lael-labs/linux

.mailmap+2−0

 Hans Verkuil <hverkuil@kernel.org> <hansverk@cisco.com>
 Hao Ge <hao.ge@linux.dev> <gehao@kylinos.cn>
 Harry Yoo <harry.yoo@oracle.com> <42.hyeyoo@gmail.com>
+Harry Yoo <harry@kernel.org> <harry.yoo@oracle.com>
 Heiko Carstens <hca@linux.ibm.com> <h.carstens@de.ibm.com>
 Heiko Carstens <hca@linux.ibm.com> <heiko.carstens@de.ibm.com>
 Heiko Stuebner <heiko@sntech.de> <heiko.stuebner@bqreaders.com>
 Morten Welinder <welinder@anemone.rentec.com>
 Morten Welinder <welinder@darter.rentec.com>
 Morten Welinder <welinder@troll.com>
+Muhammad Usama Anjum <usama.anjum@arm.com> <usama.anjum@collabora.com>
 Mukesh Ojha <quic_mojha@quicinc.com> <mojha@codeaurora.org>
 Muna Sinada <quic_msinada@quicinc.com> <msinada@codeaurora.org>
 Murali Nalajala <quic_mnalajal@quicinc.com> <mnalajal@codeaurora.org>

Documentation/PCI/pcieaer-howto.rst+10−0

@@ -85,6 +85,16 @@ In the example, 'Requester ID' means the ID of the device that sent · 84 unmodified lines
85	the error message to the Root Port. Please refer to PCIe specs for other	85	the error message to the Root Port. Please refer to PCIe specs for other
86	fields.	86	fields.
87		87
		88	The 'TLP Header' is the prefix/header of the TLP that caused the error
		89	in raw hex format. To decode the TLP Header into human-readable form
		90	one may use tlp-tool:
		91
		92	https://github.com/mmpg-x86/tlp-tool
		93
		94	Example usage::
		95
		96	curl -L https://git.kernel.org/linus/2ca1c94ce0b6 \| rtlp-tool --aer
		97
88	AER Ratelimits	98	AER Ratelimits
89	--------------	99	--------------
90		100

Documentation/core-api/dma-attributes.rst+30−8

@@ -149,11 +149,33 @@ For architectures that require cache flushing for DMA coherence · 148 unmodified lines
149	DMA_ATTR_MMIO will not perform any cache flushing. The address	149	DMA_ATTR_MMIO will not perform any cache flushing. The address
150	provided must never be mapped cacheable into the CPU.	150	provided must never be mapped cacheable into the CPU.
151		151
152	DMA_ATTR_CPU_CACHE_CLEAN	152	DMA_ATTR_DEBUGGING_IGNORE_CACHELINES
153	------------------------	153	------------------------------------
154		154
155	This attribute indicates the CPU will not dirty any cacheline overlapping this	155	This attribute indicates that CPU cache lines may overlap for buffers mapped
156	DMA_FROM_DEVICE/DMA_BIDIRECTIONAL buffer while it is mapped. This allows	156	with DMA_FROM_DEVICE or DMA_BIDIRECTIONAL.
157	multiple small buffers to safely share a cacheline without risk of data	157
158	corruption, suppressing DMA debug warnings about overlapping mappings.	158	Such overlap may occur when callers map multiple small buffers that reside
159	All mappings sharing a cacheline should have this attribute.	159	within the same cache line. In this case, callers must guarantee that the CPU
		160	will not dirty these cache lines after the mappings are established. When this
		161	condition is met, multiple buffers can safely share a cache line without risking
		162	data corruption.
		163
		164	All mappings that share a cache line must set this attribute to suppress DMA
		165	debug warnings about overlapping mappings.
		166
		167	DMA_ATTR_REQUIRE_COHERENT
		168	-------------------------
		169
		170	DMA mapping requests with the DMA_ATTR_REQUIRE_COHERENT fail on any
		171	system where SWIOTLB or cache management is required. This should only
		172	be used to support uAPI designs that require continuous HW DMA
		173	coherence with userspace processes, for example RDMA and DRM. At a
		174	minimum the memory being mapped must be userspace memory from
		175	pin_user_pages() or similar.
		176
		177	Drivers should consider using dma_mmap_pages() instead of this
		178	interface when building their uAPIs, when possible.
		179
		180	It must never be used in an in-kernel driver that only works with
		181	kernel memory.

Documentation/filesystems/overlayfs.rst+50−0

@@ -783,6 +783,56 @@ controlled by the "uuid" mount option, which supports these values: · 782 unmodified lines
783	mounted with "uuid=on".	783	mounted with "uuid=on".
784		784
785		785
		786	Durability and copy up
		787	----------------------
		788
		789	The fsync(2) system call ensures that the data and metadata of a file
		790	are safely written to the backing storage, which is expected to
		791	guarantee the existence of the information post system crash.
		792
		793	Without an fsync(2) call, there is no guarantee that the observed
		794	data after a system crash will be either the old or the new data, but
		795	in practice, the observed data after crash is often the old or new data
		796	or a mix of both.
		797
		798	When an overlayfs file is modified for the first time, copy up will
		799	create a copy of the lower file and its parent directories in the upper
		800	layer. Since the Linux filesystem API does not enforce any particular
		801	ordering on storing changes without explicit fsync(2) calls, in case
		802	of a system crash, the upper file could end up with no data at all
		803	(i.e. zeros), which would be an unusual outcome. To avoid this
		804	experience, overlayfs calls fsync(2) on the upper file before completing
		805	data copy up with rename(2) or link(2) to make the copy up "atomic".
		806
		807	By default, overlayfs does not explicitly call fsync(2) on copied up
		808	directories or on metadata-only copy up, so it provides no guarantee to
		809	persist the user's modification unless the user calls fsync(2).
		810	The fsync during copy up only guarantees that if a copy up is observed
		811	after a crash, the observed data is not zeroes or intermediate values
		812	from the copy up staging area.
		813
		814	On traditional local filesystems with a single journal (e.g. ext4, xfs),
		815	fsync on a file also persists the parent directory changes, because they
		816	are usually modified in the same transaction, so metadata durability during
		817	data copy up effectively comes for free. Overlayfs further limits risk by
		818	disallowing network filesystems as upper layer.
		819
		820	Overlayfs can be tuned to prefer performance or durability when storing
		821	to the underlying upper layer. This is controlled by the "fsync" mount
		822	option, which supports these values:
		823
		824	- "auto": (default)
		825	Call fsync(2) on upper file before completion of data copy up.
		826	No explicit fsync(2) on directory or metadata-only copy up.
		827	- "strict":
		828	Call fsync(2) on upper file and directories before completion of any
		829	copy up.
		830	- "volatile": [*]
		831	Prefer performance over durability (see `Volatile mount`_)
		832
		833	[*] The mount option "volatile" is an alias to "fsync=volatile".
		834
		835
786	Volatile mount	836	Volatile mount
787	--------------	837	--------------
788		838

Documentation/hwmon/adm1177.rst+4−4

@@ -27,10 +27,10 @@ for details. · 26 unmodified lines
27	Sysfs entries	27	Sysfs entries
28	-------------	28	-------------
29		29
30	The following attributes are supported. Current maxim attribute	30	The following attributes are supported. Current maximum attribute
31	is read-write, all other attributes are read-only.	31	is read-write, all other attributes are read-only.
32		32
33	in0_input Measured voltage in microvolts.	33	in0_input Measured voltage in millivolts.
34		34
35	curr1_input Measured current in microamperes.	35	curr1_input Measured current in milliamperes.
36	curr1_max_alarm Overcurrent alarm in microamperes.	36	curr1_max Overcurrent shutdown threshold in milliamperes.

Documentation/hwmon/peci-cputemp.rst+6−4

 temp1_crit		Provides shutdown temperature of the CPU package which
 			is also known as the maximum processor junction
 			temperature, Tjmax or Tprochot.
-temp1_crit_hyst		Provides the hysteresis value from Tcontrol to Tjmax of
+temp1_crit_hyst		Provides the hysteresis temperature of the CPU
-			the CPU package.
+			package. Returns Tcontrol, the temperature at which
+			the critical condition clears.
 temp2_label		"DTS"
 temp2_input		Provides current temperature of the CPU package scaled
 temp2_crit		Provides shutdown temperature of the CPU package which
 			is also known as the maximum processor junction
 			temperature, Tjmax or Tprochot.
-temp2_crit_hyst		Provides the hysteresis value from Tcontrol to Tjmax of
+temp2_crit_hyst		Provides the hysteresis temperature of the CPU
-			the CPU package.
+			package. Returns Tcontrol, the temperature at which
+			the critical condition clears.
 temp3_label		"Tcontrol"
 temp3_input		Provides current Tcontrol temperature of the CPU

Documentation/userspace-api/landlock.rst+19−4

 =====================================
 :Author: Mickaël Salaün
-:Date: January 2026
+:Date: March 2026
 The goal of Landlock is to enable restriction of ambient rights (e.g. global
 filesystem or network access) for a set of processes.  Because Landlock
 .. code-block:: c
-    __u32 restrict_flags = LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON;
+    __u32 restrict_flags =
-    if (abi < 7) {
+        LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON |
-        /* Clear logging flags unsupported before ABI 7. */
+        LANDLOCK_RESTRICT_SELF_TSYNC;
+    switch (abi) {
+    case 1 ... 6:
+        /* Removes logging flags for ABI < 7 */
         restrict_flags &= ~(LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF |
                             LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON |
                             LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_OFF);
+        __attribute__((fallthrough));
+    case 7:
+        /*
+         * Removes multithreaded enforcement flag for ABI < 8
+         *
+         * WARNING: Without this flag, calling landlock_restrict_self(2) is
+         * only equivalent if the calling process is single-threaded. Below
+         * ABI v8 (and as of ABI v8, when not using this flag), a Landlock
+         * policy would only be enforced for the calling thread and its
+         * children (and not for all threads, including parents and siblings).
+         */
+        restrict_flags &= ~LANDLOCK_RESTRICT_SELF_TSYNC;
     }
 The next step is to restrict the current thread from gaining more privileges

MAINTAINERS+16−7

 ASUS NOTEBOOKS AND EEEPC ACPI/WMI EXTRAS DRIVERS
 M:	Corentin Chary <corentin.chary@gmail.com>
 M:	Luke D. Jones <luke@ljones.dev>
-M:	Denis Benato <benato.denis96@gmail.com>
+M:	Denis Benato <denis.benato@linux.dev>
 L:	platform-driver-x86@vger.kernel.org
 S:	Maintained
 W:	https://asus-linux.org/
 F:	include/uapi/drm/lima_drm.h
 DRM DRIVERS FOR LOONGSON
+M:	Jianmin Lv <lvjianmin@loongson.cn>
+M:	Qianhai Wu <wuqianhai@loongson.cn>
+R:	Huacai Chen <chenhuacai@kernel.org>
+R:	Mingcong Bai <jeffbai@aosc.io>
+R:	Xi Ruoyao <xry111@xry111.site>
+R:	Icenowy Zheng <zhengxingda@iscas.ac.cn>
 L:	dri-devel@lists.freedesktop.org
-S:	Orphan
+S:	Maintained
 T:	git https://gitlab.freedesktop.org/drm/misc/kernel.git
 F:	drivers/gpu/drm/loongson/
 EXT4 FILE SYSTEM
 M:	"Theodore Ts'o" <tytso@mit.edu>
-M:	Andreas Dilger <adilger.kernel@dilger.ca>
+R:	Andreas Dilger <adilger.kernel@dilger.ca>
+R:	Baokun Li <libaokun@linux.alibaba.com>
+R:	Jan Kara <jack@suse.cz>
+R:	Ojaswin Mujoo <ojaswin@linux.ibm.com>
+R:	Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+R:	Zhang Yi <yi.zhang@huawei.com>
 L:	linux-ext4@vger.kernel.org
 S:	Maintained
 W:	http://ext4.wiki.kernel.org
 M:	Wolfram Sang <wsa+renesas@sang-engineering.com>
 L:	linux-i2c@vger.kernel.org
 S:	Maintained
-W:	https://i2c.wiki.kernel.org/
 Q:	https://patchwork.ozlabs.org/project/linux-i2c/list/
 T:	git git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux.git
 F:	Documentation/i2c/
 M:	Andi Shyti <andi.shyti@kernel.org>
 L:	linux-i2c@vger.kernel.org
 S:	Maintained
-W:	https://i2c.wiki.kernel.org/
 Q:	https://patchwork.ozlabs.org/project/linux-i2c/list/
 T:	git git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux.git
 F:	Documentation/devicetree/bindings/i2c/
 R:	Rik van Riel <riel@surriel.com>
 R:	Liam R. Howlett <Liam.Howlett@oracle.com>
 R:	Vlastimil Babka <vbabka@kernel.org>
-R:	Harry Yoo <harry.yoo@oracle.com>
+R:	Harry Yoo <harry@kernel.org>
 R:	Jann Horn <jannh@google.com>
 L:	linux-mm@kvack.org
 S:	Maintained
 SLAB ALLOCATOR
 M:	Vlastimil Babka <vbabka@kernel.org>
-M:	Harry Yoo <harry.yoo@oracle.com>
+M:	Harry Yoo <harry@kernel.org>
 M:	Andrew Morton <akpm@linux-foundation.org>
 R:	Hao Li <hao.li@linux.dev>
 R:	Christoph Lameter <cl@gentwo.org>

Makefile+2−2

@@ -2,7 +2,7 @@ · 1 unmodified line
2	VERSION = 7	2	VERSION = 7
3	PATCHLEVEL = 0	3	PATCHLEVEL = 0
4	SUBLEVEL = 0	4	SUBLEVEL = 0
5	EXTRAVERSION = -rc5	5	EXTRAVERSION = -rc6
6	NAME = Baby Opossum Posse	6	NAME = Baby Opossum Posse
7		7
8	# DOCUMENTATION	8	# DOCUMENTATION
@@ -1654,7 +1654,7 @@ CLEAN_FILES += vmlinux.symvers modules-only.symvers \ · 1645 unmodified lines
1654	modules.builtin.ranges vmlinux.o.map vmlinux.unstripped \	1654	modules.builtin.ranges vmlinux.o.map vmlinux.unstripped \
1655	compile_commands.json rust/test \	1655	compile_commands.json rust/test \
1656	rust-project.json .vmlinux.objs .vmlinux.export.c \	1656	rust-project.json .vmlinux.objs .vmlinux.export.c \
1657	.builtin-dtbs-list .builtin-dtb.S	1657	.builtin-dtbs-list .builtin-dtbs.S
1658		1658
1659	# Directories & files removed with 'make mrproper'	1659	# Directories & files removed with 'make mrproper'
1660	MRPROPER_FILES += include/config include/generated \	1660	MRPROPER_FILES += include/config include/generated \

arch/arm64/kvm/at.c+1−1

@@ -1753,7 +1753,7 @@ int __kvm_at_swap_desc(struct kvm *kvm, gpa_t ipa, u64 old, u64 new) · 1752 unmodified lines
1753	if (!writable)	1753	if (!writable)
1754	return -EPERM;	1754	return -EPERM;
1755		1755
1756	ptep = (u64 __user *)hva + offset;	1756	ptep = (void __user *)hva + offset;
1757	if (cpus_have_final_cap(ARM64_HAS_LSE_ATOMICS))	1757	if (cpus_have_final_cap(ARM64_HAS_LSE_ATOMICS))
1758	r = __lse_swap_desc(ptep, old, new);	1758	r = __lse_swap_desc(ptep, old, new);
1759	else	1759	else

arch/arm64/kvm/reset.c+14−0

@@ -247,6 +247,20 @@ void kvm_reset_vcpu(struct kvm_vcpu *vcpu) · 246 unmodified lines
247	kvm_vcpu_set_be(vcpu);	247	kvm_vcpu_set_be(vcpu);
248		248
249	*vcpu_pc(vcpu) = target_pc;	249	*vcpu_pc(vcpu) = target_pc;
		250
		251	/*
		252	* We may come from a state where either a PC update was
		253	* pending (SMC call resulting in PC being increpented to
		254	* skip the SMC) or a pending exception. Make sure we get
		255	* rid of all that, as this cannot be valid out of reset.
		256	*
		257	* Note that clearing the exception mask also clears PC
		258	* updates, but that's an implementation detail, and we
		259	* really want to make it explicit.
		260	*/
		261	vcpu_clear_flag(vcpu, PENDING_EXCEPTION);
		262	vcpu_clear_flag(vcpu, EXCEPT_MASK);
		263	vcpu_clear_flag(vcpu, INCREMENT_PC);
250	vcpu_set_reg(vcpu, 0, reset_state.r0);	264	vcpu_set_reg(vcpu, 0, reset_state.r0);
251	}	265	}
252		266

arch/loongarch/include/asm/linkage.h+36−0

@@ -41,4 +41,40 @@ · 40 unmodified lines
41	.cfi_endproc; \	41	.cfi_endproc; \
42	SYM_END(name, SYM_T_NONE)	42	SYM_END(name, SYM_T_NONE)
43		43
		44	/*
		45	* This is for the signal handler trampoline, which is used as the return
		46	* address of the signal handlers in userspace instead of called normally.
		47	* The long standing libgcc bug https://gcc.gnu.org/PR124050 requires a
		48	* nop between .cfi_startproc and the actual address of the trampoline, so
		49	* we cannot simply use SYM_FUNC_START.
		50	*
		51	* This wrapper also contains all the .cfi_* directives for recovering
		52	* the content of the GPRs and the "return address" (where the rt_sigreturn
		53	* syscall will jump to), assuming there is a struct rt_sigframe (where
		54	* a struct sigcontext containing those information we need to recover) at
		55	* $sp. The "DWARF for the LoongArch(TM) Architecture" manual states
		56	* column 0 is for $zero, but it does not make too much sense to
		57	* save/restore the hardware zero register. Repurpose this column here
		58	* for the return address (here it's not the content of $ra we cannot use
		59	* the default column 3).
		60	*/
		61	#define SYM_SIGFUNC_START(name) \
		62	.cfi_startproc; \
		63	.cfi_signal_frame; \
		64	.cfi_def_cfa 3, RT_SIGFRAME_SC; \
		65	.cfi_return_column 0; \
		66	.cfi_offset 0, SC_PC; \
		67	\
		68	.irp num, 1, 2, 3, 4, 5, 6, 7, 8, \
		69	9, 10, 11, 12, 13, 14, 15, 16, \
		70	17, 18, 19, 20, 21, 22, 23, 24, \
		71	25, 26, 27, 28, 29, 30, 31; \
		72	.cfi_offset \num, SC_REGS + \num * SZREG; \
		73	.endr; \
		74	\
		75	nop; \
		76	SYM_START(name, SYM_L_GLOBAL, SYM_A_ALIGN)
		77
		78	#define SYM_SIGFUNC_END(name) SYM_FUNC_END(name)
		79
44	#endif	80	#endif

arch/loongarch/include/asm/sigframe.h+9−0

@@ -0,0 +1,9 @@
	1	/* SPDX-License-Identifier: GPL-2.0+ */
	2
	3	#include <asm/siginfo.h>
	4	#include <asm/ucontext.h>
	5
	6	struct rt_sigframe {
	7	struct siginfo rs_info;
	8	struct ucontext rs_uctx;
	9	};

arch/loongarch/kernel/asm-offsets.c+2−0

 #include <asm/ptrace.h>
 #include <asm/processor.h>
 #include <asm/ftrace.h>
+#include <asm/sigframe.h>
 #include <vdso/datapage.h>
 static void __used output_ptreg_defines(void)
 	COMMENT("Linux sigcontext offsets.");
 	OFFSET(SC_REGS, sigcontext, sc_regs);
 	OFFSET(SC_PC, sigcontext, sc_pc);
+	OFFSET(RT_SIGFRAME_SC, rt_sigframe, rs_uctx.uc_mcontext);
 	BLANK();
 }

arch/loongarch/kernel/env.c+3−4

 	int cpu, ret;
 	char *cpuname;
 	const char *model;
-	struct device_node *root;
 	/* Parsing cpuname from DTS model property */
-	root = of_find_node_by_path("/");
+	ret = of_property_read_string(of_root, "model", &model);
-	ret = of_property_read_string(root, "model", &model);
 	if (ret == 0) {
 		cpuname = kstrdup(model, GFP_KERNEL);
+		if (!cpuname)
+			return -ENOMEM;
 		loongson_sysconf.cpuname = strsep(&cpuname, " ");
 	}
-	of_node_put(root);
 	if (loongson_sysconf.cpuname && !strncmp(loongson_sysconf.cpuname, "Loongson", 8)) {
 		for (cpu = 0; cpu < NR_CPUS; cpu++)

arch/loongarch/kernel/signal.c+1−5

 #include <asm/cpu-features.h>
 #include <asm/fpu.h>
 #include <asm/lbt.h>
+#include <asm/sigframe.h>
 #include <asm/ucontext.h>
 #include <asm/vdso.h>
 #define lock_lbt_owner()	({ preempt_disable(); pagefault_disable(); })
 #define unlock_lbt_owner()	({ pagefault_enable(); preempt_enable(); })
-struct rt_sigframe {
-	struct siginfo rs_info;
-	struct ucontext rs_uctx;
-};
 struct _ctx_layout {
 	struct sctx_info *addr;
 	unsigned int size;

arch/loongarch/kvm/intc/eiointc.c+8−8

@@ -83,7 +83,7 @@ static inline void eiointc_update_sw_coremap(struct loongarch_eiointc *s, · 82 unmodified lines
83		83
84	if (!(s->status & BIT(EIOINTC_ENABLE_CPU_ENCODE))) {	84	if (!(s->status & BIT(EIOINTC_ENABLE_CPU_ENCODE))) {
85	cpuid = ffs(cpuid) - 1;	85	cpuid = ffs(cpuid) - 1;
86	cpuid = (cpuid >= 4) ? 0 : cpuid;	86	cpuid = ((cpuid < 0) \|\| (cpuid >= 4)) ? 0 : cpuid;
87	}	87	}
88		88
89	vcpu = kvm_get_vcpu_by_cpuid(s->kvm, cpuid);	89	vcpu = kvm_get_vcpu_by_cpuid(s->kvm, cpuid);
@@ -472,34 +472,34 @@ static int kvm_eiointc_regs_access(struct kvm_device *dev, · 382 unmodified lines
472	switch (addr) {	472	switch (addr) {
473	case EIOINTC_NODETYPE_START ... EIOINTC_NODETYPE_END:	473	case EIOINTC_NODETYPE_START ... EIOINTC_NODETYPE_END:
474	offset = (addr - EIOINTC_NODETYPE_START) / 4;	474	offset = (addr - EIOINTC_NODETYPE_START) / 4;
475	p = s->nodetype + offset * 4;	475	p = (void )s->nodetype + offset 4;
476	break;	476	break;
477	case EIOINTC_IPMAP_START ... EIOINTC_IPMAP_END:	477	case EIOINTC_IPMAP_START ... EIOINTC_IPMAP_END:
478	offset = (addr - EIOINTC_IPMAP_START) / 4;	478	offset = (addr - EIOINTC_IPMAP_START) / 4;
479	p = &s->ipmap + offset * 4;	479	p = (void )&s->ipmap + offset 4;
480	break;	480	break;
481	case EIOINTC_ENABLE_START ... EIOINTC_ENABLE_END:	481	case EIOINTC_ENABLE_START ... EIOINTC_ENABLE_END:
482	offset = (addr - EIOINTC_ENABLE_START) / 4;	482	offset = (addr - EIOINTC_ENABLE_START) / 4;
483	p = s->enable + offset * 4;	483	p = (void )s->enable + offset 4;
484	break;	484	break;
485	case EIOINTC_BOUNCE_START ... EIOINTC_BOUNCE_END:	485	case EIOINTC_BOUNCE_START ... EIOINTC_BOUNCE_END:
486	offset = (addr - EIOINTC_BOUNCE_START) / 4;	486	offset = (addr - EIOINTC_BOUNCE_START) / 4;
487	p = s->bounce + offset * 4;	487	p = (void )s->bounce + offset 4;
488	break;	488	break;
489	case EIOINTC_ISR_START ... EIOINTC_ISR_END:	489	case EIOINTC_ISR_START ... EIOINTC_ISR_END:
490	offset = (addr - EIOINTC_ISR_START) / 4;	490	offset = (addr - EIOINTC_ISR_START) / 4;
491	p = s->isr + offset * 4;	491	p = (void )s->isr + offset 4;
492	break;	492	break;
493	case EIOINTC_COREISR_START ... EIOINTC_COREISR_END:	493	case EIOINTC_COREISR_START ... EIOINTC_COREISR_END:
494	if (cpu >= s->num_cpu)	494	if (cpu >= s->num_cpu)
495	return -EINVAL;	495	return -EINVAL;
496		496
497	offset = (addr - EIOINTC_COREISR_START) / 4;	497	offset = (addr - EIOINTC_COREISR_START) / 4;
498	p = s->coreisr[cpu] + offset * 4;	498	p = (void )s->coreisr[cpu] + offset 4;
499	break;	499	break;
500	case EIOINTC_COREMAP_START ... EIOINTC_COREMAP_END:	500	case EIOINTC_COREMAP_START ... EIOINTC_COREMAP_END:
501	offset = (addr - EIOINTC_COREMAP_START) / 4;	501	offset = (addr - EIOINTC_COREMAP_START) / 4;
502	p = s->coremap + offset * 4;	502	p = (void )s->coremap + offset 4;
503	break;	503	break;
504	default:	504	default:
505	kvm_err("%s: unknown eiointc register, addr = %d\n", __func__, addr);	505	kvm_err("%s: unknown eiointc register, addr = %d\n", __func__, addr);

arch/loongarch/kvm/vcpu.c+3−0

@@ -588,6 +588,9 @@ struct kvm_vcpu kvm_get_vcpu_by_cpuid(struct kvm kvm, int cpuid) · 587 unmodified lines
588	{	588	{
589	struct kvm_phyid_map *map;	589	struct kvm_phyid_map *map;
590		590
		591	if (cpuid < 0)
		592	return NULL;
		593
591	if (cpuid >= KVM_MAX_PHYID)	594	if (cpuid >= KVM_MAX_PHYID)
592	return NULL;	595	return NULL;
593		596

arch/loongarch/pci/pci.c+80−0

@@ -5,9 +5,11 @@ · 4 unmodified lines
5	#include <linux/kernel.h>	5	#include <linux/kernel.h>
6	#include <linux/init.h>	6	#include <linux/init.h>
7	#include <linux/acpi.h>	7	#include <linux/acpi.h>
		8	#include <linux/delay.h>
8	#include <linux/types.h>	9	#include <linux/types.h>
9	#include <linux/pci.h>	10	#include <linux/pci.h>
10	#include <linux/vgaarb.h>	11	#include <linux/vgaarb.h>
		12	#include <linux/io-64-nonatomic-lo-hi.h>
11	#include <asm/cacheflush.h>	13	#include <asm/cacheflush.h>
12	#include <asm/loongson.h>	14	#include <asm/loongson.h>
13		15
@@ -15,6 +17,9 @@ · 1 unmodified line
15	#define PCI_DEVICE_ID_LOONGSON_DC1 0x7a06	17	#define PCI_DEVICE_ID_LOONGSON_DC1 0x7a06
16	#define PCI_DEVICE_ID_LOONGSON_DC2 0x7a36	18	#define PCI_DEVICE_ID_LOONGSON_DC2 0x7a36
17	#define PCI_DEVICE_ID_LOONGSON_DC3 0x7a46	19	#define PCI_DEVICE_ID_LOONGSON_DC3 0x7a46
		20	#define PCI_DEVICE_ID_LOONGSON_GPU1 0x7a15
		21	#define PCI_DEVICE_ID_LOONGSON_GPU2 0x7a25
		22	#define PCI_DEVICE_ID_LOONGSON_GPU3 0x7a35
18		23
19	int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,	24	int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
20	int reg, int len, u32 *val)	25	int reg, int len, u32 *val)
@@ -99,3 +104,78 @@ static void pci_fixup_vgadev(struct pci_dev *pdev) · 78 unmodified lines
99	DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LOONGSON, PCI_DEVICE_ID_LOONGSON_DC1, pci_fixup_vgadev);	104	DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LOONGSON, PCI_DEVICE_ID_LOONGSON_DC1, pci_fixup_vgadev);
100	DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LOONGSON, PCI_DEVICE_ID_LOONGSON_DC2, pci_fixup_vgadev);	105	DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LOONGSON, PCI_DEVICE_ID_LOONGSON_DC2, pci_fixup_vgadev);
101	DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LOONGSON, PCI_DEVICE_ID_LOONGSON_DC3, pci_fixup_vgadev);	106	DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LOONGSON, PCI_DEVICE_ID_LOONGSON_DC3, pci_fixup_vgadev);
		107
		108	#define CRTC_NUM_MAX 2
		109	#define CRTC_OUTPUT_ENABLE 0x100
		110
		111	static void loongson_gpu_fixup_dma_hang(struct pci_dev *pdev, bool on)
		112	{
		113	u32 i, val, count, crtc_offset, device;
		114	void __iomem crtc_reg, base, *regbase;
		115	static u32 crtc_status[CRTC_NUM_MAX] = { 0 };
		116
		117	base = pdev->bus->ops->map_bus(pdev->bus, pdev->devfn + 1, 0);
		118	device = readw(base + PCI_DEVICE_ID);
		119
		120	regbase = ioremap(readq(base + PCI_BASE_ADDRESS_0) & ~0xffull, SZ_64K);
		121	if (!regbase) {
		122	pci_err(pdev, "Failed to ioremap()\n");
		123	return;
		124	}
		125
		126	switch (device) {
		127	case PCI_DEVICE_ID_LOONGSON_DC2:
		128	crtc_reg = regbase + 0x1240;
		129	crtc_offset = 0x10;
		130	break;
		131	case PCI_DEVICE_ID_LOONGSON_DC3:
		132	crtc_reg = regbase;
		133	crtc_offset = 0x400;
		134	break;
		135	}
		136
		137	for (i = 0; i < CRTC_NUM_MAX; i++, crtc_reg += crtc_offset) {
		138	val = readl(crtc_reg);
		139
		140	if (!on)
		141	crtc_status[i] = val;
		142
		143	/* No need to fixup if the status is off at startup. */
		144	if (!(crtc_status[i] & CRTC_OUTPUT_ENABLE))
		145	continue;
		146
		147	if (on)
		148	val \|= CRTC_OUTPUT_ENABLE;
		149	else
		150	val &= ~CRTC_OUTPUT_ENABLE;
		151
		152	mb();
		153	writel(val, crtc_reg);
		154
		155	for (count = 0; count < 40; count++) {
		156	val = readl(crtc_reg) & CRTC_OUTPUT_ENABLE;
		157	if ((on && val) \|\| (!on && !val))
		158	break;
		159	udelay(1000);
		160	}
		161
		162	pci_info(pdev, "DMA hang fixup at reg[0x%lx]: 0x%x\n",
		163	(unsigned long)crtc_reg & 0xffff, readl(crtc_reg));
		164	}
		165
		166	iounmap(regbase);
		167	}
		168
		169	static void pci_fixup_dma_hang_early(struct pci_dev *pdev)
		170	{
		171	loongson_gpu_fixup_dma_hang(pdev, false);
		172	}
		173	DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_LOONGSON, PCI_DEVICE_ID_LOONGSON_GPU2, pci_fixup_dma_hang_early);
		174	DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_LOONGSON, PCI_DEVICE_ID_LOONGSON_GPU3, pci_fixup_dma_hang_early);
		175
		176	static void pci_fixup_dma_hang_final(struct pci_dev *pdev)
		177	{
		178	loongson_gpu_fixup_dma_hang(pdev, true);
		179	}
		180	DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LOONGSON, PCI_DEVICE_ID_LOONGSON_GPU2, pci_fixup_dma_hang_final);
		181	DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LOONGSON, PCI_DEVICE_ID_LOONGSON_GPU3, pci_fixup_dma_hang_final);

arch/loongarch/vdso/Makefile+2−2

@@ -26,7 +26,7 @@ cflags-vdso := $(ccflags-vdso) \ · 25 unmodified lines
26	$(filter -W%,$(filter-out -Wa$(comma)%,$(KBUILD_CFLAGS))) \	26	$(filter -W%,$(filter-out -Wa$(comma)%,$(KBUILD_CFLAGS))) \
27	-std=gnu11 -fms-extensions -O2 -g -fno-strict-aliasing -fno-common -fno-builtin \	27	-std=gnu11 -fms-extensions -O2 -g -fno-strict-aliasing -fno-common -fno-builtin \
28	-fno-stack-protector -fno-jump-tables -DDISABLE_BRANCH_PROFILING \	28	-fno-stack-protector -fno-jump-tables -DDISABLE_BRANCH_PROFILING \
29	$(call cc-option, -fno-asynchronous-unwind-tables) \	29	$(call cc-option, -fasynchronous-unwind-tables) \
30	$(call cc-option, -fno-stack-protector)	30	$(call cc-option, -fno-stack-protector)
31	aflags-vdso := $(ccflags-vdso) \	31	aflags-vdso := $(ccflags-vdso) \
32	-D__ASSEMBLY__ -Wa,-gdwarf-2	32	-D__ASSEMBLY__ -Wa,-gdwarf-2
@@ -41,7 +41,7 @@ endif · 8 unmodified lines
41		41
42	# VDSO linker flags.	42	# VDSO linker flags.
43	ldflags-y := -Bsymbolic --no-undefined -soname=linux-vdso.so.1 \	43	ldflags-y := -Bsymbolic --no-undefined -soname=linux-vdso.so.1 \
44	$(filter -E%,$(KBUILD_CFLAGS)) -shared --build-id -T	44	$(filter -E%,$(KBUILD_CFLAGS)) -shared --build-id --eh-frame-hdr -T
45		45
46	#	46	#
47	# Shared build commands.	47	# Shared build commands.

arch/loongarch/vdso/sigreturn.S+3−3

 #include <asm/regdef.h>
 #include <asm/asm.h>
+#include <asm/asm-offsets.h>
 	.section	.text
-	.cfi_sections	.debug_frame
-SYM_FUNC_START(__vdso_rt_sigreturn)
+SYM_SIGFUNC_START(__vdso_rt_sigreturn)
 	li.w	a7, __NR_rt_sigreturn
 	syscall	0
-SYM_FUNC_END(__vdso_rt_sigreturn)
+SYM_SIGFUNC_END(__vdso_rt_sigreturn)

arch/s390/include/asm/barrier.h+2−2

@@ -62,8 +62,8 @@ do { \ · 61 unmodified lines
62	* @size: number of elements in array	62	* @size: number of elements in array
63	*/	63	*/
64	#define array_index_mask_nospec array_index_mask_nospec	64	#define array_index_mask_nospec array_index_mask_nospec
65	static inline unsigned long array_index_mask_nospec(unsigned long index,	65	static __always_inline unsigned long array_index_mask_nospec(unsigned long index,
66	unsigned long size)	66	unsigned long size)
67	{	67	{
68	unsigned long mask;	68	unsigned long mask;
69		69

arch/s390/include/asm/kvm_host.h+3−0

@@ -710,6 +710,9 @@ void kvm_arch_crypto_clear_masks(struct kvm *kvm); · 709 unmodified lines
710	void kvm_arch_crypto_set_masks(struct kvm kvm, unsigned long apm,	710	void kvm_arch_crypto_set_masks(struct kvm kvm, unsigned long apm,
711	unsigned long aqm, unsigned long adm);	711	unsigned long aqm, unsigned long adm);
712		712
		713	#define SIE64_RETURN_NORMAL 0
		714	#define SIE64_RETURN_MCCK 1
		715
713	int __sie64a(phys_addr_t sie_block_phys, struct kvm_s390_sie_block sie_block, u64 rsa,	716	int __sie64a(phys_addr_t sie_block_phys, struct kvm_s390_sie_block sie_block, u64 rsa,
714	unsigned long gasce);	717	unsigned long gasce);
715		718

arch/s390/include/asm/stacktrace.h+1−1

@@ -62,7 +62,7 @@ struct stack_frame { · 61 unmodified lines
62	struct {	62	struct {
63	unsigned long sie_control_block;	63	unsigned long sie_control_block;
64	unsigned long sie_savearea;	64	unsigned long sie_savearea;
65	unsigned long sie_reason;	65	unsigned long sie_return;
66	unsigned long sie_flags;	66	unsigned long sie_flags;
67	unsigned long sie_control_block_phys;	67	unsigned long sie_control_block_phys;
68	unsigned long sie_guest_asce;	68	unsigned long sie_guest_asce;

arch/s390/kernel/asm-offsets.c+1−1

@@ -63,7 +63,7 @@ int main(void) · 62 unmodified lines
63	OFFSET(__SF_EMPTY, stack_frame, empty[0]);	63	OFFSET(__SF_EMPTY, stack_frame, empty[0]);
64	OFFSET(__SF_SIE_CONTROL, stack_frame, sie_control_block);	64	OFFSET(__SF_SIE_CONTROL, stack_frame, sie_control_block);
65	OFFSET(__SF_SIE_SAVEAREA, stack_frame, sie_savearea);	65	OFFSET(__SF_SIE_SAVEAREA, stack_frame, sie_savearea);
66	OFFSET(__SF_SIE_REASON, stack_frame, sie_reason);	66	OFFSET(__SF_SIE_RETURN, stack_frame, sie_return);
67	OFFSET(__SF_SIE_FLAGS, stack_frame, sie_flags);	67	OFFSET(__SF_SIE_FLAGS, stack_frame, sie_flags);
68	OFFSET(__SF_SIE_CONTROL_PHYS, stack_frame, sie_control_block_phys);	68	OFFSET(__SF_SIE_CONTROL_PHYS, stack_frame, sie_control_block_phys);
69	OFFSET(__SF_SIE_GUEST_ASCE, stack_frame, sie_guest_asce);	69	OFFSET(__SF_SIE_GUEST_ASCE, stack_frame, sie_guest_asce);

arch/s390/kernel/entry.S+5−2

 	stg	%r3,__SF_SIE_CONTROL(%r15)	# ...and virtual addresses
 	stg	%r4,__SF_SIE_SAVEAREA(%r15)	# save guest register save area
 	stg	%r5,__SF_SIE_GUEST_ASCE(%r15)	# save guest asce
-	xc	__SF_SIE_REASON(8,%r15),__SF_SIE_REASON(%r15) # reason code = 0
+	xc	__SF_SIE_RETURN(8,%r15),__SF_SIE_RETURN(%r15) # return code = 0
 	mvc	__SF_SIE_FLAGS(8,%r15),__TI_flags(%r14) # copy thread flags
 	lmg	%r0,%r13,0(%r4)			# load guest gprs 0-13
 	mvi	__TI_sie(%r14),1
 	xgr	%r4,%r4
 	xgr	%r5,%r5
 	lmg	%r6,%r14,__SF_GPRS(%r15)	# restore kernel registers
-	lg	%r2,__SF_SIE_REASON(%r15)	# return exit reason code
+	lg	%r2,__SF_SIE_RETURN(%r15)	# return sie return code
 	BR_EX	%r14
 SYM_FUNC_END(__sie64a)
 EXPORT_SYMBOL(__sie64a)
 	xgr	%r9,%r9
 	xgr	%r10,%r10
 	xgr	%r11,%r11
+	xgr	%r12,%r12
 	la	%r2,STACK_FRAME_OVERHEAD(%r15)	# pointer to pt_regs
 	mvc	__PT_R8(64,%r2),__LC_SAVE_AREA(%r13)
 	MBEAR	%r2,%r13
 	xgr	%r6,%r6
 	xgr	%r7,%r7
 	xgr	%r10,%r10
+	xgr	%r12,%r12
 	xc	__PT_FLAGS(8,%r11),__PT_FLAGS(%r11)
 	mvc	__PT_R8(64,%r11),__LC_SAVE_AREA(%r13)
 	MBEAR	%r11,%r13
 	xgr	%r6,%r6
 	xgr	%r7,%r7
 	xgr	%r10,%r10
+	xgr	%r12,%r12
 	stmg	%r8,%r9,__PT_PSW(%r11)
 	xc	__PT_FLAGS(8,%r11),__PT_FLAGS(%r11)
 	xc	__SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)

arch/s390/kernel/nmi.c+2−2

@@ -487,8 +487,8 @@ void notrace s390_do_machine_check(struct pt_regs *regs) · 486 unmodified lines
487	mcck_dam_code = (mci.val & MCIC_SUBCLASS_MASK);	487	mcck_dam_code = (mci.val & MCIC_SUBCLASS_MASK);
488	if (test_cpu_flag(CIF_MCCK_GUEST) &&	488	if (test_cpu_flag(CIF_MCCK_GUEST) &&
489	(mcck_dam_code & MCCK_CODE_NO_GUEST) != mcck_dam_code) {	489	(mcck_dam_code & MCCK_CODE_NO_GUEST) != mcck_dam_code) {
490	/* Set exit reason code for host's later handling */	490	/* Set sie return code for host's later handling */
491	((long )(regs->gprs[15] + __SF_SIE_REASON)) = -EINTR;	491	((struct stack_frame *)regs->gprs[15])->sie_return = SIE64_RETURN_MCCK;
492	}	492	}
493	clear_cpu_flag(CIF_MCCK_GUEST);	493	clear_cpu_flag(CIF_MCCK_GUEST);
494		494

arch/s390/kernel/syscall.c+4−1

  */
 #include <linux/cpufeature.h>
+#include <linux/nospec.h>
 #include <linux/errno.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
 	if (unlikely(test_and_clear_pt_regs_flag(regs, PIF_SYSCALL_RET_SET)))
 		goto out;
 	regs->gprs[2] = -ENOSYS;
-	if (likely(nr < NR_syscalls))
+	if (likely(nr < NR_syscalls)) {
+		nr = array_index_nospec(nr, NR_syscalls);
 		regs->gprs[2] = sys_call_table[nr](regs);
+	}
 out:
 	syscall_exit_to_user_mode(regs);
 }

arch/s390/kvm/dat.c+15−85

@@ -134,32 +134,6 @@ int dat_set_asce_limit(struct kvm_s390_mmu_cache mc, union asce asce, int newt · 133 unmodified lines
134	return 0;	134	return 0;
135	}	135	}
136		136
137	/**
138	* dat_crstep_xchg() - Exchange a gmap CRSTE with another.
139	* @crstep: Pointer to the CRST entry
140	* @new: Replacement entry.
141	* @gfn: The affected guest address.
142	* @asce: The ASCE of the address space.
143	*
144	* Context: This function is assumed to be called with kvm->mmu_lock held.
145	*/
146	void dat_crstep_xchg(union crste *crstep, union crste new, gfn_t gfn, union asce asce)
147	{
148	if (crstep->h.i) {
149	WRITE_ONCE(*crstep, new);
150	return;
151	} else if (cpu_has_edat2()) {
152	crdte_crste(crstep, *crstep, new, gfn, asce);
153	return;
154	}
155
156	if (machine_has_tlb_guest())
157	idte_crste(crstep, gfn, IDTE_GUEST_ASCE, asce, IDTE_GLOBAL);
158	else
159	idte_crste(crstep, gfn, 0, NULL_ASCE, IDTE_GLOBAL);
160	WRITE_ONCE(*crstep, new);
161	}
162
163	/**	137	/**
164	* dat_crstep_xchg_atomic() - Atomically exchange a gmap CRSTE with another.	138	* dat_crstep_xchg_atomic() - Atomically exchange a gmap CRSTE with another.
165	* @crstep: Pointer to the CRST entry.	139	* @crstep: Pointer to the CRST entry.
@@ -175,8 +149,8 @@ void dat_crstep_xchg(union crste *crstep, union crste new, gfn_t gfn, union asce · 9 unmodified lines
175	*	149	*
176	* Return: %true if the exchange was successful.	150	* Return: %true if the exchange was successful.
177	*/	151	*/
178	bool dat_crstep_xchg_atomic(union crste *crstep, union crste old, union crste new, gfn_t gfn,	152	bool __must_check dat_crstep_xchg_atomic(union crste *crstep, union crste old, union crste new,
179	union asce asce)	153	gfn_t gfn, union asce asce)
180	{	154	{
181	if (old.h.i)	155	if (old.h.i)
182	return arch_try_cmpxchg((long *)crstep, &old.val, new.val);	156	return arch_try_cmpxchg((long *)crstep, &old.val, new.val);
@@ -292,6 +266,7 @@ static int dat_split_ste(struct kvm_s390_mmu_cache mc, union pmd pmdp, gfn_t g · 109 unmodified lines
292	pt->ptes[i].val = init.val \| i * PAGE_SIZE;	266	pt->ptes[i].val = init.val \| i * PAGE_SIZE;
293	/* No need to take locks as the page table is not installed yet. */	267	/* No need to take locks as the page table is not installed yet. */
294	pgste_init.prefix_notif = old.s.fc1.prefix_notif;	268	pgste_init.prefix_notif = old.s.fc1.prefix_notif;
		269	pgste_init.vsie_notif = old.s.fc1.vsie_notif;
295	pgste_init.pcl = uses_skeys && init.h.i;	270	pgste_init.pcl = uses_skeys && init.h.i;
296	dat_init_pgstes(pt, pgste_init.val);	271	dat_init_pgstes(pt, pgste_init.val);
297	} else {	272	} else {
@@ -893,7 +868,8 @@ static long _dat_slot_crste(union crste *crstep, gfn_t gfn, gfn_t next, struct d · 595 unmodified lines
893		868
894	/* This table entry needs to be updated. */	869	/* This table entry needs to be updated. */
895	if (walk->start <= gfn && walk->end >= next) {	870	if (walk->start <= gfn && walk->end >= next) {
896	dat_crstep_xchg_atomic(crstep, crste, new_crste, gfn, walk->asce);	871	if (!dat_crstep_xchg_atomic(crstep, crste, new_crste, gfn, walk->asce))
		872	return -EINVAL;
897	/* A lower level table was present, needs to be freed. */	873	/* A lower level table was present, needs to be freed. */
898	if (!crste.h.fc && !crste.h.i) {	874	if (!crste.h.fc && !crste.h.i) {
899	if (is_pmd(crste))	875	if (is_pmd(crste))
@@ -1021,67 +997,21 @@ bool dat_test_age_gfn(union asce asce, gfn_t start, gfn_t end) · 121 unmodified lines
1021	return _dat_walk_gfn_range(start, end, asce, &test_age_ops, 0, NULL) > 0;	997	return _dat_walk_gfn_range(start, end, asce, &test_age_ops, 0, NULL) > 0;
1022	}	998	}
1023		999
1024	int dat_link(struct kvm_s390_mmu_cache *mc, union asce asce, int level,
1025	bool uses_skeys, struct guest_fault *f)
1026	{
1027	union crste oldval, newval;
1028	union pte newpte, oldpte;
1029	union pgste pgste;
1030	int rc = 0;
1031
1032	rc = dat_entry_walk(mc, f->gfn, asce, DAT_WALK_ALLOC_CONTINUE, level, &f->crstep, &f->ptep);
1033	if (rc == -EINVAL \|\| rc == -ENOMEM)
1034	return rc;
1035	if (rc)
1036	return -EAGAIN;
1037
1038	if (WARN_ON_ONCE(unlikely(get_level(f->crstep, f->ptep) > level)))
1039	return -EINVAL;
1040
1041	if (f->ptep) {
1042	pgste = pgste_get_lock(f->ptep);
1043	oldpte = *f->ptep;
1044	newpte = _pte(f->pfn, f->writable, f->write_attempt \| oldpte.s.d, !f->page);
1045	newpte.s.sd = oldpte.s.sd;
1046	oldpte.s.sd = 0;
1047	if (oldpte.val == _PTE_EMPTY.val \|\| oldpte.h.pfra == f->pfn) {
1048	pgste = __dat_ptep_xchg(f->ptep, pgste, newpte, f->gfn, asce, uses_skeys);
1049	if (f->callback)
1050	f->callback(f);
1051	} else {
1052	rc = -EAGAIN;
1053	}
1054	pgste_set_unlock(f->ptep, pgste);
1055	} else {
1056	oldval = READ_ONCE(*f->crstep);
1057	newval = _crste_fc1(f->pfn, oldval.h.tt, f->writable,
1058	f->write_attempt \| oldval.s.fc1.d);
1059	newval.s.fc1.sd = oldval.s.fc1.sd;
1060	if (oldval.val != _CRSTE_EMPTY(oldval.h.tt).val &&
1061	crste_origin_large(oldval) != crste_origin_large(newval))
1062	return -EAGAIN;
1063	if (!dat_crstep_xchg_atomic(f->crstep, oldval, newval, f->gfn, asce))
1064	return -EAGAIN;
1065	if (f->callback)
1066	f->callback(f);
1067	}
1068
1069	return rc;
1070	}
1071
1072	static long dat_set_pn_crste(union crste crstep, gfn_t gfn, gfn_t next, struct dat_walk walk)	1000	static long dat_set_pn_crste(union crste crstep, gfn_t gfn, gfn_t next, struct dat_walk walk)
1073	{	1001	{
1074	union crste crste = READ_ONCE(*crstep);	1002	union crste newcrste, oldcrste;
1075	int *n = walk->priv;	1003	int *n = walk->priv;
1076		1004
1077	if (!crste.h.fc \|\| crste.h.i \|\| crste.h.p)	1005	do {
1078	return 0;	1006	oldcrste = READ_ONCE(*crstep);
1079		1007	if (!oldcrste.h.fc \|\| oldcrste.h.i \|\| oldcrste.h.p)
		1008	return 0;
		1009	if (oldcrste.s.fc1.prefix_notif)
		1010	break;
		1011	newcrste = oldcrste;
		1012	newcrste.s.fc1.prefix_notif = 1;
		1013	} while (!dat_crstep_xchg_atomic(crstep, oldcrste, newcrste, gfn, walk->asce));
1080	*n = 2;	1014	*n = 2;
1081	if (crste.s.fc1.prefix_notif)
1082	return 0;
1083	crste.s.fc1.prefix_notif = 1;
1084	dat_crstep_xchg(crstep, crste, gfn, walk->asce);
1085	return 0;	1015	return 0;
1086	}	1016	}
1087		1017

arch/s390/kvm/dat.h+12−11

 			unsigned long              :44; /* HW */
 			unsigned long              : 3; /* Unused */
 			unsigned long              : 1; /* HW */
+			unsigned long s            : 1; /* Special */
 			unsigned long w            : 1; /* Writable soft-bit */
 			unsigned long r            : 1; /* Readable soft-bit */
 			unsigned long d            : 1; /* Dirty */
 			unsigned long y            : 1; /* Young */
-			unsigned long prefix_notif : 1; /* Guest prefix invalidation notification */
 			unsigned long              : 3; /* HW */
+			unsigned long prefix_notif : 1; /* Guest prefix invalidation notification */
 			unsigned long vsie_notif   : 1; /* Referenced in a shadow table */
-			unsigned long              : 1; /* Unused */
 			unsigned long              : 4; /* HW */
 			unsigned long sd           : 1; /* Soft-Dirty */
 			unsigned long pr           : 1; /* Present */
 			unsigned long              :33; /* HW */
 			unsigned long              :14; /* Unused */
 			unsigned long              : 1; /* HW */
+			unsigned long s            : 1; /* Special */
 			unsigned long w            : 1; /* Writable soft-bit */
 			unsigned long r            : 1; /* Readable soft-bit */
 			unsigned long d            : 1; /* Dirty */
 			unsigned long y            : 1; /* Young */
-			unsigned long prefix_notif : 1; /* Guest prefix invalidation notification */
 			unsigned long              : 3; /* HW */
+			unsigned long prefix_notif : 1; /* Guest prefix invalidation notification */
 			unsigned long vsie_notif   : 1; /* Referenced in a shadow table */
-			unsigned long              : 1; /* Unused */
 			unsigned long              : 4; /* HW */
 			unsigned long sd           : 1; /* Soft-Dirty */
 			unsigned long pr           : 1; /* Present */
 		struct {
 			unsigned long              :47;
 			unsigned long              : 1; /* HW (should be 0) */
+			unsigned long s            : 1; /* Special */
 			unsigned long w            : 1; /* Writable */
 			unsigned long r            : 1; /* Readable */
 			unsigned long d            : 1; /* Dirty */
 			unsigned long y            : 1; /* Young */
-			unsigned long prefix_notif : 1; /* Guest prefix invalidation notification */
 			unsigned long              : 3; /* HW */
+			unsigned long prefix_notif : 1; /* Guest prefix invalidation notification */
 			unsigned long vsie_notif   : 1; /* Referenced in a shadow table */
-			unsigned long              : 1;
 			unsigned long              : 4; /* HW */
 			unsigned long sd           : 1; /* Soft-Dirty */
 			unsigned long pr           : 1; /* Present */
 		 u16 type, u16 param);
 int dat_set_prefix_notif_bit(union asce asce, gfn_t gfn);
 bool dat_test_age_gfn(union asce asce, gfn_t start, gfn_t end);
-int dat_link(struct kvm_s390_mmu_cache *mc, union asce asce, int level,
-	     bool uses_skeys, struct guest_fault *f);
 int dat_perform_essa(union asce asce, gfn_t gfn, int orc, union essa_state *state, bool *dirty);
 long dat_reset_cmma(union asce asce, gfn_t start_gfn);
 	return dat_crstep_xchg_atomic(_CRSTEP(pudp), _CRSTE(old), _CRSTE(new), gfn, asce);
 }
-static inline void dat_crstep_clear(union crste *crstep, gfn_t gfn, union asce asce)
+static inline union crste dat_crstep_clear_atomic(union crste *crstep, gfn_t gfn, union asce asce)
 {
-	union crste newcrste = _CRSTE_EMPTY(crstep->h.tt);
+	union crste oldcrste, empty = _CRSTE_EMPTY(crstep->h.tt);
-	dat_crstep_xchg(crstep, newcrste, gfn, asce);
+	do {
+		oldcrste = READ_ONCE(*crstep);
+	} while (!dat_crstep_xchg_atomic(crstep, oldcrste, empty, gfn, asce));
+	return oldcrste;
 }
 static inline int get_level(union crste *crstep, union pte *ptep)

arch/s390/kvm/gaccess.c+55−22

 	if (rc)
 		return rc;
-	pgste = pgste_get_lock(ptep_h);
+	if (!pgste_get_trylock(ptep_h, &pgste))
-	newpte = _pte(f->pfn, f->writable, !p, 0);
+		return -EAGAIN;
-	newpte.s.d |= ptep->s.d;
+	newpte = _pte(f->pfn, f->writable, !p, ptep_h->s.s);
-	newpte.s.sd |= ptep->s.sd;
+	newpte.s.d |= ptep_h->s.d;
-	newpte.h.p &= ptep->h.p;
+	newpte.s.sd |= ptep_h->s.sd;
-	pgste = _gmap_ptep_xchg(sg->parent, ptep_h, newpte, pgste, f->gfn, false);
+	newpte.h.p &= ptep_h->h.p;
-	pgste.vsie_notif = 1;
+	if (!newpte.h.p && !f->writable) {
+		rc = -EOPNOTSUPP;
+	} else {
+		pgste = _gmap_ptep_xchg(sg->parent, ptep_h, newpte, pgste, f->gfn, false);
+		pgste.vsie_notif = 1;
+	}
 	pgste_set_unlock(ptep_h, pgste);
+	if (rc)
+		return rc;
+	if (!sg->parent)
+		return -EAGAIN;
 	newpte = _pte(f->pfn, 0, !p, 0);
-	pgste = pgste_get_lock(ptep);
+	if (!pgste_get_trylock(ptep, &pgste))
+		return -EAGAIN;
 	pgste = __dat_ptep_xchg(ptep, pgste, newpte, gpa_to_gfn(raddr), sg->asce, uses_skeys(sg));
 	pgste_set_unlock(ptep, pgste);
 static int _do_shadow_crste(struct gmap *sg, gpa_t raddr, union crste *host, union crste *table,
 			    struct guest_fault *f, bool p)
 {
-	union crste newcrste;
+	union crste newcrste, oldcrste;
 	gfn_t gfn;
 	int rc;
 	if (rc)
 		return rc;
-	newcrste = _crste_fc1(f->pfn, host->h.tt, f->writable, !p);
+	do {
-	newcrste.s.fc1.d |= host->s.fc1.d;
+		/* _gmap_crstep_xchg_atomic() could have unshadowed this shadow gmap */
-	newcrste.s.fc1.sd |= host->s.fc1.sd;
+		if (!sg->parent)
-	newcrste.h.p &= host->h.p;
+			return -EAGAIN;
-	newcrste.s.fc1.vsie_notif = 1;
+		oldcrste = READ_ONCE(*host);
-	newcrste.s.fc1.prefix_notif = host->s.fc1.prefix_notif;
+		newcrste = _crste_fc1(f->pfn, oldcrste.h.tt, f->writable, !p);
-	_gmap_crstep_xchg(sg->parent, host, newcrste, f->gfn, false);
+		newcrste.s.fc1.d |= oldcrste.s.fc1.d;
+		newcrste.s.fc1.sd |= oldcrste.s.fc1.sd;
+		newcrste.h.p &= oldcrste.h.p;
+		newcrste.s.fc1.vsie_notif = 1;
+		newcrste.s.fc1.prefix_notif = oldcrste.s.fc1.prefix_notif;
+		newcrste.s.fc1.s = oldcrste.s.fc1.s;
+		if (!newcrste.h.p && !f->writable)
+			return -EOPNOTSUPP;
+	} while (!_gmap_crstep_xchg_atomic(sg->parent, host, oldcrste, newcrste, f->gfn, false));
+	if (!sg->parent)
+		return -EAGAIN;
-	newcrste = _crste_fc1(f->pfn, host->h.tt, 0, !p);
+	newcrste = _crste_fc1(f->pfn, oldcrste.h.tt, 0, !p);
-	dat_crstep_xchg(table, newcrste, gpa_to_gfn(raddr), sg->asce);
+	gfn = gpa_to_gfn(raddr);
+	while (!dat_crstep_xchg_atomic(table, READ_ONCE(*table), newcrste, gfn, sg->asce))
+		;
 	return 0;
 }
 	if (rc)
 		return rc;
-	/* A race occourred. The shadow mapping is already valid, nothing to do */
+	/* A race occurred. The shadow mapping is already valid, nothing to do */
-	if ((ptep && !ptep->h.i) || (!ptep && crste_leaf(*table)))
+	if ((ptep && !ptep->h.i && ptep->h.p == w->p) ||
+	    (!ptep && crste_leaf(*table) && !table->h.i && table->h.p == w->p))
 		return 0;
 	gl = get_level(table, ptep);
+	/* In case of a real address space */
+	if (w->level <= LEVEL_MEM) {
+		l = TABLE_TYPE_PAGE_TABLE;
+		hl = TABLE_TYPE_REGION1;
+		goto real_address_space;
+	}
 	/*
 	 * Skip levels that are already protected. For each level, protect
 	 * only the page containing the entry, not the whole table.
 	 */
 	for (i = gl ; i >= w->level; i--) {
-		rc = gmap_protect_rmap(mc, sg, entries[i - 1].gfn, gpa_to_gfn(saddr),
+		rc = gmap_protect_rmap(mc, sg, entries[i].gfn, gpa_to_gfn(saddr),
-				       entries[i - 1].pfn, i, entries[i - 1].writable);
+				       entries[i].pfn, i + 1, entries[i].writable);
 		if (rc)
 			return rc;
+		if (!sg->parent)
+			return -EAGAIN;
 	}
 	rc = dat_entry_walk(NULL, entries[LEVEL_MEM].gfn, sg->parent->asce, DAT_WALK_LEAF,
 	/* Get the smallest granularity */
 	l = min3(gl, hl, w->level);
+real_address_space:
 	flags = DAT_WALK_SPLIT_ALLOC | (uses_skeys(sg->parent) ? DAT_WALK_USES_SKEYS : 0);
 	/* If necessary, create the shadow mapping */
 	if (l < gl) {

arch/s390/kvm/gmap.c+114−46

@@ -313,13 +313,16 @@ static long gmap_clear_young_crste(union crste *crstep, gfn_t gfn, gfn_t end, st · 312 unmodified lines
313	struct clear_young_pte_priv *priv = walk->priv;	313	struct clear_young_pte_priv *priv = walk->priv;
314	union crste crste, new;	314	union crste crste, new;
315		315
316	crste = READ_ONCE(*crstep);	316	do {
		317	crste = READ_ONCE(*crstep);
		318
		319	if (!crste.h.fc)
		320	return 0;
		321	if (!crste.s.fc1.y && crste.h.i)
		322	return 0;
		323	if (crste_prefix(crste) && !gmap_mkold_prefix(priv->gmap, gfn, end))
		324	break;
317		325
318	if (!crste.h.fc)
319	return 0;
320	if (!crste.s.fc1.y && crste.h.i)
321	return 0;
322	if (!crste_prefix(crste) \|\| gmap_mkold_prefix(priv->gmap, gfn, end)) {
323	new = crste;	326	new = crste;
324	new.h.i = 1;	327	new.h.i = 1;
325	new.s.fc1.y = 0;	328	new.s.fc1.y = 0;
@@ -328,8 +331,8 @@ static long gmap_clear_young_crste(union crste *crstep, gfn_t gfn, gfn_t end, st · 2 unmodified lines
328	folio_set_dirty(phys_to_folio(crste_origin_large(crste)));	331	folio_set_dirty(phys_to_folio(crste_origin_large(crste)));
329	new.s.fc1.d = 0;	332	new.s.fc1.d = 0;
330	new.h.p = 1;	333	new.h.p = 1;
331	dat_crstep_xchg(crstep, new, gfn, walk->asce);	334	} while (!dat_crstep_xchg_atomic(crstep, crste, new, gfn, walk->asce));
332	}	335
333	priv->young = 1;	336	priv->young = 1;
334	return 0;	337	return 0;
335	}	338	}
@@ -391,14 +394,18 @@ static long _gmap_unmap_crste(union crste *crstep, gfn_t gfn, gfn_t next, struct · 55 unmodified lines
391	{	394	{
392	struct gmap_unmap_priv *priv = walk->priv;	395	struct gmap_unmap_priv *priv = walk->priv;
393	struct folio *folio = NULL;	396	struct folio *folio = NULL;
		397	union crste old = *crstep;
394		398
395	if (crstep->h.fc) {	399	if (!old.h.fc)
396	if (crstep->s.fc1.pr && test_bit(GMAP_FLAG_EXPORT_ON_UNMAP, &priv->gmap->flags))	400	return 0;
397	folio = phys_to_folio(crste_origin_large(*crstep));	401
398	gmap_crstep_xchg(priv->gmap, crstep, _CRSTE_EMPTY(crstep->h.tt), gfn);	402	if (old.s.fc1.pr && test_bit(GMAP_FLAG_EXPORT_ON_UNMAP, &priv->gmap->flags))
399	if (folio)	403	folio = phys_to_folio(crste_origin_large(old));
400	uv_convert_from_secure_folio(folio);	404	/* No races should happen because kvm->mmu_lock is held in write mode */
401	}	405	KVM_BUG_ON(!gmap_crstep_xchg_atomic(priv->gmap, crstep, old, _CRSTE_EMPTY(old.h.tt), gfn),
		406	priv->gmap->kvm);
		407	if (folio)
		408	uv_convert_from_secure_folio(folio);
402		409
403	return 0;	410	return 0;
404	}	411	}
@@ -474,23 +481,24 @@ static long _crste_test_and_clear_softdirty(union crste *table, gfn_t gfn, gfn_t · 69 unmodified lines
474		481
475	if (fatal_signal_pending(current))	482	if (fatal_signal_pending(current))
476	return 1;	483	return 1;
477	crste = READ_ONCE(*table);	484	do {
478	if (!crste.h.fc)	485	crste = READ_ONCE(*table);
479	return 0;	486	if (!crste.h.fc)
480	if (crste.h.p && !crste.s.fc1.sd)	487	return 0;
481	return 0;	488	if (crste.h.p && !crste.s.fc1.sd)
		489	return 0;
482		490
483	/*	491	/*
484	* If this large page contains one or more prefixes of vCPUs that are	492	* If this large page contains one or more prefixes of vCPUs that are
485	* currently running, do not reset the protection, leave it marked as	493	* currently running, do not reset the protection, leave it marked as
486	* dirty.	494	* dirty.
487	*/	495	*/
488	if (!crste.s.fc1.prefix_notif \|\| gmap_mkold_prefix(gmap, gfn, end)) {	496	if (crste.s.fc1.prefix_notif && !gmap_mkold_prefix(gmap, gfn, end))
		497	break;
489	new = crste;	498	new = crste;
490	new.h.p = 1;	499	new.h.p = 1;
491	new.s.fc1.sd = 0;	500	new.s.fc1.sd = 0;
492	gmap_crstep_xchg(gmap, table, new, gfn);	501	} while (!gmap_crstep_xchg_atomic(gmap, table, crste, new, gfn));
493	}
494		502
495	for ( ; gfn < end; gfn++)	503	for ( ; gfn < end; gfn++)
496	mark_page_dirty(gmap->kvm, gfn);	504	mark_page_dirty(gmap->kvm, gfn);
@@ -511,7 +519,7 @@ void gmap_sync_dirty_log(struct gmap *gmap, gfn_t start, gfn_t end) · 14 unmodified lines
511	_dat_walk_gfn_range(start, end, gmap->asce, &walk_ops, 0, gmap);	519	_dat_walk_gfn_range(start, end, gmap->asce, &walk_ops, 0, gmap);
512	}	520	}
513		521
514	static int gmap_handle_minor_crste_fault(union asce asce, struct guest_fault *f)	522	static int gmap_handle_minor_crste_fault(struct gmap gmap, struct guest_fault f)
515	{	523	{
516	union crste newcrste, oldcrste = READ_ONCE(*f->crstep);	524	union crste newcrste, oldcrste = READ_ONCE(*f->crstep);
517		525
@@ -536,10 +544,8 @@ static int gmap_handle_minor_crste_fault(union asce asce, struct guest_fault *f) · 18 unmodified lines
536	newcrste.s.fc1.d = 1;	544	newcrste.s.fc1.d = 1;
537	newcrste.s.fc1.sd = 1;	545	newcrste.s.fc1.sd = 1;
538	}	546	}
539	if (!oldcrste.s.fc1.d && newcrste.s.fc1.d)
540	SetPageDirty(phys_to_page(crste_origin_large(newcrste)));
541	/* In case of races, let the slow path deal with it. */	547	/* In case of races, let the slow path deal with it. */
542	return !dat_crstep_xchg_atomic(f->crstep, oldcrste, newcrste, f->gfn, asce);	548	return !gmap_crstep_xchg_atomic(gmap, f->crstep, oldcrste, newcrste, f->gfn);
543	}	549	}
544	/* Trying to write on a read-only page, let the slow path deal with it. */	550	/* Trying to write on a read-only page, let the slow path deal with it. */
545	return 1;	551	return 1;
@@ -568,8 +574,6 @@ static int _gmap_handle_minor_pte_fault(struct gmap gmap, union pgste pgste, · 22 unmodified lines
568	newpte.s.d = 1;	574	newpte.s.d = 1;
569	newpte.s.sd = 1;	575	newpte.s.sd = 1;
570	}	576	}
571	if (!oldpte.s.d && newpte.s.d)
572	SetPageDirty(pfn_to_page(newpte.h.pfra));
573	pgste = gmap_ptep_xchg(gmap, f->ptep, newpte, pgste, f->gfn);	577	pgste = gmap_ptep_xchg(gmap, f->ptep, newpte, pgste, f->gfn);
574		578
575	return 0;	579	return 0;
@@ -606,7 +610,7 @@ int gmap_try_fixup_minor(struct gmap gmap, struct guest_fault fault) · 30 unmodified lines
606	fault->callback(fault);	610	fault->callback(fault);
607	pgste_set_unlock(fault->ptep, pgste);	611	pgste_set_unlock(fault->ptep, pgste);
608	} else {	612	} else {
609	rc = gmap_handle_minor_crste_fault(gmap->asce, fault);	613	rc = gmap_handle_minor_crste_fault(gmap, fault);
610	if (!rc && fault->callback)	614	if (!rc && fault->callback)
611	fault->callback(fault);	615	fault->callback(fault);
612	}	616	}
@@ -623,10 +627,61 @@ static inline bool gmap_1m_allowed(struct gmap *gmap, gfn_t gfn) · 10 unmodified lines
623	return test_bit(GMAP_FLAG_ALLOW_HPAGE_1M, &gmap->flags);	627	return test_bit(GMAP_FLAG_ALLOW_HPAGE_1M, &gmap->flags);
624	}	628	}
625		629
		630	static int _gmap_link(struct kvm_s390_mmu_cache mc, struct gmap gmap, int level,
		631	struct guest_fault *f)
		632	{
		633	union crste oldval, newval;
		634	union pte newpte, oldpte;
		635	union pgste pgste;
		636	int rc = 0;
		637
		638	rc = dat_entry_walk(mc, f->gfn, gmap->asce, DAT_WALK_ALLOC_CONTINUE, level,
		639	&f->crstep, &f->ptep);
		640	if (rc == -ENOMEM)
		641	return rc;
		642	if (KVM_BUG_ON(rc == -EINVAL, gmap->kvm))
		643	return rc;
		644	if (rc)
		645	return -EAGAIN;
		646	if (KVM_BUG_ON(get_level(f->crstep, f->ptep) > level, gmap->kvm))
		647	return -EINVAL;
		648
		649	if (f->ptep) {
		650	pgste = pgste_get_lock(f->ptep);
		651	oldpte = *f->ptep;
		652	newpte = _pte(f->pfn, f->writable, f->write_attempt \| oldpte.s.d, !f->page);
		653	newpte.s.sd = oldpte.s.sd;
		654	oldpte.s.sd = 0;
		655	if (oldpte.val == _PTE_EMPTY.val \|\| oldpte.h.pfra == f->pfn) {
		656	pgste = gmap_ptep_xchg(gmap, f->ptep, newpte, pgste, f->gfn);
		657	if (f->callback)
		658	f->callback(f);
		659	} else {
		660	rc = -EAGAIN;
		661	}
		662	pgste_set_unlock(f->ptep, pgste);
		663	} else {
		664	do {
		665	oldval = READ_ONCE(*f->crstep);
		666	newval = _crste_fc1(f->pfn, oldval.h.tt, f->writable,
		667	f->write_attempt \| oldval.s.fc1.d);
		668	newval.s.fc1.s = !f->page;
		669	newval.s.fc1.sd = oldval.s.fc1.sd;
		670	if (oldval.val != _CRSTE_EMPTY(oldval.h.tt).val &&
		671	crste_origin_large(oldval) != crste_origin_large(newval))
		672	return -EAGAIN;
		673	} while (!gmap_crstep_xchg_atomic(gmap, f->crstep, oldval, newval, f->gfn));
		674	if (f->callback)
		675	f->callback(f);
		676	}
		677
		678	return rc;
		679	}
		680
626	int gmap_link(struct kvm_s390_mmu_cache mc, struct gmap gmap, struct guest_fault *f)	681	int gmap_link(struct kvm_s390_mmu_cache mc, struct gmap gmap, struct guest_fault *f)
627	{	682	{
628	unsigned int order;	683	unsigned int order;
629	int rc, level;	684	int level;
630		685
631	lockdep_assert_held(&gmap->kvm->mmu_lock);	686	lockdep_assert_held(&gmap->kvm->mmu_lock);
632		687
@@ -638,16 +693,14 @@ int gmap_link(struct kvm_s390_mmu_cache mc, struct gmap gmap, struct guest_fau · 5 unmodified lines
638	else if (order >= get_order(_SEGMENT_SIZE) && gmap_1m_allowed(gmap, f->gfn))	693	else if (order >= get_order(_SEGMENT_SIZE) && gmap_1m_allowed(gmap, f->gfn))
639	level = TABLE_TYPE_SEGMENT;	694	level = TABLE_TYPE_SEGMENT;
640	}	695	}
641	rc = dat_link(mc, gmap->asce, level, uses_skeys(gmap), f);	696	return _gmap_link(mc, gmap, level, f);
642	KVM_BUG_ON(rc == -EINVAL, gmap->kvm);
643	return rc;
644	}	697	}
645		698
646	static int gmap_ucas_map_one(struct kvm_s390_mmu_cache mc, struct gmap gmap,	699	static int gmap_ucas_map_one(struct kvm_s390_mmu_cache mc, struct gmap gmap,
647	gfn_t p_gfn, gfn_t c_gfn, bool force_alloc)	700	gfn_t p_gfn, gfn_t c_gfn, bool force_alloc)
648	{	701	{
		702	union crste newcrste, oldcrste;
649	struct page_table *pt;	703	struct page_table *pt;
650	union crste newcrste;
651	union crste *crstep;	704	union crste *crstep;
652	union pte *ptep;	705	union pte *ptep;
653	int rc;	706	int rc;
@@ -673,7 +726,11 @@ static int gmap_ucas_map_one(struct kvm_s390_mmu_cache mc, struct gmap gmap, · 19 unmodified lines
673	&crstep, &ptep);	726	&crstep, &ptep);
674	if (rc)	727	if (rc)
675	return rc;	728	return rc;
676	dat_crstep_xchg(crstep, newcrste, c_gfn, gmap->asce);	729	do {
		730	oldcrste = READ_ONCE(*crstep);
		731	if (oldcrste.val == newcrste.val)
		732	break;
		733	} while (!dat_crstep_xchg_atomic(crstep, oldcrste, newcrste, c_gfn, gmap->asce));
677	return 0;	734	return 0;
678	}	735	}
679		736
@@ -777,8 +834,10 @@ static void gmap_ucas_unmap_one(struct gmap *gmap, gfn_t c_gfn) · 97 unmodified lines
777	int rc;	834	int rc;
778		835
779	rc = dat_entry_walk(NULL, c_gfn, gmap->asce, 0, TABLE_TYPE_SEGMENT, &crstep, &ptep);	836	rc = dat_entry_walk(NULL, c_gfn, gmap->asce, 0, TABLE_TYPE_SEGMENT, &crstep, &ptep);
780	if (!rc)	837	if (rc)
781	dat_crstep_xchg(crstep, _PMD_EMPTY, c_gfn, gmap->asce);	838	return;
		839	while (!dat_crstep_xchg_atomic(crstep, READ_ONCE(*crstep), _PMD_EMPTY, c_gfn, gmap->asce))
		840	;
782	}	841	}
783		842
784	void gmap_ucas_unmap(struct gmap *gmap, gfn_t c_gfn, unsigned long count)	843	void gmap_ucas_unmap(struct gmap *gmap, gfn_t c_gfn, unsigned long count)
@@ -1017,8 +1076,8 @@ static void gmap_unshadow_level(struct gmap *sg, gfn_t r_gfn, int level) · 232 unmodified lines
1017	dat_ptep_xchg(ptep, _PTE_EMPTY, r_gfn, sg->asce, uses_skeys(sg));	1076	dat_ptep_xchg(ptep, _PTE_EMPTY, r_gfn, sg->asce, uses_skeys(sg));
1018	return;	1077	return;
1019	}	1078	}
1020	crste = READ_ONCE(*crstep);	1079
1021	dat_crstep_clear(crstep, r_gfn, sg->asce);	1080	crste = dat_crstep_clear_atomic(crstep, r_gfn, sg->asce);
1022	if (crste_leaf(crste) \|\| crste.h.i)	1081	if (crste_leaf(crste) \|\| crste.h.i)
1023	return;	1082	return;
1024	if (is_pmd(crste))	1083	if (is_pmd(crste))
@@ -1101,6 +1160,7 @@ struct gmap_protect_asce_top_level { · 76 unmodified lines
1101	static inline int __gmap_protect_asce_top_level(struct kvm_s390_mmu_cache mc, struct gmap sg,	1160	static inline int __gmap_protect_asce_top_level(struct kvm_s390_mmu_cache mc, struct gmap sg,
1102	struct gmap_protect_asce_top_level *context)	1161	struct gmap_protect_asce_top_level *context)
1103	{	1162	{
		1163	struct gmap *parent;
1104	int rc, i;	1164	int rc, i;
1105		1165
1106	guard(write_lock)(&sg->kvm->mmu_lock);	1166	guard(write_lock)(&sg->kvm->mmu_lock);
@@ -1108,7 +1168,12 @@ static inline int __gmap_protect_asce_top_level(struct kvm_s390_mmu_cache *mc, s · 1 unmodified line
1108	if (kvm_s390_array_needs_retry_safe(sg->kvm, context->seq, context->f))	1168	if (kvm_s390_array_needs_retry_safe(sg->kvm, context->seq, context->f))
1109	return -EAGAIN;	1169	return -EAGAIN;
1110		1170
1111	scoped_guard(spinlock, &sg->parent->children_lock) {	1171	parent = READ_ONCE(sg->parent);
		1172	if (!parent)
		1173	return -EAGAIN;
		1174	scoped_guard(spinlock, &parent->children_lock) {
		1175	if (READ_ONCE(sg->parent) != parent)
		1176	return -EAGAIN;
1112	for (i = 0; i < CRST_TABLE_PAGES; i++) {	1177	for (i = 0; i < CRST_TABLE_PAGES; i++) {
1113	if (!context->f[i].valid)	1178	if (!context->f[i].valid)
1114	continue;	1179	continue;
@@ -1191,6 +1256,9 @@ struct gmap gmap_create_shadow(struct kvm_s390_mmu_cache mc, struct gmap *pare · 76 unmodified lines
1191	struct gmap sg, new;	1256	struct gmap sg, new;
1192	int rc;	1257	int rc;
1193		1258
		1259	if (WARN_ON(!parent))
		1260	return ERR_PTR(-EINVAL);
		1261
1194	scoped_guard(spinlock, &parent->children_lock) {	1262	scoped_guard(spinlock, &parent->children_lock) {
1195	sg = gmap_find_shadow(parent, asce, edat_level);	1263	sg = gmap_find_shadow(parent, asce, edat_level);
1196	if (sg) {	1264	if (sg) {

arch/s390/kvm/gmap.h+21−12

 		else
 			_gmap_handle_vsie_unshadow_event(gmap, gfn);
 	}
+	if (!ptep->s.d && newpte.s.d && !newpte.s.s)
+		SetPageDirty(pfn_to_page(newpte.h.pfra));
 	return __dat_ptep_xchg(ptep, pgste, newpte, gfn, gmap->asce, uses_skeys(gmap));
 }
 	return _gmap_ptep_xchg(gmap, ptep, newpte, pgste, gfn, true);
 }
-static inline void _gmap_crstep_xchg(struct gmap *gmap, union crste *crstep, union crste ne,
+static inline bool __must_check _gmap_crstep_xchg_atomic(struct gmap *gmap, union crste *crstep,
-				     gfn_t gfn, bool needs_lock)
+							 union crste oldcrste, union crste newcrste,
+							 gfn_t gfn, bool needs_lock)
 {
-	unsigned long align = 8 + (is_pmd(*crstep) ? 0 : 11);
+	unsigned long align = is_pmd(newcrste) ? _PAGE_ENTRIES : _PAGE_ENTRIES * _CRST_ENTRIES;
+	if (KVM_BUG_ON(crstep->h.tt != oldcrste.h.tt || newcrste.h.tt != oldcrste.h.tt, gmap->kvm))
+		return true;
 	lockdep_assert_held(&gmap->kvm->mmu_lock);
 	if (!needs_lock)
 		lockdep_assert_held(&gmap->children_lock);
 	gfn = ALIGN_DOWN(gfn, align);
-	if (crste_prefix(*crstep) && (ne.h.p || ne.h.i || !crste_prefix(ne))) {
+	if (crste_prefix(oldcrste) && (newcrste.h.p || newcrste.h.i || !crste_prefix(newcrste))) {
-		ne.s.fc1.prefix_notif = 0;
+		newcrste.s.fc1.prefix_notif = 0;
 		gmap_unmap_prefix(gmap, gfn, gfn + align);
 	}
-	if (crste_leaf(*crstep) && crstep->s.fc1.vsie_notif &&
+	if (crste_leaf(oldcrste) && oldcrste.s.fc1.vsie_notif &&
-	    (ne.h.p || ne.h.i || !ne.s.fc1.vsie_notif)) {
+	    (newcrste.h.p || newcrste.h.i || !newcrste.s.fc1.vsie_notif)) {
-		ne.s.fc1.vsie_notif = 0;
+		newcrste.s.fc1.vsie_notif = 0;
 		if (needs_lock)
 			gmap_handle_vsie_unshadow_event(gmap, gfn);
 		else
 			_gmap_handle_vsie_unshadow_event(gmap, gfn);
 	}
-	dat_crstep_xchg(crstep, ne, gfn, gmap->asce);
+	if (!oldcrste.s.fc1.d && newcrste.s.fc1.d && !newcrste.s.fc1.s)
+		SetPageDirty(phys_to_page(crste_origin_large(newcrste)));
+	return dat_crstep_xchg_atomic(crstep, oldcrste, newcrste, gfn, gmap->asce);
 }
-static inline void gmap_crstep_xchg(struct gmap *gmap, union crste *crstep, union crste ne,
+static inline bool __must_check gmap_crstep_xchg_atomic(struct gmap *gmap, union crste *crstep,
-				    gfn_t gfn)
+							union crste oldcrste, union crste newcrste,
+							gfn_t gfn)
 {
-	return _gmap_crstep_xchg(gmap, crstep, ne, gfn, true);
+	return _gmap_crstep_xchg_atomic(gmap, crstep, oldcrste, newcrste, gfn, true);
 }
 /**

arch/s390/kvm/interrupt.c+18−0

 	bit = bit_nr + (addr % PAGE_SIZE) * 8;
+	/* kvm_set_routing_entry() should never allow this to happen */
+	WARN_ON_ONCE(bit > (PAGE_SIZE * BITS_PER_BYTE - 1));
 	return swap ? (bit ^ (BITS_PER_LONG - 1)) : bit;
 }
 	int rc;
 	mci.val = mcck_info->mcic;
+	/* log machine checks being reinjected on all debugs */
+	VCPU_EVENT(vcpu, 2, "guest machine check %lx", mci.val);
+	KVM_EVENT(2, "guest machine check %lx", mci.val);
+	pr_info("guest machine check pid %d: %lx", current->pid, mci.val);
 	if (mci.sr)
 		cr14 |= CR14_RECOVERY_SUBMASK;
 	if (mci.dg)
 			  struct kvm_kernel_irq_routing_entry *e,
 			  const struct kvm_irq_routing_entry *ue)
 {
+	const struct kvm_irq_routing_s390_adapter *adapter;
 	u64 uaddr_s, uaddr_i;
 	int idx;
 			return -EINVAL;
 		e->set = set_adapter_int;
+		adapter = &ue->u.adapter;
+		if (adapter->summary_addr + (adapter->summary_offset / 8) >=
+		    (adapter->summary_addr & PAGE_MASK) + PAGE_SIZE)
+			return -EINVAL;
+		if (adapter->ind_addr + (adapter->ind_offset / 8) >=
+		    (adapter->ind_addr & PAGE_MASK) + PAGE_SIZE)
+			return -EINVAL;
 		idx = srcu_read_lock(&kvm->srcu);
 		uaddr_s = gpa_to_hva(kvm, ue->u.adapter.summary_addr);
 		uaddr_i = gpa_to_hva(kvm, ue->u.adapter.ind_addr);

arch/s390/kvm/kvm-s390.c+23−11

@@ -4617,7 +4617,7 @@ static int vcpu_post_run_handle_fault(struct kvm_vcpu *vcpu) · 4616 unmodified lines
4617	return 0;	4617	return 0;
4618	}	4618	}
4619		4619
4620	static int vcpu_post_run(struct kvm_vcpu *vcpu, int exit_reason)	4620	static int vcpu_post_run(struct kvm_vcpu *vcpu, int sie_return)
4621	{	4621	{
4622	struct mcck_volatile_info *mcck_info;	4622	struct mcck_volatile_info *mcck_info;
4623	struct sie_page *sie_page;	4623	struct sie_page *sie_page;
@@ -4633,14 +4633,14 @@ static int vcpu_post_run(struct kvm_vcpu *vcpu, int exit_reason) · 9 unmodified lines
4633	vcpu->run->s.regs.gprs[14] = vcpu->arch.sie_block->gg14;	4633	vcpu->run->s.regs.gprs[14] = vcpu->arch.sie_block->gg14;
4634	vcpu->run->s.regs.gprs[15] = vcpu->arch.sie_block->gg15;	4634	vcpu->run->s.regs.gprs[15] = vcpu->arch.sie_block->gg15;
4635		4635
4636	if (exit_reason == -EINTR) {	4636	if (sie_return == SIE64_RETURN_MCCK) {
4637	VCPU_EVENT(vcpu, 3, "%s", "machine check");
4638	sie_page = container_of(vcpu->arch.sie_block,	4637	sie_page = container_of(vcpu->arch.sie_block,
4639	struct sie_page, sie_block);	4638	struct sie_page, sie_block);
4640	mcck_info = &sie_page->mcck_info;	4639	mcck_info = &sie_page->mcck_info;
4641	kvm_s390_reinject_machine_check(vcpu, mcck_info);	4640	kvm_s390_reinject_machine_check(vcpu, mcck_info);
4642	return 0;	4641	return 0;
4643	}	4642	}
		4643	WARN_ON_ONCE(sie_return != SIE64_RETURN_NORMAL);
4644		4644
4645	if (vcpu->arch.sie_block->icptcode > 0) {	4645	if (vcpu->arch.sie_block->icptcode > 0) {
4646	rc = kvm_handle_sie_intercept(vcpu);	4646	rc = kvm_handle_sie_intercept(vcpu);
@@ -4679,7 +4679,7 @@ int noinstr kvm_s390_enter_exit_sie(struct kvm_s390_sie_block *scb, · 32 unmodified lines
4679	#define PSW_INT_MASK (PSW_MASK_EXT \| PSW_MASK_IO \| PSW_MASK_MCHECK)	4679	#define PSW_INT_MASK (PSW_MASK_EXT \| PSW_MASK_IO \| PSW_MASK_MCHECK)
4680	static int __vcpu_run(struct kvm_vcpu *vcpu)	4680	static int __vcpu_run(struct kvm_vcpu *vcpu)
4681	{	4681	{
4682	int rc, exit_reason;	4682	int rc, sie_return;
4683	struct sie_page sie_page = (struct sie_page )vcpu->arch.sie_block;	4683	struct sie_page sie_page = (struct sie_page )vcpu->arch.sie_block;
4684		4684
4685	/*	4685	/*
@@ -4719,9 +4719,9 @@ xfer_to_guest_mode_check: · 33 unmodified lines
4719	guest_timing_enter_irqoff();	4719	guest_timing_enter_irqoff();
4720	__disable_cpu_timer_accounting(vcpu);	4720	__disable_cpu_timer_accounting(vcpu);
4721		4721
4722	exit_reason = kvm_s390_enter_exit_sie(vcpu->arch.sie_block,	4722	sie_return = kvm_s390_enter_exit_sie(vcpu->arch.sie_block,
4723	vcpu->run->s.regs.gprs,	4723	vcpu->run->s.regs.gprs,
4724	vcpu->arch.gmap->asce.val);	4724	vcpu->arch.gmap->asce.val);
4725		4725
4726	__enable_cpu_timer_accounting(vcpu);	4726	__enable_cpu_timer_accounting(vcpu);
4727	guest_timing_exit_irqoff();	4727	guest_timing_exit_irqoff();
@@ -4744,7 +4744,7 @@ xfer_to_guest_mode_check: · 16 unmodified lines
4744	}	4744	}
4745	kvm_vcpu_srcu_read_lock(vcpu);	4745	kvm_vcpu_srcu_read_lock(vcpu);
4746		4746
4747	rc = vcpu_post_run(vcpu, exit_reason);	4747	rc = vcpu_post_run(vcpu, sie_return);
4748	if (rc \|\| guestdbg_exit_pending(vcpu)) {	4748	if (rc \|\| guestdbg_exit_pending(vcpu)) {
4749	kvm_vcpu_srcu_read_unlock(vcpu);	4749	kvm_vcpu_srcu_read_unlock(vcpu);
4750	break;	4750	break;
@@ -5520,9 +5520,21 @@ long kvm_arch_vcpu_ioctl(struct file *filp, · 769 unmodified lines
5520	}	5520	}
5521	#endif	5521	#endif
5522	case KVM_S390_VCPU_FAULT: {	5522	case KVM_S390_VCPU_FAULT: {
5523	idx = srcu_read_lock(&vcpu->kvm->srcu);	5523	gpa_t gaddr = arg;
5524	r = vcpu_dat_fault_handler(vcpu, arg, 0);	5524
5525	srcu_read_unlock(&vcpu->kvm->srcu, idx);	5525	scoped_guard(srcu, &vcpu->kvm->srcu) {
		5526	r = vcpu_ucontrol_translate(vcpu, &gaddr);
		5527	if (r)
		5528	break;
		5529
		5530	r = kvm_s390_faultin_gfn_simple(vcpu, NULL, gpa_to_gfn(gaddr), false);
		5531	if (r == PGM_ADDRESSING)
		5532	r = -EFAULT;
		5533	if (r <= 0)
		5534	break;
		5535	r = -EIO;
		5536	KVM_BUG_ON(r, vcpu->kvm);
		5537	}
5526	break;	5538	break;
5527	}	5539	}
5528	case KVM_ENABLE_CAP:	5540	case KVM_ENABLE_CAP:

arch/s390/kvm/vsie.c+8−4

 {
 	struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s;
 	struct kvm_s390_sie_block *scb_o = vsie_page->scb_o;
+	unsigned long sie_return = SIE64_RETURN_NORMAL;
 	int guest_bp_isolation;
 	int rc = 0;
 			goto xfer_to_guest_mode_check;
 		}
 		guest_timing_enter_irqoff();
-		rc = kvm_s390_enter_exit_sie(scb_s, vcpu->run->s.regs.gprs, sg->asce.val);
+		sie_return = kvm_s390_enter_exit_sie(scb_s, vcpu->run->s.regs.gprs, sg->asce.val);
 		guest_timing_exit_irqoff();
 		local_irq_enable();
 	}
 	kvm_vcpu_srcu_read_lock(vcpu);
-	if (rc == -EINTR) {
+	if (sie_return == SIE64_RETURN_MCCK) {
-		VCPU_EVENT(vcpu, 3, "%s", "machine check");
 		kvm_s390_reinject_machine_check(vcpu, &vsie_page->mcck_info);
 		return 0;
 	}
+	WARN_ON_ONCE(sie_return != SIE64_RETURN_NORMAL);
 	if (rc > 0)
 		rc = 0; /* we could still have an icpt */
 	else if (current->thread.gmap_int_code)
 static int vsie_run(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
 {
 	struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s;
-	struct gmap *sg;
+	struct gmap *sg = NULL;
 	int rc = 0;
 	while (1) {
 			sg = gmap_put(sg);
 		cond_resched();
 	}
+	if (sg)
+		sg = gmap_put(sg);
 	if (rc == -EFAULT) {
 		/*

arch/s390/mm/fault.c+9−2

 		folio = phys_to_folio(addr);
 		if (unlikely(!folio_try_get(folio)))
 			return;
-		rc = arch_make_folio_accessible(folio);
+		rc = uv_convert_from_secure(folio_to_phys(folio));
+		if (!rc)
+			clear_bit(PG_arch_1, &folio->flags.f);
 		folio_put(folio);
+		/*
+		 * There are some valid fixup types for kernel
+		 * accesses to donated secure memory. zeropad is one
+		 * of them.
+		 */
 		if (rc)
-			BUG();
+			return handle_fault_error_nolock(regs, 0);
 	} else {
 		if (faulthandler_disabled())
 			return handle_fault_error_nolock(regs, 0);

arch/x86/coco/sev/noinstr.c+6−0

 	WARN_ON(!irqs_disabled());
+	if (!sev_cfg.ghcbs_initialized)
+		return boot_ghcb;
 	data = this_cpu_read(runtime_data);
 	ghcb = &data->ghcb_page;
 	WARN_ON(!irqs_disabled());
+	if (!sev_cfg.ghcbs_initialized)
+		return;
 	data = this_cpu_read(runtime_data);
 	ghcb = &data->ghcb_page;

arch/x86/entry/entry_fred.c+14−0

@@ -177,6 +177,16 @@ static noinstr void fred_extint(struct pt_regs *regs) · 176 unmodified lines
177	}	177	}
178	}	178	}
179		179
		180	#ifdef CONFIG_AMD_MEM_ENCRYPT
		181	noinstr void exc_vmm_communication(struct pt_regs *regs, unsigned long error_code)
		182	{
		183	if (user_mode(regs))
		184	return user_exc_vmm_communication(regs, error_code);
		185	else
		186	return kernel_exc_vmm_communication(regs, error_code);
		187	}
		188	#endif
		189
180	static noinstr void fred_hwexc(struct pt_regs *regs, unsigned long error_code)	190	static noinstr void fred_hwexc(struct pt_regs *regs, unsigned long error_code)
181	{	191	{
182	/* Optimize for #PF. That's the only exception which matters performance wise */	192	/* Optimize for #PF. That's the only exception which matters performance wise */
@@ -207,6 +217,10 @@ static noinstr void fred_hwexc(struct pt_regs *regs, unsigned long error_code) · 24 unmodified lines
207	#ifdef CONFIG_X86_CET	217	#ifdef CONFIG_X86_CET
208	case X86_TRAP_CP: return exc_control_protection(regs, error_code);	218	case X86_TRAP_CP: return exc_control_protection(regs, error_code);
209	#endif	219	#endif
		220	#ifdef CONFIG_AMD_MEM_ENCRYPT
		221	case X86_TRAP_VC: return exc_vmm_communication(regs, error_code);
		222	#endif
		223
210	default: return fred_bad_type(regs, error_code);	224	default: return fred_bad_type(regs, error_code);
211	}	225	}
212		226

arch/x86/kernel/cpu/common.c+26−7

 /* These bits should not change their value after CPU init is finished. */
 static const unsigned long cr4_pinned_mask = X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_UMIP |
-					     X86_CR4_FSGSBASE | X86_CR4_CET | X86_CR4_FRED;
+					     X86_CR4_FSGSBASE | X86_CR4_CET;
+/*
+ * The CR pinning protects against ROP on the 'mov %reg, %CRn' instruction(s).
+ * Since you can ROP directly to these instructions (barring shadow stack),
+ * any protection must follow immediately and unconditionally after that.
+ *
+ * Specifically, the CR[04] write functions below will have the value
+ * validation controlled by the @cr_pinning static_branch which is
+ * __ro_after_init, just like the cr4_pinned_bits value.
+ *
+ * Once set, an attacker will have to defeat page-tables to get around these
+ * restrictions. Which is a much bigger ask than 'simple' ROP.
+ */
 static DEFINE_STATIC_KEY_FALSE_RO(cr_pinning);
 static unsigned long cr4_pinned_bits __ro_after_init;
 	setup_umip(c);
 	setup_lass(c);
-	/* Enable FSGSBASE instructions if available. */
-	if (cpu_has(c, X86_FEATURE_FSGSBASE)) {
-		cr4_set_bits(X86_CR4_FSGSBASE);
-		elf_hwcap2 |= HWCAP2_FSGSBASE;
-	}
 	/*
 	 * The vendor-specific functions might have changed features.
 	 * Now we do "generic changes."
 	/* GHCB needs to be setup to handle #VC. */
 	setup_ghcb();
+	/*
+	 * On CPUs with FSGSBASE support, paranoid_entry() uses
+	 * ALTERNATIVE-patched RDGSBASE/WRGSBASE instructions. Secondary CPUs
+	 * boot after alternatives are patched globally, so early exceptions
+	 * execute patched code that depends on FSGSBASE. Enable the feature
+	 * before any exceptions occur.
+	 */
+	if (cpu_feature_enabled(X86_FEATURE_FSGSBASE)) {
+		cr4_set_bits(X86_CR4_FSGSBASE);
+		elf_hwcap2 |= HWCAP2_FSGSBASE;
+	}
 	if (cpu_feature_enabled(X86_FEATURE_FRED)) {
 		/* The boot CPU has enabled FRED during early boot */
 		if (!boot_cpu)

arch/x86/kvm/mmu/mmu.c+10−7

 	bool prefetch = !fault || fault->prefetch;
 	bool write_fault = fault && fault->write;
-	if (unlikely(is_noslot_pfn(pfn))) {
-		vcpu->stat.pf_mmio_spte_created++;
-		mark_mmio_spte(vcpu, sptep, gfn, pte_access);
-		return RET_PF_EMULATE;
-	}
 	if (is_shadow_present_pte(*sptep)) {
 		if (prefetch && is_last_spte(*sptep, level) &&
 		    pfn == spte_to_pfn(*sptep))
 			child = spte_to_child_sp(pte);
 			drop_parent_pte(vcpu->kvm, child, sptep);
 			flush = true;
-		} else if (WARN_ON_ONCE(pfn != spte_to_pfn(*sptep))) {
+		} else if (pfn != spte_to_pfn(*sptep)) {
+			WARN_ON_ONCE(vcpu->arch.mmu->root_role.direct);
 			drop_spte(vcpu->kvm, sptep);
 			flush = true;
 		} else
 			was_rmapped = 1;
 	}
+	if (unlikely(is_noslot_pfn(pfn))) {
+		vcpu->stat.pf_mmio_spte_created++;
+		mark_mmio_spte(vcpu, sptep, gfn, pte_access);
+		if (flush)
+			kvm_flush_remote_tlbs_gfn(vcpu->kvm, gfn, level);
+		return RET_PF_EMULATE;
+	}
 	wrprot = make_spte(vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch,
 			   false, host_writable, &spte);

arch/x86/platform/efi/quirks.c+1−1

@@ -424,7 +424,7 @@ void __init efi_unmap_boot_services(void) · 423 unmodified lines
424	if (efi_enabled(EFI_DBG))	424	if (efi_enabled(EFI_DBG))
425	return;	425	return;
426		426
427	sz = sizeof(ranges_to_free) efi.memmap.nr_map + 1;	427	sz = sizeof(ranges_to_free) (efi.memmap.nr_map + 1);
428	ranges_to_free = kzalloc(sz, GFP_KERNEL);	428	ranges_to_free = kzalloc(sz, GFP_KERNEL);
429	if (!ranges_to_free) {	429	if (!ranges_to_free) {
430	pr_err("Failed to allocate storage for freeable EFI regions\n");	430	pr_err("Failed to allocate storage for freeable EFI regions\n");

drivers/accel/ivpu/ivpu_drv.h+1−0

@@ -35,6 +35,7 @@ · 34 unmodified lines
35	#define IVPU_HW_IP_60XX 60	35	#define IVPU_HW_IP_60XX 60
36		36
37	#define IVPU_HW_IP_REV_LNL_B0 4	37	#define IVPU_HW_IP_REV_LNL_B0 4
		38	#define IVPU_HW_IP_REV_NVL_A0 0
38		39
39	#define IVPU_HW_BTRS_MTL 1	40	#define IVPU_HW_BTRS_MTL 1
40	#define IVPU_HW_BTRS_LNL 2	41	#define IVPU_HW_BTRS_LNL 2

drivers/accel/ivpu/ivpu_hw.c+4−2

 	if (ivpu_hw_btrs_gen(vdev) == IVPU_HW_BTRS_MTL)
 		vdev->wa.interrupt_clear_with_0 = ivpu_hw_btrs_irqs_clear_with_0_mtl(vdev);
-	if (ivpu_device_id(vdev) == PCI_DEVICE_ID_LNL &&
+	if ((ivpu_device_id(vdev) == PCI_DEVICE_ID_LNL &&
-	    ivpu_revision(vdev) < IVPU_HW_IP_REV_LNL_B0)
+	     ivpu_revision(vdev) < IVPU_HW_IP_REV_LNL_B0) ||
+	    (ivpu_device_id(vdev) == PCI_DEVICE_ID_NVL &&
+	     ivpu_revision(vdev) == IVPU_HW_IP_REV_NVL_A0))
 		vdev->wa.disable_clock_relinquish = true;
 	if (ivpu_test_mode & IVPU_TEST_MODE_CLK_RELINQ_ENABLE)

drivers/acpi/ec.c+2−0

@@ -1656,6 +1656,8 @@ static int acpi_ec_setup(struct acpi_ec ec, struct acpi_device device, bool ca · 1655 unmodified lines
1656		1656
1657	ret = ec_install_handlers(ec, device, call_reg);	1657	ret = ec_install_handlers(ec, device, call_reg);
1658	if (ret) {	1658	if (ret) {
		1659	ec_remove_handlers(ec);
		1660
1659	if (ec == first_ec)	1661	if (ec == first_ec)
1660	first_ec = NULL;	1662	first_ec = NULL;
1661		1663

drivers/base/regmap/regmap.c+26−4

 			       unsigned int val_num)
 {
 	void *orig_work_buf;
+	unsigned int selector_reg;
 	unsigned int win_offset;
 	unsigned int win_page;
 	bool page_chg;
 			return -EINVAL;
 	}
-	/* It is possible to have selector register inside data window.
+	/*
-	   In that case, selector register is located on every page and
+	 * Calculate the address of the selector register in the corresponding
-	   it needs no page switching, when accessed alone. */
+	 * data window if it is located on every page.
+	 */
+	page_chg = in_range(range->selector_reg, range->window_start, range->window_len);
+	if (page_chg)
+		selector_reg = range->range_min + win_page * range->window_len +
+			       range->selector_reg - range->window_start;
+	/*
+	 * It is possible to have selector register inside data window.
+	 * In that case, selector register is located on every page and it
+	 * needs no page switching, when accessed alone.
+	 *
+	 * Nevertheless we should synchronize the cache values for it.
+	 * This can't be properly achieved if the selector register is
+	 * the first and the only one to be read inside the data window.
+	 * That's why we update it in that case as well.
+	 *
+	 * However, we specifically avoid updating it for the default page,
+	 * when it's overlapped with the real data window, to prevent from
+	 * infinite looping.
+	 */
 	if (val_num > 1 ||
+	    (page_chg && selector_reg != range->selector_reg) ||
 	    range->window_start + win_offset != range->selector_reg) {
 		/* Use separate work_buf during page switching */
 		orig_work_buf = map->work_buf;
 		ret = _regmap_update_bits(map, range->selector_reg,
 					  range->selector_mask,
 					  win_page << range->selector_shift,
-					  &page_chg, false);
+					  NULL, false);
 		map->work_buf = orig_work_buf;

drivers/block/zram/zram_drv.c+14−25

@@ -917,9 +917,8 @@ static void zram_account_writeback_submit(struct zram *zram) · 916 unmodified lines
917		917
918	static int zram_writeback_complete(struct zram zram, struct zram_wb_req req)	918	static int zram_writeback_complete(struct zram zram, struct zram_wb_req req)
919	{	919	{
920	u32 size, index = req->pps->index;	920	u32 index = req->pps->index;
921	int err, prio;	921	int err;
922	bool huge;
923		922
924	err = blk_status_to_errno(req->bio.bi_status);	923	err = blk_status_to_errno(req->bio.bi_status);
925	if (err) {	924	if (err) {
@@ -946,28 +945,13 @@ static int zram_writeback_complete(struct zram zram, struct zram_wb_req req) · 20 unmodified lines
946	goto out;	945	goto out;
947	}	946	}
948		947
949	if (zram->compressed_wb) {	948	clear_slot_flag(zram, index, ZRAM_IDLE);
950	/*	949	if (test_slot_flag(zram, index, ZRAM_HUGE))
951	* ZRAM_WB slots get freed, we need to preserve data required	950	atomic64_dec(&zram->stats.huge_pages);
952	* for read decompression.	951	atomic64_sub(get_slot_size(zram, index), &zram->stats.compr_data_size);
953	*/	952	zs_free(zram->mem_pool, get_slot_handle(zram, index));
954	size = get_slot_size(zram, index);
955	prio = get_slot_comp_priority(zram, index);
956	huge = test_slot_flag(zram, index, ZRAM_HUGE);
957	}
958
959	slot_free(zram, index);
960	set_slot_flag(zram, index, ZRAM_WB);
961	set_slot_handle(zram, index, req->blk_idx);	953	set_slot_handle(zram, index, req->blk_idx);
962		954	set_slot_flag(zram, index, ZRAM_WB);
963	if (zram->compressed_wb) {
964	if (huge)
965	set_slot_flag(zram, index, ZRAM_HUGE);
966	set_slot_size(zram, index, size);
967	set_slot_comp_priority(zram, index, prio);
968	}
969
970	atomic64_inc(&zram->stats.pages_stored);
971		955
972	out:	956	out:
973	slot_unlock(zram, index);	957	slot_unlock(zram, index);
@@ -2010,8 +1994,13 @@ static void slot_free(struct zram *zram, u32 index) · 1036 unmodified lines
2010	set_slot_comp_priority(zram, index, 0);	1994	set_slot_comp_priority(zram, index, 0);
2011		1995
2012	if (test_slot_flag(zram, index, ZRAM_HUGE)) {	1996	if (test_slot_flag(zram, index, ZRAM_HUGE)) {
		1997	/*
		1998	* Writeback completion decrements ->huge_pages but keeps
		1999	* ZRAM_HUGE flag for deferred decompression path.
		2000	*/
		2001	if (!test_slot_flag(zram, index, ZRAM_WB))
		2002	atomic64_dec(&zram->stats.huge_pages);
2013	clear_slot_flag(zram, index, ZRAM_HUGE);	2003	clear_slot_flag(zram, index, ZRAM_HUGE);
2014	atomic64_dec(&zram->stats.huge_pages);
2015	}	2004	}
2016		2005
2017	if (test_slot_flag(zram, index, ZRAM_WB)) {	2006	if (test_slot_flag(zram, index, ZRAM_WB)) {

drivers/bluetooth/btintel.c+8−3

 	bt_dev_err(hdev, "Hardware error 0x%2.2x", code);
+	hci_req_sync_lock(hdev);
 	skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
 	if (IS_ERR(skb)) {
 		bt_dev_err(hdev, "Reset after hardware error failed (%ld)",
 			   PTR_ERR(skb));
-		return;
+		goto unlock;
 	}
 	kfree_skb(skb);
 	if (IS_ERR(skb)) {
 		bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)",
 			   PTR_ERR(skb));
-		return;
+		goto unlock;
 	}
 	if (skb->len != 13) {
 		bt_dev_err(hdev, "Exception info size mismatch");
 		kfree_skb(skb);
-		return;
+		goto unlock;
 	}
 	bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
 	kfree_skb(skb);
+unlock:
+	hci_req_sync_unlock(hdev);
 }
 EXPORT_SYMBOL_GPL(btintel_hw_error);

drivers/bluetooth/btusb.c+4−1

 		if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_CVSD) {
 			if (hdev->voice_setting & 0x0020) {
 				static const int alts[3] = { 2, 4, 5 };
+				unsigned int sco_idx;
-				new_alts = alts[data->sco_num - 1];
+				sco_idx = min_t(unsigned int, data->sco_num - 1,
+						ARRAY_SIZE(alts) - 1);
+				new_alts = alts[sco_idx];
 			} else {
 				new_alts = data->sco_num;
 			}

drivers/bluetooth/hci_ll.c+2−0

 	if (err || !fw->data || !fw->size) {
 		bt_dev_err(lldev->hu.hdev, "request_firmware failed(errno %d) for %s",
 			   err, bts_scr_name);
+		if (!err)
+			release_firmware(fw);
 		return -EINVAL;
 	}
 	ptr = (void *)fw->data;

drivers/cpufreq/cpufreq.c+3−6

 		 * If there is a problem with its frequency table, take it
 		 * offline and drop it.
 		 */
-		if (policy->freq_table_sorted != CPUFREQ_TABLE_SORTED_ASCENDING &&
+		ret = cpufreq_table_validate_and_sort(policy);
-		    policy->freq_table_sorted != CPUFREQ_TABLE_SORTED_DESCENDING) {
+		if (ret)
-			ret = cpufreq_table_validate_and_sort(policy);
+			goto out_offline_policy;
-			if (ret)
-				goto out_offline_policy;
-		}
 		/* related_cpus should at least include policy->cpus. */
 		cpumask_copy(policy->related_cpus, policy->cpus);

drivers/cpufreq/cpufreq_conservative.c+12−0

 	dbs_info->requested_freq = policy->cur;
 }
+static void cs_limits(struct cpufreq_policy *policy)
+{
+	struct cs_policy_dbs_info *dbs_info = to_dbs_info(policy->governor_data);
+	/*
+	 * The limits have changed, so may have the current frequency. Reset
+	 * requested_freq to avoid any unintended outcomes due to the mismatch.
+	 */
+	dbs_info->requested_freq = policy->cur;
+}
 static struct dbs_governor cs_governor = {
 	.gov = CPUFREQ_DBS_GOVERNOR_INITIALIZER("conservative"),
 	.kobj_type = { .default_groups = cs_groups },
 	.init = cs_init,
 	.exit = cs_exit,
 	.start = cs_start,
+	.limits = cs_limits,
 };
 #define CPU_FREQ_GOV_CONSERVATIVE	(cs_governor.gov)

drivers/cpufreq/cpufreq_governor.c+3−0

 void cpufreq_dbs_governor_limits(struct cpufreq_policy *policy)
 {
+	struct dbs_governor *gov = dbs_governor_of(policy);
 	struct policy_dbs_info *policy_dbs;
 	/* Protect gov->gdbs_data against cpufreq_dbs_governor_exit() */
 	mutex_lock(&policy_dbs->update_mutex);
 	cpufreq_policy_apply_limits(policy);
 	gov_update_sample_delay(policy_dbs, 0);
+	if (gov->limits)
+		gov->limits(policy);
 	mutex_unlock(&policy_dbs->update_mutex);
 out:

drivers/cpufreq/cpufreq_governor.h+1−0

@@ -138,6 +138,7 @@ struct dbs_governor { · 137 unmodified lines
138	int (init)(struct dbs_data dbs_data);	138	int (init)(struct dbs_data dbs_data);
139	void (exit)(struct dbs_data dbs_data);	139	void (exit)(struct dbs_data dbs_data);
140	void (start)(struct cpufreq_policy policy);	140	void (start)(struct cpufreq_policy policy);
		141	void (limits)(struct cpufreq_policy policy);
141	};	142	};
142		143
143	static inline struct dbs_governor dbs_governor_of(struct cpufreq_policy policy)	144	static inline struct dbs_governor dbs_governor_of(struct cpufreq_policy policy)

drivers/cpufreq/freq_table.c+4−0

@@ -360,6 +360,10 @@ int cpufreq_table_validate_and_sort(struct cpufreq_policy *policy) · 359 unmodified lines
360	if (policy_has_boost_freq(policy))	360	if (policy_has_boost_freq(policy))
361	policy->boost_supported = true;	361	policy->boost_supported = true;
362		362
		363	if (policy->freq_table_sorted == CPUFREQ_TABLE_SORTED_ASCENDING \|\|
		364	policy->freq_table_sorted == CPUFREQ_TABLE_SORTED_DESCENDING)
		365	return 0;
		366
363	return set_freq_table_sorted(policy);	367	return set_freq_table_sorted(policy);
364	}	368	}
365		369

drivers/cxl/Kconfig+1−0

@@ -59,6 +59,7 @@ config CXL_ACPI · 58 unmodified lines
59	tristate "CXL ACPI: Platform Support"	59	tristate "CXL ACPI: Platform Support"
60	depends on ACPI	60	depends on ACPI
61	depends on ACPI_NUMA	61	depends on ACPI_NUMA
		62	depends on CXL_PMEM \|\| !CXL_PMEM
62	default CXL_BUS	63	default CXL_BUS
63	select ACPI_TABLE_LIB	64	select ACPI_TABLE_LIB
64	select ACPI_HMAT	65	select ACPI_HMAT

drivers/cxl/core/hdm.c+9−16

 	struct cxl_hdm *cxlhdm;
 	void __iomem *hdm;
 	u32 ctrl;
-	int i;
 	if (!info)
 		return false;
 		return false;
 	/*
-	 * If any decoders are committed already, there should not be any
+	 * If HDM decoders are globally enabled, do not fall back to DVSEC
-	 * emulated DVSEC decoders.
+	 * range emulation. Zeroed decoder registers after region teardown
+	 * do not imply absence of HDM capability.
+	 *
+	 * Falling back to DVSEC here would treat the decoder as AUTO and
+	 * may incorrectly latch default interleave settings.
 	 */
-	for (i = 0; i < cxlhdm->decoder_count; i++) {
+	ctrl = readl(hdm + CXL_HDM_DECODER_CTRL_OFFSET);
-		ctrl = readl(hdm + CXL_HDM_DECODER0_CTRL_OFFSET(i));
+	if (ctrl & CXL_HDM_DECODER_ENABLE)
-		dev_dbg(&info->port->dev,
+		return false;
-			"decoder%d.%d: committed: %ld base: %#x_%.8x size: %#x_%.8x\n",
-			info->port->id, i,
-			FIELD_GET(CXL_HDM_DECODER0_CTRL_COMMITTED, ctrl),
-			readl(hdm + CXL_HDM_DECODER0_BASE_HIGH_OFFSET(i)),
-			readl(hdm + CXL_HDM_DECODER0_BASE_LOW_OFFSET(i)),
-			readl(hdm + CXL_HDM_DECODER0_SIZE_HIGH_OFFSET(i)),
-			readl(hdm + CXL_HDM_DECODER0_SIZE_LOW_OFFSET(i)));
-		if (FIELD_GET(CXL_HDM_DECODER0_CTRL_COMMITTED, ctrl))
-			return false;
-	}
 	return true;
 }

drivers/cxl/core/mbox.c+1−1

@@ -1301,7 +1301,7 @@ int cxl_mem_sanitize(struct cxl_memdev *cxlmd, u16 cmd) · 1300 unmodified lines
1301	* Require an endpoint to be safe otherwise the driver can not	1301	* Require an endpoint to be safe otherwise the driver can not
1302	* be sure that the device is unmapped.	1302	* be sure that the device is unmapped.
1303	*/	1303	*/
1304	if (endpoint && cxl_num_decoders_committed(endpoint) == 0)	1304	if (cxlmd->dev.driver && cxl_num_decoders_committed(endpoint) == 0)
1305	return __cxl_mem_sanitize(mds, cmd);	1305	return __cxl_mem_sanitize(mds, cmd);
1306		1306
1307	return -EBUSY;	1307	return -EBUSY;

drivers/cxl/core/port.c+6−2

@@ -552,10 +552,13 @@ static void cxl_port_release(struct device *dev) · 551 unmodified lines
552	xa_destroy(&port->dports);	552	xa_destroy(&port->dports);
553	xa_destroy(&port->regions);	553	xa_destroy(&port->regions);
554	ida_free(&cxl_port_ida, port->id);	554	ida_free(&cxl_port_ida, port->id);
555	if (is_cxl_root(port))	555
		556	if (is_cxl_root(port)) {
556	kfree(to_cxl_root(port));	557	kfree(to_cxl_root(port));
557	else	558	} else {
		559	put_device(dev->parent);
558	kfree(port);	560	kfree(port);
		561	}
559	}	562	}
560		563
561	static ssize_t decoders_committed_show(struct device *dev,	564	static ssize_t decoders_committed_show(struct device *dev,
@@ -707,6 +710,7 @@ static struct cxl_port cxl_port_alloc(struct device uport_dev, · 145 unmodified lines
707	struct cxl_port *iter;	710	struct cxl_port *iter;
708		711
709	dev->parent = &parent_port->dev;	712	dev->parent = &parent_port->dev;
		713	get_device(dev->parent);
710	port->depth = parent_port->depth + 1;	714	port->depth = parent_port->depth + 1;
711	port->parent_dport = parent_dport;	715	port->parent_dport = parent_dport;
712		716

drivers/cxl/core/region.c+3−1

 	}
 	rc = sysfs_update_group(&cxlr->dev.kobj, &cxl_region_group);
-	if (rc)
+	if (rc) {
+		kfree(res);
 		return rc;
+	}
 	rc = insert_resource(cxlrd->res, res);
 	if (rc) {

drivers/cxl/pmem.c+1−1

@@ -554,7 +554,7 @@ static __exit void cxl_pmem_exit(void) · 553 unmodified lines
554		554
555	MODULE_DESCRIPTION("CXL PMEM: Persistent Memory Support");	555	MODULE_DESCRIPTION("CXL PMEM: Persistent Memory Support");
556	MODULE_LICENSE("GPL v2");	556	MODULE_LICENSE("GPL v2");
557	module_init(cxl_pmem_init);	557	subsys_initcall(cxl_pmem_init);
558	module_exit(cxl_pmem_exit);	558	module_exit(cxl_pmem_exit);
559	MODULE_IMPORT_NS("CXL");	559	MODULE_IMPORT_NS("CXL");
560	MODULE_ALIAS_CXL(CXL_DEVICE_NVDIMM_BRIDGE);	560	MODULE_ALIAS_CXL(CXL_DEVICE_NVDIMM_BRIDGE);

drivers/dma/dw-edma/dw-edma-core.c+6−2

@@ -844,6 +844,7 @@ static int dw_edma_irq_request(struct dw_edma *dw, · 843 unmodified lines
844	{	844	{
845	struct dw_edma_chip *chip = dw->chip;	845	struct dw_edma_chip *chip = dw->chip;
846	struct device *dev = dw->chip->dev;	846	struct device *dev = dw->chip->dev;
		847	struct msi_desc *msi_desc;
847	u32 wr_mask = 1;	848	u32 wr_mask = 1;
848	u32 rd_mask = 1;	849	u32 rd_mask = 1;
849	int i, err = 0;	850	int i, err = 0;
@@ -895,9 +896,12 @@ static int dw_edma_irq_request(struct dw_edma *dw, · 45 unmodified lines
895	&dw->irq[i]);	896	&dw->irq[i]);
896	if (err)	897	if (err)
897	goto err_irq_free;	898	goto err_irq_free;
898		899	msi_desc = irq_get_msi_desc(irq);
899	if (irq_get_msi_desc(irq))	900	if (msi_desc) {
900	get_cached_msi_msg(irq, &dw->irq[i].msi);	901	get_cached_msi_msg(irq, &dw->irq[i].msi);
		902	if (!msi_desc->pci.msi_attrib.is_msix)
		903	dw->irq[i].msi.data = dw->irq[0].msi.data + i;
		904	}
901	}	905	}
902		906
903	dw->nr_irqs = i;	907	dw->nr_irqs = i;

drivers/dma/dw-edma/dw-hdma-v0-core.c+3−3

 			  lower_32_bits(chunk->ll_region.paddr));
 		SET_CH_32(dw, chan->dir, chan->id, llp.msb,
 			  upper_32_bits(chunk->ll_region.paddr));
+		/* Set consumer cycle */
+		SET_CH_32(dw, chan->dir, chan->id, cycle_sync,
+			HDMA_V0_CONSUMER_CYCLE_STAT | HDMA_V0_CONSUMER_CYCLE_BIT);
 	}
-	/* Set consumer cycle */
-	SET_CH_32(dw, chan->dir, chan->id, cycle_sync,
-		  HDMA_V0_CONSUMER_CYCLE_STAT | HDMA_V0_CONSUMER_CYCLE_BIT);
 	dw_hdma_v0_sync_ll_data(chunk);

drivers/dma/fsl-edma-main.c+11−15

@@ -317,10 +317,8 @@ static struct dma_chan fsl_edma3_xlate(struct of_phandle_args dma_spec, · 316 unmodified lines
317	return NULL;	317	return NULL;
318	i = fsl_chan - fsl_edma->chans;	318	i = fsl_chan - fsl_edma->chans;
319		319
320	fsl_chan->priority = dma_spec->args[1];	320	if (!b_chmux && i != dma_spec->args[0])
321	fsl_chan->is_rxchan = dma_spec->args[2] & FSL_EDMA_RX;	321	continue;
322	fsl_chan->is_remote = dma_spec->args[2] & FSL_EDMA_REMOTE;
323	fsl_chan->is_multi_fifo = dma_spec->args[2] & FSL_EDMA_MULTI_FIFO;
324		322
325	if ((dma_spec->args[2] & FSL_EDMA_EVEN_CH) && (i & 0x1))	323	if ((dma_spec->args[2] & FSL_EDMA_EVEN_CH) && (i & 0x1))
326	continue;	324	continue;
@@ -328,17 +326,15 @@ static struct dma_chan fsl_edma3_xlate(struct of_phandle_args dma_spec, · 1 unmodified line
328	if ((dma_spec->args[2] & FSL_EDMA_ODD_CH) && !(i & 0x1))	326	if ((dma_spec->args[2] & FSL_EDMA_ODD_CH) && !(i & 0x1))
329	continue;	327	continue;
330		328
331	if (!b_chmux && i == dma_spec->args[0]) {	329	fsl_chan->srcid = dma_spec->args[0];
332	chan = dma_get_slave_channel(chan);	330	fsl_chan->priority = dma_spec->args[1];
333	chan->device->privatecnt++;	331	fsl_chan->is_rxchan = dma_spec->args[2] & FSL_EDMA_RX;
334	return chan;	332	fsl_chan->is_remote = dma_spec->args[2] & FSL_EDMA_REMOTE;
335	} else if (b_chmux && !fsl_chan->srcid) {	333	fsl_chan->is_multi_fifo = dma_spec->args[2] & FSL_EDMA_MULTI_FIFO;
336	/* if controller support channel mux, choose a free channel */	334
337	chan = dma_get_slave_channel(chan);	335	chan = dma_get_slave_channel(chan);
338	chan->device->privatecnt++;	336	chan->device->privatecnt++;
339	fsl_chan->srcid = dma_spec->args[0];	337	return chan;
340	return chan;
341	}
342	}	338	}
343	return NULL;	339	return NULL;
344	}	340	}

drivers/dma/idxd/cdev.c+4−4

 static void idxd_cdev_dev_release(struct device *dev)
 {
 	struct idxd_cdev *idxd_cdev = dev_to_cdev(dev);
-	struct idxd_cdev_context *cdev_ctx;
-	struct idxd_wq *wq = idxd_cdev->wq;
-	cdev_ctx = &ictx[wq->idxd->data->type];
-	ida_free(&cdev_ctx->minor_ida, idxd_cdev->minor);
 	kfree(idxd_cdev);
 }
 void idxd_wq_del_cdev(struct idxd_wq *wq)
 {
+	struct idxd_cdev_context *cdev_ctx;
 	struct idxd_cdev *idxd_cdev;
 	idxd_cdev = wq->idxd_cdev;
 	wq->idxd_cdev = NULL;
 	cdev_device_del(&idxd_cdev->cdev, cdev_dev(idxd_cdev));
+	cdev_ctx = &ictx[wq->idxd->data->type];
+	ida_free(&cdev_ctx->minor_ida, idxd_cdev->minor);
 	put_device(cdev_dev(idxd_cdev));
 }

drivers/dma/idxd/device.c+31−14

 	free_descs(wq);
 	dma_free_coherent(dev, wq->compls_size, wq->compls, wq->compls_addr);
 	sbitmap_queue_free(&wq->sbq);
+	wq->type = IDXD_WQT_NONE;
 }
 EXPORT_SYMBOL_NS_GPL(idxd_wq_free_resources, "IDXD");
 	lockdep_assert_held(&wq->wq_lock);
 	wq->state = IDXD_WQ_DISABLED;
 	memset(wq->wqcfg, 0, idxd->wqcfg_size);
-	wq->type = IDXD_WQT_NONE;
 	wq->threshold = 0;
 	wq->priority = 0;
 	wq->enqcmds_retries = IDXD_ENQCMDS_RETRIES;
 	struct device *dev = &idxd->pdev->dev;
 	struct idxd_evl *evl = idxd->evl;
-	gencfg.bits = ioread32(idxd->reg_base + IDXD_GENCFG_OFFSET);
+	if (!evl)
-	if (!gencfg.evl_en)
 		return;
 	mutex_lock(&evl->lock);
 {
 	int rc;
-	lockdep_assert_held(&idxd->dev_lock);
+	guard(spinlock)(&idxd->dev_lock);
+	if (!test_bit(IDXD_FLAG_CONFIGURABLE, &idxd->flags))
+		return 0;
 	rc = idxd_wqs_setup(idxd);
 	if (rc < 0)
 		return rc;
 	free_irq(ie->vector, ie);
 	idxd_flush_pending_descs(ie);
+	/* The interrupt might have been already released by FLR */
+	if (ie->int_handle == INVALID_INT_HANDLE)
+		return;
 	if (idxd->request_int_handles)
 		idxd_device_release_int_handle(idxd, ie->int_handle, IDXD_IRQ_MSIX);
 	idxd_device_clear_perm_entry(idxd, ie);
 	ie->pasid = IOMMU_PASID_INVALID;
 }
+void idxd_wq_flush_descs(struct idxd_wq *wq)
+{
+	struct idxd_irq_entry *ie = &wq->ie;
+	struct idxd_device *idxd = wq->idxd;
+	guard(mutex)(&wq->wq_lock);
+	if (wq->state != IDXD_WQ_ENABLED || wq->type != IDXD_WQT_KERNEL)
+		return;
+	idxd_flush_pending_descs(ie);
+	if (idxd->request_int_handles)
+		idxd_device_release_int_handle(idxd, ie->int_handle, IDXD_IRQ_MSIX);
+	idxd_device_clear_perm_entry(idxd, ie);
+	ie->int_handle = INVALID_INT_HANDLE;
+}
 int idxd_wq_request_irq(struct idxd_wq *wq)
 {
 	struct idxd_device *idxd = wq->idxd;
 		}
 	}
-	rc = 0;
+	rc = idxd_device_config(idxd);
-	spin_lock(&idxd->dev_lock);
-	if (test_bit(IDXD_FLAG_CONFIGURABLE, &idxd->flags))
-		rc = idxd_device_config(idxd);
-	spin_unlock(&idxd->dev_lock);
 	if (rc < 0) {
 		dev_dbg(dev, "Writing wq %d config failed: %d\n", wq->id, rc);
 		goto err;
 	idxd_wq_reset(wq);
 	idxd_wq_free_resources(wq);
 	percpu_ref_exit(&wq->wq_active);
-	wq->type = IDXD_WQT_NONE;
 	wq->client_count = 0;
 }
 EXPORT_SYMBOL_NS_GPL(idxd_drv_disable_wq, "IDXD");
 	}
 	/* Device configuration */
-	spin_lock(&idxd->dev_lock);
+	rc = idxd_device_config(idxd);
-	if (test_bit(IDXD_FLAG_CONFIGURABLE, &idxd->flags))
-		rc = idxd_device_config(idxd);
-	spin_unlock(&idxd->dev_lock);
 	if (rc < 0)
 		return -ENXIO;

drivers/dma/idxd/dma.c+18−0

@@ -194,6 +194,22 @@ static void idxd_dma_release(struct dma_device *device) · 193 unmodified lines
194	kfree(idxd_dma);	194	kfree(idxd_dma);
195	}	195	}
196		196
		197	static int idxd_dma_terminate_all(struct dma_chan *c)
		198	{
		199	struct idxd_wq *wq = to_idxd_wq(c);
		200
		201	idxd_wq_flush_descs(wq);
		202
		203	return 0;
		204	}
		205
		206	static void idxd_dma_synchronize(struct dma_chan *c)
		207	{
		208	struct idxd_wq *wq = to_idxd_wq(c);
		209
		210	idxd_wq_drain(wq);
		211	}
		212
197	int idxd_register_dma_device(struct idxd_device *idxd)	213	int idxd_register_dma_device(struct idxd_device *idxd)
198	{	214	{
199	struct idxd_dma_dev *idxd_dma;	215	struct idxd_dma_dev *idxd_dma;
@@ -224,6 +240,8 @@ int idxd_register_dma_device(struct idxd_device *idxd) · 24 unmodified lines
224	dma->device_issue_pending = idxd_dma_issue_pending;	240	dma->device_issue_pending = idxd_dma_issue_pending;
225	dma->device_alloc_chan_resources = idxd_dma_alloc_chan_resources;	241	dma->device_alloc_chan_resources = idxd_dma_alloc_chan_resources;
226	dma->device_free_chan_resources = idxd_dma_free_chan_resources;	242	dma->device_free_chan_resources = idxd_dma_free_chan_resources;
		243	dma->device_terminate_all = idxd_dma_terminate_all;
		244	dma->device_synchronize = idxd_dma_synchronize;
227		245
228	rc = dma_async_device_register(dma);	246	rc = dma_async_device_register(dma);
229	if (rc < 0) {	247	if (rc < 0) {

drivers/dma/idxd/idxd.h+1−0

@@ -803,6 +803,7 @@ void idxd_wq_quiesce(struct idxd_wq *wq); · 802 unmodified lines
803	int idxd_wq_init_percpu_ref(struct idxd_wq *wq);	803	int idxd_wq_init_percpu_ref(struct idxd_wq *wq);
804	void idxd_wq_free_irq(struct idxd_wq *wq);	804	void idxd_wq_free_irq(struct idxd_wq *wq);
805	int idxd_wq_request_irq(struct idxd_wq *wq);	805	int idxd_wq_request_irq(struct idxd_wq *wq);
		806	void idxd_wq_flush_descs(struct idxd_wq *wq);
806		807
807	/* submission */	808	/* submission */
808	int idxd_submit_desc(struct idxd_wq wq, struct idxd_desc desc);	809	int idxd_submit_desc(struct idxd_wq wq, struct idxd_desc desc);

drivers/dma/idxd/init.c+7−7

 	idxd->rdbuf_limit = idxd_saved->saved_idxd.rdbuf_limit;
-	idxd->evl->size = saved_evl->size;
+	if (idxd->evl)
+		idxd->evl->size = saved_evl->size;
 	for (i = 0; i < idxd->max_groups; i++) {
 		struct idxd_group *saved_group, *group;
 	idxd_device_config_restore(idxd, idxd->idxd_saved);
 	/* Re-configure IDXD device if allowed. */
-	if (test_bit(IDXD_FLAG_CONFIGURABLE, &idxd->flags)) {
+	rc = idxd_device_config(idxd);
-		rc = idxd_device_config(idxd);
+	if (rc < 0) {
-		if (rc < 0) {
+		dev_err(dev, "HALT: %s config fails\n", idxd_name);
-			dev_err(dev, "HALT: %s config fails\n", idxd_name);
+		goto out;
-			goto out;
-		}
 	}
 	/* Bind IDXD device to driver. */
 	}
 out:
 	kfree(idxd->idxd_saved);
+	idxd->idxd_saved = NULL;
 }
 static const struct pci_error_handlers idxd_error_handler = {

drivers/dma/idxd/irq.c+16−0

@@ -397,6 +397,17 @@ static void idxd_device_flr(struct work_struct *work) · 396 unmodified lines
397	dev_err(&idxd->pdev->dev, "FLR failed\n");	397	dev_err(&idxd->pdev->dev, "FLR failed\n");
398	}	398	}
399		399
		400	static void idxd_wqs_flush_descs(struct idxd_device *idxd)
		401	{
		402	int i;
		403
		404	for (i = 0; i < idxd->max_wqs; i++) {
		405	struct idxd_wq *wq = idxd->wqs[i];
		406
		407	idxd_wq_flush_descs(wq);
		408	}
		409	}
		410
400	static irqreturn_t idxd_halt(struct idxd_device *idxd)	411	static irqreturn_t idxd_halt(struct idxd_device *idxd)
401	{	412	{
402	union gensts_reg gensts;	413	union gensts_reg gensts;
@@ -415,6 +426,11 @@ static irqreturn_t idxd_halt(struct idxd_device *idxd) · 12 unmodified lines
415	} else if (gensts.reset_type == IDXD_DEVICE_RESET_FLR) {	426	} else if (gensts.reset_type == IDXD_DEVICE_RESET_FLR) {
416	idxd->state = IDXD_DEV_HALTED;	427	idxd->state = IDXD_DEV_HALTED;
417	idxd_mask_error_interrupts(idxd);	428	idxd_mask_error_interrupts(idxd);
		429	/* Flush all pending descriptors, and disable
		430	* interrupts, they will be re-enabled when FLR
		431	* concludes.
		432	*/
		433	idxd_wqs_flush_descs(idxd);
418	dev_dbg(&idxd->pdev->dev,	434	dev_dbg(&idxd->pdev->dev,
419	"idxd halted, doing FLR. After FLR, configs are restored\n");	435	"idxd halted, doing FLR. After FLR, configs are restored\n");
420	INIT_WORK(&idxd->work, idxd_device_flr);	436	INIT_WORK(&idxd->work, idxd_device_flr);

drivers/dma/idxd/submit.c+1−1

@@ -138,7 +138,7 @@ static void llist_abort_desc(struct idxd_wq wq, struct idxd_irq_entry ie, · 137 unmodified lines
138	*/	138	*/
139	list_for_each_entry_safe(d, t, &flist, list) {	139	list_for_each_entry_safe(d, t, &flist, list) {
140	list_del_init(&d->list);	140	list_del_init(&d->list);
141	idxd_dma_complete_txd(found, IDXD_COMPLETE_ABORT, true,	141	idxd_dma_complete_txd(d, IDXD_COMPLETE_ABORT, true,
142	NULL, NULL);	142	NULL, NULL);
143	}	143	}
144	}	144	}

drivers/dma/idxd/sysfs.c+1−0

@@ -1836,6 +1836,7 @@ static void idxd_conf_device_release(struct device *dev) · 1835 unmodified lines
1836	{	1836	{
1837	struct idxd_device *idxd = confdev_to_idxd(dev);	1837	struct idxd_device *idxd = confdev_to_idxd(dev);
1838		1838
		1839	destroy_workqueue(idxd->wq);
1839	kfree(idxd->groups);	1840	kfree(idxd->groups);
1840	bitmap_free(idxd->wq_enable_map);	1841	bitmap_free(idxd->wq_enable_map);
1841	kfree(idxd->wqs);	1842	kfree(idxd->wqs);

drivers/dma/sh/rz-dmac.c+36−30

@@ -10,6 +10,7 @@ · 9 unmodified lines
10	*/	10	*/
11		11
12	#include <linux/bitfield.h>	12	#include <linux/bitfield.h>
		13	#include <linux/cleanup.h>
13	#include <linux/dma-mapping.h>	14	#include <linux/dma-mapping.h>
14	#include <linux/dmaengine.h>	15	#include <linux/dmaengine.h>
15	#include <linux/interrupt.h>	16	#include <linux/interrupt.h>
@@ -296,13 +297,10 @@ static void rz_dmac_disable_hw(struct rz_dmac_chan *channel) · 280 unmodified lines
296	{	297	{
297	struct dma_chan *chan = &channel->vc.chan;	298	struct dma_chan *chan = &channel->vc.chan;
298	struct rz_dmac *dmac = to_rz_dmac(chan->device);	299	struct rz_dmac *dmac = to_rz_dmac(chan->device);
299	unsigned long flags;
300		300
301	dev_dbg(dmac->dev, "%s channel %d\n", __func__, channel->index);	301	dev_dbg(dmac->dev, "%s channel %d\n", __func__, channel->index);
302		302
303	local_irq_save(flags);
304	rz_dmac_ch_writel(channel, CHCTRL_DEFAULT, CHCTRL, 1);	303	rz_dmac_ch_writel(channel, CHCTRL_DEFAULT, CHCTRL, 1);
305	local_irq_restore(flags);
306	}	304	}
307		305
308	static void rz_dmac_set_dmars_register(struct rz_dmac *dmac, int nr, u32 dmars)	306	static void rz_dmac_set_dmars_register(struct rz_dmac *dmac, int nr, u32 dmars)
@@ -447,6 +445,7 @@ static int rz_dmac_alloc_chan_resources(struct dma_chan *chan) · 138 unmodified lines
447	if (!desc)	445	if (!desc)
448	break;	446	break;
449		447
		448	/* No need to lock. This is called only for the 1st client. */
450	list_add_tail(&desc->node, &channel->ld_free);	449	list_add_tail(&desc->node, &channel->ld_free);
451	channel->descs_allocated++;	450	channel->descs_allocated++;
452	}	451	}
@@ -502,18 +501,21 @@ rz_dmac_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest, dma_addr_t src, · 49 unmodified lines
502	dev_dbg(dmac->dev, "%s channel: %d src=0x%pad dst=0x%pad len=%zu\n",	501	dev_dbg(dmac->dev, "%s channel: %d src=0x%pad dst=0x%pad len=%zu\n",
503	__func__, channel->index, &src, &dest, len);	502	__func__, channel->index, &src, &dest, len);
504		503
505	if (list_empty(&channel->ld_free))	504	scoped_guard(spinlock_irqsave, &channel->vc.lock) {
506	return NULL;	505	if (list_empty(&channel->ld_free))
		506	return NULL;
507		507
508	desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node);	508	desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node);
509		509
510	desc->type = RZ_DMAC_DESC_MEMCPY;	510	desc->type = RZ_DMAC_DESC_MEMCPY;
511	desc->src = src;	511	desc->src = src;
512	desc->dest = dest;	512	desc->dest = dest;
513	desc->len = len;	513	desc->len = len;
514	desc->direction = DMA_MEM_TO_MEM;	514	desc->direction = DMA_MEM_TO_MEM;
		515
		516	list_move_tail(channel->ld_free.next, &channel->ld_queue);
		517	}
515		518
516	list_move_tail(channel->ld_free.next, &channel->ld_queue);
517	return vchan_tx_prep(&channel->vc, &desc->vd, flags);	519	return vchan_tx_prep(&channel->vc, &desc->vd, flags);
518	}	520	}
519		521
@@ -529,27 +531,29 @@ rz_dmac_prep_slave_sg(struct dma_chan chan, struct scatterlist sgl, · 9 unmodified lines
529	int dma_length = 0;	531	int dma_length = 0;
530	int i = 0;	532	int i = 0;
531		533
532	if (list_empty(&channel->ld_free))	534	scoped_guard(spinlock_irqsave, &channel->vc.lock) {
533	return NULL;	535	if (list_empty(&channel->ld_free))
		536	return NULL;
534		537
535	desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node);	538	desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node);
536		539
537	for_each_sg(sgl, sg, sg_len, i) {	540	for_each_sg(sgl, sg, sg_len, i)
538	dma_length += sg_dma_len(sg);	541	dma_length += sg_dma_len(sg);
539	}
540		542
541	desc->type = RZ_DMAC_DESC_SLAVE_SG;	543	desc->type = RZ_DMAC_DESC_SLAVE_SG;
542	desc->sg = sgl;	544	desc->sg = sgl;
543	desc->sgcount = sg_len;	545	desc->sgcount = sg_len;
544	desc->len = dma_length;	546	desc->len = dma_length;
545	desc->direction = direction;	547	desc->direction = direction;
546		548
547	if (direction == DMA_DEV_TO_MEM)	549	if (direction == DMA_DEV_TO_MEM)
548	desc->src = channel->src_per_address;	550	desc->src = channel->src_per_address;
549	else	551	else
550	desc->dest = channel->dst_per_address;	552	desc->dest = channel->dst_per_address;
		553
		554	list_move_tail(channel->ld_free.next, &channel->ld_queue);
		555	}
551		556
552	list_move_tail(channel->ld_free.next, &channel->ld_queue);
553	return vchan_tx_prep(&channel->vc, &desc->vd, flags);	557	return vchan_tx_prep(&channel->vc, &desc->vd, flags);
554	}	558	}
555		559
@@ -561,8 +565,8 @@ static int rz_dmac_terminate_all(struct dma_chan *chan) · 5 unmodified lines
561	unsigned int i;	565	unsigned int i;
562	LIST_HEAD(head);	566	LIST_HEAD(head);
563		567
564	rz_dmac_disable_hw(channel);
565	spin_lock_irqsave(&channel->vc.lock, flags);	568	spin_lock_irqsave(&channel->vc.lock, flags);
		569	rz_dmac_disable_hw(channel);
566	for (i = 0; i < DMAC_NR_LMDESC; i++)	570	for (i = 0; i < DMAC_NR_LMDESC; i++)
567	lmdesc[i].header = 0;	571	lmdesc[i].header = 0;
568		572
@@ -699,7 +703,9 @@ static void rz_dmac_irq_handle_channel(struct rz_dmac_chan *channel) · 130 unmodified lines
699	if (chstat & CHSTAT_ER) {	703	if (chstat & CHSTAT_ER) {
700	dev_err(dmac->dev, "DMAC err CHSTAT_%d = %08X\n",	704	dev_err(dmac->dev, "DMAC err CHSTAT_%d = %08X\n",
701	channel->index, chstat);	705	channel->index, chstat);
702	rz_dmac_ch_writel(channel, CHCTRL_DEFAULT, CHCTRL, 1);	706
		707	scoped_guard(spinlock_irqsave, &channel->vc.lock)
		708	rz_dmac_ch_writel(channel, CHCTRL_DEFAULT, CHCTRL, 1);
703	goto done;	709	goto done;
704	}	710	}
705		711

drivers/dma/xilinx/xdma.c+2−2

@@ -1234,8 +1234,8 @@ static int xdma_probe(struct platform_device *pdev) · 1233 unmodified lines
1234		1234
1235	xdev->rmap = devm_regmap_init_mmio(&pdev->dev, reg_base,	1235	xdev->rmap = devm_regmap_init_mmio(&pdev->dev, reg_base,
1236	&xdma_regmap_config);	1236	&xdma_regmap_config);
1237	if (!xdev->rmap) {	1237	if (IS_ERR(xdev->rmap)) {
1238	xdma_err(xdev, "config regmap failed: %d", ret);	1238	xdma_err(xdev, "config regmap failed: %pe", xdev->rmap);
1239	goto failed;	1239	goto failed;
1240	}	1240	}
1241	INIT_LIST_HEAD(&xdev->dma_dev.channels);	1241	INIT_LIST_HEAD(&xdev->dma_dev.channels);

drivers/dma/xilinx/xilinx_dma.c+30−16

 					      struct xilinx_cdma_tx_segment,
 					      node);
 			cdma_hw = &cdma_seg->hw;
-			residue += (cdma_hw->control - cdma_hw->status) &
+			residue += (cdma_hw->control & chan->xdev->max_buffer_len) -
-				   chan->xdev->max_buffer_len;
+			           (cdma_hw->status & chan->xdev->max_buffer_len);
 		} else if (chan->xdev->dma_config->dmatype ==
 			   XDMA_TYPE_AXIDMA) {
 			axidma_seg = list_entry(entry,
 						struct xilinx_axidma_tx_segment,
 						node);
 			axidma_hw = &axidma_seg->hw;
-			residue += (axidma_hw->control - axidma_hw->status) &
+			residue += (axidma_hw->control & chan->xdev->max_buffer_len) -
-				   chan->xdev->max_buffer_len;
+			           (axidma_hw->status & chan->xdev->max_buffer_len);
 		} else {
 			aximcdma_seg =
 				list_entry(entry,
 					   node);
 			aximcdma_hw = &aximcdma_seg->hw;
 			residue +=
-				(aximcdma_hw->control - aximcdma_hw->status) &
+				(aximcdma_hw->control & chan->xdev->max_buffer_len) -
-				chan->xdev->max_buffer_len;
+				(aximcdma_hw->status & chan->xdev->max_buffer_len);
 		}
 	}
 	dma_cookie_init(dchan);
-	if (chan->xdev->dma_config->dmatype == XDMA_TYPE_AXIDMA) {
-		/* For AXI DMA resetting once channel will reset the
-		 * other channel as well so enable the interrupts here.
-		 */
-		dma_ctrl_set(chan, XILINX_DMA_REG_DMACR,
-			      XILINX_DMA_DMAXR_ALL_IRQ_MASK);
-	}
 	if ((chan->xdev->dma_config->dmatype == XDMA_TYPE_CDMA) && chan->has_sg)
 		dma_ctrl_set(chan, XILINX_DMA_REG_DMACR,
 			     XILINX_CDMA_CR_SGMODE);
 	if (chan->err)
 		return;
-	if (list_empty(&chan->pending_list))
+	if (list_empty(&chan->pending_list)) {
+		if (chan->cyclic) {
+			struct xilinx_dma_tx_descriptor *desc;
+			struct list_head *entry;
+			desc = list_last_entry(&chan->done_list,
+					       struct xilinx_dma_tx_descriptor, node);
+			list_for_each(entry, &desc->segments) {
+				struct xilinx_axidma_tx_segment *axidma_seg;
+				struct xilinx_axidma_desc_hw *axidma_hw;
+				axidma_seg = list_entry(entry,
+							struct xilinx_axidma_tx_segment,
+							node);
+				axidma_hw = &axidma_seg->hw;
+				axidma_hw->status = 0;
+			}
+			list_splice_tail_init(&chan->done_list, &chan->active_list);
+			chan->desc_pendingcount = 0;
+			chan->idle = false;
+		}
 		return;
+	}
 	if (!chan->idle)
 		return;
 			     head_desc->async_tx.phys);
 	reg  &= ~XILINX_DMA_CR_DELAY_MAX;
 	reg  |= chan->irq_delay << XILINX_DMA_CR_DELAY_SHIFT;
+	reg |= XILINX_DMA_DMAXR_ALL_IRQ_MASK;
 	dma_ctrl_write(chan, XILINX_DMA_REG_DMACR, reg);
 	xilinx_dma_start(chan);
 		return -EINVAL;
 	}
-	xdev->common.directions |= chan->direction;
+	xdev->common.directions |= BIT(chan->direction);
 	/* Request the interrupt */
 	chan->irq = of_irq_get(node, chan->tdest);

drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c+2−2

 		goto err_ib_sched;
 	}
-	/* Drop the initial kref_init count (see drm_sched_main as example) */
-	dma_fence_put(f);
 	ret = dma_fence_wait(f, false);
+	/* Drop the returned fence reference after the wait completes */
+	dma_fence_put(f);
 err_ib_sched:
 	amdgpu_job_free(job);

drivers/gpu/drm/amd/amdgpu/amdgpu_device.c+11−2

 static int amdgpu_device_get_job_timeout_settings(struct amdgpu_device *adev)
 {
-	char *input = amdgpu_lockup_timeout;
+	char buf[AMDGPU_MAX_TIMEOUT_PARAM_LENGTH];
+	char *input = buf;
 	char *timeout_setting = NULL;
 	int index = 0;
 	long timeout;
 	adev->gfx_timeout = adev->compute_timeout = adev->sdma_timeout =
 		adev->video_timeout = msecs_to_jiffies(2000);
-	if (!strnlen(input, AMDGPU_MAX_TIMEOUT_PARAM_LENGTH))
+	if (!strnlen(amdgpu_lockup_timeout, AMDGPU_MAX_TIMEOUT_PARAM_LENGTH))
 		return 0;
+	/*
+	 * strsep() destructively modifies its input by replacing delimiters
+	 * with '\0'. Use a stack copy so the global module parameter buffer
+	 * remains intact for multi-GPU systems where this function is called
+	 * once per device.
+	 */
+	strscpy(buf, amdgpu_lockup_timeout, sizeof(buf));
 	while ((timeout_setting = strsep(&input, ",")) &&
 	       strnlen(timeout_setting, AMDGPU_MAX_TIMEOUT_PARAM_LENGTH)) {
 		ret = kstrtol(timeout_setting, 0, &timeout);

drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c+32−13

@@ -35,10 +35,13 @@ · 34 unmodified lines
35	* PASIDs are global address space identifiers that can be shared	35	* PASIDs are global address space identifiers that can be shared
36	* between the GPU, an IOMMU and the driver. VMs on different devices	36	* between the GPU, an IOMMU and the driver. VMs on different devices
37	* may use the same PASID if they share the same address	37	* may use the same PASID if they share the same address
38	* space. Therefore PASIDs are allocated using a global IDA. VMs are	38	* space. Therefore PASIDs are allocated using IDR cyclic allocator
39	* looked up from the PASID per amdgpu_device.	39	* (similar to kernel PID allocation) which naturally delays reuse.
		40	* VMs are looked up from the PASID per amdgpu_device.
40	*/	41	*/
41	static DEFINE_IDA(amdgpu_pasid_ida);	42
		43	static DEFINE_IDR(amdgpu_pasid_idr);
		44	static DEFINE_SPINLOCK(amdgpu_pasid_idr_lock);
42		45
43	/* Helper to free pasid from a fence callback */	46	/* Helper to free pasid from a fence callback */
44	struct amdgpu_pasid_cb {	47	struct amdgpu_pasid_cb {
@@ -50,8 +53,8 @@ struct amdgpu_pasid_cb { · 5 unmodified lines
50	* amdgpu_pasid_alloc - Allocate a PASID	53	* amdgpu_pasid_alloc - Allocate a PASID
51	* @bits: Maximum width of the PASID in bits, must be at least 1	54	* @bits: Maximum width of the PASID in bits, must be at least 1
52	*	55	*
53	* Allocates a PASID of the given width while keeping smaller PASIDs	56	* Uses kernel's IDR cyclic allocator (same as PID allocation).
54	* available if possible.	57	* Allocates sequentially with automatic wrap-around.
55	*	58	*
56	* Returns a positive integer on success. Returns %-EINVAL if bits==0.	59	* Returns a positive integer on success. Returns %-EINVAL if bits==0.
57	* Returns %-ENOSPC if no PASID was available. Returns %-ENOMEM on	60	* Returns %-ENOSPC if no PASID was available. Returns %-ENOMEM on
@@ -59,14 +62,15 @@ struct amdgpu_pasid_cb { · 1 unmodified line
59	*/	62	*/
60	int amdgpu_pasid_alloc(unsigned int bits)	63	int amdgpu_pasid_alloc(unsigned int bits)
61	{	64	{
62	int pasid = -EINVAL;	65	int pasid;
63		66
64	for (bits = min(bits, 31U); bits > 0; bits--) {	67	if (bits == 0)
65	pasid = ida_alloc_range(&amdgpu_pasid_ida, 1U << (bits - 1),	68	return -EINVAL;
66	(1U << bits) - 1, GFP_KERNEL);	69
67	if (pasid != -ENOSPC)	70	spin_lock(&amdgpu_pasid_idr_lock);
68	break;	71	pasid = idr_alloc_cyclic(&amdgpu_pasid_idr, NULL, 1,
69	}	72	1U << bits, GFP_KERNEL);
		73	spin_unlock(&amdgpu_pasid_idr_lock);
70		74
71	if (pasid >= 0)	75	if (pasid >= 0)
72	trace_amdgpu_pasid_allocated(pasid);	76	trace_amdgpu_pasid_allocated(pasid);
@@ -81,7 +85,10 @@ int amdgpu_pasid_alloc(unsigned int bits) · 8 unmodified lines
81	void amdgpu_pasid_free(u32 pasid)	85	void amdgpu_pasid_free(u32 pasid)
82	{	86	{
83	trace_amdgpu_pasid_freed(pasid);	87	trace_amdgpu_pasid_freed(pasid);
84	ida_free(&amdgpu_pasid_ida, pasid);	88
		89	spin_lock(&amdgpu_pasid_idr_lock);
		90	idr_remove(&amdgpu_pasid_idr, pasid);
		91	spin_unlock(&amdgpu_pasid_idr_lock);
85	}	92	}
86		93
87	static void amdgpu_pasid_free_cb(struct dma_fence *fence,	94	static void amdgpu_pasid_free_cb(struct dma_fence *fence,
@@ -616,3 +623,15 @@ void amdgpu_vmid_mgr_fini(struct amdgpu_device *adev) · 528 unmodified lines
616	}	623	}
617	}	624	}
618	}	625	}
		626
		627	/**
		628	* amdgpu_pasid_mgr_cleanup - cleanup PASID manager
		629	*
		630	* Cleanup the IDR allocator.
		631	*/
		632	void amdgpu_pasid_mgr_cleanup(void)
		633	{
		634	spin_lock(&amdgpu_pasid_idr_lock);
		635	idr_destroy(&amdgpu_pasid_idr);
		636	spin_unlock(&amdgpu_pasid_idr_lock);
		637	}

drivers/gpu/drm/amd/amdgpu/amdgpu_ids.h+1−0

@@ -74,6 +74,7 @@ int amdgpu_pasid_alloc(unsigned int bits); · 73 unmodified lines
74	void amdgpu_pasid_free(u32 pasid);	74	void amdgpu_pasid_free(u32 pasid);
75	void amdgpu_pasid_free_delayed(struct dma_resv *resv,	75	void amdgpu_pasid_free_delayed(struct dma_resv *resv,
76	u32 pasid);	76	u32 pasid);
		77	void amdgpu_pasid_mgr_cleanup(void);
77		78
78	bool amdgpu_vmid_had_gpu_reset(struct amdgpu_device *adev,	79	bool amdgpu_vmid_had_gpu_reset(struct amdgpu_device *adev,
79	struct amdgpu_vmid *id);	80	struct amdgpu_vmid *id);

drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c+4−3

 	xa_destroy(&adev->vm_manager.pasids);
 	amdgpu_vmid_mgr_fini(adev);
+	amdgpu_pasid_mgr_cleanup();
 }
 /**
 	if (!root)
 		return false;
-	addr /= AMDGPU_GPU_PAGE_SIZE;
 	if (is_compute_context && !svm_range_restore_pages(adev, pasid, vmid,
-	    node_id, addr, ts, write_fault)) {
+	    node_id, addr >> PAGE_SHIFT, ts, write_fault)) {
 		amdgpu_bo_unref(&root);
 		return true;
 	}
+	addr /= AMDGPU_GPU_PAGE_SIZE;
 	r = amdgpu_bo_reserve(root, true);
 	if (r)
 		goto error_unref;

drivers/gpu/drm/amd/amdkfd/kfd_chardev.c+3−3

 	struct kfd_process *process;
 	int ret;
-	/* Each FD owns only one kfd_process */
+	if (!filep->private_data || !p)
-	if (p->context_id != KFD_CONTEXT_ID_PRIMARY)
 		return -EINVAL;
-	if (!filep->private_data || !p)
+	/* Each FD owns only one kfd_process */
+	if (p->context_id != KFD_CONTEXT_ID_PRIMARY)
 		return -EINVAL;
 	mutex_lock(&kfd_processes_mutex);

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c+8−2

 		aconnector->dc_sink = sink;
 		dc_sink_retain(aconnector->dc_sink);
+		drm_edid_free(aconnector->drm_edid);
+		aconnector->drm_edid = NULL;
 		if (sink->dc_edid.length == 0) {
-			aconnector->drm_edid = NULL;
 			hdmi_cec_unset_edid(aconnector);
 			if (aconnector->dc_link->aux_mode) {
 				drm_dp_cec_unset_edid(&aconnector->dm_dp_aux.aux);
 	caps = &dm->backlight_caps[aconnector->bl_idx];
 	/* Only offer ABM property when non-OLED and user didn't turn off by module parameter */
-	if (!caps->ext_caps->bits.oled && amdgpu_dm_abm_level < 0)
+	if (caps->ext_caps && !caps->ext_caps->bits.oled && amdgpu_dm_abm_level < 0)
 		drm_object_attach_property(&aconnector->base.base,
 					   dm->adev->mode_info.abm_level_property,
 					   ABM_SYSFS_CONTROL);
 	}
 	if (dc_resource_is_dsc_encoding_supported(dc)) {
+		for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
+			dm_new_crtc_state = to_dm_crtc_state(new_crtc_state);
+			dm_new_crtc_state->mode_changed_independent_from_dsc = new_crtc_state->mode_changed;
+		}
 		for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
 			if (drm_atomic_crtc_needs_modeset(new_crtc_state)) {
 				ret = add_affected_mst_dsc_crtcs(state, crtc);

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h+1−0

@@ -984,6 +984,7 @@ struct dm_crtc_state { · 983 unmodified lines
984		984
985	bool freesync_vrr_info_changed;	985	bool freesync_vrr_info_changed;
986		986
		987	bool mode_changed_independent_from_dsc;
987	bool dsc_force_changed;	988	bool dsc_force_changed;
988	bool vrr_supported;	989	bool vrr_supported;
989	struct mod_freesync_config freesync_config;	990	struct mod_freesync_config freesync_config;

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c+3−1

 			int ind = find_crtc_index_in_state_by_stream(state, stream);
 			if (ind >= 0) {
+				struct dm_crtc_state *dm_new_crtc_state = to_dm_crtc_state(state->crtcs[ind].new_state);
 				DRM_INFO_ONCE("%s:%d MST_DSC no mode changed for stream 0x%p\n",
 						__func__, __LINE__, stream);
-				state->crtcs[ind].new_state->mode_changed = 0;
+				dm_new_crtc_state->base.mode_changed = dm_new_crtc_state->mode_changed_independent_from_dsc;
 			}
 		}
 	}

drivers/gpu/drm/amd/display/dc/resource/dce100/dce100_resource.c+2−4

 		return &enc110->base;
 	}
-	if (enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
-		return NULL;
 	link_regs_id =
 		map_transmitter_id_to_phy_instance(enc_init_data->transmitter);
 				      &link_enc_feature,
 				      &link_enc_regs[link_regs_id],
 				      &link_enc_aux_regs[enc_init_data->channel - 1],
-				      &link_enc_hpd_regs[enc_init_data->hpd_source]);
+				      enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs) ?
+				      NULL : &link_enc_hpd_regs[enc_init_data->hpd_source]);
 	return &enc110->base;
 }

drivers/gpu/drm/amd/display/dc/resource/dce110/dce110_resource.c+3−2

 		kzalloc_obj(struct dce110_link_encoder);
 	int link_regs_id;
-	if (!enc110 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
+	if (!enc110)
 		return NULL;
 	link_regs_id =
 				      &link_enc_feature,
 				      &link_enc_regs[link_regs_id],
 				      &link_enc_aux_regs[enc_init_data->channel - 1],
-				      &link_enc_hpd_regs[enc_init_data->hpd_source]);
+				      enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs) ?
+				      NULL : &link_enc_hpd_regs[enc_init_data->hpd_source]);
 	return &enc110->base;
 }

drivers/gpu/drm/amd/display/dc/resource/dce112/dce112_resource.c+3−2

 		kzalloc_obj(struct dce110_link_encoder);
 	int link_regs_id;
-	if (!enc110 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
+	if (!enc110)
 		return NULL;
 	link_regs_id =
 				      &link_enc_feature,
 				      &link_enc_regs[link_regs_id],
 				      &link_enc_aux_regs[enc_init_data->channel - 1],
-				      &link_enc_hpd_regs[enc_init_data->hpd_source]);
+				      enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs) ?
+				      NULL : &link_enc_hpd_regs[enc_init_data->hpd_source]);
 	return &enc110->base;
 }

drivers/gpu/drm/amd/display/dc/resource/dce120/dce120_resource.c+3−2

 		kzalloc_obj(struct dce110_link_encoder);
 	int link_regs_id;
-	if (!enc110 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
+	if (!enc110)
 		return NULL;
 	link_regs_id =
 				      &link_enc_feature,
 				      &link_enc_regs[link_regs_id],
 				      &link_enc_aux_regs[enc_init_data->channel - 1],
-				      &link_enc_hpd_regs[enc_init_data->hpd_source]);
+				      enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs) ?
+				      NULL : &link_enc_hpd_regs[enc_init_data->hpd_source]);
 	return &enc110->base;
 }

drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c+6−8

 		return &enc110->base;
 	}
-	if (enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
-		return NULL;
 	link_regs_id =
 		map_transmitter_id_to_phy_instance(enc_init_data->transmitter);
 	dce60_link_encoder_construct(enc110,
-				      enc_init_data,
+				     enc_init_data,
-				      &link_enc_feature,
+				     &link_enc_feature,
-				      &link_enc_regs[link_regs_id],
+				     &link_enc_regs[link_regs_id],
-				      &link_enc_aux_regs[enc_init_data->channel - 1],
+				     &link_enc_aux_regs[enc_init_data->channel - 1],
-				      &link_enc_hpd_regs[enc_init_data->hpd_source]);
+				     enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs) ?
+				     NULL : &link_enc_hpd_regs[enc_init_data->hpd_source]);
 	return &enc110->base;
 }

drivers/gpu/drm/amd/display/dc/resource/dce80/dce80_resource.c+2−4

 		return &enc110->base;
 	}
-	if (enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
-		return NULL;
 	link_regs_id =
 		map_transmitter_id_to_phy_instance(enc_init_data->transmitter);
 				      &link_enc_feature,
 				      &link_enc_regs[link_regs_id],
 				      &link_enc_aux_regs[enc_init_data->channel - 1],
-				      &link_enc_hpd_regs[enc_init_data->hpd_source]);
+				      enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs) ?
+				      NULL : &link_enc_hpd_regs[enc_init_data->hpd_source]);
 	return &enc110->base;
 }

drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c+32−1

@@ -59,6 +59,10 @@ · 58 unmodified lines
59		59
60	#define to_amdgpu_device(x) (container_of(x, struct amdgpu_device, pm.smu_i2c))	60	#define to_amdgpu_device(x) (container_of(x, struct amdgpu_device, pm.smu_i2c))
61		61
		62	static void smu_v13_0_0_get_od_setting_limits(struct smu_context *smu,
		63	int od_feature_bit,
		64	int32_t min, int32_t max);
		65
62	static const struct smu_feature_bits smu_v13_0_0_dpm_features = {	66	static const struct smu_feature_bits smu_v13_0_0_dpm_features = {
63	.bits = {	67	.bits = {
64	SMU_FEATURE_BIT_INIT(FEATURE_DPM_GFXCLK_BIT),	68	SMU_FEATURE_BIT_INIT(FEATURE_DPM_GFXCLK_BIT),
@@ -1043,8 +1047,35 @@ static bool smu_v13_0_0_is_od_feature_supported(struct smu_context *smu, · 978 unmodified lines
1043	PPTable_t *pptable = smu->smu_table.driver_pptable;	1047	PPTable_t *pptable = smu->smu_table.driver_pptable;
1044	const OverDriveLimits_t * const overdrive_upperlimits =	1048	const OverDriveLimits_t * const overdrive_upperlimits =
1045	&pptable->SkuTable.OverDriveLimitsBasicMax;	1049	&pptable->SkuTable.OverDriveLimitsBasicMax;
		1050	int32_t min_value, max_value;
		1051	bool feature_enabled;
1046		1052
1047	return overdrive_upperlimits->FeatureCtrlMask & (1U << od_feature_bit);	1053	switch (od_feature_bit) {
		1054	case PP_OD_FEATURE_FAN_CURVE_BIT:
		1055	feature_enabled = !!(overdrive_upperlimits->FeatureCtrlMask & (1U << od_feature_bit));
		1056	if (feature_enabled) {
		1057	smu_v13_0_0_get_od_setting_limits(smu, PP_OD_FEATURE_FAN_CURVE_TEMP,
		1058	&min_value, &max_value);
		1059	if (!min_value && !max_value) {
		1060	feature_enabled = false;
		1061	goto out;
		1062	}
		1063
		1064	smu_v13_0_0_get_od_setting_limits(smu, PP_OD_FEATURE_FAN_CURVE_PWM,
		1065	&min_value, &max_value);
		1066	if (!min_value && !max_value) {
		1067	feature_enabled = false;
		1068	goto out;
		1069	}
		1070	}
		1071	break;
		1072	default:
		1073	feature_enabled = !!(overdrive_upperlimits->FeatureCtrlMask & (1U << od_feature_bit));
		1074	break;
		1075	}
		1076
		1077	out:
		1078	return feature_enabled;
1048	}	1079	}
1049		1080
1050	static void smu_v13_0_0_get_od_setting_limits(struct smu_context *smu,	1081	static void smu_v13_0_0_get_od_setting_limits(struct smu_context *smu,

drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c+12−9

 		break;
 	case SMU_OD_MCLK:
 		if (!smu_v13_0_6_cap_supported(smu, SMU_CAP(SET_UCLK_MAX)))
-			return 0;
+			return -EOPNOTSUPP;
 		size += sysfs_emit_at(buf, size, "%s:\n", "OD_MCLK");
 		size += sysfs_emit_at(buf, size, "0: %uMhz\n1: %uMhz\n",
 {
 	struct smu_dpm_context *smu_dpm = &(smu->smu_dpm);
 	struct smu_13_0_dpm_context *dpm_context = smu_dpm->dpm_context;
+	struct smu_dpm_table *uclk_table = &dpm_context->dpm_tables.uclk_table;
 	struct smu_umd_pstate_table *pstate_table = &smu->pstate_table;
 	uint32_t min_clk;
 	uint32_t max_clk;
 			if (ret)
 				return ret;
-			min_clk = SMU_DPM_TABLE_MIN(
+			if (SMU_DPM_TABLE_MAX(uclk_table) !=
-				&dpm_context->dpm_tables.uclk_table);
+			    pstate_table->uclk_pstate.curr.max) {
-			max_clk = SMU_DPM_TABLE_MAX(
+				min_clk = SMU_DPM_TABLE_MIN(&dpm_context->dpm_tables.uclk_table);
-				&dpm_context->dpm_tables.uclk_table);
+				max_clk = SMU_DPM_TABLE_MAX(&dpm_context->dpm_tables.uclk_table);
-			ret = smu_v13_0_6_set_soft_freq_limited_range(
+				ret = smu_v13_0_6_set_soft_freq_limited_range(smu,
-				smu, SMU_UCLK, min_clk, max_clk, false);
+									      SMU_UCLK, min_clk,
-			if (ret)
+									      max_clk, false);
-				return ret;
+				if (ret)
+					return ret;
+			}
 			smu_v13_0_reset_custom_level(smu);
 		}
 		break;

drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c+32−1

@@ -59,6 +59,10 @@ · 58 unmodified lines
59		59
60	#define to_amdgpu_device(x) (container_of(x, struct amdgpu_device, pm.smu_i2c))	60	#define to_amdgpu_device(x) (container_of(x, struct amdgpu_device, pm.smu_i2c))
61		61
		62	static void smu_v13_0_7_get_od_setting_limits(struct smu_context *smu,
		63	int od_feature_bit,
		64	int32_t min, int32_t max);
		65
62	static const struct smu_feature_bits smu_v13_0_7_dpm_features = {	66	static const struct smu_feature_bits smu_v13_0_7_dpm_features = {
63	.bits = {	67	.bits = {
64	SMU_FEATURE_BIT_INIT(FEATURE_DPM_GFXCLK_BIT),	68	SMU_FEATURE_BIT_INIT(FEATURE_DPM_GFXCLK_BIT),
@@ -1053,8 +1057,35 @@ static bool smu_v13_0_7_is_od_feature_supported(struct smu_context *smu, · 988 unmodified lines
1053	PPTable_t *pptable = smu->smu_table.driver_pptable;	1057	PPTable_t *pptable = smu->smu_table.driver_pptable;
1054	const OverDriveLimits_t * const overdrive_upperlimits =	1058	const OverDriveLimits_t * const overdrive_upperlimits =
1055	&pptable->SkuTable.OverDriveLimitsBasicMax;	1059	&pptable->SkuTable.OverDriveLimitsBasicMax;
		1060	int32_t min_value, max_value;
		1061	bool feature_enabled;
1056		1062
1057	return overdrive_upperlimits->FeatureCtrlMask & (1U << od_feature_bit);	1063	switch (od_feature_bit) {
		1064	case PP_OD_FEATURE_FAN_CURVE_BIT:
		1065	feature_enabled = !!(overdrive_upperlimits->FeatureCtrlMask & (1U << od_feature_bit));
		1066	if (feature_enabled) {
		1067	smu_v13_0_7_get_od_setting_limits(smu, PP_OD_FEATURE_FAN_CURVE_TEMP,
		1068	&min_value, &max_value);
		1069	if (!min_value && !max_value) {
		1070	feature_enabled = false;
		1071	goto out;
		1072	}
		1073
		1074	smu_v13_0_7_get_od_setting_limits(smu, PP_OD_FEATURE_FAN_CURVE_PWM,
		1075	&min_value, &max_value);
		1076	if (!min_value && !max_value) {
		1077	feature_enabled = false;
		1078	goto out;
		1079	}
		1080	}
		1081	break;
		1082	default:
		1083	feature_enabled = !!(overdrive_upperlimits->FeatureCtrlMask & (1U << od_feature_bit));
		1084	break;
		1085	}
		1086
		1087	out:
		1088	return feature_enabled;
1058	}	1089	}
1059		1090
1060	static void smu_v13_0_7_get_od_setting_limits(struct smu_context *smu,	1091	static void smu_v13_0_7_get_od_setting_limits(struct smu_context *smu,

drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c+32−1

@@ -56,6 +56,10 @@ · 55 unmodified lines
56		56
57	#define to_amdgpu_device(x) (container_of(x, struct amdgpu_device, pm.smu_i2c))	57	#define to_amdgpu_device(x) (container_of(x, struct amdgpu_device, pm.smu_i2c))
58		58
		59	static void smu_v14_0_2_get_od_setting_limits(struct smu_context *smu,
		60	int od_feature_bit,
		61	int32_t min, int32_t max);
		62
59	static const struct smu_feature_bits smu_v14_0_2_dpm_features = {	63	static const struct smu_feature_bits smu_v14_0_2_dpm_features = {
60	.bits = { SMU_FEATURE_BIT_INIT(FEATURE_DPM_GFXCLK_BIT),	64	.bits = { SMU_FEATURE_BIT_INIT(FEATURE_DPM_GFXCLK_BIT),
61	SMU_FEATURE_BIT_INIT(FEATURE_DPM_UCLK_BIT),	65	SMU_FEATURE_BIT_INIT(FEATURE_DPM_UCLK_BIT),
@@ -922,8 +926,35 @@ static bool smu_v14_0_2_is_od_feature_supported(struct smu_context *smu, · 860 unmodified lines
922	PPTable_t *pptable = smu->smu_table.driver_pptable;	926	PPTable_t *pptable = smu->smu_table.driver_pptable;
923	const OverDriveLimits_t * const overdrive_upperlimits =	927	const OverDriveLimits_t * const overdrive_upperlimits =
924	&pptable->SkuTable.OverDriveLimitsBasicMax;	928	&pptable->SkuTable.OverDriveLimitsBasicMax;
		929	int32_t min_value, max_value;
		930	bool feature_enabled;
925		931
926	return overdrive_upperlimits->FeatureCtrlMask & (1U << od_feature_bit);	932	switch (od_feature_bit) {
		933	case PP_OD_FEATURE_FAN_CURVE_BIT:
		934	feature_enabled = !!(overdrive_upperlimits->FeatureCtrlMask & (1U << od_feature_bit));
		935	if (feature_enabled) {
		936	smu_v14_0_2_get_od_setting_limits(smu, PP_OD_FEATURE_FAN_CURVE_TEMP,
		937	&min_value, &max_value);
		938	if (!min_value && !max_value) {
		939	feature_enabled = false;
		940	goto out;
		941	}
		942
		943	smu_v14_0_2_get_od_setting_limits(smu, PP_OD_FEATURE_FAN_CURVE_PWM,
		944	&min_value, &max_value);
		945	if (!min_value && !max_value) {
		946	feature_enabled = false;
		947	goto out;
		948	}
		949	}
		950	break;
		951	default:
		952	feature_enabled = !!(overdrive_upperlimits->FeatureCtrlMask & (1U << od_feature_bit));
		953	break;
		954	}
		955
		956	out:
		957	return feature_enabled;
927	}	958	}
928		959
929	static void smu_v14_0_2_get_od_setting_limits(struct smu_context *smu,	960	static void smu_v14_0_2_get_od_setting_limits(struct smu_context *smu,

drivers/gpu/drm/drm_gem_shmem_helper.c+28−22

@@ -550,27 +550,27 @@ int drm_gem_shmem_dumb_create(struct drm_file file, struct drm_device dev, · 549 unmodified lines
550	}	550	}
551	EXPORT_SYMBOL_GPL(drm_gem_shmem_dumb_create);	551	EXPORT_SYMBOL_GPL(drm_gem_shmem_dumb_create);
552		552
553	static bool drm_gem_shmem_try_map_pmd(struct vm_fault *vmf, unsigned long addr,	553	static vm_fault_t try_insert_pfn(struct vm_fault *vmf, unsigned int order,
554	struct page *page)	554	unsigned long pfn)
555	{	555	{
		556	if (!order) {
		557	return vmf_insert_pfn(vmf->vma, vmf->address, pfn);
556	#ifdef CONFIG_ARCH_SUPPORTS_PMD_PFNMAP	558	#ifdef CONFIG_ARCH_SUPPORTS_PMD_PFNMAP
557	unsigned long pfn = page_to_pfn(page);	559	} else if (order == PMD_ORDER) {
558	unsigned long paddr = pfn << PAGE_SHIFT;	560	unsigned long paddr = pfn << PAGE_SHIFT;
559	bool aligned = (addr & ~PMD_MASK) == (paddr & ~PMD_MASK);	561	bool aligned = (vmf->address & ~PMD_MASK) == (paddr & ~PMD_MASK);
560		562
561	if (aligned &&	563	if (aligned &&
562	pmd_none(*vmf->pmd) &&	564	folio_test_pmd_mappable(page_folio(pfn_to_page(pfn)))) {
563	folio_test_pmd_mappable(page_folio(page))) {	565	pfn &= PMD_MASK >> PAGE_SHIFT;
564	pfn &= PMD_MASK >> PAGE_SHIFT;	566	return vmf_insert_pfn_pmd(vmf, pfn, false);
565	if (vmf_insert_pfn_pmd(vmf, pfn, false) == VM_FAULT_NOPAGE)	567	}
566	return true;
567	}
568	#endif	568	#endif
569		569	}
570	return false;	570	return VM_FAULT_FALLBACK;
571	}	571	}
572		572
573	static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf)	573	static vm_fault_t drm_gem_shmem_any_fault(struct vm_fault *vmf, unsigned int order)
574	{	574	{
575	struct vm_area_struct *vma = vmf->vma;	575	struct vm_area_struct *vma = vmf->vma;
576	struct drm_gem_object *obj = vma->vm_private_data;	576	struct drm_gem_object *obj = vma->vm_private_data;
@@ -581,6 +581,9 @@ static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf) · 4 unmodified lines
581	pgoff_t page_offset;	581	pgoff_t page_offset;
582	unsigned long pfn;	582	unsigned long pfn;
583		583
		584	if (order && order != PMD_ORDER)
		585	return VM_FAULT_FALLBACK;
		586
584	/* Offset to faulty address in the VMA. */	587	/* Offset to faulty address in the VMA. */
585	page_offset = vmf->pgoff - vma->vm_pgoff;	588	page_offset = vmf->pgoff - vma->vm_pgoff;
586		589
@@ -593,13 +596,8 @@ static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf) · 6 unmodified lines
593	goto out;	596	goto out;
594	}	597	}
595		598
596	if (drm_gem_shmem_try_map_pmd(vmf, vmf->address, pages[page_offset])) {
597	ret = VM_FAULT_NOPAGE;
598	goto out;
599	}
600
601	pfn = page_to_pfn(pages[page_offset]);	599	pfn = page_to_pfn(pages[page_offset]);
602	ret = vmf_insert_pfn(vma, vmf->address, pfn);	600	ret = try_insert_pfn(vmf, order, pfn);
603		601
604	out:	602	out:
605	dma_resv_unlock(shmem->base.resv);	603	dma_resv_unlock(shmem->base.resv);
@@ -607,6 +605,11 @@ static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf) · 1 unmodified line
607	return ret;	605	return ret;
608	}	606	}
609		607
		608	static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf)
		609	{
		610	return drm_gem_shmem_any_fault(vmf, 0);
		611	}
		612
610	static void drm_gem_shmem_vm_open(struct vm_area_struct *vma)	613	static void drm_gem_shmem_vm_open(struct vm_area_struct *vma)
611	{	614	{
612	struct drm_gem_object *obj = vma->vm_private_data;	615	struct drm_gem_object *obj = vma->vm_private_data;
@@ -643,6 +646,9 @@ static void drm_gem_shmem_vm_close(struct vm_area_struct *vma) · 30 unmodified lines
643		646
644	const struct vm_operations_struct drm_gem_shmem_vm_ops = {	647	const struct vm_operations_struct drm_gem_shmem_vm_ops = {
645	.fault = drm_gem_shmem_fault,	648	.fault = drm_gem_shmem_fault,
		649	#ifdef CONFIG_ARCH_SUPPORTS_PMD_PFNMAP
		650	.huge_fault = drm_gem_shmem_any_fault,
		651	#endif
646	.open = drm_gem_shmem_vm_open,	652	.open = drm_gem_shmem_vm_open,
647	.close = drm_gem_shmem_vm_close,	653	.close = drm_gem_shmem_vm_close,
648	};	654	};

drivers/gpu/drm/drm_syncobj.c+2−2

@@ -602,7 +602,7 @@ int drm_syncobj_get_handle(struct drm_file *file_private, · 601 unmodified lines
602	drm_syncobj_get(syncobj);	602	drm_syncobj_get(syncobj);
603		603
604	ret = xa_alloc(&file_private->syncobj_xa, handle, syncobj, xa_limit_32b,	604	ret = xa_alloc(&file_private->syncobj_xa, handle, syncobj, xa_limit_32b,
605	GFP_NOWAIT);	605	GFP_KERNEL);
606	if (ret)	606	if (ret)
607	drm_syncobj_put(syncobj);	607	drm_syncobj_put(syncobj);
608		608
@@ -716,7 +716,7 @@ static int drm_syncobj_fd_to_handle(struct drm_file *file_private, · 107 unmodified lines
716	drm_syncobj_get(syncobj);	716	drm_syncobj_get(syncobj);
717		717
718	ret = xa_alloc(&file_private->syncobj_xa, handle, syncobj, xa_limit_32b,	718	ret = xa_alloc(&file_private->syncobj_xa, handle, syncobj, xa_limit_32b,
719	GFP_NOWAIT);	719	GFP_KERNEL);
720	if (ret)	720	if (ret)
721	drm_syncobj_put(syncobj);	721	drm_syncobj_put(syncobj);
722		722

drivers/gpu/drm/i915/display/intel_display.c+7−1

 	struct intel_crtc_state *crtc_state =
 		intel_atomic_get_new_crtc_state(state, crtc);
 	struct intel_crtc_state *saved_state;
+	int err;
 	saved_state = intel_crtc_state_alloc(crtc);
 	if (!saved_state)
 	/* free the old crtc_state->hw members */
 	intel_crtc_free_hw_state(crtc_state);
-	intel_dp_tunnel_atomic_clear_stream_bw(state, crtc_state);
+	err = intel_dp_tunnel_atomic_clear_stream_bw(state, crtc_state);
+	if (err) {
+		kfree(saved_state);
+		return err;
+	}
 	/* FIXME: before the switch to atomic started, a new pipe_config was
 	 * kzalloc'd. Code that depends on any field being zero should be

drivers/gpu/drm/i915/display/intel_dp_tunnel.c+14−6

  *
  * Clear any DP tunnel stream BW requirement set by
  * intel_dp_tunnel_atomic_compute_stream_bw().
+ *
+ * Returns 0 in case of success, a negative error code otherwise.
  */
-void intel_dp_tunnel_atomic_clear_stream_bw(struct intel_atomic_state *state,
+int intel_dp_tunnel_atomic_clear_stream_bw(struct intel_atomic_state *state,
-					    struct intel_crtc_state *crtc_state)
+					   struct intel_crtc_state *crtc_state)
 {
 	struct intel_crtc *crtc = to_intel_crtc(crtc_state->uapi.crtc);
+	int err;
 	if (!crtc_state->dp_tunnel_ref.tunnel)
-		return;
+		return 0;
+	err = drm_dp_tunnel_atomic_set_stream_bw(&state->base,
+						 crtc_state->dp_tunnel_ref.tunnel,
+						 crtc->pipe, 0);
+	if (err)
+		return err;
-	drm_dp_tunnel_atomic_set_stream_bw(&state->base,
-					   crtc_state->dp_tunnel_ref.tunnel,
-					   crtc->pipe, 0);
 	drm_dp_tunnel_ref_put(&crtc_state->dp_tunnel_ref);
+	return 0;
 }
 /**

drivers/gpu/drm/i915/display/intel_dp_tunnel.h+7−4

 					     struct intel_dp *intel_dp,
 					     const struct intel_connector *connector,
 					     struct intel_crtc_state *crtc_state);
-void intel_dp_tunnel_atomic_clear_stream_bw(struct intel_atomic_state *state,
+int intel_dp_tunnel_atomic_clear_stream_bw(struct intel_atomic_state *state,
-					    struct intel_crtc_state *crtc_state);
+					   struct intel_crtc_state *crtc_state);
 int intel_dp_tunnel_atomic_add_state_for_crtc(struct intel_atomic_state *state,
 					      struct intel_crtc *crtc);
 	return 0;
 }
-static inline void
+static inline int
 intel_dp_tunnel_atomic_clear_stream_bw(struct intel_atomic_state *state,
-				       struct intel_crtc_state *crtc_state) {}
+				       struct intel_crtc_state *crtc_state)
+{
+	return 0;
+}
 static inline int
 intel_dp_tunnel_atomic_add_state_for_crtc(struct intel_atomic_state *state,

drivers/gpu/drm/i915/display/intel_gmbus.c+3−1

 		val = intel_de_read_fw(display, GMBUS3(display));
 		do {
-			if (extra_byte_added && len == 1)
+			if (extra_byte_added && len == 1) {
+				len--;
 				break;
+			}
 			*buf++ = val & 0xff;
 			val >>= 8;

drivers/gpu/drm/i915/display/intel_plane.c+9−2

 		drm_framebuffer_get(plane_state->hw.fb);
 }
+static void unlink_nv12_plane(struct intel_crtc_state *crtc_state,
+			      struct intel_plane_state *plane_state);
 void intel_plane_set_invisible(struct intel_crtc_state *crtc_state,
 			       struct intel_plane_state *plane_state)
 {
 	struct intel_plane *plane = to_intel_plane(plane_state->uapi.plane);
+	unlink_nv12_plane(crtc_state, plane_state);
 	crtc_state->active_planes &= ~BIT(plane->id);
 	crtc_state->scaled_planes &= ~BIT(plane->id);
 	crtc_state->nv12_planes &= ~BIT(plane->id);
 	struct intel_display *display = to_intel_display(plane_state);
 	struct intel_plane *plane = to_intel_plane(plane_state->uapi.plane);
+	if (!plane_state->planar_linked_plane)
+		return;
 	plane_state->planar_linked_plane = NULL;
 	if (!plane_state->is_y_plane)
 		if (plane->pipe != crtc->pipe)
 			continue;
-		if (plane_state->planar_linked_plane)
+		unlink_nv12_plane(crtc_state, plane_state);
-			unlink_nv12_plane(crtc_state, plane_state);
 	}
 	if (!crtc_state->nv12_planes)

drivers/gpu/drm/i915/i915_wait_util.h+1−1

 	might_sleep();							\
 	for (;;) {							\
 		const bool expired__ = ktime_after(ktime_get_raw(), end__); \
-		OP;							\
 		/* Guarantee COND check prior to timeout */		\
 		barrier();						\
+		OP;							\
 		if (COND) {						\
 			ret__ = 0;					\
 			break;						\

drivers/gpu/drm/mediatek/mtk_dsi.c+5−4

 	dsi->host.ops = &mtk_dsi_ops;
 	dsi->host.dev = dev;
+	init_waitqueue_head(&dsi->irq_wait_queue);
+	platform_set_drvdata(pdev, dsi);
 	ret = mipi_dsi_host_register(&dsi->host);
 	if (ret < 0)
 		return dev_err_probe(dev, ret, "Failed to register DSI host\n");
 		return dev_err_probe(&pdev->dev, ret, "Failed to request DSI irq\n");
 	}
-	init_waitqueue_head(&dsi->irq_wait_queue);
-	platform_set_drvdata(pdev, dsi);
 	dsi->bridge.of_node = dev->of_node;
 	dsi->bridge.type = DRM_MODE_CONNECTOR_DSI;

drivers/gpu/drm/xe/regs/xe_gt_regs.h+1−0

@@ -553,6 +553,7 @@ · 552 unmodified lines
553	#define ENABLE_SMP_LD_RENDER_SURFACE_CONTROL REG_BIT(44 - 32)	553	#define ENABLE_SMP_LD_RENDER_SURFACE_CONTROL REG_BIT(44 - 32)
554	#define FORCE_SLM_FENCE_SCOPE_TO_TILE REG_BIT(42 - 32)	554	#define FORCE_SLM_FENCE_SCOPE_TO_TILE REG_BIT(42 - 32)
555	#define FORCE_UGM_FENCE_SCOPE_TO_TILE REG_BIT(41 - 32)	555	#define FORCE_UGM_FENCE_SCOPE_TO_TILE REG_BIT(41 - 32)
		556	#define L3_128B_256B_WRT_DIS REG_BIT(40 - 32)
556	#define MAXREQS_PER_BANK REG_GENMASK(39 - 32, 37 - 32)	557	#define MAXREQS_PER_BANK REG_GENMASK(39 - 32, 37 - 32)
557	#define DISABLE_128B_EVICTION_COMMAND_UDW REG_BIT(36 - 32)	558	#define DISABLE_128B_EVICTION_COMMAND_UDW REG_BIT(36 - 32)
558		559

drivers/gpu/drm/xe/xe_pt.c+6−6

@@ -1442,9 +1442,9 @@ static int op_check_svm_userptr(struct xe_vm vm, struct xe_vma_op op, · 1441 unmodified lines
1442	err = vma_check_userptr(vm, op->map.vma, pt_update);	1442	err = vma_check_userptr(vm, op->map.vma, pt_update);
1443	break;	1443	break;
1444	case DRM_GPUVA_OP_REMAP:	1444	case DRM_GPUVA_OP_REMAP:
1445	if (op->remap.prev)	1445	if (op->remap.prev && !op->remap.skip_prev)
1446	err = vma_check_userptr(vm, op->remap.prev, pt_update);	1446	err = vma_check_userptr(vm, op->remap.prev, pt_update);
1447	if (!err && op->remap.next)	1447	if (!err && op->remap.next && !op->remap.skip_next)
1448	err = vma_check_userptr(vm, op->remap.next, pt_update);	1448	err = vma_check_userptr(vm, op->remap.next, pt_update);
1449	break;	1449	break;
1450	case DRM_GPUVA_OP_UNMAP:	1450	case DRM_GPUVA_OP_UNMAP:
@@ -2198,12 +2198,12 @@ static int op_prepare(struct xe_vm *vm, · 747 unmodified lines
2198		2198
2199	err = unbind_op_prepare(tile, pt_update_ops, old);	2199	err = unbind_op_prepare(tile, pt_update_ops, old);
2200		2200
2201	if (!err && op->remap.prev) {	2201	if (!err && op->remap.prev && !op->remap.skip_prev) {
2202	err = bind_op_prepare(vm, tile, pt_update_ops,	2202	err = bind_op_prepare(vm, tile, pt_update_ops,
2203	op->remap.prev, false);	2203	op->remap.prev, false);
2204	pt_update_ops->wait_vm_bookkeep = true;	2204	pt_update_ops->wait_vm_bookkeep = true;
2205	}	2205	}
2206	if (!err && op->remap.next) {	2206	if (!err && op->remap.next && !op->remap.skip_next) {
2207	err = bind_op_prepare(vm, tile, pt_update_ops,	2207	err = bind_op_prepare(vm, tile, pt_update_ops,
2208	op->remap.next, false);	2208	op->remap.next, false);
2209	pt_update_ops->wait_vm_bookkeep = true;	2209	pt_update_ops->wait_vm_bookkeep = true;
@@ -2428,10 +2428,10 @@ static void op_commit(struct xe_vm *vm, · 218 unmodified lines
2428		2428
2429	unbind_op_commit(vm, tile, pt_update_ops, old, fence, fence2);	2429	unbind_op_commit(vm, tile, pt_update_ops, old, fence, fence2);
2430		2430
2431	if (op->remap.prev)	2431	if (op->remap.prev && !op->remap.skip_prev)
2432	bind_op_commit(vm, tile, pt_update_ops, op->remap.prev,	2432	bind_op_commit(vm, tile, pt_update_ops, op->remap.prev,
2433	fence, fence2, false);	2433	fence, fence2, false);
2434	if (op->remap.next)	2434	if (op->remap.next && !op->remap.skip_next)
2435	bind_op_commit(vm, tile, pt_update_ops, op->remap.next,	2435	bind_op_commit(vm, tile, pt_update_ops, op->remap.next,
2436	fence, fence2, false);	2436	fence, fence2, false);
2437	break;	2437	break;

drivers/gpu/drm/xe/xe_sriov_packet.c+2−0

@@ -341,6 +341,8 @@ ssize_t xe_sriov_packet_write_single(struct xe_device *xe, unsigned int vfid, · 340 unmodified lines
341	ret = xe_sriov_pf_migration_restore_produce(xe, vfid, *data);	341	ret = xe_sriov_pf_migration_restore_produce(xe, vfid, *data);
342	if (ret) {	342	if (ret) {
343	xe_sriov_packet_free(*data);	343	xe_sriov_packet_free(*data);
		344	*data = NULL;
		345
344	return ret;	346	return ret;
345	}	347	}
346		348

drivers/gpu/drm/xe/xe_vm.c+18−4

 			if (!err && op->remap.skip_prev) {
 				op->remap.prev->tile_present =
 					tile_present;
-				op->remap.prev = NULL;
 			}
 		}
 		if (op->remap.next) {
 			if (!err && op->remap.skip_next) {
 				op->remap.next->tile_present =
 					tile_present;
-				op->remap.next = NULL;
 			}
 		}
-		/* Adjust for partial unbind after removing VMA from VM */
+		/*
+		 * Adjust for partial unbind after removing VMA from VM. In case
+		 * of unwind we might need to undo this later.
+		 */
 		if (!err) {
 			op->base.remap.unmap->va->va.addr = op->remap.start;
 			op->base.remap.unmap->va->va.range = op->remap.range;
 			op->remap.start = xe_vma_start(old);
 			op->remap.range = xe_vma_size(old);
+			op->remap.old_start = op->remap.start;
+			op->remap.old_range = op->remap.range;
 			flags |= op->base.remap.unmap->va->flags & XE_VMA_CREATE_MASK;
 			if (op->base.remap.prev) {
 			xe_svm_notifier_lock(vm);
 			vma->gpuva.flags &= ~XE_VMA_DESTROYED;
 			xe_svm_notifier_unlock(vm);
-			if (post_commit)
+			if (post_commit) {
+				/*
+				 * Restore the old va range, in case of the
+				 * prev/next skip optimisation. Otherwise what
+				 * we re-insert here could be smaller than the
+				 * original range.
+				 */
+				op->base.remap.unmap->va->va.addr =
+					op->remap.old_start;
+				op->base.remap.unmap->va->va.range =
+					op->remap.old_range;
 				xe_vm_insert_vma(vm, vma);
+			}
 		}
 		break;
 	}

drivers/gpu/drm/xe/xe_vm_types.h+4−0

 	u64 start;
 	/** @range: range of the VMA unmap */
 	u64 range;
+	/** @old_start: Original start of the VMA we unmap */
+	u64 old_start;
+	/** @old_range: Original range of the VMA we unmap */
+	u64 old_range;
 	/** @skip_prev: skip prev rebind */
 	bool skip_prev;
 	/** @skip_next: skip next rebind */

drivers/gpu/drm/xe/xe_wa.c+2−1

@@ -247,7 +247,8 @@ static const struct xe_rtp_entry_sr gt_was[] = { · 246 unmodified lines
247	LSN_DIM_Z_WGT_MASK,	247	LSN_DIM_Z_WGT_MASK,
248	LSN_LNI_WGT(1) \| LSN_LNE_WGT(1) \|	248	LSN_LNI_WGT(1) \| LSN_LNE_WGT(1) \|
249	LSN_DIM_X_WGT(1) \| LSN_DIM_Y_WGT(1) \|	249	LSN_DIM_X_WGT(1) \| LSN_DIM_Y_WGT(1) \|
250	LSN_DIM_Z_WGT(1)))	250	LSN_DIM_Z_WGT(1)),
		251	SET(LSC_CHICKEN_BIT_0_UDW, L3_128B_256B_WRT_DIS))
251	},	252	},
252		253
253	/* Xe2_HPM */	254	/* Xe2_HPM */

drivers/hwmon/adm1177.c+31−23

 #include <linux/hwmon.h>
 #include <linux/i2c.h>
 #include <linux/init.h>
+#include <linux/math64.h>
+#include <linux/minmax.h>
 #include <linux/module.h>
 #include <linux/regulator/consumer.h>
 struct adm1177_state {
 	struct i2c_client	*client;
 	u32			r_sense_uohm;
-	u32			alert_threshold_ua;
+	u64			alert_threshold_ua;
 	bool			vrange_high;
 };
 }
 static int adm1177_write_alert_thr(struct adm1177_state *st,
-				   u32 alert_threshold_ua)
+				   u64 alert_threshold_ua)
 {
 	u64 val;
 	int ret;
 			*val = div_u64((105840000ull * dummy),
 				       4096 * st->r_sense_uohm);
 			return 0;
-		case hwmon_curr_max_alarm:
+		case hwmon_curr_max:
-			*val = st->alert_threshold_ua;
+			*val = div_u64(st->alert_threshold_ua, 1000);
 			return 0;
 		default:
 			return -EOPNOTSUPP;
 	switch (type) {
 	case hwmon_curr:
 		switch (attr) {
-		case hwmon_curr_max_alarm:
+		case hwmon_curr_max:
-			adm1177_write_alert_thr(st, val);
+			val = clamp_val(val, 0,
-			return 0;
+					div_u64(105840000ULL, st->r_sense_uohm));
+			return adm1177_write_alert_thr(st, (u64)val * 1000);
 		default:
 			return -EOPNOTSUPP;
 		}
 			if (st->r_sense_uohm)
 				return 0444;
 			return 0;
-		case hwmon_curr_max_alarm:
+		case hwmon_curr_max:
 			if (st->r_sense_uohm)
 				return 0644;
 			return 0;
 static const struct hwmon_channel_info * const adm1177_info[] = {
 	HWMON_CHANNEL_INFO(curr,
-			   HWMON_C_INPUT | HWMON_C_MAX_ALARM),
+			   HWMON_C_INPUT | HWMON_C_MAX),
 	HWMON_CHANNEL_INFO(in,
 			   HWMON_I_INPUT),
 	NULL
 	struct device *dev = &client->dev;
 	struct device *hwmon_dev;
 	struct adm1177_state *st;
-	u32 alert_threshold_ua;
+	u64 alert_threshold_ua;
+	u32 prop;
 	int ret;
 	st = devm_kzalloc(dev, sizeof(*st), GFP_KERNEL);
 	if (device_property_read_u32(dev, "shunt-resistor-micro-ohms",
 				     &st->r_sense_uohm))
 		st->r_sense_uohm = 0;
-	if (device_property_read_u32(dev, "adi,shutdown-threshold-microamp",
+	if (!device_property_read_u32(dev, "adi,shutdown-threshold-microamp",
-				     &alert_threshold_ua)) {
+				      &prop)) {
-		if (st->r_sense_uohm)
+		alert_threshold_ua = prop;
-			/*
+	} else if (st->r_sense_uohm) {
-			 * set maximum default value from datasheet based on
+		/*
-			 * shunt-resistor
+		 * set maximum default value from datasheet based on
-			 */
+		 * shunt-resistor
-			alert_threshold_ua = div_u64(105840000000,
+		 */
-						     st->r_sense_uohm);
+		alert_threshold_ua = div_u64(105840000000ULL,
-		else
+					     st->r_sense_uohm);
-			alert_threshold_ua = 0;
+	} else {
+		alert_threshold_ua = 0;
 	}
 	st->vrange_high = device_property_read_bool(dev,
 						    "adi,vrange-high-enable");
-	if (alert_threshold_ua && st->r_sense_uohm)
+	if (alert_threshold_ua && st->r_sense_uohm) {
-		adm1177_write_alert_thr(st, alert_threshold_ua);
+		ret = adm1177_write_alert_thr(st, alert_threshold_ua);
+		if (ret)
+			return ret;
+	}
 	ret = adm1177_write_cmd(st, ADM1177_CMD_V_CONT |
 				    ADM1177_CMD_I_CONT |

drivers/hwmon/peci/cputemp.c+2−2

@@ -131,7 +131,7 @@ static int get_temp_target(struct peci_cputemp *priv, enum peci_temp_target_type · 130 unmodified lines
131	*val = priv->temp.target.tjmax;	131	*val = priv->temp.target.tjmax;
132	break;	132	break;
133	case crit_hyst_type:	133	case crit_hyst_type:
134	*val = priv->temp.target.tjmax - priv->temp.target.tcontrol;	134	*val = priv->temp.target.tcontrol;
135	break;	135	break;
136	default:	136	default:
137	ret = -EOPNOTSUPP;	137	ret = -EOPNOTSUPP;
@@ -319,7 +319,7 @@ static umode_t cputemp_is_visible(const void *data, enum hwmon_sensor_types type · 181 unmodified lines
319	{	319	{
320	const struct peci_cputemp *priv = data;	320	const struct peci_cputemp *priv = data;
321		321
322	if (channel > CPUTEMP_CHANNEL_NUMS)	322	if (channel >= CPUTEMP_CHANNEL_NUMS)
323	return 0;	323	return 0;
324		324
325	if (channel < channel_core)	325	if (channel < channel_core)

drivers/hwmon/pmbus/ina233.c+2−1

@@ -72,7 +72,8 @@ static int ina233_read_word_data(struct i2c_client *client, int page, · 71 unmodified lines
72		72
73	/* Adjust returned value to match VIN coefficients */	73	/* Adjust returned value to match VIN coefficients */
74	/* VIN: 1.25 mV VSHUNT: 2.5 uV LSB */	74	/* VIN: 1.25 mV VSHUNT: 2.5 uV LSB */
75	ret = DIV_ROUND_CLOSEST(ret * 25, 12500);	75	ret = clamp_val(DIV_ROUND_CLOSEST((s16)ret * 25, 12500),
		76	S16_MIN, S16_MAX) & 0xffff;
76	break;	77	break;
77	default:	78	default:
78	ret = -ENODATA;	79	ret = -ENODATA;

drivers/hwmon/pmbus/isl68137.c+18−3

 					     int page,
 					     char *buf)
 {
-	int val = pmbus_read_byte_data(client, page, PMBUS_OPERATION);
+	int val;
+	val = pmbus_lock_interruptible(client);
+	if (val)
+		return val;
+	val = pmbus_read_byte_data(client, page, PMBUS_OPERATION);
+	pmbus_unlock(client);
 	if (val < 0)
 		return val;
 	op_val = result ? ISL68137_VOUT_AVS : 0;
+	rc = pmbus_lock_interruptible(client);
+	if (rc)
+		return rc;
 	/*
 	 * Writes to VOUT setpoint over AVSBus will persist after the VRM is
 	 * switched to PMBus control. Switching back to AVSBus control
 		rc = pmbus_read_word_data(client, page, 0xff,
 					  PMBUS_VOUT_COMMAND);
 		if (rc < 0)
-			return rc;
+			goto unlock;
 		rc = pmbus_write_word_data(client, page, PMBUS_VOUT_COMMAND,
 					   rc);
 		if (rc < 0)
-			return rc;
+			goto unlock;
 	}
 	rc = pmbus_update_byte_data(client, page, PMBUS_OPERATION,
 				    ISL68137_VOUT_AVS, op_val);
+unlock:
+	pmbus_unlock(client);
 	return (rc < 0) ? rc : count;
 }

drivers/hwmon/pmbus/pmbus_core.c+154−38

@@ -6,6 +6,7 @@ · 5 unmodified lines
6	* Copyright (c) 2012 Guenter Roeck	6	* Copyright (c) 2012 Guenter Roeck
7	*/	7	*/
8		8
		9	#include <linux/atomic.h>
9	#include <linux/debugfs.h>	10	#include <linux/debugfs.h>
10	#include <linux/delay.h>	11	#include <linux/delay.h>
11	#include <linux/dcache.h>	12	#include <linux/dcache.h>
@@ -21,8 +22,8 @@ · 9 unmodified lines
21	#include <linux/pmbus.h>	22	#include <linux/pmbus.h>
22	#include <linux/regulator/driver.h>	23	#include <linux/regulator/driver.h>
23	#include <linux/regulator/machine.h>	24	#include <linux/regulator/machine.h>
24	#include <linux/of.h>
25	#include <linux/thermal.h>	25	#include <linux/thermal.h>
		26	#include <linux/workqueue.h>
26	#include "pmbus.h"	27	#include "pmbus.h"
27		28
28	/*	29	/*
@@ -112,6 +113,11 @@ struct pmbus_data { · 83 unmodified lines
112		113
113	struct mutex update_lock;	114	struct mutex update_lock;
114		115
		116	#if IS_ENABLED(CONFIG_REGULATOR)
		117	atomic_t regulator_events[PMBUS_PAGES];
		118	struct work_struct regulator_notify_work;
		119	#endif
		120
115	bool has_status_word; /* device uses STATUS_WORD register */	121	bool has_status_word; /* device uses STATUS_WORD register */
116	int (read_status)(struct i2c_client client, int page);	122	int (read_status)(struct i2c_client client, int page);
117		123
@@ -1209,6 +1215,12 @@ static ssize_t pmbus_show_boolean(struct device *dev, · 1091 unmodified lines
1209	return sysfs_emit(buf, "%d\n", val);	1215	return sysfs_emit(buf, "%d\n", val);
1210	}	1216	}
1211		1217
		1218	static ssize_t pmbus_show_zero(struct device *dev,
		1219	struct device_attribute devattr, char buf)
		1220	{
		1221	return sysfs_emit(buf, "0\n");
		1222	}
		1223
1212	static ssize_t pmbus_show_sensor(struct device *dev,	1224	static ssize_t pmbus_show_sensor(struct device *dev,
1213	struct device_attribute devattr, char buf)	1225	struct device_attribute devattr, char buf)
1214	{	1226	{
@@ -1407,7 +1419,7 @@ static struct pmbus_sensor pmbus_add_sensor(struct pmbus_data data, · 192 unmodified lines
1407	int reg,	1419	int reg,
1408	enum pmbus_sensor_classes class,	1420	enum pmbus_sensor_classes class,
1409	bool update, bool readonly,	1421	bool update, bool readonly,
1410	bool convert)	1422	bool writeonly, bool convert)
1411	{	1423	{
1412	struct pmbus_sensor *sensor;	1424	struct pmbus_sensor *sensor;
1413	struct device_attribute *a;	1425	struct device_attribute *a;
@@ -1436,7 +1448,8 @@ static struct pmbus_sensor pmbus_add_sensor(struct pmbus_data data, · 22 unmodified lines
1436	sensor->data = -ENODATA;	1448	sensor->data = -ENODATA;
1437	pmbus_dev_attr_init(a, sensor->name,	1449	pmbus_dev_attr_init(a, sensor->name,
1438	readonly ? 0444 : 0644,	1450	readonly ? 0444 : 0644,
1439	pmbus_show_sensor, pmbus_set_sensor);	1451	writeonly ? pmbus_show_zero : pmbus_show_sensor,
		1452	pmbus_set_sensor);
1440		1453
1441	if (pmbus_add_attribute(data, &a->attr))	1454	if (pmbus_add_attribute(data, &a->attr))
1442	return NULL;	1455	return NULL;
@@ -1495,8 +1508,10 @@ static int pmbus_add_label(struct pmbus_data *data, · 52 unmodified lines
1495	struct pmbus_limit_attr {	1508	struct pmbus_limit_attr {
1496	u16 reg; /* Limit register */	1509	u16 reg; /* Limit register */
1497	u16 sbit; /* Alarm attribute status bit */	1510	u16 sbit; /* Alarm attribute status bit */
1498	bool update; /* True if register needs updates */	1511	bool readonly:1; /* True if the attribute is read-only */
1499	bool low; /* True if low limit; for limits with compare functions only */	1512	bool writeonly:1; /* True if the attribute is write-only */
		1513	bool update:1; /* True if register needs updates */
		1514	bool low:1; /* True if low limit; for limits with compare functions only */
1500	const char attr; / Attribute name */	1515	const char attr; / Attribute name */
1501	const char alarm; / Alarm attribute name */	1516	const char alarm; / Alarm attribute name */
1502	};	1517	};
@@ -1511,9 +1526,9 @@ struct pmbus_sensor_attr { · 8 unmodified lines
1511	u8 nlimit; /* # of limit registers */	1526	u8 nlimit; /* # of limit registers */
1512	enum pmbus_sensor_classes class;/* sensor class */	1527	enum pmbus_sensor_classes class;/* sensor class */
1513	const char label; / sensor label */	1528	const char label; / sensor label */
1514	bool paged; /* true if paged sensor */	1529	bool paged:1; /* true if paged sensor */
1515	bool update; /* true if update needed */	1530	bool update:1; /* true if update needed */
1516	bool compare; /* true if compare function needed */	1531	bool compare:1; /* true if compare function needed */
1517	u32 func; /* sensor mask */	1532	u32 func; /* sensor mask */
1518	u32 sfunc; /* sensor status mask */	1533	u32 sfunc; /* sensor status mask */
1519	int sreg; /* status register */	1534	int sreg; /* status register */
@@ -1544,7 +1559,7 @@ static int pmbus_add_limit_attrs(struct i2c_client *client, · 24 unmodified lines
1544	curr = pmbus_add_sensor(data, name, l->attr, index,	1559	curr = pmbus_add_sensor(data, name, l->attr, index,
1545	page, 0xff, l->reg, attr->class,	1560	page, 0xff, l->reg, attr->class,
1546	attr->update \|\| l->update,	1561	attr->update \|\| l->update,
1547	false, true);	1562	l->readonly, l->writeonly, true);
1548	if (!curr)	1563	if (!curr)
1549	return -ENOMEM;	1564	return -ENOMEM;
1550	if (l->sbit && (info->func[page] & attr->sfunc)) {	1565	if (l->sbit && (info->func[page] & attr->sfunc)) {
@@ -1584,7 +1599,7 @@ static int pmbus_add_sensor_attrs_one(struct i2c_client *client, · 33 unmodified lines
1584	return ret;	1599	return ret;
1585	}	1600	}
1586	base = pmbus_add_sensor(data, name, "input", index, page, phase,	1601	base = pmbus_add_sensor(data, name, "input", index, page, phase,
1587	attr->reg, attr->class, true, true, true);	1602	attr->reg, attr->class, true, true, false, true);
1588	if (!base)	1603	if (!base)
1589	return -ENOMEM;	1604	return -ENOMEM;
1590	/* No limit and alarm attributes for phase specific sensors */	1605	/* No limit and alarm attributes for phase specific sensors */
@@ -1707,23 +1722,29 @@ static const struct pmbus_limit_attr vin_limit_attrs[] = { · 116 unmodified lines
1707	}, {	1722	}, {
1708	.reg = PMBUS_VIRT_READ_VIN_AVG,	1723	.reg = PMBUS_VIRT_READ_VIN_AVG,
1709	.update = true,	1724	.update = true,
		1725	.readonly = true,
1710	.attr = "average",	1726	.attr = "average",
1711	}, {	1727	}, {
1712	.reg = PMBUS_VIRT_READ_VIN_MIN,	1728	.reg = PMBUS_VIRT_READ_VIN_MIN,
1713	.update = true,	1729	.update = true,
		1730	.readonly = true,
1714	.attr = "lowest",	1731	.attr = "lowest",
1715	}, {	1732	}, {
1716	.reg = PMBUS_VIRT_READ_VIN_MAX,	1733	.reg = PMBUS_VIRT_READ_VIN_MAX,
1717	.update = true,	1734	.update = true,
		1735	.readonly = true,
1718	.attr = "highest",	1736	.attr = "highest",
1719	}, {	1737	}, {
1720	.reg = PMBUS_VIRT_RESET_VIN_HISTORY,	1738	.reg = PMBUS_VIRT_RESET_VIN_HISTORY,
		1739	.writeonly = true,
1721	.attr = "reset_history",	1740	.attr = "reset_history",
1722	}, {	1741	}, {
1723	.reg = PMBUS_MFR_VIN_MIN,	1742	.reg = PMBUS_MFR_VIN_MIN,
		1743	.readonly = true,
1724	.attr = "rated_min",	1744	.attr = "rated_min",
1725	}, {	1745	}, {
1726	.reg = PMBUS_MFR_VIN_MAX,	1746	.reg = PMBUS_MFR_VIN_MAX,
		1747	.readonly = true,
1727	.attr = "rated_max",	1748	.attr = "rated_max",
1728	},	1749	},
1729	};	1750	};
@@ -1776,23 +1797,29 @@ static const struct pmbus_limit_attr vout_limit_attrs[] = { · 46 unmodified lines
1776	}, {	1797	}, {
1777	.reg = PMBUS_VIRT_READ_VOUT_AVG,	1798	.reg = PMBUS_VIRT_READ_VOUT_AVG,
1778	.update = true,	1799	.update = true,
		1800	.readonly = true,
1779	.attr = "average",	1801	.attr = "average",
1780	}, {	1802	}, {
1781	.reg = PMBUS_VIRT_READ_VOUT_MIN,	1803	.reg = PMBUS_VIRT_READ_VOUT_MIN,
1782	.update = true,	1804	.update = true,
		1805	.readonly = true,
1783	.attr = "lowest",	1806	.attr = "lowest",
1784	}, {	1807	}, {
1785	.reg = PMBUS_VIRT_READ_VOUT_MAX,	1808	.reg = PMBUS_VIRT_READ_VOUT_MAX,
1786	.update = true,	1809	.update = true,
		1810	.readonly = true,
1787	.attr = "highest",	1811	.attr = "highest",
1788	}, {	1812	}, {
1789	.reg = PMBUS_VIRT_RESET_VOUT_HISTORY,	1813	.reg = PMBUS_VIRT_RESET_VOUT_HISTORY,
		1814	.writeonly = true,
1790	.attr = "reset_history",	1815	.attr = "reset_history",
1791	}, {	1816	}, {
1792	.reg = PMBUS_MFR_VOUT_MIN,	1817	.reg = PMBUS_MFR_VOUT_MIN,
		1818	.readonly = true,
1793	.attr = "rated_min",	1819	.attr = "rated_min",
1794	}, {	1820	}, {
1795	.reg = PMBUS_MFR_VOUT_MAX,	1821	.reg = PMBUS_MFR_VOUT_MAX,
		1822	.readonly = true,
1796	.attr = "rated_max",	1823	.attr = "rated_max",
1797	},	1824	},
1798	};	1825	};
@@ -1852,20 +1879,25 @@ static const struct pmbus_limit_attr iin_limit_attrs[] = { · 53 unmodified lines
1852	}, {	1879	}, {
1853	.reg = PMBUS_VIRT_READ_IIN_AVG,	1880	.reg = PMBUS_VIRT_READ_IIN_AVG,
1854	.update = true,	1881	.update = true,
		1882	.readonly = true,
1855	.attr = "average",	1883	.attr = "average",
1856	}, {	1884	}, {
1857	.reg = PMBUS_VIRT_READ_IIN_MIN,	1885	.reg = PMBUS_VIRT_READ_IIN_MIN,
1858	.update = true,	1886	.update = true,
		1887	.readonly = true,
1859	.attr = "lowest",	1888	.attr = "lowest",
1860	}, {	1889	}, {
1861	.reg = PMBUS_VIRT_READ_IIN_MAX,	1890	.reg = PMBUS_VIRT_READ_IIN_MAX,
1862	.update = true,	1891	.update = true,
		1892	.readonly = true,
1863	.attr = "highest",	1893	.attr = "highest",
1864	}, {	1894	}, {
1865	.reg = PMBUS_VIRT_RESET_IIN_HISTORY,	1895	.reg = PMBUS_VIRT_RESET_IIN_HISTORY,
		1896	.writeonly = true,
1866	.attr = "reset_history",	1897	.attr = "reset_history",
1867	}, {	1898	}, {
1868	.reg = PMBUS_MFR_IIN_MAX,	1899	.reg = PMBUS_MFR_IIN_MAX,
		1900	.readonly = true,
1869	.attr = "rated_max",	1901	.attr = "rated_max",
1870	},	1902	},
1871	};	1903	};
@@ -1889,20 +1921,25 @@ static const struct pmbus_limit_attr iout_limit_attrs[] = { · 17 unmodified lines
1889	}, {	1921	}, {
1890	.reg = PMBUS_VIRT_READ_IOUT_AVG,	1922	.reg = PMBUS_VIRT_READ_IOUT_AVG,
1891	.update = true,	1923	.update = true,
		1924	.readonly = true,
1892	.attr = "average",	1925	.attr = "average",
1893	}, {	1926	}, {
1894	.reg = PMBUS_VIRT_READ_IOUT_MIN,	1927	.reg = PMBUS_VIRT_READ_IOUT_MIN,
1895	.update = true,	1928	.update = true,
		1929	.readonly = true,
1896	.attr = "lowest",	1930	.attr = "lowest",
1897	}, {	1931	}, {
1898	.reg = PMBUS_VIRT_READ_IOUT_MAX,	1932	.reg = PMBUS_VIRT_READ_IOUT_MAX,
1899	.update = true,	1933	.update = true,
		1934	.readonly = true,
1900	.attr = "highest",	1935	.attr = "highest",
1901	}, {	1936	}, {
1902	.reg = PMBUS_VIRT_RESET_IOUT_HISTORY,	1937	.reg = PMBUS_VIRT_RESET_IOUT_HISTORY,
		1938	.writeonly = true,
1903	.attr = "reset_history",	1939	.attr = "reset_history",
1904	}, {	1940	}, {
1905	.reg = PMBUS_MFR_IOUT_MAX,	1941	.reg = PMBUS_MFR_IOUT_MAX,
		1942	.readonly = true,
1906	.attr = "rated_max",	1943	.attr = "rated_max",
1907	},	1944	},
1908	};	1945	};
@@ -1943,20 +1980,25 @@ static const struct pmbus_limit_attr pin_limit_attrs[] = { · 34 unmodified lines
1943	}, {	1980	}, {
1944	.reg = PMBUS_VIRT_READ_PIN_AVG,	1981	.reg = PMBUS_VIRT_READ_PIN_AVG,
1945	.update = true,	1982	.update = true,
		1983	.readonly = true,
1946	.attr = "average",	1984	.attr = "average",
1947	}, {	1985	}, {
1948	.reg = PMBUS_VIRT_READ_PIN_MIN,	1986	.reg = PMBUS_VIRT_READ_PIN_MIN,
1949	.update = true,	1987	.update = true,
		1988	.readonly = true,
1950	.attr = "input_lowest",	1989	.attr = "input_lowest",
1951	}, {	1990	}, {
1952	.reg = PMBUS_VIRT_READ_PIN_MAX,	1991	.reg = PMBUS_VIRT_READ_PIN_MAX,
1953	.update = true,	1992	.update = true,
		1993	.readonly = true,
1954	.attr = "input_highest",	1994	.attr = "input_highest",
1955	}, {	1995	}, {
1956	.reg = PMBUS_VIRT_RESET_PIN_HISTORY,	1996	.reg = PMBUS_VIRT_RESET_PIN_HISTORY,
		1997	.writeonly = true,
1957	.attr = "reset_history",	1998	.attr = "reset_history",
1958	}, {	1999	}, {
1959	.reg = PMBUS_MFR_PIN_MAX,	2000	.reg = PMBUS_MFR_PIN_MAX,
		2001	.readonly = true,
1960	.attr = "rated_max",	2002	.attr = "rated_max",
1961	},	2003	},
1962	};	2004	};
@@ -1980,20 +2022,25 @@ static const struct pmbus_limit_attr pout_limit_attrs[] = { · 17 unmodified lines
1980	}, {	2022	}, {
1981	.reg = PMBUS_VIRT_READ_POUT_AVG,	2023	.reg = PMBUS_VIRT_READ_POUT_AVG,
1982	.update = true,	2024	.update = true,
		2025	.readonly = true,
1983	.attr = "average",	2026	.attr = "average",
1984	}, {	2027	}, {
1985	.reg = PMBUS_VIRT_READ_POUT_MIN,	2028	.reg = PMBUS_VIRT_READ_POUT_MIN,
1986	.update = true,	2029	.update = true,
		2030	.readonly = true,
1987	.attr = "input_lowest",	2031	.attr = "input_lowest",
1988	}, {	2032	}, {
1989	.reg = PMBUS_VIRT_READ_POUT_MAX,	2033	.reg = PMBUS_VIRT_READ_POUT_MAX,
1990	.update = true,	2034	.update = true,
		2035	.readonly = true,
1991	.attr = "input_highest",	2036	.attr = "input_highest",
1992	}, {	2037	}, {
1993	.reg = PMBUS_VIRT_RESET_POUT_HISTORY,	2038	.reg = PMBUS_VIRT_RESET_POUT_HISTORY,
		2039	.writeonly = true,
1994	.attr = "reset_history",	2040	.attr = "reset_history",
1995	}, {	2041	}, {
1996	.reg = PMBUS_MFR_POUT_MAX,	2042	.reg = PMBUS_MFR_POUT_MAX,
		2043	.readonly = true,
1997	.attr = "rated_max",	2044	.attr = "rated_max",
1998	},	2045	},
1999	};	2046	};
@@ -2049,18 +2096,23 @@ static const struct pmbus_limit_attr temp_limit_attrs[] = { · 49 unmodified lines
2049	.sbit = PB_TEMP_OT_FAULT,	2096	.sbit = PB_TEMP_OT_FAULT,
2050	}, {	2097	}, {
2051	.reg = PMBUS_VIRT_READ_TEMP_MIN,	2098	.reg = PMBUS_VIRT_READ_TEMP_MIN,
		2099	.readonly = true,
2052	.attr = "lowest",	2100	.attr = "lowest",
2053	}, {	2101	}, {
2054	.reg = PMBUS_VIRT_READ_TEMP_AVG,	2102	.reg = PMBUS_VIRT_READ_TEMP_AVG,
		2103	.readonly = true,
2055	.attr = "average",	2104	.attr = "average",
2056	}, {	2105	}, {
2057	.reg = PMBUS_VIRT_READ_TEMP_MAX,	2106	.reg = PMBUS_VIRT_READ_TEMP_MAX,
		2107	.readonly = true,
2058	.attr = "highest",	2108	.attr = "highest",
2059	}, {	2109	}, {
2060	.reg = PMBUS_VIRT_RESET_TEMP_HISTORY,	2110	.reg = PMBUS_VIRT_RESET_TEMP_HISTORY,
		2111	.writeonly = true,
2061	.attr = "reset_history",	2112	.attr = "reset_history",
2062	}, {	2113	}, {
2063	.reg = PMBUS_MFR_MAX_TEMP_1,	2114	.reg = PMBUS_MFR_MAX_TEMP_1,
		2115	.readonly = true,
2064	.attr = "rated_max",	2116	.attr = "rated_max",
2065	},	2117	},
2066	};	2118	};
@@ -2090,18 +2142,23 @@ static const struct pmbus_limit_attr temp_limit_attrs2[] = { · 23 unmodified lines
2090	.sbit = PB_TEMP_OT_FAULT,	2142	.sbit = PB_TEMP_OT_FAULT,
2091	}, {	2143	}, {
2092	.reg = PMBUS_VIRT_READ_TEMP2_MIN,	2144	.reg = PMBUS_VIRT_READ_TEMP2_MIN,
		2145	.readonly = true,
2093	.attr = "lowest",	2146	.attr = "lowest",
2094	}, {	2147	}, {
2095	.reg = PMBUS_VIRT_READ_TEMP2_AVG,	2148	.reg = PMBUS_VIRT_READ_TEMP2_AVG,
		2149	.readonly = true,
2096	.attr = "average",	2150	.attr = "average",
2097	}, {	2151	}, {
2098	.reg = PMBUS_VIRT_READ_TEMP2_MAX,	2152	.reg = PMBUS_VIRT_READ_TEMP2_MAX,
		2153	.readonly = true,
2099	.attr = "highest",	2154	.attr = "highest",
2100	}, {	2155	}, {
2101	.reg = PMBUS_VIRT_RESET_TEMP2_HISTORY,	2156	.reg = PMBUS_VIRT_RESET_TEMP2_HISTORY,
		2157	.writeonly = true,
2102	.attr = "reset_history",	2158	.attr = "reset_history",
2103	}, {	2159	}, {
2104	.reg = PMBUS_MFR_MAX_TEMP_2,	2160	.reg = PMBUS_MFR_MAX_TEMP_2,
		2161	.readonly = true,
2105	.attr = "rated_max",	2162	.attr = "rated_max",
2106	},	2163	},
2107	};	2164	};
@@ -2131,6 +2188,7 @@ static const struct pmbus_limit_attr temp_limit_attrs3[] = { · 23 unmodified lines
2131	.sbit = PB_TEMP_OT_FAULT,	2188	.sbit = PB_TEMP_OT_FAULT,
2132	}, {	2189	}, {
2133	.reg = PMBUS_MFR_MAX_TEMP_3,	2190	.reg = PMBUS_MFR_MAX_TEMP_3,
		2191	.readonly = true,
2134	.attr = "rated_max",	2192	.attr = "rated_max",
2135	},	2193	},
2136	};	2194	};
@@ -2214,7 +2272,7 @@ static int pmbus_add_fan_ctrl(struct i2c_client *client, · 77 unmodified lines
2214		2272
2215	sensor = pmbus_add_sensor(data, "fan", "target", index, page,	2273	sensor = pmbus_add_sensor(data, "fan", "target", index, page,
2216	0xff, PMBUS_VIRT_FAN_TARGET_1 + id, PSC_FAN,	2274	0xff, PMBUS_VIRT_FAN_TARGET_1 + id, PSC_FAN,
2217	false, false, true);	2275	false, false, false, true);
2218		2276
2219	if (!sensor)	2277	if (!sensor)
2220	return -ENOMEM;	2278	return -ENOMEM;
@@ -2225,14 +2283,14 @@ static int pmbus_add_fan_ctrl(struct i2c_client *client, · 4 unmodified lines
2225		2283
2226	sensor = pmbus_add_sensor(data, "pwm", NULL, index, page,	2284	sensor = pmbus_add_sensor(data, "pwm", NULL, index, page,
2227	0xff, PMBUS_VIRT_PWM_1 + id, PSC_PWM,	2285	0xff, PMBUS_VIRT_PWM_1 + id, PSC_PWM,
2228	false, false, true);	2286	false, false, false, true);
2229		2287
2230	if (!sensor)	2288	if (!sensor)
2231	return -ENOMEM;	2289	return -ENOMEM;
2232		2290
2233	sensor = pmbus_add_sensor(data, "pwm", "enable", index, page,	2291	sensor = pmbus_add_sensor(data, "pwm", "enable", index, page,
2234	0xff, PMBUS_VIRT_PWM_ENABLE_1 + id, PSC_PWM,	2292	0xff, PMBUS_VIRT_PWM_ENABLE_1 + id, PSC_PWM,
2235	true, false, false);	2293	true, false, false, false);
2236		2294
2237	if (!sensor)	2295	if (!sensor)
2238	return -ENOMEM;	2296	return -ENOMEM;
@@ -2274,7 +2332,7 @@ static int pmbus_add_fan_attributes(struct i2c_client *client, · 35 unmodified lines
2274		2332
2275	if (pmbus_add_sensor(data, "fan", "input", index,	2333	if (pmbus_add_sensor(data, "fan", "input", index,
2276	page, 0xff, pmbus_fan_registers[f],	2334	page, 0xff, pmbus_fan_registers[f],
2277	PSC_FAN, true, true, true) == NULL)	2335	PSC_FAN, true, true, false, true) == NULL)
2278	return -ENOMEM;	2336	return -ENOMEM;
2279		2337
2280	/* Fan control */	2338	/* Fan control */
@@ -3176,12 +3234,19 @@ static int pmbus_regulator_get_voltage(struct regulator_dev *rdev) · 895 unmodified lines
3176	.class = PSC_VOLTAGE_OUT,	3234	.class = PSC_VOLTAGE_OUT,
3177	.convert = true,	3235	.convert = true,
3178	};	3236	};
		3237	int ret;
3179		3238
		3239	mutex_lock(&data->update_lock);
3180	s.data = _pmbus_read_word_data(client, s.page, 0xff, PMBUS_READ_VOUT);	3240	s.data = _pmbus_read_word_data(client, s.page, 0xff, PMBUS_READ_VOUT);
3181	if (s.data < 0)	3241	if (s.data < 0) {
3182	return s.data;	3242	ret = s.data;
		3243	goto unlock;
		3244	}
3183		3245
3184	return (int)pmbus_reg2data(data, &s) * 1000; /* unit is uV */	3246	ret = (int)pmbus_reg2data(data, &s) * 1000; /* unit is uV */
		3247	unlock:
		3248	mutex_unlock(&data->update_lock);
		3249	return ret;
3185	}	3250	}
3186		3251
3187	static int pmbus_regulator_set_voltage(struct regulator_dev *rdev, int min_uv,	3252	static int pmbus_regulator_set_voltage(struct regulator_dev *rdev, int min_uv,
@@ -3198,16 +3263,22 @@ static int pmbus_regulator_set_voltage(struct regulator_dev *rdev, int min_uv, · 10 unmodified lines
3198	};	3263	};
3199	int val = DIV_ROUND_CLOSEST(min_uv, 1000); /* convert to mV */	3264	int val = DIV_ROUND_CLOSEST(min_uv, 1000); /* convert to mV */
3200	int low, high;	3265	int low, high;
		3266	int ret;
3201		3267
3202	*selector = 0;	3268	*selector = 0;
3203		3269
		3270	mutex_lock(&data->update_lock);
3204	low = pmbus_regulator_get_low_margin(client, s.page);	3271	low = pmbus_regulator_get_low_margin(client, s.page);
3205	if (low < 0)	3272	if (low < 0) {
3206	return low;	3273	ret = low;
		3274	goto unlock;
		3275	}
3207		3276
3208	high = pmbus_regulator_get_high_margin(client, s.page);	3277	high = pmbus_regulator_get_high_margin(client, s.page);
3209	if (high < 0)	3278	if (high < 0) {
3210	return high;	3279	ret = high;
		3280	goto unlock;
		3281	}
3211		3282
3212	/* Make sure we are within margins */	3283	/* Make sure we are within margins */
3213	if (low > val)	3284	if (low > val)
@@ -3217,7 +3288,10 @@ static int pmbus_regulator_set_voltage(struct regulator_dev *rdev, int min_uv, · 3 unmodified lines
3217		3288
3218	val = pmbus_data2reg(data, &s, val);	3289	val = pmbus_data2reg(data, &s, val);
3219		3290
3220	return _pmbus_write_word_data(client, s.page, PMBUS_VOUT_COMMAND, (u16)val);	3291	ret = _pmbus_write_word_data(client, s.page, PMBUS_VOUT_COMMAND, (u16)val);
		3292	unlock:
		3293	mutex_unlock(&data->update_lock);
		3294	return ret;
3221	}	3295	}
3222		3296
3223	static int pmbus_regulator_list_voltage(struct regulator_dev *rdev,	3297	static int pmbus_regulator_list_voltage(struct regulator_dev *rdev,
@@ -3227,6 +3301,7 @@ static int pmbus_regulator_list_voltage(struct regulator_dev *rdev, · 3 unmodified lines
3227	struct i2c_client *client = to_i2c_client(dev->parent);	3301	struct i2c_client *client = to_i2c_client(dev->parent);
3228	struct pmbus_data *data = i2c_get_clientdata(client);	3302	struct pmbus_data *data = i2c_get_clientdata(client);
3229	int val, low, high;	3303	int val, low, high;
		3304	int ret;
3230		3305
3231	if (data->flags & PMBUS_VOUT_PROTECTED)	3306	if (data->flags & PMBUS_VOUT_PROTECTED)
3232	return 0;	3307	return 0;
@@ -3239,18 +3314,29 @@ static int pmbus_regulator_list_voltage(struct regulator_dev *rdev, · 6 unmodified lines
3239	val = DIV_ROUND_CLOSEST(rdev->desc->min_uV +	3314	val = DIV_ROUND_CLOSEST(rdev->desc->min_uV +
3240	(rdev->desc->uV_step * selector), 1000); /* convert to mV */	3315	(rdev->desc->uV_step * selector), 1000); /* convert to mV */
3241		3316
		3317	mutex_lock(&data->update_lock);
		3318
3242	low = pmbus_regulator_get_low_margin(client, rdev_get_id(rdev));	3319	low = pmbus_regulator_get_low_margin(client, rdev_get_id(rdev));
3243	if (low < 0)	3320	if (low < 0) {
3244	return low;	3321	ret = low;
		3322	goto unlock;
		3323	}
3245		3324
3246	high = pmbus_regulator_get_high_margin(client, rdev_get_id(rdev));	3325	high = pmbus_regulator_get_high_margin(client, rdev_get_id(rdev));
3247	if (high < 0)	3326	if (high < 0) {
3248	return high;	3327	ret = high;
		3328	goto unlock;
		3329	}
3249		3330
3250	if (val >= low && val <= high)	3331	if (val >= low && val <= high) {
3251	return val * 1000; /* unit is uV */	3332	ret = val * 1000; /* unit is uV */
		3333	goto unlock;
		3334	}
3252		3335
3253	return 0;	3336	ret = 0;
		3337	unlock:
		3338	mutex_unlock(&data->update_lock);
		3339	return ret;
3254	}	3340	}
3255		3341
3256	const struct regulator_ops pmbus_regulator_ops = {	3342	const struct regulator_ops pmbus_regulator_ops = {
@@ -3281,12 +3367,42 @@ int pmbus_regulator_init_cb(struct regulator_dev *rdev, · 24 unmodified lines
3281	}	3367	}
3282	EXPORT_SYMBOL_NS_GPL(pmbus_regulator_init_cb, "PMBUS");	3368	EXPORT_SYMBOL_NS_GPL(pmbus_regulator_init_cb, "PMBUS");
3283		3369
		3370	static void pmbus_regulator_notify_work_cancel(void *data)
		3371	{
		3372	struct pmbus_data *pdata = data;
		3373
		3374	cancel_work_sync(&pdata->regulator_notify_work);
		3375	}
		3376
		3377	static void pmbus_regulator_notify_worker(struct work_struct *work)
		3378	{
		3379	struct pmbus_data *data =
		3380	container_of(work, struct pmbus_data, regulator_notify_work);
		3381	int i, j;
		3382
		3383	for (i = 0; i < data->info->pages; i++) {
		3384	int event;
		3385
		3386	event = atomic_xchg(&data->regulator_events[i], 0);
		3387	if (!event)
		3388	continue;
		3389
		3390	for (j = 0; j < data->info->num_regulators; j++) {
		3391	if (i == rdev_get_id(data->rdevs[j])) {
		3392	regulator_notifier_call_chain(data->rdevs[j],
		3393	event, NULL);
		3394	break;
		3395	}
		3396	}
		3397	}
		3398	}
		3399
3284	static int pmbus_regulator_register(struct pmbus_data *data)	3400	static int pmbus_regulator_register(struct pmbus_data *data)
3285	{	3401	{
3286	struct device *dev = data->dev;	3402	struct device *dev = data->dev;
3287	const struct pmbus_driver_info *info = data->info;	3403	const struct pmbus_driver_info *info = data->info;
3288	const struct pmbus_platform_data *pdata = dev_get_platdata(dev);	3404	const struct pmbus_platform_data *pdata = dev_get_platdata(dev);
3289	int i;	3405	int i, ret;
3290		3406
3291	data->rdevs = devm_kzalloc(dev, sizeof(struct regulator_dev ) info->num_regulators,	3407	data->rdevs = devm_kzalloc(dev, sizeof(struct regulator_dev ) info->num_regulators,
3292	GFP_KERNEL);	3408	GFP_KERNEL);
@@ -3310,19 +3426,19 @@ static int pmbus_regulator_register(struct pmbus_data *data) · 17 unmodified lines
3310	info->reg_desc[i].name);	3426	info->reg_desc[i].name);
3311	}	3427	}
3312		3428
		3429	INIT_WORK(&data->regulator_notify_work, pmbus_regulator_notify_worker);
		3430
		3431	ret = devm_add_action_or_reset(dev, pmbus_regulator_notify_work_cancel, data);
		3432	if (ret)
		3433	return ret;
		3434
3313	return 0;	3435	return 0;
3314	}	3436	}
3315		3437
3316	static void pmbus_regulator_notify(struct pmbus_data *data, int page, int event)	3438	static void pmbus_regulator_notify(struct pmbus_data *data, int page, int event)
3317	{	3439	{
3318	int j;	3440	atomic_or(event, &data->regulator_events[page]);
3319		3441	schedule_work(&data->regulator_notify_work);
3320	for (j = 0; j < data->info->num_regulators; j++) {
3321	if (page == rdev_get_id(data->rdevs[j])) {
3322	regulator_notifier_call_chain(data->rdevs[j], event, NULL);
3323	break;
3324	}
3325	}
3326	}	3442	}
3327	#else	3443	#else
3328	static int pmbus_regulator_register(struct pmbus_data *data)	3444	static int pmbus_regulator_register(struct pmbus_data *data)

drivers/i2c/busses/i2c-designware-amdisp.c+5−6

@@ -7,6 +7,7 @@ · 6 unmodified lines
7		7
8	#include <linux/module.h>	8	#include <linux/module.h>
9	#include <linux/platform_device.h>	9	#include <linux/platform_device.h>
		10	#include <linux/pm_domain.h>
10	#include <linux/pm_runtime.h>	11	#include <linux/pm_runtime.h>
11	#include <linux/soc/amd/isp4_misc.h>	12	#include <linux/soc/amd/isp4_misc.h>
12		13
@@ -76,22 +77,20 @@ static int amd_isp_dw_i2c_plat_probe(struct platform_device *pdev) · 63 unmodified lines
76		77
77	device_enable_async_suspend(&pdev->dev);	78	device_enable_async_suspend(&pdev->dev);
78		79
79	pm_runtime_enable(&pdev->dev);	80	dev_pm_genpd_resume(&pdev->dev);
80	pm_runtime_get_sync(&pdev->dev);
81
82	ret = i2c_dw_probe(isp_i2c_dev);	81	ret = i2c_dw_probe(isp_i2c_dev);
83	if (ret) {	82	if (ret) {
84	dev_err_probe(&pdev->dev, ret, "i2c_dw_probe failed\n");	83	dev_err_probe(&pdev->dev, ret, "i2c_dw_probe failed\n");
85	goto error_release_rpm;	84	goto error_release_rpm;
86	}	85	}
87		86	dev_pm_genpd_suspend(&pdev->dev);
88	pm_runtime_put_sync(&pdev->dev);	87	pm_runtime_set_suspended(&pdev->dev);
		88	pm_runtime_enable(&pdev->dev);
89		89
90	return 0;	90	return 0;
91		91
92	error_release_rpm:	92	error_release_rpm:
93	amd_isp_dw_i2c_plat_pm_cleanup(isp_i2c_dev);	93	amd_isp_dw_i2c_plat_pm_cleanup(isp_i2c_dev);
94	pm_runtime_put_sync(&pdev->dev);
95	return ret;	94	return ret;
96	}	95	}
97		96

drivers/i2c/busses/i2c-imx.c+32−19

@@ -1018,8 +1018,9 @@ static inline int i2c_imx_isr_read(struct imx_i2c_struct *i2c_imx) · 1017 unmodified lines
1018	return 0;	1018	return 0;
1019	}	1019	}
1020		1020
1021	static inline void i2c_imx_isr_read_continue(struct imx_i2c_struct *i2c_imx)	1021	static inline enum imx_i2c_state i2c_imx_isr_read_continue(struct imx_i2c_struct *i2c_imx)
1022	{	1022	{
		1023	enum imx_i2c_state next_state = IMX_I2C_STATE_READ_CONTINUE;
1023	unsigned int temp;	1024	unsigned int temp;
1024		1025
1025	if ((i2c_imx->msg->len - 1) == i2c_imx->msg_buf_idx) {	1026	if ((i2c_imx->msg->len - 1) == i2c_imx->msg_buf_idx) {
@@ -1033,18 +1034,20 @@ static inline void i2c_imx_isr_read_continue(struct imx_i2c_struct *i2c_imx) · 7 unmodified lines
1033	i2c_imx->stopped = 1;	1034	i2c_imx->stopped = 1;
1034	temp &= ~(I2CR_MSTA \| I2CR_MTX);	1035	temp &= ~(I2CR_MSTA \| I2CR_MTX);
1035	imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR);	1036	imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR);
1036	} else {	1037
1037	/*	1038	return IMX_I2C_STATE_DONE;
1038	* For i2c master receiver repeat restart operation like:
1039	* read -> repeat MSTA -> read/write
1040	* The controller must set MTX before read the last byte in
1041	* the first read operation, otherwise the first read cost
1042	* one extra clock cycle.
1043	*/
1044	temp = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR);
1045	temp \|= I2CR_MTX;
1046	imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR);
1047	}	1039	}
		1040	/*
		1041	* For i2c master receiver repeat restart operation like:
		1042	* read -> repeat MSTA -> read/write
		1043	* The controller must set MTX before read the last byte in
		1044	* the first read operation, otherwise the first read cost
		1045	* one extra clock cycle.
		1046	*/
		1047	temp = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR);
		1048	temp \|= I2CR_MTX;
		1049	imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR);
		1050	next_state = IMX_I2C_STATE_DONE;
1048	} else if (i2c_imx->msg_buf_idx == (i2c_imx->msg->len - 2)) {	1051	} else if (i2c_imx->msg_buf_idx == (i2c_imx->msg->len - 2)) {
1049	temp = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR);	1052	temp = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR);
1050	temp \|= I2CR_TXAK;	1053	temp \|= I2CR_TXAK;
@@ -1052,6 +1055,7 @@ static inline void i2c_imx_isr_read_continue(struct imx_i2c_struct *i2c_imx) · 1 unmodified line
1052	}	1055	}
1053		1056
1054	i2c_imx->msg->buf[i2c_imx->msg_buf_idx++] = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR);	1057	i2c_imx->msg->buf[i2c_imx->msg_buf_idx++] = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2DR);
		1058	return next_state;
1055	}	1059	}
1056		1060
1057	static inline void i2c_imx_isr_read_block_data_len(struct imx_i2c_struct *i2c_imx)	1061	static inline void i2c_imx_isr_read_block_data_len(struct imx_i2c_struct *i2c_imx)
@@ -1088,11 +1092,9 @@ static irqreturn_t i2c_imx_master_isr(struct imx_i2c_struct *i2c_imx, unsigned i · 30 unmodified lines
1088	break;	1092	break;
1089		1093
1090	case IMX_I2C_STATE_READ_CONTINUE:	1094	case IMX_I2C_STATE_READ_CONTINUE:
1091	i2c_imx_isr_read_continue(i2c_imx);	1095	i2c_imx->state = i2c_imx_isr_read_continue(i2c_imx);
1092	if (i2c_imx->msg_buf_idx == i2c_imx->msg->len) {	1096	if (i2c_imx->state == IMX_I2C_STATE_DONE)
1093	i2c_imx->state = IMX_I2C_STATE_DONE;
1094	wake_up(&i2c_imx->queue);	1097	wake_up(&i2c_imx->queue);
1095	}
1096	break;	1098	break;
1097		1099
1098	case IMX_I2C_STATE_READ_BLOCK_DATA:	1100	case IMX_I2C_STATE_READ_BLOCK_DATA:
@@ -1490,6 +1492,7 @@ static int i2c_imx_read(struct imx_i2c_struct i2c_imx, struct i2c_msg msgs, · 391 unmodified lines
1490	bool is_lastmsg)	1492	bool is_lastmsg)
1491	{	1493	{
1492	int block_data = msgs->flags & I2C_M_RECV_LEN;	1494	int block_data = msgs->flags & I2C_M_RECV_LEN;
		1495	int ret = 0;
1493		1496
1494	dev_dbg(&i2c_imx->adapter.dev,	1497	dev_dbg(&i2c_imx->adapter.dev,
1495	"<%s> write slave address: addr=0x%x\n",	1498	"<%s> write slave address: addr=0x%x\n",
@@ -1522,10 +1525,20 @@ static int i2c_imx_read(struct imx_i2c_struct i2c_imx, struct i2c_msg msgs, · 26 unmodified lines
1522	dev_err(&i2c_imx->adapter.dev, "<%s> read timedout\n", __func__);	1525	dev_err(&i2c_imx->adapter.dev, "<%s> read timedout\n", __func__);
1523	return -ETIMEDOUT;	1526	return -ETIMEDOUT;
1524	}	1527	}
1525	if (!i2c_imx->stopped)	1528	if (i2c_imx->is_lastmsg) {
1526	return i2c_imx_bus_busy(i2c_imx, 0, false);	1529	if (!i2c_imx->stopped)
		1530	ret = i2c_imx_bus_busy(i2c_imx, 0, false);
		1531	/*
		1532	* Only read the last byte of the last message after the bus is
		1533	* not busy. Else the controller generates another clock which
		1534	* might confuse devices.
		1535	*/
		1536	if (!ret)
		1537	i2c_imx->msg->buf[i2c_imx->msg_buf_idx++] = imx_i2c_read_reg(i2c_imx,
		1538	IMX_I2C_I2DR);
		1539	}
1527		1540
1528	return 0;	1541	return ret;
1529	}	1542	}
1530		1543
1531	static int i2c_imx_xfer_common(struct i2c_adapter *adapter,	1544	static int i2c_imx_xfer_common(struct i2c_adapter *adapter,

drivers/infiniband/core/rw.c+27−10

 	if (rdma_rw_io_needs_mr(qp->device, port_num, dir, sg_cnt)) {
 		ret = rdma_rw_init_mr_wrs(ctx, qp, port_num, sg, sg_cnt,
 				sg_offset, remote_addr, rkey, dir);
-	} else if (sg_cnt > 1) {
+		/*
+		 * If MR init succeeded or failed for a reason other
+		 * than pool exhaustion, that result is final.
+		 *
+		 * Pool exhaustion (-EAGAIN) from the max_sgl_rd
+		 * optimization is recoverable: fall back to
+		 * direct SGE posting. iWARP and force_mr require
+		 * MRs unconditionally, so -EAGAIN is terminal.
+		 */
+		if (ret != -EAGAIN ||
+		    rdma_protocol_iwarp(qp->device, port_num) ||
+		    unlikely(rdma_rw_force_mr))
+			goto out;
+	}
+	if (sg_cnt > 1)
 		ret = rdma_rw_init_map_wrs(ctx, qp, sg, sg_cnt, sg_offset,
 				remote_addr, rkey, dir);
-	} else {
+	else
 		ret = rdma_rw_init_single_wr(ctx, qp, sg, sg_offset,
 				remote_addr, rkey, dir);
-	}
+out:
 	if (ret < 0)
 		goto out_unmap_sg;
 	return ret;
 		return ret;
 	/*
-	 * IOVA mapping not available. Check if MR registration provides
+	 * IOVA not available; fall back to the map_wrs path, which maps
-	 * better performance than multiple SGE entries.
+	 * each bvec as a direct SGE. This is always correct: the MR path
+	 * is a throughput optimization, not a correctness requirement.
+	 * (iWARP, which does require MRs, is handled by the check above.)
+	 *
+	 * The rdma_rw_io_needs_mr() gate is not used here because nr_bvec
+	 * is a raw page count that overstates DMA entry demand -- the bvec
+	 * caller has no post-DMA-coalescing segment count, and feeding the
+	 * inflated count into the MR path exhausts the pool on RDMA READs.
 	 */
-	if (rdma_rw_io_needs_mr(dev, port_num, dir, nr_bvec))
-		return rdma_rw_init_mr_wrs_bvec(ctx, qp, port_num, bvecs,
-						nr_bvec, &iter, remote_addr,
-						rkey, dir);
 	return rdma_rw_init_map_wrs_bvec(ctx, qp, bvecs, nr_bvec, &iter,
 			remote_addr, rkey, dir);
 }

drivers/infiniband/core/umem.c+3−2

 	if (dirty)
 		ib_dma_unmap_sgtable_attrs(dev, &umem->sgt_append.sgt,
-					   DMA_BIDIRECTIONAL, 0);
+					   DMA_BIDIRECTIONAL,
+					   DMA_ATTR_REQUIRE_COHERENT);
 	for_each_sgtable_sg(&umem->sgt_append.sgt, sg, i) {
 		unpin_user_page_range_dirty_lock(sg_page(sg),
 	unsigned long lock_limit;
 	unsigned long new_pinned;
 	unsigned long cur_base;
-	unsigned long dma_attr = 0;
+	unsigned long dma_attr = DMA_ATTR_REQUIRE_COHERENT;
 	struct mm_struct *mm;
 	unsigned long npages;
 	int pinned, ret;

drivers/infiniband/hw/bng_re/bng_dev.c+9−5

 	return rc;
 }
-static void bng_re_query_hwrm_version(struct bng_re_dev *rdev)
+static int bng_re_query_hwrm_version(struct bng_re_dev *rdev)
 {
 	struct bnge_auxr_dev *aux_dev = rdev->aux_dev;
 	struct hwrm_ver_get_output ver_get_resp = {};
 	if (rc) {
 		ibdev_err(&rdev->ibdev, "Failed to query HW version, rc = 0x%x",
 			  rc);
-		return;
+		return rc;
 	}
 	cctx = rdev->chip_ctx;
 	if (!cctx->hwrm_cmd_max_timeout)
 		cctx->hwrm_cmd_max_timeout = BNG_ROCE_FW_MAX_TIMEOUT;
+	return 0;
 }
 static void bng_re_dev_uninit(struct bng_re_dev *rdev)
 		goto msix_ctx_fail;
 	}
-	bng_re_query_hwrm_version(rdev);
+	rc = bng_re_query_hwrm_version(rdev);
+	if (rc)
+		goto destroy_chip_ctx;
 	rc = bng_re_alloc_fw_channel(&rdev->bng_res, &rdev->rcfw);
 	if (rc) {
 		ibdev_err(&rdev->ibdev,
 			  "Failed to allocate RCFW Channel: %#x\n", rc);
-		goto alloc_fw_chl_fail;
+		goto destroy_chip_ctx;
 	}
 	/* Allocate nq record memory */
 	kfree(rdev->nqr);
 nq_alloc_fail:
 	bng_re_free_rcfw_channel(&rdev->rcfw);
-alloc_fw_chl_fail:
+destroy_chip_ctx:
 	bng_re_destroy_chip_ctx(rdev);
 msix_ctx_fail:
 	bnge_unregister_dev(rdev->aux_dev);

drivers/infiniband/hw/efa/efa_com.c+40−48

@@ -1,6 +1,6 @@
1	// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause	1	// SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause
2	/*	2	/*
3	* Copyright 2018-2025 Amazon.com, Inc. or its affiliates. All rights reserved.	3	* Copyright 2018-2026 Amazon.com, Inc. or its affiliates. All rights reserved.
4	*/	4	*/
5		5
6	#include <linux/log2.h>	6	#include <linux/log2.h>
@@ -310,23 +310,19 @@ static inline struct efa_comp_ctx *efa_com_get_comp_ctx_by_cmd_id(struct efa_com · 303 unmodified lines
310	return &aq->comp_ctx[ctx_id];	310	return &aq->comp_ctx[ctx_id];
311	}	311	}
312		312
313	static struct efa_comp_ctx __efa_com_submit_admin_cmd(struct efa_com_admin_queue aq,	313	static void __efa_com_submit_admin_cmd(struct efa_com_admin_queue *aq,
314	struct efa_admin_aq_entry *cmd,	314	struct efa_comp_ctx *comp_ctx,
315	size_t cmd_size_in_bytes,	315	struct efa_admin_aq_entry *cmd,
316	struct efa_admin_acq_entry *comp,	316	size_t cmd_size_in_bytes,
317	size_t comp_size_in_bytes)	317	struct efa_admin_acq_entry *comp,
		318	size_t comp_size_in_bytes)
318	{	319	{
319	struct efa_admin_aq_entry *aqe;	320	struct efa_admin_aq_entry *aqe;
320	struct efa_comp_ctx *comp_ctx;
321	u16 queue_size_mask;	321	u16 queue_size_mask;
322	u16 cmd_id;	322	u16 cmd_id;
323	u16 ctx_id;	323	u16 ctx_id;
324	u16 pi;	324	u16 pi;
325		325
326	comp_ctx = efa_com_alloc_comp_ctx(aq);
327	if (!comp_ctx)
328	return ERR_PTR(-EINVAL);
329
330	queue_size_mask = aq->depth - 1;	326	queue_size_mask = aq->depth - 1;
331	pi = aq->sq.pc & queue_size_mask;	327	pi = aq->sq.pc & queue_size_mask;
332	ctx_id = efa_com_get_comp_ctx_id(aq, comp_ctx);	328	ctx_id = efa_com_get_comp_ctx_id(aq, comp_ctx);
@@ -360,8 +356,6 @@ static struct efa_comp_ctx *__efa_com_submit_admin_cmd(struct efa_com_admin_queu · 27 unmodified lines
360		356
361	/* barrier not needed in case of writel */	357	/* barrier not needed in case of writel */
362	writel(aq->sq.pc, aq->sq.db_addr);	358	writel(aq->sq.pc, aq->sq.db_addr);
363
364	return comp_ctx;
365	}	359	}
366		360
367	static inline int efa_com_init_comp_ctxt(struct efa_com_admin_queue *aq)	361	static inline int efa_com_init_comp_ctxt(struct efa_com_admin_queue *aq)
@@ -394,28 +388,25 @@ static inline int efa_com_init_comp_ctxt(struct efa_com_admin_queue *aq) · 26 unmodified lines
394	return 0;	388	return 0;
395	}	389	}
396		390
397	static struct efa_comp_ctx efa_com_submit_admin_cmd(struct efa_com_admin_queue aq,	391	static int efa_com_submit_admin_cmd(struct efa_com_admin_queue *aq,
398	struct efa_admin_aq_entry *cmd,	392	struct efa_comp_ctx *comp_ctx,
399	size_t cmd_size_in_bytes,	393	struct efa_admin_aq_entry *cmd,
400	struct efa_admin_acq_entry *comp,	394	size_t cmd_size_in_bytes,
401	size_t comp_size_in_bytes)	395	struct efa_admin_acq_entry *comp,
		396	size_t comp_size_in_bytes)
402	{	397	{
403	struct efa_comp_ctx *comp_ctx;
404
405	spin_lock(&aq->sq.lock);	398	spin_lock(&aq->sq.lock);
406	if (!test_bit(EFA_AQ_STATE_RUNNING_BIT, &aq->state)) {	399	if (!test_bit(EFA_AQ_STATE_RUNNING_BIT, &aq->state)) {
407	ibdev_err_ratelimited(aq->efa_dev, "Admin queue is closed\n");	400	ibdev_err_ratelimited(aq->efa_dev, "Admin queue is closed\n");
408	spin_unlock(&aq->sq.lock);	401	spin_unlock(&aq->sq.lock);
409	return ERR_PTR(-ENODEV);	402	return -ENODEV;
410	}	403	}
411		404
412	comp_ctx = __efa_com_submit_admin_cmd(aq, cmd, cmd_size_in_bytes, comp,	405	__efa_com_submit_admin_cmd(aq, comp_ctx, cmd, cmd_size_in_bytes, comp,
413	comp_size_in_bytes);	406	comp_size_in_bytes);
414	spin_unlock(&aq->sq.lock);	407	spin_unlock(&aq->sq.lock);
415	if (IS_ERR(comp_ctx))
416	clear_bit(EFA_AQ_STATE_RUNNING_BIT, &aq->state);
417		408
418	return comp_ctx;	409	return 0;
419	}	410	}
420		411
421	static int efa_com_handle_single_admin_completion(struct efa_com_admin_queue *aq,	412	static int efa_com_handle_single_admin_completion(struct efa_com_admin_queue *aq,
@@ -512,7 +503,6 @@ static int efa_com_wait_and_process_admin_cq_polling(struct efa_comp_ctx *comp_c · 90 unmodified lines
512	{	503	{
513	unsigned long timeout;	504	unsigned long timeout;
514	unsigned long flags;	505	unsigned long flags;
515	int err;
516		506
517	timeout = jiffies + usecs_to_jiffies(aq->completion_timeout);	507	timeout = jiffies + usecs_to_jiffies(aq->completion_timeout);
518		508
@@ -532,24 +522,20 @@ static int efa_com_wait_and_process_admin_cq_polling(struct efa_comp_ctx *comp_c · 13 unmodified lines
532	atomic64_inc(&aq->stats.no_completion);	522	atomic64_inc(&aq->stats.no_completion);
533		523
534	clear_bit(EFA_AQ_STATE_RUNNING_BIT, &aq->state);	524	clear_bit(EFA_AQ_STATE_RUNNING_BIT, &aq->state);
535	err = -ETIME;	525	return -ETIME;
536	goto out;
537	}	526	}
538		527
539	msleep(aq->poll_interval);	528	msleep(aq->poll_interval);
540	}	529	}
541		530
542	err = efa_com_comp_status_to_errno(comp_ctx->user_cqe->acq_common_descriptor.status);	531	return efa_com_comp_status_to_errno(
543	out:	532	comp_ctx->user_cqe->acq_common_descriptor.status);
544	efa_com_dealloc_comp_ctx(aq, comp_ctx);
545	return err;
546	}	533	}
547		534
548	static int efa_com_wait_and_process_admin_cq_interrupts(struct efa_comp_ctx *comp_ctx,	535	static int efa_com_wait_and_process_admin_cq_interrupts(struct efa_comp_ctx *comp_ctx,
549	struct efa_com_admin_queue *aq)	536	struct efa_com_admin_queue *aq)
550	{	537	{
551	unsigned long flags;	538	unsigned long flags;
552	int err;
553		539
554	wait_for_completion_timeout(&comp_ctx->wait_event,	540	wait_for_completion_timeout(&comp_ctx->wait_event,
555	usecs_to_jiffies(aq->completion_timeout));	541	usecs_to_jiffies(aq->completion_timeout));
@@ -585,14 +571,11 @@ static int efa_com_wait_and_process_admin_cq_interrupts(struct efa_comp_ctx *com · 29 unmodified lines
585	aq->cq.cc);	571	aq->cq.cc);
586		572
587	clear_bit(EFA_AQ_STATE_RUNNING_BIT, &aq->state);	573	clear_bit(EFA_AQ_STATE_RUNNING_BIT, &aq->state);
588	err = -ETIME;	574	return -ETIME;
589	goto out;
590	}	575	}
591		576
592	err = efa_com_comp_status_to_errno(comp_ctx->user_cqe->acq_common_descriptor.status);	577	return efa_com_comp_status_to_errno(
593	out:	578	comp_ctx->user_cqe->acq_common_descriptor.status);
594	efa_com_dealloc_comp_ctx(aq, comp_ctx);
595	return err;
596	}	579	}
597		580
598	/*	581	/*
@@ -642,30 +625,39 @@ int efa_com_cmd_exec(struct efa_com_admin_queue *aq, · 43 unmodified lines
642	ibdev_dbg(aq->efa_dev, "%s (opcode %d)\n",	625	ibdev_dbg(aq->efa_dev, "%s (opcode %d)\n",
643	efa_com_cmd_str(cmd->aq_common_descriptor.opcode),	626	efa_com_cmd_str(cmd->aq_common_descriptor.opcode),
644	cmd->aq_common_descriptor.opcode);	627	cmd->aq_common_descriptor.opcode);
645	comp_ctx = efa_com_submit_admin_cmd(aq, cmd, cmd_size, comp, comp_size);	628
646	if (IS_ERR(comp_ctx)) {	629	comp_ctx = efa_com_alloc_comp_ctx(aq);
		630	if (!comp_ctx) {
		631	clear_bit(EFA_AQ_STATE_RUNNING_BIT, &aq->state);
		632	up(&aq->avail_cmds);
		633	return -EINVAL;
		634	}
		635
		636	err = efa_com_submit_admin_cmd(aq, comp_ctx, cmd, cmd_size, comp, comp_size);
		637	if (err) {
647	ibdev_err_ratelimited(	638	ibdev_err_ratelimited(
648	aq->efa_dev,	639	aq->efa_dev,
649	"Failed to submit command %s (opcode %u) err %pe\n",	640	"Failed to submit command %s (opcode %u) err %d\n",
650	efa_com_cmd_str(cmd->aq_common_descriptor.opcode),	641	efa_com_cmd_str(cmd->aq_common_descriptor.opcode),
651	cmd->aq_common_descriptor.opcode, comp_ctx);	642	cmd->aq_common_descriptor.opcode, err);
652		643
		644	efa_com_dealloc_comp_ctx(aq, comp_ctx);
653	up(&aq->avail_cmds);	645	up(&aq->avail_cmds);
654	atomic64_inc(&aq->stats.cmd_err);	646	atomic64_inc(&aq->stats.cmd_err);
655	return PTR_ERR(comp_ctx);	647	return err;
656	}	648	}
657		649
658	err = efa_com_wait_and_process_admin_cq(comp_ctx, aq);	650	err = efa_com_wait_and_process_admin_cq(comp_ctx, aq);
659	if (err) {	651	if (err) {
660	ibdev_err_ratelimited(	652	ibdev_err_ratelimited(
661	aq->efa_dev,	653	aq->efa_dev,
662	"Failed to process command %s (opcode %u) comp_status %d err %d\n",	654	"Failed to process command %s (opcode %u) err %d\n",
663	efa_com_cmd_str(cmd->aq_common_descriptor.opcode),	655	efa_com_cmd_str(cmd->aq_common_descriptor.opcode),
664	cmd->aq_common_descriptor.opcode,	656	cmd->aq_common_descriptor.opcode, err);
665	comp_ctx->user_cqe->acq_common_descriptor.status, err);
666	atomic64_inc(&aq->stats.cmd_err);	657	atomic64_inc(&aq->stats.cmd_err);
667	}	658	}
668		659
		660	efa_com_dealloc_comp_ctx(aq, comp_ctx);
669	up(&aq->avail_cmds);	661	up(&aq->avail_cmds);
670		662
671	return err;	663	return err;

drivers/infiniband/hw/ionic/ionic_controlpath.c+3−1

 {
 	const struct ib_global_route *grh;
 	enum rdma_network_type net;
+	u8 smac[ETH_ALEN];
 	u16 vlan;
 	int rc;
 	grh = rdma_ah_read_grh(attr);
-	rc = rdma_read_gid_l2_fields(grh->sgid_attr, &vlan, &hdr->eth.smac_h[0]);
+	rc = rdma_read_gid_l2_fields(grh->sgid_attr, &vlan, smac);
 	if (rc)
 		return rc;
 	if (rc)
 		return rc;
+	ether_addr_copy(hdr->eth.smac_h, smac);
 	ether_addr_copy(hdr->eth.dmac_h, attr->roce.dmac);
 	if (net == RDMA_NETWORK_IPV4) {

drivers/infiniband/hw/irdma/cm.c+16−13

 	int oldarpindex;
 	int arpindex;
 	struct net_device *netdev = iwdev->netdev;
+	int ret;
 	/* create an hte and cm_node for this instance */
 	cm_node = kzalloc_obj(*cm_node, GFP_ATOMIC);
 	if (!cm_node)
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 	/* set our node specific transport info */
 	cm_node->ipv4 = cm_info->ipv4;
 			arpindex = -EINVAL;
 	}
-	if (arpindex < 0)
+	if (arpindex < 0) {
+		ret = -EINVAL;
 		goto err;
+	}
 	ether_addr_copy(cm_node->rem_mac,
 			iwdev->rf->arp_table[arpindex].mac_addr);
 err:
 	kfree(cm_node);
-	return NULL;
+	return ERR_PTR(ret);
 }
 static void irdma_destroy_connection(struct irdma_cm_node *cm_node)
 	/* create a CM connection node */
 	cm_node = irdma_make_cm_node(cm_core, iwdev, cm_info, NULL);
-	if (!cm_node)
+	if (IS_ERR(cm_node))
-		return -ENOMEM;
+		return PTR_ERR(cm_node);
 	/* set our node side to client (active) side */
 	cm_node->tcp_cntxt.client = 1;
 		cm_info.cm_id = listener->cm_id;
 		cm_node = irdma_make_cm_node(cm_core, iwdev, &cm_info,
 					     listener);
-		if (!cm_node) {
+		if (IS_ERR(cm_node)) {
 			ibdev_dbg(&cm_core->iwdev->ibdev,
-				  "CM: allocate node failed\n");
+				  "CM: allocate node failed ret=%ld\n", PTR_ERR(cm_node));
 			refcount_dec(&listener->refcnt);
 			return;
 		}
 		irdma_cm_event_reset(event);
 		break;
 	case IRDMA_CM_EVENT_CONNECTED:
-		if (!event->cm_node->cm_id ||
+		if (!cm_node->cm_id ||
-		    event->cm_node->state != IRDMA_CM_STATE_OFFLOADED)
+		    cm_node->state != IRDMA_CM_STATE_OFFLOADED)
 			break;
 		irdma_cm_event_connected(event);
 		break;
 	case IRDMA_CM_EVENT_MPA_REJECT:
-		if (!event->cm_node->cm_id ||
+		if (!cm_node->cm_id ||
 		    cm_node->state == IRDMA_CM_STATE_OFFLOADED)
 			break;
 		irdma_send_cm_event(cm_node, cm_node->cm_id,
 				    IW_CM_EVENT_CONNECT_REPLY, -ECONNREFUSED);
 		break;
 	case IRDMA_CM_EVENT_ABORTED:
-		if (!event->cm_node->cm_id ||
+		if (!cm_node->cm_id ||
-		    event->cm_node->state == IRDMA_CM_STATE_OFFLOADED)
+		    cm_node->state == IRDMA_CM_STATE_OFFLOADED)
 			break;
 		irdma_event_connect_error(event);
 		break;
 		break;
 	}
-	irdma_rem_ref_cm_node(event->cm_node);
+	irdma_rem_ref_cm_node(cm_node);
 	kfree(event);
 }

drivers/infiniband/hw/irdma/uk.c+22−17

@@ -1438,7 +1438,7 @@ exit: · 1437 unmodified lines
1438	* irdma_round_up_wq - return round up qp wq depth	1438	* irdma_round_up_wq - return round up qp wq depth
1439	* @wqdepth: wq depth in quanta to round up	1439	* @wqdepth: wq depth in quanta to round up
1440	*/	1440	*/
1441	static int irdma_round_up_wq(u32 wqdepth)	1441	static u64 irdma_round_up_wq(u64 wqdepth)
1442	{	1442	{
1443	int scount = 1;	1443	int scount = 1;
1444		1444
@@ -1491,15 +1491,16 @@ void irdma_get_wqe_shift(struct irdma_uk_attrs *uk_attrs, u32 sge, · 46 unmodified lines
1491	int irdma_get_sqdepth(struct irdma_uk_attrs *uk_attrs, u32 sq_size, u8 shift,	1491	int irdma_get_sqdepth(struct irdma_uk_attrs *uk_attrs, u32 sq_size, u8 shift,
1492	u32 *sqdepth)	1492	u32 *sqdepth)
1493	{	1493	{
1494	u32 min_size = (u32)uk_attrs->min_hw_wq_size << shift;	1494	u32 min_hw_quanta = (u32)uk_attrs->min_hw_wq_size << shift;
		1495	u64 hw_quanta =
		1496	irdma_round_up_wq(((u64)sq_size << shift) + IRDMA_SQ_RSVD);
1495		1497
1496	*sqdepth = irdma_round_up_wq((sq_size << shift) + IRDMA_SQ_RSVD);	1498	if (hw_quanta < min_hw_quanta)
1497		1499	hw_quanta = min_hw_quanta;
1498	if (*sqdepth < min_size)	1500	else if (hw_quanta > uk_attrs->max_hw_wq_quanta)
1499	*sqdepth = min_size;
1500	else if (*sqdepth > uk_attrs->max_hw_wq_quanta)
1501	return -EINVAL;	1501	return -EINVAL;
1502		1502
		1503	*sqdepth = hw_quanta;
1503	return 0;	1504	return 0;
1504	}	1505	}
1505		1506
@@ -1513,15 +1514,16 @@ int irdma_get_sqdepth(struct irdma_uk_attrs *uk_attrs, u32 sq_size, u8 shift, · 7 unmodified lines
1513	int irdma_get_rqdepth(struct irdma_uk_attrs *uk_attrs, u32 rq_size, u8 shift,	1514	int irdma_get_rqdepth(struct irdma_uk_attrs *uk_attrs, u32 rq_size, u8 shift,
1514	u32 *rqdepth)	1515	u32 *rqdepth)
1515	{	1516	{
1516	u32 min_size = (u32)uk_attrs->min_hw_wq_size << shift;	1517	u32 min_hw_quanta = (u32)uk_attrs->min_hw_wq_size << shift;
1517		1518	u64 hw_quanta =
1518	*rqdepth = irdma_round_up_wq((rq_size << shift) + IRDMA_RQ_RSVD);	1519	irdma_round_up_wq(((u64)rq_size << shift) + IRDMA_RQ_RSVD);
1519		1520
1520	if (*rqdepth < min_size)	1521	if (hw_quanta < min_hw_quanta)
1521	*rqdepth = min_size;	1522	hw_quanta = min_hw_quanta;
1522	else if (*rqdepth > uk_attrs->max_hw_rq_quanta)	1523	else if (hw_quanta > uk_attrs->max_hw_rq_quanta)
1523	return -EINVAL;	1524	return -EINVAL;
1524		1525
		1526	*rqdepth = hw_quanta;
1525	return 0;	1527	return 0;
1526	}	1528	}
1527		1529
@@ -1535,13 +1537,16 @@ int irdma_get_rqdepth(struct irdma_uk_attrs *uk_attrs, u32 rq_size, u8 shift, · 7 unmodified lines
1535	int irdma_get_srqdepth(struct irdma_uk_attrs *uk_attrs, u32 srq_size, u8 shift,	1537	int irdma_get_srqdepth(struct irdma_uk_attrs *uk_attrs, u32 srq_size, u8 shift,
1536	u32 *srqdepth)	1538	u32 *srqdepth)
1537	{	1539	{
1538	*srqdepth = irdma_round_up_wq((srq_size << shift) + IRDMA_RQ_RSVD);	1540	u32 min_hw_quanta = (u32)uk_attrs->min_hw_wq_size << shift;
		1541	u64 hw_quanta =
		1542	irdma_round_up_wq(((u64)srq_size << shift) + IRDMA_RQ_RSVD);
1539		1543
1540	if (*srqdepth < ((u32)uk_attrs->min_hw_wq_size << shift))	1544	if (hw_quanta < min_hw_quanta)
1541	*srqdepth = uk_attrs->min_hw_wq_size << shift;	1545	hw_quanta = min_hw_quanta;
1542	else if (*srqdepth > uk_attrs->max_hw_srq_quanta)	1546	else if (hw_quanta > uk_attrs->max_hw_srq_quanta)
1543	return -EINVAL;	1547	return -EINVAL;
1544		1548
		1549	*srqdepth = hw_quanta;
1545	return 0;	1550	return 0;
1546	}	1551	}
1547		1552

drivers/infiniband/hw/irdma/utils.c+0−2

@@ -2322,8 +2322,6 @@ void irdma_modify_qp_to_err(struct irdma_sc_qp *sc_qp) · 2321 unmodified lines
2322	struct irdma_qp *qp = sc_qp->qp_uk.back_qp;	2322	struct irdma_qp *qp = sc_qp->qp_uk.back_qp;
2323	struct ib_qp_attr attr;	2323	struct ib_qp_attr attr;
2324		2324
2325	if (qp->iwdev->rf->reset)
2326	return;
2327	attr.qp_state = IB_QPS_ERR;	2325	attr.qp_state = IB_QPS_ERR;
2328		2326
2329	if (rdma_protocol_roce(qp->ibqp.device, 1))	2327	if (rdma_protocol_roce(qp->ibqp.device, 1))

drivers/infiniband/hw/irdma/verbs.c+6−4

 	}
 	irdma_qp_rem_ref(&iwqp->ibqp);
-	wait_for_completion(&iwqp->free_qp);
+	if (!iwdev->rf->reset)
+		wait_for_completion(&iwqp->free_qp);
 	irdma_free_lsmm_rsrc(iwqp);
 	irdma_cqp_qp_destroy_cmd(&iwdev->rf->sc_dev, &iwqp->sc_qp);
 	spin_lock_init(&iwqp->sc_qp.pfpdu.lock);
 	iwqp->sig_all = init_attr->sq_sig_type == IB_SIGNAL_ALL_WR;
 	rf->qp_table[qp_num] = iwqp;
+	init_completion(&iwqp->free_qp);
 	if (udata) {
 		/* GEN_1 legacy support with libi40iw does not have expanded uresp struct */
 		}
 	}
-	init_completion(&iwqp->free_qp);
 	return 0;
 error:
 				ctx_info->remote_atomics_en = true;
 	}
-	wait_event(iwqp->mod_qp_waitq, !atomic_read(&iwqp->hw_mod_qp_pend));
 	ibdev_dbg(&iwdev->ibdev,
 		  "VERBS: caller: %pS qp_id=%d to_ibqpstate=%d ibqpstate=%d irdma_qpstate=%d attr_mask=0x%x\n",
 		  __builtin_return_address(0), ibqp->qp_num, attr->qp_state,
 		case IB_QPS_ERR:
 		case IB_QPS_RESET:
 			if (iwqp->iwarp_state == IRDMA_QP_STATE_ERROR) {
+				iwqp->ibqp_state = attr->qp_state;
 				spin_unlock_irqrestore(&iwqp->lock, flags);
 				if (udata && udata->inlen) {
 					if (ib_copy_from_udata(&ureq, udata,
 		case IB_QPS_ERR:
 		case IB_QPS_RESET:
 			if (iwqp->iwarp_state == IRDMA_QP_STATE_ERROR) {
+				iwqp->ibqp_state = attr->qp_state;
 				spin_unlock_irqrestore(&iwqp->lock, flags);
 				if (udata && udata->inlen) {
 					if (ib_copy_from_udata(&ureq, udata,
 err:
 	ib_umem_release(region);
+	iwmr->region = NULL;
 	return err;
 }

drivers/iommu/dma-iommu.c+17−4

 	 */
 	if (dev_use_swiotlb(dev, size, dir) &&
 	    iova_unaligned(iovad, phys, size)) {
-		if (attrs & DMA_ATTR_MMIO)
+		if (attrs & (DMA_ATTR_MMIO | DMA_ATTR_REQUIRE_COHERENT))
 			return DMA_MAPPING_ERROR;
 		phys = iommu_dma_map_swiotlb(dev, phys, size, dir, attrs);
 		arch_sync_dma_for_device(phys, size, dir);
 	iova = __iommu_dma_map(dev, phys, size, prot, dma_mask);
-	if (iova == DMA_MAPPING_ERROR && !(attrs & DMA_ATTR_MMIO))
+	if (iova == DMA_MAPPING_ERROR &&
+	    !(attrs & (DMA_ATTR_MMIO | DMA_ATTR_REQUIRE_COHERENT)))
 		swiotlb_tbl_unmap_single(dev, phys, size, dir, attrs);
 	return iova;
 }
 {
 	phys_addr_t phys;
-	if (attrs & DMA_ATTR_MMIO) {
+	if (attrs & (DMA_ATTR_MMIO | DMA_ATTR_REQUIRE_COHERENT)) {
 		__iommu_dma_unmap(dev, dma_handle, size);
 		return;
 	}
 	if (WARN_ON_ONCE(iova_start_pad && offset > 0))
 		return -EIO;
+	/*
+	 * DMA_IOVA_USE_SWIOTLB is set on state after some entry
+	 * took SWIOTLB path, which we were supposed to prevent
+	 * for DMA_ATTR_REQUIRE_COHERENT attribute.
+	 */
+	if (WARN_ON_ONCE((state->__size & DMA_IOVA_USE_SWIOTLB) &&
+			 (attrs & DMA_ATTR_REQUIRE_COHERENT)))
+		return -EOPNOTSUPP;
+	if (!dev_is_dma_coherent(dev) && (attrs & DMA_ATTR_REQUIRE_COHERENT))
+		return -EOPNOTSUPP;
 	if (dev_use_swiotlb(dev, size, dir) &&
 	    iova_unaligned(iovad, phys, size)) {
-		if (attrs & DMA_ATTR_MMIO)
+		if (attrs & (DMA_ATTR_MMIO | DMA_ATTR_REQUIRE_COHERENT))
 			return -EPERM;
 		return iommu_dma_iova_link_swiotlb(dev, state, phys, offset,

drivers/irqchip/irq-qcom-mpm.c+3−0

 	if (ret < 0)
 		return ret;
+	mbox_client_txdone(priv->mbox_chan, 0);
 	return 0;
 }
 	}
 	priv->mbox_client.dev = dev;
+	priv->mbox_client.knows_txdone = true;
 	priv->mbox_chan = mbox_request_channel(&priv->mbox_client, 0);
 	if (IS_ERR(priv->mbox_chan)) {
 		ret = PTR_ERR(priv->mbox_chan);

drivers/irqchip/irq-renesas-rzv2h.c+1−1

@@ -621,7 +621,7 @@ static int rzv2h_icu_probe_common(struct platform_device *pdev, struct device_no · 620 unmodified lines
621	return 0;	621	return 0;
622		622
623	pm_put:	623	pm_put:
624	pm_runtime_put(&pdev->dev);	624	pm_runtime_put_sync(&pdev->dev);
625		625
626	return ret;	626	return ret;
627	}	627	}

drivers/media/i2c/ccs/ccs-core.c+0−2

@@ -3080,8 +3080,6 @@ static int ccs_init_state(struct v4l2_subdev *sd, · 3079 unmodified lines
3080	struct v4l2_rect *crop =	3080	struct v4l2_rect *crop =
3081	v4l2_subdev_state_get_crop(sd_state, pad);	3081	v4l2_subdev_state_get_crop(sd_state, pad);
3082		3082
3083	guard(mutex)(&sensor->mutex);
3084
3085	ccs_get_native_size(ssd, crop);	3083	ccs_get_native_size(ssd, crop);
3086		3084
3087	fmt->width = crop->width;	3085	fmt->width = crop->width;

drivers/media/mc/mc-request.c+5−0

 	struct media_device *mdev = req->mdev;
 	unsigned long flags;
+	mutex_lock(&mdev->req_queue_mutex);
 	spin_lock_irqsave(&req->lock, flags);
 	if (req->state != MEDIA_REQUEST_STATE_IDLE &&
 	    req->state != MEDIA_REQUEST_STATE_COMPLETE) {
 			"request: %s not in idle or complete state, cannot reinit\n",
 			req->debug_str);
 		spin_unlock_irqrestore(&req->lock, flags);
+		mutex_unlock(&mdev->req_queue_mutex);
 		return -EBUSY;
 	}
 	if (req->access_count) {
 			"request: %s is being accessed, cannot reinit\n",
 			req->debug_str);
 		spin_unlock_irqrestore(&req->lock, flags);
+		mutex_unlock(&mdev->req_queue_mutex);
 		return -EBUSY;
 	}
 	req->state = MEDIA_REQUEST_STATE_CLEANING;
 	spin_lock_irqsave(&req->lock, flags);
 	req->state = MEDIA_REQUEST_STATE_IDLE;
 	spin_unlock_irqrestore(&req->lock, flags);
+	mutex_unlock(&mdev->req_queue_mutex);
 	return 0;
 }

drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c+4−0

 		ctrl = v4l2_ctrl_find(&ctx->ctrl_hdl,
 				      V4L2_CID_STATELESS_HEVC_EXT_SPS_ST_RPS);
 		run->ext_sps_st_rps = ctrl ? ctrl->p_cur.p : NULL;
+	} else {
+		run->ext_sps_st_rps = NULL;
 	}
 	if (ctx->has_sps_lt_rps) {
 		ctrl = v4l2_ctrl_find(&ctx->ctrl_hdl,
 				      V4L2_CID_STATELESS_HEVC_EXT_SPS_LT_RPS);
 		run->ext_sps_lt_rps = ctrl ? ctrl->p_cur.p : NULL;
+	} else {
+		run->ext_sps_lt_rps = NULL;
 	}
 	rkvdec_run_preamble(ctx, &run->base);

drivers/media/platform/rockchip/rkvdec/rkvdec-vdpu383-h264.c+27−23

 	struct vdpu383_regs_h26x regs;
 };
-static void set_field_order_cnt(struct rkvdec_pps *pps, const struct v4l2_h264_dpb_entry *dpb)
+static noinline_for_stack void set_field_order_cnt(struct rkvdec_pps *pps, const struct v4l2_h264_dpb_entry *dpb)
 {
 	pps->top_field_order_cnt0 = dpb[0].top_field_order_cnt;
 	pps->bot_field_order_cnt0 = dpb[0].bottom_field_order_cnt;
 	pps->bot_field_order_cnt15 = dpb[15].bottom_field_order_cnt;
 }
+static noinline_for_stack void set_dec_params(struct rkvdec_pps *pps, const struct v4l2_ctrl_h264_decode_params *dec_params)
+{
+	const struct v4l2_h264_dpb_entry *dpb = dec_params->dpb;
+	for (int i = 0; i < ARRAY_SIZE(dec_params->dpb); i++) {
+		if (dpb[i].flags & V4L2_H264_DPB_ENTRY_FLAG_LONG_TERM)
+			pps->is_longterm |= (1 << i);
+		pps->ref_field_flags |=
+		 (!!(dpb[i].flags & V4L2_H264_DPB_ENTRY_FLAG_FIELD)) << i;
+		pps->ref_colmv_use_flag |=
+		 (!!(dpb[i].flags & V4L2_H264_DPB_ENTRY_FLAG_ACTIVE)) << i;
+		pps->ref_topfield_used |=
+		 (!!(dpb[i].fields & V4L2_H264_TOP_FIELD_REF)) << i;
+		pps->ref_botfield_used |=
+			(!!(dpb[i].fields & V4L2_H264_BOTTOM_FIELD_REF)) << i;
+	}
+	pps->pic_field_flag =
+		!!(dec_params->flags & V4L2_H264_DECODE_PARAM_FLAG_FIELD_PIC);
+	pps->pic_associated_flag =
+		!!(dec_params->flags & V4L2_H264_DECODE_PARAM_FLAG_BOTTOM_FIELD);
+	pps->cur_top_field = dec_params->top_field_order_cnt;
+	pps->cur_bot_field = dec_params->bottom_field_order_cnt;
+}
 static void assemble_hw_pps(struct rkvdec_ctx *ctx,
 			    struct rkvdec_h264_run *run)
 {
 	struct rkvdec_h264_priv_tbl *priv_tbl = h264_ctx->priv_tbl.cpu;
 	struct rkvdec_sps_pps *hw_ps;
 	u32 pic_width, pic_height;
-	u32 i;
 	/*
 	 * HW read the SPS/PPS information from PPS packet index by PPS id.
 		!!(pps->flags & V4L2_H264_PPS_FLAG_SCALING_MATRIX_PRESENT);
 	set_field_order_cnt(&hw_ps->pps, dpb);
+	set_dec_params(&hw_ps->pps, dec_params);
-	for (i = 0; i < ARRAY_SIZE(dec_params->dpb); i++) {
-		if (dpb[i].flags & V4L2_H264_DPB_ENTRY_FLAG_LONG_TERM)
-			hw_ps->pps.is_longterm |= (1 << i);
-		hw_ps->pps.ref_field_flags |=
-			(!!(dpb[i].flags & V4L2_H264_DPB_ENTRY_FLAG_FIELD)) << i;
-		hw_ps->pps.ref_colmv_use_flag |=
-			(!!(dpb[i].flags & V4L2_H264_DPB_ENTRY_FLAG_ACTIVE)) << i;
-		hw_ps->pps.ref_topfield_used |=
-			(!!(dpb[i].fields & V4L2_H264_TOP_FIELD_REF)) << i;
-		hw_ps->pps.ref_botfield_used |=
-			(!!(dpb[i].fields & V4L2_H264_BOTTOM_FIELD_REF)) << i;
-	}
-	hw_ps->pps.pic_field_flag =
-		!!(dec_params->flags & V4L2_H264_DECODE_PARAM_FLAG_FIELD_PIC);
-	hw_ps->pps.pic_associated_flag =
-		!!(dec_params->flags & V4L2_H264_DECODE_PARAM_FLAG_BOTTOM_FIELD);
-	hw_ps->pps.cur_top_field = dec_params->top_field_order_cnt;
-	hw_ps->pps.cur_bot_field = dec_params->bottom_field_order_cnt;
 }
 static void rkvdec_write_regs(struct rkvdec_ctx *ctx)

drivers/media/platform/rockchip/rkvdec/rkvdec-vp9.c+2−1

@@ -893,7 +893,8 @@ out_update_last: · 892 unmodified lines
893	update_ctx_last_info(vp9_ctx);	893	update_ctx_last_info(vp9_ctx);
894	}	894	}
895		895
896	static void rkvdec_init_v4l2_vp9_count_tbl(struct rkvdec_ctx *ctx)	896	static noinline_for_stack void
		897	rkvdec_init_v4l2_vp9_count_tbl(struct rkvdec_ctx *ctx)
897	{	898	{
898	struct rkvdec_vp9_ctx *vp9_ctx = ctx->priv;	899	struct rkvdec_vp9_ctx *vp9_ctx = ctx->priv;
899	struct rkvdec_vp9_intra_frame_symbol_counts *intra_cnts = vp9_ctx->count_tbl.cpu;	900	struct rkvdec_vp9_intra_frame_symbol_counts *intra_cnts = vp9_ctx->count_tbl.cpu;

drivers/media/platform/synopsys/Kconfig+1−0

@@ -7,6 +7,7 @@ config VIDEO_DW_MIPI_CSI2RX · 6 unmodified lines
7	depends on VIDEO_DEV	7	depends on VIDEO_DEV
8	depends on V4L_PLATFORM_DRIVERS	8	depends on V4L_PLATFORM_DRIVERS
9	depends on PM && COMMON_CLK	9	depends on PM && COMMON_CLK
		10	select GENERIC_PHY_MIPI_DPHY
10	select MEDIA_CONTROLLER	11	select MEDIA_CONTROLLER
11	select V4L2_FWNODE	12	select V4L2_FWNODE
12	select VIDEO_V4L2_SUBDEV_API	13	select VIDEO_V4L2_SUBDEV_API

drivers/media/platform/synopsys/dw-mipi-csi2rx.c+1−1

@@ -301,7 +301,7 @@ dw_mipi_csi2rx_enum_mbus_code(struct v4l2_subdev *sd, · 300 unmodified lines
301		301
302	return 0;	302	return 0;
303	case DW_MIPI_CSI2RX_PAD_SINK:	303	case DW_MIPI_CSI2RX_PAD_SINK:
304	if (code->index > csi2->formats_num)	304	if (code->index >= csi2->formats_num)
305	return -EINVAL;	305	return -EINVAL;
306		306
307	code->code = csi2->formats[code->index].code;	307	code->code = csi2->formats[code->index].code;

drivers/media/platform/verisilicon/imx8m_vpu_hw.c+1−1

@@ -343,7 +343,7 @@ const struct hantro_variant imx8mq_vpu_variant = { · 342 unmodified lines
343	.num_regs = ARRAY_SIZE(imx8mq_reg_names)	343	.num_regs = ARRAY_SIZE(imx8mq_reg_names)
344	};	344	};
345		345
346	static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst = {	346	static const struct of_device_id imx8mq_vpu_shared_resources[] = {
347	{ .compatible = "nxp,imx8mq-vpu-g1", },	347	{ .compatible = "nxp,imx8mq-vpu-g1", },
348	{ .compatible = "nxp,imx8mq-vpu-g2", },	348	{ .compatible = "nxp,imx8mq-vpu-g2", },
349	{ /* sentinel */ }	349	{ /* sentinel */ }

drivers/media/usb/uvc/uvc_video.c+5−4

 /*
  * Free transfer buffers.
  */
-static void uvc_free_urb_buffers(struct uvc_streaming *stream)
+static void uvc_free_urb_buffers(struct uvc_streaming *stream,
+				 unsigned int size)
 {
 	struct usb_device *udev = stream->dev->udev;
 	struct uvc_urb *uvc_urb;
 		if (!uvc_urb->buffer)
 			continue;
-		usb_free_noncoherent(udev, stream->urb_size, uvc_urb->buffer,
+		usb_free_noncoherent(udev, size, uvc_urb->buffer,
 				     uvc_stream_dir(stream), uvc_urb->sgt);
 		uvc_urb->buffer = NULL;
 		uvc_urb->sgt = NULL;
 			if (!uvc_alloc_urb_buffer(stream, uvc_urb, urb_size,
 						  gfp_flags)) {
-				uvc_free_urb_buffers(stream);
+				uvc_free_urb_buffers(stream, urb_size);
 				break;
 			}
 	}
 	if (free_buffers)
-		uvc_free_urb_buffers(stream);
+		uvc_free_urb_buffers(stream, stream->urb_size);
 }
 /*

drivers/media/v4l2-core/v4l2-ioctl.c+3−2

 	}
 	/*
-	 * We need to serialize streamon/off with queueing new requests.
+	 * We need to serialize streamon/off/reqbufs with queueing new requests.
 	 * These ioctls may trigger the cancellation of a streaming
 	 * operation, and that should not be mixed with queueing a new
 	 * request at the same time.
 	 */
 	if (v4l2_device_supports_requests(vfd->v4l2_dev) &&
-	    (cmd == VIDIOC_STREAMON || cmd == VIDIOC_STREAMOFF)) {
+	    (cmd == VIDIOC_STREAMON || cmd == VIDIOC_STREAMOFF ||
+	     cmd == VIDIOC_REQBUFS)) {
 		req_queue_lock = &vfd->v4l2_dev->mdev->req_queue_mutex;
 		if (mutex_lock_interruptible(req_queue_lock))

drivers/net/can/dev/netlink.c+3−1

@@ -601,7 +601,9 @@ static int can_changelink(struct net_device dev, struct nlattr tb[], · 600 unmodified lines
601	/* We need synchronization with dev->stop() */	601	/* We need synchronization with dev->stop() */
602	ASSERT_RTNL();	602	ASSERT_RTNL();
603		603
604	can_ctrlmode_changelink(dev, data, extack);	604	err = can_ctrlmode_changelink(dev, data, extack);
		605	if (err)
		606	return err;
605		607
606	if (data[IFLA_CAN_BITTIMING]) {	608	if (data[IFLA_CAN_BITTIMING]) {
607	struct can_bittiming bt;	609	struct can_bittiming bt;

drivers/net/can/spi/mcp251x.c+24−5

 	}
 	mutex_lock(&priv->mcp_lock);
-	mcp251x_power_enable(priv->transceiver, 1);
+	ret = mcp251x_power_enable(priv->transceiver, 1);
+	if (ret) {
+		dev_err(&spi->dev, "failed to enable transceiver power: %pe\n", ERR_PTR(ret));
+		goto out_close_candev;
+	}
 	priv->force_quit = 0;
 	priv->tx_skb = NULL;
 	mcp251x_hw_sleep(spi);
 out_close:
 	mcp251x_power_enable(priv->transceiver, 0);
+out_close_candev:
 	close_candev(net);
 	mutex_unlock(&priv->mcp_lock);
 	if (release_irq)
 {
 	struct spi_device *spi = to_spi_device(dev);
 	struct mcp251x_priv *priv = spi_get_drvdata(spi);
+	int ret = 0;
-	if (priv->after_suspend & AFTER_SUSPEND_POWER)
+	if (priv->after_suspend & AFTER_SUSPEND_POWER) {
-		mcp251x_power_enable(priv->power, 1);
+		ret = mcp251x_power_enable(priv->power, 1);
-	if (priv->after_suspend & AFTER_SUSPEND_UP)
+		if (ret) {
-		mcp251x_power_enable(priv->transceiver, 1);
+			dev_err(dev, "failed to restore power: %pe\n", ERR_PTR(ret));
+			return ret;
+		}
+	}
+	if (priv->after_suspend & AFTER_SUSPEND_UP) {
+		ret = mcp251x_power_enable(priv->transceiver, 1);
+		if (ret) {
+			dev_err(dev, "failed to restore transceiver power: %pe\n", ERR_PTR(ret));
+			if (priv->after_suspend & AFTER_SUSPEND_POWER)
+				mcp251x_power_enable(priv->power, 0);
+			return ret;
+		}
+	}
 	if (priv->after_suspend & (AFTER_SUSPEND_POWER | AFTER_SUSPEND_UP))
 		queue_work(priv->wq, &priv->restart_work);

drivers/net/ethernet/airoha/airoha_ppe.c+2−0

@@ -227,7 +227,9 @@ static int airoha_ppe_get_wdma_info(struct net_device dev, const u8 addr, · 226 unmodified lines
227	if (!dev)	227	if (!dev)
228	return -ENODEV;	228	return -ENODEV;
229		229
		230	rcu_read_lock();
230	err = dev_fill_forward_path(dev, addr, &stack);	231	err = dev_fill_forward_path(dev, addr, &stack);
		232	rcu_read_unlock();
231	if (err)	233	if (err)
232	return err;	234	return err;
233		235

drivers/net/ethernet/broadcom/Kconfig+1−1

@@ -25,7 +25,7 @@ config B44 · 24 unmodified lines
25	select SSB	25	select SSB
26	select MII	26	select MII
27	select PHYLIB	27	select PHYLIB
28	select FIXED_PHY if BCM47XX	28	select FIXED_PHY
29	help	29	help
30	If you have a network (Ethernet) controller of this type, say Y	30	If you have a network (Ethernet) controller of this type, say Y
31	or M here.	31	or M here.

drivers/net/ethernet/broadcom/asp2/bcmasp.c+23−18

 	}
 }
-static void bcmasp_wol_irq_destroy(struct bcmasp_priv *priv)
-{
-	if (priv->wol_irq > 0)
-		free_irq(priv->wol_irq, priv);
-}
 static void bcmasp_eee_fixup(struct bcmasp_intf *intf, bool en)
 {
 	u32 reg, phy_lpi_overwrite;
 	if (priv->irq <= 0)
 		return -EINVAL;
-	priv->clk = devm_clk_get_optional_enabled(dev, "sw_asp");
+	priv->clk = devm_clk_get_optional(dev, "sw_asp");
 	if (IS_ERR(priv->clk))
 		return dev_err_probe(dev, PTR_ERR(priv->clk),
 				     "failed to request clock\n");
 	bcmasp_set_pdata(priv, pdata);
+	ret = clk_prepare_enable(priv->clk);
+	if (ret)
+		return dev_err_probe(dev, ret, "failed to start clock\n");
 	/* Enable all clocks to ensure successful probing */
 	bcmasp_core_clock_set(priv, ASP_CTRL_CLOCK_CTRL_ASP_ALL_DISABLE, 0);
 	ret = devm_request_irq(&pdev->dev, priv->irq, bcmasp_isr, 0,
 			       pdev->name, priv);
-	if (ret)
+	if (ret) {
-		return dev_err_probe(dev, ret, "failed to request ASP interrupt: %d", ret);
+		dev_err(dev, "Failed to request ASP interrupt: %d", ret);
+		goto err_clock_disable;
+	}
 	/* Register mdio child nodes */
 	of_platform_populate(dev->of_node, bcmasp_mdio_of_match, NULL, dev);
 	priv->mda_filters = devm_kcalloc(dev, priv->num_mda_filters,
 					 sizeof(*priv->mda_filters), GFP_KERNEL);
-	if (!priv->mda_filters)
+	if (!priv->mda_filters) {
-		return -ENOMEM;
+		ret = -ENOMEM;
+		goto err_clock_disable;
+	}
 	priv->net_filters = devm_kcalloc(dev, priv->num_net_filters,
 					 sizeof(*priv->net_filters), GFP_KERNEL);
-	if (!priv->net_filters)
+	if (!priv->net_filters) {
-		return -ENOMEM;
+		ret = -ENOMEM;
+		goto err_clock_disable;
+	}
 	bcmasp_core_init_filters(priv);
 	ports_node = of_find_node_by_name(dev->of_node, "ethernet-ports");
 	if (!ports_node) {
 		dev_warn(dev, "No ports found\n");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto err_clock_disable;
 	}
 	i = 0;
 	 */
 	bcmasp_core_clock_set(priv, 0, ASP_CTRL_CLOCK_CTRL_ASP_ALL_DISABLE);
-	clk_disable_unprepare(priv->clk);
 	/* Now do the registration of the network ports which will take care
 	 * of managing the clock properly.
 	 */
 		count++;
 	}
+	clk_disable_unprepare(priv->clk);
 	dev_info(dev, "Initialized %d port(s)\n", count);
 	return ret;
 err_cleanup:
-	bcmasp_wol_irq_destroy(priv);
 	bcmasp_remove_intfs(priv);
+err_clock_disable:
+	clk_disable_unprepare(priv->clk);
 	return ret;
 }
 	if (!priv)
 		return;
-	bcmasp_wol_irq_destroy(priv);
 	bcmasp_remove_intfs(priv);
 }

drivers/net/ethernet/cadence/macb_main.c+25−16

 	}
 	if (tx_skb->skb) {
-		napi_consume_skb(tx_skb->skb, budget);
+		dev_consume_skb_any(tx_skb->skb);
 		tx_skb->skb = NULL;
 	}
 }
 	spin_lock_irq(&bp->stats_lock);
 	gem_update_stats(bp);
 	memcpy(data, &bp->ethtool_stats, sizeof(u64)
-			* (GEM_STATS_LEN + QUEUE_STATS_LEN * MACB_MAX_QUEUES));
+			* (GEM_STATS_LEN + QUEUE_STATS_LEN * bp->num_queues));
 	spin_unlock_irq(&bp->stats_lock);
 }
 	struct macb_queue *queue;
 	struct in_device *idev;
 	unsigned long flags;
+	u32 tmp, ifa_local;
 	unsigned int q;
 	int err;
-	u32 tmp;
 	if (!device_may_wakeup(&bp->dev->dev))
 		phy_exit(bp->phy);
 		return 0;
 	if (bp->wol & MACB_WOL_ENABLED) {
-		/* Check for IP address in WOL ARP mode */
+		if (bp->wolopts & WAKE_ARP) {
-		idev = __in_dev_get_rcu(bp->dev);
+			/* Check for IP address in WOL ARP mode */
-		if (idev)
+			rcu_read_lock();
-			ifa = rcu_dereference(idev->ifa_list);
+			idev = __in_dev_get_rcu(bp->dev);
-		if ((bp->wolopts & WAKE_ARP) && !ifa) {
+			if (idev)
-			netdev_err(netdev, "IP address not assigned as required by WoL walk ARP\n");
+				ifa = rcu_dereference(idev->ifa_list);
-			return -EOPNOTSUPP;
+			if (!ifa) {
+				rcu_read_unlock();
+				netdev_err(netdev, "IP address not assigned as required by WoL walk ARP\n");
+				return -EOPNOTSUPP;
+			}
+			ifa_local = be32_to_cpu(ifa->ifa_local);
+			rcu_read_unlock();
 		}
 		spin_lock_irqsave(&bp->lock, flags);
 		/* Disable Tx and Rx engines before  disabling the queues,
 		if (bp->wolopts & WAKE_ARP) {
 			tmp |= MACB_BIT(ARP);
 			/* write IP address into register */
-			tmp |= MACB_BFEXT(IP, be32_to_cpu(ifa->ifa_local));
+			tmp |= MACB_BFEXT(IP, ifa_local);
 		}
+		spin_unlock_irqrestore(&bp->lock, flags);
 		/* Change interrupt handler and
 		 * Enable WoL IRQ on queue 0
 				dev_err(dev,
 					"Unable to request IRQ %d (error %d)\n",
 					bp->queues[0].irq, err);
-				spin_unlock_irqrestore(&bp->lock, flags);
 				return err;
 			}
+			spin_lock_irqsave(&bp->lock, flags);
 			queue_writel(bp->queues, IER, GEM_BIT(WOL));
 			gem_writel(bp, WOL, tmp);
+			spin_unlock_irqrestore(&bp->lock, flags);
 		} else {
 			err = devm_request_irq(dev, bp->queues[0].irq, macb_wol_interrupt,
 					       IRQF_SHARED, netdev->name, bp->queues);
 				dev_err(dev,
 					"Unable to request IRQ %d (error %d)\n",
 					bp->queues[0].irq, err);
-				spin_unlock_irqrestore(&bp->lock, flags);
 				return err;
 			}
+			spin_lock_irqsave(&bp->lock, flags);
 			queue_writel(bp->queues, IER, MACB_BIT(WOL));
 			macb_writel(bp, WOL, tmp);
+			spin_unlock_irqrestore(&bp->lock, flags);
 		}
-		spin_unlock_irqrestore(&bp->lock, flags);
 		enable_irq_wake(bp->queues[0].irq);
 	}
 		queue_readl(bp->queues, ISR);
 		if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
 			queue_writel(bp->queues, ISR, -1);
+		spin_unlock_irqrestore(&bp->lock, flags);
 		/* Replace interrupt handler on queue 0 */
 		devm_free_irq(dev, bp->queues[0].irq, bp->queues);
 		err = devm_request_irq(dev, bp->queues[0].irq, macb_interrupt,
 			dev_err(dev,
 				"Unable to request IRQ %d (error %d)\n",
 				bp->queues[0].irq, err);
-			spin_unlock_irqrestore(&bp->lock, flags);
 			return err;
 		}
-		spin_unlock_irqrestore(&bp->lock, flags);
 		disable_irq_wake(bp->queues[0].irq);

drivers/net/ethernet/freescale/enetc/enetc_ethtool.c+2−0

@@ -813,6 +813,8 @@ static void enetc_get_ringparam(struct net_device *ndev, · 812 unmodified lines
813	{	813	{
814	struct enetc_ndev_priv *priv = netdev_priv(ndev);	814	struct enetc_ndev_priv *priv = netdev_priv(ndev);
815		815
		816	ring->rx_max_pending = priv->rx_bd_count;
		817	ring->tx_max_pending = priv->tx_bd_count;
816	ring->rx_pending = priv->rx_bd_count;	818	ring->rx_pending = priv->rx_bd_count;
817	ring->tx_pending = priv->tx_bd_count;	819	ring->tx_pending = priv->tx_bd_count;
818		820

drivers/net/ethernet/intel/iavf/iavf_ethtool.c+15−16

 {
 	/* Report the maximum number queues, even if not every queue is
 	 * currently configured. Since allocation of queues is in pairs,
-	 * use netdev->real_num_tx_queues * 2. The real_num_tx_queues is set
+	 * use netdev->num_tx_queues * 2. The num_tx_queues is set at
-	 * at device creation and never changes.
+	 * device creation and never changes.
 	 */
 	if (sset == ETH_SS_STATS)
 		return IAVF_STATS_LEN +
-			(IAVF_QUEUE_STATS_LEN * 2 *
+		       (IAVF_QUEUE_STATS_LEN * 2 * netdev->num_tx_queues);
-			 netdev->real_num_tx_queues);
 	else
 		return -EINVAL;
 }
 	iavf_add_ethtool_stats(&data, adapter, iavf_gstrings_stats);
 	rcu_read_lock();
-	/* As num_active_queues describe both tx and rx queues, we can use
+	/* Use num_tx_queues to report stats for the maximum number of queues.
-	 * it to iterate over rings' stats.
+	 * Queues beyond num_active_queues will report zero.
 	 */
-	for (i = 0; i < adapter->num_active_queues; i++) {
+	for (i = 0; i < netdev->num_tx_queues; i++) {
-		struct iavf_ring *ring;
+		struct iavf_ring *tx_ring = NULL, *rx_ring = NULL;
-		/* Tx rings stats */
+		if (i < adapter->num_active_queues) {
-		ring = &adapter->tx_rings[i];
+			tx_ring = &adapter->tx_rings[i];
-		iavf_add_queue_stats(&data, ring);
+			rx_ring = &adapter->rx_rings[i];
+		}
-		/* Rx rings stats */
+		iavf_add_queue_stats(&data, tx_ring);
-		ring = &adapter->rx_rings[i];
+		iavf_add_queue_stats(&data, rx_ring);
-		iavf_add_queue_stats(&data, ring);
 	}
 	rcu_read_unlock();
 }
 	iavf_add_stat_strings(&data, iavf_gstrings_stats);
 	/* Queues are always allocated in pairs, so we just use
-	 * real_num_tx_queues for both Tx and Rx queues.
+	 * num_tx_queues for both Tx and Rx queues.
 	 */
-	for (i = 0; i < netdev->real_num_tx_queues; i++) {
+	for (i = 0; i < netdev->num_tx_queues; i++) {
 		iavf_add_stat_strings(&data, iavf_gstrings_queue_stats,
 				      "tx", i);
 		iavf_add_stat_strings(&data, iavf_gstrings_queue_stats,

drivers/net/ethernet/intel/ice/ice.h+22−0

@@ -839,6 +839,28 @@ static inline void ice_tx_xsk_pool(struct ice_vsi *vsi, u16 qid) · 838 unmodified lines
839	WRITE_ONCE(ring->xsk_pool, ice_get_xp_from_qid(vsi, qid));	839	WRITE_ONCE(ring->xsk_pool, ice_get_xp_from_qid(vsi, qid));
840	}	840	}
841		841
		842	/**
		843	* ice_get_max_txq - return the maximum number of Tx queues for in a PF
		844	* @pf: PF structure
		845	*
		846	* Return: maximum number of Tx queues
		847	*/
		848	static inline int ice_get_max_txq(struct ice_pf *pf)
		849	{
		850	return min(num_online_cpus(), pf->hw.func_caps.common_cap.num_txq);
		851	}
		852
		853	/**
		854	* ice_get_max_rxq - return the maximum number of Rx queues for in a PF
		855	* @pf: PF structure
		856	*
		857	* Return: maximum number of Rx queues
		858	*/
		859	static inline int ice_get_max_rxq(struct ice_pf *pf)
		860	{
		861	return min(num_online_cpus(), pf->hw.func_caps.common_cap.num_rxq);
		862	}
		863
842	/**	864	/**
843	* ice_get_main_vsi - Get the PF VSI	865	* ice_get_main_vsi - Get the PF VSI
844	* @pf: PF instance	866	* @pf: PF instance

drivers/net/ethernet/intel/ice/ice_ethtool.c+11−21

 	int i = 0;
 	char *p;
+	if (ice_is_port_repr_netdev(netdev)) {
+		ice_update_eth_stats(vsi);
+		for (j = 0; j < ICE_VSI_STATS_LEN; j++) {
+			p = (char *)vsi + ice_gstrings_vsi_stats[j].stat_offset;
+			data[i++] = (ice_gstrings_vsi_stats[j].sizeof_stat ==
+				     sizeof(u64)) ? *(u64 *)p : *(u32 *)p;
+		}
+		return;
+	}
 	ice_update_pf_stats(pf);
 	ice_update_vsi_stats(vsi);
 			     sizeof(u64)) ? *(u64 *)p : *(u32 *)p;
 	}
-	if (ice_is_port_repr_netdev(netdev))
-		return;
 	/* populate per queue stats */
 	rcu_read_lock();
 	return 0;
 }
-/**
- * ice_get_max_txq - return the maximum number of Tx queues for in a PF
- * @pf: PF structure
- */
-static int ice_get_max_txq(struct ice_pf *pf)
-{
-	return min(num_online_cpus(), pf->hw.func_caps.common_cap.num_txq);
-}
-/**
- * ice_get_max_rxq - return the maximum number of Rx queues for in a PF
- * @pf: PF structure
- */
-static int ice_get_max_rxq(struct ice_pf *pf)
-{
-	return min(num_online_cpus(), pf->hw.func_caps.common_cap.num_rxq);
-}
 /**
  * ice_get_combined_cnt - return the current number of combined channels
  * @vsi: PF VSI pointer

drivers/net/ethernet/intel/ice/ice_main.c+2−2

@@ -4699,8 +4699,8 @@ static int ice_cfg_netdev(struct ice_vsi *vsi) · 4698 unmodified lines
4699	struct net_device *netdev;	4699	struct net_device *netdev;
4700	u8 mac_addr[ETH_ALEN];	4700	u8 mac_addr[ETH_ALEN];
4701		4701
4702	netdev = alloc_etherdev_mqs(sizeof(*np), vsi->alloc_txq,	4702	netdev = alloc_etherdev_mqs(sizeof(*np), ice_get_max_txq(vsi->back),
4703	vsi->alloc_rxq);	4703	ice_get_max_rxq(vsi->back));
4704	if (!netdev)	4704	if (!netdev)
4705	return -ENOMEM;	4705	return -ENOMEM;
4706		4706

drivers/net/ethernet/intel/ice/ice_repr.c+3−2

 /* Copyright (C) 2019-2021, Intel Corporation. */
 #include "ice.h"
+#include "ice_lib.h"
 #include "ice_eswitch.h"
 #include "devlink/devlink.h"
 #include "devlink/port.h"
 		return;
 	vsi = repr->src_vsi;
-	ice_update_vsi_stats(vsi);
+	ice_update_eth_stats(vsi);
 	eth_stats = &vsi->eth_stats;
 	stats->tx_packets = eth_stats->tx_unicast + eth_stats->tx_broadcast +
 static int ice_repr_ready_vf(struct ice_repr *repr)
 {
-	return !ice_check_vf_ready_for_cfg(repr->vf);
+	return ice_check_vf_ready_for_cfg(repr->vf);
 }
 static int ice_repr_ready_sf(struct ice_repr *repr)

drivers/net/ethernet/intel/idpf/idpf.h+1−1

@@ -1066,7 +1066,7 @@ bool idpf_vport_set_hsplit(const struct idpf_vport *vport, u8 val); · 1065 unmodified lines
1066	int idpf_idc_init(struct idpf_adapter *adapter);	1066	int idpf_idc_init(struct idpf_adapter *adapter);
1067	int idpf_idc_init_aux_core_dev(struct idpf_adapter *adapter,	1067	int idpf_idc_init_aux_core_dev(struct idpf_adapter *adapter,
1068	enum iidc_function_type ftype);	1068	enum iidc_function_type ftype);
1069	void idpf_idc_deinit_core_aux_device(struct iidc_rdma_core_dev_info *cdev_info);	1069	void idpf_idc_deinit_core_aux_device(struct idpf_adapter *adapter);
1070	void idpf_idc_deinit_vport_aux_device(struct iidc_rdma_vport_dev_info *vdev_info);	1070	void idpf_idc_deinit_vport_aux_device(struct iidc_rdma_vport_dev_info *vdev_info);
1071	void idpf_idc_issue_reset_event(struct iidc_rdma_core_dev_info *cdev_info);	1071	void idpf_idc_issue_reset_event(struct iidc_rdma_core_dev_info *cdev_info);
1072	void idpf_idc_vdev_mtu_event(struct iidc_rdma_vport_dev_info *vdev_info,	1072	void idpf_idc_vdev_mtu_event(struct iidc_rdma_vport_dev_info *vdev_info,

drivers/net/ethernet/intel/idpf/idpf_idc.c+4−2

 /**
  * idpf_idc_deinit_core_aux_device - de-initialize Auxiliary Device(s)
- * @cdev_info: IDC core device info pointer
+ * @adapter: driver private data structure
  */
-void idpf_idc_deinit_core_aux_device(struct iidc_rdma_core_dev_info *cdev_info)
+void idpf_idc_deinit_core_aux_device(struct idpf_adapter *adapter)
 {
+	struct iidc_rdma_core_dev_info *cdev_info = adapter->cdev_info;
 	struct iidc_rdma_priv_dev_info *privd;
 	if (!cdev_info)
 	kfree(privd->mapped_mem_regions);
 	kfree(privd);
 	kfree(cdev_info);
+	adapter->cdev_info = NULL;
 }
 /**

drivers/net/ethernet/intel/idpf/idpf_txrx.c+1−1

 			idpf_queue_assign(HSPLIT_EN, q, hs);
 			idpf_queue_assign(RSC_EN, q, rsc);
-			bufq_set->num_refillqs = num_rxq;
 			bufq_set->refillqs = kcalloc(num_rxq, swq_size,
 						     GFP_KERNEL);
 			if (!bufq_set->refillqs) {
 				err = -ENOMEM;
 				goto err_alloc;
 			}
+			bufq_set->num_refillqs = num_rxq;
 			for (unsigned int k = 0; k < bufq_set->num_refillqs; k++) {
 				struct idpf_sw_queue *refillq =
 					&bufq_set->refillqs[k];

drivers/net/ethernet/intel/idpf/idpf_virtchnl.c+1−1

@@ -3668,7 +3668,7 @@ void idpf_vc_core_deinit(struct idpf_adapter *adapter) · 3667 unmodified lines
3668		3668
3669	idpf_ptp_release(adapter);	3669	idpf_ptp_release(adapter);
3670	idpf_deinit_task(adapter);	3670	idpf_deinit_task(adapter);
3671	idpf_idc_deinit_core_aux_device(adapter->cdev_info);	3671	idpf_idc_deinit_core_aux_device(adapter);
3672	idpf_rel_rx_pt_lkup(adapter);	3672	idpf_rel_rx_pt_lkup(adapter);
3673	idpf_intr_rel(adapter);	3673	idpf_intr_rel(adapter);
3674		3674

drivers/net/ethernet/microchip/lan743x_main.c+5−0

 	else if (speed == SPEED_100)
 		mac_cr |= MAC_CR_CFG_L_;
+	if (duplex == DUPLEX_FULL)
+		mac_cr |= MAC_CR_DPX_;
+	else
+		mac_cr &= ~MAC_CR_DPX_;
 	lan743x_csr_write(adapter, MAC_CR, mac_cr);
 	lan743x_ptp_update_latency(adapter, speed);

drivers/net/ethernet/microsoft/mana/mana_en.c+4−2

 	struct auxiliary_device *adev;
 	struct mana_adev *madev;
 	int ret;
+	int id;
 	madev = kzalloc_obj(*madev);
 	if (!madev)
 	ret = mana_adev_idx_alloc();
 	if (ret < 0)
 		goto idx_fail;
-	adev->id = ret;
+	id = ret;
+	adev->id = id;
 	adev->name = name;
 	adev->dev.parent = gd->gdma_context->dev;
 	auxiliary_device_uninit(adev);
 init_fail:
-	mana_adev_idx_free(adev->id);
+	mana_adev_idx_free(id);
 idx_fail:
 	kfree(madev);

drivers/net/ethernet/pensando/ionic/ionic_lif.c+11−6

 	if (ether_addr_equal(netdev->dev_addr, mac))
 		return 0;
-	err = ionic_program_mac(lif, mac);
+	/* Only program macs for virtual functions to avoid losing the permanent
-	if (err < 0)
+	 * Mac across warm reset/reboot.
-		return err;
+	 */
+	if (lif->ionic->pdev->is_virtfn) {
+		err = ionic_program_mac(lif, mac);
+		if (err < 0)
+			return err;
-	if (err > 0)
+		if (err > 0)
-		netdev_dbg(netdev, "%s: SET and GET ATTR Mac are not equal-due to old FW running\n",
+			netdev_dbg(netdev, "%s: SET and GET ATTR Mac are not equal-due to old FW running\n",
-			   __func__);
+				   __func__);
+	}
 	err = eth_prepare_mac_addr_change(netdev, addr);
 	if (err)

drivers/net/ethernet/ti/icssg/icssg_common.c+2−2

 		pkt_len -= 4;
 		cppi5_desc_get_tags_ids(&desc_rx->hdr, &port_id, NULL);
 		psdata = cppi5_hdesc_get_psdata(desc_rx);
-		k3_cppi_desc_pool_free(rx_chn->desc_pool, desc_rx);
 		count++;
 		xsk_buff_set_size(xdp, pkt_len);
 		xsk_buff_dma_sync_for_cpu(xdp);
 			emac_dispatch_skb_zc(emac, xdp, psdata);
 			xsk_buff_free(xdp);
 		}
+		k3_cppi_desc_pool_free(rx_chn->desc_pool, desc_rx);
 	}
 	if (xdp_status & ICSSG_XDP_REDIR)
 	/* firmware adds 4 CRC bytes, strip them */
 	pkt_len -= 4;
 	cppi5_desc_get_tags_ids(&desc_rx->hdr, &port_id, NULL);
-	k3_cppi_desc_pool_free(rx_chn->desc_pool, desc_rx);
 	/* if allocation fails we drop the packet but push the
 	 * descriptor back to the ring with old page to prevent a stall
 	ndev->stats.rx_packets++;
 requeue:
+	k3_cppi_desc_pool_free(rx_chn->desc_pool, desc_rx);
 	/* queue another RX DMA */
 	ret = prueth_dma_rx_push_mapped(emac, &emac->rx_chns, new_page,
 					PRUETH_MAX_PKT_SIZE);

drivers/net/team/team_core.c+64−1

@@ -2058,6 +2058,68 @@ static const struct ethtool_ops team_ethtool_ops = { · 2057 unmodified lines
2058	* rt netlink interface	2058	* rt netlink interface
2059	***********************/	2059	***********************/
2060		2060
		2061	/* For tx path we need a linkup && enabled port and for parse any port
		2062	* suffices.
		2063	*/
		2064	static struct team_port team_header_port_get_rcu(struct team team,
		2065	bool txable)
		2066	{
		2067	struct team_port *port;
		2068
		2069	list_for_each_entry_rcu(port, &team->port_list, list) {
		2070	if (!txable \|\| team_port_txable(port))
		2071	return port;
		2072	}
		2073
		2074	return NULL;
		2075	}
		2076
		2077	static int team_header_create(struct sk_buff skb, struct net_device team_dev,
		2078	unsigned short type, const void *daddr,
		2079	const void *saddr, unsigned int len)
		2080	{
		2081	struct team *team = netdev_priv(team_dev);
		2082	const struct header_ops *port_ops;
		2083	struct team_port *port;
		2084	int ret = 0;
		2085
		2086	rcu_read_lock();
		2087	port = team_header_port_get_rcu(team, true);
		2088	if (port) {
		2089	port_ops = READ_ONCE(port->dev->header_ops);
		2090	if (port_ops && port_ops->create)
		2091	ret = port_ops->create(skb, port->dev,
		2092	type, daddr, saddr, len);
		2093	}
		2094	rcu_read_unlock();
		2095	return ret;
		2096	}
		2097
		2098	static int team_header_parse(const struct sk_buff *skb,
		2099	const struct net_device *team_dev,
		2100	unsigned char *haddr)
		2101	{
		2102	struct team *team = netdev_priv(team_dev);
		2103	const struct header_ops *port_ops;
		2104	struct team_port *port;
		2105	int ret = 0;
		2106
		2107	rcu_read_lock();
		2108	port = team_header_port_get_rcu(team, false);
		2109	if (port) {
		2110	port_ops = READ_ONCE(port->dev->header_ops);
		2111	if (port_ops && port_ops->parse)
		2112	ret = port_ops->parse(skb, port->dev, haddr);
		2113	}
		2114	rcu_read_unlock();
		2115	return ret;
		2116	}
		2117
		2118	static const struct header_ops team_header_ops = {
		2119	.create = team_header_create,
		2120	.parse = team_header_parse,
		2121	};
		2122
2061	static void team_setup_by_port(struct net_device *dev,	2123	static void team_setup_by_port(struct net_device *dev,
2062	struct net_device *port_dev)	2124	struct net_device *port_dev)
2063	{	2125	{
@@ -2066,7 +2128,8 @@ static void team_setup_by_port(struct net_device *dev, · 2 unmodified lines
2066	if (port_dev->type == ARPHRD_ETHER)	2128	if (port_dev->type == ARPHRD_ETHER)
2067	dev->header_ops = team->header_ops_cache;	2129	dev->header_ops = team->header_ops_cache;
2068	else	2130	else
2069	dev->header_ops = port_dev->header_ops;	2131	dev->header_ops = port_dev->header_ops ?
		2132	&team_header_ops : NULL;
2070	dev->type = port_dev->type;	2133	dev->type = port_dev->type;
2071	dev->hard_header_len = port_dev->hard_header_len;	2134	dev->hard_header_len = port_dev->hard_header_len;
2072	dev->needed_headroom = port_dev->needed_headroom;	2135	dev->needed_headroom = port_dev->needed_headroom;

drivers/net/tun_vnet.h+1−1

@@ -244,7 +244,7 @@ tun_vnet_hdr_tnl_from_skb(unsigned int flags, · 243 unmodified lines
244		244
245	if (virtio_net_hdr_tnl_from_skb(skb, tnl_hdr, has_tnl_offload,	245	if (virtio_net_hdr_tnl_from_skb(skb, tnl_hdr, has_tnl_offload,
246	tun_vnet_is_little_endian(flags),	246	tun_vnet_is_little_endian(flags),
247	vlan_hlen, true)) {	247	vlan_hlen, true, false)) {
248	struct virtio_net_hdr_v1 *hdr = &tnl_hdr->hash_hdr.hdr;	248	struct virtio_net_hdr_v1 *hdr = &tnl_hdr->hash_hdr.hdr;
249	struct skb_shared_info *sinfo = skb_shinfo(skb);	249	struct skb_shared_info *sinfo = skb_shinfo(skb);
250		250

drivers/net/virtio_net.c+6−1

 	struct virtio_net_hdr_v1_hash_tunnel *hdr;
 	int num_sg;
 	unsigned hdr_len = vi->hdr_len;
+	bool feature_hdrlen;
 	bool can_push;
+	feature_hdrlen = virtio_has_feature(vi->vdev,
+					    VIRTIO_NET_F_GUEST_HDRLEN);
 	pr_debug("%s: xmit %p %pM\n", vi->dev->name, skb, dest);
 	/* Make sure it's safe to cast between formats */
 	if (virtio_net_hdr_tnl_from_skb(skb, hdr, vi->tx_tnl,
 					virtio_is_little_endian(vi->vdev), 0,
-					false))
+					false, feature_hdrlen))
 		return -EPROTO;
 	if (vi->mergeable_rx_bufs)
 	/* Don't wait up for transmitted skbs to be freed. */
 	if (!use_napi) {
 		skb_orphan(skb);
+		skb_dst_drop(skb);
 		nf_reset_ct(skb);
 	}

drivers/pci/pwrctrl/core.c+3−1

 			struct device_node *remote __free(device_node) =
 				of_graph_get_remote_port_parent(endpoint);
 			if (remote) {
-				if (of_pci_supply_present(remote))
+				if (of_pci_supply_present(remote)) {
+					of_node_put(endpoint);
 					return true;
+				}
 			}
 		}
 	}

drivers/pci/pwrctrl/pci-pwrctrl-pwrseq.c+0−12

 	return pwrseq_power_off(pwrseq->pwrseq);
 }
-static void devm_pwrseq_pwrctrl_power_off(void *data)
-{
-	struct pwrseq_pwrctrl *pwrseq = data;
-	pwrseq_pwrctrl_power_off(&pwrseq->pwrctrl);
-}
 static int pwrseq_pwrctrl_probe(struct platform_device *pdev)
 {
 	const struct pwrseq_pwrctrl_pdata *pdata;
 		return dev_err_probe(dev, PTR_ERR(pwrseq->pwrseq),
 				     "Failed to get the power sequencer\n");
-	ret = devm_add_action_or_reset(dev, devm_pwrseq_pwrctrl_power_off,
-				       pwrseq);
-	if (ret)
-		return ret;
 	pwrseq->pwrctrl.power_on = pwrseq_pwrctrl_power_on;
 	pwrseq->pwrctrl.power_off = pwrseq_pwrctrl_power_off;

drivers/pci/pwrctrl/slot.c+0−1

@@ -63,7 +63,6 @@ static void devm_slot_pwrctrl_release(void *data) · 62 unmodified lines
63	{	63	{
64	struct slot_pwrctrl *slot = data;	64	struct slot_pwrctrl *slot = data;
65		65
66	slot_pwrctrl_power_off(&slot->pwrctrl);
67	regulator_bulk_free(slot->num_supplies, slot->supplies);	66	regulator_bulk_free(slot->num_supplies, slot->supplies);
68	}	67	}
69		68

drivers/phy/Kconfig+2−3

 menu "PHY Subsystem"
 config PHY_COMMON_PROPS
-	bool
+	bool "PHY common properties" if KUNIT_ALL_TESTS
 	help
 	  This parses properties common between generic PHYs and Ethernet PHYs.
 config PHY_COMMON_PROPS_TEST
 	tristate "KUnit tests for PHY common props" if !KUNIT_ALL_TESTS
-	select PHY_COMMON_PROPS
+	depends on KUNIT && PHY_COMMON_PROPS
-	depends on KUNIT
 	default KUNIT_ALL_TESTS
 	help
 	  This builds KUnit tests for the PHY common property API.

drivers/phy/freescale/phy-fsl-lynx-28g.c+2−0

@@ -1069,6 +1069,8 @@ static void lynx_28g_cdr_lock_check(struct work_struct *work) · 1068 unmodified lines
1069		1069
1070	for (i = 0; i < LYNX_28G_NUM_LANE; i++) {	1070	for (i = 0; i < LYNX_28G_NUM_LANE; i++) {
1071	lane = &priv->lane[i];	1071	lane = &priv->lane[i];
		1072	if (!lane->phy)
		1073	continue;
1072		1074
1073	mutex_lock(&lane->phy->mutex);	1075	mutex_lock(&lane->phy->mutex);
1074		1076

drivers/phy/qualcomm/phy-qcom-qmp-ufs.c+1−2

 	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_MULTI_LANE_CTRL1, 0x02),
 	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_TX_MID_TERM_CTRL1, 0x43),
 	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_PCS_CTRL1, 0xc1),
+	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_PLL_CNTL, 0x33),
 	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_TX_LARGE_AMP_DRV_LVL, 0x0f),
 	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_RX_SIGDET_CTRL2, 0x68),
 	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_TX_POST_EMP_LVL_S4, 0x0e),
 };
 static const struct qmp_phy_init_tbl sm8650_ufsphy_g4_pcs[] = {
-	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_PLL_CNTL, 0x13),
 	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_TX_HSGEAR_CAPABILITY, 0x04),
 	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_RX_HSGEAR_CAPABILITY, 0x04),
 };
 static const struct qmp_phy_init_tbl sm8650_ufsphy_g5_pcs[] = {
-	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_PLL_CNTL, 0x33),
 	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_TX_HSGEAR_CAPABILITY, 0x05),
 	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_RX_HSGEAR_CAPABILITY, 0x05),
 	QMP_PHY_INIT_CFG(QPHY_V6_PCS_UFS_RX_HS_G5_SYNC_LENGTH_CAPABILITY, 0x4d),

drivers/phy/spacemit/phy-k1-usb2.c+14−0

 #define  PHY_CLK_HSTXP_EN		BIT(3)		/* clock hstxp enable */
 #define  PHY_HSTXP_MODE			BIT(4)		/* 0: force en_txp to be 1; 1: no force */
+#define PHY_K1_HS_HOST_DISC		0x40
+#define  PHY_K1_HS_HOST_DISC_CLR		BIT(0)
 #define PHY_PLL_DIV_CFG			0x98
 #define  PHY_FDIV_FRACT_8_15		GENMASK(7, 0)
 #define  PHY_FDIV_FRACT_16_19		GENMASK(11, 8)
 	return 0;
 }
+static int spacemit_usb2phy_disconnect(struct phy *phy, int port)
+{
+	struct spacemit_usb2phy *sphy = phy_get_drvdata(phy);
+	regmap_update_bits(sphy->regmap_base, PHY_K1_HS_HOST_DISC,
+			   PHY_K1_HS_HOST_DISC_CLR, PHY_K1_HS_HOST_DISC_CLR);
+	return 0;
+}
 static const struct phy_ops spacemit_usb2phy_ops = {
 	.init = spacemit_usb2phy_init,
 	.exit = spacemit_usb2phy_exit,
+	.disconnect = spacemit_usb2phy_disconnect,
 	.owner = THIS_MODULE,
 };

drivers/phy/ti/phy-j721e-wiz.c+2−0

 			dev_err(dev,
 				"%s: Reading \"reg\" from \"%s\" failed: %d\n",
 				__func__, subnode->name, ret);
+			of_node_put(serdes);
 			return ret;
 		}
 		of_property_read_u32(subnode, "cdns,num-lanes", &num_lanes);
 		}
 	}
+	of_node_put(serdes);
 	return 0;
 }

drivers/pinctrl/mediatek/pinctrl-mtk-common.c+6−3

 		goto chip_error;
 	}
-	ret = mtk_eint_init(pctl, pdev);
+	/* Only initialize EINT if we have EINT pins */
-	if (ret)
+	if (data->eint_hw.ap_num > 0) {
-		goto chip_error;
+		ret = mtk_eint_init(pctl, pdev);
+		if (ret)
+			goto chip_error;
+	}
 	return 0;

drivers/pinctrl/qcom/pinctrl-spmi-gpio.c+16−0

@@ -723,6 +723,21 @@ static const struct pinconf_ops pmic_gpio_pinconf_ops = { · 722 unmodified lines
723	.pin_config_group_dbg_show = pmic_gpio_config_dbg_show,	723	.pin_config_group_dbg_show = pmic_gpio_config_dbg_show,
724	};	724	};
725		725
		726	static int pmic_gpio_get_direction(struct gpio_chip *chip, unsigned pin)
		727	{
		728	struct pmic_gpio_state *state = gpiochip_get_data(chip);
		729	struct pmic_gpio_pad *pad;
		730
		731	pad = state->ctrl->desc->pins[pin].drv_data;
		732
		733	if (!pad->is_enabled \|\| pad->analog_pass \|\|
		734	(!pad->input_enabled && !pad->output_enabled))
		735	return -EINVAL;
		736
		737	/* Make sure the state is aligned on what pmic_gpio_get() returns */
		738	return pad->input_enabled ? GPIO_LINE_DIRECTION_IN : GPIO_LINE_DIRECTION_OUT;
		739	}
		740
726	static int pmic_gpio_direction_input(struct gpio_chip *chip, unsigned pin)	741	static int pmic_gpio_direction_input(struct gpio_chip *chip, unsigned pin)
727	{	742	{
728	struct pmic_gpio_state *state = gpiochip_get_data(chip);	743	struct pmic_gpio_state *state = gpiochip_get_data(chip);
@@ -801,6 +816,7 @@ static void pmic_gpio_dbg_show(struct seq_file s, struct gpio_chip chip) · 72 unmodified lines
801	}	816	}
802		817
803	static const struct gpio_chip pmic_gpio_gpio_template = {	818	static const struct gpio_chip pmic_gpio_gpio_template = {
		819	.get_direction = pmic_gpio_get_direction,
804	.direction_input = pmic_gpio_direction_input,	820	.direction_input = pmic_gpio_direction_input,
805	.direction_output = pmic_gpio_direction_output,	821	.direction_output = pmic_gpio_direction_output,
806	.get = pmic_gpio_get,	822	.get = pmic_gpio_get,

drivers/pinctrl/renesas/pinctrl-rza1.c+1−1

@@ -589,7 +589,7 @@ static inline unsigned int rza1_get_bit(struct rza1_port *port, · 588 unmodified lines
589	{	589	{
590	void __iomem *mem = RZA1_ADDR(port->base, reg, port->id);	590	void __iomem *mem = RZA1_ADDR(port->base, reg, port->id);
591		591
592	return ioread16(mem) & BIT(bit);	592	return !!(ioread16(mem) & BIT(bit));
593	}	593	}
594		594
595	/**	595	/**

drivers/pinctrl/renesas/pinctrl-rzt2h.c+8−7

 	struct gpio_chip		gpio_chip;
 	struct pinctrl_gpio_range	gpio_range;
 	DECLARE_BITMAP(used_irqs, RZT2H_INTERRUPTS_NUM);
-	spinlock_t			lock; /* lock read/write registers */
+	raw_spinlock_t			lock; /* lock read/write registers */
 	struct mutex			mutex; /* serialize adding groups and functions */
 	bool				safety_port_enabled;
 	atomic_t			wakeup_path;
 	u64 reg64;
 	u16 reg16;
-	guard(spinlock_irqsave)(&pctrl->lock);
+	guard(raw_spinlock_irqsave)(&pctrl->lock);
 	/* Set pin to 'Non-use (Hi-Z input protection)'  */
 	reg16 = rzt2h_pinctrl_readw(pctrl, port, PM(port));
 	if (ret)
 		return ret;
-	guard(spinlock_irqsave)(&pctrl->lock);
+	guard(raw_spinlock_irqsave)(&pctrl->lock);
 	/* Select GPIO mode in PMC Register */
 	rzt2h_pinctrl_set_gpio_en(pctrl, port, bit, true);
 {
 	u16 reg;
-	guard(spinlock_irqsave)(&pctrl->lock);
+	guard(raw_spinlock_irqsave)(&pctrl->lock);
 	reg = rzt2h_pinctrl_readw(pctrl, port, PM(port));
 	reg &= ~PM_PIN_MASK(bit);
 	if (ret)
 		return ret;
-	guard(spinlock_irqsave)(&pctrl->lock);
+	guard(raw_spinlock_irqsave)(&pctrl->lock);
 	if (rzt2h_pinctrl_readb(pctrl, port, PMC(port)) & BIT(bit)) {
 		/*
 	u8 bit = RZT2H_PIN_ID_TO_PIN(offset);
 	u8 reg;
-	guard(spinlock_irqsave)(&pctrl->lock);
+	guard(raw_spinlock_irqsave)(&pctrl->lock);
 	reg = rzt2h_pinctrl_readb(pctrl, port, P(port));
 	if (value)
 	if (ret)
 		return dev_err_probe(dev, ret, "Unable to parse gpio-ranges\n");
+	of_node_put(of_args.np);
 	if (of_args.args[0] != 0 || of_args.args[1] != 0 ||
 	    of_args.args[2] != pctrl->data->n_port_pins)
 		return dev_err_probe(dev, -EINVAL,
 	if (ret)
 		return ret;
-	spin_lock_init(&pctrl->lock);
+	raw_spin_lock_init(&pctrl->lock);
 	mutex_init(&pctrl->mutex);
 	platform_set_drvdata(pdev, pctrl);

drivers/pinctrl/stm32/Kconfig+1−0

@@ -65,6 +65,7 @@ config PINCTRL_STM32_HDP · 64 unmodified lines
65	select PINMUX	65	select PINMUX
66	select GENERIC_PINCONF	66	select GENERIC_PINCONF
67	select GPIOLIB	67	select GPIOLIB
		68	select GPIO_GENERIC
68	help	69	help
69	The Hardware Debug Port allows the observation of internal signals.	70	The Hardware Debug Port allows the observation of internal signals.
70	It uses configurable multiplexer to route signals in a dedicated observation register.	71	It uses configurable multiplexer to route signals in a dedicated observation register.

drivers/pinctrl/sunxi/pinctrl-sunxi.c+32−11

 					 const char *pin_name,
 					 const char *func_name)
 {
+	unsigned long variant = pctl->flags & SUNXI_PINCTRL_VARIANT_MASK;
 	int i;
 	for (i = 0; i < pctl->desc->npins; i++) {
 			while (func->name) {
 				if (!strcmp(func->name, func_name) &&
 					(!func->variant ||
-					func->variant & pctl->variant))
+					func->variant & variant))
 					return func;
 				func++;
 						const u16 pin_num,
 						const u8 muxval)
 {
+	unsigned long variant = pctl->flags & SUNXI_PINCTRL_VARIANT_MASK;
 	for (unsigned int i = 0; i < pctl->desc->npins; i++) {
 		const struct sunxi_desc_pin *pin = pctl->desc->pins + i;
 		struct sunxi_desc_function *func = pin->functions;
 		if (pin->pin.number != pin_num)
 			continue;
-		if (pin->variant && !(pctl->variant & pin->variant))
+		if (pin->variant && !(variant & pin->variant))
 			continue;
 		while (func->name) {
 {
 	struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d);
 	struct sunxi_desc_function *func;
+	unsigned int offset;
+	u32 reg, shift, mask;
+	u8 disabled_mux, muxval;
 	int ret;
 	func = sunxi_pinctrl_desc_find_function_by_pin(pctl,
 	if (!func)
 		return -EINVAL;
-	ret = gpiochip_lock_as_irq(pctl->chip,
+	offset = pctl->irq_array[d->hwirq] - pctl->desc->pin_base;
-			pctl->irq_array[d->hwirq] - pctl->desc->pin_base);
+	sunxi_mux_reg(pctl, offset, &reg, &shift, &mask);
+	muxval = (readl(pctl->membase + reg) & mask) >> shift;
+	/* Change muxing to GPIO INPUT mode if at reset value */
+	if (pctl->flags & SUNXI_PINCTRL_NEW_REG_LAYOUT)
+		disabled_mux = SUN4I_FUNC_DISABLED_NEW;
+	else
+		disabled_mux = SUN4I_FUNC_DISABLED_OLD;
+	if (muxval == disabled_mux)
+		sunxi_pmx_set(pctl->pctl_dev, pctl->irq_array[d->hwirq],
+			      SUN4I_FUNC_INPUT);
+	ret = gpiochip_lock_as_irq(pctl->chip, offset);
 	if (ret) {
 		dev_err(pctl->dev, "unable to lock HW IRQ %lu for IRQ\n",
 			irqd_to_hwirq(d));
 static int sunxi_pinctrl_build_state(struct platform_device *pdev)
 {
 	struct sunxi_pinctrl *pctl = platform_get_drvdata(pdev);
+	unsigned long variant = pctl->flags & SUNXI_PINCTRL_VARIANT_MASK;
 	void *ptr;
 	int i;
 		const struct sunxi_desc_pin *pin = pctl->desc->pins + i;
 		struct sunxi_pinctrl_group *group = pctl->groups + pctl->ngroups;
-		if (pin->variant && !(pctl->variant & pin->variant))
+		if (pin->variant && !(variant & pin->variant))
 			continue;
 		group->name = pin->pin.name;
 		const struct sunxi_desc_pin *pin = pctl->desc->pins + i;
 		struct sunxi_desc_function *func;
-		if (pin->variant && !(pctl->variant & pin->variant))
+		if (pin->variant && !(variant & pin->variant))
 			continue;
 		for (func = pin->functions; func->name; func++) {
-			if (func->variant && !(pctl->variant & func->variant))
+			if (func->variant && !(variant & func->variant))
 				continue;
 			/* Create interrupt mapping while we're at it */
 		const struct sunxi_desc_pin *pin = pctl->desc->pins + i;
 		struct sunxi_desc_function *func;
-		if (pin->variant && !(pctl->variant & pin->variant))
+		if (pin->variant && !(variant & pin->variant))
 			continue;
 		for (func = pin->functions; func->name; func++) {
 			struct sunxi_pinctrl_function *func_item;
 			const char **func_grp;
-			if (func->variant && !(pctl->variant & func->variant))
+			if (func->variant && !(variant & func->variant))
 				continue;
 			func_item = sunxi_pinctrl_find_function_by_name(pctl,
 	pctl->dev = &pdev->dev;
 	pctl->desc = desc;
-	pctl->variant = flags & SUNXI_PINCTRL_VARIANT_MASK;
+	pctl->flags = flags;
 	if (flags & SUNXI_PINCTRL_NEW_REG_LAYOUT) {
 		pctl->bank_mem_size = D1_BANK_MEM_SIZE;
 		pctl->pull_regs_offset = D1_PULL_REGS_OFFSET;
 	for (i = 0, pin_idx = 0; i < pctl->desc->npins; i++) {
 		const struct sunxi_desc_pin *pin = pctl->desc->pins + i;
+		unsigned long variant = pctl->flags & SUNXI_PINCTRL_VARIANT_MASK;
-		if (pin->variant && !(pctl->variant & pin->variant))
+		if (pin->variant && !(variant & pin->variant))
 			continue;
 		pins[pin_idx++] = pin->pin;

drivers/pinctrl/sunxi/pinctrl-sunxi.h+3−1

 #define SUN4I_FUNC_INPUT	0
 #define SUN4I_FUNC_IRQ		6
+#define SUN4I_FUNC_DISABLED_OLD 7
+#define SUN4I_FUNC_DISABLED_NEW 15
 #define SUNXI_PINCTRL_VARIANT_MASK	GENMASK(7, 0)
 #define SUNXI_PINCTRL_NEW_REG_LAYOUT	BIT(8)
 	unsigned			*irq_array;
 	raw_spinlock_t			lock;
 	struct pinctrl_dev		*pctl_dev;
-	unsigned long			variant;
+	unsigned long			flags;
 	u32				bank_mem_size;
 	u32				pull_regs_offset;
 	u32				dlevel_field_width;

drivers/platform/olpc/olpc-xo175-ec.c+1−1

@@ -482,7 +482,7 @@ static int olpc_xo175_ec_cmd(u8 cmd, u8 inbuf, size_t inlen, u8 resp, · 481 unmodified lines
482	dev_dbg(dev, "CMD %x, %zd bytes expected\n", cmd, resp_len);	482	dev_dbg(dev, "CMD %x, %zd bytes expected\n", cmd, resp_len);
483		483
484	if (inlen > 5) {	484	if (inlen > 5) {
485	dev_err(dev, "command len %zd too big!\n", resp_len);	485	dev_err(dev, "command len %zd too big!\n", inlen);
486	return -EOVERFLOW;	486	return -EOVERFLOW;
487	}	487	}
488		488

drivers/platform/x86/amd/hsmp/hsmp.c+1−1

@@ -117,7 +117,7 @@ static int __hsmp_send_message(struct hsmp_socket sock, struct hsmp_message ms · 116 unmodified lines
117	}	117	}
118		118
119	if (unlikely(mbox_status == HSMP_STATUS_NOT_READY)) {	119	if (unlikely(mbox_status == HSMP_STATUS_NOT_READY)) {
120	dev_err(sock->dev, "Message ID 0x%X failure : SMU tmeout (status = 0x%X)\n",	120	dev_err(sock->dev, "Message ID 0x%X failure : SMU timeout (status = 0x%X)\n",
121	msg->msg_id, mbox_status);	121	msg->msg_id, mbox_status);
122	return -ETIMEDOUT;	122	return -ETIMEDOUT;
123	} else if (unlikely(mbox_status == HSMP_ERR_INVALID_MSG)) {	123	} else if (unlikely(mbox_status == HSMP_ERR_INVALID_MSG)) {

drivers/platform/x86/asus-armoury.h+77−0

@@ -1080,6 +1080,20 @@ static const struct dmi_system_id power_limits[] = { · 1079 unmodified lines
1080	.requires_fan_curve = true,	1080	.requires_fan_curve = true,
1081	},	1081	},
1082	},	1082	},
		1083	{
		1084	.matches = {
		1085	DMI_MATCH(DMI_BOARD_NAME, "GA503QM"),
		1086	},
		1087	.driver_data = &(struct power_data) {
		1088	.ac_data = &(struct power_limits) {
		1089	.ppt_pl1_spl_min = 15,
		1090	.ppt_pl1_spl_def = 35,
		1091	.ppt_pl1_spl_max = 80,
		1092	.ppt_pl2_sppt_min = 65,
		1093	.ppt_pl2_sppt_max = 80,
		1094	},
		1095	},
		1096	},
1083	{	1097	{
1084	.matches = {	1098	.matches = {
1085	DMI_MATCH(DMI_BOARD_NAME, "GA503QR"),	1099	DMI_MATCH(DMI_BOARD_NAME, "GA503QR"),
@@ -1518,6 +1532,35 @@ static const struct dmi_system_id power_limits[] = { · 432 unmodified lines
1518	},	1532	},
1519	},	1533	},
1520	},	1534	},
		1535	{
		1536	.matches = {
		1537	DMI_MATCH(DMI_BOARD_NAME, "GZ302EA"),
		1538	},
		1539	.driver_data = &(struct power_data) {
		1540	.ac_data = &(struct power_limits) {
		1541	.ppt_pl1_spl_min = 28,
		1542	.ppt_pl1_spl_def = 60,
		1543	.ppt_pl1_spl_max = 80,
		1544	.ppt_pl2_sppt_min = 32,
		1545	.ppt_pl2_sppt_def = 75,
		1546	.ppt_pl2_sppt_max = 92,
		1547	.ppt_pl3_fppt_min = 45,
		1548	.ppt_pl3_fppt_def = 86,
		1549	.ppt_pl3_fppt_max = 93,
		1550	},
		1551	.dc_data = &(struct power_limits) {
		1552	.ppt_pl1_spl_min = 28,
		1553	.ppt_pl1_spl_def = 45,
		1554	.ppt_pl1_spl_max = 80,
		1555	.ppt_pl2_sppt_min = 32,
		1556	.ppt_pl2_sppt_def = 52,
		1557	.ppt_pl2_sppt_max = 92,
		1558	.ppt_pl3_fppt_min = 45,
		1559	.ppt_pl3_fppt_def = 71,
		1560	.ppt_pl3_fppt_max = 93,
		1561	},
		1562	},
		1563	},
1521	{	1564	{
1522	.matches = {	1565	.matches = {
1523	DMI_MATCH(DMI_BOARD_NAME, "G513I"),	1566	DMI_MATCH(DMI_BOARD_NAME, "G513I"),
@@ -1596,6 +1639,40 @@ static const struct dmi_system_id power_limits[] = { · 72 unmodified lines
1596	.requires_fan_curve = true,	1639	.requires_fan_curve = true,
1597	},	1640	},
1598	},	1641	},
		1642	{
		1643	.matches = {
		1644	DMI_MATCH(DMI_BOARD_NAME, "G614FP"),
		1645	},
		1646	.driver_data = &(struct power_data) {
		1647	.ac_data = &(struct power_limits) {
		1648	.ppt_pl1_spl_min = 30,
		1649	.ppt_pl1_spl_max = 120,
		1650	.ppt_pl2_sppt_min = 65,
		1651	.ppt_pl2_sppt_def = 140,
		1652	.ppt_pl2_sppt_max = 165,
		1653	.ppt_pl3_fppt_min = 65,
		1654	.ppt_pl3_fppt_def = 140,
		1655	.ppt_pl3_fppt_max = 165,
		1656	.nv_temp_target_min = 75,
		1657	.nv_temp_target_max = 87,
		1658	.nv_dynamic_boost_min = 5,
		1659	.nv_dynamic_boost_max = 15,
		1660	.nv_tgp_min = 50,
		1661	.nv_tgp_max = 100,
		1662	},
		1663	.dc_data = &(struct power_limits) {
		1664	.ppt_pl1_spl_min = 25,
		1665	.ppt_pl1_spl_max = 65,
		1666	.ppt_pl2_sppt_min = 25,
		1667	.ppt_pl2_sppt_max = 65,
		1668	.ppt_pl3_fppt_min = 35,
		1669	.ppt_pl3_fppt_max = 75,
		1670	.nv_temp_target_min = 75,
		1671	.nv_temp_target_max = 87,
		1672	},
		1673	.requires_fan_curve = true,
		1674	},
		1675	},
1599	{	1676	{
1600	.matches = {	1677	.matches = {
1601	DMI_MATCH(DMI_BOARD_NAME, "G614J"),	1678	DMI_MATCH(DMI_BOARD_NAME, "G614J"),

drivers/platform/x86/asus-nb-wmi.c+1−1

@@ -548,7 +548,7 @@ static const struct dmi_system_id asus_quirks[] = { · 547 unmodified lines
548	.callback = dmi_matched,	548	.callback = dmi_matched,
549	.ident = "ASUS ROG Z13",	549	.ident = "ASUS ROG Z13",
550	.matches = {	550	.matches = {
551	DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),	551	DMI_MATCH(DMI_SYS_VENDOR, "ASUS"),
552	DMI_MATCH(DMI_PRODUCT_NAME, "ROG Flow Z13"),	552	DMI_MATCH(DMI_PRODUCT_NAME, "ROG Flow Z13"),
553	},	553	},
554	.driver_data = &quirk_asus_z13,	554	.driver_data = &quirk_asus_z13,

drivers/platform/x86/hp/hp-wmi.c+19−0

 	.ec_tp_offset	= HP_VICTUS_S_EC_THERMAL_PROFILE_OFFSET,
 };
+static const struct thermal_profile_params omen_v1_legacy_thermal_params = {
+	.performance	= HP_OMEN_V1_THERMAL_PROFILE_PERFORMANCE,
+	.balanced	= HP_OMEN_V1_THERMAL_PROFILE_DEFAULT,
+	.low_power	= HP_OMEN_V1_THERMAL_PROFILE_DEFAULT,
+	.ec_tp_offset	= HP_OMEN_EC_THERMAL_PROFILE_OFFSET,
+};
 /*
  * A generic pointer for the currently-active board's thermal profile
  * parameters.
 /* DMI Board names of Victus 16-r and Victus 16-s laptops */
 static const struct dmi_system_id victus_s_thermal_profile_boards[] __initconst = {
+	{
+		.matches = { DMI_MATCH(DMI_BOARD_NAME, "8A4D") },
+		.driver_data = (void *)&omen_v1_legacy_thermal_params,
+	},
 	{
 		.matches = { DMI_MATCH(DMI_BOARD_NAME, "8BAB") },
 		.driver_data = (void *)&omen_v1_thermal_params,
 		.matches = { DMI_MATCH(DMI_BOARD_NAME, "8BBE") },
 		.driver_data = (void *)&victus_s_thermal_params,
 	},
+	{
+		.matches = { DMI_MATCH(DMI_BOARD_NAME, "8BCA") },
+		.driver_data = (void *)&omen_v1_thermal_params,
+	},
 	{
 		.matches = { DMI_MATCH(DMI_BOARD_NAME, "8BCD") },
 		.driver_data = (void *)&omen_v1_thermal_params,
 		.matches = { DMI_MATCH(DMI_BOARD_NAME, "8BD5") },
 		.driver_data = (void *)&victus_s_thermal_params,
 	},
+	{
+		.matches = { DMI_MATCH(DMI_BOARD_NAME, "8C76") },
+		.driver_data = (void *)&omen_v1_thermal_params,
+	},
 	{
 		.matches = { DMI_MATCH(DMI_BOARD_NAME, "8C78") },
 		.driver_data = (void *)&omen_v1_thermal_params,

drivers/platform/x86/intel/hid.c+9−1

 	return 0;
 }
+static int intel_hid_pl_freeze_handler(struct device *device)
+{
+	struct intel_hid_priv *priv = dev_get_drvdata(device);
+	priv->wakeup_mode = false;
+	return intel_hid_pl_suspend_handler(device);
+}
 static int intel_hid_pl_resume_handler(struct device *device)
 {
 	intel_hid_pm_complete(device);
 static const struct dev_pm_ops intel_hid_pl_pm_ops = {
 	.prepare = intel_hid_pm_prepare,
 	.complete = intel_hid_pm_complete,
-	.freeze  = intel_hid_pl_suspend_handler,
+	.freeze  = intel_hid_pl_freeze_handler,
 	.thaw  = intel_hid_pl_resume_handler,
 	.restore  = intel_hid_pl_resume_handler,
 	.suspend  = intel_hid_pl_suspend_handler,

drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c+4−1

 {
 	u64 value;
+	if (!static_cpu_has(X86_FEATURE_HWP))
+		return true;
 	rdmsrq(MSR_PM_ENABLE, value);
 	return !(value & 0x1);
 }
 	_read_pp_info("current_level", perf_level.current_level, SST_PP_STATUS_OFFSET,
 		      SST_PP_LEVEL_START, SST_PP_LEVEL_WIDTH, SST_MUL_FACTOR_NONE)
 	_read_pp_info("locked", perf_level.locked, SST_PP_STATUS_OFFSET,
-		      SST_PP_LOCK_START, SST_PP_LEVEL_WIDTH, SST_MUL_FACTOR_NONE)
+		      SST_PP_LOCK_START, SST_PP_LOCK_WIDTH, SST_MUL_FACTOR_NONE)
 	_read_pp_info("feature_state", perf_level.feature_state, SST_PP_STATUS_OFFSET,
 		      SST_PP_FEATURE_STATE_START, SST_PP_FEATURE_STATE_WIDTH, SST_MUL_FACTOR_NONE)
 	perf_level.enabled = !!(power_domain_info->sst_header.cap_mask & BIT(1));

drivers/platform/x86/lenovo/wmi-gamezone.c+0−2

@@ -31,8 +31,6 @@ · 30 unmodified lines
31	#define LWMI_GZ_METHOD_ID_SMARTFAN_SET 44	31	#define LWMI_GZ_METHOD_ID_SMARTFAN_SET 44
32	#define LWMI_GZ_METHOD_ID_SMARTFAN_GET 45	32	#define LWMI_GZ_METHOD_ID_SMARTFAN_GET 45
33		33
34	static BLOCKING_NOTIFIER_HEAD(gz_chain_head);
35
36	struct lwmi_gz_priv {	34	struct lwmi_gz_priv {
37	enum thermal_mode current_mode;	35	enum thermal_mode current_mode;
38	struct notifier_block event_nb;	36	struct notifier_block event_nb;

drivers/scsi/ibmvscsi/ibmvfc.c+2−1

 	switch (mad_status) {
 	case IBMVFC_MAD_SUCCESS:
 		ibmvfc_dbg(vhost, "Discover Targets succeeded\n");
-		vhost->num_targets = be32_to_cpu(rsp->num_written);
+		vhost->num_targets = min_t(u32, be32_to_cpu(rsp->num_written),
+					   max_targets);
 		ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_ALLOC_TGTS);
 		break;
 	case IBMVFC_MAD_FAILED:

drivers/scsi/scsi_transport_sas.c+1−1

@@ -1734,7 +1734,7 @@ static int sas_user_scan(struct Scsi_Host *shost, uint channel, · 1733 unmodified lines
1734	break;	1734	break;
1735		1735
1736	default:	1736	default:
1737	if (channel < shost->max_channel) {	1737	if (channel <= shost->max_channel) {
1738	res = scsi_scan_host_selected(shost, channel, id, lun,	1738	res = scsi_scan_host_selected(shost, channel, id, lun,
1739	SCSI_SCAN_MANUAL);	1739	SCSI_SCAN_MANUAL);
1740	} else {	1740	} else {

drivers/scsi/ses.c+1−1

@@ -215,7 +215,7 @@ static unsigned char ses_get_page2_descriptor(struct enclosure_device edev, · 214 unmodified lines
215	unsigned char *type_ptr = ses_dev->page1_types;	215	unsigned char *type_ptr = ses_dev->page1_types;
216	unsigned char *desc_ptr = ses_dev->page2 + 8;	216	unsigned char *desc_ptr = ses_dev->page2 + 8;
217		217
218	if (ses_recv_diag(sdev, 2, ses_dev->page2, ses_dev->page2_len) < 0)	218	if (ses_recv_diag(sdev, 2, ses_dev->page2, ses_dev->page2_len))
219	return NULL;	219	return NULL;
220		220
221	for (i = 0; i < ses_dev->page1_num_types; i++, type_ptr += 4) {	221	for (i = 0; i < ses_dev->page1_num_types; i++, type_ptr += 4) {

drivers/spi/spi-fsl-lpspi.c+2−1

 		enable_irq(irq);
 	}
-	ret = devm_spi_register_controller(&pdev->dev, controller);
+	ret = spi_register_controller(controller);
 	if (ret < 0) {
 		dev_err_probe(&pdev->dev, ret, "spi_register_controller error\n");
 		goto free_dma;
 	struct fsl_lpspi_data *fsl_lpspi =
 				spi_controller_get_devdata(controller);
+	spi_unregister_controller(controller);
 	fsl_lpspi_dma_exit(controller);
 	pm_runtime_dont_use_autosuspend(fsl_lpspi->dev);

drivers/spi/spi-meson-spicc.c+0−2

@@ -1101,8 +1101,6 @@ static void meson_spicc_remove(struct platform_device *pdev) · 1100 unmodified lines
1101		1101
1102	/* Disable SPI */	1102	/* Disable SPI */
1103	writel(0, spicc->base + SPICC_CONREG);	1103	writel(0, spicc->base + SPICC_CONREG);
1104
1105	spi_controller_put(spicc->host);
1106	}	1104	}
1107		1105
1108	static const struct meson_spicc_data meson_spicc_gx_data = {	1106	static const struct meson_spicc_data meson_spicc_gx_data = {

drivers/spi/spi-sn-f-ospi.c+10−32

 	u32 num_cs = OSPI_NUM_CS;
 	int ret;
-	ctlr = spi_alloc_host(dev, sizeof(*ospi));
+	ctlr = devm_spi_alloc_host(dev, sizeof(*ospi));
 	if (!ctlr)
 		return -ENOMEM;
 	platform_set_drvdata(pdev, ospi);
 	ospi->base = devm_platform_ioremap_resource(pdev, 0);
-	if (IS_ERR(ospi->base)) {
+	if (IS_ERR(ospi->base))
-		ret = PTR_ERR(ospi->base);
+		return PTR_ERR(ospi->base);
-		goto err_put_ctlr;
-	}
 	ospi->clk = devm_clk_get_enabled(dev, NULL);
-	if (IS_ERR(ospi->clk)) {
+	if (IS_ERR(ospi->clk))
-		ret = PTR_ERR(ospi->clk);
+		return PTR_ERR(ospi->clk);
-		goto err_put_ctlr;
-	}
-	mutex_init(&ospi->mlock);
+	ret = devm_mutex_init(dev, &ospi->mlock);
-	ret = f_ospi_init(ospi);
 	if (ret)
-		goto err_destroy_mutex;
+		return ret;
-	ret = devm_spi_register_controller(dev, ctlr);
+	ret = f_ospi_init(ospi);
 	if (ret)
-		goto err_destroy_mutex;
+		return ret;
-	return 0;
-err_destroy_mutex:
-	mutex_destroy(&ospi->mlock);
-err_put_ctlr:
-	spi_controller_put(ctlr);
-	return ret;
-}
-static void f_ospi_remove(struct platform_device *pdev)
-{
-	struct f_ospi *ospi = platform_get_drvdata(pdev);
-	mutex_destroy(&ospi->mlock);
+	return devm_spi_register_controller(dev, ctlr);
 }
 static const struct of_device_id f_ospi_dt_ids[] = {
 		.of_match_table = f_ospi_dt_ids,
 	},
 	.probe = f_ospi_probe,
-	.remove = f_ospi_remove,
 };
 module_platform_driver(f_ospi_driver);

drivers/spi/spi.c+19−13

 	struct spi_device	*spi = to_spi_device(dev);
 	spi_controller_put(spi->controller);
-	kfree(spi->driver_override);
 	free_percpu(spi->pcpu_statistics);
 	kfree(spi);
 }
 				     struct device_attribute *a,
 				     const char *buf, size_t count)
 {
-	struct spi_device *spi = to_spi_device(dev);
 	int ret;
-	ret = driver_set_override(dev, &spi->driver_override, buf, count);
+	ret = __device_set_driver_override(dev, buf, count);
 	if (ret)
 		return ret;
 static ssize_t driver_override_show(struct device *dev,
 				    struct device_attribute *a, char *buf)
 {
-	const struct spi_device *spi = to_spi_device(dev);
+	guard(spinlock)(&dev->driver_override.lock);
-	ssize_t len;
+	return sysfs_emit(buf, "%s\n", dev->driver_override.name ?: "");
-	device_lock(dev);
-	len = sysfs_emit(buf, "%s\n", spi->driver_override ? : "");
-	device_unlock(dev);
-	return len;
 }
 static DEVICE_ATTR_RW(driver_override);
 {
 	const struct spi_device	*spi = to_spi_device(dev);
 	const struct spi_driver	*sdrv = to_spi_driver(drv);
+	int ret;
 	/* Check override first, and if set, only use the named driver */
-	if (spi->driver_override)
+	ret = device_match_driver_override(dev, drv);
-		return strcmp(spi->driver_override, drv->name) == 0;
+	if (ret >= 0)
+		return ret;
 	/* Attempt an OF style match */
 	if (of_driver_match_device(dev, drv))
 	if (ret)
 		return ret;
-	return devm_add_action_or_reset(dev, devm_spi_unregister_controller, ctlr);
+	/*
+	 * Prevent controller from being freed by spi_unregister_controller()
+	 * if devm_add_action_or_reset() fails for a non-devres allocated
+	 * controller.
+	 */
+	spi_controller_get(ctlr);
+	ret = devm_add_action_or_reset(dev, devm_spi_unregister_controller, ctlr);
+	if (ret == 0 || ctlr->devm_allocated)
+		spi_controller_put(ctlr);
+	return ret;
 }
 EXPORT_SYMBOL_GPL(devm_spi_register_controller);

drivers/target/loopback/tcm_loop.c+46−6

@@ -26,6 +26,7 @@ · 25 unmodified lines
26	#include <linux/slab.h>	26	#include <linux/slab.h>
27	#include <linux/types.h>	27	#include <linux/types.h>
28	#include <linux/configfs.h>	28	#include <linux/configfs.h>
		29	#include <linux/blk-mq.h>
29	#include <scsi/scsi.h>	30	#include <scsi/scsi.h>
30	#include <scsi/scsi_tcq.h>	31	#include <scsi/scsi_tcq.h>
31	#include <scsi/scsi_host.h>	32	#include <scsi/scsi_host.h>
@@ -269,15 +270,27 @@ static int tcm_loop_device_reset(struct scsi_cmnd *sc) · 237 unmodified lines
269	return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED;	270	return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED;
270	}	271	}
271		272
		273	static bool tcm_loop_flush_work_iter(struct request rq, void data)
		274	{
		275	struct scsi_cmnd *sc = blk_mq_rq_to_pdu(rq);
		276	struct tcm_loop_cmd *tl_cmd = scsi_cmd_priv(sc);
		277	struct se_cmd *se_cmd = &tl_cmd->tl_se_cmd;
		278
		279	flush_work(&se_cmd->work);
		280	return true;
		281	}
		282
272	static int tcm_loop_target_reset(struct scsi_cmnd *sc)	283	static int tcm_loop_target_reset(struct scsi_cmnd *sc)
273	{	284	{
274	struct tcm_loop_hba *tl_hba;	285	struct tcm_loop_hba *tl_hba;
275	struct tcm_loop_tpg *tl_tpg;	286	struct tcm_loop_tpg *tl_tpg;
		287	struct Scsi_Host *sh = sc->device->host;
		288	int ret;
276		289
277	/*	290	/*
278	* Locate the tcm_loop_hba_t pointer	291	* Locate the tcm_loop_hba_t pointer
279	*/	292	*/
280	tl_hba = (struct tcm_loop_hba *)shost_priv(sc->device->host);	293	tl_hba = (struct tcm_loop_hba *)shost_priv(sh);
281	if (!tl_hba) {	294	if (!tl_hba) {
282	pr_err("Unable to perform device reset without active I_T Nexus\n");	295	pr_err("Unable to perform device reset without active I_T Nexus\n");
283	return FAILED;	296	return FAILED;
@@ -286,11 +299,38 @@ static int tcm_loop_target_reset(struct scsi_cmnd *sc) · 2 unmodified lines
286	* Locate the tl_tpg pointer from TargetID in sc->device->id	299	* Locate the tl_tpg pointer from TargetID in sc->device->id
287	*/	300	*/
288	tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id];	301	tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id];
289	if (tl_tpg) {	302	if (!tl_tpg)
290	tl_tpg->tl_transport_status = TCM_TRANSPORT_ONLINE;	303	return FAILED;
291	return SUCCESS;	304
292	}	305	/*
293	return FAILED;	306	* Issue a LUN_RESET to drain all commands that the target core
		307	* knows about. This handles commands not yet marked CMD_T_COMPLETE.
		308	*/
		309	ret = tcm_loop_issue_tmr(tl_tpg, sc->device->lun, 0, TMR_LUN_RESET);
		310	if (ret != TMR_FUNCTION_COMPLETE)
		311	return FAILED;
		312
		313	/*
		314	* Flush any deferred target core completion work that may still be
		315	* queued. Commands that already had CMD_T_COMPLETE set before the TMR
		316	* are skipped by the TMR drain, but their async completion work
		317	* (transport_lun_remove_cmd → percpu_ref_put, release_cmd → scsi_done)
		318	* may still be pending in target_completion_wq.
		319	*
		320	* The SCSI EH will reuse in-flight scsi_cmnd structures for recovery
		321	* commands (e.g. TUR) immediately after this handler returns SUCCESS —
		322	* if deferred work is still pending, the memset in queuecommand would
		323	* zero the se_cmd while the work accesses it, leaking the LUN
		324	* percpu_ref and hanging configfs unlink forever.
		325	*
		326	* Use blk_mq_tagset_busy_iter() to find all started requests and
		327	* flush_work() on each — the same pattern used by mpi3mr, scsi_debug,
		328	* and other SCSI drivers to drain outstanding commands during reset.
		329	*/
		330	blk_mq_tagset_busy_iter(&sh->tag_set, tcm_loop_flush_work_iter, NULL);
		331
		332	tl_tpg->tl_transport_status = TCM_TRANSPORT_ONLINE;
		333	return SUCCESS;
294	}	334	}
295		335
296	static const struct scsi_host_template tcm_loop_driver_template = {	336	static const struct scsi_host_template tcm_loop_driver_template = {

drivers/target/target_core_file.c+1−1

@@ -276,7 +276,7 @@ fd_execute_rw_aio(struct se_cmd cmd, struct scatterlist sgl, u32 sgl_nents, · 275 unmodified lines
276	ssize_t len = 0;	276	ssize_t len = 0;
277	int ret = 0, i;	277	int ret = 0, i;
278		278
279	aio_cmd = kmalloc_flex(*aio_cmd, bvecs, sgl_nents);	279	aio_cmd = kzalloc_flex(*aio_cmd, bvecs, sgl_nents);
280	if (!aio_cmd)	280	if (!aio_cmd)
281	return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;	281	return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
282		282

drivers/thermal/intel/int340x_thermal/processor_thermal_soc_slider.c+7−1

 static void set_soc_power_profile(struct proc_thermal_device *proc_priv, int slider)
 {
+	u8 offset;
 	u64 val;
 	val = read_soc_slider(proc_priv);
 	val &= ~SLIDER_MASK;
 	val |= FIELD_PREP(SLIDER_MASK, slider) | BIT(SLIDER_ENABLE_BIT);
+	if (slider == SOC_SLIDER_VALUE_MINIMUM || slider == SOC_SLIDER_VALUE_MAXIMUM)
+		offset = 0;
+	else
+		offset = slider_offset;
 	/* Set the slider offset from module params */
 	val &= ~SLIDER_OFFSET_MASK;
-	val |= FIELD_PREP(SLIDER_OFFSET_MASK, slider_offset);
+	val |= FIELD_PREP(SLIDER_OFFSET_MASK, offset);
 	write_soc_slider(proc_priv, val);
 }

drivers/vfio/pci/vfio_pci_dmabuf.c+2−3

 	 */
 	ret = dma_buf_fd(priv->dmabuf, get_dma_buf.open_flags);
 	if (ret < 0)
-		goto err_dma_buf;
+		dma_buf_put(priv->dmabuf);
 	return ret;
-err_dma_buf:
-	dma_buf_put(priv->dmabuf);
 err_dev_put:
 	vfio_device_put_registration(&vdev->vdev);
 err_free_phys:

drivers/virt/coco/tdx-guest/tdx-guest.c+10−2

 #define GET_QUOTE_SUCCESS		0
 #define GET_QUOTE_IN_FLIGHT		0xffffffffffffffff
+#define TDX_QUOTE_MAX_LEN		(GET_QUOTE_BUF_SIZE - sizeof(struct tdx_quote_buf))
 /* struct tdx_quote_buf: Format of Quote request buffer.
  * @version: Quote format version, filled by TD.
  * @status: Status code of Quote request, filled by VMM.
 	u8 *buf;
 	struct tdx_quote_buf *quote_buf = quote_data;
 	struct tsm_report_desc *desc = &report->desc;
+	u32 out_len;
 	int ret;
 	u64 err;
 		return ret;
 	}
-	buf = kvmemdup(quote_buf->data, quote_buf->out_len, GFP_KERNEL);
+	out_len = READ_ONCE(quote_buf->out_len);
+	if (out_len > TDX_QUOTE_MAX_LEN)
+		return -EFBIG;
+	buf = kvmemdup(quote_buf->data, out_len, GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;
 	report->outblob = buf;
-	report->outblob_len = quote_buf->out_len;
+	report->outblob_len = out_len;
 	/*
 	 * TODO: parse the PEM-formatted cert chain out of the quote buffer when

drivers/virtio/virtio_ring.c+5−5

@@ -2912,10 +2912,10 @@ EXPORT_SYMBOL_GPL(virtqueue_add_inbuf); · 2911 unmodified lines
2912	* @data: the token identifying the buffer.	2912	* @data: the token identifying the buffer.
2913	* @gfp: how to do memory allocations (if necessary).	2913	* @gfp: how to do memory allocations (if necessary).
2914	*	2914	*
2915	* Same as virtqueue_add_inbuf but passes DMA_ATTR_CPU_CACHE_CLEAN to indicate	2915	* Same as virtqueue_add_inbuf but passes DMA_ATTR_DEBUGGING_IGNORE_CACHELINES
2916	* that the CPU will not dirty any cacheline overlapping this buffer while it	2916	* to indicate that the CPU will not dirty any cacheline overlapping this buffer
2917	* is available, and to suppress overlapping cacheline warnings in DMA debug	2917	* while it is available, and to suppress overlapping cacheline warnings in DMA
2918	* builds.	2918	* debug builds.
2919	*	2919	*
2920	* Caller must ensure we don't call this with other virtqueue operations	2920	* Caller must ensure we don't call this with other virtqueue operations
2921	* at the same time (except where noted).	2921	* at the same time (except where noted).
@@ -2928,7 +2928,7 @@ int virtqueue_add_inbuf_cache_clean(struct virtqueue *vq, · 6 unmodified lines
2928	gfp_t gfp)	2928	gfp_t gfp)
2929	{	2929	{
2930	return virtqueue_add(vq, &sg, num, 0, 1, data, NULL, false, gfp,	2930	return virtqueue_add(vq, &sg, num, 0, 1, data, NULL, false, gfp,
2931	DMA_ATTR_CPU_CACHE_CLEAN);	2931	DMA_ATTR_DEBUGGING_IGNORE_CACHELINES);
2932	}	2932	}
2933	EXPORT_SYMBOL_GPL(virtqueue_add_inbuf_cache_clean);	2933	EXPORT_SYMBOL_GPL(virtqueue_add_inbuf_cache_clean);
2934		2934

drivers/xen/privcmd.c+73−3

@@ -12,6 +12,7 @@ · 11 unmodified lines
12	#include <linux/eventfd.h>	12	#include <linux/eventfd.h>
13	#include <linux/file.h>	13	#include <linux/file.h>
14	#include <linux/kernel.h>	14	#include <linux/kernel.h>
		15	#include <linux/kstrtox.h>
15	#include <linux/module.h>	16	#include <linux/module.h>
16	#include <linux/mutex.h>	17	#include <linux/mutex.h>
17	#include <linux/poll.h>	18	#include <linux/poll.h>
@@ -30,7 +31,10 @@ · 12 unmodified lines
30	#include <linux/seq_file.h>	31	#include <linux/seq_file.h>
31	#include <linux/miscdevice.h>	32	#include <linux/miscdevice.h>
32	#include <linux/moduleparam.h>	33	#include <linux/moduleparam.h>
		34	#include <linux/notifier.h>
		35	#include <linux/security.h>
33	#include <linux/virtio_mmio.h>	36	#include <linux/virtio_mmio.h>
		37	#include <linux/wait.h>
34		38
35	#include <asm/xen/hypervisor.h>	39	#include <asm/xen/hypervisor.h>
36	#include <asm/xen/hypercall.h>	40	#include <asm/xen/hypercall.h>
@@ -46,6 +50,7 @@ · 9 unmodified lines
46	#include <xen/page.h>	50	#include <xen/page.h>
47	#include <xen/xen-ops.h>	51	#include <xen/xen-ops.h>
48	#include <xen/balloon.h>	52	#include <xen/balloon.h>
		53	#include <xen/xenbus.h>
49	#ifdef CONFIG_XEN_ACPI	54	#ifdef CONFIG_XEN_ACPI
50	#include <xen/acpi.h>	55	#include <xen/acpi.h>
51	#endif	56	#endif
@@ -68,10 +73,20 @@ module_param_named(dm_op_buf_max_size, privcmd_dm_op_buf_max_size, uint, · 16 unmodified lines
68	MODULE_PARM_DESC(dm_op_buf_max_size,	73	MODULE_PARM_DESC(dm_op_buf_max_size,
69	"Maximum size of a dm_op hypercall buffer");	74	"Maximum size of a dm_op hypercall buffer");
70		75
		76	static bool unrestricted;
		77	module_param(unrestricted, bool, 0);
		78	MODULE_PARM_DESC(unrestricted,
		79	"Don't restrict hypercalls to target domain if running in a domU");
		80
71	struct privcmd_data {	81	struct privcmd_data {
72	domid_t domid;	82	domid_t domid;
73	};	83	};
74		84
		85	/* DOMID_INVALID implies no restriction */
		86	static domid_t target_domain = DOMID_INVALID;
		87	static bool restrict_wait;
		88	static DECLARE_WAIT_QUEUE_HEAD(restrict_wait_wq);
		89
75	static int privcmd_vma_range_is_mapped(	90	static int privcmd_vma_range_is_mapped(
76	struct vm_area_struct *vma,	91	struct vm_area_struct *vma,
77	unsigned long addr,	92	unsigned long addr,
@@ -1563,13 +1578,16 @@ static long privcmd_ioctl(struct file *file, · 1485 unmodified lines
1563		1578
1564	static int privcmd_open(struct inode ino, struct file file)	1579	static int privcmd_open(struct inode ino, struct file file)
1565	{	1580	{
1566	struct privcmd_data data = kzalloc_obj(data);	1581	struct privcmd_data *data;
1567		1582
		1583	if (wait_event_interruptible(restrict_wait_wq, !restrict_wait) < 0)
		1584	return -EINTR;
		1585
		1586	data = kzalloc_obj(*data);
1568	if (!data)	1587	if (!data)
1569	return -ENOMEM;	1588	return -ENOMEM;
1570		1589
1571	/* DOMID_INVALID implies no restriction */	1590	data->domid = target_domain;
1572	data->domid = DOMID_INVALID;
1573		1591
1574	file->private_data = data;	1592	file->private_data = data;
1575	return 0;	1593	return 0;
@@ -1662,6 +1680,52 @@ static struct miscdevice privcmd_dev = { · 86 unmodified lines
1662	.fops = &xen_privcmd_fops,	1680	.fops = &xen_privcmd_fops,
1663	};	1681	};
1664		1682
		1683	static int init_restrict(struct notifier_block *notifier,
		1684	unsigned long event,
		1685	void *data)
		1686	{
		1687	char *target;
		1688	unsigned int domid;
		1689
		1690	/* Default to an guaranteed unused domain-id. */
		1691	target_domain = DOMID_IDLE;
		1692
		1693	target = xenbus_read(XBT_NIL, "target", "", NULL);
		1694	if (IS_ERR(target) \|\| kstrtouint(target, 10, &domid)) {
		1695	pr_err("No target domain found, blocking all hypercalls\n");
		1696	goto out;
		1697	}
		1698
		1699	target_domain = domid;
		1700
		1701	out:
		1702	if (!IS_ERR(target))
		1703	kfree(target);
		1704
		1705	restrict_wait = false;
		1706	wake_up_all(&restrict_wait_wq);
		1707
		1708	return NOTIFY_DONE;
		1709	}
		1710
		1711	static struct notifier_block xenstore_notifier = {
		1712	.notifier_call = init_restrict,
		1713	};
		1714
		1715	static void __init restrict_driver(void)
		1716	{
		1717	if (unrestricted) {
		1718	if (security_locked_down(LOCKDOWN_XEN_USER_ACTIONS))
		1719	pr_warn("Kernel is locked down, parameter \"unrestricted\" ignored\n");
		1720	else
		1721	return;
		1722	}
		1723
		1724	restrict_wait = true;
		1725
		1726	register_xenstore_notifier(&xenstore_notifier);
		1727	}
		1728
1665	static int __init privcmd_init(void)	1729	static int __init privcmd_init(void)
1666	{	1730	{
1667	int err;	1731	int err;
@@ -1669,6 +1733,9 @@ static int __init privcmd_init(void) · 1 unmodified line
1669	if (!xen_domain())	1733	if (!xen_domain())
1670	return -ENODEV;	1734	return -ENODEV;
1671		1735
		1736	if (!xen_initial_domain())
		1737	restrict_driver();
		1738
1672	err = misc_register(&privcmd_dev);	1739	err = misc_register(&privcmd_dev);
1673	if (err != 0) {	1740	if (err != 0) {
1674	pr_err("Could not register Xen privcmd device\n");	1741	pr_err("Could not register Xen privcmd device\n");
@@ -1698,6 +1765,9 @@ err_privcmdbuf: · 23 unmodified lines
1698		1765
1699	static void __exit privcmd_exit(void)	1766	static void __exit privcmd_exit(void)
1700	{	1767	{
		1768	if (!xen_initial_domain())
		1769	unregister_xenstore_notifier(&xenstore_notifier);
		1770
1701	privcmd_ioeventfd_exit();	1771	privcmd_ioeventfd_exit();
1702	privcmd_irqfd_exit();	1772	privcmd_irqfd_exit();
1703	misc_deregister(&privcmd_dev);	1773	misc_deregister(&privcmd_dev);

fs/btrfs/block-group.c+1−1

@@ -4583,7 +4583,7 @@ static void check_removing_space_info(struct btrfs_space_info *space_info) · 4582 unmodified lines
4583	for (int i = 0; i < BTRFS_SPACE_INFO_SUB_GROUP_MAX; i++) {	4583	for (int i = 0; i < BTRFS_SPACE_INFO_SUB_GROUP_MAX; i++) {
4584	if (space_info->sub_group[i]) {	4584	if (space_info->sub_group[i]) {
4585	check_removing_space_info(space_info->sub_group[i]);	4585	check_removing_space_info(space_info->sub_group[i]);
4586	kfree(space_info->sub_group[i]);	4586	btrfs_sysfs_remove_space_info(space_info->sub_group[i]);
4587	space_info->sub_group[i] = NULL;	4587	space_info->sub_group[i] = NULL;
4588	}	4588	}
4589	}	4589	}

fs/btrfs/disk-io.c+2−2

@@ -2531,8 +2531,8 @@ int btrfs_validate_super(const struct btrfs_fs_info *fs_info, · 2530 unmodified lines
2531		2531
2532	if (mirror_num >= 0 &&	2532	if (mirror_num >= 0 &&
2533	btrfs_super_bytenr(sb) != btrfs_sb_offset(mirror_num)) {	2533	btrfs_super_bytenr(sb) != btrfs_sb_offset(mirror_num)) {
2534	btrfs_err(fs_info, "super offset mismatch %llu != %u",	2534	btrfs_err(fs_info, "super offset mismatch %llu != %llu",
2535	btrfs_super_bytenr(sb), BTRFS_SUPER_INFO_OFFSET);	2535	btrfs_super_bytenr(sb), btrfs_sb_offset(mirror_num));
2536	ret = -EINVAL;	2536	ret = -EINVAL;
2537	}	2537	}
2538		2538

fs/btrfs/tree-log.c+65−33

 			    struct inode *inode, bool log_inode_only,
 			    u64 logged_isize)
 {
+	u64 gen = BTRFS_I(inode)->generation;
 	u64 flags;
 	if (log_inode_only) {
-		/* set the generation to zero so the recover code
+		/*
-		 * can tell the difference between an logging
+		 * Set the generation to zero so the recover code can tell the
-		 * just to say 'this inode exists' and a logging
+		 * difference between a logging just to say 'this inode exists'
-		 * to say 'update this inode with these values'
+		 * and a logging to say 'update this inode with these values'.
+		 * But only if the inode was not already logged before.
+		 * We access ->logged_trans directly since it was already set
+		 * up in the call chain by btrfs_log_inode(), and data_race()
+		 * to avoid false alerts from KCSAN and since it was set already
+		 * and one can set it to 0 since that only happens on eviction
+		 * and we are holding a ref on the inode.
 		 */
-		btrfs_set_inode_generation(leaf, item, 0);
+		ASSERT(data_race(BTRFS_I(inode)->logged_trans) > 0);
+		if (data_race(BTRFS_I(inode)->logged_trans) < trans->transid)
+			gen = 0;
 		btrfs_set_inode_size(leaf, item, logged_isize);
 	} else {
-		btrfs_set_inode_generation(leaf, item, BTRFS_I(inode)->generation);
 		btrfs_set_inode_size(leaf, item, inode->i_size);
 	}
+	btrfs_set_inode_generation(leaf, item, gen);
 	btrfs_set_inode_uid(leaf, item, i_uid_read(inode));
 	btrfs_set_inode_gid(leaf, item, i_gid_read(inode));
 	btrfs_set_inode_mode(leaf, item, inode->i_mode);
 	return 0;
 }
-static int logged_inode_size(struct btrfs_root *log, struct btrfs_inode *inode,
+static int get_inode_size_to_log(struct btrfs_trans_handle *trans,
-			     struct btrfs_path *path, u64 *size_ret)
+				 struct btrfs_inode *inode,
+				 struct btrfs_path *path, u64 *size_ret)
 {
 	struct btrfs_key key;
+	struct btrfs_inode_item *item;
 	int ret;
 	key.objectid = btrfs_ino(inode);
 	key.type = BTRFS_INODE_ITEM_KEY;
 	key.offset = 0;
-	ret = btrfs_search_slot(NULL, log, &key, path, 0, 0);
+	/*
-	if (ret < 0) {
+	 * Our caller called inode_logged(), so logged_trans is up to date.
-		return ret;
+	 * Use data_race() to silence any warning from KCSAN. Once logged_trans
-	} else if (ret > 0) {
+	 * is set, it can only be reset to 0 after inode eviction.
-		*size_ret = 0;
+	 */
-	} else {
+	if (data_race(inode->logged_trans) == trans->transid) {
-		struct btrfs_inode_item *item;
+		ret = btrfs_search_slot(NULL, inode->root->log_root, &key, path, 0, 0);
+	} else if (inode->generation < trans->transid) {
+		path->search_commit_root = true;
+		path->skip_locking = true;
+		ret = btrfs_search_slot(NULL, inode->root, &key, path, 0, 0);
+		path->search_commit_root = false;
+		path->skip_locking = false;
-		item = btrfs_item_ptr(path->nodes[0], path->slots[0],
+	} else {
-				      struct btrfs_inode_item);
+		*size_ret = 0;
-		*size_ret = btrfs_inode_size(path->nodes[0], item);
+		return 0;
-		/*
-		 * If the in-memory inode's i_size is smaller then the inode
-		 * size stored in the btree, return the inode's i_size, so
-		 * that we get a correct inode size after replaying the log
-		 * when before a power failure we had a shrinking truncate
-		 * followed by addition of a new name (rename / new hard link).
-		 * Otherwise return the inode size from the btree, to avoid
-		 * data loss when replaying a log due to previously doing a
-		 * write that expands the inode's size and logging a new name
-		 * immediately after.
-		 */
-		if (*size_ret > inode->vfs_inode.i_size)
-			*size_ret = inode->vfs_inode.i_size;
 	}
+	/*
+	 * If the inode was logged before or is from a past transaction, then
+	 * its inode item must exist in the log root or in the commit root.
+	 */
+	ASSERT(ret <= 0);
+	if (WARN_ON_ONCE(ret > 0))
+		ret = -ENOENT;
+	if (ret < 0)
+		return ret;
+	item = btrfs_item_ptr(path->nodes[0], path->slots[0],
+			      struct btrfs_inode_item);
+	*size_ret = btrfs_inode_size(path->nodes[0], item);
+	/*
+	 * If the in-memory inode's i_size is smaller then the inode size stored
+	 * in the btree, return the inode's i_size, so that we get a correct
+	 * inode size after replaying the log when before a power failure we had
+	 * a shrinking truncate followed by addition of a new name (rename / new
+	 * hard link). Otherwise return the inode size from the btree, to avoid
+	 * data loss when replaying a log due to previously doing a write that
+	 * expands the inode's size and logging a new name immediately after.
+	 */
+	if (*size_ret > inode->vfs_inode.i_size)
+		*size_ret = inode->vfs_inode.i_size;
 	btrfs_release_path(path);
 	return 0;
 }
 			ret = drop_inode_items(trans, log, path, inode,
 					       BTRFS_XATTR_ITEM_KEY);
 	} else {
-		if (inode_only == LOG_INODE_EXISTS && ctx->logged_before) {
+		if (inode_only == LOG_INODE_EXISTS) {
 			/*
 			 * Make sure the new inode item we write to the log has
 			 * the same isize as the current one (if it exists).
 			 * (zeroes), as if an expanding truncate happened,
 			 * instead of getting a file of 4Kb only.
 			 */
-			ret = logged_inode_size(log, inode, path, &logged_isize);
+			ret = get_inode_size_to_log(trans, inode, path, &logged_isize);
 			if (ret)
 				goto out_unlock;
 		}

fs/btrfs/volumes.c+3−2

@@ -8099,8 +8099,9 @@ int btrfs_run_dev_stats(struct btrfs_trans_handle *trans) · 8098 unmodified lines
8099	smp_rmb();	8099	smp_rmb();
8100		8100
8101	ret = update_dev_stat_item(trans, device);	8101	ret = update_dev_stat_item(trans, device);
8102	if (!ret)	8102	if (ret)
8103	atomic_sub(stats_cnt, &device->dev_stats_ccnt);	8103	break;
		8104	atomic_sub(stats_cnt, &device->dev_stats_ccnt);
8104	}	8105	}
8105	mutex_unlock(&fs_devices->device_list_mutex);	8106	mutex_unlock(&fs_devices->device_list_mutex);
8106		8107

fs/btrfs/zlib.c+3−1

@@ -308,7 +308,9 @@ int zlib_compress_bio(struct list_head ws, struct compressed_bio cb) · 307 unmodified lines
308	}	308	}
309	/* Queue the remaining part of the folio. */	309	/* Queue the remaining part of the folio. */
310	if (workspace->strm.total_out > bio->bi_iter.bi_size) {	310	if (workspace->strm.total_out > bio->bi_iter.bi_size) {
311	u32 cur_len = offset_in_folio(out_folio, workspace->strm.total_out);	311	const u32 cur_len = workspace->strm.total_out - bio->bi_iter.bi_size;
		312
		313	ASSERT(cur_len <= folio_size(out_folio));
312		314
313	if (!bio_add_folio(bio, out_folio, cur_len, 0)) {	315	if (!bio_add_folio(bio, out_folio, cur_len, 0)) {
314	ret = -E2BIG;	316	ret = -E2BIG;

fs/erofs/Kconfig+30−15

@@ -16,22 +16,36 @@ config EROFS_FS · 15 unmodified lines
16	select ZLIB_INFLATE if EROFS_FS_ZIP_DEFLATE	16	select ZLIB_INFLATE if EROFS_FS_ZIP_DEFLATE
17	select ZSTD_DECOMPRESS if EROFS_FS_ZIP_ZSTD	17	select ZSTD_DECOMPRESS if EROFS_FS_ZIP_ZSTD
18	help	18	help
19	EROFS (Enhanced Read-Only File System) is a lightweight read-only	19	EROFS (Enhanced Read-Only File System) is a modern, lightweight,
20	file system with modern designs (e.g. no buffer heads, inline	20	secure read-only filesystem for various use cases, such as immutable
21	xattrs/data, chunk-based deduplication, multiple devices, etc.) for	21	system images, container images, application sandboxes, and datasets.
22	scenarios which need high-performance read-only solutions, e.g.	22
23	smartphones with Android OS, LiveCDs and high-density hosts with	23	EROFS uses a flexible, hierarchical on-disk design so that features
24	numerous containers;	24	can be enabled on demand: the core on-disk format is block-aligned in
25		25	order to perform optimally on all kinds of devices, including block
26	It also provides transparent compression and deduplication support to	26	and memory-backed devices; the format is easy to parse and has zero
27	improve storage density and maintain relatively high compression	27	metadata redundancy, unlike generic filesystems, making it ideal for
28	ratios, and it implements in-place decompression to temporarily reuse	28	filesystem auditing and remote access; inline data, random-access
29	page cache for compressed data using proper strategies, which is	29	friendly directory data, inline/shared extended attributes and
30	quite useful for ensuring guaranteed end-to-end runtime decompression	30	chunk-based deduplication ensure space efficiency while maintaining
		31	high performance.
		32
		33	Optionally, it supports multiple devices to reference external data,
		34	enabling data sharing for container images.
		35
		36	It also has advanced encoded on-disk layouts, particularly for data
		37	compression and fine-grained deduplication. It utilizes fixed-size
		38	output compression to improve storage density while keeping relatively
		39	high compression ratios. Furthermore, it implements in-place
		40	decompression to reuse file pages to keep compressed data temporarily
		41	with proper strategies, which ensures guaranteed end-to-end runtime
31	performance under extreme memory pressure without extra cost.	42	performance under extreme memory pressure without extra cost.
32		43
33	See the documentation at <file:Documentation/filesystems/erofs.rst>	44	For more details, see the web pages at <https://erofs.docs.kernel.org>
34	and the web pages at <https://erofs.docs.kernel.org> for more details.	45	and the documentation at <file:Documentation/filesystems/erofs.rst>.
		46
		47	To compile EROFS filesystem support as a module, choose M here. The
		48	module will be called erofs.
35		49
36	If unsure, say N.	50	If unsure, say N.
37		51
@@ -105,7 +119,8 @@ config EROFS_FS_ZIP · 67 unmodified lines
105	depends on EROFS_FS	119	depends on EROFS_FS
106	default y	120	default y
107	help	121	help
108	Enable transparent compression support for EROFS file systems.	122	Enable EROFS compression layouts so that filesystems containing
		123	compressed files can be parsed by the kernel.
109		124
110	If you don't want to enable compression feature, say N.	125	If you don't want to enable compression feature, say N.
111		126

fs/erofs/fileio.c+2−4

 			container_of(iocb, struct erofs_fileio_rq, iocb);
 	struct folio_iter fi;
-	if (ret >= 0 && ret != rq->bio.bi_iter.bi_size) {
+	if (ret >= 0 && ret != rq->bio.bi_iter.bi_size)
-		bio_advance(&rq->bio, ret);
+		ret = -EIO;
-		zero_fill_bio(&rq->bio);
-	}
 	if (!rq->bio.bi_end_io) {
 		bio_for_each_folio_all(fi, &rq->bio) {
 			DBG_BUGON(folio_test_uptodate(fi.folio));

fs/erofs/ishare.c+13−2

@@ -200,8 +200,19 @@ struct inode erofs_real_inode(struct inode inode, bool *need_iput) · 199 unmodified lines
200		200
201	int __init erofs_init_ishare(void)	201	int __init erofs_init_ishare(void)
202	{	202	{
203	erofs_ishare_mnt = kern_mount(&erofs_anon_fs_type);	203	struct vfsmount *mnt;
204	return PTR_ERR_OR_ZERO(erofs_ishare_mnt);	204	int ret;
		205
		206	mnt = kern_mount(&erofs_anon_fs_type);
		207	if (IS_ERR(mnt))
		208	return PTR_ERR(mnt);
		209	/* generic_fadvise() doesn't work if s_bdi == &noop_backing_dev_info */
		210	ret = super_setup_bdi(mnt->mnt_sb);
		211	if (ret)
		212	kern_unmount(mnt);
		213	else
		214	erofs_ishare_mnt = mnt;
		215	return ret;
205	}	216	}
206		217
207	void erofs_exit_ishare(void)	218	void erofs_exit_ishare(void)

fs/erofs/zdata.c+3−0

 				       int bios)
 {
 	struct erofs_sb_info *const sbi = EROFS_SB(io->sb);
+	int gfp_flag;
 	/* wake up the caller thread for sync decompression */
 	if (io->sync) {
 			sbi->sync_decompress = EROFS_SYNC_DECOMPRESS_FORCE_ON;
 		return;
 	}
+	gfp_flag = memalloc_noio_save();
 	z_erofs_decompressqueue_work(&io->u.work);
+	memalloc_noio_restore(gfp_flag);
 }
 static void z_erofs_fill_bio_vec(struct bio_vec *bvec,

fs/ext4/Makefile+3−2

@@ -14,7 +14,8 @@ ext4-y := balloc.o bitmap.o block_validity.o dir.o ext4_jbd2.o extents.o \ · 13 unmodified lines
14		14
15	ext4-$(CONFIG_EXT4_FS_POSIX_ACL) += acl.o	15	ext4-$(CONFIG_EXT4_FS_POSIX_ACL) += acl.o
16	ext4-$(CONFIG_EXT4_FS_SECURITY) += xattr_security.o	16	ext4-$(CONFIG_EXT4_FS_SECURITY) += xattr_security.o
17	ext4-inode-test-objs += inode-test.o	17	ext4-test-objs += inode-test.o mballoc-test.o \
18	obj-$(CONFIG_EXT4_KUNIT_TESTS) += ext4-inode-test.o	18	extents-test.o
		19	obj-$(CONFIG_EXT4_KUNIT_TESTS) += ext4-test.o
19	ext4-$(CONFIG_FS_VERITY) += verity.o	20	ext4-$(CONFIG_FS_VERITY) += verity.o
20	ext4-$(CONFIG_FS_ENCRYPTION) += crypto.o	21	ext4-$(CONFIG_FS_ENCRYPTION) += crypto.o

fs/ext4/crypto.c+8−1

 	 */
 	if (handle) {
+		/*
+		 * Since the inode is new it is ok to pass the
+		 * XATTR_CREATE flag. This is necessary to match the
+		 * remaining journal credits check in the set_handle
+		 * function with the credits allocated for the new
+		 * inode.
+		 */
 		res = ext4_xattr_set_handle(handle, inode,
 					    EXT4_XATTR_INDEX_ENCRYPTION,
 					    EXT4_XATTR_NAME_ENCRYPTION_CONTEXT,
-					    ctx, len, 0);
+					    ctx, len, XATTR_CREATE);
 		if (!res) {
 			ext4_set_inode_flag(inode, EXT4_INODE_ENCRYPT);
 			ext4_clear_inode_state(inode,

fs/ext4/ext4.h+6−0

 	struct proc_dir_entry *s_proc;
 	struct kobject s_kobj;
 	struct completion s_kobj_unregister;
+	struct mutex s_error_notify_mutex; /* protects sysfs_notify vs kobject_del */
 	struct super_block *s_sb;
 	struct buffer_head *s_mmp_bh;
 extern int ext4_block_write_begin(handle_t *handle, struct folio *folio,
 				  loff_t pos, unsigned len,
 				  get_block_t *get_block);
+#if IS_ENABLED(CONFIG_EXT4_KUNIT_TESTS)
+#define EXPORT_SYMBOL_FOR_EXT4_TEST(sym) \
+	EXPORT_SYMBOL_FOR_MODULES(sym, "ext4-test")
+#endif
 #endif	/* __KERNEL__ */
 #endif	/* _EXT4_H */

fs/ext4/ext4_extents.h+12−0

@@ -264,5 +264,17 @@ static inline void ext4_idx_store_pblock(struct ext4_extent_idx *ix, · 263 unmodified lines
264	0xffff);	264	0xffff);
265	}	265	}
266		266
		267	extern int __ext4_ext_dirty(const char *where, unsigned int line,
		268	handle_t handle, struct inode inode,
		269	struct ext4_ext_path *path);
		270	extern int ext4_ext_zeroout(struct inode inode, struct ext4_extent ex);
		271	#if IS_ENABLED(CONFIG_EXT4_KUNIT_TESTS)
		272	extern int ext4_ext_space_root_idx_test(struct inode *inode, int check);
		273	extern struct ext4_ext_path *ext4_split_convert_extents_test(
		274	handle_t handle, struct inode inode,
		275	struct ext4_map_blocks *map,
		276	struct ext4_ext_path *path,
		277	int flags, unsigned int *allocated);
		278	#endif
267	#endif /* _EXT4_EXTENTS */	279	#endif /* _EXT4_EXTENTS */
268		280

fs/ext4/extents-test.c+7−5

 static void extents_kunit_exit(struct kunit *test)
 {
-	struct ext4_sb_info *sbi = k_ctx.k_ei->vfs_inode.i_sb->s_fs_info;
+	struct super_block *sb = k_ctx.k_ei->vfs_inode.i_sb;
+	struct ext4_sb_info *sbi = sb->s_fs_info;
+	ext4_es_unregister_shrinker(sbi);
 	kfree(sbi);
 	kfree(k_ctx.k_ei);
 	kfree(k_ctx.k_data);
 	eh->eh_depth = 0;
 	eh->eh_entries = cpu_to_le16(1);
 	eh->eh_magic = EXT4_EXT_MAGIC;
-	eh->eh_max =
+	eh->eh_max = cpu_to_le16(ext4_ext_space_root_idx_test(
-		cpu_to_le16(ext4_ext_space_root_idx(&k_ctx.k_ei->vfs_inode, 0));
+					&k_ctx.k_ei->vfs_inode, 0));
 	eh->eh_generation = 0;
 	/*
 	switch (param->type) {
 	case TEST_SPLIT_CONVERT:
-		path = ext4_split_convert_extents(NULL, inode, &map, path,
+		path = ext4_split_convert_extents_test(NULL, inode, &map,
-						  param->split_flags, NULL);
+					path, param->split_flags, NULL);
 		break;
 	case TEST_CREATE_BLOCKS:
 		ext4_map_create_blocks_helper(test, inode, &map, param->split_flags);

fs/ext4/extents.c+68−12

  *  - ENOMEM
  *  - EIO
  */
-static int __ext4_ext_dirty(const char *where, unsigned int line,
+int __ext4_ext_dirty(const char *where, unsigned int line,
-			    handle_t *handle, struct inode *inode,
+		     handle_t *handle, struct inode *inode,
-			    struct ext4_ext_path *path)
+		     struct ext4_ext_path *path)
 {
 	int err;
 	err = ext4_ext_get_access(handle, inode, path + k);
 	if (err)
 		return err;
+	if (unlikely(path[k].p_idx > EXT_LAST_INDEX(path[k].p_hdr))) {
+		EXT4_ERROR_INODE(inode,
+				 "path[%d].p_idx %p > EXT_LAST_INDEX %p",
+				 k, path[k].p_idx,
+				 EXT_LAST_INDEX(path[k].p_hdr));
+		return -EFSCORRUPTED;
+	}
 	path[k].p_idx->ei_block = border;
 	err = ext4_ext_dirty(handle, inode, path + k);
 	if (err)
 		err = ext4_ext_get_access(handle, inode, path + k);
 		if (err)
 			goto clean;
+		if (unlikely(path[k].p_idx > EXT_LAST_INDEX(path[k].p_hdr))) {
+			EXT4_ERROR_INODE(inode,
+					 "path[%d].p_idx %p > EXT_LAST_INDEX %p",
+					 k, path[k].p_idx,
+					 EXT_LAST_INDEX(path[k].p_hdr));
+			err = -EFSCORRUPTED;
+			goto clean;
+		}
 		path[k].p_idx->ei_block = border;
 		err = ext4_ext_dirty(handle, inode, path + k);
 		if (err)
 }
 /* FIXME!! we need to try to merge to left or right after zero-out  */
-static int ext4_ext_zeroout(struct inode *inode, struct ext4_extent *ex)
+int ext4_ext_zeroout(struct inode *inode, struct ext4_extent *ex)
 {
 	ext4_fsblk_t ee_pblock;
 	unsigned int ee_len;
 	insert_err = PTR_ERR(path);
 	err = 0;
+	if (insert_err != -ENOSPC && insert_err != -EDQUOT &&
+	    insert_err != -ENOMEM)
+		goto out_path;
 	/*
 	 * Get a new path to try to zeroout or fix the extent length.
 		goto out_path;
 	}
+	depth = ext_depth(inode);
+	ex = path[depth].p_ext;
+	if (!ex) {
+		EXT4_ERROR_INODE(inode,
+				 "bad extent address lblock: %lu, depth: %d pblock %llu",
+				 (unsigned long)ee_block, depth, path[depth].p_block);
+		err = -EFSCORRUPTED;
+		goto out;
+	}
 	err = ext4_ext_get_access(handle, inode, path + depth);
 	if (err)
 		goto out;
-	depth = ext_depth(inode);
-	ex = path[depth].p_ext;
 fix_extent_len:
 	ex->ee_len = orig_ex.ee_len;
 	err = ext4_ext_dirty(handle, inode, path + path->p_depth);
 	ext4_ext_mark_initialized(ex);
-	ext4_ext_dirty(handle, inode, path + depth);
+	err = ext4_ext_dirty(handle, inode, path + depth);
 	if (err)
 		return err;
 	path = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
 	if (IS_ERR(path)) {
 		err = PTR_ERR(path);
-		if (allocated_clusters) {
+		/*
+		 * Gracefully handle out of space conditions. If the filesystem
+		 * is inconsistent, we'll just leak allocated blocks to avoid
+		 * causing even more damage.
+		 */
+		if (allocated_clusters && (err == -EDQUOT || err == -ENOSPC)) {
 			int fb_flags = 0;
 			/*
 			 * free data blocks we just allocated.
 			 * not a good idea to call discard here directly,
 	return 0;
 }
-#ifdef CONFIG_EXT4_KUNIT_TESTS
+#if IS_ENABLED(CONFIG_EXT4_KUNIT_TESTS)
-#include "extents-test.c"
+int ext4_ext_space_root_idx_test(struct inode *inode, int check)
+{
+	return ext4_ext_space_root_idx(inode, check);
+}
+EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_ext_space_root_idx_test);
+struct ext4_ext_path *ext4_split_convert_extents_test(handle_t *handle,
+			struct inode *inode, struct ext4_map_blocks *map,
+			struct ext4_ext_path *path, int flags,
+			unsigned int *allocated)
+{
+	return ext4_split_convert_extents(handle, inode, map, path,
+					  flags, allocated);
+}
+EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_split_convert_extents_test);
+EXPORT_SYMBOL_FOR_EXT4_TEST(__ext4_ext_dirty);
+EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_ext_zeroout);
+EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_es_register_shrinker);
+EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_es_unregister_shrinker);
+EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_map_create_blocks);
+EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_es_init_tree);
+EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_es_lookup_extent);
+EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_es_insert_extent);
+EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_ext_insert_extent);
+EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_find_extent);
+EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_issue_zeroout);
+EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_map_query_blocks);
 #endif

fs/ext4/fast_commit.c+10−7

 	int ret = 0;
 	list_for_each_entry(ei, &sbi->s_fc_q[FC_Q_MAIN], i_fc_list) {
-		ret = jbd2_submit_inode_data(journal, ei->jinode);
+		ret = jbd2_submit_inode_data(journal, READ_ONCE(ei->jinode));
 		if (ret)
 			return ret;
 	}
 	list_for_each_entry(ei, &sbi->s_fc_q[FC_Q_MAIN], i_fc_list) {
-		ret = jbd2_wait_inode_data(journal, ei->jinode);
+		ret = jbd2_wait_inode_data(journal, READ_ONCE(ei->jinode));
 		if (ret)
 			return ret;
 	}
 	/* Immediately update the inode on disk. */
 	ret = ext4_handle_dirty_metadata(NULL, NULL, iloc.bh);
 	if (ret)
-		goto out;
+		goto out_brelse;
 	ret = sync_dirty_buffer(iloc.bh);
 	if (ret)
-		goto out;
+		goto out_brelse;
 	ret = ext4_mark_inode_used(sb, ino);
 	if (ret)
-		goto out;
+		goto out_brelse;
 	/* Given that we just wrote the inode on disk, this SHOULD succeed. */
 	inode = ext4_iget(sb, ino, EXT4_IGET_NORMAL);
 	if (IS_ERR(inode)) {
 		ext4_debug("Inode not found.");
-		return -EFSCORRUPTED;
+		inode = NULL;
+		ret = -EFSCORRUPTED;
+		goto out_brelse;
 	}
 	/*
 	ext4_inode_csum_set(inode, ext4_raw_inode(&iloc), EXT4_I(inode));
 	ret = ext4_handle_dirty_metadata(NULL, NULL, iloc.bh);
 	sync_dirty_buffer(iloc.bh);
+out_brelse:
 	brelse(iloc.bh);
 out:
 	iput(inode);
 	if (!ret)
 		blkdev_issue_flush(sb->s_bdev);
-	return 0;
+	return ret;
 }
 /*

fs/ext4/fsync.c+14−2

@@ -83,11 +83,23 @@ static int ext4_fsync_nojournal(struct file *file, loff_t start, loff_t end, · 82 unmodified lines
83	int datasync, bool *needs_barrier)	83	int datasync, bool *needs_barrier)
84	{	84	{
85	struct inode *inode = file->f_inode;	85	struct inode *inode = file->f_inode;
		86	struct writeback_control wbc = {
		87	.sync_mode = WB_SYNC_ALL,
		88	.nr_to_write = 0,
		89	};
86	int ret;	90	int ret;
87		91
88	ret = generic_buffers_fsync_noflush(file, start, end, datasync);	92	ret = generic_buffers_fsync_noflush(file, start, end, datasync);
89	if (!ret)	93	if (ret)
90	ret = ext4_sync_parent(inode);	94	return ret;
		95
		96	/* Force writeout of inode table buffer to disk */
		97	ret = ext4_write_inode(inode, &wbc);
		98	if (ret)
		99	return ret;
		100
		101	ret = ext4_sync_parent(inode);
		102
91	if (test_opt(inode->i_sb, BARRIER))	103	if (test_opt(inode->i_sb, BARRIER))
92	*needs_barrier = true;	104	*needs_barrier = true;
93		105

fs/ext4/ialloc.c+6−0

 	if (unlikely(!gdp))
 		return 0;
+	/* Inode was never used in this filesystem? */
+	if (ext4_has_group_desc_csum(sb) &&
+	    (gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT) ||
+	     ino >= EXT4_INODES_PER_GROUP(sb) - ext4_itable_unused_count(sb, gdp)))
+		return 0;
 	bh = sb_find_get_block(sb, ext4_inode_table(sb, gdp) +
 		       (ino / inodes_per_block));
 	if (!bh || !buffer_uptodate(bh))

fs/ext4/inline.c+9−1

@@ -522,7 +522,15 @@ static int ext4_read_inline_folio(struct inode inode, struct folio folio) · 521 unmodified lines
522	goto out;	522	goto out;
523		523
524	len = min_t(size_t, ext4_get_inline_size(inode), i_size_read(inode));	524	len = min_t(size_t, ext4_get_inline_size(inode), i_size_read(inode));
525	BUG_ON(len > PAGE_SIZE);	525
		526	if (len > PAGE_SIZE) {
		527	ext4_error_inode(inode, __func__, __LINE__, 0,
		528	"inline size %zu exceeds PAGE_SIZE", len);
		529	ret = -EFSCORRUPTED;
		530	brelse(iloc.bh);
		531	goto out;
		532	}
		533
526	kaddr = kmap_local_folio(folio, 0);	534	kaddr = kmap_local_folio(folio, 0);
527	ret = ext4_read_inline_data(inode, kaddr, len, &iloc);	535	ret = ext4_read_inline_data(inode, kaddr, len, &iloc);
528	kaddr = folio_zero_tail(folio, len, kaddr + len);	536	kaddr = folio_zero_tail(folio, len, kaddr + len);

fs/ext4/inode.c+60−15

@@ -128,6 +128,8 @@ void ext4_inode_csum_set(struct inode inode, struct ext4_inode raw, · 127 unmodified lines
128	static inline int ext4_begin_ordered_truncate(struct inode *inode,	128	static inline int ext4_begin_ordered_truncate(struct inode *inode,
129	loff_t new_size)	129	loff_t new_size)
130	{	130	{
		131	struct jbd2_inode *jinode = READ_ONCE(EXT4_I(inode)->jinode);
		132
131	trace_ext4_begin_ordered_truncate(inode, new_size);	133	trace_ext4_begin_ordered_truncate(inode, new_size);
132	/*	134	/*
133	* If jinode is zero, then we never opened the file for	135	* If jinode is zero, then we never opened the file for
@@ -135,10 +137,10 @@ static inline int ext4_begin_ordered_truncate(struct inode *inode, · 1 unmodified line
135	* jbd2_journal_begin_ordered_truncate() since there's no	137	* jbd2_journal_begin_ordered_truncate() since there's no
136	* outstanding writes we need to flush.	138	* outstanding writes we need to flush.
137	*/	139	*/
138	if (!EXT4_I(inode)->jinode)	140	if (!jinode)
139	return 0;	141	return 0;
140	return jbd2_journal_begin_ordered_truncate(EXT4_JOURNAL(inode),	142	return jbd2_journal_begin_ordered_truncate(EXT4_JOURNAL(inode),
141	EXT4_I(inode)->jinode,	143	jinode,
142	new_size);	144	new_size);
143	}	145	}
144		146
@@ -184,6 +186,14 @@ void ext4_evict_inode(struct inode *inode) · 39 unmodified lines
184	if (EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)	186	if (EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)
185	ext4_evict_ea_inode(inode);	187	ext4_evict_ea_inode(inode);
186	if (inode->i_nlink) {	188	if (inode->i_nlink) {
		189	/*
		190	* If there's dirty page will lead to data loss, user
		191	* could see stale data.
		192	*/
		193	if (unlikely(!ext4_emergency_state(inode->i_sb) &&
		194	mapping_tagged(&inode->i_data, PAGECACHE_TAG_DIRTY)))
		195	ext4_warning_inode(inode, "data will be lost");
		196
187	truncate_inode_pages_final(&inode->i_data);	197	truncate_inode_pages_final(&inode->i_data);
188		198
189	goto no_delete;	199	goto no_delete;
@@ -4451,8 +4461,13 @@ int ext4_inode_attach_jinode(struct inode *inode) · 4261 unmodified lines
4451	spin_unlock(&inode->i_lock);	4461	spin_unlock(&inode->i_lock);
4452	return -ENOMEM;	4462	return -ENOMEM;
4453	}	4463	}
4454	ei->jinode = jinode;	4464	jbd2_journal_init_jbd_inode(jinode, inode);
4455	jbd2_journal_init_jbd_inode(ei->jinode, inode);	4465	/*
		4466	* Publish ->jinode only after it is fully initialized so that
		4467	* readers never observe a partially initialized jbd2_inode.
		4468	*/
		4469	smp_wmb();
		4470	WRITE_ONCE(ei->jinode, jinode);
4456	jinode = NULL;	4471	jinode = NULL;
4457	}	4472	}
4458	spin_unlock(&inode->i_lock);	4473	spin_unlock(&inode->i_lock);
@@ -5401,18 +5416,36 @@ struct inode __ext4_iget(struct super_block sb, unsigned long ino, · 942 unmodified lines
5401	inode->i_op = &ext4_encrypted_symlink_inode_operations;	5416	inode->i_op = &ext4_encrypted_symlink_inode_operations;
5402	} else if (ext4_inode_is_fast_symlink(inode)) {	5417	} else if (ext4_inode_is_fast_symlink(inode)) {
5403	inode->i_op = &ext4_fast_symlink_inode_operations;	5418	inode->i_op = &ext4_fast_symlink_inode_operations;
5404	if (inode->i_size == 0 \|\|	5419
5405	inode->i_size >= sizeof(ei->i_data) \|\|	5420	/*
5406	strnlen((char *)ei->i_data, inode->i_size + 1) !=	5421	* Orphan cleanup can see inodes with i_size == 0
5407	inode->i_size) {	5422	* and i_data uninitialized. Skip size checks in
5408	ext4_error_inode(inode, function, line, 0,	5423	* that case. This is safe because the first thing
5409	"invalid fast symlink length %llu",	5424	* ext4_evict_inode() does for fast symlinks is
5410	(unsigned long long)inode->i_size);	5425	* clearing of i_data and i_size.
5411	ret = -EFSCORRUPTED;	5426	*/
5412	goto bad_inode;	5427	if ((EXT4_SB(sb)->s_mount_state & EXT4_ORPHAN_FS)) {
		5428	if (inode->i_nlink != 0) {
		5429	ext4_error_inode(inode, function, line, 0,
		5430	"invalid orphan symlink nlink %d",
		5431	inode->i_nlink);
		5432	ret = -EFSCORRUPTED;
		5433	goto bad_inode;
		5434	}
		5435	} else {
		5436	if (inode->i_size == 0 \|\|
		5437	inode->i_size >= sizeof(ei->i_data) \|\|
		5438	strnlen((char *)ei->i_data, inode->i_size + 1) !=
		5439	inode->i_size) {
		5440	ext4_error_inode(inode, function, line, 0,
		5441	"invalid fast symlink length %llu",
		5442	(unsigned long long)inode->i_size);
		5443	ret = -EFSCORRUPTED;
		5444	goto bad_inode;
		5445	}
		5446	inode_set_cached_link(inode, (char *)ei->i_data,
		5447	inode->i_size);
5413	}	5448	}
5414	inode_set_cached_link(inode, (char *)ei->i_data,
5415	inode->i_size);
5416	} else {	5449	} else {
5417	inode->i_op = &ext4_symlink_inode_operations;	5450	inode->i_op = &ext4_symlink_inode_operations;
5418	}	5451	}
@@ -5849,6 +5882,18 @@ int ext4_setattr(struct mnt_idmap idmap, struct dentry dentry, · 430 unmodified lines
5849	if (attr->ia_size == inode->i_size)	5882	if (attr->ia_size == inode->i_size)
5850	inc_ivers = false;	5883	inc_ivers = false;
5851		5884
		5885	/*
		5886	* If file has inline data but new size exceeds inline capacity,
		5887	* convert to extent-based storage first to prevent inconsistent
		5888	* state (inline flag set but size exceeds inline capacity).
		5889	*/
		5890	if (ext4_has_inline_data(inode) &&
		5891	attr->ia_size > EXT4_I(inode)->i_inline_size) {
		5892	error = ext4_convert_inline_data(inode);
		5893	if (error)
		5894	goto err_out;
		5895	}
		5896
5852	if (shrink) {	5897	if (shrink) {
5853	if (ext4_should_order_data(inode)) {	5898	if (ext4_should_order_data(inode)) {
5854	error = ext4_begin_ordered_truncate(inode,	5899	error = ext4_begin_ordered_truncate(inode,

fs/ext4/mballoc-test.c+41−40

 #include <linux/random.h>
 #include "ext4.h"
+#include "mballoc.h"
 struct mbt_grp_ctx {
 	struct buffer_head bitmap_bh;
 	if (state)
 		mb_set_bits(bitmap_bh->b_data, blkoff, len);
 	else
-		mb_clear_bits(bitmap_bh->b_data, blkoff, len);
+		mb_clear_bits_test(bitmap_bh->b_data, blkoff, len);
 	return 0;
 }
 	/* get block at goal */
 	ar.goal = ext4_group_first_block_no(sb, goal_group);
-	found = ext4_mb_new_blocks_simple(&ar, &err);
+	found = ext4_mb_new_blocks_simple_test(&ar, &err);
 	KUNIT_ASSERT_EQ_MSG(test, ar.goal, found,
 		"failed to alloc block at goal, expected %llu found %llu",
 		ar.goal, found);
 	/* get block after goal in goal group */
 	ar.goal = ext4_group_first_block_no(sb, goal_group);
-	found = ext4_mb_new_blocks_simple(&ar, &err);
+	found = ext4_mb_new_blocks_simple_test(&ar, &err);
 	KUNIT_ASSERT_EQ_MSG(test, ar.goal + EXT4_C2B(sbi, 1), found,
 		"failed to alloc block after goal in goal group, expected %llu found %llu",
 		ar.goal + 1, found);
 	/* get block after goal group */
 	mbt_ctx_mark_used(sb, goal_group, 0, EXT4_CLUSTERS_PER_GROUP(sb));
 	ar.goal = ext4_group_first_block_no(sb, goal_group);
-	found = ext4_mb_new_blocks_simple(&ar, &err);
+	found = ext4_mb_new_blocks_simple_test(&ar, &err);
 	KUNIT_ASSERT_EQ_MSG(test,
 		ext4_group_first_block_no(sb, goal_group + 1), found,
 		"failed to alloc block after goal group, expected %llu found %llu",
 	for (i = goal_group; i < ext4_get_groups_count(sb); i++)
 		mbt_ctx_mark_used(sb, i, 0, EXT4_CLUSTERS_PER_GROUP(sb));
 	ar.goal = ext4_group_first_block_no(sb, goal_group);
-	found = ext4_mb_new_blocks_simple(&ar, &err);
+	found = ext4_mb_new_blocks_simple_test(&ar, &err);
 	KUNIT_ASSERT_EQ_MSG(test,
 		ext4_group_first_block_no(sb, 0) + EXT4_C2B(sbi, 1), found,
 		"failed to alloc block before goal group, expected %llu found %llu",
 	for (i = 0; i < ext4_get_groups_count(sb); i++)
 		mbt_ctx_mark_used(sb, i, 0, EXT4_CLUSTERS_PER_GROUP(sb));
 	ar.goal = ext4_group_first_block_no(sb, goal_group);
-	found = ext4_mb_new_blocks_simple(&ar, &err);
+	found = ext4_mb_new_blocks_simple_test(&ar, &err);
 	KUNIT_ASSERT_NE_MSG(test, err, 0,
 		"unexpectedly get block when no block is available");
 }
 			continue;
 		bitmap = mbt_ctx_bitmap(sb, i);
-		bit = mb_find_next_zero_bit(bitmap, max, 0);
+		bit = mb_find_next_zero_bit_test(bitmap, max, 0);
 		KUNIT_ASSERT_EQ_MSG(test, bit, max,
 				    "free block on unexpected group %d", i);
 	}
 	bitmap = mbt_ctx_bitmap(sb, goal_group);
-	bit = mb_find_next_zero_bit(bitmap, max, 0);
+	bit = mb_find_next_zero_bit_test(bitmap, max, 0);
 	KUNIT_ASSERT_EQ(test, bit, start);
-	bit = mb_find_next_bit(bitmap, max, bit + 1);
+	bit = mb_find_next_bit_test(bitmap, max, bit + 1);
 	KUNIT_ASSERT_EQ(test, bit, start + len);
 }
 	block = ext4_group_first_block_no(sb, goal_group) +
 		EXT4_C2B(sbi, start);
-	ext4_free_blocks_simple(inode, block, len);
+	ext4_free_blocks_simple_test(inode, block, len);
 	validate_free_blocks_simple(test, sb, goal_group, start, len);
 	mbt_ctx_mark_used(sb, goal_group, 0, EXT4_CLUSTERS_PER_GROUP(sb));
 }
 	bitmap = mbt_ctx_bitmap(sb, TEST_GOAL_GROUP);
 	memset(bitmap, 0, sb->s_blocksize);
-	ret = ext4_mb_mark_diskspace_used(ac, NULL);
+	ret = ext4_mb_mark_diskspace_used_test(ac, NULL);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 	max = EXT4_CLUSTERS_PER_GROUP(sb);
-	i = mb_find_next_bit(bitmap, max, 0);
+	i = mb_find_next_bit_test(bitmap, max, 0);
 	KUNIT_ASSERT_EQ(test, i, start);
-	i = mb_find_next_zero_bit(bitmap, max, i + 1);
+	i = mb_find_next_zero_bit_test(bitmap, max, i + 1);
 	KUNIT_ASSERT_EQ(test, i, start + len);
-	i = mb_find_next_bit(bitmap, max, i + 1);
+	i = mb_find_next_bit_test(bitmap, max, i + 1);
 	KUNIT_ASSERT_EQ(test, max, i);
 }
 	max = EXT4_CLUSTERS_PER_GROUP(sb);
 	bb_h = buddy + sbi->s_mb_offsets[1];
-	off = mb_find_next_zero_bit(bb, max, 0);
+	off = mb_find_next_zero_bit_test(bb, max, 0);
 	grp->bb_first_free = off;
 	while (off < max) {
 		grp->bb_counters[0]++;
 		grp->bb_free++;
-		if (!(off & 1) && !mb_test_bit(off + 1, bb)) {
+		if (!(off & 1) && !mb_test_bit_test(off + 1, bb)) {
 			grp->bb_free++;
 			grp->bb_counters[0]--;
-			mb_clear_bit(off >> 1, bb_h);
+			mb_clear_bit_test(off >> 1, bb_h);
 			grp->bb_counters[1]++;
 			grp->bb_largest_free_order = 1;
 			off++;
 		}
-		off = mb_find_next_zero_bit(bb, max, off + 1);
+		off = mb_find_next_zero_bit_test(bb, max, off + 1);
 	}
 	for (order = 1; order < MB_NUM_ORDERS(sb) - 1; order++) {
 		bb = buddy + sbi->s_mb_offsets[order];
 		bb_h = buddy + sbi->s_mb_offsets[order + 1];
 		max = max >> 1;
-		off = mb_find_next_zero_bit(bb, max, 0);
+		off = mb_find_next_zero_bit_test(bb, max, 0);
 		while (off < max) {
-			if (!(off & 1) && !mb_test_bit(off + 1, bb)) {
+			if (!(off & 1) && !mb_test_bit_test(off + 1, bb)) {
 				mb_set_bits(bb, off, 2);
 				grp->bb_counters[order] -= 2;
-				mb_clear_bit(off >> 1, bb_h);
+				mb_clear_bit_test(off >> 1, bb_h);
 				grp->bb_counters[order + 1]++;
 				grp->bb_largest_free_order = order + 1;
 				off++;
 			}
-			off = mb_find_next_zero_bit(bb, max, off + 1);
+			off = mb_find_next_zero_bit_test(bb, max, off + 1);
 		}
 	}
 	max = EXT4_CLUSTERS_PER_GROUP(sb);
-	off = mb_find_next_zero_bit(bitmap, max, 0);
+	off = mb_find_next_zero_bit_test(bitmap, max, 0);
 	while (off < max) {
 		grp->bb_fragments++;
-		off = mb_find_next_bit(bitmap, max, off + 1);
+		off = mb_find_next_bit_test(bitmap, max, off + 1);
 		if (off + 1 >= max)
 			break;
-		off = mb_find_next_zero_bit(bitmap, max, off + 1);
+		off = mb_find_next_zero_bit_test(bitmap, max, off + 1);
 	}
 }
 	/* needed by validation in ext4_mb_generate_buddy */
 	ext4_grp->bb_free = mbt_grp->bb_free;
 	memset(ext4_buddy, 0xff, sb->s_blocksize);
-	ext4_mb_generate_buddy(sb, ext4_buddy, bitmap, TEST_GOAL_GROUP,
+	ext4_mb_generate_buddy_test(sb, ext4_buddy, bitmap, TEST_GOAL_GROUP,
 			       ext4_grp);
 	KUNIT_ASSERT_EQ(test, memcmp(mbt_buddy, ext4_buddy, sb->s_blocksize),
 	ex.fe_group = TEST_GOAL_GROUP;
 	ext4_lock_group(sb, TEST_GOAL_GROUP);
-	mb_mark_used(e4b, &ex);
+	mb_mark_used_test(e4b, &ex);
 	ext4_unlock_group(sb, TEST_GOAL_GROUP);
 	mb_set_bits(bitmap, start, len);
 	memset(buddy, 0xff, sb->s_blocksize);
 	for (i = 0; i < MB_NUM_ORDERS(sb); i++)
 		grp->bb_counters[i] = 0;
-	ext4_mb_generate_buddy(sb, buddy, bitmap, 0, grp);
+	ext4_mb_generate_buddy_test(sb, buddy, bitmap, 0, grp);
 	KUNIT_ASSERT_EQ(test, memcmp(buddy, e4b->bd_buddy, sb->s_blocksize),
 			0);
 				bb_counters[MB_NUM_ORDERS(sb)]), GFP_KERNEL);
 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, grp);
-	ret = ext4_mb_load_buddy(sb, TEST_GOAL_GROUP, &e4b);
+	ret = ext4_mb_load_buddy_test(sb, TEST_GOAL_GROUP, &e4b);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 	grp->bb_free = EXT4_CLUSTERS_PER_GROUP(sb);
 		test_mb_mark_used_range(test, &e4b, ranges[i].start,
 					ranges[i].len, bitmap, buddy, grp);
-	ext4_mb_unload_buddy(&e4b);
+	ext4_mb_unload_buddy_test(&e4b);
 }
 static void
 		return;
 	ext4_lock_group(sb, e4b->bd_group);
-	mb_free_blocks(NULL, e4b, start, len);
+	mb_free_blocks_test(NULL, e4b, start, len);
 	ext4_unlock_group(sb, e4b->bd_group);
-	mb_clear_bits(bitmap, start, len);
+	mb_clear_bits_test(bitmap, start, len);
 	/* bypass bb_free validatoin in ext4_mb_generate_buddy */
 	grp->bb_free += len;
 	memset(buddy, 0xff, sb->s_blocksize);
 	for (i = 0; i < MB_NUM_ORDERS(sb); i++)
 		grp->bb_counters[i] = 0;
-	ext4_mb_generate_buddy(sb, buddy, bitmap, 0, grp);
+	ext4_mb_generate_buddy_test(sb, buddy, bitmap, 0, grp);
 	KUNIT_ASSERT_EQ(test, memcmp(buddy, e4b->bd_buddy, sb->s_blocksize),
 			0);
 				bb_counters[MB_NUM_ORDERS(sb)]), GFP_KERNEL);
 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, grp);
-	ret = ext4_mb_load_buddy(sb, TEST_GOAL_GROUP, &e4b);
+	ret = ext4_mb_load_buddy_test(sb, TEST_GOAL_GROUP, &e4b);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 	ex.fe_start = 0;
 	ex.fe_group = TEST_GOAL_GROUP;
 	ext4_lock_group(sb, TEST_GOAL_GROUP);
-	mb_mark_used(&e4b, &ex);
+	mb_mark_used_test(&e4b, &ex);
 	ext4_unlock_group(sb, TEST_GOAL_GROUP);
 	grp->bb_free = 0;
 		test_mb_free_blocks_range(test, &e4b, ranges[i].start,
 					  ranges[i].len, bitmap, buddy, grp);
-	ext4_mb_unload_buddy(&e4b);
+	ext4_mb_unload_buddy_test(&e4b);
 }
 #define COUNT_FOR_ESTIMATE 100000
 	if (sb->s_blocksize > PAGE_SIZE)
 		kunit_skip(test, "blocksize exceeds pagesize");
-	ret = ext4_mb_load_buddy(sb, TEST_GOAL_GROUP, &e4b);
+	ret = ext4_mb_load_buddy_test(sb, TEST_GOAL_GROUP, &e4b);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 	ex.fe_group = TEST_GOAL_GROUP;
 			ex.fe_start = ranges[i].start;
 			ex.fe_len = ranges[i].len;
 			ext4_lock_group(sb, TEST_GOAL_GROUP);
-			mb_mark_used(&e4b, &ex);
+			mb_mark_used_test(&e4b, &ex);
 			ext4_unlock_group(sb, TEST_GOAL_GROUP);
 		}
 		end = jiffies;
 				continue;
 			ext4_lock_group(sb, TEST_GOAL_GROUP);
-			mb_free_blocks(NULL, &e4b, ranges[i].start,
+			mb_free_blocks_test(NULL, &e4b, ranges[i].start,
 				       ranges[i].len);
 			ext4_unlock_group(sb, TEST_GOAL_GROUP);
 		}
 	}
 	kunit_info(test, "costed jiffies %lu\n", all);
-	ext4_mb_unload_buddy(&e4b);
+	ext4_mb_unload_buddy_test(&e4b);
 }
 static const struct mbt_ext4_block_layout mbt_test_layouts[] = {

fs/ext4/mballoc.c+114−18

@@ -1199,6 +1199,8 @@ static int ext4_mb_scan_groups(struct ext4_allocation_context *ac) · 1198 unmodified lines
1199		1199
1200	/* searching for the right group start from the goal value specified */	1200	/* searching for the right group start from the goal value specified */
1201	start = ac->ac_g_ex.fe_group;	1201	start = ac->ac_g_ex.fe_group;
		1202	if (start >= ngroups)
		1203	start = 0;
1202	ac->ac_prefetch_grp = start;	1204	ac->ac_prefetch_grp = start;
1203	ac->ac_prefetch_nr = 0;	1205	ac->ac_prefetch_nr = 0;
1204		1206
@@ -2443,8 +2445,12 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, · 1238 unmodified lines
2443	return 0;	2445	return 0;
2444		2446
2445	err = ext4_mb_load_buddy(ac->ac_sb, group, e4b);	2447	err = ext4_mb_load_buddy(ac->ac_sb, group, e4b);
2446	if (err)	2448	if (err) {
		2449	if (EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info) &&
		2450	!(ac->ac_flags & EXT4_MB_HINT_GOAL_ONLY))
		2451	return 0;
2447	return err;	2452	return err;
		2453	}
2448		2454
2449	ext4_lock_group(ac->ac_sb, group);	2455	ext4_lock_group(ac->ac_sb, group);
2450	if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info)))	2456	if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info)))
@@ -3580,9 +3586,7 @@ err_freebuddy: · 1129 unmodified lines
3580	rcu_read_unlock();	3586	rcu_read_unlock();
3581	iput(sbi->s_buddy_cache);	3587	iput(sbi->s_buddy_cache);
3582	err_freesgi:	3588	err_freesgi:
3583	rcu_read_lock();	3589	kvfree(rcu_access_pointer(sbi->s_group_info));
3584	kvfree(rcu_dereference(sbi->s_group_info));
3585	rcu_read_unlock();
3586	return -ENOMEM;	3590	return -ENOMEM;
3587	}	3591	}
3588		3592
@@ -3889,15 +3893,14 @@ void ext4_mb_release(struct super_block *sb) · 300 unmodified lines
3889	struct kmem_cache *cachep = get_groupinfo_cache(sb->s_blocksize_bits);	3893	struct kmem_cache *cachep = get_groupinfo_cache(sb->s_blocksize_bits);
3890	int count;	3894	int count;
3891		3895
3892	if (test_opt(sb, DISCARD)) {	3896	/*
3893	/*	3897	* wait the discard work to drain all of ext4_free_data
3894	* wait the discard work to drain all of ext4_free_data	3898	*/
3895	*/	3899	flush_work(&sbi->s_discard_work);
3896	flush_work(&sbi->s_discard_work);	3900	WARN_ON_ONCE(!list_empty(&sbi->s_discard_list));
3897	WARN_ON_ONCE(!list_empty(&sbi->s_discard_list));
3898	}
3899		3901
3900	if (sbi->s_group_info) {	3902	group_info = rcu_access_pointer(sbi->s_group_info);
		3903	if (group_info) {
3901	for (i = 0; i < ngroups; i++) {	3904	for (i = 0; i < ngroups; i++) {
3902	cond_resched();	3905	cond_resched();
3903	grinfo = ext4_get_group_info(sb, i);	3906	grinfo = ext4_get_group_info(sb, i);
@@ -3915,12 +3918,9 @@ void ext4_mb_release(struct super_block *sb) · 11 unmodified lines
3915	num_meta_group_infos = (ngroups +	3918	num_meta_group_infos = (ngroups +
3916	EXT4_DESC_PER_BLOCK(sb) - 1) >>	3919	EXT4_DESC_PER_BLOCK(sb) - 1) >>
3917	EXT4_DESC_PER_BLOCK_BITS(sb);	3920	EXT4_DESC_PER_BLOCK_BITS(sb);
3918	rcu_read_lock();
3919	group_info = rcu_dereference(sbi->s_group_info);
3920	for (i = 0; i < num_meta_group_infos; i++)	3921	for (i = 0; i < num_meta_group_infos; i++)
3921	kfree(group_info[i]);	3922	kfree(group_info[i]);
3922	kvfree(group_info);	3923	kvfree(group_info);
3923	rcu_read_unlock();
3924	}	3924	}
3925	ext4_mb_avg_fragment_size_destroy(sbi);	3925	ext4_mb_avg_fragment_size_destroy(sbi);
3926	ext4_mb_largest_free_orders_destroy(sbi);	3926	ext4_mb_largest_free_orders_destroy(sbi);
@@ -4084,7 +4084,7 @@ void ext4_exit_mballoc(void) · 157 unmodified lines
4084		4084
4085	#define EXT4_MB_BITMAP_MARKED_CHECK 0x0001	4085	#define EXT4_MB_BITMAP_MARKED_CHECK 0x0001
4086	#define EXT4_MB_SYNC_UPDATE 0x0002	4086	#define EXT4_MB_SYNC_UPDATE 0x0002
4087	static int	4087	int
4088	ext4_mb_mark_context(handle_t handle, struct super_block sb, bool state,	4088	ext4_mb_mark_context(handle_t handle, struct super_block sb, bool state,
4089	ext4_group_t group, ext4_grpblk_t blkoff,	4089	ext4_group_t group, ext4_grpblk_t blkoff,
4090	ext4_grpblk_t len, int flags, ext4_grpblk_t *ret_changed)	4090	ext4_grpblk_t len, int flags, ext4_grpblk_t *ret_changed)
@@ -7188,6 +7188,102 @@ out_unload: · 3097 unmodified lines
7188	return error;	7188	return error;
7189	}	7189	}
7190		7190
7191	#ifdef CONFIG_EXT4_KUNIT_TESTS	7191	#if IS_ENABLED(CONFIG_EXT4_KUNIT_TESTS)
7192	#include "mballoc-test.c"	7192	void mb_clear_bits_test(void *bm, int cur, int len)
		7193	{
		7194	mb_clear_bits(bm, cur, len);
		7195	}
		7196	EXPORT_SYMBOL_FOR_EXT4_TEST(mb_clear_bits_test);
		7197
		7198	ext4_fsblk_t
		7199	ext4_mb_new_blocks_simple_test(struct ext4_allocation_request *ar,
		7200	int *errp)
		7201	{
		7202	return ext4_mb_new_blocks_simple(ar, errp);
		7203	}
		7204	EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_mb_new_blocks_simple_test);
		7205
		7206	int mb_find_next_zero_bit_test(void *addr, int max, int start)
		7207	{
		7208	return mb_find_next_zero_bit(addr, max, start);
		7209	}
		7210	EXPORT_SYMBOL_FOR_EXT4_TEST(mb_find_next_zero_bit_test);
		7211
		7212	int mb_find_next_bit_test(void *addr, int max, int start)
		7213	{
		7214	return mb_find_next_bit(addr, max, start);
		7215	}
		7216	EXPORT_SYMBOL_FOR_EXT4_TEST(mb_find_next_bit_test);
		7217
		7218	void mb_clear_bit_test(int bit, void *addr)
		7219	{
		7220	mb_clear_bit(bit, addr);
		7221	}
		7222	EXPORT_SYMBOL_FOR_EXT4_TEST(mb_clear_bit_test);
		7223
		7224	int mb_test_bit_test(int bit, void *addr)
		7225	{
		7226	return mb_test_bit(bit, addr);
		7227	}
		7228	EXPORT_SYMBOL_FOR_EXT4_TEST(mb_test_bit_test);
		7229
		7230	int ext4_mb_mark_diskspace_used_test(struct ext4_allocation_context *ac,
		7231	handle_t *handle)
		7232	{
		7233	return ext4_mb_mark_diskspace_used(ac, handle);
		7234	}
		7235	EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_mb_mark_diskspace_used_test);
		7236
		7237	int mb_mark_used_test(struct ext4_buddy e4b, struct ext4_free_extent ex)
		7238	{
		7239	return mb_mark_used(e4b, ex);
		7240	}
		7241	EXPORT_SYMBOL_FOR_EXT4_TEST(mb_mark_used_test);
		7242
		7243	void ext4_mb_generate_buddy_test(struct super_block sb, void buddy,
		7244	void *bitmap, ext4_group_t group,
		7245	struct ext4_group_info *grp)
		7246	{
		7247	ext4_mb_generate_buddy(sb, buddy, bitmap, group, grp);
		7248	}
		7249	EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_mb_generate_buddy_test);
		7250
		7251	int ext4_mb_load_buddy_test(struct super_block *sb, ext4_group_t group,
		7252	struct ext4_buddy *e4b)
		7253	{
		7254	return ext4_mb_load_buddy(sb, group, e4b);
		7255	}
		7256	EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_mb_load_buddy_test);
		7257
		7258	void ext4_mb_unload_buddy_test(struct ext4_buddy *e4b)
		7259	{
		7260	ext4_mb_unload_buddy(e4b);
		7261	}
		7262	EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_mb_unload_buddy_test);
		7263
		7264	void mb_free_blocks_test(struct inode inode, struct ext4_buddy e4b,
		7265	int first, int count)
		7266	{
		7267	mb_free_blocks(inode, e4b, first, count);
		7268	}
		7269	EXPORT_SYMBOL_FOR_EXT4_TEST(mb_free_blocks_test);
		7270
		7271	void ext4_free_blocks_simple_test(struct inode *inode, ext4_fsblk_t block,
		7272	unsigned long count)
		7273	{
		7274	return ext4_free_blocks_simple(inode, block, count);
		7275	}
		7276	EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_free_blocks_simple_test);
		7277
		7278	EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_wait_block_bitmap);
		7279	EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_mb_init);
		7280	EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_get_group_desc);
		7281	EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_count_free_clusters);
		7282	EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_get_group_info);
		7283	EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_free_group_clusters_set);
		7284	EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_mb_release);
		7285	EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_read_block_bitmap_nowait);
		7286	EXPORT_SYMBOL_FOR_EXT4_TEST(mb_set_bits);
		7287	EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_fc_init_inode);
		7288	EXPORT_SYMBOL_FOR_EXT4_TEST(ext4_mb_mark_context);
7193	#endif	7289	#endif

fs/ext4/mballoc.h+30−0

@@ -270,4 +270,34 @@ ext4_mballoc_query_range( · 269 unmodified lines
270	ext4_mballoc_query_range_fn formatter,	270	ext4_mballoc_query_range_fn formatter,
271	void *priv);	271	void *priv);
272		272
		273	extern int ext4_mb_mark_context(handle_t *handle,
		274	struct super_block *sb, bool state,
		275	ext4_group_t group, ext4_grpblk_t blkoff,
		276	ext4_grpblk_t len, int flags,
		277	ext4_grpblk_t *ret_changed);
		278	#if IS_ENABLED(CONFIG_EXT4_KUNIT_TESTS)
		279	extern void mb_clear_bits_test(void *bm, int cur, int len);
		280	extern ext4_fsblk_t
		281	ext4_mb_new_blocks_simple_test(struct ext4_allocation_request *ar,
		282	int *errp);
		283	extern int mb_find_next_zero_bit_test(void *addr, int max, int start);
		284	extern int mb_find_next_bit_test(void *addr, int max, int start);
		285	extern void mb_clear_bit_test(int bit, void *addr);
		286	extern int mb_test_bit_test(int bit, void *addr);
		287	extern int
		288	ext4_mb_mark_diskspace_used_test(struct ext4_allocation_context *ac,
		289	handle_t *handle);
		290	extern int mb_mark_used_test(struct ext4_buddy *e4b,
		291	struct ext4_free_extent *ex);
		292	extern void ext4_mb_generate_buddy_test(struct super_block *sb,
		293	void buddy, void bitmap, ext4_group_t group,
		294	struct ext4_group_info *grp);
		295	extern int ext4_mb_load_buddy_test(struct super_block *sb,
		296	ext4_group_t group, struct ext4_buddy *e4b);
		297	extern void ext4_mb_unload_buddy_test(struct ext4_buddy *e4b);
		298	extern void mb_free_blocks_test(struct inode *inode,
		299	struct ext4_buddy *e4b, int first, int count);
		300	extern void ext4_free_blocks_simple_test(struct inode *inode,
		301	ext4_fsblk_t block, unsigned long count);
		302	#endif
273	#endif	303	#endif

fs/ext4/page-io.c+8−2

 		nr_to_submit++;
 	} while ((bh = bh->b_this_page) != head);
-	/* Nothing to submit? Just unlock the folio... */
+	if (!nr_to_submit) {
-	if (!nr_to_submit)
+		/*
+		 * We have nothing to submit. Just cycle the folio through
+		 * writeback state to properly update xarray tags.
+		 */
+		__folio_start_writeback(folio, keep_towrite);
+		folio_end_writeback(folio);
 		return 0;
+	}
 	bh = head = folio_buffers(folio);

fs/ext4/super.c+31−6

 	struct buffer_head **group_desc;
 	int i;
-	rcu_read_lock();
+	group_desc = rcu_access_pointer(sbi->s_group_desc);
-	group_desc = rcu_dereference(sbi->s_group_desc);
 	for (i = 0; i < sbi->s_gdb_count; i++)
 		brelse(group_desc[i]);
 	kvfree(group_desc);
-	rcu_read_unlock();
 }
 static void ext4_flex_groups_free(struct ext4_sb_info *sbi)
 	struct flex_groups **flex_groups;
 	int i;
-	rcu_read_lock();
+	flex_groups = rcu_access_pointer(sbi->s_flex_groups);
-	flex_groups = rcu_dereference(sbi->s_flex_groups);
 	if (flex_groups) {
 		for (i = 0; i < sbi->s_flex_groups_allocated; i++)
 			kvfree(flex_groups[i]);
 		kvfree(flex_groups);
 	}
-	rcu_read_unlock();
 }
 static void ext4_put_super(struct super_block *sb)
 	invalidate_inode_buffers(inode);
 	clear_inode(inode);
 	ext4_discard_preallocations(inode);
+	/*
+	 * We must remove the inode from the hash before ext4_free_inode()
+	 * clears the bit in inode bitmap as otherwise another process reusing
+	 * the inode will block in insert_inode_hash() waiting for inode
+	 * eviction to complete while holding transaction handle open, but
+	 * ext4_evict_inode() still running for that inode could block waiting
+	 * for transaction commit if the inode is marked as IS_SYNC => deadlock.
+	 *
+	 * Removing the inode from the hash here is safe. There are two cases
+	 * to consider:
+	 * 1) The inode still has references to it (i_nlink > 0). In that case
+	 * we are keeping the inode and once we remove the inode from the hash,
+	 * iget() can create the new inode structure for the same inode number
+	 * and we are fine with that as all IO on behalf of the inode is
+	 * finished.
+	 * 2) We are deleting the inode (i_nlink == 0). In that case inode
+	 * number cannot be reused until ext4_free_inode() clears the bit in
+	 * the inode bitmap, at which point all IO is done and reuse is fine
+	 * again.
+	 */
+	remove_inode_hash(inode);
 	ext4_es_remove_extent(inode, 0, EXT_MAX_BLOCKS);
 	dquot_drop(inode);
 	if (EXT4_I(inode)->jinode) {
 			 "extents feature\n");
 		return 0;
 	}
+	if (ext4_has_feature_bigalloc(sb) &&
+	    le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) {
+		ext4_msg(sb, KERN_WARNING,
+			 "bad geometry: bigalloc file system with non-zero "
+			 "first_data_block\n");
+		return 0;
+	}
 #if !IS_ENABLED(CONFIG_QUOTA) || !IS_ENABLED(CONFIG_QFMT_V2)
 	if (!readonly && (ext4_has_feature_quota(sb) ||
 	timer_setup(&sbi->s_err_report, print_daily_error_info, 0);
 	spin_lock_init(&sbi->s_error_lock);
+	mutex_init(&sbi->s_error_notify_mutex);
 	INIT_WORK(&sbi->s_sb_upd_work, update_super_work);
 	err = ext4_group_desc_init(sb, es, logical_sb_block, &first_not_zeroed);

fs/ext4/sysfs.c+9−1

 void ext4_notify_error_sysfs(struct ext4_sb_info *sbi)
 {
-	sysfs_notify(&sbi->s_kobj, NULL, "errors_count");
+	mutex_lock(&sbi->s_error_notify_mutex);
+	if (sbi->s_kobj.state_in_sysfs)
+		sysfs_notify(&sbi->s_kobj, NULL, "errors_count");
+	mutex_unlock(&sbi->s_error_notify_mutex);
 }
 static struct kobject *ext4_root;
 	int err;
 	init_completion(&sbi->s_kobj_unregister);
+	mutex_lock(&sbi->s_error_notify_mutex);
 	err = kobject_init_and_add(&sbi->s_kobj, &ext4_sb_ktype, ext4_root,
 				   "%s", sb->s_id);
+	mutex_unlock(&sbi->s_error_notify_mutex);
 	if (err) {
 		kobject_put(&sbi->s_kobj);
 		wait_for_completion(&sbi->s_kobj_unregister);
 	if (sbi->s_proc)
 		remove_proc_subtree(sb->s_id, ext4_proc_root);
+	mutex_lock(&sbi->s_error_notify_mutex);
 	kobject_del(&sbi->s_kobj);
+	mutex_unlock(&sbi->s_error_notify_mutex);
 }
 int __init ext4_init_sysfs(void)

fs/fs-writeback.c+27−9

 	}
 }
+static bool __sync_lazytime(struct inode *inode)
+{
+	spin_lock(&inode->i_lock);
+	if (!(inode_state_read(inode) & I_DIRTY_TIME)) {
+		spin_unlock(&inode->i_lock);
+		return false;
+	}
+	inode_state_clear(inode, I_DIRTY_TIME);
+	spin_unlock(&inode->i_lock);
+	inode->i_op->sync_lazytime(inode);
+	return true;
+}
 bool sync_lazytime(struct inode *inode)
 {
 	if (!(inode_state_read_once(inode) & I_DIRTY_TIME))
 	trace_writeback_lazytime(inode);
 	if (inode->i_op->sync_lazytime)
-		inode->i_op->sync_lazytime(inode);
+		return __sync_lazytime(inode);
-	else
+	mark_inode_dirty_sync(inode);
-		mark_inode_dirty_sync(inode);
 	return true;
 }
 		 * The mapping can appear untagged while still on-list since we
 		 * do not have the mapping lock. Skip it here, wb completion
 		 * will remove it.
-		 *
-		 * If the mapping does not have data integrity semantics,
-		 * there's no need to wait for the writeout to complete, as the
-		 * mapping cannot guarantee that data is persistently stored.
 		 */
-		if (!mapping_tagged(mapping, PAGECACHE_TAG_WRITEBACK) ||
+		if (!mapping_tagged(mapping, PAGECACHE_TAG_WRITEBACK))
-		    mapping_no_data_integrity(mapping))
 			continue;
 		spin_unlock_irq(&sb->s_inode_wblist_lock);
 	 */
 	if (bdi == &noop_backing_dev_info)
 		return;
+	/*
+	 * If the superblock has SB_I_NO_DATA_INTEGRITY set, there's no need to
+	 * wait for the writeout to complete, as the filesystem cannot guarantee
+	 * data persistence on sync. Just kick off writeback and return.
+	 */
+	if (sb->s_iflags & SB_I_NO_DATA_INTEGRITY) {
+		wakeup_flusher_threads_bdi(bdi, WB_REASON_SYNC);
+		return;
+	}
 	WARN_ON(!rwsem_is_locked(&sb->s_umount));
 	/* protect against inode wb switch, see inode_switch_wbs_work_fn() */

fs/fuse/file.c+1−3

 	inode->i_fop = &fuse_file_operations;
 	inode->i_data.a_ops = &fuse_file_aops;
-	if (fc->writeback_cache) {
+	if (fc->writeback_cache)
 		mapping_set_writeback_may_deadlock_on_reclaim(&inode->i_data);
-		mapping_set_no_data_integrity(&inode->i_data);
-	}
 	INIT_LIST_HEAD(&fi->write_files);
 	INIT_LIST_HEAD(&fi->queued_writes);

fs/fuse/inode.c+1−0

@@ -1709,6 +1709,7 @@ static void fuse_sb_defaults(struct super_block *sb) · 1708 unmodified lines
1709	sb->s_export_op = &fuse_export_operations;	1709	sb->s_export_op = &fuse_export_operations;
1710	sb->s_iflags \|= SB_I_IMA_UNVERIFIABLE_SIGNATURE;	1710	sb->s_iflags \|= SB_I_IMA_UNVERIFIABLE_SIGNATURE;
1711	sb->s_iflags \|= SB_I_NOIDMAP;	1711	sb->s_iflags \|= SB_I_NOIDMAP;
		1712	sb->s_iflags \|= SB_I_NO_DATA_INTEGRITY;
1712	if (sb->s_user_ns != &init_user_ns)	1713	if (sb->s_user_ns != &init_user_ns)
1713	sb->s_iflags \|= SB_I_UNTRUSTED_MOUNTER;	1714	sb->s_iflags \|= SB_I_UNTRUSTED_MOUNTER;
1714	sb->s_flags &= ~(SB_NOSEC \| SB_I_VERSION);	1715	sb->s_flags &= ~(SB_NOSEC \| SB_I_VERSION);

fs/iomap/bio.c+50−1

@@ -8,7 +8,10 @@ · 7 unmodified lines
8	#include "internal.h"	8	#include "internal.h"
9	#include "trace.h"	9	#include "trace.h"
10		10
11	static void iomap_read_end_io(struct bio *bio)	11	static DEFINE_SPINLOCK(failed_read_lock);
		12	static struct bio_list failed_read_list = BIO_EMPTY_LIST;
		13
		14	static void __iomap_read_end_io(struct bio *bio)
12	{	15	{
13	int error = blk_status_to_errno(bio->bi_status);	16	int error = blk_status_to_errno(bio->bi_status);
14	struct folio_iter fi;	17	struct folio_iter fi;
@@ -18,6 +21,52 @@ static void iomap_read_end_io(struct bio *bio) · 3 unmodified lines
18	bio_put(bio);	21	bio_put(bio);
19	}	22	}
20		23
		24	static void
		25	iomap_fail_reads(
		26	struct work_struct *work)
		27	{
		28	struct bio *bio;
		29	struct bio_list tmp = BIO_EMPTY_LIST;
		30	unsigned long flags;
		31
		32	spin_lock_irqsave(&failed_read_lock, flags);
		33	bio_list_merge_init(&tmp, &failed_read_list);
		34	spin_unlock_irqrestore(&failed_read_lock, flags);
		35
		36	while ((bio = bio_list_pop(&tmp)) != NULL) {
		37	__iomap_read_end_io(bio);
		38	cond_resched();
		39	}
		40	}
		41
		42	static DECLARE_WORK(failed_read_work, iomap_fail_reads);
		43
		44	static void iomap_fail_buffered_read(struct bio *bio)
		45	{
		46	unsigned long flags;
		47
		48	/*
		49	* Bounce I/O errors to a workqueue to avoid nested i_lock acquisitions
		50	* in the fserror code. The caller no longer owns the bio reference
		51	* after the spinlock drops.
		52	*/
		53	spin_lock_irqsave(&failed_read_lock, flags);
		54	if (bio_list_empty(&failed_read_list))
		55	WARN_ON_ONCE(!schedule_work(&failed_read_work));
		56	bio_list_add(&failed_read_list, bio);
		57	spin_unlock_irqrestore(&failed_read_lock, flags);
		58	}
		59
		60	static void iomap_read_end_io(struct bio *bio)
		61	{
		62	if (bio->bi_status) {
		63	iomap_fail_buffered_read(bio);
		64	return;
		65	}
		66
		67	__iomap_read_end_io(bio);
		68	}
		69
21	static void iomap_bio_submit_read(struct iomap_read_folio_ctx *ctx)	70	static void iomap_bio_submit_read(struct iomap_read_folio_ctx *ctx)
22	{	71	{
23	struct bio *bio = ctx->read_ctx;	72	struct bio *bio = ctx->read_ctx;

fs/iomap/buffered-io.c+10−5

 	loff_t length = iomap_length(iter);
 	struct folio *folio = ctx->cur_folio;
 	size_t folio_len = folio_size(folio);
+	struct iomap_folio_state *ifs;
 	size_t poff, plen;
 	loff_t pos_diff;
 	int ret;
 		return iomap_iter_advance(iter, length);
 	}
-	ifs_alloc(iter->inode, folio, iter->flags);
+	ifs = ifs_alloc(iter->inode, folio, iter->flags);
 	length = min_t(loff_t, length, folio_len - offset_in_folio(folio, pos));
 	while (length) {
 			*bytes_submitted += plen;
 			/*
-			 * If the entire folio has been read in by the IO
+			 * Hand off folio ownership to the IO helper when:
-			 * helper, then the helper owns the folio and will end
+			 * 1) The entire folio has been submitted for IO, or
-			 * the read on it.
+			 * 2) There is no ifs attached to the folio
+			 *
+			 * Case (2) occurs when 1 << i_blkbits matches the folio
+			 * size but the underlying filesystem or block device
+			 * uses a smaller granularity for IO.
 			 */
-			if (*bytes_submitted == folio_len)
+			if (*bytes_submitted == folio_len || !ifs)
 				ctx->cur_folio = NULL;
 		}

fs/jbd2/checkpoint.c+13−2

 			 */
 			BUFFER_TRACE(bh, "queue");
 			get_bh(bh);
-			J_ASSERT_BH(bh, !buffer_jwrite(bh));
+			if (WARN_ON_ONCE(buffer_jwrite(bh))) {
+				put_bh(bh); /* drop the ref we just took */
+				spin_unlock(&journal->j_list_lock);
+				/* Clean up any previously batched buffers */
+				if (batch_count)
+					__flush_batch(journal, &batch_count);
+				jbd2_journal_abort(journal, -EFSCORRUPTED);
+				return -EFSCORRUPTED;
+			}
 			journal->j_chkpt_bhs[batch_count++] = bh;
 			transaction->t_chp_stats.cs_written++;
 			transaction->t_checkpoint_list = jh->b_cpnext;
 	if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr))
 		return 1;
-	J_ASSERT(blocknr != 0);
+	if (WARN_ON_ONCE(blocknr == 0)) {
+		jbd2_journal_abort(journal, -EFSCORRUPTED);
+		return -EFSCORRUPTED;
+	}
 	/*
 	 * We need to make sure that any blocks that were recently written out

fs/namei.c+8−2

 EXPORT_SYMBOL(hashlen_string);
 /*
- * Calculate the length and hash of the path component, and
+ * hash_name - Calculate the length and hash of the path component
- * return the length as the result.
+ * @nd: the path resolution state
+ * @name: the pathname to read the component from
+ * @lastword: if the component fits in a single word, LAST_WORD_IS_DOT,
+ * LAST_WORD_IS_DOTDOT, or some other value depending on whether the
+ * component is '.', '..', or something else. Otherwise, @lastword is 0.
+ *
+ * Returns: a pointer to the terminating '/' or NUL character in @name.
  */
 static inline const char *hash_name(struct nameidata *nd,
 				    const char *name,

fs/netfs/buffered_read.c+1−2

 	spin_lock(&rreq->lock);
 	list_add_tail(&subreq->rreq_link, &stream->subrequests);
 	if (list_is_first(&subreq->rreq_link, &stream->subrequests)) {
-		stream->front = subreq;
 		if (!stream->active) {
-			stream->collected_to = stream->front->start;
+			stream->collected_to = subreq->start;
 			/* Store list pointers before active flag */
 			smp_store_release(&stream->active, true);
 		}

fs/netfs/direct_read.c+1−2

 		spin_lock(&rreq->lock);
 		list_add_tail(&subreq->rreq_link, &stream->subrequests);
 		if (list_is_first(&subreq->rreq_link, &stream->subrequests)) {
-			stream->front = subreq;
 			if (!stream->active) {
-				stream->collected_to = stream->front->start;
+				stream->collected_to = subreq->start;
 				/* Store list pointers before active flag */
 				smp_store_release(&stream->active, true);
 			}

fs/netfs/direct_write.c+11−4

 			netfs_prepare_write(wreq, stream, wreq->start + wreq->transferred);
 			subreq = stream->construct;
 			stream->construct = NULL;
-			stream->front = NULL;
 		}
 		/* Check if (re-)preparation failed. */
 		stream->sreq_max_segs	= INT_MAX;
 		netfs_get_subrequest(subreq, netfs_sreq_trace_get_resubmit);
-		stream->prepare_write(subreq);
-		__set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags);
+		if (stream->prepare_write) {
-		netfs_stat(&netfs_n_wh_retry_write_subreq);
+			stream->prepare_write(subreq);
+			__set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags);
+			netfs_stat(&netfs_n_wh_retry_write_subreq);
+		} else {
+			struct iov_iter source;
+			netfs_reset_iter(subreq);
+			source = subreq->io_iter;
+			netfs_reissue_write(stream, subreq, &source);
+		}
 	}
 	netfs_unbuffered_write_done(wreq);

fs/netfs/iterator.c+43−0

@@ -142,6 +142,47 @@ static size_t netfs_limit_bvec(const struct iov_iter *iter, size_t start_offset, · 141 unmodified lines
142	return min(span, max_size);	142	return min(span, max_size);
143	}	143	}
144		144
		145	/*
		146	* Select the span of a kvec iterator we're going to use. Limit it by both
		147	* maximum size and maximum number of segments. Returns the size of the span
		148	* in bytes.
		149	*/
		150	static size_t netfs_limit_kvec(const struct iov_iter *iter, size_t start_offset,
		151	size_t max_size, size_t max_segs)
		152	{
		153	const struct kvec *kvecs = iter->kvec;
		154	unsigned int nkv = iter->nr_segs, ix = 0, nsegs = 0;
		155	size_t len, span = 0, n = iter->count;
		156	size_t skip = iter->iov_offset + start_offset;
		157
		158	if (WARN_ON(!iov_iter_is_kvec(iter)) \|\|
		159	WARN_ON(start_offset > n) \|\|
		160	n == 0)
		161	return 0;
		162
		163	while (n && ix < nkv && skip) {
		164	len = kvecs[ix].iov_len;
		165	if (skip < len)
		166	break;
		167	skip -= len;
		168	n -= len;
		169	ix++;
		170	}
		171
		172	while (n && ix < nkv) {
		173	len = min3(n, kvecs[ix].iov_len - skip, max_size);
		174	span += len;
		175	nsegs++;
		176	ix++;
		177	if (span >= max_size \|\| nsegs >= max_segs)
		178	break;
		179	skip = 0;
		180	n -= len;
		181	}
		182
		183	return min(span, max_size);
		184	}
		185
145	/*	186	/*
146	* Select the span of an xarray iterator we're going to use. Limit it by both	187	* Select the span of an xarray iterator we're going to use. Limit it by both
147	* maximum size and maximum number of segments. It is assumed that segments	188	* maximum size and maximum number of segments. It is assumed that segments
@@ -245,6 +286,8 @@ size_t netfs_limit_iter(const struct iov_iter *iter, size_t start_offset, · 97 unmodified lines
245	return netfs_limit_bvec(iter, start_offset, max_size, max_segs);	286	return netfs_limit_bvec(iter, start_offset, max_size, max_segs);
246	if (iov_iter_is_xarray(iter))	287	if (iov_iter_is_xarray(iter))
247	return netfs_limit_xarray(iter, start_offset, max_size, max_segs);	288	return netfs_limit_xarray(iter, start_offset, max_size, max_segs);
		289	if (iov_iter_is_kvec(iter))
		290	return netfs_limit_kvec(iter, start_offset, max_size, max_segs);
248	BUG();	291	BUG();
249	}	292	}
250	EXPORT_SYMBOL(netfs_limit_iter);	293	EXPORT_SYMBOL(netfs_limit_iter);

fs/netfs/read_collect.c+2−2

 	 * in progress.  The issuer thread may be adding stuff to the tail
 	 * whilst we're doing this.
 	 */
-	front = READ_ONCE(stream->front);
+	front = list_first_entry_or_null(&stream->subrequests,
+					 struct netfs_io_subrequest, rreq_link);
 	while (front) {
 		size_t transferred;
 		list_del_init(&front->rreq_link);
 		front = list_first_entry_or_null(&stream->subrequests,
 						 struct netfs_io_subrequest, rreq_link);
-		stream->front = front;
 		spin_unlock(&rreq->lock);
 		netfs_put_subrequest(remove,
 				     notes & ABANDON_SREQ ?

fs/netfs/read_retry.c+4−1

 		       from->start, from->transferred, from->len);
 		if (test_bit(NETFS_SREQ_FAILED, &from->flags) ||
-		    !test_bit(NETFS_SREQ_NEED_RETRY, &from->flags))
+		    !test_bit(NETFS_SREQ_NEED_RETRY, &from->flags)) {
+			subreq = from;
 			goto abandon;
+		}
 		list_for_each_continue(next, &stream->subrequests) {
 			subreq = list_entry(next, struct netfs_io_subrequest, rreq_link);
 				if (subreq == to)
 					break;
 			}
+			subreq = NULL;
 			continue;
 		}

fs/netfs/read_single.c+0−1

@@ -107,7 +107,6 @@ static int netfs_single_dispatch_read(struct netfs_io_request *rreq) · 106 unmodified lines
107	spin_lock(&rreq->lock);	107	spin_lock(&rreq->lock);
108	list_add_tail(&subreq->rreq_link, &stream->subrequests);	108	list_add_tail(&subreq->rreq_link, &stream->subrequests);
109	trace_netfs_sreq(subreq, netfs_sreq_trace_added);	109	trace_netfs_sreq(subreq, netfs_sreq_trace_added);
110	stream->front = subreq;
111	/* Store list pointers before active flag */	110	/* Store list pointers before active flag */
112	smp_store_release(&stream->active, true);	111	smp_store_release(&stream->active, true);
113	spin_unlock(&rreq->lock);	112	spin_unlock(&rreq->lock);

fs/netfs/write_collect.c+2−2

 		if (!smp_load_acquire(&stream->active))
 			continue;
-		front = stream->front;
+		front = list_first_entry_or_null(&stream->subrequests,
+						 struct netfs_io_subrequest, rreq_link);
 		while (front) {
 			trace_netfs_collect_sreq(wreq, front);
 			//_debug("sreq [%x] %llx %zx/%zx",
 			list_del_init(&front->rreq_link);
 			front = list_first_entry_or_null(&stream->subrequests,
 							 struct netfs_io_subrequest, rreq_link);
-			stream->front = front;
 			spin_unlock(&wreq->lock);
 			netfs_put_subrequest(remove,
 					     notes & SAW_FAILURE ?

fs/netfs/write_issue.c+1−2

 	spin_lock(&wreq->lock);
 	list_add_tail(&subreq->rreq_link, &stream->subrequests);
 	if (list_is_first(&subreq->rreq_link, &stream->subrequests)) {
-		stream->front = subreq;
 		if (!stream->active) {
-			stream->collected_to = stream->front->start;
+			stream->collected_to = subreq->start;
 			/* Write list pointers before active flag */
 			smp_store_release(&stream->active, true);
 		}

fs/overlayfs/copy_up.c+3−3

@@ -1146,15 +1146,15 @@ static int ovl_copy_up_one(struct dentry parent, struct dentry dentry, · 1145 unmodified lines
1146	return -EOVERFLOW;	1146	return -EOVERFLOW;
1147		1147
1148	/*	1148	/*
1149	* With metacopy disabled, we fsync after final metadata copyup, for	1149	* With "fsync=strict", we fsync after final metadata copyup, for
1150	* both regular files and directories to get atomic copyup semantics	1150	* both regular files and directories to get atomic copyup semantics
1151	* on filesystems that do not use strict metadata ordering (e.g. ubifs).	1151	* on filesystems that do not use strict metadata ordering (e.g. ubifs).
1152	*	1152	*
1153	* With metacopy enabled we want to avoid fsync on all meta copyup	1153	* By default, we want to avoid fsync on all meta copyup, because
1154	* that will hurt performance of workloads such as chown -R, so we	1154	* that will hurt performance of workloads such as chown -R, so we
1155	* only fsync on data copyup as legacy behavior.	1155	* only fsync on data copyup as legacy behavior.
1156	*/	1156	*/
1157	ctx.metadata_fsync = !OVL_FS(dentry->d_sb)->config.metacopy &&	1157	ctx.metadata_fsync = ovl_should_sync_metadata(OVL_FS(dentry->d_sb)) &&
1158	(S_ISREG(ctx.stat.mode) \|\| S_ISDIR(ctx.stat.mode));	1158	(S_ISREG(ctx.stat.mode) \|\| S_ISDIR(ctx.stat.mode));
1159	ctx.metacopy = ovl_need_meta_copy_up(dentry, ctx.stat.mode, flags);	1159	ctx.metacopy = ovl_need_meta_copy_up(dentry, ctx.stat.mode, flags);
1160		1160

fs/overlayfs/overlayfs.h+21−0

@@ -99,6 +99,12 @@ enum { · 98 unmodified lines
99	OVL_VERITY_REQUIRE,	99	OVL_VERITY_REQUIRE,
100	};	100	};
101		101
		102	enum {
		103	OVL_FSYNC_VOLATILE,
		104	OVL_FSYNC_AUTO,
		105	OVL_FSYNC_STRICT,
		106	};
		107
102	/*	108	/*
103	* The tuple (fh,uuid) is a universal unique identifier for a copy up origin,	109	* The tuple (fh,uuid) is a universal unique identifier for a copy up origin,
104	* where:	110	* where:
@@ -656,6 +662,21 @@ static inline bool ovl_xino_warn(struct ovl_fs *ofs) · 551 unmodified lines
656	return ofs->config.xino == OVL_XINO_ON;	662	return ofs->config.xino == OVL_XINO_ON;
657	}	663	}
658		664
		665	static inline bool ovl_should_sync(struct ovl_fs *ofs)
		666	{
		667	return ofs->config.fsync_mode != OVL_FSYNC_VOLATILE;
		668	}
		669
		670	static inline bool ovl_should_sync_metadata(struct ovl_fs *ofs)
		671	{
		672	return ofs->config.fsync_mode == OVL_FSYNC_STRICT;
		673	}
		674
		675	static inline bool ovl_is_volatile(struct ovl_config *config)
		676	{
		677	return config->fsync_mode == OVL_FSYNC_VOLATILE;
		678	}
		679
659	/*	680	/*
660	* To avoid regressions in existing setups with overlay lower offline changes,	681	* To avoid regressions in existing setups with overlay lower offline changes,
661	* we allow lower changes only if none of the new features are used.	682	* we allow lower changes only if none of the new features are used.

fs/overlayfs/ovl_entry.h+1−6

 	int xino;
 	bool metacopy;
 	bool userxattr;
-	bool ovl_volatile;
+	int fsync_mode;
 };
 struct ovl_sb {
 	return (struct ovl_fs *)sb->s_fs_info;
 }
-static inline bool ovl_should_sync(struct ovl_fs *ofs)
-{
-	return !ofs->config.ovl_volatile;
-}
 static inline unsigned int ovl_numlower(struct ovl_entry *oe)
 {
 	return oe ? oe->__numlower : 0;

fs/overlayfs/params.c+28−5

 	Opt_xino,
 	Opt_metacopy,
 	Opt_verity,
+	Opt_fsync,
 	Opt_volatile,
 	Opt_override_creds,
 };
 	return OVL_VERITY_OFF;
 }
+static const struct constant_table ovl_parameter_fsync[] = {
+	{ "volatile",	OVL_FSYNC_VOLATILE },
+	{ "auto",	OVL_FSYNC_AUTO     },
+	{ "strict",	OVL_FSYNC_STRICT   },
+	{}
+};
+static const char *ovl_fsync_mode(struct ovl_config *config)
+{
+	return ovl_parameter_fsync[config->fsync_mode].name;
+}
+static int ovl_fsync_mode_def(void)
+{
+	return OVL_FSYNC_AUTO;
+}
 const struct fs_parameter_spec ovl_parameter_spec[] = {
 	fsparam_string_empty("lowerdir",    Opt_lowerdir),
 	fsparam_file_or_string("lowerdir+", Opt_lowerdir_add),
 	fsparam_enum("xino",                Opt_xino, ovl_parameter_xino),
 	fsparam_enum("metacopy",            Opt_metacopy, ovl_parameter_bool),
 	fsparam_enum("verity",              Opt_verity, ovl_parameter_verity),
+	fsparam_enum("fsync",               Opt_fsync, ovl_parameter_fsync),
 	fsparam_flag("volatile",            Opt_volatile),
 	fsparam_flag_no("override_creds",   Opt_override_creds),
 	{}
 	case Opt_verity:
 		config->verity_mode = result.uint_32;
 		break;
+	case Opt_fsync:
+		config->fsync_mode = result.uint_32;
+		break;
 	case Opt_volatile:
-		config->ovl_volatile = true;
+		config->fsync_mode = OVL_FSYNC_VOLATILE;
 		break;
 	case Opt_userxattr:
 		config->userxattr = true;
 	ofs->config.nfs_export		= ovl_nfs_export_def;
 	ofs->config.xino		= ovl_xino_def();
 	ofs->config.metacopy		= ovl_metacopy_def;
+	ofs->config.fsync_mode		= ovl_fsync_mode_def();
 	fc->s_fs_info		= ofs;
 	fc->fs_private		= ctx;
 		config->index = false;
 	}
-	if (!config->upperdir && config->ovl_volatile) {
+	if (!config->upperdir && ovl_is_volatile(config)) {
 		pr_info("option \"volatile\" is meaningless in a non-upper mount, ignoring it.\n");
-		config->ovl_volatile = false;
+		config->fsync_mode = ovl_fsync_mode_def();
 	}
 	if (!config->upperdir && config->uuid == OVL_UUID_ON) {
 		seq_printf(m, ",xino=%s", ovl_xino_mode(&ofs->config));
 	if (ofs->config.metacopy != ovl_metacopy_def)
 		seq_printf(m, ",metacopy=%s", str_on_off(ofs->config.metacopy));
-	if (ofs->config.ovl_volatile)
+	if (ofs->config.fsync_mode != ovl_fsync_mode_def())
-		seq_puts(m, ",volatile");
+		seq_printf(m, ",fsync=%s", ovl_fsync_mode(&ofs->config));
 	if (ofs->config.userxattr)
 		seq_puts(m, ",userxattr");
 	if (ofs->config.verity_mode != ovl_verity_mode_def())

fs/overlayfs/super.c+1−1

@@ -776,7 +776,7 @@ static int ovl_make_workdir(struct super_block sb, struct ovl_fs ofs, · 775 unmodified lines
776	* For volatile mount, create a incompat/volatile/dirty file to keep	776	* For volatile mount, create a incompat/volatile/dirty file to keep
777	* track of it.	777	* track of it.
778	*/	778	*/
779	if (ofs->config.ovl_volatile) {	779	if (ovl_is_volatile(&ofs->config)) {
780	err = ovl_create_volatile_dirty(ofs);	780	err = ovl_create_volatile_dirty(ofs);
781	if (err < 0) {	781	if (err < 0) {
782	pr_err("Failed to create volatile/dirty file.\n");	782	pr_err("Failed to create volatile/dirty file.\n");

fs/overlayfs/util.c+4−1

@@ -85,7 +85,10 @@ int ovl_can_decode_fh(struct super_block *sb) · 84 unmodified lines
85	if (!exportfs_can_decode_fh(sb->s_export_op))	85	if (!exportfs_can_decode_fh(sb->s_export_op))
86	return 0;	86	return 0;
87		87
88	return sb->s_export_op->encode_fh ? -1 : FILEID_INO32_GEN;	88	if (sb->s_export_op->encode_fh == generic_encode_ino32_fh)
		89	return FILEID_INO32_GEN;
		90
		91	return -1;
89	}	92	}
90		93
91	struct dentry ovl_indexdir(struct super_block sb)	94	struct dentry ovl_indexdir(struct super_block sb)

fs/smb/client/Makefile+4−3

 # Build the SMB2 error mapping table from smb2status.h
 #
 $(obj)/smb2_mapping_table.c: $(src)/../common/smb2status.h \
-			    $(src)/gen_smb2_mapping
+			     $(src)/gen_smb2_mapping FORCE
-	$(call cmd,gen_smb2_mapping)
+	$(call if_changed,gen_smb2_mapping)
 $(obj)/smb2maperror.o: $(obj)/smb2_mapping_table.c
 obj-$(CONFIG_SMB_KUNIT_TESTS) += smb2maperror_test.o
-clean-files	+= smb2_mapping_table.c
+# Let Kbuild handle tracking and cleaning
+targets += smb2_mapping_table.c

fs/smb/server/oplock.c+45−27

@@ -82,11 +82,19 @@ static void lease_del_list(struct oplock_info *opinfo) · 81 unmodified lines
82	spin_unlock(&lb->lb_lock);	82	spin_unlock(&lb->lb_lock);
83	}	83	}
84		84
85	static void lb_add(struct lease_table *lb)	85	static struct lease_table alloc_lease_table(struct oplock_info opinfo)
86	{	86	{
87	write_lock(&lease_list_lock);	87	struct lease_table *lb;
88	list_add(&lb->l_entry, &lease_table_list);	88
89	write_unlock(&lease_list_lock);	89	lb = kmalloc_obj(struct lease_table, KSMBD_DEFAULT_GFP);
		90	if (!lb)
		91	return NULL;
		92
		93	memcpy(lb->client_guid, opinfo->conn->ClientGUID,
		94	SMB2_CLIENT_GUID_SIZE);
		95	INIT_LIST_HEAD(&lb->lease_list);
		96	spin_lock_init(&lb->lb_lock);
		97	return lb;
90	}	98	}
91		99
92	static int alloc_lease(struct oplock_info opinfo, struct lease_ctx_info lctx)	100	static int alloc_lease(struct oplock_info opinfo, struct lease_ctx_info lctx)
@@ -1042,34 +1050,27 @@ static void copy_lease(struct oplock_info op1, struct oplock_info op2) · 949 unmodified lines
1042	lease2->version = lease1->version;	1050	lease2->version = lease1->version;
1043	}	1051	}
1044		1052
1045	static int add_lease_global_list(struct oplock_info *opinfo)	1053	static void add_lease_global_list(struct oplock_info *opinfo,
		1054	struct lease_table *new_lb)
1046	{	1055	{
1047	struct lease_table *lb;	1056	struct lease_table *lb;
1048		1057
1049	read_lock(&lease_list_lock);	1058	write_lock(&lease_list_lock);
1050	list_for_each_entry(lb, &lease_table_list, l_entry) {	1059	list_for_each_entry(lb, &lease_table_list, l_entry) {
1051	if (!memcmp(lb->client_guid, opinfo->conn->ClientGUID,	1060	if (!memcmp(lb->client_guid, opinfo->conn->ClientGUID,
1052	SMB2_CLIENT_GUID_SIZE)) {	1061	SMB2_CLIENT_GUID_SIZE)) {
1053	opinfo->o_lease->l_lb = lb;	1062	opinfo->o_lease->l_lb = lb;
1054	lease_add_list(opinfo);	1063	lease_add_list(opinfo);
1055	read_unlock(&lease_list_lock);	1064	write_unlock(&lease_list_lock);
1056	return 0;	1065	kfree(new_lb);
		1066	return;
1057	}	1067	}
1058	}	1068	}
1059	read_unlock(&lease_list_lock);
1060		1069
1061	lb = kmalloc_obj(struct lease_table, KSMBD_DEFAULT_GFP);	1070	opinfo->o_lease->l_lb = new_lb;
1062	if (!lb)
1063	return -ENOMEM;
1064
1065	memcpy(lb->client_guid, opinfo->conn->ClientGUID,
1066	SMB2_CLIENT_GUID_SIZE);
1067	INIT_LIST_HEAD(&lb->lease_list);
1068	spin_lock_init(&lb->lb_lock);
1069	opinfo->o_lease->l_lb = lb;
1070	lease_add_list(opinfo);	1071	lease_add_list(opinfo);
1071	lb_add(lb);	1072	list_add(&new_lb->l_entry, &lease_table_list);
1072	return 0;	1073	write_unlock(&lease_list_lock);
1073	}	1074	}
1074		1075
1075	static void set_oplock_level(struct oplock_info *opinfo, int level,	1076	static void set_oplock_level(struct oplock_info *opinfo, int level,
@@ -1189,6 +1190,7 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid, · 113 unmodified lines
1189	int err = 0;	1190	int err = 0;
1190	struct oplock_info opinfo = NULL, prev_opinfo = NULL;	1191	struct oplock_info opinfo = NULL, prev_opinfo = NULL;
1191	struct ksmbd_inode *ci = fp->f_ci;	1192	struct ksmbd_inode *ci = fp->f_ci;
		1193	struct lease_table *new_lb = NULL;
1192	bool prev_op_has_lease;	1194	bool prev_op_has_lease;
1193	__le32 prev_op_state = 0;	1195	__le32 prev_op_state = 0;
1194		1196
@@ -1291,21 +1293,37 @@ set_lev: · 96 unmodified lines
1291	set_oplock_level(opinfo, req_op_level, lctx);	1293	set_oplock_level(opinfo, req_op_level, lctx);
1292		1294
1293	out:	1295	out:
1294	opinfo_count_inc(fp);	1296	/*
1295	opinfo_add(opinfo, fp);	1297	* Set o_fp before any publication so that concurrent readers
1296		1298	* (e.g. find_same_lease_key() on the lease list) that
		1299	* dereference opinfo->o_fp don't hit a NULL pointer.
		1300	*
		1301	* Keep the original publication order so concurrent opens can
		1302	* still observe the in-flight grant via ci->m_op_list, but make
		1303	* everything after opinfo_add() no-fail by preallocating any new
		1304	* lease_table first.
		1305	*/
		1306	opinfo->o_fp = fp;
1297	if (opinfo->is_lease) {	1307	if (opinfo->is_lease) {
1298	err = add_lease_global_list(opinfo);	1308	new_lb = alloc_lease_table(opinfo);
1299	if (err)	1309	if (!new_lb) {
		1310	err = -ENOMEM;
1300	goto err_out;	1311	goto err_out;
		1312	}
1301	}	1313	}
1302		1314
		1315	opinfo_count_inc(fp);
		1316	opinfo_add(opinfo, fp);
		1317
		1318	if (opinfo->is_lease)
		1319	add_lease_global_list(opinfo, new_lb);
		1320
1303	rcu_assign_pointer(fp->f_opinfo, opinfo);	1321	rcu_assign_pointer(fp->f_opinfo, opinfo);
1304	opinfo->o_fp = fp;
1305		1322
1306	return 0;	1323	return 0;
1307	err_out:	1324	err_out:
1308	__free_opinfo(opinfo);	1325	kfree(new_lb);
		1326	opinfo_put(opinfo);
1309	return err;	1327	return err;
1310	}	1328	}
1311		1329

fs/smb/server/smb2pdu.c+52−21

 			if (sess->user && sess->user->flags & KSMBD_USER_FLAG_DELAY_SESSION)
 				try_delay = true;
-			sess->last_active = jiffies;
+			/*
-			sess->state = SMB2_SESSION_EXPIRED;
+			 * For binding requests, session belongs to another
+			 * connection. Do not expire it.
+			 */
+			if (!(req->Flags & SMB2_SESSION_REQ_FLAG_BINDING)) {
+				sess->last_active = jiffies;
+				sess->state = SMB2_SESSION_EXPIRED;
+			}
 			ksmbd_user_session_put(sess);
 			work->sess = NULL;
 			if (try_delay) {
 	d_info.wptr = (char *)rsp->Buffer;
 	d_info.rptr = (char *)rsp->Buffer;
 	d_info.out_buf_len =
-		smb2_calc_max_out_buf_len(work, 8,
+		smb2_calc_max_out_buf_len(work,
-					  le32_to_cpu(req->OutputBufferLength));
+				offsetof(struct smb2_query_directory_rsp, Buffer),
+				le32_to_cpu(req->OutputBufferLength));
 	if (d_info.out_buf_len < 0) {
 		rc = -EINVAL;
 		goto err_out;
 	}
 	buf_free_len =
-		smb2_calc_max_out_buf_len(work, 8,
+		smb2_calc_max_out_buf_len(work,
-					  le32_to_cpu(req->OutputBufferLength));
+				offsetof(struct smb2_query_info_rsp, Buffer),
+				le32_to_cpu(req->OutputBufferLength));
 	if (buf_free_len < 0)
 		return -EINVAL;
 	int conv_len;
 	char *filename;
 	u64 time;
-	int ret;
+	int ret, buf_free_len, filename_len;
+	struct smb2_query_info_req *req = ksmbd_req_buf_next(work);
 	if (!(fp->daccess & FILE_READ_ATTRIBUTES_LE)) {
 		ksmbd_debug(SMB, "no right to read the attributes : 0x%x\n",
 	if (IS_ERR(filename))
 		return PTR_ERR(filename);
+	filename_len = strlen(filename);
+	buf_free_len = smb2_calc_max_out_buf_len(work,
+			offsetof(struct smb2_query_info_rsp, Buffer) +
+			offsetof(struct smb2_file_all_info, FileName),
+			le32_to_cpu(req->OutputBufferLength));
+	if (buf_free_len < (filename_len + 1) * 2) {
+		kfree(filename);
+		return -EINVAL;
+	}
 	ret = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS,
 			  AT_STATX_SYNC_AS_STAT);
 	if (ret) {
 	file_info->Mode = fp->coption;
 	file_info->AlignmentRequirement = 0;
 	conv_len = smbConvertToUTF16((__le16 *)file_info->FileName, filename,
-				     PATH_MAX, conn->local_nls, 0);
+				     min(filename_len, PATH_MAX),
+				     conn->local_nls, 0);
 	conv_len *= 2;
 	file_info->FileNameLength = cpu_to_le32(conv_len);
 	rsp->OutputBufferLength =
 	file_info = (struct smb2_file_stream_info *)rsp->Buffer;
 	buf_free_len =
-		smb2_calc_max_out_buf_len(work, 8,
+		smb2_calc_max_out_buf_len(work,
-					  le32_to_cpu(req->OutputBufferLength));
+				offsetof(struct smb2_query_info_rsp, Buffer),
+				le32_to_cpu(req->OutputBufferLength));
 	if (buf_free_len < 0)
 		goto out;
 		rc = vfs_lock_file(filp, smb_lock->cmd, flock, NULL);
 skip:
 		if (smb_lock->flags & SMB2_LOCKFLAG_UNLOCK) {
+			locks_free_lock(flock);
+			kfree(smb_lock);
 			if (!rc) {
 				ksmbd_debug(SMB, "File unlocked\n");
 			} else if (rc == -ENOENT) {
 				rsp->hdr.Status = STATUS_NOT_LOCKED;
+				err = rc;
 				goto out;
 			}
-			locks_free_lock(flock);
-			kfree(smb_lock);
 		} else {
 			if (rc == FILE_LOCK_DEFERRED) {
 				void **argv;
 				spin_unlock(&work->conn->llist_lock);
 				ksmbd_debug(SMB, "successful in taking lock\n");
 			} else {
+				locks_free_lock(flock);
+				kfree(smb_lock);
+				err = rc;
 				goto out;
 			}
 		}
 		struct file_lock *rlock = NULL;
 		rlock = smb_flock_init(filp);
-		rlock->c.flc_type = F_UNLCK;
+		if (rlock) {
-		rlock->fl_start = smb_lock->start;
+			rlock->c.flc_type = F_UNLCK;
-		rlock->fl_end = smb_lock->end;
+			rlock->fl_start = smb_lock->start;
+			rlock->fl_end = smb_lock->end;
-		rc = vfs_lock_file(filp, F_SETLK, rlock, NULL);
+			rc = vfs_lock_file(filp, F_SETLK, rlock, NULL);
-		if (rc)
+			if (rc)
-			pr_err("rollback unlock fail : %d\n", rc);
+				pr_err("rollback unlock fail : %d\n", rc);
+		} else {
+			pr_err("rollback unlock alloc failed\n");
+		}
 		list_del(&smb_lock->llist);
 		spin_lock(&work->conn->llist_lock);
 		spin_unlock(&work->conn->llist_lock);
 		locks_free_lock(smb_lock->fl);
-		locks_free_lock(rlock);
+		if (rlock)
+			locks_free_lock(rlock);
 		kfree(smb_lock);
 	}
 out2:
 	buffer = (char *)req + le32_to_cpu(req->InputOffset);
 	cnt_code = le32_to_cpu(req->CtlCode);
-	ret = smb2_calc_max_out_buf_len(work, 48,
+	ret = smb2_calc_max_out_buf_len(work,
-					le32_to_cpu(req->MaxOutputResponse));
+			offsetof(struct smb2_ioctl_rsp, Buffer),
+			le32_to_cpu(req->MaxOutputResponse));
 	if (ret < 0) {
 		rsp->hdr.Status = STATUS_INVALID_PARAMETER;
 		goto out;

fs/xfs/libxfs/xfs_attr.h+2−1

@@ -55,7 +55,8 @@ struct xfs_attr_list_context { · 54 unmodified lines
55	struct xfs_trans *tp;	55	struct xfs_trans *tp;
56	struct xfs_inode dp; / inode */	56	struct xfs_inode dp; / inode */
57	struct xfs_attrlist_cursor_kern cursor; /* position in list */	57	struct xfs_attrlist_cursor_kern cursor; /* position in list */
58	void buffer; / output buffer */	58	/* output buffer */
		59	void *buffer __counted_by_ptr(bufsize);
59		60
60	/*	61	/*
61	* Abort attribute list iteration if non-zero. Can be used to pass	62	* Abort attribute list iteration if non-zero. Can be used to pass

fs/xfs/libxfs/xfs_attr_leaf.c+22−0

@@ -1415,6 +1415,28 @@ xfs_attr3_leaf_create( · 1414 unmodified lines
1415	return 0;	1415	return 0;
1416	}	1416	}
1417		1417
		1418	/*
		1419	* Reinitialize an existing attr fork block as an empty leaf, and attach
		1420	* the buffer to tp.
		1421	*/
		1422	int
		1423	xfs_attr3_leaf_init(
		1424	struct xfs_trans *tp,
		1425	struct xfs_inode *dp,
		1426	xfs_dablk_t blkno)
		1427	{
		1428	struct xfs_buf *bp = NULL;
		1429	struct xfs_da_args args = {
		1430	.trans = tp,
		1431	.dp = dp,
		1432	.owner = dp->i_ino,
		1433	.geo = dp->i_mount->m_attr_geo,
		1434	};
		1435
		1436	ASSERT(tp != NULL);
		1437
		1438	return xfs_attr3_leaf_create(&args, blkno, &bp);
		1439	}
1418	/*	1440	/*
1419	* Split the leaf node, rebalance, then add the new entry.	1441	* Split the leaf node, rebalance, then add the new entry.
1420	*	1442	*

fs/xfs/libxfs/xfs_attr_leaf.h+3−0

 /*
  * Routines used for shrinking the Btree.
  */
+int	xfs_attr3_leaf_init(struct xfs_trans *tp, struct xfs_inode *dp,
+				xfs_dablk_t blkno);
 int	xfs_attr3_leaf_toosmall(struct xfs_da_state *state, int *retval);
 void	xfs_attr3_leaf_unbalance(struct xfs_da_state *state,
 				       struct xfs_da_state_blk *drop_blk,

fs/xfs/libxfs/xfs_da_btree.c+42−11

 }
 /*
- * Remove an entry from an intermediate node.
+ * Internal implementation to remove an entry from an intermediate node.
  */
 STATIC void
-xfs_da3_node_remove(
+__xfs_da3_node_remove(
-	struct xfs_da_state	*state,
+	struct xfs_trans	*tp,
-	struct xfs_da_state_blk	*drop_blk)
+	struct xfs_inode	*dp,
+	struct xfs_da_geometry  *geo,
+	struct xfs_da_state_blk *drop_blk)
 {
 	struct xfs_da_intnode	*node;
 	struct xfs_da3_icnode_hdr nodehdr;
 	struct xfs_da_node_entry *btree;
 	int			index;
 	int			tmp;
-	struct xfs_inode	*dp = state->args->dp;
-	trace_xfs_da_node_remove(state->args);
 	node = drop_blk->bp->b_addr;
 	xfs_da3_node_hdr_from_disk(dp->i_mount, &nodehdr, node);
 		tmp  = nodehdr.count - index - 1;
 		tmp *= (uint)sizeof(xfs_da_node_entry_t);
 		memmove(&btree[index], &btree[index + 1], tmp);
-		xfs_trans_log_buf(state->args->trans, drop_blk->bp,
+		xfs_trans_log_buf(tp, drop_blk->bp,
 		    XFS_DA_LOGRANGE(node, &btree[index], tmp));
 		index = nodehdr.count - 1;
 	}
 	memset(&btree[index], 0, sizeof(xfs_da_node_entry_t));
-	xfs_trans_log_buf(state->args->trans, drop_blk->bp,
+	xfs_trans_log_buf(tp, drop_blk->bp,
 	    XFS_DA_LOGRANGE(node, &btree[index], sizeof(btree[index])));
 	nodehdr.count -= 1;
 	xfs_da3_node_hdr_to_disk(dp->i_mount, node, &nodehdr);
-	xfs_trans_log_buf(state->args->trans, drop_blk->bp,
+	xfs_trans_log_buf(tp, drop_blk->bp,
-	    XFS_DA_LOGRANGE(node, &node->hdr, state->args->geo->node_hdr_size));
+	    XFS_DA_LOGRANGE(node, &node->hdr, geo->node_hdr_size));
 	/*
 	 * Copy the last hash value from the block to propagate upwards.
 	drop_blk->hashval = be32_to_cpu(btree[index - 1].hashval);
 }
+/*
+ * Remove an entry from an intermediate node.
+ */
+STATIC void
+xfs_da3_node_remove(
+	struct xfs_da_state	*state,
+	struct xfs_da_state_blk	*drop_blk)
+{
+	trace_xfs_da_node_remove(state->args);
+	__xfs_da3_node_remove(state->args->trans, state->args->dp,
+			state->args->geo, drop_blk);
+}
+/*
+ * Remove an entry from an intermediate attr node at the specified index.
+ */
+void
+xfs_attr3_node_entry_remove(
+	struct xfs_trans	*tp,
+	struct xfs_inode	*dp,
+	struct xfs_buf		*bp,
+	int			index)
+{
+	struct xfs_da_state_blk blk = {
+		.index		= index,
+		.bp		= bp,
+	};
+	__xfs_da3_node_remove(tp, dp, dp->i_mount->m_attr_geo, &blk);
+}
 /*
  * Unbalance the elements between two intermediate nodes,
  * move all Btree elements from one node into another.

fs/xfs/libxfs/xfs_da_btree.h+2−0

@@ -184,6 +184,8 @@ int xfs_da3_split(xfs_da_state_t *state); · 183 unmodified lines
184	int xfs_da3_join(xfs_da_state_t *state);	184	int xfs_da3_join(xfs_da_state_t *state);
185	void xfs_da3_fixhashpath(struct xfs_da_state *state,	185	void xfs_da3_fixhashpath(struct xfs_da_state *state,
186	struct xfs_da_state_path *path_to_to_fix);	186	struct xfs_da_state_path *path_to_to_fix);
		187	void xfs_attr3_node_entry_remove(struct xfs_trans tp, struct xfs_inode dp,
		188	struct xfs_buf *bp, int index);
187		189
188	/*	190	/*
189	* Routines used for finding things in the Btree.	191	* Routines used for finding things in the Btree.

fs/xfs/scrub/quota.c+3−1

 	error = xchk_quota_item_bmap(sc, dq, offset);
 	xchk_iunlock(sc, XFS_ILOCK_SHARED);
-	if (!xchk_fblock_process_error(sc, XFS_DATA_FORK, offset, &error))
+	if (!xchk_fblock_process_error(sc, XFS_DATA_FORK, offset, &error)) {
+		mutex_unlock(&dq->q_qlock);
 		return error;
+	}
 	/*
 	 * Warn if the hard limits are larger than the fs.

fs/xfs/scrub/trace.h+2−10

 	TP_STRUCT__entry(
 		__field(dev_t, dev)
 		__field(unsigned long, ino)
-		__array(char, pathname, MAXNAMELEN)
 	),
 	TP_fast_assign(
-		char		*path;
 		__entry->ino = file_inode(xf->file)->i_ino;
-		path = file_path(xf->file, __entry->pathname, MAXNAMELEN);
-		if (IS_ERR(path))
-			strncpy(__entry->pathname, "(unknown)",
-					sizeof(__entry->pathname));
 	),
-	TP_printk("xfino 0x%lx path '%s'",
+	TP_printk("xfino 0x%lx",
-		  __entry->ino,
+		  __entry->ino)
-		  __entry->pathname)
 );
 TRACE_EVENT(xfile_destroy,

fs/xfs/xfs_attr_inactive.c+57−38

@@ -140,7 +140,7 @@ xfs_attr3_node_inactive( · 139 unmodified lines
140	xfs_daddr_t parent_blkno, child_blkno;	140	xfs_daddr_t parent_blkno, child_blkno;
141	struct xfs_buf *child_bp;	141	struct xfs_buf *child_bp;
142	struct xfs_da3_icnode_hdr ichdr;	142	struct xfs_da3_icnode_hdr ichdr;
143	int error, i;	143	int error;
144		144
145	/*	145	/*
146	* Since this code is recursive (gasp!) we must protect ourselves.	146	* Since this code is recursive (gasp!) we must protect ourselves.
@@ -152,7 +152,7 @@ xfs_attr3_node_inactive( · 5 unmodified lines
152	return -EFSCORRUPTED;	152	return -EFSCORRUPTED;
153	}	153	}
154		154
155	xfs_da3_node_hdr_from_disk(dp->i_mount, &ichdr, bp->b_addr);	155	xfs_da3_node_hdr_from_disk(mp, &ichdr, bp->b_addr);
156	parent_blkno = xfs_buf_daddr(bp);	156	parent_blkno = xfs_buf_daddr(bp);
157	if (!ichdr.count) {	157	if (!ichdr.count) {
158	xfs_trans_brelse(*trans, bp);	158	xfs_trans_brelse(*trans, bp);
@@ -167,7 +167,7 @@ xfs_attr3_node_inactive( · 8 unmodified lines
167	* over the leaves removing all of them. If this is higher up	167	* over the leaves removing all of them. If this is higher up
168	* in the tree, recurse downward.	168	* in the tree, recurse downward.
169	*/	169	*/
170	for (i = 0; i < ichdr.count; i++) {	170	while (ichdr.count > 0) {
171	/*	171	/*
172	* Read the subsidiary block to see what we have to work with.	172	* Read the subsidiary block to see what we have to work with.
173	* Don't do this in a transaction. This is a depth-first	173	* Don't do this in a transaction. This is a depth-first
@@ -218,29 +218,32 @@ xfs_attr3_node_inactive( · 44 unmodified lines
218	xfs_trans_binval(*trans, child_bp);	218	xfs_trans_binval(*trans, child_bp);
219	child_bp = NULL;	219	child_bp = NULL;
220		220
		221	error = xfs_da3_node_read_mapped(*trans, dp,
		222	parent_blkno, &bp, XFS_ATTR_FORK);
		223	if (error)
		224	return error;
		225
221	/*	226	/*
222	* If we're not done, re-read the parent to get the next	227	* Remove entry from parent node, prevents being indexed to.
223	* child block number.
224	*/	228	*/
225	if (i + 1 < ichdr.count) {	229	xfs_attr3_node_entry_remove(*trans, dp, bp, 0);
226	struct xfs_da3_icnode_hdr phdr;	230
		231	xfs_da3_node_hdr_from_disk(mp, &ichdr, bp->b_addr);
		232	bp = NULL;
227		233
228	error = xfs_da3_node_read_mapped(*trans, dp,	234	if (ichdr.count > 0) {
229	parent_blkno, &bp, XFS_ATTR_FORK);	235	/*
		236	* If we're not done, get the next child block number.
		237	*/
		238	child_fsb = be32_to_cpu(ichdr.btree[0].before);
		239
		240	/*
		241	* Atomically commit the whole invalidate stuff.
		242	*/
		243	error = xfs_trans_roll_inode(trans, dp);
230	if (error)	244	if (error)
231	return error;	245	return error;
232	xfs_da3_node_hdr_from_disk(dp->i_mount, &phdr,
233	bp->b_addr);
234	child_fsb = be32_to_cpu(phdr.btree[i + 1].before);
235	xfs_trans_brelse(*trans, bp);
236	bp = NULL;
237	}	246	}
238	/*
239	* Atomically commit the whole invalidate stuff.
240	*/
241	error = xfs_trans_roll_inode(trans, dp);
242	if (error)
243	return error;
244	}	247	}
245		248
246	return 0;	249	return 0;
@@ -257,10 +260,8 @@ xfs_attr3_root_inactive( · 10 unmodified lines
257	struct xfs_trans **trans,	260	struct xfs_trans **trans,
258	struct xfs_inode *dp)	261	struct xfs_inode *dp)
259	{	262	{
260	struct xfs_mount *mp = dp->i_mount;
261	struct xfs_da_blkinfo *info;	263	struct xfs_da_blkinfo *info;
262	struct xfs_buf *bp;	264	struct xfs_buf *bp;
263	xfs_daddr_t blkno;
264	int error;	265	int error;
265		266
266	/*	267	/*
@@ -272,7 +273,6 @@ xfs_attr3_root_inactive( · 5 unmodified lines
272	error = xfs_da3_node_read(*trans, dp, 0, &bp, XFS_ATTR_FORK);	273	error = xfs_da3_node_read(*trans, dp, 0, &bp, XFS_ATTR_FORK);
273	if (error)	274	if (error)
274	return error;	275	return error;
275	blkno = xfs_buf_daddr(bp);
276		276
277	/*	277	/*
278	* Invalidate the tree, even if the "tree" is only a single leaf block.	278	* Invalidate the tree, even if the "tree" is only a single leaf block.
@@ -283,10 +283,26 @@ xfs_attr3_root_inactive( · 4 unmodified lines
283	case cpu_to_be16(XFS_DA_NODE_MAGIC):	283	case cpu_to_be16(XFS_DA_NODE_MAGIC):
284	case cpu_to_be16(XFS_DA3_NODE_MAGIC):	284	case cpu_to_be16(XFS_DA3_NODE_MAGIC):
285	error = xfs_attr3_node_inactive(trans, dp, bp, 1);	285	error = xfs_attr3_node_inactive(trans, dp, bp, 1);
		286	/*
		287	* Empty root node block are not allowed, convert it to leaf.
		288	*/
		289	if (!error)
		290	error = xfs_attr3_leaf_init(*trans, dp, 0);
		291	if (!error)
		292	error = xfs_trans_roll_inode(trans, dp);
286	break;	293	break;
287	case cpu_to_be16(XFS_ATTR_LEAF_MAGIC):	294	case cpu_to_be16(XFS_ATTR_LEAF_MAGIC):
288	case cpu_to_be16(XFS_ATTR3_LEAF_MAGIC):	295	case cpu_to_be16(XFS_ATTR3_LEAF_MAGIC):
289	error = xfs_attr3_leaf_inactive(trans, dp, bp);	296	error = xfs_attr3_leaf_inactive(trans, dp, bp);
		297	/*
		298	* Reinit the leaf before truncating extents so that a crash
		299	* mid-truncation leaves an empty leaf rather than one with
		300	* entries that may reference freed remote value blocks.
		301	*/
		302	if (!error)
		303	error = xfs_attr3_leaf_init(*trans, dp, 0);
		304	if (!error)
		305	error = xfs_trans_roll_inode(trans, dp);
290	break;	306	break;
291	default:	307	default:
292	xfs_dirattr_mark_sick(dp, XFS_ATTR_FORK);	308	xfs_dirattr_mark_sick(dp, XFS_ATTR_FORK);
@@ -295,21 +311,6 @@ xfs_attr3_root_inactive( · 2 unmodified lines
295	xfs_trans_brelse(*trans, bp);	311	xfs_trans_brelse(*trans, bp);
296	break;	312	break;
297	}	313	}
298	if (error)
299	return error;
300
301	/*
302	* Invalidate the incore copy of the root block.
303	*/
304	error = xfs_trans_get_buf(*trans, mp->m_ddev_targp, blkno,
305	XFS_FSB_TO_BB(mp, mp->m_attr_geo->fsbcount), 0, &bp);
306	if (error)
307	return error;
308	xfs_trans_binval(trans, bp); / remove from cache */
309	/*
310	* Commit the invalidate and start the next transaction.
311	*/
312	error = xfs_trans_roll_inode(trans, dp);
313		314
314	return error;	315	return error;
315	}	316	}
@@ -328,6 +329,7 @@ xfs_attr_inactive( · 12 unmodified lines
328	{	329	{
329	struct xfs_trans *trans;	330	struct xfs_trans *trans;
330	struct xfs_mount *mp;	331	struct xfs_mount *mp;
		332	struct xfs_buf *bp;
331	int lock_mode = XFS_ILOCK_SHARED;	333	int lock_mode = XFS_ILOCK_SHARED;
332	int error = 0;	334	int error = 0;
333		335
@@ -363,10 +365,27 @@ xfs_attr_inactive( · 29 unmodified lines
363	* removal below.	365	* removal below.
364	*/	366	*/
365	if (dp->i_af.if_nextents > 0) {	367	if (dp->i_af.if_nextents > 0) {
		368	/*
		369	* Invalidate and truncate all blocks but leave the root block.
		370	*/
366	error = xfs_attr3_root_inactive(&trans, dp);	371	error = xfs_attr3_root_inactive(&trans, dp);
367	if (error)	372	if (error)
368	goto out_cancel;	373	goto out_cancel;
369		374
		375	error = xfs_itruncate_extents(&trans, dp, XFS_ATTR_FORK,
		376	XFS_FSB_TO_B(mp, mp->m_attr_geo->fsbcount));
		377	if (error)
		378	goto out_cancel;
		379
		380	/*
		381	* Invalidate and truncate the root block and ensure that the
		382	* operation is completed within a single transaction.
		383	*/
		384	error = xfs_da_get_buf(trans, dp, 0, &bp, XFS_ATTR_FORK);
		385	if (error)
		386	goto out_cancel;
		387
		388	xfs_trans_binval(trans, bp);
370	error = xfs_itruncate_extents(&trans, dp, XFS_ATTR_FORK, 0);	389	error = xfs_itruncate_extents(&trans, dp, XFS_ATTR_FORK, 0);
371	if (error)	390	if (error)
372	goto out_cancel;	391	goto out_cancel;

fs/xfs/xfs_attr_item.c+2−49

@@ -653,7 +653,6 @@ xfs_attri_recover_work( · 652 unmodified lines
653	break;	653	break;
654	}	654	}
655	if (error) {	655	if (error) {
656	xfs_irele(ip);
657	XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, attrp,	656	XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, attrp,
658	sizeof(*attrp));	657	sizeof(*attrp));
659	return ERR_PTR(-EFSCORRUPTED);	658	return ERR_PTR(-EFSCORRUPTED);
@@ -1047,8 +1046,8 @@ xlog_recover_attri_commit_pass2( · 387 unmodified lines
1047	break;	1046	break;
1048	case XFS_ATTRI_OP_FLAGS_SET:	1047	case XFS_ATTRI_OP_FLAGS_SET:
1049	case XFS_ATTRI_OP_FLAGS_REPLACE:	1048	case XFS_ATTRI_OP_FLAGS_REPLACE:
1050	/* Log item, attr name, attr value */	1049	/* Log item, attr name, optional attr value */
1051	if (item->ri_total != 3) {	1050	if (item->ri_total != 2 + !!attri_formatp->alfi_value_len) {
1052	XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,	1051	XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
1053	attri_formatp, len);	1052	attri_formatp, len);
1054	return -EFSCORRUPTED;	1053	return -EFSCORRUPTED;
@@ -1132,52 +1131,6 @@ xlog_recover_attri_commit_pass2( · 77 unmodified lines
1132	return -EFSCORRUPTED;	1131	return -EFSCORRUPTED;
1133	}	1132	}
1134		1133
1135	switch (op) {
1136	case XFS_ATTRI_OP_FLAGS_REMOVE:
1137	/* Regular remove operations operate only on names. */
1138	if (attr_value != NULL \|\| value_len != 0) {
1139	XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
1140	attri_formatp, len);
1141	return -EFSCORRUPTED;
1142	}
1143	fallthrough;
1144	case XFS_ATTRI_OP_FLAGS_PPTR_REMOVE:
1145	case XFS_ATTRI_OP_FLAGS_PPTR_SET:
1146	case XFS_ATTRI_OP_FLAGS_SET:
1147	case XFS_ATTRI_OP_FLAGS_REPLACE:
1148	/*
1149	* Regular xattr set/remove/replace operations require a name
1150	* and do not take a newname. Values are optional for set and
1151	* replace.
1152	*
1153	* Name-value set/remove operations must have a name, do not
1154	* take a newname, and can take a value.
1155	*/
1156	if (attr_name == NULL \|\| name_len == 0) {
1157	XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
1158	attri_formatp, len);
1159	return -EFSCORRUPTED;
1160	}
1161	break;
1162	case XFS_ATTRI_OP_FLAGS_PPTR_REPLACE:
1163	/*
1164	* Name-value replace operations require the caller to
1165	* specify the old and new names and values explicitly.
1166	* Values are optional.
1167	*/
1168	if (attr_name == NULL \|\| name_len == 0) {
1169	XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
1170	attri_formatp, len);
1171	return -EFSCORRUPTED;
1172	}
1173	if (attr_new_name == NULL \|\| new_name_len == 0) {
1174	XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp,
1175	attri_formatp, len);
1176	return -EFSCORRUPTED;
1177	}
1178	break;
1179	}
1180
1181	/*	1134	/*
1182	* Memory alloc failure will cause replay to abort. We attach the	1135	* Memory alloc failure will cause replay to abort. We attach the
1183	* name/value buffer to the recovered incore log item and drop our	1136	* name/value buffer to the recovered incore log item and drop our

fs/xfs/xfs_dquot_item.c+7−2

 	struct xfs_dq_logitem	*qlip = DQUOT_ITEM(lip);
 	struct xfs_dquot	*dqp = qlip->qli_dquot;
 	struct xfs_buf		*bp;
+	struct xfs_ail		*ailp = lip->li_ailp;
 	uint			rval = XFS_ITEM_SUCCESS;
 	int			error;
 		goto out_unlock;
 	}
-	spin_unlock(&lip->li_ailp->ail_lock);
+	spin_unlock(&ailp->ail_lock);
 	error = xfs_dquot_use_attached_buf(dqp, &bp);
 	if (error == -EAGAIN) {
 			rval = XFS_ITEM_FLUSHING;
 	}
 	xfs_buf_relse(bp);
+	/*
+	 * The buffer no longer protects the log item from reclaim, so
+	 * do not reference lip after this point.
+	 */
 out_relock_ail:
-	spin_lock(&lip->li_ailp->ail_lock);
+	spin_lock(&ailp->ail_lock);
 out_unlock:
 	mutex_unlock(&dqp->q_qlock);
 	return rval;

fs/xfs/xfs_handle.c+1−1

 	context.dp = dp;
 	context.resynch = 1;
 	context.attr_filter = xfs_attr_filter(flags);
-	context.buffer = buffer;
 	context.bufsize = round_down(bufsize, sizeof(uint32_t));
+	context.buffer = buffer;
 	context.firstu = context.bufsize;
 	context.put_listent = xfs_ioc_attr_put_listent;

fs/xfs/xfs_inode.c+2−1

 	xfs_assert_ilocked(ip, XFS_ILOCK_EXCL);
 	if (icount_read(VFS_I(ip)))
 		xfs_assert_ilocked(ip, XFS_IOLOCK_EXCL);
-	ASSERT(new_size <= XFS_ISIZE(ip));
+	if (whichfork == XFS_DATA_FORK)
+		ASSERT(new_size <= XFS_ISIZE(ip));
 	ASSERT(tp->t_flags & XFS_TRANS_PERM_LOG_RES);
 	ASSERT(ip->i_itemp != NULL);
 	ASSERT(ip->i_itemp->ili_lock_flags == 0);

fs/xfs/xfs_inode_item.c+7−2

 	struct xfs_inode_log_item *iip = INODE_ITEM(lip);
 	struct xfs_inode	*ip = iip->ili_inode;
 	struct xfs_buf		*bp = lip->li_buf;
+	struct xfs_ail		*ailp = lip->li_ailp;
 	uint			rval = XFS_ITEM_SUCCESS;
 	int			error;
 	if (!xfs_buf_trylock(bp))
 		return XFS_ITEM_LOCKED;
-	spin_unlock(&lip->li_ailp->ail_lock);
+	spin_unlock(&ailp->ail_lock);
 	/*
 	 * We need to hold a reference for flushing the cluster buffer as it may
 		rval = XFS_ITEM_LOCKED;
 	}
-	spin_lock(&lip->li_ailp->ail_lock);
+	/*
+	 * The buffer no longer protects the log item from reclaim, so
+	 * do not reference lip after this point.
+	 */
+	spin_lock(&ailp->ail_lock);
 	return rval;
 }

fs/xfs/xfs_mount.c+4−3

  * have been retrying in the background.  This will prevent never-ending
  * retries in AIL pushing from hanging the unmount.
  *
- * Finally, we can push the AIL to clean all the remaining dirty objects, then
+ * Stop inodegc and background reclaim before pushing the AIL so that they
- * reclaim the remaining inodes that are still in memory at this point in time.
+ * are not running while the AIL is being flushed. Then push the AIL to
+ * clean all the remaining dirty objects and reclaim the remaining inodes.
  */
 static void
 xfs_unmount_flush_inodes(
 	xfs_set_unmounting(mp);
-	xfs_ail_push_all_sync(mp->m_ail);
 	xfs_inodegc_stop(mp);
 	cancel_delayed_work_sync(&mp->m_reclaim_work);
+	xfs_ail_push_all_sync(mp->m_ail);
 	xfs_reclaim_inodes(mp);
 	xfs_health_unmount(mp);
 	xfs_healthmon_unmount(mp);

fs/xfs/xfs_trace.h+34−13

 #include <linux/tracepoint.h>
 struct xfs_agf;
+struct xfs_ail;
 struct xfs_alloc_arg;
 struct xfs_attr_list_context;
 struct xfs_buf_log_item;
 DEFINE_EVENT(xfs_log_item_class, name, \
 	TP_PROTO(struct xfs_log_item *lip), \
 	TP_ARGS(lip))
-DEFINE_LOG_ITEM_EVENT(xfs_ail_push);
-DEFINE_LOG_ITEM_EVENT(xfs_ail_pinned);
-DEFINE_LOG_ITEM_EVENT(xfs_ail_locked);
-DEFINE_LOG_ITEM_EVENT(xfs_ail_flushing);
 DEFINE_LOG_ITEM_EVENT(xfs_cil_whiteout_mark);
 DEFINE_LOG_ITEM_EVENT(xfs_cil_whiteout_skip);
 DEFINE_LOG_ITEM_EVENT(xfs_cil_whiteout_unpin);
 DEFINE_LOG_ITEM_EVENT(xlog_ail_insert_abort);
 DEFINE_LOG_ITEM_EVENT(xfs_trans_free_abort);
+DECLARE_EVENT_CLASS(xfs_ail_push_class,
+	TP_PROTO(struct xfs_ail *ailp, uint type, unsigned long flags, xfs_lsn_t lsn),
+	TP_ARGS(ailp, type, flags, lsn),
+	TP_STRUCT__entry(
+		__field(dev_t, dev)
+		__field(uint, type)
+		__field(unsigned long, flags)
+		__field(xfs_lsn_t, lsn)
+	),
+	TP_fast_assign(
+		__entry->dev = ailp->ail_log->l_mp->m_super->s_dev;
+		__entry->type = type;
+		__entry->flags = flags;
+		__entry->lsn = lsn;
+	),
+	TP_printk("dev %d:%d lsn %d/%d type %s flags %s",
+		  MAJOR(__entry->dev), MINOR(__entry->dev),
+		  CYCLE_LSN(__entry->lsn), BLOCK_LSN(__entry->lsn),
+		  __print_symbolic(__entry->type, XFS_LI_TYPE_DESC),
+		  __print_flags(__entry->flags, "|", XFS_LI_FLAGS))
+)
+#define DEFINE_AIL_PUSH_EVENT(name) \
+DEFINE_EVENT(xfs_ail_push_class, name, \
+	TP_PROTO(struct xfs_ail *ailp, uint type, unsigned long flags, xfs_lsn_t lsn), \
+	TP_ARGS(ailp, type, flags, lsn))
+DEFINE_AIL_PUSH_EVENT(xfs_ail_push);
+DEFINE_AIL_PUSH_EVENT(xfs_ail_pinned);
+DEFINE_AIL_PUSH_EVENT(xfs_ail_locked);
+DEFINE_AIL_PUSH_EVENT(xfs_ail_flushing);
 DECLARE_EVENT_CLASS(xfs_ail_class,
 	TP_PROTO(struct xfs_log_item *lip, xfs_lsn_t old_lsn, xfs_lsn_t new_lsn),
 	TP_ARGS(lip, old_lsn, new_lsn),
 	TP_STRUCT__entry(
 		__field(dev_t, dev)
 		__field(unsigned long, ino)
-		__array(char, pathname, MAXNAMELEN)
 	),
 	TP_fast_assign(
-		char		*path;
 		struct file	*file = btp->bt_file;
 		__entry->dev = btp->bt_mount->m_super->s_dev;
 		__entry->ino = file_inode(file)->i_ino;
-		path = file_path(file, __entry->pathname, MAXNAMELEN);
-		if (IS_ERR(path))
-			strncpy(__entry->pathname, "(unknown)",
-					sizeof(__entry->pathname));
 	),
-	TP_printk("dev %d:%d xmino 0x%lx path '%s'",
+	TP_printk("dev %d:%d xmino 0x%lx",
 		  MAJOR(__entry->dev), MINOR(__entry->dev),
-		  __entry->ino,
+		  __entry->ino)
-		  __entry->pathname)
 );
 TRACE_EVENT(xmbuf_free,

fs/xfs/xfs_trans_ail.c+75−52

 	return XFS_ITEM_SUCCESS;
 }
+/*
+ * Push a single log item from the AIL.
+ *
+ * @lip may have been released and freed by the time this function returns,
+ * so callers must not dereference the log item afterwards.
+ */
 static inline uint
 xfsaild_push_item(
 	struct xfs_ail		*ailp,
 	return target_lsn;
 }
+static void
+xfsaild_process_logitem(
+	struct xfs_ail		*ailp,
+	struct xfs_log_item	*lip,
+	int			*stuck,
+	int			*flushing)
+{
+	struct xfs_mount	*mp = ailp->ail_log->l_mp;
+	uint			type = lip->li_type;
+	unsigned long		flags = lip->li_flags;
+	xfs_lsn_t		item_lsn = lip->li_lsn;
+	int			lock_result;
+	/*
+	 * Note that iop_push may unlock and reacquire the AIL lock. We
+	 * rely on the AIL cursor implementation to be able to deal with
+	 * the dropped lock.
+	 *
+	 * The log item may have been freed by the push, so it must not
+	 * be accessed or dereferenced below this line.
+	 */
+	lock_result = xfsaild_push_item(ailp, lip);
+	switch (lock_result) {
+	case XFS_ITEM_SUCCESS:
+		XFS_STATS_INC(mp, xs_push_ail_success);
+		trace_xfs_ail_push(ailp, type, flags, item_lsn);
+		ailp->ail_last_pushed_lsn = item_lsn;
+		break;
+	case XFS_ITEM_FLUSHING:
+		/*
+		 * The item or its backing buffer is already being
+		 * flushed.  The typical reason for that is that an
+		 * inode buffer is locked because we already pushed the
+		 * updates to it as part of inode clustering.
+		 *
+		 * We do not want to stop flushing just because lots
+		 * of items are already being flushed, but we need to
+		 * re-try the flushing relatively soon if most of the
+		 * AIL is being flushed.
+		 */
+		XFS_STATS_INC(mp, xs_push_ail_flushing);
+		trace_xfs_ail_flushing(ailp, type, flags, item_lsn);
+		(*flushing)++;
+		ailp->ail_last_pushed_lsn = item_lsn;
+		break;
+	case XFS_ITEM_PINNED:
+		XFS_STATS_INC(mp, xs_push_ail_pinned);
+		trace_xfs_ail_pinned(ailp, type, flags, item_lsn);
+		(*stuck)++;
+		ailp->ail_log_flush++;
+		break;
+	case XFS_ITEM_LOCKED:
+		XFS_STATS_INC(mp, xs_push_ail_locked);
+		trace_xfs_ail_locked(ailp, type, flags, item_lsn);
+		(*stuck)++;
+		break;
+	default:
+		ASSERT(0);
+		break;
+	}
+}
 static long
 xfsaild_push(
 	struct xfs_ail		*ailp)
 	lsn = lip->li_lsn;
 	while ((XFS_LSN_CMP(lip->li_lsn, ailp->ail_target) <= 0)) {
-		int	lock_result;
 		if (test_bit(XFS_LI_FLUSHING, &lip->li_flags))
 			goto next_item;
-		/*
+		xfsaild_process_logitem(ailp, lip, &stuck, &flushing);
-		 * Note that iop_push may unlock and reacquire the AIL lock.  We
-		 * rely on the AIL cursor implementation to be able to deal with
-		 * the dropped lock.
-		 */
-		lock_result = xfsaild_push_item(ailp, lip);
-		switch (lock_result) {
-		case XFS_ITEM_SUCCESS:
-			XFS_STATS_INC(mp, xs_push_ail_success);
-			trace_xfs_ail_push(lip);
-			ailp->ail_last_pushed_lsn = lsn;
-			break;
-		case XFS_ITEM_FLUSHING:
-			/*
-			 * The item or its backing buffer is already being
-			 * flushed.  The typical reason for that is that an
-			 * inode buffer is locked because we already pushed the
-			 * updates to it as part of inode clustering.
-			 *
-			 * We do not want to stop flushing just because lots
-			 * of items are already being flushed, but we need to
-			 * re-try the flushing relatively soon if most of the
-			 * AIL is being flushed.
-			 */
-			XFS_STATS_INC(mp, xs_push_ail_flushing);
-			trace_xfs_ail_flushing(lip);
-			flushing++;
-			ailp->ail_last_pushed_lsn = lsn;
-			break;
-		case XFS_ITEM_PINNED:
-			XFS_STATS_INC(mp, xs_push_ail_pinned);
-			trace_xfs_ail_pinned(lip);
-			stuck++;
-			ailp->ail_log_flush++;
-			break;
-		case XFS_ITEM_LOCKED:
-			XFS_STATS_INC(mp, xs_push_ail_locked);
-			trace_xfs_ail_locked(lip);
-			stuck++;
-			break;
-		default:
-			ASSERT(0);
-			break;
-		}
 		count++;
 		/*

fs/xfs/xfs_verify_media.c+8−10

 			min_not_zero(SZ_1M, me->me_max_io_size);
 	BUILD_BUG_ON(BBSHIFT != SECTOR_SHIFT);
-	ASSERT(BBTOB(bbcount) >= bdev_logical_block_size(btp->bt_bdev));
+	ASSERT(BBTOB(bbcount) >= btp->bt_logical_sectorsize);
-	return clamp(iosize, bdev_logical_block_size(btp->bt_bdev),
+	return clamp(iosize, btp->bt_logical_sectorsize, BBTOB(bbcount));
-			BBTOB(bbcount));
 }
 /* Allocate as much memory as we can get for verification buffer. */
 	unsigned int		bio_bbcount,
 	blk_status_t		bio_status)
 {
-	trace_xfs_verify_media_error(mp, me, btp->bt_bdev->bd_dev, daddr,
+	trace_xfs_verify_media_error(mp, me, btp->bt_dev, daddr, bio_bbcount,
-			bio_bbcount, bio_status);
+			bio_status);
 	/*
 	 * Pass any error, I/O or otherwise, up to the caller if we didn't
 		btp = mp->m_ddev_targp;
 		break;
 	case XFS_DEV_LOG:
-		if (mp->m_logdev_targp->bt_bdev != mp->m_ddev_targp->bt_bdev)
+		if (mp->m_logdev_targp != mp->m_ddev_targp)
 			btp = mp->m_logdev_targp;
 		break;
 	case XFS_DEV_RT:
 	/* start and end have to be aligned to the lba size */
 	if (!IS_ALIGNED(BBTOB(me->me_start_daddr | me->me_end_daddr),
-			bdev_logical_block_size(btp->bt_bdev)))
+			btp->bt_logical_sectorsize))
 		return -EINVAL;
 	/*
 	if (!folio)
 		return -ENOMEM;
-	trace_xfs_verify_media(mp, me, btp->bt_bdev->bd_dev, daddr, bbcount,
+	trace_xfs_verify_media(mp, me, btp->bt_dev, daddr, bbcount, folio);
-			folio);
 	bio = bio_alloc(btp->bt_bdev, 1, REQ_OP_READ, GFP_KERNEL);
 	if (!bio) {
 	 * an operational error.
 	 */
 	me->me_start_daddr = daddr;
-	trace_xfs_verify_media_end(mp, me, btp->bt_bdev->bd_dev);
+	trace_xfs_verify_media_end(mp, me, btp->bt_dev);
 	return 0;
 }

fs/xfs/xfs_xattr.c+1−1

 	memset(&context, 0, sizeof(context));
 	context.dp = XFS_I(inode);
 	context.resynch = 1;
-	context.buffer = size ? data : NULL;
 	context.bufsize = size;
+	context.buffer = size ? data : NULL;
 	context.firstu = context.bufsize;
 	context.put_listent = xfs_xattr_put_listent;

include/linux/damon.h+6−0

 	struct damos_walk_control *walk_control;
 	struct mutex walk_control_lock;
+	/*
+	 * indicate if this may be corrupted.  Currentonly this is set only for
+	 * damon_commit_ctx() failure.
+	 */
+	bool maybe_corrupted;
 	/* Working thread of the given DAMON context */
 	struct task_struct *kdamond;
 	/* Protects @kdamond field access */

include/linux/dma-mapping.h+13−6

 #define DMA_ATTR_MMIO		(1UL << 10)
 /*
- * DMA_ATTR_CPU_CACHE_CLEAN: Indicates the CPU will not dirty any cacheline
+ * DMA_ATTR_DEBUGGING_IGNORE_CACHELINES: Indicates the CPU cache line can be
- * overlapping this buffer while it is mapped for DMA. All mappings sharing
+ * overlapped. All mappings sharing a cacheline must have this attribute for
- * a cacheline must have this attribute for this to be considered safe.
+ * this to be considered safe.
  */
-#define DMA_ATTR_CPU_CACHE_CLEAN	(1UL << 11)
+#define DMA_ATTR_DEBUGGING_IGNORE_CACHELINES	(1UL << 11)
+/*
+ * DMA_ATTR_REQUIRE_COHERENT: Indicates that DMA coherency is required.
+ * All mappings that carry this attribute can't work with SWIOTLB and cache
+ * flushing.
+ */
+#define DMA_ATTR_REQUIRE_COHERENT	(1UL << 12)
 /*
  * A dma_addr_t can hold any valid DMA or bus address for the platform.  It can
 {
 	return NULL;
 }
-static void dma_free_attrs(struct device *dev, size_t size, void *cpu_addr,
+static inline void dma_free_attrs(struct device *dev, size_t size,
-		dma_addr_t dma_handle, unsigned long attrs)
+		void *cpu_addr, dma_addr_t dma_handle, unsigned long attrs)
 {
 }
 static inline void *dmam_alloc_attrs(struct device *dev, size_t size,

include/linux/fs/super_types.h+1−0

@@ -338,5 +338,6 @@ struct super_block { · 337 unmodified lines
338	#define SB_I_NOUMASK 0x00001000 /* VFS does not apply umask */	338	#define SB_I_NOUMASK 0x00001000 /* VFS does not apply umask */
339	#define SB_I_NOIDMAP 0x00002000 /* No idmapped mounts on this superblock */	339	#define SB_I_NOIDMAP 0x00002000 /* No idmapped mounts on this superblock */
340	#define SB_I_ALLOW_HSM 0x00004000 /* Allow HSM events on this superblock */	340	#define SB_I_ALLOW_HSM 0x00004000 /* Allow HSM events on this superblock */
		341	#define SB_I_NO_DATA_INTEGRITY 0x00008000 /* fs cannot guarantee data persistence on sync */
341		342
342	#endif /* _LINUX_FS_SUPER_TYPES_H */	343	#endif /* _LINUX_FS_SUPER_TYPES_H */

include/linux/leafops.h+21−11

 	return swp_offset(entry) & SWP_PFN_MASK;
 }
+static inline void softleaf_migration_sync(softleaf_t entry,
+		struct folio *folio)
+{
+	/*
+	 * Ensure we do not race with split, which might alter tail pages into new
+	 * folios and thus result in observing an unlocked folio.
+	 * This matches the write barrier in __split_folio_to_order().
+	 */
+	smp_rmb();
+	/*
+	 * Any use of migration entries may only occur while the
+	 * corresponding page is locked
+	 */
+	VM_WARN_ON_ONCE(!folio_test_locked(folio));
+}
 /**
  * softleaf_to_page() - Obtains struct page for PFN encoded within leaf entry.
  * @entry: Leaf entry, softleaf_has_pfn(@entry) must return true.
 	struct page *page = pfn_to_page(softleaf_to_pfn(entry));
 	VM_WARN_ON_ONCE(!softleaf_has_pfn(entry));
-	/*
+	if (softleaf_is_migration(entry))
-	 * Any use of migration entries may only occur while the
+		softleaf_migration_sync(entry, page_folio(page));
-	 * corresponding page is locked
-	 */
-	VM_WARN_ON_ONCE(softleaf_is_migration(entry) && !PageLocked(page));
 	return page;
 }
 	struct folio *folio = pfn_folio(softleaf_to_pfn(entry));
 	VM_WARN_ON_ONCE(!softleaf_has_pfn(entry));
-	/*
+	if (softleaf_is_migration(entry))
-	 * Any use of migration entries may only occur while the
+		softleaf_migration_sync(entry, folio);
-	 * corresponding folio is locked.
-	 */
-	VM_WARN_ON_ONCE(softleaf_is_migration(entry) &&
-			!folio_test_locked(folio));
 	return folio;
 }

include/linux/mempolicy.h+1−0

@@ -55,6 +55,7 @@ struct mempolicy { · 54 unmodified lines
55	nodemask_t cpuset_mems_allowed; /* relative to these nodes */	55	nodemask_t cpuset_mems_allowed; /* relative to these nodes */
56	nodemask_t user_nodemask; /* nodemask passed by user */	56	nodemask_t user_nodemask; /* nodemask passed by user */
57	} w;	57	} w;
		58	struct rcu_head rcu;
58	};	59	};
59		60
60	/*	61	/*

include/linux/netfs.h+0−1

@@ -140,7 +140,6 @@ struct netfs_io_stream { · 139 unmodified lines
140	void (issue_write)(struct netfs_io_subrequest subreq);	140	void (issue_write)(struct netfs_io_subrequest subreq);
141	/* Collection tracking */	141	/* Collection tracking */
142	struct list_head subrequests; /* Contributory I/O operations */	142	struct list_head subrequests; /* Contributory I/O operations */
143	struct netfs_io_subrequest front; / Op being collected */
144	unsigned long long collected_to; /* Position we've collected results to */	143	unsigned long long collected_to; /* Position we've collected results to */
145	size_t transferred; /* The amount transferred from this stream */	144	size_t transferred; /* The amount transferred from this stream */
146	unsigned short error; /* Aggregate error for the stream */	145	unsigned short error; /* Aggregate error for the stream */

include/linux/pagemap.h+0−11

 	AS_WRITEBACK_MAY_DEADLOCK_ON_RECLAIM = 9,
 	AS_KERNEL_FILE = 10,	/* mapping for a fake kernel file that shouldn't
 				   account usage to user cgroups */
-	AS_NO_DATA_INTEGRITY = 11, /* no data integrity guarantees */
 	/* Bits 16-25 are used for FOLIO_ORDER */
 	AS_FOLIO_ORDER_BITS = 5,
 	AS_FOLIO_ORDER_MIN = 16,
 	return test_bit(AS_WRITEBACK_MAY_DEADLOCK_ON_RECLAIM, &mapping->flags);
 }
-static inline void mapping_set_no_data_integrity(struct address_space *mapping)
-{
-	set_bit(AS_NO_DATA_INTEGRITY, &mapping->flags);
-}
-static inline bool mapping_no_data_integrity(const struct address_space *mapping)
-{
-	return test_bit(AS_NO_DATA_INTEGRITY, &mapping->flags);
-}
 static inline gfp_t mapping_gfp_mask(const struct address_space *mapping)
 {
 	return mapping->gfp_mask;

include/linux/security.h+1−0

@@ -145,6 +145,7 @@ enum lockdown_reason { · 144 unmodified lines
145	LOCKDOWN_BPF_WRITE_USER,	145	LOCKDOWN_BPF_WRITE_USER,
146	LOCKDOWN_DBG_WRITE_KERNEL,	146	LOCKDOWN_DBG_WRITE_KERNEL,
147	LOCKDOWN_RTAS_ERROR_INJECTION,	147	LOCKDOWN_RTAS_ERROR_INJECTION,
		148	LOCKDOWN_XEN_USER_ACTIONS,
148	LOCKDOWN_INTEGRITY_MAX,	149	LOCKDOWN_INTEGRITY_MAX,
149	LOCKDOWN_KCORE,	150	LOCKDOWN_KCORE,
150	LOCKDOWN_KPROBES,	151	LOCKDOWN_KPROBES,

include/linux/spi/spi.h+0−5

  * @modalias: Name of the driver to use with this device, or an alias
  *	for that name.  This appears in the sysfs "modalias" attribute
  *	for driver coldplugging, and in uevents used for hotplugging
- * @driver_override: If the name of a driver is written to this attribute, then
- *	the device will bind to the named driver and only the named driver.
- *	Do not set directly, because core frees it; use driver_set_override() to
- *	set or clear it.
  * @pcpu_statistics: statistics for the spi_device
  * @word_delay: delay to be inserted between consecutive
  *	words of a transfer
 	void			*controller_state;
 	void			*controller_data;
 	char			modalias[SPI_NAME_SIZE];
-	const char		*driver_override;
 	/* The statistics */
 	struct spi_statistics __percpu	*pcpu_statistics;

include/linux/srcutiny.h+4−0

 #ifndef _LINUX_SRCU_TINY_H
 #define _LINUX_SRCU_TINY_H
+#include <linux/irq_work_types.h>
 #include <linux/swait.h>
 struct srcu_struct {
 	struct rcu_head *srcu_cb_head;	/* Pending callbacks: Head. */
 	struct rcu_head **srcu_cb_tail;	/* Pending callbacks: Tail. */
 	struct work_struct srcu_work;	/* For driving grace periods. */
+	struct irq_work srcu_irq_work;	/* Defer schedule_work() to irq work. */
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 	struct lockdep_map dep_map;
 #endif /* #ifdef CONFIG_DEBUG_LOCK_ALLOC */
 };
 void srcu_drive_gp(struct work_struct *wp);
+void srcu_tiny_irq_work(struct irq_work *irq_work);
 #define __SRCU_STRUCT_INIT(name, __ignored, ___ignored, ____ignored)	\
 {									\
 	.srcu_wq = __SWAIT_QUEUE_HEAD_INITIALIZER(name.srcu_wq),	\
 	.srcu_cb_tail = &name.srcu_cb_head,				\
 	.srcu_work = __WORK_INITIALIZER(name.srcu_work, srcu_drive_gp),	\
+	.srcu_irq_work = { .func = srcu_tiny_irq_work },		\
 	__SRCU_DEP_MAP_INIT(name)					\
 }

include/linux/srcutree.h+5−4

 						/* Values: SRCU_READ_FLAVOR_.*  */
 	/* Update-side state. */
-	spinlock_t __private lock ____cacheline_internodealigned_in_smp;
+	raw_spinlock_t __private lock ____cacheline_internodealigned_in_smp;
 	struct rcu_segcblist srcu_cblist;	/* List of callbacks.*/
 	unsigned long srcu_gp_seq_needed;	/* Furthest future GP needed. */
 	unsigned long srcu_gp_seq_needed_exp;	/* Furthest future exp GP. */
  * Node in SRCU combining tree, similar in function to rcu_data.
  */
 struct srcu_node {
-	spinlock_t __private lock;
+	raw_spinlock_t __private lock;
 	unsigned long srcu_have_cbs[4];		/* GP seq for children having CBs, but only */
 						/*  if greater than ->srcu_gp_seq. */
 	unsigned long srcu_data_have_cbs[4];	/* Which srcu_data structs have CBs for given GP? */
 						/* First node at each level. */
 	int srcu_size_state;			/* Small-to-big transition state. */
 	struct mutex srcu_cb_mutex;		/* Serialize CB preparation. */
-	spinlock_t __private lock;		/* Protect counters and size state. */
+	raw_spinlock_t __private lock;		/* Protect counters and size state. */
 	struct mutex srcu_gp_mutex;		/* Serialize GP work. */
 	unsigned long srcu_gp_seq;		/* Grace-period seq #. */
 	unsigned long srcu_gp_seq_needed;	/* Latest gp_seq needed. */
 	unsigned long reschedule_jiffies;
 	unsigned long reschedule_count;
 	struct delayed_work work;
+	struct irq_work irq_work;
 	struct srcu_struct *srcu_ssp;
 };
 #define __SRCU_USAGE_INIT(name)									\
 {												\
-	.lock = __SPIN_LOCK_UNLOCKED(name.lock),						\
+	.lock = __RAW_SPIN_LOCK_UNLOCKED(name.lock),						\
 	.srcu_gp_seq = SRCU_GP_SEQ_INITIAL_VAL,							\
 	.srcu_gp_seq_needed = SRCU_GP_SEQ_INITIAL_VAL_WITH_STATE,				\
 	.srcu_gp_seq_needed_exp = SRCU_GP_SEQ_INITIAL_VAL,					\

include/linux/virtio_net.h+49−4

@@ -207,6 +207,39 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, · 206 unmodified lines
207	return __virtio_net_hdr_to_skb(skb, hdr, little_endian, hdr->gso_type);	207	return __virtio_net_hdr_to_skb(skb, hdr, little_endian, hdr->gso_type);
208	}	208	}
209		209
		210	/* This function must be called after virtio_net_hdr_from_skb(). */
		211	static inline void __virtio_net_set_hdrlen(const struct sk_buff *skb,
		212	struct virtio_net_hdr *hdr,
		213	bool little_endian)
		214	{
		215	u16 hdr_len;
		216
		217	hdr_len = skb_transport_offset(skb);
		218
		219	if (hdr->gso_type == VIRTIO_NET_HDR_GSO_UDP_L4)
		220	hdr_len += sizeof(struct udphdr);
		221	else
		222	hdr_len += tcp_hdrlen(skb);
		223
		224	hdr->hdr_len = __cpu_to_virtio16(little_endian, hdr_len);
		225	}
		226
		227	/* This function must be called after virtio_net_hdr_from_skb(). */
		228	static inline void __virtio_net_set_tnl_hdrlen(const struct sk_buff *skb,
		229	struct virtio_net_hdr *hdr)
		230	{
		231	u16 hdr_len;
		232
		233	hdr_len = skb_inner_transport_offset(skb);
		234
		235	if (hdr->gso_type == VIRTIO_NET_HDR_GSO_UDP_L4)
		236	hdr_len += sizeof(struct udphdr);
		237	else
		238	hdr_len += inner_tcp_hdrlen(skb);
		239
		240	hdr->hdr_len = __cpu_to_virtio16(true, hdr_len);
		241	}
		242
210	static inline int virtio_net_hdr_from_skb(const struct sk_buff *skb,	243	static inline int virtio_net_hdr_from_skb(const struct sk_buff *skb,
211	struct virtio_net_hdr *hdr,	244	struct virtio_net_hdr *hdr,
212	bool little_endian,	245	bool little_endian,
@@ -385,7 +418,8 @@ virtio_net_hdr_tnl_from_skb(const struct sk_buff *skb, · 172 unmodified lines
385	bool tnl_hdr_negotiated,	418	bool tnl_hdr_negotiated,
386	bool little_endian,	419	bool little_endian,
387	int vlan_hlen,	420	int vlan_hlen,
388	bool has_data_valid)	421	bool has_data_valid,
		422	bool feature_hdrlen)
389	{	423	{
390	struct virtio_net_hdr hdr = (struct virtio_net_hdr )vhdr;	424	struct virtio_net_hdr hdr = (struct virtio_net_hdr )vhdr;
391	unsigned int inner_nh, outer_th;	425	unsigned int inner_nh, outer_th;
@@ -394,9 +428,17 @@ virtio_net_hdr_tnl_from_skb(const struct sk_buff *skb, · 2 unmodified lines
394		428
395	tnl_gso_type = skb_shinfo(skb)->gso_type & (SKB_GSO_UDP_TUNNEL \|	429	tnl_gso_type = skb_shinfo(skb)->gso_type & (SKB_GSO_UDP_TUNNEL \|
396	SKB_GSO_UDP_TUNNEL_CSUM);	430	SKB_GSO_UDP_TUNNEL_CSUM);
397	if (!tnl_gso_type)	431	if (!tnl_gso_type) {
398	return virtio_net_hdr_from_skb(skb, hdr, little_endian,	432	ret = virtio_net_hdr_from_skb(skb, hdr, little_endian,
399	has_data_valid, vlan_hlen);	433	has_data_valid, vlan_hlen);
		434	if (ret)
		435	return ret;
		436
		437	if (feature_hdrlen && hdr->hdr_len)
		438	__virtio_net_set_hdrlen(skb, hdr, little_endian);
		439
		440	return ret;
		441	}
400		442
401	/* Tunnel support not negotiated but skb ask for it. */	443	/* Tunnel support not negotiated but skb ask for it. */
402	if (!tnl_hdr_negotiated)	444	if (!tnl_hdr_negotiated)
@@ -414,6 +456,9 @@ virtio_net_hdr_tnl_from_skb(const struct sk_buff *skb, · 11 unmodified lines
414	if (ret)	456	if (ret)
415	return ret;	457	return ret;
416		458
		459	if (feature_hdrlen && hdr->hdr_len)
		460	__virtio_net_set_tnl_hdrlen(skb, hdr);
		461
417	if (skb->protocol == htons(ETH_P_IPV6))	462	if (skb->protocol == htons(ETH_P_IPV6))
418	hdr->gso_type \|= VIRTIO_NET_HDR_GSO_UDP_TUNNEL_IPV6;	463	hdr->gso_type \|= VIRTIO_NET_HDR_GSO_UDP_TUNNEL_IPV6;
419	else	464	else

include/net/bluetooth/l2cap.h+1−0

@@ -658,6 +658,7 @@ struct l2cap_conn { · 657 unmodified lines
658	struct sk_buff *rx_skb;	658	struct sk_buff *rx_skb;
659	__u32 rx_len;	659	__u32 rx_len;
660	struct ida tx_ida;	660	struct ida tx_ida;
		661	__u8 tx_ident;
661		662
662	struct sk_buff_head pending_rx;	663	struct sk_buff_head pending_rx;
663	struct work_struct pending_rx_work;	664	struct work_struct pending_rx_work;

include/net/codel_impl.h+1−0

@@ -158,6 +158,7 @@ static struct sk_buff codel_dequeue(void ctx, · 157 unmodified lines
158	bool drop;	158	bool drop;
159		159
160	if (!skb) {	160	if (!skb) {
		161	vars->first_above_time = 0;
161	vars->dropping = false;	162	vars->dropping = false;
162	return skb;	163	return skb;
163	}	164	}

include/net/inet_hashtables.h+14−0

@@ -264,6 +264,20 @@ inet_bhashfn_portaddr(const struct inet_hashinfo hinfo, const struct sock sk, · 263 unmodified lines
264	return &hinfo->bhash2[hash & (hinfo->bhash_size - 1)];	264	return &hinfo->bhash2[hash & (hinfo->bhash_size - 1)];
265	}	265	}
266		266
		267	static inline bool inet_use_hash2_on_bind(const struct sock *sk)
		268	{
		269	#if IS_ENABLED(CONFIG_IPV6)
		270	if (sk->sk_family == AF_INET6) {
		271	if (ipv6_addr_any(&sk->sk_v6_rcv_saddr))
		272	return false;
		273
		274	if (!ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr))
		275	return true;
		276	}
		277	#endif
		278	return sk->sk_rcv_saddr != htonl(INADDR_ANY);
		279	}
		280
267	struct inet_bind_hashbucket *	281	struct inet_bind_hashbucket *
268	inet_bhash2_addr_any_hashbucket(const struct sock sk, const struct net net, int port);	282	inet_bhash2_addr_any_hashbucket(const struct sock sk, const struct net net, int port);
269		283

include/net/ip6_fib.h+20−1

@@ -507,12 +507,14 @@ void fib6_rt_update(struct net net, struct fib6_info rt, · 506 unmodified lines
507	void inet6_rt_notify(int event, struct fib6_info rt, struct nl_info info,	507	void inet6_rt_notify(int event, struct fib6_info rt, struct nl_info info,
508	unsigned int flags);	508	unsigned int flags);
509		509
		510	void fib6_age_exceptions(struct fib6_info rt, struct fib6_gc_args gc_args,
		511	unsigned long now);
510	void fib6_run_gc(unsigned long expires, struct net *net, bool force);	512	void fib6_run_gc(unsigned long expires, struct net *net, bool force);
511
512	void fib6_gc_cleanup(void);	513	void fib6_gc_cleanup(void);
513		514
514	int fib6_init(void);	515	int fib6_init(void);
515		516
		517	#if IS_ENABLED(CONFIG_IPV6)
516	/* Add the route to the gc list if it is not already there	518	/* Add the route to the gc list if it is not already there
517	*	519	*
518	* The callers should hold f6i->fib6_table->tb6_lock.	520	* The callers should hold f6i->fib6_table->tb6_lock.
@@ -545,6 +547,23 @@ static inline void fib6_remove_gc_list(struct fib6_info *f6i) · 26 unmodified lines
545	hlist_del_init(&f6i->gc_link);	547	hlist_del_init(&f6i->gc_link);
546	}	548	}
547		549
		550	static inline void fib6_may_remove_gc_list(struct net *net,
		551	struct fib6_info *f6i)
		552	{
		553	struct fib6_gc_args gc_args;
		554
		555	if (hlist_unhashed(&f6i->gc_link))
		556	return;
		557
		558	gc_args.timeout = READ_ONCE(net->ipv6.sysctl.ip6_rt_gc_interval);
		559	gc_args.more = 0;
		560
		561	rcu_read_lock();
		562	fib6_age_exceptions(f6i, &gc_args, jiffies);
		563	rcu_read_unlock();
		564	}
		565	#endif
		566
548	struct ipv6_route_iter {	567	struct ipv6_route_iter {
549	struct seq_net_private p;	568	struct seq_net_private p;
550	struct fib6_walker w;	569	struct fib6_walker w;

include/net/netfilter/nf_conntrack_core.h+5−0

@@ -83,6 +83,11 @@ void nf_conntrack_lock(spinlock_t *lock); · 82 unmodified lines
83		83
84	extern spinlock_t nf_conntrack_expect_lock;	84	extern spinlock_t nf_conntrack_expect_lock;
85		85
		86	static inline void lockdep_nfct_expect_lock_held(void)
		87	{
		88	lockdep_assert_held(&nf_conntrack_expect_lock);
		89	}
		90
86	/* ctnetlink code shared by both ctnetlink and nf_conntrack_bpf */	91	/* ctnetlink code shared by both ctnetlink and nf_conntrack_bpf */
87		92
88	static inline void __nf_ct_set_timeout(struct nf_conn *ct, u64 timeout)	93	static inline void __nf_ct_set_timeout(struct nf_conn *ct, u64 timeout)

include/net/netfilter/nf_conntrack_expect.h+18−2

 	/* Hash member */
 	struct hlist_node hnode;
+	/* Network namespace */
+	possible_net_t net;
 	/* We expect this tuple, with the following mask */
 	struct nf_conntrack_tuple tuple;
 	struct nf_conntrack_tuple_mask mask;
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+	struct nf_conntrack_zone zone;
+#endif
 	/* Usage count. */
 	refcount_t use;
 			 struct nf_conntrack_expect *this);
 	/* Helper to assign to new connection */
-	struct nf_conntrack_helper *helper;
+	struct nf_conntrack_helper __rcu *helper;
 	/* The conntrack of the master connection */
 	struct nf_conn *master;
 static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp)
 {
-	return nf_ct_net(exp->master);
+	return read_pnet(&exp->net);
+}
+static inline bool nf_ct_exp_zone_equal_any(const struct nf_conntrack_expect *a,
+					    const struct nf_conntrack_zone *b)
+{
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+	return a->zone.id == b->id;
+#else
+	return true;
+#endif
 }
 #define NF_CT_EXP_POLICY_NAME_LEN	16

include/net/netns/xfrm.h+1−1

@@ -59,7 +59,7 @@ struct netns_xfrm { · 58 unmodified lines
59	struct list_head inexact_bins;	59	struct list_head inexact_bins;
60		60
61		61
62	struct sock *nlsk;	62	struct sock __rcu *nlsk;
63	struct sock *nlsk_stash;	63	struct sock *nlsk_stash;
64		64
65	u32 sysctl_aevent_etime;	65	u32 sysctl_aevent_etime;

include/sound/sdca_function.h+0−5

  */
 #define SDCA_MAX_ENTITY_COUNT 128
-/*
- * Sanity check on number of initialization writes, can be expanded if needed.
- */
-#define SDCA_MAX_INIT_COUNT 2048
 /*
  * The Cluster IDs are 16-bit, so a maximum of 65535 Clusters per
  * function can be represented, however limit this to a slightly

include/trace/events/btrfs.h+7−4

 	),
 	TP_fast_assign(
-		const struct dentry *dentry = file->f_path.dentry;
+		struct dentry *dentry = file_dentry(file);
-		const struct inode *inode = d_inode(dentry);
+		struct inode *inode = file_inode(file);
+		struct dentry *parent = dget_parent(dentry);
+		struct inode *parent_inode = d_inode(parent);
-		TP_fast_assign_fsid(btrfs_sb(file->f_path.dentry->d_sb));
+		dput(parent);
+		TP_fast_assign_fsid(btrfs_sb(inode->i_sb));
 		__entry->ino		= btrfs_ino(BTRFS_I(inode));
-		__entry->parent		= btrfs_ino(BTRFS_I(d_inode(dentry->d_parent)));
+		__entry->parent		= btrfs_ino(BTRFS_I(parent_inode));
 		__entry->datasync	= datasync;
 		__entry->root_objectid	= btrfs_root_id(BTRFS_I(inode)->root);
 	),

include/trace/events/dma.h+3−1

 		{ DMA_ATTR_ALLOC_SINGLE_PAGES, "ALLOC_SINGLE_PAGES" }, \
 		{ DMA_ATTR_NO_WARN, "NO_WARN" }, \
 		{ DMA_ATTR_PRIVILEGED, "PRIVILEGED" }, \
-		{ DMA_ATTR_MMIO, "MMIO" })
+		{ DMA_ATTR_MMIO, "MMIO" }, \
+		{ DMA_ATTR_DEBUGGING_IGNORE_CACHELINES, "CACHELINES_OVERLAP" }, \
+		{ DMA_ATTR_REQUIRE_COHERENT, "REQUIRE_COHERENT" })
 DECLARE_EVENT_CLASS(dma_map,
 	TP_PROTO(struct device *dev, phys_addr_t phys_addr, dma_addr_t dma_addr,

include/trace/events/netfs.h+4−4

@@ -740,19 +740,19 @@ TRACE_EVENT(netfs_collect_stream, · 739 unmodified lines
740	__field(unsigned int, wreq)	740	__field(unsigned int, wreq)
741	__field(unsigned char, stream)	741	__field(unsigned char, stream)
742	__field(unsigned long long, collected_to)	742	__field(unsigned long long, collected_to)
743	__field(unsigned long long, front)	743	__field(unsigned long long, issued_to)
744	),	744	),
745		745
746	TP_fast_assign(	746	TP_fast_assign(
747	__entry->wreq = wreq->debug_id;	747	__entry->wreq = wreq->debug_id;
748	__entry->stream = stream->stream_nr;	748	__entry->stream = stream->stream_nr;
749	__entry->collected_to = stream->collected_to;	749	__entry->collected_to = stream->collected_to;
750	__entry->front = stream->front ? stream->front->start : UINT_MAX;	750	__entry->issued_to = atomic64_read(&wreq->issued_to);
751	),	751	),
752		752
753	TP_printk("R=%08x[%x:] cto=%llx frn=%llx",	753	TP_printk("R=%08x[%x:] cto=%llx ito=%llx",
754	__entry->wreq, __entry->stream,	754	__entry->wreq, __entry->stream,
755	__entry->collected_to, __entry->front)	755	__entry->collected_to, __entry->issued_to)
756	);	756	);
757		757
758	TRACE_EVENT(netfs_folioq,	758	TRACE_EVENT(netfs_folioq,

include/uapi/linux/netfilter/nf_conntrack_common.h+4−0

@@ -159,5 +159,9 @@ enum ip_conntrack_expect_events { · 158 unmodified lines
159	#define NF_CT_EXPECT_INACTIVE 0x2	159	#define NF_CT_EXPECT_INACTIVE 0x2
160	#define NF_CT_EXPECT_USERSPACE 0x4	160	#define NF_CT_EXPECT_USERSPACE 0x4
161		161
		162	#ifdef __KERNEL__
		163	#define NF_CT_EXPECT_MASK (NF_CT_EXPECT_PERMANENT \| NF_CT_EXPECT_INACTIVE \| \
		164	NF_CT_EXPECT_USERSPACE)
		165	#endif
162		166
163	#endif /* _UAPI_NF_CONNTRACK_COMMON_H */	167	#endif /* _UAPI_NF_CONNTRACK_COMMON_H */

init/Kconfig+1−1

@@ -146,7 +146,7 @@ config CC_HAS_COUNTED_BY · 145 unmodified lines
146	config CC_HAS_COUNTED_BY_PTR	146	config CC_HAS_COUNTED_BY_PTR
147	bool	147	bool
148	# supported since clang 22	148	# supported since clang 22
149	default y if CC_IS_CLANG && CLANG_VERSION >= 220000	149	default y if CC_IS_CLANG && CLANG_VERSION >= 220100
150	# supported since gcc 16.0.0	150	# supported since gcc 16.0.0
151	default y if CC_IS_GCC && GCC_VERSION >= 160000	151	default y if CC_IS_GCC && GCC_VERSION >= 160000
152		152

io_uring/fdinfo.c+3−1

 					sq_idx);
 				break;
 			}
-			if ((++sq_head & sq_mask) == 0) {
+			if (sq_idx == sq_mask) {
 				seq_printf(m,
 					"%5u: corrupted sqe, wrapping 128B entry\n",
 					sq_idx);
 				break;
 			}
+			sq_head++;
+			i++;
 			sqe128 = true;
 		}
 		seq_printf(m, "%5u: opcode:%s, fd:%d, flags:%x, off:%llu, "

kernel/dma/debug.c+5−4

 	return overlap;
 }
-static void active_cacheline_inc_overlap(phys_addr_t cln)
+static void active_cacheline_inc_overlap(phys_addr_t cln, bool is_cache_clean)
 {
 	int overlap = active_cacheline_read_overlap(cln);
 	/* If we overflowed the overlap counter then we're potentially
 	 * leaking dma-mappings.
 	 */
-	WARN_ONCE(overlap > ACTIVE_CACHELINE_MAX_OVERLAP,
+	WARN_ONCE(!is_cache_clean && overlap > ACTIVE_CACHELINE_MAX_OVERLAP,
 		  pr_fmt("exceeded %d overlapping mappings of cacheline %pa\n"),
 		  ACTIVE_CACHELINE_MAX_OVERLAP, &cln);
 }
 	if (rc == -EEXIST) {
 		struct dma_debug_entry *existing;
-		active_cacheline_inc_overlap(cln);
+		active_cacheline_inc_overlap(cln, entry->is_cache_clean);
 		existing = radix_tree_lookup(&dma_active_cacheline, cln);
 		/* A lookup failure here after we got -EEXIST is unexpected. */
 		WARN_ON(!existing);
 	unsigned long flags;
 	int rc;
-	entry->is_cache_clean = !!(attrs & DMA_ATTR_CPU_CACHE_CLEAN);
+	entry->is_cache_clean = attrs & (DMA_ATTR_DEBUGGING_IGNORE_CACHELINES |
+					 DMA_ATTR_REQUIRE_COHERENT);
 	bucket = get_hash_bucket(entry, &flags);
 	hash_bucket_add(bucket, entry);

kernel/dma/direct.h+4−3

 	dma_addr_t dma_addr;
 	if (is_swiotlb_force_bounce(dev)) {
-		if (attrs & DMA_ATTR_MMIO)
+		if (attrs & (DMA_ATTR_MMIO | DMA_ATTR_REQUIRE_COHERENT))
 			return DMA_MAPPING_ERROR;
 		return swiotlb_map(dev, phys, size, dir, attrs);
 		dma_addr = phys_to_dma(dev, phys);
 		if (unlikely(!dma_capable(dev, dma_addr, size, true)) ||
 		    dma_kmalloc_needs_bounce(dev, size, dir)) {
-			if (is_swiotlb_active(dev))
+			if (is_swiotlb_active(dev) &&
+			    !(attrs & DMA_ATTR_REQUIRE_COHERENT))
 				return swiotlb_map(dev, phys, size, dir, attrs);
 			goto err_overflow;
 {
 	phys_addr_t phys;
-	if (attrs & DMA_ATTR_MMIO)
+	if (attrs & (DMA_ATTR_MMIO | DMA_ATTR_REQUIRE_COHERENT))
 		/* nothing to do: uncached and no swiotlb */
 		return;

kernel/dma/mapping.c+6−0

 	if (WARN_ON_ONCE(!dev->dma_mask))
 		return DMA_MAPPING_ERROR;
+	if (!dev_is_dma_coherent(dev) && (attrs & DMA_ATTR_REQUIRE_COHERENT))
+		return DMA_MAPPING_ERROR;
 	if (dma_map_direct(dev, ops) ||
 	    (!is_mmio && arch_dma_map_phys_direct(dev, phys + size)))
 		addr = dma_direct_map_phys(dev, phys, size, dir, attrs);
 	BUG_ON(!valid_dma_direction(dir));
+	if (!dev_is_dma_coherent(dev) && (attrs & DMA_ATTR_REQUIRE_COHERENT))
+		return -EOPNOTSUPP;
 	if (WARN_ON_ONCE(!dev->dma_mask))
 		return 0;

kernel/dma/swiotlb.c+19−2

 #include <linux/gfp.h>
 #include <linux/highmem.h>
 #include <linux/io.h>
+#include <linux/kmsan-checks.h>
 #include <linux/iommu-helper.h>
 #include <linux/init.h>
 #include <linux/memblock.h>
 			local_irq_save(flags);
 			page = pfn_to_page(pfn);
-			if (dir == DMA_TO_DEVICE)
+			if (dir == DMA_TO_DEVICE) {
+				/*
+				 * Ideally, kmsan_check_highmem_page()
+				 * could be used here to detect infoleaks,
+				 * but callers may map uninitialized buffers
+				 * that will be written by the device,
+				 * causing false positives.
+				 */
 				memcpy_from_page(vaddr, page, offset, sz);
-			else
+			} else {
+				kmsan_unpoison_memory(vaddr, sz);
 				memcpy_to_page(page, offset, vaddr, sz);
+			}
 			local_irq_restore(flags);
 			size -= sz;
 			offset = 0;
 		}
 	} else if (dir == DMA_TO_DEVICE) {
+		/*
+		 * Ideally, kmsan_check_memory() could be used here to detect
+		 * infoleaks (uninitialized data being sent to device), but
+		 * callers may map uninitialized buffers that will be written
+		 * by the device, causing false positives.
+		 */
 		memcpy(vaddr, phys_to_virt(orig_addr), size);
 	} else {
+		kmsan_unpoison_memory(vaddr, size);
 		memcpy(phys_to_virt(orig_addr), vaddr, size);
 	}
 }

kernel/futex/core.c+1−1

@@ -342,7 +342,7 @@ static int __futex_key_to_node(struct mm_struct *mm, unsigned long addr) · 341 unmodified lines
342	if (!vma)	342	if (!vma)
343	return FUTEX_NO_NODE;	343	return FUTEX_NO_NODE;
344		344
345	mpol = vma_policy(vma);	345	mpol = READ_ONCE(vma->vm_policy);
346	if (!mpol)	346	if (!mpol)
347	return FUTEX_NO_NODE;	347	return FUTEX_NO_NODE;
348		348

kernel/futex/pi.c+2−1

 int futex_lock_pi(u32 __user *uaddr, unsigned int flags, ktime_t *time, int trylock)
 {
 	struct hrtimer_sleeper timeout, *to;
-	struct task_struct *exiting = NULL;
+	struct task_struct *exiting;
 	struct rt_mutex_waiter rt_waiter;
 	struct futex_q q = futex_q_init;
 	DEFINE_WAKE_Q(wake_q);
 	to = futex_setup_timer(time, &timeout, flags, 0);
 retry:
+	exiting = NULL;
 	ret = get_futex_key(uaddr, flags, &q.key, FUTEX_WRITE);
 	if (unlikely(ret != 0))
 		goto out;

kernel/futex/syscalls.c+8−0

@@ -459,6 +459,14 @@ SYSCALL_DEFINE4(futex_requeue, · 458 unmodified lines
459	if (ret)	459	if (ret)
460	return ret;	460	return ret;
461		461
		462	/*
		463	* For now mandate both flags are identical, like the sys_futex()
		464	* interface has. If/when we merge the variable sized futex support,
		465	* that patch can modify this test to allow a difference in size.
		466	*/
		467	if (futexes[0].w.flags != futexes[1].w.flags)
		468	return -EINVAL;
		469
462	cmpval = futexes[0].w.val;	470	cmpval = futexes[0].w.val;
463		471
464	return futex_requeue(u64_to_user_ptr(futexes[0].w.uaddr), futexes[0].w.flags,	472	return futex_requeue(u64_to_user_ptr(futexes[0].w.uaddr), futexes[0].w.flags,

kernel/power/main.c+1−1

@@ -40,7 +40,7 @@ void pm_restore_gfp_mask(void) · 39 unmodified lines
40	{	40	{
41	WARN_ON(!mutex_is_locked(&system_transition_mutex));	41	WARN_ON(!mutex_is_locked(&system_transition_mutex));
42		42
43	if (WARN_ON(!saved_gfp_count) \|\| --saved_gfp_count)	43	if (!saved_gfp_count \|\| --saved_gfp_count)
44	return;	44	return;
45		45
46	gfp_allowed_mask = saved_gfp_mask;	46	gfp_allowed_mask = saved_gfp_mask;

kernel/power/snapshot.c+11−0

@@ -2855,6 +2855,17 @@ int snapshot_write_finalize(struct snapshot_handle *handle) · 2854 unmodified lines
2855	{	2855	{
2856	int error;	2856	int error;
2857		2857
		2858	/*
		2859	* Call snapshot_write_next() to drain any trailing zero pages,
		2860	* but make sure we're in the data page region first.
		2861	* This function can return PAGE_SIZE if the kernel was expecting
		2862	* another copy page. Return -ENODATA in that situation.
		2863	*/
		2864	if (handle->cur > nr_meta_pages + 1) {
		2865	error = snapshot_write_next(handle);
		2866	if (error)
		2867	return error > 0 ? -ENODATA : error;
		2868	}
2858	copy_last_highmem_page();	2869	copy_last_highmem_page();
2859	error = hibernate_restore_protect_page(handle->buffer);	2870	error = hibernate_restore_protect_page(handle->buffer);
2860	/* Do that only if we have loaded the image entirely */	2871	/* Do that only if we have loaded the image entirely */

kernel/rcu/rcu.h+9−0

@@ -502,6 +502,15 @@ do { \ · 501 unmodified lines
502	___locked; \	502	___locked; \
503	})	503	})
504		504
		505	#define raw_spin_trylock_irqsave_rcu_node(p, flags) \
		506	({ \
		507	bool ___locked = raw_spin_trylock_irqsave(&ACCESS_PRIVATE(p, lock), flags); \
		508	\
		509	if (___locked) \
		510	smp_mb__after_unlock_lock(); \
		511	___locked; \
		512	})
		513
505	#define raw_lockdep_assert_held_rcu_node(p) \	514	#define raw_lockdep_assert_held_rcu_node(p) \
506	lockdep_assert_held(&ACCESS_PRIVATE(p, lock))	515	lockdep_assert_held(&ACCESS_PRIVATE(p, lock))
507		516

kernel/rcu/srcutiny.c+18−1

  */
 #include <linux/export.h>
+#include <linux/irq_work.h>
 #include <linux/mutex.h>
 #include <linux/preempt.h>
 #include <linux/rcupdate_wait.h>
 	ssp->srcu_idx_max = 0;
 	INIT_WORK(&ssp->srcu_work, srcu_drive_gp);
 	INIT_LIST_HEAD(&ssp->srcu_work.entry);
+	init_irq_work(&ssp->srcu_irq_work, srcu_tiny_irq_work);
 	return 0;
 }
 void cleanup_srcu_struct(struct srcu_struct *ssp)
 {
 	WARN_ON(ssp->srcu_lock_nesting[0] || ssp->srcu_lock_nesting[1]);
+	irq_work_sync(&ssp->srcu_irq_work);
 	flush_work(&ssp->srcu_work);
 	WARN_ON(ssp->srcu_gp_running);
 	WARN_ON(ssp->srcu_gp_waiting);
 }
 EXPORT_SYMBOL_GPL(srcu_drive_gp);
+/*
+ * Use an irq_work to defer schedule_work() to avoid acquiring the workqueue
+ * pool->lock while the caller might hold scheduler locks, causing lockdep
+ * splats due to workqueue_init() doing a wakeup.
+ */
+void srcu_tiny_irq_work(struct irq_work *irq_work)
+{
+	struct srcu_struct *ssp;
+	ssp = container_of(irq_work, struct srcu_struct, srcu_irq_work);
+	schedule_work(&ssp->srcu_work);
+}
+EXPORT_SYMBOL_GPL(srcu_tiny_irq_work);
 static void srcu_gp_start_if_needed(struct srcu_struct *ssp)
 {
 	unsigned long cookie;
 	WRITE_ONCE(ssp->srcu_idx_max, cookie);
 	if (!READ_ONCE(ssp->srcu_gp_running)) {
 		if (likely(srcu_init_done))
-			schedule_work(&ssp->srcu_work);
+			irq_work_queue(&ssp->srcu_irq_work);
 		else if (list_empty(&ssp->srcu_work.entry))
 			list_add(&ssp->srcu_work.entry, &srcu_boot_list);
 	}

kernel/rcu/srcutree.c+102−109

 #include <linux/mutex.h>
 #include <linux/percpu.h>
 #include <linux/preempt.h>
+#include <linux/irq_work.h>
 #include <linux/rcupdate_wait.h>
 #include <linux/sched.h>
 #include <linux/smp.h>
 static void srcu_invoke_callbacks(struct work_struct *work);
 static void srcu_reschedule(struct srcu_struct *ssp, unsigned long delay);
 static void process_srcu(struct work_struct *work);
+static void srcu_irq_work(struct irq_work *work);
 static void srcu_delay_timer(struct timer_list *t);
-/* Wrappers for lock acquisition and release, see raw_spin_lock_rcu_node(). */
-#define spin_lock_rcu_node(p)							\
-do {										\
-	spin_lock(&ACCESS_PRIVATE(p, lock));					\
-	smp_mb__after_unlock_lock();						\
-} while (0)
-#define spin_unlock_rcu_node(p) spin_unlock(&ACCESS_PRIVATE(p, lock))
-#define spin_lock_irq_rcu_node(p)						\
-do {										\
-	spin_lock_irq(&ACCESS_PRIVATE(p, lock));				\
-	smp_mb__after_unlock_lock();						\
-} while (0)
-#define spin_unlock_irq_rcu_node(p)						\
-	spin_unlock_irq(&ACCESS_PRIVATE(p, lock))
-#define spin_lock_irqsave_rcu_node(p, flags)					\
-do {										\
-	spin_lock_irqsave(&ACCESS_PRIVATE(p, lock), flags);			\
-	smp_mb__after_unlock_lock();						\
-} while (0)
-#define spin_trylock_irqsave_rcu_node(p, flags)					\
-({										\
-	bool ___locked = spin_trylock_irqsave(&ACCESS_PRIVATE(p, lock), flags); \
-										\
-	if (___locked)								\
-		smp_mb__after_unlock_lock();					\
-	___locked;								\
-})
-#define spin_unlock_irqrestore_rcu_node(p, flags)				\
-	spin_unlock_irqrestore(&ACCESS_PRIVATE(p, lock), flags)			\
 /*
  * Initialize SRCU per-CPU data.  Note that statically allocated
  * srcu_struct structures might already have srcu_read_lock() and
 	 */
 	for_each_possible_cpu(cpu) {
 		sdp = per_cpu_ptr(ssp->sda, cpu);
-		spin_lock_init(&ACCESS_PRIVATE(sdp, lock));
+		raw_spin_lock_init(&ACCESS_PRIVATE(sdp, lock));
 		rcu_segcblist_init(&sdp->srcu_cblist);
 		sdp->srcu_cblist_invoking = false;
 		sdp->srcu_gp_seq_needed = ssp->srcu_sup->srcu_gp_seq;
 	/* Each pass through this loop initializes one srcu_node structure. */
 	srcu_for_each_node_breadth_first(ssp, snp) {
-		spin_lock_init(&ACCESS_PRIVATE(snp, lock));
+		raw_spin_lock_init(&ACCESS_PRIVATE(snp, lock));
 		BUILD_BUG_ON(ARRAY_SIZE(snp->srcu_have_cbs) !=
 			     ARRAY_SIZE(snp->srcu_data_have_cbs));
 		for (i = 0; i < ARRAY_SIZE(snp->srcu_have_cbs); i++) {
 	if (!ssp->srcu_sup)
 		return -ENOMEM;
 	if (!is_static)
-		spin_lock_init(&ACCESS_PRIVATE(ssp->srcu_sup, lock));
+		raw_spin_lock_init(&ACCESS_PRIVATE(ssp->srcu_sup, lock));
 	ssp->srcu_sup->srcu_size_state = SRCU_SIZE_SMALL;
 	ssp->srcu_sup->node = NULL;
 	mutex_init(&ssp->srcu_sup->srcu_cb_mutex);
 	mutex_init(&ssp->srcu_sup->srcu_barrier_mutex);
 	atomic_set(&ssp->srcu_sup->srcu_barrier_cpu_cnt, 0);
 	INIT_DELAYED_WORK(&ssp->srcu_sup->work, process_srcu);
+	init_irq_work(&ssp->srcu_sup->irq_work, srcu_irq_work);
 	ssp->srcu_sup->sda_is_static = is_static;
 	if (!is_static) {
 		ssp->sda = alloc_percpu(struct srcu_data);
 	ssp->srcu_sup->srcu_gp_seq_needed_exp = SRCU_GP_SEQ_INITIAL_VAL;
 	ssp->srcu_sup->srcu_last_gp_end = ktime_get_mono_fast_ns();
 	if (READ_ONCE(ssp->srcu_sup->srcu_size_state) == SRCU_SIZE_SMALL && SRCU_SIZING_IS_INIT()) {
-		if (!init_srcu_struct_nodes(ssp, is_static ? GFP_ATOMIC : GFP_KERNEL))
+		if (!preemptible())
+			WRITE_ONCE(ssp->srcu_sup->srcu_size_state, SRCU_SIZE_ALLOC);
+		else if (init_srcu_struct_nodes(ssp, GFP_KERNEL))
+			WRITE_ONCE(ssp->srcu_sup->srcu_size_state, SRCU_SIZE_BIG);
+		else
 			goto err_free_sda;
-		WRITE_ONCE(ssp->srcu_sup->srcu_size_state, SRCU_SIZE_BIG);
 	}
 	ssp->srcu_sup->srcu_ssp = ssp;
 	smp_store_release(&ssp->srcu_sup->srcu_gp_seq_needed,
 	/* Double-checked locking on ->srcu_size-state. */
 	if (smp_load_acquire(&ssp->srcu_sup->srcu_size_state) != SRCU_SIZE_SMALL)
 		return;
-	spin_lock_irqsave_rcu_node(ssp->srcu_sup, flags);
+	raw_spin_lock_irqsave_rcu_node(ssp->srcu_sup, flags);
 	if (smp_load_acquire(&ssp->srcu_sup->srcu_size_state) != SRCU_SIZE_SMALL) {
-		spin_unlock_irqrestore_rcu_node(ssp->srcu_sup, flags);
+		raw_spin_unlock_irqrestore_rcu_node(ssp->srcu_sup, flags);
 		return;
 	}
 	__srcu_transition_to_big(ssp);
-	spin_unlock_irqrestore_rcu_node(ssp->srcu_sup, flags);
+	raw_spin_unlock_irqrestore_rcu_node(ssp->srcu_sup, flags);
 }
 /*
  * Check to see if the just-encountered contention event justifies
  * a transition to SRCU_SIZE_BIG.
  */
-static void spin_lock_irqsave_check_contention(struct srcu_struct *ssp)
+static void raw_spin_lock_irqsave_check_contention(struct srcu_struct *ssp)
 {
 	unsigned long j;
  * to SRCU_SIZE_BIG.  But only if the srcutree.convert_to_big module
  * parameter permits this.
  */
-static void spin_lock_irqsave_sdp_contention(struct srcu_data *sdp, unsigned long *flags)
+static void raw_spin_lock_irqsave_sdp_contention(struct srcu_data *sdp, unsigned long *flags)
 {
 	struct srcu_struct *ssp = sdp->ssp;
-	if (spin_trylock_irqsave_rcu_node(sdp, *flags))
+	if (raw_spin_trylock_irqsave_rcu_node(sdp, *flags))
 		return;
-	spin_lock_irqsave_rcu_node(ssp->srcu_sup, *flags);
+	raw_spin_lock_irqsave_rcu_node(ssp->srcu_sup, *flags);
-	spin_lock_irqsave_check_contention(ssp);
+	raw_spin_lock_irqsave_check_contention(ssp);
-	spin_unlock_irqrestore_rcu_node(ssp->srcu_sup, *flags);
+	raw_spin_unlock_irqrestore_rcu_node(ssp->srcu_sup, *flags);
-	spin_lock_irqsave_rcu_node(sdp, *flags);
+	raw_spin_lock_irqsave_rcu_node(sdp, *flags);
 }
 /*
  * to SRCU_SIZE_BIG.  But only if the srcutree.convert_to_big module
  * parameter permits this.
  */
-static void spin_lock_irqsave_ssp_contention(struct srcu_struct *ssp, unsigned long *flags)
+static void raw_spin_lock_irqsave_ssp_contention(struct srcu_struct *ssp, unsigned long *flags)
 {
-	if (spin_trylock_irqsave_rcu_node(ssp->srcu_sup, *flags))
+	if (raw_spin_trylock_irqsave_rcu_node(ssp->srcu_sup, *flags))
 		return;
-	spin_lock_irqsave_rcu_node(ssp->srcu_sup, *flags);
+	raw_spin_lock_irqsave_rcu_node(ssp->srcu_sup, *flags);
-	spin_lock_irqsave_check_contention(ssp);
+	raw_spin_lock_irqsave_check_contention(ssp);
 }
 /*
 	/* The smp_load_acquire() pairs with the smp_store_release(). */
 	if (!rcu_seq_state(smp_load_acquire(&ssp->srcu_sup->srcu_gp_seq_needed))) /*^^^*/
 		return; /* Already initialized. */
-	spin_lock_irqsave_rcu_node(ssp->srcu_sup, flags);
+	raw_spin_lock_irqsave_rcu_node(ssp->srcu_sup, flags);
 	if (!rcu_seq_state(ssp->srcu_sup->srcu_gp_seq_needed)) {
-		spin_unlock_irqrestore_rcu_node(ssp->srcu_sup, flags);
+		raw_spin_unlock_irqrestore_rcu_node(ssp->srcu_sup, flags);
 		return;
 	}
 	init_srcu_struct_fields(ssp, true);
-	spin_unlock_irqrestore_rcu_node(ssp->srcu_sup, flags);
+	raw_spin_unlock_irqrestore_rcu_node(ssp->srcu_sup, flags);
 }
 /*
 	unsigned long delay;
 	struct srcu_usage *sup = ssp->srcu_sup;
-	spin_lock_irq_rcu_node(ssp->srcu_sup);
+	raw_spin_lock_irq_rcu_node(ssp->srcu_sup);
 	delay = srcu_get_delay(ssp);
-	spin_unlock_irq_rcu_node(ssp->srcu_sup);
+	raw_spin_unlock_irq_rcu_node(ssp->srcu_sup);
 	if (WARN_ON(!delay))
 		return; /* Just leak it! */
 	if (WARN_ON(srcu_readers_active(ssp)))
 		return; /* Just leak it! */
+	/* Wait for irq_work to finish first as it may queue a new work. */
+	irq_work_sync(&sup->irq_work);
 	flush_delayed_work(&sup->work);
 	for_each_possible_cpu(cpu) {
 		struct srcu_data *sdp = per_cpu_ptr(ssp->sda, cpu);
 	mutex_lock(&sup->srcu_cb_mutex);
 	/* End the current grace period. */
-	spin_lock_irq_rcu_node(sup);
+	raw_spin_lock_irq_rcu_node(sup);
 	idx = rcu_seq_state(sup->srcu_gp_seq);
 	WARN_ON_ONCE(idx != SRCU_STATE_SCAN2);
 	if (srcu_gp_is_expedited(ssp))
 	gpseq = rcu_seq_current(&sup->srcu_gp_seq);
 	if (ULONG_CMP_LT(sup->srcu_gp_seq_needed_exp, gpseq))
 		WRITE_ONCE(sup->srcu_gp_seq_needed_exp, gpseq);
-	spin_unlock_irq_rcu_node(sup);
+	raw_spin_unlock_irq_rcu_node(sup);
 	mutex_unlock(&sup->srcu_gp_mutex);
 	/* A new grace period can start at this point.  But only one. */
 	} else {
 		idx = rcu_seq_ctr(gpseq) % ARRAY_SIZE(snp->srcu_have_cbs);
 		srcu_for_each_node_breadth_first(ssp, snp) {
-			spin_lock_irq_rcu_node(snp);
+			raw_spin_lock_irq_rcu_node(snp);
 			cbs = false;
 			last_lvl = snp >= sup->level[rcu_num_lvls - 1];
 			if (last_lvl)
 			else
 				mask = snp->srcu_data_have_cbs[idx];
 			snp->srcu_data_have_cbs[idx] = 0;
-			spin_unlock_irq_rcu_node(snp);
+			raw_spin_unlock_irq_rcu_node(snp);
 			if (cbs)
 				srcu_schedule_cbs_snp(ssp, snp, mask, cbdelay);
 		}
 	if (!(gpseq & counter_wrap_check))
 		for_each_possible_cpu(cpu) {
 			sdp = per_cpu_ptr(ssp->sda, cpu);
-			spin_lock_irq_rcu_node(sdp);
+			raw_spin_lock_irq_rcu_node(sdp);
 			if (ULONG_CMP_GE(gpseq, sdp->srcu_gp_seq_needed + 100))
 				sdp->srcu_gp_seq_needed = gpseq;
 			if (ULONG_CMP_GE(gpseq, sdp->srcu_gp_seq_needed_exp + 100))
 				sdp->srcu_gp_seq_needed_exp = gpseq;
-			spin_unlock_irq_rcu_node(sdp);
+			raw_spin_unlock_irq_rcu_node(sdp);
 		}
 	/* Callback initiation done, allow grace periods after next. */
 	mutex_unlock(&sup->srcu_cb_mutex);
 	/* Start a new grace period if needed. */
-	spin_lock_irq_rcu_node(sup);
+	raw_spin_lock_irq_rcu_node(sup);
 	gpseq = rcu_seq_current(&sup->srcu_gp_seq);
 	if (!rcu_seq_state(gpseq) &&
 	    ULONG_CMP_LT(gpseq, sup->srcu_gp_seq_needed)) {
 		srcu_gp_start(ssp);
-		spin_unlock_irq_rcu_node(sup);
+		raw_spin_unlock_irq_rcu_node(sup);
 		srcu_reschedule(ssp, 0);
 	} else {
-		spin_unlock_irq_rcu_node(sup);
+		raw_spin_unlock_irq_rcu_node(sup);
 	}
 	/* Transition to big if needed. */
 			if (WARN_ON_ONCE(rcu_seq_done(&ssp->srcu_sup->srcu_gp_seq, s)) ||
 			    (!srcu_invl_snp_seq(sgsne) && ULONG_CMP_GE(sgsne, s)))
 				return;
-			spin_lock_irqsave_rcu_node(snp, flags);
+			raw_spin_lock_irqsave_rcu_node(snp, flags);
 			sgsne = snp->srcu_gp_seq_needed_exp;
 			if (!srcu_invl_snp_seq(sgsne) && ULONG_CMP_GE(sgsne, s)) {
-				spin_unlock_irqrestore_rcu_node(snp, flags);
+				raw_spin_unlock_irqrestore_rcu_node(snp, flags);
 				return;
 			}
 			WRITE_ONCE(snp->srcu_gp_seq_needed_exp, s);
-			spin_unlock_irqrestore_rcu_node(snp, flags);
+			raw_spin_unlock_irqrestore_rcu_node(snp, flags);
 		}
-	spin_lock_irqsave_ssp_contention(ssp, &flags);
+	raw_spin_lock_irqsave_ssp_contention(ssp, &flags);
 	if (ULONG_CMP_LT(ssp->srcu_sup->srcu_gp_seq_needed_exp, s))
 		WRITE_ONCE(ssp->srcu_sup->srcu_gp_seq_needed_exp, s);
-	spin_unlock_irqrestore_rcu_node(ssp->srcu_sup, flags);
+	raw_spin_unlock_irqrestore_rcu_node(ssp->srcu_sup, flags);
 }
 /*
 		for (snp = snp_leaf; snp != NULL; snp = snp->srcu_parent) {
 			if (WARN_ON_ONCE(rcu_seq_done(&sup->srcu_gp_seq, s)) && snp != snp_leaf)
 				return; /* GP already done and CBs recorded. */
-			spin_lock_irqsave_rcu_node(snp, flags);
+			raw_spin_lock_irqsave_rcu_node(snp, flags);
 			snp_seq = snp->srcu_have_cbs[idx];
 			if (!srcu_invl_snp_seq(snp_seq) && ULONG_CMP_GE(snp_seq, s)) {
 				if (snp == snp_leaf && snp_seq == s)
 					snp->srcu_data_have_cbs[idx] |= sdp->grpmask;
-				spin_unlock_irqrestore_rcu_node(snp, flags);
+				raw_spin_unlock_irqrestore_rcu_node(snp, flags);
 				if (snp == snp_leaf && snp_seq != s) {
 					srcu_schedule_cbs_sdp(sdp, do_norm ? SRCU_INTERVAL : 0);
 					return;
 			sgsne = snp->srcu_gp_seq_needed_exp;
 			if (!do_norm && (srcu_invl_snp_seq(sgsne) || ULONG_CMP_LT(sgsne, s)))
 				WRITE_ONCE(snp->srcu_gp_seq_needed_exp, s);
-			spin_unlock_irqrestore_rcu_node(snp, flags);
+			raw_spin_unlock_irqrestore_rcu_node(snp, flags);
 		}
 	/* Top of tree, must ensure the grace period will be started. */
-	spin_lock_irqsave_ssp_contention(ssp, &flags);
+	raw_spin_lock_irqsave_ssp_contention(ssp, &flags);
 	if (ULONG_CMP_LT(sup->srcu_gp_seq_needed, s)) {
 		/*
 		 * Record need for grace period s.  Pair with load
 		// it isn't.  And it does not have to be.  After all, it
 		// can only be executed during early boot when there is only
 		// the one boot CPU running with interrupts still disabled.
+		//
+		// Use an irq_work here to avoid acquiring runqueue lock with
+		// srcu rcu_node::lock held. BPF instrument could introduce the
+		// opposite dependency, hence we need to break the possible
+		// locking dependency here.
 		if (likely(srcu_init_done))
-			queue_delayed_work(rcu_gp_wq, &sup->work,
+			irq_work_queue(&sup->irq_work);
-					   !!srcu_get_delay(ssp));
 		else if (list_empty(&sup->work.work.entry))
 			list_add(&sup->work.work.entry, &srcu_boot_list);
 	}
-	spin_unlock_irqrestore_rcu_node(sup, flags);
+	raw_spin_unlock_irqrestore_rcu_node(sup, flags);
 }
 /*
 {
 	unsigned long curdelay;
-	spin_lock_irq_rcu_node(ssp->srcu_sup);
+	raw_spin_lock_irq_rcu_node(ssp->srcu_sup);
 	curdelay = !srcu_get_delay(ssp);
-	spin_unlock_irq_rcu_node(ssp->srcu_sup);
+	raw_spin_unlock_irq_rcu_node(ssp->srcu_sup);
 	for (;;) {
 		if (srcu_readers_active_idx_check(ssp, idx))
 		return false;
 	/* If the local srcu_data structure has callbacks, not idle.  */
 	sdp = raw_cpu_ptr(ssp->sda);
-	spin_lock_irqsave_rcu_node(sdp, flags);
+	raw_spin_lock_irqsave_rcu_node(sdp, flags);
 	if (rcu_segcblist_pend_cbs(&sdp->srcu_cblist)) {
-		spin_unlock_irqrestore_rcu_node(sdp, flags);
+		raw_spin_unlock_irqrestore_rcu_node(sdp, flags);
 		return false; /* Callbacks already present, so not idle. */
 	}
-	spin_unlock_irqrestore_rcu_node(sdp, flags);
+	raw_spin_unlock_irqrestore_rcu_node(sdp, flags);
 	/*
 	 * No local callbacks, so probabilistically probe global state.
 		sdp = per_cpu_ptr(ssp->sda, get_boot_cpu_id());
 	else
 		sdp = raw_cpu_ptr(ssp->sda);
-	spin_lock_irqsave_sdp_contention(sdp, &flags);
+	raw_spin_lock_irqsave_sdp_contention(sdp, &flags);
 	if (rhp)
 		rcu_segcblist_enqueue(&sdp->srcu_cblist, rhp);
 	/*
 		sdp->srcu_gp_seq_needed_exp = s;
 		needexp = true;
 	}
-	spin_unlock_irqrestore_rcu_node(sdp, flags);
+	raw_spin_unlock_irqrestore_rcu_node(sdp, flags);
 	/* Ensure that snp node tree is fully initialized before traversing it */
 	if (ss_state < SRCU_SIZE_WAIT_BARRIER)
 	/*
 	 * Make sure that later code is ordered after the SRCU grace
-	 * period.  This pairs with the spin_lock_irq_rcu_node()
+	 * period.  This pairs with the raw_spin_lock_irq_rcu_node()
 	 * in srcu_invoke_callbacks().  Unlike Tree RCU, this is needed
 	 * because the current CPU might have been totally uninvolved with
 	 * (and thus unordered against) that grace period.
  */
 static void srcu_barrier_one_cpu(struct srcu_struct *ssp, struct srcu_data *sdp)
 {
-	spin_lock_irq_rcu_node(sdp);
+	raw_spin_lock_irq_rcu_node(sdp);
 	atomic_inc(&ssp->srcu_sup->srcu_barrier_cpu_cnt);
 	sdp->srcu_barrier_head.func = srcu_barrier_cb;
 	debug_rcu_head_queue(&sdp->srcu_barrier_head);
 		debug_rcu_head_unqueue(&sdp->srcu_barrier_head);
 		atomic_dec(&ssp->srcu_sup->srcu_barrier_cpu_cnt);
 	}
-	spin_unlock_irq_rcu_node(sdp);
+	raw_spin_unlock_irq_rcu_node(sdp);
 }
 /**
 	bool needcb = false;
 	struct srcu_data *sdp = container_of(rhp, struct srcu_data, srcu_ec_head);
-	spin_lock_irqsave_sdp_contention(sdp, &flags);
+	raw_spin_lock_irqsave_sdp_contention(sdp, &flags);
 	if (sdp->srcu_ec_state == SRCU_EC_IDLE) {
 		WARN_ON_ONCE(1);
 	} else if (sdp->srcu_ec_state == SRCU_EC_PENDING) {
 		sdp->srcu_ec_state = SRCU_EC_PENDING;
 		needcb = true;
 	}
-	spin_unlock_irqrestore_rcu_node(sdp, flags);
+	raw_spin_unlock_irqrestore_rcu_node(sdp, flags);
 	// If needed, requeue ourselves as an expedited SRCU callback.
 	if (needcb)
 		__call_srcu(sdp->ssp, &sdp->srcu_ec_head, srcu_expedite_current_cb, false);
 	migrate_disable();
 	sdp = this_cpu_ptr(ssp->sda);
-	spin_lock_irqsave_sdp_contention(sdp, &flags);
+	raw_spin_lock_irqsave_sdp_contention(sdp, &flags);
 	if (sdp->srcu_ec_state == SRCU_EC_IDLE) {
 		sdp->srcu_ec_state = SRCU_EC_PENDING;
 		needcb = true;
 	} else {
 		WARN_ON_ONCE(sdp->srcu_ec_state != SRCU_EC_REPOST);
 	}
-	spin_unlock_irqrestore_rcu_node(sdp, flags);
+	raw_spin_unlock_irqrestore_rcu_node(sdp, flags);
 	// If needed, queue an expedited SRCU callback.
 	if (needcb)
 		__call_srcu(ssp, &sdp->srcu_ec_head, srcu_expedite_current_cb, false);
 	 */
 	idx = rcu_seq_state(smp_load_acquire(&ssp->srcu_sup->srcu_gp_seq)); /* ^^^ */
 	if (idx == SRCU_STATE_IDLE) {
-		spin_lock_irq_rcu_node(ssp->srcu_sup);
+		raw_spin_lock_irq_rcu_node(ssp->srcu_sup);
 		if (ULONG_CMP_GE(ssp->srcu_sup->srcu_gp_seq, ssp->srcu_sup->srcu_gp_seq_needed)) {
 			WARN_ON_ONCE(rcu_seq_state(ssp->srcu_sup->srcu_gp_seq));
-			spin_unlock_irq_rcu_node(ssp->srcu_sup);
+			raw_spin_unlock_irq_rcu_node(ssp->srcu_sup);
 			mutex_unlock(&ssp->srcu_sup->srcu_gp_mutex);
 			return;
 		}
 		idx = rcu_seq_state(READ_ONCE(ssp->srcu_sup->srcu_gp_seq));
 		if (idx == SRCU_STATE_IDLE)
 			srcu_gp_start(ssp);
-		spin_unlock_irq_rcu_node(ssp->srcu_sup);
+		raw_spin_unlock_irq_rcu_node(ssp->srcu_sup);
 		if (idx != SRCU_STATE_IDLE) {
 			mutex_unlock(&ssp->srcu_sup->srcu_gp_mutex);
 			return; /* Someone else started the grace period. */
 			return; /* readers present, retry later. */
 		}
 		srcu_flip(ssp);
-		spin_lock_irq_rcu_node(ssp->srcu_sup);
+		raw_spin_lock_irq_rcu_node(ssp->srcu_sup);
 		rcu_seq_set_state(&ssp->srcu_sup->srcu_gp_seq, SRCU_STATE_SCAN2);
 		ssp->srcu_sup->srcu_n_exp_nodelay = 0;
-		spin_unlock_irq_rcu_node(ssp->srcu_sup);
+		raw_spin_unlock_irq_rcu_node(ssp->srcu_sup);
 	}
 	if (rcu_seq_state(READ_ONCE(ssp->srcu_sup->srcu_gp_seq)) == SRCU_STATE_SCAN2) {
 	ssp = sdp->ssp;
 	rcu_cblist_init(&ready_cbs);
-	spin_lock_irq_rcu_node(sdp);
+	raw_spin_lock_irq_rcu_node(sdp);
 	WARN_ON_ONCE(!rcu_segcblist_segempty(&sdp->srcu_cblist, RCU_NEXT_TAIL));
 	rcu_segcblist_advance(&sdp->srcu_cblist,
 			      rcu_seq_current(&ssp->srcu_sup->srcu_gp_seq));
 	 */
 	if (sdp->srcu_cblist_invoking ||
 	    !rcu_segcblist_ready_cbs(&sdp->srcu_cblist)) {
-		spin_unlock_irq_rcu_node(sdp);
+		raw_spin_unlock_irq_rcu_node(sdp);
 		return;  /* Someone else on the job or nothing to do. */
 	}
 	sdp->srcu_cblist_invoking = true;
 	rcu_segcblist_extract_done_cbs(&sdp->srcu_cblist, &ready_cbs);
 	len = ready_cbs.len;
-	spin_unlock_irq_rcu_node(sdp);
+	raw_spin_unlock_irq_rcu_node(sdp);
 	rhp = rcu_cblist_dequeue(&ready_cbs);
 	for (; rhp != NULL; rhp = rcu_cblist_dequeue(&ready_cbs)) {
 		debug_rcu_head_unqueue(rhp);
 	 * Update counts, accelerate new callbacks, and if needed,
 	 * schedule another round of callback invocation.
 	 */
-	spin_lock_irq_rcu_node(sdp);
+	raw_spin_lock_irq_rcu_node(sdp);
 	rcu_segcblist_add_len(&sdp->srcu_cblist, -len);
 	sdp->srcu_cblist_invoking = false;
 	more = rcu_segcblist_ready_cbs(&sdp->srcu_cblist);
-	spin_unlock_irq_rcu_node(sdp);
+	raw_spin_unlock_irq_rcu_node(sdp);
 	/* An SRCU barrier or callbacks from previous nesting work pending */
 	if (more)
 		srcu_schedule_cbs_sdp(sdp, 0);
 {
 	bool pushgp = true;
-	spin_lock_irq_rcu_node(ssp->srcu_sup);
+	raw_spin_lock_irq_rcu_node(ssp->srcu_sup);
 	if (ULONG_CMP_GE(ssp->srcu_sup->srcu_gp_seq, ssp->srcu_sup->srcu_gp_seq_needed)) {
 		if (!WARN_ON_ONCE(rcu_seq_state(ssp->srcu_sup->srcu_gp_seq))) {
 			/* All requests fulfilled, time to go idle. */
 		/* Outstanding request and no GP.  Start one. */
 		srcu_gp_start(ssp);
 	}
-	spin_unlock_irq_rcu_node(ssp->srcu_sup);
+	raw_spin_unlock_irq_rcu_node(ssp->srcu_sup);
 	if (pushgp)
 		queue_delayed_work(rcu_gp_wq, &ssp->srcu_sup->work, delay);
 	ssp = sup->srcu_ssp;
 	srcu_advance_state(ssp);
-	spin_lock_irq_rcu_node(ssp->srcu_sup);
+	raw_spin_lock_irq_rcu_node(ssp->srcu_sup);
 	curdelay = srcu_get_delay(ssp);
-	spin_unlock_irq_rcu_node(ssp->srcu_sup);
+	raw_spin_unlock_irq_rcu_node(ssp->srcu_sup);
 	if (curdelay) {
 		WRITE_ONCE(sup->reschedule_count, 0);
 	} else {
 	srcu_reschedule(ssp, curdelay);
 }
+static void srcu_irq_work(struct irq_work *work)
+{
+	struct srcu_struct *ssp;
+	struct srcu_usage *sup;
+	unsigned long delay;
+	unsigned long flags;
+	sup = container_of(work, struct srcu_usage, irq_work);
+	ssp = sup->srcu_ssp;
+	raw_spin_lock_irqsave_rcu_node(ssp->srcu_sup, flags);
+	delay = srcu_get_delay(ssp);
+	raw_spin_unlock_irqrestore_rcu_node(ssp->srcu_sup, flags);
+	queue_delayed_work(rcu_gp_wq, &sup->work, !!delay);
+}
 void srcutorture_get_gp_data(struct srcu_struct *ssp, int *flags,
 			     unsigned long *gp_seq)
 {

kernel/sysctl.c+1−1

@@ -1118,7 +1118,7 @@ int proc_do_large_bitmap(const struct ctl_table *table, int dir, · 1117 unmodified lines
1118	unsigned long bitmap_len = table->maxlen;	1118	unsigned long bitmap_len = table->maxlen;
1119	unsigned long bitmap = (unsigned long **) table->data;	1119	unsigned long bitmap = (unsigned long **) table->data;
1120	unsigned long *tmp_bitmap = NULL;	1120	unsigned long *tmp_bitmap = NULL;
1121	char tr_a[] = { '-', ',', '\n' }, tr_b[] = { ',', '\n', 0 }, c;	1121	char tr_a[] = { '-', ',', '\n' }, tr_b[] = { ',', '\n', 0 }, c = 0;
1122		1122
1123	if (!bitmap \|\| !bitmap_len \|\| !left \|\| (*ppos && SYSCTL_KERN_TO_USER(dir))) {	1123	if (!bitmap \|\| !bitmap_len \|\| !left \|\| (*ppos && SYSCTL_KERN_TO_USER(dir))) {
1124	*lenp = 0;	1124	*lenp = 0;

kernel/time/alarmtimer.c+1−1

@@ -540,7 +540,7 @@ static s64 alarm_timer_forward(struct k_itimer *timr, ktime_t now) · 539 unmodified lines
540	{	540	{
541	struct alarm *alarm = &timr->it.alarm.alarmtimer;	541	struct alarm *alarm = &timr->it.alarm.alarmtimer;
542		542
543	return alarm_forward(alarm, timr->it_interval, now);	543	return alarm_forward(alarm, now, timr->it_interval);
544	}	544	}
545		545
546	/**	546	/**

kernel/trace/trace_events_trigger.c+66−13

@@ -22,6 +22,39 @@ static struct task_struct *trigger_kthread; · 21 unmodified lines
22	static struct llist_head trigger_data_free_list;	22	static struct llist_head trigger_data_free_list;
23	static DEFINE_MUTEX(trigger_data_kthread_mutex);	23	static DEFINE_MUTEX(trigger_data_kthread_mutex);
24		24
		25	static int trigger_kthread_fn(void *ignore);
		26
		27	static void trigger_create_kthread_locked(void)
		28	{
		29	lockdep_assert_held(&trigger_data_kthread_mutex);
		30
		31	if (!trigger_kthread) {
		32	struct task_struct *kthread;
		33
		34	kthread = kthread_create(trigger_kthread_fn, NULL,
		35	"trigger_data_free");
		36	if (!IS_ERR(kthread))
		37	WRITE_ONCE(trigger_kthread, kthread);
		38	}
		39	}
		40
		41	static void trigger_data_free_queued_locked(void)
		42	{
		43	struct event_trigger_data data, tmp;
		44	struct llist_node *llnodes;
		45
		46	lockdep_assert_held(&trigger_data_kthread_mutex);
		47
		48	llnodes = llist_del_all(&trigger_data_free_list);
		49	if (!llnodes)
		50	return;
		51
		52	tracepoint_synchronize_unregister();
		53
		54	llist_for_each_entry_safe(data, tmp, llnodes, llist)
		55	kfree(data);
		56	}
		57
25	/* Bulk garbage collection of event_trigger_data elements */	58	/* Bulk garbage collection of event_trigger_data elements */
26	static int trigger_kthread_fn(void *ignore)	59	static int trigger_kthread_fn(void *ignore)
27	{	60	{
@@ -56,30 +89,50 @@ void trigger_data_free(struct event_trigger_data *data) · 28 unmodified lines
56	if (data->cmd_ops->set_filter)	89	if (data->cmd_ops->set_filter)
57	data->cmd_ops->set_filter(NULL, data, NULL);	90	data->cmd_ops->set_filter(NULL, data, NULL);
58		91
		92	/*
		93	* Boot-time trigger registration can fail before kthread creation
		94	* works. Keep the deferred-free semantics during boot and let late
		95	* init start the kthread to drain the list.
		96	*/
		97	if (system_state == SYSTEM_BOOTING && !trigger_kthread) {
		98	llist_add(&data->llist, &trigger_data_free_list);
		99	return;
		100	}
		101
59	if (unlikely(!trigger_kthread)) {	102	if (unlikely(!trigger_kthread)) {
60	guard(mutex)(&trigger_data_kthread_mutex);	103	guard(mutex)(&trigger_data_kthread_mutex);
		104
		105	trigger_create_kthread_locked();
61	/* Check again after taking mutex */	106	/* Check again after taking mutex */
62	if (!trigger_kthread) {	107	if (!trigger_kthread) {
63	struct task_struct *kthread;	108	llist_add(&data->llist, &trigger_data_free_list);
64		109	/* Drain the queued frees synchronously if creation failed. */
65	kthread = kthread_create(trigger_kthread_fn, NULL,	110	trigger_data_free_queued_locked();
66	"trigger_data_free");	111	return;
67	if (!IS_ERR(kthread))
68	WRITE_ONCE(trigger_kthread, kthread);
69	}	112	}
70	}	113	}
71		114
72	if (!trigger_kthread) {
73	/* Do it the slow way */
74	tracepoint_synchronize_unregister();
75	kfree(data);
76	return;
77	}
78
79	llist_add(&data->llist, &trigger_data_free_list);	115	llist_add(&data->llist, &trigger_data_free_list);
80	wake_up_process(trigger_kthread);	116	wake_up_process(trigger_kthread);
81	}	117	}
82		118
		119	static int __init trigger_data_free_init(void)
		120	{
		121	guard(mutex)(&trigger_data_kthread_mutex);
		122
		123	if (llist_empty(&trigger_data_free_list))
		124	return 0;
		125
		126	trigger_create_kthread_locked();
		127	if (trigger_kthread)
		128	wake_up_process(trigger_kthread);
		129	else
		130	trigger_data_free_queued_locked();
		131
		132	return 0;
		133	}
		134	late_initcall(trigger_data_free_init);
		135
83	static inline void data_ops_trigger(struct event_trigger_data *data,	136	static inline void data_ops_trigger(struct event_trigger_data *data,
84	struct trace_buffer buffer, void rec,	137	struct trace_buffer buffer, void rec,
85	struct ring_buffer_event *event)	138	struct ring_buffer_event *event)

kernel/trace/trace_osnoise.c+5−5

 	if (!osnoise_has_registered_instances())
 		return;
-	guard(mutex)(&interface_lock);
 	guard(cpus_read_lock)();
+	guard(mutex)(&interface_lock);
 	if (!cpu_online(cpu))
 		return;
 	if (running)
 		stop_per_cpu_kthreads();
-	mutex_lock(&interface_lock);
 	/*
 	 * avoid CPU hotplug operations that might read options.
 	 */
 	cpus_read_lock();
+	mutex_lock(&interface_lock);
 	retval = cnt;
 			clear_bit(option, &osnoise_options);
 	}
-	cpus_read_unlock();
 	mutex_unlock(&interface_lock);
+	cpus_read_unlock();
 	if (running)
 		start_per_cpu_kthreads();
 	if (running)
 		stop_per_cpu_kthreads();
-	mutex_lock(&interface_lock);
 	/*
 	 * osnoise_cpumask is read by CPU hotplug operations.
 	 */
 	cpus_read_lock();
+	mutex_lock(&interface_lock);
 	cpumask_copy(&osnoise_cpumask, osnoise_cpumask_new);
-	cpus_read_unlock();
 	mutex_unlock(&interface_lock);
+	cpus_read_unlock();
 	if (running)
 		start_per_cpu_kthreads();

lib/bug.c+2−5

 	return module_find_bug(bugaddr);
 }
-__diag_push();
+static __printf(1, 0)
-__diag_ignore(GCC, all, "-Wsuggest-attribute=format",
+void __warn_printf(const char *fmt, struct pt_regs *regs)
-	      "Not a valid __printf() conversion candidate.");
-static void __warn_printf(const char *fmt, struct pt_regs *regs)
 {
 	if (!fmt)
 		return;
 	printk("%s", fmt);
 }
-__diag_pop();
 static enum bug_trap_type __report_bug(struct bug_entry *bug, unsigned long bugaddr, struct pt_regs *regs)
 {

mm/damon/core.c+8−0

 {
 	int err;
+	dst->maybe_corrupted = true;
 	if (!is_power_of_2(src->min_region_sz))
 		return -EINVAL;
 	dst->addr_unit = src->addr_unit;
 	dst->min_region_sz = src->min_region_sz;
+	dst->maybe_corrupted = false;
 	return 0;
 }
 			complete(&control->completion);
 		else if (control->canceled && control->dealloc_on_cancel)
 			kfree(control);
+		if (!cancel && ctx->maybe_corrupted)
+			break;
 	}
 	mutex_lock(&ctx->call_controls_lock);
 		kdamond_usleep(min_wait_time);
 		kdamond_call(ctx, false);
+		if (ctx->maybe_corrupted)
+			return -EINVAL;
 		damos_walk_cancel(ctx);
 	}
 	return -EBUSY;
 		 * kdamond_merge_regions() if possible, to reduce overhead
 		 */
 		kdamond_call(ctx, false);
+		if (ctx->maybe_corrupted)
+			break;
 		if (!list_empty(&ctx->schemes))
 			kdamond_apply_schemes(ctx);
 		else

mm/damon/stat.c+50−3

@@ -145,12 +145,59 @@ static int damon_stat_damon_call_fn(void *data) · 144 unmodified lines
145	return 0;	145	return 0;
146	}	146	}
147		147
		148	struct damon_stat_system_ram_range_walk_arg {
		149	bool walked;
		150	struct resource res;
		151	};
		152
		153	static int damon_stat_system_ram_walk_fn(struct resource res, void arg)
		154	{
		155	struct damon_stat_system_ram_range_walk_arg *a = arg;
		156
		157	if (!a->walked) {
		158	a->walked = true;
		159	a->res.start = res->start;
		160	}
		161	a->res.end = res->end;
		162	return 0;
		163	}
		164
		165	static unsigned long damon_stat_res_to_core_addr(resource_size_t ra,
		166	unsigned long addr_unit)
		167	{
		168	/*
		169	* Use div_u64() for avoiding linking errors related with __udivdi3,
		170	* __aeabi_uldivmod, or similar problems. This should also improve the
		171	* performance optimization (read div_u64() comment for the detail).
		172	*/
		173	if (sizeof(ra) == 8 && sizeof(addr_unit) == 4)
		174	return div_u64(ra, addr_unit);
		175	return ra / addr_unit;
		176	}
		177
		178	static int damon_stat_set_monitoring_region(struct damon_target *t,
		179	unsigned long addr_unit, unsigned long min_region_sz)
		180	{
		181	struct damon_addr_range addr_range;
		182	struct damon_stat_system_ram_range_walk_arg arg = {};
		183
		184	walk_system_ram_res(0, -1, &arg, damon_stat_system_ram_walk_fn);
		185	if (!arg.walked)
		186	return -EINVAL;
		187	addr_range.start = damon_stat_res_to_core_addr(
		188	arg.res.start, addr_unit);
		189	addr_range.end = damon_stat_res_to_core_addr(
		190	arg.res.end + 1, addr_unit);
		191	if (addr_range.end <= addr_range.start)
		192	return -EINVAL;
		193	return damon_set_regions(t, &addr_range, 1, min_region_sz);
		194	}
		195
148	static struct damon_ctx *damon_stat_build_ctx(void)	196	static struct damon_ctx *damon_stat_build_ctx(void)
149	{	197	{
150	struct damon_ctx *ctx;	198	struct damon_ctx *ctx;
151	struct damon_attrs attrs;	199	struct damon_attrs attrs;
152	struct damon_target *target;	200	struct damon_target *target;
153	unsigned long start = 0, end = 0;
154		201
155	ctx = damon_new_ctx();	202	ctx = damon_new_ctx();
156	if (!ctx)	203	if (!ctx)
@@ -180,8 +227,8 @@ static struct damon_ctx *damon_stat_build_ctx(void) · 23 unmodified lines
180	if (!target)	227	if (!target)
181	goto free_out;	228	goto free_out;
182	damon_add_target(ctx, target);	229	damon_add_target(ctx, target);
183	if (damon_set_region_biggest_system_ram_default(target, &start, &end,	230	if (damon_stat_set_monitoring_region(target, ctx->addr_unit,
184	ctx->min_region_sz))	231	ctx->min_region_sz))
185	goto free_out;	232	goto free_out;
186	return ctx;	233	return ctx;
187	free_out:	234	free_out:

mm/damon/sysfs.c+9−1

 	if (IS_ERR(param_ctx))
 		return PTR_ERR(param_ctx);
 	test_ctx = damon_sysfs_new_test_ctx(kdamond->damon_ctx);
-	if (!test_ctx)
+	if (!test_ctx) {
+		damon_destroy_ctx(param_ctx);
 		return -ENOMEM;
+	}
 	err = damon_commit_ctx(test_ctx, param_ctx);
 	if (err)
 		goto out;
 	if (!mutex_trylock(&damon_sysfs_lock))
 		return 0;
+	if (sysfs_kdamond->contexts->nr != 1)
+		goto out;
 	damon_sysfs_upd_tuned_intervals(sysfs_kdamond);
 	damon_sysfs_upd_schemes_stats(sysfs_kdamond);
 	damon_sysfs_upd_schemes_effective_quotas(sysfs_kdamond);
+out:
 	mutex_unlock(&damon_sysfs_lock);
 	return 0;
 }
 static int damon_sysfs_handle_cmd(enum damon_sysfs_cmd cmd,
 		struct damon_sysfs_kdamond *kdamond)
 {
+	if (cmd != DAMON_SYSFS_CMD_OFF && kdamond->contexts->nr != 1)
+		return -EINVAL;
 	switch (cmd) {
 	case DAMON_SYSFS_CMD_ON:
 		return damon_sysfs_turn_damon_on(kdamond);

mm/hmm.c+2−2

@@ -778,7 +778,7 @@ dma_addr_t hmm_dma_map_pfn(struct device dev, struct hmm_dma_map map, · 777 unmodified lines
778	struct page *page = hmm_pfn_to_page(pfns[idx]);	778	struct page *page = hmm_pfn_to_page(pfns[idx]);
779	phys_addr_t paddr = hmm_pfn_to_phys(pfns[idx]);	779	phys_addr_t paddr = hmm_pfn_to_phys(pfns[idx]);
780	size_t offset = idx * map->dma_entry_size;	780	size_t offset = idx * map->dma_entry_size;
781	unsigned long attrs = 0;	781	unsigned long attrs = DMA_ATTR_REQUIRE_COHERENT;
782	dma_addr_t dma_addr;	782	dma_addr_t dma_addr;
783	int ret;	783	int ret;
784		784
@@ -871,7 +871,7 @@ bool hmm_dma_unmap_pfn(struct device dev, struct hmm_dma_map map, size_t idx) · 86 unmodified lines
871	struct dma_iova_state *state = &map->state;	871	struct dma_iova_state *state = &map->state;
872	dma_addr_t *dma_addrs = map->dma_list;	872	dma_addr_t *dma_addrs = map->dma_list;
873	unsigned long *pfns = map->pfn_list;	873	unsigned long *pfns = map->pfn_list;
874	unsigned long attrs = 0;	874	unsigned long attrs = DMA_ATTR_REQUIRE_COHERENT;
875		875
876	if ((pfns[idx] & valid_dma) != valid_dma)	876	if ((pfns[idx] & valid_dma) != valid_dma)
877	return false;	877	return false;

mm/memory.c+15−3

 	pudp = pud_offset(p4dp, address);
 	pud = pudp_get(pudp);
-	if (pud_none(pud))
+	if (!pud_present(pud))
 		goto out;
 	if (pud_leaf(pud)) {
 		lock = pud_lock(mm, pudp);
-		if (!unlikely(pud_leaf(pud))) {
+		pud = pudp_get(pudp);
+		if (unlikely(!pud_present(pud))) {
+			spin_unlock(lock);
+			goto out;
+		} else if (unlikely(!pud_leaf(pud))) {
 			spin_unlock(lock);
 			goto retry;
 		}
 	pmdp = pmd_offset(pudp, address);
 	pmd = pmdp_get_lockless(pmdp);
+	if (!pmd_present(pmd))
+		goto out;
 	if (pmd_leaf(pmd)) {
 		lock = pmd_lock(mm, pmdp);
-		if (!unlikely(pmd_leaf(pmd))) {
+		pmd = pmdp_get(pmdp);
+		if (unlikely(!pmd_present(pmd))) {
+			spin_unlock(lock);
+			goto out;
+		} else if (unlikely(!pmd_leaf(pmd))) {
 			spin_unlock(lock);
 			goto retry;
 		}

mm/mempolicy.c+8−2

 {
 	if (!atomic_dec_and_test(&pol->refcnt))
 		return;
-	kmem_cache_free(policy_cache, pol);
+	/*
+	 * Required to allow mmap_lock_speculative*() access, see for example
+	 * futex_key_to_node_opt(). All accesses are serialized by mmap_lock,
+	 * however the speculative lock section unbound by the normal lock
+	 * boundaries, requiring RCU freeing.
+	 */
+	kfree_rcu(pol, rcu);
 }
 EXPORT_SYMBOL_FOR_MODULES(__mpol_put, "kvm");
 	}
 	old = vma->vm_policy;
-	vma->vm_policy = new; /* protected by mmap_lock */
+	WRITE_ONCE(vma->vm_policy, new); /* protected by mmap_lock */
 	mpol_put(old);
 	return 0;

mm/mseal.c+1−2

 		unsigned long start, unsigned long end)
 {
 	struct vm_area_struct *vma, *prev;
-	unsigned long curr_start = start;
 	VMA_ITERATOR(vmi, mm, start);
 	/* We know there are no gaps so this will be non-NULL. */
 		prev = vma;
 	for_each_vma_range(vmi, vma, end) {
+		const unsigned long curr_start = MAX(vma->vm_start, start);
 		const unsigned long curr_end = MIN(vma->vm_end, end);
 		if (!(vma->vm_flags & VM_SEALED)) {
 		}
 		prev = vma;
-		curr_start = curr_end;
 	}
 	return 0;

mm/pagewalk.c+22−3

 static int walk_pmd_range(pud_t *pud, unsigned long addr, unsigned long end,
 			  struct mm_walk *walk)
 {
+	pud_t pudval = pudp_get(pud);
 	pmd_t *pmd;
 	unsigned long next;
 	const struct mm_walk_ops *ops = walk->ops;
 	int err = 0;
 	int depth = real_depth(3);
+	/*
+	 * For PTE handling, pte_offset_map_lock() takes care of checking
+	 * whether there actually is a page table. But it also has to be
+	 * very careful about concurrent page table reclaim.
+	 *
+	 * Similarly, we have to be careful here - a PUD entry that points
+	 * to a PMD table cannot go away, so we can just walk it. But if
+	 * it's something else, we need to ensure we didn't race something,
+	 * so need to retry.
+	 *
+	 * A pertinent example of this is a PUD refault after PUD split -
+	 * we will need to split again or risk accessing invalid memory.
+	 */
+	if (!pud_present(pudval) || pud_leaf(pudval)) {
+		walk->action = ACTION_AGAIN;
+		return 0;
+	}
 	pmd = pmd_offset(pud, addr);
 	do {
 again:
 		else if (pud_leaf(*pud) || !pud_present(*pud))
 			continue; /* Nothing to do. */
-		if (pud_none(*pud))
-			goto again;
 		err = walk_pmd_range(pud, addr, next, walk);
 		if (err)
 			break;
+		if (walk->action == ACTION_AGAIN)
+			goto again;
 	} while (pud++, addr = next, addr != end);
 	return err;

mm/rmap.c+7−0

@@ -457,6 +457,13 @@ static void cleanup_partial_anon_vmas(struct vm_area_struct *vma) · 456 unmodified lines
457	list_del(&avc->same_vma);	457	list_del(&avc->same_vma);
458	anon_vma_chain_free(avc);	458	anon_vma_chain_free(avc);
459	}	459	}
		460
		461	/*
		462	* The anon_vma assigned to this VMA is no longer valid, as we were not
		463	* able to correctly clone AVC state. Avoid inconsistent anon_vma tree
		464	* state by resetting.
		465	*/
		466	vma->anon_vma = NULL;
460	}	467	}
461		468
462	/**	469	/**

mm/swap_state.c+4−5

 	__folio_set_locked(folio);
 	__folio_set_swapbacked(folio);
+	if (!charged && mem_cgroup_swapin_charge_folio(folio, NULL, gfp, entry))
+		goto failed;
 	for (;;) {
 		ret = swap_cache_add_folio(folio, entry, &shadow);
 		if (!ret)
 			goto failed;
 	}
-	if (!charged && mem_cgroup_swapin_charge_folio(folio, NULL, gfp, entry)) {
-		swap_cache_del_folio(folio);
-		goto failed;
-	}
 	memcg1_swapin(entry, folio_nr_pages(folio));
 	if (shadow)
 		workingset_refault(folio, shadow);

mm/zswap.c+7−1

@@ -942,9 +942,15 @@ static bool zswap_decompress(struct zswap_entry entry, struct folio folio) · 941 unmodified lines
942		942
943	/* zswap entries of length PAGE_SIZE are not compressed. */	943	/* zswap entries of length PAGE_SIZE are not compressed. */
944	if (entry->length == PAGE_SIZE) {	944	if (entry->length == PAGE_SIZE) {
		945	void *dst;
		946
945	WARN_ON_ONCE(input->length != PAGE_SIZE);	947	WARN_ON_ONCE(input->length != PAGE_SIZE);
946	memcpy_from_sglist(kmap_local_folio(folio, 0), input, 0, PAGE_SIZE);	948
		949	dst = kmap_local_folio(folio, 0);
		950	memcpy_from_sglist(dst, input, 0, PAGE_SIZE);
947	dlen = PAGE_SIZE;	951	dlen = PAGE_SIZE;
		952	kunmap_local(dst);
		953	flush_dcache_folio(folio);
948	} else {	954	} else {
949	sg_init_table(&output, 1);	955	sg_init_table(&output, 1);
950	sg_set_folio(&output, folio, PAGE_SIZE, 0);	956	sg_set_folio(&output, folio, PAGE_SIZE, 0);

net/bluetooth/hci_conn.c+1−1

@@ -3095,7 +3095,7 @@ int hci_abort_conn(struct hci_conn *conn, u8 reason) · 3094 unmodified lines
3095	* hci_connect_le serializes the connection attempts so only one	3095	* hci_connect_le serializes the connection attempts so only one
3096	* connection can be in BT_CONNECT at time.	3096	* connection can be in BT_CONNECT at time.
3097	*/	3097	*/
3098	if (conn->state == BT_CONNECT && hdev->req_status == HCI_REQ_PEND) {	3098	if (conn->state == BT_CONNECT && READ_ONCE(hdev->req_status) == HCI_REQ_PEND) {
3099	switch (hci_skb_event(hdev->sent_cmd)) {	3099	switch (hci_skb_event(hdev->sent_cmd)) {
3100	case HCI_EV_CONN_COMPLETE:	3100	case HCI_EV_CONN_COMPLETE:
3101	case HCI_EV_LE_CONN_COMPLETE:	3101	case HCI_EV_LE_CONN_COMPLETE:

net/bluetooth/hci_core.c+1−1

@@ -4126,7 +4126,7 @@ static int hci_send_cmd_sync(struct hci_dev hdev, struct sk_buff skb) · 4125 unmodified lines
4126	kfree_skb(skb);	4126	kfree_skb(skb);
4127	}	4127	}
4128		4128
4129	if (hdev->req_status == HCI_REQ_PEND &&	4129	if (READ_ONCE(hdev->req_status) == HCI_REQ_PEND &&
4130	!hci_dev_test_and_set_flag(hdev, HCI_CMD_PENDING)) {	4130	!hci_dev_test_and_set_flag(hdev, HCI_CMD_PENDING)) {
4131	kfree_skb(hdev->req_skb);	4131	kfree_skb(hdev->req_skb);
4132	hdev->req_skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);	4132	hdev->req_skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);

net/bluetooth/hci_sync.c+10−10

@@ -25,11 +25,11 @@ static void hci_cmd_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode, · 24 unmodified lines
25	{	25	{
26	bt_dev_dbg(hdev, "result 0x%2.2x", result);	26	bt_dev_dbg(hdev, "result 0x%2.2x", result);
27		27
28	if (hdev->req_status != HCI_REQ_PEND)	28	if (READ_ONCE(hdev->req_status) != HCI_REQ_PEND)
29	return;	29	return;
30		30
31	hdev->req_result = result;	31	hdev->req_result = result;
32	hdev->req_status = HCI_REQ_DONE;	32	WRITE_ONCE(hdev->req_status, HCI_REQ_DONE);
33		33
34	/* Free the request command so it is not used as response */	34	/* Free the request command so it is not used as response */
35	kfree_skb(hdev->req_skb);	35	kfree_skb(hdev->req_skb);
@@ -167,20 +167,20 @@ struct sk_buff __hci_cmd_sync_sk(struct hci_dev hdev, u16 opcode, u32 plen, · 131 unmodified lines
167		167
168	hci_cmd_sync_add(&req, opcode, plen, param, event, sk);	168	hci_cmd_sync_add(&req, opcode, plen, param, event, sk);
169		169
170	hdev->req_status = HCI_REQ_PEND;	170	WRITE_ONCE(hdev->req_status, HCI_REQ_PEND);
171		171
172	err = hci_req_sync_run(&req);	172	err = hci_req_sync_run(&req);
173	if (err < 0)	173	if (err < 0)
174	return ERR_PTR(err);	174	return ERR_PTR(err);
175		175
176	err = wait_event_interruptible_timeout(hdev->req_wait_q,	176	err = wait_event_interruptible_timeout(hdev->req_wait_q,
177	hdev->req_status != HCI_REQ_PEND,	177	READ_ONCE(hdev->req_status) != HCI_REQ_PEND,
178	timeout);	178	timeout);
179		179
180	if (err == -ERESTARTSYS)	180	if (err == -ERESTARTSYS)
181	return ERR_PTR(-EINTR);	181	return ERR_PTR(-EINTR);
182		182
183	switch (hdev->req_status) {	183	switch (READ_ONCE(hdev->req_status)) {
184	case HCI_REQ_DONE:	184	case HCI_REQ_DONE:
185	err = -bt_to_errno(hdev->req_result);	185	err = -bt_to_errno(hdev->req_result);
186	break;	186	break;
@@ -194,7 +194,7 @@ struct sk_buff __hci_cmd_sync_sk(struct hci_dev hdev, u16 opcode, u32 plen, · 7 unmodified lines
194	break;	194	break;
195	}	195	}
196		196
197	hdev->req_status = 0;	197	WRITE_ONCE(hdev->req_status, 0);
198	hdev->req_result = 0;	198	hdev->req_result = 0;
199	skb = hdev->req_rsp;	199	skb = hdev->req_rsp;
200	hdev->req_rsp = NULL;	200	hdev->req_rsp = NULL;
@@ -665,9 +665,9 @@ void hci_cmd_sync_cancel(struct hci_dev *hdev, int err) · 464 unmodified lines
665	{	665	{
666	bt_dev_dbg(hdev, "err 0x%2.2x", err);	666	bt_dev_dbg(hdev, "err 0x%2.2x", err);
667		667
668	if (hdev->req_status == HCI_REQ_PEND) {	668	if (READ_ONCE(hdev->req_status) == HCI_REQ_PEND) {
669	hdev->req_result = err;	669	hdev->req_result = err;
670	hdev->req_status = HCI_REQ_CANCELED;	670	WRITE_ONCE(hdev->req_status, HCI_REQ_CANCELED);
671		671
672	queue_work(hdev->workqueue, &hdev->cmd_sync_cancel_work);	672	queue_work(hdev->workqueue, &hdev->cmd_sync_cancel_work);
673	}	673	}
@@ -683,12 +683,12 @@ void hci_cmd_sync_cancel_sync(struct hci_dev *hdev, int err) · 9 unmodified lines
683	{	683	{
684	bt_dev_dbg(hdev, "err 0x%2.2x", err);	684	bt_dev_dbg(hdev, "err 0x%2.2x", err);
685		685
686	if (hdev->req_status == HCI_REQ_PEND) {	686	if (READ_ONCE(hdev->req_status) == HCI_REQ_PEND) {
687	/* req_result is __u32 so error must be positive to be properly	687	/* req_result is __u32 so error must be positive to be properly
688	* propagated.	688	* propagated.
689	*/	689	*/
690	hdev->req_result = err < 0 ? -err : err;	690	hdev->req_result = err < 0 ? -err : err;
691	hdev->req_status = HCI_REQ_CANCELED;	691	WRITE_ONCE(hdev->req_status, HCI_REQ_CANCELED);
692		692
693	wake_up_interruptible(&hdev->req_wait_q);	693	wake_up_interruptible(&hdev->req_wait_q);
694	}	694	}

net/bluetooth/l2cap_core.c+53−18

 static int l2cap_get_ident(struct l2cap_conn *conn)
 {
+	u8 max;
+	int ident;
 	/* LE link does not support tools like l2ping so use the full range */
 	if (conn->hcon->type == LE_LINK)
-		return ida_alloc_range(&conn->tx_ida, 1, 255, GFP_ATOMIC);
+		max = 255;
 	/* Get next available identificator.
 	 *    1 - 128 are used by kernel.
 	 *  129 - 199 are reserved.
 	 *  200 - 254 are used by utilities like l2ping, etc.
 	 */
-	return ida_alloc_range(&conn->tx_ida, 1, 128, GFP_ATOMIC);
+	else
+		max = 128;
+	/* Allocate ident using min as last used + 1 (cyclic) */
+	ident = ida_alloc_range(&conn->tx_ida, READ_ONCE(conn->tx_ident) + 1,
+				max, GFP_ATOMIC);
+	/* Force min 1 to start over */
+	if (ident <= 0) {
+		ident = ida_alloc_range(&conn->tx_ida, 1, max, GFP_ATOMIC);
+		if (ident <= 0) {
+			/* If all idents are in use, log an error, this is
+			 * extremely unlikely to happen and would indicate a bug
+			 * in the code that idents are not being freed properly.
+			 */
+			BT_ERR("Unable to allocate ident: %d", ident);
+			return 0;
+		}
+	}
+	WRITE_ONCE(conn->tx_ident, ident);
+	return ident;
 }
 static void l2cap_send_acl(struct l2cap_conn *conn, struct sk_buff *skb,
 	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
+	disable_delayed_work_sync(&conn->info_timer);
+	disable_delayed_work_sync(&conn->id_addr_timer);
 	mutex_lock(&conn->lock);
 	kfree_skb(conn->rx_skb);
 	ida_destroy(&conn->tx_ida);
-	cancel_delayed_work_sync(&conn->id_addr_timer);
 	l2cap_unregister_all_users(conn);
 	/* Force the connection to be immediately dropped */
 		l2cap_chan_put(chan);
 	}
-	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
-		cancel_delayed_work_sync(&conn->info_timer);
 	hci_chan_del(conn->hchan);
 	conn->hchan = NULL;
 	/* Remote device may have requested smaller PDUs */
 	pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
+	if (!pdu_len)
+		return -EINVAL;
 	if (len <= pdu_len) {
 		sar = L2CAP_SAR_UNSEGMENTED;
 		sdu_len = 0;
 	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
 		set_default_fcs(chan);
-		if (chan->mode == L2CAP_MODE_ERTM ||
+		if (chan->state != BT_CONNECTED) {
-		    chan->mode == L2CAP_MODE_STREAMING)
+			if (chan->mode == L2CAP_MODE_ERTM ||
-			err = l2cap_ertm_init(chan);
+			    chan->mode == L2CAP_MODE_STREAMING)
+				err = l2cap_ertm_init(chan);
-		if (err < 0)
+			if (err < 0)
-			l2cap_send_disconn_req(chan, -err);
+				l2cap_send_disconn_req(chan, -err);
-		else
+			else
-			l2cap_chan_ready(chan);
+				l2cap_chan_ready(chan);
+		}
 		goto unlock;
 	}
 	cmd_len -= sizeof(*req);
 	num_scid = cmd_len / sizeof(u16);
-	/* Always respond with the same number of scids as in the request */
-	rsp_len = cmd_len;
 	if (num_scid > L2CAP_ECRED_MAX_CID) {
 		result = L2CAP_CR_LE_INVALID_PARAMS;
 		goto response;
 	}
+	/* Always respond with the same number of scids as in the request */
+	rsp_len = cmd_len;
 	mtu  = __le16_to_cpu(req->mtu);
 	mps  = __le16_to_cpu(req->mps);
 	struct l2cap_le_credits pkt;
 	u16 return_credits = l2cap_le_rx_credits(chan);
+	if (chan->mode != L2CAP_MODE_LE_FLOWCTL &&
+	    chan->mode != L2CAP_MODE_EXT_FLOWCTL)
+		return;
 	if (chan->rx_credits >= return_credits)
 		return;
 	if (!chan->sdu) {
 		u16 sdu_len;
+		if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE)) {
+			err = -EINVAL;
+			goto failed;
+		}
 		sdu_len = get_unaligned_le16(skb->data);
 		skb_pull(skb, L2CAP_SDULEN_SIZE);

net/bluetooth/l2cap_sock.c+3−0

@@ -1698,6 +1698,9 @@ static void l2cap_sock_ready_cb(struct l2cap_chan *chan) · 1697 unmodified lines
1698	struct sock *sk = chan->data;	1698	struct sock *sk = chan->data;
1699	struct sock *parent;	1699	struct sock *parent;
1700		1700
		1701	if (!sk)
		1702	return;
		1703
1701	lock_sock(sk);	1704	lock_sock(sk);
1702		1705
1703	parent = bt_sk(sk)->parent;	1706	parent = bt_sk(sk)->parent;

net/bluetooth/mgmt.c+1−1

@@ -5355,7 +5355,7 @@ static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, · 5354 unmodified lines
5355	* hci_adv_monitors_clear is about to be called which will take care of	5355	* hci_adv_monitors_clear is about to be called which will take care of
5356	* freeing the adv_monitor instances.	5356	* freeing the adv_monitor instances.
5357	*/	5357	*/
5358	if (status == -ECANCELED && !mgmt_pending_valid(hdev, cmd))	5358	if (status == -ECANCELED \|\| !mgmt_pending_valid(hdev, cmd))
5359	return;	5359	return;
5360		5360
5361	monitor = cmd->user_data;	5361	monitor = cmd->user_data;

net/bluetooth/sco.c+7−3

 	struct sock *sk;
 	sco_conn_lock(conn);
-	sk = conn->sk;
+	sk = sco_sock_hold(conn);
 	sco_conn_unlock(conn);
 	if (!sk)
 	BT_DBG("sk %p len %u", sk, skb->len);
 	if (sk->sk_state != BT_CONNECTED)
-		goto drop;
+		goto drop_put;
-	if (!sock_queue_rcv_skb(sk, skb))
+	if (!sock_queue_rcv_skb(sk, skb)) {
+		sock_put(sk);
 		return;
+	}
+drop_put:
+	sock_put(sk);
 drop:
 	kfree_skb(skb);
 }

net/can/af_can.c+2−2

@@ -469,7 +469,7 @@ int can_rx_register(struct net net, struct net_device dev, canid_t can_id, · 468 unmodified lines
469		469
470	rcv->can_id = can_id;	470	rcv->can_id = can_id;
471	rcv->mask = mask;	471	rcv->mask = mask;
472	rcv->matches = 0;	472	atomic_long_set(&rcv->matches, 0);
473	rcv->func = func;	473	rcv->func = func;
474	rcv->data = data;	474	rcv->data = data;
475	rcv->ident = ident;	475	rcv->ident = ident;
@@ -573,7 +573,7 @@ EXPORT_SYMBOL(can_rx_unregister); · 97 unmodified lines
573	static inline void deliver(struct sk_buff skb, struct receiver rcv)	573	static inline void deliver(struct sk_buff skb, struct receiver rcv)
574	{	574	{
575	rcv->func(skb, rcv->data);	575	rcv->func(skb, rcv->data);
576	rcv->matches++;	576	atomic_long_inc(&rcv->matches);
577	}	577	}
578		578
579	static int can_rcv_filter(struct can_dev_rcv_lists dev_rcv_lists, struct sk_buff skb)	579	static int can_rcv_filter(struct can_dev_rcv_lists dev_rcv_lists, struct sk_buff skb)

net/can/af_can.h+1−1

@@ -52,7 +52,7 @@ struct receiver { · 51 unmodified lines
52	struct hlist_node list;	52	struct hlist_node list;
53	canid_t can_id;	53	canid_t can_id;
54	canid_t mask;	54	canid_t mask;
55	unsigned long matches;	55	atomic_long_t matches;
56	void (func)(struct sk_buff skb, void *data);	56	void (func)(struct sk_buff skb, void *data);
57	void *data;	57	void *data;
58	char *ident;	58	char *ident;

net/can/gw.c+3−3

@@ -375,10 +375,10 @@ static void cgw_csum_crc8_rel(struct canfd_frame *cf, · 374 unmodified lines
375	return;	375	return;
376		376
377	if (from <= to) {	377	if (from <= to) {
378	for (i = crc8->from_idx; i <= crc8->to_idx; i++)	378	for (i = from; i <= to; i++)
379	crc = crc8->crctab[crc ^ cf->data[i]];	379	crc = crc8->crctab[crc ^ cf->data[i]];
380	} else {	380	} else {
381	for (i = crc8->from_idx; i >= crc8->to_idx; i--)	381	for (i = from; i >= to; i--)
382	crc = crc8->crctab[crc ^ cf->data[i]];	382	crc = crc8->crctab[crc ^ cf->data[i]];
383	}	383	}
384		384
@@ -397,7 +397,7 @@ static void cgw_csum_crc8_rel(struct canfd_frame *cf, · 12 unmodified lines
397	break;	397	break;
398	}	398	}
399		399
400	cf->data[crc8->result_idx] = crc ^ crc8->final_xor_val;	400	cf->data[res] = crc ^ crc8->final_xor_val;
401	}	401	}
402		402
403	static void cgw_csum_crc8_pos(struct canfd_frame *cf,	403	static void cgw_csum_crc8_pos(struct canfd_frame *cf,

net/can/isotp.c+18−6

 	so->ifindex = 0;
 	so->bound = 0;
-	if (so->rx.buf != so->rx.sbuf)
-		kfree(so->rx.buf);
-	if (so->tx.buf != so->tx.sbuf)
-		kfree(so->tx.buf);
 	sock_orphan(sk);
 	sock->sk = NULL;
 	return NOTIFY_DONE;
 }
+static void isotp_sock_destruct(struct sock *sk)
+{
+	struct isotp_sock *so = isotp_sk(sk);
+	/* do the standard CAN sock destruct work */
+	can_sock_destruct(sk);
+	/* free potential extended PDU buffers */
+	if (so->rx.buf != so->rx.sbuf)
+		kfree(so->rx.buf);
+	if (so->tx.buf != so->tx.sbuf)
+		kfree(so->tx.buf);
+}
 static int isotp_init(struct sock *sk)
 {
 	struct isotp_sock *so = isotp_sk(sk);
 	list_add_tail(&so->notifier, &isotp_notifier_list);
 	spin_unlock(&isotp_notifier_lock);
+	/* re-assign default can_sock_destruct() reference */
+	sk->sk_destruct = isotp_sock_destruct;
 	return 0;
 }

net/can/proc.c+2−1

@@ -196,7 +196,8 @@ static void can_print_rcvlist(struct seq_file m, struct hlist_head rx_list, · 195 unmodified lines
196	" %-5s %03x %08x %pK %pK %8ld %s\n";	196	" %-5s %03x %08x %pK %pK %8ld %s\n";
197		197
198	seq_printf(m, fmt, DNAME(dev), r->can_id, r->mask,	198	seq_printf(m, fmt, DNAME(dev), r->can_id, r->mask,
199	r->func, r->data, r->matches, r->ident);	199	r->func, r->data, atomic_long_read(&r->matches),
		200	r->ident);
200	}	201	}
201	}	202	}
202		203

net/core/dev.c+17−5

 	return vlan_features_check(skb, features);
 }
+static bool skb_gso_has_extension_hdr(const struct sk_buff *skb)
+{
+	if (!skb->encapsulation)
+		return ((skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6 ||
+			 (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4 &&
+			  vlan_get_protocol(skb) == htons(ETH_P_IPV6))) &&
+			skb_transport_header_was_set(skb) &&
+			skb_network_header_len(skb) != sizeof(struct ipv6hdr));
+	else
+		return (!skb_inner_network_header_was_set(skb) ||
+			((skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6 ||
+			  (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4 &&
+			   inner_ip_hdr(skb)->version == 6)) &&
+			 skb_inner_network_header_len(skb) != sizeof(struct ipv6hdr)));
+}
 static netdev_features_t gso_features_check(const struct sk_buff *skb,
 					    struct net_device *dev,
 					    netdev_features_t features)
 	 * so neither does TSO that depends on it.
 	 */
 	if (features & NETIF_F_IPV6_CSUM &&
-	    (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6 ||
+	    skb_gso_has_extension_hdr(skb))
-	     (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4 &&
-	      vlan_get_protocol(skb) == htons(ETH_P_IPV6))) &&
-	    skb_transport_header_was_set(skb) &&
-	    skb_network_header_len(skb) != sizeof(struct ipv6hdr))
 		features &= ~(NETIF_F_IPV6_CSUM | NETIF_F_TSO6 | NETIF_F_GSO_UDP_L4);
 	return features;

net/core/rtnetlink.c+25−3

 unlock:
 	mutex_unlock(&link_ops_mutex);
+	if (err)
+		cleanup_srcu_struct(&ops->srcu);
 	return err;
 }
 EXPORT_SYMBOL_GPL(rtnl_link_register);
 		goto out;
 	ops = master_dev->rtnl_link_ops;
-	if (!ops || !ops->get_slave_size)
+	if (!ops)
+		goto out;
+	size += nla_total_size(strlen(ops->kind) + 1);  /* IFLA_INFO_SLAVE_KIND */
+	if (!ops->get_slave_size)
 		goto out;
 	/* IFLA_INFO_SLAVE_DATA + nested data */
-	size = nla_total_size(sizeof(struct nlattr)) +
+	size += nla_total_size(sizeof(struct nlattr)) +
-	       ops->get_slave_size(master_dev, dev);
+		ops->get_slave_size(master_dev, dev);
 out:
 	rcu_read_unlock();
 	return size;
 }
+static size_t rtnl_dev_parent_size(const struct net_device *dev)
+{
+	size_t size = 0;
+	/* IFLA_PARENT_DEV_NAME */
+	if (dev->dev.parent)
+		size += nla_total_size(strlen(dev_name(dev->dev.parent)) + 1);
+	/* IFLA_PARENT_DEV_BUS_NAME */
+	if (dev->dev.parent && dev->dev.parent->bus)
+		size += nla_total_size(strlen(dev->dev.parent->bus->name) + 1);
+	return size;
+}
 static noinline size_t if_nlmsg_size(const struct net_device *dev,
 				     u32 ext_filter_mask)
 {
 	       + nla_total_size(8)  /* IFLA_MAX_PACING_OFFLOAD_HORIZON */
 	       + nla_total_size(2)  /* IFLA_HEADROOM */
 	       + nla_total_size(2)  /* IFLA_TAILROOM */
+	       + rtnl_dev_parent_size(dev)
 	       + 0;
 	if (!(ext_filter_mask & RTEXT_FILTER_SKIP_STATS))

net/ipv4/esp4.c+6−3

 		xfrm_dev_resume(skb);
 	} else {
 		if (!err &&
-		    x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)
+		    x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP) {
-			esp_output_tail_tcp(x, skb);
+			err = esp_output_tail_tcp(x, skb);
-		else
+			if (err != -EINPROGRESS)
+				kfree_skb(skb);
+		} else {
 			xfrm_output_resume(skb_to_full_sk(skb), skb, err);
+		}
 	}
 }

net/ipv4/inet_connection_sock.c+3−17

 }
 EXPORT_SYMBOL(inet_sk_get_local_port_range);
-static bool inet_use_bhash2_on_bind(const struct sock *sk)
-{
-#if IS_ENABLED(CONFIG_IPV6)
-	if (sk->sk_family == AF_INET6) {
-		if (ipv6_addr_any(&sk->sk_v6_rcv_saddr))
-			return false;
-		if (!ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr))
-			return true;
-	}
-#endif
-	return sk->sk_rcv_saddr != htonl(INADDR_ANY);
-}
 static bool inet_bind_conflict(const struct sock *sk, struct sock *sk2,
 			       kuid_t uid, bool relax,
 			       bool reuseport_cb_ok, bool reuseport_ok)
 	 * checks separately because their spinlocks have to be acquired/released
 	 * independently of each other, to prevent possible deadlocks
 	 */
-	if (inet_use_bhash2_on_bind(sk))
+	if (inet_use_hash2_on_bind(sk))
 		return tb2 && inet_bhash2_conflict(sk, tb2, uid, relax,
 						   reuseport_cb_ok, reuseport_ok);
 		head = &hinfo->bhash[inet_bhashfn(net, port,
 						  hinfo->bhash_size)];
 		spin_lock_bh(&head->lock);
-		if (inet_use_bhash2_on_bind(sk)) {
+		if (inet_use_hash2_on_bind(sk)) {
 			if (inet_bhash2_addr_any_conflict(sk, port, l3mdev, relax, false))
 				goto next_port;
 		}
 				check_bind_conflict = false;
 		}
-		if (check_bind_conflict && inet_use_bhash2_on_bind(sk)) {
+		if (check_bind_conflict && inet_use_hash2_on_bind(sk)) {
 			if (inet_bhash2_addr_any_conflict(sk, port, l3mdev, true, true))
 				goto fail_unlock;
 		}

net/ipv4/udp.c+1−1

@@ -287,7 +287,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum, · 286 unmodified lines
287	} else {	287	} else {
288	hslot = udp_hashslot(udptable, net, snum);	288	hslot = udp_hashslot(udptable, net, snum);
289	spin_lock_bh(&hslot->lock);	289	spin_lock_bh(&hslot->lock);
290	if (hslot->count > 10) {	290	if (inet_use_hash2_on_bind(sk) && hslot->count > 10) {
291	int exist;	291	int exist;
292	unsigned int slot2 = udp_sk(sk)->udp_portaddr_hash ^ snum;	292	unsigned int slot2 = udp_sk(sk)->udp_portaddr_hash ^ snum;
293		293

net/ipv6/addrconf.c+2−2

@@ -2862,7 +2862,7 @@ void addrconf_prefix_rcv(struct net_device dev, u8 opt, int len, bool sllao) · 2861 unmodified lines
2862	fib6_add_gc_list(rt);	2862	fib6_add_gc_list(rt);
2863	} else {	2863	} else {
2864	fib6_clean_expires(rt);	2864	fib6_clean_expires(rt);
2865	fib6_remove_gc_list(rt);	2865	fib6_may_remove_gc_list(net, rt);
2866	}	2866	}
2867		2867
2868	spin_unlock_bh(&table->tb6_lock);	2868	spin_unlock_bh(&table->tb6_lock);
@@ -4840,7 +4840,7 @@ static int modify_prefix_route(struct net net, struct inet6_ifaddr ifp, · 1971 unmodified lines
4840		4840
4841	if (!(flags & RTF_EXPIRES)) {	4841	if (!(flags & RTF_EXPIRES)) {
4842	fib6_clean_expires(f6i);	4842	fib6_clean_expires(f6i);
4843	fib6_remove_gc_list(f6i);	4843	fib6_may_remove_gc_list(net, f6i);
4844	} else {	4844	} else {
4845	fib6_set_expires(f6i, expires);	4845	fib6_set_expires(f6i, expires);
4846	fib6_add_gc_list(f6i);	4846	fib6_add_gc_list(f6i);

net/ipv6/esp6.c+6−3

 		xfrm_dev_resume(skb);
 	} else {
 		if (!err &&
-		    x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)
+		    x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP) {
-			esp_output_tail_tcp(x, skb);
+			err = esp_output_tail_tcp(x, skb);
-		else
+			if (err != -EINPROGRESS)
+				kfree_skb(skb);
+		} else {
 			xfrm_output_resume(skb_to_full_sk(skb), skb, err);
+		}
 	}
 }

net/ipv6/ip6_fib.c+13−2

 					return -EEXIST;
 				if (!(rt->fib6_flags & RTF_EXPIRES)) {
 					fib6_clean_expires(iter);
-					fib6_remove_gc_list(iter);
+					fib6_may_remove_gc_list(info->nl_net, iter);
 				} else {
 					fib6_set_expires(iter, rt->expires);
 					fib6_add_gc_list(iter);
 /*
  *	Garbage collection
  */
+void fib6_age_exceptions(struct fib6_info *rt, struct fib6_gc_args *gc_args,
+			 unsigned long now)
+{
+	bool may_expire = rt->fib6_flags & RTF_EXPIRES && rt->expires;
+	int old_more = gc_args->more;
+	rt6_age_exceptions(rt, gc_args, now);
+	if (!may_expire && old_more == gc_args->more)
+		fib6_remove_gc_list(rt);
+}
 static int fib6_age(struct fib6_info *rt, struct fib6_gc_args *gc_args)
 {
 	 *	Note, that clones are aged out
 	 *	only if they are not in use now.
 	 */
-	rt6_age_exceptions(rt, gc_args, now);
+	fib6_age_exceptions(rt, gc_args, now);
 	return 0;
 }

net/ipv6/netfilter/ip6t_rt.c+4−0

 		pr_debug("unknown flags %X\n", rtinfo->invflags);
 		return -EINVAL;
 	}
+	if (rtinfo->addrnr > IP6T_RT_HOPS) {
+		pr_debug("too many addresses specified\n");
+		return -EINVAL;
+	}
 	if ((rtinfo->flags & (IP6T_RT_RES | IP6T_RT_FST_MASK)) &&
 	    (!(rtinfo->flags & IP6T_RT_TYP) ||
 	     (rtinfo->rt_type != 0) ||

net/ipv6/route.c+1−1

@@ -1033,7 +1033,7 @@ int rt6_route_rcv(struct net_device dev, u8 opt, int len, · 1032 unmodified lines
1033		1033
1034	if (!addrconf_finite_timeout(lifetime)) {	1034	if (!addrconf_finite_timeout(lifetime)) {
1035	fib6_clean_expires(rt);	1035	fib6_clean_expires(rt);
1036	fib6_remove_gc_list(rt);	1036	fib6_may_remove_gc_list(net, rt);
1037	} else {	1037	} else {
1038	fib6_set_expires(rt, jiffies + HZ * lifetime);	1038	fib6_set_expires(rt, jiffies + HZ * lifetime);
1039	fib6_add_gc_list(rt);	1039	fib6_add_gc_list(rt);

net/key/af_key.c+12−7

@@ -3518,7 +3518,7 @@ static int set_sadb_kmaddress(struct sk_buff skb, const struct xfrm_kmaddress · 3517 unmodified lines
3518		3518
3519	static int set_ipsecrequest(struct sk_buff *skb,	3519	static int set_ipsecrequest(struct sk_buff *skb,
3520	uint8_t proto, uint8_t mode, int level,	3520	uint8_t proto, uint8_t mode, int level,
3521	uint32_t reqid, uint8_t family,	3521	uint32_t reqid, sa_family_t family,
3522	const xfrm_address_t src, const xfrm_address_t dst)	3522	const xfrm_address_t src, const xfrm_address_t dst)
3523	{	3523	{
3524	struct sadb_x_ipsecrequest *rq;	3524	struct sadb_x_ipsecrequest *rq;
@@ -3583,12 +3583,17 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, · 58 unmodified lines
3583		3583
3584	/* ipsecrequests */	3584	/* ipsecrequests */
3585	for (i = 0, mp = m; i < num_bundles; i++, mp++) {	3585	for (i = 0, mp = m; i < num_bundles; i++, mp++) {
3586	/* old locator pair */	3586	int pair_size;
3587	size_pol += sizeof(struct sadb_x_ipsecrequest) +	3587
3588	pfkey_sockaddr_pair_size(mp->old_family);	3588	pair_size = pfkey_sockaddr_pair_size(mp->old_family);
3589	/* new locator pair */	3589	if (!pair_size)
3590	size_pol += sizeof(struct sadb_x_ipsecrequest) +	3590	return -EINVAL;
3591	pfkey_sockaddr_pair_size(mp->new_family);	3591	size_pol += sizeof(struct sadb_x_ipsecrequest) + pair_size;
		3592
		3593	pair_size = pfkey_sockaddr_pair_size(mp->new_family);
		3594	if (!pair_size)
		3595	return -EINVAL;
		3596	size_pol += sizeof(struct sadb_x_ipsecrequest) + pair_size;
3592	}	3597	}
3593		3598
3594	size += sizeof(struct sadb_msg) + size_pol;	3599	size += sizeof(struct sadb_msg) + size_pol;

net/netfilter/nf_conntrack_broadcast.c+6−2

@@ -21,6 +21,7 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb, · 20 unmodified lines
21	unsigned int timeout)	21	unsigned int timeout)
22	{	22	{
23	const struct nf_conntrack_helper *helper;	23	const struct nf_conntrack_helper *helper;
		24	struct net *net = read_pnet(&ct->ct_net);
24	struct nf_conntrack_expect *exp;	25	struct nf_conntrack_expect *exp;
25	struct iphdr *iph = ip_hdr(skb);	26	struct iphdr *iph = ip_hdr(skb);
26	struct rtable *rt = skb_rtable(skb);	27	struct rtable *rt = skb_rtable(skb);
@@ -70,8 +71,11 @@ int nf_conntrack_broadcast_help(struct sk_buff *skb, · 43 unmodified lines
70	exp->expectfn = NULL;	71	exp->expectfn = NULL;
71	exp->flags = NF_CT_EXPECT_PERMANENT;	72	exp->flags = NF_CT_EXPECT_PERMANENT;
72	exp->class = NF_CT_EXPECT_CLASS_DEFAULT;	73	exp->class = NF_CT_EXPECT_CLASS_DEFAULT;
73	exp->helper = NULL;	74	rcu_assign_pointer(exp->helper, helper);
74		75	write_pnet(&exp->net, net);
		76	#ifdef CONFIG_NF_CONNTRACK_ZONES
		77	exp->zone = ct->zone;
		78	#endif
75	nf_ct_expect_related(exp, 0);	79	nf_ct_expect_related(exp, 0);
76	nf_ct_expect_put(exp);	80	nf_ct_expect_put(exp);
77		81

net/netfilter/nf_conntrack_ecache.c+2−0

@@ -247,6 +247,8 @@ void nf_ct_expect_event_report(enum ip_conntrack_expect_events event, · 246 unmodified lines
247	struct nf_ct_event_notifier *notify;	247	struct nf_ct_event_notifier *notify;
248	struct nf_conntrack_ecache *e;	248	struct nf_conntrack_ecache *e;
249		249
		250	lockdep_nfct_expect_lock_held();
		251
250	rcu_read_lock();	252	rcu_read_lock();
251	notify = rcu_dereference(net->ct.nf_conntrack_event_cb);	253	notify = rcu_dereference(net->ct.nf_conntrack_event_cb);
252	if (!notify)	254	if (!notify)

net/netfilter/nf_conntrack_expect.c+34−5

@@ -51,6 +51,7 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp, · 50 unmodified lines
51	struct net *net = nf_ct_exp_net(exp);	51	struct net *net = nf_ct_exp_net(exp);
52	struct nf_conntrack_net *cnet;	52	struct nf_conntrack_net *cnet;
53		53
		54	lockdep_nfct_expect_lock_held();
54	WARN_ON(!master_help);	55	WARN_ON(!master_help);
55	WARN_ON(timer_pending(&exp->timeout));	56	WARN_ON(timer_pending(&exp->timeout));
56		57
@@ -112,12 +113,14 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple, · 55 unmodified lines
112	const struct net *net)	113	const struct net *net)
113	{	114	{
114	return nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) &&	115	return nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask) &&
115	net_eq(net, nf_ct_net(i->master)) &&	116	net_eq(net, read_pnet(&i->net)) &&
116	nf_ct_zone_equal_any(i->master, zone);	117	nf_ct_exp_zone_equal_any(i, zone);
117	}	118	}
118		119
119	bool nf_ct_remove_expect(struct nf_conntrack_expect *exp)	120	bool nf_ct_remove_expect(struct nf_conntrack_expect *exp)
120	{	121	{
		122	lockdep_nfct_expect_lock_held();
		123
121	if (timer_delete(&exp->timeout)) {	124	if (timer_delete(&exp->timeout)) {
122	nf_ct_unlink_expect(exp);	125	nf_ct_unlink_expect(exp);
123	nf_ct_expect_put(exp);	126	nf_ct_expect_put(exp);
@@ -177,6 +180,8 @@ nf_ct_find_expectation(struct net *net, · 53 unmodified lines
177	struct nf_conntrack_expect i, exp = NULL;	180	struct nf_conntrack_expect i, exp = NULL;
178	unsigned int h;	181	unsigned int h;
179		182
		183	lockdep_nfct_expect_lock_held();
		184
180	if (!cnet->expect_count)	185	if (!cnet->expect_count)
181	return NULL;	186	return NULL;
182		187
@@ -309,12 +314,20 @@ struct nf_conntrack_expect nf_ct_expect_alloc(struct nf_conn me) · 126 unmodified lines
309	}	314	}
310	EXPORT_SYMBOL_GPL(nf_ct_expect_alloc);	315	EXPORT_SYMBOL_GPL(nf_ct_expect_alloc);
311		316
		317	/* This function can only be used from packet path, where accessing
		318	* master's helper is safe, because the packet holds a reference on
		319	* the conntrack object. Never use it from control plane.
		320	*/
312	void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,	321	void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
313	u_int8_t family,	322	u_int8_t family,
314	const union nf_inet_addr *saddr,	323	const union nf_inet_addr *saddr,
315	const union nf_inet_addr *daddr,	324	const union nf_inet_addr *daddr,
316	u_int8_t proto, const __be16 src, const __be16 dst)	325	u_int8_t proto, const __be16 src, const __be16 dst)
317	{	326	{
		327	struct nf_conntrack_helper *helper = NULL;
		328	struct nf_conn *ct = exp->master;
		329	struct net *net = read_pnet(&ct->ct_net);
		330	struct nf_conn_help *help;
318	int len;	331	int len;
319		332
320	if (family == AF_INET)	333	if (family == AF_INET)
@@ -325,7 +338,16 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class, · 4 unmodified lines
325	exp->flags = 0;	338	exp->flags = 0;
326	exp->class = class;	339	exp->class = class;
327	exp->expectfn = NULL;	340	exp->expectfn = NULL;
328	exp->helper = NULL;	341
		342	help = nfct_help(ct);
		343	if (help)
		344	helper = rcu_dereference(help->helper);
		345
		346	rcu_assign_pointer(exp->helper, helper);
		347	write_pnet(&exp->net, net);
		348	#ifdef CONFIG_NF_CONNTRACK_ZONES
		349	exp->zone = ct->zone;
		350	#endif
329	exp->tuple.src.l3num = family;	351	exp->tuple.src.l3num = family;
330	exp->tuple.dst.protonum = proto;	352	exp->tuple.dst.protonum = proto;
331		353
@@ -442,6 +464,8 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect, · 110 unmodified lines
442	unsigned int h;	464	unsigned int h;
443	int ret = 0;	465	int ret = 0;
444		466
		467	lockdep_nfct_expect_lock_held();
		468
445	if (!master_help) {	469	if (!master_help) {
446	ret = -ESHUTDOWN;	470	ret = -ESHUTDOWN;
447	goto out;	471	goto out;
@@ -498,8 +522,9 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, · 50 unmodified lines
498		522
499	nf_ct_expect_insert(expect);	523	nf_ct_expect_insert(expect);
500		524
501	spin_unlock_bh(&nf_conntrack_expect_lock);
502	nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report);	525	nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report);
		526	spin_unlock_bh(&nf_conntrack_expect_lock);
		527
503	return 0;	528	return 0;
504	out:	529	out:
505	spin_unlock_bh(&nf_conntrack_expect_lock);	530	spin_unlock_bh(&nf_conntrack_expect_lock);
@@ -627,11 +652,15 @@ static int exp_seq_show(struct seq_file s, void v) · 121 unmodified lines
627	{	652	{
628	struct nf_conntrack_expect *expect;	653	struct nf_conntrack_expect *expect;
629	struct nf_conntrack_helper *helper;	654	struct nf_conntrack_helper *helper;
		655	struct net *net = seq_file_net(s);
630	struct hlist_node *n = v;	656	struct hlist_node *n = v;
631	char *delim = "";	657	char *delim = "";
632		658
633	expect = hlist_entry(n, struct nf_conntrack_expect, hnode);	659	expect = hlist_entry(n, struct nf_conntrack_expect, hnode);
634		660
		661	if (!net_eq(nf_ct_exp_net(expect), net))
		662	return 0;
		663
635	if (expect->timeout.function)	664	if (expect->timeout.function)
636	seq_printf(s, "%ld ", timer_pending(&expect->timeout)	665	seq_printf(s, "%ld ", timer_pending(&expect->timeout)
637	? (long)(expect->timeout.expires - jiffies)/HZ : 0);	666	? (long)(expect->timeout.expires - jiffies)/HZ : 0);
@@ -654,7 +683,7 @@ static int exp_seq_show(struct seq_file s, void v) · 16 unmodified lines
654	if (expect->flags & NF_CT_EXPECT_USERSPACE)	683	if (expect->flags & NF_CT_EXPECT_USERSPACE)
655	seq_printf(s, "%sUSERSPACE", delim);	684	seq_printf(s, "%sUSERSPACE", delim);
656		685
657	helper = rcu_dereference(nfct_help(expect->master)->helper);	686	helper = rcu_dereference(expect->helper);
658	if (helper) {	687	if (helper) {
659	seq_printf(s, "%s%s", expect->flags ? " " : "", helper->name);	688	seq_printf(s, "%s%s", expect->flags ? " " : "", helper->name);
660	if (helper->expect_policy[expect->class].name[0])	689	if (helper->expect_policy[expect->class].name[0])

net/netfilter/nf_conntrack_h323_main.c+6−6

@@ -643,7 +643,7 @@ static int expect_h245(struct sk_buff skb, struct nf_conn ct, · 642 unmodified lines
643	&ct->tuplehash[!dir].tuple.src.u3,	643	&ct->tuplehash[!dir].tuple.src.u3,
644	&ct->tuplehash[!dir].tuple.dst.u3,	644	&ct->tuplehash[!dir].tuple.dst.u3,
645	IPPROTO_TCP, NULL, &port);	645	IPPROTO_TCP, NULL, &port);
646	exp->helper = &nf_conntrack_helper_h245;	646	rcu_assign_pointer(exp->helper, &nf_conntrack_helper_h245);
647		647
648	nathook = rcu_dereference(nfct_h323_nat_hook);	648	nathook = rcu_dereference(nfct_h323_nat_hook);
649	if (memcmp(&ct->tuplehash[dir].tuple.src.u3,	649	if (memcmp(&ct->tuplehash[dir].tuple.src.u3,
@@ -767,7 +767,7 @@ static int expect_callforwarding(struct sk_buff *skb, · 117 unmodified lines
767	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),	767	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
768	&ct->tuplehash[!dir].tuple.src.u3, &addr,	768	&ct->tuplehash[!dir].tuple.src.u3, &addr,
769	IPPROTO_TCP, NULL, &port);	769	IPPROTO_TCP, NULL, &port);
770	exp->helper = nf_conntrack_helper_q931;	770	rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931);
771		771
772	nathook = rcu_dereference(nfct_h323_nat_hook);	772	nathook = rcu_dereference(nfct_h323_nat_hook);
773	if (memcmp(&ct->tuplehash[dir].tuple.src.u3,	773	if (memcmp(&ct->tuplehash[dir].tuple.src.u3,
@@ -1234,7 +1234,7 @@ static int expect_q931(struct sk_buff skb, struct nf_conn ct, · 460 unmodified lines
1234	&ct->tuplehash[!dir].tuple.src.u3 : NULL,	1234	&ct->tuplehash[!dir].tuple.src.u3 : NULL,
1235	&ct->tuplehash[!dir].tuple.dst.u3,	1235	&ct->tuplehash[!dir].tuple.dst.u3,
1236	IPPROTO_TCP, NULL, &port);	1236	IPPROTO_TCP, NULL, &port);
1237	exp->helper = nf_conntrack_helper_q931;	1237	rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931);
1238	exp->flags = NF_CT_EXPECT_PERMANENT; /* Accept multiple calls */	1238	exp->flags = NF_CT_EXPECT_PERMANENT; /* Accept multiple calls */
1239		1239
1240	nathook = rcu_dereference(nfct_h323_nat_hook);	1240	nathook = rcu_dereference(nfct_h323_nat_hook);
@@ -1306,7 +1306,7 @@ static int process_gcf(struct sk_buff skb, struct nf_conn ct, · 65 unmodified lines
1306	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),	1306	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
1307	&ct->tuplehash[!dir].tuple.src.u3, &addr,	1307	&ct->tuplehash[!dir].tuple.src.u3, &addr,
1308	IPPROTO_UDP, NULL, &port);	1308	IPPROTO_UDP, NULL, &port);
1309	exp->helper = nf_conntrack_helper_ras;	1309	rcu_assign_pointer(exp->helper, nf_conntrack_helper_ras);
1310		1310
1311	if (nf_ct_expect_related(exp, 0) == 0) {	1311	if (nf_ct_expect_related(exp, 0) == 0) {
1312	pr_debug("nf_ct_ras: expect RAS ");	1312	pr_debug("nf_ct_ras: expect RAS ");
@@ -1523,7 +1523,7 @@ static int process_acf(struct sk_buff skb, struct nf_conn ct, · 210 unmodified lines
1523	&ct->tuplehash[!dir].tuple.src.u3, &addr,	1523	&ct->tuplehash[!dir].tuple.src.u3, &addr,
1524	IPPROTO_TCP, NULL, &port);	1524	IPPROTO_TCP, NULL, &port);
1525	exp->flags = NF_CT_EXPECT_PERMANENT;	1525	exp->flags = NF_CT_EXPECT_PERMANENT;
1526	exp->helper = nf_conntrack_helper_q931;	1526	rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931);
1527		1527
1528	if (nf_ct_expect_related(exp, 0) == 0) {	1528	if (nf_ct_expect_related(exp, 0) == 0) {
1529	pr_debug("nf_ct_ras: expect Q.931 ");	1529	pr_debug("nf_ct_ras: expect Q.931 ");
@@ -1577,7 +1577,7 @@ static int process_lcf(struct sk_buff skb, struct nf_conn ct, · 47 unmodified lines
1577	&ct->tuplehash[!dir].tuple.src.u3, &addr,	1577	&ct->tuplehash[!dir].tuple.src.u3, &addr,
1578	IPPROTO_TCP, NULL, &port);	1578	IPPROTO_TCP, NULL, &port);
1579	exp->flags = NF_CT_EXPECT_PERMANENT;	1579	exp->flags = NF_CT_EXPECT_PERMANENT;
1580	exp->helper = nf_conntrack_helper_q931;	1580	rcu_assign_pointer(exp->helper, nf_conntrack_helper_q931);
1581		1581
1582	if (nf_ct_expect_related(exp, 0) == 0) {	1582	if (nf_ct_expect_related(exp, 0) == 0) {
1583	pr_debug("nf_ct_ras: expect Q.931 ");	1583	pr_debug("nf_ct_ras: expect Q.931 ");

net/netfilter/nf_conntrack_helper.c+6−5

 static bool expect_iter_me(struct nf_conntrack_expect *exp, void *data)
 {
-	struct nf_conn_help *help = nfct_help(exp->master);
 	const struct nf_conntrack_helper *me = data;
 	const struct nf_conntrack_helper *this;
-	if (exp->helper == me)
+	this = rcu_dereference_protected(exp->helper,
-		return true;
-	this = rcu_dereference_protected(help->helper,
 					 lockdep_is_held(&nf_conntrack_expect_lock));
 	return this == me;
 }
 	nf_ct_expect_iterate_destroy(expect_iter_me, NULL);
 	nf_ct_iterate_destroy(unhelp, me);
+	/* nf_ct_iterate_destroy() does an unconditional synchronize_rcu() as
+	 * last step, this ensures rcu readers of exp->helper are done.
+	 * No need for another synchronize_rcu() here.
+	 */
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister);

net/netfilter/nf_conntrack_netlink.c+40−35

@@ -910,8 +910,8 @@ struct ctnetlink_filter { · 909 unmodified lines
910	};	910	};
911		911
912	static const struct nla_policy cta_filter_nla_policy[CTA_FILTER_MAX + 1] = {	912	static const struct nla_policy cta_filter_nla_policy[CTA_FILTER_MAX + 1] = {
913	[CTA_FILTER_ORIG_FLAGS] = { .type = NLA_U32 },	913	[CTA_FILTER_ORIG_FLAGS] = NLA_POLICY_MASK(NLA_U32, CTA_FILTER_F_ALL),
914	[CTA_FILTER_REPLY_FLAGS] = { .type = NLA_U32 },	914	[CTA_FILTER_REPLY_FLAGS] = NLA_POLICY_MASK(NLA_U32, CTA_FILTER_F_ALL),
915	};	915	};
916		916
917	static int ctnetlink_parse_filter(const struct nlattr *attr,	917	static int ctnetlink_parse_filter(const struct nlattr *attr,
@@ -925,17 +925,11 @@ static int ctnetlink_parse_filter(const struct nlattr *attr, · 7 unmodified lines
925	if (ret)	925	if (ret)
926	return ret;	926	return ret;
927		927
928	if (tb[CTA_FILTER_ORIG_FLAGS]) {	928	if (tb[CTA_FILTER_ORIG_FLAGS])
929	filter->orig_flags = nla_get_u32(tb[CTA_FILTER_ORIG_FLAGS]);	929	filter->orig_flags = nla_get_u32(tb[CTA_FILTER_ORIG_FLAGS]);
930	if (filter->orig_flags & ~CTA_FILTER_F_ALL)
931	return -EOPNOTSUPP;
932	}
933		930
934	if (tb[CTA_FILTER_REPLY_FLAGS]) {	931	if (tb[CTA_FILTER_REPLY_FLAGS])
935	filter->reply_flags = nla_get_u32(tb[CTA_FILTER_REPLY_FLAGS]);	932	filter->reply_flags = nla_get_u32(tb[CTA_FILTER_REPLY_FLAGS]);
936	if (filter->reply_flags & ~CTA_FILTER_F_ALL)
937	return -EOPNOTSUPP;
938	}
939		933
940	return 0;	934	return 0;
941	}	935	}
@@ -2634,7 +2628,7 @@ static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = { · 1692 unmodified lines
2634	[CTA_EXPECT_HELP_NAME] = { .type = NLA_NUL_STRING,	2628	[CTA_EXPECT_HELP_NAME] = { .type = NLA_NUL_STRING,
2635	.len = NF_CT_HELPER_NAME_LEN - 1 },	2629	.len = NF_CT_HELPER_NAME_LEN - 1 },
2636	[CTA_EXPECT_ZONE] = { .type = NLA_U16 },	2630	[CTA_EXPECT_ZONE] = { .type = NLA_U16 },
2637	[CTA_EXPECT_FLAGS] = { .type = NLA_U32 },	2631	[CTA_EXPECT_FLAGS] = NLA_POLICY_MASK(NLA_BE32, NF_CT_EXPECT_MASK),
2638	[CTA_EXPECT_CLASS] = { .type = NLA_U32 },	2632	[CTA_EXPECT_CLASS] = { .type = NLA_U32 },
2639	[CTA_EXPECT_NAT] = { .type = NLA_NESTED },	2633	[CTA_EXPECT_NAT] = { .type = NLA_NESTED },
2640	[CTA_EXPECT_FN] = { .type = NLA_NUL_STRING },	2634	[CTA_EXPECT_FN] = { .type = NLA_NUL_STRING },
@@ -3012,7 +3006,7 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb, · 371 unmodified lines
3012	{	3006	{
3013	struct nf_conn *master = exp->master;	3007	struct nf_conn *master = exp->master;
3014	long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;	3008	long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;
3015	struct nf_conn_help *help;	3009	struct nf_conntrack_helper *helper;
3016	#if IS_ENABLED(CONFIG_NF_NAT)	3010	#if IS_ENABLED(CONFIG_NF_NAT)
3017	struct nlattr *nest_parms;	3011	struct nlattr *nest_parms;
3018	struct nf_conntrack_tuple nat_tuple = {};	3012	struct nf_conntrack_tuple nat_tuple = {};
@@ -3057,15 +3051,12 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb, · 38 unmodified lines
3057	nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) \|\|	3051	nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) \|\|
3058	nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class)))	3052	nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class)))
3059	goto nla_put_failure;	3053	goto nla_put_failure;
3060	help = nfct_help(master);
3061	if (help) {
3062	struct nf_conntrack_helper *helper;
3063		3054
3064	helper = rcu_dereference(help->helper);	3055	helper = rcu_dereference(exp->helper);
3065	if (helper &&	3056	if (helper &&
3066	nla_put_string(skb, CTA_EXPECT_HELP_NAME, helper->name))	3057	nla_put_string(skb, CTA_EXPECT_HELP_NAME, helper->name))
3067	goto nla_put_failure;	3058	goto nla_put_failure;
3068	}	3059
3069	expfn = nf_ct_helper_expectfn_find_by_symbol(exp->expectfn);	3060	expfn = nf_ct_helper_expectfn_find_by_symbol(exp->expectfn);
3070	if (expfn != NULL &&	3061	if (expfn != NULL &&
3071	nla_put_string(skb, CTA_EXPECT_FN, expfn->name))	3062	nla_put_string(skb, CTA_EXPECT_FN, expfn->name))
@@ -3358,31 +3349,37 @@ static int ctnetlink_get_expect(struct sk_buff *skb, · 286 unmodified lines
3358	if (err < 0)	3349	if (err < 0)
3359	return err;	3350	return err;
3360		3351
		3352	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
		3353	if (!skb2)
		3354	return -ENOMEM;
		3355
		3356	spin_lock_bh(&nf_conntrack_expect_lock);
3361	exp = nf_ct_expect_find_get(info->net, &zone, &tuple);	3357	exp = nf_ct_expect_find_get(info->net, &zone, &tuple);
3362	if (!exp)	3358	if (!exp) {
		3359	spin_unlock_bh(&nf_conntrack_expect_lock);
		3360	kfree_skb(skb2);
3363	return -ENOENT;	3361	return -ENOENT;
		3362	}
3364		3363
3365	if (cda[CTA_EXPECT_ID]) {	3364	if (cda[CTA_EXPECT_ID]) {
3366	__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);	3365	__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
3367		3366
3368	if (id != nf_expect_get_id(exp)) {	3367	if (id != nf_expect_get_id(exp)) {
3369	nf_ct_expect_put(exp);	3368	nf_ct_expect_put(exp);
		3369	spin_unlock_bh(&nf_conntrack_expect_lock);
		3370	kfree_skb(skb2);
3370	return -ENOENT;	3371	return -ENOENT;
3371	}	3372	}
3372	}	3373	}
3373		3374
3374	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3375	if (!skb2) {
3376	nf_ct_expect_put(exp);
3377	return -ENOMEM;
3378	}
3379
3380	rcu_read_lock();	3375	rcu_read_lock();
3381	err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid,	3376	err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid,
3382	info->nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW,	3377	info->nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW,
3383	exp);	3378	exp);
3384	rcu_read_unlock();	3379	rcu_read_unlock();
3385	nf_ct_expect_put(exp);	3380	nf_ct_expect_put(exp);
		3381	spin_unlock_bh(&nf_conntrack_expect_lock);
		3382
3386	if (err <= 0) {	3383	if (err <= 0) {
3387	kfree_skb(skb2);	3384	kfree_skb(skb2);
3388	return -ENOMEM;	3385	return -ENOMEM;
@@ -3394,12 +3391,9 @@ static int ctnetlink_get_expect(struct sk_buff *skb, · 5 unmodified lines
3394	static bool expect_iter_name(struct nf_conntrack_expect exp, void data)	3391	static bool expect_iter_name(struct nf_conntrack_expect exp, void data)
3395	{	3392	{
3396	struct nf_conntrack_helper *helper;	3393	struct nf_conntrack_helper *helper;
3397	const struct nf_conn_help *m_help;
3398	const char *name = data;	3394	const char *name = data;
3399		3395
3400	m_help = nfct_help(exp->master);	3396	helper = rcu_dereference(exp->helper);
3401
3402	helper = rcu_dereference(m_help->helper);
3403	if (!helper)	3397	if (!helper)
3404	return false;	3398	return false;
3405		3399
@@ -3432,22 +3426,26 @@ static int ctnetlink_del_expect(struct sk_buff *skb, · 26 unmodified lines
3432	if (err < 0)	3426	if (err < 0)
3433	return err;	3427	return err;
3434		3428
		3429	spin_lock_bh(&nf_conntrack_expect_lock);
		3430
3435	/* bump usage count to 2 */	3431	/* bump usage count to 2 */
3436	exp = nf_ct_expect_find_get(info->net, &zone, &tuple);	3432	exp = nf_ct_expect_find_get(info->net, &zone, &tuple);
3437	if (!exp)	3433	if (!exp) {
		3434	spin_unlock_bh(&nf_conntrack_expect_lock);
3438	return -ENOENT;	3435	return -ENOENT;
		3436	}
3439		3437
3440	if (cda[CTA_EXPECT_ID]) {	3438	if (cda[CTA_EXPECT_ID]) {
3441	__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);	3439	__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
3442		3440
3443	if (id != nf_expect_get_id(exp)) {	3441	if (id != nf_expect_get_id(exp)) {
3444	nf_ct_expect_put(exp);	3442	nf_ct_expect_put(exp);
		3443	spin_unlock_bh(&nf_conntrack_expect_lock);
3445	return -ENOENT;	3444	return -ENOENT;
3446	}	3445	}
3447	}	3446	}
3448		3447
3449	/* after list removal, usage count == 1 */	3448	/* after list removal, usage count == 1 */
3450	spin_lock_bh(&nf_conntrack_expect_lock);
3451	if (timer_delete(&exp->timeout)) {	3449	if (timer_delete(&exp->timeout)) {
3452	nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid,	3450	nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid,
3453	nlmsg_report(info->nlh));	3451	nlmsg_report(info->nlh));
@@ -3534,9 +3532,10 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, · 80 unmodified lines
3534	struct nf_conntrack_tuple *tuple,	3532	struct nf_conntrack_tuple *tuple,
3535	struct nf_conntrack_tuple *mask)	3533	struct nf_conntrack_tuple *mask)
3536	{	3534	{
3537	u_int32_t class = 0;	3535	struct net *net = read_pnet(&ct->ct_net);
3538	struct nf_conntrack_expect *exp;	3536	struct nf_conntrack_expect *exp;
3539	struct nf_conn_help *help;	3537	struct nf_conn_help *help;
		3538	u32 class = 0;
3540	int err;	3539	int err;
3541		3540
3542	help = nfct_help(ct);	3541	help = nfct_help(ct);
@@ -3573,7 +3572,13 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, · 30 unmodified lines
3573		3572
3574	exp->class = class;	3573	exp->class = class;
3575	exp->master = ct;	3574	exp->master = ct;
3576	exp->helper = helper;	3575	write_pnet(&exp->net, net);
		3576	#ifdef CONFIG_NF_CONNTRACK_ZONES
		3577	exp->zone = ct->zone;
		3578	#endif
		3579	if (!helper)
		3580	helper = rcu_dereference(help->helper);
		3581	rcu_assign_pointer(exp->helper, helper);
3577	exp->tuple = *tuple;	3582	exp->tuple = *tuple;
3578	exp->mask.src.u3 = mask->src.u3;	3583	exp->mask.src.u3 = mask->src.u3;
3579	exp->mask.src.u.all = mask->src.u.all;	3584	exp->mask.src.u.all = mask->src.u.all;

net/netfilter/nf_conntrack_proto_tcp.c+3−7

 }
 static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = {
-	[CTA_PROTOINFO_TCP_STATE]	    = { .type = NLA_U8 },
+	[CTA_PROTOINFO_TCP_STATE]	    = NLA_POLICY_MAX(NLA_U8, TCP_CONNTRACK_SYN_SENT2),
-	[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = { .type = NLA_U8 },
+	[CTA_PROTOINFO_TCP_WSCALE_ORIGINAL] = NLA_POLICY_MAX(NLA_U8, TCP_MAX_WSCALE),
-	[CTA_PROTOINFO_TCP_WSCALE_REPLY]    = { .type = NLA_U8 },
+	[CTA_PROTOINFO_TCP_WSCALE_REPLY]    = NLA_POLICY_MAX(NLA_U8, TCP_MAX_WSCALE),
 	[CTA_PROTOINFO_TCP_FLAGS_ORIGINAL]  = { .len = sizeof(struct nf_ct_tcp_flags) },
 	[CTA_PROTOINFO_TCP_FLAGS_REPLY]	    = { .len = sizeof(struct nf_ct_tcp_flags) },
 };
 	if (err < 0)
 		return err;
-	if (tb[CTA_PROTOINFO_TCP_STATE] &&
-	    nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]) >= TCP_CONNTRACK_MAX)
-		return -EINVAL;
 	spin_lock_bh(&ct->lock);
 	if (tb[CTA_PROTOINFO_TCP_STATE])
 		ct->proto.tcp.state = nla_get_u8(tb[CTA_PROTOINFO_TCP_STATE]);

net/netfilter/nf_conntrack_sip.c+12−6

 		exp = __nf_ct_expect_find(net, nf_ct_zone(ct), &tuple);
 		if (!exp || exp->master == ct ||
-		    nfct_help(exp->master)->helper != nfct_help(ct)->helper ||
+		    exp->helper != nfct_help(ct)->helper ||
 		    exp->class != class)
 			break;
 #if IS_ENABLED(CONFIG_NF_NAT)
 	unsigned int port;
 	const struct sdp_media_type *t;
 	int ret = NF_ACCEPT;
+	bool have_rtp_addr = false;
 	hooks = rcu_dereference(nf_nat_sip_hooks);
 	caddr_len = 0;
 	if (ct_sip_parse_sdp_addr(ct, *dptr, sdpoff, *datalen,
 				  SDP_HDR_CONNECTION, SDP_HDR_MEDIA,
-				  &matchoff, &matchlen, &caddr) > 0)
+				  &matchoff, &matchlen, &caddr) > 0) {
 		caddr_len = matchlen;
+		memcpy(&rtp_addr, &caddr, sizeof(rtp_addr));
+		have_rtp_addr = true;
+	}
 	mediaoff = sdpoff;
 	for (i = 0; i < ARRAY_SIZE(sdp_media_types); ) {
 					  &matchoff, &matchlen, &maddr) > 0) {
 			maddr_len = matchlen;
 			memcpy(&rtp_addr, &maddr, sizeof(rtp_addr));
-		} else if (caddr_len)
+			have_rtp_addr = true;
+		} else if (caddr_len) {
 			memcpy(&rtp_addr, &caddr, sizeof(rtp_addr));
-		else {
+			have_rtp_addr = true;
+		} else {
 			nf_ct_helper_log(skb, ct, "cannot parse SDP message");
 			return NF_DROP;
 		}
 	/* Update session connection and owner addresses */
 	hooks = rcu_dereference(nf_nat_sip_hooks);
-	if (hooks && ct->status & IPS_NAT_MASK)
+	if (hooks && ct->status & IPS_NAT_MASK && have_rtp_addr)
 		ret = hooks->sdp_session(skb, protoff, dataoff,
 					 dptr, datalen, sdpoff,
 					 &rtp_addr);
 	nf_ct_expect_init(exp, SIP_EXPECT_SIGNALLING, nf_ct_l3num(ct),
 			  saddr, &daddr, proto, NULL, &port);
 	exp->timeout.expires = sip_timeout * HZ;
-	exp->helper = helper;
+	rcu_assign_pointer(exp->helper, helper);
 	exp->flags = NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE;
 	hooks = rcu_dereference(nf_nat_sip_hooks);

net/netfilter/nfnetlink_log.c+2−6

 	if (data_len) {
 		struct nlattr *nla;
-		int size = nla_attr_size(data_len);
-		if (skb_tailroom(inst->skb) < nla_total_size(data_len))
+		nla = nla_reserve(inst->skb, NFULA_PAYLOAD, data_len);
+		if (!nla)
 			goto nla_put_failure;
-		nla = skb_put(inst->skb, nla_total_size(data_len));
-		nla->nla_type = NFULA_PAYLOAD;
-		nla->nla_len = size;
 		if (skb_copy_bits(skb, 0, nla_data(nla), data_len))
 			BUG();
 	}

net/netfilter/nft_set_pipapo_avx2.c+10−10

@@ -242,7 +242,7 @@ static int nft_pipapo_avx2_lookup_4b_2(unsigned long map, unsigned long fill, · 241 unmodified lines
242		242
243	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);	243	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
244	if (last)	244	if (last)
245	return b;	245	ret = b;
246		246
247	if (unlikely(ret == -1))	247	if (unlikely(ret == -1))
248	ret = b / XSAVE_YMM_SIZE;	248	ret = b / XSAVE_YMM_SIZE;
@@ -319,7 +319,7 @@ static int nft_pipapo_avx2_lookup_4b_4(unsigned long map, unsigned long fill, · 70 unmodified lines
319		319
320	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);	320	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
321	if (last)	321	if (last)
322	return b;	322	ret = b;
323		323
324	if (unlikely(ret == -1))	324	if (unlikely(ret == -1))
325	ret = b / XSAVE_YMM_SIZE;	325	ret = b / XSAVE_YMM_SIZE;
@@ -414,7 +414,7 @@ static int nft_pipapo_avx2_lookup_4b_8(unsigned long map, unsigned long fill, · 88 unmodified lines
414		414
415	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);	415	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
416	if (last)	416	if (last)
417	return b;	417	ret = b;
418		418
419	if (unlikely(ret == -1))	419	if (unlikely(ret == -1))
420	ret = b / XSAVE_YMM_SIZE;	420	ret = b / XSAVE_YMM_SIZE;
@@ -505,7 +505,7 @@ static int nft_pipapo_avx2_lookup_4b_12(unsigned long map, unsigned long fill, · 84 unmodified lines
505		505
506	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);	506	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
507	if (last)	507	if (last)
508	return b;	508	ret = b;
509		509
510	if (unlikely(ret == -1))	510	if (unlikely(ret == -1))
511	ret = b / XSAVE_YMM_SIZE;	511	ret = b / XSAVE_YMM_SIZE;
@@ -641,7 +641,7 @@ static int nft_pipapo_avx2_lookup_4b_32(unsigned long map, unsigned long fill, · 129 unmodified lines
641		641
642	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);	642	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
643	if (last)	643	if (last)
644	return b;	644	ret = b;
645		645
646	if (unlikely(ret == -1))	646	if (unlikely(ret == -1))
647	ret = b / XSAVE_YMM_SIZE;	647	ret = b / XSAVE_YMM_SIZE;
@@ -699,7 +699,7 @@ static int nft_pipapo_avx2_lookup_8b_1(unsigned long map, unsigned long fill, · 51 unmodified lines
699		699
700	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);	700	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
701	if (last)	701	if (last)
702	return b;	702	ret = b;
703		703
704	if (unlikely(ret == -1))	704	if (unlikely(ret == -1))
705	ret = b / XSAVE_YMM_SIZE;	705	ret = b / XSAVE_YMM_SIZE;
@@ -764,7 +764,7 @@ static int nft_pipapo_avx2_lookup_8b_2(unsigned long map, unsigned long fill, · 58 unmodified lines
764		764
765	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);	765	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
766	if (last)	766	if (last)
767	return b;	767	ret = b;
768		768
769	if (unlikely(ret == -1))	769	if (unlikely(ret == -1))
770	ret = b / XSAVE_YMM_SIZE;	770	ret = b / XSAVE_YMM_SIZE;
@@ -839,7 +839,7 @@ static int nft_pipapo_avx2_lookup_8b_4(unsigned long map, unsigned long fill, · 68 unmodified lines
839		839
840	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);	840	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
841	if (last)	841	if (last)
842	return b;	842	ret = b;
843		843
844	if (unlikely(ret == -1))	844	if (unlikely(ret == -1))
845	ret = b / XSAVE_YMM_SIZE;	845	ret = b / XSAVE_YMM_SIZE;
@@ -925,7 +925,7 @@ static int nft_pipapo_avx2_lookup_8b_6(unsigned long map, unsigned long fill, · 79 unmodified lines
925		925
926	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);	926	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
927	if (last)	927	if (last)
928	return b;	928	ret = b;
929		929
930	if (unlikely(ret == -1))	930	if (unlikely(ret == -1))
931	ret = b / XSAVE_YMM_SIZE;	931	ret = b / XSAVE_YMM_SIZE;
@@ -1019,7 +1019,7 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long map, unsigned long fill, · 87 unmodified lines
1019		1019
1020	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);	1020	b = nft_pipapo_avx2_refill(i_ul, &map[i_ul], fill, f->mt, last);
1021	if (last)	1021	if (last)
1022	return b;	1022	ret = b;
1023		1023
1024	if (unlikely(ret == -1))	1024	if (unlikely(ret == -1))
1025	ret = b / XSAVE_YMM_SIZE;	1025	ret = b / XSAVE_YMM_SIZE;

net/netfilter/nft_set_rbtree.c+75−17

 	return array;
 }
-#define NFT_ARRAY_EXTRA_SIZE	10240
 /* Similar to nft_rbtree_{u,k}size to hide details to userspace, but consider
  * packed representation coming from userspace for anonymous sets too.
  */
 static u32 nft_array_elems(const struct nft_set *set)
 {
-	u32 nelems = atomic_read(&set->nelems);
+	u32 nelems = atomic_read(&set->nelems) - set->ndeact;
 	/* Adjacent intervals are represented with a single start element in
 	 * anonymous sets, use the current element counter as is.
 	return (nelems / 2) + 2;
 }
-static int nft_array_may_resize(const struct nft_set *set)
+#define NFT_ARRAY_INITIAL_SIZE		1024
+#define NFT_ARRAY_INITIAL_ANON_SIZE	16
+#define NFT_ARRAY_INITIAL_ANON_THRESH	(8192U / sizeof(struct nft_array_interval))
+static int nft_array_may_resize(const struct nft_set *set, bool flush)
 {
-	u32 nelems = nft_array_elems(set), new_max_intervals;
+	u32 initial_intervals, max_intervals, new_max_intervals, delta;
+	u32 shrinked_max_intervals, nelems = nft_array_elems(set);
 	struct nft_rbtree *priv = nft_set_priv(set);
 	struct nft_array *array;
-	if (!priv->array_next) {
+	if (nft_set_is_anonymous(set))
-		array = nft_array_alloc(nelems + NFT_ARRAY_EXTRA_SIZE);
+		initial_intervals = NFT_ARRAY_INITIAL_ANON_SIZE;
-		if (!array)
+	else
-			return -ENOMEM;
+		initial_intervals = NFT_ARRAY_INITIAL_SIZE;
+	if (priv->array_next) {
+		max_intervals = priv->array_next->max_intervals;
+		new_max_intervals = priv->array_next->max_intervals;
+	} else {
+		if (priv->array) {
+			max_intervals = priv->array->max_intervals;
+			new_max_intervals = priv->array->max_intervals;
+		} else {
+			max_intervals = 0;
+			new_max_intervals = initial_intervals;
+		}
+	}
-		priv->array_next = array;
+	if (nft_set_is_anonymous(set))
+		goto maybe_grow;
+	if (flush) {
+		/* Set flush just started, nelems still report elements.*/
+		nelems = 0;
+		new_max_intervals = NFT_ARRAY_INITIAL_SIZE;
+		goto realloc_array;
 	}
-	if (nelems < priv->array_next->max_intervals)
+	if (check_add_overflow(new_max_intervals, new_max_intervals,
-		return 0;
+			       &shrinked_max_intervals))
+		return -EOVERFLOW;
+	shrinked_max_intervals = DIV_ROUND_UP(shrinked_max_intervals, 3);
-	new_max_intervals = priv->array_next->max_intervals + NFT_ARRAY_EXTRA_SIZE;
+	if (shrinked_max_intervals > NFT_ARRAY_INITIAL_SIZE &&
-	if (nft_array_intervals_alloc(priv->array_next, new_max_intervals) < 0)
+	    nelems < shrinked_max_intervals) {
+		new_max_intervals = shrinked_max_intervals;
+		goto realloc_array;
+	}
+maybe_grow:
+	if (nelems > new_max_intervals) {
+		if (nft_set_is_anonymous(set) &&
+		    new_max_intervals < NFT_ARRAY_INITIAL_ANON_THRESH) {
+			new_max_intervals <<= 1;
+		} else {
+			delta = new_max_intervals >> 1;
+			if (check_add_overflow(new_max_intervals, delta,
+					       &new_max_intervals))
+				return -EOVERFLOW;
+		}
+	}
+realloc_array:
+	if (WARN_ON_ONCE(nelems > new_max_intervals))
 		return -ENOMEM;
+	if (priv->array_next) {
+		if (max_intervals == new_max_intervals)
+			return 0;
+		if (nft_array_intervals_alloc(priv->array_next, new_max_intervals) < 0)
+			return -ENOMEM;
+	} else {
+		array = nft_array_alloc(new_max_intervals);
+		if (!array)
+			return -ENOMEM;
+		priv->array_next = array;
+	}
 	return 0;
 }
 	nft_rbtree_maybe_reset_start_cookie(priv, tstamp);
-	if (nft_array_may_resize(set) < 0)
+	if (nft_array_may_resize(set, false) < 0)
 		return -ENOMEM;
 	do {
 	    nft_rbtree_interval_null(set, this))
 		priv->start_rbe_cookie = 0;
-	if (nft_array_may_resize(set) < 0)
+	if (nft_array_may_resize(set, false) < 0)
 		return NULL;
 	while (parent != NULL) {
 	switch (iter->type) {
 	case NFT_ITER_UPDATE_CLONE:
-		if (nft_array_may_resize(set) < 0) {
+		if (nft_array_may_resize(set, true) < 0) {
 			iter->err = -ENOMEM;
 			break;
 		}

net/nfc/nci/core.c+6−4

 	skb_queue_purge(&ndev->rx_q);
 	skb_queue_purge(&ndev->tx_q);
-	/* Flush RX and TX wq */
+	/* Flush TX wq, RX wq flush can't be under the lock */
-	flush_workqueue(ndev->rx_wq);
 	flush_workqueue(ndev->tx_wq);
 	/* Reset device */
 		      msecs_to_jiffies(NCI_RESET_TIMEOUT));
 	/* After this point our queues are empty
-	 * and no works are scheduled.
+	 * rx work may be running but will see that NCI_UP was cleared
 	 */
 	ndev->ops->close(ndev);
 	clear_bit(NCI_INIT, &ndev->flags);
-	/* Flush cmd wq */
+	/* Flush cmd and tx wq */
 	flush_workqueue(ndev->cmd_wq);
 	timer_delete_sync(&ndev->cmd_timer);
 	mutex_unlock(&ndev->req_lock);
+	/* rx_work may take req_lock via nci_deactivate_target */
+	flush_workqueue(ndev->rx_wq);
 	return 0;
 }

net/openvswitch/flow_netlink.c+2−0

@@ -2953,6 +2953,8 @@ static int validate_set(const struct nlattr *a, · 2952 unmodified lines
2953	case OVS_KEY_ATTR_MPLS:	2953	case OVS_KEY_ATTR_MPLS:
2954	if (!eth_p_mpls(eth_type))	2954	if (!eth_p_mpls(eth_type))
2955	return -EINVAL;	2955	return -EINVAL;
		2956	if (key_len != sizeof(struct ovs_key_mpls))
		2957	return -EINVAL;
2956	break;	2958	break;
2957		2959
2958	case OVS_KEY_ATTR_SCTP:	2960	case OVS_KEY_ATTR_SCTP:

net/openvswitch/vport-netdev.c+8−3

 void ovs_netdev_detach_dev(struct vport *vport)
 {
 	ASSERT_RTNL();
-	vport->dev->priv_flags &= ~IFF_OVS_DATAPATH;
 	netdev_rx_handler_unregister(vport->dev);
 	netdev_upper_dev_unlink(vport->dev,
 				netdev_master_upper_dev_get(vport->dev));
 	dev_set_promiscuity(vport->dev, -1);
+	/* paired with smp_mb() in netdev_destroy() */
+	smp_wmb();
+	vport->dev->priv_flags &= ~IFF_OVS_DATAPATH;
 }
 static void netdev_destroy(struct vport *vport)
 		rtnl_unlock();
 	}
+	/* paired with smp_wmb() in ovs_netdev_detach_dev() */
+	smp_mb();
 	call_rcu(&vport->rcu, vport_netdev_free);
 }
 	 */
 	if (vport->dev->reg_state == NETREG_REGISTERED)
 		rtnl_delete_link(vport->dev, 0, NULL);
-	netdev_put(vport->dev, &vport->dev_tracker);
-	vport->dev = NULL;
 	rtnl_unlock();
 	call_rcu(&vport->rcu, vport_netdev_free);

net/packet/af_packet.c+1−0

@@ -3135,6 +3135,7 @@ static int packet_release(struct socket *sock) · 3134 unmodified lines
3135		3135
3136	spin_lock(&po->bind_lock);	3136	spin_lock(&po->bind_lock);
3137	unregister_prot_hook(sk, false);	3137	unregister_prot_hook(sk, false);
		3138	WRITE_ONCE(po->num, 0);
3138	packet_cached_dev_reset(po);	3139	packet_cached_dev_reset(po);
3139		3140
3140	if (po->prot_hook.dev) {	3141	if (po->prot_hook.dev) {

net/smc/smc_rx.c+8−1

 	sock_put(sk);
 }
+static bool smc_rx_pipe_buf_get(struct pipe_inode_info *pipe,
+				struct pipe_buffer *buf)
+{
+	/* smc_spd_priv in buf->private is not shareable; disallow cloning. */
+	return false;
+}
 static const struct pipe_buf_operations smc_pipe_ops = {
 	.release = smc_rx_pipe_buf_release,
-	.get = generic_pipe_buf_get
+	.get	 = smc_rx_pipe_buf_get,
 };
 static void smc_rx_spd_release(struct splice_pipe_desc *spd,

net/tls/tls_sw.c+1−1

 		crypto_wait_req(-EINPROGRESS, &ctx->async_wait);
 	atomic_inc(&ctx->decrypt_pending);
+	__skb_queue_purge(&ctx->async_hold);
 	return ctx->async_wait.err;
 }
 		/* Wait for all previously submitted records to be decrypted */
 		ret = tls_decrypt_async_wait(ctx);
-		__skb_queue_purge(&ctx->async_hold);
 		if (ret) {
 			if (err >= 0 || err == -EINPROGRESS)

net/xfrm/xfrm_input.c+4−1

 	spin_lock_bh(&xfrm_input_afinfo_lock);
 	if (likely(xfrm_input_afinfo[afinfo->is_ipip][afinfo->family])) {
-		if (unlikely(xfrm_input_afinfo[afinfo->is_ipip][afinfo->family] != afinfo))
+		const struct xfrm_input_afinfo *cur;
+		cur = rcu_access_pointer(xfrm_input_afinfo[afinfo->is_ipip][afinfo->family]);
+		if (unlikely(cur != afinfo))
 			err = -EINVAL;
 		else
 			RCU_INIT_POINTER(xfrm_input_afinfo[afinfo->is_ipip][afinfo->family], NULL);

net/xfrm/xfrm_iptfs.c+14−3

 	    iptfs_skb_can_add_frags(newskb, fragwalk, data, copylen)) {
 		iptfs_skb_add_frags(newskb, fragwalk, data, copylen);
 	} else {
+		if (skb_linearize(newskb)) {
+			XFRM_INC_STATS(xs_net(xtfs->x),
+				       LINUX_MIB_XFRMINBUFFERERROR);
+			goto abandon;
+		}
 		/* copy fragment data into newskb */
 		if (skb_copy_seq_read(st, data, skb_put(newskb, copylen),
 				      copylen)) {
 			iplen = be16_to_cpu(iph->tot_len);
 			iphlen = iph->ihl << 2;
+			if (iplen < iphlen || iphlen < sizeof(*iph)) {
+				XFRM_INC_STATS(net,
+					       LINUX_MIB_XFRMINHDRERROR);
+				goto done;
+			}
 			protocol = cpu_to_be16(ETH_P_IP);
 			XFRM_MODE_SKB_CB(skbseq->root_skb)->tos = iph->tos;
 		} else if (iph->version == 0x6) {
 	if (!xtfs)
 		return -ENOMEM;
-	x->mode_data = xtfs;
-	xtfs->x = x;
 	xtfs->ra_newskb = NULL;
 	if (xtfs->cfg.reorder_win_size) {
 		xtfs->w_saved = kzalloc_objs(*xtfs->w_saved,
 		}
 	}
+	x->mode_data = xtfs;
+	xtfs->x = x;
 	return 0;
 }

net/xfrm/xfrm_nat_keepalive.c+1−1

@@ -261,7 +261,7 @@ int __net_init xfrm_nat_keepalive_net_init(struct net *net) · 260 unmodified lines
261		261
262	int xfrm_nat_keepalive_net_fini(struct net *net)	262	int xfrm_nat_keepalive_net_fini(struct net *net)
263	{	263	{
264	cancel_delayed_work_sync(&net->xfrm.nat_keepalive_work);	264	disable_delayed_work_sync(&net->xfrm.nat_keepalive_work);
265	return 0;	265	return 0;
266	}	266	}
267		267

net/xfrm/xfrm_policy.c+7−5

 	int i;
 	for (i = 0; i < ARRAY_SIZE(xfrm_policy_afinfo); i++) {
-		if (xfrm_policy_afinfo[i] != afinfo)
+		if (rcu_access_pointer(xfrm_policy_afinfo[i]) != afinfo)
 			continue;
 		RCU_INIT_POINTER(xfrm_policy_afinfo[i], NULL);
 		break;
 		net->xfrm.policy_count[XFRM_POLICY_MAX + dir] = 0;
 		htab = &net->xfrm.policy_bydst[dir];
-		htab->table = xfrm_hash_alloc(sz);
+		rcu_assign_pointer(htab->table, xfrm_hash_alloc(sz));
 		if (!htab->table)
 			goto out_bydst;
 		htab->hmask = hmask;
 		struct xfrm_policy_hash *htab;
 		htab = &net->xfrm.policy_bydst[dir];
-		xfrm_hash_free(htab->table, sz);
+		xfrm_hash_free(rcu_dereference_protected(htab->table, true), sz);
 	}
 	xfrm_hash_free(net->xfrm.policy_byidx, sz);
 out_byidx:
 	unsigned int sz;
 	int dir;
+	disable_work_sync(&net->xfrm.policy_hthresh.work);
 	flush_work(&net->xfrm.policy_hash_work);
 #ifdef CONFIG_XFRM_SUB_POLICY
 	xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, false);
 		htab = &net->xfrm.policy_bydst[dir];
 		sz = (htab->hmask + 1) * sizeof(struct hlist_head);
-		WARN_ON(!hlist_empty(htab->table));
+		WARN_ON(!hlist_empty(rcu_dereference_protected(htab->table, true)));
-		xfrm_hash_free(htab->table, sz);
+		xfrm_hash_free(rcu_dereference_protected(htab->table, true), sz);
 	}
 	sz = (net->xfrm.policy_idx_hmask + 1) * sizeof(struct hlist_head);

net/xfrm/xfrm_state.c+64−52

@@ -53,7 +53,7 @@ static DECLARE_WORK(xfrm_state_gc_work, xfrm_state_gc_task); · 52 unmodified lines
53	static HLIST_HEAD(xfrm_state_gc_list);	53	static HLIST_HEAD(xfrm_state_gc_list);
54	static HLIST_HEAD(xfrm_state_dev_gc_list);	54	static HLIST_HEAD(xfrm_state_dev_gc_list);
55		55
56	static inline bool xfrm_state_hold_rcu(struct xfrm_state __rcu *x)	56	static inline bool xfrm_state_hold_rcu(struct xfrm_state *x)
57	{	57	{
58	return refcount_inc_not_zero(&x->refcnt);	58	return refcount_inc_not_zero(&x->refcnt);
59	}	59	}
@@ -870,7 +870,7 @@ xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid) · 810 unmodified lines
870	for (i = 0; i <= net->xfrm.state_hmask; i++) {	870	for (i = 0; i <= net->xfrm.state_hmask; i++) {
871	struct xfrm_state *x;	871	struct xfrm_state *x;
872		872
873	hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {	873	hlist_for_each_entry(x, xfrm_state_deref_prot(net->xfrm.state_bydst, net) + i, bydst) {
874	if (xfrm_id_proto_match(x->id.proto, proto) &&	874	if (xfrm_id_proto_match(x->id.proto, proto) &&
875	(err = security_xfrm_state_delete(x)) != 0) {	875	(err = security_xfrm_state_delete(x)) != 0) {
876	xfrm_audit_state_delete(x, 0, task_valid);	876	xfrm_audit_state_delete(x, 0, task_valid);
@@ -891,7 +891,7 @@ xfrm_dev_state_flush_secctx_check(struct net net, struct net_device dev, bool · 14 unmodified lines
891	struct xfrm_state *x;	891	struct xfrm_state *x;
892	struct xfrm_dev_offload *xso;	892	struct xfrm_dev_offload *xso;
893		893
894	hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {	894	hlist_for_each_entry(x, xfrm_state_deref_prot(net->xfrm.state_bydst, net) + i, bydst) {
895	xso = &x->xso;	895	xso = &x->xso;
896		896
897	if (xso->dev == dev &&	897	if (xso->dev == dev &&
@@ -931,7 +931,7 @@ int xfrm_state_flush(struct net *net, u8 proto, bool task_valid) · 33 unmodified lines
931	for (i = 0; i <= net->xfrm.state_hmask; i++) {	931	for (i = 0; i <= net->xfrm.state_hmask; i++) {
932	struct xfrm_state *x;	932	struct xfrm_state *x;
933	restart:	933	restart:
934	hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {	934	hlist_for_each_entry(x, xfrm_state_deref_prot(net->xfrm.state_bydst, net) + i, bydst) {
935	if (!xfrm_state_kern(x) &&	935	if (!xfrm_state_kern(x) &&
936	xfrm_id_proto_match(x->id.proto, proto)) {	936	xfrm_id_proto_match(x->id.proto, proto)) {
937	xfrm_state_hold(x);	937	xfrm_state_hold(x);
@@ -973,7 +973,7 @@ int xfrm_dev_state_flush(struct net net, struct net_device dev, bool task_vali · 35 unmodified lines
973	err = -ESRCH;	973	err = -ESRCH;
974	for (i = 0; i <= net->xfrm.state_hmask; i++) {	974	for (i = 0; i <= net->xfrm.state_hmask; i++) {
975	restart:	975	restart:
976	hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {	976	hlist_for_each_entry(x, xfrm_state_deref_prot(net->xfrm.state_bydst, net) + i, bydst) {
977	xso = &x->xso;	977	xso = &x->xso;
978		978
979	if (!xfrm_state_kern(x) && xso->dev == dev) {	979	if (!xfrm_state_kern(x) && xso->dev == dev) {
@@ -1563,23 +1563,23 @@ found: · 583 unmodified lines
1563	list_add(&x->km.all, &net->xfrm.state_all);	1563	list_add(&x->km.all, &net->xfrm.state_all);
1564	h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);	1564	h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);
1565	XFRM_STATE_INSERT(bydst, &x->bydst,	1565	XFRM_STATE_INSERT(bydst, &x->bydst,
1566	net->xfrm.state_bydst + h,	1566	xfrm_state_deref_prot(net->xfrm.state_bydst, net) + h,
1567	x->xso.type);	1567	x->xso.type);
1568	h = xfrm_src_hash(net, daddr, saddr, encap_family);	1568	h = xfrm_src_hash(net, daddr, saddr, encap_family);
1569	XFRM_STATE_INSERT(bysrc, &x->bysrc,	1569	XFRM_STATE_INSERT(bysrc, &x->bysrc,
1570	net->xfrm.state_bysrc + h,	1570	xfrm_state_deref_prot(net->xfrm.state_bysrc, net) + h,
1571	x->xso.type);	1571	x->xso.type);
1572	INIT_HLIST_NODE(&x->state_cache);	1572	INIT_HLIST_NODE(&x->state_cache);
1573	if (x->id.spi) {	1573	if (x->id.spi) {
1574	h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, encap_family);	1574	h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, encap_family);
1575	XFRM_STATE_INSERT(byspi, &x->byspi,	1575	XFRM_STATE_INSERT(byspi, &x->byspi,
1576	net->xfrm.state_byspi + h,	1576	xfrm_state_deref_prot(net->xfrm.state_byspi, net) + h,
1577	x->xso.type);	1577	x->xso.type);
1578	}	1578	}
1579	if (x->km.seq) {	1579	if (x->km.seq) {
1580	h = xfrm_seq_hash(net, x->km.seq);	1580	h = xfrm_seq_hash(net, x->km.seq);
1581	XFRM_STATE_INSERT(byseq, &x->byseq,	1581	XFRM_STATE_INSERT(byseq, &x->byseq,
1582	net->xfrm.state_byseq + h,	1582	xfrm_state_deref_prot(net->xfrm.state_byseq, net) + h,
1583	x->xso.type);	1583	x->xso.type);
1584	}	1584	}
1585	x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;	1585	x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
@@ -1652,7 +1652,7 @@ xfrm_stateonly_find(struct net *net, u32 mark, u32 if_id, · 66 unmodified lines
1652		1652
1653	spin_lock_bh(&net->xfrm.xfrm_state_lock);	1653	spin_lock_bh(&net->xfrm.xfrm_state_lock);
1654	h = xfrm_dst_hash(net, daddr, saddr, reqid, family);	1654	h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
1655	hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {	1655	hlist_for_each_entry(x, xfrm_state_deref_prot(net->xfrm.state_bydst, net) + h, bydst) {
1656	if (x->props.family == family &&	1656	if (x->props.family == family &&
1657	x->props.reqid == reqid &&	1657	x->props.reqid == reqid &&
1658	(mark & x->mark.m) == x->mark.v &&	1658	(mark & x->mark.m) == x->mark.v &&
@@ -1703,18 +1703,12 @@ static struct xfrm_state xfrm_state_lookup_spi_proto(struct net net, __be32 sp · 44 unmodified lines
1703	struct xfrm_state *x;	1703	struct xfrm_state *x;
1704	unsigned int i;	1704	unsigned int i;
1705		1705
1706	rcu_read_lock();
1707	for (i = 0; i <= net->xfrm.state_hmask; i++) {	1706	for (i = 0; i <= net->xfrm.state_hmask; i++) {
1708	hlist_for_each_entry_rcu(x, &net->xfrm.state_byspi[i], byspi) {	1707	hlist_for_each_entry(x, xfrm_state_deref_prot(net->xfrm.state_byspi, net) + i, byspi) {
1709	if (x->id.spi == spi && x->id.proto == proto) {	1708	if (x->id.spi == spi && x->id.proto == proto)
1710	if (!xfrm_state_hold_rcu(x))
1711	continue;
1712	rcu_read_unlock();
1713	return x;	1709	return x;
1714	}
1715	}	1710	}
1716	}	1711	}
1717	rcu_read_unlock();
1718	return NULL;	1712	return NULL;
1719	}	1713	}
1720		1714
@@ -1730,25 +1724,29 @@ static void __xfrm_state_insert(struct xfrm_state *x) · 9 unmodified lines
1730		1724
1731	h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr,	1725	h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr,
1732	x->props.reqid, x->props.family);	1726	x->props.reqid, x->props.family);
1733	XFRM_STATE_INSERT(bydst, &x->bydst, net->xfrm.state_bydst + h,	1727	XFRM_STATE_INSERT(bydst, &x->bydst,
		1728	xfrm_state_deref_prot(net->xfrm.state_bydst, net) + h,
1734	x->xso.type);	1729	x->xso.type);
1735		1730
1736	h = xfrm_src_hash(net, &x->id.daddr, &x->props.saddr, x->props.family);	1731	h = xfrm_src_hash(net, &x->id.daddr, &x->props.saddr, x->props.family);
1737	XFRM_STATE_INSERT(bysrc, &x->bysrc, net->xfrm.state_bysrc + h,	1732	XFRM_STATE_INSERT(bysrc, &x->bysrc,
		1733	xfrm_state_deref_prot(net->xfrm.state_bysrc, net) + h,
1738	x->xso.type);	1734	x->xso.type);
1739		1735
1740	if (x->id.spi) {	1736	if (x->id.spi) {
1741	h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto,	1737	h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto,
1742	x->props.family);	1738	x->props.family);
1743		1739
1744	XFRM_STATE_INSERT(byspi, &x->byspi, net->xfrm.state_byspi + h,	1740	XFRM_STATE_INSERT(byspi, &x->byspi,
		1741	xfrm_state_deref_prot(net->xfrm.state_byspi, net) + h,
1745	x->xso.type);	1742	x->xso.type);
1746	}	1743	}
1747		1744
1748	if (x->km.seq) {	1745	if (x->km.seq) {
1749	h = xfrm_seq_hash(net, x->km.seq);	1746	h = xfrm_seq_hash(net, x->km.seq);
1750		1747
1751	XFRM_STATE_INSERT(byseq, &x->byseq, net->xfrm.state_byseq + h,	1748	XFRM_STATE_INSERT(byseq, &x->byseq,
		1749	xfrm_state_deref_prot(net->xfrm.state_byseq, net) + h,
1752	x->xso.type);	1750	x->xso.type);
1753	}	1751	}
1754		1752
@@ -1775,7 +1773,7 @@ static void __xfrm_state_bump_genids(struct xfrm_state *xnew) · 20 unmodified lines
1775	u32 cpu_id = xnew->pcpu_num;	1773	u32 cpu_id = xnew->pcpu_num;
1776		1774
1777	h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family);	1775	h = xfrm_dst_hash(net, &xnew->id.daddr, &xnew->props.saddr, reqid, family);
1778	hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {	1776	hlist_for_each_entry(x, xfrm_state_deref_prot(net->xfrm.state_bydst, net) + h, bydst) {
1779	if (x->props.family == family &&	1777	if (x->props.family == family &&
1780	x->props.reqid == reqid &&	1778	x->props.reqid == reqid &&
1781	x->if_id == if_id &&	1779	x->if_id == if_id &&
@@ -1811,7 +1809,7 @@ static struct xfrm_state __find_acq_core(struct net net, · 29 unmodified lines
1811	struct xfrm_state *x;	1809	struct xfrm_state *x;
1812	u32 mark = m->v & m->m;	1810	u32 mark = m->v & m->m;
1813		1811
1814	hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {	1812	hlist_for_each_entry(x, xfrm_state_deref_prot(net->xfrm.state_bydst, net) + h, bydst) {
1815	if (x->props.reqid != reqid \|\|	1813	if (x->props.reqid != reqid \|\|
1816	x->props.mode != mode \|\|	1814	x->props.mode != mode \|\|
1817	x->props.family != family \|\|	1815	x->props.family != family \|\|
@@ -1868,10 +1866,12 @@ static struct xfrm_state __find_acq_core(struct net net, · 50 unmodified lines
1868	ktime_set(net->xfrm.sysctl_acq_expires, 0),	1866	ktime_set(net->xfrm.sysctl_acq_expires, 0),
1869	HRTIMER_MODE_REL_SOFT);	1867	HRTIMER_MODE_REL_SOFT);
1870	list_add(&x->km.all, &net->xfrm.state_all);	1868	list_add(&x->km.all, &net->xfrm.state_all);
1871	XFRM_STATE_INSERT(bydst, &x->bydst, net->xfrm.state_bydst + h,	1869	XFRM_STATE_INSERT(bydst, &x->bydst,
		1870	xfrm_state_deref_prot(net->xfrm.state_bydst, net) + h,
1872	x->xso.type);	1871	x->xso.type);
1873	h = xfrm_src_hash(net, daddr, saddr, family);	1872	h = xfrm_src_hash(net, daddr, saddr, family);
1874	XFRM_STATE_INSERT(bysrc, &x->bysrc, net->xfrm.state_bysrc + h,	1873	XFRM_STATE_INSERT(bysrc, &x->bysrc,
		1874	xfrm_state_deref_prot(net->xfrm.state_bysrc, net) + h,
1875	x->xso.type);	1875	x->xso.type);
1876		1876
1877	net->xfrm.state_num++;	1877	net->xfrm.state_num++;
@@ -2091,7 +2091,7 @@ struct xfrm_state xfrm_migrate_state_find(struct xfrm_migrate m, struct net *n · 213 unmodified lines
2091	if (m->reqid) {	2091	if (m->reqid) {
2092	h = xfrm_dst_hash(net, &m->old_daddr, &m->old_saddr,	2092	h = xfrm_dst_hash(net, &m->old_daddr, &m->old_saddr,
2093	m->reqid, m->old_family);	2093	m->reqid, m->old_family);
2094	hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {	2094	hlist_for_each_entry(x, xfrm_state_deref_prot(net->xfrm.state_bydst, net) + h, bydst) {
2095	if (x->props.mode != m->mode \|\|	2095	if (x->props.mode != m->mode \|\|
2096	x->id.proto != m->proto)	2096	x->id.proto != m->proto)
2097	continue;	2097	continue;
@@ -2110,7 +2110,7 @@ struct xfrm_state xfrm_migrate_state_find(struct xfrm_migrate m, struct net *n · 12 unmodified lines
2110	} else {	2110	} else {
2111	h = xfrm_src_hash(net, &m->old_daddr, &m->old_saddr,	2111	h = xfrm_src_hash(net, &m->old_daddr, &m->old_saddr,
2112	m->old_family);	2112	m->old_family);
2113	hlist_for_each_entry(x, net->xfrm.state_bysrc+h, bysrc) {	2113	hlist_for_each_entry(x, xfrm_state_deref_prot(net->xfrm.state_bysrc, net) + h, bysrc) {
2114	if (x->props.mode != m->mode \|\|	2114	if (x->props.mode != m->mode \|\|
2115	x->id.proto != m->proto)	2115	x->id.proto != m->proto)
2116	continue;	2116	continue;
@@ -2264,6 +2264,7 @@ out: · 147 unmodified lines
2264		2264
2265	err = 0;	2265	err = 0;
2266	x->km.state = XFRM_STATE_DEAD;	2266	x->km.state = XFRM_STATE_DEAD;
		2267	xfrm_dev_state_delete(x);
2267	__xfrm_state_put(x);	2268	__xfrm_state_put(x);
2268	}	2269	}
2269		2270
@@ -2312,7 +2313,7 @@ void xfrm_state_update_stats(struct net *net) · 42 unmodified lines
2312		2313
2313	spin_lock_bh(&net->xfrm.xfrm_state_lock);	2314	spin_lock_bh(&net->xfrm.xfrm_state_lock);
2314	for (i = 0; i <= net->xfrm.state_hmask; i++) {	2315	for (i = 0; i <= net->xfrm.state_hmask; i++) {
2315	hlist_for_each_entry(x, net->xfrm.state_bydst + i, bydst)	2316	hlist_for_each_entry(x, xfrm_state_deref_prot(net->xfrm.state_bydst, net) + i, bydst)
2316	xfrm_dev_state_update_stats(x);	2317	xfrm_dev_state_update_stats(x);
2317	}	2318	}
2318	spin_unlock_bh(&net->xfrm.xfrm_state_lock);	2319	spin_unlock_bh(&net->xfrm.xfrm_state_lock);
@@ -2503,7 +2504,7 @@ static struct xfrm_state __xfrm_find_acq_byseq(struct net net, u32 mark, u32 s · 184 unmodified lines
2503	unsigned int h = xfrm_seq_hash(net, seq);	2504	unsigned int h = xfrm_seq_hash(net, seq);
2504	struct xfrm_state *x;	2505	struct xfrm_state *x;
2505		2506
2506	hlist_for_each_entry_rcu(x, net->xfrm.state_byseq + h, byseq) {	2507	hlist_for_each_entry(x, xfrm_state_deref_prot(net->xfrm.state_byseq, net) + h, byseq) {
2507	if (x->km.seq == seq &&	2508	if (x->km.seq == seq &&
2508	(mark & x->mark.m) == x->mark.v &&	2509	(mark & x->mark.m) == x->mark.v &&
2509	x->pcpu_num == pcpu_num &&	2510	x->pcpu_num == pcpu_num &&
@@ -2602,12 +2603,13 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high, · 92 unmodified lines
2602	if (!x0) {	2603	if (!x0) {
2603	x->id.spi = newspi;	2604	x->id.spi = newspi;
2604	h = xfrm_spi_hash(net, &x->id.daddr, newspi, x->id.proto, x->props.family);	2605	h = xfrm_spi_hash(net, &x->id.daddr, newspi, x->id.proto, x->props.family);
2605	XFRM_STATE_INSERT(byspi, &x->byspi, net->xfrm.state_byspi + h, x->xso.type);	2606	XFRM_STATE_INSERT(byspi, &x->byspi,
		2607	xfrm_state_deref_prot(net->xfrm.state_byspi, net) + h,
		2608	x->xso.type);
2606	spin_unlock_bh(&net->xfrm.xfrm_state_lock);	2609	spin_unlock_bh(&net->xfrm.xfrm_state_lock);
2607	err = 0;	2610	err = 0;
2608	goto unlock;	2611	goto unlock;
2609	}	2612	}
2610	xfrm_state_put(x0);
2611	spin_unlock_bh(&net->xfrm.xfrm_state_lock);	2613	spin_unlock_bh(&net->xfrm.xfrm_state_lock);
2612		2614
2613	next:	2615	next:
@@ -3258,6 +3260,7 @@ EXPORT_SYMBOL(xfrm_init_state); · 644 unmodified lines
3258		3260
3259	int __net_init xfrm_state_init(struct net *net)	3261	int __net_init xfrm_state_init(struct net *net)
3260	{	3262	{
		3263	struct hlist_head ndst, nsrc, nspi, nseq;
3261	unsigned int sz;	3264	unsigned int sz;
3262		3265
3263	if (net_eq(net, &init_net))	3266	if (net_eq(net, &init_net))
@@ -3268,18 +3271,25 @@ int __net_init xfrm_state_init(struct net *net) · 4 unmodified lines
3268		3271
3269	sz = sizeof(struct hlist_head) * 8;	3272	sz = sizeof(struct hlist_head) * 8;
3270		3273
3271	net->xfrm.state_bydst = xfrm_hash_alloc(sz);	3274	ndst = xfrm_hash_alloc(sz);
3272	if (!net->xfrm.state_bydst)	3275	if (!ndst)
3273	goto out_bydst;	3276	goto out_bydst;
3274	net->xfrm.state_bysrc = xfrm_hash_alloc(sz);	3277	rcu_assign_pointer(net->xfrm.state_bydst, ndst);
3275	if (!net->xfrm.state_bysrc)	3278
		3279	nsrc = xfrm_hash_alloc(sz);
		3280	if (!nsrc)
3276	goto out_bysrc;	3281	goto out_bysrc;
3277	net->xfrm.state_byspi = xfrm_hash_alloc(sz);	3282	rcu_assign_pointer(net->xfrm.state_bysrc, nsrc);
3278	if (!net->xfrm.state_byspi)	3283
		3284	nspi = xfrm_hash_alloc(sz);
		3285	if (!nspi)
3279	goto out_byspi;	3286	goto out_byspi;
3280	net->xfrm.state_byseq = xfrm_hash_alloc(sz);	3287	rcu_assign_pointer(net->xfrm.state_byspi, nspi);
3281	if (!net->xfrm.state_byseq)	3288
		3289	nseq = xfrm_hash_alloc(sz);
		3290	if (!nseq)
3282	goto out_byseq;	3291	goto out_byseq;
		3292	rcu_assign_pointer(net->xfrm.state_byseq, nseq);
3283		3293
3284	net->xfrm.state_cache_input = alloc_percpu(struct hlist_head);	3294	net->xfrm.state_cache_input = alloc_percpu(struct hlist_head);
3285	if (!net->xfrm.state_cache_input)	3295	if (!net->xfrm.state_cache_input)
@@ -3295,17 +3305,19 @@ int __net_init xfrm_state_init(struct net *net) · 9 unmodified lines
3295	return 0;	3305	return 0;
3296		3306
3297	out_state_cache_input:	3307	out_state_cache_input:
3298	xfrm_hash_free(net->xfrm.state_byseq, sz);	3308	xfrm_hash_free(nseq, sz);
3299	out_byseq:	3309	out_byseq:
3300	xfrm_hash_free(net->xfrm.state_byspi, sz);	3310	xfrm_hash_free(nspi, sz);
3301	out_byspi:	3311	out_byspi:
3302	xfrm_hash_free(net->xfrm.state_bysrc, sz);	3312	xfrm_hash_free(nsrc, sz);
3303	out_bysrc:	3313	out_bysrc:
3304	xfrm_hash_free(net->xfrm.state_bydst, sz);	3314	xfrm_hash_free(ndst, sz);
3305	out_bydst:	3315	out_bydst:
3306	return -ENOMEM;	3316	return -ENOMEM;
3307	}	3317	}
3308		3318
		3319	#define xfrm_state_deref_netexit(table) \
		3320	rcu_dereference_protected((table), true /* netns is going away */)
3309	void xfrm_state_fini(struct net *net)	3321	void xfrm_state_fini(struct net *net)
3310	{	3322	{
3311	unsigned int sz;	3323	unsigned int sz;
@@ -3318,17 +3330,17 @@ void xfrm_state_fini(struct net *net) · 6 unmodified lines
3318	WARN_ON(!list_empty(&net->xfrm.state_all));	3330	WARN_ON(!list_empty(&net->xfrm.state_all));
3319		3331
3320	for (i = 0; i <= net->xfrm.state_hmask; i++) {	3332	for (i = 0; i <= net->xfrm.state_hmask; i++) {
3321	WARN_ON(!hlist_empty(net->xfrm.state_byseq + i));	3333	WARN_ON(!hlist_empty(xfrm_state_deref_netexit(net->xfrm.state_byseq) + i));
3322	WARN_ON(!hlist_empty(net->xfrm.state_byspi + i));	3334	WARN_ON(!hlist_empty(xfrm_state_deref_netexit(net->xfrm.state_byspi) + i));
3323	WARN_ON(!hlist_empty(net->xfrm.state_bysrc + i));	3335	WARN_ON(!hlist_empty(xfrm_state_deref_netexit(net->xfrm.state_bysrc) + i));
3324	WARN_ON(!hlist_empty(net->xfrm.state_bydst + i));	3336	WARN_ON(!hlist_empty(xfrm_state_deref_netexit(net->xfrm.state_bydst) + i));
3325	}	3337	}
3326		3338
3327	sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head);	3339	sz = (net->xfrm.state_hmask + 1) * sizeof(struct hlist_head);
3328	xfrm_hash_free(net->xfrm.state_byseq, sz);	3340	xfrm_hash_free(xfrm_state_deref_netexit(net->xfrm.state_byseq), sz);
3329	xfrm_hash_free(net->xfrm.state_byspi, sz);	3341	xfrm_hash_free(xfrm_state_deref_netexit(net->xfrm.state_byspi), sz);
3330	xfrm_hash_free(net->xfrm.state_bysrc, sz);	3342	xfrm_hash_free(xfrm_state_deref_netexit(net->xfrm.state_bysrc), sz);
3331	xfrm_hash_free(net->xfrm.state_bydst, sz);	3343	xfrm_hash_free(xfrm_state_deref_netexit(net->xfrm.state_bydst), sz);
3332	free_percpu(net->xfrm.state_cache_input);	3344	free_percpu(net->xfrm.state_cache_input);
3333	}	3345	}
3334		3346

net/xfrm/xfrm_user.c+22−10

 #endif
 #include <linux/unaligned.h>
+static struct sock *xfrm_net_nlsk(const struct net *net, const struct sk_buff *skb)
+{
+	/* get the source of this request, see netlink_unicast_kernel */
+	const struct sock *sk = NETLINK_CB(skb).sk;
+	/* sk is refcounted, the netns stays alive and nlsk with it */
+	return rcu_dereference_protected(net->xfrm.nlsk, sk->sk_net_refcnt);
+}
 static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type,
 			  struct netlink_ext_ack *extack)
 {
 	err = build_spdinfo(r_skb, net, sportid, seq, *flags);
 	BUG_ON(err < 0);
-	return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);
+	return nlmsg_unicast(xfrm_net_nlsk(net, skb), r_skb, sportid);
 }
 static inline unsigned int xfrm_sadinfo_msgsize(void)
 	err = build_sadinfo(r_skb, net, sportid, seq, *flags);
 	BUG_ON(err < 0);
-	return nlmsg_unicast(net->xfrm.nlsk, r_skb, sportid);
+	return nlmsg_unicast(xfrm_net_nlsk(net, skb), r_skb, sportid);
 }
 static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
 	if (IS_ERR(resp_skb)) {
 		err = PTR_ERR(resp_skb);
 	} else {
-		err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid);
+		err = nlmsg_unicast(xfrm_net_nlsk(net, skb), resp_skb, NETLINK_CB(skb).portid);
 	}
 	xfrm_state_put(x);
 out_noput:
 		pcpu_num = nla_get_u32(attrs[XFRMA_SA_PCPU]);
 		if (pcpu_num >= num_possible_cpus()) {
 			err = -EINVAL;
+			NL_SET_ERR_MSG(extack, "pCPU number too big");
 			goto out_noput;
 		}
 	}
 		}
 	}
-	err = nlmsg_unicast(net->xfrm.nlsk, resp_skb, NETLINK_CB(skb).portid);
+	err = nlmsg_unicast(xfrm_net_nlsk(net, skb), resp_skb, NETLINK_CB(skb).portid);
 out:
 	xfrm_state_put(x);
 	r_up->out = net->xfrm.policy_default[XFRM_POLICY_OUT];
 	nlmsg_end(r_skb, r_nlh);
-	return nlmsg_unicast(net->xfrm.nlsk, r_skb, portid);
+	return nlmsg_unicast(xfrm_net_nlsk(net, skb), r_skb, portid);
 }
 static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
 		if (IS_ERR(resp_skb)) {
 			err = PTR_ERR(resp_skb);
 		} else {
-			err = nlmsg_unicast(net->xfrm.nlsk, resp_skb,
+			err = nlmsg_unicast(xfrm_net_nlsk(net, skb), resp_skb,
 					    NETLINK_CB(skb).portid);
 		}
 	} else {
 	err = build_aevent(r_skb, x, &c);
 	BUG_ON(err < 0);
-	err = nlmsg_unicast(net->xfrm.nlsk, r_skb, NETLINK_CB(skb).portid);
+	err = nlmsg_unicast(xfrm_net_nlsk(net, skb), r_skb, NETLINK_CB(skb).portid);
 	spin_unlock_bh(&x->lock);
 	xfrm_state_put(x);
 	return err;
 	if (attrs[XFRMA_SA_PCPU]) {
 		x->pcpu_num = nla_get_u32(attrs[XFRMA_SA_PCPU]);
 		err = -EINVAL;
-		if (x->pcpu_num >= num_possible_cpus())
+		if (x->pcpu_num >= num_possible_cpus()) {
+			NL_SET_ERR_MSG(extack, "pCPU number too big");
 			goto free_state;
+		}
 	}
 	err = verify_newpolicy_info(&ua->policy, extack);
 			goto err;
 		}
-		err = netlink_dump_start(net->xfrm.nlsk, skb, nlh, &c);
+		err = netlink_dump_start(xfrm_net_nlsk(net, skb), skb, nlh, &c);
 		goto err;
 	}
 	}
 	if (x->if_id)
 		l += nla_total_size(sizeof(x->if_id));
-	if (x->pcpu_num)
+	if (x->pcpu_num != UINT_MAX)
 		l += nla_total_size(sizeof(x->pcpu_num));
 	/* Must count x->lastused as it may become non-zero behind our back. */

rust/kernel/regulator.rs+18−15

     prelude::*,
 };
-use core::{marker::PhantomData, mem::ManuallyDrop, ptr::NonNull};
+use core::{
+    marker::PhantomData,
+    mem::ManuallyDrop, //
+};
 mod private {
     pub trait Sealed {}
 ///
 /// # Invariants
 ///
-/// - `inner` is a non-null wrapper over a pointer to a `struct
+/// - `inner` is a pointer obtained from a successful call to
-///   regulator` obtained from [`regulator_get()`].
+///   [`regulator_get()`]. It is treated as an opaque token that may only be
+///   accessed using C API methods (e.g., it may be `NULL` if the C API returns
+///   `NULL`).
 ///
 /// [`regulator_get()`]: https://docs.kernel.org/driver-api/regulator.html#c.regulator_get
 pub struct Regulator<State>
 where
     State: RegulatorState,
 {
-    inner: NonNull<bindings::regulator>,
+    inner: *mut bindings::regulator,
     _phantom: PhantomData<State>,
 }
         // SAFETY: Safe as per the type invariants of `Regulator`.
         to_result(unsafe {
             bindings::regulator_set_voltage(
-                self.inner.as_ptr(),
+                self.inner,
                 min_voltage.as_microvolts(),
                 max_voltage.as_microvolts(),
             )
     /// Gets the current voltage of the regulator.
     pub fn get_voltage(&self) -> Result<Voltage> {
         // SAFETY: Safe as per the type invariants of `Regulator`.
-        let voltage = unsafe { bindings::regulator_get_voltage(self.inner.as_ptr()) };
+        let voltage = unsafe { bindings::regulator_get_voltage(self.inner) };
         to_result(voltage).map(|()| Voltage::from_microvolts(voltage))
     }
             // received from the C code.
             from_err_ptr(unsafe { bindings::regulator_get(dev.as_raw(), name.as_char_ptr()) })?;
-        // SAFETY: We can safely trust `inner` to be a pointer to a valid
+        // INVARIANT: `inner` is a pointer obtained from `regulator_get()`, and
-        // regulator if `ERR_PTR` was not returned.
+        // the call was successful.
-        let inner = unsafe { NonNull::new_unchecked(inner) };
         Ok(Self {
             inner,
             _phantom: PhantomData,
     fn enable_internal(&self) -> Result {
         // SAFETY: Safe as per the type invariants of `Regulator`.
-        to_result(unsafe { bindings::regulator_enable(self.inner.as_ptr()) })
+        to_result(unsafe { bindings::regulator_enable(self.inner) })
     }
     fn disable_internal(&self) -> Result {
         // SAFETY: Safe as per the type invariants of `Regulator`.
-        to_result(unsafe { bindings::regulator_disable(self.inner.as_ptr()) })
+        to_result(unsafe { bindings::regulator_disable(self.inner) })
     }
 }
     /// Checks if the regulator is enabled.
     pub fn is_enabled(&self) -> bool {
         // SAFETY: Safe as per the type invariants of `Regulator`.
-        unsafe { bindings::regulator_is_enabled(self.inner.as_ptr()) != 0 }
+        unsafe { bindings::regulator_is_enabled(self.inner) != 0 }
     }
 }
             // SAFETY: By the type invariants, we know that `self` owns a
             // reference on the enabled refcount, so it is safe to relinquish it
             // now.
-            unsafe { bindings::regulator_disable(self.inner.as_ptr()) };
+            unsafe { bindings::regulator_disable(self.inner) };
         }
         // SAFETY: By the type invariants, we know that `self` owns a reference,
         // so it is safe to relinquish it now.
-        unsafe { bindings::regulator_put(self.inner.as_ptr()) };
+        unsafe { bindings::regulator_put(self.inner) };
     }
 }

samples/landlock/sandboxer.c+3−2

@@ -299,7 +299,7 @@ out_unset: · 298 unmodified lines
299		299
300	/* clang-format on */	300	/* clang-format on */
301		301
302	#define LANDLOCK_ABI_LAST 7	302	#define LANDLOCK_ABI_LAST 8
303		303
304	#define XSTR(s) #s	304	#define XSTR(s) #s
305	#define STR(s) XSTR(s)	305	#define STR(s) XSTR(s)
@@ -436,7 +436,8 @@ int main(const int argc, char const argv[], char const *const envp) · 130 unmodified lines
436	/* Removes LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON for ABI < 7 */	436	/* Removes LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON for ABI < 7 */
437	supported_restrict_flags &=	437	supported_restrict_flags &=
438	~LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON;	438	~LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON;
439		439	__attribute__((fallthrough));
		440	case 7:
440	/* Must be printed for any ABI < LANDLOCK_ABI_LAST. */	441	/* Must be printed for any ABI < LANDLOCK_ABI_LAST. */
441	fprintf(stderr,	442	fprintf(stderr,
442	"Hint: You should update the running kernel "	443	"Hint: You should update the running kernel "

scripts/coccinelle/api/kmalloc_objs.cocci+11−0

@@ -122,3 +122,14 @@ fresh identifier ALLOC_OBJS = script:python(ALLOC_ARRAY) { alloc_array(ALLOC_ARR · 121 unmodified lines
122	- ALLOC(struct_size_t(TYPE, FLEX, COUNT), GFP)	122	- ALLOC(struct_size_t(TYPE, FLEX, COUNT), GFP)
123	+ ALLOC_FLEX(TYPE, FLEX, COUNT, GFP)	123	+ ALLOC_FLEX(TYPE, FLEX, COUNT, GFP)
124	)	124	)
		125
		126	@drop_gfp_kernel depends on patch && !(file in "tools") && !(file in "samples")@
		127	identifier ALLOC = {kmalloc_obj,kmalloc_objs,kmalloc_flex,
		128	kzalloc_obj,kzalloc_objs,kzalloc_flex,
		129	kvmalloc_obj,kvmalloc_objs,kvmalloc_flex,
		130	kvzalloc_obj,kvzalloc_objs,kvzalloc_flex};
		131	@@
		132
		133	ALLOC(...
		134	- , GFP_KERNEL
		135	)

scripts/kconfig/merge_config.sh+10−14

 	if ! "$AWK" -v prefix="$CONFIG_PREFIX" \
 		-v warnoverride="$WARNOVERRIDE" \
 		-v strict="$STRICT" \
+		-v outfile="$TMP_FILE.new" \
 		-v builtin="$BUILTIN" \
 		-v warnredun="$WARNREDUN" '
 	BEGIN {
 	# First pass: read merge file, store all lines and index
 	FILENAME == ARGV[1] {
-	        mergefile = FILENAME
+		mergefile = FILENAME
 		merge_lines[FNR] = $0
 		merge_total = FNR
 		cfg = get_cfg($0)
 		# Not a config or not in merge file - keep it
 		if (cfg == "" || !(cfg in merge_cfg)) {
-			print $0 >> ARGV[3]
+			print $0 >> outfile
 			next
 		}
-	        prev_val = $0
+		prev_val = $0
 		new_val = merge_cfg[cfg]
 		# BUILTIN: do not demote y to m
 		if (builtin == "true" && new_val ~ /=m$/ && prev_val ~ /=y$/) {
 			warn_builtin(cfg, prev_val, new_val)
-			print $0 >> ARGV[3]
+			print $0 >> outfile
 			skip_merge[merge_cfg_line[cfg]] = 1
 			next
 		}
 		# "=n" is the same as "is not set"
 		if (prev_val ~ /=n$/ && new_val ~ / is not set$/) {
-			print $0 >> ARGV[3]
+			print $0 >> outfile
 			next
 		}
 		}
 	}
-	# output file, skip all lines
-	FILENAME == ARGV[3] {
-		nextfile
-	}
 	END {
 		# Newline in case base file lacks trailing newline
-		print "" >> ARGV[3]
+		print "" >> outfile
 		# Append merge file, skipping lines marked for builtin preservation
 		for (i = 1; i <= merge_total; i++) {
 			if (!(i in skip_merge)) {
-				print merge_lines[i] >> ARGV[3]
+				print merge_lines[i] >> outfile
 			}
 		}
 		if (strict_violated) {
 			exit 1
 		}
 	}' \
-	"$ORIG_MERGE_FILE" "$TMP_FILE" "$TMP_FILE.new"; then
+	"$ORIG_MERGE_FILE" "$TMP_FILE"; then
 		# awk exited non-zero, strict mode was violated
 		STRICT_MODE_VIOLATED=true
 	fi
 	STRICT_MODE_VIOLATED=true
 fi
-if [ "$STRICT" == "true" ] && [ "$STRICT_MODE_VIOLATED" == "true" ]; then
+if [ "$STRICT" = "true" ] && [ "$STRICT_MODE_VIOLATED" = "true" ]; then
 	echo "Requested and effective config differ"
 	exit 1
 fi

security/landlock/domain.c+1−2

@@ -94,8 +94,7 @@ static struct landlock_details *get_current_details(void) · 93 unmodified lines
94	* allocate with GFP_KERNEL_ACCOUNT because it is independent from the	94	* allocate with GFP_KERNEL_ACCOUNT because it is independent from the
95	* caller.	95	* caller.
96	*/	96	*/
97	details =	97	details = kzalloc_flex(*details, exe_path, path_size);
98	kzalloc_flex(*details, exe_path, path_size);
99	if (!details)	98	if (!details)
100	return ERR_PTR(-ENOMEM);	99	return ERR_PTR(-ENOMEM);
101		100

security/landlock/ruleset.c+4−5

 {
 	struct landlock_ruleset *new_ruleset;
-	new_ruleset =
+	new_ruleset = kzalloc_flex(*new_ruleset, access_masks, num_layers,
-		kzalloc_flex(*new_ruleset, access_masks, num_layers,
+				   GFP_KERNEL_ACCOUNT);
-			     GFP_KERNEL_ACCOUNT);
 	if (!new_ruleset)
 		return ERR_PTR(-ENOMEM);
 	refcount_set(&new_ruleset->usage, 1);
 	if (IS_ERR(new_dom))
 		return new_dom;
-	new_dom->hierarchy = kzalloc_obj(*new_dom->hierarchy,
+	new_dom->hierarchy =
-					 GFP_KERNEL_ACCOUNT);
+		kzalloc_obj(*new_dom->hierarchy, GFP_KERNEL_ACCOUNT);
 	if (!new_dom->hierarchy)
 		return ERR_PTR(-ENOMEM);

security/landlock/tsync.c+73−19

@@ -203,6 +203,40 @@ static struct tsync_work tsync_works_provide(struct tsync_works s, · 202 unmodified lines
203	return ctx;	203	return ctx;
204	}	204	}
205		205
		206	/**
		207	* tsync_works_trim - Put the last tsync_work element
		208	*
		209	* @s: TSYNC works to trim.
		210	*
		211	* Put the last task and decrement the size of @s.
		212	*
		213	* This helper does not cancel a running task, but just reset the last element
		214	* to zero.
		215	*/
		216	static void tsync_works_trim(struct tsync_works *s)
		217	{
		218	struct tsync_work *ctx;
		219
		220	if (WARN_ON_ONCE(s->size <= 0))
		221	return;
		222
		223	ctx = s->works[s->size - 1];
		224
		225	/*
		226	* For consistency, remove the task from ctx so that it does not look like
		227	* we handed it a task_work.
		228	*/
		229	put_task_struct(ctx->task);
		230	ctx = (typeof(ctx)){};
		231
		232	/*
		233	* Cancel the tsync_works_provide() change to recycle the reserved memory
		234	* for the next thread, if any. This also ensures that cancel_tsync_works()
		235	* and tsync_works_release() do not see any NULL task pointers.
		236	*/
		237	s->size--;
		238	}
		239
206	/*	240	/*
207	* tsync_works_grow_by - preallocates space for n more contexts in s	241	* tsync_works_grow_by - preallocates space for n more contexts in s
208	*	242	*
@@ -256,13 +290,14 @@ static int tsync_works_grow_by(struct tsync_works *s, size_t n, gfp_t flags) · 47 unmodified lines
256	* tsync_works_contains - checks for presence of task in s	290	* tsync_works_contains - checks for presence of task in s
257	*/	291	*/
258	static bool tsync_works_contains_task(const struct tsync_works *s,	292	static bool tsync_works_contains_task(const struct tsync_works *s,
259	struct task_struct *task)	293	const struct task_struct *task)
260	{	294	{
261	size_t i;	295	size_t i;
262		296
263	for (i = 0; i < s->size; i++)	297	for (i = 0; i < s->size; i++)
264	if (s->works[i]->task == task)	298	if (s->works[i]->task == task)
265	return true;	299	return true;
		300
266	return false;	301	return false;
267	}	302	}
268		303
@@ -276,7 +311,7 @@ static void tsync_works_release(struct tsync_works *s) · 7 unmodified lines
276	size_t i;	311	size_t i;
277		312
278	for (i = 0; i < s->size; i++) {	313	for (i = 0; i < s->size; i++) {
279	if (!s->works[i]->task)	314	if (WARN_ON_ONCE(!s->works[i]->task))
280	continue;	315	continue;
281		316
282	put_task_struct(s->works[i]->task);	317	put_task_struct(s->works[i]->task);
@@ -284,6 +319,7 @@ static void tsync_works_release(struct tsync_works *s) · 1 unmodified line
284		319
285	for (i = 0; i < s->capacity; i++)	320	for (i = 0; i < s->capacity; i++)
286	kfree(s->works[i]);	321	kfree(s->works[i]);
		322
287	kfree(s->works);	323	kfree(s->works);
288	s->works = NULL;	324	s->works = NULL;
289	s->size = 0;	325	s->size = 0;
@@ -295,7 +331,7 @@ static void tsync_works_release(struct tsync_works *s) · 5 unmodified lines
295	*/	331	*/
296	static size_t count_additional_threads(const struct tsync_works *works)	332	static size_t count_additional_threads(const struct tsync_works *works)
297	{	333	{
298	struct task_struct thread, caller;	334	const struct task_struct caller, thread;
299	size_t n = 0;	335	size_t n = 0;
300		336
301	caller = current;	337	caller = current;
@@ -334,7 +370,8 @@ static bool schedule_task_work(struct tsync_works *works, · 32 unmodified lines
334	struct tsync_shared_context *shared_ctx)	370	struct tsync_shared_context *shared_ctx)
335	{	371	{
336	int err;	372	int err;
337	struct task_struct thread, caller;	373	const struct task_struct *caller;
		374	struct task_struct *thread;
338	struct tsync_work *ctx;	375	struct tsync_work *ctx;
339	bool found_more_threads = false;	376	bool found_more_threads = false;
340		377
@@ -379,16 +416,14 @@ static bool schedule_task_work(struct tsync_works *works, · 38 unmodified lines
379		416
380	init_task_work(&ctx->work, restrict_one_thread_callback);	417	init_task_work(&ctx->work, restrict_one_thread_callback);
381	err = task_work_add(thread, &ctx->work, TWA_SIGNAL);	418	err = task_work_add(thread, &ctx->work, TWA_SIGNAL);
382	if (err) {	419	if (unlikely(err)) {
383	/*	420	/*
384	* task_work_add() only fails if the task is about to exit. We	421	* task_work_add() only fails if the task is about to exit. We
385	* checked that earlier, but it can happen as a race. Resume	422	* checked that earlier, but it can happen as a race. Resume
386	* without setting an error, as the task is probably gone in the	423	* without setting an error, as the task is probably gone in the
387	* next loop iteration. For consistency, remove the task from ctx	424	* next loop iteration.
388	* so that it does not look like we handed it a task_work.
389	*/	425	*/
390	put_task_struct(ctx->task);	426	tsync_works_trim(works);
391	ctx->task = NULL;
392		427
393	atomic_dec(&shared_ctx->num_preparing);	428	atomic_dec(&shared_ctx->num_preparing);
394	atomic_dec(&shared_ctx->num_unfinished);	429	atomic_dec(&shared_ctx->num_unfinished);
@@ -406,12 +441,15 @@ static bool schedule_task_work(struct tsync_works *works, · 11 unmodified lines
406	* shared_ctx->num_preparing and shared_ctx->num_unfished and mark the two	441	* shared_ctx->num_preparing and shared_ctx->num_unfished and mark the two
407	* completions if needed, as if the task was never scheduled.	442	* completions if needed, as if the task was never scheduled.
408	*/	443	*/
409	static void cancel_tsync_works(struct tsync_works *works,	444	static void cancel_tsync_works(const struct tsync_works *works,
410	struct tsync_shared_context *shared_ctx)	445	struct tsync_shared_context *shared_ctx)
411	{	446	{
412	int i;	447	size_t i;
413		448
414	for (i = 0; i < works->size; i++) {	449	for (i = 0; i < works->size; i++) {
		450	if (WARN_ON_ONCE(!works->works[i]->task))
		451	continue;
		452
415	if (!task_work_cancel(works->works[i]->task,	453	if (!task_work_cancel(works->works[i]->task,
416	&works->works[i]->work))	454	&works->works[i]->work))
417	continue;	455	continue;
@@ -447,6 +485,16 @@ int landlock_restrict_sibling_threads(const struct cred *old_cred, · 29 unmodified lines
447	shared_ctx.new_cred = new_cred;	485	shared_ctx.new_cred = new_cred;
448	shared_ctx.set_no_new_privs = task_no_new_privs(current);	486	shared_ctx.set_no_new_privs = task_no_new_privs(current);
449		487
		488	/*
		489	* Serialize concurrent TSYNC operations to prevent deadlocks when
		490	* multiple threads call landlock_restrict_self() simultaneously.
		491	* If the lock is already held, we gracefully yield by restarting the
		492	* syscall. This allows the current thread to process pending
		493	* task_works before retrying.
		494	*/
		495	if (!down_write_trylock(&current->signal->exec_update_lock))
		496	return restart_syscall();
		497
450	/*	498	/*
451	* We schedule a pseudo-signal task_work for each of the calling task's	499	* We schedule a pseudo-signal task_work for each of the calling task's
452	* sibling threads. In the task work, each thread:	500	* sibling threads. In the task work, each thread:
@@ -527,24 +575,30 @@ int landlock_restrict_sibling_threads(const struct cred *old_cred, · 74 unmodified lines
527	-ERESTARTNOINTR);	575	-ERESTARTNOINTR);
528		576
529	/*	577	/*
530	* Cancel task works for tasks that did not start running yet,	578	* Opportunistic improvement: try to cancel task
531	* and decrement all_prepared and num_unfinished accordingly.	579	* works for tasks that did not start running
		580	* yet. We do not have a guarantee that it
		581	* cancels any of the enqueued task works
		582	* because task_work_run() might already have
		583	* dequeued them.
532	*/	584	*/
533	cancel_tsync_works(&works, &shared_ctx);	585	cancel_tsync_works(&works, &shared_ctx);
534		586
535	/*	587	/*
536	* The remaining task works have started running, so waiting for	588	* Break the loop with error. The cleanup code
537	* their completion will finish.	589	* after the loop unblocks the remaining
		590	* task_works.
538	*/	591	*/
539	wait_for_completion(&shared_ctx.all_prepared);	592	break;
540	}	593	}
541	}	594	}
542	} while (found_more_threads &&	595	} while (found_more_threads &&
543	!atomic_read(&shared_ctx.preparation_error));	596	!atomic_read(&shared_ctx.preparation_error));
544		597
545	/*	598	/*
546	* We now have all sibling threads blocking and in "prepared" state in the	599	* We now have either (a) all sibling threads blocking and in "prepared"
547	* task work. Ask all threads to commit.	600	* state in the task work, or (b) the preparation error is set. Ask all
		601	* threads to commit (or abort).
548	*/	602	*/
549	complete_all(&shared_ctx.ready_to_commit);	603	complete_all(&shared_ctx.ready_to_commit);
550		604
@@ -556,6 +610,6 @@ int landlock_restrict_sibling_threads(const struct cred *old_cred, · 5 unmodified lines
556	wait_for_completion(&shared_ctx.all_finished);	610	wait_for_completion(&shared_ctx.all_finished);
557		611
558	tsync_works_release(&works);	612	tsync_works_release(&works);
559		613	up_write(&current->signal->exec_update_lock);
560	return atomic_read(&shared_ctx.preparation_error);	614	return atomic_read(&shared_ctx.preparation_error);
561	}	615	}

security/security.c+1−0

@@ -61,6 +61,7 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = { · 60 unmodified lines
61	[LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM",	61	[LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM",
62	[LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM",	62	[LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM",
63	[LOCKDOWN_RTAS_ERROR_INJECTION] = "RTAS error injection",	63	[LOCKDOWN_RTAS_ERROR_INJECTION] = "RTAS error injection",
		64	[LOCKDOWN_XEN_USER_ACTIONS] = "Xen guest user action",
64	[LOCKDOWN_INTEGRITY_MAX] = "integrity",	65	[LOCKDOWN_INTEGRITY_MAX] = "integrity",
65	[LOCKDOWN_KCORE] = "/proc/kcore access",	66	[LOCKDOWN_KCORE] = "/proc/kcore access",
66	[LOCKDOWN_KPROBES] = "use of kprobes",	67	[LOCKDOWN_KPROBES] = "use of kprobes",

sound/firewire/amdtp-stream.c+1−1

@@ -1164,7 +1164,7 @@ static void process_rx_packets(struct fw_iso_context *context, u32 tstamp, size_ · 1163 unmodified lines
1164	struct pkt_desc *desc = s->packet_descs_cursor;	1164	struct pkt_desc *desc = s->packet_descs_cursor;
1165	unsigned int pkt_header_length;	1165	unsigned int pkt_header_length;
1166	unsigned int packets;	1166	unsigned int packets;
1167	u32 curr_cycle_time;	1167	u32 curr_cycle_time = 0;
1168	bool need_hw_irq;	1168	bool need_hw_irq;
1169	int i;	1169	int i;
1170		1170

sound/hda/codecs/realtek/alc269.c+59−7

 	return 0;
 }
-#define STARLABS_STARFIGHTER_SHUTUP_DELAY_MS	30
+#define ALC233_STARFIGHTER_SPK_PIN	0x1b
+#define ALC233_STARFIGHTER_GPIO2	0x04
-static void starlabs_starfighter_shutup(struct hda_codec *codec)
+static void alc233_starfighter_update_amp(struct hda_codec *codec, bool on)
 {
-	if (snd_hda_gen_shutup_speakers(codec))
+	snd_hda_codec_write(codec, ALC233_STARFIGHTER_SPK_PIN, 0,
-		msleep(STARLABS_STARFIGHTER_SHUTUP_DELAY_MS);
+			    AC_VERB_SET_EAPD_BTLENABLE,
+			    on ? AC_EAPDBTL_EAPD : 0);
+	alc_update_gpio_data(codec, ALC233_STARFIGHTER_GPIO2, on);
+}
+static void alc233_starfighter_pcm_hook(struct hda_pcm_stream *hinfo,
+					struct hda_codec *codec,
+					struct snd_pcm_substream *substream,
+					int action)
+{
+	switch (action) {
+	case HDA_GEN_PCM_ACT_PREPARE:
+		alc233_starfighter_update_amp(codec, true);
+		break;
+	case HDA_GEN_PCM_ACT_CLEANUP:
+		alc233_starfighter_update_amp(codec, false);
+		break;
+	}
 }
 static void alc233_fixup_starlabs_starfighter(struct hda_codec *codec,
 {
 	struct alc_spec *spec = codec->spec;
-	if (action == HDA_FIXUP_ACT_PRE_PROBE)
+	switch (action) {
-		spec->shutup = starlabs_starfighter_shutup;
+	case HDA_FIXUP_ACT_PRE_PROBE:
+		spec->gpio_mask |= ALC233_STARFIGHTER_GPIO2;
+		spec->gpio_dir |= ALC233_STARFIGHTER_GPIO2;
+		spec->gpio_data &= ~ALC233_STARFIGHTER_GPIO2;
+		break;
+	case HDA_FIXUP_ACT_PROBE:
+		spec->gen.pcm_playback_hook = alc233_starfighter_pcm_hook;
+		break;
+	}
 }
 static void alc269_fixup_pincfg_no_hp_to_lineout(struct hda_codec *codec,
 	alc_fixup_hp_gpio_led(codec, action, 0x04, 0x0);
 	alc285_fixup_hp_coef_micmute_led(codec, fix, action);
 }
+static void alc245_hp_spk_mute_led_update(void *private_data, int enabled)
+{
+	struct hda_codec *codec = private_data;
+	unsigned int val;
+	val = enabled ? 0x08 : 0x04; /* 0x08 led on, 0x04 led off */
+	alc_update_coef_idx(codec, 0x0b, 0x0c, val);
+}
 /* JD2: mute led GPIO3: micmute led */
 static void alc245_tas2781_i2c_hp_fixup_muteled(struct hda_codec *codec,
 					  const struct hda_fixup *fix, int action)
 {
 	struct alc_spec *spec = codec->spec;
+	hda_nid_t hp_pin = alc_get_hp_pin(spec);
 	static const hda_nid_t conn[] = { 0x02 };
 	switch (action) {
 	case HDA_FIXUP_ACT_PRE_PROBE:
+		if (!hp_pin) {
+			spec->gen.vmaster_mute.hook = alc245_hp_spk_mute_led_update;
+			spec->gen.vmaster_mute_led = 1;
+		}
 		spec->gen.auto_mute_via_amp = 1;
 		snd_hda_override_conn_list(codec, 0x17, ARRAY_SIZE(conn), conn);
 		break;
+	case HDA_FIXUP_ACT_INIT:
+		if (!hp_pin)
+			alc245_hp_spk_mute_led_update(codec, !spec->gen.master_mute);
+		break;
 	}
 	tas2781_fixup_txnw_i2c(codec, fix, action);
-	alc245_fixup_hp_mute_led_coefbit(codec, fix, action);
+	if (hp_pin)
+		alc245_fixup_hp_mute_led_coefbit(codec, fix, action);
 	alc285_fixup_hp_coef_micmute_led(codec, fix, action);
 }
 /*
 	SND_PCI_QUIRK(0x103c, 0x8730, "HP ProBook 445 G7", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
 	SND_PCI_QUIRK(0x103c, 0x8735, "HP ProBook 435 G7", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
 	SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+	SND_PCI_QUIRK(0x103c, 0x8756, "HP ENVY Laptop 13-ba0xxx", ALC245_FIXUP_HP_X360_MUTE_LEDS),
 	SND_PCI_QUIRK(0x103c, 0x8760, "HP EliteBook 8{4,5}5 G7", ALC285_FIXUP_HP_BEEP_MICMUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x876e, "HP ENVY x360 Convertible 13-ay0xxx", ALC245_FIXUP_HP_X360_MUTE_LEDS),
 	SND_PCI_QUIRK(0x103c, 0x877a, "HP", ALC285_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x8788, "HP OMEN 15", ALC285_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x87b7, "HP Laptop 14-fq0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x87c8, "HP", ALC287_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x87cb, "HP Pavilion 15-eg0xxx", ALC287_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x87cc, "HP Pavilion 15-eg0xxx", ALC287_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x87d3, "HP Laptop 15-gw0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x87df, "HP ProBook 430 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8da7, "HP 14 Enstrom OmniBook X", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x103c, 0x8da8, "HP 16 Piston OmniBook X", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x103c, 0x8dd4, "HP EliteStudio 8 AIO", ALC274_FIXUP_HP_AIO_BIND_DACS),
+	SND_PCI_QUIRK(0x103c, 0x8dd7, "HP Laptop 15-fd0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x8de8, "HP Gemtree", ALC245_FIXUP_TAS2781_SPI_2),
 	SND_PCI_QUIRK(0x103c, 0x8de9, "HP Gemtree", ALC245_FIXUP_TAS2781_SPI_2),
 	SND_PCI_QUIRK(0x103c, 0x8dec, "HP EliteBook 640 G12", ALC236_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x1043, 0x1194, "ASUS UM3406KA", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x1043, 0x11c0, "ASUS X556UR", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+	HDA_CODEC_QUIRK(0x1043, 0x1204, "ASUS Strix G16 G615JMR", ALC287_FIXUP_TXNW2781_I2C_ASUS),
 	SND_PCI_QUIRK(0x1043, 0x1204, "ASUS Strix G615JHR_JMR_JPR", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x1043, 0x1214, "ASUS Strix G615LH_LM_LP", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x1043, 0x125e, "ASUS Q524UQK", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x14e3, "ASUS G513PI/PU/PV", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x1043, 0x14f2, "ASUS VivoBook X515JA", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x1503, "ASUS G733PY/PZ/PZV/PYV", ALC287_FIXUP_CS35L41_I2C_2),
+	SND_PCI_QUIRK(0x1043, 0x1514, "ASUS ROG Flow Z13 GZ302EAC", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
 	SND_PCI_QUIRK(0x1043, 0x1533, "ASUS GV302XA/XJ/XQ/XU/XV/XI", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x1043, 0x1573, "ASUS GZ301VV/VQ/VU/VJ/VA/VC/VE/VVC/VQC/VUC/VJC/VEC/VCC", ALC285_FIXUP_ASUS_HEADSET_MIC),
 	SND_PCI_QUIRK(0x17aa, 0x38ab, "Thinkbook 16P", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD),
 	SND_PCI_QUIRK(0x17aa, 0x38b4, "Legion Slim 7 16IRH8", ALC287_FIXUP_CS35L41_I2C_2),
 	HDA_CODEC_QUIRK(0x17aa, 0x391c, "Lenovo Yoga 7 2-in-1 14AKP10", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
+	HDA_CODEC_QUIRK(0x17aa, 0x391d, "Lenovo Yoga 7 2-in-1 16AKP10", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
 	SND_PCI_QUIRK(0x17aa, 0x38b5, "Legion Slim 7 16IRH8", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x17aa, 0x38b6, "Legion Slim 7 16APH8", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x17aa, 0x38b7, "Legion Slim 7 16APH8", ALC287_FIXUP_CS35L41_I2C_2),

sound/hda/controllers/intel.c+0−1

@@ -2077,7 +2077,6 @@ static const struct pci_device_id driver_denylist[] = { · 2076 unmodified lines
2077	{ PCI_DEVICE_SUB(0x1022, 0x1487, 0x1043, 0x874f) }, /* ASUS ROG Zenith II / Strix */	2077	{ PCI_DEVICE_SUB(0x1022, 0x1487, 0x1043, 0x874f) }, /* ASUS ROG Zenith II / Strix */
2078	{ PCI_DEVICE_SUB(0x1022, 0x1487, 0x1462, 0xcb59) }, /* MSI TRX40 Creator */	2078	{ PCI_DEVICE_SUB(0x1022, 0x1487, 0x1462, 0xcb59) }, /* MSI TRX40 Creator */
2079	{ PCI_DEVICE_SUB(0x1022, 0x1487, 0x1462, 0xcb60) }, /* MSI TRX40 */	2079	{ PCI_DEVICE_SUB(0x1022, 0x1487, 0x1462, 0xcb60) }, /* MSI TRX40 */
2080	{ PCI_DEVICE_SUB(0x1022, 0x15e3, 0x1462, 0xee59) }, /* MSI X870E Tomahawk WiFi */
2081	{}	2080	{}
2082	};	2081	};
2083		2082

sound/pci/asihpi/hpimsgx.c+4−2

 		HPI_ADAPTER_OPEN);
 	hm.adapter_index = adapter;
 	hw_entry_point(&hm, &hr);
-	memcpy(&rESP_HPI_ADAPTER_OPEN[adapter], &hr,
+	memcpy(&rESP_HPI_ADAPTER_OPEN[adapter].h, &hr,
-		sizeof(rESP_HPI_ADAPTER_OPEN[0]));
+		sizeof(rESP_HPI_ADAPTER_OPEN[adapter].h));
+	memcpy(&rESP_HPI_ADAPTER_OPEN[adapter].a, &hr.u.ax.info,
+		sizeof(rESP_HPI_ADAPTER_OPEN[adapter].a));
 	if (hr.error)
 		return hr.error;

sound/soc/amd/yc/acp6x-mach.c+14−0

@@ -52,6 +52,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { · 51 unmodified lines
52	DMI_MATCH(DMI_PRODUCT_NAME, "Bellator N176"),	52	DMI_MATCH(DMI_PRODUCT_NAME, "Bellator N176"),
53	}	53	}
54	},	54	},
		55	{
		56	.driver_data = &acp6x_card,
		57	.matches = {
		58	DMI_MATCH(DMI_BOARD_VENDOR, "HP"),
		59	DMI_MATCH(DMI_PRODUCT_NAME, "HP Laptop 15-fc0xxx"),
		60	}
		61	},
55	{	62	{
56	.driver_data = &acp6x_card,	63	.driver_data = &acp6x_card,
57	.matches = {	64	.matches = {
@@ -752,6 +759,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { · 694 unmodified lines
752	DMI_MATCH(DMI_PRODUCT_NAME, "Thin A15 B7VE"),	759	DMI_MATCH(DMI_PRODUCT_NAME, "Thin A15 B7VE"),
753	}	760	}
754	},	761	},
		762	{
		763	.driver_data = &acp6x_card,
		764	.matches = {
		765	DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
		766	DMI_MATCH(DMI_PRODUCT_NAME, "M7601RM"),
		767	}
		768	},
755	{}	769	{}
756	};	770	};
757		771

sound/soc/codecs/adau1372.c+24−10

 	return 0;
 }
-static void adau1372_enable_pll(struct adau1372 *adau1372)
+static int adau1372_enable_pll(struct adau1372 *adau1372)
 {
 	unsigned int val, timeout = 0;
 	int ret;
 		timeout++;
 	} while (!(val & 1) && timeout < 3);
-	if (ret < 0 || !(val & 1))
+	if (ret < 0 || !(val & 1)) {
 		dev_err(adau1372->dev, "Failed to lock PLL\n");
+		return ret < 0 ? ret : -ETIMEDOUT;
+	}
+	return 0;
 }
-static void adau1372_set_power(struct adau1372 *adau1372, bool enable)
+static int adau1372_set_power(struct adau1372 *adau1372, bool enable)
 {
 	if (adau1372->enabled == enable)
-		return;
+		return 0;
 	if (enable) {
 		unsigned int clk_ctrl = ADAU1372_CLK_CTRL_MCLK_EN;
+		int ret;
-		clk_prepare_enable(adau1372->mclk);
+		ret = clk_prepare_enable(adau1372->mclk);
+		if (ret)
+			return ret;
 		if (adau1372->pd_gpio)
 			gpiod_set_value(adau1372->pd_gpio, 0);
 		 * accessed.
 		 */
 		if (adau1372->use_pll) {
-			adau1372_enable_pll(adau1372);
+			ret = adau1372_enable_pll(adau1372);
+			if (ret) {
+				regcache_cache_only(adau1372->regmap, true);
+				if (adau1372->pd_gpio)
+					gpiod_set_value(adau1372->pd_gpio, 1);
+				clk_disable_unprepare(adau1372->mclk);
+				return ret;
+			}
 			clk_ctrl |= ADAU1372_CLK_CTRL_CLKSRC;
 		}
 	}
 	adau1372->enabled = enable;
+	return 0;
 }
 static int adau1372_set_bias_level(struct snd_soc_component *component,
 	case SND_SOC_BIAS_PREPARE:
 		break;
 	case SND_SOC_BIAS_STANDBY:
-		adau1372_set_power(adau1372, true);
+		return adau1372_set_power(adau1372, true);
-		break;
 	case SND_SOC_BIAS_OFF:
-		adau1372_set_power(adau1372, false);
+		return adau1372_set_power(adau1372, false);
-		break;
 	}
 	return 0;

sound/soc/sdca/sdca_functions.c+10−4

 	} else if (num_init_writes % sizeof(*raw) != 0) {
 		dev_err(dev, "%pfwP: init table size invalid\n", function_node);
 		return -EINVAL;
-	} else if ((num_init_writes / sizeof(*raw)) > SDCA_MAX_INIT_COUNT) {
-		dev_err(dev, "%pfwP: maximum init table size exceeded\n", function_node);
-		return -EINVAL;
 	}
 	raw = kzalloc(num_init_writes, GFP_KERNEL);
 static struct sdca_entity *find_sdca_entity_by_label(struct sdca_function_data *function,
 						     const char *entity_label)
 {
+	struct sdca_entity *entity = NULL;
 	int i;
 	for (i = 0; i < function->num_entities; i++) {
-		struct sdca_entity *entity = &function->entities[i];
+		entity = &function->entities[i];
+		/* check whole string first*/
+		if (!strcmp(entity->label, entity_label))
+			return entity;
+	}
+	for (i = 0; i < function->num_entities; i++) {
+		entity = &function->entities[i];
 		if (!strncmp(entity->label, entity_label, strlen(entity_label)))
 			return entity;

sound/soc/sof/ipc4-topology.c+1−1

@@ -2951,7 +2951,7 @@ static int sof_ipc4_control_load_bytes(struct snd_sof_dev *sdev, struct snd_sof_ · 2950 unmodified lines
2951	return -EINVAL;	2951	return -EINVAL;
2952	}	2952	}
2953		2953
2954	if (scontrol->priv_size < sizeof(struct sof_abi_hdr)) {	2954	if (scontrol->priv_size && scontrol->priv_size < sizeof(struct sof_abi_hdr)) {
2955	dev_err(sdev->dev,	2955	dev_err(sdev->dev,
2956	"bytes control %s initial data size %zu is insufficient.\n",	2956	"bytes control %s initial data size %zu is insufficient.\n",
2957	scontrol->name, scontrol->priv_size);	2957	scontrol->name, scontrol->priv_size);

sound/usb/Kconfig+1−0

@@ -192,6 +192,7 @@ config SND_USB_AUDIO_QMI · 191 unmodified lines
192	tristate "Qualcomm Audio Offload driver"	192	tristate "Qualcomm Audio Offload driver"
193	depends on QCOM_QMI_HELPERS && SND_USB_AUDIO && SND_SOC_USB	193	depends on QCOM_QMI_HELPERS && SND_USB_AUDIO && SND_SOC_USB
194	depends on USB_XHCI_HCD && USB_XHCI_SIDEBAND	194	depends on USB_XHCI_HCD && USB_XHCI_SIDEBAND
		195	select AUXILIARY_BUS
195	help	196	help
196	Say Y here to enable the Qualcomm USB audio offloading feature.	197	Say Y here to enable the Qualcomm USB audio offloading feature.
197		198

sound/usb/qcom/qc_audio_offload.c+1−1

@@ -1,6 +1,6 @@
1	// SPDX-License-Identifier: GPL-2.0	1	// SPDX-License-Identifier: GPL-2.0
2	/*	2	/*
3	* Copyright (c) 2022-2025 Qualcomm Innovation Center, Inc. All rights reserved.	3	* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
4	*/	4	*/
5		5
6	#include <linux/auxiliary_bus.h>	6	#include <linux/auxiliary_bus.h>

sound/usb/quirks.c+4−0

 	/* Device matches */
 	DEVICE_FLG(0x001f, 0x0b21, /* AB13X USB Audio */
 		   QUIRK_FLAG_FORCE_IFACE_RESET | QUIRK_FLAG_IFACE_DELAY),
+	DEVICE_FLG(0x001f, 0x0b23, /* AB17X USB Audio */
+		   QUIRK_FLAG_FORCE_IFACE_RESET | QUIRK_FLAG_IFACE_DELAY),
 	DEVICE_FLG(0x0020, 0x0b21, /* GHW-123P */
 		   QUIRK_FLAG_FORCE_IFACE_RESET | QUIRK_FLAG_IFACE_DELAY),
 	DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */
 		   QUIRK_FLAG_CTL_MSG_DELAY | QUIRK_FLAG_IFACE_DELAY),
 	VENDOR_FLG(0x07fd, /* MOTU */
 		   QUIRK_FLAG_VALIDATE_RATES),
+	DEVICE_FLG(0x1235, 0x8006, 0), /* Focusrite Scarlett 2i2 1st Gen */
+	DEVICE_FLG(0x1235, 0x800a, 0), /* Focusrite Scarlett 2i4 1st Gen */
 	VENDOR_FLG(0x1235, /* Focusrite Novation */
 		   QUIRK_FLAG_SKIP_CLOCK_SELECTOR |
 		   QUIRK_FLAG_SKIP_IFACE_SETUP),

tools/arch/x86/include/asm/msr-index.h+4−1

 #define MSR_AMD64_SNP_SMT_PROT		BIT_ULL(MSR_AMD64_SNP_SMT_PROT_BIT)
 #define MSR_AMD64_SNP_SECURE_AVIC_BIT	18
 #define MSR_AMD64_SNP_SECURE_AVIC	BIT_ULL(MSR_AMD64_SNP_SECURE_AVIC_BIT)
-#define MSR_AMD64_SNP_RESV_BIT		19
+#define MSR_AMD64_SNP_RESERVED_BITS19_22 GENMASK_ULL(22, 19)
+#define MSR_AMD64_SNP_IBPB_ON_ENTRY_BIT	23
+#define MSR_AMD64_SNP_IBPB_ON_ENTRY	BIT_ULL(MSR_AMD64_SNP_IBPB_ON_ENTRY_BIT)
+#define MSR_AMD64_SNP_RESV_BIT		24
 #define MSR_AMD64_SNP_RESERVED_MASK	GENMASK_ULL(63, MSR_AMD64_SNP_RESV_BIT)
 #define MSR_AMD64_SAVIC_CONTROL		0xc0010138
 #define MSR_AMD64_SAVIC_EN_BIT		0

tools/arch/x86/include/uapi/asm/kvm.h+1−0

@@ -476,6 +476,7 @@ struct kvm_sync_regs { · 475 unmodified lines
476	#define KVM_X86_QUIRK_SLOT_ZAP_ALL (1 << 7)	476	#define KVM_X86_QUIRK_SLOT_ZAP_ALL (1 << 7)
477	#define KVM_X86_QUIRK_STUFF_FEATURE_MSRS (1 << 8)	477	#define KVM_X86_QUIRK_STUFF_FEATURE_MSRS (1 << 8)
478	#define KVM_X86_QUIRK_IGNORE_GUEST_PAT (1 << 9)	478	#define KVM_X86_QUIRK_IGNORE_GUEST_PAT (1 << 9)
		479	#define KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM (1 << 10)
479		480
480	#define KVM_STATE_NESTED_FORMAT_VMX 0	481	#define KVM_STATE_NESTED_FORMAT_VMX 0
481	#define KVM_STATE_NESTED_FORMAT_SVM 1	482	#define KVM_STATE_NESTED_FORMAT_SVM 1

tools/include/linux/build_bug.h+3−1

 /**
  * BUILD_BUG_ON_MSG - break compile if a condition is true & emit supplied
  *		      error message.
- * @condition: the condition which the compiler should know is false.
+ * @cond: the condition which the compiler should know is false.
+ * @msg: build-time error message
  *
  * See BUILD_BUG_ON for description.
  */
 /**
  * static_assert - check integer constant expression at build time
+ * @expr: expression to be checked
  *
  * static_assert() is a wrapper for the C11 _Static_assert, with a
  * little macro magic to make the message optional (defaulting to the

tools/include/uapi/linux/kvm.h+8−0

 #include <linux/ioctl.h>
 #include <asm/kvm.h>
+#ifdef __KERNEL__
+#include <linux/kvm_types.h>
+#endif
 #define KVM_API_VERSION 12
 /*
 	__u16 size;
 	__u32 offset;
 	__u32 bucket_size;
+#ifdef __KERNEL__
+	char name[KVM_STATS_NAME_SIZE];
+#else
 	char name[];
+#endif
 };
 #define KVM_GET_STATS_FD  _IO(KVMIO,  0xce)

tools/perf/check-headers.sh+0−1

@@ -187,7 +187,6 @@ done · 186 unmodified lines
187	check arch/x86/lib/memcpy_64.S '-I "^EXPORT_SYMBOL" -I "^#include <asm/export.h>" -I"^SYM_FUNC_START$_LOCAL$*(memcpy_$erms\\|orig$)" -I"^#include <linux/cfi_types.h>"'	187	check arch/x86/lib/memcpy_64.S '-I "^EXPORT_SYMBOL" -I "^#include <asm/export.h>" -I"^SYM_FUNC_START$_LOCAL$*(memcpy_$erms\\|orig$)" -I"^#include <linux/cfi_types.h>"'
188	check arch/x86/lib/memset_64.S '-I "^EXPORT_SYMBOL" -I "^#include <asm/export.h>" -I"^SYM_FUNC_START$_LOCAL$*(memset_$erms\\|orig$)"'	188	check arch/x86/lib/memset_64.S '-I "^EXPORT_SYMBOL" -I "^#include <asm/export.h>" -I"^SYM_FUNC_START$_LOCAL$*(memset_$erms\\|orig$)"'
189	check arch/x86/include/asm/amd/ibs.h '-I "^#include .*/msr-index.h"'	189	check arch/x86/include/asm/amd/ibs.h '-I "^#include .*/msr-index.h"'
190	check arch/arm64/include/asm/cputype.h '-I "^#include [<\"]$asm/$*sysreg.h"'
191	check include/linux/unaligned.h '-I "^#include <linux/unaligned/packed_struct.h>" -I "^#include <asm/byteorder.h>" -I "^#pragma GCC diagnostic"'	190	check include/linux/unaligned.h '-I "^#include <linux/unaligned/packed_struct.h>" -I "^#include <asm/byteorder.h>" -I "^#pragma GCC diagnostic"'
192	check include/uapi/asm-generic/mman.h '-I "^#include <$uapi/$asm-generic/mman-common$-tools$.h>"'	191	check include/uapi/asm-generic/mman.h '-I "^#include <$uapi/$asm-generic/mman-common$-tools$.h>"'
193	check include/uapi/linux/mman.h '-I "^#include <$uapi/$*asm/mman.h>"'	192	check include/uapi/linux/mman.h '-I "^#include <$uapi/$*asm/mman.h>"'

tools/perf/util/kvm-stat-arch/kvm-stat-x86.c+3−3

@@ -4,9 +4,9 @@ · 3 unmodified lines
4	#include "../kvm-stat.h"	4	#include "../kvm-stat.h"
5	#include "../evsel.h"	5	#include "../evsel.h"
6	#include "../env.h"	6	#include "../env.h"
7	#include "../../arch/x86/include/uapi/asm/svm.h"	7	#include "../../../arch/x86/include/uapi/asm/svm.h"
8	#include "../../arch/x86/include/uapi/asm/vmx.h"	8	#include "../../../arch/x86/include/uapi/asm/vmx.h"
9	#include "../../arch/x86/include/uapi/asm/kvm.h"	9	#include "../../../arch/x86/include/uapi/asm/kvm.h"
10	#include <subcmd/parse-options.h>	10	#include <subcmd/parse-options.h>
11		11
12	define_exit_reasons_table(vmx_exit_reasons, VMX_EXIT_REASONS);	12	define_exit_reasons_table(vmx_exit_reasons, VMX_EXIT_REASONS);

tools/perf/util/metricgroup.c+3−3

@@ -1605,9 +1605,9 @@ bool metricgroup__has_metric_or_groups(const char pmu, const char metric_or_gr · 1604 unmodified lines
1605	.metric_or_groups = metric_or_groups,	1605	.metric_or_groups = metric_or_groups,
1606	};	1606	};
1607		1607
1608	return pmu_metrics_table__for_each_metric(table,	1608	return metricgroup__for_each_metric(table,
1609	metricgroup__has_metric_or_groups_callback,	1609	metricgroup__has_metric_or_groups_callback,
1610	&data)	1610	&data)
1611	? true : false;	1611	? true : false;
1612	}	1612	}
1613		1613

tools/perf/util/parse-events.c+65−17

@@ -1117,7 +1117,7 @@ static int config_attr(struct perf_event_attr *attr, · 1116 unmodified lines
1117		1117
1118	static struct evsel_config_term *add_config_term(enum evsel_term_type type,	1118	static struct evsel_config_term *add_config_term(enum evsel_term_type type,
1119	struct list_head *head_terms,	1119	struct list_head *head_terms,
1120	bool weak)	1120	bool weak, char *str, u64 val)
1121	{	1121	{
1122	struct evsel_config_term *t;	1122	struct evsel_config_term *t;
1123		1123
@@ -1128,8 +1128,62 @@ static struct evsel_config_term *add_config_term(enum evsel_term_type type, · 4 unmodified lines
1128	INIT_LIST_HEAD(&t->list);	1128	INIT_LIST_HEAD(&t->list);
1129	t->type = type;	1129	t->type = type;
1130	t->weak = weak;	1130	t->weak = weak;
1131	list_add_tail(&t->list, head_terms);
1132		1131
		1132	switch (type) {
		1133	case EVSEL__CONFIG_TERM_PERIOD:
		1134	case EVSEL__CONFIG_TERM_FREQ:
		1135	case EVSEL__CONFIG_TERM_STACK_USER:
		1136	case EVSEL__CONFIG_TERM_USR_CHG_CONFIG:
		1137	case EVSEL__CONFIG_TERM_USR_CHG_CONFIG1:
		1138	case EVSEL__CONFIG_TERM_USR_CHG_CONFIG2:
		1139	case EVSEL__CONFIG_TERM_USR_CHG_CONFIG3:
		1140	case EVSEL__CONFIG_TERM_USR_CHG_CONFIG4:
		1141	t->val.val = val;
		1142	break;
		1143	case EVSEL__CONFIG_TERM_TIME:
		1144	t->val.time = val;
		1145	break;
		1146	case EVSEL__CONFIG_TERM_INHERIT:
		1147	t->val.inherit = val;
		1148	break;
		1149	case EVSEL__CONFIG_TERM_OVERWRITE:
		1150	t->val.overwrite = val;
		1151	break;
		1152	case EVSEL__CONFIG_TERM_MAX_STACK:
		1153	t->val.max_stack = val;
		1154	break;
		1155	case EVSEL__CONFIG_TERM_MAX_EVENTS:
		1156	t->val.max_events = val;
		1157	break;
		1158	case EVSEL__CONFIG_TERM_PERCORE:
		1159	t->val.percore = val;
		1160	break;
		1161	case EVSEL__CONFIG_TERM_AUX_OUTPUT:
		1162	t->val.aux_output = val;
		1163	break;
		1164	case EVSEL__CONFIG_TERM_AUX_SAMPLE_SIZE:
		1165	t->val.aux_sample_size = val;
		1166	break;
		1167	case EVSEL__CONFIG_TERM_CALLGRAPH:
		1168	case EVSEL__CONFIG_TERM_BRANCH:
		1169	case EVSEL__CONFIG_TERM_DRV_CFG:
		1170	case EVSEL__CONFIG_TERM_RATIO_TO_PREV:
		1171	case EVSEL__CONFIG_TERM_AUX_ACTION:
		1172	if (str) {
		1173	t->val.str = strdup(str);
		1174	if (!t->val.str) {
		1175	zfree(&t);
		1176	return NULL;
		1177	}
		1178	t->free_str = true;
		1179	}
		1180	break;
		1181	default:
		1182	t->val.val = val;
		1183	break;
		1184	}
		1185
		1186	list_add_tail(&t->list, head_terms);
1133	return t;	1187	return t;
1134	}	1188	}
1135		1189
@@ -1142,7 +1196,7 @@ static int get_config_terms(const struct parse_events_terms *head_config, · 6 unmodified lines
1142	struct evsel_config_term *new_term;	1196	struct evsel_config_term *new_term;
1143	enum evsel_term_type new_type;	1197	enum evsel_term_type new_type;
1144	bool str_type = false;	1198	bool str_type = false;
1145	u64 val;	1199	u64 val = 0;
1146		1200
1147	switch (term->type_term) {	1201	switch (term->type_term) {
1148	case PARSE_EVENTS__TERM_TYPE_SAMPLE_PERIOD:	1202	case PARSE_EVENTS__TERM_TYPE_SAMPLE_PERIOD:
@@ -1234,20 +1288,15 @@ static int get_config_terms(const struct parse_events_terms *head_config, · 85 unmodified lines
1234	continue;	1288	continue;
1235	}	1289	}
1236		1290
1237	new_term = add_config_term(new_type, head_terms, term->weak);	1291	/*
		1292	* Note: Members evsel_config_term::val and
		1293	* parse_events_term::val are unions and endianness needs
		1294	* to be taken into account when changing such union members.
		1295	*/
		1296	new_term = add_config_term(new_type, head_terms, term->weak,
		1297	str_type ? term->val.str : NULL, val);
1238	if (!new_term)	1298	if (!new_term)
1239	return -ENOMEM;	1299	return -ENOMEM;
1240
1241	if (str_type) {
1242	new_term->val.str = strdup(term->val.str);
1243	if (!new_term->val.str) {
1244	zfree(&new_term);
1245	return -ENOMEM;
1246	}
1247	new_term->free_str = true;
1248	} else {
1249	new_term->val.val = val;
1250	}
1251	}	1300	}
1252	return 0;	1301	return 0;
1253	}	1302	}
@@ -1277,10 +1326,9 @@ static int add_cfg_chg(const struct perf_pmu *pmu, · 23 unmodified lines
1277	if (bits) {	1326	if (bits) {
1278	struct evsel_config_term *new_term;	1327	struct evsel_config_term *new_term;
1279		1328
1280	new_term = add_config_term(new_term_type, head_terms, false);	1329	new_term = add_config_term(new_term_type, head_terms, false, NULL, bits);
1281	if (!new_term)	1330	if (!new_term)
1282	return -ENOMEM;	1331	return -ENOMEM;
1283	new_term->val.cfg_chg = bits;
1284	}	1332	}
1285		1333
1286	return 0;	1334	return 0;

tools/testing/selftests/drivers/net/team/Makefile+1−0

@@ -3,6 +3,7 @@ · 2 unmodified lines
3		3
4	TEST_PROGS := \	4	TEST_PROGS := \
5	dev_addr_lists.sh \	5	dev_addr_lists.sh \
		6	non_ether_header_ops.sh \
6	options.sh \	7	options.sh \
7	propagation.sh \	8	propagation.sh \
8	refleak.sh \	9	refleak.sh \

tools/testing/selftests/drivers/net/team/config+2−0

+CONFIG_BONDING=y
 CONFIG_DUMMY=y
 CONFIG_IPV6=y
 CONFIG_MACVLAN=y
 CONFIG_NETDEVSIM=m
+CONFIG_NET_IPGRE=y
 CONFIG_NET_TEAM=y
 CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=y
 CONFIG_NET_TEAM_MODE_LOADBALANCE=y

tools/testing/selftests/drivers/net/team/non_ether_header_ops.sh+41−0

@@ -0,0 +1,41 @@
	1	#!/bin/bash
	2	# SPDX-License-Identifier: GPL-2.0
	3	# shellcheck disable=SC2154
	4	#
	5	# Reproduce the non-Ethernet header_ops confusion scenario with:
	6	# g0 (gre) -> b0 (bond) -> t0 (team)
	7	#
	8	# Before the fix, direct header_ops inheritance in this stack could call
	9	# callbacks with the wrong net_device context and crash.
	10
	11	lib_dir=$(dirname "$0")
	12	source "$lib_dir"/../../../net/lib.sh
	13
	14	trap cleanup_all_ns EXIT
	15
	16	setup_ns ns1
	17
	18	ip -n "$ns1" link add d0 type dummy
	19	ip -n "$ns1" addr add 10.10.10.1/24 dev d0
	20	ip -n "$ns1" link set d0 up
	21
	22	ip -n "$ns1" link add g0 type gre local 10.10.10.1
	23	ip -n "$ns1" link add b0 type bond mode active-backup
	24	ip -n "$ns1" link add t0 type team
	25
	26	ip -n "$ns1" link set g0 master b0
	27	ip -n "$ns1" link set b0 master t0
	28
	29	ip -n "$ns1" link set g0 up
	30	ip -n "$ns1" link set b0 up
	31	ip -n "$ns1" link set t0 up
	32
	33	# IPv6 address assignment triggers MLD join reports that call
	34	# dev_hard_header() on t0, exercising the inherited header_ops path.
	35	ip -n "$ns1" -6 addr add 2001:db8:1::1/64 dev t0 nodad
	36	for i in $(seq 1 20); do
	37	ip netns exec "$ns1" ping -6 -I t0 ff02::1 -c1 -W1 &>/dev/null \|\| true
	38	done
	39
	40	echo "PASS: non-Ethernet header_ops stacking did not crash"
	41	exit "$EXIT_STATUS"

tools/testing/selftests/kvm/Makefile.kvm+1−0

@@ -206,6 +206,7 @@ TEST_GEN_PROGS_s390 += s390/ucontrol_test · 205 unmodified lines
206	TEST_GEN_PROGS_s390 += s390/user_operexec	206	TEST_GEN_PROGS_s390 += s390/user_operexec
207	TEST_GEN_PROGS_s390 += s390/keyop	207	TEST_GEN_PROGS_s390 += s390/keyop
208	TEST_GEN_PROGS_s390 += rseq_test	208	TEST_GEN_PROGS_s390 += rseq_test
		209	TEST_GEN_PROGS_s390 += s390/irq_routing
209		210
210	TEST_GEN_PROGS_riscv = $(TEST_GEN_PROGS_COMMON)	211	TEST_GEN_PROGS_riscv = $(TEST_GEN_PROGS_COMMON)
211	TEST_GEN_PROGS_riscv += riscv/sbi_pmu_test	212	TEST_GEN_PROGS_riscv += riscv/sbi_pmu_test

tools/testing/selftests/kvm/s390/irq_routing.c+75−0

@@ -0,0 +1,75 @@
	1	// SPDX-License-Identifier: GPL-2.0-only
	2	/*
	3	* IRQ routing offset tests.
	4	*
	5	* Copyright IBM Corp. 2026
	6	*
	7	* Authors:
	8	* Janosch Frank <frankja@linux.ibm.com>
	9	*/
	10	#include <stdio.h>
	11	#include <stdlib.h>
	12	#include <string.h>
	13	#include <sys/ioctl.h>
	14
	15	#include "test_util.h"
	16	#include "kvm_util.h"
	17	#include "kselftest.h"
	18	#include "ucall_common.h"
	19
	20	extern char guest_code[];
	21	asm("guest_code:\n"
	22	"diag %r0,%r0,0\n"
	23	"j .\n");
	24
	25	static void test(void)
	26	{
	27	struct kvm_irq_routing *routing;
	28	struct kvm_vcpu *vcpu;
	29	struct kvm_vm *vm;
	30	vm_paddr_t mem;
	31	int ret;
	32
	33	struct kvm_irq_routing_entry ue = {
	34	.type = KVM_IRQ_ROUTING_S390_ADAPTER,
	35	.gsi = 1,
	36	};
	37
	38	vm = vm_create_with_one_vcpu(&vcpu, guest_code);
	39	mem = vm_phy_pages_alloc(vm, 2, 4096 * 42, 0);
	40
	41	routing = kvm_gsi_routing_create();
	42	routing->nr = 1;
	43	routing->entries[0] = ue;
	44	routing->entries[0].u.adapter.summary_addr = (uintptr_t)mem;
	45	routing->entries[0].u.adapter.ind_addr = (uintptr_t)mem;
	46
	47	routing->entries[0].u.adapter.summary_offset = 4096 * 8;
	48	ret = __vm_ioctl(vm, KVM_SET_GSI_ROUTING, routing);
	49	ksft_test_result(ret == -1 && errno == EINVAL, "summary offset outside of page\n");
	50
	51	routing->entries[0].u.adapter.summary_offset -= 4;
	52	ret = __vm_ioctl(vm, KVM_SET_GSI_ROUTING, routing);
	53	ksft_test_result(ret == 0, "summary offset inside of page\n");
	54
	55	routing->entries[0].u.adapter.ind_offset = 4096 * 8;
	56	ret = __vm_ioctl(vm, KVM_SET_GSI_ROUTING, routing);
	57	ksft_test_result(ret == -1 && errno == EINVAL, "ind offset outside of page\n");
	58
	59	routing->entries[0].u.adapter.ind_offset -= 4;
	60	ret = __vm_ioctl(vm, KVM_SET_GSI_ROUTING, routing);
	61	ksft_test_result(ret == 0, "ind offset inside of page\n");
	62
	63	kvm_vm_free(vm);
	64	}
	65
	66	int main(int argc, char *argv[])
	67	{
	68	TEST_REQUIRE(kvm_has_cap(KVM_CAP_IRQ_ROUTING));
	69
	70	ksft_print_header();
	71	ksft_set_plan(4);
	72	test();
	73
	74	ksft_finished(); /* Print results and exit() accordingly */
	75	}

tools/testing/selftests/landlock/tsync_test.c+90−1

@@ -6,9 +6,10 @@ · 5 unmodified lines
6	*/	6	*/
7		7
8	#define _GNU_SOURCE	8	#define _GNU_SOURCE
		9	#include <linux/landlock.h>
9	#include <pthread.h>	10	#include <pthread.h>
		11	#include <signal.h>
10	#include <sys/prctl.h>	12	#include <sys/prctl.h>
11	#include <linux/landlock.h>
12		13
13	#include "common.h"	14	#include "common.h"
14		15
@@ -158,4 +159,92 @@ TEST(competing_enablement) · 143 unmodified lines
158	EXPECT_EQ(0, close(ruleset_fd));	159	EXPECT_EQ(0, close(ruleset_fd));
159	}	160	}
160		161
		162	static void signal_nop_handler(int sig)
		163	{
		164	}
		165
		166	struct signaler_data {
		167	pthread_t target;
		168	volatile bool stop;
		169	};
		170
		171	static void signaler_thread(void data)
		172	{
		173	struct signaler_data *sd = data;
		174
		175	while (!sd->stop)
		176	pthread_kill(sd->target, SIGUSR1);
		177
		178	return NULL;
		179	}
		180
		181	/*
		182	* Number of idle sibling threads. This must be large enough that even on
		183	* machines with many cores, the sibling threads cannot all complete their
		184	* credential preparation in a single parallel wave, otherwise the signaler
		185	* thread has no window to interrupt wait_for_completion_interruptible().
		186	* 200 threads on a 64-core machine yields ~3 serialized waves, giving the
		187	* tight signal loop enough time to land an interruption.
		188	*/
		189	#define NUM_IDLE_THREADS 200
		190
		191	/*
		192	* Exercises the tsync interruption and cancellation paths in tsync.c.
		193	*
		194	* When a signal interrupts the calling thread while it waits for sibling
		195	* threads to finish their credential preparation
		196	* (wait_for_completion_interruptible in landlock_restrict_sibling_threads),
		197	* the kernel sets ERESTARTNOINTR, cancels queued task works that have not
		198	* started yet (cancel_tsync_works), then waits for the remaining works to
		199	* finish. On the error return, syscalls.c aborts the prepared credentials.
		200	* The kernel automatically restarts the syscall, so userspace sees success.
		201	*/
		202	TEST(tsync_interrupt)
		203	{
		204	size_t i;
		205	pthread_t threads[NUM_IDLE_THREADS];
		206	pthread_t signaler;
		207	struct signaler_data sd;
		208	struct sigaction sa = {};
		209	const int ruleset_fd = create_ruleset(_metadata);
		210
		211	disable_caps(_metadata);
		212
		213	/* Install a no-op SIGUSR1 handler so the signal does not kill us. */
		214	sa.sa_handler = signal_nop_handler;
		215	sigemptyset(&sa.sa_mask);
		216	ASSERT_EQ(0, sigaction(SIGUSR1, &sa, NULL));
		217
		218	ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0));
		219
		220	for (i = 0; i < NUM_IDLE_THREADS; i++)
		221	ASSERT_EQ(0, pthread_create(&threads[i], NULL, idle, NULL));
		222
		223	/*
		224	* Start a signaler thread that continuously sends SIGUSR1 to the
		225	* calling thread. This maximizes the chance of interrupting
		226	* wait_for_completion_interruptible() in the kernel's tsync path.
		227	*/
		228	sd.target = pthread_self();
		229	sd.stop = false;
		230	ASSERT_EQ(0, pthread_create(&signaler, NULL, signaler_thread, &sd));
		231
		232	/*
		233	* The syscall may be interrupted and transparently restarted by the
		234	* kernel (ERESTARTNOINTR). From userspace, it should always succeed.
		235	*/
		236	EXPECT_EQ(0, landlock_restrict_self(ruleset_fd,
		237	LANDLOCK_RESTRICT_SELF_TSYNC));
		238
		239	sd.stop = true;
		240	ASSERT_EQ(0, pthread_join(signaler, NULL));
		241
		242	for (i = 0; i < NUM_IDLE_THREADS; i++) {
		243	ASSERT_EQ(0, pthread_cancel(threads[i]));
		244	ASSERT_EQ(0, pthread_join(threads[i], NULL));
		245	}
		246
		247	EXPECT_EQ(0, close(ruleset_fd));
		248	}
		249
161	TEST_HARNESS_MAIN	250	TEST_HARNESS_MAIN

tools/testing/selftests/mount_setattr/mount_setattr_test.c+1−1

@@ -1020,7 +1020,7 @@ FIXTURE_SETUP(mount_setattr_idmapped) · 1019 unmodified lines
1020	"size=100000,mode=700"), 0);	1020	"size=100000,mode=700"), 0);
1021		1021
1022	ASSERT_EQ(mount("testing", "/mnt", "tmpfs", MS_NOATIME \| MS_NODEV,	1022	ASSERT_EQ(mount("testing", "/mnt", "tmpfs", MS_NOATIME \| MS_NODEV,
1023	"size=2m,mode=700"), 0);	1023	"size=256m,mode=700"), 0);
1024		1024
1025	ASSERT_EQ(mkdir("/mnt/A", 0777), 0);	1025	ASSERT_EQ(mkdir("/mnt/A", 0777), 0);
1026		1026

tools/testing/selftests/net/fib_tests.sh+58−3

@@ -868,6 +868,64 @@ fib6_gc_test() · 867 unmodified lines
868	check_rt_num 5 $($IP -6 route list \|grep -v expires\|grep 2001:20::\|wc -l)	868	check_rt_num 5 $($IP -6 route list \|grep -v expires\|grep 2001:20::\|wc -l)
869	log_test $ret 0 "ipv6 route garbage collection (replace with permanent)"	869	log_test $ret 0 "ipv6 route garbage collection (replace with permanent)"
870		870
		871	# Delete dummy_10 and remove all routes
		872	$IP link del dev dummy_10
		873
		874	# rd6 is required for the next test. (ipv6toolkit)
		875	if [ ! -x "$(command -v rd6)" ]; then
		876	echo "SKIP: rd6 not found."
		877	set +e
		878	cleanup &> /dev/null
		879	return
		880	fi
		881
		882	setup_ns ns2
		883	$IP link add veth1 type veth peer veth2 netns $ns2
		884	$IP link set veth1 up
		885	ip -netns $ns2 link set veth2 up
		886	$IP addr add fe80:dead::1/64 dev veth1
		887	ip -netns $ns2 addr add fe80:dead::2/64 dev veth2
		888
		889	# Add NTF_ROUTER neighbour to prevent rt6_age_examine_exception()
		890	# from removing not-yet-expired exceptions.
		891	ip -netns $ns2 link set veth2 address 00:11:22:33:44:55
		892	$IP neigh add fe80:dead::3 lladdr 00:11:22:33:44:55 dev veth1 router
		893
		894	$NS_EXEC sysctl -wq net.ipv6.conf.veth1.accept_redirects=1
		895	$NS_EXEC sysctl -wq net.ipv6.conf.veth1.forwarding=0
		896
		897	# Temporary routes
		898	for i in $(seq 1 5); do
		899	# Expire route after $EXPIRE seconds
		900	$IP -6 route add 2001:10::$i \
		901	via fe80:dead::2 dev veth1 expires $EXPIRE
		902
		903	ip netns exec $ns2 rd6 -i veth2 \
		904	-s fe80:dead::2 -d fe80:dead::1 \
		905	-r 2001:10::$i -t fe80:dead::3 -p ICMP6
		906	done
		907
		908	check_rt_num 5 $($IP -6 route list \| grep expires \| grep 2001:10:: \| wc -l)
		909
		910	# Promote to permanent routes by "prepend" (w/o NLM_F_EXCL and NLM_F_REPLACE)
		911	for i in $(seq 1 5); do
		912	# -EEXIST, but the temporary route becomes the permanent route.
		913	$IP -6 route append 2001:10::$i \
		914	via fe80:dead::2 dev veth1 2>/dev/null \|\| true
		915	done
		916
		917	check_rt_num 5 $($IP -6 route list \| grep -v expires \| grep 2001:10:: \| wc -l)
		918	check_rt_num 5 $($IP -6 route list cache \| grep 2001:10:: \| wc -l)
		919
		920	# Trigger GC instead of waiting $GC_WAIT_TIME.
		921	# rt6_nh_dump_exceptions() just skips expired exceptions.
		922	$NS_EXEC sysctl -wq net.ipv6.route.flush=1
		923	check_rt_num 0 $($IP -6 route list cache \| grep 2001:10:: \| wc -l)
		924	log_test $ret 0 "ipv6 route garbage collection (promote to permanent routes)"
		925
		926	$IP neigh del fe80:dead::3 lladdr 00:11:22:33:44:55 dev veth1 router
		927	$IP link del veth1
		928
871	# ra6 is required for the next test. (ipv6toolkit)	929	# ra6 is required for the next test. (ipv6toolkit)
872	if [ ! -x "$(command -v ra6)" ]; then	930	if [ ! -x "$(command -v ra6)" ]; then
873	echo "SKIP: ra6 not found."	931	echo "SKIP: ra6 not found."
@@ -876,9 +934,6 @@ fib6_gc_test() · 2 unmodified lines
876	return	934	return
877	fi	935	fi
878		936
879	# Delete dummy_10 and remove all routes
880	$IP link del dev dummy_10
881
882	# Create a pair of veth devices to send a RA message from one	937	# Create a pair of veth devices to send a RA message from one
883	# device to another.	938	# device to another.
884	$IP link add veth1 type veth peer name veth2	939	$IP link add veth1 type veth peer name veth2

tools/testing/selftests/net/netfilter/nft_concat_range.sh+69−1

@@ -29,7 +29,8 @@ TYPES="net_port port_net net6_port port_proto net6_port_mac net6_port_mac_proto · 28 unmodified lines
29	net6_port_net6_port net_port_mac_proto_net"	29	net6_port_net6_port net_port_mac_proto_net"
30		30
31	# Reported bugs, also described by TYPE_ variables below	31	# Reported bugs, also described by TYPE_ variables below
32	BUGS="flush_remove_add reload net_port_proto_match avx2_mismatch doublecreate insert_overlap"	32	BUGS="flush_remove_add reload net_port_proto_match avx2_mismatch doublecreate
		33	insert_overlap load_flush_load4 load_flush_load8"
33		34
34	# List of possible paths to pktgen script from kernel tree for performance tests	35	# List of possible paths to pktgen script from kernel tree for performance tests
35	PKTGEN_SCRIPT_PATHS="	36	PKTGEN_SCRIPT_PATHS="
@@ -432,6 +433,30 @@ race_repeat 0 · 396 unmodified lines
432	perf_duration 0	433	perf_duration 0
433	"	434	"
434		435
		436	TYPE_load_flush_load4="
		437	display reload with flush, 4bit groups
		438	type_spec ipv4_addr . ipv4_addr
		439	chain_spec ip saddr . ip daddr
		440	dst addr4
		441	proto icmp
		442
		443	race_repeat 0
		444
		445	perf_duration 0
		446	"
		447
		448	TYPE_load_flush_load8="
		449	display reload with flush, 8bit groups
		450	type_spec ipv4_addr . ipv4_addr
		451	chain_spec ip saddr . ip daddr
		452	dst addr4
		453	proto icmp
		454
		455	race_repeat 0
		456
		457	perf_duration 0
		458	"
		459
435	# Set template for all tests, types and rules are filled in depending on test	460	# Set template for all tests, types and rules are filled in depending on test
436	set_template='	461	set_template='
437	flush ruleset	462	flush ruleset
@@ -1997,6 +2022,49 @@ test_bug_insert_overlap() · 1559 unmodified lines
1997	return 0	2022	return 0
1998	}	2023	}
1999		2024
		2025	test_bug_load_flush_load4()
		2026	{
		2027	local i
		2028
		2029	setup veth send_"${proto}" set \|\| return ${ksft_skip}
		2030
		2031	for i in $(seq 0 255); do
		2032	local addelem="add element inet filter test"
		2033	local j
		2034
		2035	for j in $(seq 0 20); do
		2036	echo "$addelem { 10.$j.0.$i . 10.$j.1.$i }"
		2037	echo "$addelem { 10.$j.0.$i . 10.$j.2.$i }"
		2038	done
		2039	done > "$tmp"
		2040
		2041	nft -f "$tmp" \|\| return 1
		2042
		2043	( echo "flush set inet filter test";cat "$tmp") \| nft -f -
		2044	[ $? -eq 0 ] \|\| return 1
		2045
		2046	return 0
		2047	}
		2048
		2049	test_bug_load_flush_load8()
		2050	{
		2051	local i
		2052
		2053	setup veth send_"${proto}" set \|\| return ${ksft_skip}
		2054
		2055	for i in $(seq 1 100); do
		2056	echo "add element inet filter test { 10.0.0.$i . 10.0.1.$i }"
		2057	echo "add element inet filter test { 10.0.0.$i . 10.0.2.$i }"
		2058	done > "$tmp"
		2059
		2060	nft -f "$tmp" \|\| return 1
		2061
		2062	( echo "flush set inet filter test";cat "$tmp") \| nft -f -
		2063	[ $? -eq 0 ] \|\| return 1
		2064
		2065	return 0
		2066	}
		2067
2000	test_reported_issues() {	2068	test_reported_issues() {
2001	eval test_bug_"${subtest}"	2069	eval test_bug_"${subtest}"
2002	}	2070	}

ASoC: Merge up fixes

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code