector + zrange->nr_sectors > get_capacity(bdev->bd_disk))
		328	/* Out of range */
		329	return -EINVAL;
		330
		331	start = zrange->sector << SECTOR_SHIFT;
		332	end = ((zrange->sector + zrange->nr_sectors) << SECTOR_SHIFT) - 1;
		333
		334	return truncate_bdev_range(bdev, mode, start, end);
		335	}
		336
321	/*	337	/*
322	* BLKRESETZONE, BLKOPENZONE, BLKCLOSEZONE and BLKFINISHZONE ioctl processing.	338	* BLKRESETZONE, BLKOPENZONE, BLKCLOSEZONE and BLKFINISHZONE ioctl processing.
323	* Called from blkdev_ioctl.	339	* Called from blkdev_ioctl.
@@ -329,6 +345,7 @@ int blkdev_zone_mgmt_ioctl(struct block_device *bdev, fmode_t mode, · 5 unmodified lines
329	struct request_queue *q;	345	struct request_queue *q;
330	struct blk_zone_range zrange;	346	struct blk_zone_range zrange;
331	enum req_opf op;	347	enum req_opf op;
		348	int ret;
332		349
333	if (!argp)	350	if (!argp)
334	return -EINVAL;	351	return -EINVAL;
@@ -352,6 +369,11 @@ int blkdev_zone_mgmt_ioctl(struct block_device *bdev, fmode_t mode, · 17 unmodified lines
352	switch (cmd) {	369	switch (cmd) {
353	case BLKRESETZONE:	370	case BLKRESETZONE:
354	op = REQ_OP_ZONE_RESET;	371	op = REQ_OP_ZONE_RESET;
		372
		373	/* Invalidate the page cache, including dirty pages. */
		374	ret = blkdev_truncate_zone_range(bdev, mode, &zrange);
		375	if (ret)
		376	return ret;
355	break;	377	break;
356	case BLKOPENZONE:	378	case BLKOPENZONE:
357	op = REQ_OP_ZONE_OPEN;	379	op = REQ_OP_ZONE_OPEN;
@@ -366,8 +388,20 @@ int blkdev_zone_mgmt_ioctl(struct block_device *bdev, fmode_t mode, · 8 unmodified lines
366	return -ENOTTY;	388	return -ENOTTY;
367	}	389	}
368		390
369	return blkdev_zone_mgmt(bdev, op, zrange.sector, zrange.nr_sectors,	391	ret = blkdev_zone_mgmt(bdev, op, zrange.sector, zrange.nr_sectors,
370	GFP_KERNEL);	392	GFP_KERNEL);
		393
		394	/*
		395	* Invalidate the page cache again for zone reset: writes can only be
		396	* direct for zoned devices so concurrent writes would not add any page
		397	* to the page cache after/during reset. The page cache may be filled
		398	* again due to concurrent reads though and dropping the pages for
		399	* these is fine.
		400	*/
		401	if (!ret && cmd == BLKRESETZONE)
		402	ret = blkdev_truncate_zone_range(bdev, mode, &zrange);
		403
		404	return ret;
371	}	405	}
372		406
373	static inline unsigned long *blk_alloc_zone_bitmap(int node,	407	static inline unsigned long *blk_alloc_zone_bitmap(int node,

block/bounce.c+3−3

block/genhd.c+1−3

@@ -534,10 +534,8 @@ static void register_disk(struct device parent, struct gendisk disk, · 533 unmodified lines
534	kobject_create_and_add("holders", &ddev->kobj);	534	kobject_create_and_add("holders", &ddev->kobj);
535	disk->slave_dir = kobject_create_and_add("slaves", &ddev->kobj);	535	disk->slave_dir = kobject_create_and_add("slaves", &ddev->kobj);
536		536
537	if (disk->flags & GENHD_FL_HIDDEN) {	537	if (disk->flags & GENHD_FL_HIDDEN)
538	dev_set_uevent_suppress(ddev, 0);
539	return;	538	return;
540	}
541		539
542	disk_scan_partitions(disk);	540	disk_scan_partitions(disk);
543		541

crypto/Kconfig+1−1

@@ -767,7 +767,7 @@ config CRYPTO_POLY1305_X86_64 · 766 unmodified lines
767		767
768	config CRYPTO_POLY1305_MIPS	768	config CRYPTO_POLY1305_MIPS
769	tristate "Poly1305 authenticator algorithm (MIPS optimized)"	769	tristate "Poly1305 authenticator algorithm (MIPS optimized)"
770	depends on CPU_MIPS32 \|\| (CPU_MIPS64 && 64BIT)	770	depends on MIPS
771	select CRYPTO_ARCH_HAVE_LIB_POLY1305	771	select CRYPTO_ARCH_HAVE_LIB_POLY1305
772		772
773	config CRYPTO_MD4	773	config CRYPTO_MD4

drivers/atm/eni.c+2−1

@@ -2260,7 +2260,8 @@ out: · 2259 unmodified lines
2260	return rc;	2260	return rc;
2261		2261
2262	err_eni_release:	2262	err_eni_release:
2263	eni_do_release(dev);	2263	dev->phy = NULL;
		2264	iounmap(ENI_DEV(dev)->ioaddr);
2264	err_unregister:	2265	err_unregister:
2265	atm_dev_deregister(dev);	2266	atm_dev_deregister(dev);
2266	err_free_consistent:	2267	err_free_consistent:

drivers/atm/idt77105.c+2−2

@@ -262,7 +262,7 @@ static int idt77105_start(struct atm_dev *dev) · 261 unmodified lines
262	{	262	{
263	unsigned long flags;	263	unsigned long flags;
264		264
265	if (!(dev->dev_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL)))	265	if (!(dev->phy_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL)))
266	return -ENOMEM;	266	return -ENOMEM;
267	PRIV(dev)->dev = dev;	267	PRIV(dev)->dev = dev;
268	spin_lock_irqsave(&idt77105_priv_lock, flags);	268	spin_lock_irqsave(&idt77105_priv_lock, flags);
@@ -337,7 +337,7 @@ static int idt77105_stop(struct atm_dev *dev) · 68 unmodified lines
337	else	337	else
338	idt77105_all = walk->next;	338	idt77105_all = walk->next;
339	dev->phy = NULL;	339	dev->phy = NULL;
340	dev->dev_data = NULL;	340	dev->phy_data = NULL;
341	kfree(walk);	341	kfree(walk);
342	break;	342	break;
343	}	343	}

drivers/atm/lanai.c+4−1

 	conf1_write(lanai);
 #endif
 	iounmap(lanai->base);
+	lanai->base = NULL;
     error_pci:
 	pci_disable_device(lanai->pci);
     error:
 static void lanai_dev_close(struct atm_dev *atmdev)
 {
 	struct lanai_dev *lanai = (struct lanai_dev *) atmdev->dev_data;
+	if (lanai->base==NULL)
+		return;
 	printk(KERN_INFO DEV_LABEL "(itf %d): shutting down interface\n",
 	    lanai->number);
 	lanai_timed_poll_stop(lanai);
 	struct atm_dev *atmdev;
 	int result;
-	lanai = kmalloc(sizeof(*lanai), GFP_KERNEL);
+	lanai = kzalloc(sizeof(*lanai), GFP_KERNEL);
 	if (lanai == NULL) {
 		printk(KERN_ERR DEV_LABEL
 		       ": couldn't allocate dev_data structure!\n");

drivers/atm/uPD98402.c+1−1

@@ -211,7 +211,7 @@ static void uPD98402_int(struct atm_dev *dev) · 210 unmodified lines
211	static int uPD98402_start(struct atm_dev *dev)	211	static int uPD98402_start(struct atm_dev *dev)
212	{	212	{
213	DPRINTK("phy_start\n");	213	DPRINTK("phy_start\n");
214	if (!(dev->dev_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL)))	214	if (!(dev->phy_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL)))
215	return -ENOMEM;	215	return -ENOMEM;
216	spin_lock_init(&PRIV(dev)->lock);	216	spin_lock_init(&PRIV(dev)->lock);
217	memset(&PRIV(dev)->sonet_stats,0,sizeof(struct k_sonet_stats));	217	memset(&PRIV(dev)->sonet_stats,0,sizeof(struct k_sonet_stats));

drivers/base/swnode.c+20−9

 	if (software_node_to_swnode(node))
 		return -EEXIST;
+	if (node->parent && !parent)
+		return -EINVAL;
 	return PTR_ERR_OR_ZERO(swnode_register(node, parent, 0));
 }
 EXPORT_SYMBOL_GPL(software_node_register);
 /**
  * device_add_software_node - Assign software node to a device
  * @dev: The device the software node is meant for.
- * @swnode: The software node.
+ * @node: The software node.
  *
- * This function will register @swnode and make it the secondary firmware node
+ * This function will make @node the secondary firmware node pointer of @dev. If
- * pointer of @dev. If @dev has no primary node, then @swnode will become the primary
+ * @dev has no primary node, then @node will become the primary node. The
- * node.
+ * function will register @node automatically if it wasn't already registered.
  */
-int device_add_software_node(struct device *dev, const struct software_node *swnode)
+int device_add_software_node(struct device *dev, const struct software_node *node)
 {
+	struct swnode *swnode;
 	int ret;
 	/* Only one software node per device. */
 	if (dev_to_swnode(dev))
 		return -EBUSY;
-	ret = software_node_register(swnode);
+	swnode = software_node_to_swnode(node);
-	if (ret)
+	if (swnode) {
-		return ret;
+		kobject_get(&swnode->kobj);
+	} else {
+		ret = software_node_register(node);
+		if (ret)
+			return ret;
+		swnode = software_node_to_swnode(node);
+	}
-	set_secondary_fwnode(dev, software_node_fwnode(swnode));
+	set_secondary_fwnode(dev, &swnode->fwnode);
 	return 0;
 }

drivers/block/drbd/drbd_int.h+1−1

@@ -1324,7 +1324,7 @@ struct bm_extent { · 1323 unmodified lines
1324	* A followup commit may allow even bigger BIO sizes,	1324	* A followup commit may allow even bigger BIO sizes,
1325	* once we thought that through. */	1325	* once we thought that through. */
1326	#define DRBD_MAX_BIO_SIZE (1U << 20)	1326	#define DRBD_MAX_BIO_SIZE (1U << 20)
1327	#if DRBD_MAX_BIO_SIZE > (BIO_MAX_PAGES << PAGE_SHIFT)	1327	#if DRBD_MAX_BIO_SIZE > (BIO_MAX_VECS << PAGE_SHIFT)
1328	#error Architecture not supported: DRBD_MAX_BIO_SIZE > BIO_MAX_SIZE	1328	#error Architecture not supported: DRBD_MAX_BIO_SIZE > BIO_MAX_SIZE
1329	#endif	1329	#endif
1330	#define DRBD_MAX_BIO_SIZE_SAFE (1U << 12) /* Works always = 4k */	1330	#define DRBD_MAX_BIO_SIZE_SAFE (1U << 12) /* Works always = 4k */

drivers/block/rsxx/core.c+1−0

@@ -871,6 +871,7 @@ static int rsxx_pci_probe(struct pci_dev *dev, · 870 unmodified lines
871	card->event_wq = create_singlethread_workqueue(DRIVER_NAME"_event");	871	card->event_wq = create_singlethread_workqueue(DRIVER_NAME"_event");
872	if (!card->event_wq) {	872	if (!card->event_wq) {
873	dev_err(CARD_TO_DEV(card), "Failed card event setup.\n");	873	dev_err(CARD_TO_DEV(card), "Failed card event setup.\n");
		874	st = -ENOMEM;
874	goto failed_event_handler;	875	goto failed_event_handler;
875	}	876	}
876		877

drivers/block/umem.c+4−1

 	if (card->mm_pages[0].desc == NULL ||
 	    card->mm_pages[1].desc == NULL) {
 		dev_printk(KERN_ERR, &card->dev->dev, "alloc failed\n");
+		ret = -ENOMEM;
 		goto failed_alloc;
 	}
 	reset_page(&card->mm_pages[0]);
 	spin_lock_init(&card->lock);
 	card->queue = blk_alloc_queue(NUMA_NO_NODE);
-	if (!card->queue)
+	if (!card->queue) {
+		ret = -ENOMEM;
 		goto failed_alloc;
+	}
 	tasklet_init(&card->tasklet, process_page, (unsigned long)card);

drivers/block/zram/zram_drv.c+11−6

 	struct bio_vec bio_vec;
 	struct page *page;
 	ssize_t ret = len;
-	int mode;
+	int mode, err;
 	unsigned long blk_idx = 0;
 	if (sysfs_streq(buf, "idle"))
 		if (strncmp(buf, PAGE_WB_SIG, sizeof(PAGE_WB_SIG) - 1))
 			return -EINVAL;
-		ret = kstrtol(buf + sizeof(PAGE_WB_SIG) - 1, 10, &index);
+		if (kstrtol(buf + sizeof(PAGE_WB_SIG) - 1, 10, &index) ||
-		if (ret || index >= nr_pages)
+				index >= nr_pages)
 			return -EINVAL;
 		nr_pages = 1;
 		goto release_init_lock;
 	}
-	while (nr_pages--) {
+	for (; nr_pages != 0; index++, nr_pages--) {
 		struct bio_vec bvec;
 		bvec.bv_page = page;
 		 * XXX: A single page IO would be inefficient for write
 		 * but it would be not bad as starter.
 		 */
-		ret = submit_bio_wait(&bio);
+		err = submit_bio_wait(&bio);
-		if (ret) {
+		if (err) {
 			zram_slot_lock(zram, index);
 			zram_clear_flag(zram, index, ZRAM_UNDER_WB);
 			zram_clear_flag(zram, index, ZRAM_IDLE);
 			zram_slot_unlock(zram, index);
+			/*
+			 * Return last IO error unless every IO were
+			 * not suceeded.
+			 */
+			ret = err;
 			continue;
 		}

drivers/char/hw_random/pseries-rng.c+1−2

 	return hwrng_register(&pseries_rng);
 }
-static int pseries_rng_remove(struct vio_dev *dev)
+static void pseries_rng_remove(struct vio_dev *dev)
 {
 	hwrng_unregister(&pseries_rng);
-	return 0;
 }
 static const struct vio_device_id pseries_rng_driver_ids[] = {

drivers/char/tpm/tpm_ibmvtpm.c+1−3

  *
  * Return: Always 0.
  */
-static int tpm_ibmvtpm_remove(struct vio_dev *vdev)
+static void tpm_ibmvtpm_remove(struct vio_dev *vdev)
 {
 	struct tpm_chip *chip = dev_get_drvdata(&vdev->dev);
 	struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev);
 	kfree(ibmvtpm);
 	/* For tpm_ibmvtpm_get_desired_dma */
 	dev_set_drvdata(&vdev->dev, NULL);
-	return 0;
 }
 /**

drivers/cpufreq/cpufreq-dt-platdev.c+2−0

@@ -103,6 +103,8 @@ static const struct of_device_id whitelist[] __initconst = { · 102 unmodified lines
103	static const struct of_device_id blacklist[] __initconst = {	103	static const struct of_device_id blacklist[] __initconst = {
104	{ .compatible = "allwinner,sun50i-h6", },	104	{ .compatible = "allwinner,sun50i-h6", },
105		105
		106	{ .compatible = "arm,vexpress", },
		107
106	{ .compatible = "calxeda,highbank", },	108	{ .compatible = "calxeda,highbank", },
107	{ .compatible = "calxeda,ecx-2000", },	109	{ .compatible = "calxeda,ecx-2000", },
108		110

drivers/cpufreq/qcom-cpufreq-hw.c+3−3

@@ -317,9 +317,9 @@ static int qcom_cpufreq_hw_cpu_init(struct cpufreq_policy *policy) · 316 unmodified lines
317	}	317	}
318		318
319	base = ioremap(res->start, resource_size(res));	319	base = ioremap(res->start, resource_size(res));
320	if (IS_ERR(base)) {	320	if (!base) {
321	dev_err(dev, "failed to map resource %pR\n", res);	321	dev_err(dev, "failed to map resource %pR\n", res);
322	ret = PTR_ERR(base);	322	ret = -ENOMEM;
323	goto release_region;	323	goto release_region;
324	}	324	}
325		325
@@ -374,7 +374,7 @@ static int qcom_cpufreq_hw_cpu_init(struct cpufreq_policy *policy) · 48 unmodified lines
374	error:	374	error:
375	kfree(data);	375	kfree(data);
376	unmap_base:	376	unmap_base:
377	iounmap(data->base);	377	iounmap(base);
378	release_region:	378	release_region:
379	release_mem_region(res->start, resource_size(res));	379	release_mem_region(res->start, resource_size(res));
380	return ret;	380	return ret;

drivers/crypto/nx/nx-842-pseries.c+1−3

 	return ret;
 }
-static int nx842_remove(struct vio_dev *viodev)
+static void nx842_remove(struct vio_dev *viodev)
 {
 	struct nx842_devdata *old_devdata;
 	unsigned long flags;
 	if (old_devdata)
 		kfree(old_devdata->counters);
 	kfree(old_devdata);
-	return 0;
 }
 static const struct vio_device_id nx842_vio_driver_ids[] = {

drivers/crypto/nx/nx.c+1−3

 	return nx_register_algs();
 }
-static int nx_remove(struct vio_dev *viodev)
+static void nx_remove(struct vio_dev *viodev)
 {
 	dev_dbg(&viodev->dev, "entering nx_remove for UA 0x%x\n",
 		viodev->unit_address);
 		nx_unregister_skcipher(&nx_ecb_aes_alg, NX_FC_AES,
 				       NX_MODE_AES_ECB);
 	}
-	return 0;
 }

drivers/firmware/efi/libstub/arm64-stub.c+1−1

@@ -24,7 +24,7 @@ efi_status_t check_platform_features(void) · 23 unmodified lines
24	return EFI_SUCCESS;	24	return EFI_SUCCESS;
25		25
26	tg = (read_cpuid(ID_AA64MMFR0_EL1) >> ID_AA64MMFR0_TGRAN_SHIFT) & 0xf;	26	tg = (read_cpuid(ID_AA64MMFR0_EL1) >> ID_AA64MMFR0_TGRAN_SHIFT) & 0xf;
27	if (tg != ID_AA64MMFR0_TGRAN_SUPPORTED) {	27	if (tg < ID_AA64MMFR0_TGRAN_SUPPORTED_MIN \|\| tg > ID_AA64MMFR0_TGRAN_SUPPORTED_MAX) {
28	if (IS_ENABLED(CONFIG_ARM64_64K_PAGES))	28	if (IS_ENABLED(CONFIG_ARM64_64K_PAGES))
29	efi_err("This 64 KB granular kernel is not supported by your CPU\n");	29	efi_err("This 64 KB granular kernel is not supported by your CPU\n");
30	else	30	else

drivers/firmware/efi/libstub/efi-stub.c+16−0

@@ -96,6 +96,18 @@ static void install_memreserve_table(void) · 95 unmodified lines
96	efi_err("Failed to install memreserve config table!\n");	96	efi_err("Failed to install memreserve config table!\n");
97	}	97	}
98		98
		99	static u32 get_supported_rt_services(void)
		100	{
		101	const efi_rt_properties_table_t *rt_prop_table;
		102	u32 supported = EFI_RT_SUPPORTED_ALL;
		103
		104	rt_prop_table = get_efi_config_table(EFI_RT_PROPERTIES_TABLE_GUID);
		105	if (rt_prop_table)
		106	supported &= rt_prop_table->runtime_services_supported;
		107
		108	return supported;
		109	}
		110
99	/*	111	/*
100	* EFI entry point for the arm/arm64 EFI stubs. This is the entrypoint	112	* EFI entry point for the arm/arm64 EFI stubs. This is the entrypoint
101	* that is described in the PE/COFF header. Most of the code is the same	113	* that is described in the PE/COFF header. Most of the code is the same
@@ -250,6 +262,10 @@ efi_status_t __efiapi efi_pe_entry(efi_handle_t handle, · 148 unmodified lines
250	(prop_tbl->memory_protection_attribute &	262	(prop_tbl->memory_protection_attribute &
251	EFI_PROPERTIES_RUNTIME_MEMORY_PROTECTION_NON_EXECUTABLE_PE_DATA);	263	EFI_PROPERTIES_RUNTIME_MEMORY_PROTECTION_NON_EXECUTABLE_PE_DATA);
252		264
		265	/* force efi_novamap if SetVirtualAddressMap() is unsupported */
		266	efi_novamap \|= !(get_supported_rt_services() &
		267	EFI_RT_SUPPORTED_SET_VIRTUAL_ADDRESS_MAP);
		268
253	/* hibernation expects the runtime regions to stay in the same place */	269	/* hibernation expects the runtime regions to stay in the same place */
254	if (!IS_ENABLED(CONFIG_HIBERNATION) && !efi_nokaslr && !flat_va_mapping) {	270	if (!IS_ENABLED(CONFIG_HIBERNATION) && !efi_nokaslr && !flat_va_mapping) {
255	/*	271	/*

drivers/gpio/gpio-pca953x.c+23−55

@@ -113,8 +113,29 @@ MODULE_DEVICE_TABLE(i2c, pca953x_id); · 112 unmodified lines
113	#ifdef CONFIG_GPIO_PCA953X_IRQ	113	#ifdef CONFIG_GPIO_PCA953X_IRQ
114		114
115	#include <linux/dmi.h>	115	#include <linux/dmi.h>
116	#include <linux/gpio.h>	116
117	#include <linux/list.h>	117	static const struct acpi_gpio_params pca953x_irq_gpios = { 0, 0, true };
		118
		119	static const struct acpi_gpio_mapping pca953x_acpi_irq_gpios[] = {
		120	{ "irq-gpios", &pca953x_irq_gpios, 1, ACPI_GPIO_QUIRK_ABSOLUTE_NUMBER },
		121	{ }
		122	};
		123
		124	static int pca953x_acpi_get_irq(struct device *dev)
		125	{
		126	int ret;
		127
		128	ret = devm_acpi_dev_add_driver_gpios(dev, pca953x_acpi_irq_gpios);
		129	if (ret)
		130	dev_warn(dev, "can't add GPIO ACPI mapping\n");
		131
		132	ret = acpi_dev_gpio_irq_get_by(ACPI_COMPANION(dev), "irq-gpios", 0);
		133	if (ret < 0)
		134	return ret;
		135
		136	dev_info(dev, "ACPI interrupt quirk (IRQ %d)\n", ret);
		137	return ret;
		138	}
118		139
119	static const struct dmi_system_id pca953x_dmi_acpi_irq_info[] = {	140	static const struct dmi_system_id pca953x_dmi_acpi_irq_info[] = {
120	{	141	{
@@ -133,59 +154,6 @@ static const struct dmi_system_id pca953x_dmi_acpi_irq_info[] = { · 12 unmodified lines
133	},	154	},
134	{}	155	{}
135	};	156	};
136
137	#ifdef CONFIG_ACPI
138	static int pca953x_acpi_get_pin(struct acpi_resource ares, void data)
139	{
140	struct acpi_resource_gpio *agpio;
141	int *pin = data;
142
143	if (acpi_gpio_get_irq_resource(ares, &agpio))
144	*pin = agpio->pin_table[0];
145	return 1;
146	}
147
148	static int pca953x_acpi_find_pin(struct device *dev)
149	{
150	struct acpi_device *adev = ACPI_COMPANION(dev);
151	int pin = -ENOENT, ret;
152	LIST_HEAD(r);
153
154	ret = acpi_dev_get_resources(adev, &r, pca953x_acpi_get_pin, &pin);
155	acpi_dev_free_resource_list(&r);
156	if (ret < 0)
157	return ret;
158
159	return pin;
160	}
161	#else
162	static inline int pca953x_acpi_find_pin(struct device *dev) { return -ENXIO; }
163	#endif
164
165	static int pca953x_acpi_get_irq(struct device *dev)
166	{
167	int pin, ret;
168
169	pin = pca953x_acpi_find_pin(dev);
170	if (pin < 0)
171	return pin;
172
173	dev_info(dev, "Applying ACPI interrupt quirk (GPIO %d)\n", pin);
174
175	if (!gpio_is_valid(pin))
176	return -EINVAL;
177
178	ret = gpio_request(pin, "pca953x interrupt");
179	if (ret)
180	return ret;
181
182	ret = gpio_to_irq(pin);
183
184	/* When pin is used as an IRQ, no need to keep it requested */
185	gpio_free(pin);
186
187	return ret;
188	}
189	#endif	157	#endif
190		158
191	static const struct acpi_device_id pca953x_acpi_ids[] = {	159	static const struct acpi_device_id pca953x_acpi_ids[] = {

drivers/gpio/gpiolib-acpi.c+15−6

 	int ret, value;
 	ret = request_threaded_irq(event->irq, NULL, event->handler,
-				   event->irqflags, "ACPI:Event", event);
+				   event->irqflags | IRQF_ONESHOT, "ACPI:Event", event);
 	if (ret) {
 		dev_err(acpi_gpio->chip->parent,
 			"Failed to setup interrupt handler for %d\n",
 	if (!lookup->desc) {
 		const struct acpi_resource_gpio *agpio = &ares->data.gpio;
 		bool gpioint = agpio->connection_type == ACPI_RESOURCE_GPIO_TYPE_INT;
+		struct gpio_desc *desc;
 		u16 pin_index;
 		if (lookup->info.quirks & ACPI_GPIO_QUIRK_ONLY_GPIOIO && gpioint)
 		if (pin_index >= agpio->pin_table_length)
 			return 1;
-		lookup->desc = acpi_get_gpiod(agpio->resource_source.string_ptr,
+		if (lookup->info.quirks & ACPI_GPIO_QUIRK_ABSOLUTE_NUMBER)
+			desc = gpio_to_desc(agpio->pin_table[pin_index]);
+		else
+			desc = acpi_get_gpiod(agpio->resource_source.string_ptr,
 					      agpio->pin_table[pin_index]);
+		lookup->desc = desc;
 		lookup->info.pin_config = agpio->pin_config;
 		lookup->info.debounce = agpio->debounce_timeout;
 		lookup->info.gpioint = gpioint;
 }
 /**
- * acpi_dev_gpio_irq_get() - Find GpioInt and translate it to Linux IRQ number
+ * acpi_dev_gpio_irq_get_by() - Find GpioInt and translate it to Linux IRQ number
  * @adev: pointer to a ACPI device to get IRQ from
+ * @name: optional name of GpioInt resource
  * @index: index of GpioInt resource (starting from %0)
  *
  * If the device has one or more GpioInt resources, this function can be
  * The function is idempotent, though each time it runs it will configure GPIO
  * pin direction according to the flags in GpioInt resource.
  *
+ * The function takes optional @name parameter. If the resource has a property
+ * name, then only those will be taken into account.
+ *
  * Return: Linux IRQ number (> %0) on success, negative errno on failure.
  */
-int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index)
+int acpi_dev_gpio_irq_get_by(struct acpi_device *adev, const char *name, int index)
 {
 	int idx, i;
 	unsigned int irq_flags;
 		struct acpi_gpio_info info;
 		struct gpio_desc *desc;
-		desc = acpi_get_gpiod_by_index(adev, NULL, i, &info);
+		desc = acpi_get_gpiod_by_index(adev, name, i, &info);
 		/* Ignore -EPROBE_DEFER, it only matters if idx matches */
 		if (IS_ERR(desc) && PTR_ERR(desc) != -EPROBE_DEFER)
 	}
 	return -ENOENT;
 }
-EXPORT_SYMBOL_GPL(acpi_dev_gpio_irq_get);
+EXPORT_SYMBOL_GPL(acpi_dev_gpio_irq_get_by);
 static acpi_status
 acpi_gpio_adr_space_handler(u32 function, acpi_physical_address address,

drivers/gpio/gpiolib.c+9−10

  *
  * Looks for device property "gpio-line-names" and if it exists assigns
  * GPIO line names for the chip. The memory allocated for the assigned
- * names belong to the underlying software node and should not be released
+ * names belong to the underlying firmware node and should not be released
  * by the caller.
  */
 static int devprop_gpiochip_set_names(struct gpio_chip *chip)
 {
 	struct gpio_device *gdev = chip->gpiodev;
-	struct device *dev = chip->parent;
+	struct fwnode_handle *fwnode = dev_fwnode(&gdev->dev);
 	const char **names;
 	int ret, i;
 	int count;
-	/* GPIO chip may not have a parent device whose properties we inspect. */
+	count = fwnode_property_string_array_count(fwnode, "gpio-line-names");
-	if (!dev)
-		return 0;
-	count = device_property_string_array_count(dev, "gpio-line-names");
 	if (count < 0)
 		return 0;
 	if (!names)
 		return -ENOMEM;
-	ret = device_property_read_string_array(dev, "gpio-line-names",
+	ret = fwnode_property_read_string_array(fwnode, "gpio-line-names",
 						names, count);
 	if (ret < 0) {
 		dev_warn(&gdev->dev, "failed to read GPIO line names\n");
 static void gpiodevice_release(struct device *dev)
 {
-	struct gpio_device *gdev = dev_get_drvdata(dev);
+	struct gpio_device *gdev = container_of(dev, struct gpio_device, dev);
+	unsigned long flags;
+	spin_lock_irqsave(&gpio_lock, flags);
 	list_del(&gdev->list);
+	spin_unlock_irqrestore(&gpio_lock, flags);
 	ida_free(&gpio_ida, gdev->id);
 	kfree_const(gdev->label);
 	kfree(gdev->descs);
 		goto err_free_ida;
 	device_initialize(&gdev->dev);
-	dev_set_drvdata(&gdev->dev, gdev);
 	if (gc->parent && gc->parent->driver)
 		gdev->owner = gc->parent->driver->owner;
 	else if (gc->owner)

drivers/gpu/drm/Kconfig+1−0

@@ -228,6 +228,7 @@ source "drivers/gpu/drm/arm/Kconfig" · 227 unmodified lines
228	config DRM_RADEON	228	config DRM_RADEON
229	tristate "ATI Radeon"	229	tristate "ATI Radeon"
230	depends on DRM && PCI && MMU	230	depends on DRM && PCI && MMU
		231	depends on AGP \|\| !AGP
231	select FW_LOADER	232	select FW_LOADER
232	select DRM_KMS_HELPER	233	select DRM_KMS_HELPER
233	select DRM_TTM	234	select DRM_TTM

drivers/gpu/drm/amd/amdgpu/amdgpu.h+1−0

@@ -180,6 +180,7 @@ extern uint amdgpu_smu_memory_pool_size; · 179 unmodified lines
180	extern uint amdgpu_dc_feature_mask;	180	extern uint amdgpu_dc_feature_mask;
181	extern uint amdgpu_dc_debug_mask;	181	extern uint amdgpu_dc_debug_mask;
182	extern uint amdgpu_dm_abm_level;	182	extern uint amdgpu_dm_abm_level;
		183	extern int amdgpu_backlight;
183	extern struct amdgpu_mgpu_info mgpu_info;	184	extern struct amdgpu_mgpu_info mgpu_info;
184	extern int amdgpu_ras_enable;	185	extern int amdgpu_ras_enable;
185	extern uint amdgpu_ras_mask;	186	extern uint amdgpu_ras_mask;

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+1−1

@@ -903,7 +903,7 @@ void amdgpu_acpi_fini(struct amdgpu_device *adev) · 902 unmodified lines
903	*/	903	*/
904	bool amdgpu_acpi_is_s0ix_supported(struct amdgpu_device *adev)	904	bool amdgpu_acpi_is_s0ix_supported(struct amdgpu_device *adev)
905	{	905	{
906	#if defined(CONFIG_AMD_PMC)	906	#if defined(CONFIG_AMD_PMC) \|\| defined(CONFIG_AMD_PMC_MODULE)
907	if (acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0) {	907	if (acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0) {
908	if (adev->flags & AMD_IS_APU)	908	if (adev->flags & AMD_IS_APU)
909	return true;	909	return true;

drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c+4−0

 MODULE_PARM_DESC(abmlevel, "ABM level (0 = off (default), 1-4 = backlight reduction level) ");
 module_param_named(abmlevel, amdgpu_dm_abm_level, uint, 0444);
+int amdgpu_backlight = -1;
+MODULE_PARM_DESC(backlight, "Backlight control (0 = pwm, 1 = aux, -1 auto (default))");
+module_param_named(backlight, amdgpu_backlight, bint, 0444);
 /**
  * DOC: tmz (int)
  * Trusted Memory Zone (TMZ) is a method to protect data being written

drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c+1−1

@@ -146,7 +146,7 @@ static int amdgpufb_create_pinned_object(struct amdgpu_fbdev *rfbdev, · 145 unmodified lines
146	size = mode_cmd->pitches[0] * height;	146	size = mode_cmd->pitches[0] * height;
147	aligned_size = ALIGN(size, PAGE_SIZE);	147	aligned_size = ALIGN(size, PAGE_SIZE);
148	ret = amdgpu_gem_object_create(adev, aligned_size, 0, domain, flags,	148	ret = amdgpu_gem_object_create(adev, aligned_size, 0, domain, flags,
149	ttm_bo_type_kernel, NULL, &gobj);	149	ttm_bo_type_device, NULL, &gobj);
150	if (ret) {	150	if (ret) {
151	pr_err("failed to allocate framebuffer (%d)\n", aligned_size);	151	pr_err("failed to allocate framebuffer (%d)\n", aligned_size);
152	return -ENOMEM;	152	return -ENOMEM;

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c+30−20

@@ -2267,6 +2267,11 @@ static void update_connector_ext_caps(struct amdgpu_dm_connector *aconnector) · 2266 unmodified lines
2267	caps->ext_caps->bits.hdr_aux_backlight_control == 1)	2267	caps->ext_caps->bits.hdr_aux_backlight_control == 1)
2268	caps->aux_support = true;	2268	caps->aux_support = true;
2269		2269
		2270	if (amdgpu_backlight == 0)
		2271	caps->aux_support = false;
		2272	else if (amdgpu_backlight == 1)
		2273	caps->aux_support = true;
		2274
2270	/* From the specification (CTA-861-G), for calculating the maximum	2275	/* From the specification (CTA-861-G), for calculating the maximum
2271	* luminance we need to use:	2276	* luminance we need to use:
2272	* Luminance = 502*(CV/32)	2277	* Luminance = 502*(CV/32)
@@ -3185,19 +3190,6 @@ static void amdgpu_dm_update_backlight_caps(struct amdgpu_display_manager *dm) · 912 unmodified lines
3185	#endif	3190	#endif
3186	}	3191	}
3187		3192
3188	static int set_backlight_via_aux(struct dc_link *link, uint32_t brightness)
3189	{
3190	bool rc;
3191
3192	if (!link)
3193	return 1;
3194
3195	rc = dc_link_set_backlight_level_nits(link, true, brightness,
3196	AUX_BL_DEFAULT_TRANSITION_TIME_MS);
3197
3198	return rc ? 0 : 1;
3199	}
3200
3201	static int get_brightness_range(const struct amdgpu_dm_backlight_caps *caps,	3193	static int get_brightness_range(const struct amdgpu_dm_backlight_caps *caps,
3202	unsigned min, unsigned max)	3194	unsigned min, unsigned max)
3203	{	3195	{
@@ -3260,9 +3252,10 @@ static int amdgpu_dm_backlight_update_status(struct backlight_device *bd) · 56 unmodified lines
3260	brightness = convert_brightness_from_user(&caps, bd->props.brightness);	3252	brightness = convert_brightness_from_user(&caps, bd->props.brightness);
3261	// Change brightness based on AUX property	3253	// Change brightness based on AUX property
3262	if (caps.aux_support)	3254	if (caps.aux_support)
3263	return set_backlight_via_aux(link, brightness);	3255	rc = dc_link_set_backlight_level_nits(link, true, brightness,
3264		3256	AUX_BL_DEFAULT_TRANSITION_TIME_MS);
3265	rc = dc_link_set_backlight_level(dm->backlight_link, brightness, 0);	3257	else
		3258	rc = dc_link_set_backlight_level(dm->backlight_link, brightness, 0);
3266		3259
3267	return rc ? 0 : 1;	3260	return rc ? 0 : 1;
3268	}	3261	}
@@ -3270,11 +3263,27 @@ static int amdgpu_dm_backlight_update_status(struct backlight_device *bd) · 1 unmodified line
3270	static int amdgpu_dm_backlight_get_brightness(struct backlight_device *bd)	3263	static int amdgpu_dm_backlight_get_brightness(struct backlight_device *bd)
3271	{	3264	{
3272	struct amdgpu_display_manager *dm = bl_get_data(bd);	3265	struct amdgpu_display_manager *dm = bl_get_data(bd);
3273	int ret = dc_link_get_backlight_level(dm->backlight_link);	3266	struct amdgpu_dm_backlight_caps caps;
		3267
		3268	amdgpu_dm_update_backlight_caps(dm);
		3269	caps = dm->backlight_caps;
		3270
		3271	if (caps.aux_support) {
		3272	struct dc_link link = (struct dc_link )dm->backlight_link;
		3273	u32 avg, peak;
		3274	bool rc;
3274		3275
3275	if (ret == DC_ERROR_UNEXPECTED)	3276	rc = dc_link_get_backlight_level_nits(link, &avg, &peak);
3276	return bd->props.brightness;	3277	if (!rc)
3277	return convert_brightness_to_user(&dm->backlight_caps, ret);	3278	return bd->props.brightness;
		3279	return convert_brightness_to_user(&caps, avg);
		3280	} else {
		3281	int ret = dc_link_get_backlight_level(dm->backlight_link);
		3282
		3283	if (ret == DC_ERROR_UNEXPECTED)
		3284	return bd->props.brightness;
		3285	return convert_brightness_to_user(&caps, ret);
		3286	}
3278	}	3287	}
3279		3288
3280	static const struct backlight_ops amdgpu_dm_backlight_ops = {	3289	static const struct backlight_ops amdgpu_dm_backlight_ops = {
@@ -4716,6 +4725,7 @@ static int fill_dc_plane_attributes(struct amdgpu_device *adev, · 1435 unmodified lines
4716	dc_plane_state->global_alpha_value = plane_info.global_alpha_value;	4725	dc_plane_state->global_alpha_value = plane_info.global_alpha_value;
4717	dc_plane_state->dcc = plane_info.dcc;	4726	dc_plane_state->dcc = plane_info.dcc;
4718	dc_plane_state->layer_index = plane_info.layer_index; // Always returns 0	4727	dc_plane_state->layer_index = plane_info.layer_index; // Always returns 0
		4728	dc_plane_state->flip_int_enabled = true;
4719		4729
4720	/*	4730	/*
4721	* Always set input transfer function, since plane state is refreshed	4731	* Always set input transfer function, since plane state is refreshed

drivers/gpu/drm/amd/display/dc/core/dc_link.c+0−1

@@ -2602,7 +2602,6 @@ bool dc_link_set_backlight_level(const struct dc_link *link, · 2601 unmodified lines
2602	if (pipe_ctx->plane_state == NULL)	2602	if (pipe_ctx->plane_state == NULL)
2603	frame_ramp = 0;	2603	frame_ramp = 0;
2604	} else {	2604	} else {
2605	ASSERT(false);
2606	return false;	2605	return false;
2607	}	2606	}
2608		2607

drivers/gpu/drm/amd/display/dc/dc.h+1−0

@@ -887,6 +887,7 @@ struct dc_plane_state { · 886 unmodified lines
887	int layer_index;	887	int layer_index;
888		888
889	union surface_update_flags update_flags;	889	union surface_update_flags update_flags;
		890	bool flip_int_enabled;
890	/* private to DC core */	891	/* private to DC core */
891	struct dc_plane_status status;	892	struct dc_plane_status status;
892	struct dc_context *ctx;	893	struct dc_context *ctx;

drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c+11−0

 	REG_UPDATE(DCHUBP_CNTL, HUBP_DISABLE, reset ? 1 : 0);
 }
+void hubp1_set_flip_int(struct hubp *hubp)
+{
+	struct dcn10_hubp *hubp1 = TO_DCN10_HUBP(hubp);
+	REG_UPDATE(DCSURF_SURFACE_FLIP_INTERRUPT,
+		SURFACE_FLIP_INT_MASK, 1);
+	return;
+}
 void hubp1_init(struct hubp *hubp)
 {
 	//do nothing
 	.dmdata_load = NULL,
 	.hubp_soft_reset = hubp1_soft_reset,
 	.hubp_in_blank = hubp1_in_blank,
+	.hubp_set_flip_int = hubp1_set_flip_int,
 };
 /*****************************************/

drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.h+6−0

 	SRI(DCSURF_SURFACE_EARLIEST_INUSE_C, HUBPREQ, id),\
 	SRI(DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C, HUBPREQ, id),\
 	SRI(DCSURF_SURFACE_CONTROL, HUBPREQ, id),\
+	SRI(DCSURF_SURFACE_FLIP_INTERRUPT, HUBPREQ, id),\
 	SRI(HUBPRET_CONTROL, HUBPRET, id),\
 	SRI(DCN_EXPANSION_MODE, HUBPREQ, id),\
 	SRI(DCHUBP_REQ_SIZE_CONFIG, HUBP, id),\
 	uint32_t DCSURF_SURFACE_EARLIEST_INUSE_C; \
 	uint32_t DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C; \
 	uint32_t DCSURF_SURFACE_CONTROL; \
+	uint32_t DCSURF_SURFACE_FLIP_INTERRUPT; \
 	uint32_t HUBPRET_CONTROL; \
 	uint32_t DCN_EXPANSION_MODE; \
 	uint32_t DCHUBP_REQ_SIZE_CONFIG; \
 	HUBP_SF(HUBPREQ0_DCSURF_SURFACE_CONTROL, SECONDARY_META_SURFACE_TMZ_C, mask_sh),\
 	HUBP_SF(HUBPREQ0_DCSURF_SURFACE_CONTROL, SECONDARY_SURFACE_DCC_EN, mask_sh),\
 	HUBP_SF(HUBPREQ0_DCSURF_SURFACE_CONTROL, SECONDARY_SURFACE_DCC_IND_64B_BLK, mask_sh),\
+	HUBP_SF(HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT, SURFACE_FLIP_INT_MASK, mask_sh),\
 	HUBP_SF(HUBPRET0_HUBPRET_CONTROL, DET_BUF_PLANE1_BASE_ADDRESS, mask_sh),\
 	HUBP_SF(HUBPRET0_HUBPRET_CONTROL, CROSSBAR_SRC_CB_B, mask_sh),\
 	HUBP_SF(HUBPRET0_HUBPRET_CONTROL, CROSSBAR_SRC_CR_R, mask_sh),\
 	type PRIMARY_SURFACE_DCC_IND_64B_BLK;\
 	type SECONDARY_SURFACE_DCC_EN;\
 	type SECONDARY_SURFACE_DCC_IND_64B_BLK;\
+	type SURFACE_FLIP_INT_MASK;\
 	type DET_BUF_PLANE1_BASE_ADDRESS;\
 	type CROSSBAR_SRC_CB_B;\
 	type CROSSBAR_SRC_CR_R;\
 bool hubp1_in_blank(struct hubp *hubp);
 void hubp1_soft_reset(struct hubp *hubp, bool reset);
+void hubp1_set_flip_int(struct hubp *hubp);
 #endif

drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c+7−0

@@ -2196,6 +2196,13 @@ static void dcn10_enable_plane( · 2195 unmodified lines
2196	if (dc->debug.sanity_checks) {	2196	if (dc->debug.sanity_checks) {
2197	hws->funcs.verify_allow_pstate_change_high(dc);	2197	hws->funcs.verify_allow_pstate_change_high(dc);
2198	}	2198	}
		2199
		2200	if (!pipe_ctx->top_pipe
		2201	&& pipe_ctx->plane_state
		2202	&& pipe_ctx->plane_state->flip_int_enabled
		2203	&& pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int)
		2204	pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int(pipe_ctx->plane_res.hubp);
		2205
2199	}	2206	}
2200		2207
2201	void dcn10_program_gamut_remap(struct pipe_ctx *pipe_ctx)	2208	void dcn10_program_gamut_remap(struct pipe_ctx *pipe_ctx)

drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c+1−0

@@ -1597,6 +1597,7 @@ static struct hubp_funcs dcn20_hubp_funcs = { · 1596 unmodified lines
1597	.validate_dml_output = hubp2_validate_dml_output,	1597	.validate_dml_output = hubp2_validate_dml_output,
1598	.hubp_in_blank = hubp1_in_blank,	1598	.hubp_in_blank = hubp1_in_blank,
1599	.hubp_soft_reset = hubp1_soft_reset,	1599	.hubp_soft_reset = hubp1_soft_reset,
		1600	.hubp_set_flip_int = hubp1_set_flip_int,
1600	};	1601	};
1601		1602
1602		1603

drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c+6−0

 		pipe_ctx->plane_res.hubp->funcs->hubp_set_vm_system_aperture_settings(pipe_ctx->plane_res.hubp, &apt);
 	}
+	if (!pipe_ctx->top_pipe
+		&& pipe_ctx->plane_state
+		&& pipe_ctx->plane_state->flip_int_enabled
+		&& pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int)
+			pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int(pipe_ctx->plane_res.hubp);
 //	if (dc->debug.sanity_checks) {
 //		dcn10_verify_allow_pstate_change_high(dc);
 //	}

drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c+1−0

@@ -838,6 +838,7 @@ static struct hubp_funcs dcn21_hubp_funcs = { · 837 unmodified lines
838	.hubp_set_flip_control_surface_gsl = hubp2_set_flip_control_surface_gsl,	838	.hubp_set_flip_control_surface_gsl = hubp2_set_flip_control_surface_gsl,
839	.hubp_init = hubp21_init,	839	.hubp_init = hubp21_init,
840	.validate_dml_output = hubp21_validate_dml_output,	840	.validate_dml_output = hubp21_validate_dml_output,
		841	.hubp_set_flip_int = hubp1_set_flip_int,
841	};	842	};
842		843
843	bool hubp21_construct(	844	bool hubp21_construct(

drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c+2−6

 	.num_banks = 8,
 	.num_chans = 4,
 	.vmm_page_size_bytes = 4096,
-	.dram_clock_change_latency_us = 11.72,
+	.dram_clock_change_latency_us = 23.84,
 	.return_bus_width_bytes = 64,
 	.dispclk_dppclk_vco_speed_mhz = 3600,
 	.xfc_bus_transport_time_us = 4,
 {
 	int i;
-	DC_FP_START();
 	if (dc->bb_overrides.sr_exit_time_ns) {
 		for (i = 0; i < WM_SET_COUNT; i++) {
 			  dc->clk_mgr->bw_params->wm_table.entries[i].sr_exit_time_us =
 				dc->bb_overrides.dram_clock_change_latency_ns / 1000.0;
 		}
 	}
-	DC_FP_END();
 }
 void dcn21_calculate_wm(
 	int vlevel = 0;
 	int pipe_split_from[MAX_PIPES];
 	int pipe_cnt = 0;
-	display_e2e_pipe_params_st *pipes = kzalloc(dc->res_pool->pipe_count * sizeof(display_e2e_pipe_params_st), GFP_KERNEL);
+	display_e2e_pipe_params_st *pipes = kzalloc(dc->res_pool->pipe_count * sizeof(display_e2e_pipe_params_st), GFP_ATOMIC);
 	DC_LOGGER_INIT(dc->ctx->logger);
 	BW_VAL_TRACE_COUNT();

drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c+1−0

@@ -511,6 +511,7 @@ static struct hubp_funcs dcn30_hubp_funcs = { · 510 unmodified lines
511	.hubp_init = hubp3_init,	511	.hubp_init = hubp3_init,
512	.hubp_in_blank = hubp1_in_blank,	512	.hubp_in_blank = hubp1_in_blank,
513	.hubp_soft_reset = hubp1_soft_reset,	513	.hubp_soft_reset = hubp1_soft_reset,
		514	.hubp_set_flip_int = hubp1_set_flip_int,
514	};	515	};
515		516
516	bool hubp3_construct(	517	bool hubp3_construct(

drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c+31−0

@@ -2508,6 +2508,19 @@ static const struct resource_funcs dcn30_res_pool_funcs = { · 2507 unmodified lines
2508	.patch_unknown_plane_state = dcn20_patch_unknown_plane_state,	2508	.patch_unknown_plane_state = dcn20_patch_unknown_plane_state,
2509	};	2509	};
2510		2510
		2511	#define CTX ctx
		2512
		2513	#define REG(reg_name) \
		2514	(DCN_BASE.instance[0].segment[mm ## reg_name ## _BASE_IDX] + mm ## reg_name)
		2515
		2516	static uint32_t read_pipe_fuses(struct dc_context *ctx)
		2517	{
		2518	uint32_t value = REG_READ(CC_DC_PIPE_DIS);
		2519	/* Support for max 6 pipes */
		2520	value = value & 0x3f;
		2521	return value;
		2522	}
		2523
2511	static bool dcn30_resource_construct(	2524	static bool dcn30_resource_construct(
2512	uint8_t num_virtual_links,	2525	uint8_t num_virtual_links,
2513	struct dc *dc,	2526	struct dc *dc,
@@ -2517,6 +2530,15 @@ static bool dcn30_resource_construct( · 3 unmodified lines
2517	struct dc_context *ctx = dc->ctx;	2530	struct dc_context *ctx = dc->ctx;
2518	struct irq_service_init_data init_data;	2531	struct irq_service_init_data init_data;
2519	struct ddc_service_init_data ddc_init_data;	2532	struct ddc_service_init_data ddc_init_data;
		2533	uint32_t pipe_fuses = read_pipe_fuses(ctx);
		2534	uint32_t num_pipes = 0;
		2535
		2536	if (!(pipe_fuses == 0 \|\| pipe_fuses == 0x3e)) {
		2537	BREAK_TO_DEBUGGER();
		2538	dm_error("DC: Unexpected fuse recipe for navi2x !\n");
		2539	/* fault to single pipe */
		2540	pipe_fuses = 0x3e;
		2541	}
2520		2542
2521	DC_FP_START();	2543	DC_FP_START();
2522		2544
@@ -2650,6 +2672,15 @@ static bool dcn30_resource_construct( · 127 unmodified lines
2650	/* PP Lib and SMU interfaces */	2672	/* PP Lib and SMU interfaces */
2651	init_soc_bounding_box(dc, pool);	2673	init_soc_bounding_box(dc, pool);
2652		2674
		2675	num_pipes = dcn3_0_ip.max_num_dpp;
		2676
		2677	for (i = 0; i < dcn3_0_ip.max_num_dpp; i++)
		2678	if (pipe_fuses & 1 << i)
		2679	num_pipes--;
		2680
		2681	dcn3_0_ip.max_num_dpp = num_pipes;
		2682	dcn3_0_ip.max_num_otg = num_pipes;
		2683
2653	dml_init_instance(&dc->dml, &dcn3_0_soc, &dcn3_0_ip, DML_PROJECT_DCN30);	2684	dml_init_instance(&dc->dml, &dcn3_0_soc, &dcn3_0_ip, DML_PROJECT_DCN30);
2654		2685
2655	/* IRQ */	2686	/* IRQ */

drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c+95−1

@@ -1619,12 +1619,106 @@ static void dcn301_update_bw_bounding_box(struct dc dc, struct clk_bw_params b · 1618 unmodified lines
1619	dml_init_instance(&dc->dml, &dcn3_01_soc, &dcn3_01_ip, DML_PROJECT_DCN30);	1619	dml_init_instance(&dc->dml, &dcn3_01_soc, &dcn3_01_ip, DML_PROJECT_DCN30);
1620	}	1620	}
1621		1621
		1622	static void calculate_wm_set_for_vlevel(
		1623	int vlevel,
		1624	struct wm_range_table_entry *table_entry,
		1625	struct dcn_watermarks *wm_set,
		1626	struct display_mode_lib *dml,
		1627	display_e2e_pipe_params_st *pipes,
		1628	int pipe_cnt)
		1629	{
		1630	double dram_clock_change_latency_cached = dml->soc.dram_clock_change_latency_us;
		1631
		1632	ASSERT(vlevel < dml->soc.num_states);
		1633	/* only pipe 0 is read for voltage and dcf/soc clocks */
		1634	pipes[0].clks_cfg.voltage = vlevel;
		1635	pipes[0].clks_cfg.dcfclk_mhz = dml->soc.clock_limits[vlevel].dcfclk_mhz;
		1636	pipes[0].clks_cfg.socclk_mhz = dml->soc.clock_limits[vlevel].socclk_mhz;
		1637
		1638	dml->soc.dram_clock_change_latency_us = table_entry->pstate_latency_us;
		1639	dml->soc.sr_exit_time_us = table_entry->sr_exit_time_us;
		1640	dml->soc.sr_enter_plus_exit_time_us = table_entry->sr_enter_plus_exit_time_us;
		1641
		1642	wm_set->urgent_ns = get_wm_urgent(dml, pipes, pipe_cnt) * 1000;
		1643	wm_set->cstate_pstate.cstate_enter_plus_exit_ns = get_wm_stutter_enter_exit(dml, pipes, pipe_cnt) * 1000;
		1644	wm_set->cstate_pstate.cstate_exit_ns = get_wm_stutter_exit(dml, pipes, pipe_cnt) * 1000;
		1645	wm_set->cstate_pstate.pstate_change_ns = get_wm_dram_clock_change(dml, pipes, pipe_cnt) * 1000;
		1646	wm_set->pte_meta_urgent_ns = get_wm_memory_trip(dml, pipes, pipe_cnt) * 1000;
		1647	wm_set->frac_urg_bw_nom = get_fraction_of_urgent_bandwidth(dml, pipes, pipe_cnt) * 1000;
		1648	wm_set->frac_urg_bw_flip = get_fraction_of_urgent_bandwidth_imm_flip(dml, pipes, pipe_cnt) * 1000;
		1649	wm_set->urgent_latency_ns = get_urgent_latency(dml, pipes, pipe_cnt) * 1000;
		1650	dml->soc.dram_clock_change_latency_us = dram_clock_change_latency_cached;
		1651
		1652	}
		1653
		1654	static void dcn301_calculate_wm_and_dlg(
		1655	struct dc dc, struct dc_state context,
		1656	display_e2e_pipe_params_st *pipes,
		1657	int pipe_cnt,
		1658	int vlevel_req)
		1659	{
		1660	int i, pipe_idx;
		1661	int vlevel, vlevel_max;
		1662	struct wm_range_table_entry *table_entry;
		1663	struct clk_bw_params *bw_params = dc->clk_mgr->bw_params;
		1664
		1665	ASSERT(bw_params);
		1666
		1667	vlevel_max = bw_params->clk_table.num_entries - 1;
		1668
		1669	/* WM Set D */
		1670	table_entry = &bw_params->wm_table.entries[WM_D];
		1671	if (table_entry->wm_type == WM_TYPE_RETRAINING)
		1672	vlevel = 0;
		1673	else
		1674	vlevel = vlevel_max;
		1675	calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.d,
		1676	&context->bw_ctx.dml, pipes, pipe_cnt);
		1677	/* WM Set C */
		1678	table_entry = &bw_params->wm_table.entries[WM_C];
		1679	vlevel = min(max(vlevel_req, 2), vlevel_max);
		1680	calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.c,
		1681	&context->bw_ctx.dml, pipes, pipe_cnt);
		1682	/* WM Set B */
		1683	table_entry = &bw_params->wm_table.entries[WM_B];
		1684	vlevel = min(max(vlevel_req, 1), vlevel_max);
		1685	calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.b,
		1686	&context->bw_ctx.dml, pipes, pipe_cnt);
		1687
		1688	/* WM Set A */
		1689	table_entry = &bw_params->wm_table.entries[WM_A];
		1690	vlevel = min(vlevel_req, vlevel_max);
		1691	calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.a,
		1692	&context->bw_ctx.dml, pipes, pipe_cnt);
		1693
		1694	for (i = 0, pipe_idx = 0; i < dc->res_pool->pipe_count; i++) {
		1695	if (!context->res_ctx.pipe_ctx[i].stream)
		1696	continue;
		1697
		1698	pipes[pipe_idx].clks_cfg.dispclk_mhz = get_dispclk_calculated(&context->bw_ctx.dml, pipes, pipe_cnt);
		1699	pipes[pipe_idx].clks_cfg.dppclk_mhz = get_dppclk_calculated(&context->bw_ctx.dml, pipes, pipe_cnt, pipe_idx);
		1700
		1701	if (dc->config.forced_clocks) {
		1702	pipes[pipe_idx].clks_cfg.dispclk_mhz = context->bw_ctx.dml.soc.clock_limits[0].dispclk_mhz;
		1703	pipes[pipe_idx].clks_cfg.dppclk_mhz = context->bw_ctx.dml.soc.clock_limits[0].dppclk_mhz;
		1704	}
		1705	if (dc->debug.min_disp_clk_khz > pipes[pipe_idx].clks_cfg.dispclk_mhz * 1000)
		1706	pipes[pipe_idx].clks_cfg.dispclk_mhz = dc->debug.min_disp_clk_khz / 1000.0;
		1707	if (dc->debug.min_dpp_clk_khz > pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000)
		1708	pipes[pipe_idx].clks_cfg.dppclk_mhz = dc->debug.min_dpp_clk_khz / 1000.0;
		1709
		1710	pipe_idx++;
		1711	}
		1712
		1713	dcn20_calculate_dlg_params(dc, context, pipes, pipe_cnt, vlevel);
		1714	}
		1715
1622	static struct resource_funcs dcn301_res_pool_funcs = {	1716	static struct resource_funcs dcn301_res_pool_funcs = {
1623	.destroy = dcn301_destroy_resource_pool,	1717	.destroy = dcn301_destroy_resource_pool,
1624	.link_enc_create = dcn301_link_encoder_create,	1718	.link_enc_create = dcn301_link_encoder_create,
1625	.panel_cntl_create = dcn301_panel_cntl_create,	1719	.panel_cntl_create = dcn301_panel_cntl_create,
1626	.validate_bandwidth = dcn30_validate_bandwidth,	1720	.validate_bandwidth = dcn30_validate_bandwidth,
1627	.calculate_wm_and_dlg = dcn30_calculate_wm_and_dlg,	1721	.calculate_wm_and_dlg = dcn301_calculate_wm_and_dlg,
1628	.populate_dml_pipes = dcn30_populate_dml_pipes_from_context,	1722	.populate_dml_pipes = dcn30_populate_dml_pipes_from_context,
1629	.acquire_idle_pipe_for_layer = dcn20_acquire_idle_pipe_for_layer,	1723	.acquire_idle_pipe_for_layer = dcn20_acquire_idle_pipe_for_layer,
1630	.add_stream_to_ctx = dcn30_add_stream_to_ctx,	1724	.add_stream_to_ctx = dcn30_add_stream_to_ctx,

drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h+2−0

@@ -191,6 +191,8 @@ struct hubp_funcs { · 190 unmodified lines
191	bool (hubp_in_blank)(struct hubp hubp);	191	bool (hubp_in_blank)(struct hubp hubp);
192	void (hubp_soft_reset)(struct hubp hubp, bool reset);	192	void (hubp_soft_reset)(struct hubp hubp, bool reset);
193		193
		194	void (hubp_set_flip_int)(struct hubp hubp);
		195
194	};	196	};
195		197
196	#endif	198	#endif

drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c+4−4

@@ -5216,10 +5216,10 @@ static int smu7_set_watermarks_for_clocks_ranges(struct pp_hwmgr *hwmgr, · 5215 unmodified lines
5216	for (j = 0; j < dep_sclk_table->count; j++) {	5216	for (j = 0; j < dep_sclk_table->count; j++) {
5217	valid_entry = false;	5217	valid_entry = false;
5218	for (k = 0; k < watermarks->num_wm_sets; k++) {	5218	for (k = 0; k < watermarks->num_wm_sets; k++) {
5219	if (dep_sclk_table->entries[i].clk / 10 >= watermarks->wm_clk_ranges[k].wm_min_eng_clk_in_khz &&	5219	if (dep_sclk_table->entries[i].clk >= watermarks->wm_clk_ranges[k].wm_min_eng_clk_in_khz / 10 &&
5220	dep_sclk_table->entries[i].clk / 10 < watermarks->wm_clk_ranges[k].wm_max_eng_clk_in_khz &&	5220	dep_sclk_table->entries[i].clk < watermarks->wm_clk_ranges[k].wm_max_eng_clk_in_khz / 10 &&
5221	dep_mclk_table->entries[i].clk / 10 >= watermarks->wm_clk_ranges[k].wm_min_mem_clk_in_khz &&	5221	dep_mclk_table->entries[i].clk >= watermarks->wm_clk_ranges[k].wm_min_mem_clk_in_khz / 10 &&
5222	dep_mclk_table->entries[i].clk / 10 < watermarks->wm_clk_ranges[k].wm_max_mem_clk_in_khz) {	5222	dep_mclk_table->entries[i].clk < watermarks->wm_clk_ranges[k].wm_max_mem_clk_in_khz / 10) {
5223	valid_entry = true;	5223	valid_entry = true;
5224	table->DisplayWatermark[i][j] = watermarks->wm_clk_ranges[k].wm_set_id;	5224	table->DisplayWatermark[i][j] = watermarks->wm_clk_ranges[k].wm_set_id;
5225	break;	5225	break;

drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c+48−0

@@ -1505,6 +1505,48 @@ static int vega10_populate_single_lclk_level(struct pp_hwmgr *hwmgr, · 1504 unmodified lines
1505	return 0;	1505	return 0;
1506	}	1506	}
1507		1507
		1508	static int vega10_override_pcie_parameters(struct pp_hwmgr *hwmgr)
		1509	{
		1510	struct amdgpu_device adev = (struct amdgpu_device )(hwmgr->adev);
		1511	struct vega10_hwmgr *data =
		1512	(struct vega10_hwmgr *)(hwmgr->backend);
		1513	uint32_t pcie_gen = 0, pcie_width = 0;
		1514	PPTable_t *pp_table = &(data->smc_state_table.pp_table);
		1515	int i;
		1516
		1517	if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN4)
		1518	pcie_gen = 3;
		1519	else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)
		1520	pcie_gen = 2;
		1521	else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2)
		1522	pcie_gen = 1;
		1523	else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN1)
		1524	pcie_gen = 0;
		1525
		1526	if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X16)
		1527	pcie_width = 6;
		1528	else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X12)
		1529	pcie_width = 5;
		1530	else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X8)
		1531	pcie_width = 4;
		1532	else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X4)
		1533	pcie_width = 3;
		1534	else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X2)
		1535	pcie_width = 2;
		1536	else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X1)
		1537	pcie_width = 1;
		1538
		1539	for (i = 0; i < NUM_LINK_LEVELS; i++) {
		1540	if (pp_table->PcieGenSpeed[i] > pcie_gen)
		1541	pp_table->PcieGenSpeed[i] = pcie_gen;
		1542
		1543	if (pp_table->PcieLaneCount[i] > pcie_width)
		1544	pp_table->PcieLaneCount[i] = pcie_width;
		1545	}
		1546
		1547	return 0;
		1548	}
		1549
1508	static int vega10_populate_smc_link_levels(struct pp_hwmgr *hwmgr)	1550	static int vega10_populate_smc_link_levels(struct pp_hwmgr *hwmgr)
1509	{	1551	{
1510	int result = -1;	1552	int result = -1;
@@ -2556,6 +2598,11 @@ static int vega10_init_smc_table(struct pp_hwmgr *hwmgr) · 1045 unmodified lines
2556	"Failed to initialize Link Level!",	2598	"Failed to initialize Link Level!",
2557	return result);	2599	return result);
2558		2600
		2601	result = vega10_override_pcie_parameters(hwmgr);
		2602	PP_ASSERT_WITH_CODE(!result,
		2603	"Failed to override pcie parameters!",
		2604	return result);
		2605
2559	result = vega10_populate_all_graphic_levels(hwmgr);	2606	result = vega10_populate_all_graphic_levels(hwmgr);
2560	PP_ASSERT_WITH_CODE(!result,	2607	PP_ASSERT_WITH_CODE(!result,
2561	"Failed to initialize Graphics Level!",	2608	"Failed to initialize Graphics Level!",
@@ -2922,6 +2969,7 @@ static int vega10_start_dpm(struct pp_hwmgr *hwmgr, uint32_t bitmap) · 360 unmodified lines
2922	return 0;	2969	return 0;
2923	}	2970	}
2924		2971
		2972
2925	static int vega10_enable_disable_PCC_limit_feature(struct pp_hwmgr *hwmgr, bool enable)	2973	static int vega10_enable_disable_PCC_limit_feature(struct pp_hwmgr *hwmgr, bool enable)
2926	{	2974	{
2927	struct vega10_hwmgr *data = hwmgr->backend;	2975	struct vega10_hwmgr *data = hwmgr->backend;

drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c+66−0

@@ -481,6 +481,67 @@ static void vega12_init_dpm_state(struct vega12_dpm_state *dpm_state) · 480 unmodified lines
481	dpm_state->hard_max_level = 0xffff;	481	dpm_state->hard_max_level = 0xffff;
482	}	482	}
483		483
		484	static int vega12_override_pcie_parameters(struct pp_hwmgr *hwmgr)
		485	{
		486	struct amdgpu_device adev = (struct amdgpu_device )(hwmgr->adev);
		487	struct vega12_hwmgr *data =
		488	(struct vega12_hwmgr *)(hwmgr->backend);
		489	uint32_t pcie_gen = 0, pcie_width = 0, smu_pcie_arg, pcie_gen_arg, pcie_width_arg;
		490	PPTable_t *pp_table = &(data->smc_state_table.pp_table);
		491	int i;
		492	int ret;
		493
		494	if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN4)
		495	pcie_gen = 3;
		496	else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)
		497	pcie_gen = 2;
		498	else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2)
		499	pcie_gen = 1;
		500	else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN1)
		501	pcie_gen = 0;
		502
		503	if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X16)
		504	pcie_width = 6;
		505	else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X12)
		506	pcie_width = 5;
		507	else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X8)
		508	pcie_width = 4;
		509	else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X4)
		510	pcie_width = 3;
		511	else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X2)
		512	pcie_width = 2;
		513	else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X1)
		514	pcie_width = 1;
		515
		516	/* Bit 31:16: LCLK DPM level. 0 is DPM0, and 1 is DPM1
		517	* Bit 15:8: PCIE GEN, 0 to 3 corresponds to GEN1 to GEN4
		518	* Bit 7:0: PCIE lane width, 1 to 7 corresponds is x1 to x32
		519	*/
		520	for (i = 0; i < NUM_LINK_LEVELS; i++) {
		521	pcie_gen_arg = (pp_table->PcieGenSpeed[i] > pcie_gen) ? pcie_gen :
		522	pp_table->PcieGenSpeed[i];
		523	pcie_width_arg = (pp_table->PcieLaneCount[i] > pcie_width) ? pcie_width :
		524	pp_table->PcieLaneCount[i];
		525
		526	if (pcie_gen_arg != pp_table->PcieGenSpeed[i] \|\| pcie_width_arg !=
		527	pp_table->PcieLaneCount[i]) {
		528	smu_pcie_arg = (i << 16) \| (pcie_gen_arg << 8) \| pcie_width_arg;
		529	ret = smum_send_msg_to_smc_with_parameter(hwmgr,
		530	PPSMC_MSG_OverridePcieParameters, smu_pcie_arg,
		531	NULL);
		532	PP_ASSERT_WITH_CODE(!ret,
		533	"[OverridePcieParameters] Attempt to override pcie params failed!",
		534	return ret);
		535	}
		536
		537	/* update the pptable */
		538	pp_table->PcieGenSpeed[i] = pcie_gen_arg;
		539	pp_table->PcieLaneCount[i] = pcie_width_arg;
		540	}
		541
		542	return 0;
		543	}
		544
484	static int vega12_get_number_of_dpm_level(struct pp_hwmgr *hwmgr,	545	static int vega12_get_number_of_dpm_level(struct pp_hwmgr *hwmgr,
485	PPCLK_e clk_id, uint32_t *num_of_levels)	546	PPCLK_e clk_id, uint32_t *num_of_levels)
486	{	547	{
@@ -968,6 +1029,11 @@ static int vega12_enable_dpm_tasks(struct pp_hwmgr *hwmgr) · 481 unmodified lines
968	"Failed to enable all smu features!",	1029	"Failed to enable all smu features!",
969	return result);	1030	return result);
970		1031
		1032	result = vega12_override_pcie_parameters(hwmgr);
		1033	PP_ASSERT_WITH_CODE(!result,
		1034	"[EnableDPMTasks] Failed to override pcie parameters!",
		1035	return result);
		1036
971	tmp_result = vega12_power_control_set_level(hwmgr);	1037	tmp_result = vega12_power_control_set_level(hwmgr);
972	PP_ASSERT_WITH_CODE(!tmp_result,	1038	PP_ASSERT_WITH_CODE(!tmp_result,
973	"Failed to power control set level!",	1039	"Failed to power control set level!",

drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c+27−21

@@ -831,7 +831,9 @@ static int vega20_override_pcie_parameters(struct pp_hwmgr *hwmgr) · 830 unmodified lines
831	struct amdgpu_device adev = (struct amdgpu_device )(hwmgr->adev);	831	struct amdgpu_device adev = (struct amdgpu_device )(hwmgr->adev);
832	struct vega20_hwmgr *data =	832	struct vega20_hwmgr *data =
833	(struct vega20_hwmgr *)(hwmgr->backend);	833	(struct vega20_hwmgr *)(hwmgr->backend);
834	uint32_t pcie_gen = 0, pcie_width = 0, smu_pcie_arg;	834	uint32_t pcie_gen = 0, pcie_width = 0, smu_pcie_arg, pcie_gen_arg, pcie_width_arg;
		835	PPTable_t *pp_table = &(data->smc_state_table.pp_table);
		836	int i;
835	int ret;	837	int ret;
836		838
837	if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN4)	839	if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN4)
@@ -860,17 +862,27 @@ static int vega20_override_pcie_parameters(struct pp_hwmgr *hwmgr) · 22 unmodified lines
860	* Bit 15:8: PCIE GEN, 0 to 3 corresponds to GEN1 to GEN4	862	* Bit 15:8: PCIE GEN, 0 to 3 corresponds to GEN1 to GEN4
861	* Bit 7:0: PCIE lane width, 1 to 7 corresponds is x1 to x32	863	* Bit 7:0: PCIE lane width, 1 to 7 corresponds is x1 to x32
862	*/	864	*/
863	smu_pcie_arg = (1 << 16) \| (pcie_gen << 8) \| pcie_width;	865	for (i = 0; i < NUM_LINK_LEVELS; i++) {
864	ret = smum_send_msg_to_smc_with_parameter(hwmgr,	866	pcie_gen_arg = (pp_table->PcieGenSpeed[i] > pcie_gen) ? pcie_gen :
865	PPSMC_MSG_OverridePcieParameters, smu_pcie_arg,	867	pp_table->PcieGenSpeed[i];
866	NULL);	868	pcie_width_arg = (pp_table->PcieLaneCount[i] > pcie_width) ? pcie_width :
867	PP_ASSERT_WITH_CODE(!ret,	869	pp_table->PcieLaneCount[i];
868	"[OverridePcieParameters] Attempt to override pcie params failed!",	870
869	return ret);	871	if (pcie_gen_arg != pp_table->PcieGenSpeed[i] \|\| pcie_width_arg !=
		872	pp_table->PcieLaneCount[i]) {
		873	smu_pcie_arg = (i << 16) \| (pcie_gen_arg << 8) \| pcie_width_arg;
		874	ret = smum_send_msg_to_smc_with_parameter(hwmgr,
		875	PPSMC_MSG_OverridePcieParameters, smu_pcie_arg,
		876	NULL);
		877	PP_ASSERT_WITH_CODE(!ret,
		878	"[OverridePcieParameters] Attempt to override pcie params failed!",
		879	return ret);
		880	}
870		881
871	data->pcie_parameters_override = true;	882	/* update the pptable */
872	data->pcie_gen_level1 = pcie_gen;	883	pp_table->PcieGenSpeed[i] = pcie_gen_arg;
873	data->pcie_width_level1 = pcie_width;	884	pp_table->PcieLaneCount[i] = pcie_width_arg;
		885	}
874		886
875	return 0;	887	return 0;
876	}	888	}
@@ -3319,9 +3331,7 @@ static int vega20_print_clock_levels(struct pp_hwmgr *hwmgr, · 2442 unmodified lines
3319	data->od8_settings.od8_settings_array;	3331	data->od8_settings.od8_settings_array;
3320	OverDriveTable_t *od_table =	3332	OverDriveTable_t *od_table =
3321	&(data->smc_state_table.overdrive_table);	3333	&(data->smc_state_table.overdrive_table);
3322	struct phm_ppt_v3_information *pptable_information =	3334	PPTable_t *pptable = &(data->smc_state_table.pp_table);
3323	(struct phm_ppt_v3_information *)hwmgr->pptable;
3324	PPTable_t pptable = (PPTable_t )pptable_information->smc_pptable;
3325	struct pp_clock_levels_with_latency clocks;	3335	struct pp_clock_levels_with_latency clocks;
3326	struct vega20_single_dpm_table *fclk_dpm_table =	3336	struct vega20_single_dpm_table *fclk_dpm_table =
3327	&(data->dpm_table.fclk_table);	3337	&(data->dpm_table.fclk_table);
@@ -3420,13 +3430,9 @@ static int vega20_print_clock_levels(struct pp_hwmgr *hwmgr, · 92 unmodified lines
3420	current_lane_width =	3430	current_lane_width =
3421	vega20_get_current_pcie_link_width_level(hwmgr);	3431	vega20_get_current_pcie_link_width_level(hwmgr);
3422	for (i = 0; i < NUM_LINK_LEVELS; i++) {	3432	for (i = 0; i < NUM_LINK_LEVELS; i++) {
3423	if (i == 1 && data->pcie_parameters_override) {	3433	gen_speed = pptable->PcieGenSpeed[i];
3424	gen_speed = data->pcie_gen_level1;	3434	lane_width = pptable->PcieLaneCount[i];
3425	lane_width = data->pcie_width_level1;	3435
3426	} else {
3427	gen_speed = pptable->PcieGenSpeed[i];
3428	lane_width = pptable->PcieLaneCount[i];
3429	}
3430	size += sprintf(buf + size, "%d: %s %s %dMhz %s\n", i,	3436	size += sprintf(buf + size, "%d: %s %s %dMhz %s\n", i,
3431	(gen_speed == 0) ? "2.5GT/s," :	3437	(gen_speed == 0) ? "2.5GT/s," :
3432	(gen_speed == 1) ? "5.0GT/s," :	3438	(gen_speed == 1) ? "5.0GT/s," :

drivers/gpu/drm/drm_fb_helper.c+1−1

@@ -2048,7 +2048,7 @@ static void drm_fbdev_cleanup(struct drm_fb_helper *fb_helper) · 2047 unmodified lines
2048		2048
2049	if (shadow)	2049	if (shadow)
2050	vfree(shadow);	2050	vfree(shadow);
2051	else	2051	else if (fb_helper->buffer)
2052	drm_client_buffer_vunmap(fb_helper->buffer);	2052	drm_client_buffer_vunmap(fb_helper->buffer);
2053		2053
2054	drm_client_framebuffer_delete(fb_helper->buffer);	2054	drm_client_framebuffer_delete(fb_helper->buffer);

drivers/gpu/drm/drm_gem_shmem_helper.c+22−10

 	if (--shmem->vmap_use_count > 0)
 		return;
-	if (obj->import_attach)
+	if (obj->import_attach) {
 		dma_buf_vunmap(obj->import_attach->dmabuf, map);
-	else
+	} else {
 		vunmap(shmem->vaddr);
+		drm_gem_shmem_put_pages(shmem);
+	}
 	shmem->vaddr = NULL;
-	drm_gem_shmem_put_pages(shmem);
 }
 /*
 	struct drm_gem_object *obj = vma->vm_private_data;
 	struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj);
 	loff_t num_pages = obj->size >> PAGE_SHIFT;
+	vm_fault_t ret;
 	struct page *page;
+	pgoff_t page_offset;
-	if (vmf->pgoff >= num_pages || WARN_ON_ONCE(!shmem->pages))
+	/* We don't use vmf->pgoff since that has the fake offset */
-		return VM_FAULT_SIGBUS;
+	page_offset = (vmf->address - vma->vm_start) >> PAGE_SHIFT;
-	page = shmem->pages[vmf->pgoff];
+	mutex_lock(&shmem->pages_lock);
-	return vmf_insert_page(vma, vmf->address, page);
+	if (page_offset >= num_pages ||
+	    WARN_ON_ONCE(!shmem->pages) ||
+	    shmem->madv < 0) {
+		ret = VM_FAULT_SIGBUS;
+	} else {
+		page = shmem->pages[page_offset];
+		ret = vmf_insert_page(vma, vmf->address, page);
+	}
+	mutex_unlock(&shmem->pages_lock);
+	return ret;
 }
 static void drm_gem_shmem_vm_open(struct vm_area_struct *vma)
 	struct drm_gem_shmem_object *shmem;
 	int ret;
-	/* Remove the fake offset */
-	vma->vm_pgoff -= drm_vma_node_start(&obj->vma_node);
 	if (obj->import_attach) {
 		/* Drop the reference drm_gem_mmap_obj() acquired.*/
 		drm_gem_object_put(obj);

drivers/gpu/drm/drm_ioc32.c+11−0

 	if (copy_from_user(&v32, (void __user *)arg, sizeof(v32)))
 		return -EFAULT;
+	memset(&v, 0, sizeof(v));
 	v = (struct drm_version) {
 		.name_len = v32.name_len,
 		.name = compat_ptr(v32.name),
 	if (copy_from_user(&uq32, (void __user *)arg, sizeof(uq32)))
 		return -EFAULT;
+	memset(&uq, 0, sizeof(uq));
 	uq = (struct drm_unique){
 		.unique_len = uq32.unique_len,
 		.unique = compat_ptr(uq32.unique),
 	if (copy_from_user(&c32, argp, sizeof(c32)))
 		return -EFAULT;
+	memset(&client, 0, sizeof(client));
 	client.idx = c32.idx;
 	err = drm_ioctl_kernel(file, drm_getclient, &client, 0);
 	if (copy_from_user(&req32, argp, sizeof(req32)))
 		return -EFAULT;
+	memset(&req, 0, sizeof(req));
 	req.request.type = req32.request.type;
 	req.request.sequence = req32.request.sequence;
 	req.request.signal = req32.request.signal;
 	struct drm_mode_fb_cmd2 req64;
 	int err;
+	memset(&req64, 0, sizeof(req64));
 	if (copy_from_user(&req64, argp,
 			   offsetof(drm_mode_fb_cmd232_t, modifier)))
 		return -EFAULT;

drivers/gpu/drm/i915/gt/intel_engine_cs.c+6−1

 		goto err_status;
 	}
+	err = intel_engine_init_cmd_parser(engine);
+	if (err)
+		goto err_cmd_parser;
 	intel_engine_init_active(engine, ENGINE_PHYSICAL);
 	intel_engine_init_execlists(engine);
-	intel_engine_init_cmd_parser(engine);
 	intel_engine_init__pm(engine);
 	intel_engine_init_retire(engine);
 	return 0;
+err_cmd_parser:
+	intel_breadcrumbs_free(engine->breadcrumbs);
 err_status:
 	cleanup_status_page(engine);
 	return err;

drivers/gpu/drm/i915/i915_cmd_parser.c+13−6

  * struct intel_engine_cs based on whether the platform requires software
  * command parsing.
  */
-void intel_engine_init_cmd_parser(struct intel_engine_cs *engine)
+int intel_engine_init_cmd_parser(struct intel_engine_cs *engine)
 {
 	const struct drm_i915_cmd_table *cmd_tables;
 	int cmd_table_count;
 	if (!IS_GEN(engine->i915, 7) && !(IS_GEN(engine->i915, 9) &&
 					  engine->class == COPY_ENGINE_CLASS))
-		return;
+		return 0;
 	switch (engine->class) {
 	case RENDER_CLASS:
 		break;
 	default:
 		MISSING_CASE(engine->class);
-		return;
+		goto out;
 	}
 	if (!validate_cmds_sorted(engine, cmd_tables, cmd_table_count)) {
 		drm_err(&engine->i915->drm,
 			"%s: command descriptions are not sorted\n",
 			engine->name);
-		return;
+		goto out;
 	}
 	if (!validate_regs_sorted(engine)) {
 		drm_err(&engine->i915->drm,
 			"%s: registers are not sorted\n", engine->name);
-		return;
+		goto out;
 	}
 	ret = init_hash_table(engine, cmd_tables, cmd_table_count);
 		drm_err(&engine->i915->drm,
 			"%s: initialised failed!\n", engine->name);
 		fini_hash_table(engine);
-		return;
+		goto out;
 	}
 	engine->flags |= I915_ENGINE_USING_CMD_PARSER;
+out:
+	if (intel_engine_requires_cmd_parser(engine) &&
+	    !intel_engine_using_cmd_parser(engine))
+		return -EINVAL;
+	return 0;
 }
 /**

drivers/gpu/drm/i915/i915_drv.h+1−1

@@ -1952,7 +1952,7 @@ const char i915_cache_level_str(struct drm_i915_private i915, int type); · 1951 unmodified lines
1952		1952
1953	/* i915_cmd_parser.c */	1953	/* i915_cmd_parser.c */
1954	int i915_cmd_parser_get_version(struct drm_i915_private *dev_priv);	1954	int i915_cmd_parser_get_version(struct drm_i915_private *dev_priv);
1955	void intel_engine_init_cmd_parser(struct intel_engine_cs *engine);	1955	int intel_engine_init_cmd_parser(struct intel_engine_cs *engine);
1956	void intel_engine_cleanup_cmd_parser(struct intel_engine_cs *engine);	1956	void intel_engine_cleanup_cmd_parser(struct intel_engine_cs *engine);
1957	int intel_engine_cmd_parser(struct intel_engine_cs *engine,	1957	int intel_engine_cmd_parser(struct intel_engine_cs *engine,
1958	struct i915_vma *batch,	1958	struct i915_vma *batch,

drivers/gpu/drm/meson/meson_drv.c+11−0

 	return count;
 }
+static void meson_drv_shutdown(struct platform_device *pdev)
+{
+	struct meson_drm *priv = dev_get_drvdata(&pdev->dev);
+	struct drm_device *drm = priv->drm;
+	DRM_DEBUG_DRIVER("\n");
+	drm_kms_helper_poll_fini(drm);
+	drm_atomic_helper_shutdown(drm);
+}
 static int meson_drv_probe(struct platform_device *pdev)
 {
 	struct component_match *match = NULL;
 static struct platform_driver meson_drm_platform_driver = {
 	.probe      = meson_drv_probe,
+	.shutdown   = meson_drv_shutdown,
 	.driver     = {
 		.name	= "meson-drm",
 		.of_match_table = dt_match,

drivers/gpu/drm/nouveau/nouveau_bo.c+4−2

 	if (nvbo->force_coherent)
 		return;
-	for (i = 0; i < ttm_dma->num_pages; ++i) {
+	i = 0;
+	while (i < ttm_dma->num_pages) {
 		struct page *p = ttm_dma->pages[i];
 		size_t num_pages = 1;
 	if (nvbo->force_coherent)
 		return;
-	for (i = 0; i < ttm_dma->num_pages; ++i) {
+	i = 0;
+	while (i < ttm_dma->num_pages) {
 		struct page *p = ttm_dma->pages[i];
 		size_t num_pages = 1;

drivers/gpu/drm/qxl/qxl_display.c+1−0

@@ -328,6 +328,7 @@ static void qxl_crtc_update_monitors_config(struct drm_crtc *crtc, · 327 unmodified lines
328		328
329	head.id = i;	329	head.id = i;
330	head.flags = 0;	330	head.flags = 0;
		331	head.surface_id = 0;
331	oldcount = qdev->monitors_config->count;	332	oldcount = qdev->monitors_config->count;
332	if (crtc->state->active) {	333	if (crtc->state->active) {
333	struct drm_display_mode *mode = &crtc->mode;	334	struct drm_display_mode *mode = &crtc->mode;

drivers/gpu/drm/qxl/qxl_release.c+10−2

 				       int type, struct qxl_release **release,
 				       struct qxl_bo **rbo)
 {
-	struct qxl_bo *bo;
+	struct qxl_bo *bo, *free_bo = NULL;
 	int idr_ret;
 	int ret = 0;
 	union qxl_release_info *info;
 	mutex_lock(&qdev->release_mutex);
 	if (qdev->current_release_bo_offset[cur_idx] + 1 >= releases_per_bo[cur_idx]) {
-		qxl_bo_unref(&qdev->current_release_bo[cur_idx]);
+		free_bo = qdev->current_release_bo[cur_idx];
 		qdev->current_release_bo_offset[cur_idx] = 0;
 		qdev->current_release_bo[cur_idx] = NULL;
 	}
 		ret = qxl_release_bo_alloc(qdev, &qdev->current_release_bo[cur_idx]);
 		if (ret) {
 			mutex_unlock(&qdev->release_mutex);
+			if (free_bo) {
+				qxl_bo_unpin(free_bo);
+				qxl_bo_unref(&free_bo);
+			}
 			qxl_release_free(qdev, *release);
 			return ret;
 		}
 		*rbo = bo;
 	mutex_unlock(&qdev->release_mutex);
+	if (free_bo) {
+		qxl_bo_unpin(free_bo);
+		qxl_bo_unref(&free_bo);
+	}
 	ret = qxl_release_list_add(*release, bo);
 	qxl_bo_unref(&bo);

drivers/gpu/drm/radeon/radeon.h+2−0

@@ -574,6 +574,8 @@ struct radeon_gem { · 573 unmodified lines
574	struct list_head objects;	574	struct list_head objects;
575	};	575	};
576		576
		577	extern const struct drm_gem_object_funcs radeon_gem_object_funcs;
		578
577	int radeon_gem_init(struct radeon_device *rdev);	579	int radeon_gem_init(struct radeon_device *rdev);
578	void radeon_gem_fini(struct radeon_device *rdev);	580	void radeon_gem_fini(struct radeon_device *rdev);
579	int radeon_gem_object_create(struct radeon_device *rdev, unsigned long size,	581	int radeon_gem_object_create(struct radeon_device *rdev, unsigned long size,

drivers/gpu/drm/radeon/radeon_gem.c+2−2

@@ -43,7 +43,7 @@ struct sg_table radeon_gem_prime_get_sg_table(struct drm_gem_object obj); · 42 unmodified lines
43	int radeon_gem_prime_pin(struct drm_gem_object *obj);	43	int radeon_gem_prime_pin(struct drm_gem_object *obj);
44	void radeon_gem_prime_unpin(struct drm_gem_object *obj);	44	void radeon_gem_prime_unpin(struct drm_gem_object *obj);
45		45
46	static const struct drm_gem_object_funcs radeon_gem_object_funcs;	46	const struct drm_gem_object_funcs radeon_gem_object_funcs;
47		47
48	static void radeon_gem_object_free(struct drm_gem_object *gobj)	48	static void radeon_gem_object_free(struct drm_gem_object *gobj)
49	{	49	{
@@ -227,7 +227,7 @@ static int radeon_gem_handle_lockup(struct radeon_device *rdev, int r) · 177 unmodified lines
227	return r;	227	return r;
228	}	228	}
229		229
230	static const struct drm_gem_object_funcs radeon_gem_object_funcs = {	230	const struct drm_gem_object_funcs radeon_gem_object_funcs = {
231	.free = radeon_gem_object_free,	231	.free = radeon_gem_object_free,
232	.open = radeon_gem_object_open,	232	.open = radeon_gem_object_open,
233	.close = radeon_gem_object_close,	233	.close = radeon_gem_object_close,

drivers/gpu/drm/radeon/radeon_prime.c+2−0

@@ -56,6 +56,8 @@ struct drm_gem_object radeon_gem_prime_import_sg_table(struct drm_device dev, · 55 unmodified lines
56	if (ret)	56	if (ret)
57	return ERR_PTR(ret);	57	return ERR_PTR(ret);
58		58
		59	bo->tbo.base.funcs = &radeon_gem_object_funcs;
		60
59	mutex_lock(&rdev->gem.mutex);	61	mutex_lock(&rdev->gem.mutex);
60	list_add_tail(&bo->list, &rdev->gem.objects);	62	list_add_tail(&bo->list, &rdev->gem.objects);
61	mutex_unlock(&rdev->gem.mutex);	63	mutex_unlock(&rdev->gem.mutex);

drivers/gpu/drm/tiny/gm12u320.c+36−8

 struct gm12u320_device {
 	struct drm_device	         dev;
+	struct device                   *dmadev;
 	struct drm_simple_display_pipe   pipe;
 	struct drm_connector	         conn;
 	unsigned char                   *cmd_buf;
 	DRM_FORMAT_MOD_INVALID
 };
+/*
+ * FIXME: Dma-buf sharing requires DMA support by the importing device.
+ *        This function is a workaround to make USB devices work as well.
+ *        See todo.rst for how to fix the issue in the dma-buf framework.
+ */
+static struct drm_gem_object *gm12u320_gem_prime_import(struct drm_device *dev,
+							struct dma_buf *dma_buf)
+{
+	struct gm12u320_device *gm12u320 = to_gm12u320(dev);
+	if (!gm12u320->dmadev)
+		return ERR_PTR(-ENODEV);
+	return drm_gem_prime_import_dev(dev, dma_buf, gm12u320->dmadev);
+}
 DEFINE_DRM_GEM_FOPS(gm12u320_fops);
 static const struct drm_driver gm12u320_drm_driver = {
 	.fops		 = &gm12u320_fops,
 	DRM_GEM_SHMEM_DRIVER_OPS,
+	.gem_prime_import = gm12u320_gem_prime_import,
 };
 static const struct drm_mode_config_funcs gm12u320_mode_config_funcs = {
 				      struct gm12u320_device, dev);
 	if (IS_ERR(gm12u320))
 		return PTR_ERR(gm12u320);
+	dev = &gm12u320->dev;
+	gm12u320->dmadev = usb_intf_get_dma_device(to_usb_interface(dev->dev));
+	if (!gm12u320->dmadev)
+		drm_warn(dev, "buffer sharing not supported"); /* not an error */
 	INIT_DELAYED_WORK(&gm12u320->fb_update.work, gm12u320_fb_update_work);
 	mutex_init(&gm12u320->fb_update.lock);
-	dev = &gm12u320->dev;
 	ret = drmm_mode_config_init(dev);
 	if (ret)
-		return ret;
+		goto err_put_device;
 	dev->mode_config.min_width = GM12U320_USER_WIDTH;
 	dev->mode_config.max_width = GM12U320_USER_WIDTH;
 	ret = gm12u320_usb_alloc(gm12u320);
 	if (ret)
-		return ret;
+		goto err_put_device;
 	ret = gm12u320_set_ecomode(gm12u320);
 	if (ret)
-		return ret;
+		goto err_put_device;
 	ret = gm12u320_conn_init(gm12u320);
 	if (ret)
-		return ret;
+		goto err_put_device;
 	ret = drm_simple_display_pipe_init(&gm12u320->dev,
 					   &gm12u320->pipe,
 					   gm12u320_pipe_modifiers,
 					   &gm12u320->conn);
 	if (ret)
-		return ret;
+		goto err_put_device;
 	drm_mode_config_reset(dev);
 	usb_set_intfdata(interface, dev);
 	ret = drm_dev_register(dev, 0);
 	if (ret)
-		return ret;
+		goto err_put_device;
 	drm_fbdev_generic_setup(dev, 0);
 	return 0;
+err_put_device:
+	put_device(gm12u320->dmadev);
+	return ret;
 }
 static void gm12u320_usb_disconnect(struct usb_interface *interface)
 {
 	struct drm_device *dev = usb_get_intfdata(interface);
+	struct gm12u320_device *gm12u320 = to_gm12u320(dev);
+	put_device(gm12u320->dmadev);
+	gm12u320->dmadev = NULL;
 	drm_dev_unplug(dev);
 	drm_atomic_helper_shutdown(dev);
 }

drivers/gpu/drm/ttm/ttm_bo.c+6−2

 	struct ttm_bo_device *bdev = bo->bdev;
 	struct ttm_resource_manager *man;
-	dma_resv_assert_held(bo->base.resv);
+	if (!bo->deleted)
+		dma_resv_assert_held(bo->base.resv);
 	if (bo->pin_count) {
 		ttm_bo_del_from_lru(bo);
 		 * Make pinned bos immediately available to
 		 * shrinkers, now that they are queued for
 		 * destruction.
+		 *
+		 * FIXME: QXL is triggering this. Can be removed when the
+		 * driver is fixed.
 		 */
-		if (WARN_ON(bo->pin_count)) {
+		if (WARN_ON_ONCE(bo->pin_count)) {
 			bo->pin_count = 0;
 			ttm_bo_move_to_lru_tail(bo, &bo->mem, NULL);
 		}

drivers/gpu/drm/ttm/ttm_pool.c+2−2

@@ -268,13 +268,13 @@ static void ttm_pool_type_init(struct ttm_pool_type pt, struct ttm_pool pool, · 267 unmodified lines
268	/* Remove a pool_type from the global shrinker list and free all pages */	268	/* Remove a pool_type from the global shrinker list and free all pages */
269	static void ttm_pool_type_fini(struct ttm_pool_type *pt)	269	static void ttm_pool_type_fini(struct ttm_pool_type *pt)
270	{	270	{
271	struct page p, tmp;	271	struct page *p;
272		272
273	mutex_lock(&shrinker_lock);	273	mutex_lock(&shrinker_lock);
274	list_del(&pt->shrinker_list);	274	list_del(&pt->shrinker_list);
275	mutex_unlock(&shrinker_lock);	275	mutex_unlock(&shrinker_lock);
276		276
277	list_for_each_entry_safe(p, tmp, &pt->pages, lru)	277	while ((p = ttm_pool_type_take(pt)))
278	ttm_pool_free_page(pt->pool, pt->caching, pt->order, p);	278	ttm_pool_free_page(pt->pool, pt->caching, pt->order, p);
279	}	279	}
280		280

drivers/gpu/drm/udl/udl_drv.c+17−0

@@ -32,6 +32,22 @@ static int udl_usb_resume(struct usb_interface *interface) · 31 unmodified lines
32	return drm_mode_config_helper_resume(dev);	32	return drm_mode_config_helper_resume(dev);
33	}	33	}
34		34
		35	/*
		36	* FIXME: Dma-buf sharing requires DMA support by the importing device.
		37	* This function is a workaround to make USB devices work as well.
		38	* See todo.rst for how to fix the issue in the dma-buf framework.
		39	*/
		40	static struct drm_gem_object udl_driver_gem_prime_import(struct drm_device dev,
		41	struct dma_buf *dma_buf)
		42	{
		43	struct udl_device *udl = to_udl(dev);
		44
		45	if (!udl->dmadev)
		46	return ERR_PTR(-ENODEV);
		47
		48	return drm_gem_prime_import_dev(dev, dma_buf, udl->dmadev);
		49	}
		50
35	DEFINE_DRM_GEM_FOPS(udl_driver_fops);	51	DEFINE_DRM_GEM_FOPS(udl_driver_fops);
36		52
37	static const struct drm_driver driver = {	53	static const struct drm_driver driver = {
@@ -40,6 +56,7 @@ static const struct drm_driver driver = { · 2 unmodified lines
40	/* GEM hooks */	56	/* GEM hooks */
41	.fops = &udl_driver_fops,	57	.fops = &udl_driver_fops,
42	DRM_GEM_SHMEM_DRIVER_OPS,	58	DRM_GEM_SHMEM_DRIVER_OPS,
		59	.gem_prime_import = udl_driver_gem_prime_import,
43		60
44	.name = DRIVER_NAME,	61	.name = DRIVER_NAME,
45	.desc = DRIVER_DESC,	62	.desc = DRIVER_DESC,

drivers/gpu/drm/udl/udl_drv.h+1−0

@@ -50,6 +50,7 @@ struct urb_list { · 49 unmodified lines
50	struct udl_device {	50	struct udl_device {
51	struct drm_device drm;	51	struct drm_device drm;
52	struct device *dev;	52	struct device *dev;
		53	struct device *dmadev;
53		54
54	struct drm_simple_display_pipe display_pipe;	55	struct drm_simple_display_pipe display_pipe;
55		56

drivers/gpu/drm/udl/udl_main.c+10−0

 	DRM_DEBUG("\n");
+	udl->dmadev = usb_intf_get_dma_device(to_usb_interface(dev->dev));
+	if (!udl->dmadev)
+		drm_warn(dev, "buffer sharing not supported"); /* not an error */
 	mutex_init(&udl->gem_lock);
 	if (!udl_parse_vendor_descriptor(udl)) {
 err:
 	if (udl->urbs.count)
 		udl_free_urb_list(dev);
+	put_device(udl->dmadev);
 	DRM_ERROR("%d\n", ret);
 	return ret;
 }
 int udl_drop_usb(struct drm_device *dev)
 {
+	struct udl_device *udl = to_udl(dev);
 	udl_free_urb_list(dev);
+	put_device(udl->dmadev);
+	udl->dmadev = NULL;
 	return 0;
 }

drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c+1−3

 	vm_fault_t ret;
 	pgoff_t fault_page_size;
 	bool write = vmf->flags & FAULT_FLAG_WRITE;
-	bool is_cow_mapping =
-		(vma->vm_flags & (VM_SHARED | VM_MAYWRITE)) == VM_MAYWRITE;
 	switch (pe_size) {
 	case PE_SIZE_PMD:
 	}
 	/* Always do write dirty-tracking and COW on PTE level. */
-	if (write && (READ_ONCE(vbo->dirty) || is_cow_mapping))
+	if (write && (READ_ONCE(vbo->dirty) || is_cow_mapping(vma->vm_flags)))
 		return VM_FAULT_FALLBACK;
 	ret = ttm_bo_vm_reserve(bo, vmf);

drivers/gpu/drm/vmwgfx/vmwgfx_ttm_glue.c+1−1

@@ -49,7 +49,7 @@ int vmw_mmap(struct file filp, struct vm_area_struct vma) · 48 unmodified lines
49	vma->vm_ops = &vmw_vm_ops;	49	vma->vm_ops = &vmw_vm_ops;
50		50
51	/* Use VM_PFNMAP rather than VM_MIXEDMAP if not a COW mapping */	51	/* Use VM_PFNMAP rather than VM_MIXEDMAP if not a COW mapping */
52	if ((vma->vm_flags & (VM_SHARED \| VM_MAYWRITE)) != VM_MAYWRITE)	52	if (!is_cow_mapping(vma->vm_flags))
53	vma->vm_flags = (vma->vm_flags & ~VM_MIXEDMAP) \| VM_PFNMAP;	53	vma->vm_flags = (vma->vm_flags & ~VM_MIXEDMAP) \| VM_PFNMAP;
54		54
55	return 0;	55	return 0;

drivers/irqchip/Kconfig+0−9

 config ARM_GIC
 	bool
 	select IRQ_DOMAIN_HIERARCHY
-	select GENERIC_IRQ_MULTI_HANDLER
 	select GENERIC_IRQ_EFFECTIVE_AFF_MASK
 config ARM_GIC_PM
 config ARM_GIC_V3
 	bool
-	select GENERIC_IRQ_MULTI_HANDLER
 	select IRQ_DOMAIN_HIERARCHY
 	select PARTITION_PERCPU
 	select GENERIC_IRQ_EFFECTIVE_AFF_MASK
 config ARM_VIC
 	bool
 	select IRQ_DOMAIN
-	select GENERIC_IRQ_MULTI_HANDLER
 config ARM_VIC_NR
 	int
 	bool
 	select GENERIC_IRQ_CHIP
 	select IRQ_DOMAIN
-	select GENERIC_IRQ_MULTI_HANDLER
 	select SPARSE_IRQ
 config ATMEL_AIC5_IRQ
 	bool
 	select GENERIC_IRQ_CHIP
 	select IRQ_DOMAIN
-	select GENERIC_IRQ_MULTI_HANDLER
 	select SPARSE_IRQ
 config I8259
 config FARADAY_FTINTC010
 	bool
 	select IRQ_DOMAIN
-	select GENERIC_IRQ_MULTI_HANDLER
 	select SPARSE_IRQ
 config HISILICON_IRQ_MBIGEN
 config IXP4XX_IRQ
 	bool
 	select IRQ_DOMAIN
-	select GENERIC_IRQ_MULTI_HANDLER
 	select SPARSE_IRQ
 config MADERA_IRQ
 	bool
 	depends on ARCH_CLPS711X
 	select IRQ_DOMAIN
-	select GENERIC_IRQ_MULTI_HANDLER
 	select SPARSE_IRQ
 	default y
 config ORION_IRQCHIP
 	bool
 	select IRQ_DOMAIN
-	select GENERIC_IRQ_MULTI_HANDLER
 config PIC32_EVIC
 	bool

drivers/irqchip/irq-ingenic-tcu.c+1−0

@@ -179,5 +179,6 @@ err_free_tcu: · 178 unmodified lines
179	}	179	}
180	IRQCHIP_DECLARE(jz4740_tcu_irq, "ingenic,jz4740-tcu", ingenic_tcu_irq_init);	180	IRQCHIP_DECLARE(jz4740_tcu_irq, "ingenic,jz4740-tcu", ingenic_tcu_irq_init);
181	IRQCHIP_DECLARE(jz4725b_tcu_irq, "ingenic,jz4725b-tcu", ingenic_tcu_irq_init);	181	IRQCHIP_DECLARE(jz4725b_tcu_irq, "ingenic,jz4725b-tcu", ingenic_tcu_irq_init);
		182	IRQCHIP_DECLARE(jz4760_tcu_irq, "ingenic,jz4760-tcu", ingenic_tcu_irq_init);
182	IRQCHIP_DECLARE(jz4770_tcu_irq, "ingenic,jz4770-tcu", ingenic_tcu_irq_init);	183	IRQCHIP_DECLARE(jz4770_tcu_irq, "ingenic,jz4770-tcu", ingenic_tcu_irq_init);
183	IRQCHIP_DECLARE(x1000_tcu_irq, "ingenic,x1000-tcu", ingenic_tcu_irq_init);	184	IRQCHIP_DECLARE(x1000_tcu_irq, "ingenic,x1000-tcu", ingenic_tcu_irq_init);

drivers/irqchip/irq-ingenic.c+1−0

@@ -155,6 +155,7 @@ static int __init intc_2chip_of_init(struct device_node *node, · 154 unmodified lines
155	{	155	{
156	return ingenic_intc_of_init(node, 2);	156	return ingenic_intc_of_init(node, 2);
157	}	157	}
		158	IRQCHIP_DECLARE(jz4760_intc, "ingenic,jz4760-intc", intc_2chip_of_init);
158	IRQCHIP_DECLARE(jz4770_intc, "ingenic,jz4770-intc", intc_2chip_of_init);	159	IRQCHIP_DECLARE(jz4770_intc, "ingenic,jz4770-intc", intc_2chip_of_init);
159	IRQCHIP_DECLARE(jz4775_intc, "ingenic,jz4775-intc", intc_2chip_of_init);	160	IRQCHIP_DECLARE(jz4775_intc, "ingenic,jz4775-intc", intc_2chip_of_init);
160	IRQCHIP_DECLARE(jz4780_intc, "ingenic,jz4780-intc", intc_2chip_of_init);	161	IRQCHIP_DECLARE(jz4780_intc, "ingenic,jz4780-intc", intc_2chip_of_init);

drivers/leds/trigger/ledtrig-tty.c+4−7

 	if (size) {
 		ttyname = kmemdup_nul(buf, size, GFP_KERNEL);
-		if (!ttyname) {
+		if (!ttyname)
-			ret = -ENOMEM;
+			return -ENOMEM;
-			goto out_unlock;
-		}
 	} else {
 		ttyname = NULL;
 	}
 	trigger_data->ttyname = ttyname;
-out_unlock:
 	mutex_unlock(&trigger_data->mutex);
 	if (ttyname && !running)
 	if (icount.rx != trigger_data->rx ||
 	    icount.tx != trigger_data->tx) {
-		led_set_brightness(trigger_data->led_cdev, LED_ON);
+		led_set_brightness_sync(trigger_data->led_cdev, LED_ON);
 		trigger_data->rx = icount.rx;
 		trigger_data->tx = icount.tx;
 	} else {
-		led_set_brightness(trigger_data->led_cdev, LED_OFF);
+		led_set_brightness_sync(trigger_data->led_cdev, LED_OFF);
 	}
 out:

drivers/md/bcache/super.c+1−1

@@ -965,7 +965,7 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, · 964 unmodified lines
965	q->limits.max_hw_sectors = UINT_MAX;	965	q->limits.max_hw_sectors = UINT_MAX;
966	q->limits.max_sectors = UINT_MAX;	966	q->limits.max_sectors = UINT_MAX;
967	q->limits.max_segment_size = UINT_MAX;	967	q->limits.max_segment_size = UINT_MAX;
968	q->limits.max_segments = BIO_MAX_PAGES;	968	q->limits.max_segments = BIO_MAX_VECS;
969	blk_queue_max_discard_sectors(q, UINT_MAX);	969	blk_queue_max_discard_sectors(q, UINT_MAX);
970	q->limits.discard_granularity = 512;	970	q->limits.discard_granularity = 512;
971	q->limits.io_min = block_size;	971	q->limits.io_min = block_size;

drivers/md/dm-crypt.c+4−4

drivers/md/dm-writecache.c+2−2

@@ -1892,10 +1892,10 @@ restart: · 1891 unmodified lines
1892	list_add(&g->lru, &wbl.list);	1892	list_add(&g->lru, &wbl.list);
1893	wbl.size++;	1893	wbl.size++;
1894	g->write_in_progress = true;	1894	g->write_in_progress = true;
1895	g->wc_list_contiguous = BIO_MAX_PAGES;	1895	g->wc_list_contiguous = BIO_MAX_VECS;
1896	f = g;	1896	f = g;
1897	e->wc_list_contiguous++;	1897	e->wc_list_contiguous++;
1898	if (unlikely(e->wc_list_contiguous == BIO_MAX_PAGES)) {	1898	if (unlikely(e->wc_list_contiguous == BIO_MAX_VECS)) {
1899	if (unlikely(wc->writeback_all)) {	1899	if (unlikely(wc->writeback_all)) {
1900	next_node = rb_next(&f->rb_node);	1900	next_node = rb_next(&f->rb_node);
1901	if (likely(next_node))	1901	if (likely(next_node))

drivers/md/raid5-cache.c+2−2

@@ -735,7 +735,7 @@ static void r5l_submit_current_io(struct r5l_log *log) · 734 unmodified lines
735		735
736	static struct bio r5l_bio_alloc(struct r5l_log log)	736	static struct bio r5l_bio_alloc(struct r5l_log log)
737	{	737	{
738	struct bio *bio = bio_alloc_bioset(GFP_NOIO, BIO_MAX_PAGES, &log->bs);	738	struct bio *bio = bio_alloc_bioset(GFP_NOIO, BIO_MAX_VECS, &log->bs);
739		739
740	bio_set_op_attrs(bio, REQ_OP_WRITE, 0);	740	bio_set_op_attrs(bio, REQ_OP_WRITE, 0);
741	bio_set_dev(bio, log->rdev->bdev);	741	bio_set_dev(bio, log->rdev->bdev);
@@ -1634,7 +1634,7 @@ static int r5l_recovery_allocate_ra_pool(struct r5l_log *log, · 892 unmodified lines
1634	{	1634	{
1635	struct page *page;	1635	struct page *page;
1636		1636
1637	ctx->ra_bio = bio_alloc_bioset(GFP_KERNEL, BIO_MAX_PAGES, &log->bs);	1637	ctx->ra_bio = bio_alloc_bioset(GFP_KERNEL, BIO_MAX_VECS, &log->bs);
1638	if (!ctx->ra_bio)	1638	if (!ctx->ra_bio)
1639	return -ENOMEM;	1639	return -ENOMEM;
1640		1640

drivers/md/raid5-ppl.c+1−1

@@ -496,7 +496,7 @@ static void ppl_submit_iounit(struct ppl_io_unit *io) · 495 unmodified lines
496	if (!bio_add_page(bio, sh->ppl_page, PAGE_SIZE, 0)) {	496	if (!bio_add_page(bio, sh->ppl_page, PAGE_SIZE, 0)) {
497	struct bio *prev = bio;	497	struct bio *prev = bio;
498		498
499	bio = bio_alloc_bioset(GFP_NOIO, BIO_MAX_PAGES,	499	bio = bio_alloc_bioset(GFP_NOIO, BIO_MAX_VECS,
500	&ppl_conf->bs);	500	&ppl_conf->bs);
501	bio->bi_opf = prev->bi_opf;	501	bio->bi_opf = prev->bi_opf;
502	bio->bi_write_hint = prev->bi_write_hint;	502	bio->bi_write_hint = prev->bi_write_hint;

drivers/media/platform/rockchip/rkisp1/rkisp1-params.c+0−1

@@ -1288,7 +1288,6 @@ static void rkisp1_params_config_parameter(struct rkisp1_params *params) · 1287 unmodified lines
1288	memset(hst.hist_weight, 0x01, sizeof(hst.hist_weight));	1288	memset(hst.hist_weight, 0x01, sizeof(hst.hist_weight));
1289	rkisp1_hst_config(params, &hst);	1289	rkisp1_hst_config(params, &hst);
1290	rkisp1_param_set_bits(params, RKISP1_CIF_ISP_HIST_PROP,	1290	rkisp1_param_set_bits(params, RKISP1_CIF_ISP_HIST_PROP,
1291	~RKISP1_CIF_ISP_HIST_PROP_MODE_MASK \|
1292	rkisp1_hst_params_default_config.mode);	1291	rkisp1_hst_params_default_config.mode);
1293		1292
1294	/* set the range */	1293	/* set the range */

drivers/media/platform/vsp1/vsp1_drm.c+3−3

@@ -245,7 +245,7 @@ static int vsp1_du_pipeline_setup_brx(struct vsp1_device *vsp1, · 244 unmodified lines
245	brx = &vsp1->bru->entity;	245	brx = &vsp1->bru->entity;
246	else if (pipe->brx && !drm_pipe->force_brx_release)	246	else if (pipe->brx && !drm_pipe->force_brx_release)
247	brx = pipe->brx;	247	brx = pipe->brx;
248	else if (!vsp1->bru->entity.pipe)	248	else if (vsp1_feature(vsp1, VSP1_HAS_BRU) && !vsp1->bru->entity.pipe)
249	brx = &vsp1->bru->entity;	249	brx = &vsp1->bru->entity;
250	else	250	else
251	brx = &vsp1->brs->entity;	251	brx = &vsp1->brs->entity;
@@ -462,9 +462,9 @@ static int vsp1_du_pipeline_setup_inputs(struct vsp1_device *vsp1, · 210 unmodified lines
462	* make sure it is present in the pipeline's list of entities if it	462	* make sure it is present in the pipeline's list of entities if it
463	* wasn't already.	463	* wasn't already.
464	*/	464	*/
465	if (!use_uif) {	465	if (drm_pipe->uif && !use_uif) {
466	drm_pipe->uif->pipe = NULL;	466	drm_pipe->uif->pipe = NULL;
467	} else if (!drm_pipe->uif->pipe) {	467	} else if (drm_pipe->uif && !drm_pipe->uif->pipe) {
468	drm_pipe->uif->pipe = pipe;	468	drm_pipe->uif->pipe = pipe;
469	list_add_tail(&drm_pipe->uif->list_pipe, &pipe->entities);	469	list_add_tail(&drm_pipe->uif->list_pipe, &pipe->entities);
470	}	470	}

drivers/media/rc/Makefile+1−0

@@ -5,6 +5,7 @@ obj-y += keymaps/ · 4 unmodified lines
5	obj-$(CONFIG_RC_CORE) += rc-core.o	5	obj-$(CONFIG_RC_CORE) += rc-core.o
6	rc-core-y := rc-main.o rc-ir-raw.o	6	rc-core-y := rc-main.o rc-ir-raw.o
7	rc-core-$(CONFIG_LIRC) += lirc_dev.o	7	rc-core-$(CONFIG_LIRC) += lirc_dev.o
		8	rc-core-$(CONFIG_MEDIA_CEC_RC) += keymaps/rc-cec.o
8	rc-core-$(CONFIG_BPF_LIRC_MODE2) += bpf-lirc.o	9	rc-core-$(CONFIG_BPF_LIRC_MODE2) += bpf-lirc.o
9	obj-$(CONFIG_IR_NEC_DECODER) += ir-nec-decoder.o	10	obj-$(CONFIG_IR_NEC_DECODER) += ir-nec-decoder.o
10	obj-$(CONFIG_IR_RC5_DECODER) += ir-rc5-decoder.o	11	obj-$(CONFIG_IR_RC5_DECODER) += ir-rc5-decoder.o

drivers/media/rc/keymaps/Makefile+0−1

@@ -21,7 +21,6 @@ obj-$(CONFIG_RC_MAP) += rc-adstech-dvb-t-pci.o \ · 20 unmodified lines
21	rc-behold.o \	21	rc-behold.o \
22	rc-behold-columbus.o \	22	rc-behold-columbus.o \
23	rc-budget-ci-old.o \	23	rc-budget-ci-old.o \
24	rc-cec.o \
25	rc-cinergy-1400.o \	24	rc-cinergy-1400.o \
26	rc-cinergy.o \	25	rc-cinergy.o \
27	rc-d680-dmb.o \	26	rc-d680-dmb.o \

drivers/media/rc/keymaps/rc-cec.c+11−17

 // SPDX-License-Identifier: GPL-2.0-or-later
 /* Keytable for the CEC remote control
+ *
+ * This keymap is unusual in that it can't be built as a module,
+ * instead it is registered directly in rc-main.c if CONFIG_MEDIA_CEC_RC
+ * is set. This is because it can be called from drm_dp_cec_set_edid() via
+ * cec_register_adapter() in an asynchronous context, and it is not
+ * allowed to use request_module() to load rc-cec.ko in that case.
+ *
+ * Since this keymap is only used if CONFIG_MEDIA_CEC_RC is set, we
+ * just compile this keymap into the rc-core module and never as a
+ * separate module.
  *
  * Copyright (c) 2015 by Kamil Debski
  */
 	/* 0x77-0xff: Reserved */
 };
-static struct rc_map_list cec_map = {
+struct rc_map_list cec_map = {
 	.map = {
 		.scan		= cec,
 		.size		= ARRAY_SIZE(cec),
 		.name		= RC_MAP_CEC,
 	}
 };
-static int __init init_rc_map_cec(void)
-{
-	return rc_map_register(&cec_map);
-}
-static void __exit exit_rc_map_cec(void)
-{
-	rc_map_unregister(&cec_map);
-}
-module_init(init_rc_map_cec);
-module_exit(exit_rc_map_cec);
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Kamil Debski");

drivers/media/rc/rc-main.c+6−0

 	led_trigger_register_simple("rc-feedback", &led_feedback);
 	rc_map_register(&empty_map);
+#ifdef CONFIG_MEDIA_CEC_RC
+	rc_map_register(&cec_map);
+#endif
 	return 0;
 }
 	lirc_dev_exit();
 	class_unregister(&rc_class);
 	led_trigger_unregister_simple(led_feedback);
+#ifdef CONFIG_MEDIA_CEC_RC
+	rc_map_unregister(&cec_map);
+#endif
 	rc_map_unregister(&empty_map);
 }

drivers/media/usb/usbtv/usbtv-audio.c+1−1

@@ -371,7 +371,7 @@ void usbtv_audio_free(struct usbtv *usbtv) · 370 unmodified lines
371	cancel_work_sync(&usbtv->snd_trigger);	371	cancel_work_sync(&usbtv->snd_trigger);
372		372
373	if (usbtv->snd && usbtv->udev) {	373	if (usbtv->snd && usbtv->udev) {
374	snd_card_free(usbtv->snd);	374	snd_card_free_when_closed(usbtv->snd);
375	usbtv->snd = NULL;	375	usbtv->snd = NULL;
376	}	376	}
377	}	377	}

drivers/misc/fastrpc.c+5−0

 	if (!fl->cctx->rpdev)
 		return -EPIPE;
+	if (handle == FASTRPC_INIT_HANDLE && !kernel) {
+		dev_warn_ratelimited(fl->sctx->dev, "user app trying to send a kernel RPC message (%d)\n",  handle);
+		return -EPERM;
+	}
 	ctx = fastrpc_context_alloc(fl, kernel, sc, args);
 	if (IS_ERR(ctx))
 		return PTR_ERR(ctx);

drivers/misc/habanalabs/common/debugfs.c+1−4

@@ -992,7 +992,6 @@ void hl_debugfs_add_device(struct hl_device *hdev) · 991 unmodified lines
992	struct hl_dbg_device_entry *dev_entry = &hdev->hl_debugfs;	992	struct hl_dbg_device_entry *dev_entry = &hdev->hl_debugfs;
993	int count = ARRAY_SIZE(hl_debugfs_list);	993	int count = ARRAY_SIZE(hl_debugfs_list);
994	struct hl_debugfs_entry *entry;	994	struct hl_debugfs_entry *entry;
995	struct dentry *ent;
996	int i;	995	int i;
997		996
998	dev_entry->hdev = hdev;	997	dev_entry->hdev = hdev;
@@ -1105,13 +1104,11 @@ void hl_debugfs_add_device(struct hl_device *hdev) · 106 unmodified lines
1105	&hl_security_violations_fops);	1104	&hl_security_violations_fops);
1106		1105
1107	for (i = 0, entry = dev_entry->entry_arr ; i < count ; i++, entry++) {	1106	for (i = 0, entry = dev_entry->entry_arr ; i < count ; i++, entry++) {
1108		1107	debugfs_create_file(hl_debugfs_list[i].name,
1109	ent = debugfs_create_file(hl_debugfs_list[i].name,
1110	0444,	1108	0444,
1111	dev_entry->root,	1109	dev_entry->root,
1112	entry,	1110	entry,
1113	&hl_debugfs_fops);	1111	&hl_debugfs_fops);
1114	entry->dent = ent;
1115	entry->info_ent = &hl_debugfs_list[i];	1112	entry->info_ent = &hl_debugfs_list[i];
1116	entry->dev_entry = dev_entry;	1113	entry->dev_entry = dev_entry;
1117	}	1114	}

drivers/misc/habanalabs/common/device.c+35−5

 static int hl_device_release(struct inode *inode, struct file *filp)
 {
 	struct hl_fpriv *hpriv = filp->private_data;
+	struct hl_device *hdev = hpriv->hdev;
+	filp->private_data = NULL;
+	if (!hdev) {
+		pr_crit("Closing FD after device was removed. Memory leak will occur and it is advised to reboot.\n");
+		put_pid(hpriv->taskpid);
+		return 0;
+	}
 	hl_cb_mgr_fini(hpriv->hdev, &hpriv->cb_mgr);
 	hl_ctx_mgr_fini(hpriv->hdev, &hpriv->ctx_mgr);
-	filp->private_data = NULL;
 	hl_hpriv_put(hpriv);
 	return 0;
 static int hl_device_release_ctrl(struct inode *inode, struct file *filp)
 {
 	struct hl_fpriv *hpriv = filp->private_data;
-	struct hl_device *hdev;
+	struct hl_device *hdev = hpriv->hdev;
 	filp->private_data = NULL;
-	hdev = hpriv->hdev;
+	if (!hdev) {
+		pr_err("Closing FD after device was removed\n");
+		goto out;
+	}
 	mutex_lock(&hdev->fpriv_list_lock);
 	list_del(&hpriv->dev_node);
 	mutex_unlock(&hdev->fpriv_list_lock);
+out:
+	put_pid(hpriv->taskpid);
 	kfree(hpriv);
 static int hl_mmap(struct file *filp, struct vm_area_struct *vma)
 {
 	struct hl_fpriv *hpriv = filp->private_data;
+	struct hl_device *hdev = hpriv->hdev;
 	unsigned long vm_pgoff;
+	if (!hdev) {
+		pr_err_ratelimited("Trying to mmap after device was removed! Please close FD\n");
+		return -ENODEV;
+	}
 	vm_pgoff = vma->vm_pgoff;
 	vma->vm_pgoff = HL_MMAP_OFFSET_VALUE_GET(vm_pgoff);
 	return -EBUSY;
 }
+static void device_disable_open_processes(struct hl_device *hdev)
+{
+	struct hl_fpriv *hpriv;
+	mutex_lock(&hdev->fpriv_list_lock);
+	list_for_each_entry(hpriv, &hdev->fpriv_list, dev_node)
+		hpriv->hdev = NULL;
+	mutex_unlock(&hdev->fpriv_list_lock);
+}
 /*
  * hl_device_reset - reset the device
  *
 		HL_PENDING_RESET_LONG_SEC);
 	rc = device_kill_open_processes(hdev, HL_PENDING_RESET_LONG_SEC);
-	if (rc)
+	if (rc) {
 		dev_crit(hdev->dev, "Failed to kill all open processes\n");
+		device_disable_open_processes(hdev);
+	}
 	hl_cb_pool_fini(hdev);

drivers/misc/habanalabs/common/habanalabs.h+0−2

 /**
  * struct hl_debugfs_entry - debugfs dentry wrapper.
- * @dent: base debugfs entry structure.
  * @info_ent: dentry realted ops.
  * @dev_entry: ASIC specific debugfs manager.
  */
 struct hl_debugfs_entry {
-	struct dentry			*dent;
 	const struct hl_info_list	*info_ent;
 	struct hl_dbg_device_entry	*dev_entry;
 };

drivers/misc/habanalabs/common/habanalabs_ioctl.c+12−0

  * All Rights Reserved.
  */
+#define pr_fmt(fmt)	"habanalabs: " fmt
 #include <uapi/misc/habanalabs.h>
 #include "habanalabs.h"
 	const struct hl_ioctl_desc *ioctl = NULL;
 	unsigned int nr = _IOC_NR(cmd);
+	if (!hdev) {
+		pr_err_ratelimited("Sending ioctl after device was removed! Please close FD\n");
+		return -ENODEV;
+	}
 	if ((nr >= HL_COMMAND_START) && (nr < HL_COMMAND_END)) {
 		ioctl = &hl_ioctls[nr];
 	} else {
 	const struct hl_ioctl_desc *ioctl = NULL;
 	unsigned int nr = _IOC_NR(cmd);
+	if (!hdev) {
+		pr_err_ratelimited("Sending ioctl after device was removed! Please close FD\n");
+		return -ENODEV;
+	}
 	if (nr == _IOC_NR(HL_IOCTL_INFO)) {
 		ioctl = &hl_ioctls_control[nr];
 	} else {

drivers/misc/habanalabs/common/irq.c+1−1

@@ -47,7 +47,7 @@ inline u32 hl_cq_inc_ptr(u32 ptr) · 46 unmodified lines
47	* Increment ptr by 1. If it reaches the number of event queue	47	* Increment ptr by 1. If it reaches the number of event queue
48	* entries, set it to 0	48	* entries, set it to 0
49	*/	49	*/
50	inline u32 hl_eq_inc_ptr(u32 ptr)	50	static inline u32 hl_eq_inc_ptr(u32 ptr)
51	{	51	{
52	ptr++;	52	ptr++;
53	if (unlikely(ptr == HL_EQ_LENGTH))	53	if (unlikely(ptr == HL_EQ_LENGTH))

drivers/misc/habanalabs/common/mmu/mmu.c+26−12

@@ -499,18 +499,32 @@ static void hl_mmu_pa_page_with_offset(struct hl_ctx *ctx, u64 virt_addr, · 498 unmodified lines
499	else /* HL_VA_RANGE_TYPE_DRAM */	499	else /* HL_VA_RANGE_TYPE_DRAM */
500	p = &prop->dmmu;	500	p = &prop->dmmu;
501		501
502	/*	502	if ((hops->range_type == HL_VA_RANGE_TYPE_DRAM) &&
503	* find the correct hop shift field in hl_mmu_properties structure	503	!is_power_of_2(prop->dram_page_size)) {
504	* in order to determine the right maks for the page offset.	504	u32 bit;
505	*/	505	u64 page_offset_mask;
506	hop0_shift_off = offsetof(struct hl_mmu_properties, hop0_shift);	506	u64 phys_addr_mask;
507	p = (char *)p + hop0_shift_off;	507
508	p = (char )p + ((hops->used_hops - 1) sizeof(u64));	508	bit = __ffs64((u64)prop->dram_page_size);
509	hop_shift = (u64 )p;	509	page_offset_mask = ((1ull << bit) - 1);
510	offset_mask = (1ull << hop_shift) - 1;	510	phys_addr_mask = ~page_offset_mask;
511	addr_mask = ~(offset_mask);	511	*phys_addr = (tmp_phys_addr & phys_addr_mask) \|
512	*phys_addr = (tmp_phys_addr & addr_mask) \|	512	(virt_addr & page_offset_mask);
513	(virt_addr & offset_mask);	513	} else {
		514	/*
		515	* find the correct hop shift field in hl_mmu_properties
		516	* structure in order to determine the right masks
		517	* for the page offset.
		518	*/
		519	hop0_shift_off = offsetof(struct hl_mmu_properties, hop0_shift);
		520	p = (char *)p + hop0_shift_off;
		521	p = (char )p + ((hops->used_hops - 1) sizeof(u64));
		522	hop_shift = (u64 )p;
		523	offset_mask = (1ull << hop_shift) - 1;
		524	addr_mask = ~(offset_mask);
		525	*phys_addr = (tmp_phys_addr & addr_mask) \|
		526	(virt_addr & offset_mask);
		527	}
514	}	528	}
515		529
516	int hl_mmu_va_to_pa(struct hl_ctx ctx, u64 virt_addr, u64 phys_addr)	530	int hl_mmu_va_to_pa(struct hl_ctx ctx, u64 virt_addr, u64 phys_addr)

drivers/misc/ibmvmc.c+1−3

 	return -EPERM;
 }
-static int ibmvmc_remove(struct vio_dev *vdev)
+static void ibmvmc_remove(struct vio_dev *vdev)
 {
 	struct crq_server_adapter *adapter = dev_get_drvdata(&vdev->dev);
 	dev_info(adapter->dev, "Entering remove for UA 0x%x\n",
 		 vdev->unit_address);
 	ibmvmc_release_crq_queue(adapter);
-	return 0;
 }
 static struct vio_device_id ibmvmc_device_table[] = {

drivers/misc/pvpanic.c+1−0

@@ -140,6 +140,7 @@ static const struct of_device_id pvpanic_mmio_match[] = { · 139 unmodified lines
140	{ .compatible = "qemu,pvpanic-mmio", },	140	{ .compatible = "qemu,pvpanic-mmio", },
141	{}	141	{}
142	};	142	};
		143	MODULE_DEVICE_TABLE(of, pvpanic_mmio_match);
143		144
144	static const struct acpi_device_id pvpanic_device_ids[] = {	145	static const struct acpi_device_id pvpanic_device_ids[] = {
145	{ "QEMU0001", 0 },	146	{ "QEMU0001", 0 },

drivers/mmc/core/bus.c+5−6

 	mmc_remove_card_debugfs(card);
 #endif
-	if (host->cqe_enabled) {
-		host->cqe_ops->cqe_disable(host);
-		host->cqe_enabled = false;
-	}
 	if (mmc_card_present(card)) {
 		if (mmc_host_is_spi(card->host)) {
 			pr_info("%s: SPI card removed\n",
 		of_node_put(card->dev.of_node);
 	}
+	if (host->cqe_enabled) {
+		host->cqe_ops->cqe_disable(host);
+		host->cqe_enabled = false;
+	}
 	put_device(&card->dev);
 }

drivers/mmc/core/mmc.c+11−4

 		/* EXT_CSD value is in units of 10ms, but we store in ms */
 		card->ext_csd.part_time = 10 * ext_csd[EXT_CSD_PART_SWITCH_TIME];
-		/* Some eMMC set the value too low so set a minimum */
-		if (card->ext_csd.part_time &&
-		    card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME)
-			card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME;
 		/* Sleep / awake timeout in 100ns units */
 		if (sa_shift > 0 && sa_shift <= 0x17)
 		card->ext_csd.data_sector_size = 512;
 	}
+	/*
+	 * GENERIC_CMD6_TIME is to be used "unless a specific timeout is defined
+	 * when accessing a specific field", so use it here if there is no
+	 * PARTITION_SWITCH_TIME.
+	 */
+	if (!card->ext_csd.part_time)
+		card->ext_csd.part_time = card->ext_csd.generic_cmd6_time;
+	/* Some eMMC set the value too low so set a minimum */
+	if (card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME)
+		card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME;
 	/* eMMC v5 or later */
 	if (card->ext_csd.rev >= 7) {
 		memcpy(card->ext_csd.fwrev, &ext_csd[EXT_CSD_FIRMWARE_VERSION],

drivers/mmc/host/mmci.c+9−1

 		if (!cmd->busy_timeout)
 			cmd->busy_timeout = 10 * MSEC_PER_SEC;
-		clks = (unsigned long long)cmd->busy_timeout * host->cclk;
+		if (cmd->busy_timeout > host->mmc->max_busy_timeout)
+			clks = (unsigned long long)host->mmc->max_busy_timeout * host->cclk;
+		else
+			clks = (unsigned long long)cmd->busy_timeout * host->cclk;
 		do_div(clks, MSEC_PER_SEC);
 		writel_relaxed(clks, host->base + MMCIDATATIMER);
 	}
 		mmc->caps |= MMC_CAP_WAIT_WHILE_BUSY;
 	}
+	/* Variants with mandatory busy timeout in HW needs R1B responses. */
+	if (variant->busy_timeout)
+		mmc->caps |= MMC_CAP_NEED_RSP_BUSY;
 	/* Prepare a CMD12 - needed to clear the DPSM on some variants. */
 	host->stop_abort.opcode = MMC_STOP_TRANSMISSION;
 	host->stop_abort.arg = 0;

drivers/net/Kconfig+1−1

@@ -94,7 +94,7 @@ config WIREGUARD · 93 unmodified lines
94	select CRYPTO_BLAKE2S_ARM if ARM	94	select CRYPTO_BLAKE2S_ARM if ARM
95	select CRYPTO_CURVE25519_NEON if ARM && KERNEL_MODE_NEON	95	select CRYPTO_CURVE25519_NEON if ARM && KERNEL_MODE_NEON
96	select CRYPTO_CHACHA_MIPS if CPU_MIPS32_R2	96	select CRYPTO_CHACHA_MIPS if CPU_MIPS32_R2
97	select CRYPTO_POLY1305_MIPS if CPU_MIPS32 \|\| (CPU_MIPS64 && 64BIT)	97	select CRYPTO_POLY1305_MIPS if MIPS
98	help	98	help
99	WireGuard is a secure, fast, and easy to use replacement for IPSec	99	WireGuard is a secure, fast, and easy to use replacement for IPSec
100	that uses modern cryptography and clever networking tricks. It's	100	that uses modern cryptography and clever networking tricks. It's

drivers/net/bonding/bond_main.c+6−2

 	rcu_read_lock();
 	slave = bond_first_slave_rcu(bond);
-	if (!slave)
+	if (!slave) {
+		ret = -EINVAL;
 		goto out;
+	}
 	slave_ops = slave->dev->netdev_ops;
-	if (!slave_ops->ndo_neigh_setup)
+	if (!slave_ops->ndo_neigh_setup) {
+		ret = -EINVAL;
 		goto out;
+	}
 	/* TODO: find another way [1] to implement this.
 	 * Passing a zeroed structure is fragile,

drivers/net/can/flexcan.c+15−9

 	u32 reg;
 	reg = priv->read(&regs->mcr);
-	reg |= FLEXCAN_MCR_HALT;
+	reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT;
 	priv->write(reg, &regs->mcr);
 	while (timeout-- && !(priv->read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK))
 	flexcan_set_bittiming(dev);
+	/* set freeze, halt */
+	err = flexcan_chip_freeze(priv);
+	if (err)
+		goto out_chip_disable;
 	/* MCR
 	 *
-	 * enable freeze
-	 * halt now
 	 * only supervisor access
 	 * enable warning int
 	 * enable individual RX masking
 	 */
 	reg_mcr = priv->read(&regs->mcr);
 	reg_mcr &= ~FLEXCAN_MCR_MAXMB(0xff);
-	reg_mcr |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT | FLEXCAN_MCR_SUPV |
+	reg_mcr |= FLEXCAN_MCR_SUPV | FLEXCAN_MCR_WRN_EN | FLEXCAN_MCR_IRMQ |
-		FLEXCAN_MCR_WRN_EN | FLEXCAN_MCR_IRMQ | FLEXCAN_MCR_IDAM_C |
+		FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_MAXMB(priv->tx_mb_idx);
-		FLEXCAN_MCR_MAXMB(priv->tx_mb_idx);
 	/* MCR
 	 *
 	if (err)
 		goto out_chip_disable;
-	/* set freeze, halt and activate FIFO, restrict register access */
+	/* set freeze, halt */
+	err = flexcan_chip_freeze(priv);
+	if (err)
+		goto out_chip_disable;
+	/* activate FIFO, restrict register access */
 	reg = priv->read(&regs->mcr);
-	reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT |
+	reg |=  FLEXCAN_MCR_FEN | FLEXCAN_MCR_SUPV;
-		FLEXCAN_MCR_FEN | FLEXCAN_MCR_SUPV;
 	priv->write(reg, &regs->mcr);
 	/* Currently we only support newer versions of this core

drivers/net/can/m_can/tcan4x5x-core.c+3−3

 	if (ret)
 		return ret;
+	/* Zero out the MCAN buffers */
+	m_can_init_ram(cdev);
 	ret = regmap_update_bits(tcan4x5x->regmap, TCAN4X5X_CONFIG,
 				 TCAN4X5X_MODE_SEL_MASK, TCAN4X5X_MODE_NORMAL);
 	if (ret)
 		return ret;
-	/* Zero out the MCAN buffers */
-	m_can_init_ram(cdev);
 	return ret;
 }

drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c+4−17

 	u8 len;
 	int i, j;
-	netdev_reset_queue(priv->ndev);
 	/* TEF */
 	tef_ring = priv->tef;
 	tef_ring->head = 0;
 static int
 mcp251xfd_handle_tefif_one(struct mcp251xfd_priv *priv,
-			   const struct mcp251xfd_hw_tef_obj *hw_tef_obj,
+			   const struct mcp251xfd_hw_tef_obj *hw_tef_obj)
-			   unsigned int *frame_len_ptr)
 {
 	struct net_device_stats *stats = &priv->ndev->stats;
 	u32 seq, seq_masked, tef_tail_masked;
 	stats->tx_bytes +=
 		can_rx_offload_get_echo_skb(&priv->offload,
 					    mcp251xfd_get_tef_tail(priv),
-					    hw_tef_obj->ts,
+					    hw_tef_obj->ts, NULL);
-					    frame_len_ptr);
 	stats->tx_packets++;
 	priv->tef->tail++;
 static int mcp251xfd_handle_tefif(struct mcp251xfd_priv *priv)
 {
 	struct mcp251xfd_hw_tef_obj hw_tef_obj[MCP251XFD_TX_OBJ_NUM_MAX];
-	unsigned int total_frame_len = 0;
 	u8 tef_tail, len, l;
 	int err, i;
 	}
 	for (i = 0; i < len; i++) {
-		unsigned int frame_len;
+		err = mcp251xfd_handle_tefif_one(priv, &hw_tef_obj[i]);
-		err = mcp251xfd_handle_tefif_one(priv, &hw_tef_obj[i], &frame_len);
 		/* -EAGAIN means the Sequence Number in the TEF
 		 * doesn't match our tef_tail. This can happen if we
 		 * read the TEF objects too early. Leave loop let the
 			goto out_netif_wake_queue;
 		if (err)
 			return err;
-		total_frame_len += frame_len;
 	}
  out_netif_wake_queue:
 			return err;
 		tx_ring->tail += len;
-		netdev_completed_queue(priv->ndev, len, total_frame_len);
 		err = mcp251xfd_check_tef_tail(priv);
 		if (err)
 	struct mcp251xfd_priv *priv = netdev_priv(ndev);
 	struct mcp251xfd_tx_ring *tx_ring = priv->tx;
 	struct mcp251xfd_tx_obj *tx_obj;
-	unsigned int frame_len;
 	u8 tx_head;
 	int err;
 	if (mcp251xfd_get_tx_free(tx_ring) == 0)
 		netif_stop_queue(ndev);
-	frame_len = can_skb_get_frame_len(skb);
+	can_put_echo_skb(skb, ndev, tx_head, 0);
-	can_put_echo_skb(skb, ndev, tx_head, frame_len);
-	netdev_sent_queue(priv->ndev, frame_len);
 	err = mcp251xfd_tx_obj_write(priv, tx_obj);
 	if (err)

drivers/net/dsa/bcm_sf2.c+3−3

@@ -406,7 +406,7 @@ static int bcm_sf2_sw_rst(struct bcm_sf2_priv *priv) · 405 unmodified lines
406	/* The watchdog reset does not work on 7278, we need to hit the	406	/* The watchdog reset does not work on 7278, we need to hit the
407	* "external" reset line through the reset controller.	407	* "external" reset line through the reset controller.
408	*/	408	*/
409	if (priv->type == BCM7278_DEVICE_ID && !IS_ERR(priv->rcdev)) {	409	if (priv->type == BCM7278_DEVICE_ID) {
410	ret = reset_control_assert(priv->rcdev);	410	ret = reset_control_assert(priv->rcdev);
411	if (ret)	411	if (ret)
412	return ret;	412	return ret;
@@ -1265,7 +1265,7 @@ static int bcm_sf2_sw_probe(struct platform_device *pdev) · 852 unmodified lines
1265		1265
1266	priv->rcdev = devm_reset_control_get_optional_exclusive(&pdev->dev,	1266	priv->rcdev = devm_reset_control_get_optional_exclusive(&pdev->dev,
1267	"switch");	1267	"switch");
1268	if (PTR_ERR(priv->rcdev) == -EPROBE_DEFER)	1268	if (IS_ERR(priv->rcdev))
1269	return PTR_ERR(priv->rcdev);	1269	return PTR_ERR(priv->rcdev);
1270		1270
1271	/* Auto-detection using standard registers will not work, so	1271	/* Auto-detection using standard registers will not work, so
@@ -1426,7 +1426,7 @@ static int bcm_sf2_sw_remove(struct platform_device *pdev) · 154 unmodified lines
1426	bcm_sf2_mdio_unregister(priv);	1426	bcm_sf2_mdio_unregister(priv);
1427	clk_disable_unprepare(priv->clk_mdiv);	1427	clk_disable_unprepare(priv->clk_mdiv);
1428	clk_disable_unprepare(priv->clk);	1428	clk_disable_unprepare(priv->clk);
1429	if (priv->type == BCM7278_DEVICE_ID && !IS_ERR(priv->rcdev))	1429	if (priv->type == BCM7278_DEVICE_ID)
1430	reset_control_assert(priv->rcdev);	1430	reset_control_assert(priv->rcdev);
1431		1431
1432	return 0;	1432	return 0;

drivers/net/dsa/mt7530.c+4−0

 	}
 }
+#ifdef CONFIG_GPIOLIB
 static inline u32
 mt7530_gpio_to_bit(unsigned int offset)
 {
 	return devm_gpiochip_add_data(dev, gc, priv);
 }
+#endif /* CONFIG_GPIOLIB */
 static int
 mt7530_setup(struct dsa_switch *ds)
 		}
 	}
+#ifdef CONFIG_GPIOLIB
 	if (of_property_read_bool(priv->dev->of_node, "gpio-controller")) {
 		ret = mt7530_setup_gpio(priv);
 		if (ret)
 			return ret;
 	}
+#endif /* CONFIG_GPIOLIB */
 	mt7530_setup_port5(ds, interface);

drivers/net/dsa/sja1105/sja1105_main.c+3−3

@@ -1922,7 +1922,7 @@ out_unlock_ptp: · 1921 unmodified lines
1922	speed = SPEED_1000;	1922	speed = SPEED_1000;
1923	else if (bmcr & BMCR_SPEED100)	1923	else if (bmcr & BMCR_SPEED100)
1924	speed = SPEED_100;	1924	speed = SPEED_100;
1925	else if (bmcr & BMCR_SPEED10)	1925	else
1926	speed = SPEED_10;	1926	speed = SPEED_10;
1927		1927
1928	sja1105_sgmii_pcs_force_speed(priv, speed);	1928	sja1105_sgmii_pcs_force_speed(priv, speed);
@@ -3369,14 +3369,14 @@ static int sja1105_port_ucast_bcast_flood(struct sja1105_private *priv, int to, · 1440 unmodified lines
3369	if (flags.val & BR_FLOOD)	3369	if (flags.val & BR_FLOOD)
3370	priv->ucast_egress_floods \|= BIT(to);	3370	priv->ucast_egress_floods \|= BIT(to);
3371	else	3371	else
3372	priv->ucast_egress_floods \|= BIT(to);	3372	priv->ucast_egress_floods &= ~BIT(to);
3373	}	3373	}
3374		3374
3375	if (flags.mask & BR_BCAST_FLOOD) {	3375	if (flags.mask & BR_BCAST_FLOOD) {
3376	if (flags.val & BR_BCAST_FLOOD)	3376	if (flags.val & BR_BCAST_FLOOD)
3377	priv->bcast_egress_floods \|= BIT(to);	3377	priv->bcast_egress_floods \|= BIT(to);
3378	else	3378	else
3379	priv->bcast_egress_floods \|= BIT(to);	3379	priv->bcast_egress_floods &= ~BIT(to);
3380	}	3380	}
3381		3381
3382	return sja1105_manage_flood_domains(priv);	3382	return sja1105_manage_flood_domains(priv);

drivers/net/dsa/xrs700x/xrs700x.c+8−2

 		return -EOPNOTSUPP;
 	dsa_hsr_foreach_port(dp, ds, hsr) {
-		partner = dp;
+		if (dp->index != port) {
+			partner = dp;
+			break;
+		}
 	}
 	/* We can't enable redundancy on the switch until both
 	unsigned int val;
 	dsa_hsr_foreach_port(dp, ds, hsr) {
-		partner = dp;
+		if (dp->index != port) {
+			partner = dp;
+			break;
+		}
 	}
 	if (!partner)

drivers/net/ethernet/atheros/alx/main.c+5−2

 	if (!netif_running(alx->dev))
 		return 0;
-	netif_device_attach(alx->dev);
 	rtnl_lock();
 	err = __alx_open(alx, true);
 	rtnl_unlock();
+	if (err)
+		return err;
-	return err;
+	netif_device_attach(alx->dev);
+	return 0;
 }
 static SIMPLE_DEV_PM_OPS(alx_pm_ops, alx_suspend, alx_resume);

drivers/net/ethernet/broadcom/bcm4908_enet.c+3−0

@@ -592,6 +592,9 @@ static int bcm4908_enet_poll(struct napi_struct *napi, int weight) · 591 unmodified lines
592	bcm4908_enet_intrs_on(enet);	592	bcm4908_enet_intrs_on(enet);
593	}	593	}
594		594
		595	/* Hardware could disable ring if it run out of descriptors */
		596	bcm4908_enet_dma_rx_ring_enable(enet, &enet->rx_ring);
		597
595	return handled;	598	return handled;
596	}	599	}
597		600

drivers/net/ethernet/broadcom/bnxt/bnxt.c+15−2

 	bp->irq_tbl[0].handler = bnxt_inta;
 }
+static int bnxt_init_int_mode(struct bnxt *bp);
 static int bnxt_setup_int_mode(struct bnxt *bp)
 {
 	int rc;
+	if (!bp->irq_tbl) {
+		rc = bnxt_init_int_mode(bp);
+		if (rc || !bp->irq_tbl)
+			return rc ?: -ENODEV;
+	}
 	if (bp->flags & BNXT_FLAG_USING_MSIX)
 		bnxt_setup_msix(bp);
 	else
 static int bnxt_init_int_mode(struct bnxt *bp)
 {
-	int rc = 0;
+	int rc = -ENODEV;
 	if (bp->flags & BNXT_FLAG_MSIX_CAP)
 		rc = bnxt_init_msix(bp);
 {
 	struct hwrm_func_drv_if_change_output *resp = bp->hwrm_cmd_resp_addr;
 	struct hwrm_func_drv_if_change_input req = {0};
-	bool resc_reinit = false, fw_reset = false;
+	bool fw_reset = !bp->irq_tbl;
+	bool resc_reinit = false;
 	int rc, retry = 0;
 	u32 flags = 0;
 	if (test_bit(BNXT_STATE_IN_FW_RESET, &bp->state) && !fw_reset) {
 		netdev_err(bp->dev, "RESET_DONE not set during FW reset.\n");
+		set_bit(BNXT_STATE_ABORT_ERR, &bp->state);
 		return -ENODEV;
 	}
 	if (resc_reinit || fw_reset) {
 	if (test_bit(BNXT_STATE_IN_FW_RESET, &bp->state))
 		return -EBUSY;
+	if (bp->dev->reg_state == NETREG_UNREGISTERED)
+		return -ENODEV;
 	rc = bnxt_fw_init_one(bp);
 	if (!rc) {
 		bnxt_clear_int_mode(bp);

drivers/net/ethernet/cadence/macb_main.c+8−7

 	return 0;
 }
+static const struct macb_usrio_config macb_default_usrio = {
+	.mii = MACB_BIT(MII),
+	.rmii = MACB_BIT(RMII),
+	.rgmii = GEM_BIT(RGMII),
+	.refclk = MACB_BIT(CLKEN),
+};
 #if defined(CONFIG_OF)
 /* 1518 rounded up */
 #define AT91ETHER_MAX_RBUFF_SZ	0x600
 	return macb_init(pdev);
 }
-static const struct macb_usrio_config macb_default_usrio = {
-	.mii = MACB_BIT(MII),
-	.rmii = MACB_BIT(RMII),
-	.rgmii = GEM_BIT(RGMII),
-	.refclk = MACB_BIT(CLKEN),
-};
 static const struct macb_usrio_config sama7g5_usrio = {
 	.mii = 0,
 	.rmii = 1,
 	.dma_burst_length = 16,
 	.clk_init = macb_clk_init,
 	.init = macb_init,
+	.usrio = &macb_default_usrio,
 	.jumbo_max_len = 10240,
 };

drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c+4−4

@@ -672,7 +672,7 @@ static int chcr_ktls_cpl_act_open_rpl(struct adapter *adap, · 671 unmodified lines
672	if (tx_info->pending_close) {	672	if (tx_info->pending_close) {
673	spin_unlock(&tx_info->lock);	673	spin_unlock(&tx_info->lock);
674	if (!status) {	674	if (!status) {
675	/* it's a late success, tcb status is establised,	675	/* it's a late success, tcb status is established,
676	* mark it close.	676	* mark it close.
677	*/	677	*/
678	chcr_ktls_mark_tcb_close(tx_info);	678	chcr_ktls_mark_tcb_close(tx_info);
@@ -930,7 +930,7 @@ chcr_ktls_get_tx_flits(u32 nr_frags, unsigned int key_ctx_len) · 251 unmodified lines
930	}	930	}
931		931
932	/*	932	/*
933	* chcr_ktls_check_tcp_options: To check if there is any TCP option availbale	933	* chcr_ktls_check_tcp_options: To check if there is any TCP option available
934	* other than timestamp.	934	* other than timestamp.
935	* @skb - skb contains partial record..	935	* @skb - skb contains partial record..
936	* return: 1 / 0	936	* return: 1 / 0
@@ -1115,7 +1115,7 @@ static int chcr_ktls_xmit_wr_complete(struct sk_buff *skb, · 178 unmodified lines
1115	}	1115	}
1116		1116
1117	if (unlikely(credits < ETHTXQ_STOP_THRES)) {	1117	if (unlikely(credits < ETHTXQ_STOP_THRES)) {
1118	/* Credits are below the threshold vaues, stop the queue after	1118	/* Credits are below the threshold values, stop the queue after
1119	* injecting the Work Request for this packet.	1119	* injecting the Work Request for this packet.
1120	*/	1120	*/
1121	chcr_eth_txq_stop(q);	1121	chcr_eth_txq_stop(q);
@@ -2006,7 +2006,7 @@ static int chcr_ktls_xmit(struct sk_buff skb, struct net_device dev) · 884 unmodified lines
2006		2006
2007	/* TCP segments can be in received either complete or partial.	2007	/* TCP segments can be in received either complete or partial.
2008	* chcr_end_part_handler will handle cases if complete record or end	2008	* chcr_end_part_handler will handle cases if complete record or end
2009	* part of the record is received. Incase of partial end part of record,	2009	* part of the record is received. In case of partial end part of record,
2010	* we will send the complete record again.	2010	* we will send the complete record again.
2011	*/	2011	*/
2012		2012

drivers/net/ethernet/davicom/dm9000.c+18−5

 	u32		wake_state;
 	int		ip_summed;
+	struct regulator *power_supply;
 };
 /* debug code */
 		if (ret) {
 			dev_err(dev, "failed to request reset gpio %d: %d\n",
 				reset_gpios, ret);
-			return -ENODEV;
+			goto out_regulator_disable;
 		}
 		/* According to manual PWRST# Low Period Min 1ms */
 	if (!pdata) {
 		pdata = dm9000_parse_dt(&pdev->dev);
-		if (IS_ERR(pdata))
+		if (IS_ERR(pdata)) {
-			return PTR_ERR(pdata);
+			ret = PTR_ERR(pdata);
+			goto out_regulator_disable;
+		}
 	}
 	/* Init network device */
 	db->dev = &pdev->dev;
 	db->ndev = ndev;
+	if (!IS_ERR(power))
+		db->power_supply = power;
 	spin_lock_init(&db->lock);
 	mutex_init(&db->addr_lock);
 		goto out;
 	}
-	db->irq_wake = platform_get_irq(pdev, 1);
+	db->irq_wake = platform_get_irq_optional(pdev, 1);
 	if (db->irq_wake >= 0) {
 		dev_dbg(db->dev, "wakeup irq %d\n", db->irq_wake);
 	dm9000_release_board(pdev, db);
 	free_netdev(ndev);
+out_regulator_disable:
+	if (!IS_ERR(power))
+		regulator_disable(power);
 	return ret;
 }
 dm9000_drv_remove(struct platform_device *pdev)
 {
 	struct net_device *ndev = platform_get_drvdata(pdev);
+	struct board_info *dm = to_dm9000_board(ndev);
 	unregister_netdev(ndev);
-	dm9000_release_board(pdev, netdev_priv(ndev));
+	dm9000_release_board(pdev, dm);
 	free_netdev(ndev);		/* free device structure */
+	if (dm->power_supply)
+		regulator_disable(dm->power_supply);
 	dev_dbg(&pdev->dev, "released and freed device\n");
 	return 0;

drivers/net/ethernet/freescale/enetc/enetc.c+50−43

@@ -281,6 +281,8 @@ static int enetc_poll(struct napi_struct *napi, int budget) · 280 unmodified lines
281	int work_done;	281	int work_done;
282	int i;	282	int i;
283		283
		284	enetc_lock_mdio();
		285
284	for (i = 0; i < v->count_tx_rings; i++)	286	for (i = 0; i < v->count_tx_rings; i++)
285	if (!enetc_clean_tx_ring(&v->tx_ring[i], budget))	287	if (!enetc_clean_tx_ring(&v->tx_ring[i], budget))
286	complete = false;	288	complete = false;
@@ -291,8 +293,10 @@ static int enetc_poll(struct napi_struct *napi, int budget) · 4 unmodified lines
291	if (work_done)	293	if (work_done)
292	v->rx_napi_work = true;	294	v->rx_napi_work = true;
293		295
294	if (!complete)	296	if (!complete) {
		297	enetc_unlock_mdio();
295	return budget;	298	return budget;
		299	}
296		300
297	napi_complete_done(napi, work_done);	301	napi_complete_done(napi, work_done);
298		302
@@ -301,8 +305,6 @@ static int enetc_poll(struct napi_struct *napi, int budget) · 2 unmodified lines
301		305
302	v->rx_napi_work = false;	306	v->rx_napi_work = false;
303		307
304	enetc_lock_mdio();
305
306	/* enable interrupts */	308	/* enable interrupts */
307	enetc_wr_reg_hot(v->rbier, ENETC_RBIER_RXTIE);	309	enetc_wr_reg_hot(v->rbier, ENETC_RBIER_RXTIE);
308		310
@@ -327,8 +329,8 @@ static void enetc_get_tx_tstamp(struct enetc_hw hw, union enetc_tx_bd txbd, · 18 unmodified lines
327	{	329	{
328	u32 lo, hi, tstamp_lo;	330	u32 lo, hi, tstamp_lo;
329		331
330	lo = enetc_rd(hw, ENETC_SICTR0);	332	lo = enetc_rd_hot(hw, ENETC_SICTR0);
331	hi = enetc_rd(hw, ENETC_SICTR1);	333	hi = enetc_rd_hot(hw, ENETC_SICTR1);
332	tstamp_lo = le32_to_cpu(txbd->wb.tstamp);	334	tstamp_lo = le32_to_cpu(txbd->wb.tstamp);
333	if (lo <= tstamp_lo)	335	if (lo <= tstamp_lo)
334	hi -= 1;	336	hi -= 1;
@@ -342,6 +344,12 @@ static void enetc_tstamp_tx(struct sk_buff *skb, u64 tstamp) · 7 unmodified lines
342	if (skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS) {	344	if (skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS) {
343	memset(&shhwtstamps, 0, sizeof(shhwtstamps));	345	memset(&shhwtstamps, 0, sizeof(shhwtstamps));
344	shhwtstamps.hwtstamp = ns_to_ktime(tstamp);	346	shhwtstamps.hwtstamp = ns_to_ktime(tstamp);
		347	/* Ensure skb_mstamp_ns, which might have been populated with
		348	* the txtime, is not mistaken for a software timestamp,
		349	* because this will prevent the dispatch of our hardware
		350	* timestamp to the socket.
		351	*/
		352	skb->tstamp = ktime_set(0, 0);
345	skb_tstamp_tx(skb, &shhwtstamps);	353	skb_tstamp_tx(skb, &shhwtstamps);
346	}	354	}
347	}	355	}
@@ -358,9 +366,7 @@ static bool enetc_clean_tx_ring(struct enetc_bdr *tx_ring, int napi_budget) · 10 unmodified lines
358	i = tx_ring->next_to_clean;	366	i = tx_ring->next_to_clean;
359	tx_swbd = &tx_ring->tx_swbd[i];	367	tx_swbd = &tx_ring->tx_swbd[i];
360		368
361	enetc_lock_mdio();
362	bds_to_clean = enetc_bd_ready_count(tx_ring, i);	369	bds_to_clean = enetc_bd_ready_count(tx_ring, i);
363	enetc_unlock_mdio();
364		370
365	do_tstamp = false;	371	do_tstamp = false;
366		372
@@ -403,8 +409,6 @@ static bool enetc_clean_tx_ring(struct enetc_bdr *tx_ring, int napi_budget) · 36 unmodified lines
403	tx_swbd = tx_ring->tx_swbd;	409	tx_swbd = tx_ring->tx_swbd;
404	}	410	}
405		411
406	enetc_lock_mdio();
407
408	/* BD iteration loop end */	412	/* BD iteration loop end */
409	if (is_eof) {	413	if (is_eof) {
410	tx_frm_cnt++;	414	tx_frm_cnt++;
@@ -415,8 +419,6 @@ static bool enetc_clean_tx_ring(struct enetc_bdr *tx_ring, int napi_budget) · 4 unmodified lines
415		419
416	if (unlikely(!bds_to_clean))	420	if (unlikely(!bds_to_clean))
417	bds_to_clean = enetc_bd_ready_count(tx_ring, i);	421	bds_to_clean = enetc_bd_ready_count(tx_ring, i);
418
419	enetc_unlock_mdio();
420	}	422	}
421		423
422	tx_ring->next_to_clean = i;	424	tx_ring->next_to_clean = i;
@@ -527,9 +529,8 @@ static void enetc_get_rx_tstamp(struct net_device *ndev, · 104 unmodified lines
527	static void enetc_get_offloads(struct enetc_bdr *rx_ring,	529	static void enetc_get_offloads(struct enetc_bdr *rx_ring,
528	union enetc_rx_bd rxbd, struct sk_buff skb)	530	union enetc_rx_bd rxbd, struct sk_buff skb)
529	{	531	{
530	#ifdef CONFIG_FSL_ENETC_PTP_CLOCK
531	struct enetc_ndev_priv *priv = netdev_priv(rx_ring->ndev);	532	struct enetc_ndev_priv *priv = netdev_priv(rx_ring->ndev);
532	#endif	533
533	/* TODO: hashing */	534	/* TODO: hashing */
534	if (rx_ring->ndev->features & NETIF_F_RXCSUM) {	535	if (rx_ring->ndev->features & NETIF_F_RXCSUM) {
535	u16 inet_csum = le16_to_cpu(rxbd->r.inet_csum);	536	u16 inet_csum = le16_to_cpu(rxbd->r.inet_csum);
@@ -538,12 +539,31 @@ static void enetc_get_offloads(struct enetc_bdr *rx_ring, · 2 unmodified lines
538	skb->ip_summed = CHECKSUM_COMPLETE;	539	skb->ip_summed = CHECKSUM_COMPLETE;
539	}	540	}
540		541
541	/* copy VLAN to skb, if one is extracted, for now we assume it's a	542	if (le16_to_cpu(rxbd->r.flags) & ENETC_RXBD_FLAG_VLAN) {
542	* standard TPID, but HW also supports custom values	543	__be16 tpid = 0;
543	*/	544
544	if (le16_to_cpu(rxbd->r.flags) & ENETC_RXBD_FLAG_VLAN)	545	switch (le16_to_cpu(rxbd->r.flags) & ENETC_RXBD_FLAG_TPID) {
545	__vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q),	546	case 0:
546	le16_to_cpu(rxbd->r.vlan_opt));	547	tpid = htons(ETH_P_8021Q);
		548	break;
		549	case 1:
		550	tpid = htons(ETH_P_8021AD);
		551	break;
		552	case 2:
		553	tpid = htons(enetc_port_rd(&priv->si->hw,
		554	ENETC_PCVLANR1));
		555	break;
		556	case 3:
		557	tpid = htons(enetc_port_rd(&priv->si->hw,
		558	ENETC_PCVLANR2));
		559	break;
		560	default:
		561	break;
		562	}
		563
		564	__vlan_hwaccel_put_tag(skb, tpid, le16_to_cpu(rxbd->r.vlan_opt));
		565	}
		566
547	#ifdef CONFIG_FSL_ENETC_PTP_CLOCK	567	#ifdef CONFIG_FSL_ENETC_PTP_CLOCK
548	if (priv->active_offloads & ENETC_F_RX_TSTAMP)	568	if (priv->active_offloads & ENETC_F_RX_TSTAMP)
549	enetc_get_rx_tstamp(rx_ring->ndev, rxbd, skb);	569	enetc_get_rx_tstamp(rx_ring->ndev, rxbd, skb);
@@ -660,8 +680,6 @@ static int enetc_clean_rx_ring(struct enetc_bdr *rx_ring, · 110 unmodified lines
660	u32 bd_status;	680	u32 bd_status;
661	u16 size;	681	u16 size;
662		682
663	enetc_lock_mdio();
664
665	if (cleaned_cnt >= ENETC_RXBD_BUNDLE) {	683	if (cleaned_cnt >= ENETC_RXBD_BUNDLE) {
666	int count = enetc_refill_rx_ring(rx_ring, cleaned_cnt);	684	int count = enetc_refill_rx_ring(rx_ring, cleaned_cnt);
667		685
@@ -672,19 +690,15 @@ static int enetc_clean_rx_ring(struct enetc_bdr *rx_ring, · 4 unmodified lines
672		690
673	rxbd = enetc_rxbd(rx_ring, i);	691	rxbd = enetc_rxbd(rx_ring, i);
674	bd_status = le32_to_cpu(rxbd->r.lstatus);	692	bd_status = le32_to_cpu(rxbd->r.lstatus);
675	if (!bd_status) {	693	if (!bd_status)
676	enetc_unlock_mdio();
677	break;	694	break;
678	}
679		695
680	enetc_wr_reg_hot(rx_ring->idr, BIT(rx_ring->index));	696	enetc_wr_reg_hot(rx_ring->idr, BIT(rx_ring->index));
681	dma_rmb(); /* for reading other rxbd fields */	697	dma_rmb(); /* for reading other rxbd fields */
682	size = le16_to_cpu(rxbd->r.buf_len);	698	size = le16_to_cpu(rxbd->r.buf_len);
683	skb = enetc_map_rx_buff_to_skb(rx_ring, i, size);	699	skb = enetc_map_rx_buff_to_skb(rx_ring, i, size);
684	if (!skb) {	700	if (!skb)
685	enetc_unlock_mdio();
686	break;	701	break;
687	}
688		702
689	enetc_get_offloads(rx_ring, rxbd, skb);	703	enetc_get_offloads(rx_ring, rxbd, skb);
690		704
@@ -696,7 +710,6 @@ static int enetc_clean_rx_ring(struct enetc_bdr *rx_ring, · 5 unmodified lines
696		710
697	if (unlikely(bd_status &	711	if (unlikely(bd_status &
698	ENETC_RXBD_LSTATUS(ENETC_RXBD_ERR_MASK))) {	712	ENETC_RXBD_LSTATUS(ENETC_RXBD_ERR_MASK))) {
699	enetc_unlock_mdio();
700	dev_kfree_skb(skb);	713	dev_kfree_skb(skb);
701	while (!(bd_status & ENETC_RXBD_LSTATUS_F)) {	714	while (!(bd_status & ENETC_RXBD_LSTATUS_F)) {
702	dma_rmb();	715	dma_rmb();
@@ -736,8 +749,6 @@ static int enetc_clean_rx_ring(struct enetc_bdr *rx_ring, · 33 unmodified lines
736		749
737	enetc_process_skb(rx_ring, skb);	750	enetc_process_skb(rx_ring, skb);
738		751
739	enetc_unlock_mdio();
740
741	napi_gro_receive(napi, skb);	752	napi_gro_receive(napi, skb);
742		753
743	rx_frm_cnt++;	754	rx_frm_cnt++;
@@ -984,7 +995,7 @@ static void enetc_free_rxtx_rings(struct enetc_ndev_priv *priv) · 240 unmodified lines
984	enetc_free_tx_ring(priv->tx_ring[i]);	995	enetc_free_tx_ring(priv->tx_ring[i]);
985	}	996	}
986		997
987	static int enetc_alloc_cbdr(struct device dev, struct enetc_cbdr cbdr)	998	int enetc_alloc_cbdr(struct device dev, struct enetc_cbdr cbdr)
988	{	999	{
989	int size = cbdr->bd_count * sizeof(struct enetc_cbd);	1000	int size = cbdr->bd_count * sizeof(struct enetc_cbd);
990		1001
@@ -1005,7 +1016,7 @@ static int enetc_alloc_cbdr(struct device dev, struct enetc_cbdr cbdr) · 14 unmodified lines
1005	return 0;	1016	return 0;
1006	}	1017	}
1007		1018
1008	static void enetc_free_cbdr(struct device dev, struct enetc_cbdr cbdr)	1019	void enetc_free_cbdr(struct device dev, struct enetc_cbdr cbdr)
1009	{	1020	{
1010	int size = cbdr->bd_count * sizeof(struct enetc_cbd);	1021	int size = cbdr->bd_count * sizeof(struct enetc_cbd);
1011		1022
@@ -1013,7 +1024,7 @@ static void enetc_free_cbdr(struct device dev, struct enetc_cbdr cbdr) · 1 unmodified line
1013	cbdr->bd_base = NULL;	1024	cbdr->bd_base = NULL;
1014	}	1025	}
1015		1026
1016	static void enetc_setup_cbdr(struct enetc_hw hw, struct enetc_cbdr cbdr)	1027	void enetc_setup_cbdr(struct enetc_hw hw, struct enetc_cbdr cbdr)
1017	{	1028	{
1018	/* set CBDR cache attributes */	1029	/* set CBDR cache attributes */
1019	enetc_wr(hw, ENETC_SICAR2,	1030	enetc_wr(hw, ENETC_SICAR2,
@@ -1033,7 +1044,7 @@ static void enetc_setup_cbdr(struct enetc_hw hw, struct enetc_cbdr cbdr) · 13 unmodified lines
1033	cbdr->cir = hw->reg + ENETC_SICBDRCIR;	1044	cbdr->cir = hw->reg + ENETC_SICBDRCIR;
1034	}	1045	}
1035		1046
1036	static void enetc_clear_cbdr(struct enetc_hw *hw)	1047	void enetc_clear_cbdr(struct enetc_hw *hw)
1037	{	1048	{
1038	enetc_wr(hw, ENETC_SICBDRMR, 0);	1049	enetc_wr(hw, ENETC_SICBDRMR, 0);
1039	}	1050	}
@@ -1058,13 +1069,12 @@ static int enetc_setup_default_rss_table(struct enetc_si *si, int num_groups) · 18 unmodified lines
1058	return 0;	1069	return 0;
1059	}	1070	}
1060		1071
1061	static int enetc_configure_si(struct enetc_ndev_priv *priv)	1072	int enetc_configure_si(struct enetc_ndev_priv *priv)
1062	{	1073	{
1063	struct enetc_si *si = priv->si;	1074	struct enetc_si *si = priv->si;
1064	struct enetc_hw *hw = &si->hw;	1075	struct enetc_hw *hw = &si->hw;
1065	int err;	1076	int err;
1066		1077
1067	enetc_setup_cbdr(hw, &si->cbd_ring);
1068	/* set SI cache attributes */	1078	/* set SI cache attributes */
1069	enetc_wr(hw, ENETC_SICAR0,	1079	enetc_wr(hw, ENETC_SICAR0,
1070	ENETC_SICAR_RD_COHERENT \| ENETC_SICAR_WR_COHERENT);	1080	ENETC_SICAR_RD_COHERENT \| ENETC_SICAR_WR_COHERENT);
@@ -1112,6 +1122,8 @@ int enetc_alloc_si_resources(struct enetc_ndev_priv *priv) · 41 unmodified lines
1112	if (err)	1122	if (err)
1113	return err;	1123	return err;
1114		1124
		1125	enetc_setup_cbdr(&si->hw, &si->cbd_ring);
		1126
1115	priv->cls_rules = kcalloc(si->num_fs_entries, sizeof(*priv->cls_rules),	1127	priv->cls_rules = kcalloc(si->num_fs_entries, sizeof(*priv->cls_rules),
1116	GFP_KERNEL);	1128	GFP_KERNEL);
1117	if (!priv->cls_rules) {	1129	if (!priv->cls_rules) {
@@ -1119,14 +1131,8 @@ int enetc_alloc_si_resources(struct enetc_ndev_priv *priv) · 1 unmodified line
1119	goto err_alloc_cls;	1131	goto err_alloc_cls;
1120	}	1132	}
1121		1133
1122	err = enetc_configure_si(priv);
1123	if (err)
1124	goto err_config_si;
1125
1126	return 0;	1134	return 0;
1127		1135
1128	err_config_si:
1129	kfree(priv->cls_rules);
1130	err_alloc_cls:	1136	err_alloc_cls:
1131	enetc_clear_cbdr(&si->hw);	1137	enetc_clear_cbdr(&si->hw);
1132	enetc_free_cbdr(priv->dev, &si->cbd_ring);	1138	enetc_free_cbdr(priv->dev, &si->cbd_ring);
@@ -1212,7 +1218,8 @@ static void enetc_setup_rxbdr(struct enetc_hw hw, struct enetc_bdr rx_ring) · 79 unmodified lines
1212	rx_ring->idr = hw->reg + ENETC_SIRXIDR;	1218	rx_ring->idr = hw->reg + ENETC_SIRXIDR;
1213		1219
1214	enetc_refill_rx_ring(rx_ring, enetc_bd_unused(rx_ring));	1220	enetc_refill_rx_ring(rx_ring, enetc_bd_unused(rx_ring));
1215	enetc_wr(hw, ENETC_SIRXIDR, rx_ring->next_to_use);	1221	/* update ENETC's consumer index */
		1222	enetc_rxbdr_wr(hw, idx, ENETC_RBCIR, rx_ring->next_to_use);
1216		1223
1217	/* enable ring */	1224	/* enable ring */
1218	enetc_rxbdr_wr(hw, idx, ENETC_RBMR, rbmr);	1225	enetc_rxbdr_wr(hw, idx, ENETC_RBMR, rbmr);

drivers/net/ethernet/freescale/enetc/enetc.h+5−0

 void enetc_init_si_rings_params(struct enetc_ndev_priv *priv);
 int enetc_alloc_si_resources(struct enetc_ndev_priv *priv);
 void enetc_free_si_resources(struct enetc_ndev_priv *priv);
+int enetc_configure_si(struct enetc_ndev_priv *priv);
 int enetc_open(struct net_device *ndev);
 int enetc_close(struct net_device *ndev);
 void enetc_set_ethtool_ops(struct net_device *ndev);
 /* control buffer descriptor ring (CBDR) */
+int enetc_alloc_cbdr(struct device *dev, struct enetc_cbdr *cbdr);
+void enetc_free_cbdr(struct device *dev, struct enetc_cbdr *cbdr);
+void enetc_setup_cbdr(struct enetc_hw *hw, struct enetc_cbdr *cbdr);
+void enetc_clear_cbdr(struct enetc_hw *hw);
 int enetc_set_mac_flt_entry(struct enetc_si *si, int index,
 			    char *mac_addr, int si_map);
 int enetc_clear_mac_flt_entry(struct enetc_si *si, int index);

drivers/net/ethernet/freescale/enetc/enetc_hw.h+17−3

 #define ENETC_PSIPMAR0(n)	(0x0100 + (n) * 0x8) /* n = SI index */
 #define ENETC_PSIPMAR1(n)	(0x0104 + (n) * 0x8)
 #define ENETC_PVCLCTR		0x0208
+#define ENETC_PCVLANR1		0x0210
+#define ENETC_PCVLANR2		0x0214
 #define ENETC_VLAN_TYPE_C	BIT(0)
 #define ENETC_VLAN_TYPE_S	BIT(1)
 #define ENETC_PVCLCTR_OVTPIDL(bmp)	((bmp) & 0xff) /* VLAN_TYPE */
 #define ENETC_PM0_MAXFRM	0x8014
 #define ENETC_SET_TX_MTU(val)	((val) << 16)
 #define ENETC_SET_MAXFRM(val)	((val) & 0xffff)
+#define ENETC_PM0_RX_FIFO	0x801c
+#define ENETC_PM0_RX_FIFO_VAL	1
 #define ENETC_PM_IMDIO_BASE	0x8030
 #define ENETC_PM0_IF_MODE	0x8300
-#define ENETC_PMO_IFM_RG	BIT(2)
+#define ENETC_PM0_IFM_RG	BIT(2)
 #define ENETC_PM0_IFM_RLP	(BIT(5) | BIT(11))
-#define ENETC_PM0_IFM_RGAUTO	(BIT(15) | ENETC_PMO_IFM_RG | BIT(1))
+#define ENETC_PM0_IFM_EN_AUTO	BIT(15)
-#define ENETC_PM0_IFM_XGMII	BIT(12)
+#define ENETC_PM0_IFM_SSP_MASK	GENMASK(14, 13)
+#define ENETC_PM0_IFM_SSP_1000	(2 << 13)
+#define ENETC_PM0_IFM_SSP_100	(0 << 13)
+#define ENETC_PM0_IFM_SSP_10	(1 << 13)
+#define ENETC_PM0_IFM_FULL_DPX	BIT(12)
+#define ENETC_PM0_IFM_IFMODE_MASK GENMASK(1, 0)
+#define ENETC_PM0_IFM_IFMODE_XGMII 0
+#define ENETC_PM0_IFM_IFMODE_GMII 2
 #define ENETC_PSIDCAPR		0x1b08
 #define ENETC_PSIDCAPR_MSK	GENMASK(15, 0)
 #define ENETC_PSFCAPR		0x1b18
 #define enetc_wr_reg(reg, val)		_enetc_wr_reg_wa((reg), (val))
 #define enetc_rd(hw, off)		enetc_rd_reg((hw)->reg + (off))
 #define enetc_wr(hw, off, val)		enetc_wr_reg((hw)->reg + (off), val)
+#define enetc_rd_hot(hw, off)		enetc_rd_reg_hot((hw)->reg + (off))
+#define enetc_wr_hot(hw, off, val)	enetc_wr_reg_hot((hw)->reg + (off), val)
 #define enetc_rd64(hw, off)		_enetc_rd_reg64_wa((hw)->reg + (off))
 /* port register accessors - PF only */
 #define enetc_port_rd(hw, off)		enetc_rd_reg((hw)->port + (off))
 #define ENETC_RXBD_LSTATUS(flags)	((flags) << 16)
 #define ENETC_RXBD_FLAG_VLAN	BIT(9)
 #define ENETC_RXBD_FLAG_TSTMP	BIT(10)
+#define ENETC_RXBD_FLAG_TPID	GENMASK(1, 0)
 #define ENETC_MAC_ADDR_FILT_CNT	8 /* # of supported entries per port */
 #define EMETC_MAC_ADDR_FILT_RES	3 /* # of reserved entries at the beginning */

drivers/net/ethernet/freescale/enetc/enetc_pf.c+87−17

@@ -190,7 +190,6 @@ static void enetc_pf_set_rx_mode(struct net_device *ndev) · 189 unmodified lines
190	{	190	{
191	struct enetc_ndev_priv *priv = netdev_priv(ndev);	191	struct enetc_ndev_priv *priv = netdev_priv(ndev);
192	struct enetc_pf *pf = enetc_si_priv(priv->si);	192	struct enetc_pf *pf = enetc_si_priv(priv->si);
193	char vlan_promisc_simap = pf->vlan_promisc_simap;
194	struct enetc_hw *hw = &priv->si->hw;	193	struct enetc_hw *hw = &priv->si->hw;
195	bool uprom = false, mprom = false;	194	bool uprom = false, mprom = false;
196	struct enetc_mac_filter *filter;	195	struct enetc_mac_filter *filter;
@@ -203,16 +202,12 @@ static void enetc_pf_set_rx_mode(struct net_device *ndev) · 6 unmodified lines
203	psipmr = ENETC_PSIPMR_SET_UP(0) \| ENETC_PSIPMR_SET_MP(0);	202	psipmr = ENETC_PSIPMR_SET_UP(0) \| ENETC_PSIPMR_SET_MP(0);
204	uprom = true;	203	uprom = true;
205	mprom = true;	204	mprom = true;
206	/* Enable VLAN promiscuous mode for SI0 (PF) */
207	vlan_promisc_simap \|= BIT(0);
208	} else if (ndev->flags & IFF_ALLMULTI) {	205	} else if (ndev->flags & IFF_ALLMULTI) {
209	/* enable multi cast promisc mode for SI0 (PF) */	206	/* enable multi cast promisc mode for SI0 (PF) */
210	psipmr = ENETC_PSIPMR_SET_MP(0);	207	psipmr = ENETC_PSIPMR_SET_MP(0);
211	mprom = true;	208	mprom = true;
212	}	209	}
213		210
214	enetc_set_vlan_promisc(&pf->si->hw, vlan_promisc_simap);
215
216	/* first 2 filter entries belong to PF */	211	/* first 2 filter entries belong to PF */
217	if (!uprom) {	212	if (!uprom) {
218	/* Update unicast filters */	213	/* Update unicast filters */
@@ -320,7 +315,7 @@ static void enetc_set_loopback(struct net_device *ndev, bool en) · 101 unmodified lines
320	u32 reg;	315	u32 reg;
321		316
322	reg = enetc_port_rd(hw, ENETC_PM0_IF_MODE);	317	reg = enetc_port_rd(hw, ENETC_PM0_IF_MODE);
323	if (reg & ENETC_PMO_IFM_RG) {	318	if (reg & ENETC_PM0_IFM_RG) {
324	/* RGMII mode */	319	/* RGMII mode */
325	reg = (reg & ~ENETC_PM0_IFM_RLP) \|	320	reg = (reg & ~ENETC_PM0_IFM_RLP) \|
326	(en ? ENETC_PM0_IFM_RLP : 0);	321	(en ? ENETC_PM0_IFM_RLP : 0);
@@ -495,17 +490,30 @@ static void enetc_configure_port_mac(struct enetc_hw *hw) · 168 unmodified lines
495		490
496	enetc_port_wr(hw, ENETC_PM1_CMD_CFG, ENETC_PM0_CMD_PHY_TX_EN \|	491	enetc_port_wr(hw, ENETC_PM1_CMD_CFG, ENETC_PM0_CMD_PHY_TX_EN \|
497	ENETC_PM0_CMD_TXP \| ENETC_PM0_PROMISC);	492	ENETC_PM0_CMD_TXP \| ENETC_PM0_PROMISC);
		493
		494	/* On LS1028A, the MAC RX FIFO defaults to 2, which is too high
		495	* and may lead to RX lock-up under traffic. Set it to 1 instead,
		496	* as recommended by the hardware team.
		497	*/
		498	enetc_port_wr(hw, ENETC_PM0_RX_FIFO, ENETC_PM0_RX_FIFO_VAL);
498	}	499	}
499		500
500	static void enetc_mac_config(struct enetc_hw *hw, phy_interface_t phy_mode)	501	static void enetc_mac_config(struct enetc_hw *hw, phy_interface_t phy_mode)
501	{	502	{
502	/* set auto-speed for RGMII */	503	u32 val;
503	if (enetc_port_rd(hw, ENETC_PM0_IF_MODE) & ENETC_PMO_IFM_RG \|\|	504
504	phy_interface_mode_is_rgmii(phy_mode))	505	if (phy_interface_mode_is_rgmii(phy_mode)) {
505	enetc_port_wr(hw, ENETC_PM0_IF_MODE, ENETC_PM0_IFM_RGAUTO);	506	val = enetc_port_rd(hw, ENETC_PM0_IF_MODE);
		507	val &= ~ENETC_PM0_IFM_EN_AUTO;
		508	val &= ENETC_PM0_IFM_IFMODE_MASK;
		509	val \|= ENETC_PM0_IFM_IFMODE_GMII \| ENETC_PM0_IFM_RG;
		510	enetc_port_wr(hw, ENETC_PM0_IF_MODE, val);
		511	}
506		512
507	if (phy_mode == PHY_INTERFACE_MODE_USXGMII)	513	if (phy_mode == PHY_INTERFACE_MODE_USXGMII) {
508	enetc_port_wr(hw, ENETC_PM0_IF_MODE, ENETC_PM0_IFM_XGMII);	514	val = ENETC_PM0_IFM_FULL_DPX \| ENETC_PM0_IFM_IFMODE_XGMII;
		515	enetc_port_wr(hw, ENETC_PM0_IF_MODE, val);
		516	}
509	}	517	}
510		518
511	static void enetc_mac_enable(struct enetc_hw *hw, bool en)	519	static void enetc_mac_enable(struct enetc_hw *hw, bool en)
@@ -937,6 +945,34 @@ static void enetc_pl_mac_config(struct phylink_config *config, · 425 unmodified lines
937	phylink_set_pcs(priv->phylink, &pf->pcs->pcs);	945	phylink_set_pcs(priv->phylink, &pf->pcs->pcs);
938	}	946	}
939		947
		948	static void enetc_force_rgmii_mac(struct enetc_hw *hw, int speed, int duplex)
		949	{
		950	u32 old_val, val;
		951
		952	old_val = val = enetc_port_rd(hw, ENETC_PM0_IF_MODE);
		953
		954	if (speed == SPEED_1000) {
		955	val &= ~ENETC_PM0_IFM_SSP_MASK;
		956	val \|= ENETC_PM0_IFM_SSP_1000;
		957	} else if (speed == SPEED_100) {
		958	val &= ~ENETC_PM0_IFM_SSP_MASK;
		959	val \|= ENETC_PM0_IFM_SSP_100;
		960	} else if (speed == SPEED_10) {
		961	val &= ~ENETC_PM0_IFM_SSP_MASK;
		962	val \|= ENETC_PM0_IFM_SSP_10;
		963	}
		964
		965	if (duplex == DUPLEX_FULL)
		966	val \|= ENETC_PM0_IFM_FULL_DPX;
		967	else
		968	val &= ~ENETC_PM0_IFM_FULL_DPX;
		969
		970	if (val == old_val)
		971	return;
		972
		973	enetc_port_wr(hw, ENETC_PM0_IF_MODE, val);
		974	}
		975
940	static void enetc_pl_mac_link_up(struct phylink_config *config,	976	static void enetc_pl_mac_link_up(struct phylink_config *config,
941	struct phy_device *phy, unsigned int mode,	977	struct phy_device *phy, unsigned int mode,
942	phy_interface_t interface, int speed,	978	phy_interface_t interface, int speed,
@@ -949,6 +985,10 @@ static void enetc_pl_mac_link_up(struct phylink_config *config, · 6 unmodified lines
949	if (priv->active_offloads & ENETC_F_QBV)	985	if (priv->active_offloads & ENETC_F_QBV)
950	enetc_sched_speed_set(priv, speed);	986	enetc_sched_speed_set(priv, speed);
951		987
		988	if (!phylink_autoneg_inband(mode) &&
		989	phy_interface_mode_is_rgmii(interface))
		990	enetc_force_rgmii_mac(&pf->si->hw, speed, duplex);
		991
952	enetc_mac_enable(&pf->si->hw, true);	992	enetc_mac_enable(&pf->si->hw, true);
953	}	993	}
954		994
@@ -1041,6 +1081,26 @@ static int enetc_init_port_rss_memory(struct enetc_si *si) · 86 unmodified lines
1041	return err;	1081	return err;
1042	}	1082	}
1043		1083
		1084	static void enetc_init_unused_port(struct enetc_si *si)
		1085	{
		1086	struct device *dev = &si->pdev->dev;
		1087	struct enetc_hw *hw = &si->hw;
		1088	int err;
		1089
		1090	si->cbd_ring.bd_count = ENETC_CBDR_DEFAULT_SIZE;
		1091	err = enetc_alloc_cbdr(dev, &si->cbd_ring);
		1092	if (err)
		1093	return;
		1094
		1095	enetc_setup_cbdr(hw, &si->cbd_ring);
		1096
		1097	enetc_init_port_rfs_memory(si);
		1098	enetc_init_port_rss_memory(si);
		1099
		1100	enetc_clear_cbdr(hw);
		1101	enetc_free_cbdr(dev, &si->cbd_ring);
		1102	}
		1103
1044	static int enetc_pf_probe(struct pci_dev *pdev,	1104	static int enetc_pf_probe(struct pci_dev *pdev,
1045	const struct pci_device_id *ent)	1105	const struct pci_device_id *ent)
1046	{	1106	{
@@ -1051,11 +1111,6 @@ static int enetc_pf_probe(struct pci_dev *pdev, · 4 unmodified lines
1051	struct enetc_pf *pf;	1111	struct enetc_pf *pf;
1052	int err;	1112	int err;
1053		1113
1054	if (node && !of_device_is_available(node)) {
1055	dev_info(&pdev->dev, "device is disabled, skipping\n");
1056	return -ENODEV;
1057	}
1058
1059	err = enetc_pci_probe(pdev, KBUILD_MODNAME, sizeof(*pf));	1114	err = enetc_pci_probe(pdev, KBUILD_MODNAME, sizeof(*pf));
1060	if (err) {	1115	if (err) {
1061	dev_err(&pdev->dev, "PCI probing failed\n");	1116	dev_err(&pdev->dev, "PCI probing failed\n");
@@ -1069,6 +1124,13 @@ static int enetc_pf_probe(struct pci_dev *pdev, · 7 unmodified lines
1069	goto err_map_pf_space;	1124	goto err_map_pf_space;
1070	}	1125	}
1071		1126
		1127	if (node && !of_device_is_available(node)) {
		1128	enetc_init_unused_port(si);
		1129	dev_info(&pdev->dev, "device is disabled, skipping\n");
		1130	err = -ENODEV;
		1131	goto err_device_disabled;
		1132	}
		1133
1072	pf = enetc_si_priv(si);	1134	pf = enetc_si_priv(si);
1073	pf->si = si;	1135	pf->si = si;
1074	pf->total_vfs = pci_sriov_get_totalvfs(pdev);	1136	pf->total_vfs = pci_sriov_get_totalvfs(pdev);
@@ -1108,6 +1170,12 @@ static int enetc_pf_probe(struct pci_dev *pdev, · 33 unmodified lines
1108	goto err_init_port_rss;	1170	goto err_init_port_rss;
1109	}	1171	}
1110		1172
		1173	err = enetc_configure_si(priv);
		1174	if (err) {
		1175	dev_err(&pdev->dev, "Failed to configure SI\n");
		1176	goto err_config_si;
		1177	}
		1178
1111	err = enetc_alloc_msix(priv);	1179	err = enetc_alloc_msix(priv);
1112	if (err) {	1180	if (err) {
1113	dev_err(&pdev->dev, "MSIX alloc failed\n");	1181	dev_err(&pdev->dev, "MSIX alloc failed\n");
@@ -1136,6 +1204,7 @@ err_phylink_create: · 22 unmodified lines
1136	enetc_mdiobus_destroy(pf);	1204	enetc_mdiobus_destroy(pf);
1137	err_mdiobus_create:	1205	err_mdiobus_create:
1138	enetc_free_msix(priv);	1206	enetc_free_msix(priv);
		1207	err_config_si:
1139	err_init_port_rss:	1208	err_init_port_rss:
1140	err_init_port_rfs:	1209	err_init_port_rfs:
1141	err_alloc_msix:	1210	err_alloc_msix:
@@ -1144,6 +1213,7 @@ err_alloc_si_res: · 2 unmodified lines
1144	si->ndev = NULL;	1213	si->ndev = NULL;
1145	free_netdev(ndev);	1214	free_netdev(ndev);
1146	err_alloc_netdev:	1215	err_alloc_netdev:
		1216	err_device_disabled:
1147	err_map_pf_space:	1217	err_map_pf_space:
1148	enetc_pci_remove(pdev);	1218	enetc_pci_remove(pdev);
1149		1219

drivers/net/ethernet/freescale/enetc/enetc_vf.c+7−0

 		goto err_alloc_si_res;
 	}
+	err = enetc_configure_si(priv);
+	if (err) {
+		dev_err(&pdev->dev, "Failed to configure SI\n");
+		goto err_config_si;
+	}
 	err = enetc_alloc_msix(priv);
 	if (err) {
 		dev_err(&pdev->dev, "MSIX alloc failed\n");
 err_reg_netdev:
 	enetc_free_msix(priv);
+err_config_si:
 err_alloc_msix:
 	enetc_free_si_resources(priv);
 err_alloc_si_res:

drivers/net/ethernet/freescale/fec_ptp.c+7−0

 	u64 ns;
 	unsigned long flags;
+	mutex_lock(&adapter->ptp_clk_mutex);
+	/* Check the ptp clock */
+	if (!adapter->ptp_clk_on) {
+		mutex_unlock(&adapter->ptp_clk_mutex);
+		return -EINVAL;
+	}
 	spin_lock_irqsave(&adapter->tmreg_lock, flags);
 	ns = timecounter_read(&adapter->tc);
 	spin_unlock_irqrestore(&adapter->tmreg_lock, flags);
+	mutex_unlock(&adapter->ptp_clk_mutex);
 	*ts = ns_to_timespec64(ns);

drivers/net/ethernet/freescale/gianfar.c+15−0

@@ -2390,6 +2390,10 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus, · 2389 unmodified lines
2390	if (lstatus & BD_LFLAG(RXBD_LAST))	2390	if (lstatus & BD_LFLAG(RXBD_LAST))
2391	size -= skb->len;	2391	size -= skb->len;
2392		2392
		2393	WARN(size < 0, "gianfar: rx fragment size underflow");
		2394	if (size < 0)
		2395	return false;
		2396
2393	skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,	2397	skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
2394	rxb->page_offset + RXBUF_ALIGNMENT,	2398	rxb->page_offset + RXBUF_ALIGNMENT,
2395	size, GFAR_RXB_TRUESIZE);	2399	size, GFAR_RXB_TRUESIZE);
@@ -2552,6 +2556,17 @@ static int gfar_clean_rx_ring(struct gfar_priv_rx_q *rx_queue, · 156 unmodified lines
2552	if (lstatus & BD_LFLAG(RXBD_EMPTY))	2556	if (lstatus & BD_LFLAG(RXBD_EMPTY))
2553	break;	2557	break;
2554		2558
		2559	/* lost RXBD_LAST descriptor due to overrun */
		2560	if (skb &&
		2561	(lstatus & BD_LFLAG(RXBD_FIRST))) {
		2562	/* discard faulty buffer */
		2563	dev_kfree_skb(skb);
		2564	skb = NULL;
		2565	rx_queue->stats.rx_dropped++;
		2566
		2567	/* can continue normally */
		2568	}
		2569
2555	/* order rx buffer descriptor reads */	2570	/* order rx buffer descriptor reads */
2556	rmb();	2571	rmb();
2557		2572

drivers/net/ethernet/hisilicon/hns/hns_enet.c+3−1

 			for (j = 0; j < fetch_num; j++) {
 				/* alloc one skb and init */
 				skb = hns_assemble_skb(ndev);
-				if (!skb)
+				if (!skb) {
+					ret = -ENOMEM;
 					goto out;
+				}
 				rd = &tx_ring_data(priv, skb->queue_mapping);
 				hns_nic_net_xmit_hw(ndev, skb, rd);

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h+3−3

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c+3−4

 	case BIT(INNER_SRC_MAC):
 		for (i = 0; i < ETH_ALEN; i++) {
 			calc_x(key_x[ETH_ALEN - 1 - i], rule->tuples.src_mac[i],
-			       rule->tuples.src_mac[i]);
+			       rule->tuples_mask.src_mac[i]);
 			calc_y(key_y[ETH_ALEN - 1 - i], rule->tuples.src_mac[i],
-			       rule->tuples.src_mac[i]);
+			       rule->tuples_mask.src_mac[i]);
 		}
 		return true;
 		fs->h_ext.vlan_tci = cpu_to_be16(rule->tuples.vlan_tag1);
 		fs->m_ext.vlan_tci =
 				rule->unused_tuple & BIT(INNER_VLAN_TAG_FST) ?
-				cpu_to_be16(VLAN_VID_MASK) :
+				0 : cpu_to_be16(rule->tuples_mask.vlan_tag1);
-				cpu_to_be16(rule->tuples_mask.vlan_tag1);
 	}
 	if (fs->flow_type & FLOW_MAC_EXT) {

drivers/net/ethernet/ibm/ibmveth.c+1−3

 	return 0;
 }
-static int ibmveth_remove(struct vio_dev *dev)
+static void ibmveth_remove(struct vio_dev *dev)
 {
 	struct net_device *netdev = dev_get_drvdata(&dev->dev);
 	struct ibmveth_adapter *adapter = netdev_priv(netdev);
 	free_netdev(netdev);
 	dev_set_drvdata(&dev->dev, NULL);
-	return 0;
 }
 static struct attribute veth_active_attr;

drivers/net/ethernet/ibm/ibmvnic.c+8−14

 MODULE_VERSION(IBMVNIC_DRIVER_VERSION);
 static int ibmvnic_version = IBMVNIC_INITIAL_VERSION;
-static int ibmvnic_remove(struct vio_dev *);
 static void release_sub_crqs(struct ibmvnic_adapter *, bool);
 static int ibmvnic_reset_crq(struct ibmvnic_adapter *);
 static int ibmvnic_send_crq_init(struct ibmvnic_adapter *);
 	if (!is_valid_ether_addr(addr->sa_data))
 		return -EADDRNOTAVAIL;
-	if (adapter->state != VNIC_PROBED) {
+	ether_addr_copy(adapter->mac_addr, addr->sa_data);
-		ether_addr_copy(adapter->mac_addr, addr->sa_data);
+	if (adapter->state != VNIC_PROBED)
 		rc = __ibmvnic_set_mac(netdev, addr->sa_data);
-	}
 	return rc;
 }
 {
 	struct device *dev = &adapter->vdev->dev;
 	unsigned long timeout = msecs_to_jiffies(20000);
-	u64 old_num_rx_queues, old_num_tx_queues;
+	u64 old_num_rx_queues = adapter->req_rx_queues;
+	u64 old_num_tx_queues = adapter->req_tx_queues;
 	int rc;
 	adapter->from_passive_init = false;
-	if (reset) {
+	if (reset)
-		old_num_rx_queues = adapter->req_rx_queues;
-		old_num_tx_queues = adapter->req_tx_queues;
 		reinit_completion(&adapter->init_done);
-	}
 	adapter->init_done_rc = 0;
 	rc = ibmvnic_send_crq_init(adapter);
 	return rc;
 }
-static int ibmvnic_remove(struct vio_dev *dev)
+static void ibmvnic_remove(struct vio_dev *dev)
 {
 	struct net_device *netdev = dev_get_drvdata(&dev->dev);
 	struct ibmvnic_adapter *adapter = netdev_priv(netdev);
 	 * after setting state, so __ibmvnic_reset() which is called
 	 * from the flush_work() below, can make progress.
 	 */
-	spin_lock_irqsave(&adapter->rwi_lock, flags);
+	spin_lock(&adapter->rwi_lock);
 	adapter->state = VNIC_REMOVING;
-	spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+	spin_unlock(&adapter->rwi_lock);
 	spin_unlock_irqrestore(&adapter->state_lock, flags);
 	device_remove_file(&dev->dev, &dev_attr_failover);
 	free_netdev(netdev);
 	dev_set_drvdata(&dev->dev, NULL);
-	return 0;
 }
 static ssize_t failover_store(struct device *dev, struct device_attribute *attr,

drivers/net/ethernet/intel/iavf/iavf_main.c+2−1

@@ -1776,7 +1776,8 @@ static int iavf_init_get_resources(struct iavf_adapter *adapter) · 1775 unmodified lines
1776	goto err_alloc;	1776	goto err_alloc;
1777	}	1777	}
1778		1778
1779	if (iavf_process_config(adapter))	1779	err = iavf_process_config(adapter);
		1780	if (err)
1780	goto err_alloc;	1781	goto err_alloc;
1781	adapter->current_op = VIRTCHNL_OP_UNKNOWN;	1782	adapter->current_op = VIRTCHNL_OP_UNKNOWN;
1782		1783

drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c+5−0

 		return -EINVAL;
 	}
+	if (xs->props.mode != XFRM_MODE_TRANSPORT) {
+		netdev_err(dev, "Unsupported mode for ipsec offload\n");
+		return -EINVAL;
+	}
 	if (ixgbe_ipsec_check_mgmt_ip(xs)) {
 		netdev_err(dev, "IPsec IP addr clash with mgmt filters\n");
 		return -EINVAL;

drivers/net/ethernet/intel/ixgbe/ixgbe_main.c+4−2

 	ixgbe_atr_compute_perfect_hash_82599(&input->filter, mask);
 	err = ixgbe_fdir_write_perfect_filter_82599(hw, &input->filter,
 						    input->sw_idx, queue);
-	if (!err)
+	if (err)
-		ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx);
+		goto err_out_w_lock;
+	ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx);
 	spin_unlock(&adapter->fdir_perfect_lock);
 	if ((uhtid != 0x800) && (adapter->jump_tables[uhtid]))

drivers/net/ethernet/intel/ixgbevf/ipsec.c+5−0

 		return -EINVAL;
 	}
+	if (xs->props.mode != XFRM_MODE_TRANSPORT) {
+		netdev_err(dev, "Unsupported mode for ipsec offload\n");
+		return -EINVAL;
+	}
 	if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) {
 		struct rx_sa rsa;

drivers/net/ethernet/marvell/octeontx2/af/cgx.c+3−1

@@ -56,7 +56,9 @@ static bool is_dev_rpm(void *cgxd) · 55 unmodified lines
56		56
57	bool is_lmac_valid(struct cgx *cgx, int lmac_id)	57	bool is_lmac_valid(struct cgx *cgx, int lmac_id)
58	{	58	{
59	return cgx && test_bit(lmac_id, &cgx->lmac_bmap);	59	if (!cgx \|\| lmac_id < 0 \|\| lmac_id >= MAX_LMAC_PER_CGX)
		60	return false;
		61	return test_bit(lmac_id, &cgx->lmac_bmap);
60	}	62	}
61		63
62	struct mac_ops get_mac_ops(void cgxd)	64	struct mac_ops get_mac_ops(void cgxd)

drivers/net/ethernet/mediatek/mtk_star_emac.c+3−2

 		goto push_new_skb;
 	}
-	desc_data.dma_addr = new_dma_addr;
 	/* We can't fail anymore at this point: it's safe to unmap the skb. */
 	mtk_star_dma_unmap_rx(priv, &desc_data);
 	desc_data.skb->dev = ndev;
 	netif_receive_skb(desc_data.skb);
+	/* update dma_addr for new skb */
+	desc_data.dma_addr = new_dma_addr;
 push_new_skb:
 	desc_data.len = skb_tailroom(new_skb);
 	desc_data.skb = new_skb;

drivers/net/ethernet/mellanox/mlx4/en_ethtool.c+1−1

@@ -47,7 +47,7 @@ · 46 unmodified lines
47	#define EN_ETHTOOL_SHORT_MASK cpu_to_be16(0xffff)	47	#define EN_ETHTOOL_SHORT_MASK cpu_to_be16(0xffff)
48	#define EN_ETHTOOL_WORD_MASK cpu_to_be32(0xffffffff)	48	#define EN_ETHTOOL_WORD_MASK cpu_to_be32(0xffffffff)
49		49
50	static int mlx4_en_moderation_update(struct mlx4_en_priv *priv)	50	int mlx4_en_moderation_update(struct mlx4_en_priv *priv)
51	{	51	{
52	int i, t;	52	int i, t;
53	int err = 0;	53	int err = 0;

drivers/net/ethernet/mellanox/mlx4/en_netdev.c+2−0

@@ -3554,6 +3554,8 @@ int mlx4_en_reset_config(struct net_device *dev, · 3553 unmodified lines
3554	en_err(priv, "Failed starting port\n");	3554	en_err(priv, "Failed starting port\n");
3555	}	3555	}
3556		3556
		3557	if (!err)
		3558	err = mlx4_en_moderation_update(priv);
3557	out:	3559	out:
3558	mutex_unlock(&mdev->state_lock);	3560	mutex_unlock(&mdev->state_lock);
3559	kfree(tmp);	3561	kfree(tmp);

drivers/net/ethernet/mellanox/mlx4/mlx4_en.h+1−0

@@ -775,6 +775,7 @@ void mlx4_en_ptp_overflow_check(struct mlx4_en_dev *mdev); · 774 unmodified lines
775	#define DEV_FEATURE_CHANGED(dev, new_features, feature) \	775	#define DEV_FEATURE_CHANGED(dev, new_features, feature) \
776	((dev->features & feature) ^ (new_features & feature))	776	((dev->features & feature) ^ (new_features & feature))
777		777
		778	int mlx4_en_moderation_update(struct mlx4_en_priv *priv);
778	int mlx4_en_reset_config(struct net_device *dev,	779	int mlx4_en_reset_config(struct net_device *dev,
779	struct hwtstamp_config ts_config,	780	struct hwtstamp_config ts_config,
780	netdev_features_t new_features);	781	netdev_features_t new_features);

drivers/net/ethernet/mellanox/mlxsw/reg.h+1−0

@@ -4430,6 +4430,7 @@ MLXSW_ITEM32(reg, ptys, ext_eth_proto_cap, 0x08, 0, 32); · 4429 unmodified lines
4430	#define MLXSW_REG_PTYS_ETH_SPEED_100GBASE_CR4 BIT(20)	4430	#define MLXSW_REG_PTYS_ETH_SPEED_100GBASE_CR4 BIT(20)
4431	#define MLXSW_REG_PTYS_ETH_SPEED_100GBASE_SR4 BIT(21)	4431	#define MLXSW_REG_PTYS_ETH_SPEED_100GBASE_SR4 BIT(21)
4432	#define MLXSW_REG_PTYS_ETH_SPEED_100GBASE_KR4 BIT(22)	4432	#define MLXSW_REG_PTYS_ETH_SPEED_100GBASE_KR4 BIT(22)
		4433	#define MLXSW_REG_PTYS_ETH_SPEED_100GBASE_LR4_ER4 BIT(23)
4433	#define MLXSW_REG_PTYS_ETH_SPEED_25GBASE_CR BIT(27)	4434	#define MLXSW_REG_PTYS_ETH_SPEED_25GBASE_CR BIT(27)
4434	#define MLXSW_REG_PTYS_ETH_SPEED_25GBASE_KR BIT(28)	4435	#define MLXSW_REG_PTYS_ETH_SPEED_25GBASE_KR BIT(28)
4435	#define MLXSW_REG_PTYS_ETH_SPEED_25GBASE_SR BIT(29)	4436	#define MLXSW_REG_PTYS_ETH_SPEED_25GBASE_SR BIT(29)

drivers/net/ethernet/mellanox/mlxsw/spectrum_ethtool.c+5−0

 		.mask_ethtool	= ETHTOOL_LINK_MODE_100000baseKR4_Full_BIT,
 		.speed		= SPEED_100000,
 	},
+	{
+		.mask		= MLXSW_REG_PTYS_ETH_SPEED_100GBASE_LR4_ER4,
+		.mask_ethtool	= ETHTOOL_LINK_MODE_100000baseLR4_ER4_Full_BIT,
+		.speed		= SPEED_100000,
+	},
 };
 #define MLXSW_SP1_PORT_LINK_MODE_LEN ARRAY_SIZE(mlxsw_sp1_port_link_mode)

drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c+7−0

 	if (mlxsw_sp->router->aborted)
 		return 0;
+	if (fen_info->fi->nh &&
+	    !mlxsw_sp_nexthop_obj_group_lookup(mlxsw_sp, fen_info->fi->nh->id))
+		return 0;
 	fib_node = mlxsw_sp_fib_node_get(mlxsw_sp, fen_info->tb_id,
 					 &fen_info->dst, sizeof(fen_info->dst),
 					 fen_info->dst_len,
 	if (mlxsw_sp_fib6_rt_should_ignore(rt))
 		return 0;
+	if (rt->nh && !mlxsw_sp_nexthop_obj_group_lookup(mlxsw_sp, rt->nh->id))
+		return 0;
 	fib_node = mlxsw_sp_fib_node_get(mlxsw_sp, rt->fib6_table->tb6_id,
 					 &rt->fib6_dst.addr,
 					 sizeof(rt->fib6_dst.addr),

drivers/net/ethernet/mellanox/mlxsw/switchx2.c+2−1

 	{
 		.mask		= MLXSW_REG_PTYS_ETH_SPEED_100GBASE_CR4 |
 				  MLXSW_REG_PTYS_ETH_SPEED_100GBASE_SR4 |
-				  MLXSW_REG_PTYS_ETH_SPEED_100GBASE_KR4,
+				  MLXSW_REG_PTYS_ETH_SPEED_100GBASE_KR4 |
+				  MLXSW_REG_PTYS_ETH_SPEED_100GBASE_LR4_ER4,
 		.speed		= 100000,
 	},
 };

drivers/net/ethernet/microchip/lan743x_main.c+1−1

@@ -2040,7 +2040,7 @@ lan743x_rx_trim_skb(struct sk_buff *skb, int frame_length) · 2039 unmodified lines
2040	dev_kfree_skb_irq(skb);	2040	dev_kfree_skb_irq(skb);
2041	return NULL;	2041	return NULL;
2042	}	2042	}
2043	frame_length = max_t(int, 0, frame_length - RX_HEAD_PADDING - 2);	2043	frame_length = max_t(int, 0, frame_length - RX_HEAD_PADDING - 4);
2044	if (skb->len > frame_length) {	2044	if (skb->len > frame_length) {
2045	skb->tail -= skb->len - frame_length;	2045	skb->tail -= skb->len - frame_length;
2046	skb->len = frame_length;	2046	skb->len = frame_length;

drivers/net/ethernet/mscc/Kconfig+1−0

@@ -13,6 +13,7 @@ if NET_VENDOR_MICROSEMI · 12 unmodified lines
13		13
14	# Users should depend on NET_SWITCHDEV, HAS_IOMEM	14	# Users should depend on NET_SWITCHDEV, HAS_IOMEM
15	config MSCC_OCELOT_SWITCH_LIB	15	config MSCC_OCELOT_SWITCH_LIB
		16	select NET_DEVLINK
16	select REGMAP_MMIO	17	select REGMAP_MMIO
17	select PACKING	18	select PACKING
18	select PHYLIB	19	select PHYLIB

drivers/net/ethernet/mscc/ocelot_flower.c+2−1

 			return -EOPNOTSUPP;
 		}
+		flow_rule_match_ipv4_addrs(rule, &match);
 		if (filter->block_id == VCAP_IS1 && *(u32 *)&match.mask->dst) {
 			NL_SET_ERR_MSG_MOD(extack,
 					   "Key type S1_NORMAL cannot match on destination IP");
 			return -EOPNOTSUPP;
 		}
-		flow_rule_match_ipv4_addrs(rule, &match);
 		tmp = &filter->key.ipv4.sip.value.addr[0];
 		memcpy(tmp, &match.key->src, 4);

drivers/net/ethernet/realtek/r8169_main.c+1−1

@@ -767,7 +767,7 @@ static void r8168fp_adjust_ocp_cmd(struct rtl8169_private tp, u32 cmd, int typ · 766 unmodified lines
767	if (type == ERIAR_OOB &&	767	if (type == ERIAR_OOB &&
768	(tp->mac_version == RTL_GIGA_MAC_VER_52 \|\|	768	(tp->mac_version == RTL_GIGA_MAC_VER_52 \|\|
769	tp->mac_version == RTL_GIGA_MAC_VER_53))	769	tp->mac_version == RTL_GIGA_MAC_VER_53))
770	*cmd \|= 0x7f0 << 18;	770	*cmd \|= 0xf70 << 18;
771	}	771	}
772		772
773	DECLARE_RTL_COND(rtl_eriar_cond)	773	DECLARE_RTL_COND(rtl_eriar_cond)

drivers/net/ethernet/renesas/sh_eth.c+7−0

 			  EESR_TDE,
 	.fdr_value	= 0x0000070f,
+	.trscer_err_mask = DESC_I_RINT8 | DESC_I_RINT5,
 	.no_psr		= 1,
 	.apr		= 1,
 	.mpr		= 1,
 	.fdr_value	= 0x0000070f,
+	.trscer_err_mask = DESC_I_RINT8 | DESC_I_RINT5,
 	.apr		= 1,
 	.mpr		= 1,
 	.tpauser	= 1,
 			  EESIPR_CEEFIP | EESIPR_CELFIP |
 			  EESIPR_RRFIP | EESIPR_RTLFIP | EESIPR_RTSFIP |
 			  EESIPR_PREIP | EESIPR_CERFIP,
+	.trscer_err_mask = DESC_I_RINT8,
 	.tsu		= 1,
 	.dual_port	= 1,
 };

drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c+45−14

 static int intel_mgbe_common_data(struct pci_dev *pdev,
 				  struct plat_stmmacenet_data *plat)
 {
+	char clk_name[20];
 	int ret;
 	int i;
 	plat->eee_usecs_rate = plat->clk_ptp_rate;
 	/* Set system clock */
+	sprintf(clk_name, "%s-%s", "stmmac", pci_name(pdev));
 	plat->stmmac_clk = clk_register_fixed_rate(&pdev->dev,
-						   "stmmac-clk", NULL, 0,
+						   clk_name, NULL, 0,
 						   plat->clk_ptp_rate);
 	if (IS_ERR(plat->stmmac_clk)) {
 	return intel_mgbe_common_data(pdev, plat);
 }
-static int tgl_sgmii_data(struct pci_dev *pdev,
+static int tgl_sgmii_phy0_data(struct pci_dev *pdev,
-			  struct plat_stmmacenet_data *plat)
+			       struct plat_stmmacenet_data *plat)
 {
 	plat->bus_id = 1;
 	plat->phy_interface = PHY_INTERFACE_MODE_SGMII;
 	return tgl_common_data(pdev, plat);
 }
-static struct stmmac_pci_info tgl_sgmii1g_info = {
+static struct stmmac_pci_info tgl_sgmii1g_phy0_info = {
-	.setup = tgl_sgmii_data,
+	.setup = tgl_sgmii_phy0_data,
 };
-static int adls_sgmii_data(struct pci_dev *pdev,
+static int tgl_sgmii_phy1_data(struct pci_dev *pdev,
-			   struct plat_stmmacenet_data *plat)
+			       struct plat_stmmacenet_data *plat)
+{
+	plat->bus_id = 2;
+	plat->phy_interface = PHY_INTERFACE_MODE_SGMII;
+	plat->serdes_powerup = intel_serdes_powerup;
+	plat->serdes_powerdown = intel_serdes_powerdown;
+	return tgl_common_data(pdev, plat);
+}
+static struct stmmac_pci_info tgl_sgmii1g_phy1_info = {
+	.setup = tgl_sgmii_phy1_data,
+};
+static int adls_sgmii_phy0_data(struct pci_dev *pdev,
+				struct plat_stmmacenet_data *plat)
 {
 	plat->bus_id = 1;
 	plat->phy_interface = PHY_INTERFACE_MODE_SGMII;
 	return tgl_common_data(pdev, plat);
 }
-static struct stmmac_pci_info adls_sgmii1g_info = {
+static struct stmmac_pci_info adls_sgmii1g_phy0_info = {
-	.setup = adls_sgmii_data,
+	.setup = adls_sgmii_phy0_data,
 };
+static int adls_sgmii_phy1_data(struct pci_dev *pdev,
+				struct plat_stmmacenet_data *plat)
+{
+	plat->bus_id = 2;
+	plat->phy_interface = PHY_INTERFACE_MODE_SGMII;
+	/* SerDes power up and power down are done in BIOS for ADL */
+	return tgl_common_data(pdev, plat);
+}
+static struct stmmac_pci_info adls_sgmii1g_phy1_info = {
+	.setup = adls_sgmii_phy1_data,
+};
 static const struct stmmac_pci_func_data galileo_stmmac_func_data[] = {
 	{
 		.func = 6,
 	{ PCI_DEVICE_DATA(INTEL, EHL_PSE1_RGMII1G_ID, &ehl_pse1_rgmii1g_info) },
 	{ PCI_DEVICE_DATA(INTEL, EHL_PSE1_SGMII1G_ID, &ehl_pse1_sgmii1g_info) },
 	{ PCI_DEVICE_DATA(INTEL, EHL_PSE1_SGMII2G5_ID, &ehl_pse1_sgmii1g_info) },
-	{ PCI_DEVICE_DATA(INTEL, TGL_SGMII1G_ID, &tgl_sgmii1g_info) },
+	{ PCI_DEVICE_DATA(INTEL, TGL_SGMII1G_ID, &tgl_sgmii1g_phy0_info) },
-	{ PCI_DEVICE_DATA(INTEL, TGLH_SGMII1G_0_ID, &tgl_sgmii1g_info) },
+	{ PCI_DEVICE_DATA(INTEL, TGLH_SGMII1G_0_ID, &tgl_sgmii1g_phy0_info) },
-	{ PCI_DEVICE_DATA(INTEL, TGLH_SGMII1G_1_ID, &tgl_sgmii1g_info) },
+	{ PCI_DEVICE_DATA(INTEL, TGLH_SGMII1G_1_ID, &tgl_sgmii1g_phy1_info) },
-	{ PCI_DEVICE_DATA(INTEL, ADLS_SGMII1G_0_ID, &adls_sgmii1g_info) },
+	{ PCI_DEVICE_DATA(INTEL, ADLS_SGMII1G_0_ID, &adls_sgmii1g_phy0_info) },
-	{ PCI_DEVICE_DATA(INTEL, ADLS_SGMII1G_1_ID, &adls_sgmii1g_info) },
+	{ PCI_DEVICE_DATA(INTEL, ADLS_SGMII1G_1_ID, &adls_sgmii1g_phy1_info) },
 	{}
 };
 MODULE_DEVICE_TABLE(pci, intel_eth_pci_id_table);

drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c+49−10

@@ -402,19 +402,53 @@ static void dwmac4_rd_set_tx_ic(struct dma_desc *p) · 401 unmodified lines
402	p->des2 \|= cpu_to_le32(TDES2_INTERRUPT_ON_COMPLETION);	402	p->des2 \|= cpu_to_le32(TDES2_INTERRUPT_ON_COMPLETION);
403	}	403	}
404		404
405	static void dwmac4_display_ring(void *head, unsigned int size, bool rx)	405	static void dwmac4_display_ring(void *head, unsigned int size, bool rx,
		406	dma_addr_t dma_rx_phy, unsigned int desc_size)
406	{	407	{
407	struct dma_desc p = (struct dma_desc )head;	408	dma_addr_t dma_addr;
408	int i;	409	int i;
409		410
410	pr_info("%s descriptor ring:\n", rx ? "RX" : "TX");	411	pr_info("%s descriptor ring:\n", rx ? "RX" : "TX");
411		412
412	for (i = 0; i < size; i++) {	413	if (desc_size == sizeof(struct dma_desc)) {
413	pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",	414	struct dma_desc p = (struct dma_desc )head;
414	i, (unsigned int)virt_to_phys(p),	415
415	le32_to_cpu(p->des0), le32_to_cpu(p->des1),	416	for (i = 0; i < size; i++) {
416	le32_to_cpu(p->des2), le32_to_cpu(p->des3));	417	dma_addr = dma_rx_phy + i * sizeof(*p);
417	p++;	418	pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x\n",
		419	i, &dma_addr,
		420	le32_to_cpu(p->des0), le32_to_cpu(p->des1),
		421	le32_to_cpu(p->des2), le32_to_cpu(p->des3));
		422	p++;
		423	}
		424	} else if (desc_size == sizeof(struct dma_extended_desc)) {
		425	struct dma_extended_desc extp = (struct dma_extended_desc )head;
		426
		427	for (i = 0; i < size; i++) {
		428	dma_addr = dma_rx_phy + i * sizeof(*extp);
		429	pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n",
		430	i, &dma_addr,
		431	le32_to_cpu(extp->basic.des0), le32_to_cpu(extp->basic.des1),
		432	le32_to_cpu(extp->basic.des2), le32_to_cpu(extp->basic.des3),
		433	le32_to_cpu(extp->des4), le32_to_cpu(extp->des5),
		434	le32_to_cpu(extp->des6), le32_to_cpu(extp->des7));
		435	extp++;
		436	}
		437	} else if (desc_size == sizeof(struct dma_edesc)) {
		438	struct dma_edesc ep = (struct dma_edesc )head;
		439
		440	for (i = 0; i < size; i++) {
		441	dma_addr = dma_rx_phy + i * sizeof(*ep);
		442	pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n",
		443	i, &dma_addr,
		444	le32_to_cpu(ep->des4), le32_to_cpu(ep->des5),
		445	le32_to_cpu(ep->des6), le32_to_cpu(ep->des7),
		446	le32_to_cpu(ep->basic.des0), le32_to_cpu(ep->basic.des1),
		447	le32_to_cpu(ep->basic.des2), le32_to_cpu(ep->basic.des3));
		448	ep++;
		449	}
		450	} else {
		451	pr_err("unsupported descriptor!");
418	}	452	}
419	}	453	}
420		454
@@ -499,10 +533,15 @@ static void dwmac4_get_rx_header_len(struct dma_desc p, unsigned int len) · 78 unmodified lines
499	*len = le32_to_cpu(p->des2) & RDES2_HL;	533	*len = le32_to_cpu(p->des2) & RDES2_HL;
500	}	534	}
501		535
502	static void dwmac4_set_sec_addr(struct dma_desc *p, dma_addr_t addr)	536	static void dwmac4_set_sec_addr(struct dma_desc *p, dma_addr_t addr, bool buf2_valid)
503	{	537	{
504	p->des2 = cpu_to_le32(lower_32_bits(addr));	538	p->des2 = cpu_to_le32(lower_32_bits(addr));
505	p->des3 = cpu_to_le32(upper_32_bits(addr) \| RDES3_BUFFER2_VALID_ADDR);	539	p->des3 = cpu_to_le32(upper_32_bits(addr));
		540
		541	if (buf2_valid)
		542	p->des3 \|= cpu_to_le32(RDES3_BUFFER2_VALID_ADDR);
		543	else
		544	p->des3 &= cpu_to_le32(~RDES3_BUFFER2_VALID_ADDR);
506	}	545	}
507		546
508	static void dwmac4_set_tbs(struct dma_edesc *p, u32 sec, u32 nsec)	547	static void dwmac4_set_tbs(struct dma_edesc *p, u32 sec, u32 nsec)

drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c+18−1

@@ -124,6 +124,23 @@ static void dwmac4_dma_init_channel(void __iomem *ioaddr, · 123 unmodified lines
124	ioaddr + DMA_CHAN_INTR_ENA(chan));	124	ioaddr + DMA_CHAN_INTR_ENA(chan));
125	}	125	}
126		126
		127	static void dwmac410_dma_init_channel(void __iomem *ioaddr,
		128	struct stmmac_dma_cfg *dma_cfg, u32 chan)
		129	{
		130	u32 value;
		131
		132	/* common channel control register config */
		133	value = readl(ioaddr + DMA_CHAN_CONTROL(chan));
		134	if (dma_cfg->pblx8)
		135	value = value \| DMA_BUS_MODE_PBL;
		136
		137	writel(value, ioaddr + DMA_CHAN_CONTROL(chan));
		138
		139	/* Mask interrupts by writing to CSR7 */
		140	writel(DMA_CHAN_INTR_DEFAULT_MASK_4_10,
		141	ioaddr + DMA_CHAN_INTR_ENA(chan));
		142	}
		143
127	static void dwmac4_dma_init(void __iomem *ioaddr,	144	static void dwmac4_dma_init(void __iomem *ioaddr,
128	struct stmmac_dma_cfg *dma_cfg, int atds)	145	struct stmmac_dma_cfg *dma_cfg, int atds)
129	{	146	{
@@ -523,7 +540,7 @@ const struct stmmac_dma_ops dwmac4_dma_ops = { · 393 unmodified lines
523	const struct stmmac_dma_ops dwmac410_dma_ops = {	540	const struct stmmac_dma_ops dwmac410_dma_ops = {
524	.reset = dwmac4_dma_reset,	541	.reset = dwmac4_dma_reset,
525	.init = dwmac4_dma_init,	542	.init = dwmac4_dma_init,
526	.init_chan = dwmac4_dma_init_channel,	543	.init_chan = dwmac410_dma_init_channel,
527	.init_rx_chan = dwmac4_dma_init_rx_chan,	544	.init_rx_chan = dwmac4_dma_init_rx_chan,
528	.init_tx_chan = dwmac4_dma_init_tx_chan,	545	.init_tx_chan = dwmac4_dma_init_tx_chan,
529	.axi = dwmac4_dma_axi,	546	.axi = dwmac4_dma_axi,

drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c+0−4

@@ -53,10 +53,6 @@ void dwmac4_dma_stop_tx(void __iomem *ioaddr, u32 chan) · 52 unmodified lines
53		53
54	value &= ~DMA_CONTROL_ST;	54	value &= ~DMA_CONTROL_ST;
55	writel(value, ioaddr + DMA_CHAN_TX_CONTROL(chan));	55	writel(value, ioaddr + DMA_CHAN_TX_CONTROL(chan));
56
57	value = readl(ioaddr + GMAC_CONFIG);
58	value &= ~GMAC_CONFIG_TE;
59	writel(value, ioaddr + GMAC_CONFIG);
60	}	56	}
61		57
62	void dwmac4_dma_start_rx(void __iomem *ioaddr, u32 chan)	58	void dwmac4_dma_start_rx(void __iomem *ioaddr, u32 chan)

drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c+1−1

@@ -292,7 +292,7 @@ static void dwxgmac2_get_rx_header_len(struct dma_desc p, unsigned int len) · 291 unmodified lines
292	*len = le32_to_cpu(p->des2) & XGMAC_RDES2_HL;	292	*len = le32_to_cpu(p->des2) & XGMAC_RDES2_HL;
293	}	293	}
294		294
295	static void dwxgmac2_set_sec_addr(struct dma_desc *p, dma_addr_t addr)	295	static void dwxgmac2_set_sec_addr(struct dma_desc *p, dma_addr_t addr, bool is_valid)
296	{	296	{
297	p->des2 = cpu_to_le32(lower_32_bits(addr));	297	p->des2 = cpu_to_le32(lower_32_bits(addr));
298	p->des3 = cpu_to_le32(upper_32_bits(addr));	298	p->des3 = cpu_to_le32(upper_32_bits(addr));

drivers/net/ethernet/stmicro/stmmac/enh_desc.c+6−3

 	}
 }
-static void enh_desc_display_ring(void *head, unsigned int size, bool rx)
+static void enh_desc_display_ring(void *head, unsigned int size, bool rx,
+				  dma_addr_t dma_rx_phy, unsigned int desc_size)
 {
 	struct dma_extended_desc *ep = (struct dma_extended_desc *)head;
+	dma_addr_t dma_addr;
 	int i;
 	pr_info("Extended %s descriptor ring:\n", rx ? "RX" : "TX");
 	for (i = 0; i < size; i++) {
 		u64 x;
+		dma_addr = dma_rx_phy + i * sizeof(*ep);
 		x = *(u64 *)ep;
-		pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",
+		pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x\n",
-			i, (unsigned int)virt_to_phys(ep),
+			i, &dma_addr,
 			(unsigned int)x, (unsigned int)(x >> 32),
 			ep->basic.des2, ep->basic.des3);
 		ep++;

drivers/net/ethernet/stmicro/stmmac/hwif.h+3−2

 	/* get rx timestamp status */
 	int (*get_rx_timestamp_status)(void *desc, void *next_desc, u32 ats);
 	/* Display ring */
-	void (*display_ring)(void *head, unsigned int size, bool rx);
+	void (*display_ring)(void *head, unsigned int size, bool rx,
+			     dma_addr_t dma_rx_phy, unsigned int desc_size);
 	/* set MSS via context descriptor */
 	void (*set_mss)(struct dma_desc *p, unsigned int mss);
 	/* get descriptor skbuff address */
 	int (*get_rx_hash)(struct dma_desc *p, u32 *hash,
 			   enum pkt_hash_types *type);
 	void (*get_rx_header_len)(struct dma_desc *p, unsigned int *len);
-	void (*set_sec_addr)(struct dma_desc *p, dma_addr_t addr);
+	void (*set_sec_addr)(struct dma_desc *p, dma_addr_t addr, bool buf2_valid);
 	void (*set_sarc)(struct dma_desc *p, u32 sarc_type);
 	void (*set_vlan_tag)(struct dma_desc *p, u16 tag, u16 inner_tag,
 			     u32 inner_type);

drivers/net/ethernet/stmicro/stmmac/norm_desc.c+6−3

 		return 1;
 }
-static void ndesc_display_ring(void *head, unsigned int size, bool rx)
+static void ndesc_display_ring(void *head, unsigned int size, bool rx,
+			       dma_addr_t dma_rx_phy, unsigned int desc_size)
 {
 	struct dma_desc *p = (struct dma_desc *)head;
+	dma_addr_t dma_addr;
 	int i;
 	pr_info("%s descriptor ring:\n", rx ? "RX" : "TX");
 	for (i = 0; i < size; i++) {
 		u64 x;
+		dma_addr = dma_rx_phy + i * sizeof(*p);
 		x = *(u64 *)p;
-		pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x",
+		pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x",
-			i, (unsigned int)virt_to_phys(p),
+			i, &dma_addr,
 			(unsigned int)x, (unsigned int)(x >> 32),
 			p->des2, p->des3);
 		p++;

drivers/net/ethernet/stmicro/stmmac/stmmac_main.c+135−25

@@ -1133,6 +1133,7 @@ static int stmmac_phy_setup(struct stmmac_priv *priv) · 1132 unmodified lines
1133	static void stmmac_display_rx_rings(struct stmmac_priv *priv)	1133	static void stmmac_display_rx_rings(struct stmmac_priv *priv)
1134	{	1134	{
1135	u32 rx_cnt = priv->plat->rx_queues_to_use;	1135	u32 rx_cnt = priv->plat->rx_queues_to_use;
		1136	unsigned int desc_size;
1136	void *head_rx;	1137	void *head_rx;
1137	u32 queue;	1138	u32 queue;
1138		1139
@@ -1142,19 +1143,24 @@ static void stmmac_display_rx_rings(struct stmmac_priv *priv) · 3 unmodified lines
1142		1143
1143	pr_info("\tRX Queue %u rings\n", queue);	1144	pr_info("\tRX Queue %u rings\n", queue);
1144		1145
1145	if (priv->extend_desc)	1146	if (priv->extend_desc) {
1146	head_rx = (void *)rx_q->dma_erx;	1147	head_rx = (void *)rx_q->dma_erx;
1147	else	1148	desc_size = sizeof(struct dma_extended_desc);
		1149	} else {
1148	head_rx = (void *)rx_q->dma_rx;	1150	head_rx = (void *)rx_q->dma_rx;
		1151	desc_size = sizeof(struct dma_desc);
		1152	}
1149		1153
1150	/* Display RX ring */	1154	/* Display RX ring */
1151	stmmac_display_ring(priv, head_rx, priv->dma_rx_size, true);	1155	stmmac_display_ring(priv, head_rx, priv->dma_rx_size, true,
		1156	rx_q->dma_rx_phy, desc_size);
1152	}	1157	}
1153	}	1158	}
1154		1159
1155	static void stmmac_display_tx_rings(struct stmmac_priv *priv)	1160	static void stmmac_display_tx_rings(struct stmmac_priv *priv)
1156	{	1161	{
1157	u32 tx_cnt = priv->plat->tx_queues_to_use;	1162	u32 tx_cnt = priv->plat->tx_queues_to_use;
		1163	unsigned int desc_size;
1158	void *head_tx;	1164	void *head_tx;
1159	u32 queue;	1165	u32 queue;
1160		1166
@@ -1164,14 +1170,19 @@ static void stmmac_display_tx_rings(struct stmmac_priv *priv) · 3 unmodified lines
1164		1170
1165	pr_info("\tTX Queue %d rings\n", queue);	1171	pr_info("\tTX Queue %d rings\n", queue);
1166		1172
1167	if (priv->extend_desc)	1173	if (priv->extend_desc) {
1168	head_tx = (void *)tx_q->dma_etx;	1174	head_tx = (void *)tx_q->dma_etx;
1169	else if (tx_q->tbs & STMMAC_TBS_AVAIL)	1175	desc_size = sizeof(struct dma_extended_desc);
		1176	} else if (tx_q->tbs & STMMAC_TBS_AVAIL) {
1170	head_tx = (void *)tx_q->dma_entx;	1177	head_tx = (void *)tx_q->dma_entx;
1171	else	1178	desc_size = sizeof(struct dma_edesc);
		1179	} else {
1172	head_tx = (void *)tx_q->dma_tx;	1180	head_tx = (void *)tx_q->dma_tx;
		1181	desc_size = sizeof(struct dma_desc);
		1182	}
1173		1183
1174	stmmac_display_ring(priv, head_tx, priv->dma_tx_size, false);	1184	stmmac_display_ring(priv, head_tx, priv->dma_tx_size, false,
		1185	tx_q->dma_tx_phy, desc_size);
1175	}	1186	}
1176	}	1187	}
1177		1188
@@ -1303,9 +1314,10 @@ static int stmmac_init_rx_buffers(struct stmmac_priv priv, struct dma_desc p, · 125 unmodified lines
1303	return -ENOMEM;	1314	return -ENOMEM;
1304		1315
1305	buf->sec_addr = page_pool_get_dma_addr(buf->sec_page);	1316	buf->sec_addr = page_pool_get_dma_addr(buf->sec_page);
1306	stmmac_set_desc_sec_addr(priv, p, buf->sec_addr);	1317	stmmac_set_desc_sec_addr(priv, p, buf->sec_addr, true);
1307	} else {	1318	} else {
1308	buf->sec_page = NULL;	1319	buf->sec_page = NULL;
		1320	stmmac_set_desc_sec_addr(priv, p, buf->sec_addr, false);
1309	}	1321	}
1310		1322
1311	buf->addr = page_pool_get_dma_addr(buf->page);	1323	buf->addr = page_pool_get_dma_addr(buf->page);
@@ -1367,6 +1379,88 @@ static void stmmac_free_tx_buffer(struct stmmac_priv *priv, u32 queue, int i) · 55 unmodified lines
1367	}	1379	}
1368	}	1380	}
1369		1381
		1382	/**
		1383	* stmmac_reinit_rx_buffers - reinit the RX descriptor buffer.
		1384	* @priv: driver private structure
		1385	* Description: this function is called to re-allocate a receive buffer, perform
		1386	* the DMA mapping and init the descriptor.
		1387	*/
		1388	static void stmmac_reinit_rx_buffers(struct stmmac_priv *priv)
		1389	{
		1390	u32 rx_count = priv->plat->rx_queues_to_use;
		1391	u32 queue;
		1392	int i;
		1393
		1394	for (queue = 0; queue < rx_count; queue++) {
		1395	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
		1396
		1397	for (i = 0; i < priv->dma_rx_size; i++) {
		1398	struct stmmac_rx_buffer *buf = &rx_q->buf_pool[i];
		1399
		1400	if (buf->page) {
		1401	page_pool_recycle_direct(rx_q->page_pool, buf->page);
		1402	buf->page = NULL;
		1403	}
		1404
		1405	if (priv->sph && buf->sec_page) {
		1406	page_pool_recycle_direct(rx_q->page_pool, buf->sec_page);
		1407	buf->sec_page = NULL;
		1408	}
		1409	}
		1410	}
		1411
		1412	for (queue = 0; queue < rx_count; queue++) {
		1413	struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
		1414
		1415	for (i = 0; i < priv->dma_rx_size; i++) {
		1416	struct stmmac_rx_buffer *buf = &rx_q->buf_pool[i];
		1417	struct dma_desc *p;
		1418
		1419	if (priv->extend_desc)
		1420	p = &((rx_q->dma_erx + i)->basic);
		1421	else
		1422	p = rx_q->dma_rx + i;
		1423
		1424	if (!buf->page) {
		1425	buf->page = page_pool_dev_alloc_pages(rx_q->page_pool);
		1426	if (!buf->page)
		1427	goto err_reinit_rx_buffers;
		1428
		1429	buf->addr = page_pool_get_dma_addr(buf->page);
		1430	}
		1431
		1432	if (priv->sph && !buf->sec_page) {
		1433	buf->sec_page = page_pool_dev_alloc_pages(rx_q->page_pool);
		1434	if (!buf->sec_page)
		1435	goto err_reinit_rx_buffers;
		1436
		1437	buf->sec_addr = page_pool_get_dma_addr(buf->sec_page);
		1438	}
		1439
		1440	stmmac_set_desc_addr(priv, p, buf->addr);
		1441	if (priv->sph)
		1442	stmmac_set_desc_sec_addr(priv, p, buf->sec_addr, true);
		1443	else
		1444	stmmac_set_desc_sec_addr(priv, p, buf->sec_addr, false);
		1445	if (priv->dma_buf_sz == BUF_SIZE_16KiB)
		1446	stmmac_init_desc3(priv, p);
		1447	}
		1448	}
		1449
		1450	return;
		1451
		1452	err_reinit_rx_buffers:
		1453	do {
		1454	while (--i >= 0)
		1455	stmmac_free_rx_buffer(priv, queue, i);
		1456
		1457	if (queue == 0)
		1458	break;
		1459
		1460	i = priv->dma_rx_size;
		1461	} while (queue-- > 0);
		1462	}
		1463
1370	/**	1464	/**
1371	* init_dma_rx_desc_rings - init the RX descriptor rings	1465	* init_dma_rx_desc_rings - init the RX descriptor rings
1372	* @dev: net device structure	1466	* @dev: net device structure
@@ -3648,7 +3742,10 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv, u32 queue) · 2275 unmodified lines
3648	DMA_FROM_DEVICE);	3742	DMA_FROM_DEVICE);
3649		3743
3650	stmmac_set_desc_addr(priv, p, buf->addr);	3744	stmmac_set_desc_addr(priv, p, buf->addr);
3651	stmmac_set_desc_sec_addr(priv, p, buf->sec_addr);	3745	if (priv->sph)
		3746	stmmac_set_desc_sec_addr(priv, p, buf->sec_addr, true);
		3747	else
		3748	stmmac_set_desc_sec_addr(priv, p, buf->sec_addr, false);
3652	stmmac_refill_desc3(priv, rx_q, p);	3749	stmmac_refill_desc3(priv, rx_q, p);
3653		3750
3654	rx_q->rx_count_frames++;	3751	rx_q->rx_count_frames++;
@@ -3736,18 +3833,23 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) · 81 unmodified lines
3736	unsigned int count = 0, error = 0, len = 0;	3833	unsigned int count = 0, error = 0, len = 0;
3737	int status = 0, coe = priv->hw->rx_csum;	3834	int status = 0, coe = priv->hw->rx_csum;
3738	unsigned int next_entry = rx_q->cur_rx;	3835	unsigned int next_entry = rx_q->cur_rx;
		3836	unsigned int desc_size;
3739	struct sk_buff *skb = NULL;	3837	struct sk_buff *skb = NULL;
3740		3838
3741	if (netif_msg_rx_status(priv)) {	3839	if (netif_msg_rx_status(priv)) {
3742	void *rx_head;	3840	void *rx_head;
3743		3841
3744	netdev_dbg(priv->dev, "%s: descriptor ring:\n", __func__);	3842	netdev_dbg(priv->dev, "%s: descriptor ring:\n", __func__);
3745	if (priv->extend_desc)	3843	if (priv->extend_desc) {
3746	rx_head = (void *)rx_q->dma_erx;	3844	rx_head = (void *)rx_q->dma_erx;
3747	else	3845	desc_size = sizeof(struct dma_extended_desc);
		3846	} else {
3748	rx_head = (void *)rx_q->dma_rx;	3847	rx_head = (void *)rx_q->dma_rx;
		3848	desc_size = sizeof(struct dma_desc);
		3849	}
3749		3850
3750	stmmac_display_ring(priv, rx_head, priv->dma_rx_size, true);	3851	stmmac_display_ring(priv, rx_head, priv->dma_rx_size, true,
		3852	rx_q->dma_rx_phy, desc_size);
3751	}	3853	}
3752	while (count < limit) {	3854	while (count < limit) {
3753	unsigned int buf1_len = 0, buf2_len = 0;	3855	unsigned int buf1_len = 0, buf2_len = 0;
@@ -4315,24 +4417,27 @@ static int stmmac_set_mac_address(struct net_device ndev, void addr) · 561 unmodified lines
4315	static struct dentry *stmmac_fs_dir;	4417	static struct dentry *stmmac_fs_dir;
4316		4418
4317	static void sysfs_display_ring(void *head, int size, int extend_desc,	4419	static void sysfs_display_ring(void *head, int size, int extend_desc,
4318	struct seq_file *seq)	4420	struct seq_file *seq, dma_addr_t dma_phy_addr)
4319	{	4421	{
4320	int i;	4422	int i;
4321	struct dma_extended_desc ep = (struct dma_extended_desc )head;	4423	struct dma_extended_desc ep = (struct dma_extended_desc )head;
4322	struct dma_desc p = (struct dma_desc )head;	4424	struct dma_desc p = (struct dma_desc )head;
		4425	dma_addr_t dma_addr;
4323		4426
4324	for (i = 0; i < size; i++) {	4427	for (i = 0; i < size; i++) {
4325	if (extend_desc) {	4428	if (extend_desc) {
4326	seq_printf(seq, "%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",	4429	dma_addr = dma_phy_addr + i * sizeof(*ep);
4327	i, (unsigned int)virt_to_phys(ep),	4430	seq_printf(seq, "%d [%pad]: 0x%x 0x%x 0x%x 0x%x\n",
		4431	i, &dma_addr,
4328	le32_to_cpu(ep->basic.des0),	4432	le32_to_cpu(ep->basic.des0),
4329	le32_to_cpu(ep->basic.des1),	4433	le32_to_cpu(ep->basic.des1),
4330	le32_to_cpu(ep->basic.des2),	4434	le32_to_cpu(ep->basic.des2),
4331	le32_to_cpu(ep->basic.des3));	4435	le32_to_cpu(ep->basic.des3));
4332	ep++;	4436	ep++;
4333	} else {	4437	} else {
4334	seq_printf(seq, "%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",	4438	dma_addr = dma_phy_addr + i * sizeof(*p);
4335	i, (unsigned int)virt_to_phys(p),	4439	seq_printf(seq, "%d [%pad]: 0x%x 0x%x 0x%x 0x%x\n",
		4440	i, &dma_addr,
4336	le32_to_cpu(p->des0), le32_to_cpu(p->des1),	4441	le32_to_cpu(p->des0), le32_to_cpu(p->des1),
4337	le32_to_cpu(p->des2), le32_to_cpu(p->des3));	4442	le32_to_cpu(p->des2), le32_to_cpu(p->des3));
4338	p++;	4443	p++;
@@ -4360,11 +4465,11 @@ static int stmmac_rings_status_show(struct seq_file seq, void v) · 21 unmodified lines
4360	if (priv->extend_desc) {	4465	if (priv->extend_desc) {
4361	seq_printf(seq, "Extended descriptor ring:\n");	4466	seq_printf(seq, "Extended descriptor ring:\n");
4362	sysfs_display_ring((void *)rx_q->dma_erx,	4467	sysfs_display_ring((void *)rx_q->dma_erx,
4363	priv->dma_rx_size, 1, seq);	4468	priv->dma_rx_size, 1, seq, rx_q->dma_rx_phy);
4364	} else {	4469	} else {
4365	seq_printf(seq, "Descriptor ring:\n");	4470	seq_printf(seq, "Descriptor ring:\n");
4366	sysfs_display_ring((void *)rx_q->dma_rx,	4471	sysfs_display_ring((void *)rx_q->dma_rx,
4367	priv->dma_rx_size, 0, seq);	4472	priv->dma_rx_size, 0, seq, rx_q->dma_rx_phy);
4368	}	4473	}
4369	}	4474	}
4370		4475
@@ -4376,11 +4481,11 @@ static int stmmac_rings_status_show(struct seq_file seq, void v) · 5 unmodified lines
4376	if (priv->extend_desc) {	4481	if (priv->extend_desc) {
4377	seq_printf(seq, "Extended descriptor ring:\n");	4482	seq_printf(seq, "Extended descriptor ring:\n");
4378	sysfs_display_ring((void *)tx_q->dma_etx,	4483	sysfs_display_ring((void *)tx_q->dma_etx,
4379	priv->dma_tx_size, 1, seq);	4484	priv->dma_tx_size, 1, seq, tx_q->dma_tx_phy);
4380	} else if (!(tx_q->tbs & STMMAC_TBS_AVAIL)) {	4485	} else if (!(tx_q->tbs & STMMAC_TBS_AVAIL)) {
4381	seq_printf(seq, "Descriptor ring:\n");	4486	seq_printf(seq, "Descriptor ring:\n");
4382	sysfs_display_ring((void *)tx_q->dma_tx,	4487	sysfs_display_ring((void *)tx_q->dma_tx,
4383	priv->dma_tx_size, 0, seq);	4488	priv->dma_tx_size, 0, seq, tx_q->dma_tx_phy);
4384	}	4489	}
4385	}	4490	}
4386		4491
@@ -5144,13 +5249,16 @@ int stmmac_dvr_remove(struct device *dev) · 757 unmodified lines
5144	netdev_info(priv->dev, "%s: removing driver", __func__);	5249	netdev_info(priv->dev, "%s: removing driver", __func__);
5145		5250
5146	stmmac_stop_all_dma(priv);	5251	stmmac_stop_all_dma(priv);
		5252	stmmac_mac_set(priv, priv->ioaddr, false);
		5253	netif_carrier_off(ndev);
		5254	unregister_netdev(ndev);
5147		5255
		5256	/* Serdes power down needs to happen after VLAN filter
		5257	* is deleted that is triggered by unregister_netdev().
		5258	*/
5148	if (priv->plat->serdes_powerdown)	5259	if (priv->plat->serdes_powerdown)
5149	priv->plat->serdes_powerdown(ndev, priv->plat->bsp_priv);	5260	priv->plat->serdes_powerdown(ndev, priv->plat->bsp_priv);
5150		5261
5151	stmmac_mac_set(priv, priv->ioaddr, false);
5152	netif_carrier_off(ndev);
5153	unregister_netdev(ndev);
5154	#ifdef CONFIG_DEBUG_FS	5262	#ifdef CONFIG_DEBUG_FS
5155	stmmac_exit_fs(ndev);	5263	stmmac_exit_fs(ndev);
5156	#endif	5264	#endif
@@ -5257,6 +5365,8 @@ static void stmmac_reset_queues_param(struct stmmac_priv *priv) · 100 unmodified lines
5257	tx_q->cur_tx = 0;	5365	tx_q->cur_tx = 0;
5258	tx_q->dirty_tx = 0;	5366	tx_q->dirty_tx = 0;
5259	tx_q->mss = 0;	5367	tx_q->mss = 0;
		5368
		5369	netdev_tx_reset_queue(netdev_get_tx_queue(priv->dev, queue));
5260	}	5370	}
5261	}	5371	}
5262		5372
@@ -5318,7 +5428,7 @@ int stmmac_resume(struct device *dev) · 55 unmodified lines
5318	mutex_lock(&priv->lock);	5428	mutex_lock(&priv->lock);
5319		5429
5320	stmmac_reset_queues_param(priv);	5430	stmmac_reset_queues_param(priv);
5321		5431	stmmac_reinit_rx_buffers(priv);
5322	stmmac_free_tx_skbufs(priv);	5432	stmmac_free_tx_skbufs(priv);
5323	stmmac_clear_descriptors(priv);	5433	stmmac_clear_descriptors(priv);
5324		5434

drivers/net/ethernet/sun/niu.c+0−2

 		mp->rx_mcasts += RXMAC_MC_FRM_CNT_COUNT;
 	if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP)
 		mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT;
-	if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP)
-		mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT;
 	if (val & XRXMAC_STATUS_RXHIST1_CNT_EXP)
 		mp->rx_hist_cnt1 += RXMAC_HIST_CNT1_COUNT;
 	if (val & XRXMAC_STATUS_RXHIST2_CNT_EXP)

drivers/net/ethernet/tehuti/tehuti.c+1−0

@@ -2044,6 +2044,7 @@ bdx_probe(struct pci_dev pdev, const struct pci_device_id ent) · 2043 unmodified lines
2044	/bdx_hw_reset(priv); /	2044	/bdx_hw_reset(priv); /
2045	if (bdx_read_mac(priv)) {	2045	if (bdx_read_mac(priv)) {
2046	pr_err("load MAC address failed\n");	2046	pr_err("load MAC address failed\n");
		2047	err = -EFAULT;
2047	goto err_out_iomap;	2048	goto err_out_iomap;
2048	}	2049	}
2049	SET_NETDEV_DEV(ndev, &pdev->dev);	2050	SET_NETDEV_DEV(ndev, &pdev->dev);

drivers/net/hamradio/6pack.c+0−5

 		goto out_drop;
 	}
-	if (len > sp->mtu) {	/* sp->mtu = AX25_MTU = max. PACLEN = 256 */
-		msg = "oversized transmit packet!";
-		goto out_drop;
-	}
 	if (p[0] > 5) {
 		msg = "invalid KISS command";
 		goto out_drop;

drivers/net/hyperv/hyperv_net.h+1−1

@@ -229,7 +229,7 @@ int netvsc_send(struct net_device *net, · 228 unmodified lines
229	bool xdp_tx);	229	bool xdp_tx);
230	void netvsc_linkstatus_callback(struct net_device *net,	230	void netvsc_linkstatus_callback(struct net_device *net,
231	struct rndis_message *resp,	231	struct rndis_message *resp,
232	void *data);	232	void *data, u32 data_buflen);
233	int netvsc_recv_callback(struct net_device *net,	233	int netvsc_recv_callback(struct net_device *net,
234	struct netvsc_device *nvdev,	234	struct netvsc_device *nvdev,
235	struct netvsc_channel *nvchan);	235	struct netvsc_channel *nvchan);

drivers/net/hyperv/netvsc_drv.c+9−4

  */
 void netvsc_linkstatus_callback(struct net_device *net,
 				struct rndis_message *resp,
-				void *data)
+				void *data, u32 data_buflen)
 {
 	struct rndis_indicate_status *indicate = &resp->msg.indicate_status;
 	struct net_device_context *ndev_ctx = netdev_priv(net);
 	if (indicate->status == RNDIS_STATUS_LINK_SPEED_CHANGE) {
 		u32 speed;
-		/* Validate status_buf_offset */
+		/* Validate status_buf_offset and status_buflen.
+		 *
+		 * Certain (pre-Fe) implementations of Hyper-V's vSwitch didn't account
+		 * for the status buffer field in resp->msg_len; perform the validation
+		 * using data_buflen (>= resp->msg_len).
+		 */
 		if (indicate->status_buflen < sizeof(speed) ||
 		    indicate->status_buf_offset < sizeof(*indicate) ||
-		    resp->msg_len - RNDIS_HEADER_SIZE < indicate->status_buf_offset ||
+		    data_buflen - RNDIS_HEADER_SIZE < indicate->status_buf_offset ||
-		    resp->msg_len - RNDIS_HEADER_SIZE - indicate->status_buf_offset
+		    data_buflen - RNDIS_HEADER_SIZE - indicate->status_buf_offset
 				< indicate->status_buflen) {
 			netdev_err(net, "invalid rndis_indicate_status packet\n");
 			return;

drivers/net/hyperv/rndis_filter.c+1−1

@@ -620,7 +620,7 @@ int rndis_filter_receive(struct net_device *ndev, · 619 unmodified lines
620		620
621	case RNDIS_MSG_INDICATE:	621	case RNDIS_MSG_INDICATE:
622	/* notification msgs */	622	/* notification msgs */
623	netvsc_linkstatus_callback(ndev, rndis_msg, data);	623	netvsc_linkstatus_callback(ndev, rndis_msg, data, buflen);
624	break;	624	break;
625	default:	625	default:
626	netdev_err(ndev,	626	netdev_err(ndev,

drivers/net/netdevsim/netdev.c+1−0

@@ -294,6 +294,7 @@ nsim_create(struct nsim_dev nsim_dev, struct nsim_dev_port nsim_dev_port) · 293 unmodified lines
294	dev_net_set(dev, nsim_dev_net(nsim_dev));	294	dev_net_set(dev, nsim_dev_net(nsim_dev));
295	ns = netdev_priv(dev);	295	ns = netdev_priv(dev);
296	ns->netdev = dev;	296	ns->netdev = dev;
		297	u64_stats_init(&ns->syncp);
297	ns->nsim_dev = nsim_dev;	298	ns->nsim_dev = nsim_dev;
298	ns->nsim_dev_port = nsim_dev_port;	299	ns->nsim_dev_port = nsim_dev_port;
299	ns->nsim_bus_dev = nsim_dev->nsim_bus_dev;	300	ns->nsim_bus_dev = nsim_dev->nsim_bus_dev;

drivers/net/phy/dp83822.c+5−4

 static irqreturn_t dp83822_handle_interrupt(struct phy_device *phydev)
 {
+	bool trigger_machine = false;
 	int irq_status;
 	/* The MISR1 and MISR2 registers are holding the interrupt status in
 		return IRQ_NONE;
 	}
 	if (irq_status & ((irq_status & GENMASK(7, 0)) << 8))
-		goto trigger_machine;
+		trigger_machine = true;
 	irq_status = phy_read(phydev, MII_DP83822_MISR2);
 	if (irq_status < 0) {
 		return IRQ_NONE;
 	}
 	if (irq_status & ((irq_status & GENMASK(7, 0)) << 8))
-		goto trigger_machine;
+		trigger_machine = true;
-	return IRQ_NONE;
+	if (!trigger_machine)
+		return IRQ_NONE;
-trigger_machine:
 	phy_trigger_machine(phydev);
 	return IRQ_HANDLED;

drivers/net/phy/dp83tc811.c+6−5

 static irqreturn_t dp83811_handle_interrupt(struct phy_device *phydev)
 {
+	bool trigger_machine = false;
 	int irq_status;
 	/* The INT_STAT registers 1, 2 and 3 are holding the interrupt status
 		return IRQ_NONE;
 	}
 	if (irq_status & ((irq_status & GENMASK(7, 0)) << 8))
-		goto trigger_machine;
+		trigger_machine = true;
 	irq_status = phy_read(phydev, MII_DP83811_INT_STAT2);
 	if (irq_status < 0) {
 		return IRQ_NONE;
 	}
 	if (irq_status & ((irq_status & GENMASK(7, 0)) << 8))
-		goto trigger_machine;
+		trigger_machine = true;
 	irq_status = phy_read(phydev, MII_DP83811_INT_STAT3);
 	if (irq_status < 0) {
 		return IRQ_NONE;
 	}
 	if (irq_status & ((irq_status & GENMASK(7, 0)) << 8))
-		goto trigger_machine;
+		trigger_machine = true;
-	return IRQ_NONE;
+	if (!trigger_machine)
+		return IRQ_NONE;
-trigger_machine:
 	phy_trigger_machine(phydev);
 	return IRQ_HANDLED;

drivers/net/phy/phy.c+4−2

 	phydev->autoneg = autoneg;
-	phydev->speed = speed;
+	if (autoneg == AUTONEG_DISABLE) {
+		phydev->speed = speed;
+		phydev->duplex = duplex;
+	}
 	linkmode_copy(phydev->advertising, advertising);
 	linkmode_mod_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
 			 phydev->advertising, autoneg == AUTONEG_ENABLE);
-	phydev->duplex = duplex;
 	phydev->master_slave_set = cmd->base.master_slave_cfg;
 	phydev->mdix_ctrl = cmd->base.eth_tp_mdix_ctrl;

drivers/net/phy/phy_device.c+2−4

 static LIST_HEAD(phy_fixup_list);
 static DEFINE_MUTEX(phy_fixup_lock);
-#ifdef CONFIG_PM
 static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
 {
 	struct device_driver *drv = phydev->mdio.dev.driver;
 	return !phydev->suspended;
 }
-static int mdio_bus_phy_suspend(struct device *dev)
+static __maybe_unused int mdio_bus_phy_suspend(struct device *dev)
 {
 	struct phy_device *phydev = to_phy_device(dev);
 	return phy_suspend(phydev);
 }
-static int mdio_bus_phy_resume(struct device *dev)
+static __maybe_unused int mdio_bus_phy_resume(struct device *dev)
 {
 	struct phy_device *phydev = to_phy_device(dev);
 	int ret;
 static SIMPLE_DEV_PM_OPS(mdio_bus_phy_pm_ops, mdio_bus_phy_suspend,
 			 mdio_bus_phy_resume);
-#endif /* CONFIG_PM */
 /**
  * phy_register_fixup - creates a new phy_fixup and adds it to the list

drivers/net/usb/cdc_ncm.c+5−5

@@ -851,17 +851,17 @@ int cdc_ncm_bind_common(struct usbnet dev, struct usb_interface intf, u8 data_ · 850 unmodified lines
851		851
852	/* check if we got everything */	852	/* check if we got everything */
853	if (!ctx->data) {	853	if (!ctx->data) {
854	dev_dbg(&intf->dev, "CDC Union missing and no IAD found\n");	854	dev_err(&intf->dev, "CDC Union missing and no IAD found\n");
855	goto error;	855	goto error;
856	}	856	}
857	if (cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting)) {	857	if (cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting)) {
858	if (!ctx->mbim_desc) {	858	if (!ctx->mbim_desc) {
859	dev_dbg(&intf->dev, "MBIM functional descriptor missing\n");	859	dev_err(&intf->dev, "MBIM functional descriptor missing\n");
860	goto error;	860	goto error;
861	}	861	}
862	} else {	862	} else {
863	if (!ctx->ether_desc \|\| !ctx->func_desc) {	863	if (!ctx->ether_desc \|\| !ctx->func_desc) {
864	dev_dbg(&intf->dev, "NCM or ECM functional descriptors missing\n");	864	dev_err(&intf->dev, "NCM or ECM functional descriptors missing\n");
865	goto error;	865	goto error;
866	}	866	}
867	}	867	}
@@ -870,7 +870,7 @@ int cdc_ncm_bind_common(struct usbnet dev, struct usb_interface intf, u8 data_ · 2 unmodified lines
870	if (ctx->data != ctx->control) {	870	if (ctx->data != ctx->control) {
871	temp = usb_driver_claim_interface(driver, ctx->data, dev);	871	temp = usb_driver_claim_interface(driver, ctx->data, dev);
872	if (temp) {	872	if (temp) {
873	dev_dbg(&intf->dev, "failed to claim data intf\n");	873	dev_err(&intf->dev, "failed to claim data intf\n");
874	goto error;	874	goto error;
875	}	875	}
876	}	876	}
@@ -926,7 +926,7 @@ int cdc_ncm_bind_common(struct usbnet dev, struct usb_interface intf, u8 data_ · 49 unmodified lines
926	if (ctx->ether_desc) {	926	if (ctx->ether_desc) {
927	temp = usbnet_get_ethernet_addr(dev, ctx->ether_desc->iMACAddress);	927	temp = usbnet_get_ethernet_addr(dev, ctx->ether_desc->iMACAddress);
928	if (temp) {	928	if (temp) {
929	dev_dbg(&intf->dev, "failed to get mac address\n");	929	dev_err(&intf->dev, "failed to get mac address\n");
930	goto error2;	930	goto error2;
931	}	931	}
932	dev_info(&intf->dev, "MAC-Address: %pM\n", dev->net->dev_addr);	932	dev_info(&intf->dev, "MAC-Address: %pM\n", dev->net->dev_addr);

drivers/net/usb/qmi_wwan.c+0−14

@@ -429,13 +429,6 @@ static ssize_t add_mux_store(struct device d, struct device_attribute attr, c · 428 unmodified lines
429	goto err;	429	goto err;
430	}	430	}
431		431
432	/* we don't want to modify a running netdev */
433	if (netif_running(dev->net)) {
434	netdev_err(dev->net, "Cannot change a running device\n");
435	ret = -EBUSY;
436	goto err;
437	}
438
439	ret = qmimux_register_device(dev->net, mux_id);	432	ret = qmimux_register_device(dev->net, mux_id);
440	if (!ret) {	433	if (!ret) {
441	info->flags \|= QMI_WWAN_FLAG_MUX;	434	info->flags \|= QMI_WWAN_FLAG_MUX;
@@ -465,13 +458,6 @@ static ssize_t del_mux_store(struct device d, struct device_attribute attr, c · 23 unmodified lines
465	if (!rtnl_trylock())	458	if (!rtnl_trylock())
466	return restart_syscall();	459	return restart_syscall();
467		460
468	/* we don't want to modify a running netdev */
469	if (netif_running(dev->net)) {
470	netdev_err(dev->net, "Cannot change a running device\n");
471	ret = -EBUSY;
472	goto err;
473	}
474
475	del_dev = qmimux_find_dev(dev, mux_id);	461	del_dev = qmimux_find_dev(dev, mux_id);
476	if (!del_dev) {	462	if (!del_dev) {
477	netdev_err(dev->net, "mux_id not present\n");	463	netdev_err(dev->net, "mux_id not present\n");

drivers/net/usb/r8152.c+6−29

 		device_set_wakeup_enable(&tp->udev->dev, false);
 }
-static void r8153_mac_clk_spd(struct r8152 *tp, bool enable)
-{
-	/* MAC clock speed down */
-	if (enable) {
-		ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL,
-			       ALDPS_SPDWN_RATIO);
-		ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2,
-			       EEE_SPDWN_RATIO);
-		ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3,
-			       PKT_AVAIL_SPDWN_EN | SUSPEND_SPDWN_EN |
-			       U1U2_SPDWN_EN | L1_SPDWN_EN);
-		ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4,
-			       PWRSAVE_SPDWN_EN | RXDV_SPDWN_EN | TX10MIDLE_EN |
-			       TP100_SPDWN_EN | TP500_SPDWN_EN | EEE_SPDWN_EN |
-			       TP1000_SPDWN_EN);
-	} else {
-		ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, 0);
-		ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, 0);
-		ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, 0);
-		ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, 0);
-	}
-}
 static void r8153_u1u2en(struct r8152 *tp, bool enable)
 {
 	u8 u1u2[8];
 	if (enable) {
 		r8153_u1u2en(tp, false);
 		r8153_u2p3en(tp, false);
-		r8153_mac_clk_spd(tp, true);
 		rtl_runtime_suspend_enable(tp, true);
 	} else {
 		rtl_runtime_suspend_enable(tp, false);
-		r8153_mac_clk_spd(tp, false);
 		switch (tp->version) {
 		case RTL_VER_03:
 {
 	u32 ocp_data;
-	r8153_mac_clk_spd(tp, false);
 	rxdy_gated_en(tp, true);
 	r8153_teredo_off(tp);
 {
 	u32 ocp_data;
-	r8153_mac_clk_spd(tp, true);
 	ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
 	ocp_data &= ~NOW_IS_OOB;
 	ocp_write_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL, ocp_data);
 	ocp_write_word(tp, MCU_TYPE_USB, USB_CONNECT_TIMER, 0x0001);
+	/* MAC clock speed down */
+	ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, 0);
+	ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, 0);
+	ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, 0);
+	ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, 0);
 	r8153_power_cut_en(tp, false);
 	rtl_runtime_suspend_enable(tp, false);
 	r8153_u1u2en(tp, true);
-	r8153_mac_clk_spd(tp, false);
 	usb_enable_lpm(tp->udev);
 	ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_CONFIG6);

drivers/net/usb/usbnet.c+1−1

@@ -887,7 +887,7 @@ int usbnet_open (struct net_device *net) · 886 unmodified lines
887		887
888	// insist peer be connected	888	// insist peer be connected
889	if (info->check_connect && (retval = info->check_connect (dev)) < 0) {	889	if (info->check_connect && (retval = info->check_connect (dev)) < 0) {
890	netif_dbg(dev, ifup, dev->net, "can't open; %d\n", retval);	890	netif_err(dev, ifup, dev->net, "can't open; %d\n", retval);
891	goto done;	891	goto done;
892	}	892	}
893		893

drivers/net/wan/fsl_ucc_hdlc.c+6−2

 	priv->rx_skbuff = kcalloc(priv->rx_ring_size,
 				  sizeof(*priv->rx_skbuff),
 				  GFP_KERNEL);
-	if (!priv->rx_skbuff)
+	if (!priv->rx_skbuff) {
+		ret = -ENOMEM;
 		goto free_ucc_pram;
+	}
 	priv->tx_skbuff = kcalloc(priv->tx_ring_size,
 				  sizeof(*priv->tx_skbuff),
 				  GFP_KERNEL);
-	if (!priv->tx_skbuff)
+	if (!priv->tx_skbuff) {
+		ret = -ENOMEM;
 		goto free_rx_skbuff;
+	}
 	priv->skb_curtx = 0;
 	priv->skb_dirtytx = 0;

drivers/net/wan/lapbether.c+0−3

 		return -ENODEV;
 	}
-	netif_start_queue(dev);
 	return 0;
 }
 {
 	int err;
-	netif_stop_queue(dev);
 	if ((err = lapb_unregister(dev)) != LAPB_OK)
 		pr_err("lapb_unregister error: %d\n", err);

drivers/net/wireless/ath/ath11k/mac.c+2−2

@@ -5450,8 +5450,8 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw, · 5449 unmodified lines
5450	}	5450	}
5451		5451
5452	if (ab->hw_params.vdev_start_delay &&	5452	if (ab->hw_params.vdev_start_delay &&
5453	(arvif->vdev_type == WMI_VDEV_TYPE_AP \|\|	5453	arvif->vdev_type != WMI_VDEV_TYPE_AP &&
5454	arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)) {	5454	arvif->vdev_type != WMI_VDEV_TYPE_MONITOR) {
5455	param.vdev_id = arvif->vdev_id;	5455	param.vdev_id = arvif->vdev_id;
5456	param.peer_type = WMI_PEER_TYPE_DEFAULT;	5456	param.peer_type = WMI_PEER_TYPE_DEFAULT;
5457	param.peer_addr = ar->mac_addr;	5457	param.peer_addr = ar->mac_addr;

drivers/net/wireless/ath/ath11k/qmi.c+2−2

@@ -1687,8 +1687,8 @@ static int ath11k_qmi_respond_fw_mem_request(struct ath11k_base *ab) · 1686 unmodified lines
1687	req->mem_seg[i].size = ab->qmi.target_mem[i].size;	1687	req->mem_seg[i].size = ab->qmi.target_mem[i].size;
1688	req->mem_seg[i].type = ab->qmi.target_mem[i].type;	1688	req->mem_seg[i].type = ab->qmi.target_mem[i].type;
1689	ath11k_dbg(ab, ATH11K_DBG_QMI,	1689	ath11k_dbg(ab, ATH11K_DBG_QMI,
1690	"qmi req mem_seg[%d] 0x%llx %u %u\n", i,	1690	"qmi req mem_seg[%d] %pad %u %u\n", i,
1691	ab->qmi.target_mem[i].paddr,	1691	&ab->qmi.target_mem[i].paddr,
1692	ab->qmi.target_mem[i].size,	1692	ab->qmi.target_mem[i].size,
1693	ab->qmi.target_mem[i].type);	1693	ab->qmi.target_mem[i].type);
1694	}	1694	}

drivers/net/wireless/ath/ath9k/ath9k.h+2−1

 	s8 txq;
 	u8 keyix;
 	u8 rtscts_rate;
-	u8 retries : 7;
+	u8 retries : 6;
+	u8 dyn_smps : 1;
 	u8 baw_tracked : 1;
 	u8 tx_power;
 	enum ath9k_key_type keytype:2;

drivers/net/wireless/ath/ath9k/xmit.c+6−0

 				 is_40, is_sgi, is_sp);
 			if (rix < 8 && (tx_info->flags & IEEE80211_TX_CTL_STBC))
 				info->rates[i].RateFlags |= ATH9K_RATESERIES_STBC;
+			if (rix >= 8 && fi->dyn_smps) {
+				info->rates[i].RateFlags |=
+					ATH9K_RATESERIES_RTS_CTS;
+				info->flags |= ATH9K_TXDESC_CTSENA;
+			}
 			info->txpower[i] = ath_get_rate_txpower(sc, bf, rix,
 								is_40, false);
 		fi->keyix = an->ps_key;
 	else
 		fi->keyix = ATH9K_TXKEYIX_INVALID;
+	fi->dyn_smps = sta && sta->smps_mode == IEEE80211_SMPS_DYNAMIC;
 	fi->keytype = keytype;
 	fi->framelen = framelen;
 	fi->tx_power = txpower;

drivers/net/wireless/intel/iwlwifi/fw/pnvm.c+2−2

@@ -271,12 +271,12 @@ static int iwl_pnvm_get_from_efi(struct iwl_trans *trans, · 270 unmodified lines
271	err = efivar_entry_get(pnvm_efivar, NULL, &package_size, package);	271	err = efivar_entry_get(pnvm_efivar, NULL, &package_size, package);
272	if (err) {	272	if (err) {
273	IWL_DEBUG_FW(trans,	273	IWL_DEBUG_FW(trans,
274	"PNVM UEFI variable not found %d (len %zd)\n",	274	"PNVM UEFI variable not found %d (len %lu)\n",
275	err, package_size);	275	err, package_size);
276	goto out;	276	goto out;
277	}	277	}
278		278
279	IWL_DEBUG_FW(trans, "Read PNVM fro UEFI with size %zd\n", package_size);	279	IWL_DEBUG_FW(trans, "Read PNVM fro UEFI with size %lu\n", package_size);
280		280
281	data = kmemdup(package->data, len, GFP_KERNEL);	281	data = kmemdup(package->data, len, GFP_KERNEL);
282	if (!*data)	282	if (!*data)

drivers/net/wireless/intel/iwlwifi/iwl-op-mode.h+2−0

@@ -205,6 +205,8 @@ static inline void iwl_op_mode_time_point(struct iwl_op_mode *op_mode, · 204 unmodified lines
205	enum iwl_fw_ini_time_point tp_id,	205	enum iwl_fw_ini_time_point tp_id,
206	union iwl_dbg_tlv_tp_data *tp_data)	206	union iwl_dbg_tlv_tp_data *tp_data)
207	{	207	{
		208	if (!op_mode \|\| !op_mode->ops \|\| !op_mode->ops->time_point)
		209	return;
208	op_mode->ops->time_point(op_mode, tp_id, tp_data);	210	op_mode->ops->time_point(op_mode, tp_id, tp_data);
209	}	211	}
210		212

drivers/net/wireless/intel/iwlwifi/mvm/fw.c+1−0

@@ -1083,6 +1083,7 @@ static const struct dmi_system_id dmi_ppag_approved_list[] = { · 1082 unmodified lines
1083	DMI_MATCH(DMI_SYS_VENDOR, "ASUSTek COMPUTER INC."),	1083	DMI_MATCH(DMI_SYS_VENDOR, "ASUSTek COMPUTER INC."),
1084	},	1084	},
1085	},	1085	},
		1086	{}
1086	};	1087	};
1087		1088
1088	static int iwl_mvm_ppag_init(struct iwl_mvm *mvm)	1089	static int iwl_mvm_ppag_init(struct iwl_mvm *mvm)

drivers/net/wireless/intel/iwlwifi/pcie/drv.c+2−1

 		}
 	}
+#if IS_ENABLED(CONFIG_IWLMVM)
 	/*
 	 * Workaround for problematic SnJ device: sometimes when
 	 * certain RF modules are connected to SnJ, the device ID
 	if (CSR_HW_REV_TYPE(iwl_trans->hw_rev) == IWL_CFG_MAC_TYPE_SNJ)
 		iwl_trans->trans_cfg = &iwl_so_trans_cfg;
-#if IS_ENABLED(CONFIG_IWLMVM)
 	/*
 	 * special-case 7265D, it has the same PCI IDs.
 	 *

drivers/net/wireless/intel/iwlwifi/pcie/rx.c+2−1

 		iwl_pcie_rx_init_rxb_lists(rxq);
+		spin_unlock_bh(&rxq->lock);
 		if (!rxq->napi.poll) {
 			int (*poll)(struct napi_struct *, int) = iwl_pcie_napi_poll;
 			napi_enable(&rxq->napi);
 		}
-		spin_unlock_bh(&rxq->lock);
 	}
 	/* move the pool to the default queue and allocator ownerships */

drivers/net/wireless/mediatek/mt76/dma.c+13−13

 	};
 	struct ieee80211_hw *hw;
 	int len, n = 0, ret = -ENOMEM;
-	struct mt76_queue_entry e;
 	struct mt76_txwi_cache *t;
 	struct sk_buff *iter;
 	dma_addr_t addr;
 	}
 	tx_info.nbuf = n;
+	if (q->queued + (tx_info.nbuf + 1) / 2 >= q->ndesc - 1) {
+		ret = -ENOMEM;
+		goto unmap;
+	}
 	dma_sync_single_for_cpu(dev->dev, t->dma_addr, dev->drv->txwi_size,
 				DMA_TO_DEVICE);
 	ret = dev->drv->tx_prepare_skb(dev, txwi, q->qid, wcid, sta, &tx_info);
 	if (ret < 0)
 		goto unmap;
-	if (q->queued + (tx_info.nbuf + 1) / 2 >= q->ndesc - 1) {
-		ret = -ENOMEM;
-		goto unmap;
-	}
 	return mt76_dma_add_buf(dev, q, tx_info.buf, tx_info.nbuf,
 				tx_info.info, tx_info.skb, t);
 	}
 #endif
-	e.skb = tx_info.skb;
+	dev_kfree_skb(tx_info.skb);
-	e.txwi = t;
-	dev->drv->tx_complete_skb(dev, &e);
 	mt76_put_txwi(dev, t);
 	return ret;
 }
 {
 	struct sk_buff *skb = q->rx_head;
 	struct skb_shared_info *shinfo = skb_shinfo(skb);
+	int nr_frags = shinfo->nr_frags;
-	if (shinfo->nr_frags < ARRAY_SIZE(shinfo->frags)) {
+	if (nr_frags < ARRAY_SIZE(shinfo->frags)) {
 		struct page *page = virt_to_head_page(data);
 		int offset = data - page_address(page) + q->buf_offset;
-		skb_add_rx_frag(skb, shinfo->nr_frags, page, offset, len,
+		skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size);
-				q->buf_size);
 	} else {
 		skb_free_frag(data);
 	}
 		return;
 	q->rx_head = NULL;
-	dev->drv->rx_skb(dev, q - dev->q_rx, skb);
+	if (nr_frags < ARRAY_SIZE(shinfo->frags))
+		dev->drv->rx_skb(dev, q - dev->q_rx, skb);
+	else
+		dev_kfree_skb(skb);
 }
 static int

drivers/net/wireless/mediatek/mt76/mt7915/mac.c+5−5

 	}
 	txp->nbuf = nbuf;
-	/* pass partial skb header to fw */
-	tx_info->buf[1].len = MT_CT_PARSE_LEN;
-	tx_info->buf[1].skip_unmap = true;
-	tx_info->nbuf = MT_CT_DMA_BUF_NUM;
 	txp->flags = cpu_to_le16(MT_CT_INFO_APPLY_TXD | MT_CT_INFO_FROM_HOST);
 	if (!key)
 		txp->rept_wds_wcid = cpu_to_le16(0x3ff);
 	tx_info->skb = DMA_DUMMY_DATA;
+	/* pass partial skb header to fw */
+	tx_info->buf[1].len = MT_CT_PARSE_LEN;
+	tx_info->buf[1].skip_unmap = true;
+	tx_info->nbuf = MT_CT_DMA_BUF_NUM;
 	return 0;
 }

drivers/net/wireless/mediatek/mt76/mt7915/testmode.c+2−2

@@ -543,7 +543,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en) · 542 unmodified lines
543	tx_cont->bw = CMD_CBW_20MHZ;	543	tx_cont->bw = CMD_CBW_20MHZ;
544	break;	544	break;
545	default:	545	default:
546	break;	546	return -EINVAL;
547	}	547	}
548		548
549	if (!en) {	549	if (!en) {
@@ -591,7 +591,7 @@ mt7915_tm_set_tx_cont(struct mt7915_phy *phy, bool en) · 41 unmodified lines
591	mode = MT_PHY_TYPE_HE_MU;	591	mode = MT_PHY_TYPE_HE_MU;
592	break;	592	break;
593	default:	593	default:
594	break;	594	return -EINVAL;
595	}	595	}
596		596
597	rateval = mode << 6 \| rate_idx;	597	rateval = mode << 6 \| rate_idx;

drivers/net/wireless/mediatek/mt76/mt7921/mcu.c+1−3

 	if (wlan_idx >= MT76_N_WCIDS)
 		return;
 	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
-	if (!wcid) {
+	if (!wcid)
-		stats->tx_rate = rate;
 		return;
-	}
 	msta = container_of(wcid, struct mt7921_sta, wcid);
 	stats = &msta->stats;

drivers/net/xen-netback/netback.c+2−2

@@ -557,8 +557,8 @@ check_frags: · 556 unmodified lines
557	}	557	}
558		558
559	if (skb_has_frag_list(skb) && !first_shinfo) {	559	if (skb_has_frag_list(skb) && !first_shinfo) {
560	first_shinfo = skb_shinfo(skb);	560	first_shinfo = shinfo;
561	shinfo = skb_shinfo(skb_shinfo(skb)->frag_list);	561	shinfo = skb_shinfo(shinfo->frag_list);
562	nr_frags = shinfo->nr_frags;	562	nr_frags = shinfo->nr_frags;
563		563
564	goto check_frags;	564	goto check_frags;

drivers/nvme/host/core.c+11−4

 		return true;
 	nvme_req(req)->status = NVME_SC_HOST_ABORTED_CMD;
+	nvme_req(req)->flags |= NVME_REQ_CANCELLED;
 	blk_mq_complete_request(req);
 	return true;
 }
 		goto out_free_id;
 	}
-	error = -ENODEV;
+	error = NVME_SC_INVALID_NS | NVME_SC_DNR;
 	if ((*id)->ncap == 0) /* namespace not allocated or attached */
 		goto out_free_id;
 static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids)
 {
 	struct nvme_id_ns *id;
-	int ret = -ENODEV;
+	int ret = NVME_SC_INVALID_NS | NVME_SC_DNR;
 	if (test_bit(NVME_NS_DEAD, &ns->flags))
 		goto out;
 	if (ret)
 		goto out;
-	ret = -ENODEV;
+	ret = NVME_SC_INVALID_NS | NVME_SC_DNR;
 	if (!nvme_ns_ids_equal(&ns->head->ids, ids)) {
 		dev_err(ns->ctrl->device,
 			"identifiers changed for nsid %d\n", ns->head->ns_id);
 	 *
 	 * TODO: we should probably schedule a delayed retry here.
 	 */
-	if (ret && ret != -ENOMEM && !(ret > 0 && !(ret & NVME_SC_DNR)))
+	if (ret > 0 && (ret & NVME_SC_DNR))
 		nvme_ns_remove(ns);
 }
 				nsid);
 			break;
 		}
+		if (!nvme_multi_css(ctrl)) {
+			dev_warn(ctrl->device,
+				"command set not reported for nsid: %d\n",
+				nsid);
+			break;
+		}
 		nvme_alloc_ns(ctrl, nsid, &ids);
 		break;
 	default:

drivers/nvme/host/fc.c+3−2

 				sizeof(op->rsp_iu), DMA_FROM_DEVICE);
 	if (opstate == FCPOP_STATE_ABORTED)
-		status = cpu_to_le16(NVME_SC_HOST_PATH_ERROR << 1);
+		status = cpu_to_le16(NVME_SC_HOST_ABORTED_CMD << 1);
 	else if (freq->status) {
 		status = cpu_to_le16(NVME_SC_HOST_PATH_ERROR << 1);
 		dev_info(ctrl->ctrl.device,
 		nvme_fc_complete_rq(rq);
 check_error:
-	if (terminate_assoc)
+	if (terminate_assoc && ctrl->ctrl.state != NVME_CTRL_RESETTING)
 		queue_work(nvme_reset_wq, &ctrl->ioerr_work);
 }
 	struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
 	struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(req);
+	op->nreq.flags |= NVME_REQ_CANCELLED;
 	__nvme_fc_abort_op(ctrl, op);
 	return true;
 }

drivers/nvme/host/pci.c+1−0

@@ -3246,6 +3246,7 @@ static const struct pci_device_id nvme_id_table[] = { · 3245 unmodified lines
3246	.driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },	3246	.driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
3247	{ PCI_DEVICE(0x144d, 0xa822), /* Samsung PM1725a */	3247	{ PCI_DEVICE(0x144d, 0xa822), /* Samsung PM1725a */
3248	.driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY \|	3248	.driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY \|
		3249	NVME_QUIRK_DISABLE_WRITE_ZEROES\|
3249	NVME_QUIRK_IGNORE_DEV_SUBNQN, },	3250	NVME_QUIRK_IGNORE_DEV_SUBNQN, },
3250	{ PCI_DEVICE(0x1987, 0x5016), /* Phison E16 */	3251	{ PCI_DEVICE(0x1987, 0x5016), /* Phison E16 */
3251	.driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, },	3252	.driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, },

drivers/nvme/host/zns.c+7−2

 int nvme_revalidate_zones(struct nvme_ns *ns)
 {
-	return blk_revalidate_disk_zones(ns->disk, NULL);
+	struct request_queue *q = ns->queue;
+	int ret;
+	ret = blk_revalidate_disk_zones(ns->disk, NULL);
+	if (!ret)
+		blk_queue_max_zone_append_sectors(q, ns->ctrl->max_zone_append);
+	return ret;
 }
 static int nvme_set_max_append(struct nvme_ctrl *ctrl)
 	blk_queue_flag_set(QUEUE_FLAG_ZONE_RESETALL, q);
 	blk_queue_max_open_zones(q, le32_to_cpu(id->mor) + 1);
 	blk_queue_max_active_zones(q, le32_to_cpu(id->mar) + 1);
-	blk_queue_max_zone_append_sectors(q, ns->ctrl->max_zone_append);
 free_data:
 	kfree(id);
 	return status;

drivers/nvme/target/passthru.c+3−3

@@ -50,9 +50,9 @@ static u16 nvmet_passthru_override_id_ctrl(struct nvmet_req *req) · 49 unmodified lines
50		50
51	/*	51	/*
52	* nvmet_passthru_map_sg is limitted to using a single bio so limit	52	* nvmet_passthru_map_sg is limitted to using a single bio so limit
53	* the mdts based on BIO_MAX_PAGES as well	53	* the mdts based on BIO_MAX_VECS as well
54	*/	54	*/
55	max_hw_sectors = min_not_zero(BIO_MAX_PAGES << (PAGE_SHIFT - 9),	55	max_hw_sectors = min_not_zero(BIO_MAX_VECS << (PAGE_SHIFT - 9),
56	max_hw_sectors);	56	max_hw_sectors);
57		57
58	page_shift = NVME_CAP_MPSMIN(ctrl->cap) + 12;	58	page_shift = NVME_CAP_MPSMIN(ctrl->cap) + 12;
@@ -191,7 +191,7 @@ static int nvmet_passthru_map_sg(struct nvmet_req req, struct request rq) · 132 unmodified lines
191	struct bio *bio;	191	struct bio *bio;
192	int i;	192	int i;
193		193
194	if (req->sg_cnt > BIO_MAX_PAGES)	194	if (req->sg_cnt > BIO_MAX_VECS)
195	return -EINVAL;	195	return -EINVAL;
196		196
197	if (req->transfer_len <= NVMET_MAX_INLINE_DATA_LEN) {	197	if (req->transfer_len <= NVMET_MAX_INLINE_DATA_LEN) {

drivers/nvme/target/rdma.c+2−3

 		nvmet_req_uninit(&rsp->req);
 		nvmet_rdma_release_rsp(rsp);
 		if (wc->status != IB_WC_WR_FLUSH_ERR) {
-			pr_info("RDMA WRITE for CQE 0x%p failed with status %s (%d).\n",
+			pr_info("RDMA WRITE for CQE failed with status %s (%d).\n",
-				wc->wr_cqe, ib_wc_status_msg(wc->status),
+				ib_wc_status_msg(wc->status), wc->status);
-				wc->status);
 			nvmet_rdma_error_comp(queue);
 		}
 		return;

drivers/opp/core.c+25−23

 	mutex_lock(&opp_table->lock);
 	list_for_each_entry(temp, &opp_table->opp_list, node) {
-		if (dynamic == temp->dynamic) {
+		/*
+		 * Refcount must be dropped only once for each OPP by OPP core,
+		 * do that with help of "removed" flag.
+		 */
+		if (!temp->removed && dynamic == temp->dynamic) {
 			opp = temp;
 			break;
 		}
 	return opp;
 }
-bool _opp_remove_all_static(struct opp_table *opp_table)
+/*
+ * Can't call dev_pm_opp_put() from under the lock as debugfs removal needs to
+ * happen lock less to avoid circular dependency issues. This routine must be
+ * called without the opp_table->lock held.
+ */
+static void _opp_remove_all(struct opp_table *opp_table, bool dynamic)
 {
 	struct dev_pm_opp *opp;
+	while ((opp = _opp_get_next(opp_table, dynamic))) {
+		opp->removed = true;
+		dev_pm_opp_put(opp);
+		/* Drop the references taken by dev_pm_opp_add() */
+		if (dynamic)
+			dev_pm_opp_put_opp_table(opp_table);
+	}
+}
+bool _opp_remove_all_static(struct opp_table *opp_table)
+{
 	mutex_lock(&opp_table->lock);
 	if (!opp_table->parsed_static_opps) {
 	mutex_unlock(&opp_table->lock);
-	/*
+	_opp_remove_all(opp_table, false);
-	 * Can't remove the OPP from under the lock, debugfs removal needs to
-	 * happen lock less to avoid circular dependency issues.
-	 */
-	while ((opp = _opp_get_next(opp_table, false)))
-		dev_pm_opp_put(opp);
 	return true;
 }
 void dev_pm_opp_remove_all_dynamic(struct device *dev)
 {
 	struct opp_table *opp_table;
-	struct dev_pm_opp *opp;
-	int count = 0;
 	opp_table = _find_opp_table(dev);
 	if (IS_ERR(opp_table))
 		return;
-	/*
+	_opp_remove_all(opp_table, true);
-	 * Can't remove the OPP from under the lock, debugfs removal needs to
-	 * happen lock less to avoid circular dependency issues.
-	 */
-	while ((opp = _opp_get_next(opp_table, true))) {
-		dev_pm_opp_put(opp);
-		count++;
-	}
-	/* Drop the references taken by dev_pm_opp_add() */
-	while (count--)
-		dev_pm_opp_put_opp_table(opp_table);
 	/* Drop the reference taken by _find_opp_table() */
 	dev_pm_opp_put_opp_table(opp_table);

drivers/opp/opp.h+2−0

  * @dynamic:	not-created from static DT entries.
  * @turbo:	true if turbo (boost) OPP
  * @suspend:	true if suspend OPP
+ * @removed:	flag indicating that OPP's reference is dropped by OPP core.
  * @pstate: Device's power domain's performance state.
  * @rate:	Frequency in hertz
  * @level:	Performance level
 	bool dynamic;
 	bool turbo;
 	bool suspend;
+	bool removed;
 	unsigned int pstate;
 	unsigned long rate;
 	unsigned int level;

drivers/pci/xen-pcifront.c+2−2

@@ -26,7 +26,7 @@ · 25 unmodified lines
26	#include <xen/platform_pci.h>	26	#include <xen/platform_pci.h>
27		27
28	#include <asm/xen/swiotlb-xen.h>	28	#include <asm/xen/swiotlb-xen.h>
29	#define INVALID_GRANT_REF (0)	29
30	#define INVALID_EVTCHN (-1)	30	#define INVALID_EVTCHN (-1)
31		31
32	struct pci_bus_entry {	32	struct pci_bus_entry {
@@ -42,7 +42,7 @@ struct pcifront_device { · 9 unmodified lines
42	struct list_head root_buses;	42	struct list_head root_buses;
43		43
44	int evtchn;	44	int evtchn;
45	int gnt_ref;	45	grant_ref_t gnt_ref;
46		46
47	int irq;	47	int irq;
48		48

drivers/perf/arm_dmc620_pmu.c+1−0

@@ -681,6 +681,7 @@ static int dmc620_pmu_device_probe(struct platform_device *pdev) · 680 unmodified lines
681	if (!name) {	681	if (!name) {
682	dev_err(&pdev->dev,	682	dev_err(&pdev->dev,
683	"Create name failed, PMU @%pa\n", &res->start);	683	"Create name failed, PMU @%pa\n", &res->start);
		684	ret = -ENOMEM;
684	goto out_teardown_dev;	685	goto out_teardown_dev;
685	}	686	}
686		687

drivers/regulator/mt6315-regulator.c+2−2

@@ -41,7 +41,7 @@ struct mt6315_chip { · 40 unmodified lines
41	.type = REGULATOR_VOLTAGE, \	41	.type = REGULATOR_VOLTAGE, \
42	.id = _bid, \	42	.id = _bid, \
43	.owner = THIS_MODULE, \	43	.owner = THIS_MODULE, \
44	.n_voltages = 0xbf, \	44	.n_voltages = 0xc0, \
45	.linear_ranges = mt_volt_range1, \	45	.linear_ranges = mt_volt_range1, \
46	.n_linear_ranges = ARRAY_SIZE(mt_volt_range1), \	46	.n_linear_ranges = ARRAY_SIZE(mt_volt_range1), \
47	.vsel_reg = _vsel, \	47	.vsel_reg = _vsel, \
@@ -69,7 +69,7 @@ static unsigned int mt6315_map_mode(u32 mode) · 21 unmodified lines
69	case MT6315_BUCK_MODE_LP:	69	case MT6315_BUCK_MODE_LP:
70	return REGULATOR_MODE_IDLE;	70	return REGULATOR_MODE_IDLE;
71	default:	71	default:
72	return -EINVAL;	72	return REGULATOR_MODE_INVALID;
73	}	73	}
74	}	74	}
75		75

drivers/regulator/pca9450-regulator.c+9−1

 		return ret;
 	}
+	/* Clear PRESET_EN bit in BUCK123_DVS to use DVS registers */
+	ret = regmap_clear_bits(pca9450->regmap, PCA9450_REG_BUCK123_DVS,
+				BUCK123_PRESET_EN);
+	if (ret) {
+		dev_err(&i2c->dev, "Failed to clear PRESET_EN bit: %d\n", ret);
+		return ret;
+	}
 	/* Set reset behavior on assertion of WDOG_B signal */
 	ret = regmap_update_bits(pca9450->regmap, PCA9450_REG_RESET_CTRL,
 				WDOG_B_CFG_MASK, WDOG_B_CFG_COLD_LDO12);
 	if (IS_ERR(pca9450->sd_vsel_gpio)) {
 		dev_err(&i2c->dev, "Failed to get SD_VSEL GPIO\n");
-		return ret;
+		return PTR_ERR(pca9450->sd_vsel_gpio);
 	}
 	dev_info(&i2c->dev, "%s probed.\n",

drivers/regulator/qcom-rpmh-regulator.c+3−3

@@ -726,8 +726,8 @@ static const struct rpmh_vreg_hw_data pmic5_ftsmps510 = { · 725 unmodified lines
726	static const struct rpmh_vreg_hw_data pmic5_hfsmps515 = {	726	static const struct rpmh_vreg_hw_data pmic5_hfsmps515 = {
727	.regulator_type = VRM,	727	.regulator_type = VRM,
728	.ops = &rpmh_regulator_vrm_ops,	728	.ops = &rpmh_regulator_vrm_ops,
729	.voltage_range = REGULATOR_LINEAR_RANGE(2800000, 0, 4, 16000),	729	.voltage_range = REGULATOR_LINEAR_RANGE(320000, 0, 235, 16000),
730	.n_voltages = 5,	730	.n_voltages = 236,
731	.pmic_mode_map = pmic_mode_map_pmic5_smps,	731	.pmic_mode_map = pmic_mode_map_pmic5_smps,
732	.of_map_mode = rpmh_regulator_pmic4_smps_of_map_mode,	732	.of_map_mode = rpmh_regulator_pmic4_smps_of_map_mode,
733	};	733	};
@@ -901,7 +901,7 @@ static const struct rpmh_vreg_init_data pm8350_vreg_data[] = { · 167 unmodified lines
901	};	901	};
902		902
903	static const struct rpmh_vreg_init_data pm8350c_vreg_data[] = {	903	static const struct rpmh_vreg_init_data pm8350c_vreg_data[] = {
904	RPMH_VREG("smps1", "smp%s1", &pmic5_hfsmps510, "vdd-s1"),	904	RPMH_VREG("smps1", "smp%s1", &pmic5_hfsmps515, "vdd-s1"),
905	RPMH_VREG("smps2", "smp%s2", &pmic5_ftsmps510, "vdd-s2"),	905	RPMH_VREG("smps2", "smp%s2", &pmic5_ftsmps510, "vdd-s2"),
906	RPMH_VREG("smps3", "smp%s3", &pmic5_ftsmps510, "vdd-s3"),	906	RPMH_VREG("smps3", "smp%s3", &pmic5_ftsmps510, "vdd-s3"),
907	RPMH_VREG("smps4", "smp%s4", &pmic5_ftsmps510, "vdd-s4"),	907	RPMH_VREG("smps4", "smp%s4", &pmic5_ftsmps510, "vdd-s4"),

drivers/regulator/rt4831-regulator.c+2−2

@@ -153,9 +153,9 @@ static int rt4831_regulator_probe(struct platform_device *pdev) · 152 unmodified lines
153	int i, ret;	153	int i, ret;
154		154
155	regmap = dev_get_regmap(pdev->dev.parent, NULL);	155	regmap = dev_get_regmap(pdev->dev.parent, NULL);
156	if (IS_ERR(regmap)) {	156	if (!regmap) {
157	dev_err(&pdev->dev, "Failed to init regmap\n");	157	dev_err(&pdev->dev, "Failed to init regmap\n");
158	return PTR_ERR(regmap);	158	return -ENODEV;
159	}	159	}
160		160
161	/* Configure DSV mode to normal by default */	161	/* Configure DSV mode to normal by default */

drivers/s390/block/dasd.c+3−3

 	basedev = block->base;
 	spin_lock_irq(&dq->lock);
-	if (basedev->state < DASD_STATE_READY) {
+	if (basedev->state < DASD_STATE_READY ||
+	    test_bit(DASD_FLAG_OFFLINE, &basedev->flags)) {
 		DBF_DEV_EVENT(DBF_ERR, basedev,
 			      "device not ready for request %p", req);
 		rc = BLK_STS_IOERR;
 	struct dasd_device *device;
 	struct dasd_block *block;
-	cdev->handler = NULL;
 	device = dasd_device_from_cdev(cdev);
 	if (IS_ERR(device)) {
 		dasd_remove_sysfs_files(cdev);
 	 * no quite down yet.
 	 */
 	dasd_set_target_state(device, DASD_STATE_NEW);
+	cdev->handler = NULL;
 	/* dasd_delete_device destroys the device reference. */
 	block = device->block;
 	dasd_delete_device(device);

drivers/s390/char/tty3270.c+4−2

 			 * last output position matches the start address
 			 * of this line.
 			 */
-			if (s->string[1] == sba[0] && s->string[2] == sba[1])
+			if (s->string[1] == sba[0] && s->string[2] == sba[1]) {
-				str += 3, len -= 3;
+				str += 3;
+				len -= 3;
+			}
 			if (raw3270_request_add_data(wrq, str, len) != 0)
 				break;
 			list_del_init(&s->update);

drivers/s390/char/zcore.c+27−17

@@ -15,6 +15,7 @@ · 14 unmodified lines
15	#include <linux/init.h>	15	#include <linux/init.h>
16	#include <linux/slab.h>	16	#include <linux/slab.h>
17	#include <linux/debugfs.h>	17	#include <linux/debugfs.h>
		18	#include <linux/reboot.h>
18		19
19	#include <asm/asm-offsets.h>	20	#include <asm/asm-offsets.h>
20	#include <asm/ipl.h>	21	#include <asm/ipl.h>
@@ -238,6 +239,28 @@ static int __init zcore_reipl_init(void) · 217 unmodified lines
238	return 0;	239	return 0;
239	}	240	}
240		241
		242	static int zcore_reboot_and_on_panic_handler(struct notifier_block *self,
		243	unsigned long event,
		244	void *data)
		245	{
		246	if (hsa_available)
		247	release_hsa();
		248
		249	return NOTIFY_OK;
		250	}
		251
		252	static struct notifier_block zcore_reboot_notifier = {
		253	.notifier_call = zcore_reboot_and_on_panic_handler,
		254	/* we need to be notified before reipl and kdump */
		255	.priority = INT_MAX,
		256	};
		257
		258	static struct notifier_block zcore_on_panic_notifier = {
		259	.notifier_call = zcore_reboot_and_on_panic_handler,
		260	/* we need to be notified before reipl and kdump */
		261	.priority = INT_MAX,
		262	};
		263
241	static int __init zcore_init(void)	264	static int __init zcore_init(void)
242	{	265	{
243	unsigned char arch;	266	unsigned char arch;
@@ -293,28 +316,15 @@ static int __init zcore_init(void) · 49 unmodified lines
293	goto fail;	316	goto fail;
294		317
295	zcore_dir = debugfs_create_dir("zcore" , NULL);	318	zcore_dir = debugfs_create_dir("zcore" , NULL);
296	if (!zcore_dir) {
297	rc = -ENOMEM;
298	goto fail;
299	}
300	zcore_reipl_file = debugfs_create_file("reipl", S_IRUSR, zcore_dir,	319	zcore_reipl_file = debugfs_create_file("reipl", S_IRUSR, zcore_dir,
301	NULL, &zcore_reipl_fops);	320	NULL, &zcore_reipl_fops);
302	if (!zcore_reipl_file) {
303	rc = -ENOMEM;
304	goto fail_dir;
305	}
306	zcore_hsa_file = debugfs_create_file("hsa", S_IRUSR\|S_IWUSR, zcore_dir,	321	zcore_hsa_file = debugfs_create_file("hsa", S_IRUSR\|S_IWUSR, zcore_dir,
307	NULL, &zcore_hsa_fops);	322	NULL, &zcore_hsa_fops);
308	if (!zcore_hsa_file) {
309	rc = -ENOMEM;
310	goto fail_reipl_file;
311	}
312	return 0;
313		323
314	fail_reipl_file:	324	register_reboot_notifier(&zcore_reboot_notifier);
315	debugfs_remove(zcore_reipl_file);	325	atomic_notifier_chain_register(&panic_notifier_list, &zcore_on_panic_notifier);
316	fail_dir:	326
317	debugfs_remove(zcore_dir);	327	return 0;
318	fail:	328	fail:
319	diag308(DIAG308_REL_HSA, NULL);	329	diag308(DIAG308_REL_HSA, NULL);
320	return rc;	330	return rc;

drivers/s390/cio/device_fsm.c+1−1

@@ -47,7 +47,7 @@ static void ccw_timeout_log(struct ccw_device *cdev) · 46 unmodified lines
47	orb = &private->orb;	47	orb = &private->orb;
48	cc = stsch(sch->schid, &schib);	48	cc = stsch(sch->schid, &schib);
49		49
50	printk(KERN_WARNING "cio: ccw device timeout occurred at %llx, "	50	printk(KERN_WARNING "cio: ccw device timeout occurred at %lx, "
51	"device information:\n", get_tod_clock());	51	"device information:\n", get_tod_clock());
52	printk(KERN_WARNING "cio: orb:\n");	52	printk(KERN_WARNING "cio: orb:\n");
53	print_hex_dump(KERN_WARNING, "cio: ", DUMP_PREFIX_NONE, 16, 1,	53	print_hex_dump(KERN_WARNING, "cio: ", DUMP_PREFIX_NONE, 16, 1,

drivers/s390/cio/vfio_ccw_ops.c+3−3

@@ -543,7 +543,7 @@ static ssize_t vfio_ccw_mdev_ioctl(struct mdev_device *mdev, · 542 unmodified lines
543	if (ret)	543	if (ret)
544	return ret;	544	return ret;
545		545
546	return copy_to_user((void __user *)arg, &info, minsz);	546	return copy_to_user((void __user *)arg, &info, minsz) ? -EFAULT : 0;
547	}	547	}
548	case VFIO_DEVICE_GET_REGION_INFO:	548	case VFIO_DEVICE_GET_REGION_INFO:
549	{	549	{
@@ -561,7 +561,7 @@ static ssize_t vfio_ccw_mdev_ioctl(struct mdev_device *mdev, · 11 unmodified lines
561	if (ret)	561	if (ret)
562	return ret;	562	return ret;
563		563
564	return copy_to_user((void __user *)arg, &info, minsz);	564	return copy_to_user((void __user *)arg, &info, minsz) ? -EFAULT : 0;
565	}	565	}
566	case VFIO_DEVICE_GET_IRQ_INFO:	566	case VFIO_DEVICE_GET_IRQ_INFO:
567	{	567	{
@@ -582,7 +582,7 @@ static ssize_t vfio_ccw_mdev_ioctl(struct mdev_device *mdev, · 14 unmodified lines
582	if (info.count == -1)	582	if (info.count == -1)
583	return -EINVAL;	583	return -EINVAL;
584		584
585	return copy_to_user((void __user *)arg, &info, minsz);	585	return copy_to_user((void __user *)arg, &info, minsz) ? -EFAULT : 0;
586	}	586	}
587	case VFIO_DEVICE_SET_IRQS:	587	case VFIO_DEVICE_SET_IRQS:
588	{	588	{

drivers/s390/crypto/vfio_ap_ops.c+1−1

@@ -1286,7 +1286,7 @@ static int vfio_ap_mdev_get_device_info(unsigned long arg) · 1285 unmodified lines
1286	info.num_regions = 0;	1286	info.num_regions = 0;
1287	info.num_irqs = 0;	1287	info.num_irqs = 0;
1288		1288
1289	return copy_to_user((void __user *)arg, &info, minsz);	1289	return copy_to_user((void __user *)arg, &info, minsz) ? -EFAULT : 0;
1290	}	1290	}
1291		1291
1292	static ssize_t vfio_ap_mdev_ioctl(struct mdev_device *mdev,	1292	static ssize_t vfio_ap_mdev_ioctl(struct mdev_device *mdev,

drivers/s390/net/qeth_core.h+2−1

 	int is_header[QDIO_MAX_ELEMENTS_PER_BUFFER];
 	struct qeth_qdio_out_q *q;
-	struct qeth_qdio_out_buffer *next_pending;
+	struct list_head list_entry;
 };
 struct qeth_card;
 	struct qdio_buffer *qdio_bufs[QDIO_MAX_BUFFERS_PER_Q];
 	struct qeth_qdio_out_buffer *bufs[QDIO_MAX_BUFFERS_PER_Q];
 	struct qdio_outbuf_state *bufstates; /* convenience pointer */
+	struct list_head pending_bufs;
 	struct qeth_out_q_stats stats;
 	spinlock_t lock;
 	unsigned int priority;

drivers/s390/net/qeth_core_main.c+60−68

@@ -73,8 +73,6 @@ static void qeth_free_qdio_queues(struct qeth_card *card); · 72 unmodified lines
73	static void qeth_notify_skbs(struct qeth_qdio_out_q *queue,	73	static void qeth_notify_skbs(struct qeth_qdio_out_q *queue,
74	struct qeth_qdio_out_buffer *buf,	74	struct qeth_qdio_out_buffer *buf,
75	enum iucv_tx_notify notification);	75	enum iucv_tx_notify notification);
76	static void qeth_tx_complete_buf(struct qeth_qdio_out_buffer *buf, bool error,
77	int budget);
78		76
79	static void qeth_close_dev_handler(struct work_struct *work)	77	static void qeth_close_dev_handler(struct work_struct *work)
80	{	78	{
@@ -465,41 +463,6 @@ static enum iucv_tx_notify qeth_compute_cq_notification(int sbalf15, · 384 unmodified lines
465	return n;	463	return n;
466	}	464	}
467		465
468	static void qeth_cleanup_handled_pending(struct qeth_qdio_out_q *q, int bidx,
469	int forced_cleanup)
470	{
471	if (q->card->options.cq != QETH_CQ_ENABLED)
472	return;
473
474	if (q->bufs[bidx]->next_pending != NULL) {
475	struct qeth_qdio_out_buffer *head = q->bufs[bidx];
476	struct qeth_qdio_out_buffer *c = q->bufs[bidx]->next_pending;
477
478	while (c) {
479	if (forced_cleanup \|\|
480	atomic_read(&c->state) == QETH_QDIO_BUF_EMPTY) {
481	struct qeth_qdio_out_buffer *f = c;
482
483	QETH_CARD_TEXT(f->q->card, 5, "fp");
484	QETH_CARD_TEXT_(f->q->card, 5, "%lx", (long) f);
485	/* release here to avoid interleaving between
486	outbound tasklet and inbound tasklet
487	regarding notifications and lifecycle */
488	qeth_tx_complete_buf(c, forced_cleanup, 0);
489
490	c = f->next_pending;
491	WARN_ON_ONCE(head->next_pending != f);
492	head->next_pending = c;
493	kmem_cache_free(qeth_qdio_outbuf_cache, f);
494	} else {
495	head = c;
496	c = c->next_pending;
497	}
498
499	}
500	}
501	}
502
503	static void qeth_qdio_handle_aob(struct qeth_card *card,	466	static void qeth_qdio_handle_aob(struct qeth_card *card,
504	unsigned long phys_aob_addr)	467	unsigned long phys_aob_addr)
505	{	468	{
@@ -507,6 +470,7 @@ static void qeth_qdio_handle_aob(struct qeth_card *card, · 1 unmodified line
507	struct qaob *aob;	470	struct qaob *aob;
508	struct qeth_qdio_out_buffer *buffer;	471	struct qeth_qdio_out_buffer *buffer;
509	enum iucv_tx_notify notification;	472	enum iucv_tx_notify notification;
		473	struct qeth_qdio_out_q *queue;
510	unsigned int i;	474	unsigned int i;
511		475
512	aob = (struct qaob *) phys_to_virt(phys_aob_addr);	476	aob = (struct qaob *) phys_to_virt(phys_aob_addr);
@@ -537,7 +501,7 @@ static void qeth_qdio_handle_aob(struct qeth_card *card, · 24 unmodified lines
537	qeth_notify_skbs(buffer->q, buffer, notification);	501	qeth_notify_skbs(buffer->q, buffer, notification);
538		502
539	/* Free dangling allocations. The attached skbs are handled by	503	/* Free dangling allocations. The attached skbs are handled by
540	* qeth_cleanup_handled_pending().	504	* qeth_tx_complete_pending_bufs().
541	*/	505	*/
542	for (i = 0;	506	for (i = 0;
543	i < aob->sb_count && i < QETH_MAX_BUFFER_ELEMENTS(card);	507	i < aob->sb_count && i < QETH_MAX_BUFFER_ELEMENTS(card);
@@ -549,7 +513,9 @@ static void qeth_qdio_handle_aob(struct qeth_card *card, · 5 unmodified lines
549	buffer->is_header[i] = 0;	513	buffer->is_header[i] = 0;
550	}	514	}
551		515
		516	queue = buffer->q;
552	atomic_set(&buffer->state, QETH_QDIO_BUF_EMPTY);	517	atomic_set(&buffer->state, QETH_QDIO_BUF_EMPTY);
		518	napi_schedule(&queue->napi);
553	break;	519	break;
554	default:	520	default:
555	WARN_ON_ONCE(1);	521	WARN_ON_ONCE(1);
@@ -1424,9 +1390,6 @@ static void qeth_tx_complete_buf(struct qeth_qdio_out_buffer *buf, bool error, · 868 unmodified lines
1424	struct qeth_qdio_out_q *queue = buf->q;	1390	struct qeth_qdio_out_q *queue = buf->q;
1425	struct sk_buff *skb;	1391	struct sk_buff *skb;
1426		1392
1427	if (atomic_read(&buf->state) == QETH_QDIO_BUF_PENDING)
1428	qeth_notify_skbs(queue, buf, TX_NOTIFY_GENERALERROR);
1429
1430	/* Empty buffer? */	1393	/* Empty buffer? */
1431	if (buf->next_element_to_fill == 0)	1394	if (buf->next_element_to_fill == 0)
1432	return;	1395	return;
@@ -1488,14 +1451,38 @@ static void qeth_clear_output_buffer(struct qeth_qdio_out_q *queue, · 55 unmodified lines
1488	atomic_set(&buf->state, QETH_QDIO_BUF_EMPTY);	1451	atomic_set(&buf->state, QETH_QDIO_BUF_EMPTY);
1489	}	1452	}
1490		1453
		1454	static void qeth_tx_complete_pending_bufs(struct qeth_card *card,
		1455	struct qeth_qdio_out_q *queue,
		1456	bool drain)
		1457	{
		1458	struct qeth_qdio_out_buffer buf, tmp;
		1459
		1460	list_for_each_entry_safe(buf, tmp, &queue->pending_bufs, list_entry) {
		1461	if (drain \|\| atomic_read(&buf->state) == QETH_QDIO_BUF_EMPTY) {
		1462	QETH_CARD_TEXT(card, 5, "fp");
		1463	QETH_CARD_TEXT_(card, 5, "%lx", (long) buf);
		1464
		1465	if (drain)
		1466	qeth_notify_skbs(queue, buf,
		1467	TX_NOTIFY_GENERALERROR);
		1468	qeth_tx_complete_buf(buf, drain, 0);
		1469
		1470	list_del(&buf->list_entry);
		1471	kmem_cache_free(qeth_qdio_outbuf_cache, buf);
		1472	}
		1473	}
		1474	}
		1475
1491	static void qeth_drain_output_queue(struct qeth_qdio_out_q *q, bool free)	1476	static void qeth_drain_output_queue(struct qeth_qdio_out_q *q, bool free)
1492	{	1477	{
1493	int j;	1478	int j;
1494		1479
		1480	qeth_tx_complete_pending_bufs(q->card, q, true);
		1481
1495	for (j = 0; j < QDIO_MAX_BUFFERS_PER_Q; ++j) {	1482	for (j = 0; j < QDIO_MAX_BUFFERS_PER_Q; ++j) {
1496	if (!q->bufs[j])	1483	if (!q->bufs[j])
1497	continue;	1484	continue;
1498	qeth_cleanup_handled_pending(q, j, 1);	1485
1499	qeth_clear_output_buffer(q, q->bufs[j], true, 0);	1486	qeth_clear_output_buffer(q, q->bufs[j], true, 0);
1500	if (free) {	1487	if (free) {
1501	kmem_cache_free(qeth_qdio_outbuf_cache, q->bufs[j]);	1488	kmem_cache_free(qeth_qdio_outbuf_cache, q->bufs[j]);
@@ -2615,7 +2602,6 @@ static int qeth_init_qdio_out_buf(struct qeth_qdio_out_q *q, int bidx) · 1113 unmodified lines
2615	skb_queue_head_init(&newbuf->skb_list);	2602	skb_queue_head_init(&newbuf->skb_list);
2616	lockdep_set_class(&newbuf->skb_list.lock, &qdio_out_skb_queue_key);	2603	lockdep_set_class(&newbuf->skb_list.lock, &qdio_out_skb_queue_key);
2617	newbuf->q = q;	2604	newbuf->q = q;
2618	newbuf->next_pending = q->bufs[bidx];
2619	atomic_set(&newbuf->state, QETH_QDIO_BUF_EMPTY);	2605	atomic_set(&newbuf->state, QETH_QDIO_BUF_EMPTY);
2620	q->bufs[bidx] = newbuf;	2606	q->bufs[bidx] = newbuf;
2621	return 0;	2607	return 0;
@@ -2634,15 +2620,28 @@ static void qeth_free_output_queue(struct qeth_qdio_out_q *q) · 12 unmodified lines
2634	static struct qeth_qdio_out_q *qeth_alloc_output_queue(void)	2620	static struct qeth_qdio_out_q *qeth_alloc_output_queue(void)
2635	{	2621	{
2636	struct qeth_qdio_out_q q = kzalloc(sizeof(q), GFP_KERNEL);	2622	struct qeth_qdio_out_q q = kzalloc(sizeof(q), GFP_KERNEL);
		2623	unsigned int i;
2637		2624
2638	if (!q)	2625	if (!q)
2639	return NULL;	2626	return NULL;
2640		2627
2641	if (qdio_alloc_buffers(q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q)) {	2628	if (qdio_alloc_buffers(q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q))
2642	kfree(q);	2629	goto err_qdio_bufs;
2643	return NULL;	2630
		2631	for (i = 0; i < QDIO_MAX_BUFFERS_PER_Q; i++) {
		2632	if (qeth_init_qdio_out_buf(q, i))
		2633	goto err_out_bufs;
2644	}	2634	}
		2635
2645	return q;	2636	return q;
		2637
		2638	err_out_bufs:
		2639	while (i > 0)
		2640	kmem_cache_free(qeth_qdio_outbuf_cache, q->bufs[--i]);
		2641	qdio_free_buffers(q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q);
		2642	err_qdio_bufs:
		2643	kfree(q);
		2644	return NULL;
2646	}	2645	}
2647		2646
2648	static void qeth_tx_completion_timer(struct timer_list *timer)	2647	static void qeth_tx_completion_timer(struct timer_list *timer)
@@ -2655,7 +2654,7 @@ static void qeth_tx_completion_timer(struct timer_list *timer) · 6 unmodified lines
2655		2654
2656	static int qeth_alloc_qdio_queues(struct qeth_card *card)	2655	static int qeth_alloc_qdio_queues(struct qeth_card *card)
2657	{	2656	{
2658	int i, j;	2657	unsigned int i;
2659		2658
2660	QETH_CARD_TEXT(card, 2, "allcqdbf");	2659	QETH_CARD_TEXT(card, 2, "allcqdbf");
2661		2660
@@ -2684,18 +2683,12 @@ static int qeth_alloc_qdio_queues(struct qeth_card *card) · 22 unmodified lines
2684	card->qdio.out_qs[i] = queue;	2683	card->qdio.out_qs[i] = queue;
2685	queue->card = card;	2684	queue->card = card;
2686	queue->queue_no = i;	2685	queue->queue_no = i;
		2686	INIT_LIST_HEAD(&queue->pending_bufs);
2687	spin_lock_init(&queue->lock);	2687	spin_lock_init(&queue->lock);
2688	timer_setup(&queue->timer, qeth_tx_completion_timer, 0);	2688	timer_setup(&queue->timer, qeth_tx_completion_timer, 0);
2689	queue->coalesce_usecs = QETH_TX_COALESCE_USECS;	2689	queue->coalesce_usecs = QETH_TX_COALESCE_USECS;
2690	queue->max_coalesced_frames = QETH_TX_MAX_COALESCED_FRAMES;	2690	queue->max_coalesced_frames = QETH_TX_MAX_COALESCED_FRAMES;
2691	queue->priority = QETH_QIB_PQUE_PRIO_DEFAULT;	2691	queue->priority = QETH_QIB_PQUE_PRIO_DEFAULT;
2692
2693	/* give outbound qeth_qdio_buffers their qdio_buffers */
2694	for (j = 0; j < QDIO_MAX_BUFFERS_PER_Q; ++j) {
2695	WARN_ON(queue->bufs[j]);
2696	if (qeth_init_qdio_out_buf(queue, j))
2697	goto out_freeoutqbufs;
2698	}
2699	}	2692	}
2700		2693
2701	/* completion */	2694	/* completion */
@@ -2704,13 +2697,6 @@ static int qeth_alloc_qdio_queues(struct qeth_card *card) · 2 unmodified lines
2704		2697
2705	return 0;	2698	return 0;
2706		2699
2707	out_freeoutqbufs:
2708	while (j > 0) {
2709	--j;
2710	kmem_cache_free(qeth_qdio_outbuf_cache,
2711	card->qdio.out_qs[i]->bufs[j]);
2712	card->qdio.out_qs[i]->bufs[j] = NULL;
2713	}
2714	out_freeoutq:	2700	out_freeoutq:
2715	while (i > 0) {	2701	while (i > 0) {
2716	qeth_free_output_queue(card->qdio.out_qs[--i]);	2702	qeth_free_output_queue(card->qdio.out_qs[--i]);
@@ -6107,6 +6093,8 @@ static void qeth_iqd_tx_complete(struct qeth_qdio_out_q *queue, · 3390 unmodified lines
6107	qeth_schedule_recovery(card);	6093	qeth_schedule_recovery(card);
6108	}	6094	}
6109		6095
		6096	list_add(&buffer->list_entry,
		6097	&queue->pending_bufs);
6110	/* Skip clearing the buffer: */	6098	/* Skip clearing the buffer: */
6111	return;	6099	return;
6112	case QETH_QDIO_BUF_QAOB_OK:	6100	case QETH_QDIO_BUF_QAOB_OK:
@@ -6162,6 +6150,8 @@ static int qeth_tx_poll(struct napi_struct *napi, int budget) · 49 unmodified lines
6162	unsigned int bytes = 0;	6150	unsigned int bytes = 0;
6163	int completed;	6151	int completed;
6164		6152
		6153	qeth_tx_complete_pending_bufs(card, queue, false);
		6154
6165	if (qeth_out_queue_is_empty(queue)) {	6155	if (qeth_out_queue_is_empty(queue)) {
6166	napi_complete(napi);	6156	napi_complete(napi);
6167	return 0;	6157	return 0;
@@ -6194,7 +6184,6 @@ static int qeth_tx_poll(struct napi_struct *napi, int budget) · 26 unmodified lines
6194		6184
6195	qeth_handle_send_error(card, buffer, error);	6185	qeth_handle_send_error(card, buffer, error);
6196	qeth_iqd_tx_complete(queue, bidx, error, budget);	6186	qeth_iqd_tx_complete(queue, bidx, error, budget);
6197	qeth_cleanup_handled_pending(queue, bidx, false);
6198	}	6187	}
6199		6188
6200	netdev_tx_completed_queue(txq, packets, bytes);	6189	netdev_tx_completed_queue(txq, packets, bytes);
@@ -7249,9 +7238,7 @@ int qeth_open(struct net_device *dev) · 1048 unmodified lines
7249	card->data.state = CH_STATE_UP;	7238	card->data.state = CH_STATE_UP;
7250	netif_tx_start_all_queues(dev);	7239	netif_tx_start_all_queues(dev);
7251		7240
7252	napi_enable(&card->napi);
7253	local_bh_disable();	7241	local_bh_disable();
7254	napi_schedule(&card->napi);
7255	if (IS_IQD(card)) {	7242	if (IS_IQD(card)) {
7256	struct qeth_qdio_out_q *queue;	7243	struct qeth_qdio_out_q *queue;
7257	unsigned int i;	7244	unsigned int i;
@@ -7263,8 +7250,12 @@ int qeth_open(struct net_device *dev) · 5 unmodified lines
7263	napi_schedule(&queue->napi);	7250	napi_schedule(&queue->napi);
7264	}	7251	}
7265	}	7252	}
		7253
		7254	napi_enable(&card->napi);
		7255	napi_schedule(&card->napi);
7266	/* kick-start the NAPI softirq: */	7256	/* kick-start the NAPI softirq: */
7267	local_bh_enable();	7257	local_bh_enable();
		7258
7268	return 0;	7259	return 0;
7269	}	7260	}
7270	EXPORT_SYMBOL_GPL(qeth_open);	7261	EXPORT_SYMBOL_GPL(qeth_open);
@@ -7274,6 +7265,11 @@ int qeth_stop(struct net_device *dev) · 3 unmodified lines
7274	struct qeth_card *card = dev->ml_priv;	7265	struct qeth_card *card = dev->ml_priv;
7275		7266
7276	QETH_CARD_TEXT(card, 4, "qethstop");	7267	QETH_CARD_TEXT(card, 4, "qethstop");
		7268
		7269	napi_disable(&card->napi);
		7270	cancel_delayed_work_sync(&card->buffer_reclaim_work);
		7271	qdio_stop_irq(CARD_DDEV(card));
		7272
7277	if (IS_IQD(card)) {	7273	if (IS_IQD(card)) {
7278	struct qeth_qdio_out_q *queue;	7274	struct qeth_qdio_out_q *queue;
7279	unsigned int i;	7275	unsigned int i;
@@ -7294,10 +7290,6 @@ int qeth_stop(struct net_device *dev) · 14 unmodified lines
7294	netif_tx_disable(dev);	7290	netif_tx_disable(dev);
7295	}	7291	}
7296		7292
7297	napi_disable(&card->napi);
7298	cancel_delayed_work_sync(&card->buffer_reclaim_work);
7299	qdio_stop_irq(CARD_DDEV(card));
7300
7301	return 0;	7293	return 0;
7302	}	7294	}
7303	EXPORT_SYMBOL_GPL(qeth_stop);	7295	EXPORT_SYMBOL_GPL(qeth_stop);

drivers/scsi/ibmvscsi/ibmvfc.c+37−28

@@ -21,6 +21,7 @@ · 20 unmodified lines
21	#include <linux/bsg-lib.h>	21	#include <linux/bsg-lib.h>
22	#include <asm/firmware.h>	22	#include <asm/firmware.h>
23	#include <asm/irq.h>	23	#include <asm/irq.h>
		24	#include <asm/rtas.h>
24	#include <asm/vio.h>	25	#include <asm/vio.h>
25	#include <scsi/scsi.h>	26	#include <scsi/scsi.h>
26	#include <scsi/scsi_cmnd.h>	27	#include <scsi/scsi_cmnd.h>
@@ -158,6 +159,9 @@ static void ibmvfc_npiv_logout(struct ibmvfc_host *); · 131 unmodified lines
158	static void ibmvfc_tgt_implicit_logout_and_del(struct ibmvfc_target *);	159	static void ibmvfc_tgt_implicit_logout_and_del(struct ibmvfc_target *);
159	static void ibmvfc_tgt_move_login(struct ibmvfc_target *);	160	static void ibmvfc_tgt_move_login(struct ibmvfc_target *);
160		161
		162	static void ibmvfc_release_sub_crqs(struct ibmvfc_host *);
		163	static void ibmvfc_init_sub_crqs(struct ibmvfc_host *);
		164
161	static const char *unknown_error = "unknown error";	165	static const char *unknown_error = "unknown error";
162		166
163	static long h_reg_sub_crq(unsigned long unit_address, unsigned long ioba,	167	static long h_reg_sub_crq(unsigned long unit_address, unsigned long ioba,
@@ -899,6 +903,9 @@ static int ibmvfc_reenable_crq_queue(struct ibmvfc_host *vhost) · 735 unmodified lines
899	{	903	{
900	int rc = 0;	904	int rc = 0;
901	struct vio_dev *vdev = to_vio_dev(vhost->dev);	905	struct vio_dev *vdev = to_vio_dev(vhost->dev);
		906	unsigned long flags;
		907
		908	ibmvfc_release_sub_crqs(vhost);
902		909
903	/* Re-enable the CRQ */	910	/* Re-enable the CRQ */
904	do {	911	do {
@@ -910,6 +917,15 @@ static int ibmvfc_reenable_crq_queue(struct ibmvfc_host *vhost) · 5 unmodified lines
910	if (rc)	917	if (rc)
911	dev_err(vhost->dev, "Error enabling adapter (rc=%d)\n", rc);	918	dev_err(vhost->dev, "Error enabling adapter (rc=%d)\n", rc);
912		919
		920	spin_lock_irqsave(vhost->host->host_lock, flags);
		921	spin_lock(vhost->crq.q_lock);
		922	vhost->do_enquiry = 1;
		923	vhost->using_channels = 0;
		924	spin_unlock(vhost->crq.q_lock);
		925	spin_unlock_irqrestore(vhost->host->host_lock, flags);
		926
		927	ibmvfc_init_sub_crqs(vhost);
		928
913	return rc;	929	return rc;
914	}	930	}
915		931
@@ -926,8 +942,8 @@ static int ibmvfc_reset_crq(struct ibmvfc_host *vhost) · 10 unmodified lines
926	unsigned long flags;	942	unsigned long flags;
927	struct vio_dev *vdev = to_vio_dev(vhost->dev);	943	struct vio_dev *vdev = to_vio_dev(vhost->dev);
928	struct ibmvfc_queue *crq = &vhost->crq;	944	struct ibmvfc_queue *crq = &vhost->crq;
929	struct ibmvfc_queue *scrq;	945
930	int i;	946	ibmvfc_release_sub_crqs(vhost);
931		947
932	/* Close the CRQ */	948	/* Close the CRQ */
933	do {	949	do {
@@ -947,16 +963,6 @@ static int ibmvfc_reset_crq(struct ibmvfc_host *vhost) · 13 unmodified lines
947	memset(crq->msgs.crq, 0, PAGE_SIZE);	963	memset(crq->msgs.crq, 0, PAGE_SIZE);
948	crq->cur = 0;	964	crq->cur = 0;
949		965
950	if (vhost->scsi_scrqs.scrqs) {
951	for (i = 0; i < nr_scsi_hw_queues; i++) {
952	scrq = &vhost->scsi_scrqs.scrqs[i];
953	spin_lock(scrq->q_lock);
954	memset(scrq->msgs.scrq, 0, PAGE_SIZE);
955	scrq->cur = 0;
956	spin_unlock(scrq->q_lock);
957	}
958	}
959
960	/* And re-open it again */	966	/* And re-open it again */
961	rc = plpar_hcall_norets(H_REG_CRQ, vdev->unit_address,	967	rc = plpar_hcall_norets(H_REG_CRQ, vdev->unit_address,
962	crq->msg_token, PAGE_SIZE);	968	crq->msg_token, PAGE_SIZE);
@@ -966,9 +972,12 @@ static int ibmvfc_reset_crq(struct ibmvfc_host *vhost) · 3 unmodified lines
966	dev_warn(vhost->dev, "Partner adapter not ready\n");	972	dev_warn(vhost->dev, "Partner adapter not ready\n");
967	else if (rc != 0)	973	else if (rc != 0)
968	dev_warn(vhost->dev, "Couldn't register crq (rc=%d)\n", rc);	974	dev_warn(vhost->dev, "Couldn't register crq (rc=%d)\n", rc);
		975
969	spin_unlock(vhost->crq.q_lock);	976	spin_unlock(vhost->crq.q_lock);
970	spin_unlock_irqrestore(vhost->host->host_lock, flags);	977	spin_unlock_irqrestore(vhost->host->host_lock, flags);
971		978
		979	ibmvfc_init_sub_crqs(vhost);
		980
972	return rc;	981	return rc;
973	}	982	}
974		983
@@ -5642,7 +5651,8 @@ static int ibmvfc_register_scsi_channel(struct ibmvfc_host *vhost, · 4667 unmodified lines
5642	rc = h_reg_sub_crq(vdev->unit_address, scrq->msg_token, PAGE_SIZE,	5651	rc = h_reg_sub_crq(vdev->unit_address, scrq->msg_token, PAGE_SIZE,
5643	&scrq->cookie, &scrq->hw_irq);	5652	&scrq->cookie, &scrq->hw_irq);
5644		5653
5645	if (rc) {	5654	/* H_CLOSED indicates successful register, but no CRQ partner */
		5655	if (rc && rc != H_CLOSED) {
5646	dev_warn(dev, "Error registering sub-crq: %d\n", rc);	5656	dev_warn(dev, "Error registering sub-crq: %d\n", rc);
5647	if (rc == H_PARAMETER)	5657	if (rc == H_PARAMETER)
5648	dev_warn_once(dev, "Firmware may not support MQ\n");	5658	dev_warn_once(dev, "Firmware may not support MQ\n");
@@ -5675,8 +5685,8 @@ static int ibmvfc_register_scsi_channel(struct ibmvfc_host *vhost, · 26 unmodified lines
5675		5685
5676	irq_failed:	5686	irq_failed:
5677	do {	5687	do {
5678	plpar_hcall_norets(H_FREE_SUB_CRQ, vdev->unit_address, scrq->cookie);	5688	rc = plpar_hcall_norets(H_FREE_SUB_CRQ, vdev->unit_address, scrq->cookie);
5679	} while (rc == H_BUSY \|\| H_IS_LONG_BUSY(rc));	5689	} while (rtas_busy_delay(rc));
5680	reg_failed:	5690	reg_failed:
5681	ibmvfc_free_queue(vhost, scrq);	5691	ibmvfc_free_queue(vhost, scrq);
5682	LEAVE;	5692	LEAVE;
@@ -5694,6 +5704,7 @@ static void ibmvfc_deregister_scsi_channel(struct ibmvfc_host *vhost, int index) · 11 unmodified lines
5694		5704
5695	free_irq(scrq->irq, scrq);	5705	free_irq(scrq->irq, scrq);
5696	irq_dispose_mapping(scrq->irq);	5706	irq_dispose_mapping(scrq->irq);
		5707	scrq->irq = 0;
5697		5708
5698	do {	5709	do {
5699	rc = plpar_hcall_norets(H_FREE_SUB_CRQ, vdev->unit_address,	5710	rc = plpar_hcall_norets(H_FREE_SUB_CRQ, vdev->unit_address,
@@ -5707,17 +5718,21 @@ static void ibmvfc_deregister_scsi_channel(struct ibmvfc_host *vhost, int index) · 7 unmodified lines
5707	LEAVE;	5718	LEAVE;
5708	}	5719	}
5709		5720
5710	static int ibmvfc_init_sub_crqs(struct ibmvfc_host *vhost)	5721	static void ibmvfc_init_sub_crqs(struct ibmvfc_host *vhost)
5711	{	5722	{
5712	int i, j;	5723	int i, j;
5713		5724
5714	ENTER;	5725	ENTER;
		5726	if (!vhost->mq_enabled)
		5727	return;
5715		5728
5716	vhost->scsi_scrqs.scrqs = kcalloc(nr_scsi_hw_queues,	5729	vhost->scsi_scrqs.scrqs = kcalloc(nr_scsi_hw_queues,
5717	sizeof(*vhost->scsi_scrqs.scrqs),	5730	sizeof(*vhost->scsi_scrqs.scrqs),
5718	GFP_KERNEL);	5731	GFP_KERNEL);
5719	if (!vhost->scsi_scrqs.scrqs)	5732	if (!vhost->scsi_scrqs.scrqs) {
5720	return -1;	5733	vhost->do_enquiry = 0;
		5734	return;
		5735	}
5721		5736
5722	for (i = 0; i < nr_scsi_hw_queues; i++) {	5737	for (i = 0; i < nr_scsi_hw_queues; i++) {
5723	if (ibmvfc_register_scsi_channel(vhost, i)) {	5738	if (ibmvfc_register_scsi_channel(vhost, i)) {
@@ -5726,13 +5741,12 @@ static int ibmvfc_init_sub_crqs(struct ibmvfc_host *vhost) · 2 unmodified lines
5726	kfree(vhost->scsi_scrqs.scrqs);	5741	kfree(vhost->scsi_scrqs.scrqs);
5727	vhost->scsi_scrqs.scrqs = NULL;	5742	vhost->scsi_scrqs.scrqs = NULL;
5728	vhost->scsi_scrqs.active_queues = 0;	5743	vhost->scsi_scrqs.active_queues = 0;
5729	LEAVE;	5744	vhost->do_enquiry = 0;
5730	return -1;	5745	break;
5731	}	5746	}
5732	}	5747	}
5733		5748
5734	LEAVE;	5749	LEAVE;
5735	return 0;
5736	}	5750	}
5737		5751
5738	static void ibmvfc_release_sub_crqs(struct ibmvfc_host *vhost)	5752	static void ibmvfc_release_sub_crqs(struct ibmvfc_host *vhost)
@@ -5999,11 +6013,7 @@ static int ibmvfc_probe(struct vio_dev vdev, const struct vio_device_id id) · 260 unmodified lines
5999	goto remove_shost;	6013	goto remove_shost;
6000	}	6014	}
6001		6015
6002	if (vhost->mq_enabled) {	6016	ibmvfc_init_sub_crqs(vhost);
6003	rc = ibmvfc_init_sub_crqs(vhost);
6004	if (rc)
6005	dev_warn(dev, "Failed to allocate Sub-CRQs. rc=%d\n", rc);
6006	}
6007		6017
6008	if (shost_to_fc_host(shost)->rqst_q)	6018	if (shost_to_fc_host(shost)->rqst_q)
6009	blk_queue_max_segments(shost_to_fc_host(shost)->rqst_q, 1);	6019	blk_queue_max_segments(shost_to_fc_host(shost)->rqst_q, 1);
@@ -6038,7 +6048,7 @@ out: · 28 unmodified lines
6038	* Return value:	6048	* Return value:
6039	* 0	6049	* 0
6040	**/	6050	**/
6041	static int ibmvfc_remove(struct vio_dev *vdev)	6051	static void ibmvfc_remove(struct vio_dev *vdev)
6042	{	6052	{
6043	struct ibmvfc_host *vhost = dev_get_drvdata(&vdev->dev);	6053	struct ibmvfc_host *vhost = dev_get_drvdata(&vdev->dev);
6044	LIST_HEAD(purge);	6054	LIST_HEAD(purge);
@@ -6070,7 +6080,6 @@ static int ibmvfc_remove(struct vio_dev *vdev) · 25 unmodified lines
6070	spin_unlock(&ibmvfc_driver_lock);	6080	spin_unlock(&ibmvfc_driver_lock);
6071	scsi_host_put(vhost->host);	6081	scsi_host_put(vhost->host);
6072	LEAVE;	6082	LEAVE;
6073	return 0;
6074	}	6083	}
6075		6084
6076	/**	6085	/**

drivers/scsi/ibmvscsi/ibmvscsi.c+1−3

 	return -1;
 }
-static int ibmvscsi_remove(struct vio_dev *vdev)
+static void ibmvscsi_remove(struct vio_dev *vdev)
 {
 	struct ibmvscsi_host_data *hostdata = dev_get_drvdata(&vdev->dev);
 	spin_unlock(&ibmvscsi_driver_lock);
 	scsi_host_put(hostdata->host);
-	return 0;
 }
 /**

drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c+1−3

 	return rc;
 }
-static int ibmvscsis_remove(struct vio_dev *vdev)
+static void ibmvscsis_remove(struct vio_dev *vdev)
 {
 	struct scsi_info *vscsi = dev_get_drvdata(&vdev->dev);
 	list_del(&vscsi->list);
 	spin_unlock_bh(&ibmvscsis_dev_lock);
 	kfree(vscsi);
-	return 0;
 }
 static ssize_t system_id_show(struct device *dev,

drivers/scsi/ufs/ufs-qcom.c+10−0

 {
 	int ret = 0;
 	struct ufs_qcom_host *host = ufshcd_get_variant(hba);
+	bool reenable_intr = false;
 	if (!host->core_reset) {
 		dev_warn(hba->dev, "%s: reset control not set\n", __func__);
 		goto out;
 	}
+	reenable_intr = hba->is_irq_enabled;
+	disable_irq(hba->irq);
+	hba->is_irq_enabled = false;
 	ret = reset_control_assert(host->core_reset);
 	if (ret) {
 		dev_err(hba->dev, "%s: core_reset assert failed, err = %d\n",
 	usleep_range(1000, 1100);
+	if (reenable_intr) {
+		enable_irq(hba->irq);
+		hba->is_irq_enabled = true;
+	}
 out:
 	return ret;
 }

drivers/scsi/ufs/ufshcd.c+13−28

 		       16, 4, buf, __len, false);                        \
 } while (0)
-static bool early_suspend;
 int ufshcd_dump_regs(struct ufs_hba *hba, size_t offset, size_t len,
 		     const char *prefix)
 {
 {
 	struct ufs_hba *hba = dev_get_drvdata(dev);
-	return snprintf(buf, PAGE_SIZE, "%d\n", hba->clk_scaling.is_enabled);
+	return sysfs_emit(buf, "%d\n", hba->clk_scaling.is_enabled);
 }
 static ssize_t ufshcd_clkscale_enable_store(struct device *dev,
 			 * UFS device needs urgent BKOPs.
 			 */
 			if (!hba->pm_op_in_progress &&
+			    !ufshcd_eh_in_progress(hba) &&
 			    ufshcd_is_exception_event(lrbp->ucd_rsp_ptr) &&
 			    schedule_work(&hba->eeh_work)) {
 				/*
 			ufshcd_suspend_clkscaling(hba);
 		ufshcd_clk_scaling_allow(hba, false);
 	}
+	ufshcd_scsi_block_requests(hba);
+	/* Drain ufshcd_queuecommand() */
+	down_write(&hba->clk_scaling_lock);
+	up_write(&hba->clk_scaling_lock);
+	cancel_work_sync(&hba->eeh_work);
 }
 static void ufshcd_err_handling_unprepare(struct ufs_hba *hba)
 {
+	ufshcd_scsi_unblock_requests(hba);
 	ufshcd_release(hba);
 	if (ufshcd_is_clkscaling_supported(hba))
 		ufshcd_clk_scaling_suspend(hba, false);
+	ufshcd_clear_ua_wluns(hba);
 	pm_runtime_put(hba->dev);
 }
 	spin_unlock_irqrestore(hba->host->host_lock, flags);
 	ufshcd_err_handling_prepare(hba);
 	spin_lock_irqsave(hba->host->host_lock, flags);
-	ufshcd_scsi_block_requests(hba);
+	if (hba->ufshcd_state != UFSHCD_STATE_ERROR)
-	hba->ufshcd_state = UFSHCD_STATE_RESET;
+		hba->ufshcd_state = UFSHCD_STATE_RESET;
 	/* Complete requests that have door-bell cleared by h/w */
 	ufshcd_complete_requests(hba);
 	}
 	ufshcd_clear_eh_in_progress(hba);
 	spin_unlock_irqrestore(hba->host->host_lock, flags);
-	ufshcd_scsi_unblock_requests(hba);
 	ufshcd_err_handling_unprepare(hba);
 	up(&hba->host_sem);
-	if (!err && needs_reset)
-		ufshcd_clear_ua_wluns(hba);
 }
 /**
 	unsigned long flags;
 	ktime_t start = ktime_get();
+	hba->ufshcd_state = UFSHCD_STATE_RESET;
 	ret = ufshcd_link_startup(hba);
 	if (ret)
 		goto out;
 	int ret = 0;
 	ktime_t start = ktime_get();
-	if (!hba) {
-		early_suspend = true;
-		return 0;
-	}
 	down(&hba->host_sem);
 	if (!hba->is_powered)
 	int ret = 0;
 	ktime_t start = ktime_get();
-	if (!hba)
-		return -EINVAL;
-	if (unlikely(early_suspend)) {
-		early_suspend = false;
-		down(&hba->host_sem);
-	}
 	if (!hba->is_powered || pm_runtime_suspended(hba->dev))
 		/*
 		 * Let the runtime resume take care of resuming
 	int ret = 0;
 	ktime_t start = ktime_get();
-	if (!hba)
-		return -EINVAL;
 	if (!hba->is_powered)
 		goto out;
 	else
 	int ret = 0;
 	ktime_t start = ktime_get();
-	if (!hba)
-		return -EINVAL;
 	if (!hba->is_powered)
 		goto out;
 	else

drivers/scsi/vmw_pvscsi.c+0−2

@@ -17,8 +17,6 @@ · 16 unmodified lines
17	* along with this program; if not, write to the Free Software	17	* along with this program; if not, write to the Free Software
18	* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.	18	* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
19	*	19	*
20	* Maintained by: Jim Gill <jgill@vmware.com>
21	*
22	*/	20	*/
23		21
24	#include <linux/kernel.h>	22	#include <linux/kernel.h>

drivers/scsi/vmw_pvscsi.h+0−2

@@ -17,8 +17,6 @@ · 16 unmodified lines
17	* along with this program; if not, write to the Free Software	17	* along with this program; if not, write to the Free Software
18	* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.	18	* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
19	*	19	*
20	* Maintained by: Jim Gill <jgill@vmware.com>
21	*
22	*/	20	*/
23		21
24	#ifndef _VMW_PVSCSI_H_	22	#ifndef _VMW_PVSCSI_H_

drivers/staging/comedi/drivers/addi_apci_1032.c+3−1

 	struct apci1032_private *devpriv = dev->private;
 	struct comedi_subdevice *s = dev->read_subdev;
 	unsigned int ctrl;
+	unsigned short val;
 	/* check interrupt is from this device */
 	if ((inl(devpriv->amcc_iobase + AMCC_OP_REG_INTCSR) &
 	outl(ctrl & ~APCI1032_CTRL_INT_ENA, dev->iobase + APCI1032_CTRL_REG);
 	s->state = inl(dev->iobase + APCI1032_STATUS_REG) & 0xffff;
-	comedi_buf_write_samples(s, &s->state, 1);
+	val = s->state;
+	comedi_buf_write_samples(s, &val, 1);
 	comedi_handle_events(dev, s);
 	/* enable the interrupt */

drivers/staging/comedi/drivers/addi_apci_1500.c+9−9

@@ -208,7 +208,7 @@ static irqreturn_t apci1500_interrupt(int irq, void *d) · 207 unmodified lines
208	struct comedi_device *dev = d;	208	struct comedi_device *dev = d;
209	struct apci1500_private *devpriv = dev->private;	209	struct apci1500_private *devpriv = dev->private;
210	struct comedi_subdevice *s = dev->read_subdev;	210	struct comedi_subdevice *s = dev->read_subdev;
211	unsigned int status = 0;	211	unsigned short status = 0;
212	unsigned int val;	212	unsigned int val;
213		213
214	val = inl(devpriv->amcc + AMCC_OP_REG_INTCSR);	214	val = inl(devpriv->amcc + AMCC_OP_REG_INTCSR);
@@ -238,14 +238,14 @@ static irqreturn_t apci1500_interrupt(int irq, void *d) · 23 unmodified lines
238	*	238	*
239	* Mask Meaning	239	* Mask Meaning
240	* ---------- ------------------------------------------	240	* ---------- ------------------------------------------
241	* 0x00000001 Event 1 has occurred	241	* 0b00000001 Event 1 has occurred
242	* 0x00000010 Event 2 has occurred	242	* 0b00000010 Event 2 has occurred
243	* 0x00000100 Counter/timer 1 has run down (not implemented)	243	* 0b00000100 Counter/timer 1 has run down (not implemented)
244	* 0x00001000 Counter/timer 2 has run down (not implemented)	244	* 0b00001000 Counter/timer 2 has run down (not implemented)
245	* 0x00010000 Counter 3 has run down (not implemented)	245	* 0b00010000 Counter 3 has run down (not implemented)
246	* 0x00100000 Watchdog has run down (not implemented)	246	* 0b00100000 Watchdog has run down (not implemented)
247	* 0x01000000 Voltage error	247	* 0b01000000 Voltage error
248	* 0x10000000 Short-circuit error	248	* 0b10000000 Short-circuit error
249	*/	249	*/
250	comedi_buf_write_samples(s, &status, 1);	250	comedi_buf_write_samples(s, &status, 1);
251	comedi_handle_events(dev, s);	251	comedi_handle_events(dev, s);

drivers/staging/comedi/drivers/adv_pci1710.c+5−5

@@ -300,11 +300,11 @@ static int pci1710_ai_eoc(struct comedi_device *dev, · 299 unmodified lines
300	static int pci1710_ai_read_sample(struct comedi_device *dev,	300	static int pci1710_ai_read_sample(struct comedi_device *dev,
301	struct comedi_subdevice *s,	301	struct comedi_subdevice *s,
302	unsigned int cur_chan,	302	unsigned int cur_chan,
303	unsigned int *val)	303	unsigned short *val)
304	{	304	{
305	const struct boardtype *board = dev->board_ptr;	305	const struct boardtype *board = dev->board_ptr;
306	struct pci1710_private *devpriv = dev->private;	306	struct pci1710_private *devpriv = dev->private;
307	unsigned int sample;	307	unsigned short sample;
308	unsigned int chan;	308	unsigned int chan;
309		309
310	sample = inw(dev->iobase + PCI171X_AD_DATA_REG);	310	sample = inw(dev->iobase + PCI171X_AD_DATA_REG);
@@ -345,7 +345,7 @@ static int pci1710_ai_insn_read(struct comedi_device *dev, · 34 unmodified lines
345	pci1710_ai_setup_chanlist(dev, s, &insn->chanspec, 1, 1);	345	pci1710_ai_setup_chanlist(dev, s, &insn->chanspec, 1, 1);
346		346
347	for (i = 0; i < insn->n; i++) {	347	for (i = 0; i < insn->n; i++) {
348	unsigned int val;	348	unsigned short val;
349		349
350	/* start conversion */	350	/* start conversion */
351	outw(0, dev->iobase + PCI171X_SOFTTRG_REG);	351	outw(0, dev->iobase + PCI171X_SOFTTRG_REG);
@@ -395,7 +395,7 @@ static void pci1710_handle_every_sample(struct comedi_device *dev, · 43 unmodified lines
395	{	395	{
396	struct comedi_cmd *cmd = &s->async->cmd;	396	struct comedi_cmd *cmd = &s->async->cmd;
397	unsigned int status;	397	unsigned int status;
398	unsigned int val;	398	unsigned short val;
399	int ret;	399	int ret;
400		400
401	status = inw(dev->iobase + PCI171X_STATUS_REG);	401	status = inw(dev->iobase + PCI171X_STATUS_REG);
@@ -455,7 +455,7 @@ static void pci1710_handle_fifo(struct comedi_device *dev, · 53 unmodified lines
455	}	455	}
456		456
457	for (i = 0; i < devpriv->max_samples; i++) {	457	for (i = 0; i < devpriv->max_samples; i++) {
458	unsigned int val;	458	unsigned short val;
459	int ret;	459	int ret;
460		460
461	ret = pci1710_ai_read_sample(dev, s, s->async->cur_chan, &val);	461	ret = pci1710_ai_read_sample(dev, s, s->async->cur_chan, &val);

drivers/staging/comedi/drivers/amplc_pc236_common.c+3−1

@@ -126,7 +126,9 @@ static irqreturn_t pc236_interrupt(int irq, void *d) · 125 unmodified lines
126		126
127	handled = pc236_intr_check(dev);	127	handled = pc236_intr_check(dev);
128	if (dev->attached && handled) {	128	if (dev->attached && handled) {
129	comedi_buf_write_samples(s, &s->state, 1);	129	unsigned short val = 0;
		130
		131	comedi_buf_write_samples(s, &val, 1);
130	comedi_handle_events(dev, s);	132	comedi_handle_events(dev, s);
131	}	133	}
132	return IRQ_RETVAL(handled);	134	return IRQ_RETVAL(handled);

drivers/staging/comedi/drivers/comedi_parport.c+2−1

 	struct comedi_device *dev = d;
 	struct comedi_subdevice *s = dev->read_subdev;
 	unsigned int ctrl;
+	unsigned short val = 0;
 	ctrl = inb(dev->iobase + PARPORT_CTRL_REG);
 	if (!(ctrl & PARPORT_CTRL_IRQ_ENA))
 		return IRQ_NONE;
-	comedi_buf_write_samples(s, &s->state, 1);
+	comedi_buf_write_samples(s, &val, 1);
 	comedi_handle_events(dev, s);
 	return IRQ_HANDLED;

drivers/staging/comedi/drivers/das6402.c+1−1

@@ -186,7 +186,7 @@ static irqreturn_t das6402_interrupt(int irq, void *d) · 185 unmodified lines
186	if (status & DAS6402_STATUS_FFULL) {	186	if (status & DAS6402_STATUS_FFULL) {
187	async->events \|= COMEDI_CB_OVERFLOW;	187	async->events \|= COMEDI_CB_OVERFLOW;
188	} else if (status & DAS6402_STATUS_FFNE) {	188	} else if (status & DAS6402_STATUS_FFNE) {
189	unsigned int val;	189	unsigned short val;
190		190
191	val = das6402_ai_read_sample(dev, s);	191	val = das6402_ai_read_sample(dev, s);
192	comedi_buf_write_samples(s, &val, 1);	192	comedi_buf_write_samples(s, &val, 1);

drivers/staging/comedi/drivers/das800.c+1−1

@@ -427,7 +427,7 @@ static irqreturn_t das800_interrupt(int irq, void *d) · 426 unmodified lines
427	struct comedi_cmd *cmd;	427	struct comedi_cmd *cmd;
428	unsigned long irq_flags;	428	unsigned long irq_flags;
429	unsigned int status;	429	unsigned int status;
430	unsigned int val;	430	unsigned short val;
431	bool fifo_empty;	431	bool fifo_empty;
432	bool fifo_overflow;	432	bool fifo_overflow;
433	int i;	433	int i;

drivers/staging/comedi/drivers/dmm32at.c+1−1

@@ -404,7 +404,7 @@ static irqreturn_t dmm32at_isr(int irq, void *d) · 403 unmodified lines
404	{	404	{
405	struct comedi_device *dev = d;	405	struct comedi_device *dev = d;
406	unsigned char intstat;	406	unsigned char intstat;
407	unsigned int val;	407	unsigned short val;
408	int i;	408	int i;
409		409
410	if (!dev->attached) {	410	if (!dev->attached) {

drivers/staging/comedi/drivers/me4000.c+1−1

@@ -924,7 +924,7 @@ static irqreturn_t me4000_ai_isr(int irq, void *dev_id) · 923 unmodified lines
924	struct comedi_subdevice *s = dev->read_subdev;	924	struct comedi_subdevice *s = dev->read_subdev;
925	int i;	925	int i;
926	int c = 0;	926	int c = 0;
927	unsigned int lval;	927	unsigned short lval;
928		928
929	if (!dev->attached)	929	if (!dev->attached)
930	return IRQ_NONE;	930	return IRQ_NONE;

drivers/staging/comedi/drivers/ni_6527.c+3−1

@@ -195,7 +195,9 @@ static irqreturn_t ni6527_interrupt(int irq, void *d) · 194 unmodified lines
195	return IRQ_NONE;	195	return IRQ_NONE;
196		196
197	if (status & NI6527_STATUS_EDGE) {	197	if (status & NI6527_STATUS_EDGE) {
198	comedi_buf_write_samples(s, &s->state, 1);	198	unsigned short val = 0;
		199
		200	comedi_buf_write_samples(s, &val, 1);
199	comedi_handle_events(dev, s);	201	comedi_handle_events(dev, s);
200	}	202	}
201		203

drivers/staging/comedi/drivers/ni_65xx.c+2−1

 	struct comedi_device *dev = d;
 	struct comedi_subdevice *s = dev->read_subdev;
 	unsigned int status;
+	unsigned short val = 0;
 	status = readb(dev->mmio + NI_65XX_STATUS_REG);
 	if ((status & NI_65XX_STATUS_INT) == 0)
 	writeb(NI_65XX_CLR_EDGE_INT | NI_65XX_CLR_OVERFLOW_INT,
 	       dev->mmio + NI_65XX_CLR_REG);
-	comedi_buf_write_samples(s, &s->state, 1);
+	comedi_buf_write_samples(s, &val, 1);
 	comedi_handle_events(dev, s);
 	return IRQ_HANDLED;

drivers/staging/comedi/drivers/pcl711.c+1−1

@@ -184,7 +184,7 @@ static irqreturn_t pcl711_interrupt(int irq, void *d) · 183 unmodified lines
184	struct comedi_device *dev = d;	184	struct comedi_device *dev = d;
185	struct comedi_subdevice *s = dev->read_subdev;	185	struct comedi_subdevice *s = dev->read_subdev;
186	struct comedi_cmd *cmd = &s->async->cmd;	186	struct comedi_cmd *cmd = &s->async->cmd;
187	unsigned int data;	187	unsigned short data;
188		188
189	if (!dev->attached) {	189	if (!dev->attached) {
190	dev_err(dev->class_dev, "spurious interrupt\n");	190	dev_err(dev->class_dev, "spurious interrupt\n");

drivers/staging/comedi/drivers/pcl726.c+3−1

@@ -220,9 +220,11 @@ static irqreturn_t pcl726_interrupt(int irq, void *d) · 219 unmodified lines
220	struct pcl726_private *devpriv = dev->private;	220	struct pcl726_private *devpriv = dev->private;
221		221
222	if (devpriv->cmd_running) {	222	if (devpriv->cmd_running) {
		223	unsigned short val = 0;
		224
223	pcl726_intr_cancel(dev, s);	225	pcl726_intr_cancel(dev, s);
224		226
225	comedi_buf_write_samples(s, &s->state, 1);	227	comedi_buf_write_samples(s, &val, 1);
226	comedi_handle_events(dev, s);	228	comedi_handle_events(dev, s);
227	}	229	}
228		230

drivers/staging/comedi/drivers/pcl818.c+1−1

@@ -423,7 +423,7 @@ static int pcl818_ai_eoc(struct comedi_device *dev, · 422 unmodified lines
423		423
424	static bool pcl818_ai_write_sample(struct comedi_device *dev,	424	static bool pcl818_ai_write_sample(struct comedi_device *dev,
425	struct comedi_subdevice *s,	425	struct comedi_subdevice *s,
426	unsigned int chan, unsigned int val)	426	unsigned int chan, unsigned short val)
427	{	427	{
428	struct pcl818_private *devpriv = dev->private;	428	struct pcl818_private *devpriv = dev->private;
429	struct comedi_cmd *cmd = &s->async->cmd;	429	struct comedi_cmd *cmd = &s->async->cmd;

drivers/staging/ks7010/ks_wlan_net.c+4−2

 {
 	struct ks_wlan_private *priv = netdev_priv(dev);
 	struct iw_scan_req *req = NULL;
+	int len;
 	if (priv->sleep_mode == SLP_SLEEP)
 		return -EPERM;
 	if (wrqu->data.length == sizeof(struct iw_scan_req) &&
 	    wrqu->data.flags & IW_SCAN_THIS_ESSID) {
 		req = (struct iw_scan_req *)extra;
-		priv->scan_ssid_len = req->essid_len;
+		len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE);
-		memcpy(priv->scan_ssid, req->essid, priv->scan_ssid_len);
+		priv->scan_ssid_len = len;
+		memcpy(priv->scan_ssid, req->essid, len);
 	} else {
 		priv->scan_ssid_len = 0;
 	}

drivers/staging/rtl8188eu/core/rtw_ap.c+5−0

 	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, WLAN_EID_SSID, &ie_len,
 		       pbss_network->ie_length - _BEACON_IE_OFFSET_);
 	if (p && ie_len > 0) {
+		ie_len = min_t(int, ie_len, sizeof(pbss_network->ssid.ssid));
 		memset(&pbss_network->ssid, 0, sizeof(struct ndis_802_11_ssid));
 		memcpy(pbss_network->ssid.ssid, p + 2, ie_len);
 		pbss_network->ssid.ssid_length = ie_len;
 	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, WLAN_EID_SUPP_RATES, &ie_len,
 		       pbss_network->ie_length - _BEACON_IE_OFFSET_);
 	if (p) {
+		ie_len = min_t(int, ie_len, NDIS_802_11_LENGTH_RATES_EX);
 		memcpy(supportRate, p + 2, ie_len);
 		supportRateNum = ie_len;
 	}
 	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, WLAN_EID_EXT_SUPP_RATES,
 		       &ie_len, pbss_network->ie_length - _BEACON_IE_OFFSET_);
 	if (p) {
+		ie_len = min_t(int, ie_len,
+			       NDIS_802_11_LENGTH_RATES_EX - supportRateNum);
 		memcpy(supportRate + supportRateNum, p + 2, ie_len);
 		supportRateNum += ie_len;
 	}
 		pht_cap->mcs.rx_mask[0] = 0xff;
 		pht_cap->mcs.rx_mask[1] = 0x0;
+		ie_len = min_t(int, ie_len, sizeof(pmlmepriv->htpriv.ht_cap));
 		memcpy(&pmlmepriv->htpriv.ht_cap, p + 2, ie_len);
 	}

drivers/staging/rtl8188eu/os_dep/ioctl_linux.c+4−2

 						break;
 					}
 					sec_len = *(pos++); len -= 1;
-					if (sec_len > 0 && sec_len <= len) {
+					if (sec_len > 0 &&
+					    sec_len <= len &&
+					    sec_len <= 32) {
 						ssid[ssid_index].ssid_length = sec_len;
-						memcpy(ssid[ssid_index].ssid, pos, ssid[ssid_index].ssid_length);
+						memcpy(ssid[ssid_index].ssid, pos, sec_len);
 						ssid_index++;
 					}
 					pos += sec_len;

drivers/staging/rtl8192e/Kconfig+1−0

@@ -27,6 +27,7 @@ config RTLLIB_CRYPTO_CCMP · 26 unmodified lines
27	config RTLLIB_CRYPTO_TKIP	27	config RTLLIB_CRYPTO_TKIP
28	tristate "Support for rtllib TKIP crypto"	28	tristate "Support for rtllib TKIP crypto"
29	depends on RTLLIB	29	depends on RTLLIB
		30	select CRYPTO
30	select CRYPTO_LIB_ARC4	31	select CRYPTO_LIB_ARC4
31	select CRYPTO_MICHAEL_MIC	32	select CRYPTO_MICHAEL_MIC
32	default y	33	default y

drivers/staging/rtl8192e/rtl8192e/rtl_wx.c+4−3

@@ -406,9 +406,10 @@ static int _rtl92e_wx_set_scan(struct net_device *dev, · 405 unmodified lines
406	struct iw_scan_req req = (struct iw_scan_req )b;	406	struct iw_scan_req req = (struct iw_scan_req )b;
407		407
408	if (req->essid_len) {	408	if (req->essid_len) {
409	ieee->current_network.ssid_len = req->essid_len;	409	int len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE);
410	memcpy(ieee->current_network.ssid, req->essid,	410
411	req->essid_len);	411	ieee->current_network.ssid_len = len;
		412	memcpy(ieee->current_network.ssid, req->essid, len);
412	}	413	}
413	}	414	}
414		415

drivers/staging/rtl8192u/r8192U_wx.c+4−2

@@ -331,8 +331,10 @@ static int r8192_wx_set_scan(struct net_device dev, struct iw_request_info a, · 330 unmodified lines
331	struct iw_scan_req req = (struct iw_scan_req )b;	331	struct iw_scan_req req = (struct iw_scan_req )b;
332		332
333	if (req->essid_len) {	333	if (req->essid_len) {
334	ieee->current_network.ssid_len = req->essid_len;	334	int len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE);
335	memcpy(ieee->current_network.ssid, req->essid, req->essid_len);	335
		336	ieee->current_network.ssid_len = len;
		337	memcpy(ieee->current_network.ssid, req->essid, len);
336	}	338	}
337	}	339	}
338		340

drivers/staging/rtl8712/rtl871x_cmd.c+4−2

@@ -192,8 +192,10 @@ u8 r8712_sitesurvey_cmd(struct _adapter *padapter, · 191 unmodified lines
192	psurveyPara->ss_ssidlen = 0;	192	psurveyPara->ss_ssidlen = 0;
193	memset(psurveyPara->ss_ssid, 0, IW_ESSID_MAX_SIZE + 1);	193	memset(psurveyPara->ss_ssid, 0, IW_ESSID_MAX_SIZE + 1);
194	if (pssid && pssid->SsidLength) {	194	if (pssid && pssid->SsidLength) {
195	memcpy(psurveyPara->ss_ssid, pssid->Ssid, pssid->SsidLength);	195	int len = min_t(int, pssid->SsidLength, IW_ESSID_MAX_SIZE);
196	psurveyPara->ss_ssidlen = cpu_to_le32(pssid->SsidLength);	196
		197	memcpy(psurveyPara->ss_ssid, pssid->Ssid, len);
		198	psurveyPara->ss_ssidlen = cpu_to_le32(len);
197	}	199	}
198	set_fwstate(pmlmepriv, _FW_UNDER_SURVEY);	200	set_fwstate(pmlmepriv, _FW_UNDER_SURVEY);
199	r8712_enqueue_cmd(pcmdpriv, ph2c);	201	r8712_enqueue_cmd(pcmdpriv, ph2c);

drivers/staging/rtl8712/rtl871x_ioctl_linux.c+1−1

@@ -924,7 +924,7 @@ static int r871x_wx_set_priv(struct net_device *dev, · 923 unmodified lines
924	struct iw_point dwrq = (struct iw_point )awrq;	924	struct iw_point dwrq = (struct iw_point )awrq;
925		925
926	len = dwrq->length;	926	len = dwrq->length;
927	ext = memdup_user(dwrq->pointer, len);	927	ext = strndup_user(dwrq->pointer, len);
928	if (IS_ERR(ext))	928	if (IS_ERR(ext))
929	return PTR_ERR(ext);	929	return PTR_ERR(ext);
930		930

drivers/staging/wfx/bh.c+1−0

@@ -5,6 +5,7 @@ · 4 unmodified lines
5	* Copyright (c) 2017-2020, Silicon Laboratories, Inc.	5	* Copyright (c) 2017-2020, Silicon Laboratories, Inc.
6	* Copyright (c) 2010, ST-Ericsson	6	* Copyright (c) 2010, ST-Ericsson
7	*/	7	*/
		8	#include <linux/gpio/consumer.h>
8	#include <net/mac80211.h>	9	#include <net/mac80211.h>
9		10
10	#include "bh.h"	11	#include "bh.h"

drivers/staging/wfx/bh.h+4−0

@@ -8,6 +8,10 @@ · 7 unmodified lines
8	#ifndef WFX_BH_H	8	#ifndef WFX_BH_H
9	#define WFX_BH_H	9	#define WFX_BH_H
10		10
		11	#include <linux/atomic.h>
		12	#include <linux/wait.h>
		13	#include <linux/workqueue.h>
		14
11	struct wfx_dev;	15	struct wfx_dev;
12		16
13	struct wfx_hif {	17	struct wfx_hif {

drivers/staging/wfx/bus.h+3−0

@@ -8,6 +8,9 @@ · 7 unmodified lines
8	#ifndef WFX_BUS_H	8	#ifndef WFX_BUS_H
9	#define WFX_BUS_H	9	#define WFX_BUS_H
10		10
		11	#include <linux/mmc/sdio_func.h>
		12	#include <linux/spi/spi.h>
		13
11	#define WFX_REG_CONFIG 0x0	14	#define WFX_REG_CONFIG 0x0
12	#define WFX_REG_CONTROL 0x1	15	#define WFX_REG_CONTROL 0x1
13	#define WFX_REG_IN_OUT_QUEUE 0x2	16	#define WFX_REG_IN_OUT_QUEUE 0x2

drivers/staging/wfx/bus_sdio.c+6−0

  * Copyright (c) 2017-2020, Silicon Laboratories, Inc.
  * Copyright (c) 2010, ST-Ericsson
  */
+#include <linux/module.h>
 #include <linux/mmc/sdio.h>
 #include <linux/mmc/sdio_func.h>
 #include <linux/mmc/card.h>
+#include <linux/interrupt.h>
 #include <linux/of_irq.h>
+#include <linux/irq.h>
 #include "bus.h"
 #include "wfx.h"
+#include "hwio.h"
+#include "main.h"
+#include "bh.h"
 static const struct wfx_platform_data wfx_sdio_pdata = {
 	.file_fw = "wfm_wf200",

drivers/staging/wfx/bus_spi.c+7−0

  * Copyright (c) 2011, Sagrad Inc.
  * Copyright (c) 2010, ST-Ericsson
  */
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/gpio/consumer.h>
 #include <linux/spi/spi.h>
+#include <linux/interrupt.h>
 #include <linux/irq.h>
 #include <linux/of.h>
 #include "bus.h"
 #include "wfx.h"
+#include "hwio.h"
+#include "main.h"
+#include "bh.h"
 #define SET_WRITE 0x7FFF        /* usage: and operation */
 #define SET_READ 0x8000         /* usage: or operation */

drivers/staging/wfx/data_rx.c+5−0

  * Copyright (c) 2017-2020, Silicon Laboratories, Inc.
  * Copyright (c) 2010, ST-Ericsson
  */
+#include <linux/etherdevice.h>
+#include <net/mac80211.h>
 #include "data_rx.h"
 #include "wfx.h"
+#include "bh.h"
+#include "sta.h"
 static void wfx_rx_handle_ba(struct wfx_vif *wvif, struct ieee80211_mgmt *mgmt)
 {

drivers/staging/wfx/data_tx.c+5−0

  * Copyright (c) 2010, ST-Ericsson
  */
 #include <net/mac80211.h>
+#include <linux/etherdevice.h>
+#include "data_tx.h"
 #include "wfx.h"
+#include "bh.h"
 #include "sta.h"
+#include "queue.h"
+#include "debug.h"
 #include "traces.h"
 #include "hif_tx_mib.h"

drivers/staging/wfx/data_tx.h+3−0

@@ -8,6 +8,9 @@ · 7 unmodified lines
8	#ifndef WFX_DATA_TX_H	8	#ifndef WFX_DATA_TX_H
9	#define WFX_DATA_TX_H	9	#define WFX_DATA_TX_H
10		10
		11	#include <linux/list.h>
		12	#include <net/mac80211.h>
		13
11	#include "hif_api_cmd.h"	14	#include "hif_api_cmd.h"
12	#include "hif_api_mib.h"	15	#include "hif_api_mib.h"
13		16

drivers/staging/wfx/debug.c+6−0

  * Copyright (c) 2017-2020, Silicon Laboratories, Inc.
  * Copyright (c) 2010, ST-Ericsson
  */
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+#include <linux/crc32.h>
 #include "debug.h"
 #include "wfx.h"
 #include "sta.h"
+#include "main.h"
+#include "hif_tx.h"
 #include "hif_tx_mib.h"
 #define CREATE_TRACE_POINTS

drivers/staging/wfx/fwio.c+2−0

@@ -6,6 +6,8 @@ · 5 unmodified lines
6	* Copyright (c) 2010, ST-Ericsson	6	* Copyright (c) 2010, ST-Ericsson
7	*/	7	*/
8	#include <linux/firmware.h>	8	#include <linux/firmware.h>
		9	#include <linux/slab.h>
		10	#include <linux/mm.h>
9	#include <linux/bitfield.h>	11	#include <linux/bitfield.h>
10		12
11	#include "fwio.h"	13	#include "fwio.h"

drivers/staging/wfx/hif_api_cmd.h+4−0

@@ -8,6 +8,10 @@ · 7 unmodified lines
8	#ifndef WFX_HIF_API_CMD_H	8	#ifndef WFX_HIF_API_CMD_H
9	#define WFX_HIF_API_CMD_H	9	#define WFX_HIF_API_CMD_H
10		10
		11	#include <linux/ieee80211.h>
		12
		13	#include "hif_api_general.h"
		14
11	enum hif_requests_ids {	15	enum hif_requests_ids {
12	HIF_REQ_ID_RESET = 0x0a,	16	HIF_REQ_ID_RESET = 0x0a,
13	HIF_REQ_ID_READ_MIB = 0x05,	17	HIF_REQ_ID_READ_MIB = 0x05,

drivers/staging/wfx/hif_api_general.h+9−0

@@ -8,6 +8,15 @@ · 7 unmodified lines
8	#ifndef WFX_HIF_API_GENERAL_H	8	#ifndef WFX_HIF_API_GENERAL_H
9	#define WFX_HIF_API_GENERAL_H	9	#define WFX_HIF_API_GENERAL_H
10		10
		11	#ifdef __KERNEL__
		12	#include <linux/types.h>
		13	#include <linux/if_ether.h>
		14	#else
		15	#include <net/ethernet.h>
		16	#include <stdint.h>
		17	#define __packed __attribute__((__packed__))
		18	#endif
		19
11	#define HIF_ID_IS_INDICATION 0x80	20	#define HIF_ID_IS_INDICATION 0x80
12	#define HIF_COUNTER_MAX 7	21	#define HIF_COUNTER_MAX 7
13		22

drivers/staging/wfx/hif_tx.c+4−0

  * Copyright (c) 2017-2020, Silicon Laboratories, Inc.
  * Copyright (c) 2010, ST-Ericsson
  */
+#include <linux/etherdevice.h>
+#include "hif_tx.h"
 #include "wfx.h"
+#include "bh.h"
 #include "hwio.h"
 #include "debug.h"
 #include "sta.h"

drivers/staging/wfx/hif_tx_mib.c+5−0

  * Copyright (c) 2010, ST-Ericsson
  * Copyright (C) 2010, ST-Ericsson SA
  */
+#include <linux/etherdevice.h>
 #include "wfx.h"
+#include "hif_tx.h"
 #include "hif_tx_mib.h"
+#include "hif_api_mib.h"
 int hif_set_output_power(struct wfx_vif *wvif, int val)
 {

drivers/staging/wfx/hwio.c+3−0

  * Copyright (c) 2017-2020, Silicon Laboratories, Inc.
  * Copyright (c) 2010, ST-Ericsson
  */
+#include <linux/kernel.h>
+#include <linux/delay.h>
 #include <linux/slab.h>
 #include "hwio.h"
 #include "wfx.h"
+#include "bus.h"
 #include "traces.h"
 /*

drivers/staging/wfx/hwio.h+2−0

@@ -8,6 +8,8 @@ · 7 unmodified lines
8	#ifndef WFX_HWIO_H	8	#ifndef WFX_HWIO_H
9	#define WFX_HWIO_H	9	#define WFX_HWIO_H
10		10
		11	#include <linux/types.h>
		12
11	struct wfx_dev;	13	struct wfx_dev;
12		14
13	int wfx_data_read(struct wfx_dev wdev, void buf, size_t buf_len);	15	int wfx_data_read(struct wfx_dev wdev, void buf, size_t buf_len);

drivers/staging/wfx/key.c+2−0

  * Copyright (c) 2017-2020, Silicon Laboratories, Inc.
  * Copyright (c) 2010, ST-Ericsson
  */
+#include <linux/etherdevice.h>
 #include <net/mac80211.h>
 #include "key.h"
 #include "wfx.h"
+#include "hif_tx_mib.h"
 static int wfx_alloc_key(struct wfx_dev *wdev)
 {

drivers/staging/wfx/key.h+2−0

@@ -8,6 +8,8 @@ · 7 unmodified lines
8	#ifndef WFX_KEY_H	8	#ifndef WFX_KEY_H
9	#define WFX_KEY_H	9	#define WFX_KEY_H
10		10
		11	#include <net/mac80211.h>
		12
11	struct wfx_dev;	13	struct wfx_dev;
12	struct wfx_vif;	14	struct wfx_vif;
13		15

drivers/staging/wfx/main.c+7−0

  * Copyright (c) 2006, Michael Wu <flamingice@sourmilk.net>
  * Copyright (c) 2004-2006 Jean-Baptiste Note <jbnote@gmail.com>, et al.
  */
+#include <linux/module.h>
 #include <linux/of.h>
 #include <linux/of_net.h>
+#include <linux/gpio/consumer.h>
 #include <linux/mmc/sdio_func.h>
 #include <linux/spi/spi.h>
+#include <linux/etherdevice.h>
 #include <linux/firmware.h>
+#include "main.h"
 #include "wfx.h"
 #include "fwio.h"
 #include "hwio.h"
 #include "bus.h"
+#include "bh.h"
 #include "sta.h"
 #include "key.h"
 #include "scan.h"
 #include "debug.h"
+#include "data_tx.h"
 #include "hif_tx_mib.h"
+#include "hif_api_cmd.h"
 #define WFX_PDS_MAX_SIZE 1500

drivers/staging/wfx/main.h+3−0

@@ -10,8 +10,11 @@ · 9 unmodified lines
10	#ifndef WFX_MAIN_H	10	#ifndef WFX_MAIN_H
11	#define WFX_MAIN_H	11	#define WFX_MAIN_H
12		12
		13	#include <linux/device.h>
13	#include <linux/gpio/consumer.h>	14	#include <linux/gpio/consumer.h>
14		15
		16	#include "hif_api_general.h"
		17
15	struct wfx_dev;	18	struct wfx_dev;
16	struct hwbus_ops;	19	struct hwbus_ops;
17		20

drivers/staging/wfx/queue.c+4−0

  * Copyright (c) 2017-2020, Silicon Laboratories, Inc.
  * Copyright (c) 2010, ST-Ericsson
  */
+#include <linux/sched.h>
 #include <net/mac80211.h>
+#include "queue.h"
 #include "wfx.h"
+#include "sta.h"
+#include "data_tx.h"
 #include "traces.h"
 void wfx_tx_lock(struct wfx_dev *wdev)

drivers/staging/wfx/queue.h+3−0

@@ -8,6 +8,9 @@ · 7 unmodified lines
8	#ifndef WFX_QUEUE_H	8	#ifndef WFX_QUEUE_H
9	#define WFX_QUEUE_H	9	#define WFX_QUEUE_H
10		10
		11	#include <linux/skbuff.h>
		12	#include <linux/atomic.h>
		13
11	struct wfx_dev;	14	struct wfx_dev;
12	struct wfx_vif;	15	struct wfx_vif;
13		16

drivers/staging/wfx/scan.h+2−0

@@ -8,6 +8,8 @@ · 7 unmodified lines
8	#ifndef WFX_SCAN_H	8	#ifndef WFX_SCAN_H
9	#define WFX_SCAN_H	9	#define WFX_SCAN_H
10		10
		11	#include <net/mac80211.h>
		12
11	struct wfx_dev;	13	struct wfx_dev;
12	struct wfx_vif;	14	struct wfx_vif;
13		15

drivers/staging/wfx/sta.c+6−0

  * Copyright (c) 2017-2020, Silicon Laboratories, Inc.
  * Copyright (c) 2010, ST-Ericsson
  */
+#include <linux/etherdevice.h>
 #include <net/mac80211.h>
 #include "sta.h"
 #include "wfx.h"
+#include "fwio.h"
+#include "bh.h"
+#include "key.h"
 #include "scan.h"
+#include "debug.h"
+#include "hif_tx.h"
 #include "hif_tx_mib.h"
 #define HIF_MAX_ARP_IP_ADDRTABLE_ENTRIES 2

drivers/staging/wfx/sta.h+2−0

@@ -8,6 +8,8 @@ · 7 unmodified lines
8	#ifndef WFX_STA_H	8	#ifndef WFX_STA_H
9	#define WFX_STA_H	9	#define WFX_STA_H
10		10
		11	#include <net/mac80211.h>
		12
11	struct wfx_dev;	13	struct wfx_dev;
12	struct wfx_vif;	14	struct wfx_vif;
13		15

drivers/staging/wfx/traces.h+3−0

 #define _WFX_TRACE_H
 #include <linux/tracepoint.h>
+#include <net/mac80211.h>
 #include "bus.h"
+#include "hif_api_cmd.h"
+#include "hif_api_mib.h"
 /* The hell below need some explanations. For each symbolic number, we need to
  * define it with TRACE_DEFINE_ENUM() and in a list for __print_symbolic.

drivers/staging/wfx/wfx.h+3−0

@@ -10,6 +10,9 @@ · 9 unmodified lines
10	#ifndef WFX_H	10	#ifndef WFX_H
11	#define WFX_H	11	#define WFX_H
12		12
		13	#include <linux/completion.h>
		14	#include <linux/workqueue.h>
		15	#include <linux/mutex.h>
13	#include <linux/nospec.h>	16	#include <linux/nospec.h>
14	#include <net/mac80211.h>	17	#include <net/mac80211.h>
15		18

drivers/tty/hvc/hvcs.c+1−3

 static int hvcs_probe(struct vio_dev *dev,
 		const struct vio_device_id *id);
-static int hvcs_remove(struct vio_dev *dev);
 static int __init hvcs_module_init(void);
 static void __exit hvcs_module_exit(void);
 static int hvcs_initialize(void);
 	return 0;
 }
-static int hvcs_remove(struct vio_dev *dev)
+static void hvcs_remove(struct vio_dev *dev)
 {
 	struct hvcs_struct *hvcsd = dev_get_drvdata(&dev->dev);
 	unsigned long flags;
 	printk(KERN_INFO "HVCS: vty-server@%X removed from the"
 			" vio bus.\n", dev->unit_address);
-	return 0;
 };
 static struct vio_driver hvcs_vio_driver = {

drivers/tty/pty.c+2−13

@@ -66,8 +66,7 @@ static void pty_close(struct tty_struct tty, struct file filp) · 65 unmodified lines
66	wake_up_interruptible(&tty->link->read_wait);	66	wake_up_interruptible(&tty->link->read_wait);
67	wake_up_interruptible(&tty->link->write_wait);	67	wake_up_interruptible(&tty->link->write_wait);
68	if (tty->driver->subtype == PTY_TYPE_MASTER) {	68	if (tty->driver->subtype == PTY_TYPE_MASTER) {
69	struct file *f;	69	set_bit(TTY_OTHER_CLOSED, &tty->flags);
70
71	#ifdef CONFIG_UNIX98_PTYS	70	#ifdef CONFIG_UNIX98_PTYS
72	if (tty->driver == ptm_driver) {	71	if (tty->driver == ptm_driver) {
73	mutex_lock(&devpts_mutex);	72	mutex_lock(&devpts_mutex);
@@ -76,17 +75,7 @@ static void pty_close(struct tty_struct tty, struct file filp) · 2 unmodified lines
76	mutex_unlock(&devpts_mutex);	75	mutex_unlock(&devpts_mutex);
77	}	76	}
78	#endif	77	#endif
79		78	tty_vhangup(tty->link);
80	/*
81	* This hack is required because a program can open a
82	* pty and redirect a console to it, but if the pty is
83	* closed and the console is not released, then the
84	* slave side will never close. So release the
85	* redirect when the master closes.
86	*/
87	f = tty_release_redirect(tty->link);
88	if (f)
89	fput(f);
90	}	79	}
91	}	80	}
92		81

drivers/tty/serial/max310x.c+5−24

@@ -1056,9 +1056,9 @@ static int max310x_startup(struct uart_port *port) · 1055 unmodified lines
1056	max310x_port_update(port, MAX310X_MODE1_REG,	1056	max310x_port_update(port, MAX310X_MODE1_REG,
1057	MAX310X_MODE1_TRNSCVCTRL_BIT, 0);	1057	MAX310X_MODE1_TRNSCVCTRL_BIT, 0);
1058		1058
1059	/* Reset FIFOs */	1059	/* Configure MODE2 register & Reset FIFOs*/
1060	max310x_port_write(port, MAX310X_MODE2_REG,	1060	val = MAX310X_MODE2_RXEMPTINV_BIT \| MAX310X_MODE2_FIFORST_BIT;
1061	MAX310X_MODE2_FIFORST_BIT);	1061	max310x_port_write(port, MAX310X_MODE2_REG, val);
1062	max310x_port_update(port, MAX310X_MODE2_REG,	1062	max310x_port_update(port, MAX310X_MODE2_REG,
1063	MAX310X_MODE2_FIFORST_BIT, 0);	1063	MAX310X_MODE2_FIFORST_BIT, 0);
1064		1064
@@ -1086,27 +1086,8 @@ static int max310x_startup(struct uart_port *port) · 21 unmodified lines
1086	/* Clear IRQ status register */	1086	/* Clear IRQ status register */
1087	max310x_port_read(port, MAX310X_IRQSTS_REG);	1087	max310x_port_read(port, MAX310X_IRQSTS_REG);
1088		1088
1089	/*	1089	/* Enable RX, TX, CTS change interrupts */
1090	* Let's ask for an interrupt after a timeout equivalent to	1090	val = MAX310X_IRQ_RXEMPTY_BIT \| MAX310X_IRQ_TXEMPTY_BIT;
1091	* the receiving time of 4 characters after the last character
1092	* has been received.
1093	*/
1094	max310x_port_write(port, MAX310X_RXTO_REG, 4);
1095
1096	/*
1097	* Make sure we also get RX interrupts when the RX FIFO is
1098	* filling up quickly, so get an interrupt when half of the RX
1099	* FIFO has been filled in.
1100	*/
1101	max310x_port_write(port, MAX310X_FIFOTRIGLVL_REG,
1102	MAX310X_FIFOTRIGLVL_RX(MAX310X_FIFO_SIZE / 2));
1103
1104	/* Enable RX timeout interrupt in LSR */
1105	max310x_port_write(port, MAX310X_LSR_IRQEN_REG,
1106	MAX310X_LSR_RXTO_BIT);
1107
1108	/* Enable LSR, RX FIFO trigger, CTS change interrupts */
1109	val = MAX310X_IRQ_LSR_BIT \| MAX310X_IRQ_RXFIFO_BIT \| MAX310X_IRQ_TXEMPTY_BIT;
1110	max310x_port_write(port, MAX310X_IRQEN_REG, val \| MAX310X_IRQ_CTS_BIT);	1091	max310x_port_write(port, MAX310X_IRQEN_REG, val \| MAX310X_IRQ_CTS_BIT);
1111		1092
1112	return 0;	1093	return 0;

drivers/tty/tty_io.c+2−3

  *	@tty: tty device
  *
  *	This is available to the pty code so if the master closes, if the
- *	slave is a redirect it can release the redirect.  It returns the
+ *	slave is a redirect it can release the redirect.
- *	filp for the redirect, which must be fput when the operations on
- *	the tty are completed.
  */
 struct file *tty_release_redirect(struct tty_struct *tty)
 {
 	return f;
 }
+EXPORT_SYMBOL_GPL(tty_release_redirect);
 /**
  *	__tty_hangup		-	actual handler for hangup events

drivers/usb/class/cdc-acm.c+5−0

 	.driver_info = SEND_ZERO_PACKET,
 	},
+	/* Exclude Goodix Fingerprint Reader */
+	{ USB_DEVICE(0x27c6, 0x5395),
+	.driver_info = IGNORE_DEVICE,
+	},
 	/* control interfaces without any protocol set */
 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
 		USB_CDC_PROTO_NONE) },

drivers/usb/class/usblp.c+12−4

 /* No kernel lock - fine */
 static __poll_t usblp_poll(struct file *file, struct poll_table_struct *wait)
 {
-	__poll_t ret;
+	struct usblp *usblp = file->private_data;
+	__poll_t ret = 0;
 	unsigned long flags;
-	struct usblp *usblp = file->private_data;
 	/* Should we check file->f_mode & FMODE_WRITE before poll_wait()? */
 	poll_wait(file, &usblp->rwait, wait);
 	poll_wait(file, &usblp->wwait, wait);
+	mutex_lock(&usblp->mut);
+	if (!usblp->present)
+		ret |= EPOLLHUP;
+	mutex_unlock(&usblp->mut);
 	spin_lock_irqsave(&usblp->lock, flags);
-	ret = ((usblp->bidir && usblp->rcomplete) ? EPOLLIN  | EPOLLRDNORM : 0) |
+	if (usblp->bidir && usblp->rcomplete)
-	   ((usblp->no_paper || usblp->wcomplete) ? EPOLLOUT | EPOLLWRNORM : 0);
+		ret |= EPOLLIN  | EPOLLRDNORM;
+	if (usblp->no_paper || usblp->wcomplete)
+		ret |= EPOLLOUT | EPOLLWRNORM;
 	spin_unlock_irqrestore(&usblp->lock, flags);
 	return ret;
 }

drivers/usb/core/usb.c+32−0

@@ -748,6 +748,38 @@ void usb_put_intf(struct usb_interface *intf) · 747 unmodified lines
748	}	748	}
749	EXPORT_SYMBOL_GPL(usb_put_intf);	749	EXPORT_SYMBOL_GPL(usb_put_intf);
750		750
		751	/**
		752	* usb_intf_get_dma_device - acquire a reference on the usb interface's DMA endpoint
		753	* @intf: the usb interface
		754	*
		755	* While a USB device cannot perform DMA operations by itself, many USB
		756	* controllers can. A call to usb_intf_get_dma_device() returns the DMA endpoint
		757	* for the given USB interface, if any. The returned device structure must be
		758	* released with put_device().
		759	*
		760	* See also usb_get_dma_device().
		761	*
		762	* Returns: A reference to the usb interface's DMA endpoint; or NULL if none
		763	* exists.
		764	*/
		765	struct device usb_intf_get_dma_device(struct usb_interface intf)
		766	{
		767	struct usb_device *udev = interface_to_usbdev(intf);
		768	struct device *dmadev;
		769
		770	if (!udev->bus)
		771	return NULL;
		772
		773	dmadev = get_device(udev->bus->sysdev);
		774	if (!dmadev \|\| !dmadev->dma_mask) {
		775	put_device(dmadev);
		776	return NULL;
		777	}
		778
		779	return dmadev;
		780	}
		781	EXPORT_SYMBOL_GPL(usb_intf_get_dma_device);
		782
751	/* USB device locking	783	/* USB device locking
752	*	784	*
753	* USB devices and interfaces are locked using the semaphore in their	785	* USB devices and interfaces are locked using the semaphore in their

drivers/usb/dwc3/dwc3-qcom.c+13−5

 	if (ret)
 		dev_warn(qcom->dev, "failed to disable interconnect: %d\n", ret);
+	if (device_may_wakeup(qcom->dev))
+		dwc3_qcom_enable_interrupts(qcom);
 	qcom->is_suspended = true;
-	dwc3_qcom_enable_interrupts(qcom);
 	return 0;
 }
 	if (!qcom->is_suspended)
 		return 0;
-	dwc3_qcom_disable_interrupts(qcom);
+	if (device_may_wakeup(qcom->dev))
+		dwc3_qcom_disable_interrupts(qcom);
 	for (i = 0; i < qcom->num_clocks; i++) {
 		ret = clk_prepare_enable(qcom->clks[i]);
 	ret = of_platform_populate(np, NULL, NULL, dev);
 	if (ret) {
 		dev_err(dev, "failed to register dwc3 core - %d\n", ret);
-		return ret;
+		goto node_put;
 	}
 	qcom->dwc3 = of_find_device_by_node(dwc3_np);
 	if (!qcom->dwc3) {
+		ret = -ENODEV;
 		dev_err(dev, "failed to get dwc3 platform device\n");
-		return -ENODEV;
 	}
-	return 0;
+node_put:
+	of_node_put(dwc3_np);
+	return ret;
 }
 static struct platform_device *
 static const struct acpi_device_id dwc3_qcom_acpi_match[] = {
 	{ "QCOM2430", (unsigned long)&sdm845_acpi_pdata },
 	{ "QCOM0304", (unsigned long)&sdm845_acpi_urs_pdata },
+	{ "QCOM0497", (unsigned long)&sdm845_acpi_urs_pdata },
+	{ "QCOM04A6", (unsigned long)&sdm845_acpi_pdata },
 	{ },
 };
 MODULE_DEVICE_TABLE(acpi, dwc3_qcom_acpi_match);

drivers/usb/gadget/function/f_uac1.c+1−0

@@ -499,6 +499,7 @@ static void f_audio_disable(struct usb_function *f) · 498 unmodified lines
499	uac1->as_out_alt = 0;	499	uac1->as_out_alt = 0;
500	uac1->as_in_alt = 0;	500	uac1->as_in_alt = 0;
501		501
		502	u_audio_stop_playback(&uac1->g_audio);
502	u_audio_stop_capture(&uac1->g_audio);	503	u_audio_stop_capture(&uac1->g_audio);
503	}	504	}
504		505

drivers/usb/gadget/function/f_uac2.c+1−1

@@ -478,7 +478,7 @@ static int set_ep_max_packet_size(const struct f_uac2_opts *uac2_opts, · 477 unmodified lines
478	}	478	}
479		479
480	max_size_bw = num_channels(chmask) * ssize *	480	max_size_bw = num_channels(chmask) * ssize *
481	DIV_ROUND_UP(srate, factor / (1 << (ep_desc->bInterval - 1)));	481	((srate / (factor / (1 << (ep_desc->bInterval - 1)))) + 1);
482	ep_desc->wMaxPacketSize = cpu_to_le16(min_t(u16, max_size_bw,	482	ep_desc->wMaxPacketSize = cpu_to_le16(min_t(u16, max_size_bw,
483	max_size_ep));	483	max_size_ep));
484		484

drivers/usb/gadget/function/u_ether_configfs.h+2−3

 						size_t len)		\
 	{								\
 		struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item);	\
-		int ret;						\
+		int ret = -EINVAL;					\
 		u8 val;							\
 									\
 		mutex_lock(&opts->lock);				\
-		ret = sscanf(page, "%02hhx", &val);			\
+		if (sscanf(page, "%02hhx", &val) > 0) {			\
-		if (ret > 0) {						\
 			opts->_n_ = val;				\
 			ret = len;					\
 		}							\

drivers/usb/gadget/udc/s3c2410_udc.c+2−2

@@ -1773,8 +1773,8 @@ static int s3c2410_udc_probe(struct platform_device *pdev) · 1772 unmodified lines
1773	udc_info = dev_get_platdata(&pdev->dev);	1773	udc_info = dev_get_platdata(&pdev->dev);
1774		1774
1775	base_addr = devm_platform_ioremap_resource(pdev, 0);	1775	base_addr = devm_platform_ioremap_resource(pdev, 0);
1776	if (!base_addr) {	1776	if (IS_ERR(base_addr)) {
1777	retval = -ENOMEM;	1777	retval = PTR_ERR(base_addr);
1778	goto err_mem;	1778	goto err_mem;
1779	}	1779	}
1780		1780

drivers/usb/host/xhci-pci.c+11−2

 #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI		0x1142
 #define PCI_DEVICE_ID_ASMEDIA_1142_XHCI			0x1242
 #define PCI_DEVICE_ID_ASMEDIA_2142_XHCI			0x2142
+#define PCI_DEVICE_ID_ASMEDIA_3242_XHCI			0x3242
 static const char hcd_name[] = "xhci_hcd";
 		pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI)
 		xhci->quirks |= XHCI_BROKEN_STREAMS;
 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
-		pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI)
+		pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI) {
 		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+		xhci->quirks |= XHCI_NO_64BIT_SUPPORT;
+	}
 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
 	    (pdev->device == PCI_DEVICE_ID_ASMEDIA_1142_XHCI ||
-	     pdev->device == PCI_DEVICE_ID_ASMEDIA_2142_XHCI))
+	     pdev->device == PCI_DEVICE_ID_ASMEDIA_2142_XHCI ||
+	     pdev->device == PCI_DEVICE_ID_ASMEDIA_3242_XHCI))
 		xhci->quirks |= XHCI_NO_64BIT_SUPPORT;
 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
 	     pdev->device == 0x9026)
 		xhci->quirks |= XHCI_RESET_PLL_ON_DISCONNECT;
+	if (pdev->vendor == PCI_VENDOR_ID_AMD &&
+	    (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_2 ||
+	     pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4))
+		xhci->quirks |= XHCI_NO_SOFT_RETRY;
 	if (xhci->quirks & XHCI_RESET_ON_RESUME)
 		xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
 				"QUIRK: Resetting on resume");

drivers/usb/host/xhci-ring.c+2−1

@@ -2484,7 +2484,8 @@ static int process_bulk_intr_td(struct xhci_hcd xhci, struct xhci_td td, · 2483 unmodified lines
2484	remaining = 0;	2484	remaining = 0;
2485	break;	2485	break;
2486	case COMP_USB_TRANSACTION_ERROR:	2486	case COMP_USB_TRANSACTION_ERROR:
2487	if ((ep_ring->err_count++ > MAX_SOFT_RETRY) \|\|	2487	if (xhci->quirks & XHCI_NO_SOFT_RETRY \|\|
		2488	(ep_ring->err_count++ > MAX_SOFT_RETRY) \|\|
2488	le32_to_cpu(slot_ctx->tt_info) & TT_SLOT)	2489	le32_to_cpu(slot_ctx->tt_info) & TT_SLOT)
2489	break;	2490	break;
2490		2491

drivers/usb/host/xhci.c+43−35

@@ -883,44 +883,42 @@ static void xhci_clear_command_ring(struct xhci_hcd *xhci) · 882 unmodified lines
883	xhci_set_cmd_ring_deq(xhci);	883	xhci_set_cmd_ring_deq(xhci);
884	}	884	}
885		885
886	static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci)	886	/*
		887	* Disable port wake bits if do_wakeup is not set.
		888	*
		889	* Also clear a possible internal port wake state left hanging for ports that
		890	* detected termination but never successfully enumerated (trained to 0U).
		891	* Internal wake causes immediate xHCI wake after suspend. PORT_CSC write done
		892	* at enumeration clears this wake, force one here as well for unconnected ports
		893	*/
		894
		895	static void xhci_disable_hub_port_wake(struct xhci_hcd *xhci,
		896	struct xhci_hub *rhub,
		897	bool do_wakeup)
887	{	898	{
888	struct xhci_port **ports;
889	int port_index;
890	unsigned long flags;	899	unsigned long flags;
891	u32 t1, t2, portsc;	900	u32 t1, t2, portsc;
		901	int i;
892		902
893	spin_lock_irqsave(&xhci->lock, flags);	903	spin_lock_irqsave(&xhci->lock, flags);
894		904
895	/* disable usb3 ports Wake bits */	905	for (i = 0; i < rhub->num_ports; i++) {
896	port_index = xhci->usb3_rhub.num_ports;	906	portsc = readl(rhub->ports[i]->addr);
897	ports = xhci->usb3_rhub.ports;	907	t1 = xhci_port_state_to_neutral(portsc);
898	while (port_index--) {	908	t2 = t1;
899	t1 = readl(ports[port_index]->addr);	909
900	portsc = t1;	910	/* clear wake bits if do_wake is not set */
901	t1 = xhci_port_state_to_neutral(t1);	911	if (!do_wakeup)
902	t2 = t1 & ~PORT_WAKE_BITS;	912	t2 &= ~PORT_WAKE_BITS;
903	if (t1 != t2) {	913
904	writel(t2, ports[port_index]->addr);	914	/* Don't touch csc bit if connected or connect change is set */
905	xhci_dbg(xhci, "disable wake bits port %d-%d, portsc: 0x%x, write: 0x%x\n",	915	if (!(portsc & (PORT_CSC \| PORT_CONNECT)))
906	xhci->usb3_rhub.hcd->self.busnum,	916	t2 \|= PORT_CSC;
907	port_index + 1, portsc, t2);
908	}
909	}
910		917
911	/* disable usb2 ports Wake bits */
912	port_index = xhci->usb2_rhub.num_ports;
913	ports = xhci->usb2_rhub.ports;
914	while (port_index--) {
915	t1 = readl(ports[port_index]->addr);
916	portsc = t1;
917	t1 = xhci_port_state_to_neutral(t1);
918	t2 = t1 & ~PORT_WAKE_BITS;
919	if (t1 != t2) {	918	if (t1 != t2) {
920	writel(t2, ports[port_index]->addr);	919	writel(t2, rhub->ports[i]->addr);
921	xhci_dbg(xhci, "disable wake bits port %d-%d, portsc: 0x%x, write: 0x%x\n",	920	xhci_dbg(xhci, "config port %d-%d wake bits, portsc: 0x%x, write: 0x%x\n",
922	xhci->usb2_rhub.hcd->self.busnum,	921	rhub->hcd->self.busnum, i + 1, portsc, t2);
923	port_index + 1, portsc, t2);
924	}	922	}
925	}	923	}
926	spin_unlock_irqrestore(&xhci->lock, flags);	924	spin_unlock_irqrestore(&xhci->lock, flags);
@@ -983,8 +981,8 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup) · 56 unmodified lines
983	return -EINVAL;	981	return -EINVAL;
984		982
985	/* Clear root port wake on bits if wakeup not allowed. */	983	/* Clear root port wake on bits if wakeup not allowed. */
986	if (!do_wakeup)	984	xhci_disable_hub_port_wake(xhci, &xhci->usb3_rhub, do_wakeup);
987	xhci_disable_port_wake_on_bits(xhci);	985	xhci_disable_hub_port_wake(xhci, &xhci->usb2_rhub, do_wakeup);
988		986
989	if (!HCD_HW_ACCESSIBLE(hcd))	987	if (!HCD_HW_ACCESSIBLE(hcd))
990	return 0;	988	return 0;
@@ -1088,6 +1086,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) · 97 unmodified lines
1088	struct usb_hcd *secondary_hcd;	1086	struct usb_hcd *secondary_hcd;
1089	int retval = 0;	1087	int retval = 0;
1090	bool comp_timer_running = false;	1088	bool comp_timer_running = false;
		1089	bool pending_portevent = false;
1091		1090
1092	if (!hcd->state)	1091	if (!hcd->state)
1093	return 0;	1092	return 0;
@@ -1226,13 +1225,22 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) · 132 unmodified lines
1226		1225
1227	done:	1226	done:
1228	if (retval == 0) {	1227	if (retval == 0) {
1229	/* Resume root hubs only when have pending events. */	1228	/*
1230	if (xhci_pending_portevent(xhci)) {	1229	* Resume roothubs only if there are pending events.
		1230	* USB 3 devices resend U3 LFPS wake after a 100ms delay if
		1231	* the first wake signalling failed, give it that chance.
		1232	*/
		1233	pending_portevent = xhci_pending_portevent(xhci);
		1234	if (!pending_portevent) {
		1235	msleep(120);
		1236	pending_portevent = xhci_pending_portevent(xhci);
		1237	}
		1238
		1239	if (pending_portevent) {
1231	usb_hcd_resume_root_hub(xhci->shared_hcd);	1240	usb_hcd_resume_root_hub(xhci->shared_hcd);
1232	usb_hcd_resume_root_hub(hcd);	1241	usb_hcd_resume_root_hub(hcd);
1233	}	1242	}
1234	}	1243	}
1235
1236	/*	1244	/*
1237	* If system is subject to the Quirk, Compliance Mode Timer needs to	1245	* If system is subject to the Quirk, Compliance Mode Timer needs to
1238	* be re-initialized Always after a system resume. Ports are subject	1246	* be re-initialized Always after a system resume. Ports are subject

drivers/usb/host/xhci.h+1−0

@@ -1891,6 +1891,7 @@ struct xhci_hcd { · 1890 unmodified lines
1891	#define XHCI_SKIP_PHY_INIT BIT_ULL(37)	1891	#define XHCI_SKIP_PHY_INIT BIT_ULL(37)
1892	#define XHCI_DISABLE_SPARSE BIT_ULL(38)	1892	#define XHCI_DISABLE_SPARSE BIT_ULL(38)
1893	#define XHCI_SG_TRB_CACHE_SIZE_QUIRK BIT_ULL(39)	1893	#define XHCI_SG_TRB_CACHE_SIZE_QUIRK BIT_ULL(39)
		1894	#define XHCI_NO_SOFT_RETRY BIT_ULL(40)
1894		1895
1895	unsigned int num_active_eps;	1896	unsigned int num_active_eps;
1896	unsigned int limit_active_eps;	1897	unsigned int limit_active_eps;

drivers/usb/renesas_usbhs/pipe.c+2−0

@@ -746,6 +746,8 @@ struct usbhs_pipe usbhs_pipe_malloc(struct usbhs_priv priv, · 745 unmodified lines
746		746
747	void usbhs_pipe_free(struct usbhs_pipe *pipe)	747	void usbhs_pipe_free(struct usbhs_pipe *pipe)
748	{	748	{
		749	usbhsp_pipe_select(pipe);
		750	usbhsp_pipe_cfg_set(pipe, 0xFFFF, 0);
749	usbhsp_put_pipe(pipe);	751	usbhsp_put_pipe(pipe);
750	}	752	}
751		753

drivers/usb/serial/ch341.c+1−0

@@ -86,6 +86,7 @@ static const struct usb_device_id id_table[] = { · 85 unmodified lines
86	{ USB_DEVICE(0x1a86, 0x7522) },	86	{ USB_DEVICE(0x1a86, 0x7522) },
87	{ USB_DEVICE(0x1a86, 0x7523) },	87	{ USB_DEVICE(0x1a86, 0x7523) },
88	{ USB_DEVICE(0x4348, 0x5523) },	88	{ USB_DEVICE(0x4348, 0x5523) },
		89	{ USB_DEVICE(0x9986, 0x7523) },
89	{ },	90	{ },
90	};	91	};
91	MODULE_DEVICE_TABLE(usb, id_table);	92	MODULE_DEVICE_TABLE(usb, id_table);

drivers/usb/serial/cp210x.c+3−0

 	{ USB_DEVICE(0x10C4, 0x8857) },	/* CEL EM357 ZigBee USB Stick */
 	{ USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
 	{ USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
+	{ USB_DEVICE(0x10C4, 0x88D8) }, /* Acuity Brands nLight Air Adapter */
 	{ USB_DEVICE(0x10C4, 0x88FB) }, /* CESINEL MEDCAL STII Network Analyzer */
 	{ USB_DEVICE(0x10C4, 0x8938) }, /* CESINEL MEDCAL S II Network Analyzer */
 	{ USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
 	{ USB_DEVICE(0x1901, 0x0194) },	/* GE Healthcare Remote Alarm Box */
 	{ USB_DEVICE(0x1901, 0x0195) },	/* GE B850/B650/B450 CP2104 DP UART interface */
 	{ USB_DEVICE(0x1901, 0x0196) },	/* GE B850 CP2105 DP UART interface */
+	{ USB_DEVICE(0x1901, 0x0197) }, /* GE CS1000 Display serial interface */
+	{ USB_DEVICE(0x1901, 0x0198) }, /* GE CS1000 M.2 Key E serial interface */
 	{ USB_DEVICE(0x199B, 0xBA30) }, /* LORD WSDA-200-USB */
 	{ USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */
 	{ USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */

drivers/usb/serial/io_edgeport.c+16−10

 				response = -ENODEV;
 			}
-			usb_free_urb(edge_serial->interrupt_read_urb);
+			goto error;
-			kfree(edge_serial->interrupt_in_buffer);
-			usb_free_urb(edge_serial->read_urb);
-			kfree(edge_serial->bulk_in_buffer);
-			kfree(edge_serial);
-			return response;
 		}
 		/* start interrupt read for this edgeport this interrupt will
 		 * continue as long as the edgeport is connected */
 		response = usb_submit_urb(edge_serial->interrupt_read_urb,
 								GFP_KERNEL);
-		if (response)
+		if (response) {
 			dev_err(ddev, "%s - Error %d submitting control urb\n",
 				__func__, response);
+			goto error;
+		}
 	}
 	return response;
+error:
+	usb_free_urb(edge_serial->interrupt_read_urb);
+	kfree(edge_serial->interrupt_in_buffer);
+	usb_free_urb(edge_serial->read_urb);
+	kfree(edge_serial->bulk_in_buffer);
+	kfree(edge_serial);
+	return response;
 }

drivers/usb/serial/xr_serial.c+0−25

@@ -545,37 +545,13 @@ static void xr_close(struct usb_serial_port *port) · 544 unmodified lines
545		545
546	static int xr_probe(struct usb_serial serial, const struct usb_device_id id)	546	static int xr_probe(struct usb_serial serial, const struct usb_device_id id)
547	{	547	{
548	struct usb_driver *driver = serial->type->usb_driver;
549	struct usb_interface *control_interface;
550	int ret;
551
552	/* Don't bind to control interface */	548	/* Don't bind to control interface */
553	if (serial->interface->cur_altsetting->desc.bInterfaceNumber == 0)	549	if (serial->interface->cur_altsetting->desc.bInterfaceNumber == 0)
554	return -ENODEV;	550	return -ENODEV;
555		551
556	/* But claim the control interface during data interface probe */
557	control_interface = usb_ifnum_to_if(serial->dev, 0);
558	if (!control_interface)
559	return -ENODEV;
560
561	ret = usb_driver_claim_interface(driver, control_interface, NULL);
562	if (ret) {
563	dev_err(&serial->interface->dev, "Failed to claim control interface\n");
564	return ret;
565	}
566
567	return 0;	552	return 0;
568	}	553	}
569		554
570	static void xr_disconnect(struct usb_serial *serial)
571	{
572	struct usb_driver *driver = serial->type->usb_driver;
573	struct usb_interface *control_interface;
574
575	control_interface = usb_ifnum_to_if(serial->dev, 0);
576	usb_driver_release_interface(driver, control_interface);
577	}
578
579	static const struct usb_device_id id_table[] = {	555	static const struct usb_device_id id_table[] = {
580	{ USB_DEVICE(0x04e2, 0x1410) }, /* XR21V141X */	556	{ USB_DEVICE(0x04e2, 0x1410) }, /* XR21V141X */
581	{ }	557	{ }
@@ -590,7 +566,6 @@ static struct usb_serial_driver xr_device = { · 8 unmodified lines
590	.id_table = id_table,	566	.id_table = id_table,
591	.num_ports = 1,	567	.num_ports = 1,
592	.probe = xr_probe,	568	.probe = xr_probe,
593	.disconnect = xr_disconnect,
594	.open = xr_open,	569	.open = xr_open,
595	.close = xr_close,	570	.close = xr_close,
596	.break_ctl = xr_break_ctl,	571	.break_ctl = xr_break_ctl,

drivers/usb/usbip/stub_dev.c+35−7

 	int sockfd = 0;
 	struct socket *socket;
 	int rv;
+	struct task_struct *tcp_rx = NULL;
+	struct task_struct *tcp_tx = NULL;
 	if (!sdev) {
 		dev_err(dev, "sdev is null\n");
 		}
 		socket = sockfd_lookup(sockfd, &err);
-		if (!socket)
+		if (!socket) {
+			dev_err(dev, "failed to lookup sock");
 			goto err;
+		}
-		sdev->ud.tcp_socket = socket;
+		if (socket->type != SOCK_STREAM) {
-		sdev->ud.sockfd = sockfd;
+			dev_err(dev, "Expecting SOCK_STREAM - found %d",
+				socket->type);
+			goto sock_err;
+		}
+		/* unlock and create threads and get tasks */
 		spin_unlock_irq(&sdev->ud.lock);
+		tcp_rx = kthread_create(stub_rx_loop, &sdev->ud, "stub_rx");
+		if (IS_ERR(tcp_rx)) {
+			sockfd_put(socket);
+			return -EINVAL;
+		}
+		tcp_tx = kthread_create(stub_tx_loop, &sdev->ud, "stub_tx");
+		if (IS_ERR(tcp_tx)) {
+			kthread_stop(tcp_rx);
+			sockfd_put(socket);
+			return -EINVAL;
+		}
-		sdev->ud.tcp_rx = kthread_get_run(stub_rx_loop, &sdev->ud,
+		/* get task structs now */
-						  "stub_rx");
+		get_task_struct(tcp_rx);
-		sdev->ud.tcp_tx = kthread_get_run(stub_tx_loop, &sdev->ud,
+		get_task_struct(tcp_tx);
-						  "stub_tx");
+		/* lock and update sdev->ud state */
 		spin_lock_irq(&sdev->ud.lock);
+		sdev->ud.tcp_socket = socket;
+		sdev->ud.sockfd = sockfd;
+		sdev->ud.tcp_rx = tcp_rx;
+		sdev->ud.tcp_tx = tcp_tx;
 		sdev->ud.status = SDEV_ST_USED;
 		spin_unlock_irq(&sdev->ud.lock);
+		wake_up_process(sdev->ud.tcp_rx);
+		wake_up_process(sdev->ud.tcp_tx);
 	} else {
 		dev_info(dev, "stub down\n");
 	return count;
+sock_err:
+	sockfd_put(socket);
 err:
 	spin_unlock_irq(&sdev->ud.lock);
 	return -EINVAL;

drivers/usb/usbip/vhci_sysfs.c+34−5

 	struct vhci *vhci;
 	int err;
 	unsigned long flags;
+	struct task_struct *tcp_rx = NULL;
+	struct task_struct *tcp_tx = NULL;
 	/*
 	 * @rhport: port number of vhci_hcd
 	/* Extract socket from fd. */
 	socket = sockfd_lookup(sockfd, &err);
-	if (!socket)
+	if (!socket) {
+		dev_err(dev, "failed to lookup sock");
 		return -EINVAL;
+	}
+	if (socket->type != SOCK_STREAM) {
+		dev_err(dev, "Expecting SOCK_STREAM - found %d",
+			socket->type);
+		sockfd_put(socket);
+		return -EINVAL;
+	}
+	/* create threads before locking */
+	tcp_rx = kthread_create(vhci_rx_loop, &vdev->ud, "vhci_rx");
+	if (IS_ERR(tcp_rx)) {
+		sockfd_put(socket);
+		return -EINVAL;
+	}
+	tcp_tx = kthread_create(vhci_tx_loop, &vdev->ud, "vhci_tx");
+	if (IS_ERR(tcp_tx)) {
+		kthread_stop(tcp_rx);
+		sockfd_put(socket);
+		return -EINVAL;
+	}
-	/* now need lock until setting vdev status as used */
+	/* get task structs now */
+	get_task_struct(tcp_rx);
+	get_task_struct(tcp_tx);
-	/* begin a lock */
+	/* now begin lock until setting vdev status set */
 	spin_lock_irqsave(&vhci->lock, flags);
 	spin_lock(&vdev->ud.lock);
 		spin_unlock_irqrestore(&vhci->lock, flags);
 		sockfd_put(socket);
+		kthread_stop_put(tcp_rx);
+		kthread_stop_put(tcp_tx);
 		dev_err(dev, "port %d already used\n", rhport);
 		/*
 	vdev->speed         = speed;
 	vdev->ud.sockfd     = sockfd;
 	vdev->ud.tcp_socket = socket;
+	vdev->ud.tcp_rx     = tcp_rx;
+	vdev->ud.tcp_tx     = tcp_tx;
 	vdev->ud.status     = VDEV_ST_NOTASSIGNED;
 	usbip_kcov_handle_init(&vdev->ud);
 	spin_unlock_irqrestore(&vhci->lock, flags);
 	/* end the lock */
-	vdev->ud.tcp_rx = kthread_get_run(vhci_rx_loop, &vdev->ud, "vhci_rx");
+	wake_up_process(vdev->ud.tcp_rx);
-	vdev->ud.tcp_tx = kthread_get_run(vhci_tx_loop, &vdev->ud, "vhci_tx");
+	wake_up_process(vdev->ud.tcp_tx);
 	rh_port_connect(vdev, speed);

drivers/usb/usbip/vudc_sysfs.c+42−7

 }
 static BIN_ATTR_RO(dev_desc, sizeof(struct usb_device_descriptor));
-static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *attr,
+static ssize_t usbip_sockfd_store(struct device *dev,
-		     const char *in, size_t count)
+				  struct device_attribute *attr,
+				  const char *in, size_t count)
 {
 	struct vudc *udc = (struct vudc *) dev_get_drvdata(dev);
 	int rv;
 	struct socket *socket;
 	unsigned long flags;
 	int ret;
+	struct task_struct *tcp_rx = NULL;
+	struct task_struct *tcp_tx = NULL;
 	rv = kstrtoint(in, 0, &sockfd);
 	if (rv != 0)
 			goto unlock_ud;
 		}
-		udc->ud.tcp_socket = socket;
+		if (socket->type != SOCK_STREAM) {
+			dev_err(dev, "Expecting SOCK_STREAM - found %d",
+				socket->type);
+			ret = -EINVAL;
+			goto sock_err;
+		}
+		/* unlock and create threads and get tasks */
 		spin_unlock_irq(&udc->ud.lock);
 		spin_unlock_irqrestore(&udc->lock, flags);
-		udc->ud.tcp_rx = kthread_get_run(&v_rx_loop,
+		tcp_rx = kthread_create(&v_rx_loop, &udc->ud, "vudc_rx");
-						    &udc->ud, "vudc_rx");
+		if (IS_ERR(tcp_rx)) {
-		udc->ud.tcp_tx = kthread_get_run(&v_tx_loop,
+			sockfd_put(socket);
-						    &udc->ud, "vudc_tx");
+			return -EINVAL;
+		}
+		tcp_tx = kthread_create(&v_tx_loop, &udc->ud, "vudc_tx");
+		if (IS_ERR(tcp_tx)) {
+			kthread_stop(tcp_rx);
+			sockfd_put(socket);
+			return -EINVAL;
+		}
+		/* get task structs now */
+		get_task_struct(tcp_rx);
+		get_task_struct(tcp_tx);
+		/* lock and update udc->ud state */
 		spin_lock_irqsave(&udc->lock, flags);
 		spin_lock_irq(&udc->ud.lock);
+		udc->ud.tcp_socket = socket;
+		udc->ud.tcp_rx = tcp_rx;
+		udc->ud.tcp_rx = tcp_tx;
 		udc->ud.status = SDEV_ST_USED;
 		spin_unlock_irq(&udc->ud.lock);
 		ktime_get_ts64(&udc->start_time);
 		v_start_timer(udc);
 		udc->connected = 1;
+		spin_unlock_irqrestore(&udc->lock, flags);
+		wake_up_process(udc->ud.tcp_rx);
+		wake_up_process(udc->ud.tcp_tx);
+		return count;
 	} else {
 		if (!udc->connected) {
 			dev_err(dev, "Device not connected");
 	return count;
+sock_err:
+	sockfd_put(socket);
 unlock_ud:
 	spin_unlock_irq(&udc->ud.lock);
 unlock:

drivers/video/fbdev/aty/atyfb.h+0−3

 #endif
 }
-#if defined(CONFIG_PMAC_BACKLIGHT) || defined (CONFIG_FB_ATY_GENERIC_LCD) || \
-defined (CONFIG_FB_ATY_BACKLIGHT)
 extern void aty_st_lcd(int index, u32 val, const struct atyfb_par *par);
 extern u32 aty_ld_lcd(int index, const struct atyfb_par *par);
-#endif
     /*
      *  DAC operations

drivers/video/fbdev/aty/atyfb_base.c+5−4

 #define PRINTKE(fmt, args...)	printk(KERN_ERR "atyfb: " fmt, ## args)
 #if defined(CONFIG_PMAC_BACKLIGHT) || defined(CONFIG_FB_ATY_GENERIC_LCD) || \
-defined(CONFIG_FB_ATY_BACKLIGHT)
+defined(CONFIG_FB_ATY_BACKLIGHT) || defined (CONFIG_PPC_PMAC)
 static const u32 lt_lcd_regs[] = {
 	CNFG_PANEL_LG,
 	LCD_GEN_CNTL_LG,
 		return aty_ld_le32(LCD_DATA, par);
 	}
 }
-#else /* defined(CONFIG_PMAC_BACKLIGHT) || defined(CONFIG_FB_ATY_BACKLIGHT) \
+#else /* defined(CONFIG_PMAC_BACKLIGHT) || defined(CONFIG_FB_ATY_BACKLIGHT) ||
-	 defined(CONFIG_FB_ATY_GENERIC_LCD) */
+	 defined(CONFIG_FB_ATY_GENERIC_LCD) || defined(CONFIG_PPC_PMAC) */
 void aty_st_lcd(int index, u32 val, const struct atyfb_par *par)
 { }
 {
 	return 0;
 }
-#endif /* defined(CONFIG_PMAC_BACKLIGHT) || defined (CONFIG_FB_ATY_GENERIC_LCD) */
+#endif /* defined(CONFIG_PMAC_BACKLIGHT) || defined(CONFIG_FB_ATY_BACKLIGHT) ||
+	  defined (CONFIG_FB_ATY_GENERIC_LCD) || defined(CONFIG_PPC_PMAC) */
 #ifdef CONFIG_FB_ATY_GENERIC_LCD
 /*

drivers/virt/acrn/hsm.c+10−1

 		acrn_ioreq_request_clear(vm);
 		break;
 	case ACRN_IOCTL_PM_GET_CPU_STATE:
-		if (copy_from_user(&cstate_cmd, (void *)ioctl_param,
+		if (copy_from_user(&cstate_cmd, (void __user *)ioctl_param,
 				   sizeof(cstate_cmd)))
 			return -EFAULT;
 }
 static DEVICE_ATTR_WO(remove_cpu);
+static umode_t acrn_attr_visible(struct kobject *kobj, struct attribute *a, int n)
+{
+       if (a == &dev_attr_remove_cpu.attr)
+               return IS_ENABLED(CONFIG_HOTPLUG_CPU) ? a->mode : 0;
+       return a->mode;
+}
 static struct attribute *acrn_attrs[] = {
 	&dev_attr_remove_cpu.attr,
 	NULL
 static struct attribute_group acrn_attr_group = {
 	.attrs = acrn_attrs,
+	.is_visible = acrn_attr_visible,
 };
 static const struct attribute_group *acrn_attr_groups[] = {

drivers/virt/acrn/irqfd.c+3−3

@@ -112,7 +112,7 @@ static int acrn_irqfd_assign(struct acrn_vm vm, struct acrn_irqfd args) · 111 unmodified lines
112	{	112	{
113	struct eventfd_ctx *eventfd = NULL;	113	struct eventfd_ctx *eventfd = NULL;
114	struct hsm_irqfd irqfd, tmp;	114	struct hsm_irqfd irqfd, tmp;
115	unsigned int events;	115	__poll_t events;
116	struct fd f;	116	struct fd f;
117	int ret = 0;	117	int ret = 0;
118		118
@@ -158,9 +158,9 @@ static int acrn_irqfd_assign(struct acrn_vm vm, struct acrn_irqfd args) · 39 unmodified lines
158	mutex_unlock(&vm->irqfds_lock);	158	mutex_unlock(&vm->irqfds_lock);
159		159
160	/* Check the pending event in this stage */	160	/* Check the pending event in this stage */
161	events = f.file->f_op->poll(f.file, &irqfd->pt);	161	events = vfs_poll(f.file, &irqfd->pt);
162		162
163	if (events & POLLIN)	163	if (events & EPOLLIN)
164	acrn_irqfd_inject(irqfd);	164	acrn_irqfd_inject(irqfd);
165		165
166	fdput(f);	166	fdput(f);

drivers/xen/events/events_2l.c+15−7

 	return EVTCHN_2L_NR_CHANNELS;
 }
+static void evtchn_2l_remove(evtchn_port_t evtchn, unsigned int cpu)
+{
+	clear_bit(evtchn, BM(per_cpu(cpu_evtchn_mask, cpu)));
+}
 static void evtchn_2l_bind_to_cpu(evtchn_port_t evtchn, unsigned int cpu,
 				  unsigned int old_cpu)
 {
 	return sync_test_bit(port, BM(&s->evtchn_pending[0]));
 }
-static bool evtchn_2l_test_and_set_mask(evtchn_port_t port)
-{
-	struct shared_info *s = HYPERVISOR_shared_info;
-	return sync_test_and_set_bit(port, BM(&s->evtchn_mask[0]));
-}
 static void evtchn_2l_mask(evtchn_port_t port)
 {
 	struct shared_info *s = HYPERVISOR_shared_info;
 				EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD);
 }
+static int evtchn_2l_percpu_deinit(unsigned int cpu)
+{
+	memset(per_cpu(cpu_evtchn_mask, cpu), 0, sizeof(xen_ulong_t) *
+			EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD);
+	return 0;
+}
 static const struct evtchn_ops evtchn_ops_2l = {
 	.max_channels      = evtchn_2l_max_channels,
 	.nr_channels       = evtchn_2l_max_channels,
+	.remove            = evtchn_2l_remove,
 	.bind_to_cpu       = evtchn_2l_bind_to_cpu,
 	.clear_pending     = evtchn_2l_clear_pending,
 	.set_pending       = evtchn_2l_set_pending,
 	.is_pending        = evtchn_2l_is_pending,
-	.test_and_set_mask = evtchn_2l_test_and_set_mask,
 	.mask              = evtchn_2l_mask,
 	.unmask            = evtchn_2l_unmask,
 	.handle_events     = evtchn_2l_handle_events,
 	.resume	           = evtchn_2l_resume,
+	.percpu_deinit     = evtchn_2l_percpu_deinit,
 };
 void __init xen_evtchn_2l_init(void)

drivers/xen/events/events_base.c+100−30

 	short refcnt;
 	u8 spurious_cnt;
 	u8 is_accounted;
-	enum xen_irq_type type; /* type */
+	short type;		/* type: IRQT_* */
+	u8 mask_reason;		/* Why is event channel masked */
+#define EVT_MASK_REASON_EXPLICIT	0x01
+#define EVT_MASK_REASON_TEMPORARY	0x02
+#define EVT_MASK_REASON_EOI_PENDING	0x04
+	u8 is_active;		/* Is event just being handled? */
 	unsigned irq;
 	evtchn_port_t evtchn;   /* event channel */
 	unsigned short cpu;     /* cpu bound */
 	unsigned short eoi_cpu; /* EOI must happen on this cpu-1 */
 	unsigned int irq_epoch; /* If eoi_cpu valid: irq_epoch of event */
 	u64 eoi_time;           /* Time in jiffies when to EOI. */
+	spinlock_t lock;
 	union {
 		unsigned short virq;
  *   evtchn_rwlock
  *     IRQ-desc lock
  *       percpu eoi_list_lock
+ *         irq_info->lock
  */
 static LIST_HEAD(xen_irq_list_head);
 	info->irq = irq;
 	info->evtchn = evtchn;
 	info->cpu = cpu;
+	info->mask_reason = EVT_MASK_REASON_EXPLICIT;
+	spin_lock_init(&info->lock);
 	ret = set_evtchn_to_irq(evtchn, irq);
 	if (ret < 0)
 static void xen_irq_info_cleanup(struct irq_info *info)
 {
 	set_evtchn_to_irq(info->evtchn, -1);
+	xen_evtchn_port_remove(info->evtchn, info->cpu);
 	info->evtchn = 0;
 	channels_on_cpu_dec(info);
 }
 	return ret;
 }
+static void do_mask(struct irq_info *info, u8 reason)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&info->lock, flags);
+	if (!info->mask_reason)
+		mask_evtchn(info->evtchn);
+	info->mask_reason |= reason;
+	spin_unlock_irqrestore(&info->lock, flags);
+}
+static void do_unmask(struct irq_info *info, u8 reason)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&info->lock, flags);
+	info->mask_reason &= ~reason;
+	if (!info->mask_reason)
+		unmask_evtchn(info->evtchn);
+	spin_unlock_irqrestore(&info->lock, flags);
+}
 #ifdef CONFIG_X86
 static bool pirq_check_eoi_map(unsigned irq)
 {
 	}
 	info->eoi_time = 0;
-	unmask_evtchn(evtchn);
+	do_unmask(info, EVT_MASK_REASON_EOI_PENDING);
 }
 static void xen_irq_lateeoi_worker(struct work_struct *work)
 		BUG();
 }
+static void event_handler_exit(struct irq_info *info)
+{
+	smp_store_release(&info->is_active, 0);
+	clear_evtchn(info->evtchn);
+}
 static void pirq_query_unmask(int irq)
 {
 	struct physdev_irq_status_query irq_status;
 static void eoi_pirq(struct irq_data *data)
 {
-	evtchn_port_t evtchn = evtchn_from_irq(data->irq);
+	struct irq_info *info = info_for_irq(data->irq);
+	evtchn_port_t evtchn = info ? info->evtchn : 0;
 	struct physdev_eoi eoi = { .irq = pirq_from_irq(data->irq) };
 	int rc = 0;
 	if (!VALID_EVTCHN(evtchn))
 		return;
-	clear_evtchn(evtchn);
+	event_handler_exit(info);
 	if (pirq_needs_eoi(data->irq)) {
 		rc = HYPERVISOR_physdev_op(PHYSDEVOP_eoi, &eoi);
 		goto err;
 out:
-	unmask_evtchn(evtchn);
+	do_unmask(info, EVT_MASK_REASON_EXPLICIT);
 	eoi_pirq(irq_get_irq_data(irq));
 	return 0;
 	if (!VALID_EVTCHN(evtchn))
 		return;
-	mask_evtchn(evtchn);
+	do_mask(info, EVT_MASK_REASON_EXPLICIT);
 	xen_evtchn_close(evtchn);
 	xen_irq_info_cleanup(info);
 }
 	}
 	info = info_for_irq(irq);
+	if (xchg_acquire(&info->is_active, 1))
+		return;
 	dev = (info->type == IRQT_EVTCHN) ? info->u.interdomain : NULL;
 	if (dev)
 }
 /* Rebind an evtchn so that it gets delivered to a specific cpu */
-static int xen_rebind_evtchn_to_cpu(evtchn_port_t evtchn, unsigned int tcpu)
+static int xen_rebind_evtchn_to_cpu(struct irq_info *info, unsigned int tcpu)
 {
 	struct evtchn_bind_vcpu bind_vcpu;
-	int masked;
+	evtchn_port_t evtchn = info ? info->evtchn : 0;
 	if (!VALID_EVTCHN(evtchn))
 		return -1;
 	 * Mask the event while changing the VCPU binding to prevent
 	 * it being delivered on an unexpected VCPU.
 	 */
-	masked = test_and_set_mask(evtchn);
+	do_mask(info, EVT_MASK_REASON_TEMPORARY);
 	/*
 	 * If this fails, it usually just indicates that we're dealing with a
 	if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0)
 		bind_evtchn_to_cpu(evtchn, tcpu, false);
-	if (!masked)
+	do_unmask(info, EVT_MASK_REASON_TEMPORARY);
-		unmask_evtchn(evtchn);
 	return 0;
 }
 	unsigned int tcpu = select_target_cpu(dest);
 	int ret;
-	ret = xen_rebind_evtchn_to_cpu(evtchn_from_irq(data->irq), tcpu);
+	ret = xen_rebind_evtchn_to_cpu(info_for_irq(data->irq), tcpu);
 	if (!ret)
 		irq_data_update_effective_affinity(data, cpumask_of(tcpu));
 static void enable_dynirq(struct irq_data *data)
 {
-	evtchn_port_t evtchn = evtchn_from_irq(data->irq);
+	struct irq_info *info = info_for_irq(data->irq);
+	evtchn_port_t evtchn = info ? info->evtchn : 0;
 	if (VALID_EVTCHN(evtchn))
-		unmask_evtchn(evtchn);
+		do_unmask(info, EVT_MASK_REASON_EXPLICIT);
 }
 static void disable_dynirq(struct irq_data *data)
 {
-	evtchn_port_t evtchn = evtchn_from_irq(data->irq);
+	struct irq_info *info = info_for_irq(data->irq);
+	evtchn_port_t evtchn = info ? info->evtchn : 0;
 	if (VALID_EVTCHN(evtchn))
-		mask_evtchn(evtchn);
+		do_mask(info, EVT_MASK_REASON_EXPLICIT);
 }
 static void ack_dynirq(struct irq_data *data)
 {
-	evtchn_port_t evtchn = evtchn_from_irq(data->irq);
+	struct irq_info *info = info_for_irq(data->irq);
+	evtchn_port_t evtchn = info ? info->evtchn : 0;
-	if (!VALID_EVTCHN(evtchn))
+	if (VALID_EVTCHN(evtchn))
-		return;
+		event_handler_exit(info);
-	clear_evtchn(evtchn);
 }
 static void mask_ack_dynirq(struct irq_data *data)
 	ack_dynirq(data);
 }
+static void lateeoi_ack_dynirq(struct irq_data *data)
+{
+	struct irq_info *info = info_for_irq(data->irq);
+	evtchn_port_t evtchn = info ? info->evtchn : 0;
+	if (VALID_EVTCHN(evtchn)) {
+		do_mask(info, EVT_MASK_REASON_EOI_PENDING);
+		event_handler_exit(info);
+	}
+}
+static void lateeoi_mask_ack_dynirq(struct irq_data *data)
+{
+	struct irq_info *info = info_for_irq(data->irq);
+	evtchn_port_t evtchn = info ? info->evtchn : 0;
+	if (VALID_EVTCHN(evtchn)) {
+		do_mask(info, EVT_MASK_REASON_EXPLICIT);
+		event_handler_exit(info);
+	}
+}
 static int retrigger_dynirq(struct irq_data *data)
 {
-	evtchn_port_t evtchn = evtchn_from_irq(data->irq);
+	struct irq_info *info = info_for_irq(data->irq);
-	int masked;
+	evtchn_port_t evtchn = info ? info->evtchn : 0;
 	if (!VALID_EVTCHN(evtchn))
 		return 0;
-	masked = test_and_set_mask(evtchn);
+	do_mask(info, EVT_MASK_REASON_TEMPORARY);
 	set_evtchn(evtchn);
-	if (!masked)
+	do_unmask(info, EVT_MASK_REASON_TEMPORARY);
-		unmask_evtchn(evtchn);
 	return 1;
 }
 /* Clear an irq's pending state, in preparation for polling on it */
 void xen_clear_irq_pending(int irq)
 {
-	evtchn_port_t evtchn = evtchn_from_irq(irq);
+	struct irq_info *info = info_for_irq(irq);
+	evtchn_port_t evtchn = info ? info->evtchn : 0;
 	if (VALID_EVTCHN(evtchn))
-		clear_evtchn(evtchn);
+		event_handler_exit(info);
 }
 EXPORT_SYMBOL(xen_clear_irq_pending);
 void xen_set_irq_pending(int irq)
 	.irq_mask		= disable_dynirq,
 	.irq_unmask		= enable_dynirq,
-	.irq_ack		= mask_ack_dynirq,
+	.irq_ack		= lateeoi_ack_dynirq,
-	.irq_mask_ack		= mask_ack_dynirq,
+	.irq_mask_ack		= lateeoi_mask_ack_dynirq,
 	.irq_set_affinity	= set_affinity_irq,
 	.irq_retrigger		= retrigger_dynirq,

drivers/xen/events/events_fifo.c+0−7

 	return sync_test_bit(EVTCHN_FIFO_BIT(PENDING, word), BM(word));
 }
-static bool evtchn_fifo_test_and_set_mask(evtchn_port_t port)
-{
-	event_word_t *word = event_word_from_port(port);
-	return sync_test_and_set_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
-}
 static void evtchn_fifo_mask(evtchn_port_t port)
 {
 	event_word_t *word = event_word_from_port(port);
 	.clear_pending     = evtchn_fifo_clear_pending,
 	.set_pending       = evtchn_fifo_set_pending,
 	.is_pending        = evtchn_fifo_is_pending,
-	.test_and_set_mask = evtchn_fifo_test_and_set_mask,
 	.mask              = evtchn_fifo_mask,
 	.unmask            = evtchn_fifo_unmask,
 	.handle_events     = evtchn_fifo_handle_events,

drivers/xen/events/events_internal.h+8−6

 	unsigned (*nr_channels)(void);
 	int (*setup)(evtchn_port_t port);
+	void (*remove)(evtchn_port_t port, unsigned int cpu);
 	void (*bind_to_cpu)(evtchn_port_t evtchn, unsigned int cpu,
 			    unsigned int old_cpu);
 	void (*clear_pending)(evtchn_port_t port);
 	void (*set_pending)(evtchn_port_t port);
 	bool (*is_pending)(evtchn_port_t port);
-	bool (*test_and_set_mask)(evtchn_port_t port);
 	void (*mask)(evtchn_port_t port);
 	void (*unmask)(evtchn_port_t port);
 	return 0;
 }
+static inline void xen_evtchn_port_remove(evtchn_port_t evtchn,
+					  unsigned int cpu)
+{
+	if (evtchn_ops->remove)
+		evtchn_ops->remove(evtchn, cpu);
+}
 static inline void xen_evtchn_port_bind_to_cpu(evtchn_port_t evtchn,
 					       unsigned int cpu,
 					       unsigned int old_cpu)
 	return evtchn_ops->is_pending(port);
 }
-static inline bool test_and_set_mask(evtchn_port_t port)
-{
-	return evtchn_ops->test_and_set_mask(port);
-}
 static inline void mask_evtchn(evtchn_port_t port)
 {
 	return evtchn_ops->mask(port);

drivers/xen/gntdev.c+33−21

 	if (NULL == add)
 		return NULL;
-	add->grants    = kvcalloc(count, sizeof(add->grants[0]), GFP_KERNEL);
+	add->grants    = kvmalloc_array(count, sizeof(add->grants[0]),
-	add->map_ops   = kvcalloc(count, sizeof(add->map_ops[0]), GFP_KERNEL);
+					GFP_KERNEL);
-	add->unmap_ops = kvcalloc(count, sizeof(add->unmap_ops[0]), GFP_KERNEL);
+	add->map_ops   = kvmalloc_array(count, sizeof(add->map_ops[0]),
-	add->kmap_ops  = kvcalloc(count, sizeof(add->kmap_ops[0]), GFP_KERNEL);
+					GFP_KERNEL);
-	add->kunmap_ops = kvcalloc(count,
+	add->unmap_ops = kvmalloc_array(count, sizeof(add->unmap_ops[0]),
-				   sizeof(add->kunmap_ops[0]), GFP_KERNEL);
+					GFP_KERNEL);
 	add->pages     = kvcalloc(count, sizeof(add->pages[0]), GFP_KERNEL);
 	if (NULL == add->grants    ||
 	    NULL == add->map_ops   ||
 	    NULL == add->unmap_ops ||
-	    NULL == add->kmap_ops  ||
-	    NULL == add->kunmap_ops ||
 	    NULL == add->pages)
 		goto err;
+	if (use_ptemod) {
+		add->kmap_ops   = kvmalloc_array(count, sizeof(add->kmap_ops[0]),
+						 GFP_KERNEL);
+		add->kunmap_ops = kvmalloc_array(count, sizeof(add->kunmap_ops[0]),
+						 GFP_KERNEL);
+		if (NULL == add->kmap_ops || NULL == add->kunmap_ops)
+			goto err;
+	}
 #ifdef CONFIG_XEN_GRANT_DMA_ALLOC
 	add->dma_flags = dma_flags;
 		goto err;
 	for (i = 0; i < count; i++) {
-		add->map_ops[i].handle = -1;
+		add->grants[i].domid = DOMID_INVALID;
-		add->unmap_ops[i].handle = -1;
+		add->grants[i].ref = INVALID_GRANT_REF;
-		add->kmap_ops[i].handle = -1;
+		add->map_ops[i].handle = INVALID_GRANT_HANDLE;
-		add->kunmap_ops[i].handle = -1;
+		add->unmap_ops[i].handle = INVALID_GRANT_HANDLE;
+		if (use_ptemod) {
+			add->kmap_ops[i].handle = INVALID_GRANT_HANDLE;
+			add->kunmap_ops[i].handle = INVALID_GRANT_HANDLE;
+		}
 	}
 	add->index = 0;
 			  map->grants[pgnr].ref,
 			  map->grants[pgnr].domid);
 	gnttab_set_unmap_op(&map->unmap_ops[pgnr], pte_maddr, flags,
-			    -1 /* handle */);
+			    INVALID_GRANT_HANDLE);
 	return 0;
 }
 	if (!use_ptemod) {
 		/* Note: it could already be mapped */
-		if (map->map_ops[0].handle != -1)
+		if (map->map_ops[0].handle != INVALID_GRANT_HANDLE)
 			return 0;
 		for (i = 0; i < map->count; i++) {
 			unsigned long addr = (unsigned long)
 				map->grants[i].ref,
 				map->grants[i].domid);
 			gnttab_set_unmap_op(&map->unmap_ops[i], addr,
-				map->flags, -1 /* handle */);
+				map->flags, INVALID_GRANT_HANDLE);
 		}
 	} else {
 		/*
 				map->grants[i].ref,
 				map->grants[i].domid);
 			gnttab_set_unmap_op(&map->kunmap_ops[i], address,
-				flags, -1);
+				flags, INVALID_GRANT_HANDLE);
 		}
 	}
 	pr_debug("map %d+%d\n", map->index, map->count);
-	err = gnttab_map_refs(map->map_ops, use_ptemod ? map->kmap_ops : NULL,
+	err = gnttab_map_refs(map->map_ops, map->kmap_ops, map->pages,
-			map->pages, map->count);
+			map->count);
 	for (i = 0; i < map->count; i++) {
 		if (map->map_ops[i].status == GNTST_okay)
 		pr_debug("unmap handle=%d st=%d\n",
 			map->unmap_ops[offset+i].handle,
 			map->unmap_ops[offset+i].status);
-		map->unmap_ops[offset+i].handle = -1;
+		map->unmap_ops[offset+i].handle = INVALID_GRANT_HANDLE;
 	}
 	return err;
 }
 	 * already unmapped some of the grants. Only unmap valid ranges.
 	 */
 	while (pages && !err) {
-		while (pages && map->unmap_ops[offset].handle == -1) {
+		while (pages &&
+		       map->unmap_ops[offset].handle == INVALID_GRANT_HANDLE) {
 			offset++;
 			pages--;
 		}
 		range = 0;
 		while (range < pages) {
-			if (map->unmap_ops[offset+range].handle == -1)
+			if (map->unmap_ops[offset + range].handle ==
+			    INVALID_GRANT_HANDLE)
 				break;
 			range++;
 		}

fs/Kconfig+1−1

@@ -203,7 +203,7 @@ config TMPFS_XATTR · 202 unmodified lines
203		203
204	config TMPFS_INODE64	204	config TMPFS_INODE64
205	bool "Use 64-bit ino_t by default in tmpfs"	205	bool "Use 64-bit ino_t by default in tmpfs"
206	depends on TMPFS && 64BIT && !(S390 \|\| ALPHA)	206	depends on TMPFS && 64BIT
207	default n	207	default n
208	help	208	help
209	tmpfs has historically used only inode numbers as wide as an unsigned	209	tmpfs has historically used only inode numbers as wide as an unsigned

fs/afs/dir.c+0−1

@@ -70,7 +70,6 @@ const struct inode_operations afs_dir_inode_operations = { · 69 unmodified lines
70	.permission = afs_permission,	70	.permission = afs_permission,
71	.getattr = afs_getattr,	71	.getattr = afs_getattr,
72	.setattr = afs_setattr,	72	.setattr = afs_setattr,
73	.listxattr = afs_listxattr,
74	};	73	};
75		74
76	const struct address_space_operations afs_dir_aops = {	75	const struct address_space_operations afs_dir_aops = {

fs/afs/file.c+0−1

@@ -43,7 +43,6 @@ const struct inode_operations afs_file_inode_operations = { · 42 unmodified lines
43	.getattr = afs_getattr,	43	.getattr = afs_getattr,
44	.setattr = afs_setattr,	44	.setattr = afs_setattr,
45	.permission = afs_permission,	45	.permission = afs_permission,
46	.listxattr = afs_listxattr,
47	};	46	};
48		47
49	const struct address_space_operations afs_fs_aops = {	48	const struct address_space_operations afs_fs_aops = {

fs/afs/fs_operation.c+5−2

 		if (test_bit(AFS_SERVER_FL_IS_YFS, &op->server->flags) &&
 		    op->ops->issue_yfs_rpc)
 			op->ops->issue_yfs_rpc(op);
-		else
+		else if (op->ops->issue_afs_rpc)
 			op->ops->issue_afs_rpc(op);
+		else
+			op->ac.error = -ENOTSUPP;
-		op->error = afs_wait_for_call_to_complete(op->call, &op->ac);
+		if (op->call)
+			op->error = afs_wait_for_call_to_complete(op->call, &op->ac);
 	}
 	switch (op->error) {

fs/afs/inode.c+0−1

@@ -27,7 +27,6 @@ · 26 unmodified lines
27		27
28	static const struct inode_operations afs_symlink_inode_operations = {	28	static const struct inode_operations afs_symlink_inode_operations = {
29	.get_link = page_get_link,	29	.get_link = page_get_link,
30	.listxattr = afs_listxattr,
31	};	30	};
32		31
33	static noinline void dump_vnode(struct afs_vnode vnode, struct afs_vnode parent_vnode)	32	static noinline void dump_vnode(struct afs_vnode vnode, struct afs_vnode parent_vnode)

fs/afs/internal.h+0−1

@@ -1509,7 +1509,6 @@ extern int afs_launder_page(struct page *); · 1508 unmodified lines
1509	* xattr.c	1509	* xattr.c
1510	*/	1510	*/
1511	extern const struct xattr_handler *afs_xattr_handlers[];	1511	extern const struct xattr_handler *afs_xattr_handlers[];
1512	extern ssize_t afs_listxattr(struct dentry , char , size_t);
1513		1512
1514	/*	1513	/*
1515	* yfsclient.c	1514	* yfsclient.c

fs/afs/mntpt.c+0−1

@@ -32,7 +32,6 @@ const struct inode_operations afs_mntpt_inode_operations = { · 31 unmodified lines
32	.lookup = afs_mntpt_lookup,	32	.lookup = afs_mntpt_lookup,
33	.readlink = page_readlink,	33	.readlink = page_readlink,
34	.getattr = afs_getattr,	34	.getattr = afs_getattr,
35	.listxattr = afs_listxattr,
36	};	35	};
37		36
38	const struct inode_operations afs_autocell_inode_operations = {	37	const struct inode_operations afs_autocell_inode_operations = {

fs/afs/xattr.c+7−24

 #include <linux/xattr.h>
 #include "internal.h"
-static const char afs_xattr_list[] =
-	"afs.acl\0"
-	"afs.cell\0"
-	"afs.fid\0"
-	"afs.volume\0"
-	"afs.yfs.acl\0"
-	"afs.yfs.acl_inherited\0"
-	"afs.yfs.acl_num_cleaned\0"
-	"afs.yfs.vol_acl";
-/*
- * Retrieve a list of the supported xattrs.
- */
-ssize_t afs_listxattr(struct dentry *dentry, char *buffer, size_t size)
-{
-	if (size == 0)
-		return sizeof(afs_xattr_list);
-	if (size < sizeof(afs_xattr_list))
-		return -ERANGE;
-	memcpy(buffer, afs_xattr_list, sizeof(afs_xattr_list));
-	return sizeof(afs_xattr_list);
-}
 /*
  * Deal with the result of a successful fetch ACL operation.
  */
 			else
 				ret = -ERANGE;
 		}
+	} else if (ret == -ENOTSUPP) {
+		ret = -ENODATA;
 	}
 error_yacl:
 {
 	struct afs_operation *op;
 	struct afs_vnode *vnode = AFS_FS_I(inode);
+	int ret;
 	if (flags == XATTR_CREATE ||
 	    strcmp(name, "acl") != 0)
 		return afs_put_operation(op);
 	op->ops = &yfs_store_opaque_acl2_operation;
-	return afs_do_sync_operation(op);
+	ret = afs_do_sync_operation(op);
+	if (ret == -ENOTSUPP)
+		ret = -ENODATA;
+	return ret;
 }
 static const struct xattr_handler afs_xattr_yfs_handler = {

fs/binfmt_misc.c+14−15

 	struct super_block *sb = file_inode(file)->i_sb;
 	struct dentry *root = sb->s_root, *dentry;
 	int err = 0;
+	struct file *f = NULL;
 	e = create_entry(buffer, count);
 	if (IS_ERR(e))
 		return PTR_ERR(e);
+	if (e->flags & MISC_FMT_OPEN_FILE) {
+		f = open_exec(e->interpreter);
+		if (IS_ERR(f)) {
+			pr_notice("register: failed to install interpreter file %s\n",
+				 e->interpreter);
+			kfree(e);
+			return PTR_ERR(f);
+		}
+		e->interp_file = f;
+	}
 	inode_lock(d_inode(root));
 	dentry = lookup_one_len(e->name, root, strlen(e->name));
 	err = PTR_ERR(dentry);
 		goto out2;
 	}
-	if (e->flags & MISC_FMT_OPEN_FILE) {
-		struct file *f;
-		f = open_exec(e->interpreter);
-		if (IS_ERR(f)) {
-			err = PTR_ERR(f);
-			pr_notice("register: failed to install interpreter file %s\n", e->interpreter);
-			simple_release_fs(&bm_mnt, &entry_count);
-			iput(inode);
-			inode = NULL;
-			goto out2;
-		}
-		e->interp_file = f;
-	}
 	e->dentry = dget(dentry);
 	inode->i_private = e;
 	inode->i_fop = &bm_entry_operations;
 	inode_unlock(d_inode(root));
 	if (err) {
+		if (f)
+			filp_close(f, NULL);
 		kfree(e);
 		return err;
 	}

fs/block_dev.c+13−4

 	if (!(mode & FMODE_EXCL)) {
 		int err = bd_prepare_to_claim(bdev, truncate_bdev_range);
 		if (err)
-			return err;
+			goto invalidate;
 	}
 	truncate_inode_pages_range(bdev->bd_inode->i_mapping, lstart, lend);
 	if (!(mode & FMODE_EXCL))
 		bd_abort_claiming(bdev, truncate_bdev_range);
 	return 0;
+invalidate:
+	/*
+	 * Someone else has handle exclusively open. Try invalidating instead.
+	 * The 'end' argument is inclusive so the rounding is safe.
+	 */
+	return invalidate_inode_pages2_range(bdev->bd_inode->i_mapping,
+					     lstart >> PAGE_SHIFT,
+					     lend >> PAGE_SHIFT);
 }
 static void set_init_blocksize(struct block_device *bdev)
 		dio->size += bio->bi_iter.bi_size;
 		pos += bio->bi_iter.bi_size;
-		nr_pages = bio_iov_vecs_to_alloc(iter, BIO_MAX_PAGES);
+		nr_pages = bio_iov_vecs_to_alloc(iter, BIO_MAX_VECS);
 		if (!nr_pages) {
 			bool polled = false;
 	if (!iov_iter_count(iter))
 		return 0;
-	nr_pages = bio_iov_vecs_to_alloc(iter, BIO_MAX_PAGES + 1);
+	nr_pages = bio_iov_vecs_to_alloc(iter, BIO_MAX_VECS + 1);
-	if (is_sync_kiocb(iocb) && nr_pages <= BIO_MAX_PAGES)
+	if (is_sync_kiocb(iocb) && nr_pages <= BIO_MAX_VECS)
 		return __blkdev_direct_IO_simple(iocb, iter, nr_pages);
 	return __blkdev_direct_IO(iocb, iter, bio_max_segs(nr_pages));

fs/btrfs/extent_io.c+1−1

@@ -3059,7 +3059,7 @@ struct bio *btrfs_bio_alloc(u64 first_byte) · 3058 unmodified lines
3059	{	3059	{
3060	struct bio *bio;	3060	struct bio *bio;
3061		3061
3062	bio = bio_alloc_bioset(GFP_NOFS, BIO_MAX_PAGES, &btrfs_bioset);	3062	bio = bio_alloc_bioset(GFP_NOFS, BIO_MAX_VECS, &btrfs_bioset);
3063	bio->bi_iter.bi_sector = first_byte >> 9;	3063	bio->bi_iter.bi_sector = first_byte >> 9;
3064	btrfs_io_bio_init(btrfs_io_bio(bio));	3064	btrfs_io_bio_init(btrfs_io_bio(bio));
3065	return bio;	3065	return bio;

fs/btrfs/scrub.c+1−1

@@ -1428,7 +1428,7 @@ static void scrub_recheck_block_on_raid56(struct btrfs_fs_info *fs_info, · 1427 unmodified lines
1428	if (!first_page->dev->bdev)	1428	if (!first_page->dev->bdev)
1429	goto out;	1429	goto out;
1430		1430
1431	bio = btrfs_io_bio_alloc(BIO_MAX_PAGES);	1431	bio = btrfs_io_bio_alloc(BIO_MAX_VECS);
1432	bio_set_dev(bio, first_page->dev->bdev);	1432	bio_set_dev(bio, first_page->dev->bdev);
1433		1433
1434	for (page_num = 0; page_num < sblock->page_count; page_num++) {	1434	for (page_num = 0; page_num < sblock->page_count; page_num++) {

fs/cifs/cifs_debug.c+1−1

@@ -207,7 +207,7 @@ static int cifs_debug_files_proc_show(struct seq_file m, void v) · 206 unmodified lines
207	from_kuid(&init_user_ns, cfile->uid),	207	from_kuid(&init_user_ns, cfile->uid),
208	cfile->dentry);	208	cfile->dentry);
209	#ifdef CONFIG_CIFS_DEBUG2	209	#ifdef CONFIG_CIFS_DEBUG2
210	seq_printf(m, " 0x%llx\n", cfile->fid.mid);	210	seq_printf(m, " %llu\n", cfile->fid.mid);
211	#else	211	#else
212	seq_printf(m, "\n");	212	seq_printf(m, "\n");
213	#endif /* CIFS_DEBUG2 */	213	#endif /* CIFS_DEBUG2 */

fs/cifs/cifsfs.c+1−1

@@ -290,7 +290,7 @@ cifs_statfs(struct dentry dentry, struct kstatfs buf) · 289 unmodified lines
290	rc = server->ops->queryfs(xid, tcon, cifs_sb, buf);	290	rc = server->ops->queryfs(xid, tcon, cifs_sb, buf);
291		291
292	free_xid(xid);	292	free_xid(xid);
293	return 0;	293	return rc;
294	}	294	}
295		295
296	static long cifs_fallocate(struct file *file, int mode, loff_t off, loff_t len)	296	static long cifs_fallocate(struct file *file, int mode, loff_t off, loff_t len)

fs/cifs/cifsglob.h+10−9

fs/cifs/connect.c+7−7

 		spin_lock(&GlobalMid_Lock);
 		list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
 			mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
-			cifs_dbg(FYI, "Clearing mid 0x%llx\n", mid_entry->mid);
+			cifs_dbg(FYI, "Clearing mid %llu\n", mid_entry->mid);
 			kref_get(&mid_entry->refcount);
 			mid_entry->mid_state = MID_SHUTDOWN;
 			list_move(&mid_entry->qhead, &dispose_list);
 		/* now walk dispose list and issue callbacks */
 		list_for_each_safe(tmp, tmp2, &dispose_list) {
 			mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
-			cifs_dbg(FYI, "Callback mid 0x%llx\n", mid_entry->mid);
+			cifs_dbg(FYI, "Callback mid %llu\n", mid_entry->mid);
 			list_del_init(&mid_entry->qhead);
 			mid_entry->callback(mid_entry);
 			cifs_mid_q_entry_release(mid_entry);
 	tcp_ses->min_offload = ctx->min_offload;
 	tcp_ses->tcpStatus = CifsNeedNegotiate;
+	if ((ctx->max_credits < 20) || (ctx->max_credits > 60000))
+		tcp_ses->max_credits = SMB2_MAX_CREDITS_AVAILABLE;
+	else
+		tcp_ses->max_credits = ctx->max_credits;
 	tcp_ses->nr_targets = 1;
 	tcp_ses->ignore_signature = ctx->ignore_signature;
 	/* thread spawned, put it on the list */
 	*nserver = server;
-	if ((ctx->max_credits < 20) || (ctx->max_credits > 60000))
-		server->max_credits = SMB2_MAX_CREDITS_AVAILABLE;
-	else
-		server->max_credits = ctx->max_credits;
 	/* get a reference to a SMB session */
 	ses = cifs_get_smb_ses(server, ctx);
 	if (IS_ERR(ses)) {

fs/cifs/sess.c+1−0

@@ -230,6 +230,7 @@ cifs_ses_add_channel(struct cifs_sb_info cifs_sb, struct cifs_ses ses, · 229 unmodified lines
230	ctx.noautotune = ses->server->noautotune;	230	ctx.noautotune = ses->server->noautotune;
231	ctx.sockopt_tcp_nodelay = ses->server->tcp_nodelay;	231	ctx.sockopt_tcp_nodelay = ses->server->tcp_nodelay;
232	ctx.echo_interval = ses->server->echo_interval / HZ;	232	ctx.echo_interval = ses->server->echo_interval / HZ;
		233	ctx.max_credits = ses->server->max_credits;
233		234
234	/*	235	/*
235	* This will be used for encoding/decoding user/domain/pw	236	* This will be used for encoding/decoding user/domain/pw

fs/cifs/smb2inode.c+1−0

@@ -358,6 +358,7 @@ smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, · 357 unmodified lines
358	if (cfile)	358	if (cfile)
359	goto after_close;	359	goto after_close;
360	/* Close */	360	/* Close */
		361	flags \|= CIFS_CP_CREATE_CLOSE_OP;
361	rqst[num_rqst].rq_iov = &vars->close_iov[0];	362	rqst[num_rqst].rq_iov = &vars->close_iov[0];
362	rqst[num_rqst].rq_nvec = 1;	363	rqst[num_rqst].rq_nvec = 1;
363	rc = SMB2_close_init(tcon, server,	364	rc = SMB2_close_init(tcon, server,

fs/cifs/smb2misc.c+5−5

@@ -767,7 +767,7 @@ smb2_cancelled_close_fid(struct work_struct *work) · 766 unmodified lines
767	int rc;	767	int rc;
768		768
769	if (cancelled->mid)	769	if (cancelled->mid)
770	cifs_tcon_dbg(VFS, "Close unmatched open for MID:%llx\n",	770	cifs_tcon_dbg(VFS, "Close unmatched open for MID:%llu\n",
771	cancelled->mid);	771	cancelled->mid);
772	else	772	else
773	cifs_tcon_dbg(VFS, "Close interrupted close\n");	773	cifs_tcon_dbg(VFS, "Close interrupted close\n");
@@ -844,14 +844,14 @@ smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid, · 70 unmodified lines
844	}	844	}
845		845
846	int	846	int
847	smb2_handle_cancelled_mid(char buffer, struct TCP_Server_Info server)	847	smb2_handle_cancelled_mid(struct mid_q_entry mid, struct TCP_Server_Info server)
848	{	848	{
849	struct smb2_sync_hdr sync_hdr = (struct smb2_sync_hdr )buffer;	849	struct smb2_sync_hdr *sync_hdr = mid->resp_buf;
850	struct smb2_create_rsp rsp = (struct smb2_create_rsp )buffer;	850	struct smb2_create_rsp *rsp = mid->resp_buf;
851	struct cifs_tcon *tcon;	851	struct cifs_tcon *tcon;
852	int rc;	852	int rc;
853		853
854	if (sync_hdr->Command != SMB2_CREATE \|\|	854	if ((mid->optype & CIFS_CP_CREATE_CLOSE_OP) \|\| sync_hdr->Command != SMB2_CREATE \|\|
855	sync_hdr->Status != STATUS_SUCCESS)	855	sync_hdr->Status != STATUS_SUCCESS)
856	return 0;	856	return 0;
857		857

fs/cifs/smb2ops.c+5−5

@@ -1195,7 +1195,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, · 1194 unmodified lines
1195	struct TCP_Server_Info *server = cifs_pick_channel(ses);	1195	struct TCP_Server_Info *server = cifs_pick_channel(ses);
1196	__le16 *utf16_path = NULL;	1196	__le16 *utf16_path = NULL;
1197	int ea_name_len = strlen(ea_name);	1197	int ea_name_len = strlen(ea_name);
1198	int flags = 0;	1198	int flags = CIFS_CP_CREATE_CLOSE_OP;
1199	int len;	1199	int len;
1200	struct smb_rqst rqst[3];	1200	struct smb_rqst rqst[3];
1201	int resp_buftype[3];	1201	int resp_buftype[3];
@@ -1573,7 +1573,7 @@ smb2_ioctl_query_info(const unsigned int xid, · 371 unmodified lines
1573	struct smb_query_info qi;	1573	struct smb_query_info qi;
1574	struct smb_query_info __user *pqi;	1574	struct smb_query_info __user *pqi;
1575	int rc = 0;	1575	int rc = 0;
1576	int flags = 0;	1576	int flags = CIFS_CP_CREATE_CLOSE_OP;
1577	struct smb2_query_info_rsp *qi_rsp = NULL;	1577	struct smb2_query_info_rsp *qi_rsp = NULL;
1578	struct smb2_ioctl_rsp *io_rsp = NULL;	1578	struct smb2_ioctl_rsp *io_rsp = NULL;
1579	void *buffer = NULL;	1579	void *buffer = NULL;
@@ -2577,7 +2577,7 @@ smb2_query_info_compound(const unsigned int xid, struct cifs_tcon *tcon, · 997 unmodified lines
2577	{	2577	{
2578	struct cifs_ses *ses = tcon->ses;	2578	struct cifs_ses *ses = tcon->ses;
2579	struct TCP_Server_Info *server = cifs_pick_channel(ses);	2579	struct TCP_Server_Info *server = cifs_pick_channel(ses);
2580	int flags = 0;	2580	int flags = CIFS_CP_CREATE_CLOSE_OP;
2581	struct smb_rqst rqst[3];	2581	struct smb_rqst rqst[3];
2582	int resp_buftype[3];	2582	int resp_buftype[3];
2583	struct kvec rsp_iov[3];	2583	struct kvec rsp_iov[3];
@@ -2975,7 +2975,7 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon, · 391 unmodified lines
2975	unsigned int sub_offset;	2975	unsigned int sub_offset;
2976	unsigned int print_len;	2976	unsigned int print_len;
2977	unsigned int print_offset;	2977	unsigned int print_offset;
2978	int flags = 0;	2978	int flags = CIFS_CP_CREATE_CLOSE_OP;
2979	struct smb_rqst rqst[3];	2979	struct smb_rqst rqst[3];
2980	int resp_buftype[3];	2980	int resp_buftype[3];
2981	struct kvec rsp_iov[3];	2981	struct kvec rsp_iov[3];
@@ -3157,7 +3157,7 @@ smb2_query_reparse_tag(const unsigned int xid, struct cifs_tcon *tcon, · 175 unmodified lines
3157	struct cifs_open_parms oparms;	3157	struct cifs_open_parms oparms;
3158	struct cifs_fid fid;	3158	struct cifs_fid fid;
3159	struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses);	3159	struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses);
3160	int flags = 0;	3160	int flags = CIFS_CP_CREATE_CLOSE_OP;
3161	struct smb_rqst rqst[3];	3161	struct smb_rqst rqst[3];
3162	int resp_buftype[3];	3162	int resp_buftype[3];
3163	struct kvec rsp_iov[3];	3163	struct kvec rsp_iov[3];

fs/cifs/smb2pdu.c+2−4

 	if (rdata->credits.value > 0) {
 		shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes,
 						SMB2_MAX_BUFFER_SIZE));
-		shdr->CreditRequest =
+		shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8);
-			cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1);
 		rc = adjust_credits(server, &rdata->credits, rdata->bytes);
 		if (rc)
 	if (wdata->credits.value > 0) {
 		shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes,
 						    SMB2_MAX_BUFFER_SIZE));
-		shdr->CreditRequest =
+		shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8);
-			cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1);
 		rc = adjust_credits(server, &wdata->credits, wdata->bytes);
 		if (rc)

fs/cifs/smb2proto.h+1−2

 extern int smb2_handle_cancelled_close(struct cifs_tcon *tcon,
 				       __u64 persistent_fid,
 				       __u64 volatile_fid);
-extern int smb2_handle_cancelled_mid(char *buffer,
+extern int smb2_handle_cancelled_mid(struct mid_q_entry *mid, struct TCP_Server_Info *server);
-					struct TCP_Server_Info *server);
 void smb2_cancelled_close_fid(struct work_struct *work);
 extern int SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon,
 			 u64 persistent_file_id, u64 volatile_file_id,

fs/cifs/transport.c+2−2

@@ -101,7 +101,7 @@ static void _cifs_mid_q_entry_release(struct kref *refcount) · 100 unmodified lines
101	if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) &&	101	if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) &&
102	midEntry->mid_state == MID_RESPONSE_RECEIVED &&	102	midEntry->mid_state == MID_RESPONSE_RECEIVED &&
103	server->ops->handle_cancelled_mid)	103	server->ops->handle_cancelled_mid)
104	server->ops->handle_cancelled_mid(midEntry->resp_buf, server);	104	server->ops->handle_cancelled_mid(midEntry, server);
105		105
106	midEntry->mid_state = MID_FREE;	106	midEntry->mid_state = MID_FREE;
107	atomic_dec(&midCount);	107	atomic_dec(&midCount);
@@ -1207,7 +1207,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, · 1099 unmodified lines
1207	}	1207	}
1208	if (rc != 0) {	1208	if (rc != 0) {
1209	for (; i < num_rqst; i++) {	1209	for (; i < num_rqst; i++) {
1210	cifs_server_dbg(VFS, "Cancelling wait for mid %llu cmd: %d\n",	1210	cifs_server_dbg(FYI, "Cancelling wait for mid %llu cmd: %d\n",
1211	midQ[i]->mid, le16_to_cpu(midQ[i]->command));	1211	midQ[i]->mid, le16_to_cpu(midQ[i]->command));
1212	send_cancel(server, &rqst[i], midQ[i]);	1212	send_cancel(server, &rqst[i], midQ[i]);
1213	spin_lock(&GlobalMid_Lock);	1213	spin_lock(&GlobalMid_Lock);

fs/configfs/file.c+2−4

 	attr = to_attr(dentry);
 	if (!attr)
-		goto out_put_item;
+		goto out_free_buffer;
 	if (type & CONFIGFS_ITEM_BIN_ATTR) {
 		buffer->bin_attr = to_bin_attr(dentry);
 	/* Grab the module reference for this attribute if we have one */
 	error = -ENODEV;
 	if (!try_module_get(buffer->owner))
-		goto out_put_item;
+		goto out_free_buffer;
 	error = -EACCES;
 	if (!buffer->item->ci_type)
 out_put_module:
 	module_put(buffer->owner);
-out_put_item:
-	config_item_put(buffer->item);
 out_free_buffer:
 	up_read(&frag->frag_sem);
 	kfree(buffer);

fs/crypto/bio.c+3−3

@@ -52,7 +52,7 @@ static int fscrypt_zeroout_range_inline_crypt(const struct inode *inode, · 51 unmodified lines
52	int num_pages = 0;	52	int num_pages = 0;
53		53
54	/* This always succeeds since __GFP_DIRECT_RECLAIM is set. */	54	/* This always succeeds since __GFP_DIRECT_RECLAIM is set. */
55	bio = bio_alloc(GFP_NOFS, BIO_MAX_PAGES);	55	bio = bio_alloc(GFP_NOFS, BIO_MAX_VECS);
56		56
57	while (len) {	57	while (len) {
58	unsigned int blocks_this_page = min(len, blocks_per_page);	58	unsigned int blocks_this_page = min(len, blocks_per_page);
@@ -74,7 +74,7 @@ static int fscrypt_zeroout_range_inline_crypt(const struct inode *inode, · 15 unmodified lines
74	len -= blocks_this_page;	74	len -= blocks_this_page;
75	lblk += blocks_this_page;	75	lblk += blocks_this_page;
76	pblk += blocks_this_page;	76	pblk += blocks_this_page;
77	if (num_pages == BIO_MAX_PAGES \|\| !len \|\|	77	if (num_pages == BIO_MAX_VECS \|\| !len \|\|
78	!fscrypt_mergeable_bio(bio, inode, lblk)) {	78	!fscrypt_mergeable_bio(bio, inode, lblk)) {
79	err = submit_bio_wait(bio);	79	err = submit_bio_wait(bio);
80	if (err)	80	if (err)
@@ -126,7 +126,7 @@ int fscrypt_zeroout_range(const struct inode *inode, pgoff_t lblk, · 45 unmodified lines
126	return fscrypt_zeroout_range_inline_crypt(inode, lblk, pblk,	126	return fscrypt_zeroout_range_inline_crypt(inode, lblk, pblk,
127	len);	127	len);
128		128
129	BUILD_BUG_ON(ARRAY_SIZE(pages) > BIO_MAX_PAGES);	129	BUILD_BUG_ON(ARRAY_SIZE(pages) > BIO_MAX_VECS);
130	nr_pages = min_t(unsigned int, ARRAY_SIZE(pages),	130	nr_pages = min_t(unsigned int, ARRAY_SIZE(pages),
131	(len + blocks_per_page - 1) >> blocks_per_page_bits);	131	(len + blocks_per_page - 1) >> blocks_per_page_bits);
132		132

fs/erofs/data.c+11−17

@@ -129,6 +129,7 @@ static inline struct bio erofs_read_raw_page(struct bio bio, · 128 unmodified lines
129	struct page *page,	129	struct page *page,
130	erofs_off_t *last_block,	130	erofs_off_t *last_block,
131	unsigned int nblocks,	131	unsigned int nblocks,
		132	unsigned int *eblks,
132	bool ra)	133	bool ra)
133	{	134	{
134	struct inode *const inode = mapping->host;	135	struct inode *const inode = mapping->host;
@@ -145,8 +146,7 @@ static inline struct bio erofs_read_raw_page(struct bio bio, · 10 unmodified lines
145		146
146	/* note that for readpage case, bio also equals to NULL */	147	/* note that for readpage case, bio also equals to NULL */
147	if (bio &&	148	if (bio &&
148	/* not continuous */	149	(last_block + 1 != current_block \|\| !eblks)) {
149	*last_block + 1 != current_block) {
150	submit_bio_retry:	150	submit_bio_retry:
151	submit_bio(bio);	151	submit_bio(bio);
152	bio = NULL;	152	bio = NULL;
@@ -216,7 +216,8 @@ submit_bio_retry: · 63 unmodified lines
216	if (nblocks > DIV_ROUND_UP(map.m_plen, PAGE_SIZE))	216	if (nblocks > DIV_ROUND_UP(map.m_plen, PAGE_SIZE))
217	nblocks = DIV_ROUND_UP(map.m_plen, PAGE_SIZE);	217	nblocks = DIV_ROUND_UP(map.m_plen, PAGE_SIZE);
218		218
219	bio = bio_alloc(GFP_NOIO, bio_max_segs(nblocks));	219	*eblks = bio_max_segs(nblocks);
		220	bio = bio_alloc(GFP_NOIO, *eblks);
220		221
221	bio->bi_end_io = erofs_readendio;	222	bio->bi_end_io = erofs_readendio;
222	bio_set_dev(bio, sb->s_bdev);	223	bio_set_dev(bio, sb->s_bdev);
@@ -229,16 +230,8 @@ submit_bio_retry: · 6 unmodified lines
229	/* out of the extent or bio is full */	230	/* out of the extent or bio is full */
230	if (err < PAGE_SIZE)	231	if (err < PAGE_SIZE)
231	goto submit_bio_retry;	232	goto submit_bio_retry;
232		233	--*eblks;
233	*last_block = current_block;	234	*last_block = current_block;
234
235	/* shift in advance in case of it followed by too many gaps */
236	if (bio->bi_iter.bi_size >= bio->bi_max_vecs * PAGE_SIZE) {
237	/* err should reassign to 0 after submitting */
238	err = 0;
239	goto submit_bio_out;
240	}
241
242	return bio;	235	return bio;
243		236
244	err_out:	237	err_out:
@@ -252,7 +245,6 @@ has_updated: · 7 unmodified lines
252		245
253	/* if updated manually, continuous pages has a gap */	246	/* if updated manually, continuous pages has a gap */
254	if (bio)	247	if (bio)
255	submit_bio_out:
256	submit_bio(bio);	248	submit_bio(bio);
257	return err ? ERR_PTR(err) : NULL;	249	return err ? ERR_PTR(err) : NULL;
258	}	250	}
@@ -264,23 +256,26 @@ submit_bio_out: · 5 unmodified lines
264	static int erofs_raw_access_readpage(struct file file, struct page page)	256	static int erofs_raw_access_readpage(struct file file, struct page page)
265	{	257	{
266	erofs_off_t last_block;	258	erofs_off_t last_block;
		259	unsigned int eblks;
267	struct bio *bio;	260	struct bio *bio;
268		261
269	trace_erofs_readpage(page, true);	262	trace_erofs_readpage(page, true);
270		263
271	bio = erofs_read_raw_page(NULL, page->mapping,	264	bio = erofs_read_raw_page(NULL, page->mapping,
272	page, &last_block, 1, false);	265	page, &last_block, 1, &eblks, false);
273		266
274	if (IS_ERR(bio))	267	if (IS_ERR(bio))
275	return PTR_ERR(bio);	268	return PTR_ERR(bio);
276		269
277	DBG_BUGON(bio); /* since we have only one bio -- must be NULL */	270	if (bio)
		271	submit_bio(bio);
278	return 0;	272	return 0;
279	}	273	}
280		274
281	static void erofs_raw_access_readahead(struct readahead_control *rac)	275	static void erofs_raw_access_readahead(struct readahead_control *rac)
282	{	276	{
283	erofs_off_t last_block;	277	erofs_off_t last_block;
		278	unsigned int eblks;
284	struct bio *bio = NULL;	279	struct bio *bio = NULL;
285	struct page *page;	280	struct page *page;
286		281
@@ -291,7 +286,7 @@ static void erofs_raw_access_readahead(struct readahead_control *rac) · 4 unmodified lines
291	prefetchw(&page->flags);	286	prefetchw(&page->flags);
292		287
293	bio = erofs_read_raw_page(bio, rac->mapping, page, &last_block,	288	bio = erofs_read_raw_page(bio, rac->mapping, page, &last_block,
294	readahead_count(rac), true);	289	readahead_count(rac), &eblks, true);
295		290
296	/* all the page errors are ignored when readahead */	291	/* all the page errors are ignored when readahead */
297	if (IS_ERR(bio)) {	292	if (IS_ERR(bio)) {
@@ -305,7 +300,6 @@ static void erofs_raw_access_readahead(struct readahead_control *rac) · 7 unmodified lines
305	put_page(page);	300	put_page(page);
306	}	301	}
307		302
308	/* the rare case (end in gaps) */
309	if (bio)	303	if (bio)
310	submit_bio(bio);	304	submit_bio(bio);
311	}	305	}

fs/erofs/zdata.c+1−1

@@ -1235,7 +1235,7 @@ submit_bio_retry: · 1234 unmodified lines
1235	}	1235	}
1236		1236
1237	if (!bio) {	1237	if (!bio) {
1238	bio = bio_alloc(GFP_NOIO, BIO_MAX_PAGES);	1238	bio = bio_alloc(GFP_NOIO, BIO_MAX_VECS);
1239		1239
1240	bio->bi_end_io = z_erofs_decompressqueue_endio;	1240	bio->bi_end_io = z_erofs_decompressqueue_endio;
1241	bio_set_dev(bio, sb->s_bdev);	1241	bio_set_dev(bio, sb->s_bdev);

fs/ext4/page-io.c+1−1

@@ -398,7 +398,7 @@ static void io_submit_init_bio(struct ext4_io_submit *io, · 397 unmodified lines
398	* bio_alloc will _always_ be able to allocate a bio if	398	* bio_alloc will _always_ be able to allocate a bio if
399	* __GFP_DIRECT_RECLAIM is set, see comments for bio_alloc_bioset().	399	* __GFP_DIRECT_RECLAIM is set, see comments for bio_alloc_bioset().
400	*/	400	*/
401	bio = bio_alloc(GFP_NOIO, BIO_MAX_PAGES);	401	bio = bio_alloc(GFP_NOIO, BIO_MAX_VECS);
402	fscrypt_set_bio_crypt_ctx_bh(bio, bh, GFP_NOIO);	402	fscrypt_set_bio_crypt_ctx_bh(bio, bh, GFP_NOIO);
403	bio->bi_iter.bi_sector = bh->b_blocknr * (bh->b_size >> 9);	403	bio->bi_iter.bi_sector = bh->b_blocknr * (bh->b_size >> 9);
404	bio_set_dev(bio, bh->b_bdev);	404	bio_set_dev(bio, bh->b_bdev);

fs/f2fs/checkpoint.c+1−1

@@ -292,7 +292,7 @@ void f2fs_ra_meta_pages_cond(struct f2fs_sb_info *sbi, pgoff_t index) · 291 unmodified lines
292	f2fs_put_page(page, 0);	292	f2fs_put_page(page, 0);
293		293
294	if (readahead)	294	if (readahead)
295	f2fs_ra_meta_pages(sbi, index, BIO_MAX_PAGES, META_POR, true);	295	f2fs_ra_meta_pages(sbi, index, BIO_MAX_VECS, META_POR, true);
296	}	296	}
297		297
298	static int __f2fs_write_meta_page(struct page *page,	298	static int __f2fs_write_meta_page(struct page *page,

fs/f2fs/data.c+2−2

@@ -857,7 +857,7 @@ int f2fs_merge_page_bio(struct f2fs_io_info *fio) · 856 unmodified lines
857	f2fs_submit_merged_ipu_write(fio->sbi, &bio, NULL);	857	f2fs_submit_merged_ipu_write(fio->sbi, &bio, NULL);
858	alloc_new:	858	alloc_new:
859	if (!bio) {	859	if (!bio) {
860	bio = __bio_alloc(fio, BIO_MAX_PAGES);	860	bio = __bio_alloc(fio, BIO_MAX_VECS);
861	__attach_io_flag(fio);	861	__attach_io_flag(fio);
862	f2fs_set_bio_crypt_ctx(bio, fio->page->mapping->host,	862	f2fs_set_bio_crypt_ctx(bio, fio->page->mapping->host,
863	fio->page->index, fio, GFP_NOIO);	863	fio->page->index, fio, GFP_NOIO);
@@ -932,7 +932,7 @@ alloc_new: · 68 unmodified lines
932	fio->retry = true;	932	fio->retry = true;
933	goto skip;	933	goto skip;
934	}	934	}
935	io->bio = __bio_alloc(fio, BIO_MAX_PAGES);	935	io->bio = __bio_alloc(fio, BIO_MAX_VECS);
936	f2fs_set_bio_crypt_ctx(io->bio, fio->page->mapping->host,	936	f2fs_set_bio_crypt_ctx(io->bio, fio->page->mapping->host,
937	bio_page->index, fio, GFP_NOIO);	937	bio_page->index, fio, GFP_NOIO);
938	io->fio = *fio;	938	io->fio = *fio;

fs/f2fs/segment.c+1−1

@@ -4381,7 +4381,7 @@ static int build_sit_entries(struct f2fs_sb_info *sbi) · 4380 unmodified lines
4381	block_t total_node_blocks = 0;	4381	block_t total_node_blocks = 0;
4382		4382
4383	do {	4383	do {
4384	readed = f2fs_ra_meta_pages(sbi, start_blk, BIO_MAX_PAGES,	4384	readed = f2fs_ra_meta_pages(sbi, start_blk, BIO_MAX_VECS,
4385	META_SIT, true);	4385	META_SIT, true);
4386		4386
4387	start = start_blk * sit_i->sents_per_block;	4387	start = start_blk * sit_i->sents_per_block;

fs/f2fs/segment.h+2−2

@@ -851,7 +851,7 @@ static inline int nr_pages_to_skip(struct f2fs_sb_info *sbi, int type) · 850 unmodified lines
851	else if (type == NODE)	851	else if (type == NODE)
852	return 8 * sbi->blocks_per_seg;	852	return 8 * sbi->blocks_per_seg;
853	else if (type == META)	853	else if (type == META)
854	return 8 * BIO_MAX_PAGES;	854	return 8 * BIO_MAX_VECS;
855	else	855	else
856	return 0;	856	return 0;
857	}	857	}
@@ -868,7 +868,7 @@ static inline long nr_pages_to_write(struct f2fs_sb_info *sbi, int type, · 10 unmodified lines
868	return 0;	868	return 0;
869		869
870	nr_to_write = wbc->nr_to_write;	870	nr_to_write = wbc->nr_to_write;
871	desired = BIO_MAX_PAGES;	871	desired = BIO_MAX_VECS;
872	if (type == NODE)	872	if (type == NODE)
873	desired <<= 1;	873	desired <<= 1;
874		874

fs/f2fs/super.c+2−2

@@ -753,9 +753,9 @@ static int parse_options(struct super_block sb, char options, bool is_remount) · 752 unmodified lines
753	case Opt_io_size_bits:	753	case Opt_io_size_bits:
754	if (args->from && match_int(args, &arg))	754	if (args->from && match_int(args, &arg))
755	return -EINVAL;	755	return -EINVAL;
756	if (arg <= 0 \|\| arg > __ilog2_u32(BIO_MAX_PAGES)) {	756	if (arg <= 0 \|\| arg > __ilog2_u32(BIO_MAX_VECS)) {
757	f2fs_warn(sbi, "Not support %d, larger than %d",	757	f2fs_warn(sbi, "Not support %d, larger than %d",
758	1 << arg, BIO_MAX_PAGES);	758	1 << arg, BIO_MAX_VECS);
759	return -EINVAL;	759	return -EINVAL;
760	}	760	}
761	F2FS_OPTION(sbi).write_io_size_bits = arg;	761	F2FS_OPTION(sbi).write_io_size_bits = arg;

fs/fuse/dev.c+16−10

 static long fuse_dev_ioctl(struct file *file, unsigned int cmd,
 			   unsigned long arg)
 {
-	int err = -ENOTTY;
+	int res;
+	int oldfd;
+	struct fuse_dev *fud = NULL;
-	if (cmd == FUSE_DEV_IOC_CLONE) {
+	if (_IOC_TYPE(cmd) != FUSE_DEV_IOC_MAGIC)
-		int oldfd;
+		return -ENOTTY;
-		err = -EFAULT;
+	switch (_IOC_NR(cmd)) {
-		if (!get_user(oldfd, (__u32 __user *) arg)) {
+	case _IOC_NR(FUSE_DEV_IOC_CLONE):
+		res = -EFAULT;
+		if (!get_user(oldfd, (__u32 __user *)arg)) {
 			struct file *old = fget(oldfd);
-			err = -EINVAL;
+			res = -EINVAL;
 			if (old) {
-				struct fuse_dev *fud = NULL;
 				/*
 				 * Check against file->f_op because CUSE
 				 * uses the same ioctl handler.
 				if (fud) {
 					mutex_lock(&fuse_mutex);
-					err = fuse_device_clone(fud->fc, file);
+					res = fuse_device_clone(fud->fc, file);
 					mutex_unlock(&fuse_mutex);
 				}
 				fput(old);
 			}
 		}
+		break;
+	default:
+		res = -ENOTTY;
+		break;
 	}
-	return err;
+	return res;
 }
 const struct file_operations fuse_dev_operations = {

fs/fuse/fuse_i.h+1−0

@@ -863,6 +863,7 @@ static inline u64 fuse_get_attr_version(struct fuse_conn *fc) · 862 unmodified lines
863		863
864	static inline void fuse_make_bad(struct inode *inode)	864	static inline void fuse_make_bad(struct inode *inode)
865	{	865	{
		866	remove_inode_hash(inode);
866	set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state);	867	set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state);
867	}	868	}
868		869

fs/fuse/virtio_fs.c+8−1

 	/* virtiofs allocates and installs its own fuse devices */
 	ctx->fudptr = NULL;
-	if (ctx->dax)
+	if (ctx->dax) {
+		if (!fs->dax_dev) {
+			err = -EINVAL;
+			pr_err("virtio-fs: dax can't be enabled as filesystem"
+			       " device does not support it.\n");
+			goto err_free_fuse_devs;
+		}
 		ctx->dax_dev = fs->dax_dev;
+	}
 	err = fuse_fill_super_common(sb, ctx);
 	if (err < 0)
 		goto err_free_fuse_devs;

fs/gfs2/log.c+5−1

 	while (!list_empty(head)) {
 		bd = list_first_entry(head, struct gfs2_bufdata, bd_list);
 		list_del_init(&bd->bd_list);
+		if (!list_empty(&bd->bd_ail_st_list))
+			gfs2_remove_from_ail(bd);
 		kmem_cache_free(gfs2_bufdata_cachep, bd);
 	}
 	head = &tr->tr_databuf;
 	while (!list_empty(head)) {
 		bd = list_first_entry(head, struct gfs2_bufdata, bd_list);
 		list_del_init(&bd->bd_list);
+		if (!list_empty(&bd->bd_ail_st_list))
+			gfs2_remove_from_ail(bd);
 		kmem_cache_free(gfs2_bufdata_cachep, bd);
 	}
 }
 	 * Do this check while holding the log_flush_lock to prevent new
 	 * buffers from being added to the ail via gfs2_pin()
 	 */
-	if (gfs2_withdrawn(sdp))
+	if (gfs2_withdrawn(sdp) || !test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags))
 		goto out;
 	/* Log might have been flushed while we waited for the flush lock */

fs/gfs2/lops.c+1−1

@@ -267,7 +267,7 @@ static struct bio gfs2_log_alloc_bio(struct gfs2_sbd sdp, u64 blkno, · 266 unmodified lines
267	bio_end_io_t *end_io)	267	bio_end_io_t *end_io)
268	{	268	{
269	struct super_block *sb = sdp->sd_vfs;	269	struct super_block *sb = sdp->sd_vfs;
270	struct bio *bio = bio_alloc(GFP_NOIO, BIO_MAX_PAGES);	270	struct bio *bio = bio_alloc(GFP_NOIO, BIO_MAX_VECS);
271		271
272	bio->bi_iter.bi_sector = blkno << sdp->sd_fsb2bb_shift;	272	bio->bi_iter.bi_sector = blkno << sdp->sd_fsb2bb_shift;
273	bio_set_dev(bio, sb->s_bdev);	273	bio_set_dev(bio, sb->s_bdev);

fs/gfs2/ops_fstype.c+1−3

 			return -EINVAL;
 		if (fc->sb_flags & SB_RDONLY) {
-			error = gfs2_make_fs_ro(sdp);
+			gfs2_make_fs_ro(sdp);
-			if (error)
-				errorfc(fc, "unable to remount read-only");
 		} else {
 			error = gfs2_make_fs_rw(sdp);
 			if (error)

fs/gfs2/super.c+2−8

  * Returns: errno
  */
-int gfs2_make_fs_ro(struct gfs2_sbd *sdp)
+void gfs2_make_fs_ro(struct gfs2_sbd *sdp)
 {
-	int error = 0;
 	int log_write_allowed = test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags);
 	gfs2_flush_delete_work(sdp);
 	if (!log_write_allowed)
 		sdp->sd_vfs->s_flags |= SB_RDONLY;
-	return error;
 }
 /**
 static void gfs2_put_super(struct super_block *sb)
 {
 	struct gfs2_sbd *sdp = sb->s_fs_info;
-	int error;
 	struct gfs2_jdesc *jd;
 	/* No more recovery requests */
 	spin_unlock(&sdp->sd_jindex_spin);
 	if (!sb_rdonly(sb)) {
-		error = gfs2_make_fs_ro(sdp);
+		gfs2_make_fs_ro(sdp);
-		if (error)
-			gfs2_io_error(sdp);
 	}
 	WARN_ON(gfs2_withdrawing(sdp));

fs/gfs2/super.h+1−1

@@ -34,7 +34,7 @@ extern int gfs2_lookup_in_master_dir(struct gfs2_sbd sdp, char filename, · 33 unmodified lines
34	struct gfs2_inode **ipp);	34	struct gfs2_inode **ipp);
35		35
36	extern int gfs2_make_fs_rw(struct gfs2_sbd *sdp);	36	extern int gfs2_make_fs_rw(struct gfs2_sbd *sdp);
37	extern int gfs2_make_fs_ro(struct gfs2_sbd *sdp);	37	extern void gfs2_make_fs_ro(struct gfs2_sbd *sdp);
38	extern void gfs2_online_uevent(struct gfs2_sbd *sdp);	38	extern void gfs2_online_uevent(struct gfs2_sbd *sdp);
39	extern int gfs2_statfs_init(struct gfs2_sbd *sdp);	39	extern int gfs2_statfs_init(struct gfs2_sbd *sdp);
40	extern void gfs2_statfs_change(struct gfs2_sbd *sdp, s64 total, s64 free,	40	extern void gfs2_statfs_change(struct gfs2_sbd *sdp, s64 total, s64 free,

fs/gfs2/trans.c+2−0

 	bd->bd_bh = bh;
 	bd->bd_gl = gl;
 	INIT_LIST_HEAD(&bd->bd_list);
+	INIT_LIST_HEAD(&bd->bd_ail_st_list);
+	INIT_LIST_HEAD(&bd->bd_ail_gl_list);
 	bh->b_private = bd;
 	return bd;
 }

fs/gfs2/util.c+11−6

 static void signal_our_withdraw(struct gfs2_sbd *sdp)
 {
 	struct gfs2_glock *live_gl = sdp->sd_live_gh.gh_gl;
-	struct inode *inode = sdp->sd_jdesc->jd_inode;
+	struct inode *inode;
-	struct gfs2_inode *ip = GFS2_I(inode);
+	struct gfs2_inode *ip;
-	struct gfs2_glock *i_gl = ip->i_gl;
+	struct gfs2_glock *i_gl;
-	u64 no_formal_ino = ip->i_no_formal_ino;
+	u64 no_formal_ino;
 	int log_write_allowed = test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags);
 	int ret = 0;
 	int tries;
-	if (test_bit(SDF_NORECOVERY, &sdp->sd_flags))
+	if (test_bit(SDF_NORECOVERY, &sdp->sd_flags) || !sdp->sd_jdesc)
 		return;
+	inode = sdp->sd_jdesc->jd_inode;
+	ip = GFS2_I(inode);
+	i_gl = ip->i_gl;
+	no_formal_ino = ip->i_no_formal_ino;
 	/* Prevent any glock dq until withdraw recovery is complete */
 	set_bit(SDF_WITHDRAW_RECOVERY, &sdp->sd_flags);
 	/*
 				ret = 0;
 		}
 		if (!ret)
-			ret = gfs2_make_fs_ro(sdp);
+			gfs2_make_fs_ro(sdp);
 		gfs2_freeze_unlock(&freeze_gh);
 	}

fs/io-wq.c+12−13

 	io_wq_work_fn *do_work;
 	struct task_struct *manager;
-	struct user_struct *user;
 	struct io_wq_hash *hash;
 	tsk->pf_io_worker = worker;
 	worker->task = tsk;
 	set_cpus_allowed_ptr(tsk, cpumask_of_node(wqe->node));
-	tsk->flags |= PF_NOFREEZE | PF_NO_SETAFFINITY;
+	tsk->flags |= PF_NO_SETAFFINITY;
 	raw_spin_lock_irq(&wqe->lock);
 	hlist_nulls_add_head_rcu(&worker->nulls_node, &wqe->free_list);
 		set_current_state(TASK_INTERRUPTIBLE);
 		io_wq_check_workers(wq);
 		schedule_timeout(HZ);
-		try_to_freeze();
 		if (fatal_signal_pending(current))
 			set_bit(IO_WQ_BIT_EXIT, &wq->state);
 	} while (!test_bit(IO_WQ_BIT_EXIT, &wq->state));
 		io_wq_for_each_worker(wq->wqes[node], io_wq_worker_wake, NULL);
 	rcu_read_unlock();
-	/* we might not ever have created any workers */
+	if (atomic_dec_and_test(&wq->worker_refs))
-	if (atomic_read(&wq->worker_refs))
+		complete(&wq->worker_done);
-		wait_for_completion(&wq->worker_done);
+	wait_for_completion(&wq->worker_done);
 	spin_lock_irq(&wq->hash->wait.lock);
 	for_each_node(node)
 	if (wq->manager)
 		return 0;
-	reinit_completion(&wq->worker_done);
+	WARN_ON_ONCE(test_bit(IO_WQ_BIT_EXIT, &wq->state));
+	init_completion(&wq->worker_done);
+	atomic_set(&wq->worker_refs, 1);
 	tsk = create_io_thread(io_wq_manager, wq, NUMA_NO_NODE);
 	if (!IS_ERR(tsk)) {
 		wq->manager = get_task_struct(tsk);
 		return 0;
 	}
+	if (atomic_dec_and_test(&wq->worker_refs))
+		complete(&wq->worker_done);
 	return PTR_ERR(tsk);
 }
 	/* Can only happen if manager creation fails after exec */
 	if (io_wq_fork_manager(wqe->wq) ||
 	    test_bit(IO_WQ_BIT_EXIT, &wqe->wq->state)) {
-		work->flags |= IO_WQ_WORK_CANCEL;
+		io_run_cancel(work, wqe);
-		wqe->wq->do_work(work);
 		return;
 	}
 	init_completion(&wq->exited);
 	refcount_set(&wq->refs, 1);
-	init_completion(&wq->worker_done);
-	atomic_set(&wq->worker_refs, 0);
 	ret = io_wq_fork_manager(wq);
 	if (!ret)
 		return wq;
 err:
 	io_wq_put_hash(data->hash);
 	cpuhp_state_remove_instance_nocalls(io_wq_online, &wq->cpuhp_node);

fs/io-wq.h+1−1

@@ -79,8 +79,8 @@ static inline void wq_list_del(struct io_wq_work_list *list, · 78 unmodified lines
79		79
80	struct io_wq_work {	80	struct io_wq_work {
81	struct io_wq_work_node list;	81	struct io_wq_work_node list;
		82	const struct cred *creds;
82	unsigned flags;	83	unsigned flags;
83	unsigned short personality;
84	};	84	};
85		85
86	static inline struct io_wq_work wq_next_work(struct io_wq_work work)	86	static inline struct io_wq_work wq_next_work(struct io_wq_work work)

fs/io_uring.c+455−382

@@ -258,12 +258,10 @@ enum { · 257 unmodified lines
258		258
259	struct io_sq_data {	259	struct io_sq_data {
260	refcount_t refs;	260	refcount_t refs;
261	struct mutex lock;	261	struct rw_semaphore rw_lock;
262		262
263	/* ctx's that are using this sqd */	263	/* ctx's that are using this sqd */
264	struct list_head ctx_list;	264	struct list_head ctx_list;
265	struct list_head ctx_new_list;
266	struct mutex ctx_lock;
267		265
268	struct task_struct *thread;	266	struct task_struct *thread;
269	struct wait_queue_head wait;	267	struct wait_queue_head wait;
@@ -271,10 +269,9 @@ struct io_sq_data { · 1 unmodified line
271	unsigned sq_thread_idle;	269	unsigned sq_thread_idle;
272	int sq_cpu;	270	int sq_cpu;
273	pid_t task_pid;	271	pid_t task_pid;
		272	pid_t task_tgid;
274		273
275	unsigned long state;	274	unsigned long state;
276	struct completion startup;
277	struct completion parked;
278	struct completion exited;	275	struct completion exited;
279	};	276	};
280		277
@@ -336,7 +333,6 @@ struct io_ring_ctx { · 55 unmodified lines
336	unsigned int drain_next: 1;	333	unsigned int drain_next: 1;
337	unsigned int eventfd_async: 1;	334	unsigned int eventfd_async: 1;
338	unsigned int restricted: 1;	335	unsigned int restricted: 1;
339	unsigned int sqo_exec: 1;
340		336
341	/*	337	/*
342	* Ring buffer of indices into array of io_uring_sqe, which is	338	* Ring buffer of indices into array of io_uring_sqe, which is
@@ -380,6 +376,7 @@ struct io_ring_ctx { · 37 unmodified lines
380	/* Only used for accounting purposes */	376	/* Only used for accounting purposes */
381	struct mm_struct *mm_account;	377	struct mm_struct *mm_account;
382		378
		379	const struct cred sq_creds; / cred used for __io_sq_thread() */
383	struct io_sq_data sq_data; / if using sq thread polling */	380	struct io_sq_data sq_data; / if using sq thread polling */
384		381
385	struct wait_queue_head sqo_sq_wait;	382	struct wait_queue_head sqo_sq_wait;
@@ -400,7 +397,6 @@ struct io_ring_ctx { · 14 unmodified lines
400	struct user_struct *user;	397	struct user_struct *user;
401		398
402	struct completion ref_comp;	399	struct completion ref_comp;
403	struct completion sq_thread_comp;
404		400
405	#if defined(CONFIG_UNIX)	401	#if defined(CONFIG_UNIX)
406	struct socket *ring_sock;	402	struct socket *ring_sock;
@@ -408,7 +404,8 @@ struct io_ring_ctx { · 1 unmodified line
408		404
409	struct idr io_buffer_idr;	405	struct idr io_buffer_idr;
410		406
411	struct idr personality_idr;	407	struct xarray personalities;
		408	u32 pers_next;
412		409
413	struct {	410	struct {
414	unsigned cached_cq_tail;	411	unsigned cached_cq_tail;
@@ -454,6 +451,7 @@ struct io_ring_ctx { · 39 unmodified lines
454		451
455	/* Keep this last, we don't need it for the fast path */	452	/* Keep this last, we don't need it for the fast path */
456	struct work_struct exit_work;	453	struct work_struct exit_work;
		454	struct list_head tctx_list;
457	};	455	};
458		456
459	/*	457	/*
@@ -805,6 +803,12 @@ struct io_kiocb { · 345 unmodified lines
805	struct io_wq_work work;	803	struct io_wq_work work;
806	};	804	};
807		805
		806	struct io_tctx_node {
		807	struct list_head ctx_node;
		808	struct task_struct *task;
		809	struct io_ring_ctx *ctx;
		810	};
		811
808	struct io_defer_entry {	812	struct io_defer_entry {
809	struct list_head list;	813	struct list_head list;
810	struct io_kiocb *req;	814	struct io_kiocb *req;
@@ -979,6 +983,8 @@ static const struct io_op_def io_op_defs[] = { · 168 unmodified lines
979	[IORING_OP_UNLINKAT] = {},	983	[IORING_OP_UNLINKAT] = {},
980	};	984	};
981		985
		986	static bool io_disarm_next(struct io_kiocb *req);
		987	static void io_uring_del_task_file(unsigned long index);
982	static void io_uring_try_cancel_requests(struct io_ring_ctx *ctx,	988	static void io_uring_try_cancel_requests(struct io_ring_ctx *ctx,
983	struct task_struct *task,	989	struct task_struct *task,
984	struct files_struct *files);	990	struct files_struct *files);
@@ -1129,9 +1135,8 @@ static struct io_ring_ctx io_ring_ctx_alloc(struct io_uring_params p) · 144 unmodified lines
1129	init_waitqueue_head(&ctx->cq_wait);	1135	init_waitqueue_head(&ctx->cq_wait);
1130	INIT_LIST_HEAD(&ctx->cq_overflow_list);	1136	INIT_LIST_HEAD(&ctx->cq_overflow_list);
1131	init_completion(&ctx->ref_comp);	1137	init_completion(&ctx->ref_comp);
1132	init_completion(&ctx->sq_thread_comp);
1133	idr_init(&ctx->io_buffer_idr);	1138	idr_init(&ctx->io_buffer_idr);
1134	idr_init(&ctx->personality_idr);	1139	xa_init_flags(&ctx->personalities, XA_FLAGS_ALLOC1);
1135	mutex_init(&ctx->uring_lock);	1140	mutex_init(&ctx->uring_lock);
1136	init_waitqueue_head(&ctx->wait);	1141	init_waitqueue_head(&ctx->wait);
1137	spin_lock_init(&ctx->completion_lock);	1142	spin_lock_init(&ctx->completion_lock);
@@ -1144,6 +1149,7 @@ static struct io_ring_ctx io_ring_ctx_alloc(struct io_uring_params p) · 6 unmodified lines
1144	INIT_LIST_HEAD(&ctx->rsrc_ref_list);	1149	INIT_LIST_HEAD(&ctx->rsrc_ref_list);
1145	INIT_DELAYED_WORK(&ctx->rsrc_put_work, io_rsrc_put_work);	1150	INIT_DELAYED_WORK(&ctx->rsrc_put_work, io_rsrc_put_work);
1146	init_llist_head(&ctx->rsrc_put_llist);	1151	init_llist_head(&ctx->rsrc_put_llist);
		1152	INIT_LIST_HEAD(&ctx->tctx_list);
1147	INIT_LIST_HEAD(&ctx->submit_state.comp.free_list);	1153	INIT_LIST_HEAD(&ctx->submit_state.comp.free_list);
1148	INIT_LIST_HEAD(&ctx->submit_state.comp.locked_free_list);	1154	INIT_LIST_HEAD(&ctx->submit_state.comp.locked_free_list);
1149	return ctx;	1155	return ctx;
@@ -1183,6 +1189,9 @@ static void io_prep_async_work(struct io_kiocb *req) · 33 unmodified lines
1183	const struct io_op_def *def = &io_op_defs[req->opcode];	1189	const struct io_op_def *def = &io_op_defs[req->opcode];
1184	struct io_ring_ctx *ctx = req->ctx;	1190	struct io_ring_ctx *ctx = req->ctx;
1185		1191
		1192	if (!req->work.creds)
		1193	req->work.creds = get_current_cred();
		1194
1186	if (req->flags & REQ_F_FORCE_ASYNC)	1195	if (req->flags & REQ_F_FORCE_ASYNC)
1187	req->work.flags \|= IO_WQ_WORK_CONCURRENT;	1196	req->work.flags \|= IO_WQ_WORK_CONCURRENT;
1188		1197
@@ -1514,15 +1523,14 @@ static void io_cqring_fill_event(struct io_kiocb *req, long res) · 325 unmodified lines
1514	__io_cqring_fill_event(req, res, 0);	1523	__io_cqring_fill_event(req, res, 0);
1515	}	1524	}
1516		1525
1517	static inline void io_req_complete_post(struct io_kiocb *req, long res,	1526	static void io_req_complete_post(struct io_kiocb *req, long res,
1518	unsigned int cflags)	1527	unsigned int cflags)
1519	{	1528	{
1520	struct io_ring_ctx *ctx = req->ctx;	1529	struct io_ring_ctx *ctx = req->ctx;
1521	unsigned long flags;	1530	unsigned long flags;
1522		1531
1523	spin_lock_irqsave(&ctx->completion_lock, flags);	1532	spin_lock_irqsave(&ctx->completion_lock, flags);
1524	__io_cqring_fill_event(req, res, cflags);	1533	__io_cqring_fill_event(req, res, cflags);
1525	io_commit_cqring(ctx);
1526	/*	1534	/*
1527	* If we're the last reference to this request, add to our locked	1535	* If we're the last reference to this request, add to our locked
1528	* free_list cache.	1536	* free_list cache.
@@ -1530,19 +1538,26 @@ static inline void io_req_complete_post(struct io_kiocb *req, long res, · 1 unmodified line
1530	if (refcount_dec_and_test(&req->refs)) {	1538	if (refcount_dec_and_test(&req->refs)) {
1531	struct io_comp_state *cs = &ctx->submit_state.comp;	1539	struct io_comp_state *cs = &ctx->submit_state.comp;
1532		1540
		1541	if (req->flags & (REQ_F_LINK \| REQ_F_HARDLINK)) {
		1542	if (req->flags & (REQ_F_LINK_TIMEOUT \| REQ_F_FAIL_LINK))
		1543	io_disarm_next(req);
		1544	if (req->link) {
		1545	io_req_task_queue(req->link);
		1546	req->link = NULL;
		1547	}
		1548	}
1533	io_dismantle_req(req);	1549	io_dismantle_req(req);
1534	io_put_task(req->task, 1);	1550	io_put_task(req->task, 1);
1535	list_add(&req->compl.list, &cs->locked_free_list);	1551	list_add(&req->compl.list, &cs->locked_free_list);
1536	cs->locked_free_nr++;	1552	cs->locked_free_nr++;
1537	} else	1553	} else
1538	req = NULL;	1554	req = NULL;
		1555	io_commit_cqring(ctx);
1539	spin_unlock_irqrestore(&ctx->completion_lock, flags);	1556	spin_unlock_irqrestore(&ctx->completion_lock, flags);
1540
1541	io_cqring_ev_posted(ctx);	1557	io_cqring_ev_posted(ctx);
1542	if (req) {	1558
1543	io_queue_next(req);	1559	if (req)
1544	percpu_ref_put(&ctx->refs);	1560	percpu_ref_put(&ctx->refs);
1545	}
1546	}	1561	}
1547		1562
1548	static void io_req_complete_state(struct io_kiocb *req, long res,	1563	static void io_req_complete_state(struct io_kiocb *req, long res,
@@ -1648,6 +1663,10 @@ static void io_dismantle_req(struct io_kiocb *req) · 99 unmodified lines
1648	io_put_file(req, req->file, (req->flags & REQ_F_FIXED_FILE));	1663	io_put_file(req, req->file, (req->flags & REQ_F_FIXED_FILE));
1649	if (req->fixed_rsrc_refs)	1664	if (req->fixed_rsrc_refs)
1650	percpu_ref_put(req->fixed_rsrc_refs);	1665	percpu_ref_put(req->fixed_rsrc_refs);
		1666	if (req->work.creds) {
		1667	put_cred(req->work.creds);
		1668	req->work.creds = NULL;
		1669	}
1651		1670
1652	if (req->flags & REQ_F_INFLIGHT) {	1671	if (req->flags & REQ_F_INFLIGHT) {
1653	struct io_ring_ctx *ctx = req->ctx;	1672	struct io_ring_ctx *ctx = req->ctx;
@@ -1690,15 +1709,11 @@ static inline void io_remove_next_linked(struct io_kiocb *req) · 36 unmodified lines
1690	nxt->link = NULL;	1709	nxt->link = NULL;
1691	}	1710	}
1692		1711
1693	static void io_kill_linked_timeout(struct io_kiocb *req)	1712	static bool io_kill_linked_timeout(struct io_kiocb *req)
		1713	__must_hold(&req->ctx->completion_lock)
1694	{	1714	{
1695	struct io_ring_ctx *ctx = req->ctx;	1715	struct io_kiocb *link = req->link;
1696	struct io_kiocb *link;
1697	bool cancelled = false;	1716	bool cancelled = false;
1698	unsigned long flags;
1699
1700	spin_lock_irqsave(&ctx->completion_lock, flags);
1701	link = req->link;
1702		1717
1703	/*	1718	/*
1704	* Can happen if a linked timeout fired and link had been like	1719	* Can happen if a linked timeout fired and link had been like
@@ -1713,50 +1728,48 @@ static void io_kill_linked_timeout(struct io_kiocb *req) · 8 unmodified lines
1713	ret = hrtimer_try_to_cancel(&io->timer);	1728	ret = hrtimer_try_to_cancel(&io->timer);
1714	if (ret != -1) {	1729	if (ret != -1) {
1715	io_cqring_fill_event(link, -ECANCELED);	1730	io_cqring_fill_event(link, -ECANCELED);
1716	io_commit_cqring(ctx);	1731	io_put_req_deferred(link, 1);
1717	cancelled = true;	1732	cancelled = true;
1718	}	1733	}
1719	}	1734	}
1720	req->flags &= ~REQ_F_LINK_TIMEOUT;	1735	req->flags &= ~REQ_F_LINK_TIMEOUT;
1721	spin_unlock_irqrestore(&ctx->completion_lock, flags);	1736	return cancelled;
1722
1723	if (cancelled) {
1724	io_cqring_ev_posted(ctx);
1725	io_put_req(link);
1726	}
1727	}	1737	}
1728		1738
1729
1730	static void io_fail_links(struct io_kiocb *req)	1739	static void io_fail_links(struct io_kiocb *req)
		1740	__must_hold(&req->ctx->completion_lock)
1731	{	1741	{
1732	struct io_kiocb link, nxt;	1742	struct io_kiocb nxt, link = req->link;
1733	struct io_ring_ctx *ctx = req->ctx;
1734	unsigned long flags;
1735		1743
1736	spin_lock_irqsave(&ctx->completion_lock, flags);
1737	link = req->link;
1738	req->link = NULL;	1744	req->link = NULL;
1739
1740	while (link) {	1745	while (link) {
1741	nxt = link->link;	1746	nxt = link->link;
1742	link->link = NULL;	1747	link->link = NULL;
1743		1748
1744	trace_io_uring_fail_link(req, link);	1749	trace_io_uring_fail_link(req, link);
1745	io_cqring_fill_event(link, -ECANCELED);	1750	io_cqring_fill_event(link, -ECANCELED);
1746
1747	io_put_req_deferred(link, 2);	1751	io_put_req_deferred(link, 2);
1748	link = nxt;	1752	link = nxt;
1749	}	1753	}
1750	io_commit_cqring(ctx);	1754	}
1751	spin_unlock_irqrestore(&ctx->completion_lock, flags);
1752		1755
1753	io_cqring_ev_posted(ctx);	1756	static bool io_disarm_next(struct io_kiocb *req)
		1757	__must_hold(&req->ctx->completion_lock)
		1758	{
		1759	bool posted = false;
		1760
		1761	if (likely(req->flags & REQ_F_LINK_TIMEOUT))
		1762	posted = io_kill_linked_timeout(req);
		1763	if (unlikely(req->flags & REQ_F_FAIL_LINK)) {
		1764	posted \|= (req->link != NULL);
		1765	io_fail_links(req);
		1766	}
		1767	return posted;
1754	}	1768	}
1755		1769
1756	static struct io_kiocb __io_req_find_next(struct io_kiocb req)	1770	static struct io_kiocb __io_req_find_next(struct io_kiocb req)
1757	{	1771	{
1758	if (req->flags & REQ_F_LINK_TIMEOUT)	1772	struct io_kiocb *nxt;
1759	io_kill_linked_timeout(req);
1760		1773
1761	/*	1774	/*
1762	* If LINK is set, we have dependent requests in this chain. If we	1775	* If LINK is set, we have dependent requests in this chain. If we
@@ -1764,14 +1777,22 @@ static struct io_kiocb __io_req_find_next(struct io_kiocb req) · 1 unmodified line
1764	* dependencies to the next request. In case of failure, fail the rest	1777	* dependencies to the next request. In case of failure, fail the rest
1765	* of the chain.	1778	* of the chain.
1766	*/	1779	*/
1767	if (likely(!(req->flags & REQ_F_FAIL_LINK))) {	1780	if (req->flags & (REQ_F_LINK_TIMEOUT \| REQ_F_FAIL_LINK)) {
1768	struct io_kiocb *nxt = req->link;	1781	struct io_ring_ctx *ctx = req->ctx;
		1782	unsigned long flags;
		1783	bool posted;
1769		1784
1770	req->link = NULL;	1785	spin_lock_irqsave(&ctx->completion_lock, flags);
1771	return nxt;	1786	posted = io_disarm_next(req);
		1787	if (posted)
		1788	io_commit_cqring(req->ctx);
		1789	spin_unlock_irqrestore(&ctx->completion_lock, flags);
		1790	if (posted)
		1791	io_cqring_ev_posted(ctx);
1772	}	1792	}
1773	io_fail_links(req);	1793	nxt = req->link;
1774	return NULL;	1794	req->link = NULL;
		1795	return nxt;
1775	}	1796	}
1776		1797
1777	static inline struct io_kiocb io_req_find_next(struct io_kiocb req)	1798	static inline struct io_kiocb io_req_find_next(struct io_kiocb req)
@@ -5559,22 +5580,30 @@ add: · 3781 unmodified lines
5559	return 0;	5580	return 0;
5560	}	5581	}
5561		5582
		5583	struct io_cancel_data {
		5584	struct io_ring_ctx *ctx;
		5585	u64 user_data;
		5586	};
		5587
5562	static bool io_cancel_cb(struct io_wq_work work, void data)	5588	static bool io_cancel_cb(struct io_wq_work work, void data)
5563	{	5589	{
5564	struct io_kiocb *req = container_of(work, struct io_kiocb, work);	5590	struct io_kiocb *req = container_of(work, struct io_kiocb, work);
		5591	struct io_cancel_data *cd = data;
5565		5592
5566	return req->user_data == (unsigned long) data;	5593	return req->ctx == cd->ctx && req->user_data == cd->user_data;
5567	}	5594	}
5568		5595
5569	static int io_async_cancel_one(struct io_uring_task tctx, void sqe_addr)	5596	static int io_async_cancel_one(struct io_uring_task *tctx, u64 user_data,
		5597	struct io_ring_ctx *ctx)
5570	{	5598	{
		5599	struct io_cancel_data data = { .ctx = ctx, .user_data = user_data, };
5571	enum io_wq_cancel cancel_ret;	5600	enum io_wq_cancel cancel_ret;
5572	int ret = 0;	5601	int ret = 0;
5573		5602
5574	if (!tctx->io_wq)	5603	if (!tctx \|\| !tctx->io_wq)
5575	return -ENOENT;	5604	return -ENOENT;
5576		5605
5577	cancel_ret = io_wq_cancel_cb(tctx->io_wq, io_cancel_cb, sqe_addr, false);	5606	cancel_ret = io_wq_cancel_cb(tctx->io_wq, io_cancel_cb, &data, false);
5578	switch (cancel_ret) {	5607	switch (cancel_ret) {
5579	case IO_WQ_CANCEL_OK:	5608	case IO_WQ_CANCEL_OK:
5580	ret = 0;	5609	ret = 0;
@@ -5597,8 +5626,7 @@ static void io_async_find_and_cancel(struct io_ring_ctx *ctx, · 16 unmodified lines
5597	unsigned long flags;	5626	unsigned long flags;
5598	int ret;	5627	int ret;
5599		5628
5600	ret = io_async_cancel_one(req->task->io_uring,	5629	ret = io_async_cancel_one(req->task->io_uring, sqe_addr, ctx);
5601	(void *) (unsigned long) sqe_addr);
5602	if (ret != -ENOENT) {	5630	if (ret != -ENOENT) {
5603	spin_lock_irqsave(&ctx->completion_lock, flags);	5631	spin_lock_irqsave(&ctx->completion_lock, flags);
5604	goto done;	5632	goto done;
@@ -5639,8 +5667,47 @@ static int io_async_cancel_prep(struct io_kiocb *req, · 34 unmodified lines
5639	static int io_async_cancel(struct io_kiocb *req, unsigned int issue_flags)	5667	static int io_async_cancel(struct io_kiocb *req, unsigned int issue_flags)
5640	{	5668	{
5641	struct io_ring_ctx *ctx = req->ctx;	5669	struct io_ring_ctx *ctx = req->ctx;
		5670	u64 sqe_addr = req->cancel.addr;
		5671	struct io_tctx_node *node;
		5672	int ret;
		5673
		5674	/* tasks should wait for their io-wq threads, so safe w/o sync */
		5675	ret = io_async_cancel_one(req->task->io_uring, sqe_addr, ctx);
		5676	spin_lock_irq(&ctx->completion_lock);
		5677	if (ret != -ENOENT)
		5678	goto done;
		5679	ret = io_timeout_cancel(ctx, sqe_addr);
		5680	if (ret != -ENOENT)
		5681	goto done;
		5682	ret = io_poll_cancel(ctx, sqe_addr);
		5683	if (ret != -ENOENT)
		5684	goto done;
		5685	spin_unlock_irq(&ctx->completion_lock);
		5686
		5687	/* slow path, try all io-wq's */
		5688	io_ring_submit_lock(ctx, !(issue_flags & IO_URING_F_NONBLOCK));
		5689	ret = -ENOENT;
		5690	list_for_each_entry(node, &ctx->tctx_list, ctx_node) {
		5691	struct io_uring_task *tctx = node->task->io_uring;
		5692
		5693	if (!tctx \|\| !tctx->io_wq)
		5694	continue;
		5695	ret = io_async_cancel_one(tctx, req->cancel.addr, ctx);
		5696	if (ret != -ENOENT)
		5697	break;
		5698	}
		5699	io_ring_submit_unlock(ctx, !(issue_flags & IO_URING_F_NONBLOCK));
5642		5700
5643	io_async_find_and_cancel(ctx, req, req->cancel.addr, 0);	5701	spin_lock_irq(&ctx->completion_lock);
		5702	done:
		5703	io_cqring_fill_event(req, ret);
		5704	io_commit_cqring(ctx);
		5705	spin_unlock_irq(&ctx->completion_lock);
		5706	io_cqring_ev_posted(ctx);
		5707
		5708	if (ret < 0)
		5709	req_set_fail_links(req);
		5710	io_put_req(req);
5644	return 0;	5711	return 0;
5645	}	5712	}
5646		5713
@@ -5916,18 +5983,8 @@ static int io_issue_sqe(struct io_kiocb *req, unsigned int issue_flags) · 269 unmodified lines
5916	const struct cred *creds = NULL;	5983	const struct cred *creds = NULL;
5917	int ret;	5984	int ret;
5918		5985
5919	if (req->work.personality) {	5986	if (req->work.creds && req->work.creds != current_cred())
5920	const struct cred *new_creds;	5987	creds = override_creds(req->work.creds);
5921
5922	if (!(issue_flags & IO_URING_F_NONBLOCK))
5923	mutex_lock(&ctx->uring_lock);
5924	new_creds = idr_find(&ctx->personality_idr, req->work.personality);
5925	if (!(issue_flags & IO_URING_F_NONBLOCK))
5926	mutex_unlock(&ctx->uring_lock);
5927	if (!new_creds)
5928	return -EINVAL;
5929	creds = override_creds(new_creds);
5930	}
5931		5988
5932	switch (req->opcode) {	5989	switch (req->opcode) {
5933	case IORING_OP_NOP:	5990	case IORING_OP_NOP:
@@ -6291,7 +6348,7 @@ static int io_init_req(struct io_ring_ctx ctx, struct io_kiocb req, · 357 unmodified lines
6291	{	6348	{
6292	struct io_submit_state *state;	6349	struct io_submit_state *state;
6293	unsigned int sqe_flags;	6350	unsigned int sqe_flags;
6294	int ret = 0;	6351	int personality, ret = 0;
6295		6352
6296	req->opcode = READ_ONCE(sqe->opcode);	6353	req->opcode = READ_ONCE(sqe->opcode);
6297	/* same numerical values with corresponding REQ_F_, safe to copy /	6354	/* same numerical values with corresponding REQ_F_, safe to copy /
@@ -6306,6 +6363,9 @@ static int io_init_req(struct io_ring_ctx ctx, struct io_kiocb req, · 8 unmodified lines
6306	refcount_set(&req->refs, 2);	6363	refcount_set(&req->refs, 2);
6307	req->task = current;	6364	req->task = current;
6308	req->result = 0;	6365	req->result = 0;
		6366	req->work.list.next = NULL;
		6367	req->work.creds = NULL;
		6368	req->work.flags = 0;
6309		6369
6310	/* enforce forwards compatibility on users */	6370	/* enforce forwards compatibility on users */
6311	if (unlikely(sqe_flags & ~SQE_VALID_FLAGS)) {	6371	if (unlikely(sqe_flags & ~SQE_VALID_FLAGS)) {
@@ -6323,9 +6383,13 @@ static int io_init_req(struct io_ring_ctx ctx, struct io_kiocb req, · 11 unmodified lines
6323	!io_op_defs[req->opcode].buffer_select)	6383	!io_op_defs[req->opcode].buffer_select)
6324	return -EOPNOTSUPP;	6384	return -EOPNOTSUPP;
6325		6385
6326	req->work.list.next = NULL;	6386	personality = READ_ONCE(sqe->personality);
6327	req->work.flags = 0;	6387	if (personality) {
6328	req->work.personality = READ_ONCE(sqe->personality);	6388	req->work.creds = xa_load(&ctx->personalities, personality);
		6389	if (!req->work.creds)
		6390	return -EINVAL;
		6391	get_cred(req->work.creds);
		6392	}
6329	state = &ctx->submit_state;	6393	state = &ctx->submit_state;
6330		6394
6331	/*	6395	/*
@@ -6587,7 +6651,8 @@ static int __io_sq_thread(struct io_ring_ctx *ctx, bool cap_entries) · 255 unmodified lines
6587	if (!list_empty(&ctx->iopoll_list))	6651	if (!list_empty(&ctx->iopoll_list))
6588	io_do_iopoll(ctx, &nr_events, 0);	6652	io_do_iopoll(ctx, &nr_events, 0);
6589		6653
6590	if (to_submit && likely(!percpu_ref_is_dying(&ctx->refs)))	6654	if (to_submit && likely(!percpu_ref_is_dying(&ctx->refs)) &&
		6655	!(ctx->flags & IORING_SETUP_R_DISABLED))
6591	ret = io_submit_sqes(ctx, to_submit);	6656	ret = io_submit_sqes(ctx, to_submit);
6592	mutex_unlock(&ctx->uring_lock);	6657	mutex_unlock(&ctx->uring_lock);
6593	}	6658	}
@@ -6611,58 +6676,6 @@ static void io_sqd_update_thread_idle(struct io_sq_data *sqd) · 17 unmodified lines
6611	sqd->sq_thread_idle = sq_thread_idle;	6676	sqd->sq_thread_idle = sq_thread_idle;
6612	}	6677	}
6613		6678
6614	static void io_sqd_init_new(struct io_sq_data *sqd)
6615	{
6616	struct io_ring_ctx *ctx;
6617
6618	while (!list_empty(&sqd->ctx_new_list)) {
6619	ctx = list_first_entry(&sqd->ctx_new_list, struct io_ring_ctx, sqd_list);
6620	list_move_tail(&ctx->sqd_list, &sqd->ctx_list);
6621	complete(&ctx->sq_thread_comp);
6622	}
6623
6624	io_sqd_update_thread_idle(sqd);
6625	}
6626
6627	static bool io_sq_thread_should_stop(struct io_sq_data *sqd)
6628	{
6629	return test_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state);
6630	}
6631
6632	static bool io_sq_thread_should_park(struct io_sq_data *sqd)
6633	{
6634	return test_bit(IO_SQ_THREAD_SHOULD_PARK, &sqd->state);
6635	}
6636
6637	static void io_sq_thread_parkme(struct io_sq_data *sqd)
6638	{
6639	for (;;) {
6640	/*
6641	* TASK_PARKED is a special state; we must serialize against
6642	* possible pending wakeups to avoid store-store collisions on
6643	* task->state.
6644	*
6645	* Such a collision might possibly result in the task state
6646	* changin from TASK_PARKED and us failing the
6647	* wait_task_inactive() in kthread_park().
6648	*/
6649	set_special_state(TASK_PARKED);
6650	if (!test_bit(IO_SQ_THREAD_SHOULD_PARK, &sqd->state))
6651	break;
6652
6653	/*
6654	* Thread is going to call schedule(), do not preempt it,
6655	* or the caller of kthread_park() may spend more time in
6656	* wait_task_inactive().
6657	*/
6658	preempt_disable();
6659	complete(&sqd->parked);
6660	schedule_preempt_disabled();
6661	preempt_enable();
6662	}
6663	__set_current_state(TASK_RUNNING);
6664	}
6665
6666	static int io_sq_thread(void *data)	6679	static int io_sq_thread(void *data)
6667	{	6680	{
6668	struct io_sq_data *sqd = data;	6681	struct io_sq_data *sqd = data;
@@ -6681,31 +6694,32 @@ static int io_sq_thread(void *data) · 12 unmodified lines
6681	set_cpus_allowed_ptr(current, cpu_online_mask);	6694	set_cpus_allowed_ptr(current, cpu_online_mask);
6682	current->flags \|= PF_NO_SETAFFINITY;	6695	current->flags \|= PF_NO_SETAFFINITY;
6683		6696
6684	wait_for_completion(&sqd->startup);	6697	down_read(&sqd->rw_lock);
6685		6698
6686	while (!io_sq_thread_should_stop(sqd)) {	6699	while (!test_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state)) {
6687	int ret;	6700	int ret;
6688	bool cap_entries, sqt_spin, needs_sched;	6701	bool cap_entries, sqt_spin, needs_sched;
6689		6702
6690	/*	6703	if (test_bit(IO_SQ_THREAD_SHOULD_PARK, &sqd->state)) {
6691	* Any changes to the sqd lists are synchronized through the	6704	up_read(&sqd->rw_lock);
6692	* thread parking. This synchronizes the thread vs users,	6705	cond_resched();
6693	* the users are synchronized on the sqd->ctx_lock.	6706	down_read(&sqd->rw_lock);
6694	*/	6707	io_run_task_work();
6695	if (io_sq_thread_should_park(sqd)) {
6696	io_sq_thread_parkme(sqd);
6697	continue;
6698	}
6699	if (unlikely(!list_empty(&sqd->ctx_new_list))) {
6700	io_sqd_init_new(sqd);
6701	timeout = jiffies + sqd->sq_thread_idle;	6708	timeout = jiffies + sqd->sq_thread_idle;
		6709	continue;
6702	}	6710	}
6703	if (fatal_signal_pending(current))	6711	if (fatal_signal_pending(current))
6704	break;	6712	break;
6705	sqt_spin = false;	6713	sqt_spin = false;
6706	cap_entries = !list_is_singular(&sqd->ctx_list);	6714	cap_entries = !list_is_singular(&sqd->ctx_list);
6707	list_for_each_entry(ctx, &sqd->ctx_list, sqd_list) {	6715	list_for_each_entry(ctx, &sqd->ctx_list, sqd_list) {
		6716	const struct cred *creds = NULL;
		6717
		6718	if (ctx->sq_creds != current_cred())
		6719	creds = override_creds(ctx->sq_creds);
6708	ret = __io_sq_thread(ctx, cap_entries);	6720	ret = __io_sq_thread(ctx, cap_entries);
		6721	if (creds)
		6722	revert_creds(creds);
6709	if (!sqt_spin && (ret > 0 \|\| !list_empty(&ctx->iopoll_list)))	6723	if (!sqt_spin && (ret > 0 \|\| !list_empty(&ctx->iopoll_list)))
6710	sqt_spin = true;	6724	sqt_spin = true;
6711	}	6725	}
@@ -6732,12 +6746,13 @@ static int io_sq_thread(void *data) · 20 unmodified lines
6732	}	6746	}
6733	}	6747	}
6734		6748
6735	if (needs_sched && !io_sq_thread_should_park(sqd)) {	6749	if (needs_sched && !test_bit(IO_SQ_THREAD_SHOULD_PARK, &sqd->state)) {
6736	list_for_each_entry(ctx, &sqd->ctx_list, sqd_list)	6750	list_for_each_entry(ctx, &sqd->ctx_list, sqd_list)
6737	io_ring_set_wakeup_flag(ctx);	6751	io_ring_set_wakeup_flag(ctx);
6738		6752
		6753	up_read(&sqd->rw_lock);
6739	schedule();	6754	schedule();
6740	try_to_freeze();	6755	down_read(&sqd->rw_lock);
6741	list_for_each_entry(ctx, &sqd->ctx_list, sqd_list)	6756	list_for_each_entry(ctx, &sqd->ctx_list, sqd_list)
6742	io_ring_clear_wakeup_flag(ctx);	6757	io_ring_clear_wakeup_flag(ctx);
6743	}	6758	}
@@ -6745,32 +6760,23 @@ static int io_sq_thread(void *data) · 1 unmodified line
6745	finish_wait(&sqd->wait, &wait);	6760	finish_wait(&sqd->wait, &wait);
6746	timeout = jiffies + sqd->sq_thread_idle;	6761	timeout = jiffies + sqd->sq_thread_idle;
6747	}	6762	}
6748		6763	up_read(&sqd->rw_lock);
6749	list_for_each_entry(ctx, &sqd->ctx_list, sqd_list)	6764	down_write(&sqd->rw_lock);
6750	io_uring_cancel_sqpoll(ctx);
6751
6752	io_run_task_work();
6753
6754	/*	6765	/*
6755	* Ensure that we park properly if racing with someone trying to park	6766	* someone may have parked and added a cancellation task_work, run
6756	* while we're exiting. If we fail to grab the lock, check park and	6767	* it first because we don't want it in io_uring_cancel_sqpoll()
6757	* park if necessary. The ordering with the park bit and the lock
6758	* ensures that we catch this reliably.
6759	*/	6768	*/
6760	if (!mutex_trylock(&sqd->lock)) {	6769	io_run_task_work();
6761	if (io_sq_thread_should_park(sqd))
6762	io_sq_thread_parkme(sqd);
6763	mutex_lock(&sqd->lock);
6764	}
6765		6770
		6771	list_for_each_entry(ctx, &sqd->ctx_list, sqd_list)
		6772	io_uring_cancel_sqpoll(ctx);
6766	sqd->thread = NULL;	6773	sqd->thread = NULL;
6767	list_for_each_entry(ctx, &sqd->ctx_list, sqd_list) {	6774	list_for_each_entry(ctx, &sqd->ctx_list, sqd_list)
6768	ctx->sqo_exec = 1;
6769	io_ring_set_wakeup_flag(ctx);	6775	io_ring_set_wakeup_flag(ctx);
6770	}	6776	up_write(&sqd->rw_lock);
6771		6777
		6778	io_run_task_work();
6772	complete(&sqd->exited);	6779	complete(&sqd->exited);
6773	mutex_unlock(&sqd->lock);
6774	do_exit(0);	6780	do_exit(0);
6775	}	6781	}
6776		6782
@@ -7069,44 +7075,37 @@ static int io_sqe_files_unregister(struct io_ring_ctx *ctx) · 292 unmodified lines
7069	}	7075	}
7070		7076
7071	static void io_sq_thread_unpark(struct io_sq_data *sqd)	7077	static void io_sq_thread_unpark(struct io_sq_data *sqd)
7072	__releases(&sqd->lock)	7078	__releases(&sqd->rw_lock)
7073	{	7079	{
7074	if (sqd->thread == current)	7080	WARN_ON_ONCE(sqd->thread == current);
7075	return;	7081
7076	clear_bit(IO_SQ_THREAD_SHOULD_PARK, &sqd->state);	7082	clear_bit(IO_SQ_THREAD_SHOULD_PARK, &sqd->state);
7077	if (sqd->thread)	7083	up_write(&sqd->rw_lock);
7078	wake_up_state(sqd->thread, TASK_PARKED);
7079	mutex_unlock(&sqd->lock);
7080	}	7084	}
7081		7085
7082	static void io_sq_thread_park(struct io_sq_data *sqd)	7086	static void io_sq_thread_park(struct io_sq_data *sqd)
7083	__acquires(&sqd->lock)	7087	__acquires(&sqd->rw_lock)
7084	{	7088	{
7085	if (sqd->thread == current)	7089	WARN_ON_ONCE(sqd->thread == current);
7086	return;	7090
7087	set_bit(IO_SQ_THREAD_SHOULD_PARK, &sqd->state);	7091	set_bit(IO_SQ_THREAD_SHOULD_PARK, &sqd->state);
7088	mutex_lock(&sqd->lock);	7092	down_write(&sqd->rw_lock);
7089	if (sqd->thread) {	7093	/* set again for consistency, in case concurrent parks are happening */
		7094	set_bit(IO_SQ_THREAD_SHOULD_PARK, &sqd->state);
		7095	if (sqd->thread)
7090	wake_up_process(sqd->thread);	7096	wake_up_process(sqd->thread);
7091	wait_for_completion(&sqd->parked);
7092	}
7093	}	7097	}
7094		7098
7095	static void io_sq_thread_stop(struct io_sq_data *sqd)	7099	static void io_sq_thread_stop(struct io_sq_data *sqd)
7096	{	7100	{
7097	if (test_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state))	7101	WARN_ON_ONCE(sqd->thread == current);
7098	return;	7102
7099	mutex_lock(&sqd->lock);	7103	down_write(&sqd->rw_lock);
7100	if (sqd->thread) {	7104	set_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state);
7101	set_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state);	7105	if (sqd->thread)
7102	WARN_ON_ONCE(test_bit(IO_SQ_THREAD_SHOULD_PARK, &sqd->state));
7103	wake_up_process(sqd->thread);	7106	wake_up_process(sqd->thread);
7104	mutex_unlock(&sqd->lock);	7107	up_write(&sqd->rw_lock);
7105	wait_for_completion(&sqd->exited);	7108	wait_for_completion(&sqd->exited);
7106	WARN_ON_ONCE(sqd->thread);
7107	} else {
7108	mutex_unlock(&sqd->lock);
7109	}
7110	}	7109	}
7111		7110
7112	static void io_put_sq_data(struct io_sq_data *sqd)	7111	static void io_put_sq_data(struct io_sq_data *sqd)
@@ -7122,22 +7121,15 @@ static void io_sq_thread_finish(struct io_ring_ctx *ctx) · 9 unmodified lines
7122	struct io_sq_data *sqd = ctx->sq_data;	7121	struct io_sq_data *sqd = ctx->sq_data;
7123		7122
7124	if (sqd) {	7123	if (sqd) {
7125	complete(&sqd->startup);	7124	io_sq_thread_park(sqd);
7126	if (sqd->thread) {	7125	list_del_init(&ctx->sqd_list);
7127	wait_for_completion(&ctx->sq_thread_comp);
7128	io_sq_thread_park(sqd);
7129	}
7130
7131	mutex_lock(&sqd->ctx_lock);
7132	list_del(&ctx->sqd_list);
7133	io_sqd_update_thread_idle(sqd);	7126	io_sqd_update_thread_idle(sqd);
7134	mutex_unlock(&sqd->ctx_lock);	7127	io_sq_thread_unpark(sqd);
7135
7136	if (sqd->thread)
7137	io_sq_thread_unpark(sqd);
7138		7128
7139	io_put_sq_data(sqd);	7129	io_put_sq_data(sqd);
7140	ctx->sq_data = NULL;	7130	ctx->sq_data = NULL;
		7131	if (ctx->sq_creds)
		7132	put_cred(ctx->sq_creds);
7141	}	7133	}
7142	}	7134	}
7143		7135
@@ -7161,18 +7153,32 @@ static struct io_sq_data io_attach_sq_data(struct io_uring_params p) · 17 unmodified lines
7161	fdput(f);	7153	fdput(f);
7162	return ERR_PTR(-EINVAL);	7154	return ERR_PTR(-EINVAL);
7163	}	7155	}
		7156	if (sqd->task_tgid != current->tgid) {
		7157	fdput(f);
		7158	return ERR_PTR(-EPERM);
		7159	}
7164		7160
7165	refcount_inc(&sqd->refs);	7161	refcount_inc(&sqd->refs);
7166	fdput(f);	7162	fdput(f);
7167	return sqd;	7163	return sqd;
7168	}	7164	}
7169		7165
7170	static struct io_sq_data io_get_sq_data(struct io_uring_params p)	7166	static struct io_sq_data io_get_sq_data(struct io_uring_params p,
		7167	bool *attached)
7171	{	7168	{
7172	struct io_sq_data *sqd;	7169	struct io_sq_data *sqd;
7173		7170
7174	if (p->flags & IORING_SETUP_ATTACH_WQ)	7171	*attached = false;
7175	return io_attach_sq_data(p);	7172	if (p->flags & IORING_SETUP_ATTACH_WQ) {
		7173	sqd = io_attach_sq_data(p);
		7174	if (!IS_ERR(sqd)) {
		7175	*attached = true;
		7176	return sqd;
		7177	}
		7178	/* fall through for EPERM case, setup new sqd/task */
		7179	if (PTR_ERR(sqd) != -EPERM)
		7180	return sqd;
		7181	}
7176		7182
7177	sqd = kzalloc(sizeof(*sqd), GFP_KERNEL);	7183	sqd = kzalloc(sizeof(*sqd), GFP_KERNEL);
7178	if (!sqd)	7184	if (!sqd)
@@ -7180,12 +7186,8 @@ static struct io_sq_data io_get_sq_data(struct io_uring_params p) · 1 unmodified line
7180		7186
7181	refcount_set(&sqd->refs, 1);	7187	refcount_set(&sqd->refs, 1);
7182	INIT_LIST_HEAD(&sqd->ctx_list);	7188	INIT_LIST_HEAD(&sqd->ctx_list);
7183	INIT_LIST_HEAD(&sqd->ctx_new_list);	7189	init_rwsem(&sqd->rw_lock);
7184	mutex_init(&sqd->ctx_lock);
7185	mutex_init(&sqd->lock);
7186	init_waitqueue_head(&sqd->wait);	7190	init_waitqueue_head(&sqd->wait);
7187	init_completion(&sqd->startup);
7188	init_completion(&sqd->parked);
7189	init_completion(&sqd->exited);	7191	init_completion(&sqd->exited);
7190	return sqd;	7192	return sqd;
7191	}	7193	}
@@ -7802,7 +7804,6 @@ static int io_uring_alloc_task_context(struct task_struct *task, · 610 unmodified lines
7802	init_waitqueue_head(&tctx->wait);	7804	init_waitqueue_head(&tctx->wait);
7803	tctx->last = NULL;	7805	tctx->last = NULL;
7804	atomic_set(&tctx->in_idle, 0);	7806	atomic_set(&tctx->in_idle, 0);
7805	tctx->sqpoll = false;
7806	task->io_uring = tctx;	7807	task->io_uring = tctx;
7807	spin_lock_init(&tctx->task_lock);	7808	spin_lock_init(&tctx->task_lock);
7808	INIT_WQ_LIST(&tctx->task_list);	7809	INIT_WQ_LIST(&tctx->task_list);
@@ -7823,26 +7824,6 @@ void __io_uring_free(struct task_struct *tsk) · 14 unmodified lines
7823	tsk->io_uring = NULL;	7824	tsk->io_uring = NULL;
7824	}	7825	}
7825		7826
7826	static int io_sq_thread_fork(struct io_sq_data sqd, struct io_ring_ctx ctx)
7827	{
7828	struct task_struct *tsk;
7829	int ret;
7830
7831	clear_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state);
7832	reinit_completion(&sqd->parked);
7833	ctx->sqo_exec = 0;
7834	sqd->task_pid = current->pid;
7835	tsk = create_io_thread(io_sq_thread, sqd, NUMA_NO_NODE);
7836	if (IS_ERR(tsk))
7837	return PTR_ERR(tsk);
7838	ret = io_uring_alloc_task_context(tsk, ctx);
7839	if (ret)
7840	set_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state);
7841	sqd->thread = tsk;
7842	wake_up_new_task(tsk);
7843	return ret;
7844	}
7845
7846	static int io_sq_offload_create(struct io_ring_ctx *ctx,	7827	static int io_sq_offload_create(struct io_ring_ctx *ctx,
7847	struct io_uring_params *p)	7828	struct io_uring_params *p)
7848	{	7829	{
@@ -7865,39 +7846,51 @@ static int io_sq_offload_create(struct io_ring_ctx *ctx, · 16 unmodified lines
7865	if (ctx->flags & IORING_SETUP_SQPOLL) {	7846	if (ctx->flags & IORING_SETUP_SQPOLL) {
7866	struct task_struct *tsk;	7847	struct task_struct *tsk;
7867	struct io_sq_data *sqd;	7848	struct io_sq_data *sqd;
		7849	bool attached;
7868		7850
7869	ret = -EPERM;	7851	ret = -EPERM;
7870	if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_NICE))	7852	if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_NICE))
7871	goto err;	7853	goto err;
7872		7854
7873	sqd = io_get_sq_data(p);	7855	sqd = io_get_sq_data(p, &attached);
7874	if (IS_ERR(sqd)) {	7856	if (IS_ERR(sqd)) {
7875	ret = PTR_ERR(sqd);	7857	ret = PTR_ERR(sqd);
7876	goto err;	7858	goto err;
7877	}	7859	}
7878		7860
		7861	ctx->sq_creds = get_current_cred();
7879	ctx->sq_data = sqd;	7862	ctx->sq_data = sqd;
7880	io_sq_thread_park(sqd);
7881	mutex_lock(&sqd->ctx_lock);
7882	list_add(&ctx->sqd_list, &sqd->ctx_new_list);
7883	mutex_unlock(&sqd->ctx_lock);
7884	io_sq_thread_unpark(sqd);
7885
7886	ctx->sq_thread_idle = msecs_to_jiffies(p->sq_thread_idle);	7863	ctx->sq_thread_idle = msecs_to_jiffies(p->sq_thread_idle);
7887	if (!ctx->sq_thread_idle)	7864	if (!ctx->sq_thread_idle)
7888	ctx->sq_thread_idle = HZ;	7865	ctx->sq_thread_idle = HZ;
7889		7866
7890	if (sqd->thread)	7867	ret = 0;
		7868	io_sq_thread_park(sqd);
		7869	/* don't attach to a dying SQPOLL thread, would be racy */
		7870	if (attached && !sqd->thread) {
		7871	ret = -ENXIO;
		7872	} else {
		7873	list_add(&ctx->sqd_list, &sqd->ctx_list);
		7874	io_sqd_update_thread_idle(sqd);
		7875	}
		7876	io_sq_thread_unpark(sqd);
		7877
		7878	if (ret < 0) {
		7879	io_put_sq_data(sqd);
		7880	ctx->sq_data = NULL;
		7881	return ret;
		7882	} else if (attached) {
7891	return 0;	7883	return 0;
		7884	}
7892		7885
7893	if (p->flags & IORING_SETUP_SQ_AFF) {	7886	if (p->flags & IORING_SETUP_SQ_AFF) {
7894	int cpu = p->sq_thread_cpu;	7887	int cpu = p->sq_thread_cpu;
7895		7888
7896	ret = -EINVAL;	7889	ret = -EINVAL;
7897	if (cpu >= nr_cpu_ids)	7890	if (cpu >= nr_cpu_ids)
7898	goto err;	7891	goto err_sqpoll;
7899	if (!cpu_online(cpu))	7892	if (!cpu_online(cpu))
7900	goto err;	7893	goto err_sqpoll;
7901		7894
7902	sqd->sq_cpu = cpu;	7895	sqd->sq_cpu = cpu;
7903	} else {	7896	} else {
@@ -7905,15 +7898,15 @@ static int io_sq_offload_create(struct io_ring_ctx *ctx, · 1 unmodified line
7905	}	7898	}
7906		7899
7907	sqd->task_pid = current->pid;	7900	sqd->task_pid = current->pid;
		7901	sqd->task_tgid = current->tgid;
7908	tsk = create_io_thread(io_sq_thread, sqd, NUMA_NO_NODE);	7902	tsk = create_io_thread(io_sq_thread, sqd, NUMA_NO_NODE);
7909	if (IS_ERR(tsk)) {	7903	if (IS_ERR(tsk)) {
7910	ret = PTR_ERR(tsk);	7904	ret = PTR_ERR(tsk);
7911	goto err;	7905	goto err_sqpoll;
7912	}	7906	}
7913	ret = io_uring_alloc_task_context(tsk, ctx);	7907
7914	if (ret)
7915	set_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state);
7916	sqd->thread = tsk;	7908	sqd->thread = tsk;
		7909	ret = io_uring_alloc_task_context(tsk, ctx);
7917	wake_up_new_task(tsk);	7910	wake_up_new_task(tsk);
7918	if (ret)	7911	if (ret)
7919	goto err;	7912	goto err;
@@ -7927,15 +7920,9 @@ static int io_sq_offload_create(struct io_ring_ctx *ctx, · 7 unmodified lines
7927	err:	7920	err:
7928	io_sq_thread_finish(ctx);	7921	io_sq_thread_finish(ctx);
7929	return ret;	7922	return ret;
7930	}	7923	err_sqpoll:
7931		7924	complete(&ctx->sq_data->exited);
7932	static void io_sq_offload_start(struct io_ring_ctx *ctx)	7925	goto err;
7933	{
7934	struct io_sq_data *sqd = ctx->sq_data;
7935
7936	ctx->flags &= ~IORING_SETUP_R_DISABLED;
7937	if (ctx->flags & IORING_SETUP_SQPOLL)
7938	complete(&sqd->startup);
7939	}	7926	}
7940		7927
7941	static inline void __io_unaccount_mem(struct user_struct *user,	7928	static inline void __io_unaccount_mem(struct user_struct *user,
@@ -8418,7 +8405,6 @@ static void io_ring_ctx_free(struct io_ring_ctx *ctx) · 476 unmodified lines
8418	mutex_unlock(&ctx->uring_lock);	8405	mutex_unlock(&ctx->uring_lock);
8419	io_eventfd_unregister(ctx);	8406	io_eventfd_unregister(ctx);
8420	io_destroy_buffers(ctx);	8407	io_destroy_buffers(ctx);
8421	idr_destroy(&ctx->personality_idr);
8422		8408
8423	#if defined(CONFIG_UNIX)	8409	#if defined(CONFIG_UNIX)
8424	if (ctx->ring_sock) {	8410	if (ctx->ring_sock) {
@@ -8483,7 +8469,7 @@ static int io_unregister_personality(struct io_ring_ctx *ctx, unsigned id) · 58 unmodified lines
8483	{	8469	{
8484	const struct cred *creds;	8470	const struct cred *creds;
8485		8471
8486	creds = idr_remove(&ctx->personality_idr, id);	8472	creds = xa_erase(&ctx->personalities, id);
8487	if (creds) {	8473	if (creds) {
8488	put_cred(creds);	8474	put_cred(creds);
8489	return 0;	8475	return 0;
@@ -8492,14 +8478,6 @@ static int io_unregister_personality(struct io_ring_ctx *ctx, unsigned id) · 2 unmodified lines
8492	return -EINVAL;	8478	return -EINVAL;
8493	}	8479	}
8494		8480
8495	static int io_remove_personalities(int id, void p, void data)
8496	{
8497	struct io_ring_ctx *ctx = data;
8498
8499	io_unregister_personality(ctx, id);
8500	return 0;
8501	}
8502
8503	static bool io_run_ctx_fallback(struct io_ring_ctx *ctx)	8481	static bool io_run_ctx_fallback(struct io_ring_ctx *ctx)
8504	{	8482	{
8505	struct callback_head work, next;	8483	struct callback_head work, next;
@@ -8522,10 +8500,34 @@ static bool io_run_ctx_fallback(struct io_ring_ctx *ctx) · 16 unmodified lines
8522	return executed;	8500	return executed;
8523	}	8501	}
8524		8502
		8503	struct io_tctx_exit {
		8504	struct callback_head task_work;
		8505	struct completion completion;
		8506	struct io_ring_ctx *ctx;
		8507	};
		8508
		8509	static void io_tctx_exit_cb(struct callback_head *cb)
		8510	{
		8511	struct io_uring_task *tctx = current->io_uring;
		8512	struct io_tctx_exit *work;
		8513
		8514	work = container_of(cb, struct io_tctx_exit, task_work);
		8515	/*
		8516	* When @in_idle, we're in cancellation and it's racy to remove the
		8517	* node. It'll be removed by the end of cancellation, just ignore it.
		8518	*/
		8519	if (!atomic_read(&tctx->in_idle))
		8520	io_uring_del_task_file((unsigned long)work->ctx);
		8521	complete(&work->completion);
		8522	}
		8523
8525	static void io_ring_exit_work(struct work_struct *work)	8524	static void io_ring_exit_work(struct work_struct *work)
8526	{	8525	{
8527	struct io_ring_ctx *ctx = container_of(work, struct io_ring_ctx,	8526	struct io_ring_ctx *ctx = container_of(work, struct io_ring_ctx, exit_work);
8528	exit_work);	8527	unsigned long timeout = jiffies + HZ * 60 * 5;
		8528	struct io_tctx_exit exit;
		8529	struct io_tctx_node *node;
		8530	int ret;
8529		8531
8530	/*	8532	/*
8531	* If we're doing polled IO and end up having requests being	8533	* If we're doing polled IO and end up having requests being
@@ -8535,19 +8537,47 @@ static void io_ring_exit_work(struct work_struct *work) · 3 unmodified lines
8535	*/	8537	*/
8536	do {	8538	do {
8537	io_uring_try_cancel_requests(ctx, NULL, NULL);	8539	io_uring_try_cancel_requests(ctx, NULL, NULL);
		8540
		8541	WARN_ON_ONCE(time_after(jiffies, timeout));
8538	} while (!wait_for_completion_timeout(&ctx->ref_comp, HZ/20));	8542	} while (!wait_for_completion_timeout(&ctx->ref_comp, HZ/20));
		8543
		8544	mutex_lock(&ctx->uring_lock);
		8545	while (!list_empty(&ctx->tctx_list)) {
		8546	WARN_ON_ONCE(time_after(jiffies, timeout));
		8547
		8548	node = list_first_entry(&ctx->tctx_list, struct io_tctx_node,
		8549	ctx_node);
		8550	exit.ctx = ctx;
		8551	init_completion(&exit.completion);
		8552	init_task_work(&exit.task_work, io_tctx_exit_cb);
		8553	ret = task_work_add(node->task, &exit.task_work, TWA_SIGNAL);
		8554	if (WARN_ON_ONCE(ret))
		8555	continue;
		8556	wake_up_process(node->task);
		8557
		8558	mutex_unlock(&ctx->uring_lock);
		8559	wait_for_completion(&exit.completion);
		8560	cond_resched();
		8561	mutex_lock(&ctx->uring_lock);
		8562	}
		8563	mutex_unlock(&ctx->uring_lock);
		8564
8539	io_ring_ctx_free(ctx);	8565	io_ring_ctx_free(ctx);
8540	}	8566	}
8541		8567
8542	static void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx)	8568	static void io_ring_ctx_wait_and_kill(struct io_ring_ctx *ctx)
8543	{	8569	{
		8570	unsigned long index;
		8571	struct creds *creds;
		8572
8544	mutex_lock(&ctx->uring_lock);	8573	mutex_lock(&ctx->uring_lock);
8545	percpu_ref_kill(&ctx->refs);	8574	percpu_ref_kill(&ctx->refs);
8546	/* if force is set, the ring is going away. always drop after that */	8575	/* if force is set, the ring is going away. always drop after that */
8547	ctx->cq_overflow_flushed = 1;	8576	ctx->cq_overflow_flushed = 1;
8548	if (ctx->rings)	8577	if (ctx->rings)
8549	__io_cqring_overflow_flush(ctx, true, NULL, NULL);	8578	__io_cqring_overflow_flush(ctx, true, NULL, NULL);
8550	idr_for_each(&ctx->personality_idr, io_remove_personalities, ctx);	8579	xa_for_each(&ctx->personalities, index, creds)
		8580	io_unregister_personality(ctx, index);
8551	mutex_unlock(&ctx->uring_lock);	8581	mutex_unlock(&ctx->uring_lock);
8552		8582
8553	io_kill_timeouts(ctx, NULL, NULL);	8583	io_kill_timeouts(ctx, NULL, NULL);
@@ -8600,11 +8630,11 @@ static bool io_cancel_task_cb(struct io_wq_work work, void data) · 46 unmodified lines
8600	return ret;	8630	return ret;
8601	}	8631	}
8602		8632
8603	static void io_cancel_defer_files(struct io_ring_ctx *ctx,	8633	static bool io_cancel_defer_files(struct io_ring_ctx *ctx,
8604	struct task_struct *task,	8634	struct task_struct *task,
8605	struct files_struct *files)	8635	struct files_struct *files)
8606	{	8636	{
8607	struct io_defer_entry *de = NULL;	8637	struct io_defer_entry *de;
8608	LIST_HEAD(list);	8638	LIST_HEAD(list);
8609		8639
8610	spin_lock_irq(&ctx->completion_lock);	8640	spin_lock_irq(&ctx->completion_lock);
@@ -8615,6 +8645,8 @@ static void io_cancel_defer_files(struct io_ring_ctx *ctx, · 4 unmodified lines
8615	}	8645	}
8616	}	8646	}
8617	spin_unlock_irq(&ctx->completion_lock);	8647	spin_unlock_irq(&ctx->completion_lock);
		8648	if (list_empty(&list))
		8649	return false;
8618		8650
8619	while (!list_empty(&list)) {	8651	while (!list_empty(&list)) {
8620	de = list_first_entry(&list, struct io_defer_entry, list);	8652	de = list_first_entry(&list, struct io_defer_entry, list);
@@ -8624,6 +8656,38 @@ static void io_cancel_defer_files(struct io_ring_ctx *ctx, · 3 unmodified lines
8624	io_req_complete(de->req, -ECANCELED);	8656	io_req_complete(de->req, -ECANCELED);
8625	kfree(de);	8657	kfree(de);
8626	}	8658	}
		8659	return true;
		8660	}
		8661
		8662	static bool io_cancel_ctx_cb(struct io_wq_work work, void data)
		8663	{
		8664	struct io_kiocb *req = container_of(work, struct io_kiocb, work);
		8665
		8666	return req->ctx == data;
		8667	}
		8668
		8669	static bool io_uring_try_cancel_iowq(struct io_ring_ctx *ctx)
		8670	{
		8671	struct io_tctx_node *node;
		8672	enum io_wq_cancel cret;
		8673	bool ret = false;
		8674
		8675	mutex_lock(&ctx->uring_lock);
		8676	list_for_each_entry(node, &ctx->tctx_list, ctx_node) {
		8677	struct io_uring_task *tctx = node->task->io_uring;
		8678
		8679	/*
		8680	* io_wq will stay alive while we hold uring_lock, because it's
		8681	* killed after ctx nodes, which requires to take the lock.
		8682	*/
		8683	if (!tctx \|\| !tctx->io_wq)
		8684	continue;
		8685	cret = io_wq_cancel_cb(tctx->io_wq, io_cancel_ctx_cb, ctx, true);
		8686	ret \|= (cret != IO_WQ_CANCEL_NOTFOUND);
		8687	}
		8688	mutex_unlock(&ctx->uring_lock);
		8689
		8690	return ret;
8627	}	8691	}
8628		8692
8629	static void io_uring_try_cancel_requests(struct io_ring_ctx *ctx,	8693	static void io_uring_try_cancel_requests(struct io_ring_ctx *ctx,
@@ -8631,27 +8695,34 @@ static void io_uring_try_cancel_requests(struct io_ring_ctx *ctx, · 1 unmodified line
8631	struct files_struct *files)	8695	struct files_struct *files)
8632	{	8696	{
8633	struct io_task_cancel cancel = { .task = task, .files = files, };	8697	struct io_task_cancel cancel = { .task = task, .files = files, };
8634	struct task_struct *tctx_task = task ?: current;	8698	struct io_uring_task *tctx = task ? task->io_uring : NULL;
8635	struct io_uring_task *tctx = tctx_task->io_uring;
8636		8699
8637	while (1) {	8700	while (1) {
8638	enum io_wq_cancel cret;	8701	enum io_wq_cancel cret;
8639	bool ret = false;	8702	bool ret = false;
8640		8703
8641	if (tctx && tctx->io_wq) {	8704	if (!task) {
		8705	ret \|= io_uring_try_cancel_iowq(ctx);
		8706	} else if (tctx && tctx->io_wq) {
		8707	/*
		8708	* Cancels requests of all rings, not only @ctx, but
		8709	* it's fine as the task is in exit/exec.
		8710	*/
8642	cret = io_wq_cancel_cb(tctx->io_wq, io_cancel_task_cb,	8711	cret = io_wq_cancel_cb(tctx->io_wq, io_cancel_task_cb,
8643	&cancel, true);	8712	&cancel, true);
8644	ret \|= (cret != IO_WQ_CANCEL_NOTFOUND);	8713	ret \|= (cret != IO_WQ_CANCEL_NOTFOUND);
8645	}	8714	}
8646		8715
8647	/* SQPOLL thread does its own polling */	8716	/* SQPOLL thread does its own polling */
8648	if (!(ctx->flags & IORING_SETUP_SQPOLL) && !files) {	8717	if ((!(ctx->flags & IORING_SETUP_SQPOLL) && !files) \|\|
		8718	(ctx->sq_data && ctx->sq_data->thread == current)) {
8649	while (!list_empty_careful(&ctx->iopoll_list)) {	8719	while (!list_empty_careful(&ctx->iopoll_list)) {
8650	io_iopoll_try_reap_events(ctx);	8720	io_iopoll_try_reap_events(ctx);
8651	ret = true;	8721	ret = true;
8652	}	8722	}
8653	}	8723	}
8654		8724
		8725	ret \|= io_cancel_defer_files(ctx, task, files);
8655	ret \|= io_poll_remove_all(ctx, task, files);	8726	ret \|= io_poll_remove_all(ctx, task, files);
8656	ret \|= io_kill_timeouts(ctx, task, files);	8727	ret \|= io_kill_timeouts(ctx, task, files);
8657	ret \|= io_run_task_work();	8728	ret \|= io_run_task_work();
@@ -8691,58 +8762,21 @@ static void io_uring_cancel_files(struct io_ring_ctx *ctx, · 33 unmodified lines
8691		8762
8692	io_uring_try_cancel_requests(ctx, task, files);	8763	io_uring_try_cancel_requests(ctx, task, files);
8693		8764
8694	if (ctx->sq_data)
8695	io_sq_thread_unpark(ctx->sq_data);
8696	prepare_to_wait(&task->io_uring->wait, &wait,	8765	prepare_to_wait(&task->io_uring->wait, &wait,
8697	TASK_UNINTERRUPTIBLE);	8766	TASK_UNINTERRUPTIBLE);
8698	if (inflight == io_uring_count_inflight(ctx, task, files))	8767	if (inflight == io_uring_count_inflight(ctx, task, files))
8699	schedule();	8768	schedule();
8700	finish_wait(&task->io_uring->wait, &wait);	8769	finish_wait(&task->io_uring->wait, &wait);
8701	if (ctx->sq_data)
8702	io_sq_thread_park(ctx->sq_data);
8703	}
8704	}
8705
8706	/*
8707	* We need to iteratively cancel requests, in case a request has dependent
8708	* hard links. These persist even for failure of cancelations, hence keep
8709	* looping until none are found.
8710	*/
8711	static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx,
8712	struct files_struct *files)
8713	{
8714	struct task_struct *task = current;
8715
8716	if ((ctx->flags & IORING_SETUP_SQPOLL) && ctx->sq_data) {
8717	/* never started, nothing to cancel */
8718	if (ctx->flags & IORING_SETUP_R_DISABLED) {
8719	io_sq_offload_start(ctx);
8720	return;
8721	}
8722	io_sq_thread_park(ctx->sq_data);
8723	task = ctx->sq_data->thread;
8724	if (task)
8725	atomic_inc(&task->io_uring->in_idle);
8726	}	8770	}
8727
8728	io_cancel_defer_files(ctx, task, files);
8729
8730	io_uring_cancel_files(ctx, task, files);
8731	if (!files)
8732	io_uring_try_cancel_requests(ctx, task, NULL);
8733
8734	if (task)
8735	atomic_dec(&task->io_uring->in_idle);
8736	if (ctx->sq_data)
8737	io_sq_thread_unpark(ctx->sq_data);
8738	}	8771	}
8739		8772
8740	/*	8773	/*
8741	* Note that this task has used io_uring. We use it for cancelation purposes.	8774	* Note that this task has used io_uring. We use it for cancelation purposes.
8742	*/	8775	*/
8743	static int io_uring_add_task_file(struct io_ring_ctx ctx, struct file file)	8776	static int io_uring_add_task_file(struct io_ring_ctx *ctx)
8744	{	8777	{
8745	struct io_uring_task *tctx = current->io_uring;	8778	struct io_uring_task *tctx = current->io_uring;
		8779	struct io_tctx_node *node;
8746	int ret;	8780	int ret;
8747		8781
8748	if (unlikely(!tctx)) {	8782	if (unlikely(!tctx)) {
@@ -8751,102 +8785,151 @@ static int io_uring_add_task_file(struct io_ring_ctx ctx, struct file file) · 2 unmodified lines
8751	return ret;	8785	return ret;
8752	tctx = current->io_uring;	8786	tctx = current->io_uring;
8753	}	8787	}
8754	if (tctx->last != file) {	8788	if (tctx->last != ctx) {
8755	void *old = xa_load(&tctx->xa, (unsigned long)file);	8789	void *old = xa_load(&tctx->xa, (unsigned long)ctx);
8756		8790
8757	if (!old) {	8791	if (!old) {
8758	get_file(file);	8792	node = kmalloc(sizeof(*node), GFP_KERNEL);
8759	ret = xa_err(xa_store(&tctx->xa, (unsigned long)file,	8793	if (!node)
8760	file, GFP_KERNEL));	8794	return -ENOMEM;
		8795	node->ctx = ctx;
		8796	node->task = current;
		8797
		8798	ret = xa_err(xa_store(&tctx->xa, (unsigned long)ctx,
		8799	node, GFP_KERNEL));
8761	if (ret) {	8800	if (ret) {
8762	fput(file);	8801	kfree(node);
8763	return ret;	8802	return ret;
8764	}	8803	}
		8804
		8805	mutex_lock(&ctx->uring_lock);
		8806	list_add(&node->ctx_node, &ctx->tctx_list);
		8807	mutex_unlock(&ctx->uring_lock);
8765	}	8808	}
8766	tctx->last = file;	8809	tctx->last = ctx;
8767	}	8810	}
8768
8769	/*
8770	* This is race safe in that the task itself is doing this, hence it
8771	* cannot be going through the exit/cancel paths at the same time.
8772	* This cannot be modified while exit/cancel is running.
8773	*/
8774	if (!tctx->sqpoll && (ctx->flags & IORING_SETUP_SQPOLL))
8775	tctx->sqpoll = true;
8776
8777	return 0;	8811	return 0;
8778	}	8812	}
8779		8813
8780	/*	8814	/*
8781	* Remove this io_uring_file -> task mapping.	8815	* Remove this io_uring_file -> task mapping.
8782	*/	8816	*/
8783	static void io_uring_del_task_file(struct file *file)	8817	static void io_uring_del_task_file(unsigned long index)
8784	{	8818	{
8785	struct io_uring_task *tctx = current->io_uring;	8819	struct io_uring_task *tctx = current->io_uring;
		8820	struct io_tctx_node *node;
8786		8821
8787	if (tctx->last == file)	8822	if (!tctx)
		8823	return;
		8824	node = xa_erase(&tctx->xa, index);
		8825	if (!node)
		8826	return;
		8827
		8828	WARN_ON_ONCE(current != node->task);
		8829	WARN_ON_ONCE(list_empty(&node->ctx_node));
		8830
		8831	mutex_lock(&node->ctx->uring_lock);
		8832	list_del(&node->ctx_node);
		8833	mutex_unlock(&node->ctx->uring_lock);
		8834
		8835	if (tctx->last == node->ctx)
8788	tctx->last = NULL;	8836	tctx->last = NULL;
8789	file = xa_erase(&tctx->xa, (unsigned long)file);	8837	kfree(node);
8790	if (file)
8791	fput(file);
8792	}	8838	}
8793		8839
8794	static void io_uring_clean_tctx(struct io_uring_task *tctx)	8840	static void io_uring_clean_tctx(struct io_uring_task *tctx)
8795	{	8841	{
8796	struct file *file;	8842	struct io_tctx_node *node;
8797	unsigned long index;	8843	unsigned long index;
8798		8844
8799	xa_for_each(&tctx->xa, index, file)	8845	xa_for_each(&tctx->xa, index, node)
8800	io_uring_del_task_file(file);	8846	io_uring_del_task_file(index);
8801	if (tctx->io_wq) {	8847	if (tctx->io_wq) {
8802	io_wq_put_and_exit(tctx->io_wq);	8848	io_wq_put_and_exit(tctx->io_wq);
8803	tctx->io_wq = NULL;	8849	tctx->io_wq = NULL;
8804	}	8850	}
8805	}	8851	}
8806		8852
		8853	static s64 tctx_inflight(struct io_uring_task *tctx)
		8854	{
		8855	return percpu_counter_sum(&tctx->inflight);
		8856	}
		8857
		8858	static void io_sqpoll_cancel_cb(struct callback_head *cb)
		8859	{
		8860	struct io_tctx_exit *work = container_of(cb, struct io_tctx_exit, task_work);
		8861	struct io_ring_ctx *ctx = work->ctx;
		8862	struct io_sq_data *sqd = ctx->sq_data;
		8863
		8864	if (sqd->thread)
		8865	io_uring_cancel_sqpoll(ctx);
		8866	complete(&work->completion);
		8867	}
		8868
		8869	static void io_sqpoll_cancel_sync(struct io_ring_ctx *ctx)
		8870	{
		8871	struct io_sq_data *sqd = ctx->sq_data;
		8872	struct io_tctx_exit work = { .ctx = ctx, };
		8873	struct task_struct *task;
		8874
		8875	io_sq_thread_park(sqd);
		8876	list_del_init(&ctx->sqd_list);
		8877	io_sqd_update_thread_idle(sqd);
		8878	task = sqd->thread;
		8879	if (task) {
		8880	init_completion(&work.completion);
		8881	init_task_work(&work.task_work, io_sqpoll_cancel_cb);
		8882	WARN_ON_ONCE(task_work_add(task, &work.task_work, TWA_SIGNAL));
		8883	wake_up_process(task);
		8884	}
		8885	io_sq_thread_unpark(sqd);
		8886
		8887	if (task)
		8888	wait_for_completion(&work.completion);
		8889	}
		8890
8807	void __io_uring_files_cancel(struct files_struct *files)	8891	void __io_uring_files_cancel(struct files_struct *files)
8808	{	8892	{
8809	struct io_uring_task *tctx = current->io_uring;	8893	struct io_uring_task *tctx = current->io_uring;
8810	struct file *file;	8894	struct io_tctx_node *node;
8811	unsigned long index;	8895	unsigned long index;
8812		8896
8813	/* make sure overflow events are dropped */	8897	/* make sure overflow events are dropped */
8814	atomic_inc(&tctx->in_idle);	8898	atomic_inc(&tctx->in_idle);
8815	xa_for_each(&tctx->xa, index, file)	8899	xa_for_each(&tctx->xa, index, node) {
8816	io_uring_cancel_task_requests(file->private_data, files);	8900	struct io_ring_ctx *ctx = node->ctx;
		8901
		8902	if (ctx->sq_data) {
		8903	io_sqpoll_cancel_sync(ctx);
		8904	continue;
		8905	}
		8906	io_uring_cancel_files(ctx, current, files);
		8907	if (!files)
		8908	io_uring_try_cancel_requests(ctx, current, NULL);
		8909	}
8817	atomic_dec(&tctx->in_idle);	8910	atomic_dec(&tctx->in_idle);
8818		8911
8819	if (files)	8912	if (files)
8820	io_uring_clean_tctx(tctx);	8913	io_uring_clean_tctx(tctx);
8821	}	8914	}
8822		8915
8823	static s64 tctx_inflight(struct io_uring_task *tctx)	8916	/* should only be called by SQPOLL task */
8824	{
8825	return percpu_counter_sum(&tctx->inflight);
8826	}
8827
8828	static void io_uring_cancel_sqpoll(struct io_ring_ctx *ctx)	8917	static void io_uring_cancel_sqpoll(struct io_ring_ctx *ctx)
8829	{	8918	{
8830	struct io_sq_data *sqd = ctx->sq_data;	8919	struct io_sq_data *sqd = ctx->sq_data;
8831	struct io_uring_task *tctx;	8920	struct io_uring_task *tctx = current->io_uring;
8832	s64 inflight;	8921	s64 inflight;
8833	DEFINE_WAIT(wait);	8922	DEFINE_WAIT(wait);
8834		8923
8835	if (!sqd)	8924	WARN_ON_ONCE(!sqd \|\| ctx->sq_data->thread != current);
8836	return;	8925
8837	io_sq_thread_park(sqd);
8838	if (!sqd->thread \|\| !sqd->thread->io_uring) {
8839	io_sq_thread_unpark(sqd);
8840	return;
8841	}
8842	tctx = ctx->sq_data->thread->io_uring;
8843	atomic_inc(&tctx->in_idle);	8926	atomic_inc(&tctx->in_idle);
8844	do {	8927	do {
8845	/* read completions before cancelations */	8928	/* read completions before cancelations */
8846	inflight = tctx_inflight(tctx);	8929	inflight = tctx_inflight(tctx);
8847	if (!inflight)	8930	if (!inflight)
8848	break;	8931	break;
8849	io_uring_cancel_task_requests(ctx, NULL);	8932	io_uring_try_cancel_requests(ctx, current, NULL);
8850		8933
8851	prepare_to_wait(&tctx->wait, &wait, TASK_UNINTERRUPTIBLE);	8934	prepare_to_wait(&tctx->wait, &wait, TASK_UNINTERRUPTIBLE);
8852	/*	8935	/*
@@ -8859,7 +8942,6 @@ static void io_uring_cancel_sqpoll(struct io_ring_ctx *ctx) · 6 unmodified lines
8859	finish_wait(&tctx->wait, &wait);	8942	finish_wait(&tctx->wait, &wait);
8860	} while (1);	8943	} while (1);
8861	atomic_dec(&tctx->in_idle);	8944	atomic_dec(&tctx->in_idle);
8862	io_sq_thread_unpark(sqd);
8863	}	8945	}
8864		8946
8865	/*	8947	/*
@@ -8874,15 +8956,6 @@ void __io_uring_task_cancel(void) · 8 unmodified lines
8874		8956
8875	/* make sure overflow events are dropped */	8957	/* make sure overflow events are dropped */
8876	atomic_inc(&tctx->in_idle);	8958	atomic_inc(&tctx->in_idle);
8877
8878	if (tctx->sqpoll) {
8879	struct file *file;
8880	unsigned long index;
8881
8882	xa_for_each(&tctx->xa, index, file)
8883	io_uring_cancel_sqpoll(file->private_data);
8884	}
8885
8886	do {	8959	do {
8887	/* read completions before cancelations */	8960	/* read completions before cancelations */
8888	inflight = tctx_inflight(tctx);	8961	inflight = tctx_inflight(tctx);
@@ -8981,7 +9054,6 @@ static unsigned long io_uring_nommu_get_unmapped_area(struct file *file, · 92 unmodified lines
8981		9054
8982	static int io_sqpoll_wait_sq(struct io_ring_ctx *ctx)	9055	static int io_sqpoll_wait_sq(struct io_ring_ctx *ctx)
8983	{	9056	{
8984	int ret = 0;
8985	DEFINE_WAIT(wait);	9057	DEFINE_WAIT(wait);
8986		9058
8987	do {	9059	do {
@@ -8995,7 +9067,7 @@ static int io_sqpoll_wait_sq(struct io_ring_ctx *ctx) · 7 unmodified lines
8995	} while (!signal_pending(current));	9067	} while (!signal_pending(current));
8996		9068
8997	finish_wait(&ctx->sqo_sq_wait, &wait);	9069	finish_wait(&ctx->sqo_sq_wait, &wait);
8998	return ret;	9070	return 0;
8999	}	9071	}
9000		9072
9001	static int io_get_ext_arg(unsigned flags, const void __user argp, size_t argsz,	9073	static int io_get_ext_arg(unsigned flags, const void __user argp, size_t argsz,
@@ -9069,13 +9141,10 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit, · 67 unmodified lines
9069	if (ctx->flags & IORING_SETUP_SQPOLL) {	9141	if (ctx->flags & IORING_SETUP_SQPOLL) {
9070	io_cqring_overflow_flush(ctx, false, NULL, NULL);	9142	io_cqring_overflow_flush(ctx, false, NULL, NULL);
9071		9143
9072	if (unlikely(ctx->sqo_exec)) {
9073	ret = io_sq_thread_fork(ctx->sq_data, ctx);
9074	if (ret)
9075	goto out;
9076	ctx->sqo_exec = 0;
9077	}
9078	ret = -EOWNERDEAD;	9144	ret = -EOWNERDEAD;
		9145	if (unlikely(ctx->sq_data->thread == NULL)) {
		9146	goto out;
		9147	}
9079	if (flags & IORING_ENTER_SQ_WAKEUP)	9148	if (flags & IORING_ENTER_SQ_WAKEUP)
9080	wake_up(&ctx->sq_data->wait);	9149	wake_up(&ctx->sq_data->wait);
9081	if (flags & IORING_ENTER_SQ_WAIT) {	9150	if (flags & IORING_ENTER_SQ_WAIT) {
@@ -9085,7 +9154,7 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit, · 3 unmodified lines
9085	}	9154	}
9086	submitted = to_submit;	9155	submitted = to_submit;
9087	} else if (to_submit) {	9156	} else if (to_submit) {
9088	ret = io_uring_add_task_file(ctx, f.file);	9157	ret = io_uring_add_task_file(ctx);
9089	if (unlikely(ret))	9158	if (unlikely(ret))
9090	goto out;	9159	goto out;
9091	mutex_lock(&ctx->uring_lock);	9160	mutex_lock(&ctx->uring_lock);
@@ -9127,10 +9196,9 @@ out_fput: · 35 unmodified lines
9127	}	9196	}
9128		9197
9129	#ifdef CONFIG_PROC_FS	9198	#ifdef CONFIG_PROC_FS
9130	static int io_uring_show_cred(int id, void p, void data)	9199	static int io_uring_show_cred(struct seq_file *m, unsigned int id,
		9200	const struct cred *cred)
9131	{	9201	{
9132	const struct cred *cred = p;
9133	struct seq_file *m = data;
9134	struct user_namespace *uns = seq_user_ns(m);	9202	struct user_namespace *uns = seq_user_ns(m);
9135	struct group_info *gi;	9203	struct group_info *gi;
9136	kernel_cap_t cap;	9204	kernel_cap_t cap;
@@ -9198,9 +9266,13 @@ static void __io_uring_show_fdinfo(struct io_ring_ctx ctx, struct seq_file m) · 61 unmodified lines
9198	seq_printf(m, "%5u: 0x%llx/%u\n", i, buf->ubuf,	9266	seq_printf(m, "%5u: 0x%llx/%u\n", i, buf->ubuf,
9199	(unsigned int) buf->len);	9267	(unsigned int) buf->len);
9200	}	9268	}
9201	if (has_lock && !idr_is_empty(&ctx->personality_idr)) {	9269	if (has_lock && !xa_empty(&ctx->personalities)) {
		9270	unsigned long index;
		9271	const struct cred *cred;
		9272
9202	seq_printf(m, "Personalities:\n");	9273	seq_printf(m, "Personalities:\n");
9203	idr_for_each(&ctx->personality_idr, io_uring_show_cred, m);	9274	xa_for_each(&ctx->personalities, index, cred)
		9275	io_uring_show_cred(m, index, cred);
9204	}	9276	}
9205	seq_printf(m, "PollList:\n");	9277	seq_printf(m, "PollList:\n");
9206	spin_lock_irq(&ctx->completion_lock);	9278	spin_lock_irq(&ctx->completion_lock);
@@ -9294,7 +9366,7 @@ static int io_uring_install_fd(struct io_ring_ctx ctx, struct file file) · 87 unmodified lines
9294	if (fd < 0)	9366	if (fd < 0)
9295	return fd;	9367	return fd;
9296		9368
9297	ret = io_uring_add_task_file(ctx, file);	9369	ret = io_uring_add_task_file(ctx);
9298	if (ret) {	9370	if (ret) {
9299	put_unused_fd(fd);	9371	put_unused_fd(fd);
9300	return ret;	9372	return ret;
@@ -9402,9 +9474,6 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p, · 101 unmodified lines
9402	if (ret)	9474	if (ret)
9403	goto err;	9475	goto err;
9404		9476
9405	if (!(p->flags & IORING_SETUP_R_DISABLED))
9406	io_sq_offload_start(ctx);
9407
9408	memset(&p->sq_off, 0, sizeof(p->sq_off));	9477	memset(&p->sq_off, 0, sizeof(p->sq_off));
9409	p->sq_off.head = offsetof(struct io_rings, sq.head);	9478	p->sq_off.head = offsetof(struct io_rings, sq.head);
9410	p->sq_off.tail = offsetof(struct io_rings, sq.tail);	9479	p->sq_off.tail = offsetof(struct io_rings, sq.tail);
@@ -9532,14 +9601,16 @@ out: · 121 unmodified lines
9532	static int io_register_personality(struct io_ring_ctx *ctx)	9601	static int io_register_personality(struct io_ring_ctx *ctx)
9533	{	9602	{
9534	const struct cred *creds;	9603	const struct cred *creds;
		9604	u32 id;
9535	int ret;	9605	int ret;
9536		9606
9537	creds = get_current_cred();	9607	creds = get_current_cred();
9538		9608
9539	ret = idr_alloc_cyclic(&ctx->personality_idr, (void *) creds, 1,	9609	ret = xa_alloc_cyclic(&ctx->personalities, &id, (void *)creds,
9540	USHRT_MAX, GFP_KERNEL);	9610	XA_LIMIT(0, USHRT_MAX), &ctx->pers_next, GFP_KERNEL);
9541	if (ret < 0)	9611	if (!ret)
9542	put_cred(creds);	9612	return id;
		9613	put_cred(creds);
9543	return ret;	9614	return ret;
9544	}	9615	}
9545		9616
@@ -9621,7 +9692,9 @@ static int io_register_enable_rings(struct io_ring_ctx *ctx) · 75 unmodified lines
9621	if (ctx->restrictions.registered)	9692	if (ctx->restrictions.registered)
9622	ctx->restricted = 1;	9693	ctx->restricted = 1;
9623		9694
9624	io_sq_offload_start(ctx);	9695	ctx->flags &= ~IORING_SETUP_R_DISABLED;
		9696	if (ctx->sq_data && wq_has_sleeper(&ctx->sq_data->wait))
		9697	wake_up(&ctx->sq_data->wait);
9625	return 0;	9698	return 0;
9626	}	9699	}
9627		9700

fs/iomap/buffered-io.c+2−2

@@ -1221,7 +1221,7 @@ iomap_alloc_ioend(struct inode inode, struct iomap_writepage_ctx wpc, · 1220 unmodified lines
1221	struct iomap_ioend *ioend;	1221	struct iomap_ioend *ioend;
1222	struct bio *bio;	1222	struct bio *bio;
1223		1223
1224	bio = bio_alloc_bioset(GFP_NOFS, BIO_MAX_PAGES, &iomap_ioend_bioset);	1224	bio = bio_alloc_bioset(GFP_NOFS, BIO_MAX_VECS, &iomap_ioend_bioset);
1225	bio_set_dev(bio, wpc->iomap.bdev);	1225	bio_set_dev(bio, wpc->iomap.bdev);
1226	bio->bi_iter.bi_sector = sector;	1226	bio->bi_iter.bi_sector = sector;
1227	bio->bi_opf = REQ_OP_WRITE \| wbc_to_write_flags(wbc);	1227	bio->bi_opf = REQ_OP_WRITE \| wbc_to_write_flags(wbc);
@@ -1252,7 +1252,7 @@ iomap_chain_bio(struct bio *prev) · 24 unmodified lines
1252	{	1252	{
1253	struct bio *new;	1253	struct bio *new;
1254		1254
1255	new = bio_alloc(GFP_NOFS, BIO_MAX_PAGES);	1255	new = bio_alloc(GFP_NOFS, BIO_MAX_VECS);
1256	bio_copy_dev(new, prev);/* also copies over blkcg information */	1256	bio_copy_dev(new, prev);/* also copies over blkcg information */
1257	new->bi_iter.bi_sector = bio_end_sector(prev);	1257	new->bi_iter.bi_sector = bio_end_sector(prev);
1258	new->bi_opf = prev->bi_opf;	1258	new->bi_opf = prev->bi_opf;

fs/iomap/direct-io.c+2−2

@@ -296,7 +296,7 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length, · 295 unmodified lines
296	*/	296	*/
297	bio_opf = iomap_dio_bio_opflags(dio, iomap, use_fua);	297	bio_opf = iomap_dio_bio_opflags(dio, iomap, use_fua);
298		298
299	nr_pages = bio_iov_vecs_to_alloc(dio->submit.iter, BIO_MAX_PAGES);	299	nr_pages = bio_iov_vecs_to_alloc(dio->submit.iter, BIO_MAX_VECS);
300	do {	300	do {
301	size_t n;	301	size_t n;
302	if (dio->error) {	302	if (dio->error) {
@@ -338,7 +338,7 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length, · 35 unmodified lines
338	copied += n;	338	copied += n;
339		339
340	nr_pages = bio_iov_vecs_to_alloc(dio->submit.iter,	340	nr_pages = bio_iov_vecs_to_alloc(dio->submit.iter,
341	BIO_MAX_PAGES);	341	BIO_MAX_VECS);
342	iomap_dio_submit_bio(dio, iomap, bio, pos);	342	iomap_dio_submit_bio(dio, iomap, bio, pos);
343	pos += n;	343	pos += n;
344	} while (nr_pages);	344	} while (nr_pages);

fs/locks.c+0−3

@@ -1808,9 +1808,6 @@ check_conflicting_open(struct file *filp, const long arg, int flags) · 1807 unmodified lines
1808		1808
1809	if (flags & FL_LAYOUT)	1809	if (flags & FL_LAYOUT)
1810	return 0;	1810	return 0;
1811	if (flags & FL_DELEG)
1812	/* We leave these checks to the caller. */
1813	return 0;
1814		1811
1815	if (arg == F_RDLCK)	1812	if (arg == F_RDLCK)
1816	return inode_is_open_for_write(inode) ? -EAGAIN : 0;	1813	return inode_is_open_for_write(inode) ? -EAGAIN : 0;

fs/mpage.c+1−1

@@ -616,7 +616,7 @@ alloc_new: · 615 unmodified lines
616	goto out;	616	goto out;
617	}	617	}
618	bio = mpage_alloc(bdev, blocks[0] << (blkbits - 9),	618	bio = mpage_alloc(bdev, blocks[0] << (blkbits - 9),
619	BIO_MAX_PAGES, GFP_NOFS\|__GFP_HIGH);	619	BIO_MAX_VECS, GFP_NOFS\|__GFP_HIGH);
620	if (bio == NULL)	620	if (bio == NULL)
621	goto confused;	621	goto confused;
622		622

fs/nfs/Kconfig+1−1

@@ -127,7 +127,7 @@ config PNFS_BLOCK · 126 unmodified lines
127	config PNFS_FLEXFILE_LAYOUT	127	config PNFS_FLEXFILE_LAYOUT
128	tristate	128	tristate
129	depends on NFS_V4_1 && NFS_V3	129	depends on NFS_V4_1 && NFS_V3
130	default m	130	default NFS_V4
131		131
132	config NFS_V4_1_IMPLEMENTATION_ID_DOMAIN	132	config NFS_V4_1_IMPLEMENTATION_ID_DOMAIN
133	string "NFSv4.1 Implementation ID Domain"	133	string "NFSv4.1 Implementation ID Domain"

fs/nfs/dir.c+33−25

 		spin_lock(&dir->i_lock);
 		if (list_empty(&nfsi->open_files) &&
 		    (nfsi->cache_validity & NFS_INO_DATA_INVAL_DEFER))
-			nfsi->cache_validity |= NFS_INO_INVALID_DATA |
+			nfs_set_cache_invalid(dir,
-				NFS_INO_REVAL_FORCED;
+					      NFS_INO_INVALID_DATA |
+						      NFS_INO_REVAL_FORCED);
 		list_add(&ctx->list, &nfsi->open_files);
 		spin_unlock(&dir->i_lock);
 		return ctx;
 	goto out;
 }
+static void nfs_mark_dir_for_revalidate(struct inode *inode)
+{
+	spin_lock(&inode->i_lock);
+	nfs_set_cache_invalid(inode, NFS_INO_REVAL_PAGECACHE);
+	spin_unlock(&inode->i_lock);
+}
 /*
  * We judge how long we want to trust negative
  * dentries by looking at the parent inode mtime.
 			__func__, dentry);
 		return 1;
 	case 0:
-		nfs_mark_for_revalidate(dir);
+		/*
-		if (inode && S_ISDIR(inode->i_mode)) {
+		 * We can't d_drop the root of a disconnected tree:
-			/* Purge readdir caches. */
+		 * its d_hash is on the s_anon list and d_drop() would hide
-			nfs_zap_caches(inode);
+		 * it from shrink_dcache_for_unmount(), leading to busy
-			/*
+		 * inodes on unmount and further oopses.
-			 * We can't d_drop the root of a disconnected tree:
+		 */
-			 * its d_hash is on the s_anon list and d_drop() would hide
+		if (inode && IS_ROOT(dentry))
-			 * it from shrink_dcache_for_unmount(), leading to busy
+			return 1;
-			 * inodes on unmount and further oopses.
-			 */
-			if (IS_ROOT(dentry))
-				return 1;
-		}
 		dfprintk(LOOKUPCACHE, "NFS: %s(%pd2) is invalid\n",
 				__func__, dentry);
 		return 0;
 	nfs_free_fattr(fattr);
 	nfs_free_fhandle(fhandle);
 	nfs4_label_free(label);
+	/*
+	 * If the lookup failed despite the dentry change attribute being
+	 * a match, then we should revalidate the directory cache.
+	 */
+	if (!ret && nfs_verify_change_attribute(dir, dentry->d_time))
+		nfs_mark_dir_for_revalidate(dir);
 	return nfs_lookup_revalidate_done(dir, dentry, inode, ret);
 }
 		error = nfs_lookup_verify_inode(inode, flags);
 		if (error) {
 			if (error == -ESTALE)
-				nfs_zap_caches(dir);
+				nfs_mark_dir_for_revalidate(dir);
 			goto out_bad;
 		}
 		nfs_advise_use_readdirplus(dir);
 	if (inode->i_nlink > 0)
 		drop_nlink(inode);
 	NFS_I(inode)->attr_gencount = nfs_inc_attr_generation_counter();
-	NFS_I(inode)->cache_validity |= NFS_INO_INVALID_CHANGE
+	nfs_set_cache_invalid(
-		| NFS_INO_INVALID_CTIME
+		inode, NFS_INO_INVALID_CHANGE | NFS_INO_INVALID_CTIME |
-		| NFS_INO_INVALID_OTHER
+			       NFS_INO_INVALID_OTHER | NFS_INO_REVAL_FORCED);
-		| NFS_INO_REVAL_FORCED;
 	spin_unlock(&inode->i_lock);
 }
 {
 	if (S_ISDIR(inode->i_mode))
 		/* drop any readdir cache as it could easily be old */
-		NFS_I(inode)->cache_validity |= NFS_INO_INVALID_DATA;
+		nfs_set_cache_invalid(inode, NFS_INO_INVALID_DATA);
 	if (dentry->d_flags & DCACHE_NFSFS_RENAMED) {
 		nfs_complete_unlink(dentry, inode);
 	dput(parent);
 	return d;
 out_error:
-	nfs_mark_for_revalidate(dir);
 	d = ERR_PTR(error);
 	goto out;
 }
 	if (error == 0) {
 		spin_lock(&old_inode->i_lock);
 		NFS_I(old_inode)->attr_gencount = nfs_inc_attr_generation_counter();
-		NFS_I(old_inode)->cache_validity |= NFS_INO_INVALID_CHANGE
+		nfs_set_cache_invalid(old_inode, NFS_INO_INVALID_CHANGE |
-			| NFS_INO_INVALID_CTIME
+							 NFS_INO_INVALID_CTIME |
-			| NFS_INO_REVAL_FORCED;
+							 NFS_INO_REVAL_FORCED);
 		spin_unlock(&old_inode->i_lock);
 	}
 out:

fs/nfs/inode.c+4−3

 }
 #endif
-static void nfs_set_cache_invalid(struct inode *inode, unsigned long flags)
+void nfs_set_cache_invalid(struct inode *inode, unsigned long flags)
 {
 	struct nfs_inode *nfsi = NFS_I(inode);
 	bool have_delegation = NFS_PROTO(inode)->have_delegation(inode, FMODE_READ);
 	if (flags & NFS_INO_INVALID_DATA)
 		nfs_fscache_invalidate(inode);
 }
+EXPORT_SYMBOL_GPL(nfs_set_cache_invalid);
 /*
  * Invalidate the local caches
 	spin_lock(&inode->i_lock);
 	if (list_empty(&nfsi->open_files) &&
 	    (nfsi->cache_validity & NFS_INO_DATA_INVAL_DEFER))
-		nfsi->cache_validity |= NFS_INO_INVALID_DATA |
+		nfs_set_cache_invalid(inode, NFS_INO_INVALID_DATA |
-			NFS_INO_REVAL_FORCED;
+						     NFS_INO_REVAL_FORCED);
 	list_add_tail_rcu(&ctx->list, &nfsi->open_files);
 	spin_unlock(&inode->i_lock);
 }

fs/nfs/internal.h+2−1

 extern int nfs_drop_inode(struct inode *);
 extern void nfs_clear_inode(struct inode *);
 extern void nfs_evict_inode(struct inode *);
-void nfs_zap_acl_cache(struct inode *inode);
+extern void nfs_zap_acl_cache(struct inode *inode);
+extern void nfs_set_cache_invalid(struct inode *inode, unsigned long flags);
 extern bool nfs_check_cache_invalid(struct inode *, unsigned long);
 extern int nfs_wait_bit_killable(struct wait_bit_key *key, int mode);
 extern int nfs_wait_atomic_killable(atomic_t *p, unsigned int mode);

fs/nfs/nfs3xdr.c+2−1

 #define NFS3_pagepad_sz		(1) /* Page padding */
 #define NFS3_fhandle_sz		(1+16)
 #define NFS3_fh_sz		(NFS3_fhandle_sz)	/* shorthand */
+#define NFS3_post_op_fh_sz	(1+NFS3_fh_sz)
 #define NFS3_sattr_sz		(15)
 #define NFS3_filename_sz	(1+(NFS3_MAXNAMLEN>>2))
 #define NFS3_path_sz		(1+(NFS3_MAXPATHLEN>>2))
 #define NFS3_readlinkres_sz	(1+NFS3_post_op_attr_sz+1+NFS3_pagepad_sz)
 #define NFS3_readres_sz		(1+NFS3_post_op_attr_sz+3+NFS3_pagepad_sz)
 #define NFS3_writeres_sz	(1+NFS3_wcc_data_sz+4)
-#define NFS3_createres_sz	(1+NFS3_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)
+#define NFS3_createres_sz	(1+NFS3_post_op_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)
 #define NFS3_renameres_sz	(1+(2 * NFS3_wcc_data_sz))
 #define NFS3_linkres_sz		(1+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)
 #define NFS3_readdirres_sz	(1+NFS3_post_op_attr_sz+2+NFS3_pagepad_sz)

fs/nfs/nfs42proc.c+7−5

 	truncate_pagecache_range(dst_inode, pos_dst,
 				 pos_dst + res->write_res.count);
 	spin_lock(&dst_inode->i_lock);
-	NFS_I(dst_inode)->cache_validity |= (NFS_INO_REVAL_PAGECACHE |
+	nfs_set_cache_invalid(
-			NFS_INO_REVAL_FORCED | NFS_INO_INVALID_SIZE |
+		dst_inode, NFS_INO_REVAL_PAGECACHE | NFS_INO_REVAL_FORCED |
-			NFS_INO_INVALID_ATTR | NFS_INO_INVALID_DATA);
+				   NFS_INO_INVALID_SIZE | NFS_INO_INVALID_ATTR |
+				   NFS_INO_INVALID_DATA);
 	spin_unlock(&dst_inode->i_lock);
 	spin_lock(&src_inode->i_lock);
-	NFS_I(src_inode)->cache_validity |= (NFS_INO_REVAL_PAGECACHE |
+	nfs_set_cache_invalid(src_inode, NFS_INO_REVAL_PAGECACHE |
-			NFS_INO_REVAL_FORCED | NFS_INO_INVALID_ATIME);
+						 NFS_INO_REVAL_FORCED |
+						 NFS_INO_INVALID_ATIME);
 	spin_unlock(&src_inode->i_lock);
 	status = res->write_res.count;
 out:

fs/nfs/nfs4proc.c+16−17

 static void
 nfs4_inc_nlink_locked(struct inode *inode)
 {
-	NFS_I(inode)->cache_validity |= NFS_INO_INVALID_OTHER;
+	nfs_set_cache_invalid(inode, NFS_INO_INVALID_OTHER);
 	inc_nlink(inode);
 }
 static void
 nfs4_dec_nlink_locked(struct inode *inode)
 {
-	NFS_I(inode)->cache_validity |= NFS_INO_INVALID_OTHER;
+	nfs_set_cache_invalid(inode, NFS_INO_INVALID_OTHER);
 	drop_nlink(inode);
 }
 {
 	struct nfs_inode *nfsi = NFS_I(inode);
-	nfsi->cache_validity |= NFS_INO_INVALID_CTIME
+	cache_validity |= NFS_INO_INVALID_CTIME | NFS_INO_INVALID_MTIME;
-		| NFS_INO_INVALID_MTIME
-		| cache_validity;
 	if (cinfo->atomic && cinfo->before == inode_peek_iversion_raw(inode)) {
 		nfsi->cache_validity &= ~NFS_INO_REVAL_PAGECACHE;
 		nfsi->attrtimeo_timestamp = jiffies;
 	} else {
 		if (S_ISDIR(inode->i_mode)) {
-			nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+			cache_validity |= NFS_INO_INVALID_DATA;
 			nfs_force_lookup_revalidate(inode);
 		} else {
 			if (!NFS_PROTO(inode)->have_delegation(inode,
 							       FMODE_READ))
-				nfsi->cache_validity |= NFS_INO_REVAL_PAGECACHE;
+				cache_validity |= NFS_INO_REVAL_PAGECACHE;
 		}
 		if (cinfo->before != inode_peek_iversion_raw(inode))
-			nfsi->cache_validity |= NFS_INO_INVALID_ACCESS |
+			cache_validity |= NFS_INO_INVALID_ACCESS |
-						NFS_INO_INVALID_ACL |
+					  NFS_INO_INVALID_ACL |
-						NFS_INO_INVALID_XATTR;
+					  NFS_INO_INVALID_XATTR;
 	}
 	inode_set_iversion_raw(inode, cinfo->after);
 	nfsi->read_cache_jiffies = timestamp;
 	nfsi->attr_gencount = nfs_inc_attr_generation_counter();
+	nfs_set_cache_invalid(inode, cache_validity);
 	nfsi->cache_validity &= ~NFS_INO_INVALID_CHANGE;
-	if (nfsi->cache_validity & NFS_INO_INVALID_DATA)
-		nfs_fscache_invalidate(inode);
 }
 void
 	unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE);
 	int ret, i;
+	/* You can't remove system.nfs4_acl: */
+	if (buflen == 0)
+		return -EINVAL;
 	if (!nfs4_server_supports_acls(server))
 		return -EOPNOTSUPP;
 	if (npages > ARRAY_SIZE(pages))
 	 * so mark the attribute cache invalid.
 	 */
 	spin_lock(&inode->i_lock);
-	NFS_I(inode)->cache_validity |= NFS_INO_INVALID_CHANGE
+	nfs_set_cache_invalid(inode, NFS_INO_INVALID_CHANGE |
-		| NFS_INO_INVALID_CTIME
+					     NFS_INO_INVALID_CTIME |
-		| NFS_INO_REVAL_FORCED;
+					     NFS_INO_REVAL_FORCED);
 	spin_unlock(&inode->i_lock);
 	nfs_access_zap_cache(inode);
 	nfs_zap_acl_cache(inode);
 		return ret;
 	if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL))
 		return -ENOENT;
-	return 0;
+	return label.len;
 }
 static int nfs4_get_security_label(struct inode *inode, void *buf,

fs/nfs/unlink.c+3−3

@@ -500,9 +500,9 @@ nfs_sillyrename(struct inode dir, struct dentry dentry) · 499 unmodified lines
500	nfs_set_verifier(dentry, nfs_save_change_attribute(dir));	500	nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
501	spin_lock(&inode->i_lock);	501	spin_lock(&inode->i_lock);
502	NFS_I(inode)->attr_gencount = nfs_inc_attr_generation_counter();	502	NFS_I(inode)->attr_gencount = nfs_inc_attr_generation_counter();
503	NFS_I(inode)->cache_validity \|= NFS_INO_INVALID_CHANGE	503	nfs_set_cache_invalid(inode, NFS_INO_INVALID_CHANGE \|
504	\| NFS_INO_INVALID_CTIME	504	NFS_INO_INVALID_CTIME \|
505	\| NFS_INO_REVAL_FORCED;	505	NFS_INO_REVAL_FORCED);
506	spin_unlock(&inode->i_lock);	506	spin_unlock(&inode->i_lock);
507	d_move(dentry, sdentry);	507	d_move(dentry, sdentry);
508	break;	508	break;

fs/nfs/write.c+4−4

@@ -303,9 +303,9 @@ static void nfs_set_pageerror(struct address_space *mapping) · 302 unmodified lines
303	nfs_zap_mapping(mapping->host, mapping);	303	nfs_zap_mapping(mapping->host, mapping);
304	/* Force file size revalidation */	304	/* Force file size revalidation */
305	spin_lock(&inode->i_lock);	305	spin_lock(&inode->i_lock);
306	NFS_I(inode)->cache_validity \|= NFS_INO_REVAL_FORCED \|	306	nfs_set_cache_invalid(inode, NFS_INO_REVAL_FORCED \|
307	NFS_INO_REVAL_PAGECACHE \|	307	NFS_INO_REVAL_PAGECACHE \|
308	NFS_INO_INVALID_SIZE;	308	NFS_INO_INVALID_SIZE);
309	spin_unlock(&inode->i_lock);	309	spin_unlock(&inode->i_lock);
310	}	310	}
311		311
@@ -1604,7 +1604,7 @@ static int nfs_writeback_done(struct rpc_task *task, · 1292 unmodified lines
1604	/* Deal with the suid/sgid bit corner case */	1604	/* Deal with the suid/sgid bit corner case */
1605	if (nfs_should_remove_suid(inode)) {	1605	if (nfs_should_remove_suid(inode)) {
1606	spin_lock(&inode->i_lock);	1606	spin_lock(&inode->i_lock);
1607	NFS_I(inode)->cache_validity \|= NFS_INO_INVALID_OTHER;	1607	nfs_set_cache_invalid(inode, NFS_INO_INVALID_OTHER);
1608	spin_unlock(&inode->i_lock);	1608	spin_unlock(&inode->i_lock);
1609	}	1609	}
1610	return 0;	1610	return 0;

fs/nfsd/Kconfig+1−0

@@ -73,6 +73,7 @@ config NFSD_V4 · 72 unmodified lines
73	select NFSD_V3	73	select NFSD_V3
74	select FS_POSIX_ACL	74	select FS_POSIX_ACL
75	select SUNRPC_GSS	75	select SUNRPC_GSS
		76	select CRYPTO
76	select CRYPTO_MD5	77	select CRYPTO_MD5
77	select CRYPTO_SHA256	78	select CRYPTO_SHA256
78	select GRACE_PERIOD	79	select GRACE_PERIOD

fs/nfsd/filecache.c+2−0

 			continue;
 		if (!nfsd_match_cred(nf->nf_cred, current_cred()))
 			continue;
+		if (!test_bit(NFSD_FILE_HASHED, &nf->nf_flags))
+			continue;
 		if (nfsd_file_get(nf) != NULL)
 			return nf;
 	}

fs/nfsd/nfs4callback.c+1−0

@@ -1189,6 +1189,7 @@ static void nfsd4_cb_done(struct rpc_task task, void calldata) · 1188 unmodified lines
1189	switch (task->tk_status) {	1189	switch (task->tk_status) {
1190	case -EIO:	1190	case -EIO:
1191	case -ETIMEDOUT:	1191	case -ETIMEDOUT:
		1192	case -EACCES:
1192	nfsd4_mark_cb_down(clp, task->tk_status);	1193	nfsd4_mark_cb_down(clp, task->tk_status);
1193	}	1194	}
1194	break;	1195	break;

fs/nfsd/nfs4proc.c+1−1

@@ -1302,7 +1302,7 @@ nfsd4_cleanup_inter_ssc(struct vfsmount ss_mnt, struct nfsd_file src, · 1301 unmodified lines
1302	struct nfsd_file *dst)	1302	struct nfsd_file *dst)
1303	{	1303	{
1304	nfs42_ssc_close(src->nf_file);	1304	nfs42_ssc_close(src->nf_file);
1305	/* 'src' is freed by nfsd4_do_async_copy */	1305	fput(src->nf_file);
1306	nfsd_file_put(dst);	1306	nfsd_file_put(dst);
1307	mntput(ss_mnt);	1307	mntput(ss_mnt);
1308	}	1308	}

fs/nfsd/nfs4state.c+15−40

 	return fl;
 }
-static int nfsd4_check_conflicting_opens(struct nfs4_client *clp,
-						struct nfs4_file *fp)
-{
-	struct nfs4_clnt_odstate *co;
-	struct file *f = fp->fi_deleg_file->nf_file;
-	struct inode *ino = locks_inode(f);
-	int writes = atomic_read(&ino->i_writecount);
-	if (fp->fi_fds[O_WRONLY])
-		writes--;
-	if (fp->fi_fds[O_RDWR])
-		writes--;
-	if (writes > 0)
-		return -EAGAIN;
-	spin_lock(&fp->fi_lock);
-	list_for_each_entry(co, &fp->fi_clnt_odstate, co_perfile) {
-		if (co->co_client != clp) {
-			spin_unlock(&fp->fi_lock);
-			return -EAGAIN;
-		}
-	}
-	spin_unlock(&fp->fi_lock);
-	return 0;
-}
 static struct nfs4_delegation *
 nfs4_set_delegation(struct nfs4_client *clp, struct svc_fh *fh,
 		    struct nfs4_file *fp, struct nfs4_clnt_odstate *odstate)
 	nf = find_readable_file(fp);
 	if (!nf) {
-		/*
+		/* We should always have a readable file here */
-		 * We probably could attempt another open and get a read
+		WARN_ON_ONCE(1);
-		 * delegation, but for now, don't bother until the
+		return ERR_PTR(-EBADF);
-		 * client actually sends us one.
-		 */
-		return ERR_PTR(-EAGAIN);
 	}
 	spin_lock(&state_lock);
 	spin_lock(&fp->fi_lock);
 	if (!fl)
 		goto out_clnt_odstate;
-	status = nfsd4_check_conflicting_opens(clp, fp);
-	if (status) {
-		locks_free_lock(fl);
-		goto out_clnt_odstate;
-	}
 	status = vfs_setlease(fp->fi_deleg_file->nf_file, fl->fl_type, &fl, NULL);
 	if (fl)
 		locks_free_lock(fl);
 	if (status)
 		goto out_clnt_odstate;
-	status = nfsd4_check_conflicting_opens(clp, fp);
-	if (status)
-		goto out_clnt_odstate;
 	spin_lock(&state_lock);
 	spin_lock(&fp->fi_lock);
 				goto out_no_deleg;
 			if (!cb_up || !(oo->oo_flags & NFS4_OO_CONFIRMED))
 				goto out_no_deleg;
+			/*
+			 * Also, if the file was opened for write or
+			 * create, there's a good chance the client's
+			 * about to write to it, resulting in an
+			 * immediate recall (since we don't support
+			 * write delegations):
+			 */
+			if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
+				goto out_no_deleg;
+			if (open->op_create == NFS4_OPEN_CREATE)
+				goto out_no_deleg;
 			break;
 		default:
 			goto out_no_deleg;
 	idr_for_each_entry(&nn->s2s_cp_stateids, cps_t, i) {
 		cps = container_of(cps_t, struct nfs4_cpntf_state, cp_stateid);
 		if (cps->cp_stateid.sc_type == NFS4_COPYNOTIFY_STID &&
-				cps->cpntf_time > cutoff)
+				cps->cpntf_time < cutoff)
 			_free_cpntf_state_locked(nn, cps);
 	}
 	spin_unlock(&nn->s2s_cp_lock);

fs/nilfs2/segbuf.c+1−1

@@ -399,7 +399,7 @@ static void nilfs_segbuf_prepare_write(struct nilfs_segment_buffer *segbuf, · 398 unmodified lines
399	{	399	{
400	wi->bio = NULL;	400	wi->bio = NULL;
401	wi->rest_blocks = segbuf->sb_sum.nblocks;	401	wi->rest_blocks = segbuf->sb_sum.nblocks;
402	wi->max_pages = BIO_MAX_PAGES;	402	wi->max_pages = BIO_MAX_VECS;
403	wi->nr_vecs = min(wi->max_pages, wi->rest_blocks);	403	wi->nr_vecs = min(wi->max_pages, wi->rest_blocks);
404	wi->start = wi->end = 0;	404	wi->start = wi->end = 0;
405	wi->blocknr = segbuf->sb_pseg_start;	405	wi->blocknr = segbuf->sb_pseg_start;

fs/pnode.h+1−1

@@ -12,7 +12,7 @@ · 11 unmodified lines
12		12
13	#define IS_MNT_SHARED(m) ((m)->mnt.mnt_flags & MNT_SHARED)	13	#define IS_MNT_SHARED(m) ((m)->mnt.mnt_flags & MNT_SHARED)
14	#define IS_MNT_SLAVE(m) ((m)->mnt_master)	14	#define IS_MNT_SLAVE(m) ((m)->mnt_master)
15	#define IS_MNT_NEW(m) (!(m)->mnt_ns)	15	#define IS_MNT_NEW(m) (!(m)->mnt_ns \|\| is_anon_ns((m)->mnt_ns))
16	#define CLEAR_MNT_SHARED(m) ((m)->mnt.mnt_flags &= ~MNT_SHARED)	16	#define CLEAR_MNT_SHARED(m) ((m)->mnt.mnt_flags &= ~MNT_SHARED)
17	#define IS_MNT_UNBINDABLE(m) ((m)->mnt.mnt_flags & MNT_UNBINDABLE)	17	#define IS_MNT_UNBINDABLE(m) ((m)->mnt.mnt_flags & MNT_UNBINDABLE)
18	#define IS_MNT_MARKED(m) ((m)->mnt.mnt_flags & MNT_MARKED)	18	#define IS_MNT_MARKED(m) ((m)->mnt.mnt_flags & MNT_MARKED)

fs/proc/task_mmu.c+0−2

@@ -1036,8 +1036,6 @@ struct clear_refs_private { · 1035 unmodified lines
1036		1036
1037	#ifdef CONFIG_MEM_SOFT_DIRTY	1037	#ifdef CONFIG_MEM_SOFT_DIRTY
1038		1038
1039	#define is_cow_mapping(flags) (((flags) & (VM_SHARED \| VM_MAYWRITE)) == VM_MAYWRITE)
1040
1041	static inline bool pte_is_pinned(struct vm_area_struct *vma, unsigned long addr, pte_t pte)	1039	static inline bool pte_is_pinned(struct vm_area_struct *vma, unsigned long addr, pte_t pte)
1042	{	1040	{
1043	struct page *page;	1041	struct page *page;

fs/squashfs/block.c+1−1

@@ -87,7 +87,7 @@ static int squashfs_bio_read(struct super_block *sb, u64 index, int length, · 86 unmodified lines
87	int error, i;	87	int error, i;
88	struct bio *bio;	88	struct bio *bio;
89		89
90	if (page_count <= BIO_MAX_PAGES)	90	if (page_count <= BIO_MAX_VECS)
91	bio = bio_alloc(GFP_NOIO, page_count);	91	bio = bio_alloc(GFP_NOIO, page_count);
92	else	92	else
93	bio = bio_kmalloc(GFP_NOIO, page_count);	93	bio = bio_kmalloc(GFP_NOIO, page_count);

fs/zonefs/super.c+1−1

@@ -684,7 +684,7 @@ static ssize_t zonefs_file_dio_append(struct kiocb iocb, struct iov_iter from) · 683 unmodified lines
684	max = ALIGN_DOWN(max << SECTOR_SHIFT, inode->i_sb->s_blocksize);	684	max = ALIGN_DOWN(max << SECTOR_SHIFT, inode->i_sb->s_blocksize);
685	iov_iter_truncate(from, max);	685	iov_iter_truncate(from, max);
686		686
687	nr_pages = iov_iter_npages(from, BIO_MAX_PAGES);	687	nr_pages = iov_iter_npages(from, BIO_MAX_VECS);
688	if (!nr_pages)	688	if (!nr_pages)
689	return 0;	689	return 0;
690		690

include/kvm/arm_pmu.h+7−2

 #define ARMV8_PMU_CYCLE_IDX		(ARMV8_PMU_MAX_COUNTERS - 1)
 #define ARMV8_PMU_MAX_COUNTER_PAIRS	((ARMV8_PMU_MAX_COUNTERS + 1) >> 1)
+DECLARE_STATIC_KEY_FALSE(kvm_arm_pmu_available);
+static __always_inline bool kvm_arm_support_pmu_v3(void)
+{
+	return static_branch_likely(&kvm_arm_pmu_available);
+}
 #ifdef CONFIG_HW_PERF_EVENTS
 struct kvm_pmc {
 void kvm_pmu_handle_pmcr(struct kvm_vcpu *vcpu, u64 val);
 void kvm_pmu_set_counter_event_type(struct kvm_vcpu *vcpu, u64 data,
 				    u64 select_idx);
-bool kvm_arm_support_pmu_v3(void);
 int kvm_arm_pmu_v3_set_attr(struct kvm_vcpu *vcpu,
 			    struct kvm_device_attr *attr);
 int kvm_arm_pmu_v3_get_attr(struct kvm_vcpu *vcpu,
 static inline void kvm_pmu_handle_pmcr(struct kvm_vcpu *vcpu, u64 val) {}
 static inline void kvm_pmu_set_counter_event_type(struct kvm_vcpu *vcpu,
 						  u64 data, u64 select_idx) {}
-static inline bool kvm_arm_support_pmu_v3(void) { return false; }
 static inline int kvm_arm_pmu_v3_set_attr(struct kvm_vcpu *vcpu,
 					  struct kvm_device_attr *attr)
 {

include/linux/acpi.h+8−2

 #if defined(CONFIG_ACPI) && defined(CONFIG_GPIOLIB)
 bool acpi_gpio_get_irq_resource(struct acpi_resource *ares,
 				struct acpi_resource_gpio **agpio);
-int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index);
+int acpi_dev_gpio_irq_get_by(struct acpi_device *adev, const char *name, int index);
 #else
 static inline bool acpi_gpio_get_irq_resource(struct acpi_resource *ares,
 					      struct acpi_resource_gpio **agpio)
 {
 	return false;
 }
-static inline int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index)
+static inline int acpi_dev_gpio_irq_get_by(struct acpi_device *adev,
+					   const char *name, int index)
 {
 	return -ENXIO;
 }
 #endif
+static inline int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index)
+{
+	return acpi_dev_gpio_irq_get_by(adev, NULL, index);
+}
 /* Device properties */
 #ifdef CONFIG_ACPI

include/linux/atmdev.h+1−1

@@ -151,7 +151,7 @@ struct atm_dev { · 150 unmodified lines
151	const char type; / device type name */	151	const char type; / device type name */
152	int number; /* device index */	152	int number; /* device index */
153	void dev_data; / per-device data */	153	void dev_data; / per-device data */
154	void phy_data; / private PHY date */	154	void phy_data; / private PHY data */
155	unsigned long flags; /* device flags (ATM_DF_) /	155	unsigned long flags; /* device flags (ATM_DF_) /
156	struct list_head local; /* local ATM addresses */	156	struct list_head local; /* local ATM addresses */
157	struct list_head lecs; /* LECS ATM addresses learned via ILMI */	157	struct list_head lecs; /* LECS ATM addresses learned via ILMI */

include/linux/bio.h+2−2

@@ -20,11 +20,11 @@ · 19 unmodified lines
20	#define BIO_BUG_ON	20	#define BIO_BUG_ON
21	#endif	21	#endif
22		22
23	#define BIO_MAX_PAGES 256U	23	#define BIO_MAX_VECS 256U
24		24
25	static inline unsigned int bio_max_segs(unsigned int nr_segs)	25	static inline unsigned int bio_max_segs(unsigned int nr_segs)
26	{	26	{
27	return min(nr_segs, BIO_MAX_PAGES);	27	return min(nr_segs, BIO_MAX_VECS);
28	}	28	}
29		29
30	#define bio_prio(bio) (bio)->bi_ioprio	30	#define bio_prio(bio) (bio)->bi_ioprio

include/linux/can/skb.h+6−2

 static inline void can_skb_set_owner(struct sk_buff *skb, struct sock *sk)
 {
-	if (sk) {
+	/* If the socket has already been closed by user space, the
-		sock_hold(sk);
+	 * refcount may already be 0 (and the socket will be freed
+	 * after the last TX skb has been freed). So only increase
+	 * socket refcount if the refcount is > 0.
+	 */
+	if (sk && refcount_inc_not_zero(&sk->sk_refcnt)) {
 		skb->destructor = sock_efree;
 		skb->sk = sk;
 	}

include/linux/compiler-clang.h+6−0

 #define __no_sanitize_thread
 #endif
+#if defined(CONFIG_ARCH_USE_BUILTIN_BSWAP)
+#define __HAVE_BUILTIN_BSWAP32__
+#define __HAVE_BUILTIN_BSWAP64__
+#define __HAVE_BUILTIN_BSWAP16__
+#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */
 #if __has_feature(undefined_behavior_sanitizer)
 /* GCC does not have __SANITIZE_UNDEFINED__ */
 #define __no_sanitize_undefined \

include/linux/compiler-version.h+14−0

@@ -0,0 +1,14 @@
	1	/* SPDX-License-Identifier: GPL-2.0-only */
	2
	3	#ifdef __LINUX_COMPILER_VERSION_H
	4	#error "Please do not include <linux/compiler-version.h>. This is done by the build system."
	5	#endif
	6	#define __LINUX_COMPILER_VERSION_H
	7
	8	/*
	9	* This header exists to force full rebuild when the compiler is upgraded.
	10	*
	11	* When fixdep scans this, it will find this string "CONFIG_CC_VERSION_TEXT"
	12	* and add dependency on include/config/cc/version/text.h, which is touched
	13	* by Kconfig when the version string from the compiler changes.
	14	*/

include/linux/cpu.h+3−0

 {
 }
+static inline int add_cpu(unsigned int cpu) { return 0;}
 #endif /* CONFIG_SMP */
 extern struct bus_type cpu_subsys;
 static inline void lockdep_assert_cpus_held(void) { }
 static inline void cpu_hotplug_disable(void) { }
 static inline void cpu_hotplug_enable(void) { }
+static inline int remove_cpu(unsigned int cpu) { return -EPERM; }
 static inline void smp_shutdown_nonboot_cpus(unsigned int primary_cpu) { }
 #endif	/* !CONFIG_HOTPLUG_CPU */

include/linux/gpio/consumer.h+2−0

@@ -674,6 +674,8 @@ struct acpi_gpio_mapping { · 673 unmodified lines
674	* get GpioIo type explicitly, this quirk may be used.	674	* get GpioIo type explicitly, this quirk may be used.
675	*/	675	*/
676	#define ACPI_GPIO_QUIRK_ONLY_GPIOIO BIT(1)	676	#define ACPI_GPIO_QUIRK_ONLY_GPIOIO BIT(1)
		677	/* Use given pin as an absolute GPIO number in the system */
		678	#define ACPI_GPIO_QUIRK_ABSOLUTE_NUMBER BIT(2)
677		679
678	unsigned int quirks;	680	unsigned int quirks;
679	};	681	};

include/linux/io_uring.h+1−1

@@ -18,7 +18,7 @@ struct io_uring_task { · 17 unmodified lines
18	/* submission side */	18	/* submission side */
19	struct xarray xa;	19	struct xarray xa;
20	struct wait_queue_head wait;	20	struct wait_queue_head wait;
21	struct file *last;	21	void *last;
22	void *io_wq;	22	void *io_wq;
23	struct percpu_counter inflight;	23	struct percpu_counter inflight;
24	atomic_t in_idle;	24	atomic_t in_idle;

include/linux/irqdomain.h+0−4

  *      setting up one or more generic chips for interrupt controllers
  *      drivers using the generic chip library which uses this pointer.
  * @parent: Pointer to parent irq_domain to support hierarchy irq_domains
- * @debugfs_file: dentry for the domain debugfs file
  *
  * Revmap data, used internally by irq_domain
  * @revmap_direct_max_irq: The largest hwirq that can be set for controllers that
 #ifdef	CONFIG_IRQ_DOMAIN_HIERARCHY
 	struct irq_domain *parent;
 #endif
-#ifdef CONFIG_GENERIC_IRQ_DEBUGFS
-	struct dentry		*debugfs_file;
-#endif
 	/* reverse map data. The linear map gets appended to the irq_domain */
 	irq_hw_number_t hwirq_max;

include/linux/kconfig.h+0−2

@@ -2,8 +2,6 @@ · 1 unmodified line
2	#ifndef __LINUX_KCONFIG_H	2	#ifndef __LINUX_KCONFIG_H
3	#define __LINUX_KCONFIG_H	3	#define __LINUX_KCONFIG_H
4		4
5	/* CONFIG_CC_VERSION_TEXT (Do not delete this comment. See help in Kconfig) */
6
7	#include <generated/autoconf.h>	5	#include <generated/autoconf.h>
8		6
9	#ifdef CONFIG_CPU_BIG_ENDIAN	7	#ifdef CONFIG_CPU_BIG_ENDIAN

include/linux/memblock.h+2−2

@@ -460,7 +460,7 @@ static inline void memblock_free_late(phys_addr_t base, phys_addr_t size) · 459 unmodified lines
460	/*	460	/*
461	* Set the allocation direction to bottom-up or top-down.	461	* Set the allocation direction to bottom-up or top-down.
462	*/	462	*/
463	static inline void memblock_set_bottom_up(bool enable)	463	static inline __init void memblock_set_bottom_up(bool enable)
464	{	464	{
465	memblock.bottom_up = enable;	465	memblock.bottom_up = enable;
466	}	466	}
@@ -470,7 +470,7 @@ static inline void memblock_set_bottom_up(bool enable) · 3 unmodified lines
470	* if this is true, that said, memblock will allocate memory	470	* if this is true, that said, memblock will allocate memory
471	* in bottom-up direction.	471	* in bottom-up direction.
472	*/	472	*/
473	static inline bool memblock_bottom_up(void)	473	static inline __init bool memblock_bottom_up(void)
474	{	474	{
475	return memblock.bottom_up;	475	return memblock.bottom_up;
476	}	476	}

include/linux/memcontrol.h+2−4

 	rcu_read_unlock();
 }
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+void split_page_memcg(struct page *head, unsigned int nr);
-void mem_cgroup_split_huge_fixup(struct page *head);
-#endif
 #else /* CONFIG_MEMCG */
 	return 0;
 }
-static inline void mem_cgroup_split_huge_fixup(struct page *head)
+static inline void split_page_memcg(struct page *head, unsigned int nr)
 {
 }

include/linux/mm.h+21−0

@@ -1300,6 +1300,27 @@ static inline bool page_maybe_dma_pinned(struct page *page) · 1299 unmodified lines
1300	GUP_PIN_COUNTING_BIAS;	1300	GUP_PIN_COUNTING_BIAS;
1301	}	1301	}
1302		1302
		1303	static inline bool is_cow_mapping(vm_flags_t flags)
		1304	{
		1305	return (flags & (VM_SHARED \| VM_MAYWRITE)) == VM_MAYWRITE;
		1306	}
		1307
		1308	/*
		1309	* This should most likely only be called during fork() to see whether we
		1310	* should break the cow immediately for a page on the src mm.
		1311	*/
		1312	static inline bool page_needs_cow_for_dma(struct vm_area_struct *vma,
		1313	struct page *page)
		1314	{
		1315	if (!is_cow_mapping(vma->vm_flags))
		1316	return false;
		1317
		1318	if (!atomic_read(&vma->vm_mm->has_pinned))
		1319	return false;
		1320
		1321	return page_maybe_dma_pinned(page);
		1322	}
		1323
1303	#if defined(CONFIG_SPARSEMEM) && !defined(CONFIG_SPARSEMEM_VMEMMAP)	1324	#if defined(CONFIG_SPARSEMEM) && !defined(CONFIG_SPARSEMEM_VMEMMAP)
1304	#define SECTION_IN_PAGE_FLAGS	1325	#define SECTION_IN_PAGE_FLAGS
1305	#endif	1326	#endif

include/linux/mm_types.h+1−0

@@ -23,6 +23,7 @@ · 22 unmodified lines
23	#endif	23	#endif
24	#define AT_VECTOR_SIZE (2*(AT_VECTOR_SIZE_ARCH + AT_VECTOR_SIZE_BASE + 1))	24	#define AT_VECTOR_SIZE (2*(AT_VECTOR_SIZE_ARCH + AT_VECTOR_SIZE_BASE + 1))
25		25
		26	#define INIT_PASID 0
26		27
27	struct address_space;	28	struct address_space;
28	struct mem_cgroup;	29	struct mem_cgroup;

include/linux/netdevice.h+0−2

@@ -3959,8 +3959,6 @@ int dev_change_xdp_fd(struct net_device dev, struct netlink_ext_ack extack, · 3958 unmodified lines
3959	int bpf_xdp_link_attach(const union bpf_attr attr, struct bpf_prog prog);	3959	int bpf_xdp_link_attach(const union bpf_attr attr, struct bpf_prog prog);
3960	u32 dev_xdp_prog_id(struct net_device *dev, enum bpf_xdp_mode mode);	3960	u32 dev_xdp_prog_id(struct net_device *dev, enum bpf_xdp_mode mode);
3961		3961
3962	int xdp_umem_query(struct net_device *dev, u16 queue_id);
3963
3964	int __dev_forward_skb(struct net_device dev, struct sk_buff skb);	3962	int __dev_forward_skb(struct net_device dev, struct sk_buff skb);
3965	int dev_forward_skb(struct net_device dev, struct sk_buff skb);	3963	int dev_forward_skb(struct net_device dev, struct sk_buff skb);
3966	int dev_forward_skb_nomtu(struct net_device dev, struct sk_buff skb);	3964	int dev_forward_skb_nomtu(struct net_device dev, struct sk_buff skb);

include/linux/perf_event.h+2−0

 #define PERF_ATTACH_TASK	0x04
 #define PERF_ATTACH_TASK_DATA	0x08
 #define PERF_ATTACH_ITRACE	0x10
+#define PERF_ATTACH_SCHED_CB	0x20
 struct perf_cgroup;
 struct perf_buffer;
 	struct list_head		cgrp_cpuctx_entry;
 #endif
+	struct list_head		sched_cb_entry;
 	int				sched_cb_usage;
 	int				online;

include/linux/pgtable.h+4−0

 #define pgprot_device pgprot_noncached
 #endif
+#ifndef pgprot_mhp
+#define pgprot_mhp(prot)	(prot)
+#endif
 #ifdef CONFIG_MMU
 #ifndef pgprot_modify
 #define pgprot_modify pgprot_modify

include/linux/property.h+1−1

@@ -488,7 +488,7 @@ fwnode_create_software_node(const struct property_entry *properties, · 487 unmodified lines
488	const struct fwnode_handle *parent);	488	const struct fwnode_handle *parent);
489	void fwnode_remove_software_node(struct fwnode_handle *fwnode);	489	void fwnode_remove_software_node(struct fwnode_handle *fwnode);
490		490
491	int device_add_software_node(struct device dev, const struct software_node swnode);	491	int device_add_software_node(struct device dev, const struct software_node node);
492	void device_remove_software_node(struct device *dev);	492	void device_remove_software_node(struct device *dev);
493		493
494	int device_create_managed_software_node(struct device *dev,	494	int device_create_managed_software_node(struct device *dev,

include/linux/regulator/pca9450.h+3−0

@@ -147,6 +147,9 @@ enum { · 146 unmodified lines
147	#define BUCK6_FPWM 0x04	147	#define BUCK6_FPWM 0x04
148	#define BUCK6_ENMODE_MASK 0x03	148	#define BUCK6_ENMODE_MASK 0x03
149		149
		150	/* PCA9450_REG_BUCK123_PRESET_EN bit */
		151	#define BUCK123_PRESET_EN 0x80
		152
150	/* PCA9450_BUCK1OUT_DVS0 bits */	153	/* PCA9450_BUCK1OUT_DVS0 bits */
151	#define BUCK1OUT_DVS0_MASK 0x7F	154	#define BUCK1OUT_DVS0_MASK 0x7F
152	#define BUCK1OUT_DVS0_DEFAULT 0x14	155	#define BUCK1OUT_DVS0_DEFAULT 0x14

include/linux/sched/mm.h+2−1

@@ -140,7 +140,8 @@ static inline bool in_vfork(struct task_struct *tsk) · 139 unmodified lines
140	* another oom-unkillable task does this it should blame itself.	140	* another oom-unkillable task does this it should blame itself.
141	*/	141	*/
142	rcu_read_lock();	142	rcu_read_lock();
143	ret = tsk->vfork_done && tsk->real_parent->mm == tsk->mm;	143	ret = tsk->vfork_done &&
		144	rcu_dereference(tsk->real_parent)->mm == tsk->mm;
144	rcu_read_unlock();	145	rcu_read_unlock();
145		146
146	return ret;	147	return ret;

include/linux/seqlock.h+1−4

  * seqcount_latch_init() - runtime initializer for seqcount_latch_t
  * @s: Pointer to the seqcount_latch_t instance
  */
-static inline void seqcount_latch_init(seqcount_latch_t *s)
+#define seqcount_latch_init(s) seqcount_init(&(s)->seqcount)
-{
-	seqcount_init(&s->seqcount);
-}
 /**
  * raw_read_seqcount_latch() - pick even/odd latch data copy

include/linux/stop_machine.h+6−5

 				   const struct cpumask *cpus);
 #else	/* CONFIG_SMP || CONFIG_HOTPLUG_CPU */
-static inline int stop_machine_cpuslocked(cpu_stop_fn_t fn, void *data,
+static __always_inline int stop_machine_cpuslocked(cpu_stop_fn_t fn, void *data,
 					  const struct cpumask *cpus)
 {
 	unsigned long flags;
 	return ret;
 }
-static inline int stop_machine(cpu_stop_fn_t fn, void *data,
+static __always_inline int
-			       const struct cpumask *cpus)
+stop_machine(cpu_stop_fn_t fn, void *data, const struct cpumask *cpus)
 {
 	return stop_machine_cpuslocked(fn, data, cpus);
 }
-static inline int stop_machine_from_inactive_cpu(cpu_stop_fn_t fn, void *data,
+static __always_inline int
-						 const struct cpumask *cpus)
+stop_machine_from_inactive_cpu(cpu_stop_fn_t fn, void *data,
+			       const struct cpumask *cpus)
 {
 	return stop_machine(fn, data, cpus);
 }

include/linux/sunrpc/svc_rdma.h+0−1

@@ -104,7 +104,6 @@ struct svcxprt_rdma { · 103 unmodified lines
104		104
105	wait_queue_head_t sc_send_wait; /* SQ exhaustion waitlist */	105	wait_queue_head_t sc_send_wait; /* SQ exhaustion waitlist */
106	unsigned long sc_flags;	106	unsigned long sc_flags;
107	u32 sc_pending_recvs;
108	struct list_head sc_read_complete_q;	107	struct list_head sc_read_complete_q;
109	struct work_struct sc_work;	108	struct work_struct sc_work;
110		109

include/linux/textsearch.h+1−1

@@ -23,7 +23,7 @@ struct ts_config; · 22 unmodified lines
23	struct ts_state	23	struct ts_state
24	{	24	{
25	unsigned int offset;	25	unsigned int offset;
26	char cb[40];	26	char cb[48];
27	};	27	};
28		28
29	/**	29	/**

include/linux/u64_stats_sync.h+4−3

 }
 #endif
+#if BITS_PER_LONG == 32 && defined(CONFIG_SMP)
+#define u64_stats_init(syncp)	seqcount_init(&(syncp)->seq)
+#else
 static inline void u64_stats_init(struct u64_stats_sync *syncp)
 {
-#if BITS_PER_LONG == 32 && defined(CONFIG_SMP)
-	seqcount_init(&syncp->seq);
-#endif
 }
+#endif
 static inline void u64_stats_update_begin(struct u64_stats_sync *syncp)
 {

include/linux/usb.h+2−0

@@ -746,6 +746,8 @@ extern int usb_lock_device_for_reset(struct usb_device *udev, · 745 unmodified lines
746	extern int usb_reset_device(struct usb_device *dev);	746	extern int usb_reset_device(struct usb_device *dev);
747	extern void usb_queue_reset_device(struct usb_interface *dev);	747	extern void usb_queue_reset_device(struct usb_interface *dev);
748		748
		749	extern struct device usb_intf_get_dma_device(struct usb_interface intf);
		750
749	#ifdef CONFIG_ACPI	751	#ifdef CONFIG_ACPI
750	extern int usb_acpi_set_power_state(struct usb_device *hdev, int index,	752	extern int usb_acpi_set_power_state(struct usb_device *hdev, int index,
751	bool enable);	753	bool enable);

include/linux/virtio_net.h+6−1

 		if (gso_type && skb->network_header) {
 			struct flow_keys_basic keys;
-			if (!skb->protocol)
+			if (!skb->protocol) {
+				__be16 protocol = dev_parse_header_protocol(skb);
 				virtio_net_hdr_set_proto(skb, hdr);
+				if (protocol && protocol != skb->protocol)
+					return -EINVAL;
+			}
 retry:
 			if (!skb_flow_dissect_flow_keys_basic(NULL, skb, &keys,
 							      NULL, 0, 0, 0,

include/linux/ww_mutex.h+3−2

@@ -173,9 +173,10 @@ static inline void ww_acquire_done(struct ww_acquire_ctx *ctx) · 172 unmodified lines
173	*/	173	*/
174	static inline void ww_acquire_fini(struct ww_acquire_ctx *ctx)	174	static inline void ww_acquire_fini(struct ww_acquire_ctx *ctx)
175	{	175	{
176	#ifdef CONFIG_DEBUG_MUTEXES	176	#ifdef CONFIG_DEBUG_LOCK_ALLOC
177	mutex_release(&ctx->dep_map, _THIS_IP_);	177	mutex_release(&ctx->dep_map, _THIS_IP_);
178		178	#endif
		179	#ifdef CONFIG_DEBUG_MUTEXES
179	DEBUG_LOCKS_WARN_ON(ctx->acquired);	180	DEBUG_LOCKS_WARN_ON(ctx->acquired);
180	if (!IS_ENABLED(CONFIG_PROVE_LOCKING))	181	if (!IS_ENABLED(CONFIG_PROVE_LOCKING))
181	/*	182	/*

include/media/rc-map.h+7−0

@@ -175,6 +175,13 @@ struct rc_map_list { · 174 unmodified lines
175	struct rc_map map;	175	struct rc_map map;
176	};	176	};
177		177
		178	#ifdef CONFIG_MEDIA_CEC_RC
		179	/*
		180	* rc_map_list from rc-cec.c
		181	*/
		182	extern struct rc_map_list cec_map;
		183	#endif
		184
178	/* Routines from rc-map.c */	185	/* Routines from rc-map.c */
179		186
180	/**	187	/**

include/uapi/linux/bpf.h+0−1

@@ -3850,7 +3850,6 @@ union bpf_attr { · 3849 unmodified lines
3850	*	3850	*
3851	* long bpf_check_mtu(void ctx, u32 ifindex, u32 mtu_len, s32 len_diff, u64 flags)	3851	* long bpf_check_mtu(void ctx, u32 ifindex, u32 mtu_len, s32 len_diff, u64 flags)
3852	* Description	3852	* Description
3853
3854	* Check ctx packet size against exceeding MTU of net device (based	3853	* Check ctx packet size against exceeding MTU of net device (based
3855	* on ifindex). This helper will likely be used in combination	3854	* on ifindex). This helper will likely be used in combination
3856	* with helpers that adjust/change the packet size.	3855	* with helpers that adjust/change the packet size.

include/uapi/linux/fuse.h+2−1

@@ -903,7 +903,8 @@ struct fuse_notify_retrieve_in { · 902 unmodified lines
903	};	903	};
904		904
905	/* Device ioctls: */	905	/* Device ioctls: */
906	#define FUSE_DEV_IOC_CLONE _IOR(229, 0, uint32_t)	906	#define FUSE_DEV_IOC_MAGIC 229
		907	#define FUSE_DEV_IOC_CLONE _IOR(FUSE_DEV_IOC_MAGIC, 0, uint32_t)
907		908
908	struct fuse_lseek_in {	909	struct fuse_lseek_in {
909	uint64_t fh;	910	uint64_t fh;

include/uapi/linux/l2tp.h+1−0

@@ -145,6 +145,7 @@ enum { · 144 unmodified lines
145	L2TP_ATTR_RX_ERRORS, /* u64 */	145	L2TP_ATTR_RX_ERRORS, /* u64 */
146	L2TP_ATTR_STATS_PAD,	146	L2TP_ATTR_STATS_PAD,
147	L2TP_ATTR_RX_COOKIE_DISCARDS, /* u64 */	147	L2TP_ATTR_RX_COOKIE_DISCARDS, /* u64 */
		148	L2TP_ATTR_RX_INVALID, /* u64 */
148	__L2TP_ATTR_STATS_MAX,	149	__L2TP_ATTR_STATS_MAX,
149	};	150	};
150		151

include/uapi/linux/netfilter/nfnetlink_cthelper.h+1−1

@@ -5,7 +5,7 @@ · 4 unmodified lines
5	#define NFCT_HELPER_STATUS_DISABLED 0	5	#define NFCT_HELPER_STATUS_DISABLED 0
6	#define NFCT_HELPER_STATUS_ENABLED 1	6	#define NFCT_HELPER_STATUS_ENABLED 1
7		7
8	enum nfnl_acct_msg_types {	8	enum nfnl_cthelper_msg_types {
9	NFNL_MSG_CTHELPER_NEW,	9	NFNL_MSG_CTHELPER_NEW,
10	NFNL_MSG_CTHELPER_GET,	10	NFNL_MSG_CTHELPER_GET,
11	NFNL_MSG_CTHELPER_DEL,	11	NFNL_MSG_CTHELPER_DEL,

include/xen/grant_table.h+7−0

@@ -50,6 +50,13 @@ · 49 unmodified lines
50	#include <linux/page-flags.h>	50	#include <linux/page-flags.h>
51	#include <linux/kernel.h>	51	#include <linux/kernel.h>
52		52
		53	/*
		54	* Technically there's no reliably invalid grant reference or grant handle,
		55	* so pick the value that is the most unlikely one to be observed valid.
		56	*/
		57	#define INVALID_GRANT_REF ((grant_ref_t)-1)
		58	#define INVALID_GRANT_HANDLE ((grant_handle_t)-1)
		59
53	#define GNTTAB_RESERVED_XENSTORE 1	60	#define GNTTAB_RESERVED_XENSTORE 1
54		61
55	/* NR_GRANT_FRAMES must be less than or equal to that configured in Xen */	62	/* NR_GRANT_FRAMES must be less than or equal to that configured in Xen */

include/xen/xenbus.h+0−1

@@ -51,7 +51,6 @@ · 50 unmodified lines
51		51
52	#define XENBUS_MAX_RING_GRANT_ORDER 4	52	#define XENBUS_MAX_RING_GRANT_ORDER 4
53	#define XENBUS_MAX_RING_GRANTS (1U << XENBUS_MAX_RING_GRANT_ORDER)	53	#define XENBUS_MAX_RING_GRANTS (1U << XENBUS_MAX_RING_GRANT_ORDER)
54	#define INVALID_GRANT_HANDLE (~0U)
55		54
56	/* Register callback to watch this node. */	55	/* Register callback to watch this node. */
57	struct xenbus_watch	56	struct xenbus_watch

init/Kconfig+5−6

 	    When the compiler is updated, Kconfig will be invoked.
 	  - Ensure full rebuild when the compiler is updated
-	    include/linux/kconfig.h contains this option in the comment line so
+	    include/linux/compiler-version.h contains this option in the comment
-	    fixdep adds include/config/cc/version/text.h into the auto-generated
+	    line so fixdep adds include/config/cc/version/text.h into the
-	    dependency. When the compiler is updated, syncconfig will touch it
+	    auto-generated dependency. When the compiler is updated, syncconfig
-	    and then every file will be rebuilt.
+	    will touch it and then every file will be rebuilt.
 config CC_IS_GCC
 	def_bool $(success,test "$(cc-name)" = GCC)
 config COMPILE_TEST
 	bool "Compile also drivers which will not load"
-	depends on !UML && !S390
+	depends on HAS_IOMEM
-	default n
 	help
 	  Some drivers can be compiled on a different platform than they are
 	  intended to be run on. Despite they cannot be loaded there (or even

kernel/bpf/btf.c+0−2

 		 * is not supported yet.
 		 * BPF_PROG_TYPE_RAW_TRACEPOINT is fine.
 		 */
-		if (log->level & BPF_LOG_LEVEL)
-			bpf_log(log, "arg#%d type is not a struct\n", arg);
 		return NULL;
 	}
 	tname = btf_name_by_offset(btf, t->name_off);

kernel/bpf/core.c+6−0

 	 * clone is guaranteed to not be locked.
 	 */
 	fp->aux = NULL;
+	fp->stats = NULL;
+	fp->active = NULL;
 	__bpf_prog_free(fp);
 }
 /* Return TRUE if the JIT backend wants verifier to enable sub-register usage
  * analysis code and wants explicit zero extension inserted by verifier.
  * Otherwise, return FALSE.
+ *
+ * The verifier inserts an explicit zero extension after BPF_CMPXCHGs even if
+ * you don't override this. JITs that don't want these extra insns can detect
+ * them using insn_is_zext.
  */
 bool __weak bpf_jit_needs_zext(void)
 {

kernel/bpf/verifier.c+58−33

@@ -504,6 +504,13 @@ static bool is_ptr_cast_function(enum bpf_func_id func_id) · 503 unmodified lines
504	func_id == BPF_FUNC_skc_to_tcp_request_sock;	504	func_id == BPF_FUNC_skc_to_tcp_request_sock;
505	}	505	}
506		506
		507	static bool is_cmpxchg_insn(const struct bpf_insn *insn)
		508	{
		509	return BPF_CLASS(insn->code) == BPF_STX &&
		510	BPF_MODE(insn->code) == BPF_ATOMIC &&
		511	insn->imm == BPF_CMPXCHG;
		512	}
		513
507	/* string representation of 'enum bpf_reg_type' */	514	/* string representation of 'enum bpf_reg_type' */
508	static const char * const reg_type_str[] = {	515	static const char * const reg_type_str[] = {
509	[NOT_INIT] = "?",	516	[NOT_INIT] = "?",
@@ -1120,7 +1127,7 @@ static void mark_ptr_not_null_reg(struct bpf_reg_state *reg) · 610 unmodified lines
1120	reg->type = PTR_TO_RDWR_BUF;	1127	reg->type = PTR_TO_RDWR_BUF;
1121	break;	1128	break;
1122	default:	1129	default:
1123	WARN_ON("unknown nullable register type");	1130	WARN_ONCE(1, "unknown nullable register type");
1124	}	1131	}
1125	}	1132	}
1126		1133
@@ -1703,7 +1710,11 @@ static bool is_reg64(struct bpf_verifier_env env, struct bpf_insn insn, · 576 unmodified lines
1703	}	1710	}
1704		1711
1705	if (class == BPF_STX) {	1712	if (class == BPF_STX) {
1706	if (reg->type != SCALAR_VALUE)	1713	/* BPF_STX (including atomic variants) has multiple source
		1714	* operands, one of which is a ptr. Check whether the caller is
		1715	* asking about it.
		1716	*/
		1717	if (t == SRC_OP && reg->type != SCALAR_VALUE)
1707	return true;	1718	return true;
1708	return BPF_SIZE(code) == BPF_DW;	1719	return BPF_SIZE(code) == BPF_DW;
1709	}	1720	}
@@ -1735,22 +1746,38 @@ static bool is_reg64(struct bpf_verifier_env env, struct bpf_insn insn, · 25 unmodified lines
1735	return true;	1746	return true;
1736	}	1747	}
1737		1748
1738	/* Return TRUE if INSN doesn't have explicit value define. */	1749	/* Return the regno defined by the insn, or -1. */
1739	static bool insn_no_def(struct bpf_insn *insn)	1750	static int insn_def_regno(const struct bpf_insn *insn)
1740	{	1751	{
1741	u8 class = BPF_CLASS(insn->code);	1752	switch (BPF_CLASS(insn->code)) {
1742		1753	case BPF_JMP:
1743	return (class == BPF_JMP \|\| class == BPF_JMP32 \|\|	1754	case BPF_JMP32:
1744	class == BPF_STX \|\| class == BPF_ST);	1755	case BPF_ST:
		1756	return -1;
		1757	case BPF_STX:
		1758	if (BPF_MODE(insn->code) == BPF_ATOMIC &&
		1759	(insn->imm & BPF_FETCH)) {
		1760	if (insn->imm == BPF_CMPXCHG)
		1761	return BPF_REG_0;
		1762	else
		1763	return insn->src_reg;
		1764	} else {
		1765	return -1;
		1766	}
		1767	default:
		1768	return insn->dst_reg;
		1769	}
1745	}	1770	}
1746		1771
1747	/* Return TRUE if INSN has defined any 32-bit value explicitly. */	1772	/* Return TRUE if INSN has defined any 32-bit value explicitly. */
1748	static bool insn_has_def32(struct bpf_verifier_env env, struct bpf_insn insn)	1773	static bool insn_has_def32(struct bpf_verifier_env env, struct bpf_insn insn)
1749	{	1774	{
1750	if (insn_no_def(insn))	1775	int dst_reg = insn_def_regno(insn);
		1776
		1777	if (dst_reg == -1)
1751	return false;	1778	return false;
1752		1779
1753	return !is_reg64(env, insn, insn->dst_reg, NULL, DST_OP);	1780	return !is_reg64(env, insn, dst_reg, NULL, DST_OP);
1754	}	1781	}
1755		1782
1756	static void mark_insn_zext(struct bpf_verifier_env *env,	1783	static void mark_insn_zext(struct bpf_verifier_env *env,
@@ -11006,9 +11033,10 @@ static int opt_subreg_zext_lo32_rnd_hi32(struct bpf_verifier_env *env, · 9249 unmodified lines
11006	for (i = 0; i < len; i++) {	11033	for (i = 0; i < len; i++) {
11007	int adj_idx = i + delta;	11034	int adj_idx = i + delta;
11008	struct bpf_insn insn;	11035	struct bpf_insn insn;
11009	u8 load_reg;	11036	int load_reg;
11010		11037
11011	insn = insns[adj_idx];	11038	insn = insns[adj_idx];
		11039	load_reg = insn_def_regno(&insn);
11012	if (!aux[adj_idx].zext_dst) {	11040	if (!aux[adj_idx].zext_dst) {
11013	u8 code, class;	11041	u8 code, class;
11014	u32 imm_rnd;	11042	u32 imm_rnd;
@@ -11018,14 +11046,14 @@ static int opt_subreg_zext_lo32_rnd_hi32(struct bpf_verifier_env *env, · 3 unmodified lines
11018		11046
11019	code = insn.code;	11047	code = insn.code;
11020	class = BPF_CLASS(code);	11048	class = BPF_CLASS(code);
11021	if (insn_no_def(&insn))	11049	if (load_reg == -1)
11022	continue;	11050	continue;
11023		11051
11024	/* NOTE: arg "reg" (the fourth one) is only used for	11052	/* NOTE: arg "reg" (the fourth one) is only used for
11025	* BPF_STX which has been ruled out in above	11053	* BPF_STX + SRC_OP, so it is safe to pass NULL
11026	* check, it is safe to pass NULL here.	11054	* here.
11027	*/	11055	*/
11028	if (is_reg64(env, &insn, insn.dst_reg, NULL, DST_OP)) {	11056	if (is_reg64(env, &insn, load_reg, NULL, DST_OP)) {
11029	if (class == BPF_LD &&	11057	if (class == BPF_LD &&
11030	BPF_MODE(code) == BPF_IMM)	11058	BPF_MODE(code) == BPF_IMM)
11031	i++;	11059	i++;
@@ -11040,31 +11068,28 @@ static int opt_subreg_zext_lo32_rnd_hi32(struct bpf_verifier_env *env, · 8 unmodified lines
11040	imm_rnd = get_random_int();	11068	imm_rnd = get_random_int();
11041	rnd_hi32_patch[0] = insn;	11069	rnd_hi32_patch[0] = insn;
11042	rnd_hi32_patch[1].imm = imm_rnd;	11070	rnd_hi32_patch[1].imm = imm_rnd;
11043	rnd_hi32_patch[3].dst_reg = insn.dst_reg;	11071	rnd_hi32_patch[3].dst_reg = load_reg;
11044	patch = rnd_hi32_patch;	11072	patch = rnd_hi32_patch;
11045	patch_len = 4;	11073	patch_len = 4;
11046	goto apply_patch_buffer;	11074	goto apply_patch_buffer;
11047	}	11075	}
11048		11076
11049	if (!bpf_jit_needs_zext())	11077	/* Add in an zero-extend instruction if a) the JIT has requested
		11078	* it or b) it's a CMPXCHG.
		11079	*
		11080	* The latter is because: BPF_CMPXCHG always loads a value into
		11081	* R0, therefore always zero-extends. However some archs'
		11082	* equivalent instruction only does this load when the
		11083	* comparison is successful. This detail of CMPXCHG is
		11084	* orthogonal to the general zero-extension behaviour of the
		11085	* CPU, so it's treated independently of bpf_jit_needs_zext.
		11086	*/
		11087	if (!bpf_jit_needs_zext() && !is_cmpxchg_insn(&insn))
11050	continue;	11088	continue;
11051		11089
11052	/* zext_dst means that we want to zero-extend whatever register	11090	if (WARN_ON(load_reg == -1)) {
11053	* the insn defines, which is dst_reg most of the time, with	11091	verbose(env, "verifier bug. zext_dst is set, but no reg is defined\n");
11054	* the notable exception of BPF_STX + BPF_ATOMIC + BPF_FETCH.	11092	return -EFAULT;
11055	*/
11056	if (BPF_CLASS(insn.code) == BPF_STX &&
11057	BPF_MODE(insn.code) == BPF_ATOMIC) {
11058	/* BPF_STX + BPF_ATOMIC insns without BPF_FETCH do not
11059	* define any registers, therefore zext_dst cannot be
11060	* set.
11061	*/
11062	if (WARN_ON(!(insn.imm & BPF_FETCH)))
11063	return -EINVAL;
11064	load_reg = insn.imm == BPF_CMPXCHG ? BPF_REG_0
11065	: insn.src_reg;
11066	} else {
11067	load_reg = insn.dst_reg;
11068	}	11093	}
11069		11094
11070	zext_patch[0] = insn;	11095	zext_patch[0] = insn;

kernel/events/core.c+38−4

 static atomic_t perf_sched_count;
 static DEFINE_PER_CPU(atomic_t, perf_cgroup_events);
+static DEFINE_PER_CPU(int, perf_sched_cb_usages);
 static DEFINE_PER_CPU(struct pmu_event_list, pmu_sb_events);
 static atomic_t nr_mmap_events __read_mostly;
 	}
 }
+static DEFINE_PER_CPU(struct list_head, sched_cb_list);
 void perf_sched_cb_dec(struct pmu *pmu)
 {
 	struct perf_cpu_context *cpuctx = this_cpu_ptr(pmu->pmu_cpu_context);
-	--cpuctx->sched_cb_usage;
+	this_cpu_dec(perf_sched_cb_usages);
+	if (!--cpuctx->sched_cb_usage)
+		list_del(&cpuctx->sched_cb_entry);
 }
 {
 	struct perf_cpu_context *cpuctx = this_cpu_ptr(pmu->pmu_cpu_context);
-	cpuctx->sched_cb_usage++;
+	if (!cpuctx->sched_cb_usage++)
+		list_add(&cpuctx->sched_cb_entry, this_cpu_ptr(&sched_cb_list));
+	this_cpu_inc(perf_sched_cb_usages);
 }
 /*
 	perf_ctx_unlock(cpuctx, cpuctx->task_ctx);
 }
+static void perf_pmu_sched_task(struct task_struct *prev,
+				struct task_struct *next,
+				bool sched_in)
+{
+	struct perf_cpu_context *cpuctx;
+	if (prev == next)
+		return;
+	list_for_each_entry(cpuctx, this_cpu_ptr(&sched_cb_list), sched_cb_entry) {
+		/* will be handled in perf_event_context_sched_in/out */
+		if (cpuctx->task_ctx)
+			continue;
+		__perf_pmu_sched_task(cpuctx, sched_in);
+	}
+}
 static void perf_event_switch(struct task_struct *task,
 			      struct task_struct *next_prev, bool sched_in);
 {
 	int ctxn;
+	if (__this_cpu_read(perf_sched_cb_usages))
+		perf_pmu_sched_task(task, next, false);
 	if (atomic_read(&nr_switch_events))
 		perf_event_switch(task, next, false);
 	if (atomic_read(&nr_switch_events))
 		perf_event_switch(task, prev, true);
+	if (__this_cpu_read(perf_sched_cb_usages))
+		perf_pmu_sched_task(prev, task, true);
 }
 static u64 perf_calculate_period(struct perf_event *event, u64 nsec, u64 count)
 	if (event->parent)
 		return;
-	if (event->attach_state & PERF_ATTACH_TASK)
+	if (event->attach_state & (PERF_ATTACH_TASK | PERF_ATTACH_SCHED_CB))
 		dec = true;
 	if (event->attr.mmap || event->attr.mmap_data)
 		atomic_dec(&nr_mmap_events);
 	if (event->parent)
 		return;
-	if (event->attach_state & PERF_ATTACH_TASK)
+	if (event->attach_state & (PERF_ATTACH_TASK | PERF_ATTACH_SCHED_CB))
 		inc = true;
 	if (event->attr.mmap || event->attr.mmap_data)
 		atomic_inc(&nr_mmap_events);
 #ifdef CONFIG_CGROUP_PERF
 		INIT_LIST_HEAD(&per_cpu(cgrp_cpuctx_list, cpu));
 #endif
+		INIT_LIST_HEAD(&per_cpu(sched_cb_list, cpu));
 	}
 }

kernel/fork.c+9−0

 #endif
 }
+static void mm_init_pasid(struct mm_struct *mm)
+{
+#ifdef CONFIG_IOMMU_SUPPORT
+	mm->pasid = INIT_PASID;
+#endif
+}
 static void mm_init_uprobes_state(struct mm_struct *mm)
 {
 #ifdef CONFIG_UPROBES
 	mm_init_cpumask(mm);
 	mm_init_aio(mm);
 	mm_init_owner(mm, p);
+	mm_init_pasid(mm);
 	RCU_INIT_POINTER(mm->exe_file, NULL);
 	mmu_notifier_subscriptions_init(mm);
 	init_tlb_flush_pending(mm);
 	if (!IS_ERR(tsk)) {
 		sigfillset(&tsk->blocked);
 		sigdelsetmask(&tsk->blocked, sigmask(SIGKILL));
+		tsk->flags |= PF_NOFREEZE;
 	}
 	return tsk;
 }

kernel/irq/irqdomain.c+4−5

 static void debugfs_add_domain_dir(struct irq_domain *d)
 {
-	if (!d->name || !domain_dir || d->debugfs_file)
+	if (!d->name || !domain_dir)
 		return;
-	d->debugfs_file = debugfs_create_file(d->name, 0444, domain_dir, d,
+	debugfs_create_file(d->name, 0444, domain_dir, d,
-					      &irq_domain_debug_fops);
+			    &irq_domain_debug_fops);
 }
 static void debugfs_remove_domain_dir(struct irq_domain *d)
 {
-	debugfs_remove(d->debugfs_file);
+	debugfs_remove(debugfs_lookup(d->name, domain_dir));
-	d->debugfs_file = NULL;
 }
 void __init irq_domain_debugfs_init(struct dentry *root)

kernel/locking/mutex.c+14−11

  */
 static __always_inline bool
 mutex_optimistic_spin(struct mutex *lock, struct ww_acquire_ctx *ww_ctx,
-		      const bool use_ww_ctx, struct mutex_waiter *waiter)
+		      struct mutex_waiter *waiter)
 {
 	if (!waiter) {
 		/*
 #else
 static __always_inline bool
 mutex_optimistic_spin(struct mutex *lock, struct ww_acquire_ctx *ww_ctx,
-		      const bool use_ww_ctx, struct mutex_waiter *waiter)
+		      struct mutex_waiter *waiter)
 {
 	return false;
 }
 	struct ww_mutex *ww;
 	int ret;
+	if (!use_ww_ctx)
+		ww_ctx = NULL;
 	might_sleep();
 #ifdef CONFIG_DEBUG_MUTEXES
 #endif
 	ww = container_of(lock, struct ww_mutex, base);
-	if (use_ww_ctx && ww_ctx) {
+	if (ww_ctx) {
 		if (unlikely(ww_ctx == READ_ONCE(ww->ctx)))
 			return -EALREADY;
 	mutex_acquire_nest(&lock->dep_map, subclass, 0, nest_lock, ip);
 	if (__mutex_trylock(lock) ||
-	    mutex_optimistic_spin(lock, ww_ctx, use_ww_ctx, NULL)) {
+	    mutex_optimistic_spin(lock, ww_ctx, NULL)) {
 		/* got the lock, yay! */
 		lock_acquired(&lock->dep_map, ip);
-		if (use_ww_ctx && ww_ctx)
+		if (ww_ctx)
 			ww_mutex_set_context_fastpath(ww, ww_ctx);
 		preempt_enable();
 		return 0;
 	 * After waiting to acquire the wait_lock, try again.
 	 */
 	if (__mutex_trylock(lock)) {
-		if (use_ww_ctx && ww_ctx)
+		if (ww_ctx)
 			__ww_mutex_check_waiters(lock, ww_ctx);
 		goto skip_wait;
 			goto err;
 		}
-		if (use_ww_ctx && ww_ctx) {
+		if (ww_ctx) {
 			ret = __ww_mutex_check_kill(lock, &waiter, ww_ctx);
 			if (ret)
 				goto err;
 		 * ww_mutex needs to always recheck its position since its waiter
 		 * list is not FIFO ordered.
 		 */
-		if ((use_ww_ctx && ww_ctx) || !first) {
+		if (ww_ctx || !first) {
 			first = __mutex_waiter_is_first(lock, &waiter);
 			if (first)
 				__mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
 		 * or we must see its unlock and acquire.
 		 */
 		if (__mutex_trylock(lock) ||
-		    (first && mutex_optimistic_spin(lock, ww_ctx, use_ww_ctx, &waiter)))
+		    (first && mutex_optimistic_spin(lock, ww_ctx, &waiter)))
 			break;
 		spin_lock(&lock->wait_lock);
 acquired:
 	__set_current_state(TASK_RUNNING);
-	if (use_ww_ctx && ww_ctx) {
+	if (ww_ctx) {
 		/*
 		 * Wound-Wait; we stole the lock (!first_waiter), check the
 		 * waiters as anyone might want to wound us.
 	/* got the lock - cleanup and rejoice! */
 	lock_acquired(&lock->dep_map, ip);
-	if (use_ww_ctx && ww_ctx)
+	if (ww_ctx)
 		ww_mutex_lock_acquired(ww, ww_ctx);
 	spin_unlock(&lock->wait_lock);

kernel/sched/core.c+62−64

 	struct set_affinity_pending	*pending;
 };
+/*
+ * @refs: number of wait_for_completion()
+ * @stop_pending: is @stop_work in use
+ */
 struct set_affinity_pending {
 	refcount_t		refs;
+	unsigned int		stop_pending;
 	struct completion	done;
 	struct cpu_stop_work	stop_work;
 	struct migration_arg	arg;
  */
 static int migration_cpu_stop(void *data)
 {
-	struct set_affinity_pending *pending;
 	struct migration_arg *arg = data;
+	struct set_affinity_pending *pending = arg->pending;
 	struct task_struct *p = arg->task;
 	int dest_cpu = arg->dest_cpu;
 	struct rq *rq = this_rq();
 	raw_spin_lock(&p->pi_lock);
 	rq_lock(rq, &rf);
-	pending = p->migration_pending;
 	/*
 	 * If task_rq(p) != rq, it cannot be migrated here, because we're
 	 * holding rq->lock, if p->on_rq == 0 it cannot get enqueued because
 			goto out;
 		if (pending) {
-			p->migration_pending = NULL;
+			if (p->migration_pending == pending)
+				p->migration_pending = NULL;
 			complete = true;
 		}
-		/* migrate_enable() --  we must not race against SCA */
 		if (dest_cpu < 0) {
-			/*
+			if (cpumask_test_cpu(task_cpu(p), &p->cpus_mask))
-			 * When this was migrate_enable() but we no longer
-			 * have a @pending, a concurrent SCA 'fixed' things
-			 * and we should be valid again. Nothing to do.
-			 */
-			if (!pending) {
-				WARN_ON_ONCE(!cpumask_test_cpu(task_cpu(p), &p->cpus_mask));
 				goto out;
-			}
 			dest_cpu = cpumask_any_distribute(&p->cpus_mask);
 		}
 		else
 			p->wake_cpu = dest_cpu;
-	} else if (dest_cpu < 0 || pending) {
+		/*
+		 * XXX __migrate_task() can fail, at which point we might end
+		 * up running on a dodgy CPU, AFAICT this can only happen
+		 * during CPU hotplug, at which point we'll get pushed out
+		 * anyway, so it's probably not a big deal.
+		 */
+	} else if (pending) {
 		/*
 		 * This happens when we get migrated between migrate_enable()'s
 		 * preempt_enable() and scheduling the stopper task. At that
 		 * ->pi_lock, so the allowed mask is stable - if it got
 		 * somewhere allowed, we're done.
 		 */
-		if (pending && cpumask_test_cpu(task_cpu(p), p->cpus_ptr)) {
+		if (cpumask_test_cpu(task_cpu(p), p->cpus_ptr)) {
-			p->migration_pending = NULL;
+			if (p->migration_pending == pending)
+				p->migration_pending = NULL;
 			complete = true;
 			goto out;
 		}
-		/*
-		 * When this was migrate_enable() but we no longer have an
-		 * @pending, a concurrent SCA 'fixed' things and we should be
-		 * valid again. Nothing to do.
-		 */
-		if (!pending) {
-			WARN_ON_ONCE(!cpumask_test_cpu(task_cpu(p), &p->cpus_mask));
-			goto out;
-		}
 		/*
 		 * When migrate_enable() hits a rq mis-match we can't reliably
 		 * determine is_migration_disabled() and so have to chase after
 		 * it.
 		 */
+		WARN_ON_ONCE(!pending->stop_pending);
 		task_rq_unlock(rq, p, &rf);
 		stop_one_cpu_nowait(task_cpu(p), migration_cpu_stop,
 				    &pending->arg, &pending->stop_work);
 		return 0;
 	}
 out:
+	if (pending)
+		pending->stop_pending = false;
 	task_rq_unlock(rq, p, &rf);
 	if (complete)
 		complete_all(&pending->done);
-	/* For pending->{arg,stop_work} */
-	pending = arg->pending;
-	if (pending && refcount_dec_and_test(&pending->refs))
-		wake_up_var(&pending->refs);
 	return 0;
 }
 			    int dest_cpu, unsigned int flags)
 {
 	struct set_affinity_pending my_pending = { }, *pending = NULL;
-	struct migration_arg arg = {
+	bool stop_pending, complete = false;
-		.task = p,
-		.dest_cpu = dest_cpu,
-	};
-	bool complete = false;
 	/* Can the task run on the task's current CPU? If so, we're done */
 	if (cpumask_test_cpu(task_cpu(p), &p->cpus_mask)) {
 			push_task = get_task_struct(p);
 		}
+		/*
+		 * If there are pending waiters, but no pending stop_work,
+		 * then complete now.
+		 */
 		pending = p->migration_pending;
-		if (pending) {
+		if (pending && !pending->stop_pending) {
-			refcount_inc(&pending->refs);
 			p->migration_pending = NULL;
 			complete = true;
 		}
 		task_rq_unlock(rq, p, rf);
 		if (push_task) {
 		}
 		if (complete)
-			goto do_complete;
+			complete_all(&pending->done);
 		return 0;
 	}
 			/* Install the request */
 			refcount_set(&my_pending.refs, 1);
 			init_completion(&my_pending.done);
+			my_pending.arg = (struct migration_arg) {
+				.task = p,
+				.dest_cpu = -1,		/* any */
+				.pending = &my_pending,
+			};
 			p->migration_pending = &my_pending;
 		} else {
 			pending = p->migration_pending;
 		return -EINVAL;
 	}
-	if (flags & SCA_MIGRATE_ENABLE) {
-		refcount_inc(&pending->refs); /* pending->{arg,stop_work} */
-		p->migration_flags &= ~MDF_PUSH;
-		task_rq_unlock(rq, p, rf);
-		pending->arg = (struct migration_arg) {
-			.task = p,
-			.dest_cpu = -1,
-			.pending = pending,
-		};
-		stop_one_cpu_nowait(cpu_of(rq), migration_cpu_stop,
-				    &pending->arg, &pending->stop_work);
-		return 0;
-	}
 	if (task_running(rq, p) || p->state == TASK_WAKING) {
 		/*
-		 * Lessen races (and headaches) by delegating
+		 * MIGRATE_ENABLE gets here because 'p == current', but for
-		 * is_migration_disabled(p) checks to the stopper, which will
+		 * anything else we cannot do is_migration_disabled(), punt
-		 * run on the same CPU as said p.
+		 * and have the stopper function handle it all race-free.
 		 */
+		stop_pending = pending->stop_pending;
+		if (!stop_pending)
+			pending->stop_pending = true;
+		if (flags & SCA_MIGRATE_ENABLE)
+			p->migration_flags &= ~MDF_PUSH;
 		task_rq_unlock(rq, p, rf);
-		stop_one_cpu(cpu_of(rq), migration_cpu_stop, &arg);
+		if (!stop_pending) {
+			stop_one_cpu_nowait(cpu_of(rq), migration_cpu_stop,
+					    &pending->arg, &pending->stop_work);
+		}
+		if (flags & SCA_MIGRATE_ENABLE)
+			return 0;
 	} else {
 		if (!is_migration_disabled(p)) {
 			if (task_on_rq_queued(p))
 				rq = move_queued_task(rq, rf, p, dest_cpu);
-			p->migration_pending = NULL;
+			if (!pending->stop_pending) {
-			complete = true;
+				p->migration_pending = NULL;
+				complete = true;
+			}
 		}
 		task_rq_unlock(rq, p, rf);
-do_complete:
 		if (complete)
 			complete_all(&pending->done);
 	}
 	wait_for_completion(&pending->done);
 	if (refcount_dec_and_test(&pending->refs))
-		wake_up_var(&pending->refs);
+		wake_up_var(&pending->refs); /* No UaF, just an address */
 	/*
 	 * Block the original owner of &pending until all subsequent callers
 	 */
 	wait_var_event(&my_pending.refs, !refcount_read(&my_pending.refs));
+	/* ARGH */
+	WARN_ON_ONCE(my_pending.stop_pending);
 	return 0;
 }

kernel/sched/membarrier.c+1−3

@@ -471,9 +471,7 @@ static int sync_runqueues_membarrier_state(struct mm_struct *mm) · 470 unmodified lines
471	}	471	}
472	rcu_read_unlock();	472	rcu_read_unlock();
473		473
474	preempt_disable();	474	on_each_cpu_mask(tmpmask, ipi_sync_rq_state, mm, true);
475	smp_call_function_many(tmpmask, ipi_sync_rq_state, mm, 1);
476	preempt_enable();
477		475
478	free_cpumask_var(tmpmask);	476	free_cpumask_var(tmpmask);
479	cpus_read_unlock();	477	cpus_read_unlock();

kernel/sys.c+1−1

@@ -2079,7 +2079,7 @@ static int prctl_set_auxv(struct mm_struct *mm, unsigned long addr, · 2078 unmodified lines
2079	* up to the caller to provide sane values here, otherwise userspace	2079	* up to the caller to provide sane values here, otherwise userspace
2080	* tools which use this vector might be unhappy.	2080	* tools which use this vector might be unhappy.
2081	*/	2081	*/
2082	unsigned long user_auxv[AT_VECTOR_SIZE];	2082	unsigned long user_auxv[AT_VECTOR_SIZE] = {};
2083		2083
2084	if (len > sizeof(user_auxv))	2084	if (len > sizeof(user_auxv))
2085	return -EINVAL;	2085	return -EINVAL;

kernel/time/hrtimer.c+39−21

 }
 /*
- * Recomputes cpu_base::*next_timer and returns the earliest expires_next but
+ * Recomputes cpu_base::*next_timer and returns the earliest expires_next
- * does not set cpu_base::*expires_next, that is done by hrtimer_reprogram.
+ * but does not set cpu_base::*expires_next, that is done by
+ * hrtimer[_force]_reprogram and hrtimer_interrupt only. When updating
+ * cpu_base::*expires_next right away, reprogramming logic would no longer
+ * work.
  *
  * When a softirq is pending, we can ignore the HRTIMER_ACTIVE_SOFT bases,
  * those timers will get run whenever the softirq gets handled, at the end of
 	return expires_next;
 }
+static ktime_t hrtimer_update_next_event(struct hrtimer_cpu_base *cpu_base)
+{
+	ktime_t expires_next, soft = KTIME_MAX;
+	/*
+	 * If the soft interrupt has already been activated, ignore the
+	 * soft bases. They will be handled in the already raised soft
+	 * interrupt.
+	 */
+	if (!cpu_base->softirq_activated) {
+		soft = __hrtimer_get_next_event(cpu_base, HRTIMER_ACTIVE_SOFT);
+		/*
+		 * Update the soft expiry time. clock_settime() might have
+		 * affected it.
+		 */
+		cpu_base->softirq_expires_next = soft;
+	}
+	expires_next = __hrtimer_get_next_event(cpu_base, HRTIMER_ACTIVE_HARD);
+	/*
+	 * If a softirq timer is expiring first, update cpu_base->next_timer
+	 * and program the hardware with the soft expiry time.
+	 */
+	if (expires_next > soft) {
+		cpu_base->next_timer = cpu_base->softirq_next_timer;
+		expires_next = soft;
+	}
+	return expires_next;
+}
 static inline ktime_t hrtimer_update_base(struct hrtimer_cpu_base *base)
 {
 	ktime_t *offs_real = &base->clock_base[HRTIMER_BASE_REALTIME].offset;
 {
 	ktime_t expires_next;
-	/*
+	expires_next = hrtimer_update_next_event(cpu_base);
-	 * Find the current next expiration time.
-	 */
-	expires_next = __hrtimer_get_next_event(cpu_base, HRTIMER_ACTIVE_ALL);
-	if (cpu_base->next_timer && cpu_base->next_timer->is_soft) {
-		/*
-		 * When the softirq is activated, hrtimer has to be
-		 * programmed with the first hard hrtimer because soft
-		 * timer interrupt could occur too late.
-		 */
-		if (cpu_base->softirq_activated)
-			expires_next = __hrtimer_get_next_event(cpu_base,
-								HRTIMER_ACTIVE_HARD);
-		else
-			cpu_base->softirq_expires_next = expires_next;
-	}
 	if (skip_equal && expires_next == cpu_base->expires_next)
 		return;
 	__hrtimer_run_queues(cpu_base, now, flags, HRTIMER_ACTIVE_HARD);
-	/* Reevaluate the clock bases for the next expiry */
+	/* Reevaluate the clock bases for the [soft] next expiry */
-	expires_next = __hrtimer_get_next_event(cpu_base, HRTIMER_ACTIVE_ALL);
+	expires_next = hrtimer_update_next_event(cpu_base);
 	/*
 	 * Store the new expiry value so the migration code can verify
 	 * against it.

lib/Kconfig.kasan+1−0

@@ -156,6 +156,7 @@ config KASAN_STACK_ENABLE · 155 unmodified lines
156		156
157	config KASAN_STACK	157	config KASAN_STACK
158	int	158	int
		159	depends on KASAN_GENERIC \|\| KASAN_SW_TAGS
159	default 1 if KASAN_STACK_ENABLE \|\| CC_IS_GCC	160	default 1 if KASAN_STACK_ENABLE \|\| CC_IS_GCC
160	default 0	161	default 0
161		162

lib/extable.c+0−5

 }
 #endif
-#ifndef ARCH_HAS_SORT_EXTABLE
 #ifndef ARCH_HAS_RELATIVE_EXTABLE
 #define swap_ex		NULL
 #else
 		m->num_exentries--;
 }
 #endif /* CONFIG_MODULES */
-#endif /* !ARCH_HAS_SORT_EXTABLE */
-#ifndef ARCH_HAS_SEARCH_EXTABLE
 static int cmp_ex_search(const void *key, const void *elt)
 {
 	return bsearch(&value, base, num,
 		       sizeof(struct exception_table_entry), cmp_ex_search);
 }
-#endif

mm/highmem.c+12−5

 	BUG_ON(end1 > page_size(page) || end2 > page_size(page));
+	if (start1 >= end1)
+		start1 = end1 = 0;
+	if (start2 >= end2)
+		start2 = end2 = 0;
 	for (i = 0; i < compound_nr(page); i++) {
 		void *kaddr = NULL;
-		if (start1 < PAGE_SIZE || start2 < PAGE_SIZE)
-			kaddr = kmap_atomic(page + i);
 		if (start1 >= PAGE_SIZE) {
 			start1 -= PAGE_SIZE;
 			end1 -= PAGE_SIZE;
 		} else {
 			unsigned this_end = min_t(unsigned, end1, PAGE_SIZE);
-			if (end1 > start1)
+			if (end1 > start1) {
+				kaddr = kmap_atomic(page + i);
 				memset(kaddr + start1, 0, this_end - start1);
+			}
 			end1 -= this_end;
 			start1 = 0;
 		}
 		} else {
 			unsigned this_end = min_t(unsigned, end2, PAGE_SIZE);
-			if (end2 > start2)
+			if (end2 > start2) {
+				if (!kaddr)
+					kaddr = kmap_atomic(page + i);
 				memset(kaddr + start2, 0, this_end - start2);
+			}
 			end2 -= this_end;
 			start2 = 0;
 		}

mm/huge_memory.c+3−7

 	 * best effort that the pinned pages won't be replaced by another
 	 * random page during the coming copy-on-write.
 	 */
-	if (unlikely(is_cow_mapping(vma->vm_flags) &&
+	if (unlikely(page_needs_cow_for_dma(vma, src_page))) {
-		     atomic_read(&src_mm->has_pinned) &&
-		     page_maybe_dma_pinned(src_page))) {
 		pte_free(dst_mm, pgtable);
 		spin_unlock(src_ptl);
 		spin_unlock(dst_ptl);
 	}
 	/* Please refer to comments in copy_huge_pmd() */
-	if (unlikely(is_cow_mapping(vma->vm_flags) &&
+	if (unlikely(page_needs_cow_for_dma(vma, pud_page(pud)))) {
-		     atomic_read(&src_mm->has_pinned) &&
-		     page_maybe_dma_pinned(pud_page(pud)))) {
 		spin_unlock(src_ptl);
 		spin_unlock(dst_ptl);
 		__split_huge_pud(vma, src_pud, addr);
 	int i;
 	/* complete memcg works before add pages to LRU */
-	mem_cgroup_split_huge_fixup(head);
+	split_page_memcg(head, nr);
 	if (PageAnon(head) && PageSwapCache(head)) {
 		swp_entry_t entry = { .val = page_private(head) };

mm/hugetlb.c+91−32

@@ -331,6 +331,24 @@ static void coalesce_file_region(struct resv_map resv, struct file_region rg) · 330 unmodified lines
331	}	331	}
332	}	332	}
333		333
		334	static inline long
		335	hugetlb_resv_map_add(struct resv_map map, struct file_region rg, long from,
		336	long to, struct hstate h, struct hugetlb_cgroup cg,
		337	long *regions_needed)
		338	{
		339	struct file_region *nrg;
		340
		341	if (!regions_needed) {
		342	nrg = get_file_region_entry_from_cache(map, from, to);
		343	record_hugetlb_cgroup_uncharge_info(cg, h, map, nrg);
		344	list_add(&nrg->link, rg->link.prev);
		345	coalesce_file_region(map, nrg);
		346	} else
		347	*regions_needed += 1;
		348
		349	return to - from;
		350	}
		351
334	/*	352	/*
335	* Must be called with resv->lock held.	353	* Must be called with resv->lock held.
336	*	354	*
@@ -346,7 +364,7 @@ static long add_reservation_in_range(struct resv_map *resv, long f, long t, · 9 unmodified lines
346	long add = 0;	364	long add = 0;
347	struct list_head *head = &resv->regions;	365	struct list_head *head = &resv->regions;
348	long last_accounted_offset = f;	366	long last_accounted_offset = f;
349	struct file_region rg = NULL, trg = NULL, *nrg = NULL;	367	struct file_region rg = NULL, trg = NULL;
350		368
351	if (regions_needed)	369	if (regions_needed)
352	*regions_needed = 0;	370	*regions_needed = 0;
@@ -369,24 +387,17 @@ static long add_reservation_in_range(struct resv_map *resv, long f, long t, · 16 unmodified lines
369	/* When we find a region that starts beyond our range, we've	387	/* When we find a region that starts beyond our range, we've
370	* finished.	388	* finished.
371	*/	389	*/
372	if (rg->from > t)	390	if (rg->from >= t)
373	break;	391	break;
374		392
375	/* Add an entry for last_accounted_offset -> rg->from, and	393	/* Add an entry for last_accounted_offset -> rg->from, and
376	* update last_accounted_offset.	394	* update last_accounted_offset.
377	*/	395	*/
378	if (rg->from > last_accounted_offset) {	396	if (rg->from > last_accounted_offset)
379	add += rg->from - last_accounted_offset;	397	add += hugetlb_resv_map_add(resv, rg,
380	if (!regions_needed) {	398	last_accounted_offset,
381	nrg = get_file_region_entry_from_cache(	399	rg->from, h, h_cg,
382	resv, last_accounted_offset, rg->from);	400	regions_needed);
383	record_hugetlb_cgroup_uncharge_info(h_cg, h,
384	resv, nrg);
385	list_add(&nrg->link, rg->link.prev);
386	coalesce_file_region(resv, nrg);
387	} else
388	*regions_needed += 1;
389	}
390		401
391	last_accounted_offset = rg->to;	402	last_accounted_offset = rg->to;
392	}	403	}
@@ -394,17 +405,9 @@ static long add_reservation_in_range(struct resv_map *resv, long f, long t, · 1 unmodified line
394	/* Handle the case where our range extends beyond	405	/* Handle the case where our range extends beyond
395	* last_accounted_offset.	406	* last_accounted_offset.
396	*/	407	*/
397	if (last_accounted_offset < t) {	408	if (last_accounted_offset < t)
398	add += t - last_accounted_offset;	409	add += hugetlb_resv_map_add(resv, rg, last_accounted_offset,
399	if (!regions_needed) {	410	t, h, h_cg, regions_needed);
400	nrg = get_file_region_entry_from_cache(
401	resv, last_accounted_offset, t);
402	record_hugetlb_cgroup_uncharge_info(h_cg, h, resv, nrg);
403	list_add(&nrg->link, rg->link.prev);
404	coalesce_file_region(resv, nrg);
405	} else
406	*regions_needed += 1;
407	}
408		411
409	VM_BUG_ON(add < 0);	412	VM_BUG_ON(add < 0);
410	return add;	413	return add;
@@ -3725,21 +3728,32 @@ static bool is_hugetlb_entry_hwpoisoned(pte_t pte) · 3314 unmodified lines
3725	return false;	3728	return false;
3726	}	3729	}
3727		3730
		3731	static void
		3732	hugetlb_install_page(struct vm_area_struct vma, pte_t ptep, unsigned long addr,
		3733	struct page *new_page)
		3734	{
		3735	__SetPageUptodate(new_page);
		3736	set_huge_pte_at(vma->vm_mm, addr, ptep, make_huge_pte(vma, new_page, 1));
		3737	hugepage_add_new_anon_rmap(new_page, vma, addr);
		3738	hugetlb_count_add(pages_per_huge_page(hstate_vma(vma)), vma->vm_mm);
		3739	ClearHPageRestoreReserve(new_page);
		3740	SetHPageMigratable(new_page);
		3741	}
		3742
3728	int copy_hugetlb_page_range(struct mm_struct dst, struct mm_struct src,	3743	int copy_hugetlb_page_range(struct mm_struct dst, struct mm_struct src,
3729	struct vm_area_struct *vma)	3744	struct vm_area_struct *vma)
3730	{	3745	{
3731	pte_t src_pte, dst_pte, entry, dst_entry;	3746	pte_t src_pte, dst_pte, entry, dst_entry;
3732	struct page *ptepage;	3747	struct page *ptepage;
3733	unsigned long addr;	3748	unsigned long addr;
3734	int cow;	3749	bool cow = is_cow_mapping(vma->vm_flags);
3735	struct hstate *h = hstate_vma(vma);	3750	struct hstate *h = hstate_vma(vma);
3736	unsigned long sz = huge_page_size(h);	3751	unsigned long sz = huge_page_size(h);
		3752	unsigned long npages = pages_per_huge_page(h);
3737	struct address_space *mapping = vma->vm_file->f_mapping;	3753	struct address_space *mapping = vma->vm_file->f_mapping;
3738	struct mmu_notifier_range range;	3754	struct mmu_notifier_range range;
3739	int ret = 0;	3755	int ret = 0;
3740		3756
3741	cow = (vma->vm_flags & (VM_SHARED \| VM_MAYWRITE)) == VM_MAYWRITE;
3742
3743	if (cow) {	3757	if (cow) {
3744	mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, vma, src,	3758	mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, vma, src,
3745	vma->vm_start,	3759	vma->vm_start,
@@ -3784,6 +3798,7 @@ int copy_hugetlb_page_range(struct mm_struct dst, struct mm_struct src, · 38 unmodified lines
3784	spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);	3798	spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
3785	entry = huge_ptep_get(src_pte);	3799	entry = huge_ptep_get(src_pte);
3786	dst_entry = huge_ptep_get(dst_pte);	3800	dst_entry = huge_ptep_get(dst_pte);
		3801	again:
3787	if (huge_pte_none(entry) \|\| !huge_pte_none(dst_entry)) {	3802	if (huge_pte_none(entry) \|\| !huge_pte_none(dst_entry)) {
3788	/*	3803	/*
3789	* Skip if src entry none. Also, skip in the	3804	* Skip if src entry none. Also, skip in the
@@ -3807,6 +3822,52 @@ int copy_hugetlb_page_range(struct mm_struct dst, struct mm_struct src, · 17 unmodified lines
3807	}	3822	}
3808	set_huge_swap_pte_at(dst, addr, dst_pte, entry, sz);	3823	set_huge_swap_pte_at(dst, addr, dst_pte, entry, sz);
3809	} else {	3824	} else {
		3825	entry = huge_ptep_get(src_pte);
		3826	ptepage = pte_page(entry);
		3827	get_page(ptepage);
		3828
		3829	/*
		3830	* This is a rare case where we see pinned hugetlb
		3831	* pages while they're prone to COW. We need to do the
		3832	* COW earlier during fork.
		3833	*
		3834	* When pre-allocating the page or copying data, we
		3835	* need to be without the pgtable locks since we could
		3836	* sleep during the process.
		3837	*/
		3838	if (unlikely(page_needs_cow_for_dma(vma, ptepage))) {
		3839	pte_t src_pte_old = entry;
		3840	struct page *new;
		3841
		3842	spin_unlock(src_ptl);
		3843	spin_unlock(dst_ptl);
		3844	/* Do not use reserve as it's private owned */
		3845	new = alloc_huge_page(vma, addr, 1);
		3846	if (IS_ERR(new)) {
		3847	put_page(ptepage);
		3848	ret = PTR_ERR(new);
		3849	break;
		3850	}
		3851	copy_user_huge_page(new, ptepage, addr, vma,
		3852	npages);
		3853	put_page(ptepage);
		3854
		3855	/* Install the new huge page if src pte stable */
		3856	dst_ptl = huge_pte_lock(h, dst, dst_pte);
		3857	src_ptl = huge_pte_lockptr(h, src, src_pte);
		3858	spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
		3859	entry = huge_ptep_get(src_pte);
		3860	if (!pte_same(src_pte_old, entry)) {
		3861	put_page(new);
		3862	/* dst_entry won't change as in child */
		3863	goto again;
		3864	}
		3865	hugetlb_install_page(vma, dst_pte, addr, new);
		3866	spin_unlock(src_ptl);
		3867	spin_unlock(dst_ptl);
		3868	continue;
		3869	}
		3870
3810	if (cow) {	3871	if (cow) {
3811	/*	3872	/*
3812	* No need to notify as we are downgrading page	3873	* No need to notify as we are downgrading page
@@ -3817,12 +3878,10 @@ int copy_hugetlb_page_range(struct mm_struct dst, struct mm_struct src, · 4 unmodified lines
3817	*/	3878	*/
3818	huge_ptep_set_wrprotect(src, addr, src_pte);	3879	huge_ptep_set_wrprotect(src, addr, src_pte);
3819	}	3880	}
3820	entry = huge_ptep_get(src_pte);	3881
3821	ptepage = pte_page(entry);
3822	get_page(ptepage);
3823	page_dup_rmap(ptepage, true);	3882	page_dup_rmap(ptepage, true);
3824	set_huge_pte_at(dst, addr, dst_pte, entry);	3883	set_huge_pte_at(dst, addr, dst_pte, entry);
3825	hugetlb_count_add(pages_per_huge_page(h), dst);	3884	hugetlb_count_add(npages, dst);
3826	}	3885	}
3827	spin_unlock(src_ptl);	3886	spin_unlock(src_ptl);
3828	spin_unlock(dst_ptl);	3887	spin_unlock(dst_ptl);

mm/internal.h+0−5

  */
 #define buddy_order_unsafe(page)	READ_ONCE(page_private(page))
-static inline bool is_cow_mapping(vm_flags_t flags)
-{
-	return (flags & (VM_SHARED | VM_MAYWRITE)) == VM_MAYWRITE;
-}
 /*
  * These three helpers classifies VMAs for virtual memory accounting.
  */

mm/kfence/report.c+18−12

 #include "kfence.h"
+/* May be overridden by <asm/kfence.h>. */
+#ifndef ARCH_FUNC_PREFIX
+#define ARCH_FUNC_PREFIX ""
+#endif
 extern bool no_hash_pointers;
 /* Helper function to either print to a seq_file or to console. */
 	for (skipnr = 0; skipnr < num_entries; skipnr++) {
 		int len = scnprintf(buf, sizeof(buf), "%ps", (void *)stack_entries[skipnr]);
-		if (str_has_prefix(buf, "kfence_") || str_has_prefix(buf, "__kfence_") ||
+		if (str_has_prefix(buf, ARCH_FUNC_PREFIX "kfence_") ||
-		    !strncmp(buf, "__slab_free", len)) {
+		    str_has_prefix(buf, ARCH_FUNC_PREFIX "__kfence_") ||
+		    !strncmp(buf, ARCH_FUNC_PREFIX "__slab_free", len)) {
 			/*
 			 * In case of tail calls from any of the below
 			 * to any of the above.
 		}
 		/* Also the *_bulk() variants by only checking prefixes. */
-		if (str_has_prefix(buf, "kfree") ||
+		if (str_has_prefix(buf, ARCH_FUNC_PREFIX "kfree") ||
-		    str_has_prefix(buf, "kmem_cache_free") ||
+		    str_has_prefix(buf, ARCH_FUNC_PREFIX "kmem_cache_free") ||
-		    str_has_prefix(buf, "__kmalloc") ||
+		    str_has_prefix(buf, ARCH_FUNC_PREFIX "__kmalloc") ||
-		    str_has_prefix(buf, "kmem_cache_alloc"))
+		    str_has_prefix(buf, ARCH_FUNC_PREFIX "kmem_cache_alloc"))
 			goto found;
 	}
 	if (fallback < num_entries)
 	lockdep_assert_held(&meta->lock);
 	if (meta->state == KFENCE_OBJECT_UNUSED) {
-		seq_con_printf(seq, "kfence-#%zd unused\n", meta - kfence_metadata);
+		seq_con_printf(seq, "kfence-#%td unused\n", meta - kfence_metadata);
 		return;
 	}
 	seq_con_printf(seq,
-		       "kfence-#%zd [0x%p-0x%p"
+		       "kfence-#%td [0x%p-0x%p"
 		       ", size=%d, cache=%s] allocated by task %d:\n",
 		       meta - kfence_metadata, (void *)start, (void *)(start + size - 1), size,
 		       (cache && cache->name) ? cache->name : "<destroyed>", meta->alloc_track.pid);
 		pr_err("BUG: KFENCE: out-of-bounds %s in %pS\n\n", get_access_type(is_write),
 		       (void *)stack_entries[skipnr]);
-		pr_err("Out-of-bounds %s at 0x%p (%luB %s of kfence-#%zd):\n",
+		pr_err("Out-of-bounds %s at 0x%p (%luB %s of kfence-#%td):\n",
 		       get_access_type(is_write), (void *)address,
 		       left_of_object ? meta->addr - address : address - meta->addr,
 		       left_of_object ? "left" : "right", object_index);
 	case KFENCE_ERROR_UAF:
 		pr_err("BUG: KFENCE: use-after-free %s in %pS\n\n", get_access_type(is_write),
 		       (void *)stack_entries[skipnr]);
-		pr_err("Use-after-free %s at 0x%p (in kfence-#%zd):\n",
+		pr_err("Use-after-free %s at 0x%p (in kfence-#%td):\n",
 		       get_access_type(is_write), (void *)address, object_index);
 		break;
 	case KFENCE_ERROR_CORRUPTION:
 		pr_err("BUG: KFENCE: memory corruption in %pS\n\n", (void *)stack_entries[skipnr]);
 		pr_err("Corrupted memory at 0x%p ", (void *)address);
 		print_diff_canary(address, 16, meta);
-		pr_cont(" (in kfence-#%zd):\n", object_index);
+		pr_cont(" (in kfence-#%td):\n", object_index);
 		break;
 	case KFENCE_ERROR_INVALID:
 		pr_err("BUG: KFENCE: invalid %s in %pS\n\n", get_access_type(is_write),
 		break;
 	case KFENCE_ERROR_INVALID_FREE:
 		pr_err("BUG: KFENCE: invalid free in %pS\n\n", (void *)stack_entries[skipnr]);
-		pr_err("Invalid free of 0x%p (in kfence-#%zd):\n", (void *)address,
+		pr_err("Invalid free of 0x%p (in kfence-#%td):\n", (void *)address,
 		       object_index);
 		break;
 	}

mm/madvise.c+12−1

 		goto release_task;
 	}
-	mm = mm_access(task, PTRACE_MODE_ATTACH_FSCREDS);
+	/* Require PTRACE_MODE_READ to avoid leaking ASLR metadata. */
+	mm = mm_access(task, PTRACE_MODE_READ_FSCREDS);
 	if (IS_ERR_OR_NULL(mm)) {
 		ret = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
 		goto release_task;
 	}
+	/*
+	 * Require CAP_SYS_NICE for influencing process performance. Note that
+	 * only non-destructive hints are currently supported.
+	 */
+	if (!capable(CAP_SYS_NICE)) {
+		ret = -EPERM;
+		goto release_mm;
+	}
 	total_len = iov_iter_count(&iter);
 	while (iov_iter_count(&iter)) {
 	if (ret == 0)
 		ret = total_len - iov_iter_count(&iter);
+release_mm:
 	mmput(mm);
 release_task:
 	put_task_struct(task);

mm/memcontrol.c+6−9

 #endif /* CONFIG_MEMCG_KMEM */
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
 /*
- * Because page_memcg(head) is not set on compound tails, set it now.
+ * Because page_memcg(head) is not set on tails, set it now.
  */
-void mem_cgroup_split_huge_fixup(struct page *head)
+void split_page_memcg(struct page *head, unsigned int nr)
 {
 	struct mem_cgroup *memcg = page_memcg(head);
 	int i;
-	if (mem_cgroup_disabled())
+	if (mem_cgroup_disabled() || !memcg)
 		return;
-	for (i = 1; i < HPAGE_PMD_NR; i++) {
+	for (i = 1; i < nr; i++)
-		css_get(&memcg->css);
+		head[i].memcg_data = head->memcg_data;
-		head[i].memcg_data = (unsigned long)memcg;
+	css_get_many(&memcg->css, nr - 1);
-	}
 }
-#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 #ifdef CONFIG_MEMCG_SWAP
 /**

mm/memory.c+9−7

 		  pte_t *dst_pte, pte_t *src_pte, unsigned long addr, int *rss,
 		  struct page **prealloc, pte_t pte, struct page *page)
 {
-	struct mm_struct *src_mm = src_vma->vm_mm;
 	struct page *new_page;
-	if (!is_cow_mapping(src_vma->vm_flags))
-		return 1;
 	/*
 	 * What we want to do is to check whether this page may
 	 * have been pinned by the parent process.  If so,
 	 * the page count. That might give false positives for
 	 * for pinning, but it will work correctly.
 	 */
-	if (likely(!atomic_read(&src_mm->has_pinned)))
+	if (likely(!page_needs_cow_for_dma(src_vma, page)))
-		return 1;
-	if (likely(!page_maybe_dma_pinned(page)))
 		return 1;
 	new_page = *prealloc;
 		return handle_userfault(vmf, VM_UFFD_WP);
 	}
+	/*
+	 * Userfaultfd write-protect can defer flushes. Ensure the TLB
+	 * is flushed in this case before copying.
+	 */
+	if (unlikely(userfaultfd_wp(vmf->vma) &&
+		     mm_tlb_flush_pending(vmf->vma->vm_mm)))
+		flush_tlb_page(vmf->vma, vmf->address);
 	vmf->page = vm_normal_page(vma, vmf->address, vmf->orig_pte);
 	if (!vmf->page) {
 		/*

mm/memory_hotplug.c+1−1

@@ -1072,7 +1072,7 @@ static int online_memory_block(struct memory_block mem, void arg) · 1071 unmodified lines
1072	*/	1072	*/
1073	int __ref add_memory_resource(int nid, struct resource *res, mhp_t mhp_flags)	1073	int __ref add_memory_resource(int nid, struct resource *res, mhp_t mhp_flags)
1074	{	1074	{
1075	struct mhp_params params = { .pgprot = PAGE_KERNEL };	1075	struct mhp_params params = { .pgprot = pgprot_mhp(PAGE_KERNEL) };
1076	u64 start, size;	1076	u64 start, size;
1077	bool new_node = false;	1077	bool new_node = false;
1078	int ret;	1078	int ret;

mm/page_alloc.c+82−85

 	kernel_poison_pages(page, 1 << order);
+	/*
+	 * With hardware tag-based KASAN, memory tags must be set before the
+	 * page becomes unavailable via debug_pagealloc or arch_free_page.
+	 */
+	kasan_free_nondeferred_pages(page, order);
 	/*
 	 * arch_free_page() can make the page's contents inaccessible.  s390
 	 * does this.  So nothing which can access the page's contents should
 	debug_pagealloc_unmap_pages(page, 1 << order);
-	kasan_free_nondeferred_pages(page, order);
 	return true;
 }
 	for (i = 1; i < (1 << order); i++)
 		set_page_refcounted(page + i);
 	split_page_owner(page, 1 << order);
+	split_page_memcg(page, 1 << order);
 }
 EXPORT_SYMBOL_GPL(split_page);
 	}
 }
+#if !defined(CONFIG_FLAT_NODE_MEM_MAP)
+/*
+ * Only struct pages that correspond to ranges defined by memblock.memory
+ * are zeroed and initialized by going through __init_single_page() during
+ * memmap_init_zone().
+ *
+ * But, there could be struct pages that correspond to holes in
+ * memblock.memory. This can happen because of the following reasons:
+ * - physical memory bank size is not necessarily the exact multiple of the
+ *   arbitrary section size
+ * - early reserved memory may not be listed in memblock.memory
+ * - memory layouts defined with memmap= kernel parameter may not align
+ *   nicely with memmap sections
+ *
+ * Explicitly initialize those struct pages so that:
+ * - PG_Reserved is set
+ * - zone and node links point to zone and node that span the page if the
+ *   hole is in the middle of a zone
+ * - zone and node links point to adjacent zone/node if the hole falls on
+ *   the zone boundary; the pages in such holes will be prepended to the
+ *   zone/node above the hole except for the trailing pages in the last
+ *   section that will be appended to the zone/node below.
+ */
+static u64 __meminit init_unavailable_range(unsigned long spfn,
+					    unsigned long epfn,
+					    int zone, int node)
+{
+	unsigned long pfn;
+	u64 pgcnt = 0;
+	for (pfn = spfn; pfn < epfn; pfn++) {
+		if (!pfn_valid(ALIGN_DOWN(pfn, pageblock_nr_pages))) {
+			pfn = ALIGN_DOWN(pfn, pageblock_nr_pages)
+				+ pageblock_nr_pages - 1;
+			continue;
+		}
+		__init_single_page(pfn_to_page(pfn), pfn, zone, node);
+		__SetPageReserved(pfn_to_page(pfn));
+		pgcnt++;
+	}
+	return pgcnt;
+}
+#else
+static inline u64 init_unavailable_range(unsigned long spfn, unsigned long epfn,
+					 int zone, int node)
+{
+	return 0;
+}
+#endif
 void __meminit __weak memmap_init_zone(struct zone *zone)
 {
 	unsigned long zone_start_pfn = zone->zone_start_pfn;
 	unsigned long zone_end_pfn = zone_start_pfn + zone->spanned_pages;
 	int i, nid = zone_to_nid(zone), zone_id = zone_idx(zone);
+	static unsigned long hole_pfn;
 	unsigned long start_pfn, end_pfn;
+	u64 pgcnt = 0;
 	for_each_mem_pfn_range(i, nid, &start_pfn, &end_pfn, NULL) {
 		start_pfn = clamp(start_pfn, zone_start_pfn, zone_end_pfn);
 			memmap_init_range(end_pfn - start_pfn, nid,
 					zone_id, start_pfn, zone_end_pfn,
 					MEMINIT_EARLY, NULL, MIGRATE_MOVABLE);
+		if (hole_pfn < start_pfn)
+			pgcnt += init_unavailable_range(hole_pfn, start_pfn,
+							zone_id, nid);
+		hole_pfn = end_pfn;
 	}
+#ifdef CONFIG_SPARSEMEM
+	/*
+	 * Initialize the hole in the range [zone_end_pfn, section_end].
+	 * If zone boundary falls in the middle of a section, this hole
+	 * will be re-initialized during the call to this function for the
+	 * higher zone.
+	 */
+	end_pfn = round_up(zone_end_pfn, PAGES_PER_SECTION);
+	if (hole_pfn < end_pfn)
+		pgcnt += init_unavailable_range(hole_pfn, end_pfn,
+						zone_id, nid);
+#endif
+	if (pgcnt)
+		pr_info("  %s zone: %llu pages in unavailable ranges\n",
+			zone->name, pgcnt);
 }
 static int zone_batchsize(struct zone *zone)
 	free_area_init_node(nid);
 }
-#if !defined(CONFIG_FLAT_NODE_MEM_MAP)
-/*
- * Initialize all valid struct pages in the range [spfn, epfn) and mark them
- * PageReserved(). Return the number of struct pages that were initialized.
- */
-static u64 __init init_unavailable_range(unsigned long spfn, unsigned long epfn)
-{
-	unsigned long pfn;
-	u64 pgcnt = 0;
-	for (pfn = spfn; pfn < epfn; pfn++) {
-		if (!pfn_valid(ALIGN_DOWN(pfn, pageblock_nr_pages))) {
-			pfn = ALIGN_DOWN(pfn, pageblock_nr_pages)
-				+ pageblock_nr_pages - 1;
-			continue;
-		}
-		/*
-		 * Use a fake node/zone (0) for now. Some of these pages
-		 * (in memblock.reserved but not in memblock.memory) will
-		 * get re-initialized via reserve_bootmem_region() later.
-		 */
-		__init_single_page(pfn_to_page(pfn), pfn, 0, 0);
-		__SetPageReserved(pfn_to_page(pfn));
-		pgcnt++;
-	}
-	return pgcnt;
-}
-/*
- * Only struct pages that are backed by physical memory are zeroed and
- * initialized by going through __init_single_page(). But, there are some
- * struct pages which are reserved in memblock allocator and their fields
- * may be accessed (for example page_to_pfn() on some configuration accesses
- * flags). We must explicitly initialize those struct pages.
- *
- * This function also addresses a similar issue where struct pages are left
- * uninitialized because the physical address range is not covered by
- * memblock.memory or memblock.reserved. That could happen when memblock
- * layout is manually configured via memmap=, or when the highest physical
- * address (max_pfn) does not end on a section boundary.
- */
-static void __init init_unavailable_mem(void)
-{
-	phys_addr_t start, end;
-	u64 i, pgcnt;
-	phys_addr_t next = 0;
-	/*
-	 * Loop through unavailable ranges not covered by memblock.memory.
-	 */
-	pgcnt = 0;
-	for_each_mem_range(i, &start, &end) {
-		if (next < start)
-			pgcnt += init_unavailable_range(PFN_DOWN(next),
-							PFN_UP(start));
-		next = end;
-	}
-	/*
-	 * Early sections always have a fully populated memmap for the whole
-	 * section - see pfn_valid(). If the last section has holes at the
-	 * end and that section is marked "online", the memmap will be
-	 * considered initialized. Make sure that memmap has a well defined
-	 * state.
-	 */
-	pgcnt += init_unavailable_range(PFN_DOWN(next),
-					round_up(max_pfn, PAGES_PER_SECTION));
-	/*
-	 * Struct pages that do not have backing memory. This could be because
-	 * firmware is using some of this memory, or for some other reasons.
-	 */
-	if (pgcnt)
-		pr_info("Zeroed struct page in unavailable ranges: %lld pages", pgcnt);
-}
-#else
-static inline void __init init_unavailable_mem(void)
-{
-}
-#endif /* !CONFIG_FLAT_NODE_MEM_MAP */
 #if MAX_NUMNODES > 1
 /*
  * Figure out the number of possible node ids.
 	/* Initialise every node */
 	mminit_verify_pageflags_layout();
 	setup_nr_node_ids();
-	init_unavailable_mem();
 	for_each_online_node(nid) {
 		pg_data_t *pgdat = NODE_DATA(nid);
 		free_area_init_node(nid);

mm/slab.c+1−1

@@ -2992,7 +2992,7 @@ static void cache_alloc_debugcheck_after(struct kmem_cache cachep, · 2991 unmodified lines
2992	gfp_t flags, void *objp, unsigned long caller)	2992	gfp_t flags, void *objp, unsigned long caller)
2993	{	2993	{
2994	WARN_ON_ONCE(cachep->ctor && (flags & __GFP_ZERO));	2994	WARN_ON_ONCE(cachep->ctor && (flags & __GFP_ZERO));
2995	if (!objp)	2995	if (!objp \|\| is_kfence_address(objp))
2996	return objp;	2996	return objp;
2997	if (cachep->flags & SLAB_POISON) {	2997	if (cachep->flags & SLAB_POISON) {
2998	check_poison_obj(cachep, objp);	2998	check_poison_obj(cachep, objp);

mm/slub.c+1−1

@@ -1993,7 +1993,7 @@ static void get_partial_node(struct kmem_cache s, struct kmem_cache_node *n, · 1992 unmodified lines
1993		1993
1994	t = acquire_slab(s, n, page, object == NULL, &objects);	1994	t = acquire_slab(s, n, page, object == NULL, &objects);
1995	if (!t)	1995	if (!t)
1996	continue; /* cmpxchg raced */	1996	break;
1997		1997
1998	available += objects;	1998	available += objects;
1999	if (!object) {	1999	if (!object) {

net/9p/client.c+0−4

 	}
 	p9_debug(P9_DEBUG_9P, "<<< RREAD count %d\n", count);
-	if (!count) {
-		p9_tag_remove(clnt, req);
-		return 0;
-	}
 	if (non_zc) {
 		int n = copy_to_iter(dataptr, count, to);

net/core/rtnetlink.c+1−1

@@ -2147,7 +2147,7 @@ out: · 2146 unmodified lines
2147	out_err:	2147	out_err:
2148	cb->args[1] = idx;	2148	cb->args[1] = idx;
2149	cb->args[0] = h;	2149	cb->args[0] = h;
2150	cb->seq = net->dev_base_seq;	2150	cb->seq = tgt_net->dev_base_seq;
2151	nl_dump_check_consistent(cb, nlmsg_hdr(skb));	2151	nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2152	if (netnsid >= 0)	2152	if (netnsid >= 0)
2153	put_net(tgt_net);	2153	put_net(tgt_net);

net/core/skbuff.c+2−0

@@ -3659,6 +3659,8 @@ unsigned int skb_find_text(struct sk_buff *skb, unsigned int from, · 3658 unmodified lines
3659	struct ts_state state;	3659	struct ts_state state;
3660	unsigned int ret;	3660	unsigned int ret;
3661		3661
		3662	BUILD_BUG_ON(sizeof(struct skb_seq_state) > sizeof(state.cb));
		3663
3662	config->get_next_block = skb_ts_get_next_block;	3664	config->get_next_block = skb_ts_get_next_block;
3663	config->finish = skb_ts_finish;	3665	config->finish = skb_ts_finish;
3664		3666

net/dsa/Kconfig+2−0

@@ -118,6 +118,8 @@ config NET_DSA_TAG_OCELOT · 117 unmodified lines
118		118
119	config NET_DSA_TAG_OCELOT_8021Q	119	config NET_DSA_TAG_OCELOT_8021Q
120	tristate "Tag driver for Ocelot family of switches, using VLAN"	120	tristate "Tag driver for Ocelot family of switches, using VLAN"
		121	depends on MSCC_OCELOT_SWITCH_LIB \|\| \
		122	(MSCC_OCELOT_SWITCH_LIB=n && COMPILE_TEST)
121	select NET_DSA_TAG_8021Q	123	select NET_DSA_TAG_8021Q
122	help	124	help
123	Say Y or M if you want to enable support for tagging frames with a	125	Say Y or M if you want to enable support for tagging frames with a

net/dsa/dsa_priv.h+14−11

 void dsa_port_hsr_leave(struct dsa_port *dp, struct net_device *hsr);
 extern const struct phylink_mac_ops dsa_port_phylink_mac_ops;
-static inline bool dsa_port_offloads_netdev(struct dsa_port *dp,
+static inline bool dsa_port_offloads_bridge_port(struct dsa_port *dp,
-					    struct net_device *dev)
+						 struct net_device *dev)
 {
 	/* Switchdev offloading can be configured on: */
 		 */
 		return true;
-	if (dp->bridge_dev == dev)
-		/* DSA ports connected to a bridge, and event was emitted
-		 * for the bridge.
-		 */
-		return true;
 	if (dp->lag_dev == dev)
 		/* DSA ports connected to a bridge via a LAG */
 		return true;
 	return false;
 }
+static inline bool dsa_port_offloads_bridge(struct dsa_port *dp,
+					    struct net_device *bridge_dev)
+{
+	/* DSA ports connected to a bridge, and event was emitted
+	 * for the bridge.
+	 */
+	return dp->bridge_dev == bridge_dev;
+}
 /* Returns true if any port of this tree offloads the given net_device */
-static inline bool dsa_tree_offloads_netdev(struct dsa_switch_tree *dst,
+static inline bool dsa_tree_offloads_bridge_port(struct dsa_switch_tree *dst,
-					    struct net_device *dev)
+						 struct net_device *dev)
 {
 	struct dsa_port *dp;
 	list_for_each_entry(dp, &dst->ports, list)
-		if (dsa_port_offloads_netdev(dp, dev))
+		if (dsa_port_offloads_bridge_port(dp, dev))
 			return true;
 	return false;

net/dsa/slave.c+43−16

 	struct dsa_port *dp = dsa_slave_to_port(dev);
 	int ret;
-	if (!dsa_port_offloads_netdev(dp, attr->orig_dev))
-		return -EOPNOTSUPP;
 	switch (attr->id) {
 	case SWITCHDEV_ATTR_ID_PORT_STP_STATE:
+		if (!dsa_port_offloads_bridge_port(dp, attr->orig_dev))
+			return -EOPNOTSUPP;
 		ret = dsa_port_set_state(dp, attr->u.stp_state);
 		break;
 	case SWITCHDEV_ATTR_ID_BRIDGE_VLAN_FILTERING:
+		if (!dsa_port_offloads_bridge(dp, attr->orig_dev))
+			return -EOPNOTSUPP;
 		ret = dsa_port_vlan_filtering(dp, attr->u.vlan_filtering,
 					      extack);
 		break;
 	case SWITCHDEV_ATTR_ID_BRIDGE_AGEING_TIME:
+		if (!dsa_port_offloads_bridge(dp, attr->orig_dev))
+			return -EOPNOTSUPP;
 		ret = dsa_port_ageing_time(dp, attr->u.ageing_time);
 		break;
 	case SWITCHDEV_ATTR_ID_PORT_PRE_BRIDGE_FLAGS:
+		if (!dsa_port_offloads_bridge_port(dp, attr->orig_dev))
+			return -EOPNOTSUPP;
 		ret = dsa_port_pre_bridge_flags(dp, attr->u.brport_flags,
 						extack);
 		break;
 	case SWITCHDEV_ATTR_ID_PORT_BRIDGE_FLAGS:
+		if (!dsa_port_offloads_bridge_port(dp, attr->orig_dev))
+			return -EOPNOTSUPP;
 		ret = dsa_port_bridge_flags(dp, attr->u.brport_flags, extack);
 		break;
 	case SWITCHDEV_ATTR_ID_BRIDGE_MROUTER:
+		if (!dsa_port_offloads_bridge(dp, attr->orig_dev))
+			return -EOPNOTSUPP;
 		ret = dsa_port_mrouter(dp->cpu_dp, attr->u.mrouter, extack);
 		break;
 	default:
 	struct switchdev_obj_port_vlan vlan;
 	int err;
-	if (!dsa_port_offloads_netdev(dp, obj->orig_dev))
-		return -EOPNOTSUPP;
 	if (dsa_port_skip_vlan_configuration(dp)) {
 		NL_SET_ERR_MSG_MOD(extack, "skipping configuration of VLAN");
 		return 0;
 	switch (obj->id) {
 	case SWITCHDEV_OBJ_ID_PORT_MDB:
-		if (!dsa_port_offloads_netdev(dp, obj->orig_dev))
+		if (!dsa_port_offloads_bridge_port(dp, obj->orig_dev))
 			return -EOPNOTSUPP;
 		err = dsa_port_mdb_add(dp, SWITCHDEV_OBJ_PORT_MDB(obj));
 		break;
 	case SWITCHDEV_OBJ_ID_HOST_MDB:
+		if (!dsa_port_offloads_bridge(dp, obj->orig_dev))
+			return -EOPNOTSUPP;
 		/* DSA can directly translate this to a normal MDB add,
 		 * but on the CPU port.
 		 */
 		err = dsa_port_mdb_add(dp->cpu_dp, SWITCHDEV_OBJ_PORT_MDB(obj));
 		break;
 	case SWITCHDEV_OBJ_ID_PORT_VLAN:
+		if (!dsa_port_offloads_bridge_port(dp, obj->orig_dev))
+			return -EOPNOTSUPP;
 		err = dsa_slave_vlan_add(dev, obj, extack);
 		break;
 	case SWITCHDEV_OBJ_ID_MRP:
-		if (!dsa_port_offloads_netdev(dp, obj->orig_dev))
+		if (!dsa_port_offloads_bridge(dp, obj->orig_dev))
 			return -EOPNOTSUPP;
 		err = dsa_port_mrp_add(dp, SWITCHDEV_OBJ_MRP(obj));
 		break;
 	case SWITCHDEV_OBJ_ID_RING_ROLE_MRP:
-		if (!dsa_port_offloads_netdev(dp, obj->orig_dev))
+		if (!dsa_port_offloads_bridge(dp, obj->orig_dev))
 			return -EOPNOTSUPP;
 		err = dsa_port_mrp_add_ring_role(dp,
 						 SWITCHDEV_OBJ_RING_ROLE_MRP(obj));
 		break;
 	struct switchdev_obj_port_vlan *vlan;
 	int err;
-	if (!dsa_port_offloads_netdev(dp, obj->orig_dev))
-		return -EOPNOTSUPP;
 	if (dsa_port_skip_vlan_configuration(dp))
 		return 0;
 	switch (obj->id) {
 	case SWITCHDEV_OBJ_ID_PORT_MDB:
-		if (!dsa_port_offloads_netdev(dp, obj->orig_dev))
+		if (!dsa_port_offloads_bridge_port(dp, obj->orig_dev))
 			return -EOPNOTSUPP;
 		err = dsa_port_mdb_del(dp, SWITCHDEV_OBJ_PORT_MDB(obj));
 		break;
 	case SWITCHDEV_OBJ_ID_HOST_MDB:
+		if (!dsa_port_offloads_bridge(dp, obj->orig_dev))
+			return -EOPNOTSUPP;
 		/* DSA can directly translate this to a normal MDB add,
 		 * but on the CPU port.
 		 */
 		err = dsa_port_mdb_del(dp->cpu_dp, SWITCHDEV_OBJ_PORT_MDB(obj));
 		break;
 	case SWITCHDEV_OBJ_ID_PORT_VLAN:
+		if (!dsa_port_offloads_bridge_port(dp, obj->orig_dev))
+			return -EOPNOTSUPP;
 		err = dsa_slave_vlan_del(dev, obj);
 		break;
 	case SWITCHDEV_OBJ_ID_MRP:
-		if (!dsa_port_offloads_netdev(dp, obj->orig_dev))
+		if (!dsa_port_offloads_bridge(dp, obj->orig_dev))
 			return -EOPNOTSUPP;
 		err = dsa_port_mrp_del(dp, SWITCHDEV_OBJ_MRP(obj));
 		break;
 	case SWITCHDEV_OBJ_ID_RING_ROLE_MRP:
-		if (!dsa_port_offloads_netdev(dp, obj->orig_dev))
+		if (!dsa_port_offloads_bridge(dp, obj->orig_dev))
 			return -EOPNOTSUPP;
 		err = dsa_port_mrp_del_ring_role(dp,
 						 SWITCHDEV_OBJ_RING_ROLE_MRP(obj));
 		break;
 			 * other ports bridged with the LAG should be able to
 			 * autonomously forward towards it.
 			 */
-			if (dsa_tree_offloads_netdev(dp->ds->dst, dev))
+			if (dsa_tree_offloads_bridge_port(dp->ds->dst, dev))
 				return NOTIFY_DONE;
 		}

net/dsa/tag_mtk.c+13−6

 #define MTK_HDR_LEN		4
 #define MTK_HDR_XMIT_UNTAGGED		0
 #define MTK_HDR_XMIT_TAGGED_TPID_8100	1
+#define MTK_HDR_XMIT_TAGGED_TPID_88A8	2
 #define MTK_HDR_RECV_SOURCE_PORT_MASK	GENMASK(2, 0)
 #define MTK_HDR_XMIT_DP_BIT_MASK	GENMASK(5, 0)
 #define MTK_HDR_XMIT_SA_DIS		BIT(6)
 				    struct net_device *dev)
 {
 	struct dsa_port *dp = dsa_slave_to_port(dev);
+	u8 xmit_tpid;
 	u8 *mtk_tag;
-	bool is_vlan_skb = true;
 	unsigned char *dest = eth_hdr(skb)->h_dest;
 	bool is_multicast_skb = is_multicast_ether_addr(dest) &&
 				!is_broadcast_ether_addr(dest);
 	 * the both special and VLAN tag at the same time and then look up VLAN
 	 * table with VID.
 	 */
-	if (!skb_vlan_tagged(skb)) {
+	switch (skb->protocol) {
+	case htons(ETH_P_8021Q):
+		xmit_tpid = MTK_HDR_XMIT_TAGGED_TPID_8100;
+		break;
+	case htons(ETH_P_8021AD):
+		xmit_tpid = MTK_HDR_XMIT_TAGGED_TPID_88A8;
+		break;
+	default:
+		xmit_tpid = MTK_HDR_XMIT_UNTAGGED;
 		skb_push(skb, MTK_HDR_LEN);
 		memmove(skb->data, skb->data + MTK_HDR_LEN, 2 * ETH_ALEN);
-		is_vlan_skb = false;
 	}
 	mtk_tag = skb->data + 2 * ETH_ALEN;
 	/* Mark tag attribute on special tag insertion to notify hardware
 	 * whether that's a combined special tag with 802.1Q header.
 	 */
-	mtk_tag[0] = is_vlan_skb ? MTK_HDR_XMIT_TAGGED_TPID_8100 :
+	mtk_tag[0] = xmit_tpid;
-		     MTK_HDR_XMIT_UNTAGGED;
 	mtk_tag[1] = (1 << dp->index) & MTK_HDR_XMIT_DP_BIT_MASK;
 	/* Disable SA learning for multicast frames */
 		mtk_tag[1] |= MTK_HDR_XMIT_SA_DIS;
 	/* Tag control information is kept for 802.1Q */
-	if (!is_vlan_skb) {
+	if (xmit_tpid == MTK_HDR_XMIT_UNTAGGED) {
 		mtk_tag[2] = 0;
 		mtk_tag[3] = 0;
 	}

net/dsa/tag_rtl4_a.c+5−7

 				      struct net_device *dev)
 {
 	struct dsa_port *dp = dsa_slave_to_port(dev);
+	__be16 *p;
 	u8 *tag;
-	u16 *p;
 	u16 out;
 	/* Pad out to at least 60 bytes */
-	if (unlikely(eth_skb_pad(skb)))
+	if (unlikely(__skb_put_padto(skb, ETH_ZLEN, false)))
-		return NULL;
-	if (skb_cow_head(skb, RTL4_A_HDR_LEN) < 0)
 		return NULL;
 	netdev_dbg(dev, "add realtek tag to package to port %d\n",
 	tag = skb->data + 2 * ETH_ALEN;
 	/* Set Ethertype */
-	p = (u16 *)tag;
+	p = (__be16 *)tag;
 	*p = htons(RTL4_A_ETHERTYPE);
 	out = (RTL4_A_PROTOCOL_RTL8366RB << 12) | (2 << 8);
-	/* The lower bits is the port numer */
+	/* The lower bits is the port number */
 	out |= (u8)dp->index;
-	p = (u16 *)(tag + 2);
+	p = (__be16 *)(tag + 2);
 	*p = htons(out);
 	return skb;

net/ethtool/channels.c+13−13

 	struct ethtool_channels channels = {};
 	struct ethnl_req_info req_info = {};
 	struct nlattr **tb = info->attrs;
-	const struct nlattr *err_attr;
+	u32 err_attr, max_rx_in_use = 0;
 	const struct ethtool_ops *ops;
 	struct net_device *dev;
-	u32 max_rx_in_use = 0;
 	int ret;
 	ret = ethnl_parse_header_dev_get(&req_info,
 	/* ensure new channel counts are within limits */
 	if (channels.rx_count > channels.max_rx)
-		err_attr = tb[ETHTOOL_A_CHANNELS_RX_COUNT];
+		err_attr = ETHTOOL_A_CHANNELS_RX_COUNT;
 	else if (channels.tx_count > channels.max_tx)
-		err_attr = tb[ETHTOOL_A_CHANNELS_TX_COUNT];
+		err_attr = ETHTOOL_A_CHANNELS_TX_COUNT;
 	else if (channels.other_count > channels.max_other)
-		err_attr = tb[ETHTOOL_A_CHANNELS_OTHER_COUNT];
+		err_attr = ETHTOOL_A_CHANNELS_OTHER_COUNT;
 	else if (channels.combined_count > channels.max_combined)
-		err_attr = tb[ETHTOOL_A_CHANNELS_COMBINED_COUNT];
+		err_attr = ETHTOOL_A_CHANNELS_COMBINED_COUNT;
 	else
-		err_attr = NULL;
+		err_attr = 0;
 	if (err_attr) {
 		ret = -EINVAL;
-		NL_SET_ERR_MSG_ATTR(info->extack, err_attr,
+		NL_SET_ERR_MSG_ATTR(info->extack, tb[err_attr],
 				    "requested channel count exceeds maximum");
 		goto out_ops;
 	}
 	/* ensure there is at least one RX and one TX channel */
 	if (!channels.combined_count && !channels.rx_count)
-		err_attr = tb[ETHTOOL_A_CHANNELS_RX_COUNT];
+		err_attr = ETHTOOL_A_CHANNELS_RX_COUNT;
 	else if (!channels.combined_count && !channels.tx_count)
-		err_attr = tb[ETHTOOL_A_CHANNELS_TX_COUNT];
+		err_attr = ETHTOOL_A_CHANNELS_TX_COUNT;
 	else
-		err_attr = NULL;
+		err_attr = 0;
 	if (err_attr) {
 		if (mod_combined)
-			err_attr = tb[ETHTOOL_A_CHANNELS_COMBINED_COUNT];
+			err_attr = ETHTOOL_A_CHANNELS_COMBINED_COUNT;
 		ret = -EINVAL;
-		NL_SET_ERR_MSG_ATTR(info->extack, err_attr, "requested channel counts would result in no RX or TX channel being configured");
+		NL_SET_ERR_MSG_ATTR(info->extack, tb[err_attr],
+				    "requested channel counts would result in no RX or TX channel being configured");
 		goto out_ops;
 	}

net/ipv4/cipso_ipv4.c+2−11

 		ret_val = -ENOENT;
 		goto doi_remove_return;
 	}
-	if (!refcount_dec_and_test(&doi_def->refcount)) {
-		spin_unlock(&cipso_v4_doi_list_lock);
-		ret_val = -EBUSY;
-		goto doi_remove_return;
-	}
 	list_del_rcu(&doi_def->list);
 	spin_unlock(&cipso_v4_doi_list_lock);
-	cipso_v4_cache_invalidate();
+	cipso_v4_doi_putdef(doi_def);
-	call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
 	ret_val = 0;
 doi_remove_return:
 	if (!refcount_dec_and_test(&doi_def->refcount))
 		return;
-	spin_lock(&cipso_v4_doi_list_lock);
-	list_del_rcu(&doi_def->list);
-	spin_unlock(&cipso_v4_doi_list_lock);
 	cipso_v4_cache_invalidate();
 	call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
 {
 	buf[0] = IPOPT_CIPSO;
 	buf[1] = CIPSO_V4_HDR_LEN + len;
-	*(__be32 *)&buf[2] = htonl(doi_def->doi);
+	put_unaligned_be32(doi_def->doi, &buf[2]);
 }
 /**

net/ipv4/inetpeer.c+7−14

@@ -65,7 +65,7 @@ EXPORT_SYMBOL_GPL(inet_peer_base_init); · 64 unmodified lines
65	#define PEER_MAX_GC 32	65	#define PEER_MAX_GC 32
66		66
67	/* Exported for sysctl_net_ipv4. */	67	/* Exported for sysctl_net_ipv4. */
68	int inet_peer_threshold __read_mostly = 65536 + 128; /* start to throw entries more	68	int inet_peer_threshold __read_mostly; /* start to throw entries more
69	* aggressively at this stage */	69	* aggressively at this stage */
70	int inet_peer_minttl __read_mostly = 120 * HZ; /* TTL under high load: 120 sec */	70	int inet_peer_minttl __read_mostly = 120 * HZ; /* TTL under high load: 120 sec */
71	int inet_peer_maxttl __read_mostly = 10 * 60 * HZ; /* usual time to live: 10 min */	71	int inet_peer_maxttl __read_mostly = 10 * 60 * HZ; /* usual time to live: 10 min */
@@ -73,20 +73,13 @@ int inet_peer_maxttl __read_mostly = 10 * 60 * HZ; /* usual time to live: 10 min · 1 unmodified line
73	/* Called from ip_output.c:ip_init */	73	/* Called from ip_output.c:ip_init */
74	void __init inet_initpeers(void)	74	void __init inet_initpeers(void)
75	{	75	{
76	struct sysinfo si;	76	u64 nr_entries;
77		77
78	/* Use the straight interface to information about memory. */	78	/* 1% of physical memory */
79	si_meminfo(&si);	79	nr_entries = div64_ul((u64)totalram_pages() << PAGE_SHIFT,
80	/* The values below were suggested by Alexey Kuznetsov	80	100 * L1_CACHE_ALIGN(sizeof(struct inet_peer)));
81	* <kuznet@ms2.inr.ac.ru>. I don't have any opinion about the values	81
82	* myself. --SAW	82	inet_peer_threshold = clamp_val(nr_entries, 4096, 65536 + 128);
83	*/
84	if (si.totalram <= (32768*1024)/PAGE_SIZE)
85	inet_peer_threshold >>= 1; /* max pool size about 1MB on IA32 */
86	if (si.totalram <= (16384*1024)/PAGE_SIZE)
87	inet_peer_threshold >>= 1; /* about 512KB */
88	if (si.totalram <= (8192*1024)/PAGE_SIZE)
89	inet_peer_threshold >>= 2; /* about 128KB */
90		83
91	peer_cachep = kmem_cache_create("inet_peer_cache",	84	peer_cachep = kmem_cache_create("inet_peer_cache",
92	sizeof(struct inet_peer),	85	sizeof(struct inet_peer),

net/ipv4/ip_tunnel.c+2−3

 		if (!skb_is_gso(skb) &&
 		    (inner_iph->frag_off & htons(IP_DF)) &&
 		    mtu < pkt_size) {
-			memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+			icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
-			icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
 			return -E2BIG;
 		}
 	}
 		if (!skb_is_gso(skb) && mtu >= IPV6_MIN_MTU &&
 					mtu < pkt_size) {
-			icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+			icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
 			return -E2BIG;
 		}
 	}

net/ipv4/ip_vti.c+3−3

@@ -238,13 +238,13 @@ static netdev_tx_t vti_xmit(struct sk_buff skb, struct net_device dev, · 237 unmodified lines
238	if (skb->len > mtu) {	238	if (skb->len > mtu) {
239	skb_dst_update_pmtu_no_confirm(skb, mtu);	239	skb_dst_update_pmtu_no_confirm(skb, mtu);
240	if (skb->protocol == htons(ETH_P_IP)) {	240	if (skb->protocol == htons(ETH_P_IP)) {
241	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,	241	icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
242	htonl(mtu));	242	htonl(mtu));
243	} else {	243	} else {
244	if (mtu < IPV6_MIN_MTU)	244	if (mtu < IPV6_MIN_MTU)
245	mtu = IPV6_MIN_MTU;	245	mtu = IPV6_MIN_MTU;
246		246
247	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);	247	icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
248	}	248	}
249		249
250	dst_release(dst);	250	dst_release(dst);

net/ipv4/nexthop.c+7−3

 /* rtnl */
 /* remove all nexthops tied to a device being deleted */
-static void nexthop_flush_dev(struct net_device *dev)
+static void nexthop_flush_dev(struct net_device *dev, unsigned long event)
 {
 	unsigned int hash = nh_dev_hashfn(dev->ifindex);
 	struct net *net = dev_net(dev);
 		if (nhi->fib_nhc.nhc_dev != dev)
 			continue;
+		if (nhi->reject_nh &&
+		    (event == NETDEV_DOWN || event == NETDEV_CHANGE))
+			continue;
 		remove_nexthop(net, nhi->nh_parent, NULL);
 	}
 }
 	switch (event) {
 	case NETDEV_DOWN:
 	case NETDEV_UNREGISTER:
-		nexthop_flush_dev(dev);
+		nexthop_flush_dev(dev, event);
 		break;
 	case NETDEV_CHANGE:
 		if (!(dev_get_flags(dev) & (IFF_RUNNING | IFF_LOWER_UP)))
-			nexthop_flush_dev(dev);
+			nexthop_flush_dev(dev, event);
 		break;
 	case NETDEV_CHANGEMTU:
 		info_ext = ptr;

net/ipv4/tcp.c+17−9

 		break;
 	case TCP_QUEUE_SEQ:
-		if (sk->sk_state != TCP_CLOSE)
+		if (sk->sk_state != TCP_CLOSE) {
 			err = -EPERM;
-		else if (tp->repair_queue == TCP_SEND_QUEUE)
+		} else if (tp->repair_queue == TCP_SEND_QUEUE) {
-			WRITE_ONCE(tp->write_seq, val);
+			if (!tcp_rtx_queue_empty(sk))
-		else if (tp->repair_queue == TCP_RECV_QUEUE) {
+				err = -EPERM;
-			WRITE_ONCE(tp->rcv_nxt, val);
+			else
-			WRITE_ONCE(tp->copied_seq, val);
+				WRITE_ONCE(tp->write_seq, val);
-		}
+		} else if (tp->repair_queue == TCP_RECV_QUEUE) {
-		else
+			if (tp->rcv_nxt != tp->copied_seq) {
+				err = -EPERM;
+			} else {
+				WRITE_ONCE(tp->rcv_nxt, val);
+				WRITE_ONCE(tp->copied_seq, val);
+			}
+		} else {
 			err = -EINVAL;
+		}
 		break;
 	case TCP_REPAIR_OPTIONS:
 		if (get_user(len, optlen))
 			return -EFAULT;
-		if (len < offsetofend(struct tcp_zerocopy_receive, length))
+		if (len < 0 ||
+		    len < offsetofend(struct tcp_zerocopy_receive, length))
 			return -EINVAL;
 		if (unlikely(len > sizeof(zc))) {
 			err = check_zeroed_user(optval + sizeof(zc),

net/ipv4/udp_offload.c+1−1

@@ -526,7 +526,7 @@ struct sk_buff udp_gro_receive(struct list_head head, struct sk_buff *skb, · 525 unmodified lines
526	}	526	}
527		527
528	if (!sk \|\| NAPI_GRO_CB(skb)->encap_mark \|\|	528	if (!sk \|\| NAPI_GRO_CB(skb)->encap_mark \|\|
529	(skb->ip_summed != CHECKSUM_PARTIAL &&	529	(uh->check && skb->ip_summed != CHECKSUM_PARTIAL &&
530	NAPI_GRO_CB(skb)->csum_cnt == 0 &&	530	NAPI_GRO_CB(skb)->csum_cnt == 0 &&
531	!NAPI_GRO_CB(skb)->csum_valid) \|\|	531	!NAPI_GRO_CB(skb)->csum_valid) \|\|
532	!udp_sk(sk)->gro_receive)	532	!udp_sk(sk)->gro_receive)

net/ipv6/calipso.c+5−9

 static struct calipso_map_cache_bkt *calipso_cache;
+static void calipso_cache_invalidate(void);
+static void calipso_doi_putdef(struct calipso_doi *doi_def);
 /* Label Mapping Cache Functions
  */
 		ret_val = -ENOENT;
 		goto doi_remove_return;
 	}
-	if (!refcount_dec_and_test(&doi_def->refcount)) {
-		spin_unlock(&calipso_doi_list_lock);
-		ret_val = -EBUSY;
-		goto doi_remove_return;
-	}
 	list_del_rcu(&doi_def->list);
 	spin_unlock(&calipso_doi_list_lock);
-	call_rcu(&doi_def->rcu, calipso_doi_free_rcu);
+	calipso_doi_putdef(doi_def);
 	ret_val = 0;
 doi_remove_return:
 	if (!refcount_dec_and_test(&doi_def->refcount))
 		return;
-	spin_lock(&calipso_doi_list_lock);
-	list_del_rcu(&doi_def->list);
-	spin_unlock(&calipso_doi_list_lock);
+	calipso_cache_invalidate();
 	call_rcu(&doi_def->rcu, calipso_doi_free_rcu);
 }

net/ipv6/ip6_gre.c+8−8

@@ -678,8 +678,8 @@ static int prepare_ip6gre_xmit_ipv6(struct sk_buff *skb, · 677 unmodified lines
678		678
679	tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];	679	tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];
680	if (tel->encap_limit == 0) {	680	if (tel->encap_limit == 0) {
681	icmpv6_send(skb, ICMPV6_PARAMPROB,	681	icmpv6_ndo_send(skb, ICMPV6_PARAMPROB,
682	ICMPV6_HDR_FIELD, offset + 2);	682	ICMPV6_HDR_FIELD, offset + 2);
683	return -1;	683	return -1;
684	}	684	}
685	*encap_limit = tel->encap_limit - 1;	685	*encap_limit = tel->encap_limit - 1;
@@ -805,8 +805,8 @@ static inline int ip6gre_xmit_ipv4(struct sk_buff skb, struct net_device dev) · 119 unmodified lines
805	if (err != 0) {	805	if (err != 0) {
806	/* XXX: send ICMP error even if DF is not set. */	806	/* XXX: send ICMP error even if DF is not set. */
807	if (err == -EMSGSIZE)	807	if (err == -EMSGSIZE)
808	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,	808	icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
809	htonl(mtu));	809	htonl(mtu));
810	return -1;	810	return -1;
811	}	811	}
812		812
@@ -837,7 +837,7 @@ static inline int ip6gre_xmit_ipv6(struct sk_buff skb, struct net_device dev) · 24 unmodified lines
837	&mtu, skb->protocol);	837	&mtu, skb->protocol);
838	if (err != 0) {	838	if (err != 0) {
839	if (err == -EMSGSIZE)	839	if (err == -EMSGSIZE)
840	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);	840	icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
841	return -1;	841	return -1;
842	}	842	}
843		843
@@ -1063,10 +1063,10 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, · 219 unmodified lines
1063	/* XXX: send ICMP error even if DF is not set. */	1063	/* XXX: send ICMP error even if DF is not set. */
1064	if (err == -EMSGSIZE) {	1064	if (err == -EMSGSIZE) {
1065	if (skb->protocol == htons(ETH_P_IP))	1065	if (skb->protocol == htons(ETH_P_IP))
1066	icmp_send(skb, ICMP_DEST_UNREACH,	1066	icmp_ndo_send(skb, ICMP_DEST_UNREACH,
1067	ICMP_FRAG_NEEDED, htonl(mtu));	1067	ICMP_FRAG_NEEDED, htonl(mtu));
1068	else	1068	else
1069	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);	1069	icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
1070	}	1070	}
1071		1071
1072	goto tx_err;	1072	goto tx_err;

net/ipv6/ip6_tunnel.c+5−5

@@ -1332,8 +1332,8 @@ ipxip6_tnl_xmit(struct sk_buff skb, struct net_device dev, · 1331 unmodified lines
1332		1332
1333	tel = (void *)&skb_network_header(skb)[offset];	1333	tel = (void *)&skb_network_header(skb)[offset];
1334	if (tel->encap_limit == 0) {	1334	if (tel->encap_limit == 0) {
1335	icmpv6_send(skb, ICMPV6_PARAMPROB,	1335	icmpv6_ndo_send(skb, ICMPV6_PARAMPROB,
1336	ICMPV6_HDR_FIELD, offset + 2);	1336	ICMPV6_HDR_FIELD, offset + 2);
1337	return -1;	1337	return -1;
1338	}	1338	}
1339	encap_limit = tel->encap_limit - 1;	1339	encap_limit = tel->encap_limit - 1;
@@ -1385,11 +1385,11 @@ ipxip6_tnl_xmit(struct sk_buff skb, struct net_device dev, · 45 unmodified lines
1385	if (err == -EMSGSIZE)	1385	if (err == -EMSGSIZE)
1386	switch (protocol) {	1386	switch (protocol) {
1387	case IPPROTO_IPIP:	1387	case IPPROTO_IPIP:
1388	icmp_send(skb, ICMP_DEST_UNREACH,	1388	icmp_ndo_send(skb, ICMP_DEST_UNREACH,
1389	ICMP_FRAG_NEEDED, htonl(mtu));	1389	ICMP_FRAG_NEEDED, htonl(mtu));
1390	break;	1390	break;
1391	case IPPROTO_IPV6:	1391	case IPPROTO_IPV6:
1392	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);	1392	icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
1393	break;	1393	break;
1394	default:	1394	default:
1395	break;	1395	break;

net/ipv6/ip6_vti.c+3−3

@@ -521,10 +521,10 @@ vti6_xmit(struct sk_buff skb, struct net_device dev, struct flowi *fl) · 520 unmodified lines
521	if (mtu < IPV6_MIN_MTU)	521	if (mtu < IPV6_MIN_MTU)
522	mtu = IPV6_MIN_MTU;	522	mtu = IPV6_MIN_MTU;
523		523
524	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);	524	icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
525	} else {	525	} else {
526	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,	526	icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
527	htonl(mtu));	527	htonl(mtu));
528	}	528	}
529		529
530	err = -EMSGSIZE;	530	err = -EMSGSIZE;

net/ipv6/sit.c+1−1

@@ -987,7 +987,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb, · 986 unmodified lines
987	skb_dst_update_pmtu_no_confirm(skb, mtu);	987	skb_dst_update_pmtu_no_confirm(skb, mtu);
988		988
989	if (skb->len > mtu && !skb_is_gso(skb)) {	989	if (skb->len > mtu && !skb_is_gso(skb)) {
990	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);	990	icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
991	ip_rt_put(rt);	991	ip_rt_put(rt);
992	goto tx_error;	992	goto tx_error;
993	}	993	}

net/l2tp/l2tp_core.c+22−19

 	/* Parse and check optional cookie */
 	if (session->peer_cookie_len > 0) {
 		if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
-			pr_warn_ratelimited("%s: cookie mismatch (%u/%u). Discarding.\n",
+			pr_debug_ratelimited("%s: cookie mismatch (%u/%u). Discarding.\n",
-					    tunnel->name, tunnel->tunnel_id,
+					     tunnel->name, tunnel->tunnel_id,
-					    session->session_id);
+					     session->session_id);
 			atomic_long_inc(&session->stats.rx_cookie_discards);
 			goto discard;
 		}
 		 * If user has configured mandatory sequence numbers, discard.
 		 */
 		if (session->recv_seq) {
-			pr_warn_ratelimited("%s: recv data has no seq numbers when required. Discarding.\n",
+			pr_debug_ratelimited("%s: recv data has no seq numbers when required. Discarding.\n",
-					    session->name);
+					     session->name);
 			atomic_long_inc(&session->stats.rx_seq_discards);
 			goto discard;
 		}
 			session->send_seq = 0;
 			l2tp_session_set_header_len(session, tunnel->version);
 		} else if (session->send_seq) {
-			pr_warn_ratelimited("%s: recv data has no seq numbers when required. Discarding.\n",
+			pr_debug_ratelimited("%s: recv data has no seq numbers when required. Discarding.\n",
-					    session->name);
+					     session->name);
 			atomic_long_inc(&session->stats.rx_seq_discards);
 			goto discard;
 		}
 	/* Short packet? */
 	if (!pskb_may_pull(skb, L2TP_HDR_SIZE_MAX)) {
-		pr_warn_ratelimited("%s: recv short packet (len=%d)\n",
+		pr_debug_ratelimited("%s: recv short packet (len=%d)\n",
-				    tunnel->name, skb->len);
+				     tunnel->name, skb->len);
-		goto error;
+		goto invalid;
 	}
 	/* Point to L2TP header */
 	/* Check protocol version */
 	version = hdrflags & L2TP_HDR_VER_MASK;
 	if (version != tunnel->version) {
-		pr_warn_ratelimited("%s: recv protocol version mismatch: got %d expected %d\n",
+		pr_debug_ratelimited("%s: recv protocol version mismatch: got %d expected %d\n",
-				    tunnel->name, version, tunnel->version);
+				     tunnel->name, version, tunnel->version);
-		goto error;
+		goto invalid;
 	}
 	/* Get length of L2TP packet */
 	/* If type is control packet, it is handled by userspace. */
 	if (hdrflags & L2TP_HDRFLAG_T)
-		goto error;
+		goto pass;
 	/* Skip flags */
 	ptr += 2;
 			l2tp_session_dec_refcount(session);
 		/* Not found? Pass to userspace to deal with */
-		pr_warn_ratelimited("%s: no session found (%u/%u). Passing up.\n",
+		pr_debug_ratelimited("%s: no session found (%u/%u). Passing up.\n",
-				    tunnel->name, tunnel_id, session_id);
+				     tunnel->name, tunnel_id, session_id);
-		goto error;
+		goto pass;
 	}
 	if (tunnel->version == L2TP_HDR_VER_3 &&
 	    l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr))
-		goto error;
+		goto invalid;
 	l2tp_recv_common(session, skb, ptr, optr, hdrflags, length);
 	l2tp_session_dec_refcount(session);
 	return 0;
-error:
+invalid:
+	atomic_long_inc(&tunnel->stats.rx_invalid);
+pass:
 	/* Put UDP header back */
 	__skb_push(skb, sizeof(struct udphdr));

net/l2tp/l2tp_core.h+1−0

@@ -39,6 +39,7 @@ struct l2tp_stats { · 38 unmodified lines
39	atomic_long_t rx_oos_packets;	39	atomic_long_t rx_oos_packets;
40	atomic_long_t rx_errors;	40	atomic_long_t rx_errors;
41	atomic_long_t rx_cookie_discards;	41	atomic_long_t rx_cookie_discards;
		42	atomic_long_t rx_invalid;
42	};	43	};
43		44
44	struct l2tp_tunnel;	45	struct l2tp_tunnel;

net/l2tp/l2tp_netlink.c+6−0

 			      L2TP_ATTR_STATS_PAD) ||
 	    nla_put_u64_64bit(skb, L2TP_ATTR_RX_ERRORS,
 			      atomic_long_read(&tunnel->stats.rx_errors),
+			      L2TP_ATTR_STATS_PAD) ||
+	    nla_put_u64_64bit(skb, L2TP_ATTR_RX_INVALID,
+			      atomic_long_read(&tunnel->stats.rx_invalid),
 			      L2TP_ATTR_STATS_PAD))
 		goto nla_put_failure;
 	nla_nest_end(skb, nest);
 			      L2TP_ATTR_STATS_PAD) ||
 	    nla_put_u64_64bit(skb, L2TP_ATTR_RX_ERRORS,
 			      atomic_long_read(&session->stats.rx_errors),
+			      L2TP_ATTR_STATS_PAD) ||
+	    nla_put_u64_64bit(skb, L2TP_ATTR_RX_INVALID,
+			      atomic_long_read(&session->stats.rx_invalid),
 			      L2TP_ATTR_STATS_PAD))
 		goto nla_put_failure;
 	nla_nest_end(skb, nest);

net/mpls/mpls_gso.c+3−0

 #include <linux/netdev_features.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <net/mpls.h>
 static struct sk_buff *mpls_gso_segment(struct sk_buff *skb,
 				       netdev_features_t features)
 	skb_reset_network_header(skb);
 	mpls_hlen = skb_inner_network_header(skb) - skb_network_header(skb);
+	if (unlikely(!mpls_hlen || mpls_hlen % MPLS_HLEN))
+		goto out;
 	if (unlikely(!pskb_may_pull(skb, mpls_hlen)))
 		goto out;

net/mptcp/protocol.c+104−61

@@ -1061,6 +1061,12 @@ out: · 1060 unmodified lines
1061	}	1061	}
1062	}	1062	}
1063		1063
		1064	static void __mptcp_clean_una_wakeup(struct sock *sk)
		1065	{
		1066	__mptcp_clean_una(sk);
		1067	mptcp_write_space(sk);
		1068	}
		1069
1064	static void mptcp_enter_memory_pressure(struct sock *sk)	1070	static void mptcp_enter_memory_pressure(struct sock *sk)
1065	{	1071	{
1066	struct mptcp_subflow_context *subflow;	1072	struct mptcp_subflow_context *subflow;
@@ -1189,6 +1195,7 @@ static bool mptcp_tx_cache_refill(struct sock *sk, int size, · 122 unmodified lines
1189	*/	1195	*/
1190	while (skbs->qlen > 1) {	1196	while (skbs->qlen > 1) {
1191	skb = __skb_dequeue_tail(skbs);	1197	skb = __skb_dequeue_tail(skbs);
		1198	*total_ts -= skb->truesize;
1192	__kfree_skb(skb);	1199	__kfree_skb(skb);
1193	}	1200	}
1194	return skbs->qlen > 0;	1201	return skbs->qlen > 0;
@@ -1444,7 +1451,7 @@ static void mptcp_push_release(struct sock sk, struct sock ssk, · 249 unmodified lines
1444	release_sock(ssk);	1451	release_sock(ssk);
1445	}	1452	}
1446		1453
1447	static void mptcp_push_pending(struct sock *sk, unsigned int flags)	1454	static void __mptcp_push_pending(struct sock *sk, unsigned int flags)
1448	{	1455	{
1449	struct sock prev_ssk = NULL, ssk = NULL;	1456	struct sock prev_ssk = NULL, ssk = NULL;
1450	struct mptcp_sock *msk = mptcp_sk(sk);	1457	struct mptcp_sock *msk = mptcp_sk(sk);
@@ -1696,14 +1703,14 @@ static int mptcp_sendmsg(struct sock sk, struct msghdr msg, size_t len) · 245 unmodified lines
1696		1703
1697	wait_for_memory:	1704	wait_for_memory:
1698	mptcp_set_nospace(sk);	1705	mptcp_set_nospace(sk);
1699	mptcp_push_pending(sk, msg->msg_flags);	1706	__mptcp_push_pending(sk, msg->msg_flags);
1700	ret = sk_stream_wait_memory(sk, &timeo);	1707	ret = sk_stream_wait_memory(sk, &timeo);
1701	if (ret)	1708	if (ret)
1702	goto out;	1709	goto out;
1703	}	1710	}
1704		1711
1705	if (copied)	1712	if (copied)
1706	mptcp_push_pending(sk, msg->msg_flags);	1713	__mptcp_push_pending(sk, msg->msg_flags);
1707		1714
1708	out:	1715	out:
1709	release_sock(sk);	1716	release_sock(sk);
@@ -2115,6 +2122,14 @@ static struct sock mptcp_subflow_get_retrans(const struct mptcp_sock msk) · 405 unmodified lines
2115	return backup;	2122	return backup;
2116	}	2123	}
2117		2124
		2125	static void mptcp_dispose_initial_subflow(struct mptcp_sock *msk)
		2126	{
		2127	if (msk->subflow) {
		2128	iput(SOCK_INODE(msk->subflow));
		2129	msk->subflow = NULL;
		2130	}
		2131	}
		2132
2118	/* subflow sockets can be either outgoing (connect) or incoming	2133	/* subflow sockets can be either outgoing (connect) or incoming
2119	* (accept).	2134	* (accept).
2120	*	2135	*
@@ -2126,6 +2141,8 @@ static struct sock mptcp_subflow_get_retrans(const struct mptcp_sock msk) · 5 unmodified lines
2126	static void __mptcp_close_ssk(struct sock sk, struct sock ssk,	2141	static void __mptcp_close_ssk(struct sock sk, struct sock ssk,
2127	struct mptcp_subflow_context *subflow)	2142	struct mptcp_subflow_context *subflow)
2128	{	2143	{
		2144	struct mptcp_sock *msk = mptcp_sk(sk);
		2145
2129	list_del(&subflow->node);	2146	list_del(&subflow->node);
2130		2147
2131	lock_sock_nested(ssk, SINGLE_DEPTH_NESTING);	2148	lock_sock_nested(ssk, SINGLE_DEPTH_NESTING);
@@ -2154,6 +2171,18 @@ static void __mptcp_close_ssk(struct sock sk, struct sock ssk, · 22 unmodified lines
2154	release_sock(ssk);	2171	release_sock(ssk);
2155		2172
2156	sock_put(ssk);	2173	sock_put(ssk);
		2174
		2175	if (ssk == msk->last_snd)
		2176	msk->last_snd = NULL;
		2177
		2178	if (ssk == msk->ack_hint)
		2179	msk->ack_hint = NULL;
		2180
		2181	if (ssk == msk->first)
		2182	msk->first = NULL;
		2183
		2184	if (msk->subflow && ssk == msk->subflow->sk)
		2185	mptcp_dispose_initial_subflow(msk);
2157	}	2186	}
2158		2187
2159	void mptcp_close_ssk(struct sock sk, struct sock ssk,	2188	void mptcp_close_ssk(struct sock sk, struct sock ssk,
@@ -2238,14 +2267,58 @@ static void mptcp_check_fastclose(struct mptcp_sock *msk) · 78 unmodified lines
2238	mptcp_close_wake_up(sk);	2267	mptcp_close_wake_up(sk);
2239	}	2268	}
2240		2269
2241	static void mptcp_worker(struct work_struct *work)	2270	static void __mptcp_retrans(struct sock *sk)
2242	{	2271	{
2243	struct mptcp_sock *msk = container_of(work, struct mptcp_sock, work);	2272	struct mptcp_sock *msk = mptcp_sk(sk);
2244	struct sock ssk, sk = &msk->sk.icsk_inet.sk;
2245	struct mptcp_sendmsg_info info = {};	2273	struct mptcp_sendmsg_info info = {};
2246	struct mptcp_data_frag *dfrag;	2274	struct mptcp_data_frag *dfrag;
2247	size_t copied = 0;	2275	size_t copied = 0;
2248	int state, ret;	2276	struct sock *ssk;
		2277	int ret;
		2278
		2279	__mptcp_clean_una_wakeup(sk);
		2280	dfrag = mptcp_rtx_head(sk);
		2281	if (!dfrag)
		2282	return;
		2283
		2284	ssk = mptcp_subflow_get_retrans(msk);
		2285	if (!ssk)
		2286	goto reset_timer;
		2287
		2288	lock_sock(ssk);
		2289
		2290	/* limit retransmission to the bytes already sent on some subflows */
		2291	info.sent = 0;
		2292	info.limit = dfrag->already_sent;
		2293	while (info.sent < dfrag->already_sent) {
		2294	if (!mptcp_alloc_tx_skb(sk, ssk))
		2295	break;
		2296
		2297	ret = mptcp_sendmsg_frag(sk, ssk, dfrag, &info);
		2298	if (ret <= 0)
		2299	break;
		2300
		2301	MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_RETRANSSEGS);
		2302	copied += ret;
		2303	info.sent += ret;
		2304	}
		2305	if (copied)
		2306	tcp_push(ssk, 0, info.mss_now, tcp_sk(ssk)->nonagle,
		2307	info.size_goal);
		2308
		2309	mptcp_set_timeout(sk, ssk);
		2310	release_sock(ssk);
		2311
		2312	reset_timer:
		2313	if (!mptcp_timer_pending(sk))
		2314	mptcp_reset_timer(sk);
		2315	}
		2316
		2317	static void mptcp_worker(struct work_struct *work)
		2318	{
		2319	struct mptcp_sock *msk = container_of(work, struct mptcp_sock, work);
		2320	struct sock *sk = &msk->sk.icsk_inet.sk;
		2321	int state;
2249		2322
2250	lock_sock(sk);	2323	lock_sock(sk);
2251	state = sk->sk_state;	2324	state = sk->sk_state;
@@ -2280,45 +2353,8 @@ static void mptcp_worker(struct work_struct *work) · 28 unmodified lines
2280	if (test_and_clear_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags))	2353	if (test_and_clear_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags))
2281	__mptcp_close_subflow(msk);	2354	__mptcp_close_subflow(msk);
2282		2355
2283	if (!test_and_clear_bit(MPTCP_WORK_RTX, &msk->flags))	2356	if (test_and_clear_bit(MPTCP_WORK_RTX, &msk->flags))
2284	goto unlock;	2357	__mptcp_retrans(sk);
2285
2286	__mptcp_clean_una(sk);
2287	dfrag = mptcp_rtx_head(sk);
2288	if (!dfrag)
2289	goto unlock;
2290
2291	ssk = mptcp_subflow_get_retrans(msk);
2292	if (!ssk)
2293	goto reset_unlock;
2294
2295	lock_sock(ssk);
2296
2297	/* limit retransmission to the bytes already sent on some subflows */
2298	info.sent = 0;
2299	info.limit = dfrag->already_sent;
2300	while (info.sent < dfrag->already_sent) {
2301	if (!mptcp_alloc_tx_skb(sk, ssk))
2302	break;
2303
2304	ret = mptcp_sendmsg_frag(sk, ssk, dfrag, &info);
2305	if (ret <= 0)
2306	break;
2307
2308	MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_RETRANSSEGS);
2309	copied += ret;
2310	info.sent += ret;
2311	}
2312	if (copied)
2313	tcp_push(ssk, 0, info.mss_now, tcp_sk(ssk)->nonagle,
2314	info.size_goal);
2315
2316	mptcp_set_timeout(sk, ssk);
2317	release_sock(ssk);
2318
2319	reset_unlock:
2320	if (!mptcp_timer_pending(sk))
2321	mptcp_reset_timer(sk);
2322		2358
2323	unlock:	2359	unlock:
2324	release_sock(sk);	2360	release_sock(sk);
@@ -2523,12 +2559,6 @@ static void __mptcp_destroy_sock(struct sock *sk) · 198 unmodified lines
2523		2559
2524	might_sleep();	2560	might_sleep();
2525		2561
2526	/* dispose the ancillatory tcp socket, if any */
2527	if (msk->subflow) {
2528	iput(SOCK_INODE(msk->subflow));
2529	msk->subflow = NULL;
2530	}
2531
2532	/* be sure to always acquire the join list lock, to sync vs	2562	/* be sure to always acquire the join list lock, to sync vs
2533	* mptcp_finish_join().	2563	* mptcp_finish_join().
2534	*/	2564	*/
@@ -2553,6 +2583,7 @@ static void __mptcp_destroy_sock(struct sock *sk) · 18 unmodified lines
2553	sk_stream_kill_queues(sk);	2583	sk_stream_kill_queues(sk);
2554	xfrm_sk_free_policy(sk);	2584	xfrm_sk_free_policy(sk);
2555	sk_refcnt_debug_release(sk);	2585	sk_refcnt_debug_release(sk);
		2586	mptcp_dispose_initial_subflow(msk);
2556	sock_put(sk);	2587	sock_put(sk);
2557	}	2588	}
2558		2589
@@ -2934,13 +2965,14 @@ static void mptcp_release_cb(struct sock *sk) · 375 unmodified lines
2934	{	2965	{
2935	unsigned long flags, nflags;	2966	unsigned long flags, nflags;
2936		2967
2937	/* push_pending may touch wmem_reserved, do it before the later	2968	for (;;) {
2938	* cleanup	2969	flags = 0;
2939	*/	2970	if (test_and_clear_bit(MPTCP_PUSH_PENDING, &mptcp_sk(sk)->flags))
2940	if (test_and_clear_bit(MPTCP_CLEAN_UNA, &mptcp_sk(sk)->flags))	2971	flags \|= MPTCP_PUSH_PENDING;
2941	__mptcp_clean_una(sk);	2972	if (!flags)
2942	if (test_and_clear_bit(MPTCP_PUSH_PENDING, &mptcp_sk(sk)->flags)) {	2973	break;
2943	/* mptcp_push_pending() acquires the subflow socket lock	2974
		2975	/* the following actions acquire the subflow socket lock
2944	*	2976	*
2945	* 1) can't be invoked in atomic scope	2977	* 1) can't be invoked in atomic scope
2946	* 2) must avoid ABBA deadlock with msk socket spinlock: the RX	2978	* 2) must avoid ABBA deadlock with msk socket spinlock: the RX
@@ -2949,13 +2981,21 @@ static void mptcp_release_cb(struct sock *sk) · 2 unmodified lines
2949	*/	2981	*/
2950		2982
2951	spin_unlock_bh(&sk->sk_lock.slock);	2983	spin_unlock_bh(&sk->sk_lock.slock);
2952	mptcp_push_pending(sk, 0);	2984	if (flags & MPTCP_PUSH_PENDING)
		2985	__mptcp_push_pending(sk, 0);
		2986
		2987	cond_resched();
2953	spin_lock_bh(&sk->sk_lock.slock);	2988	spin_lock_bh(&sk->sk_lock.slock);
2954	}	2989	}
		2990
		2991	if (test_and_clear_bit(MPTCP_CLEAN_UNA, &mptcp_sk(sk)->flags))
		2992	__mptcp_clean_una_wakeup(sk);
2955	if (test_and_clear_bit(MPTCP_ERROR_REPORT, &mptcp_sk(sk)->flags))	2993	if (test_and_clear_bit(MPTCP_ERROR_REPORT, &mptcp_sk(sk)->flags))
2956	__mptcp_error_report(sk);	2994	__mptcp_error_report(sk);
2957		2995
2958	/* clear any wmem reservation and errors */	2996	/* push_pending may touch wmem_reserved, ensure we do the cleanup
		2997	* later
		2998	*/
2959	__mptcp_update_wmem(sk);	2999	__mptcp_update_wmem(sk);
2960	__mptcp_update_rmem(sk);	3000	__mptcp_update_rmem(sk);
2961		3001
@@ -3285,6 +3325,9 @@ static int mptcp_stream_accept(struct socket sock, struct socket newsock, · 323 unmodified lines
3285	/* PM/worker can now acquire the first subflow socket	3325	/* PM/worker can now acquire the first subflow socket
3286	* lock without racing with listener queue cleanup,	3326	* lock without racing with listener queue cleanup,
3287	* we can notify it, if needed.	3327	* we can notify it, if needed.
		3328	*
		3329	* Even if remote has reset the initial subflow by now
		3330	* the refcnt is still at least one.
3288	*/	3331	*/
3289	subflow = mptcp_subflow_ctx(msk->first);	3332	subflow = mptcp_subflow_ctx(msk->first);
3290	list_add(&subflow->node, &msk->conn_list);	3333	list_add(&subflow->node, &msk->conn_list);

net/mptcp/protocol.h+8−6

 #define TCPOLEN_MPTCP_DSS_MAP64		14
 #define TCPOLEN_MPTCP_DSS_CHECKSUM	2
 #define TCPOLEN_MPTCP_ADD_ADDR		16
-#define TCPOLEN_MPTCP_ADD_ADDR_PORT	20
+#define TCPOLEN_MPTCP_ADD_ADDR_PORT	18
 #define TCPOLEN_MPTCP_ADD_ADDR_BASE	8
-#define TCPOLEN_MPTCP_ADD_ADDR_BASE_PORT	12
+#define TCPOLEN_MPTCP_ADD_ADDR_BASE_PORT	10
 #define TCPOLEN_MPTCP_ADD_ADDR6		28
-#define TCPOLEN_MPTCP_ADD_ADDR6_PORT	32
+#define TCPOLEN_MPTCP_ADD_ADDR6_PORT	30
 #define TCPOLEN_MPTCP_ADD_ADDR6_BASE	20
-#define TCPOLEN_MPTCP_ADD_ADDR6_BASE_PORT	24
+#define TCPOLEN_MPTCP_ADD_ADDR6_BASE_PORT	22
-#define TCPOLEN_MPTCP_PORT_LEN		4
+#define TCPOLEN_MPTCP_PORT_LEN		2
+#define TCPOLEN_MPTCP_PORT_ALIGN	2
 #define TCPOLEN_MPTCP_RM_ADDR_BASE	4
 #define TCPOLEN_MPTCP_PRIO		3
 #define TCPOLEN_MPTCP_PRIO_ALIGN	4
 		len = TCPOLEN_MPTCP_ADD_ADDR6_BASE;
 	if (!echo)
 		len += MPTCPOPT_THMAC_LEN;
+	/* account for 2 trailing 'nop' options */
 	if (port)
-		len += TCPOLEN_MPTCP_PORT_LEN;
+		len += TCPOLEN_MPTCP_PORT_LEN + TCPOLEN_MPTCP_PORT_ALIGN;
 	return len;
 }

net/mptcp/subflow.c+8−6

 			/* move the msk reference ownership to the subflow */
 			subflow_req->msk = NULL;
 			ctx->conn = (struct sock *)owner;
-			if (!mptcp_finish_join(child))
-				goto dispose_child;
-			SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINACKRX);
-			tcp_rsk(req)->drop_req = true;
 			if (subflow_use_different_sport(owner, sk)) {
 				pr_debug("ack inet_sport=%d %d",
 					 ntohs(inet_sk((struct sock *)owner)->inet_sport));
 				if (!mptcp_pm_sport_in_anno_list(owner, sk)) {
 					SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MISMATCHPORTACKRX);
-					goto out;
+					goto dispose_child;
 				}
 				SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINPORTACKRX);
 			}
+			if (!mptcp_finish_join(child))
+				goto dispose_child;
+			SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINACKRX);
+			tcp_rsk(req)->drop_req = true;
 		}
 	}
 	spin_lock_bh(&msk->join_list_lock);
 	list_del(&subflow->node);
 	spin_unlock_bh(&msk->join_list_lock);
+	sock_put(mptcp_subflow_tcp_sock(subflow));
 failed:
 	subflow->disposable = 1;

net/netfilter/nf_conntrack_helper.c+1−2

@@ -219,7 +219,7 @@ nf_ct_lookup_helper(struct nf_conn ct, struct net net) · 218 unmodified lines
219	return NULL;	219	return NULL;
220	pr_info("nf_conntrack: default automatic helper assignment "	220	pr_info("nf_conntrack: default automatic helper assignment "
221	"has been turned off for security reasons and CT-based "	221	"has been turned off for security reasons and CT-based "
222	" firewall rule not found. Use the iptables CT target "	222	"firewall rule not found. Use the iptables CT target "
223	"to attach helpers instead.\n");	223	"to attach helpers instead.\n");
224	net->ct.auto_assign_helper_warned = 1;	224	net->ct.auto_assign_helper_warned = 1;
225	return NULL;	225	return NULL;
@@ -228,7 +228,6 @@ nf_ct_lookup_helper(struct nf_conn ct, struct net net) · 2 unmodified lines
228	return __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);	228	return __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
229	}	229	}
230		230
231
232	int __nf_ct_try_assign_helper(struct nf_conn ct, struct nf_conn tmpl,	231	int __nf_ct_try_assign_helper(struct nf_conn ct, struct nf_conn tmpl,
233	gfp_t flags)	232	gfp_t flags)
234	{	233	{

net/netfilter/nf_conntrack_proto_tcp.c+4−2

 					IP_CT_EXP_CHALLENGE_ACK;
 		}
 		spin_unlock_bh(&ct->lock);
-		nf_ct_l4proto_log_invalid(skb, ct, "invalid packet ignored in "
+		nf_ct_l4proto_log_invalid(skb, ct,
-					  "state %s ", tcp_conntrack_names[old_state]);
+					  "packet (index %d) in dir %d ignored, state %s",
+					  index, dir,
+					  tcp_conntrack_names[old_state]);
 		return NF_ACCEPT;
 	case TCP_CONNTRACK_MAX:
 		/* Special case for SYN proxy: when the SYN to the server or

net/netfilter/nf_nat_proto.c+21−4

 }
 static unsigned int
-nf_nat_ipv4_in(void *priv, struct sk_buff *skb,
+nf_nat_ipv4_pre_routing(void *priv, struct sk_buff *skb,
-	       const struct nf_hook_state *state)
+			const struct nf_hook_state *state)
 {
 	unsigned int ret;
 	__be32 daddr = ip_hdr(skb)->daddr;
 	return ret;
 }
+static unsigned int
+nf_nat_ipv4_local_in(void *priv, struct sk_buff *skb,
+		     const struct nf_hook_state *state)
+{
+	__be32 saddr = ip_hdr(skb)->saddr;
+	struct sock *sk = skb->sk;
+	unsigned int ret;
+	ret = nf_nat_ipv4_fn(priv, skb, state);
+	if (ret == NF_ACCEPT && sk && saddr != ip_hdr(skb)->saddr &&
+	    !inet_sk_transparent(sk))
+		skb_orphan(skb); /* TCP edemux obtained wrong socket */
+	return ret;
+}
 static unsigned int
 nf_nat_ipv4_out(void *priv, struct sk_buff *skb,
 		const struct nf_hook_state *state)
 static const struct nf_hook_ops nf_nat_ipv4_ops[] = {
 	/* Before packet filtering, change destination */
 	{
-		.hook		= nf_nat_ipv4_in,
+		.hook		= nf_nat_ipv4_pre_routing,
 		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_PRE_ROUTING,
 		.priority	= NF_IP_PRI_NAT_DST,
 	},
 	/* After packet filtering, change source */
 	{
-		.hook		= nf_nat_ipv4_fn,
+		.hook		= nf_nat_ipv4_local_in,
 		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_LOCAL_IN,
 		.priority	= NF_IP_PRI_NAT_SRC,

net/netfilter/nf_tables_api.c+14−5

 	if (flags == ctx->table->flags)
 		return 0;
+	if ((nft_table_has_owner(ctx->table) &&
+	     !(flags & NFT_TABLE_F_OWNER)) ||
+	    (!nft_table_has_owner(ctx->table) &&
+	     flags & NFT_TABLE_F_OWNER))
+		return -EOPNOTSUPP;
 	trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
 				sizeof(struct nft_trans_table));
 	if (trans == NULL)
 {
 	struct nft_table *table;
-	list_for_each_entry(table, &net->nft.tables, list)
+	list_for_each_entry(table, &net->nft.tables, list) {
+		if (nft_table_has_owner(table))
+			continue;
 		__nft_release_hook(net, table);
+	}
 }
 static void __nft_release_table(struct net *net, struct nft_table *table)
 	nf_tables_table_destroy(&ctx);
 }
-static void __nft_release_tables(struct net *net, u32 nlpid)
+static void __nft_release_tables(struct net *net)
 {
 	struct nft_table *table, *nt;
 	list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
-		if (nft_table_has_owner(table) &&
+		if (nft_table_has_owner(table))
-		    nlpid != table->nlpid)
 			continue;
 		__nft_release_table(net, table);
 	mutex_lock(&net->nft.commit_mutex);
 	if (!list_empty(&net->nft.commit_list))
 		__nf_tables_abort(net, NFNL_ABORT_NONE);
-	__nft_release_tables(net, 0);
+	__nft_release_tables(net);
 	mutex_unlock(&net->nft.commit_mutex);
 	WARN_ON_ONCE(!list_empty(&net->nft.tables));
 	WARN_ON_ONCE(!list_empty(&net->nft.module_list));

net/netfilter/x_tables.c+4−2

 	const struct xt_match *m;
 	int have_rev = 0;
+	mutex_lock(&xt[af].mutex);
 	list_for_each_entry(m, &xt[af].match, list) {
 		if (strcmp(m->name, name) == 0) {
 			if (m->revision > *bestp)
 				have_rev = 1;
 		}
 	}
+	mutex_unlock(&xt[af].mutex);
 	if (af != NFPROTO_UNSPEC && !have_rev)
 		return match_revfn(NFPROTO_UNSPEC, name, revision, bestp);
 	const struct xt_target *t;
 	int have_rev = 0;
+	mutex_lock(&xt[af].mutex);
 	list_for_each_entry(t, &xt[af].target, list) {
 		if (strcmp(t->name, name) == 0) {
 			if (t->revision > *bestp)
 				have_rev = 1;
 		}
 	}
+	mutex_unlock(&xt[af].mutex);
 	if (af != NFPROTO_UNSPEC && !have_rev)
 		return target_revfn(NFPROTO_UNSPEC, name, revision, bestp);
 {
 	int have_rev, best = -1;
-	mutex_lock(&xt[af].mutex);
 	if (target == 1)
 		have_rev = target_revfn(af, name, revision, &best);
 	else
 		have_rev = match_revfn(af, name, revision, &best);
-	mutex_unlock(&xt[af].mutex);
 	/* Nothing at all?  Return 0 to try loading module. */
 	if (best == -1) {

net/netlabel/netlabel_cipso_v4.c+3−0

 		break;
 	}
+	cipso_v4_doi_putdef(doi_def);
 	rcu_read_unlock();
 	genlmsg_end(ans_skb, data);
 list_retry:
 	/* XXX - this limit is a guesstimate */
 	if (nlsze_mult < 4) {
+		cipso_v4_doi_putdef(doi_def);
 		rcu_read_unlock();
 		kfree_skb(ans_skb);
 		nlsze_mult *= 2;
 		goto list_start;
 	}
 list_failure_lock:
+	cipso_v4_doi_putdef(doi_def);
 	rcu_read_unlock();
 list_failure:
 	kfree_skb(ans_skb);

net/qrtr/qrtr.c+4−2

 	if (len == 0 || len & 3)
 		return -EINVAL;
-	skb = netdev_alloc_skb(NULL, len);
+	skb = __netdev_alloc_skb(NULL, len, GFP_ATOMIC | __GFP_NOWARN);
 	if (!skb)
 		return -ENOMEM;
 	plen = (len + 3) & ~3;
 	skb = sock_alloc_send_skb(sk, plen + QRTR_HDR_MAX_SIZE,
 				  msg->msg_flags & MSG_DONTWAIT, &rc);
-	if (!skb)
+	if (!skb) {
+		rc = -ENOMEM;
 		goto out_node;
+	}
 	skb_reserve(skb, QRTR_HDR_MAX_SIZE);

net/sched/sch_api.c+4−4

@@ -2168,7 +2168,7 @@ static int tc_dump_tclass_qdisc(struct Qdisc q, struct sk_buff skb, · 2167 unmodified lines
2168		2168
2169	static int tc_dump_tclass_root(struct Qdisc root, struct sk_buff skb,	2169	static int tc_dump_tclass_root(struct Qdisc root, struct sk_buff skb,
2170	struct tcmsg tcm, struct netlink_callback cb,	2170	struct tcmsg tcm, struct netlink_callback cb,
2171	int *t_p, int s_t)	2171	int *t_p, int s_t, bool recur)
2172	{	2172	{
2173	struct Qdisc *q;	2173	struct Qdisc *q;
2174	int b;	2174	int b;
@@ -2179,7 +2179,7 @@ static int tc_dump_tclass_root(struct Qdisc root, struct sk_buff skb, · 4 unmodified lines
2179	if (tc_dump_tclass_qdisc(root, skb, tcm, cb, t_p, s_t) < 0)	2179	if (tc_dump_tclass_qdisc(root, skb, tcm, cb, t_p, s_t) < 0)
2180	return -1;	2180	return -1;
2181		2181
2182	if (!qdisc_dev(root))	2182	if (!qdisc_dev(root) \|\| !recur)
2183	return 0;	2183	return 0;
2184		2184
2185	if (tcm->tcm_parent) {	2185	if (tcm->tcm_parent) {
@@ -2214,13 +2214,13 @@ static int tc_dump_tclass(struct sk_buff skb, struct netlink_callback cb) · 28 unmodified lines
2214	s_t = cb->args[0];	2214	s_t = cb->args[0];
2215	t = 0;	2215	t = 0;
2216		2216
2217	if (tc_dump_tclass_root(dev->qdisc, skb, tcm, cb, &t, s_t) < 0)	2217	if (tc_dump_tclass_root(dev->qdisc, skb, tcm, cb, &t, s_t, true) < 0)
2218	goto done;	2218	goto done;
2219		2219
2220	dev_queue = dev_ingress_queue(dev);	2220	dev_queue = dev_ingress_queue(dev);
2221	if (dev_queue &&	2221	if (dev_queue &&
2222	tc_dump_tclass_root(dev_queue->qdisc_sleeping, skb, tcm, cb,	2222	tc_dump_tclass_root(dev_queue->qdisc_sleeping, skb, tcm, cb,
2223	&t, s_t) < 0)	2223	&t, s_t, false) < 0)
2224	goto done;	2224	goto done;
2225		2225
2226	done:	2226	done:

net/sctp/tsnmap.c+1−1

@@ -75,7 +75,7 @@ int sctp_tsnmap_check(const struct sctp_tsnmap *map, __u32 tsn) · 74 unmodified lines
75	return 1;	75	return 1;
76		76
77	/* Verify that we can hold this TSN and that it will not	77	/* Verify that we can hold this TSN and that it will not
78	* overlfow our map	78	* overflow our map
79	*/	79	*/
80	if (!TSN_lt(tsn, map->base_tsn + SCTP_TSN_MAP_SIZE))	80	if (!TSN_lt(tsn, map->base_tsn + SCTP_TSN_MAP_SIZE))
81	return -1;	81	return -1;

net/sunrpc/auth_gss/svcauth_gss.c+7−4

@@ -1825,11 +1825,14 @@ static int · 1824 unmodified lines
1825	svcauth_gss_release(struct svc_rqst *rqstp)	1825	svcauth_gss_release(struct svc_rqst *rqstp)
1826	{	1826	{
1827	struct gss_svc_data gsd = (struct gss_svc_data )rqstp->rq_auth_data;	1827	struct gss_svc_data gsd = (struct gss_svc_data )rqstp->rq_auth_data;
1828	struct rpc_gss_wire_cred *gc = &gsd->clcred;	1828	struct rpc_gss_wire_cred *gc;
1829	struct xdr_buf *resbuf = &rqstp->rq_res;	1829	struct xdr_buf *resbuf = &rqstp->rq_res;
1830	int stat = -EINVAL;	1830	int stat = -EINVAL;
1831	struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);	1831	struct sunrpc_net *sn = net_generic(SVC_NET(rqstp), sunrpc_net_id);
1832		1832
		1833	if (!gsd)
		1834	goto out;
		1835	gc = &gsd->clcred;
1833	if (gc->gc_proc != RPC_GSS_PROC_DATA)	1836	if (gc->gc_proc != RPC_GSS_PROC_DATA)
1834	goto out;	1837	goto out;
1835	/* Release can be called twice, but we only wrap once. */	1838	/* Release can be called twice, but we only wrap once. */
@@ -1870,10 +1873,10 @@ out_err: · 34 unmodified lines
1870	if (rqstp->rq_cred.cr_group_info)	1873	if (rqstp->rq_cred.cr_group_info)
1871	put_group_info(rqstp->rq_cred.cr_group_info);	1874	put_group_info(rqstp->rq_cred.cr_group_info);
1872	rqstp->rq_cred.cr_group_info = NULL;	1875	rqstp->rq_cred.cr_group_info = NULL;
1873	if (gsd->rsci)	1876	if (gsd && gsd->rsci) {
1874	cache_put(&gsd->rsci->h, sn->rsc_cache);	1877	cache_put(&gsd->rsci->h, sn->rsc_cache);
1875	gsd->rsci = NULL;	1878	gsd->rsci = NULL;
1876		1879	}
1877	return stat;	1880	return stat;
1878	}	1881	}
1879		1882

net/sunrpc/sched.c+4−1

 	rpc_set_active(task);
 	rpc_make_runnable(rpciod_workqueue, task);
-	if (!is_async)
+	if (!is_async) {
+		unsigned int pflags = memalloc_nofs_save();
 		__rpc_execute(task);
+		memalloc_nofs_restore(pflags);
+	}
 }
 static void rpc_async_schedule(struct work_struct *work)

net/sunrpc/svc.c+4−2

  sendit:
 	if (svc_authorise(rqstp))
-		goto close;
+		goto close_xprt;
 	return 1;		/* Caller can now send it */
 release_dropit:
 	return 0;
  close:
+	svc_authorise(rqstp);
+close_xprt:
 	if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
 		svc_close_xprt(rqstp->rq_xprt);
 	dprintk("svc: svc_process close\n");
 err_short_len:
 	svc_printk(rqstp, "short len %zd, dropping request\n",
 			argv->iov_len);
-	goto close;
+	goto close_xprt;
 err_bad_rpc:
 	serv->sv_stats->rpcbadfmt++;

net/sunrpc/svc_xprt.c+2−2

@@ -1060,7 +1060,7 @@ static int svc_close_list(struct svc_serv serv, struct list_head xprt_list, st · 1059 unmodified lines
1060	struct svc_xprt *xprt;	1060	struct svc_xprt *xprt;
1061	int ret = 0;	1061	int ret = 0;
1062		1062
1063	spin_lock(&serv->sv_lock);	1063	spin_lock_bh(&serv->sv_lock);
1064	list_for_each_entry(xprt, xprt_list, xpt_list) {	1064	list_for_each_entry(xprt, xprt_list, xpt_list) {
1065	if (xprt->xpt_net != net)	1065	if (xprt->xpt_net != net)
1066	continue;	1066	continue;
@@ -1068,7 +1068,7 @@ static int svc_close_list(struct svc_serv serv, struct list_head xprt_list, st · 1 unmodified line
1068	set_bit(XPT_CLOSE, &xprt->xpt_flags);	1068	set_bit(XPT_CLOSE, &xprt->xpt_flags);
1069	svc_xprt_enqueue(xprt);	1069	svc_xprt_enqueue(xprt);
1070	}	1070	}
1071	spin_unlock(&serv->sv_lock);	1071	spin_unlock_bh(&serv->sv_lock);
1072	return ret;	1072	return ret;
1073	}	1073	}
1074		1074

net/sunrpc/xprtrdma/svc_rdma_backchannel.c+3−3

@@ -252,9 +252,9 @@ xprt_setup_rdma_bc(struct xprt_create *args) · 251 unmodified lines
252	xprt->timeout = &xprt_rdma_bc_timeout;	252	xprt->timeout = &xprt_rdma_bc_timeout;
253	xprt_set_bound(xprt);	253	xprt_set_bound(xprt);
254	xprt_set_connected(xprt);	254	xprt_set_connected(xprt);
255	xprt->bind_timeout = RPCRDMA_BIND_TO;	255	xprt->bind_timeout = 0;
256	xprt->reestablish_timeout = RPCRDMA_INIT_REEST_TO;	256	xprt->reestablish_timeout = 0;
257	xprt->idle_timeout = RPCRDMA_IDLE_DISC_TO;	257	xprt->idle_timeout = 0;
258		258
259	xprt->prot = XPRT_TRANSPORT_BC_RDMA;	259	xprt->prot = XPRT_TRANSPORT_BC_RDMA;
260	xprt->ops = &xprt_rdma_bc_procs;	260	xprt->ops = &xprt_rdma_bc_procs;

net/sunrpc/xprtrdma/svc_rdma_recvfrom.c+39−43

 		svc_rdma_recv_ctxt_put(rdma, ctxt);
 }
-static bool svc_rdma_refresh_recvs(struct svcxprt_rdma *rdma,
+static int __svc_rdma_post_recv(struct svcxprt_rdma *rdma,
-				   unsigned int wanted, bool temp)
+				struct svc_rdma_recv_ctxt *ctxt)
 {
-	const struct ib_recv_wr *bad_wr = NULL;
-	struct svc_rdma_recv_ctxt *ctxt;
-	struct ib_recv_wr *recv_chain;
 	int ret;
-	recv_chain = NULL;
+	trace_svcrdma_post_recv(ctxt);
-	while (wanted--) {
+	ret = ib_post_recv(rdma->sc_qp, &ctxt->rc_recv_wr, NULL);
-		ctxt = svc_rdma_recv_ctxt_get(rdma);
-		if (!ctxt)
-			break;
-		trace_svcrdma_post_recv(ctxt);
-		ctxt->rc_temp = temp;
-		ctxt->rc_recv_wr.next = recv_chain;
-		recv_chain = &ctxt->rc_recv_wr;
-		rdma->sc_pending_recvs++;
-	}
-	if (!recv_chain)
-		return false;
-	ret = ib_post_recv(rdma->sc_qp, recv_chain, &bad_wr);
 	if (ret)
 		goto err_post;
-	return true;
+	return 0;
 err_post:
-	while (bad_wr) {
-		ctxt = container_of(bad_wr, struct svc_rdma_recv_ctxt,
-				    rc_recv_wr);
-		bad_wr = bad_wr->next;
-		svc_rdma_recv_ctxt_put(rdma, ctxt);
-	}
 	trace_svcrdma_rq_post_err(rdma, ret);
-	/* Since we're destroying the xprt, no need to reset
+	svc_rdma_recv_ctxt_put(rdma, ctxt);
-	 * sc_pending_recvs. */
+	return ret;
-	return false;
+}
+static int svc_rdma_post_recv(struct svcxprt_rdma *rdma)
+{
+	struct svc_rdma_recv_ctxt *ctxt;
+	if (test_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags))
+		return 0;
+	ctxt = svc_rdma_recv_ctxt_get(rdma);
+	if (!ctxt)
+		return -ENOMEM;
+	return __svc_rdma_post_recv(rdma, ctxt);
 }
 /**
  */
 bool svc_rdma_post_recvs(struct svcxprt_rdma *rdma)
 {
-	return svc_rdma_refresh_recvs(rdma, rdma->sc_max_requests, true);
+	struct svc_rdma_recv_ctxt *ctxt;
+	unsigned int i;
+	int ret;
+	for (i = 0; i < rdma->sc_max_requests; i++) {
+		ctxt = svc_rdma_recv_ctxt_get(rdma);
+		if (!ctxt)
+			return false;
+		ctxt->rc_temp = true;
+		ret = __svc_rdma_post_recv(rdma, ctxt);
+		if (ret)
+			return false;
+	}
+	return true;
 }
 /**
  * @cq: Completion Queue context
  * @wc: Work Completion object
  *
+ * NB: The svc_xprt/svcxprt_rdma is pinned whenever it's possible that
+ * the Receive completion handler could be running.
  */
 static void svc_rdma_wc_receive(struct ib_cq *cq, struct ib_wc *wc)
 {
 	struct ib_cqe *cqe = wc->wr_cqe;
 	struct svc_rdma_recv_ctxt *ctxt;
-	rdma->sc_pending_recvs--;
 	/* WARNING: Only wc->wr_cqe and wc->status are reliable */
 	ctxt = container_of(cqe, struct svc_rdma_recv_ctxt, rc_cqe);
 	if (wc->status != IB_WC_SUCCESS)
 		goto flushed;
+	if (svc_rdma_post_recv(rdma))
+		goto post_err;
 	/* All wc fields are now known to be valid */
 	ctxt->rc_byte_len = wc->byte_len;
 	spin_unlock(&rdma->sc_rq_dto_lock);
 	if (!test_bit(RDMAXPRT_CONN_PENDING, &rdma->sc_flags))
 		svc_xprt_enqueue(&rdma->sc_xprt);
-	if (!test_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags) &&
-	    rdma->sc_pending_recvs < rdma->sc_max_requests)
-		if (!svc_rdma_refresh_recvs(rdma, RPCRDMA_MAX_RECV_BATCH,
-					    false))
-			goto post_err;
 	return;
 flushed:
-	svc_rdma_recv_ctxt_put(rdma, ctxt);
 post_err:
+	svc_rdma_recv_ctxt_put(rdma, ctxt);
 	set_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags);
 	svc_xprt_enqueue(&rdma->sc_xprt);
 }

samples/bpf/xdpsock_user.c+2−0

@@ -1699,5 +1699,7 @@ int main(int argc, char **argv) · 1698 unmodified lines
1699		1699
1700	xdpsock_cleanup();	1700	xdpsock_cleanup();
1701		1701
		1702	munmap(bufs, NUM_FRAMES * opt_xsk_frame_size);
		1703
1702	return 0;	1704	return 0;
1703	}	1705	}

scripts/Makefile.lib+2−2

@@ -327,7 +327,7 @@ $(obj)/%.dtb.S: $(obj)/%.dtb FORCE · 326 unmodified lines
327		327
328	quiet_cmd_dtc = DTC $@	328	quiet_cmd_dtc = DTC $@
329	cmd_dtc = $(HOSTCC) -E $(dtc_cpp_flags) -x assembler-with-cpp -o $(dtc-tmp) $< ; \	329	cmd_dtc = $(HOSTCC) -E $(dtc_cpp_flags) -x assembler-with-cpp -o $(dtc-tmp) $< ; \
330	$(DTC) -O $(patsubst .%,%,$(suffix $@)) -o $@ -b 0 \	330	$(DTC) -o $@ -b 0 \
331	$(addprefix -i,$(dir $<) $(DTC_INCLUDE)) $(DTC_FLAGS) \	331	$(addprefix -i,$(dir $<) $(DTC_INCLUDE)) $(DTC_FLAGS) \
332	-d $(depfile).dtc.tmp $(dtc-tmp) ; \	332	-d $(depfile).dtc.tmp $(dtc-tmp) ; \
333	cat $(depfile).pre.tmp $(depfile).dtc.tmp > $(depfile)	333	cat $(depfile).pre.tmp $(depfile).dtc.tmp > $(depfile)
@@ -352,7 +352,7 @@ define rule_dtc · 18 unmodified lines
352	endef	352	endef
353		353
354	$(obj)/%.dt.yaml: $(src)/%.dts $(DTC) $(DT_TMP_SCHEMA) FORCE	354	$(obj)/%.dt.yaml: $(src)/%.dts $(DTC) $(DT_TMP_SCHEMA) FORCE
355	$(call if_changed_rule,dtc,yaml)	355	$(call if_changed_rule,dtc)
356		356
357	dtc-tmp = $(subst $(comma),_,$(dot-target).dts.tmp)	357	dtc-tmp = $(subst $(comma),_,$(dot-target).dts.tmp)
358		358

scripts/dummy-tools/gcc+16−2

 fi
 if arg_contain -E "$@"; then
-	# For scripts/gcc-version.sh; This emulates GCC 20.0.0
+	# For scripts/cc-version.sh; This emulates GCC 20.0.0
 	if arg_contain - "$@"; then
-		sed 's/^__GNUC__$/20/; s/^__GNUC_MINOR__$/0/; s/^__GNUC_PATCHLEVEL__$/0/'
+		sed -n '/^GCC/{s/__GNUC__/20/; s/__GNUC_MINOR__/0/; s/__GNUC_PATCHLEVEL__/0/; p;}'
 		exit 0
 	else
 		echo "no input files" >&2
 		echo "%gs"
 		exit 0
 	fi
+	# For arch/powerpc/tools/gcc-check-mprofile-kernel.sh
+	if arg_contain -m64 "$@" && arg_contain -mlittle-endian "$@" &&
+		arg_contain -mprofile-kernel "$@"; then
+		if ! test -t 0 && ! grep -q notrace; then
+			echo "_mcount"
+		fi
+		exit 0
+	fi
 fi
 # To set GCC_PLUGINS
 	echo $plugin_dir
 	exit 0
 fi
+# inverted return value
+if arg_contain -D__SIZEOF_INT128__=0 "$@"; then
+	exit 1
+fi

scripts/gcc-plugins/Makefile+1−0

@@ -22,6 +22,7 @@ always-y += $(GCC_PLUGIN) · 21 unmodified lines
22	GCC_PLUGINS_DIR = $(shell $(CC) -print-file-name=plugin)	22	GCC_PLUGINS_DIR = $(shell $(CC) -print-file-name=plugin)
23		23
24	plugin_cxxflags = -Wp,-MMD,$(depfile) $(KBUILD_HOSTCXXFLAGS) -fPIC \	24	plugin_cxxflags = -Wp,-MMD,$(depfile) $(KBUILD_HOSTCXXFLAGS) -fPIC \
		25	-include $(srctree)/include/linux/compiler-version.h \
25	-I $(GCC_PLUGINS_DIR)/include -I $(obj) -std=gnu++11 \	26	-I $(GCC_PLUGINS_DIR)/include -I $(obj) -std=gnu++11 \
26	-fno-rtti -fno-exceptions -fasynchronous-unwind-tables \	27	-fno-rtti -fno-exceptions -fasynchronous-unwind-tables \
27	-ggdb -Wno-narrowing -Wno-unused-variable \	28	-ggdb -Wno-narrowing -Wno-unused-variable \

scripts/ld-version.sh+14−8

 # Get the first line of the --version output.
 IFS='
 '
-set -- $("$@" --version)
+set -- $(LC_ALL=C "$@" --version)
 # Split the line on spaces.
 IFS=' '
 elif [ "$1" = GNU -a "$2" = gold ]; then
 	echo "gold linker is not supported as it is not capable of linking the kernel proper." >&2
 	exit 1
-elif [ "$1" = LLD ]; then
-	version=$2
-	min_version=$lld_min_version
-	name=LLD
-	disp_name=LLD
 else
-	echo "$orig_args: unknown linker" >&2
+	while [ $# -gt 1 -a "$1" != "LLD" ]; do
-	exit 1
+		shift
+	done
+	if [ "$1" = LLD ]; then
+		version=$2
+		min_version=$lld_min_version
+		name=LLD
+		disp_name=LLD
+	else
+		echo "$orig_args: unknown linker" >&2
+		exit 1
+	fi
 fi
 # Some distributions append a package release number, as in 2.34-4.fc32

security/commoncap.c+1−11

 	__u32 magic, nsmagic;
 	struct inode *inode = d_backing_inode(dentry);
 	struct user_namespace *task_ns = current_user_ns(),
-		*fs_ns = inode->i_sb->s_user_ns,
+		*fs_ns = inode->i_sb->s_user_ns;
-		*ancestor;
 	kuid_t rootid;
 	size_t newsize;
 	if (nsrootid == -1)
 		return -EINVAL;
-	/*
-	 * Do not allow allow adding a v3 filesystem capability xattr
-	 * if the rootid field is ambiguous.
-	 */
-	for (ancestor = task_ns->parent; ancestor; ancestor = ancestor->parent) {
-		if (from_kuid(ancestor, rootid) == 0)
-			return -EINVAL;
-	}
 	newsize = sizeof(struct vfs_ns_cap_data);
 	nscap = kmalloc(newsize, GFP_ATOMIC);
 	if (!nscap)

sound/hda/intel-nhlt.c+5−0

 	if (!nhlt)
 		return 0;
+	if (nhlt->header.length <= sizeof(struct acpi_table_header)) {
+		dev_warn(dev, "Invalid DMIC description table\n");
+		return 0;
+	}
 	for (j = 0, epnt = nhlt->desc; j < nhlt->endpoint_count; j++,
 	     epnt = (struct nhlt_endpoint *)((u8 *)epnt + epnt->length)) {

sound/pci/hda/hda_bind.c+4−0

 	if (codec->bus->shutdown)
 		return;
+	/* ignore unsol events during system suspend/resume */
+	if (codec->core.dev.power.power_state.event != PM_EVENT_ON)
+		return;
 	if (codec->patch_ops.unsol_event)
 		codec->patch_ops.unsol_event(codec, ev);
 }

sound/pci/hda/hda_controller.c+0−7

@@ -609,13 +609,6 @@ static int azx_pcm_open(struct snd_pcm_substream *substream) · 608 unmodified lines
609	20,	609	20,
610	178000000);	610	178000000);
611		611
612	/* by some reason, the playback stream stalls on PulseAudio with
613	* tsched=1 when a capture stream triggers. Until we figure out the
614	* real cause, disable tsched mode by telling the PCM info flag.
615	*/
616	if (chip->driver_caps & AZX_DCAPS_AMD_WORKAROUND)
617	runtime->hw.info \|= SNDRV_PCM_INFO_BATCH;
618
619	if (chip->align_buffer_size)	612	if (chip->align_buffer_size)
620	/* constrain buffer sizes to be multiple of 128	613	/* constrain buffer sizes to be multiple of 128
621	bytes. This is more efficient in terms of memory	614	bytes. This is more efficient in terms of memory

sound/pci/hda/hda_intel.c+2−0

@@ -1026,6 +1026,8 @@ static int azx_prepare(struct device *dev) · 1025 unmodified lines
1026	chip = card->private_data;	1026	chip = card->private_data;
1027	chip->pm_prepared = 1;	1027	chip->pm_prepared = 1;
1028		1028
		1029	flush_work(&azx_bus(chip)->unsol_work);
		1030
1029	/* HDA controller always requires different WAKEEN for runtime suspend	1031	/* HDA controller always requires different WAKEEN for runtime suspend
1030	* and system suspend, so don't use direct-complete here.	1032	* and system suspend, so don't use direct-complete here.
1031	*/	1033	*/

sound/pci/hda/patch_ca0132.c+1−0

@@ -1309,6 +1309,7 @@ static const struct snd_pci_quirk ca0132_quirks[] = { · 1308 unmodified lines
1309	SND_PCI_QUIRK(0x1102, 0x0013, "Recon3D", QUIRK_R3D),	1309	SND_PCI_QUIRK(0x1102, 0x0013, "Recon3D", QUIRK_R3D),
1310	SND_PCI_QUIRK(0x1102, 0x0018, "Recon3D", QUIRK_R3D),	1310	SND_PCI_QUIRK(0x1102, 0x0018, "Recon3D", QUIRK_R3D),
1311	SND_PCI_QUIRK(0x1102, 0x0051, "Sound Blaster AE-5", QUIRK_AE5),	1311	SND_PCI_QUIRK(0x1102, 0x0051, "Sound Blaster AE-5", QUIRK_AE5),
		1312	SND_PCI_QUIRK(0x1102, 0x0191, "Sound Blaster AE-5 Plus", QUIRK_AE5),
1312	SND_PCI_QUIRK(0x1102, 0x0081, "Sound Blaster AE-7", QUIRK_AE7),	1313	SND_PCI_QUIRK(0x1102, 0x0081, "Sound Blaster AE-7", QUIRK_AE7),
1313	{}	1314	{}
1314	};	1315	};

sound/pci/hda/patch_conexant.c+45−17

 	return 0;
 }
+static void cxt_init_gpio_led(struct hda_codec *codec)
+{
+	struct conexant_spec *spec = codec->spec;
+	unsigned int mask = spec->gpio_mute_led_mask | spec->gpio_mic_led_mask;
+	if (mask) {
+		snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_MASK,
+				    mask);
+		snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DIRECTION,
+				    mask);
+		snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA,
+				    spec->gpio_led);
+	}
+}
 static int cx_auto_init(struct hda_codec *codec)
 {
 	struct conexant_spec *spec = codec->spec;
 	if (!spec->dynamic_eapd)
 		cx_auto_turn_eapd(codec, spec->num_eapds, spec->eapds, true);
+	cxt_init_gpio_led(codec);
 	snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_INIT);
 	return 0;
 	CXT_FIXUP_HP_SPECTRE,
 	CXT_FIXUP_HP_GATE_MIC,
 	CXT_FIXUP_MUTE_LED_GPIO,
+	CXT_FIXUP_HP_ZBOOK_MUTE_LED,
 	CXT_FIXUP_HEADSET_MIC,
 	CXT_FIXUP_HP_MIC_NO_PRESENCE,
 };
 	return 0;
 }

78 more lines aren’t shown here.

sound/pci/hda/patch_hdmi.c+13−0

This diff is large: its 27 lines aren’t shown here.

sound/usb/card.c+6−0

This diff is large: its 20 lines aren’t shown here.

sound/usb/quirks.c+10−1

This diff is large: its 32 lines aren’t shown here.

sound/usb/usbaudio.h+1−0

This diff is large: its 8 lines aren’t shown here.

tools/arch/s390/include/uapi/asm/ptrace.h+3−2

This diff is large: its 12 lines aren’t shown here.

tools/arch/x86/include/asm/cpufeatures.h+13−6

This diff is large: its 75 lines aren’t shown here.

tools/arch/x86/include/uapi/asm/kvm.h+1−0

This diff is large: its 8 lines aren’t shown here.

tools/arch/x86/include/uapi/asm/vmx.h+3−1

This diff is large: its 18 lines aren’t shown here.

tools/bpf/resolve_btfids/main.c+5−0

This diff is large: its 12 lines aren’t shown here.

tools/build/Makefile+7−1

This diff is large: its 20 lines aren’t shown here.

tools/include/linux/coresight-pmu.h+15−5

This diff is large: its 33 lines aren’t shown here.

tools/include/uapi/drm/drm.h+49−48

This diff is large: its 402 lines aren’t shown here.

tools/include/uapi/drm/i915_drm.h+2−1

This diff is large: its 11 lines aren’t shown here.

tools/include/uapi/linux/bpf.h+0−1

This diff is large: its 8 lines aren’t shown here.

tools/include/uapi/linux/kvm.h+73−0

This diff is large: its 134 lines aren’t shown here.

tools/include/uapi/linux/mount.h+16−0

This diff is large: its 29 lines aren’t shown here.

tools/include/uapi/linux/openat2.h+4−0

This diff is large: its 10 lines aren’t shown here.

tools/lib/bpf/xsk.c+3−2

This diff is large: its 19 lines aren’t shown here.

tools/lib/perf/evlist.c+9−4

This diff is large: its 30 lines aren’t shown here.

tools/lib/perf/include/internal/evlist.h+2−0

This diff is large: its 7 lines aren’t shown here.

tools/objtool/check.c+3−0

This diff is large: its 10 lines aren’t shown here.

tools/perf/Documentation/perf-evlist.txt+1−1

This diff is large: its 9 lines aren’t shown here.

tools/perf/Documentation/perf-ftrace.txt+2−2

This diff is large: its 11 lines aren’t shown here.

tools/perf/Documentation/perf-kallsyms.txt+1−1

This diff is large: its 7 lines aren’t shown here.

tools/perf/Documentation/perf-trace.txt+2−2

This diff is large: its 11 lines aren’t shown here.

tools/perf/Makefile.perf+2−10

This diff is large: its 33 lines aren’t shown here.

tools/perf/arch/arm/util/cs-etm.c+8−4

This diff is large: its 41 lines aren’t shown here.

tools/perf/arch/powerpc/entry/syscalls/syscall.tbl+6−15

This diff is large: its 59 lines aren’t shown here.

tools/perf/arch/s390/entry/syscalls/syscall.tbl+1−0

This diff is large: its 5 lines aren’t shown here.

tools/perf/arch/x86/Makefile+6−5

This diff is large: its 24 lines aren’t shown here.

tools/perf/arch/x86/entry/syscalls/syscall_64.tbl+1−0

This diff is large: its 8 lines aren’t shown here.

tools/perf/arch/x86/include/arch-tests.h+1−0

This diff is large: its 8 lines aren’t shown here.

tools/perf/arch/x86/tests/Build+1−0

This diff is large: its 7 lines aren’t shown here.

tools/perf/arch/x86/tests/arch-tests.c+4−0

This diff is large: its 11 lines aren’t shown here.

tools/perf/arch/x86/tests/insn-x86.c+1−1

This diff is large: its 13 lines aren’t shown here.

tools/perf/arch/x86/tests/sample-parsing.c+121−0

This diff is large: its 122 lines aren’t shown here.

tools/perf/arch/x86/util/archinsn.c+1−1

This diff is large: its 12 lines aren’t shown here.

tools/perf/bench/numa.c+29−13

This diff is large: its 125 lines aren’t shown here.

tools/perf/bench/sched-messaging.c+2−2

This diff is large: its 14 lines aren’t shown here.

tools/perf/bench/sched-pipe.c+2−2

This diff is large: its 18 lines aren’t shown here.

tools/perf/bench/syscall.c+2−2

This diff is large: its 18 lines aren’t shown here.

tools/perf/builtin-daemon.c+3−3

This diff is large: its 24 lines aren’t shown here.

tools/perf/builtin-diff.c+2−1

This diff is large: its 10 lines aren’t shown here.

tools/perf/builtin-trace.c+2−3

This diff is large: its 19 lines aren’t shown here.

tools/perf/perf-archive.sh+1−2

This diff is large: its 11 lines aren’t shown here.

tools/perf/tests/attr.c+7−1

This diff is large: its 22 lines aren’t shown here.

tools/perf/tests/code-reading.c+3−7

This diff is large: its 17 lines aren’t shown here.

tools/perf/tests/cpumap.c+2−0

This diff is large: its 9 lines aren’t shown here.

tools/perf/tests/keep-tracking.c+2−3

This diff is large: its 13 lines aren’t shown here.

tools/perf/tests/mmap-basic.c+0−2

This diff is large: its 9 lines aren’t shown here.

tools/perf/tests/perf-time-to-tsc.c+2−0

This diff is large: its 9 lines aren’t shown here.

tools/perf/tests/sample-parsing.c+0−4

This diff is large: its 18 lines aren’t shown here.

tools/perf/tests/shell/daemon.sh+16−16

This diff is large: its 118 lines aren’t shown here.

tools/perf/tests/sw-clock.c+4−8

This diff is large: its 39 lines aren’t shown here.

tools/perf/tests/switch-tracking.c+2−3

This diff is large: its 13 lines aren’t shown here.

tools/perf/tests/task-exit.c+3−7

This diff is large: its 37 lines aren’t shown here.

tools/perf/tests/thread-map.c+3−5

This diff is large: its 33 lines aren’t shown here.

tools/perf/util/evlist.c+1−0

This diff is large: its 8 lines aren’t shown here.

tools/perf/util/evsel.c+17−1

This diff is large: its 36 lines aren’t shown here.

tools/perf/util/evsel.h+3−1

This diff is large: its 23 lines aren’t shown here.

tools/perf/util/header.c+2−2

This diff is large: its 11 lines aren’t shown here.

tools/perf/util/map.c+3−4

This diff is large: its 21 lines aren’t shown here.

tools/perf/util/parse-events.y+5−1

This diff is large: its 21 lines aren’t shown here.

tools/perf/util/python-ext-sources+1−0

This diff is large: its 5 lines aren’t shown here.

tools/perf/util/sort.c+2−2

This diff is large: its 18 lines aren’t shown here.

tools/perf/util/stat-display.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/perf/util/stat.c+38−9

This diff is large: its 89 lines aren’t shown here.

tools/perf/util/trace-event-read.c+1−0

This diff is large: its 8 lines aren’t shown here.

tools/testing/selftests/arm64/fp/sve-ptrace.c+1−1

This diff is large: its 7 lines aren’t shown here.

tools/testing/selftests/bpf/progs/netif_receive_skb.c+10−3

This diff is large: its 29 lines aren’t shown here.

tools/testing/selftests/bpf/progs/test_global_func11.c+1−1

This diff is large: its 7 lines aren’t shown here.

tools/testing/selftests/bpf/progs/test_tunnel_kern.c+2−4

This diff is large: its 13 lines aren’t shown here.

tools/testing/selftests/bpf/verifier/array_access.c+2−1

This diff is large: its 15 lines aren’t shown here.

tools/testing/selftests/bpf/verifier/atomic_and.c+23−0

This diff is large: its 27 lines aren’t shown here.

tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c+25−0

This diff is large: its 29 lines aren’t shown here.

tools/testing/selftests/bpf/verifier/atomic_or.c+25−0

This diff is large: its 29 lines aren’t shown here.

tools/testing/selftests/gpio/.gitignore+1−1

This diff is large: its 4 lines aren’t shown here.

tools/testing/selftests/net/fib_nexthops.sh+8−0

This diff is large: its 15 lines aren’t shown here.

tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d_vlan.sh+9−0

This diff is large: its 21 lines aren’t shown here.

tools/testing/selftests/net/ipsec.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/netfilter/Makefile+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/netfilter/nf_nat_edemux.sh+99−0

This diff is large: its 100 lines aren’t shown here.

Merge branch 'locking/urgent' into locking/core, to pick up dependent commits

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code

@@ -195,7 +195,7 @@ static inline void regs_set_return_value(struct pt_regs *regs, unsigned long rc) · 194 unmodified lines
195	#define TRAP_FLAGS_MASK 0x11	195	#define TRAP_FLAGS_MASK 0x11
196	#define TRAP(regs) ((regs)->trap & ~TRAP_FLAGS_MASK)	196	#define TRAP(regs) ((regs)->trap & ~TRAP_FLAGS_MASK)
197	#define FULL_REGS(regs) (((regs)->trap & 1) == 0)	197	#define FULL_REGS(regs) (((regs)->trap & 1) == 0)
198	#define SET_FULL_REGS(regs) ((regs)->trap \|= 1)	198	#define SET_FULL_REGS(regs) ((regs)->trap &= ~1)
199	#endif	199	#endif
200	#define CHECK_FULL_REGS(regs) BUG_ON(!FULL_REGS(regs))	200	#define CHECK_FULL_REGS(regs) BUG_ON(!FULL_REGS(regs))
201	#define NV_REG_POISON 0xdeadbeefdeadbeefUL	201	#define NV_REG_POISON 0xdeadbeefdeadbeefUL
@@ -210,7 +210,7 @@ static inline void regs_set_return_value(struct pt_regs *regs, unsigned long rc) · 8 unmodified lines
210	#define TRAP_FLAGS_MASK 0x1F	210	#define TRAP_FLAGS_MASK 0x1F
211	#define TRAP(regs) ((regs)->trap & ~TRAP_FLAGS_MASK)	211	#define TRAP(regs) ((regs)->trap & ~TRAP_FLAGS_MASK)
212	#define FULL_REGS(regs) (((regs)->trap & 1) == 0)	212	#define FULL_REGS(regs) (((regs)->trap & 1) == 0)
213	#define SET_FULL_REGS(regs) ((regs)->trap \|= 1)	213	#define SET_FULL_REGS(regs) ((regs)->trap &= ~1)
214	#define IS_CRITICAL_EXC(regs) (((regs)->trap & 2) != 0)	214	#define IS_CRITICAL_EXC(regs) (((regs)->trap & 2) != 0)
215	#define IS_MCHECK_EXC(regs) (((regs)->trap & 4) != 0)	215	#define IS_MCHECK_EXC(regs) (((regs)->trap & 4) != 0)
216	#define IS_DEBUG_EXC(regs) (((regs)->trap & 8) != 0)	216	#define IS_DEBUG_EXC(regs) (((regs)->trap & 8) != 0)

@@ -229,10 +229,10 @@ static struct bio bounce_clone_bio(struct bio bio_src) · 228 unmodified lines
229	* - The point of cloning the biovec is to produce a bio with a biovec	229	* - The point of cloning the biovec is to produce a bio with a biovec
230	* the caller can modify: bi_idx and bi_bvec_done should be 0.	230	* the caller can modify: bi_idx and bi_bvec_done should be 0.
231	*	231	*
232	* - The original bio could've had more than BIO_MAX_PAGES biovecs; if	232	* - The original bio could've had more than BIO_MAX_VECS biovecs; if
233	* we tried to clone the whole thing bio_alloc_bioset() would fail.	233	* we tried to clone the whole thing bio_alloc_bioset() would fail.
234	* But the clone should succeed as long as the number of biovecs we	234	* But the clone should succeed as long as the number of biovecs we
235	* actually need to allocate is fewer than BIO_MAX_PAGES.	235	* actually need to allocate is fewer than BIO_MAX_VECS.
236	*	236	*
237	* - Lastly, bi_vcnt should not be looked at or relied upon by code	237	* - Lastly, bi_vcnt should not be looked at or relied upon by code
238	* that does not own the bio - reason being drivers don't use it for	238	* that does not own the bio - reason being drivers don't use it for
@@ -299,7 +299,7 @@ static void __blk_queue_bounce(struct request_queue q, struct bio *bio_orig, · 60 unmodified lines
299	int sectors = 0;	299	int sectors = 0;
300		300
301	bio_for_each_segment(from, *bio_orig, iter) {	301	bio_for_each_segment(from, *bio_orig, iter) {
302	if (i++ < BIO_MAX_PAGES)	302	if (i++ < BIO_MAX_VECS)
303	sectors += from.bv_len >> 9;	303	sectors += from.bv_len >> 9;
304	if (page_to_pfn(from.bv_page) > q->limits.bounce_pfn)	304	if (page_to_pfn(from.bv_page) > q->limits.bounce_pfn)
305	bounce = true;	305	bounce = true;

@@ -229,7 +229,7 @@ static DEFINE_SPINLOCK(dm_crypt_clients_lock); · 228 unmodified lines
229	static unsigned dm_crypt_clients_n = 0;	229	static unsigned dm_crypt_clients_n = 0;
230	static volatile unsigned long dm_crypt_pages_per_client;	230	static volatile unsigned long dm_crypt_pages_per_client;
231	#define DM_CRYPT_MEMORY_PERCENT 2	231	#define DM_CRYPT_MEMORY_PERCENT 2
232	#define DM_CRYPT_MIN_PAGES_PER_CLIENT (BIO_MAX_PAGES * 16)	232	#define DM_CRYPT_MIN_PAGES_PER_CLIENT (BIO_MAX_VECS * 16)
233		233
234	static void clone_init(struct dm_crypt_io , struct bio );	234	static void clone_init(struct dm_crypt_io , struct bio );
235	static void kcryptd_queue_crypt(struct dm_crypt_io *io);	235	static void kcryptd_queue_crypt(struct dm_crypt_io *io);
@@ -3246,7 +3246,7 @@ static int crypt_ctr(struct dm_target ti, unsigned int argc, char *argv) · 3010 unmodified lines
3246	ALIGN(sizeof(struct dm_crypt_io) + cc->dmreq_start + additional_req_size,	3246	ALIGN(sizeof(struct dm_crypt_io) + cc->dmreq_start + additional_req_size,
3247	ARCH_KMALLOC_MINALIGN);	3247	ARCH_KMALLOC_MINALIGN);
3248		3248
3249	ret = mempool_init(&cc->page_pool, BIO_MAX_PAGES, crypt_page_alloc, crypt_page_free, cc);	3249	ret = mempool_init(&cc->page_pool, BIO_MAX_VECS, crypt_page_alloc, crypt_page_free, cc);
3250	if (ret) {	3250	if (ret) {
3251	ti->error = "Cannot allocate page mempool";	3251	ti->error = "Cannot allocate page mempool";
3252	goto bad;	3252	goto bad;
@@ -3373,9 +3373,9 @@ static int crypt_map(struct dm_target ti, struct bio bio) · 120 unmodified lines
3373	/*	3373	/*
3374	* Check if bio is too large, split as needed.	3374	* Check if bio is too large, split as needed.
3375	*/	3375	*/
3376	if (unlikely(bio->bi_iter.bi_size > (BIO_MAX_PAGES << PAGE_SHIFT)) &&	3376	if (unlikely(bio->bi_iter.bi_size > (BIO_MAX_VECS << PAGE_SHIFT)) &&
3377	(bio_data_dir(bio) == WRITE \|\| cc->on_disk_tag_size))	3377	(bio_data_dir(bio) == WRITE \|\| cc->on_disk_tag_size))
3378	dm_accept_partial_bio(bio, ((BIO_MAX_PAGES << PAGE_SHIFT) >> SECTOR_SHIFT));	3378	dm_accept_partial_bio(bio, ((BIO_MAX_VECS << PAGE_SHIFT) >> SECTOR_SHIFT));
3379		3379
3380	/*	3380	/*
3381	* Ensure that bio is a multiple of internal sector encryption size	3381	* Ensure that bio is a multiple of internal sector encryption size

@@ -1053,16 +1053,16 @@ struct hclge_fd_tcam_config_3_cmd { · 1052 unmodified lines
1053	#define HCLGE_FD_AD_DROP_B 0	1053	#define HCLGE_FD_AD_DROP_B 0
1054	#define HCLGE_FD_AD_DIRECT_QID_B 1	1054	#define HCLGE_FD_AD_DIRECT_QID_B 1
1055	#define HCLGE_FD_AD_QID_S 2	1055	#define HCLGE_FD_AD_QID_S 2
1056	#define HCLGE_FD_AD_QID_M GENMASK(12, 2)	1056	#define HCLGE_FD_AD_QID_M GENMASK(11, 2)
1057	#define HCLGE_FD_AD_USE_COUNTER_B 12	1057	#define HCLGE_FD_AD_USE_COUNTER_B 12
1058	#define HCLGE_FD_AD_COUNTER_NUM_S 13	1058	#define HCLGE_FD_AD_COUNTER_NUM_S 13
1059	#define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(20, 13)	1059	#define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(20, 13)
1060	#define HCLGE_FD_AD_NXT_STEP_B 20	1060	#define HCLGE_FD_AD_NXT_STEP_B 20
1061	#define HCLGE_FD_AD_NXT_KEY_S 21	1061	#define HCLGE_FD_AD_NXT_KEY_S 21
1062	#define HCLGE_FD_AD_NXT_KEY_M GENMASK(26, 21)	1062	#define HCLGE_FD_AD_NXT_KEY_M GENMASK(25, 21)
1063	#define HCLGE_FD_AD_WR_RULE_ID_B 0	1063	#define HCLGE_FD_AD_WR_RULE_ID_B 0
1064	#define HCLGE_FD_AD_RULE_ID_S 1	1064	#define HCLGE_FD_AD_RULE_ID_S 1
1065	#define HCLGE_FD_AD_RULE_ID_M GENMASK(13, 1)	1065	#define HCLGE_FD_AD_RULE_ID_M GENMASK(12, 1)
1066	#define HCLGE_FD_AD_TC_OVRD_B 16	1066	#define HCLGE_FD_AD_TC_OVRD_B 16
1067	#define HCLGE_FD_AD_TC_SIZE_S 17	1067	#define HCLGE_FD_AD_TC_SIZE_S 17
1068	#define HCLGE_FD_AD_TC_SIZE_M GENMASK(20, 17)	1068	#define HCLGE_FD_AD_TC_SIZE_M GENMASK(20, 17)

@@ -257,7 +257,7 @@ struct smb_version_operations { · 256 unmodified lines
257	/* verify the message */	257	/* verify the message */
258	int (check_message)(char , unsigned int, struct TCP_Server_Info *);	258	int (check_message)(char , unsigned int, struct TCP_Server_Info *);
259	bool (is_oplock_break)(char , struct TCP_Server_Info *);	259	bool (is_oplock_break)(char , struct TCP_Server_Info *);
260	int (handle_cancelled_mid)(char , struct TCP_Server_Info *);	260	int (handle_cancelled_mid)(struct mid_q_entry , struct TCP_Server_Info *);
261	void (downgrade_oplock)(struct TCP_Server_Info server,	261	void (downgrade_oplock)(struct TCP_Server_Info server,
262	struct cifsInodeInfo *cinode, __u32 oplock,	262	struct cifsInodeInfo *cinode, __u32 oplock,
263	unsigned int epoch, bool *purge_cache);	263	unsigned int epoch, bool *purge_cache);
@@ -1705,16 +1705,17 @@ static inline bool is_retryable_error(int error) · 1441 unmodified lines
1705	#define CIFS_NO_RSP_BUF 0x040 /* no response buffer required */	1705	#define CIFS_NO_RSP_BUF 0x040 /* no response buffer required */
1706		1706
1707	/* Type of request operation */	1707	/* Type of request operation */
1708	#define CIFS_ECHO_OP 0x080 /* echo request */	1708	#define CIFS_ECHO_OP 0x080 /* echo request */
1709	#define CIFS_OBREAK_OP 0x0100 /* oplock break request */	1709	#define CIFS_OBREAK_OP 0x0100 /* oplock break request */
1710	#define CIFS_NEG_OP 0x0200 /* negotiate request */	1710	#define CIFS_NEG_OP 0x0200 /* negotiate request */
		1711	#define CIFS_CP_CREATE_CLOSE_OP 0x0400 /* compound create+close request */
1711	/* Lower bitmask values are reserved by others below. */	1712	/* Lower bitmask values are reserved by others below. */
1712	#define CIFS_SESS_OP 0x2000 /* session setup request */	1713	#define CIFS_SESS_OP 0x2000 /* session setup request */
1713	#define CIFS_OP_MASK 0x2380 /* mask request type */	1714	#define CIFS_OP_MASK 0x2780 /* mask request type */
1714		1715
1715	#define CIFS_HAS_CREDITS 0x0400 /* already has credits */	1716	#define CIFS_HAS_CREDITS 0x0400 /* already has credits */
1716	#define CIFS_TRANSFORM_REQ 0x0800 /* transform request before sending */	1717	#define CIFS_TRANSFORM_REQ 0x0800 /* transform request before sending */
1717	#define CIFS_NO_SRV_RSP 0x1000 /* there is no server response */	1718	#define CIFS_NO_SRV_RSP 0x1000 /* there is no server response */
1718		1719
1719	/* Security Flags: indicate type of session setup needed */	1720	/* Security Flags: indicate type of session setup needed */
1720	#define CIFSSEC_MAY_SIGN 0x00001	1721	#define CIFSSEC_MAY_SIGN 0x00001