lael-labs/linux

.mailmap+1−0

@@ -327,6 +327,7 @@ Henrik Rydberg <rydberg@bitmath.org> · 326 unmodified lines
327	Herbert Xu <herbert@gondor.apana.org.au>	327	Herbert Xu <herbert@gondor.apana.org.au>
328	Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>	328	Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>
329	Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>	329	Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>
		330	Ignat Korchagin <ignat@linux.win> <ignat@cloudflare.com>
330	Ike Panhc <ikepanhc@gmail.com> <ike.pan@canonical.com>	331	Ike Panhc <ikepanhc@gmail.com> <ike.pan@canonical.com>
331	J. Bruce Fields <bfields@fieldses.org> <bfields@redhat.com>	332	J. Bruce Fields <bfields@fieldses.org> <bfields@redhat.com>
332	J. Bruce Fields <bfields@fieldses.org> <bfields@citi.umich.edu>	333	J. Bruce Fields <bfields@fieldses.org> <bfields@citi.umich.edu>

Documentation/dev-tools/kunit/run_wrapper.rst+2−0

@@ -336,6 +336,8 @@ command line arguments: · 335 unmodified lines
336	- ``--list_tests_attr``: If set, lists all tests that will be run and all of their	336	- ``--list_tests_attr``: If set, lists all tests that will be run and all of their
337	attributes.	337	attributes.
338		338
		339	- ``--list_suites``: If set, lists all suites that will be run.
		340
339	Command-line completion	341	Command-line completion
340	==============================	342	==============================
341		343

Documentation/devicetree/bindings/mtd/st,spear600-smi.yaml+19−7

   Flash sub nodes describe the memory range and optional per-flash
   properties.
-allOf:
-  - $ref: mtd.yaml#
 properties:
   compatible:
     const: st,spear600-smi
     $ref: /schemas/types.yaml#/definitions/uint32
     description: Functional clock rate of the SMI controller in Hz.
-  st,smi-fast-mode:
+patternProperties:
-    type: boolean
+  "^flash@.*$":
-    description: Indicates that the attached flash supports fast read mode.
+    $ref: /schemas/mtd/mtd.yaml#
+    properties:
+      reg:
+        maxItems: 1
+      st,smi-fast-mode:
+        type: boolean
+        description: Indicates that the attached flash supports fast read mode.
+    unevaluatedProperties: false
+    required:
+      - reg
 required:
   - compatible
   - reg
   - clock-rate
+  - "#address-cells"
+  - "#size-cells"
 unevaluatedProperties: false
         interrupts = <12>;
         clock-rate = <50000000>;  /* 50 MHz */
-        flash@f8000000 {
+        flash@fc000000 {
             reg = <0xfc000000 0x1000>;
             st,smi-fast-mode;
         };

Documentation/devicetree/bindings/regulator/regulator.yaml+2−2

@@ -168,7 +168,7 @@ properties: · 167 unmodified lines
168	offset from voltage set to regulator.	168	offset from voltage set to regulator.
169		169
170	regulator-uv-protection-microvolt:	170	regulator-uv-protection-microvolt:
171	description: Set over under voltage protection limit. This is a limit where	171	description: Set under voltage protection limit. This is a limit where
172	hardware performs emergency shutdown. Zero can be passed to disable	172	hardware performs emergency shutdown. Zero can be passed to disable
173	protection and value '1' indicates that protection should be enabled but	173	protection and value '1' indicates that protection should be enabled but
174	limit setting can be omitted. Limit is given as microvolt offset from	174	limit setting can be omitted. Limit is given as microvolt offset from
@@ -182,7 +182,7 @@ properties: · 7 unmodified lines
182	is given as microvolt offset from voltage set to regulator.	182	is given as microvolt offset from voltage set to regulator.
183		183
184	regulator-uv-warn-microvolt:	184	regulator-uv-warn-microvolt:
185	description: Set over under voltage warning limit. This is a limit where	185	description: Set under voltage warning limit. This is a limit where
186	hardware is assumed still to be functional but approaching limit where	186	hardware is assumed still to be functional but approaching limit where
187	it gets damaged. Recovery actions should be initiated. Zero can be passed	187	it gets damaged. Recovery actions should be initiated. Zero can be passed
188	to disable detection and value '1' indicates that detection should	188	to disable detection and value '1' indicates that detection should

Documentation/driver-api/driver-model/binding.rst+48−0

@@ -99,3 +99,51 @@ of the driver is decremented. All symlinks between the two are removed. · 98 unmodified lines
99	When a driver is removed, the list of devices that it supports is	99	When a driver is removed, the list of devices that it supports is
100	iterated over, and the driver's remove callback is called for each	100	iterated over, and the driver's remove callback is called for each
101	one. The device is removed from that list and the symlinks removed.	101	one. The device is removed from that list and the symlinks removed.
		102
		103
		104	Driver Override
		105	~~~~~~~~~~~~~~~
		106
		107	Userspace may override the standard matching by writing a driver name to
		108	a device's ``driver_override`` sysfs attribute. When set, only a driver
		109	whose name matches the override will be considered during binding. This
		110	bypasses all bus-specific matching (OF, ACPI, ID tables, etc.).
		111
		112	The override may be cleared by writing an empty string, which returns
		113	the device to standard matching rules. Writing to ``driver_override``
		114	does not automatically unbind the device from its current driver or
		115	make any attempt to load the specified driver.
		116
		117	Buses opt into this mechanism by setting the ``driver_override`` flag in
		118	their ``struct bus_type``::
		119
		120	const struct bus_type example_bus_type = {
		121	...
		122	.driver_override = true,
		123	};
		124
		125	When the flag is set, the driver core automatically creates the
		126	``driver_override`` sysfs attribute for every device on that bus.
		127
		128	The bus's ``match()`` callback should check the override before performing
		129	its own matching, using ``device_match_driver_override()``::
		130
		131	static int example_match(struct device dev, const struct device_driver drv)
		132	{
		133	int ret;
		134
		135	ret = device_match_driver_override(dev, drv);
		136	if (ret >= 0)
		137	return ret;
		138
		139	/* Fall through to bus-specific matching... */
		140	}
		141
		142	``device_match_driver_override()`` returns > 0 if the override matches
		143	the given driver, 0 if the override is set but does not match, or < 0 if
		144	no override is set at all.
		145
		146	Additional helpers are available:
		147
		148	- ``device_set_driver_override()`` - set or clear the override from kernel code.
		149	- ``device_has_driver_override()`` - check whether an override is set.

Documentation/netlink/specs/net_shaper.yaml+6−6

@@ -247,8 +247,8 @@ operations: · 246 unmodified lines
247	flags: [admin-perm]	247	flags: [admin-perm]
248		248
249	do:	249	do:
250	pre: net-shaper-nl-pre-doit	250	pre: net-shaper-nl-pre-doit-write
251	post: net-shaper-nl-post-doit	251	post: net-shaper-nl-post-doit-write
252	request:	252	request:
253	attributes:	253	attributes:
254	- ifindex	254	- ifindex
@@ -278,8 +278,8 @@ operations: · 23 unmodified lines
278	flags: [admin-perm]	278	flags: [admin-perm]
279		279
280	do:	280	do:
281	pre: net-shaper-nl-pre-doit	281	pre: net-shaper-nl-pre-doit-write
282	post: net-shaper-nl-post-doit	282	post: net-shaper-nl-post-doit-write
283	request:	283	request:
284	attributes: *ns-binding	284	attributes: *ns-binding
285		285
@@ -309,8 +309,8 @@ operations: · 23 unmodified lines
309	flags: [admin-perm]	309	flags: [admin-perm]
310		310
311	do:	311	do:
312	pre: net-shaper-nl-pre-doit	312	pre: net-shaper-nl-pre-doit-write
313	post: net-shaper-nl-post-doit	313	post: net-shaper-nl-post-doit-write
314	request:	314	request:
315	attributes:	315	attributes:
316	- ifindex	316	- ifindex

MAINTAINERS+8−6

 ASYMMETRIC KEYS
 M:	David Howells <dhowells@redhat.com>
 M:	Lukas Wunner <lukas@wunner.de>
-M:	Ignat Korchagin <ignat@cloudflare.com>
+M:	Ignat Korchagin <ignat@linux.win>
 L:	keyrings@vger.kernel.org
 L:	linux-crypto@vger.kernel.org
 S:	Maintained
 ASYMMETRIC KEYS - ECDSA
 M:	Lukas Wunner <lukas@wunner.de>
-M:	Ignat Korchagin <ignat@cloudflare.com>
+M:	Ignat Korchagin <ignat@linux.win>
 R:	Stefan Berger <stefanb@linux.ibm.com>
 L:	linux-crypto@vger.kernel.org
 S:	Maintained
 ASYMMETRIC KEYS - GOST
 M:	Lukas Wunner <lukas@wunner.de>
-M:	Ignat Korchagin <ignat@cloudflare.com>
+M:	Ignat Korchagin <ignat@linux.win>
 L:	linux-crypto@vger.kernel.org
 S:	Odd fixes
 F:	crypto/ecrdsa*
 ASYMMETRIC KEYS - RSA
 M:	Lukas Wunner <lukas@wunner.de>
-M:	Ignat Korchagin <ignat@cloudflare.com>
+M:	Ignat Korchagin <ignat@linux.win>
 L:	linux-crypto@vger.kernel.org
 S:	Maintained
 F:	crypto/rsa*
 F:	drivers/gpu/drm/tiny/hx8357d.c
 DRM DRIVER FOR HYPERV SYNTHETIC VIDEO DEVICE
-M:	Deepak Rawat <drawat.floss@gmail.com>
+M:	Dexuan Cui <decui@microsoft.com>
+M:	Long Li <longli@microsoft.com>
+M:	Saurabh Sengar <ssengar@linux.microsoft.com>
 L:	linux-hyperv@vger.kernel.org
 L:	dri-devel@lists.freedesktop.org
 S:	Maintained
 F:	drivers/pinctrl/spear/
 SPI NOR SUBSYSTEM
-M:	Tudor Ambarus <tudor.ambarus@linaro.org>
 M:	Pratyush Yadav <pratyush@kernel.org>
 M:	Michael Walle <mwalle@kernel.org>
+R:	Takahiro Kuwano <takahiro.kuwano@infineon.com>
 L:	linux-mtd@lists.infradead.org
 S:	Maintained
 W:	http://www.linux-mtd.infradead.org/

Makefile+1−1

@@ -2,7 +2,7 @@ · 1 unmodified line
2	VERSION = 7	2	VERSION = 7
3	PATCHLEVEL = 0	3	PATCHLEVEL = 0
4	SUBLEVEL = 0	4	SUBLEVEL = 0
5	EXTRAVERSION = -rc4	5	EXTRAVERSION = -rc5
6	NAME = Baby Opossum Posse	6	NAME = Baby Opossum Posse
7		7
8	# DOCUMENTATION	8	# DOCUMENTATION

arch/arm/configs/multi_v7_defconfig+0−1

@@ -279,7 +279,6 @@ CONFIG_TI_CPSW_SWITCHDEV=y · 278 unmodified lines
279	CONFIG_TI_CPTS=y	279	CONFIG_TI_CPTS=y
280	CONFIG_TI_KEYSTONE_NETCP=y	280	CONFIG_TI_KEYSTONE_NETCP=y
281	CONFIG_TI_KEYSTONE_NETCP_ETHSS=y	281	CONFIG_TI_KEYSTONE_NETCP_ETHSS=y
282	CONFIG_TI_PRUSS=m
283	CONFIG_TI_PRUETH=m	282	CONFIG_TI_PRUETH=m
284	CONFIG_XILINX_EMACLITE=y	283	CONFIG_XILINX_EMACLITE=y
285	CONFIG_SFP=m	284	CONFIG_SFP=m

arch/arm64/boot/dts/renesas/r8a78000.dtsi+8−8

@@ -698,7 +698,7 @@ · 697 unmodified lines
698	compatible = "renesas,scif-r8a78000",	698	compatible = "renesas,scif-r8a78000",
699	"renesas,rcar-gen5-scif", "renesas,scif";	699	"renesas,rcar-gen5-scif", "renesas,scif";
700	reg = <0 0xc0700000 0 0x40>;	700	reg = <0 0xc0700000 0 0x40>;
701	interrupts = <GIC_SPI 4074 IRQ_TYPE_LEVEL_HIGH>;	701	interrupts = <GIC_ESPI 10 IRQ_TYPE_LEVEL_HIGH>;
702	clocks = <&dummy_clk_sgasyncd16>, <&dummy_clk_sgasyncd16>, <&scif_clk>;	702	clocks = <&dummy_clk_sgasyncd16>, <&dummy_clk_sgasyncd16>, <&scif_clk>;
703	clock-names = "fck", "brg_int", "scif_clk";	703	clock-names = "fck", "brg_int", "scif_clk";
704	status = "disabled";	704	status = "disabled";
@@ -708,7 +708,7 @@ · 3 unmodified lines
708	compatible = "renesas,scif-r8a78000",	708	compatible = "renesas,scif-r8a78000",
709	"renesas,rcar-gen5-scif", "renesas,scif";	709	"renesas,rcar-gen5-scif", "renesas,scif";
710	reg = <0 0xc0704000 0 0x40>;	710	reg = <0 0xc0704000 0 0x40>;
711	interrupts = <GIC_SPI 4075 IRQ_TYPE_LEVEL_HIGH>;	711	interrupts = <GIC_ESPI 11 IRQ_TYPE_LEVEL_HIGH>;
712	clocks = <&dummy_clk_sgasyncd16>, <&dummy_clk_sgasyncd16>, <&scif_clk>;	712	clocks = <&dummy_clk_sgasyncd16>, <&dummy_clk_sgasyncd16>, <&scif_clk>;
713	clock-names = "fck", "brg_int", "scif_clk";	713	clock-names = "fck", "brg_int", "scif_clk";
714	status = "disabled";	714	status = "disabled";
@@ -718,7 +718,7 @@ · 3 unmodified lines
718	compatible = "renesas,scif-r8a78000",	718	compatible = "renesas,scif-r8a78000",
719	"renesas,rcar-gen5-scif", "renesas,scif";	719	"renesas,rcar-gen5-scif", "renesas,scif";
720	reg = <0 0xc0708000 0 0x40>;	720	reg = <0 0xc0708000 0 0x40>;
721	interrupts = <GIC_SPI 4076 IRQ_TYPE_LEVEL_HIGH>;	721	interrupts = <GIC_ESPI 12 IRQ_TYPE_LEVEL_HIGH>;
722	clocks = <&dummy_clk_sgasyncd16>, <&dummy_clk_sgasyncd16>, <&scif_clk>;	722	clocks = <&dummy_clk_sgasyncd16>, <&dummy_clk_sgasyncd16>, <&scif_clk>;
723	clock-names = "fck", "brg_int", "scif_clk";	723	clock-names = "fck", "brg_int", "scif_clk";
724	status = "disabled";	724	status = "disabled";
@@ -728,7 +728,7 @@ · 3 unmodified lines
728	compatible = "renesas,scif-r8a78000",	728	compatible = "renesas,scif-r8a78000",
729	"renesas,rcar-gen5-scif", "renesas,scif";	729	"renesas,rcar-gen5-scif", "renesas,scif";
730	reg = <0 0xc070c000 0 0x40>;	730	reg = <0 0xc070c000 0 0x40>;
731	interrupts = <GIC_SPI 4077 IRQ_TYPE_LEVEL_HIGH>;	731	interrupts = <GIC_ESPI 13 IRQ_TYPE_LEVEL_HIGH>;
732	clocks = <&dummy_clk_sgasyncd16>, <&dummy_clk_sgasyncd16>, <&scif_clk>;	732	clocks = <&dummy_clk_sgasyncd16>, <&dummy_clk_sgasyncd16>, <&scif_clk>;
733	clock-names = "fck", "brg_int", "scif_clk";	733	clock-names = "fck", "brg_int", "scif_clk";
734	status = "disabled";	734	status = "disabled";
@@ -738,7 +738,7 @@ · 3 unmodified lines
738	compatible = "renesas,hscif-r8a78000",	738	compatible = "renesas,hscif-r8a78000",
739	"renesas,rcar-gen5-hscif", "renesas,hscif";	739	"renesas,rcar-gen5-hscif", "renesas,hscif";
740	reg = <0 0xc0710000 0 0x60>;	740	reg = <0 0xc0710000 0 0x60>;
741	interrupts = <GIC_SPI 4078 IRQ_TYPE_LEVEL_HIGH>;	741	interrupts = <GIC_ESPI 14 IRQ_TYPE_LEVEL_HIGH>;
742	clocks = <&dummy_clk_sgasyncd4>, <&dummy_clk_sgasyncd4>, <&scif_clk>;	742	clocks = <&dummy_clk_sgasyncd4>, <&dummy_clk_sgasyncd4>, <&scif_clk>;
743	clock-names = "fck", "brg_int", "scif_clk";	743	clock-names = "fck", "brg_int", "scif_clk";
744	status = "disabled";	744	status = "disabled";
@@ -748,7 +748,7 @@ · 3 unmodified lines
748	compatible = "renesas,hscif-r8a78000",	748	compatible = "renesas,hscif-r8a78000",
749	"renesas,rcar-gen5-hscif", "renesas,hscif";	749	"renesas,rcar-gen5-hscif", "renesas,hscif";
750	reg = <0 0xc0714000 0 0x60>;	750	reg = <0 0xc0714000 0 0x60>;
751	interrupts = <GIC_SPI 4079 IRQ_TYPE_LEVEL_HIGH>;	751	interrupts = <GIC_ESPI 15 IRQ_TYPE_LEVEL_HIGH>;
752	clocks = <&dummy_clk_sgasyncd4>, <&dummy_clk_sgasyncd4>, <&scif_clk>;	752	clocks = <&dummy_clk_sgasyncd4>, <&dummy_clk_sgasyncd4>, <&scif_clk>;
753	clock-names = "fck", "brg_int", "scif_clk";	753	clock-names = "fck", "brg_int", "scif_clk";
754	status = "disabled";	754	status = "disabled";
@@ -758,7 +758,7 @@ · 3 unmodified lines
758	compatible = "renesas,hscif-r8a78000",	758	compatible = "renesas,hscif-r8a78000",
759	"renesas,rcar-gen5-hscif", "renesas,hscif";	759	"renesas,rcar-gen5-hscif", "renesas,hscif";
760	reg = <0 0xc0718000 0 0x60>;	760	reg = <0 0xc0718000 0 0x60>;
761	interrupts = <GIC_SPI 4080 IRQ_TYPE_LEVEL_HIGH>;	761	interrupts = <GIC_ESPI 16 IRQ_TYPE_LEVEL_HIGH>;
762	clocks = <&dummy_clk_sgasyncd4>, <&dummy_clk_sgasyncd4>, <&scif_clk>;	762	clocks = <&dummy_clk_sgasyncd4>, <&dummy_clk_sgasyncd4>, <&scif_clk>;
763	clock-names = "fck", "brg_int", "scif_clk";	763	clock-names = "fck", "brg_int", "scif_clk";
764	status = "disabled";	764	status = "disabled";
@@ -768,7 +768,7 @@ · 3 unmodified lines
768	compatible = "renesas,hscif-r8a78000",	768	compatible = "renesas,hscif-r8a78000",
769	"renesas,rcar-gen5-hscif", "renesas,hscif";	769	"renesas,rcar-gen5-hscif", "renesas,hscif";
770	reg = <0 0xc071c000 0 0x60>;	770	reg = <0 0xc071c000 0 0x60>;
771	interrupts = <GIC_SPI 4081 IRQ_TYPE_LEVEL_HIGH>;	771	interrupts = <GIC_ESPI 17 IRQ_TYPE_LEVEL_HIGH>;
772	clocks = <&dummy_clk_sgasyncd4>, <&dummy_clk_sgasyncd4>, <&scif_clk>;	772	clocks = <&dummy_clk_sgasyncd4>, <&dummy_clk_sgasyncd4>, <&scif_clk>;
773	clock-names = "fck", "brg_int", "scif_clk";	773	clock-names = "fck", "brg_int", "scif_clk";
774	status = "disabled";	774	status = "disabled";

arch/arm64/boot/dts/renesas/r9a09g057.dtsi+0−30

@@ -581,16 +581,6 @@ · 580 unmodified lines
581	status = "disabled";	581	status = "disabled";
582	};	582	};
583		583
584	wdt0: watchdog@11c00400 {
585	compatible = "renesas,r9a09g057-wdt";
586	reg = <0 0x11c00400 0 0x400>;
587	clocks = <&cpg CPG_MOD 0x4b>, <&cpg CPG_MOD 0x4c>;
588	clock-names = "pclk", "oscclk";
589	resets = <&cpg 0x75>;
590	power-domains = <&cpg>;
591	status = "disabled";
592	};
593
594	wdt1: watchdog@14400000 {	584	wdt1: watchdog@14400000 {
595	compatible = "renesas,r9a09g057-wdt";	585	compatible = "renesas,r9a09g057-wdt";
596	reg = <0 0x14400000 0 0x400>;	586	reg = <0 0x14400000 0 0x400>;
@@ -601,26 +591,6 @@ · 4 unmodified lines
601	status = "disabled";	591	status = "disabled";
602	};	592	};
603		593
604	wdt2: watchdog@13000000 {
605	compatible = "renesas,r9a09g057-wdt";
606	reg = <0 0x13000000 0 0x400>;
607	clocks = <&cpg CPG_MOD 0x4f>, <&cpg CPG_MOD 0x50>;
608	clock-names = "pclk", "oscclk";
609	resets = <&cpg 0x77>;
610	power-domains = <&cpg>;
611	status = "disabled";
612	};
613
614	wdt3: watchdog@13000400 {
615	compatible = "renesas,r9a09g057-wdt";
616	reg = <0 0x13000400 0 0x400>;
617	clocks = <&cpg CPG_MOD 0x51>, <&cpg CPG_MOD 0x52>;
618	clock-names = "pclk", "oscclk";
619	resets = <&cpg 0x78>;
620	power-domains = <&cpg>;
621	status = "disabled";
622	};
623
624	rtc: rtc@11c00800 {	594	rtc: rtc@11c00800 {
625	compatible = "renesas,r9a09g057-rtca3", "renesas,rz-rtca3";	595	compatible = "renesas,r9a09g057-rtca3", "renesas,rz-rtca3";
626	reg = <0 0x11c00800 0 0x400>;	596	reg = <0 0x11c00800 0 0x400>;

arch/arm64/boot/dts/renesas/r9a09g077.dtsi+2−2

@@ -974,8 +974,8 @@ · 973 unmodified lines
974		974
975	cpg: clock-controller@80280000 {	975	cpg: clock-controller@80280000 {
976	compatible = "renesas,r9a09g077-cpg-mssr";	976	compatible = "renesas,r9a09g077-cpg-mssr";
977	reg = <0 0x80280000 0 0x1000>,	977	reg = <0 0x80280000 0 0x10000>,
978	<0 0x81280000 0 0x9000>;	978	<0 0x81280000 0 0x10000>;
979	clocks = <&extal_clk>;	979	clocks = <&extal_clk>;
980	clock-names = "extal";	980	clock-names = "extal";
981	#clock-cells = <2>;	981	#clock-cells = <2>;

arch/arm64/boot/dts/renesas/r9a09g087.dtsi+2−2

@@ -977,8 +977,8 @@ · 976 unmodified lines
977		977
978	cpg: clock-controller@80280000 {	978	cpg: clock-controller@80280000 {
979	compatible = "renesas,r9a09g087-cpg-mssr";	979	compatible = "renesas,r9a09g087-cpg-mssr";
980	reg = <0 0x80280000 0 0x1000>,	980	reg = <0 0x80280000 0 0x10000>,
981	<0 0x81280000 0 0x9000>;	981	<0 0x81280000 0 0x10000>;
982	clocks = <&extal_clk>;	982	clocks = <&extal_clk>;
983	clock-names = "extal";	983	clock-names = "extal";
984	#clock-cells = <2>;	984	#clock-cells = <2>;

arch/arm64/boot/dts/renesas/rzg3s-smarc-som.dtsi+1−1

@@ -162,7 +162,7 @@ · 161 unmodified lines
162	<100000000>;	162	<100000000>;
163	renesas,settings = [	163	renesas,settings = [
164	80 00 11 19 4c 42 dc 2f 06 7d 20 1a 5f 1e f2 27	164	80 00 11 19 4c 42 dc 2f 06 7d 20 1a 5f 1e f2 27
165	00 40 00 00 00 00 00 00 06 0c 19 02 3f f0 90 86	165	00 40 00 00 00 00 00 00 06 0c 19 02 3b f0 90 86
166	a0 80 30 30 9c	166	a0 80 30 30 9c
167	];	167	];
168	};	168	};

arch/arm64/boot/dts/renesas/rzt2h-n2h-evk-common.dtsi+1−0

@@ -53,6 +53,7 @@ · 52 unmodified lines
53	regulator-max-microvolt = <3300000>;	53	regulator-max-microvolt = <3300000>;
54	gpios-states = <0>;	54	gpios-states = <0>;
55	states = <3300000 0>, <1800000 1>;	55	states = <3300000 0>, <1800000 1>;
		56	regulator-ramp-delay = <60>;
56	};	57	};
57	#endif	58	#endif
58		59

arch/arm64/boot/dts/renesas/rzv2-evk-cn15-sd.dtso+1−0

@@ -25,6 +25,7 @@ · 24 unmodified lines
25	regulator-max-microvolt = <3300000>;	25	regulator-max-microvolt = <3300000>;
26	gpios-states = <0>;	26	gpios-states = <0>;
27	states = <3300000 0>, <1800000 1>;	27	states = <3300000 0>, <1800000 1>;
		28	regulator-ramp-delay = <60>;
28	};	29	};
29	};	30	};
30		31

arch/arm64/crypto/aes-neonbs-glue.c+23−14

@@ -76,19 +76,24 @@ static int aesbs_setkey(struct crypto_skcipher tfm, const u8 in_key, · 75 unmodified lines
76	unsigned int key_len)	76	unsigned int key_len)
77	{	77	{
78	struct aesbs_ctx *ctx = crypto_skcipher_ctx(tfm);	78	struct aesbs_ctx *ctx = crypto_skcipher_ctx(tfm);
79	struct crypto_aes_ctx rk;	79	struct crypto_aes_ctx *rk;
80	int err;	80	int err;
81		81
82	err = aes_expandkey(&rk, in_key, key_len);	82	rk = kmalloc(sizeof(*rk), GFP_KERNEL);
		83	if (!rk)
		84	return -ENOMEM;
		85
		86	err = aes_expandkey(rk, in_key, key_len);
83	if (err)	87	if (err)
84	return err;	88	goto out;
85		89
86	ctx->rounds = 6 + key_len / 4;	90	ctx->rounds = 6 + key_len / 4;
87		91
88	scoped_ksimd()	92	scoped_ksimd()
89	aesbs_convert_key(ctx->rk, rk.key_enc, ctx->rounds);	93	aesbs_convert_key(ctx->rk, rk->key_enc, ctx->rounds);
90		94	out:
91	return 0;	95	kfree_sensitive(rk);
		96	return err;
92	}	97	}
93		98
94	static int __ecb_crypt(struct skcipher_request *req,	99	static int __ecb_crypt(struct skcipher_request *req,
@@ -133,22 +138,26 @@ static int aesbs_cbc_ctr_setkey(struct crypto_skcipher tfm, const u8 in_key, · 38 unmodified lines
133	unsigned int key_len)	138	unsigned int key_len)
134	{	139	{
135	struct aesbs_cbc_ctr_ctx *ctx = crypto_skcipher_ctx(tfm);	140	struct aesbs_cbc_ctr_ctx *ctx = crypto_skcipher_ctx(tfm);
136	struct crypto_aes_ctx rk;	141	struct crypto_aes_ctx *rk;
137	int err;	142	int err;
138		143
139	err = aes_expandkey(&rk, in_key, key_len);	144	rk = kmalloc(sizeof(*rk), GFP_KERNEL);
		145	if (!rk)
		146	return -ENOMEM;
		147
		148	err = aes_expandkey(rk, in_key, key_len);
140	if (err)	149	if (err)
141	return err;	150	goto out;
142		151
143	ctx->key.rounds = 6 + key_len / 4;	152	ctx->key.rounds = 6 + key_len / 4;
144		153
145	memcpy(ctx->enc, rk.key_enc, sizeof(ctx->enc));	154	memcpy(ctx->enc, rk->key_enc, sizeof(ctx->enc));
146		155
147	scoped_ksimd()	156	scoped_ksimd()
148	aesbs_convert_key(ctx->key.rk, rk.key_enc, ctx->key.rounds);	157	aesbs_convert_key(ctx->key.rk, rk->key_enc, ctx->key.rounds);
149	memzero_explicit(&rk, sizeof(rk));	158	out:
150		159	kfree_sensitive(rk);
151	return 0;	160	return err;
152	}	161	}
153		162
154	static int cbc_encrypt(struct skcipher_request *req)	163	static int cbc_encrypt(struct skcipher_request *req)

arch/arm64/kernel/pi/patch-scs.c+8−0

@@ -192,6 +192,14 @@ static int scs_handle_fde_frame(const struct eh_frame *frame, · 191 unmodified lines
192	size -= 2;	192	size -= 2;
193	break;	193	break;
194		194
		195	case DW_CFA_advance_loc4:
		196	loc += opcode++ code_alignment_factor;
		197	loc += (opcode++ << 8) code_alignment_factor;
		198	loc += (opcode++ << 16) code_alignment_factor;
		199	loc += (opcode++ << 24) code_alignment_factor;
		200	size -= 4;
		201	break;
		202
195	case DW_CFA_def_cfa:	203	case DW_CFA_def_cfa:
196	case DW_CFA_offset_extended:	204	case DW_CFA_offset_extended:
197	size = skip_xleb128(&opcode, size);	205	size = skip_xleb128(&opcode, size);

arch/arm64/kernel/rsi.c+2−1

 #include <asm/io.h>
 #include <asm/mem_encrypt.h>
+#include <asm/pgtable.h>
 #include <asm/rsi.h>
 static struct realm_config config;
 		return;
 	if (WARN_ON(rsi_get_realm_config(&config)))
 		return;
-	prot_ns_shared = BIT(config.ipa_bits - 1);
+	prot_ns_shared = __phys_to_pte_val(BIT(config.ipa_bits - 1));
 	if (arm64_ioremap_prot_hook_register(realm_ioremap_hook))
 		return;

arch/loongarch/Kconfig+3−0

@@ -304,6 +304,9 @@ config AS_HAS_LBT_EXTENSION · 303 unmodified lines
304	config AS_HAS_LVZ_EXTENSION	304	config AS_HAS_LVZ_EXTENSION
305	def_bool $(as-instr,hvcl 0)	305	def_bool $(as-instr,hvcl 0)
306		306
		307	config AS_HAS_SCQ_EXTENSION
		308	def_bool $(as-instr,sc.q \$t0$(comma)\$t1$(comma)\$t2)
		309
307	config CC_HAS_ANNOTATE_TABLEJUMP	310	config CC_HAS_ANNOTATE_TABLEJUMP
308	def_bool $(cc-option,-mannotate-tablejump)	311	def_bool $(cc-option,-mannotate-tablejump)
309		312

arch/loongarch/include/asm/cmpxchg.h+5−0

 	arch_cmpxchg((ptr), (o), (n));					\
   })
+#ifdef CONFIG_AS_HAS_SCQ_EXTENSION
 union __u128_halves {
 	u128 full;
 	struct {
 	BUILD_BUG_ON(sizeof(*(ptr)) != 16);				\
 	__arch_cmpxchg128(ptr, o, n, "");				\
 })
+#endif /* CONFIG_AS_HAS_SCQ_EXTENSION */
 #else
 #include <asm-generic/cmpxchg-local.h>
 #define arch_cmpxchg64_local(ptr, o, n) __generic_cmpxchg64_local((ptr), (o), (n))

arch/loongarch/include/asm/uaccess.h+12−2

 									\
 	__get_kernel_common(*((type *)(dst)), sizeof(type),		\
 			    (__force type *)(src));			\
-	if (unlikely(__gu_err))						\
+	if (unlikely(__gu_err))	{					\
+		pr_info("%s: memory access failed, ecode 0x%x\n",	\
+			__func__, read_csr_excode());			\
+		pr_info("%s: the caller is %pS\n",			\
+			__func__, __builtin_return_address(0));		\
 		goto err_label;						\
+	}								\
 } while (0)
 #define __put_kernel_nofault(dst, src, type, err_label)			\
 									\
 	__pu_val = *(__force type *)(src);				\
 	__put_kernel_common(((type *)(dst)), sizeof(type));		\
-	if (unlikely(__pu_err))						\
+	if (unlikely(__pu_err))	{					\
+		pr_info("%s: memory access failed, ecode 0x%x\n",	\
+			__func__, read_csr_excode());			\
+		pr_info("%s: the caller is %pS\n",			\
+			__func__, __builtin_return_address(0));		\
 		goto err_label;						\
+	}								\
 } while (0)
 extern unsigned long __copy_user(void *to, const void *from, __kernel_size_t n);

arch/loongarch/kernel/inst.c+25−6

 	if (smp_processor_id() == copy->cpu) {
 		ret = copy_to_kernel_nofault(copy->dst, copy->src, copy->len);
-		if (ret)
+		if (ret) {
 			pr_err("%s: operation failed\n", __func__);
+			return ret;
+		}
 	}
 	flush_icache_range((unsigned long)copy->dst, (unsigned long)copy->dst + copy->len);
-	return ret;
+	return 0;
 }
 int larch_insn_text_copy(void *dst, void *src, size_t len)
 {
 	int ret = 0;
+	int err = 0;
 	size_t start, end;
 	struct insn_copy copy = {
 		.dst = dst,
 		.src = src,
 		.len = len,
-		.cpu = smp_processor_id(),
+		.cpu = raw_smp_processor_id(),
 	};
+	/*
+	 * Ensure copy.cpu won't be hot removed before stop_machine.
+	 * If it is removed nobody will really update the text.
+	 */
+	lockdep_assert_cpus_held();
 	start = round_down((size_t)dst, PAGE_SIZE);
 	end   = round_up((size_t)dst + len, PAGE_SIZE);
-	set_memory_rw(start, (end - start) / PAGE_SIZE);
+	err = set_memory_rw(start, (end - start) / PAGE_SIZE);
-	ret = stop_machine(text_copy_cb, &copy, cpu_online_mask);
+	if (err) {
-	set_memory_rox(start, (end - start) / PAGE_SIZE);
+		pr_info("%s: set_memory_rw() failed\n", __func__);
+		return err;
+	}
+	ret = stop_machine_cpuslocked(text_copy_cb, &copy, cpu_online_mask);
+	err = set_memory_rox(start, (end - start) / PAGE_SIZE);
+	if (err) {
+		pr_info("%s: set_memory_rox() failed\n", __func__);
+		return err;
+	}
 	return ret;
 }

arch/loongarch/kvm/vm.c+2−2

@@ -49,8 +49,8 @@ static void kvm_vm_init_features(struct kvm *kvm) · 48 unmodified lines
49	kvm->arch.kvm_features \|= BIT(KVM_LOONGARCH_VM_FEAT_PMU);	49	kvm->arch.kvm_features \|= BIT(KVM_LOONGARCH_VM_FEAT_PMU);
50		50
51	/* Enable all PV features by default */	51	/* Enable all PV features by default */
52	kvm->arch.pv_features = BIT(KVM_FEATURE_IPI);	52	kvm->arch.pv_features \|= BIT(KVM_FEATURE_IPI);
53	kvm->arch.kvm_features = BIT(KVM_LOONGARCH_VM_FEAT_PV_IPI);	53	kvm->arch.kvm_features \|= BIT(KVM_LOONGARCH_VM_FEAT_PV_IPI);
54	if (kvm_pvtime_supported()) {	54	if (kvm_pvtime_supported()) {
55	kvm->arch.pv_features \|= BIT(KVM_FEATURE_PREEMPT);	55	kvm->arch.pv_features \|= BIT(KVM_FEATURE_PREEMPT);
56	kvm->arch.pv_features \|= BIT(KVM_FEATURE_STEAL_TIME);	56	kvm->arch.pv_features \|= BIT(KVM_FEATURE_STEAL_TIME);

arch/loongarch/net/bpf_jit.c+11−0

 {
 	int ret;
+	cpus_read_lock();
 	mutex_lock(&text_mutex);
 	ret = larch_insn_text_copy(dst, src, len);
 	mutex_unlock(&text_mutex);
+	cpus_read_unlock();
 	return ret ? ERR_PTR(-EINVAL) : dst;
 }
 	if (ret)
 		return ret;
+	cpus_read_lock();
 	mutex_lock(&text_mutex);
 	if (memcmp(ip, new_insns, LOONGARCH_LONG_JUMP_NBYTES))
 		ret = larch_insn_text_copy(ip, new_insns, LOONGARCH_LONG_JUMP_NBYTES);
 	mutex_unlock(&text_mutex);
+	cpus_read_unlock();
 	return ret;
 }
 	for (i = 0; i < (len / sizeof(u32)); i++)
 		inst[i] = INSN_BREAK;
+	cpus_read_lock();
 	mutex_lock(&text_mutex);
 	if (larch_insn_text_copy(dst, inst, len))
 		ret = -EINVAL;
 	mutex_unlock(&text_mutex);
+	cpus_read_unlock();
 	kvfree(inst);
 	bpf_prog_pack_free(image, size);
 }
+int arch_protect_bpf_trampoline(void *image, unsigned int size)
+{
+	return 0;
+}
 /*
  * Sign-extend the register if necessary
  */

arch/parisc/kernel/cache.c+2−2

@@ -953,7 +953,7 @@ SYSCALL_DEFINE3(cacheflush, unsigned long, addr, unsigned long, bytes, · 952 unmodified lines
953	#else	953	#else
954	"1: cmpb,<<,n %0,%2,1b\n"	954	"1: cmpb,<<,n %0,%2,1b\n"
955	#endif	955	#endif
956	" fic,m %3(%4,%0)\n"	956	" fdc,m %3(%4,%0)\n"
957	"2: sync\n"	957	"2: sync\n"
958	ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 2b, "%1")	958	ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 2b, "%1")
959	: "+r" (start), "+r" (error)	959	: "+r" (start), "+r" (error)
@@ -968,7 +968,7 @@ SYSCALL_DEFINE3(cacheflush, unsigned long, addr, unsigned long, bytes, · 8 unmodified lines
968	#else	968	#else
969	"1: cmpb,<<,n %0,%2,1b\n"	969	"1: cmpb,<<,n %0,%2,1b\n"
970	#endif	970	#endif
971	" fdc,m %3(%4,%0)\n"	971	" fic,m %3(%4,%0)\n"
972	"2: sync\n"	972	"2: sync\n"
973	ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 2b, "%1")	973	ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 2b, "%1")
974	: "+r" (start), "+r" (error)	974	: "+r" (start), "+r" (error)

arch/riscv/boot/dts/microchip/mpfs.dtsi+2−0

 			clocks = <&clkcfg CLK_CAN0>, <&clkcfg CLK_MSSPLL3>;
 			interrupt-parent = <&plic>;
 			interrupts = <56>;
+			resets = <&mss_top_sysreg CLK_CAN0>;
 			status = "disabled";
 		};
 			clocks = <&clkcfg CLK_CAN1>, <&clkcfg CLK_MSSPLL3>;
 			interrupt-parent = <&plic>;
 			interrupts = <57>;
+			resets = <&mss_top_sysreg CLK_CAN1>;
 			status = "disabled";
 		};

arch/sh/drivers/platform_early.c+0−4

 	struct platform_device *pdev = to_platform_device(dev);
 	struct platform_driver *pdrv = to_platform_driver(drv);
-	/* When driver_override is set, only bind to the matching driver */
-	if (pdev->driver_override)
-		return !strcmp(pdev->driver_override, drv->name);
 	/* Then try to match against the id table */
 	if (pdrv->id_table)
 		return platform_match_id(pdrv->id_table, pdev) != NULL;

arch/x86/entry/vdso/common/vclock_gettime.c+1−1

@@ -13,7 +13,7 @@ · 12 unmodified lines
13	#include <linux/types.h>	13	#include <linux/types.h>
14	#include <vdso/gettime.h>	14	#include <vdso/gettime.h>
15		15
16	#include "../../../../lib/vdso/gettimeofday.c"	16	#include "lib/vdso/gettimeofday.c"
17		17
18	int __vdso_gettimeofday(struct __kernel_old_timeval tv, struct timezone tz)	18	int __vdso_gettimeofday(struct __kernel_old_timeval tv, struct timezone tz)
19	{	19	{

arch/x86/events/core.c+5−2

 			else if (i < n_running)
 				continue;
-			if (hwc->state & PERF_HES_ARCH)
+			cpuc->events[hwc->idx] = event;
+			if (hwc->state & PERF_HES_ARCH) {
+				static_call(x86_pmu_set_period)(event);
 				continue;
+			}
 			/*
 			 * if cpuc->enabled = 0, then no wrmsr as
 			 * per x86_pmu_enable_event()
 			 */
-			cpuc->events[hwc->idx] = event;
 			x86_pmu_start(event, PERF_EF_RELOAD);
 		}
 		cpuc->n_added = 0;

arch/x86/events/intel/core.c+21−10

 		event->hw.dyn_constraint &= hybrid(event->pmu, acr_cause_mask64);
 }
+static inline int intel_set_branch_counter_constr(struct perf_event *event,
+						  int *num)
+{
+	if (branch_sample_call_stack(event))
+		return -EINVAL;
+	if (branch_sample_counters(event)) {
+		(*num)++;
+		event->hw.dyn_constraint &= x86_pmu.lbr_counters;
+	}
+	return 0;
+}
 static int intel_pmu_hw_config(struct perf_event *event)
 {
 	int ret = x86_pmu_hw_config(event);
 		 * group, which requires the extra space to store the counters.
 		 */
 		leader = event->group_leader;
-		if (branch_sample_call_stack(leader))
+		if (intel_set_branch_counter_constr(leader, &num))
 			return -EINVAL;
-		if (branch_sample_counters(leader)) {
-			num++;
-			leader->hw.dyn_constraint &= x86_pmu.lbr_counters;
-		}
 		leader->hw.flags |= PERF_X86_EVENT_BRANCH_COUNTERS;
 		for_each_sibling_event(sibling, leader) {
-			if (branch_sample_call_stack(sibling))
+			if (intel_set_branch_counter_constr(sibling, &num))
+				return -EINVAL;
+		}
+		/* event isn't installed as a sibling yet. */
+		if (event != leader) {
+			if (intel_set_branch_counter_constr(event, &num))
 				return -EINVAL;
-			if (branch_sample_counters(sibling)) {
-				num++;
-				sibling->hw.dyn_constraint &= x86_pmu.lbr_counters;
-			}
 		}
 		if (num > fls(x86_pmu.lbr_counters))

arch/x86/events/intel/ds.c+7−4

 	if (omr.omr_remote)
 		val |= REM;
-	val |= omr.omr_hitm ? P(SNOOP, HITM) : P(SNOOP, HIT);
 	if (omr.omr_source == 0x2) {
-		u8 snoop = omr.omr_snoop | omr.omr_promoted;
+		u8 snoop = omr.omr_snoop | (omr.omr_promoted << 1);
-		if (snoop == 0x0)
+		if (omr.omr_hitm)
+			val |= P(SNOOP, HITM);
+		else if (snoop == 0x0)
 			val |= P(SNOOP, NA);
 		else if (snoop == 0x1)
 			val |= P(SNOOP, MISS);
 		else if (snoop == 0x3)
 			val |= P(SNOOP, NONE);
 	} else if (omr.omr_source > 0x2 && omr.omr_source < 0x7) {
+		val |= omr.omr_hitm ? P(SNOOP, HITM) : P(SNOOP, HIT);
 		val |= omr.omr_snoop ? P(SNOOPX, FWD) : 0;
+	} else {
+		val |= P(SNOOP, NONE);
 	}
 	return val;

arch/x86/hyperv/hv_crash.c+52−48

 		cpu_relax();
 }
-/* This cannot be inlined as it needs stack */
+static void hv_crash_restore_tss(void)
-static noinline __noclone void hv_crash_restore_tss(void)
 {
 	load_TR_desc();
 }
-/* This cannot be inlined as it needs stack */
+static void hv_crash_clear_kernpt(void)
-static noinline void hv_crash_clear_kernpt(void)
 {
 	pgd_t *pgd;
 	p4d_t *p4d;
 	native_p4d_clear(p4d);
 }
+static void __noreturn hv_crash_handle(void)
+{
+	hv_crash_restore_tss();
+	hv_crash_clear_kernpt();
+	/* we are now fully in devirtualized normal kernel mode */
+	__crash_kexec(NULL);
+	hv_panic_timeout_reboot();
+}
+/*
+ * __naked functions do not permit function calls, not even to __always_inline
+ * functions that only contain asm() blocks themselves. So use a macro instead.
+ */
+#define hv_wrmsr(msr, val) \
+	asm volatile("wrmsr" :: "c"(msr), "a"((u32)val), "d"((u32)(val >> 32)) : "memory")
 /*
  * This is the C entry point from the asm glue code after the disable hypercall.
  * We enter here in IA32-e long mode, ie, full 64bit mode running on kernel
  * available. We restore kernel GDT, and rest of the context, and continue
  * to kexec.
  */
-static asmlinkage void __noreturn hv_crash_c_entry(void)
+static void __naked hv_crash_c_entry(void)
 {
-	struct hv_crash_ctxt *ctxt = &hv_crash_ctxt;
 	/* first thing, restore kernel gdt */
-	native_load_gdt(&ctxt->gdtr);
+	asm volatile("lgdt %0" : : "m" (hv_crash_ctxt.gdtr));
-	asm volatile("movw %%ax, %%ss" : : "a"(ctxt->ss));
+	asm volatile("movw %0, %%ss\n\t"
-	asm volatile("movq %0, %%rsp" : : "m"(ctxt->rsp));
+		     "movq %1, %%rsp"
+		     :: "m"(hv_crash_ctxt.ss), "m"(hv_crash_ctxt.rsp));
-	asm volatile("movw %%ax, %%ds" : : "a"(ctxt->ds));
+	asm volatile("movw %0, %%ds" : : "m"(hv_crash_ctxt.ds));
-	asm volatile("movw %%ax, %%es" : : "a"(ctxt->es));
+	asm volatile("movw %0, %%es" : : "m"(hv_crash_ctxt.es));
-	asm volatile("movw %%ax, %%fs" : : "a"(ctxt->fs));
+	asm volatile("movw %0, %%fs" : : "m"(hv_crash_ctxt.fs));
-	asm volatile("movw %%ax, %%gs" : : "a"(ctxt->gs));
+	asm volatile("movw %0, %%gs" : : "m"(hv_crash_ctxt.gs));
-	native_wrmsrq(MSR_IA32_CR_PAT, ctxt->pat);
+	hv_wrmsr(MSR_IA32_CR_PAT, hv_crash_ctxt.pat);
-	asm volatile("movq %0, %%cr0" : : "r"(ctxt->cr0));
+	asm volatile("movq %0, %%cr0" : : "r"(hv_crash_ctxt.cr0));
-	asm volatile("movq %0, %%cr8" : : "r"(ctxt->cr8));
+	asm volatile("movq %0, %%cr8" : : "r"(hv_crash_ctxt.cr8));
-	asm volatile("movq %0, %%cr4" : : "r"(ctxt->cr4));
+	asm volatile("movq %0, %%cr4" : : "r"(hv_crash_ctxt.cr4));
-	asm volatile("movq %0, %%cr2" : : "r"(ctxt->cr4));
+	asm volatile("movq %0, %%cr2" : : "r"(hv_crash_ctxt.cr2));
-	native_load_idt(&ctxt->idtr);
+	asm volatile("lidt %0" : : "m" (hv_crash_ctxt.idtr));
-	native_wrmsrq(MSR_GS_BASE, ctxt->gsbase);
+	hv_wrmsr(MSR_GS_BASE, hv_crash_ctxt.gsbase);
-	native_wrmsrq(MSR_EFER, ctxt->efer);
+	hv_wrmsr(MSR_EFER, hv_crash_ctxt.efer);
 	/* restore the original kernel CS now via far return */
-	asm volatile("movzwq %0, %%rax\n\t"
+	asm volatile("pushq %q0\n\t"
-		     "pushq %%rax\n\t"
+		     "pushq %q1\n\t"
-		     "pushq $1f\n\t"
+		     "lretq"
-		     "lretq\n\t"
+		     :: "r"(hv_crash_ctxt.cs), "r"(hv_crash_handle));
-		     "1:nop\n\t" : : "m"(ctxt->cs) : "rax");
-	/* We are in asmlinkage without stack frame, hence make C function
-	 * calls which will buy stack frames.
-	 */
-	hv_crash_restore_tss();
-	hv_crash_clear_kernpt();
-	/* we are now fully in devirtualized normal kernel mode */
-	__crash_kexec(NULL);
-	hv_panic_timeout_reboot();
 }
-/* Tell gcc we are using lretq long jump in the above function intentionally */
+/* Tell objtool we are using lretq long jump in the above function intentionally */
 STACK_FRAME_NON_STANDARD(hv_crash_c_entry);
 static void hv_mark_tss_not_busy(void)
 {
 	struct hv_crash_ctxt *ctxt = &hv_crash_ctxt;
-	asm volatile("movq %%rsp,%0" : "=m"(ctxt->rsp));
+	ctxt->rsp = current_stack_pointer;
 	ctxt->cr0 = native_read_cr0();
 	ctxt->cr4 = native_read_cr4();
-	asm volatile("movq %%cr2, %0" : "=a"(ctxt->cr2));
+	asm volatile("movq %%cr2, %0" : "=r"(ctxt->cr2));
-	asm volatile("movq %%cr8, %0" : "=a"(ctxt->cr8));
+	asm volatile("movq %%cr8, %0" : "=r"(ctxt->cr8));
-	asm volatile("movl %%cs, %%eax" : "=a"(ctxt->cs));
+	asm volatile("movw %%cs, %0" : "=m"(ctxt->cs));
-	asm volatile("movl %%ss, %%eax" : "=a"(ctxt->ss));
+	asm volatile("movw %%ss, %0" : "=m"(ctxt->ss));
-	asm volatile("movl %%ds, %%eax" : "=a"(ctxt->ds));
+	asm volatile("movw %%ds, %0" : "=m"(ctxt->ds));
-	asm volatile("movl %%es, %%eax" : "=a"(ctxt->es));
+	asm volatile("movw %%es, %0" : "=m"(ctxt->es));
-	asm volatile("movl %%fs, %%eax" : "=a"(ctxt->fs));
+	asm volatile("movw %%fs, %0" : "=m"(ctxt->fs));
-	asm volatile("movl %%gs, %%eax" : "=a"(ctxt->gs));
+	asm volatile("movw %%gs, %0" : "=m"(ctxt->gs));
 	native_store_gdt(&ctxt->gdtr);
 	store_idt(&ctxt->idtr);

arch/x86/kernel/apic/x2apic_uv_x.c+16−2

@@ -1708,8 +1708,22 @@ static void __init uv_system_init_hub(void) · 1707 unmodified lines
1708	struct uv_hub_info_s *new_hub;	1708	struct uv_hub_info_s *new_hub;
1709		1709
1710	/* Allocate & fill new per hub info list */	1710	/* Allocate & fill new per hub info list */
1711	new_hub = (bid == 0) ? &uv_hub_info_node0	1711	if (bid == 0) {
1712	: kzalloc_node(bytes, GFP_KERNEL, uv_blade_to_node(bid));	1712	new_hub = &uv_hub_info_node0;
		1713	} else {
		1714	int nid;
		1715
		1716	/*
		1717	* Deconfigured sockets are mapped to SOCK_EMPTY. Use
		1718	* NUMA_NO_NODE to allocate on a valid node.
		1719	*/
		1720	nid = uv_blade_to_node(bid);
		1721	if (nid == SOCK_EMPTY)
		1722	nid = NUMA_NO_NODE;
		1723
		1724	new_hub = kzalloc_node(bytes, GFP_KERNEL, nid);
		1725	}
		1726
1713	if (WARN_ON_ONCE(!new_hub)) {	1727	if (WARN_ON_ONCE(!new_hub)) {
1714	/* do not kfree() bid 0, which is statically allocated */	1728	/* do not kfree() bid 0, which is statically allocated */
1715	while (--bid > 0)	1729	while (--bid > 0)

arch/x86/kernel/cpu/mce/amd.c+11−6

 {
 	amd_reset_thr_limit(m->bank);
-	/* Clear MCA_DESTAT for all deferred errors even those logged in MCA_STATUS. */
+	if (mce_flags.smca) {
-	if (m->status & MCI_STATUS_DEFERRED)
+		/*
-		mce_wrmsrq(MSR_AMD64_SMCA_MCx_DESTAT(m->bank), 0);
+		 * Clear MCA_DESTAT for all deferred errors even those
+		 * logged in MCA_STATUS.
+		 */
+		if (m->status & MCI_STATUS_DEFERRED)
+			mce_wrmsrq(MSR_AMD64_SMCA_MCx_DESTAT(m->bank), 0);
-	/* Don't clear MCA_STATUS if MCA_DESTAT was used exclusively. */
+		/* Don't clear MCA_STATUS if MCA_DESTAT was used exclusively. */
-	if (m->kflags & MCE_CHECK_DFR_REGS)
+		if (m->kflags & MCE_CHECK_DFR_REGS)
-		return;
+			return;
+	}
 	mce_wrmsrq(mca_msr_reg(m->bank, MCA_STATUS), 0);
 }

arch/x86/kernel/cpu/mshyperv.c+3−2

@@ -496,8 +496,9 @@ static void hv_reserve_irq_vectors(void) · 495 unmodified lines
496	test_and_set_bit(HYPERV_DBG_FASTFAIL_VECTOR, system_vectors))	496	test_and_set_bit(HYPERV_DBG_FASTFAIL_VECTOR, system_vectors))
497	BUG();	497	BUG();
498		498
499	pr_info("Hyper-V: reserve vectors: %d %d %d\n", HYPERV_DBG_ASSERT_VECTOR,	499	pr_info("Hyper-V: reserve vectors: 0x%x 0x%x 0x%x\n",
500	HYPERV_DBG_SERVICE_VECTOR, HYPERV_DBG_FASTFAIL_VECTOR);	500	HYPERV_DBG_ASSERT_VECTOR, HYPERV_DBG_SERVICE_VECTOR,
		501	HYPERV_DBG_FASTFAIL_VECTOR);
501	}	502	}
502		503
503	static void __init ms_hyperv_init_platform(void)	504	static void __init ms_hyperv_init_platform(void)

drivers/acpi/acpi_processor.c+8−7

 				     PCI_ANY_ID, PCI_ANY_ID, NULL);
 		if (ide_dev) {
 			errata.piix4.bmisx = pci_resource_start(ide_dev, 4);
+			if (errata.piix4.bmisx)
+				dev_dbg(&ide_dev->dev,
+					"Bus master activity detection (BM-IDE) erratum enabled\n");
 			pci_dev_put(ide_dev);
 		}
 		if (isa_dev) {
 			pci_read_config_byte(isa_dev, 0x76, &value1);
 			pci_read_config_byte(isa_dev, 0x77, &value2);
-			if ((value1 & 0x80) || (value2 & 0x80))
+			if ((value1 & 0x80) || (value2 & 0x80)) {
 				errata.piix4.fdma = 1;
+				dev_dbg(&isa_dev->dev,
+					"Type-F DMA livelock erratum (C3 disabled)\n");
+			}
 			pci_dev_put(isa_dev);
 		}
 		break;
 	}
-	if (ide_dev)
-		dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
-	if (isa_dev)
-		dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
 	return 0;
 }

drivers/acpi/acpica/acpredef.h+1−1

@@ -451,7 +451,7 @@ const union acpi_predefined_info acpi_gbl_predefined_methods[] = { · 450 unmodified lines
451		451
452	{{"_DSM",	452	{{"_DSM",
453	METHOD_4ARGS(ACPI_TYPE_BUFFER, ACPI_TYPE_INTEGER, ACPI_TYPE_INTEGER,	453	METHOD_4ARGS(ACPI_TYPE_BUFFER, ACPI_TYPE_INTEGER, ACPI_TYPE_INTEGER,
454	ACPI_TYPE_ANY \| ACPI_TYPE_PACKAGE) \|	454	ACPI_TYPE_PACKAGE \| ACPI_TYPE_ANY) \|
455	ARG_COUNT_IS_MINIMUM,	455	ARG_COUNT_IS_MINIMUM,
456	METHOD_RETURNS(ACPI_RTYPE_ALL)}}, /* Must return a value, but it can be of any type */	456	METHOD_RETURNS(ACPI_RTYPE_ALL)}}, /* Must return a value, but it can be of any type */
457		457

drivers/acpi/bus.c+0−3

@@ -818,9 +818,6 @@ const struct acpi_device acpi_companion_match(const struct device dev) · 817 unmodified lines
818	if (list_empty(&adev->pnp.ids))	818	if (list_empty(&adev->pnp.ids))
819	return NULL;	819	return NULL;
820		820
821	if (adev->pnp.type.backlight)
822	return adev;
823
824	return acpi_primary_dev_companion(adev, dev);	821	return acpi_primary_dev_companion(adev, dev);
825	}	822	}
826		823

drivers/ata/libata-core.c+3−0

@@ -4188,6 +4188,9 @@ static const struct ata_dev_quirks_entry __ata_dev_quirks[] = { · 4187 unmodified lines
4188	{ "ST3320[68]13AS", "SD1[5-9]", ATA_QUIRK_NONCQ \|	4188	{ "ST3320[68]13AS", "SD1[5-9]", ATA_QUIRK_NONCQ \|
4189	ATA_QUIRK_FIRMWARE_WARN },	4189	ATA_QUIRK_FIRMWARE_WARN },
4190		4190
		4191	/* ADATA devices with LPM issues. */
		4192	{ "ADATA SU680", NULL, ATA_QUIRK_NOLPM },
		4193
4191	/* Seagate disks with LPM issues */	4194	/* Seagate disks with LPM issues */
4192	{ "ST1000DM010-2EP102", NULL, ATA_QUIRK_NOLPM },	4195	{ "ST1000DM010-2EP102", NULL, ATA_QUIRK_NOLPM },
4193	{ "ST2000DM008-2FR102", NULL, ATA_QUIRK_NOLPM },	4196	{ "ST2000DM008-2FR102", NULL, ATA_QUIRK_NOLPM },

drivers/ata/libata-scsi.c+1−1

@@ -3600,7 +3600,7 @@ static unsigned int ata_scsiop_maint_in(struct ata_device *dev, · 3599 unmodified lines
3600		3600
3601	if (cdb[2] != 1 && cdb[2] != 3) {	3601	if (cdb[2] != 1 && cdb[2] != 3) {
3602	ata_dev_warn(dev, "invalid command format %d\n", cdb[2]);	3602	ata_dev_warn(dev, "invalid command format %d\n", cdb[2]);
3603	ata_scsi_set_invalid_field(dev, cmd, 1, 0xff);	3603	ata_scsi_set_invalid_field(dev, cmd, 2, 0xff);
3604	return 0;	3604	return 0;
3605	}	3605	}
3606		3606

drivers/base/bus.c+42−1

@@ -504,6 +504,36 @@ int bus_for_each_drv(const struct bus_type bus, struct device_driver start, · 503 unmodified lines
504	}	504	}
505	EXPORT_SYMBOL_GPL(bus_for_each_drv);	505	EXPORT_SYMBOL_GPL(bus_for_each_drv);
506		506
		507	static ssize_t driver_override_store(struct device *dev,
		508	struct device_attribute *attr,
		509	const char *buf, size_t count)
		510	{
		511	int ret;
		512
		513	ret = __device_set_driver_override(dev, buf, count);
		514	if (ret)
		515	return ret;
		516
		517	return count;
		518	}
		519
		520	static ssize_t driver_override_show(struct device *dev,
		521	struct device_attribute attr, char buf)
		522	{
		523	guard(spinlock)(&dev->driver_override.lock);
		524	return sysfs_emit(buf, "%s\n", dev->driver_override.name);
		525	}
		526	static DEVICE_ATTR_RW(driver_override);
		527
		528	static struct attribute *driver_override_dev_attrs[] = {
		529	&dev_attr_driver_override.attr,
		530	NULL,
		531	};
		532
		533	static const struct attribute_group driver_override_dev_group = {
		534	.attrs = driver_override_dev_attrs,
		535	};
		536
507	/**	537	/**
508	* bus_add_device - add device to bus	538	* bus_add_device - add device to bus
509	* @dev: device being added	539	* @dev: device being added
@@ -537,9 +567,15 @@ int bus_add_device(struct device *dev) · 27 unmodified lines
537	if (error)	567	if (error)
538	goto out_put;	568	goto out_put;
539		569
		570	if (dev->bus->driver_override) {
		571	error = device_add_group(dev, &driver_override_dev_group);
		572	if (error)
		573	goto out_groups;
		574	}
		575
540	error = sysfs_create_link(&sp->devices_kset->kobj, &dev->kobj, dev_name(dev));	576	error = sysfs_create_link(&sp->devices_kset->kobj, &dev->kobj, dev_name(dev));
541	if (error)	577	if (error)
542	goto out_groups;	578	goto out_override;
543		579
544	error = sysfs_create_link(&dev->kobj, &sp->subsys.kobj, "subsystem");	580	error = sysfs_create_link(&dev->kobj, &sp->subsys.kobj, "subsystem");
545	if (error)	581	if (error)
@@ -550,6 +586,9 @@ int bus_add_device(struct device *dev) · 4 unmodified lines
550		586
551	out_subsys:	587	out_subsys:
552	sysfs_remove_link(&sp->devices_kset->kobj, dev_name(dev));	588	sysfs_remove_link(&sp->devices_kset->kobj, dev_name(dev));
		589	out_override:
		590	if (dev->bus->driver_override)
		591	device_remove_group(dev, &driver_override_dev_group);
553	out_groups:	592	out_groups:
554	device_remove_groups(dev, sp->bus->dev_groups);	593	device_remove_groups(dev, sp->bus->dev_groups);
555	out_put:	594	out_put:
@@ -607,6 +646,8 @@ void bus_remove_device(struct device *dev) · 51 unmodified lines
607		646
608	sysfs_remove_link(&dev->kobj, "subsystem");	647	sysfs_remove_link(&dev->kobj, "subsystem");
609	sysfs_remove_link(&sp->devices_kset->kobj, dev_name(dev));	648	sysfs_remove_link(&sp->devices_kset->kobj, dev_name(dev));
		649	if (dev->bus->driver_override)
		650	device_remove_group(dev, &driver_override_dev_group);
610	device_remove_groups(dev, dev->bus->dev_groups);	651	device_remove_groups(dev, dev->bus->dev_groups);
611	if (klist_node_attached(&dev->p->knode_bus))	652	if (klist_node_attached(&dev->p->knode_bus))
612	klist_del(&dev->p->knode_bus);	653	klist_del(&dev->p->knode_bus);

drivers/base/core.c+2−0

 	devres_release_all(dev);
 	kfree(dev->dma_range_map);
+	kfree(dev->driver_override.name);
 	if (dev->release)
 		dev->release(dev);
 	kobject_init(&dev->kobj, &device_ktype);
 	INIT_LIST_HEAD(&dev->dma_pools);
 	mutex_init(&dev->mutex);
+	spin_lock_init(&dev->driver_override.lock);
 	lockdep_set_novalidate_class(&dev->mutex);
 	spin_lock_init(&dev->devres_lock);
 	INIT_LIST_HEAD(&dev->devres_head);

drivers/base/dd.c+60−0

@@ -381,6 +381,66 @@ static void __exit deferred_probe_exit(void) · 380 unmodified lines
381	}	381	}
382	__exitcall(deferred_probe_exit);	382	__exitcall(deferred_probe_exit);
383		383
		384	int __device_set_driver_override(struct device dev, const char s, size_t len)
		385	{
		386	const char new, old;
		387	char *cp;
		388
		389	if (!s)
		390	return -EINVAL;
		391
		392	/*
		393	* The stored value will be used in sysfs show callback (sysfs_emit()),
		394	* which has a length limit of PAGE_SIZE and adds a trailing newline.
		395	* Thus we can store one character less to avoid truncation during sysfs
		396	* show.
		397	*/
		398	if (len >= (PAGE_SIZE - 1))
		399	return -EINVAL;
		400
		401	/*
		402	* Compute the real length of the string in case userspace sends us a
		403	* bunch of \0 characters like python likes to do.
		404	*/
		405	len = strlen(s);
		406
		407	if (!len) {
		408	/* Empty string passed - clear override */
		409	spin_lock(&dev->driver_override.lock);
		410	old = dev->driver_override.name;
		411	dev->driver_override.name = NULL;
		412	spin_unlock(&dev->driver_override.lock);
		413	kfree(old);
		414
		415	return 0;
		416	}
		417
		418	cp = strnchr(s, len, '\n');
		419	if (cp)
		420	len = cp - s;
		421
		422	new = kstrndup(s, len, GFP_KERNEL);
		423	if (!new)
		424	return -ENOMEM;
		425
		426	spin_lock(&dev->driver_override.lock);
		427	old = dev->driver_override.name;
		428	if (cp != s) {
		429	dev->driver_override.name = new;
		430	spin_unlock(&dev->driver_override.lock);
		431	} else {
		432	/* "\n" passed - clear override */
		433	dev->driver_override.name = NULL;
		434	spin_unlock(&dev->driver_override.lock);
		435
		436	kfree(new);
		437	}
		438	kfree(old);
		439
		440	return 0;
		441	}
		442	EXPORT_SYMBOL_GPL(__device_set_driver_override);
		443
384	/**	444	/**
385	* device_is_bound() - Check if device is bound to a driver	445	* device_is_bound() - Check if device is bound to a driver
386	* @dev: device to check	446	* @dev: device to check

drivers/base/platform.c+5−32

 	kfree(pa->pdev.dev.platform_data);
 	kfree(pa->pdev.mfd_cell);
 	kfree(pa->pdev.resource);
-	kfree(pa->pdev.driver_override);
 	kfree(pa);
 }
 }
 static DEVICE_ATTR_RO(numa_node);
-static ssize_t driver_override_show(struct device *dev,
-				    struct device_attribute *attr, char *buf)
-{
-	struct platform_device *pdev = to_platform_device(dev);
-	ssize_t len;
-	device_lock(dev);
-	len = sysfs_emit(buf, "%s\n", pdev->driver_override);
-	device_unlock(dev);
-	return len;
-}
-static ssize_t driver_override_store(struct device *dev,
-				     struct device_attribute *attr,
-				     const char *buf, size_t count)
-{
-	struct platform_device *pdev = to_platform_device(dev);
-	int ret;
-	ret = driver_set_override(dev, &pdev->driver_override, buf, count);
-	if (ret)
-		return ret;
-	return count;
-}
-static DEVICE_ATTR_RW(driver_override);
 static struct attribute *platform_dev_attrs[] = {
 	&dev_attr_modalias.attr,
 	&dev_attr_numa_node.attr,
-	&dev_attr_driver_override.attr,
 	NULL,
 };
 {
 	struct platform_device *pdev = to_platform_device(dev);
 	struct platform_driver *pdrv = to_platform_driver(drv);
+	int ret;
 	/* When driver_override is set, only bind to the matching driver */
-	if (pdev->driver_override)
+	ret = device_match_driver_override(dev, drv);
-		return !strcmp(pdev->driver_override, drv->name);
+	if (ret >= 0)
+		return ret;
 	/* Attempt an OF style match first */
 	if (of_driver_match_device(dev, drv))
 const struct bus_type platform_bus_type = {
 	.name		= "platform",
 	.dev_groups	= platform_dev_groups,
+	.driver_override = true,
 	.match		= platform_match,
 	.uevent		= platform_uevent,
 	.probe		= platform_probe,

drivers/base/power/runtime.c+1−0

@@ -1895,6 +1895,7 @@ void pm_runtime_reinit(struct device *dev) · 1894 unmodified lines
1895	void pm_runtime_remove(struct device *dev)	1895	void pm_runtime_remove(struct device *dev)
1896	{	1896	{
1897	__pm_runtime_disable(dev, false);	1897	__pm_runtime_disable(dev, false);
		1898	flush_work(&dev->power.work);
1898	pm_runtime_reinit(dev);	1899	pm_runtime_reinit(dev);
1899	}	1900	}
1900		1901

drivers/bluetooth/btqca.c+2−0

@@ -787,6 +787,8 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate, · 786 unmodified lines
787	*/	787	*/
788	if (soc_type == QCA_WCN3988)	788	if (soc_type == QCA_WCN3988)
789	rom_ver = ((soc_ver & 0x00000f00) >> 0x05) \| (soc_ver & 0x0000000f);	789	rom_ver = ((soc_ver & 0x00000f00) >> 0x05) \| (soc_ver & 0x0000000f);
		790	else if (soc_type == QCA_WCN3998)
		791	rom_ver = ((soc_ver & 0x0000f000) >> 0x07) \| (soc_ver & 0x0000000f);
790	else	792	else
791	rom_ver = ((soc_ver & 0x00000f00) >> 0x04) \| (soc_ver & 0x0000000f);	793	rom_ver = ((soc_ver & 0x00000f00) >> 0x04) \| (soc_ver & 0x0000000f);
792		794

drivers/bus/simple-pm-bus.c+2−2

@@ -36,7 +36,7 @@ static int simple_pm_bus_probe(struct platform_device *pdev) · 35 unmodified lines
36	* that's not listed in simple_pm_bus_of_match. We don't want to do any	36	* that's not listed in simple_pm_bus_of_match. We don't want to do any
37	* of the simple-pm-bus tasks for these devices, so return early.	37	* of the simple-pm-bus tasks for these devices, so return early.
38	*/	38	*/
39	if (pdev->driver_override)	39	if (device_has_driver_override(&pdev->dev))
40	return 0;	40	return 0;
41		41
42	match = of_match_device(dev->driver->of_match_table, dev);	42	match = of_match_device(dev->driver->of_match_table, dev);
@@ -78,7 +78,7 @@ static void simple_pm_bus_remove(struct platform_device *pdev) · 35 unmodified lines
78	{	78	{
79	const void *data = of_device_get_match_data(&pdev->dev);	79	const void *data = of_device_get_match_data(&pdev->dev);
80		80
81	if (pdev->driver_override \|\| data)	81	if (device_has_driver_override(&pdev->dev) \|\| data)
82	return;	82	return;
83		83
84	dev_dbg(&pdev->dev, "%s\n", __func__);	84	dev_dbg(&pdev->dev, "%s\n", __func__);

drivers/cache/ax45mp_cache.c+2−2

 static int __init ax45mp_cache_init(void)
 {
-	struct device_node *np;
 	struct resource res;
 	int ret;
-	np = of_find_matching_node(NULL, ax45mp_cache_ids);
+	struct device_node *np __free(device_node) =
+		of_find_matching_node(NULL, ax45mp_cache_ids);
 	if (!of_device_is_available(np))
 		return -ENODEV;

drivers/cache/starfive_starlink_cache.c+2−2

 static int __init starlink_cache_init(void)
 {
-	struct device_node *np;
 	u32 block_size;
 	int ret;
-	np = of_find_matching_node(NULL, starlink_cache_ids);
+	struct device_node *np __free(device_node) =
+		of_find_matching_node(NULL, starlink_cache_ids);
 	if (!of_device_is_available(np))
 		return -ENODEV;

drivers/clk/imx/clk-scu.c+1−2

@@ -706,8 +706,7 @@ struct clk_hw imx_clk_scu_alloc_dev(const char name, · 705 unmodified lines
706	if (ret)	706	if (ret)
707	goto put_device;	707	goto put_device;
708		708
709	ret = driver_set_override(&pdev->dev, &pdev->driver_override,	709	ret = device_set_driver_override(&pdev->dev, "imx-scu-clk");
710	"imx-scu-clk", strlen("imx-scu-clk"));
711	if (ret)	710	if (ret)
712	goto put_device;	711	goto put_device;
713		712

drivers/crypto/ccp/sev-dev.c+1−3

 		 * in Firmware state on failure. Use snp_reclaim_pages() to
 		 * transition either case back to Hypervisor-owned state.
 		 */
-		if (snp_reclaim_pages(__pa(data), 1, true)) {
+		if (snp_reclaim_pages(__pa(data), 1, true))
-			snp_leak_pages(__page_to_pfn(status_page), 1);
 			return -EFAULT;
-		}
 	}
 	if (ret)

drivers/crypto/padlock-sha.c+7−0

@@ -332,6 +332,13 @@ static int __init padlock_init(void) · 331 unmodified lines
332	if (!x86_match_cpu(padlock_sha_ids) \|\| !boot_cpu_has(X86_FEATURE_PHE_EN))	332	if (!x86_match_cpu(padlock_sha_ids) \|\| !boot_cpu_has(X86_FEATURE_PHE_EN))
333	return -ENODEV;	333	return -ENODEV;
334		334
		335	/*
		336	* Skip family 0x07 and newer used by Zhaoxin processors,
		337	* as the driver's self-tests fail on these CPUs.
		338	*/
		339	if (c->x86 >= 0x07)
		340	return -ENODEV;
		341
335	/* Register the newly added algorithm module if on *	342	/* Register the newly added algorithm module if on *
336	* VIA Nano processor, or else just do as before */	343	* VIA Nano processor, or else just do as before */
337	if (c->x86_model < 0x0f) {	344	if (c->x86_model < 0x0f) {

drivers/firewire/net.c+3−2

 	memcpy((u8 *)hh->hh_data + HH_DATA_OFF(FWNET_HLEN), haddr, net->addr_len);
 }
-static int fwnet_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+static int fwnet_header_parse(const struct sk_buff *skb, const struct net_device *dev,
+			      unsigned char *haddr)
 {
-	memcpy(haddr, skb->dev->dev_addr, FWNET_ALEN);
+	memcpy(haddr, dev->dev_addr, FWNET_ALEN);
 	return FWNET_ALEN;
 }

drivers/firmware/arm_ffa/driver.c+4−4

@@ -205,12 +205,12 @@ static int ffa_rxtx_map(phys_addr_t tx_buf, phys_addr_t rx_buf, u32 pg_cnt) · 204 unmodified lines
205	return 0;	205	return 0;
206	}	206	}
207		207
208	static int ffa_rxtx_unmap(u16 vm_id)	208	static int ffa_rxtx_unmap(void)
209	{	209	{
210	ffa_value_t ret;	210	ffa_value_t ret;
211		211
212	invoke_ffa_fn((ffa_value_t){	212	invoke_ffa_fn((ffa_value_t){
213	.a0 = FFA_RXTX_UNMAP, .a1 = PACK_TARGET_INFO(vm_id, 0),	213	.a0 = FFA_RXTX_UNMAP,
214	}, &ret);	214	}, &ret);
215		215
216	if (ret.a0 == FFA_ERROR)	216	if (ret.a0 == FFA_ERROR)
@@ -2097,7 +2097,7 @@ static int __init ffa_init(void) · 1880 unmodified lines
2097		2097
2098	pr_err("failed to setup partitions\n");	2098	pr_err("failed to setup partitions\n");
2099	ffa_notifications_cleanup();	2099	ffa_notifications_cleanup();
2100	ffa_rxtx_unmap(drv_info->vm_id);	2100	ffa_rxtx_unmap();
2101	free_pages:	2101	free_pages:
2102	if (drv_info->tx_buffer)	2102	if (drv_info->tx_buffer)
2103	free_pages_exact(drv_info->tx_buffer, rxtx_bufsz);	2103	free_pages_exact(drv_info->tx_buffer, rxtx_bufsz);
@@ -2112,7 +2112,7 @@ static void __exit ffa_exit(void) · 8 unmodified lines
2112	{	2112	{
2113	ffa_notifications_cleanup();	2113	ffa_notifications_cleanup();
2114	ffa_partitions_cleanup();	2114	ffa_partitions_cleanup();
2115	ffa_rxtx_unmap(drv_info->vm_id);	2115	ffa_rxtx_unmap();
2116	free_pages_exact(drv_info->tx_buffer, drv_info->rxtx_bufsz);	2116	free_pages_exact(drv_info->tx_buffer, drv_info->rxtx_bufsz);
2117	free_pages_exact(drv_info->rx_buffer, drv_info->rxtx_bufsz);	2117	free_pages_exact(drv_info->rx_buffer, drv_info->rxtx_bufsz);
2118	kfree(drv_info);	2118	kfree(drv_info);

drivers/firmware/arm_scmi/notify.c+2−2

@@ -1066,7 +1066,7 @@ static int scmi_register_event_handler(struct scmi_notify_instance *ni, · 1065 unmodified lines
1066	* since at creation time we usually want to have all setup and ready before	1066	* since at creation time we usually want to have all setup and ready before
1067	* events really start flowing.	1067	* events really start flowing.
1068	*	1068	*
1069	* Return: A properly refcounted handler on Success, NULL on Failure	1069	* Return: A properly refcounted handler on Success, ERR_PTR on Failure
1070	*/	1070	*/
1071	static inline struct scmi_event_handler *	1071	static inline struct scmi_event_handler *
1072	__scmi_event_handler_get_ops(struct scmi_notify_instance *ni,	1072	__scmi_event_handler_get_ops(struct scmi_notify_instance *ni,
@@ -1113,7 +1113,7 @@ __scmi_event_handler_get_ops(struct scmi_notify_instance *ni, · 40 unmodified lines
1113	}	1113	}
1114	mutex_unlock(&ni->pending_mtx);	1114	mutex_unlock(&ni->pending_mtx);
1115		1115
1116	return hndl;	1116	return hndl ?: ERR_PTR(-ENODEV);
1117	}	1117	}
1118		1118
1119	static struct scmi_event_handler *	1119	static struct scmi_event_handler *

drivers/firmware/arm_scmi/protocols.h+2−2

@@ -189,13 +189,13 @@ struct scmi_protocol_handle { · 188 unmodified lines
189		189
190	/**	190	/**
191	* struct scmi_iterator_state - Iterator current state descriptor	191	* struct scmi_iterator_state - Iterator current state descriptor
192	* @desc_index: Starting index for the current mulit-part request.	192	* @desc_index: Starting index for the current multi-part request.
193	* @num_returned: Number of returned items in the last multi-part reply.	193	* @num_returned: Number of returned items in the last multi-part reply.
194	* @num_remaining: Number of remaining items in the multi-part message.	194	* @num_remaining: Number of remaining items in the multi-part message.
195	* @max_resources: Maximum acceptable number of items, configured by the caller	195	* @max_resources: Maximum acceptable number of items, configured by the caller
196	* depending on the underlying resources that it is querying.	196	* depending on the underlying resources that it is querying.
197	* @loop_idx: The iterator loop index in the current multi-part reply.	197	* @loop_idx: The iterator loop index in the current multi-part reply.
198	* @rx_len: Size in bytes of the currenly processed message; it can be used by	198	* @rx_len: Size in bytes of the currently processed message; it can be used by
199	* the user of the iterator to verify a reply size.	199	* the user of the iterator to verify a reply size.
200	* @priv: Optional pointer to some additional state-related private data setup	200	* @priv: Optional pointer to some additional state-related private data setup
201	* by the caller during the iterations.	201	* by the caller during the iterations.

drivers/firmware/arm_scpi.c+3−2

 #include <linux/bitmap.h>
 #include <linux/bitfield.h>
+#include <linux/cleanup.h>
 #include <linux/device.h>
 #include <linux/err.h>
 #include <linux/export.h>
 		int idx = scpi_drvinfo->num_chans;
 		struct scpi_chan *pchan = scpi_drvinfo->channels + idx;
 		struct mbox_client *cl = &pchan->cl;
-		struct device_node *shmem = of_parse_phandle(np, "shmem", idx);
+		struct device_node *shmem __free(device_node) =
+			of_parse_phandle(np, "shmem", idx);
 		if (!of_match_node(shmem_of_match, shmem))
 			return -ENXIO;
 		ret = of_address_to_resource(shmem, 0, &res);
-		of_node_put(shmem);
 		if (ret) {
 			dev_err(dev, "failed to get SCPI payload mem resource\n");
 			return ret;

drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c+4−0

 #define AMDGPU_BO_LIST_MAX_PRIORITY	32u
 #define AMDGPU_BO_LIST_NUM_BUCKETS	(AMDGPU_BO_LIST_MAX_PRIORITY + 1)
+#define AMDGPU_BO_LIST_MAX_ENTRIES	(128 * 1024)
 static void amdgpu_bo_list_free_rcu(struct rcu_head *rcu)
 {
 	const uint32_t bo_number = in->bo_number;
 	struct drm_amdgpu_bo_list_entry *info;
+	if (bo_number > AMDGPU_BO_LIST_MAX_ENTRIES)
+		return -EINVAL;
 	/* copy the handle array from userspace to a kernel buffer */
 	if (likely(info_size == bo_info_size)) {
 		info = vmemdup_array_user(uptr, bo_number, info_size);

drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c+6−1

 	}
 	/* Prepare a TLB flush fence to be attached to PTs */
-	if (!params->unlocked) {
+	/* The check for need_tlb_fence should be dropped once we
+	 * sort out the issues with KIQ/MES TLB invalidation timeouts.
+	 */
+	if (!params->unlocked && vm->need_tlb_fence) {
 		amdgpu_vm_tlb_fence_create(params->adev, vm, fence);
 		/* Makes sure no PD/PT is freed before the flush */
 	ttm_lru_bulk_move_init(&vm->lru_bulk_move);
 	vm->is_compute_context = false;
+	vm->need_tlb_fence = amdgpu_userq_enabled(&adev->ddev);
 	vm->use_cpu_for_update = !!(adev->vm_manager.vm_update_mode &
 				    AMDGPU_VM_USE_CPU_FOR_GFX);
 	dma_fence_put(vm->last_update);
 	vm->last_update = dma_fence_get_stub();
 	vm->is_compute_context = true;
+	vm->need_tlb_fence = true;
 unreserve_bo:
 	amdgpu_bo_unreserve(vm->root.bo);

drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h+2−0

@@ -441,6 +441,8 @@ struct amdgpu_vm { · 440 unmodified lines
441	struct ttm_lru_bulk_move lru_bulk_move;	441	struct ttm_lru_bulk_move lru_bulk_move;
442	/* Flag to indicate if VM is used for compute */	442	/* Flag to indicate if VM is used for compute */
443	bool is_compute_context;	443	bool is_compute_context;
		444	/* Flag to indicate if VM needs a TLB fence (KFD or KGD) */
		445	bool need_tlb_fence;
444		446
445	/* Memory partition number, -1 means any partition */	447	/* Memory partition number, -1 means any partition */
446	int8_t mem_id;	448	int8_t mem_id;

drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c+14−7

 	} else {
 		switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
 		case IP_VERSION(9, 0, 0):
-			mmhub_cid = mmhub_client_ids_vega10[cid][rw];
+			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega10) ?
+				mmhub_client_ids_vega10[cid][rw] : NULL;
 			break;
 		case IP_VERSION(9, 3, 0):
-			mmhub_cid = mmhub_client_ids_vega12[cid][rw];
+			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega12) ?
+				mmhub_client_ids_vega12[cid][rw] : NULL;
 			break;
 		case IP_VERSION(9, 4, 0):
-			mmhub_cid = mmhub_client_ids_vega20[cid][rw];
+			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega20) ?
+				mmhub_client_ids_vega20[cid][rw] : NULL;
 			break;
 		case IP_VERSION(9, 4, 1):
-			mmhub_cid = mmhub_client_ids_arcturus[cid][rw];
+			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_arcturus) ?
+				mmhub_client_ids_arcturus[cid][rw] : NULL;
 			break;
 		case IP_VERSION(9, 1, 0):
 		case IP_VERSION(9, 2, 0):
-			mmhub_cid = mmhub_client_ids_raven[cid][rw];
+			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_raven) ?
+				mmhub_client_ids_raven[cid][rw] : NULL;
 			break;
 		case IP_VERSION(1, 5, 0):
 		case IP_VERSION(2, 4, 0):
-			mmhub_cid = mmhub_client_ids_renoir[cid][rw];
+			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_renoir) ?
+				mmhub_client_ids_renoir[cid][rw] : NULL;
 			break;
 		case IP_VERSION(1, 8, 0):
 		case IP_VERSION(9, 4, 2):
-			mmhub_cid = mmhub_client_ids_aldebaran[cid][rw];
+			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_aldebaran) ?
+				mmhub_client_ids_aldebaran[cid][rw] : NULL;
 			break;
 		default:
 			mmhub_cid = NULL;

drivers/gpu/drm/amd/amdgpu/isp_v4_1_1.c+2−2

@@ -129,7 +129,7 @@ static int isp_genpd_add_device(struct device dev, void data) · 128 unmodified lines
129	if (!pdev)	129	if (!pdev)
130	return -EINVAL;	130	return -EINVAL;
131		131
132	if (!dev->type->name) {	132	if (!dev->type \|\| !dev->type->name) {
133	drm_dbg(&adev->ddev, "Invalid device type to add\n");	133	drm_dbg(&adev->ddev, "Invalid device type to add\n");
134	goto exit;	134	goto exit;
135	}	135	}
@@ -165,7 +165,7 @@ static int isp_genpd_remove_device(struct device dev, void data) · 29 unmodified lines
165	if (!pdev)	165	if (!pdev)
166	return -EINVAL;	166	return -EINVAL;
167		167
168	if (!dev->type->name) {	168	if (!dev->type \|\| !dev->type->name) {
169	drm_dbg(&adev->ddev, "Invalid device type to remove\n");	169	drm_dbg(&adev->ddev, "Invalid device type to remove\n");
170	goto exit;	170	goto exit;
171	}	171	}

drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c+6−3

 	switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
 	case IP_VERSION(2, 0, 0):
 	case IP_VERSION(2, 0, 2):
-		mmhub_cid = mmhub_client_ids_navi1x[cid][rw];
+		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_navi1x) ?
+			mmhub_client_ids_navi1x[cid][rw] : NULL;
 		break;
 	case IP_VERSION(2, 1, 0):
 	case IP_VERSION(2, 1, 1):
-		mmhub_cid = mmhub_client_ids_sienna_cichlid[cid][rw];
+		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_sienna_cichlid) ?
+			mmhub_client_ids_sienna_cichlid[cid][rw] : NULL;
 		break;
 	case IP_VERSION(2, 1, 2):
-		mmhub_cid = mmhub_client_ids_beige_goby[cid][rw];
+		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_beige_goby) ?
+			mmhub_client_ids_beige_goby[cid][rw] : NULL;
 		break;
 	default:
 		mmhub_cid = NULL;

drivers/gpu/drm/amd/amdgpu/mmhub_v2_3.c+2−1

 	case IP_VERSION(2, 3, 0):
 	case IP_VERSION(2, 4, 0):
 	case IP_VERSION(2, 4, 1):
-		mmhub_cid = mmhub_client_ids_vangogh[cid][rw];
+		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vangogh) ?
+			mmhub_client_ids_vangogh[cid][rw] : NULL;
 		break;
 	default:
 		mmhub_cid = NULL;

drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c+2−1

 	switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
 	case IP_VERSION(3, 0, 0):
 	case IP_VERSION(3, 0, 1):
-		mmhub_cid = mmhub_client_ids_v3_0_0[cid][rw];
+		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_0_0) ?
+			mmhub_client_ids_v3_0_0[cid][rw] : NULL;
 		break;
 	default:
 		mmhub_cid = NULL;

drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c+2−1

@@ -117,7 +117,8 @@ mmhub_v3_0_1_print_l2_protection_fault_status(struct amdgpu_device *adev, · 116 unmodified lines
117		117
118	switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {	118	switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
119	case IP_VERSION(3, 0, 1):	119	case IP_VERSION(3, 0, 1):
120	mmhub_cid = mmhub_client_ids_v3_0_1[cid][rw];	120	mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_0_1) ?
		121	mmhub_client_ids_v3_0_1[cid][rw] : NULL;
121	break;	122	break;
122	default:	123	default:
123	mmhub_cid = NULL;	124	mmhub_cid = NULL;

drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_2.c+2−1

@@ -108,7 +108,8 @@ mmhub_v3_0_2_print_l2_protection_fault_status(struct amdgpu_device *adev, · 107 unmodified lines
108	"MMVM_L2_PROTECTION_FAULT_STATUS:0x%08X\n",	108	"MMVM_L2_PROTECTION_FAULT_STATUS:0x%08X\n",
109	status);	109	status);
110		110
111	mmhub_cid = mmhub_client_ids_v3_0_2[cid][rw];	111	mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_0_2) ?
		112	mmhub_client_ids_v3_0_2[cid][rw] : NULL;
112	dev_err(adev->dev, "\t Faulty UTCL2 client ID: %s (0x%x)\n",	113	dev_err(adev->dev, "\t Faulty UTCL2 client ID: %s (0x%x)\n",
113	mmhub_cid ? mmhub_cid : "unknown", cid);	114	mmhub_cid ? mmhub_cid : "unknown", cid);
114	dev_err(adev->dev, "\t MORE_FAULTS: 0x%lx\n",	115	dev_err(adev->dev, "\t MORE_FAULTS: 0x%lx\n",

drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c+2−1

 		status);
 	switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
 	case IP_VERSION(4, 1, 0):
-		mmhub_cid = mmhub_client_ids_v4_1_0[cid][rw];
+		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v4_1_0) ?
+			mmhub_client_ids_v4_1_0[cid][rw] : NULL;
 		break;
 	default:
 		mmhub_cid = NULL;

drivers/gpu/drm/amd/amdgpu/mmhub_v4_2_0.c+2−1

 		status);
 	switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
 	case IP_VERSION(4, 2, 0):
-		mmhub_cid = mmhub_client_ids_v4_2_0[cid][rw];
+		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v4_2_0) ?
+			mmhub_client_ids_v4_2_0[cid][rw] : NULL;
 		break;
 	default:
 		mmhub_cid = NULL;

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c+3−3

@@ -2554,7 +2554,7 @@ static int dm_dmub_sw_init(struct amdgpu_device *adev) · 2553 unmodified lines
2554	fw_meta_info_params.fw_inst_const = adev->dm.dmub_fw->data +	2554	fw_meta_info_params.fw_inst_const = adev->dm.dmub_fw->data +
2555	le32_to_cpu(hdr->header.ucode_array_offset_bytes) +	2555	le32_to_cpu(hdr->header.ucode_array_offset_bytes) +
2556	PSP_HEADER_BYTES_256;	2556	PSP_HEADER_BYTES_256;
2557	fw_meta_info_params.fw_bss_data = region_params.bss_data_size ? adev->dm.dmub_fw->data +	2557	fw_meta_info_params.fw_bss_data = fw_meta_info_params.bss_data_size ? adev->dm.dmub_fw->data +
2558	le32_to_cpu(hdr->header.ucode_array_offset_bytes) +	2558	le32_to_cpu(hdr->header.ucode_array_offset_bytes) +
2559	le32_to_cpu(hdr->inst_const_bytes) : NULL;	2559	le32_to_cpu(hdr->inst_const_bytes) : NULL;
2560	fw_meta_info_params.custom_psp_footer_size = 0;	2560	fw_meta_info_params.custom_psp_footer_size = 0;
@@ -13119,7 +13119,7 @@ static void parse_edid_displayid_vrr(struct drm_connector *connector, · 10558 unmodified lines
13119	u16 min_vfreq;	13119	u16 min_vfreq;
13120	u16 max_vfreq;	13120	u16 max_vfreq;
13121		13121
13122	if (edid == NULL \|\| edid->extensions == 0)	13122	if (!edid \|\| !edid->extensions)
13123	return;	13123	return;
13124		13124
13125	/* Find DisplayID extension */	13125	/* Find DisplayID extension */
@@ -13129,7 +13129,7 @@ static void parse_edid_displayid_vrr(struct drm_connector *connector, · 3 unmodified lines
13129	break;	13129	break;
13130	}	13130	}
13131		13131
13132	if (edid_ext == NULL)	13132	if (i == edid->extensions)
13133	return;	13133	return;
13134		13134
13135	while (j < EDID_LENGTH) {	13135	while (j < EDID_LENGTH) {

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_colorop.c+3−3

drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c+4−4

 			BREAK_TO_DEBUGGER();
 			return NULL;
 		}
+		if (ctx->dce_version == DCN_VERSION_2_01) {
+			dcn201_clk_mgr_construct(ctx, clk_mgr, pp_smu, dccg);
+			return &clk_mgr->base;
+		}
 		if (ASICREV_IS_SIENNA_CICHLID_P(asic_id.hw_internal_rev)) {
 			dcn3_clk_mgr_construct(ctx, clk_mgr, pp_smu, dccg);
 			return &clk_mgr->base;
 			dcn3_clk_mgr_construct(ctx, clk_mgr, pp_smu, dccg);
 			return &clk_mgr->base;
 		}
-		if (ctx->dce_version == DCN_VERSION_2_01) {
-			dcn201_clk_mgr_construct(ctx, clk_mgr, pp_smu, dccg);
-			return &clk_mgr->base;
-		}
 		dcn20_clk_mgr_construct(ctx, clk_mgr, pp_smu, dccg);
 		return &clk_mgr->base;
 	}

drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c+3−0

@@ -1785,7 +1785,10 @@ static bool dml1_validate(struct dc dc, struct dc_state context, enum dc_valid · 1784 unmodified lines
1785		1785
1786	dc->res_pool->funcs->calculate_wm_and_dlg(dc, context, pipes, pipe_cnt, vlevel);	1786	dc->res_pool->funcs->calculate_wm_and_dlg(dc, context, pipes, pipe_cnt, vlevel);
1787		1787
		1788	DC_FP_START();
1788	dcn32_override_min_req_memclk(dc, context);	1789	dcn32_override_min_req_memclk(dc, context);
		1790	DC_FP_END();
		1791
1789	dcn32_override_min_req_dcfclk(dc, context);	1792	dcn32_override_min_req_dcfclk(dc, context);
1790		1793
1791	BW_VAL_TRACE_END_WATERMARKS();	1794	BW_VAL_TRACE_END_WATERMARKS();

drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c+3−1

 	if (adev->asic_type == CHIP_HAINAN) {
 		if ((adev->pdev->revision == 0x81) ||
 		    (adev->pdev->revision == 0xC3) ||
+		    (adev->pdev->device == 0x6660) ||
 		    (adev->pdev->device == 0x6664) ||
 		    (adev->pdev->device == 0x6665) ||
-		    (adev->pdev->device == 0x6667)) {
+		    (adev->pdev->device == 0x6667) ||
+		    (adev->pdev->device == 0x666F)) {
 			max_sclk = 75000;
 		}
 		if ((adev->pdev->revision == 0xC3) ||

drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c+1−1

@@ -848,7 +848,7 @@ static int dw_hdmi_qp_config_audio_infoframe(struct dw_hdmi_qp *hdmi, · 847 unmodified lines
848		848
849	regmap_bulk_write(hdmi->regm, PKT_AUDI_CONTENTS0, &header_bytes, 1);	849	regmap_bulk_write(hdmi->regm, PKT_AUDI_CONTENTS0, &header_bytes, 1);
850	regmap_bulk_write(hdmi->regm, PKT_AUDI_CONTENTS1, &buffer[3], 1);	850	regmap_bulk_write(hdmi->regm, PKT_AUDI_CONTENTS1, &buffer[3], 1);
851	regmap_bulk_write(hdmi->regm, PKT_AUDI_CONTENTS2, &buffer[4], 1);	851	regmap_bulk_write(hdmi->regm, PKT_AUDI_CONTENTS2, &buffer[7], 1);
852		852
853	/* Enable ACR, AUDI, AMD */	853	/* Enable ACR, AUDI, AMD */
854	dw_hdmi_qp_mod(hdmi,	854	dw_hdmi_qp_mod(hdmi,

drivers/gpu/drm/drm_file.c+4−1

 void drm_file_free(struct drm_file *file)
 {
 	struct drm_device *dev;
+	int idx;
 	if (!file)
 		return;
 	drm_events_release(file);
-	if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+	if (drm_core_check_feature(dev, DRIVER_MODESET) &&
+	    drm_dev_enter(dev, &idx)) {
 		drm_fb_release(file);
 		drm_property_destroy_user_blobs(dev, file);
+		drm_dev_exit(idx);
 	}
 	if (drm_core_check_feature(dev, DRIVER_SYNCOBJ))

drivers/gpu/drm/drm_mode_config.c+6−3

 	 */
 	WARN_ON(!list_empty(&dev->mode_config.fb_list));
 	list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
-		struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]");
+		if (list_empty(&fb->filp_head) || drm_framebuffer_read_refcount(fb) > 1) {
+			struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]");
-		drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
+			drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
-		drm_framebuffer_print_info(&p, 1, fb);
+			drm_framebuffer_print_info(&p, 1, fb);
+		}
+		list_del_init(&fb->filp_head);
 		drm_framebuffer_free(&fb->base.refcount);
 	}

drivers/gpu/drm/drm_pagemap_util.c+5−9

 	drm_dbg(cache->shrinker->drm, "Destroying dpagemap cache.\n");
 	spin_lock(&cache->lock);
 	dpagemap = cache->dpagemap;
-	if (!dpagemap) {
+	cache->dpagemap = NULL;
-		spin_unlock(&cache->lock);
+	if (dpagemap && !drm_pagemap_shrinker_cancel(dpagemap))
-		goto out;
+		dpagemap = NULL;
-	}
+	spin_unlock(&cache->lock);
-	if (drm_pagemap_shrinker_cancel(dpagemap)) {
+	if (dpagemap)
-		cache->dpagemap = NULL;
-		spin_unlock(&cache->lock);
 		drm_pagemap_destroy(dpagemap, false);
-	}
-out:
 	mutex_destroy(&cache->lookup_mutex);
 	kfree(cache);
 }

drivers/gpu/drm/i915/display/intel_display_power_well.c+1−1

@@ -806,7 +806,7 @@ void gen9_set_dc_state(struct intel_display *display, u32 state) · 805 unmodified lines
806	power_domains->dc_state, val & mask);	806	power_domains->dc_state, val & mask);
807		807
808	enable_dc6 = state & DC_STATE_EN_UPTO_DC6;	808	enable_dc6 = state & DC_STATE_EN_UPTO_DC6;
809	dc6_was_enabled = val & DC_STATE_EN_UPTO_DC6;	809	dc6_was_enabled = power_domains->dc_state & DC_STATE_EN_UPTO_DC6;
810	if (!dc6_was_enabled && enable_dc6)	810	if (!dc6_was_enabled && enable_dc6)
811	intel_dmc_update_dc6_allowed_count(display, true);	811	intel_dmc_update_dc6_allowed_count(display, true);
812		812

drivers/gpu/drm/i915/display/intel_display_types.h+1−0

@@ -1186,6 +1186,7 @@ struct intel_crtc_state { · 1185 unmodified lines
1186	u32 dc3co_exitline;	1186	u32 dc3co_exitline;
1187	u16 su_y_granularity;	1187	u16 su_y_granularity;
1188	u8 active_non_psr_pipes;	1188	u8 active_non_psr_pipes;
		1189	u8 entry_setup_frames;
1189	const char *no_psr_reason;	1190	const char *no_psr_reason;
1190		1191
1191	/*	1192	/*

drivers/gpu/drm/i915/display/intel_dmc.c+1−2

@@ -1599,8 +1599,7 @@ static bool intel_dmc_get_dc6_allowed_count(struct intel_display display, u32 · 1598 unmodified lines
1599	return false;	1599	return false;
1600		1600
1601	mutex_lock(&power_domains->lock);	1601	mutex_lock(&power_domains->lock);
1602	dc6_enabled = intel_de_read(display, DC_STATE_EN) &	1602	dc6_enabled = power_domains->dc_state & DC_STATE_EN_UPTO_DC6;
1603	DC_STATE_EN_UPTO_DC6;
1604	if (dc6_enabled)	1603	if (dc6_enabled)
1605	intel_dmc_update_dc6_allowed_count(display, false);	1604	intel_dmc_update_dc6_allowed_count(display, false);
1606		1605

drivers/gpu/drm/i915/display/intel_psr.c+5−2

 	entry_setup_frames = intel_psr_entry_setup_frames(intel_dp, conn_state, adjusted_mode);
 	if (entry_setup_frames >= 0) {
-		intel_dp->psr.entry_setup_frames = entry_setup_frames;
+		crtc_state->entry_setup_frames = entry_setup_frames;
 	} else {
 		crtc_state->no_psr_reason = "PSR setup timing not met";
 		drm_dbg_kms(display->drm,
 {
 	struct intel_display *display = to_intel_display(intel_dp);
-	return (DISPLAY_VER(display) == 20 && intel_dp->psr.entry_setup_frames > 0 &&
+	return (DISPLAY_VER(display) == 20 && crtc_state->entry_setup_frames > 0 &&
 		!crtc_state->has_sel_update);
 }
 	intel_dp->psr.pkg_c_latency_used = crtc_state->pkg_c_latency_used;
 	intel_dp->psr.io_wake_lines = crtc_state->alpm_state.io_wake_lines;
 	intel_dp->psr.fast_wake_lines = crtc_state->alpm_state.fast_wake_lines;
+	intel_dp->psr.entry_setup_frames = crtc_state->entry_setup_frames;
 	if (!psr_interrupt_error_check(intel_dp))
 		return;
 			 * - Display WA #1136: skl, bxt
 			 */
 			if (intel_crtc_needs_modeset(new_crtc_state) ||
+			    new_crtc_state->update_m_n ||
+			    new_crtc_state->update_lrr ||
 			    !new_crtc_state->has_psr ||
 			    !new_crtc_state->active_planes ||
 			    new_crtc_state->has_sel_update != psr->sel_update_enabled ||

drivers/gpu/drm/i915/gt/intel_engine_cs.c+2−1

@@ -1967,7 +1967,8 @@ void intel_engines_reset_default_submission(struct intel_gt *gt) · 1966 unmodified lines
1967	if (engine->sanitize)	1967	if (engine->sanitize)
1968	engine->sanitize(engine);	1968	engine->sanitize(engine);
1969		1969
1970	engine->set_default_submission(engine);	1970	if (engine->set_default_submission)
		1971	engine->set_default_submission(engine);
1971	}	1972	}
1972	}	1973	}
1973		1974

drivers/gpu/drm/imagination/pvr_device.c+0−17

@@ -225,29 +225,12 @@ static irqreturn_t pvr_device_irq_thread_handler(int irq, void *data) · 224 unmodified lines
225	}	225	}
226		226
227	if (pvr_dev->has_safety_events) {	227	if (pvr_dev->has_safety_events) {
228	int err;
229
230	/*
231	* Ensure the GPU is powered on since some safety events (such
232	* as ECC faults) can happen outside of job submissions, which
233	* are otherwise the only time a power reference is held.
234	*/
235	err = pvr_power_get(pvr_dev);
236	if (err) {
237	drm_err_ratelimited(drm_dev,
238	"%s: could not take power reference (%d)\n",
239	__func__, err);
240	return ret;
241	}
242
243	while (pvr_device_safety_irq_pending(pvr_dev)) {	228	while (pvr_device_safety_irq_pending(pvr_dev)) {
244	pvr_device_safety_irq_clear(pvr_dev);	229	pvr_device_safety_irq_clear(pvr_dev);
245	pvr_device_handle_safety_events(pvr_dev);	230	pvr_device_handle_safety_events(pvr_dev);
246		231
247	ret = IRQ_HANDLED;	232	ret = IRQ_HANDLED;
248	}	233	}
249
250	pvr_power_put(pvr_dev);
251	}	234	}
252		235
253	return ret;	236	return ret;

drivers/gpu/drm/imagination/pvr_power.c+39−12

 }
 static int
-pvr_power_fw_disable(struct pvr_device *pvr_dev, bool hard_reset)
+pvr_power_fw_disable(struct pvr_device *pvr_dev, bool hard_reset, bool rpm_suspend)
 {
-	if (!hard_reset) {
+	int err;
-		int err;
+	if (!hard_reset) {
 		cancel_delayed_work_sync(&pvr_dev->watchdog.work);
 		err = pvr_power_request_idle(pvr_dev);
 			return err;
 	}
-	return pvr_fw_stop(pvr_dev);
+	if (rpm_suspend) {
+		/* This also waits for late processing of GPU or firmware IRQs in other cores */
+		disable_irq(pvr_dev->irq);
+	}
+	err = pvr_fw_stop(pvr_dev);
+	if (err && rpm_suspend)
+		enable_irq(pvr_dev->irq);
+	return err;
 }
 static int
-pvr_power_fw_enable(struct pvr_device *pvr_dev)
+pvr_power_fw_enable(struct pvr_device *pvr_dev, bool rpm_resume)
 {
 	int err;
+	if (rpm_resume)
+		enable_irq(pvr_dev->irq);
 	err = pvr_fw_start(pvr_dev);
 	if (err)
-		return err;
+		goto out;
 	err = pvr_wait_for_fw_boot(pvr_dev);
 	if (err) {
 		drm_err(from_pvr_device(pvr_dev), "Firmware failed to boot\n");
 		pvr_fw_stop(pvr_dev);
-		return err;
+		goto out;
 	}
 	queue_delayed_work(pvr_dev->sched_wq, &pvr_dev->watchdog.work,
 			   msecs_to_jiffies(WATCHDOG_TIME_MS));
 	return 0;
+out:
+	if (rpm_resume)
+		disable_irq(pvr_dev->irq);
+	return err;
 }
 bool
 		return -EIO;
 	if (pvr_dev->fw_dev.booted) {
-		err = pvr_power_fw_disable(pvr_dev, false);
+		err = pvr_power_fw_disable(pvr_dev, false, true);
 		if (err)
 			goto err_drm_dev_exit;
 	}
 		goto err_drm_dev_exit;
 	if (pvr_dev->fw_dev.booted) {
-		err = pvr_power_fw_enable(pvr_dev);
+		err = pvr_power_fw_enable(pvr_dev, true);
 		if (err)
 			goto err_power_off;
 	}
 	}
 	/* Disable IRQs for the duration of the reset. */
-	disable_irq(pvr_dev->irq);
+	if (hard_reset) {
+		disable_irq(pvr_dev->irq);
+	} else {
+		/*
+		 * Soft reset is triggered as a response to a FW command to the Host and is
+		 * processed from the threaded IRQ handler. This code cannot (nor needs to)
+		 * wait for any IRQ processing to complete.
+		 */
+		disable_irq_nosync(pvr_dev->irq);
+	}
 	do {
 		if (hard_reset) {
 			queues_disabled = true;
 		}
-		err = pvr_power_fw_disable(pvr_dev, hard_reset);
+		err = pvr_power_fw_disable(pvr_dev, hard_reset, false);
 		if (!err) {
 			if (hard_reset) {
 				pvr_dev->fw_dev.booted = false;
 			pvr_fw_irq_clear(pvr_dev);
-			err = pvr_power_fw_enable(pvr_dev);
+			err = pvr_power_fw_enable(pvr_dev, false);
 		}
 		if (err && hard_reset)

drivers/gpu/drm/radeon/si_dpm.c+3−1

 	if (rdev->family == CHIP_HAINAN) {
 		if ((rdev->pdev->revision == 0x81) ||
 		    (rdev->pdev->revision == 0xC3) ||
+		    (rdev->pdev->device == 0x6660) ||
 		    (rdev->pdev->device == 0x6664) ||
 		    (rdev->pdev->device == 0x6665) ||
-		    (rdev->pdev->device == 0x6667)) {
+		    (rdev->pdev->device == 0x6667) ||
+		    (rdev->pdev->device == 0x666F)) {
 			max_sclk = 75000;
 		}
 		if ((rdev->pdev->revision == 0xC3) ||

drivers/gpu/drm/vmwgfx/vmwgfx_drv.h+57−36

 struct vmw_res_func;
+struct vmw_bo;
+struct vmw_bo;
+struct vmw_resource_dirty;
 /**
- * struct vmw-resource - base class for hardware resources
+ * struct vmw_resource - base class for hardware resources
  *
  * @kref: For refcounting.
  * @dev_priv: Pointer to the device private for this resource. Immutable.
  * @id: Device id. Protected by @dev_priv::resource_lock.
+ * @used_prio: Priority for this resource.
  * @guest_memory_size: Guest memory buffer size. Immutable.
  * @res_dirty: Resource contains data not yet in the guest memory buffer.
  * Protected by resource reserved.
  * pin-count greater than zero. It is not on the resource LRU lists and its
  * guest memory buffer is pinned. Hence it can't be evicted.
  * @func: Method vtable for this resource. Immutable.
- * @mob_node; Node for the MOB guest memory rbtree. Protected by
+ * @mob_node: Node for the MOB guest memory rbtree. Protected by
  * @guest_memory_bo reserved.
  * @lru_head: List head for the LRU list. Protected by @dev_priv::resource_lock.
  * @binding_head: List head for the context binding list. Protected by
  * the @dev_priv::binding_mutex
+ * @dirty: resource's dirty tracker
  * @res_free: The resource destructor.
  * @hw_destroy: Callback to destroy the resource on the device, as part of
  * resource destruction.
  */
-struct vmw_bo;
-struct vmw_bo;
-struct vmw_resource_dirty;
 struct vmw_resource {
 	struct kref kref;
 	struct vmw_private *dev_priv;
  * @quality_level: Quality level.
  * @autogen_filter: Filter for automatically generated mipmaps.
  * @array_size: Number of array elements for a 1D/2D texture. For cubemap
-                texture number of faces * array_size. This should be 0 for pre
+ *              texture number of faces * array_size. This should be 0 for pre
-		SM4 device.
+ *		SM4 device.
  * @buffer_byte_stride: Buffer byte stride.
  * @num_sizes: Size of @sizes. For GB surface this should always be 1.
  * @base_size: Surface dimension.
 struct vmw_res_cache_entry {
 	uint32_t handle;
 	struct vmw_resource *res;
+	/* private: */
 	void *private;
+	/* public: */
 	unsigned short valid_handle;
 	unsigned short valid;
 };
 /**
  * enum vmw_dma_map_mode - indicate how to perform TTM page dma mappings.
+ * @vmw_dma_alloc_coherent: Use TTM coherent pages
+ * @vmw_dma_map_populate: Unmap from DMA just after unpopulate
+ * @vmw_dma_map_bind: Unmap from DMA just before unbind
  */
 enum vmw_dma_map_mode {
-	vmw_dma_alloc_coherent, /* Use TTM coherent pages */
+	vmw_dma_alloc_coherent,
-	vmw_dma_map_populate,   /* Unmap from DMA just after unpopulate */
+	vmw_dma_map_populate,
-	vmw_dma_map_bind,       /* Unmap from DMA just before unbind */
+	vmw_dma_map_bind,
+	/* private: */
 	vmw_dma_map_max
 };
  * struct vmw_sg_table - Scatter/gather table for binding, with additional
  * device-specific information.
  *
+ * @mode: which page mapping mode to use
+ * @pages: Array of page pointers to the pages.
+ * @addrs: DMA addresses to the pages if coherent pages are used.
  * @sgt: Pointer to a struct sg_table with binding information
- * @num_regions: Number of regions with device-address contiguous pages
+ * @num_pages: Number of @pages
  */
 struct vmw_sg_table {
 	enum vmw_dma_map_mode mode;
  * than from user-space
  * @fp: If @kernel is false, points to the file of the client. Otherwise
  * NULL
+ * @filp: DRM state for this file
  * @cmd_bounce: Command bounce buffer used for command validation before
  * copying to fifo space
  * @cmd_bounce_size: Current command bounce buffer size
 bool vmwgfx_supported(struct vmw_private *vmw);
-/**
+/*
  * GMR utilities - vmwgfx_gmr.c
  */
 			int gmr_id);
 extern void vmw_gmr_unbind(struct vmw_private *dev_priv, int gmr_id);
-/**
+/*
  * User handles
  */
 struct vmw_user_object {
 void vmw_user_object_unmap(struct vmw_user_object *uo);
 bool vmw_user_object_is_mapped(struct vmw_user_object *uo);
-/**
+/*
  * Resource utilities - vmwgfx_resource.c
  */
 struct vmw_user_resource_conv;
 	return !RB_EMPTY_NODE(&res->mob_node);
 }
-/**
+/*
  * GEM related functionality - vmwgfx_gem.c
  */
 struct vmw_bo_params;
 				       struct drm_file *filp);
 extern void vmw_debugfs_gem_init(struct vmw_private *vdev);
-/**
+/*
  * Misc Ioctl functionality - vmwgfx_ioctl.c
  */
 extern int vmw_present_readback_ioctl(struct drm_device *dev, void *data,
 				      struct drm_file *file_priv);
-/**
+/*
  * Fifo utilities - vmwgfx_fifo.c
  */
 /**
- * vmw_fifo_caps - Returns the capabilities of the FIFO command
+ * vmw_fifo_caps - Get the capabilities of the FIFO command
  * queue or 0 if fifo memory isn't present.
  * @dev_priv: The device private context
+ *
+ * Returns: capabilities of the FIFO command or %0 if fifo memory not present
  */
 static inline uint32_t vmw_fifo_caps(const struct vmw_private *dev_priv)
 {
 /**
- * vmw_is_cursor_bypass3_enabled - Returns TRUE iff Cursor Bypass 3
+ * vmw_is_cursor_bypass3_enabled - check Cursor Bypass 3 enabled setting
- * is enabled in the FIFO.
+ * in the FIFO.
  * @dev_priv: The device private context
+ *
+ * Returns: %true iff Cursor Bypass 3 is enabled in the FIFO
  */
 static inline bool
 vmw_is_cursor_bypass3_enabled(const struct vmw_private *dev_priv)
 	return (vmw_fifo_caps(dev_priv) & SVGA_FIFO_CAP_CURSOR_BYPASS_3) != 0;
 }
-/**
+/*
  * TTM buffer object driver - vmwgfx_ttm_buffer.c
  */
  *
  * @viter: Pointer to the iterator to advance.
  *
- * Returns false if past the list of pages, true otherwise.
+ * Returns: false if past the list of pages, true otherwise.
  */
 static inline bool vmw_piter_next(struct vmw_piter *viter)
 {
  *
  * @viter: Pointer to the iterator
  *
- * Returns the DMA address of the page pointed to by @viter.
+ * Returns: the DMA address of the page pointed to by @viter.
  */
 static inline dma_addr_t vmw_piter_dma_addr(struct vmw_piter *viter)
 {
  *
  * @viter: Pointer to the iterator
  *
- * Returns the DMA address of the page pointed to by @viter.
+ * Returns: the DMA address of the page pointed to by @viter.
  */
 static inline struct page *vmw_piter_page(struct vmw_piter *viter)
 {
 	return viter->pages[viter->i];
 }
-/**
+/*
  * Command submission - vmwgfx_execbuf.c
  */
 					int32_t out_fence_fd);
 bool vmw_cmd_describe(const void *buf, u32 *size, char const **cmd);
-/**
+/*
  * IRQs and wating - vmwgfx_irq.c
  */
 bool vmw_generic_waiter_remove(struct vmw_private *dev_priv,
 			       u32 flag, int *waiter_count);
-/**
+/*
  * Kernel modesetting - vmwgfx_kms.c
  */
 extern void vmw_resource_unpin(struct vmw_resource *res);
 extern enum vmw_res_type vmw_res_type(const struct vmw_resource *res);
-/**
+/*
  * Overlay control - vmwgfx_overlay.c
  */
 int vmw_overlay_num_overlays(struct vmw_private *dev_priv);
 int vmw_overlay_num_free_overlays(struct vmw_private *dev_priv);
-/**
+/*
  * GMR Id manager
  */
 int vmw_gmrid_man_init(struct vmw_private *dev_priv, int type);
 void vmw_gmrid_man_fini(struct vmw_private *dev_priv, int type);
-/**
+/*
  * System memory manager
  */
 int vmw_sys_man_init(struct vmw_private *dev_priv);
 void vmw_sys_man_fini(struct vmw_private *dev_priv);
-/**
+/*
  * Prime - vmwgfx_prime.c
  */
  * @line: The current line of the blit.
  * @line_offset: Offset of the current line segment.
  * @cpp: Bytes per pixel (granularity information).
- * @memcpy: Which memcpy function to use.
+ * @do_cpy: Which memcpy function to use.
  */
 struct vmw_diff_cpy {
 	struct drm_rect rect;
 /**
  * VMW_DEBUG_KMS - Debug output for kernel mode-setting
+ * @fmt: format string for the args
  *
  * This macro is for debugging vmwgfx mode-setting code.
  */
 #define VMW_DEBUG_KMS(fmt, ...)                                               \
 	DRM_DEBUG_DRIVER(fmt, ##__VA_ARGS__)
-/**
+/*
  * Inline helper functions
  */
 /**
  * vmw_fifo_mem_read - Perform a MMIO read from the fifo memory
- *
+ * @vmw: The device private structure
  * @fifo_reg: The fifo register to read from
  *
  * This function is intended to be equivalent to ioread32() on
  * memremap'd memory, but without byteswapping.
+ *
+ * Returns: the value read
  */
 static inline u32 vmw_fifo_mem_read(struct vmw_private *vmw, uint32 fifo_reg)
 {
 /**
  * vmw_fifo_mem_write - Perform a MMIO write to volatile memory
- *
+ * @vmw: The device private structure
- * @addr: The fifo register to write to
+ * @fifo_reg: The fifo register to write to
+ * @value: The value to write
  *
  * This function is intended to be equivalent to iowrite32 on
  * memremap'd memory, but without byteswapping.

drivers/gpu/drm/vmwgfx/vmwgfx_kms.c+2−1

 		ret = vmw_bo_dirty_add(bo);
 		if (!ret && surface && surface->res.func->dirty_alloc) {
 			surface->res.coherent = true;
-			ret = surface->res.func->dirty_alloc(&surface->res);
+			if (surface->res.dirty == NULL)
+				ret = surface->res.func->dirty_alloc(&surface->res);
 		}
 		ttm_bo_unreserve(&bo->tbo);
 	}

drivers/gpu/drm/xe/xe_ggtt.c+4−6

 {
 	struct xe_ggtt *ggtt = arg;
+	scoped_guard(mutex, &ggtt->lock)
+		ggtt->flags &= ~XE_GGTT_FLAGS_ONLINE;
 	drain_workqueue(ggtt->wq);
 }
 	if (err)
 		return err;
+	ggtt->flags |= XE_GGTT_FLAGS_ONLINE;
 	err = devm_add_action_or_reset(xe->drm.dev, dev_fini_ggtt, ggtt);
 	if (err)
 		return err;
 static void ggtt_node_remove(struct xe_ggtt_node *node)
 {
 	struct xe_ggtt *ggtt = node->ggtt;
-	struct xe_device *xe = tile_to_xe(ggtt->tile);
 	bool bound;
-	int idx;
-	bound = drm_dev_enter(&xe->drm, &idx);
 	mutex_lock(&ggtt->lock);
+	bound = ggtt->flags & XE_GGTT_FLAGS_ONLINE;
 	if (bound)
 		xe_ggtt_clear(ggtt, node->base.start, node->base.size);
 	drm_mm_remove_node(&node->base);
 	if (node->invalidate_on_remove)
 		xe_ggtt_invalidate(ggtt);
-	drm_dev_exit(idx);
 free_node:
 	xe_ggtt_node_fini(node);
 }

drivers/gpu/drm/xe/xe_ggtt_types.h+4−1

 	/** @size: Total usable size of this GGTT */
 	u64 size;
-#define XE_GGTT_FLAGS_64K BIT(0)
+#define XE_GGTT_FLAGS_64K       BIT(0)
+#define XE_GGTT_FLAGS_ONLINE	BIT(1)
 	/**
 	 * @flags: Flags for this GGTT
 	 * Acceptable flags:
 	 * - %XE_GGTT_FLAGS_64K - if PTE size is 64K. Otherwise, regular is 4K.
+	 * - %XE_GGTT_FLAGS_ONLINE - is GGTT online, protected by ggtt->lock
+	 *   after init
 	 */
 	unsigned int flags;
 	/** @scratch: Internal object allocation used as a scratch page */

drivers/gpu/drm/xe/xe_gt_ccs_mode.c+2−0

 #include "xe_gt_printk.h"
 #include "xe_gt_sysfs.h"
 #include "xe_mmio.h"
+#include "xe_pm.h"
 #include "xe_sriov.h"
 static void __xe_gt_apply_ccs_mode(struct xe_gt *gt, u32 num_engines)
 		xe_gt_info(gt, "Setting compute mode to %d\n", num_engines);
 		gt->ccs_mode = num_engines;
 		xe_gt_record_user_engines(gt);
+		guard(xe_pm_runtime)(xe);
 		xe_gt_reset(gt);
 	}

drivers/gpu/drm/xe/xe_guc.c+27−5

 	struct xe_guc_pc *guc_pc = &gt->uc.guc.pc;
 	u32 before_freq, act_freq, cur_freq;
 	u32 status = 0, tries = 0;
+	int load_result, ret;
 	ktime_t before;
 	u64 delta_ms;
-	int ret;
 	before_freq = xe_guc_pc_get_act_freq(guc_pc);
 	before = ktime_get();
-	ret = poll_timeout_us(ret = guc_load_done(gt, &status, &tries), ret,
+	ret = poll_timeout_us(load_result = guc_load_done(gt, &status, &tries), load_result,
 			      10 * USEC_PER_MSEC,
 			      GUC_LOAD_TIMEOUT_SEC * USEC_PER_SEC, false);
 	act_freq = xe_guc_pc_get_act_freq(guc_pc);
 	cur_freq = xe_guc_pc_get_cur_freq_fw(guc_pc);
-	if (ret) {
+	if (ret || load_result <= 0) {
 		xe_gt_err(gt, "load failed: status = 0x%08X, time = %lldms, freq = %dMHz (req %dMHz)\n",
 			  status, delta_ms, xe_guc_pc_get_act_freq(guc_pc),
 			  xe_guc_pc_get_cur_freq_fw(guc_pc));
 	return 0;
 }
-int xe_guc_suspend(struct xe_guc *guc)
+/**
+ * xe_guc_softreset() - Soft reset GuC
+ * @guc: The GuC object
+ *
+ * Send soft reset command to GuC through mmio send.
+ *
+ * Return: 0 if success, otherwise error code
+ */
+int xe_guc_softreset(struct xe_guc *guc)
 {
-	struct xe_gt *gt = guc_to_gt(guc);
 	u32 action[] = {
 		XE_GUC_ACTION_CLIENT_SOFT_RESET,
 	};
 	int ret;
+	if (!xe_uc_fw_is_running(&guc->fw))
+		return 0;
 	ret = xe_guc_mmio_send(guc, action, ARRAY_SIZE(action));
+	if (ret)
+		return ret;
+	return 0;
+}
+int xe_guc_suspend(struct xe_guc *guc)
+{
+	struct xe_gt *gt = guc_to_gt(guc);
+	int ret;
+	ret = xe_guc_softreset(guc);
 	if (ret) {
 		xe_gt_err(gt, "GuC suspend failed: %pe\n", ERR_PTR(ret));
 		return ret;

drivers/gpu/drm/xe/xe_guc.h+1−0

@@ -44,6 +44,7 @@ int xe_guc_opt_in_features_enable(struct xe_guc *guc); · 43 unmodified lines
44	void xe_guc_runtime_suspend(struct xe_guc *guc);	44	void xe_guc_runtime_suspend(struct xe_guc *guc);
45	void xe_guc_runtime_resume(struct xe_guc *guc);	45	void xe_guc_runtime_resume(struct xe_guc *guc);
46	int xe_guc_suspend(struct xe_guc *guc);	46	int xe_guc_suspend(struct xe_guc *guc);
		47	int xe_guc_softreset(struct xe_guc *guc);
47	void xe_guc_notify(struct xe_guc *guc);	48	void xe_guc_notify(struct xe_guc *guc);
48	int xe_guc_auth_huc(struct xe_guc *guc, u32 rsa_addr);	49	int xe_guc_auth_huc(struct xe_guc *guc, u32 rsa_addr);
49	int xe_guc_mmio_send(struct xe_guc guc, const u32 request, u32 len);	50	int xe_guc_mmio_send(struct xe_guc guc, const u32 request, u32 len);

drivers/gpu/drm/xe/xe_guc_ct.c+1−0

@@ -345,6 +345,7 @@ static void guc_action_disable_ct(void *arg) · 344 unmodified lines
345	{	345	{
346	struct xe_guc_ct *ct = arg;	346	struct xe_guc_ct *ct = arg;
347		347
		348	xe_guc_ct_stop(ct);
348	guc_ct_change_state(ct, XE_GUC_CT_STATE_DISABLED);	349	guc_ct_change_state(ct, XE_GUC_CT_STATE_DISABLED);
349	}	350	}
350		351

drivers/gpu/drm/xe/xe_guc_submit.c+61−25

 #define XE_GUC_EXEC_QUEUE_CGP_CONTEXT_ERROR_LEN		6
+static int guc_submit_reset_prepare(struct xe_guc *guc);
 static struct xe_guc *
 exec_queue_to_guc(struct xe_exec_queue *q)
 {
 		 EXEC_QUEUE_STATE_BANNED));
 }
-static void guc_submit_fini(struct drm_device *drm, void *arg)
+static void guc_submit_sw_fini(struct drm_device *drm, void *arg)
 {
 	struct xe_guc *guc = arg;
 	struct xe_device *xe = guc_to_xe(guc);
 	xa_destroy(&guc->submission_state.exec_queue_lookup);
 }
+static void guc_submit_fini(void *arg)
+{
+	struct xe_guc *guc = arg;
+	/* Forcefully kill any remaining exec queues */
+	xe_guc_ct_stop(&guc->ct);
+	guc_submit_reset_prepare(guc);
+	xe_guc_softreset(guc);
+	xe_guc_submit_stop(guc);
+	xe_uc_fw_sanitize(&guc->fw);
+	xe_guc_submit_pause_abort(guc);
+}
 static void guc_submit_wedged_fini(void *arg)
 {
 	struct xe_guc *guc = arg;
 	guc->submission_state.initialized = true;
-	return drmm_add_action_or_reset(&xe->drm, guc_submit_fini, guc);
+	err = drmm_add_action_or_reset(&xe->drm, guc_submit_sw_fini, guc);
+	if (err)
+		return err;
+	return devm_add_action_or_reset(xe->drm.dev, guc_submit_fini, guc);
 }
 /*
  */
 void xe_guc_submit_wedge(struct xe_guc *guc)
 {
+	struct xe_device *xe = guc_to_xe(guc);
 	struct xe_gt *gt = guc_to_gt(guc);
 	struct xe_exec_queue *q;
 	unsigned long index;
 	if (!guc->submission_state.initialized)
 		return;
-	err = devm_add_action_or_reset(guc_to_xe(guc)->drm.dev,
+	if (xe->wedged.mode == 2) {
-				       guc_submit_wedged_fini, guc);
+		err = devm_add_action_or_reset(guc_to_xe(guc)->drm.dev,
-	if (err) {
+					       guc_submit_wedged_fini, guc);
-		xe_gt_err(gt, "Failed to register clean-up in wedged.mode=%s; "
+		if (err) {
-			  "Although device is wedged.\n",
+			xe_gt_err(gt, "Failed to register clean-up on wedged.mode=2; "
-			  xe_wedged_mode_to_string(XE_WEDGED_MODE_UPON_ANY_HANG_NO_RESET));
+				  "Although device is wedged.\n");
-		return;
+			return;
-	}
+		}
-	mutex_lock(&guc->submission_state.lock);
+		mutex_lock(&guc->submission_state.lock);
-	xa_for_each(&guc->submission_state.exec_queue_lookup, index, q)
+		xa_for_each(&guc->submission_state.exec_queue_lookup, index, q)
-		if (xe_exec_queue_get_unless_zero(q))
+			if (xe_exec_queue_get_unless_zero(q))
-			set_exec_queue_wedged(q);
+				set_exec_queue_wedged(q);
-	mutex_unlock(&guc->submission_state.lock);
+		mutex_unlock(&guc->submission_state.lock);
+	} else {
+		/* Forcefully kill any remaining exec queues, signal fences */
+		guc_submit_reset_prepare(guc);
+		xe_guc_submit_stop(guc);
+		xe_guc_softreset(guc);
+		xe_uc_fw_sanitize(&guc->fw);
+		xe_guc_submit_pause_abort(guc);
+	}
 }
 static bool guc_submit_hint_wedged(struct xe_guc *guc)
 static void guc_exec_queue_stop(struct xe_guc *guc, struct xe_exec_queue *q)
 {
 	struct xe_gpu_scheduler *sched = &q->guc->sched;
+	bool do_destroy = false;
 	/* Stop scheduling + flush any DRM scheduler operations */
 	xe_sched_submission_stop(sched);
 	/* Clean up lost G2H + reset engine state */
 	if (exec_queue_registered(q)) {
 		if (exec_queue_destroyed(q))
-			__guc_exec_queue_destroy(guc, q);
+			do_destroy = true;
 	}
 	if (q->guc->suspend_pending) {
 		set_exec_queue_suspended(q);
 			xe_guc_exec_queue_trigger_cleanup(q);
 		}
 	}
+	if (do_destroy)
+		__guc_exec_queue_destroy(guc, q);
 }
-int xe_guc_submit_reset_prepare(struct xe_guc *guc)
+static int guc_submit_reset_prepare(struct xe_guc *guc)
 {
 	int ret;
-	if (xe_gt_WARN_ON(guc_to_gt(guc), vf_recovery(guc)))
-		return 0;
-	if (!guc->submission_state.initialized)
-		return 0;
 	/*
 	 * Using an atomic here rather than submission_state.lock as this
 	 * function can be called while holding the CT lock (engine reset
 	return ret;
 }
+int xe_guc_submit_reset_prepare(struct xe_guc *guc)
+{
+	if (xe_gt_WARN_ON(guc_to_gt(guc), vf_recovery(guc)))
+		return 0;
+	if (!guc->submission_state.initialized)
+		return 0;
+	return guc_submit_reset_prepare(guc);
+}
 void xe_guc_submit_reset_wait(struct xe_guc *guc)
 {
 	wait_event(guc->ct.wq, xe_device_wedged(guc_to_xe(guc)) ||
 			continue;
 		xe_sched_submission_start(sched);
-		if (exec_queue_killed_or_banned_or_wedged(q))
+		guc_exec_queue_kill(q);
-			xe_guc_exec_queue_trigger_cleanup(q);
 	}
 	mutex_unlock(&guc->submission_state.lock);
 }

drivers/gpu/drm/xe/xe_lrc.c+2−2

@@ -2413,14 +2413,14 @@ static int get_ctx_timestamp(struct xe_lrc lrc, u32 engine_id, u64 reg_ctx_ts) · 2412 unmodified lines
2413	* @lrc: Pointer to the lrc.	2413	* @lrc: Pointer to the lrc.
2414	*	2414	*
2415	* Return latest ctx timestamp. With support for active contexts, the	2415	* Return latest ctx timestamp. With support for active contexts, the
2416	* calculation may bb slightly racy, so follow a read-again logic to ensure that	2416	* calculation may be slightly racy, so follow a read-again logic to ensure that
2417	* the context is still active before returning the right timestamp.	2417	* the context is still active before returning the right timestamp.
2418	*	2418	*
2419	* Returns: New ctx timestamp value	2419	* Returns: New ctx timestamp value
2420	*/	2420	*/
2421	u64 xe_lrc_timestamp(struct xe_lrc *lrc)	2421	u64 xe_lrc_timestamp(struct xe_lrc *lrc)
2422	{	2422	{
2423	u64 lrc_ts, reg_ts, new_ts;	2423	u64 lrc_ts, reg_ts, new_ts = lrc->ctx_timestamp;
2424	u32 engine_id;	2424	u32 engine_id;
2425		2425
2426	lrc_ts = xe_lrc_ctx_timestamp(lrc);	2426	lrc_ts = xe_lrc_ctx_timestamp(lrc);

drivers/gpu/drm/xe/xe_oa.c+5−2

 	size_t offset = 0;
 	int ret;
-	/* Can't read from disabled streams */
+	if (!stream->sample)
-	if (!stream->enabled || !stream->sample)
 		return -EINVAL;
 	if (!(file->f_flags & O_NONBLOCK)) {
 	if (stream->sample)
 		hrtimer_cancel(&stream->poll_check_timer);
+	/* Update stream->oa_buffer.tail to allow any final reports to be read */
+	if (xe_oa_buffer_check_unlocked(stream))
+		wake_up(&stream->poll_wq);
 }
 static int xe_oa_enable_preempt_timeslice(struct xe_oa_stream *stream)

drivers/gpu/drm/xe/xe_pt.c+29−9

 	XE_WARN_ON(!level);
 	/* Check for leaf node */
 	if (xe_walk->prl && xe_page_reclaim_list_valid(xe_walk->prl) &&
-	    (!xe_child->base.children || !xe_child->base.children[first])) {
+	    xe_child->level <= MAX_HUGEPTE_LEVEL) {
 		struct iosys_map *leaf_map = &xe_child->bo->vmap;
 		pgoff_t count = xe_pt_num_entries(addr, next, xe_child->level, walk);
 		for (pgoff_t i = 0; i < count; i++) {
-			u64 pte = xe_map_rd(xe, leaf_map, (first + i) * sizeof(u64), u64);
+			u64 pte;
 			int ret;
+			/*
+			 * If not a leaf pt, skip unless non-leaf pt is interleaved between
+			 * leaf ptes which causes the page walk to skip over the child leaves
+			 */
+			if (xe_child->base.children && xe_child->base.children[first + i]) {
+				u64 pt_size = 1ULL << walk->shifts[xe_child->level];
+				bool edge_pt = (i == 0 && !IS_ALIGNED(addr, pt_size)) ||
+					       (i == count - 1 && !IS_ALIGNED(next, pt_size));
+				if (!edge_pt) {
+					xe_page_reclaim_list_abort(xe_walk->tile->primary_gt,
+								   xe_walk->prl,
+								   "PT is skipped by walk at level=%u offset=%lu",
+								   xe_child->level, first + i);
+					break;
+				}
+				continue;
+			}
+			pte = xe_map_rd(xe, leaf_map, (first + i) * sizeof(u64), u64);
 			/*
 			 * In rare scenarios, pte may not be written yet due to racy conditions.
 			 * In such cases, invalidate the PRL and fallback to full PPC invalidation.
 			}
 			/* Ensure it is a defined page */
-			xe_tile_assert(xe_walk->tile,
+			xe_tile_assert(xe_walk->tile, xe_child->level == 0 ||
-				       xe_child->level == 0 ||
+				       (pte & (XE_PDE_PS_2M | XE_PDPE_PS_1G)));
-				       (pte & (XE_PTE_PS64 | XE_PDE_PS_2M | XE_PDPE_PS_1G)));
 			/* An entry should be added for 64KB but contigious 4K have XE_PTE_PS64 */
 			if (pte & XE_PTE_PS64)
 	killed = xe_pt_check_kill(addr, next, level - 1, xe_child, action, walk);
 	/*
-	 * Verify PRL is active and if entry is not a leaf pte (base.children conditions),
+	 * Verify if any PTE are potentially dropped at non-leaf levels, either from being
-	 * there is a potential need to invalidate the PRL if any PTE (num_live) are dropped.
+	 * killed or the page walk covers the region.
 	 */
-	if (xe_walk->prl && level > 1 && xe_child->num_live &&
+	if (xe_walk->prl && xe_page_reclaim_list_valid(xe_walk->prl) &&
-	    xe_child->base.children && xe_child->base.children[first]) {
+	    xe_child->level > MAX_HUGEPTE_LEVEL && xe_child->num_live) {
 		bool covered = xe_pt_covers(addr, next, xe_child->level, &xe_walk->base);
 		/*

drivers/hid/bpf/hid_bpf_dispatch.c+2−0

@@ -444,6 +444,8 @@ hid_bpf_hw_request(struct hid_bpf_ctx ctx, __u8 buf, size_t buf__sz, · 443 unmodified lines
444	(u64)(long)ctx,	444	(u64)(long)ctx,
445	true); /* prevent infinite recursions */	445	true); /* prevent infinite recursions */
446		446
		447	if (ret > size)
		448	ret = size;
447	if (ret > 0)	449	if (ret > 0)
448	memcpy(buf, dma_data, ret);	450	memcpy(buf, dma_data, ret);
449		451

drivers/hid/hid-appletb-kbd.c+3−2

 	return 0;
 }
-static int appletb_kbd_reset_resume(struct hid_device *hdev)
+static int appletb_kbd_resume(struct hid_device *hdev)
 {
 	struct appletb_kbd *kbd = hid_get_drvdata(hdev);
 	.event = appletb_kbd_hid_event,
 	.input_configured = appletb_kbd_input_configured,
 	.suspend = pm_ptr(appletb_kbd_suspend),
-	.reset_resume = pm_ptr(appletb_kbd_reset_resume),
+	.resume = pm_ptr(appletb_kbd_resume),
+	.reset_resume = pm_ptr(appletb_kbd_resume),
 	.driver.dev_groups = appletb_kbd_groups,
 };
 module_hid_driver(appletb_kbd_hid_driver);

drivers/hid/hid-asus.c+3−0

 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
 	    USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X),
 	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD | QUIRK_ROG_ALLY_XPAD },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+	    USB_DEVICE_ID_ASUSTEK_XGM_2022),
+	},
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
 	    USB_DEVICE_ID_ASUSTEK_XGM_2023),
 	},

drivers/hid/hid-core.c+4−3

 		rsize = max_buffer_size;
 	if (csize < rsize) {
-		dbg_hid("report %d is too short, (%d < %d)\n", report->id,
+		hid_warn_ratelimited(hid, "Event data for report %d was too short (%d vs %d)\n",
-				csize, rsize);
+				     report->id, rsize, csize);
-		memset(cdata + csize, 0, rsize - csize);
+		ret = -EINVAL;
+		goto out;
 	}
 	if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event)

drivers/hid/hid-ids.h+1−2

 #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X		0x1b4c
 #define USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD	0x196b
 #define USB_DEVICE_ID_ASUSTEK_FX503VD_KEYBOARD	0x1869
+#define USB_DEVICE_ID_ASUSTEK_XGM_2022	0x1970
 #define USB_DEVICE_ID_ASUSTEK_XGM_2023	0x1a9a
 #define USB_VENDOR_ID_ATEN		0x0557
 #define USB_DEVICE_ID_TOSHIBA_CLICK_L9W	0x0401
 #define USB_DEVICE_ID_HP_X2		0x074d
 #define USB_DEVICE_ID_HP_X2_10_COVER	0x0755
-#define USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN	0x2544
-#define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN	0x2706
 #define I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM	0x2F81
 #define USB_VENDOR_ID_ELECOM		0x056e

drivers/hid/hid-input.c+11−7

 #define HID_BATTERY_QUIRK_FEATURE	(1 << 1) /* ask for feature report */
 #define HID_BATTERY_QUIRK_IGNORE	(1 << 2) /* completely ignore the battery */
 #define HID_BATTERY_QUIRK_AVOID_QUERY	(1 << 3) /* do not query the battery */
+#define HID_BATTERY_QUIRK_DYNAMIC	(1 << 4) /* report present only after life signs */
 static const struct hid_device_id hid_battery_quirks[] = {
 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
 		USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD),
 	  HID_BATTERY_QUIRK_IGNORE },
-	{ HID_USB_DEVICE(USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN),
-	  HID_BATTERY_QUIRK_IGNORE },
-	{ HID_USB_DEVICE(USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN),
-	  HID_BATTERY_QUIRK_IGNORE },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L),
 	  HID_BATTERY_QUIRK_AVOID_QUERY },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_MW),
 	 * Elan HID touchscreens seem to all report a non present battery,
 	 * set HID_BATTERY_QUIRK_IGNORE for all Elan I2C and USB HID devices.
 	 */
-	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE },
+	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_DYNAMIC },
-	{ HID_USB_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_DYNAMIC },
 	{}
 };
 	int ret = 0;
 	switch (prop) {
-	case POWER_SUPPLY_PROP_PRESENT:
 	case POWER_SUPPLY_PROP_ONLINE:
 		val->intval = 1;
 		break;
+	case POWER_SUPPLY_PROP_PRESENT:
+		val->intval = dev->battery_present;
+		break;
 	case POWER_SUPPLY_PROP_CAPACITY:
 		if (dev->battery_status != HID_BATTERY_REPORTED &&
 		    !dev->battery_avoid_query) {
 	if (quirks & HID_BATTERY_QUIRK_AVOID_QUERY)
 		dev->battery_avoid_query = true;
+	dev->battery_present = (quirks & HID_BATTERY_QUIRK_DYNAMIC) ? false : true;
 	dev->battery = power_supply_register(&dev->dev, psy_desc, &psy_cfg);
 	if (IS_ERR(dev->battery)) {
 		error = PTR_ERR(dev->battery);
 		return;
 	if (hidinput_update_battery_charge_status(dev, usage, value)) {
+		dev->battery_present = true;
 		power_supply_changed(dev->battery);
 		return;
 	}
 	if (dev->battery_status != HID_BATTERY_REPORTED ||
 	    capacity != dev->battery_capacity ||
 	    ktime_after(ktime_get_coarse(), dev->battery_ratelimit_time)) {
+		dev->battery_present = true;
 		dev->battery_capacity = capacity;
 		dev->battery_status = HID_BATTERY_REPORTED;
 		dev->battery_ratelimit_time =

drivers/hid/hid-logitech-hidpp.c+5−1

 		if (!ret)
 			ret = hidpp_ff_init(hidpp, &data);
-		if (ret)
+		if (ret) {
 			hid_warn(hidpp->hid_dev,
 		     "Unable to initialize force feedback support, errno %d\n",
 				 ret);
+			ret = 0;
+		}
 	}
 	/*
 	  HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb038) },
 	{ /* Slim Solar+ K980 Keyboard over Bluetooth */
 	  HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb391) },
+	{ /* MX Master 4 mouse over Bluetooth */
+	  HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb042) },
 	{}
 };

drivers/hid/hid-multitouch.c+7−0

 		dev_warn(&hdev->dev, "failed to fetch feature %d\n",
 			 report->id);
 	} else {
+		/* The report ID in the request and the response should match */
+		if (report->id != buf[0]) {
+			hid_err(hdev, "Returned feature report did not match the request\n");
+			goto free;
+		}
 		ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, buf,
 					   size, 0);
 		if (ret)
 			dev_warn(&hdev->dev, "failed to report feature\n");
 	}
+free:
 	kfree(buf);
 }

drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c+1−0

@@ -127,6 +127,7 @@ int quicki2c_hid_probe(struct quicki2c_device *qcdev) · 126 unmodified lines
127	hid->product = le16_to_cpu(qcdev->dev_desc.product_id);	127	hid->product = le16_to_cpu(qcdev->dev_desc.product_id);
128	snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X", "quicki2c-hid",	128	snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X", "quicki2c-hid",
129	hid->vendor, hid->product);	129	hid->vendor, hid->product);
		130	strscpy(hid->phys, dev_name(qcdev->dev), sizeof(hid->phys));
130		131
131	ret = hid_add_device(hid);	132	ret = hid_add_device(hid);
132	if (ret) {	133	if (ret) {

drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c+1−0

@@ -118,6 +118,7 @@ int quickspi_hid_probe(struct quickspi_device *qsdev) · 117 unmodified lines
118	hid->product = le16_to_cpu(qsdev->dev_desc.product_id);	118	hid->product = le16_to_cpu(qsdev->dev_desc.product_id);
119	snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X", "quickspi-hid",	119	snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X", "quickspi-hid",
120	hid->vendor, hid->product);	120	hid->vendor, hid->product);
		121	strscpy(hid->phys, dev_name(qsdev->dev), sizeof(hid->phys));
121		122
122	ret = hid_add_device(hid);	123	ret = hid_add_device(hid);
123	if (ret) {	124	if (ret) {

drivers/hid/wacom_wac.c+10−0

 	switch (data[0]) {
 	case 0x04:
+		if (len < 32) {
+			dev_warn(wacom->pen_input->dev.parent,
+				 "Report 0x04 too short: %zu bytes\n", len);
+			break;
+		}
 		wacom_intuos_bt_process_data(wacom, data + i);
 		i += 10;
 		fallthrough;
 	case 0x03:
+		if (i == 1 && len < 22) {
+			dev_warn(wacom->pen_input->dev.parent,
+				 "Report 0x03 too short: %zu bytes\n", len);
+			break;
+		}
 		wacom_intuos_bt_process_data(wacom, data + i);
 		i += 10;
 		wacom_intuos_bt_process_data(wacom, data + i);

drivers/hv/mshv_regions.c+4−2

 		ret = pin_user_pages_fast(userspace_addr, nr_pages,
 					  FOLL_WRITE | FOLL_LONGTERM,
 					  pages);
-		if (ret < 0)
+		if (ret != nr_pages)
 			goto release_pages;
 	}
 	return 0;
 release_pages:
+	if (ret > 0)
+		done_count += ret;
 	mshv_region_invalidate_pages(region, 0, done_count);
-	return ret;
+	return ret < 0 ? ret : -ENOMEM;
 }
 static int mshv_region_chunk_unmap(struct mshv_mem_region *region,

drivers/hv/mshv_root.h+2−3

 };
 struct mshv_root {
-	struct hv_synic_pages __percpu *synic_pages;
 	spinlock_t pt_ht_lock;
 	DECLARE_HASHTABLE(pt_htable, MSHV_PARTITIONS_HASH_BITS);
 	struct hv_partition_property_vmm_capabilities vmm_caps;
 void mshv_unregister_doorbell(u64 partition_id, int doorbell_portid);
 void mshv_isr(void);
-int mshv_synic_init(unsigned int cpu);
+int mshv_synic_init(struct device *dev);
-int mshv_synic_cleanup(unsigned int cpu);
+void mshv_synic_exit(void);
 static inline bool mshv_partition_encrypted(struct mshv_partition *partition)
 {

drivers/hv/mshv_root_main.c+22−71

 	HVCALL_SET_VP_REGISTERS,
 	HVCALL_TRANSLATE_VIRTUAL_ADDRESS,
 	HVCALL_CLEAR_VIRTUAL_INTERRUPT,
-	HVCALL_SCRUB_PARTITION,
 	HVCALL_REGISTER_INTERCEPT_RESULT,
 	HVCALL_ASSERT_VIRTUAL_INTERRUPT,
 	HVCALL_GET_GPA_PAGES_ACCESS_STATES,
  */
 static long
 mshv_map_user_memory(struct mshv_partition *partition,
-		     struct mshv_user_mem_region mem)
+		     struct mshv_user_mem_region *mem)
 {
 	struct mshv_mem_region *region;
 	struct vm_area_struct *vma;
 	ulong mmio_pfn;
 	long ret;
-	if (mem.flags & BIT(MSHV_SET_MEM_BIT_UNMAP) ||
+	if (mem->flags & BIT(MSHV_SET_MEM_BIT_UNMAP) ||
-	    !access_ok((const void __user *)mem.userspace_addr, mem.size))
+	    !access_ok((const void __user *)mem->userspace_addr, mem->size))
 		return -EINVAL;
 	mmap_read_lock(current->mm);
-	vma = vma_lookup(current->mm, mem.userspace_addr);
+	vma = vma_lookup(current->mm, mem->userspace_addr);
 	is_mmio = vma ? !!(vma->vm_flags & (VM_IO | VM_PFNMAP)) : 0;
 	mmio_pfn = is_mmio ? vma->vm_pgoff : 0;
 	mmap_read_unlock(current->mm);
 	if (!vma)
 		return -EINVAL;
-	ret = mshv_partition_create_region(partition, &mem, &region,
+	ret = mshv_partition_create_region(partition, mem, &region,
 					   is_mmio);
 	if (ret)
 		return ret;
 	return 0;
 errout:
-	vfree(region);
+	mshv_region_put(region);
 	return ret;
 }
 /* Called for unmapping both the guest ram and the mmio space */
 static long
 mshv_unmap_user_memory(struct mshv_partition *partition,
-		       struct mshv_user_mem_region mem)
+		       struct mshv_user_mem_region *mem)
 {
 	struct mshv_mem_region *region;
-	if (!(mem.flags & BIT(MSHV_SET_MEM_BIT_UNMAP)))
+	if (!(mem->flags & BIT(MSHV_SET_MEM_BIT_UNMAP)))
 		return -EINVAL;
 	spin_lock(&partition->pt_mem_regions_lock);
-	region = mshv_partition_region_by_gfn(partition, mem.guest_pfn);
+	region = mshv_partition_region_by_gfn(partition, mem->guest_pfn);
 	if (!region) {
 		spin_unlock(&partition->pt_mem_regions_lock);
 		return -ENOENT;
 	}
 	/* Paranoia check */
-	if (region->start_uaddr != mem.userspace_addr ||
+	if (region->start_uaddr != mem->userspace_addr ||
-	    region->start_gfn != mem.guest_pfn ||
+	    region->start_gfn != mem->guest_pfn ||
-	    region->nr_pages != HVPFN_DOWN(mem.size)) {
+	    region->nr_pages != HVPFN_DOWN(mem->size)) {
 		spin_unlock(&partition->pt_mem_regions_lock);
 		return -EINVAL;
 	}
 		return -EINVAL;
 	if (mem.flags & BIT(MSHV_SET_MEM_BIT_UNMAP))
-		return mshv_unmap_user_memory(partition, mem);
+		return mshv_unmap_user_memory(partition, &mem);
-	return mshv_map_user_memory(partition, mem);
+	return mshv_map_user_memory(partition, &mem);
 }
 static long
 	return 0;
 }
-static int mshv_cpuhp_online;
 static int mshv_root_sched_online;
 static const char *scheduler_type_to_string(enum hv_scheduler_type type)
 	free_percpu(root_scheduler_output);
 }
-static int mshv_reboot_notify(struct notifier_block *nb,
-			      unsigned long code, void *unused)
-{
-	cpuhp_remove_state(mshv_cpuhp_online);
-	return 0;
-}
-struct notifier_block mshv_reboot_nb = {
-	.notifier_call = mshv_reboot_notify,
-};
-static void mshv_root_partition_exit(void)
-{
-	unregister_reboot_notifier(&mshv_reboot_nb);
-}
-static int __init mshv_root_partition_init(struct device *dev)
-{
-	return register_reboot_notifier(&mshv_reboot_nb);
-}
 static int __init mshv_init_vmm_caps(struct device *dev)
 {
 	int ret;
 			MSHV_HV_MAX_VERSION);
 	}
-	mshv_root.synic_pages = alloc_percpu(struct hv_synic_pages);
+	ret = mshv_synic_init(dev);
-	if (!mshv_root.synic_pages) {
+	if (ret)
-		dev_err(dev, "Failed to allocate percpu synic page\n");
-		ret = -ENOMEM;
 		goto device_deregister;
-	}
-	ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "mshv_synic",
-				mshv_synic_init,
-				mshv_synic_cleanup);
-	if (ret < 0) {
-		dev_err(dev, "Failed to setup cpu hotplug state: %i\n", ret);
-		goto free_synic_pages;
-	}
-	mshv_cpuhp_online = ret;
 	ret = mshv_init_vmm_caps(dev);
 	if (ret)
-		goto remove_cpu_state;
+		goto synic_cleanup;
 	ret = mshv_retrieve_scheduler_type(dev);
 	if (ret)
-		goto remove_cpu_state;
+		goto synic_cleanup;
-	if (hv_root_partition())
-		ret = mshv_root_partition_init(dev);
-	if (ret)
-		goto remove_cpu_state;
 	ret = root_scheduler_init(dev);
 	if (ret)
-		goto exit_partition;
+		goto synic_cleanup;
 	ret = mshv_debugfs_init();
 	if (ret)
 	mshv_debugfs_exit();
 deinit_root_scheduler:
 	root_scheduler_deinit();
-exit_partition:
+synic_cleanup:
-	if (hv_root_partition())
+	mshv_synic_exit();
-		mshv_root_partition_exit();
-remove_cpu_state:
-	cpuhp_remove_state(mshv_cpuhp_online);
-free_synic_pages:
-	free_percpu(mshv_root.synic_pages);
 device_deregister:
 	misc_deregister(&mshv_dev);
 	return ret;
 	misc_deregister(&mshv_dev);
 	mshv_irqfd_wq_cleanup();
 	root_scheduler_deinit();
-	if (hv_root_partition())
+	mshv_synic_exit();
-		mshv_root_partition_exit();
-	cpuhp_remove_state(mshv_cpuhp_online);
-	free_percpu(mshv_root.synic_pages);
 }
 module_init(mshv_parent_partition_init);

drivers/hv/mshv_synic.c+173−15

@@ -10,13 +10,22 @@ · 9 unmodified lines
10	#include <linux/kernel.h>	10	#include <linux/kernel.h>
11	#include <linux/slab.h>	11	#include <linux/slab.h>
12	#include <linux/mm.h>	12	#include <linux/mm.h>
		13	#include <linux/interrupt.h>
13	#include <linux/io.h>	14	#include <linux/io.h>
14	#include <linux/random.h>	15	#include <linux/random.h>
		16	#include <linux/cpuhotplug.h>
		17	#include <linux/reboot.h>
15	#include <asm/mshyperv.h>	18	#include <asm/mshyperv.h>
		19	#include <linux/acpi.h>
16		20
17	#include "mshv_eventfd.h"	21	#include "mshv_eventfd.h"
18	#include "mshv.h"	22	#include "mshv.h"
19		23
		24	static int synic_cpuhp_online;
		25	static struct hv_synic_pages __percpu *synic_pages;
		26	static int mshv_sint_vector = -1; /* hwirq for the SynIC SINTs */
		27	static int mshv_sint_irq = -1; /* Linux IRQ for mshv_sint_vector */
		28
20	static u32 synic_event_ring_get_queued_port(u32 sint_index)	29	static u32 synic_event_ring_get_queued_port(u32 sint_index)
21	{	30	{
22	struct hv_synic_event_ring_page **event_ring_page;	31	struct hv_synic_event_ring_page **event_ring_page;
@@ -26,7 +35,7 @@ static u32 synic_event_ring_get_queued_port(u32 sint_index) · 3 unmodified lines
26	u32 message;	35	u32 message;
27	u8 tail;	36	u8 tail;
28		37
29	spages = this_cpu_ptr(mshv_root.synic_pages);	38	spages = this_cpu_ptr(synic_pages);
30	event_ring_page = &spages->synic_event_ring_page;	39	event_ring_page = &spages->synic_event_ring_page;
31	synic_eventring_tail = (u8 **)this_cpu_ptr(hv_synic_eventring_tail);	40	synic_eventring_tail = (u8 **)this_cpu_ptr(hv_synic_eventring_tail);
32		41
@@ -393,7 +402,7 @@ unlock_out: · 360 unmodified lines
393		402
394	void mshv_isr(void)	403	void mshv_isr(void)
395	{	404	{
396	struct hv_synic_pages *spages = this_cpu_ptr(mshv_root.synic_pages);	405	struct hv_synic_pages *spages = this_cpu_ptr(synic_pages);
397	struct hv_message_page **msg_page = &spages->hyp_synic_message_page;	406	struct hv_message_page **msg_page = &spages->hyp_synic_message_page;
398	struct hv_message *msg;	407	struct hv_message *msg;
399	bool handled;	408	bool handled;
@@ -437,25 +446,21 @@ void mshv_isr(void) · 37 unmodified lines
437	if (msg->header.message_flags.msg_pending)	446	if (msg->header.message_flags.msg_pending)
438	hv_set_non_nested_msr(HV_MSR_EOM, 0);	447	hv_set_non_nested_msr(HV_MSR_EOM, 0);
439		448
440	#ifdef HYPERVISOR_CALLBACK_VECTOR	449	add_interrupt_randomness(mshv_sint_vector);
441	add_interrupt_randomness(HYPERVISOR_CALLBACK_VECTOR);
442	#endif
443	} else {	450	} else {
444	pr_warn_once("%s: unknown message type 0x%x\n", __func__,	451	pr_warn_once("%s: unknown message type 0x%x\n", __func__,
445	msg->header.message_type);	452	msg->header.message_type);
446	}	453	}
447	}	454	}
448		455
449	int mshv_synic_init(unsigned int cpu)	456	static int mshv_synic_cpu_init(unsigned int cpu)
450	{	457	{
451	union hv_synic_simp simp;	458	union hv_synic_simp simp;
452	union hv_synic_siefp siefp;	459	union hv_synic_siefp siefp;
453	union hv_synic_sirbp sirbp;	460	union hv_synic_sirbp sirbp;
454	#ifdef HYPERVISOR_CALLBACK_VECTOR
455	union hv_synic_sint sint;	461	union hv_synic_sint sint;
456	#endif
457	union hv_synic_scontrol sctrl;	462	union hv_synic_scontrol sctrl;
458	struct hv_synic_pages *spages = this_cpu_ptr(mshv_root.synic_pages);	463	struct hv_synic_pages *spages = this_cpu_ptr(synic_pages);
459	struct hv_message_page **msg_page = &spages->hyp_synic_message_page;	464	struct hv_message_page **msg_page = &spages->hyp_synic_message_page;
460	struct hv_synic_event_flags_page **event_flags_page =	465	struct hv_synic_event_flags_page **event_flags_page =
461	&spages->synic_event_flags_page;	466	&spages->synic_event_flags_page;
@@ -496,10 +501,12 @@ int mshv_synic_init(unsigned int cpu) · 34 unmodified lines
496		501
497	hv_set_non_nested_msr(HV_MSR_SIRBP, sirbp.as_uint64);	502	hv_set_non_nested_msr(HV_MSR_SIRBP, sirbp.as_uint64);
498		503
499	#ifdef HYPERVISOR_CALLBACK_VECTOR	504	if (mshv_sint_irq != -1)
		505	enable_percpu_irq(mshv_sint_irq, 0);
		506
500	/* Enable intercepts */	507	/* Enable intercepts */
501	sint.as_uint64 = 0;	508	sint.as_uint64 = 0;
502	sint.vector = HYPERVISOR_CALLBACK_VECTOR;	509	sint.vector = mshv_sint_vector;
503	sint.masked = false;	510	sint.masked = false;
504	sint.auto_eoi = hv_recommend_using_aeoi();	511	sint.auto_eoi = hv_recommend_using_aeoi();
505	hv_set_non_nested_msr(HV_MSR_SINT0 + HV_SYNIC_INTERCEPTION_SINT_INDEX,	512	hv_set_non_nested_msr(HV_MSR_SINT0 + HV_SYNIC_INTERCEPTION_SINT_INDEX,
@@ -507,13 +514,12 @@ int mshv_synic_init(unsigned int cpu) · 1 unmodified line
507		514
508	/* Doorbell SINT */	515	/* Doorbell SINT */
509	sint.as_uint64 = 0;	516	sint.as_uint64 = 0;
510	sint.vector = HYPERVISOR_CALLBACK_VECTOR;	517	sint.vector = mshv_sint_vector;
511	sint.masked = false;	518	sint.masked = false;
512	sint.as_intercept = 1;	519	sint.as_intercept = 1;
513	sint.auto_eoi = hv_recommend_using_aeoi();	520	sint.auto_eoi = hv_recommend_using_aeoi();
514	hv_set_non_nested_msr(HV_MSR_SINT0 + HV_SYNIC_DOORBELL_SINT_INDEX,	521	hv_set_non_nested_msr(HV_MSR_SINT0 + HV_SYNIC_DOORBELL_SINT_INDEX,
515	sint.as_uint64);	522	sint.as_uint64);
516	#endif
517		523
518	/* Enable global synic bit */	524	/* Enable global synic bit */
519	sctrl.as_uint64 = hv_get_non_nested_msr(HV_MSR_SCONTROL);	525	sctrl.as_uint64 = hv_get_non_nested_msr(HV_MSR_SCONTROL);
@@ -542,14 +548,14 @@ cleanup: · 22 unmodified lines
542	return -EFAULT;	548	return -EFAULT;
543	}	549	}
544		550
545	int mshv_synic_cleanup(unsigned int cpu)	551	static int mshv_synic_cpu_exit(unsigned int cpu)
546	{	552	{
547	union hv_synic_sint sint;	553	union hv_synic_sint sint;
548	union hv_synic_simp simp;	554	union hv_synic_simp simp;
549	union hv_synic_siefp siefp;	555	union hv_synic_siefp siefp;
550	union hv_synic_sirbp sirbp;	556	union hv_synic_sirbp sirbp;
551	union hv_synic_scontrol sctrl;	557	union hv_synic_scontrol sctrl;
552	struct hv_synic_pages *spages = this_cpu_ptr(mshv_root.synic_pages);	558	struct hv_synic_pages *spages = this_cpu_ptr(synic_pages);
553	struct hv_message_page **msg_page = &spages->hyp_synic_message_page;	559	struct hv_message_page **msg_page = &spages->hyp_synic_message_page;
554	struct hv_synic_event_flags_page **event_flags_page =	560	struct hv_synic_event_flags_page **event_flags_page =
555	&spages->synic_event_flags_page;	561	&spages->synic_event_flags_page;
@@ -568,6 +574,9 @@ int mshv_synic_cleanup(unsigned int cpu) · 12 unmodified lines
568	hv_set_non_nested_msr(HV_MSR_SINT0 + HV_SYNIC_DOORBELL_SINT_INDEX,	574	hv_set_non_nested_msr(HV_MSR_SINT0 + HV_SYNIC_DOORBELL_SINT_INDEX,
569	sint.as_uint64);	575	sint.as_uint64);
570		576
		577	if (mshv_sint_irq != -1)
		578	disable_percpu_irq(mshv_sint_irq);
		579
571	/* Disable Synic's event ring page */	580	/* Disable Synic's event ring page */
572	sirbp.as_uint64 = hv_get_non_nested_msr(HV_MSR_SIRBP);	581	sirbp.as_uint64 = hv_get_non_nested_msr(HV_MSR_SIRBP);
573	sirbp.sirbp_enabled = false;	582	sirbp.sirbp_enabled = false;
@@ -663,3 +672,152 @@ mshv_unregister_doorbell(u64 partition_id, int doorbell_portid) · 89 unmodified lines
663		672
664	mshv_portid_free(doorbell_portid);	673	mshv_portid_free(doorbell_portid);
665	}	674	}
		675
		676	static int mshv_synic_reboot_notify(struct notifier_block *nb,
		677	unsigned long code, void *unused)
		678	{
		679	if (!hv_root_partition())
		680	return 0;
		681
		682	cpuhp_remove_state(synic_cpuhp_online);
		683	return 0;
		684	}
		685
		686	static struct notifier_block mshv_synic_reboot_nb = {
		687	.notifier_call = mshv_synic_reboot_notify,
		688	};
		689
		690	#ifndef HYPERVISOR_CALLBACK_VECTOR
		691	static DEFINE_PER_CPU(long, mshv_evt);
		692
		693	static irqreturn_t mshv_percpu_isr(int irq, void *dev_id)
		694	{
		695	mshv_isr();
		696	return IRQ_HANDLED;
		697	}
		698
		699	#ifdef CONFIG_ACPI
		700	static int __init mshv_acpi_setup_sint_irq(void)
		701	{
		702	return acpi_register_gsi(NULL, mshv_sint_vector, ACPI_EDGE_SENSITIVE,
		703	ACPI_ACTIVE_HIGH);
		704	}
		705
		706	static void mshv_acpi_cleanup_sint_irq(void)
		707	{
		708	acpi_unregister_gsi(mshv_sint_vector);
		709	}
		710	#else
		711	static int __init mshv_acpi_setup_sint_irq(void)
		712	{
		713	return -ENODEV;
		714	}
		715
		716	static void mshv_acpi_cleanup_sint_irq(void)
		717	{
		718	}
		719	#endif
		720
		721	static int __init mshv_sint_vector_setup(void)
		722	{
		723	int ret;
		724	struct hv_register_assoc reg = {
		725	.name = HV_ARM64_REGISTER_SINT_RESERVED_INTERRUPT_ID,
		726	};
		727	union hv_input_vtl input_vtl = { 0 };
		728
		729	if (acpi_disabled)
		730	return -ENODEV;
		731
		732	ret = hv_call_get_vp_registers(HV_VP_INDEX_SELF, HV_PARTITION_ID_SELF,
		733	1, input_vtl, &reg);
		734	if (ret \|\| !reg.value.reg64)
		735	return -ENODEV;
		736
		737	mshv_sint_vector = reg.value.reg64;
		738	ret = mshv_acpi_setup_sint_irq();
		739	if (ret < 0) {
		740	pr_err("Failed to setup IRQ for MSHV SINT vector %d: %d\n",
		741	mshv_sint_vector, ret);
		742	goto out_fail;
		743	}
		744
		745	mshv_sint_irq = ret;
		746
		747	ret = request_percpu_irq(mshv_sint_irq, mshv_percpu_isr, "MSHV",
		748	&mshv_evt);
		749	if (ret)
		750	goto out_unregister;
		751
		752	return 0;
		753
		754	out_unregister:
		755	mshv_acpi_cleanup_sint_irq();
		756	out_fail:
		757	return ret;
		758	}
		759
		760	static void mshv_sint_vector_cleanup(void)
		761	{
		762	free_percpu_irq(mshv_sint_irq, &mshv_evt);
		763	mshv_acpi_cleanup_sint_irq();
		764	}
		765	#else /* !HYPERVISOR_CALLBACK_VECTOR */
		766	static int __init mshv_sint_vector_setup(void)
		767	{
		768	mshv_sint_vector = HYPERVISOR_CALLBACK_VECTOR;
		769	return 0;
		770	}
		771
		772	static void mshv_sint_vector_cleanup(void)
		773	{
		774	}
		775	#endif /* HYPERVISOR_CALLBACK_VECTOR */
		776
		777	int __init mshv_synic_init(struct device *dev)
		778	{
		779	int ret = 0;
		780
		781	ret = mshv_sint_vector_setup();
		782	if (ret)
		783	return ret;
		784
		785	synic_pages = alloc_percpu(struct hv_synic_pages);
		786	if (!synic_pages) {
		787	dev_err(dev, "Failed to allocate percpu synic page\n");
		788	ret = -ENOMEM;
		789	goto sint_vector_cleanup;
		790	}
		791
		792	ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "mshv_synic",
		793	mshv_synic_cpu_init,
		794	mshv_synic_cpu_exit);
		795	if (ret < 0) {
		796	dev_err(dev, "Failed to setup cpu hotplug state: %i\n", ret);
		797	goto free_synic_pages;
		798	}
		799
		800	synic_cpuhp_online = ret;
		801
		802	ret = register_reboot_notifier(&mshv_synic_reboot_nb);
		803	if (ret)
		804	goto remove_cpuhp_state;
		805
		806	return 0;
		807
		808	remove_cpuhp_state:
		809	cpuhp_remove_state(synic_cpuhp_online);
		810	free_synic_pages:
		811	free_percpu(synic_pages);
		812	sint_vector_cleanup:
		813	mshv_sint_vector_cleanup();
		814	return ret;
		815	}
		816
		817	void mshv_synic_exit(void)
		818	{
		819	unregister_reboot_notifier(&mshv_synic_reboot_nb);
		820	cpuhp_remove_state(synic_cpuhp_online);
		821	free_percpu(synic_pages);
		822	mshv_sint_vector_cleanup();
		823	}

drivers/hwmon/axi-fan-control.c+1−1

@@ -507,7 +507,7 @@ static int axi_fan_control_probe(struct platform_device *pdev) · 506 unmodified lines
507	ret = devm_request_threaded_irq(&pdev->dev, ctl->irq, NULL,	507	ret = devm_request_threaded_irq(&pdev->dev, ctl->irq, NULL,
508	axi_fan_control_irq_handler,	508	axi_fan_control_irq_handler,
509	IRQF_ONESHOT \| IRQF_TRIGGER_HIGH,	509	IRQF_ONESHOT \| IRQF_TRIGGER_HIGH,
510	pdev->driver_override, ctl);	510	NULL, ctl);
511	if (ret)	511	if (ret)
512	return dev_err_probe(&pdev->dev, ret,	512	return dev_err_probe(&pdev->dev, ret,
513	"failed to request an irq\n");	513	"failed to request an irq\n");

drivers/hwmon/max6639.c+5−5

@@ -232,7 +232,7 @@ static int max6639_read_fan(struct device *dev, u32 attr, int channel, · 231 unmodified lines
232	static int max6639_set_ppr(struct max6639_data *data, int channel, u8 ppr)	232	static int max6639_set_ppr(struct max6639_data *data, int channel, u8 ppr)
233	{	233	{
234	/* Decrement the PPR value and shift left by 6 to match the register format */	234	/* Decrement the PPR value and shift left by 6 to match the register format */
235	return regmap_write(data->regmap, MAX6639_REG_FAN_PPR(channel), ppr-- << 6);	235	return regmap_write(data->regmap, MAX6639_REG_FAN_PPR(channel), --ppr << 6);
236	}	236	}
237		237
238	static int max6639_write_fan(struct device *dev, u32 attr, int channel,	238	static int max6639_write_fan(struct device *dev, u32 attr, int channel,
@@ -524,8 +524,8 @@ static int max6639_probe_child_from_dt(struct i2c_client *client, · 285 unmodified lines
524		524
525	{	525	{
526	struct device *dev = &client->dev;	526	struct device *dev = &client->dev;
527	u32 i;	527	u32 i, val;
528	int err, val;	528	int err;
529		529
530	err = of_property_read_u32(child, "reg", &i);	530	err = of_property_read_u32(child, "reg", &i);
531	if (err) {	531	if (err) {
@@ -540,8 +540,8 @@ static int max6639_probe_child_from_dt(struct i2c_client *client, · 8 unmodified lines
540		540
541	err = of_property_read_u32(child, "pulses-per-revolution", &val);	541	err = of_property_read_u32(child, "pulses-per-revolution", &val);
542	if (!err) {	542	if (!err) {
543	if (val < 1 \|\| val > 5) {	543	if (val < 1 \|\| val > 4) {
544	dev_err(dev, "invalid pulses-per-revolution %d of %pOFn\n", val, child);	544	dev_err(dev, "invalid pulses-per-revolution %u of %pOFn\n", val, child);
545	return -EINVAL;	545	return -EINVAL;
546	}	546	}
547	data->ppr[i] = val;	547	data->ppr[i] = val;

drivers/hwmon/pmbus/hac300s.c+2−0

 	case PMBUS_MFR_VOUT_MIN:
 	case PMBUS_READ_VOUT:
 		rv = pmbus_read_word_data(client, page, phase, reg);
+		if (rv < 0)
+			return rv;
 		return FIELD_GET(LINEAR11_MANTISSA_MASK, rv);
 	default:
 		return -ENODATA;

drivers/hwmon/pmbus/ina233.c+2−0

@@ -67,6 +67,8 @@ static int ina233_read_word_data(struct i2c_client *client, int page, · 66 unmodified lines
67	switch (reg) {	67	switch (reg) {
68	case PMBUS_VIRT_READ_VMON:	68	case PMBUS_VIRT_READ_VMON:
69	ret = pmbus_read_word_data(client, 0, 0xff, MFR_READ_VSHUNT);	69	ret = pmbus_read_word_data(client, 0, 0xff, MFR_READ_VSHUNT);
		70	if (ret < 0)
		71	return ret;
70		72
71	/* Adjust returned value to match VIN coefficients */	73	/* Adjust returned value to match VIN coefficients */
72	/* VIN: 1.25 mV VSHUNT: 2.5 uV LSB */	74	/* VIN: 1.25 mV VSHUNT: 2.5 uV LSB */

drivers/hwmon/pmbus/isl68137.c+5−2

 {
 	int val = pmbus_read_byte_data(client, page, PMBUS_OPERATION);
-	return sprintf(buf, "%d\n",
+	if (val < 0)
-		       (val & ISL68137_VOUT_AVS) == ISL68137_VOUT_AVS ? 1 : 0);
+		return val;
+	return sysfs_emit(buf, "%d\n",
+			   (val & ISL68137_VOUT_AVS) == ISL68137_VOUT_AVS);
 }
 static ssize_t isl68137_avs_enable_store_page(struct i2c_client *client,

drivers/hwmon/pmbus/mp2869.c+21−14

 {
 	const struct pmbus_driver_info *info = pmbus_get_driver_info(client);
 	struct mp2869_data *data = to_mp2869_data(info);
-	int ret;
+	int ret, mfr;
 	switch (reg) {
 	case PMBUS_VOUT_MODE:
 		if (ret < 0)
 			return ret;
+		mfr = pmbus_read_byte_data(client, page,
+					   PMBUS_STATUS_MFR_SPECIFIC);
+		if (mfr < 0)
+			return mfr;
 		ret = (ret & ~GENMASK(2, 2)) |
 			FIELD_PREP(GENMASK(2, 2),
-				   FIELD_GET(GENMASK(1, 1),
+				   FIELD_GET(GENMASK(1, 1), mfr));
-					     pmbus_read_byte_data(client, page,
-								  PMBUS_STATUS_MFR_SPECIFIC)));
 		break;
 	case PMBUS_STATUS_TEMPERATURE:
 		/*
 		if (ret < 0)
 			return ret;
+		mfr = pmbus_read_byte_data(client, page,
+					   PMBUS_STATUS_MFR_SPECIFIC);
+		if (mfr < 0)
+			return mfr;
 		ret = (ret & ~GENMASK(7, 6)) |
 			FIELD_PREP(GENMASK(6, 6),
-				   FIELD_GET(GENMASK(1, 1),
+				   FIELD_GET(GENMASK(1, 1), mfr)) |
-					     pmbus_read_byte_data(client, page,
-								  PMBUS_STATUS_MFR_SPECIFIC))) |
 			 FIELD_PREP(GENMASK(7, 7),
-				    FIELD_GET(GENMASK(1, 1),
+				    FIELD_GET(GENMASK(1, 1), mfr));
-					      pmbus_read_byte_data(client, page,
-								   PMBUS_STATUS_MFR_SPECIFIC)));
 		break;
 	default:
 		ret = -ENODATA;
 {
 	const struct pmbus_driver_info *info = pmbus_get_driver_info(client);
 	struct mp2869_data *data = to_mp2869_data(info);
-	int ret;
+	int ret, mfr;
 	switch (reg) {
 	case PMBUS_STATUS_WORD:
 		if (ret < 0)
 			return ret;
+		mfr = pmbus_read_byte_data(client, page,
+					   PMBUS_STATUS_MFR_SPECIFIC);
+		if (mfr < 0)
+			return mfr;
 		ret = (ret & ~GENMASK(2, 2)) |
 			 FIELD_PREP(GENMASK(2, 2),
-				    FIELD_GET(GENMASK(1, 1),
+				    FIELD_GET(GENMASK(1, 1), mfr));
-					      pmbus_read_byte_data(client, page,
-								   PMBUS_STATUS_MFR_SPECIFIC)));
 		break;
 	case PMBUS_READ_VIN:
 		/*

drivers/hwmon/pmbus/mp2975.c+2−0

 	case PMBUS_STATUS_WORD:
 		/* MP2973 & MP2971 return PGOOD instead of PB_STATUS_POWER_GOOD_N. */
 		ret = pmbus_read_word_data(client, page, phase, reg);
+		if (ret < 0)
+			return ret;
 		ret ^= PB_STATUS_POWER_GOOD_N;
 		break;
 	case PMBUS_OT_FAULT_LIMIT:

drivers/i2c/busses/Kconfig+2−0

 	tristate "NVIDIA Tegra internal I2C controller"
 	depends on ARCH_TEGRA || (COMPILE_TEST && (ARC || ARM || ARM64 || M68K || RISCV || SUPERH || SPARC))
 	# COMPILE_TEST needs architectures with readsX()/writesX() primitives
+	depends on PINCTRL
+	# ARCH_TEGRA implies PINCTRL, but the COMPILE_TEST side doesn't.
 	help
 	  If you say yes to this option, support will be included for the
 	  I2C controller embedded in NVIDIA Tegra SOCs

drivers/i2c/busses/i2c-cp2615.c+3−0

@@ -298,6 +298,9 @@ cp2615_i2c_probe(struct usb_interface usbif, const struct usb_device_id id) · 297 unmodified lines
298	if (!adap)	298	if (!adap)
299	return -ENOMEM;	299	return -ENOMEM;
300		300
		301	if (!usbdev->serial)
		302	return -EINVAL;
		303
301	strscpy(adap->name, usbdev->serial, sizeof(adap->name));	304	strscpy(adap->name, usbdev->serial, sizeof(adap->name));
302	adap->owner = THIS_MODULE;	305	adap->owner = THIS_MODULE;
303	adap->dev.parent = &usbif->dev;	306	adap->dev.parent = &usbif->dev;

drivers/i2c/busses/i2c-fsi.c+1−0

@@ -729,6 +729,7 @@ static int fsi_i2c_probe(struct fsi_device *fsi_dev) · 728 unmodified lines
729	rc = i2c_add_adapter(&port->adapter);	729	rc = i2c_add_adapter(&port->adapter);
730	if (rc < 0) {	730	if (rc < 0) {
731	dev_err(dev, "Failed to register adapter: %d\n", rc);	731	dev_err(dev, "Failed to register adapter: %d\n", rc);
		732	of_node_put(np);
732	kfree(port);	733	kfree(port);
733	continue;	734	continue;
734	}	735	}

drivers/i2c/busses/i2c-pxa.c+16−1

 	struct pinctrl		*pinctrl;
 	struct pinctrl_state	*pinctrl_default;
 	struct pinctrl_state	*pinctrl_recovery;
+	bool			reset_before_xfer;
 };
 #define _IBMR(i2c)	((i2c)->reg_ibmr)
 {
 	struct pxa_i2c *i2c = adap->algo_data;
+	if (i2c->reset_before_xfer) {
+		i2c_pxa_reset(i2c);
+		i2c->reset_before_xfer = false;
+	}
 	return i2c_pxa_internal_xfer(i2c, msgs, num, i2c_pxa_do_xfer);
 }
 		}
 	}
-	i2c_pxa_reset(i2c);
+	/*
+	 * Skip reset on Armada 3700 when recovery is used to avoid
+	 * controller hang due to the pinctrl state changes done by
+	 * the generic recovery initialization code. The reset will
+	 * be performed later, prior to the first transfer.
+	 */
+	if (i2c_type == REGS_A3700 && i2c->adap.bus_recovery_info)
+		i2c->reset_before_xfer = true;
+	else
+		i2c_pxa_reset(i2c);
 	ret = i2c_add_numbered_adapter(&i2c->adap);
 	if (ret < 0)

drivers/i2c/busses/i2c-tegra.c+4−1

 	 *
 	 * VI I2C device shouldn't be marked as IRQ-safe because VI I2C won't
 	 * be used for atomic transfers. ACPI device is not IRQ safe also.
+	 *
+	 * Devices with pinctrl states cannot be marked IRQ-safe as the pinctrl
+	 * state transitions during runtime PM require mutexes.
 	 */
-	if (!IS_VI(i2c_dev) && !has_acpi_companion(i2c_dev->dev))
+	if (!IS_VI(i2c_dev) && !has_acpi_companion(i2c_dev->dev) && !i2c_dev->dev->pins)
 		pm_runtime_irq_safe(i2c_dev->dev);
 	pm_runtime_enable(i2c_dev->dev);

drivers/iommu/amd/iommu.c+14−1

@@ -2909,8 +2909,21 @@ static struct iommu_domain blocked_domain = { · 2908 unmodified lines
2909		2909
2910	static struct protection_domain identity_domain;	2910	static struct protection_domain identity_domain;
2911		2911
		2912	static int amd_iommu_identity_attach(struct iommu_domain dom, struct device dev,
		2913	struct iommu_domain *old)
		2914	{
		2915	/*
		2916	* Don't allow attaching a device to the identity domain if SNP is
		2917	* enabled.
		2918	*/
		2919	if (amd_iommu_snp_en)
		2920	return -EINVAL;
		2921
		2922	return amd_iommu_attach_device(dom, dev, old);
		2923	}
		2924
2912	static const struct iommu_domain_ops identity_domain_ops = {	2925	static const struct iommu_domain_ops identity_domain_ops = {
2913	.attach_dev = amd_iommu_attach_device,	2926	.attach_dev = amd_iommu_identity_attach,
2914	};	2927	};
2915		2928
2916	void amd_iommu_init_identity_domain(void)	2929	void amd_iommu_init_identity_domain(void)

drivers/iommu/intel/dmar.c+1−2

 	if (fault & DMA_FSTS_ITE) {
 		head = readl(iommu->reg + DMAR_IQH_REG);
 		head = ((head >> shift) - 1 + QI_LENGTH) % QI_LENGTH;
-		head |= 1;
 		tail = readl(iommu->reg + DMAR_IQT_REG);
 		tail = ((tail >> shift) - 1 + QI_LENGTH) % QI_LENGTH;
 		do {
 			if (qi->desc_status[head] == QI_IN_USE)
 				qi->desc_status[head] = QI_ABORT;
-			head = (head - 2 + QI_LENGTH) % QI_LENGTH;
+			head = (head - 1 + QI_LENGTH) % QI_LENGTH;
 		} while (head != tail);
 		/*

drivers/iommu/intel/svm.c+8−4

 	if (IS_ERR(dev_pasid))
 		return PTR_ERR(dev_pasid);
-	ret = iopf_for_domain_replace(domain, old, dev);
+	/* SVA with non-IOMMU/PRI IOPF handling is allowed. */
-	if (ret)
+	if (info->pri_supported) {
-		goto out_remove_dev_pasid;
+		ret = iopf_for_domain_replace(domain, old, dev);
+		if (ret)
+			goto out_remove_dev_pasid;
+	}
 	/* Setup the pasid table: */
 	sflags = cpu_feature_enabled(X86_FEATURE_LA57) ? PASID_FLAG_FL5LP : 0;
 	return 0;
 out_unwind_iopf:
-	iopf_for_domain_replace(old, domain, dev);
+	if (info->pri_supported)
+		iopf_for_domain_replace(old, domain, dev);
 out_remove_dev_pasid:
 	domain_remove_dev_pasid(domain, dev, pasid);
 	return ret;

drivers/iommu/iommu-sva.c+6−6

 	iommu_detach_device_pasid(domain, dev, iommu_mm->pasid);
 	if (--domain->users == 0) {
 		list_del(&domain->next);
-		iommu_domain_free(domain);
+		if (list_empty(&iommu_mm->sva_domains)) {
-	}
+			list_del(&iommu_mm->mm_list_elm);
+			if (list_empty(&iommu_sva_mms))
+				iommu_sva_present = false;
+		}
-	if (list_empty(&iommu_mm->sva_domains)) {
+		iommu_domain_free(domain);
-		list_del(&iommu_mm->mm_list_elm);
-		if (list_empty(&iommu_sva_mms))
-			iommu_sva_present = false;
 	}
 	mutex_unlock(&iommu_sva_lock);

drivers/iommu/iommu.c+5−1

 			if (addr == end)
 				goto map_end;
-			phys_addr = iommu_iova_to_phys(domain, addr);
+			/*
+			 * Return address by iommu_iova_to_phys for 0 is
+			 * ambiguous. Offset to address 1 if addr is 0.
+			 */
+			phys_addr = iommu_iova_to_phys(domain, addr ? addr : 1);
 			if (!phys_addr) {
 				map_size += pg_size;
 				continue;

drivers/irqchip/irq-riscv-rpmi-sysmsi.c+1−0

@@ -250,6 +250,7 @@ static int rpmi_sysmsi_probe(struct platform_device *pdev) · 249 unmodified lines
250	rc = riscv_acpi_get_gsi_info(fwnode, &priv->gsi_base, &id,	250	rc = riscv_acpi_get_gsi_info(fwnode, &priv->gsi_base, &id,
251	&nr_irqs, NULL);	251	&nr_irqs, NULL);
252	if (rc) {	252	if (rc) {
		253	mbox_free_channel(priv->chan);
253	dev_err(dev, "failed to find GSI mapping\n");	254	dev_err(dev, "failed to find GSI mapping\n");
254	return rc;	255	return rc;
255	}	256	}

drivers/mmc/host/sdhci-pci-gli.c+9−0

 #define   GLI_9750_MISC_TX1_DLY_VALUE    0x5
 #define   SDHCI_GLI_9750_MISC_SSC_OFF    BIT(26)
+#define SDHCI_GLI_9750_GM_BURST_SIZE		  0x510
+#define   SDHCI_GLI_9750_GM_BURST_SIZE_R_OSRC_LMT  GENMASK(17, 16)
 #define SDHCI_GLI_9750_TUNING_CONTROL	          0x540
 #define   SDHCI_GLI_9750_TUNING_CONTROL_EN          BIT(4)
 #define   GLI_9750_TUNING_CONTROL_EN_ON             0x1
 	u32 misc_value;
 	u32 parameter_value;
 	u32 control_value;
+	u32 burst_value;
 	u16 ctrl2;
 	gl9750_wt_on(host);
+	/* clear R_OSRC_Lmt to avoid DMA write corruption */
+	burst_value = sdhci_readl(host, SDHCI_GLI_9750_GM_BURST_SIZE);
+	burst_value &= ~SDHCI_GLI_9750_GM_BURST_SIZE_R_OSRC_LMT;
+	sdhci_writel(host, burst_value, SDHCI_GLI_9750_GM_BURST_SIZE);
 	driving_value = sdhci_readl(host, SDHCI_GLI_9750_DRIVING);
 	pll_value = sdhci_readl(host, SDHCI_GLI_9750_PLL);
 	sw_ctrl_value = sdhci_readl(host, SDHCI_GLI_9750_SW_CTRL);

drivers/mmc/host/sdhci.c+8−1

 	 * their platform code before calling sdhci_add_host(), and we
 	 * won't assume 8-bit width for hosts without that CAP.
 	 */
-	if (!(host->quirks & SDHCI_QUIRK_FORCE_1_BIT_DATA))
+	if (host->quirks & SDHCI_QUIRK_FORCE_1_BIT_DATA) {
+		host->caps1 &= ~(SDHCI_SUPPORT_SDR104 | SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_DDR50);
+		if (host->quirks2 & SDHCI_QUIRK2_CAPS_BIT63_FOR_HS400)
+			host->caps1 &= ~SDHCI_SUPPORT_HS400;
+		mmc->caps2 &= ~(MMC_CAP2_HS200 | MMC_CAP2_HS400 | MMC_CAP2_HS400_ES);
+		mmc->caps &= ~(MMC_CAP_DDR | MMC_CAP_UHS);
+	} else {
 		mmc->caps |= MMC_CAP_4_BIT_DATA;
+	}
 	if (host->quirks2 & SDHCI_QUIRK2_HOST_NO_CMD23)
 		mmc->caps &= ~MMC_CAP_CMD23;

drivers/mtd/nand/raw/brcmnand/brcmnand.c+2−4

@@ -2350,14 +2350,12 @@ static int brcmnand_write(struct mtd_info mtd, struct nand_chip chip, · 2349 unmodified lines
2350	for (i = 0; i < ctrl->max_oob; i += 4)	2350	for (i = 0; i < ctrl->max_oob; i += 4)
2351	oob_reg_write(ctrl, i, 0xffffffff);	2351	oob_reg_write(ctrl, i, 0xffffffff);
2352		2352
2353	if (mtd->oops_panic_write)	2353	if (mtd->oops_panic_write) {
2354	/* switch to interrupt polling and PIO mode */	2354	/* switch to interrupt polling and PIO mode */
2355	disable_ctrl_irqs(ctrl);	2355	disable_ctrl_irqs(ctrl);
2356		2356	} else if (use_dma(ctrl) && (has_edu(ctrl) \|\| !oob) && flash_dma_buf_ok(buf)) {
2357	if (use_dma(ctrl) && (has_edu(ctrl) \|\| !oob) && flash_dma_buf_ok(buf)) {
2358	if (ctrl->dma_trans(host, addr, (u32 *)buf, oob, mtd->writesize,	2357	if (ctrl->dma_trans(host, addr, (u32 *)buf, oob, mtd->writesize,
2359	CMD_PROGRAM_PAGE))	2358	CMD_PROGRAM_PAGE))
2360
2361	ret = -EIO;	2359	ret = -EIO;
2362		2360
2363	goto out;	2361	goto out;

drivers/mtd/nand/raw/cadence-nand-controller.c+1−1

@@ -3133,7 +3133,7 @@ static int cadence_nand_init(struct cdns_nand_ctrl *cdns_ctrl) · 3132 unmodified lines
3133	sizeof(*cdns_ctrl->cdma_desc),	3133	sizeof(*cdns_ctrl->cdma_desc),
3134	&cdns_ctrl->dma_cdma_desc,	3134	&cdns_ctrl->dma_cdma_desc,
3135	GFP_KERNEL);	3135	GFP_KERNEL);
3136	if (!cdns_ctrl->dma_cdma_desc)	3136	if (!cdns_ctrl->cdma_desc)
3137	return -ENOMEM;	3137	return -ENOMEM;
3138		3138
3139	cdns_ctrl->buf_size = SZ_16K;	3139	cdns_ctrl->buf_size = SZ_16K;

drivers/mtd/nand/raw/nand_base.c+12−2

 static int nand_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
 {
 	struct nand_chip *chip = mtd_to_nand(mtd);
+	int ret;
 	if (!chip->ops.lock_area)
 		return -ENOTSUPP;
-	return chip->ops.lock_area(chip, ofs, len);
+	nand_get_device(chip);
+	ret = chip->ops.lock_area(chip, ofs, len);
+	nand_release_device(chip);
+	return ret;
 }
 /**
 static int nand_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
 {
 	struct nand_chip *chip = mtd_to_nand(mtd);
+	int ret;
 	if (!chip->ops.unlock_area)
 		return -ENOTSUPP;
-	return chip->ops.unlock_area(chip, ofs, len);
+	nand_get_device(chip);
+	ret = chip->ops.unlock_area(chip, ofs, len);
+	nand_release_device(chip);
+	return ret;
 }
 /* Set default functions */

drivers/mtd/nand/raw/pl35x-nand-controller.c+3−0

@@ -862,6 +862,9 @@ static int pl35x_nfc_setup_interface(struct nand_chip *chip, int cs, · 861 unmodified lines
862	PL35X_SMC_NAND_TAR_CYCLES(tmgs.t_ar) \|	862	PL35X_SMC_NAND_TAR_CYCLES(tmgs.t_ar) \|
863	PL35X_SMC_NAND_TRR_CYCLES(tmgs.t_rr);	863	PL35X_SMC_NAND_TRR_CYCLES(tmgs.t_rr);
864		864
		865	writel(plnand->timings, nfc->conf_regs + PL35X_SMC_CYCLES);
		866	pl35x_smc_update_regs(nfc);
		867
865	return 0;	868	return 0;
866	}	869	}
867		870

drivers/mtd/parsers/redboot.c+3−3

@@ -270,9 +270,9 @@ nogood: · 269 unmodified lines
270		270
271	strcpy(names, fl->img->name);	271	strcpy(names, fl->img->name);
272	#ifdef CONFIG_MTD_REDBOOT_PARTS_READONLY	272	#ifdef CONFIG_MTD_REDBOOT_PARTS_READONLY
273	if (!memcmp(names, "RedBoot", 8) \|\|	273	if (!strcmp(names, "RedBoot") \|\|
274	!memcmp(names, "RedBoot config", 15) \|\|	274	!strcmp(names, "RedBoot config") \|\|
275	!memcmp(names, "FIS directory", 14)) {	275	!strcmp(names, "FIS directory")) {
276	parts[i].mask_flags = MTD_WRITEABLE;	276	parts[i].mask_flags = MTD_WRITEABLE;
277	}	277	}
278	#endif	278	#endif

drivers/mtd/spi-nor/core.c+7−7

@@ -2345,15 +2345,15 @@ int spi_nor_hwcaps_pp2cmd(u32 hwcaps) · 2344 unmodified lines
2345	}	2345	}
2346		2346
2347	/**	2347	/**
2348	* spi_nor_spimem_check_op - check if the operation is supported	2348	* spi_nor_spimem_check_read_pp_op - check if a read or a page program operation is
2349	* by controller	2349	* supported by controller
2350	*@nor: pointer to a 'struct spi_nor'	2350	*@nor: pointer to a 'struct spi_nor'
2351	*@op: pointer to op template to be checked	2351	*@op: pointer to op template to be checked
2352	*	2352	*
2353	* Returns 0 if operation is supported, -EOPNOTSUPP otherwise.	2353	* Returns 0 if operation is supported, -EOPNOTSUPP otherwise.
2354	*/	2354	*/
2355	static int spi_nor_spimem_check_op(struct spi_nor *nor,	2355	static int spi_nor_spimem_check_read_pp_op(struct spi_nor *nor,
2356	struct spi_mem_op *op)	2356	struct spi_mem_op *op)
2357	{	2357	{
2358	/*	2358	/*
2359	* First test with 4 address bytes. The opcode itself might	2359	* First test with 4 address bytes. The opcode itself might
@@ -2396,7 +2396,7 @@ static int spi_nor_spimem_check_readop(struct spi_nor *nor, · 36 unmodified lines
2396	if (spi_nor_protocol_is_dtr(nor->read_proto))	2396	if (spi_nor_protocol_is_dtr(nor->read_proto))
2397	op.dummy.nbytes *= 2;	2397	op.dummy.nbytes *= 2;
2398		2398
2399	return spi_nor_spimem_check_op(nor, &op);	2399	return spi_nor_spimem_check_read_pp_op(nor, &op);
2400	}	2400	}
2401		2401
2402	/**	2402	/**
@@ -2414,7 +2414,7 @@ static int spi_nor_spimem_check_pp(struct spi_nor *nor, · 11 unmodified lines
2414		2414
2415	spi_nor_spimem_setup_op(nor, &op, pp->proto);	2415	spi_nor_spimem_setup_op(nor, &op, pp->proto);
2416		2416
2417	return spi_nor_spimem_check_op(nor, &op);	2417	return spi_nor_spimem_check_read_pp_op(nor, &op);
2418	}	2418	}
2419		2419
2420	/**	2420	/**
@@ -2466,7 +2466,7 @@ spi_nor_spimem_adjust_hwcaps(struct spi_nor nor, u32 hwcaps) · 45 unmodified lines
2466		2466
2467	spi_nor_spimem_setup_op(nor, &op, nor->reg_proto);	2467	spi_nor_spimem_setup_op(nor, &op, nor->reg_proto);
2468		2468
2469	if (spi_nor_spimem_check_op(nor, &op))	2469	if (!spi_mem_supports_op(nor->spimem, &op))
2470	nor->flags \|= SNOR_F_NO_READ_CR;	2470	nor->flags \|= SNOR_F_NO_READ_CR;
2471	}	2471	}
2472	}	2472	}

drivers/net/bonding/bond_debugfs.c+11−5

 	for (; hash_index != RLB_NULL_INDEX;
 	     hash_index = client_info->used_next) {
 		client_info = &(bond_info->rx_hashtbl[hash_index]);
-		seq_printf(m, "%-15pI4 %-15pI4 %-17pM %s\n",
+		if (client_info->slave)
-			&client_info->ip_src,
+			seq_printf(m, "%-15pI4 %-15pI4 %-17pM %s\n",
-			&client_info->ip_dst,
+				   &client_info->ip_src,
-			&client_info->mac_dst,
+				   &client_info->ip_dst,
-			client_info->slave->dev->name);
+				   &client_info->mac_dst,
+				   client_info->slave->dev->name);
+		else
+			seq_printf(m, "%-15pI4 %-15pI4 %-17pM (none)\n",
+				   &client_info->ip_src,
+				   &client_info->ip_dst,
+				   &client_info->mac_dst);
 	}
 	spin_unlock_bh(&bond->mode_lock);

drivers/net/bonding/bond_main.c+5−3

 	return ret;
 }
-static int bond_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+static int bond_header_parse(const struct sk_buff *skb,
+			     const struct net_device *dev,
+			     unsigned char *haddr)
 {
-	struct bonding *bond = netdev_priv(skb->dev);
+	struct bonding *bond = netdev_priv(dev);
 	const struct header_ops *slave_ops;
 	struct slave *slave;
 	int ret = 0;
 	if (slave) {
 		slave_ops = READ_ONCE(slave->dev->header_ops);
 		if (slave_ops && slave_ops->parse)
-			ret = slave_ops->parse(skb, haddr);
+			ret = slave_ops->parse(skb, slave->dev, haddr);
 	}
 	rcu_read_unlock();
 	return ret;

drivers/net/dsa/bcm_sf2.c+6−2

@@ -980,15 +980,19 @@ static int bcm_sf2_sw_resume(struct dsa_switch *ds) · 979 unmodified lines
980	ret = bcm_sf2_sw_rst(priv);	980	ret = bcm_sf2_sw_rst(priv);
981	if (ret) {	981	if (ret) {
982	pr_err("%s: failed to software reset switch\n", __func__);	982	pr_err("%s: failed to software reset switch\n", __func__);
		983	if (!priv->wol_ports_mask)
		984	clk_disable_unprepare(priv->clk);
983	return ret;	985	return ret;
984	}	986	}
985		987
986	bcm_sf2_crossbar_setup(priv);	988	bcm_sf2_crossbar_setup(priv);
987		989
988	ret = bcm_sf2_cfp_resume(ds);	990	ret = bcm_sf2_cfp_resume(ds);
989	if (ret)	991	if (ret) {
		992	if (!priv->wol_ports_mask)
		993	clk_disable_unprepare(priv->clk);
990	return ret;	994	return ret;
991		995	}
992	if (priv->hw_params.num_gphy == 1)	996	if (priv->hw_params.num_gphy == 1)
993	bcm_sf2_gphy_enable_set(ds, true);	997	bcm_sf2_gphy_enable_set(ds, true);
994		998

drivers/net/ethernet/airoha/airoha_eth.c+0−1

@@ -3083,7 +3083,6 @@ static void airoha_remove(struct platform_device *pdev) · 3082 unmodified lines
3083	if (!port)	3083	if (!port)
3084	continue;	3084	continue;
3085		3085
3086	airoha_dev_stop(port->dev);
3087	unregister_netdev(port->dev);	3086	unregister_netdev(port->dev);
3088	airoha_metadata_dst_free(port);	3087	airoha_metadata_dst_free(port);
3089	}	3088	}

drivers/net/ethernet/broadcom/bnxt/bnxt.c+2−0

@@ -2929,6 +2929,8 @@ static int bnxt_async_event_process(struct bnxt *bp, · 2928 unmodified lines
2929	u16 type = (u16)BNXT_EVENT_BUF_PRODUCER_TYPE(data1);	2929	u16 type = (u16)BNXT_EVENT_BUF_PRODUCER_TYPE(data1);
2930	u32 offset = BNXT_EVENT_BUF_PRODUCER_OFFSET(data2);	2930	u32 offset = BNXT_EVENT_BUF_PRODUCER_OFFSET(data2);
2931		2931
		2932	if (type >= ARRAY_SIZE(bp->bs_trace))
		2933	goto async_event_process_exit;
2932	bnxt_bs_trace_check_wrap(&bp->bs_trace[type], offset);	2934	bnxt_bs_trace_check_wrap(&bp->bs_trace[type], offset);
2933	goto async_event_process_exit;	2935	goto async_event_process_exit;
2934	}	2936	}

drivers/net/ethernet/broadcom/bnxt/bnxt.h+1−1

@@ -2146,7 +2146,7 @@ enum board_idx { · 2145 unmodified lines
2146	};	2146	};
2147		2147
2148	#define BNXT_TRACE_BUF_MAGIC_BYTE ((u8)0xbc)	2148	#define BNXT_TRACE_BUF_MAGIC_BYTE ((u8)0xbc)
2149	#define BNXT_TRACE_MAX 11	2149	#define BNXT_TRACE_MAX (DBG_LOG_BUFFER_FLUSH_REQ_TYPE_ERR_QPC_TRACE + 1)
2150		2150
2151	struct bnxt_bs_trace_info {	2151	struct bnxt_bs_trace_info {
2152	u8 *magic_byte;	2152	u8 *magic_byte;

drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c+1−1

@@ -123,7 +123,7 @@ static int bcmgenet_poll_wol_status(struct bcmgenet_priv *priv) · 122 unmodified lines
123	while (!(bcmgenet_rbuf_readl(priv, RBUF_STATUS)	123	while (!(bcmgenet_rbuf_readl(priv, RBUF_STATUS)
124	& RBUF_STATUS_WOL)) {	124	& RBUF_STATUS_WOL)) {
125	retries++;	125	retries++;
126	if (retries > 5) {	126	if (retries > 50) {
127	netdev_crit(dev, "polling wol mode timeout\n");	127	netdev_crit(dev, "polling wol mode timeout\n");
128	return -ETIMEDOUT;	128	return -ETIMEDOUT;
129	}	129	}

drivers/net/ethernet/broadcom/tg3.c+11−0

 	return err;
 }
+static int tg3_is_default_mac_address(u8 *addr)
+{
+	static const u8 default_mac_address[ETH_ALEN] = { 0x00, 0x10, 0x18, 0x00, 0x00, 0x00 };
+	return ether_addr_equal(default_mac_address, addr);
+}
 static int tg3_get_device_address(struct tg3 *tp, u8 *addr)
 {
 	u32 hi, lo, mac_offset;
 	if (!is_valid_ether_addr(addr))
 		return -EINVAL;
+	if (tg3_is_default_mac_address(addr))
+		return device_get_mac_address(&tp->pdev->dev, addr);
 	return 0;
 }

drivers/net/ethernet/cadence/macb_main.c+22−4

 	desc->ctrl = 0;
 }
+static void gem_init_rx_ring(struct macb_queue *queue)
+{
+	queue->rx_tail = 0;
+	queue->rx_prepared_head = 0;
+	gem_rx_refill(queue);
+}
 static void gem_init_rings(struct macb *bp)
 {
 	struct macb_queue *queue;
 		queue->tx_head = 0;
 		queue->tx_tail = 0;
-		queue->rx_tail = 0;
+		gem_init_rx_ring(queue);
-		queue->rx_prepared_head = 0;
-		gem_rx_refill(queue);
 	}
 	macb_init_tieoff(bp);
 	struct macb *bp = netdev_priv(netdev);
 	int ret;
+	if (!(netdev->hw_features & NETIF_F_NTUPLE))
+		return -EOPNOTSUPP;
 	switch (cmd->cmd) {
 	case ETHTOOL_SRXCLSRLINS:
 		if ((cmd->fs.location >= bp->max_tuples)
 		rtnl_unlock();
 	}
+	if (!(bp->caps & MACB_CAPS_MACB_IS_EMAC))
+		macb_init_buffers(bp);
 	for (q = 0, queue = bp->queues; q < bp->num_queues;
 	     ++q, ++queue) {
+		if (!(bp->caps & MACB_CAPS_MACB_IS_EMAC)) {
+			if (macb_is_gem(bp))
+				gem_init_rx_ring(queue);
+			else
+				macb_init_rx_ring(queue);
+		}
 		napi_enable(&queue->napi_rx);
 		napi_enable(&queue->napi_tx);
 	}

drivers/net/ethernet/cadence/macb_ptp.c+3−1

@@ -357,8 +357,10 @@ void gem_ptp_remove(struct net_device *ndev) · 356 unmodified lines
357	{	357	{
358	struct macb *bp = netdev_priv(ndev);	358	struct macb *bp = netdev_priv(ndev);
359		359
360	if (bp->ptp_clock)	360	if (bp->ptp_clock) {
361	ptp_clock_unregister(bp->ptp_clock);	361	ptp_clock_unregister(bp->ptp_clock);
		362	bp->ptp_clock = NULL;
		363	}
362		364
363	gem_ptp_clear_timer(bp);	365	gem_ptp_clear_timer(bp);
364		366

drivers/net/ethernet/intel/iavf/iavf_main.c+6−3

 		adapter->num_vlan_filters++;
 		iavf_schedule_aq_request(adapter, IAVF_FLAG_AQ_ADD_VLAN_FILTER);
 	} else if (f->state == IAVF_VLAN_REMOVE) {
-		/* IAVF_VLAN_REMOVE means that VLAN wasn't yet removed.
+		/* Re-add the filter since we cannot tell whether the
-		 * We can safely only change the state here.
+		 * pending delete has already been processed by the PF.
+		 * A duplicate add is harmless.
 		 */
-		f->state = IAVF_VLAN_ACTIVE;
+		f->state = IAVF_VLAN_ADD;
+		iavf_schedule_aq_request(adapter,
+					 IAVF_FLAG_AQ_ADD_VLAN_FILTER);
 	}
 clearout:

drivers/net/ethernet/intel/igc/igc.h+2−0

@@ -781,6 +781,8 @@ int igc_ptp_hwtstamp_set(struct net_device *netdev, · 780 unmodified lines
781	struct kernel_hwtstamp_config *config,	781	struct kernel_hwtstamp_config *config,
782	struct netlink_ext_ack *extack);	782	struct netlink_ext_ack *extack);
783	void igc_ptp_tx_hang(struct igc_adapter *adapter);	783	void igc_ptp_tx_hang(struct igc_adapter *adapter);
		784	void igc_ptp_clear_xsk_tx_tstamp_queue(struct igc_adapter *adapter,
		785	u16 queue_id);
784	void igc_ptp_read(struct igc_adapter adapter, struct timespec64 ts);	786	void igc_ptp_read(struct igc_adapter adapter, struct timespec64 ts);
785	void igc_ptp_tx_tstamp_event(struct igc_adapter *adapter);	787	void igc_ptp_tx_tstamp_event(struct igc_adapter *adapter);
786		788

drivers/net/ethernet/intel/igc/igc_main.c+9−5

 	/* reset next_to_use and next_to_clean */
 	tx_ring->next_to_use = 0;
 	tx_ring->next_to_clean = 0;
+	/* Clear any lingering XSK TX timestamp requests */
+	if (test_bit(IGC_RING_FLAG_TX_HWTSTAMP, &tx_ring->flags)) {
+		struct igc_adapter *adapter = netdev_priv(tx_ring->netdev);
+		igc_ptp_clear_xsk_tx_tstamp_queue(adapter, tx_ring->queue_index);
+	}
 }
 /**
 	/* The minimum packet size with TCTL.PSP set is 17 so pad the skb
 	 * in order to meet this minimum size requirement.
 	 */
-	if (skb->len < 17) {
+	if (skb_put_padto(skb, 17))
-		if (skb_padto(skb, 17))
+		return NETDEV_TX_OK;
-			return NETDEV_TX_OK;
-		skb->len = 17;
-	}
 	return igc_xmit_frame_ring(skb, igc_tx_queue_mapping(adapter, skb));
 }

drivers/net/ethernet/intel/igc/igc_ptp.c+33−0

@@ -577,6 +577,39 @@ static void igc_ptp_clear_tx_tstamp(struct igc_adapter *adapter) · 576 unmodified lines
577	spin_unlock_irqrestore(&adapter->ptp_tx_lock, flags);	577	spin_unlock_irqrestore(&adapter->ptp_tx_lock, flags);
578	}	578	}
579		579
		580	/**
		581	* igc_ptp_clear_xsk_tx_tstamp_queue - Clear pending XSK TX timestamps for a queue
		582	* @adapter: Board private structure
		583	* @queue_id: TX queue index to clear timestamps for
		584	*
		585	* Iterates over all TX timestamp registers and releases any pending
		586	* timestamp requests associated with the given TX queue. This is
		587	* called when an XDP pool is being disabled to ensure no stale
		588	* timestamp references remain.
		589	*/
		590	void igc_ptp_clear_xsk_tx_tstamp_queue(struct igc_adapter *adapter, u16 queue_id)
		591	{
		592	unsigned long flags;
		593	int i;
		594
		595	spin_lock_irqsave(&adapter->ptp_tx_lock, flags);
		596
		597	for (i = 0; i < IGC_MAX_TX_TSTAMP_REGS; i++) {
		598	struct igc_tx_timestamp_request *tstamp = &adapter->tx_tstamp[i];
		599
		600	if (tstamp->buffer_type != IGC_TX_BUFFER_TYPE_XSK)
		601	continue;
		602	if (tstamp->xsk_queue_index != queue_id)
		603	continue;
		604	if (!tstamp->xsk_tx_buffer)
		605	continue;
		606
		607	igc_ptp_free_tx_buffer(adapter, tstamp);
		608	}
		609
		610	spin_unlock_irqrestore(&adapter->ptp_tx_lock, flags);
		611	}
		612
580	static void igc_ptp_disable_tx_timestamp(struct igc_adapter *adapter)	613	static void igc_ptp_disable_tx_timestamp(struct igc_adapter *adapter)
581	{	614	{
582	struct igc_hw *hw = &adapter->hw;	615	struct igc_hw *hw = &adapter->hw;

drivers/net/ethernet/intel/libie/fwlog.c+36−13

 	module = libie_find_module_by_dentry(fwlog->debugfs_modules, dentry);
 	if (module < 0) {
 		dev_info(dev, "unknown module\n");
-		return -EINVAL;
+		count = -EINVAL;
+		goto free_cmd_buf;
 	}
 	cnt = sscanf(cmd_buf, "%s", user_val);
-	if (cnt != 1)
+	if (cnt != 1) {
-		return -EINVAL;
+		count = -EINVAL;
+		goto free_cmd_buf;
+	}
 	log_level = sysfs_match_string(libie_fwlog_level_string, user_val);
 	if (log_level < 0) {
 		dev_info(dev, "unknown log level '%s'\n", user_val);
-		return -EINVAL;
+		count = -EINVAL;
+		goto free_cmd_buf;
 	}
 	if (module != LIBIE_AQC_FW_LOG_ID_MAX) {
 			fwlog->cfg.module_entries[i].log_level = log_level;
 	}
+free_cmd_buf:
+	kfree(cmd_buf);
 	return count;
 }
 		return PTR_ERR(cmd_buf);
 	ret = sscanf(cmd_buf, "%s", user_val);
-	if (ret != 1)
+	if (ret != 1) {
-		return -EINVAL;
+		count = -EINVAL;
+		goto free_cmd_buf;
+	}
 	ret = kstrtos16(user_val, 0, &nr_messages);
-	if (ret)
+	if (ret) {
-		return ret;
+		count = ret;
+		goto free_cmd_buf;
+	}
 	if (nr_messages < LIBIE_AQC_FW_LOG_MIN_RESOLUTION ||
 	    nr_messages > LIBIE_AQC_FW_LOG_MAX_RESOLUTION) {
 		dev_err(dev, "Invalid FW log number of messages %d, value must be between %d - %d\n",
 			nr_messages, LIBIE_AQC_FW_LOG_MIN_RESOLUTION,
 			LIBIE_AQC_FW_LOG_MAX_RESOLUTION);
-		return -EINVAL;
+		count = -EINVAL;
+		goto free_cmd_buf;
 	}
 	fwlog->cfg.log_resolution = nr_messages;
+free_cmd_buf:
+	kfree(cmd_buf);
 	return count;
 }
 		return PTR_ERR(cmd_buf);
 	ret = sscanf(cmd_buf, "%s", user_val);
-	if (ret != 1)
+	if (ret != 1) {
-		return -EINVAL;
+		ret = -EINVAL;
+		goto free_cmd_buf;
+	}
 	ret = kstrtobool(user_val, &enable);
 	if (ret)
 	 */
 	if (WARN_ON(ret != (ssize_t)count && ret >= 0))
 		ret = -EIO;
+free_cmd_buf:
+	kfree(cmd_buf);
 	return ret;
 }
 		return PTR_ERR(cmd_buf);
 	ret = sscanf(cmd_buf, "%s", user_val);
-	if (ret != 1)
+	if (ret != 1) {
-		return -EINVAL;
+		ret = -EINVAL;
+		goto free_cmd_buf;
+	}
 	index = sysfs_match_string(libie_fwlog_log_size, user_val);
 	if (index < 0) {
 	 */
 	if (WARN_ON(ret != (ssize_t)count && ret >= 0))
 		ret = -EIO;
+free_cmd_buf:
+	kfree(cmd_buf);
 	return ret;
 }

drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c+2−2

@@ -5016,7 +5016,7 @@ static int mvpp2_bm_switch_buffers(struct mvpp2 *priv, bool percpu) · 5015 unmodified lines
5016	if (priv->percpu_pools)	5016	if (priv->percpu_pools)
5017	numbufs = port->nrxqs * 2;	5017	numbufs = port->nrxqs * 2;
5018		5018
5019	if (change_percpu)	5019	if (change_percpu && priv->global_tx_fc)
5020	mvpp2_bm_pool_update_priv_fc(priv, false);	5020	mvpp2_bm_pool_update_priv_fc(priv, false);
5021		5021
5022	for (i = 0; i < numbufs; i++)	5022	for (i = 0; i < numbufs; i++)
@@ -5041,7 +5041,7 @@ static int mvpp2_bm_switch_buffers(struct mvpp2 *priv, bool percpu) · 18 unmodified lines
5041	mvpp2_open(port->dev);	5041	mvpp2_open(port->dev);
5042	}	5042	}
5043		5043
5044	if (change_percpu)	5044	if (change_percpu && priv->global_tx_fc)
5045	mvpp2_bm_pool_update_priv_fc(priv, true);	5045	mvpp2_bm_pool_update_priv_fc(priv, true);
5046		5046
5047	return 0;	5047	return 0;

drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h+1−0

@@ -287,6 +287,7 @@ struct mlx5e_ipsec_sa_entry { · 286 unmodified lines
287	struct mlx5e_ipsec_dwork *dwork;	287	struct mlx5e_ipsec_dwork *dwork;
288	struct mlx5e_ipsec_limits limits;	288	struct mlx5e_ipsec_limits limits;
289	u32 rx_mapped_id;	289	u32 rx_mapped_id;
		290	u8 ctx[MLX5_ST_SZ_BYTES(ipsec_aso)];
290	};	291	};
291		292
292	struct mlx5_accel_pol_xfrm_attrs {	293	struct mlx5_accel_pol_xfrm_attrs {

drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c+22−28

 	mlx5e_ipsec_aso_query(sa_entry, data);
 }
-static void mlx5e_ipsec_update_esn_state(struct mlx5e_ipsec_sa_entry *sa_entry,
+static void
-					 u32 mode_param)
+mlx5e_ipsec_update_esn_state(struct mlx5e_ipsec_sa_entry *sa_entry,
+			     u32 mode_param,
+			     struct mlx5_accel_esp_xfrm_attrs *attrs)
 {
-	struct mlx5_accel_esp_xfrm_attrs attrs = {};
 	struct mlx5_wqe_aso_ctrl_seg data = {};
 	if (mode_param < MLX5E_IPSEC_ESN_SCOPE_MID) {
 		sa_entry->esn_state.overlap = 1;
 	}
-	mlx5e_ipsec_build_accel_xfrm_attrs(sa_entry, &attrs);
+	mlx5e_ipsec_build_accel_xfrm_attrs(sa_entry, attrs);
-	/* It is safe to execute the modify below unlocked since the only flows
-	 * that could affect this HW object, are create, destroy and this work.
-	 *
-	 * Creation flow can't co-exist with this modify work, the destruction
-	 * flow would cancel this work, and this work is a single entity that
-	 * can't conflict with it self.
-	 */
-	spin_unlock_bh(&sa_entry->x->lock);
-	mlx5_accel_esp_modify_xfrm(sa_entry, &attrs);
-	spin_lock_bh(&sa_entry->x->lock);
 	data.data_offset_condition_operand =
 		MLX5_IPSEC_ASO_REMOVE_FLOW_PKT_CNT_OFFSET;
 static void mlx5e_ipsec_handle_limits(struct mlx5e_ipsec_sa_entry *sa_entry)
 {
 	struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs;
-	struct mlx5e_ipsec *ipsec = sa_entry->ipsec;
-	struct mlx5e_ipsec_aso *aso = ipsec->aso;
 	bool soft_arm, hard_arm;
 	u64 hard_cnt;
 	lockdep_assert_held(&sa_entry->x->lock);
-	soft_arm = !MLX5_GET(ipsec_aso, aso->ctx, soft_lft_arm);
+	soft_arm = !MLX5_GET(ipsec_aso, sa_entry->ctx, soft_lft_arm);
-	hard_arm = !MLX5_GET(ipsec_aso, aso->ctx, hard_lft_arm);
+	hard_arm = !MLX5_GET(ipsec_aso, sa_entry->ctx, hard_lft_arm);
 	if (!soft_arm && !hard_arm)
 		/* It is not lifetime event */
 		return;
-	hard_cnt = MLX5_GET(ipsec_aso, aso->ctx, remove_flow_pkt_cnt);
+	hard_cnt = MLX5_GET(ipsec_aso, sa_entry->ctx, remove_flow_pkt_cnt);
 	if (!hard_cnt || hard_arm) {
 		/* It is possible to see packet counter equal to zero without
 		 * hard limit event armed. Such situation can be if packet
 	struct mlx5e_ipsec_work *work =
 		container_of(_work, struct mlx5e_ipsec_work, work);
 	struct mlx5e_ipsec_sa_entry *sa_entry = work->data;
+	struct mlx5_accel_esp_xfrm_attrs tmp = {};
 	struct mlx5_accel_esp_xfrm_attrs *attrs;
-	struct mlx5e_ipsec_aso *aso;
+	bool need_modify = false;
 	int ret;
-	aso = sa_entry->ipsec->aso;
 	attrs = &sa_entry->attrs;
 	spin_lock_bh(&sa_entry->x->lock);
 	if (ret)
 		goto unlock;
+	if (attrs->lft.soft_packet_limit != XFRM_INF)
+		mlx5e_ipsec_handle_limits(sa_entry);
 	if (attrs->replay_esn.trigger &&
-	    !MLX5_GET(ipsec_aso, aso->ctx, esn_event_arm)) {
+	    !MLX5_GET(ipsec_aso, sa_entry->ctx, esn_event_arm)) {
-		u32 mode_param = MLX5_GET(ipsec_aso, aso->ctx, mode_parameter);
+		u32 mode_param = MLX5_GET(ipsec_aso, sa_entry->ctx,
+					  mode_parameter);
-		mlx5e_ipsec_update_esn_state(sa_entry, mode_param);
+		mlx5e_ipsec_update_esn_state(sa_entry, mode_param, &tmp);
+		need_modify = true;
 	}
-	if (attrs->lft.soft_packet_limit != XFRM_INF)
-		mlx5e_ipsec_handle_limits(sa_entry);
 unlock:
 	spin_unlock_bh(&sa_entry->x->lock);
+	if (need_modify)
+		mlx5_accel_esp_modify_xfrm(sa_entry, &tmp);
 	kfree(work);
 }
 			/* We are in atomic context */
 			udelay(10);
 	} while (ret && time_is_after_jiffies(expires));
+	if (!ret)
+		memcpy(sa_entry->ctx, aso->ctx, MLX5_ST_SZ_BYTES(ipsec_aso));
 	spin_unlock_bh(&aso->lock);
 	return ret;
 }

drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c+9−14

 	return err;
 }
-static u32 mlx5_esw_qos_lag_link_speed_get_locked(struct mlx5_core_dev *mdev)
+static u32 mlx5_esw_qos_lag_link_speed_get(struct mlx5_core_dev *mdev,
+					   bool take_rtnl)
 {
 	struct ethtool_link_ksettings lksettings;
 	struct net_device *slave, *master;
 	u32 speed = SPEED_UNKNOWN;
-	/* Lock ensures a stable reference to master and slave netdevice
-	 * while port speed of master is queried.
-	 */
-	ASSERT_RTNL();
 	slave = mlx5_uplink_netdev_get(mdev);
 	if (!slave)
 		goto out;
+	if (take_rtnl)
+		rtnl_lock();
 	master = netdev_master_upper_dev_get(slave);
 	if (master && !__ethtool_get_link_ksettings(master, &lksettings))
 		speed = lksettings.base.speed;
+	if (take_rtnl)
+		rtnl_unlock();
 out:
 	mlx5_uplink_netdev_put(mdev, slave);
 }
 static int mlx5_esw_qos_max_link_speed_get(struct mlx5_core_dev *mdev, u32 *link_speed_max,
-					   bool hold_rtnl_lock, struct netlink_ext_ack *extack)
+					   bool take_rtnl,
+					   struct netlink_ext_ack *extack)
 {
 	int err;
 	if (!mlx5_lag_is_active(mdev))
 		goto skip_lag;
-	if (hold_rtnl_lock)
+	*link_speed_max = mlx5_esw_qos_lag_link_speed_get(mdev, take_rtnl);
-		rtnl_lock();
-	*link_speed_max = mlx5_esw_qos_lag_link_speed_get_locked(mdev);
-	if (hold_rtnl_lock)
-		rtnl_unlock();
 	if (*link_speed_max != (u32)SPEED_UNKNOWN)
 		return 0;

drivers/net/ethernet/microsoft/mana/hw_channel.c+3−3

 		gc->max_num_cqs = 0;
 	}
-	kfree(hwc->caller_ctx);
-	hwc->caller_ctx = NULL;
 	if (hwc->txq)
 		mana_hwc_destroy_wq(hwc, hwc->txq);
 	if (hwc->cq)
 		mana_hwc_destroy_cq(hwc->gdma_dev->gdma_context, hwc->cq);
+	kfree(hwc->caller_ctx);
+	hwc->caller_ctx = NULL;
 	mana_gd_free_res_map(&hwc->inflight_msg_res);
 	hwc->num_inflight_msg = 0;

drivers/net/ethernet/ti/icssg/icssg_common.c+5−0

 		xdp_prepare_buff(&xdp, pa, PRUETH_HEADROOM, pkt_len, false);
 		*xdp_state = emac_run_xdp(emac, &xdp, &pkt_len);
+		if (*xdp_state == ICSSG_XDP_CONSUMED) {
+			page_pool_recycle_direct(pool, page);
+			goto requeue;
+		}
 		if (*xdp_state != ICSSG_XDP_PASS)
 			goto requeue;
 		headroom = xdp.data - xdp.data_hard_start;

drivers/net/netdevsim/netdev.c+4−1

 	int ret;
 	ret = __dev_forward_skb(rx_dev, skb);
-	if (ret)
+	if (ret) {
+		if (psp_ext)
+			__skb_ext_put(psp_ext);
 		return ret;
+	}
 	nsim_psp_handle_ext(skb, psp_ext);

drivers/net/usb/aqc111.c+6−6

@@ -1395,14 +1395,14 @@ static int aqc111_suspend(struct usb_interface *intf, pm_message_t message) · 1394 unmodified lines
1395	aqc111_write16_cmd_nopm(dev, AQ_ACCESS_MAC,	1395	aqc111_write16_cmd_nopm(dev, AQ_ACCESS_MAC,
1396	SFR_MEDIUM_STATUS_MODE, 2, &reg16);	1396	SFR_MEDIUM_STATUS_MODE, 2, &reg16);
1397		1397
1398	aqc111_write_cmd(dev, AQ_WOL_CFG, 0, 0,	1398	aqc111_write_cmd_nopm(dev, AQ_WOL_CFG, 0, 0,
1399	WOL_CFG_SIZE, &wol_cfg);	1399	WOL_CFG_SIZE, &wol_cfg);
1400	aqc111_write32_cmd(dev, AQ_PHY_OPS, 0, 0,	1400	aqc111_write32_cmd_nopm(dev, AQ_PHY_OPS, 0, 0,
1401	&aqc111_data->phy_cfg);	1401	&aqc111_data->phy_cfg);
1402	} else {	1402	} else {
1403	aqc111_data->phy_cfg \|= AQ_LOW_POWER;	1403	aqc111_data->phy_cfg \|= AQ_LOW_POWER;
1404	aqc111_write32_cmd(dev, AQ_PHY_OPS, 0, 0,	1404	aqc111_write32_cmd_nopm(dev, AQ_PHY_OPS, 0, 0,
1405	&aqc111_data->phy_cfg);	1405	&aqc111_data->phy_cfg);
1406		1406
1407	/* Disable RX path */	1407	/* Disable RX path */
1408	aqc111_read16_cmd_nopm(dev, AQ_ACCESS_MAC,	1408	aqc111_read16_cmd_nopm(dev, AQ_ACCESS_MAC,

drivers/net/usb/cdc_ncm.c+6−4

 	struct usbnet *dev = netdev_priv(skb_in->dev);
 	struct usb_cdc_ncm_ndp16 *ndp16;
 	int ret = -EINVAL;
+	size_t ndp_len;
 	if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) > skb_in->len) {
 		netif_dbg(dev, rx_err, dev->net, "invalid NDP offset  <%u>\n",
 					sizeof(struct usb_cdc_ncm_dpe16));
 	ret--; /* we process NDP entries except for the last one */
-	if ((sizeof(struct usb_cdc_ncm_ndp16) +
+	ndp_len = struct_size_t(struct usb_cdc_ncm_ndp16, dpe16, ret);
-	     ret * (sizeof(struct usb_cdc_ncm_dpe16))) > skb_in->len) {
+	if (ndpoffset + ndp_len > skb_in->len) {
 		netif_dbg(dev, rx_err, dev->net, "Invalid nframes = %d\n", ret);
 		ret = -EINVAL;
 	}
 	struct usbnet *dev = netdev_priv(skb_in->dev);
 	struct usb_cdc_ncm_ndp32 *ndp32;
 	int ret = -EINVAL;
+	size_t ndp_len;
 	if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp32)) > skb_in->len) {
 		netif_dbg(dev, rx_err, dev->net, "invalid NDP offset  <%u>\n",
 					sizeof(struct usb_cdc_ncm_dpe32));
 	ret--; /* we process NDP entries except for the last one */
-	if ((sizeof(struct usb_cdc_ncm_ndp32) +
+	ndp_len = struct_size_t(struct usb_cdc_ncm_ndp32, dpe32, ret);
-	     ret * (sizeof(struct usb_cdc_ncm_dpe32))) > skb_in->len) {
+	if (ndpoffset + ndp_len > skb_in->len) {
 		netif_dbg(dev, rx_err, dev->net, "Invalid nframes = %d\n", ret);
 		ret = -EINVAL;
 	}

drivers/net/wireless/ath/ath9k/channel.c+2−4

 	skb_set_queue_mapping(skb, IEEE80211_AC_VO);
 	if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, NULL))
-		goto error;
+		return;
 	txctl.txq = sc->tx.txq_map[IEEE80211_AC_VO];
 	if (ath_tx_start(sc->hw, skb, &txctl))
 		skb->priority = 7;
 		skb_set_queue_mapping(skb, IEEE80211_AC_VO);
-		if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, &sta)) {
+		if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, &sta))
-			dev_kfree_skb_any(skb);
 			return false;
-		}
 		break;
 	default:
 		return false;

drivers/net/wireless/mediatek/mt76/scan.c+1−3

@@ -63,10 +63,8 @@ mt76_scan_send_probe(struct mt76_dev dev, struct cfg80211_ssid ssid) · 62 unmodified lines
63		63
64	rcu_read_lock();	64	rcu_read_lock();
65		65
66	if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL)) {	66	if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL))
67	ieee80211_free_txskb(phy->hw, skb);
68	goto out;	67	goto out;
69	}
70		68
71	info = IEEE80211_SKB_CB(skb);	69	info = IEEE80211_SKB_CB(skb);
72	if (req->no_cck)	70	if (req->no_cck)

drivers/net/wireless/ti/wlcore/tx.c+1−1

@@ -210,7 +210,7 @@ static int wl1271_tx_allocate(struct wl1271 wl, struct wl12xx_vif wlvif, · 209 unmodified lines
210	if (skb_headroom(skb) < (total_len - skb->len) &&	210	if (skb_headroom(skb) < (total_len - skb->len) &&
211	pskb_expand_head(skb, (total_len - skb->len), 0, GFP_ATOMIC)) {	211	pskb_expand_head(skb, (total_len - skb->len), 0, GFP_ATOMIC)) {
212	wl1271_free_tx_id(wl, id);	212	wl1271_free_tx_id(wl, id);
213	return -EAGAIN;	213	return -ENOMEM;
214	}	214	}
215	desc = skb_push(skb, total_len - skb->len);	215	desc = skb_push(skb, total_len - skb->len);
216		216

drivers/net/wireless/virtual/mac80211_hwsim.c+1−2

 						      hwsim->tmp_chan->band,
 						      NULL)) {
 				rcu_read_unlock();
-				kfree_skb(probe);
 				continue;
 			}
 	if (info->attrs[HWSIM_ATTR_PMSR_SUPPORT]) {
 		struct cfg80211_pmsr_capabilities *pmsr_capa;
-		pmsr_capa = kmalloc_obj(*pmsr_capa);
+		pmsr_capa = kzalloc_obj(*pmsr_capa);
 		if (!pmsr_capa) {
 			ret = -ENOMEM;
 			goto out_free;

drivers/nfc/nxp-nci/i2c.c+2−2

@@ -47,8 +47,8 @@ static int nxp_nci_i2c_set_mode(void *phy_id, · 46 unmodified lines
47	{	47	{
48	struct nxp_nci_i2c_phy phy = (struct nxp_nci_i2c_phy ) phy_id;	48	struct nxp_nci_i2c_phy phy = (struct nxp_nci_i2c_phy ) phy_id;
49		49
50	gpiod_set_value(phy->gpiod_fw, (mode == NXP_NCI_MODE_FW) ? 1 : 0);	50	gpiod_set_value_cansleep(phy->gpiod_fw, (mode == NXP_NCI_MODE_FW) ? 1 : 0);
51	gpiod_set_value(phy->gpiod_en, (mode != NXP_NCI_MODE_COLD) ? 1 : 0);	51	gpiod_set_value_cansleep(phy->gpiod_en, (mode != NXP_NCI_MODE_COLD) ? 1 : 0);
52	usleep_range(10000, 15000);	52	usleep_range(10000, 15000);
53		53
54	if (mode == NXP_NCI_MODE_COLD)	54	if (mode == NXP_NCI_MODE_COLD)

drivers/nvdimm/bus.c+3−2

 static void nd_async_device_register(void *d, async_cookie_t cookie)
 {
 	struct device *dev = d;
+	struct device *parent = dev->parent;
 	if (device_add(dev) != 0) {
 		dev_err(dev, "%s: failed\n", __func__);
 		put_device(dev);
 	}
 	put_device(dev);
-	if (dev->parent)
+	if (parent)
-		put_device(dev->parent);
+		put_device(parent);
 }
 static void nd_async_device_unregister(void *d, async_cookie_t cookie)

drivers/pci/endpoint/functions/pci-epf-test.c+5−0

 		dev_err(&epf->dev, "pci_epc_set_bar() failed: %d\n", ret);
 		bar->submap = old_submap;
 		bar->num_submap = old_nsub;
+		ret = pci_epc_set_bar(epc, epf->func_no, epf->vfunc_no, bar);
+		if (ret)
+			dev_warn(&epf->dev, "Failed to restore the original BAR mapping: %d\n",
+				 ret);
 		kfree(submap);
 		goto err;
 	}

drivers/pci/pwrctrl/core.c+41−13

@@ -268,6 +268,46 @@ err_power_off: · 267 unmodified lines
268	}	268	}
269	EXPORT_SYMBOL_GPL(pci_pwrctrl_power_on_devices);	269	EXPORT_SYMBOL_GPL(pci_pwrctrl_power_on_devices);
270		270
		271	/*
		272	* Check whether the pwrctrl device really needs to be created or not. The
		273	* pwrctrl device will only be created if the node satisfies below requirements:
		274	*
		275	* 1. Presence of compatible property with "pci" prefix to match against the
		276	* pwrctrl driver (AND)
		277	* 2. At least one of the power supplies defined in the devicetree node of the
		278	* device (OR) in the remote endpoint parent node to indicate pwrctrl
		279	* requirement.
		280	*/
		281	static bool pci_pwrctrl_is_required(struct device_node *np)
		282	{
		283	struct device_node *endpoint;
		284	const char *compat;
		285	int ret;
		286
		287	ret = of_property_read_string(np, "compatible", &compat);
		288	if (ret < 0)
		289	return false;
		290
		291	if (!strstarts(compat, "pci"))
		292	return false;
		293
		294	if (of_pci_supply_present(np))
		295	return true;
		296
		297	if (of_graph_is_present(np)) {
		298	for_each_endpoint_of_node(np, endpoint) {
		299	struct device_node *remote __free(device_node) =
		300	of_graph_get_remote_port_parent(endpoint);
		301	if (remote) {
		302	if (of_pci_supply_present(remote))
		303	return true;
		304	}
		305	}
		306	}
		307
		308	return false;
		309	}
		310
271	static int pci_pwrctrl_create_device(struct device_node *np,	311	static int pci_pwrctrl_create_device(struct device_node *np,
272	struct device *parent)	312	struct device *parent)
273	{	313	{
@@ -287,19 +327,7 @@ static int pci_pwrctrl_create_device(struct device_node *np, · 13 unmodified lines
287	return 0;	327	return 0;
288	}	328	}
289		329
290	/*	330	if (!pci_pwrctrl_is_required(np)) {
291	* Sanity check to make sure that the node has the compatible property
292	* to allow driver binding.
293	*/
294	if (!of_property_present(np, "compatible"))
295	return 0;
296
297	/*
298	* Check whether the pwrctrl device really needs to be created or not.
299	* This is decided based on at least one of the power supplies defined
300	* in the devicetree node of the device or the graph property.
301	*/
302	if (!of_pci_supply_present(np) && !of_graph_is_present(np)) {
303	dev_dbg(parent, "Skipping OF node: %s\n", np->name);	331	dev_dbg(parent, "Skipping OF node: %s\n", np->name);
304	return 0;	332	return 0;
305	}	333	}

drivers/pmdomain/bcm/bcm2835-power.c+4−8

 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/io.h>
+#include <linux/iopoll.h>
 #include <linux/mfd/bcm2835-pm.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 static int bcm2835_asb_control(struct bcm2835_power *power, u32 reg, bool enable)
 {
 	void __iomem *base = power->asb;
-	u64 start;
 	u32 val;
 	switch (reg) {
 		break;
 	}
-	start = ktime_get_ns();
 	/* Enable the module's async AXI bridges. */
 	if (enable) {
 		val = readl(base + reg) & ~ASB_REQ_STOP;
 	}
 	writel(PM_PASSWORD | val, base + reg);
-	while (!!(readl(base + reg) & ASB_ACK) == enable) {
+	if (readl_poll_timeout_atomic(base + reg, val,
-		cpu_relax();
+				      !!(val & ASB_ACK) != enable, 0, 5))
-		if (ktime_get_ns() - start >= 1000)
+		return -ETIMEDOUT;
-			return -ETIMEDOUT;
-	}
 	return 0;
 }

drivers/pmdomain/mediatek/mtk-pm-domains.c+1−1

@@ -1203,7 +1203,7 @@ static int scpsys_probe(struct platform_device *pdev) · 1202 unmodified lines
1203	scpsys->soc_data = soc;	1203	scpsys->soc_data = soc;
1204		1204
1205	scpsys->pd_data.domains = scpsys->domains;	1205	scpsys->pd_data.domains = scpsys->domains;
1206	scpsys->pd_data.num_domains = soc->num_domains;	1206	scpsys->pd_data.num_domains = num_domains;
1207		1207
1208	parent = dev->parent;	1208	parent = dev->parent;
1209	if (!parent) {	1209	if (!parent) {

drivers/resctrl/mpam_devices.c+2−0

 static int mpam_restore_mbwu_state(void *_ris)
 {
 	int i;
+	u64 val;
 	struct mon_read mwbu_arg;
 	struct mpam_msc_ris *ris = _ris;
 	struct mpam_class *class = ris->vmsc->comp->class;
 			mwbu_arg.ris = ris;
 			mwbu_arg.ctx = &ris->mbwu_state[i].cfg;
 			mwbu_arg.type = mpam_msmon_choose_counter(class);
+			mwbu_arg.val = &val;
 			__ris_msmon_read(&mwbu_arg);
 		}

drivers/resctrl/test_mpam_devices.c+15−7

 	mutex_unlock(&mpam_list_lock);
 }
+static void __test_mpam_reset_msc_bitmap(struct mpam_msc *msc, u16 reg, u16 wd)
+{
+	/* Avoid warnings when running with CONFIG_DEBUG_PREEMPT */
+	guard(preempt)();
+	mpam_reset_msc_bitmap(msc, reg, wd);
+}
 static void test_mpam_reset_msc_bitmap(struct kunit *test)
 {
-	char __iomem *buf = kunit_kzalloc(test, SZ_16K, GFP_KERNEL);
+	char __iomem *buf = (__force char __iomem *)kunit_kzalloc(test, SZ_16K, GFP_KERNEL);
 	struct mpam_msc fake_msc = {};
 	u32 *test_result;
 	mutex_init(&fake_msc.part_sel_lock);
 	mutex_lock(&fake_msc.part_sel_lock);
-	test_result = (u32 *)(buf + MPAMCFG_CPBM);
+	test_result = (__force u32 *)(buf + MPAMCFG_CPBM);
-	mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 0);
+	__test_mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 0);
 	KUNIT_EXPECT_EQ(test, test_result[0], 0);
 	KUNIT_EXPECT_EQ(test, test_result[1], 0);
 	test_result[0] = 0;
 	test_result[1] = 0;
-	mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 1);
+	__test_mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 1);
 	KUNIT_EXPECT_EQ(test, test_result[0], 1);
 	KUNIT_EXPECT_EQ(test, test_result[1], 0);
 	test_result[0] = 0;
 	test_result[1] = 0;
-	mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 16);
+	__test_mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 16);
 	KUNIT_EXPECT_EQ(test, test_result[0], 0xffff);
 	KUNIT_EXPECT_EQ(test, test_result[1], 0);
 	test_result[0] = 0;
 	test_result[1] = 0;
-	mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 32);
+	__test_mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 32);
 	KUNIT_EXPECT_EQ(test, test_result[0], 0xffffffff);
 	KUNIT_EXPECT_EQ(test, test_result[1], 0);
 	test_result[0] = 0;
 	test_result[1] = 0;
-	mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 33);
+	__test_mpam_reset_msc_bitmap(&fake_msc, MPAMCFG_CPBM, 33);
 	KUNIT_EXPECT_EQ(test, test_result[0], 0xffffffff);
 	KUNIT_EXPECT_EQ(test, test_result[1], 1);
 	test_result[0] = 0;

drivers/reset/reset-rzg2l-usbphy-ctrl.c+3−0

@@ -136,6 +136,9 @@ static int rzg2l_usbphy_ctrl_set_pwrrdy(struct regmap_field *pwrrdy, · 135 unmodified lines
136	{	136	{
137	u32 val = power_on ? 0 : 1;	137	u32 val = power_on ? 0 : 1;
138		138
		139	if (!pwrrdy)
		140	return 0;
		141
139	/* The initialization path guarantees that the mask is 1 bit long. */	142	/* The initialization path guarantees that the mask is 1 bit long. */
140	return regmap_field_update_bits(pwrrdy, 1, val);	143	return regmap_field_update_bits(pwrrdy, 1, val);
141	}	144	}

drivers/slimbus/qcom-ngd-ctrl.c+2−4

 		ngd->id = id;
 		ngd->pdev->dev.parent = parent;
-		ret = driver_set_override(&ngd->pdev->dev,
+		ret = device_set_driver_override(&ngd->pdev->dev,
-					  &ngd->pdev->driver_override,
+						 QCOM_SLIM_NGD_DRV_NAME);
-					  QCOM_SLIM_NGD_DRV_NAME,
-					  strlen(QCOM_SLIM_NGD_DRV_NAME));
 		if (ret) {
 			platform_device_put(ngd->pdev);
 			kfree(ngd);

drivers/soc/fsl/qbman/qman.c+22−2

@@ -1827,6 +1827,8 @@ EXPORT_SYMBOL(qman_create_fq); · 1826 unmodified lines
1827		1827
1828	void qman_destroy_fq(struct qman_fq *fq)	1828	void qman_destroy_fq(struct qman_fq *fq)
1829	{	1829	{
		1830	int leaked;
		1831
1830	/*	1832	/*
1831	* We don't need to lock the FQ as it is a pre-condition that the FQ be	1833	* We don't need to lock the FQ as it is a pre-condition that the FQ be
1832	* quiesced. Instead, run some checks.	1834	* quiesced. Instead, run some checks.
@@ -1834,11 +1836,29 @@ void qman_destroy_fq(struct qman_fq *fq) · 1 unmodified line
1834	switch (fq->state) {	1836	switch (fq->state) {
1835	case qman_fq_state_parked:	1837	case qman_fq_state_parked:
1836	case qman_fq_state_oos:	1838	case qman_fq_state_oos:
1837	if (fq_isset(fq, QMAN_FQ_FLAG_DYNAMIC_FQID))	1839	/*
1838	qman_release_fqid(fq->fqid);	1840	* There's a race condition here on releasing the fqid,
		1841	* setting the fq_table to NULL, and freeing the fqid.
		1842	* To prevent it, this order should be respected:
		1843	*/
		1844	if (fq_isset(fq, QMAN_FQ_FLAG_DYNAMIC_FQID)) {
		1845	leaked = qman_shutdown_fq(fq->fqid);
		1846	if (leaked)
		1847	pr_debug("FQID %d leaked\n", fq->fqid);
		1848	}
1839		1849
1840	DPAA_ASSERT(fq_table[fq->idx]);	1850	DPAA_ASSERT(fq_table[fq->idx]);
1841	fq_table[fq->idx] = NULL;	1851	fq_table[fq->idx] = NULL;
		1852
		1853	if (fq_isset(fq, QMAN_FQ_FLAG_DYNAMIC_FQID) && !leaked) {
		1854	/*
		1855	* fq_table[fq->idx] should be set to null before
		1856	* freeing fq->fqid otherwise it could by allocated by
		1857	* qman_alloc_fqid() while still being !NULL
		1858	*/
		1859	smp_wmb();
		1860	gen_pool_free(qm_fqalloc, fq->fqid \| DPAA_GENALLOC_OFF, 1);
		1861	}
1842	return;	1862	return;
1843	default:	1863	default:
1844	break;	1864	break;

drivers/soc/fsl/qe/qmc.c+2−2

@@ -1790,8 +1790,8 @@ static int qmc_qe_init_resources(struct qmc qmc, struct platform_device pdev) · 1789 unmodified lines
1790	return -EINVAL;	1790	return -EINVAL;
1791	qmc->dpram_offset = res->start - qe_muram_dma(qe_muram_addr(0));	1791	qmc->dpram_offset = res->start - qe_muram_dma(qe_muram_addr(0));
1792	qmc->dpram = devm_ioremap_resource(qmc->dev, res);	1792	qmc->dpram = devm_ioremap_resource(qmc->dev, res);
1793	if (IS_ERR(qmc->scc_pram))	1793	if (IS_ERR(qmc->dpram))
1794	return PTR_ERR(qmc->scc_pram);	1794	return PTR_ERR(qmc->dpram);
1795		1795
1796	return 0;	1796	return 0;
1797	}	1797	}

drivers/soc/microchip/mpfs-sys-controller.c+9−4

 	sys_controller->flash = of_get_mtd_device_by_node(np);
 	of_node_put(np);
-	if (IS_ERR(sys_controller->flash))
+	if (IS_ERR(sys_controller->flash)) {
-		return dev_err_probe(dev, PTR_ERR(sys_controller->flash), "Failed to get flash\n");
+		ret = dev_err_probe(dev, PTR_ERR(sys_controller->flash), "Failed to get flash\n");
+		goto out_free;
+	}
 no_flash:
 	sys_controller->client.dev = dev;
 	if (IS_ERR(sys_controller->chan)) {
 		ret = dev_err_probe(dev, PTR_ERR(sys_controller->chan),
 				    "Failed to get mbox channel\n");
-		kfree(sys_controller);
+		goto out_free;
-		return ret;
 	}
 	init_completion(&sys_controller->c);
 	dev_info(&pdev->dev, "Registered MPFS system controller\n");
 	return 0;
+out_free:
+	kfree(sys_controller);
+	return ret;
 }
 static void mpfs_sys_controller_remove(struct platform_device *pdev)

drivers/soc/rockchip/grf.c+1−0

@@ -231,6 +231,7 @@ static int __init rockchip_grf_init(void) · 230 unmodified lines
231	grf = syscon_node_to_regmap(np);	231	grf = syscon_node_to_regmap(np);
232	if (IS_ERR(grf)) {	232	if (IS_ERR(grf)) {
233	pr_err("%s: could not get grf syscon\n", __func__);	233	pr_err("%s: could not get grf syscon\n", __func__);
		234	of_node_put(np);
234	return PTR_ERR(grf);	235	return PTR_ERR(grf);
235	}	236	}
236		237

drivers/spi/spi-amlogic-spifc-a4.c+7−39

 	return clk_set_rate(sfc->core_clk, SFC_BUS_DEFAULT_CLK);
 }
-static int aml_sfc_disable_clk(struct aml_sfc *sfc)
-{
-	clk_disable_unprepare(sfc->core_clk);
-	clk_disable_unprepare(sfc->gate_clk);
-	return 0;
-}
 static int aml_sfc_probe(struct platform_device *pdev)
 {
 	struct device_node *np = pdev->dev.of_node;
 	/* Enable Amlogic flash controller spi mode */
 	ret = regmap_write(sfc->regmap_base, SFC_SPI_CFG, SPI_MODE_EN);
-	if (ret) {
+	if (ret)
-		dev_err(dev, "failed to enable SPI mode\n");
+		return dev_err_probe(dev, ret, "failed to enable SPI mode\n");
-		goto err_out;
-	}
 	ret = dma_set_mask(sfc->dev, DMA_BIT_MASK(32));
-	if (ret) {
+	if (ret)
-		dev_err(sfc->dev, "failed to set dma mask\n");
+		return dev_err_probe(sfc->dev, ret, "failed to set dma mask\n");
-		goto err_out;
-	}
 	sfc->ecc_eng.dev = &pdev->dev;
 	sfc->ecc_eng.integration = NAND_ECC_ENGINE_INTEGRATION_PIPELINED;
 	sfc->ecc_eng.priv = sfc;
 	ret = nand_ecc_register_on_host_hw_engine(&sfc->ecc_eng);
-	if (ret) {
+	if (ret)
-		dev_err(&pdev->dev, "failed to register Aml host ecc engine.\n");
+		return dev_err_probe(&pdev->dev, ret, "failed to register Aml host ecc engine.\n");
-		goto err_out;
-	}
 	ret = of_property_read_u32(np, "amlogic,rx-adj", &val);
 	if (!ret)
 	ctrl->min_speed_hz = SFC_MIN_FREQUENCY;
 	ctrl->num_chipselect = SFC_MAX_CS_NUM;
-	ret = devm_spi_register_controller(dev, ctrl);
+	return devm_spi_register_controller(dev, ctrl);
-	if (ret)
-		goto err_out;
-	return 0;
-err_out:
-	aml_sfc_disable_clk(sfc);
-	return ret;
-}
-static void aml_sfc_remove(struct platform_device *pdev)
-{
-	struct spi_controller *ctlr = platform_get_drvdata(pdev);
-	struct aml_sfc *sfc = spi_controller_get_devdata(ctlr);
-	aml_sfc_disable_clk(sfc);
 }
 static const struct of_device_id aml_sfc_of_match[] = {
 		.of_match_table = aml_sfc_of_match,
 	},
 	.probe = aml_sfc_probe,
-	.remove = aml_sfc_remove,
 };
 module_platform_driver(aml_sfc_driver);

drivers/spi/spi-amlogic-spisg.c+4−8

 	};
 	if (of_property_read_bool(dev->of_node, "spi-slave"))
-		ctlr = spi_alloc_target(dev, sizeof(*spisg));
+		ctlr = devm_spi_alloc_target(dev, sizeof(*spisg));
 	else
-		ctlr = spi_alloc_host(dev, sizeof(*spisg));
+		ctlr = devm_spi_alloc_host(dev, sizeof(*spisg));
 	if (!ctlr)
 		return -ENOMEM;
 		return dev_err_probe(dev, PTR_ERR(spisg->map), "regmap init failed\n");
 	irq = platform_get_irq(pdev, 0);
-	if (irq < 0) {
+	if (irq < 0)
-		ret = irq;
+		return irq;
-		goto out_controller;
-	}
 	ret = device_reset_optional(dev);
 	if (ret)
 	if (spisg->core)
 		clk_disable_unprepare(spisg->core);
 	clk_disable_unprepare(spisg->pclk);
-out_controller:
-	spi_controller_put(ctlr);
 	return ret;
 }

drivers/spi/spi-axiado.c+11−20

@@ -765,30 +765,22 @@ static int ax_spi_probe(struct platform_device *pdev) · 764 unmodified lines
765	platform_set_drvdata(pdev, ctlr);	765	platform_set_drvdata(pdev, ctlr);
766		766
767	xspi->regs = devm_platform_ioremap_resource(pdev, 0);	767	xspi->regs = devm_platform_ioremap_resource(pdev, 0);
768	if (IS_ERR(xspi->regs)) {	768	if (IS_ERR(xspi->regs))
769	ret = PTR_ERR(xspi->regs);	769	return PTR_ERR(xspi->regs);
770	goto remove_ctlr;
771	}
772		770
773	xspi->pclk = devm_clk_get(&pdev->dev, "pclk");	771	xspi->pclk = devm_clk_get(&pdev->dev, "pclk");
774	if (IS_ERR(xspi->pclk)) {	772	if (IS_ERR(xspi->pclk))
775	dev_err(&pdev->dev, "pclk clock not found.\n");	773	return dev_err_probe(&pdev->dev, PTR_ERR(xspi->pclk),
776	ret = PTR_ERR(xspi->pclk);	774	"pclk clock not found.\n");
777	goto remove_ctlr;
778	}
779		775
780	xspi->ref_clk = devm_clk_get(&pdev->dev, "ref");	776	xspi->ref_clk = devm_clk_get(&pdev->dev, "ref");
781	if (IS_ERR(xspi->ref_clk)) {	777	if (IS_ERR(xspi->ref_clk))
782	dev_err(&pdev->dev, "ref clock not found.\n");	778	return dev_err_probe(&pdev->dev, PTR_ERR(xspi->ref_clk),
783	ret = PTR_ERR(xspi->ref_clk);	779	"ref clock not found.\n");
784	goto remove_ctlr;
785	}
786		780
787	ret = clk_prepare_enable(xspi->pclk);	781	ret = clk_prepare_enable(xspi->pclk);
788	if (ret) {	782	if (ret)
789	dev_err(&pdev->dev, "Unable to enable APB clock.\n");	783	return dev_err_probe(&pdev->dev, ret, "Unable to enable APB clock.\n");
790	goto remove_ctlr;
791	}
792		784
793	ret = clk_prepare_enable(xspi->ref_clk);	785	ret = clk_prepare_enable(xspi->ref_clk);
794	if (ret) {	786	if (ret) {
@@ -869,8 +861,7 @@ clk_dis_all: · 74 unmodified lines
869	clk_disable_unprepare(xspi->ref_clk);	861	clk_disable_unprepare(xspi->ref_clk);
870	clk_dis_apb:	862	clk_dis_apb:
871	clk_disable_unprepare(xspi->pclk);	863	clk_disable_unprepare(xspi->pclk);
872	remove_ctlr:	864
873	spi_controller_put(ctlr);
874	return ret;	865	return ret;
875	}	866	}
876		867

drivers/spi/spi-geni-qcom.c+7−6

 		writel((spi_slv->mode & SPI_LOOP) ? LOOPBACK_ENABLE : 0, se->base + SE_SPI_LOOPBACK);
 	if (cs_changed)
 		writel(chipselect, se->base + SE_SPI_DEMUX_SEL);
-	if (mode_changed & SE_SPI_CPHA)
+	if (mode_changed & SPI_CPHA)
 		writel((spi_slv->mode & SPI_CPHA) ? CPHA : 0, se->base + SE_SPI_CPHA);
-	if (mode_changed & SE_SPI_CPOL)
+	if (mode_changed & SPI_CPOL)
 		writel((spi_slv->mode & SPI_CPOL) ? CPOL : 0, se->base + SE_SPI_CPOL);
 	if ((mode_changed & SPI_CS_HIGH) || (cs_changed && (spi_slv->mode & SPI_CS_HIGH)))
 		writel((spi_slv->mode & SPI_CS_HIGH) ? BIT(chipselect) : 0, se->base + SE_SPI_DEMUX_OUTPUT_INV);
 	struct spi_controller *spi = data;
 	struct spi_geni_master *mas = spi_controller_get_devdata(spi);
 	struct geni_se *se = &mas->se;
-	u32 m_irq;
+	u32 m_irq, dma_tx_status, dma_rx_status;
 	m_irq = readl(se->base + SE_GENI_M_IRQ_STATUS);
-	if (!m_irq)
+	dma_tx_status = readl_relaxed(se->base + SE_DMA_TX_IRQ_STAT);
+	dma_rx_status = readl_relaxed(se->base + SE_DMA_RX_IRQ_STAT);
+	if (!m_irq && !dma_tx_status && !dma_rx_status)
 		return IRQ_NONE;
 	if (m_irq & (M_CMD_OVERRUN_EN | M_ILLEGAL_CMD_EN | M_CMD_FAILURE_EN |
 		}
 	} else if (mas->cur_xfer_mode == GENI_SE_DMA) {
 		const struct spi_transfer *xfer = mas->cur_xfer;
-		u32 dma_tx_status = readl_relaxed(se->base + SE_DMA_TX_IRQ_STAT);
-		u32 dma_rx_status = readl_relaxed(se->base + SE_DMA_RX_IRQ_STAT);
 		if (dma_tx_status)
 			writel(dma_tx_status, se->base + SE_DMA_TX_IRQ_CLR);

drivers/spi/spi.c+12−13

 	struct spi_controller *ctlr;
 	ctlr = container_of(dev, struct spi_controller, dev);
+	free_percpu(ctlr->pcpu_statistics);
 	kfree(ctlr);
 }
 	if (!ctlr)
 		return NULL;
+	ctlr->pcpu_statistics = spi_alloc_pcpu_stats(NULL);
+	if (!ctlr->pcpu_statistics) {
+		kfree(ctlr);
+		return NULL;
+	}
 	device_initialize(&ctlr->dev);
 	INIT_LIST_HEAD(&ctlr->queue);
 	spin_lock_init(&ctlr->queue_lock);
 		dev_info(dev, "controller is unqueued, this is deprecated\n");
 	} else if (ctlr->transfer_one || ctlr->transfer_one_message) {
 		status = spi_controller_initialize_queue(ctlr);
-		if (status) {
+		if (status)
-			device_del(&ctlr->dev);
+			goto del_ctrl;
-			goto free_bus_id;
-		}
-	}
-	/* Add statistics */
-	ctlr->pcpu_statistics = spi_alloc_pcpu_stats(dev);
-	if (!ctlr->pcpu_statistics) {
-		dev_err(dev, "Error allocating per-cpu statistics\n");
-		status = -ENOMEM;
-		goto destroy_queue;
 	}
 	mutex_lock(&board_lock);
 	acpi_register_spi_devices(ctlr);
 	return status;
-destroy_queue:
+del_ctrl:
-	spi_destroy_queue(ctlr);
+	device_del(&ctlr->dev);
 free_bus_id:
 	mutex_lock(&board_lock);
 	idr_remove(&spi_controller_idr, ctlr->bus_num);

drivers/tee/tee_shm.c+0−27

@@ -23,29 +23,11 @@ struct tee_shm_dma_mem { · 22 unmodified lines
23	struct page *page;	23	struct page *page;
24	};	24	};
25		25
26	static void shm_put_kernel_pages(struct page **pages, size_t page_count)
27	{
28	size_t n;
29
30	for (n = 0; n < page_count; n++)
31	put_page(pages[n]);
32	}
33
34	static void shm_get_kernel_pages(struct page **pages, size_t page_count)
35	{
36	size_t n;
37
38	for (n = 0; n < page_count; n++)
39	get_page(pages[n]);
40	}
41
42	static void release_registered_pages(struct tee_shm *shm)	26	static void release_registered_pages(struct tee_shm *shm)
43	{	27	{
44	if (shm->pages) {	28	if (shm->pages) {
45	if (shm->flags & TEE_SHM_USER_MAPPED)	29	if (shm->flags & TEE_SHM_USER_MAPPED)
46	unpin_user_pages(shm->pages, shm->num_pages);	30	unpin_user_pages(shm->pages, shm->num_pages);
47	else
48	shm_put_kernel_pages(shm->pages, shm->num_pages);
49		31
50	kfree(shm->pages);	32	kfree(shm->pages);
51	}	33	}
@@ -477,13 +459,6 @@ register_shm_helper(struct tee_context ctx, struct iov_iter iter, u32 flags, · 425 unmodified lines
477	goto err_put_shm_pages;	459	goto err_put_shm_pages;
478	}	460	}
479		461
480	/*
481	* iov_iter_extract_kvec_pages does not get reference on the pages,
482	* get a reference on them.
483	*/
484	if (iov_iter_is_kvec(iter))
485	shm_get_kernel_pages(shm->pages, num_pages);
486
487	shm->offset = off;	462	shm->offset = off;
488	shm->size = len;	463	shm->size = len;
489	shm->num_pages = num_pages;	464	shm->num_pages = num_pages;
@@ -499,8 +474,6 @@ register_shm_helper(struct tee_context ctx, struct iov_iter iter, u32 flags, · 9 unmodified lines
499	err_put_shm_pages:	474	err_put_shm_pages:
500	if (!iov_iter_is_kvec(iter))	475	if (!iov_iter_is_kvec(iter))
501	unpin_user_pages(shm->pages, shm->num_pages);	476	unpin_user_pages(shm->pages, shm->num_pages);
502	else
503	shm_put_kernel_pages(shm->pages, shm->num_pages);
504	err_free_shm_pages:	477	err_free_shm_pages:
505	kfree(shm->pages);	478	kfree(shm->pages);
506	err_free_shm:	479	err_free_shm:

drivers/tty/serial/8250/8250.h+25−0

@@ -175,7 +175,9 @@ static unsigned int __maybe_unused serial_icr_read(struct uart_8250_port *up, · 174 unmodified lines
175	return value;	175	return value;
176	}	176	}
177		177
		178	void serial8250_clear_fifos(struct uart_8250_port *p);
178	void serial8250_clear_and_reinit_fifos(struct uart_8250_port *p);	179	void serial8250_clear_and_reinit_fifos(struct uart_8250_port *p);
		180	void serial8250_fifo_wait_for_lsr_thre(struct uart_8250_port *up, unsigned int count);
179		181
180	void serial8250_rpm_get(struct uart_8250_port *p);	182	void serial8250_rpm_get(struct uart_8250_port *p);
181	void serial8250_rpm_put(struct uart_8250_port *p);	183	void serial8250_rpm_put(struct uart_8250_port *p);
@@ -400,6 +402,26 @@ static inline bool serial8250_tx_dma_running(struct uart_8250_port *p) · 218 unmodified lines
400		402
401	return dma && dma->tx_running;	403	return dma && dma->tx_running;
402	}	404	}
		405
		406	static inline void serial8250_tx_dma_pause(struct uart_8250_port *p)
		407	{
		408	struct uart_8250_dma *dma = p->dma;
		409
		410	if (!dma->tx_running)
		411	return;
		412
		413	dmaengine_pause(dma->txchan);
		414	}
		415
		416	static inline void serial8250_tx_dma_resume(struct uart_8250_port *p)
		417	{
		418	struct uart_8250_dma *dma = p->dma;
		419
		420	if (!dma->tx_running)
		421	return;
		422
		423	dmaengine_resume(dma->txchan);
		424	}
403	#else	425	#else
404	static inline int serial8250_tx_dma(struct uart_8250_port *p)	426	static inline int serial8250_tx_dma(struct uart_8250_port *p)
405	{	427	{
@@ -421,6 +443,9 @@ static inline bool serial8250_tx_dma_running(struct uart_8250_port *p) · 15 unmodified lines
421	{	443	{
422	return false;	444	return false;
423	}	445	}
		446
		447	static inline void serial8250_tx_dma_pause(struct uart_8250_port *p) { }
		448	static inline void serial8250_tx_dma_resume(struct uart_8250_port *p) { }
424	#endif	449	#endif
425		450
426	static inline int ns16550a_goto_highspeed(struct uart_8250_port *up)	451	static inline int ns16550a_goto_highspeed(struct uart_8250_port *up)

drivers/tty/serial/8250/8250_dma.c+15−0

@@ -162,7 +162,22 @@ void serial8250_tx_dma_flush(struct uart_8250_port *p) · 161 unmodified lines
162	*/	162	*/
163	dma->tx_size = 0;	163	dma->tx_size = 0;
164		164
		165	/*
		166	* We can't use `dmaengine_terminate_sync` because `uart_flush_buffer` is
		167	* holding the uart port spinlock.
		168	*/
165	dmaengine_terminate_async(dma->txchan);	169	dmaengine_terminate_async(dma->txchan);
		170
		171	/*
		172	* The callback might or might not run. If it doesn't run, we need to ensure
		173	* that `tx_running` is cleared so that we can schedule new transactions.
		174	* If it does run, then the zombie callback will clear `tx_running` again
		175	* and perform a no-op since `tx_size` was cleared above.
		176	*
		177	* In either case, we ASSUME the DMA transaction will terminate before we
		178	* issue a new `serial8250_tx_dma`.
		179	*/
		180	dma->tx_running = 0;
166	}	181	}
167		182
168	int serial8250_rx_dma(struct uart_8250_port *p)	183	int serial8250_rx_dma(struct uart_8250_port *p)

drivers/tty/serial/8250/8250_dw.c+235−61

@@ -9,10 +9,14 @@ · 8 unmodified lines
9	* LCR is written whilst busy. If it is, then a busy detect interrupt is	9	* LCR is written whilst busy. If it is, then a busy detect interrupt is
10	* raised, the LCR needs to be rewritten and the uart status register read.	10	* raised, the LCR needs to be rewritten and the uart status register read.
11	*/	11	*/
		12	#include <linux/bitfield.h>
		13	#include <linux/bits.h>
		14	#include <linux/cleanup.h>
12	#include <linux/clk.h>	15	#include <linux/clk.h>
13	#include <linux/delay.h>	16	#include <linux/delay.h>
14	#include <linux/device.h>	17	#include <linux/device.h>
15	#include <linux/io.h>	18	#include <linux/io.h>
		19	#include <linux/lockdep.h>
16	#include <linux/mod_devicetable.h>	20	#include <linux/mod_devicetable.h>
17	#include <linux/module.h>	21	#include <linux/module.h>
18	#include <linux/notifier.h>	22	#include <linux/notifier.h>
@@ -40,8 +44,12 @@ · 21 unmodified lines
40	#define RZN1_UART_RDMACR 0x110 /* DMA Control Register Receive Mode */	44	#define RZN1_UART_RDMACR 0x110 /* DMA Control Register Receive Mode */
41		45
42	/* DesignWare specific register fields */	46	/* DesignWare specific register fields */
		47	#define DW_UART_IIR_IID GENMASK(3, 0)
		48
43	#define DW_UART_MCR_SIRE BIT(6)	49	#define DW_UART_MCR_SIRE BIT(6)
44		50
		51	#define DW_UART_USR_BUSY BIT(0)
		52
45	/* Renesas specific register fields */	53	/* Renesas specific register fields */
46	#define RZN1_UART_xDMACR_DMA_EN BIT(0)	54	#define RZN1_UART_xDMACR_DMA_EN BIT(0)
47	#define RZN1_UART_xDMACR_1_WORD_BURST (0 << 1)	55	#define RZN1_UART_xDMACR_1_WORD_BURST (0 << 1)
@@ -56,6 +64,13 @@ · 8 unmodified lines
56	#define DW_UART_QUIRK_IS_DMA_FC BIT(3)	64	#define DW_UART_QUIRK_IS_DMA_FC BIT(3)
57	#define DW_UART_QUIRK_APMC0D08 BIT(4)	65	#define DW_UART_QUIRK_APMC0D08 BIT(4)
58	#define DW_UART_QUIRK_CPR_VALUE BIT(5)	66	#define DW_UART_QUIRK_CPR_VALUE BIT(5)
		67	#define DW_UART_QUIRK_IER_KICK BIT(6)
		68
		69	/*
		70	* Number of consecutive IIR_NO_INT interrupts required to trigger interrupt
		71	* storm prevention code.
		72	*/
		73	#define DW_UART_QUIRK_IER_KICK_THRES 4
59		74
60	struct dw8250_platform_data {	75	struct dw8250_platform_data {
61	u8 usr_reg;	76	u8 usr_reg;
@@ -77,6 +92,9 @@ struct dw8250_data { · 15 unmodified lines
77		92
78	unsigned int skip_autocfg:1;	93	unsigned int skip_autocfg:1;
79	unsigned int uart_16550_compatible:1;	94	unsigned int uart_16550_compatible:1;
		95	unsigned int in_idle:1;
		96
		97	u8 no_int_count;
80	};	98	};
81		99
82	static inline struct dw8250_data to_dw8250_data(struct dw8250_port_data data)	100	static inline struct dw8250_data to_dw8250_data(struct dw8250_port_data data)
@@ -107,78 +125,167 @@ static inline u32 dw8250_modify_msr(struct uart_port *p, unsigned int offset, u3 · 24 unmodified lines
107	return value;	125	return value;
108	}	126	}
109		127
		128	static void dw8250_idle_exit(struct uart_port *p)
		129	{
		130	struct dw8250_data *d = to_dw8250_data(p->private_data);
		131	struct uart_8250_port *up = up_to_u8250p(p);
		132
		133	if (d->uart_16550_compatible)
		134	return;
		135
		136	if (up->capabilities & UART_CAP_FIFO)
		137	serial_port_out(p, UART_FCR, up->fcr);
		138	serial_port_out(p, UART_MCR, up->mcr);
		139	serial_port_out(p, UART_IER, up->ier);
		140
		141	/* DMA Rx is restarted by IRQ handler as needed. */
		142	if (up->dma)
		143	serial8250_tx_dma_resume(up);
		144
		145	d->in_idle = 0;
		146	}
		147
110	/*	148	/*
111	* This function is being called as part of the uart_port::serial_out()	149	* Ensure BUSY is not asserted. If DW UART is configured with
112	* routine. Hence, it must not call serial_port_out() or serial_out()	150	* !uart_16550_compatible, the writes to LCR, DLL, and DLH fail while
113	* against the modified registers here, i.e. LCR.	151	* BUSY is asserted.
		152	*
		153	* Context: port's lock must be held
114	*/	154	*/
115	static void dw8250_force_idle(struct uart_port *p)	155	static int dw8250_idle_enter(struct uart_port *p)
116	{	156	{
		157	struct dw8250_data *d = to_dw8250_data(p->private_data);
		158	unsigned int usr_reg = d->pdata ? d->pdata->usr_reg : DW_UART_USR;
117	struct uart_8250_port *up = up_to_u8250p(p);	159	struct uart_8250_port *up = up_to_u8250p(p);
118	unsigned int lsr;	160	int retries;
		161	u32 lsr;
119		162
120	/*	163	lockdep_assert_held_once(&p->lock);
121	* The following call currently performs serial_out()	164
122	* against the FCR register. Because it differs to LCR	165	if (d->uart_16550_compatible)
123	* there will be no infinite loop, but if it ever gets	166	return 0;
124	* modified, we might need a new custom version of it	167
125	* that avoids infinite recursion.	168	d->in_idle = 1;
126	*/	169
127	serial8250_clear_and_reinit_fifos(up);	170	/* Prevent triggering interrupt from RBR filling */
		171	serial_port_out(p, UART_IER, 0);
		172
		173	if (up->dma) {
		174	serial8250_rx_dma_flush(up);
		175	if (serial8250_tx_dma_running(up))
		176	serial8250_tx_dma_pause(up);
		177	}
128		178
129	/*	179	/*
130	* With PSLVERR_RESP_EN parameter set to 1, the device generates an	180	* Wait until Tx becomes empty + one extra frame time to ensure all bits
131	* error response when an attempt to read an empty RBR with FIFO	181	* have been sent on the wire.
132	* enabled.	182	*
		183	* FIXME: frame_time delay is too long with very low baudrates.
133	*/	184	*/
134	if (up->fcr & UART_FCR_ENABLE_FIFO) {	185	serial8250_fifo_wait_for_lsr_thre(up, p->fifosize);
135	lsr = serial_port_in(p, UART_LSR);	186	ndelay(p->frame_time);
136	if (!(lsr & UART_LSR_DR))	187
137	return;	188	serial_port_out(p, UART_MCR, up->mcr \| UART_MCR_LOOP);
		189
		190	retries = 4; /* Arbitrary limit, 2 was always enough in tests */
		191	do {
		192	serial8250_clear_fifos(up);
		193	if (!(serial_port_in(p, usr_reg) & DW_UART_USR_BUSY))
		194	break;
		195	/* FIXME: frame_time delay is too long with very low baudrates. */
		196	ndelay(p->frame_time);
		197	} while (--retries);
		198
		199	lsr = serial_lsr_in(up);
		200	if (lsr & UART_LSR_DR) {
		201	serial_port_in(p, UART_RX);
		202	up->lsr_saved_flags = 0;
		203	}
		204
		205	/* Now guaranteed to have BUSY deasserted? Just sanity check */
		206	if (serial_port_in(p, usr_reg) & DW_UART_USR_BUSY) {
		207	dw8250_idle_exit(p);
		208	return -EBUSY;
138	}	209	}
139		210
140	serial_port_in(p, UART_RX);	211	return 0;
		212	}
		213
		214	static void dw8250_set_divisor(struct uart_port *p, unsigned int baud,
		215	unsigned int quot, unsigned int quot_frac)
		216	{
		217	struct uart_8250_port *up = up_to_u8250p(p);
		218	int ret;
		219
		220	ret = dw8250_idle_enter(p);
		221	if (ret < 0)
		222	return;
		223
		224	serial_port_out(p, UART_LCR, up->lcr \| UART_LCR_DLAB);
		225	if (!(serial_port_in(p, UART_LCR) & UART_LCR_DLAB))
		226	goto idle_failed;
		227
		228	serial_dl_write(up, quot);
		229	serial_port_out(p, UART_LCR, up->lcr);
		230
		231	idle_failed:
		232	dw8250_idle_exit(p);
141	}	233	}
142		234
143	/*	235	/*
144	* This function is being called as part of the uart_port::serial_out()	236	* This function is being called as part of the uart_port::serial_out()
145	* routine. Hence, it must not call serial_port_out() or serial_out()	237	* routine. Hence, special care must be taken when serial_port_out() or
146	* against the modified registers here, i.e. LCR.	238	* serial_out() against the modified registers here, i.e. LCR (d->in_idle is
		239	* used to break recursion loop).
147	*/	240	*/
148	static void dw8250_check_lcr(struct uart_port *p, unsigned int offset, u32 value)	241	static void dw8250_check_lcr(struct uart_port *p, unsigned int offset, u32 value)
149	{	242	{
150	struct dw8250_data *d = to_dw8250_data(p->private_data);	243	struct dw8250_data *d = to_dw8250_data(p->private_data);
151	void __iomem *addr = p->membase + (offset << p->regshift);	244	u32 lcr;
152	int tries = 1000;	245	int ret;
153		246
154	if (offset != UART_LCR \|\| d->uart_16550_compatible)	247	if (offset != UART_LCR \|\| d->uart_16550_compatible)
155	return;	248	return;
156		249
		250	lcr = serial_port_in(p, UART_LCR);
		251
157	/* Make sure LCR write wasn't ignored */	252	/* Make sure LCR write wasn't ignored */
158	while (tries--) {	253	if ((value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR))
159	u32 lcr = serial_port_in(p, offset);	254	return;
160		255
161	if ((value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR))	256	if (d->in_idle)
162	return;	257	goto write_err;
163		258
164	dw8250_force_idle(p);	259	ret = dw8250_idle_enter(p);
		260	if (ret < 0)
		261	goto write_err;
165		262
166	#ifdef CONFIG_64BIT	263	serial_port_out(p, UART_LCR, value);
167	if (p->type == PORT_OCTEON)	264	dw8250_idle_exit(p);
168	__raw_writeq(value & 0xff, addr);	265	return;
169	else	266
170	#endif	267	write_err:
171	if (p->iotype == UPIO_MEM32)
172	writel(value, addr);
173	else if (p->iotype == UPIO_MEM32BE)
174	iowrite32be(value, addr);
175	else
176	writeb(value, addr);
177	}
178	/*	268	/*
179	* FIXME: this deadlocks if port->lock is already held	269	* FIXME: this deadlocks if port->lock is already held
180	* dev_err(p->dev, "Couldn't set LCR to %d\n", value);	270	* dev_err(p->dev, "Couldn't set LCR to %d\n", value);
181	*/	271	*/
		272	return; /* Silences "label at the end of compound statement" */
		273	}
		274
		275	/*
		276	* With BUSY, LCR writes can be very expensive (IRQ + complex retry logic).
		277	* If the write does not change the value of the LCR register, skip it entirely.
		278	*/
		279	static bool dw8250_can_skip_reg_write(struct uart_port *p, unsigned int offset, u32 value)
		280	{
		281	struct dw8250_data *d = to_dw8250_data(p->private_data);
		282	u32 lcr;
		283
		284	if (offset != UART_LCR \|\| d->uart_16550_compatible)
		285	return false;
		286
		287	lcr = serial_port_in(p, offset);
		288	return lcr == value;
182	}	289	}
183		290
184	/* Returns once the transmitter is empty or we run out of retries */	291	/* Returns once the transmitter is empty or we run out of retries */
@@ -207,12 +314,18 @@ static void dw8250_tx_wait_empty(struct uart_port *p) · 22 unmodified lines
207		314
208	static void dw8250_serial_out(struct uart_port *p, unsigned int offset, u32 value)	315	static void dw8250_serial_out(struct uart_port *p, unsigned int offset, u32 value)
209	{	316	{
		317	if (dw8250_can_skip_reg_write(p, offset, value))
		318	return;
		319
210	writeb(value, p->membase + (offset << p->regshift));	320	writeb(value, p->membase + (offset << p->regshift));
211	dw8250_check_lcr(p, offset, value);	321	dw8250_check_lcr(p, offset, value);
212	}	322	}
213		323
214	static void dw8250_serial_out38x(struct uart_port *p, unsigned int offset, u32 value)	324	static void dw8250_serial_out38x(struct uart_port *p, unsigned int offset, u32 value)
215	{	325	{
		326	if (dw8250_can_skip_reg_write(p, offset, value))
		327	return;
		328
216	/* Allow the TX to drain before we reconfigure */	329	/* Allow the TX to drain before we reconfigure */
217	if (offset == UART_LCR)	330	if (offset == UART_LCR)
218	dw8250_tx_wait_empty(p);	331	dw8250_tx_wait_empty(p);
@@ -237,6 +350,9 @@ static u32 dw8250_serial_inq(struct uart_port *p, unsigned int offset) · 18 unmodified lines
237		350
238	static void dw8250_serial_outq(struct uart_port *p, unsigned int offset, u32 value)	351	static void dw8250_serial_outq(struct uart_port *p, unsigned int offset, u32 value)
239	{	352	{
		353	if (dw8250_can_skip_reg_write(p, offset, value))
		354	return;
		355
240	value &= 0xff;	356	value &= 0xff;
241	__raw_writeq(value, p->membase + (offset << p->regshift));	357	__raw_writeq(value, p->membase + (offset << p->regshift));
242	/* Read back to ensure register write ordering. */	358	/* Read back to ensure register write ordering. */
@@ -248,6 +364,9 @@ static void dw8250_serial_outq(struct uart_port *p, unsigned int offset, u32 val · 5 unmodified lines
248		364
249	static void dw8250_serial_out32(struct uart_port *p, unsigned int offset, u32 value)	365	static void dw8250_serial_out32(struct uart_port *p, unsigned int offset, u32 value)
250	{	366	{
		367	if (dw8250_can_skip_reg_write(p, offset, value))
		368	return;
		369
251	writel(value, p->membase + (offset << p->regshift));	370	writel(value, p->membase + (offset << p->regshift));
252	dw8250_check_lcr(p, offset, value);	371	dw8250_check_lcr(p, offset, value);
253	}	372	}
@@ -261,6 +380,9 @@ static u32 dw8250_serial_in32(struct uart_port *p, unsigned int offset) · 7 unmodified lines
261		380
262	static void dw8250_serial_out32be(struct uart_port *p, unsigned int offset, u32 value)	381	static void dw8250_serial_out32be(struct uart_port *p, unsigned int offset, u32 value)
263	{	382	{
		383	if (dw8250_can_skip_reg_write(p, offset, value))
		384	return;
		385
264	iowrite32be(value, p->membase + (offset << p->regshift));	386	iowrite32be(value, p->membase + (offset << p->regshift));
265	dw8250_check_lcr(p, offset, value);	387	dw8250_check_lcr(p, offset, value);
266	}	388	}
@@ -272,6 +394,29 @@ static u32 dw8250_serial_in32be(struct uart_port *p, unsigned int offset) · 5 unmodified lines
272	return dw8250_modify_msr(p, offset, value);	394	return dw8250_modify_msr(p, offset, value);
273	}	395	}
274		396
		397	/*
		398	* INTC10EE UART can IRQ storm while reporting IIR_NO_INT. Inducing IIR value
		399	* change has been observed to break the storm.
		400	*
		401	* If Tx is empty (THRE asserted), we use here IER_THRI to cause IIR_NO_INT ->
		402	* IIR_THRI transition.
		403	*/
		404	static void dw8250_quirk_ier_kick(struct uart_port *p)
		405	{
		406	struct uart_8250_port *up = up_to_u8250p(p);
		407	u32 lsr;
		408
		409	if (up->ier & UART_IER_THRI)
		410	return;
		411
		412	lsr = serial_lsr_in(up);
		413	if (!(lsr & UART_LSR_THRE))
		414	return;
		415
		416	serial_port_out(p, UART_IER, up->ier \| UART_IER_THRI);
		417	serial_port_in(p, UART_LCR); /* safe, no side-effects */
		418	serial_port_out(p, UART_IER, up->ier);
		419	}
275		420
276	static int dw8250_handle_irq(struct uart_port *p)	421	static int dw8250_handle_irq(struct uart_port *p)
277	{	422	{
@@ -281,7 +426,31 @@ static int dw8250_handle_irq(struct uart_port *p) · 3 unmodified lines
281	bool rx_timeout = (iir & 0x3f) == UART_IIR_RX_TIMEOUT;	426	bool rx_timeout = (iir & 0x3f) == UART_IIR_RX_TIMEOUT;
282	unsigned int quirks = d->pdata->quirks;	427	unsigned int quirks = d->pdata->quirks;
283	unsigned int status;	428	unsigned int status;
284	unsigned long flags;	429
		430	guard(uart_port_lock_irqsave)(p);
		431
		432	switch (FIELD_GET(DW_UART_IIR_IID, iir)) {
		433	case UART_IIR_NO_INT:
		434	if (d->uart_16550_compatible \|\| up->dma)
		435	return 0;
		436
		437	if (quirks & DW_UART_QUIRK_IER_KICK &&
		438	d->no_int_count == (DW_UART_QUIRK_IER_KICK_THRES - 1))
		439	dw8250_quirk_ier_kick(p);
		440	d->no_int_count = (d->no_int_count + 1) % DW_UART_QUIRK_IER_KICK_THRES;
		441
		442	return 0;
		443
		444	case UART_IIR_BUSY:
		445	/* Clear the USR */
		446	serial_port_in(p, d->pdata->usr_reg);
		447
		448	d->no_int_count = 0;
		449
		450	return 1;
		451	}
		452
		453	d->no_int_count = 0;
285		454
286	/*	455	/*
287	* There are ways to get Designware-based UARTs into a state where	456	* There are ways to get Designware-based UARTs into a state where
@@ -294,20 +463,15 @@ static int dw8250_handle_irq(struct uart_port *p) · 6 unmodified lines
294	* so we limit the workaround only to non-DMA mode.	463	* so we limit the workaround only to non-DMA mode.
295	*/	464	*/
296	if (!up->dma && rx_timeout) {	465	if (!up->dma && rx_timeout) {
297	uart_port_lock_irqsave(p, &flags);
298	status = serial_lsr_in(up);	466	status = serial_lsr_in(up);
299		467
300	if (!(status & (UART_LSR_DR \| UART_LSR_BI)))	468	if (!(status & (UART_LSR_DR \| UART_LSR_BI)))
301	serial_port_in(p, UART_RX);	469	serial_port_in(p, UART_RX);
302
303	uart_port_unlock_irqrestore(p, flags);
304	}	470	}
305		471
306	/* Manually stop the Rx DMA transfer when acting as flow controller */	472	/* Manually stop the Rx DMA transfer when acting as flow controller */
307	if (quirks & DW_UART_QUIRK_IS_DMA_FC && up->dma && up->dma->rx_running && rx_timeout) {	473	if (quirks & DW_UART_QUIRK_IS_DMA_FC && up->dma && up->dma->rx_running && rx_timeout) {
308	uart_port_lock_irqsave(p, &flags);
309	status = serial_lsr_in(up);	474	status = serial_lsr_in(up);
310	uart_port_unlock_irqrestore(p, flags);
311		475
312	if (status & (UART_LSR_DR \| UART_LSR_BI)) {	476	if (status & (UART_LSR_DR \| UART_LSR_BI)) {
313	dw8250_writel_ext(p, RZN1_UART_RDMACR, 0);	477	dw8250_writel_ext(p, RZN1_UART_RDMACR, 0);
@@ -315,17 +479,9 @@ static int dw8250_handle_irq(struct uart_port *p) · 1 unmodified line
315	}	479	}
316	}	480	}
317		481
318	if (serial8250_handle_irq(p, iir))	482	serial8250_handle_irq_locked(p, iir);
319	return 1;
320
321	if ((iir & UART_IIR_BUSY) == UART_IIR_BUSY) {
322	/* Clear the USR */
323	serial_port_in(p, d->pdata->usr_reg);
324
325	return 1;
326	}
327		483
328	return 0;	484	return 1;
329	}	485	}
330		486
331	static void dw8250_clk_work_cb(struct work_struct *work)	487	static void dw8250_clk_work_cb(struct work_struct *work)
@@ -527,6 +683,14 @@ static void dw8250_reset_control_assert(void *data) · 195 unmodified lines
527	reset_control_assert(data);	683	reset_control_assert(data);
528	}	684	}
529		685
		686	static void dw8250_shutdown(struct uart_port *port)
		687	{
		688	struct dw8250_data *d = to_dw8250_data(port->private_data);
		689
		690	serial8250_do_shutdown(port);
		691	d->no_int_count = 0;
		692	}
		693
530	static int dw8250_probe(struct platform_device *pdev)	694	static int dw8250_probe(struct platform_device *pdev)
531	{	695	{
532	struct uart_8250_port uart = {}, *up = &uart;	696	struct uart_8250_port uart = {}, *up = &uart;
@@ -545,8 +709,10 @@ static int dw8250_probe(struct platform_device *pdev) · 12 unmodified lines
545	p->type = PORT_8250;	709	p->type = PORT_8250;
546	p->flags = UPF_FIXED_PORT;	710	p->flags = UPF_FIXED_PORT;
547	p->dev = dev;	711	p->dev = dev;
		712
548	p->set_ldisc = dw8250_set_ldisc;	713	p->set_ldisc = dw8250_set_ldisc;
549	p->set_termios = dw8250_set_termios;	714	p->set_termios = dw8250_set_termios;
		715	p->set_divisor = dw8250_set_divisor;
550		716
551	data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);	717	data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
552	if (!data)	718	if (!data)
@@ -654,10 +820,12 @@ static int dw8250_probe(struct platform_device *pdev) · 101 unmodified lines
654	dw8250_quirks(p, data);	820	dw8250_quirks(p, data);
655		821
656	/* If the Busy Functionality is not implemented, don't handle it */	822	/* If the Busy Functionality is not implemented, don't handle it */
657	if (data->uart_16550_compatible)	823	if (data->uart_16550_compatible) {
658	p->handle_irq = NULL;	824	p->handle_irq = NULL;
659	else if (data->pdata)	825	} else if (data->pdata) {
660	p->handle_irq = dw8250_handle_irq;	826	p->handle_irq = dw8250_handle_irq;
		827	p->shutdown = dw8250_shutdown;
		828	}
661		829
662	dw8250_setup_dma_filter(p, data);	830	dw8250_setup_dma_filter(p, data);
663		831
@@ -789,6 +957,11 @@ static const struct dw8250_platform_data dw8250_skip_set_rate_data = { · 125 unmodified lines
789	.quirks = DW_UART_QUIRK_SKIP_SET_RATE,	957	.quirks = DW_UART_QUIRK_SKIP_SET_RATE,
790	};	958	};
791		959
		960	static const struct dw8250_platform_data dw8250_intc10ee = {
		961	.usr_reg = DW_UART_USR,
		962	.quirks = DW_UART_QUIRK_IER_KICK,
		963	};
		964
792	static const struct of_device_id dw8250_of_match[] = {	965	static const struct of_device_id dw8250_of_match[] = {
793	{ .compatible = "snps,dw-apb-uart", .data = &dw8250_dw_apb },	966	{ .compatible = "snps,dw-apb-uart", .data = &dw8250_dw_apb },
794	{ .compatible = "cavium,octeon-3860-uart", .data = &dw8250_octeon_3860_data },	967	{ .compatible = "cavium,octeon-3860-uart", .data = &dw8250_octeon_3860_data },
@@ -818,7 +991,7 @@ static const struct acpi_device_id dw8250_acpi_match[] = { · 23 unmodified lines
818	{ "INT33C5", (kernel_ulong_t)&dw8250_dw_apb },	991	{ "INT33C5", (kernel_ulong_t)&dw8250_dw_apb },
819	{ "INT3434", (kernel_ulong_t)&dw8250_dw_apb },	992	{ "INT3434", (kernel_ulong_t)&dw8250_dw_apb },
820	{ "INT3435", (kernel_ulong_t)&dw8250_dw_apb },	993	{ "INT3435", (kernel_ulong_t)&dw8250_dw_apb },
821	{ "INTC10EE", (kernel_ulong_t)&dw8250_dw_apb },	994	{ "INTC10EE", (kernel_ulong_t)&dw8250_intc10ee },
822	{ },	995	{ },
823	};	996	};
824	MODULE_DEVICE_TABLE(acpi, dw8250_acpi_match);	997	MODULE_DEVICE_TABLE(acpi, dw8250_acpi_match);
@@ -836,6 +1009,7 @@ static struct platform_driver dw8250_platform_driver = { · 11 unmodified lines
836		1009
837	module_platform_driver(dw8250_platform_driver);	1010	module_platform_driver(dw8250_platform_driver);
838		1011
		1012	MODULE_IMPORT_NS("SERIAL_8250");
839	MODULE_AUTHOR("Jamie Iles");	1013	MODULE_AUTHOR("Jamie Iles");
840	MODULE_LICENSE("GPL");	1014	MODULE_LICENSE("GPL");
841	MODULE_DESCRIPTION("Synopsys DesignWare 8250 serial port driver");	1015	MODULE_DESCRIPTION("Synopsys DesignWare 8250 serial port driver");

drivers/tty/serial/8250/8250_pci.c+17−0

 };
 #define PCI_DEVICE_ID_HPE_PCI_SERIAL	0x37e
+#define PCIE_VENDOR_ID_ASIX		0x125B
+#define PCIE_DEVICE_ID_AX99100		0x9100
 static const struct pci_device_id pci_use_msi[] = {
 	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9900,
 			 0xA000, 0x1000) },
 	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_HP_3PAR, PCI_DEVICE_ID_HPE_PCI_SERIAL,
 			 PCI_ANY_ID, PCI_ANY_ID) },
+	{ PCI_DEVICE_SUB(PCIE_VENDOR_ID_ASIX, PCIE_DEVICE_ID_AX99100,
+			 0xA000, 0x1000) },
 	{ }
 };
 	case PCI_DEVICE_ID_NETMOS_9912:
 	case PCI_DEVICE_ID_NETMOS_9922:
 	case PCI_DEVICE_ID_NETMOS_9900:
+	case PCIE_DEVICE_ID_AX99100:
 		num_serial = pci_netmos_9900_numports(dev);
 		break;
 		.init		= pci_netmos_init,
 		.setup		= pci_netmos_9900_setup,
 	},
+	{
+		.vendor		= PCIE_VENDOR_ID_ASIX,
+		.device		= PCI_ANY_ID,
+		.subvendor	= PCI_ANY_ID,
+		.subdevice	= PCI_ANY_ID,
+		.init		= pci_netmos_init,
+		.setup		= pci_netmos_9900_setup,
+	},
 	/*
 	 * EndRun Technologies
 	*/
 		0xA000, 0x3002,
 		0, 0, pbn_NETMOS9900_2s_115200 },
+	{	PCIE_VENDOR_ID_ASIX, PCIE_DEVICE_ID_AX99100,
+		0xA000, 0x1000,
+		0, 0, pbn_b0_1_115200 },
 	/*
 	 * Best Connectivity and Rosewill PCI Multi I/O cards
 	 */

drivers/tty/serial/8250/8250_port.c+45−30

 #include <linux/irq.h>
 #include <linux/console.h>
 #include <linux/gpio/consumer.h>
+#include <linux/lockdep.h>
 #include <linux/sysrq.h>
 #include <linux/delay.h>
 #include <linux/platform_device.h>
 /*
  * FIFO support.
  */
-static void serial8250_clear_fifos(struct uart_8250_port *p)
+void serial8250_clear_fifos(struct uart_8250_port *p)
 {
 	if (p->capabilities & UART_CAP_FIFO) {
 		serial_out(p, UART_FCR, UART_FCR_ENABLE_FIFO);
 		serial_out(p, UART_FCR, 0);
 	}
 }
+EXPORT_SYMBOL_NS_GPL(serial8250_clear_fifos, "SERIAL_8250");
 static enum hrtimer_restart serial8250_em485_handle_start_tx(struct hrtimer *t);
 static enum hrtimer_restart serial8250_em485_handle_stop_tx(struct hrtimer *t);
 }
 /*
- * This handles the interrupt from one port.
+ * Context: port's lock must be held by the caller.
  */
-int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+void serial8250_handle_irq_locked(struct uart_port *port, unsigned int iir)
 {
 	struct uart_8250_port *up = up_to_u8250p(port);
 	struct tty_port *tport = &port->state->port;
 	bool skip_rx = false;
-	unsigned long flags;
 	u16 status;
-	if (iir & UART_IIR_NO_INT)
+	lockdep_assert_held_once(&port->lock);
-		return 0;
-	uart_port_lock_irqsave(port, &flags);
 	status = serial_lsr_in(up);
 		else if (!up->dma->tx_running)
 			__stop_tx(up);
 	}
+}
+EXPORT_SYMBOL_NS_GPL(serial8250_handle_irq_locked, "SERIAL_8250");
+/*
+ * This handles the interrupt from one port.
+ */
+int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+{
+	if (iir & UART_IIR_NO_INT)
+		return 0;
-	uart_unlock_and_check_sysrq_irqrestore(port, flags);
+	guard(uart_port_lock_irqsave)(port);
+	serial8250_handle_irq_locked(port, iir);
 	return 1;
 }
 	if (up->port.flags & UPF_NO_THRE_TEST)
 		return;
-	if (port->irqflags & IRQF_SHARED)
+	disable_irq(port->irq);
-		disable_irq_nosync(port->irq);
 	/*
 	 * Test for UARTs that do not reassert THRE when the transmitter is idle and the interrupt
 		serial_port_out(port, UART_IER, 0);
 	}
-	if (port->irqflags & IRQF_SHARED)
+	enable_irq(port->irq);
-		enable_irq(port->irq);
 	/*
 	 * If the interrupt is not reasserted, or we otherwise don't trust the iir, setup a timer to
 void serial8250_do_shutdown(struct uart_port *port)
 {
 	struct uart_8250_port *up = up_to_u8250p(port);
+	u32 lcr;
 	serial8250_rpm_get(up);
 	/*
 			port->mctrl &= ~TIOCM_OUT2;
 		serial8250_set_mctrl(port, port->mctrl);
+		/* Disable break condition */
+		lcr = serial_port_in(port, UART_LCR);
+		lcr &= ~UART_LCR_SBC;
+		serial_port_out(port, UART_LCR, lcr);
 	}
-	/*
-	 * Disable break condition and FIFOs
-	 */
-	serial_port_out(port, UART_LCR,
-			serial_port_in(port, UART_LCR) & ~UART_LCR_SBC);
 	serial8250_clear_fifos(up);
 	rsa_disable(up);
 	 * the IRQ chain.
 	 */
 	serial_port_in(port, UART_RX);
+	/*
+	 * LCR writes on DW UART can trigger late (unmaskable) IRQs.
+	 * Handle them before releasing the handler.
+	 */
+	synchronize_irq(port->irq);
 	serial8250_rpm_put(up);
 	up->ops->release_irq(up);
 }
 EXPORT_SYMBOL_GPL(serial8250_set_defaults);
+void serial8250_fifo_wait_for_lsr_thre(struct uart_8250_port *up, unsigned int count)
+{
+	unsigned int i;
+	for (i = 0; i < count; i++) {
+		if (wait_for_lsr(up, UART_LSR_THRE))
+			return;
+	}
+}
+EXPORT_SYMBOL_NS_GPL(serial8250_fifo_wait_for_lsr_thre, "SERIAL_8250");
 #ifdef CONFIG_SERIAL_8250_CONSOLE
 static void serial8250_console_putchar(struct uart_port *port, unsigned char ch)
 	serial8250_out_MCR(up, up->mcr | UART_MCR_DTR | UART_MCR_RTS);
 }
-static void fifo_wait_for_lsr(struct uart_8250_port *up, unsigned int count)
-{
-	unsigned int i;
-	for (i = 0; i < count; i++) {
-		if (wait_for_lsr(up, UART_LSR_THRE))
-			return;
-	}
-}
 /*
  * Print a string to the serial port using the device FIFO
  *
 	while (s != end) {
 		/* Allow timeout for each byte of a possibly full FIFO */
-		fifo_wait_for_lsr(up, fifosize);
+		serial8250_fifo_wait_for_lsr_thre(up, fifosize);
 		for (i = 0; i < fifosize && s != end; ++i) {
 			if (*s == '\n' && !cr_sent) {
 	 * Allow timeout for each byte written since the caller will only wait
 	 * for UART_LSR_BOTH_EMPTY using the timeout of a single character
 	 */
-	fifo_wait_for_lsr(up, tx_count);
+	serial8250_fifo_wait_for_lsr_thre(up, tx_count);
 }
 /*

drivers/tty/serial/serial_core.c+4−1

 	unsigned int ret;
 	port = uart_port_ref_lock(state, &flags);
-	ret = kfifo_avail(&state->port.xmit_fifo);
+	if (!state->port.xmit_buf)
+		ret = 0;
+	else
+		ret = kfifo_avail(&state->port.xmit_fifo);
 	uart_port_unlock_deref(port, flags);
 	return ret;
 }

drivers/tty/serial/uartlite.c+1−0

@@ -878,6 +878,7 @@ of_err: · 877 unmodified lines
878	pm_runtime_use_autosuspend(&pdev->dev);	878	pm_runtime_use_autosuspend(&pdev->dev);
879	pm_runtime_set_autosuspend_delay(&pdev->dev, UART_AUTOSUSPEND_TIMEOUT);	879	pm_runtime_set_autosuspend_delay(&pdev->dev, UART_AUTOSUSPEND_TIMEOUT);
880	pm_runtime_set_active(&pdev->dev);	880	pm_runtime_set_active(&pdev->dev);
		881	pm_runtime_get_noresume(&pdev->dev);
881	pm_runtime_enable(&pdev->dev);	882	pm_runtime_enable(&pdev->dev);
882		883
883	ret = ulite_assign(&pdev->dev, id, res->start, irq, pdata);	884	ret = ulite_assign(&pdev->dev, id, res->start, irq, pdata);

drivers/tty/vt/vt.c+8−0

 			kfree(vc->vc_saved_screen);
 			vc->vc_saved_screen = NULL;
 		}
+		vc_uniscr_free(vc->vc_saved_uni_lines);
+		vc->vc_saved_uni_lines = NULL;
 	}
 	return vc;
 }
 	vc->vc_saved_screen = kmemdup((u16 *)vc->vc_origin, size, GFP_KERNEL);
 	if (vc->vc_saved_screen == NULL)
 		return;
+	vc->vc_saved_uni_lines = vc->vc_uni_lines;
+	vc->vc_uni_lines = NULL;
 	vc->vc_saved_rows = vc->vc_rows;
 	vc->vc_saved_cols = vc->vc_cols;
 	save_cur(vc);
 		dest = ((u16 *)vc->vc_origin) + r * vc->vc_cols;
 		memcpy(dest, src, 2 * cols);
 	}
+	vc_uniscr_set(vc, vc->vc_saved_uni_lines);
+	vc->vc_saved_uni_lines = NULL;
 	restore_cur(vc);
 	/* Update the entire screen */
 	if (con_should_update(vc))
 	if (vc->vc_saved_screen != NULL) {
 		kfree(vc->vc_saved_screen);
 		vc->vc_saved_screen = NULL;
+		vc_uniscr_free(vc->vc_saved_uni_lines);
+		vc->vc_saved_uni_lines = NULL;
 		vc->vc_saved_rows = 0;
 		vc->vc_saved_cols = 0;
 	}

fs/binfmt_elf_fdpic.c+6−0

 #ifdef ELF_HWCAP2
 	nitems++;
 #endif
+#ifdef ELF_HWCAP3
+	nitems++;
+#endif
+#ifdef ELF_HWCAP4
+	nitems++;
+#endif
 	csp = sp;
 	sp -= nitems * 2 * sizeof(unsigned long);

fs/btrfs/backref.c+28−0

@@ -1393,6 +1393,13 @@ static int find_parent_nodes(struct btrfs_backref_walk_ctx *ctx, · 1392 unmodified lines
1393	.indirect_missing_keys = PREFTREE_INIT	1393	.indirect_missing_keys = PREFTREE_INIT
1394	};	1394	};
1395		1395
		1396	if (unlikely(!root)) {
		1397	btrfs_err(ctx->fs_info,
		1398	"missing extent root for extent at bytenr %llu",
		1399	ctx->bytenr);
		1400	return -EUCLEAN;
		1401	}
		1402
1396	/* Roots ulist is not needed when using a sharedness check context. */	1403	/* Roots ulist is not needed when using a sharedness check context. */
1397	if (sc)	1404	if (sc)
1398	ASSERT(ctx->roots == NULL);	1405	ASSERT(ctx->roots == NULL);
@@ -2204,6 +2211,13 @@ int extent_from_logical(struct btrfs_fs_info *fs_info, u64 logical, · 805 unmodified lines
2204	struct btrfs_extent_item *ei;	2211	struct btrfs_extent_item *ei;
2205	struct btrfs_key key;	2212	struct btrfs_key key;
2206		2213
		2214	if (unlikely(!extent_root)) {
		2215	btrfs_err(fs_info,
		2216	"missing extent root for extent at bytenr %llu",
		2217	logical);
		2218	return -EUCLEAN;
		2219	}
		2220
2207	key.objectid = logical;	2221	key.objectid = logical;
2208	if (btrfs_fs_incompat(fs_info, SKINNY_METADATA))	2222	if (btrfs_fs_incompat(fs_info, SKINNY_METADATA))
2209	key.type = BTRFS_METADATA_ITEM_KEY;	2223	key.type = BTRFS_METADATA_ITEM_KEY;
@@ -2851,6 +2865,13 @@ int btrfs_backref_iter_start(struct btrfs_backref_iter *iter, u64 bytenr) · 641 unmodified lines
2851	struct btrfs_key key;	2865	struct btrfs_key key;
2852	int ret;	2866	int ret;
2853		2867
		2868	if (unlikely(!extent_root)) {
		2869	btrfs_err(fs_info,
		2870	"missing extent root for extent at bytenr %llu",
		2871	bytenr);
		2872	return -EUCLEAN;
		2873	}
		2874
2854	key.objectid = bytenr;	2875	key.objectid = bytenr;
2855	key.type = BTRFS_METADATA_ITEM_KEY;	2876	key.type = BTRFS_METADATA_ITEM_KEY;
2856	key.offset = (u64)-1;	2877	key.offset = (u64)-1;
@@ -2987,6 +3008,13 @@ int btrfs_backref_iter_next(struct btrfs_backref_iter *iter) · 130 unmodified lines
2987		3008
2988	/* We're at keyed items, there is no inline item, go to the next one */	3009	/* We're at keyed items, there is no inline item, go to the next one */
2989	extent_root = btrfs_extent_root(iter->fs_info, iter->bytenr);	3010	extent_root = btrfs_extent_root(iter->fs_info, iter->bytenr);
		3011	if (unlikely(!extent_root)) {
		3012	btrfs_err(iter->fs_info,
		3013	"missing extent root for extent at bytenr %llu",
		3014	iter->bytenr);
		3015	return -EUCLEAN;
		3016	}
		3017
2990	ret = btrfs_next_item(extent_root, iter->path);	3018	ret = btrfs_next_item(extent_root, iter->path);
2991	if (ret)	3019	if (ret)
2992	return ret;	3020	return ret;

fs/btrfs/block-group.c+36−0

 	last = max_t(u64, block_group->start, BTRFS_SUPER_INFO_OFFSET);
 	extent_root = btrfs_extent_root(fs_info, last);
+	if (unlikely(!extent_root)) {
+		btrfs_err(fs_info,
+			  "missing extent root for block group at offset %llu",
+			  block_group->start);
+		return -EUCLEAN;
+	}
 #ifdef CONFIG_BTRFS_DEBUG
 	/*
 	int ret;
 	root = btrfs_block_group_root(fs_info);
+	if (unlikely(!root)) {
+		btrfs_err(fs_info, "missing block group root");
+		return -EUCLEAN;
+	}
 	key.objectid = block_group->start;
 	key.type = BTRFS_BLOCK_GROUP_ITEM_KEY;
 	key.offset = block_group->length;
 	struct btrfs_chunk_map *map;
 	unsigned int num_items;
+	if (unlikely(!root)) {
+		btrfs_err(fs_info, "missing block group root");
+		return ERR_PTR(-EUCLEAN);
+	}
 	map = btrfs_find_chunk_map(fs_info, chunk_offset, 1);
 	ASSERT(map != NULL);
 	ASSERT(map->start == chunk_offset);
 	int ret;
 	struct btrfs_key found_key;
+	if (unlikely(!root)) {
+		btrfs_err(fs_info, "missing block group root");
+		return -EUCLEAN;
+	}
 	btrfs_for_each_slot(root, key, &found_key, path, ret) {
 		if (found_key.objectid >= key->objectid &&
 		    found_key.type == BTRFS_BLOCK_GROUP_ITEM_KEY) {
 	size_t size;
 	int ret;
+	if (unlikely(!root)) {
+		btrfs_err(fs_info, "missing block group root");
+		return -EUCLEAN;
+	}
 	spin_lock(&block_group->lock);
 	btrfs_set_stack_block_group_v2_used(&bgi, block_group->used);
 	btrfs_set_stack_block_group_v2_chunk_objectid(&bgi, block_group->global_root_id);
 	int ret;
 	bool dirty_bg_running;
+	if (unlikely(!root)) {
+		btrfs_err(fs_info, "missing block group root");
+		return -EUCLEAN;
+	}
 	/*
 	 * This can only happen when we are doing read-only scrub on read-only
 	 * mount.
 	u64 used, remap_bytes;
 	u32 identity_remap_count;
+	if (unlikely(!root)) {
+		btrfs_err(fs_info, "missing block group root");
+		return -EUCLEAN;
+	}
 	/*
 	 * Block group items update can be triggered out of commit transaction
 	 * critical section, thus we need a consistent view of used bytes.

fs/btrfs/compression.c+8−3

 	ASSERT(IS_ALIGNED(ordered->file_offset, fs_info->sectorsize));
 	ASSERT(IS_ALIGNED(ordered->num_bytes, fs_info->sectorsize));
-	ASSERT(cb->writeback);
+	/*
+	 * This flag determines if we should clear the writeback flag from the
+	 * page cache. But this function is only utilized by encoded writes, it
+	 * never goes through the page cache.
+	 */
+	ASSERT(!cb->writeback);
 	cb->start = ordered->file_offset;
 	cb->len = ordered->num_bytes;
+	ASSERT(cb->bbio.bio.bi_iter.bi_size == ordered->disk_num_bytes);
 	cb->compressed_len = ordered->disk_num_bytes;
 	cb->bbio.bio.bi_iter.bi_sector = ordered->disk_bytenr >> SECTOR_SHIFT;
 	cb->bbio.ordered = ordered;
 	cb = alloc_compressed_bio(inode, start, REQ_OP_WRITE, end_bbio_compressed_write);
 	cb->start = start;
 	cb->len = len;
-	cb->writeback = true;
+	cb->writeback = false;
 	return cb;
 }

fs/btrfs/disk-io.c+17−3

  * this will bump the backup pointer by one when it is
  * done
  */
-static void backup_super_roots(struct btrfs_fs_info *info)
+static int backup_super_roots(struct btrfs_fs_info *info)
 {
 	const int next_backup = info->backup_root_index;
 	struct btrfs_root_backup *root_backup;
 		struct btrfs_root *extent_root = btrfs_extent_root(info, 0);
 		struct btrfs_root *csum_root = btrfs_csum_root(info, 0);
+		if (unlikely(!extent_root)) {
+			btrfs_err(info, "missing extent root for extent at bytenr 0");
+			return -EUCLEAN;
+		}
+		if (unlikely(!csum_root)) {
+			btrfs_err(info, "missing csum root for extent at bytenr 0");
+			return -EUCLEAN;
+		}
 		btrfs_set_backup_extent_root(root_backup,
 					     extent_root->node->start);
 		btrfs_set_backup_extent_root_gen(root_backup,
 	memcpy(&info->super_copy->super_roots,
 	       &info->super_for_commit->super_roots,
 	       sizeof(*root_backup) * BTRFS_NUM_BACKUP_ROOTS);
+	return 0;
 }
 /*
 	 * not from fsync where the tree roots in fs_info have not
 	 * been consistent on disk.
 	 */
-	if (max_mirrors == 0)
+	if (max_mirrors == 0) {
-		backup_super_roots(fs_info);
+		ret = backup_super_roots(fs_info);
+		if (ret < 0)
+			return ret;
+	}
 	sb = fs_info->super_for_commit;
 	dev_item = &sb->dev_item;

fs/btrfs/extent-tree.c+93−5

 	struct btrfs_key key;
 	BTRFS_PATH_AUTO_FREE(path);
+	if (unlikely(!root)) {
+		btrfs_err(fs_info,
+			  "missing extent root for extent at bytenr %llu", start);
+		return -EUCLEAN;
+	}
 	path = btrfs_alloc_path();
 	if (!path)
 		return -ENOMEM;
 	key.offset = offset;
 	extent_root = btrfs_extent_root(fs_info, bytenr);
+	if (unlikely(!extent_root)) {
+		btrfs_err(fs_info,
+			  "missing extent root for extent at bytenr %llu", bytenr);
+		return -EUCLEAN;
+	}
 	ret = btrfs_search_slot(NULL, extent_root, &key, path, 0, 0);
 	if (ret < 0)
 		return ret;
 	int recow;
 	int ret;
+	if (unlikely(!root)) {
+		btrfs_err(trans->fs_info,
+			  "missing extent root for extent at bytenr %llu", bytenr);
+		return -EUCLEAN;
+	}
 	key.objectid = bytenr;
 	if (parent) {
 		key.type = BTRFS_SHARED_DATA_REF_KEY;
 	u32 num_refs;
 	int ret;
+	if (unlikely(!root)) {
+		btrfs_err(trans->fs_info,
+			  "missing extent root for extent at bytenr %llu", bytenr);
+		return -EUCLEAN;
+	}
 	key.objectid = bytenr;
 	if (node->parent) {
 		key.type = BTRFS_SHARED_DATA_REF_KEY;
 	struct btrfs_key key;
 	int ret;
+	if (unlikely(!root)) {
+		btrfs_err(trans->fs_info,
+			  "missing extent root for extent at bytenr %llu", bytenr);
+		return -EUCLEAN;
+	}
 	key.objectid = bytenr;
 	if (parent) {
 		key.type = BTRFS_SHARED_BLOCK_REF_KEY;
 	struct btrfs_key key;
 	int ret;
+	if (unlikely(!root)) {
+		btrfs_err(trans->fs_info,
+			  "missing extent root for extent at bytenr %llu", bytenr);
+		return -EUCLEAN;
+	}
 	key.objectid = bytenr;
 	if (node->parent) {
 		key.type = BTRFS_SHARED_BLOCK_REF_KEY;
 	bool skinny_metadata = btrfs_fs_incompat(fs_info, SKINNY_METADATA);
 	int needed;
+	if (unlikely(!root)) {
+		btrfs_err(fs_info,
+			  "missing extent root for extent at bytenr %llu", bytenr);
+		return -EUCLEAN;
+	}
 	key.objectid = bytenr;
 	key.type = BTRFS_EXTENT_ITEM_KEY;
 	key.offset = num_bytes;
 	}
 	root = btrfs_extent_root(fs_info, key.objectid);
+	if (unlikely(!root)) {
+		btrfs_err(fs_info,
+			  "missing extent root for extent at bytenr %llu",
+			  key.objectid);
+		return -EUCLEAN;
+	}
 again:
 	ret = btrfs_search_slot(trans, root, &key, path, 0, 1);
 	if (ret < 0) {
 			struct btrfs_root *csum_root;
 			csum_root = btrfs_csum_root(fs_info, head->bytenr);
-			ret = btrfs_del_csums(trans, csum_root, head->bytenr,
+			if (unlikely(!csum_root)) {
-					      head->num_bytes);
+				btrfs_err(fs_info,
+					  "missing csum root for extent at bytenr %llu",
+					  head->bytenr);
+				ret = -EUCLEAN;
+			} else {
+				ret = btrfs_del_csums(trans, csum_root, head->bytenr,
+						      head->num_bytes);
+			}
 		}
 	}
 	int type;
 	int ret;
+	if (unlikely(!extent_root)) {
+		btrfs_err(fs_info,
+			  "missing extent root for extent at bytenr %llu", bytenr);
+		return -EUCLEAN;
+	}
 	key.objectid = bytenr;
 	key.type = BTRFS_EXTENT_ITEM_KEY;
 	key.offset = (u64)-1;
 		struct btrfs_root *csum_root;
 		csum_root = btrfs_csum_root(trans->fs_info, bytenr);
+		if (unlikely(!csum_root)) {
+			ret = -EUCLEAN;
+			btrfs_abort_transaction(trans, ret);
+			btrfs_err(trans->fs_info,
+				  "missing csum root for extent at bytenr %llu",
+				  bytenr);
+			return ret;
+		}
 		ret = btrfs_del_csums(trans, csum_root, bytenr, num_bytes);
 		if (unlikely(ret)) {
 			btrfs_abort_transaction(trans, ret);
 	u64 delayed_ref_root = href->owning_root;
 	extent_root = btrfs_extent_root(info, bytenr);
-	ASSERT(extent_root);
+	if (unlikely(!extent_root)) {
+		btrfs_err(info,
+			  "missing extent root for extent at bytenr %llu", bytenr);
+		return -EUCLEAN;
+	}
 	path = btrfs_alloc_path();
 	if (!path)
 		size += btrfs_extent_inline_ref_size(BTRFS_EXTENT_OWNER_REF_KEY);
 	size += btrfs_extent_inline_ref_size(type);
+	extent_root = btrfs_extent_root(fs_info, ins->objectid);
+	if (unlikely(!extent_root)) {
+		btrfs_err(fs_info,
+			  "missing extent root for extent at bytenr %llu",
+			  ins->objectid);
+		return -EUCLEAN;
+	}
 	path = btrfs_alloc_path();
 	if (!path)
 		return -ENOMEM;
-	extent_root = btrfs_extent_root(fs_info, ins->objectid);
 	ret = btrfs_insert_empty_item(trans, extent_root, path, ins, size);
 	if (ret) {
 		btrfs_free_path(path);
 		size += sizeof(*block_info);
 	}
+	extent_root = btrfs_extent_root(fs_info, extent_key.objectid);
+	if (unlikely(!extent_root)) {
+		btrfs_err(fs_info,
+			  "missing extent root for extent at bytenr %llu",
+			  extent_key.objectid);
+		return -EUCLEAN;
+	}
 	path = btrfs_alloc_path();
 	if (!path)
 		return -ENOMEM;
-	extent_root = btrfs_extent_root(fs_info, extent_key.objectid);
 	ret = btrfs_insert_empty_item(trans, extent_root, path, &extent_key,
 				      size);
 	if (ret) {

fs/btrfs/file-item.c+7−0

@@ -308,6 +308,13 @@ static int search_csum_tree(struct btrfs_fs_info *fs_info, · 307 unmodified lines
308	/* Current item doesn't contain the desired range, search again */	308	/* Current item doesn't contain the desired range, search again */
309	btrfs_release_path(path);	309	btrfs_release_path(path);
310	csum_root = btrfs_csum_root(fs_info, disk_bytenr);	310	csum_root = btrfs_csum_root(fs_info, disk_bytenr);
		311	if (unlikely(!csum_root)) {
		312	btrfs_err(fs_info,
		313	"missing csum root for extent at bytenr %llu",
		314	disk_bytenr);
		315	return -EUCLEAN;
		316	}
		317
311	item = btrfs_lookup_csum(NULL, csum_root, path, disk_bytenr, 0);	318	item = btrfs_lookup_csum(NULL, csum_root, path, disk_bytenr, 0);
312	if (IS_ERR(item)) {	319	if (IS_ERR(item)) {
313	ret = PTR_ERR(item);	320	ret = PTR_ERR(item);

fs/btrfs/free-space-tree.c+8−1

 	if (ret)
 		return ret;
+	extent_root = btrfs_extent_root(trans->fs_info, block_group->start);
+	if (unlikely(!extent_root)) {
+		btrfs_err(trans->fs_info,
+			  "missing extent root for block group at offset %llu",
+			  block_group->start);
+		return -EUCLEAN;
+	}
 	mutex_lock(&block_group->free_space_lock);
 	/*
 	key.type = BTRFS_EXTENT_ITEM_KEY;
 	key.offset = 0;
-	extent_root = btrfs_extent_root(trans->fs_info, key.objectid);
 	ret = btrfs_search_slot_for_read(extent_root, &key, path, 1, 0);
 	if (ret < 0)
 		goto out_locked;

fs/btrfs/inode.c+20−5

 	 */
 	csum_root = btrfs_csum_root(root->fs_info, io_start);
+	if (unlikely(!csum_root)) {
+		btrfs_err(root->fs_info,
+			  "missing csum root for extent at bytenr %llu", io_start);
+		ret = -EUCLEAN;
+		goto out;
+	}
 	ret = btrfs_lookup_csums_list(csum_root, io_start,
 				      io_start + args->file_extent.num_bytes - 1,
 				      NULL, nowait);
 	int ret;
 	list_for_each_entry(sum, list, list) {
-		trans->adding_csums = true;
+		if (!csum_root) {
-		if (!csum_root)
 			csum_root = btrfs_csum_root(trans->fs_info,
 						    sum->logical);
+			if (unlikely(!csum_root)) {
+				btrfs_err(trans->fs_info,
+				  "missing csum root for extent at bytenr %llu",
+					  sum->logical);
+				return -EUCLEAN;
+			}
+		}
+		trans->adding_csums = true;
 		ret = btrfs_csum_file_blocks(trans, csum_root, sum);
 		trans->adding_csums = false;
 		if (ret)
 	int compression;
 	size_t orig_count;
 	const u32 min_folio_size = btrfs_min_folio_size(fs_info);
+	const u32 blocksize = fs_info->sectorsize;
 	u64 start, end;
 	u64 num_bytes, ram_bytes, disk_num_bytes;
 	struct btrfs_key ins;
 			ret = -EFAULT;
 			goto out_cb;
 		}
-		if (bytes < min_folio_size)
+		if (!IS_ALIGNED(bytes, blocksize))
-			folio_zero_range(folio, bytes, min_folio_size - bytes);
+			folio_zero_range(folio, bytes, round_up(bytes, blocksize) - bytes);
-		ret = bio_add_folio(&cb->bbio.bio, folio, folio_size(folio), 0);
+		ret = bio_add_folio(&cb->bbio.bio, folio, round_up(bytes, blocksize), 0);
 		if (unlikely(!ret)) {
 			folio_put(folio);
 			ret = -EINVAL;

fs/btrfs/ioctl.c+9−3

 		}
 	}
-	trans = btrfs_join_transaction(root);
+	/* 2 BTRFS_QGROUP_RELATION_KEY items. */
+	trans = btrfs_start_transaction(root, 2);
 	if (IS_ERR(trans)) {
 		ret = PTR_ERR(trans);
 		goto out;
 		goto out;
 	}
-	trans = btrfs_join_transaction(root);
+	/*
+	 * 1 BTRFS_QGROUP_INFO_KEY item.
+	 * 1 BTRFS_QGROUP_LIMIT_KEY item.
+	 */
+	trans = btrfs_start_transaction(root, 2);
 	if (IS_ERR(trans)) {
 		ret = PTR_ERR(trans);
 		goto out;
 		goto drop_write;
 	}
-	trans = btrfs_join_transaction(root);
+	/* 1 BTRFS_QGROUP_LIMIT_KEY item. */
+	trans = btrfs_start_transaction(root, 1);
 	if (IS_ERR(trans)) {
 		ret = PTR_ERR(trans);
 		goto out;

fs/btrfs/lzo.c+2−2

@@ -429,7 +429,7 @@ static void copy_compressed_segment(struct compressed_bio *cb, · 428 unmodified lines
429	int lzo_decompress_bio(struct list_head ws, struct compressed_bio cb)	429	int lzo_decompress_bio(struct list_head ws, struct compressed_bio cb)
430	{	430	{
431	struct workspace *workspace = list_entry(ws, struct workspace, list);	431	struct workspace *workspace = list_entry(ws, struct workspace, list);
432	const struct btrfs_fs_info *fs_info = cb->bbio.inode->root->fs_info;	432	struct btrfs_fs_info *fs_info = cb->bbio.inode->root->fs_info;
433	const u32 sectorsize = fs_info->sectorsize;	433	const u32 sectorsize = fs_info->sectorsize;
434	struct folio_iter fi;	434	struct folio_iter fi;
435	char *kaddr;	435	char *kaddr;
@@ -447,7 +447,7 @@ int lzo_decompress_bio(struct list_head ws, struct compressed_bio cb) · 11 unmodified lines
447	/* There must be a compressed folio and matches the sectorsize. */	447	/* There must be a compressed folio and matches the sectorsize. */
448	if (unlikely(!fi.folio))	448	if (unlikely(!fi.folio))
449	return -EINVAL;	449	return -EINVAL;
450	ASSERT(folio_size(fi.folio) == sectorsize);	450	ASSERT(folio_size(fi.folio) == btrfs_min_folio_size(fs_info));
451	kaddr = kmap_local_folio(fi.folio, 0);	451	kaddr = kmap_local_folio(fi.folio, 0);
452	len_in = read_compress_length(kaddr);	452	len_in = read_compress_length(kaddr);
453	kunmap_local(kaddr);	453	kunmap_local(kaddr);

fs/btrfs/qgroup.c+8−0

@@ -3739,6 +3739,14 @@ static int qgroup_rescan_leaf(struct btrfs_trans_handle *trans, · 3738 unmodified lines
3739	mutex_lock(&fs_info->qgroup_rescan_lock);	3739	mutex_lock(&fs_info->qgroup_rescan_lock);
3740	extent_root = btrfs_extent_root(fs_info,	3740	extent_root = btrfs_extent_root(fs_info,
3741	fs_info->qgroup_rescan_progress.objectid);	3741	fs_info->qgroup_rescan_progress.objectid);
		3742	if (unlikely(!extent_root)) {
		3743	btrfs_err(fs_info,
		3744	"missing extent root for extent at bytenr %llu",
		3745	fs_info->qgroup_rescan_progress.objectid);
		3746	mutex_unlock(&fs_info->qgroup_rescan_lock);
		3747	return -EUCLEAN;
		3748	}
		3749
3742	ret = btrfs_search_slot_for_read(extent_root,	3750	ret = btrfs_search_slot_for_read(extent_root,
3743	&fs_info->qgroup_rescan_progress,	3751	&fs_info->qgroup_rescan_progress,
3744	path, 1, 0);	3752	path, 1, 0);

fs/btrfs/raid56.c+10−2

 static void fill_data_csums(struct btrfs_raid_bio *rbio)
 {
 	struct btrfs_fs_info *fs_info = rbio->bioc->fs_info;
-	struct btrfs_root *csum_root = btrfs_csum_root(fs_info,
+	struct btrfs_root *csum_root;
-						       rbio->bioc->full_stripe_logical);
 	const u64 start = rbio->bioc->full_stripe_logical;
 	const u32 len = (rbio->nr_data * rbio->stripe_nsectors) <<
 			fs_info->sectorsize_bits;
 		goto error;
 	}
+	csum_root = btrfs_csum_root(fs_info, rbio->bioc->full_stripe_logical);
+	if (unlikely(!csum_root)) {
+		btrfs_err(fs_info,
+			  "missing csum root for extent at bytenr %llu",
+			  rbio->bioc->full_stripe_logical);
+		ret = -EUCLEAN;
+		goto error;
+	}
 	ret = btrfs_lookup_csums_bitmap(csum_root, NULL, start, start + len - 1,
 					rbio->csum_buf, rbio->csum_bitmap);
 	if (ret < 0)

fs/btrfs/relocation.c+32−7

 	dest_addr = ins.objectid;
 	dest_length = ins.offset;
+	dest_bg = btrfs_lookup_block_group(fs_info, dest_addr);
 	if (!is_data && !IS_ALIGNED(dest_length, fs_info->nodesize)) {
 		u64 new_length = ALIGN_DOWN(dest_length, fs_info->nodesize);
 	if (unlikely(ret))
 		goto end;
-	dest_bg = btrfs_lookup_block_group(fs_info, dest_addr);
 	adjust_block_group_remap_bytes(trans, dest_bg, dest_length);
 	mutex_lock(&dest_bg->free_space_lock);
 	bg_needs_free_space = test_bit(BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE,
 				       &dest_bg->runtime_flags);
 	mutex_unlock(&dest_bg->free_space_lock);
-	btrfs_put_block_group(dest_bg);
 	if (bg_needs_free_space) {
 		ret = btrfs_add_block_group_free_space(trans, dest_bg);
 			btrfs_end_transaction(trans);
 		}
 	} else {
-		dest_bg = btrfs_lookup_block_group(fs_info, dest_addr);
 		btrfs_free_reserved_bytes(dest_bg, dest_length, 0);
-		btrfs_put_block_group(dest_bg);
 		ret = btrfs_commit_transaction(trans);
 	}
+	btrfs_put_block_group(dest_bg);
 	return ret;
 }
 	struct btrfs_space_info *sinfo = src_bg->space_info;
 	extent_root = btrfs_extent_root(fs_info, src_bg->start);
+	if (unlikely(!extent_root)) {
+		btrfs_err(fs_info,
+			  "missing extent root for block group at offset %llu",
+			  src_bg->start);
+		return -EUCLEAN;
+	}
 	trans = btrfs_start_transaction(extent_root, 0);
 	if (IS_ERR(trans))
 	int ret;
 	bool bg_is_ro = false;
+	if (unlikely(!extent_root)) {
+		btrfs_err(fs_info,
+			  "missing extent root for block group at offset %llu",
+			  group_start);
+		return -EUCLEAN;
+	}
 	/*
 	 * This only gets set if we had a half-deleted snapshot on mount.  We
 	 * cannot allow relocation to start while we're still trying to clean up
 		goto out;
 	}
+	rc->extent_root = btrfs_extent_root(fs_info, 0);
+	if (unlikely(!rc->extent_root)) {
+		btrfs_err(fs_info, "missing extent root for extent at bytenr 0");
+		ret = -EUCLEAN;
+		goto out;
+	}
 	ret = reloc_chunk_start(fs_info);
 	if (ret < 0)
 		goto out_end;
-	rc->extent_root = btrfs_extent_root(fs_info, 0);
 	set_reloc_control(rc);
 	trans = btrfs_join_transaction(rc->extent_root);
 	LIST_HEAD(list);
 	int ret;
+	if (unlikely(!csum_root)) {
+		btrfs_mark_ordered_extent_error(ordered);
+		btrfs_err(fs_info,
+			  "missing csum root for extent at bytenr %llu",
+			  disk_bytenr);
+		return -EUCLEAN;
+	}
 	ret = btrfs_lookup_csums_list(csum_root, disk_bytenr,
 				      disk_bytenr + ordered->num_bytes - 1,
 				      &list, false);

fs/btrfs/tree-checker.c+18−1

@@ -1284,10 +1284,27 @@ static int check_root_item(struct extent_buffer leaf, struct btrfs_key key, · 1283 unmodified lines
1284	}	1284	}
1285	if (unlikely(btrfs_root_drop_level(&ri) >= BTRFS_MAX_LEVEL)) {	1285	if (unlikely(btrfs_root_drop_level(&ri) >= BTRFS_MAX_LEVEL)) {
1286	generic_err(leaf, slot,	1286	generic_err(leaf, slot,
1287	"invalid root level, have %u expect [0, %u]",	1287	"invalid root drop_level, have %u expect [0, %u]",
1288	btrfs_root_drop_level(&ri), BTRFS_MAX_LEVEL - 1);	1288	btrfs_root_drop_level(&ri), BTRFS_MAX_LEVEL - 1);
1289	return -EUCLEAN;	1289	return -EUCLEAN;
1290	}	1290	}
		1291	/*
		1292	* If drop_progress.objectid is non-zero, a btrfs_drop_snapshot() was
		1293	* interrupted and the resume point was recorded in drop_progress and
		1294	* drop_level. In that case drop_level must be >= 1: level 0 is the
		1295	* leaf level and drop_snapshot never saves a checkpoint there (it
		1296	* only records checkpoints at internal node levels in DROP_REFERENCE
		1297	* stage). A zero drop_level combined with a non-zero drop_progress
		1298	* objectid indicates on-disk corruption and would cause a BUG_ON in
		1299	* merge_reloc_root() and btrfs_drop_snapshot() at mount time.
		1300	*/
		1301	if (unlikely(btrfs_disk_key_objectid(&ri.drop_progress) != 0 &&
		1302	btrfs_root_drop_level(&ri) == 0)) {
		1303	generic_err(leaf, slot,
		1304	"invalid root drop_level 0 with non-zero drop_progress objectid %llu",
		1305	btrfs_disk_key_objectid(&ri.drop_progress));
		1306	return -EUCLEAN;
		1307	}
1291		1308
1292	/* Flags check */	1309	/* Flags check */
1293	if (unlikely(btrfs_root_flags(&ri) & ~valid_root_flags)) {	1310	if (unlikely(btrfs_root_flags(&ri) & ~valid_root_flags)) {

fs/btrfs/tree-log.c+27−0

 		sums = list_first_entry(&ordered_sums, struct btrfs_ordered_sum, list);
 		csum_root = btrfs_csum_root(fs_info, sums->logical);
+		if (unlikely(!csum_root)) {
+			btrfs_err(fs_info,
+				  "missing csum root for extent at bytenr %llu",
+				  sums->logical);
+			ret = -EUCLEAN;
+		}
 		if (!ret) {
 			ret = btrfs_del_csums(trans, csum_root, sums->logical,
 					      sums->len);
 		}
 		csum_root = btrfs_csum_root(trans->fs_info, disk_bytenr);
+		if (unlikely(!csum_root)) {
+			btrfs_err(trans->fs_info,
+				  "missing csum root for extent at bytenr %llu",
+				  disk_bytenr);
+			return -EUCLEAN;
+		}
 		disk_bytenr += extent_offset;
 		ret = btrfs_lookup_csums_list(csum_root, disk_bytenr,
 					      disk_bytenr + extent_num_bytes - 1,
 	/* block start is already adjusted for the file extent offset. */
 	block_start = btrfs_extent_map_block_start(em);
 	csum_root = btrfs_csum_root(trans->fs_info, block_start);
+	if (unlikely(!csum_root)) {
+		btrfs_err(trans->fs_info,
+			  "missing csum root for extent at bytenr %llu",
+			  block_start);
+		return -EUCLEAN;
+	}
 	ret = btrfs_lookup_csums_list(csum_root, block_start + csum_offset,
 				      block_start + csum_offset + csum_len - 1,
 				      &ordered_sums, false);
 				  struct btrfs_root *root,
 				  struct btrfs_log_ctx *ctx)
 {
+	const bool orig_log_new_dentries = ctx->log_new_dentries;
 	int ret = 0;
 	/*
 			 * dir index key range logged for the directory. So we
 			 * must make sure the deletion is recorded.
 			 */
+			ctx->log_new_dentries = false;
 			ret = btrfs_log_inode(trans, inode, LOG_INODE_ALL, ctx);
+			if (!ret && ctx->log_new_dentries)
+				ret = log_new_dir_dentries(trans, inode, ctx);
 			btrfs_add_delayed_iput(inode);
 			if (ret)
 				break;
 			break;
 	}
+	ctx->log_new_dentries = orig_log_new_dentries;
 	ctx->logging_conflict_inodes = false;
 	if (ret)
 		free_conflicting_inodes(ctx);

fs/btrfs/volumes.c+18−9

 	/* step one, relocate all the extents inside this chunk */
 	btrfs_scrub_pause(fs_info);
-	ret = btrfs_relocate_block_group(fs_info, chunk_offset, true);
+	ret = btrfs_relocate_block_group(fs_info, chunk_offset, verbose);
 	btrfs_scrub_continue(fs_info);
 	if (ret) {
 		/*
 end:
 	while (!list_empty(chunks)) {
 		bool is_unused;
+		struct btrfs_block_group *bg;
 		rci = list_first_entry(chunks, struct remap_chunk_info, list);
-		spin_lock(&rci->bg->lock);
+		bg = rci->bg;
-		is_unused = !btrfs_is_block_group_used(rci->bg);
+		if (bg) {
-		spin_unlock(&rci->bg->lock);
+			/*
+			 * This is a bit racy and the 'used' status can change
+			 * but this is not a problem as later functions will
+			 * verify it again.
+			 */
+			spin_lock(&bg->lock);
+			is_unused = !btrfs_is_block_group_used(bg);
+			spin_unlock(&bg->lock);
-		if (is_unused)
+			if (is_unused)
-			btrfs_mark_bg_unused(rci->bg);
+				btrfs_mark_bg_unused(bg);
-		if (rci->made_ro)
+			if (rci->made_ro)
-			btrfs_dec_block_group_ro(rci->bg);
+				btrfs_dec_block_group_ro(bg);
-		btrfs_put_block_group(rci->bg);
+			btrfs_put_block_group(bg);
+		}
 		list_del(&rci->list);
 		kfree(rci);

fs/btrfs/zoned.c+11−2

 	if (!btrfs_fs_incompat(fs_info, ZONED))
 		return 0;
-	mutex_lock(&fs_devices->device_list_mutex);
+	/*
+	 * No need to take the device_list mutex here, we're still in the mount
+	 * path and devices cannot be added to or removed from the list yet.
+	 */
 	list_for_each_entry(device, &fs_devices->devices, dev_list) {
 		/* We can skip reading of zone info for missing devices */
 		if (!device->bdev)
 		if (ret)
 			break;
 	}
-	mutex_unlock(&fs_devices->device_list_mutex);
 	return ret;
 }
 	key.offset = 0;
 	root = btrfs_extent_root(fs_info, key.objectid);
+	if (unlikely(!root)) {
+		btrfs_err(fs_info,
+			  "missing extent root for extent at bytenr %llu",
+			  key.objectid);
+		return -EUCLEAN;
+	}
 	ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
 	/* We should not find the exact match */
 	if (unlikely(!ret))

fs/btrfs/zstd.c+1−1

@@ -600,7 +600,7 @@ int zstd_decompress_bio(struct list_head ws, struct compressed_bio cb) · 599 unmodified lines
600	bio_first_folio(&fi, &cb->bbio.bio, 0);	600	bio_first_folio(&fi, &cb->bbio.bio, 0);
601	if (unlikely(!fi.folio))	601	if (unlikely(!fi.folio))
602	return -EINVAL;	602	return -EINVAL;
603	ASSERT(folio_size(fi.folio) == blocksize);	603	ASSERT(folio_size(fi.folio) == min_folio_size);
604		604
605	stream = zstd_init_dstream(	605	stream = zstd_init_dstream(
606	ZSTD_BTRFS_MAX_INPUT, workspace->mem, workspace->size);	606	ZSTD_BTRFS_MAX_INPUT, workspace->mem, workspace->size);

fs/nfsd/export.c+54−9

  * second map contains a reference to the entry in the first map.
  */
+static struct workqueue_struct *nfsd_export_wq;
 #define	EXPKEY_HASHBITS		8
 #define	EXPKEY_HASHMAX		(1 << EXPKEY_HASHBITS)
 #define	EXPKEY_HASHMASK		(EXPKEY_HASHMAX -1)
-static void expkey_put(struct kref *ref)
+static void expkey_release(struct work_struct *work)
 {
-	struct svc_expkey *key = container_of(ref, struct svc_expkey, h.ref);
+	struct svc_expkey *key = container_of(to_rcu_work(work),
+					      struct svc_expkey, ek_rwork);
 	if (test_bit(CACHE_VALID, &key->h.flags) &&
 	    !test_bit(CACHE_NEGATIVE, &key->h.flags))
 		path_put(&key->ek_path);
 	auth_domain_put(key->ek_client);
-	kfree_rcu(key, ek_rcu);
+	kfree(key);
+}
+static void expkey_put(struct kref *ref)
+{
+	struct svc_expkey *key = container_of(ref, struct svc_expkey, h.ref);
+	INIT_RCU_WORK(&key->ek_rwork, expkey_release);
+	queue_rcu_work(nfsd_export_wq, &key->ek_rwork);
 }
 static int expkey_upcall(struct cache_detail *cd, struct cache_head *h)
 					    EXP_STATS_COUNTERS_NUM);
 }
-static void svc_export_release(struct rcu_head *rcu_head)
+static void svc_export_release(struct work_struct *work)
 {
-	struct svc_export *exp = container_of(rcu_head, struct svc_export,
+	struct svc_export *exp = container_of(to_rcu_work(work),
-			ex_rcu);
+					      struct svc_export, ex_rwork);
+	path_put(&exp->ex_path);
+	auth_domain_put(exp->ex_client);
 	nfsd4_fslocs_free(&exp->ex_fslocs);
 	export_stats_destroy(exp->ex_stats);
 	kfree(exp->ex_stats);
 {
 	struct svc_export *exp = container_of(ref, struct svc_export, h.ref);
-	path_put(&exp->ex_path);
+	INIT_RCU_WORK(&exp->ex_rwork, svc_export_release);
-	auth_domain_put(exp->ex_client);
+	queue_rcu_work(nfsd_export_wq, &exp->ex_rwork);
-	call_rcu(&exp->ex_rcu, svc_export_release);
 }
 static int svc_export_upcall(struct cache_detail *cd, struct cache_head *h)
 	.show	= e_show,
 };
+/**
+ * nfsd_export_wq_init - allocate the export release workqueue
+ *
+ * Called once at module load. The workqueue runs deferred svc_export and
+ * svc_expkey release work scheduled by queue_rcu_work() in the cache put
+ * callbacks.
+ *
+ * Return values:
+ *   %0: workqueue allocated
+ *   %-ENOMEM: allocation failed
+ */
+int nfsd_export_wq_init(void)
+{
+	nfsd_export_wq = alloc_workqueue("nfsd_export", WQ_UNBOUND, 0);
+	if (!nfsd_export_wq)
+		return -ENOMEM;
+	return 0;
+}
+/**
+ * nfsd_export_wq_shutdown - drain and free the export release workqueue
+ *
+ * Called once at module unload. Per-namespace teardown in
+ * nfsd_export_shutdown() has already drained all deferred work.
+ */
+void nfsd_export_wq_shutdown(void)
+{
+	destroy_workqueue(nfsd_export_wq);
+}
 /*
  * Initialize the exports module.
  */
 	cache_unregister_net(nn->svc_expkey_cache, net);
 	cache_unregister_net(nn->svc_export_cache, net);
+	/* Drain deferred export and expkey release work. */
+	rcu_barrier();
+	flush_workqueue(nfsd_export_wq);
 	cache_destroy_net(nn->svc_expkey_cache, net);
 	cache_destroy_net(nn->svc_export_cache, net);
 	svcauth_unix_purge(net);

fs/nfsd/export.h+5−2

 #include <linux/sunrpc/cache.h>
 #include <linux/percpu_counter.h>
+#include <linux/workqueue.h>
 #include <uapi/linux/nfsd/export.h>
 #include <linux/nfs4.h>
 	u32			ex_layout_types;
 	struct nfsd4_deviceid_map *ex_devid_map;
 	struct cache_detail	*cd;
-	struct rcu_head		ex_rcu;
+	struct rcu_work		ex_rwork;
 	unsigned long		ex_xprtsec_modes;
 	struct export_stats	*ex_stats;
 };
 	u32			ek_fsid[6];
 	struct path		ek_path;
-	struct rcu_head		ek_rcu;
+	struct rcu_work		ek_rwork;
 };
 #define EX_ISSYNC(exp)		(!((exp)->ex_flags & NFSEXP_ASYNC))
 /*
  * Function declarations
  */
+int			nfsd_export_wq_init(void);
+void			nfsd_export_wq_shutdown(void);
 int			nfsd_export_init(struct net *);
 void			nfsd_export_shutdown(struct net *);
 void			nfsd_export_flush(struct net *);

fs/nfsd/nfs4xdr.c+7−2

 		int len = xdr->buf->len - (op_status_offset + XDR_UNIT);
 		so->so_replay.rp_status = op->status;
-		so->so_replay.rp_buflen = len;
+		if (len <= NFSD4_REPLAY_ISIZE) {
-		read_bytes_from_xdr_buf(xdr->buf, op_status_offset + XDR_UNIT,
+			so->so_replay.rp_buflen = len;
+			read_bytes_from_xdr_buf(xdr->buf,
+						op_status_offset + XDR_UNIT,
 						so->so_replay.rp_buf, len);
+		} else {
+			so->so_replay.rp_buflen = 0;
+		}
 	}
 status:
 	op->status = nfsd4_map_status(op->status,

fs/nfsd/nfsctl.c+19−3

 	seq = file->private_data;
 	seq->private = nn->svc_export_cache;
+	get_net(net);
 	return 0;
 }
+static int exports_release(struct inode *inode, struct file *file)
+{
+	struct seq_file *seq = file->private_data;
+	struct cache_detail *cd = seq->private;
+	put_net(cd->net);
+	return seq_release(inode, file);
+}
 static int exports_nfsd_open(struct inode *inode, struct file *file)
 {
 	return exports_net_open(inode->i_sb->s_fs_info, file);
 	.open		= exports_nfsd_open,
 	.read		= seq_read,
 	.llseek		= seq_lseek,
-	.release	= seq_release,
+	.release	= exports_release,
 };
 static int export_features_show(struct seq_file *m, void *v)
 	.proc_open	= exports_proc_open,
 	.proc_read	= seq_read,
 	.proc_lseek	= seq_lseek,
-	.proc_release	= seq_release,
+	.proc_release	= exports_release,
 };
 static int create_proc_exports_entry(void)
 	if (retval)
 		goto out_free_pnfs;
 	nfsd_lockd_init();	/* lockd->nfsd callbacks */
+	retval = nfsd_export_wq_init();
+	if (retval)
+		goto out_free_lockd;
 	retval = register_pernet_subsys(&nfsd_net_ops);
 	if (retval < 0)
-		goto out_free_lockd;
+		goto out_free_export_wq;
 	retval = register_cld_notifier();
 	if (retval)
 		goto out_free_subsys;
 	unregister_cld_notifier();
 out_free_subsys:
 	unregister_pernet_subsys(&nfsd_net_ops);
+out_free_export_wq:
+	nfsd_export_wq_shutdown();
 out_free_lockd:
 	nfsd_lockd_shutdown();
 	nfsd_drc_slab_free();
 	nfsd4_destroy_laundry_wq();
 	unregister_cld_notifier();
 	unregister_pernet_subsys(&nfsd_net_ops);
+	nfsd_export_wq_shutdown();
 	nfsd_drc_slab_free();
 	nfsd_lockd_shutdown();
 	nfsd4_free_slabs();

fs/nfsd/state.h+12−5

 	struct xdr_netobj	cr_princhash;
 };
-/* A reasonable value for REPLAY_ISIZE was estimated as follows:
+/*
- * The OPEN response, typically the largest, requires
+ * REPLAY_ISIZE is sized for an OPEN response with delegation:
- *   4(status) + 8(stateid) + 20(changeinfo) + 4(rflags) +  8(verifier) +
+ *   4(status) + 8(stateid) + 20(changeinfo) + 4(rflags) +
- *   4(deleg. type) + 8(deleg. stateid) + 4(deleg. recall flag) +
+ *   8(verifier) + 4(deleg. type) + 8(deleg. stateid) +
- *   20(deleg. space limit) + ~32(deleg. ace) = 112 bytes
+ *   4(deleg. recall flag) + 20(deleg. space limit) +
+ *   ~32(deleg. ace) = 112 bytes
+ *
+ * Some responses can exceed this. A LOCK denial includes the conflicting
+ * lock owner, which can be up to 1024 bytes (NFS4_OPAQUE_LIMIT). Responses
+ * larger than REPLAY_ISIZE are not cached in rp_ibuf; only rp_status is
+ * saved. Enlarging this constant increases the size of every
+ * nfs4_stateowner.
  */
 #define NFSD4_REPLAY_ISIZE       112

fs/smb/client/cifsglob.h+6−0

@@ -2386,4 +2386,10 @@ static inline int cifs_open_create_options(unsigned int oflags, int opts) · 2385 unmodified lines
2386	return opts;	2386	return opts;
2387	}	2387	}
2388		2388
		2389	/*
		2390	* The number of blocks is not related to (i_size / i_blksize), but instead
		2391	* 512 byte (2**9) size is required for calculating num blocks.
		2392	*/
		2393	#define CIFS_INO_BLOCKS(size) DIV_ROUND_UP_ULL((u64)(size), 512)
		2394
2389	#endif /* _CIFS_GLOB_H */	2395	#endif /* _CIFS_GLOB_H */

fs/smb/client/connect.c+4−0

 	case Kerberos:
 		if (!uid_eq(ctx->cred_uid, ses->cred_uid))
 			return 0;
+		if (strncmp(ses->user_name ?: "",
+			    ctx->username ?: "",
+			    CIFS_MAX_USERNAME_LEN))
+			return 0;
 		break;
 	case NTLMv2:
 	case RawNTLMSSP:

fs/smb/client/file.c+0−1

@@ -993,7 +993,6 @@ static int cifs_do_truncate(const unsigned int xid, struct dentry *dentry) · 992 unmodified lines
993	if (!rc) {	993	if (!rc) {
994	netfs_resize_file(&cinode->netfs, 0, true);	994	netfs_resize_file(&cinode->netfs, 0, true);
995	cifs_setsize(inode, 0);	995	cifs_setsize(inode, 0);
996	inode->i_blocks = 0;
997	}	996	}
998	}	997	}
999	if (cfile)	998	if (cfile)

fs/smb/client/inode.c+6−15

@@ -219,13 +219,7 @@ cifs_fattr_to_inode(struct inode inode, struct cifs_fattr fattr, · 218 unmodified lines
219	*/	219	*/
220	if (is_size_safe_to_change(cifs_i, fattr->cf_eof, from_readdir)) {	220	if (is_size_safe_to_change(cifs_i, fattr->cf_eof, from_readdir)) {
221	i_size_write(inode, fattr->cf_eof);	221	i_size_write(inode, fattr->cf_eof);
222		222	inode->i_blocks = CIFS_INO_BLOCKS(fattr->cf_bytes);
223	/*
224	* i_blocks is not related to (i_size / i_blksize),
225	* but instead 512 byte (2**9) size is required for
226	* calculating num blocks.
227	*/
228	inode->i_blocks = (512 - 1 + fattr->cf_bytes) >> 9;
229	}	223	}
230		224
231	if (S_ISLNK(fattr->cf_mode) && fattr->cf_symlink_target) {	225	if (S_ISLNK(fattr->cf_mode) && fattr->cf_symlink_target) {
@@ -3015,6 +3009,11 @@ void cifs_setsize(struct inode *inode, loff_t offset) · 2783 unmodified lines
3015	{	3009	{
3016	spin_lock(&inode->i_lock);	3010	spin_lock(&inode->i_lock);
3017	i_size_write(inode, offset);	3011	i_size_write(inode, offset);
		3012	/*
		3013	* Until we can query the server for actual allocation size,
		3014	* this is best estimate we have for blocks allocated for a file.
		3015	*/
		3016	inode->i_blocks = CIFS_INO_BLOCKS(offset);
3018	spin_unlock(&inode->i_lock);	3017	spin_unlock(&inode->i_lock);
3019	inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));	3018	inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
3020	truncate_pagecache(inode, offset);	3019	truncate_pagecache(inode, offset);
@@ -3087,14 +3086,6 @@ set_size_out: · 66 unmodified lines
3087	if (rc == 0) {	3086	if (rc == 0) {
3088	netfs_resize_file(&cifsInode->netfs, size, true);	3087	netfs_resize_file(&cifsInode->netfs, size, true);
3089	cifs_setsize(inode, size);	3088	cifs_setsize(inode, size);
3090	/*
3091	* i_blocks is not related to (i_size / i_blksize), but instead
3092	* 512 byte (2**9) size is required for calculating num blocks.
3093	* Until we can query the server for actual allocation size,
3094	* this is best estimate we have for blocks allocated for a file
3095	* Number of blocks must be rounded up so size 1 is not 0 blocks
3096	*/
3097	inode->i_blocks = (512 - 1 + size) >> 9;
3098	}	3089	}
3099		3090
3100	return rc;	3091	return rc;

fs/smb/client/smb1transport.c+1−1

@@ -460,7 +460,7 @@ check_smb_hdr(struct smb_hdr *smb) · 459 unmodified lines
460	return 0;	460	return 0;
461		461
462	/*	462	/*
463	* Windows NT server returns error resposne (e.g. STATUS_DELETE_PENDING	463	* Windows NT server returns error response (e.g. STATUS_DELETE_PENDING
464	* or STATUS_OBJECT_NAME_NOT_FOUND or ERRDOS/ERRbadfile or any other)	464	* or STATUS_OBJECT_NAME_NOT_FOUND or ERRDOS/ERRbadfile or any other)
465	* for some TRANS2 requests without the RESPONSE flag set in header.	465	* for some TRANS2 requests without the RESPONSE flag set in header.
466	*/	466	*/

fs/smb/client/smb2ops.c+4−16

 {
 	struct smb2_file_network_open_info file_inf;
 	struct inode *inode;
+	u64 asize;
 	int rc;
 	rc = __SMB2_close(xid, tcon, cfile->fid.persistent_fid,
 		inode_set_atime_to_ts(inode,
 				      cifs_NTtimeToUnix(file_inf.LastAccessTime));
-	/*
+	asize = le64_to_cpu(file_inf.AllocationSize);
-	 * i_blocks is not related to (i_size / i_blksize),
+	if (asize > 4096)
-	 * but instead 512 byte (2**9) size is required for
+		inode->i_blocks = CIFS_INO_BLOCKS(asize);
-	 * calculating num blocks.
-	 */
-	if (le64_to_cpu(file_inf.AllocationSize) > 4096)
-		inode->i_blocks =
-			(512 - 1 + le64_to_cpu(file_inf.AllocationSize)) >> 9;
 	/* End of file and Attributes should not have to be updated on close */
 	spin_unlock(&inode->i_lock);
 		rc = smb2_set_file_size(xid, tcon, trgtfile, dest_off + len, false);
 		if (rc)
 			goto duplicate_extents_out;
-		/*
-		 * Although also could set plausible allocation size (i_blocks)
-		 * here in addition to setting the file size, in reflink
-		 * it is likely that the target file is sparse. Its allocation
-		 * size will be queried on next revalidate, but it is important
-		 * to make sure that file's cached size is updated immediately
-		 */
 		netfs_resize_file(netfs_inode(inode), dest_off + len, true);
 		cifs_setsize(inode, dest_off + len);
 	}

fs/smb/server/mgmt/tree_connect.c+6−3

 void ksmbd_tree_connect_put(struct ksmbd_tree_connect *tcon)
 {
-	if (atomic_dec_and_test(&tcon->refcount))
+	if (atomic_dec_and_test(&tcon->refcount)) {
+		ksmbd_share_config_put(tcon->share_conf);
 		kfree(tcon);
+	}
 }
 static int __ksmbd_tree_conn_disconnect(struct ksmbd_session *sess,
 	ret = ksmbd_ipc_tree_disconnect_request(sess->id, tree_conn->id);
 	ksmbd_release_tree_conn_id(sess, tree_conn->id);
-	ksmbd_share_config_put(tree_conn->share_conf);
 	ksmbd_counter_dec(KSMBD_COUNTER_TREE_CONNS);
-	if (atomic_dec_and_test(&tree_conn->refcount))
+	if (atomic_dec_and_test(&tree_conn->refcount)) {
+		ksmbd_share_config_put(tree_conn->share_conf);
 		kfree(tree_conn);
+	}
 	return ret;
 }

fs/smb/server/smb2pdu.c+12−5

 			pr_err("The first operation in the compound does not have tcon\n");
 			return -EINVAL;
 		}
+		if (work->tcon->t_state != TREE_CONNECTED)
+			return -ENOENT;
 		if (tree_id != UINT_MAX && work->tcon->id != tree_id) {
 			pr_err("tree id(%u) is different with id(%u) in first operation\n",
 					tree_id, work->tcon->id);
 			}
 		}
 		smb2_set_err_rsp(work);
+		conn->binding = false;
 	} else {
 		unsigned int iov_len;
 						goto out;
 					}
-					dh_info->fp->conn = conn;
+					if (dh_info->fp->conn) {
+						ksmbd_put_durable_fd(dh_info->fp);
+						err = -EBADF;
+						goto out;
+					}
 					dh_info->reconnected = true;
 					goto out;
 				}
 				    struct smb2_query_info_req *req,
 				    struct smb2_query_info_rsp *rsp)
 {
-	struct ksmbd_session *sess = work->sess;
 	struct ksmbd_conn *conn = work->conn;
 	struct ksmbd_share_config *share = work->tcon->share_conf;
 	int fsinfoclass = 0;
 		info = (struct object_id_info *)(rsp->Buffer);
-		if (!user_guest(sess->user))
+		if (path.mnt->mnt_sb->s_uuid_len == 16)
-			memcpy(info->objid, user_passkey(sess->user), 16);
+			memcpy(info->objid, path.mnt->mnt_sb->s_uuid.b,
+					path.mnt->mnt_sb->s_uuid_len);
 		else
-			memset(info->objid, 0, 16);
+			memcpy(info->objid, &stfs.f_fsid, sizeof(stfs.f_fsid));
 		info->extended_info.magic = cpu_to_le32(EXTENDED_INFO_MAGIC);
 		info->extended_info.version = cpu_to_le32(1);

fs/tests/exec_kunit.c+0−3

 	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 * 3 + sizeof(void *)),
 	    .argc = 0, .envc = 0 },
 	  .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
-	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * (_STK_LIM / 4 *  + sizeof(void *)),
-	    .argc = 0, .envc = 0 },
-	  .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },
 	{ { .p = ULONG_MAX, .rlim_stack.rlim_cur = 4 * _STK_LIM,
 	    .argc = 0, .envc = 0 },
 	  .expected_argmin = ULONG_MAX - (_STK_LIM / 4 * 3) + sizeof(void *) },

include/hyperv/hvgdk_mini.h+2−1

 #define HVCALL_NOTIFY_PARTITION_EVENT                   0x0087
 #define HVCALL_ENTER_SLEEP_STATE			0x0084
 #define HVCALL_NOTIFY_PORT_RING_EMPTY			0x008b
-#define HVCALL_SCRUB_PARTITION				0x008d
 #define HVCALL_REGISTER_INTERCEPT_RESULT		0x0091
 #define HVCALL_ASSERT_VIRTUAL_INTERRUPT			0x0094
 #define HVCALL_CREATE_PORT				0x0095
 	HV_X64_REGISTER_MSR_MTRR_FIX4KF8000	= 0x0008007A,
 	HV_X64_REGISTER_REG_PAGE	= 0x0009001C,
+#elif defined(CONFIG_ARM64)
+	HV_ARM64_REGISTER_SINT_RESERVED_INTERRUPT_ID	= 0x00070001,
 #endif
 };

include/linux/auxvec.h+1−1

@@ -4,6 +4,6 @@ · 3 unmodified lines
4		4
5	#include <uapi/linux/auxvec.h>	5	#include <uapi/linux/auxvec.h>
6		6
7	#define AT_VECTOR_SIZE_BASE 22 /* NEW_AUX_ENT entries in auxiliary table */	7	#define AT_VECTOR_SIZE_BASE 24 /* NEW_AUX_ENT entries in auxiliary table */
8	/* number of "#define AT_." above, minus {AT_NULL, AT_IGNORE, AT_NOTELF} /	8	/* number of "#define AT_." above, minus {AT_NULL, AT_IGNORE, AT_NOTELF} /
9	#endif /* _LINUX_AUXVEC_H */	9	#endif /* _LINUX_AUXVEC_H */

include/linux/build_bug.h+3−1

 /**
  * BUILD_BUG_ON_MSG - break compile if a condition is true & emit supplied
  *		      error message.
- * @condition: the condition which the compiler should know is false.
+ * @cond: the condition which the compiler should know is false.
+ * @msg: build-time error message
  *
  * See BUILD_BUG_ON for description.
  */
 /**
  * static_assert - check integer constant expression at build time
+ * @expr: expression to be checked
  *
  * static_assert() is a wrapper for the C11 _Static_assert, with a
  * little macro magic to make the message optional (defaulting to the

include/linux/console_struct.h+1−0

@@ -160,6 +160,7 @@ struct vc_data { · 159 unmodified lines
160	struct uni_pagedict *uni_pagedict_loc; / [!] Location of uni_pagedict variable for this console */	160	struct uni_pagedict *uni_pagedict_loc; / [!] Location of uni_pagedict variable for this console */
161	u32 *vc_uni_lines; / unicode screen content */	161	u32 *vc_uni_lines; / unicode screen content */
162	u16 *vc_saved_screen;	162	u16 *vc_saved_screen;
		163	u32 **vc_saved_uni_lines;
163	unsigned int vc_saved_cols;	164	unsigned int vc_saved_cols;
164	unsigned int vc_saved_rows;	165	unsigned int vc_saved_rows;
165	/* additional information is in vt_kern.h */	166	/* additional information is in vt_kern.h */

include/linux/device.h+54−0

@@ -483,6 +483,8 @@ struct device_physical_location { · 482 unmodified lines
483	* on. This shrinks the "Board Support Packages" (BSPs) and	483	* on. This shrinks the "Board Support Packages" (BSPs) and
484	* minimizes board-specific #ifdefs in drivers.	484	* minimizes board-specific #ifdefs in drivers.
485	* @driver_data: Private pointer for driver specific info.	485	* @driver_data: Private pointer for driver specific info.
		486	* @driver_override: Driver name to force a match. Do not touch directly; use
		487	* device_set_driver_override() instead.
486	* @links: Links to suppliers and consumers of this device.	488	* @links: Links to suppliers and consumers of this device.
487	* @power: For device power management.	489	* @power: For device power management.
488	* See Documentation/driver-api/pm/devices.rst for details.	490	* See Documentation/driver-api/pm/devices.rst for details.
@@ -576,6 +578,10 @@ struct device { · 87 unmodified lines
576	core doesn't touch it */	578	core doesn't touch it */
577	void driver_data; / Driver data, set and get with	579	void driver_data; / Driver data, set and get with
578	dev_set_drvdata/dev_get_drvdata */	580	dev_set_drvdata/dev_get_drvdata */
		581	struct {
		582	const char *name;
		583	spinlock_t lock;
		584	} driver_override;
579	struct mutex mutex; /* mutex to synchronize calls to	585	struct mutex mutex; /* mutex to synchronize calls to
580	* its driver.	586	* its driver.
581	*/	587	*/
@@ -701,6 +707,54 @@ struct device_link { · 119 unmodified lines
701		707
702	#define kobj_to_dev(__kobj) container_of_const(__kobj, struct device, kobj)	708	#define kobj_to_dev(__kobj) container_of_const(__kobj, struct device, kobj)
703		709
		710	int __device_set_driver_override(struct device dev, const char s, size_t len);
		711
		712	/**
		713	* device_set_driver_override() - Helper to set or clear driver override.
		714	* @dev: Device to change
		715	* @s: NUL-terminated string, new driver name to force a match, pass empty
		716	* string to clear it ("" or "\n", where the latter is only for sysfs
		717	* interface).
		718	*
		719	* Helper to set or clear driver override of a device.
		720	*
		721	* Returns: 0 on success or a negative error code on failure.
		722	*/
		723	static inline int device_set_driver_override(struct device dev, const char s)
		724	{
		725	return __device_set_driver_override(dev, s, s ? strlen(s) : 0);
		726	}
		727
		728	/**
		729	* device_has_driver_override() - Check if a driver override has been set.
		730	* @dev: device to check
		731	*
		732	* Returns true if a driver override has been set for this device.
		733	*/
		734	static inline bool device_has_driver_override(struct device *dev)
		735	{
		736	guard(spinlock)(&dev->driver_override.lock);
		737	return !!dev->driver_override.name;
		738	}
		739
		740	/**
		741	* device_match_driver_override() - Match a driver against the device's driver_override.
		742	* @dev: device to check
		743	* @drv: driver to match against
		744	*
		745	* Returns > 0 if a driver override is set and matches the given driver, 0 if a
		746	* driver override is set but does not match, or < 0 if a driver override is not
		747	* set at all.
		748	*/
		749	static inline int device_match_driver_override(struct device *dev,
		750	const struct device_driver *drv)
		751	{
		752	guard(spinlock)(&dev->driver_override.lock);
		753	if (dev->driver_override.name)
		754	return !strcmp(dev->driver_override.name, drv->name);
		755	return -1;
		756	}
		757
704	/**	758	/**
705	* device_iommu_mapped - Returns true when the device DMA is translated	759	* device_iommu_mapped - Returns true when the device DMA is translated
706	* by an IOMMU	760	* by an IOMMU

include/linux/device/bus.h+4−0

  *			this bus.
  * @pm:		Power management operations of this bus, callback the specific
  *		device driver's pm-ops.
+ * @driver_override:	Set to true if this bus supports the driver_override
+ *			mechanism, which allows userspace to force a specific
+ *			driver to bind to a device via a sysfs attribute.
  * @need_parent_lock:	When probing or removing a device on this bus, the
  *			device core should lock the device's parent.
  *
 	const struct dev_pm_ops *pm;
+	bool driver_override;
 	bool need_parent_lock;
 };

include/linux/etherdevice.h+2−1

@@ -42,7 +42,8 @@ extern const struct header_ops eth_header_ops; · 41 unmodified lines
42		42
43	int eth_header(struct sk_buff skb, struct net_device dev, unsigned short type,	43	int eth_header(struct sk_buff skb, struct net_device dev, unsigned short type,
44	const void daddr, const void saddr, unsigned len);	44	const void daddr, const void saddr, unsigned len);
45	int eth_header_parse(const struct sk_buff skb, unsigned char haddr);	45	int eth_header_parse(const struct sk_buff skb, const struct net_device dev,
		46	unsigned char *haddr);
46	int eth_header_cache(const struct neighbour neigh, struct hh_cache hh,	47	int eth_header_cache(const struct neighbour neigh, struct hh_cache hh,
47	__be16 type);	48	__be16 type);
48	void eth_header_cache_update(struct hh_cache hh, const struct net_device dev,	49	void eth_header_cache_update(struct hh_cache hh, const struct net_device dev,

include/linux/hid.h+1−0

@@ -682,6 +682,7 @@ struct hid_device { · 681 unmodified lines
682	__s32 battery_charge_status;	682	__s32 battery_charge_status;
683	enum hid_battery_status battery_status;	683	enum hid_battery_status battery_status;
684	bool battery_avoid_query;	684	bool battery_avoid_query;
		685	bool battery_present;
685	ktime_t battery_ratelimit_time;	686	ktime_t battery_ratelimit_time;
686	#endif	687	#endif
687		688

include/linux/if_ether.h+2−1

@@ -40,7 +40,8 @@ static inline struct ethhdr inner_eth_hdr(const struct sk_buff skb) · 39 unmodified lines
40	return (struct ethhdr *)skb_inner_mac_header(skb);	40	return (struct ethhdr *)skb_inner_mac_header(skb);
41	}	41	}
42		42
43	int eth_header_parse(const struct sk_buff skb, unsigned char haddr);	43	int eth_header_parse(const struct sk_buff skb, const struct net_device dev,
		44	unsigned char *haddr);
44		45
45	extern ssize_t sysfs_format_mac(char buf, const unsigned char addr, int len);	46	extern ssize_t sysfs_format_mac(char buf, const unsigned char addr, int len);
46		47

include/linux/io-pgtable.h+8−2

  *                 tables.
  * @ias:           Input address (iova) size, in bits.
  * @oas:           Output address (paddr) size, in bits.
- * @coherent_walk  A flag to indicate whether or not page table walks made
+ * @coherent_walk: A flag to indicate whether or not page table walks made
  *                 by the IOMMU are coherent with the CPU caches.
  * @tlb:           TLB management callbacks for this set of tables.
  * @iommu_dev:     The device representing the DMA configuration for the
 	void (*free)(void *cookie, void *pages, size_t size);
 	/* Low-level data specific to the table format */
+	/* private: */
 	union {
 		struct {
 			u64	ttbr;
  * @unmap_pages:  Unmap a range of virtually contiguous pages of the same size.
  * @iova_to_phys: Translate iova to physical address.
  * @pgtable_walk: (optional) Perform a page table walk for a given iova.
+ * @read_and_clear_dirty: Record dirty info per IOVA. If an IOVA is dirty,
+ *			  clear its dirty state from the PTE unless the
+ *			  IOMMU_DIRTY_NO_CLEAR flag is passed in.
  *
  * These functions map directly onto the iommu_ops member functions with
  * the same names.
  *          the configuration actually provided by the allocator (e.g. the
  *          pgsize_bitmap may be restricted).
  * @cookie: An opaque token provided by the IOMMU driver and passed back to
- *          the callback routines in cfg->tlb.
+ *          the callback routines.
+ *
+ * Returns: Pointer to the &struct io_pgtable_ops for this set of page tables.
  */
 struct io_pgtable_ops *alloc_io_pgtable_ops(enum io_pgtable_fmt fmt,
 					    struct io_pgtable_cfg *cfg,

include/linux/io_uring_types.h+3−0

 	REQ_F_BL_NO_RECYCLE_BIT,
 	REQ_F_BUFFERS_COMMIT_BIT,
 	REQ_F_BUF_NODE_BIT,
+	REQ_F_BUF_MORE_BIT,
 	REQ_F_HAS_METADATA_BIT,
 	REQ_F_IMPORT_BUFFER_BIT,
 	REQ_F_SQE_COPIED_BIT,
 	REQ_F_BUFFERS_COMMIT	= IO_REQ_FLAG(REQ_F_BUFFERS_COMMIT_BIT),
 	/* buf node is valid */
 	REQ_F_BUF_NODE		= IO_REQ_FLAG(REQ_F_BUF_NODE_BIT),
+	/* incremental buffer consumption, more space available */
+	REQ_F_BUF_MORE		= IO_REQ_FLAG(REQ_F_BUF_MORE_BIT),
 	/* request has read/write metadata assigned */
 	REQ_F_HAS_METADATA	= IO_REQ_FLAG(REQ_F_HAS_METADATA_BIT),
 	/*

include/linux/local_lock_internal.h+1−1

@@ -315,7 +315,7 @@ do { \ · 314 unmodified lines
315		315
316	#endif /* CONFIG_PREEMPT_RT */	316	#endif /* CONFIG_PREEMPT_RT */
317		317
318	#if defined(WARN_CONTEXT_ANALYSIS)	318	#if defined(WARN_CONTEXT_ANALYSIS) && !defined(__CHECKER__)
319	/*	319	/*
320	* Because the compiler only knows about the base per-CPU variable, use this	320	* Because the compiler only knows about the base per-CPU variable, use this
321	* helper function to make the compiler think we lock/unlock the @base variable,	321	* helper function to make the compiler think we lock/unlock the @base variable,

include/linux/netdevice.h+5−4

 	int	(*create) (struct sk_buff *skb, struct net_device *dev,
 			   unsigned short type, const void *daddr,
 			   const void *saddr, unsigned int len);
-	int	(*parse)(const struct sk_buff *skb, unsigned char *haddr);
+	int	(*parse)(const struct sk_buff *skb,
+			 const struct net_device *dev,
+			 unsigned char *haddr);
 	int	(*cache)(const struct neighbour *neigh, struct hh_cache *hh, __be16 type);
 	void	(*cache_update)(struct hh_cache *hh,
 				const struct net_device *dev,
 	unsigned long		state;
 	unsigned int		flags;
 	unsigned short		hard_header_len;
+	enum netdev_stat_type	pcpu_stat_type:8;
 	netdev_features_t	features;
 	struct inet6_dev __rcu	*ip6_ptr;
 	__cacheline_group_end(net_device_read_txrx);
 	void				*ml_priv;
 	enum netdev_ml_priv_type	ml_priv_type;
-	enum netdev_stat_type		pcpu_stat_type:8;
 #if IS_ENABLED(CONFIG_GARP)
 	struct garp_port __rcu	*garp_port;
 #endif
 	if (!dev->header_ops || !dev->header_ops->parse)
 		return 0;
-	return dev->header_ops->parse(skb, haddr);
+	return dev->header_ops->parse(skb, dev, haddr);
 }
 static inline __be16 dev_parse_header_protocol(const struct sk_buff *skb)

include/linux/platform_device.h+0−5

 	struct resource	*resource;
 	const struct platform_device_id	*id_entry;
-	/*
-	 * Driver name to force a match.  Do not set directly, because core
-	 * frees it.  Use driver_set_override() to set or clear it.
-	 */
-	const char *driver_override;
 	/* MFD cell pointer */
 	struct mfd_cell *mfd_cell;

include/linux/serial_8250.h+1−0

@@ -195,6 +195,7 @@ void serial8250_do_set_mctrl(struct uart_port *port, unsigned int mctrl); · 194 unmodified lines
195	void serial8250_do_set_divisor(struct uart_port *port, unsigned int baud,	195	void serial8250_do_set_divisor(struct uart_port *port, unsigned int baud,
196	unsigned int quot);	196	unsigned int quot);
197	int fsl8250_handle_irq(struct uart_port *port);	197	int fsl8250_handle_irq(struct uart_port *port);
		198	void serial8250_handle_irq_locked(struct uart_port *port, unsigned int iir);
198	int serial8250_handle_irq(struct uart_port *port, unsigned int iir);	199	int serial8250_handle_irq(struct uart_port *port, unsigned int iir);
199	u16 serial8250_rx_chars(struct uart_8250_port *up, u16 lsr);	200	u16 serial8250_rx_chars(struct uart_8250_port *up, u16 lsr);
200	void serial8250_read_char(struct uart_8250_port *up, u16 lsr);	201	void serial8250_read_char(struct uart_8250_port *up, u16 lsr);

include/net/ip_tunnels.h+23−7

@@ -665,13 +665,29 @@ static inline int iptunnel_pull_offloads(struct sk_buff *skb) · 664 unmodified lines
665	static inline void iptunnel_xmit_stats(struct net_device *dev, int pkt_len)	665	static inline void iptunnel_xmit_stats(struct net_device *dev, int pkt_len)
666	{	666	{
667	if (pkt_len > 0) {	667	if (pkt_len > 0) {
668	struct pcpu_sw_netstats *tstats = get_cpu_ptr(dev->tstats);	668	if (dev->pcpu_stat_type == NETDEV_PCPU_STAT_DSTATS) {
669		669	struct pcpu_dstats *dstats = get_cpu_ptr(dev->dstats);
670	u64_stats_update_begin(&tstats->syncp);	670
671	u64_stats_add(&tstats->tx_bytes, pkt_len);	671	u64_stats_update_begin(&dstats->syncp);
672	u64_stats_inc(&tstats->tx_packets);	672	u64_stats_add(&dstats->tx_bytes, pkt_len);
673	u64_stats_update_end(&tstats->syncp);	673	u64_stats_inc(&dstats->tx_packets);
674	put_cpu_ptr(tstats);	674	u64_stats_update_end(&dstats->syncp);
		675	put_cpu_ptr(dstats);
		676	return;
		677	}
		678	if (dev->pcpu_stat_type == NETDEV_PCPU_STAT_TSTATS) {
		679	struct pcpu_sw_netstats *tstats = get_cpu_ptr(dev->tstats);
		680
		681	u64_stats_update_begin(&tstats->syncp);
		682	u64_stats_add(&tstats->tx_bytes, pkt_len);
		683	u64_stats_inc(&tstats->tx_packets);
		684	u64_stats_update_end(&tstats->syncp);
		685	put_cpu_ptr(tstats);
		686	return;
		687	}
		688	pr_err_once("iptunnel_xmit_stats pcpu_stat_type=%d\n",
		689	dev->pcpu_stat_type);
		690	WARN_ON_ONCE(1);
675	return;	691	return;
676	}	692	}
677		693

include/net/mac80211.h+3−1

  * @band: the band to transmit on
  * @sta: optional pointer to get the station to send the frame to
  *
- * Return: %true if the skb was prepared, %false otherwise
+ * Return: %true if the skb was prepared, %false otherwise.
+ * On failure, the skb is freed by this function; callers must not
+ * free it again.
  *
  * Note: must be called under RCU lock
  */

include/net/netfilter/nf_tables.h+2−4

 	unsigned char		data[];
 };
-#define NFT_SET_ELEM_INTERNAL_LAST	0x1
 /* placeholder structure for opaque set element backend representation. */
 struct nft_elem_priv { };
  *	@key: element key
  *	@key_end: closing element key
  *	@data: element data
- * 	@flags: flags
  *	@priv: element private data and extensions
  */
 struct nft_set_elem {
 		u32		buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
 		struct nft_data val;
 	} data;
-	u32			flags;
 	struct nft_elem_priv	*priv;
 };
 					u64 timeout, u64 expiration, gfp_t gfp);
 int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,
 			    struct nft_expr *expr_array[]);
+void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
+			       struct nft_set_elem_expr *elem_expr);
 void nft_set_elem_destroy(const struct nft_set *set,
 			  const struct nft_elem_priv *elem_priv,
 			  bool destroy_expr);

include/net/sch_generic.h+33−0

@@ -716,6 +716,34 @@ void qdisc_destroy(struct Qdisc *qdisc); · 715 unmodified lines
716	void qdisc_put(struct Qdisc *qdisc);	716	void qdisc_put(struct Qdisc *qdisc);
717	void qdisc_put_unlocked(struct Qdisc *qdisc);	717	void qdisc_put_unlocked(struct Qdisc *qdisc);
718	void qdisc_tree_reduce_backlog(struct Qdisc *qdisc, int n, int len);	718	void qdisc_tree_reduce_backlog(struct Qdisc *qdisc, int n, int len);
		719
		720	static inline void dev_reset_queue(struct net_device *dev,
		721	struct netdev_queue *dev_queue,
		722	void *_unused)
		723	{
		724	struct Qdisc *qdisc;
		725	bool nolock;
		726
		727	qdisc = rtnl_dereference(dev_queue->qdisc_sleeping);
		728	if (!qdisc)
		729	return;
		730
		731	nolock = qdisc->flags & TCQ_F_NOLOCK;
		732
		733	if (nolock)
		734	spin_lock_bh(&qdisc->seqlock);
		735	spin_lock_bh(qdisc_lock(qdisc));
		736
		737	qdisc_reset(qdisc);
		738
		739	spin_unlock_bh(qdisc_lock(qdisc));
		740	if (nolock) {
		741	clear_bit(__QDISC_STATE_MISSED, &qdisc->state);
		742	clear_bit(__QDISC_STATE_DRAINING, &qdisc->state);
		743	spin_unlock_bh(&qdisc->seqlock);
		744	}
		745	}
		746
719	#ifdef CONFIG_NET_SCHED	747	#ifdef CONFIG_NET_SCHED
720	int qdisc_offload_dump_helper(struct Qdisc *q, enum tc_setup_type type,	748	int qdisc_offload_dump_helper(struct Qdisc *q, enum tc_setup_type type,
721	void *type_data);	749	void *type_data);
@@ -1429,6 +1457,11 @@ void mini_qdisc_pair_init(struct mini_Qdisc_pair miniqp, struct Qdisc qdisc, · 707 unmodified lines
1429	void mini_qdisc_pair_block_init(struct mini_Qdisc_pair *miniqp,	1457	void mini_qdisc_pair_block_init(struct mini_Qdisc_pair *miniqp,
1430	struct tcf_block *block);	1458	struct tcf_block *block);
1431		1459
		1460	static inline bool mini_qdisc_pair_inited(struct mini_Qdisc_pair *miniqp)
		1461	{
		1462	return !!miniqp->p_miniq;
		1463	}
		1464
1432	void mq_change_real_num_tx(struct Qdisc *sch, unsigned int new_real_tx);	1465	void mq_change_real_num_tx(struct Qdisc *sch, unsigned int new_real_tx);
1433		1466
1434	int sch_frag_xmit_hook(struct sk_buff skb, int (xmit)(struct sk_buff *skb));	1467	int sch_frag_xmit_hook(struct sk_buff skb, int (xmit)(struct sk_buff *skb));

include/net/udp_tunnel.h+1−1

@@ -52,7 +52,7 @@ int udp_sock_create6(struct net net, struct udp_port_cfg cfg, · 51 unmodified lines
52	static inline int udp_sock_create6(struct net net, struct udp_port_cfg cfg,	52	static inline int udp_sock_create6(struct net net, struct udp_port_cfg cfg,
53	struct socket **sockp)	53	struct socket **sockp)
54	{	54	{
55	return 0;	55	return -EPFNOSUPPORT;
56	}	56	}
57	#endif	57	#endif
58		58

include/trace/events/task.h+5−2

 	TP_ARGS(task, comm),
 	TP_STRUCT__entry(
+		__field(	pid_t,	pid)
 		__array(	char, oldcomm,  TASK_COMM_LEN)
 		__array(	char, newcomm,  TASK_COMM_LEN)
 		__field(	short,	oom_score_adj)
 	),
 	TP_fast_assign(
+		__entry->pid = task->pid;
 		memcpy(entry->oldcomm, task->comm, TASK_COMM_LEN);
 		strscpy(entry->newcomm, comm, TASK_COMM_LEN);
 		__entry->oom_score_adj = task->signal->oom_score_adj;
 	),
-	TP_printk("oldcomm=%s newcomm=%s oom_score_adj=%hd",
+	TP_printk("pid=%d oldcomm=%s newcomm=%s oom_score_adj=%hd",
-		  __entry->oldcomm, __entry->newcomm, __entry->oom_score_adj)
+		__entry->pid, __entry->oldcomm,
+		__entry->newcomm, __entry->oom_score_adj)
 );
 /**

io_uring/kbuf.c+11−3

 static bool io_kbuf_inc_commit(struct io_buffer_list *bl, int len)
 {
+	/* No data consumed, return false early to avoid consuming the buffer */
+	if (!len)
+		return false;
 	while (len) {
 		struct io_uring_buf *buf;
 		u32 buf_len, this_len;
 	sel.addr = u64_to_user_ptr(READ_ONCE(buf->addr));
 	if (io_should_commit(req, issue_flags)) {
-		io_kbuf_commit(req, sel.buf_list, *len, 1);
+		if (!io_kbuf_commit(req, sel.buf_list, *len, 1))
+			req->flags |= REQ_F_BUF_MORE;
 		sel.buf_list = NULL;
 	}
 	return sel;
 		 */
 		if (ret > 0) {
 			req->flags |= REQ_F_BUFFERS_COMMIT | REQ_F_BL_NO_RECYCLE;
-			io_kbuf_commit(req, sel->buf_list, arg->out_len, ret);
+			if (!io_kbuf_commit(req, sel->buf_list, arg->out_len, ret))
+				req->flags |= REQ_F_BUF_MORE;
 		}
 	} else {
 		ret = io_provided_buffers_select(req, &arg->out_len, sel->buf_list, arg->iovs);
 	if (bl)
 		ret = io_kbuf_commit(req, bl, len, nr);
+	if (ret && (req->flags & REQ_F_BUF_MORE))
+		ret = false;
-	req->flags &= ~REQ_F_BUFFER_RING;
+	req->flags &= ~(REQ_F_BUFFER_RING | REQ_F_BUF_MORE);
 	return ret;
 }

io_uring/poll.c+7−2

 				atomic_andnot(IO_POLL_RETRY_FLAG, &req->poll_refs);
 				v &= ~IO_POLL_RETRY_FLAG;
 			}
+			v &= IO_POLL_REF_MASK;
 		}
 		/* the mask was stashed in __io_poll_execute */
 				return IOU_POLL_REMOVE_POLL_USE_RES;
 			}
 		} else {
-			int ret = io_poll_issue(req, tw);
+			int ret;
+			/* multiple refs and HUP, ensure we loop once more */
+			if ((req->cqe.res & (POLLHUP | POLLRDHUP)) && v != 1)
+				v--;
+			ret = io_poll_issue(req, tw);
 			if (ret == IOU_COMPLETE)
 				return IOU_POLL_REMOVE_POLL_USE_RES;
 			else if (ret == IOU_REQUEUE)
 		 * Release all references, retry if someone tried to restart
 		 * task_work while we were executing it.
 		 */
-		v &= IO_POLL_REF_MASK;
 	} while (atomic_sub_return(v, &req->poll_refs) & IO_POLL_REF_MASK);
 	io_napi_add(req);

kernel/bpf/btf.c+20−4

 	 * of the _bh() version.
 	 */
 	spin_lock_irqsave(&btf_idr_lock, flags);
-	idr_remove(&btf_idr, btf->id);
+	if (btf->id) {
+		idr_remove(&btf_idr, btf->id);
+		/*
+		 * Clear the id here to make this function idempotent, since it will get
+		 * called a couple of times for module BTFs: on module unload, and then
+		 * the final btf_put(). btf_alloc_id() starts IDs with 1, so we can use
+		 * 0 as sentinel value.
+		 */
+		WRITE_ONCE(btf->id, 0);
+	}
 	spin_unlock_irqrestore(&btf_idr_lock, flags);
 }
 {
 	const struct btf *btf = filp->private_data;
-	seq_printf(m, "btf_id:\t%u\n", btf->id);
+	seq_printf(m, "btf_id:\t%u\n", READ_ONCE(btf->id));
 }
 #endif
 	if (copy_from_user(&info, uinfo, info_copy))
 		return -EFAULT;
-	info.id = btf->id;
+	info.id = READ_ONCE(btf->id);
 	ubtf = u64_to_user_ptr(info.btf);
 	btf_copy = min_t(u32, btf->data_size, info.btf_size);
 	if (copy_to_user(ubtf, btf->data, btf_copy))
 u32 btf_obj_id(const struct btf *btf)
 {
-	return btf->id;
+	return READ_ONCE(btf->id);
 }
 bool btf_is_kernel(const struct btf *btf)
 			if (btf_mod->module != module)
 				continue;
+			/*
+			 * For modules, we do the freeing of BTF IDR as soon as
+			 * module goes away to disable BTF discovery, since the
+			 * btf_try_get_module() on such BTFs will fail. This may
+			 * be called again on btf_put(), but it's ok to do so.
+			 */
+			btf_free_id(btf_mod->btf);
 			list_del(&btf_mod->list);
 			if (btf_mod->sysfs_attr)
 				sysfs_remove_bin_file(btf_kobj, btf_mod->sysfs_attr);

kernel/bpf/core.c+35−8

 		*to++ = BPF_ALU64_IMM(BPF_XOR, BPF_REG_AX, imm_rnd);
 		*to++ = BPF_STX_MEM(from->code, from->dst_reg, BPF_REG_AX, from->off);
 		break;
+	case BPF_ST | BPF_PROBE_MEM32 | BPF_DW:
+	case BPF_ST | BPF_PROBE_MEM32 | BPF_W:
+	case BPF_ST | BPF_PROBE_MEM32 | BPF_H:
+	case BPF_ST | BPF_PROBE_MEM32 | BPF_B:
+		*to++ = BPF_ALU64_IMM(BPF_MOV, BPF_REG_AX, imm_rnd ^
+				      from->imm);
+		*to++ = BPF_ALU64_IMM(BPF_XOR, BPF_REG_AX, imm_rnd);
+		/*
+		 * Cannot use BPF_STX_MEM() macro here as it
+		 * hardcodes BPF_MEM mode, losing PROBE_MEM32
+		 * and breaking arena addressing in the JIT.
+		 */
+		*to++ = (struct bpf_insn) {
+			.code  = BPF_STX | BPF_PROBE_MEM32 |
+				 BPF_SIZE(from->code),
+			.dst_reg = from->dst_reg,
+			.src_reg = BPF_REG_AX,
+			.off   = from->off,
+		};
+		break;
 	}
 out:
 	return to - to_buff;
 }
 #ifndef CONFIG_BPF_JIT_ALWAYS_ON
+/* Absolute value of s32 without undefined behavior for S32_MIN */
+static u32 abs_s32(s32 x)
+{
+	return x >= 0 ? (u32)x : -(u32)x;
+}
 /**
  *	___bpf_prog_run - run eBPF program on a given context
  *	@regs: is the array of MAX_BPF_EXT_REG eBPF pseudo-registers
 			DST = do_div(AX, (u32) SRC);
 			break;
 		case 1:
-			AX = abs((s32)DST);
+			AX = abs_s32((s32)DST);
-			AX = do_div(AX, abs((s32)SRC));
+			AX = do_div(AX, abs_s32((s32)SRC));
 			if ((s32)DST < 0)
 				DST = (u32)-AX;
 			else
 			DST = do_div(AX, (u32) IMM);
 			break;
 		case 1:
-			AX = abs((s32)DST);
+			AX = abs_s32((s32)DST);
-			AX = do_div(AX, abs((s32)IMM));
+			AX = do_div(AX, abs_s32((s32)IMM));
 			if ((s32)DST < 0)
 				DST = (u32)-AX;
 			else
 			DST = (u32) AX;
 			break;
 		case 1:
-			AX = abs((s32)DST);
+			AX = abs_s32((s32)DST);
-			do_div(AX, abs((s32)SRC));
+			do_div(AX, abs_s32((s32)SRC));
 			if (((s32)DST < 0) == ((s32)SRC < 0))
 				DST = (u32)AX;
 			else
 			DST = (u32) AX;
 			break;
 		case 1:
-			AX = abs((s32)DST);
+			AX = abs_s32((s32)DST);
-			do_div(AX, abs((s32)IMM));
+			do_div(AX, abs_s32((s32)IMM));
 			if (((s32)DST < 0) == ((s32)IMM < 0))
 				DST = (u32)AX;
 			else

kernel/bpf/verifier.c+25−8

@@ -15910,6 +15910,13 @@ static void scalar_byte_swap(struct bpf_reg_state dst_reg, struct bpf_insn ins · 15909 unmodified lines
15910	/* Apply bswap if alu64 or switch between big-endian and little-endian machines */	15910	/* Apply bswap if alu64 or switch between big-endian and little-endian machines */
15911	bool need_bswap = alu64 \|\| (to_le == is_big_endian);	15911	bool need_bswap = alu64 \|\| (to_le == is_big_endian);
15912		15912
		15913	/*
		15914	* If the register is mutated, manually reset its scalar ID to break
		15915	* any existing ties and avoid incorrect bounds propagation.
		15916	*/
		15917	if (need_bswap \|\| insn->imm == 16 \|\| insn->imm == 32)
		15918	dst_reg->id = 0;
		15919
15913	if (need_bswap) {	15920	if (need_bswap) {
15914	if (insn->imm == 16)	15921	if (insn->imm == 16)
15915	dst_reg->var_off = tnum_bswap16(dst_reg->var_off);	15922	dst_reg->var_off = tnum_bswap16(dst_reg->var_off);
@@ -15992,7 +15999,7 @@ static int maybe_fork_scalars(struct bpf_verifier_env env, struct bpf_insn ins · 76 unmodified lines
15992	else	15999	else
15993	return 0;	16000	return 0;
15994		16001
15995	branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false);	16002	branch = push_stack(env, env->insn_idx, env->insn_idx, false);
15996	if (IS_ERR(branch))	16003	if (IS_ERR(branch))
15997	return PTR_ERR(branch);	16004	return PTR_ERR(branch);
15998		16005
@@ -17408,6 +17415,12 @@ static void sync_linked_regs(struct bpf_verifier_env *env, struct bpf_verifier_s · 1409 unmodified lines
17408	continue;	17415	continue;
17409	if ((reg->id & ~BPF_ADD_CONST) != (known_reg->id & ~BPF_ADD_CONST))	17416	if ((reg->id & ~BPF_ADD_CONST) != (known_reg->id & ~BPF_ADD_CONST))
17410	continue;	17417	continue;
		17418	/*
		17419	* Skip mixed 32/64-bit links: the delta relationship doesn't
		17420	* hold across different ALU widths.
		17421	*/
		17422	if (((reg->id ^ known_reg->id) & BPF_ADD_CONST) == BPF_ADD_CONST)
		17423	continue;
17411	if ((!(reg->id & BPF_ADD_CONST) && !(known_reg->id & BPF_ADD_CONST)) \|\|	17424	if ((!(reg->id & BPF_ADD_CONST) && !(known_reg->id & BPF_ADD_CONST)) \|\|
17412	reg->off == known_reg->off) {	17425	reg->off == known_reg->off) {
17413	s32 saved_subreg_def = reg->subreg_def;	17426	s32 saved_subreg_def = reg->subreg_def;
@@ -17435,7 +17448,7 @@ static void sync_linked_regs(struct bpf_verifier_env *env, struct bpf_verifier_s · 21 unmodified lines
17435	scalar32_min_max_add(reg, &fake_reg);	17448	scalar32_min_max_add(reg, &fake_reg);
17436	scalar_min_max_add(reg, &fake_reg);	17449	scalar_min_max_add(reg, &fake_reg);
17437	reg->var_off = tnum_add(reg->var_off, fake_reg.var_off);	17450	reg->var_off = tnum_add(reg->var_off, fake_reg.var_off);
17438	if (known_reg->id & BPF_ADD_CONST32)	17451	if ((reg->id \| known_reg->id) & BPF_ADD_CONST32)
17439	zext_32_to_64(reg);	17452	zext_32_to_64(reg);
17440	reg_bounds_sync(reg);	17453	reg_bounds_sync(reg);
17441	}	17454	}
@@ -19863,11 +19876,14 @@ static bool regsafe(struct bpf_verifier_env env, struct bpf_reg_state rold, · 2421 unmodified lines
19863	* Also verify that new value satisfies old value range knowledge.	19876	* Also verify that new value satisfies old value range knowledge.
19864	*/	19877	*/
19865		19878
19866	/* ADD_CONST mismatch: different linking semantics */	19879	/*
19867	if ((rold->id & BPF_ADD_CONST) && !(rcur->id & BPF_ADD_CONST))	19880	* ADD_CONST flags must match exactly: BPF_ADD_CONST32 and
19868	return false;	19881	* BPF_ADD_CONST64 have different linking semantics in
19869		19882	* sync_linked_regs() (alu32 zero-extends, alu64 does not),
19870	if (rold->id && !(rold->id & BPF_ADD_CONST) && (rcur->id & BPF_ADD_CONST))	19883	* so pruning across different flag types is unsafe.
		19884	*/
		19885	if (rold->id &&
		19886	(rold->id & BPF_ADD_CONST) != (rcur->id & BPF_ADD_CONST))
19871	return false;	19887	return false;
19872		19888
19873	/* Both have offset linkage: offsets must match */	19889	/* Both have offset linkage: offsets must match */
@@ -20904,7 +20920,8 @@ static int process_bpf_exit_full(struct bpf_verifier_env *env, · 1030 unmodified lines
20904	* state when it exits.	20920	* state when it exits.
20905	*/	20921	*/
20906	int err = check_resource_leak(env, exception_exit,	20922	int err = check_resource_leak(env, exception_exit,
20907	!env->cur_state->curframe,	20923	exception_exit \|\| !env->cur_state->curframe,
		20924	exception_exit ? "bpf_throw" :
20908	"BPF_EXIT instruction in main prog");	20925	"BPF_EXIT instruction in main prog");
20909	if (err)	20926	if (err)
20910	return err;	20927	return err;

kernel/crash_dump_dm_crypt.c+2−2

@@ -168,8 +168,8 @@ static int read_key_from_user_keying(struct dm_crypt_key *dm_key) · 167 unmodified lines
168		168
169	memcpy(dm_key->data, ukp->data, ukp->datalen);	169	memcpy(dm_key->data, ukp->data, ukp->datalen);
170	dm_key->key_size = ukp->datalen;	170	dm_key->key_size = ukp->datalen;
171	kexec_dprintk("Get dm crypt key (size=%u) %s: %8ph\n", dm_key->key_size,	171	kexec_dprintk("Get dm crypt key (size=%u) %s\n", dm_key->key_size,
172	dm_key->key_desc, dm_key->data);	172	dm_key->key_desc);
173		173
174	out:	174	out:
175	up_read(&key->sem);	175	up_read(&key->sem);

kernel/events/core.c+8−11

 	struct perf_event *sub, *event = data->event;
 	struct perf_event_context *ctx = event->ctx;
 	struct perf_cpu_context *cpuctx = this_cpu_ptr(&perf_cpu_context);
-	struct pmu *pmu = event->pmu;
+	struct pmu *pmu;
 	/*
 	 * If this is a task context, we need to check whether it is
 	if (ctx->task && cpuctx->task_ctx != ctx)
 		return;
-	raw_spin_lock(&ctx->lock);
+	guard(raw_spinlock)(&ctx->lock);
 	ctx_time_update_event(ctx, event);
 	perf_event_update_time(event);
 		perf_event_update_sibling_time(event);
 	if (event->state != PERF_EVENT_STATE_ACTIVE)
-		goto unlock;
+		return;
 	if (!data->group) {
-		pmu->read(event);
+		perf_pmu_read(event);
 		data->ret = 0;
-		goto unlock;
+		return;
 	}
+	pmu = event->pmu_ctx->pmu;
 	pmu->start_txn(pmu, PERF_PMU_TXN_READ);
-	pmu->read(event);
+	perf_pmu_read(event);
 	for_each_sibling_event(sub, event)
 		perf_pmu_read(sub);
 	data->ret = pmu->commit_txn(pmu);
-unlock:
-	raw_spin_unlock(&ctx->lock);
 }
 static inline u64 perf_event_count(struct perf_event *event, bool self)
 	get_ctx(child_ctx);
 	child_event->ctx = child_ctx;
-	pmu_ctx = find_get_pmu_context(child_event->pmu, child_ctx, child_event);
+	pmu_ctx = find_get_pmu_context(parent_event->pmu_ctx->pmu, child_ctx, child_event);
 	if (IS_ERR(pmu_ctx)) {
 		free_event(child_event);
 		return ERR_CAST(pmu_ctx);

kernel/sched/idle.c+21−9

 	return cpuidle_enter(drv, dev, next_state);
 }
+static void idle_call_stop_or_retain_tick(bool stop_tick)
+{
+	if (stop_tick || tick_nohz_tick_stopped())
+		tick_nohz_idle_stop_tick();
+	else
+		tick_nohz_idle_retain_tick();
+}
 /**
  * cpuidle_idle_call - the main idle function
  *
  * set, and it returns with polling set.  If it ever stops polling, it
  * must clear the polling bit.
  */
-static void cpuidle_idle_call(void)
+static void cpuidle_idle_call(bool stop_tick)
 {
 	struct cpuidle_device *dev = cpuidle_get_device();
 	struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
 	}
 	if (cpuidle_not_available(drv, dev)) {
-		tick_nohz_idle_stop_tick();
+		idle_call_stop_or_retain_tick(stop_tick);
 		default_idle_call();
 		goto exit_idle;
 		next_state = cpuidle_find_deepest_state(drv, dev, max_latency_ns);
 		call_cpuidle(drv, dev, next_state);
 	} else if (drv->state_count > 1) {
-		bool stop_tick = true;
+		/*
+		 * stop_tick is expected to be true by default by cpuidle
+		 * governors, which allows them to select idle states with
+		 * target residency above the tick period length.
+		 */
+		stop_tick = true;
 		/*
 		 * Ask the cpuidle framework to choose a convenient idle state.
 		 */
 		next_state = cpuidle_select(drv, dev, &stop_tick);
-		if (stop_tick || tick_nohz_tick_stopped())
+		idle_call_stop_or_retain_tick(stop_tick);
-			tick_nohz_idle_stop_tick();
-		else
-			tick_nohz_idle_retain_tick();
 		entered_state = call_cpuidle(drv, dev, next_state);
 		/*
 		 */
 		cpuidle_reflect(dev, entered_state);
 	} else {
-		tick_nohz_idle_retain_tick();
+		idle_call_stop_or_retain_tick(stop_tick);
 		/*
 		 * If there is only a single idle state (or none), there is
 static void do_idle(void)
 {
 	int cpu = smp_processor_id();
+	bool got_tick = false;
 	/*
 	 * Check if we need to update blocked load
 			tick_nohz_idle_restart_tick();
 			cpu_idle_poll();
 		} else {
-			cpuidle_idle_call();
+			cpuidle_idle_call(got_tick);
 		}
+		got_tick = tick_nohz_idle_got_tick();
 		arch_cpu_idle_exit();
 	}

kernel/trace/ftrace.c+2−2

@@ -6606,9 +6606,9 @@ int update_ftrace_direct_mod(struct ftrace_ops ops, struct ftrace_hash hash, b · 6605 unmodified lines
6606	if (!orig_hash)	6606	if (!orig_hash)
6607	goto unlock;	6607	goto unlock;
6608		6608
6609	/* Enable the tmp_ops to have the same functions as the direct ops */	6609	/* Enable the tmp_ops to have the same functions as the hash object. */
6610	ftrace_ops_init(&tmp_ops);	6610	ftrace_ops_init(&tmp_ops);
6611	tmp_ops.func_hash = ops->func_hash;	6611	tmp_ops.func_hash->filter_hash = hash;
6612		6612
6613	err = register_ftrace_function_nolock(&tmp_ops);	6613	err = register_ftrace_function_nolock(&tmp_ops);
6614	if (err)	6614	if (err)

kernel/trace/ring_buffer.c+1−1

@@ -2053,7 +2053,7 @@ static void rb_meta_validate_events(struct ring_buffer_per_cpu *cpu_buffer) · 2052 unmodified lines
2053		2053
2054	entries += ret;	2054	entries += ret;
2055	entry_bytes += local_read(&head_page->page->commit);	2055	entry_bytes += local_read(&head_page->page->commit);
2056	local_set(&cpu_buffer->head_page->entries, ret);	2056	local_set(&head_page->entries, ret);
2057		2057
2058	if (head_page == cpu_buffer->commit_page)	2058	if (head_page == cpu_buffer->commit_page)
2059	break;	2059	break;

kernel/trace/trace.c+27−9

 	lockdep_assert_held(&event_mutex);
 	if (enabled) {
-		if (!list_empty(&tr->marker_list))
+		if (tr->trace_flags & TRACE_ITER(COPY_MARKER))
 			return false;
 		list_add_rcu(&tr->marker_list, &marker_copies);
 		return true;
 	}
-	if (list_empty(&tr->marker_list))
+	if (!(tr->trace_flags & TRACE_ITER(COPY_MARKER)))
 		return false;
-	list_del_init(&tr->marker_list);
+	list_del_rcu(&tr->marker_list);
 	tr->trace_flags &= ~TRACE_ITER(COPY_MARKER);
 	return true;
 }
 	 */
 	do {
+		/*
+		 * It is possible that something is trying to migrate this
+		 * task. What happens then, is when preemption is enabled,
+		 * the migration thread will preempt this task, try to
+		 * migrate it, fail, then let it run again. That will
+		 * cause this to loop again and never succeed.
+		 * On failures, enabled and disable preemption with
+		 * migration enabled, to allow the migration thread to
+		 * migrate this task.
+		 */
+		if (trys) {
+			preempt_enable_notrace();
+			preempt_disable_notrace();
+			cpu = smp_processor_id();
+			buffer = per_cpu_ptr(tinfo->tbuf, cpu)->buf;
+		}
 		/*
 		 * If for some reason, copy_from_user() always causes a context
 		 * switch, this would then cause an infinite loop.
 	list_del(&tr->list);
-	/* Disable all the flags that were enabled coming in */
-	for (i = 0; i < TRACE_FLAGS_MAX_SIZE; i++) {
-		if ((1ULL << i) & ZEROED_TRACE_FLAGS)
-			set_tracer_flag(tr, 1ULL << i, 0);
-	}
 	if (printk_trace == tr)
 		update_printk_trace(&global_trace);
+	/* Must be done before disabling all the flags */
 	if (update_marker_trace(tr, 0))
 		synchronize_rcu();
+	/* Disable all the flags that were enabled coming in */
+	for (i = 0; i < TRACE_FLAGS_MAX_SIZE; i++) {
+		if ((1ULL << i) & ZEROED_TRACE_FLAGS)
+			set_tracer_flag(tr, 1ULL << i, 0);
+	}
 	tracing_set_nop(tr);
 	clear_ftrace_function_probes(tr);
 	event_trace_del_tracer(tr);

lib/bootconfig.c+2−1

@@ -723,7 +723,8 @@ static int __init xbc_parse_kv(char *k, char v, int op) · 722 unmodified lines
723	if (op == ':') {	723	if (op == ':') {
724	unsigned short nidx = child->next;	724	unsigned short nidx = child->next;
725		725
726	xbc_init_node(child, v, XBC_VALUE);	726	if (xbc_init_node(child, v, XBC_VALUE) < 0)
		727	return xbc_parse_error("Failed to override value", v);
727	child->next = nidx; /* keep subkeys */	728	child->next = nidx; /* keep subkeys */
728	goto array;	729	goto array;
729	}	730	}

lib/crypto/Makefile+3−0

@@ -55,6 +55,9 @@ libaes-$(CONFIG_SPARC) += sparc/aes_asm.o · 54 unmodified lines
55	libaes-$(CONFIG_X86) += x86/aes-aesni.o	55	libaes-$(CONFIG_X86) += x86/aes-aesni.o
56	endif # CONFIG_CRYPTO_LIB_AES_ARCH	56	endif # CONFIG_CRYPTO_LIB_AES_ARCH
57		57
		58	# clean-files must be defined unconditionally
		59	clean-files += powerpc/aesp8-ppc.S
		60
58	################################################################################	61	################################################################################
59		62
60	obj-$(CONFIG_CRYPTO_LIB_AESCFB) += libaescfb.o	63	obj-$(CONFIG_CRYPTO_LIB_AESCFB) += libaescfb.o

mm/huge_memory.c+2−1

@@ -2797,7 +2797,8 @@ int move_pages_huge_pmd(struct mm_struct mm, pmd_t dst_pmd, pmd_t *src_pmd, pm · 2796 unmodified lines
2797	_dst_pmd = pmd_mkwrite(pmd_mkdirty(_dst_pmd), dst_vma);	2797	_dst_pmd = pmd_mkwrite(pmd_mkdirty(_dst_pmd), dst_vma);
2798	} else {	2798	} else {
2799	src_pmdval = pmdp_huge_clear_flush(src_vma, src_addr, src_pmd);	2799	src_pmdval = pmdp_huge_clear_flush(src_vma, src_addr, src_pmd);
2800	_dst_pmd = folio_mk_pmd(src_folio, dst_vma->vm_page_prot);	2800	_dst_pmd = move_soft_dirty_pmd(src_pmdval);
		2801	_dst_pmd = clear_uffd_wp_pmd(_dst_pmd);
2801	}	2802	}
2802	set_pmd_at(mm, dst_addr, dst_pmd, _dst_pmd);	2803	set_pmd_at(mm, dst_addr, dst_pmd, _dst_pmd);
2803		2804

mm/rmap.c+17−4

 	if (userfaultfd_wp(vma))
 		return 1;
-	return folio_pte_batch(folio, pvmw->pte, pte, max_nr);
+	/*
+	 * If unmap fails, we need to restore the ptes. To avoid accidentally
+	 * upgrading write permissions for ptes that were not originally
+	 * writable, and to avoid losing the soft-dirty bit, use the
+	 * appropriate FPB flags.
+	 */
+	return folio_pte_batch_flags(folio, vma, pvmw->pte, &pte, max_nr,
+				     FPB_RESPECT_WRITE | FPB_RESPECT_SOFT_DIRTY);
 }
 /*
 			__maybe_unused pmd_t pmdval;
 			if (flags & TTU_SPLIT_HUGE_PMD) {
+				/*
+				 * split_huge_pmd_locked() might leave the
+				 * folio mapped through PTEs. Retry the walk
+				 * so we can detect this scenario and properly
+				 * abort the walk.
+				 */
 				split_huge_pmd_locked(vma, pvmw.address,
 						      pvmw.pmd, true);
-				ret = false;
+				flags &= ~TTU_SPLIT_HUGE_PMD;
-				page_vma_mapped_walk_done(&pvmw);
+				page_vma_mapped_walk_restart(&pvmw);
-				break;
+				continue;
 			}
 #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION
 			pmdval = pmdp_get(pvmw.pmd);

net/atm/lec.c+47−25

@@ -154,10 +154,19 @@ static void lec_handle_bridge(struct sk_buff skb, struct net_device dev) · 153 unmodified lines
154	/* 0x01 is topology change */	154	/* 0x01 is topology change */
155		155
156	priv = netdev_priv(dev);	156	priv = netdev_priv(dev);
157	atm_force_charge(priv->lecd, skb2->truesize);	157	struct atm_vcc *vcc;
158	sk = sk_atm(priv->lecd);	158
159	skb_queue_tail(&sk->sk_receive_queue, skb2);	159	rcu_read_lock();
160	sk->sk_data_ready(sk);	160	vcc = rcu_dereference(priv->lecd);
		161	if (vcc) {
		162	atm_force_charge(vcc, skb2->truesize);
		163	sk = sk_atm(vcc);
		164	skb_queue_tail(&sk->sk_receive_queue, skb2);
		165	sk->sk_data_ready(sk);
		166	} else {
		167	dev_kfree_skb(skb2);
		168	}
		169	rcu_read_unlock();
161	}	170	}
162	}	171	}
163	#endif /* IS_ENABLED(CONFIG_BRIDGE) */	172	#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -216,7 +225,7 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb, · 52 unmodified lines
216	int is_rdesc;	225	int is_rdesc;
217		226
218	pr_debug("called\n");	227	pr_debug("called\n");
219	if (!priv->lecd) {	228	if (!rcu_access_pointer(priv->lecd)) {
220	pr_info("%s:No lecd attached\n", dev->name);	229	pr_info("%s:No lecd attached\n", dev->name);
221	dev->stats.tx_errors++;	230	dev->stats.tx_errors++;
222	netif_stop_queue(dev);	231	netif_stop_queue(dev);
@@ -449,10 +458,19 @@ static int lec_atm_send(struct atm_vcc vcc, struct sk_buff skb) · 226 unmodified lines
449	break;	458	break;
450	skb2->len = sizeof(struct atmlec_msg);	459	skb2->len = sizeof(struct atmlec_msg);
451	skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg));	460	skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg));
452	atm_force_charge(priv->lecd, skb2->truesize);	461	struct atm_vcc *vcc;
453	sk = sk_atm(priv->lecd);	462
454	skb_queue_tail(&sk->sk_receive_queue, skb2);	463	rcu_read_lock();
455	sk->sk_data_ready(sk);	464	vcc = rcu_dereference(priv->lecd);
		465	if (vcc) {
		466	atm_force_charge(vcc, skb2->truesize);
		467	sk = sk_atm(vcc);
		468	skb_queue_tail(&sk->sk_receive_queue, skb2);
		469	sk->sk_data_ready(sk);
		470	} else {
		471	dev_kfree_skb(skb2);
		472	}
		473	rcu_read_unlock();
456	}	474	}
457	}	475	}
458	#endif /* IS_ENABLED(CONFIG_BRIDGE) */	476	#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -468,23 +486,16 @@ static int lec_atm_send(struct atm_vcc vcc, struct sk_buff skb) · 9 unmodified lines
468		486
469	static void lec_atm_close(struct atm_vcc *vcc)	487	static void lec_atm_close(struct atm_vcc *vcc)
470	{	488	{
471	struct sk_buff *skb;
472	struct net_device dev = (struct net_device )vcc->proto_data;	489	struct net_device dev = (struct net_device )vcc->proto_data;
473	struct lec_priv *priv = netdev_priv(dev);	490	struct lec_priv *priv = netdev_priv(dev);
474		491
475	priv->lecd = NULL;	492	rcu_assign_pointer(priv->lecd, NULL);
		493	synchronize_rcu();
476	/* Do something needful? */	494	/* Do something needful? */
477		495
478	netif_stop_queue(dev);	496	netif_stop_queue(dev);
479	lec_arp_destroy(priv);	497	lec_arp_destroy(priv);
480		498
481	if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
482	pr_info("%s closing with messages pending\n", dev->name);
483	while ((skb = skb_dequeue(&sk_atm(vcc)->sk_receive_queue))) {
484	atm_return(vcc, skb->truesize);
485	dev_kfree_skb(skb);
486	}
487
488	pr_info("%s: Shut down!\n", dev->name);	499	pr_info("%s: Shut down!\n", dev->name);
489	module_put(THIS_MODULE);	500	module_put(THIS_MODULE);
490	}	501	}
@@ -510,12 +521,14 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type, · 19 unmodified lines
510	const unsigned char mac_addr, const unsigned char atm_addr,	521	const unsigned char mac_addr, const unsigned char atm_addr,
511	struct sk_buff *data)	522	struct sk_buff *data)
512	{	523	{
		524	struct atm_vcc *vcc;
513	struct sock *sk;	525	struct sock *sk;
514	struct sk_buff *skb;	526	struct sk_buff *skb;
515	struct atmlec_msg *mesg;	527	struct atmlec_msg *mesg;
516		528
517	if (!priv \|\| !priv->lecd)	529	if (!priv \|\| !rcu_access_pointer(priv->lecd))
518	return -1;	530	return -1;
		531
519	skb = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);	532	skb = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
520	if (!skb)	533	if (!skb)
521	return -1;	534	return -1;
@@ -532,18 +545,27 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type, · 10 unmodified lines
532	if (atm_addr)	545	if (atm_addr)
533	memcpy(&mesg->content.normal.atm_addr, atm_addr, ATM_ESA_LEN);	546	memcpy(&mesg->content.normal.atm_addr, atm_addr, ATM_ESA_LEN);
534		547
535	atm_force_charge(priv->lecd, skb->truesize);	548	rcu_read_lock();
536	sk = sk_atm(priv->lecd);	549	vcc = rcu_dereference(priv->lecd);
		550	if (!vcc) {
		551	rcu_read_unlock();
		552	kfree_skb(skb);
		553	return -1;
		554	}
		555
		556	atm_force_charge(vcc, skb->truesize);
		557	sk = sk_atm(vcc);
537	skb_queue_tail(&sk->sk_receive_queue, skb);	558	skb_queue_tail(&sk->sk_receive_queue, skb);
538	sk->sk_data_ready(sk);	559	sk->sk_data_ready(sk);
539		560
540	if (data != NULL) {	561	if (data != NULL) {
541	pr_debug("about to send %d bytes of data\n", data->len);	562	pr_debug("about to send %d bytes of data\n", data->len);
542	atm_force_charge(priv->lecd, data->truesize);	563	atm_force_charge(vcc, data->truesize);
543	skb_queue_tail(&sk->sk_receive_queue, data);	564	skb_queue_tail(&sk->sk_receive_queue, data);
544	sk->sk_data_ready(sk);	565	sk->sk_data_ready(sk);
545	}	566	}
546		567
		568	rcu_read_unlock();
547	return 0;	569	return 0;
548	}	570	}
549		571
@@ -618,7 +640,7 @@ static void lec_push(struct atm_vcc vcc, struct sk_buff skb) · 68 unmodified lines
618		640
619	atm_return(vcc, skb->truesize);	641	atm_return(vcc, skb->truesize);
620	if ((__be16 ) skb->data == htons(priv->lecid) \|\|	642	if ((__be16 ) skb->data == htons(priv->lecid) \|\|
621	!priv->lecd \|\| !(dev->flags & IFF_UP)) {	643	!rcu_access_pointer(priv->lecd) \|\| !(dev->flags & IFF_UP)) {
622	/*	644	/*
623	* Probably looping back, or if lecd is missing,	645	* Probably looping back, or if lecd is missing,
624	* lecd has gone down	646	* lecd has gone down
@@ -753,12 +775,12 @@ static int lecd_attach(struct atm_vcc *vcc, int arg) · 128 unmodified lines
753	priv = netdev_priv(dev_lec[i]);	775	priv = netdev_priv(dev_lec[i]);
754	} else {	776	} else {
755	priv = netdev_priv(dev_lec[i]);	777	priv = netdev_priv(dev_lec[i]);
756	if (priv->lecd)	778	if (rcu_access_pointer(priv->lecd))
757	return -EADDRINUSE;	779	return -EADDRINUSE;
758	}	780	}
759	lec_arp_init(priv);	781	lec_arp_init(priv);
760	priv->itfnum = i; /* LANE2 addition */	782	priv->itfnum = i; /* LANE2 addition */
761	priv->lecd = vcc;	783	rcu_assign_pointer(priv->lecd, vcc);
762	vcc->dev = &lecatm_dev;	784	vcc->dev = &lecatm_dev;
763	vcc_insert_socket(sk_atm(vcc));	785	vcc_insert_socket(sk_atm(vcc));
764		786

net/atm/lec.h+1−1

@@ -91,7 +91,7 @@ struct lec_priv { · 90 unmodified lines
91	*/	91	*/
92	spinlock_t lec_arp_lock;	92	spinlock_t lec_arp_lock;
93	struct atm_vcc mcast_vcc; / Default Multicast Send VCC */	93	struct atm_vcc mcast_vcc; / Default Multicast Send VCC */
94	struct atm_vcc *lecd;	94	struct atm_vcc __rcu *lecd;
95	struct delayed_work lec_arp_work; /* C10 */	95	struct delayed_work lec_arp_work; /* C10 */
96	unsigned int maximum_unknown_frame_count;	96	unsigned int maximum_unknown_frame_count;
97	/*	97	/*

net/batman-adv/bat_iv_ogm.c+3−0

@@ -473,6 +473,9 @@ batadv_iv_ogm_can_aggregate(const struct batadv_ogm_packet *new_bat_ogm_packet, · 472 unmodified lines
473	if (aggregated_bytes > max_bytes)	473	if (aggregated_bytes > max_bytes)
474	return false;	474	return false;
475		475
		476	if (skb_tailroom(forw_packet->skb) < packet_len)
		477	return false;
		478
476	if (packet_num >= BATADV_MAX_AGGREGATION_PACKETS)	479	if (packet_num >= BATADV_MAX_AGGREGATION_PACKETS)
477	return false;	480	return false;
478		481

net/bluetooth/hci_conn.c+2−2

 		return false;
 done:
+	conn->iso_qos = *qos;
 	if (hci_cmd_sync_queue(hdev, set_cig_params_sync,
 			       UINT_PTR(qos->ucast.cig), NULL) < 0)
 		return false;
 	}
 	hci_conn_hold(cis);
-	cis->iso_qos = *qos;
 	cis->state = BT_BOUND;
 	return cis;

net/bluetooth/hci_sync.c+1−1

 	 * state.
 	 */
 	if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
-		hci_scan_disable_sync(hdev);
 		hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED);
+		hci_scan_disable_sync(hdev);
 	}
 	/* Update random address, but set require_privacy to false so

net/bluetooth/hidp/core.c+14−2

 	skb_queue_purge(&session->intr_transmit);
 	fput(session->intr_sock->file);
 	fput(session->ctrl_sock->file);
-	l2cap_conn_put(session->conn);
+	if (session->conn)
+		l2cap_conn_put(session->conn);
 	kfree(session);
 }
 	down_write(&hidp_session_sem);
+	/* Drop L2CAP reference immediately to indicate that
+	 * l2cap_unregister_user() shall not be called as it is already
+	 * considered removed.
+	 */
+	if (session->conn) {
+		l2cap_conn_put(session->conn);
+		session->conn = NULL;
+	}
 	hidp_session_terminate(session);
 	cancel_work_sync(&session->dev_init);
 	 * Instead, this call has the same semantics as if user-space tried to
 	 * delete the session.
 	 */
-	l2cap_unregister_user(session->conn, &session->user);
+	if (session->conn)
+		l2cap_unregister_user(session->conn, &session->user);
 	hidp_session_put(session);
 	module_put_and_kthread_exit(0);

net/bluetooth/l2cap_core.c+31−20

 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
 {
-	struct hci_dev *hdev = conn->hcon->hdev;
 	int ret;
 	/* We need to check whether l2cap_conn is registered. If it is not, we
-	 * must not register the l2cap_user. l2cap_conn_del() is unregisters
+	 * must not register the l2cap_user. l2cap_conn_del() unregisters
-	 * l2cap_conn objects, but doesn't provide its own locking. Instead, it
+	 * l2cap_conn objects under conn->lock, and we use the same lock here
-	 * relies on the parent hci_conn object to be locked. This itself relies
+	 * to protect access to conn->users and conn->hchan.
-	 * on the hci_dev object to be locked. So we must lock the hci device
+	 */
-	 * here, too. */
-	hci_dev_lock(hdev);
+	mutex_lock(&conn->lock);
 	if (!list_empty(&user->list)) {
 		ret = -EINVAL;
 	ret = 0;
 out_unlock:
-	hci_dev_unlock(hdev);
+	mutex_unlock(&conn->lock);
 	return ret;
 }
 EXPORT_SYMBOL(l2cap_register_user);
 void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
 {
-	struct hci_dev *hdev = conn->hcon->hdev;
+	mutex_lock(&conn->lock);
-	hci_dev_lock(hdev);
 	if (list_empty(&user->list))
 		goto out_unlock;
 	user->remove(conn, user);
 out_unlock:
-	hci_dev_unlock(hdev);
+	mutex_unlock(&conn->lock);
 }
 EXPORT_SYMBOL(l2cap_unregister_user);
 	switch (type) {
 	case L2CAP_IT_FEAT_MASK:
-		conn->feat_mask = get_unaligned_le32(rsp->data);
+		if (cmd_len >= sizeof(*rsp) + sizeof(u32))
+			conn->feat_mask = get_unaligned_le32(rsp->data);
 		if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
 			struct l2cap_info_req req;
 		break;
 	case L2CAP_IT_FIXED_CHAN:
-		conn->remote_fixed_chan = rsp->data[0];
+		if (cmd_len >= sizeof(*rsp) + sizeof(rsp->data[0]))
+			conn->remote_fixed_chan = rsp->data[0];
 		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
 		conn->info_ident = 0;
 	u16 mtu, mps;
 	__le16 psm;
 	u8 result, rsp_len = 0;
-	int i, num_scid;
+	int i, num_scid = 0;
 	bool defer = false;
 	if (!enable_ecred)
 		goto response;
 	}
+	/* Check if there are no pending channels with the same ident */
+	__l2cap_chan_list_id(conn, cmd->ident, l2cap_ecred_list_defer,
+			     &num_scid);
+	if (num_scid) {
+		result = L2CAP_CR_LE_INVALID_PARAMS;
+		goto response;
+	}
 	cmd_len -= sizeof(*req);
 	num_scid = cmd_len / sizeof(u16);
 					 u8 *data)
 {
 	struct l2cap_chan *chan, *tmp;
-	struct l2cap_ecred_conn_rsp *rsp = (void *) data;
+	struct l2cap_ecred_reconf_rsp *rsp = (void *)data;
 	u16 result;
 	if (cmd_len < sizeof(*rsp))
 	result = __le16_to_cpu(rsp->result);
-	BT_DBG("result 0x%4.4x", rsp->result);
+	BT_DBG("result 0x%4.4x", result);
 	if (!result)
 		return 0;
 		return -ENOBUFS;
 	}
-	if (chan->imtu < skb->len) {
+	if (skb->len > chan->imtu) {
-		BT_ERR("Too big LE L2CAP PDU");
+		BT_ERR("Too big LE L2CAP PDU: len %u > %u", skb->len,
+		       chan->imtu);
+		l2cap_send_disconn_req(chan, ECONNRESET);
 		return -ENOBUFS;
 	}
 		       sdu_len, skb->len, chan->imtu);
 		if (sdu_len > chan->imtu) {
-			BT_ERR("Too big LE L2CAP SDU length received");
+			BT_ERR("Too big LE L2CAP SDU length: len %u > %u",
+			       skb->len, sdu_len);
+			l2cap_send_disconn_req(chan, ECONNRESET);
 			err = -EMSGSIZE;
 			goto failed;
 		}
 	if (chan->sdu->len + skb->len > chan->sdu_len) {
 		BT_ERR("Too much LE L2CAP data received");
+		l2cap_send_disconn_req(chan, ECONNRESET);
 		err = -EINVAL;
 		goto failed;
 	}

net/bluetooth/mgmt.c+2−5

 	sk = cmd->sk;
 	if (status) {
-		mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
+		mgmt_cmd_status(cmd->sk, hdev->id, cmd->opcode, status);
-				status);
-		mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev, true,
-				     cmd_status_rsp, &status);
 		goto done;
 	}
 	mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
 			  mgmt_status(status), &rp, sizeof(rp));
-	mgmt_pending_remove(cmd);
+	mgmt_pending_free(cmd);
 	hci_dev_unlock(hdev);
 	bt_dev_dbg(hdev, "add monitor %d complete, status %d",

net/bluetooth/smp.c+1−1

@@ -2743,7 +2743,7 @@ static int smp_cmd_public_key(struct l2cap_conn conn, struct sk_buff skb) · 2742 unmodified lines
2743	if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) &&	2743	if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) &&
2744	!crypto_memneq(key, smp->local_pk, 64)) {	2744	!crypto_memneq(key, smp->local_pk, 64)) {
2745	bt_dev_err(hdev, "Remote and local public keys are identical");	2745	bt_dev_err(hdev, "Remote and local public keys are identical");
2746	return SMP_UNSPECIFIED;	2746	return SMP_DHKEY_CHECK_FAILED;
2747	}	2747	}
2748		2748
2749	memcpy(smp->remote_pk, key, 64);	2749	memcpy(smp->remote_pk, key, 64);

net/bridge/br_cfm.c+2−2

@@ -576,7 +576,7 @@ static void mep_delete_implementation(struct net_bridge *br, · 575 unmodified lines
576		576
577	/* Empty and free peer MEP list */	577	/* Empty and free peer MEP list */
578	hlist_for_each_entry_safe(peer_mep, n_store, &mep->peer_mep_list, head) {	578	hlist_for_each_entry_safe(peer_mep, n_store, &mep->peer_mep_list, head) {
579	cancel_delayed_work_sync(&peer_mep->ccm_rx_dwork);	579	disable_delayed_work_sync(&peer_mep->ccm_rx_dwork);
580	hlist_del_rcu(&peer_mep->head);	580	hlist_del_rcu(&peer_mep->head);
581	kfree_rcu(peer_mep, rcu);	581	kfree_rcu(peer_mep, rcu);
582	}	582	}
@@ -732,7 +732,7 @@ int br_cfm_cc_peer_mep_remove(struct net_bridge *br, const u32 instance, · 149 unmodified lines
732	return -ENOENT;	732	return -ENOENT;
733	}	733	}
734		734
735	cc_peer_disable(peer_mep);	735	disable_delayed_work_sync(&peer_mep->ccm_rx_dwork);
736		736
737	hlist_del_rcu(&peer_mep->head);	737	hlist_del_rcu(&peer_mep->head);
738	kfree_rcu(peer_mep, rcu);	738	kfree_rcu(peer_mep, rcu);

net/ethernet/eth.c+3−6

 }
 EXPORT_SYMBOL(eth_type_trans);
-/**
+int eth_header_parse(const struct sk_buff *skb, const struct net_device *dev,
- * eth_header_parse - extract hardware address from packet
+		     unsigned char *haddr)
- * @skb: packet to extract header from
- * @haddr: destination buffer
- */
-int eth_header_parse(const struct sk_buff *skb, unsigned char *haddr)
 {
 	const struct ethhdr *eth = eth_hdr(skb);
 	memcpy(haddr, eth->h_source, ETH_ALEN);
 	return ETH_ALEN;
 }

net/ipv4/icmp.c+3−1

 static bool icmp_tag_validation(int proto)
 {
+	const struct net_protocol *ipprot;
 	bool ok;
 	rcu_read_lock();
-	ok = rcu_dereference(inet_protos[proto])->icmp_strict_tag_validation;
+	ipprot = rcu_dereference(inet_protos[proto]);
+	ok = ipprot ? ipprot->icmp_strict_tag_validation : false;
 	rcu_read_unlock();
 	return ok;
 }

net/ipv4/ip_gre.c+2−1

@@ -919,7 +919,8 @@ static int ipgre_header(struct sk_buff skb, struct net_device dev, · 918 unmodified lines
919	return -(t->hlen + sizeof(*iph));	919	return -(t->hlen + sizeof(*iph));
920	}	920	}
921		921
922	static int ipgre_header_parse(const struct sk_buff skb, unsigned char haddr)	922	static int ipgre_header_parse(const struct sk_buff skb, const struct net_device dev,
		923	unsigned char *haddr)
923	{	924	{
924	const struct iphdr iph = (const struct iphdr ) skb_mac_header(skb);	925	const struct iphdr iph = (const struct iphdr ) skb_mac_header(skb);
925	memcpy(haddr, &iph->saddr, 4);	926	memcpy(haddr, &iph->saddr, 4);

net/ipv6/exthdrs.c+4−0

 	hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 	idev = __in6_dev_get(skb->dev);
+	if (!idev) {
+		kfree_skb(skb);
+		return -1;
+	}
 	accept_seg6 = min(READ_ONCE(net->ipv6.devconf_all->seg6_enabled),
 			  READ_ONCE(idev->cnf.seg6_enabled));

net/ipv6/seg6_hmac.c+2−0

@@ -184,6 +184,8 @@ bool seg6_hmac_validate_skb(struct sk_buff *skb) · 183 unmodified lines
184	int require_hmac;	184	int require_hmac;
185		185
186	idev = __in6_dev_get(skb->dev);	186	idev = __in6_dev_get(skb->dev);
		187	if (!idev)
		188	return false;
187		189
188	srh = (struct ipv6_sr_hdr *)skb_transport_header(skb);	190	srh = (struct ipv6_sr_hdr *)skb_transport_header(skb);
189		191

net/mac80211/cfg.c+6−6

 	__sta_info_flush(sdata, true, link_id, NULL);
-	ieee80211_remove_link_keys(link, &keys);
-	if (!list_empty(&keys)) {
-		synchronize_net();
-		ieee80211_free_key_list(local, &keys);
-	}
 	ieee80211_stop_mbssid(sdata);
 	RCU_INIT_POINTER(link_conf->tx_bss_conf, NULL);
 	ieee80211_link_info_change_notify(sdata, link,
 					  BSS_CHANGED_BEACON_ENABLED);
+	ieee80211_remove_link_keys(link, &keys);
+	if (!list_empty(&keys)) {
+		synchronize_net();
+		ieee80211_free_key_list(local, &keys);
+	}
 	if (sdata->wdev.links[link_id].cac_started) {
 		chandef = link_conf->chanreq.oper;
 		wiphy_hrtimer_work_cancel(wiphy, &link->dfs_cac_timer_work);

net/mac80211/chan.c+4−2

 	rcu_read_lock();
 	list_for_each_entry_rcu(sta, &local->sta_list,
 				list) {
-		struct ieee80211_sub_if_data *sdata = sta->sdata;
+		struct ieee80211_sub_if_data *sdata;
 		enum ieee80211_sta_rx_bandwidth new_sta_bw;
 		unsigned int link_id;
 		if (!ieee80211_sdata_running(sta->sdata))
 			continue;
-		for (link_id = 0; link_id < ARRAY_SIZE(sta->sdata->link); link_id++) {
+		sdata = get_bss_sdata(sta->sdata);
+		for (link_id = 0; link_id < ARRAY_SIZE(sdata->link); link_id++) {
 			struct ieee80211_link_data *link =
 				rcu_dereference(sdata->link[link_id]);
 			struct ieee80211_bss_conf *link_conf;

net/mac80211/debugfs.c+5−9

 static ssize_t aql_enable_write(struct file *file, const char __user *user_buf,
 				size_t count, loff_t *ppos)
 {
-	bool aql_disabled = static_key_false(&aql_disable.key);
 	char buf[3];
 	size_t len;
 	if (len > 0 && buf[len - 1] == '\n')
 		buf[len - 1] = 0;
-	if (buf[0] == '0' && buf[1] == '\0') {
+	if (buf[0] == '0' && buf[1] == '\0')
-		if (!aql_disabled)
+		static_branch_enable(&aql_disable);
-			static_branch_inc(&aql_disable);
+	else if (buf[0] == '1' && buf[1] == '\0')
-	} else if (buf[0] == '1' && buf[1] == '\0') {
+		static_branch_disable(&aql_disable);
-		if (aql_disabled)
+	else
-			static_branch_dec(&aql_disable);
-	} else {
 		return -EINVAL;
-	}
 	return count;
 }

net/mac80211/mesh.c+3−0

 	 *   - MDA enabled
 	 * - Power management control on fc
 	 */
+	if (!ie->mesh_config)
+		return false;
 	if (!(ifmsh->mesh_id_len == ie->mesh_id_len &&
 	     memcmp(ifmsh->mesh_id, ie->mesh_id, ie->mesh_id_len) == 0 &&
 	     (ifmsh->mesh_pp_id == ie->mesh_config->meshconf_psel) &&

net/mac80211/sta_info.c+5−2

 	}
 	link_sinfo->inactive_time =
-		jiffies_to_msecs(jiffies - ieee80211_sta_last_active(sta, link_id));
+		jiffies_delta_to_msecs(jiffies -
+				       ieee80211_sta_last_active(sta,
+								 link_id));
 	if (!(link_sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES64) |
 				    BIT_ULL(NL80211_STA_INFO_TX_BYTES)))) {
 	sinfo->connected_time = ktime_get_seconds() - sta->last_connected;
 	sinfo->assoc_at = sta->assoc_at;
 	sinfo->inactive_time =
-		jiffies_to_msecs(jiffies - ieee80211_sta_last_active(sta, -1));
+		jiffies_delta_to_msecs(jiffies -
+				       ieee80211_sta_last_active(sta, -1));
 	if (!(sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES64) |
 			       BIT_ULL(NL80211_STA_INFO_TX_BYTES)))) {

net/mac80211/tdls.c+1−1

@@ -1449,7 +1449,7 @@ int ieee80211_tdls_oper(struct wiphy wiphy, struct net_device dev, · 1448 unmodified lines
1449	}	1449	}
1450		1450
1451	sta = sta_info_get(sdata, peer);	1451	sta = sta_info_get(sdata, peer);
1452	if (!sta)	1452	if (!sta \|\| !sta->sta.tdls)
1453	return -ENOLINK;	1453	return -ENOLINK;
1454		1454
1455	iee80211_tdls_recalc_chanctx(sdata, sta);	1455	iee80211_tdls_recalc_chanctx(sdata, sta);

net/mac80211/tx.c+3−1

 	struct ieee80211_tx_data tx;
 	struct sk_buff *skb2;
-	if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP)
+	if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP) {
+		kfree_skb(skb);
 		return false;
+	}
 	info->band = band;
 	info->control.vif = vif;

net/mac802154/iface.c+3−1

@@ -469,7 +469,9 @@ static int mac802154_header_create(struct sk_buff *skb, · 468 unmodified lines
469	}	469	}
470		470
471	static int	471	static int
472	mac802154_header_parse(const struct sk_buff skb, unsigned char haddr)	472	mac802154_header_parse(const struct sk_buff *skb,
		473	const struct net_device *dev,
		474	unsigned char *haddr)
473	{	475	{
474	struct ieee802154_hdr hdr;	476	struct ieee802154_hdr hdr;
475		477

net/mpls/af_mpls.c+1−0

@@ -2854,6 +2854,7 @@ out_unregister_rtnl_af: · 2853 unmodified lines
2854	rtnl_af_unregister(&mpls_af_ops);	2854	rtnl_af_unregister(&mpls_af_ops);
2855	out_unregister_dev_type:	2855	out_unregister_dev_type:
2856	dev_remove_pack(&mpls_packet_type);	2856	dev_remove_pack(&mpls_packet_type);
		2857	unregister_netdevice_notifier(&mpls_dev_notifier);
2857	out_unregister_pernet:	2858	out_unregister_pernet:
2858	unregister_pernet_subsys(&mpls_net_ops);	2859	unregister_pernet_subsys(&mpls_net_ops);
2859	goto out;	2860	goto out;

net/mptcp/pm_kernel.c+1−1

@@ -838,7 +838,7 @@ static struct lock_class_key mptcp_keys[2]; · 837 unmodified lines
838	static int mptcp_pm_nl_create_listen_socket(struct sock *sk,	838	static int mptcp_pm_nl_create_listen_socket(struct sock *sk,
839	struct mptcp_pm_addr_entry *entry)	839	struct mptcp_pm_addr_entry *entry)
840	{	840	{
841	bool is_ipv6 = sk->sk_family == AF_INET6;	841	bool is_ipv6 = entry->addr.family == AF_INET6;
842	int addrlen = sizeof(struct sockaddr_in);	842	int addrlen = sizeof(struct sockaddr_in);
843	struct sockaddr_storage addr;	843	struct sockaddr_storage addr;
844	struct sock newsk, ssk;	844	struct sock newsk, ssk;

net/netfilter/nf_bpf_link.c+1−1

@@ -170,7 +170,7 @@ static int bpf_nf_link_update(struct bpf_link link, struct bpf_prog new_prog, · 169 unmodified lines
170		170
171	static const struct bpf_link_ops bpf_nf_link_lops = {	171	static const struct bpf_link_ops bpf_nf_link_lops = {
172	.release = bpf_nf_link_release,	172	.release = bpf_nf_link_release,
173	.dealloc = bpf_nf_link_dealloc,	173	.dealloc_deferred = bpf_nf_link_dealloc,
174	.detach = bpf_nf_link_detach,	174	.detach = bpf_nf_link_detach,
175	.show_fdinfo = bpf_nf_link_show_info,	175	.show_fdinfo = bpf_nf_link_show_info,
176	.fill_link_info = bpf_nf_link_fill_link_info,	176	.fill_link_info = bpf_nf_link_fill_link_info,

net/netfilter/nf_conntrack_h323_asn1.c+4−0

 		if (nf_h323_error_boundary(bs, 0, 2))
 			return H323_ERROR_BOUND;
 		len = get_bits(bs, 2) + 1;
+		if (nf_h323_error_boundary(bs, len, 0))
+			return H323_ERROR_BOUND;
 		BYTE_ALIGN(bs);
 		if (base && (f->attr & DECODE)) {	/* timeToLive */
 			unsigned int v = get_uint(bs, len) + f->lb;
 				break;
 			p++;
 			len--;
+			if (len <= 0)
+				break;
 			return DecodeH323_UserInformation(buf, p, len,
 							  &q931->UUIE);
 		}

net/netfilter/nf_conntrack_netlink.c+26−2

 {
 	struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
 	struct nf_conn *ct = cb->data;
-	struct nf_conn_help *help = nfct_help(ct);
+	struct nf_conn_help *help;
 	u_int8_t l3proto = nfmsg->nfgen_family;
 	unsigned long last_id = cb->args[1];
 	struct nf_conntrack_expect *exp;
 	if (cb->args[0])
 		return 0;
+	help = nfct_help(ct);
+	if (!help)
+		return 0;
 	rcu_read_lock();
 restart:
 	return skb->len;
 }
+static int ctnetlink_dump_exp_ct_start(struct netlink_callback *cb)
+{
+	struct nf_conn *ct = cb->data;
+	if (!refcount_inc_not_zero(&ct->ct_general.use))
+		return -ENOENT;
+	return 0;
+}
+static int ctnetlink_dump_exp_ct_done(struct netlink_callback *cb)
+{
+	struct nf_conn *ct = cb->data;
+	if (ct)
+		nf_ct_put(ct);
+	return 0;
+}
 static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl,
 				 struct sk_buff *skb,
 				 const struct nlmsghdr *nlh,
 	struct nf_conntrack_zone zone;
 	struct netlink_dump_control c = {
 		.dump = ctnetlink_exp_ct_dump_table,
+		.start = ctnetlink_dump_exp_ct_start,
+		.done = ctnetlink_dump_exp_ct_done,
 	};
 	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER,
 #if IS_ENABLED(CONFIG_NF_NAT)
 static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = {
-	[CTA_EXPECT_NAT_DIR]	= { .type = NLA_U32 },
+	[CTA_EXPECT_NAT_DIR]	= NLA_POLICY_MAX(NLA_BE32, IP_CT_DIR_REPLY),
 	[CTA_EXPECT_NAT_TUPLE]	= { .type = NLA_NESTED },
 };
 #endif

net/netfilter/nf_conntrack_proto_sctp.c+2−1

@@ -582,7 +582,8 @@ nla_put_failure: · 581 unmodified lines
582	}	582	}
583		583
584	static const struct nla_policy sctp_nla_policy[CTA_PROTOINFO_SCTP_MAX+1] = {	584	static const struct nla_policy sctp_nla_policy[CTA_PROTOINFO_SCTP_MAX+1] = {
585	[CTA_PROTOINFO_SCTP_STATE] = { .type = NLA_U8 },	585	[CTA_PROTOINFO_SCTP_STATE] = NLA_POLICY_MAX(NLA_U8,
		586	SCTP_CONNTRACK_HEARTBEAT_SENT),
586	[CTA_PROTOINFO_SCTP_VTAG_ORIGINAL] = { .type = NLA_U32 },	587	[CTA_PROTOINFO_SCTP_VTAG_ORIGINAL] = { .type = NLA_U32 },
587	[CTA_PROTOINFO_SCTP_VTAG_REPLY] = { .type = NLA_U32 },	588	[CTA_PROTOINFO_SCTP_VTAG_REPLY] = { .type = NLA_U32 },
588	};	589	};

net/netfilter/nf_conntrack_sip.c+5−1

 {
 	struct tcphdr *th, _tcph;
 	unsigned int dataoff, datalen;
-	unsigned int matchoff, matchlen, clen;
+	unsigned int matchoff, matchlen;
 	unsigned int msglen, origlen;
 	const char *dptr, *end;
 	s16 diff, tdiff = 0;
 	int ret = NF_ACCEPT;
+	unsigned long clen;
 	bool term;
 	if (ctinfo != IP_CT_ESTABLISHED &&
 		if (dptr + matchoff == end)
 			break;
+		if (clen > datalen)
+			break;
 		term = false;
 		for (; end + strlen("\r\n\r\n") <= dptr + datalen; end++) {
 			if (end[0] == '\r' && end[1] == '\n' &&

net/netfilter/nf_flow_table_ip.c+1−0

@@ -738,6 +738,7 @@ static int nf_flow_encap_push(struct sk_buff *skb, · 737 unmodified lines
738	switch (tuple->encap[i].proto) {	738	switch (tuple->encap[i].proto) {
739	case htons(ETH_P_8021Q):	739	case htons(ETH_P_8021Q):
740	case htons(ETH_P_8021AD):	740	case htons(ETH_P_8021AD):
		741	skb_reset_mac_header(skb);
741	if (skb_vlan_push(skb, tuple->encap[i].proto,	742	if (skb_vlan_push(skb, tuple->encap[i].proto,
742	tuple->encap[i].id) < 0)	743	tuple->encap[i].id) < 0)
743	return -1;	744	return -1;

net/netfilter/nf_tables_api.c+7−19

 	}
 }
-static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
+void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
-				      struct nft_set_elem_expr *elem_expr)
+			       struct nft_set_elem_expr *elem_expr)
 {
 	struct nft_expr *expr;
 	u32 size;
 }
 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
-			    const struct nlattr *attr, u32 nlmsg_flags,
+			    const struct nlattr *attr, u32 nlmsg_flags)
-			    bool last)
 {
 	struct nft_expr *expr_array[NFT_SET_EXPR_MAX] = {};
 	struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
 	if (flags)
 		*nft_set_ext_flags(ext) = flags;
-	if (last)
-		elem.flags = NFT_SET_ELEM_INTERNAL_LAST;
-	else
-		elem.flags = 0;
 	if (obj)
 		*nft_set_ext_obj(ext) = obj;
 	nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
 	nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
-		err = nft_add_set_elem(&ctx, set, attr, info->nlh->nlmsg_flags,
+		err = nft_add_set_elem(&ctx, set, attr, info->nlh->nlmsg_flags);
-				       nla_is_last(attr, rem));
 		if (err < 0) {
 			NL_SET_BAD_ATTR(extack, attr);
 			return err;
 }
 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
-			   const struct nlattr *attr, bool last)
+			   const struct nlattr *attr)
 {
 	struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
 	struct nft_set_ext_tmpl tmpl;
 	if (flags)
 		*nft_set_ext_flags(ext) = flags;
-	if (last)
-		elem.flags = NFT_SET_ELEM_INTERNAL_LAST;
-	else
-		elem.flags = 0;
 	trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
 	if (trans == NULL)
 		goto fail_trans;
 		return nft_set_flush(&ctx, set, genmask);
 	nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
-		err = nft_del_setelem(&ctx, set, attr,
+		err = nft_del_setelem(&ctx, set, attr);
-				      nla_is_last(attr, rem));
 		if (err == -ENOENT &&
 		    NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYSETELEM)
 			continue;
 	return 0;
 err_flowtable_hooks:
+	synchronize_rcu();
 	nft_trans_destroy(trans);
 err_flowtable_trans:
 	nft_hooks_destroy(&flowtable->hook_list);

net/netfilter/nfnetlink_osf.c+13−0

 {
 	struct nf_osf_user_finger *f;
 	struct nf_osf_finger *kf = NULL, *sf;
+	unsigned int tot_opt_len = 0;
 	int err = 0;
+	int i;
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
 	if (f->opt_num > ARRAY_SIZE(f->opt))
 		return -EINVAL;
+	for (i = 0; i < f->opt_num; i++) {
+		if (!f->opt[i].length || f->opt[i].length > MAX_IPOPTLEN)
+			return -EINVAL;
+		if (f->opt[i].kind == OSFOPT_MSS && f->opt[i].length < 4)
+			return -EINVAL;
+		tot_opt_len += f->opt[i].length;
+		if (tot_opt_len > MAX_IPOPTLEN)
+			return -EINVAL;
+	}
 	if (!memchr(f->genre, 0, MAXGENRELEN) ||
 	    !memchr(f->subtype, 0, MAXGENRELEN) ||
 	    !memchr(f->version, 0, MAXGENRELEN))

net/netfilter/nft_ct.c+4−0

 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_conntrack_seqadj.h>
+#include "nf_internals.h"
 struct nft_ct_helper_obj  {
 	struct nf_conntrack_helper *helper4;
 #endif
 #ifdef CONFIG_NF_CONNTRACK_ZONES
 	case NFT_CT_ZONE:
+		nf_queue_nf_hook_drop(ctx->net);
 		mutex_lock(&nft_ct_pcpu_mutex);
 		if (--nft_ct_pcpu_template_refcnt == 0)
 			nft_ct_tmpl_put_pcpu();
 	struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 	struct nf_ct_timeout *timeout = priv->timeout;
+	nf_queue_nf_hook_drop(ctx->net);
 	nf_ct_untimeout(ctx->net, timeout);
 	nf_ct_netns_put(ctx->net, ctx->family);
 	kfree(priv->timeout);
 {
 	struct nft_ct_helper_obj *priv = nft_obj_data(obj);
+	nf_queue_nf_hook_drop(ctx->net);
 	if (priv->helper4)
 		nf_conntrack_helper_put(priv->helper4);
 	if (priv->helper6)

net/netfilter/nft_dynset.c+9−1

 				 const struct nft_set_ext *ext)
 {
 	struct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext);
+	struct nft_ctx ctx = {
+		.net	= read_pnet(&priv->set->net),
+		.family	= priv->set->table->family,
+	};
 	struct nft_expr *expr;
 	int i;
 	for (i = 0; i < priv->num_exprs; i++) {
 		expr = nft_setelem_expr_at(elem_expr, elem_expr->size);
 		if (nft_expr_clone(expr, priv->expr_array[i], GFP_ATOMIC) < 0)
-			return -1;
+			goto err_out;
 		elem_expr->size += priv->expr_array[i]->ops->size;
 	}
 	return 0;
+err_out:
+	nft_set_elem_expr_destroy(&ctx, elem_expr);
+	return -1;
 }
 struct nft_elem_priv *nft_dynset_new(struct nft_set *set,

net/netfilter/nft_set_rbtree.c+10−61

@@ -304,19 +304,10 @@ static void nft_rbtree_set_start_cookie(struct nft_rbtree *priv, · 303 unmodified lines
304	priv->start_rbe_cookie = (unsigned long)rbe;	304	priv->start_rbe_cookie = (unsigned long)rbe;
305	}	305	}
306		306
307	static void nft_rbtree_set_start_cookie_open(struct nft_rbtree *priv,
308	const struct nft_rbtree_elem *rbe,
309	unsigned long open_interval)
310	{
311	priv->start_rbe_cookie = (unsigned long)rbe \| open_interval;
312	}
313
314	#define NFT_RBTREE_OPEN_INTERVAL 1UL
315
316	static bool nft_rbtree_cmp_start_cookie(struct nft_rbtree *priv,	307	static bool nft_rbtree_cmp_start_cookie(struct nft_rbtree *priv,
317	const struct nft_rbtree_elem *rbe)	308	const struct nft_rbtree_elem *rbe)
318	{	309	{
319	return (priv->start_rbe_cookie & ~NFT_RBTREE_OPEN_INTERVAL) == (unsigned long)rbe;	310	return priv->start_rbe_cookie == (unsigned long)rbe;
320	}	311	}
321		312
322	static bool nft_rbtree_insert_same_interval(const struct net *net,	313	static bool nft_rbtree_insert_same_interval(const struct net *net,
@@ -346,14 +337,13 @@ static bool nft_rbtree_insert_same_interval(const struct net *net, · 23 unmodified lines
346		337
347	static int __nft_rbtree_insert(const struct net net, const struct nft_set set,	338	static int __nft_rbtree_insert(const struct net net, const struct nft_set set,
348	struct nft_rbtree_elem *new,	339	struct nft_rbtree_elem *new,
349	struct nft_elem_priv **elem_priv, u64 tstamp, bool last)	340	struct nft_elem_priv **elem_priv, u64 tstamp)
350	{	341	{
351	struct nft_rbtree_elem rbe, rbe_le = NULL, rbe_ge = NULL, rbe_prev;	342	struct nft_rbtree_elem rbe, rbe_le = NULL, rbe_ge = NULL, rbe_prev;
352	struct rb_node node, next, parent, p, first = NULL;	343	struct rb_node node, next, parent, p, first = NULL;
353	struct nft_rbtree *priv = nft_set_priv(set);	344	struct nft_rbtree *priv = nft_set_priv(set);
354	u8 cur_genmask = nft_genmask_cur(net);	345	u8 cur_genmask = nft_genmask_cur(net);
355	u8 genmask = nft_genmask_next(net);	346	u8 genmask = nft_genmask_next(net);
356	unsigned long open_interval = 0;
357	int d;	347	int d;
358		348
359	/* Descend the tree to search for an existing element greater than the	349	/* Descend the tree to search for an existing element greater than the
@@ -459,18 +449,10 @@ static int __nft_rbtree_insert(const struct net net, const struct nft_set set, · 99 unmodified lines
459	}	449	}
460	}	450	}
461		451
462	if (nft_rbtree_interval_null(set, new)) {	452	if (nft_rbtree_interval_null(set, new))
		453	priv->start_rbe_cookie = 0;
		454	else if (nft_rbtree_interval_start(new) && priv->start_rbe_cookie)
463	priv->start_rbe_cookie = 0;	455	priv->start_rbe_cookie = 0;
464	} else if (nft_rbtree_interval_start(new) && priv->start_rbe_cookie) {
465	if (nft_set_is_anonymous(set)) {
466	priv->start_rbe_cookie = 0;
467	} else if (priv->start_rbe_cookie & NFT_RBTREE_OPEN_INTERVAL) {
468	/* Previous element is an open interval that partially
469	* overlaps with an existing non-open interval.
470	*/
471	return -ENOTEMPTY;
472	}
473	}
474		456
475	/* - new start element matching existing start element: full overlap	457	/* - new start element matching existing start element: full overlap
476	* reported as -EEXIST, cleared by caller if NLM_F_EXCL is not given.	458	* reported as -EEXIST, cleared by caller if NLM_F_EXCL is not given.
@@ -478,27 +460,7 @@ static int __nft_rbtree_insert(const struct net net, const struct nft_set set, · 1 unmodified line
478	if (rbe_ge && !nft_rbtree_cmp(set, new, rbe_ge) &&	460	if (rbe_ge && !nft_rbtree_cmp(set, new, rbe_ge) &&
479	nft_rbtree_interval_start(rbe_ge) == nft_rbtree_interval_start(new)) {	461	nft_rbtree_interval_start(rbe_ge) == nft_rbtree_interval_start(new)) {
480	*elem_priv = &rbe_ge->priv;	462	*elem_priv = &rbe_ge->priv;
481		463	nft_rbtree_set_start_cookie(priv, rbe_ge);
482	/* - Corner case: new start element of open interval (which
483	* comes as last element in the batch) overlaps the start of
484	* an existing interval with an end element: partial overlap.
485	*/
486	node = rb_first(&priv->root);
487	rbe = __nft_rbtree_next_active(node, genmask);
488	if (rbe && nft_rbtree_interval_end(rbe)) {
489	rbe = nft_rbtree_next_active(rbe, genmask);
490	if (rbe &&
491	nft_rbtree_interval_start(rbe) &&
492	!nft_rbtree_cmp(set, new, rbe)) {
493	if (last)
494	return -ENOTEMPTY;
495
496	/* Maybe open interval? */
497	open_interval = NFT_RBTREE_OPEN_INTERVAL;
498	}
499	}
500	nft_rbtree_set_start_cookie_open(priv, rbe_ge, open_interval);
501
502	return -EEXIST;	464	return -EEXIST;
503	}	465	}
504		466
@@ -553,12 +515,6 @@ static int __nft_rbtree_insert(const struct net net, const struct nft_set set, · 48 unmodified lines
553	nft_rbtree_interval_end(rbe_ge) && nft_rbtree_interval_end(new))	515	nft_rbtree_interval_end(rbe_ge) && nft_rbtree_interval_end(new))
554	return -ENOTEMPTY;	516	return -ENOTEMPTY;
555		517
556	/* - start element overlaps an open interval but end element is new:
557	* partial overlap, reported as -ENOEMPTY.
558	*/
559	if (!rbe_ge && priv->start_rbe_cookie && nft_rbtree_interval_end(new))
560	return -ENOTEMPTY;
561
562	/* Accepted element: pick insertion point depending on key value */	518	/* Accepted element: pick insertion point depending on key value */
563	parent = NULL;	519	parent = NULL;
564	p = &priv->root.rb_node;	520	p = &priv->root.rb_node;
@@ -668,7 +624,6 @@ static int nft_rbtree_insert(const struct net net, const struct nft_set set, · 103 unmodified lines
668	struct nft_elem_priv **elem_priv)	624	struct nft_elem_priv **elem_priv)
669	{	625	{
670	struct nft_rbtree_elem *rbe = nft_elem_priv_cast(elem->priv);	626	struct nft_rbtree_elem *rbe = nft_elem_priv_cast(elem->priv);
671	bool last = !!(elem->flags & NFT_SET_ELEM_INTERNAL_LAST);
672	struct nft_rbtree *priv = nft_set_priv(set);	627	struct nft_rbtree *priv = nft_set_priv(set);
673	u64 tstamp = nft_net_tstamp(net);	628	u64 tstamp = nft_net_tstamp(net);
674	int err;	629	int err;
@@ -685,12 +640,8 @@ static int nft_rbtree_insert(const struct net net, const struct nft_set set, · 10 unmodified lines
685	cond_resched();	640	cond_resched();
686		641
687	write_lock_bh(&priv->lock);	642	write_lock_bh(&priv->lock);
688	err = __nft_rbtree_insert(net, set, rbe, elem_priv, tstamp, last);	643	err = __nft_rbtree_insert(net, set, rbe, elem_priv, tstamp);
689	write_unlock_bh(&priv->lock);	644	write_unlock_bh(&priv->lock);
690
691	if (nft_rbtree_interval_end(rbe))
692	priv->start_rbe_cookie = 0;
693
694	} while (err == -EAGAIN);	645	} while (err == -EAGAIN);
695		646
696	return err;	647	return err;
@@ -778,7 +729,6 @@ nft_rbtree_deactivate(const struct net net, const struct nft_set set, · 81 unmodified lines
778	const struct nft_set_elem *elem)	729	const struct nft_set_elem *elem)
779	{	730	{
780	struct nft_rbtree_elem rbe, this = nft_elem_priv_cast(elem->priv);	731	struct nft_rbtree_elem rbe, this = nft_elem_priv_cast(elem->priv);
781	bool last = !!(elem->flags & NFT_SET_ELEM_INTERNAL_LAST);
782	struct nft_rbtree *priv = nft_set_priv(set);	732	struct nft_rbtree *priv = nft_set_priv(set);
783	const struct rb_node *parent = priv->root.rb_node;	733	const struct rb_node *parent = priv->root.rb_node;
784	u8 genmask = nft_genmask_next(net);	734	u8 genmask = nft_genmask_next(net);
@@ -819,10 +769,9 @@ nft_rbtree_deactivate(const struct net net, const struct nft_set set, · 34 unmodified lines
819	continue;	769	continue;
820	}	770	}
821		771
822	if (nft_rbtree_interval_start(rbe)) {	772	if (nft_rbtree_interval_start(rbe))
823	if (!last)	773	nft_rbtree_set_start_cookie(priv, rbe);
824	nft_rbtree_set_start_cookie(priv, rbe);	774	else if (!nft_rbtree_deactivate_same_interval(net, priv, rbe))
825	} else if (!nft_rbtree_deactivate_same_interval(net, priv, rbe))
826	return NULL;	775	return NULL;
827		776
828	nft_rbtree_flush(net, set, &rbe->priv);	777	nft_rbtree_flush(net, set, &rbe->priv);

net/netfilter/xt_CT.c+4−0

 #include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_conntrack_timeout.h>
 #include <net/netfilter/nf_conntrack_zones.h>
+#include "nf_internals.h"
 static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
 {
 	struct nf_conn_help *help;
 	if (ct) {
+		if (info->helper[0] || info->timeout[0])
+			nf_queue_nf_hook_drop(par->net);
 		help = nfct_help(ct);
 		xt_ct_put_helper(help);

net/netfilter/xt_time.c+2−2

@@ -223,13 +223,13 @@ time_mt(const struct sk_buff skb, struct xt_action_param par) · 222 unmodified lines
223		223
224	localtime_2(&current_time, stamp);	224	localtime_2(&current_time, stamp);
225		225
226	if (!(info->weekdays_match & (1 << current_time.weekday)))	226	if (!(info->weekdays_match & (1U << current_time.weekday)))
227	return false;	227	return false;
228		228
229	/* Do not spend time computing monthday if all days match anyway */	229	/* Do not spend time computing monthday if all days match anyway */
230	if (info->monthdays_match != XT_TIME_ALL_MONTHDAYS) {	230	if (info->monthdays_match != XT_TIME_ALL_MONTHDAYS) {
231	localtime_3(&current_time, stamp);	231	localtime_3(&current_time, stamp);
232	if (!(info->monthdays_match & (1 << current_time.monthday)))	232	if (!(info->monthdays_match & (1U << current_time.monthday)))
233	return false;	233	return false;
234	}	234	}
235		235

net/phonet/af_phonet.c+4−1

 	return 1;
 }
-static int pn_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+static int pn_header_parse(const struct sk_buff *skb,
+			   const struct net_device *dev,
+			   unsigned char *haddr)
 {
 	const u8 *media = skb_mac_header(skb);
 	*haddr = *media;
 	return 1;
 }

net/rose/af_rose.c+5−0

 		goto out_release;
 	}
+	if (sk->sk_state == TCP_SYN_SENT) {
+		err = -EALREADY;
+		goto out_release;
+	}
 	sk->sk_state   = TCP_CLOSE;
 	sock->state = SS_UNCONNECTED;

net/sched/sch_generic.c+0−27

@@ -1288,33 +1288,6 @@ static void dev_deactivate_queue(struct net_device *dev, · 1287 unmodified lines
1288	}	1288	}
1289	}	1289	}
1290		1290
1291	static void dev_reset_queue(struct net_device *dev,
1292	struct netdev_queue *dev_queue,
1293	void *_unused)
1294	{
1295	struct Qdisc *qdisc;
1296	bool nolock;
1297
1298	qdisc = rtnl_dereference(dev_queue->qdisc_sleeping);
1299	if (!qdisc)
1300	return;
1301
1302	nolock = qdisc->flags & TCQ_F_NOLOCK;
1303
1304	if (nolock)
1305	spin_lock_bh(&qdisc->seqlock);
1306	spin_lock_bh(qdisc_lock(qdisc));
1307
1308	qdisc_reset(qdisc);
1309
1310	spin_unlock_bh(qdisc_lock(qdisc));
1311	if (nolock) {
1312	clear_bit(__QDISC_STATE_MISSED, &qdisc->state);
1313	clear_bit(__QDISC_STATE_DRAINING, &qdisc->state);
1314	spin_unlock_bh(&qdisc->seqlock);
1315	}
1316	}
1317
1318	static bool some_qdisc_is_busy(struct net_device *dev)	1291	static bool some_qdisc_is_busy(struct net_device *dev)
1319	{	1292	{
1320	unsigned int i;	1293	unsigned int i;

net/sched/sch_ingress.c+8−6

 {
 	struct ingress_sched_data *q = qdisc_priv(sch);
 	struct net_device *dev = qdisc_dev(sch);
-	struct bpf_mprog_entry *entry = rtnl_dereference(dev->tcx_ingress);
+	struct bpf_mprog_entry *entry;
 	if (sch->parent != TC_H_INGRESS)
 		return;
 	tcf_block_put_ext(q->block, sch, &q->block_info);
-	if (entry) {
+	if (mini_qdisc_pair_inited(&q->miniqp)) {
+		entry = rtnl_dereference(dev->tcx_ingress);
 		tcx_miniq_dec(entry);
 		if (!tcx_entry_is_active(entry)) {
 			tcx_entry_update(dev, NULL, true);
 static void clsact_destroy(struct Qdisc *sch)
 {
+	struct bpf_mprog_entry *ingress_entry, *egress_entry;
 	struct clsact_sched_data *q = qdisc_priv(sch);
 	struct net_device *dev = qdisc_dev(sch);
-	struct bpf_mprog_entry *ingress_entry = rtnl_dereference(dev->tcx_ingress);
-	struct bpf_mprog_entry *egress_entry = rtnl_dereference(dev->tcx_egress);
 	if (sch->parent != TC_H_CLSACT)
 		return;
 	tcf_block_put_ext(q->ingress_block, sch, &q->ingress_block_info);
 	tcf_block_put_ext(q->egress_block, sch, &q->egress_block_info);
-	if (ingress_entry) {
+	if (mini_qdisc_pair_inited(&q->miniqp_ingress)) {
+		ingress_entry = rtnl_dereference(dev->tcx_ingress);
 		tcx_miniq_dec(ingress_entry);
 		if (!tcx_entry_is_active(ingress_entry)) {
 			tcx_entry_update(dev, NULL, true);
 		}
 	}
-	if (egress_entry) {
+	if (mini_qdisc_pair_inited(&q->miniqp_egress)) {
+		egress_entry = rtnl_dereference(dev->tcx_egress);
 		tcx_miniq_dec(egress_entry);
 		if (!tcx_entry_is_active(egress_entry)) {
 			tcx_entry_update(dev, NULL, false);

net/sched/sch_teql.c+2−5

 					master->slaves = NEXT_SLAVE(q);
 					if (q == master->slaves) {
 						struct netdev_queue *txq;
-						spinlock_t *root_lock;
 						txq = netdev_get_tx_queue(master->dev, 0);
 						master->slaves = NULL;
-						root_lock = qdisc_root_sleeping_lock(rtnl_dereference(txq->qdisc));
+						dev_reset_queue(master->dev,
-						spin_lock_bh(root_lock);
+								txq, NULL);
-						qdisc_reset(rtnl_dereference(txq->qdisc));
-						spin_unlock_bh(root_lock);
 					}
 				}
 				skb_queue_purge(&dat->q);

net/shaper/shaper.c+93−65

 	return &((struct net_shaper_nl_ctx *)ctx)->binding;
 }
-static void net_shaper_lock(struct net_shaper_binding *binding)
+static struct net_shaper_hierarchy *
+net_shaper_hierarchy(struct net_shaper_binding *binding)
 {
-	switch (binding->type) {
+	/* Pairs with WRITE_ONCE() in net_shaper_hierarchy_setup. */
-	case NET_SHAPER_BINDING_TYPE_NETDEV:
+	if (binding->type == NET_SHAPER_BINDING_TYPE_NETDEV)
-		netdev_lock(binding->netdev);
+		return READ_ONCE(binding->netdev->net_shaper_hierarchy);
-		break;
-	}
-}
-static void net_shaper_unlock(struct net_shaper_binding *binding)
+	/* No other type supported yet. */
-{
+	return NULL;
-	switch (binding->type) {
-	case NET_SHAPER_BINDING_TYPE_NETDEV:
-		netdev_unlock(binding->netdev);
-		break;
-	}
 }
 static struct net_shaper_hierarchy *
-net_shaper_hierarchy(struct net_shaper_binding *binding)
+net_shaper_hierarchy_rcu(struct net_shaper_binding *binding)
 {
-	/* Pairs with WRITE_ONCE() in net_shaper_hierarchy_setup. */
+	/* Readers look up the device and take a ref, then take RCU lock
-	if (binding->type == NET_SHAPER_BINDING_TYPE_NETDEV)
+	 * later at which point netdev may have been unregistered and flushed.
+	 * READ_ONCE() pairs with WRITE_ONCE() in net_shaper_hierarchy_setup.
+	 */
+	if (binding->type == NET_SHAPER_BINDING_TYPE_NETDEV &&
+	    READ_ONCE(binding->netdev->reg_state) <= NETREG_REGISTERED)
 		return READ_ONCE(binding->netdev->net_shaper_hierarchy);
 	/* No other type supported yet. */
 	return 0;
 }
+/* Like net_shaper_ctx_setup(), but for "write" handlers (never for dumps!)
+ * Acquires the lock protecting the hierarchy (instance lock for netdev).
+ */
+static int net_shaper_ctx_setup_lock(const struct genl_info *info, int type,
+				     struct net_shaper_nl_ctx *ctx)
+{
+	struct net *ns = genl_info_net(info);
+	struct net_device *dev;
+	int ifindex;
+	if (GENL_REQ_ATTR_CHECK(info, type))
+		return -EINVAL;
+	ifindex = nla_get_u32(info->attrs[type]);
+	dev = netdev_get_by_index_lock(ns, ifindex);
+	if (!dev) {
+		NL_SET_BAD_ATTR(info->extack, info->attrs[type]);
+		return -ENOENT;
+	}
+	if (!dev->netdev_ops->net_shaper_ops) {
+		NL_SET_BAD_ATTR(info->extack, info->attrs[type]);
+		netdev_unlock(dev);
+		return -EOPNOTSUPP;
+	}
+	ctx->binding.type = NET_SHAPER_BINDING_TYPE_NETDEV;
+	ctx->binding.netdev = dev;
+	return 0;
+}
 static void net_shaper_ctx_cleanup(struct net_shaper_nl_ctx *ctx)
 {
 	if (ctx->binding.type == NET_SHAPER_BINDING_TYPE_NETDEV)
 		netdev_put(ctx->binding.netdev, &ctx->dev_tracker);
 }
+static void net_shaper_ctx_cleanup_unlock(struct net_shaper_nl_ctx *ctx)
+{
+	if (ctx->binding.type == NET_SHAPER_BINDING_TYPE_NETDEV)
+		netdev_unlock(ctx->binding.netdev);
+}
 static u32 net_shaper_handle_to_index(const struct net_shaper_handle *handle)
 {
 	return FIELD_PREP(NET_SHAPER_SCOPE_MASK, handle->scope) |
 net_shaper_lookup(struct net_shaper_binding *binding,
 		  const struct net_shaper_handle *handle)
 {
-	struct net_shaper_hierarchy *hierarchy = net_shaper_hierarchy(binding);
 	u32 index = net_shaper_handle_to_index(handle);
+	struct net_shaper_hierarchy *hierarchy;
+	hierarchy = net_shaper_hierarchy_rcu(binding);
 	if (!hierarchy || xa_get_mark(&hierarchy->shapers, index,
 				      NET_SHAPER_NOT_VALID))
 		return NULL;
 }
 /* Allocate on demand the per device shaper's hierarchy container.
- * Called under the net shaper lock
+ * Called under the lock protecting the hierarchy (instance lock for netdev)
  */
 static struct net_shaper_hierarchy *
 net_shaper_hierarchy_setup(struct net_shaper_binding *binding)
 	net_shaper_generic_post(info);
 }
+int net_shaper_nl_pre_doit_write(const struct genl_split_ops *ops,
+				struct sk_buff *skb, struct genl_info *info)
+{
+	struct net_shaper_nl_ctx *ctx = (struct net_shaper_nl_ctx *)info->ctx;
+	BUILD_BUG_ON(sizeof(*ctx) > sizeof(info->ctx));
+	return net_shaper_ctx_setup_lock(info, NET_SHAPER_A_IFINDEX, ctx);
+}
+void net_shaper_nl_post_doit_write(const struct genl_split_ops *ops,
+				   struct sk_buff *skb, struct genl_info *info)
+{
+	net_shaper_ctx_cleanup_unlock((struct net_shaper_nl_ctx *)info->ctx);
+}
 int net_shaper_nl_pre_dumpit(struct netlink_callback *cb)
 {
 	struct net_shaper_nl_ctx *ctx = (struct net_shaper_nl_ctx *)cb->ctx;
 	/* Don't error out dumps performed before any set operation. */
 	binding = net_shaper_binding_from_ctx(ctx);
-	hierarchy = net_shaper_hierarchy(binding);
-	if (!hierarchy)
-		return 0;
 	rcu_read_lock();
+	hierarchy = net_shaper_hierarchy_rcu(binding);
+	if (!hierarchy)
+		goto out_unlock;
 	for (; (shaper = xa_find(&hierarchy->shapers, &ctx->start_index,
 				 U32_MAX, XA_PRESENT)); ctx->start_index++) {
 		ret = net_shaper_fill_one(skb, binding, shaper, info);
 		if (ret)
 			break;
 	}
+out_unlock:
 	rcu_read_unlock();
 	return ret;
 	binding = net_shaper_binding_from_ctx(info->ctx);
-	net_shaper_lock(binding);
 	ret = net_shaper_parse_info(binding, info->attrs, info, &shaper,
 				    &exists);
 	if (ret)
-		goto unlock;
+		return ret;
 	if (!exists)
 		net_shaper_default_parent(&shaper.handle, &shaper.parent);
 	hierarchy = net_shaper_hierarchy_setup(binding);
-	if (!hierarchy) {
+	if (!hierarchy)
-		ret = -ENOMEM;
+		return -ENOMEM;
-		goto unlock;
-	}
 	/* The 'set' operation can't create node-scope shapers. */
 	handle = shaper.handle;
 	if (handle.scope == NET_SHAPER_SCOPE_NODE &&
-	    !net_shaper_lookup(binding, &handle)) {
+	    !net_shaper_lookup(binding, &handle))
-		ret = -ENOENT;
+		return -ENOENT;
-		goto unlock;
-	}
 	ret = net_shaper_pre_insert(binding, &handle, info->extack);
 	if (ret)
-		goto unlock;
+		return ret;
 	ops = net_shaper_ops(binding);
 	ret = ops->set(binding, &shaper, info->extack);
 	if (ret) {
 		net_shaper_rollback(binding);
-		goto unlock;
+		return ret;
 	}
 	net_shaper_commit(binding, 1, &shaper);
-unlock:
+	return 0;
-	net_shaper_unlock(binding);
-	return ret;
 }
 static int __net_shaper_delete(struct net_shaper_binding *binding,
 	binding = net_shaper_binding_from_ctx(info->ctx);
-	net_shaper_lock(binding);
 	ret = net_shaper_parse_handle(info->attrs[NET_SHAPER_A_HANDLE], info,
 				      &handle);
 	if (ret)
-		goto unlock;
+		return ret;
 	hierarchy = net_shaper_hierarchy(binding);
-	if (!hierarchy) {
+	if (!hierarchy)
-		ret = -ENOENT;
+		return -ENOENT;
-		goto unlock;
-	}
 	shaper = net_shaper_lookup(binding, &handle);
-	if (!shaper) {
+	if (!shaper)
-		ret = -ENOENT;
+		return -ENOENT;
-		goto unlock;
-	}
 	if (handle.scope == NET_SHAPER_SCOPE_NODE) {
 		ret = net_shaper_pre_del_node(binding, shaper, info->extack);
 		if (ret)
-			goto unlock;
+			return ret;
 	}
-	ret = __net_shaper_delete(binding, shaper, info->extack);
+	return __net_shaper_delete(binding, shaper, info->extack);
-unlock:
-	net_shaper_unlock(binding);
-	return ret;
 }
 static int net_shaper_group_send_reply(struct net_shaper_binding *binding,
 	if (!net_shaper_ops(binding)->group)
 		return -EOPNOTSUPP;
-	net_shaper_lock(binding);
 	leaves_count = net_shaper_list_len(info, NET_SHAPER_A_LEAVES);
 	if (!leaves_count) {
 		NL_SET_BAD_ATTR(info->extack,
 				info->attrs[NET_SHAPER_A_LEAVES]);
-		ret = -EINVAL;
+		return -EINVAL;
-		goto unlock;
 	}
 	leaves = kcalloc(leaves_count, sizeof(struct net_shaper) +
 			 sizeof(struct net_shaper *), GFP_KERNEL);
-	if (!leaves) {
+	if (!leaves)
-		ret = -ENOMEM;
+		return -ENOMEM;
-		goto unlock;
-	}
 	old_nodes = (void *)&leaves[leaves_count];
 	ret = net_shaper_parse_node(binding, info->attrs, info, &node);
 free_leaves:
 	kfree(leaves);
-unlock:
-	net_shaper_unlock(binding);
 	return ret;
 free_msg:
 	if (!hierarchy)
 		return;
-	net_shaper_lock(binding);
 	xa_lock(&hierarchy->shapers);
 	xa_for_each(&hierarchy->shapers, index, cur) {
 		__xa_erase(&hierarchy->shapers, index);
 		kfree(cur);
 	}
 	xa_unlock(&hierarchy->shapers);
-	net_shaper_unlock(binding);
 	kfree(hierarchy);
 }

net/shaper/shaper_nl_gen.c+6−6

@@ -99,27 +99,27 @@ static const struct genl_split_ops net_shaper_nl_ops[] = { · 98 unmodified lines
99	},	99	},
100	{	100	{
101	.cmd = NET_SHAPER_CMD_SET,	101	.cmd = NET_SHAPER_CMD_SET,
102	.pre_doit = net_shaper_nl_pre_doit,	102	.pre_doit = net_shaper_nl_pre_doit_write,
103	.doit = net_shaper_nl_set_doit,	103	.doit = net_shaper_nl_set_doit,
104	.post_doit = net_shaper_nl_post_doit,	104	.post_doit = net_shaper_nl_post_doit_write,
105	.policy = net_shaper_set_nl_policy,	105	.policy = net_shaper_set_nl_policy,
106	.maxattr = NET_SHAPER_A_IFINDEX,	106	.maxattr = NET_SHAPER_A_IFINDEX,
107	.flags = GENL_ADMIN_PERM \| GENL_CMD_CAP_DO,	107	.flags = GENL_ADMIN_PERM \| GENL_CMD_CAP_DO,
108	},	108	},
109	{	109	{
110	.cmd = NET_SHAPER_CMD_DELETE,	110	.cmd = NET_SHAPER_CMD_DELETE,
111	.pre_doit = net_shaper_nl_pre_doit,	111	.pre_doit = net_shaper_nl_pre_doit_write,
112	.doit = net_shaper_nl_delete_doit,	112	.doit = net_shaper_nl_delete_doit,
113	.post_doit = net_shaper_nl_post_doit,	113	.post_doit = net_shaper_nl_post_doit_write,
114	.policy = net_shaper_delete_nl_policy,	114	.policy = net_shaper_delete_nl_policy,
115	.maxattr = NET_SHAPER_A_IFINDEX,	115	.maxattr = NET_SHAPER_A_IFINDEX,
116	.flags = GENL_ADMIN_PERM \| GENL_CMD_CAP_DO,	116	.flags = GENL_ADMIN_PERM \| GENL_CMD_CAP_DO,
117	},	117	},
118	{	118	{
119	.cmd = NET_SHAPER_CMD_GROUP,	119	.cmd = NET_SHAPER_CMD_GROUP,
120	.pre_doit = net_shaper_nl_pre_doit,	120	.pre_doit = net_shaper_nl_pre_doit_write,
121	.doit = net_shaper_nl_group_doit,	121	.doit = net_shaper_nl_group_doit,
122	.post_doit = net_shaper_nl_post_doit,	122	.post_doit = net_shaper_nl_post_doit_write,
123	.policy = net_shaper_group_nl_policy,	123	.policy = net_shaper_group_nl_policy,
124	.maxattr = NET_SHAPER_A_LEAVES,	124	.maxattr = NET_SHAPER_A_LEAVES,
125	.flags = GENL_ADMIN_PERM \| GENL_CMD_CAP_DO,	125	.flags = GENL_ADMIN_PERM \| GENL_CMD_CAP_DO,

net/shaper/shaper_nl_gen.h+5−0

 int net_shaper_nl_pre_doit(const struct genl_split_ops *ops,
 			   struct sk_buff *skb, struct genl_info *info);
+int net_shaper_nl_pre_doit_write(const struct genl_split_ops *ops,
+				 struct sk_buff *skb, struct genl_info *info);
 int net_shaper_nl_cap_pre_doit(const struct genl_split_ops *ops,
 			       struct sk_buff *skb, struct genl_info *info);
 void
 net_shaper_nl_post_doit(const struct genl_split_ops *ops, struct sk_buff *skb,
 			struct genl_info *info);
 void
+net_shaper_nl_post_doit_write(const struct genl_split_ops *ops,
+			      struct sk_buff *skb, struct genl_info *info);
+void
 net_shaper_nl_cap_post_doit(const struct genl_split_ops *ops,
 			    struct sk_buff *skb, struct genl_info *info);
 int net_shaper_nl_pre_dumpit(struct netlink_callback *cb);

net/smc/af_smc.c+17−6

 	struct smc_sock *smc;
 	struct sock *child;
-	smc = smc_clcsock_user_data(sk);
+	rcu_read_lock();
+	smc = smc_clcsock_user_data_rcu(sk);
+	if (!smc || !refcount_inc_not_zero(&smc->sk.sk_refcnt)) {
+		rcu_read_unlock();
+		smc = NULL;
+		goto drop;
+	}
+	rcu_read_unlock();
 	if (READ_ONCE(sk->sk_ack_backlog) + atomic_read(&smc->queued_smc_hs) >
 				sk->sk_max_ack_backlog)
 		if (inet_csk(child)->icsk_af_ops == inet_csk(sk)->icsk_af_ops)
 			inet_csk(child)->icsk_af_ops = smc->ori_af_ops;
 	}
+	sock_put(&smc->sk);
 	return child;
 drop:
 	dst_release(dst);
 	tcp_listendrop(sk);
+	if (smc)
+		sock_put(&smc->sk);
 	return NULL;
 }
 	struct sock *clcsk = smc->clcsock->sk;
 	write_lock_bh(&clcsk->sk_callback_lock);
-	clcsk->sk_user_data = NULL;
+	rcu_assign_sk_user_data(clcsk, NULL);
 	smc_clcsock_restore_cb(&clcsk->sk_state_change, &smc->clcsk_state_change);
 	smc_clcsock_restore_cb(&clcsk->sk_data_ready, &smc->clcsk_data_ready);
 	struct sock *clcsk = smc->clcsock->sk;
 	write_lock_bh(&clcsk->sk_callback_lock);
-	clcsk->sk_user_data = (void *)((uintptr_t)smc | SK_USER_DATA_NOCOPY);
+	__rcu_assign_sk_user_data_with_flags(clcsk, smc, SK_USER_DATA_NOCOPY);
 	smc_clcsock_replace_cb(&clcsk->sk_state_change, smc_fback_state_change,
 			       &smc->clcsk_state_change);
 	 * smc-specific sk_data_ready function
 	 */
 	write_lock_bh(&smc->clcsock->sk->sk_callback_lock);
-	smc->clcsock->sk->sk_user_data =
+	__rcu_assign_sk_user_data_with_flags(smc->clcsock->sk, smc,
-		(void *)((uintptr_t)smc | SK_USER_DATA_NOCOPY);
+					     SK_USER_DATA_NOCOPY);
 	smc_clcsock_replace_cb(&smc->clcsock->sk->sk_data_ready,
 			       smc_clcsock_data_ready, &smc->clcsk_data_ready);
 	write_unlock_bh(&smc->clcsock->sk->sk_callback_lock);
 		write_lock_bh(&smc->clcsock->sk->sk_callback_lock);
 		smc_clcsock_restore_cb(&smc->clcsock->sk->sk_data_ready,
 				       &smc->clcsk_data_ready);
-		smc->clcsock->sk->sk_user_data = NULL;
+		rcu_assign_sk_user_data(smc->clcsock->sk, NULL);
 		write_unlock_bh(&smc->clcsock->sk->sk_callback_lock);
 		goto out;
 	}
+	sock_set_flag(sk, SOCK_RCU_FREE);
 	sk->sk_max_ack_backlog = backlog;
 	sk->sk_ack_backlog = 0;
 	sk->sk_state = SMC_LISTEN;

net/smc/smc.h+5−0

 	       ((uintptr_t)clcsk->sk_user_data & ~SK_USER_DATA_NOCOPY);
 }
+static inline struct smc_sock *smc_clcsock_user_data_rcu(const struct sock *clcsk)
+{
+	return (struct smc_sock *)rcu_dereference_sk_user_data(clcsk);
+}
 /* save target_cb in saved_cb, and replace target_cb with new_cb */
 static inline void smc_clcsock_replace_cb(void (**target_cb)(struct sock *),
 					  void (*new_cb)(struct sock *),

net/smc/smc_close.c+1−1

@@ -218,7 +218,7 @@ again: · 217 unmodified lines
218	write_lock_bh(&smc->clcsock->sk->sk_callback_lock);	218	write_lock_bh(&smc->clcsock->sk->sk_callback_lock);
219	smc_clcsock_restore_cb(&smc->clcsock->sk->sk_data_ready,	219	smc_clcsock_restore_cb(&smc->clcsock->sk->sk_data_ready,
220	&smc->clcsk_data_ready);	220	&smc->clcsk_data_ready);
221	smc->clcsock->sk->sk_user_data = NULL;	221	rcu_assign_sk_user_data(smc->clcsock->sk, NULL);
222	write_unlock_bh(&smc->clcsock->sk->sk_callback_lock);	222	write_unlock_bh(&smc->clcsock->sk->sk_callback_lock);
223	rc = kernel_sock_shutdown(smc->clcsock, SHUT_RDWR);	223	rc = kernel_sock_shutdown(smc->clcsock, SHUT_RDWR);
224	}	224	}

net/sunrpc/cache.c+21−5

 	struct cache_reader *rp = filp->private_data;
 	if (rp) {
+		struct cache_request *rq = NULL;
 		spin_lock(&queue_lock);
 		if (rp->offset) {
 			struct cache_queue *cq;
-			for (cq= &rp->q; &cq->list != &cd->queue;
+			for (cq = &rp->q; &cq->list != &cd->queue;
-			     cq = list_entry(cq->list.next, struct cache_queue, list))
+			     cq = list_entry(cq->list.next,
+					     struct cache_queue, list))
 				if (!cq->reader) {
-					container_of(cq, struct cache_request, q)
+					struct cache_request *cr =
-						->readers--;
+						container_of(cq,
+						struct cache_request, q);
+					cr->readers--;
+					if (cr->readers == 0 &&
+					    !test_bit(CACHE_PENDING,
+						      &cr->item->flags)) {
+						list_del(&cr->q.list);
+						rq = cr;
+					}
 					break;
 				}
 			rp->offset = 0;
 		list_del(&rp->q.list);
 		spin_unlock(&queue_lock);
+		if (rq) {
+			cache_put(rq->item, cd);
+			kfree(rq->buf);
+			kfree(rq);
+		}
 		filp->private_data = NULL;
 		kfree(rp);
 	}
 	if (filp->f_mode & FMODE_WRITE) {
 		atomic_dec(&cd->writers);

net/unix/af_unix.c+2−0

@@ -1958,6 +1958,8 @@ static void unix_detach_fds(struct scm_cookie scm, struct sk_buff skb) · 1957 unmodified lines
1958	static void unix_peek_fds(struct scm_cookie scm, struct sk_buff skb)	1958	static void unix_peek_fds(struct scm_cookie scm, struct sk_buff skb)
1959	{	1959	{
1960	scm->fp = scm_fp_dup(UNIXCB(skb).fp);	1960	scm->fp = scm_fp_dup(UNIXCB(skb).fp);
		1961
		1962	unix_peek_fpl(scm->fp);
1961	}	1963	}
1962		1964
1963	static void unix_destruct_scm(struct sk_buff *skb)	1965	static void unix_destruct_scm(struct sk_buff *skb)

net/unix/af_unix.h+1−0

@@ -29,6 +29,7 @@ void unix_del_edges(struct scm_fp_list *fpl); · 28 unmodified lines
29	void unix_update_edges(struct unix_sock *receiver);	29	void unix_update_edges(struct unix_sock *receiver);
30	int unix_prepare_fpl(struct scm_fp_list *fpl);	30	int unix_prepare_fpl(struct scm_fp_list *fpl);
31	void unix_destroy_fpl(struct scm_fp_list *fpl);	31	void unix_destroy_fpl(struct scm_fp_list *fpl);
		32	void unix_peek_fpl(struct scm_fp_list *fpl);
32	void unix_schedule_gc(struct user_struct *user);	33	void unix_schedule_gc(struct user_struct *user);
33		34
34	/* SOCK_DIAG */	35	/* SOCK_DIAG */

net/unix/garbage.c+51−28

 	unix_free_vertices(fpl);
 }
+static bool gc_in_progress;
+static seqcount_t unix_peek_seq = SEQCNT_ZERO(unix_peek_seq);
+void unix_peek_fpl(struct scm_fp_list *fpl)
+{
+	static DEFINE_SPINLOCK(unix_peek_lock);
+	if (!fpl || !fpl->count_unix)
+		return;
+	if (!READ_ONCE(gc_in_progress))
+		return;
+	/* Invalidate the final refcnt check in unix_vertex_dead(). */
+	spin_lock(&unix_peek_lock);
+	raw_write_seqcount_barrier(&unix_peek_seq);
+	spin_unlock(&unix_peek_lock);
+}
 static bool unix_vertex_dead(struct unix_vertex *vertex)
 {
 	struct unix_edge *edge;
 	return true;
 }
+static LIST_HEAD(unix_visited_vertices);
+static unsigned long unix_vertex_grouped_index = UNIX_VERTEX_INDEX_MARK2;
+static bool unix_scc_dead(struct list_head *scc, bool fast)
+{
+	struct unix_vertex *vertex;
+	bool scc_dead = true;
+	unsigned int seq;
+	seq = read_seqcount_begin(&unix_peek_seq);
+	list_for_each_entry_reverse(vertex, scc, scc_entry) {
+		/* Don't restart DFS from this vertex. */
+		list_move_tail(&vertex->entry, &unix_visited_vertices);
+		/* Mark vertex as off-stack for __unix_walk_scc(). */
+		if (!fast)
+			vertex->index = unix_vertex_grouped_index;
+		if (scc_dead)
+			scc_dead = unix_vertex_dead(vertex);
+	}
+	/* If MSG_PEEK intervened, defer this SCC to the next round. */
+	if (read_seqcount_retry(&unix_peek_seq, seq))
+		return false;
+	return scc_dead;
+}
 static void unix_collect_skb(struct list_head *scc, struct sk_buff_head *hitlist)
 {
 	struct unix_vertex *vertex;
 	return false;
 }
-static LIST_HEAD(unix_visited_vertices);
-static unsigned long unix_vertex_grouped_index = UNIX_VERTEX_INDEX_MARK2;
 static unsigned long __unix_walk_scc(struct unix_vertex *vertex,
 				     unsigned long *last_index,
 				     struct sk_buff_head *hitlist)
 	}
 	if (vertex->index == vertex->scc_index) {
-		struct unix_vertex *v;
 		struct list_head scc;
-		bool scc_dead = true;
 		/* SCC finalised.
 		 *
 		 */
 		__list_cut_position(&scc, &vertex_stack, &vertex->scc_entry);
-		list_for_each_entry_reverse(v, &scc, scc_entry) {
+		if (unix_scc_dead(&scc, false)) {
-			/* Don't restart DFS from this vertex in unix_walk_scc(). */
-			list_move_tail(&v->entry, &unix_visited_vertices);
-			/* Mark vertex as off-stack. */
-			v->index = unix_vertex_grouped_index;
-			if (scc_dead)
-				scc_dead = unix_vertex_dead(v);
-		}
-		if (scc_dead) {
 			unix_collect_skb(&scc, hitlist);
 		} else {
 			if (unix_vertex_max_scc_index < vertex->scc_index)
 	while (!list_empty(&unix_unvisited_vertices)) {
 		struct unix_vertex *vertex;
 		struct list_head scc;
-		bool scc_dead = true;
 		vertex = list_first_entry(&unix_unvisited_vertices, typeof(*vertex), entry);
 		list_add(&scc, &vertex->scc_entry);
-		list_for_each_entry_reverse(vertex, &scc, scc_entry) {
+		if (unix_scc_dead(&scc, true)) {
-			list_move_tail(&vertex->entry, &unix_visited_vertices);
-			if (scc_dead)
-				scc_dead = unix_vertex_dead(vertex);
-		}
-		if (scc_dead) {
 			cyclic_sccs--;
 			unix_collect_skb(&scc, hitlist);
 		}
 		   cyclic_sccs ? UNIX_GRAPH_CYCLIC : UNIX_GRAPH_NOT_CYCLIC);
 }
-static bool gc_in_progress;
 static void unix_gc(struct work_struct *work)
 {
 	struct sk_buff_head hitlist;

net/wireless/pmsr.c+1−0

@@ -664,6 +664,7 @@ void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev) · 663 unmodified lines
664	}	664	}
665	spin_unlock_bh(&wdev->pmsr_lock);	665	spin_unlock_bh(&wdev->pmsr_lock);
666		666
		667	cancel_work_sync(&wdev->pmsr_free_wk);
667	if (found)	668	if (found)
668	cfg80211_pmsr_process_abort(wdev);	669	cfg80211_pmsr_process_abort(wdev);
669		670

scripts/livepatch/klp-build+4−5

 # application from appending it with '+' due to a dirty git working tree.
 set_kernelversion() {
 	local file="$SRC/scripts/setlocalversion"
-	local localversion
+	local kernelrelease
 	stash_file "$file"
-	localversion="$(cd "$SRC" && make --no-print-directory kernelversion)"
+	kernelrelease="$(cd "$SRC" && make syncconfig &>/dev/null && make -s kernelrelease)"
-	localversion="$(cd "$SRC" && KERNELVERSION="$localversion" ./scripts/setlocalversion)"
+	[[ -z "$kernelrelease" ]] && die "failed to get kernel version"
-	[[ -z "$localversion" ]] && die "setlocalversion failed"
-	sed -i "2i echo $localversion; exit 0" scripts/setlocalversion
+	sed -i "2i echo $kernelrelease; exit 0" scripts/setlocalversion
 }
 get_patch_files() {

sound/soc/samsung/i2s.c+3−3

@@ -1360,10 +1360,10 @@ static int i2s_create_secondary_device(struct samsung_i2s_priv *priv) · 1359 unmodified lines
1360	if (!pdev_sec)	1360	if (!pdev_sec)
1361	return -ENOMEM;	1361	return -ENOMEM;
1362		1362
1363	pdev_sec->driver_override = kstrdup("samsung-i2s", GFP_KERNEL);	1363	ret = device_set_driver_override(&pdev_sec->dev, "samsung-i2s");
1364	if (!pdev_sec->driver_override) {	1364	if (ret) {
1365	platform_device_put(pdev_sec);	1365	platform_device_put(pdev_sec);
1366	return -ENOMEM;	1366	return ret;
1367	}	1367	}
1368		1368
1369	ret = platform_device_add(pdev_sec);	1369	ret = platform_device_add(pdev_sec);

tools/bootconfig/main.c+5−2

 	if (fd < 0)
 		return -errno;
 	ret = fstat(fd, &stat);
-	if (ret < 0)
+	if (ret < 0) {
-		return -errno;
+		ret = -errno;
+		close(fd);
+		return ret;
+	}
 	ret = load_xbc_fd(fd, buf, stat.st_size);

tools/objtool/check.c+2−3

 			last = insn;
 		/*
-		 * Store back-pointers for unconditional forward jumps such
+		 * Store back-pointers for forward jumps such
 		 * that find_jump_table() can back-track using those and
 		 * avoid some potentially confusing code.
 		 */
-		if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest &&
+		if (insn->jump_dest &&
-		    insn->offset > last->offset &&
 		    insn->jump_dest->offset > insn->offset &&
 		    !insn->jump_dest->first_jump_src) {

tools/objtool/elf.c+3−20

 #include <string.h>
 #include <unistd.h>
 #include <errno.h>
-#include <libgen.h>
 #include <ctype.h>
 #include <linux/align.h>
 #include <linux/kernel.h>
 struct elf *elf_create_file(GElf_Ehdr *ehdr, const char *name)
 {
 	struct section *null, *symtab, *strtab, *shstrtab;
-	char *dir, *base, *tmp_name;
+	char *tmp_name;
 	struct symbol *sym;
 	struct elf *elf;
 	INIT_LIST_HEAD(&elf->sections);
-	dir = strdup(name);
+	tmp_name = malloc(strlen(name) + 8);
-	if (!dir) {
-		ERROR_GLIBC("strdup");
-		return NULL;
-	}
-	dir = dirname(dir);
-	base = strdup(name);
-	if (!base) {
-		ERROR_GLIBC("strdup");
-		return NULL;
-	}
-	base = basename(base);
-	tmp_name = malloc(256);
 	if (!tmp_name) {
 		ERROR_GLIBC("malloc");
 		return NULL;
 	}
-	snprintf(tmp_name, 256, "%s/%s.XXXXXX", dir, base);
+	sprintf(tmp_name, "%s.XXXXXX", name);
 	elf->fd = mkstemp(tmp_name);
 	if (elf->fd == -1) {

tools/objtool/klp-diff.c+2−1

 #include <objtool/util.h>
 #include <arch/special.h>
+#include <linux/align.h>
 #include <linux/objtool_types.h>
 #include <linux/livepatch_external.h>
 #include <linux/stringify.h>
 		}
 		if (!is_sec_sym(patched_sym))
-			offset = sec_size(out_sec);
+			offset = ALIGN(sec_size(out_sec), out_sec->sh.sh_addralign);
 		if (patched_sym->len || is_sec_sym(patched_sym)) {
 			void *data = NULL;

tools/testing/selftests/bpf/Makefile+1−1

@@ -409,7 +409,7 @@ $(RESOLVE_BTFIDS): $(HOST_BPFOBJ) \| $(HOST_BUILD_DIR)/resolve_btfids \ · 408 unmodified lines
409	CC="$(HOSTCC)" LD="$(HOSTLD)" AR="$(HOSTAR)" \	409	CC="$(HOSTCC)" LD="$(HOSTLD)" AR="$(HOSTAR)" \
410	LIBBPF_INCLUDE=$(HOST_INCLUDE_DIR) \	410	LIBBPF_INCLUDE=$(HOST_INCLUDE_DIR) \
411	EXTRA_LDFLAGS='$(SAN_LDFLAGS) $(EXTRA_LDFLAGS)' \	411	EXTRA_LDFLAGS='$(SAN_LDFLAGS) $(EXTRA_LDFLAGS)' \
412	HOSTPKG_CONFIG=$(PKG_CONFIG) \	412	HOSTPKG_CONFIG='$(PKG_CONFIG)' \
413	OUTPUT=$(HOST_BUILD_DIR)/resolve_btfids/ BPFOBJ=$(HOST_BPFOBJ)	413	OUTPUT=$(HOST_BUILD_DIR)/resolve_btfids/ BPFOBJ=$(HOST_BPFOBJ)
414		414
415	# Get Clang's default includes on this system, as opposed to those seen by	415	# Get Clang's default includes on this system, as opposed to those seen by

tools/testing/selftests/bpf/progs/exceptions_fail.c+53−3

@@ -8,6 +8,11 @@ · 7 unmodified lines
8	#include "bpf_experimental.h"	8	#include "bpf_experimental.h"
9		9
10	extern void bpf_rcu_read_lock(void) __ksym;	10	extern void bpf_rcu_read_lock(void) __ksym;
		11	extern void bpf_rcu_read_unlock(void) __ksym;
		12	extern void bpf_preempt_disable(void) __ksym;
		13	extern void bpf_preempt_enable(void) __ksym;
		14	extern void bpf_local_irq_save(unsigned long *) __ksym;
		15	extern void bpf_local_irq_restore(unsigned long *) __ksym;
11		16
12	#define private(name) SEC(".bss." #name) __hidden __attribute__((aligned(8)))	17	#define private(name) SEC(".bss." #name) __hidden __attribute__((aligned(8)))
13		18
@@ -131,7 +136,7 @@ int reject_subprog_with_lock(void *ctx) · 117 unmodified lines
131	}	136	}
132		137
133	SEC("?tc")	138	SEC("?tc")
134	__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_rcu_read_lock-ed region")	139	__failure __msg("bpf_throw cannot be used inside bpf_rcu_read_lock-ed region")
135	int reject_with_rcu_read_lock(void *ctx)	140	int reject_with_rcu_read_lock(void *ctx)
136	{	141	{
137	bpf_rcu_read_lock();	142	bpf_rcu_read_lock();
@@ -147,11 +152,13 @@ __noinline static int throwing_subprog(struct __sk_buff *ctx) · 9 unmodified lines
147	}	152	}
148		153
149	SEC("?tc")	154	SEC("?tc")
150	__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_rcu_read_lock-ed region")	155	__failure __msg("bpf_throw cannot be used inside bpf_rcu_read_lock-ed region")
151	int reject_subprog_with_rcu_read_lock(void *ctx)	156	int reject_subprog_with_rcu_read_lock(void *ctx)
152	{	157	{
153	bpf_rcu_read_lock();	158	bpf_rcu_read_lock();
154	return throwing_subprog(ctx);	159	throwing_subprog(ctx);
		160	bpf_rcu_read_unlock();
		161	return 0;
155	}	162	}
156		163
157	static bool rbless(struct bpf_rb_node n1, const struct bpf_rb_node n2)	164	static bool rbless(struct bpf_rb_node n1, const struct bpf_rb_node n2)
@@ -346,4 +353,47 @@ int reject_exception_throw_cb_diff(struct __sk_buff *ctx) · 188 unmodified lines
346	return 0;	353	return 0;
347	}	354	}
348		355
		356	__noinline static int always_throws(void)
		357	{
		358	bpf_throw(0);
		359	return 0;
		360	}
		361
		362	__noinline static int rcu_lock_then_throw(void)
		363	{
		364	bpf_rcu_read_lock();
		365	bpf_throw(0);
		366	return 0;
		367	}
		368
		369	SEC("?tc")
		370	__failure __msg("bpf_throw cannot be used inside bpf_rcu_read_lock-ed region")
		371	int reject_subprog_rcu_lock_throw(void *ctx)
		372	{
		373	rcu_lock_then_throw();
		374	return 0;
		375	}
		376
		377	SEC("?tc")
		378	__failure __msg("bpf_throw cannot be used inside bpf_preempt_disable-ed region")
		379	int reject_subprog_throw_preempt_lock(void *ctx)
		380	{
		381	bpf_preempt_disable();
		382	always_throws();
		383	bpf_preempt_enable();
		384	return 0;
		385	}
		386
		387	SEC("?tc")
		388	__failure __msg("bpf_throw cannot be used inside bpf_local_irq_save-ed region")
		389	int reject_subprog_throw_irq_lock(void *ctx)
		390	{
		391	unsigned long flags;
		392
		393	bpf_local_irq_save(&flags);
		394	always_throws();
		395	bpf_local_irq_restore(&flags);
		396	return 0;
		397	}
		398
349	char _license[] SEC("license") = "GPL";	399	char _license[] SEC("license") = "GPL";

tools/testing/selftests/bpf/progs/verifier_bounds.c+94−0

@@ -2037,4 +2037,98 @@ __naked void signed_unsigned_intersection32_case2(void *ctx) · 2036 unmodified lines
2037	: __clobber_all);	2037	: __clobber_all);
2038	}	2038	}
2039		2039
		2040	SEC("socket")
		2041	__description("maybe_fork_scalars: OR with constant rejects OOB")
		2042	__failure __msg("invalid access to map value")
		2043	__naked void or_scalar_fork_rejects_oob(void)
		2044	{
		2045	asm volatile (" \
		2046	r1 = 0; \
		2047	(u64)(r10 - 8) = r1; \
		2048	r2 = r10; \
		2049	r2 += -8; \
		2050	r1 = %[map_hash_8b] ll; \
		2051	call %[bpf_map_lookup_elem]; \
		2052	if r0 == 0 goto l0_%=; \
		2053	r9 = r0; \
		2054	r6 = (u64)(r9 + 0); \
		2055	r6 s>>= 63; \
		2056	r6 \|= 8; \
		2057	/* r6 is -1 (current) or 8 (pushed) */ \
		2058	if r6 s< 0 goto l0_%=; \
		2059	/* pushed path: r6 = 8, OOB for value_size=8 */ \
		2060	r9 += r6; \
		2061	r0 = (u8)(r9 + 0); \
		2062	l0_%=: r0 = 0; \
		2063	exit; \
		2064	" :
		2065	: __imm(bpf_map_lookup_elem),
		2066	__imm_addr(map_hash_8b)
		2067	: __clobber_all);
		2068	}
		2069
		2070	SEC("socket")
		2071	__description("maybe_fork_scalars: AND with constant still works")
		2072	__success __retval(0)
		2073	__naked void and_scalar_fork_still_works(void)
		2074	{
		2075	asm volatile (" \
		2076	r1 = 0; \
		2077	(u64)(r10 - 8) = r1; \
		2078	r2 = r10; \
		2079	r2 += -8; \
		2080	r1 = %[map_hash_8b] ll; \
		2081	call %[bpf_map_lookup_elem]; \
		2082	if r0 == 0 goto l0_%=; \
		2083	r9 = r0; \
		2084	r6 = (u64)(r9 + 0); \
		2085	r6 s>>= 63; \
		2086	r6 &= 4; \
		2087	/* \
		2088	* r6 is 0 (pushed, 0&4==0) or 4 (current) \
		2089	* both within value_size=8 \
		2090	*/ \
		2091	if r6 s< 0 goto l0_%=; \
		2092	r9 += r6; \
		2093	r0 = (u8)(r9 + 0); \
		2094	l0_%=: r0 = 0; \
		2095	exit; \
		2096	" :
		2097	: __imm(bpf_map_lookup_elem),
		2098	__imm_addr(map_hash_8b)
		2099	: __clobber_all);
		2100	}
		2101
		2102	SEC("socket")
		2103	__description("maybe_fork_scalars: OR with constant allows in-bounds")
		2104	__success __retval(0)
		2105	__naked void or_scalar_fork_allows_inbounds(void)
		2106	{
		2107	asm volatile (" \
		2108	r1 = 0; \
		2109	(u64)(r10 - 8) = r1; \
		2110	r2 = r10; \
		2111	r2 += -8; \
		2112	r1 = %[map_hash_8b] ll; \
		2113	call %[bpf_map_lookup_elem]; \
		2114	if r0 == 0 goto l0_%=; \
		2115	r9 = r0; \
		2116	r6 = (u64)(r9 + 0); \
		2117	r6 s>>= 63; \
		2118	r6 \|= 4; \
		2119	/* \
		2120	* r6 is -1 (current) or 4 (pushed) \
		2121	* pushed path: r6 = 4, within value_size=8 \
		2122	*/ \
		2123	if r6 s< 0 goto l0_%=; \
		2124	r9 += r6; \
		2125	r0 = (u8)(r9 + 0); \
		2126	l0_%=: r0 = 0; \
		2127	exit; \
		2128	" :
		2129	: __imm(bpf_map_lookup_elem),
		2130	__imm_addr(map_hash_8b)
		2131	: __clobber_all);
		2132	}
		2133
2040	char _license[] SEC("license") = "GPL";	2134	char _license[] SEC("license") = "GPL";

tools/testing/selftests/bpf/progs/verifier_bswap.c+22−0

@@ -91,6 +91,28 @@ BSWAP_RANGE_TEST(le32_range, "le32", 0x3f00, 0x3f0000) · 90 unmodified lines
91	BSWAP_RANGE_TEST(le64_range, "le64", 0x3f00, 0x3f000000000000)	91	BSWAP_RANGE_TEST(le64_range, "le64", 0x3f00, 0x3f000000000000)
92	#endif	92	#endif
93		93
		94	SEC("socket")
		95	__description("BSWAP, reset reg id")
		96	__failure __msg("math between fp pointer and register with unbounded min value is not allowed")
		97	__naked void bswap_reset_reg_id(void)
		98	{
		99	asm volatile (" \
		100	call %[bpf_ktime_get_ns]; \
		101	r1 = r0; \
		102	r0 = be16 r0; \
		103	if r0 != 1 goto l0_%=; \
		104	r2 = r10; \
		105	r2 += -512; \
		106	r2 += r1; \
		107	(u8 )(r2 + 0) = 0; \
		108	l0_%=: \
		109	r0 = 0; \
		110	exit; \
		111	" :
		112	: __imm(bpf_ktime_get_ns)
		113	: __clobber_all);
		114	}
		115
94	#else	116	#else
95		117
96	SEC("socket")	118	SEC("socket")

tools/testing/selftests/bpf/progs/verifier_linked_scalars.c+108−0

@@ -348,6 +348,114 @@ l0_%=: \ · 347 unmodified lines
348	: __clobber_all);	348	: __clobber_all);
349	}	349	}
350		350
		351	/*
		352	* Test that sync_linked_regs() checks reg->id (the linked target register)
		353	* for BPF_ADD_CONST32 rather than known_reg->id (the branch register).
		354	*/
		355	SEC("socket")
		356	__success
		357	__naked void scalars_alu32_zext_linked_reg(void)
		358	{
		359	asm volatile (" \
		360	call %[bpf_get_prandom_u32]; \
		361	w6 = w0; /* r6 in [0, 0xFFFFFFFF] */ \
		362	r7 = r6; /* linked: same id as r6 */ \
		363	w7 += 1; /* alu32: r7.id \|= BPF_ADD_CONST32 */ \
		364	r8 = 0xFFFFffff ll; \
		365	if r6 < r8 goto l0_%=; \
		366	/* r6 in [0xFFFFFFFF, 0xFFFFFFFF] */ \
		367	/* sync_linked_regs: known_reg=r6, reg=r7 */ \
		368	/* CPU: w7 = (u32)(0xFFFFFFFF + 1) = 0, zext -> r7 = 0 */ \
		369	/* With fix: r7 64-bit = [0, 0] (zext applied) */ \
		370	/* Without fix: r7 64-bit = [0x100000000] (no zext) */ \
		371	r7 >>= 32; \
		372	if r7 == 0 goto l0_%=; \
		373	r0 /= 0; /* unreachable with fix */ \
		374	l0_%=: \
		375	r0 = 0; \
		376	exit; \
		377	" :
		378	: __imm(bpf_get_prandom_u32)
		379	: __clobber_all);
		380	}
		381
		382	/*
		383	* Test that sync_linked_regs() skips propagation when one register used
		384	* alu32 (BPF_ADD_CONST32) and the other used alu64 (BPF_ADD_CONST64).
		385	* The delta relationship doesn't hold across different ALU widths.
		386	*/
		387	SEC("socket")
		388	__failure __msg("div by zero")
		389	__naked void scalars_alu32_alu64_cross_type(void)
		390	{
		391	asm volatile (" \
		392	call %[bpf_get_prandom_u32]; \
		393	w6 = w0; /* r6 in [0, 0xFFFFFFFF] */ \
		394	r7 = r6; /* linked: same id as r6 */ \
		395	w7 += 1; /* alu32: BPF_ADD_CONST32, delta = 1 */ \
		396	r8 = r6; /* linked: same id as r6 */ \
		397	r8 += 2; /* alu64: BPF_ADD_CONST64, delta = 2 */ \
		398	r9 = 0xFFFFffff ll; \
		399	if r7 < r9 goto l0_%=; \
		400	/* r7 = 0xFFFFFFFF */ \
		401	/* sync: known_reg=r7 (ADD_CONST32), reg=r8 (ADD_CONST64) */ \
		402	/* Without fix: r8 = zext(0xFFFFFFFF + 1) = 0 */ \
		403	/* With fix: r8 stays [2, 0x100000001] (r8 >= 2) */ \
		404	if r8 > 0 goto l1_%=; \
		405	goto l0_%=; \
		406	l1_%=: \
		407	r0 /= 0; /* div by zero */ \
		408	l0_%=: \
		409	r0 = 0; \
		410	exit; \
		411	" :
		412	: __imm(bpf_get_prandom_u32)
		413	: __clobber_all);
		414	}
		415
		416	/*
		417	* Test that regsafe() prevents pruning when two paths reach the same program
		418	* point with linked registers carrying different ADD_CONST flags (one
		419	* BPF_ADD_CONST32 from alu32, another BPF_ADD_CONST64 from alu64).
		420	*/
		421	SEC("socket")
		422	__failure __msg("div by zero")
		423	__flag(BPF_F_TEST_STATE_FREQ)
		424	__naked void scalars_alu32_alu64_regsafe_pruning(void)
		425	{
		426	asm volatile (" \
		427	call %[bpf_get_prandom_u32]; \
		428	w6 = w0; /* r6 in [0, 0xFFFFFFFF] */ \
		429	r7 = r6; /* linked: same id as r6 */ \
		430	/* Get another random value for the path branch */ \
		431	call %[bpf_get_prandom_u32]; \
		432	if r0 > 0 goto l_pathb_%=; \
		433	/* Path A: alu32 */ \
		434	w7 += 1; /* BPF_ADD_CONST32, delta = 1 */\
		435	goto l_merge_%=; \
		436	l_pathb_%=: \
		437	/* Path B: alu64 */ \
		438	r7 += 1; /* BPF_ADD_CONST64, delta = 1 */\
		439	l_merge_%=: \
		440	/* Merge point: regsafe() compares path B against cached path A. */ \
		441	/* Narrow r6 to trigger sync_linked_regs for r7 */ \
		442	r9 = 0xFFFFffff ll; \
		443	if r6 < r9 goto l0_%=; \
		444	/* r6 = 0xFFFFFFFF */ \
		445	/* sync: r7 = 0xFFFFFFFF + 1 = 0x100000000 */ \
		446	/* Path A: zext -> r7 = 0 */ \
		447	/* Path B: no zext -> r7 = 0x100000000 */ \
		448	r7 >>= 32; \
		449	if r7 == 0 goto l0_%=; \
		450	r0 /= 0; /* div by zero on path B */ \
		451	l0_%=: \
		452	r0 = 0; \
		453	exit; \
		454	" :
		455	: __imm(bpf_get_prandom_u32)
		456	: __clobber_all);
		457	}
		458
351	SEC("socket")	459	SEC("socket")
352	__success	460	__success
353	void alu32_negative_offset(void)	461	void alu32_negative_offset(void)

tools/testing/selftests/bpf/progs/verifier_sdiv.c+58−0

@@ -1209,6 +1209,64 @@ __naked void smod32_ri_divisor_neg_1(void) · 1208 unmodified lines
1209	: __clobber_all);	1209	: __clobber_all);
1210	}	1210	}
1211		1211
		1212	SEC("socket")
		1213	__description("SDIV32, INT_MIN divided by 2, imm")
		1214	__success __success_unpriv __retval(-1073741824)
		1215	__naked void sdiv32_int_min_div_2_imm(void)
		1216	{
		1217	asm volatile (" \
		1218	w0 = %[int_min]; \
		1219	w0 s/= 2; \
		1220	exit; \
		1221	" :
		1222	: __imm_const(int_min, INT_MIN)
		1223	: __clobber_all);
		1224	}
		1225
		1226	SEC("socket")
		1227	__description("SDIV32, INT_MIN divided by 2, reg")
		1228	__success __success_unpriv __retval(-1073741824)
		1229	__naked void sdiv32_int_min_div_2_reg(void)
		1230	{
		1231	asm volatile (" \
		1232	w0 = %[int_min]; \
		1233	w1 = 2; \
		1234	w0 s/= w1; \
		1235	exit; \
		1236	" :
		1237	: __imm_const(int_min, INT_MIN)
		1238	: __clobber_all);
		1239	}
		1240
		1241	SEC("socket")
		1242	__description("SMOD32, INT_MIN modulo 2, imm")
		1243	__success __success_unpriv __retval(0)
		1244	__naked void smod32_int_min_mod_2_imm(void)
		1245	{
		1246	asm volatile (" \
		1247	w0 = %[int_min]; \
		1248	w0 s%%= 2; \
		1249	exit; \
		1250	" :
		1251	: __imm_const(int_min, INT_MIN)
		1252	: __clobber_all);
		1253	}
		1254
		1255	SEC("socket")
		1256	__description("SMOD32, INT_MIN modulo -2, imm")
		1257	__success __success_unpriv __retval(0)
		1258	__naked void smod32_int_min_mod_neg2_imm(void)
		1259	{
		1260	asm volatile (" \
		1261	w0 = %[int_min]; \
		1262	w0 s%%= -2; \
		1263	exit; \
		1264	" :
		1265	: __imm_const(int_min, INT_MIN)
		1266	: __clobber_all);
		1267	}
		1268
		1269
1212	#else	1270	#else
1213		1271
1214	SEC("socket")	1272	SEC("socket")

tools/testing/selftests/hid/progs/hid_bpf_helpers.h+12−0

 #define __HID_BPF_HELPERS_H
 /* "undefine" structs and enums in vmlinux.h, because we "override" them below */
+#define bpf_wq bpf_wq___not_used
 #define hid_bpf_ctx hid_bpf_ctx___not_used
 #define hid_bpf_ops hid_bpf_ops___not_used
+#define hid_device hid_device___not_used
 #define hid_report_type hid_report_type___not_used
 #define hid_class_request hid_class_request___not_used
 #define hid_bpf_attach_flags hid_bpf_attach_flags___not_used
 #include "vmlinux.h"
+#undef bpf_wq
 #undef hid_bpf_ctx
 #undef hid_bpf_ops
+#undef hid_device
 #undef hid_report_type
 #undef hid_class_request
 #undef hid_bpf_attach_flags
 	HID_REPORT_TYPES,
 };
+struct hid_device {
+	unsigned int id;
+} __attribute__((preserve_access_index));
+struct bpf_wq {
+	__u64 __opaque[2];
+};
 struct hid_bpf_ctx {
 	struct hid_device *hid;
 	__u32 allocated_size;

@@ -37,19 +37,19 @@ const u64 amdgpu_dm_supported_degam_tfs = · 36 unmodified lines
37	BIT(DRM_COLOROP_1D_CURVE_SRGB_EOTF) \|	37	BIT(DRM_COLOROP_1D_CURVE_SRGB_EOTF) \|
38	BIT(DRM_COLOROP_1D_CURVE_PQ_125_EOTF) \|	38	BIT(DRM_COLOROP_1D_CURVE_PQ_125_EOTF) \|
39	BIT(DRM_COLOROP_1D_CURVE_BT2020_INV_OETF) \|	39	BIT(DRM_COLOROP_1D_CURVE_BT2020_INV_OETF) \|
40	BIT(DRM_COLOROP_1D_CURVE_GAMMA22_INV);	40	BIT(DRM_COLOROP_1D_CURVE_GAMMA22);
41		41
42	const u64 amdgpu_dm_supported_shaper_tfs =	42	const u64 amdgpu_dm_supported_shaper_tfs =
43	BIT(DRM_COLOROP_1D_CURVE_SRGB_INV_EOTF) \|	43	BIT(DRM_COLOROP_1D_CURVE_SRGB_INV_EOTF) \|
44	BIT(DRM_COLOROP_1D_CURVE_PQ_125_INV_EOTF) \|	44	BIT(DRM_COLOROP_1D_CURVE_PQ_125_INV_EOTF) \|
45	BIT(DRM_COLOROP_1D_CURVE_BT2020_OETF) \|	45	BIT(DRM_COLOROP_1D_CURVE_BT2020_OETF) \|
46	BIT(DRM_COLOROP_1D_CURVE_GAMMA22);	46	BIT(DRM_COLOROP_1D_CURVE_GAMMA22_INV);
47		47
48	const u64 amdgpu_dm_supported_blnd_tfs =	48	const u64 amdgpu_dm_supported_blnd_tfs =
49	BIT(DRM_COLOROP_1D_CURVE_SRGB_EOTF) \|	49	BIT(DRM_COLOROP_1D_CURVE_SRGB_EOTF) \|
50	BIT(DRM_COLOROP_1D_CURVE_PQ_125_EOTF) \|	50	BIT(DRM_COLOROP_1D_CURVE_PQ_125_EOTF) \|
51	BIT(DRM_COLOROP_1D_CURVE_BT2020_INV_OETF) \|	51	BIT(DRM_COLOROP_1D_CURVE_BT2020_INV_OETF) \|
52	BIT(DRM_COLOROP_1D_CURVE_GAMMA22_INV);	52	BIT(DRM_COLOROP_1D_CURVE_GAMMA22);
53		53
54	#define MAX_COLOR_PIPELINE_OPS 10	54	#define MAX_COLOR_PIPELINE_OPS 10
55		55