History

Merge tag 'nand/for-7.2' into mtd/next

* Extend SPI NAND continuous read to Winbond devices, which requires numerous changes in the spi-{mem,nand} layers such as the need for a secondary read operation template. * Continuous reads in general have also been enhanced/fixed for avoiding potential issues at probe time and at block boundaries. Plus, there is the usual load of misc fixes and improvements.

Miquel Raynal committed 4 months ago

Commit 49420df2 parents c10f641 4f2692a577 files · +8150 −5115Browse files

Unified · Split

577 files
  1. .mailmap +6 −0
  2. Documentation/admin-guide/cgroup-v2.rst +1 −1
  3. Documentation/devicetree/bindings/mailbox/qcom-ipcc.yaml +1 −0
  4. Documentation/devicetree/bindings/mtd/nand-chip.yaml +9 −0
  5. Documentation/filesystems/isofs.rst +1 −1
  6. Documentation/netlink/specs/psp.yaml +2 −0
  7. MAINTAINERS +70 −35
  8. Makefile +1 −1
  9. arch/arm64/include/asm/irqflags.h +7 −7
  10. arch/arm64/include/asm/kernel-pgtable.h +6 −1
  11. arch/arm64/include/asm/kvm_asm.h +18 −10
  12. arch/arm64/include/asm/kvm_host.h +1 −4
  13. arch/arm64/kernel/pi/patch-scs.c +2 −2
  14. arch/arm64/kernel/signal.c +43 −11
  15. arch/arm64/kvm/arm.c +4 −0
  16. arch/arm64/kvm/config.c +16 −7
  17. arch/arm64/kvm/hyp/nvhe/hyp-main.c +17 −13
  18. arch/arm64/kvm/hyp/nvhe/pkvm.c +25 −13
  19. arch/arm64/kvm/hyp/nvhe/setup.c +3 −3
  20. arch/arm64/kvm/vgic/vgic-mmio-v2.c +1 −1
  21. arch/arm64/kvm/vgic/vgic-mmio-v3.c +1 −1
  22. arch/s390/kernel/debug.c +8 −0
  23. arch/s390/mm/fault.c +1 −1
  24. arch/sh/include/asm/setup.h +1 −1
  25. crypto/authencesn.c +5 −0
  26. drivers/acpi/acpi_tad.c +19 −16
  27. drivers/acpi/apei/einj-core.c +25 −20
  28. drivers/acpi/arm64/cpuidle.c +3 −7
  29. drivers/acpi/cppc_acpi.c +3 −3
  30. drivers/acpi/video_detect.c +8 −0
  31. drivers/ata/pata_parport/pata_parport.c +7 −14
  32. drivers/base/regmap/regmap-sdw-mbq.c +1 −1
  33. drivers/cdrom/cdrom.c +48 −25
  34. drivers/dpll/dpll_netlink.c +10 −0
  35. drivers/dpll/dpll_netlink.h +0 −2
  36. drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +5 −1
  37. drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +1 −3
  38. drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +4 −2
  39. drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +4 −1
  40. drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +24 −33
  41. drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c +1 −1
  42. drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +3 −0
  43. drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c +15 −7
  44. drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h +1 −0
  45. drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +14 −3
  46. drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +1 −9
  47. drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +1 −9
  48. drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c +1 −10
  49. drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c +66 −0
  50. drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.c +1 −0
  51. drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c +2 −0
  52. drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c +1 −0
  53. drivers/gpu/drm/amd/amdgpu/jpeg_v4_0.c +1 −0
  54. drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c +1 −0
  55. drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c +1 −0
  56. drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_0.c +1 −0
  57. drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c +1 −0
  58. drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_2.c +1 −0
  59. drivers/gpu/drm/amd/amdgpu/jpeg_v5_3_0.c +1 −0
  60. drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c +1 −10
  61. drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c +1 −10
  62. drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c +10 −0
  63. drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c +2 −0
  64. drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c +2 −0
  65. drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c +6 −1
  66. drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c +4 −1
  67. drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c +1 −0
  68. drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c +1 −0
  69. drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c +1 −0
  70. drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c +1 −0
  71. drivers/gpu/drm/amd/amdgpu/vcn_v5_0_2.c +1 −0
  72. drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +24 −2
  73. drivers/gpu/drm/amd/amdkfd/kfd_priv.h +3 −0
  74. drivers/gpu/drm/amd/amdkfd/kfd_svm.c +11 −0
  75. drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +20 −4
  76. drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c +44 −0
  77. drivers/gpu/drm/amd/display/dc/bios/bios_parser.c +72 −1
  78. drivers/gpu/drm/amd/display/dc/dc.h +1 −1
  79. drivers/gpu/drm/amd/display/dc/dc_bios_types.h +2 −1
  80. drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c +3 −1
  81. drivers/gpu/drm/amd/display/dc/dcn30/dcn30_mmhubbub.c +2 −2
  82. drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c +3 −0
  83. drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c +59 −35
  84. drivers/gpu/drm/amd/display/dc/link/link_factory.c +3 −1
  85. drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c +2 −1
  86. drivers/gpu/drm/amd/display/dc/resource/dce80/dce80_resource.c +2 −1
  87. drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h +4 −0
  88. drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c +1 −0
  89. drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c +1 −0
  90. drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c +1 −1
  91. drivers/gpu/drm/drm_color_mgmt.c +1 −1
  92. drivers/gpu/drm/drm_gem_framebuffer_helper.c +2 −2
  93. drivers/gpu/drm/imagination/pvr_fw_trace.c +1 −1
  94. drivers/gpu/drm/sysfb/ofdrm.c +2 −0
  95. drivers/gpu/drm/tiny/appletbdrm.c +2 −2
  96. drivers/gpu/drm/udl/udl_main.c +1 −2
  97. drivers/gpu/drm/udl/udl_modeset.c +4 −1
  98. drivers/gpu/drm/xe/Makefile +1 −0
  99. drivers/gpu/drm/xe/regs/xe_gt_regs.h +1 −1
  100. drivers/gpu/drm/xe/xe_bo.c +6 −2
  101. drivers/gpu/drm/xe/xe_bo_types.h +2 −1
  102. drivers/gpu/drm/xe/xe_dma_buf.c +18 −5
  103. drivers/gpu/drm/xe/xe_eu_stall.c +2 −2
  104. drivers/gpu/drm/xe/xe_exec_queue.c +6 −3
  105. drivers/gpu/drm/xe/xe_gsc.c +1 −1
  106. drivers/gpu/drm/xe/xe_guc_submit.c +9 −24
  107. drivers/gpu/drm/xe/xe_lrc.c +1 −1
  108. drivers/gpu/drm/xe/xe_mem_pool.c +403 −0
  109. drivers/gpu/drm/xe/xe_mem_pool.h +35 −0
  110. drivers/gpu/drm/xe/xe_mem_pool_types.h +21 −0
  111. drivers/gpu/drm/xe/xe_migrate.c +31 −25
  112. drivers/gpu/drm/xe/xe_pci.c +1 −0
  113. drivers/gpu/drm/xe/xe_reg_whitelist.c +1 −1
  114. drivers/gpu/drm/xe/xe_sriov_vf_ccs.c +29 −25
  115. drivers/gpu/drm/xe/xe_sriov_vf_ccs_types.h +1 −4
  116. drivers/gpu/drm/xe/xe_tuning.c +1 −1
  117. drivers/gpu/drm/xe/xe_vm.c +4 −1
  118. drivers/gpu/drm/xe/xe_vm_madvise.c +47 −0
  119. drivers/gpu/drm/xe/xe_wa.c +0 −8
  120. drivers/mailbox/cix-mailbox.c +2 −4
  121. drivers/mailbox/exynos-mailbox.c +0 −4
  122. drivers/mailbox/hi3660-mailbox.c +0 −2
  123. drivers/mailbox/hi6220-mailbox.c +5 −9
  124. drivers/mailbox/imx-mailbox.c +1 −3
  125. drivers/mailbox/mailbox-sti.c +0 −2
  126. drivers/mailbox/mailbox-test.c +46 −34
  127. drivers/mailbox/mailbox.c +44 −23
  128. drivers/mailbox/mailbox.h +0 −12
  129. drivers/mailbox/mtk-cmdq-mailbox.c +5 −5
  130. drivers/mailbox/mtk-vcp-mailbox.c +1 −1
  131. drivers/mailbox/omap-mailbox.c +1 −3
  132. drivers/mailbox/pcc.c +0 −2
  133. drivers/mailbox/rockchip-mailbox.c +2 −7
  134. drivers/mailbox/tegra-hsp.c +2 −4
  135. drivers/md/md-bitmap.c +119 −12
  136. drivers/md/md-bitmap.h +1 −1
  137. drivers/md/md-llbitmap.c +6 −1
  138. drivers/md/md.c +102 −80
  139. drivers/md/md.h +4 −2
  140. drivers/md/persistent-data/dm-btree-remove.c +8 −0
  141. drivers/md/raid1-10.c +6 −1
  142. drivers/md/raid1.c +4 −11
  143. drivers/md/raid10.c +2 −0
  144. drivers/md/raid5.c +6 −1
  145. drivers/mtd/nand/raw/Kconfig +1 −1
  146. drivers/mtd/nand/raw/nand_base.c +12 −12
  147. drivers/mtd/nand/raw/ndfc.c +10 −10
  148. drivers/mtd/nand/raw/pl35x-nand-controller.c +1 −1
  149. drivers/mtd/nand/raw/qcom_nandc.c +6 −10
  150. drivers/mtd/nand/spi/core.c +136 −55
  151. drivers/mtd/nand/spi/macronix.c +28 −10
  152. drivers/mtd/nand/spi/winbond.c +252 −63
  153. drivers/mtd/spi-nor/core.c +12 −10
  154. drivers/mtd/spi-nor/debugfs.c +3 −1
  155. drivers/net/bareudp.c +3 −0
  156. drivers/net/bonding/bond_3ad.c +60 −49
  157. drivers/net/bonding/bond_main.c +5 −3
  158. drivers/net/bonding/bond_netlink.c +10 −6
  159. drivers/net/bonding/bond_procfs.c +2 −1
  160. drivers/net/bonding/bond_sysfs_slave.c +11 −6
  161. drivers/net/ethernet/airoha/airoha_eth.c +30 −21
  162. drivers/net/ethernet/airoha/airoha_eth.h +5 −0
  163. drivers/net/ethernet/ibm/ibmveth.c +22 −0
  164. drivers/net/ethernet/ibm/ibmveth.h +1 −0
  165. drivers/net/ethernet/intel/iavf/iavf.h +4 −5
  166. drivers/net/ethernet/intel/iavf/iavf_main.c +12 −40
  167. drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +36 −40
  168. drivers/net/ethernet/intel/ice/devlink/devlink.c +2 −0
  169. drivers/net/ethernet/intel/ice/ice_common.c +0 −2
  170. drivers/net/ethernet/intel/ice/ice_dpll.c +134 −12
  171. drivers/net/ethernet/intel/ice/ice_main.c +2 −0
  172. drivers/net/ethernet/intel/ice/ice_vf_lib.c +6 −1
  173. drivers/net/ethernet/sfc/efx_devlink.c +1 −1
  174. drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +12 −7
  175. drivers/net/mctp/mctp-i2c.c +2 −2
  176. drivers/net/netconsole.c +30 −19
  177. drivers/net/netdevsim/dev.c +1 −1
  178. drivers/net/phy/dp83869.c +12 −1
  179. drivers/net/usb/rtl8150.c +11 −1
  180. drivers/net/vrf.c +11 −4
  181. drivers/nfc/trf7970a.c +2 −1
  182. drivers/nvme/common/auth.c +74 −20
  183. drivers/nvme/host/apple.c +1 −5
  184. drivers/nvme/host/auth.c +9 −7
  185. drivers/nvme/host/core.c +11 −5
  186. drivers/nvme/host/fc.c +1 −0
  187. drivers/nvme/host/multipath.c +0 −4
  188. drivers/nvme/host/pci.c +5 −0
  189. drivers/nvme/host/rdma.c +9 −0
  190. drivers/nvme/host/sysfs.c +19 −0
  191. drivers/nvme/host/tcp.c +22 −7
  192. drivers/nvme/target/admin-cmd.c +2 −6
  193. drivers/nvme/target/auth.c +10 −11
  194. drivers/nvme/target/configfs.c +27 −0
  195. drivers/nvme/target/core.c +9 −1
  196. drivers/nvme/target/fabrics-cmd-auth.c +5 −4
  197. drivers/nvme/target/nvmet.h +13 −0
  198. drivers/nvme/target/tcp.c +64 −53
  199. drivers/nvme/target/zns.c +1 −5
  200. drivers/regulator/Kconfig +1 −0
  201. drivers/s390/char/Kconfig +0 −8
  202. drivers/s390/char/sclp_config.c +0 −6
  203. drivers/scsi/sr.c +2 −9
  204. drivers/scsi/sr.h +0 −1
  205. drivers/spi/spi-airoha-snfi.c +3 −3
  206. drivers/spi/spi-amlogic-spisg.c +1 −2
  207. drivers/spi/spi-aspeed-smc.c +2 −2
  208. drivers/spi/spi-axiado.c +1 −1
  209. drivers/spi/spi-cadence-quadspi.c +18 −18
  210. drivers/spi/spi-cadence.c +13 −2
  211. drivers/spi/spi-intel.c +3 −3
  212. drivers/spi/spi-mem.c +25 −7
  213. drivers/spi/spi-mxic.c +9 −9
  214. drivers/spi/spi-npcm-fiu.c +8 −8
  215. drivers/spi/spi-rockchip.c +2 −4
  216. drivers/spi/spi-rpc-if.c +4 −4
  217. drivers/spi/spi-rzv2h-rspi.c +1 −1
  218. drivers/spi/spi-stm32-ospi.c +3 −3
  219. drivers/spi/spi-stm32-qspi.c +3 −3
  220. drivers/spi/spi-wpcm-fiu.c +1 −1
  221. drivers/xen/privcmd.c +7 −0
  222. drivers/xen/sys-hypervisor.c +6 −2
  223. fs/btrfs/extent_io.c +12 −2
  224. fs/btrfs/extent_io.h +2 −1
  225. fs/btrfs/free-space-tree.c +15 −3
  226. fs/btrfs/inode.c +3 −1
  227. fs/btrfs/ioctl.c +3 −4
  228. fs/btrfs/raid-stripe-tree.c +45 −12
  229. fs/btrfs/relocation.c +24 −6
  230. fs/isofs/export.c +1 −1
  231. fs/isofs/namei.c +2 −9
  232. fs/isofs/rock.c +9 −0
  233. fs/notify/fanotify/fanotify.c +1 −1
  234. fs/notify/fsnotify.c +1 −1
  235. fs/notify/mark.c +47 −10
  236. fs/ntfs/bitmap.c +11 −8
  237. fs/ntfs/dir.c +10 −3
  238. fs/ntfs/index.c +13 −4
  239. fs/ntfs/iomap.c +3 −3
  240. fs/ntfs/namei.c +11 −2
  241. fs/ntfs/reparse.c +3 −2
  242. fs/ntfs/runlist.c +21 −3
  243. fs/smb/client/cifsproto.h +0 −1
  244. fs/smb/client/fs_context.c +0 −31
  245. fs/smb/client/smb2inode.c +1 −1
  246. fs/smb/client/smb2ops.c +11 −0
  247. fs/smb/server/connection.c +38 −8
  248. fs/smb/server/connection.h +1 −0
  249. fs/smb/server/smb2pdu.c +7 −1
  250. fs/udf/misc.c +6 −2
  251. include/acpi/acpi_bus.h +2 −0
  252. include/acpi/actbl1.h +6 −0
  253. include/drm/drm_fb_helper.h +6 −0
  254. include/linux/cdrom.h +1 −0
  255. include/linux/dma-buf.h +2 −2
  256. include/linux/dpll.h +1 −0
  257. include/linux/fsnotify_backend.h +1 −0
  258. include/linux/mailbox_client.h +1 −0
  259. include/linux/mailbox_controller.h +13 −4
  260. include/linux/maple_tree.h +1 −1
  261. include/linux/mm.h +1 −1
  262. include/linux/mroute_base.h +3 −0
  263. include/linux/mtd/nand-qpic-common.h +3 −1
  264. include/linux/mtd/spinand.h +30 −2
  265. include/linux/nvme-auth.h +3 −3
  266. include/linux/rculist.h +29 −0
  267. include/linux/rhashtable-types.h +5 −0
  268. include/linux/rhashtable.h +5 −3
  269. include/linux/spi/spi-mem.h +11 −1
  270. include/linux/tracepoint.h +1 −1
  271. include/net/bond_3ad.h +1 −1
  272. include/net/netfilter/nf_tables.h +13 −0
  273. include/net/netmem.h +15 −0
  274. include/uapi/linux/io_uring.h +2 −1
  275. io_uring/kbuf.c +7 −2
  276. io_uring/kbuf.h +7 −1
  277. io_uring/napi.c +2 −0
  278. io_uring/tw.c +11 −1
  279. io_uring/zcrx.c +1 −2
  280. kernel/cgroup/cgroup.c +28 −18
  281. kernel/cgroup/cpuset-internal.h +5 −0
  282. kernel/cgroup/cpuset.c +9 −4
  283. kernel/cgroup/rdma.c +1 −1
  284. kernel/fork.c +5 −7
  285. kernel/futex/requeue.c +9 −4
  286. kernel/liveupdate/kexec_handover.c +13 −8
  287. kernel/liveupdate/luo_session.c +10 −5
  288. kernel/sched/core.c +1 −0
  289. kernel/sched/ext.c +276 −122
  290. kernel/sched/ext_idle.c +18 −2
  291. kernel/sched/ext_idle.h +1 −0
  292. kernel/sched/ext_internal.h +2 −0
  293. kernel/sched/fair.c +24 −18
  294. kernel/trace/trace_branch.c +4 −4
  295. kernel/trace/trace_probe.c +6 −0
  296. kernel/trace/trace_probe.h +3 −1
  297. lib/maple_tree.c +1 −1
  298. lib/rhashtable.c +31 −5
  299. lib/test_maple_tree.c +2 −2
  300. mm/damon/lru_sort.c +55 −30
  301. mm/damon/reclaim.c +55 −30
  302. mm/damon/stat.c +20 −10
  303. mm/damon/sysfs-schemes.c +22 −2
  304. mm/hugetlb_cma.c +1 −0
  305. mm/memcontrol.c +19 −10
  306. mm/page-writeback.c +6 −10
  307. mm/page_alloc.c +5 −0
  308. mm/slub.c +4 −0
  309. mm/userfaultfd.c +11 −1
  310. mm/util.c +17 −9
  311. mm/vma.c +2 −1
  312. mm/vmalloc.c +1 −1
  313. net/core/devmem.c +1 −2
  314. net/core/neighbour.c +5 −5
  315. net/core/netpoll.c +18 −1
  316. net/core/page_pool.c +5 −5
  317. net/ipv4/ipmr.c +58 −50
  318. net/ipv4/ipmr_base.c +16 −0
  319. net/ipv4/netfilter/arp_tables.c +15 −3
  320. net/ipv4/netfilter/arpt_mangle.c +8 −0
  321. net/ipv4/tcp_timer.c +3 −2
  322. net/ipv6/exthdrs.c +6 −3
  323. net/ipv6/rpl_iptunnel.c +9 −0
  324. net/ipv6/seg6_iptunnel.c +9 −0
  325. net/mptcp/pm_kernel.c +1 −0
  326. net/mptcp/protocol.c +2 −1
  327. net/mptcp/sockopt.c +6 −6
  328. net/netfilter/nf_conntrack_proto_sctp.c +7 −3
  329. net/netfilter/nf_conntrack_sip.c +118 −34
  330. net/netfilter/nf_nat_sip.c +1 −0
  331. net/netfilter/nf_tables_api.c +225 −89
  332. net/netfilter/nft_bitwise.c +2 −1
  333. net/netfilter/xt_policy.c +1 −1
  334. net/phonet/socket.c +8 −2
  335. net/psp/psp-nl-gen.c +2 −2
  336. net/psp/psp_nl.c +7 −3
  337. net/sched/sch_cake.c +113 −104
  338. net/sched/sch_choke.c +16 −10
  339. net/sched/sch_fq_pie.c +10 −9
  340. net/sched/sch_netem.c +64 −12
  341. net/sched/sch_taprio.c +8 −5
  342. net/sctp/sm_statefuns.c +6 −0
  343. net/tls/tls.h +1 −0
  344. net/tls/tls_strp.c +6 −0
  345. net/tls/tls_sw.c +4 −0
  346. net/vmw_vsock/hyperv_transport.c +2 −2
  347. security/selinux/hooks.c +17 −21
  348. security/selinux/include/objsec.h +1 −3
  349. sound/core/oss/pcm_oss.c +23 −6
  350. sound/drivers/aloop.c +30 −13
  351. sound/hda/codecs/Makefile +0 −2
  352. sound/hda/codecs/conexant.c +7 −1
  353. sound/hda/codecs/realtek/alc269.c +13 −1
  354. sound/hda/codecs/side-codecs/cs35l56_hda.c +21 −10
  355. sound/hda/codecs/side-codecs/cs35l56_hda.h +1 −0
  356. sound/hda/codecs/side-codecs/tas2781_hda_spi.c +11 −3
  357. sound/hda/core/hdmi_chmap.c +7 −4
  358. sound/soc/amd/acp/acp-legacy-mach.c +1 −1
  359. sound/soc/amd/acp/acp-mach-common.c +19 −3
  360. sound/soc/amd/acp/acp-mach.h +4 −0
  361. sound/soc/amd/acp/acp-sof-mach.c +1 −1
  362. sound/soc/codecs/ab8500-codec.c +3 −3
  363. sound/soc/codecs/aw88395/aw88395.c +4 −5
  364. sound/soc/codecs/cs35l56-shared.c +3 −4
  365. sound/soc/codecs/es8389.c +1 −1
  366. sound/soc/codecs/tas2764.c +1 −0
  367. sound/soc/codecs/tas2770.c +2 −2
  368. sound/soc/codecs/wcd937x.c +25 −1
  369. sound/soc/intel/boards/bytcr_wm5102.c +1 −0
  370. sound/soc/sof/intel/hda.c +2 −1
  371. sound/soc/spacemit/k1_i2s.c +34 −15
  372. sound/soc/tegra/Makefile +0 −1
  373. sound/usb/caiaq/device.c +3 −3
  374. sound/usb/caiaq/input.c +1 −1
  375. sound/usb/misc/ua101.c +7 −0
  376. sound/usb/mixer.c +10 −0
  377. sound/usb/quirks-table.h +3 −1
  378. sound/usb/quirks.c +1 −1
  379. sound/usb/stream.c +25 −37
  380. sound/usb/stream.h +2 −1
  381. tools/sched_ext/scx_qmap.bpf.c +6 −18
  382. tools/testing/radix-tree/maple.c +1 −1
  383. tools/testing/selftests/arm64/gcs/gcs-util.h +0 −6
  384. tools/testing/selftests/arm64/gcs/libc-gcs.c +1 −0
  385. tools/testing/selftests/drivers/net/README.rst +8 −2
  386. tools/testing/selftests/kvm/access_tracking_perf_test.c +22 −22
  387. tools/testing/selftests/kvm/arch_timer.c +3 −3
  388. tools/testing/selftests/kvm/arm64/aarch32_id_regs.c +7 −7
  389. tools/testing/selftests/kvm/arm64/arch_timer.c +4 −4
  390. tools/testing/selftests/kvm/arm64/arch_timer_edge_cases.c +80 −81
  391. tools/testing/selftests/kvm/arm64/debug-exceptions.c +35 −37
  392. tools/testing/selftests/kvm/arm64/hypercalls.c +12 −12
  393. tools/testing/selftests/kvm/arm64/idreg-idst.c +2 −2
  394. tools/testing/selftests/kvm/arm64/no-vgic.c +4 −4
  395. tools/testing/selftests/kvm/arm64/page_fault_test.c +41 −41
  396. tools/testing/selftests/kvm/arm64/psci_test.c +12 −14
  397. tools/testing/selftests/kvm/arm64/sea_to_user.c +19 −22
  398. tools/testing/selftests/kvm/arm64/set_id_regs.c +35 −35
  399. tools/testing/selftests/kvm/arm64/smccc_filter.c +5 −5
  400. tools/testing/selftests/kvm/arm64/vgic_init.c +28 −28
  401. tools/testing/selftests/kvm/arm64/vgic_irq.c +69 −68
  402. tools/testing/selftests/kvm/arm64/vgic_lpi_stress.c +10 −10
  403. tools/testing/selftests/kvm/arm64/vgic_v5.c +5 −5
  404. tools/testing/selftests/kvm/arm64/vpmu_counter_access.c +28 −28
  405. tools/testing/selftests/kvm/coalesced_io_test.c +19 −19
  406. tools/testing/selftests/kvm/demand_paging_test.c +5 −5
  407. tools/testing/selftests/kvm/dirty_log_perf_test.c +7 −7
  408. tools/testing/selftests/kvm/dirty_log_test.c +41 −41
  409. tools/testing/selftests/kvm/get-reg-list.c +1 −1
  410. tools/testing/selftests/kvm/guest_memfd_test.c +9 −9
  411. tools/testing/selftests/kvm/guest_print_test.c +11 −11
  412. tools/testing/selftests/kvm/hardware_disable_test.c +3 −3
  413. tools/testing/selftests/kvm/include/arm64/arch_timer.h +15 −15
  414. tools/testing/selftests/kvm/include/arm64/delay.h +2 −2
  415. tools/testing/selftests/kvm/include/arm64/gic.h +4 −4
  416. tools/testing/selftests/kvm/include/arm64/gic_v3_its.h +3 −4
  417. tools/testing/selftests/kvm/include/arm64/processor.h +11 −11
  418. tools/testing/selftests/kvm/include/arm64/ucall.h +2 −2
  419. tools/testing/selftests/kvm/include/arm64/vgic.h +11 −11
  420. tools/testing/selftests/kvm/include/kvm_util.h +166 −180
  421. tools/testing/selftests/kvm/include/kvm_util_types.h +5 −3
  422. tools/testing/selftests/kvm/include/loongarch/arch_timer.h +2 −2
  423. tools/testing/selftests/kvm/include/loongarch/ucall.h +2 −2
  424. tools/testing/selftests/kvm/include/memstress.h +15 −15
  425. tools/testing/selftests/kvm/include/riscv/arch_timer.h +11 −11
  426. tools/testing/selftests/kvm/include/riscv/processor.h +4 −5
  427. tools/testing/selftests/kvm/include/riscv/ucall.h +2 −2
  428. tools/testing/selftests/kvm/include/s390/diag318_test_handler.h +1 −1
  429. tools/testing/selftests/kvm/include/s390/facility.h +2 −2
  430. tools/testing/selftests/kvm/include/s390/ucall.h +2 −2
  431. tools/testing/selftests/kvm/include/sparsebit.h +3 −3
  432. tools/testing/selftests/kvm/include/test_util.h +21 −19
  433. tools/testing/selftests/kvm/include/timer_test.h +9 −9
  434. tools/testing/selftests/kvm/include/ucall_common.h +11 −11
  435. tools/testing/selftests/kvm/include/userfaultfd_util.h +3 −3
  436. tools/testing/selftests/kvm/include/x86/apic.h +11 −11
  437. tools/testing/selftests/kvm/include/x86/evmcs.h +11 −11
  438. tools/testing/selftests/kvm/include/x86/hyperv.h +14 −14
  439. tools/testing/selftests/kvm/include/x86/kvm_util_arch.h +18 −18
  440. tools/testing/selftests/kvm/include/x86/pmu.h +5 −4
  441. tools/testing/selftests/kvm/include/x86/processor.h +144 −148
  442. tools/testing/selftests/kvm/include/x86/sev.h +10 −10
  443. tools/testing/selftests/kvm/include/x86/smm.h +1 −2
  444. tools/testing/selftests/kvm/include/x86/svm_util.h +6 −6
  445. tools/testing/selftests/kvm/include/x86/ucall.h +1 −1
  446. tools/testing/selftests/kvm/include/x86/vmx.h +35 −35
  447. tools/testing/selftests/kvm/kvm_page_table_test.c +27 −27
  448. tools/testing/selftests/kvm/lib/arm64/gic.c +3 −3
  449. tools/testing/selftests/kvm/lib/arm64/gic_private.h +13 −13
  450. tools/testing/selftests/kvm/lib/arm64/gic_v3.c +45 −45
  451. tools/testing/selftests/kvm/lib/arm64/gic_v3_its.c +5 −6
  452. tools/testing/selftests/kvm/lib/arm64/processor.c +82 −83
  453. tools/testing/selftests/kvm/lib/arm64/ucall.c +6 −6
  454. tools/testing/selftests/kvm/lib/arm64/vgic.c +20 −20
  455. tools/testing/selftests/kvm/lib/elf.c +8 −9
  456. tools/testing/selftests/kvm/lib/guest_modes.c +1 −1
  457. tools/testing/selftests/kvm/lib/guest_sprintf.c +9 −9
  458. tools/testing/selftests/kvm/lib/kvm_util.c +144 −215
  459. tools/testing/selftests/kvm/lib/loongarch/processor.c +55 −55
  460. tools/testing/selftests/kvm/lib/loongarch/ucall.c +6 −6
  461. tools/testing/selftests/kvm/lib/memstress.c +19 −19
  462. tools/testing/selftests/kvm/lib/riscv/processor.c +45 −46
  463. tools/testing/selftests/kvm/lib/s390/diag318_test_handler.c +6 −6
  464. tools/testing/selftests/kvm/lib/s390/facility.c +1 −1
  465. tools/testing/selftests/kvm/lib/s390/processor.c +31 −34
  466. tools/testing/selftests/kvm/lib/sparsebit.c +9 −9
  467. tools/testing/selftests/kvm/lib/test_util.c +15 −15
  468. tools/testing/selftests/kvm/lib/ucall_common.c +17 −17
  469. tools/testing/selftests/kvm/lib/userfaultfd_util.c +7 −7
  470. tools/testing/selftests/kvm/lib/x86/apic.c +1 −1
  471. tools/testing/selftests/kvm/lib/x86/hyperv.c +7 −7
  472. tools/testing/selftests/kvm/lib/x86/memstress.c +7 −7
  473. tools/testing/selftests/kvm/lib/x86/pmu.c +4 −4
  474. tools/testing/selftests/kvm/lib/x86/processor.c +142 −150
  475. tools/testing/selftests/kvm/lib/x86/sev.c +10 −10
  476. tools/testing/selftests/kvm/lib/x86/svm.c +8 −8
  477. tools/testing/selftests/kvm/lib/x86/ucall.c +2 −2
  478. tools/testing/selftests/kvm/lib/x86/vmx.c +22 −22
  479. tools/testing/selftests/kvm/loongarch/arch_timer.c +14 −14
  480. tools/testing/selftests/kvm/loongarch/pmu_test.c +5 −5
  481. tools/testing/selftests/kvm/memslot_modification_stress_test.c +5 −5
  482. tools/testing/selftests/kvm/memslot_perf_test.c +82 −82
  483. tools/testing/selftests/kvm/mmu_stress_test.c +14 −14
  484. tools/testing/selftests/kvm/pre_fault_memory_test.c +6 −6
  485. tools/testing/selftests/kvm/riscv/arch_timer.c +4 −4
  486. tools/testing/selftests/kvm/riscv/ebreak_test.c +3 −3
  487. tools/testing/selftests/kvm/riscv/get-reg-list.c +2 −2
  488. tools/testing/selftests/kvm/riscv/sbi_pmu_test.c +4 −4
  489. tools/testing/selftests/kvm/s390/debug_test.c +4 −4
  490. tools/testing/selftests/kvm/s390/irq_routing.c +1 −1
  491. tools/testing/selftests/kvm/s390/memop.c +47 −47
  492. tools/testing/selftests/kvm/s390/resets.c +3 −3
  493. tools/testing/selftests/kvm/s390/shared_zeropage_test.c +1 −1
  494. tools/testing/selftests/kvm/s390/tprot.c +12 −12
  495. tools/testing/selftests/kvm/s390/ucontrol_test.c +4 −4
  496. tools/testing/selftests/kvm/set_memory_region_test.c +20 −20
  497. tools/testing/selftests/kvm/steal_time.c +42 −37
  498. tools/testing/selftests/kvm/system_counter_offset_test.c +6 −6
  499. tools/testing/selftests/kvm/x86/amx_test.c +7 −7
  500. tools/testing/selftests/kvm/x86/aperfmperf_test.c +8 −8
  501. tools/testing/selftests/kvm/x86/apic_bus_clock_test.c +12 −12
  502. tools/testing/selftests/kvm/x86/cpuid_test.c +3 −3
  503. tools/testing/selftests/kvm/x86/debug_regs.c +2 −2
  504. tools/testing/selftests/kvm/x86/dirty_log_page_splitting_test.c +8 −8
  505. tools/testing/selftests/kvm/x86/evmcs_smm_controls_test.c +3 −3
  506. tools/testing/selftests/kvm/x86/fastops_test.c +26 −26
  507. tools/testing/selftests/kvm/x86/feature_msrs_test.c +6 −6
  508. tools/testing/selftests/kvm/x86/fix_hypercall_test.c +10 −10
  509. tools/testing/selftests/kvm/x86/flds_emulation.h +3 −3
  510. tools/testing/selftests/kvm/x86/hwcr_msr_test.c +5 −5
  511. tools/testing/selftests/kvm/x86/hyperv_clock.c +3 −3
  512. tools/testing/selftests/kvm/x86/hyperv_evmcs.c +5 −5
  513. tools/testing/selftests/kvm/x86/hyperv_extended_hypercalls.c +10 −10
  514. tools/testing/selftests/kvm/x86/hyperv_features.c +13 −13
  515. tools/testing/selftests/kvm/x86/hyperv_ipi.c +6 −6
  516. tools/testing/selftests/kvm/x86/hyperv_svm_test.c +5 −5
  517. tools/testing/selftests/kvm/x86/hyperv_tlb_flush.c +18 −18
  518. tools/testing/selftests/kvm/x86/kvm_buslock_test.c +1 −1
  519. tools/testing/selftests/kvm/x86/kvm_clock_test.c +7 −7
  520. tools/testing/selftests/kvm/x86/kvm_pv_test.c +5 −5
  521. tools/testing/selftests/kvm/x86/monitor_mwait_test.c +1 −1
  522. tools/testing/selftests/kvm/x86/nested_close_kvm_test.c +1 −1
  523. tools/testing/selftests/kvm/x86/nested_dirty_log_test.c +5 −5
  524. tools/testing/selftests/kvm/x86/nested_emulation_test.c +10 −10
  525. tools/testing/selftests/kvm/x86/nested_exceptions_test.c +3 −3
  526. tools/testing/selftests/kvm/x86/nested_invalid_cr3_test.c +1 −1
  527. tools/testing/selftests/kvm/x86/nested_set_state_test.c +2 −2
  528. tools/testing/selftests/kvm/x86/nested_tsc_adjust_test.c +6 −6
  529. tools/testing/selftests/kvm/x86/nested_tsc_scaling_test.c +13 −13
  530. tools/testing/selftests/kvm/x86/nested_vmsave_vmload_test.c +1 −1
  531. tools/testing/selftests/kvm/x86/nx_huge_pages_test.c +9 −9
  532. tools/testing/selftests/kvm/x86/platform_info_test.c +3 −3
  533. tools/testing/selftests/kvm/x86/pmu_counters_test.c +54 −55
  534. tools/testing/selftests/kvm/x86/pmu_event_filter_test.c +51 −51
  535. tools/testing/selftests/kvm/x86/private_mem_conversions_test.c +39 −39
  536. tools/testing/selftests/kvm/x86/private_mem_kvm_exits_test.c +7 −7
  537. tools/testing/selftests/kvm/x86/set_boot_cpu_id.c +3 −3
  538. tools/testing/selftests/kvm/x86/set_sregs_test.c +3 −3
  539. tools/testing/selftests/kvm/x86/sev_init2_tests.c +3 −3
  540. tools/testing/selftests/kvm/x86/sev_smoke_test.c +11 −11
  541. tools/testing/selftests/kvm/x86/smaller_maxphyaddr_emulation_test.c +4 −4
  542. tools/testing/selftests/kvm/x86/smm_test.c +4 −4
  543. tools/testing/selftests/kvm/x86/state_test.c +7 −7
  544. tools/testing/selftests/kvm/x86/svm_int_ctl_test.c +1 −1
  545. tools/testing/selftests/kvm/x86/svm_lbr_nested_state.c +1 −1
  546. tools/testing/selftests/kvm/x86/svm_nested_clear_efer_svme.c +1 −1
  547. tools/testing/selftests/kvm/x86/svm_nested_shutdown_test.c +1 −1
  548. tools/testing/selftests/kvm/x86/svm_nested_soft_inject_test.c +5 −5
  549. tools/testing/selftests/kvm/x86/svm_nested_vmcb12_gpa.c +7 −7
  550. tools/testing/selftests/kvm/x86/svm_vmcall_test.c +1 −1
  551. tools/testing/selftests/kvm/x86/sync_regs_test.c +1 −1
  552. tools/testing/selftests/kvm/x86/triple_fault_event_test.c +2 −2
  553. tools/testing/selftests/kvm/x86/tsc_msrs_test.c +1 −1
  554. tools/testing/selftests/kvm/x86/tsc_scaling_sync.c +2 −2
  555. tools/testing/selftests/kvm/x86/ucna_injection_test.c +23 −22
  556. tools/testing/selftests/kvm/x86/userspace_io_test.c +2 −2
  557. tools/testing/selftests/kvm/x86/userspace_msr_exit_test.c +29 −29
  558. tools/testing/selftests/kvm/x86/vmx_apic_access_test.c +2 −2
  559. tools/testing/selftests/kvm/x86/vmx_apicv_updates_test.c +2 −2
  560. tools/testing/selftests/kvm/x86/vmx_invalid_nested_guest_state.c +1 −1
  561. tools/testing/selftests/kvm/x86/vmx_msrs_test.c +10 −12
  562. tools/testing/selftests/kvm/x86/vmx_nested_la57_state_test.c +2 −2
  563. tools/testing/selftests/kvm/x86/vmx_pmu_caps_test.c +6 −6
  564. tools/testing/selftests/kvm/x86/vmx_preemption_timer_test.c +1 −1
  565. tools/testing/selftests/kvm/x86/xapic_ipi_test.c +32 −32
  566. tools/testing/selftests/kvm/x86/xapic_state_test.c +10 −10
  567. tools/testing/selftests/kvm/x86/xapic_tpr_test.c +12 −12
  568. tools/testing/selftests/kvm/x86/xcr0_cpuid_test.c +4 −4
  569. tools/testing/selftests/kvm/x86/xen_shinfo_test.c +11 −11
  570. tools/testing/selftests/kvm/x86/xss_msr_test.c +1 −1
  571. tools/testing/selftests/mm/config +1 −0
  572. tools/testing/selftests/sched_ext/Makefile +1 −0
  573. tools/testing/selftests/sched_ext/non_scx_kfunc_deny.bpf.c +44 −0
  574. tools/testing/selftests/sched_ext/non_scx_kfunc_deny.c +47 −0
  575. tools/testing/selftests/tc-testing/tc-tests/qdiscs/taprio.json +26 −0
  576. tools/testing/vma/include/dup.h +1 −1
  577. tools/testing/vma/include/stubs.h +2 −1
.mailmap+6−0
@@ -19,6 +19,7 @@ Abhinav Kumar <quic_abhinavk@quicinc.com> <abhinavk@codeaurora.org> · 18 unmodified lines
1919 Ahmad Masri <quic_amasri@quicinc.com> <amasri@codeaurora.org>
2020 Adam Oldham <oldhamca@gmail.com>
2121 Adam Radford <aradford@gmail.com>
22+Aditya Garg <gargaditya08@proton.me> <gargaditya08@live.com>
2223 Adriana Reus <adi.reus@gmail.com> <adriana.reus@intel.com>
2324 Adrian Bunk <bunk@stusta.de>
2425 Ajay Kaher <ajay.kaher@broadcom.com> <akaher@vmware.com>
@@ -207,6 +208,7 @@ Claudiu Beznea <claudiu.beznea@tuxon.dev> <claudiu.beznea@microchip.com> · 182 unmodified lines
207208 Colin Ian King <colin.i.king@gmail.com> <colin.king@canonical.com>
208209 Corey Minyard <minyard@acm.org>
209210 Damian Hobson-Garcia <dhobsong@igel.co.jp>
211+Dan Carpenter <error27@gmail.com> <dan.carpenter@linaro.org>
210212 Dan Carpenter <error27@gmail.com> <dan.carpenter@oracle.com>
211213 Dan Williams <djbw@kernel.org> <dan.j.williams@intel.com>
212214 Daniel Borkmann <daniel@iogearbox.net> <danborkmann@googlemail.com>
@@ -495,6 +497,7 @@ Leon Romanovsky <leon@kernel.org> <leon@leon.nu> · 282 unmodified lines
495497 Leon Romanovsky <leon@kernel.org> <leonro@mellanox.com>
496498 Leon Romanovsky <leon@kernel.org> <leonro@nvidia.com>
497499 Leo Yan <leo.yan@linux.dev> <leo.yan@linaro.org>
500+Liam R. Howlett <liam@infradead.org> <Liam.Howlett@oracle.com>
498501 Liam Mark <quic_lmark@quicinc.com> <lmark@codeaurora.org>
499502 Linas Vepstas <linas@austin.ibm.com>
500503 Linus Lüssing <linus.luessing@c0d3.blue> <linus.luessing@ascom.ch>
@@ -505,6 +508,8 @@ Linus Walleij <linusw@kernel.org> <linus.walleij@stericsson.com> · 4 unmodified lines
505508 Linus Walleij <linusw@kernel.org> <linus.walleij@linaro.org>
506509 Linus Walleij <linusw@kernel.org> <triad@df.lth.se>
507510 <linux-hardening@vger.kernel.org> <kernel-hardening@lists.openwall.com>
511+Li Wang <li.wang@linux.dev> <liwang@redhat.com>
512+Li Wang <li.wang@linux.dev> <wangli.ahau@gmail.com>
508513 Li Yang <leoyang.li@nxp.com> <leoli@freescale.com>
509514 Li Yang <leoyang.li@nxp.com> <leo@zh-kernel.org>
510515 Lior David <quic_liord@quicinc.com> <liord@codeaurora.org>
@@ -687,6 +692,7 @@ Punit Agrawal <punitagrawal@gmail.com> <punit.agrawal@arm.com> · 176 unmodified lines
687692 Puranjay Mohan <puranjay@kernel.org> <puranjay12@gmail.com>
688693 Qais Yousef <qyousef@layalina.io> <qais.yousef@imgtec.com>
689694 Qais Yousef <qyousef@layalina.io> <qais.yousef@arm.com>
695+Qi Zheng <qi.zheng@linux.dev> <zhengqi.arch@bytedance.com>
690696 Quentin Monnet <qmo@kernel.org> <quentin.monnet@netronome.com>
691697 Quentin Monnet <qmo@kernel.org> <quentin@isovalent.com>
692698 Quentin Perret <qperret@qperret.net> <quentin.perret@arm.com>
Documentation/admin-guide/cgroup-v2.rst+1−1
@@ -220,7 +220,7 @@ cgroup v2 currently supports the following mount options. · 219 unmodified lines
220220 memory_hugetlb_accounting
221221 Count HugeTLB memory usage towards the cgroup's overall
222222 memory usage for the memory controller (for the purpose of
223− statistics reporting and memory protetion). This is a new
223+ statistics reporting and memory protection). This is a new
224224 behavior that could regress existing setups, so it must be
225225 explicitly opted in with this mount option.
226226
Documentation/devicetree/bindings/mailbox/qcom-ipcc.yaml+1−0
@@ -24,6 +24,7 @@ properties: · 23 unmodified lines
2424 compatible:
2525 items:
2626 - enum:
27+ - qcom,eliza-ipcc
2728 - qcom,glymur-ipcc
2829 - qcom,kaanapali-ipcc
2930 - qcom,milos-ipcc
Documentation/devicetree/bindings/mtd/nand-chip.yaml+9−0
@@ -23,6 +23,15 @@ properties: · 22 unmodified lines
2323 description:
2424 Contains the chip-select IDs.
2525
26+ nand-randomizer:
27+ description: |
28+ Control the data randomizer feature.
29+ 0: Disable randomizer.
30+ 1: Enable randomizer.
31+ If absent, the current hardware state is left unchanged.
32+ $ref: /schemas/types.yaml#/definitions/uint32
33+ enum: [0, 1]
34+
2635 required:
2736 - reg
2837
Documentation/filesystems/isofs.rst+1−1
@@ -57,7 +57,7 @@ Mount options unique to the isofs filesystem. · 56 unmodified lines
5757 Recommended documents about ISO 9660 standard are located at:
5858
5959 - http://www.y-adagio.com/
60−- ftp://ftp.ecma.ch/ecma-st/Ecma-119.pdf
60+- https://ecma-international.org/wp-content/uploads/ECMA-119_2nd_edition_december_1987.pdf
6161
6262 Quoting from the PDF "This 2nd Edition of Standard ECMA-119 is technically
6363 identical with ISO 9660.", so it is a valid and gratis substitute of the
Documentation/netlink/specs/psp.yaml+2−0
@@ -188,6 +188,7 @@ operations: · 187 unmodified lines
188188 name: dev-set
189189 doc: Set the configuration of a PSP device.
190190 attribute-set: dev
191+ flags: [admin-perm]
191192 do:
192193 request:
193194 attributes:
@@ -207,6 +208,7 @@ operations: · 13 unmodified lines
207208 name: key-rotate
208209 doc: Rotate the device key.
209210 attribute-set: dev
211+ flags: [admin-perm]
210212 do:
211213 request:
212214 attributes:
MAINTAINERS+70−35
@@ -7873,7 +7873,7 @@ F: drivers/gpu/drm/sun4i/sun8i* · 7872 unmodified lines
78737873
78747874 DRM DRIVER FOR APPLE TOUCH BARS
78757875 M: Aun-Ali Zaidi <admin@kodeit.net>
7876−M: Aditya Garg <gargaditya08@live.com>
7876+M: Aditya Garg <gargaditya08@proton.me>
78777877 L: dri-devel@lists.freedesktop.org
78787878 S: Maintained
78797879 T: git https://gitlab.freedesktop.org/drm/misc/kernel.git
@@ -13860,7 +13860,6 @@ M: Pratyush Yadav <pratyush@kernel.org> · 5980 unmodified lines
1386013860 R: Dave Young <ruirui.yang@linux.dev>
1386113861 L: kexec@lists.infradead.org
1386213862 S: Maintained
13863−W: http://lse.sourceforge.net/kdump/
1386413863 F: Documentation/admin-guide/kdump/
1386513864 F: fs/proc/vmcore.c
1386613865 F: include/linux/crash_core.h
@@ -15252,7 +15251,7 @@ M: Andrea Cervesato <andrea.cervesato@suse.com> · 1385 unmodified lines
1525215251 M: Cyril Hrubis <chrubis@suse.cz>
1525315252 M: Jan Stancek <jstancek@redhat.com>
1525415253 M: Petr Vorel <pvorel@suse.cz>
15255−M: Li Wang <liwang@redhat.com>
15254+M: Li Wang <li.wang@linux.dev>
1525615255 M: Yang Xu <xuyang2018.jy@fujitsu.com>
1525715256 M: Xiao Yang <yangx.jy@fujitsu.com>
1525815257 L: ltp@lists.linux.it (subscribers-only)
@@ -15399,7 +15398,7 @@ F: include/net/netns/mctp.h · 140 unmodified lines
1539915398 F: net/mctp/
1540015399
1540115400 MAPLE TREE
15402−M: Liam R. Howlett <Liam.Howlett@oracle.com>
15401+M: Liam R. Howlett <liam@infradead.org>
1540315402 R: Alice Ryhl <aliceryhl@google.com>
1540415403 R: Andrew Ballance <andrewjballance@gmail.com>
1540515404 L: maple-tree@lists.infradead.org
@@ -16759,7 +16758,7 @@ MEMORY MANAGEMENT - CORE · 1353 unmodified lines
1675916758 M: Andrew Morton <akpm@linux-foundation.org>
1676016759 M: David Hildenbrand <david@kernel.org>
1676116760 R: Lorenzo Stoakes <ljs@kernel.org>
16762−R: Liam R. Howlett <Liam.Howlett@oracle.com>
16761+R: Liam R. Howlett <liam@infradead.org>
1676316762 R: Vlastimil Babka <vbabka@kernel.org>
1676416763 R: Mike Rapoport <rppt@kernel.org>
1676516764 R: Suren Baghdasaryan <surenb@google.com>
@@ -16805,7 +16804,7 @@ F: mm/sparse.c · 39 unmodified lines
1680516804 F: mm/util.c
1680616805 F: mm/vmpressure.c
1680716806 F: mm/vmstat.c
16808−N: include/linux/page[-_]*
16807+N: include\/linux\/page[-_][a-zA-Z]*
1680916808
1681016809 MEMORY MANAGEMENT - EXECMEM
1681116810 M: Andrew Morton <akpm@linux-foundation.org>
@@ -16895,7 +16894,7 @@ MEMORY MANAGEMENT - MISC · 83 unmodified lines
1689516894 M: Andrew Morton <akpm@linux-foundation.org>
1689616895 M: David Hildenbrand <david@kernel.org>
1689716896 R: Lorenzo Stoakes <ljs@kernel.org>
16898−R: Liam R. Howlett <Liam.Howlett@oracle.com>
16897+R: Liam R. Howlett <liam@infradead.org>
1689916898 R: Vlastimil Babka <vbabka@kernel.org>
1690016899 R: Mike Rapoport <rppt@kernel.org>
1690116900 R: Suren Baghdasaryan <surenb@google.com>
@@ -16962,6 +16961,7 @@ S: Maintained · 60 unmodified lines
1696216961 F: include/linux/compaction.h
1696316962 F: include/linux/gfp.h
1696416963 F: include/linux/page-isolation.h
16964+F: include/linux/pageblock-flags.h
1696516965 F: mm/compaction.c
1696616966 F: mm/debug_page_alloc.c
1696716967 F: mm/debug_page_ref.c
@@ -16983,7 +16983,7 @@ M: Andrew Morton <akpm@linux-foundation.org> · 15 unmodified lines
1698316983 M: Johannes Weiner <hannes@cmpxchg.org>
1698416984 R: David Hildenbrand <david@kernel.org>
1698516985 R: Michal Hocko <mhocko@kernel.org>
16986−R: Qi Zheng <zhengqi.arch@bytedance.com>
16986+R: Qi Zheng <qi.zheng@linux.dev>
1698716987 R: Shakeel Butt <shakeel.butt@linux.dev>
1698816988 R: Lorenzo Stoakes <ljs@kernel.org>
1698916989 L: linux-mm@kvack.org
@@ -16996,7 +16996,7 @@ M: Andrew Morton <akpm@linux-foundation.org> · 6 unmodified lines
1699616996 M: David Hildenbrand <david@kernel.org>
1699716997 M: Lorenzo Stoakes <ljs@kernel.org>
1699816998 R: Rik van Riel <riel@surriel.com>
16999−R: Liam R. Howlett <Liam.Howlett@oracle.com>
16999+R: Liam R. Howlett <liam@infradead.org>
1700017000 R: Vlastimil Babka <vbabka@kernel.org>
1700117001 R: Harry Yoo <harry@kernel.org>
1700217002 R: Jann Horn <jannh@google.com>
@@ -17043,7 +17043,7 @@ M: David Hildenbrand <david@kernel.org> · 40 unmodified lines
1704317043 M: Lorenzo Stoakes <ljs@kernel.org>
1704417044 R: Zi Yan <ziy@nvidia.com>
1704517045 R: Baolin Wang <baolin.wang@linux.alibaba.com>
17046−R: Liam R. Howlett <Liam.Howlett@oracle.com>
17046+R: Liam R. Howlett <liam@infradead.org>
1704717047 R: Nico Pache <npache@redhat.com>
1704817048 R: Ryan Roberts <ryan.roberts@arm.com>
1704917049 R: Dev Jain <dev.jain@arm.com>
@@ -17081,7 +17081,7 @@ F: tools/testing/selftests/mm/uffd-*.[ch] · 31 unmodified lines
1708117081 MEMORY MANAGEMENT - RUST
1708217082 M: Alice Ryhl <aliceryhl@google.com>
1708317083 R: Lorenzo Stoakes <ljs@kernel.org>
17084−R: Liam R. Howlett <Liam.Howlett@oracle.com>
17084+R: Liam R. Howlett <liam@infradead.org>
1708517085 L: linux-mm@kvack.org
1708617086 L: rust-for-linux@vger.kernel.org
1708717087 S: Maintained
@@ -17095,7 +17095,7 @@ F: rust/kernel/page.rs · 7 unmodified lines
1709517095
1709617096 MEMORY MAPPING
1709717097 M: Andrew Morton <akpm@linux-foundation.org>
17098−M: Liam R. Howlett <Liam.Howlett@oracle.com>
17098+M: Liam R. Howlett <liam@infradead.org>
1709917099 M: Lorenzo Stoakes <ljs@kernel.org>
1710017100 R: Vlastimil Babka <vbabka@kernel.org>
1710117101 R: Jann Horn <jannh@google.com>
@@ -17127,7 +17127,7 @@ F: tools/testing/vma/ · 25 unmodified lines
1712717127 MEMORY MAPPING - LOCKING
1712817128 M: Andrew Morton <akpm@linux-foundation.org>
1712917129 M: Suren Baghdasaryan <surenb@google.com>
17130−M: Liam R. Howlett <Liam.Howlett@oracle.com>
17130+M: Liam R. Howlett <liam@infradead.org>
1713117131 M: Lorenzo Stoakes <ljs@kernel.org>
1713217132 R: Vlastimil Babka <vbabka@kernel.org>
1713317133 R: Shakeel Butt <shakeel.butt@linux.dev>
@@ -17142,7 +17142,7 @@ F: mm/mmap_lock.c · 8 unmodified lines
1714217142
1714317143 MEMORY MAPPING - MADVISE (MEMORY ADVICE)
1714417144 M: Andrew Morton <akpm@linux-foundation.org>
17145−M: Liam R. Howlett <Liam.Howlett@oracle.com>
17145+M: Liam R. Howlett <liam@infradead.org>
1714617146 M: Lorenzo Stoakes <ljs@kernel.org>
1714717147 M: David Hildenbrand <david@kernel.org>
1714817148 R: Vlastimil Babka <vbabka@kernel.org>
@@ -18672,19 +18672,59 @@ F: net/xfrm/ · 1523 unmodified lines
1867218672 F: tools/testing/selftests/net/ipsec.c
1867318673
1867418674 NETWORKING [IPv4/IPv6]
18675−M: "David S. Miller" <davem@davemloft.net>
1867618675 M: David Ahern <dsahern@kernel.org>
18676+M: Ido Schimmel <idosch@nvidia.com>
1867718677 L: netdev@vger.kernel.org
1867818678 S: Maintained
18679−T: git git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
18680−F: arch/x86/net/*
18681−F: include/linux/ip.h
18682−F: include/linux/ipv6*
18679+F: Documentation/netlink/specs/rt-addr.yaml
18680+F: Documentation/netlink/specs/rt-neigh.yaml
18681+F: Documentation/netlink/specs/rt-route.yaml
18682+F: Documentation/netlink/specs/rt-rule.yaml
18683+F: include/linux/inetdevice.h
18684+F: include/linux/mroute*
18685+F: include/net/addrconf.h
18686+F: include/net/arp.h
1868318687 F: include/net/fib*
18688+F: include/net/if_inet6.h
18689+F: include/net/inetpeer.h
1868418690 F: include/net/ip*
18691+F: include/net/lwtunnel.h
18692+F: include/net/ndisc.h
18693+F: include/net/netns/nexthop.h
18694+F: include/net/nexthop.h
1868518695 F: include/net/route.h
18686−F: net/ipv4/
18687−F: net/ipv6/
18696+F: include/uapi/linux/fib_rules.h
18697+F: include/uapi/linux/in_route.h
18698+F: include/uapi/linux/mroute*
18699+F: include/uapi/linux/nexthop.h
18700+F: net/core/fib*
18701+F: net/core/lwtunnel.c
18702+F: net/ipv4/arp.c
18703+F: net/ipv4/devinet.c
18704+F: net/ipv4/fib*
18705+F: net/ipv4/icmp.c
18706+F: net/ipv4/igmp.c
18707+F: net/ipv4/inet_fragment.c
18708+F: net/ipv4/inetpeer.c
18709+F: net/ipv4/ip*
18710+F: net/ipv4/metrics.c
18711+F: net/ipv4/netlink.c
18712+F: net/ipv4/nexthop.c
18713+F: net/ipv4/route.c
18714+F: net/ipv6/addr*
18715+F: net/ipv6/anycast.c
18716+F: net/ipv6/exthdrs.c
18717+F: net/ipv6/exthdrs_core.c
18718+F: net/ipv6/fib*
18719+F: net/ipv6/icmp.c
18720+F: net/ipv6/ip*
18721+F: net/ipv6/mcast*
18722+F: net/ipv6/ndisc.c
18723+F: net/ipv6/output_core.c
18724+F: net/ipv6/reassembly.c
18725+F: net/ipv6/route.c
18726+F: tools/testing/selftests/net/fib*
18727+F: tools/testing/selftests/net/forwarding/
1868818728
1868918729 NETWORKING [LABELED] (NetLabel, Labeled IPsec, SECMARK)
1869018730 M: Paul Moore <paul@paul-moore.com>
@@ -18819,18 +18859,11 @@ F: Documentation/networking/net_failover.rst · 128 unmodified lines
1881918859 F: drivers/net/net_failover.c
1882018860 F: include/net/net_failover.h
1882118861
18822−NEXTHOP
18823−M: David Ahern <dsahern@kernel.org>
18824−L: netdev@vger.kernel.org
18825−S: Maintained
18826−F: include/net/netns/nexthop.h
18827−F: include/net/nexthop.h
18828−F: include/uapi/linux/nexthop.h
18829−F: net/ipv4/nexthop.c
18830−
1883118862 NFC SUBSYSTEM
18832−L: netdev@vger.kernel.org
18833−S: Orphan
18863+M: David Heidelberg <david+nfc@ixit.cz>
18864+L: oe-linux-nfc@lists.linux.dev
18865+S: Maintained
18866+T: git https://codeberg.org/linux-nfc/linux.git
1883418867 F: Documentation/devicetree/bindings/net/nfc/
1883518868 F: drivers/nfc/
1883618869 F: include/net/nfc/
@@ -20774,6 +20807,7 @@ M: Dominik Brodowski <linux@dominikbrodowski.net> · 1937 unmodified lines
2077420807 S: Odd Fixes
2077520808 T: git git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux.git
2077620809 F: Documentation/pcmcia/
20810+F: drivers/net/ethernet/8390/pcnet_cs.c
2077720811 F: drivers/pcmcia/
2077820812 F: include/pcmcia/
2077920813 F: tools/pcmcia/
@@ -23369,7 +23403,7 @@ RUST [ALLOC] · 2589 unmodified lines
2336923403 M: Danilo Krummrich <dakr@kernel.org>
2337023404 R: Lorenzo Stoakes <ljs@kernel.org>
2337123405 R: Vlastimil Babka <vbabka@kernel.org>
23372−R: Liam R. Howlett <Liam.Howlett@oracle.com>
23406+R: Liam R. Howlett <liam@infradead.org>
2337323407 R: Uladzislau Rezki <urezki@gmail.com>
2337423408 L: rust-for-linux@vger.kernel.org
2337523409 S: Maintained
@@ -23521,7 +23555,7 @@ F: drivers/s390/net/ · 145 unmodified lines
2352123555
2352223556 S390 PCI SUBSYSTEM
2352323557 M: Niklas Schnelle <schnelle@linux.ibm.com>
23524−M: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
23558+M: Gerd Bayer <gbayer@linux.ibm.com>
2352523559 L: linux-s390@vger.kernel.org
2352623560 S: Supported
2352723561 F: Documentation/arch/s390/pci.rst
@@ -24314,7 +24348,7 @@ F: include/media/i2c/rj54n1cb0c.h · 786 unmodified lines
2431424348 SHRINKER
2431524349 M: Andrew Morton <akpm@linux-foundation.org>
2431624350 M: Dave Chinner <david@fromorbit.com>
24317−R: Qi Zheng <zhengqi.arch@bytedance.com>
24351+R: Qi Zheng <qi.zheng@linux.dev>
2431824352 R: Roman Gushchin <roman.gushchin@linux.dev>
2431924353 R: Muchun Song <muchun.song@linux.dev>
2432024354 L: linux-mm@kvack.org
@@ -24764,6 +24798,7 @@ SOFTWARE RAID (Multiple Disks) SUPPORT · 443 unmodified lines
2476424798 M: Song Liu <song@kernel.org>
2476524799 M: Yu Kuai <yukuai@fnnas.com>
2476624800 R: Li Nan <linan122@huawei.com>
24801+R: Xiao Ni <xiao@kernel.org>
2476724802 L: linux-raid@vger.kernel.org
2476824803 S: Supported
2476924804 Q: https://patchwork.kernel.org/project/linux-raid/list/
Makefile+1−1
@@ -2,7 +2,7 @@ · 1 unmodified line
22 VERSION = 7
33 PATCHLEVEL = 1
44 SUBLEVEL = 0
5−EXTRAVERSION = -rc1
5+EXTRAVERSION = -rc2
66 NAME = Baby Opossum Posse
77
88 # *DOCUMENTATION*
arch/arm64/include/asm/irqflags.h+7−7
@@ -40,7 +40,7 @@ static __always_inline void __pmr_local_irq_enable(void) · 39 unmodified lines
4040 barrier();
4141 }
4242
43−static inline void arch_local_irq_enable(void)
43+static __always_inline void arch_local_irq_enable(void)
4444 {
4545 if (system_uses_irq_prio_masking()) {
4646 __pmr_local_irq_enable();
@@ -68,7 +68,7 @@ static __always_inline void __pmr_local_irq_disable(void) · 21 unmodified lines
6868 barrier();
6969 }
7070
71−static inline void arch_local_irq_disable(void)
71+static __always_inline void arch_local_irq_disable(void)
7272 {
7373 if (system_uses_irq_prio_masking()) {
7474 __pmr_local_irq_disable();
@@ -90,7 +90,7 @@ static __always_inline unsigned long __pmr_local_save_flags(void) · 15 unmodified lines
9090 /*
9191 * Save the current interrupt enable state.
9292 */
93−static inline unsigned long arch_local_save_flags(void)
93+static __always_inline unsigned long arch_local_save_flags(void)
9494 {
9595 if (system_uses_irq_prio_masking()) {
9696 return __pmr_local_save_flags();
@@ -109,7 +109,7 @@ static __always_inline bool __pmr_irqs_disabled_flags(unsigned long flags) · 12 unmodified lines
109109 return flags != GIC_PRIO_IRQON;
110110 }
111111
112−static inline bool arch_irqs_disabled_flags(unsigned long flags)
112+static __always_inline bool arch_irqs_disabled_flags(unsigned long flags)
113113 {
114114 if (system_uses_irq_prio_masking()) {
115115 return __pmr_irqs_disabled_flags(flags);
@@ -128,7 +128,7 @@ static __always_inline bool __pmr_irqs_disabled(void) · 12 unmodified lines
128128 return __pmr_irqs_disabled_flags(__pmr_local_save_flags());
129129 }
130130
131−static inline bool arch_irqs_disabled(void)
131+static __always_inline bool arch_irqs_disabled(void)
132132 {
133133 if (system_uses_irq_prio_masking()) {
134134 return __pmr_irqs_disabled();
@@ -160,7 +160,7 @@ static __always_inline unsigned long __pmr_local_irq_save(void) · 25 unmodified lines
160160 return flags;
161161 }
162162
163−static inline unsigned long arch_local_irq_save(void)
163+static __always_inline unsigned long arch_local_irq_save(void)
164164 {
165165 if (system_uses_irq_prio_masking()) {
166166 return __pmr_local_irq_save();
@@ -187,7 +187,7 @@ static __always_inline void __pmr_local_irq_restore(unsigned long flags) · 20 unmodified lines
187187 /*
188188 * restore saved IRQ state
189189 */
190−static inline void arch_local_irq_restore(unsigned long flags)
190+static __always_inline void arch_local_irq_restore(unsigned long flags)
191191 {
192192 if (system_uses_irq_prio_masking()) {
193193 __pmr_local_irq_restore(flags);
arch/arm64/include/asm/kernel-pgtable.h+6−1
@@ -68,7 +68,12 @@ · 67 unmodified lines
6868 #define KERNEL_SEGMENT_COUNT 5
6969
7070 #if SWAPPER_BLOCK_SIZE > SEGMENT_ALIGN
71−#define EARLY_SEGMENT_EXTRA_PAGES (KERNEL_SEGMENT_COUNT + 1)
71+/*
72+ * KERNEL_SEGMENT_COUNT counts the permanent kernel VMAs. The early mapping
73+ * has one additional split, [_text, _stext). Reserve one more page for the
74+ * SWAPPER_BLOCK_SIZE-unaligned boundaries.
75+ */
76+#define EARLY_SEGMENT_EXTRA_PAGES (KERNEL_SEGMENT_COUNT + 2)
7277 /*
7378 * The initial ID map consists of the kernel image, mapped as two separate
7479 * segments, and may appear misaligned wrt the swapper block size. This means
arch/arm64/include/asm/kvm_asm.h+18−10
@@ -50,6 +50,9 @@ · 49 unmodified lines
5050
5151 #include <linux/mm.h>
5252
53+#define MARKER(m) \
54+ m, __after_##m = m - 1
55+
5356 enum __kvm_host_smccc_func {
5457 /* Hypercalls that are unavailable once pKVM has finalised. */
5558 /* __KVM_HOST_SMCCC_FUNC___kvm_hyp_init */
@@ -59,8 +62,10 @@ enum __kvm_host_smccc_func { · 3 unmodified lines
5962 __KVM_HOST_SMCCC_FUNC___kvm_enable_ssbs,
6063 __KVM_HOST_SMCCC_FUNC___vgic_v3_init_lrs,
6164 __KVM_HOST_SMCCC_FUNC___vgic_v3_get_gic_config,
65+
66+ MARKER(__KVM_HOST_SMCCC_FUNC_MIN_PKVM),
67+
6268 __KVM_HOST_SMCCC_FUNC___pkvm_prot_finalize,
63− __KVM_HOST_SMCCC_FUNC_MIN_PKVM = __KVM_HOST_SMCCC_FUNC___pkvm_prot_finalize,
6469
6570 /* Hypercalls that are always available and common to [nh]VHE/pKVM. */
6671 __KVM_HOST_SMCCC_FUNC___kvm_adjust_pc,
@@ -72,11 +77,20 @@ enum __kvm_host_smccc_func { · 5 unmodified lines
7277 __KVM_HOST_SMCCC_FUNC___kvm_tlb_flush_vmid_range,
7378 __KVM_HOST_SMCCC_FUNC___kvm_flush_cpu_context,
7479 __KVM_HOST_SMCCC_FUNC___kvm_timer_set_cntvoff,
80+ __KVM_HOST_SMCCC_FUNC___tracing_load,
81+ __KVM_HOST_SMCCC_FUNC___tracing_unload,
82+ __KVM_HOST_SMCCC_FUNC___tracing_enable,
83+ __KVM_HOST_SMCCC_FUNC___tracing_swap_reader,
84+ __KVM_HOST_SMCCC_FUNC___tracing_update_clock,
85+ __KVM_HOST_SMCCC_FUNC___tracing_reset,
86+ __KVM_HOST_SMCCC_FUNC___tracing_enable_event,
87+ __KVM_HOST_SMCCC_FUNC___tracing_write_event,
7588 __KVM_HOST_SMCCC_FUNC___vgic_v3_save_aprs,
7689 __KVM_HOST_SMCCC_FUNC___vgic_v3_restore_vmcr_aprs,
7790 __KVM_HOST_SMCCC_FUNC___vgic_v5_save_apr,
7891 __KVM_HOST_SMCCC_FUNC___vgic_v5_restore_vmcr_apr,
79− __KVM_HOST_SMCCC_FUNC_MAX_NO_PKVM = __KVM_HOST_SMCCC_FUNC___vgic_v5_restore_vmcr_apr,
92+
93+ MARKER(__KVM_HOST_SMCCC_FUNC_PKVM_ONLY),
8094
8195 /* Hypercalls that are available only when pKVM has finalised. */
8296 __KVM_HOST_SMCCC_FUNC___pkvm_host_share_hyp,
@@ -100,14 +114,8 @@ enum __kvm_host_smccc_func { · 17 unmodified lines
100114 __KVM_HOST_SMCCC_FUNC___pkvm_vcpu_load,
101115 __KVM_HOST_SMCCC_FUNC___pkvm_vcpu_put,
102116 __KVM_HOST_SMCCC_FUNC___pkvm_tlb_flush_vmid,
103− __KVM_HOST_SMCCC_FUNC___tracing_load,
104− __KVM_HOST_SMCCC_FUNC___tracing_unload,
105− __KVM_HOST_SMCCC_FUNC___tracing_enable,
106− __KVM_HOST_SMCCC_FUNC___tracing_swap_reader,
107− __KVM_HOST_SMCCC_FUNC___tracing_update_clock,
108− __KVM_HOST_SMCCC_FUNC___tracing_reset,
109− __KVM_HOST_SMCCC_FUNC___tracing_enable_event,
110− __KVM_HOST_SMCCC_FUNC___tracing_write_event,
117+
118+ MARKER(__KVM_HOST_SMCCC_FUNC_MAX)
111119 };
112120
113121 #define DECLARE_KVM_VHE_SYM(sym) extern char sym[]
arch/arm64/include/asm/kvm_host.h+1−4
@@ -450,9 +450,6 @@ struct kvm_vcpu_fault_info { · 449 unmodified lines
450450 r = __VNCR_START__ + ((VNCR_ ## r) / 8), \
451451 __after_##r = __MAX__(__before_##r - 1, r)
452452
453−#define MARKER(m) \
454− m, __after_##m = m - 1
455−
456453 enum vcpu_sysreg {
457454 __INVALID_SYSREG__, /* 0 is reserved as an invalid value */
458455 MPIDR_EL1, /* MultiProcessor Affinity Register */
@@ -1548,7 +1545,7 @@ static inline bool __vcpu_has_feature(const struct kvm_arch *ka, int feature) · 1089 unmodified lines
15481545 #define kvm_vcpu_has_feature(k, f) __vcpu_has_feature(&(k)->arch, (f))
15491546 #define vcpu_has_feature(v, f) __vcpu_has_feature(&(v)->kvm->arch, (f))
15501547
1551−#define kvm_vcpu_initialized(v) vcpu_get_flag(vcpu, VCPU_INITIALIZED)
1548+#define kvm_vcpu_initialized(v) vcpu_get_flag(v, VCPU_INITIALIZED)
15521549
15531550 int kvm_trng_call(struct kvm_vcpu *vcpu);
15541551 #ifdef CONFIG_KVM
arch/arm64/kernel/pi/patch-scs.c+2−2
@@ -196,9 +196,9 @@ static int scs_handle_fde_frame(const struct eh_frame *frame, · 195 unmodified lines
196196 loc += *opcode++ * code_alignment_factor;
197197 loc += (*opcode++ << 8) * code_alignment_factor;
198198 loc += (*opcode++ << 16) * code_alignment_factor;
199− loc += (*opcode++ << 24) * code_alignment_factor;
199+ loc += ((u64)*opcode++ << 24) * code_alignment_factor;
200200 size -= 4;
201− break;
201+ break;
202202
203203 case DW_CFA_def_cfa:
204204 case DW_CFA_offset_extended:
arch/arm64/kernel/signal.c+43−11
@@ -67,6 +67,9 @@ struct rt_sigframe_user_layout { · 66 unmodified lines
6767 unsigned long end_offset;
6868 };
6969
70+#define TERMINATOR_SIZE round_up(sizeof(struct _aarch64_ctx), 16)
71+#define EXTRA_CONTEXT_SIZE round_up(sizeof(struct extra_context), 16)
72+
7073 /*
7174 * Holds any EL0-controlled state that influences unprivileged memory accesses.
7275 * This includes both accesses done in userspace and uaccess done in the kernel.
@@ -74,13 +77,35 @@ struct rt_sigframe_user_layout { · 1 unmodified line
7477 * This state needs to be carefully managed to ensure that it doesn't cause
7578 * uaccess to fail when setting up the signal frame, and the signal handler
7679 * itself also expects a well-defined state when entered.
80+ *
81+ * The struct should be zero-initialised. Its members should only be accessed
82+ * via the accessors below. __valid_fields tracks which of the fields are valid
83+ * (have been set to some value).
7784 */
7885 struct user_access_state {
79− u64 por_el0;
86+ unsigned int __valid_fields;
87+ u64 __por_el0;
8088 };
8189
82−#define TERMINATOR_SIZE round_up(sizeof(struct _aarch64_ctx), 16)
83−#define EXTRA_CONTEXT_SIZE round_up(sizeof(struct extra_context), 16)
90+#define UA_STATE_HAS_POR_EL0 BIT(0)
91+
92+static void set_ua_state_por_el0(struct user_access_state *ua_state,
93+ u64 por_el0)
94+{
95+ ua_state->__por_el0 = por_el0;
96+ ua_state->__valid_fields |= UA_STATE_HAS_POR_EL0;
97+}
98+
99+static int get_ua_state_por_el0(const struct user_access_state *ua_state,
100+ u64 *por_el0)
101+{
102+ if (ua_state->__valid_fields & UA_STATE_HAS_POR_EL0) {
103+ *por_el0 = ua_state->__por_el0;
104+ return 0;
105+ }
106+
107+ return -ENOENT;
108+}
84109
85110 /*
86111 * Save the user access state into ua_state and reset it to disable any
@@ -94,7 +119,7 @@ static void save_reset_user_access_state(struct user_access_state *ua_state) · 7 unmodified lines
94119 for (int pkey = 0; pkey < arch_max_pkey(); pkey++)
95120 por_enable_all |= POR_ELx_PERM_PREP(pkey, POE_RWX);
96121
97− ua_state->por_el0 = read_sysreg_s(SYS_POR_EL0);
122+ set_ua_state_por_el0(ua_state, read_sysreg_s(SYS_POR_EL0));
98123 write_sysreg_s(por_enable_all, SYS_POR_EL0);
99124 /*
100125 * No ISB required as we can tolerate spurious Overlay faults -
@@ -122,8 +147,10 @@ static void set_handler_user_access_state(void) · 21 unmodified lines
122147 */
123148 static void restore_user_access_state(const struct user_access_state *ua_state)
124149 {
125− if (system_supports_poe())
126− write_sysreg_s(ua_state->por_el0, SYS_POR_EL0);
150+ u64 por_el0;
151+
152+ if (get_ua_state_por_el0(ua_state, &por_el0) == 0)
153+ write_sysreg_s(por_el0, SYS_POR_EL0);
127154 }
128155
129156 static void init_user_layout(struct rt_sigframe_user_layout *user)
@@ -333,11 +360,16 @@ static int restore_fpmr_context(struct user_ctxs *user) · 203 unmodified lines
333360 static int preserve_poe_context(struct poe_context __user *ctx,
334361 const struct user_access_state *ua_state)
335362 {
336− int err = 0;
363+ int err;
364+ u64 por_el0;
365+
366+ err = get_ua_state_por_el0(ua_state, &por_el0);
367+ if (WARN_ON_ONCE(err))
368+ return err;
337369
338370 __put_user_error(POE_MAGIC, &ctx->head.magic, err);
339371 __put_user_error(sizeof(*ctx), &ctx->head.size, err);
340− __put_user_error(ua_state->por_el0, &ctx->por_el0, err);
372+ __put_user_error(por_el0, &ctx->por_el0, err);
341373
342374 return err;
343375 }
@@ -353,7 +385,7 @@ static int restore_poe_context(struct user_ctxs *user, · 9 unmodified lines
353385
354386 __get_user_error(por_el0, &(user->poe->por_el0), err);
355387 if (!err)
356− ua_state->por_el0 = por_el0;
388+ set_ua_state_por_el0(ua_state, por_el0);
357389
358390 return err;
359391 }
@@ -1095,7 +1127,7 @@ SYSCALL_DEFINE0(rt_sigreturn) · 735 unmodified lines
10951127 {
10961128 struct pt_regs *regs = current_pt_regs();
10971129 struct rt_sigframe __user *frame;
1098− struct user_access_state ua_state;
1130+ struct user_access_state ua_state = {};
10991131
11001132 /* Always make any pending restarted system calls return -EINTR */
11011133 current->restart_block.fn = do_no_restart_syscall;
@@ -1507,7 +1539,7 @@ static int setup_rt_frame(int usig, struct ksignal *ksig, sigset_t *set, · 405 unmodified lines
15071539 {
15081540 struct rt_sigframe_user_layout user;
15091541 struct rt_sigframe __user *frame;
1510− struct user_access_state ua_state;
1542+ struct user_access_state ua_state = {};
15111543 int err = 0;
15121544
15131545 fpsimd_save_and_flush_current_state();
arch/arm64/kvm/arm.c+4−0
@@ -824,6 +824,10 @@ int kvm_arch_vcpu_runnable(struct kvm_vcpu *v) · 823 unmodified lines
824824 {
825825 bool irq_lines = *vcpu_hcr(v) & (HCR_VI | HCR_VF | HCR_VSE);
826826
827+ irq_lines |= (!irqchip_in_kernel(v->kvm) &&
828+ (kvm_timer_should_notify_user(v) ||
829+ kvm_pmu_should_notify_user(v)));
830+
827831 return ((irq_lines || kvm_vgic_vcpu_pending_irq(v))
828832 && !kvm_arm_vcpu_stopped(v) && !v->arch.pause);
829833 }
arch/arm64/kvm/config.c+16−7
@@ -131,7 +131,6 @@ struct reg_feat_map_desc { · 130 unmodified lines
131131 }
132132
133133 #define FEAT_SPE ID_AA64DFR0_EL1, PMSVer, IMP
134−#define FEAT_SPE_FnE ID_AA64DFR0_EL1, PMSVer, V1P2
135134 #define FEAT_BRBE ID_AA64DFR0_EL1, BRBE, IMP
136135 #define FEAT_TRC_SR ID_AA64DFR0_EL1, TraceVer, IMP
137136 #define FEAT_PMUv3 ID_AA64DFR0_EL1, PMUVer, IMP
@@ -192,7 +191,7 @@ struct reg_feat_map_desc { · 54 unmodified lines
192191 #define FEAT_SRMASK ID_AA64MMFR4_EL1, SRMASK, IMP
193192 #define FEAT_PoPS ID_AA64MMFR4_EL1, PoPS, IMP
194193 #define FEAT_PFAR ID_AA64PFR1_EL1, PFAR, IMP
195−#define FEAT_Debugv8p9 ID_AA64DFR0_EL1, PMUVer, V3P9
194+#define FEAT_Debugv8p9 ID_AA64DFR0_EL1, DebugVer, V8P9
196195 #define FEAT_PMUv3_SS ID_AA64DFR0_EL1, PMSS, IMP
197196 #define FEAT_SEBEP ID_AA64DFR0_EL1, SEBEP, IMP
198197 #define FEAT_EBEP ID_AA64DFR1_EL1, EBEP, IMP
@@ -283,7 +282,7 @@ static bool feat_anerr(struct kvm *kvm) · 84 unmodified lines
283282 static bool feat_sme_smps(struct kvm *kvm)
284283 {
285284 /*
286− * Revists this if KVM ever supports SME -- this really should
285+ * Revisit this if KVM ever supports SME -- this really should
287286 * look at the guest's view of SMIDR_EL1. Funnily enough, this
288287 * is not captured in the JSON file, but only as a note in the
289288 * ARM ARM.
@@ -295,17 +294,27 @@ static bool feat_sme_smps(struct kvm *kvm) · 5 unmodified lines
295294 static bool feat_spe_fds(struct kvm *kvm)
296295 {
297296 /*
298− * Revists this if KVM ever supports SPE -- this really should
297+ * Revisit this if KVM ever supports SPE -- this really should
299298 * look at the guest's view of PMSIDR_EL1.
300299 */
301300 return (kvm_has_feat(kvm, FEAT_SPEv1p4) &&
302301 (read_sysreg_s(SYS_PMSIDR_EL1) & PMSIDR_EL1_FDS));
303302 }
304303
304+static bool feat_spe_fne(struct kvm *kvm)
305+{
306+ /*
307+ * Revisit this if KVM ever supports SPE -- this really should
308+ * look at the guest's view of PMSIDR_EL1.
309+ */
310+ return (kvm_has_feat(kvm, FEAT_SPEv1p2) &&
311+ (read_sysreg_s(SYS_PMSIDR_EL1) & PMSIDR_EL1_FnE));
312+}
313+
305314 static bool feat_trbe_mpam(struct kvm *kvm)
306315 {
307316 /*
308− * Revists this if KVM ever supports both MPAM and TRBE --
317+ * Revisit this if KVM ever supports both MPAM and TRBE --
309318 * this really should look at the guest's view of TRBIDR_EL1.
310319 */
311320 return (kvm_has_feat(kvm, FEAT_TRBE) &&
@@ -537,7 +546,7 @@ static const struct reg_bits_to_feat_map hdfgrtr_feat_map[] = { · 225 unmodified lines
537546 HDFGRTR_EL2_PMBPTR_EL1 |
538547 HDFGRTR_EL2_PMBLIMITR_EL1,
539548 FEAT_SPE),
540− NEEDS_FEAT(HDFGRTR_EL2_nPMSNEVFR_EL1, FEAT_SPE_FnE),
549+ NEEDS_FEAT(HDFGRTR_EL2_nPMSNEVFR_EL1, feat_spe_fne),
541550 NEEDS_FEAT(HDFGRTR_EL2_nBRBDATA |
542551 HDFGRTR_EL2_nBRBCTL |
543552 HDFGRTR_EL2_nBRBIDR,
@@ -605,7 +614,7 @@ static const struct reg_bits_to_feat_map hdfgwtr_feat_map[] = { · 61 unmodified lines
605614 HDFGWTR_EL2_PMBPTR_EL1 |
606615 HDFGWTR_EL2_PMBLIMITR_EL1,
607616 FEAT_SPE),
608− NEEDS_FEAT(HDFGWTR_EL2_nPMSNEVFR_EL1, FEAT_SPE_FnE),
617+ NEEDS_FEAT(HDFGWTR_EL2_nPMSNEVFR_EL1, feat_spe_fne),
609618 NEEDS_FEAT(HDFGWTR_EL2_nBRBDATA |
610619 HDFGWTR_EL2_nBRBCTL,
611620 FEAT_BRBE),
arch/arm64/kvm/hyp/nvhe/hyp-main.c+17−13
@@ -709,6 +709,14 @@ static const hcall_t host_hcall[] = { · 708 unmodified lines
709709 HANDLE_FUNC(__kvm_tlb_flush_vmid_range),
710710 HANDLE_FUNC(__kvm_flush_cpu_context),
711711 HANDLE_FUNC(__kvm_timer_set_cntvoff),
712+ HANDLE_FUNC(__tracing_load),
713+ HANDLE_FUNC(__tracing_unload),
714+ HANDLE_FUNC(__tracing_enable),
715+ HANDLE_FUNC(__tracing_swap_reader),
716+ HANDLE_FUNC(__tracing_update_clock),
717+ HANDLE_FUNC(__tracing_reset),
718+ HANDLE_FUNC(__tracing_enable_event),
719+ HANDLE_FUNC(__tracing_write_event),
712720 HANDLE_FUNC(__vgic_v3_save_aprs),
713721 HANDLE_FUNC(__vgic_v3_restore_vmcr_aprs),
714722 HANDLE_FUNC(__vgic_v5_save_apr),
@@ -735,22 +743,16 @@ static const hcall_t host_hcall[] = { · 20 unmodified lines
735743 HANDLE_FUNC(__pkvm_vcpu_load),
736744 HANDLE_FUNC(__pkvm_vcpu_put),
737745 HANDLE_FUNC(__pkvm_tlb_flush_vmid),
738− HANDLE_FUNC(__tracing_load),
739− HANDLE_FUNC(__tracing_unload),
740− HANDLE_FUNC(__tracing_enable),
741− HANDLE_FUNC(__tracing_swap_reader),
742− HANDLE_FUNC(__tracing_update_clock),
743− HANDLE_FUNC(__tracing_reset),
744− HANDLE_FUNC(__tracing_enable_event),
745− HANDLE_FUNC(__tracing_write_event),
746746 };
747747
748748 static void handle_host_hcall(struct kvm_cpu_context *host_ctxt)
749749 {
750750 DECLARE_REG(unsigned long, id, host_ctxt, 0);
751− unsigned long hcall_min = 0, hcall_max = -1;
751+ unsigned long hcall_min = 0, hcall_max = __KVM_HOST_SMCCC_FUNC_MAX;
752752 hcall_t hfn;
753753
754+ BUILD_BUG_ON(ARRAY_SIZE(host_hcall) != __KVM_HOST_SMCCC_FUNC_MAX);
755+
754756 /*
755757 * If pKVM has been initialised then reject any calls to the
756758 * early "privileged" hypercalls. Note that we cannot reject
@@ -763,16 +765,14 @@ static void handle_host_hcall(struct kvm_cpu_context *host_ctxt) · 6 unmodified lines
763765 if (static_branch_unlikely(&kvm_protected_mode_initialized)) {
764766 hcall_min = __KVM_HOST_SMCCC_FUNC_MIN_PKVM;
765767 } else {
766− hcall_max = __KVM_HOST_SMCCC_FUNC_MAX_NO_PKVM;
768+ hcall_max = __KVM_HOST_SMCCC_FUNC_PKVM_ONLY;
767769 }
768770
769771 id &= ~ARM_SMCCC_CALL_HINTS;
770772 id -= KVM_HOST_SMCCC_ID(0);
771773
772− if (unlikely(id < hcall_min || id > hcall_max ||
773− id >= ARRAY_SIZE(host_hcall))) {
774+ if (unlikely(id < hcall_min || id >= hcall_max))
774775 goto inval;
775− }
776776
777777 hfn = host_hcall[id];
778778 if (unlikely(!hfn))
@@ -805,6 +805,10 @@ static void handle_host_smc(struct kvm_cpu_context *host_ctxt) · 26 unmodified lines
805805 }
806806
807807 func_id &= ~ARM_SMCCC_CALL_HINTS;
808+ if (upper_32_bits(func_id)) {
809+ cpu_reg(host_ctxt, 0) = SMCCC_RET_NOT_SUPPORTED;
810+ goto exit_skip_instr;
811+ }
808812
809813 handled = kvm_host_psci_handler(host_ctxt, func_id);
810814 if (!handled)
arch/arm64/kvm/hyp/nvhe/pkvm.c+25−13
@@ -266,7 +266,8 @@ struct pkvm_hyp_vcpu *pkvm_load_hyp_vcpu(pkvm_handle_t handle, · 265 unmodified lines
266266 if (hyp_vm->kvm.created_vcpus <= vcpu_idx)
267267 goto unlock;
268268
269− hyp_vcpu = hyp_vm->vcpus[vcpu_idx];
269+ /* Pairs with smp_store_release() in register_hyp_vcpu(). */
270+ hyp_vcpu = smp_load_acquire(&hyp_vm->vcpus[vcpu_idx]);
270271 if (!hyp_vcpu)
271272 goto unlock;
272273
@@ -860,12 +861,30 @@ err_unpin_kvm: · 587 unmodified lines
860861 * the page-aligned size of 'struct pkvm_hyp_vcpu'.
861862 * Return 0 on success, negative error code on failure.
862863 */
864+static int register_hyp_vcpu(struct pkvm_hyp_vm *hyp_vm,
865+ struct pkvm_hyp_vcpu *hyp_vcpu)
866+{
867+ unsigned int idx = hyp_vcpu->vcpu.vcpu_idx;
868+
869+ if (idx >= hyp_vm->kvm.created_vcpus)
870+ return -EINVAL;
871+
872+ if (hyp_vm->vcpus[idx])
873+ return -EINVAL;
874+
875+ /*
876+ * Ensure the hyp_vcpu is initialised before publishing it to
877+ * the vCPU-load path via 'hyp_vm->vcpus[]'.
878+ */
879+ smp_store_release(&hyp_vm->vcpus[idx], hyp_vcpu);
880+ return 0;
881+}
882+
863883 int __pkvm_init_vcpu(pkvm_handle_t handle, struct kvm_vcpu *host_vcpu,
864884 unsigned long vcpu_hva)
865885 {
866886 struct pkvm_hyp_vcpu *hyp_vcpu;
867887 struct pkvm_hyp_vm *hyp_vm;
868− unsigned int idx;
869888 int ret;
870889
871890 hyp_vcpu = map_donated_memory(vcpu_hva, sizeof(*hyp_vcpu));
@@ -884,18 +903,11 @@ int __pkvm_init_vcpu(pkvm_handle_t handle, struct kvm_vcpu *host_vcpu, · 12 unmodified lines
884903 if (ret)
885904 goto unlock;
886905
887− idx = hyp_vcpu->vcpu.vcpu_idx;
888− if (idx >= hyp_vm->kvm.created_vcpus) {
889− ret = -EINVAL;
890− goto unlock;
891− }
892−
893− if (hyp_vm->vcpus[idx]) {
894− ret = -EINVAL;
895− goto unlock;
906+ ret = register_hyp_vcpu(hyp_vm, hyp_vcpu);
907+ if (ret) {
908+ unpin_host_vcpu(host_vcpu);
909+ unpin_host_sve_state(hyp_vcpu);
896910 }
897−
898− hyp_vm->vcpus[idx] = hyp_vcpu;
899911 unlock:
900912 hyp_spin_unlock(&vm_table_lock);
901913
arch/arm64/kvm/hyp/nvhe/setup.c+3−3
@@ -312,15 +312,15 @@ void __noreturn __pkvm_init_finalise(void) · 311 unmodified lines
312312 };
313313 pkvm_pgtable.mm_ops = &pkvm_pgtable_mm_ops;
314314
315− ret = fix_host_ownership();
315+ ret = fix_hyp_pgtable_refcnt();
316316 if (ret)
317317 goto out;
318318
319− ret = fix_hyp_pgtable_refcnt();
319+ ret = hyp_create_fixmap();
320320 if (ret)
321321 goto out;
322322
323− ret = hyp_create_fixmap();
323+ ret = fix_host_ownership();
324324 if (ret)
325325 goto out;
326326
arch/arm64/kvm/vgic/vgic-mmio-v2.c+1−1
@@ -91,7 +91,7 @@ static int vgic_mmio_uaccess_write_v2_misc(struct kvm_vcpu *vcpu, · 90 unmodified lines
9191 * migration from old kernels to new kernels with legacy
9292 * userspace.
9393 */
94− reg = FIELD_GET(GICD_IIDR_REVISION_MASK, reg);
94+ reg = FIELD_GET(GICD_IIDR_REVISION_MASK, val);
9595 switch (reg) {
9696 case KVM_VGIC_IMP_REV_2:
9797 case KVM_VGIC_IMP_REV_3:
arch/arm64/kvm/vgic/vgic-mmio-v3.c+1−1
@@ -194,7 +194,7 @@ static int vgic_mmio_uaccess_write_v3_misc(struct kvm_vcpu *vcpu, · 193 unmodified lines
194194 if ((reg ^ val) & ~GICD_IIDR_REVISION_MASK)
195195 return -EINVAL;
196196
197− reg = FIELD_GET(GICD_IIDR_REVISION_MASK, reg);
197+ reg = FIELD_GET(GICD_IIDR_REVISION_MASK, val);
198198 switch (reg) {
199199 case KVM_VGIC_IMP_REV_2:
200200 case KVM_VGIC_IMP_REV_3:
arch/s390/kernel/debug.c+8−0
@@ -1414,6 +1414,9 @@ static inline char *debug_get_user_string(const char __user *user_buf, · 1413 unmodified lines
14141414 {
14151415 char *buffer;
14161416
1417+ if (!user_len)
1418+ return ERR_PTR(-EINVAL);
1419+
14171420 buffer = memdup_user_nul(user_buf, user_len);
14181421 if (IS_ERR(buffer))
14191422 return buffer;
@@ -1584,6 +1587,11 @@ static int debug_input_flush_fn(debug_info_t *id, struct debug_view *view, · 164 unmodified lines
15841587 char input_buf[1];
15851588 int rc = user_len;
15861589
1590+ if (!user_len) {
1591+ rc = -EINVAL;
1592+ goto out;
1593+ }
1594+
15871595 if (user_len > 0x10000)
15881596 user_len = 0x10000;
15891597 if (*offset != 0) {
arch/s390/mm/fault.c+1−1
@@ -438,7 +438,7 @@ void do_secure_storage_access(struct pt_regs *regs) · 437 unmodified lines
438438 panic("Unexpected PGM 0x3d with TEID bit 61=0");
439439 }
440440 if (is_kernel_fault(regs)) {
441− folio = phys_to_folio(addr);
441+ folio = virt_to_folio((void *)addr);
442442 if (unlikely(!folio_try_get(folio)))
443443 return;
444444 rc = uv_convert_from_secure(folio_to_phys(folio));
arch/sh/include/asm/setup.h+1−1
@@ -7,7 +7,7 @@ · 6 unmodified lines
77 /*
88 * This is set up by the setup-routine at boot-time
99 */
10−extern unsigned char *boot_params_page;
10+extern unsigned char boot_params_page[];
1111 #define PARAM boot_params_page
1212
1313 #define MOUNT_ROOT_RDONLY (*(unsigned long *) (PARAM+0x000))
crypto/authencesn.c+5−0
@@ -390,6 +390,11 @@ static int crypto_authenc_esn_create(struct crypto_template *tmpl, · 389 unmodified lines
390390 auth = crypto_spawn_ahash_alg(&ctx->auth);
391391 auth_base = &auth->base;
392392
393+ if (auth->digestsize > 0 && auth->digestsize < 4) {
394+ err = -EINVAL;
395+ goto err_free_inst;
396+ }
397+
393398 err = crypto_grab_skcipher(&ctx->enc, aead_crypto_instance(inst),
394399 crypto_attr_alg_name(tb[2]), 0, mask);
395400 if (err)
drivers/acpi/acpi_tad.c+19−16
@@ -605,15 +605,12 @@ static umode_t acpi_tad_attr_is_visible(struct kobject *kobj, · 604 unmodified lines
605605 return 0;
606606 }
607607
608−static const struct attribute_group acpi_tad_attr_group = {
608+static const struct attribute_group acpi_tad_group = {
609609 .attrs = acpi_tad_attrs,
610610 .is_visible = acpi_tad_attr_is_visible,
611611 };
612612
613−static const struct attribute_group *acpi_tad_attr_groups[] = {
614− &acpi_tad_attr_group,
615− NULL,
616−};
613+__ATTRIBUTE_GROUPS(acpi_tad);
617614
618615 #ifdef CONFIG_RTC_CLASS
619616 /* RTC class device interface */
@@ -683,9 +680,8 @@ static int acpi_tad_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *t) · 63 unmodified lines
683680
684681 acpi_tad_rt_to_tm(&rt, &tm_now);
685682
686− value = ktime_divns(ktime_sub(rtc_tm_to_ktime(t->time),
687− rtc_tm_to_ktime(tm_now)), NSEC_PER_SEC);
688− if (value <= 0 || value > U32_MAX)
683+ value = rtc_tm_to_time64(&t->time) - rtc_tm_to_time64(&tm_now);
684+ if (value <= 0 || value >= U32_MAX)
689685 return -EINVAL;
690686 }
691687
@@ -748,8 +744,7 @@ static int acpi_tad_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *t) · 56 unmodified lines
748744
749745 if (retval != ACPI_TAD_WAKE_DISABLED) {
750746 t->enabled = 1;
751− t->time = rtc_ktime_to_tm(ktime_add_ns(rtc_tm_to_ktime(tm_now),
752− (u64)retval * NSEC_PER_SEC));
747+ rtc_time64_to_tm(rtc_tm_to_time64(&tm_now) + retval, &t->time);
753748 } else {
754749 t->enabled = 0;
755750 t->time = tm_now;
@@ -795,9 +790,9 @@ static int acpi_tad_disable_timer(struct device *dev, u32 timer_id) · 39 unmodified lines
795790 return acpi_tad_wake_set(dev, "_STV", timer_id, ACPI_TAD_WAKE_DISABLED);
796791 }
797792
798−static void acpi_tad_remove(struct platform_device *pdev)
793+static void acpi_tad_remove(void *data)
799794 {
800− struct device *dev = &pdev->dev;
795+ struct device *dev = data;
801796 struct acpi_tad_driver_data *dd = dev_get_drvdata(dev);
802797
803798 device_init_wakeup(dev, false);
@@ -824,6 +819,7 @@ static int acpi_tad_probe(struct platform_device *pdev) · 20 unmodified lines
824819 struct acpi_tad_driver_data *dd;
825820 acpi_status status;
826821 unsigned long long caps;
822+ int ret;
827823
828824 /*
829825 * Initialization failure messages are mostly about firmware issues, so
@@ -863,13 +859,21 @@ static int acpi_tad_probe(struct platform_device *pdev) · 33 unmodified lines
863859 }
864860
865861 /*
866− * The platform bus type layer tells the ACPI PM domain powers up the
867− * device, so set the runtime PM status of it to "active".
862+ * The platform bus type probe callback tells the ACPI PM domain to
863+ * power up the device, so set the runtime PM status of it to "active".
868864 */
869865 pm_runtime_set_active(dev);
870866 pm_runtime_enable(dev);
871867 pm_runtime_suspend(dev);
872868
869+ /*
870+ * acpi_tad_remove() needs to run after unregistering the RTC class
871+ * device to avoid racing with the latter's callbacks.
872+ */
873+ ret = devm_add_action_or_reset(&pdev->dev, acpi_tad_remove, &pdev->dev);
874+ if (ret)
875+ return ret;
876+
873877 if (caps & ACPI_TAD_RT)
874878 acpi_tad_register_rtc(dev, caps);
875879
@@ -885,10 +889,9 @@ static struct platform_driver acpi_tad_driver = { · 9 unmodified lines
885889 .driver = {
886890 .name = "acpi-tad",
887891 .acpi_match_table = acpi_tad_ids,
888− .dev_groups = acpi_tad_attr_groups,
892+ .dev_groups = acpi_tad_groups,
889893 },
890894 .probe = acpi_tad_probe,
891− .remove = acpi_tad_remove,
892895 };
893896 MODULE_DEVICE_TABLE(acpi, acpi_tad_ids);
894897
drivers/acpi/apei/einj-core.c+25−20
@@ -401,8 +401,18 @@ static struct acpi_generic_address *einj_get_trigger_parameter_region( · 400 unmodified lines
401401
402402 return NULL;
403403 }
404+
405+static bool is_memory_injection(u32 type, u32 flags)
406+{
407+ if (flags & SETWA_FLAGS_EINJV2)
408+ return !!(type & ACPI_EINJV2_MEMORY);
409+ if (type & ACPI5_VENDOR_BIT)
410+ return !!(vendor_flags & SETWA_FLAGS_MEM);
411+ return !!(type & MEM_ERROR_MASK) || !!(flags & SETWA_FLAGS_MEM);
412+}
413+
404414 /* Execute instructions in trigger error action table */
405−static int __einj_error_trigger(u64 trigger_paddr, u32 type,
415+static int __einj_error_trigger(u64 trigger_paddr, u32 type, u32 flags,
406416 u64 param1, u64 param2)
407417 {
408418 struct acpi_einj_trigger trigger_tab;
@@ -480,7 +490,7 @@ static int __einj_error_trigger(u64 trigger_paddr, u32 type, · 71 unmodified lines
480490 * This will cause resource conflict with regular memory. So
481491 * remove it from trigger table resources.
482492 */
483− if ((param_extension || acpi5) && (type & MEM_ERROR_MASK) && param2) {
493+ if ((param_extension || acpi5) && is_memory_injection(type, flags)) {
484494 struct apei_resources addr_resources;
485495
486496 apei_resources_init(&addr_resources);
@@ -660,7 +670,7 @@ static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, · 173 unmodified lines
660670 return rc;
661671 trigger_paddr = apei_exec_ctx_get_output(&ctx);
662672 if (notrigger == 0) {
663− rc = __einj_error_trigger(trigger_paddr, type, param1, param2);
673+ rc = __einj_error_trigger(trigger_paddr, type, flags, param1, param2);
664674 if (rc)
665675 return rc;
666676 }
@@ -718,35 +728,30 @@ int einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, u64 param3, · 51 unmodified lines
718728 SETWA_FLAGS_PCIE_SBDF | SETWA_FLAGS_EINJV2)))
719729 return -EINVAL;
720730
731+ /*
732+ * Injections targeting a CXL 1.0/1.1 port have to be injected
733+ * via the einj_cxl_rch_error_inject() path as that does the proper
734+ * validation of the given RCRB base (MMIO) address.
735+ */
736+ if (einj_is_cxl_error_type(type) && (flags & SETWA_FLAGS_MEM))
737+ return -EINVAL;
738+
721739 /* check if type is a valid EINJv2 error type */
722740 if (is_v2) {
723741 if (!(type & available_error_type_v2))
724742 return -EINVAL;
725743 }
726− /*
727− * We need extra sanity checks for memory errors.
728− * Other types leap directly to injection.
729− */
730744
731745 /* ensure param1/param2 existed */
732746 if (!(param_extension || acpi5))
733747 goto inject;
734748
735− /* ensure injection is memory related */
736− if (type & ACPI5_VENDOR_BIT) {
737− if (vendor_flags != SETWA_FLAGS_MEM)
738− goto inject;
739− } else if (!(type & MEM_ERROR_MASK) && !(flags & SETWA_FLAGS_MEM)) {
740− goto inject;
741− }
742−
743749 /*
744− * Injections targeting a CXL 1.0/1.1 port have to be injected
745− * via the einj_cxl_rch_error_inject() path as that does the proper
746− * validation of the given RCRB base (MMIO) address.
750+ * We need extra sanity checks for memory errors.
751+ * Other types leap directly to injection.
747752 */
748− if (einj_is_cxl_error_type(type) && (flags & SETWA_FLAGS_MEM))
749− return -EINVAL;
753+ if (!is_memory_injection(type, flags))
754+ goto inject;
750755
751756 /*
752757 * Disallow crazy address masks that give BIOS leeway to pick
drivers/acpi/arm64/cpuidle.c+3−7
@@ -16,7 +16,7 @@ · 15 unmodified lines
1616
1717 static int psci_acpi_cpu_init_idle(unsigned int cpu)
1818 {
19− int i, count;
19+ int i;
2020 struct acpi_lpi_state *lpi;
2121 struct acpi_processor *pr = per_cpu(processors, cpu);
2222
@@ -30,14 +30,10 @@ static int psci_acpi_cpu_init_idle(unsigned int cpu) · 7 unmodified lines
3030 if (!psci_ops.cpu_suspend)
3131 return -EOPNOTSUPP;
3232
33− count = pr->power.count - 1;
34− if (count <= 0)
35− return -ENODEV;
36−
37− for (i = 0; i < count; i++) {
33+ for (i = 1; i < pr->power.count; i++) {
3834 u32 state;
3935
40− lpi = &pr->power.lpi_states[i + 1];
36+ lpi = &pr->power.lpi_states[i];
4137 /*
4238 * Only bits[31:0] represent a PSCI power_state while
4339 * bits[63:32] must be 0x0 as per ARM ACPI FFH Specification
drivers/acpi/cppc_acpi.c+3−3
@@ -362,7 +362,7 @@ static int send_pcc_cmd(int pcc_ss_id, u16 cmd) · 361 unmodified lines
362362 end:
363363 if (cmd == CMD_WRITE) {
364364 if (unlikely(ret)) {
365− for_each_online_cpu(i) {
365+ for_each_possible_cpu(i) {
366366 struct cpc_desc *desc = per_cpu(cpc_desc_ptr, i);
367367
368368 if (!desc)
@@ -524,13 +524,13 @@ int acpi_get_psd_map(unsigned int cpu, struct cppc_cpudata *cpu_data) · 155 unmodified lines
524524 else if (pdomain->coord_type == DOMAIN_COORD_TYPE_SW_ANY)
525525 cpu_data->shared_type = CPUFREQ_SHARED_TYPE_ANY;
526526
527− for_each_online_cpu(i) {
527+ for_each_possible_cpu(i) {
528528 if (i == cpu)
529529 continue;
530530
531531 match_cpc_ptr = per_cpu(cpc_desc_ptr, i);
532532 if (!match_cpc_ptr)
533− goto err_fault;
533+ continue;
534534
535535 match_pdomain = &(match_cpc_ptr->domain_info);
536536 if (match_pdomain->domain != pdomain->domain)
drivers/acpi/video_detect.c+8−0
@@ -916,6 +916,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = { · 915 unmodified lines
916916 DMI_MATCH(DMI_PRODUCT_NAME, "82K8"),
917917 },
918918 },
919+ {
920+ .callback = video_detect_force_native,
921+ /* HP OMEN Gaming Laptop 16-n0xxx */
922+ .matches = {
923+ DMI_MATCH(DMI_SYS_VENDOR, "HP"),
924+ DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16-n0xxx"),
925+ },
926+ },
919927
920928 /*
921929 * x86 android tablets which directly control the backlight through
drivers/ata/pata_parport/pata_parport.c+7−14
@@ -459,19 +459,11 @@ static void pata_parport_dev_release(struct device *dev) · 458 unmodified lines
459459 kfree(pi);
460460 }
461461
462−static void pata_parport_bus_release(struct device *dev)
463−{
464− /* nothing to do here but required to avoid warning on device removal */
465−}
466−
467462 static const struct bus_type pata_parport_bus_type = {
468463 .name = DRV_NAME,
469464 };
470465
471−static struct device pata_parport_bus = {
472− .init_name = DRV_NAME,
473− .release = pata_parport_bus_release,
474−};
466+static struct device *pata_parport_bus;
475467
476468 static const struct scsi_host_template pata_parport_sht = {
477469 PATA_PARPORT_SHT("pata_parport")
@@ -518,7 +510,7 @@ static struct pi_adapter *pi_init_one(struct parport *parport, · 40 unmodified lines
518510 }
519511
520512 /* set up pi->dev before pi_probe_unit() so it can use dev_printk() */
521− pi->dev.parent = &pata_parport_bus;
513+ pi->dev.parent = pata_parport_bus;
522514 pi->dev.bus = &pata_parport_bus_type;
523515 pi->dev.driver = &pr->driver;
524516 pi->dev.release = pata_parport_dev_release;
@@ -780,8 +772,9 @@ static __init int pata_parport_init(void) · 255 unmodified lines
780772 return error;
781773 }
782774
783− error = device_register(&pata_parport_bus);
784− if (error) {
775+ pata_parport_bus = root_device_register(DRV_NAME);
776+ if (IS_ERR(pata_parport_bus)) {
777+ error = PTR_ERR(pata_parport_bus);
785778 pr_err("failed to register pata_parport bus, error: %d\n", error);
786779 goto out_unregister_bus;
787780 }
@@ -811,7 +804,7 @@ out_remove_del: · 23 unmodified lines
811804 out_remove_new:
812805 bus_remove_file(&pata_parport_bus_type, &bus_attr_new_device);
813806 out_unregister_dev:
814− device_unregister(&pata_parport_bus);
807+ root_device_unregister(pata_parport_bus);
815808 out_unregister_bus:
816809 bus_unregister(&pata_parport_bus_type);
817810 return error;
@@ -822,7 +815,7 @@ static __exit void pata_parport_exit(void) · 4 unmodified lines
822815 parport_unregister_driver(&pata_parport_driver);
823816 bus_remove_file(&pata_parport_bus_type, &bus_attr_new_device);
824817 bus_remove_file(&pata_parport_bus_type, &bus_attr_delete_device);
825− device_unregister(&pata_parport_bus);
818+ root_device_unregister(pata_parport_bus);
826819 bus_unregister(&pata_parport_bus_type);
827820 }
828821
drivers/base/regmap/regmap-sdw-mbq.c+1−1
@@ -172,7 +172,7 @@ static int regmap_sdw_mbq_read(void *context, unsigned int reg, unsigned int *va · 171 unmodified lines
172172 ret = regmap_sdw_mbq_read_impl(slave, reg, val, mbq_size);
173173 if (ret == -ENODATA) {
174174 if (!deferrable)
175− dev_warn(dev, "Defer on undeferable control: %x\n", reg);
175+ dev_warn(dev, "Defer on undeferrable control: %x\n", reg);
176176
177177 ret = regmap_sdw_mbq_poll_busy(slave, reg, ctx);
178178 if (ret)
drivers/cdrom/cdrom.c+48−25
@@ -631,6 +631,16 @@ int register_cdrom(struct gendisk *disk, struct cdrom_device_info *cdi) · 630 unmodified lines
631631
632632 WARN_ON(!cdo->generic_packet);
633633
634+ /*
635+ * Propagate the drive's write support to the block layer so BLKROGET
636+ * reflects actual write capability. Drivers that use GET CONFIGURATION
637+ * features (CDC_MRW_W, CDC_RAM) must have called
638+ * cdrom_probe_write_features() before register_cdrom() so the mask is
639+ * complete here.
640+ */
641+ set_disk_ro(disk, !CDROM_CAN(CDC_DVD_RAM | CDC_MRW_W | CDC_RAM |
642+ CDC_CD_RW));
643+
634644 cd_dbg(CD_REG_UNREG, "drive \"/dev/%s\" registered\n", cdi->name);
635645 mutex_lock(&cdrom_mutex);
636646 list_add(&cdi->list, &cdrom_list);
@@ -742,6 +752,44 @@ static int cdrom_is_random_writable(struct cdrom_device_info *cdi, int *write) · 105 unmodified lines
742752 return 0;
743753 }
744754
755+/*
756+ * Probe write-related MMC features via GET CONFIGURATION and update
757+ * cdi->mask accordingly. Drivers that populate cdi->mask from the MODE SENSE
758+ * capabilities page (e.g. sr) should call this after those MODE SENSE bits
759+ * have been set but before register_cdrom(), so that the full set of
760+ * write-capability bits is known by the time register_cdrom() decides on the
761+ * initial read-only state of the disk.
762+ */
763+void cdrom_probe_write_features(struct cdrom_device_info *cdi)
764+{
765+ int mrw, mrw_write, ram_write;
766+
767+ mrw = 0;
768+ if (!cdrom_is_mrw(cdi, &mrw_write))
769+ mrw = 1;
770+
771+ if (CDROM_CAN(CDC_MO_DRIVE))
772+ ram_write = 1;
773+ else
774+ (void) cdrom_is_random_writable(cdi, &ram_write);
775+
776+ if (mrw)
777+ cdi->mask &= ~CDC_MRW;
778+ else
779+ cdi->mask |= CDC_MRW;
780+
781+ if (mrw_write)
782+ cdi->mask &= ~CDC_MRW_W;
783+ else
784+ cdi->mask |= CDC_MRW_W;
785+
786+ if (ram_write)
787+ cdi->mask &= ~CDC_RAM;
788+ else
789+ cdi->mask |= CDC_RAM;
790+}
791+EXPORT_SYMBOL(cdrom_probe_write_features);
792+
745793 static int cdrom_media_erasable(struct cdrom_device_info *cdi)
746794 {
747795 disc_information di;
@@ -894,33 +942,8 @@ static int cdrom_is_dvd_rw(struct cdrom_device_info *cdi) · 146 unmodified lines
894942 */
895943 static int cdrom_open_write(struct cdrom_device_info *cdi)
896944 {
897− int mrw, mrw_write, ram_write;
898945 int ret = 1;
899946
900− mrw = 0;
901− if (!cdrom_is_mrw(cdi, &mrw_write))
902− mrw = 1;
903−
904− if (CDROM_CAN(CDC_MO_DRIVE))
905− ram_write = 1;
906− else
907− (void) cdrom_is_random_writable(cdi, &ram_write);
908−
909− if (mrw)
910− cdi->mask &= ~CDC_MRW;
911− else
912− cdi->mask |= CDC_MRW;
913−
914− if (mrw_write)
915− cdi->mask &= ~CDC_MRW_W;
916− else
917− cdi->mask |= CDC_MRW_W;
918−
919− if (ram_write)
920− cdi->mask &= ~CDC_RAM;
921− else
922− cdi->mask |= CDC_RAM;
923−
924947 if (CDROM_CAN(CDC_MRW_W))
925948 ret = cdrom_mrw_open_write(cdi);
926949 else if (CDROM_CAN(CDC_DVD_RAM))
drivers/dpll/dpll_netlink.c+10−0
@@ -900,11 +900,21 @@ int dpll_pin_delete_ntf(struct dpll_pin *pin) · 899 unmodified lines
900900 return dpll_pin_event_send(DPLL_CMD_PIN_DELETE_NTF, pin);
901901 }
902902
903+/**
904+ * __dpll_pin_change_ntf - notify that the pin has been changed
905+ * @pin: registered pin pointer
906+ *
907+ * Context: caller must hold dpll_lock. Suitable for use inside pin
908+ * callbacks which are already invoked under dpll_lock.
909+ * Return: 0 if succeeds, error code otherwise.
910+ */
903911 int __dpll_pin_change_ntf(struct dpll_pin *pin)
904912 {
913+ lockdep_assert_held(&dpll_lock);
905914 dpll_pin_notify(pin, DPLL_PIN_CHANGED);
906915 return dpll_pin_event_send(DPLL_CMD_PIN_CHANGE_NTF, pin);
907916 }
917+EXPORT_SYMBOL_GPL(__dpll_pin_change_ntf);
908918
909919 /**
910920 * dpll_pin_change_ntf - notify that the pin has been changed
drivers/dpll/dpll_netlink.h+0−2
@@ -11,5 +11,3 @@ int dpll_device_delete_ntf(struct dpll_device *dpll); · 10 unmodified lines
1111 int dpll_pin_create_ntf(struct dpll_pin *pin);
1212
1313 int dpll_pin_delete_ntf(struct dpll_pin *pin);
14−
15−int __dpll_pin_change_ntf(struct dpll_pin *pin);
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c+5−1
@@ -2839,8 +2839,12 @@ static int amdgpu_device_ip_fini_early(struct amdgpu_device *adev) · 2838 unmodified lines
28392839 * that checks whether the PSP is running. A solution for those issues
28402840 * in the APU is to trigger a GPU reset, but this should be done during
28412841 * the unload phase to avoid adding boot latency and screen flicker.
2842+ * GFX V11 has GC block as default off IP. Every time AMDGPU driver sends
2843+ * a request to PMFW to unload MP1, PMFW will put GC in reset and power down
2844+ * the voltage. Hence, skipping reset for APUs with GFX V11 or later.
28422845 */
2843− if ((adev->flags & AMD_IS_APU) && !adev->gmc.is_app_apu) {
2846+ if ((adev->flags & AMD_IS_APU) && !adev->gmc.is_app_apu &&
2847+ amdgpu_ip_version(adev, GC_HWIP, 0) < IP_VERSION(11, 0, 0)) {
28442848 r = amdgpu_asic_reset(adev);
28452849 if (r)
28462850 dev_err(adev->dev, "asic reset on %s failed\n", __func__);
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c+1−3
@@ -3090,10 +3090,8 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev) · 3089 unmodified lines
30903090 case IP_VERSION(11, 5, 1):
30913091 case IP_VERSION(11, 5, 2):
30923092 case IP_VERSION(11, 5, 3):
3093− adev->family = AMDGPU_FAMILY_GC_11_5_0;
3094− break;
30953093 case IP_VERSION(11, 5, 4):
3096− adev->family = AMDGPU_FAMILY_GC_11_5_4;
3094+ adev->family = AMDGPU_FAMILY_GC_11_5_0;
30973095 break;
30983096 case IP_VERSION(12, 0, 0):
30993097 case IP_VERSION(12, 0, 1):
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c+4−2
@@ -3158,8 +3158,10 @@ static int __init amdgpu_init(void) · 3157 unmodified lines
31583158 amdgpu_register_atpx_handler();
31593159 amdgpu_acpi_detect();
31603160
3161− /* Ignore KFD init failures. Normal when CONFIG_HSA_AMD is not set. */
3162− amdgpu_amdkfd_init();
3161+ /* Ignore KFD init failures when CONFIG_HSA_AMD is not set. */
3162+ r = amdgpu_amdkfd_init();
3163+ if (r && r != -ENOENT)
3164+ goto error_fence;
31633165
31643166 if (amdgpu_pp_feature_mask & PP_OVERDRIVE_MASK) {
31653167 add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c+4−1
@@ -314,7 +314,10 @@ void amdgpu_gmc_gart_location(struct amdgpu_device *adev, struct amdgpu_gmc *mc, · 313 unmodified lines
314314 mc->gart_start = max_mc_address - mc->gart_size + 1;
315315 break;
316316 case AMDGPU_GART_PLACEMENT_LOW:
317− mc->gart_start = 0;
317+ if (size_bf >= mc->gart_size)
318+ mc->gart_start = 0;
319+ else
320+ mc->gart_start = ALIGN(mc->fb_end, four_gb);
318321 break;
319322 case AMDGPU_GART_PLACEMENT_BEST_FIT:
320323 default:
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c+24−33
@@ -873,68 +873,59 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) · 872 unmodified lines
873873 ? -EFAULT : 0;
874874 }
875875 case AMDGPU_INFO_READ_MMR_REG: {
876− int ret = 0;
877− unsigned int n, alloc_size;
878− uint32_t *regs;
879876 unsigned int se_num = (info->read_mmr_reg.instance >>
880877 AMDGPU_INFO_MMR_SE_INDEX_SHIFT) &
881878 AMDGPU_INFO_MMR_SE_INDEX_MASK;
882879 unsigned int sh_num = (info->read_mmr_reg.instance >>
883880 AMDGPU_INFO_MMR_SH_INDEX_SHIFT) &
884881 AMDGPU_INFO_MMR_SH_INDEX_MASK;
885−
886− if (!down_read_trylock(&adev->reset_domain->sem))
887− return -ENOENT;
882+ unsigned int alloc_size;
883+ uint32_t *regs;
884+ int ret;
888885
889886 /* set full masks if the userspace set all bits
890887 * in the bitfields
891888 */
892− if (se_num == AMDGPU_INFO_MMR_SE_INDEX_MASK) {
889+ if (se_num == AMDGPU_INFO_MMR_SE_INDEX_MASK)
893890 se_num = 0xffffffff;
894− } else if (se_num >= AMDGPU_GFX_MAX_SE) {
895− ret = -EINVAL;
896− goto out;
897− }
891+ else if (se_num >= AMDGPU_GFX_MAX_SE)
892+ return -EINVAL;
898893
899− if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK) {
894+ if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK)
900895 sh_num = 0xffffffff;
901− } else if (sh_num >= AMDGPU_GFX_MAX_SH_PER_SE) {
902− ret = -EINVAL;
903− goto out;
904− }
896+ else if (sh_num >= AMDGPU_GFX_MAX_SH_PER_SE)
897+ return -EINVAL;
905898
906− if (info->read_mmr_reg.count > 128) {
907− ret = -EINVAL;
908− goto out;
909− }
899+ if (info->read_mmr_reg.count > 128)
900+ return -EINVAL;
910901
911− regs = kmalloc_array(info->read_mmr_reg.count, sizeof(*regs), GFP_KERNEL);
912− if (!regs) {
913− ret = -ENOMEM;
914− goto out;
915− }
902+ regs = kmalloc_array(info->read_mmr_reg.count, sizeof(*regs),
903+ GFP_KERNEL);
904+ if (!regs)
905+ return -ENOMEM;
916906
907+ down_read(&adev->reset_domain->sem);
917908 alloc_size = info->read_mmr_reg.count * sizeof(*regs);
918−
919909 amdgpu_gfx_off_ctrl(adev, false);
910+ ret = 0;
920911 for (i = 0; i < info->read_mmr_reg.count; i++) {
921912 if (amdgpu_asic_read_register(adev, se_num, sh_num,
922913 info->read_mmr_reg.dword_offset + i,
923914 &regs[i])) {
924915 DRM_DEBUG_KMS("unallowed offset %#x\n",
925916 info->read_mmr_reg.dword_offset + i);
926− kfree(regs);
927− amdgpu_gfx_off_ctrl(adev, true);
928917 ret = -EFAULT;
929− goto out;
918+ break;
930919 }
931920 }
932921 amdgpu_gfx_off_ctrl(adev, true);
933− n = copy_to_user(out, regs, min(size, alloc_size));
934− kfree(regs);
935− ret = (n ? -EFAULT : 0);
936−out:
937922 up_read(&adev->reset_domain->sem);
923+
924+ if (!ret) {
925+ ret = copy_to_user(out, regs, min(size, alloc_size))
926+ ? -EFAULT : 0;
927+ }
928+ kfree(regs);
938929 return ret;
939930 }
940931 case AMDGPU_INFO_DEV_INFO: {
drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c+1−1
@@ -1950,7 +1950,7 @@ void amdgpu_ras_check_bad_page_status(struct amdgpu_device *adev) · 1949 unmodified lines
19501950 if (!control || amdgpu_bad_page_threshold == 0)
19511951 return;
19521952
1953− if (control->ras_num_bad_pages >= ras->bad_page_cnt_threshold) {
1953+ if (control->ras_num_bad_pages > ras->bad_page_cnt_threshold) {
19541954 if (amdgpu_dpm_send_rma_reason(adev))
19551955 dev_warn(adev->dev, "Unable to send out-of-band RMA CPER");
19561956 else
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c+3−0
@@ -75,6 +75,9 @@ static int amdgpu_ttm_init_on_chip(struct amdgpu_device *adev, · 74 unmodified lines
7575 unsigned int type,
7676 uint64_t size_in_page)
7777 {
78+ if (!size_in_page)
79+ return 0;
80+
7881 return ttm_range_man_init(&adev->mman.bdev, type,
7982 false, size_in_page);
8083 }
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c+15−7
@@ -205,6 +205,19 @@ void amdgpu_userq_start_hang_detect_work(struct amdgpu_usermode_queue *queue) · 204 unmodified lines
205205 msecs_to_jiffies(timeout_ms));
206206 }
207207
208+void amdgpu_userq_process_fence_irq(struct amdgpu_device *adev, u32 doorbell)
209+{
210+ struct xarray *xa = &adev->userq_doorbell_xa;
211+ struct amdgpu_usermode_queue *queue;
212+ unsigned long flags;
213+
214+ xa_lock_irqsave(xa, flags);
215+ queue = xa_load(xa, doorbell);
216+ if (queue)
217+ amdgpu_userq_fence_driver_process(queue->fence_drv);
218+ xa_unlock_irqrestore(xa, flags);
219+}
220+
208221 static void amdgpu_userq_init_hang_detect_work(struct amdgpu_usermode_queue *queue)
209222 {
210223 INIT_DELAYED_WORK(&queue->hang_detect_work, amdgpu_userq_hang_detect_work);
@@ -643,12 +656,6 @@ amdgpu_userq_destroy(struct amdgpu_userq_mgr *uq_mgr, struct amdgpu_usermode_que · 432 unmodified lines
643656 #endif
644657 amdgpu_userq_detect_and_reset_queues(uq_mgr);
645658 r = amdgpu_userq_unmap_helper(queue);
646− /*TODO: It requires a reset for userq hw unmap error*/
647− if (r) {
648− drm_warn(adev_to_drm(uq_mgr->adev), "trying to destroy a HW mapping userq\n");
649− queue->state = AMDGPU_USERQ_STATE_HUNG;
650− }
651−
652659 atomic_dec(&uq_mgr->userq_count[queue->queue_type]);
653660 amdgpu_userq_cleanup(queue);
654661 mutex_unlock(&uq_mgr->userq_mutex);
@@ -1187,7 +1194,7 @@ retry_lock: · 532 unmodified lines
11871194 bo = range->bo;
11881195 ret = amdgpu_ttm_tt_get_user_pages(bo, range);
11891196 if (ret)
1190− goto unlock_all;
1197+ goto free_ranges;
11911198 }
11921199
11931200 invalidated = true;
@@ -1214,6 +1221,7 @@ retry_lock: · 20 unmodified lines
12141221
12151222 unlock_all:
12161223 drm_exec_fini(&exec);
1224+free_ranges:
12171225 xa_for_each(&xa, tmp_key, range) {
12181226 if (!range)
12191227 continue;
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h+1−0
@@ -156,6 +156,7 @@ void amdgpu_userq_reset_work(struct work_struct *work); · 155 unmodified lines
156156 void amdgpu_userq_pre_reset(struct amdgpu_device *adev);
157157 int amdgpu_userq_post_reset(struct amdgpu_device *adev, bool vram_lost);
158158 void amdgpu_userq_start_hang_detect_work(struct amdgpu_usermode_queue *queue);
159+void amdgpu_userq_process_fence_irq(struct amdgpu_device *adev, u32 doorbell);
159160
160161 int amdgpu_userq_input_va_validate(struct amdgpu_device *adev,
161162 struct amdgpu_usermode_queue *queue,
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c+14−3
@@ -3023,11 +3023,22 @@ bool amdgpu_vm_handle_fault(struct amdgpu_device *adev, u32 pasid, · 3022 unmodified lines
30233023
30243024 is_compute_context = vm->is_compute_context;
30253025
3026− if (is_compute_context && !svm_range_restore_pages(adev, pasid, vmid,
3027− node_id, addr >> PAGE_SHIFT, ts, write_fault)) {
3026+ if (is_compute_context) {
3027+ /* Unreserve root since svm_range_restore_pages might try to reserve it. */
3028+ /* TODO: rework svm_range_restore_pages so that this isn't necessary. */
30283029 amdgpu_bo_unreserve(root);
3030+
3031+ if (!svm_range_restore_pages(adev, pasid, vmid,
3032+ node_id, addr >> PAGE_SHIFT, ts, write_fault)) {
3033+ amdgpu_bo_unref(&root);
3034+ return true;
3035+ }
30293036 amdgpu_bo_unref(&root);
3030− return true;
3037+
3038+ /* Re-acquire the VM lock, could be that the VM was freed in between. */
3039+ vm = amdgpu_vm_lock_by_pasid(adev, &root, pasid);
3040+ if (!vm)
3041+ return false;
30313042 }
30323043
30333044 addr /= AMDGPU_GPU_PAGE_SIZE;
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c+1−9
@@ -6523,15 +6523,7 @@ static int gfx_v11_0_eop_irq(struct amdgpu_device *adev, · 6522 unmodified lines
65236523 DRM_DEBUG("IH: CP EOP\n");
65246524
65256525 if (adev->enable_mes && doorbell_offset) {
6526− struct amdgpu_usermode_queue *queue;
6527− struct xarray *xa = &adev->userq_doorbell_xa;
6528− unsigned long flags;
6529−
6530− xa_lock_irqsave(xa, flags);
6531− queue = xa_load(xa, doorbell_offset);
6532− if (queue)
6533− amdgpu_userq_fence_driver_process(queue->fence_drv);
6534− xa_unlock_irqrestore(xa, flags);
6526+ amdgpu_userq_process_fence_irq(adev, doorbell_offset);
65356527 } else {
65366528 me_id = (entry->ring_id & 0x0c) >> 2;
65376529 pipe_id = (entry->ring_id & 0x03) >> 0;
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c+1−9
@@ -4854,15 +4854,7 @@ static int gfx_v12_0_eop_irq(struct amdgpu_device *adev, · 4853 unmodified lines
48544854 DRM_DEBUG("IH: CP EOP\n");
48554855
48564856 if (adev->enable_mes && doorbell_offset) {
4857− struct xarray *xa = &adev->userq_doorbell_xa;
4858− struct amdgpu_usermode_queue *queue;
4859− unsigned long flags;
4860−
4861− xa_lock_irqsave(xa, flags);
4862− queue = xa_load(xa, doorbell_offset);
4863− if (queue)
4864− amdgpu_userq_fence_driver_process(queue->fence_drv);
4865− xa_unlock_irqrestore(xa, flags);
4857+ amdgpu_userq_process_fence_irq(adev, doorbell_offset);
48664858 } else {
48674859 me_id = (entry->ring_id & 0x0c) >> 2;
48684860 pipe_id = (entry->ring_id & 0x03) >> 0;
drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c+1−10
@@ -3643,16 +3643,7 @@ static int gfx_v12_1_eop_irq(struct amdgpu_device *adev, · 3642 unmodified lines
36433643 DRM_DEBUG("IH: CP EOP\n");
36443644
36453645 if (adev->enable_mes && doorbell_offset) {
3646− struct xarray *xa = &adev->userq_doorbell_xa;
3647− struct amdgpu_usermode_queue *queue;
3648− unsigned long flags;
3649−
3650− xa_lock_irqsave(xa, flags);
3651− queue = xa_load(xa, doorbell_offset);
3652− if (queue)
3653− amdgpu_userq_fence_driver_process(queue->fence_drv);
3654−
3655− xa_unlock_irqrestore(xa, flags);
3646+ amdgpu_userq_process_fence_irq(adev, doorbell_offset);
36563647 } else {
36573648 me_id = (entry->ring_id & 0x0c) >> 2;
36583649 pipe_id = (entry->ring_id & 0x03) >> 0;
drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c+66−0
@@ -1571,6 +1571,71 @@ static void gfx_v6_0_setup_spi(struct amdgpu_device *adev) · 1570 unmodified lines
15711571 mutex_unlock(&adev->grbm_idx_mutex);
15721572 }
15731573
1574+/**
1575+ * gfx_v6_0_setup_tcc() - setup which TCCs are used
1576+ *
1577+ * @adev: amdgpu_device pointer
1578+ *
1579+ * Verify whether the current GPU has any TCCs disabled,
1580+ * which can happen when the GPU is harvested and some
1581+ * memory channels are disabled, reducing the memory bus width.
1582+ * For example, on the Radeon HD 7870 XT (Tahiti LE).
1583+ *
1584+ * If some TCCs are disabled, we need to make sure that
1585+ * the disabled TCCs are not used, and the remaining TCCs
1586+ * are used optimally.
1587+ *
1588+ * TCP_CHAN_STEER_LO/HI control which TCC is used by TCP channels.
1589+ * TCP_ADDR_CONFIG.NUM_TCC_BANKS controls how many channels are used.
1590+ *
1591+ * For optimal performance:
1592+ * - Rely on the CHAN_STEER from the golden registers table,
1593+ * only skip disabled TCCs but keep the mapping order.
1594+ * - Limit NUM_TCC_BANKS to number of active TCCs to avoid thrashing,
1595+ * which performs better than using the same TCC twice.
1596+ */
1597+static void gfx_v6_0_setup_tcc(struct amdgpu_device *adev)
1598+{
1599+ u32 i, tcc, tcp_addr_config, num_active_tcc = 0;
1600+ u64 chan_steer, patched_chan_steer = 0;
1601+ const u32 num_max_tcc = adev->gfx.config.max_texture_channel_caches;
1602+ const u32 dis_tcc_mask =
1603+ amdgpu_gfx_create_bitmask(num_max_tcc) &
1604+ (REG_GET_FIELD(RREG32(mmCGTS_TCC_DISABLE),
1605+ CGTS_TCC_DISABLE, TCC_DISABLE) |
1606+ REG_GET_FIELD(RREG32(mmCGTS_USER_TCC_DISABLE),
1607+ CGTS_USER_TCC_DISABLE, TCC_DISABLE));
1608+
1609+ /* When no TCC is disabled, the golden registers table already has optimal TCC setup */
1610+ if (!dis_tcc_mask)
1611+ return;
1612+
1613+ /* Each 4-bit nibble contains the index of a TCC used by all TCPs */
1614+ chan_steer = RREG32(mmTCP_CHAN_STEER_LO) | ((u64)RREG32(mmTCP_CHAN_STEER_HI) << 32ull);
1615+
1616+ /* Patch the TCP to TCC mapping to skip disabled TCCs */
1617+ for (i = 0; i < num_max_tcc; ++i) {
1618+ tcc = (chan_steer >> (u64)(4 * i)) & 0xf;
1619+
1620+ if (!((1 << tcc) & dis_tcc_mask)) {
1621+ /* Copy enabled TCC indices to the patched register value. */
1622+ patched_chan_steer |= (u64)tcc << (u64)(4 * num_active_tcc);
1623+ ++num_active_tcc;
1624+ }
1625+ }
1626+
1627+ WARN_ON(num_active_tcc != num_max_tcc - hweight32(dis_tcc_mask));
1628+
1629+ /* Patch number of TCCs used by TCPs */
1630+ tcp_addr_config = REG_SET_FIELD(RREG32(mmTCP_ADDR_CONFIG),
1631+ TCP_ADDR_CONFIG, NUM_TCC_BANKS,
1632+ num_active_tcc - 1);
1633+
1634+ WREG32(mmTCP_ADDR_CONFIG, tcp_addr_config);
1635+ WREG32(mmTCP_CHAN_STEER_HI, upper_32_bits(patched_chan_steer));
1636+ WREG32(mmTCP_CHAN_STEER_LO, lower_32_bits(patched_chan_steer));
1637+}
1638+
15741639 static void gfx_v6_0_config_init(struct amdgpu_device *adev)
15751640 {
15761641 adev->gfx.config.double_offchip_lds_buf = 0;
@@ -1729,6 +1794,7 @@ static void gfx_v6_0_constants_init(struct amdgpu_device *adev) · 152 unmodified lines
17291794 gfx_v6_0_tiling_mode_table_init(adev);
17301795
17311796 gfx_v6_0_setup_rb(adev);
1797+ gfx_v6_0_setup_tcc(adev);
17321798
17331799 gfx_v6_0_setup_spi(adev);
17341800
drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.c+1−0
@@ -802,6 +802,7 @@ static const struct amd_ip_funcs jpeg_v2_0_ip_funcs = { · 801 unmodified lines
802802 static const struct amdgpu_ring_funcs jpeg_v2_0_dec_ring_vm_funcs = {
803803 .type = AMDGPU_RING_TYPE_VCN_JPEG,
804804 .align_mask = 0xf,
805+ .no_user_fence = true,
805806 .get_rptr = jpeg_v2_0_dec_ring_get_rptr,
806807 .get_wptr = jpeg_v2_0_dec_ring_get_wptr,
807808 .set_wptr = jpeg_v2_0_dec_ring_set_wptr,
drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c+2−0
@@ -693,6 +693,7 @@ static const struct amd_ip_funcs jpeg_v2_6_ip_funcs = { · 692 unmodified lines
693693 static const struct amdgpu_ring_funcs jpeg_v2_5_dec_ring_vm_funcs = {
694694 .type = AMDGPU_RING_TYPE_VCN_JPEG,
695695 .align_mask = 0xf,
696+ .no_user_fence = true,
696697 .get_rptr = jpeg_v2_5_dec_ring_get_rptr,
697698 .get_wptr = jpeg_v2_5_dec_ring_get_wptr,
698699 .set_wptr = jpeg_v2_5_dec_ring_set_wptr,
@@ -724,6 +725,7 @@ static const struct amdgpu_ring_funcs jpeg_v2_5_dec_ring_vm_funcs = { · 25 unmodified lines
724725 static const struct amdgpu_ring_funcs jpeg_v2_6_dec_ring_vm_funcs = {
725726 .type = AMDGPU_RING_TYPE_VCN_JPEG,
726727 .align_mask = 0xf,
728+ .no_user_fence = true,
727729 .get_rptr = jpeg_v2_5_dec_ring_get_rptr,
728730 .get_wptr = jpeg_v2_5_dec_ring_get_wptr,
729731 .set_wptr = jpeg_v2_5_dec_ring_set_wptr,
drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c+1−0
@@ -594,6 +594,7 @@ static const struct amd_ip_funcs jpeg_v3_0_ip_funcs = { · 593 unmodified lines
594594 static const struct amdgpu_ring_funcs jpeg_v3_0_dec_ring_vm_funcs = {
595595 .type = AMDGPU_RING_TYPE_VCN_JPEG,
596596 .align_mask = 0xf,
597+ .no_user_fence = true,
597598 .get_rptr = jpeg_v3_0_dec_ring_get_rptr,
598599 .get_wptr = jpeg_v3_0_dec_ring_get_wptr,
599600 .set_wptr = jpeg_v3_0_dec_ring_set_wptr,
drivers/gpu/drm/amd/amdgpu/jpeg_v4_0.c+1−0
@@ -759,6 +759,7 @@ static const struct amd_ip_funcs jpeg_v4_0_ip_funcs = { · 758 unmodified lines
759759 static const struct amdgpu_ring_funcs jpeg_v4_0_dec_ring_vm_funcs = {
760760 .type = AMDGPU_RING_TYPE_VCN_JPEG,
761761 .align_mask = 0xf,
762+ .no_user_fence = true,
762763 .get_rptr = jpeg_v4_0_dec_ring_get_rptr,
763764 .get_wptr = jpeg_v4_0_dec_ring_get_wptr,
764765 .set_wptr = jpeg_v4_0_dec_ring_set_wptr,
drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c+1−0
@@ -1219,6 +1219,7 @@ static const struct amd_ip_funcs jpeg_v4_0_3_ip_funcs = { · 1218 unmodified lines
12191219 static const struct amdgpu_ring_funcs jpeg_v4_0_3_dec_ring_vm_funcs = {
12201220 .type = AMDGPU_RING_TYPE_VCN_JPEG,
12211221 .align_mask = 0xf,
1222+ .no_user_fence = true,
12221223 .get_rptr = jpeg_v4_0_3_dec_ring_get_rptr,
12231224 .get_wptr = jpeg_v4_0_3_dec_ring_get_wptr,
12241225 .set_wptr = jpeg_v4_0_3_dec_ring_set_wptr,
drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_5.c+1−0
@@ -804,6 +804,7 @@ static const struct amd_ip_funcs jpeg_v4_0_5_ip_funcs = { · 803 unmodified lines
804804 static const struct amdgpu_ring_funcs jpeg_v4_0_5_dec_ring_vm_funcs = {
805805 .type = AMDGPU_RING_TYPE_VCN_JPEG,
806806 .align_mask = 0xf,
807+ .no_user_fence = true,
807808 .get_rptr = jpeg_v4_0_5_dec_ring_get_rptr,
808809 .get_wptr = jpeg_v4_0_5_dec_ring_get_wptr,
809810 .set_wptr = jpeg_v4_0_5_dec_ring_set_wptr,
drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_0.c+1−0
@@ -680,6 +680,7 @@ static const struct amd_ip_funcs jpeg_v5_0_0_ip_funcs = { · 679 unmodified lines
680680 static const struct amdgpu_ring_funcs jpeg_v5_0_0_dec_ring_vm_funcs = {
681681 .type = AMDGPU_RING_TYPE_VCN_JPEG,
682682 .align_mask = 0xf,
683+ .no_user_fence = true,
683684 .get_rptr = jpeg_v5_0_0_dec_ring_get_rptr,
684685 .get_wptr = jpeg_v5_0_0_dec_ring_get_wptr,
685686 .set_wptr = jpeg_v5_0_0_dec_ring_set_wptr,
drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c+1−0
@@ -884,6 +884,7 @@ static const struct amd_ip_funcs jpeg_v5_0_1_ip_funcs = { · 883 unmodified lines
884884 static const struct amdgpu_ring_funcs jpeg_v5_0_1_dec_ring_vm_funcs = {
885885 .type = AMDGPU_RING_TYPE_VCN_JPEG,
886886 .align_mask = 0xf,
887+ .no_user_fence = true,
887888 .get_rptr = jpeg_v5_0_1_dec_ring_get_rptr,
888889 .get_wptr = jpeg_v5_0_1_dec_ring_get_wptr,
889890 .set_wptr = jpeg_v5_0_1_dec_ring_set_wptr,
drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_2.c+1−0
@@ -703,6 +703,7 @@ static const struct amd_ip_funcs jpeg_v5_0_2_ip_funcs = { · 702 unmodified lines
703703 static const struct amdgpu_ring_funcs jpeg_v5_0_2_dec_ring_vm_funcs = {
704704 .type = AMDGPU_RING_TYPE_VCN_JPEG,
705705 .align_mask = 0xf,
706+ .no_user_fence = true,
706707 .get_rptr = jpeg_v5_0_2_dec_ring_get_rptr,
707708 .get_wptr = jpeg_v5_0_2_dec_ring_get_wptr,
708709 .set_wptr = jpeg_v5_0_2_dec_ring_set_wptr,
drivers/gpu/drm/amd/amdgpu/jpeg_v5_3_0.c+1−0
@@ -661,6 +661,7 @@ static const struct amd_ip_funcs jpeg_v5_3_0_ip_funcs = { · 660 unmodified lines
661661 static const struct amdgpu_ring_funcs jpeg_v5_3_0_dec_ring_vm_funcs = {
662662 .type = AMDGPU_RING_TYPE_VCN_JPEG,
663663 .align_mask = 0xf,
664+ .no_user_fence = true,
664665 .get_rptr = jpeg_v5_3_0_dec_ring_get_rptr,
665666 .get_wptr = jpeg_v5_3_0_dec_ring_get_wptr,
666667 .set_wptr = jpeg_v5_3_0_dec_ring_set_wptr,
drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c+1−10
@@ -1662,17 +1662,8 @@ static int sdma_v6_0_process_fence_irq(struct amdgpu_device *adev, · 1661 unmodified lines
16621662 u32 doorbell_offset = entry->src_data[0];
16631663
16641664 if (adev->enable_mes && doorbell_offset) {
1665− struct amdgpu_usermode_queue *queue;
1666− struct xarray *xa = &adev->userq_doorbell_xa;
1667− unsigned long flags;
1668−
16691665 doorbell_offset >>= SDMA0_QUEUE0_DOORBELL_OFFSET__OFFSET__SHIFT;
1670−
1671− xa_lock_irqsave(xa, flags);
1672− queue = xa_load(xa, doorbell_offset);
1673− if (queue)
1674− amdgpu_userq_fence_driver_process(queue->fence_drv);
1675− xa_unlock_irqrestore(xa, flags);
1666+ amdgpu_userq_process_fence_irq(adev, doorbell_offset);
16761667 }
16771668
16781669 return 0;
drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c+1−10
@@ -1594,17 +1594,8 @@ static int sdma_v7_0_process_fence_irq(struct amdgpu_device *adev, · 1593 unmodified lines
15941594 u32 doorbell_offset = entry->src_data[0];
15951595
15961596 if (adev->enable_mes && doorbell_offset) {
1597− struct xarray *xa = &adev->userq_doorbell_xa;
1598− struct amdgpu_usermode_queue *queue;
1599− unsigned long flags;
1600−
16011597 doorbell_offset >>= SDMA0_QUEUE0_DOORBELL_OFFSET__OFFSET__SHIFT;
1602−
1603− xa_lock_irqsave(xa, flags);
1604− queue = xa_load(xa, doorbell_offset);
1605− if (queue)
1606− amdgpu_userq_fence_driver_process(queue->fence_drv);
1607− xa_unlock_irqrestore(xa, flags);
1598+ amdgpu_userq_process_fence_irq(adev, doorbell_offset);
16081599 }
16091600
16101601 return 0;
drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c+10−0
@@ -242,6 +242,10 @@ static void uvd_v3_1_mc_resume(struct amdgpu_device *adev) · 241 unmodified lines
242242 uint64_t addr;
243243 uint32_t size;
244244
245+ /* When the keyselect is already set, don't perturb it. */
246+ if (RREG32(mmUVD_FW_START))
247+ return;
248+
245249 /* program the VCPU memory controller bits 0-27 */
246250 addr = (adev->uvd.inst->gpu_addr + AMDGPU_UVD_FIRMWARE_OFFSET) >> 3;
247251 size = AMDGPU_UVD_FIRMWARE_SIZE(adev) >> 3;
@@ -284,6 +288,12 @@ static int uvd_v3_1_fw_validate(struct amdgpu_device *adev) · 36 unmodified lines
284288 int i;
285289 uint32_t keysel = adev->uvd.keyselect;
286290
291+ if (RREG32(mmUVD_FW_START) & UVD_FW_STATUS__PASS_MASK) {
292+ dev_dbg(adev->dev, "UVD keyselect already set: 0x%x (on CPU: 0x%x)\n",
293+ RREG32(mmUVD_FW_START), adev->uvd.keyselect);
294+ return 0;
295+ }
296+
287297 WREG32(mmUVD_FW_START, keysel);
288298
289299 for (i = 0; i < 10; ++i) {
drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c+2−0
@@ -2113,6 +2113,7 @@ static const struct amd_ip_funcs vcn_v2_0_ip_funcs = { · 2112 unmodified lines
21132113 static const struct amdgpu_ring_funcs vcn_v2_0_dec_ring_vm_funcs = {
21142114 .type = AMDGPU_RING_TYPE_VCN_DEC,
21152115 .align_mask = 0xf,
2116+ .no_user_fence = true,
21162117 .secure_submission_supported = true,
21172118 .get_rptr = vcn_v2_0_dec_ring_get_rptr,
21182119 .get_wptr = vcn_v2_0_dec_ring_get_wptr,
@@ -2145,6 +2146,7 @@ static const struct amdgpu_ring_funcs vcn_v2_0_enc_ring_vm_funcs = { · 26 unmodified lines
21452146 .type = AMDGPU_RING_TYPE_VCN_ENC,
21462147 .align_mask = 0x3f,
21472148 .nop = VCN_ENC_CMD_NO_OP,
2149+ .no_user_fence = true,
21482150 .get_rptr = vcn_v2_0_enc_ring_get_rptr,
21492151 .get_wptr = vcn_v2_0_enc_ring_get_wptr,
21502152 .set_wptr = vcn_v2_0_enc_ring_set_wptr,
drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c+2−0
@@ -1778,6 +1778,7 @@ static void vcn_v2_5_dec_ring_set_wptr(struct amdgpu_ring *ring) · 1777 unmodified lines
17781778 static const struct amdgpu_ring_funcs vcn_v2_5_dec_ring_vm_funcs = {
17791779 .type = AMDGPU_RING_TYPE_VCN_DEC,
17801780 .align_mask = 0xf,
1781+ .no_user_fence = true,
17811782 .secure_submission_supported = true,
17821783 .get_rptr = vcn_v2_5_dec_ring_get_rptr,
17831784 .get_wptr = vcn_v2_5_dec_ring_get_wptr,
@@ -1879,6 +1880,7 @@ static const struct amdgpu_ring_funcs vcn_v2_5_enc_ring_vm_funcs = { · 95 unmodified lines
18791880 .type = AMDGPU_RING_TYPE_VCN_ENC,
18801881 .align_mask = 0x3f,
18811882 .nop = VCN_ENC_CMD_NO_OP,
1883+ .no_user_fence = true,
18821884 .get_rptr = vcn_v2_5_enc_ring_get_rptr,
18831885 .get_wptr = vcn_v2_5_enc_ring_get_wptr,
18841886 .set_wptr = vcn_v2_5_enc_ring_set_wptr,
drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c+6−1
@@ -1856,6 +1856,7 @@ static const struct amdgpu_ring_funcs vcn_v3_0_dec_sw_ring_vm_funcs = { · 1855 unmodified lines
18561856 .type = AMDGPU_RING_TYPE_VCN_DEC,
18571857 .align_mask = 0x3f,
18581858 .nop = VCN_DEC_SW_CMD_NO_OP,
1859+ .no_user_fence = true,
18591860 .secure_submission_supported = true,
18601861 .get_rptr = vcn_v3_0_dec_ring_get_rptr,
18611862 .get_wptr = vcn_v3_0_dec_ring_get_wptr,
@@ -1972,6 +1973,7 @@ static int vcn_v3_0_dec_msg(struct amdgpu_cs_parser *p, struct amdgpu_job *job, · 110 unmodified lines
19721973
19731974 for (i = 0, msg = &msg[6]; i < num_buffers; ++i, msg += 4) {
19741975 uint32_t offset, size, *create;
1976+ uint64_t buf_end;
19751977
19761978 if (msg[0] != RDECODE_MESSAGE_CREATE)
19771979 continue;
@@ -1979,7 +1981,8 @@ static int vcn_v3_0_dec_msg(struct amdgpu_cs_parser *p, struct amdgpu_job *job, · 1 unmodified line
19791981 offset = msg[1];
19801982 size = msg[2];
19811983
1982− if (size < 4 || offset + size > end - addr) {
1984+ if (size < 4 || check_add_overflow(offset, size, &buf_end) ||
1985+ buf_end > end - addr) {
19831986 DRM_ERROR("VCN message buffer exceeds BO bounds!\n");
19841987 r = -EINVAL;
19851988 goto out;
@@ -2036,6 +2039,7 @@ static int vcn_v3_0_ring_patch_cs_in_place(struct amdgpu_cs_parser *p, · 50 unmodified lines
20362039 static const struct amdgpu_ring_funcs vcn_v3_0_dec_ring_vm_funcs = {
20372040 .type = AMDGPU_RING_TYPE_VCN_DEC,
20382041 .align_mask = 0xf,
2042+ .no_user_fence = true,
20392043 .secure_submission_supported = true,
20402044 .get_rptr = vcn_v3_0_dec_ring_get_rptr,
20412045 .get_wptr = vcn_v3_0_dec_ring_get_wptr,
@@ -2138,6 +2142,7 @@ static const struct amdgpu_ring_funcs vcn_v3_0_enc_ring_vm_funcs = { · 96 unmodified lines
21382142 .type = AMDGPU_RING_TYPE_VCN_ENC,
21392143 .align_mask = 0x3f,
21402144 .nop = VCN_ENC_CMD_NO_OP,
2145+ .no_user_fence = true,
21412146 .get_rptr = vcn_v3_0_enc_ring_get_rptr,
21422147 .get_wptr = vcn_v3_0_enc_ring_get_wptr,
21432148 .set_wptr = vcn_v3_0_enc_ring_set_wptr,
drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c+4−1
@@ -1889,6 +1889,7 @@ static int vcn_v4_0_dec_msg(struct amdgpu_cs_parser *p, struct amdgpu_job *job, · 1888 unmodified lines
18891889
18901890 for (i = 0, msg = &msg[6]; i < num_buffers; ++i, msg += 4) {
18911891 uint32_t offset, size, *create;
1892+ uint64_t buf_end;
18921893
18931894 if (msg[0] != RDECODE_MESSAGE_CREATE)
18941895 continue;
@@ -1896,7 +1897,8 @@ static int vcn_v4_0_dec_msg(struct amdgpu_cs_parser *p, struct amdgpu_job *job, · 1 unmodified line
18961897 offset = msg[1];
18971898 size = msg[2];
18981899
1899− if (size < 4 || offset + size > end - addr) {
1900+ if (size < 4 || check_add_overflow(offset, size, &buf_end) ||
1901+ buf_end > end - addr) {
19001902 DRM_ERROR("VCN message buffer exceeds BO bounds!\n");
19011903 r = -EINVAL;
19021904 goto out;
@@ -1994,6 +1996,7 @@ static struct amdgpu_ring_funcs vcn_v4_0_unified_ring_vm_funcs = { · 91 unmodified lines
19941996 .type = AMDGPU_RING_TYPE_VCN_ENC,
19951997 .align_mask = 0x3f,
19961998 .nop = VCN_ENC_CMD_NO_OP,
1999+ .no_user_fence = true,
19972000 .extra_bytes = sizeof(struct amdgpu_vcn_rb_metadata),
19982001 .get_rptr = vcn_v4_0_unified_ring_get_rptr,
19992002 .get_wptr = vcn_v4_0_unified_ring_get_wptr,
drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c+1−0
@@ -1775,6 +1775,7 @@ static const struct amdgpu_ring_funcs vcn_v4_0_3_unified_ring_vm_funcs = { · 1774 unmodified lines
17751775 .type = AMDGPU_RING_TYPE_VCN_ENC,
17761776 .align_mask = 0x3f,
17771777 .nop = VCN_ENC_CMD_NO_OP,
1778+ .no_user_fence = true,
17781779 .get_rptr = vcn_v4_0_3_unified_ring_get_rptr,
17791780 .get_wptr = vcn_v4_0_3_unified_ring_get_wptr,
17801781 .set_wptr = vcn_v4_0_3_unified_ring_set_wptr,
drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c+1−0
@@ -1483,6 +1483,7 @@ static struct amdgpu_ring_funcs vcn_v4_0_5_unified_ring_vm_funcs = { · 1482 unmodified lines
14831483 .type = AMDGPU_RING_TYPE_VCN_ENC,
14841484 .align_mask = 0x3f,
14851485 .nop = VCN_ENC_CMD_NO_OP,
1486+ .no_user_fence = true,
14861487 .get_rptr = vcn_v4_0_5_unified_ring_get_rptr,
14871488 .get_wptr = vcn_v4_0_5_unified_ring_get_wptr,
14881489 .set_wptr = vcn_v4_0_5_unified_ring_set_wptr,
drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c+1−0
@@ -1207,6 +1207,7 @@ static const struct amdgpu_ring_funcs vcn_v5_0_0_unified_ring_vm_funcs = { · 1206 unmodified lines
12071207 .type = AMDGPU_RING_TYPE_VCN_ENC,
12081208 .align_mask = 0x3f,
12091209 .nop = VCN_ENC_CMD_NO_OP,
1210+ .no_user_fence = true,
12101211 .get_rptr = vcn_v5_0_0_unified_ring_get_rptr,
12111212 .get_wptr = vcn_v5_0_0_unified_ring_get_wptr,
12121213 .set_wptr = vcn_v5_0_0_unified_ring_set_wptr,
drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c+1−0
@@ -1419,6 +1419,7 @@ static const struct amdgpu_ring_funcs vcn_v5_0_1_unified_ring_vm_funcs = { · 1418 unmodified lines
14191419 .type = AMDGPU_RING_TYPE_VCN_ENC,
14201420 .align_mask = 0x3f,
14211421 .nop = VCN_ENC_CMD_NO_OP,
1422+ .no_user_fence = true,
14221423 .get_rptr = vcn_v5_0_1_unified_ring_get_rptr,
14231424 .get_wptr = vcn_v5_0_1_unified_ring_get_wptr,
14241425 .set_wptr = vcn_v5_0_1_unified_ring_set_wptr,
drivers/gpu/drm/amd/amdgpu/vcn_v5_0_2.c+1−0
@@ -994,6 +994,7 @@ static const struct amdgpu_ring_funcs vcn_v5_0_2_unified_ring_vm_funcs = { · 993 unmodified lines
994994 .type = AMDGPU_RING_TYPE_VCN_ENC,
995995 .align_mask = 0x3f,
996996 .nop = VCN_ENC_CMD_NO_OP,
997+ .no_user_fence = true,
997998 .get_rptr = vcn_v5_0_2_unified_ring_get_rptr,
998999 .get_wptr = vcn_v5_0_2_unified_ring_get_wptr,
9991000 .set_wptr = vcn_v5_0_2_unified_ring_set_wptr,
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c+24−2
@@ -25,6 +25,7 @@ · 24 unmodified lines
2525 #include <linux/err.h>
2626 #include <linux/fs.h>
2727 #include <linux/file.h>
28+#include <linux/overflow.h>
2829 #include <linux/sched.h>
2930 #include <linux/slab.h>
3031 #include <linux/uaccess.h>
@@ -1695,6 +1696,16 @@ static int kfd_ioctl_smi_events(struct file *filep, · 1664 unmodified lines
16951696 return kfd_smi_event_open(pdd->dev, &args->anon_fd);
16961697 }
16971698
1699+static int kfd_ioctl_svm_validate(void *kdata, unsigned int usize)
1700+{
1701+ struct kfd_ioctl_svm_args *args = kdata;
1702+ size_t expected = struct_size(args, attrs, args->nattr);
1703+
1704+ if (expected == SIZE_MAX || usize < expected)
1705+ return -EINVAL;
1706+ return 0;
1707+}
1708+
16981709 #if IS_ENABLED(CONFIG_HSA_AMD_SVM)
16991710
17001711 static int kfd_ioctl_set_xnack_mode(struct file *filep,
@@ -3209,7 +3220,11 @@ static int kfd_ioctl_create_process(struct file *filep, struct kfd_process *p, v · 1508 unmodified lines
32093220
32103221 #define AMDKFD_IOCTL_DEF(ioctl, _func, _flags) \
32113222 [_IOC_NR(ioctl)] = {.cmd = ioctl, .func = _func, .flags = _flags, \
3212− .cmd_drv = 0, .name = #ioctl}
3223+ .validate = NULL, .cmd_drv = 0, .name = #ioctl}
3224+
3225+#define AMDKFD_IOCTL_DEF_V(ioctl, _func, _validate, _flags) \
3226+ [_IOC_NR(ioctl)] = {.cmd = ioctl, .func = _func, .flags = _flags, \
3227+ .validate = _validate, .cmd_drv = 0, .name = #ioctl}
32133228
32143229 /** Ioctl table */
32153230 static const struct amdkfd_ioctl_desc amdkfd_ioctls[] = {
@@ -3306,7 +3321,8 @@ static const struct amdkfd_ioctl_desc amdkfd_ioctls[] = { · 90 unmodified lines
33063321 AMDKFD_IOCTL_DEF(AMDKFD_IOC_SMI_EVENTS,
33073322 kfd_ioctl_smi_events, 0),
33083323
3309− AMDKFD_IOCTL_DEF(AMDKFD_IOC_SVM, kfd_ioctl_svm, 0),
3324+ AMDKFD_IOCTL_DEF_V(AMDKFD_IOC_SVM, kfd_ioctl_svm,
3325+ kfd_ioctl_svm_validate, 0),
33103326
33113327 AMDKFD_IOCTL_DEF(AMDKFD_IOC_SET_XNACK_MODE,
33123328 kfd_ioctl_set_xnack_mode, 0),
@@ -3431,6 +3447,12 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg) · 118 unmodified lines
34313447 memset(kdata, 0, usize);
34323448 }
34333449
3450+ if (ioctl->validate) {
3451+ retcode = ioctl->validate(kdata, usize);
3452+ if (retcode)
3453+ goto err_i1;
3454+ }
3455+
34343456 retcode = func(filep, process, kdata);
34353457
34363458 if (cmd & IOC_OUT)
drivers/gpu/drm/amd/amdkfd/kfd_priv.h+3−0
@@ -1047,10 +1047,13 @@ extern struct srcu_struct kfd_processes_srcu; · 1046 unmodified lines
10471047 typedef int amdkfd_ioctl_t(struct file *filep, struct kfd_process *p,
10481048 void *data);
10491049
1050+typedef int amdkfd_ioctl_validate_t(void *kdata, unsigned int usize);
1051+
10501052 struct amdkfd_ioctl_desc {
10511053 unsigned int cmd;
10521054 int flags;
10531055 amdkfd_ioctl_t *func;
1056+ amdkfd_ioctl_validate_t *validate;
10541057 unsigned int cmd_drv;
10551058 const char *name;
10561059 };
drivers/gpu/drm/amd/amdkfd/kfd_svm.c+11−0
@@ -1366,6 +1366,12 @@ svm_range_unmap_from_gpu(struct amdgpu_device *adev, struct amdgpu_vm *vm, · 1365 unmodified lines
13661366
13671367 pr_debug("CPU[0x%llx 0x%llx] -> GPU[0x%llx 0x%llx]\n", start, last,
13681368 gpu_start, gpu_end);
1369+
1370+ if (!amdgpu_vm_ready(vm)) {
1371+ pr_debug("VM not ready, canceling unmap\n");
1372+ return -EINVAL;
1373+ }
1374+
13691375 return amdgpu_vm_update_range(adev, vm, false, true, true, false, NULL, gpu_start,
13701376 gpu_end, init_pte_value, 0, 0, NULL, NULL,
13711377 fence);
@@ -1443,6 +1449,11 @@ svm_range_map_to_gpu(struct kfd_process_device *pdd, struct svm_range *prange, · 71 unmodified lines
14431449 pr_debug("svms 0x%p [0x%lx 0x%lx] readonly %d\n", prange->svms,
14441450 last_start, last_start + npages - 1, readonly);
14451451
1452+ if (!amdgpu_vm_ready(vm)) {
1453+ pr_debug("VM not ready, canceling map\n");
1454+ return -EINVAL;
1455+ }
1456+
14461457 for (i = offset; i < offset + npages; i++) {
14471458 uint64_t gpu_start;
14481459 uint64_t gpu_end;
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c+20−4
@@ -1903,7 +1903,11 @@ static int amdgpu_dm_init(struct amdgpu_device *adev) · 1902 unmodified lines
19031903 goto error;
19041904 }
19051905
1906− init_data.asic_id.chip_family = adev->family;
1906+ /* special handling for early revisions of GC 11.5.4 */
1907+ if (amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(11, 5, 4))
1908+ init_data.asic_id.chip_family = AMDGPU_FAMILY_GC_11_5_4;
1909+ else
1910+ init_data.asic_id.chip_family = adev->family;
19071911
19081912 init_data.asic_id.pci_revision_id = adev->pdev->revision;
19091913 init_data.asic_id.hw_internal_rev = adev->external_rev_id;
@@ -9404,9 +9408,21 @@ static void manage_dm_interrupts(struct amdgpu_device *adev, · 7494 unmodified lines
94049408 if (acrtc_state) {
94059409 timing = &acrtc_state->stream->timing;
94069410
9407− if (amdgpu_ip_version(adev, DCE_HWIP, 0) <
9408− IP_VERSION(3, 5, 0) ||
9409− !(adev->flags & AMD_IS_APU)) {
9411+ if (amdgpu_ip_version(adev, DCE_HWIP, 0) >=
9412+ IP_VERSION(3, 2, 0) &&
9413+ !(adev->flags & AMD_IS_APU)) {
9414+ /*
9415+ * DGPUs NV3x and newer that support idle optimizations
9416+ * experience intermittent flip-done timeouts on cursor
9417+ * updates. Restore 5s offdelay behavior for now.
9418+ *
9419+ * Discussion on the issue:
9420+ * https://lore.kernel.org/amd-gfx/20260217191632.1243826-1-sysdadmin@m1k.cloud/
9421+ */
9422+ config.offdelay_ms = 5000;
9423+ config.disable_immediate = false;
9424+ } else if (amdgpu_ip_version(adev, DCE_HWIP, 0) <
9425+ IP_VERSION(3, 5, 0)) {
94109426 /*
94119427 * Older HW and DGPU have issues with instant off;
94129428 * use a 2 frame offdelay.
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c+44−0
@@ -1032,6 +1032,45 @@ dm_helpers_read_acpi_edid(struct amdgpu_dm_connector *aconnector) · 1031 unmodified lines
10321032 return drm_edid_read_custom(connector, dm_helpers_probe_acpi_edid, connector);
10331033 }
10341034
1035+static const struct drm_edid *
1036+dm_helpers_read_vbios_hardcoded_edid(struct dc_link *link, struct amdgpu_dm_connector *aconnector)
1037+{
1038+ struct dc_bios *bios = link->ctx->dc_bios;
1039+ struct embedded_panel_info info;
1040+ const struct drm_edid *edid;
1041+ enum bp_result r;
1042+
1043+ if (!dc_is_embedded_signal(link->connector_signal) ||
1044+ !bios->funcs->get_embedded_panel_info)
1045+ return NULL;
1046+
1047+ memset(&info, 0, sizeof(info));
1048+ r = bios->funcs->get_embedded_panel_info(bios, &info);
1049+
1050+ if (r != BP_RESULT_OK) {
1051+ dm_error("Error when reading embedded panel info: %u\n", r);
1052+ return NULL;
1053+ }
1054+
1055+ if (!info.fake_edid || !info.fake_edid_size) {
1056+ dm_error("Embedded panel info doesn't contain an EDID\n");
1057+ return NULL;
1058+ }
1059+
1060+ edid = drm_edid_alloc(info.fake_edid, info.fake_edid_size);
1061+
1062+ if (!drm_edid_valid(edid)) {
1063+ dm_error("EDID from embedded panel info is invalid\n");
1064+ drm_edid_free(edid);
1065+ return NULL;
1066+ }
1067+
1068+ aconnector->base.display_info.width_mm = info.panel_width_mm;
1069+ aconnector->base.display_info.height_mm = info.panel_height_mm;
1070+
1071+ return edid;
1072+}
1073+
10351074 void populate_hdmi_info_from_connector(struct drm_hdmi_info *hdmi, struct dc_edid_caps *edid_caps)
10361075 {
10371076 edid_caps->scdc_present = hdmi->scdc.supported;
@@ -1052,6 +1091,9 @@ enum dc_edid_status dm_helpers_read_local_edid( · 14 unmodified lines
10521091
10531092 if (link->aux_mode)
10541093 ddc = &aconnector->dm_dp_aux.aux.ddc;
1094+ else if (link->ddc_hw_inst == GPIO_DDC_LINE_UNKNOWN &&
1095+ dc_is_embedded_signal(link->connector_signal))
1096+ ddc = NULL;
10551097 else
10561098 ddc = &aconnector->i2c->base;
10571099
@@ -1065,6 +1107,8 @@ enum dc_edid_status dm_helpers_read_local_edid( · 7 unmodified lines
10651107 drm_edid = dm_helpers_read_acpi_edid(aconnector);
10661108 if (drm_edid)
10671109 drm_info(connector->dev, "Using ACPI provided EDID for %s\n", connector->name);
1110+ else if (!ddc)
1111+ drm_edid = dm_helpers_read_vbios_hardcoded_edid(link, aconnector);
10681112 else
10691113 drm_edid = drm_edid_read_ddc(connector, ddc);
10701114 drm_edid_connector_update(connector, drm_edid);
drivers/gpu/drm/amd/display/dc/bios/bios_parser.c+72−1
@@ -794,11 +794,13 @@ static enum bp_result bios_parser_external_encoder_control( · 793 unmodified lines
794794
795795 static enum bp_result bios_parser_dac_load_detection(
796796 struct dc_bios *dcb,
797− enum engine_id engine_id)
797+ enum engine_id engine_id,
798+ struct graphics_object_id ext_enc_id)
798799 {
799800 struct bios_parser *bp = BP_FROM_DCB(dcb);
800801 struct dc_context *ctx = dcb->ctx;
801802 struct bp_load_detection_parameters bp_params = {0};
803+ struct bp_external_encoder_control ext_cntl = {0};
802804 enum bp_result bp_result = BP_RESULT_UNSUPPORTED;
803805 uint32_t bios_0_scratch;
804806 uint32_t device_id_mask = 0;
@@ -824,6 +826,13 @@ static enum bp_result bios_parser_dac_load_detection( · 19 unmodified lines
824826
825827 bp_params.engine_id = engine_id;
826828 bp_result = bp->cmd_tbl.dac_load_detection(bp, &bp_params);
829+ } else if (ext_enc_id.id) {
830+ if (!bp->cmd_tbl.external_encoder_control)
831+ return BP_RESULT_UNSUPPORTED;
832+
833+ ext_cntl.action = EXTERNAL_ENCODER_CONTROL_DAC_LOAD_DETECT;
834+ ext_cntl.encoder_id = ext_enc_id;
835+ bp_result = bp->cmd_tbl.external_encoder_control(bp, &ext_cntl);
827836 }
828837
829838 if (bp_result != BP_RESULT_OK)
@@ -1304,6 +1313,60 @@ static enum bp_result bios_parser_get_embedded_panel_info( · 474 unmodified lines
13041313 return BP_RESULT_FAILURE;
13051314 }
13061315
1316+static enum bp_result get_embedded_panel_extra_info(
1317+ struct bios_parser *bp,
1318+ struct embedded_panel_info *info,
1319+ const uint32_t table_offset)
1320+{
1321+ uint8_t *record = bios_get_image(&bp->base, table_offset, 1);
1322+ ATOM_PANEL_RESOLUTION_PATCH_RECORD *panel_res_record;
1323+ ATOM_FAKE_EDID_PATCH_RECORD *fake_edid_record;
1324+
1325+ while (*record != ATOM_RECORD_END_TYPE) {
1326+ switch (*record) {
1327+ case LCD_MODE_PATCH_RECORD_MODE_TYPE:
1328+ record += sizeof(ATOM_PATCH_RECORD_MODE);
1329+ break;
1330+ case LCD_RTS_RECORD_TYPE:
1331+ record += sizeof(ATOM_LCD_RTS_RECORD);
1332+ break;
1333+ case LCD_CAP_RECORD_TYPE:
1334+ record += sizeof(ATOM_LCD_MODE_CONTROL_CAP);
1335+ break;
1336+ case LCD_FAKE_EDID_PATCH_RECORD_TYPE:
1337+ fake_edid_record = (ATOM_FAKE_EDID_PATCH_RECORD *)record;
1338+ if (fake_edid_record->ucFakeEDIDLength) {
1339+ if (fake_edid_record->ucFakeEDIDLength == 128)
1340+ info->fake_edid_size =
1341+ fake_edid_record->ucFakeEDIDLength;
1342+ else
1343+ info->fake_edid_size =
1344+ fake_edid_record->ucFakeEDIDLength * 128;
1345+
1346+ info->fake_edid = fake_edid_record->ucFakeEDIDString;
1347+
1348+ record += struct_size(fake_edid_record,
1349+ ucFakeEDIDString,
1350+ info->fake_edid_size);
1351+ } else {
1352+ /* empty fake edid record must be 3 bytes long */
1353+ record += sizeof(ATOM_FAKE_EDID_PATCH_RECORD) + 1;
1354+ }
1355+ break;
1356+ case LCD_PANEL_RESOLUTION_RECORD_TYPE:
1357+ panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
1358+ info->panel_width_mm = panel_res_record->usHSize;
1359+ info->panel_height_mm = panel_res_record->usVSize;
1360+ record += sizeof(ATOM_PANEL_RESOLUTION_PATCH_RECORD);
1361+ break;
1362+ default:
1363+ return BP_RESULT_BADBIOSTABLE;
1364+ }
1365+ }
1366+
1367+ return BP_RESULT_OK;
1368+}
1369+
13071370 static enum bp_result get_embedded_panel_info_v1_2(
13081371 struct bios_parser *bp,
13091372 struct embedded_panel_info *info)
@@ -1420,6 +1483,10 @@ static enum bp_result get_embedded_panel_info_v1_2( · 110 unmodified lines
14201483 if (ATOM_PANEL_MISC_API_ENABLED & lvds->ucLVDS_Misc)
14211484 info->lcd_timing.misc_info.API_ENABLED = true;
14221485
1486+ if (lvds->usExtInfoTableOffset)
1487+ return get_embedded_panel_extra_info(bp, info,
1488+ le16_to_cpu(lvds->usExtInfoTableOffset) + DATA_TABLES(LCD_Info));
1489+
14231490 return BP_RESULT_OK;
14241491 }
14251492
@@ -1545,6 +1612,10 @@ static enum bp_result get_embedded_panel_info_v1_3( · 119 unmodified lines
15451612 (uint32_t) (ATOM_PANEL_MISC_V13_GREY_LEVEL &
15461613 lvds->ucLCD_Misc) >> ATOM_PANEL_MISC_V13_GREY_LEVEL_SHIFT;
15471614
1615+ if (lvds->usExtInfoTableOffset)
1616+ return get_embedded_panel_extra_info(bp, info,
1617+ le16_to_cpu(lvds->usExtInfoTableOffset) + DATA_TABLES(LCD_Info));
1618+
15481619 return BP_RESULT_OK;
15491620 }
15501621
drivers/gpu/drm/amd/display/dc/dc.h+1−1
@@ -1682,7 +1682,7 @@ struct dc_scratch_space { · 1681 unmodified lines
16821682 struct dc_link_training_overrides preferred_training_settings;
16831683 struct dp_audio_test_data audio_test_data;
16841684
1685− uint8_t ddc_hw_inst;
1685+ enum gpio_ddc_line ddc_hw_inst;
16861686
16871687 uint8_t hpd_src;
16881688
drivers/gpu/drm/amd/display/dc/dc_bios_types.h+2−1
@@ -102,7 +102,8 @@ struct dc_vbios_funcs { · 101 unmodified lines
102102 struct bp_external_encoder_control *cntl);
103103 enum bp_result (*dac_load_detection)(
104104 struct dc_bios *bios,
105− enum engine_id engine_id);
105+ enum engine_id engine_id,
106+ struct graphics_object_id ext_enc_id);
106107 enum bp_result (*transmitter_control)(
107108 struct dc_bios *bios,
108109 struct bp_transmitter_control *cntl);
drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c+3−1
@@ -1102,7 +1102,9 @@ void dce110_link_encoder_hw_init( · 1101 unmodified lines
11021102 ASSERT(result == BP_RESULT_OK);
11031103
11041104 }
1105− aux_initialize(enc110);
1105+
1106+ if (enc110->aux_regs)
1107+ aux_initialize(enc110);
11061108
11071109 /* reinitialize HPD.
11081110 * hpd_initialize() will pass DIG_FE id to HW context.
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_mmhubbub.c+2−2
@@ -40,8 +40,8 @@ · 39 unmodified lines
4040 #define FN(reg_name, field_name) \
4141 mcif_wb30->mcif_wb_shift->field_name, mcif_wb30->mcif_wb_mask->field_name
4242
43−#define MCIF_ADDR(addr) (((unsigned long long)addr & 0xffffffffff) + 0xFE) >> 8
44−#define MCIF_ADDR_HIGH(addr) (unsigned long long)addr >> 40
43+#define MCIF_ADDR(addr) ((uint32_t)((((unsigned long long)(addr) & 0xffffffffffULL) + 0xFEULL) >> 8))
44+#define MCIF_ADDR_HIGH(addr) ((uint32_t)(((unsigned long long)(addr)) >> 40))
4545
4646 /* wbif programming guide:
4747 * 1. set up wbif parameter:
drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c+3−0
@@ -646,6 +646,9 @@ failure: · 645 unmodified lines
646646 enum gpio_ddc_line dal_ddc_get_line(
647647 const struct ddc *ddc)
648648 {
649+ if (!ddc)
650+ return GPIO_DDC_LINE_UNKNOWN;
651+
649652 return (enum gpio_ddc_line)dal_gpio_get_enum(ddc->pin_data);
650653 }
651654
drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c+59−35
@@ -665,16 +665,45 @@ void dce110_update_info_frame(struct pipe_ctx *pipe_ctx) · 664 unmodified lines
665665 }
666666
667667 static void
668−dce110_dac_encoder_control(struct pipe_ctx *pipe_ctx, bool enable)
668+dce110_external_encoder_control(enum bp_external_encoder_control_action action,
669+ struct dc_link *link,
670+ struct dc_crtc_timing *timing)
669671 {
670− struct dc_link *link = pipe_ctx->stream->link;
672+ struct dc *dc = link->ctx->dc;
671673 struct dc_bios *bios = link->ctx->dc_bios;
672− struct bp_encoder_control encoder_control = {0};
674+ const struct dc_link_settings *link_settings = &link->cur_link_settings;
675+ enum bp_result bp_result = BP_RESULT_OK;
676+ struct bp_external_encoder_control ext_cntl = {
677+ .action = action,
678+ .connector_obj_id = link->link_enc->connector,
679+ .encoder_id = link->ext_enc_id,
680+ .lanes_number = link_settings->lane_count,
681+ .link_rate = link_settings->link_rate,
682+
683+ /* Use signal type of the real link encoder, ie. DP */
684+ .signal = link->connector_signal,
685+
686+ /* We don't know the timing yet when executing the SETUP action,
687+ * so use a reasonably high default value. It seems that ENABLE
688+ * can change the actual pixel clock but doesn't work with higher
689+ * pixel clocks than what SETUP was called with.
690+ */
691+ .pixel_clock = timing ? timing->pix_clk_100hz / 10 : 300000,
692+ .color_depth = timing ? timing->display_color_depth : COLOR_DEPTH_888,
693+ };
694+ DC_LOGGER_INIT(dc->ctx);
673695
674− encoder_control.action = enable ? ENCODER_CONTROL_ENABLE : ENCODER_CONTROL_DISABLE;
675− encoder_control.engine_id = link->link_enc->analog_engine;
676− encoder_control.pixel_clock = pipe_ctx->stream->timing.pix_clk_100hz / 10;
677− bios->funcs->encoder_control(bios, &encoder_control);
696+ bp_result = bios->funcs->external_encoder_control(bios, &ext_cntl);
697+
698+ if (bp_result != BP_RESULT_OK)
699+ DC_LOG_ERROR("Failed to execute external encoder action: 0x%x\n", action);
700+}
701+
702+static void
703+dce110_prepare_ddc(struct dc_link *link)
704+{
705+ if (link->ext_enc_id.id)
706+ dce110_external_encoder_control(EXTERNAL_ENCODER_CONTROL_DDC_SETUP, link, NULL);
678707 }
679708
680709 static bool
@@ -684,7 +713,8 @@ dce110_dac_load_detect(struct dc_link *link) · 3 unmodified lines
684713 struct link_encoder *link_enc = link->link_enc;
685714 enum bp_result bp_result;
686715
687− bp_result = bios->funcs->dac_load_detection(bios, link_enc->analog_engine);
716+ bp_result = bios->funcs->dac_load_detection(
717+ bios, link_enc->analog_engine, link->ext_enc_id);
688718 return bp_result == BP_RESULT_OK;
689719 }
690720
@@ -700,7 +730,6 @@ void dce110_enable_stream(struct pipe_ctx *pipe_ctx) · 9 unmodified lines
700730 uint32_t early_control = 0;
701731 struct timing_generator *tg = pipe_ctx->stream_res.tg;
702732
703− link_hwss->setup_stream_attribute(pipe_ctx);
704733 link_hwss->setup_stream_encoder(pipe_ctx);
705734
706735 dc->hwss.update_info_frame(pipe_ctx);
@@ -719,8 +748,8 @@ void dce110_enable_stream(struct pipe_ctx *pipe_ctx) · 12 unmodified lines
719748
720749 tg->funcs->set_early_control(tg, early_control);
721750
722− if (dc_is_rgb_signal(pipe_ctx->stream->signal))
723− dce110_dac_encoder_control(pipe_ctx, true);
751+ if (link->ext_enc_id.id)
752+ dce110_external_encoder_control(EXTERNAL_ENCODER_CONTROL_ENABLE, link, timing);
724753 }
725754
726755 static enum bp_result link_transmitter_control(
@@ -1219,8 +1248,8 @@ void dce110_disable_stream(struct pipe_ctx *pipe_ctx) · 492 unmodified lines
12191248 link_enc->transmitter - TRANSMITTER_UNIPHY_A);
12201249 }
12211250
1222− if (dc_is_rgb_signal(pipe_ctx->stream->signal))
1223− dce110_dac_encoder_control(pipe_ctx, false);
1251+ if (link->ext_enc_id.id)
1252+ dce110_external_encoder_control(EXTERNAL_ENCODER_CONTROL_DISABLE, link, NULL);
12241253 }
12251254
12261255 void dce110_unblank_stream(struct pipe_ctx *pipe_ctx,
@@ -1603,22 +1632,6 @@ static enum dc_status dce110_enable_stream_timing( · 376 unmodified lines
16031632
16041633 return DC_OK;
16051634 }
1606−static void
1607−dce110_select_crtc_source(struct pipe_ctx *pipe_ctx)
1608−{
1609− struct dc_link *link = pipe_ctx->stream->link;
1610− struct dc_bios *bios = link->ctx->dc_bios;
1611− struct bp_crtc_source_select crtc_source_select = {0};
1612− enum engine_id engine_id = link->link_enc->preferred_engine;
1613−
1614− if (dc_is_rgb_signal(pipe_ctx->stream->signal))
1615− engine_id = link->link_enc->analog_engine;
1616− crtc_source_select.controller_id = CONTROLLER_ID_D0 + pipe_ctx->stream_res.tg->inst;
1617− crtc_source_select.color_depth = pipe_ctx->stream->timing.display_color_depth;
1618− crtc_source_select.engine_id = engine_id;
1619− crtc_source_select.sink_signal = pipe_ctx->stream->signal;
1620− bios->funcs->select_crtc_source(bios, &crtc_source_select);
1621−}
16221635
16231636 enum dc_status dce110_apply_single_controller_ctx_to_hw(
16241637 struct pipe_ctx *pipe_ctx,
@@ -1639,10 +1652,6 @@ enum dc_status dce110_apply_single_controller_ctx_to_hw( · 14 unmodified lines
16391652 hws->funcs.disable_stream_gating(dc, pipe_ctx);
16401653 }
16411654
1642− if (pipe_ctx->stream->signal == SIGNAL_TYPE_RGB) {
1643− dce110_select_crtc_source(pipe_ctx);
1644− }
1645−
16461655 if (pipe_ctx->stream_res.audio != NULL) {
16471656 struct audio_output audio_output = {0};
16481657
@@ -1722,8 +1731,7 @@ enum dc_status dce110_apply_single_controller_ctx_to_hw( · 73 unmodified lines
17221731 pipe_ctx->stream_res.tg->funcs->set_static_screen_control(
17231732 pipe_ctx->stream_res.tg, event_triggers, 2);
17241733
1725− if (!dc_is_virtual_signal(pipe_ctx->stream->signal) &&
1726− !dc_is_rgb_signal(pipe_ctx->stream->signal))
1734+ if (!dc_is_virtual_signal(pipe_ctx->stream->signal))
17271735 pipe_ctx->stream_res.stream_enc->funcs->dig_connect_to_otg(
17281736 pipe_ctx->stream_res.stream_enc,
17291737 pipe_ctx->stream_res.tg->inst);
@@ -3376,6 +3384,15 @@ void dce110_enable_tmds_link_output(struct dc_link *link, · 1646 unmodified lines
33763384 link->phy_state.symclk_state = SYMCLK_ON_TX_ON;
33773385 }
33783386
3387+static void dce110_enable_analog_link_output(
3388+ struct dc_link *link,
3389+ uint32_t pix_clk_100hz)
3390+{
3391+ link->link_enc->funcs->enable_analog_output(
3392+ link->link_enc,
3393+ pix_clk_100hz);
3394+}
3395+
33793396 void dce110_enable_dp_link_output(
33803397 struct dc_link *link,
33813398 const struct link_resource *link_res,
@@ -3423,6 +3440,11 @@ void dce110_enable_dp_link_output( · 41 unmodified lines
34233440 }
34243441 }
34253442
3443+ if (link->ext_enc_id.id) {
3444+ dce110_external_encoder_control(EXTERNAL_ENCODER_CONTROL_INIT, link, NULL);
3445+ dce110_external_encoder_control(EXTERNAL_ENCODER_CONTROL_SETUP, link, NULL);
3446+ }
3447+
34263448 if (dc->link_srv->dp_get_encoding_format(link_settings) == DP_8b_10b_ENCODING) {
34273449 if (dc->clk_mgr->funcs->notify_link_rate_change)
34283450 dc->clk_mgr->funcs->notify_link_rate_change(dc->clk_mgr, link);
@@ -3513,8 +3535,10 @@ static const struct hw_sequencer_funcs dce110_funcs = { · 84 unmodified lines
35133535 .enable_lvds_link_output = dce110_enable_lvds_link_output,
35143536 .enable_tmds_link_output = dce110_enable_tmds_link_output,
35153537 .enable_dp_link_output = dce110_enable_dp_link_output,
3538+ .enable_analog_link_output = dce110_enable_analog_link_output,
35163539 .disable_link_output = dce110_disable_link_output,
35173540 .dac_load_detect = dce110_dac_load_detect,
3541+ .prepare_ddc = dce110_prepare_ddc,
35183542 };
35193543
35203544 static const struct hwseq_private_funcs dce110_private_funcs = {
drivers/gpu/drm/amd/display/dc/link/link_factory.c+3−1
@@ -568,7 +568,9 @@ static bool construct_phy(struct dc_link *link, · 567 unmodified lines
568568 goto ddc_create_fail;
569569 }
570570
571− if (!link->ddc->ddc_pin) {
571+ /* Embedded display connectors such as LVDS may not have DDC. */
572+ if (!link->ddc->ddc_pin &&
573+ !dc_is_embedded_signal(link->connector_signal)) {
572574 DC_ERROR("Failed to get I2C info for connector!\n");
573575 goto ddc_create_fail;
574576 }
drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c+2−1
@@ -753,7 +753,8 @@ static struct link_encoder *dce60_link_encoder_create( · 752 unmodified lines
753753 enc_init_data,
754754 &link_enc_feature,
755755 &link_enc_regs[link_regs_id],
756− &link_enc_aux_regs[enc_init_data->channel - 1],
756+ enc_init_data->channel == CHANNEL_ID_UNKNOWN ?
757+ NULL : &link_enc_aux_regs[enc_init_data->channel - 1],
757758 enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs) ?
758759 NULL : &link_enc_hpd_regs[enc_init_data->hpd_source]);
759760 return &enc110->base;
drivers/gpu/drm/amd/display/dc/resource/dce80/dce80_resource.c+2−1
@@ -760,7 +760,8 @@ static struct link_encoder *dce80_link_encoder_create( · 759 unmodified lines
760760 enc_init_data,
761761 &link_enc_feature,
762762 &link_enc_regs[link_regs_id],
763− &link_enc_aux_regs[enc_init_data->channel - 1],
763+ enc_init_data->channel == CHANNEL_ID_UNKNOWN ?
764+ NULL : &link_enc_aux_regs[enc_init_data->channel - 1],
764765 enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs) ?
765766 NULL : &link_enc_hpd_regs[enc_init_data->hpd_source]);
766767 return &enc110->base;
drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h+4−0
@@ -153,6 +153,10 @@ struct embedded_panel_info { · 152 unmodified lines
153153 uint32_t drr_enabled;
154154 uint32_t min_drr_refresh_rate;
155155 bool realtek_eDPToLVDS;
156+ uint16_t panel_width_mm;
157+ uint16_t panel_height_mm;
158+ uint16_t fake_edid_size;
159+ const uint8_t *fake_edid;
156160 };
157161
158162 struct dc_firmware_info {
drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c+1−0
@@ -425,6 +425,7 @@ static int aldebaran_set_default_dpm_table(struct smu_context *smu) · 424 unmodified lines
425425 dpm_table->dpm_levels[0].enabled = true;
426426 dpm_table->dpm_levels[1].value = pptable->GfxclkFmax;
427427 dpm_table->dpm_levels[1].enabled = true;
428+ dpm_table->flags |= SMU_DPM_TABLE_FINE_GRAINED;
428429 } else {
429430 dpm_table->count = 1;
430431 dpm_table->dpm_levels[0].value = smu->smu_table.boot_values.gfxclk / 100;
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c+1−0
@@ -1129,6 +1129,7 @@ static int smu_v13_0_6_set_default_dpm_table(struct smu_context *smu) · 1128 unmodified lines
11291129 /* gfxclk dpm table setup */
11301130 dpm_table = &dpm_context->dpm_tables.gfx_table;
11311131 dpm_table->clk_type = SMU_GFXCLK;
1132+ dpm_table->flags = SMU_DPM_TABLE_FINE_GRAINED;
11321133 if (smu_cmn_feature_is_enabled(smu, SMU_FEATURE_DPM_GFXCLK_BIT)) {
11331134 /* In the case of gfxclk, only fine-grained dpm is honored.
11341135 * Get min/max values from FW.
drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c+1−1
@@ -1370,7 +1370,7 @@ int smu_cmn_print_dpm_clk_levels(struct smu_context *smu, · 1369 unmodified lines
13701370 level_index = 1;
13711371 }
13721372
1373− if (!is_fine_grained) {
1373+ if (!is_fine_grained || count == 1) {
13741374 for (i = 0; i < count; i++) {
13751375 freq_match = !is_deep_sleep &&
13761376 smu_cmn_freqs_match(
drivers/gpu/drm/drm_color_mgmt.c+1−1
@@ -831,7 +831,7 @@ static void fill_palette_332(struct drm_crtc *crtc, u16 r, u16 g, u16 b, · 830 unmodified lines
831831 }
832832
833833 /**
834− * drm_crtc_fill_palette_332 - Programs a default palette for R332-like formats
834+ * drm_crtc_fill_palette_332 - Programs a default palette for RGB332-like formats
835835 * @crtc: The displaying CRTC
836836 * @set_palette: Callback for programming the hardware gamma LUT
837837 *
drivers/gpu/drm/drm_gem_framebuffer_helper.c+2−2
@@ -172,8 +172,8 @@ int drm_gem_fb_init_with_funcs(struct drm_device *dev, · 171 unmodified lines
172172 }
173173
174174 for (i = 0; i < info->num_planes; i++) {
175− unsigned int width = mode_cmd->width / (i ? info->hsub : 1);
176− unsigned int height = mode_cmd->height / (i ? info->vsub : 1);
175+ unsigned int width = drm_format_info_plane_width(info, mode_cmd->width, i);
176+ unsigned int height = drm_format_info_plane_height(info, mode_cmd->height, i);
177177 unsigned int min_size;
178178
179179 objs[i] = drm_gem_object_lookup(file, mode_cmd->handles[i]);
drivers/gpu/drm/imagination/pvr_fw_trace.c+1−1
@@ -558,6 +558,6 @@ pvr_fw_trace_debugfs_init(struct pvr_device *pvr_dev, struct dentry *dir) · 557 unmodified lines
558558 &pvr_fw_trace_fops);
559559 }
560560
561− debugfs_create_file("trace_mask", 0600, dir, fw_trace,
561+ debugfs_create_file("trace_mask", 0600, dir, pvr_dev,
562562 &pvr_fw_trace_mask_fops);
563563 }
drivers/gpu/drm/sysfb/ofdrm.c+2−0
@@ -350,6 +350,7 @@ static void ofdrm_pci_release(void *data) · 349 unmodified lines
350350 struct pci_dev *pcidev = data;
351351
352352 pci_disable_device(pcidev);
353+ pci_dev_put(pcidev);
353354 }
354355
355356 static int ofdrm_device_init_pci(struct ofdrm_device *odev)
@@ -375,6 +376,7 @@ static int ofdrm_device_init_pci(struct ofdrm_device *odev) · 19 unmodified lines
375376 if (ret) {
376377 drm_err(dev, "pci_enable_device(%s) failed: %d\n",
377378 dev_name(&pcidev->dev), ret);
379+ pci_dev_put(pcidev);
378380 return ret;
379381 }
380382 ret = devm_add_action_or_reset(&pdev->dev, ofdrm_pci_release, pcidev);
drivers/gpu/drm/tiny/appletbdrm.c+2−2
@@ -353,7 +353,7 @@ static int appletbdrm_primary_plane_helper_atomic_check(struct drm_plane *plane, · 352 unmodified lines
353353 frames_size +
354354 sizeof(struct appletbdrm_fb_request_footer), 16);
355355
356− appletbdrm_state->request = kzalloc(request_size, GFP_KERNEL);
356+ appletbdrm_state->request = kvzalloc(request_size, GFP_KERNEL);
357357
358358 if (!appletbdrm_state->request)
359359 return -ENOMEM;
@@ -543,7 +543,7 @@ static void appletbdrm_primary_plane_destroy_state(struct drm_plane *plane, · 183 unmodified lines
543543 {
544544 struct appletbdrm_plane_state *appletbdrm_state = to_appletbdrm_plane_state(state);
545545
546− kfree(appletbdrm_state->request);
546+ kvfree(appletbdrm_state->request);
547547 kfree(appletbdrm_state->response);
548548
549549 __drm_gem_destroy_shadow_plane_state(&appletbdrm_state->base);
drivers/gpu/drm/udl/udl_main.c+1−2
@@ -285,13 +285,12 @@ static struct urb *udl_get_urb_locked(struct udl_device *udl, long timeout) · 284 unmodified lines
285285 return unode->urb;
286286 }
287287
288−#define GET_URB_TIMEOUT HZ
289288 struct urb *udl_get_urb(struct udl_device *udl)
290289 {
291290 struct urb *urb;
292291
293292 spin_lock_irq(&udl->urbs.lock);
294− urb = udl_get_urb_locked(udl, GET_URB_TIMEOUT);
293+ urb = udl_get_urb_locked(udl, HZ * 2);
295294 spin_unlock_irq(&udl->urbs.lock);
296295 return urb;
297296 }
drivers/gpu/drm/udl/udl_modeset.c+4−1
@@ -21,6 +21,7 @@ · 20 unmodified lines
2121 #include <drm/drm_gem_framebuffer_helper.h>
2222 #include <drm/drm_gem_shmem_helper.h>
2323 #include <drm/drm_modeset_helper_vtables.h>
24+#include <drm/drm_print.h>
2425 #include <drm/drm_probe_helper.h>
2526 #include <drm/drm_vblank.h>
2627
@@ -342,8 +343,10 @@ static void udl_crtc_helper_atomic_enable(struct drm_crtc *crtc, struct drm_atom · 315 unmodified lines
342343 return;
343344
344345 urb = udl_get_urb(udl);
345− if (!urb)
346+ if (!urb) {
347+ drm_err_ratelimited(dev, "get urb failed when enabling crtc\n");
346348 goto out;
349+ }
347350
348351 buf = (char *)urb->transfer_buffer;
349352 buf = udl_vidreg_lock(buf);
drivers/gpu/drm/xe/Makefile+1−0
@@ -88,6 +88,7 @@ xe-y += xe_bb.o \ · 87 unmodified lines
8888 xe_irq.o \
8989 xe_late_bind_fw.o \
9090 xe_lrc.o \
91+ xe_mem_pool.o \
9192 xe_migrate.o \
9293 xe_mmio.o \
9394 xe_mmio_gem.o \
drivers/gpu/drm/xe/regs/xe_gt_regs.h+1−1
@@ -583,7 +583,7 @@ · 582 unmodified lines
583583 #define DISABLE_128B_EVICTION_COMMAND_UDW REG_BIT(36 - 32)
584584 #define LSCFE_SAME_ADDRESS_ATOMICS_COALESCING_DISABLE REG_BIT(35 - 32)
585585
586−#define ROW_CHICKEN5 XE_REG_MCR(0xe7f0)
586+#define ROW_CHICKEN5 XE_REG_MCR(0xe7f0, XE_REG_OPTION_MASKED)
587587 #define CPSS_AWARE_DIS REG_BIT(3)
588588
589589 #define SARB_CHICKEN1 XE_REG_MCR(0xe90c)
drivers/gpu/drm/xe/xe_bo.c+6−2
@@ -2322,8 +2322,10 @@ struct xe_bo *xe_bo_init_locked(struct xe_device *xe, struct xe_bo *bo, · 2321 unmodified lines
23222322 }
23232323
23242324 /* XE_BO_FLAG_GGTTx requires XE_BO_FLAG_GGTT also be set */
2325− if ((flags & XE_BO_FLAG_GGTT_ALL) && !(flags & XE_BO_FLAG_GGTT))
2325+ if ((flags & XE_BO_FLAG_GGTT_ALL) && !(flags & XE_BO_FLAG_GGTT)) {
2326+ xe_bo_free(bo);
23262327 return ERR_PTR(-EINVAL);
2328+ }
23272329
23282330 if (flags & (XE_BO_FLAG_VRAM_MASK | XE_BO_FLAG_STOLEN) &&
23292331 !(flags & XE_BO_FLAG_IGNORE_MIN_PAGE_SIZE) &&
@@ -2342,8 +2344,10 @@ struct xe_bo *xe_bo_init_locked(struct xe_device *xe, struct xe_bo *bo, · 12 unmodified lines
23422344 alignment = SZ_4K >> PAGE_SHIFT;
23432345 }
23442346
2345− if (type == ttm_bo_type_device && aligned_size != size)
2347+ if (type == ttm_bo_type_device && aligned_size != size) {
2348+ xe_bo_free(bo);
23462349 return ERR_PTR(-EINVAL);
2350+ }
23472351
23482352 if (!bo) {
23492353 bo = xe_bo_alloc();
drivers/gpu/drm/xe/xe_bo_types.h+2−1
@@ -18,6 +18,7 @@ · 17 unmodified lines
1818 #include "xe_ggtt_types.h"
1919
2020 struct xe_device;
21+struct xe_mem_pool_node;
2122 struct xe_vm;
2223
2324 #define XE_BO_MAX_PLACEMENTS 3
@@ -88,7 +89,7 @@ struct xe_bo { · 64 unmodified lines
8889 bool ccs_cleared;
8990
9091 /** @bb_ccs: BB instructions of CCS read/write. Valid only for VF */
91− struct xe_bb *bb_ccs[XE_SRIOV_VF_CCS_CTX_COUNT];
92+ struct xe_mem_pool_node *bb_ccs[XE_SRIOV_VF_CCS_CTX_COUNT];
9293
9394 /**
9495 * @cpu_caching: CPU caching mode. Currently only used for userspace
drivers/gpu/drm/xe/xe_dma_buf.c+18−5
@@ -258,6 +258,13 @@ out_unlock: · 257 unmodified lines
258258 return ERR_PTR(ret);
259259 }
260260
261+/*
262+ * Takes ownership of @storage: on success it is transferred to the returned
263+ * drm_gem_object; on failure it is freed before returning the error.
264+ * This matches the contract of xe_bo_init_locked() which frees @storage on
265+ * its error paths, so callers need not (and must not) free @storage after
266+ * this call.
267+ */
261268 static struct drm_gem_object *
262269 xe_dma_buf_init_obj(struct drm_device *dev, struct xe_bo *storage,
263270 struct dma_buf *dma_buf)
@@ -271,8 +278,10 @@ xe_dma_buf_init_obj(struct drm_device *dev, struct xe_bo *storage, · 7 unmodified lines
271278 int ret = 0;
272279
273280 dummy_obj = drm_gpuvm_resv_object_alloc(&xe->drm);
274− if (!dummy_obj)
281+ if (!dummy_obj) {
282+ xe_bo_free(storage);
275283 return ERR_PTR(-ENOMEM);
284+ }
276285
277286 dummy_obj->resv = resv;
278287 xe_validation_guard(&ctx, &xe->val, &exec, (struct xe_val_flags) {}, ret) {
@@ -281,6 +290,7 @@ xe_dma_buf_init_obj(struct drm_device *dev, struct xe_bo *storage, · 2 unmodified lines
281290 if (ret)
282291 break;
283292
293+ /* xe_bo_init_locked() frees storage on error */
284294 bo = xe_bo_init_locked(xe, storage, NULL, resv, NULL, dma_buf->size,
285295 0, /* Will require 1way or 2way for vm_bind */
286296 ttm_bo_type_sg, XE_BO_FLAG_SYSTEM, &exec);
@@ -368,12 +378,15 @@ struct drm_gem_object *xe_gem_prime_import(struct drm_device *dev, · 81 unmodified lines
368378 goto out_err;
369379 }
370380
371− /* Errors here will take care of freeing the bo. */
381+ /*
382+ * xe_dma_buf_init_obj() takes ownership of bo on both success
383+ * and failure, so we must not touch bo after this call.
384+ */
372385 obj = xe_dma_buf_init_obj(dev, bo, dma_buf);
373− if (IS_ERR(obj))
386+ if (IS_ERR(obj)) {
387+ dma_buf_detach(dma_buf, attach);
374388 return obj;
375−
376−
389+ }
377390 get_dma_buf(dma_buf);
378391 obj->import_attach = attach;
379392 return obj;
drivers/gpu/drm/xe/xe_eu_stall.c+2−2
@@ -869,14 +869,14 @@ static int xe_eu_stall_stream_close(struct inode *inode, struct file *file) · 868 unmodified lines
869869 struct xe_eu_stall_data_stream *stream = file->private_data;
870870 struct xe_gt *gt = stream->gt;
871871
872− drm_dev_put(&gt->tile->xe->drm);
873−
874872 mutex_lock(&gt->eu_stall->stream_lock);
875873 xe_eu_stall_disable_locked(stream);
876874 xe_eu_stall_data_buf_destroy(stream);
877875 xe_eu_stall_stream_free(stream);
878876 mutex_unlock(&gt->eu_stall->stream_lock);
879877
878+ drm_dev_put(&gt->tile->xe->drm);
879+
880880 return 0;
881881 }
882882
drivers/gpu/drm/xe/xe_exec_queue.c+6−3
@@ -1405,7 +1405,7 @@ int xe_exec_queue_create_ioctl(struct drm_device *dev, void *data, · 1404 unmodified lines
14051405 if (q->vm && q->hwe->hw_engine_group) {
14061406 err = xe_hw_engine_group_add_exec_queue(q->hwe->hw_engine_group, q);
14071407 if (err)
1408− goto put_exec_queue;
1408+ goto kill_exec_queue;
14091409 }
14101410 }
14111411
@@ -1416,12 +1416,15 @@ int xe_exec_queue_create_ioctl(struct drm_device *dev, void *data, · 4 unmodified lines
14161416 /* user id alloc must always be last in ioctl to prevent UAF */
14171417 err = xa_alloc(&xef->exec_queue.xa, &id, q, xa_limit_32b, GFP_KERNEL);
14181418 if (err)
1419− goto kill_exec_queue;
1419+ goto del_hw_engine_group;
14201420
14211421 args->exec_queue_id = id;
14221422
14231423 return 0;
14241424
1425+del_hw_engine_group:
1426+ if (q->vm && q->hwe && q->hwe->hw_engine_group)
1427+ xe_hw_engine_group_del_exec_queue(q->hwe->hw_engine_group, q);
14251428 kill_exec_queue:
14261429 xe_exec_queue_kill(q);
14271430 delete_queue_group:
@@ -1760,7 +1763,7 @@ void xe_exec_queue_tlb_inval_last_fence_put(struct xe_exec_queue *q, · 332 unmodified lines
17601763 void xe_exec_queue_tlb_inval_last_fence_put_unlocked(struct xe_exec_queue *q,
17611764 unsigned int type)
17621765 {
1763− xe_assert(q->vm->xe, type == XE_EXEC_QUEUE_TLB_INVAL_MEDIA_GT ||
1766+ xe_assert(gt_to_xe(q->gt), type == XE_EXEC_QUEUE_TLB_INVAL_MEDIA_GT ||
17641767 type == XE_EXEC_QUEUE_TLB_INVAL_PRIMARY_GT);
17651768
17661769 dma_fence_put(q->tlb_inval[type].last_fence);
drivers/gpu/drm/xe/xe_gsc.c+1−1
@@ -166,7 +166,7 @@ static int query_compatibility_version(struct xe_gsc *gsc) · 165 unmodified lines
166166 &rd_offset);
167167 if (err) {
168168 xe_gt_err(gt, "HuC: invalid GSC reply for version query (err=%d)\n", err);
169− return err;
169+ goto out_bo;
170170 }
171171
172172 compat->major = version_query_rd(xe, &bo->vmap, rd_offset, proj_major);
drivers/gpu/drm/xe/xe_guc_submit.c+9−24
@@ -259,24 +259,12 @@ static void guc_submit_sw_fini(struct drm_device *drm, void *arg) · 258 unmodified lines
259259 }
260260
261261 static void guc_submit_fini(void *arg)
262−{
263− struct xe_guc *guc = arg;
264−
265− /* Forcefully kill any remaining exec queues */
266− xe_guc_ct_stop(&guc->ct);
267− guc_submit_reset_prepare(guc);
268− xe_guc_softreset(guc);
269− xe_guc_submit_stop(guc);
270− xe_uc_fw_sanitize(&guc->fw);
271− xe_guc_submit_pause_abort(guc);
272−}
273−
274−static void guc_submit_wedged_fini(void *arg)
275262 {
276263 struct xe_guc *guc = arg;
277264 struct xe_exec_queue *q;
278265 unsigned long index;
279266
267+ /* Drop any wedged queue refs */
280268 mutex_lock(&guc->submission_state.lock);
281269 xa_for_each(&guc->submission_state.exec_queue_lookup, index, q) {
282270 if (exec_queue_wedged(q)) {
@@ -286,6 +274,14 @@ static void guc_submit_wedged_fini(void *arg) · 3 unmodified lines
286274 }
287275 }
288276 mutex_unlock(&guc->submission_state.lock);
277+
278+ /* Forcefully kill any remaining exec queues */
279+ xe_guc_ct_stop(&guc->ct);
280+ guc_submit_reset_prepare(guc);
281+ xe_guc_softreset(guc);
282+ xe_guc_submit_stop(guc);
283+ xe_uc_fw_sanitize(&guc->fw);
284+ xe_guc_submit_pause_abort(guc);
289285 }
290286
291287 static const struct xe_exec_queue_ops guc_exec_queue_ops;
@@ -1320,10 +1316,8 @@ static void disable_scheduling_deregister(struct xe_guc *guc, · 1028 unmodified lines
13201316 void xe_guc_submit_wedge(struct xe_guc *guc)
13211317 {
13221318 struct xe_device *xe = guc_to_xe(guc);
1323− struct xe_gt *gt = guc_to_gt(guc);
13241319 struct xe_exec_queue *q;
13251320 unsigned long index;
1326− int err;
13271321
13281322 xe_gt_assert(guc_to_gt(guc), guc_to_xe(guc)->wedged.mode);
13291323
@@ -1335,15 +1329,6 @@ void xe_guc_submit_wedge(struct xe_guc *guc) · 5 unmodified lines
13351329 return;
13361330
13371331 if (xe->wedged.mode == XE_WEDGED_MODE_UPON_ANY_HANG_NO_RESET) {
1338− err = devm_add_action_or_reset(guc_to_xe(guc)->drm.dev,
1339− guc_submit_wedged_fini, guc);
1340− if (err) {
1341− xe_gt_err(gt, "Failed to register clean-up on wedged.mode=%s; "
1342− "Although device is wedged.\n",
1343− xe_wedged_mode_to_string(XE_WEDGED_MODE_UPON_ANY_HANG_NO_RESET));
1344− return;
1345− }
1346−
13471332 mutex_lock(&guc->submission_state.lock);
13481333 xa_for_each(&guc->submission_state.exec_queue_lookup, index, q)
13491334 if (xe_exec_queue_get_unless_zero(q))
drivers/gpu/drm/xe/xe_lrc.c+1−1
@@ -1214,7 +1214,7 @@ static ssize_t setup_invalidate_state_cache_wa(struct xe_lrc *lrc, · 1213 unmodified lines
12141214 if (xe_gt_WARN_ON(lrc->gt, max_len < 3))
12151215 return -ENOSPC;
12161216
1217− *cmd++ = MI_LOAD_REGISTER_IMM | MI_LRI_NUM_REGS(1);
1217+ *cmd++ = MI_LOAD_REGISTER_IMM | MI_LRI_LRM_CS_MMIO | MI_LRI_NUM_REGS(1);
12181218 *cmd++ = CS_DEBUG_MODE2(0).addr;
12191219 *cmd++ = REG_MASKED_FIELD_ENABLE(INSTRUCTION_STATE_CACHE_INVALIDATE);
12201220
drivers/gpu/drm/xe/xe_mem_pool.c+403−0
@@ -0,0 +1,403 @@
1+// SPDX-License-Identifier: MIT
2+/*
3+ * Copyright © 2026 Intel Corporation
4+ */
5+
6+#include <linux/kernel.h>
7+
8+#include <drm/drm_managed.h>
9+
10+#include "instructions/xe_mi_commands.h"
11+#include "xe_bo.h"
12+#include "xe_device_types.h"
13+#include "xe_map.h"
14+#include "xe_mem_pool.h"
15+#include "xe_mem_pool_types.h"
16+#include "xe_tile_printk.h"
17+
18+/**
19+ * struct xe_mem_pool - DRM MM pool for sub-allocating memory from a BO on an
20+ * XE tile.
21+ *
22+ * The XE memory pool is a DRM MM manager that provides sub-allocation of memory
23+ * from a backing buffer object (BO) on a specific XE tile. It is designed to
24+ * manage memory for GPU workloads, allowing for efficient allocation and
25+ * deallocation of memory regions within the BO.
26+ *
27+ * The memory pool maintains a primary BO that is pinned in the GGTT and mapped
28+ * into the CPU address space for direct access. Optionally, it can also maintain
29+ * a shadow BO that can be used for atomic updates to the primary BO's contents.
30+ *
31+ * The API provided by the memory pool allows clients to allocate and free memory
32+ * regions, retrieve GPU and CPU addresses, and synchronize data between the
33+ * primary and shadow BOs as needed.
34+ */
35+struct xe_mem_pool {
36+ /** @base: Range allocator over [0, @size) in bytes */
37+ struct drm_mm base;
38+ /** @bo: Active pool BO (GGTT-pinned, CPU-mapped). */
39+ struct xe_bo *bo;
40+ /** @shadow: Shadow BO for atomic command updates. */
41+ struct xe_bo *shadow;
42+ /** @swap_guard: Timeline guard updating @bo and @shadow */
43+ struct mutex swap_guard;
44+ /** @cpu_addr: CPU virtual address of the active BO. */
45+ void *cpu_addr;
46+ /** @is_iomem: Indicates if the BO mapping is I/O memory. */
47+ bool is_iomem;
48+};
49+
50+static struct xe_mem_pool *node_to_pool(struct xe_mem_pool_node *node)
51+{
52+ return container_of(node->sa_node.mm, struct xe_mem_pool, base);
53+}
54+
55+static struct xe_tile *pool_to_tile(struct xe_mem_pool *pool)
56+{
57+ return pool->bo->tile;
58+}
59+
60+static void fini_pool_action(struct drm_device *drm, void *arg)
61+{
62+ struct xe_mem_pool *pool = arg;
63+
64+ if (pool->is_iomem)
65+ kvfree(pool->cpu_addr);
66+
67+ drm_mm_takedown(&pool->base);
68+}
69+
70+static int pool_shadow_init(struct xe_mem_pool *pool)
71+{
72+ struct xe_tile *tile = pool->bo->tile;
73+ struct xe_device *xe = tile_to_xe(tile);
74+ struct xe_bo *shadow;
75+ int ret;
76+
77+ xe_assert(xe, !pool->shadow);
78+
79+ ret = drmm_mutex_init(&xe->drm, &pool->swap_guard);
80+ if (ret)
81+ return ret;
82+
83+ if (IS_ENABLED(CONFIG_PROVE_LOCKING)) {
84+ fs_reclaim_acquire(GFP_KERNEL);
85+ might_lock(&pool->swap_guard);
86+ fs_reclaim_release(GFP_KERNEL);
87+ }
88+ shadow = xe_managed_bo_create_pin_map(xe, tile,
89+ xe_bo_size(pool->bo),
90+ XE_BO_FLAG_VRAM_IF_DGFX(tile) |
91+ XE_BO_FLAG_GGTT |
92+ XE_BO_FLAG_GGTT_INVALIDATE |
93+ XE_BO_FLAG_PINNED_NORESTORE);
94+ if (IS_ERR(shadow))
95+ return PTR_ERR(shadow);
96+
97+ pool->shadow = shadow;
98+
99+ return 0;
100+}
101+
102+/**
103+ * xe_mem_pool_init() - Initialize memory pool.
104+ * @tile: the &xe_tile where allocate.
105+ * @size: number of bytes to allocate.
106+ * @guard: the size of the guard region at the end of the BO that is not
107+ * sub-allocated, in bytes.
108+ * @flags: flags to use to create shadow pool.
109+ *
110+ * Initializes a memory pool for sub-allocating memory from a backing BO on the
111+ * specified XE tile. The backing BO is pinned in the GGTT and mapped into
112+ * the CPU address space for direct access. Optionally, a shadow BO can also be
113+ * initialized for atomic updates to the primary BO's contents.
114+ *
115+ * Returns: a pointer to the &xe_mem_pool, or an error pointer on failure.
116+ */
117+struct xe_mem_pool *xe_mem_pool_init(struct xe_tile *tile, u32 size,
118+ u32 guard, int flags)
119+{
120+ struct xe_device *xe = tile_to_xe(tile);
121+ struct xe_mem_pool *pool;
122+ struct xe_bo *bo;
123+ u32 managed_size;
124+ int ret;
125+
126+ xe_tile_assert(tile, size > guard);
127+ managed_size = size - guard;
128+
129+ pool = drmm_kzalloc(&xe->drm, sizeof(*pool), GFP_KERNEL);
130+ if (!pool)
131+ return ERR_PTR(-ENOMEM);
132+
133+ bo = xe_managed_bo_create_pin_map(xe, tile, size,
134+ XE_BO_FLAG_VRAM_IF_DGFX(tile) |
135+ XE_BO_FLAG_GGTT |
136+ XE_BO_FLAG_GGTT_INVALIDATE |
137+ XE_BO_FLAG_PINNED_NORESTORE);
138+ if (IS_ERR(bo)) {
139+ xe_tile_err(tile, "Failed to prepare %uKiB BO for mem pool (%pe)\n",
140+ size / SZ_1K, bo);
141+ return ERR_CAST(bo);
142+ }
143+ pool->bo = bo;
144+ pool->is_iomem = bo->vmap.is_iomem;
145+
146+ if (pool->is_iomem) {
147+ pool->cpu_addr = kvzalloc(size, GFP_KERNEL);
148+ if (!pool->cpu_addr)
149+ return ERR_PTR(-ENOMEM);
150+ } else {
151+ pool->cpu_addr = bo->vmap.vaddr;
152+ }
153+
154+ if (flags & XE_MEM_POOL_BO_FLAG_INIT_SHADOW_COPY) {
155+ ret = pool_shadow_init(pool);
156+
157+ if (ret)
158+ goto out_err;
159+ }
160+
161+ drm_mm_init(&pool->base, 0, managed_size);
162+ ret = drmm_add_action_or_reset(&xe->drm, fini_pool_action, pool);
163+ if (ret)
164+ return ERR_PTR(ret);
165+
166+ return pool;
167+
168+out_err:
169+ if (flags & XE_MEM_POOL_BO_FLAG_INIT_SHADOW_COPY)
170+ xe_tile_err(tile,
171+ "Failed to initialize shadow BO for mem pool (%d)\n", ret);
172+ if (bo->vmap.is_iomem)
173+ kvfree(pool->cpu_addr);
174+ return ERR_PTR(ret);
175+}
176+
177+/**
178+ * xe_mem_pool_sync() - Copy the entire contents of the main pool to shadow pool.
179+ * @pool: the memory pool containing the primary and shadow BOs.
180+ *
181+ * Copies the entire contents of the primary pool to the shadow pool. This must
182+ * be done after xe_mem_pool_init() with the XE_MEM_POOL_BO_FLAG_INIT_SHADOW_COPY
183+ * flag to ensure that the shadow pool has the same initial contents as the primary
184+ * pool. After this initial synchronization, clients can choose to synchronize the
185+ * shadow pool with the primary pool on a node basis using
186+ * xe_mem_pool_sync_shadow_locked() as needed.
187+ *
188+ * Return: None.
189+ */
190+void xe_mem_pool_sync(struct xe_mem_pool *pool)
191+{
192+ struct xe_tile *tile = pool_to_tile(pool);
193+ struct xe_device *xe = tile_to_xe(tile);
194+
195+ xe_tile_assert(tile, pool->shadow);
196+
197+ xe_map_memcpy_to(xe, &pool->shadow->vmap, 0,
198+ pool->cpu_addr, xe_bo_size(pool->bo));
199+}
200+
201+/**
202+ * xe_mem_pool_swap_shadow_locked() - Swap the primary BO with the shadow BO.
203+ * @pool: the memory pool containing the primary and shadow BOs.
204+ *
205+ * Swaps the primary buffer object with the shadow buffer object in the mem
206+ * pool. This allows for atomic updates to the contents of the primary BO
207+ * by first writing to the shadow BO and then swapping it with the primary BO.
208+ * Swap_guard must be held to ensure synchronization with any concurrent swap
209+ * operations.
210+ *
211+ * Return: None.
212+ */
213+void xe_mem_pool_swap_shadow_locked(struct xe_mem_pool *pool)
214+{
215+ struct xe_tile *tile = pool_to_tile(pool);
216+
217+ xe_tile_assert(tile, pool->shadow);
218+ lockdep_assert_held(&pool->swap_guard);
219+
220+ swap(pool->bo, pool->shadow);
221+ if (!pool->bo->vmap.is_iomem)
222+ pool->cpu_addr = pool->bo->vmap.vaddr;
223+}
224+
225+/**
226+ * xe_mem_pool_sync_shadow_locked() - Copy node from primary pool to shadow pool.
227+ * @node: the node allocated in the memory pool.
228+ *
229+ * Copies the specified batch buffer from the primary pool to the shadow pool.
230+ * Swap_guard must be held to ensure synchronization with any concurrent swap
231+ * operations.
232+ *
233+ * Return: None.
234+ */
235+void xe_mem_pool_sync_shadow_locked(struct xe_mem_pool_node *node)
236+{
237+ struct xe_mem_pool *pool = node_to_pool(node);
238+ struct xe_tile *tile = pool_to_tile(pool);
239+ struct xe_device *xe = tile_to_xe(tile);
240+ struct drm_mm_node *sa_node = &node->sa_node;
241+
242+ xe_tile_assert(tile, pool->shadow);
243+ lockdep_assert_held(&pool->swap_guard);
244+
245+ xe_map_memcpy_to(xe, &pool->shadow->vmap,
246+ sa_node->start,
247+ pool->cpu_addr + sa_node->start,
248+ sa_node->size);
249+}
250+
251+/**
252+ * xe_mem_pool_gpu_addr() - Retrieve GPU address of memory pool.
253+ * @pool: the memory pool
254+ *
255+ * Returns: GGTT address of the memory pool.
256+ */
257+u64 xe_mem_pool_gpu_addr(struct xe_mem_pool *pool)
258+{
259+ return xe_bo_ggtt_addr(pool->bo);
260+}
261+
262+/**
263+ * xe_mem_pool_cpu_addr() - Retrieve CPU address of manager pool.
264+ * @pool: the memory pool
265+ *
266+ * Returns: CPU virtual address of memory pool.
267+ */
268+void *xe_mem_pool_cpu_addr(struct xe_mem_pool *pool)
269+{
270+ return pool->cpu_addr;
271+}
272+
273+/**
274+ * xe_mem_pool_bo_swap_guard() - Retrieve the mutex used to guard swap
275+ * operations on a memory pool.
276+ * @pool: the memory pool
277+ *
278+ * Returns: Swap guard mutex or NULL if shadow pool is not created.
279+ */
280+struct mutex *xe_mem_pool_bo_swap_guard(struct xe_mem_pool *pool)
281+{
282+ if (!pool->shadow)
283+ return NULL;
284+
285+ return &pool->swap_guard;
286+}
287+
288+/**
289+ * xe_mem_pool_bo_flush_write() - Copy the data from the sub-allocation
290+ * to the GPU memory.
291+ * @node: the node allocated in the memory pool to flush.
292+ */
293+void xe_mem_pool_bo_flush_write(struct xe_mem_pool_node *node)
294+{
295+ struct xe_mem_pool *pool = node_to_pool(node);
296+ struct xe_tile *tile = pool_to_tile(pool);
297+ struct xe_device *xe = tile_to_xe(tile);
298+ struct drm_mm_node *sa_node = &node->sa_node;
299+
300+ if (!pool->bo->vmap.is_iomem)
301+ return;
302+
303+ xe_map_memcpy_to(xe, &pool->bo->vmap, sa_node->start,
304+ pool->cpu_addr + sa_node->start,
305+ sa_node->size);
306+}
307+
308+/**
309+ * xe_mem_pool_bo_sync_read() - Copy the data from GPU memory to the
310+ * sub-allocation.
311+ * @node: the node allocated in the memory pool to read back.
312+ */
313+void xe_mem_pool_bo_sync_read(struct xe_mem_pool_node *node)
314+{
315+ struct xe_mem_pool *pool = node_to_pool(node);
316+ struct xe_tile *tile = pool_to_tile(pool);
317+ struct xe_device *xe = tile_to_xe(tile);
318+ struct drm_mm_node *sa_node = &node->sa_node;
319+
320+ if (!pool->bo->vmap.is_iomem)
321+ return;
322+
323+ xe_map_memcpy_from(xe, pool->cpu_addr + sa_node->start,
324+ &pool->bo->vmap, sa_node->start, sa_node->size);
325+}
326+
327+/**
328+ * xe_mem_pool_alloc_node() - Allocate a new node for use with xe_mem_pool.
329+ *
330+ * Returns: node structure or an ERR_PTR(-ENOMEM).
331+ */
332+struct xe_mem_pool_node *xe_mem_pool_alloc_node(void)
333+{
334+ struct xe_mem_pool_node *node = kzalloc_obj(*node);
335+
336+ if (!node)
337+ return ERR_PTR(-ENOMEM);
338+
339+ return node;
340+}
341+
342+/**
343+ * xe_mem_pool_insert_node() - Insert a node into the memory pool.
344+ * @pool: the memory pool to insert into
345+ * @node: the node to insert
346+ * @size: the size of the node to be allocated in bytes.
347+ *
348+ * Inserts a node into the specified memory pool using drm_mm for
349+ * allocation.
350+ *
351+ * Returns: 0 on success or a negative error code on failure.
352+ */
353+int xe_mem_pool_insert_node(struct xe_mem_pool *pool,
354+ struct xe_mem_pool_node *node, u32 size)
355+{
356+ if (!pool)
357+ return -EINVAL;
358+
359+ return drm_mm_insert_node(&pool->base, &node->sa_node, size);
360+}
361+
362+/**
363+ * xe_mem_pool_free_node() - Free a node allocated from the memory pool.
364+ * @node: the node to free
365+ *
366+ * Returns: None.
367+ */
368+void xe_mem_pool_free_node(struct xe_mem_pool_node *node)
369+{
370+ if (!node)
371+ return;
372+
373+ drm_mm_remove_node(&node->sa_node);
374+ kfree(node);
375+}
376+
377+/**
378+ * xe_mem_pool_node_cpu_addr() - Retrieve CPU address of the node.
379+ * @node: the node allocated in the memory pool
380+ *
381+ * Returns: CPU virtual address of the node.
382+ */
383+void *xe_mem_pool_node_cpu_addr(struct xe_mem_pool_node *node)
384+{
385+ struct xe_mem_pool *pool = node_to_pool(node);
386+
387+ return xe_mem_pool_cpu_addr(pool) + node->sa_node.start;
388+}
389+
390+/**
391+ * xe_mem_pool_dump() - Dump the state of the DRM MM manager for debugging.
392+ * @pool: the memory pool info be dumped.
393+ * @p: The DRM printer to use for output.
394+ *
395+ * Only the drm managed region is dumped, not the state of the BOs or any other
396+ * pool information.
397+ *
398+ * Returns: None.
399+ */
400+void xe_mem_pool_dump(struct xe_mem_pool *pool, struct drm_printer *p)
401+{
402+ drm_mm_print(&pool->base, p);
403+}
drivers/gpu/drm/xe/xe_mem_pool.h+35−0
@@ -0,0 +1,35 @@
1+/* SPDX-License-Identifier: MIT */
2+/*
3+ * Copyright © 2026 Intel Corporation
4+ */
5+#ifndef _XE_MEM_POOL_H_
6+#define _XE_MEM_POOL_H_
7+
8+#include <linux/sizes.h>
9+#include <linux/types.h>
10+
11+#include <drm/drm_mm.h>
12+#include "xe_mem_pool_types.h"
13+
14+struct drm_printer;
15+struct xe_mem_pool;
16+struct xe_tile;
17+
18+struct xe_mem_pool *xe_mem_pool_init(struct xe_tile *tile, u32 size,
19+ u32 guard, int flags);
20+void xe_mem_pool_sync(struct xe_mem_pool *pool);
21+void xe_mem_pool_swap_shadow_locked(struct xe_mem_pool *pool);
22+void xe_mem_pool_sync_shadow_locked(struct xe_mem_pool_node *node);
23+u64 xe_mem_pool_gpu_addr(struct xe_mem_pool *pool);
24+void *xe_mem_pool_cpu_addr(struct xe_mem_pool *pool);
25+struct mutex *xe_mem_pool_bo_swap_guard(struct xe_mem_pool *pool);
26+void xe_mem_pool_bo_flush_write(struct xe_mem_pool_node *node);
27+void xe_mem_pool_bo_sync_read(struct xe_mem_pool_node *node);
28+struct xe_mem_pool_node *xe_mem_pool_alloc_node(void);
29+int xe_mem_pool_insert_node(struct xe_mem_pool *pool,
30+ struct xe_mem_pool_node *node, u32 size);
31+void xe_mem_pool_free_node(struct xe_mem_pool_node *node);
32+void *xe_mem_pool_node_cpu_addr(struct xe_mem_pool_node *node);
33+void xe_mem_pool_dump(struct xe_mem_pool *pool, struct drm_printer *p);
34+
35+#endif
drivers/gpu/drm/xe/xe_mem_pool_types.h+21−0
@@ -0,0 +1,21 @@
1+/* SPDX-License-Identifier: MIT */
2+/*
3+ * Copyright © 2026 Intel Corporation
4+ */
5+
6+#ifndef _XE_MEM_POOL_TYPES_H_
7+#define _XE_MEM_POOL_TYPES_H_
8+
9+#include <drm/drm_mm.h>
10+
11+#define XE_MEM_POOL_BO_FLAG_INIT_SHADOW_COPY BIT(0)
12+
13+/**
14+ * struct xe_mem_pool_node - Sub-range allocations from mem pool.
15+ */
16+struct xe_mem_pool_node {
17+ /** @sa_node: drm_mm_node for this allocation. */
18+ struct drm_mm_node sa_node;
19+};
20+
21+#endif
drivers/gpu/drm/xe/xe_migrate.c+31−25
@@ -29,6 +29,7 @@ · 28 unmodified lines
2929 #include "xe_hw_engine.h"
3030 #include "xe_lrc.h"
3131 #include "xe_map.h"
32+#include "xe_mem_pool.h"
3233 #include "xe_mocs.h"
3334 #include "xe_printk.h"
3435 #include "xe_pt.h"
@@ -1166,11 +1167,12 @@ int xe_migrate_ccs_rw_copy(struct xe_tile *tile, struct xe_exec_queue *q, · 1131 unmodified lines
11661167 u32 batch_size, batch_size_allocated;
11671168 struct xe_device *xe = gt_to_xe(gt);
11681169 struct xe_res_cursor src_it, ccs_it;
1170+ struct xe_mem_pool *bb_pool;
11691171 struct xe_sriov_vf_ccs_ctx *ctx;
1170− struct xe_sa_manager *bb_pool;
11711172 u64 size = xe_bo_size(src_bo);
1172− struct xe_bb *bb = NULL;
1173+ struct xe_mem_pool_node *bb;
11731174 u64 src_L0, src_L0_ofs;
1175+ struct xe_bb xe_bb_tmp;
11741176 u32 src_L0_pt;
11751177 int err;
11761178
@@ -1208,18 +1210,18 @@ int xe_migrate_ccs_rw_copy(struct xe_tile *tile, struct xe_exec_queue *q, · 31 unmodified lines
12081210 size -= src_L0;
12091211 }
12101212
1211− bb = xe_bb_alloc(gt);
1213+ bb = xe_mem_pool_alloc_node();
12121214 if (IS_ERR(bb))
12131215 return PTR_ERR(bb);
12141216
12151217 bb_pool = ctx->mem.ccs_bb_pool;
1216− scoped_guard(mutex, xe_sa_bo_swap_guard(bb_pool)) {
1217− xe_sa_bo_swap_shadow(bb_pool);
1218+ scoped_guard(mutex, xe_mem_pool_bo_swap_guard(bb_pool)) {
1219+ xe_mem_pool_swap_shadow_locked(bb_pool);
12181220
1219− err = xe_bb_init(bb, bb_pool, batch_size);
1221+ err = xe_mem_pool_insert_node(bb_pool, bb, batch_size * sizeof(u32));
12201222 if (err) {
12211223 xe_gt_err(gt, "BB allocation failed.\n");
1222− xe_bb_free(bb, NULL);
1224+ kfree(bb);
12231225 return err;
12241226 }
12251227
@@ -1227,6 +1229,7 @@ int xe_migrate_ccs_rw_copy(struct xe_tile *tile, struct xe_exec_queue *q, · 1 unmodified line
12271229 size = xe_bo_size(src_bo);
12281230 batch_size = 0;
12291231
1232+ xe_bb_tmp = (struct xe_bb){ .cs = xe_mem_pool_node_cpu_addr(bb), .len = 0 };
12301233 /*
12311234 * Emit PTE and copy commands here.
12321235 * The CCS copy command can only support limited size. If the size to be
@@ -1255,24 +1258,27 @@ int xe_migrate_ccs_rw_copy(struct xe_tile *tile, struct xe_exec_queue *q, · 22 unmodified lines
12551258 xe_assert(xe, IS_ALIGNED(ccs_it.start, PAGE_SIZE));
12561259 batch_size += EMIT_COPY_CCS_DW;
12571260
1258− emit_pte(m, bb, src_L0_pt, false, true, &src_it, src_L0, src);
1261+ emit_pte(m, &xe_bb_tmp, src_L0_pt, false, true, &src_it, src_L0, src);
12591262
1260− emit_pte(m, bb, ccs_pt, false, false, &ccs_it, ccs_size, src);
1263+ emit_pte(m, &xe_bb_tmp, ccs_pt, false, false, &ccs_it, ccs_size, src);
12611264
1262− bb->len = emit_flush_invalidate(bb->cs, bb->len, flush_flags);
1263− flush_flags = xe_migrate_ccs_copy(m, bb, src_L0_ofs, src_is_pltt,
1265+ xe_bb_tmp.len = emit_flush_invalidate(xe_bb_tmp.cs, xe_bb_tmp.len,
1266+ flush_flags);
1267+ flush_flags = xe_migrate_ccs_copy(m, &xe_bb_tmp, src_L0_ofs, src_is_pltt,
12641268 src_L0_ofs, dst_is_pltt,
12651269 src_L0, ccs_ofs, true);
1266− bb->len = emit_flush_invalidate(bb->cs, bb->len, flush_flags);
1270+ xe_bb_tmp.len = emit_flush_invalidate(xe_bb_tmp.cs, xe_bb_tmp.len,
1271+ flush_flags);
12671272
12681273 size -= src_L0;
12691274 }
12701275
1271− xe_assert(xe, (batch_size_allocated == bb->len));
1276+ xe_assert(xe, (batch_size_allocated == xe_bb_tmp.len));
1277+ xe_assert(xe, bb->sa_node.size == xe_bb_tmp.len * sizeof(u32));
12721278 src_bo->bb_ccs[read_write] = bb;
12731279
12741280 xe_sriov_vf_ccs_rw_update_bb_addr(ctx);
1275− xe_sa_bo_sync_shadow(bb->bo);
1281+ xe_mem_pool_sync_shadow_locked(bb);
12761282 }
12771283
12781284 return 0;
@@ -1297,10 +1303,10 @@ int xe_migrate_ccs_rw_copy(struct xe_tile *tile, struct xe_exec_queue *q, · 18 unmodified lines
12971303 void xe_migrate_ccs_rw_copy_clear(struct xe_bo *src_bo,
12981304 enum xe_sriov_vf_ccs_rw_ctxs read_write)
12991305 {
1300− struct xe_bb *bb = src_bo->bb_ccs[read_write];
1306+ struct xe_mem_pool_node *bb = src_bo->bb_ccs[read_write];
13011307 struct xe_device *xe = xe_bo_device(src_bo);
1308+ struct xe_mem_pool *bb_pool;
13021309 struct xe_sriov_vf_ccs_ctx *ctx;
1303− struct xe_sa_manager *bb_pool;
13041310 u32 *cs;
13051311
13061312 xe_assert(xe, IS_SRIOV_VF(xe));
@@ -1308,17 +1314,17 @@ void xe_migrate_ccs_rw_copy_clear(struct xe_bo *src_bo, · 1 unmodified line
13081314 ctx = &xe->sriov.vf.ccs.contexts[read_write];
13091315 bb_pool = ctx->mem.ccs_bb_pool;
13101316
1311− guard(mutex) (xe_sa_bo_swap_guard(bb_pool));
1312− xe_sa_bo_swap_shadow(bb_pool);
1313−
1314− cs = xe_sa_bo_cpu_addr(bb->bo);
1315− memset(cs, MI_NOOP, bb->len * sizeof(u32));
1316− xe_sriov_vf_ccs_rw_update_bb_addr(ctx);
1317+ scoped_guard(mutex, xe_mem_pool_bo_swap_guard(bb_pool)) {
1318+ xe_mem_pool_swap_shadow_locked(bb_pool);
13171319
1318− xe_sa_bo_sync_shadow(bb->bo);
1320+ cs = xe_mem_pool_node_cpu_addr(bb);
1321+ memset(cs, MI_NOOP, bb->sa_node.size);
1322+ xe_sriov_vf_ccs_rw_update_bb_addr(ctx);
13191323
1320− xe_bb_free(bb, NULL);
1321− src_bo->bb_ccs[read_write] = NULL;
1324+ xe_mem_pool_sync_shadow_locked(bb);
1325+ xe_mem_pool_free_node(bb);
1326+ src_bo->bb_ccs[read_write] = NULL;
1327+ }
13221328 }
13231329
13241330 /**
drivers/gpu/drm/xe/xe_pci.c+1−0
@@ -118,6 +118,7 @@ static const struct xe_graphics_desc graphics_xe2 = { · 117 unmodified lines
118118
119119 static const struct xe_graphics_desc graphics_xe3p_lpg = {
120120 XE2_GFX_FEATURES,
121+ .has_indirect_ring_state = 1,
121122 .multi_queue_engine_class_mask = BIT(XE_ENGINE_CLASS_COPY) | BIT(XE_ENGINE_CLASS_COMPUTE),
122123 .num_geometry_xecore_fuse_regs = 3,
123124 .num_compute_xecore_fuse_regs = 3,
drivers/gpu/drm/xe/xe_reg_whitelist.c+1−1
@@ -226,7 +226,7 @@ void xe_reg_whitelist_print_entry(struct drm_printer *p, unsigned int indent, · 225 unmodified lines
226226 }
227227
228228 range_start = reg & REG_GENMASK(25, range_bit);
229− range_end = range_start | REG_GENMASK(range_bit, 0);
229+ range_end = range_start | REG_GENMASK(range_bit - 1, 0);
230230
231231 switch (val & RING_FORCE_TO_NONPRIV_ACCESS_MASK) {
232232 case RING_FORCE_TO_NONPRIV_ACCESS_RW:
drivers/gpu/drm/xe/xe_sriov_vf_ccs.c+29−25
@@ -14,9 +14,9 @@ · 13 unmodified lines
1414 #include "xe_guc.h"
1515 #include "xe_guc_submit.h"
1616 #include "xe_lrc.h"
17+#include "xe_mem_pool.h"
1718 #include "xe_migrate.h"
1819 #include "xe_pm.h"
19−#include "xe_sa.h"
2020 #include "xe_sriov_printk.h"
2121 #include "xe_sriov_vf.h"
2222 #include "xe_sriov_vf_ccs.h"
@@ -141,43 +141,47 @@ static u64 get_ccs_bb_pool_size(struct xe_device *xe) · 118 unmodified lines
141141
142142 static int alloc_bb_pool(struct xe_tile *tile, struct xe_sriov_vf_ccs_ctx *ctx)
143143 {
144+ struct xe_mem_pool *pool;
144145 struct xe_device *xe = tile_to_xe(tile);
145− struct xe_sa_manager *sa_manager;
146+ u32 *pool_cpu_addr, *last_dw_addr;
146147 u64 bb_pool_size;
147− int offset, err;
148+ int err;
148149
149150 bb_pool_size = get_ccs_bb_pool_size(xe);
150151 xe_sriov_info(xe, "Allocating %s CCS BB pool size = %lldMB\n",
151152 ctx->ctx_id ? "Restore" : "Save", bb_pool_size / SZ_1M);
152153
153− sa_manager = __xe_sa_bo_manager_init(tile, bb_pool_size, SZ_4K, SZ_16,
154− XE_SA_BO_MANAGER_FLAG_SHADOW);
155−
156− if (IS_ERR(sa_manager)) {
157− xe_sriov_err(xe, "Suballocator init failed with error: %pe\n",
158− sa_manager);
159− err = PTR_ERR(sa_manager);
154+ pool = xe_mem_pool_init(tile, bb_pool_size, sizeof(u32),
155+ XE_MEM_POOL_BO_FLAG_INIT_SHADOW_COPY);
156+ if (IS_ERR(pool)) {
157+ xe_sriov_err(xe, "xe_mem_pool_init failed with error: %pe\n",
158+ pool);
159+ err = PTR_ERR(pool);
160160 return err;
161161 }
162162
163− offset = 0;
164− xe_map_memset(xe, &sa_manager->bo->vmap, offset, MI_NOOP,
165− bb_pool_size);
166− xe_map_memset(xe, &sa_manager->shadow->vmap, offset, MI_NOOP,
167− bb_pool_size);
163+ pool_cpu_addr = xe_mem_pool_cpu_addr(pool);
164+ memset(pool_cpu_addr, 0, bb_pool_size);
168165
169− offset = bb_pool_size - sizeof(u32);
170− xe_map_wr(xe, &sa_manager->bo->vmap, offset, u32, MI_BATCH_BUFFER_END);
171− xe_map_wr(xe, &sa_manager->shadow->vmap, offset, u32, MI_BATCH_BUFFER_END);
166+ last_dw_addr = pool_cpu_addr + (bb_pool_size / sizeof(u32)) - 1;
167+ *last_dw_addr = MI_BATCH_BUFFER_END;
172168
173− ctx->mem.ccs_bb_pool = sa_manager;
169+ /**
170+ * Sync the main copy and shadow copy so that the shadow copy is
171+ * replica of main copy. We sync only BBs after init part. So, we
172+ * need to make sure the main pool and shadow copy are in sync after
173+ * this point. This is needed as GuC may read the BB commands from
174+ * shadow copy.
175+ */
176+ xe_mem_pool_sync(pool);
174177
178+ ctx->mem.ccs_bb_pool = pool;
175179 return 0;
176180 }
177181
178182 static void ccs_rw_update_ring(struct xe_sriov_vf_ccs_ctx *ctx)
179183 {
180− u64 addr = xe_sa_manager_gpu_addr(ctx->mem.ccs_bb_pool);
184+ u64 addr = xe_mem_pool_gpu_addr(ctx->mem.ccs_bb_pool);
181185 struct xe_lrc *lrc = xe_exec_queue_lrc(ctx->mig_q);
182186 u32 dw[10], i = 0;
183187
@@ -388,7 +392,7 @@ err_ret: · 204 unmodified lines
388392 #define XE_SRIOV_VF_CCS_RW_BB_ADDR_OFFSET (2 * sizeof(u32))
389393 void xe_sriov_vf_ccs_rw_update_bb_addr(struct xe_sriov_vf_ccs_ctx *ctx)
390394 {
391− u64 addr = xe_sa_manager_gpu_addr(ctx->mem.ccs_bb_pool);
395+ u64 addr = xe_mem_pool_gpu_addr(ctx->mem.ccs_bb_pool);
392396 struct xe_lrc *lrc = xe_exec_queue_lrc(ctx->mig_q);
393397 struct xe_device *xe = gt_to_xe(ctx->mig_q->gt);
394398
@@ -412,8 +416,8 @@ int xe_sriov_vf_ccs_attach_bo(struct xe_bo *bo) · 17 unmodified lines
412416 struct xe_device *xe = xe_bo_device(bo);
413417 enum xe_sriov_vf_ccs_rw_ctxs ctx_id;
414418 struct xe_sriov_vf_ccs_ctx *ctx;
419+ struct xe_mem_pool_node *bb;
415420 struct xe_tile *tile;
416− struct xe_bb *bb;
417421 int err = 0;
418422
419423 xe_assert(xe, IS_VF_CCS_READY(xe));
@@ -445,7 +449,7 @@ int xe_sriov_vf_ccs_detach_bo(struct xe_bo *bo) · 25 unmodified lines
445449 {
446450 struct xe_device *xe = xe_bo_device(bo);
447451 enum xe_sriov_vf_ccs_rw_ctxs ctx_id;
448− struct xe_bb *bb;
452+ struct xe_mem_pool_node *bb;
449453
450454 xe_assert(xe, IS_VF_CCS_READY(xe));
451455
@@ -471,8 +475,8 @@ int xe_sriov_vf_ccs_detach_bo(struct xe_bo *bo) · 19 unmodified lines
471475 */
472476 void xe_sriov_vf_ccs_print(struct xe_device *xe, struct drm_printer *p)
473477 {
474− struct xe_sa_manager *bb_pool;
475478 enum xe_sriov_vf_ccs_rw_ctxs ctx_id;
479+ struct xe_mem_pool *bb_pool;
476480
477481 if (!IS_VF_CCS_READY(xe))
478482 return;
@@ -485,7 +489,7 @@ void xe_sriov_vf_ccs_print(struct xe_device *xe, struct drm_printer *p) · 6 unmodified lines
485489
486490 drm_printf(p, "ccs %s bb suballoc info\n", ctx_id ? "write" : "read");
487491 drm_printf(p, "-------------------------\n");
488− drm_suballoc_dump_debug_info(&bb_pool->base, p, xe_sa_manager_gpu_addr(bb_pool));
492+ xe_mem_pool_dump(bb_pool, p);
489493 drm_puts(p, "\n");
490494 }
491495 }
drivers/gpu/drm/xe/xe_sriov_vf_ccs_types.h+1−4
@@ -17,9 +17,6 @@ enum xe_sriov_vf_ccs_rw_ctxs { · 16 unmodified lines
1717 XE_SRIOV_VF_CCS_CTX_COUNT
1818 };
1919
20−struct xe_migrate;
21−struct xe_sa_manager;
22−
2320 /**
2421 * struct xe_sriov_vf_ccs_ctx - VF CCS migration context data.
2522 */
@@ -33,7 +30,7 @@ struct xe_sriov_vf_ccs_ctx { · 7 unmodified lines
3330 /** @mem: memory data */
3431 struct {
3532 /** @mem.ccs_bb_pool: Pool from which batch buffers are allocated. */
36− struct xe_sa_manager *ccs_bb_pool;
33+ struct xe_mem_pool *ccs_bb_pool;
3734 } mem;
3835 };
3936
drivers/gpu/drm/xe/xe_tuning.c+1−1
@@ -97,7 +97,7 @@ static const struct xe_rtp_entry_sr gt_tunings[] = { · 96 unmodified lines
9797 { XE_RTP_NAME("Tuning: Set STLB Bank Hash Mode to 4KB"),
9898 XE_RTP_RULES(GRAPHICS_VERSION_RANGE(3510, XE_RTP_END_VERSION_UNDEFINED),
9999 IS_INTEGRATED),
100− XE_RTP_ACTIONS(FIELD_SET(XEHP_GAMSTLB_CTRL, BANK_HASH_MODE,
100+ XE_RTP_ACTIONS(FIELD_SET(GAMSTLB_CTRL, BANK_HASH_MODE,
101101 BANK_HASH_4KB_MODE))
102102 },
103103 };
drivers/gpu/drm/xe/xe_vm.c+4−1
@@ -3658,6 +3658,8 @@ static int vm_bind_ioctl_check_args(struct xe_device *xe, struct xe_vm *vm, · 3657 unmodified lines
36583658 op == DRM_XE_VM_BIND_OP_MAP_USERPTR) ||
36593659 XE_IOCTL_DBG(xe, coh_mode == XE_COH_NONE &&
36603660 op == DRM_XE_VM_BIND_OP_MAP_USERPTR) ||
3661+ XE_IOCTL_DBG(xe, !IS_DGFX(xe) && coh_mode == XE_COH_NONE &&
3662+ is_cpu_addr_mirror) ||
36613663 XE_IOCTL_DBG(xe, xe_device_is_l2_flush_optimized(xe) &&
36623664 (op == DRM_XE_VM_BIND_OP_MAP_USERPTR ||
36633665 is_cpu_addr_mirror) &&
@@ -4156,7 +4158,8 @@ int xe_vm_get_property_ioctl(struct drm_device *drm, void *data, · 492 unmodified lines
41564158 int ret = 0;
41574159
41584160 if (XE_IOCTL_DBG(xe, (args->reserved[0] || args->reserved[1] ||
4159− args->reserved[2])))
4161+ args->reserved[2] || args->extensions ||
4162+ args->pad)))
41604163 return -EINVAL;
41614164
41624165 vm = xe_vm_lookup(xef, args->vm_id);
drivers/gpu/drm/xe/xe_vm_madvise.c+47−0
@@ -621,6 +621,45 @@ static int xe_madvise_purgeable_retained_to_user(const struct xe_madvise_details · 620 unmodified lines
621621 return 0;
622622 }
623623
624+static bool check_pat_args_are_sane(struct xe_device *xe,
625+ struct xe_vmas_in_madvise_range *madvise_range,
626+ u16 pat_index)
627+{
628+ u16 coh_mode = xe_pat_index_get_coh_mode(xe, pat_index);
629+ int i;
630+
631+ /*
632+ * Using coh_none with CPU cached buffers is not allowed on iGPU.
633+ * On iGPU the GPU shares the LLC with the CPU, so with coh_none
634+ * the GPU bypasses CPU caches and reads directly from DRAM,
635+ * potentially seeing stale sensitive data from previously freed
636+ * pages. On dGPU this restriction does not apply, because the
637+ * platform does not provide a non-coherent system memory access
638+ * path that would violate the DMA coherency contract.
639+ */
640+ if (coh_mode != XE_COH_NONE || IS_DGFX(xe))
641+ return true;
642+
643+ for (i = 0; i < madvise_range->num_vmas; i++) {
644+ struct xe_vma *vma = madvise_range->vmas[i];
645+ struct xe_bo *bo = xe_vma_bo(vma);
646+
647+ if (bo) {
648+ /* BO with WB caching + COH_NONE is not allowed */
649+ if (XE_IOCTL_DBG(xe, bo->cpu_caching == DRM_XE_GEM_CPU_CACHING_WB))
650+ return false;
651+ /* Imported dma-buf without caching info, assume cached */
652+ if (XE_IOCTL_DBG(xe, !bo->cpu_caching))
653+ return false;
654+ } else if (XE_IOCTL_DBG(xe, xe_vma_is_cpu_addr_mirror(vma) ||
655+ xe_vma_is_userptr(vma)))
656+ /* System memory (userptr/SVM) is always CPU cached */
657+ return false;
658+ }
659+
660+ return true;
661+}
662+
624663 static bool check_bo_args_are_sane(struct xe_vm *vm, struct xe_vma **vmas,
625664 int num_vmas, u32 atomic_val)
626665 {
@@ -750,6 +789,14 @@ int xe_vm_madvise_ioctl(struct drm_device *dev, void *data, struct drm_file *fil · 123 unmodified lines
750789 }
751790 }
752791
792+ if (args->type == DRM_XE_MEM_RANGE_ATTR_PAT) {
793+ if (!check_pat_args_are_sane(xe, &madvise_range,
794+ args->pat_index.val)) {
795+ err = -EINVAL;
796+ goto free_vmas;
797+ }
798+ }
799+
753800 if (madvise_range.has_bo_vmas) {
754801 if (args->type == DRM_XE_MEM_RANGE_ATTR_ATOMIC) {
755802 if (!check_bo_args_are_sane(vm, madvise_range.vmas,
drivers/gpu/drm/xe/xe_wa.c+0−8
@@ -743,14 +743,6 @@ static const struct xe_rtp_entry_sr lrc_was[] = { · 742 unmodified lines
743743 XE_RTP_RULES(GRAPHICS_VERSION(2001), ENGINE_CLASS(RENDER)),
744744 XE_RTP_ACTIONS(SET(WM_CHICKEN3, HIZ_PLANE_COMPRESSION_DIS))
745745 },
746− { XE_RTP_NAME("14019988906"),
747− XE_RTP_RULES(GRAPHICS_VERSION_RANGE(2001, 2002), ENGINE_CLASS(RENDER)),
748− XE_RTP_ACTIONS(SET(XEHP_PSS_CHICKEN, FLSH_IGNORES_PSD))
749− },
750− { XE_RTP_NAME("14019877138"),
751− XE_RTP_RULES(GRAPHICS_VERSION_RANGE(2001, 2002), ENGINE_CLASS(RENDER)),
752− XE_RTP_ACTIONS(SET(XEHP_PSS_CHICKEN, FD_END_COLLECT))
753− },
754746 { XE_RTP_NAME("14021490052"),
755747 XE_RTP_RULES(GRAPHICS_VERSION(2001), ENGINE_CLASS(RENDER)),
756748 XE_RTP_ACTIONS(SET(FF_MODE,
drivers/mailbox/cix-mailbox.c+2−4
@@ -12,8 +12,6 @@ · 11 unmodified lines
1212 #include <linux/module.h>
1313 #include <linux/platform_device.h>
1414
15−#include "mailbox.h"
16−
1715 /*
1816 * The maximum transmission size is 32 words or 128 bytes.
1917 */
@@ -405,7 +403,7 @@ static int cix_mbox_startup(struct mbox_chan *chan) · 385 unmodified lines
405403 int index = cp->index, ret;
406404 u32 val;
407405
408− ret = request_irq(priv->irq, cix_mbox_isr, 0,
406+ ret = request_irq(priv->irq, cix_mbox_isr, IRQF_NO_SUSPEND,
409407 dev_name(priv->dev), chan);
410408 if (ret) {
411409 dev_err(priv->dev, "Unable to acquire IRQ %d\n", priv->irq);
@@ -415,7 +413,7 @@ static int cix_mbox_startup(struct mbox_chan *chan) · 3 unmodified lines
415413 switch (cp->type) {
416414 case CIX_MBOX_TYPE_DB:
417415 /* Overwrite txdone_method for DB channel */
418− chan->txdone_method = TXDONE_BY_ACK;
416+ chan->txdone_method = MBOX_TXDONE_BY_ACK;
419417 fallthrough;
420418 case CIX_MBOX_TYPE_REG:
421419 if (priv->dir == CIX_MBOX_TX) {
drivers/mailbox/exynos-mailbox.c+0−4
@@ -99,7 +99,6 @@ static int exynos_mbox_probe(struct platform_device *pdev) · 98 unmodified lines
9999 struct mbox_controller *mbox;
100100 struct mbox_chan *chans;
101101 struct clk *pclk;
102− int i;
103102
104103 exynos_mbox = devm_kzalloc(dev, sizeof(*exynos_mbox), GFP_KERNEL);
105104 if (!exynos_mbox)
@@ -129,9 +128,6 @@ static int exynos_mbox_probe(struct platform_device *pdev) · 23 unmodified lines
129128 mbox->ops = &exynos_mbox_chan_ops;
130129 mbox->of_xlate = exynos_mbox_of_xlate;
131130
132− for (i = 0; i < EXYNOS_MBOX_CHAN_COUNT; i++)
133− chans[i].mbox = mbox;
134−
135131 exynos_mbox->mbox = mbox;
136132
137133 platform_set_drvdata(pdev, exynos_mbox);
drivers/mailbox/hi3660-mailbox.c+0−2
@@ -15,8 +15,6 @@ · 14 unmodified lines
1515 #include <linux/platform_device.h>
1616 #include <linux/slab.h>
1717
18−#include "mailbox.h"
19−
2018 #define MBOX_CHAN_MAX 32
2119
2220 #define MBOX_RX 0x0
drivers/mailbox/hi6220-mailbox.c+5−9
@@ -79,12 +79,12 @@ struct hi6220_mbox { · 78 unmodified lines
7979 /* region for mailbox */
8080 void __iomem *base;
8181
82− unsigned int chan_num;
83− struct hi6220_mbox_chan *mchan;
84−
8582 void *irq_map_chan[MBOX_CHAN_MAX];
8683 struct mbox_chan *chan;
8784 struct mbox_controller controller;
85+
86+ unsigned int chan_num;
87+ struct hi6220_mbox_chan mchan[] __counted_by(chan_num);
8888 };
8989
9090 static void mbox_set_state(struct hi6220_mbox *mbox,
@@ -267,16 +267,12 @@ static int hi6220_mbox_probe(struct platform_device *pdev) · 176 unmodified lines
267267 struct hi6220_mbox *mbox;
268268 int i, err;
269269
270− mbox = devm_kzalloc(dev, sizeof(*mbox), GFP_KERNEL);
270+ mbox = devm_kzalloc(dev, struct_size(mbox, mchan, MBOX_CHAN_MAX), GFP_KERNEL);
271271 if (!mbox)
272272 return -ENOMEM;
273273
274− mbox->dev = dev;
275274 mbox->chan_num = MBOX_CHAN_MAX;
276− mbox->mchan = devm_kcalloc(dev,
277− mbox->chan_num, sizeof(*mbox->mchan), GFP_KERNEL);
278− if (!mbox->mchan)
279− return -ENOMEM;
275+ mbox->dev = dev;
280276
281277 mbox->chan = devm_kcalloc(dev,
282278 mbox->chan_num, sizeof(*mbox->chan), GFP_KERNEL);
drivers/mailbox/imx-mailbox.c+1−3
@@ -23,8 +23,6 @@ · 22 unmodified lines
2323 #include <linux/slab.h>
2424 #include <linux/workqueue.h>
2525
26−#include "mailbox.h"
27−
2826 #define IMX_MU_CHANS 24
2927 /* TX0/RX0/RXDB[0-3] */
3028 #define IMX_MU_SCU_CHANS 6
@@ -734,7 +732,7 @@ static struct mbox_chan * imx_mu_xlate(struct mbox_controller *mbox, · 703 unmodified lines
734732 p_chan = &mbox->chans[chan];
735733
736734 if (type == IMX_MU_TYPE_TXDB_V2)
737− p_chan->txdone_method = TXDONE_BY_ACK;
735+ p_chan->txdone_method = MBOX_TXDONE_BY_ACK;
738736
739737 return p_chan;
740738 }
drivers/mailbox/mailbox-sti.c+0−2
@@ -21,8 +21,6 @@ · 20 unmodified lines
2121 #include <linux/property.h>
2222 #include <linux/slab.h>
2323
24−#include "mailbox.h"
25−
2624 #define STI_MBOX_INST_MAX 4 /* RAM saving: Max supported instances */
2725 #define STI_MBOX_CHAN_MAX 20 /* RAM saving: Max supported channels */
2826
drivers/mailbox/mailbox-test.c+46−34
@@ -28,8 +28,6 @@ · 27 unmodified lines
2828 #define MBOX_HEXDUMP_MAX_LEN (MBOX_HEXDUMP_LINE_LEN * \
2929 (MBOX_MAX_MSG_LEN / MBOX_BYTES_PER_LINE))
3030
31−static bool mbox_data_ready;
32−
3331 struct mbox_test_device {
3432 struct device *dev;
3533 void __iomem *tx_mmio;
@@ -42,6 +40,7 @@ struct mbox_test_device { · 6 unmodified lines
4240 spinlock_t lock;
4341 struct mutex mutex;
4442 wait_queue_head_t waitq;
43+ bool data_ready;
4544 struct fasync_struct *async_queue;
4645 struct dentry *root_debugfs_dir;
4746 };
@@ -162,7 +161,7 @@ static bool mbox_test_message_data_ready(struct mbox_test_device *tdev) · 114 unmodified lines
162161 unsigned long flags;
163162
164163 spin_lock_irqsave(&tdev->lock, flags);
165− data_ready = mbox_data_ready;
164+ data_ready = tdev->data_ready;
166165 spin_unlock_irqrestore(&tdev->lock, flags);
167166
168167 return data_ready;
@@ -227,7 +226,7 @@ static ssize_t mbox_test_message_read(struct file *filp, char __user *userbuf, · 58 unmodified lines
227226 *(touser + l) = '\0';
228227
229228 memset(tdev->rx_buffer, 0, MBOX_MAX_MSG_LEN);
230− mbox_data_ready = false;
229+ tdev->data_ready = false;
231230
232231 spin_unlock_irqrestore(&tdev->lock, flags);
233232
@@ -297,7 +296,7 @@ static void mbox_test_receive_message(struct mbox_client *client, void *message) · 63 unmodified lines
297296 message, MBOX_MAX_MSG_LEN);
298297 memcpy(tdev->rx_buffer, message, MBOX_MAX_MSG_LEN);
299298 }
300− mbox_data_ready = true;
299+ tdev->data_ready = true;
301300 spin_unlock_irqrestore(&tdev->lock, flags);
302301
303302 wake_up_interruptible(&tdev->waitq);
@@ -336,7 +335,7 @@ mbox_test_request_channel(struct platform_device *pdev, const char *name) · 32 unmodified lines
336335
337336 client = devm_kzalloc(&pdev->dev, sizeof(*client), GFP_KERNEL);
338337 if (!client)
339− return ERR_PTR(-ENOMEM);
338+ return NULL;
340339
341340 client->dev = &pdev->dev;
342341 client->rx_callback = mbox_test_receive_message;
@@ -355,67 +354,80 @@ mbox_test_request_channel(struct platform_device *pdev, const char *name) · 12 unmodified lines
355354 return channel;
356355 }
357356
357+static void __iomem *mbox_test_ioremap(struct platform_device *pdev, unsigned int res_num)
358+{
359+ struct resource *res;
360+ void __iomem *mmio;
361+
362+ res = platform_get_resource(pdev, IORESOURCE_MEM, res_num);
363+ if (!res)
364+ return NULL;
365+
366+ mmio = devm_ioremap_resource(&pdev->dev, res);
367+ if (PTR_ERR(mmio) == -EBUSY) {
368+ dev_info(&pdev->dev, "trying workaround with plain ioremap\n");
369+ return devm_ioremap(&pdev->dev, res->start, resource_size(res));
370+ }
371+
372+ return IS_ERR(mmio) ? NULL : mmio;
373+}
374+
358375 static int mbox_test_probe(struct platform_device *pdev)
359376 {
360377 struct mbox_test_device *tdev;
361− struct resource *res;
362− resource_size_t size;
363378 int ret;
364379
365380 tdev = devm_kzalloc(&pdev->dev, sizeof(*tdev), GFP_KERNEL);
366381 if (!tdev)
367382 return -ENOMEM;
368383
384+ tdev->dev = &pdev->dev;
385+ spin_lock_init(&tdev->lock);
386+ mutex_init(&tdev->mutex);
387+ init_waitqueue_head(&tdev->waitq);
388+ platform_set_drvdata(pdev, tdev);
389+
369390 /* It's okay for MMIO to be NULL */
370− tdev->tx_mmio = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
371− if (PTR_ERR(tdev->tx_mmio) == -EBUSY) {
372− /* if reserved area in SRAM, try just ioremap */
373− size = resource_size(res);
374− tdev->tx_mmio = devm_ioremap(&pdev->dev, res->start, size);
375− } else if (IS_ERR(tdev->tx_mmio)) {
376− tdev->tx_mmio = NULL;
377− }
391+ tdev->tx_mmio = mbox_test_ioremap(pdev, 0);
378392
379393 /* If specified, second reg entry is Rx MMIO */
380− tdev->rx_mmio = devm_platform_get_and_ioremap_resource(pdev, 1, &res);
381− if (PTR_ERR(tdev->rx_mmio) == -EBUSY) {
382− size = resource_size(res);
383− tdev->rx_mmio = devm_ioremap(&pdev->dev, res->start, size);
384− } else if (IS_ERR(tdev->rx_mmio)) {
394+ tdev->rx_mmio = mbox_test_ioremap(pdev, 1);
395+ if (!tdev->rx_mmio)
385396 tdev->rx_mmio = tdev->tx_mmio;
386− }
387397
388398 tdev->tx_channel = mbox_test_request_channel(pdev, "tx");
389399 tdev->rx_channel = mbox_test_request_channel(pdev, "rx");
390400
391− if (IS_ERR_OR_NULL(tdev->tx_channel) && IS_ERR_OR_NULL(tdev->rx_channel))
401+ if (!tdev->tx_channel && !tdev->rx_channel)
392402 return -EPROBE_DEFER;
393403
394404 /* If Rx is not specified but has Rx MMIO, then Rx = Tx */
395405 if (!tdev->rx_channel && (tdev->rx_mmio != tdev->tx_mmio))
396406 tdev->rx_channel = tdev->tx_channel;
397407
398− tdev->dev = &pdev->dev;
399− platform_set_drvdata(pdev, tdev);
400−
401− spin_lock_init(&tdev->lock);
402− mutex_init(&tdev->mutex);
403−
404408 if (tdev->rx_channel) {
405409 tdev->rx_buffer = devm_kzalloc(&pdev->dev,
406410 MBOX_MAX_MSG_LEN, GFP_KERNEL);
407− if (!tdev->rx_buffer)
408− return -ENOMEM;
411+ if (!tdev->rx_buffer) {
412+ ret = -ENOMEM;
413+ goto err_free_chans;
414+ }
409415 }
410416
411417 ret = mbox_test_add_debugfs(pdev, tdev);
412418 if (ret)
413− return ret;
419+ goto err_free_chans;
414420
415− init_waitqueue_head(&tdev->waitq);
416421 dev_info(&pdev->dev, "Successfully registered\n");
417422
418423 return 0;
424+
425+err_free_chans:
426+ if (tdev->tx_channel)
427+ mbox_free_channel(tdev->tx_channel);
428+ if (tdev->rx_channel && tdev->rx_channel != tdev->tx_channel)
429+ mbox_free_channel(tdev->rx_channel);
430+ return ret;
419431 }
420432
421433 static void mbox_test_remove(struct platform_device *pdev)
@@ -426,7 +438,7 @@ static void mbox_test_remove(struct platform_device *pdev) · 4 unmodified lines
426438
427439 if (tdev->tx_channel)
428440 mbox_free_channel(tdev->tx_channel);
429− if (tdev->rx_channel)
441+ if (tdev->rx_channel && tdev->rx_channel != tdev->tx_channel)
430442 mbox_free_channel(tdev->rx_channel);
431443 }
432444
drivers/mailbox/mailbox.c+44−23
@@ -18,8 +18,6 @@ · 17 unmodified lines
1818 #include <linux/property.h>
1919 #include <linux/spinlock.h>
2020
21−#include "mailbox.h"
22−
2321 static LIST_HEAD(mbox_cons);
2422 static DEFINE_MUTEX(con_mutex);
2523
@@ -52,7 +50,7 @@ static void msg_submit(struct mbox_chan *chan) · 26 unmodified lines
5250 int err = -EBUSY;
5351
5452 scoped_guard(spinlock_irqsave, &chan->lock) {
55− if (!chan->msg_count || chan->active_req)
53+ if (!chan->msg_count || chan->active_req != MBOX_NO_MSG)
5654 break;
5755
5856 count = chan->msg_count;
@@ -74,7 +72,7 @@ static void msg_submit(struct mbox_chan *chan) · 15 unmodified lines
7472 }
7573 }
7674
77− if (!err && (chan->txdone_method & TXDONE_BY_POLL)) {
75+ if (!err && (chan->txdone_method & MBOX_TXDONE_BY_POLL)) {
7876 /* kick start the timer immediately to avoid delays */
7977 scoped_guard(spinlock_irqsave, &chan->mbox->poll_hrt_lock)
8078 hrtimer_start(&chan->mbox->poll_hrt, 0, HRTIMER_MODE_REL);
@@ -87,13 +85,13 @@ static void tx_tick(struct mbox_chan *chan, int r) · 6 unmodified lines
8785
8886 scoped_guard(spinlock_irqsave, &chan->lock) {
8987 mssg = chan->active_req;
90− chan->active_req = NULL;
88+ chan->active_req = MBOX_NO_MSG;
9189 }
9290
9391 /* Submit next message */
9492 msg_submit(chan);
9593
96− if (!mssg)
94+ if (mssg == MBOX_NO_MSG)
9795 return;
9896
9997 /* Notify the client */
@@ -114,7 +112,7 @@ static enum hrtimer_restart txdone_hrtimer(struct hrtimer *hrtimer) · 14 unmodified lines
114112 for (i = 0; i < mbox->num_chans; i++) {
115113 struct mbox_chan *chan = &mbox->chans[i];
116114
117− if (chan->active_req && chan->cl) {
115+ if (chan->active_req != MBOX_NO_MSG && chan->cl) {
118116 txdone = chan->mbox->ops->last_tx_done(chan);
119117 if (txdone)
120118 tx_tick(chan, 0);
@@ -164,7 +162,7 @@ EXPORT_SYMBOL_GPL(mbox_chan_received_data); · 43 unmodified lines
164162 */
165163 void mbox_chan_txdone(struct mbox_chan *chan, int r)
166164 {
167− if (unlikely(!(chan->txdone_method & TXDONE_BY_IRQ))) {
165+ if (unlikely(!(chan->txdone_method & MBOX_TXDONE_BY_IRQ))) {
168166 dev_err(chan->mbox->dev,
169167 "Controller can't run the TX ticker\n");
170168 return;
@@ -185,7 +183,7 @@ EXPORT_SYMBOL_GPL(mbox_chan_txdone); · 14 unmodified lines
185183 */
186184 void mbox_client_txdone(struct mbox_chan *chan, int r)
187185 {
188− if (unlikely(!(chan->txdone_method & TXDONE_BY_ACK))) {
186+ if (unlikely(!(chan->txdone_method & MBOX_TXDONE_BY_ACK))) {
189187 dev_err(chan->mbox->dev, "Client can't run the TX ticker\n");
190188 return;
191189 }
@@ -218,6 +216,29 @@ bool mbox_client_peek_data(struct mbox_chan *chan) · 26 unmodified lines
218216 }
219217 EXPORT_SYMBOL_GPL(mbox_client_peek_data);
220218
219+/**
220+ * mbox_chan_tx_slots_available - Query the number of available TX queue slots.
221+ * @chan: Mailbox channel to query.
222+ *
223+ * Clients may call this to check how many messages can be queued via
224+ * mbox_send_message() before the channel's TX queue is full. This helps
225+ * clients avoid the -ENOBUFS error without needing to increase
226+ * MBOX_TX_QUEUE_LEN.
227+ * This can be called from atomic context.
228+ *
229+ * Return: Number of available slots in the channel's TX queue.
230+ */
231+unsigned int mbox_chan_tx_slots_available(struct mbox_chan *chan)
232+{
233+ unsigned int ret;
234+
235+ guard(spinlock_irqsave)(&chan->lock);
236+ ret = MBOX_TX_QUEUE_LEN - chan->msg_count;
237+
238+ return ret;
239+}
240+EXPORT_SYMBOL_GPL(mbox_chan_tx_slots_available);
241+
221242 /**
222243 * mbox_send_message - For client to submit a message to be
223244 * sent to the remote.
@@ -246,7 +267,7 @@ int mbox_send_message(struct mbox_chan *chan, void *mssg) · 22 unmodified lines
246267 {
247268 int t;
248269
249− if (!chan || !chan->cl)
270+ if (!chan || !chan->cl || mssg == MBOX_NO_MSG)
250271 return -EINVAL;
251272
252273 t = add_to_rbuf(chan, mssg);
@@ -319,12 +340,12 @@ static int __mbox_bind_client(struct mbox_chan *chan, struct mbox_client *cl) · 66 unmodified lines
319340 scoped_guard(spinlock_irqsave, &chan->lock) {
320341 chan->msg_free = 0;
321342 chan->msg_count = 0;
322− chan->active_req = NULL;
343+ chan->active_req = MBOX_NO_MSG;
323344 chan->cl = cl;
324345 init_completion(&chan->tx_complete);
325346
326− if (chan->txdone_method == TXDONE_BY_POLL && cl->knows_txdone)
327− chan->txdone_method = TXDONE_BY_ACK;
347+ if (chan->txdone_method == MBOX_TXDONE_BY_POLL && cl->knows_txdone)
348+ chan->txdone_method = MBOX_TXDONE_BY_ACK;
328349 }
329350
330351 if (chan->mbox->ops->startup) {
@@ -341,7 +362,7 @@ static int __mbox_bind_client(struct mbox_chan *chan, struct mbox_client *cl) · 10 unmodified lines
341362 }
342363
343364 /**
344− * mbox_bind_client - Request a mailbox channel.
365+ * mbox_bind_client - Bind client to a mailbox channel.
345366 * @chan: The mailbox channel to bind the client to.
346367 * @cl: Identity of the client requesting the channel.
347368 *
@@ -477,9 +498,9 @@ void mbox_free_channel(struct mbox_chan *chan) · 129 unmodified lines
477498 /* The queued TX requests are simply aborted, no callbacks are made */
478499 scoped_guard(spinlock_irqsave, &chan->lock) {
479500 chan->cl = NULL;
480− chan->active_req = NULL;
481− if (chan->txdone_method == TXDONE_BY_ACK)
482− chan->txdone_method = TXDONE_BY_POLL;
501+ chan->active_req = MBOX_NO_MSG;
502+ if (chan->txdone_method == MBOX_TXDONE_BY_ACK)
503+ chan->txdone_method = MBOX_TXDONE_BY_POLL;
483504 }
484505
485506 module_put(chan->mbox->dev->driver->owner);
@@ -505,18 +526,17 @@ int mbox_controller_register(struct mbox_controller *mbox) · 19 unmodified lines
505526 {
506527 int i, txdone;
507528
508− /* Sanity check */
509− if (!mbox || !mbox->dev || !mbox->ops || !mbox->num_chans)
529+ if (!mbox || !mbox->dev || !mbox->ops || !mbox->chans || !mbox->num_chans)
510530 return -EINVAL;
511531
512532 if (mbox->txdone_irq)
513− txdone = TXDONE_BY_IRQ;
533+ txdone = MBOX_TXDONE_BY_IRQ;
514534 else if (mbox->txdone_poll)
515− txdone = TXDONE_BY_POLL;
535+ txdone = MBOX_TXDONE_BY_POLL;
516536 else /* It has to be ACK then */
517− txdone = TXDONE_BY_ACK;
537+ txdone = MBOX_TXDONE_BY_ACK;
518538
519− if (txdone == TXDONE_BY_POLL) {
539+ if (txdone == MBOX_TXDONE_BY_POLL) {
520540
521541 if (!mbox->ops->last_tx_done) {
522542 dev_err(mbox->dev, "last_tx_done method is absent\n");
@@ -532,6 +552,7 @@ int mbox_controller_register(struct mbox_controller *mbox) · 9 unmodified lines
532552
533553 chan->cl = NULL;
534554 chan->mbox = mbox;
555+ chan->active_req = MBOX_NO_MSG;
535556 chan->txdone_method = txdone;
536557 spin_lock_init(&chan->lock);
537558 }
drivers/mailbox/mailbox.h+0−12
@@ -1,12 +0,0 @@
1−/* SPDX-License-Identifier: GPL-2.0-only */
2−
3−#ifndef __MAILBOX_H
4−#define __MAILBOX_H
5−
6−#include <linux/bits.h>
7−
8−#define TXDONE_BY_IRQ BIT(0) /* controller has remote RTR irq */
9−#define TXDONE_BY_POLL BIT(1) /* controller can read status of last TX */
10−#define TXDONE_BY_ACK BIT(2) /* S/W ACK received by Client ticks the TX */
11−
12−#endif /* __MAILBOX_H */
drivers/mailbox/mtk-cmdq-mailbox.c+5−5
@@ -493,14 +493,14 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data) · 492 unmodified lines
493493 if (curr_pa == end_pa - CMDQ_INST_SIZE ||
494494 curr_pa == end_pa) {
495495 /* set to this task directly */
496− writel(task->pa_base >> cmdq->pdata->shift,
497− thread->base + CMDQ_THR_CURR_ADDR);
496+ gce_addr = cmdq_convert_gce_addr(task->pa_base, cmdq->pdata);
497+ writel(gce_addr, thread->base + CMDQ_THR_CURR_ADDR);
498498 } else {
499499 cmdq_task_insert_into_thread(task);
500500 smp_mb(); /* modify jump before enable thread */
501501 }
502− writel((task->pa_base + pkt->cmd_buf_size) >> cmdq->pdata->shift,
503− thread->base + CMDQ_THR_END_ADDR);
502+ gce_addr = cmdq_convert_gce_addr(task->pa_base + pkt->cmd_buf_size, cmdq->pdata);
503+ writel(gce_addr, thread->base + CMDQ_THR_END_ADDR);
504504 cmdq_thread_resume(thread);
505505 }
506506 list_move_tail(&task->list_entry, &thread->task_busy_list);
@@ -728,7 +728,7 @@ static int cmdq_probe(struct platform_device *pdev) · 221 unmodified lines
728728 cmdq->mbox.ops = &cmdq_mbox_chan_ops;
729729 cmdq->mbox.of_xlate = cmdq_xlate;
730730
731− /* make use of TXDONE_BY_ACK */
731+ /* make use of MBOX_TXDONE_BY_ACK */
732732 cmdq->mbox.txdone_irq = false;
733733 cmdq->mbox.txdone_poll = false;
734734
drivers/mailbox/mtk-vcp-mailbox.c+1−1
@@ -50,7 +50,7 @@ static struct mbox_chan *mtk_vcp_mbox_xlate(struct mbox_controller *mbox, · 49 unmodified lines
5050 const struct of_phandle_args *sp)
5151 {
5252 if (sp->args_count)
53− return NULL;
53+ return ERR_PTR(-EINVAL);
5454
5555 return &mbox->chans[0];
5656 }
drivers/mailbox/omap-mailbox.c+1−3
@@ -22,8 +22,6 @@ · 21 unmodified lines
2222 #include <linux/pm_runtime.h>
2323 #include <linux/mailbox_controller.h>
2424
25−#include "mailbox.h"
26−
2725 #define MAILBOX_REVISION 0x000
2826 #define MAILBOX_MESSAGE(m) (0x040 + 4 * (m))
2927 #define MAILBOX_FIFOSTATUS(m) (0x080 + 4 * (m))
@@ -240,7 +238,7 @@ static int omap_mbox_startup(struct omap_mbox *mbox) · 210 unmodified lines
240238 }
241239
242240 if (mbox->send_no_irq)
243− mbox->chan->txdone_method = TXDONE_BY_ACK;
241+ mbox->chan->txdone_method = MBOX_TXDONE_BY_ACK;
244242
245243 omap_mbox_enable_irq(mbox, IRQ_RX);
246244
drivers/mailbox/pcc.c+0−2
@@ -59,8 +59,6 @@ · 58 unmodified lines
5959 #include <linux/io-64-nonatomic-lo-hi.h>
6060 #include <acpi/pcc.h>
6161
62−#include "mailbox.h"
63−
6462 #define MBOX_IRQ_NAME "pcc-mbox"
6563
6664 /**
drivers/mailbox/rockchip-mailbox.c+2−7
@@ -46,7 +46,7 @@ struct rockchip_mbox { · 45 unmodified lines
4646 /* The maximum size of buf for each channel */
4747 u32 buf_size;
4848
49− struct rockchip_mbox_chan *chans;
49+ struct rockchip_mbox_chan chans[];
5050 };
5151
5252 static int rockchip_mbox_send_data(struct mbox_chan *chan, void *data)
@@ -173,15 +173,10 @@ static int rockchip_mbox_probe(struct platform_device *pdev) · 120 unmodified lines
173173
174174 drv_data = (const struct rockchip_mbox_data *) device_get_match_data(&pdev->dev);
175175
176− mb = devm_kzalloc(&pdev->dev, sizeof(*mb), GFP_KERNEL);
176+ mb = devm_kzalloc(&pdev->dev, struct_size(mb, chans, drv_data->num_chans), GFP_KERNEL);
177177 if (!mb)
178178 return -ENOMEM;
179179
180− mb->chans = devm_kcalloc(&pdev->dev, drv_data->num_chans,
181− sizeof(*mb->chans), GFP_KERNEL);
182− if (!mb->chans)
183− return -ENOMEM;
184−
185180 mb->mbox.chans = devm_kcalloc(&pdev->dev, drv_data->num_chans,
186181 sizeof(*mb->mbox.chans), GFP_KERNEL);
187182 if (!mb->mbox.chans)
drivers/mailbox/tegra-hsp.c+2−4
@@ -16,8 +16,6 @@ · 15 unmodified lines
1616
1717 #include <dt-bindings/mailbox/tegra186-hsp.h>
1818
19−#include "mailbox.h"
20−
2119 #define HSP_INT_IE(x) (0x100 + ((x) * 4))
2220 #define HSP_INT_IV 0x300
2321 #define HSP_INT_IR 0x304
@@ -497,7 +495,7 @@ static int tegra_hsp_mailbox_flush(struct mbox_chan *chan, · 473 unmodified lines
497495 mbox_chan_txdone(chan, 0);
498496
499497 /* Wait until channel is empty */
500− if (chan->active_req != NULL)
498+ if (chan->active_req != MBOX_NO_MSG)
501499 continue;
502500
503501 return 0;
@@ -516,7 +514,7 @@ static int tegra_hsp_mailbox_startup(struct mbox_chan *chan) · 12 unmodified lines
516514 struct tegra_hsp *hsp = mb->channel.hsp;
517515 unsigned long flags;
518516
519− chan->txdone_method = TXDONE_BY_IRQ;
517+ chan->txdone_method = MBOX_TXDONE_BY_IRQ;
520518
521519 /*
522520 * Shared mailboxes start out as consumers by default. FULL and EMPTY
drivers/md/md-bitmap.c+119−12
@@ -216,6 +216,7 @@ struct bitmap { · 215 unmodified lines
216216 };
217217
218218 static struct workqueue_struct *md_bitmap_wq;
219+static struct attribute_group md_bitmap_internal_group;
219220
220221 static int __bitmap_resize(struct bitmap *bitmap, sector_t blocks,
221222 int chunksize, bool init);
@@ -2580,6 +2581,30 @@ static int bitmap_resize(struct mddev *mddev, sector_t blocks, int chunksize) · 2358 unmodified lines
25802581 return __bitmap_resize(bitmap, blocks, chunksize, false);
25812582 }
25822583
2584+static bool bitmap_none_enabled(void *data, bool flush)
2585+{
2586+ return false;
2587+}
2588+
2589+static int bitmap_none_create(struct mddev *mddev)
2590+{
2591+ return 0;
2592+}
2593+
2594+static int bitmap_none_load(struct mddev *mddev)
2595+{
2596+ return 0;
2597+}
2598+
2599+static void bitmap_none_destroy(struct mddev *mddev)
2600+{
2601+}
2602+
2603+static int bitmap_none_get_stats(void *data, struct md_bitmap_stats *stats)
2604+{
2605+ return -ENOENT;
2606+}
2607+
25832608 static ssize_t
25842609 location_show(struct mddev *mddev, char *page)
25852610 {
@@ -2618,7 +2643,11 @@ location_store(struct mddev *mddev, const char *buf, size_t len) · 32 unmodified lines
26182643 goto out;
26192644 }
26202645
2621− bitmap_destroy(mddev);
2646+ sysfs_unmerge_group(&mddev->kobj, &md_bitmap_internal_group);
2647+ md_bitmap_destroy_nosysfs(mddev);
2648+ mddev->bitmap_id = ID_BITMAP_NONE;
2649+ if (!mddev_set_bitmap_ops_nosysfs(mddev))
2650+ goto none_err;
26222651 mddev->bitmap_info.offset = 0;
26232652 if (mddev->bitmap_info.file) {
26242653 struct file *f = mddev->bitmap_info.file;
@@ -2654,16 +2683,25 @@ location_store(struct mddev *mddev, const char *buf, size_t len) · 29 unmodified lines
26542683 }
26552684
26562685 mddev->bitmap_info.offset = offset;
2657− rv = bitmap_create(mddev);
2686+ md_bitmap_destroy_nosysfs(mddev);
2687+ mddev->bitmap_id = ID_BITMAP;
2688+ if (!mddev_set_bitmap_ops_nosysfs(mddev))
2689+ goto bitmap_err;
2690+
2691+ rv = md_bitmap_create_nosysfs(mddev);
26582692 if (rv)
2659− goto out;
2693+ goto create_err;
26602694
2661− rv = bitmap_load(mddev);
2695+ rv = mddev->bitmap_ops->load(mddev);
26622696 if (rv) {
26632697 mddev->bitmap_info.offset = 0;
2664− bitmap_destroy(mddev);
2665− goto out;
2698+ goto load_err;
26662699 }
2700+
2701+ rv = sysfs_merge_group(&mddev->kobj,
2702+ &md_bitmap_internal_group);
2703+ if (rv)
2704+ goto merge_err;
26672705 }
26682706 }
26692707 if (!mddev->external) {
@@ -2679,6 +2717,22 @@ out: · 9 unmodified lines
26792717 if (rv)
26802718 return rv;
26812719 return len;
2720+
2721+merge_err:
2722+ mddev->bitmap_info.offset = 0;
2723+load_err:
2724+ md_bitmap_destroy_nosysfs(mddev);
2725+create_err:
2726+ mddev->bitmap_info.offset = 0;
2727+ mddev->bitmap_id = ID_BITMAP_NONE;
2728+ if (!mddev_set_bitmap_ops_nosysfs(mddev))
2729+ rv = -ENOENT;
2730+ goto out;
2731+bitmap_err:
2732+ rv = -ENOENT;
2733+none_err:
2734+ mddev->bitmap_info.offset = 0;
2735+ goto out;
26822736 }
26832737
26842738 static struct md_sysfs_entry bitmap_location =
@@ -2955,8 +3009,12 @@ static struct md_sysfs_entry max_backlog_used = · 270 unmodified lines
29553009 __ATTR(max_backlog_used, S_IRUGO | S_IWUSR,
29563010 behind_writes_used_show, behind_writes_used_reset);
29573011
2958−static struct attribute *md_bitmap_attrs[] = {
3012+static struct attribute *md_bitmap_common_attrs[] = {
29593013 &bitmap_location.attr,
3014+ NULL
3015+};
3016+
3017+static struct attribute *md_bitmap_internal_attrs[] = {
29603018 &bitmap_space.attr,
29613019 &bitmap_timeout.attr,
29623020 &bitmap_backlog.attr,
@@ -2967,9 +3025,41 @@ static struct attribute *md_bitmap_attrs[] = { · 4 unmodified lines
29673025 NULL
29683026 };
29693027
2970−static struct attribute_group md_bitmap_group = {
3028+static struct attribute_group md_bitmap_common_group = {
29713029 .name = "bitmap",
2972− .attrs = md_bitmap_attrs,
3030+ .attrs = md_bitmap_common_attrs,
3031+};
3032+
3033+static struct attribute_group md_bitmap_internal_group = {
3034+ .name = "bitmap",
3035+ .attrs = md_bitmap_internal_attrs,
3036+};
3037+
3038+static const struct attribute_group *bitmap_groups[] = {
3039+ &md_bitmap_common_group,
3040+ &md_bitmap_internal_group,
3041+ NULL,
3042+};
3043+
3044+static const struct attribute_group *bitmap_none_groups[] = {
3045+ &md_bitmap_common_group,
3046+ NULL,
3047+};
3048+
3049+static struct bitmap_operations bitmap_none_ops = {
3050+ .head = {
3051+ .type = MD_BITMAP,
3052+ .id = ID_BITMAP_NONE,
3053+ .name = "none",
3054+ },
3055+
3056+ .enabled = bitmap_none_enabled,
3057+ .create = bitmap_none_create,
3058+ .load = bitmap_none_load,
3059+ .destroy = bitmap_none_destroy,
3060+ .get_stats = bitmap_none_get_stats,
3061+
3062+ .groups = bitmap_none_groups,
29733063 };
29743064
29753065 static struct bitmap_operations bitmap_ops = {
@@ -3013,21 +3103,38 @@ static struct bitmap_operations bitmap_ops = { · 37 unmodified lines
30133103 .set_pages = bitmap_set_pages,
30143104 .free = md_bitmap_free,
30153105
3016− .group = &md_bitmap_group,
3106+ .groups = bitmap_groups,
30173107 };
30183108
30193109 int md_bitmap_init(void)
30203110 {
3111+ int err;
3112+
30213113 md_bitmap_wq = alloc_workqueue("md_bitmap", WQ_MEM_RECLAIM | WQ_UNBOUND,
30223114 0);
30233115 if (!md_bitmap_wq)
30243116 return -ENOMEM;
30253117
3026− return register_md_submodule(&bitmap_ops.head);
3118+ err = register_md_submodule(&bitmap_none_ops.head);
3119+ if (err)
3120+ goto err_wq;
3121+
3122+ err = register_md_submodule(&bitmap_ops.head);
3123+ if (err)
3124+ goto err_none;
3125+
3126+ return 0;
3127+
3128+err_none:
3129+ unregister_md_submodule(&bitmap_none_ops.head);
3130+err_wq:
3131+ destroy_workqueue(md_bitmap_wq);
3132+ return err;
30273133 }
30283134
30293135 void md_bitmap_exit(void)
30303136 {
3031− destroy_workqueue(md_bitmap_wq);
30323137 unregister_md_submodule(&bitmap_ops.head);
3138+ unregister_md_submodule(&bitmap_none_ops.head);
3139+ destroy_workqueue(md_bitmap_wq);
30333140 }
drivers/md/md-bitmap.h+1−1
@@ -125,7 +125,7 @@ struct bitmap_operations { · 124 unmodified lines
125125 void (*set_pages)(void *data, unsigned long pages);
126126 void (*free)(void *data);
127127
128− struct attribute_group *group;
128+ const struct attribute_group **groups;
129129 };
130130
131131 /* the bitmap API */
drivers/md/md-llbitmap.c+6−1
@@ -1738,6 +1738,11 @@ static struct attribute_group md_llbitmap_group = { · 1737 unmodified lines
17381738 .attrs = md_llbitmap_attrs,
17391739 };
17401740
1741+static const struct attribute_group *md_llbitmap_groups[] = {
1742+ &md_llbitmap_group,
1743+ NULL,
1744+};
1745+
17411746 static struct bitmap_operations llbitmap_ops = {
17421747 .head = {
17431748 .type = MD_BITMAP,
@@ -1774,7 +1779,7 @@ static struct bitmap_operations llbitmap_ops = { · 30 unmodified lines
17741779 .dirty_bits = llbitmap_dirty_bits,
17751780 .write_all = llbitmap_write_all,
17761781
1777− .group = &md_llbitmap_group,
1782+ .groups = md_llbitmap_groups,
17781783 };
17791784
17801785 int md_llbitmap_init(void)
drivers/md/md.c+102−80
@@ -396,27 +396,19 @@ bool md_handle_request(struct mddev *mddev, struct bio *bio) · 395 unmodified lines
396396 {
397397 check_suspended:
398398 if (is_suspended(mddev, bio)) {
399− DEFINE_WAIT(__wait);
400399 /* Bail out if REQ_NOWAIT is set for the bio */
401400 if (bio->bi_opf & REQ_NOWAIT) {
402401 bio_wouldblock_error(bio);
403402 return true;
404403 }
405− for (;;) {
406− prepare_to_wait(&mddev->sb_wait, &__wait,
407− TASK_UNINTERRUPTIBLE);
408− if (!is_suspended(mddev, bio))
409− break;
410− schedule();
411− }
412− finish_wait(&mddev->sb_wait, &__wait);
404+ wait_event(mddev->sb_wait, !is_suspended(mddev, bio));
413405 }
414406 if (!percpu_ref_tryget_live(&mddev->active_io))
415407 goto check_suspended;
416408
417409 if (!mddev->pers->make_request(mddev, bio)) {
418410 percpu_ref_put(&mddev->active_io);
419− if (!mddev->gendisk && mddev->pers->prepare_suspend)
411+ if (mddev_is_dm(mddev) && mddev->pers->prepare_suspend)
420412 return false;
421413 goto check_suspended;
422414 }
@@ -687,13 +679,38 @@ static void active_io_release(struct percpu_ref *ref) · 264 unmodified lines
687679
688680 static void no_op(struct percpu_ref *r) {}
689681
690−static bool mddev_set_bitmap_ops(struct mddev *mddev)
682+static void md_bitmap_sysfs_add(struct mddev *mddev)
683+{
684+ if (sysfs_update_groups(&mddev->kobj, mddev->bitmap_ops->groups))
685+ pr_warn("md: cannot register extra bitmap attributes for %s\n",
686+ mdname(mddev));
687+ else
688+ /*
689+ * Inform user with KOBJ_CHANGE about new bitmap
690+ * attributes.
691+ */
692+ kobject_uevent(&mddev->kobj, KOBJ_CHANGE);
693+}
694+
695+static void md_bitmap_sysfs_del(struct mddev *mddev)
696+{
697+ int nr_groups = 0;
698+
699+ for (nr_groups = 0; mddev->bitmap_ops->groups[nr_groups]; nr_groups++)
700+ ;
701+
702+ while (--nr_groups >= 1)
703+ sysfs_unmerge_group(&mddev->kobj,
704+ mddev->bitmap_ops->groups[nr_groups]);
705+ sysfs_remove_group(&mddev->kobj, mddev->bitmap_ops->groups[0]);
706+}
707+
708+bool mddev_set_bitmap_ops_nosysfs(struct mddev *mddev)
691709 {
692− struct bitmap_operations *old = mddev->bitmap_ops;
693710 struct md_submodule_head *head;
694711
695− if (mddev->bitmap_id == ID_BITMAP_NONE ||
696− (old && old->head.id == mddev->bitmap_id))
712+ if (mddev->bitmap_ops &&
713+ mddev->bitmap_ops->head.id == mddev->bitmap_id)
697714 return true;
698715
699716 xa_lock(&md_submodule);
@@ -711,18 +728,6 @@ static bool mddev_set_bitmap_ops(struct mddev *mddev) · 11 unmodified lines
711728
712729 mddev->bitmap_ops = (void *)head;
713730 xa_unlock(&md_submodule);
714−
715− if (!mddev_is_dm(mddev) && mddev->bitmap_ops->group) {
716− if (sysfs_create_group(&mddev->kobj, mddev->bitmap_ops->group))
717− pr_warn("md: cannot register extra bitmap attributes for %s\n",
718− mdname(mddev));
719− else
720− /*
721− * Inform user with KOBJ_CHANGE about new bitmap
722− * attributes.
723− */
724− kobject_uevent(&mddev->kobj, KOBJ_CHANGE);
725− }
726731 return true;
727732
728733 err:
@@ -730,15 +735,6 @@ err: · 1 unmodified line
730735 return false;
731736 }
732737
733−static void mddev_clear_bitmap_ops(struct mddev *mddev)
734−{
735− if (!mddev_is_dm(mddev) && mddev->bitmap_ops &&
736− mddev->bitmap_ops->group)
737− sysfs_remove_group(&mddev->kobj, mddev->bitmap_ops->group);
738−
739− mddev->bitmap_ops = NULL;
740−}
741−
742738 int mddev_init(struct mddev *mddev)
743739 {
744740 int err = 0;
@@ -4279,7 +4275,7 @@ bitmap_type_show(struct mddev *mddev, char *page) · 3534 unmodified lines
42794275
42804276 xa_lock(&md_submodule);
42814277 xa_for_each(&md_submodule, i, head) {
4282− if (head->type != MD_BITMAP)
4278+ if (head->type != MD_BITMAP || head->id == ID_BITMAP_NONE)
42834279 continue;
42844280
42854281 if (mddev->bitmap_id == head->id)
@@ -6059,10 +6055,7 @@ static struct attribute *md_default_attrs[] = { · 1773 unmodified lines
60596055 &md_logical_block_size.attr,
60606056 NULL,
60616057 };
6062−
6063−static const struct attribute_group md_default_group = {
6064− .attrs = md_default_attrs,
6065−};
6058+ATTRIBUTE_GROUPS(md_default);
60666059
60676060 static struct attribute *md_redundancy_attrs[] = {
60686061 &md_scan_mode.attr,
@@ -6087,11 +6080,6 @@ static const struct attribute_group md_redundancy_group = { · 18 unmodified lines
60876080 .attrs = md_redundancy_attrs,
60886081 };
60896082
6090−static const struct attribute_group *md_attr_groups[] = {
6091− &md_default_group,
6092− NULL,
6093−};
6094−
60956083 static ssize_t
60966084 md_attr_show(struct kobject *kobj, struct attribute *attr, char *page)
60976085 {
@@ -6174,7 +6162,7 @@ static const struct sysfs_ops md_sysfs_ops = { · 76 unmodified lines
61746162 static const struct kobj_type md_ktype = {
61756163 .release = md_kobj_release,
61766164 .sysfs_ops = &md_sysfs_ops,
6177− .default_groups = md_attr_groups,
6165+ .default_groups = md_default_groups,
61786166 };
61796167
61806168 int mdp_major = 0;
@@ -6539,7 +6527,7 @@ out: · 358 unmodified lines
65396527 return id;
65406528 }
65416529
6542−static int md_bitmap_create(struct mddev *mddev)
6530+int md_bitmap_create_nosysfs(struct mddev *mddev)
65436531 {
65446532 enum md_submodule_id orig_id = mddev->bitmap_id;
65456533 enum md_submodule_id sb_id;
@@ -6548,8 +6536,10 @@ static int md_bitmap_create(struct mddev *mddev) · 2 unmodified lines
65486536 if (mddev->bitmap_id == ID_BITMAP_NONE)
65496537 return -EINVAL;
65506538
6551− if (!mddev_set_bitmap_ops(mddev))
6539+ if (!mddev_set_bitmap_ops_nosysfs(mddev)) {
6540+ mddev->bitmap_id = orig_id;
65526541 return -ENOENT;
6542+ }
65536543
65546544 err = mddev->bitmap_ops->create(mddev);
65556545 if (!err)
@@ -6560,37 +6550,72 @@ static int md_bitmap_create(struct mddev *mddev) · 4 unmodified lines
65606550 * doesn't match, and mdadm is not the latest version to set
65616551 * bitmap_type, set bitmap_ops based on the disk version.
65626552 */
6563− mddev_clear_bitmap_ops(mddev);
6553+ mddev->bitmap_ops = NULL;
65646554
65656555 sb_id = md_bitmap_get_id_from_sb(mddev);
6566− if (sb_id == ID_BITMAP_NONE || sb_id == orig_id)
6556+ if (sb_id == ID_BITMAP_NONE || sb_id == orig_id) {
6557+ mddev->bitmap_id = orig_id;
65676558 return err;
6559+ }
65686560
65696561 pr_info("md: %s: bitmap version mismatch, switching from %d to %d\n",
65706562 mdname(mddev), orig_id, sb_id);
65716563
65726564 mddev->bitmap_id = sb_id;
6573− if (!mddev_set_bitmap_ops(mddev)) {
6565+ if (!mddev_set_bitmap_ops_nosysfs(mddev)) {
65746566 mddev->bitmap_id = orig_id;
65756567 return -ENOENT;
65766568 }
65776569
65786570 err = mddev->bitmap_ops->create(mddev);
65796571 if (err) {
6580− mddev_clear_bitmap_ops(mddev);
6572+ mddev->bitmap_ops = NULL;
65816573 mddev->bitmap_id = orig_id;
65826574 }
65836575
65846576 return err;
65856577 }
65866578
6587−static void md_bitmap_destroy(struct mddev *mddev)
6579+static int md_bitmap_create(struct mddev *mddev)
6580+{
6581+ int err;
6582+
6583+ err = md_bitmap_create_nosysfs(mddev);
6584+ if (err)
6585+ return err;
6586+
6587+ if (!mddev_is_dm(mddev) && mddev->bitmap_ops->groups)
6588+ md_bitmap_sysfs_add(mddev);
6589+
6590+ return 0;
6591+}
6592+
6593+void md_bitmap_destroy_nosysfs(struct mddev *mddev)
65886594 {
65896595 if (!md_bitmap_registered(mddev))
65906596 return;
65916597
65926598 mddev->bitmap_ops->destroy(mddev);
6593− mddev_clear_bitmap_ops(mddev);
6599+ mddev->bitmap_ops = NULL;
6600+}
6601+
6602+static void md_bitmap_destroy(struct mddev *mddev)
6603+{
6604+ if (!mddev_is_dm(mddev) && mddev->bitmap_ops &&
6605+ mddev->bitmap_ops->groups)
6606+ md_bitmap_sysfs_del(mddev);
6607+
6608+ md_bitmap_destroy_nosysfs(mddev);
6609+}
6610+
6611+static void md_bitmap_set_none(struct mddev *mddev)
6612+{
6613+ mddev->bitmap_id = ID_BITMAP_NONE;
6614+ if (!mddev_set_bitmap_ops_nosysfs(mddev))
6615+ return;
6616+
6617+ if (!mddev_is_dm(mddev) && mddev->bitmap_ops->groups)
6618+ md_bitmap_sysfs_add(mddev);
65946619 }
65956620
65966621 int md_run(struct mddev *mddev)
@@ -6713,7 +6738,7 @@ int md_run(struct mddev *mddev) · 116 unmodified lines
67136738 }
67146739
67156740 /* dm-raid expect sync_thread to be frozen until resume */
6716− if (mddev->gendisk)
6741+ if (!mddev_is_dm(mddev))
67176742 mddev->recovery = 0;
67186743
67196744 /* may be over-ridden by personality */
@@ -6802,6 +6827,10 @@ int md_run(struct mddev *mddev) · 82 unmodified lines
68026827 if (mddev->sb_flags)
68036828 md_update_sb(mddev, 0);
68046829
6830+ if (IS_ENABLED(CONFIG_MD_BITMAP) && !mddev->bitmap_info.file &&
6831+ !mddev->bitmap_info.offset)
6832+ md_bitmap_set_none(mddev);
6833+
68056834 md_new_event();
68066835 return 0;
68076836
@@ -7747,7 +7776,8 @@ static int set_bitmap_file(struct mddev *mddev, int fd) · 939 unmodified lines
77477776 {
77487777 int err = 0;
77497778
7750− if (!md_bitmap_registered(mddev))
7779+ if (!md_bitmap_registered(mddev) ||
7780+ mddev->bitmap_id == ID_BITMAP_NONE)
77517781 return -EINVAL;
77527782
77537783 if (mddev->pers) {
@@ -7812,10 +7842,12 @@ static int set_bitmap_file(struct mddev *mddev, int fd) · 58 unmodified lines
78127842
78137843 if (err) {
78147844 md_bitmap_destroy(mddev);
7845+ md_bitmap_set_none(mddev);
78157846 fd = -1;
78167847 }
78177848 } else if (fd < 0) {
78187849 md_bitmap_destroy(mddev);
7850+ md_bitmap_set_none(mddev);
78197851 }
78207852 }
78217853
@@ -8122,12 +8154,16 @@ static int update_array_info(struct mddev *mddev, mdu_array_info_t *info) · 300 unmodified lines
81228154 mddev->bitmap_info.default_offset;
81238155 mddev->bitmap_info.space =
81248156 mddev->bitmap_info.default_space;
8157+ mddev->bitmap_id = ID_BITMAP;
81258158 rv = md_bitmap_create(mddev);
81268159 if (!rv)
81278160 rv = mddev->bitmap_ops->load(mddev);
81288161
8129− if (rv)
8162+ if (rv) {
81308163 md_bitmap_destroy(mddev);
8164+ mddev->bitmap_info.offset = 0;
8165+ md_bitmap_set_none(mddev);
8166+ }
81318167 } else {
81328168 struct md_bitmap_stats stats;
81338169
@@ -8155,6 +8191,7 @@ static int update_array_info(struct mddev *mddev, mdu_array_info_t *info) · 21 unmodified lines
81558191 }
81568192 md_bitmap_destroy(mddev);
81578193 mddev->bitmap_info.offset = 0;
8194+ md_bitmap_set_none(mddev);
81588195 }
81598196 }
81608197 md_update_sb(mddev, 1);
@@ -9341,9 +9378,11 @@ static void md_bitmap_end(struct mddev *mddev, struct md_io_clone *md_io_clone) · 1180 unmodified lines
93419378
93429379 static void md_end_clone_io(struct bio *bio)
93439380 {
9344− struct md_io_clone *md_io_clone = bio->bi_private;
9381+ struct md_io_clone *md_io_clone = container_of(bio, struct md_io_clone,
9382+ bio_clone);
93459383 struct bio *orig_bio = md_io_clone->orig_bio;
93469384 struct mddev *mddev = md_io_clone->mddev;
9385+ struct completion *reshape_completion = bio->bi_private;
93479386
93489387 if (bio_data_dir(orig_bio) == WRITE && md_bitmap_enabled(mddev, false))
93499388 md_bitmap_end(mddev, md_io_clone);
@@ -9355,7 +9394,10 @@ static void md_end_clone_io(struct bio *bio) · 5 unmodified lines
93559394 bio_end_io_acct(orig_bio, md_io_clone->start_time);
93569395
93579396 bio_put(bio);
9358− bio_endio(orig_bio);
9397+ if (unlikely(reshape_completion))
9398+ complete(reshape_completion);
9399+ else
9400+ bio_endio(orig_bio);
93599401 percpu_ref_put(&mddev->active_io);
93609402 }
93619403
@@ -9380,7 +9422,7 @@ static void md_clone_bio(struct mddev *mddev, struct bio **bio) · 18 unmodified lines
93809422 }
93819423
93829424 clone->bi_end_io = md_end_clone_io;
9383− clone->bi_private = md_io_clone;
9425+ clone->bi_private = NULL;
93849426 *bio = clone;
93859427 }
93869428
@@ -9391,26 +9433,6 @@ void md_account_bio(struct mddev *mddev, struct bio **bio) · 4 unmodified lines
93919433 }
93929434 EXPORT_SYMBOL_GPL(md_account_bio);
93939435
9394−void md_free_cloned_bio(struct bio *bio)
9395−{
9396− struct md_io_clone *md_io_clone = bio->bi_private;
9397− struct bio *orig_bio = md_io_clone->orig_bio;
9398− struct mddev *mddev = md_io_clone->mddev;
9399−
9400− if (bio_data_dir(orig_bio) == WRITE && md_bitmap_enabled(mddev, false))
9401− md_bitmap_end(mddev, md_io_clone);
9402−
9403− if (bio->bi_status && !orig_bio->bi_status)
9404− orig_bio->bi_status = bio->bi_status;
9405−
9406− if (md_io_clone->start_time)
9407− bio_end_io_acct(orig_bio, md_io_clone->start_time);
9408−
9409− bio_put(bio);
9410− percpu_ref_put(&mddev->active_io);
9411−}
9412−EXPORT_SYMBOL_GPL(md_free_cloned_bio);
9413−
94149436 /* md_allow_write(mddev)
94159437 * Calling this ensures that the array is marked 'active' so that writes
94169438 * may proceed without blocking. It is important to call this before
drivers/md/md.h+4−2
@@ -920,7 +920,6 @@ extern void md_finish_reshape(struct mddev *mddev); · 919 unmodified lines
920920 void md_submit_discard_bio(struct mddev *mddev, struct md_rdev *rdev,
921921 struct bio *bio, sector_t start, sector_t size);
922922 void md_account_bio(struct mddev *mddev, struct bio **bio);
923−void md_free_cloned_bio(struct bio *bio);
924923
925924 extern bool __must_check md_flush_request(struct mddev *mddev, struct bio *bio);
926925 void md_write_metadata(struct mddev *mddev, struct md_rdev *rdev,
@@ -935,6 +934,9 @@ extern void md_allow_write(struct mddev *mddev); · 8 unmodified lines
935934 extern void md_wait_for_blocked_rdev(struct md_rdev *rdev, struct mddev *mddev);
936935 extern void md_set_array_sectors(struct mddev *mddev, sector_t array_sectors);
937936 extern int md_check_no_bitmap(struct mddev *mddev);
937+bool mddev_set_bitmap_ops_nosysfs(struct mddev *mddev);
938+int md_bitmap_create_nosysfs(struct mddev *mddev);
939+void md_bitmap_destroy_nosysfs(struct mddev *mddev);
938940 extern int md_integrity_register(struct mddev *mddev);
939941 extern int strict_strtoul_scaled(const char *cp, unsigned long *res, int scale);
940942
@@ -1015,7 +1017,7 @@ static inline int mddev_suspend_and_lock(struct mddev *mddev) · 74 unmodified lines
10151017 static inline void mddev_suspend_and_lock_nointr(struct mddev *mddev)
10161018 {
10171019 mddev_suspend(mddev, false);
1018− mutex_lock(&mddev->reconfig_mutex);
1020+ mddev_lock_nointr(mddev);
10191021 }
10201022
10211023 static inline void mddev_unlock_and_resume(struct mddev *mddev)
drivers/md/persistent-data/dm-btree-remove.c+8−0
@@ -490,12 +490,20 @@ static int rebalance_children(struct shadow_spine *s, · 489 unmodified lines
490490
491491 if (le32_to_cpu(n->header.nr_entries) == 1) {
492492 struct dm_block *child;
493+ int is_shared;
493494 dm_block_t b = value64(n, 0);
494495
496+ r = dm_tm_block_is_shared(info->tm, b, &is_shared);
497+ if (r)
498+ return r;
499+
495500 r = dm_tm_read_lock(info->tm, b, &btree_node_validator, &child);
496501 if (r)
497502 return r;
498503
504+ if (is_shared)
505+ inc_children(info->tm, dm_block_data(child), vt);
506+
499507 memcpy(n, dm_block_data(child),
500508 dm_bm_block_size(dm_tm_get_bm(info->tm)));
501509
drivers/md/raid1-10.c+6−1
@@ -293,8 +293,13 @@ static inline bool raid1_should_read_first(struct mddev *mddev, · 292 unmodified lines
293293 * bio with REQ_RAHEAD or REQ_NOWAIT can fail at anytime, before such IO is
294294 * submitted to the underlying disks, hence don't record badblocks or retry
295295 * in this case.
296+ *
297+ * BLK_STS_INVAL means the bio was not valid for the underlying device. This
298+ * is a user error, not a device failure, so retrying or recording bad blocks
299+ * would be wrong.
296300 */
297301 static inline bool raid1_should_handle_error(struct bio *bio)
298302 {
299− return !(bio->bi_opf & (REQ_RAHEAD | REQ_NOWAIT));
303+ return !(bio->bi_opf & (REQ_RAHEAD | REQ_NOWAIT)) &&
304+ bio->bi_status != BLK_STS_INVAL;
300305 }
drivers/md/raid1.c+4−11
@@ -1510,21 +1510,14 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, · 1509 unmodified lines
15101510 mddev->cluster_ops->area_resyncing(mddev, WRITE,
15111511 bio->bi_iter.bi_sector, bio_end_sector(bio))) {
15121512
1513− DEFINE_WAIT(w);
15141513 if (bio->bi_opf & REQ_NOWAIT) {
15151514 bio_wouldblock_error(bio);
15161515 return;
15171516 }
1518− for (;;) {
1519− prepare_to_wait(&conf->wait_barrier,
1520− &w, TASK_IDLE);
1521− if (!mddev->cluster_ops->area_resyncing(mddev, WRITE,
1522− bio->bi_iter.bi_sector,
1523− bio_end_sector(bio)))
1524− break;
1525− schedule();
1526− }
1527− finish_wait(&conf->wait_barrier, &w);
1517+ wait_event_idle(conf->wait_barrier,
1518+ !mddev->cluster_ops->area_resyncing(mddev, WRITE,
1519+ bio->bi_iter.bi_sector,
1520+ bio_end_sector(bio)));
15281521 }
15291522
15301523 /*
drivers/md/raid10.c+2−0
@@ -3791,6 +3791,8 @@ static int setup_geo(struct geom *geo, struct mddev *mddev, enum geo_type new) · 3790 unmodified lines
37913791 nc = layout & 255;
37923792 fc = (layout >> 8) & 255;
37933793 fo = layout & (1<<16);
3794+ if (!nc || !fc)
3795+ return -1;
37943796 geo->raid_disks = disks;
37953797 geo->near_copies = nc;
37963798 geo->far_copies = fc;
drivers/md/raid5.c+6−1
@@ -6217,7 +6217,12 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) · 6216 unmodified lines
62176217
62186218 mempool_free(ctx, conf->ctx_pool);
62196219 if (res == STRIPE_WAIT_RESHAPE) {
6220− md_free_cloned_bio(bi);
6220+ DECLARE_COMPLETION_ONSTACK(done);
6221+ WRITE_ONCE(bi->bi_private, &done);
6222+
6223+ bio_endio(bi);
6224+
6225+ wait_for_completion(&done);
62216226 return false;
62226227 }
62236228
drivers/mtd/nand/raw/Kconfig+1−1
@@ -71,7 +71,7 @@ config MTD_NAND_AU1550 · 70 unmodified lines
7171
7272 config MTD_NAND_NDFC
7373 tristate "IBM/MCC 4xx NAND controller"
74− depends on 4xx
74+ depends on 44x || COMPILE_TEST
7575 select MTD_NAND_ECC_SW_HAMMING
7676 select MTD_NAND_ECC_SW_HAMMING_SMC
7777 help
drivers/mtd/nand/raw/nand_base.c+12−12
@@ -175,7 +175,7 @@ void nand_select_target(struct nand_chip *chip, unsigned int cs) · 174 unmodified lines
175175 * cs should always lie between 0 and nanddev_ntargets(), when that's
176176 * not the case it's a bug and the caller should be fixed.
177177 */
178− if (WARN_ON(cs > nanddev_ntargets(&chip->base)))
178+ if (WARN_ON(cs >= nanddev_ntargets(&chip->base)))
179179 return;
180180
181181 chip->cur_cs = cs;
@@ -1216,32 +1216,32 @@ static int nand_lp_exec_read_page_op(struct nand_chip *chip, unsigned int page, · 1034 unmodified lines
12161216 return nand_exec_op(chip, &op);
12171217 }
12181218
1219−static unsigned int rawnand_last_page_of_lun(unsigned int pages_per_lun, unsigned int lun)
1219+static unsigned int rawnand_last_page_of_block(unsigned int ppb, unsigned int block)
12201220 {
1221− /* lun is expected to be very small */
1222− return (lun * pages_per_lun) + pages_per_lun - 1;
1221+ /* block is expected to be very small */
1222+ return (block * ppb) + ppb - 1;
12231223 }
12241224
12251225 static void rawnand_cap_cont_reads(struct nand_chip *chip)
12261226 {
12271227 struct nand_memory_organization *memorg;
1228− unsigned int ppl, first_lun, last_lun;
1228+ unsigned int ppb, first_block, last_block;
12291229
12301230 memorg = nanddev_get_memorg(&chip->base);
1231− ppl = memorg->pages_per_eraseblock * memorg->eraseblocks_per_lun;
1232− first_lun = chip->cont_read.first_page / ppl;
1233− last_lun = chip->cont_read.last_page / ppl;
1231+ ppb = memorg->pages_per_eraseblock;
1232+ first_block = chip->cont_read.first_page / ppb;
1233+ last_block = chip->cont_read.last_page / ppb;
12341234
1235− /* Prevent sequential cache reads across LUN boundaries */
1236− if (first_lun != last_lun)
1237− chip->cont_read.pause_page = rawnand_last_page_of_lun(ppl, first_lun);
1235+ /* Prevent sequential cache reads across block boundaries */
1236+ if (first_block != last_block)
1237+ chip->cont_read.pause_page = rawnand_last_page_of_block(ppb, first_block);
12381238 else
12391239 chip->cont_read.pause_page = chip->cont_read.last_page;
12401240
12411241 if (chip->cont_read.first_page == chip->cont_read.pause_page) {
12421242 chip->cont_read.first_page++;
12431243 chip->cont_read.pause_page = min(chip->cont_read.last_page,
1244− rawnand_last_page_of_lun(ppl, first_lun + 1));
1244+ rawnand_last_page_of_block(ppb, first_block + 1));
12451245 }
12461246
12471247 if (chip->cont_read.first_page >= chip->cont_read.last_page)
drivers/mtd/nand/raw/ndfc.c+10−10
@@ -44,13 +44,13 @@ static void ndfc_select_chip(struct nand_chip *nchip, int chip) · 43 unmodified lines
4444 uint32_t ccr;
4545 struct ndfc_controller *ndfc = nand_get_controller_data(nchip);
4646
47− ccr = in_be32(ndfc->ndfcbase + NDFC_CCR);
47+ ccr = ioread32be(ndfc->ndfcbase + NDFC_CCR);
4848 if (chip >= 0) {
4949 ccr &= ~NDFC_CCR_BS_MASK;
5050 ccr |= NDFC_CCR_BS(chip + ndfc->chip_select);
5151 } else
5252 ccr |= NDFC_CCR_RESET_CE;
53− out_be32(ndfc->ndfcbase + NDFC_CCR, ccr);
53+ iowrite32be(ccr, ndfc->ndfcbase + NDFC_CCR);
5454 }
5555
5656 static void ndfc_hwcontrol(struct nand_chip *chip, int cmd, unsigned int ctrl)
@@ -70,7 +70,7 @@ static int ndfc_ready(struct nand_chip *chip) · 13 unmodified lines
7070 {
7171 struct ndfc_controller *ndfc = nand_get_controller_data(chip);
7272
73− return in_be32(ndfc->ndfcbase + NDFC_STAT) & NDFC_STAT_IS_READY;
73+ return ioread32be(ndfc->ndfcbase + NDFC_STAT) & NDFC_STAT_IS_READY;
7474 }
7575
7676 static void ndfc_enable_hwecc(struct nand_chip *chip, int mode)
@@ -78,9 +78,9 @@ static void ndfc_enable_hwecc(struct nand_chip *chip, int mode) · 1 unmodified line
7878 uint32_t ccr;
7979 struct ndfc_controller *ndfc = nand_get_controller_data(chip);
8080
81− ccr = in_be32(ndfc->ndfcbase + NDFC_CCR);
81+ ccr = ioread32be(ndfc->ndfcbase + NDFC_CCR);
8282 ccr |= NDFC_CCR_RESET_ECC;
83− out_be32(ndfc->ndfcbase + NDFC_CCR, ccr);
83+ iowrite32be(ccr, ndfc->ndfcbase + NDFC_CCR);
8484 wmb();
8585 }
8686
@@ -92,7 +92,7 @@ static int ndfc_calculate_ecc(struct nand_chip *chip, · 5 unmodified lines
9292 uint8_t *p = (uint8_t *)&ecc;
9393
9494 wmb();
95− ecc = in_be32(ndfc->ndfcbase + NDFC_ECC);
95+ ecc = ioread32be(ndfc->ndfcbase + NDFC_ECC);
9696 /* The NDFC uses Smart Media (SMC) bytes order */
9797 ecc_code[0] = p[1];
9898 ecc_code[1] = p[2];
@@ -114,7 +114,7 @@ static void ndfc_read_buf(struct nand_chip *chip, uint8_t *buf, int len) · 15 unmodified lines
114114 uint32_t *p = (uint32_t *) buf;
115115
116116 for(;len > 0; len -= 4)
117− *p++ = in_be32(ndfc->ndfcbase + NDFC_DATA);
117+ *p++ = ioread32be(ndfc->ndfcbase + NDFC_DATA);
118118 }
119119
120120 static void ndfc_write_buf(struct nand_chip *chip, const uint8_t *buf, int len)
@@ -123,7 +123,7 @@ static void ndfc_write_buf(struct nand_chip *chip, const uint8_t *buf, int len) · 2 unmodified lines
123123 uint32_t *p = (uint32_t *) buf;
124124
125125 for(;len > 0; len -= 4)
126− out_be32(ndfc->ndfcbase + NDFC_DATA, *p++);
126+ iowrite32be(*p++, ndfc->ndfcbase + NDFC_DATA);
127127 }
128128
129129 /*
@@ -223,13 +223,13 @@ static int ndfc_probe(struct platform_device *ofdev) · 93 unmodified lines
223223 if (reg)
224224 ccr |= be32_to_cpup(reg);
225225
226− out_be32(ndfc->ndfcbase + NDFC_CCR, ccr);
226+ iowrite32be(ccr, ndfc->ndfcbase + NDFC_CCR);
227227
228228 /* Set the bank settings if given */
229229 reg = of_get_property(ofdev->dev.of_node, "bank-settings", NULL);
230230 if (reg) {
231231 int offset = NDFC_BCFG0 + (ndfc->chip_select << 2);
232− out_be32(ndfc->ndfcbase + offset, be32_to_cpup(reg));
232+ iowrite32be(be32_to_cpup(reg), ndfc->ndfcbase + offset);
233233 }
234234
235235 err = ndfc_chip_init(ndfc, ofdev->dev.of_node);
drivers/mtd/nand/raw/pl35x-nand-controller.c+1−1
@@ -1155,7 +1155,7 @@ static int pl35x_nand_probe(struct platform_device *pdev) · 1154 unmodified lines
11551155 nfc->controller.ops = &pl35x_nandc_ops;
11561156 INIT_LIST_HEAD(&nfc->chips);
11571157
1158− nfc->conf_regs = devm_ioremap_resource(&smc_amba->dev, &smc_amba->res);
1158+ nfc->conf_regs = devm_ioremap_resource(nfc->dev, &smc_amba->res);
11591159 if (IS_ERR(nfc->conf_regs))
11601160 return PTR_ERR(nfc->conf_regs);
11611161
drivers/mtd/nand/raw/qcom_nandc.c+6−10
@@ -128,8 +128,8 @@ static struct qcom_nand_host *to_qcom_nand_host(struct nand_chip *chip) · 127 unmodified lines
128128 static struct qcom_nand_controller *
129129 get_qcom_nand_controller(struct nand_chip *chip)
130130 {
131− return (struct qcom_nand_controller *)
132− ((u8 *)chip->controller - sizeof(struct qcom_nand_controller));
131+ return container_of(chip->controller, struct qcom_nand_controller,
132+ controller);
133133 }
134134
135135 static u32 nandc_read(struct qcom_nand_controller *nandc, int offset)
@@ -2034,8 +2034,8 @@ static int qcom_nandc_setup(struct qcom_nand_controller *nandc) · 1898 unmodified lines
20342034 {
20352035 u32 nand_ctrl;
20362036
2037− nand_controller_init(nandc->controller);
2038− nandc->controller->ops = &qcom_nandc_ops;
2037+ nand_controller_init(&nandc->controller);
2038+ nandc->controller.ops = &qcom_nandc_ops;
20392039
20402040 /* kill onenand */
20412041 if (!nandc->props->nandc_part_of_qpic)
@@ -2175,7 +2175,7 @@ static int qcom_nand_host_init_and_register(struct qcom_nand_controller *nandc, · 133 unmodified lines
21752175 chip->legacy.block_bad = qcom_nandc_block_bad;
21762176 chip->legacy.block_markbad = qcom_nandc_block_markbad;
21772177
2178− chip->controller = nandc->controller;
2178+ chip->controller = &nandc->controller;
21792179 chip->options |= NAND_NO_SUBPAGE_WRITE | NAND_USES_DMA |
21802180 NAND_SKIP_BBTSCAN;
21812181
@@ -2256,21 +2256,17 @@ static int qcom_nandc_parse_dt(struct platform_device *pdev) · 74 unmodified lines
22562256 static int qcom_nandc_probe(struct platform_device *pdev)
22572257 {
22582258 struct qcom_nand_controller *nandc;
2259− struct nand_controller *controller;
22602259 const void *dev_data;
22612260 struct device *dev = &pdev->dev;
22622261 struct resource *res;
22632262 int ret;
22642263
2265− nandc = devm_kzalloc(&pdev->dev, sizeof(*nandc) + sizeof(*controller),
2266− GFP_KERNEL);
2264+ nandc = devm_kzalloc(&pdev->dev, sizeof(*nandc), GFP_KERNEL);
22672265 if (!nandc)
22682266 return -ENOMEM;
2269− controller = (struct nand_controller *)&nandc[1];
22702267
22712268 platform_set_drvdata(pdev, nandc);
22722269 nandc->dev = dev;
2273− nandc->controller = controller;
22742270
22752271 dev_data = of_device_get_match_data(dev);
22762272 if (!dev_data) {
drivers/mtd/nand/spi/core.c+136−55
@@ -100,6 +100,17 @@ spinand_fill_page_read_op(struct spinand_device *spinand, u64 addr) · 99 unmodified lines
100100 return op;
101101 }
102102
103+static struct spi_mem_op
104+spinand_fill_page_read_packed_op(struct spinand_device *spinand, u64 addr)
105+{
106+ struct spi_mem_op op = spinand->op_templates->page_read;
107+
108+ op.cmd.opcode |= addr >> 16;
109+ op.addr.val = addr & 0xFFFF;
110+
111+ return op;
112+}
113+
103114 struct spi_mem_op
104115 spinand_fill_prog_exec_op(struct spinand_device *spinand, u64 addr)
105116 {
@@ -453,7 +464,10 @@ static int spinand_load_page_op(struct spinand_device *spinand, · 347 unmodified lines
453464 {
454465 struct nand_device *nand = spinand_to_nand(spinand);
455466 unsigned int row = nanddev_pos_to_row(nand, &req->pos);
456− struct spi_mem_op op = SPINAND_OP(spinand, page_read, row);
467+ bool packed = spinand->flags & SPINAND_ODTR_PACKED_PAGE_READ;
468+ struct spi_mem_op op = packed ?
469+ SPINAND_OP(spinand, page_read_packed, row) :
470+ SPINAND_OP(spinand, page_read, row);
457471
458472 return spi_mem_exec_op(spinand->spimem, &op);
459473 }
@@ -487,10 +501,18 @@ static int spinand_read_from_cache_op(struct spinand_device *spinand, · 27 unmodified lines
487501 }
488502 }
489503
490− if (req->mode == MTD_OPS_RAW)
491− rdesc = spinand->dirmaps[req->pos.plane].rdesc;
504+ rdesc = spinand->dirmaps[req->pos.plane].rdesc;
505+
506+ if (spinand->op_templates->cont_read_cache && req->continuous)
507+ rdesc->info.op_tmpl = &rdesc->info.secondary_op_tmpl;
508+ else
509+ rdesc->info.op_tmpl = &rdesc->info.primary_op_tmpl;
510+
511+ if (nand->ecc.engine->integration == NAND_ECC_ENGINE_INTEGRATION_PIPELINED &&
512+ req->mode != MTD_OPS_RAW)
513+ rdesc->info.op_tmpl->data.ecc = true;
492514 else
493− rdesc = spinand->dirmaps[req->pos.plane].rdesc_ecc;
515+ rdesc->info.op_tmpl->data.ecc = false;
494516
495517 if (spinand->flags & SPINAND_HAS_READ_PLANE_SELECT_BIT)
496518 column |= req->pos.plane << fls(nanddev_page_size(nand));
@@ -579,10 +601,13 @@ static int spinand_write_to_cache_op(struct spinand_device *spinand, · 82 unmodified lines
579601 req->ooblen);
580602 }
581603
582− if (req->mode == MTD_OPS_RAW)
583− wdesc = spinand->dirmaps[req->pos.plane].wdesc;
604+ wdesc = spinand->dirmaps[req->pos.plane].wdesc;
605+
606+ if (nand->ecc.engine->integration == NAND_ECC_ENGINE_INTEGRATION_PIPELINED &&
607+ req->mode != MTD_OPS_RAW)
608+ wdesc->info.op_tmpl->data.ecc = true;
584609 else
585− wdesc = spinand->dirmaps[req->pos.plane].wdesc_ecc;
610+ wdesc->info.op_tmpl->data.ecc = false;
586611
587612 if (spinand->flags & SPINAND_HAS_PROG_PLANE_SELECT_BIT)
588613 column |= req->pos.plane << fls(nanddev_page_size(nand));
@@ -878,6 +903,12 @@ static int spinand_mtd_continuous_page_read(struct mtd_info *mtd, loff_t from, · 289 unmodified lines
878903 * Each data read must be a multiple of 4-bytes and full pages should be read;
879904 * otherwise, the data output might get out of sequence from one read command
880905 * to another.
906+ *
907+ * Continuous reads never cross LUN boundaries. Some devices don't
908+ * support crossing planes boundaries. Some devices don't even support
909+ * crossing blocks boundaries. The common case being to read through UBI,
910+ * we will very rarely read two consequent blocks or more, so let's only enable
911+ * continuous reads when reading within the same erase block.
881912 */
882913 nanddev_io_for_each_block(nand, NAND_PAGE_READ, from, ops, &iter) {
883914 ret = spinand_select_target(spinand, iter.req.pos.target);
@@ -934,13 +965,10 @@ static void spinand_cont_read_init(struct spinand_device *spinand) · 50 unmodified lines
934965 {
935966 struct nand_device *nand = spinand_to_nand(spinand);
936967 enum nand_ecc_engine_type engine_type = nand->ecc.ctx.conf.engine_type;
968+ struct spi_controller *ctlr = spinand->spimem->spi->controller;
937969
938970 /* OOBs cannot be retrieved so external/on-host ECC engine won't work */
939− if (spinand->set_cont_read &&
940− (engine_type == NAND_ECC_ENGINE_TYPE_ON_DIE ||
941− engine_type == NAND_ECC_ENGINE_TYPE_NONE)) {
942− spinand->cont_read_possible = true;
943−
971+ if (spinand->set_cont_read) {
944972 /*
945973 * Ensure continuous read is disabled on probe.
946974 * Some devices retain this state across soft reset,
@@ -948,6 +976,11 @@ static void spinand_cont_read_init(struct spinand_device *spinand) · 1 unmodified line
948976 * in false positive returns from spinand_isbad().
949977 */
950978 spinand_cont_read_enable(spinand, false);
979+
980+ if ((engine_type == NAND_ECC_ENGINE_TYPE_ON_DIE ||
981+ engine_type == NAND_ECC_ENGINE_TYPE_NONE) &&
982+ !spi_mem_controller_is_capable(ctlr, no_cs_assertion))
983+ spinand->cont_read_possible = true;
951984 }
952985 }
953986
@@ -968,19 +1001,6 @@ static bool spinand_use_cont_read(struct mtd_info *mtd, loff_t from, · 14 unmodified lines
9681001 nanddev_offs_to_pos(nand, from, &start_pos);
9691002 nanddev_offs_to_pos(nand, from + ops->len - 1, &end_pos);
9701003
971− /*
972− * Continuous reads never cross LUN boundaries. Some devices don't
973− * support crossing planes boundaries. Some devices don't even support
974− * crossing blocks boundaries. The common case being to read through UBI,
975− * we will very rarely read two consequent blocks or more, so it is safer
976− * and easier (can be improved) to only enable continuous reads when
977− * reading within the same erase block.
978− */
979− if (start_pos.target != end_pos.target ||
980− start_pos.plane != end_pos.plane ||
981− start_pos.eraseblock != end_pos.eraseblock)
982− return false;
983−
9841004 return start_pos.page < end_pos.page;
9851005 }
9861006
@@ -1222,6 +1242,7 @@ static struct spi_mem_dirmap_desc *spinand_create_rdesc( · 235 unmodified lines
12221242 * its spi controller, use regular reading
12231243 */
12241244 spinand->cont_read_possible = false;
1245+ memset(&info->secondary_op_tmpl, 0, sizeof(info->secondary_op_tmpl));
12251246
12261247 info->length = nanddev_page_size(nand) +
12271248 nanddev_per_page_oobsize(nand);
@@ -1238,12 +1259,31 @@ static int spinand_create_dirmap(struct spinand_device *spinand, · 10 unmodified lines
12381259 struct nand_device *nand = spinand_to_nand(spinand);
12391260 struct spi_mem_dirmap_info info = { 0 };
12401261 struct spi_mem_dirmap_desc *desc;
1262+ bool enable_ecc = false, secondary_op = false;
1263+
1264+ if (nand->ecc.engine->integration == NAND_ECC_ENGINE_INTEGRATION_PIPELINED)
1265+ enable_ecc = true;
1266+
1267+ if (spinand->cont_read_possible && spinand->op_templates->cont_read_cache)
1268+ secondary_op = true;
1269+
1270+ /*
1271+ * Continuous read implies that only the main data is retrieved, backed
1272+ * by an on-die ECC engine. It is not possible to use a pipelind ECC
1273+ * engine with continuous read.
1274+ */
1275+ if (enable_ecc && secondary_op) {
1276+ secondary_op = false;
1277+ spinand->cont_read_possible = false;
1278+ }
12411279
12421280 /* The plane number is passed in MSB just above the column address */
12431281 info.offset = plane << fls(nand->memorg.pagesize);
12441282
1283+ /* Write descriptor */
12451284 info.length = nanddev_page_size(nand) + nanddev_per_page_oobsize(nand);
1246− info.op_tmpl = *spinand->op_templates->update_cache;
1285+ info.primary_op_tmpl = *spinand->op_templates->update_cache;
1286+ info.primary_op_tmpl.data.ecc = enable_ecc;
12471287 desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev,
12481288 spinand->spimem, &info);
12491289 if (IS_ERR(desc))
@@ -1251,37 +1291,18 @@ static int spinand_create_dirmap(struct spinand_device *spinand, · 1 unmodified line
12511291
12521292 spinand->dirmaps[plane].wdesc = desc;
12531293
1254− info.op_tmpl = *spinand->op_templates->read_cache;
1255− desc = spinand_create_rdesc(spinand, &info);
1256− if (IS_ERR(desc))
1257− return PTR_ERR(desc);
1258−
1259− spinand->dirmaps[plane].rdesc = desc;
1260−
1261− if (nand->ecc.engine->integration != NAND_ECC_ENGINE_INTEGRATION_PIPELINED) {
1262− spinand->dirmaps[plane].wdesc_ecc = spinand->dirmaps[plane].wdesc;
1263− spinand->dirmaps[plane].rdesc_ecc = spinand->dirmaps[plane].rdesc;
1264−
1265− return 0;
1294+ /* Read descriptor */
1295+ info.primary_op_tmpl = *spinand->op_templates->read_cache;
1296+ info.primary_op_tmpl.data.ecc = enable_ecc;
1297+ if (secondary_op) {
1298+ info.secondary_op_tmpl = *spinand->op_templates->cont_read_cache;
1299+ info.secondary_op_tmpl.data.ecc = enable_ecc;
12661300 }
1267−
1268− info.length = nanddev_page_size(nand) + nanddev_per_page_oobsize(nand);
1269− info.op_tmpl = *spinand->op_templates->update_cache;
1270− info.op_tmpl.data.ecc = true;
1271− desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev,
1272− spinand->spimem, &info);
1273− if (IS_ERR(desc))
1274− return PTR_ERR(desc);
1275−
1276− spinand->dirmaps[plane].wdesc_ecc = desc;
1277−
1278− info.op_tmpl = *spinand->op_templates->read_cache;
1279− info.op_tmpl.data.ecc = true;
12801301 desc = spinand_create_rdesc(spinand, &info);
12811302 if (IS_ERR(desc))
12821303 return PTR_ERR(desc);
12831304
1284− spinand->dirmaps[plane].rdesc_ecc = desc;
1305+ spinand->dirmaps[plane].rdesc = desc;
12851306
12861307 return 0;
12871308 }
@@ -1307,6 +1328,22 @@ static int spinand_create_dirmaps(struct spinand_device *spinand) · 19 unmodified lines
13071328 return 0;
13081329 }
13091330
1331+static int spinand_randomizer_init(struct spinand_device *spinand)
1332+{
1333+ struct device_node *np = spinand->spimem->spi->dev.of_node;
1334+ u32 rand_val;
1335+ int ret;
1336+
1337+ if (!spinand->set_randomizer)
1338+ return 0;
1339+
1340+ ret = of_property_read_u32(np, "nand-randomizer", &rand_val);
1341+ if (ret)
1342+ return 0;
1343+
1344+ return spinand->set_randomizer(spinand, rand_val);
1345+}
1346+
13101347 static const struct nand_ops spinand_ops = {
13111348 .erase = spinand_erase,
13121349 .markbad = spinand_markbad,
@@ -1407,7 +1444,7 @@ static void spinand_manufacturer_cleanup(struct spinand_device *spinand) · 94 unmodified lines
14071444 return spinand->manufacturer->ops->cleanup(spinand);
14081445 }
14091446
1410−static bool spinand_op_is_odtr(const struct spi_mem_op *op)
1447+bool spinand_op_is_odtr(const struct spi_mem_op *op)
14111448 {
14121449 return op->cmd.dtr && op->cmd.buswidth == 8;
14131450 }
@@ -1489,9 +1526,13 @@ static int spinand_init_odtr_instruction_set(struct spinand_device *spinand) · 75 unmodified lines
14891526 if (!spi_mem_supports_op(spinand->spimem, &tmpl->blk_erase))
14901527 return -EOPNOTSUPP;
14911528
1492− tmpl->page_read = (struct spi_mem_op)SPINAND_PAGE_READ_8D_8D_0_OP(0);
1493− if (!spi_mem_supports_op(spinand->spimem, &tmpl->page_read))
1529+ if (spinand->flags & SPINAND_ODTR_PACKED_PAGE_READ)
1530+ tmpl->page_read = (struct spi_mem_op)SPINAND_PAGE_READ_PACKED_8D_8D_0_OP(0);
1531+ else
1532+ tmpl->page_read = (struct spi_mem_op)SPINAND_PAGE_READ_8D_8D_0_OP(0);
1533+ if (!spi_mem_supports_op(spinand->spimem, &tmpl->page_read)) {
14941534 return -EOPNOTSUPP;
1535+ }
14951536
14961537 tmpl->prog_exec = (struct spi_mem_op)SPINAND_PROG_EXEC_8D_8D_0_OP(0);
14971538 if (!spi_mem_supports_op(spinand->spimem, &tmpl->prog_exec))
@@ -1594,6 +1635,7 @@ int spinand_match_and_init(struct spinand_device *spinand, · 96 unmodified lines
15941635 spinand->user_otp = &table[i].user_otp;
15951636 spinand->read_retries = table[i].read_retries;
15961637 spinand->set_read_retry = table[i].set_read_retry;
1638+ spinand->set_randomizer = table[i].set_randomizer;
15971639
15981640 /* I/O variants selection with single-spi SDR commands */
15991641
@@ -1622,6 +1664,33 @@ int spinand_match_and_init(struct spinand_device *spinand, · 22 unmodified lines
16221664 if (ret)
16231665 return ret;
16241666
1667+ if (info->op_variants.cont_read_cache) {
1668+ op = spinand_select_op_variant(spinand, SSDR,
1669+ info->op_variants.cont_read_cache);
1670+ if (op) {
1671+ const struct spi_mem_op *read_op;
1672+
1673+ read_op = spinand->ssdr_op_templates.read_cache;
1674+
1675+ /*
1676+ * Sometimes the fastest continuous read variant may not
1677+ * be supported. In this case, prefer to use the fastest
1678+ * read from cache variant and disable continuous reads.
1679+ */
1680+ if (read_op->cmd.buswidth > op->cmd.buswidth ||
1681+ (read_op->cmd.dtr && !op->cmd.dtr) ||
1682+ read_op->addr.buswidth > op->addr.buswidth ||
1683+ (read_op->addr.dtr && !op->addr.dtr) ||
1684+ read_op->data.buswidth > op->data.buswidth ||
1685+ (read_op->data.dtr && !op->data.dtr))
1686+ spinand->cont_read_possible = false;
1687+ else
1688+ spinand->ssdr_op_templates.cont_read_cache = op;
1689+ } else {
1690+ spinand->cont_read_possible = false;
1691+ }
1692+ }
1693+
16251694 /* I/O variants selection with octo-spi DDR commands (optional) */
16261695
16271696 ret = spinand_init_odtr_instruction_set(spinand);
@@ -1644,6 +1713,15 @@ int spinand_match_and_init(struct spinand_device *spinand, · 16 unmodified lines
16441713 info->op_variants.update_cache);
16451714 spinand->odtr_op_templates.update_cache = op;
16461715
1716+ if (info->op_variants.cont_read_cache) {
1717+ op = spinand_select_op_variant(spinand, ODTR,
1718+ info->op_variants.cont_read_cache);
1719+ if (op)
1720+ spinand->odtr_op_templates.cont_read_cache = op;
1721+ else
1722+ spinand->cont_read_possible = false;
1723+ }
1724+
16471725 return 0;
16481726 }
16491727
@@ -1881,6 +1959,9 @@ static int spinand_init(struct spinand_device *spinand) · 231 unmodified lines
18811959 * ECC initialization must have happened previously.
18821960 */
18831961 spinand_cont_read_init(spinand);
1962+ ret = spinand_randomizer_init(spinand);
1963+ if (ret)
1964+ goto err_cleanup_nanddev;
18841965
18851966 mtd->_read_oob = spinand_mtd_read;
18861967 mtd->_write_oob = spinand_mtd_write;
drivers/mtd/nand/spi/macronix.c+28−10
@@ -14,6 +14,8 @@ · 13 unmodified lines
1414 #define MACRONIX_ECCSR_BF_LAST_PAGE(eccsr) FIELD_GET(GENMASK(3, 0), eccsr)
1515 #define MACRONIX_ECCSR_BF_ACCUMULATED_PAGES(eccsr) FIELD_GET(GENMASK(7, 4), eccsr)
1616 #define MACRONIX_CFG_CONT_READ BIT(2)
17+#define MACRONIX_CFG_RANDOMIZER_EN BIT(1)
18+#define MACRONIX_FEATURE_ADDR_RANDOMIZER 0x10
1719 #define MACRONIX_FEATURE_ADDR_READ_RETRY 0x70
1820 #define MACRONIX_NUM_READ_RETRY_MODES 5
1921
@@ -170,6 +172,12 @@ static int macronix_set_read_retry(struct spinand_device *spinand, · 150 unmodified lines
170172 return spi_mem_exec_op(spinand->spimem, &op);
171173 }
172174
175+static int macronix_set_randomizer(struct spinand_device *spinand, bool enable)
176+{
177+ return spinand_write_reg_op(spinand, MACRONIX_FEATURE_ADDR_RANDOMIZER,
178+ enable ? MACRONIX_CFG_RANDOMIZER_EN : 0);
179+}
180+
173181 static const struct spinand_info macronix_spinand_table[] = {
174182 SPINAND_INFO("MX35LF1GE4AB",
175183 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x12),
@@ -231,7 +239,8 @@ static const struct spinand_info macronix_spinand_table[] = { · 55 unmodified lines
231239 SPINAND_HAS_QE_BIT,
232240 SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, NULL),
233241 SPINAND_READ_RETRY(MACRONIX_NUM_READ_RETRY_MODES,
234− macronix_set_read_retry)),
242+ macronix_set_read_retry),
243+ SPINAND_RANDOMIZER(macronix_set_randomizer)),
235244 SPINAND_INFO("MX35LF2G24AD",
236245 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x24, 0x03),
237246 NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 2, 1, 1),
@@ -243,7 +252,8 @@ static const struct spinand_info macronix_spinand_table[] = { · 5 unmodified lines
243252 SPINAND_HAS_PROG_PLANE_SELECT_BIT,
244253 SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, NULL),
245254 SPINAND_READ_RETRY(MACRONIX_NUM_READ_RETRY_MODES,
246− macronix_set_read_retry)),
255+ macronix_set_read_retry),
256+ SPINAND_RANDOMIZER(macronix_set_randomizer)),
247257 SPINAND_INFO("MX35LF2G24AD-Z4I8",
248258 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x64, 0x03),
249259 NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1),
@@ -254,7 +264,8 @@ static const struct spinand_info macronix_spinand_table[] = { · 4 unmodified lines
254264 SPINAND_HAS_QE_BIT,
255265 SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, NULL),
256266 SPINAND_READ_RETRY(MACRONIX_NUM_READ_RETRY_MODES,
257− macronix_set_read_retry)),
267+ macronix_set_read_retry),
268+ SPINAND_RANDOMIZER(macronix_set_randomizer)),
258269 SPINAND_INFO("MX35LF4G24AD",
259270 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x35, 0x03),
260271 NAND_MEMORG(1, 4096, 256, 64, 2048, 40, 2, 1, 1),
@@ -266,7 +277,8 @@ static const struct spinand_info macronix_spinand_table[] = { · 5 unmodified lines
266277 SPINAND_HAS_PROG_PLANE_SELECT_BIT,
267278 SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, NULL),
268279 SPINAND_READ_RETRY(MACRONIX_NUM_READ_RETRY_MODES,
269− macronix_set_read_retry)),
280+ macronix_set_read_retry),
281+ SPINAND_RANDOMIZER(macronix_set_randomizer)),
270282 SPINAND_INFO("MX35LF4G24AD-Z4I8",
271283 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x75, 0x03),
272284 NAND_MEMORG(1, 4096, 256, 64, 2048, 40, 1, 1, 1),
@@ -277,7 +289,8 @@ static const struct spinand_info macronix_spinand_table[] = { · 4 unmodified lines
277289 SPINAND_HAS_QE_BIT,
278290 SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, NULL),
279291 SPINAND_READ_RETRY(MACRONIX_NUM_READ_RETRY_MODES,
280− macronix_set_read_retry)),
292+ macronix_set_read_retry),
293+ SPINAND_RANDOMIZER(macronix_set_randomizer)),
281294 SPINAND_INFO("MX31LF1GE4BC",
282295 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x1e),
283296 NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
@@ -327,7 +340,8 @@ static const struct spinand_info macronix_spinand_table[] = { · 43 unmodified lines
327340 SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout,
328341 macronix_ecc_get_status),
329342 SPINAND_READ_RETRY(MACRONIX_NUM_READ_RETRY_MODES,
330− macronix_set_read_retry)),
343+ macronix_set_read_retry),
344+ SPINAND_RANDOMIZER(macronix_set_randomizer)),
331345 SPINAND_INFO("MX35UF4G24AD-Z4I8",
332346 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xf5, 0x03),
333347 NAND_MEMORG(1, 4096, 256, 64, 2048, 40, 1, 1, 1),
@@ -340,7 +354,8 @@ static const struct spinand_info macronix_spinand_table[] = { · 6 unmodified lines
340354 SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout,
341355 macronix_ecc_get_status),
342356 SPINAND_READ_RETRY(MACRONIX_NUM_READ_RETRY_MODES,
343− macronix_set_read_retry)),
357+ macronix_set_read_retry),
358+ SPINAND_RANDOMIZER(macronix_set_randomizer)),
344359 SPINAND_INFO("MX35UF4GE4AD",
345360 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xb7, 0x03),
346361 NAND_MEMORG(1, 4096, 256, 64, 2048, 40, 1, 1, 1),
@@ -381,7 +396,8 @@ static const struct spinand_info macronix_spinand_table[] = { · 34 unmodified lines
381396 SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout,
382397 macronix_ecc_get_status),
383398 SPINAND_READ_RETRY(MACRONIX_NUM_READ_RETRY_MODES,
384− macronix_set_read_retry)),
399+ macronix_set_read_retry),
400+ SPINAND_RANDOMIZER(macronix_set_randomizer)),
385401 SPINAND_INFO("MX35UF2G24AD-Z4I8",
386402 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xe4, 0x03),
387403 NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1),
@@ -394,7 +410,8 @@ static const struct spinand_info macronix_spinand_table[] = { · 6 unmodified lines
394410 SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout,
395411 macronix_ecc_get_status),
396412 SPINAND_READ_RETRY(MACRONIX_NUM_READ_RETRY_MODES,
397− macronix_set_read_retry)),
413+ macronix_set_read_retry),
414+ SPINAND_RANDOMIZER(macronix_set_randomizer)),
398415 SPINAND_INFO("MX35UF2GE4AD",
399416 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xa6, 0x03),
400417 NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1),
@@ -444,7 +461,8 @@ static const struct spinand_info macronix_spinand_table[] = { · 43 unmodified lines
444461 SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout,
445462 macronix_ecc_get_status),
446463 SPINAND_READ_RETRY(MACRONIX_NUM_READ_RETRY_MODES,
447− macronix_set_read_retry)),
464+ macronix_set_read_retry),
465+ SPINAND_RANDOMIZER(macronix_set_randomizer)),
448466 SPINAND_INFO("MX35UF1GE4AD",
449467 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x96, 0x03),
450468 NAND_MEMORG(1, 2048, 128, 64, 1024, 20, 1, 1, 1),
drivers/mtd/nand/spi/winbond.c+252−63
@@ -15,9 +15,11 @@ · 14 unmodified lines
1515
1616 #define SPINAND_MFR_WINBOND 0xEF
1717
18+#define WINBOND_CFG_HFREQ BIT(0)
1819 #define WINBOND_CFG_BUF_READ BIT(3)
1920
2021 #define W25N04KV_STATUS_ECC_5_8_BITFLIPS (3 << 4)
22+#define W25W35NXXJW_STATUS_ECC_MULT_UNCOR (3 << 4)
2123
2224 #define W25N0XJW_SR4 0xD0
2325 #define W25N0XJW_SR4_HS BIT(2)
@@ -29,6 +31,105 @@ · 5 unmodified lines
2931 #define W35N01JW_VCR_IO_MODE_OCTAL_DDR 0xC7
3032 #define W35N01JW_VCR_DUMMY_CLOCK_REG 0x01
3133
34+/*
35+ * Winbond chips ignore the address bytes during continuous reads, and
36+ * because the dummy cycles are enough they indicate dropping the
37+ * address cycles from the continuous read from cache variants. This is
38+ * very poorly supported by SPI controller drivers which are "wired" to
39+ * always at least provide the column. Keep using address cycles, but
40+ * reduce the number of dummy cycles accordingly.
41+ */
42+#define WINBOND_CONT_READ_FROM_CACHE_FAST_1S_1S_1S_OP(ndummy, buf, len, freq) \
43+ SPI_MEM_OP(SPI_MEM_OP_CMD(0x0b, 1), \
44+ SPI_MEM_OP_ADDR(1, 0, 1), \
45+ SPI_MEM_OP_DUMMY(ndummy - 1, 1), \
46+ SPI_MEM_OP_DATA_IN(len, buf, 1), \
47+ SPI_MEM_OP_MAX_FREQ(freq))
48+
49+#define WINBOND_CONT_READ_FROM_CACHE_1S_1D_1D_OP(ndummy, buf, len, freq) \
50+ SPI_MEM_OP(SPI_MEM_OP_CMD(0x0d, 1), \
51+ SPI_MEM_DTR_OP_ADDR(2, 0, 1), \
52+ SPI_MEM_DTR_OP_DUMMY(ndummy, 1), \
53+ SPI_MEM_DTR_OP_DATA_IN(len, buf, 1), \
54+ SPI_MEM_OP_MAX_FREQ(freq))
55+
56+#define WINBOND_CONT_READ_FROM_CACHE_1S_1S_2S_OP(ndummy, buf, len, freq) \
57+ SPI_MEM_OP(SPI_MEM_OP_CMD(0x3b, 1), \
58+ SPI_MEM_OP_ADDR(1, 0, 1), \
59+ SPI_MEM_OP_DUMMY(ndummy - 1, 1), \
60+ SPI_MEM_OP_DATA_IN(len, buf, 2), \
61+ SPI_MEM_OP_MAX_FREQ(freq))
62+
63+#define WINBOND_CONT_READ_FROM_CACHE_1S_2S_2S_OP(ndummy, buf, len, freq) \
64+ SPI_MEM_OP(SPI_MEM_OP_CMD(0xbb, 1), \
65+ SPI_MEM_OP_ADDR(1, 0, 2), \
66+ SPI_MEM_OP_DUMMY(ndummy - 1, 2), \
67+ SPI_MEM_OP_DATA_IN(len, buf, 2), \
68+ SPI_MEM_OP_MAX_FREQ(freq))
69+
70+#define WINBOND_CONT_READ_FROM_CACHE_1S_2D_2D_OP(ndummy, buf, len, freq) \
71+ SPI_MEM_OP(SPI_MEM_OP_CMD(0xbd, 1), \
72+ SPI_MEM_DTR_OP_ADDR(1, 0, 2), \
73+ SPI_MEM_DTR_OP_DUMMY(ndummy - 1, 2), \
74+ SPI_MEM_DTR_OP_DATA_IN(len, buf, 2), \
75+ SPI_MEM_OP_MAX_FREQ(freq))
76+
77+#define WINBOND_CONT_READ_FROM_CACHE_1S_1S_4S_OP(ndummy, buf, len, freq) \
78+ SPI_MEM_OP(SPI_MEM_OP_CMD(0x6b, 1), \
79+ SPI_MEM_OP_ADDR(1, 0, 1), \
80+ SPI_MEM_OP_DUMMY(ndummy - 1, 1), \
81+ SPI_MEM_OP_DATA_IN(len, buf, 4), \
82+ SPI_MEM_OP_MAX_FREQ(freq))
83+
84+#define WINBOND_CONT_READ_FROM_CACHE_1S_1D_4D_OP(ndummy, buf, len, freq) \
85+ SPI_MEM_OP(SPI_MEM_OP_CMD(0x6d, 1), \
86+ SPI_MEM_DTR_OP_ADDR(1, 0, 1), \
87+ SPI_MEM_DTR_OP_DUMMY(ndummy - 1, 1), \
88+ SPI_MEM_DTR_OP_DATA_IN(len, buf, 4), \
89+ SPI_MEM_OP_MAX_FREQ(freq))
90+
91+#define WINBOND_CONT_READ_FROM_CACHE_1S_4S_4S_OP(ndummy, buf, len, freq) \
92+ SPI_MEM_OP(SPI_MEM_OP_CMD(0xeb, 1), \
93+ SPI_MEM_OP_ADDR(1, 0, 4), \
94+ SPI_MEM_OP_DUMMY(ndummy - 1, 4), \
95+ SPI_MEM_OP_DATA_IN(len, buf, 4), \
96+ SPI_MEM_OP_MAX_FREQ(freq))
97+
98+#define WINBOND_CONT_READ_FROM_CACHE_1S_4D_4D_OP(ndummy, buf, len, freq) \
99+ SPI_MEM_OP(SPI_MEM_OP_CMD(0xed, 1), \
100+ SPI_MEM_DTR_OP_ADDR(1, 0, 4), \
101+ SPI_MEM_DTR_OP_DUMMY(ndummy - 1, 4), \
102+ SPI_MEM_DTR_OP_DATA_IN(len, buf, 4), \
103+ SPI_MEM_OP_MAX_FREQ(freq))
104+
105+#define WINBOND_CONT_READ_FROM_CACHE_1S_1S_8S_OP(ndummy, buf, len, freq) \
106+ SPI_MEM_OP(SPI_MEM_OP_CMD(0x8b, 1), \
107+ SPI_MEM_OP_ADDR(1, 0, 1), \
108+ SPI_MEM_OP_DUMMY(ndummy - 1, 1), \
109+ SPI_MEM_OP_DATA_IN(len, buf, 8), \
110+ SPI_MEM_OP_MAX_FREQ(freq))
111+
112+#define WINBOND_CONT_READ_FROM_CACHE_1S_1D_8D_OP(ndummy, buf, len, freq) \
113+ SPI_MEM_OP(SPI_MEM_OP_CMD(0x9d, 1), \
114+ SPI_MEM_DTR_OP_ADDR(1, 0, 1), \
115+ SPI_MEM_DTR_OP_DUMMY(ndummy - 1, 1), \
116+ SPI_MEM_DTR_OP_DATA_IN(len, buf, 8), \
117+ SPI_MEM_OP_MAX_FREQ(freq))
118+
119+#define WINBOND_CONT_READ_FROM_CACHE_1S_8S_8S_OP(ndummy, buf, len, freq) \
120+ SPI_MEM_OP(SPI_MEM_OP_CMD(0xcb, 1), \
121+ SPI_MEM_OP_ADDR(1, 0, 8), \
122+ SPI_MEM_OP_DUMMY(ndummy - 1, 8), \
123+ SPI_MEM_OP_DATA_IN(len, buf, 8), \
124+ SPI_MEM_OP_MAX_FREQ(freq))
125+
126+#define WINBOND_CONT_READ_FROM_CACHE_8D_8D_8D_OP(ndummy, buf, len, freq) \
127+ SPI_MEM_OP(SPI_MEM_DTR_OP_RPT_CMD(0x9d, 8), \
128+ SPI_MEM_DTR_OP_ADDR(2, 0, 8), \
129+ SPI_MEM_DTR_OP_DUMMY(ndummy - 2, 8), \
130+ SPI_MEM_DTR_OP_DATA_IN(len, buf, 8), \
131+ SPI_MEM_OP_MAX_FREQ(freq))
132+
32133 /*
33134 * "X2" in the core is equivalent to "dual output" in the datasheets,
34135 * "X4" in the core is equivalent to "quad output" in the datasheets.
@@ -49,6 +150,19 @@ static SPINAND_OP_VARIANTS(read_cache_octal_variants, · 14 unmodified lines
49150 SPINAND_PAGE_READ_FROM_CACHE_FAST_1S_1S_1S_OP(0, 1, NULL, 0, 0),
50151 SPINAND_PAGE_READ_FROM_CACHE_1S_1S_1S_OP(0, 1, NULL, 0, 0));
51152
153+static SPINAND_OP_VARIANTS(cont_read_cache_octal_variants,
154+ WINBOND_CONT_READ_FROM_CACHE_8D_8D_8D_OP(24, NULL, 0, 120 * HZ_PER_MHZ),
155+ WINBOND_CONT_READ_FROM_CACHE_8D_8D_8D_OP(16, NULL, 0, 86 * HZ_PER_MHZ),
156+ WINBOND_CONT_READ_FROM_CACHE_1S_1D_8D_OP(3, NULL, 0, 120 * HZ_PER_MHZ),
157+ WINBOND_CONT_READ_FROM_CACHE_1S_1D_8D_OP(2, NULL, 0, 105 * HZ_PER_MHZ),
158+ WINBOND_CONT_READ_FROM_CACHE_1S_8S_8S_OP(20, NULL, 0, 0),
159+ WINBOND_CONT_READ_FROM_CACHE_1S_8S_8S_OP(16, NULL, 0, 162 * HZ_PER_MHZ),
160+ WINBOND_CONT_READ_FROM_CACHE_1S_8S_8S_OP(12, NULL, 0, 124 * HZ_PER_MHZ),
161+ WINBOND_CONT_READ_FROM_CACHE_1S_8S_8S_OP(8, NULL, 0, 86 * HZ_PER_MHZ),
162+ WINBOND_CONT_READ_FROM_CACHE_1S_1S_8S_OP(2, NULL, 0, 0),
163+ WINBOND_CONT_READ_FROM_CACHE_1S_1S_8S_OP(1, NULL, 0, 133 * HZ_PER_MHZ),
164+ WINBOND_CONT_READ_FROM_CACHE_FAST_1S_1S_1S_OP(1, NULL, 0, 0));
165+
52166 static SPINAND_OP_VARIANTS(write_cache_octal_variants,
53167 SPINAND_PROG_LOAD_8D_8D_8D_OP(true, 0, NULL, 0),
54168 SPINAND_PROG_LOAD_1S_8S_8S_OP(true, 0, NULL, 0),
@@ -75,6 +189,20 @@ static SPINAND_OP_VARIANTS(read_cache_dual_quad_dtr_variants, · 20 unmodified lines
75189 SPINAND_PAGE_READ_FROM_CACHE_FAST_1S_1S_1S_OP(0, 1, NULL, 0, 0),
76190 SPINAND_PAGE_READ_FROM_CACHE_1S_1S_1S_OP(0, 1, NULL, 0, 54 * HZ_PER_MHZ));
77191
192+static SPINAND_OP_VARIANTS(cont_read_cache_dual_quad_dtr_variants,
193+ WINBOND_CONT_READ_FROM_CACHE_1S_4D_4D_OP(11, NULL, 0, 80 * HZ_PER_MHZ),
194+ WINBOND_CONT_READ_FROM_CACHE_1S_1D_4D_OP(5, NULL, 0, 80 * HZ_PER_MHZ),
195+ WINBOND_CONT_READ_FROM_CACHE_1S_4S_4S_OP(7, NULL, 0, 0),
196+ WINBOND_CONT_READ_FROM_CACHE_1S_4S_4S_OP(6, NULL, 0, 104 * HZ_PER_MHZ),
197+ WINBOND_CONT_READ_FROM_CACHE_1S_1S_4S_OP(4, NULL, 0, 0),
198+ WINBOND_CONT_READ_FROM_CACHE_1S_2D_2D_OP(6, NULL, 0, 80 * HZ_PER_MHZ),
199+ /* The 1S_1D_2D variant would require 4.5 dummy bytes, this is not possible */
200+ WINBOND_CONT_READ_FROM_CACHE_1S_2S_2S_OP(5, NULL, 0, 0),
201+ WINBOND_CONT_READ_FROM_CACHE_1S_2S_2S_OP(4, NULL, 0, 104 * HZ_PER_MHZ),
202+ WINBOND_CONT_READ_FROM_CACHE_1S_1S_2S_OP(4, NULL, 0, 0),
203+ /* The 1S_1D_1D variant would require 4.5 dummy bytes, this is not possible */
204+ WINBOND_CONT_READ_FROM_CACHE_FAST_1S_1S_1S_OP(4, NULL, 0, 0));
205+
78206 static SPINAND_OP_VARIANTS(read_cache_variants,
79207 SPINAND_PAGE_READ_FROM_CACHE_1S_4S_4S_OP(0, 2, NULL, 0, 0),
80208 SPINAND_PAGE_READ_FROM_CACHE_1S_1S_4S_OP(0, 1, NULL, 0, 0),
@@ -99,7 +227,7 @@ static SPINAND_OP_VARIANTS(update_cache_variants, · 18 unmodified lines
99227
100228 #define SPINAND_WINBOND_WRITE_VCR_8D_8D_8D(reg, buf) \
101229 SPI_MEM_OP(SPI_MEM_DTR_OP_RPT_CMD(0x81, 8), \
102− SPI_MEM_DTR_OP_ADDR(4, reg, 8), \
230+ SPI_MEM_DTR_OP_ADDR(4, reg << 8, 8), \
103231 SPI_MEM_OP_NO_DUMMY, \
104232 SPI_MEM_DTR_OP_DATA_OUT(2, buf, 8))
105233
@@ -326,45 +454,84 @@ static int w25n02kv_ecc_get_status(struct spinand_device *spinand, · 220 unmodified lines
326454 return -EINVAL;
327455 }
328456
457+static int w25w35nxxjw_ecc_get_status(struct spinand_device *spinand, u8 status)
458+{
459+ switch (status & STATUS_ECC_MASK) {
460+ case STATUS_ECC_NO_BITFLIPS:
461+ return 0;
462+
463+ case STATUS_ECC_HAS_BITFLIPS:
464+ return 1;
465+
466+ case STATUS_ECC_UNCOR_ERROR:
467+ case W25W35NXXJW_STATUS_ECC_MULT_UNCOR:
468+ return -EBADMSG;
469+
470+ default:
471+ break;
472+ }
473+
474+ return -EINVAL;
475+}
476+
477+static int w25n0xjw_set_sr4_hs(struct spinand_device *spinand, bool enable)
478+{
479+ int ret;
480+ u8 sr4;
481+
482+ ret = spinand_read_reg_op(spinand, W25N0XJW_SR4, &sr4);
483+ if (ret)
484+ return ret;
485+
486+ if (enable)
487+ sr4 |= W25N0XJW_SR4_HS;
488+ else
489+ sr4 &= ~W25N0XJW_SR4_HS;
490+
491+ return spinand_write_reg_op(spinand, W25N0XJW_SR4, sr4);
492+}
493+
494+/*
495+ * SDR dual and quad I/O operations over 104MHz require the HS bit to
496+ * enable a few more dummy cycles.
497+ */
498+static bool w25n0xjw_op_needs_hs(const struct spi_mem_op *op)
499+{
500+ if (op->cmd.dtr || op->addr.dtr || op->dummy.dtr || op->data.dtr)
501+ return false;
502+ else if (op->cmd.buswidth != 1 || op->addr.buswidth == 1)
503+ return false;
504+ else if (op->max_freq && op->max_freq <= 104 * HZ_PER_MHZ)
505+ return false;
506+
507+ return true;
508+}
509+
329510 static int w25n0xjw_hs_cfg(struct spinand_device *spinand,
330511 enum spinand_bus_interface iface)
331512 {
332513 const struct spi_mem_op *op;
333− bool hs;
334− u8 sr4;
335− int ret;
336514
337515 if (iface != SSDR)
338516 return -EOPNOTSUPP;
339517
340518 /*
341− * SDR dual and quad I/O operations over 104MHz require the HS bit to
342− * enable a few more dummy cycles.
519+ * At this stage, we do not yet know the continuous read template, nor
520+ * if there is going to be one. Let's assume the continuous read
521+ * template will be selected with the same heuristics as the buffered
522+ * read variant, as there cannot be a HS configuration mismatch between
523+ * them.
343524 */
344525 op = spinand->op_templates->read_cache;
345− if (op->cmd.dtr || op->addr.dtr || op->dummy.dtr || op->data.dtr)
346− hs = false;
347− else if (op->cmd.buswidth != 1 || op->addr.buswidth == 1)
348− hs = false;
349− else if (op->max_freq && op->max_freq <= 104 * HZ_PER_MHZ)
350− hs = false;
351− else
352− hs = true;
353−
354− ret = spinand_read_reg_op(spinand, W25N0XJW_SR4, &sr4);
355− if (ret)
356− return ret;
357526
358− if (hs)
359− sr4 |= W25N0XJW_SR4_HS;
360− else
361− sr4 &= ~W25N0XJW_SR4_HS;
527+ return w25n0xjw_set_sr4_hs(spinand, w25n0xjw_op_needs_hs(op));
528+}
362529
363− ret = spinand_write_reg_op(spinand, W25N0XJW_SR4, sr4);
364− if (ret)
365− return ret;
530+static int w25n0xjw_set_cont_read(struct spinand_device *spinand, bool enable)
531+{
532+ u8 mask = enable ? 0 : WINBOND_CFG_BUF_READ;
366533
367− return 0;
534+ return spinand_upd_cfg(spinand, WINBOND_CFG_BUF_READ, mask);
368535 }
369536
370537 static int w35n0xjw_write_vcr(struct spinand_device *spinand, u8 reg, u8 val)
@@ -451,6 +618,18 @@ static int w35n0xjw_vcr_cfg(struct spinand_device *spinand, · 80 unmodified lines
451618 return 0;
452619 }
453620
621+static int w35n0xjw_set_cont_read(struct spinand_device *spinand, bool enable)
622+{
623+ const struct spi_mem_op *cont_op = spinand->op_templates->cont_read_cache;
624+ u8 mask = enable ? 0 : WINBOND_CFG_BUF_READ;
625+
626+ if (cont_op && enable && spinand_op_is_odtr(cont_op) &&
627+ cont_op->max_freq >= 90 * HZ_PER_MHZ)
628+ mask |= WINBOND_CFG_HFREQ;
629+
630+ return spinand_upd_cfg(spinand, WINBOND_CFG_BUF_READ | WINBOND_CFG_HFREQ, mask);
631+}
632+
454633 static const struct spinand_info winbond_spinand_table[] = {
455634 /* 512M-bit densities */
456635 SPINAND_INFO("W25N512GW", /* 1.8V */
@@ -485,12 +664,14 @@ static const struct spinand_info winbond_spinand_table[] = { · 28 unmodified lines
485664 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xbc, 0x21),
486665 NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
487666 NAND_ECCREQ(1, 512),
488− SPINAND_INFO_OP_VARIANTS(&read_cache_dual_quad_dtr_variants,
489− &write_cache_variants,
490− &update_cache_variants),
667+ SPINAND_INFO_OP_VARIANTS_WITH_CONT(&read_cache_dual_quad_dtr_variants,
668+ &write_cache_variants,
669+ &update_cache_variants,
670+ &cont_read_cache_dual_quad_dtr_variants),
491671 SPINAND_HAS_QE_BIT,
492− SPINAND_ECCINFO(&w25n01jw_ooblayout, NULL),
493− SPINAND_CONFIGURE_CHIP(w25n0xjw_hs_cfg)),
672+ SPINAND_ECCINFO(&w25n01jw_ooblayout, w25w35nxxjw_ecc_get_status),
673+ SPINAND_CONFIGURE_CHIP(w25n0xjw_hs_cfg),
674+ SPINAND_CONT_READ(w25n0xjw_set_cont_read)),
494675 SPINAND_INFO("W25N01KV", /* 3.3V */
495676 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xae, 0x21),
496677 NAND_MEMORG(1, 2048, 96, 64, 1024, 20, 1, 1, 1),
@@ -504,35 +685,15 @@ static const struct spinand_info winbond_spinand_table[] = { · 7 unmodified lines
504685 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xdc, 0x21),
505686 NAND_MEMORG(1, 4096, 128, 64, 512, 10, 1, 1, 1),
506687 NAND_ECCREQ(1, 512),
507− SPINAND_INFO_OP_VARIANTS(&read_cache_octal_variants,
508− &write_cache_octal_variants,
509− &update_cache_octal_variants),
688+ SPINAND_INFO_OP_VARIANTS_WITH_CONT(&read_cache_octal_variants,
689+ &write_cache_octal_variants,
690+ &update_cache_octal_variants,
691+ &cont_read_cache_octal_variants),
510692 0,
511693 SPINAND_INFO_VENDOR_OPS(&winbond_w35_ops),
512− SPINAND_ECCINFO(&w35n01jw_ooblayout, NULL),
513− SPINAND_CONFIGURE_CHIP(w35n0xjw_vcr_cfg)),
514− SPINAND_INFO("W35N02JW", /* 1.8V */
515− SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xdf, 0x22),
516− NAND_MEMORG(1, 4096, 128, 64, 512, 10, 1, 2, 1),
517− NAND_ECCREQ(1, 512),
518− SPINAND_INFO_OP_VARIANTS(&read_cache_octal_variants,
519− &write_cache_octal_variants,
520− &update_cache_octal_variants),
521− 0,
522− SPINAND_INFO_VENDOR_OPS(&winbond_w35_ops),
523− SPINAND_ECCINFO(&w35n01jw_ooblayout, NULL),
524− SPINAND_CONFIGURE_CHIP(w35n0xjw_vcr_cfg)),
525− SPINAND_INFO("W35N04JW", /* 1.8V */
526− SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xdf, 0x23),
527− NAND_MEMORG(1, 4096, 128, 64, 512, 10, 1, 4, 1),
528− NAND_ECCREQ(1, 512),
529− SPINAND_INFO_OP_VARIANTS(&read_cache_octal_variants,
530− &write_cache_octal_variants,
531− &update_cache_octal_variants),
532− 0,
533− SPINAND_INFO_VENDOR_OPS(&winbond_w35_ops),
534− SPINAND_ECCINFO(&w35n01jw_ooblayout, NULL),
535− SPINAND_CONFIGURE_CHIP(w35n0xjw_vcr_cfg)),
694+ SPINAND_ECCINFO(&w35n01jw_ooblayout, w25w35nxxjw_ecc_get_status),
695+ SPINAND_CONFIGURE_CHIP(w35n0xjw_vcr_cfg),
696+ SPINAND_CONT_READ(w35n0xjw_set_cont_read)),
536697 /* 2G-bit densities */
537698 SPINAND_INFO("W25M02GV", /* 2x1G-bit 3.3V */
538699 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xab, 0x21),
@@ -549,12 +710,14 @@ static const struct spinand_info winbond_spinand_table[] = { · 10 unmodified lines
549710 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xbf, 0x22),
550711 NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 2, 1),
551712 NAND_ECCREQ(1, 512),
552− SPINAND_INFO_OP_VARIANTS(&read_cache_dual_quad_dtr_variants,
553− &write_cache_variants,
554− &update_cache_variants),
713+ SPINAND_INFO_OP_VARIANTS_WITH_CONT(&read_cache_dual_quad_dtr_variants,
714+ &write_cache_variants,
715+ &update_cache_variants,
716+ &cont_read_cache_dual_quad_dtr_variants),
555717 SPINAND_HAS_QE_BIT,
556− SPINAND_ECCINFO(&w25m02gv_ooblayout, NULL),
557− SPINAND_CONFIGURE_CHIP(w25n0xjw_hs_cfg)),
718+ SPINAND_ECCINFO(&w25m02gv_ooblayout, w25w35nxxjw_ecc_get_status),
719+ SPINAND_CONFIGURE_CHIP(w25n0xjw_hs_cfg),
720+ SPINAND_CONT_READ(w25n0xjw_set_cont_read)),
558721 SPINAND_INFO("W25N02KV", /* 3.3V */
559722 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xaa, 0x22),
560723 NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1),
@@ -573,6 +736,19 @@ static const struct spinand_info winbond_spinand_table[] = { · 12 unmodified lines
573736 &update_cache_variants),
574737 0,
575738 SPINAND_ECCINFO(&w25n02kv_ooblayout, w25n02kv_ecc_get_status)),
739+ SPINAND_INFO("W35N02JW", /* 1.8V */
740+ SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xdf, 0x22),
741+ NAND_MEMORG(1, 4096, 128, 64, 512, 10, 1, 2, 1),
742+ NAND_ECCREQ(1, 512),
743+ SPINAND_INFO_OP_VARIANTS_WITH_CONT(&read_cache_octal_variants,
744+ &write_cache_octal_variants,
745+ &update_cache_octal_variants,
746+ &cont_read_cache_octal_variants),
747+ SPINAND_ODTR_PACKED_PAGE_READ,
748+ SPINAND_INFO_VENDOR_OPS(&winbond_w35_ops),
749+ SPINAND_ECCINFO(&w35n01jw_ooblayout, w25w35nxxjw_ecc_get_status),
750+ SPINAND_CONFIGURE_CHIP(w35n0xjw_vcr_cfg),
751+ SPINAND_CONT_READ(w35n0xjw_set_cont_read)),
576752 /* 4G-bit densities */
577753 SPINAND_INFO("W25N04KV", /* 3.3V */
578754 SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xaa, 0x23),
@@ -592,6 +768,19 @@ static const struct spinand_info winbond_spinand_table[] = { · 13 unmodified lines
592768 &update_cache_variants),
593769 0,
594770 SPINAND_ECCINFO(&w25n02kv_ooblayout, w25n02kv_ecc_get_status)),
771+ SPINAND_INFO("W35N04JW", /* 1.8V */
772+ SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xdf, 0x23),
773+ NAND_MEMORG(1, 4096, 128, 64, 512, 10, 1, 4, 1),
774+ NAND_ECCREQ(1, 512),
775+ SPINAND_INFO_OP_VARIANTS_WITH_CONT(&read_cache_octal_variants,
776+ &write_cache_octal_variants,
777+ &update_cache_octal_variants,
778+ &cont_read_cache_octal_variants),
779+ SPINAND_ODTR_PACKED_PAGE_READ,
780+ SPINAND_INFO_VENDOR_OPS(&winbond_w35_ops),
781+ SPINAND_ECCINFO(&w35n01jw_ooblayout, w25w35nxxjw_ecc_get_status),
782+ SPINAND_CONFIGURE_CHIP(w35n0xjw_vcr_cfg),
783+ SPINAND_CONT_READ(w35n0xjw_set_cont_read)),
595784 };
596785
597786 static int winbond_spinand_init(struct spinand_device *spinand)
drivers/mtd/spi-nor/core.c+12−10
@@ -3711,14 +3711,15 @@ EXPORT_SYMBOL_GPL(spi_nor_scan); · 3710 unmodified lines
37113711 static int spi_nor_create_read_dirmap(struct spi_nor *nor)
37123712 {
37133713 struct spi_mem_dirmap_info info = {
3714− .op_tmpl = SPI_MEM_OP(SPI_MEM_OP_CMD(nor->read_opcode, 0),
3715− SPI_MEM_OP_ADDR(nor->addr_nbytes, 0, 0),
3716− SPI_MEM_OP_DUMMY(nor->read_dummy, 0),
3717− SPI_MEM_OP_DATA_IN(0, NULL, 0)),
3714+ .op_tmpl = &info.primary_op_tmpl,
3715+ .primary_op_tmpl = SPI_MEM_OP(SPI_MEM_OP_CMD(nor->read_opcode, 0),
3716+ SPI_MEM_OP_ADDR(nor->addr_nbytes, 0, 0),
3717+ SPI_MEM_OP_DUMMY(nor->read_dummy, 0),
3718+ SPI_MEM_OP_DATA_IN(0, NULL, 0)),
37183719 .offset = 0,
37193720 .length = nor->params->size,
37203721 };
3721− struct spi_mem_op *op = &info.op_tmpl;
3722+ struct spi_mem_op *op = info.op_tmpl;
37223723
37233724 spi_nor_spimem_setup_op(nor, op, nor->read_proto);
37243725
@@ -3742,14 +3743,15 @@ static int spi_nor_create_read_dirmap(struct spi_nor *nor) · 17 unmodified lines
37423743 static int spi_nor_create_write_dirmap(struct spi_nor *nor)
37433744 {
37443745 struct spi_mem_dirmap_info info = {
3745− .op_tmpl = SPI_MEM_OP(SPI_MEM_OP_CMD(nor->program_opcode, 0),
3746− SPI_MEM_OP_ADDR(nor->addr_nbytes, 0, 0),
3747− SPI_MEM_OP_NO_DUMMY,
3748− SPI_MEM_OP_DATA_OUT(0, NULL, 0)),
3746+ .op_tmpl = &info.primary_op_tmpl,
3747+ .primary_op_tmpl = SPI_MEM_OP(SPI_MEM_OP_CMD(nor->program_opcode, 0),
3748+ SPI_MEM_OP_ADDR(nor->addr_nbytes, 0, 0),
3749+ SPI_MEM_OP_NO_DUMMY,
3750+ SPI_MEM_OP_DATA_OUT(0, NULL, 0)),
37493751 .offset = 0,
37503752 .length = nor->params->size,
37513753 };
3752− struct spi_mem_op *op = &info.op_tmpl;
3754+ struct spi_mem_op *op = info.op_tmpl;
37533755
37543756 if (nor->program_opcode == SPINOR_OP_AAI_WP && nor->sst_write_second)
37553757 op->addr.nbytes = 0;
drivers/mtd/spi-nor/debugfs.c+3−1
@@ -1,5 +1,6 @@
11 // SPDX-License-Identifier: GPL-2.0
22
3+#include <linux/array_size.h>
34 #include <linux/debugfs.h>
45 #include <linux/math64.h>
56 #include <linux/mtd/spi-nor.h>
@@ -98,7 +99,8 @@ static int spi_nor_params_show(struct seq_file *s, void *data) · 92 unmodified lines
9899 seq_printf(s, "address nbytes\t%u\n", nor->addr_nbytes);
99100
100101 seq_puts(s, "flags\t\t");
101− spi_nor_print_flags(s, nor->flags, snor_f_names, sizeof(snor_f_names));
102+ spi_nor_print_flags(s, nor->flags, snor_f_names,
103+ ARRAY_SIZE(snor_f_names));
102104 seq_puts(s, "\n");
103105
104106 seq_puts(s, "\nopcodes\n");
drivers/net/bareudp.c+3−0
@@ -529,6 +529,9 @@ static int bareudp_fill_metadata_dst(struct net_device *dev, · 528 unmodified lines
529529 struct in6_addr saddr;
530530 struct socket *sock = rcu_dereference(bareudp->sock);
531531
532+ if (!sock)
533+ return -ESHUTDOWN;
534+
532535 dst = udp_tunnel6_dst_lookup(skb, dev, bareudp->net, sock,
533536 0, &saddr, &info->key,
534537 sport, bareudp->port, info->key.tos,
drivers/net/bonding/bond_3ad.c+60−49
@@ -1029,6 +1029,7 @@ static void ad_cond_set_peer_notif(struct port *port) · 1028 unmodified lines
10291029 static void ad_mux_machine(struct port *port, bool *update_slave_arr)
10301030 {
10311031 struct bonding *bond = __get_bond_by_port(port);
1032+ struct aggregator *aggregator;
10321033 mux_states_t last_state;
10331034
10341035 /* keep current State Machine state to compare later if it was
@@ -1036,6 +1037,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) · 1 unmodified line
10361037 */
10371038 last_state = port->sm_mux_state;
10381039
1040+ aggregator = rcu_dereference(port->aggregator);
10391041 if (port->sm_vars & AD_PORT_BEGIN) {
10401042 port->sm_mux_state = AD_MUX_DETACHED;
10411043 } else {
@@ -1055,7 +1057,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) · 13 unmodified lines
10551057 * cycle to update ready variable, we check
10561058 * READY_N and update READY here
10571059 */
1058− __set_agg_ports_ready(port->aggregator, __agg_ports_are_ready(port->aggregator));
1060+ __set_agg_ports_ready(aggregator, __agg_ports_are_ready(aggregator));
10591061 port->sm_mux_state = AD_MUX_DETACHED;
10601062 break;
10611063 }
@@ -1070,7 +1072,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) · 8 unmodified lines
10701072 * update ready variable, we check READY_N and update
10711073 * READY here
10721074 */
1073− __set_agg_ports_ready(port->aggregator, __agg_ports_are_ready(port->aggregator));
1075+ __set_agg_ports_ready(aggregator, __agg_ports_are_ready(aggregator));
10741076
10751077 /* if the wait_while_timer expired, and the port is
10761078 * in READY state, move to ATTACHED state
@@ -1086,7 +1088,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) · 9 unmodified lines
10861088 if ((port->sm_vars & AD_PORT_SELECTED) &&
10871089 (port->partner_oper.port_state & LACP_STATE_SYNCHRONIZATION) &&
10881090 !__check_agg_selection_timer(port)) {
1089− if (port->aggregator->is_active) {
1091+ if (aggregator->is_active) {
10901092 int state = AD_MUX_COLLECTING_DISTRIBUTING;
10911093
10921094 if (!bond->params.coupled_control)
@@ -1102,9 +1104,9 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) · 9 unmodified lines
11021104 * cycle to update ready variable, we check
11031105 * READY_N and update READY here
11041106 */
1105− __set_agg_ports_ready(port->aggregator, __agg_ports_are_ready(port->aggregator));
1107+ __set_agg_ports_ready(aggregator, __agg_ports_are_ready(aggregator));
11061108 port->sm_mux_state = AD_MUX_DETACHED;
1107− } else if (port->aggregator->is_active) {
1109+ } else if (aggregator->is_active) {
11081110 port->actor_oper_port_state |=
11091111 LACP_STATE_SYNCHRONIZATION;
11101112 }
@@ -1115,7 +1117,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) · 4 unmodified lines
11151117 * sure that a collecting distributing
11161118 * port in an active aggregator is enabled
11171119 */
1118− if (port->aggregator->is_active &&
1120+ if (aggregator->is_active &&
11191121 !__port_is_collecting_distributing(port)) {
11201122 __enable_port(port);
11211123 *update_slave_arr = true;
@@ -1134,7 +1136,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) · 12 unmodified lines
11341136 */
11351137 struct slave *slave = port->slave;
11361138
1137− if (port->aggregator->is_active &&
1139+ if (aggregator->is_active &&
11381140 bond_is_slave_rx_disabled(slave)) {
11391141 ad_enable_collecting(port);
11401142 *update_slave_arr = true;
@@ -1154,8 +1156,8 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) · 13 unmodified lines
11541156 * sure that a collecting distributing
11551157 * port in an active aggregator is enabled
11561158 */
1157− if (port->aggregator &&
1158− port->aggregator->is_active &&
1159+ if (aggregator &&
1160+ aggregator->is_active &&
11591161 !__port_is_collecting_distributing(port)) {
11601162 __enable_port(port);
11611163 *update_slave_arr = true;
@@ -1187,7 +1189,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) · 25 unmodified lines
11871189 port->sm_mux_timer_counter = __ad_timer_to_ticks(AD_WAIT_WHILE_TIMER, 0);
11881190 break;
11891191 case AD_MUX_ATTACHED:
1190− if (port->aggregator->is_active)
1192+ if (aggregator->is_active)
11911193 port->actor_oper_port_state |=
11921194 LACP_STATE_SYNCHRONIZATION;
11931195 else
@@ -1561,9 +1563,9 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr) · 367 unmodified lines
15611563 bond = __get_bond_by_port(port);
15621564
15631565 /* if the port is connected to other aggregator, detach it */
1564− if (port->aggregator) {
1566+ temp_aggregator = rcu_dereference(port->aggregator);
1567+ if (temp_aggregator) {
15651568 /* detach the port from its former aggregator */
1566− temp_aggregator = port->aggregator;
15671569 for (curr_port = temp_aggregator->lag_ports; curr_port;
15681570 last_port = curr_port,
15691571 curr_port = curr_port->next_port_in_aggregator) {
@@ -1586,7 +1588,7 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr) · 16 unmodified lines
15861588 /* clear the port's relations to this
15871589 * aggregator
15881590 */
1589− port->aggregator = NULL;
1591+ RCU_INIT_POINTER(port->aggregator, NULL);
15901592 port->next_port_in_aggregator = NULL;
15911593 port->actor_port_aggregator_identifier = 0;
15921594
@@ -1609,7 +1611,7 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr) · 16 unmodified lines
16091611 port->slave->bond->dev->name,
16101612 port->slave->dev->name,
16111613 port->actor_port_number,
1612− port->aggregator->aggregator_identifier);
1614+ temp_aggregator->aggregator_identifier);
16131615 }
16141616 }
16151617 /* search on all aggregators for a suitable aggregator for this port */
@@ -1633,15 +1635,15 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr) · 17 unmodified lines
16331635 )
16341636 ) {
16351637 /* attach to the founded aggregator */
1636− port->aggregator = aggregator;
1638+ rcu_assign_pointer(port->aggregator, aggregator);
16371639 port->actor_port_aggregator_identifier =
1638− port->aggregator->aggregator_identifier;
1640+ aggregator->aggregator_identifier;
16391641 port->next_port_in_aggregator = aggregator->lag_ports;
1640− port->aggregator->num_of_ports++;
1642+ aggregator->num_of_ports++;
16411643 aggregator->lag_ports = port;
16421644 slave_dbg(bond->dev, slave->dev, "Port %d joined LAG %d (existing LAG)\n",
16431645 port->actor_port_number,
1644− port->aggregator->aggregator_identifier);
1646+ aggregator->aggregator_identifier);
16451647
16461648 /* mark this port as selected */
16471649 port->sm_vars |= AD_PORT_SELECTED;
@@ -1656,39 +1658,40 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr) · 8 unmodified lines
16561658 if (!found) {
16571659 if (free_aggregator) {
16581660 /* assign port a new aggregator */
1659− port->aggregator = free_aggregator;
16601661 port->actor_port_aggregator_identifier =
1661− port->aggregator->aggregator_identifier;
1662+ free_aggregator->aggregator_identifier;
16621663
16631664 /* update the new aggregator's parameters
16641665 * if port was responsed from the end-user
16651666 */
16661667 if (port->actor_oper_port_key & AD_DUPLEX_KEY_MASKS)
16671668 /* if port is full duplex */
1668− port->aggregator->is_individual = false;
1669+ free_aggregator->is_individual = false;
16691670 else
1670− port->aggregator->is_individual = true;
1671+ free_aggregator->is_individual = true;
16711672
1672− port->aggregator->actor_admin_aggregator_key =
1673+ free_aggregator->actor_admin_aggregator_key =
16731674 port->actor_admin_port_key;
1674− port->aggregator->actor_oper_aggregator_key =
1675+ free_aggregator->actor_oper_aggregator_key =
16751676 port->actor_oper_port_key;
1676− port->aggregator->partner_system =
1677+ free_aggregator->partner_system =
16771678 port->partner_oper.system;
1678− port->aggregator->partner_system_priority =
1679+ free_aggregator->partner_system_priority =
16791680 port->partner_oper.system_priority;
1680− port->aggregator->partner_oper_aggregator_key = port->partner_oper.key;
1681− port->aggregator->receive_state = 1;
1682− port->aggregator->transmit_state = 1;
1683− port->aggregator->lag_ports = port;
1684− port->aggregator->num_of_ports++;
1681+ free_aggregator->partner_oper_aggregator_key = port->partner_oper.key;
1682+ free_aggregator->receive_state = 1;
1683+ free_aggregator->transmit_state = 1;
1684+ free_aggregator->lag_ports = port;
1685+ free_aggregator->num_of_ports++;
1686+
1687+ rcu_assign_pointer(port->aggregator, free_aggregator);
16851688
16861689 /* mark this port as selected */
16871690 port->sm_vars |= AD_PORT_SELECTED;
16881691
16891692 slave_dbg(bond->dev, port->slave->dev, "Port %d joined LAG %d (new LAG)\n",
16901693 port->actor_port_number,
1691− port->aggregator->aggregator_identifier);
1694+ free_aggregator->aggregator_identifier);
16921695 } else {
16931696 slave_err(bond->dev, port->slave->dev,
16941697 "Port %d did not find a suitable aggregator\n",
@@ -1700,13 +1703,12 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr) · 5 unmodified lines
17001703 * in all aggregator's ports, else set ready=FALSE in all
17011704 * aggregator's ports
17021705 */
1703− __set_agg_ports_ready(port->aggregator,
1704− __agg_ports_are_ready(port->aggregator));
1706+ aggregator = rcu_dereference(port->aggregator);
1707+ __set_agg_ports_ready(aggregator, __agg_ports_are_ready(aggregator));
17051708
1706− aggregator = __get_first_agg(port);
1707− ad_agg_selection_logic(aggregator, update_slave_arr);
1709+ ad_agg_selection_logic(__get_first_agg(port), update_slave_arr);
17081710
1709− if (!port->aggregator->is_active)
1711+ if (!aggregator->is_active)
17101712 port->actor_oper_port_state &= ~LACP_STATE_SYNCHRONIZATION;
17111713 }
17121714
@@ -2075,13 +2077,15 @@ static void ad_initialize_port(struct port *port, const struct bond_params *bond · 362 unmodified lines
20752077 */
20762078 static void ad_enable_collecting(struct port *port)
20772079 {
2078− if (port->aggregator->is_active) {
2080+ struct aggregator *aggregator = rcu_dereference(port->aggregator);
2081+
2082+ if (aggregator->is_active) {
20792083 struct slave *slave = port->slave;
20802084
20812085 slave_dbg(slave->bond->dev, slave->dev,
20822086 "Enabling collecting on port %d (LAG %d)\n",
20832087 port->actor_port_number,
2084− port->aggregator->aggregator_identifier);
2088+ aggregator->aggregator_identifier);
20852089 __enable_collecting_port(port);
20862090 }
20872091 }
@@ -2093,11 +2097,13 @@ static void ad_enable_collecting(struct port *port) · 5 unmodified lines
20932097 */
20942098 static void ad_disable_distributing(struct port *port, bool *update_slave_arr)
20952099 {
2096− if (port->aggregator && __agg_has_partner(port->aggregator)) {
2100+ struct aggregator *aggregator = rcu_dereference(port->aggregator);
2101+
2102+ if (aggregator && __agg_has_partner(aggregator)) {
20972103 slave_dbg(port->slave->bond->dev, port->slave->dev,
20982104 "Disabling distributing on port %d (LAG %d)\n",
20992105 port->actor_port_number,
2100− port->aggregator->aggregator_identifier);
2106+ aggregator->aggregator_identifier);
21012107 __disable_distributing_port(port);
21022108 /* Slave array needs an update */
21032109 *update_slave_arr = true;
@@ -2114,11 +2120,13 @@ static void ad_disable_distributing(struct port *port, bool *update_slave_arr) · 10 unmodified lines
21142120 static void ad_enable_collecting_distributing(struct port *port,
21152121 bool *update_slave_arr)
21162122 {
2117− if (port->aggregator->is_active) {
2123+ struct aggregator *aggregator = rcu_dereference(port->aggregator);
2124+
2125+ if (aggregator->is_active) {
21182126 slave_dbg(port->slave->bond->dev, port->slave->dev,
21192127 "Enabling port %d (LAG %d)\n",
21202128 port->actor_port_number,
2121− port->aggregator->aggregator_identifier);
2129+ aggregator->aggregator_identifier);
21222130 __enable_port(port);
21232131 /* Slave array needs update */
21242132 *update_slave_arr = true;
@@ -2135,11 +2143,13 @@ static void ad_enable_collecting_distributing(struct port *port, · 10 unmodified lines
21352143 static void ad_disable_collecting_distributing(struct port *port,
21362144 bool *update_slave_arr)
21372145 {
2138− if (port->aggregator && __agg_has_partner(port->aggregator)) {
2146+ struct aggregator *aggregator = rcu_dereference(port->aggregator);
2147+
2148+ if (aggregator && __agg_has_partner(aggregator)) {
21392149 slave_dbg(port->slave->bond->dev, port->slave->dev,
21402150 "Disabling port %d (LAG %d)\n",
21412151 port->actor_port_number,
2142− port->aggregator->aggregator_identifier);
2152+ aggregator->aggregator_identifier);
21432153 __disable_port(port);
21442154 /* Slave array needs an update */
21452155 *update_slave_arr = true;
@@ -2379,7 +2389,7 @@ void bond_3ad_unbind_slave(struct slave *slave) · 233 unmodified lines
23792389 */
23802390 for (temp_port = aggregator->lag_ports; temp_port;
23812391 temp_port = temp_port->next_port_in_aggregator) {
2382− temp_port->aggregator = new_aggregator;
2392+ rcu_assign_pointer(temp_port->aggregator, new_aggregator);
23832393 temp_port->actor_port_aggregator_identifier = new_aggregator->aggregator_identifier;
23842394 }
23852395
@@ -2848,15 +2858,16 @@ out: · 462 unmodified lines
28482858 int __bond_3ad_get_active_agg_info(struct bonding *bond,
28492859 struct ad_info *ad_info)
28502860 {
2851− struct aggregator *aggregator = NULL;
2861+ struct aggregator *aggregator = NULL, *tmp;
28522862 struct list_head *iter;
28532863 struct slave *slave;
28542864 struct port *port;
28552865
28562866 bond_for_each_slave_rcu(bond, slave, iter) {
28572867 port = &(SLAVE_AD_INFO(slave)->port);
2858− if (port->aggregator && port->aggregator->is_active) {
2859− aggregator = port->aggregator;
2868+ tmp = rcu_dereference(port->aggregator);
2869+ if (tmp && tmp->is_active) {
2870+ aggregator = tmp;
28602871 break;
28612872 }
28622873 }
drivers/net/bonding/bond_main.c+5−3
@@ -1433,7 +1433,7 @@ static void bond_poll_controller(struct net_device *bond_dev) · 1432 unmodified lines
14331433
14341434 if (BOND_MODE(bond) == BOND_MODE_8023AD) {
14351435 struct aggregator *agg =
1436− SLAVE_AD_INFO(slave)->port.aggregator;
1436+ rcu_dereference(SLAVE_AD_INFO(slave)->port.aggregator);
14371437
14381438 if (agg &&
14391439 agg->aggregator_identifier != ad_info.aggregator_id)
@@ -5179,15 +5179,16 @@ int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave) · 3739 unmodified lines
51795179 spin_unlock_bh(&bond->mode_lock);
51805180 agg_id = ad_info.aggregator_id;
51815181 }
5182+ rcu_read_lock();
51825183 bond_for_each_slave(bond, slave, iter) {
51835184 if (skipslave == slave)
51845185 continue;
51855186
51865187 all_slaves->arr[all_slaves->count++] = slave;
51875188 if (BOND_MODE(bond) == BOND_MODE_8023AD) {
5188− struct aggregator *agg;
5189+ const struct aggregator *agg;
51895190
5190− agg = SLAVE_AD_INFO(slave)->port.aggregator;
5191+ agg = rcu_dereference(SLAVE_AD_INFO(slave)->port.aggregator);
51915192 if (!agg || agg->aggregator_identifier != agg_id)
51925193 continue;
51935194 }
@@ -5199,6 +5200,7 @@ int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave) · 5 unmodified lines
51995200
52005201 usable_slaves->arr[usable_slaves->count++] = slave;
52015202 }
5203+ rcu_read_unlock();
52025204
52035205 bond_set_slave_arr(bond, usable_slaves, all_slaves);
52045206 return ret;
drivers/net/bonding/bond_netlink.c+10−6
@@ -66,27 +66,29 @@ static int bond_fill_slave_info(struct sk_buff *skb, · 65 unmodified lines
6666 const struct port *ad_port;
6767
6868 ad_port = &SLAVE_AD_INFO(slave)->port;
69− agg = SLAVE_AD_INFO(slave)->port.aggregator;
69+ rcu_read_lock();
70+ agg = rcu_dereference(SLAVE_AD_INFO(slave)->port.aggregator);
7071 if (agg) {
7172 if (nla_put_u16(skb, IFLA_BOND_SLAVE_AD_AGGREGATOR_ID,
7273 agg->aggregator_identifier))
73− goto nla_put_failure;
74+ goto nla_put_failure_rcu;
7475 if (nla_put_u8(skb,
7576 IFLA_BOND_SLAVE_AD_ACTOR_OPER_PORT_STATE,
7677 ad_port->actor_oper_port_state))
77− goto nla_put_failure;
78+ goto nla_put_failure_rcu;
7879 if (nla_put_u16(skb,
7980 IFLA_BOND_SLAVE_AD_PARTNER_OPER_PORT_STATE,
8081 ad_port->partner_oper.port_state))
81− goto nla_put_failure;
82+ goto nla_put_failure_rcu;
8283
8384 if (nla_put_u8(skb, IFLA_BOND_SLAVE_AD_CHURN_ACTOR_STATE,
8485 ad_port->sm_churn_actor_state))
85− goto nla_put_failure;
86+ goto nla_put_failure_rcu;
8687 if (nla_put_u8(skb, IFLA_BOND_SLAVE_AD_CHURN_PARTNER_STATE,
8788 ad_port->sm_churn_partner_state))
88− goto nla_put_failure;
89+ goto nla_put_failure_rcu;
8990 }
91+ rcu_read_unlock();
9092
9193 if (nla_put_u16(skb, IFLA_BOND_SLAVE_ACTOR_PORT_PRIO,
9294 SLAVE_AD_INFO(slave)->port_priority))
@@ -95,6 +97,8 @@ static int bond_fill_slave_info(struct sk_buff *skb, · 2 unmodified lines
9597
9698 return 0;
9799
100+nla_put_failure_rcu:
101+ rcu_read_unlock();
98102 nla_put_failure:
99103 return -EMSGSIZE;
100104 }
drivers/net/bonding/bond_procfs.c+2−1
@@ -188,6 +188,7 @@ static void bond_info_show_master(struct seq_file *seq) · 187 unmodified lines
188188 }
189189 }
190190
191+/* Note: runs under rcu_read_lock() */
191192 static void bond_info_show_slave(struct seq_file *seq,
192193 const struct slave *slave)
193194 {
@@ -214,7 +215,7 @@ static void bond_info_show_slave(struct seq_file *seq, · 20 unmodified lines
214215
215216 if (BOND_MODE(bond) == BOND_MODE_8023AD) {
216217 const struct port *port = &SLAVE_AD_INFO(slave)->port;
217− const struct aggregator *agg = port->aggregator;
218+ const struct aggregator *agg = rcu_dereference(port->aggregator);
218219
219220 if (agg) {
220221 seq_printf(seq, "Aggregator ID: %d\n",
drivers/net/bonding/bond_sysfs_slave.c+11−6
@@ -62,10 +62,15 @@ static ssize_t ad_aggregator_id_show(struct slave *slave, char *buf) · 61 unmodified lines
6262 const struct aggregator *agg;
6363
6464 if (BOND_MODE(slave->bond) == BOND_MODE_8023AD) {
65− agg = SLAVE_AD_INFO(slave)->port.aggregator;
66− if (agg)
67− return sysfs_emit(buf, "%d\n",
68− agg->aggregator_identifier);
65+ rcu_read_lock();
66+ agg = rcu_dereference(SLAVE_AD_INFO(slave)->port.aggregator);
67+ if (agg) {
68+ ssize_t res = sysfs_emit(buf, "%d\n",
69+ agg->aggregator_identifier);
70+ rcu_read_unlock();
71+ return res;
72+ }
73+ rcu_read_unlock();
6974 }
7075
7176 return sysfs_emit(buf, "N/A\n");
@@ -78,7 +83,7 @@ static ssize_t ad_actor_oper_port_state_show(struct slave *slave, char *buf) · 6 unmodified lines
7883
7984 if (BOND_MODE(slave->bond) == BOND_MODE_8023AD) {
8085 ad_port = &SLAVE_AD_INFO(slave)->port;
81− if (ad_port->aggregator)
86+ if (rcu_access_pointer(ad_port->aggregator))
8287 return sysfs_emit(buf, "%u\n",
8388 ad_port->actor_oper_port_state);
8489 }
@@ -93,7 +98,7 @@ static ssize_t ad_partner_oper_port_state_show(struct slave *slave, char *buf) · 8 unmodified lines
9398
9499 if (BOND_MODE(slave->bond) == BOND_MODE_8023AD) {
95100 ad_port = &SLAVE_AD_INFO(slave)->port;
96− if (ad_port->aggregator)
101+ if (rcu_access_pointer(ad_port->aggregator))
97102 return sysfs_emit(buf, "%u\n",
98103 ad_port->partner_oper.port_state);
99104 }
drivers/net/ethernet/airoha/airoha_eth.c+30−21
@@ -847,13 +847,24 @@ static void airoha_qdma_wake_netdev_txqs(struct airoha_queue *q) · 846 unmodified lines
847847 {
848848 struct airoha_qdma *qdma = q->qdma;
849849 struct airoha_eth *eth = qdma->eth;
850− int i;
850+ int i, qid = q - &qdma->q_tx[0];
851851
852852 for (i = 0; i < ARRAY_SIZE(eth->ports); i++) {
853853 struct airoha_gdm_port *port = eth->ports[i];
854+ int j;
855+
856+ if (!port)
857+ continue;
858+
859+ if (port->qdma != qdma)
860+ continue;
854861
855− if (port && port->qdma == qdma)
856− netif_tx_wake_all_queues(port->dev);
862+ for (j = 0; j < port->dev->num_tx_queues; j++) {
863+ if (airoha_qdma_get_txq(qdma, j) != qid)
864+ continue;
865+
866+ netif_wake_subqueue(port->dev, j);
867+ }
857868 }
858869 q->txq_stopped = false;
859870 }
@@ -929,10 +940,9 @@ static int airoha_qdma_tx_napi_poll(struct napi_struct *napi, int budget) · 69 unmodified lines
929940 q->queued--;
930941
931942 if (skb) {
932− u16 queue = skb_get_queue_mapping(skb);
933943 struct netdev_queue *txq;
934944
935− txq = netdev_get_tx_queue(skb->dev, queue);
945+ txq = skb_get_tx_queue(skb->dev, skb);
936946 netdev_tx_completed_queue(txq, 1, skb->len);
937947 dev_kfree_skb_any(skb);
938948 }
@@ -1737,14 +1747,11 @@ static int airoha_dev_stop(struct net_device *dev) · 798 unmodified lines
17371747 {
17381748 struct airoha_gdm_port *port = netdev_priv(dev);
17391749 struct airoha_qdma *qdma = port->qdma;
1740− int i, err;
1750+ int i;
17411751
17421752 netif_tx_disable(dev);
1743− err = airoha_set_vip_for_gdm_port(port, false);
1744− if (err)
1745− return err;
1746−
1747− for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++)
1753+ airoha_set_vip_for_gdm_port(port, false);
1754+ for (i = 0; i < dev->num_tx_queues; i++)
17481755 netdev_tx_reset_subqueue(dev, i);
17491756
17501757 airoha_set_gdm_port_fwd_cfg(qdma->eth, REG_GDM_FWD_CFG(port->id),
@@ -1997,12 +2004,12 @@ static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb, · 246 unmodified lines
19972004 struct netdev_queue *txq;
19982005 struct airoha_queue *q;
19992006 LIST_HEAD(tx_list);
2007+ int i = 0, qid;
20002008 void *data;
2001− int i, qid;
20022009 u16 index;
20032010 u8 fport;
20042011
2005− qid = skb_get_queue_mapping(skb) % ARRAY_SIZE(qdma->q_tx);
2012+ qid = airoha_qdma_get_txq(qdma, skb_get_queue_mapping(skb));
20062013 tag = airoha_get_dsa_tag(skb, dev);
20072014
20082015 msg0 = FIELD_PREP(QDMA_ETH_TXMSG_CHAN_MASK,
@@ -2039,7 +2046,7 @@ static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb, · 30 unmodified lines
20392046
20402047 spin_lock_bh(&q->lock);
20412048
2042− txq = netdev_get_tx_queue(dev, qid);
2049+ txq = skb_get_tx_queue(dev, skb);
20432050 nr_frags = 1 + skb_shinfo(skb)->nr_frags;
20442051
20452052 if (q->queued + nr_frags >= q->ndesc) {
@@ -2057,7 +2064,7 @@ static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb, · 11 unmodified lines
20572064 list);
20582065 index = e - q->entry;
20592066
2060− for (i = 0; i < nr_frags; i++) {
2067+ while (true) {
20612068 struct airoha_qdma_desc *desc = &q->desc[index];
20622069 skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
20632070 dma_addr_t addr;
@@ -2069,7 +2076,7 @@ static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb, · 5 unmodified lines
20692076 goto error_unmap;
20702077
20712078 list_move_tail(&e->list, &tx_list);
2072− e->skb = i ? NULL : skb;
2079+ e->skb = i == nr_frags - 1 ? skb : NULL;
20732080 e->dma_addr = addr;
20742081 e->dma_len = len;
20752082
@@ -2088,6 +2095,9 @@ static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb, · 12 unmodified lines
20882095 WRITE_ONCE(desc->msg1, cpu_to_le32(msg1));
20892096 WRITE_ONCE(desc->msg2, cpu_to_le32(0xffff));
20902097
2098+ if (++i == nr_frags)
2099+ break;
2100+
20912101 data = skb_frag_address(frag);
20922102 len = skb_frag_size(frag);
20932103 }
@@ -2095,17 +2105,16 @@ static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb, · 1 unmodified line
20952105
20962106 skb_tx_timestamp(skb);
20972107 netdev_tx_sent_queue(txq, skb->len);
2108+ if (q->ndesc - q->queued < q->free_thr) {
2109+ netif_tx_stop_queue(txq);
2110+ q->txq_stopped = true;
2111+ }
20982112
20992113 if (netif_xmit_stopped(txq) || !netdev_xmit_more())
21002114 airoha_qdma_rmw(qdma, REG_TX_CPU_IDX(qid),
21012115 TX_RING_CPU_IDX_MASK,
21022116 FIELD_PREP(TX_RING_CPU_IDX_MASK, index));
21032117
2104− if (q->ndesc - q->queued < q->free_thr) {
2105− netif_tx_stop_queue(txq);
2106− q->txq_stopped = true;
2107− }
2108−
21092118 spin_unlock_bh(&q->lock);
21102119
21112120 return NETDEV_TX_OK;
drivers/net/ethernet/airoha/airoha_eth.h+5−0
@@ -631,6 +631,11 @@ u32 airoha_rmw(void __iomem *base, u32 offset, u32 mask, u32 val); · 630 unmodified lines
631631 #define airoha_qdma_clear(qdma, offset, val) \
632632 airoha_rmw((qdma)->regs, (offset), (val), 0)
633633
634+static inline u16 airoha_qdma_get_txq(struct airoha_qdma *qdma, u16 qid)
635+{
636+ return qid % ARRAY_SIZE(qdma->q_tx);
637+}
638+
634639 static inline bool airoha_is_lan_gdm_port(struct airoha_gdm_port *port)
635640 {
636641 /* GDM1 port on EN7581 SoC is connected to the lan dsa switch.
drivers/net/ethernet/ibm/ibmveth.c+22−0
@@ -1756,6 +1756,27 @@ static int ibmveth_set_mac_addr(struct net_device *dev, void *p) · 1755 unmodified lines
17561756 return 0;
17571757 }
17581758
1759+static netdev_features_t ibmveth_features_check(struct sk_buff *skb,
1760+ struct net_device *dev,
1761+ netdev_features_t features)
1762+{
1763+ /* Some physical adapters do not support segmentation offload with
1764+ * MSS < 224. Disable GSO for such packets to avoid adapter freeze.
1765+ * Note: Single-segment packets (gso_segs == 1) don't need this check
1766+ * as they bypass the LSO path and are transmitted without segmentation.
1767+ */
1768+ if (skb_is_gso(skb)) {
1769+ if (skb_shinfo(skb)->gso_size < IBMVETH_MIN_LSO_MSS) {
1770+ netdev_warn_once(dev,
1771+ "MSS %u too small for LSO, disabling GSO\n",
1772+ skb_shinfo(skb)->gso_size);
1773+ features &= ~NETIF_F_GSO_MASK;
1774+ }
1775+ }
1776+
1777+ return vlan_features_check(skb, features);
1778+}
1779+
17591780 static const struct net_device_ops ibmveth_netdev_ops = {
17601781 .ndo_open = ibmveth_open,
17611782 .ndo_stop = ibmveth_close,
@@ -1767,6 +1788,7 @@ static const struct net_device_ops ibmveth_netdev_ops = { · 5 unmodified lines
17671788 .ndo_set_features = ibmveth_set_features,
17681789 .ndo_validate_addr = eth_validate_addr,
17691790 .ndo_set_mac_address = ibmveth_set_mac_addr,
1791+ .ndo_features_check = ibmveth_features_check,
17701792 #ifdef CONFIG_NET_POLL_CONTROLLER
17711793 .ndo_poll_controller = ibmveth_poll_controller,
17721794 #endif
drivers/net/ethernet/ibm/ibmveth.h+1−0
@@ -37,6 +37,7 @@ · 36 unmodified lines
3737 #define IBMVETH_ILLAN_IPV4_TCP_CSUM 0x0000000000000002UL
3838 #define IBMVETH_ILLAN_ACTIVE_TRUNK 0x0000000000000001UL
3939
40+#define IBMVETH_MIN_LSO_MSS 224 /* Minimum MSS for LSO */
4041 /* hcall macros */
4142 #define h_register_logical_lan(ua, buflst, rxq, fltlst, mac) \
4243 plpar_hcall_norets(H_REGISTER_LOGICAL_LAN, ua, buflst, rxq, fltlst, mac)
drivers/net/ethernet/intel/iavf/iavf.h+4−5
@@ -158,11 +158,10 @@ struct iavf_vlan { · 157 unmodified lines
158158 enum iavf_vlan_state_t {
159159 IAVF_VLAN_INVALID,
160160 IAVF_VLAN_ADD, /* filter needs to be added */
161− IAVF_VLAN_IS_NEW, /* filter is new, wait for PF answer */
162− IAVF_VLAN_ACTIVE, /* filter is accepted by PF */
163− IAVF_VLAN_DISABLE, /* filter needs to be deleted by PF, then marked INACTIVE */
164− IAVF_VLAN_INACTIVE, /* filter is inactive, we are in IFF_DOWN */
165− IAVF_VLAN_REMOVE, /* filter needs to be removed from list */
161+ IAVF_VLAN_ADDING, /* ADD sent to PF, waiting for response */
162+ IAVF_VLAN_ACTIVE, /* PF confirmed, filter is in HW */
163+ IAVF_VLAN_REMOVE, /* filter queued for DEL from PF */
164+ IAVF_VLAN_REMOVING, /* DEL sent to PF, waiting for response */
166165 };
167166
168167 struct iavf_vlan_filter {
drivers/net/ethernet/intel/iavf/iavf_main.c+12−40
@@ -757,10 +757,10 @@ iavf_vlan_filter *iavf_add_vlan(struct iavf_adapter *adapter, · 756 unmodified lines
757757 adapter->num_vlan_filters++;
758758 iavf_schedule_aq_request(adapter, IAVF_FLAG_AQ_ADD_VLAN_FILTER);
759759 } else if (f->state == IAVF_VLAN_REMOVE) {
760− /* Re-add the filter since we cannot tell whether the
761− * pending delete has already been processed by the PF.
762− * A duplicate add is harmless.
763− */
760+ /* DEL not yet sent to PF, cancel it */
761+ f->state = IAVF_VLAN_ACTIVE;
762+ } else if (f->state == IAVF_VLAN_REMOVING) {
763+ /* DEL already sent to PF, re-add after completion */
764764 f->state = IAVF_VLAN_ADD;
765765 iavf_schedule_aq_request(adapter,
766766 IAVF_FLAG_AQ_ADD_VLAN_FILTER);
@@ -791,37 +791,19 @@ static void iavf_del_vlan(struct iavf_adapter *adapter, struct iavf_vlan vlan) · 24 unmodified lines
791791 list_del(&f->list);
792792 kfree(f);
793793 adapter->num_vlan_filters--;
794− } else {
794+ } else if (f->state != IAVF_VLAN_REMOVING) {
795795 f->state = IAVF_VLAN_REMOVE;
796796 iavf_schedule_aq_request(adapter,
797797 IAVF_FLAG_AQ_DEL_VLAN_FILTER);
798798 }
799+ /* If REMOVING, DEL is already sent to PF; completion
800+ * handler will free the filter when PF confirms.
801+ */
799802 }
800803
801804 spin_unlock_bh(&adapter->mac_vlan_list_lock);
802805 }
803806
804−/**
805− * iavf_restore_filters
806− * @adapter: board private structure
807− *
808− * Restore existing non MAC filters when VF netdev comes back up
809− **/
810−static void iavf_restore_filters(struct iavf_adapter *adapter)
811−{
812− struct iavf_vlan_filter *f;
813−
814− /* re-add all VLAN filters */
815− spin_lock_bh(&adapter->mac_vlan_list_lock);
816−
817− list_for_each_entry(f, &adapter->vlan_filter_list, list) {
818− if (f->state == IAVF_VLAN_INACTIVE)
819− f->state = IAVF_VLAN_ADD;
820− }
821−
822− spin_unlock_bh(&adapter->mac_vlan_list_lock);
823− adapter->aq_required |= IAVF_FLAG_AQ_ADD_VLAN_FILTER;
824−}
825807
826808 /**
827809 * iavf_get_num_vlans_added - get number of VLANs added
@@ -1246,13 +1228,12 @@ static void iavf_up_complete(struct iavf_adapter *adapter) · 418 unmodified lines
12461228 }
12471229
12481230 /**
1249− * iavf_clear_mac_vlan_filters - Remove mac and vlan filters not sent to PF
1250− * yet and mark other to be removed.
1231+ * iavf_clear_mac_filters - Remove MAC filters not sent to PF yet and mark
1232+ * others to be removed.
12511233 * @adapter: board private structure
12521234 **/
1253−static void iavf_clear_mac_vlan_filters(struct iavf_adapter *adapter)
1235+static void iavf_clear_mac_filters(struct iavf_adapter *adapter)
12541236 {
1255− struct iavf_vlan_filter *vlf, *vlftmp;
12561237 struct iavf_mac_filter *f, *ftmp;
12571238
12581239 spin_lock_bh(&adapter->mac_vlan_list_lock);
@@ -1271,11 +1252,6 @@ static void iavf_clear_mac_vlan_filters(struct iavf_adapter *adapter) · 12 unmodified lines
12711252 }
12721253 }
12731254
1274− /* disable all VLAN filters */
1275− list_for_each_entry_safe(vlf, vlftmp, &adapter->vlan_filter_list,
1276− list)
1277− vlf->state = IAVF_VLAN_DISABLE;
1278−
12791255 spin_unlock_bh(&adapter->mac_vlan_list_lock);
12801256 }
12811257
@@ -1371,7 +1347,7 @@ void iavf_down(struct iavf_adapter *adapter) · 89 unmodified lines
13711347 iavf_napi_disable_all(adapter);
13721348 iavf_irq_disable(adapter);
13731349
1374− iavf_clear_mac_vlan_filters(adapter);
1350+ iavf_clear_mac_filters(adapter);
13751351 iavf_clear_cloud_filters(adapter);
13761352 iavf_clear_fdir_filters(adapter);
13771353 iavf_clear_adv_rss_conf(adapter);
@@ -1388,8 +1364,6 @@ void iavf_down(struct iavf_adapter *adapter) · 10 unmodified lines
13881364 */
13891365 if (!list_empty(&adapter->mac_filter_list))
13901366 adapter->aq_required |= IAVF_FLAG_AQ_DEL_MAC_FILTER;
1391− if (!list_empty(&adapter->vlan_filter_list))
1392− adapter->aq_required |= IAVF_FLAG_AQ_DEL_VLAN_FILTER;
13931367 if (!list_empty(&adapter->cloud_filter_list))
13941368 adapter->aq_required |= IAVF_FLAG_AQ_DEL_CLOUD_FILTER;
13951369 if (!list_empty(&adapter->fdir_list_head))
@@ -4494,8 +4468,6 @@ static int iavf_open(struct net_device *netdev) · 3098 unmodified lines
44944468 iavf_add_filter(adapter, adapter->hw.mac.addr);
44954469 spin_unlock_bh(&adapter->mac_vlan_list_lock);
44964470
4497− /* Restore filters that were removed with IFF_DOWN */
4498− iavf_restore_filters(adapter);
44994471 iavf_restore_fdir_filters(adapter);
45004472
45014473 iavf_configure(adapter);
drivers/net/ethernet/intel/iavf/iavf_virtchnl.c+36−40
@@ -746,7 +746,7 @@ static void iavf_vlan_add_reject(struct iavf_adapter *adapter) · 745 unmodified lines
746746
747747 spin_lock_bh(&adapter->mac_vlan_list_lock);
748748 list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) {
749− if (f->state == IAVF_VLAN_IS_NEW) {
749+ if (f->state == IAVF_VLAN_ADDING) {
750750 list_del(&f->list);
751751 kfree(f);
752752 adapter->num_vlan_filters--;
@@ -812,7 +812,7 @@ void iavf_add_vlans(struct iavf_adapter *adapter) · 59 unmodified lines
812812 if (f->state == IAVF_VLAN_ADD) {
813813 vvfl->vlan_id[i] = f->vlan.vid;
814814 i++;
815− f->state = IAVF_VLAN_IS_NEW;
815+ f->state = IAVF_VLAN_ADDING;
816816 if (i == count)
817817 break;
818818 }
@@ -874,7 +874,7 @@ void iavf_add_vlans(struct iavf_adapter *adapter) · 55 unmodified lines
874874 vlan->tpid = f->vlan.tpid;
875875
876876 i++;
877− f->state = IAVF_VLAN_IS_NEW;
877+ f->state = IAVF_VLAN_ADDING;
878878 }
879879 }
880880
@@ -911,22 +911,12 @@ void iavf_del_vlans(struct iavf_adapter *adapter) · 30 unmodified lines
911911 spin_lock_bh(&adapter->mac_vlan_list_lock);
912912
913913 list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) {
914− /* since VLAN capabilities are not allowed, we dont want to send
915− * a VLAN delete request because it will most likely fail and
916− * create unnecessary errors/noise, so just free the VLAN
917− * filters marked for removal to enable bailing out before
918− * sending a virtchnl message
919− */
920914 if (f->state == IAVF_VLAN_REMOVE &&
921915 !VLAN_FILTERING_ALLOWED(adapter)) {
922916 list_del(&f->list);
923917 kfree(f);
924918 adapter->num_vlan_filters--;
925− } else if (f->state == IAVF_VLAN_DISABLE &&
926− !VLAN_FILTERING_ALLOWED(adapter)) {
927− f->state = IAVF_VLAN_INACTIVE;
928− } else if (f->state == IAVF_VLAN_REMOVE ||
929− f->state == IAVF_VLAN_DISABLE) {
919+ } else if (f->state == IAVF_VLAN_REMOVE) {
930920 count++;
931921 }
932922 }
@@ -958,18 +948,10 @@ void iavf_del_vlans(struct iavf_adapter *adapter) · 25 unmodified lines
958948
959949 vvfl->vsi_id = adapter->vsi_res->vsi_id;
960950 vvfl->num_elements = count;
961− list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) {
962− if (f->state == IAVF_VLAN_DISABLE) {
963− vvfl->vlan_id[i] = f->vlan.vid;
964− f->state = IAVF_VLAN_INACTIVE;
965− i++;
966− if (i == count)
967− break;
968− } else if (f->state == IAVF_VLAN_REMOVE) {
951+ list_for_each_entry(f, &adapter->vlan_filter_list, list) {
952+ if (f->state == IAVF_VLAN_REMOVE) {
969953 vvfl->vlan_id[i] = f->vlan.vid;
970− list_del(&f->list);
971− kfree(f);
972− adapter->num_vlan_filters--;
954+ f->state = IAVF_VLAN_REMOVING;
973955 i++;
974956 if (i == count)
975957 break;
@@ -1006,9 +988,8 @@ void iavf_del_vlans(struct iavf_adapter *adapter) · 30 unmodified lines
1006988
1007989 vvfl_v2->vport_id = adapter->vsi_res->vsi_id;
1008990 vvfl_v2->num_elements = count;
1009− list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) {
1010− if (f->state == IAVF_VLAN_DISABLE ||
1011− f->state == IAVF_VLAN_REMOVE) {
991+ list_for_each_entry(f, &adapter->vlan_filter_list, list) {
992+ if (f->state == IAVF_VLAN_REMOVE) {
1012993 struct virtchnl_vlan_supported_caps *filtering_support =
1013994 &adapter->vlan_v2_caps.filtering.filtering_support;
1014995 struct virtchnl_vlan *vlan;
@@ -1022,13 +1003,7 @@ void iavf_del_vlans(struct iavf_adapter *adapter) · 7 unmodified lines
10221003 vlan->tci = f->vlan.vid;
10231004 vlan->tpid = f->vlan.tpid;
10241005
1025− if (f->state == IAVF_VLAN_DISABLE) {
1026− f->state = IAVF_VLAN_INACTIVE;
1027− } else {
1028− list_del(&f->list);
1029− kfree(f);
1030− adapter->num_vlan_filters--;
1031− }
1006+ f->state = IAVF_VLAN_REMOVING;
10321007 i++;
10331008 if (i == count)
10341009 break;
@@ -2391,10 +2366,6 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, · 1356 unmodified lines
23912366 ether_addr_copy(adapter->hw.mac.addr, netdev->dev_addr);
23922367 wake_up(&adapter->vc_waitqueue);
23932368 break;
2394− case VIRTCHNL_OP_DEL_VLAN:
2395− dev_err(&adapter->pdev->dev, "Failed to delete VLAN filter, error %s\n",
2396− iavf_stat_str(&adapter->hw, v_retval));
2397− break;
23982369 case VIRTCHNL_OP_DEL_ETH_ADDR:
23992370 dev_err(&adapter->pdev->dev, "Failed to delete MAC filter, error %s\n",
24002371 iavf_stat_str(&adapter->hw, v_retval));
@@ -2905,17 +2876,42 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, · 504 unmodified lines
29052876 spin_unlock_bh(&adapter->adv_rss_lock);
29062877 }
29072878 break;
2879+ case VIRTCHNL_OP_ADD_VLAN:
29082880 case VIRTCHNL_OP_ADD_VLAN_V2: {
29092881 struct iavf_vlan_filter *f;
29102882
2883+ if (v_retval)
2884+ break;
2885+
29112886 spin_lock_bh(&adapter->mac_vlan_list_lock);
29122887 list_for_each_entry(f, &adapter->vlan_filter_list, list) {
2913− if (f->state == IAVF_VLAN_IS_NEW)
2888+ if (f->state == IAVF_VLAN_ADDING)
29142889 f->state = IAVF_VLAN_ACTIVE;
29152890 }
29162891 spin_unlock_bh(&adapter->mac_vlan_list_lock);
29172892 }
29182893 break;
2894+ case VIRTCHNL_OP_DEL_VLAN:
2895+ case VIRTCHNL_OP_DEL_VLAN_V2: {
2896+ struct iavf_vlan_filter *f, *ftmp;
2897+
2898+ spin_lock_bh(&adapter->mac_vlan_list_lock);
2899+ list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list,
2900+ list) {
2901+ if (f->state == IAVF_VLAN_REMOVING) {
2902+ if (v_retval) {
2903+ /* PF rejected DEL, keep filter */
2904+ f->state = IAVF_VLAN_ACTIVE;
2905+ } else {
2906+ list_del(&f->list);
2907+ kfree(f);
2908+ adapter->num_vlan_filters--;
2909+ }
2910+ }
2911+ }
2912+ spin_unlock_bh(&adapter->mac_vlan_list_lock);
2913+ }
2914+ break;
29192915 case VIRTCHNL_OP_ENABLE_VLAN_STRIPPING:
29202916 /* PF enabled vlan strip on this VF.
29212917 * Update netdev->features if needed to be in sync with ethtool.
drivers/net/ethernet/intel/ice/devlink/devlink.c+2−0
@@ -1245,6 +1245,8 @@ static int ice_devlink_reinit_up(struct ice_pf *pf) · 1244 unmodified lines
12451245 return err;
12461246 }
12471247
1248+ ice_init_dev_hw(pf);
1249+
12481250 /* load MSI-X values */
12491251 ice_set_min_max_msix(pf);
12501252
drivers/net/ethernet/intel/ice/ice_common.c+0−2
@@ -1126,8 +1126,6 @@ int ice_init_hw(struct ice_hw *hw) · 1125 unmodified lines
11261126 if (status)
11271127 goto err_unroll_fltr_mgmt_struct;
11281128
1129− ice_init_dev_hw(hw->back);
1130−
11311129 mutex_init(&hw->tnl_lock);
11321130 ice_init_chk_recipe_reuse_support(hw);
11331131
drivers/net/ethernet/intel/ice/ice_dpll.c+134−12
@@ -1154,6 +1154,32 @@ ice_dpll_input_state_get(const struct dpll_pin *pin, void *pin_priv, · 1153 unmodified lines
11541154 extack, ICE_DPLL_PIN_TYPE_INPUT);
11551155 }
11561156
1157+/**
1158+ * ice_dpll_sw_pin_notify_peer - notify the paired SW pin after a state change
1159+ * @d: pointer to dplls struct
1160+ * @changed: the SW pin that was explicitly changed (already notified by dpll core)
1161+ *
1162+ * SMA and U.FL pins share physical signal paths in pairs (SMA1/U.FL1 and
1163+ * SMA2/U.FL2). When one pin's routing changes via the PCA9575 GPIO
1164+ * expander, the paired pin's state may also change. Send a change
1165+ * notification for the peer pin so userspace consumers monitoring the
1166+ * peer via dpll netlink learn about the update.
1167+ *
1168+ * Context: Called from dpll_pin_ops callbacks after pf->dplls.lock is
1169+ * released. Uses __dpll_pin_change_ntf() because dpll_lock is
1170+ * still held by the dpll netlink layer.
1171+ */
1172+static void ice_dpll_sw_pin_notify_peer(struct ice_dplls *d,
1173+ struct ice_dpll_pin *changed)
1174+{
1175+ struct ice_dpll_pin *peer;
1176+
1177+ peer = (changed >= d->sma && changed < d->sma + ICE_DPLL_PIN_SW_NUM) ?
1178+ &d->ufl[changed->idx] : &d->sma[changed->idx];
1179+ if (peer->pin)
1180+ __dpll_pin_change_ntf(peer->pin);
1181+}
1182+
11571183 /**
11581184 * ice_dpll_sma_direction_set - set direction of SMA pin
11591185 * @p: pointer to a pin
@@ -1171,6 +1197,8 @@ static int ice_dpll_sma_direction_set(struct ice_dpll_pin *p, · 11 unmodified lines
11711197 enum dpll_pin_direction direction,
11721198 struct netlink_ext_ack *extack)
11731199 {
1200+ struct ice_dplls *d = &p->pf->dplls;
1201+ struct ice_dpll_pin *peer;
11741202 u8 data;
11751203 int ret;
11761204
@@ -1189,8 +1217,9 @@ static int ice_dpll_sma_direction_set(struct ice_dpll_pin *p, · 12 unmodified lines
11891217 case ICE_DPLL_PIN_SW_2_IDX:
11901218 if (direction == DPLL_PIN_DIRECTION_INPUT) {
11911219 data &= ~ICE_SMA2_DIR_EN;
1220+ data |= ICE_SMA2_UFL2_RX_DIS;
11921221 } else {
1193− data &= ~ICE_SMA2_TX_EN;
1222+ data &= ~(ICE_SMA2_TX_EN | ICE_SMA2_UFL2_RX_DIS);
11941223 data |= ICE_SMA2_DIR_EN;
11951224 }
11961225 break;
@@ -1202,6 +1231,34 @@ static int ice_dpll_sma_direction_set(struct ice_dpll_pin *p, · 5 unmodified lines
12021231 ret = ice_dpll_pin_state_update(p->pf, p,
12031232 ICE_DPLL_PIN_TYPE_SOFTWARE,
12041233 extack);
1234+ if (ret)
1235+ return ret;
1236+
1237+ /* When a direction change activates the paired U.FL pin, enable
1238+ * its backing CGU pin so the pin reports as connected. Without
1239+ * this the U.FL routing is correct but the CGU pin stays disabled
1240+ * and userspace sees the pin as disconnected. Do not disable the
1241+ * backing pin when U.FL becomes inactive because the SMA pin may
1242+ * still be using it.
1243+ */
1244+ peer = &d->ufl[p->idx];
1245+ if (peer->active) {
1246+ struct ice_dpll_pin *target;
1247+ enum ice_dpll_pin_type type;
1248+
1249+ if (peer->output) {
1250+ target = peer->output;
1251+ type = ICE_DPLL_PIN_TYPE_OUTPUT;
1252+ } else {
1253+ target = peer->input;
1254+ type = ICE_DPLL_PIN_TYPE_INPUT;
1255+ }
1256+ ret = ice_dpll_pin_enable(&p->pf->hw, target,
1257+ d->eec.dpll_idx, type, extack);
1258+ if (!ret)
1259+ ret = ice_dpll_pin_state_update(p->pf, target,
1260+ type, extack);
1261+ }
12051262
12061263 return ret;
12071264 }
@@ -1253,6 +1310,14 @@ ice_dpll_ufl_pin_state_set(const struct dpll_pin *pin, void *pin_priv, · 45 unmodified lines
12531310 data &= ~ICE_SMA1_MASK;
12541311 enable = true;
12551312 } else if (state == DPLL_PIN_STATE_DISCONNECTED) {
1313+ /* Skip if U.FL1 is not active, setting TX_EN
1314+ * while DIR_EN is set would also deactivate
1315+ * the paired SMA1 output.
1316+ */
1317+ if (data & (ICE_SMA1_DIR_EN | ICE_SMA1_TX_EN)) {
1318+ ret = 0;
1319+ goto unlock;
1320+ }
12561321 data |= ICE_SMA1_TX_EN;
12571322 enable = false;
12581323 } else {
@@ -1267,6 +1332,15 @@ ice_dpll_ufl_pin_state_set(const struct dpll_pin *pin, void *pin_priv, · 8 unmodified lines
12671332 data &= ~ICE_SMA2_UFL2_RX_DIS;
12681333 enable = true;
12691334 } else if (state == DPLL_PIN_STATE_DISCONNECTED) {
1335+ /* Skip if U.FL2 is not active, setting
1336+ * UFL2_RX_DIS could also disable the paired
1337+ * SMA2 input.
1338+ */
1339+ if (!(data & ICE_SMA2_DIR_EN) ||
1340+ (data & ICE_SMA2_UFL2_RX_DIS)) {
1341+ ret = 0;
1342+ goto unlock;
1343+ }
12701344 data |= ICE_SMA2_UFL2_RX_DIS;
12711345 enable = false;
12721346 } else {
@@ -1296,6 +1370,8 @@ ice_dpll_ufl_pin_state_set(const struct dpll_pin *pin, void *pin_priv, · 23 unmodified lines
12961370
12971371 unlock:
12981372 mutex_unlock(&pf->dplls.lock);
1373+ if (!ret)
1374+ ice_dpll_sw_pin_notify_peer(&pf->dplls, p);
12991375
13001376 return ret;
13011377 }
@@ -1414,6 +1490,8 @@ ice_dpll_sma_pin_state_set(const struct dpll_pin *pin, void *pin_priv, · 112 unmodified lines
14141490
14151491 unlock:
14161492 mutex_unlock(&pf->dplls.lock);
1493+ if (!ret)
1494+ ice_dpll_sw_pin_notify_peer(&pf->dplls, sma);
14171495
14181496 return ret;
14191497 }
@@ -1609,6 +1687,8 @@ ice_dpll_pin_sma_direction_set(const struct dpll_pin *pin, void *pin_priv, · 189 unmodified lines
16091687 mutex_lock(&pf->dplls.lock);
16101688 ret = ice_dpll_sma_direction_set(p, direction, extack);
16111689 mutex_unlock(&pf->dplls.lock);
1690+ if (!ret)
1691+ ice_dpll_sw_pin_notify_peer(&pf->dplls, p);
16121692
16131693 return ret;
16141694 }
@@ -1915,7 +1995,10 @@ ice_dpll_phase_offset_get(const struct dpll_pin *pin, void *pin_priv, · 300 unmodified lines
19151995 d->active_input == p->input->pin))
19161996 *phase_offset = d->phase_offset * ICE_DPLL_PHASE_OFFSET_FACTOR;
19171997 else if (d->phase_offset_monitor_period)
1918− *phase_offset = p->phase_offset * ICE_DPLL_PHASE_OFFSET_FACTOR;
1998+ *phase_offset = (p->input &&
1999+ p->direction == DPLL_PIN_DIRECTION_INPUT ?
2000+ p->input->phase_offset :
2001+ p->phase_offset) * ICE_DPLL_PHASE_OFFSET_FACTOR;
19192002 else
19202003 *phase_offset = 0;
19212004 mutex_unlock(&pf->dplls.lock);
@@ -2609,6 +2692,27 @@ static u64 ice_generate_clock_id(struct ice_pf *pf) · 687 unmodified lines
26092692 return pci_get_dsn(pf->pdev);
26102693 }
26112694
2695+/**
2696+ * ice_dpll_pin_ntf - notify pin change including any SW pin wrappers
2697+ * @dplls: pointer to dplls struct
2698+ * @pin: the dpll_pin that changed
2699+ *
2700+ * Send a change notification for @pin and for any registered SMA/U.FL pin
2701+ * whose backing CGU input matches @pin.
2702+ */
2703+static void ice_dpll_pin_ntf(struct ice_dplls *dplls, struct dpll_pin *pin)
2704+{
2705+ dpll_pin_change_ntf(pin);
2706+ for (int i = 0; i < ICE_DPLL_PIN_SW_NUM; i++) {
2707+ if (dplls->sma[i].pin && dplls->sma[i].input &&
2708+ dplls->sma[i].input->pin == pin)
2709+ dpll_pin_change_ntf(dplls->sma[i].pin);
2710+ if (dplls->ufl[i].pin && dplls->ufl[i].input &&
2711+ dplls->ufl[i].input->pin == pin)
2712+ dpll_pin_change_ntf(dplls->ufl[i].pin);
2713+ }
2714+}
2715+
26122716 /**
26132717 * ice_dpll_notify_changes - notify dpll subsystem about changes
26142718 * @d: pointer do dpll
@@ -2617,6 +2721,7 @@ static u64 ice_generate_clock_id(struct ice_pf *pf) · 2 unmodified lines
26172721 */
26182722 static void ice_dpll_notify_changes(struct ice_dpll *d)
26192723 {
2724+ struct ice_dplls *dplls = &d->pf->dplls;
26202725 bool pin_notified = false;
26212726
26222727 if (d->prev_dpll_state != d->dpll_state) {
@@ -2625,17 +2730,17 @@ static void ice_dpll_notify_changes(struct ice_dpll *d) · 2 unmodified lines
26252730 }
26262731 if (d->prev_input != d->active_input) {
26272732 if (d->prev_input)
2628− dpll_pin_change_ntf(d->prev_input);
2733+ ice_dpll_pin_ntf(dplls, d->prev_input);
26292734 d->prev_input = d->active_input;
26302735 if (d->active_input) {
2631− dpll_pin_change_ntf(d->active_input);
2736+ ice_dpll_pin_ntf(dplls, d->active_input);
26322737 pin_notified = true;
26332738 }
26342739 }
26352740 if (d->prev_phase_offset != d->phase_offset) {
26362741 d->prev_phase_offset = d->phase_offset;
26372742 if (!pin_notified && d->active_input)
2638− dpll_pin_change_ntf(d->active_input);
2743+ ice_dpll_pin_ntf(dplls, d->active_input);
26392744 }
26402745 }
26412746
@@ -2664,6 +2769,7 @@ static bool ice_dpll_is_pps_phase_monitor(struct ice_pf *pf) · 22 unmodified lines
26642769
26652770 /**
26662771 * ice_dpll_pins_notify_mask - notify dpll subsystem about bulk pin changes
2772+ * @dplls: pointer to dplls struct
26672773 * @pins: array of ice_dpll_pin pointers registered within dpll subsystem
26682774 * @pin_num: number of pins
26692775 * @phase_offset_ntf_mask: bitmask of pin indexes to notify
@@ -2673,15 +2779,14 @@ static bool ice_dpll_is_pps_phase_monitor(struct ice_pf *pf) · 3 unmodified lines
26732779 *
26742780 * Context: Must be called while pf->dplls.lock is released.
26752781 */
2676−static void ice_dpll_pins_notify_mask(struct ice_dpll_pin *pins,
2782+static void ice_dpll_pins_notify_mask(struct ice_dplls *dplls,
2783+ struct ice_dpll_pin *pins,
26772784 u8 pin_num,
26782785 u32 phase_offset_ntf_mask)
26792786 {
2680− int i = 0;
2681−
2682− for (i = 0; i < pin_num; i++)
2683− if (phase_offset_ntf_mask & (1 << i))
2684− dpll_pin_change_ntf(pins[i].pin);
2787+ for (int i = 0; i < pin_num; i++)
2788+ if (phase_offset_ntf_mask & BIT(i))
2789+ ice_dpll_pin_ntf(dplls, pins[i].pin);
26852790 }
26862791
26872792 /**
@@ -2857,7 +2962,7 @@ static void ice_dpll_periodic_work(struct kthread_work *work) · 169 unmodified lines
28572962 ice_dpll_notify_changes(de);
28582963 ice_dpll_notify_changes(dp);
28592964 if (phase_offset_ntf)
2860− ice_dpll_pins_notify_mask(d->inputs, d->num_inputs,
2965+ ice_dpll_pins_notify_mask(d, d->inputs, d->num_inputs,
28612966 phase_offset_ntf);
28622967
28632968 resched:
@@ -4014,6 +4119,7 @@ static int ice_dpll_init_info_sw_pins(struct ice_pf *pf) · 1150 unmodified lines
40144119 struct ice_dpll_pin *pin;
40154120 u32 phase_adj_max, caps;
40164121 int i, ret;
4122+ u8 data;
40174123
40184124 if (pf->hw.device_id == ICE_DEV_ID_E810C_QSFP)
40194125 input_idx_offset = ICE_E810_RCLK_PINS_NUM;
@@ -4073,6 +4179,22 @@ static int ice_dpll_init_info_sw_pins(struct ice_pf *pf) · 53 unmodified lines
40734179 }
40744180 ice_dpll_phase_range_set(&pin->prop.phase_range, phase_adj_max);
40754181 }
4182+
4183+ /* Initialize the SMA control register to a known-good default state.
4184+ * Without this write the PCA9575 GPIO expander retains its power-on
4185+ * default (all outputs high) which makes all SW pins appear inactive.
4186+ * Set SMA1 and SMA2 as active inputs, disable U.FL1 output and
4187+ * U.FL2 input.
4188+ */
4189+ ret = ice_read_sma_ctrl(&pf->hw, &data);
4190+ if (ret)
4191+ return ret;
4192+ data &= ~ICE_ALL_SMA_MASK;
4193+ data |= ICE_SMA1_TX_EN | ICE_SMA2_TX_EN | ICE_SMA2_UFL2_RX_DIS;
4194+ ret = ice_write_sma_ctrl(&pf->hw, data);
4195+ if (ret)
4196+ return ret;
4197+
40764198 ret = ice_dpll_pin_state_update(pf, pin, ICE_DPLL_PIN_TYPE_SOFTWARE,
40774199 NULL);
40784200 if (ret)
drivers/net/ethernet/intel/ice/ice_main.c+2−0
@@ -5245,6 +5245,8 @@ ice_probe(struct pci_dev *pdev, const struct pci_device_id __always_unused *ent) · 5244 unmodified lines
52455245 return err;
52465246 }
52475247
5248+ ice_init_dev_hw(pf);
5249+
52485250 adapter = ice_adapter_get(pdev);
52495251 if (IS_ERR(adapter)) {
52505252 err = PTR_ERR(adapter);
drivers/net/ethernet/intel/ice/ice_vf_lib.c+6−1
@@ -804,7 +804,12 @@ void ice_reset_all_vfs(struct ice_pf *pf) · 803 unmodified lines
804804 ice_vf_ctrl_invalidate_vsi(vf);
805805
806806 ice_vf_pre_vsi_rebuild(vf);
807− ice_vf_rebuild_vsi(vf);
807+ if (ice_vf_rebuild_vsi(vf)) {
808+ dev_err(dev, "VF %u VSI rebuild failed, leaving VF disabled\n",
809+ vf->vf_id);
810+ mutex_unlock(&vf->cfg_lock);
811+ continue;
812+ }
808813 ice_vf_post_vsi_rebuild(vf);
809814
810815 ice_eswitch_attach_vf(pf, vf);
drivers/net/ethernet/sfc/efx_devlink.c+1−1
@@ -531,7 +531,7 @@ static int efx_devlink_info_running_versions(struct efx_nic *efx, · 530 unmodified lines
531531 if (rc || outlength < MC_CMD_GET_VERSION_OUT_LEN) {
532532 netif_err(efx, drv, efx->net_dev,
533533 "mcdi MC_CMD_GET_VERSION failed\n");
534− return rc;
534+ return rc ?: -EIO;
535535 }
536536
537537 /* Handle previous output */
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c+12−7
@@ -5549,9 +5549,12 @@ read_again: · 5548 unmodified lines
55495549 break;
55505550
55515551 /* Prefetch the next RX descriptor */
5552− rx_q->cur_rx = STMMAC_NEXT_ENTRY(rx_q->cur_rx,
5553− priv->dma_conf.dma_rx_size);
5554− next_entry = rx_q->cur_rx;
5552+ next_entry = STMMAC_NEXT_ENTRY(rx_q->cur_rx,
5553+ priv->dma_conf.dma_rx_size);
5554+ if (unlikely(next_entry == rx_q->dirty_rx))
5555+ break;
5556+
5557+ rx_q->cur_rx = next_entry;
55555558
55565559 np = stmmac_get_rx_desc(priv, rx_q, next_entry);
55575560
@@ -5686,7 +5689,6 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) · 128 unmodified lines
56865689
56875690 dma_dir = page_pool_get_dma_dir(rx_q->page_pool);
56885691 bufsz = DIV_ROUND_UP(priv->dma_conf.dma_buf_sz, PAGE_SIZE) * PAGE_SIZE;
5689− limit = min(priv->dma_conf.dma_rx_size - 1, (unsigned int)limit);
56905692
56915693 if (netif_msg_rx_status(priv)) {
56925694 void *rx_head = stmmac_get_rx_desc(priv, rx_q, 0);
@@ -5733,9 +5735,12 @@ read_again: · 40 unmodified lines
57335735 if (unlikely(status & dma_own))
57345736 break;
57355737
5736− rx_q->cur_rx = STMMAC_NEXT_ENTRY(rx_q->cur_rx,
5737− priv->dma_conf.dma_rx_size);
5738− next_entry = rx_q->cur_rx;
5738+ next_entry = STMMAC_NEXT_ENTRY(rx_q->cur_rx,
5739+ priv->dma_conf.dma_rx_size);
5740+ if (unlikely(next_entry == rx_q->dirty_rx))
5741+ break;
5742+
5743+ rx_q->cur_rx = next_entry;
57395744
57405745 np = stmmac_get_rx_desc(priv, rx_q, next_entry);
57415746
drivers/net/mctp/mctp-i2c.c+2−2
@@ -496,8 +496,6 @@ static void mctp_i2c_xmit(struct mctp_i2c_dev *midev, struct sk_buff *skb) · 495 unmodified lines
496496 u8 *pecp;
497497 int rc;
498498
499− fs = mctp_i2c_get_tx_flow_state(midev, skb);
500−
501499 hdr = (void *)skb_mac_header(skb);
502500 /* Sanity check that packet contents matches skb length,
503501 * and can't exceed MCTP_I2C_BUFSZ
@@ -509,6 +507,8 @@ static void mctp_i2c_xmit(struct mctp_i2c_dev *midev, struct sk_buff *skb) · 5 unmodified lines
509507 return;
510508 }
511509
510+ fs = mctp_i2c_get_tx_flow_state(midev, skb);
511+
512512 if (skb_tailroom(skb) >= 1) {
513513 /* Linear case with space, we can just append the PEC */
514514 skb_put(skb, 1);
drivers/net/netconsole.c+30−19
@@ -752,7 +752,7 @@ static ssize_t enabled_store(struct config_item *item, · 751 unmodified lines
752752 unregister_netcons_consoles();
753753 }
754754
755− ret = strnlen(buf, count);
755+ ret = count;
756756 /* Deferred cleanup */
757757 netconsole_process_cleanups();
758758 out_unlock:
@@ -781,7 +781,7 @@ static ssize_t release_store(struct config_item *item, const char *buf, · 22 unmodified lines
781781
782782 nt->release = release;
783783
784− ret = strnlen(buf, count);
784+ ret = count;
785785 out_unlock:
786786 dynamic_netconsole_mutex_unlock();
787787 return ret;
@@ -807,7 +807,7 @@ static ssize_t extended_store(struct config_item *item, const char *buf, · 19 unmodified lines
807807 goto out_unlock;
808808
809809 nt->extended = extended;
810− ret = strnlen(buf, count);
810+ ret = count;
811811 out_unlock:
812812 dynamic_netconsole_mutex_unlock();
813813 return ret;
@@ -817,6 +817,13 @@ static ssize_t dev_name_store(struct config_item *item, const char *buf, · 3 unmodified lines
817817 size_t count)
818818 {
819819 struct netconsole_target *nt = to_target(item);
820+ size_t len = count;
821+
822+ /* Account for a trailing newline appended by tools like echo */
823+ if (len && buf[len - 1] == '\n')
824+ len--;
825+ if (len >= IFNAMSIZ)
826+ return -ENAMETOOLONG;
820827
821828 dynamic_netconsole_mutex_lock();
822829 if (nt->state == STATE_ENABLED) {
@@ -830,7 +837,7 @@ static ssize_t dev_name_store(struct config_item *item, const char *buf, · 7 unmodified lines
830837 trim_newline(nt->np.dev_name, IFNAMSIZ);
831838
832839 dynamic_netconsole_mutex_unlock();
833− return strnlen(buf, count);
840+ return count;
834841 }
835842
836843 static ssize_t local_port_store(struct config_item *item, const char *buf,
@@ -849,7 +856,7 @@ static ssize_t local_port_store(struct config_item *item, const char *buf, · 12 unmodified lines
849856 ret = kstrtou16(buf, 10, &nt->np.local_port);
850857 if (ret < 0)
851858 goto out_unlock;
852− ret = strnlen(buf, count);
859+ ret = count;
853860 out_unlock:
854861 dynamic_netconsole_mutex_unlock();
855862 return ret;
@@ -871,7 +878,7 @@ static ssize_t remote_port_store(struct config_item *item, · 15 unmodified lines
871878 ret = kstrtou16(buf, 10, &nt->np.remote_port);
872879 if (ret < 0)
873880 goto out_unlock;
874− ret = strnlen(buf, count);
881+ ret = count;
875882 out_unlock:
876883 dynamic_netconsole_mutex_unlock();
877884 return ret;
@@ -896,7 +903,7 @@ static ssize_t local_ip_store(struct config_item *item, const char *buf, · 18 unmodified lines
896903 goto out_unlock;
897904 nt->np.ipv6 = !!ipv6;
898905
899− ret = strnlen(buf, count);
906+ ret = count;
900907 out_unlock:
901908 dynamic_netconsole_mutex_unlock();
902909 return ret;
@@ -921,7 +928,7 @@ static ssize_t remote_ip_store(struct config_item *item, const char *buf, · 18 unmodified lines
921928 goto out_unlock;
922929 nt->np.ipv6 = !!ipv6;
923930
924− ret = strnlen(buf, count);
931+ ret = count;
925932 out_unlock:
926933 dynamic_netconsole_mutex_unlock();
927934 return ret;
@@ -957,7 +964,7 @@ static ssize_t remote_mac_store(struct config_item *item, const char *buf, · 29 unmodified lines
957964 goto out_unlock;
958965 memcpy(nt->np.remote_mac, remote_mac, ETH_ALEN);
959966
960− ret = strnlen(buf, count);
967+ ret = count;
961968 out_unlock:
962969 dynamic_netconsole_mutex_unlock();
963970 return ret;
@@ -1072,26 +1079,30 @@ static ssize_t userdatum_value_store(struct config_item *item, const char *buf, · 108 unmodified lines
10721079 size_t count)
10731080 {
10741081 struct userdatum *udm = to_userdatum(item);
1082+ char old_value[MAX_EXTRADATA_VALUE_LEN];
10751083 struct netconsole_target *nt;
10761084 struct userdata *ud;
10771085 ssize_t ret;
10781086
1079− if (count > MAX_EXTRADATA_VALUE_LEN)
1087+ if (count >= MAX_EXTRADATA_VALUE_LEN)
10801088 return -EMSGSIZE;
10811089
10821090 mutex_lock(&netconsole_subsys.su_mutex);
10831091 dynamic_netconsole_mutex_lock();
1084−
1085− ret = strscpy(udm->value, buf, sizeof(udm->value));
1086− if (ret < 0)
1087− goto out_unlock;
1092+ /* Snapshot for rollback if update_userdata() fails below */
1093+ strscpy(old_value, udm->value, sizeof(old_value));
1094+ /* count is bounded above, so strscpy() cannot truncate here */
1095+ strscpy(udm->value, buf, sizeof(udm->value));
10881096 trim_newline(udm->value, sizeof(udm->value));
10891097
10901098 ud = to_userdata(item->ci_parent);
10911099 nt = userdata_to_target(ud);
10921100 ret = update_userdata(nt);
1093− if (ret < 0)
1101+ if (ret < 0) {
1102+ /* Restore the previous value so it matches the live payload */
1103+ strscpy(udm->value, old_value, sizeof(udm->value));
10941104 goto out_unlock;
1105+ }
10951106 ret = count;
10961107 out_unlock:
10971108 dynamic_netconsole_mutex_unlock();
@@ -1133,7 +1144,7 @@ static ssize_t sysdata_msgid_enabled_store(struct config_item *item, · 35 unmodified lines
11331144 disable_sysdata_feature(nt, SYSDATA_MSGID);
11341145
11351146 unlock_ok:
1136− ret = strnlen(buf, count);
1147+ ret = count;
11371148 dynamic_netconsole_mutex_unlock();
11381149 mutex_unlock(&netconsole_subsys.su_mutex);
11391150 return ret;
@@ -1162,7 +1173,7 @@ static ssize_t sysdata_release_enabled_store(struct config_item *item, · 22 unmodified lines
11621173 disable_sysdata_feature(nt, SYSDATA_RELEASE);
11631174
11641175 unlock_ok:
1165− ret = strnlen(buf, count);
1176+ ret = count;
11661177 dynamic_netconsole_mutex_unlock();
11671178 mutex_unlock(&netconsole_subsys.su_mutex);
11681179 return ret;
@@ -1191,7 +1202,7 @@ static ssize_t sysdata_taskname_enabled_store(struct config_item *item, · 22 unmodified lines
11911202 disable_sysdata_feature(nt, SYSDATA_TASKNAME);
11921203
11931204 unlock_ok:
1194− ret = strnlen(buf, count);
1205+ ret = count;
11951206 dynamic_netconsole_mutex_unlock();
11961207 mutex_unlock(&netconsole_subsys.su_mutex);
11971208 return ret;
@@ -1225,7 +1236,7 @@ static ssize_t sysdata_cpu_nr_enabled_store(struct config_item *item, · 27 unmodified lines
12251236 disable_sysdata_feature(nt, SYSDATA_CPU_NR);
12261237
12271238 unlock_ok:
1228− ret = strnlen(buf, count);
1239+ ret = count;
12291240 dynamic_netconsole_mutex_unlock();
12301241 mutex_unlock(&netconsole_subsys.su_mutex);
12311242 return ret;
drivers/net/netdevsim/dev.c+1−1
@@ -829,7 +829,7 @@ static struct sk_buff *nsim_dev_trap_skb_build(void) · 828 unmodified lines
829829 skb->protocol = htons(ETH_P_IP);
830830
831831 skb_set_network_header(skb, skb->len);
832− iph = skb_put(skb, sizeof(struct iphdr));
832+ iph = skb_put_zero(skb, sizeof(struct iphdr));
833833 iph->protocol = IPPROTO_UDP;
834834 iph->saddr = in_aton("192.0.2.1");
835835 iph->daddr = in_aton("198.51.100.1");
drivers/net/phy/dp83869.c+12−1
@@ -31,6 +31,7 @@ · 30 unmodified lines
3131 #define DP83869_RGMIICTL 0x0032
3232 #define DP83869_STRAP_STS1 0x006e
3333 #define DP83869_RGMIIDCTL 0x0086
34+#define DP83869_ANA_PLL_PROG_PI 0x00c6
3435 #define DP83869_RXFCFG 0x0134
3536 #define DP83869_RXFPMD1 0x0136
3637 #define DP83869_RXFPMD2 0x0137
@@ -826,12 +827,22 @@ static int dp83869_config_init(struct phy_device *phydev) · 789 unmodified lines
826827 dp83869_config_port_mirroring(phydev);
827828
828829 /* Clock output selection if muxing property is set */
829− if (dp83869->clk_output_sel != DP83869_CLK_O_SEL_REF_CLK)
830+ if (dp83869->clk_output_sel != DP83869_CLK_O_SEL_REF_CLK) {
831+ /*
832+ * Table 7-121 in datasheet says we have to set register 0xc6
833+ * to value 0x10 before CLK_O_SEL can be modified.
834+ */
835+ ret = phy_write_mmd(phydev, DP83869_DEVADDR,
836+ DP83869_ANA_PLL_PROG_PI, 0x10);
837+ if (ret)
838+ return ret;
839+
830840 ret = phy_modify_mmd(phydev,
831841 DP83869_DEVADDR, DP83869_IO_MUX_CFG,
832842 DP83869_IO_MUX_CFG_CLK_O_SEL_MASK,
833843 dp83869->clk_output_sel <<
834844 DP83869_IO_MUX_CFG_CLK_O_SEL_SHIFT);
845+ }
835846
836847 if (phy_interface_is_rgmii(phydev)) {
837848 ret = phy_write_mmd(phydev, DP83869_DEVADDR, DP83869_RGMIIDCTL,
drivers/net/usb/rtl8150.c+11−1
@@ -683,6 +683,7 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, · 682 unmodified lines
683683 struct net_device *netdev)
684684 {
685685 rtl8150_t *dev = netdev_priv(netdev);
686+ unsigned int skb_len;
686687 int count, res;
687688
688689 /* pad the frame and ensure terminating USB packet, datasheet 9.2.3 */
@@ -694,6 +695,8 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, · 5 unmodified lines
694695 return NETDEV_TX_OK;
695696 }
696697
698+ skb_len = skb->len;
699+
697700 netif_stop_queue(netdev);
698701 dev->tx_skb = skb;
699702 usb_fill_bulk_urb(dev->tx_urb, dev->udev, usb_sndbulkpipe(dev->udev, 2),
@@ -707,9 +710,16 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, · 7 unmodified lines
707710 netdev->stats.tx_errors++;
708711 netif_start_queue(netdev);
709712 }
713+ /*
714+ * The URB was not submitted, so write_bulk_callback() will
715+ * never run to free dev->tx_skb. Drop the skb here and
716+ * clear tx_skb to avoid leaving a stale pointer.
717+ */
718+ dev->tx_skb = NULL;
719+ dev_kfree_skb_any(skb);
710720 } else {
711721 netdev->stats.tx_packets++;
712− netdev->stats.tx_bytes += skb->len;
722+ netdev->stats.tx_bytes += skb_len;
713723 netif_trans_update(netdev);
714724 }
715725
drivers/net/vrf.c+11−4
@@ -1034,6 +1034,7 @@ static int do_vrf_add_slave(struct net_device *dev, struct net_device *port_dev, · 1033 unmodified lines
10341034
10351035 err:
10361036 port_dev->priv_flags &= ~IFF_L3MDEV_SLAVE;
1037+ synchronize_net();
10371038 return ret;
10381039 }
10391040
@@ -1053,10 +1054,16 @@ static int vrf_add_slave(struct net_device *dev, struct net_device *port_dev, · 13 unmodified lines
10531054 }
10541055
10551056 /* inverse of do_vrf_add_slave */
1056−static int do_vrf_del_slave(struct net_device *dev, struct net_device *port_dev)
1057+static int do_vrf_del_slave(struct net_device *dev, struct net_device *port_dev,
1058+ bool needs_sync)
10571059 {
10581060 netdev_upper_dev_unlink(port_dev, dev);
10591061 port_dev->priv_flags &= ~IFF_L3MDEV_SLAVE;
1062+ /* Make sure that concurrent RCU readers that identified the device
1063+ * as a VRF port see a VRF master or no master at all.
1064+ */
1065+ if (needs_sync)
1066+ synchronize_net();
10601067
10611068 cycle_netdev(port_dev, NULL);
10621069
@@ -1065,7 +1072,7 @@ static int do_vrf_del_slave(struct net_device *dev, struct net_device *port_dev) · 2 unmodified lines
10651072
10661073 static int vrf_del_slave(struct net_device *dev, struct net_device *port_dev)
10671074 {
1068− return do_vrf_del_slave(dev, port_dev);
1075+ return do_vrf_del_slave(dev, port_dev, true);
10691076 }
10701077
10711078 static void vrf_dev_uninit(struct net_device *dev)
@@ -1619,7 +1626,7 @@ static void vrf_dellink(struct net_device *dev, struct list_head *head) · 547 unmodified lines
16191626 struct list_head *iter;
16201627
16211628 netdev_for_each_lower_dev(dev, port_dev, iter)
1622− vrf_del_slave(dev, port_dev);
1629+ do_vrf_del_slave(dev, port_dev, false);
16231630
16241631 vrf_map_unregister_dev(dev);
16251632
@@ -1751,7 +1758,7 @@ static int vrf_device_event(struct notifier_block *unused, · 125 unmodified lines
17511758 goto out;
17521759
17531760 vrf_dev = netdev_master_upper_dev_get(dev);
1754− vrf_del_slave(vrf_dev, dev);
1761+ do_vrf_del_slave(vrf_dev, dev, false);
17551762 }
17561763 out:
17571764 return NOTIFY_DONE;
drivers/nfc/trf7970a.c+2−1
@@ -317,6 +317,7 @@ · 316 unmodified lines
317317 #define TRF7970A_RSSI_OSC_STATUS_RSSI_MASK (BIT(2) | BIT(1) | BIT(0))
318318 #define TRF7970A_RSSI_OSC_STATUS_RSSI_X_MASK (BIT(5) | BIT(4) | BIT(3))
319319 #define TRF7970A_RSSI_OSC_STATUS_RSSI_OSC_OK BIT(6)
320+#define TRF7970A_RSSI_OSC_STATUS_RSSI_NOISE_LEVEL 1
320321
321322 #define TRF7970A_SPECIAL_FCN_REG1_COL_7_6 BIT(0)
322323 #define TRF7970A_SPECIAL_FCN_REG1_14_ANTICOLL BIT(1)
@@ -1300,7 +1301,7 @@ static int trf7970a_is_rf_field(struct trf7970a *trf, bool *is_rf_field) · 977 unmodified lines
13001301 if (ret)
13011302 return ret;
13021303
1303− if (rssi & TRF7970A_RSSI_OSC_STATUS_RSSI_MASK)
1304+ if ((rssi & TRF7970A_RSSI_OSC_STATUS_RSSI_MASK) > TRF7970A_RSSI_OSC_STATUS_RSSI_NOISE_LEVEL)
13041305 *is_rf_field = true;
13051306 else
13061307 *is_rf_field = false;
drivers/nvme/common/auth.c+74−20
@@ -351,18 +351,29 @@ struct nvme_dhchap_key *nvme_auth_transform_key( · 350 unmodified lines
351351 }
352352 EXPORT_SYMBOL_GPL(nvme_auth_transform_key);
353353
354+/**
355+ * nvme_auth_augmented_challenge() - Compute the augmented DH-HMAC-CHAP challenge
356+ * @hmac_id: Hash algorithm identifier
357+ * @skey: Session key
358+ * @skey_len: Length of @skey
359+ * @challenge: Challenge value
360+ * @aug: Output buffer for the augmented challenge
361+ * @hlen: Hash output length (length of @challenge and @aug)
362+ *
363+ * NVMe base specification 8.3.5.5.4: The augmented challenge is computed
364+ * applying the HMAC function using the hash function H() selected by the
365+ * HashID parameter ... with the hash of the ephemeral DH key ... as HMAC key
366+ * to the challenge C (i.e., Ca = HMAC(H(g^xy mod p), C)).
367+ *
368+ * As the session key skey is already H(g^xy mod p) per section 8.3.5.5.9, use
369+ * it directly as the HMAC key without additional hashing.
370+ *
371+ * Return: 0 on success, negative errno on failure.
372+ */
354373 int nvme_auth_augmented_challenge(u8 hmac_id, const u8 *skey, size_t skey_len,
355374 const u8 *challenge, u8 *aug, size_t hlen)
356375 {
357− u8 hashed_key[NVME_AUTH_MAX_DIGEST_SIZE];
358− int ret;
359−
360− ret = nvme_auth_hash(hmac_id, skey, skey_len, hashed_key);
361− if (ret)
362− return ret;
363− ret = nvme_auth_hmac(hmac_id, hashed_key, hlen, challenge, hlen, aug);
364− memzero_explicit(hashed_key, sizeof(hashed_key));
365− return ret;
376+ return nvme_auth_hmac(hmac_id, skey, skey_len, challenge, hlen, aug);
366377 }
367378 EXPORT_SYMBOL_GPL(nvme_auth_augmented_challenge);
368379
@@ -403,33 +414,76 @@ int nvme_auth_gen_pubkey(struct crypto_kpp *dh_tfm, · 34 unmodified lines
403414 }
404415 EXPORT_SYMBOL_GPL(nvme_auth_gen_pubkey);
405416
406−int nvme_auth_gen_shared_secret(struct crypto_kpp *dh_tfm,
407− const u8 *ctrl_key, size_t ctrl_key_len,
408− u8 *sess_key, size_t sess_key_len)
417+/**
418+ * nvme_auth_gen_session_key() - Generate an ephemeral session key
419+ * @dh_tfm: Diffie-Hellman transform with local private key already set
420+ * @public_key: Peer's public key
421+ * @public_key_len: Length of @public_key
422+ * @sess_key: Output buffer for the session key
423+ * @sess_key_len: Size of @sess_key buffer
424+ * @hash_id: Hash algorithm identifier
425+ *
426+ * NVMe base specification 8.3.5.5.9: The session key Ks shall be computed from
427+ * the ephemeral DH key (i.e., g^xy mod p) ... by applying the hash function
428+ * H() selected by the HashID parameter ... (i.e., Ks = H(g^xy mod p)).
429+ *
430+ * Return: 0 on success, negative errno on failure.
431+ */
432+int nvme_auth_gen_session_key(struct crypto_kpp *dh_tfm,
433+ const u8 *public_key, size_t public_key_len,
434+ u8 *sess_key, size_t sess_key_len, u8 hash_id)
409435 {
410436 struct kpp_request *req;
411437 struct crypto_wait wait;
412438 struct scatterlist src, dst;
439+ u8 *dh_secret;
440+ size_t dh_secret_len, hash_len;
413441 int ret;
414442
415− req = kpp_request_alloc(dh_tfm, GFP_KERNEL);
416− if (!req)
443+ hash_len = nvme_auth_hmac_hash_len(hash_id);
444+ if (!hash_len) {
445+ pr_warn("%s: invalid hash algorithm %d\n", __func__, hash_id);
446+ return -EINVAL;
447+ }
448+
449+ if (sess_key_len != hash_len) {
450+ pr_warn("%s: sess_key buffer missized (%zu != %zu)\n",
451+ __func__, sess_key_len, hash_len);
452+ return -EINVAL;
453+ }
454+
455+ dh_secret_len = crypto_kpp_maxsize(dh_tfm);
456+ dh_secret = kzalloc(dh_secret_len, GFP_KERNEL);
457+ if (!dh_secret)
417458 return -ENOMEM;
418459
460+ req = kpp_request_alloc(dh_tfm, GFP_KERNEL);
461+ if (!req) {
462+ ret = -ENOMEM;
463+ goto out_free_secret;
464+ }
465+
419466 crypto_init_wait(&wait);
420− sg_init_one(&src, ctrl_key, ctrl_key_len);
421− kpp_request_set_input(req, &src, ctrl_key_len);
422− sg_init_one(&dst, sess_key, sess_key_len);
423− kpp_request_set_output(req, &dst, sess_key_len);
467+ sg_init_one(&src, public_key, public_key_len);
468+ kpp_request_set_input(req, &src, public_key_len);
469+ sg_init_one(&dst, dh_secret, dh_secret_len);
470+ kpp_request_set_output(req, &dst, dh_secret_len);
424471 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
425472 crypto_req_done, &wait);
426473
427474 ret = crypto_wait_req(crypto_kpp_compute_shared_secret(req), &wait);
428−
429475 kpp_request_free(req);
476+
477+ if (ret)
478+ goto out_free_secret;
479+
480+ ret = nvme_auth_hash(hash_id, dh_secret, dh_secret_len, sess_key);
481+
482+out_free_secret:
483+ kfree_sensitive(dh_secret);
430484 return ret;
431485 }
432−EXPORT_SYMBOL_GPL(nvme_auth_gen_shared_secret);
486+EXPORT_SYMBOL_GPL(nvme_auth_gen_session_key);
433487
434488 int nvme_auth_parse_key(const char *secret, struct nvme_dhchap_key **ret_key)
435489 {
drivers/nvme/host/apple.c+1−5
@@ -1267,11 +1267,7 @@ static int apple_nvme_get_address(struct nvme_ctrl *ctrl, char *buf, int size) · 1266 unmodified lines
12671267
12681268 static void apple_nvme_free_ctrl(struct nvme_ctrl *ctrl)
12691269 {
1270− struct apple_nvme *anv = ctrl_to_apple_nvme(ctrl);
1271−
1272− if (anv->ctrl.admin_q)
1273− blk_put_queue(anv->ctrl.admin_q);
1274− put_device(anv->dev);
1270+ put_device(ctrl->dev);
12751271 }
12761272
12771273 static const struct nvme_ctrl_ops nvme_ctrl_ops = {
drivers/nvme/host/auth.c+9−7
@@ -535,11 +535,12 @@ static int nvme_auth_dhchap_setup_ctrl_response(struct nvme_ctrl *ctrl, · 534 unmodified lines
535535 put_unaligned_le16(chap->transaction, buf);
536536 nvme_auth_hmac_update(&hmac, buf, 2);
537537
538− memset(buf, 0, 4);
538+ *buf = chap->sc_c;
539539 nvme_auth_hmac_update(&hmac, buf, 1);
540540 nvme_auth_hmac_update(&hmac, "Controller", 10);
541541 nvme_auth_hmac_update(&hmac, ctrl->opts->subsysnqn,
542542 strlen(ctrl->opts->subsysnqn));
543+ memset(buf, 0, 4);
543544 nvme_auth_hmac_update(&hmac, buf, 1);
544545 nvme_auth_hmac_update(&hmac, ctrl->opts->host->nqn,
545546 strlen(ctrl->opts->host->nqn));
@@ -587,7 +588,7 @@ static int nvme_auth_dhchap_exponential(struct nvme_ctrl *ctrl, · 41 unmodified lines
587588 }
588589
589590 gen_sesskey:
590− chap->sess_key_len = chap->host_key_len;
591+ chap->sess_key_len = chap->hash_len;
591592 chap->sess_key = kmalloc(chap->sess_key_len, GFP_KERNEL);
592593 if (!chap->sess_key) {
593594 chap->sess_key_len = 0;
@@ -595,16 +596,17 @@ gen_sesskey: · 1 unmodified line
595596 return -ENOMEM;
596597 }
597598
598− ret = nvme_auth_gen_shared_secret(chap->dh_tfm,
599− chap->ctrl_key, chap->ctrl_key_len,
600− chap->sess_key, chap->sess_key_len);
599+ ret = nvme_auth_gen_session_key(chap->dh_tfm,
600+ chap->ctrl_key, chap->ctrl_key_len,
601+ chap->sess_key, chap->sess_key_len,
602+ chap->hash_id);
601603 if (ret) {
602604 dev_dbg(ctrl->device,
603− "failed to generate shared secret, error %d\n", ret);
605+ "failed to generate session key, error %d\n", ret);
604606 chap->status = NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD;
605607 return ret;
606608 }
607− dev_dbg(ctrl->device, "shared secret %*ph\n",
609+ dev_dbg(ctrl->device, "session key %*ph\n",
608610 (int)chap->sess_key_len, chap->sess_key);
609611 return 0;
610612 }
drivers/nvme/host/core.c+11−5
@@ -454,11 +454,10 @@ void nvme_end_req(struct request *req) · 453 unmodified lines
454454 blk_mq_end_request(req, status);
455455 }
456456
457−void nvme_complete_rq(struct request *req)
457+static void __nvme_complete_rq(struct request *req)
458458 {
459459 struct nvme_ctrl *ctrl = nvme_req(req)->ctrl;
460460
461− trace_nvme_complete_rq(req);
462461 nvme_cleanup_cmd(req);
463462
464463 /*
@@ -493,6 +492,12 @@ void nvme_complete_rq(struct request *req) · 28 unmodified lines
493492 return;
494493 }
495494 }
495+
496+void nvme_complete_rq(struct request *req)
497+{
498+ trace_nvme_complete_rq(req);
499+ __nvme_complete_rq(req);
500+}
496501 EXPORT_SYMBOL_GPL(nvme_complete_rq);
497502
498503 void nvme_complete_batch_req(struct request *req)
@@ -513,7 +518,7 @@ blk_status_t nvme_host_path_error(struct request *req) · 14 unmodified lines
513518 {
514519 nvme_req(req)->status = NVME_SC_HOST_PATH_ERROR;
515520 blk_mq_set_request_complete(req);
516− nvme_complete_rq(req);
521+ __nvme_complete_rq(req);
517522 return BLK_STS_OK;
518523 }
519524 EXPORT_SYMBOL_GPL(nvme_host_path_error);
@@ -3044,7 +3049,7 @@ static const struct nvme_core_quirk_entry core_quirks[] = { · 2524 unmodified lines
30443049 *
30453050 * The device is left in a state where it is also not possible
30463051 * to use "nvme set-feature" to disable APST, but booting with
3047− * nvme_core.default_ps_max_latency=0 works.
3052+ * nvme_core.default_ps_max_latency_us=0 works.
30483053 */
30493054 .vid = 0x1e0f,
30503055 .mn = "KCD6XVUL6T40",
@@ -4083,7 +4088,8 @@ static int nvme_init_ns_head(struct nvme_ns *ns, struct nvme_ns_info *info) · 1032 unmodified lines
40834088 mutex_unlock(&ctrl->subsys->lock);
40844089
40854090 #ifdef CONFIG_NVME_MULTIPATH
4086− cancel_delayed_work(&head->remove_work);
4091+ if (cancel_delayed_work(&head->remove_work))
4092+ module_put(THIS_MODULE);
40874093 #endif
40884094 return 0;
40894095
drivers/nvme/host/fc.c+1−0
@@ -3968,3 +3968,4 @@ module_exit(nvme_fc_exit_module); · 3967 unmodified lines
39683968
39693969 MODULE_DESCRIPTION("NVMe host FC transport driver");
39703970 MODULE_LICENSE("GPL v2");
3971+MODULE_ALIAS("nvme-fc");
drivers/nvme/host/multipath.c+0−4
@@ -231,16 +231,12 @@ bool nvme_mpath_clear_current_path(struct nvme_ns *ns) · 230 unmodified lines
231231 bool changed = false;
232232 int node;
233233
234− if (!head)
235− goto out;
236−
237234 for_each_node(node) {
238235 if (ns == rcu_access_pointer(head->current_path[node])) {
239236 rcu_assign_pointer(head->current_path[node], NULL);
240237 changed = true;
241238 }
242239 }
243−out:
244240 return changed;
245241 }
246242
drivers/nvme/host/pci.c+5−0
@@ -2241,6 +2241,7 @@ release_cq: · 2240 unmodified lines
22412241 static const struct blk_mq_ops nvme_mq_admin_ops = {
22422242 .queue_rq = nvme_queue_rq,
22432243 .complete = nvme_pci_complete_rq,
2244+ .commit_rqs = nvme_commit_rqs,
22442245 .init_hctx = nvme_admin_init_hctx,
22452246 .init_request = nvme_pci_init_request,
22462247 .timeout = nvme_timeout,
@@ -4104,6 +4105,10 @@ static const struct pci_device_id nvme_id_table[] = { · 1857 unmodified lines
41044105 .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
41054106 { PCI_DEVICE(0x1c5f, 0x0540), /* Memblaze Pblaze4 adapter */
41064107 .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
4108+ { PCI_DEVICE(0x1c5f, 0x0555), /* Memblaze Pblaze5 adapter */
4109+ .driver_data = NVME_QUIRK_NO_NS_DESC_LIST, },
4110+ { PCI_DEVICE(0x144d, 0xa808), /* Samsung PM981/983 */
4111+ .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, },
41074112 { PCI_DEVICE(0x144d, 0xa821), /* Samsung PM1725 */
41084113 .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
41094114 { PCI_DEVICE(0x144d, 0xa822), /* Samsung PM1725a */
drivers/nvme/host/rdma.c+9−0
@@ -2189,6 +2189,13 @@ out_fail: · 2188 unmodified lines
21892189 nvme_rdma_reconnect_or_remove(ctrl, ret);
21902190 }
21912191
2192+static bool nvme_rdma_supports_pci_p2pdma(struct nvme_ctrl *ctrl)
2193+{
2194+ struct nvme_rdma_ctrl *r_ctrl = to_rdma_ctrl(ctrl);
2195+
2196+ return ib_dma_pci_p2p_dma_supported(r_ctrl->device->dev);
2197+}
2198+
21922199 static const struct nvme_ctrl_ops nvme_rdma_ctrl_ops = {
21932200 .name = "rdma",
21942201 .module = THIS_MODULE,
@@ -2203,6 +2210,7 @@ static const struct nvme_ctrl_ops nvme_rdma_ctrl_ops = { · 8 unmodified lines
22032210 .get_address = nvmf_get_address,
22042211 .stop_ctrl = nvme_rdma_stop_ctrl,
22052212 .get_virt_boundary = nvme_get_virt_boundary,
2213+ .supports_pci_p2pdma = nvme_rdma_supports_pci_p2pdma,
22062214 };
22072215
22082216 /*
@@ -2432,3 +2440,4 @@ module_exit(nvme_rdma_cleanup_module); · 223 unmodified lines
24322440
24332441 MODULE_DESCRIPTION("NVMe host RDMA transport driver");
24342442 MODULE_LICENSE("GPL v2");
2443+MODULE_ALIAS("nvme-rdma");
drivers/nvme/host/sysfs.c+19−0
@@ -883,10 +883,26 @@ static ssize_t tls_keyring_show(struct device *dev, · 882 unmodified lines
883883 }
884884 static DEVICE_ATTR_RO(tls_keyring);
885885
886+static ssize_t tls_mode_show(struct device *dev,
887+ struct device_attribute *attr, char *buf)
888+{
889+ struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
890+ const char *mode;
891+
892+ if (ctrl->opts->tls)
893+ mode = "tls";
894+ else
895+ mode = "concat";
896+
897+ return sysfs_emit(buf, "%s\n", mode);
898+}
899+static DEVICE_ATTR_RO(tls_mode);
900+
886901 static struct attribute *nvme_tls_attrs[] = {
887902 &dev_attr_tls_key.attr,
888903 &dev_attr_tls_configured_key.attr,
889904 &dev_attr_tls_keyring.attr,
905+ &dev_attr_tls_mode.attr,
890906 NULL,
891907 };
892908
@@ -908,6 +924,9 @@ static umode_t nvme_tls_attrs_are_visible(struct kobject *kobj, · 15 unmodified lines
908924 if (a == &dev_attr_tls_keyring.attr &&
909925 !ctrl->opts->keyring)
910926 return 0;
927+ if (a == &dev_attr_tls_mode.attr &&
928+ !ctrl->opts->tls && !ctrl->opts->concat)
929+ return 0;
911930
912931 return a->mode;
913932 }
drivers/nvme/host/tcp.c+22−7
@@ -1438,18 +1438,32 @@ static void nvme_tcp_free_queue(struct nvme_ctrl *nctrl, int qid) · 1437 unmodified lines
14381438 {
14391439 struct nvme_tcp_ctrl *ctrl = to_tcp_ctrl(nctrl);
14401440 struct nvme_tcp_queue *queue = &ctrl->queues[qid];
1441− unsigned int noreclaim_flag;
1441+ unsigned int noio_flag;
14421442
14431443 if (!test_and_clear_bit(NVME_TCP_Q_ALLOCATED, &queue->flags))
14441444 return;
14451445
14461446 page_frag_cache_drain(&queue->pf_cache);
14471447
1448− noreclaim_flag = memalloc_noreclaim_save();
1449− /* ->sock will be released by fput() */
1450− fput(queue->sock->file);
1448+ /**
1449+ * Prevent memory reclaim from triggering block I/O during socket
1450+ * teardown. The socket release path fput -> tcp_close ->
1451+ * tcp_disconnect -> tcp_send_active_reset may allocate memory, and
1452+ * allowing reclaim to issue I/O could deadlock if we're being called
1453+ * from block device teardown (e.g., del_gendisk -> elevator cleanup)
1454+ * which holds locks that the I/O completion path needs.
1455+ */
1456+ noio_flag = memalloc_noio_save();
1457+
1458+ /**
1459+ * Release the socket synchronously. During reset in
1460+ * nvme_reset_ctrl_work(), queue teardown is immediately followed by
1461+ * re-allocation. fput() defers socket cleanup to delayed_fput_work
1462+ * in workqueue context, which can race with new queue setup.
1463+ */
1464+ __fput_sync(queue->sock->file);
14511465 queue->sock = NULL;
1452− memalloc_noreclaim_restore(noreclaim_flag);
1466+ memalloc_noio_restore(noio_flag);
14531467
14541468 kfree(queue->pdu);
14551469 mutex_destroy(&queue->send_mutex);
@@ -1901,8 +1915,8 @@ err_init_connect: · 445 unmodified lines
19011915 err_rcv_pdu:
19021916 kfree(queue->pdu);
19031917 err_sock:
1904− /* ->sock will be released by fput() */
1905− fput(queue->sock->file);
1918+ /* Use sync variant - see nvme_tcp_free_queue() for explanation */
1919+ __fput_sync(queue->sock->file);
19061920 queue->sock = NULL;
19071921 err_destroy_mutex:
19081922 mutex_destroy(&queue->send_mutex);
@@ -3071,3 +3085,4 @@ module_exit(nvme_tcp_cleanup_module); · 1162 unmodified lines
30713085
30723086 MODULE_DESCRIPTION("NVMe host TCP transport driver");
30733087 MODULE_LICENSE("GPL v2");
3088+MODULE_ALIAS("nvme-tcp");
drivers/nvme/target/admin-cmd.c+2−6
@@ -687,12 +687,8 @@ static void nvmet_execute_identify_ctrl(struct nvmet_req *req) · 686 unmodified lines
687687 id->cmic = NVME_CTRL_CMIC_MULTI_PORT | NVME_CTRL_CMIC_MULTI_CTRL |
688688 NVME_CTRL_CMIC_ANA;
689689
690− /* Limit MDTS according to transport capability */
691− if (ctrl->ops->get_mdts)
692− id->mdts = ctrl->ops->get_mdts(ctrl);
693− else
694− id->mdts = 0;
695−
690+ /* Limit MDTS according to port config or transport capability */
691+ id->mdts = nvmet_ctrl_mdts(req);
696692 id->cntlid = cpu_to_le16(ctrl->cntlid);
697693 id->ver = cpu_to_le32(ctrl->subsys->ver);
698694
drivers/nvme/target/auth.c+10−11
@@ -229,9 +229,6 @@ out_unlock: · 228 unmodified lines
229229 void nvmet_auth_sq_free(struct nvmet_sq *sq)
230230 {
231231 cancel_delayed_work(&sq->auth_expired_work);
232−#ifdef CONFIG_NVME_TARGET_TCP_TLS
233− sq->tls_key = NULL;
234−#endif
235232 kfree(sq->dhchap_c1);
236233 sq->dhchap_c1 = NULL;
237234 kfree(sq->dhchap_c2);
@@ -402,11 +399,12 @@ int nvmet_auth_ctrl_hash(struct nvmet_req *req, u8 *response, · 164 unmodified lines
402399 put_unaligned_le16(req->sq->dhchap_tid, buf);
403400 nvme_auth_hmac_update(&hmac, buf, 2);
404401
405− memset(buf, 0, 4);
402+ *buf = req->sq->sc_c;
406403 nvme_auth_hmac_update(&hmac, buf, 1);
407404 nvme_auth_hmac_update(&hmac, "Controller", 10);
408405 nvme_auth_hmac_update(&hmac, ctrl->subsys->subsysnqn,
409406 strlen(ctrl->subsys->subsysnqn));
407+ memset(buf, 0, 4);
410408 nvme_auth_hmac_update(&hmac, buf, 1);
411409 nvme_auth_hmac_update(&hmac, ctrl->hostnqn, strlen(ctrl->hostnqn));
412410 nvme_auth_hmac_final(&hmac, response);
@@ -449,18 +447,19 @@ int nvmet_auth_ctrl_sesskey(struct nvmet_req *req, · 36 unmodified lines
449447 struct nvmet_ctrl *ctrl = req->sq->ctrl;
450448 int ret;
451449
452− req->sq->dhchap_skey_len = ctrl->dh_keysize;
450+ req->sq->dhchap_skey_len = nvme_auth_hmac_hash_len(ctrl->shash_id);
453451 req->sq->dhchap_skey = kzalloc(req->sq->dhchap_skey_len, GFP_KERNEL);
454452 if (!req->sq->dhchap_skey)
455453 return -ENOMEM;
456− ret = nvme_auth_gen_shared_secret(ctrl->dh_tfm,
457− pkey, pkey_size,
458− req->sq->dhchap_skey,
459− req->sq->dhchap_skey_len);
454+ ret = nvme_auth_gen_session_key(ctrl->dh_tfm,
455+ pkey, pkey_size,
456+ req->sq->dhchap_skey,
457+ req->sq->dhchap_skey_len,
458+ ctrl->shash_id);
460459 if (ret)
461− pr_debug("failed to compute shared secret, err %d\n", ret);
460+ pr_debug("failed to compute session key, err %d\n", ret);
462461 else
463− pr_debug("%s: shared secret %*ph\n", __func__,
462+ pr_debug("%s: session key %*ph\n", __func__,
464463 (int)req->sq->dhchap_skey_len,
465464 req->sq->dhchap_skey);
466465
drivers/nvme/target/configfs.c+27−0
@@ -301,6 +301,31 @@ static ssize_t nvmet_param_max_queue_size_store(struct config_item *item, · 300 unmodified lines
301301
302302 CONFIGFS_ATTR(nvmet_, param_max_queue_size);
303303
304+static ssize_t nvmet_param_mdts_show(struct config_item *item, char *page)
305+{
306+ struct nvmet_port *port = to_nvmet_port(item);
307+
308+ return snprintf(page, PAGE_SIZE, "%d\n", port->mdts);
309+}
310+
311+static ssize_t nvmet_param_mdts_store(struct config_item *item,
312+ const char *page, size_t count)
313+{
314+ struct nvmet_port *port = to_nvmet_port(item);
315+ int ret;
316+
317+ if (nvmet_is_port_enabled(port, __func__))
318+ return -EACCES;
319+ ret = kstrtoint(page, 0, &port->mdts);
320+ if (ret) {
321+ pr_err("Invalid value '%s' for mdts\n", page);
322+ return -EINVAL;
323+ }
324+ return count;
325+}
326+
327+CONFIGFS_ATTR(nvmet_, param_mdts);
328+
304329 #ifdef CONFIG_BLK_DEV_INTEGRITY
305330 static ssize_t nvmet_param_pi_enable_show(struct config_item *item,
306331 char *page)
@@ -1995,6 +2020,7 @@ static struct configfs_attribute *nvmet_port_attrs[] = { · 1688 unmodified lines
19952020 &nvmet_attr_addr_tsas,
19962021 &nvmet_attr_param_inline_data_size,
19972022 &nvmet_attr_param_max_queue_size,
2023+ &nvmet_attr_param_mdts,
19982024 #ifdef CONFIG_BLK_DEV_INTEGRITY
19992025 &nvmet_attr_param_pi_enable,
20002026 #endif
@@ -2053,6 +2079,7 @@ static struct config_group *nvmet_ports_make(struct config_group *group, · 52 unmodified lines
20532079 INIT_LIST_HEAD(&port->referrals);
20542080 port->inline_data_size = -1; /* < 0 == let the transport choose */
20552081 port->max_queue_size = -1; /* < 0 == let the transport choose */
2082+ port->mdts = -1; /* < 0 == let the transport choose */
20562083
20572084 port->disc_addr.trtype = NVMF_TRTYPE_MAX;
20582085 port->disc_addr.portid = cpu_to_le16(portid);
drivers/nvme/target/core.c+9−1
@@ -370,6 +370,14 @@ int nvmet_enable_port(struct nvmet_port *port) · 369 unmodified lines
370370 NVMET_MIN_QUEUE_SIZE,
371371 NVMET_MAX_QUEUE_SIZE);
372372
373+ /*
374+ * If the transport didn't set the mdts properly, then clamp it to the
375+ * target limits. Also set default values in case the transport didn't
376+ * set it at all.
377+ */
378+ if (port->mdts < 0 || port->mdts > NVMET_MAX_MDTS)
379+ port->mdts = 0;
380+
373381 port->enabled = true;
374382 port->tr_ops = ops;
375383 return 0;
@@ -1743,7 +1751,7 @@ static void nvmet_ctrl_free(struct kref *ref) · 1367 unmodified lines
17431751
17441752 nvmet_stop_keep_alive_timer(ctrl);
17451753
1746− flush_work(&ctrl->async_event_work);
1754+ cancel_work_sync(&ctrl->async_event_work);
17471755 cancel_work_sync(&ctrl->fatal_err_work);
17481756
17491757 nvmet_destroy_auth(ctrl);
drivers/nvme/target/fabrics-cmd-auth.c+5−4
@@ -395,10 +395,9 @@ done: · 394 unmodified lines
395395 goto complete;
396396 }
397397 /* Final states, clear up variables */
398− if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE2) {
399− nvmet_auth_sq_free(req->sq);
398+ nvmet_auth_sq_free(req->sq);
399+ if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE2)
400400 nvmet_ctrl_fatal_error(ctrl);
401− }
402401
403402 complete:
404403 nvmet_req_complete(req, status);
@@ -574,7 +573,9 @@ void nvmet_execute_auth_receive(struct nvmet_req *req) · 169 unmodified lines
574573 status = nvmet_copy_to_sgl(req, 0, d, al);
575574 kfree(d);
576575 done:
577− if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE1) {
576+ if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2)
577+ nvmet_auth_sq_free(req->sq);
578+ else if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE1) {
578579 nvmet_auth_sq_free(req->sq);
579580 nvmet_ctrl_fatal_error(ctrl);
580581 }
drivers/nvme/target/nvmet.h+13−0
@@ -214,6 +214,7 @@ struct nvmet_port { · 213 unmodified lines
214214 bool enabled;
215215 int inline_data_size;
216216 int max_queue_size;
217+ int mdts;
217218 const struct nvmet_fabrics_ops *tr_ops;
218219 bool pi_enable;
219220 };
@@ -673,6 +674,7 @@ void nvmet_add_async_event(struct nvmet_ctrl *ctrl, u8 event_type, · 453 unmodified lines
673674 #define NVMET_MAX_QUEUE_SIZE 1024
674675 #define NVMET_NR_QUEUES 128
675676 #define NVMET_MAX_CMD(ctrl) (NVME_CAP_MQES(ctrl->cap) + 1)
677+#define NVMET_MAX_MDTS 255
676678
677679 /*
678680 * Nice round number that makes a list of nsids fit into a page.
@@ -761,6 +763,17 @@ static inline bool nvmet_is_pci_ctrl(struct nvmet_ctrl *ctrl) · 82 unmodified lines
761763 return ctrl->port->disc_addr.trtype == NVMF_TRTYPE_PCI;
762764 }
763765
766+/* Limit MDTS according to port config or transport capability */
767+static inline u8 nvmet_ctrl_mdts(struct nvmet_req *req)
768+{
769+ struct nvmet_ctrl *ctrl = req->sq->ctrl;
770+ u8 mdts = req->port->mdts;
771+
772+ if (!ctrl->ops->get_mdts)
773+ return mdts;
774+ return min_not_zero(ctrl->ops->get_mdts(ctrl), mdts);
775+}
776+
764777 #ifdef CONFIG_NVME_TARGET_PASSTHRU
765778 void nvmet_passthru_subsys_free(struct nvmet_subsys *subsys);
766779 int nvmet_passthru_ctrl_enable(struct nvmet_subsys *subsys);
drivers/nvme/target/tcp.c+64−53
@@ -349,9 +349,7 @@ static void nvmet_tcp_free_cmd_buffers(struct nvmet_tcp_cmd *cmd) · 348 unmodified lines
349349 cmd->req.sg = NULL;
350350 }
351351
352−static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue);
353−
354−static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
352+static int nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
355353 {
356354 struct bio_vec *iov = cmd->iov;
357355 struct scatterlist *sg;
@@ -364,22 +362,19 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd) · 6 unmodified lines
364362 offset = cmd->rbytes_done;
365363 cmd->sg_idx = offset / PAGE_SIZE;
366364 sg_offset = offset % PAGE_SIZE;
367− if (!cmd->req.sg_cnt || cmd->sg_idx >= cmd->req.sg_cnt) {
368− nvmet_tcp_fatal_error(cmd->queue);
369− return;
370− }
365+ if (!cmd->req.sg_cnt || cmd->sg_idx >= cmd->req.sg_cnt)
366+ return -EPROTO;
367+
371368 sg = &cmd->req.sg[cmd->sg_idx];
372369 sg_remaining = cmd->req.sg_cnt - cmd->sg_idx;
373370
374371 while (length) {
375− if (!sg_remaining) {
376− nvmet_tcp_fatal_error(cmd->queue);
377− return;
378− }
379− if (!sg->length || sg->length <= sg_offset) {
380− nvmet_tcp_fatal_error(cmd->queue);
381− return;
382− }
372+ if (!sg_remaining)
373+ return -EPROTO;
374+
375+ if (!sg->length || sg->length <= sg_offset)
376+ return -EPROTO;
377+
383378 u32 iov_len = min_t(u32, length, sg->length - sg_offset);
384379
385380 bvec_set_page(iov, sg_page(sg), iov_len,
@@ -394,24 +389,29 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd) · 8 unmodified lines
394389
395390 iov_iter_bvec(&cmd->recv_msg.msg_iter, ITER_DEST, cmd->iov,
396391 nr_pages, cmd->pdu_len);
397−}
398−
399−static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue)
400−{
401− queue->rcv_state = NVMET_TCP_RECV_ERR;
402− if (queue->nvme_sq.ctrl)
403− nvmet_ctrl_fatal_error(queue->nvme_sq.ctrl);
404− else
405− kernel_sock_shutdown(queue->sock, SHUT_RDWR);
392+ return 0;
406393 }
407394
408395 static void nvmet_tcp_socket_error(struct nvmet_tcp_queue *queue, int status)
409396 {
397+ /*
398+ * Keep rcv_state at RECV_ERR even for the internal -ESHUTDOWN path.
399+ * nvmet_tcp_handle_icreq() can return -ESHUTDOWN after the ICReq has
400+ * already been consumed and queue teardown has started.
401+ *
402+ * If nvmet_tcp_data_ready() or nvmet_tcp_write_space() queues
403+ * nvmet_tcp_io_work() again before nvmet_tcp_release_queue_work()
404+ * cancels it, the queue must not keep that old receive state.
405+ * Otherwise the next nvmet_tcp_io_work() run can reach
406+ * nvmet_tcp_done_recv_pdu() and try to handle the same ICReq again.
407+ *
408+ * That is why queue->rcv_state needs to be updated before we return.
409+ */
410410 queue->rcv_state = NVMET_TCP_RECV_ERR;
411− if (status == -EPIPE || status == -ECONNRESET)
411+ if (status == -EPIPE || status == -ECONNRESET || !queue->nvme_sq.ctrl)
412412 kernel_sock_shutdown(queue->sock, SHUT_RDWR);
413413 else
414− nvmet_tcp_fatal_error(queue);
414+ nvmet_ctrl_fatal_error(queue->nvme_sq.ctrl);
415415 }
416416
417417 static int nvmet_tcp_map_data(struct nvmet_tcp_cmd *cmd)
@@ -887,7 +887,6 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue) · 469 unmodified lines
887887 if (le32_to_cpu(icreq->hdr.plen) != sizeof(struct nvme_tcp_icreq_pdu)) {
888888 pr_err("bad nvme-tcp pdu length (%d)\n",
889889 le32_to_cpu(icreq->hdr.plen));
890− nvmet_tcp_fatal_error(queue);
891890 return -EPROTO;
892891 }
893892
@@ -922,16 +921,29 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue) · 28 unmodified lines
922921 iov.iov_len = sizeof(*icresp);
923922 ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len);
924923 if (ret < 0) {
924+ spin_lock_bh(&queue->state_lock);
925+ if (queue->state == NVMET_TCP_Q_DISCONNECTING) {
926+ spin_unlock_bh(&queue->state_lock);
927+ return -ESHUTDOWN;
928+ }
925929 queue->state = NVMET_TCP_Q_FAILED;
930+ spin_unlock_bh(&queue->state_lock);
926931 return ret; /* queue removal will cleanup */
927932 }
928933
934+ spin_lock_bh(&queue->state_lock);
935+ if (queue->state == NVMET_TCP_Q_DISCONNECTING) {
936+ spin_unlock_bh(&queue->state_lock);
937+ /* Tell nvmet_tcp_socket_error() teardown is in progress. */
938+ return -ESHUTDOWN;
939+ }
929940 queue->state = NVMET_TCP_Q_LIVE;
941+ spin_unlock_bh(&queue->state_lock);
930942 nvmet_prepare_receive_pdu(queue);
931943 return 0;
932944 }
933945
934−static void nvmet_tcp_handle_req_failure(struct nvmet_tcp_queue *queue,
946+static int nvmet_tcp_handle_req_failure(struct nvmet_tcp_queue *queue,
935947 struct nvmet_tcp_cmd *cmd, struct nvmet_req *req)
936948 {
937949 size_t data_len = le32_to_cpu(req->cmd->common.dptr.sgl.length);
@@ -947,19 +959,22 @@ static void nvmet_tcp_handle_req_failure(struct nvmet_tcp_queue *queue, · 9 unmodified lines
947959 if (!nvme_is_write(cmd->req.cmd) || !data_len ||
948960 data_len > cmd->req.port->inline_data_size) {
949961 nvmet_prepare_receive_pdu(queue);
950− return;
962+ return 0;
951963 }
952964
953965 ret = nvmet_tcp_map_data(cmd);
954966 if (unlikely(ret)) {
955967 pr_err("queue %d: failed to map data\n", queue->idx);
956− nvmet_tcp_fatal_error(queue);
957− return;
968+ return -EPROTO;
958969 }
959970
960971 queue->rcv_state = NVMET_TCP_RECV_DATA;
961− nvmet_tcp_build_pdu_iovec(cmd);
962972 cmd->flags |= NVMET_TCP_F_INIT_FAILED;
973+ ret = nvmet_tcp_build_pdu_iovec(cmd);
974+ if (unlikely(ret))
975+ pr_err("queue %d: failed to build PDU iovec\n", queue->idx);
976+
977+ return ret;
963978 }
964979
965980 static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)
@@ -1011,7 +1026,10 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) · 45 unmodified lines
10111026 goto err_proto;
10121027 }
10131028 cmd->pdu_recv = 0;
1014− nvmet_tcp_build_pdu_iovec(cmd);
1029+ if (unlikely(nvmet_tcp_build_pdu_iovec(cmd))) {
1030+ pr_err("queue %d: failed to build PDU iovec\n", queue->idx);
1031+ goto err_proto;
1032+ }
10151033 queue->cmd = cmd;
10161034 queue->rcv_state = NVMET_TCP_RECV_DATA;
10171035
@@ -1019,7 +1037,6 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) · 1 unmodified line
10191037
10201038 err_proto:
10211039 /* FIXME: use proper transport errors */
1022− nvmet_tcp_fatal_error(queue);
10231040 return -EPROTO;
10241041 }
10251042
@@ -1034,7 +1051,6 @@ static int nvmet_tcp_done_recv_pdu(struct nvmet_tcp_queue *queue) · 8 unmodified lines
10341051 if (hdr->type != nvme_tcp_icreq) {
10351052 pr_err("unexpected pdu type (%d) before icreq\n",
10361053 hdr->type);
1037− nvmet_tcp_fatal_error(queue);
10381054 return -EPROTO;
10391055 }
10401056 return nvmet_tcp_handle_icreq(queue);
@@ -1043,7 +1059,6 @@ static int nvmet_tcp_done_recv_pdu(struct nvmet_tcp_queue *queue) · 2 unmodified lines
10431059 if (unlikely(hdr->type == nvme_tcp_icreq)) {
10441060 pr_err("queue %d: received icreq pdu in state %d\n",
10451061 queue->idx, queue->state);
1046− nvmet_tcp_fatal_error(queue);
10471062 return -EPROTO;
10481063 }
10491064
@@ -1060,7 +1075,6 @@ static int nvmet_tcp_done_recv_pdu(struct nvmet_tcp_queue *queue) · 10 unmodified lines
10601075 pr_err("queue %d: out of commands (%d) send_list_len: %d, opcode: %d",
10611076 queue->idx, queue->nr_cmds, queue->send_list_len,
10621077 nvme_cmd->common.opcode);
1063− nvmet_tcp_fatal_error(queue);
10641078 return -ENOMEM;
10651079 }
10661080
@@ -1074,17 +1088,16 @@ static int nvmet_tcp_done_recv_pdu(struct nvmet_tcp_queue *queue) · 7 unmodified lines
10741088 le32_to_cpu(req->cmd->common.dptr.sgl.length),
10751089 le16_to_cpu(req->cqe->status));
10761090
1077− nvmet_tcp_handle_req_failure(queue, queue->cmd, req);
1078− return 0;
1091+ return nvmet_tcp_handle_req_failure(queue, queue->cmd, req);
10791092 }
10801093
10811094 ret = nvmet_tcp_map_data(queue->cmd);
10821095 if (unlikely(ret)) {
10831096 pr_err("queue %d: failed to map data\n", queue->idx);
10841097 if (nvmet_tcp_has_inline_data(queue->cmd))
1085− nvmet_tcp_fatal_error(queue);
1086− else
1087− nvmet_req_complete(req, ret);
1098+ return -EPROTO;
1099+
1100+ nvmet_req_complete(req, ret);
10881101 ret = -EAGAIN;
10891102 goto out;
10901103 }
@@ -1092,8 +1105,11 @@ static int nvmet_tcp_done_recv_pdu(struct nvmet_tcp_queue *queue) · 1 unmodified line
10921105 if (nvmet_tcp_need_data_in(queue->cmd)) {
10931106 if (nvmet_tcp_has_inline_data(queue->cmd)) {
10941107 queue->rcv_state = NVMET_TCP_RECV_DATA;
1095− nvmet_tcp_build_pdu_iovec(queue->cmd);
1096− return 0;
1108+ ret = nvmet_tcp_build_pdu_iovec(queue->cmd);
1109+ if (unlikely(ret))
1110+ pr_err("queue %d: failed to build PDU iovec\n",
1111+ queue->idx);
1112+ return ret;
10971113 }
10981114 /* send back R2T */
10991115 nvmet_tcp_queue_response(&queue->cmd->req);
@@ -1204,7 +1220,6 @@ recv: · 104 unmodified lines
12041220
12051221 if (unlikely(!nvmet_tcp_pdu_valid(hdr->type))) {
12061222 pr_err("unexpected pdu type %d\n", hdr->type);
1207− nvmet_tcp_fatal_error(queue);
12081223 return -EIO;
12091224 }
12101225
@@ -1218,16 +1233,12 @@ recv: · 7 unmodified lines
12181233 }
12191234
12201235 if (queue->hdr_digest &&
1221− nvmet_tcp_verify_hdgst(queue, &queue->pdu, hdr->hlen)) {
1222− nvmet_tcp_fatal_error(queue); /* fatal */
1236+ nvmet_tcp_verify_hdgst(queue, &queue->pdu, hdr->hlen))
12231237 return -EPROTO;
1224− }
12251238
12261239 if (queue->data_digest &&
1227− nvmet_tcp_check_ddgst(queue, &queue->pdu)) {
1228− nvmet_tcp_fatal_error(queue); /* fatal */
1240+ nvmet_tcp_check_ddgst(queue, &queue->pdu))
12291241 return -EPROTO;
1230− }
12311242
12321243 return nvmet_tcp_done_recv_pdu(queue);
12331244 }
@@ -1310,9 +1321,9 @@ static int nvmet_tcp_try_recv_ddgst(struct nvmet_tcp_queue *queue) · 76 unmodified lines
13101321 queue->idx, cmd->req.cmd->common.command_id,
13111322 queue->pdu.cmd.hdr.type, le32_to_cpu(cmd->recv_ddgst),
13121323 le32_to_cpu(cmd->exp_ddgst));
1313− nvmet_req_uninit(&cmd->req);
1324+ if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED))
1325+ nvmet_req_uninit(&cmd->req);
13141326 nvmet_tcp_free_cmd_buffers(cmd);
1315− nvmet_tcp_fatal_error(queue);
13161327 ret = -EPROTO;
13171328 goto out;
13181329 }
drivers/nvme/target/zns.c+1−5
@@ -69,7 +69,6 @@ bool nvmet_bdev_zns_enable(struct nvmet_ns *ns) · 68 unmodified lines
6969 void nvmet_execute_identify_ctrl_zns(struct nvmet_req *req)
7070 {
7171 u8 zasl = req->sq->ctrl->subsys->zasl;
72− struct nvmet_ctrl *ctrl = req->sq->ctrl;
7372 struct nvme_id_ctrl_zns *id;
7473 u16 status;
7574
@@ -79,10 +78,7 @@ void nvmet_execute_identify_ctrl_zns(struct nvmet_req *req) · 3 unmodified lines
7978 goto out;
8079 }
8180
82− if (ctrl->ops->get_mdts)
83− id->zasl = min_t(u8, ctrl->ops->get_mdts(ctrl), zasl);
84− else
85− id->zasl = zasl;
81+ id->zasl = min_not_zero(nvmet_ctrl_mdts(req), zasl);
8682
8783 status = nvmet_copy_to_sgl(req, 0, id, sizeof(*id));
8884
drivers/regulator/Kconfig+1−0
@@ -1231,6 +1231,7 @@ config REGULATOR_RASPBERRYPI_TOUCHSCREEN_ATTINY · 1230 unmodified lines
12311231 tristate "Raspberry Pi 7-inch touchscreen panel ATTINY regulator"
12321232 depends on ARM || ARM64 || COMPILE_TEST
12331233 depends on BACKLIGHT_CLASS_DEVICE
1234+ depends on GPIOLIB
12341235 depends on I2C
12351236 select REGMAP_I2C
12361237 help
drivers/s390/char/Kconfig+0−8
@@ -85,14 +85,6 @@ config HMC_DRV · 84 unmodified lines
8585 transfer cache size from its default value 0.5MB to N bytes. If N
8686 is zero, then no caching is performed.
8787
88−config SCLP_OFB
89− def_bool n
90− prompt "Support for Open-for-Business SCLP Event"
91− depends on S390
92− help
93− This option enables the Open-for-Business interface to the s390
94− Service Element.
95−
9688 config S390_UV_UAPI
9789 def_tristate m
9890 prompt "Ultravisor userspace API"
drivers/s390/char/sclp_config.c+0−6
@@ -80,14 +80,11 @@ static void sclp_conf_receiver_fn(struct evbuf_header *evbuf) · 79 unmodified lines
8080
8181 static struct sclp_register sclp_conf_register =
8282 {
83−#ifdef CONFIG_SCLP_OFB
8483 .send_mask = EVTYP_CONFMGMDATA_MASK,
85−#endif
8684 .receive_mask = EVTYP_CONFMGMDATA_MASK,
8785 .receiver_fn = sclp_conf_receiver_fn,
8886 };
8987
90−#ifdef CONFIG_SCLP_OFB
9188 static int sclp_ofb_send_req(char *ev_data, size_t len)
9289 {
9390 static DEFINE_MUTEX(send_mutex);
@@ -143,11 +140,9 @@ static const struct bin_attribute ofb_bin_attr = { · 49 unmodified lines
143140 },
144141 .write = sysfs_ofb_data_write,
145142 };
146−#endif
147143
148144 static int __init sclp_ofb_setup(void)
149145 {
150−#ifdef CONFIG_SCLP_OFB
151146 struct kset *ofb_kset;
152147 int rc;
153148
@@ -159,7 +154,6 @@ static int __init sclp_ofb_setup(void) · 5 unmodified lines
159154 kset_unregister(ofb_kset);
160155 return rc;
161156 }
162−#endif
163157 return 0;
164158 }
165159
drivers/scsi/sr.c+2−9
@@ -395,7 +395,7 @@ static blk_status_t sr_init_command(struct scsi_cmnd *SCpnt) · 394 unmodified lines
395395
396396 switch (req_op(rq)) {
397397 case REQ_OP_WRITE:
398− if (!cd->writeable)
398+ if (get_disk_ro(cd->disk))
399399 goto out;
400400 SCpnt->cmnd[0] = WRITE_10;
401401 cd->cdi.media_written = 1;
@@ -681,6 +681,7 @@ static int sr_probe(struct scsi_device *sdev) · 279 unmodified lines
681681 error = -ENOMEM;
682682 if (get_capabilities(cd))
683683 goto fail_minor;
684+ cdrom_probe_write_features(&cd->cdi);
684685 sr_vendor_init(cd);
685686
686687 set_capacity(disk, cd->capacity);
@@ -899,14 +900,6 @@ static int get_capabilities(struct scsi_cd *cd) · 212 unmodified lines
899900 /*else I don't think it can close its tray
900901 cd->cdi.mask |= CDC_CLOSE_TRAY; */
901902
902− /*
903− * if DVD-RAM, MRW-W or CD-RW, we are randomly writable
904− */
905− if ((cd->cdi.mask & (CDC_DVD_RAM | CDC_MRW_W | CDC_RAM | CDC_CD_RW)) !=
906− (CDC_DVD_RAM | CDC_MRW_W | CDC_RAM | CDC_CD_RW)) {
907− cd->writeable = 1;
908− }
909−
910903 kfree(buffer);
911904 return 0;
912905 }
drivers/scsi/sr.h+0−1
@@ -35,7 +35,6 @@ typedef struct scsi_cd { · 34 unmodified lines
3535 struct scsi_device *device;
3636 unsigned int vendor; /* vendor code, see sr_vendor.c */
3737 unsigned long ms_offset; /* for reading multisession-CD's */
38− unsigned writeable : 1;
3938 unsigned use:1; /* is this device still supportable */
4039 unsigned xa_flag:1; /* CD has XA sectors ? */
4140 unsigned readcd_known:1; /* drive supports READ_CD (0xbe) */
drivers/spi/spi-airoha-snfi.c+3−3
@@ -546,7 +546,7 @@ static int airoha_snand_dirmap_create(struct spi_mem_dirmap_desc *desc) · 545 unmodified lines
546546 if (desc->info.length > SPI_NAND_CACHE_SIZE)
547547 return -E2BIG;
548548
549− if (!airoha_snand_supports_op(desc->mem, &desc->info.op_tmpl))
549+ if (!airoha_snand_supports_op(desc->mem, desc->info.op_tmpl))
550550 return -EOPNOTSUPP;
551551
552552 return 0;
@@ -572,7 +572,7 @@ static ssize_t airoha_snand_dirmap_read(struct spi_mem_dirmap_desc *desc, · 19 unmodified lines
572572 * DUALIO and QUADIO opcodes are not supported by the spi controller,
573573 * replace them with supported opcodes.
574574 */
575− opcode = desc->info.op_tmpl.cmd.opcode;
575+ opcode = desc->info.op_tmpl->cmd.opcode;
576576 switch (opcode) {
577577 case SPI_NAND_OP_READ_FROM_CACHE_SINGLE:
578578 case SPI_NAND_OP_READ_FROM_CACHE_SINGLE_FAST:
@@ -761,7 +761,7 @@ static ssize_t airoha_snand_dirmap_write(struct spi_mem_dirmap_desc *desc, · 182 unmodified lines
761761 /* minimum oob size is 64 */
762762 bytes = round_up(offs + len, 64);
763763
764− opcode = desc->info.op_tmpl.cmd.opcode;
764+ opcode = desc->info.op_tmpl->cmd.opcode;
765765 switch (opcode) {
766766 case SPI_NAND_OP_PROGRAM_LOAD_SINGLE:
767767 case SPI_NAND_OP_PROGRAM_LOAD_RAMDOM_SINGLE:
drivers/spi/spi-amlogic-spisg.c+1−2
@@ -794,6 +794,7 @@ static int aml_spisg_probe(struct platform_device *pdev) · 793 unmodified lines
794794
795795 dma_set_max_seg_size(&pdev->dev, SPISG_BLOCK_MAX);
796796
797+ init_completion(&spisg->completion);
797798 ret = devm_request_irq(&pdev->dev, irq, aml_spisg_irq, 0, NULL, spisg);
798799 if (ret) {
799800 dev_err(&pdev->dev, "irq request failed\n");
@@ -806,8 +807,6 @@ static int aml_spisg_probe(struct platform_device *pdev) · 6 unmodified lines
806807 goto out_clk;
807808 }
808809
809− init_completion(&spisg->completion);
810−
811810 pm_runtime_put(&spisg->pdev->dev);
812811
813812 return 0;
drivers/spi/spi-aspeed-smc.c+2−2
@@ -697,7 +697,7 @@ static int aspeed_spi_dirmap_create(struct spi_mem_dirmap_desc *desc) · 696 unmodified lines
697697 {
698698 struct aspeed_spi *aspi = spi_controller_get_devdata(desc->mem->spi->controller);
699699 struct aspeed_spi_chip *chip = &aspi->chips[spi_get_chipselect(desc->mem->spi, 0)];
700− struct spi_mem_op *op = &desc->info.op_tmpl;
700+ struct spi_mem_op *op = desc->info.op_tmpl;
701701 u32 ctl_val;
702702 int ret = 0;
703703
@@ -769,7 +769,7 @@ static ssize_t aspeed_spi_dirmap_read(struct spi_mem_dirmap_desc *desc, · 65 unmodified lines
769769 if (chip->ahb_window_size < offset + len || chip->force_user_mode) {
770770 int ret;
771771
772− ret = aspeed_spi_read_user(chip, &desc->info.op_tmpl, offset, len, buf);
772+ ret = aspeed_spi_read_user(chip, desc->info.op_tmpl, offset, len, buf);
773773 if (ret < 0)
774774 return ret;
775775 } else {
drivers/spi/spi-axiado.c+1−1
@@ -201,7 +201,7 @@ static void ax_spi_fill_tx_fifo(struct ax_spi *xspi) · 200 unmodified lines
201201 * then spi control did't work thoroughly, add one byte delay
202202 */
203203 if (ax_spi_read(xspi, AX_SPI_IVR) & AX_SPI_IVR_TFOV)
204− usleep_range(10, 10);
204+ udelay(10);
205205 if (xspi->tx_buf)
206206 ax_spi_write_b(xspi, AX_SPI_TXFIFO, *xspi->tx_buf++);
207207 else
drivers/spi/spi-cadence-quadspi.c+18−18
@@ -1860,14 +1860,10 @@ static int cqspi_probe(struct platform_device *pdev) · 1859 unmodified lines
18601860 if (irq < 0)
18611861 return -ENXIO;
18621862
1863− ret = pm_runtime_set_active(dev);
1864− if (ret)
1865− return ret;
1866−
18671863 ret = clk_bulk_prepare_enable(CLK_QSPI_NUM, cqspi->clks);
18681864 if (ret) {
18691865 dev_err(dev, "Cannot enable QSPI clocks.\n");
1870− goto disable_rpm;
1866+ return ret;
18711867 }
18721868
18731869 /* Obtain QSPI reset control */
@@ -1962,10 +1958,11 @@ static int cqspi_probe(struct platform_device *pdev) · 88 unmodified lines
19621958 cqspi->sclk = 0;
19631959
19641960 if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) {
1965− pm_runtime_enable(dev);
19661961 pm_runtime_set_autosuspend_delay(dev, CQSPI_AUTOSUSPEND_TIMEOUT);
19671962 pm_runtime_use_autosuspend(dev);
19681963 pm_runtime_get_noresume(dev);
1964+ pm_runtime_set_active(dev);
1965+ pm_runtime_enable(dev);
19691966 }
19701967
19711968 host->num_chipselect = cqspi->num_chipselect;
@@ -1977,7 +1974,7 @@ static int cqspi_probe(struct platform_device *pdev) · 5 unmodified lines
19771974 ret = cqspi_request_mmap_dma(cqspi);
19781975 if (ret == -EPROBE_DEFER) {
19791976 dev_err_probe(&pdev->dev, ret, "Failed to request mmap DMA\n");
1980− goto disable_controller;
1977+ goto disable_rpm;
19811978 }
19821979 }
19831980
@@ -1995,14 +1992,16 @@ static int cqspi_probe(struct platform_device *pdev) · 11 unmodified lines
19951992 release_dma_chan:
19961993 if (cqspi->rx_chan)
19971994 dma_release_channel(cqspi->rx_chan);
1998−disable_controller:
1999− cqspi_controller_enable(cqspi, 0);
2000−disable_clks:
2001− if (pm_runtime_get_sync(&pdev->dev) >= 0)
2002− clk_bulk_disable_unprepare(CLK_QSPI_NUM, cqspi->clks);
20031995 disable_rpm:
2004− if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
1996+ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) {
20051997 pm_runtime_disable(dev);
1998+ pm_runtime_set_suspended(dev);
1999+ pm_runtime_put_noidle(dev);
2000+ pm_runtime_dont_use_autosuspend(dev);
2001+ }
2002+ cqspi_controller_enable(cqspi, 0);
2003+disable_clks:
2004+ clk_bulk_disable_unprepare(CLK_QSPI_NUM, cqspi->clks);
20062005
20072006 return ret;
20082007 }
@@ -2026,18 +2025,19 @@ static void cqspi_remove(struct platform_device *pdev) · 17 unmodified lines
20262025 if (cqspi->rx_chan)
20272026 dma_release_channel(cqspi->rx_chan);
20282027
2029− cqspi_controller_enable(cqspi, 0);
2030−
2031−
20322028 if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
20332029 ret = pm_runtime_get_sync(&pdev->dev);
20342030
2035− if (ret >= 0)
2031+ if (ret >= 0) {
2032+ cqspi_controller_enable(cqspi, 0);
20362033 clk_bulk_disable_unprepare(CLK_QSPI_NUM, cqspi->clks);
2034+ }
20372035
20382036 if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) {
2039− pm_runtime_put_sync(&pdev->dev);
20402037 pm_runtime_disable(&pdev->dev);
2038+ pm_runtime_set_suspended(&pdev->dev);
2039+ pm_runtime_put_noidle(&pdev->dev);
2040+ pm_runtime_dont_use_autosuspend(&pdev->dev);
20412041 }
20422042 }
20432043
drivers/spi/spi-cadence.c+13−2
@@ -741,7 +741,6 @@ static int cdns_spi_probe(struct platform_device *pdev) · 740 unmodified lines
741741 /* Set to default valid value */
742742 ctlr->max_speed_hz = xspi->clk_rate / 4;
743743 xspi->speed_hz = ctlr->max_speed_hz;
744− pm_runtime_put_autosuspend(&pdev->dev);
745744 } else {
746745 ctlr->mode_bits |= SPI_NO_CS;
747746 ctlr->target_abort = cdns_target_abort;
@@ -752,12 +751,17 @@ static int cdns_spi_probe(struct platform_device *pdev) · 4 unmodified lines
752751 goto clk_dis_all;
753752 }
754753
754+ if (!spi_controller_is_target(ctlr))
755+ pm_runtime_put_autosuspend(&pdev->dev);
756+
755757 return ret;
756758
757759 clk_dis_all:
758760 if (!spi_controller_is_target(ctlr)) {
759761 pm_runtime_disable(&pdev->dev);
760762 pm_runtime_set_suspended(&pdev->dev);
763+ pm_runtime_put_noidle(&pdev->dev);
764+ pm_runtime_dont_use_autosuspend(&pdev->dev);
761765 }
762766 remove_ctlr:
763767 spi_controller_put(ctlr);
@@ -776,16 +780,23 @@ static void cdns_spi_remove(struct platform_device *pdev) · 12 unmodified lines
776780 {
777781 struct spi_controller *ctlr = platform_get_drvdata(pdev);
778782 struct cdns_spi *xspi = spi_controller_get_devdata(ctlr);
783+ int ret = 0;
784+
785+ if (!spi_controller_is_target(ctlr))
786+ ret = pm_runtime_get_sync(&pdev->dev);
779787
780788 spi_controller_get(ctlr);
781789
782790 spi_unregister_controller(ctlr);
783791
784− cdns_spi_write(xspi, CDNS_SPI_ER, CDNS_SPI_ER_DISABLE);
792+ if (ret >= 0)
793+ cdns_spi_write(xspi, CDNS_SPI_ER, CDNS_SPI_ER_DISABLE);
785794
786795 if (!spi_controller_is_target(ctlr)) {
787796 pm_runtime_disable(&pdev->dev);
788797 pm_runtime_set_suspended(&pdev->dev);
798+ pm_runtime_put_noidle(&pdev->dev);
799+ pm_runtime_dont_use_autosuspend(&pdev->dev);
789800 }
790801
791802 spi_controller_put(ctlr);
drivers/spi/spi-intel.c+3−3
@@ -814,7 +814,7 @@ static int intel_spi_dirmap_create(struct spi_mem_dirmap_desc *desc) · 813 unmodified lines
814814 struct intel_spi *ispi = spi_controller_get_devdata(desc->mem->spi->controller);
815815 const struct intel_spi_mem_op *iop;
816816
817− iop = intel_spi_match_mem_op(ispi, &desc->info.op_tmpl);
817+ iop = intel_spi_match_mem_op(ispi, desc->info.op_tmpl);
818818 if (!iop)
819819 return -EOPNOTSUPP;
820820
@@ -827,7 +827,7 @@ static ssize_t intel_spi_dirmap_read(struct spi_mem_dirmap_desc *desc, u64 offs, · 6 unmodified lines
827827 {
828828 struct intel_spi *ispi = spi_controller_get_devdata(desc->mem->spi->controller);
829829 const struct intel_spi_mem_op *iop = desc->priv;
830− struct spi_mem_op op = desc->info.op_tmpl;
830+ struct spi_mem_op op = *desc->info.op_tmpl;
831831 int ret;
832832
833833 /* Fill in the gaps */
@@ -844,7 +844,7 @@ static ssize_t intel_spi_dirmap_write(struct spi_mem_dirmap_desc *desc, u64 offs · 10 unmodified lines
844844 {
845845 struct intel_spi *ispi = spi_controller_get_devdata(desc->mem->spi->controller);
846846 const struct intel_spi_mem_op *iop = desc->priv;
847− struct spi_mem_op op = desc->info.op_tmpl;
847+ struct spi_mem_op op = *desc->info.op_tmpl;
848848 int ret;
849849
850850 op.addr.val = offs;
drivers/spi/spi-mem.c+25−7
@@ -647,7 +647,7 @@ EXPORT_SYMBOL_GPL(spi_mem_calc_op_duration); · 646 unmodified lines
647647 static ssize_t spi_mem_no_dirmap_read(struct spi_mem_dirmap_desc *desc,
648648 u64 offs, size_t len, void *buf)
649649 {
650− struct spi_mem_op op = desc->info.op_tmpl;
650+ struct spi_mem_op op = *desc->info.op_tmpl;
651651 int ret;
652652
653653 op.addr.val = desc->info.offset + offs;
@@ -667,7 +667,7 @@ static ssize_t spi_mem_no_dirmap_read(struct spi_mem_dirmap_desc *desc, · 13 unmodified lines
667667 static ssize_t spi_mem_no_dirmap_write(struct spi_mem_dirmap_desc *desc,
668668 u64 offs, size_t len, const void *buf)
669669 {
670− struct spi_mem_op op = desc->info.op_tmpl;
670+ struct spi_mem_op op = *desc->info.op_tmpl;
671671 int ret;
672672
673673 op.addr.val = desc->info.offset + offs;
@@ -706,19 +706,37 @@ spi_mem_dirmap_create(struct spi_mem *mem, · 32 unmodified lines
706706 int ret = -ENOTSUPP;
707707
708708 /* Make sure the number of address cycles is between 1 and 8 bytes. */
709− if (!info->op_tmpl.addr.nbytes || info->op_tmpl.addr.nbytes > 8)
709+ if (!info->primary_op_tmpl.addr.nbytes || info->primary_op_tmpl.addr.nbytes > 8)
710710 return ERR_PTR(-EINVAL);
711711
712712 /* data.dir should either be SPI_MEM_DATA_IN or SPI_MEM_DATA_OUT. */
713− if (info->op_tmpl.data.dir == SPI_MEM_NO_DATA)
713+ if (info->primary_op_tmpl.data.dir == SPI_MEM_NO_DATA)
714714 return ERR_PTR(-EINVAL);
715715
716+ /* Apply similar constraints to the secondary template */
717+ if (info->secondary_op_tmpl.cmd.opcode) {
718+ if (!info->secondary_op_tmpl.addr.nbytes ||
719+ info->secondary_op_tmpl.addr.nbytes > 8)
720+ return ERR_PTR(-EINVAL);
721+
722+ if (info->secondary_op_tmpl.data.dir == SPI_MEM_NO_DATA)
723+ return ERR_PTR(-EINVAL);
724+
725+ if (!spi_mem_supports_op(mem, &info->secondary_op_tmpl))
726+ return ERR_PTR(-EOPNOTSUPP);
727+
728+ if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create &&
729+ !spi_mem_controller_is_capable(ctlr, secondary_op_tmpl))
730+ return ERR_PTR(-EOPNOTSUPP);
731+ }
732+
716733 desc = kzalloc_obj(*desc);
717734 if (!desc)
718735 return ERR_PTR(-ENOMEM);
719736
720737 desc->mem = mem;
721738 desc->info = *info;
739+ desc->info.op_tmpl = &desc->info.primary_op_tmpl;
722740 if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) {
723741 ret = spi_mem_access_start(mem);
724742 if (ret) {
@@ -733,7 +751,7 @@ spi_mem_dirmap_create(struct spi_mem *mem, · 8 unmodified lines
733751
734752 if (ret) {
735753 desc->nodirmap = true;
736− if (!spi_mem_supports_op(desc->mem, &desc->info.op_tmpl))
754+ if (!spi_mem_supports_op(desc->mem, &desc->info.primary_op_tmpl))
737755 ret = -EOPNOTSUPP;
738756 else
739757 ret = 0;
@@ -857,7 +875,7 @@ ssize_t spi_mem_dirmap_read(struct spi_mem_dirmap_desc *desc, · 117 unmodified lines
857875 struct spi_controller *ctlr = desc->mem->spi->controller;
858876 ssize_t ret;
859877
860− if (desc->info.op_tmpl.data.dir != SPI_MEM_DATA_IN)
878+ if (desc->info.op_tmpl->data.dir != SPI_MEM_DATA_IN)
861879 return -EINVAL;
862880
863881 if (!len)
@@ -903,7 +921,7 @@ ssize_t spi_mem_dirmap_write(struct spi_mem_dirmap_desc *desc, · 39 unmodified lines
903921 struct spi_controller *ctlr = desc->mem->spi->controller;
904922 ssize_t ret;
905923
906− if (desc->info.op_tmpl.data.dir != SPI_MEM_DATA_OUT)
924+ if (desc->info.op_tmpl->data.dir != SPI_MEM_DATA_OUT)
907925 return -EINVAL;
908926
909927 if (!len)
drivers/spi/spi-mxic.c+9−9
@@ -403,20 +403,20 @@ static ssize_t mxic_spi_mem_dirmap_read(struct spi_mem_dirmap_desc *desc, · 402 unmodified lines
403403 if (WARN_ON(offs + desc->info.offset + len > U32_MAX))
404404 return -EINVAL;
405405
406− writel(mxic_spi_prep_hc_cfg(desc->mem->spi, 0, desc->info.op_tmpl.data.swap16),
406+ writel(mxic_spi_prep_hc_cfg(desc->mem->spi, 0, desc->info.op_tmpl->data.swap16),
407407 mxic->regs + HC_CFG);
408408
409− writel(mxic_spi_mem_prep_op_cfg(&desc->info.op_tmpl, len),
409+ writel(mxic_spi_mem_prep_op_cfg(desc->info.op_tmpl, len),
410410 mxic->regs + LRD_CFG);
411411 writel(desc->info.offset + offs, mxic->regs + LRD_ADDR);
412412 len = min_t(size_t, len, mxic->linear.size);
413413 writel(len, mxic->regs + LRD_RANGE);
414− writel(LMODE_CMD0(desc->info.op_tmpl.cmd.opcode) |
414+ writel(LMODE_CMD0(desc->info.op_tmpl->cmd.opcode) |
415415 LMODE_SLV_ACT(spi_get_chipselect(desc->mem->spi, 0)) |
416416 LMODE_EN,
417417 mxic->regs + LRD_CTRL);
418418
419− if (mxic->ecc.use_pipelined_conf && desc->info.op_tmpl.data.ecc) {
419+ if (mxic->ecc.use_pipelined_conf && desc->info.op_tmpl->data.ecc) {
420420 ret = mxic_ecc_process_data_pipelined(mxic->ecc.pipelined_engine,
421421 NAND_PAGE_READ,
422422 mxic->linear.dma + offs);
@@ -448,20 +448,20 @@ static ssize_t mxic_spi_mem_dirmap_write(struct spi_mem_dirmap_desc *desc, · 25 unmodified lines
448448 if (WARN_ON(offs + desc->info.offset + len > U32_MAX))
449449 return -EINVAL;
450450
451− writel(mxic_spi_prep_hc_cfg(desc->mem->spi, 0, desc->info.op_tmpl.data.swap16),
451+ writel(mxic_spi_prep_hc_cfg(desc->mem->spi, 0, desc->info.op_tmpl->data.swap16),
452452 mxic->regs + HC_CFG);
453453
454− writel(mxic_spi_mem_prep_op_cfg(&desc->info.op_tmpl, len),
454+ writel(mxic_spi_mem_prep_op_cfg(desc->info.op_tmpl, len),
455455 mxic->regs + LWR_CFG);
456456 writel(desc->info.offset + offs, mxic->regs + LWR_ADDR);
457457 len = min_t(size_t, len, mxic->linear.size);
458458 writel(len, mxic->regs + LWR_RANGE);
459− writel(LMODE_CMD0(desc->info.op_tmpl.cmd.opcode) |
459+ writel(LMODE_CMD0(desc->info.op_tmpl->cmd.opcode) |
460460 LMODE_SLV_ACT(spi_get_chipselect(desc->mem->spi, 0)) |
461461 LMODE_EN,
462462 mxic->regs + LWR_CTRL);
463463
464− if (mxic->ecc.use_pipelined_conf && desc->info.op_tmpl.data.ecc) {
464+ if (mxic->ecc.use_pipelined_conf && desc->info.op_tmpl->data.ecc) {
465465 ret = mxic_ecc_process_data_pipelined(mxic->ecc.pipelined_engine,
466466 NAND_PAGE_WRITE,
467467 mxic->linear.dma + offs);
@@ -509,7 +509,7 @@ static int mxic_spi_mem_dirmap_create(struct spi_mem_dirmap_desc *desc) · 41 unmodified lines
509509 if (desc->info.offset + desc->info.length > U32_MAX)
510510 return -EINVAL;
511511
512− if (!mxic_spi_mem_supports_op(desc->mem, &desc->info.op_tmpl))
512+ if (!mxic_spi_mem_supports_op(desc->mem, desc->info.op_tmpl))
513513 return -EOPNOTSUPP;
514514
515515 return 0;
drivers/spi/spi-npcm-fiu.c+8−8
@@ -299,11 +299,11 @@ static ssize_t npcm_fiu_direct_read(struct spi_mem_dirmap_desc *desc, · 298 unmodified lines
299299 for (i = 0 ; i < len ; i++)
300300 *(buf_rx + i) = ioread8(src + i);
301301 } else {
302− if (desc->info.op_tmpl.addr.buswidth != fiu->drd_op.addr.buswidth ||
303− desc->info.op_tmpl.dummy.nbytes != fiu->drd_op.dummy.nbytes ||
304− desc->info.op_tmpl.cmd.opcode != fiu->drd_op.cmd.opcode ||
305− desc->info.op_tmpl.addr.nbytes != fiu->drd_op.addr.nbytes)
306− npcm_fiu_set_drd(fiu, &desc->info.op_tmpl);
302+ if (desc->info.op_tmpl->addr.buswidth != fiu->drd_op.addr.buswidth ||
303+ desc->info.op_tmpl->dummy.nbytes != fiu->drd_op.dummy.nbytes ||
304+ desc->info.op_tmpl->cmd.opcode != fiu->drd_op.cmd.opcode ||
305+ desc->info.op_tmpl->addr.nbytes != fiu->drd_op.addr.nbytes)
306+ npcm_fiu_set_drd(fiu, desc->info.op_tmpl);
307307
308308 memcpy_fromio(buf_rx, src, len);
309309 }
@@ -609,7 +609,7 @@ static int npcm_fiu_dirmap_create(struct spi_mem_dirmap_desc *desc) · 299 unmodified lines
609609 }
610610
611611 if (!fiu->spix_mode &&
612− desc->info.op_tmpl.data.dir == SPI_MEM_DATA_OUT) {
612+ desc->info.op_tmpl->data.dir == SPI_MEM_DATA_OUT) {
613613 desc->nodirmap = true;
614614 return 0;
615615 }
@@ -644,9 +644,9 @@ static int npcm_fiu_dirmap_create(struct spi_mem_dirmap_desc *desc) · 28 unmodified lines
644644 NPCM_FIU_CFG_FIU_FIX);
645645 }
646646
647− if (desc->info.op_tmpl.data.dir == SPI_MEM_DATA_IN) {
647+ if (desc->info.op_tmpl->data.dir == SPI_MEM_DATA_IN) {
648648 if (!fiu->spix_mode)
649− npcm_fiu_set_drd(fiu, &desc->info.op_tmpl);
649+ npcm_fiu_set_drd(fiu, desc->info.op_tmpl);
650650 else
651651 npcm_fiux_set_direct_rd(fiu);
652652
drivers/spi/spi-rockchip.c+2−4
@@ -98,7 +98,6 @@ · 97 unmodified lines
9898 #define CR0_FRF_MICROWIRE 0x2
9999
100100 #define CR0_XFM_OFFSET 18
101−#define CR0_XFM_MASK (0x03 << SPI_XFM_OFFSET)
102101 #define CR0_XFM_TR 0x0
103102 #define CR0_XFM_TO 0x1
104103 #define CR0_XFM_RO 0x2
@@ -109,8 +108,6 @@ · 4 unmodified lines
109108
110109 #define CR0_SOI_OFFSET 23
111110
112−#define CR0_MTM_OFFSET 0x21
113−
114111 /* Bit fields in SER, 2bit */
115112 #define SER_MASK 0x3
116113
@@ -357,7 +354,8 @@ static irqreturn_t rockchip_spi_isr(int irq, void *dev_id) · 240 unmodified lines
357354 struct rockchip_spi *rs = spi_controller_get_devdata(ctlr);
358355
359356 /* When int_cs_inactive comes, spi target abort */
360− if (rs->cs_inactive && readl_relaxed(rs->regs + ROCKCHIP_SPI_IMR) & INT_CS_INACTIVE) {
357+ if (rs->cs_inactive &&
358+ (readl_relaxed(rs->regs + ROCKCHIP_SPI_ISR) & INT_CS_INACTIVE)) {
361359 ctlr->target_abort(ctlr);
362360 writel_relaxed(0, rs->regs + ROCKCHIP_SPI_IMR);
363361 writel_relaxed(0xffffffff, rs->regs + ROCKCHIP_SPI_ICR);
drivers/spi/spi-rpc-if.c+4−4
@@ -83,7 +83,7 @@ static ssize_t xspi_spi_mem_dirmap_write(struct spi_mem_dirmap_desc *desc, · 82 unmodified lines
8383 if (offs + desc->info.offset + len > U32_MAX)
8484 return -EINVAL;
8585
86− rpcif_spi_mem_prepare(desc->mem->spi, &desc->info.op_tmpl, &offs, &len);
86+ rpcif_spi_mem_prepare(desc->mem->spi, desc->info.op_tmpl, &offs, &len);
8787
8888 return xspi_dirmap_write(rpc->dev, offs, len, buf);
8989 }
@@ -97,7 +97,7 @@ static ssize_t rpcif_spi_mem_dirmap_read(struct spi_mem_dirmap_desc *desc, · 7 unmodified lines
9797 if (offs + desc->info.offset + len > U32_MAX)
9898 return -EINVAL;
9999
100− rpcif_spi_mem_prepare(desc->mem->spi, &desc->info.op_tmpl, &offs, &len);
100+ rpcif_spi_mem_prepare(desc->mem->spi, desc->info.op_tmpl, &offs, &len);
101101
102102 return rpcif_dirmap_read(rpc->dev, offs, len, buf);
103103 }
@@ -110,13 +110,13 @@ static int rpcif_spi_mem_dirmap_create(struct spi_mem_dirmap_desc *desc) · 6 unmodified lines
110110 if (desc->info.offset + desc->info.length > U32_MAX)
111111 return -EINVAL;
112112
113− if (!rpcif_spi_mem_supports_op(desc->mem, &desc->info.op_tmpl))
113+ if (!rpcif_spi_mem_supports_op(desc->mem, desc->info.op_tmpl))
114114 return -EOPNOTSUPP;
115115
116116 if (!rpc->dirmap)
117117 return -EOPNOTSUPP;
118118
119− if (!rpc->xspi && desc->info.op_tmpl.data.dir != SPI_MEM_DATA_IN)
119+ if (!rpc->xspi && desc->info.op_tmpl->data.dir != SPI_MEM_DATA_IN)
120120 return -EOPNOTSUPP;
121121
122122 return 0;
drivers/spi/spi-rzv2h-rspi.c+1−1
@@ -579,7 +579,7 @@ static u32 rzv2h_rspi_setup_clock(struct rzv2h_rspi_priv *rspi, u32 hz) · 578 unmodified lines
579579 rspi->info->find_pclk_rate(rspi->pclk, hz, &best_clock);
580580
581581 if (!best_clock.clk_rate)
582− return -EINVAL;
582+ return 0;
583583
584584 ret = clk_set_rate(best_clock.clk, best_clock.clk_rate);
585585 if (ret)
drivers/spi/spi-stm32-ospi.c+3−3
@@ -602,11 +602,11 @@ static int stm32_ospi_dirmap_create(struct spi_mem_dirmap_desc *desc) · 601 unmodified lines
602602 {
603603 struct stm32_ospi *ospi = spi_controller_get_devdata(desc->mem->spi->controller);
604604
605− if (desc->info.op_tmpl.data.dir == SPI_MEM_DATA_OUT)
605+ if (desc->info.op_tmpl->data.dir == SPI_MEM_DATA_OUT)
606606 return -EOPNOTSUPP;
607607
608608 /* Should never happen, as mm_base == null is an error probe exit condition */
609− if (!ospi->mm_base && desc->info.op_tmpl.data.dir == SPI_MEM_DATA_IN)
609+ if (!ospi->mm_base && desc->info.op_tmpl->data.dir == SPI_MEM_DATA_IN)
610610 return -EOPNOTSUPP;
611611
612612 if (!ospi->mm_size)
@@ -633,7 +633,7 @@ static ssize_t stm32_ospi_dirmap_read(struct spi_mem_dirmap_desc *desc, · 20 unmodified lines
633633 * spi_mem_op template with offs, len and *buf in order to get
634634 * all needed transfer information into struct spi_mem_op
635635 */
636− memcpy(&op, &desc->info.op_tmpl, sizeof(struct spi_mem_op));
636+ memcpy(&op, desc->info.op_tmpl, sizeof(struct spi_mem_op));
637637 dev_dbg(ospi->dev, "%s len = 0x%zx offs = 0x%llx buf = 0x%p\n", __func__, len, offs, buf);
638638
639639 op.data.nbytes = len;
drivers/spi/spi-stm32-qspi.c+3−3
@@ -506,11 +506,11 @@ static int stm32_qspi_dirmap_create(struct spi_mem_dirmap_desc *desc) · 505 unmodified lines
506506 {
507507 struct stm32_qspi *qspi = spi_controller_get_devdata(desc->mem->spi->controller);
508508
509− if (desc->info.op_tmpl.data.dir == SPI_MEM_DATA_OUT)
509+ if (desc->info.op_tmpl->data.dir == SPI_MEM_DATA_OUT)
510510 return -EOPNOTSUPP;
511511
512512 /* should never happen, as mm_base == null is an error probe exit condition */
513− if (!qspi->mm_base && desc->info.op_tmpl.data.dir == SPI_MEM_DATA_IN)
513+ if (!qspi->mm_base && desc->info.op_tmpl->data.dir == SPI_MEM_DATA_IN)
514514 return -EOPNOTSUPP;
515515
516516 if (!qspi->mm_size)
@@ -536,7 +536,7 @@ static ssize_t stm32_qspi_dirmap_read(struct spi_mem_dirmap_desc *desc, · 19 unmodified lines
536536 * spi_mem_op template with offs, len and *buf in order to get
537537 * all needed transfer information into struct spi_mem_op
538538 */
539− memcpy(&op, &desc->info.op_tmpl, sizeof(struct spi_mem_op));
539+ memcpy(&op, desc->info.op_tmpl, sizeof(struct spi_mem_op));
540540 dev_dbg(qspi->dev, "%s len = 0x%zx offs = 0x%llx buf = 0x%p\n", __func__, len, offs, buf);
541541
542542 op.data.nbytes = len;
drivers/spi/spi-wpcm-fiu.c+1−1
@@ -377,7 +377,7 @@ static int wpcm_fiu_dirmap_create(struct spi_mem_dirmap_desc *desc) · 376 unmodified lines
377377 struct wpcm_fiu_spi *fiu = spi_controller_get_devdata(desc->mem->spi->controller);
378378 int cs = spi_get_chipselect(desc->mem->spi, 0);
379379
380− if (desc->info.op_tmpl.data.dir != SPI_MEM_DATA_IN)
380+ if (desc->info.op_tmpl->data.dir != SPI_MEM_DATA_IN)
381381 return -EOPNOTSUPP;
382382
383383 /*
drivers/xen/privcmd.c+7−0
@@ -1620,6 +1620,12 @@ static void privcmd_close(struct vm_area_struct *vma) · 1619 unmodified lines
16201620 kvfree(pages);
16211621 }
16221622
1623+static int privcmd_may_split(struct vm_area_struct *area, unsigned long addr)
1624+{
1625+ /* Forbid splitting, avoids double free via privcmd_close(). */
1626+ return -EINVAL;
1627+}
1628+
16231629 static vm_fault_t privcmd_fault(struct vm_fault *vmf)
16241630 {
16251631 printk(KERN_DEBUG "privcmd_fault: vma=%p %lx-%lx, pgoff=%lx, uv=%p\n",
@@ -1631,6 +1637,7 @@ static vm_fault_t privcmd_fault(struct vm_fault *vmf) · 5 unmodified lines
16311637
16321638 static const struct vm_operations_struct privcmd_vm_ops = {
16331639 .close = privcmd_close,
1640+ .may_split = privcmd_may_split,
16341641 .fault = privcmd_fault
16351642 };
16361643
drivers/xen/sys-hypervisor.c+6−2
@@ -366,6 +366,8 @@ static ssize_t buildid_show(struct hyp_sysfs_attr *attr, char *buffer) · 365 unmodified lines
366366 ret = sprintf(buffer, "<denied>");
367367 return ret;
368368 }
369+ if (ret > PAGE_SIZE)
370+ return -ENOSPC;
369371
370372 buildid = kmalloc(sizeof(*buildid) + ret, GFP_KERNEL);
371373 if (!buildid)
@@ -373,8 +375,10 @@ static ssize_t buildid_show(struct hyp_sysfs_attr *attr, char *buffer) · 1 unmodified line
373375
374376 buildid->len = ret;
375377 ret = HYPERVISOR_xen_version(XENVER_build_id, buildid);
376− if (ret > 0)
377− ret = sprintf(buffer, "%s", buildid->buf);
378+ if (ret > 0) {
379+ /* Build id is binary, not a string. */
380+ memcpy(buffer, buildid->buf, ret);
381+ }
378382 kfree(buildid);
379383
380384 return ret;
fs/btrfs/extent_io.c+12−2
@@ -4641,7 +4641,8 @@ int try_release_extent_buffer(struct folio *folio) · 4640 unmodified lines
46414641 * to read the block we will not block on anything.
46424642 */
46434643 void btrfs_readahead_tree_block(struct btrfs_fs_info *fs_info,
4644− u64 bytenr, u64 owner_root, u64 gen, int level)
4644+ u64 bytenr, u64 owner_root, u64 gen, int level,
4645+ const struct btrfs_key *first_key)
46454646 {
46464647 struct btrfs_tree_parent_check check = {
46474648 .level = level,
@@ -4650,6 +4651,11 @@ void btrfs_readahead_tree_block(struct btrfs_fs_info *fs_info, · 2 unmodified lines
46504651 struct extent_buffer *eb;
46514652 int ret;
46524653
4654+ if (first_key) {
4655+ memcpy(&check.first_key, first_key, sizeof(struct btrfs_key));
4656+ check.has_first_key = true;
4657+ }
4658+
46534659 eb = btrfs_find_create_tree_block(fs_info, bytenr, owner_root, level);
46544660 if (IS_ERR(eb))
46554661 return;
@@ -4677,9 +4683,13 @@ void btrfs_readahead_tree_block(struct btrfs_fs_info *fs_info, · 21 unmodified lines
46774683 */
46784684 void btrfs_readahead_node_child(struct extent_buffer *node, int slot)
46794685 {
4686+ struct btrfs_key node_key;
4687+
4688+ btrfs_node_key_to_cpu(node, &node_key, slot);
46804689 btrfs_readahead_tree_block(node->fs_info,
46814690 btrfs_node_blockptr(node, slot),
46824691 btrfs_header_owner(node),
46834692 btrfs_node_ptr_generation(node, slot),
4684− btrfs_header_level(node) - 1);
4693+ btrfs_header_level(node) - 1,
4694+ &node_key);
46854695 }
fs/btrfs/extent_io.h+2−1
@@ -287,7 +287,8 @@ static inline void wait_on_extent_buffer_writeback(struct extent_buffer *eb) · 286 unmodified lines
287287 }
288288
289289 void btrfs_readahead_tree_block(struct btrfs_fs_info *fs_info,
290− u64 bytenr, u64 owner_root, u64 gen, int level);
290+ u64 bytenr, u64 owner_root, u64 gen, int level,
291+ const struct btrfs_key *first_key);
291292 void btrfs_readahead_node_child(struct extent_buffer *node, int slot);
292293
293294 /* Note: this can be used in for loops without caching the value in a variable. */
fs/btrfs/free-space-tree.c+15−3
@@ -259,7 +259,11 @@ int btrfs_convert_free_space_to_bitmaps(struct btrfs_trans_handle *trans, · 258 unmodified lines
259259 nr++;
260260 path->slots[0]--;
261261 } else {
262− ASSERT(0);
262+ btrfs_err(fs_info, "unexpected free space tree key type %u",
263+ found_key.type);
264+ ret = -EUCLEAN;
265+ btrfs_abort_transaction(trans, ret);
266+ goto out;
263267 }
264268 }
265269
@@ -405,7 +409,11 @@ int btrfs_convert_free_space_to_extents(struct btrfs_trans_handle *trans, · 139 unmodified lines
405409
406410 nr++;
407411 } else {
408− ASSERT(0);
412+ btrfs_err(fs_info, "unexpected free space tree key type %u",
413+ found_key.type);
414+ ret = -EUCLEAN;
415+ btrfs_abort_transaction(trans, ret);
416+ goto out;
409417 }
410418 }
411419
@@ -1518,7 +1526,11 @@ int btrfs_remove_block_group_free_space(struct btrfs_trans_handle *trans, · 1106 unmodified lines
15181526 nr++;
15191527 path->slots[0]--;
15201528 } else {
1521− ASSERT(0);
1529+ btrfs_err(trans->fs_info, "unexpected free space tree key type %u",
1530+ found_key.type);
1531+ ret = -EUCLEAN;
1532+ btrfs_abort_transaction(trans, ret);
1533+ return ret;
15221534 }
15231535 }
15241536
fs/btrfs/inode.c+3−1
@@ -1153,7 +1153,7 @@ out_free_reserve: · 1152 unmodified lines
11531153 NULL, &cached,
11541154 EXTENT_LOCKED | EXTENT_DELALLOC |
11551155 EXTENT_DELALLOC_NEW |
1156− EXTENT_DEFRAG | EXTENT_DO_ACCOUNTING,
1156+ EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV,
11571157 PAGE_UNLOCK | PAGE_START_WRITEBACK |
11581158 PAGE_END_WRITEBACK);
11591159 if (async_extent->cb)
@@ -4959,6 +4959,8 @@ static int btrfs_rmdir(struct inode *vfs_dir, struct dentry *dentry) · 3799 unmodified lines
49594959 if (ret)
49604960 goto out;
49614961
4962+ btrfs_record_unlink_dir(trans, dir, inode, false);
4963+
49624964 /* now the directory is empty */
49634965 ret = btrfs_unlink_inode(trans, dir, inode, &fname.disk_name);
49644966 if (!ret)
fs/btrfs/ioctl.c+3−4
@@ -5102,7 +5102,6 @@ static int btrfs_ioctl_subvol_sync(struct btrfs_fs_info *fs_info, void __user *a · 5101 unmodified lines
51025102 return 0;
51035103 }
51045104
5105−#ifdef CONFIG_BTRFS_EXPERIMENTAL
51065105 static int btrfs_ioctl_shutdown(struct btrfs_fs_info *fs_info, unsigned long arg)
51075106 {
51085107 int ret = 0;
@@ -5134,10 +5133,12 @@ static int btrfs_ioctl_shutdown(struct btrfs_fs_info *fs_info, unsigned long arg · 25 unmodified lines
51345133 case BTRFS_SHUTDOWN_FLAGS_NOLOGFLUSH:
51355134 btrfs_force_shutdown(fs_info);
51365135 break;
5136+ default:
5137+ ret = -EINVAL;
5138+ break;
51375139 }
51385140 return ret;
51395141 }
5140−#endif
51415142
51425143 long btrfs_ioctl(struct file *file, unsigned int
51435144 cmd, unsigned long arg)
@@ -5294,10 +5295,8 @@ long btrfs_ioctl(struct file *file, unsigned int · 150 unmodified lines
52945295 #endif
52955296 case BTRFS_IOC_SUBVOL_SYNC_WAIT:
52965297 return btrfs_ioctl_subvol_sync(fs_info, argp);
5297−#ifdef CONFIG_BTRFS_EXPERIMENTAL
52985298 case BTRFS_IOC_SHUTDOWN:
52995299 return btrfs_ioctl_shutdown(fs_info, arg);
5300−#endif
53015300 }
53025301
53035302 return -ENOTTY;
fs/btrfs/raid-stripe-tree.c+45−12
@@ -45,8 +45,11 @@ static int btrfs_partially_delete_raid_extent(struct btrfs_trans_handle *trans, · 44 unmodified lines
4545
4646 for (int i = 0; i < btrfs_num_raid_stripes(item_size); i++) {
4747 struct btrfs_raid_stride *stride = &extent->strides[i];
48+ u64 devid;
4849 u64 phys;
4950
51+ devid = btrfs_raid_stride_devid(leaf, stride);
52+ btrfs_set_stack_raid_stride_devid(&newitem->strides[i], devid);
5053 phys = btrfs_raid_stride_physical(leaf, stride) + frontpad;
5154 btrfs_set_stack_raid_stride_physical(&newitem->strides[i], phys);
5255 }
@@ -95,14 +98,26 @@ int btrfs_delete_raid_extent(struct btrfs_trans_handle *trans, u64 start, u64 le · 42 unmodified lines
9598 while (1) {
9699 key.objectid = start;
97100 key.type = BTRFS_RAID_STRIPE_KEY;
98− key.offset = 0;
101+ key.offset = (u64)-1;
99102
100103 ret = btrfs_search_slot(trans, stripe_root, &key, path, -1, 1);
101104 if (ret < 0)
102105 break;
103106
104− if (path->slots[0] == btrfs_header_nritems(path->nodes[0]))
105− path->slots[0]--;
107+ /*
108+ * Search with offset=(u64)-1 ensures we land on the correct
109+ * leaf even when the target entry is the first item on a leaf.
110+ * Since no real entry has offset=(u64)-1, ret is always 1 and
111+ * slot points past the last entry with objectid==start (or
112+ * past the end of the leaf if that entry is the last item).
113+ * Back up one slot to find the actual entry.
114+ */
115+ if (path->slots[0] == 0) {
116+ /* No entry with objectid <= start exists. */
117+ ret = 0;
118+ break;
119+ }
120+ path->slots[0]--;
106121
107122 leaf = path->nodes[0];
108123 slot = path->slots[0];
@@ -123,7 +138,7 @@ int btrfs_delete_raid_extent(struct btrfs_trans_handle *trans, u64 start, u64 le · 14 unmodified lines
123138 */
124139 if (found_start > start) {
125140 if (slot == 0) {
126− ret = btrfs_previous_item(stripe_root, path, start,
141+ ret = btrfs_previous_item(stripe_root, path, 0,
127142 BTRFS_RAID_STRIPE_KEY);
128143 if (ret) {
129144 if (ret > 0)
@@ -139,7 +154,10 @@ int btrfs_delete_raid_extent(struct btrfs_trans_handle *trans, u64 start, u64 le · 9 unmodified lines
139154 btrfs_item_key_to_cpu(leaf, &key, slot);
140155 found_start = key.objectid;
141156 found_end = found_start + key.offset;
142− ASSERT(found_start <= start);
157+ if (found_start > start || found_end <= start) {
158+ ret = -ENOENT;
159+ break;
160+ }
143161 }
144162
145163 if (key.type != BTRFS_RAID_STRIPE_KEY)
@@ -176,9 +194,19 @@ int btrfs_delete_raid_extent(struct btrfs_trans_handle *trans, u64 start, u64 le · 30 unmodified lines
176194
177195 /* The "right" item. */
178196 ret = btrfs_duplicate_item(trans, stripe_root, path, &newkey);
197+ if (ret == -EAGAIN) {
198+ btrfs_release_path(path);
199+ continue;
200+ }
179201 if (ret)
180202 break;
181203
204+ /*
205+ * btrfs_duplicate_item() may have triggered a leaf
206+ * split via setup_leaf_for_split(), so we must refresh
207+ * our leaf pointer from the path.
208+ */
209+ leaf = path->nodes[0];
182210 item_size = btrfs_item_size(leaf, path->slots[0]);
183211 extent = btrfs_item_ptr(leaf, path->slots[0],
184212 struct btrfs_stripe_extent);
@@ -195,8 +223,9 @@ int btrfs_delete_raid_extent(struct btrfs_trans_handle *trans, u64 start, u64 le · 10 unmodified lines
195223 /* The "left" item. */
196224 path->slots[0]--;
197225 btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
198− btrfs_partially_delete_raid_extent(trans, path, &key,
199− diff_start, 0);
226+ ret = btrfs_partially_delete_raid_extent(trans, path,
227+ &key,
228+ diff_start, 0);
200229 break;
201230 }
202231
@@ -212,8 +241,11 @@ int btrfs_delete_raid_extent(struct btrfs_trans_handle *trans, u64 start, u64 le · 9 unmodified lines
212241 if (found_start < start) {
213242 u64 diff_start = start - found_start;
214243
215− btrfs_partially_delete_raid_extent(trans, path, &key,
216− diff_start, 0);
244+ ret = btrfs_partially_delete_raid_extent(trans, path,
245+ &key,
246+ diff_start, 0);
247+ if (ret)
248+ break;
217249
218250 start += (key.offset - diff_start);
219251 length -= (key.offset - diff_start);
@@ -236,9 +268,10 @@ int btrfs_delete_raid_extent(struct btrfs_trans_handle *trans, u64 start, u64 le · 16 unmodified lines
236268 if (found_end > end) {
237269 u64 diff_end = found_end - end;
238270
239− btrfs_partially_delete_raid_extent(trans, path, &key,
240− key.offset - length,
241− length);
271+ ret = btrfs_partially_delete_raid_extent(trans, path,
272+ &key,
273+ key.offset - length,
274+ length);
242275 ASSERT(key.offset - diff_end == length);
243276 break;
244277 }
fs/btrfs/relocation.c+24−6
@@ -2607,7 +2607,7 @@ int relocate_tree_blocks(struct btrfs_trans_handle *trans, · 2606 unmodified lines
26072607 if (!block->key_ready)
26082608 btrfs_readahead_tree_block(fs_info, block->bytenr,
26092609 block->owner, 0,
2610− block->level);
2610+ block->level, NULL);
26112611 }
26122612
26132613 /* Get first keys */
@@ -3876,7 +3876,7 @@ static int add_remap_tree_entries(struct btrfs_trans_handle *trans, struct btrfs · 1262 unmodified lines
38763876 ret = btrfs_insert_empty_items(trans, fs_info->remap_root, path, &batch);
38773877 btrfs_release_path(path);
38783878
3879− if (num_entries <= max_items)
3879+ if (ret || num_entries <= max_items)
38803880 break;
38813881
38823882 num_entries -= max_items;
@@ -4174,6 +4174,12 @@ static int move_existing_remap(struct btrfs_fs_info *fs_info, · 291 unmodified lines
41744174 return ret;
41754175 }
41764176
4177+ if (ins.offset < length) {
4178+ spin_lock(&sinfo->lock);
4179+ btrfs_space_info_update_bytes_may_use(sinfo, ins.offset - length);
4180+ spin_unlock(&sinfo->lock);
4181+ }
4182+
41774183 dest_addr = ins.objectid;
41784184 dest_length = ins.offset;
41794185
@@ -5000,6 +5006,12 @@ static int do_remap_reloc_trans(struct btrfs_fs_info *fs_info, · 820 unmodified lines
50005006 return ret;
50015007 }
50025008
5009+ if (ins.offset < remap_length) {
5010+ spin_lock(&sinfo->lock);
5011+ btrfs_space_info_update_bytes_may_use(sinfo, ins.offset - remap_length);
5012+ spin_unlock(&sinfo->lock);
5013+ }
5014+
50035015 made_reservation = true;
50045016
50055017 new_addr = ins.objectid;
@@ -5023,21 +5035,27 @@ static int do_remap_reloc_trans(struct btrfs_fs_info *fs_info, · 17 unmodified lines
50235035
50245036 if (bg_needs_free_space) {
50255037 ret = btrfs_add_block_group_free_space(trans, dest_bg);
5026− if (ret)
5038+ if (ret) {
5039+ btrfs_abort_transaction(trans, ret);
50275040 goto fail;
5041+ }
50285042 }
50295043
50305044 ret = copy_remapped_data(fs_info, start, new_addr, length);
5031− if (ret)
5045+ if (ret) {
5046+ btrfs_abort_transaction(trans, ret);
50325047 goto fail;
5048+ }
50335049
50345050 ret = btrfs_remove_from_free_space_tree(trans, new_addr, length);
5035− if (ret)
5051+ if (ret) {
5052+ btrfs_abort_transaction(trans, ret);
50365053 goto fail;
5054+ }
50375055
50385056 ret = add_remap_entry(trans, path, src_bg, start, new_addr, length);
50395057 if (ret) {
5040− btrfs_add_to_free_space_tree(trans, new_addr, length);
5058+ btrfs_abort_transaction(trans, ret);
50415059 goto fail;
50425060 }
50435061
fs/isofs/export.c+1−1
@@ -24,7 +24,7 @@ isofs_export_iget(struct super_block *sb, · 23 unmodified lines
2424 {
2525 struct inode *inode;
2626
27− if (block == 0)
27+ if (block == 0 || block >= ISOFS_SB(sb)->s_nzones)
2828 return ERR_PTR(-ESTALE);
2929 inode = isofs_iget(sb, block, offset);
3030 if (IS_ERR(inode))
fs/isofs/namei.c+2−9
@@ -10,20 +10,13 @@ · 9 unmodified lines
1010 #include <linux/gfp.h>
1111 #include "isofs.h"
1212
13−/*
14− * ok, we cannot use strncmp, as the name is not in our data space.
15− * Thus we'll have to use isofs_match. No big problem. Match also makes
16− * some sanity tests.
17− */
1813 static int
1914 isofs_cmp(struct dentry *dentry, const char *compare, int dlen)
2015 {
21− struct qstr qstr;
22− qstr.name = compare;
23− qstr.len = dlen;
2416 if (likely(!dentry->d_op))
2517 return dentry->d_name.len != dlen || memcmp(dentry->d_name.name, compare, dlen);
26− return dentry->d_op->d_compare(NULL, dentry->d_name.len, dentry->d_name.name, &qstr);
18+ return dentry->d_op->d_compare(NULL, dentry->d_name.len, dentry->d_name.name,
19+ &QSTR_LEN(compare, dlen));
2720 }
2821
2922 /*
fs/isofs/rock.c+9−0
@@ -101,6 +101,15 @@ static int rock_continue(struct rock_state *rs) · 100 unmodified lines
101101 goto out;
102102 }
103103
104+ if ((unsigned)rs->cont_extent >= ISOFS_SB(rs->inode->i_sb)->s_nzones) {
105+ printk(KERN_NOTICE "rock: corrupted directory entry. "
106+ "extent=%u out of volume (nzones=%lu)\n",
107+ (unsigned)rs->cont_extent,
108+ ISOFS_SB(rs->inode->i_sb)->s_nzones);
109+ ret = -EIO;
110+ goto out;
111+ }
112+
104113 if (rs->cont_extent) {
105114 struct buffer_head *bh;
106115
fs/notify/fanotify/fanotify.c+1−1
@@ -457,7 +457,7 @@ static int fanotify_encode_fh(struct fanotify_fh *fh, struct inode *inode, · 456 unmodified lines
457457 /*
458458 * Unlike file_handle, type and len of struct fanotify_fh are u8.
459459 * Traditionally, filesystem return handle_type < 0xff, but there
460− * is no enforecement for that in vfs.
460+ * is no enforcement for that in vfs.
461461 */
462462 BUILD_BUG_ON(MAX_HANDLE_SZ > 0xff || FILEID_INVALID > 0xff);
463463 if (type <= 0 || type >= FILEID_INVALID || fh_len != dwords << 2)
fs/notify/fsnotify.c+1−1
@@ -388,7 +388,7 @@ static struct fsnotify_mark *fsnotify_first_mark(struct fsnotify_mark_connector · 387 unmodified lines
388388 return hlist_entry_safe(node, struct fsnotify_mark, obj_list);
389389 }
390390
391−static struct fsnotify_mark *fsnotify_next_mark(struct fsnotify_mark *mark)
391+struct fsnotify_mark *fsnotify_next_mark(struct fsnotify_mark *mark)
392392 {
393393 struct hlist_node *node = NULL;
394394
fs/notify/mark.c+47−10
@@ -238,7 +238,12 @@ static struct inode *fsnotify_update_iref(struct fsnotify_mark_connector *conn, · 237 unmodified lines
238238 return inode;
239239 }
240240
241−static void *__fsnotify_recalc_mask(struct fsnotify_mark_connector *conn)
241+/*
242+ * Calculate mask of events for a list of marks.
243+ *
244+ * Return true if any of the attached marks want to hold an inode reference.
245+ */
246+static bool __fsnotify_recalc_mask(struct fsnotify_mark_connector *conn)
242247 {
243248 u32 new_mask = 0;
244249 bool want_iref = false;
@@ -262,6 +267,34 @@ static void *__fsnotify_recalc_mask(struct fsnotify_mark_connector *conn) · 17 unmodified lines
262267 */
263268 WRITE_ONCE(*fsnotify_conn_mask_p(conn), new_mask);
264269
270+ return want_iref;
271+}
272+
273+/*
274+ * Calculate mask of events for a list of marks after attach/modify mark
275+ * and get an inode reference for the connector if needed.
276+ *
277+ * A concurrent add of evictable mark and detach of non-evictable mark can
278+ * lead to __fsnotify_recalc_mask() returning false want_iref, but in this
279+ * case we defer clearing iref to fsnotify_recalc_mask_clear_iref() called
280+ * from fsnotify_put_mark().
281+ */
282+static void fsnotify_recalc_mask_set_iref(struct fsnotify_mark_connector *conn)
283+{
284+ bool has_iref = conn->flags & FSNOTIFY_CONN_FLAG_HAS_IREF;
285+ bool want_iref = __fsnotify_recalc_mask(conn) || has_iref;
286+
287+ (void) fsnotify_update_iref(conn, want_iref);
288+}
289+
290+/*
291+ * Calculate mask of events for a list of marks after detach mark
292+ * and return the inode object if its reference is no longer needed.
293+ */
294+static void *fsnotify_recalc_mask_clear_iref(struct fsnotify_mark_connector *conn)
295+{
296+ bool want_iref = __fsnotify_recalc_mask(conn);
297+
265298 return fsnotify_update_iref(conn, want_iref);
266299 }
267300
@@ -298,7 +331,7 @@ void fsnotify_recalc_mask(struct fsnotify_mark_connector *conn) · 30 unmodified lines
298331
299332 spin_lock(&conn->lock);
300333 update_children = !fsnotify_conn_watches_children(conn);
301− __fsnotify_recalc_mask(conn);
334+ fsnotify_recalc_mask_set_iref(conn);
302335 update_children &= fsnotify_conn_watches_children(conn);
303336 spin_unlock(&conn->lock);
304337 /*
@@ -419,7 +452,7 @@ void fsnotify_put_mark(struct fsnotify_mark *mark) · 114 unmodified lines
419452 /* Update watched objects after detaching mark */
420453 if (sb)
421454 fsnotify_update_sb_watchers(sb, conn);
422− objp = __fsnotify_recalc_mask(conn);
455+ objp = fsnotify_recalc_mask_clear_iref(conn);
423456 type = conn->type;
424457 }
425458 WRITE_ONCE(mark->connector, NULL);
@@ -457,9 +490,6 @@ EXPORT_SYMBOL_GPL(fsnotify_put_mark); · 31 unmodified lines
457490 */
458491 static bool fsnotify_get_mark_safe(struct fsnotify_mark *mark)
459492 {
460− if (!mark)
461− return true;
462−
463493 if (refcount_inc_not_zero(&mark->refcnt)) {
464494 spin_lock(&mark->lock);
465495 if (mark->flags & FSNOTIFY_MARK_FLAG_ATTACHED) {
@@ -500,15 +530,22 @@ bool fsnotify_prepare_user_wait(struct fsnotify_iter_info *iter_info) · 34 unmodified lines
500530 int type;
501531
502532 fsnotify_foreach_iter_type(type) {
533+ struct fsnotify_mark *mark = iter_info->marks[type];
534+
503535 /* This can fail if mark is being removed */
504− if (!fsnotify_get_mark_safe(iter_info->marks[type])) {
505− __release(&fsnotify_mark_srcu);
506− goto fail;
536+ while (mark && !fsnotify_get_mark_safe(mark)) {
537+ if (mark->group == iter_info->current_group) {
538+ __release(&fsnotify_mark_srcu);
539+ goto fail;
540+ }
541+ /* This is a mark in an unrelated group, skip */
542+ mark = fsnotify_next_mark(mark);
543+ iter_info->marks[type] = mark;
507544 }
508545 }
509546
510547 /*
511− * Now that both marks are pinned by refcount in the inode / vfsmount
548+ * Now that all marks are pinned by refcount in the inode / vfsmount / etc
512549 * lists, we can drop SRCU lock, and safely resume the list iteration
513550 * once userspace returns.
514551 */
fs/ntfs/bitmap.c+11−8
@@ -125,7 +125,7 @@ int __ntfs_bitmap_set_bits_in_run(struct inode *vi, const s64 start_bit, · 124 unmodified lines
125125 struct address_space *mapping;
126126 struct folio *folio;
127127 u8 *kaddr;
128− int pos, len;
128+ int pos, len, err;
129129 u8 bit;
130130 struct ntfs_inode *ni = NTFS_I(vi);
131131 struct ntfs_volume *vol = ni->vol;
@@ -201,8 +201,10 @@ int __ntfs_bitmap_set_bits_in_run(struct inode *vi, const s64 start_bit, · 69 unmodified lines
201201
202202 /* If we are not in the last page, deal with all subsequent pages. */
203203 while (index < end_index) {
204− if (cnt <= 0)
204+ if (cnt <= 0) {
205+ err = -EIO;
205206 goto rollback;
207+ }
206208
207209 /* Update @index and get the next folio. */
208210 folio_mark_dirty(folio);
@@ -214,6 +216,7 @@ int __ntfs_bitmap_set_bits_in_run(struct inode *vi, const s64 start_bit, · 5 unmodified lines
214216 ntfs_error(vi->i_sb,
215217 "Failed to map subsequent page (error %li), aborting.",
216218 PTR_ERR(folio));
219+ err = PTR_ERR(folio);
217220 goto rollback;
218221 }
219222
@@ -265,7 +268,7 @@ rollback: · 45 unmodified lines
265268 * - @count - @cnt is the number of bits that have been modified
266269 */
267270 if (is_rollback)
268− return PTR_ERR(folio);
271+ return err;
269272 if (count != cnt)
270273 pos = __ntfs_bitmap_set_bits_in_run(vi, start_bit, count - cnt,
271274 value ? 0 : 1, true);
@@ -274,14 +277,14 @@ rollback: · 2 unmodified lines
274277 if (!pos) {
275278 /* Rollback was successful. */
276279 ntfs_error(vi->i_sb,
277− "Failed to map subsequent page (error %li), aborting.",
278− PTR_ERR(folio));
280+ "Failed to map subsequent page (error %i), aborting.",
281+ err);
279282 } else {
280283 /* Rollback failed. */
281284 ntfs_error(vi->i_sb,
282− "Failed to map subsequent page (error %li) and rollback failed (error %i). Aborting and leaving inconsistent metadata. Unmount and run chkdsk.",
283− PTR_ERR(folio), pos);
285+ "Failed to map subsequent page (error %i) and rollback failed (error %i). Aborting and leaving inconsistent metadata. Unmount and run chkdsk.",
286+ err, pos);
284287 NVolSetErrors(NTFS_SB(vi->i_sb));
285288 }
286− return PTR_ERR(folio);
289+ return err;
287290 }
fs/ntfs/dir.c+10−3
@@ -911,8 +911,8 @@ static int ntfs_readdir(struct file *file, struct dir_context *actor) · 910 unmodified lines
911911
912912 if (next->flags & INDEX_ENTRY_NODE) {
913913 next = ntfs_index_walk_down(next, ictx);
914− if (!next) {
915− err = -EIO;
914+ if (IS_ERR(next)) {
915+ err = PTR_ERR(next);
916916 goto out;
917917 }
918918 }
@@ -920,7 +920,14 @@ static int ntfs_readdir(struct file *file, struct dir_context *actor) · 1 unmodified line
920920 if (next && !(next->flags & INDEX_ENTRY_END))
921921 goto nextdir;
922922
923− while ((next = ntfs_index_next(next, ictx)) != NULL) {
923+ while (1) {
924+ next = ntfs_index_next(next, ictx);
925+ if (IS_ERR(next)) {
926+ err = PTR_ERR(next);
927+ goto out;
928+ }
929+ if (!next)
930+ break;
924931 nextdir:
925932 /* Check the consistency of an index entry */
926933 if (ntfs_index_entry_inconsistent(ictx, vol, next, COLLATION_FILE_NAME,
fs/ntfs/index.c+13−4
@@ -1969,15 +1969,19 @@ err_out: · 1968 unmodified lines
19691969 struct index_entry *ntfs_index_walk_down(struct index_entry *ie, struct ntfs_index_context *ictx)
19701970 {
19711971 struct index_entry *entry;
1972+ struct index_block *ib;
19721973 s64 vcn;
19731974
19741975 entry = ie;
19751976 do {
19761977 vcn = ntfs_ie_get_vcn(entry);
19771978 if (ictx->is_in_root) {
1979+ ib = kvzalloc(ictx->block_size, GFP_NOFS);
1980+ if (!ib)
1981+ return ERR_PTR(-ENOMEM);
19781982 /* down from level zero */
19791983 ictx->ir = NULL;
1980− ictx->ib = kvzalloc(ictx->block_size, GFP_NOFS);
1984+ ictx->ib = ib;
19811985 ictx->pindex = 1;
19821986 ictx->is_in_root = false;
19831987 } else {
@@ -1991,8 +1995,8 @@ struct index_entry *ntfs_index_walk_down(struct index_entry *ie, struct ntfs_ind · 7 unmodified lines
19911995 ictx->entry = ntfs_ie_get_first(&ictx->ib->index);
19921996 entry = ictx->entry;
19931997 } else
1994− entry = NULL;
1995− } while (entry && (entry->flags & INDEX_ENTRY_NODE));
1998+ entry = ERR_PTR(-EIO);
1999+ } while (!IS_ERR(entry) && (entry->flags & INDEX_ENTRY_NODE));
19962000
19972001 return entry;
19982002 }
@@ -2097,10 +2101,15 @@ struct index_entry *ntfs_index_next(struct index_entry *ie, struct ntfs_index_co · 98 unmodified lines
20972101
20982102 /* walk down if it has a subnode */
20992103 if (flags & INDEX_ENTRY_NODE) {
2100− if (!ictx->ia_ni)
2104+ if (!ictx->ia_ni) {
21012105 ictx->ia_ni = ntfs_ia_open(ictx, ictx->idx_ni);
2106+ if (!ictx->ia_ni)
2107+ return ERR_PTR(-EIO);
2108+ }
21022109
21032110 next = ntfs_index_walk_down(next, ictx);
2111+ if (IS_ERR(next))
2112+ return next;
21042113 } else {
21052114
21062115 /* walk up it has no subnode, nor data */
fs/ntfs/iomap.c+3−3
@@ -788,8 +788,7 @@ static int ntfs_write_iomap_end_resident(struct inode *inode, loff_t pos, · 787 unmodified lines
788788 ctx = ntfs_attr_get_search_ctx(ni, NULL);
789789 if (!ctx) {
790790 written = -ENOMEM;
791− mutex_unlock(&ni->mrec_lock);
792− return written;
791+ goto err_out;
793792 }
794793
795794 err = ntfs_attr_lookup(ni->type, ni->name, ni->name_len,
@@ -810,7 +809,8 @@ static int ntfs_write_iomap_end_resident(struct inode *inode, loff_t pos, · 14 unmodified lines
810809 memcpy(kattr + pos, iomap_inline_data(iomap, pos), written);
811810 mark_mft_record_dirty(ctx->ntfs_ino);
812811 err_out:
813− ntfs_attr_put_search_ctx(ctx);
812+ if (ctx)
813+ ntfs_attr_put_search_ctx(ctx);
814814 put_page(ipage);
815815 mutex_unlock(&ni->mrec_lock);
816816 return written;
fs/ntfs/namei.c+11−2
@@ -945,7 +945,8 @@ search: · 944 unmodified lines
945945
946946 ni_mrec = actx->base_mrec ? actx->base_mrec : actx->mrec;
947947 ni_mrec->link_count = cpu_to_le16(le16_to_cpu(ni_mrec->link_count) - 1);
948− drop_nlink(VFS_I(ni));
948+ if (!S_ISDIR(VFS_I(ni)->i_mode))
949+ drop_nlink(VFS_I(ni));
949950
950951 mark_mft_record_dirty(ni);
951952 if (looking_for_dos_name) {
@@ -955,6 +956,13 @@ search: · 3 unmodified lines
955956 goto search;
956957 }
957958
959+ /*
960+ * For directories, Drop VFS nlink only when mft record link count
961+ * becomes zero. Because we fixes VFS nlink to 1 for directories.
962+ */
963+ if (S_ISDIR(VFS_I(ni)->i_mode) && !le16_to_cpu(ni_mrec->link_count))
964+ drop_nlink(VFS_I(ni));
965+
958966 /*
959967 * If hard link count is not equal to zero then we are done. In other
960968 * case there are no reference to this inode left, so we should free all
@@ -1221,7 +1229,8 @@ static int __ntfs_link(struct ntfs_inode *ni, struct ntfs_inode *dir_ni, · 260 unmodified lines
12211229 }
12221230 /* Increment hard links count. */
12231231 ni_mrec->link_count = cpu_to_le16(le16_to_cpu(ni_mrec->link_count) + 1);
1224− inc_nlink(VFS_I(ni));
1232+ if (!S_ISDIR(vi->i_mode))
1233+ inc_nlink(VFS_I(ni));
12251234
12261235 /* Done! */
12271236 mark_mft_record_dirty(ni);
fs/ntfs/reparse.c+3−2
@@ -505,7 +505,6 @@ int ntfs_reparse_set_wsl_symlink(struct ntfs_inode *ni, · 504 unmodified lines
505505 struct reparse_point *reparse;
506506 struct wsl_link_reparse_data *data;
507507
508− utarget = (char *)NULL;
509508 len = ntfs_ucstonls(ni->vol, target, target_len, &utarget, 0);
510509 if (len <= 0)
511510 return -EINVAL;
@@ -514,7 +513,7 @@ int ntfs_reparse_set_wsl_symlink(struct ntfs_inode *ni, · 2 unmodified lines
514513 reparse = kvzalloc(reparse_len, GFP_NOFS);
515514 if (!reparse) {
516515 err = -ENOMEM;
517− kvfree(utarget);
516+ kfree(utarget);
518517 } else {
519518 data = (struct wsl_link_reparse_data *)reparse->reparse_data;
520519 reparse->reparse_tag = IO_REPARSE_TAG_LX_SYMLINK;
@@ -528,6 +527,8 @@ int ntfs_reparse_set_wsl_symlink(struct ntfs_inode *ni, · 7 unmodified lines
528527 kvfree(reparse);
529528 if (!err)
530529 ni->target = utarget;
530+ else
531+ kfree(utarget);
531532 }
532533 return err;
533534 }
fs/ntfs/runlist.c+21−3
@@ -15,6 +15,8 @@ · 14 unmodified lines
1515 * Copyright (c) 2007-2022 Jean-Pierre Andre
1616 */
1717
18+#include <linux/overflow.h>
19+
1820 #include "ntfs.h"
1921 #include "attrib.h"
2022
@@ -739,6 +741,7 @@ struct runlist_element *ntfs_mapping_pairs_decompress(const struct ntfs_volume * · 718 unmodified lines
739741 int rlsize; /* Size of runlist buffer. */
740742 u16 rlpos; /* Current runlist position in units of struct runlist_elements. */
741743 u8 b; /* Current byte offset in buf. */
744+ u64 lowest_vcn; /* Raw on-disk lowest_vcn. */
742745
743746 #ifdef DEBUG
744747 /* Make sure attr exists and is non-resident. */
@@ -747,8 +750,14 @@ struct runlist_element *ntfs_mapping_pairs_decompress(const struct ntfs_volume * · 2 unmodified lines
747750 return ERR_PTR(-EINVAL);
748751 }
749752 #endif
753+ lowest_vcn = le64_to_cpu(attr->data.non_resident.lowest_vcn);
754+ /* Validate lowest_vcn from on-disk metadata to ensure it is sane. */
755+ if (overflows_type(lowest_vcn, vcn)) {
756+ ntfs_error(vol->sb, "Invalid lowest_vcn in mapping pairs.");
757+ return ERR_PTR(-EIO);
758+ }
750759 /* Start at vcn = lowest_vcn and lcn 0. */
751− vcn = le64_to_cpu(attr->data.non_resident.lowest_vcn);
760+ vcn = lowest_vcn;
752761 lcn = 0;
753762 /* Get start of the mapping pairs array. */
754763 buf = (u8 *)attr +
@@ -823,8 +832,17 @@ struct runlist_element *ntfs_mapping_pairs_decompress(const struct ntfs_volume * · 68 unmodified lines
823832 * element.
824833 */
825834 rl[rlpos].length = deltaxcn;
826− /* Increment the current vcn by the current run length. */
827− vcn += deltaxcn;
835+ /*
836+ * Increment the current vcn by the current run length.
837+ * Guard against s64 overflow from a crafted mapping
838+ * pairs array to preserve the monotonically-increasing
839+ * vcn invariant.
840+ */
841+ if (unlikely(check_add_overflow(vcn, deltaxcn, &vcn))) {
842+ ntfs_error(vol->sb, "VCN overflow in mapping pairs array.");
843+ goto err_out;
844+ }
845+
828846 /*
829847 * There might be no lcn change at all, as is the case for
830848 * sparse clusters on NTFS 3.0+, in which case we set the lcn
fs/smb/client/cifsproto.h+0−1
@@ -89,7 +89,6 @@ int cifs_handle_standard(struct TCP_Server_Info *server, · 88 unmodified lines
8989 struct mid_q_entry *mid);
9090 char *smb3_fs_context_fullpath(const struct smb3_fs_context *ctx, char dirsep);
9191 int smb3_parse_devname(const char *devname, struct smb3_fs_context *ctx);
92−int smb3_parse_opt(const char *options, const char *key, char **val);
9392 int cifs_ipaddr_cmp(struct sockaddr *srcaddr, struct sockaddr *rhs);
9493 bool cifs_match_ipaddr(struct sockaddr *srcaddr, struct sockaddr *rhs);
9594 int cifs_discard_remaining_data(struct TCP_Server_Info *server);
fs/smb/client/fs_context.c+0−31
@@ -536,37 +536,6 @@ cifs_parse_smb_version(struct fs_context *fc, char *value, struct smb3_fs_contex · 535 unmodified lines
536536 return 0;
537537 }
538538
539−int smb3_parse_opt(const char *options, const char *key, char **val)
540−{
541− int rc = -ENOENT;
542− char *opts, *orig, *p;
543−
544− orig = opts = kstrdup(options, GFP_KERNEL);
545− if (!opts)
546− return -ENOMEM;
547−
548− while ((p = strsep(&opts, ","))) {
549− char *nval;
550−
551− if (!*p)
552− continue;
553− if (strncasecmp(p, key, strlen(key)))
554− continue;
555− nval = strchr(p, '=');
556− if (nval) {
557− if (nval == p)
558− continue;
559− *nval++ = 0;
560− *val = kstrdup(nval, GFP_KERNEL);
561− rc = !*val ? -ENOMEM : 0;
562− goto out;
563− }
564− }
565−out:
566− kfree(orig);
567− return rc;
568−}
569−
570539 /*
571540 * Remove duplicate path delimiters. Windows is supposed to do that
572541 * but there are some bugs that prevent rename from working if there are
fs/smb/client/smb2inode.c+1−1
@@ -230,7 +230,7 @@ replay_again: · 229 unmodified lines
230230 num_rqst = 0;
231231 server = cifs_pick_channel(ses);
232232
233− vars = kzalloc_obj(*vars, GFP_ATOMIC);
233+ vars = kzalloc_obj(*vars, GFP_KERNEL);
234234 if (vars == NULL) {
235235 rc = -ENOMEM;
236236 goto out;
fs/smb/client/smb2ops.c+11−0
@@ -111,10 +111,21 @@ smb2_add_credits(struct TCP_Server_Info *server, · 110 unmodified lines
111111 cifs_trace_rw_credits_zero_in_flight);
112112 }
113113 server->in_flight--;
114+
115+ /*
116+ * Rebalance credits when an op drains in_flight. For session setup,
117+ * do this only when the total accumulated credits are high enough (>2)
118+ * so that a newly established secondary channel can reserve credits for
119+ * echoes and oplocks. We expect this to happen at the end of the final
120+ * session setup response.
121+ */
114122 if (server->in_flight == 0 &&
115123 ((optype & CIFS_OP_MASK) != CIFS_NEG_OP) &&
116124 ((optype & CIFS_OP_MASK) != CIFS_SESS_OP))
117125 rc = change_conf(server);
126+ else if (server->in_flight == 0 &&
127+ ((optype & CIFS_OP_MASK) == CIFS_SESS_OP) && *val > 2)
128+ rc = change_conf(server);
118129 /*
119130 * Sometimes server returns 0 credits on oplock break ack - we need to
120131 * rebalance credits in this case.
fs/smb/server/connection.c+38−8
@@ -540,24 +540,54 @@ out: · 539 unmodified lines
540540
541541 static void stop_sessions(void)
542542 {
543− struct ksmbd_conn *conn;
543+ struct ksmbd_conn *conn, *target;
544544 struct ksmbd_transport *t;
545+ bool any;
545546 int bkt;
546547
548+ /*
549+ * Serialised via init_lock; no concurrent stop_sessions() can
550+ * touch conn->stop_called, so writing it under the read lock is
551+ * safe.
552+ */
547553 again:
554+ target = NULL;
555+ any = false;
548556 down_read(&conn_list_lock);
549557 hash_for_each(conn_list, bkt, conn, hlist) {
550− t = conn->transport;
551− ksmbd_conn_set_exiting(conn);
552− if (t->ops->shutdown) {
553− up_read(&conn_list_lock);
558+ any = true;
559+ if (conn->stop_called)
560+ continue;
561+ atomic_inc(&conn->refcnt);
562+ conn->stop_called = true;
563+ /*
564+ * Mark the connection EXITING while still holding the
565+ * read lock so the selection and the status transition
566+ * happen together. Do not regress a connection that has
567+ * already advanced to RELEASING on its own (e.g. the
568+ * handler exited its receive loop for an unrelated
569+ * reason).
570+ */
571+ if (READ_ONCE(conn->status) != KSMBD_SESS_RELEASING)
572+ ksmbd_conn_set_exiting(conn);
573+ target = conn;
574+ break;
575+ }
576+ up_read(&conn_list_lock);
577+
578+ if (target) {
579+ t = target->transport;
580+ if (t->ops->shutdown)
554581 t->ops->shutdown(t);
555− down_read(&conn_list_lock);
582+ if (atomic_dec_and_test(&target->refcnt)) {
583+ ida_destroy(&target->async_ida);
584+ t->ops->free_transport(t);
585+ kfree(target);
556586 }
587+ goto again;
557588 }
558− up_read(&conn_list_lock);
559589
560− if (!hash_empty(conn_list)) {
590+ if (any) {
561591 msleep(100);
562592 goto again;
563593 }
fs/smb/server/connection.h+1−0
@@ -49,6 +49,7 @@ struct ksmbd_conn { · 48 unmodified lines
4949 struct mutex srv_mutex;
5050 int status;
5151 unsigned int cli_cap;
52+ bool stop_called;
5253 union {
5354 __be32 inet_addr;
5455 #if IS_ENABLED(CONFIG_IPV6)
fs/smb/server/smb2pdu.c+7−1
@@ -3946,7 +3946,13 @@ static int smb2_populate_readdir_entry(struct ksmbd_conn *conn, int info_level, · 3945 unmodified lines
39463946 goto free_conv_name;
39473947 }
39483948
3949− struct_sz = readdir_info_level_struct_sz(info_level) + conv_len;
3949+ struct_sz = readdir_info_level_struct_sz(info_level);
3950+ if (struct_sz == -EOPNOTSUPP) {
3951+ rc = -EINVAL;
3952+ goto free_conv_name;
3953+ }
3954+
3955+ struct_sz += conv_len;
39503956 next_entry_offset = ALIGN(struct_sz, KSMBD_DIR_INFO_ALIGNMENT);
39513957 d_info->last_entry_off_align = next_entry_offset - struct_sz;
39523958
fs/udf/misc.c+6−2
@@ -230,8 +230,12 @@ struct buffer_head *udf_read_tagged(struct super_block *sb, uint32_t block, · 229 unmodified lines
230230 }
231231
232232 /* Verify the descriptor CRC */
233− if (le16_to_cpu(tag_p->descCRCLength) + sizeof(struct tag) > sb->s_blocksize ||
234− le16_to_cpu(tag_p->descCRC) == crc_itu_t(0,
233+ if (le16_to_cpu(tag_p->descCRCLength) + sizeof(struct tag) > sb->s_blocksize) {
234+ udf_err(sb, "block %u: CRC length %u exceeds block size\n",
235+ block, le16_to_cpu(tag_p->descCRCLength));
236+ goto error_out;
237+ }
238+ if (le16_to_cpu(tag_p->descCRC) == crc_itu_t(0,
235239 bh->b_data + sizeof(struct tag),
236240 le16_to_cpu(tag_p->descCRCLength)))
237241 return bh;
include/acpi/acpi_bus.h+2−0
@@ -17,6 +17,8 @@ · 16 unmodified lines
1717 #include <linux/property.h>
1818 #include <linux/types.h>
1919
20+struct notifier_block;
21+
2022 struct acpi_handle_list {
2123 u32 count;
2224 acpi_handle *handles;
include/acpi/actbl1.h+6−0
@@ -1386,6 +1386,12 @@ enum acpi_einj_command_status { · 1385 unmodified lines
13861386 #define ACPI_EINJ_CXL_MEM_FATAL (1<<17)
13871387 #define ACPI_EINJ_VENDOR_DEFINED (1<<31)
13881388
1389+/* EINJV2 error types from EINJV2_GET_ERROR_TYPE (ACPI 6.6) */
1390+
1391+#define ACPI_EINJV2_PROCESSOR (1)
1392+#define ACPI_EINJV2_MEMORY (1<<1)
1393+#define ACPI_EINJV2_PCIE (1<<2)
1394+
13891395 /*******************************************************************************
13901396 *
13911397 * ERST - Error Record Serialization Table (ACPI 4.0)
include/drm/drm_fb_helper.h+6−0
@@ -273,6 +273,12 @@ int drm_fb_helper_hotplug_event(struct drm_fb_helper *fb_helper); · 272 unmodified lines
273273 int drm_fb_helper_initial_config(struct drm_fb_helper *fb_helper);
274274 bool drm_fb_helper_gem_is_fb(const struct drm_fb_helper *fb_helper,
275275 const struct drm_gem_object *obj);
276+#else
277+static inline bool drm_fb_helper_gem_is_fb(const struct drm_fb_helper *fb_helper,
278+ const struct drm_gem_object *obj)
279+{
280+ return false;
281+}
276282 #endif
277283
278284 #endif
include/linux/cdrom.h+1−0
@@ -108,6 +108,7 @@ int cdrom_ioctl(struct cdrom_device_info *cdi, struct block_device *bdev, · 107 unmodified lines
108108 extern unsigned int cdrom_check_events(struct cdrom_device_info *cdi,
109109 unsigned int clearing);
110110
111+extern void cdrom_probe_write_features(struct cdrom_device_info *cdi);
111112 extern int register_cdrom(struct gendisk *disk, struct cdrom_device_info *cdi);
112113 extern void unregister_cdrom(struct cdrom_device_info *cdi);
113114
include/linux/dma-buf.h+2−2
@@ -322,13 +322,13 @@ struct dma_buf { · 321 unmodified lines
322322 * @vmapping_counter:
323323 *
324324 * Used internally to refcnt the vmaps returned by dma_buf_vmap().
325− * Protected by @lock.
325+ * Protected by @resv.
326326 */
327327 unsigned vmapping_counter;
328328
329329 /**
330330 * @vmap_ptr:
331− * The current vmap ptr if @vmapping_counter > 0. Protected by @lock.
331+ * The current vmap ptr if @vmapping_counter > 0. Protected by @resv.
332332 */
333333 struct iosys_map vmap_ptr;
334334
include/linux/dpll.h+1−0
@@ -286,6 +286,7 @@ int dpll_pin_ref_sync_pair_add(struct dpll_pin *pin, · 285 unmodified lines
286286
287287 int dpll_device_change_ntf(struct dpll_device *dpll);
288288
289+int __dpll_pin_change_ntf(struct dpll_pin *pin);
289290 int dpll_pin_change_ntf(struct dpll_pin *pin);
290291
291292 int register_dpll_notifier(struct notifier_block *nb);
include/linux/fsnotify_backend.h+1−0
@@ -915,6 +915,7 @@ extern void fsnotify_clear_marks_by_group(struct fsnotify_group *group, · 914 unmodified lines
915915 unsigned int obj_type);
916916 extern void fsnotify_get_mark(struct fsnotify_mark *mark);
917917 extern void fsnotify_put_mark(struct fsnotify_mark *mark);
918+struct fsnotify_mark *fsnotify_next_mark(struct fsnotify_mark *mark);
918919 extern void fsnotify_finish_user_wait(struct fsnotify_iter_info *iter_info);
919920 extern bool fsnotify_prepare_user_wait(struct fsnotify_iter_info *iter_info);
920921
include/linux/mailbox_client.h+1−0
@@ -45,6 +45,7 @@ int mbox_send_message(struct mbox_chan *chan, void *mssg); · 44 unmodified lines
4545 int mbox_flush(struct mbox_chan *chan, unsigned long timeout);
4646 void mbox_client_txdone(struct mbox_chan *chan, int r); /* atomic */
4747 bool mbox_client_peek_data(struct mbox_chan *chan); /* atomic */
48+unsigned int mbox_chan_tx_slots_available(struct mbox_chan *chan); /* atomic */
4849 void mbox_free_channel(struct mbox_chan *chan); /* may sleep */
4950
5051 #endif /* __MAILBOX_CLIENT_H */
include/linux/mailbox_controller.h+13−4
@@ -3,6 +3,7 @@ · 2 unmodified lines
33 #ifndef __MAILBOX_CONTROLLER_H
44 #define __MAILBOX_CONTROLLER_H
55
6+#include <linux/bits.h>
67 #include <linux/completion.h>
78 #include <linux/device.h>
89 #include <linux/hrtimer.h>
@@ -11,6 +12,13 @@ · 2 unmodified lines
1112
1213 struct mbox_chan;
1314
15+/* Sentinel value distinguishing "no active request" from "NULL message data" */
16+#define MBOX_NO_MSG ((void *)-1)
17+
18+#define MBOX_TXDONE_BY_IRQ BIT(0) /* controller has remote RTR irq */
19+#define MBOX_TXDONE_BY_POLL BIT(1) /* controller can read status of last TX */
20+#define MBOX_TXDONE_BY_ACK BIT(2) /* S/W ACK received by Client ticks the TX */
21+
1422 /**
1523 * struct mbox_chan_ops - methods to control mailbox channels
1624 * @send_data: The API asks the MBOX controller driver, in atomic
@@ -54,10 +62,10 @@ struct mbox_chan_ops { · 37 unmodified lines
5462
5563 /**
5664 * struct mbox_controller - Controller of a class of communication channels
57− * @dev: Device backing this controller
58− * @ops: Operators that work on each communication chan
59− * @chans: Array of channels
60− * @num_chans: Number of channels in the 'chans' array.
65+ * @dev: Device backing this controller. Required.
66+ * @ops: Operators that work on each communication chan. Required.
67+ * @chans: Array of channels. Required.
68+ * @num_chans: Number of channels in the 'chans' array. Required.
6169 * @txdone_irq: Indicates if the controller can report to API when
6270 * the last transmitted data was read by the remote.
6371 * Eg, if it has some TX ACK irq.
@@ -70,6 +78,7 @@ struct mbox_chan_ops { · 6 unmodified lines
7078 * @of_xlate: Controller driver specific mapping of channel via DT
7179 * @poll_hrt: API private. hrtimer used to poll for TXDONE on all
7280 * channels.
81+ * @poll_hrt_lock: API private. Lock protecting access to poll_hrt.
7382 * @node: API private. To hook into list of controllers.
7483 */
7584 struct mbox_controller {
include/linux/maple_tree.h+1−1
@@ -4,7 +4,7 @@ · 3 unmodified lines
44 /*
55 * Maple Tree - An RCU-safe adaptive tree for storing ranges
66 * Copyright (c) 2018-2022 Oracle
7− * Authors: Liam R. Howlett <Liam.Howlett@Oracle.com>
7+ * Authors: Liam R. Howlett <liam@infradead.org>
88 * Matthew Wilcox <willy@infradead.org>
99 */
1010
include/linux/mm.h+1−1
@@ -4391,7 +4391,7 @@ static inline void mmap_action_map_kernel_pages_full(struct vm_area_desc *desc, · 4390 unmodified lines
43914391
43924392 int mmap_action_prepare(struct vm_area_desc *desc);
43934393 int mmap_action_complete(struct vm_area_struct *vma,
4394− struct mmap_action *action);
4394+ struct mmap_action *action, bool is_compat);
43954395
43964396 /* Look up the first VMA which exactly match the interval vm_start ... vm_end */
43974397 static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
include/linux/mroute_base.h+3−0
@@ -226,6 +226,7 @@ struct mr_table_ops { · 225 unmodified lines
226226
227227 /**
228228 * struct mr_table - a multicast routing table
229+ * @work: used for table destruction
229230 * @list: entry within a list of multicast routing tables
230231 * @net: net where this table belongs
231232 * @ops: protocol specific operations
@@ -243,6 +244,7 @@ struct mr_table_ops { · 11 unmodified lines
243244 * @mroute_reg_vif_num: PIM-device vif index
244245 */
245246 struct mr_table {
247+ struct rcu_work work;
246248 struct list_head list;
247249 possible_net_t net;
248250 struct mr_table_ops ops;
@@ -274,6 +276,7 @@ void vif_device_init(struct vif_device *v, · 25 unmodified lines
274276 unsigned short flags,
275277 unsigned short get_iflink_mask);
276278
279+void mr_table_free(struct mr_table *mrt);
277280 struct mr_table *
278281 mr_table_alloc(struct net *net, u32 id,
279282 struct mr_table_ops *ops,
include/linux/mtd/nand-qpic-common.h+3−1
@@ -9,6 +9,8 @@ · 8 unmodified lines
99 #ifndef __MTD_NAND_QPIC_COMMON_H__
1010 #define __MTD_NAND_QPIC_COMMON_H__
1111
12+#include <linux/mtd/rawnand.h>
13+
1214 /* NANDc reg offsets */
1315 #define NAND_FLASH_CMD 0x00
1416 #define NAND_ADDR0 0x04
@@ -394,7 +396,7 @@ struct qcom_nand_controller { · 379 unmodified lines
394396
395397 const struct qcom_nandc_props *props;
396398
397− struct nand_controller *controller;
399+ struct nand_controller controller;
398400 struct qpic_spi_nand *qspi;
399401 struct list_head host_list;
400402
include/linux/mtd/spinand.h+30−2
@@ -290,6 +290,12 @@ · 289 unmodified lines
290290 SPI_MEM_OP_NO_DUMMY, \
291291 SPI_MEM_OP_NO_DATA)
292292
293+#define SPINAND_PAGE_READ_PACKED_8D_8D_0_OP(addr) \
294+ SPI_MEM_OP(SPI_MEM_DTR_OP_PACKED_CMD(0x13, addr >> 16, 8), \
295+ SPI_MEM_DTR_OP_ADDR(2, addr & 0xffff, 8), \
296+ SPI_MEM_OP_NO_DUMMY, \
297+ SPI_MEM_OP_NO_DATA)
298+
293299 #define SPINAND_PAGE_READ_FROM_CACHE_8D_8D_8D_OP(addr, ndummy, buf, len, freq) \
294300 SPI_MEM_OP(SPI_MEM_DTR_OP_RPT_CMD(0x9d, 8), \
295301 SPI_MEM_DTR_OP_ADDR(2, addr, 8), \
@@ -483,6 +489,7 @@ struct spinand_ecc_info { · 187 unmodified lines
483489 #define SPINAND_HAS_PROG_PLANE_SELECT_BIT BIT(2)
484490 #define SPINAND_HAS_READ_PLANE_SELECT_BIT BIT(3)
485491 #define SPINAND_NO_RAW_ACCESS BIT(4)
492+#define SPINAND_ODTR_PACKED_PAGE_READ BIT(5)
486493
487494 /**
488495 * struct spinand_ondie_ecc_conf - private SPI-NAND on-die ECC engine structure
@@ -576,6 +583,7 @@ enum spinand_bus_interface { · 87 unmodified lines
576583 * @op_variants.read_cache: variants of the read-cache operation
577584 * @op_variants.write_cache: variants of the write-cache operation
578585 * @op_variants.update_cache: variants of the update-cache operation
586+ * @op_variants.cont_read_cache: variants of the continuous read-cache operation
579587 * @vendor_ops: vendor specific operations
580588 * @select_target: function used to select a target/die. Required only for
581589 * multi-die chips
@@ -585,6 +593,7 @@ enum spinand_bus_interface { · 3 unmodified lines
585593 * @user_otp: SPI NAND user OTP info.
586594 * @read_retries: the number of read retry modes supported
587595 * @set_read_retry: enable/disable read retry for data recovery
596+ * @set_randomizer: enable/disable randomizer support
588597 *
589598 * Each SPI NAND manufacturer driver should have a spinand_info table
590599 * describing all the chips supported by the driver.
@@ -600,6 +609,7 @@ struct spinand_info { · 9 unmodified lines
600609 const struct spinand_op_variants *read_cache;
601610 const struct spinand_op_variants *write_cache;
602611 const struct spinand_op_variants *update_cache;
612+ const struct spinand_op_variants *cont_read_cache;
603613 } op_variants;
604614 const struct spinand_op_variants *vendor_ops;
605615 int (*select_target)(struct spinand_device *spinand,
@@ -613,6 +623,8 @@ struct spinand_info { · 7 unmodified lines
613623 unsigned int read_retries;
614624 int (*set_read_retry)(struct spinand_device *spinand,
615625 unsigned int read_retry);
626+ int (*set_randomizer)(struct spinand_device *spinand,
627+ bool enable);
616628 };
617629
618630 #define SPINAND_ID(__method, ...) \
@@ -629,6 +641,14 @@ struct spinand_info { · 10 unmodified lines
629641 .update_cache = __update, \
630642 }
631643
644+#define SPINAND_INFO_OP_VARIANTS_WITH_CONT(__read, __write, __update, __cont_read) \
645+ { \
646+ .read_cache = __read, \
647+ .write_cache = __write, \
648+ .update_cache = __update, \
649+ .cont_read_cache = __cont_read, \
650+ }
651+
632652 #define SPINAND_INFO_VENDOR_OPS(__ops) \
633653 .vendor_ops = __ops
634654
@@ -669,6 +689,9 @@ struct spinand_info { · 34 unmodified lines
669689 .read_retries = __read_retries, \
670690 .set_read_retry = __set_read_retry
671691
692+#define SPINAND_RANDOMIZER(__set_randomizer) \
693+ .set_randomizer = __set_randomizer
694+
672695 #define SPINAND_INFO(__model, __id, __memorg, __eccreq, __op_variants, \
673696 __flags, ...) \
674697 { \
@@ -684,8 +707,6 @@ struct spinand_info { · 9 unmodified lines
684707 struct spinand_dirmap {
685708 struct spi_mem_dirmap_desc *wdesc;
686709 struct spi_mem_dirmap_desc *rdesc;
687− struct spi_mem_dirmap_desc *wdesc_ecc;
688− struct spi_mem_dirmap_desc *rdesc_ecc;
689710 };
690711
691712 /**
@@ -702,6 +723,7 @@ struct spinand_dirmap { · 10 unmodified lines
702723 * @read_cache: read cache op template
703724 * @write_cache: write cache op template
704725 * @update_cache: update cache op template
726+ * @cont_read_cache: continuous read cache op template (optional)
705727 */
706728 struct spinand_mem_ops {
707729 struct spi_mem_op reset;
@@ -716,6 +738,7 @@ struct spinand_mem_ops { · 8 unmodified lines
716738 const struct spi_mem_op *read_cache;
717739 const struct spi_mem_op *write_cache;
718740 const struct spi_mem_op *update_cache;
741+ const struct spi_mem_op *cont_read_cache;
719742 };
720743
721744 /**
@@ -754,6 +777,7 @@ struct spinand_mem_ops { · 32 unmodified lines
754777 * @user_otp: SPI NAND user OTP info.
755778 * @read_retries: the number of read retry modes supported
756779 * @set_read_retry: Enable/disable the read retry feature
780+ * @set_randomizer: Enable/disable the randomizer feature
757781 */
758782 struct spinand_device {
759783 struct nand_device base;
@@ -787,6 +811,8 @@ struct spinand_device { · 27 unmodified lines
787811 bool cont_read_possible;
788812 int (*set_cont_read)(struct spinand_device *spinand,
789813 bool enable);
814+ int (*set_randomizer)(struct spinand_device *spinand,
815+ bool enable);
790816
791817 const struct spinand_fact_otp *fact_otp;
792818 const struct spinand_user_otp *user_otp;
@@ -862,6 +888,8 @@ static inline void spinand_set_of_node(struct spinand_device *spinand, · 69 unmodified lines
862888 nanddev_set_of_node(&spinand->base, np);
863889 }
864890
891+bool spinand_op_is_odtr(const struct spi_mem_op *op);
892+
865893 int spinand_match_and_init(struct spinand_device *spinand,
866894 const struct spinand_info *table,
867895 unsigned int table_size,
include/linux/nvme-auth.h+3−3
@@ -49,9 +49,9 @@ int nvme_auth_augmented_challenge(u8 hmac_id, const u8 *skey, size_t skey_len, · 48 unmodified lines
4949 int nvme_auth_gen_privkey(struct crypto_kpp *dh_tfm, u8 dh_gid);
5050 int nvme_auth_gen_pubkey(struct crypto_kpp *dh_tfm,
5151 u8 *host_key, size_t host_key_len);
52−int nvme_auth_gen_shared_secret(struct crypto_kpp *dh_tfm,
53− const u8 *ctrl_key, size_t ctrl_key_len,
54− u8 *sess_key, size_t sess_key_len);
52+int nvme_auth_gen_session_key(struct crypto_kpp *dh_tfm,
53+ const u8 *public_key, size_t public_key_len,
54+ u8 *sess_key, size_t sess_key_len, u8 hash_id);
5555 int nvme_auth_generate_psk(u8 hmac_id, const u8 *skey, size_t skey_len,
5656 const u8 *c1, const u8 *c2, size_t hash_len,
5757 u8 **ret_psk, size_t *ret_len);
include/linux/rculist.h+29−0
@@ -261,6 +261,35 @@ static inline void list_replace_rcu(struct list_head *old, · 260 unmodified lines
261261 old->prev = LIST_POISON2;
262262 }
263263
264+static inline void __list_splice_rcu(struct list_head *list,
265+ struct list_head *prev,
266+ struct list_head *next)
267+{
268+ struct list_head *first = list->next;
269+ struct list_head *last = list->prev;
270+
271+ last->next = next;
272+ first->prev = prev;
273+ next->prev = last;
274+ rcu_assign_pointer(list_next_rcu(prev), first);
275+}
276+
277+/**
278+ * list_splice_rcu - splice a non-RCU list into an RCU-protected list,
279+ * designed for stacks.
280+ * @list: the non RCU-protected list to splice
281+ * @head: the place in the existing RCU-protected list to splice
282+ *
283+ * The list pointed to by @head can be RCU-read traversed concurrently with
284+ * this function.
285+ */
286+static inline void list_splice_rcu(struct list_head *list,
287+ struct list_head *head)
288+{
289+ if (!list_empty(list))
290+ __list_splice_rcu(list, head, head->next);
291+}
292+
264293 /**
265294 * __list_splice_init_rcu - join an RCU-protected list into an existing list.
266295 * @list: the RCU-protected list to splice
include/linux/rhashtable-types.h+5−0
@@ -12,6 +12,7 @@ · 11 unmodified lines
1212 #include <linux/alloc_tag.h>
1313 #include <linux/atomic.h>
1414 #include <linux/compiler.h>
15+#include <linux/irq_work_types.h>
1516 #include <linux/mutex.h>
1617 #include <linux/workqueue_types.h>
1718
@@ -49,6 +50,7 @@ typedef int (*rht_obj_cmpfn_t)(struct rhashtable_compare_arg *arg, · 31 unmodified lines
4950 * @head_offset: Offset of rhash_head in struct to be hashed
5051 * @max_size: Maximum size while expanding
5152 * @min_size: Minimum size while shrinking
53+ * @insecure_elasticity: Set to true to disable chain length checks
5254 * @automatic_shrinking: Enable automatic shrinking of tables
5355 * @hashfn: Hash function (default: jhash2 if !(key_len % 4), or jhash)
5456 * @obj_hashfn: Function to hash object
@@ -61,6 +63,7 @@ struct rhashtable_params { · 6 unmodified lines
6163 u16 head_offset;
6264 unsigned int max_size;
6365 u16 min_size;
66+ bool insecure_elasticity;
6467 bool automatic_shrinking;
6568 rht_hashfn_t hashfn;
6669 rht_obj_hashfn_t obj_hashfn;
@@ -75,6 +78,7 @@ struct rhashtable_params { · 8 unmodified lines
7578 * @p: Configuration parameters
7679 * @rhlist: True if this is an rhltable
7780 * @run_work: Deferred worker to expand/shrink asynchronously
81+ * @run_irq_work: Bounces the @run_work kick through hard IRQ context.
7882 * @mutex: Mutex to protect current/future table swapping
7983 * @lock: Spin lock to protect walker list
8084 * @nelems: Number of elements in table
@@ -86,6 +90,7 @@ struct rhashtable { · 5 unmodified lines
8690 struct rhashtable_params p;
8791 bool rhlist;
8892 struct work_struct run_work;
93+ struct irq_work run_irq_work;
8994 struct mutex mutex;
9095 spinlock_t lock;
9196 atomic_t nelems;
include/linux/rhashtable.h+5−3
@@ -20,6 +20,7 @@ · 19 unmodified lines
2020
2121 #include <linux/err.h>
2222 #include <linux/errno.h>
23+#include <linux/irq_work.h>
2324 #include <linux/jhash.h>
2425 #include <linux/list_nulls.h>
2526 #include <linux/workqueue.h>
@@ -821,14 +822,15 @@ slow_path: · 795 unmodified lines
821822 goto out;
822823 }
823824
824− if (elasticity <= 0)
825+ if (elasticity <= 0 && !params.insecure_elasticity)
825826 goto slow_path;
826827
827828 data = ERR_PTR(-E2BIG);
828829 if (unlikely(rht_grow_above_max(ht, tbl)))
829830 goto out_unlock;
830831
831− if (unlikely(rht_grow_above_100(ht, tbl)))
832+ if (unlikely(rht_grow_above_100(ht, tbl)) &&
833+ !params.insecure_elasticity)
832834 goto slow_path;
833835
834836 /* Inserting at head of list makes unlocking free. */
@@ -846,7 +848,7 @@ slow_path: · 11 unmodified lines
846848 rht_assign_unlock(tbl, bkt, obj, flags);
847849
848850 if (rht_grow_above_75(ht, tbl))
849− schedule_work(&ht->run_work);
851+ irq_work_queue(&ht->run_irq_work);
850852
851853 data = NULL;
852854 out:
include/linux/spi/spi-mem.h+11−1
@@ -227,6 +227,8 @@ struct spi_mem_op { · 226 unmodified lines
227227 * struct spi_mem_dirmap_info - Direct mapping information
228228 * @op_tmpl: operation template that should be used by the direct mapping when
229229 * the memory device is accessed
230+ * @secondary_op_tmpl: secondary template, may be used as an alternative to the
231+ * primary template (decided by the upper layer)
230232 * @offset: absolute offset this direct mapping is pointing to
231233 * @length: length in byte of this direct mapping
232234 *
@@ -237,7 +239,9 @@ struct spi_mem_op { · 4 unmodified lines
237239 * direction is directly encoded in the ->op_tmpl.data.dir field.
238240 */
239241 struct spi_mem_dirmap_info {
240− struct spi_mem_op op_tmpl;
242+ struct spi_mem_op *op_tmpl;
243+ struct spi_mem_op primary_op_tmpl;
244+ struct spi_mem_op secondary_op_tmpl;
241245 u64 offset;
242246 u64 length;
243247 };
@@ -381,12 +385,18 @@ struct spi_controller_mem_ops { · 137 unmodified lines
381385 * @swap16: Supports swapping bytes on a 16 bit boundary when configured in
382386 * Octal DTR
383387 * @per_op_freq: Supports per operation frequency switching
388+ * @no_cs_assertion: The controller may automatically deassert the CS if there
389+ * is a pause in the transfer (eg. internal bus contention or
390+ * DMA arbitration on an interconnect). Features such as NAND
391+ * continuous reads shall not be leveraged.
384392 */
385393 struct spi_controller_mem_caps {
386394 bool dtr;
387395 bool ecc;
388396 bool swap16;
389397 bool per_op_freq;
398+ bool secondary_op_tmpl;
399+ bool no_cs_assertion;
390400 };
391401
392402 #define spi_mem_controller_is_capable(ctlr, cap) \
include/linux/tracepoint.h+1−1
@@ -202,7 +202,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p) · 201 unmodified lines
202202 #define TP_CONDITION(args...) args
203203
204204 /*
205− * Individual subsystem my have a separate configuration to
205+ * Individual subsystem may have a separate configuration to
206206 * enable their tracepoints. By default, this file will create
207207 * the tracepoints if CONFIG_TRACEPOINTS is defined. If a subsystem
208208 * wants to be able to disable its tracepoints from being created
include/net/bond_3ad.h+1−1
@@ -243,7 +243,7 @@ typedef struct port { · 242 unmodified lines
243243 churn_state_t sm_churn_actor_state;
244244 churn_state_t sm_churn_partner_state;
245245 struct slave *slave; /* pointer to the bond slave that this port belongs to */
246− struct aggregator *aggregator; /* pointer to an aggregator that this port related to */
246+ struct aggregator __rcu *aggregator; /* pointer to an aggregator that this port related to */
247247 struct port *next_port_in_aggregator; /* Next port on the linked list of the parent aggregator */
248248 u32 transaction_id; /* continuous number for identification of Marker PDU's; */
249249 struct lacpdu lacpdu; /* the lacpdu that will be sent for this port */
include/net/netfilter/nf_tables.h+13−0
@@ -1204,12 +1204,15 @@ struct nft_stats { · 1203 unmodified lines
12041204 struct u64_stats_sync syncp;
12051205 };
12061206
1207+#define NFT_HOOK_REMOVE (1 << 0)
1208+
12071209 struct nft_hook {
12081210 struct list_head list;
12091211 struct list_head ops_list;
12101212 struct rcu_head rcu;
12111213 char ifname[IFNAMSIZ];
12121214 u8 ifnamelen;
1215+ u8 flags;
12131216 };
12141217
12151218 struct nf_hook_ops *nft_hook_find_ops(const struct nft_hook *hook,
@@ -1664,6 +1667,16 @@ struct nft_trans { · 448 unmodified lines
16641667 u8 put_net:1;
16651668 };
16661669
1670+/**
1671+ * struct nft_trans_hook - nf_tables hook update in transaction
1672+ * @list: used internally
1673+ * @hook: struct nft_hook with the device hook
1674+ */
1675+struct nft_trans_hook {
1676+ struct list_head list;
1677+ struct nft_hook *hook;
1678+};
1679+
16671680 /**
16681681 * struct nft_trans_binding - nf_tables object with binding support in transaction
16691682 * @nft_trans: base structure, MUST be first member
include/net/netmem.h+15−0
@@ -127,6 +127,21 @@ static inline unsigned int net_iov_idx(const struct net_iov *niov) · 126 unmodified lines
127127 return niov - net_iov_owner(niov)->niovs;
128128 }
129129
130+/* Initialize a niov: stamp the owning area, the memory provider type,
131+ * and the page_type "no type" sentinel expected by the page-type API
132+ * (see PAGE_TYPE_OPS in <linux/page-flags.h>) so that
133+ * page_pool_set_pp_info() can later call __SetPageNetpp() on a niov
134+ * cast to struct page.
135+ */
136+static inline void net_iov_init(struct net_iov *niov,
137+ struct net_iov_area *owner,
138+ enum net_iov_type type)
139+{
140+ niov->owner = owner;
141+ niov->type = type;
142+ niov->page_type = UINT_MAX;
143+}
144+
130145 /* netmem */
131146
132147 /**
include/uapi/linux/io_uring.h+2−1
@@ -905,7 +905,8 @@ struct io_uring_buf_reg { · 904 unmodified lines
905905 __u32 ring_entries;
906906 __u16 bgid;
907907 __u16 flags;
908− __u64 resv[3];
908+ __u32 min_left;
909+ __u32 resv[5];
909910 };
910911
911912 /* argument for IORING_REGISTER_PBUF_STATUS */
io_uring/kbuf.c+7−2
@@ -47,7 +47,7 @@ static bool io_kbuf_inc_commit(struct io_buffer_list *bl, int len) · 46 unmodified lines
4747 this_len = min_t(u32, len, buf_len);
4848 buf_len -= this_len;
4949 /* Stop looping for invalid buffer length of 0 */
50− if (buf_len || !this_len) {
50+ if (buf_len > bl->min_left_sub_one || !this_len) {
5151 WRITE_ONCE(buf->addr, READ_ONCE(buf->addr) + this_len);
5252 WRITE_ONCE(buf->len, buf_len);
5353 return false;
@@ -637,6 +637,10 @@ int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg) · 583 unmodified lines
637637 if (reg.ring_entries >= 65536)
638638 return -EINVAL;
639639
640+ /* minimum left byte count is a property of incremental buffers */
641+ if (!(reg.flags & IOU_PBUF_RING_INC) && reg.min_left)
642+ return -EINVAL;
643+
640644 bl = io_buffer_get_list(ctx, reg.bgid);
641645 if (bl) {
642646 /* if mapped buffer ring OR classic exists, don't allow */
@@ -680,10 +684,11 @@ int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg) · 37 unmodified lines
680684 }
681685 #endif
682686
683− bl->nr_entries = reg.ring_entries;
684687 bl->mask = reg.ring_entries - 1;
685688 bl->flags |= IOBL_BUF_RING;
686689 bl->buf_ring = br;
690+ if (reg.min_left)
691+ bl->min_left_sub_one = reg.min_left - 1;
687692 if (reg.flags & IOU_PBUF_RING_INC)
688693 bl->flags |= IOBL_INC;
689694 ret = io_buffer_add_list(ctx, bl, reg.bgid);
io_uring/kbuf.h+7−1
@@ -27,12 +27,18 @@ struct io_buffer_list { · 26 unmodified lines
2727 __u16 bgid;
2828
2929 /* below is for ring provided buffers */
30− __u16 nr_entries;
3130 __u16 head;
3231 __u16 mask;
3332
3433 __u16 flags;
3534
35+ /*
36+ * minimum required amount to be left to reuse an incrementally
37+ * consumed buffer. If less than this is left at consumption time,
38+ * buffer is done and head is incremented to the next buffer.
39+ */
40+ __u32 min_left_sub_one;
41+
3642 struct io_mapped_region region;
3743 };
3844
io_uring/napi.c+2−0
@@ -276,6 +276,8 @@ static int io_napi_register_napi(struct io_ring_ctx *ctx, · 275 unmodified lines
276276 /* clean the napi list for new settings */
277277 io_napi_free(ctx);
278278 WRITE_ONCE(ctx->napi_track_mode, napi->op_param);
279+ /* cap NAPI at 10 msec of spin time */
280+ napi->busy_poll_to = min(10000, napi->busy_poll_to);
279281 WRITE_ONCE(ctx->napi_busy_poll_dt, napi->busy_poll_to * NSEC_PER_USEC);
280282 WRITE_ONCE(ctx->napi_prefer_busy_poll, !!napi->prefer_busy_poll);
281283 return 0;
io_uring/tw.c+11−1
@@ -273,8 +273,18 @@ void io_req_task_work_add_remote(struct io_kiocb *req, unsigned flags) · 272 unmodified lines
273273
274274 void __cold io_move_task_work_from_local(struct io_ring_ctx *ctx)
275275 {
276− struct llist_node *node = llist_del_all(&ctx->work_llist);
276+ struct llist_node *node;
277277
278+ /*
279+ * Running the work items may utilize ->retry_llist as a means
280+ * for capping the number of task_work entries run at the same
281+ * time. But that list can potentially race with moving the work
282+ * from here, if the task is exiting. As any normal task_work
283+ * running holds ->uring_lock already, just guard this slow path
284+ * with ->uring_lock to avoid racing on ->retry_llist.
285+ */
286+ guard(mutex)(&ctx->uring_lock);
287+ node = llist_del_all(&ctx->work_llist);
278288 __io_fallback_tw(node, false);
279289 node = llist_del_all(&ctx->retry_llist);
280290 __io_fallback_tw(node, false);
io_uring/zcrx.c+1−2
@@ -495,10 +495,9 @@ static int io_zcrx_create_area(struct io_zcrx_ifq *ifq, · 494 unmodified lines
495495 for (i = 0; i < nr_iovs; i++) {
496496 struct net_iov *niov = &area->nia.niovs[i];
497497
498− niov->owner = &area->nia;
498+ net_iov_init(niov, &area->nia, NET_IOV_IOURING);
499499 area->freelist[i] = i;
500500 atomic_set(&area->user_refs[i], 0);
501− niov->type = NET_IOV_IOURING;
502501 }
503502
504503 if (ifq->dev) {
kernel/cgroup/cgroup.c+28−18
@@ -3934,33 +3934,41 @@ static int cgroup_cpu_pressure_show(struct seq_file *seq, void *v) · 3933 unmodified lines
39343934 static ssize_t pressure_write(struct kernfs_open_file *of, char *buf,
39353935 size_t nbytes, enum psi_res res)
39363936 {
3937− struct cgroup_file_ctx *ctx = of->priv;
3937+ struct cgroup_file_ctx *ctx;
39383938 struct psi_trigger *new;
39393939 struct cgroup *cgrp;
39403940 struct psi_group *psi;
3941+ ssize_t ret = 0;
39413942
39423943 cgrp = cgroup_kn_lock_live(of->kn, false);
39433944 if (!cgrp)
39443945 return -ENODEV;
39453946
3946− cgroup_get(cgrp);
3947− cgroup_kn_unlock(of->kn);
3947+ ctx = of->priv;
3948+ if (!ctx) {
3949+ ret = -ENODEV;
3950+ goto out_unlock;
3951+ }
39483952
39493953 /* Allow only one trigger per file descriptor */
39503954 if (ctx->psi.trigger) {
3951− cgroup_put(cgrp);
3952− return -EBUSY;
3955+ ret = -EBUSY;
3956+ goto out_unlock;
39533957 }
39543958
39553959 psi = cgroup_psi(cgrp);
39563960 new = psi_trigger_create(psi, buf, res, of->file, of);
39573961 if (IS_ERR(new)) {
3958− cgroup_put(cgrp);
3959− return PTR_ERR(new);
3962+ ret = PTR_ERR(new);
3963+ goto out_unlock;
39603964 }
39613965
39623966 smp_store_release(&ctx->psi.trigger, new);
3963− cgroup_put(cgrp);
3967+
3968+out_unlock:
3969+ cgroup_kn_unlock(of->kn);
3970+ if (ret)
3971+ return ret;
39643972
39653973 return nbytes;
39663974 }
@@ -5716,16 +5724,6 @@ static void offline_css(struct cgroup_subsys_state *css) · 1749 unmodified lines
57165724 RCU_INIT_POINTER(css->cgroup->subsys[ss->id], NULL);
57175725
57185726 wake_up_all(&css->cgroup->offline_waitq);
5719−
5720− css->cgroup->nr_dying_subsys[ss->id]++;
5721− /*
5722− * Parent css and cgroup cannot be freed until after the freeing
5723− * of child css, see css_free_rwork_fn().
5724− */
5725− while ((css = css->parent)) {
5726− css->nr_descendants--;
5727− css->cgroup->nr_dying_subsys[ss->id]++;
5728− }
57295727 }
57305728
57315729 /**
@@ -6038,6 +6036,8 @@ static void css_killed_ref_fn(struct percpu_ref *ref) · 306 unmodified lines
60386036 */
60396037 static void kill_css(struct cgroup_subsys_state *css)
60406038 {
6039+ struct cgroup_subsys *ss = css->ss;
6040+
60416041 lockdep_assert_held(&cgroup_mutex);
60426042
60436043 if (css->flags & CSS_DYING)
@@ -6074,6 +6074,16 @@ static void kill_css(struct cgroup_subsys_state *css) · 30 unmodified lines
60746074 * css is confirmed to be seen as killed on all CPUs.
60756075 */
60766076 percpu_ref_kill_and_confirm(&css->refcnt, css_killed_ref_fn);
6077+
6078+ css->cgroup->nr_dying_subsys[ss->id]++;
6079+ /*
6080+ * Parent css and cgroup cannot be freed until after the freeing
6081+ * of child css, see css_free_rwork_fn().
6082+ */
6083+ while ((css = css->parent)) {
6084+ css->nr_descendants--;
6085+ css->cgroup->nr_dying_subsys[ss->id]++;
6086+ }
60776087 }
60786088
60796089 /**
kernel/cgroup/cpuset-internal.h+5−0
@@ -168,6 +168,11 @@ struct cpuset { · 167 unmodified lines
168168 int nr_deadline_tasks;
169169 int nr_migrate_dl_tasks;
170170 u64 sum_migrate_dl_bw;
171+ /*
172+ * CPU used for temporary DL bandwidth allocation during attach;
173+ * -1 if no DL bandwidth was allocated in the current attach.
174+ */
175+ int dl_bw_cpu;
171176
172177 /* Invalid partition error code, not lock protected */
173178 enum prs_errcode prs_err;
kernel/cgroup/cpuset.c+9−4
@@ -288,6 +288,7 @@ struct cpuset top_cpuset = { · 287 unmodified lines
288288 .flags = BIT(CS_CPU_EXCLUSIVE) |
289289 BIT(CS_MEM_EXCLUSIVE) | BIT(CS_SCHED_LOAD_BALANCE),
290290 .partition_root_state = PRS_ROOT,
291+ .dl_bw_cpu = -1,
291292 };
292293
293294 /**
@@ -579,6 +580,8 @@ static struct cpuset *dup_or_alloc_cpuset(struct cpuset *cs) · 285 unmodified lines
579580 if (!trial)
580581 return NULL;
581582
583+ trial->dl_bw_cpu = -1;
584+
582585 /* Setup cpumask pointer array */
583586 cpumask_var_t *pmask[4] = {
584587 &trial->cpus_allowed,
@@ -2980,6 +2983,7 @@ static void reset_migrate_dl_data(struct cpuset *cs) · 2395 unmodified lines
29802983 {
29812984 cs->nr_migrate_dl_tasks = 0;
29822985 cs->sum_migrate_dl_bw = 0;
2986+ cs->dl_bw_cpu = -1;
29832987 }
29842988
29852989 /* Called by cgroups to determine if a cpuset is usable; cpuset_mutex held */
@@ -3056,6 +3060,8 @@ static int cpuset_can_attach(struct cgroup_taskset *tset) · 70 unmodified lines
30563060 reset_migrate_dl_data(cs);
30573061 goto out_unlock;
30583062 }
3063+
3064+ cs->dl_bw_cpu = cpu;
30593065 }
30603066
30613067 out_success:
@@ -3080,12 +3086,11 @@ static void cpuset_cancel_attach(struct cgroup_taskset *tset) · 18 unmodified lines
30803086 mutex_lock(&cpuset_mutex);
30813087 dec_attach_in_progress_locked(cs);
30823088
3083− if (cs->nr_migrate_dl_tasks) {
3084− int cpu = cpumask_any(cs->effective_cpus);
3089+ if (cs->dl_bw_cpu >= 0)
3090+ dl_bw_free(cs->dl_bw_cpu, cs->sum_migrate_dl_bw);
30853091
3086− dl_bw_free(cpu, cs->sum_migrate_dl_bw);
3092+ if (cs->nr_migrate_dl_tasks)
30873093 reset_migrate_dl_data(cs);
3088− }
30893094
30903095 mutex_unlock(&cpuset_mutex);
30913096 }
kernel/cgroup/rdma.c+1−1
@@ -283,7 +283,7 @@ int rdmacg_try_charge(struct rdma_cgroup **rdmacg, · 282 unmodified lines
283283 ret = PTR_ERR(rpool);
284284 goto err;
285285 } else {
286− new = rpool->resources[index].usage + 1;
286+ new = (s64)rpool->resources[index].usage + 1;
287287 if (new > rpool->resources[index].max) {
288288 ret = -EAGAIN;
289289 goto err;
kernel/fork.c+5−7
@@ -1951,9 +1951,11 @@ static void rv_task_fork(struct task_struct *p) · 1950 unmodified lines
19511951
19521952 static bool need_futex_hash_allocate_default(u64 clone_flags)
19531953 {
1954− if ((clone_flags & (CLONE_THREAD | CLONE_VM)) != (CLONE_THREAD | CLONE_VM))
1955− return false;
1956− return true;
1954+ /*
1955+ * Allocate a default futex hash for any sibling that will
1956+ * share the parent's mm, except vfork.
1957+ */
1958+ return (clone_flags & (CLONE_VM | CLONE_VFORK)) == CLONE_VM;
19571959 }
19581960
19591961 /*
@@ -2380,10 +2382,6 @@ __latent_entropy struct task_struct *copy_process( · 420 unmodified lines
23802382 if (retval)
23812383 goto bad_fork_cancel_cgroup;
23822384
2383− /*
2384− * Allocate a default futex hash for the user process once the first
2385− * thread spawns.
2386− */
23872385 if (need_futex_hash_allocate_default(clone_flags)) {
23882386 retval = futex_hash_allocate_default();
23892387 if (retval)
kernel/futex/requeue.c+9−4
@@ -319,8 +319,11 @@ futex_proxy_trylock_atomic(u32 __user *pifutex, struct futex_hash_bucket *hb1, · 318 unmodified lines
319319 return -EINVAL;
320320
321321 /* Ensure that this does not race against an early wakeup */
322− if (!futex_requeue_pi_prepare(top_waiter, NULL))
322+ if (!futex_requeue_pi_prepare(top_waiter, NULL)) {
323+ plist_del(&top_waiter->list, &hb1->chain);
324+ futex_hb_waiters_dec(hb1);
323325 return -EAGAIN;
326+ }
324327
325328 /*
326329 * Try to take the lock for top_waiter and set the FUTEX_WAITERS bit
@@ -722,10 +725,12 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb, · 395 unmodified lines
722725
723726 /*
724727 * We were woken prior to requeue by a timeout or a signal.
725− * Unqueue the futex_q and determine which it was.
728+ * Conditionally unqueue the futex_q and determine which it was.
726729 */
727− plist_del(&q->list, &hb->chain);
728− futex_hb_waiters_dec(hb);
730+ if (!plist_node_empty(&q->list)) {
731+ plist_del(&q->list, &hb->chain);
732+ futex_hb_waiters_dec(hb);
733+ }
729734
730735 /* Handle spurious wakeups gracefully */
731736 ret = -EWOULDBLOCK;
kernel/liveupdate/kexec_handover.c+13−8
@@ -762,19 +762,24 @@ int kho_add_subtree(const char *name, void *blob, size_t size) · 761 unmodified lines
762762 goto out_pack;
763763 }
764764
765− err = fdt_setprop(root_fdt, off, KHO_SUB_TREE_PROP_NAME,
766− &phys, sizeof(phys));
767− if (err < 0)
768− goto out_pack;
765+ fdt_err = fdt_setprop(root_fdt, off, KHO_SUB_TREE_PROP_NAME,
766+ &phys, sizeof(phys));
767+ if (fdt_err < 0)
768+ goto out_del_node;
769769
770− err = fdt_setprop(root_fdt, off, KHO_SUB_TREE_SIZE_PROP_NAME,
771− &size_u64, sizeof(size_u64));
772− if (err < 0)
773− goto out_pack;
770+ fdt_err = fdt_setprop(root_fdt, off, KHO_SUB_TREE_SIZE_PROP_NAME,
771+ &size_u64, sizeof(size_u64));
772+ if (fdt_err < 0)
773+ goto out_del_node;
774774
775775 WARN_ON_ONCE(kho_debugfs_blob_add(&kho_out.dbg, name, blob,
776776 size, false));
777777
778+ err = 0;
779+ goto out_pack;
780+
781+out_del_node:
782+ fdt_del_node(root_fdt, off);
778783 out_pack:
779784 fdt_pack(root_fdt);
780785
kernel/liveupdate/luo_session.c+10−5
@@ -514,11 +514,12 @@ int luo_session_deserialize(void) · 513 unmodified lines
514514 {
515515 struct luo_session_header *sh = &luo_session_global.incoming;
516516 static bool is_deserialized;
517− static int err;
517+ static int saved_err;
518+ int err;
518519
519520 /* If has been deserialized, always return the same error code */
520521 if (is_deserialized)
521− return err;
522+ return saved_err;
522523
523524 is_deserialized = true;
524525 if (!sh->active)
@@ -547,7 +548,8 @@ int luo_session_deserialize(void) · 22 unmodified lines
547548 pr_warn("Failed to allocate session [%.*s] during deserialization %pe\n",
548549 (int)sizeof(sh->ser[i].name),
549550 sh->ser[i].name, session);
550− return PTR_ERR(session);
551+ err = PTR_ERR(session);
552+ goto save_err;
551553 }
552554
553555 err = luo_session_insert(sh, session);
@@ -555,7 +557,7 @@ int luo_session_deserialize(void) · 1 unmodified line
555557 pr_warn("Failed to insert session [%s] %pe\n",
556558 session->name, ERR_PTR(err));
557559 luo_session_free(session);
558− return err;
560+ goto save_err;
559561 }
560562
561563 scoped_guard(mutex, &session->mutex) {
@@ -565,7 +567,7 @@ int luo_session_deserialize(void) · 3 unmodified lines
565567 if (err) {
566568 pr_warn("Failed to deserialize files for session [%s] %pe\n",
567569 session->name, ERR_PTR(err));
568− return err;
570+ goto save_err;
569571 }
570572 }
571573
@@ -574,6 +576,9 @@ int luo_session_deserialize(void) · 2 unmodified lines
574576 sh->ser = NULL;
575577
576578 return 0;
579+save_err:
580+ saved_err = err;
581+ return err;
577582 }
578583
579584 int luo_session_serialize(void)
kernel/sched/core.c+1−0
@@ -4458,6 +4458,7 @@ static void __sched_fork(u64 clone_flags, struct task_struct *p) · 4457 unmodified lines
44584458 p->se.nr_migrations = 0;
44594459 p->se.vruntime = 0;
44604460 p->se.vlag = 0;
4461+ p->se.rel_deadline = 0;
44614462 INIT_LIST_HEAD(&p->se.group_node);
44624463
44634464 /* A delayed task cannot be in clone(). */
kernel/sched/ext.c+276−122
@@ -32,6 +32,7 @@ static const struct rhashtable_params scx_sched_hash_params = { · 31 unmodified lines
3232 .key_len = sizeof_field(struct scx_sched, ops.sub_cgroup_id),
3333 .key_offset = offsetof(struct scx_sched, ops.sub_cgroup_id),
3434 .head_offset = offsetof(struct scx_sched, hash_node),
35+ .insecure_elasticity = true, /* inserted under scx_sched_lock */
3536 };
3637
3738 static struct rhashtable scx_sched_hash;
@@ -52,8 +53,6 @@ DEFINE_STATIC_KEY_FALSE(__scx_enabled); · 14 unmodified lines
5253 DEFINE_STATIC_PERCPU_RWSEM(scx_fork_rwsem);
5354 static atomic_t scx_enable_state_var = ATOMIC_INIT(SCX_DISABLED);
5455 static DEFINE_RAW_SPINLOCK(scx_bypass_lock);
55−static cpumask_var_t scx_bypass_lb_donee_cpumask;
56−static cpumask_var_t scx_bypass_lb_resched_cpumask;
5756 static bool scx_init_task_enabled;
5857 static bool scx_switching_all;
5958 DEFINE_STATIC_KEY_FALSE(__scx_switched_all);
@@ -469,24 +468,35 @@ static inline void update_locked_rq(struct rq *rq) · 409 unmodified lines
469468 __this_cpu_write(scx_locked_rq_state, rq);
470469 }
471470
472−#define SCX_CALL_OP(sch, op, rq, args...) \
471+/*
472+ * SCX ops can recurse via scx_bpf_sub_dispatch() - the inner call must not
473+ * clobber the outer's scx_locked_rq_state. Save it on entry, restore on exit.
474+ */
475+#define SCX_CALL_OP(sch, op, locked_rq, args...) \
473476 do { \
474− if (rq) \
475− update_locked_rq(rq); \
477+ struct rq *__prev_locked_rq; \
478+ \
479+ if (locked_rq) { \
480+ __prev_locked_rq = scx_locked_rq(); \
481+ update_locked_rq(locked_rq); \
482+ } \
476483 (sch)->ops.op(args); \
477− if (rq) \
478− update_locked_rq(NULL); \
484+ if (locked_rq) \
485+ update_locked_rq(__prev_locked_rq); \
479486 } while (0)
480487
481−#define SCX_CALL_OP_RET(sch, op, rq, args...) \
488+#define SCX_CALL_OP_RET(sch, op, locked_rq, args...) \
482489 ({ \
490+ struct rq *__prev_locked_rq; \
483491 __typeof__((sch)->ops.op(args)) __ret; \
484492 \
485− if (rq) \
486− update_locked_rq(rq); \
493+ if (locked_rq) { \
494+ __prev_locked_rq = scx_locked_rq(); \
495+ update_locked_rq(locked_rq); \
496+ } \
487497 __ret = (sch)->ops.op(args); \
488− if (rq) \
489− update_locked_rq(NULL); \
498+ if (locked_rq) \
499+ update_locked_rq(__prev_locked_rq); \
490500 __ret; \
491501 })
492502
@@ -498,39 +508,39 @@ do { \ · 5 unmodified lines
498508 * those subject tasks.
499509 *
500510 * Every SCX_CALL_OP_TASK*() call site invokes its op with @p's rq lock held -
501− * either via the @rq argument here, or (for ops.select_cpu()) via @p's pi_lock
502− * held by try_to_wake_up() with rq tracking via scx_rq.in_select_cpu. So if
503− * kf_tasks[] is set, @p's scheduler-protected fields are stable.
511+ * either via the @locked_rq argument here, or (for ops.select_cpu()) via @p's
512+ * pi_lock held by try_to_wake_up() with rq tracking via scx_rq.in_select_cpu.
513+ * So if kf_tasks[] is set, @p's scheduler-protected fields are stable.
504514 *
505515 * kf_tasks[] can not stack, so task-based SCX ops must not nest. The
506516 * WARN_ON_ONCE() in each macro catches a re-entry of any of the three variants
507517 * while a previous one is still in progress.
508518 */
509−#define SCX_CALL_OP_TASK(sch, op, rq, task, args...) \
519+#define SCX_CALL_OP_TASK(sch, op, locked_rq, task, args...) \
510520 do { \
511521 WARN_ON_ONCE(current->scx.kf_tasks[0]); \
512522 current->scx.kf_tasks[0] = task; \
513− SCX_CALL_OP((sch), op, rq, task, ##args); \
523+ SCX_CALL_OP((sch), op, locked_rq, task, ##args); \
514524 current->scx.kf_tasks[0] = NULL; \
515525 } while (0)
516526
517−#define SCX_CALL_OP_TASK_RET(sch, op, rq, task, args...) \
527+#define SCX_CALL_OP_TASK_RET(sch, op, locked_rq, task, args...) \
518528 ({ \
519529 __typeof__((sch)->ops.op(task, ##args)) __ret; \
520530 WARN_ON_ONCE(current->scx.kf_tasks[0]); \
521531 current->scx.kf_tasks[0] = task; \
522− __ret = SCX_CALL_OP_RET((sch), op, rq, task, ##args); \
532+ __ret = SCX_CALL_OP_RET((sch), op, locked_rq, task, ##args); \
523533 current->scx.kf_tasks[0] = NULL; \
524534 __ret; \
525535 })
526536
527−#define SCX_CALL_OP_2TASKS_RET(sch, op, rq, task0, task1, args...) \
537+#define SCX_CALL_OP_2TASKS_RET(sch, op, locked_rq, task0, task1, args...) \
528538 ({ \
529539 __typeof__((sch)->ops.op(task0, task1, ##args)) __ret; \
530540 WARN_ON_ONCE(current->scx.kf_tasks[0]); \
531541 current->scx.kf_tasks[0] = task0; \
532542 current->scx.kf_tasks[1] = task1; \
533− __ret = SCX_CALL_OP_RET((sch), op, rq, task0, task1, ##args); \
543+ __ret = SCX_CALL_OP_RET((sch), op, locked_rq, task0, task1, ##args); \
534544 current->scx.kf_tasks[0] = NULL; \
535545 current->scx.kf_tasks[1] = NULL; \
536546 __ret; \
@@ -1388,18 +1398,55 @@ static void call_task_dequeue(struct scx_sched *sch, struct rq *rq, · 851 unmodified lines
13881398 p->scx.flags &= ~SCX_TASK_IN_CUSTODY;
13891399 }
13901400
1391−static void local_dsq_post_enq(struct scx_dispatch_q *dsq, struct task_struct *p,
1392− u64 enq_flags)
1401+static void local_dsq_post_enq(struct scx_sched *sch, struct scx_dispatch_q *dsq,
1402+ struct task_struct *p, u64 enq_flags)
13931403 {
13941404 struct rq *rq = container_of(dsq, struct rq, scx.local_dsq);
1395− bool preempt = false;
13961405
1397− call_task_dequeue(scx_root, rq, p, 0);
1406+ call_task_dequeue(sch, rq, p, 0);
1407+
1408+ /*
1409+ * Note that @rq's lock may be dropped between this enqueue and @p
1410+ * actually getting on CPU. This gives higher-class tasks (e.g. RT)
1411+ * an opportunity to wake up on @rq and prevent @p from running.
1412+ * Here are some concrete examples:
1413+ *
1414+ * Example 1:
1415+ *
1416+ * We dispatch two tasks from a single ops.dispatch():
1417+ * - First, a local task to this CPU's local DSQ;
1418+ * - Second, a local/remote task to a remote CPU's local DSQ.
1419+ * We must drop the local rq lock in order to finish the second
1420+ * dispatch. In that time, an RT task can wake up on the local rq.
1421+ *
1422+ * Example 2:
1423+ *
1424+ * We dispatch a local/remote task to a remote CPU's local DSQ.
1425+ * We must drop the remote rq lock before the dispatched task can run,
1426+ * which gives an RT task an opportunity to wake up on the remote rq.
1427+ *
1428+ * Both examples work the same if we replace dispatching with moving
1429+ * the tasks from a user-created DSQ.
1430+ *
1431+ * We must detect these wakeups so that we can re-enqueue IMMED tasks
1432+ * from @rq's local DSQ. scx_wakeup_preempt() serves exactly this
1433+ * purpose, but for it to be invoked, we must ensure that we bump
1434+ * @rq->next_class to &ext_sched_class if it's currently idle.
1435+ *
1436+ * wakeup_preempt() does the bumping, and since we only invoke it if
1437+ * @rq->next_class is below &ext_sched_class, it will also
1438+ * resched_curr(rq).
1439+ */
1440+ if (sched_class_above(p->sched_class, rq->next_class))
1441+ wakeup_preempt(rq, p, 0);
13981442
13991443 /*
14001444 * If @rq is in balance, the CPU is already vacant and looking for the
14011445 * next task to run. No need to preempt or trigger resched after moving
14021446 * @p into its local DSQ.
1447+ * Note that the wakeup_preempt() above may have already triggered
1448+ * a resched if @rq->next_class was idle. It's harmless, since
1449+ * need_resched is cleared immediately after task pick.
14031450 */
14041451 if (rq->scx.flags & SCX_RQ_IN_BALANCE)
14051452 return;
@@ -1407,11 +1454,8 @@ static void local_dsq_post_enq(struct scx_dispatch_q *dsq, struct task_struct *p · 1 unmodified line
14071454 if ((enq_flags & SCX_ENQ_PREEMPT) && p != rq->curr &&
14081455 rq->curr->sched_class == &ext_sched_class) {
14091456 rq->curr->scx.slice = 0;
1410− preempt = true;
1411− }
1412−
1413− if (preempt || sched_class_above(&ext_sched_class, rq->curr->sched_class))
14141457 resched_curr(rq);
1458+ }
14151459 }
14161460
14171461 static void dispatch_enqueue(struct scx_sched *sch, struct rq *rq,
@@ -1494,11 +1538,13 @@ static void dispatch_enqueue(struct scx_sched *sch, struct rq *rq, · 76 unmodified lines
14941538 if (!(dsq->id & SCX_DSQ_FLAG_BUILTIN))
14951539 rcu_assign_pointer(dsq->first_task, p);
14961540 } else {
1497− bool was_empty;
1498−
1499− was_empty = list_empty(&dsq->list);
1541+ /*
1542+ * dsq->list can contain parked BPF iterator cursors, so
1543+ * list_empty() here isn't a reliable proxy for "no real
1544+ * task in the DSQ". Test dsq->first_task directly.
1545+ */
15001546 list_add_tail(&p->scx.dsq_list.node, &dsq->list);
1501− if (was_empty && !(dsq->id & SCX_DSQ_FLAG_BUILTIN))
1547+ if (!dsq->first_task && !(dsq->id & SCX_DSQ_FLAG_BUILTIN))
15021548 rcu_assign_pointer(dsq->first_task, p);
15031549 }
15041550 }
@@ -1518,7 +1564,7 @@ static void dispatch_enqueue(struct scx_sched *sch, struct rq *rq, · 13 unmodified lines
15181564 * concurrently in a non-atomic way.
15191565 */
15201566 if (is_local) {
1521− local_dsq_post_enq(dsq, p, enq_flags);
1567+ local_dsq_post_enq(sch, dsq, p, enq_flags);
15221568 } else {
15231569 /*
15241570 * Task on global/bypass DSQ: leave custody, task on
@@ -2129,7 +2175,8 @@ static void wakeup_preempt_scx(struct rq *rq, struct task_struct *p, int wake_fl · 604 unmodified lines
21292175 schedule_reenq_local(rq, 0);
21302176 }
21312177
2132−static void move_local_task_to_local_dsq(struct task_struct *p, u64 enq_flags,
2178+static void move_local_task_to_local_dsq(struct scx_sched *sch,
2179+ struct task_struct *p, u64 enq_flags,
21332180 struct scx_dispatch_q *src_dsq,
21342181 struct rq *dst_rq)
21352182 {
@@ -2149,7 +2196,7 @@ static void move_local_task_to_local_dsq(struct task_struct *p, u64 enq_flags, · 13 unmodified lines
21492196 dsq_inc_nr(dst_dsq, p, enq_flags);
21502197 p->scx.dsq = dst_dsq;
21512198
2152− local_dsq_post_enq(dst_dsq, p, enq_flags);
2199+ local_dsq_post_enq(sch, dst_dsq, p, enq_flags);
21532200 }
21542201
21552202 /**
@@ -2370,7 +2417,7 @@ static struct rq *move_task_between_dsqs(struct scx_sched *sch, · 214 unmodified lines
23702417 /* @p is going from a non-local DSQ to a local DSQ */
23712418 if (src_rq == dst_rq) {
23722419 task_unlink_from_dsq(p, src_dsq);
2373− move_local_task_to_local_dsq(p, enq_flags,
2420+ move_local_task_to_local_dsq(sch, p, enq_flags,
23742421 src_dsq, dst_rq);
23752422 raw_spin_unlock(&src_dsq->lock);
23762423 } else {
@@ -2423,7 +2470,7 @@ retry: · 46 unmodified lines
24232470
24242471 if (rq == task_rq) {
24252472 task_unlink_from_dsq(p, dsq);
2426− move_local_task_to_local_dsq(p, enq_flags, dsq, rq);
2473+ move_local_task_to_local_dsq(sch, p, enq_flags, dsq, rq);
24272474 raw_spin_unlock(&dsq->lock);
24282475 return true;
24292476 }
@@ -3183,7 +3230,7 @@ bool scx_prio_less(const struct task_struct *a, const struct task_struct *b, · 753 unmodified lines
31833230 if (sch_a == sch_b && SCX_HAS_OP(sch_a, core_sched_before) &&
31843231 !scx_bypassing(sch_a, task_cpu(a)))
31853232 return SCX_CALL_OP_2TASKS_RET(sch_a, core_sched_before,
3186− NULL,
3233+ task_rq(a),
31873234 (struct task_struct *)a,
31883235 (struct task_struct *)b);
31893236 else
@@ -3631,6 +3678,22 @@ static void __scx_disable_and_exit_task(struct scx_sched *sch, · 441 unmodified lines
36313678 SCX_CALL_OP_TASK(sch, exit_task, task_rq(p), p, &args);
36323679 }
36333680
3681+/*
3682+ * Undo a completed __scx_init_task(sch, p, false) when scx_enable_task() never
3683+ * ran. The task state has not been transitioned, so this mirrors the
3684+ * SCX_TASK_INIT branch in __scx_disable_and_exit_task().
3685+ */
3686+static void scx_sub_init_cancel_task(struct scx_sched *sch, struct task_struct *p)
3687+{
3688+ struct scx_exit_task_args args = { .cancelled = true };
3689+
3690+ lockdep_assert_held(&p->pi_lock);
3691+ lockdep_assert_rq_held(task_rq(p));
3692+
3693+ if (SCX_HAS_OP(sch, exit_task))
3694+ SCX_CALL_OP_TASK(sch, exit_task, task_rq(p), p, &args);
3695+}
3696+
36343697 static void scx_disable_and_exit_task(struct scx_sched *sch,
36353698 struct task_struct *p)
36363699 {
@@ -3639,11 +3702,12 @@ static void scx_disable_and_exit_task(struct scx_sched *sch, · 2 unmodified lines
36393702 /*
36403703 * If set, @p exited between __scx_init_task() and scx_enable_task() in
36413704 * scx_sub_enable() and is initialized for both the associated sched and
3642− * its parent. Disable and exit for the child too.
3705+ * its parent. Exit for the child too - scx_enable_task() never ran for
3706+ * it, so undo only init_task.
36433707 */
3644− if ((p->scx.flags & SCX_TASK_SUB_INIT) &&
3645− !WARN_ON_ONCE(!scx_enabling_sub_sched)) {
3646− __scx_disable_and_exit_task(scx_enabling_sub_sched, p);
3708+ if (p->scx.flags & SCX_TASK_SUB_INIT) {
3709+ if (!WARN_ON_ONCE(!scx_enabling_sub_sched))
3710+ scx_sub_init_cancel_task(scx_enabling_sub_sched, p);
36473711 p->scx.flags &= ~SCX_TASK_SUB_INIT;
36483712 }
36493713
@@ -4324,9 +4388,10 @@ void scx_cgroup_cancel_attach(struct cgroup_taskset *tset) · 674 unmodified lines
43244388
43254389 void scx_group_set_weight(struct task_group *tg, unsigned long weight)
43264390 {
4327− struct scx_sched *sch = scx_root;
4391+ struct scx_sched *sch;
43284392
43294393 percpu_down_read(&scx_cgroup_ops_rwsem);
4394+ sch = scx_root;
43304395
43314396 if (scx_cgroup_enabled && SCX_HAS_OP(sch, cgroup_set_weight) &&
43324397 tg->scx.weight != weight)
@@ -4339,9 +4404,10 @@ void scx_group_set_weight(struct task_group *tg, unsigned long weight) · 6 unmodified lines
43394404
43404405 void scx_group_set_idle(struct task_group *tg, bool idle)
43414406 {
4342− struct scx_sched *sch = scx_root;
4407+ struct scx_sched *sch;
43434408
43444409 percpu_down_read(&scx_cgroup_ops_rwsem);
4410+ sch = scx_root;
43454411
43464412 if (scx_cgroup_enabled && SCX_HAS_OP(sch, cgroup_set_idle))
43474413 SCX_CALL_OP(sch, cgroup_set_idle, NULL, tg_cgrp(tg), idle);
@@ -4355,9 +4421,10 @@ void scx_group_set_idle(struct task_group *tg, bool idle) · 7 unmodified lines
43554421 void scx_group_set_bandwidth(struct task_group *tg,
43564422 u64 period_us, u64 quota_us, u64 burst_us)
43574423 {
4358− struct scx_sched *sch = scx_root;
4424+ struct scx_sched *sch;
43594425
43604426 percpu_down_read(&scx_cgroup_ops_rwsem);
4427+ sch = scx_root;
43614428
43624429 if (scx_cgroup_enabled && SCX_HAS_OP(sch, cgroup_set_bandwidth) &&
43634430 (tg->scx.bw_period_us != period_us ||
@@ -4380,21 +4447,6 @@ static struct cgroup *root_cgroup(void) · 16 unmodified lines
43804447 return &cgrp_dfl_root.cgrp;
43814448 }
43824449
4383−static struct cgroup *sch_cgroup(struct scx_sched *sch)
4384−{
4385− return sch->cgrp;
4386−}
4387−
4388−/* for each descendant of @cgrp including self, set ->scx_sched to @sch */
4389−static void set_cgroup_sched(struct cgroup *cgrp, struct scx_sched *sch)
4390−{
4391− struct cgroup *pos;
4392− struct cgroup_subsys_state *css;
4393−
4394− cgroup_for_each_live_descendant_pre(pos, css, cgrp)
4395− rcu_assign_pointer(pos->scx_sched, sch);
4396−}
4397−
43984450 static void scx_cgroup_lock(void)
43994451 {
44004452 #ifdef CONFIG_EXT_GROUP_SCHED
@@ -4412,12 +4464,30 @@ static void scx_cgroup_unlock(void) · 11 unmodified lines
44124464 }
44134465 #else /* CONFIG_EXT_GROUP_SCHED || CONFIG_EXT_SUB_SCHED */
44144466 static struct cgroup *root_cgroup(void) { return NULL; }
4415−static struct cgroup *sch_cgroup(struct scx_sched *sch) { return NULL; }
4416−static void set_cgroup_sched(struct cgroup *cgrp, struct scx_sched *sch) {}
44174467 static void scx_cgroup_lock(void) {}
44184468 static void scx_cgroup_unlock(void) {}
44194469 #endif /* CONFIG_EXT_GROUP_SCHED || CONFIG_EXT_SUB_SCHED */
44204470
4471+#ifdef CONFIG_EXT_SUB_SCHED
4472+static struct cgroup *sch_cgroup(struct scx_sched *sch)
4473+{
4474+ return sch->cgrp;
4475+}
4476+
4477+/* for each descendant of @cgrp including self, set ->scx_sched to @sch */
4478+static void set_cgroup_sched(struct cgroup *cgrp, struct scx_sched *sch)
4479+{
4480+ struct cgroup *pos;
4481+ struct cgroup_subsys_state *css;
4482+
4483+ cgroup_for_each_live_descendant_pre(pos, css, cgrp)
4484+ rcu_assign_pointer(pos->scx_sched, sch);
4485+}
4486+#else /* CONFIG_EXT_SUB_SCHED */
4487+static struct cgroup *sch_cgroup(struct scx_sched *sch) { return NULL; }
4488+static void set_cgroup_sched(struct cgroup *cgrp, struct scx_sched *sch) {}
4489+#endif /* CONFIG_EXT_SUB_SCHED */
4490+
44214491 /*
44224492 * Omitted operations:
44234493 *
@@ -4712,6 +4782,8 @@ static void scx_sched_free_rcu_work(struct work_struct *work) · 288 unmodified lines
47124782 irq_work_sync(&sch->disable_irq_work);
47134783 kthread_destroy_worker(sch->helper);
47144784 timer_shutdown_sync(&sch->bypass_lb_timer);
4785+ free_cpumask_var(sch->bypass_lb_donee_cpumask);
4786+ free_cpumask_var(sch->bypass_lb_resched_cpumask);
47154787
47164788 #ifdef CONFIG_EXT_SUB_SCHED
47174789 kfree(sch->cgrp_path);
@@ -4938,6 +5010,25 @@ void scx_softlockup(u32 dur_s) · 220 unmodified lines
49385010 smp_processor_id(), dur_s);
49395011 }
49405012
5013+/*
5014+ * scx_hardlockup() runs from NMI and eventually calls scx_claim_exit(),
5015+ * which takes scx_sched_lock. scx_sched_lock isn't NMI-safe and grabbing
5016+ * it from NMI context can lead to deadlocks. Defer via irq_work; the
5017+ * disable path runs off irq_work anyway.
5018+ */
5019+static atomic_t scx_hardlockup_cpu = ATOMIC_INIT(-1);
5020+
5021+static void scx_hardlockup_irq_workfn(struct irq_work *work)
5022+{
5023+ int cpu = atomic_xchg(&scx_hardlockup_cpu, -1);
5024+
5025+ if (cpu >= 0 && handle_lockup("hard lockup - CPU %d", cpu))
5026+ printk_deferred(KERN_ERR "sched_ext: Hard lockup - CPU %d, disabling BPF scheduler\n",
5027+ cpu);
5028+}
5029+
5030+static DEFINE_IRQ_WORK(scx_hardlockup_irq_work, scx_hardlockup_irq_workfn);
5031+
49415032 /**
49425033 * scx_hardlockup - sched_ext hardlockup handler
49435034 *
@@ -4946,17 +5037,19 @@ void scx_softlockup(u32 dur_s) · 2 unmodified lines
49465037 * Try kicking out the current scheduler in an attempt to recover the system to
49475038 * a good state before taking more drastic actions.
49485039 *
4949− * Returns %true if sched_ext is enabled and abort was initiated, which may
4950− * resolve the reported hardlockup. %false if sched_ext is not enabled or
4951− * someone else already initiated abort.
5040+ * Queues an irq_work; the handle_lockup() call happens in IRQ context (see
5041+ * scx_hardlockup_irq_workfn).
5042+ *
5043+ * Returns %true if sched_ext is enabled and the work was queued, %false
5044+ * otherwise.
49525045 */
49535046 bool scx_hardlockup(int cpu)
49545047 {
4955− if (!handle_lockup("hard lockup - CPU %d", cpu))
5048+ if (!rcu_access_pointer(scx_root))
49565049 return false;
49575050
4958− printk_deferred(KERN_ERR "sched_ext: Hard lockup - CPU %d, disabling BPF scheduler\n",
4959− cpu);
5051+ atomic_cmpxchg(&scx_hardlockup_cpu, -1, cpu);
5052+ irq_work_queue(&scx_hardlockup_irq_work);
49605053 return true;
49615054 }
49625055
@@ -5000,6 +5093,15 @@ resume: · 37 unmodified lines
50005093 if (cpumask_empty(donee_mask))
50015094 break;
50025095
5096+ /*
5097+ * If an earlier pass placed @p on @donor_dsq from a different
5098+ * CPU and the donee hasn't consumed it yet, @p is still on the
5099+ * previous CPU and task_rq(@p) != @donor_rq. @p can't be moved
5100+ * without its rq locked. Skip.
5101+ */
5102+ if (task_rq(p) != donor_rq)
5103+ continue;
5104+
50035105 donee = cpumask_any_and_distribute(donee_mask, p->cpus_ptr);
50045106 if (donee >= nr_cpu_ids)
50055107 continue;
@@ -5058,8 +5160,8 @@ resume: · 52 unmodified lines
50585160 static void bypass_lb_node(struct scx_sched *sch, int node)
50595161 {
50605162 const struct cpumask *node_mask = cpumask_of_node(node);
5061− struct cpumask *donee_mask = scx_bypass_lb_donee_cpumask;
5062− struct cpumask *resched_mask = scx_bypass_lb_resched_cpumask;
5163+ struct cpumask *donee_mask = sch->bypass_lb_donee_cpumask;
5164+ struct cpumask *resched_mask = sch->bypass_lb_resched_cpumask;
50635165 u32 nr_tasks = 0, nr_cpus = 0, nr_balanced = 0;
50645166 u32 nr_target, nr_donor_target;
50655167 u32 before_min = U32_MAX, before_max = 0;
@@ -5698,6 +5800,8 @@ static void scx_sub_disable(struct scx_sched *sch) · 632 unmodified lines
56985800
56995801 if (sch->ops.exit)
57005802 SCX_CALL_OP(sch, exit, NULL, sch->exit_info);
5803+ if (sch->sub_kset)
5804+ kset_unregister(sch->sub_kset);
57015805 kobject_del(&sch->kobj);
57025806 }
57035807 #else /* CONFIG_EXT_SUB_SCHED */
@@ -5829,6 +5933,10 @@ static void scx_root_disable(struct scx_sched *sch) · 125 unmodified lines
58295933 * could observe an object of the same name still in the hierarchy when
58305934 * the next scheduler is loaded.
58315935 */
5936+#ifdef CONFIG_EXT_SUB_SCHED
5937+ if (sch->sub_kset)
5938+ kset_unregister(sch->sub_kset);
5939+#endif
58325940 kobject_del(&sch->kobj);
58335941
58345942 free_kick_syncs();
@@ -5921,6 +6029,25 @@ static void scx_disable(struct scx_sched *sch, enum scx_exit_kind kind) · 86 unmodified lines
59216029 irq_work_queue(&sch->disable_irq_work);
59226030 }
59236031
6032+/**
6033+ * scx_flush_disable_work - flush the disable work and wait for it to finish
6034+ * @sch: the scheduler
6035+ *
6036+ * sch->disable_work might still not queued, causing kthread_flush_work()
6037+ * as a noop. Syncing the irq_work first is required to guarantee the
6038+ * kthread work has been queued before waiting for it.
6039+ */
6040+static void scx_flush_disable_work(struct scx_sched *sch)
6041+{
6042+ int kind;
6043+
6044+ do {
6045+ irq_work_sync(&sch->disable_irq_work);
6046+ kthread_flush_work(&sch->disable_work);
6047+ kind = atomic_read(&sch->exit_kind);
6048+ } while (kind != SCX_EXIT_NONE && kind != SCX_EXIT_DONE);
6049+}
6050+
59246051 static void dump_newline(struct seq_buf *s)
59256052 {
59266053 trace_sched_ext_dump("");
@@ -6032,9 +6159,8 @@ static void ops_dump_exit(void) · 105 unmodified lines
60326159 scx_dump_data.cpu = -1;
60336160 }
60346161
6035−static void scx_dump_task(struct scx_sched *sch,
6036− struct seq_buf *s, struct scx_dump_ctx *dctx,
6037− struct task_struct *p, char marker)
6162+static void scx_dump_task(struct scx_sched *sch, struct seq_buf *s, struct scx_dump_ctx *dctx,
6163+ struct rq *rq, struct task_struct *p, char marker)
60386164 {
60396165 static unsigned long bt[SCX_EXIT_BT_LEN];
60406166 struct scx_sched *task_sch = scx_task_sched(p);
@@ -6075,7 +6201,7 @@ static void scx_dump_task(struct scx_sched *sch, · 34 unmodified lines
60756201
60766202 if (SCX_HAS_OP(sch, dump_task)) {
60776203 ops_dump_init(s, " ");
6078− SCX_CALL_OP(sch, dump_task, NULL, dctx, p);
6204+ SCX_CALL_OP(sch, dump_task, rq, dctx, p);
60796205 ops_dump_exit();
60806206 }
60816207
@@ -6199,8 +6325,7 @@ static void scx_dump_state(struct scx_sched *sch, struct scx_exit_info *ei, · 117 unmodified lines
61996325 used = seq_buf_used(&ns);
62006326 if (SCX_HAS_OP(sch, dump_cpu)) {
62016327 ops_dump_init(&ns, " ");
6202− SCX_CALL_OP(sch, dump_cpu, NULL,
6203− &dctx, cpu, idle);
6328+ SCX_CALL_OP(sch, dump_cpu, rq, &dctx, cpu, idle);
62046329 ops_dump_exit();
62056330 }
62066331
@@ -6223,11 +6348,11 @@ static void scx_dump_state(struct scx_sched *sch, struct scx_exit_info *ei, · 16 unmodified lines
62236348
62246349 if (rq->curr->sched_class == &ext_sched_class &&
62256350 (dump_all_tasks || scx_task_on_sched(sch, rq->curr)))
6226− scx_dump_task(sch, &s, &dctx, rq->curr, '*');
6351+ scx_dump_task(sch, &s, &dctx, rq, rq->curr, '*');
62276352
62286353 list_for_each_entry(p, &rq->scx.runnable_list, scx.runnable_node)
62296354 if (dump_all_tasks || scx_task_on_sched(sch, p))
6230− scx_dump_task(sch, &s, &dctx, p, ' ');
6355+ scx_dump_task(sch, &s, &dctx, rq, p, ' ');
62316356 next:
62326357 rq_unlock_irqrestore(rq, &rf);
62336358 }
@@ -6437,6 +6562,15 @@ static struct scx_sched *scx_alloc_and_add_sched(struct sched_ext_ops *ops, · 203 unmodified lines
64376562 init_irq_work(&sch->disable_irq_work, scx_disable_irq_workfn);
64386563 kthread_init_work(&sch->disable_work, scx_disable_workfn);
64396564 timer_setup(&sch->bypass_lb_timer, scx_bypass_lb_timerfn, 0);
6565+
6566+ if (!alloc_cpumask_var(&sch->bypass_lb_donee_cpumask, GFP_KERNEL)) {
6567+ ret = -ENOMEM;
6568+ goto err_stop_helper;
6569+ }
6570+ if (!alloc_cpumask_var(&sch->bypass_lb_resched_cpumask, GFP_KERNEL)) {
6571+ ret = -ENOMEM;
6572+ goto err_free_lb_cpumask;
6573+ }
64406574 sch->ops = *ops;
64416575 rcu_assign_pointer(ops->priv, sch);
64426576
@@ -6446,14 +6580,14 @@ static struct scx_sched *scx_alloc_and_add_sched(struct sched_ext_ops *ops, · 3 unmodified lines
64466580 char *buf = kzalloc(PATH_MAX, GFP_KERNEL);
64476581 if (!buf) {
64486582 ret = -ENOMEM;
6449− goto err_stop_helper;
6583+ goto err_free_lb_resched;
64506584 }
64516585 cgroup_path(cgrp, buf, PATH_MAX);
64526586 sch->cgrp_path = kstrdup(buf, GFP_KERNEL);
64536587 kfree(buf);
64546588 if (!sch->cgrp_path) {
64556589 ret = -ENOMEM;
6456− goto err_stop_helper;
6590+ goto err_free_lb_resched;
64576591 }
64586592
64596593 sch->cgrp = cgrp;
@@ -6488,10 +6622,12 @@ static struct scx_sched *scx_alloc_and_add_sched(struct sched_ext_ops *ops, · 28 unmodified lines
64886622 #endif /* CONFIG_EXT_SUB_SCHED */
64896623 return sch;
64906624
6491−#ifdef CONFIG_EXT_SUB_SCHED
6625+err_free_lb_resched:
6626+ free_cpumask_var(sch->bypass_lb_resched_cpumask);
6627+err_free_lb_cpumask:
6628+ free_cpumask_var(sch->bypass_lb_donee_cpumask);
64926629 err_stop_helper:
64936630 kthread_destroy_worker(sch->helper);
6494−#endif
64956631 err_free_pcpu:
64966632 for_each_possible_cpu(cpu) {
64976633 if (cpu == bypass_fail_cpu)
@@ -6510,7 +6646,7 @@ err_free_ei: · 12 unmodified lines
65106646 err_free_sch:
65116647 kfree(sch);
65126648 err_put_cgrp:
6513−#if defined(CONFIG_EXT_GROUP_SCHED) || defined(CONFIG_EXT_SUB_SCHED)
6649+#ifdef CONFIG_EXT_SUB_SCHED
65146650 cgroup_put(cgrp);
65156651 #endif
65166652 return ERR_PTR(ret);
@@ -6601,7 +6737,7 @@ static void scx_root_enable_workfn(struct kthread_work *work) · 84 unmodified lines
66016737 if (ret)
66026738 goto err_unlock;
66036739
6604−#if defined(CONFIG_EXT_GROUP_SCHED) || defined(CONFIG_EXT_SUB_SCHED)
6740+#ifdef CONFIG_EXT_SUB_SCHED
66056741 cgroup_get(cgrp);
66066742 #endif
66076743 sch = scx_alloc_and_add_sched(ops, cgrp, NULL);
@@ -6639,8 +6775,10 @@ static void scx_root_enable_workfn(struct kthread_work *work) · 31 unmodified lines
66396775 rcu_assign_pointer(scx_root, sch);
66406776
66416777 ret = scx_link_sched(sch);
6642− if (ret)
6778+ if (ret) {
6779+ cpus_read_unlock();
66436780 goto err_disable;
6781+ }
66446782
66456783 scx_idle_enable(ops);
66466784
@@ -6821,7 +6959,7 @@ err_disable: · 174 unmodified lines
68216959 * completion. sch's base reference will be put by bpf_scx_unreg().
68226960 */
68236961 scx_error(sch, "scx_root_enable() failed (%d)", ret);
6824− kthread_flush_work(&sch->disable_work);
6962+ scx_flush_disable_work(sch);
68256963 cmd->ret = 0;
68266964 }
68276965
@@ -7072,23 +7210,30 @@ out_unlock: · 244 unmodified lines
70727210 abort:
70737211 put_task_struct(p);
70747212 scx_task_iter_stop(&sti);
7075− scx_enabling_sub_sched = NULL;
70767213
7214+ /*
7215+ * Undo __scx_init_task() for tasks we marked. scx_enable_task() never
7216+ * ran for @sch on them, so calling scx_disable_task() here would invoke
7217+ * ops.disable() without a matching ops.enable(). scx_enabling_sub_sched
7218+ * must stay set until SUB_INIT is cleared from every marked task -
7219+ * scx_disable_and_exit_task() reads it when a task exits concurrently.
7220+ */
70777221 scx_task_iter_start(&sti, sch->cgrp);
70787222 while ((p = scx_task_iter_next_locked(&sti))) {
70797223 if (p->scx.flags & SCX_TASK_SUB_INIT) {
7080− __scx_disable_and_exit_task(sch, p);
7224+ scx_sub_init_cancel_task(sch, p);
70817225 p->scx.flags &= ~SCX_TASK_SUB_INIT;
70827226 }
70837227 }
70847228 scx_task_iter_stop(&sti);
7229+ scx_enabling_sub_sched = NULL;
70857230 err_unlock_and_disable:
70867231 /* we'll soon enter disable path, keep bypass on */
70877232 scx_cgroup_unlock();
70887233 percpu_up_write(&scx_fork_rwsem);
70897234 err_disable:
70907235 mutex_unlock(&scx_enable_mutex);
7091− kthread_flush_work(&sch->disable_work);
7236+ scx_flush_disable_work(sch);
70927237 cmd->ret = 0;
70937238 }
70947239
@@ -7349,7 +7494,7 @@ static void bpf_scx_unreg(void *kdata, struct bpf_link *link) · 254 unmodified lines
73497494 struct scx_sched *sch = rcu_dereference_protected(ops->priv, true);
73507495
73517496 scx_disable(sch, SCX_EXIT_UNREG);
7352− kthread_flush_work(&sch->disable_work);
7497+ scx_flush_disable_work(sch);
73537498 RCU_INIT_POINTER(ops->priv, NULL);
73547499 kobject_put(&sch->kobj);
73557500 }
@@ -8033,12 +8178,22 @@ static bool scx_dsq_move(struct bpf_iter_scx_dsq_kern *kit, · 677 unmodified lines
80338178 struct task_struct *p, u64 dsq_id, u64 enq_flags)
80348179 {
80358180 struct scx_dispatch_q *src_dsq = kit->dsq, *dst_dsq;
8036− struct scx_sched *sch = src_dsq->sched;
8181+ struct scx_sched *sch;
80378182 struct rq *this_rq, *src_rq, *locked_rq;
80388183 bool dispatched = false;
80398184 bool in_balance;
80408185 unsigned long flags;
80418186
8187+ /*
8188+ * The verifier considers an iterator slot initialized on any
8189+ * KF_ITER_NEW return, so a BPF program may legally reach here after
8190+ * bpf_iter_scx_dsq_new() failed and left @kit->dsq NULL.
8191+ */
8192+ if (unlikely(!src_dsq))
8193+ return false;
8194+
8195+ sch = src_dsq->sched;
8196+
80428197 if (!scx_vet_enq_flags(sch, dsq_id, &enq_flags))
80438198 return false;
80448199
@@ -8526,7 +8681,7 @@ __bpf_kfunc bool scx_bpf_task_set_slice(struct task_struct *p, u64 slice, · 481 unmodified lines
85268681
85278682 guard(rcu)();
85288683 sch = scx_prog_sched(aux);
8529− if (unlikely(!scx_task_on_sched(sch, p)))
8684+ if (unlikely(!sch || !scx_task_on_sched(sch, p)))
85308685 return false;
85318686
85328687 p->scx.slice = slice;
@@ -8549,7 +8704,7 @@ __bpf_kfunc bool scx_bpf_task_set_dsq_vtime(struct task_struct *p, u64 vtime, · 16 unmodified lines
85498704
85508705 guard(rcu)();
85518706 sch = scx_prog_sched(aux);
8552− if (unlikely(!scx_task_on_sched(sch, p)))
8707+ if (unlikely(!sch || !scx_task_on_sched(sch, p)))
85538708 return false;
85548709
85558710 p->scx.dsq_vtime = vtime;
@@ -8633,11 +8788,12 @@ __bpf_kfunc void scx_bpf_kick_cpu(s32 cpu, u64 flags, const struct bpf_prog_aux · 77 unmodified lines
86338788 /**
86348789 * scx_bpf_dsq_nr_queued - Return the number of queued tasks
86358790 * @dsq_id: id of the DSQ
8791+ * @aux: implicit BPF argument to access bpf_prog_aux hidden from BPF progs
86368792 *
86378793 * Return the number of tasks in the DSQ matching @dsq_id. If not found,
86388794 * -%ENOENT is returned.
86398795 */
8640−__bpf_kfunc s32 scx_bpf_dsq_nr_queued(u64 dsq_id)
8796+__bpf_kfunc s32 scx_bpf_dsq_nr_queued(u64 dsq_id, const struct bpf_prog_aux *aux)
86418797 {
86428798 struct scx_sched *sch;
86438799 struct scx_dispatch_q *dsq;
@@ -8645,7 +8801,7 @@ __bpf_kfunc s32 scx_bpf_dsq_nr_queued(u64 dsq_id) · 1 unmodified line
86458801
86468802 preempt_disable();
86478803
8648− sch = rcu_dereference_sched(scx_root);
8804+ sch = scx_prog_sched(aux);
86498805 if (unlikely(!sch)) {
86508806 ret = -ENODEV;
86518807 goto out;
@@ -8677,21 +8833,21 @@ out: · 25 unmodified lines
86778833 /**
86788834 * scx_bpf_destroy_dsq - Destroy a custom DSQ
86798835 * @dsq_id: DSQ to destroy
8836+ * @aux: implicit BPF argument to access bpf_prog_aux hidden from BPF progs
86808837 *
86818838 * Destroy the custom DSQ identified by @dsq_id. Only DSQs created with
86828839 * scx_bpf_create_dsq() can be destroyed. The caller must ensure that the DSQ is
86838840 * empty and no further tasks are dispatched to it. Ignored if called on a DSQ
86848841 * which doesn't exist. Can be called from any online scx_ops operations.
86858842 */
8686−__bpf_kfunc void scx_bpf_destroy_dsq(u64 dsq_id)
8843+__bpf_kfunc void scx_bpf_destroy_dsq(u64 dsq_id, const struct bpf_prog_aux *aux)
86878844 {
86888845 struct scx_sched *sch;
86898846
8690− rcu_read_lock();
8691− sch = rcu_dereference(scx_root);
8847+ guard(rcu)();
8848+ sch = scx_prog_sched(aux);
86928849 if (sch)
86938850 destroy_dsq(sch, dsq_id);
8694− rcu_read_unlock();
86958851 }
86968852
86978853 /**
@@ -9445,8 +9601,8 @@ BTF_KFUNCS_START(scx_kfunc_ids_any) · 747 unmodified lines
94459601 BTF_ID_FLAGS(func, scx_bpf_task_set_slice, KF_IMPLICIT_ARGS | KF_RCU);
94469602 BTF_ID_FLAGS(func, scx_bpf_task_set_dsq_vtime, KF_IMPLICIT_ARGS | KF_RCU);
94479603 BTF_ID_FLAGS(func, scx_bpf_kick_cpu, KF_IMPLICIT_ARGS)
9448−BTF_ID_FLAGS(func, scx_bpf_dsq_nr_queued)
9449−BTF_ID_FLAGS(func, scx_bpf_destroy_dsq)
9604+BTF_ID_FLAGS(func, scx_bpf_dsq_nr_queued, KF_IMPLICIT_ARGS)
9605+BTF_ID_FLAGS(func, scx_bpf_destroy_dsq, KF_IMPLICIT_ARGS)
94509606 BTF_ID_FLAGS(func, scx_bpf_dsq_peek, KF_IMPLICIT_ARGS | KF_RCU_PROTECTED | KF_RET_NULL)
94519607 BTF_ID_FLAGS(func, scx_bpf_dsq_reenq, KF_IMPLICIT_ARGS)
94529608 BTF_ID_FLAGS(func, scx_bpf_reenqueue_local___v2, KF_IMPLICIT_ARGS)
@@ -9479,6 +9635,7 @@ BTF_KFUNCS_END(scx_kfunc_ids_any) · 26 unmodified lines
94799635 static const struct btf_kfunc_id_set scx_kfunc_set_any = {
94809636 .owner = THIS_MODULE,
94819637 .set = &scx_kfunc_ids_any,
9638+ .filter = scx_kfunc_context_filter,
94829639 };
94839640
94849641 /*
@@ -9526,13 +9683,12 @@ static const u32 scx_kf_allow_flags[] = { · 41 unmodified lines
95269683 };
95279684
95289685 /*
9529− * Verifier-time filter for context-sensitive SCX kfuncs. Registered via the
9530− * .filter field on each per-group btf_kfunc_id_set. The BPF core invokes this
9531− * for every kfunc call in the registered hook (BPF_PROG_TYPE_STRUCT_OPS or
9686+ * Verifier-time filter for SCX kfuncs. Registered via the .filter field on
9687+ * each per-group btf_kfunc_id_set. The BPF core invokes this for every kfunc
9688+ * call in the registered hook (BPF_PROG_TYPE_STRUCT_OPS or
95329689 * BPF_PROG_TYPE_SYSCALL), regardless of which set originally introduced the
9533− * kfunc - so the filter must short-circuit on kfuncs it doesn't govern (e.g.
9534− * scx_kfunc_ids_any) by falling through to "allow" when none of the
9535− * context-sensitive sets contain the kfunc.
9690+ * kfunc - so the filter must short-circuit on kfuncs it doesn't govern by
9691+ * falling through to "allow" when none of the SCX sets contain the kfunc.
95369692 */
95379693 int scx_kfunc_context_filter(const struct bpf_prog *prog, u32 kfunc_id)
95389694 {
@@ -9541,18 +9697,21 @@ int scx_kfunc_context_filter(const struct bpf_prog *prog, u32 kfunc_id) · 2 unmodified lines
95419697 bool in_enqueue = btf_id_set8_contains(&scx_kfunc_ids_enqueue_dispatch, kfunc_id);
95429698 bool in_dispatch = btf_id_set8_contains(&scx_kfunc_ids_dispatch, kfunc_id);
95439699 bool in_cpu_release = btf_id_set8_contains(&scx_kfunc_ids_cpu_release, kfunc_id);
9700+ bool in_idle = btf_id_set8_contains(&scx_kfunc_ids_idle, kfunc_id);
9701+ bool in_any = btf_id_set8_contains(&scx_kfunc_ids_any, kfunc_id);
95449702 u32 moff, flags;
95459703
9546− /* Not a context-sensitive kfunc (e.g. from scx_kfunc_ids_any) - allow. */
9547− if (!(in_unlocked || in_select_cpu || in_enqueue || in_dispatch || in_cpu_release))
9704+ /* Not an SCX kfunc - allow. */
9705+ if (!(in_unlocked || in_select_cpu || in_enqueue || in_dispatch ||
9706+ in_cpu_release || in_idle || in_any))
95489707 return 0;
95499708
95509709 /* SYSCALL progs (e.g. BPF test_run()) may call unlocked and select_cpu kfuncs. */
95519710 if (prog->type == BPF_PROG_TYPE_SYSCALL)
9552− return (in_unlocked || in_select_cpu) ? 0 : -EACCES;
9711+ return (in_unlocked || in_select_cpu || in_idle || in_any) ? 0 : -EACCES;
95539712
95549713 if (prog->type != BPF_PROG_TYPE_STRUCT_OPS)
9555− return -EACCES;
9714+ return (in_any || in_idle) ? 0 : -EACCES;
95569715
95579716 /*
95589717 * add_subprog_and_kfunc() collects all kfunc calls, including dead code
@@ -9565,14 +9724,15 @@ int scx_kfunc_context_filter(const struct bpf_prog *prog, u32 kfunc_id) · 6 unmodified lines
95659724 return 0;
95669725
95679726 /*
9568− * Non-SCX struct_ops: only unlocked kfuncs are safe. The other
9569− * context-sensitive kfuncs assume the rq lock is held by the SCX
9570− * dispatch path, which doesn't apply to other struct_ops users.
9727+ * Non-SCX struct_ops: SCX kfuncs are not permitted.
95719728 */
95729729 if (prog->aux->st_ops != &bpf_sched_ext_ops)
9573− return in_unlocked ? 0 : -EACCES;
9730+ return -EACCES;
95749731
95759732 /* SCX struct_ops: check the per-op allow list. */
9733+ if (in_any || in_idle)
9734+ return 0;
9735+
95769736 moff = prog->aux->attach_st_ops_member_off;
95779737 flags = scx_kf_allow_flags[SCX_MOFF_IDX(moff)];
95789738
@@ -9656,12 +9816,6 @@ static int __init scx_init(void) · 77 unmodified lines
96569816 return ret;
96579817 }
96589818
9659− if (!alloc_cpumask_var(&scx_bypass_lb_donee_cpumask, GFP_KERNEL) ||
9660− !alloc_cpumask_var(&scx_bypass_lb_resched_cpumask, GFP_KERNEL)) {
9661− pr_err("sched_ext: Failed to allocate cpumasks\n");
9662− return -ENOMEM;
9663− }
9664−
96659819 return 0;
96669820 }
96679821 __initcall(scx_init);
kernel/sched/ext_idle.c+18−2
@@ -927,14 +927,24 @@ static s32 select_cpu_from_kfunc(struct scx_sched *sch, struct task_struct *p, · 926 unmodified lines
927927 * Accessing p->cpus_ptr / p->nr_cpus_allowed needs either @p's rq
928928 * lock or @p's pi_lock. Three cases:
929929 *
930− * - inside ops.select_cpu(): try_to_wake_up() holds @p's pi_lock.
930+ * - inside ops.select_cpu(): try_to_wake_up() holds the wake-up
931+ * task's pi_lock; the wake-up task is recorded in kf_tasks[0]
932+ * by SCX_CALL_OP_TASK_RET().
931933 * - other rq-locked SCX op: scx_locked_rq() points at the held rq.
932934 * - truly unlocked (UNLOCKED ops, SYSCALL, non-SCX struct_ops):
933935 * nothing held, take pi_lock ourselves.
936+ *
937+ * In the first two cases, BPF schedulers may pass an arbitrary task
938+ * that the held lock doesn't cover. Refuse those.
934939 */
935940 if (this_rq()->scx.in_select_cpu) {
941+ if (!scx_kf_arg_task_ok(sch, p))
942+ return -EINVAL;
936943 lockdep_assert_held(&p->pi_lock);
937− } else if (!scx_locked_rq()) {
944+ } else if (scx_locked_rq()) {
945+ if (task_rq(p) != scx_locked_rq())
946+ goto cross_task;
947+ } else {
938948 raw_spin_lock_irqsave(&p->pi_lock, irq_flags);
939949 we_locked = true;
940950 }
@@ -960,6 +970,11 @@ static s32 select_cpu_from_kfunc(struct scx_sched *sch, struct task_struct *p, · 19 unmodified lines
960970 raw_spin_unlock_irqrestore(&p->pi_lock, irq_flags);
961971
962972 return cpu;
973+
974+cross_task:
975+ scx_error(sch, "select_cpu kfunc called cross-task on %s[%d]",
976+ p->comm, p->pid);
977+ return -EINVAL;
963978 }
964979
965980 /**
@@ -1467,6 +1482,7 @@ BTF_KFUNCS_END(scx_kfunc_ids_idle) · 501 unmodified lines
14671482 static const struct btf_kfunc_id_set scx_kfunc_set_idle = {
14681483 .owner = THIS_MODULE,
14691484 .set = &scx_kfunc_ids_idle,
1485+ .filter = scx_kfunc_context_filter,
14701486 };
14711487
14721488 /*
kernel/sched/ext_idle.h+1−0
@@ -12,6 +12,7 @@ · 11 unmodified lines
1212
1313 struct sched_ext_ops;
1414
15+extern struct btf_id_set8 scx_kfunc_ids_idle;
1516 extern struct btf_id_set8 scx_kfunc_ids_select_cpu;
1617
1718 void scx_idle_update_selcpu_topology(struct sched_ext_ops *ops);
kernel/sched/ext_internal.h+2−0
@@ -1075,6 +1075,8 @@ struct scx_sched { · 1074 unmodified lines
10751075 struct irq_work disable_irq_work;
10761076 struct kthread_work disable_work;
10771077 struct timer_list bypass_lb_timer;
1078+ cpumask_var_t bypass_lb_donee_cpumask;
1079+ cpumask_var_t bypass_lb_resched_cpumask;
10781080 struct rcu_work rcu_work;
10791081
10801082 /* all ancestors including self */
kernel/sched/fair.c+24−18
@@ -847,13 +847,19 @@ static s64 entity_lag(struct cfs_rq *cfs_rq, struct sched_entity *se, u64 avrunt · 846 unmodified lines
847847 * Similarly, check that the entity didn't gain positive lag when DELAY_ZERO
848848 * is set.
849849 *
850− * Return true if the lag has been adjusted.
850+ * Return true if the vlag has been modified. Specifically:
851+ *
852+ * se->vlag != avg_vruntime() - se->vruntime
853+ *
854+ * This can be due to clamping in entity_lag() or clamping due to
855+ * sched_delayed. Either way, when vlag is modified and the entity is
856+ * retained, the tree needs to be adjusted.
851857 */
852858 static __always_inline
853859 bool update_entity_lag(struct cfs_rq *cfs_rq, struct sched_entity *se)
854860 {
855− s64 vlag = entity_lag(cfs_rq, se, avg_vruntime(cfs_rq));
856− bool ret;
861+ u64 avruntime = avg_vruntime(cfs_rq);
862+ s64 vlag = entity_lag(cfs_rq, se, avruntime);
857863
858864 WARN_ON_ONCE(!se->on_rq);
859865
@@ -863,10 +869,9 @@ bool update_entity_lag(struct cfs_rq *cfs_rq, struct sched_entity *se) · 3 unmodified lines
863869 if (sched_feat(DELAY_ZERO))
864870 vlag = min(vlag, 0);
865871 }
866− ret = (vlag == se->vlag);
867872 se->vlag = vlag;
868873
869− return ret;
874+ return avruntime - vlag != se->vruntime;
870875 }
871876
872877 /*
@@ -1099,7 +1104,7 @@ static inline void cancel_protect_slice(struct sched_entity *se) · 226 unmodified lines
10991104 *
11001105 * Which allows tree pruning through eligibility.
11011106 */
1102−static struct sched_entity *__pick_eevdf(struct cfs_rq *cfs_rq, bool protect)
1107+static struct sched_entity *pick_eevdf(struct cfs_rq *cfs_rq, bool protect)
11031108 {
11041109 struct rb_node *node = cfs_rq->tasks_timeline.rb_root.rb_node;
11051110 struct sched_entity *se = __pick_first_entity(cfs_rq);
@@ -1170,11 +1175,6 @@ found: · 64 unmodified lines
11701175 return best;
11711176 }
11721177
1173−static struct sched_entity *pick_eevdf(struct cfs_rq *cfs_rq)
1174−{
1175− return __pick_eevdf(cfs_rq, true);
1176−}
1177−
11781178 struct sched_entity *__pick_last_entity(struct cfs_rq *cfs_rq)
11791179 {
11801180 struct rb_node *last = rb_last(&cfs_rq->tasks_timeline.rb_root);
@@ -5749,11 +5749,11 @@ static int dequeue_entities(struct rq *rq, struct sched_entity *se, int flags); · 4568 unmodified lines
57495749 * 4) do not run the "skip" process, if something else is available
57505750 */
57515751 static struct sched_entity *
5752−pick_next_entity(struct rq *rq, struct cfs_rq *cfs_rq)
5752+pick_next_entity(struct rq *rq, struct cfs_rq *cfs_rq, bool protect)
57535753 {
57545754 struct sched_entity *se;
57555755
5756− se = pick_eevdf(cfs_rq);
5756+ se = pick_eevdf(cfs_rq, protect);
57575757 if (se->sched_delayed) {
57585758 dequeue_entities(rq, se, DEQUEUE_SLEEP | DEQUEUE_DELAYED);
57595759 /*
@@ -9027,7 +9027,7 @@ static void wakeup_preempt_fair(struct rq *rq, struct task_struct *p, int wake_f · 3267 unmodified lines
90279027 {
90289028 enum preempt_wakeup_action preempt_action = PREEMPT_WAKEUP_PICK;
90299029 struct task_struct *donor = rq->donor;
9030− struct sched_entity *se = &donor->se, *pse = &p->se;
9030+ struct sched_entity *nse, *se = &donor->se, *pse = &p->se;
90319031 struct cfs_rq *cfs_rq = task_cfs_rq(donor);
90329032 int cse_is_idle, pse_is_idle;
90339033
@@ -9138,11 +9138,17 @@ static void wakeup_preempt_fair(struct rq *rq, struct task_struct *p, int wake_f · 104 unmodified lines
91389138 }
91399139
91409140 pick:
9141+ nse = pick_next_entity(rq, cfs_rq, preempt_action != PREEMPT_WAKEUP_SHORT);
9142+ /* If @p has become the most eligible task, force preemption */
9143+ if (nse == pse)
9144+ goto preempt;
9145+
91419146 /*
9142− * If @p has become the most eligible task, force preemption.
9147+ * Because p is enqueued, nse being null can only mean that we
9148+ * dequeued a delayed task.
91439149 */
9144− if (__pick_eevdf(cfs_rq, preempt_action != PREEMPT_WAKEUP_SHORT) == pse)
9145− goto preempt;
9150+ if (!nse)
9151+ goto pick;
91469152
91479153 if (sched_feat(RUN_TO_PARITY))
91489154 update_protect_slice(cfs_rq, se);
@@ -9179,7 +9185,7 @@ again: · 30 unmodified lines
91799185
91809186 throttled |= check_cfs_rq_runtime(cfs_rq);
91819187
9182− se = pick_next_entity(rq, cfs_rq);
9188+ se = pick_next_entity(rq, cfs_rq, true);
91839189 if (!se)
91849190 goto again;
91859191 cfs_rq = group_cfs_rq(se);
kernel/trace/trace_branch.c+4−4
@@ -373,10 +373,10 @@ __init static int init_annotated_branch_stats(void) · 372 unmodified lines
373373 int ret;
374374
375375 ret = register_stat_tracer(&annotated_branch_stats);
376− if (!ret) {
376+ if (ret) {
377377 printk(KERN_WARNING "Warning: could not register "
378378 "annotated branches stats\n");
379− return 1;
379+ return ret;
380380 }
381381 return 0;
382382 }
@@ -438,10 +438,10 @@ __init static int all_annotated_branch_stats(void) · 55 unmodified lines
438438 int ret;
439439
440440 ret = register_stat_tracer(&all_branch_stats);
441− if (!ret) {
441+ if (ret) {
442442 printk(KERN_WARNING "Warning: could not register "
443443 "all branches stats\n");
444− return 1;
444+ return ret;
445445 }
446446 return 0;
447447 }
kernel/trace/trace_probe.c+6−0
@@ -1523,6 +1523,12 @@ static int traceprobe_parse_probe_arg_body(const char *argv, ssize_t *size, · 1522 unmodified lines
15231523 parg->offset = *size;
15241524 *size += parg->type->size * (parg->count ?: 1);
15251525
1526+ if (*size > MAX_PROBE_EVENT_SIZE) {
1527+ ret = -E2BIG;
1528+ trace_probe_log_err(ctx->offset, EVENT_TOO_BIG);
1529+ goto fail;
1530+ }
1531+
15261532 if (parg->count) {
15271533 len = strlen(parg->type->fmttype) + 6;
15281534 parg->fmt = kmalloc(len, GFP_KERNEL);
kernel/trace/trace_probe.h+3−1
@@ -38,6 +38,7 @@ · 37 unmodified lines
3838 #define MAX_BTF_ARGS_LEN 128
3939 #define MAX_DENTRY_ARGS_LEN 256
4040 #define MAX_STRING_SIZE PATH_MAX
41+#define MAX_PROBE_EVENT_SIZE 3072
4142
4243 /* Reserved field names */
4344 #define FIELD_STRING_IP "__probe_ip"
@@ -561,7 +562,8 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call, · 517 unmodified lines
561562 C(BAD_TYPE4STR, "This type does not fit for string."),\
562563 C(NEED_STRING_TYPE, "$comm and immediate-string only accepts string type"),\
563564 C(TOO_MANY_ARGS, "Too many arguments are specified"), \
564− C(TOO_MANY_EARGS, "Too many entry arguments specified"),
565+ C(TOO_MANY_EARGS, "Too many entry arguments specified"), \
566+ C(EVENT_TOO_BIG, "Event too big (too many fields?)"),
565567
566568 #undef C
567569 #define C(a, b) TP_ERR_##a
lib/maple_tree.c+1−1
@@ -2,7 +2,7 @@ · 1 unmodified line
22 /*
33 * Maple Tree implementation
44 * Copyright (c) 2018-2022 Oracle Corporation
5− * Authors: Liam R. Howlett <Liam.Howlett@oracle.com>
5+ * Authors: Liam R. Howlett <liam@infradead.org>
66 * Matthew Wilcox <willy@infradead.org>
77 * Copyright (c) 2023 ByteDance
88 * Author: Peng Zhang <zhangpeng.00@bytedance.com>
lib/rhashtable.c+31−5
@@ -441,10 +441,33 @@ static void rht_deferred_worker(struct work_struct *work) · 440 unmodified lines
441441
442442 mutex_unlock(&ht->mutex);
443443
444+ /*
445+ * Re-arm via @run_work, not @run_irq_work.
446+ * rhashtable_free_and_destroy() drains async work as irq_work_sync()
447+ * followed by cancel_work_sync(). If this site queued irq_work while
448+ * cancel_work_sync() was waiting for us, irq_work_sync() would already
449+ * have returned and the stale irq_work could fire post-teardown.
450+ * cancel_work_sync() natively handles self-requeue on @run_work.
451+ */
444452 if (err)
445453 schedule_work(&ht->run_work);
446454 }
447455
456+/*
457+ * Insert-path callers can run under a raw spinlock (e.g. an insecure_elasticity
458+ * user). Calling schedule_work() under that lock records caller_lock ->
459+ * pool->lock -> pi_lock -> rq->__lock, closing a locking cycle if any of
460+ * these is acquired in the reverse direction elsewhere. Bounce through
461+ * irq_work so the schedule_work() runs with the caller's lock no longer held.
462+ */
463+static void rht_deferred_irq_work(struct irq_work *irq_work)
464+{
465+ struct rhashtable *ht = container_of(irq_work, struct rhashtable,
466+ run_irq_work);
467+
468+ schedule_work(&ht->run_work);
469+}
470+
448471 static int rhashtable_insert_rehash(struct rhashtable *ht,
449472 struct bucket_table *tbl)
450473 {
@@ -477,7 +500,7 @@ static int rhashtable_insert_rehash(struct rhashtable *ht, · 26 unmodified lines
477500 if (err == -EEXIST)
478501 err = 0;
479502 } else
480− schedule_work(&ht->run_work);
503+ irq_work_queue(&ht->run_irq_work);
481504
482505 return err;
483506
@@ -488,7 +511,7 @@ fail: · 4 unmodified lines
488511
489512 /* Schedule async rehash to retry allocation in process context. */
490513 if (err == -ENOMEM)
491− schedule_work(&ht->run_work);
514+ irq_work_queue(&ht->run_irq_work);
492515
493516 return err;
494517 }
@@ -538,7 +561,7 @@ static void *rhashtable_lookup_one(struct rhashtable *ht, · 43 unmodified lines
538561 return NULL;
539562 }
540563
541− if (elasticity <= 0)
564+ if (elasticity <= 0 && !ht->p.insecure_elasticity)
542565 return ERR_PTR(-EAGAIN);
543566
544567 return ERR_PTR(-ENOENT);
@@ -568,7 +591,8 @@ static struct bucket_table *rhashtable_insert_one( · 23 unmodified lines
568591 if (unlikely(rht_grow_above_max(ht, tbl)))
569592 return ERR_PTR(-E2BIG);
570593
571− if (unlikely(rht_grow_above_100(ht, tbl)))
594+ if (unlikely(rht_grow_above_100(ht, tbl)) &&
595+ !ht->p.insecure_elasticity)
572596 return ERR_PTR(-EAGAIN);
573597
574598 head = rht_ptr(bkt, tbl, hash);
@@ -629,7 +653,7 @@ static void *rhashtable_try_insert(struct rhashtable *ht, const void *key, · 54 unmodified lines
629653 rht_unlock(tbl, bkt, flags);
630654
631655 if (inserted && rht_grow_above_75(ht, tbl))
632− schedule_work(&ht->run_work);
656+ irq_work_queue(&ht->run_irq_work);
633657 }
634658 } while (!IS_ERR_OR_NULL(new_tbl));
635659
@@ -1084,6 +1108,7 @@ int rhashtable_init_noprof(struct rhashtable *ht, · 448 unmodified lines
10841108 RCU_INIT_POINTER(ht->tbl, tbl);
10851109
10861110 INIT_WORK(&ht->run_work, rht_deferred_worker);
1111+ init_irq_work(&ht->run_irq_work, rht_deferred_irq_work);
10871112
10881113 return 0;
10891114 }
@@ -1149,6 +1174,7 @@ void rhashtable_free_and_destroy(struct rhashtable *ht, · 59 unmodified lines
11491174 struct bucket_table *tbl, *next_tbl;
11501175 unsigned int i;
11511176
1177+ irq_work_sync(&ht->run_irq_work);
11521178 cancel_work_sync(&ht->run_work);
11531179
11541180 mutex_lock(&ht->mutex);
lib/test_maple_tree.c+2−2
@@ -2,7 +2,7 @@ · 1 unmodified line
22 /*
33 * test_maple_tree.c: Test the maple tree API
44 * Copyright (c) 2018-2022 Oracle Corporation
5− * Author: Liam R. Howlett <Liam.Howlett@Oracle.com>
5+ * Author: Liam R. Howlett <liam@infradead.org>
66 *
77 * Any tests that only require the interface of the tree.
88 */
@@ -4021,6 +4021,6 @@ static void __exit maple_tree_harvest(void) · 4012 unmodified lines
40214021
40224022 module_init(maple_tree_seed);
40234023 module_exit(maple_tree_harvest);
4024−MODULE_AUTHOR("Liam R. Howlett <Liam.Howlett@Oracle.com>");
4024+MODULE_AUTHOR("Liam R. Howlett <liam@infradead.org>");
40254025 MODULE_DESCRIPTION("maple tree API test module");
40264026 MODULE_LICENSE("GPL");
mm/damon/lru_sort.c+55−30
@@ -161,15 +161,6 @@ module_param(monitor_region_end, ulong, 0600); · 160 unmodified lines
161161 */
162162 static unsigned long addr_unit __read_mostly = 1;
163163
164−/*
165− * PID of the DAMON thread
166− *
167− * If DAMON_LRU_SORT is enabled, this becomes the PID of the worker thread.
168− * Else, -1.
169− */
170−static int kdamond_pid __read_mostly = -1;
171−module_param(kdamond_pid, int, 0400);
172−
173164 static struct damos_stat damon_lru_sort_hot_stat;
174165 DEFINE_DAMON_MODULES_DAMOS_STATS_PARAMS(damon_lru_sort_hot_stat,
175166 lru_sort_tried_hot_regions, lru_sorted_hot_regions,
@@ -386,12 +377,8 @@ static int damon_lru_sort_turn(bool on) · 210 unmodified lines
386377 {
387378 int err;
388379
389− if (!on) {
390− err = damon_stop(&ctx, 1);
391− if (!err)
392− kdamond_pid = -1;
393− return err;
394− }
380+ if (!on)
381+ return damon_stop(&ctx, 1);
395382
396383 err = damon_lru_sort_apply_parameters();
397384 if (err)
@@ -400,9 +387,6 @@ static int damon_lru_sort_turn(bool on) · 2 unmodified lines
400387 err = damon_start(&ctx, 1, true);
401388 if (err)
402389 return err;
403− kdamond_pid = damon_kdamond_pid(ctx);
404− if (kdamond_pid < 0)
405− return kdamond_pid;
406390 return damon_call(ctx, &call_control);
407391 }
408392
@@ -430,42 +414,83 @@ module_param_cb(addr_unit, &addr_unit_param_ops, &addr_unit, 0600); · 21 unmodified lines
430414 MODULE_PARM_DESC(addr_unit,
431415 "Scale factor for DAMON_LRU_SORT to ops address conversion (default: 1)");
432416
417+static bool damon_lru_sort_enabled(void)
418+{
419+ if (!ctx)
420+ return false;
421+ return damon_is_running(ctx);
422+}
423+
433424 static int damon_lru_sort_enabled_store(const char *val,
434425 const struct kernel_param *kp)
435426 {
436− bool is_enabled = enabled;
437− bool enable;
438427 int err;
439428
440− err = kstrtobool(val, &enable);
429+ err = kstrtobool(val, &enabled);
441430 if (err)
442431 return err;
443432
444− if (is_enabled == enable)
433+ if (damon_lru_sort_enabled() == enabled)
445434 return 0;
446435
447436 /* Called before init function. The function will handle this. */
448437 if (!damon_initialized())
449− goto set_param_out;
438+ return 0;
450439
451− err = damon_lru_sort_turn(enable);
452− if (err)
453− return err;
440+ return damon_lru_sort_turn(enabled);
441+}
454442
455−set_param_out:
456− enabled = enable;
457− return err;
443+static int damon_lru_sort_enabled_load(char *buffer,
444+ const struct kernel_param *kp)
445+{
446+ return sprintf(buffer, "%c\n", damon_lru_sort_enabled() ? 'Y' : 'N');
458447 }
459448
460449 static const struct kernel_param_ops enabled_param_ops = {
461450 .set = damon_lru_sort_enabled_store,
462− .get = param_get_bool,
451+ .get = damon_lru_sort_enabled_load,
463452 };
464453
465454 module_param_cb(enabled, &enabled_param_ops, &enabled, 0600);
466455 MODULE_PARM_DESC(enabled,
467456 "Enable or disable DAMON_LRU_SORT (default: disabled)");
468457
458+static int damon_lru_sort_kdamond_pid_store(const char *val,
459+ const struct kernel_param *kp)
460+{
461+ /*
462+ * kdamond_pid is read-only, but kernel command line could write it.
463+ * Do nothing here.
464+ */
465+ return 0;
466+}
467+
468+static int damon_lru_sort_kdamond_pid_load(char *buffer,
469+ const struct kernel_param *kp)
470+{
471+ int kdamond_pid = -1;
472+
473+ if (ctx) {
474+ kdamond_pid = damon_kdamond_pid(ctx);
475+ if (kdamond_pid < 0)
476+ kdamond_pid = -1;
477+ }
478+ return sprintf(buffer, "%d\n", kdamond_pid);
479+}
480+
481+static const struct kernel_param_ops kdamond_pid_param_ops = {
482+ .set = damon_lru_sort_kdamond_pid_store,
483+ .get = damon_lru_sort_kdamond_pid_load,
484+};
485+
486+/*
487+ * PID of the DAMON thread
488+ *
489+ * If DAMON_LRU_SORT is enabled, this becomes the PID of the worker thread.
490+ * Else, -1.
491+ */
492+module_param_cb(kdamond_pid, &kdamond_pid_param_ops, NULL, 0400);
493+
469494 static int __init damon_lru_sort_init(void)
470495 {
471496 int err;
mm/damon/reclaim.c+55−30
@@ -144,15 +144,6 @@ static unsigned long addr_unit __read_mostly = 1; · 143 unmodified lines
144144 static bool skip_anon __read_mostly;
145145 module_param(skip_anon, bool, 0600);
146146
147−/*
148− * PID of the DAMON thread
149− *
150− * If DAMON_RECLAIM is enabled, this becomes the PID of the worker thread.
151− * Else, -1.
152− */
153−static int kdamond_pid __read_mostly = -1;
154−module_param(kdamond_pid, int, 0400);
155−
156147 static struct damos_stat damon_reclaim_stat;
157148 DEFINE_DAMON_MODULES_DAMOS_STATS_PARAMS(damon_reclaim_stat,
158149 reclaim_tried_regions, reclaimed_regions, quota_exceeds);
@@ -288,12 +279,8 @@ static int damon_reclaim_turn(bool on) · 129 unmodified lines
288279 {
289280 int err;
290281
291− if (!on) {
292− err = damon_stop(&ctx, 1);
293− if (!err)
294− kdamond_pid = -1;
295− return err;
296− }
282+ if (!on)
283+ return damon_stop(&ctx, 1);
297284
298285 err = damon_reclaim_apply_parameters();
299286 if (err)
@@ -302,9 +289,6 @@ static int damon_reclaim_turn(bool on) · 2 unmodified lines
302289 err = damon_start(&ctx, 1, true);
303290 if (err)
304291 return err;
305− kdamond_pid = damon_kdamond_pid(ctx);
306− if (kdamond_pid < 0)
307− return kdamond_pid;
308292 return damon_call(ctx, &call_control);
309293 }
310294
@@ -332,42 +316,83 @@ module_param_cb(addr_unit, &addr_unit_param_ops, &addr_unit, 0600); · 21 unmodified lines
332316 MODULE_PARM_DESC(addr_unit,
333317 "Scale factor for DAMON_RECLAIM to ops address conversion (default: 1)");
334318
319+static bool damon_reclaim_enabled(void)
320+{
321+ if (!ctx)
322+ return false;
323+ return damon_is_running(ctx);
324+}
325+
335326 static int damon_reclaim_enabled_store(const char *val,
336327 const struct kernel_param *kp)
337328 {
338− bool is_enabled = enabled;
339− bool enable;
340329 int err;
341330
342− err = kstrtobool(val, &enable);
331+ err = kstrtobool(val, &enabled);
343332 if (err)
344333 return err;
345334
346− if (is_enabled == enable)
335+ if (damon_reclaim_enabled() == enabled)
347336 return 0;
348337
349338 /* Called before init function. The function will handle this. */
350339 if (!damon_initialized())
351− goto set_param_out;
340+ return 0;
352341
353− err = damon_reclaim_turn(enable);
354− if (err)
355− return err;
342+ return damon_reclaim_turn(enabled);
343+}
356344
357−set_param_out:
358− enabled = enable;
359− return err;
345+static int damon_reclaim_enabled_load(char *buffer,
346+ const struct kernel_param *kp)
347+{
348+ return sprintf(buffer, "%c\n", damon_reclaim_enabled() ? 'Y' : 'N');
360349 }
361350
362351 static const struct kernel_param_ops enabled_param_ops = {
363352 .set = damon_reclaim_enabled_store,
364− .get = param_get_bool,
353+ .get = damon_reclaim_enabled_load,
365354 };
366355
367356 module_param_cb(enabled, &enabled_param_ops, &enabled, 0600);
368357 MODULE_PARM_DESC(enabled,
369358 "Enable or disable DAMON_RECLAIM (default: disabled)");
370359
360+static int damon_reclaim_kdamond_pid_store(const char *val,
361+ const struct kernel_param *kp)
362+{
363+ /*
364+ * kdamond_pid is read-only, but kernel command line could write it.
365+ * Do nothing here.
366+ */
367+ return 0;
368+}
369+
370+static int damon_reclaim_kdamond_pid_load(char *buffer,
371+ const struct kernel_param *kp)
372+{
373+ int kdamond_pid = -1;
374+
375+ if (ctx) {
376+ kdamond_pid = damon_kdamond_pid(ctx);
377+ if (kdamond_pid < 0)
378+ kdamond_pid = -1;
379+ }
380+ return sprintf(buffer, "%d\n", kdamond_pid);
381+}
382+
383+static const struct kernel_param_ops kdamond_pid_param_ops = {
384+ .set = damon_reclaim_kdamond_pid_store,
385+ .get = damon_reclaim_kdamond_pid_load,
386+};
387+
388+/*
389+ * PID of the DAMON thread
390+ *
391+ * If DAMON_RECLAIM is enabled, this becomes the PID of the worker thread.
392+ * Else, -1.
393+ */
394+module_param_cb(kdamond_pid, &kdamond_pid_param_ops, NULL, 0400);
395+
371396 static int __init damon_reclaim_init(void)
372397 {
373398 int err;
mm/damon/stat.c+20−10
@@ -19,14 +19,17 @@ · 18 unmodified lines
1919 static int damon_stat_enabled_store(
2020 const char *val, const struct kernel_param *kp);
2121
22+static int damon_stat_enabled_load(char *buffer,
23+ const struct kernel_param *kp);
24+
2225 static const struct kernel_param_ops enabled_param_ops = {
2326 .set = damon_stat_enabled_store,
24− .get = param_get_bool,
27+ .get = damon_stat_enabled_load,
2528 };
2629
2730 static bool enabled __read_mostly = IS_ENABLED(
2831 CONFIG_DAMON_STAT_ENABLED_DEFAULT);
29−module_param_cb(enabled, &enabled_param_ops, &enabled, 0600);
32+module_param_cb(enabled, &enabled_param_ops, NULL, 0600);
3033 MODULE_PARM_DESC(enabled, "Enable of disable DAMON_STAT");
3134
3235 static unsigned long estimated_memory_bandwidth __read_mostly;
@@ -273,17 +276,23 @@ static void damon_stat_stop(void) · 240 unmodified lines
273276 damon_stat_context = NULL;
274277 }
275278
279+static bool damon_stat_enabled(void)
280+{
281+ if (!damon_stat_context)
282+ return false;
283+ return damon_is_running(damon_stat_context);
284+}
285+
276286 static int damon_stat_enabled_store(
277287 const char *val, const struct kernel_param *kp)
278288 {
279− bool is_enabled = enabled;
280289 int err;
281290
282291 err = kstrtobool(val, &enabled);
283292 if (err)
284293 return err;
285294
286− if (is_enabled == enabled)
295+ if (damon_stat_enabled() == enabled)
287296 return 0;
288297
289298 if (!damon_initialized())
@@ -293,16 +302,17 @@ static int damon_stat_enabled_store( · 3 unmodified lines
293302 */
294303 return 0;
295304
296− if (enabled) {
297− err = damon_stat_start();
298− if (err)
299− enabled = false;
300− return err;
301− }
305+ if (enabled)
306+ return damon_stat_start();
302307 damon_stat_stop();
303308 return 0;
304309 }
305310
311+static int damon_stat_enabled_load(char *buffer, const struct kernel_param *kp)
312+{
313+ return sprintf(buffer, "%c\n", damon_stat_enabled() ? 'Y' : 'N');
314+}
315+
306316 static int __init damon_stat_init(void)
307317 {
308318 int err = 0;
mm/damon/sysfs-schemes.c+22−2
@@ -533,9 +533,14 @@ static ssize_t memcg_path_show(struct kobject *kobj, · 532 unmodified lines
533533 {
534534 struct damon_sysfs_scheme_filter *filter = container_of(kobj,
535535 struct damon_sysfs_scheme_filter, kobj);
536+ int len;
536537
537− return sysfs_emit(buf, "%s\n",
538+ if (!mutex_trylock(&damon_sysfs_lock))
539+ return -EBUSY;
540+ len = sysfs_emit(buf, "%s\n",
538541 filter->memcg_path ? filter->memcg_path : "");
542+ mutex_unlock(&damon_sysfs_lock);
543+ return len;
539544 }
540545
541546 static ssize_t memcg_path_store(struct kobject *kobj,
@@ -550,8 +555,13 @@ static ssize_t memcg_path_store(struct kobject *kobj, · 8 unmodified lines
550555 return -ENOMEM;
551556
552557 strscpy(path, buf, count + 1);
558+ if (!mutex_trylock(&damon_sysfs_lock)) {
559+ kfree(path);
560+ return -EBUSY;
561+ }
553562 kfree(filter->memcg_path);
554563 filter->memcg_path = path;
564+ mutex_unlock(&damon_sysfs_lock);
555565 return count;
556566 }
557567
@@ -1187,8 +1197,13 @@ static ssize_t path_show(struct kobject *kobj, · 629 unmodified lines
11871197 {
11881198 struct damos_sysfs_quota_goal *goal = container_of(kobj,
11891199 struct damos_sysfs_quota_goal, kobj);
1200+ int len;
11901201
1191− return sysfs_emit(buf, "%s\n", goal->path ? goal->path : "");
1202+ if (!mutex_trylock(&damon_sysfs_lock))
1203+ return -EBUSY;
1204+ len = sysfs_emit(buf, "%s\n", goal->path ? goal->path : "");
1205+ mutex_unlock(&damon_sysfs_lock);
1206+ return len;
11921207 }
11931208
11941209 static ssize_t path_store(struct kobject *kobj,
@@ -1203,8 +1218,13 @@ static ssize_t path_store(struct kobject *kobj, · 8 unmodified lines
12031218 return -ENOMEM;
12041219
12051220 strscpy(path, buf, count + 1);
1221+ if (!mutex_trylock(&damon_sysfs_lock)) {
1222+ kfree(path);
1223+ return -EBUSY;
1224+ }
12061225 kfree(goal->path);
12071226 goal->path = path;
1227+ mutex_unlock(&damon_sysfs_lock);
12081228 return count;
12091229 }
12101230
mm/hugetlb_cma.c+1−0
@@ -204,6 +204,7 @@ void __init hugetlb_cma_reserve(void) · 203 unmodified lines
204204 */
205205 per_node = DIV_ROUND_UP(hugetlb_cma_size,
206206 nodes_weight(hugetlb_bootmem_nodes));
207+ per_node = round_up(per_node, PAGE_SIZE << order);
207208 pr_info("hugetlb_cma: reserve %lu MiB, up to %lu MiB per node\n",
208209 hugetlb_cma_size / SZ_1M, per_node / SZ_1M);
209210 }
mm/memcontrol.c+19−10
@@ -805,12 +805,17 @@ static long memcg_state_val_in_pages(int idx, long val) · 804 unmodified lines
805805 * Used in mod_memcg_state() and mod_memcg_lruvec_state() to avoid race with
806806 * reparenting of non-hierarchical state_locals.
807807 */
808−static inline struct mem_cgroup *get_non_dying_memcg_start(struct mem_cgroup *memcg)
808+static inline struct mem_cgroup *get_non_dying_memcg_start(struct mem_cgroup *memcg,
809+ bool *rcu_locked)
809810 {
810− if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
811+ /* Rebinding can cause this value to be changed at runtime */
812+ if (cgroup_subsys_on_dfl(memory_cgrp_subsys)) {
813+ *rcu_locked = false;
811814 return memcg;
815+ }
812816
813817 rcu_read_lock();
818+ *rcu_locked = true;
814819
815820 while (memcg_is_dying(memcg))
816821 memcg = parent_mem_cgroup(memcg);
@@ -818,20 +823,21 @@ static inline struct mem_cgroup *get_non_dying_memcg_start(struct mem_cgroup *me · 1 unmodified line
818823 return memcg;
819824 }
820825
821−static inline void get_non_dying_memcg_end(void)
826+static inline void get_non_dying_memcg_end(bool rcu_locked)
822827 {
823− if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
828+ if (!rcu_locked)
824829 return;
825830
826831 rcu_read_unlock();
827832 }
828833 #else
829−static inline struct mem_cgroup *get_non_dying_memcg_start(struct mem_cgroup *memcg)
834+static inline struct mem_cgroup *get_non_dying_memcg_start(struct mem_cgroup *memcg,
835+ bool *rcu_locked)
830836 {
831837 return memcg;
832838 }
833839
834−static inline void get_non_dying_memcg_end(void)
840+static inline void get_non_dying_memcg_end(bool rcu_locked)
835841 {
836842 }
837843 #endif
@@ -865,12 +871,14 @@ static void __mod_memcg_state(struct mem_cgroup *memcg, · 27 unmodified lines
865871 void mod_memcg_state(struct mem_cgroup *memcg, enum memcg_stat_item idx,
866872 int val)
867873 {
874+ bool rcu_locked = false;
875+
868876 if (mem_cgroup_disabled())
869877 return;
870878
871− memcg = get_non_dying_memcg_start(memcg);
879+ memcg = get_non_dying_memcg_start(memcg, &rcu_locked);
872880 __mod_memcg_state(memcg, idx, val);
873− get_non_dying_memcg_end();
881+ get_non_dying_memcg_end(rcu_locked);
874882 }
875883
876884 #ifdef CONFIG_MEMCG_V1
@@ -933,14 +941,15 @@ static void mod_memcg_lruvec_state(struct lruvec *lruvec, · 56 unmodified lines
933941 struct pglist_data *pgdat = lruvec_pgdat(lruvec);
934942 struct mem_cgroup_per_node *pn;
935943 struct mem_cgroup *memcg;
944+ bool rcu_locked = false;
936945
937946 pn = container_of(lruvec, struct mem_cgroup_per_node, lruvec);
938− memcg = get_non_dying_memcg_start(pn->memcg);
947+ memcg = get_non_dying_memcg_start(pn->memcg, &rcu_locked);
939948 pn = memcg->nodeinfo[pgdat->node_id];
940949
941950 __mod_memcg_lruvec_state(pn, idx, val);
942951
943− get_non_dying_memcg_end();
952+ get_non_dying_memcg_end(rcu_locked);
944953 }
945954
946955 /**
mm/page-writeback.c+6−10
@@ -1835,7 +1835,9 @@ static int balance_dirty_pages(struct bdi_writeback *wb, · 1834 unmodified lines
18351835 balance_domain_limits(mdtc, strictlimit);
18361836 }
18371837
1838− if (nr_dirty > gdtc->bg_thresh && !writeback_in_progress(wb))
1838+ if (!writeback_in_progress(wb) &&
1839+ (nr_dirty > gdtc->bg_thresh ||
1840+ (strictlimit && gdtc->wb_dirty > gdtc->wb_bg_thresh)))
18391841 wb_start_background_writeback(wb);
18401842
18411843 /*
@@ -1862,15 +1864,9 @@ free_running: · 20 unmodified lines
18621864 * Unconditionally start background writeback if it's not
18631865 * already in progress. We need to do this because the global
18641866 * dirty threshold check above (nr_dirty > gdtc->bg_thresh)
1865− * doesn't account for these cases:
1866− *
1867− * a) strictlimit BDIs: throttling is calculated using per-wb
1868− * thresholds. The per-wb threshold can be exceeded even when
1869− * nr_dirty < gdtc->bg_thresh
1870− *
1871− * b) memcg-based throttling: memcg uses its own dirty count and
1872− * thresholds and can trigger throttling even when global
1873− * nr_dirty < gdtc->bg_thresh
1867+ * doesn't account for the memcg-based throttling case. memcg
1868+ * uses its own dirty count and thresholds and can trigger
1869+ * throttling even when global nr_dirty < gdtc->bg_thresh
18741870 *
18751871 * Writeback needs to be started else the writer stalls in the
18761872 * throttle loop waiting for dirty pages to be written back
mm/page_alloc.c+5−0
@@ -7737,6 +7737,11 @@ struct page *alloc_frozen_pages_nolock_noprof(gfp_t gfp_flags, int nid, unsigned · 7736 unmodified lines
77377737 */
77387738 if (IS_ENABLED(CONFIG_PREEMPT_RT) && (in_nmi() || in_hardirq()))
77397739 return NULL;
7740+
7741+ /* On UP, spin_trylock() always succeeds even when it is locked */
7742+ if (!IS_ENABLED(CONFIG_SMP) && in_nmi())
7743+ return NULL;
7744+
77407745 if (!pcp_allowed_order(order))
77417746 return NULL;
77427747
mm/slub.c+4−0
@@ -5339,6 +5339,10 @@ void *kmalloc_nolock_noprof(size_t size, gfp_t gfp_flags, int node) · 5338 unmodified lines
53395339 if (IS_ENABLED(CONFIG_PREEMPT_RT) && (in_nmi() || in_hardirq()))
53405340 return NULL;
53415341
5342+ /* On UP, spin_trylock() always succeeds even when it is locked */
5343+ if (!IS_ENABLED(CONFIG_SMP) && in_nmi())
5344+ return NULL;
5345+
53425346 retry:
53435347 if (unlikely(size > KMALLOC_MAX_CACHE_SIZE))
53445348 return NULL;
mm/userfaultfd.c+11−1
@@ -443,8 +443,10 @@ static int mfill_copy_folio_locked(struct folio *folio, unsigned long src_addr) · 442 unmodified lines
443443 return ret;
444444 }
445445
446−static int mfill_copy_folio_retry(struct mfill_state *state, struct folio *folio)
446+static int mfill_copy_folio_retry(struct mfill_state *state,
447+ struct folio *folio)
447448 {
449+ const struct vm_uffd_ops *orig_ops = vma_uffd_ops(state->vma);
448450 unsigned long src_addr = state->src_addr;
449451 void *kaddr;
450452 int err;
@@ -465,6 +467,14 @@ static int mfill_copy_folio_retry(struct mfill_state *state, struct folio *folio · 14 unmodified lines
465467 if (err)
466468 return err;
467469
470+ /*
471+ * The VMA type may have changed while the lock was dropped
472+ * (e.g. replaced with a hugetlb mapping), making the caller's
473+ * ops pointer stale.
474+ */
475+ if (vma_uffd_ops(state->vma) != orig_ops)
476+ return -EAGAIN;
477+
468478 err = mfill_establish_pmd(state);
469479 if (err)
470480 return err;
mm/util.c+17−9
@@ -1232,7 +1232,7 @@ int __compat_vma_mmap(struct vm_area_desc *desc, · 1231 unmodified lines
12321232 /* Update the VMA from the descriptor. */
12331233 compat_set_vma_from_desc(vma, desc);
12341234 /* Complete any specified mmap actions. */
1235− return mmap_action_complete(vma, &desc->action);
1235+ return mmap_action_complete(vma, &desc->action, /*is_compat=*/true);
12361236 }
12371237 EXPORT_SYMBOL(__compat_vma_mmap);
12381238
@@ -1389,7 +1389,8 @@ static int call_vma_mapped(struct vm_area_struct *vma) · 150 unmodified lines
13891389 }
13901390
13911391 static int mmap_action_finish(struct vm_area_struct *vma,
1392− struct mmap_action *action, int err)
1392+ struct mmap_action *action, int err,
1393+ bool is_compat)
13931394 {
13941395 size_t len;
13951396
@@ -1400,8 +1401,12 @@ static int mmap_action_finish(struct vm_area_struct *vma, · 4 unmodified lines
14001401
14011402 /* do_munmap() might take rmap lock, so release if held. */
14021403 maybe_rmap_unlock_action(vma, action);
1403− if (!err)
1404− return 0;
1404+ /*
1405+ * If this is invoked from the compatibility layer, post-mmap() hook
1406+ * logic will handle cleanup for us.
1407+ */
1408+ if (!err || is_compat)
1409+ return err;
14051410
14061411 /*
14071412 * If an error occurs, unmap the VMA altogether and return an error. We
@@ -1451,13 +1456,15 @@ EXPORT_SYMBOL(mmap_action_prepare); · 43 unmodified lines
14511456 * mmap_action_complete - Execute VMA descriptor action.
14521457 * @vma: The VMA to perform the action upon.
14531458 * @action: The action to perform.
1459+ * @is_compat: Is this being invoked from the compatibility layer?
14541460 *
14551461 * Similar to mmap_action_prepare().
14561462 *
1457− * Return: 0 on success, or error, at which point the VMA will be unmapped.
1463+ * Return: 0 on success, or error, at which point the VMA will be unmapped if
1464+ * !@is_compat.
14581465 */
14591466 int mmap_action_complete(struct vm_area_struct *vma,
1460− struct mmap_action *action)
1467+ struct mmap_action *action, bool is_compat)
14611468 {
14621469 int err = 0;
14631470
@@ -1478,7 +1485,7 @@ int mmap_action_complete(struct vm_area_struct *vma, · 14 unmodified lines
14781485 break;
14791486 }
14801487
1481− return mmap_action_finish(vma, action, err);
1488+ return mmap_action_finish(vma, action, err, is_compat);
14821489 }
14831490 EXPORT_SYMBOL(mmap_action_complete);
14841491 #else
@@ -1500,7 +1507,8 @@ int mmap_action_prepare(struct vm_area_desc *desc) · 15 unmodified lines
15001507 EXPORT_SYMBOL(mmap_action_prepare);
15011508
15021509 int mmap_action_complete(struct vm_area_struct *vma,
1503− struct mmap_action *action)
1510+ struct mmap_action *action,
1511+ bool is_compat)
15041512 {
15051513 int err = 0;
15061514
@@ -1517,7 +1525,7 @@ int mmap_action_complete(struct vm_area_struct *vma, · 10 unmodified lines
15171525 break;
15181526 }
15191527
1520− return mmap_action_finish(vma, action, err);
1528+ return mmap_action_finish(vma, action, err, is_compat);
15211529 }
15221530 EXPORT_SYMBOL(mmap_action_complete);
15231531 #endif
mm/vma.c+2−1
@@ -2780,7 +2780,8 @@ static unsigned long __mmap_region(struct file *file, unsigned long addr, · 2779 unmodified lines
27802780 __mmap_complete(&map, vma);
27812781
27822782 if (have_mmap_prepare && allocated_new) {
2783− error = mmap_action_complete(vma, &desc.action);
2783+ error = mmap_action_complete(vma, &desc.action,
2784+ /*is_compat=*/false);
27842785 if (error)
27852786 return error;
27862787 }
mm/vmalloc.c+1−1
@@ -4361,7 +4361,7 @@ need_realloc: · 4360 unmodified lines
43614361 return NULL;
43624362
43634363 if (p) {
4364− memcpy(n, p, old_size);
4364+ memcpy(n, p, min(size, old_size));
43654365 vfree(p);
43664366 }
43674367
net/core/devmem.c+1−2
@@ -297,8 +297,7 @@ net_devmem_bind_dmabuf(struct net_device *dev, · 296 unmodified lines
297297
298298 for (i = 0; i < owner->area.num_niovs; i++) {
299299 niov = &owner->area.niovs[i];
300− niov->type = NET_IOV_DMABUF;
301− niov->owner = &owner->area;
300+ net_iov_init(niov, &owner->area, NET_IOV_DMABUF);
302301 page_pool_set_dma_addr_netmem(net_iov_to_netmem(niov),
303302 net_devmem_get_dma_addr(niov));
304303 if (direction == DMA_TO_DEVICE)
net/core/neighbour.c+5−5
@@ -3210,8 +3210,10 @@ int neigh_xmit(int index, struct net_device *dev, · 3209 unmodified lines
32103210
32113211 rcu_read_lock();
32123212 tbl = rcu_dereference(neigh_tables[index]);
3213− if (!tbl)
3214− goto out_unlock;
3213+ if (!tbl) {
3214+ rcu_read_unlock();
3215+ goto out_kfree_skb;
3216+ }
32153217 if (index == NEIGH_ARP_TABLE) {
32163218 u32 key = *((u32 *)addr);
32173219
@@ -3227,7 +3229,6 @@ int neigh_xmit(int index, struct net_device *dev, · 9 unmodified lines
32273229 goto out_kfree_skb;
32283230 }
32293231 err = READ_ONCE(neigh->output)(neigh, skb);
3230−out_unlock:
32313232 rcu_read_unlock();
32323233 }
32333234 else if (index == NEIGH_LINK_TABLE) {
@@ -3237,11 +3238,10 @@ out_unlock: · 3 unmodified lines
32373238 goto out_kfree_skb;
32383239 err = dev_queue_xmit(skb);
32393240 }
3240−out:
32413241 return err;
32423242 out_kfree_skb:
32433243 kfree_skb(skb);
3244− goto out;
3244+ return err;
32453245 }
32463246 EXPORT_SYMBOL(neigh_xmit);
32473247
net/core/netpoll.c+18−1
@@ -704,6 +704,23 @@ static int netpoll_take_ipv4(struct netpoll *np, struct net_device *ndev) · 703 unmodified lines
704704 return 0;
705705 }
706706
707+/*
708+ * Test whether the caller left np->local_ip unset, so that
709+ * netpoll_setup() should auto-populate it from the egress device.
710+ *
711+ * np->local_ip is a union of __be32 (IPv4) and struct in6_addr (IPv6),
712+ * so an IPv6 address whose first 4 bytes are zero (e.g. ::1, ::2,
713+ * IPv4-mapped ::ffff:a.b.c.d) must not be tested via the IPv4 arm —
714+ * doing so would misclassify a caller-supplied address as unset and
715+ * silently overwrite it with whatever address the device exposes.
716+ */
717+static bool netpoll_local_ip_unset(const struct netpoll *np)
718+{
719+ if (np->ipv6)
720+ return ipv6_addr_any(&np->local_ip.in6);
721+ return !np->local_ip.ip;
722+}
723+
707724 int netpoll_setup(struct netpoll *np)
708725 {
709726 struct net *net = current->nsproxy->net_ns;
@@ -747,7 +764,7 @@ int netpoll_setup(struct netpoll *np) · 37 unmodified lines
747764 rtnl_lock();
748765 }
749766
750− if (!np->local_ip.ip) {
767+ if (netpoll_local_ip_unset(np)) {
751768 if (!np->ipv6) {
752769 err = netpoll_take_ipv4(np, ndev);
753770 if (err)
net/core/page_pool.c+5−5
@@ -327,6 +327,11 @@ static void page_pool_uninit(struct page_pool *pool) · 326 unmodified lines
327327 if (!pool->system)
328328 free_percpu(pool->recycle_stats);
329329 #endif
330+
331+ if (pool->mp_ops) {
332+ pool->mp_ops->destroy(pool);
333+ static_branch_dec(&page_pool_mem_providers);
334+ }
330335 }
331336
332337 /**
@@ -1146,11 +1151,6 @@ static void __page_pool_destroy(struct page_pool *pool) · 813 unmodified lines
11461151 page_pool_unlist(pool);
11471152 page_pool_uninit(pool);
11481153
1149− if (pool->mp_ops) {
1150− pool->mp_ops->destroy(pool);
1151− static_branch_dec(&page_pool_mem_providers);
1152− }
1153−
11541154 kfree(pool);
11551155 }
11561156
net/ipv4/ipmr.c+58−50
@@ -151,16 +151,6 @@ static struct mr_table *__ipmr_get_table(struct net *net, u32 id) · 150 unmodified lines
151151 return NULL;
152152 }
153153
154−static struct mr_table *ipmr_get_table(struct net *net, u32 id)
155−{
156− struct mr_table *mrt;
157−
158− rcu_read_lock();
159− mrt = __ipmr_get_table(net, id);
160− rcu_read_unlock();
161− return mrt;
162−}
163−
164154 static int ipmr_fib_lookup(struct net *net, struct flowi4 *flp4,
165155 struct mr_table **mrt)
166156 {
@@ -293,7 +283,7 @@ static void __net_exit ipmr_rules_exit_rtnl(struct net *net, · 126 unmodified lines
293283 struct mr_table *mrt, *next;
294284
295285 list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) {
296− list_del(&mrt->list);
286+ list_del_rcu(&mrt->list);
297287 ipmr_free_table(mrt, dev_kill_list);
298288 }
299289 }
@@ -315,28 +305,30 @@ bool ipmr_rule_default(const struct fib_rule *rule) · 15 unmodified lines
315305 }
316306 EXPORT_SYMBOL(ipmr_rule_default);
317307 #else
318−#define ipmr_for_each_table(mrt, net) \
319− for (mrt = net->ipv4.mrt; mrt; mrt = NULL)
320−
321308 static struct mr_table *ipmr_mr_table_iter(struct net *net,
322309 struct mr_table *mrt)
323310 {
324311 if (!mrt)
325− return net->ipv4.mrt;
312+ return rcu_dereference(net->ipv4.mrt);
326313 return NULL;
327314 }
328315
329−static struct mr_table *ipmr_get_table(struct net *net, u32 id)
316+static struct mr_table *__ipmr_get_table(struct net *net, u32 id)
330317 {
331− return net->ipv4.mrt;
318+ return rcu_dereference_check(net->ipv4.mrt,
319+ lockdep_rtnl_is_held() ||
320+ !rcu_access_pointer(net->ipv4.mrt));
332321 }
333322
334−#define __ipmr_get_table ipmr_get_table
323+#define ipmr_for_each_table(mrt, net) \
324+ for (mrt = __ipmr_get_table(net, 0); mrt; mrt = NULL)
335325
336326 static int ipmr_fib_lookup(struct net *net, struct flowi4 *flp4,
337327 struct mr_table **mrt)
338328 {
339− *mrt = net->ipv4.mrt;
329+ *mrt = rcu_dereference(net->ipv4.mrt);
330+ if (!*mrt)
331+ return -EAGAIN;
340332 return 0;
341333 }
342334
@@ -347,7 +339,8 @@ static int __net_init ipmr_rules_init(struct net *net) · 4 unmodified lines
347339 mrt = ipmr_new_table(net, RT_TABLE_DEFAULT);
348340 if (IS_ERR(mrt))
349341 return PTR_ERR(mrt);
350− net->ipv4.mrt = mrt;
342+
343+ rcu_assign_pointer(net->ipv4.mrt, mrt);
351344 return 0;
352345 }
353346
@@ -358,9 +351,10 @@ static void __net_exit ipmr_rules_exit(struct net *net) · 4 unmodified lines
358351 static void __net_exit ipmr_rules_exit_rtnl(struct net *net,
359352 struct list_head *dev_kill_list)
360353 {
361− ipmr_free_table(net->ipv4.mrt, dev_kill_list);
354+ struct mr_table *mrt = rcu_dereference_protected(net->ipv4.mrt, 1);
362355
363− net->ipv4.mrt = NULL;
356+ RCU_INIT_POINTER(net->ipv4.mrt, NULL);
357+ ipmr_free_table(mrt, dev_kill_list);
364358 }
365359
366360 static int ipmr_rules_dump(struct net *net, struct notifier_block *nb,
@@ -381,6 +375,17 @@ bool ipmr_rule_default(const struct fib_rule *rule) · 14 unmodified lines
381375 EXPORT_SYMBOL(ipmr_rule_default);
382376 #endif
383377
378+static struct mr_table *ipmr_get_table(struct net *net, u32 id)
379+{
380+ struct mr_table *mrt;
381+
382+ rcu_read_lock();
383+ mrt = __ipmr_get_table(net, id);
384+ rcu_read_unlock();
385+
386+ return mrt;
387+}
388+
384389 static inline int ipmr_hash_cmp(struct rhashtable_compare_arg *arg,
385390 const void *ptr)
386391 {
@@ -441,12 +446,11 @@ static void ipmr_free_table(struct mr_table *mrt, struct list_head *dev_kill_lis · 54 unmodified lines
441446
442447 WARN_ON_ONCE(!mr_can_free_table(net));
443448
444− timer_shutdown_sync(&mrt->ipmr_expire_timer);
445449 mroute_clean_tables(mrt, MRT_FLUSH_VIFS | MRT_FLUSH_VIFS_STATIC |
446450 MRT_FLUSH_MFC | MRT_FLUSH_MFC_STATIC,
447451 &ipmr_dev_kill_list);
448− rhltable_destroy(&mrt->mfc_hash);
449− kfree(mrt);
452+ timer_shutdown_sync(&mrt->ipmr_expire_timer);
453+ mr_table_free(mrt);
450454
451455 WARN_ON_ONCE(!net_initialized(net) && !list_empty(&ipmr_dev_kill_list));
452456 list_splice(&ipmr_dev_kill_list, dev_kill_list);
@@ -1135,12 +1139,19 @@ static int ipmr_cache_report(const struct mr_table *mrt, · 682 unmodified lines
11351139 static int ipmr_cache_unresolved(struct mr_table *mrt, vifi_t vifi,
11361140 struct sk_buff *skb, struct net_device *dev)
11371141 {
1142+ struct net *net = read_pnet(&mrt->net);
11381143 const struct iphdr *iph = ip_hdr(skb);
1139− struct mfc_cache *c;
1144+ struct mfc_cache *c = NULL;
11401145 bool found = false;
11411146 int err;
11421147
11431148 spin_lock_bh(&mfc_unres_lock);
1149+
1150+ if (!check_net(net)) {
1151+ err = -EINVAL;
1152+ goto err;
1153+ }
1154+
11441155 list_for_each_entry(c, &mrt->mfc_unres_queue, _c.list) {
11451156 if (c->mfc_mcastgrp == iph->daddr &&
11461157 c->mfc_origin == iph->saddr) {
@@ -1153,10 +1164,8 @@ static int ipmr_cache_unresolved(struct mr_table *mrt, vifi_t vifi, · 6 unmodified lines
11531164 /* Create a new entry if allowable */
11541165 c = ipmr_cache_alloc_unres();
11551166 if (!c) {
1156− spin_unlock_bh(&mfc_unres_lock);
1157−
1158− kfree_skb(skb);
1159− return -ENOBUFS;
1167+ err = -ENOBUFS;
1168+ goto err;
11601169 }
11611170
11621171 /* Fill in the new cache entry */
@@ -1166,17 +1175,8 @@ static int ipmr_cache_unresolved(struct mr_table *mrt, vifi_t vifi, · 3 unmodified lines
11661175
11671176 /* Reflect first query at mrouted. */
11681177 err = ipmr_cache_report(mrt, skb, vifi, IGMPMSG_NOCACHE);
1169−
1170− if (err < 0) {
1171− /* If the report failed throw the cache entry
1172− out - Brad Parker
1173− */
1174− spin_unlock_bh(&mfc_unres_lock);
1175−
1176− ipmr_cache_free(c);
1177− kfree_skb(skb);
1178− return err;
1179− }
1178+ if (err < 0)
1179+ goto err;
11801180
11811181 atomic_inc(&mrt->cache_resolve_queue_len);
11821182 list_add(&c->_c.list, &mrt->mfc_unres_queue);
@@ -1189,18 +1189,26 @@ static int ipmr_cache_unresolved(struct mr_table *mrt, vifi_t vifi, · 6 unmodified lines
11891189
11901190 /* See if we can append the packet */
11911191 if (c->_c.mfc_un.unres.unresolved.qlen > 3) {
1192− kfree_skb(skb);
1192+ c = NULL;
11931193 err = -ENOBUFS;
1194− } else {
1195− if (dev) {
1196− skb->dev = dev;
1197− skb->skb_iif = dev->ifindex;
1198− }
1199− skb_queue_tail(&c->_c.mfc_un.unres.unresolved, skb);
1200− err = 0;
1194+ goto err;
1195+ }
1196+
1197+ if (dev) {
1198+ skb->dev = dev;
1199+ skb->skb_iif = dev->ifindex;
12011200 }
12021201
1202+ skb_queue_tail(&c->_c.mfc_un.unres.unresolved, skb);
1203+
12031204 spin_unlock_bh(&mfc_unres_lock);
1205+ return 0;
1206+
1207+err:
1208+ spin_unlock_bh(&mfc_unres_lock);
1209+ if (c)
1210+ ipmr_cache_free(c);
1211+ kfree_skb(skb);
12041212 return err;
12051213 }
12061214
@@ -1346,7 +1354,7 @@ static void mroute_clean_tables(struct mr_table *mrt, int flags, · 139 unmodified lines
13461354 }
13471355
13481356 if (flags & MRT_FLUSH_MFC) {
1349− if (atomic_read(&mrt->cache_resolve_queue_len) != 0) {
1357+ if (atomic_read(&mrt->cache_resolve_queue_len) != 0 || !check_net(net)) {
13501358 spin_lock_bh(&mfc_unres_lock);
13511359 list_for_each_entry_safe(c, tmp, &mrt->mfc_unres_queue, list) {
13521360 list_del(&c->list);
net/ipv4/ipmr_base.c+16−0
@@ -28,6 +28,20 @@ void vif_device_init(struct vif_device *v, · 27 unmodified lines
2828 v->link = dev->ifindex;
2929 }
3030
31+static void __mr_free_table(struct work_struct *work)
32+{
33+ struct mr_table *mrt = container_of(to_rcu_work(work),
34+ struct mr_table, work);
35+
36+ rhltable_destroy(&mrt->mfc_hash);
37+ kfree(mrt);
38+}
39+
40+void mr_table_free(struct mr_table *mrt)
41+{
42+ queue_rcu_work(system_unbound_wq, &mrt->work);
43+}
44+
3145 struct mr_table *
3246 mr_table_alloc(struct net *net, u32 id,
3347 struct mr_table_ops *ops,
@@ -50,6 +64,8 @@ mr_table_alloc(struct net *net, u32 id, · 16 unmodified lines
5064 kfree(mrt);
5165 return ERR_PTR(err);
5266 }
67+
68+ INIT_RCU_WORK(&mrt->work, __mr_free_table);
5369 INIT_LIST_HEAD(&mrt->mfc_cache_list);
5470 INIT_LIST_HEAD(&mrt->mfc_unres_queue);
5571
net/ipv4/netfilter/arp_tables.c+15−3
@@ -110,13 +110,25 @@ static inline int arp_packet_match(const struct arphdr *arphdr, · 109 unmodified lines
110110 arpptr += dev->addr_len;
111111 memcpy(&src_ipaddr, arpptr, sizeof(u32));
112112 arpptr += sizeof(u32);
113− tgt_devaddr = arpptr;
114− arpptr += dev->addr_len;
113+
114+ if (IS_ENABLED(CONFIG_FIREWIRE_NET) && dev->type == ARPHRD_IEEE1394) {
115+ if (unlikely(memchr_inv(arpinfo->tgt_devaddr.mask, 0,
116+ sizeof(arpinfo->tgt_devaddr.mask))))
117+ return 0;
118+
119+ tgt_devaddr = NULL;
120+ } else {
121+ tgt_devaddr = arpptr;
122+ arpptr += dev->addr_len;
123+ }
115124 memcpy(&tgt_ipaddr, arpptr, sizeof(u32));
116125
117126 if (NF_INVF(arpinfo, ARPT_INV_SRCDEVADDR,
118127 arp_devaddr_compare(&arpinfo->src_devaddr, src_devaddr,
119− dev->addr_len)) ||
128+ dev->addr_len)))
129+ return 0;
130+
131+ if (tgt_devaddr &&
120132 NF_INVF(arpinfo, ARPT_INV_TGTDEVADDR,
121133 arp_devaddr_compare(&arpinfo->tgt_devaddr, tgt_devaddr,
122134 dev->addr_len)))
net/ipv4/netfilter/arpt_mangle.c+8−0
@@ -40,6 +40,10 @@ target(struct sk_buff *skb, const struct xt_action_param *par) · 39 unmodified lines
4040 }
4141 arpptr += pln;
4242 if (mangle->flags & ARPT_MANGLE_TDEV) {
43+ if (unlikely(IS_ENABLED(CONFIG_FIREWIRE_NET) &&
44+ skb->dev->type == ARPHRD_IEEE1394))
45+ return NF_DROP;
46+
4347 if (ARPT_DEV_ADDR_LEN_MAX < hln ||
4448 (arpptr + hln > skb_tail_pointer(skb)))
4549 return NF_DROP;
@@ -47,6 +51,10 @@ target(struct sk_buff *skb, const struct xt_action_param *par) · 1 unmodified line
4751 }
4852 arpptr += hln;
4953 if (mangle->flags & ARPT_MANGLE_TIP) {
54+ if (unlikely(IS_ENABLED(CONFIG_FIREWIRE_NET) &&
55+ skb->dev->type == ARPHRD_IEEE1394))
56+ return NF_DROP;
57+
5058 if (ARPT_MANGLE_ADDR_LEN_MAX < pln ||
5159 (arpptr + pln > skb_tail_pointer(skb)))
5260 return NF_DROP;
net/ipv4/tcp_timer.c+3−2
@@ -50,7 +50,8 @@ static u32 tcp_clamp_rto_to_user_timeout(const struct sock *sk) · 49 unmodified lines
5050 u32 tcp_clamp_probe0_to_user_timeout(const struct sock *sk, u32 when)
5151 {
5252 const struct inet_connection_sock *icsk = inet_csk(sk);
53− u32 remaining, user_timeout;
53+ u32 user_timeout;
54+ s32 remaining;
5455 s32 elapsed;
5556
5657 user_timeout = READ_ONCE(icsk->icsk_user_timeout);
@@ -61,7 +62,7 @@ u32 tcp_clamp_probe0_to_user_timeout(const struct sock *sk, u32 when) · 4 unmodified lines
6162 if (unlikely(elapsed < 0))
6263 elapsed = 0;
6364 remaining = msecs_to_jiffies(user_timeout) - elapsed;
64− remaining = max_t(u32, remaining, TCP_TIMEOUT_MIN);
65+ remaining = max_t(int, remaining, TCP_TIMEOUT_MIN);
6566
6667 return min_t(u32, remaining, when);
6768 }
net/ipv6/exthdrs.c+6−3
@@ -491,6 +491,7 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb) · 490 unmodified lines
491491 struct net *net = dev_net(skb->dev);
492492 struct inet6_dev *idev;
493493 struct ipv6hdr *oldhdr;
494+ unsigned int chdr_len;
494495 unsigned char *buf;
495496 int accept_rpl_seg;
496497 int i, err;
@@ -592,8 +593,10 @@ looped_back: · 95 unmodified lines
592593 skb_pull(skb, ((hdr->hdrlen + 1) << 3));
593594 skb_postpull_rcsum(skb, oldhdr,
594595 sizeof(struct ipv6hdr) + ((hdr->hdrlen + 1) << 3));
595− if (unlikely(!hdr->segments_left)) {
596− if (pskb_expand_head(skb, sizeof(struct ipv6hdr) + ((chdr->hdrlen + 1) << 3), 0,
596+ chdr_len = sizeof(struct ipv6hdr) + ((chdr->hdrlen + 1) << 3);
597+ if (unlikely(!hdr->segments_left ||
598+ skb_headroom(skb) < chdr_len + skb->mac_len)) {
599+ if (pskb_expand_head(skb, chdr_len + skb->mac_len, 0,
597600 GFP_ATOMIC)) {
598601 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_OUTDISCARDS);
599602 kfree_skb(skb);
@@ -603,7 +606,7 @@ looped_back: · 3 unmodified lines
603606
604607 oldhdr = ipv6_hdr(skb);
605608 }
606− skb_push(skb, ((chdr->hdrlen + 1) << 3) + sizeof(struct ipv6hdr));
609+ skb_push(skb, chdr_len);
607610 skb_reset_network_header(skb);
608611 skb_mac_header_rebuild(skb);
609612 skb_set_transport_header(skb, sizeof(struct ipv6hdr));
net/ipv6/rpl_iptunnel.c+9−0
@@ -287,7 +287,16 @@ static int rpl_input(struct sk_buff *skb) · 286 unmodified lines
287287
288288 if (!dst) {
289289 ip6_route_input(skb);
290+
291+ /* ip6_route_input() sets a NOREF dst; force a refcount on it
292+ * before caching or further use.
293+ */
294+ skb_dst_force(skb);
290295 dst = skb_dst(skb);
296+ if (unlikely(!dst)) {
297+ err = -ENETUNREACH;
298+ goto drop;
299+ }
291300
292301 /* cache only if we don't create a dst reference loop */
293302 if (!dst->error && lwtst != dst->lwtstate) {
net/ipv6/seg6_iptunnel.c+9−0
@@ -515,7 +515,16 @@ static int seg6_input_core(struct net *net, struct sock *sk, · 514 unmodified lines
515515
516516 if (!dst) {
517517 ip6_route_input(skb);
518+
519+ /* ip6_route_input() sets a NOREF dst; force a refcount on it
520+ * before caching or further use.
521+ */
522+ skb_dst_force(skb);
518523 dst = skb_dst(skb);
524+ if (unlikely(!dst)) {
525+ err = -ENETUNREACH;
526+ goto drop;
527+ }
519528
520529 /* cache only if we don't create a dst reference loop */
521530 if (!dst->error && lwtst != dst->lwtstate) {
net/mptcp/pm_kernel.c+1−0
@@ -1278,6 +1278,7 @@ static void __reset_counters(struct pm_nl_pernet *pernet) · 1277 unmodified lines
12781278 WRITE_ONCE(pernet->endp_signal_max, 0);
12791279 WRITE_ONCE(pernet->endp_subflow_max, 0);
12801280 WRITE_ONCE(pernet->endp_laminar_max, 0);
1281+ WRITE_ONCE(pernet->endp_fullmesh_max, 0);
12811282 pernet->endpoints = 0;
12821283 }
12831284
net/mptcp/protocol.c+2−1
@@ -3302,7 +3302,8 @@ bool __mptcp_close(struct sock *sk, long timeout) · 3301 unmodified lines
33023302 goto cleanup;
33033303 }
33043304
3305− if (mptcp_data_avail(msk) || timeout < 0) {
3305+ if (mptcp_data_avail(msk) || timeout < 0 ||
3306+ (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime)) {
33063307 /* If the msk has read data, or the caller explicitly ask it,
33073308 * do the MPTCP equivalent of TCP reset, aka MPTCP fastclose
33083309 */
net/mptcp/sockopt.c+6−6
@@ -159,10 +159,10 @@ static int mptcp_setsockopt_sol_socket_tstamp(struct mptcp_sock *msk, int optnam · 158 unmodified lines
159159 lock_sock(sk);
160160 mptcp_for_each_subflow(msk, subflow) {
161161 struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
162− bool slow = lock_sock_fast(ssk);
163162
164− sock_set_timestamp(sk, optname, !!val);
165− unlock_sock_fast(ssk, slow);
163+ lock_sock(ssk);
164+ sock_set_timestamp(ssk, optname, !!val);
165+ release_sock(ssk);
166166 }
167167
168168 release_sock(sk);
@@ -235,10 +235,10 @@ static int mptcp_setsockopt_sol_socket_timestamping(struct mptcp_sock *msk, · 66 unmodified lines
235235
236236 mptcp_for_each_subflow(msk, subflow) {
237237 struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
238− bool slow = lock_sock_fast(ssk);
239238
240− sock_set_timestamping(sk, optname, timestamping);
241− unlock_sock_fast(ssk, slow);
239+ lock_sock(ssk);
240+ sock_set_timestamping(ssk, optname, timestamping);
241+ release_sock(ssk);
242242 }
243243
244244 release_sock(sk);
net/netfilter/nf_conntrack_proto_sctp.c+7−3
@@ -466,9 +466,13 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct, · 465 unmodified lines
466466 if (!ih)
467467 goto out_unlock;
468468
469− if (ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir])
470− ct->proto.sctp.init[!dir] = 0;
471− ct->proto.sctp.init[dir] = 1;
469+ /* Do not record INIT matching peer vtag (stale or retransmitted INIT). */
470+ if (old_state == SCTP_CONNTRACK_NONE ||
471+ ct->proto.sctp.vtag[!dir] != ih->init_tag) {
472+ if (ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir])
473+ ct->proto.sctp.init[!dir] = 0;
474+ ct->proto.sctp.init[dir] = 1;
475+ }
472476
473477 pr_debug("Setting vtag %x for dir %d\n", ih->init_tag, !dir);
474478 ct->proto.sctp.vtag[!dir] = ih->init_tag;
net/netfilter/nf_conntrack_sip.c+118−34
@@ -181,6 +181,57 @@ static int sip_parse_addr(const struct nf_conn *ct, const char *cp, · 180 unmodified lines
181181 return 1;
182182 }
183183
184+/* Parse optional port number after IP address.
185+ * Returns false on malformed input, true otherwise.
186+ * If port is non-NULL, stores parsed port in network byte order.
187+ * If no port is present, sets *port to default SIP port.
188+ */
189+static bool sip_parse_port(const char *dptr, const char **endp,
190+ const char *limit, __be16 *port)
191+{
192+ unsigned int p = 0;
193+ int len = 0;
194+
195+ if (dptr >= limit)
196+ return false;
197+
198+ if (*dptr != ':') {
199+ if (port)
200+ *port = htons(SIP_PORT);
201+ if (endp)
202+ *endp = dptr;
203+ return true;
204+ }
205+
206+ dptr++; /* skip ':' */
207+
208+ while (dptr < limit && isdigit(*dptr)) {
209+ p = p * 10 + (*dptr - '0');
210+ dptr++;
211+ len++;
212+ if (len > 5) /* max "65535" */
213+ return false;
214+ }
215+
216+ if (len == 0)
217+ return false;
218+
219+ /* reached limit while parsing port */
220+ if (dptr >= limit)
221+ return false;
222+
223+ if (p < 1024 || p > 65535)
224+ return false;
225+
226+ if (port)
227+ *port = htons(p);
228+
229+ if (endp)
230+ *endp = dptr;
231+
232+ return true;
233+}
234+
184235 /* skip ip address. returns its length. */
185236 static int epaddr_len(const struct nf_conn *ct, const char *dptr,
186237 const char *limit, int *shift)
@@ -193,11 +244,8 @@ static int epaddr_len(const struct nf_conn *ct, const char *dptr, · 6 unmodified lines
193244 return 0;
194245 }
195246
196− /* Port number */
197− if (*dptr == ':') {
198− dptr++;
199− dptr += digits_len(ct, dptr, limit, shift);
200− }
247+ if (!sip_parse_port(dptr, &dptr, limit, NULL))
248+ return 0;
201249 return dptr - aux;
202250 }
203251
@@ -228,6 +276,51 @@ static int skp_epaddr_len(const struct nf_conn *ct, const char *dptr, · 24 unmodified lines
228276 return epaddr_len(ct, dptr, limit, shift);
229277 }
230278
279+/* simple_strtoul stops after first non-number character.
280+ * But as we're not dealing with c-strings, we can't rely on
281+ * hitting \r,\n,\0 etc. before moving past end of buffer.
282+ *
283+ * This is a variant of simple_strtoul, but doesn't require
284+ * a c-string.
285+ *
286+ * If value exceeds UINT_MAX, 0 is returned.
287+ */
288+static unsigned int sip_strtouint(const char *cp, unsigned int len, char **endp)
289+{
290+ const unsigned int max = sizeof("4294967295");
291+ unsigned int olen = len;
292+ const char *s = cp;
293+ u64 result = 0;
294+
295+ if (len > max)
296+ len = max;
297+
298+ while (olen > 0 && isdigit(*s)) {
299+ unsigned int value;
300+
301+ if (len == 0)
302+ goto err;
303+
304+ value = *s - '0';
305+ result = result * 10 + value;
306+
307+ if (result > UINT_MAX)
308+ goto err;
309+ s++;
310+ len--;
311+ olen--;
312+ }
313+
314+ if (endp)
315+ *endp = (char *)s;
316+
317+ return result;
318+err:
319+ if (endp)
320+ *endp = (char *)cp;
321+ return 0;
322+}
323+
231324 /* Parse a SIP request line of the form:
232325 *
233326 * Request-Line = Method SP Request-URI SP SIP-Version CRLF
@@ -241,7 +334,6 @@ int ct_sip_parse_request(const struct nf_conn *ct, · 7 unmodified lines
241334 {
242335 const char *start = dptr, *limit = dptr + datalen, *end;
243336 unsigned int mlen;
244− unsigned int p;
245337 int shift = 0;
246338
247339 /* Skip method and following whitespace */
@@ -267,14 +359,8 @@ int ct_sip_parse_request(const struct nf_conn *ct, · 19 unmodified lines
267359
268360 if (!sip_parse_addr(ct, dptr, &end, addr, limit, true))
269361 return -1;
270− if (end < limit && *end == ':') {
271− end++;
272− p = simple_strtoul(end, (char **)&end, 10);
273− if (p < 1024 || p > 65535)
274− return -1;
275− *port = htons(p);
276− } else
277− *port = htons(SIP_PORT);
362+ if (!sip_parse_port(end, &end, limit, port))
363+ return -1;
278364
279365 if (end == dptr)
280366 return 0;
@@ -509,7 +595,6 @@ int ct_sip_parse_header_uri(const struct nf_conn *ct, const char *dptr, · 228 unmodified lines
509595 union nf_inet_addr *addr, __be16 *port)
510596 {
511597 const char *c, *limit = dptr + datalen;
512− unsigned int p;
513598 int ret;
514599
515600 ret = ct_sip_walk_headers(ct, dptr, dataoff ? *dataoff : 0, datalen,
@@ -520,14 +605,8 @@ int ct_sip_parse_header_uri(const struct nf_conn *ct, const char *dptr, · 4 unmodified lines
520605
521606 if (!sip_parse_addr(ct, dptr + *matchoff, &c, addr, limit, true))
522607 return -1;
523− if (*c == ':') {
524− c++;
525− p = simple_strtoul(c, (char **)&c, 10);
526− if (p < 1024 || p > 65535)
527− return -1;
528− *port = htons(p);
529− } else
530− *port = htons(SIP_PORT);
608+ if (!sip_parse_port(c, &c, limit, port))
609+ return -1;
531610
532611 if (dataoff)
533612 *dataoff = c - dptr;
@@ -609,7 +688,7 @@ int ct_sip_parse_numerical_param(const struct nf_conn *ct, const char *dptr, · 75 unmodified lines
609688 return 0;
610689
611690 start += strlen(name);
612− *val = simple_strtoul(start, &end, 0);
691+ *val = sip_strtouint(start, limit - start, (char **)&end);
613692 if (start == end)
614693 return -1;
615694 if (matchoff && matchlen) {
@@ -1064,6 +1143,8 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff, · 448 unmodified lines
10641143
10651144 mediaoff = sdpoff;
10661145 for (i = 0; i < ARRAY_SIZE(sdp_media_types); ) {
1146+ char *end;
1147+
10671148 if (ct_sip_get_sdp_header(ct, *dptr, mediaoff, *datalen,
10681149 SDP_HDR_MEDIA, SDP_HDR_UNSPEC,
10691150 &mediaoff, &medialen) <= 0)
@@ -1079,8 +1160,8 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff, · 9 unmodified lines
10791160 mediaoff += t->len;
10801161 medialen -= t->len;
10811162
1082− port = simple_strtoul(*dptr + mediaoff, NULL, 10);
1083− if (port == 0)
1163+ port = sip_strtouint(*dptr + mediaoff, *datalen - mediaoff, (char **)&end);
1164+ if (port == 0 || *dptr + mediaoff == end)
10841165 continue;
10851166 if (port < 1024 || port > 65535) {
10861167 nf_ct_helper_log(skb, ct, "wrong port %u", port);
@@ -1254,7 +1335,7 @@ static int process_register_request(struct sk_buff *skb, unsigned int protoff, · 167 unmodified lines
12541335 */
12551336 if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_EXPIRES,
12561337 &matchoff, &matchlen) > 0)
1257− expires = simple_strtoul(*dptr + matchoff, NULL, 10);
1338+ expires = sip_strtouint(*dptr + matchoff, *datalen - matchoff, NULL);
12581339
12591340 ret = ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen,
12601341 SIP_HDR_CONTACT, NULL,
@@ -1358,7 +1439,7 @@ static int process_register_response(struct sk_buff *skb, unsigned int protoff, · 97 unmodified lines
13581439
13591440 if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_EXPIRES,
13601441 &matchoff, &matchlen) > 0)
1361− expires = simple_strtoul(*dptr + matchoff, NULL, 10);
1442+ expires = sip_strtouint(*dptr + matchoff, *datalen - matchoff, NULL);
13621443
13631444 while (1) {
13641445 unsigned int c_expires = expires;
@@ -1418,10 +1499,12 @@ static int process_sip_response(struct sk_buff *skb, unsigned int protoff, · 53 unmodified lines
14181499 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
14191500 unsigned int matchoff, matchlen, matchend;
14201501 unsigned int code, cseq, i;
1502+ char *end;
14211503
14221504 if (*datalen < strlen("SIP/2.0 200"))
14231505 return NF_ACCEPT;
1424− code = simple_strtoul(*dptr + strlen("SIP/2.0 "), NULL, 10);
1506+ code = sip_strtouint(*dptr + strlen("SIP/2.0 "),
1507+ *datalen - strlen("SIP/2.0 "), NULL);
14251508 if (!code) {
14261509 nf_ct_helper_log(skb, ct, "cannot get code");
14271510 return NF_DROP;
@@ -1432,8 +1515,8 @@ static int process_sip_response(struct sk_buff *skb, unsigned int protoff, · 4 unmodified lines
14321515 nf_ct_helper_log(skb, ct, "cannot parse cseq");
14331516 return NF_DROP;
14341517 }
1435− cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
1436− if (!cseq && *(*dptr + matchoff) != '0') {
1518+ cseq = sip_strtouint(*dptr + matchoff, *datalen - matchoff, (char **)&end);
1519+ if (*dptr + matchoff == end) {
14371520 nf_ct_helper_log(skb, ct, "cannot get cseq");
14381521 return NF_DROP;
14391522 }
@@ -1482,6 +1565,7 @@ static int process_sip_request(struct sk_buff *skb, unsigned int protoff, · 42 unmodified lines
14821565
14831566 for (i = 0; i < ARRAY_SIZE(sip_handlers); i++) {
14841567 const struct sip_handler *handler;
1568+ char *end;
14851569
14861570 handler = &sip_handlers[i];
14871571 if (handler->request == NULL)
@@ -1498,8 +1582,8 @@ static int process_sip_request(struct sk_buff *skb, unsigned int protoff, · 10 unmodified lines
14981582 nf_ct_helper_log(skb, ct, "cannot parse cseq");
14991583 return NF_DROP;
15001584 }
1501− cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
1502− if (!cseq && *(*dptr + matchoff) != '0') {
1585+ cseq = sip_strtouint(*dptr + matchoff, *datalen - matchoff, (char **)&end);
1586+ if (*dptr + matchoff == end) {
15031587 nf_ct_helper_log(skb, ct, "cannot get cseq");
15041588 return NF_DROP;
15051589 }
@@ -1575,7 +1659,7 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff, · 69 unmodified lines
15751659 &matchoff, &matchlen) <= 0)
15761660 break;
15771661
1578− clen = simple_strtoul(dptr + matchoff, (char **)&end, 10);
1662+ clen = sip_strtouint(dptr + matchoff, datalen - matchoff, (char **)&end);
15791663 if (dptr + matchoff == end)
15801664 break;
15811665
net/netfilter/nf_nat_sip.c+1−0
@@ -246,6 +246,7 @@ static unsigned int nf_nat_sip(struct sk_buff *skb, unsigned int protoff, · 245 unmodified lines
246246 if (ct_sip_parse_numerical_param(ct, *dptr, matchend, *datalen,
247247 "rport=", &poff, &plen,
248248 &n) > 0 &&
249+ n >= 1024 && n <= 65535 &&
249250 htons(n) == ct->tuplehash[dir].tuple.dst.u.udp.port &&
250251 htons(n) != ct->tuplehash[!dir].tuple.src.u.udp.port) {
251252 __be16 p = ct->tuplehash[!dir].tuple.src.u.udp.port;
net/netfilter/nf_tables_api.c+225−89
@@ -374,6 +374,38 @@ static void nft_netdev_hook_free_rcu(struct nft_hook *hook) · 373 unmodified lines
374374 call_rcu(&hook->rcu, __nft_netdev_hook_free_rcu);
375375 }
376376
377+static void nft_netdev_hook_unlink_free_rcu(struct nft_hook *hook)
378+{
379+ list_del_rcu(&hook->list);
380+ nft_netdev_hook_free_rcu(hook);
381+}
382+
383+static void nft_trans_hook_destroy(struct nft_trans_hook *trans_hook)
384+{
385+ list_del(&trans_hook->list);
386+ kfree(trans_hook);
387+}
388+
389+static void nft_netdev_unregister_trans_hook(struct net *net,
390+ const struct nft_table *table,
391+ struct list_head *hook_list)
392+{
393+ struct nft_trans_hook *trans_hook, *next;
394+ struct nf_hook_ops *ops;
395+ struct nft_hook *hook;
396+
397+ list_for_each_entry_safe(trans_hook, next, hook_list, list) {
398+ hook = trans_hook->hook;
399+
400+ if (!(table->flags & NFT_TABLE_F_DORMANT)) {
401+ list_for_each_entry(ops, &hook->ops_list, list)
402+ nf_unregister_net_hook(net, ops);
403+ }
404+ nft_netdev_hook_unlink_free_rcu(hook);
405+ nft_trans_hook_destroy(trans_hook);
406+ }
407+}
408+
377409 static void nft_netdev_unregister_hooks(struct net *net,
378410 struct list_head *hook_list,
379411 bool release_netdev)
@@ -384,10 +416,8 @@ static void nft_netdev_unregister_hooks(struct net *net, · 4 unmodified lines
384416 list_for_each_entry_safe(hook, next, hook_list, list) {
385417 list_for_each_entry(ops, &hook->ops_list, list)
386418 nf_unregister_net_hook(net, ops);
387− if (release_netdev) {
388− list_del(&hook->list);
389− nft_netdev_hook_free_rcu(hook);
390− }
419+ if (release_netdev)
420+ nft_netdev_hook_unlink_free_rcu(hook);
391421 }
392422 }
393423
@@ -1942,15 +1972,69 @@ static int nft_nla_put_hook_dev(struct sk_buff *skb, struct nft_hook *hook) · 1548 unmodified lines
19421972 return nla_put_string(skb, attr, hook->ifname);
19431973 }
19441974
1975+struct nft_hook_dump_ctx {
1976+ struct nft_hook *first;
1977+ int n;
1978+};
1979+
1980+static int nft_dump_basechain_hook_one(struct sk_buff *skb,
1981+ struct nft_hook *hook,
1982+ struct nft_hook_dump_ctx *dump_ctx)
1983+{
1984+ if (!dump_ctx->first)
1985+ dump_ctx->first = hook;
1986+
1987+ if (nft_nla_put_hook_dev(skb, hook))
1988+ return -1;
1989+
1990+ dump_ctx->n++;
1991+
1992+ return 0;
1993+}
1994+
1995+static int nft_dump_basechain_hook_list(struct sk_buff *skb,
1996+ const struct net *net,
1997+ const struct list_head *hook_list,
1998+ struct nft_hook_dump_ctx *dump_ctx)
1999+{
2000+ struct nft_hook *hook;
2001+ int err;
2002+
2003+ list_for_each_entry_rcu(hook, hook_list, list,
2004+ lockdep_commit_lock_is_held(net)) {
2005+ err = nft_dump_basechain_hook_one(skb, hook, dump_ctx);
2006+ if (err < 0)
2007+ return err;
2008+ }
2009+
2010+ return 0;
2011+}
2012+
2013+static int nft_dump_basechain_trans_hook_list(struct sk_buff *skb,
2014+ const struct list_head *trans_hook_list,
2015+ struct nft_hook_dump_ctx *dump_ctx)
2016+{
2017+ struct nft_trans_hook *trans_hook;
2018+ int err;
2019+
2020+ list_for_each_entry(trans_hook, trans_hook_list, list) {
2021+ err = nft_dump_basechain_hook_one(skb, trans_hook->hook, dump_ctx);
2022+ if (err < 0)
2023+ return err;
2024+ }
2025+
2026+ return 0;
2027+}
2028+
19452029 static int nft_dump_basechain_hook(struct sk_buff *skb,
19462030 const struct net *net, int family,
19472031 const struct nft_base_chain *basechain,
1948− const struct list_head *hook_list)
2032+ const struct list_head *hook_list,
2033+ const struct list_head *trans_hook_list)
19492034 {
19502035 const struct nf_hook_ops *ops = &basechain->ops;
1951− struct nft_hook *hook, *first = NULL;
2036+ struct nft_hook_dump_ctx dump_hook_ctx = {};
19522037 struct nlattr *nest, *nest_devs;
1953− int n = 0;
19542038
19552039 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_HOOK);
19562040 if (nest == NULL)
@@ -1965,23 +2049,23 @@ static int nft_dump_basechain_hook(struct sk_buff *skb, · 8 unmodified lines
19652049 if (!nest_devs)
19662050 goto nla_put_failure;
19672051
1968− if (!hook_list)
2052+ if (!hook_list && !trans_hook_list)
19692053 hook_list = &basechain->hook_list;
19702054
1971− list_for_each_entry_rcu(hook, hook_list, list,
1972− lockdep_commit_lock_is_held(net)) {
1973− if (!first)
1974− first = hook;
1975−
1976− if (nft_nla_put_hook_dev(skb, hook))
1977− goto nla_put_failure;
1978− n++;
2055+ if (hook_list &&
2056+ nft_dump_basechain_hook_list(skb, net, hook_list, &dump_hook_ctx)) {
2057+ goto nla_put_failure;
2058+ } else if (trans_hook_list &&
2059+ nft_dump_basechain_trans_hook_list(skb, trans_hook_list,
2060+ &dump_hook_ctx)) {
2061+ goto nla_put_failure;
19792062 }
2063+
19802064 nla_nest_end(skb, nest_devs);
19812065
1982− if (n == 1 &&
1983− !hook_is_prefix(first) &&
1984− nla_put_string(skb, NFTA_HOOK_DEV, first->ifname))
2066+ if (dump_hook_ctx.n == 1 &&
2067+ !hook_is_prefix(dump_hook_ctx.first) &&
2068+ nla_put_string(skb, NFTA_HOOK_DEV, dump_hook_ctx.first->ifname))
19852069 goto nla_put_failure;
19862070 }
19872071 nla_nest_end(skb, nest);
@@ -1995,7 +2079,8 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, · 7 unmodified lines
19952079 u32 portid, u32 seq, int event, u32 flags,
19962080 int family, const struct nft_table *table,
19972081 const struct nft_chain *chain,
1998− const struct list_head *hook_list)
2082+ const struct list_head *hook_list,
2083+ const struct list_head *trans_hook_list)
19992084 {
20002085 struct nlmsghdr *nlh;
20012086
@@ -2011,7 +2096,7 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, · 9 unmodified lines
20112096 NFTA_CHAIN_PAD))
20122097 goto nla_put_failure;
20132098
2014− if (!hook_list &&
2099+ if (!hook_list && !trans_hook_list &&
20152100 (event == NFT_MSG_DELCHAIN ||
20162101 event == NFT_MSG_DESTROYCHAIN)) {
20172102 nlmsg_end(skb, nlh);
@@ -2022,7 +2107,8 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, · 4 unmodified lines
20222107 const struct nft_base_chain *basechain = nft_base_chain(chain);
20232108 struct nft_stats __percpu *stats;
20242109
2025− if (nft_dump_basechain_hook(skb, net, family, basechain, hook_list))
2110+ if (nft_dump_basechain_hook(skb, net, family, basechain,
2111+ hook_list, trans_hook_list))
20262112 goto nla_put_failure;
20272113
20282114 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
@@ -2058,7 +2144,8 @@ nla_put_failure: · 29 unmodified lines
20582144 }
20592145
20602146 static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event,
2061− const struct list_head *hook_list)
2147+ const struct list_head *hook_list,
2148+ const struct list_head *trans_hook_list)
20622149 {
20632150 struct nftables_pernet *nft_net;
20642151 struct sk_buff *skb;
@@ -2078,7 +2165,7 @@ static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event, · 13 unmodified lines
20782165
20792166 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
20802167 event, flags, ctx->family, ctx->table,
2081− ctx->chain, hook_list);
2168+ ctx->chain, hook_list, trans_hook_list);
20822169 if (err < 0) {
20832170 kfree_skb(skb);
20842171 goto err;
@@ -2124,7 +2211,7 @@ static int nf_tables_dump_chains(struct sk_buff *skb, · 39 unmodified lines
21242211 NFT_MSG_NEWCHAIN,
21252212 NLM_F_MULTI,
21262213 table->family, table,
2127− chain, NULL) < 0)
2214+ chain, NULL, NULL) < 0)
21282215 goto done;
21292216
21302217 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
@@ -2178,7 +2265,7 @@ static int nf_tables_getchain(struct sk_buff *skb, const struct nfnl_info *info, · 47 unmodified lines
21782265
21792266 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
21802267 info->nlh->nlmsg_seq, NFT_MSG_NEWCHAIN,
2181− 0, family, table, chain, NULL);
2268+ 0, family, table, chain, NULL, NULL);
21822269 if (err < 0)
21832270 goto err_fill_chain_info;
21842271
@@ -2271,10 +2358,8 @@ void nf_tables_chain_destroy(struct nft_chain *chain) · 86 unmodified lines
22712358
22722359 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) {
22732360 list_for_each_entry_safe(hook, next,
2274− &basechain->hook_list, list) {
2275− list_del_rcu(&hook->list);
2276− nft_netdev_hook_free_rcu(hook);
2277− }
2361+ &basechain->hook_list, list)
2362+ nft_netdev_hook_unlink_free_rcu(hook);
22782363 }
22792364 module_put(basechain->type->owner);
22802365 if (rcu_access_pointer(basechain->stats)) {
@@ -2343,8 +2428,12 @@ static struct nft_hook *nft_hook_list_find(struct list_head *hook_list, · 62 unmodified lines
23432428
23442429 list_for_each_entry(hook, hook_list, list) {
23452430 if (!strncmp(hook->ifname, this->ifname,
2346− min(hook->ifnamelen, this->ifnamelen)))
2431+ min(hook->ifnamelen, this->ifnamelen))) {
2432+ if (hook->flags & NFT_HOOK_REMOVE)
2433+ continue;
2434+
23472435 return hook;
2436+ }
23482437 }
23492438
23502439 return NULL;
@@ -2974,6 +3063,7 @@ err_hooks: · 623 unmodified lines
29743063 list_for_each_entry(ops, &h->ops_list, list)
29753064 nf_unregister_net_hook(ctx->net, ops);
29763065 }
3066+ /* hook.list is on stack, no need for list_del_rcu() */
29773067 list_del(&h->list);
29783068 nft_netdev_hook_free_rcu(h);
29793069 }
@@ -3102,6 +3192,32 @@ static int nf_tables_newchain(struct sk_buff *skb, const struct nfnl_info *info, · 122 unmodified lines
31023192 return nf_tables_addchain(&ctx, family, policy, flags, extack);
31033193 }
31043194
3195+static int nft_trans_delhook(struct nft_hook *hook,
3196+ struct list_head *del_list)
3197+{
3198+ struct nft_trans_hook *trans_hook;
3199+
3200+ trans_hook = kmalloc_obj(*trans_hook, GFP_KERNEL);
3201+ if (!trans_hook)
3202+ return -ENOMEM;
3203+
3204+ trans_hook->hook = hook;
3205+ list_add_tail(&trans_hook->list, del_list);
3206+ hook->flags |= NFT_HOOK_REMOVE;
3207+
3208+ return 0;
3209+}
3210+
3211+static void nft_trans_delhook_abort(struct list_head *del_list)
3212+{
3213+ struct nft_trans_hook *trans_hook, *next;
3214+
3215+ list_for_each_entry_safe(trans_hook, next, del_list, list) {
3216+ trans_hook->hook->flags &= ~NFT_HOOK_REMOVE;
3217+ nft_trans_hook_destroy(trans_hook);
3218+ }
3219+}
3220+
31053221 static int nft_delchain_hook(struct nft_ctx *ctx,
31063222 struct nft_base_chain *basechain,
31073223 struct netlink_ext_ack *extack)
@@ -3128,7 +3244,10 @@ static int nft_delchain_hook(struct nft_ctx *ctx, · 20 unmodified lines
31283244 err = -ENOENT;
31293245 goto err_chain_del_hook;
31303246 }
3131− list_move(&hook->list, &chain_del_list);
3247+ if (nft_trans_delhook(hook, &chain_del_list) < 0) {
3248+ err = -ENOMEM;
3249+ goto err_chain_del_hook;
3250+ }
31323251 }
31333252
31343253 trans = nft_trans_alloc_chain(ctx, NFT_MSG_DELCHAIN);
@@ -3148,7 +3267,7 @@ static int nft_delchain_hook(struct nft_ctx *ctx, · 13 unmodified lines
31483267 return 0;
31493268
31503269 err_chain_del_hook:
3151− list_splice(&chain_del_list, &basechain->hook_list);
3270+ nft_trans_delhook_abort(&chain_del_list);
31523271 nft_chain_release_hook(&chain_hook);
31533272
31543273 return err;
@@ -8852,10 +8971,8 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net, · 5697 unmodified lines
88528971 list_for_each_entry_safe(hook, next, hook_list, list) {
88538972 list_for_each_entry(ops, &hook->ops_list, list)
88548973 nft_unregister_flowtable_ops(net, flowtable, ops);
8855− if (release_netdev) {
8856− list_del(&hook->list);
8857− nft_netdev_hook_free_rcu(hook);
8858− }
8974+ if (release_netdev)
8975+ nft_netdev_hook_unlink_free_rcu(hook);
88598976 }
88608977 }
88618978
@@ -8926,8 +9043,7 @@ err_unregister_net_hooks: · 64 unmodified lines
89269043
89279044 nft_unregister_flowtable_ops(net, flowtable, ops);
89289045 }
8929− list_del_rcu(&hook->list);
8930− nft_netdev_hook_free_rcu(hook);
9046+ nft_netdev_hook_unlink_free_rcu(hook);
89319047 }
89329048
89339049 return err;
@@ -8937,9 +9053,25 @@ static void nft_hooks_destroy(struct list_head *hook_list) · 3 unmodified lines
89379053 {
89389054 struct nft_hook *hook, *next;
89399055
8940− list_for_each_entry_safe(hook, next, hook_list, list) {
8941− list_del_rcu(&hook->list);
8942− nft_netdev_hook_free_rcu(hook);
9056+ list_for_each_entry_safe(hook, next, hook_list, list)
9057+ nft_netdev_hook_unlink_free_rcu(hook);
9058+}
9059+
9060+static void nft_flowtable_unregister_trans_hook(struct net *net,
9061+ struct nft_flowtable *flowtable,
9062+ struct list_head *hook_list)
9063+{
9064+ struct nft_trans_hook *trans_hook, *next;
9065+ struct nf_hook_ops *ops;
9066+ struct nft_hook *hook;
9067+
9068+ list_for_each_entry_safe(trans_hook, next, hook_list, list) {
9069+ hook = trans_hook->hook;
9070+ list_for_each_entry(ops, &hook->ops_list, list)
9071+ nft_unregister_flowtable_ops(net, flowtable, ops);
9072+
9073+ nft_netdev_hook_unlink_free_rcu(hook);
9074+ nft_trans_hook_destroy(trans_hook);
89439075 }
89449076 }
89459077
@@ -9028,8 +9160,7 @@ err_flowtable_update_hook: · 82 unmodified lines
90289160 nft_unregister_flowtable_ops(ctx->net,
90299161 flowtable, ops);
90309162 }
9031− list_del_rcu(&hook->list);
9032− nft_netdev_hook_free_rcu(hook);
9163+ nft_netdev_hook_unlink_free_rcu(hook);
90339164 }
90349165
90359166 return err;
@@ -9202,7 +9333,10 @@ static int nft_delflowtable_hook(struct nft_ctx *ctx, · 166 unmodified lines
92029333 err = -ENOENT;
92039334 goto err_flowtable_del_hook;
92049335 }
9205− list_move(&hook->list, &flowtable_del_list);
9336+ if (nft_trans_delhook(hook, &flowtable_del_list) < 0) {
9337+ err = -ENOMEM;
9338+ goto err_flowtable_del_hook;
9339+ }
92069340 }
92079341
92089342 trans = nft_trans_alloc(ctx, NFT_MSG_DELFLOWTABLE,
@@ -9223,7 +9357,7 @@ static int nft_delflowtable_hook(struct nft_ctx *ctx, · 14 unmodified lines
92239357 return 0;
92249358
92259359 err_flowtable_del_hook:
9226− list_splice(&flowtable_del_list, &flowtable->hook_list);
9360+ nft_trans_delhook_abort(&flowtable_del_list);
92279361 nft_flowtable_hook_release(&flowtable_hook);
92289362
92299363 return err;
@@ -9288,8 +9422,10 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, · 58 unmodified lines
92889422 u32 portid, u32 seq, int event,
92899423 u32 flags, int family,
92909424 struct nft_flowtable *flowtable,
9291− struct list_head *hook_list)
9425+ struct list_head *hook_list,
9426+ struct list_head *trans_hook_list)
92929427 {
9428+ struct nft_trans_hook *trans_hook;
92939429 struct nlattr *nest, *nest_devs;
92949430 struct nft_hook *hook;
92959431 struct nlmsghdr *nlh;
@@ -9306,7 +9442,7 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, · 10 unmodified lines
93069442 NFTA_FLOWTABLE_PAD))
93079443 goto nla_put_failure;
93089444
9309− if (!hook_list &&
9445+ if (!hook_list && !trans_hook_list &&
93109446 (event == NFT_MSG_DELFLOWTABLE ||
93119447 event == NFT_MSG_DESTROYFLOWTABLE)) {
93129448 nlmsg_end(skb, nlh);
@@ -9328,13 +9464,20 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, · 15 unmodified lines
93289464 if (!nest_devs)
93299465 goto nla_put_failure;
93309466
9331− if (!hook_list)
9467+ if (!hook_list && !trans_hook_list)
93329468 hook_list = &flowtable->hook_list;
93339469
9334− list_for_each_entry_rcu(hook, hook_list, list,
9335− lockdep_commit_lock_is_held(net)) {
9336− if (nft_nla_put_hook_dev(skb, hook))
9337− goto nla_put_failure;
9470+ if (hook_list) {
9471+ list_for_each_entry_rcu(hook, hook_list, list,
9472+ lockdep_commit_lock_is_held(net)) {
9473+ if (nft_nla_put_hook_dev(skb, hook))
9474+ goto nla_put_failure;
9475+ }
9476+ } else if (trans_hook_list) {
9477+ list_for_each_entry(trans_hook, trans_hook_list, list) {
9478+ if (nft_nla_put_hook_dev(skb, trans_hook->hook))
9479+ goto nla_put_failure;
9480+ }
93389481 }
93399482 nla_nest_end(skb, nest_devs);
93409483 nla_nest_end(skb, nest);
@@ -9388,7 +9531,7 @@ static int nf_tables_dump_flowtable(struct sk_buff *skb, · 47 unmodified lines
93889531 NFT_MSG_NEWFLOWTABLE,
93899532 NLM_F_MULTI | NLM_F_APPEND,
93909533 table->family,
9391− flowtable, NULL) < 0)
9534+ flowtable, NULL, NULL) < 0)
93929535 goto done;
93939536
93949537 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
@@ -9488,7 +9631,7 @@ static int nf_tables_getflowtable(struct sk_buff *skb, · 93 unmodified lines
94889631 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
94899632 info->nlh->nlmsg_seq,
94909633 NFT_MSG_NEWFLOWTABLE, 0, family,
9491− flowtable, NULL);
9634+ flowtable, NULL, NULL);
94929635 if (err < 0)
94939636 goto err_fill_flowtable_info;
94949637
@@ -9501,7 +9644,9 @@ err_fill_flowtable_info: · 6 unmodified lines
95019644
95029645 static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
95039646 struct nft_flowtable *flowtable,
9504− struct list_head *hook_list, int event)
9647+ struct list_head *hook_list,
9648+ struct list_head *trans_hook_list,
9649+ int event)
95059650 {
95069651 struct nftables_pernet *nft_net = nft_pernet(ctx->net);
95079652 struct sk_buff *skb;
@@ -9521,7 +9666,8 @@ static void nf_tables_flowtable_notify(struct nft_ctx *ctx, · 13 unmodified lines
95219666
95229667 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
95239668 ctx->seq, event, flags,
9524− ctx->family, flowtable, hook_list);
9669+ ctx->family, flowtable,
9670+ hook_list, trans_hook_list);
95259671 if (err < 0) {
95269672 kfree_skb(skb);
95279673 goto err;
@@ -9535,13 +9681,8 @@ err: · 7 unmodified lines
95359681
95369682 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
95379683 {
9538− struct nft_hook *hook, *next;
9539−
95409684 flowtable->data.type->free(&flowtable->data);
9541− list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
9542− list_del_rcu(&hook->list);
9543− nft_netdev_hook_free_rcu(hook);
9544− }
9685+ nft_hooks_destroy(&flowtable->hook_list);
95459686 kfree(flowtable->name);
95469687 module_put(flowtable->data.type->owner);
95479688 kfree(flowtable);
@@ -10060,9 +10201,7 @@ static void nft_commit_release(struct nft_trans *trans) · 512 unmodified lines
1006010201 break;
1006110202 case NFT_MSG_DELCHAIN:
1006210203 case NFT_MSG_DESTROYCHAIN:
10063− if (nft_trans_chain_update(trans))
10064− nft_hooks_destroy(&nft_trans_chain_hooks(trans));
10065− else
10204+ if (!nft_trans_chain_update(trans))
1006610205 nf_tables_chain_destroy(nft_trans_chain(trans));
1006710206 break;
1006810207 case NFT_MSG_DELRULE:
@@ -10083,9 +10222,7 @@ static void nft_commit_release(struct nft_trans *trans) · 14 unmodified lines
1008310222 break;
1008410223 case NFT_MSG_DELFLOWTABLE:
1008510224 case NFT_MSG_DESTROYFLOWTABLE:
10086− if (nft_trans_flowtable_update(trans))
10087− nft_hooks_destroy(&nft_trans_flowtable_hooks(trans));
10088− else
10225+ if (!nft_trans_flowtable_update(trans))
1008910226 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
1009010227 break;
1009110228 }
@@ -10845,31 +10982,28 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) · 753 unmodified lines
1084510982 if (nft_trans_chain_update(trans)) {
1084610983 nft_chain_commit_update(nft_trans_container_chain(trans));
1084710984 nf_tables_chain_notify(&ctx, NFT_MSG_NEWCHAIN,
10848− &nft_trans_chain_hooks(trans));
10849− list_splice(&nft_trans_chain_hooks(trans),
10850− &nft_trans_basechain(trans)->hook_list);
10985+ &nft_trans_chain_hooks(trans), NULL);
10986+ list_splice_rcu(&nft_trans_chain_hooks(trans),
10987+ &nft_trans_basechain(trans)->hook_list);
1085110988 /* trans destroyed after rcu grace period */
1085210989 } else {
1085310990 nft_chain_commit_drop_policy(nft_trans_container_chain(trans));
1085410991 nft_clear(net, nft_trans_chain(trans));
10855− nf_tables_chain_notify(&ctx, NFT_MSG_NEWCHAIN, NULL);
10992+ nf_tables_chain_notify(&ctx, NFT_MSG_NEWCHAIN, NULL, NULL);
1085610993 nft_trans_destroy(trans);
1085710994 }
1085810995 break;
1085910996 case NFT_MSG_DELCHAIN:
1086010997 case NFT_MSG_DESTROYCHAIN:
1086110998 if (nft_trans_chain_update(trans)) {
10862− nf_tables_chain_notify(&ctx, NFT_MSG_DELCHAIN,
10999+ nf_tables_chain_notify(&ctx, NFT_MSG_DELCHAIN, NULL,
1086311000 &nft_trans_chain_hooks(trans));
10864− if (!(table->flags & NFT_TABLE_F_DORMANT)) {
10865− nft_netdev_unregister_hooks(net,
10866− &nft_trans_chain_hooks(trans),
10867− true);
10868− }
11001+ nft_netdev_unregister_trans_hook(net, table,
11002+ &nft_trans_chain_hooks(trans));
1086911003 } else {
1087011004 nft_chain_del(nft_trans_chain(trans));
1087111005 nf_tables_chain_notify(&ctx, NFT_MSG_DELCHAIN,
10872− NULL);
11006+ NULL, NULL);
1087311007 nf_tables_unregister_hook(ctx.net, ctx.table,
1087411008 nft_trans_chain(trans));
1087511009 }
@@ -10975,14 +11109,16 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) · 99 unmodified lines
1097511109 nf_tables_flowtable_notify(&ctx,
1097611110 nft_trans_flowtable(trans),
1097711111 &nft_trans_flowtable_hooks(trans),
11112+ NULL,
1097811113 NFT_MSG_NEWFLOWTABLE);
10979− list_splice(&nft_trans_flowtable_hooks(trans),
10980− &nft_trans_flowtable(trans)->hook_list);
11114+ list_splice_rcu(&nft_trans_flowtable_hooks(trans),
11115+ &nft_trans_flowtable(trans)->hook_list);
1098111116 } else {
1098211117 nft_clear(net, nft_trans_flowtable(trans));
1098311118 nf_tables_flowtable_notify(&ctx,
1098411119 nft_trans_flowtable(trans),
1098511120 NULL,
11121+ NULL,
1098611122 NFT_MSG_NEWFLOWTABLE);
1098711123 }
1098811124 nft_trans_destroy(trans);
@@ -10992,16 +11128,18 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) · 3 unmodified lines
1099211128 if (nft_trans_flowtable_update(trans)) {
1099311129 nf_tables_flowtable_notify(&ctx,
1099411130 nft_trans_flowtable(trans),
11131+ NULL,
1099511132 &nft_trans_flowtable_hooks(trans),
1099611133 trans->msg_type);
10997− nft_unregister_flowtable_net_hooks(net,
10998− nft_trans_flowtable(trans),
10999− &nft_trans_flowtable_hooks(trans));
11134+ nft_flowtable_unregister_trans_hook(net,
11135+ nft_trans_flowtable(trans),
11136+ &nft_trans_flowtable_hooks(trans));
1100011137 } else {
1100111138 list_del_rcu(&nft_trans_flowtable(trans)->list);
1100211139 nf_tables_flowtable_notify(&ctx,
1100311140 nft_trans_flowtable(trans),
1100411141 NULL,
11142+ NULL,
1100511143 trans->msg_type);
1100611144 nft_unregister_flowtable_net_hooks(net,
1100711145 nft_trans_flowtable(trans),
@@ -11165,8 +11303,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) · 157 unmodified lines
1116511303 case NFT_MSG_DELCHAIN:
1116611304 case NFT_MSG_DESTROYCHAIN:
1116711305 if (nft_trans_chain_update(trans)) {
11168− list_splice(&nft_trans_chain_hooks(trans),
11169− &nft_trans_basechain(trans)->hook_list);
11306+ nft_trans_delhook_abort(&nft_trans_chain_hooks(trans));
1117011307 } else {
1117111308 nft_use_inc_restore(&table->use);
1117211309 nft_clear(trans->net, nft_trans_chain(trans));
@@ -11280,8 +11417,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) · 107 unmodified lines
1128011417 case NFT_MSG_DELFLOWTABLE:
1128111418 case NFT_MSG_DESTROYFLOWTABLE:
1128211419 if (nft_trans_flowtable_update(trans)) {
11283− list_splice(&nft_trans_flowtable_hooks(trans),
11284− &nft_trans_flowtable(trans)->hook_list);
11420+ nft_trans_delhook_abort(&nft_trans_flowtable_hooks(trans));
1128511421 } else {
1128611422 nft_use_inc_restore(&table->use);
1128711423 nft_clear(trans->net, nft_trans_flowtable(trans));
net/netfilter/nft_bitwise.c+2−1
@@ -196,7 +196,8 @@ static int nft_bitwise_init_shift(struct nft_bitwise *priv, · 195 unmodified lines
196196 if (err < 0)
197197 return err;
198198
199− if (priv->data.data[0] >= BITS_PER_TYPE(u32)) {
199+ if (!priv->data.data[0] ||
200+ priv->data.data[0] >= BITS_PER_TYPE(u32)) {
200201 nft_data_release(&priv->data, desc.type);
201202 return -EINVAL;
202203 }
net/netfilter/xt_policy.c+1−1
@@ -63,7 +63,7 @@ match_policy_in(const struct sk_buff *skb, const struct xt_policy_info *info, · 62 unmodified lines
6363 return 0;
6464
6565 for (i = sp->len - 1; i >= 0; i--) {
66− pos = strict ? i - sp->len + 1 : 0;
66+ pos = strict ? sp->len - i - 1 : 0;
6767 if (pos >= info->len)
6868 return 0;
6969 e = &info->pol[pos];
net/phonet/socket.c+8−2
@@ -208,9 +208,15 @@ static int pn_socket_autobind(struct socket *sock) · 207 unmodified lines
208208 sa.spn_family = AF_PHONET;
209209 err = pn_socket_bind(sock, (struct sockaddr_unsized *)&sa,
210210 sizeof(struct sockaddr_pn));
211− if (err != -EINVAL)
211+ /*
212+ * pn_socket_bind() also returns -EINVAL when sk_state != TCP_CLOSE
213+ * without a prior bind, so -EINVAL alone is not sufficient to infer
214+ * that the socket was already bound. Only treat it as "already
215+ * bound" when the port is non-zero; otherwise propagate the error
216+ * instead of crashing the kernel.
217+ */
218+ if (err != -EINVAL || unlikely(!pn_port(pn_sk(sock->sk)->sobject)))
212219 return err;
213− BUG_ON(!pn_port(pn_sk(sock->sk)->sobject));
214220 return 0; /* socket was already bound */
215221 }
216222
net/psp/psp-nl-gen.c+2−2
@@ -76,7 +76,7 @@ static const struct genl_split_ops psp_nl_ops[] = { · 75 unmodified lines
7676 .post_doit = psp_device_unlock,
7777 .policy = psp_dev_set_nl_policy,
7878 .maxattr = PSP_A_DEV_PSP_VERSIONS_ENA,
79− .flags = GENL_CMD_CAP_DO,
79+ .flags = GENL_ADMIN_PERM | GENL_CMD_CAP_DO,
8080 },
8181 {
8282 .cmd = PSP_CMD_KEY_ROTATE,
@@ -85,7 +85,7 @@ static const struct genl_split_ops psp_nl_ops[] = { · 2 unmodified lines
8585 .post_doit = psp_device_unlock,
8686 .policy = psp_key_rotate_nl_policy,
8787 .maxattr = PSP_A_DEV_ID,
88− .flags = GENL_CMD_CAP_DO,
88+ .flags = GENL_ADMIN_PERM | GENL_CMD_CAP_DO,
8989 },
9090 {
9191 .cmd = PSP_CMD_RX_ASSOC,
net/psp/psp_nl.c+7−3
@@ -305,8 +305,13 @@ int psp_assoc_device_get_locked(const struct genl_split_ops *ops, · 304 unmodified lines
305305
306306 psd = psp_dev_get_for_sock(socket->sk);
307307 if (psd) {
308− err = psp_dev_check_access(psd, genl_info_net(info));
309− if (err) {
308+ /* Extra care needed here, psp_dev_get_for_sock() only gives
309+ * us access to struct psp_dev's memory, which is quite weak.
310+ */
311+ mutex_lock(&psd->lock);
312+ if (!psp_dev_is_registered(psd) ||
313+ psp_dev_check_access(psd, genl_info_net(info))) {
314+ mutex_unlock(&psd->lock);
310315 psp_dev_put(psd);
311316 psd = NULL;
312317 }
@@ -319,7 +324,6 @@ int psp_assoc_device_get_locked(const struct genl_split_ops *ops, · 6 unmodified lines
319324
320325 id = info->attrs[PSP_A_ASSOC_DEV_ID];
321326 if (psd) {
322− mutex_lock(&psd->lock);
323327 if (id && psd->id != nla_get_u32(id)) {
324328 mutex_unlock(&psd->lock);
325329 NL_SET_ERR_MSG_ATTR(info->extack, id,
net/sched/sch_cake.c+113−104
@@ -813,7 +813,7 @@ skip_hash: · 812 unmodified lines
813813 i++, k = (k + 1) % CAKE_SET_WAYS) {
814814 if (q->tags[outer_hash + k] == flow_hash) {
815815 if (i)
816− q->way_hits++;
816+ WRITE_ONCE(q->way_hits, q->way_hits + 1);
817817
818818 if (!q->flows[outer_hash + k].set) {
819819 /* need to increment host refcnts */
@@ -831,7 +831,7 @@ skip_hash: · 11 unmodified lines
831831 for (i = 0; i < CAKE_SET_WAYS;
832832 i++, k = (k + 1) % CAKE_SET_WAYS) {
833833 if (!q->flows[outer_hash + k].set) {
834− q->way_misses++;
834+ WRITE_ONCE(q->way_misses, q->way_misses + 1);
835835 allocate_src = cake_dsrc(flow_mode);
836836 allocate_dst = cake_ddst(flow_mode);
837837 goto found;
@@ -841,7 +841,7 @@ skip_hash: · 3 unmodified lines
841841 /* With no empty queues, default to the original
842842 * queue, accept the collision, update the host tags.
843843 */
844− q->way_collisions++;
844+ WRITE_ONCE(q->way_collisions, q->way_collisions + 1);
845845 allocate_src = cake_dsrc(flow_mode);
846846 allocate_dst = cake_ddst(flow_mode);
847847
@@ -1379,9 +1379,9 @@ static u32 cake_calc_overhead(struct cake_sched_data *qd, u32 len, u32 off) · 531 unmodified lines
13791379 len -= off;
13801380
13811381 if (qd->max_netlen < len)
1382− qd->max_netlen = len;
1382+ WRITE_ONCE(qd->max_netlen, len);
13831383 if (qd->min_netlen > len)
1384− qd->min_netlen = len;
1384+ WRITE_ONCE(qd->min_netlen, len);
13851385
13861386 len += q->rate_overhead;
13871387
@@ -1401,9 +1401,9 @@ static u32 cake_calc_overhead(struct cake_sched_data *qd, u32 len, u32 off) · 13 unmodified lines
14011401 }
14021402
14031403 if (qd->max_adjlen < len)
1404− qd->max_adjlen = len;
1404+ WRITE_ONCE(qd->max_adjlen, len);
14051405 if (qd->min_adjlen > len)
1406− qd->min_adjlen = len;
1406+ WRITE_ONCE(qd->min_adjlen, len);
14071407
14081408 return len;
14091409 }
@@ -1416,7 +1416,7 @@ static u32 cake_overhead(struct cake_sched_data *q, const struct sk_buff *skb) · 6 unmodified lines
14161416 u16 segs = qdisc_pkt_segs(skb);
14171417 u32 len = qdisc_pkt_len(skb);
14181418
1419− q->avg_netoff = cake_ewma(q->avg_netoff, off << 16, 8);
1419+ WRITE_ONCE(q->avg_netoff, cake_ewma(q->avg_netoff, off << 16, 8));
14201420
14211421 if (segs == 1)
14221422 return cake_calc_overhead(q, len, off);
@@ -1590,16 +1590,17 @@ static unsigned int cake_drop(struct Qdisc *sch, struct sk_buff **to_free) · 167 unmodified lines
15901590 }
15911591
15921592 if (cobalt_queue_full(&flow->cvars, &b->cparams, now))
1593− b->unresponsive_flow_count++;
1593+ WRITE_ONCE(b->unresponsive_flow_count,
1594+ b->unresponsive_flow_count + 1);
15941595
15951596 len = qdisc_pkt_len(skb);
15961597 q->buffer_used -= skb->truesize;
15971598 b->backlogs[idx] -= len;
1598− b->tin_backlog -= len;
1599+ WRITE_ONCE(b->tin_backlog, b->tin_backlog - len);
15991600 sch->qstats.backlog -= len;
16001601
16011602 flow->dropped++;
1602− b->tin_dropped++;
1603+ WRITE_ONCE(b->tin_dropped, b->tin_dropped + 1);
16031604
16041605 if (q->config->rate_flags & CAKE_FLAG_INGRESS)
16051606 cake_advance_shaper(q, b, skb, now, true);
@@ -1795,7 +1796,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, · 189 unmodified lines
17951796 }
17961797
17971798 if (unlikely(len > b->max_skblen))
1798− b->max_skblen = len;
1799+ WRITE_ONCE(b->max_skblen, len);
17991800
18001801 if (qdisc_pkt_segs(skb) > 1 && q->config->rate_flags & CAKE_FLAG_SPLIT_GSO) {
18011802 struct sk_buff *segs, *nskb;
@@ -1819,15 +1820,15 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, · 17 unmodified lines
18191820 numsegs++;
18201821 slen += segs->len;
18211822 q->buffer_used += segs->truesize;
1822− b->packets++;
1823+ WRITE_ONCE(b->packets, b->packets + 1);
18231824 }
18241825
18251826 /* stats */
1826− b->bytes += slen;
18271827 b->backlogs[idx] += slen;
1828− b->tin_backlog += slen;
18291828 sch->qstats.backlog += slen;
18301829 q->avg_window_bytes += slen;
1830+ WRITE_ONCE(b->bytes, b->bytes + slen);
1831+ WRITE_ONCE(b->tin_backlog, b->tin_backlog + slen);
18311832
18321833 qdisc_tree_reduce_backlog(sch, 1-numsegs, len-slen);
18331834 consume_skb(skb);
@@ -1843,10 +1844,10 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, · 9 unmodified lines
18431844 ack = cake_ack_filter(q, flow);
18441845
18451846 if (ack) {
1846− b->ack_drops++;
1847+ WRITE_ONCE(b->ack_drops, b->ack_drops + 1);
18471848 sch->qstats.drops++;
18481849 ack_pkt_len = qdisc_pkt_len(ack);
1849− b->bytes += ack_pkt_len;
1850+ WRITE_ONCE(b->bytes, b->bytes + ack_pkt_len);
18501851 q->buffer_used += skb->truesize - ack->truesize;
18511852 if (q->config->rate_flags & CAKE_FLAG_INGRESS)
18521853 cake_advance_shaper(q, b, ack, now, true);
@@ -1859,12 +1860,12 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, · 6 unmodified lines
18591860 }
18601861
18611862 /* stats */
1862− b->packets++;
1863− b->bytes += len - ack_pkt_len;
1863+ WRITE_ONCE(b->packets, b->packets + 1);
18641864 b->backlogs[idx] += len - ack_pkt_len;
1865− b->tin_backlog += len - ack_pkt_len;
18661865 sch->qstats.backlog += len - ack_pkt_len;
18671866 q->avg_window_bytes += len - ack_pkt_len;
1867+ WRITE_ONCE(b->bytes, b->bytes + len - ack_pkt_len);
1868+ WRITE_ONCE(b->tin_backlog, b->tin_backlog + len - ack_pkt_len);
18681869 }
18691870
18701871 if (q->overflow_timeout)
@@ -1894,9 +1895,9 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, · 23 unmodified lines
18941895 u64 b = q->avg_window_bytes * (u64)NSEC_PER_SEC;
18951896
18961897 b = div64_u64(b, window_interval);
1897− q->avg_peak_bandwidth =
1898− cake_ewma(q->avg_peak_bandwidth, b,
1899− b > q->avg_peak_bandwidth ? 2 : 8);
1898+ WRITE_ONCE(q->avg_peak_bandwidth,
1899+ cake_ewma(q->avg_peak_bandwidth, b,
1900+ b > q->avg_peak_bandwidth ? 2 : 8));
19001901 q->avg_window_bytes = 0;
19011902 q->avg_window_begin = now;
19021903
@@ -1917,11 +1918,11 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, · 14 unmodified lines
19171918 if (!flow->set) {
19181919 list_add_tail(&flow->flowchain, &b->new_flows);
19191920 } else {
1920− b->decaying_flow_count--;
1921+ WRITE_ONCE(b->decaying_flow_count, b->decaying_flow_count - 1);
19211922 list_move_tail(&flow->flowchain, &b->new_flows);
19221923 }
19231924 flow->set = CAKE_SET_SPARSE;
1924− b->sparse_flow_count++;
1925+ WRITE_ONCE(b->sparse_flow_count, b->sparse_flow_count + 1);
19251926
19261927 flow->deficit = cake_get_flow_quantum(b, flow, q->config->flow_mode);
19271928 } else if (flow->set == CAKE_SET_SPARSE_WAIT) {
@@ -1929,15 +1930,15 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, · 1 unmodified line
19291930 * in the bulk rotation.
19301931 */
19311932 flow->set = CAKE_SET_BULK;
1932− b->sparse_flow_count--;
1933− b->bulk_flow_count++;
1933+ WRITE_ONCE(b->sparse_flow_count, b->sparse_flow_count - 1);
1934+ WRITE_ONCE(b->bulk_flow_count, b->bulk_flow_count + 1);
19341935
19351936 cake_inc_srchost_bulk_flow_count(b, flow, q->config->flow_mode);
19361937 cake_inc_dsthost_bulk_flow_count(b, flow, q->config->flow_mode);
19371938 }
19381939
19391940 if (q->buffer_used > q->buffer_max_used)
1940− q->buffer_max_used = q->buffer_used;
1941+ WRITE_ONCE(q->buffer_max_used, q->buffer_used);
19411942
19421943 if (q->buffer_used <= q->buffer_limit)
19431944 return NET_XMIT_SUCCESS;
@@ -1977,7 +1978,7 @@ static struct sk_buff *cake_dequeue_one(struct Qdisc *sch) · 33 unmodified lines
19771978 skb = dequeue_head(flow);
19781979 len = qdisc_pkt_len(skb);
19791980 b->backlogs[q->cur_flow] -= len;
1980− b->tin_backlog -= len;
1981+ WRITE_ONCE(b->tin_backlog, b->tin_backlog - len);
19811982 sch->qstats.backlog -= len;
19821983 q->buffer_used -= skb->truesize;
19831984 sch->q.qlen--;
@@ -2042,7 +2043,7 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) · 58 unmodified lines
20422043
20432044 cake_configure_rates(sch, new_rate, true);
20442045 q->last_checked_active = now;
2045− q->active_queues = num_active_qs;
2046+ WRITE_ONCE(q->active_queues, num_active_qs);
20462047 }
20472048
20482049 begin:
@@ -2149,8 +2150,8 @@ retry: · 100 unmodified lines
21492150 */
21502151 if (flow->set == CAKE_SET_SPARSE) {
21512152 if (flow->head) {
2152− b->sparse_flow_count--;
2153− b->bulk_flow_count++;
2153+ WRITE_ONCE(b->sparse_flow_count, b->sparse_flow_count - 1);
2154+ WRITE_ONCE(b->bulk_flow_count, b->bulk_flow_count + 1);
21542155
21552156 cake_inc_srchost_bulk_flow_count(b, flow, q->config->flow_mode);
21562157 cake_inc_dsthost_bulk_flow_count(b, flow, q->config->flow_mode);
@@ -2177,7 +2178,8 @@ retry: · 20 unmodified lines
21772178 if (!skb) {
21782179 /* this queue was actually empty */
21792180 if (cobalt_queue_empty(&flow->cvars, &b->cparams, now))
2180− b->unresponsive_flow_count--;
2181+ WRITE_ONCE(b->unresponsive_flow_count,
2182+ b->unresponsive_flow_count - 1);
21812183
21822184 if (flow->cvars.p_drop || flow->cvars.count ||
21832185 ktime_before(now, flow->cvars.drop_next)) {
@@ -2187,32 +2189,32 @@ retry: · 3 unmodified lines
21872189 list_move_tail(&flow->flowchain,
21882190 &b->decaying_flows);
21892191 if (flow->set == CAKE_SET_BULK) {
2190− b->bulk_flow_count--;
2192+ WRITE_ONCE(b->bulk_flow_count, b->bulk_flow_count - 1);
21912193
21922194 cake_dec_srchost_bulk_flow_count(b, flow, q->config->flow_mode);
21932195 cake_dec_dsthost_bulk_flow_count(b, flow, q->config->flow_mode);
21942196
2195− b->decaying_flow_count++;
2197+ WRITE_ONCE(b->decaying_flow_count, b->decaying_flow_count + 1);
21962198 } else if (flow->set == CAKE_SET_SPARSE ||
21972199 flow->set == CAKE_SET_SPARSE_WAIT) {
2198− b->sparse_flow_count--;
2199− b->decaying_flow_count++;
2200+ WRITE_ONCE(b->sparse_flow_count, b->sparse_flow_count - 1);
2201+ WRITE_ONCE(b->decaying_flow_count, b->decaying_flow_count + 1);
22002202 }
22012203 flow->set = CAKE_SET_DECAYING;
22022204 } else {
22032205 /* remove empty queue from the flowchain */
22042206 list_del_init(&flow->flowchain);
22052207 if (flow->set == CAKE_SET_SPARSE ||
2206− flow->set == CAKE_SET_SPARSE_WAIT)
2207− b->sparse_flow_count--;
2208− else if (flow->set == CAKE_SET_BULK) {
2209− b->bulk_flow_count--;
2208+ flow->set == CAKE_SET_SPARSE_WAIT) {
2209+ WRITE_ONCE(b->sparse_flow_count, b->sparse_flow_count - 1);
2210+ } else if (flow->set == CAKE_SET_BULK) {
2211+ WRITE_ONCE(b->bulk_flow_count, b->bulk_flow_count - 1);
22102212
22112213 cake_dec_srchost_bulk_flow_count(b, flow, q->config->flow_mode);
22122214 cake_dec_dsthost_bulk_flow_count(b, flow, q->config->flow_mode);
2213− } else
2214− b->decaying_flow_count--;
2215−
2215+ } else {
2216+ WRITE_ONCE(b->decaying_flow_count, b->decaying_flow_count - 1);
2217+ }
22162218 flow->set = CAKE_SET_NONE;
22172219 }
22182220 goto begin;
@@ -2234,7 +2236,7 @@ retry: · 15 unmodified lines
22342236 b->tin_deficit -= len;
22352237 }
22362238 flow->dropped++;
2237− b->tin_dropped++;
2239+ WRITE_ONCE(b->tin_dropped, b->tin_dropped + 1);
22382240 qdisc_tree_reduce_backlog(sch, 1, qdisc_pkt_len(skb));
22392241 qdisc_qstats_drop(sch);
22402242 qdisc_dequeue_drop(sch, skb, reason);
@@ -2242,17 +2244,19 @@ retry: · 1 unmodified line
22422244 goto retry;
22432245 }
22442246
2245− b->tin_ecn_mark += !!flow->cvars.ecn_marked;
2247+ WRITE_ONCE(b->tin_ecn_mark, b->tin_ecn_mark + !!flow->cvars.ecn_marked);
22462248 qdisc_bstats_update(sch, skb);
22472249 WRITE_ONCE(q->last_active, now);
22482250
22492251 /* collect delay stats */
22502252 delay = ktime_to_ns(ktime_sub(now, cobalt_get_enqueue_time(skb)));
2251− b->avge_delay = cake_ewma(b->avge_delay, delay, 8);
2252− b->peak_delay = cake_ewma(b->peak_delay, delay,
2253− delay > b->peak_delay ? 2 : 8);
2254− b->base_delay = cake_ewma(b->base_delay, delay,
2255− delay < b->base_delay ? 2 : 8);
2253+ WRITE_ONCE(b->avge_delay, cake_ewma(b->avge_delay, delay, 8));
2254+ WRITE_ONCE(b->peak_delay,
2255+ cake_ewma(b->peak_delay, delay,
2256+ delay > b->peak_delay ? 2 : 8));
2257+ WRITE_ONCE(b->base_delay,
2258+ cake_ewma(b->base_delay, delay,
2259+ delay < b->base_delay ? 2 : 8));
22562260
22572261 len = cake_advance_shaper(q, b, skb, now, false);
22582262 flow->deficit -= len;
@@ -2329,9 +2333,9 @@ static void cake_set_rate(struct cake_tin_data *b, u64 rate, u32 mtu, · 70 unmodified lines
23292333 u8 rate_shft = 0;
23302334 u64 rate_ns = 0;
23312335
2332− b->flow_quantum = 1514;
23332336 if (rate) {
2334− b->flow_quantum = max(min(rate >> 12, 1514ULL), 300ULL);
2337+ WRITE_ONCE(b->flow_quantum,
2338+ max(min(rate >> 12, 1514ULL), 300ULL));
23352339 rate_shft = 34;
23362340 rate_ns = ((u64)NSEC_PER_SEC) << rate_shft;
23372341 rate_ns = div64_u64(rate_ns, max(MIN_RATE, rate));
@@ -2339,9 +2343,11 @@ static void cake_set_rate(struct cake_tin_data *b, u64 rate, u32 mtu, · 1 unmodified line
23392343 rate_ns >>= 1;
23402344 rate_shft--;
23412345 }
2342− } /* else unlimited, ie. zero delay */
2343−
2344− b->tin_rate_bps = rate;
2346+ } else {
2347+ /* else unlimited, ie. zero delay */
2348+ WRITE_ONCE(b->flow_quantum, 1514);
2349+ }
2350+ WRITE_ONCE(b->tin_rate_bps, rate);
23452351 b->tin_rate_ns = rate_ns;
23462352 b->tin_rate_shft = rate_shft;
23472353
@@ -2350,10 +2356,11 @@ static void cake_set_rate(struct cake_tin_data *b, u64 rate, u32 mtu, · 2 unmodified lines
23502356
23512357 byte_target_ns = (byte_target * rate_ns) >> rate_shft;
23522358
2353− b->cparams.target = max((byte_target_ns * 3) / 2, target_ns);
2354− b->cparams.interval = max(rtt_est_ns +
2355− b->cparams.target - target_ns,
2356− b->cparams.target * 2);
2359+ WRITE_ONCE(b->cparams.target,
2360+ max((byte_target_ns * 3) / 2, target_ns));
2361+ WRITE_ONCE(b->cparams.interval,
2362+ max(rtt_est_ns + b->cparams.target - target_ns,
2363+ b->cparams.target * 2));
23572364 b->cparams.mtu_time = byte_target_ns;
23582365 b->cparams.p_inc = 1 << 24; /* 1/256 */
23592366 b->cparams.p_dec = 1 << 20; /* 1/4096 */
@@ -2611,25 +2618,27 @@ static void cake_reconfigure(struct Qdisc *sch) · 251 unmodified lines
26112618 {
26122619 struct cake_sched_data *qd = qdisc_priv(sch);
26132620 struct cake_sched_config *q = qd->config;
2621+ u32 buffer_limit;
26142622
26152623 cake_configure_rates(sch, qd->config->rate_bps, false);
26162624
26172625 if (q->buffer_config_limit) {
2618− qd->buffer_limit = q->buffer_config_limit;
2626+ buffer_limit = q->buffer_config_limit;
26192627 } else if (q->rate_bps) {
26202628 u64 t = q->rate_bps * q->interval;
26212629
26222630 do_div(t, USEC_PER_SEC / 4);
2623− qd->buffer_limit = max_t(u32, t, 4U << 20);
2631+ buffer_limit = max_t(u32, t, 4U << 20);
26242632 } else {
2625− qd->buffer_limit = ~0;
2633+ buffer_limit = ~0;
26262634 }
26272635
26282636 sch->flags &= ~TCQ_F_CAN_BYPASS;
26292637
2630− qd->buffer_limit = min(qd->buffer_limit,
2631− max(sch->limit * psched_mtu(qdisc_dev(sch)),
2632− q->buffer_config_limit));
2638+ WRITE_ONCE(qd->buffer_limit,
2639+ min(buffer_limit,
2640+ max(sch->limit * psched_mtu(qdisc_dev(sch)),
2641+ q->buffer_config_limit)));
26332642 }
26342643
26352644 static int cake_config_change(struct cake_sched_config *q, struct nlattr *opt,
@@ -2774,10 +2783,10 @@ static int cake_change(struct Qdisc *sch, struct nlattr *opt, · 138 unmodified lines
27742783 return ret;
27752784
27762785 if (overhead_changed) {
2777− qd->max_netlen = 0;
2778− qd->max_adjlen = 0;
2779− qd->min_netlen = ~0;
2780− qd->min_adjlen = ~0;
2786+ WRITE_ONCE(qd->max_netlen, 0);
2787+ WRITE_ONCE(qd->max_adjlen, 0);
2788+ WRITE_ONCE(qd->min_netlen, ~0);
2789+ WRITE_ONCE(qd->min_adjlen, ~0);
27812790 }
27822791
27832792 if (qd->tins) {
@@ -2995,15 +3004,15 @@ static int cake_dump_stats(struct Qdisc *sch, struct gnet_dump *d) · 211 unmodified lines
29953004 goto nla_put_failure; \
29963005 } while (0)
29973006
2998− PUT_STAT_U64(CAPACITY_ESTIMATE64, q->avg_peak_bandwidth);
2999− PUT_STAT_U32(MEMORY_LIMIT, q->buffer_limit);
3000− PUT_STAT_U32(MEMORY_USED, q->buffer_max_used);
3001− PUT_STAT_U32(AVG_NETOFF, ((q->avg_netoff + 0x8000) >> 16));
3002− PUT_STAT_U32(MAX_NETLEN, q->max_netlen);
3003− PUT_STAT_U32(MAX_ADJLEN, q->max_adjlen);
3004− PUT_STAT_U32(MIN_NETLEN, q->min_netlen);
3005− PUT_STAT_U32(MIN_ADJLEN, q->min_adjlen);
3006− PUT_STAT_U32(ACTIVE_QUEUES, q->active_queues);
3007+ PUT_STAT_U64(CAPACITY_ESTIMATE64, READ_ONCE(q->avg_peak_bandwidth));
3008+ PUT_STAT_U32(MEMORY_LIMIT, READ_ONCE(q->buffer_limit));
3009+ PUT_STAT_U32(MEMORY_USED, READ_ONCE(q->buffer_max_used));
3010+ PUT_STAT_U32(AVG_NETOFF, ((READ_ONCE(q->avg_netoff) + 0x8000) >> 16));
3011+ PUT_STAT_U32(MAX_NETLEN, READ_ONCE(q->max_netlen));
3012+ PUT_STAT_U32(MAX_ADJLEN, READ_ONCE(q->max_adjlen));
3013+ PUT_STAT_U32(MIN_NETLEN, READ_ONCE(q->min_netlen));
3014+ PUT_STAT_U32(MIN_ADJLEN, READ_ONCE(q->min_adjlen));
3015+ PUT_STAT_U32(ACTIVE_QUEUES, READ_ONCE(q->active_queues));
30073016
30083017 #undef PUT_STAT_U32
30093018 #undef PUT_STAT_U64
@@ -3029,38 +3038,38 @@ static int cake_dump_stats(struct Qdisc *sch, struct gnet_dump *d) · 19 unmodified lines
30293038 if (!ts)
30303039 goto nla_put_failure;
30313040
3032− PUT_TSTAT_U64(THRESHOLD_RATE64, b->tin_rate_bps);
3033− PUT_TSTAT_U64(SENT_BYTES64, b->bytes);
3034− PUT_TSTAT_U32(BACKLOG_BYTES, b->tin_backlog);
3041+ PUT_TSTAT_U64(THRESHOLD_RATE64, READ_ONCE(b->tin_rate_bps));
3042+ PUT_TSTAT_U64(SENT_BYTES64, READ_ONCE(b->bytes));
3043+ PUT_TSTAT_U32(BACKLOG_BYTES, READ_ONCE(b->tin_backlog));
30353044
30363045 PUT_TSTAT_U32(TARGET_US,
3037− ktime_to_us(ns_to_ktime(b->cparams.target)));
3046+ ktime_to_us(ns_to_ktime(READ_ONCE(b->cparams.target))));
30383047 PUT_TSTAT_U32(INTERVAL_US,
3039− ktime_to_us(ns_to_ktime(b->cparams.interval)));
3048+ ktime_to_us(ns_to_ktime(READ_ONCE(b->cparams.interval))));
30403049
3041− PUT_TSTAT_U32(SENT_PACKETS, b->packets);
3042− PUT_TSTAT_U32(DROPPED_PACKETS, b->tin_dropped);
3043− PUT_TSTAT_U32(ECN_MARKED_PACKETS, b->tin_ecn_mark);
3044− PUT_TSTAT_U32(ACKS_DROPPED_PACKETS, b->ack_drops);
3050+ PUT_TSTAT_U32(SENT_PACKETS, READ_ONCE(b->packets));
3051+ PUT_TSTAT_U32(DROPPED_PACKETS, READ_ONCE(b->tin_dropped));
3052+ PUT_TSTAT_U32(ECN_MARKED_PACKETS, READ_ONCE(b->tin_ecn_mark));
3053+ PUT_TSTAT_U32(ACKS_DROPPED_PACKETS, READ_ONCE(b->ack_drops));
30453054
30463055 PUT_TSTAT_U32(PEAK_DELAY_US,
3047− ktime_to_us(ns_to_ktime(b->peak_delay)));
3056+ ktime_to_us(ns_to_ktime(READ_ONCE(b->peak_delay))));
30483057 PUT_TSTAT_U32(AVG_DELAY_US,
3049− ktime_to_us(ns_to_ktime(b->avge_delay)));
3058+ ktime_to_us(ns_to_ktime(READ_ONCE(b->avge_delay))));
30503059 PUT_TSTAT_U32(BASE_DELAY_US,
3051− ktime_to_us(ns_to_ktime(b->base_delay)));
3060+ ktime_to_us(ns_to_ktime(READ_ONCE(b->base_delay))));
30523061
3053− PUT_TSTAT_U32(WAY_INDIRECT_HITS, b->way_hits);
3054− PUT_TSTAT_U32(WAY_MISSES, b->way_misses);
3055− PUT_TSTAT_U32(WAY_COLLISIONS, b->way_collisions);
3062+ PUT_TSTAT_U32(WAY_INDIRECT_HITS, READ_ONCE(b->way_hits));
3063+ PUT_TSTAT_U32(WAY_MISSES, READ_ONCE(b->way_misses));
3064+ PUT_TSTAT_U32(WAY_COLLISIONS, READ_ONCE(b->way_collisions));
30563065
3057− PUT_TSTAT_U32(SPARSE_FLOWS, b->sparse_flow_count +
3058− b->decaying_flow_count);
3059− PUT_TSTAT_U32(BULK_FLOWS, b->bulk_flow_count);
3060− PUT_TSTAT_U32(UNRESPONSIVE_FLOWS, b->unresponsive_flow_count);
3061− PUT_TSTAT_U32(MAX_SKBLEN, b->max_skblen);
3066+ PUT_TSTAT_U32(SPARSE_FLOWS, READ_ONCE(b->sparse_flow_count) +
3067+ READ_ONCE(b->decaying_flow_count));
3068+ PUT_TSTAT_U32(BULK_FLOWS, READ_ONCE(b->bulk_flow_count));
3069+ PUT_TSTAT_U32(UNRESPONSIVE_FLOWS, READ_ONCE(b->unresponsive_flow_count));
3070+ PUT_TSTAT_U32(MAX_SKBLEN, READ_ONCE(b->max_skblen));
30623071
3063− PUT_TSTAT_U32(FLOW_QUANTUM, b->flow_quantum);
3072+ PUT_TSTAT_U32(FLOW_QUANTUM, READ_ONCE(b->flow_quantum));
30643073 nla_nest_end(d->skb, ts);
30653074 }
30663075
@@ -3298,10 +3307,10 @@ static int cake_mq_change(struct Qdisc *sch, struct nlattr *opt, · 231 unmodified lines
32983307 struct cake_sched_data *qd = qdisc_priv(chld);
32993308
33003309 if (overhead_changed) {
3301− qd->max_netlen = 0;
3302− qd->max_adjlen = 0;
3303− qd->min_netlen = ~0;
3304− qd->min_adjlen = ~0;
3310+ WRITE_ONCE(qd->max_netlen, 0);
3311+ WRITE_ONCE(qd->max_adjlen, 0);
3312+ WRITE_ONCE(qd->min_netlen, ~0);
3313+ WRITE_ONCE(qd->min_adjlen, ~0);
33053314 }
33063315
33073316 if (qd->tins) {
net/sched/sch_choke.c+16−10
@@ -229,7 +229,7 @@ static int choke_enqueue(struct sk_buff *skb, struct Qdisc *sch, · 228 unmodified lines
229229
230230 /* Draw a packet at random from queue and compare flow */
231231 if (choke_match_random(q, skb, &idx)) {
232− q->stats.matched++;
232+ WRITE_ONCE(q->stats.matched, q->stats.matched + 1);
233233 choke_drop_by_idx(sch, idx, to_free);
234234 goto congestion_drop;
235235 }
@@ -241,11 +241,13 @@ static int choke_enqueue(struct sk_buff *skb, struct Qdisc *sch, · 5 unmodified lines
241241 qdisc_qstats_overlimit(sch);
242242 if (use_harddrop(q) || !use_ecn(q) ||
243243 !INET_ECN_set_ce(skb)) {
244− q->stats.forced_drop++;
244+ WRITE_ONCE(q->stats.forced_drop,
245+ q->stats.forced_drop + 1);
245246 goto congestion_drop;
246247 }
247248
248− q->stats.forced_mark++;
249+ WRITE_ONCE(q->stats.forced_mark,
250+ q->stats.forced_mark + 1);
249251 } else if (++q->vars.qcount) {
250252 if (red_mark_probability(p, &q->vars, q->vars.qavg)) {
251253 q->vars.qcount = 0;
@@ -253,11 +255,13 @@ static int choke_enqueue(struct sk_buff *skb, struct Qdisc *sch, · 1 unmodified line
253255
254256 qdisc_qstats_overlimit(sch);
255257 if (!use_ecn(q) || !INET_ECN_set_ce(skb)) {
256− q->stats.prob_drop++;
258+ WRITE_ONCE(q->stats.prob_drop,
259+ q->stats.prob_drop + 1);
257260 goto congestion_drop;
258261 }
259262
260− q->stats.prob_mark++;
263+ WRITE_ONCE(q->stats.prob_mark,
264+ q->stats.prob_mark + 1);
261265 }
262266 } else
263267 q->vars.qR = red_random(p);
@@ -272,7 +276,7 @@ static int choke_enqueue(struct sk_buff *skb, struct Qdisc *sch, · 8 unmodified lines
272276 return NET_XMIT_SUCCESS;
273277 }
274278
275− q->stats.pdrop++;
279+ WRITE_ONCE(q->stats.pdrop, q->stats.pdrop + 1);
276280 return qdisc_drop(skb, sch, to_free);
277281
278282 congestion_drop:
@@ -461,10 +465,12 @@ static int choke_dump_stats(struct Qdisc *sch, struct gnet_dump *d) · 182 unmodified lines
461465 {
462466 struct choke_sched_data *q = qdisc_priv(sch);
463467 struct tc_choke_xstats st = {
464− .early = q->stats.prob_drop + q->stats.forced_drop,
465− .marked = q->stats.prob_mark + q->stats.forced_mark,
466− .pdrop = q->stats.pdrop,
467− .matched = q->stats.matched,
468+ .early = READ_ONCE(q->stats.prob_drop) +
469+ READ_ONCE(q->stats.forced_drop),
470+ .marked = READ_ONCE(q->stats.prob_mark) +
471+ READ_ONCE(q->stats.forced_mark),
472+ .pdrop = READ_ONCE(q->stats.pdrop),
473+ .matched = READ_ONCE(q->stats.matched),
468474 };
469475
470476 return gnet_stats_copy_app(d, &st, sizeof(st));
net/sched/sch_fq_pie.c+10−9
@@ -509,18 +509,19 @@ nla_put_failure: · 508 unmodified lines
509509 static int fq_pie_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
510510 {
511511 struct fq_pie_sched_data *q = qdisc_priv(sch);
512− struct tc_fq_pie_xstats st = {
513− .packets_in = q->stats.packets_in,
514− .overlimit = q->stats.overlimit,
515− .overmemory = q->overmemory,
516− .dropped = q->stats.dropped,
517− .ecn_mark = q->stats.ecn_mark,
518− .new_flow_count = q->new_flow_count,
519− .memory_usage = q->memory_usage,
520− };
512+ struct tc_fq_pie_xstats st = { 0 };
521513 struct list_head *pos;
522514
523515 sch_tree_lock(sch);
516+
517+ st.packets_in = q->stats.packets_in;
518+ st.overlimit = q->stats.overlimit;
519+ st.overmemory = q->overmemory;
520+ st.dropped = q->stats.dropped;
521+ st.ecn_mark = q->stats.ecn_mark;
522+ st.new_flow_count = q->new_flow_count;
523+ st.memory_usage = q->memory_usage;
524+
524525 list_for_each(pos, &q->new_flows)
525526 st.new_flows_len++;
526527
net/sched/sch_netem.c+64−12
@@ -227,10 +227,10 @@ static bool loss_4state(struct netem_sched_data *q) · 226 unmodified lines
227227 if (rnd < clg->a4) {
228228 clg->state = LOST_IN_GAP_PERIOD;
229229 return true;
230− } else if (clg->a4 < rnd && rnd < clg->a1 + clg->a4) {
230+ } else if (rnd < clg->a1 + clg->a4) {
231231 clg->state = LOST_IN_BURST_PERIOD;
232232 return true;
233− } else if (clg->a1 + clg->a4 < rnd) {
233+ } else {
234234 clg->state = TX_IN_GAP_PERIOD;
235235 }
236236
@@ -247,9 +247,9 @@ static bool loss_4state(struct netem_sched_data *q) · 10 unmodified lines
247247 case LOST_IN_BURST_PERIOD:
248248 if (rnd < clg->a3)
249249 clg->state = TX_IN_BURST_PERIOD;
250− else if (clg->a3 < rnd && rnd < clg->a2 + clg->a3) {
250+ else if (rnd < clg->a2 + clg->a3) {
251251 clg->state = TX_IN_GAP_PERIOD;
252− } else if (clg->a2 + clg->a3 < rnd) {
252+ } else {
253253 clg->state = LOST_IN_BURST_PERIOD;
254254 return true;
255255 }
@@ -524,7 +524,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, · 268 unmodified lines
524524 1 << get_random_u32_below(8);
525525 }
526526
527− if (unlikely(q->t_len >= sch->limit)) {
527+ if (unlikely(sch->q.qlen >= sch->limit)) {
528528 /* re-link segs, so that qdisc_drop_all() frees them all */
529529 skb->next = segs;
530530 qdisc_drop_all(skb, sch, to_free);
@@ -659,9 +659,8 @@ static void get_slot_next(struct netem_sched_data *q, u64 now) · 128 unmodified lines
659659
660660 if (!q->slot_dist)
661661 next_delay = q->slot_config.min_delay +
662− (get_random_u32() *
663− (q->slot_config.max_delay -
664− q->slot_config.min_delay) >> 32);
662+ mul_u64_u32_shr(q->slot_config.max_delay - q->slot_config.min_delay,
663+ get_random_u32(), 32);
665664 else
666665 next_delay = tabledist(q->slot_config.dist_delay,
667666 (s32)(q->slot_config.dist_jitter),
@@ -827,6 +826,39 @@ static int get_dist_table(struct disttable **tbl, const struct nlattr *attr) · 159 unmodified lines
827826 return 0;
828827 }
829828
829+static int validate_time(const struct nlattr *attr, const char *name,
830+ struct netlink_ext_ack *extack)
831+{
832+ if (nla_get_s64(attr) < 0) {
833+ NL_SET_ERR_MSG_ATTR_FMT(extack, attr, "negative %s", name);
834+ return -EINVAL;
835+ }
836+ return 0;
837+}
838+
839+static int validate_slot(const struct nlattr *attr, struct netlink_ext_ack *extack)
840+{
841+ const struct tc_netem_slot *c = nla_data(attr);
842+
843+ if (c->min_delay < 0 || c->max_delay < 0) {
844+ NL_SET_ERR_MSG_ATTR(extack, attr, "negative slot delay");
845+ return -EINVAL;
846+ }
847+ if (c->min_delay > c->max_delay) {
848+ NL_SET_ERR_MSG_ATTR(extack, attr, "slot min delay greater than max delay");
849+ return -EINVAL;
850+ }
851+ if (c->dist_delay < 0 || c->dist_jitter < 0) {
852+ NL_SET_ERR_MSG_ATTR(extack, attr, "negative dist delay");
853+ return -EINVAL;
854+ }
855+ if (c->max_packets < 0 || c->max_bytes < 0) {
856+ NL_SET_ERR_MSG_ATTR(extack, attr, "negative slot limit");
857+ return -EINVAL;
858+ }
859+ return 0;
860+}
861+
830862 static void get_slot(struct netem_sched_data *q, const struct nlattr *attr)
831863 {
832864 const struct tc_netem_slot *c = nla_data(attr);
@@ -1040,6 +1072,24 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt, · 207 unmodified lines
10401072 goto table_free;
10411073 }
10421074
1075+ if (tb[TCA_NETEM_SLOT]) {
1076+ ret = validate_slot(tb[TCA_NETEM_SLOT], extack);
1077+ if (ret)
1078+ goto table_free;
1079+ }
1080+
1081+ if (tb[TCA_NETEM_LATENCY64]) {
1082+ ret = validate_time(tb[TCA_NETEM_LATENCY64], "latency", extack);
1083+ if (ret)
1084+ goto table_free;
1085+ }
1086+
1087+ if (tb[TCA_NETEM_JITTER64]) {
1088+ ret = validate_time(tb[TCA_NETEM_JITTER64], "jitter", extack);
1089+ if (ret)
1090+ goto table_free;
1091+ }
1092+
10431093 sch_tree_lock(sch);
10441094 /* backup q->clg and q->loss_model */
10451095 old_clg = q->clg;
@@ -1112,11 +1162,10 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt, · 66 unmodified lines
11121162 /* capping jitter to the range acceptable by tabledist() */
11131163 q->jitter = min_t(s64, abs(q->jitter), INT_MAX);
11141164
1115− if (tb[TCA_NETEM_PRNG_SEED])
1165+ if (tb[TCA_NETEM_PRNG_SEED]) {
11161166 q->prng.seed = nla_get_u64(tb[TCA_NETEM_PRNG_SEED]);
1117− else
1118− q->prng.seed = get_random_u64();
1119− prandom_seed_state(&q->prng.prng_state, q->prng.seed);
1167+ prandom_seed_state(&q->prng.prng_state, q->prng.seed);
1168+ }
11201169
11211170 unlock:
11221171 sch_tree_unlock(sch);
@@ -1139,6 +1188,9 @@ static int netem_init(struct Qdisc *sch, struct nlattr *opt, · 16 unmodified lines
11391188 return -EINVAL;
11401189
11411190 q->loss_model = CLG_RANDOM;
1191+ q->prng.seed = get_random_u64();
1192+ prandom_seed_state(&q->prng.prng_state, q->prng.seed);
1193+
11421194 ret = netem_change(sch, opt, extack);
11431195 if (ret)
11441196 pr_info("netem: change failed\n");
net/sched/sch_taprio.c+8−5
@@ -634,7 +634,7 @@ static int taprio_enqueue(struct sk_buff *skb, struct Qdisc *sch, · 633 unmodified lines
634634 queue = skb_get_queue_mapping(skb);
635635
636636 child = q->qdiscs[queue];
637− if (unlikely(!child))
637+ if (unlikely(child == &noop_qdisc))
638638 return qdisc_drop(skb, sch, to_free);
639639
640640 if (taprio_skb_exceeds_queue_max_sdu(sch, skb)) {
@@ -717,7 +717,7 @@ static struct sk_buff *taprio_dequeue_from_txq(struct Qdisc *sch, int txq, · 76 unmodified lines
717717 int len;
718718 u8 tc;
719719
720− if (unlikely(!child))
720+ if (unlikely(child == &noop_qdisc))
721721 return NULL;
722722
723723 if (TXTIME_ASSIST_IS_ENABLED(q->flags))
@@ -2184,6 +2184,9 @@ static int taprio_graft(struct Qdisc *sch, unsigned long cl, · 1460 unmodified lines
21842184 if (!dev_queue)
21852185 return -EINVAL;
21862186
2187+ if (!new)
2188+ new = &noop_qdisc;
2189+
21872190 if (dev->flags & IFF_UP)
21882191 dev_deactivate(dev, false);
21892192
@@ -2197,14 +2200,14 @@ static int taprio_graft(struct Qdisc *sch, unsigned long cl, · 7 unmodified lines
21972200 *old = q->qdiscs[cl - 1];
21982201 if (FULL_OFFLOAD_IS_ENABLED(q->flags)) {
21992202 WARN_ON_ONCE(dev_graft_qdisc(dev_queue, new) != *old);
2200− if (new)
2203+ if (new != &noop_qdisc)
22012204 qdisc_refcount_inc(new);
2202− if (*old)
2205+ if (*old && *old != &noop_qdisc)
22032206 qdisc_put(*old);
22042207 }
22052208
22062209 q->qdiscs[cl - 1] = new;
2207− if (new)
2210+ if (new != &noop_qdisc)
22082211 new->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT;
22092212
22102213 if (dev->flags & IFF_UP)
net/sctp/sm_statefuns.c+6−0
@@ -1556,6 +1556,12 @@ static enum sctp_disposition sctp_sf_do_unexpected_init( · 1555 unmodified lines
15561556 /* Tag the variable length parameters. */
15571557 chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));
15581558
1559+ if (asoc->state >= SCTP_STATE_ESTABLISHED) {
1560+ /* Discard INIT matching peer vtag after handshake completion (stale INIT). */
1561+ if (ntohl(chunk->subh.init_hdr->init_tag) == asoc->peer.i.init_tag)
1562+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1563+ }
1564+
15591565 /* Verify the INIT chunk before processing it. */
15601566 err_chunk = NULL;
15611567 if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
net/tls/tls.h+1−0
@@ -188,6 +188,7 @@ int tls_strp_dev_init(void); · 187 unmodified lines
188188 void tls_strp_dev_exit(void);
189189
190190 void tls_strp_done(struct tls_strparser *strp);
191+void __tls_strp_done(struct tls_strparser *strp);
191192 void tls_strp_stop(struct tls_strparser *strp);
192193 int tls_strp_init(struct tls_strparser *strp, struct sock *sk);
193194 void tls_strp_data_ready(struct tls_strparser *strp);
net/tls/tls_strp.c+6−0
@@ -624,6 +624,12 @@ void tls_strp_done(struct tls_strparser *strp) · 623 unmodified lines
624624 WARN_ON(!strp->stopped);
625625
626626 cancel_work_sync(&strp->work);
627+ __tls_strp_done(strp);
628+}
629+
630+/* For setup error paths where the strparser was initialized but never armed. */
631+void __tls_strp_done(struct tls_strparser *strp)
632+{
627633 tls_strp_anchor_free(strp);
628634 }
629635
net/tls/tls_sw.c+4−0
@@ -2624,8 +2624,12 @@ void tls_sw_free_ctx_rx(struct tls_context *tls_ctx) · 2623 unmodified lines
26242624 void tls_sw_free_resources_rx(struct sock *sk)
26252625 {
26262626 struct tls_context *tls_ctx = tls_get_ctx(sk);
2627+ struct tls_sw_context_rx *ctx;
2628+
2629+ ctx = tls_sw_ctx_rx(tls_ctx);
26272630
26282631 tls_sw_release_resources_rx(sk);
2632+ __tls_strp_done(&ctx->strp);
26292633 tls_sw_free_ctx_rx(tls_ctx);
26302634 }
26312635
net/vmw_vsock/hyperv_transport.c+2−2
@@ -375,10 +375,10 @@ static void hvs_open_connection(struct vmbus_channel *chan) · 374 unmodified lines
375375 } else {
376376 sndbuf = max_t(int, sk->sk_sndbuf, RINGBUFFER_HVS_SND_SIZE);
377377 sndbuf = min_t(int, sndbuf, RINGBUFFER_HVS_MAX_SIZE);
378− sndbuf = ALIGN(sndbuf, HV_HYP_PAGE_SIZE);
378+ sndbuf = VMBUS_RING_SIZE(sndbuf);
379379 rcvbuf = max_t(int, sk->sk_rcvbuf, RINGBUFFER_HVS_RCV_SIZE);
380380 rcvbuf = min_t(int, rcvbuf, RINGBUFFER_HVS_MAX_SIZE);
381− rcvbuf = ALIGN(rcvbuf, HV_HYP_PAGE_SIZE);
381+ rcvbuf = VMBUS_RING_SIZE(rcvbuf);
382382 }
383383
384384 chan->max_pkt_size = HVS_MAX_PKT_SIZE;
security/selinux/hooks.c+17−21
@@ -2966,7 +2966,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir, · 2965 unmodified lines
29662966 {
29672967 const struct cred_security_struct *crsec = selinux_cred(current_cred());
29682968 struct superblock_security_struct *sbsec;
2969− struct xattr *xattr = lsm_get_xattr_slot(xattrs, xattr_count);
2969+ struct xattr *xattr;
29702970 u32 newsid, clen;
29712971 u16 newsclass;
29722972 int rc;
@@ -2992,6 +2992,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir, · 19 unmodified lines
29922992 !(sbsec->flags & SBLABEL_MNT))
29932993 return -EOPNOTSUPP;
29942994
2995+ xattr = lsm_get_xattr_slot(xattrs, xattr_count);
29952996 if (xattr) {
29962997 rc = security_sid_to_context_force(newsid,
29972998 &context, &clen);
@@ -3208,15 +3209,13 @@ static inline int task_avdcache_search(struct task_security_struct *tsec, · 210 unmodified lines
32083209 * @tsec: the task's security state
32093210 * @isec: the inode associated with the cache entry
32103211 * @avd: the AVD to cache
3211− * @audited: the permission audit bitmask to cache
32123212 *
3213− * Update the AVD cache in @tsec with the @avdc and @audited info associated
3213+ * Update the AVD cache in @tsec with the @avd info associated
32143214 * with @isec.
32153215 */
32163216 static inline void task_avdcache_update(struct task_security_struct *tsec,
32173217 struct inode_security_struct *isec,
3218− struct av_decision *avd,
3219− u32 audited)
3218+ struct av_decision *avd)
32203219 {
32213220 int spot;
32223221
@@ -3228,9 +3227,7 @@ static inline void task_avdcache_update(struct task_security_struct *tsec, · 5 unmodified lines
32283227 spot = (tsec->avdcache.dir_spot + 1) & (TSEC_AVDC_DIR_SIZE - 1);
32293228 tsec->avdcache.dir_spot = spot;
32303229 tsec->avdcache.dir[spot].isid = isec->sid;
3231− tsec->avdcache.dir[spot].audited = audited;
3232− tsec->avdcache.dir[spot].allowed = avd->allowed;
3233− tsec->avdcache.dir[spot].permissive = avd->flags & AVD_FLAGS_PERMISSIVE;
3230+ tsec->avdcache.dir[spot].avd = *avd;
32343231 tsec->avdcache.permissive_neveraudit =
32353232 (avd->flags == (AVD_FLAGS_PERMISSIVE|AVD_FLAGS_NEVERAUDIT));
32363233 }
@@ -3251,6 +3248,7 @@ static int selinux_inode_permission(struct inode *inode, int requested) · 14 unmodified lines
32513248 struct task_security_struct *tsec;
32523249 struct inode_security_struct *isec;
32533250 struct avdc_entry *avdc;
3251+ struct av_decision avd, *avdp = &avd;
32543252 int rc, rc2;
32553253 u32 audited, denied;
32563254
@@ -3272,23 +3270,21 @@ static int selinux_inode_permission(struct inode *inode, int requested) · 15 unmodified lines
32723270 rc = task_avdcache_search(tsec, isec, &avdc);
32733271 if (likely(!rc)) {
32743272 /* Cache hit. */
3275− audited = perms & avdc->audited;
3276− denied = perms & ~avdc->allowed;
3277− if (unlikely(denied && enforcing_enabled() &&
3278− !avdc->permissive))
3273+ avdp = &avdc->avd;
3274+ denied = perms & ~avdp->allowed;
3275+ if (unlikely(denied) && enforcing_enabled() &&
3276+ !(avdp->flags & AVD_FLAGS_PERMISSIVE))
32793277 rc = -EACCES;
32803278 } else {
3281− struct av_decision avd;
3282−
32833279 /* Cache miss. */
32843280 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass,
3285− perms, 0, &avd);
3286− audited = avc_audit_required(perms, &avd, rc,
3287− (requested & MAY_ACCESS) ? FILE__AUDIT_ACCESS : 0,
3288− &denied);
3289− task_avdcache_update(tsec, isec, &avd, audited);
3281+ perms, 0, avdp);
3282+ task_avdcache_update(tsec, isec, avdp);
32903283 }
32913284
3285+ audited = avc_audit_required(perms, avdp, rc,
3286+ (requested & MAY_ACCESS) ?
3287+ FILE__AUDIT_ACCESS : 0, &denied);
32923288 if (likely(!audited))
32933289 return rc;
32943290
@@ -4920,7 +4916,7 @@ static bool sock_skip_has_perm(u32 sid) · 1625 unmodified lines
49204916
49214917 static int sock_has_perm(struct sock *sk, u32 perms)
49224918 {
4923− struct sk_security_struct *sksec = sk->sk_security;
4919+ struct sk_security_struct *sksec = selinux_sock(sk);
49244920 struct common_audit_data ad;
49254921 struct lsm_network_audit net;
49264922
@@ -6227,7 +6223,7 @@ static unsigned int selinux_ip_postroute(void *priv, · 1300 unmodified lines
62276223
62286224 static int nlmsg_sock_has_extended_perms(struct sock *sk, u32 perms, u16 nlmsg_type)
62296225 {
6230− struct sk_security_struct *sksec = sk->sk_security;
6226+ struct sk_security_struct *sksec = selinux_sock(sk);
62316227 struct common_audit_data ad;
62326228 u8 driver;
62336229 u8 xperm;
security/selinux/include/objsec.h+1−3
@@ -32,9 +32,7 @@ · 31 unmodified lines
3232
3333 struct avdc_entry {
3434 u32 isid; /* inode SID */
35− u32 allowed; /* allowed permission bitmask */
36− u32 audited; /* audited permission bitmask */
37− bool permissive; /* AVC permissive flag */
35+ struct av_decision avd; /* av decision */
3836 };
3937
4038 struct cred_security_struct {
sound/core/oss/pcm_oss.c+23−6
@@ -2155,10 +2155,16 @@ static int snd_pcm_oss_get_trigger(struct snd_pcm_oss_file *pcm_oss_file) · 2154 unmodified lines
21552155
21562156 psubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK];
21572157 csubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
2158− if (psubstream && psubstream->runtime && psubstream->runtime->oss.trigger)
2159− result |= PCM_ENABLE_OUTPUT;
2160− if (csubstream && csubstream->runtime && csubstream->runtime->oss.trigger)
2161− result |= PCM_ENABLE_INPUT;
2158+ if (psubstream && psubstream->runtime) {
2159+ guard(mutex)(&psubstream->runtime->oss.params_lock);
2160+ if (psubstream->runtime->oss.trigger)
2161+ result |= PCM_ENABLE_OUTPUT;
2162+ }
2163+ if (csubstream && csubstream->runtime) {
2164+ guard(mutex)(&csubstream->runtime->oss.params_lock);
2165+ if (csubstream->runtime->oss.trigger)
2166+ result |= PCM_ENABLE_INPUT;
2167+ }
21622168 return result;
21632169 }
21642170
@@ -2832,6 +2838,17 @@ static int snd_pcm_oss_capture_ready(struct snd_pcm_substream *substream) · 667 unmodified lines
28322838 runtime->oss.period_frames;
28332839 }
28342840
2841+static bool need_input_retrigger(struct snd_pcm_runtime *runtime)
2842+{
2843+ bool ret;
2844+
2845+ guard(mutex)(&runtime->oss.params_lock);
2846+ ret = runtime->oss.trigger;
2847+ if (ret)
2848+ runtime->oss.trigger = 0;
2849+ return ret;
2850+}
2851+
28352852 static __poll_t snd_pcm_oss_poll(struct file *file, poll_table * wait)
28362853 {
28372854 struct snd_pcm_oss_file *pcm_oss_file;
@@ -2864,11 +2881,11 @@ static __poll_t snd_pcm_oss_poll(struct file *file, poll_table * wait) · 26 unmodified lines
28642881 snd_pcm_oss_capture_ready(csubstream))
28652882 mask |= EPOLLIN | EPOLLRDNORM;
28662883 }
2867− if (ostate != SNDRV_PCM_STATE_RUNNING && runtime->oss.trigger) {
2884+ if (ostate != SNDRV_PCM_STATE_RUNNING &&
2885+ need_input_retrigger(runtime)) {
28682886 struct snd_pcm_oss_file ofile;
28692887 memset(&ofile, 0, sizeof(ofile));
28702888 ofile.streams[SNDRV_PCM_STREAM_CAPTURE] = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
2871− runtime->oss.trigger = 0;
28722889 snd_pcm_oss_set_trigger(&ofile, PCM_ENABLE_INPUT);
28732890 }
28742891 }
sound/drivers/aloop.c+30−13
@@ -99,6 +99,9 @@ struct loopback_ops { · 98 unmodified lines
9999 struct loopback_cable {
100100 spinlock_t lock;
101101 struct loopback_pcm *streams[2];
102+ /* in-flight peer stops running outside cable->lock */
103+ atomic_t stop_count;
104+ wait_queue_head_t stop_wait;
102105 struct snd_pcm_hardware hw;
103106 /* flags */
104107 unsigned int valid;
@@ -366,8 +369,11 @@ static int loopback_check_format(struct loopback_cable *cable, int stream) · 261 unmodified lines
366369 return 0;
367370 if (stream == SNDRV_PCM_STREAM_CAPTURE)
368371 return -EIO;
369− else if (cruntime->state == SNDRV_PCM_STATE_RUNNING)
372+ else if (cruntime->state == SNDRV_PCM_STATE_RUNNING) {
373+ /* close must not free the peer runtime below */
374+ atomic_inc(&cable->stop_count);
370375 stop_capture = true;
376+ }
371377 }
372378
373379 setup = get_setup(dpcm_play);
@@ -396,8 +402,11 @@ static int loopback_check_format(struct loopback_cable *cable, int stream) · 22 unmodified lines
396402 }
397403 }
398404
399− if (stop_capture)
405+ if (stop_capture) {
400406 snd_pcm_stop(dpcm_capt->substream, SNDRV_PCM_STATE_DRAINING);
407+ if (atomic_dec_and_test(&cable->stop_count))
408+ wake_up(&cable->stop_wait);
409+ }
401410
402411 return 0;
403412 }
@@ -1049,23 +1058,29 @@ static void free_cable(struct snd_pcm_substream *substream) · 645 unmodified lines
10491058 struct loopback *loopback = substream->private_data;
10501059 int dev = get_cable_index(substream);
10511060 struct loopback_cable *cable;
1061+ struct loopback_pcm *dpcm;
1062+ bool other_alive;
10521063
10531064 cable = loopback->cables[substream->number][dev];
10541065 if (!cable)
10551066 return;
1056− if (cable->streams[!substream->stream]) {
1057− /* other stream is still alive */
1058− guard(spinlock_irq)(&cable->lock);
1059− cable->streams[substream->stream] = NULL;
1060− } else {
1061− struct loopback_pcm *dpcm = substream->runtime->private_data;
10621067
1063− if (cable->ops && cable->ops->close_cable && dpcm)
1064− cable->ops->close_cable(dpcm);
1065− /* free the cable */
1066− loopback->cables[substream->number][dev] = NULL;
1067− kfree(cable);
1068+ scoped_guard(spinlock_irq, &cable->lock) {
1069+ cable->streams[substream->stream] = NULL;
1070+ other_alive = cable->streams[!substream->stream];
10681071 }
1072+
1073+ /* Pair with the stop_count increment in loopback_check_format(). */
1074+ wait_event(cable->stop_wait, !atomic_read(&cable->stop_count));
1075+ if (other_alive)
1076+ return;
1077+
1078+ dpcm = substream->runtime->private_data;
1079+ if (cable->ops && cable->ops->close_cable && dpcm)
1080+ cable->ops->close_cable(dpcm);
1081+ /* free the cable */
1082+ loopback->cables[substream->number][dev] = NULL;
1083+ kfree(cable);
10691084 }
10701085
10711086 static int loopback_jiffies_timer_open(struct loopback_pcm *dpcm)
@@ -1260,6 +1275,8 @@ static int loopback_open(struct snd_pcm_substream *substream) · 188 unmodified lines
12601275 goto unlock;
12611276 }
12621277 spin_lock_init(&cable->lock);
1278+ atomic_set(&cable->stop_count, 0);
1279+ init_waitqueue_head(&cable->stop_wait);
12631280 cable->hw = loopback_pcm_hardware;
12641281 if (loopback->timer_source)
12651282 cable->ops = &loopback_snd_timer_ops;
sound/hda/codecs/Makefile+0−2
@@ -7,7 +7,6 @@ snd-hda-codec-cm9825-y := cm9825.o · 6 unmodified lines
77 snd-hda-codec-analog-y := analog.o
88 snd-hda-codec-ca0110-y := ca0110.o
99 snd-hda-codec-ca0132-y := ca0132.o
10−snd-hda-codec-cmedia-y := cmedia.o
1110 snd-hda-codec-conexant-y := conexant.o
1211 snd-hda-codec-idt-y := sigmatel.o
1312 snd-hda-codec-senarytech-y := senarytech.o
@@ -26,7 +25,6 @@ obj-$(CONFIG_SND_HDA_CODEC_CM9825) += snd-hda-codec-cm9825.o · 12 unmodified lines
2625 obj-$(CONFIG_SND_HDA_CODEC_ANALOG) += snd-hda-codec-analog.o
2726 obj-$(CONFIG_SND_HDA_CODEC_CA0110) += snd-hda-codec-ca0110.o
2827 obj-$(CONFIG_SND_HDA_CODEC_CA0132) += snd-hda-codec-ca0132.o
29−obj-$(CONFIG_SND_HDA_CODEC_CMEDIA) += snd-hda-codec-cmedia.o
3028 obj-$(CONFIG_SND_HDA_CODEC_CONEXANT) += snd-hda-codec-conexant.o
3129 obj-$(CONFIG_SND_HDA_CODEC_SIGMATEL) += snd-hda-codec-idt.o
3230 obj-$(CONFIG_SND_HDA_CODEC_SENARYTECH) += snd-hda-codec-senarytech.o
sound/hda/codecs/conexant.c+7−1
@@ -1175,6 +1175,7 @@ static void add_cx5051_fake_mutes(struct hda_codec *codec) · 1174 unmodified lines
11751175 static int cx_probe(struct hda_codec *codec, const struct hda_device_id *id)
11761176 {
11771177 struct conexant_spec *spec;
1178+ struct hda_jack_callback *callback;
11781179 int err;
11791180
11801181 codec_info(codec, "%s: BIOS auto-probing.\n", codec->core.chip_name);
@@ -1190,7 +1191,12 @@ static int cx_probe(struct hda_codec *codec, const struct hda_device_id *id) · 9 unmodified lines
11901191 case 0x14f11f86:
11911192 case 0x14f11f87:
11921193 spec->is_cx11880_sn6140 = true;
1193− snd_hda_jack_detect_enable_callback(codec, 0x19, cx_update_headset_mic_vref);
1194+ callback = snd_hda_jack_detect_enable_callback(codec, 0x19,
1195+ cx_update_headset_mic_vref);
1196+ if (IS_ERR(callback)) {
1197+ err = PTR_ERR(callback);
1198+ goto error;
1199+ }
11941200 break;
11951201 }
11961202
sound/hda/codecs/realtek/alc269.c+13−1
@@ -3694,6 +3694,17 @@ static void alc287_fixup_lenovo_thinkpad_with_alc1318(struct hda_codec *codec, · 3693 unmodified lines
36943694 spec->power_hook = alc287_s4_power_gpio3_default;
36953695 spec->gen.pcm_playback_hook = alc287_alc1318_playback_pcm_hook;
36963696 }
3697+
3698+static void alc287_fixup_tb_vmaster_led(struct hda_codec *codec,
3699+ const struct hda_fixup *fix, int action)
3700+{
3701+ struct alc_spec *spec = codec->spec;
3702+
3703+ if (action == HDA_FIXUP_ACT_PRE_PROBE)
3704+ spec->gen.vmaster_mute_led = 1;
3705+
3706+ alc287_fixup_bind_dacs(codec, fix, action);
3707+}
36973708 /* GPIO2: mute led GPIO3: micmute led */
36983709 static void alc245_tas2781_spi_hp_fixup_muteled(struct hda_codec *codec,
36993710 const struct hda_fixup *fix, int action)
@@ -6448,7 +6459,7 @@ static const struct hda_fixup alc269_fixups[] = { · 2748 unmodified lines
64486459 },
64496460 [ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD] = {
64506461 .type = HDA_FIXUP_FUNC,
6451− .v.func = alc287_fixup_bind_dacs,
6462+ .v.func = alc287_fixup_tb_vmaster_led,
64526463 .chained = true,
64536464 .chain_id = ALC287_FIXUP_CS35L41_I2C_2_THINKPAD_ACPI,
64546465 },
@@ -6717,6 +6728,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { · 262 unmodified lines
67176728 SND_PCI_QUIRK(0x1025, 0x159c, "Acer Nitro 5 AN515-58", ALC2XX_FIXUP_HEADSET_MIC),
67186729 SND_PCI_QUIRK(0x1025, 0x1597, "Acer Nitro 5 AN517-55", ALC2XX_FIXUP_HEADSET_MIC),
67196730 SND_PCI_QUIRK(0x1025, 0x160e, "Acer PT316-51S", ALC2XX_FIXUP_HEADSET_MIC),
6731+ SND_PCI_QUIRK(0x1025, 0x1640, "Acer Aspire A315-44P", ALC256_FIXUP_ACER_SFG16_MICMUTE_LED),
67206732 SND_PCI_QUIRK(0x1025, 0x1679, "Acer Nitro 16 AN16-41", ALC2XX_FIXUP_HEADSET_MIC),
67216733 SND_PCI_QUIRK(0x1025, 0x169a, "Acer Swift SFG16", ALC256_FIXUP_ACER_SFG16_MICMUTE_LED),
67226734 SND_PCI_QUIRK(0x1025, 0x171e, "Acer Nitro ANV15-51", ALC245_FIXUP_ACER_MICMUTE_LED),
sound/hda/codecs/side-codecs/cs35l56_hda.c+21−10
@@ -180,11 +180,15 @@ static int cs35l56_hda_mixer_get(struct snd_kcontrol *kcontrol, · 179 unmodified lines
180180 {
181181 struct cs35l56_hda *cs35l56 = snd_kcontrol_chip(kcontrol);
182182 unsigned int reg_val;
183− int i;
183+ int i, ret;
184184
185185 cs35l56_hda_wait_dsp_ready(cs35l56);
186186
187− regmap_read(cs35l56->base.regmap, kcontrol->private_value, &reg_val);
187+ ret = regmap_read(cs35l56->base.regmap, kcontrol->private_value,
188+ &reg_val);
189+ if (ret)
190+ return ret;
191+
188192 reg_val &= CS35L56_ASP_TXn_SRC_MASK;
189193
190194 for (i = 0; i < CS35L56_NUM_INPUT_SRC; ++i) {
@@ -203,15 +207,20 @@ static int cs35l56_hda_mixer_put(struct snd_kcontrol *kcontrol, · 12 unmodified lines
203207 struct cs35l56_hda *cs35l56 = snd_kcontrol_chip(kcontrol);
204208 unsigned int item = ucontrol->value.enumerated.item[0];
205209 bool changed;
210+ int ret;
206211
207212 if (item >= CS35L56_NUM_INPUT_SRC)
208213 return -EINVAL;
209214
210215 cs35l56_hda_wait_dsp_ready(cs35l56);
211216
212− regmap_update_bits_check(cs35l56->base.regmap, kcontrol->private_value,
213− CS35L56_INPUT_MASK, cs35l56_tx_input_values[item],
214− &changed);
217+ ret = regmap_update_bits_check(cs35l56->base.regmap,
218+ kcontrol->private_value,
219+ CS35L56_INPUT_MASK,
220+ cs35l56_tx_input_values[item],
221+ &changed);
222+ if (ret)
223+ return ret;
215224
216225 return changed;
217226 }
@@ -967,6 +976,7 @@ static int cs35l56_hda_system_resume(struct device *dev) · 749 unmodified lines
967976 static int cs35l56_hda_fixup_yoga9(struct cs35l56_hda *cs35l56, int *bus_addr)
968977 {
969978 /* The cirrus,dev-index property has the wrong values */
979+ cs35l56->num_amps = 2;
970980 switch (*bus_addr) {
971981 case 0x30:
972982 cs35l56->index = 1;
@@ -1016,7 +1026,6 @@ static int cs35l56_hda_read_acpi(struct cs35l56_hda *cs35l56, int hid, int id) · 43 unmodified lines
10161026 char hid_string[8];
10171027 struct acpi_device *adev;
10181028 const char *property, *sub;
1019− size_t nval;
10201029 int i, ret;
10211030
10221031 /*
@@ -1052,13 +1061,14 @@ static int cs35l56_hda_read_acpi(struct cs35l56_hda *cs35l56, int hid, int id) · 29 unmodified lines
10521061 ret = -EINVAL;
10531062 goto err;
10541063 }
1055− nval = ret;
1064+ cs35l56->num_amps = ret;
10561065
1057− ret = device_property_read_u32_array(cs35l56->base.dev, property, values, nval);
1066+ ret = device_property_read_u32_array(cs35l56->base.dev, property, values,
1067+ cs35l56->num_amps);
10581068 if (ret)
10591069 goto err;
10601070
1061− for (i = 0; i < nval; i++) {
1071+ for (i = 0; i < cs35l56->num_amps; i++) {
10621072 if (values[i] == id) {
10631073 cs35l56->index = i;
10641074 break;
@@ -1081,7 +1091,8 @@ static int cs35l56_hda_read_acpi(struct cs35l56_hda *cs35l56, int hid, int id) · 16 unmodified lines
10811091 "Read ACPI _SUB failed(%ld): fallback to generic firmware\n",
10821092 PTR_ERR(sub));
10831093 } else {
1084− ret = cirrus_scodec_get_speaker_id(cs35l56->base.dev, cs35l56->index, nval, -1);
1094+ ret = cirrus_scodec_get_speaker_id(cs35l56->base.dev, cs35l56->index,
1095+ cs35l56->num_amps, -1);
10851096 if (ret == -ENOENT) {
10861097 cs35l56->system_name = sub;
10871098 } else if (ret >= 0) {
sound/hda/codecs/side-codecs/cs35l56_hda.h+1−0
@@ -26,6 +26,7 @@ struct cs35l56_hda { · 25 unmodified lines
2626 struct work_struct dsp_work;
2727
2828 int index;
29+ int num_amps;
2930 const char *system_name;
3031 const char *amp_name;
3132
sound/hda/codecs/side-codecs/tas2781_hda_spi.c+11−3
@@ -132,10 +132,18 @@ static int tasdevice_spi_dev_update_bits(struct tasdevice_priv *tas_priv, · 131 unmodified lines
132132 int ret, val;
133133
134134 /*
135− * In our TAS2781 SPI mode, read/write was masked in last bit of
136− * address, it cause regmap_update_bits() not work as expected.
135+ * In TAS2781 SPI mode, when accessing non-book-zero or page numbers
136+ * greater than 1 in book 0, an additional byte must be read. The
137+ * first byte in such cases is a dummy byte and should be ignored.
137138 */
138− ret = tasdevice_dev_read(tas_priv, chn, reg, &val);
139+ if ((TASDEVICE_BOOK_ID(reg) > 0) || (TASDEVICE_PAGE_ID(reg) > 1)) {
140+ unsigned char buf[2];
141+
142+ ret = tasdevice_dev_bulk_read(tas_priv, chn, reg, buf, 2);
143+ val = buf[1];
144+ } else {
145+ ret = tasdevice_dev_read(tas_priv, chn, reg, &val);
146+ }
139147 if (ret < 0) {
140148 dev_err(tas_priv->dev, "%s, E=%d\n", __func__, ret);
141149 return ret;
sound/hda/core/hdmi_chmap.c+7−4
@@ -353,13 +353,16 @@ static void hdmi_std_setup_channel_mapping(struct hdac_chmap *chmap, · 352 unmodified lines
353353 if (hdmi_channel_mapping[ca][1] == 0) {
354354 int hdmi_slot = 0;
355355 /* fill actual channel mappings in ALSA channel (i) order */
356− for (i = 0; i < ch_alloc->channels; i++) {
357− while (!WARN_ON(hdmi_slot >= 8) &&
358− !ch_alloc->speakers[7 - hdmi_slot])
359− hdmi_slot++; /* skip zero slots */
356+ for (i = 0; i < ch_alloc->channels && hdmi_slot < 8; i++) {
357+ while (!ch_alloc->speakers[7 - hdmi_slot]) {
358+ /* skip zero slots */
359+ if (++hdmi_slot >= 8)
360+ goto out;
361+ }
360362
361363 hdmi_channel_mapping[ca][i] = (i << 4) | hdmi_slot++;
362364 }
365+ out:
363366 /* fill the rest of the slots with ALSA channel 0xf */
364367 for (hdmi_slot = 0; hdmi_slot < 8; hdmi_slot++)
365368 if (!ch_alloc->speakers[7 - hdmi_slot])
sound/soc/amd/acp/acp-legacy-mach.c+1−1
@@ -174,7 +174,7 @@ static int acp_asoc_probe(struct platform_device *pdev) · 173 unmodified lines
174174 acp_card_drvdata->acp_rev = mach->mach_params.subsystem_rev;
175175
176176 dmi_id = dmi_first_match(acp_quirk_table);
177− if (dmi_id && dmi_id->driver_data)
177+ if (dmi_id && dmi_id->driver_data == (void *)QUIRK_TDM_MODE_ENABLE)
178178 acp_card_drvdata->tdm_mode = dmi_id->driver_data;
179179
180180 ret = acp_legacy_dai_links_create(card);
sound/soc/amd/acp/acp-mach-common.c+19−3
@@ -20,6 +20,7 @@ · 19 unmodified lines
2020 #include <sound/soc.h>
2121 #include <linux/input.h>
2222 #include <linux/module.h>
23+#include <linux/dmi.h>
2324
2425 #include "../../codecs/rt5682.h"
2526 #include "../../codecs/rt1019.h"
@@ -37,15 +38,21 @@ · 11 unmodified lines
3738 #define NAU8821_FREQ_OUT 12288000
3839 #define MAX98388_CODEC_DAI "max98388-aif1"
3940
40−#define TDM_MODE_ENABLE 1
41−
4241 const struct dmi_system_id acp_quirk_table[] = {
4342 {
4443 /* Google skyrim proto-0 */
4544 .matches = {
4645 DMI_EXACT_MATCH(DMI_PRODUCT_FAMILY, "Google_Skyrim"),
4746 },
48− .driver_data = (void *)TDM_MODE_ENABLE,
47+ .driver_data = (void *)QUIRK_TDM_MODE_ENABLE,
48+ },
49+ {
50+ /* Valve Steam Deck OLED */
51+ .matches = {
52+ DMI_MATCH(DMI_SYS_VENDOR, "Valve"),
53+ DMI_MATCH(DMI_PRODUCT_NAME, "Galileo"),
54+ },
55+ .driver_data = (void *)QUIRK_REMAP_DMIC_BT,
4956 },
5057 {}
5158 };
@@ -1401,6 +1408,7 @@ int acp_sofdsp_dai_links_create(struct snd_soc_card *card) · 1349 unmodified lines
14011408 struct snd_soc_dai_link *links;
14021409 struct device *dev = card->dev;
14031410 struct acp_card_drvdata *drv_data = card->drvdata;
1411+ const struct dmi_system_id *dmi_id = dmi_first_match(acp_quirk_table);
14041412 int i = 0, num_links = 0;
14051413
14061414 if (drv_data->hs_cpu_id)
@@ -1572,6 +1580,9 @@ int acp_sofdsp_dai_links_create(struct snd_soc_card *card) · 165 unmodified lines
15721580 links[i].codecs = &snd_soc_dummy_dlc;
15731581 links[i].num_codecs = 1;
15741582 }
1583+
1584+ if (dmi_id && dmi_id->driver_data == (void *)QUIRK_REMAP_DMIC_BT)
1585+ links[i].id = DMIC_BE_ID;
15751586 i++;
15761587 }
15771588
@@ -1587,6 +1598,11 @@ int acp_sofdsp_dai_links_create(struct snd_soc_card *card) · 9 unmodified lines
15871598 links[i].capture_only = 1;
15881599 links[i].nonatomic = true;
15891600 links[i].no_pcm = 1;
1601+
1602+ if (dmi_id && dmi_id->driver_data == (void *)QUIRK_REMAP_DMIC_BT) {
1603+ links[i].id = BT_BE_ID;
1604+ dev_dbg(dev, "quirk REMAP_DMIC_BT enabled\n");
1605+ }
15901606 }
15911607
15921608 card->dai_link = links;
sound/soc/amd/acp/acp-mach.h+4−0
@@ -26,6 +26,10 @@ · 25 unmodified lines
2626
2727 #define acp_get_drvdata(card) ((struct acp_card_drvdata *)(card)->drvdata)
2828
29+/* List of DMI quirks - check acp-mach-common.c for usage. */
30+#define QUIRK_TDM_MODE_ENABLE 1
31+#define QUIRK_REMAP_DMIC_BT 2
32+
2933 enum be_id {
3034 HEADSET_BE_ID = 0,
3135 AMP_BE_ID,
sound/soc/amd/acp/acp-sof-mach.c+1−1
@@ -110,7 +110,7 @@ static int acp_sof_probe(struct platform_device *pdev) · 109 unmodified lines
110110
111111 acp_card_drvdata = card->drvdata;
112112 dmi_id = dmi_first_match(acp_quirk_table);
113− if (dmi_id && dmi_id->driver_data)
113+ if (dmi_id && dmi_id->driver_data == (void *)QUIRK_TDM_MODE_ENABLE)
114114 acp_card_drvdata->tdm_mode = dmi_id->driver_data;
115115
116116 acp_card_drvdata->acp_rev = mach->mach_params.subsystem_rev;
sound/soc/codecs/ab8500-codec.c+3−3
@@ -2496,13 +2496,13 @@ static int ab8500_codec_probe(struct snd_soc_component *component) · 2495 unmodified lines
24962496 return status;
24972497 }
24982498 fc = (struct filter_control *)
2499− &ab8500_filter_controls[AB8500_FILTER_ANC_FIR].private_value;
2499+ ab8500_filter_controls[AB8500_FILTER_ANC_FIR].private_value;
25002500 drvdata->anc_fir_values = (long *)fc->value;
25012501 fc = (struct filter_control *)
2502− &ab8500_filter_controls[AB8500_FILTER_ANC_IIR].private_value;
2502+ ab8500_filter_controls[AB8500_FILTER_ANC_IIR].private_value;
25032503 drvdata->anc_iir_values = (long *)fc->value;
25042504 fc = (struct filter_control *)
2505− &ab8500_filter_controls[AB8500_FILTER_SID_FIR].private_value;
2505+ ab8500_filter_controls[AB8500_FILTER_SID_FIR].private_value;
25062506 drvdata->sid_fir_values = (long *)fc->value;
25072507
25082508 snd_soc_dapm_disable_pin(dapm, "ANC Configure Input");
sound/soc/codecs/aw88395/aw88395.c+4−5
@@ -456,8 +456,6 @@ static void aw88395_hw_reset(struct aw88395 *aw88395) · 455 unmodified lines
456456 usleep_range(AW88395_1000_US, AW88395_1000_US + 10);
457457 gpiod_set_value_cansleep(aw88395->reset_gpio, 1);
458458 usleep_range(AW88395_1000_US, AW88395_1000_US + 10);
459− } else {
460− dev_err(aw88395->aw_pa->dev, "%s failed", __func__);
461459 }
462460 }
463461
@@ -522,9 +520,10 @@ static int aw88395_i2c_probe(struct i2c_client *i2c) · 58 unmodified lines
522520 i2c_set_clientdata(i2c, aw88395);
523521
524522 aw88395->reset_gpio = devm_gpiod_get_optional(&i2c->dev, "reset", GPIOD_OUT_LOW);
525− if (IS_ERR(aw88395->reset_gpio))
526− dev_info(&i2c->dev, "reset gpio not defined\n");
527−
523+ if (IS_ERR(aw88395->reset_gpio)) {
524+ return dev_err_probe(&i2c->dev, PTR_ERR(aw88395->reset_gpio),
525+ "failed to get reset gpio\n");
526+ }
528527 /* hardware reset */
529528 aw88395_hw_reset(aw88395);
530529
sound/soc/codecs/cs35l56-shared.c+3−4
@@ -108,8 +108,6 @@ int cs35l56_set_patch(struct cs35l56_base *cs35l56_base) · 107 unmodified lines
108108 EXPORT_SYMBOL_NS_GPL(cs35l56_set_patch, "SND_SOC_CS35L56_SHARED");
109109
110110 static const struct reg_default cs35l56_reg_defaults[] = {
111− /* no defaults for OTP_MEM - first read populates cache */
112−
113111 { CS35L56_ASP1_ENABLES1, 0x00000000 },
114112 { CS35L56_ASP1_CONTROL1, 0x00000028 },
115113 { CS35L56_ASP1_CONTROL2, 0x18180200 },
@@ -138,8 +136,6 @@ static const struct reg_default cs35l56_reg_defaults[] = { · 22 unmodified lines
138136 };
139137
140138 static const struct reg_default cs35l63_reg_defaults[] = {
141− /* no defaults for OTP_MEM - first read populates cache */
142−
143139 { CS35L56_ASP1_ENABLES1, 0x00000000 },
144140 { CS35L56_ASP1_CONTROL1, 0x00000028 },
145141 { CS35L56_ASP1_CONTROL2, 0x18180200 },
@@ -282,6 +278,9 @@ static bool cs35l56_common_volatile_reg(unsigned int reg) · 136 unmodified lines
282278 case CS35L56_GLOBAL_ENABLES: /* owned by firmware */
283279 case CS35L56_BLOCK_ENABLES: /* owned by firmware */
284280 case CS35L56_BLOCK_ENABLES2: /* owned by firmware */
281+ case CS35L56_OTP_MEM_53:
282+ case CS35L56_OTP_MEM_54:
283+ case CS35L56_OTP_MEM_55:
285284 case CS35L56_SYNC_GPIO1_CFG ... CS35L56_ASP2_DIO_GPIO13_CFG:
286285 case CS35L56_UPDATE_REGS:
287286 case CS35L56_REFCLK_INPUT: /* owned by firmware */
sound/soc/codecs/es8389.c+1−1
@@ -892,7 +892,7 @@ static int es8389_probe(struct snd_soc_component *component) · 891 unmodified lines
892892 return ret;
893893 }
894894
895− es8389->mclk = devm_clk_get(component->dev, "mclk");
895+ es8389->mclk = devm_clk_get_optional(component->dev, "mclk");
896896 if (IS_ERR(es8389->mclk))
897897 return dev_err_probe(component->dev, PTR_ERR(es8389->mclk),
898898 "ES8389 is unable to get mclk\n");
sound/soc/codecs/tas2764.c+1−0
@@ -904,6 +904,7 @@ static bool tas2764_volatile_register(struct device *dev, unsigned int reg) · 903 unmodified lines
904904 {
905905 switch (reg) {
906906 case TAS2764_SW_RST:
907+ case TAS2764_TEMP:
907908 case TAS2764_INT_LTCH0 ... TAS2764_INT_LTCH4:
908909 case TAS2764_INT_CLK_CFG:
909910 return true;
sound/soc/codecs/tas2770.c+2−2
@@ -624,7 +624,7 @@ static int tas2770_read_die_temp(struct tas2770_priv *tas2770, long *result) · 623 unmodified lines
624624 /*
625625 * As per datasheet: divide register by 16 and subtract 93 to get
626626 * degrees Celsius. hwmon requires millidegrees. Let's avoid rounding
627− * errors by subtracting 93 * 16 then multiplying by 1000 / 16.
627+ * errors by subtracting 93 * 16 and scaling before dividing.
628628 *
629629 * NOTE: The ADC registers are initialised to 0 on reset. This means
630630 * that the temperature will read -93 *C until the chip is brought out
@@ -633,7 +633,7 @@ static int tas2770_read_die_temp(struct tas2770_priv *tas2770, long *result) · 2 unmodified lines
633633 * value read back from its registers will be the last value sampled
634634 * before entering software shutdown.
635635 */
636− *result = (reading - (93 * 16)) * (1000 / 16);
636+ *result = (reading - (93 * 16)) * 1000 / 16;
637637 return 0;
638638 }
639639
sound/soc/codecs/wcd937x.c+25−1
@@ -546,6 +546,9 @@ static int wcd937x_codec_aux_dac_event(struct snd_soc_dapm_widget *w, · 545 unmodified lines
546546 snd_soc_component_update_bits(component,
547547 WCD937X_DIGITAL_CDC_ANA_CLK_CTL,
548548 BIT(2), BIT(2));
549+ snd_soc_component_update_bits(component,
550+ WCD937X_AUX_AUXPA,
551+ BIT(4), BIT(4));
549552 snd_soc_component_update_bits(component,
550553 WCD937X_DIGITAL_CDC_DIG_CLK_CTL,
551554 BIT(2), BIT(2));
@@ -562,6 +565,9 @@ static int wcd937x_codec_aux_dac_event(struct snd_soc_dapm_widget *w, · 10 unmodified lines
562565 snd_soc_component_update_bits(component,
563566 WCD937X_DIGITAL_CDC_ANA_CLK_CTL,
564567 BIT(2), 0x00);
568+ snd_soc_component_update_bits(component,
569+ WCD937X_AUX_AUXPA,
570+ BIT(4), 0x00);
565571 break;
566572 }
567573
@@ -730,10 +736,23 @@ static int wcd937x_codec_enable_aux_pa(struct snd_soc_dapm_widget *w, · 162 unmodified lines
730736 snd_soc_component_update_bits(component,
731737 WCD937X_ANA_RX_SUPPLIES,
732738 BIT(1), BIT(1));
739+ /* Enable AUX PA related RX supplies */
740+ snd_soc_component_update_bits(component,
741+ WCD937X_ANA_RX_SUPPLIES,
742+ BIT(6), BIT(6));
743+ snd_soc_component_update_bits(component,
744+ WCD937X_ANA_RX_SUPPLIES,
745+ BIT(7), BIT(7));
733746 enable_irq(wcd937x->aux_pdm_wd_int);
734747 break;
735748 case SND_SOC_DAPM_PRE_PMD:
736749 disable_irq_nosync(wcd937x->aux_pdm_wd_int);
750+ snd_soc_component_update_bits(component,
751+ WCD937X_ANA_RX_SUPPLIES,
752+ BIT(6), 0x00);
753+ snd_soc_component_update_bits(component,
754+ WCD937X_ANA_RX_SUPPLIES,
755+ BIT(7), 0x00);
737756 break;
738757 case SND_SOC_DAPM_POST_PMD:
739758 usleep_range(2000, 2010);
@@ -2051,7 +2070,12 @@ static const struct snd_kcontrol_new wcd937x_snd_controls[] = { · 1311 unmodified lines
20512070 wcd937x_get_swr_port, wcd937x_set_swr_port),
20522071 SOC_SINGLE_EXT("LO Switch", WCD937X_LO, 0, 1, 0,
20532072 wcd937x_get_swr_port, wcd937x_set_swr_port),
2054−
2073+ SOC_SINGLE_EXT("CLSH PA Switch", WCD937X_CLSH, 0, 1, 0,
2074+ wcd937x_get_swr_port, wcd937x_set_swr_port),
2075+ SOC_SINGLE_EXT("DSD_L Switch", WCD937X_DSD_L, 0, 1, 0,
2076+ wcd937x_get_swr_port, wcd937x_set_swr_port),
2077+ SOC_SINGLE_EXT("DSD_R Switch", WCD937X_DSD_R, 0, 1, 0,
2078+ wcd937x_get_swr_port, wcd937x_set_swr_port),
20552079 SOC_SINGLE_EXT("ADC1 Switch", WCD937X_ADC1, 1, 1, 0,
20562080 wcd937x_get_swr_port, wcd937x_set_swr_port),
20572081 SOC_SINGLE_EXT("ADC2 Switch", WCD937X_ADC2, 1, 1, 0,
sound/soc/intel/boards/bytcr_wm5102.c+1−0
@@ -170,6 +170,7 @@ static int platform_clock_control(struct snd_soc_dapm_widget *w, · 169 unmodified lines
170170 ret = byt_wm5102_prepare_and_enable_pll1(codec_dai, 48000);
171171 if (ret) {
172172 dev_err(card->dev, "Error setting codec sysclk: %d\n", ret);
173+ clk_disable_unprepare(priv->mclk);
173174 return ret;
174175 }
175176 } else {
sound/soc/sof/intel/hda.c+2−1
@@ -1412,7 +1412,8 @@ static struct snd_soc_acpi_mach *hda_sdw_machine_select(struct snd_sof_dev *sdev · 1411 unmodified lines
14121412 link_mask |= BIT(peripherals->array[i]->bus->link_id);
14131413
14141414 link_num = hweight32(link_mask);
1415− links = devm_kcalloc(sdev->dev, link_num, sizeof(*links), GFP_KERNEL);
1415+ /* An empty adr_link is needed to terminate the adr_link loop */
1416+ links = devm_kcalloc(sdev->dev, link_num + 1, sizeof(*links), GFP_KERNEL);
14161417 if (!links)
14171418 return NULL;
14181419
sound/soc/spacemit/k1_i2s.c+34−15
@@ -93,8 +93,8 @@ static void spacemit_i2s_init(struct spacemit_i2s_dev *i2s) · 92 unmodified lines
9393 u32 sscr_val, sspsp_val, ssfcr_val, ssrwt_val;
9494
9595 sscr_val = SSCR_TRAIL | SSCR_FRF_PSP;
96− ssfcr_val = FIELD_PREP(SSFCR_FIELD_TFT, 5) |
97− FIELD_PREP(SSFCR_FIELD_RFT, 5) |
96+ ssfcr_val = FIELD_PREP(SSFCR_FIELD_TFT, 0xF) |
97+ FIELD_PREP(SSFCR_FIELD_RFT, 0xF) |
9898 SSFCR_RSRE | SSFCR_TSRE;
9999 ssrwt_val = SSRWT_RWOT;
100100 sspsp_val = SSPSP_SFRMP;
@@ -106,6 +106,37 @@ static void spacemit_i2s_init(struct spacemit_i2s_dev *i2s) · 5 unmodified lines
106106 writel(0, i2s->base + SSINTEN);
107107 }
108108
109+static int spacemit_i2s_startup(struct snd_pcm_substream *substream,
110+ struct snd_soc_dai *dai)
111+{
112+ struct spacemit_i2s_dev *i2s = snd_soc_dai_get_drvdata(dai);
113+
114+ switch (i2s->dai_fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
115+ case SND_SOC_DAIFMT_I2S:
116+ snd_pcm_hw_constraint_minmax(substream->runtime,
117+ SNDRV_PCM_HW_PARAM_CHANNELS,
118+ 2, 2);
119+ snd_pcm_hw_constraint_mask64(substream->runtime,
120+ SNDRV_PCM_HW_PARAM_FORMAT,
121+ SNDRV_PCM_FMTBIT_S16_LE);
122+ break;
123+ case SND_SOC_DAIFMT_DSP_A:
124+ case SND_SOC_DAIFMT_DSP_B:
125+ snd_pcm_hw_constraint_minmax(substream->runtime,
126+ SNDRV_PCM_HW_PARAM_CHANNELS,
127+ 1, 1);
128+ snd_pcm_hw_constraint_mask64(substream->runtime,
129+ SNDRV_PCM_HW_PARAM_FORMAT,
130+ SNDRV_PCM_FMTBIT_S32_LE);
131+ break;
132+ default:
133+ dev_dbg(i2s->dev, "unexpected format type");
134+ return -EINVAL;
135+ }
136+
137+ return 0;
138+}
139+
109140 static int spacemit_i2s_hw_params(struct snd_pcm_substream *substream,
110141 struct snd_pcm_hw_params *params,
111142 struct snd_soc_dai *dai)
@@ -157,22 +188,9 @@ static int spacemit_i2s_hw_params(struct snd_pcm_substream *substream, · 45 unmodified lines
157188 dma_data->maxburst = 32;
158189 dma_data->addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
159190 }
160−
161− snd_pcm_hw_constraint_minmax(substream->runtime,
162− SNDRV_PCM_HW_PARAM_CHANNELS,
163− 1, 2);
164− snd_pcm_hw_constraint_mask64(substream->runtime,
165− SNDRV_PCM_HW_PARAM_FORMAT,
166− SNDRV_PCM_FMTBIT_S16_LE);
167191 break;
168192 case SND_SOC_DAIFMT_DSP_A:
169193 case SND_SOC_DAIFMT_DSP_B:
170− snd_pcm_hw_constraint_minmax(substream->runtime,
171− SNDRV_PCM_HW_PARAM_CHANNELS,
172− 1, 1);
173− snd_pcm_hw_constraint_mask64(substream->runtime,
174− SNDRV_PCM_HW_PARAM_FORMAT,
175− SNDRV_PCM_FMTBIT_S32_LE);
176194 break;
177195 default:
178196 dev_dbg(i2s->dev, "unexpected format type");
@@ -303,6 +321,7 @@ static int spacemit_i2s_dai_remove(struct snd_soc_dai *dai) · 124 unmodified lines
303321 static const struct snd_soc_dai_ops spacemit_i2s_dai_ops = {
304322 .probe = spacemit_i2s_dai_probe,
305323 .remove = spacemit_i2s_dai_remove,
324+ .startup = spacemit_i2s_startup,
306325 .hw_params = spacemit_i2s_hw_params,
307326 .set_sysclk = spacemit_i2s_set_sysclk,
308327 .set_fmt = spacemit_i2s_set_fmt,
sound/soc/tegra/Makefile+0−1
@@ -1,7 +1,6 @@
11 # SPDX-License-Identifier: GPL-2.0
22 # Tegra platform Support
33 snd-soc-tegra-pcm-y := tegra_pcm.o
4−snd-soc-tegra-utils-y += tegra_asoc_utils.o
54 snd-soc-tegra20-ac97-y := tegra20_ac97.o
65 snd-soc-tegra20-das-y := tegra20_das.o
76 snd-soc-tegra20-i2s-y := tegra20_i2s.o
sound/usb/caiaq/device.c+3−3
@@ -366,7 +366,7 @@ static int setup_card(struct snd_usb_caiaqdev *cdev) · 365 unmodified lines
366366
367367 #ifdef CONFIG_SND_USB_CAIAQ_INPUT
368368 ret = snd_usb_caiaq_input_init(cdev);
369− if (ret < 0) {
369+ if (ret < 0 && ret != -ENODEV) {
370370 dev_err(dev, "Unable to set up input system (ret=%d)\n", ret);
371371 return ret;
372372 }
@@ -423,6 +423,7 @@ static int create_card(struct usb_device *usb_dev, · 50 unmodified lines
423423
424424 cdev = caiaqdev(card);
425425 cdev->chip.dev = usb_get_dev(usb_dev);
426+ card->private_free = card_free;
426427 cdev->chip.card = card;
427428 cdev->chip.usb_id = USB_ID(le16_to_cpu(usb_dev->descriptor.idVendor),
428429 le16_to_cpu(usb_dev->descriptor.idProduct));
@@ -511,10 +512,9 @@ static int init_card(struct snd_usb_caiaqdev *cdev) · 82 unmodified lines
511512 scnprintf(card->longname, sizeof(card->longname), "%s %s (%s)",
512513 cdev->vendor_name, cdev->product_name, usbpath);
513514
514− card->private_free = card_free;
515515 err = setup_card(cdev);
516516 if (err < 0)
517− return err;
517+ goto err_kill_urb;
518518
519519 return 0;
520520
sound/usb/caiaq/input.c+1−1
@@ -804,7 +804,7 @@ int snd_usb_caiaq_input_init(struct snd_usb_caiaqdev *cdev) · 803 unmodified lines
804804
805805 default:
806806 /* no input methods supported on this device */
807− ret = -EINVAL;
807+ ret = -ENODEV;
808808 goto exit_free_idev;
809809 }
810810
sound/usb/misc/ua101.c+7−0
@@ -974,6 +974,13 @@ static int detect_usb_format(struct ua101 *ua) · 973 unmodified lines
974974
975975 ua->capture.channels = fmt_capture->bNrChannels;
976976 ua->playback.channels = fmt_playback->bNrChannels;
977+ if (!ua->capture.channels || !ua->playback.channels) {
978+ dev_err(&ua->dev->dev,
979+ "invalid channel count: capture %u, playback %u\n",
980+ ua->capture.channels, ua->playback.channels);
981+ return -EINVAL;
982+ }
983+
977984 ua->capture.frame_bytes =
978985 fmt_capture->bSubframeSize * ua->capture.channels;
979986 ua->playback.frame_bytes =
sound/usb/mixer.c+10−0
@@ -1190,6 +1190,16 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, · 1189 unmodified lines
11901190 cval->res = 1;
11911191 }
11921192 break;
1193+
1194+ case USB_ID(0x0e6f, 0x024a): /* PDP Riffmaster for PS4 */
1195+ case USB_ID(0x0e6f, 0x0249): /* PDP Riffmaster for PS5 */
1196+ if (!strcmp(kctl->id.name, "PCM Playback Volume")) {
1197+ usb_audio_info(chip,
1198+ "set volume quirk for PDP Riffmaster for PS4/PS5\n");
1199+ cval->min = -2560; /* Mute under it */
1200+ }
1201+ break;
1202+
11931203 case USB_ID(0x3302, 0x12db): /* MOONDROP Quark2 */
11941204 if (!strcmp(kctl->id.name, "PCM Playback Volume")) {
11951205 usb_audio_info(chip,
sound/usb/quirks-table.h+3−1
@@ -2652,6 +2652,9 @@ YAMAHA_DEVICE(0x7010, "UB99"), · 2651 unmodified lines
26522652 }
26532653 }
26542654 },
2655+
2656+#endif /* disabled */
2657+
26552658 {
26562659 /*
26572660 * The AudioBox USB advertises S24_3LE as the only supported format
@@ -2700,7 +2703,6 @@ YAMAHA_DEVICE(0x7010, "UB99"), · 42 unmodified lines
27002703 }
27012704 }
27022705 },
2703−#endif /* disabled */
27042706
27052707 {
27062708 /*
sound/usb/quirks.c+1−1
@@ -125,7 +125,7 @@ static int add_audio_stream_from_fixed_fmt(struct snd_usb_audio *chip, · 124 unmodified lines
125125
126126 snd_usb_audioformat_set_sync_ep(chip, fp);
127127
128− err = snd_usb_add_audio_stream(chip, stream, fp);
128+ err = snd_usb_add_audio_stream(chip, stream, fp, NULL);
129129 if (err < 0)
130130 return err;
131131
sound/usb/stream.c+25−37
@@ -79,7 +79,7 @@ static void snd_usb_audio_pcm_free(struct snd_pcm *pcm) · 78 unmodified lines
7979 static void snd_usb_init_substream(struct snd_usb_stream *as,
8080 int stream,
8181 struct audioformat *fp,
82− struct snd_usb_power_domain *pd)
82+ struct snd_usb_power_domain **pdptr)
8383 {
8484 struct snd_usb_substream *subs = &as->substream[stream];
8585
@@ -105,10 +105,11 @@ static void snd_usb_init_substream(struct snd_usb_stream *as, · 19 unmodified lines
105105 if (fp->channels > subs->channels_max)
106106 subs->channels_max = fp->channels;
107107
108− if (pd) {
109− subs->str_pd = pd;
108+ if (pdptr && *pdptr) {
109+ subs->str_pd = *pdptr;
110+ *pdptr = NULL; /* assigned */
110111 /* Initialize Power Domain to idle status D1 */
111− snd_usb_power_domain_set(subs->stream->chip, pd,
112+ snd_usb_power_domain_set(subs->stream->chip, subs->str_pd,
112113 UAC3_PD_STATE_D1);
113114 }
114115
@@ -352,6 +353,8 @@ snd_pcm_chmap_elem *convert_chmap_v3(struct uac3_cluster_header_descriptor · 237 unmodified lines
352353 if (len < sizeof(*cs_desc))
353354 break;
354355 cs_len = le16_to_cpu(cs_desc->wLength);
356+ if (cs_len < sizeof(*cs_desc))
357+ break;
355358 if (len < cs_len)
356359 break;
357360 cs_type = cs_desc->bSegmentType;
@@ -492,11 +495,14 @@ snd_pcm_chmap_elem *convert_chmap_v3(struct uac3_cluster_header_descriptor · 134 unmodified lines
492495 * if not, create a new pcm stream. note, fp is added to the substream
493496 * fmt_list and will be freed on the chip instance release. do not free
494497 * fp or do remove it from the substream fmt_list to avoid double-free.
498+ *
499+ * pdptr is optional and can be NULL. When it's non-NULL and the PD gets
500+ * assigned to the stream, *pdptr is cleared to NULL upon return.
495501 */
496−static int __snd_usb_add_audio_stream(struct snd_usb_audio *chip,
497− int stream,
498− struct audioformat *fp,
499− struct snd_usb_power_domain *pd)
502+int snd_usb_add_audio_stream(struct snd_usb_audio *chip,
503+ int stream,
504+ struct audioformat *fp,
505+ struct snd_usb_power_domain **pdptr)
500506
501507 {
502508 struct snd_usb_stream *as;
@@ -529,7 +535,7 @@ static int __snd_usb_add_audio_stream(struct snd_usb_audio *chip, · 26 unmodified lines
529535 err = snd_pcm_new_stream(as->pcm, stream, 1);
530536 if (err < 0)
531537 return err;
532− snd_usb_init_substream(as, stream, fp, pd);
538+ snd_usb_init_substream(as, stream, fp, pdptr);
533539 return add_chmap(as->pcm, stream, subs);
534540 }
535541
@@ -558,7 +564,7 @@ static int __snd_usb_add_audio_stream(struct snd_usb_audio *chip, · 22 unmodified lines
558564 else
559565 strscpy(pcm->name, "USB Audio");
560566
561− snd_usb_init_substream(as, stream, fp, pd);
567+ snd_usb_init_substream(as, stream, fp, pdptr);
562568
563569 /*
564570 * Keep using head insertion for M-Audio Audiophile USB (tm) which has a
@@ -576,21 +582,6 @@ static int __snd_usb_add_audio_stream(struct snd_usb_audio *chip, · 11 unmodified lines
576582 return add_chmap(pcm, stream, &as->substream[stream]);
577583 }
578584
579−int snd_usb_add_audio_stream(struct snd_usb_audio *chip,
580− int stream,
581− struct audioformat *fp)
582−{
583− return __snd_usb_add_audio_stream(chip, stream, fp, NULL);
584−}
585−
586−static int snd_usb_add_audio_stream_v3(struct snd_usb_audio *chip,
587− int stream,
588− struct audioformat *fp,
589− struct snd_usb_power_domain *pd)
590−{
591− return __snd_usb_add_audio_stream(chip, stream, fp, pd);
592−}
593−
594585 static int parse_uac_endpoint_attributes(struct snd_usb_audio *chip,
595586 struct usb_host_interface *alts,
596587 int protocol, int iface_no)
@@ -1003,7 +994,7 @@ snd_usb_get_audioformat_uac3(struct snd_usb_audio *chip, · 406 unmodified lines
1003994 * and request Cluster Descriptor
1004995 */
1005996 wLength = le16_to_cpu(hc_header.wLength);
1006− if (wLength < sizeof(cluster))
997+ if (wLength < sizeof(*cluster))
1007998 return NULL;
1008999 cluster = kzalloc(wLength, GFP_KERNEL);
10091000 if (!cluster)
@@ -1113,8 +1104,7 @@ found_clock: · 103 unmodified lines
11131104 }
11141105 }
11151106
1116− if (pd)
1117− *pd_out = pd;
1107+ *pd_out = pd;
11181108
11191109 return fp;
11201110 }
@@ -1129,7 +1119,6 @@ static int __snd_usb_parse_audio_interface(struct snd_usb_audio *chip, · 8 unmodified lines
11291119 struct usb_interface_descriptor *altsd;
11301120 int i, altno, err, stream;
11311121 struct audioformat *fp = NULL;
1132− struct snd_usb_power_domain *pd = NULL;
11331122 bool set_iface_first;
11341123 int num, protocol;
11351124
@@ -1171,6 +1160,12 @@ static int __snd_usb_parse_audio_interface(struct snd_usb_audio *chip, · 35 unmodified lines
11711160 if (snd_usb_apply_interface_quirk(chip, iface_no, altno))
11721161 continue;
11731162
1163+ /* pd may be allocated at snd_usb_get_audioformat_uac3() and
1164+ * assigned at snd_usb_add_audio_stream(); otherwise it'll be
1165+ * freed automatically by cleanup at each loop.
1166+ */
1167+ struct snd_usb_power_domain *pd __free(kfree) = NULL;
1168+
11741169 /*
11751170 * Roland audio streaming interfaces are marked with protocols
11761171 * 0/1/2, but are UAC 1 compatible.
@@ -1226,23 +1221,16 @@ static int __snd_usb_parse_audio_interface(struct snd_usb_audio *chip, · 49 unmodified lines
12261221 *has_non_pcm = true;
12271222 if ((fp->fmt_type == UAC_FORMAT_TYPE_I) == non_pcm) {
12281223 audioformat_free(fp);
1229− kfree(pd);
12301224 fp = NULL;
1231− pd = NULL;
12321225 continue;
12331226 }
12341227
12351228 snd_usb_audioformat_set_sync_ep(chip, fp);
12361229
12371230 dev_dbg(&dev->dev, "%u:%d: add audio endpoint %#x\n", iface_no, altno, fp->endpoint);
1238− if (protocol == UAC_VERSION_3)
1239− err = snd_usb_add_audio_stream_v3(chip, stream, fp, pd);
1240− else
1241− err = snd_usb_add_audio_stream(chip, stream, fp);
1242−
1231+ err = snd_usb_add_audio_stream(chip, stream, fp, &pd);
12431232 if (err < 0) {
12441233 audioformat_free(fp);
1245− kfree(pd);
12461234 return err;
12471235 }
12481236
sound/usb/stream.h+2−1
@@ -7,7 +7,8 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, · 6 unmodified lines
77
88 int snd_usb_add_audio_stream(struct snd_usb_audio *chip,
99 int stream,
10− struct audioformat *fp);
10+ struct audioformat *fp,
11+ struct snd_usb_power_domain **pdptr);
1112
1213 #endif /* __USBAUDIO_STREAM_H */
1314
tools/sched_ext/scx_qmap.bpf.c+6−18
@@ -159,13 +159,7 @@ static s32 pick_direct_dispatch_cpu(struct task_struct *p, s32 prev_cpu) · 158 unmodified lines
159159
160160 static struct task_ctx *lookup_task_ctx(struct task_struct *p)
161161 {
162− struct task_ctx *tctx;
163−
164− if (!(tctx = bpf_task_storage_get(&task_ctx_stor, p, 0, 0))) {
165− scx_bpf_error("task_ctx lookup failed");
166− return NULL;
167− }
168− return tctx;
162+ return bpf_task_storage_get(&task_ctx_stor, p, 0, 0);
169163 }
170164
171165 s32 BPF_STRUCT_OPS(qmap_select_cpu, struct task_struct *p,
@@ -175,7 +169,7 @@ s32 BPF_STRUCT_OPS(qmap_select_cpu, struct task_struct *p, · 3 unmodified lines
175169 s32 cpu;
176170
177171 if (!(tctx = lookup_task_ctx(p)))
178− return -ESRCH;
172+ return prev_cpu;
179173
180174 if (p->scx.weight < 2 && !(p->flags & PF_KTHREAD))
181175 return prev_cpu;
@@ -540,13 +534,9 @@ void BPF_STRUCT_OPS(qmap_dispatch, s32 cpu, struct task_struct *prev) · 358 unmodified lines
540534 */
541535 if (prev) {
542536 tctx = bpf_task_storage_get(&task_ctx_stor, prev, 0, 0);
543− if (!tctx) {
544− scx_bpf_error("task_ctx lookup failed");
545− return;
546− }
547−
548− tctx->core_sched_seq =
549− core_sched_tail_seqs[weight_to_idx(prev->scx.weight)]++;
537+ if (tctx)
538+ tctx->core_sched_seq =
539+ core_sched_tail_seqs[weight_to_idx(prev->scx.weight)]++;
550540 }
551541 }
552542
@@ -584,10 +574,8 @@ static s64 task_qdist(struct task_struct *p) · 31 unmodified lines
584574 s64 qdist;
585575
586576 tctx = bpf_task_storage_get(&task_ctx_stor, p, 0, 0);
587− if (!tctx) {
588− scx_bpf_error("task_ctx lookup failed");
577+ if (!tctx)
589578 return 0;
590− }
591579
592580 qdist = tctx->core_sched_seq - core_sched_head_seqs[idx];
593581
tools/testing/radix-tree/maple.c+1−1
@@ -2,7 +2,7 @@ · 1 unmodified line
22 /*
33 * maple_tree.c: Userspace testing for maple tree test-suite
44 * Copyright (c) 2018-2022 Oracle Corporation
5− * Author: Liam R. Howlett <Liam.Howlett@Oracle.com>
5+ * Author: Liam R. Howlett <liam@infradead.org>
66 *
77 * Any tests that require internal knowledge of the tree or threads and other
88 * difficult to handle in kernel tests.
tools/testing/selftests/arm64/gcs/gcs-util.h+0−6
@@ -18,12 +18,6 @@ · 17 unmodified lines
1818
1919 #ifndef NT_ARM_GCS
2020 #define NT_ARM_GCS 0x410
21−
22−struct user_gcs {
23− __u64 features_enabled;
24− __u64 features_locked;
25− __u64 gcspr_el0;
26−};
2721 #endif
2822
2923 /* Shadow Stack/Guarded Control Stack interface */
tools/testing/selftests/arm64/gcs/libc-gcs.c+1−0
@@ -16,6 +16,7 @@ · 15 unmodified lines
1616
1717 #include <asm/hwcap.h>
1818 #include <asm/mman.h>
19+#include <asm/ptrace.h>
1920
2021 #include <linux/compiler.h>
2122
tools/testing/selftests/drivers/net/README.rst+8−2
@@ -211,8 +211,8 @@ Avoid libraries and frameworks · 210 unmodified lines
211211
212212 Test files should be relatively self contained. The libraries should
213213 only include very core or non-trivial code.
214−It may be tempting to "factor out" the common code, but fight that urge.
215−Library code increases the barrier of entry, and complexity in general.
214+It may be tempting to "factor out" the common code to lib/py/, but fight that
215+urge. Library code increases the barrier of entry, and complexity in general.
216216
217217 Avoid mixing test code and boilerplate
218218 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -290,6 +290,12 @@ or:: · 71 unmodified lines
290290 def test(cfg, mode, protocol):
291291 pass
292292
293+Linters
294+~~~~~~~
295+
296+We expect clean ``ruff check`` and ``pylint --disable=R``.
297+The code should be clean, avoid disabling pylint warnings explicitly!
298+
293299 Running tests CI-style
294300 ======================
295301
tools/testing/selftests/kvm/access_tracking_perf_test.c+22−22
@@ -101,15 +101,15 @@ struct test_params { · 100 unmodified lines
101101 enum vm_mem_backing_src_type backing_src;
102102
103103 /* The amount of memory to allocate for each vCPU. */
104− uint64_t vcpu_memory_bytes;
104+ u64 vcpu_memory_bytes;
105105
106106 /* The number of vCPUs to create in the VM. */
107107 int nr_vcpus;
108108 };
109109
110−static uint64_t pread_uint64(int fd, const char *filename, uint64_t index)
110+static u64 pread_u64(int fd, const char *filename, u64 index)
111111 {
112− uint64_t value;
112+ u64 value;
113113 off_t offset = index * sizeof(value);
114114
115115 TEST_ASSERT(pread(fd, &value, sizeof(value), offset) == sizeof(value),
@@ -123,13 +123,13 @@ static uint64_t pread_uint64(int fd, const char *filename, uint64_t index) · 7 unmodified lines
123123 #define PAGEMAP_PRESENT (1ULL << 63)
124124 #define PAGEMAP_PFN_MASK ((1ULL << 55) - 1)
125125
126−static uint64_t lookup_pfn(int pagemap_fd, struct kvm_vm *vm, uint64_t gva)
126+static u64 lookup_pfn(int pagemap_fd, struct kvm_vm *vm, gva_t gva)
127127 {
128− uint64_t hva = (uint64_t) addr_gva2hva(vm, gva);
129− uint64_t entry;
130− uint64_t pfn;
128+ u64 hva = (u64)addr_gva2hva(vm, gva);
129+ u64 entry;
130+ u64 pfn;
131131
132− entry = pread_uint64(pagemap_fd, "pagemap", hva / getpagesize());
132+ entry = pread_u64(pagemap_fd, "pagemap", hva / getpagesize());
133133 if (!(entry & PAGEMAP_PRESENT))
134134 return 0;
135135
@@ -139,16 +139,16 @@ static uint64_t lookup_pfn(int pagemap_fd, struct kvm_vm *vm, uint64_t gva) · 3 unmodified lines
139139 return pfn;
140140 }
141141
142−static bool is_page_idle(int page_idle_fd, uint64_t pfn)
142+static bool is_page_idle(int page_idle_fd, u64 pfn)
143143 {
144− uint64_t bits = pread_uint64(page_idle_fd, "page_idle", pfn / 64);
144+ u64 bits = pread_u64(page_idle_fd, "page_idle", pfn / 64);
145145
146146 return !!((bits >> (pfn % 64)) & 1);
147147 }
148148
149−static void mark_page_idle(int page_idle_fd, uint64_t pfn)
149+static void mark_page_idle(int page_idle_fd, u64 pfn)
150150 {
151− uint64_t bits = 1ULL << (pfn % 64);
151+ u64 bits = 1ULL << (pfn % 64);
152152
153153 TEST_ASSERT(pwrite(page_idle_fd, &bits, 8, 8 * (pfn / 64)) == 8,
154154 "Set page_idle bits for PFN 0x%" PRIx64, pfn);
@@ -174,11 +174,11 @@ static void pageidle_mark_vcpu_memory_idle(struct kvm_vm *vm, · 19 unmodified lines
174174 struct memstress_vcpu_args *vcpu_args)
175175 {
176176 int vcpu_idx = vcpu_args->vcpu_idx;
177− uint64_t base_gva = vcpu_args->gva;
178− uint64_t pages = vcpu_args->pages;
179− uint64_t page;
180− uint64_t still_idle = 0;
181− uint64_t no_pfn = 0;
177+ gva_t base_gva = vcpu_args->gva;
178+ u64 pages = vcpu_args->pages;
179+ u64 page;
180+ u64 still_idle = 0;
181+ u64 no_pfn = 0;
182182 int page_idle_fd;
183183 int pagemap_fd;
184184
@@ -193,8 +193,8 @@ static void pageidle_mark_vcpu_memory_idle(struct kvm_vm *vm, · 8 unmodified lines
193193 TEST_ASSERT(pagemap_fd > 0, "Failed to open pagemap.");
194194
195195 for (page = 0; page < pages; page++) {
196− uint64_t gva = base_gva + page * memstress_args.guest_page_size;
197− uint64_t pfn = lookup_pfn(pagemap_fd, vm, gva);
196+ gva_t gva = base_gva + page * memstress_args.guest_page_size;
197+ u64 pfn = lookup_pfn(pagemap_fd, vm, gva);
198198
199199 if (!pfn) {
200200 no_pfn++;
@@ -297,10 +297,10 @@ static void lru_gen_mark_memory_idle(struct kvm_vm *vm) · 96 unmodified lines
297297 lru_gen_last_gen = new_gen;
298298 }
299299
300−static void assert_ucall(struct kvm_vcpu *vcpu, uint64_t expected_ucall)
300+static void assert_ucall(struct kvm_vcpu *vcpu, u64 expected_ucall)
301301 {
302302 struct ucall uc;
303− uint64_t actual_ucall = get_ucall(vcpu, &uc);
303+ u64 actual_ucall = get_ucall(vcpu, &uc);
304304
305305 TEST_ASSERT(expected_ucall == actual_ucall,
306306 "Guest exited unexpectedly (expected ucall %" PRIu64
@@ -417,7 +417,7 @@ static void run_test(enum vm_guest_mode mode, void *arg) · 110 unmodified lines
417417 */
418418 test_pages = params->nr_vcpus * params->vcpu_memory_bytes /
419419 max(memstress_args.guest_page_size,
420− (uint64_t)getpagesize());
420+ (u64)getpagesize());
421421
422422 memstress_start_vcpu_threads(nr_vcpus, vcpu_thread_main);
423423
tools/testing/selftests/kvm/arch_timer.c+3−3
@@ -78,9 +78,9 @@ static void *test_vcpu_run(void *arg) · 77 unmodified lines
7878 return NULL;
7979 }
8080
81−static uint32_t test_get_pcpu(void)
81+static u32 test_get_pcpu(void)
8282 {
83− uint32_t pcpu;
83+ u32 pcpu;
8484 unsigned int nproc_conf;
8585 cpu_set_t online_cpuset;
8686
@@ -98,7 +98,7 @@ static uint32_t test_get_pcpu(void) · 11 unmodified lines
9898 static int test_migrate_vcpu(unsigned int vcpu_idx)
9999 {
100100 int ret;
101− uint32_t new_pcpu = test_get_pcpu();
101+ u32 new_pcpu = test_get_pcpu();
102102
103103 pr_debug("Migrating vCPU: %u to pCPU: %u\n", vcpu_idx, new_pcpu);
104104
tools/testing/selftests/kvm/arm64/aarch32_id_regs.c+7−7
@@ -66,7 +66,7 @@ static void test_guest_raz(struct kvm_vcpu *vcpu) · 65 unmodified lines
6666 }
6767 }
6868
69−static uint64_t raz_wi_reg_ids[] = {
69+static u64 raz_wi_reg_ids[] = {
7070 KVM_ARM64_SYS_REG(SYS_ID_PFR0_EL1),
7171 KVM_ARM64_SYS_REG(SYS_ID_PFR1_EL1),
7272 KVM_ARM64_SYS_REG(SYS_ID_DFR0_EL1),
@@ -94,8 +94,8 @@ static void test_user_raz_wi(struct kvm_vcpu *vcpu) · 21 unmodified lines
9494 int i;
9595
9696 for (i = 0; i < ARRAY_SIZE(raz_wi_reg_ids); i++) {
97− uint64_t reg_id = raz_wi_reg_ids[i];
98− uint64_t val;
97+ u64 reg_id = raz_wi_reg_ids[i];
98+ u64 val;
9999
100100 val = vcpu_get_reg(vcpu, reg_id);
101101 TEST_ASSERT_EQ(val, 0);
@@ -111,7 +111,7 @@ static void test_user_raz_wi(struct kvm_vcpu *vcpu) · 9 unmodified lines
111111 }
112112 }
113113
114−static uint64_t raz_invariant_reg_ids[] = {
114+static u64 raz_invariant_reg_ids[] = {
115115 KVM_ARM64_SYS_REG(SYS_ID_AFR0_EL1),
116116 KVM_ARM64_SYS_REG(sys_reg(3, 0, 0, 3, 3)),
117117 KVM_ARM64_SYS_REG(SYS_ID_DFR1_EL1),
@@ -123,8 +123,8 @@ static void test_user_raz_invariant(struct kvm_vcpu *vcpu) · 5 unmodified lines
123123 int i, r;
124124
125125 for (i = 0; i < ARRAY_SIZE(raz_invariant_reg_ids); i++) {
126− uint64_t reg_id = raz_invariant_reg_ids[i];
127− uint64_t val;
126+ u64 reg_id = raz_invariant_reg_ids[i];
127+ u64 val;
128128
129129 val = vcpu_get_reg(vcpu, reg_id);
130130 TEST_ASSERT_EQ(val, 0);
@@ -142,7 +142,7 @@ static void test_user_raz_invariant(struct kvm_vcpu *vcpu) · 11 unmodified lines
142142
143143 static bool vcpu_aarch64_only(struct kvm_vcpu *vcpu)
144144 {
145− uint64_t val, el0;
145+ u64 val, el0;
146146
147147 val = vcpu_get_reg(vcpu, KVM_ARM64_SYS_REG(SYS_ID_AA64PFR0_EL1));
148148
tools/testing/selftests/kvm/arm64/arch_timer.c+4−4
@@ -56,7 +56,7 @@ static void guest_validate_irq(unsigned int intid, · 55 unmodified lines
5656 struct test_vcpu_shared_data *shared_data)
5757 {
5858 enum guest_stage stage = shared_data->guest_stage;
59− uint64_t xcnt = 0, xcnt_diff_us, cval = 0;
59+ u64 xcnt = 0, xcnt_diff_us, cval = 0;
6060 unsigned long xctl = 0;
6161 unsigned int timer_irq = 0;
6262 unsigned int accessor;
@@ -105,7 +105,7 @@ static void guest_validate_irq(unsigned int intid, · 42 unmodified lines
105105 static void guest_irq_handler(struct ex_regs *regs)
106106 {
107107 unsigned int intid = gic_get_and_ack_irq();
108− uint32_t cpu = guest_get_vcpuid();
108+ u32 cpu = guest_get_vcpuid();
109109 struct test_vcpu_shared_data *shared_data = &vcpu_shared_data[cpu];
110110
111111 guest_validate_irq(intid, shared_data);
@@ -116,7 +116,7 @@ static void guest_irq_handler(struct ex_regs *regs) · 4 unmodified lines
116116 static void guest_run_stage(struct test_vcpu_shared_data *shared_data,
117117 enum guest_stage stage)
118118 {
119− uint32_t irq_iter, config_iter;
119+ u32 irq_iter, config_iter;
120120
121121 shared_data->guest_stage = stage;
122122 shared_data->nr_iter = 0;
@@ -140,7 +140,7 @@ static void guest_run_stage(struct test_vcpu_shared_data *shared_data, · 17 unmodified lines
140140
141141 static void guest_code(void)
142142 {
143− uint32_t cpu = guest_get_vcpuid();
143+ u32 cpu = guest_get_vcpuid();
144144 struct test_vcpu_shared_data *shared_data = &vcpu_shared_data[cpu];
145145
146146 local_irq_disable();
tools/testing/selftests/kvm/arm64/arch_timer_edge_cases.c+80−81
@@ -23,25 +23,25 @@ · 22 unmodified lines
2323 #include "vgic.h"
2424
2525 /* Depends on counter width. */
26−static uint64_t CVAL_MAX;
26+static u64 CVAL_MAX;
2727 /* tval is a signed 32-bit int. */
28−static const int32_t TVAL_MAX = INT32_MAX;
29−static const int32_t TVAL_MIN = INT32_MIN;
28+static const s32 TVAL_MAX = INT32_MAX;
29+static const s32 TVAL_MIN = INT32_MIN;
3030
3131 /* After how much time we say there is no IRQ. */
32−static const uint32_t TIMEOUT_NO_IRQ_US = 50000;
32+static const u32 TIMEOUT_NO_IRQ_US = 50000;
3333
3434 /* Counter value to use as the starting one for most tests. Set to CVAL_MAX/2 */
35−static uint64_t DEF_CNT;
35+static u64 DEF_CNT;
3636
3737 /* Number of runs. */
38−static const uint32_t NR_TEST_ITERS_DEF = 5;
38+static const u32 NR_TEST_ITERS_DEF = 5;
3939
4040 /* Default wait test time in ms. */
41−static const uint32_t WAIT_TEST_MS = 10;
41+static const u32 WAIT_TEST_MS = 10;
4242
4343 /* Default "long" wait test time in ms. */
44−static const uint32_t LONG_WAIT_TEST_MS = 100;
44+static const u32 LONG_WAIT_TEST_MS = 100;
4545
4646 /* Shared with IRQ handler. */
4747 struct test_vcpu_shared_data {
@@ -53,9 +53,9 @@ struct test_args { · 5 unmodified lines
5353 /* Virtual or physical timer and counter tests. */
5454 enum arch_timer timer;
5555 /* Delay used for most timer tests. */
56− uint64_t wait_ms;
56+ u64 wait_ms;
5757 /* Delay used in the test_long_timer_delays test. */
58− uint64_t long_wait_ms;
58+ u64 long_wait_ms;
5959 /* Number of iterations. */
6060 int iterations;
6161 /* Whether to test the physical timer. */
@@ -82,12 +82,12 @@ enum sync_cmd { · 20 unmodified lines
8282 NO_USERSPACE_CMD,
8383 };
8484
85−typedef void (*sleep_method_t)(enum arch_timer timer, uint64_t usec);
85+typedef void (*sleep_method_t)(enum arch_timer timer, u64 usec);
8686
87−static void sleep_poll(enum arch_timer timer, uint64_t usec);
88−static void sleep_sched_poll(enum arch_timer timer, uint64_t usec);
89−static void sleep_in_userspace(enum arch_timer timer, uint64_t usec);
90−static void sleep_migrate(enum arch_timer timer, uint64_t usec);
87+static void sleep_poll(enum arch_timer timer, u64 usec);
88+static void sleep_sched_poll(enum arch_timer timer, u64 usec);
89+static void sleep_in_userspace(enum arch_timer timer, u64 usec);
90+static void sleep_migrate(enum arch_timer timer, u64 usec);
9191
9292 sleep_method_t sleep_method[] = {
9393 sleep_poll,
@@ -115,14 +115,14 @@ enum timer_view { · 21 unmodified lines
115115 TIMER_TVAL,
116116 };
117117
118−static void assert_irqs_handled(uint32_t n)
118+static void assert_irqs_handled(u32 n)
119119 {
120120 int h = atomic_read(&shared_data.handled);
121121
122122 __GUEST_ASSERT(h == n, "Handled %d IRQS but expected %d", h, n);
123123 }
124124
125−static void userspace_cmd(uint64_t cmd)
125+static void userspace_cmd(u64 cmd)
126126 {
127127 GUEST_SYNC_ARGS(cmd, 0, 0, 0, 0);
128128 }
@@ -132,12 +132,12 @@ static void userspace_migrate_vcpu(void) · 3 unmodified lines
132132 userspace_cmd(USERSPACE_MIGRATE_SELF);
133133 }
134134
135−static void userspace_sleep(uint64_t usecs)
135+static void userspace_sleep(u64 usecs)
136136 {
137137 GUEST_SYNC_ARGS(USERSPACE_USLEEP, usecs, 0, 0, 0);
138138 }
139139
140−static void set_counter(enum arch_timer timer, uint64_t counter)
140+static void set_counter(enum arch_timer timer, u64 counter)
141141 {
142142 GUEST_SYNC_ARGS(SET_COUNTER_VALUE, counter, timer, 0, 0);
143143 }
@@ -146,8 +146,8 @@ static void guest_irq_handler(struct ex_regs *regs) · 2 unmodified lines
146146 {
147147 unsigned int intid = gic_get_and_ack_irq();
148148 enum arch_timer timer;
149− uint64_t cnt, cval;
150− uint32_t ctl;
149+ u64 cnt, cval;
150+ u32 ctl;
151151 bool timer_condition, istatus;
152152
153153 if (intid == IAR_SPURIOUS) {
@@ -178,8 +178,8 @@ out: · 24 unmodified lines
178178 gic_set_eoi(intid);
179179 }
180180
181−static void set_cval_irq(enum arch_timer timer, uint64_t cval_cycles,
182− uint32_t ctl)
181+static void set_cval_irq(enum arch_timer timer, u64 cval_cycles,
182+ u32 ctl)
183183 {
184184 atomic_set(&shared_data.handled, 0);
185185 atomic_set(&shared_data.spurious, 0);
@@ -187,8 +187,8 @@ static void set_cval_irq(enum arch_timer timer, uint64_t cval_cycles, · 1 unmodified line
187187 timer_set_ctl(timer, ctl);
188188 }
189189
190−static void set_tval_irq(enum arch_timer timer, uint64_t tval_cycles,
191− uint32_t ctl)
190+static void set_tval_irq(enum arch_timer timer, u64 tval_cycles,
191+ u32 ctl)
192192 {
193193 atomic_set(&shared_data.handled, 0);
194194 atomic_set(&shared_data.spurious, 0);
@@ -196,7 +196,7 @@ static void set_tval_irq(enum arch_timer timer, uint64_t tval_cycles, · 1 unmodified line
196196 timer_set_ctl(timer, ctl);
197197 }
198198
199−static void set_xval_irq(enum arch_timer timer, uint64_t xval, uint32_t ctl,
199+static void set_xval_irq(enum arch_timer timer, u64 xval, u32 ctl,
200200 enum timer_view tv)
201201 {
202202 switch (tv) {
@@ -275,13 +275,13 @@ static void wait_migrate_poll_for_irq(void) · 72 unmodified lines
275275 * Sleep for usec microseconds by polling in the guest or in
276276 * userspace (e.g. userspace_cmd=USERSPACE_SCHEDULE).
277277 */
278−static void guest_poll(enum arch_timer test_timer, uint64_t usec,
278+static void guest_poll(enum arch_timer test_timer, u64 usec,
279279 enum sync_cmd usp_cmd)
280280 {
281− uint64_t cycles = usec_to_cycles(usec);
281+ u64 cycles = usec_to_cycles(usec);
282282 /* Whichever timer we are testing with, sleep with the other. */
283283 enum arch_timer sleep_timer = 1 - test_timer;
284− uint64_t start = timer_get_cntct(sleep_timer);
284+ u64 start = timer_get_cntct(sleep_timer);
285285
286286 while ((timer_get_cntct(sleep_timer) - start) < cycles) {
287287 if (usp_cmd == NO_USERSPACE_CMD)
@@ -291,22 +291,22 @@ static void guest_poll(enum arch_timer test_timer, uint64_t usec, · 3 unmodified lines
291291 }
292292 }
293293
294−static void sleep_poll(enum arch_timer timer, uint64_t usec)
294+static void sleep_poll(enum arch_timer timer, u64 usec)
295295 {
296296 guest_poll(timer, usec, NO_USERSPACE_CMD);
297297 }
298298
299−static void sleep_sched_poll(enum arch_timer timer, uint64_t usec)
299+static void sleep_sched_poll(enum arch_timer timer, u64 usec)
300300 {
301301 guest_poll(timer, usec, USERSPACE_SCHED_YIELD);
302302 }
303303
304−static void sleep_migrate(enum arch_timer timer, uint64_t usec)
304+static void sleep_migrate(enum arch_timer timer, u64 usec)
305305 {
306306 guest_poll(timer, usec, USERSPACE_MIGRATE_SELF);
307307 }
308308
309−static void sleep_in_userspace(enum arch_timer timer, uint64_t usec)
309+static void sleep_in_userspace(enum arch_timer timer, u64 usec)
310310 {
311311 userspace_sleep(usec);
312312 }
@@ -315,15 +315,15 @@ static void sleep_in_userspace(enum arch_timer timer, uint64_t usec) · 2 unmodified lines
315315 * Reset the timer state to some nice values like the counter not being close
316316 * to the edge, and the control register masked and disabled.
317317 */
318−static void reset_timer_state(enum arch_timer timer, uint64_t cnt)
318+static void reset_timer_state(enum arch_timer timer, u64 cnt)
319319 {
320320 set_counter(timer, cnt);
321321 timer_set_ctl(timer, CTL_IMASK);
322322 }
323323
324−static void test_timer_xval(enum arch_timer timer, uint64_t xval,
324+static void test_timer_xval(enum arch_timer timer, u64 xval,
325325 enum timer_view tv, irq_wait_method_t wm, bool reset_state,
326− uint64_t reset_cnt)
326+ u64 reset_cnt)
327327 {
328328 local_irq_disable();
329329
@@ -348,23 +348,23 @@ static void test_timer_xval(enum arch_timer timer, uint64_t xval, · 18 unmodified lines
348348 * the "runner", like: tools/testing/selftests/kselftest/runner.sh.
349349 */
350350
351−static void test_timer_cval(enum arch_timer timer, uint64_t cval,
351+static void test_timer_cval(enum arch_timer timer, u64 cval,
352352 irq_wait_method_t wm, bool reset_state,
353− uint64_t reset_cnt)
353+ u64 reset_cnt)
354354 {
355355 test_timer_xval(timer, cval, TIMER_CVAL, wm, reset_state, reset_cnt);
356356 }
357357
358−static void test_timer_tval(enum arch_timer timer, int32_t tval,
358+static void test_timer_tval(enum arch_timer timer, s32 tval,
359359 irq_wait_method_t wm, bool reset_state,
360− uint64_t reset_cnt)
360+ u64 reset_cnt)
361361 {
362− test_timer_xval(timer, (uint64_t) tval, TIMER_TVAL, wm, reset_state,
362+ test_timer_xval(timer, (u64)tval, TIMER_TVAL, wm, reset_state,
363363 reset_cnt);
364364 }
365365
366−static void test_xval_check_no_irq(enum arch_timer timer, uint64_t xval,
367− uint64_t usec, enum timer_view timer_view,
366+static void test_xval_check_no_irq(enum arch_timer timer, u64 xval,
367+ u64 usec, enum timer_view timer_view,
368368 sleep_method_t guest_sleep)
369369 {
370370 local_irq_disable();
@@ -379,17 +379,17 @@ static void test_xval_check_no_irq(enum arch_timer timer, uint64_t xval, · 8 unmodified lines
379379 assert_irqs_handled(0);
380380 }
381381
382−static void test_cval_no_irq(enum arch_timer timer, uint64_t cval,
383− uint64_t usec, sleep_method_t wm)
382+static void test_cval_no_irq(enum arch_timer timer, u64 cval,
383+ u64 usec, sleep_method_t wm)
384384 {
385385 test_xval_check_no_irq(timer, cval, usec, TIMER_CVAL, wm);
386386 }
387387
388−static void test_tval_no_irq(enum arch_timer timer, int32_t tval, uint64_t usec,
388+static void test_tval_no_irq(enum arch_timer timer, s32 tval, u64 usec,
389389 sleep_method_t wm)
390390 {
391− /* tval will be cast to an int32_t in test_xval_check_no_irq */
392− test_xval_check_no_irq(timer, (uint64_t) tval, usec, TIMER_TVAL, wm);
391+ /* tval will be cast to an s32 in test_xval_check_no_irq */
392+ test_xval_check_no_irq(timer, (u64)tval, usec, TIMER_TVAL, wm);
393393 }
394394
395395 /* Test masking/unmasking a timer using the timer mask (not the IRQ mask). */
@@ -463,7 +463,7 @@ static void test_timers_fired_multiple_times(enum arch_timer timer) · 67 unmodified lines
463463 * timeout for the wait: we use the wfi instruction.
464464 */
465465 static void test_reprogramming_timer(enum arch_timer timer, irq_wait_method_t wm,
466− int32_t delta_1_ms, int32_t delta_2_ms)
466+ s32 delta_1_ms, s32 delta_2_ms)
467467 {
468468 local_irq_disable();
469469 reset_timer_state(timer, DEF_CNT);
@@ -488,7 +488,7 @@ static void test_reprogramming_timer(enum arch_timer timer, irq_wait_method_t wm · 18 unmodified lines
488488 static void test_reprogram_timers(enum arch_timer timer)
489489 {
490490 int i;
491− uint64_t base_wait = test_args.wait_ms;
491+ u64 base_wait = test_args.wait_ms;
492492
493493 for (i = 0; i < ARRAY_SIZE(irq_wait_method); i++) {
494494 /*
@@ -504,8 +504,8 @@ static void test_reprogram_timers(enum arch_timer timer) · 9 unmodified lines
504504
505505 static void test_basic_functionality(enum arch_timer timer)
506506 {
507− int32_t tval = (int32_t) msec_to_cycles(test_args.wait_ms);
508− uint64_t cval = DEF_CNT + msec_to_cycles(test_args.wait_ms);
507+ s32 tval = (s32)msec_to_cycles(test_args.wait_ms);
508+ u64 cval = DEF_CNT + msec_to_cycles(test_args.wait_ms);
509509 int i;
510510
511511 for (i = 0; i < ARRAY_SIZE(irq_wait_method); i++) {
@@ -593,7 +593,7 @@ static void test_set_cnt_after_tval_max(enum arch_timer timer, irq_wait_method_t · 81 unmodified lines
593593 reset_timer_state(timer, DEF_CNT);
594594
595595 set_cval_irq(timer,
596− (uint64_t) TVAL_MAX +
596+ (u64)TVAL_MAX +
597597 msec_to_cycles(test_args.wait_ms) / 2, CTL_ENABLE);
598598
599599 set_counter(timer, TVAL_MAX);
@@ -608,7 +608,7 @@ static void test_set_cnt_after_tval_max(enum arch_timer timer, irq_wait_method_t · 8 unmodified lines
608608 /* Test timers set for: cval = now + TVAL_MAX + wait_ms / 2 */
609609 static void test_timers_above_tval_max(enum arch_timer timer)
610610 {
611− uint64_t cval;
611+ u64 cval;
612612 int i;
613613
614614 /*
@@ -638,8 +638,8 @@ static void test_timers_above_tval_max(enum arch_timer timer) · 23 unmodified lines
638638 * sets the counter to cnt_1, the [c|t]val, the counter to cnt_2, and
639639 * then waits for an IRQ.
640640 */
641−static void test_set_cnt_after_xval(enum arch_timer timer, uint64_t cnt_1,
642− uint64_t xval, uint64_t cnt_2,
641+static void test_set_cnt_after_xval(enum arch_timer timer, u64 cnt_1,
642+ u64 xval, u64 cnt_2,
643643 irq_wait_method_t wm, enum timer_view tv)
644644 {
645645 local_irq_disable();
@@ -662,8 +662,8 @@ static void test_set_cnt_after_xval(enum arch_timer timer, uint64_t cnt_1, · 16 unmodified lines
662662 * then waits for an IRQ.
663663 */
664664 static void test_set_cnt_after_xval_no_irq(enum arch_timer timer,
665− uint64_t cnt_1, uint64_t xval,
666− uint64_t cnt_2,
665+ u64 cnt_1, u64 xval,
666+ u64 cnt_2,
667667 sleep_method_t guest_sleep,
668668 enum timer_view tv)
669669 {
@@ -684,31 +684,31 @@ static void test_set_cnt_after_xval_no_irq(enum arch_timer timer, · 14 unmodified lines
684684 timer_set_ctl(timer, CTL_IMASK);
685685 }
686686
687−static void test_set_cnt_after_tval(enum arch_timer timer, uint64_t cnt_1,
688− int32_t tval, uint64_t cnt_2,
687+static void test_set_cnt_after_tval(enum arch_timer timer, u64 cnt_1,
688+ s32 tval, u64 cnt_2,
689689 irq_wait_method_t wm)
690690 {
691691 test_set_cnt_after_xval(timer, cnt_1, tval, cnt_2, wm, TIMER_TVAL);
692692 }
693693
694−static void test_set_cnt_after_cval(enum arch_timer timer, uint64_t cnt_1,
695− uint64_t cval, uint64_t cnt_2,
694+static void test_set_cnt_after_cval(enum arch_timer timer, u64 cnt_1,
695+ u64 cval, u64 cnt_2,
696696 irq_wait_method_t wm)
697697 {
698698 test_set_cnt_after_xval(timer, cnt_1, cval, cnt_2, wm, TIMER_CVAL);
699699 }
700700
701701 static void test_set_cnt_after_tval_no_irq(enum arch_timer timer,
702− uint64_t cnt_1, int32_t tval,
703− uint64_t cnt_2, sleep_method_t wm)
702+ u64 cnt_1, s32 tval,
703+ u64 cnt_2, sleep_method_t wm)
704704 {
705705 test_set_cnt_after_xval_no_irq(timer, cnt_1, tval, cnt_2, wm,
706706 TIMER_TVAL);
707707 }
708708
709709 static void test_set_cnt_after_cval_no_irq(enum arch_timer timer,
710− uint64_t cnt_1, uint64_t cval,
711− uint64_t cnt_2, sleep_method_t wm)
710+ u64 cnt_1, u64 cval,
711+ u64 cnt_2, sleep_method_t wm)
712712 {
713713 test_set_cnt_after_xval_no_irq(timer, cnt_1, cval, cnt_2, wm,
714714 TIMER_CVAL);
@@ -718,7 +718,7 @@ static void test_set_cnt_after_cval_no_irq(enum arch_timer timer, · 3 unmodified lines
718718 static void test_move_counters_ahead_of_timers(enum arch_timer timer)
719719 {
720720 int i;
721− int32_t tval;
721+ s32 tval;
722722
723723 for (i = 0; i < ARRAY_SIZE(irq_wait_method); i++) {
724724 irq_wait_method_t wm = irq_wait_method[i];
@@ -730,8 +730,7 @@ static void test_move_counters_ahead_of_timers(enum arch_timer timer) · 5 unmodified lines
730730 test_set_cnt_after_tval(timer, 0, -1, DEF_CNT + 1, wm);
731731 test_set_cnt_after_tval(timer, 0, -1, TVAL_MAX, wm);
732732 tval = TVAL_MAX;
733− test_set_cnt_after_tval(timer, 0, tval, (uint64_t) tval + 1,
734− wm);
733+ test_set_cnt_after_tval(timer, 0, tval, (u64)tval + 1, wm);
735734 }
736735 }
737736
@@ -754,8 +753,8 @@ static void test_move_counters_behind_timers(enum arch_timer timer) · 16 unmodified lines
754753
755754 static void test_timers_in_the_past(enum arch_timer timer)
756755 {
757− int32_t tval = -1 * (int32_t) msec_to_cycles(test_args.wait_ms);
758− uint64_t cval;
756+ s32 tval = -1 * (s32)msec_to_cycles(test_args.wait_ms);
757+ u64 cval;
759758 int i;
760759
761760 for (i = 0; i < ARRAY_SIZE(irq_wait_method); i++) {
@@ -790,8 +789,8 @@ static void test_timers_in_the_past(enum arch_timer timer) · 28 unmodified lines
790789
791790 static void test_long_timer_delays(enum arch_timer timer)
792791 {
793− int32_t tval = (int32_t) msec_to_cycles(test_args.long_wait_ms);
794− uint64_t cval = DEF_CNT + msec_to_cycles(test_args.long_wait_ms);
792+ s32 tval = (s32)msec_to_cycles(test_args.long_wait_ms);
793+ u64 cval = DEF_CNT + msec_to_cycles(test_args.long_wait_ms);
795794 int i;
796795
797796 for (i = 0; i < ARRAY_SIZE(irq_wait_method); i++) {
@@ -846,11 +845,11 @@ static void guest_code(enum arch_timer timer) · 48 unmodified lines
846845
847846 static cpu_set_t default_cpuset;
848847
849−static uint32_t next_pcpu(void)
848+static u32 next_pcpu(void)
850849 {
851− uint32_t max = get_nprocs();
852− uint32_t cur = sched_getcpu();
853− uint32_t next = cur;
850+ u32 max = get_nprocs();
851+ u32 cur = sched_getcpu();
852+ u32 next = cur;
854853 cpu_set_t cpuset = default_cpuset;
855854
856855 TEST_ASSERT(max > 1, "Need at least two physical cpus");
@@ -862,7 +861,7 @@ static uint32_t next_pcpu(void) · 5 unmodified lines
862861 return next;
863862 }
864863
865−static void kvm_set_cntxct(struct kvm_vcpu *vcpu, uint64_t cnt,
864+static void kvm_set_cntxct(struct kvm_vcpu *vcpu, u64 cnt,
866865 enum arch_timer timer)
867866 {
868867 if (timer == PHYSICAL)
@@ -874,7 +873,7 @@ static void kvm_set_cntxct(struct kvm_vcpu *vcpu, uint64_t cnt, · 5 unmodified lines
874873 static void handle_sync(struct kvm_vcpu *vcpu, struct ucall *uc)
875874 {
876875 enum sync_cmd cmd = uc->args[1];
877− uint64_t val = uc->args[2];
876+ u64 val = uc->args[2];
878877 enum arch_timer timer = uc->args[3];
879878
880879 switch (cmd) {
@@ -1018,8 +1017,8 @@ static bool parse_args(int argc, char *argv[]) · 137 unmodified lines
10181017
10191018 static void set_counter_defaults(void)
10201019 {
1021− const uint64_t MIN_ROLLOVER_SECS = 40ULL * 365 * 24 * 3600;
1022− uint64_t freq = read_sysreg(CNTFRQ_EL0);
1020+ const u64 MIN_ROLLOVER_SECS = 40ULL * 365 * 24 * 3600;
1021+ u64 freq = read_sysreg(CNTFRQ_EL0);
10231022 int width = ilog2(MIN_ROLLOVER_SECS * freq);
10241023
10251024 width = clamp(width, 56, 64);
tools/testing/selftests/kvm/arm64/debug-exceptions.c+35−37
@@ -31,14 +31,14 @@ · 30 unmodified lines
3131
3232 extern unsigned char sw_bp, sw_bp2, hw_bp, hw_bp2, bp_svc, bp_brk, hw_wp, ss_start, hw_bp_ctx;
3333 extern unsigned char iter_ss_begin, iter_ss_end;
34−static volatile uint64_t sw_bp_addr, hw_bp_addr;
35−static volatile uint64_t wp_addr, wp_data_addr;
36−static volatile uint64_t svc_addr;
37−static volatile uint64_t ss_addr[4], ss_idx;
38−#define PC(v) ((uint64_t)&(v))
34+static volatile u64 sw_bp_addr, hw_bp_addr;
35+static volatile u64 wp_addr, wp_data_addr;
36+static volatile u64 svc_addr;
37+static volatile u64 ss_addr[4], ss_idx;
38+#define PC(v) ((u64)&(v))
3939
4040 #define GEN_DEBUG_WRITE_REG(reg_name) \
41−static void write_##reg_name(int num, uint64_t val) \
41+static void write_##reg_name(int num, u64 val) \
4242 { \
4343 switch (num) { \
4444 case 0: \
@@ -102,8 +102,8 @@ GEN_DEBUG_WRITE_REG(dbgwvr) · 57 unmodified lines
102102
103103 static void reset_debug_state(void)
104104 {
105− uint8_t brps, wrps, i;
106− uint64_t dfr0;
105+ u8 brps, wrps, i;
106+ u64 dfr0;
107107
108108 asm volatile("msr daifset, #8");
109109
@@ -140,7 +140,7 @@ static void enable_os_lock(void) · 30 unmodified lines
140140
141141 static void enable_monitor_debug_exceptions(void)
142142 {
143− uint64_t mdscr;
143+ u64 mdscr;
144144
145145 asm volatile("msr daifclr, #8");
146146
@@ -149,9 +149,9 @@ static void enable_monitor_debug_exceptions(void) · 2 unmodified lines
149149 isb();
150150 }
151151
152−static void install_wp(uint8_t wpn, uint64_t addr)
152+static void install_wp(u8 wpn, u64 addr)
153153 {
154− uint32_t wcr;
154+ u32 wcr;
155155
156156 wcr = DBGWCR_LEN8 | DBGWCR_RD | DBGWCR_WR | DBGWCR_EL1 | DBGWCR_E;
157157 write_dbgwcr(wpn, wcr);
@@ -162,9 +162,9 @@ static void install_wp(uint8_t wpn, uint64_t addr) · 4 unmodified lines
162162 enable_monitor_debug_exceptions();
163163 }
164164
165−static void install_hw_bp(uint8_t bpn, uint64_t addr)
165+static void install_hw_bp(u8 bpn, u64 addr)
166166 {
167− uint32_t bcr;
167+ u32 bcr;
168168
169169 bcr = DBGBCR_LEN8 | DBGBCR_EXEC | DBGBCR_EL1 | DBGBCR_E;
170170 write_dbgbcr(bpn, bcr);
@@ -174,11 +174,10 @@ static void install_hw_bp(uint8_t bpn, uint64_t addr) · 3 unmodified lines
174174 enable_monitor_debug_exceptions();
175175 }
176176
177−static void install_wp_ctx(uint8_t addr_wp, uint8_t ctx_bp, uint64_t addr,
178− uint64_t ctx)
177+static void install_wp_ctx(u8 addr_wp, u8 ctx_bp, u64 addr, u64 ctx)
179178 {
180− uint32_t wcr;
181− uint64_t ctx_bcr;
179+ u32 wcr;
180+ u64 ctx_bcr;
182181
183182 /* Setup a context-aware breakpoint for Linked Context ID Match */
184183 ctx_bcr = DBGBCR_LEN8 | DBGBCR_EXEC | DBGBCR_EL1 | DBGBCR_E |
@@ -188,7 +187,7 @@ static void install_wp_ctx(uint8_t addr_wp, uint8_t ctx_bp, uint64_t addr, · 3 unmodified lines
188187
189188 /* Setup a linked watchpoint (linked to the context-aware breakpoint) */
190189 wcr = DBGWCR_LEN8 | DBGWCR_RD | DBGWCR_WR | DBGWCR_EL1 | DBGWCR_E |
191− DBGWCR_WT_LINK | ((uint32_t)ctx_bp << DBGWCR_LBN_SHIFT);
190+ DBGWCR_WT_LINK | ((u32)ctx_bp << DBGWCR_LBN_SHIFT);
192191 write_dbgwcr(addr_wp, wcr);
193192 write_dbgwvr(addr_wp, addr);
194193 isb();
@@ -196,10 +195,9 @@ static void install_wp_ctx(uint8_t addr_wp, uint8_t ctx_bp, uint64_t addr, · 1 unmodified line
196195 enable_monitor_debug_exceptions();
197196 }
198197
199−void install_hw_bp_ctx(uint8_t addr_bp, uint8_t ctx_bp, uint64_t addr,
200− uint64_t ctx)
198+void install_hw_bp_ctx(u8 addr_bp, u8 ctx_bp, u64 addr, u64 ctx)
201199 {
202− uint32_t addr_bcr, ctx_bcr;
200+ u32 addr_bcr, ctx_bcr;
203201
204202 /* Setup a context-aware breakpoint for Linked Context ID Match */
205203 ctx_bcr = DBGBCR_LEN8 | DBGBCR_EXEC | DBGBCR_EL1 | DBGBCR_E |
@@ -213,7 +211,7 @@ void install_hw_bp_ctx(uint8_t addr_bp, uint8_t ctx_bp, uint64_t addr, · 7 unmodified lines
213211 */
214212 addr_bcr = DBGBCR_LEN8 | DBGBCR_EXEC | DBGBCR_EL1 | DBGBCR_E |
215213 DBGBCR_BT_ADDR_LINK_CTX |
216− ((uint32_t)ctx_bp << DBGBCR_LBN_SHIFT);
214+ ((u32)ctx_bp << DBGBCR_LBN_SHIFT);
217215 write_dbgbcr(addr_bp, addr_bcr);
218216 write_dbgbvr(addr_bp, addr);
219217 isb();
@@ -223,7 +221,7 @@ void install_hw_bp_ctx(uint8_t addr_bp, uint8_t ctx_bp, uint64_t addr, · 3 unmodified lines
223221
224222 static void install_ss(void)
225223 {
226− uint64_t mdscr;
224+ u64 mdscr;
227225
228226 asm volatile("msr daifclr, #8");
229227
@@ -234,9 +232,9 @@ static void install_ss(void) · 4 unmodified lines
234232
235233 static volatile char write_data;
236234
237−static void guest_code(uint8_t bpn, uint8_t wpn, uint8_t ctx_bpn)
235+static void guest_code(u8 bpn, u8 wpn, u8 ctx_bpn)
238236 {
239− uint64_t ctx = 0xabcdef; /* a random context number */
237+ u64 ctx = 0xabcdef; /* a random context number */
240238
241239 /* Software-breakpoint */
242240 reset_debug_state();
@@ -377,8 +375,8 @@ static void guest_svc_handler(struct ex_regs *regs) · 134 unmodified lines
377375
378376 static void guest_code_ss(int test_cnt)
379377 {
380− uint64_t i;
381− uint64_t bvr, wvr, w_bvr, w_wvr;
378+ u64 i;
379+ u64 bvr, wvr, w_bvr, w_wvr;
382380
383381 for (i = 0; i < test_cnt; i++) {
384382 /* Bits [1:0] of dbg{b,w}vr are RES0 */
@@ -416,12 +414,12 @@ static void guest_code_ss(int test_cnt) · 31 unmodified lines
416414 GUEST_DONE();
417415 }
418416
419−static int debug_version(uint64_t id_aa64dfr0)
417+static int debug_version(u64 id_aa64dfr0)
420418 {
421419 return FIELD_GET(ID_AA64DFR0_EL1_DebugVer, id_aa64dfr0);
422420 }
423421
424−static void test_guest_debug_exceptions(uint8_t bpn, uint8_t wpn, uint8_t ctx_bpn)
422+static void test_guest_debug_exceptions(u8 bpn, u8 wpn, u8 ctx_bpn)
425423 {
426424 struct kvm_vcpu *vcpu;
427425 struct kvm_vm *vm;
@@ -468,8 +466,8 @@ void test_single_step_from_userspace(int test_cnt) · 40 unmodified lines
468466 struct kvm_vm *vm;
469467 struct ucall uc;
470468 struct kvm_run *run;
471− uint64_t pc, cmd;
472− uint64_t test_pc = 0;
469+ u64 pc, cmd;
470+ u64 test_pc = 0;
473471 bool ss_enable = false;
474472 struct kvm_guest_debug debug = {};
475473
@@ -506,7 +504,7 @@ void test_single_step_from_userspace(int test_cnt) · 30 unmodified lines
506504 "Unexpected pc 0x%lx (expected 0x%lx)",
507505 pc, test_pc);
508506
509− if ((pc + 4) == (uint64_t)&iter_ss_end) {
507+ if ((pc + 4) == (u64)&iter_ss_end) {
510508 test_pc = 0;
511509 debug.control = KVM_GUESTDBG_ENABLE;
512510 ss_enable = false;
@@ -519,8 +517,8 @@ void test_single_step_from_userspace(int test_cnt) · 6 unmodified lines
519517 * iter_ss_end, the pc for the next KVM_EXIT_DEBUG should
520518 * be the current pc + 4.
521519 */
522− if ((pc >= (uint64_t)&iter_ss_begin) &&
523− (pc < (uint64_t)&iter_ss_end))
520+ if ((pc >= (u64)&iter_ss_begin) &&
521+ (pc < (u64)&iter_ss_end))
524522 test_pc = pc + 4;
525523 else
526524 test_pc = 0;
@@ -533,9 +531,9 @@ void test_single_step_from_userspace(int test_cnt) · 6 unmodified lines
533531 * Run debug testing using the various breakpoint#, watchpoint# and
534532 * context-aware breakpoint# with the given ID_AA64DFR0_EL1 configuration.
535533 */
536−void test_guest_debug_exceptions_all(uint64_t aa64dfr0)
534+void test_guest_debug_exceptions_all(u64 aa64dfr0)
537535 {
538− uint8_t brp_num, wrp_num, ctx_brp_num, normal_brp_num, ctx_brp_base;
536+ u8 brp_num, wrp_num, ctx_brp_num, normal_brp_num, ctx_brp_base;
539537 int b, w, c;
540538
541539 /* Number of breakpoints */
@@ -580,7 +578,7 @@ int main(int argc, char *argv[]) · 38 unmodified lines
580578 struct kvm_vm *vm;
581579 int opt;
582580 int ss_iteration = 10000;
583− uint64_t aa64dfr0;
581+ u64 aa64dfr0;
584582
585583 vm = vm_create_with_one_vcpu(&vcpu, guest_code);
586584 aa64dfr0 = vcpu_get_reg(vcpu, KVM_ARM64_SYS_REG(SYS_ID_AA64DFR0_EL1));
tools/testing/selftests/kvm/arm64/hypercalls.c+12−12
@@ -29,9 +29,9 @@ · 28 unmodified lines
2929 #define KVM_REG_ARM_VENDOR_HYP_BMAP_2_RESET_VAL 0
3030
3131 struct kvm_fw_reg_info {
32− uint64_t reg; /* Register definition */
33− uint64_t max_feat_bit; /* Bit that represents the upper limit of the feature-map */
34− uint64_t reset_val; /* Reset value for the register */
32+ u64 reg; /* Register definition */
33+ u64 max_feat_bit; /* Bit that represents the upper limit of the feature-map */
34+ u64 reset_val; /* Reset value for the register */
3535 };
3636
3737 #define FW_REG_INFO(r) \
@@ -59,8 +59,8 @@ enum test_stage { · 21 unmodified lines
5959 static int stage = TEST_STAGE_REG_IFACE;
6060
6161 struct test_hvc_info {
62− uint32_t func_id;
63− uint64_t arg1;
62+ u32 func_id;
63+ u64 arg1;
6464 };
6565
6666 #define TEST_HVC_INFO(f, a1) \
@@ -152,9 +152,9 @@ static void guest_code(void) · 85 unmodified lines
152152 }
153153
154154 struct st_time {
155− uint32_t rev;
156− uint32_t attr;
157− uint64_t st_time;
155+ u32 rev;
156+ u32 attr;
157+ u64 st_time;
158158 };
159159
160160 #define STEAL_TIME_SIZE ((sizeof(struct st_time) + 63) & ~63)
@@ -162,7 +162,7 @@ struct st_time { · 1 unmodified line
162162
163163 static void steal_time_init(struct kvm_vcpu *vcpu)
164164 {
165− uint64_t st_ipa = (ulong)ST_GPA_BASE;
165+ u64 st_ipa = (ulong)ST_GPA_BASE;
166166 unsigned int gpages;
167167
168168 gpages = vm_calc_num_guest_pages(VM_MODE_DEFAULT, STEAL_TIME_SIZE);
@@ -174,13 +174,13 @@ static void steal_time_init(struct kvm_vcpu *vcpu) · 5 unmodified lines
174174
175175 static void test_fw_regs_before_vm_start(struct kvm_vcpu *vcpu)
176176 {
177− uint64_t val;
177+ u64 val;
178178 unsigned int i;
179179 int ret;
180180
181181 for (i = 0; i < ARRAY_SIZE(fw_reg_info); i++) {
182182 const struct kvm_fw_reg_info *reg_info = &fw_reg_info[i];
183− uint64_t set_val;
183+ u64 set_val;
184184
185185 /* First 'read' should be the reset value for the reg */
186186 val = vcpu_get_reg(vcpu, reg_info->reg);
@@ -229,7 +229,7 @@ static void test_fw_regs_before_vm_start(struct kvm_vcpu *vcpu) · 42 unmodified lines
229229
230230 static void test_fw_regs_after_vm_start(struct kvm_vcpu *vcpu)
231231 {
232− uint64_t val;
232+ u64 val;
233233 unsigned int i;
234234 int ret;
235235
tools/testing/selftests/kvm/arm64/idreg-idst.c+2−2
@@ -13,7 +13,7 @@ static volatile bool sys64, undef; · 12 unmodified lines
1313
1414 #define __check_sr_read(r) \
1515 ({ \
16− uint64_t val; \
16+ u64 val; \
1717 \
1818 sys64 = false; \
1919 undef = false; \
@@ -101,7 +101,7 @@ int main(int argc, char *argv[]) · 81 unmodified lines
101101 {
102102 struct kvm_vcpu *vcpu;
103103 struct kvm_vm *vm;
104− uint64_t mmfr2;
104+ u64 mmfr2;
105105
106106 test_disable_default_vgic();
107107
tools/testing/selftests/kvm/arm64/no-vgic.c+4−4
@@ -15,7 +15,7 @@ static volatile bool handled; · 14 unmodified lines
1515
1616 #define __check_sr_read(r) \
1717 ({ \
18− uint64_t val; \
18+ u64 val; \
1919 \
2020 handled = false; \
2121 dsb(sy); \
@@ -33,7 +33,7 @@ static volatile bool handled; · 11 unmodified lines
3333
3434 #define __check_gicv5_gicr_op(r) \
3535 ({ \
36− uint64_t val; \
36+ u64 val; \
3737 \
3838 handled = false; \
3939 dsb(sy); \
@@ -82,7 +82,7 @@ static volatile bool handled; · 42 unmodified lines
8282
8383 static void guest_code_gicv3(void)
8484 {
85− uint64_t val;
85+ u64 val;
8686
8787 /*
8888 * Check that we advertise that ID_AA64PFR0_EL1.GIC == 0, having
@@ -262,7 +262,7 @@ int main(int argc, char *argv[]) · 173 unmodified lines
262262 struct kvm_vcpu *vcpu;
263263 struct kvm_vm *vm;
264264 bool has_v3, has_v5;
265− uint64_t pfr;
265+ u64 pfr;
266266
267267 test_disable_default_vgic();
268268
tools/testing/selftests/kvm/arm64/page_fault_test.c+41−41
@@ -23,7 +23,7 @@ · 22 unmodified lines
2323 #define TEST_PTE_GVA 0xb0000000
2424 #define TEST_DATA 0x0123456789ABCDEF
2525
26−static uint64_t *guest_test_memory = (uint64_t *)TEST_GVA;
26+static u64 *guest_test_memory = (u64 *)TEST_GVA;
2727
2828 #define CMD_NONE (0)
2929 #define CMD_SKIP_TEST (1ULL << 1)
@@ -48,7 +48,7 @@ static struct event_cnt { · 18 unmodified lines
4848
4949 struct test_desc {
5050 const char *name;
51− uint64_t mem_mark_cmd;
51+ u64 mem_mark_cmd;
5252 /* Skip the test if any prepare function returns false */
5353 bool (*guest_prepare[PREPARE_FN_NR])(void);
5454 void (*guest_test)(void);
@@ -59,8 +59,8 @@ struct test_desc { · 4 unmodified lines
5959 void (*iabt_handler)(struct ex_regs *regs);
6060 void (*mmio_handler)(struct kvm_vm *vm, struct kvm_run *run);
6161 void (*fail_vcpu_run_handler)(int ret);
62− uint32_t pt_memslot_flags;
63− uint32_t data_memslot_flags;
62+ u32 pt_memslot_flags;
63+ u32 data_memslot_flags;
6464 bool skip;
6565 struct event_cnt expected_events;
6666 };
@@ -70,9 +70,9 @@ struct test_params { · 3 unmodified lines
7070 struct test_desc *test_desc;
7171 };
7272
73−static inline void flush_tlb_page(uint64_t vaddr)
73+static inline void flush_tlb_page(gva_t gva)
7474 {
75− uint64_t page = vaddr >> 12;
75+ gva_t page = gva >> 12;
7676
7777 dsb(ishst);
7878 asm volatile("tlbi vaae1is, %0" :: "r" (page));
@@ -82,7 +82,7 @@ static inline void flush_tlb_page(uint64_t vaddr) · 3 unmodified lines
8282
8383 static void guest_write64(void)
8484 {
85− uint64_t val;
85+ u64 val;
8686
8787 WRITE_ONCE(*guest_test_memory, TEST_DATA);
8888 val = READ_ONCE(*guest_test_memory);
@@ -92,8 +92,8 @@ static void guest_write64(void) · 3 unmodified lines
9292 /* Check the system for atomic instructions. */
9393 static bool guest_check_lse(void)
9494 {
95− uint64_t isar0 = read_sysreg(id_aa64isar0_el1);
96− uint64_t atomic;
95+ u64 isar0 = read_sysreg(id_aa64isar0_el1);
96+ u64 atomic;
9797
9898 atomic = FIELD_GET(ID_AA64ISAR0_EL1_ATOMIC, isar0);
9999 return atomic >= 2;
@@ -101,8 +101,8 @@ static bool guest_check_lse(void) · 1 unmodified line
101101
102102 static bool guest_check_dc_zva(void)
103103 {
104− uint64_t dczid = read_sysreg(dczid_el0);
105− uint64_t dzp = FIELD_GET(DCZID_EL0_DZP, dczid);
104+ u64 dczid = read_sysreg(dczid_el0);
105+ u64 dzp = FIELD_GET(DCZID_EL0_DZP, dczid);
106106
107107 return dzp == 0;
108108 }
@@ -110,7 +110,7 @@ static bool guest_check_dc_zva(void) · 1 unmodified line
110110 /* Compare and swap instruction. */
111111 static void guest_cas(void)
112112 {
113− uint64_t val;
113+ u64 val;
114114
115115 GUEST_ASSERT(guest_check_lse());
116116 asm volatile(".arch_extension lse\n"
@@ -122,7 +122,7 @@ static void guest_cas(void) · 5 unmodified lines
122122
123123 static void guest_read64(void)
124124 {
125− uint64_t val;
125+ u64 val;
126126
127127 val = READ_ONCE(*guest_test_memory);
128128 GUEST_ASSERT_EQ(val, 0);
@@ -131,7 +131,7 @@ static void guest_read64(void) · 2 unmodified lines
131131 /* Address translation instruction */
132132 static void guest_at(void)
133133 {
134− uint64_t par;
134+ u64 par;
135135
136136 asm volatile("at s1e1r, %0" :: "r" (guest_test_memory));
137137 isb();
@@ -148,7 +148,7 @@ static void guest_at(void) · 10 unmodified lines
148148 */
149149 static void guest_dc_zva(void)
150150 {
151− uint16_t val;
151+ u16 val;
152152
153153 asm volatile("dc zva, %0" :: "r" (guest_test_memory));
154154 dsb(ish);
@@ -164,8 +164,8 @@ static void guest_dc_zva(void) · 9 unmodified lines
164164 */
165165 static void guest_ld_preidx(void)
166166 {
167− uint64_t val;
168− uint64_t addr = TEST_GVA - 8;
167+ u64 val;
168+ u64 addr = TEST_GVA - 8;
169169
170170 /*
171171 * This ends up accessing "TEST_GVA + 8 - 8", where "TEST_GVA - 8" is
@@ -179,8 +179,8 @@ static void guest_ld_preidx(void) · 7 unmodified lines
179179
180180 static void guest_st_preidx(void)
181181 {
182− uint64_t val = TEST_DATA;
183− uint64_t addr = TEST_GVA - 8;
182+ u64 val = TEST_DATA;
183+ u64 addr = TEST_GVA - 8;
184184
185185 asm volatile("str %0, [%1, #8]!"
186186 : "+r" (val), "+r" (addr));
@@ -191,8 +191,8 @@ static void guest_st_preidx(void) · 4 unmodified lines
191191
192192 static bool guest_set_ha(void)
193193 {
194− uint64_t mmfr1 = read_sysreg(id_aa64mmfr1_el1);
195− uint64_t hadbs, tcr;
194+ u64 mmfr1 = read_sysreg(id_aa64mmfr1_el1);
195+ u64 hadbs, tcr;
196196
197197 /* Skip if HA is not supported. */
198198 hadbs = FIELD_GET(ID_AA64MMFR1_EL1_HAFDBS, mmfr1);
@@ -208,7 +208,7 @@ static bool guest_set_ha(void) · 9 unmodified lines
208208
209209 static bool guest_clear_pte_af(void)
210210 {
211− *((uint64_t *)TEST_PTE_GVA) &= ~PTE_AF;
211+ *((u64 *)TEST_PTE_GVA) &= ~PTE_AF;
212212 flush_tlb_page(TEST_GVA);
213213
214214 return true;
@@ -217,7 +217,7 @@ static bool guest_clear_pte_af(void) · 2 unmodified lines
217217 static void guest_check_pte_af(void)
218218 {
219219 dsb(ish);
220− GUEST_ASSERT_EQ(*((uint64_t *)TEST_PTE_GVA) & PTE_AF, PTE_AF);
220+ GUEST_ASSERT_EQ(*((u64 *)TEST_PTE_GVA) & PTE_AF, PTE_AF);
221221 }
222222
223223 static void guest_check_write_in_dirty_log(void)
@@ -302,26 +302,26 @@ static void no_iabt_handler(struct ex_regs *regs) · 78 unmodified lines
302302 static struct uffd_args {
303303 char *copy;
304304 void *hva;
305− uint64_t paging_size;
305+ u64 paging_size;
306306 } pt_args, data_args;
307307
308308 /* Returns true to continue the test, and false if it should be skipped. */
309309 static int uffd_generic_handler(int uffd_mode, int uffd, struct uffd_msg *msg,
310310 struct uffd_args *args)
311311 {
312− uint64_t addr = msg->arg.pagefault.address;
313− uint64_t flags = msg->arg.pagefault.flags;
312+ u64 addr = msg->arg.pagefault.address;
313+ u64 flags = msg->arg.pagefault.flags;
314314 struct uffdio_copy copy;
315315 int ret;
316316
317317 TEST_ASSERT(uffd_mode == UFFDIO_REGISTER_MODE_MISSING,
318318 "The only expected UFFD mode is MISSING");
319− TEST_ASSERT_EQ(addr, (uint64_t)args->hva);
319+ TEST_ASSERT_EQ(addr, (u64)args->hva);
320320
321321 pr_debug("uffd fault: addr=%p write=%d\n",
322322 (void *)addr, !!(flags & UFFD_PAGEFAULT_FLAG_WRITE));
323323
324− copy.src = (uint64_t)args->copy;
324+ copy.src = (u64)args->copy;
325325 copy.dst = addr;
326326 copy.len = args->paging_size;
327327 copy.mode = 0;
@@ -407,7 +407,7 @@ static bool punch_hole_in_backing_store(struct kvm_vm *vm, · 79 unmodified lines
407407 struct userspace_mem_region *region)
408408 {
409409 void *hva = (void *)region->region.userspace_addr;
410− uint64_t paging_size = region->region.memory_size;
410+ u64 paging_size = region->region.memory_size;
411411 int ret, fd = region->fd;
412412
413413 if (fd != -1) {
@@ -438,7 +438,7 @@ static void mmio_on_test_gpa_handler(struct kvm_vm *vm, struct kvm_run *run) · 24 unmodified lines
438438
439439 static void mmio_no_handler(struct kvm_vm *vm, struct kvm_run *run)
440440 {
441− uint64_t data;
441+ u64 data;
442442
443443 memcpy(&data, run->mmio.data, sizeof(data));
444444 pr_debug("addr=%lld len=%d w=%d data=%lx\n",
@@ -449,11 +449,11 @@ static void mmio_no_handler(struct kvm_vm *vm, struct kvm_run *run) · 4 unmodified lines
449449
450450 static bool check_write_in_dirty_log(struct kvm_vm *vm,
451451 struct userspace_mem_region *region,
452− uint64_t host_pg_nr)
452+ u64 host_pg_nr)
453453 {
454454 unsigned long *bmap;
455455 bool first_page_dirty;
456− uint64_t size = region->region.memory_size;
456+ u64 size = region->region.memory_size;
457457
458458 /* getpage_size() is not always equal to vm->page_size */
459459 bmap = bitmap_zalloc(size / getpagesize());
@@ -468,7 +468,7 @@ static bool handle_cmd(struct kvm_vm *vm, int cmd) · 8 unmodified lines
468468 {
469469 struct userspace_mem_region *data_region, *pt_region;
470470 bool continue_test = true;
471− uint64_t pte_gpa, pte_pg;
471+ u64 pte_gpa, pte_pg;
472472
473473 data_region = vm_get_mem_region(vm, MEM_REGION_TEST_DATA);
474474 pt_region = vm_get_mem_region(vm, MEM_REGION_PT);
@@ -510,7 +510,7 @@ void fail_vcpu_run_mmio_no_syndrome_handler(int ret) · 35 unmodified lines
510510 events.fail_vcpu_runs += 1;
511511 }
512512
513−typedef uint32_t aarch64_insn_t;
513+typedef u32 aarch64_insn_t;
514514 extern aarch64_insn_t __exec_test[2];
515515
516516 noinline void __return_0x77(void)
@@ -525,7 +525,7 @@ noinline void __return_0x77(void) · 8 unmodified lines
525525 */
526526 static void load_exec_code_for_test(struct kvm_vm *vm)
527527 {
528− uint64_t *code;
528+ u64 *code;
529529 struct userspace_mem_region *region;
530530 void *hva;
531531
@@ -552,7 +552,7 @@ static void setup_abort_handlers(struct kvm_vm *vm, struct kvm_vcpu *vcpu, · 20 unmodified lines
552552 static void setup_gva_maps(struct kvm_vm *vm)
553553 {
554554 struct userspace_mem_region *region;
555− uint64_t pte_gpa;
555+ u64 pte_gpa;
556556
557557 region = vm_get_mem_region(vm, MEM_REGION_TEST_DATA);
558558 /* Map TEST_GVA first. This will install a new PTE. */
@@ -574,12 +574,12 @@ enum pf_test_memslots { · 15 unmodified lines
574574 */
575575 static void setup_memslots(struct kvm_vm *vm, struct test_params *p)
576576 {
577− uint64_t backing_src_pagesz = get_backing_src_pagesz(p->src_type);
578− uint64_t guest_page_size = vm->page_size;
579− uint64_t max_gfn = vm_compute_max_gfn(vm);
577+ u64 backing_src_pagesz = get_backing_src_pagesz(p->src_type);
578+ u64 guest_page_size = vm->page_size;
579+ u64 max_gfn = vm_compute_max_gfn(vm);
580580 /* Enough for 2M of code when using 4K guest pages. */
581− uint64_t code_npages = 512;
582− uint64_t pt_size, data_size, data_gpa;
581+ u64 code_npages = 512;
582+ u64 pt_size, data_size, data_gpa;
583583
584584 /*
585585 * This test requires 1 pgd, 2 pud, 4 pmd, and 6 pte pages when using
tools/testing/selftests/kvm/arm64/psci_test.c+12−14
@@ -22,8 +22,7 @@ · 21 unmodified lines
2222 #define CPU_ON_ENTRY_ADDR 0xfeedf00dul
2323 #define CPU_ON_CONTEXT_ID 0xdeadc0deul
2424
25−static uint64_t psci_cpu_on(uint64_t target_cpu, uint64_t entry_addr,
26− uint64_t context_id)
25+static u64 psci_cpu_on(u64 target_cpu, u64 entry_addr, u64 context_id)
2726 {
2827 struct arm_smccc_res res;
2928
@@ -33,8 +32,7 @@ static uint64_t psci_cpu_on(uint64_t target_cpu, uint64_t entry_addr, · 3 unmodified lines
3332 return res.a0;
3433 }
3534
36−static uint64_t psci_affinity_info(uint64_t target_affinity,
37− uint64_t lowest_affinity_level)
35+static u64 psci_affinity_info(u64 target_affinity, u64 lowest_affinity_level)
3836 {
3937 struct arm_smccc_res res;
4038
@@ -44,7 +42,7 @@ static uint64_t psci_affinity_info(uint64_t target_affinity, · 3 unmodified lines
4442 return res.a0;
4543 }
4644
47−static uint64_t psci_system_suspend(uint64_t entry_addr, uint64_t context_id)
45+static u64 psci_system_suspend(u64 entry_addr, u64 context_id)
4846 {
4947 struct arm_smccc_res res;
5048
@@ -54,7 +52,7 @@ static uint64_t psci_system_suspend(uint64_t entry_addr, uint64_t context_id) · 3 unmodified lines
5452 return res.a0;
5553 }
5654
57−static uint64_t psci_system_off2(uint64_t type, uint64_t cookie)
55+static u64 psci_system_off2(u64 type, u64 cookie)
5856 {
5957 struct arm_smccc_res res;
6058
@@ -63,7 +61,7 @@ static uint64_t psci_system_off2(uint64_t type, uint64_t cookie) · 2 unmodified lines
6361 return res.a0;
6462 }
6563
66−static uint64_t psci_features(uint32_t func_id)
64+static u64 psci_features(u32 func_id)
6765 {
6866 struct arm_smccc_res res;
6967
@@ -110,7 +108,7 @@ static void enter_guest(struct kvm_vcpu *vcpu) · 40 unmodified lines
110108
111109 static void assert_vcpu_reset(struct kvm_vcpu *vcpu)
112110 {
113− uint64_t obs_pc, obs_x0;
111+ u64 obs_pc, obs_x0;
114112
115113 obs_pc = vcpu_get_reg(vcpu, ARM64_CORE_REG(regs.pc));
116114 obs_x0 = vcpu_get_reg(vcpu, ARM64_CORE_REG(regs.regs[0]));
@@ -123,9 +121,9 @@ static void assert_vcpu_reset(struct kvm_vcpu *vcpu) · 6 unmodified lines
123121 obs_x0, CPU_ON_CONTEXT_ID);
124122 }
125123
126−static void guest_test_cpu_on(uint64_t target_cpu)
124+static void guest_test_cpu_on(u64 target_cpu)
127125 {
128− uint64_t target_state;
126+ u64 target_state;
129127
130128 GUEST_ASSERT(!psci_cpu_on(target_cpu, CPU_ON_ENTRY_ADDR, CPU_ON_CONTEXT_ID));
131129
@@ -142,7 +140,7 @@ static void guest_test_cpu_on(uint64_t target_cpu) · 10 unmodified lines
142140 static void host_test_cpu_on(void)
143141 {
144142 struct kvm_vcpu *source, *target;
145− uint64_t target_mpidr;
143+ u64 target_mpidr;
146144 struct kvm_vm *vm;
147145 struct ucall uc;
148146
@@ -166,7 +164,7 @@ static void host_test_cpu_on(void) · 17 unmodified lines
166164
167165 static void guest_test_system_suspend(void)
168166 {
169− uint64_t ret;
167+ u64 ret;
170168
171169 /* assert that SYSTEM_SUSPEND is discoverable */
172170 GUEST_ASSERT(!psci_features(PSCI_1_0_FN_SYSTEM_SUSPEND));
@@ -200,7 +198,7 @@ static void host_test_system_suspend(void) · 27 unmodified lines
200198
201199 static void guest_test_system_off2(void)
202200 {
203− uint64_t ret;
201+ u64 ret;
204202
205203 /* assert that SYSTEM_OFF2 is discoverable */
206204 GUEST_ASSERT(psci_features(PSCI_1_3_FN_SYSTEM_OFF2) &
@@ -238,7 +236,7 @@ static void host_test_system_off2(void) · 31 unmodified lines
238236 {
239237 struct kvm_vcpu *source, *target;
240238 struct kvm_mp_state mps;
241− uint64_t psci_version = 0;
239+ u64 psci_version = 0;
242240 int nr_shutdowns = 0;
243241 struct kvm_run *run;
244242 struct ucall uc;
tools/testing/selftests/kvm/arm64/sea_to_user.c+19−22
@@ -51,18 +51,16 @@ · 50 unmodified lines
5151 #define EINJ_OFFSET 0x01234badUL
5252 #define EINJ_GVA ((START_GVA) + (EINJ_OFFSET))
5353
54−static vm_paddr_t einj_gpa;
54+static gpa_t einj_gpa;
5555 static void *einj_hva;
56−static uint64_t einj_hpa;
56+static u64 einj_hpa;
5757 static bool far_invalid;
5858
59−static uint64_t translate_to_host_paddr(unsigned long vaddr)
59+static u64 translate_hva_to_hpa(unsigned long hva)
6060 {
61− uint64_t pinfo;
62− int64_t offset = vaddr / getpagesize() * sizeof(pinfo);
61+ u64 pinfo;
62+ s64 offset = hva / getpagesize() * sizeof(pinfo);
6363 int fd;
64− uint64_t page_addr;
65− uint64_t paddr;
6664
6765 fd = open("/proc/self/pagemap", O_RDONLY);
6866 if (fd < 0)
@@ -77,12 +75,11 @@ static uint64_t translate_to_host_paddr(unsigned long vaddr) · 8 unmodified lines
7775 if ((pinfo & PAGE_PRESENT) == 0)
7876 ksft_exit_fail_perror("Page not present");
7977
80− page_addr = (pinfo & PAGE_PHYSICAL) << MIN_PAGE_SHIFT;
81− paddr = page_addr + (vaddr & (getpagesize() - 1));
82− return paddr;
78+ return ((pinfo & PAGE_PHYSICAL) << MIN_PAGE_SHIFT) +
79+ (hva & (getpagesize() - 1));
8380 }
8481
85−static void write_einj_entry(const char *einj_path, uint64_t val)
82+static void write_einj_entry(const char *einj_path, u64 val)
8683 {
8784 char cmd[256] = {0};
8885 FILE *cmdfile = NULL;
@@ -96,7 +93,7 @@ static void write_einj_entry(const char *einj_path, uint64_t val) · 7 unmodified lines
9693 ksft_exit_fail_perror("Failed to write EINJ entry");
9794 }
9895
99−static void inject_uer(uint64_t paddr)
96+static void inject_uer(u64 hpa)
10097 {
10198 if (access("/sys/firmware/acpi/tables/EINJ", R_OK) == -1)
10299 ksft_test_result_skip("EINJ table no available in firmware");
@@ -106,7 +103,7 @@ static void inject_uer(uint64_t paddr) · 3 unmodified lines
106103
107104 write_einj_entry(EINJ_ETYPE, ERROR_TYPE_MEMORY_UER);
108105 write_einj_entry(EINJ_FLAGS, MASK_MEMORY_UER);
109− write_einj_entry(EINJ_ADDR, paddr);
106+ write_einj_entry(EINJ_ADDR, hpa);
110107 write_einj_entry(EINJ_MASK, ~0x0UL);
111108 write_einj_entry(EINJ_NOTRIGGER, 1);
112109 write_einj_entry(EINJ_DOIT, 1);
@@ -145,10 +142,10 @@ static void setup_sigbus_handler(void) · 32 unmodified lines
145142
146143 static void guest_code(void)
147144 {
148− uint64_t guest_data;
145+ u64 guest_data;
149146
150147 /* Consumes error will cause a SEA. */
151− guest_data = *(uint64_t *)EINJ_GVA;
148+ guest_data = *(u64 *)EINJ_GVA;
152149
153150 GUEST_FAIL("Poison not protected by SEA: gva=%#lx, guest_data=%#lx\n",
154151 EINJ_GVA, guest_data);
@@ -253,8 +250,8 @@ static struct kvm_vm *vm_create_with_sea_handler(struct kvm_vcpu **vcpu) · 98 unmodified lines
253250 size_t backing_page_size;
254251 size_t guest_page_size;
255252 size_t alignment;
256− uint64_t num_guest_pages;
257− vm_paddr_t start_gpa;
253+ u64 num_guest_pages;
254+ gpa_t start_gpa;
258255 enum vm_mem_backing_src_type src_type = VM_MEM_SRC_ANONYMOUS_HUGETLB_1GB;
259256 struct kvm_vm *vm;
260257
@@ -278,7 +275,7 @@ static struct kvm_vm *vm_create_with_sea_handler(struct kvm_vcpu **vcpu) · 17 unmodified lines
278275 vm_userspace_mem_region_add(
279276 /*vm=*/vm,
280277 /*src_type=*/src_type,
281− /*guest_paddr=*/start_gpa,
278+ /*gpa=*/start_gpa,
282279 /*slot=*/1,
283280 /*npages=*/num_guest_pages,
284281 /*flags=*/0);
@@ -292,18 +289,18 @@ static struct kvm_vm *vm_create_with_sea_handler(struct kvm_vcpu **vcpu) · 7 unmodified lines
292289
293290 static void vm_inject_memory_uer(struct kvm_vm *vm)
294291 {
295− uint64_t guest_data;
292+ u64 guest_data;
296293
297294 einj_gpa = addr_gva2gpa(vm, EINJ_GVA);
298295 einj_hva = addr_gva2hva(vm, EINJ_GVA);
299296
300297 /* Populate certain data before injecting UER. */
301− *(uint64_t *)einj_hva = 0xBAADCAFE;
302− guest_data = *(uint64_t *)einj_hva;
298+ *(u64 *)einj_hva = 0xBAADCAFE;
299+ guest_data = *(u64 *)einj_hva;
303300 ksft_print_msg("Before EINJect: data=%#lx\n",
304301 guest_data);
305302
306− einj_hpa = translate_to_host_paddr((unsigned long)einj_hva);
303+ einj_hpa = translate_hva_to_hpa((unsigned long)einj_hva);
307304
308305 ksft_print_msg("EINJ_GVA=%#lx, einj_gpa=%#lx, einj_hva=%p, einj_hpa=%#lx\n",
309306 EINJ_GVA, einj_gpa, einj_hva, einj_hpa);
tools/testing/selftests/kvm/arm64/set_id_regs.c+35−35
@@ -30,20 +30,20 @@ struct reg_ftr_bits { · 29 unmodified lines
3030 char *name;
3131 bool sign;
3232 enum ftr_type type;
33− uint8_t shift;
34− uint64_t mask;
33+ u8 shift;
34+ u64 mask;
3535 /*
3636 * For FTR_EXACT, safe_val is used as the exact safe value.
3737 * For FTR_LOWER_SAFE, safe_val is used as the minimal safe value.
3838 */
39− int64_t safe_val;
39+ s64 safe_val;
4040
4141 /* Allowed to be changed by the host after run */
4242 bool mutable;
4343 };
4444
4545 struct test_feature_reg {
46− uint32_t reg;
46+ u32 reg;
4747 const struct reg_ftr_bits *ftr_bits;
4848 };
4949
@@ -275,9 +275,9 @@ static void guest_code(void) · 225 unmodified lines
275275 }
276276
277277 /* Return a safe value to a given ftr_bits an ftr value */
278−uint64_t get_safe_value(const struct reg_ftr_bits *ftr_bits, uint64_t ftr)
278+u64 get_safe_value(const struct reg_ftr_bits *ftr_bits, u64 ftr)
279279 {
280− uint64_t ftr_max = ftr_bits->mask >> ftr_bits->shift;
280+ u64 ftr_max = ftr_bits->mask >> ftr_bits->shift;
281281
282282 TEST_ASSERT(ftr_max > 1, "This test doesn't support single bit features");
283283
@@ -329,16 +329,16 @@ uint64_t get_safe_value(const struct reg_ftr_bits *ftr_bits, uint64_t ftr) · 45 unmodified lines
329329 }
330330
331331 /* Return an invalid value to a given ftr_bits an ftr value */
332−uint64_t get_invalid_value(const struct reg_ftr_bits *ftr_bits, uint64_t ftr)
332+u64 get_invalid_value(const struct reg_ftr_bits *ftr_bits, u64 ftr)
333333 {
334− uint64_t ftr_max = ftr_bits->mask >> ftr_bits->shift;
334+ u64 ftr_max = ftr_bits->mask >> ftr_bits->shift;
335335
336336 TEST_ASSERT(ftr_max > 1, "This test doesn't support single bit features");
337337
338338 if (ftr_bits->sign == FTR_UNSIGNED) {
339339 switch (ftr_bits->type) {
340340 case FTR_EXACT:
341− ftr = max((uint64_t)ftr_bits->safe_val + 1, ftr + 1);
341+ ftr = max((u64)ftr_bits->safe_val + 1, ftr + 1);
342342 break;
343343 case FTR_LOWER_SAFE:
344344 ftr++;
@@ -358,7 +358,7 @@ uint64_t get_invalid_value(const struct reg_ftr_bits *ftr_bits, uint64_t ftr) · 13 unmodified lines
358358 } else if (ftr != ftr_max) {
359359 switch (ftr_bits->type) {
360360 case FTR_EXACT:
361− ftr = max((uint64_t)ftr_bits->safe_val + 1, ftr + 1);
361+ ftr = max((u64)ftr_bits->safe_val + 1, ftr + 1);
362362 break;
363363 case FTR_LOWER_SAFE:
364364 ftr++;
@@ -382,12 +382,12 @@ uint64_t get_invalid_value(const struct reg_ftr_bits *ftr_bits, uint64_t ftr) · 17 unmodified lines
382382 return ftr;
383383 }
384384
385−static uint64_t test_reg_set_success(struct kvm_vcpu *vcpu, uint64_t reg,
386− const struct reg_ftr_bits *ftr_bits)
385+static u64 test_reg_set_success(struct kvm_vcpu *vcpu, u64 reg,
386+ const struct reg_ftr_bits *ftr_bits)
387387 {
388− uint8_t shift = ftr_bits->shift;
389− uint64_t mask = ftr_bits->mask;
390− uint64_t val, new_val, ftr;
388+ u8 shift = ftr_bits->shift;
389+ u64 mask = ftr_bits->mask;
390+ u64 val, new_val, ftr;
391391
392392 val = vcpu_get_reg(vcpu, reg);
393393 ftr = (val & mask) >> shift;
@@ -405,12 +405,12 @@ static uint64_t test_reg_set_success(struct kvm_vcpu *vcpu, uint64_t reg, · 11 unmodified lines
405405 return new_val;
406406 }
407407
408−static void test_reg_set_fail(struct kvm_vcpu *vcpu, uint64_t reg,
408+static void test_reg_set_fail(struct kvm_vcpu *vcpu, u64 reg,
409409 const struct reg_ftr_bits *ftr_bits)
410410 {
411− uint8_t shift = ftr_bits->shift;
412− uint64_t mask = ftr_bits->mask;
413− uint64_t val, old_val, ftr;
411+ u8 shift = ftr_bits->shift;
412+ u64 mask = ftr_bits->mask;
413+ u64 val, old_val, ftr;
414414 int r;
415415
416416 val = vcpu_get_reg(vcpu, reg);
@@ -431,7 +431,7 @@ static void test_reg_set_fail(struct kvm_vcpu *vcpu, uint64_t reg, · 14 unmodified lines
431431 TEST_ASSERT_EQ(val, old_val);
432432 }
433433
434−static uint64_t test_reg_vals[KVM_ARM_FEATURE_ID_RANGE_SIZE];
434+static u64 test_reg_vals[KVM_ARM_FEATURE_ID_RANGE_SIZE];
435435
436436 #define encoding_to_range_idx(encoding) \
437437 KVM_ARM_FEATURE_ID_RANGE_IDX(sys_reg_Op0(encoding), sys_reg_Op1(encoding), \
@@ -441,7 +441,7 @@ static uint64_t test_reg_vals[KVM_ARM_FEATURE_ID_RANGE_SIZE]; · 3 unmodified lines
441441
442442 static void test_vm_ftr_id_regs(struct kvm_vcpu *vcpu, bool aarch64_only)
443443 {
444− uint64_t masks[KVM_ARM_FEATURE_ID_RANGE_SIZE];
444+ u64 masks[KVM_ARM_FEATURE_ID_RANGE_SIZE];
445445 struct reg_mask_range range = {
446446 .addr = (__u64)masks,
447447 };
@@ -458,8 +458,8 @@ static void test_vm_ftr_id_regs(struct kvm_vcpu *vcpu, bool aarch64_only) · 10 unmodified lines
458458
459459 for (int i = 0; i < ARRAY_SIZE(test_regs); i++) {
460460 const struct reg_ftr_bits *ftr_bits = test_regs[i].ftr_bits;
461− uint32_t reg_id = test_regs[i].reg;
462− uint64_t reg = KVM_ARM64_SYS_REG(reg_id);
461+ u32 reg_id = test_regs[i].reg;
462+ u64 reg = KVM_ARM64_SYS_REG(reg_id);
463463 int idx;
464464
465465 /* Get the index to masks array for the idreg */
@@ -489,11 +489,11 @@ static void test_vm_ftr_id_regs(struct kvm_vcpu *vcpu, bool aarch64_only) · 23 unmodified lines
489489 #define MPAM_IDREG_TEST 6
490490 static void test_user_set_mpam_reg(struct kvm_vcpu *vcpu)
491491 {
492− uint64_t masks[KVM_ARM_FEATURE_ID_RANGE_SIZE];
492+ u64 masks[KVM_ARM_FEATURE_ID_RANGE_SIZE];
493493 struct reg_mask_range range = {
494494 .addr = (__u64)masks,
495495 };
496− uint64_t val;
496+ u64 val;
497497 int idx, err;
498498
499499 /*
@@ -584,13 +584,13 @@ static void test_user_set_mpam_reg(struct kvm_vcpu *vcpu) · 84 unmodified lines
584584 #define MTE_IDREG_TEST 1
585585 static void test_user_set_mte_reg(struct kvm_vcpu *vcpu)
586586 {
587− uint64_t masks[KVM_ARM_FEATURE_ID_RANGE_SIZE];
587+ u64 masks[KVM_ARM_FEATURE_ID_RANGE_SIZE];
588588 struct reg_mask_range range = {
589589 .addr = (__u64)masks,
590590 };
591− uint64_t val;
592− uint64_t mte;
593− uint64_t mte_frac;
591+ u64 val;
592+ u64 mte;
593+ u64 mte_frac;
594594 int idx, err;
595595
596596 val = vcpu_get_reg(vcpu, KVM_ARM64_SYS_REG(SYS_ID_AA64PFR1_EL1));
@@ -644,7 +644,7 @@ static void test_user_set_mte_reg(struct kvm_vcpu *vcpu) · 47 unmodified lines
644644 ksft_test_result_pass("ID_AA64PFR1_EL1.MTE_frac no longer 0xF\n");
645645 }
646646
647−static uint64_t reset_mutable_bits(uint32_t id, uint64_t val)
647+static u64 reset_mutable_bits(u32 id, u64 val)
648648 {
649649 struct test_feature_reg *reg = NULL;
650650
@@ -674,7 +674,7 @@ static void test_guest_reg_read(struct kvm_vcpu *vcpu) · 23 unmodified lines
674674 struct ucall uc;
675675
676676 while (!done) {
677− uint64_t val;
677+ u64 val;
678678
679679 vcpu_run(vcpu);
680680
@@ -707,7 +707,7 @@ static void test_guest_reg_read(struct kvm_vcpu *vcpu) · 26 unmodified lines
707707
708708 static void test_clidr(struct kvm_vcpu *vcpu)
709709 {
710− uint64_t clidr;
710+ u64 clidr;
711711 int level;
712712
713713 clidr = vcpu_get_reg(vcpu, KVM_ARM64_SYS_REG(SYS_CLIDR_EL1));
@@ -772,10 +772,10 @@ static void test_vcpu_non_ftr_id_regs(struct kvm_vcpu *vcpu) · 58 unmodified lines
772772 ksft_test_result_pass("%s\n", __func__);
773773 }
774774
775−static void test_assert_id_reg_unchanged(struct kvm_vcpu *vcpu, uint32_t encoding)
775+static void test_assert_id_reg_unchanged(struct kvm_vcpu *vcpu, u32 encoding)
776776 {
777777 size_t idx = encoding_to_range_idx(encoding);
778− uint64_t observed;
778+ u64 observed;
779779
780780 observed = vcpu_get_reg(vcpu, KVM_ARM64_SYS_REG(encoding));
781781 TEST_ASSERT_EQ(reset_mutable_bits(encoding, test_reg_vals[idx]),
@@ -808,7 +808,7 @@ int main(void) · 26 unmodified lines
808808 struct kvm_vcpu *vcpu;
809809 struct kvm_vm *vm;
810810 bool aarch64_only;
811− uint64_t val, el0;
811+ u64 val, el0;
812812 int test_cnt, i, j;
813813
814814 TEST_REQUIRE(kvm_has_cap(KVM_CAP_ARM_SUPPORTED_REG_MASK_RANGES));
tools/testing/selftests/kvm/arm64/smccc_filter.c+5−5
@@ -37,7 +37,7 @@ static bool test_runs_at_el2(void) · 36 unmodified lines
3737 for (conduit = test_runs_at_el2() ? SMC_INSN : HVC_INSN; \
3838 conduit <= SMC_INSN; conduit++)
3939
40−static void guest_main(uint32_t func_id, enum smccc_conduit conduit)
40+static void guest_main(u32 func_id, enum smccc_conduit conduit)
4141 {
4242 struct arm_smccc_res res;
4343
@@ -49,7 +49,7 @@ static void guest_main(uint32_t func_id, enum smccc_conduit conduit) · 5 unmodified lines
4949 GUEST_SYNC(res.a0);
5050 }
5151
52−static int __set_smccc_filter(struct kvm_vm *vm, uint32_t start, uint32_t nr_functions,
52+static int __set_smccc_filter(struct kvm_vm *vm, u32 start, u32 nr_functions,
5353 enum kvm_smccc_filter_action action)
5454 {
5555 struct kvm_smccc_filter filter = {
@@ -62,7 +62,7 @@ static int __set_smccc_filter(struct kvm_vm *vm, uint32_t start, uint32_t nr_fun · 6 unmodified lines
6262 KVM_ARM_VM_SMCCC_FILTER, &filter);
6363 }
6464
65−static void set_smccc_filter(struct kvm_vm *vm, uint32_t start, uint32_t nr_functions,
65+static void set_smccc_filter(struct kvm_vm *vm, u32 start, u32 nr_functions,
6666 enum kvm_smccc_filter_action action)
6767 {
6868 int ret = __set_smccc_filter(vm, start, nr_functions, action);
@@ -112,7 +112,7 @@ static void test_filter_reserved_range(void) · 43 unmodified lines
112112 {
113113 struct kvm_vcpu *vcpu;
114114 struct kvm_vm *vm = setup_vm(&vcpu);
115− uint32_t smc64_fn;
115+ u32 smc64_fn;
116116 int r;
117117
118118 r = __set_smccc_filter(vm, ARM_SMCCC_ARCH_WORKAROUND_1,
@@ -217,7 +217,7 @@ static void test_filter_denied(void) · 98 unmodified lines
217217 }
218218 }
219219
220−static void expect_call_fwd_to_user(struct kvm_vcpu *vcpu, uint32_t func_id,
220+static void expect_call_fwd_to_user(struct kvm_vcpu *vcpu, u32 func_id,
221221 enum smccc_conduit conduit)
222222 {
223223 struct kvm_run *run = vcpu->run;
tools/testing/selftests/kvm/arm64/vgic_init.c+28−28
@@ -19,7 +19,7 @@ · 18 unmodified lines
1919
2020 #define NR_VCPUS 4
2121
22−#define REG_OFFSET(vcpu, offset) (((uint64_t)vcpu << 32) | offset)
22+#define REG_OFFSET(vcpu, offset) (((u64)vcpu << 32) | offset)
2323
2424 #define VGIC_DEV_IS_V2(_d) ((_d) == KVM_DEV_TYPE_ARM_VGIC_V2)
2525 #define VGIC_DEV_IS_V3(_d) ((_d) == KVM_DEV_TYPE_ARM_VGIC_V3)
@@ -27,10 +27,10 @@ · 1 unmodified line
2727 struct vm_gic {
2828 struct kvm_vm *vm;
2929 int gic_fd;
30− uint32_t gic_dev_type;
30+ u32 gic_dev_type;
3131 };
3232
33−static uint64_t max_phys_size;
33+static u64 max_phys_size;
3434
3535 /*
3636 * Helpers to access a redistributor register and verify the ioctl() failed or
@@ -39,17 +39,17 @@ static uint64_t max_phys_size; · 2 unmodified lines
3939 static void v3_redist_reg_get_errno(int gicv3_fd, int vcpu, int offset,
4040 int want, const char *msg)
4141 {
42− uint32_t ignored_val;
42+ u32 ignored_val;
4343 int ret = __kvm_device_attr_get(gicv3_fd, KVM_DEV_ARM_VGIC_GRP_REDIST_REGS,
4444 REG_OFFSET(vcpu, offset), &ignored_val);
4545
4646 TEST_ASSERT(ret && errno == want, "%s; want errno = %d", msg, want);
4747 }
4848
49−static void v3_redist_reg_get(int gicv3_fd, int vcpu, int offset, uint32_t want,
49+static void v3_redist_reg_get(int gicv3_fd, int vcpu, int offset, u32 want,
5050 const char *msg)
5151 {
52− uint32_t val;
52+ u32 val;
5353
5454 kvm_device_attr_get(gicv3_fd, KVM_DEV_ARM_VGIC_GRP_REDIST_REGS,
5555 REG_OFFSET(vcpu, offset), &val);
@@ -71,8 +71,8 @@ static int run_vcpu(struct kvm_vcpu *vcpu) · 15 unmodified lines
7171 return __vcpu_run(vcpu) ? -errno : 0;
7272 }
7373
74−static struct vm_gic vm_gic_create_with_vcpus(uint32_t gic_dev_type,
75− uint32_t nr_vcpus,
74+static struct vm_gic vm_gic_create_with_vcpus(u32 gic_dev_type,
75+ u32 nr_vcpus,
7676 struct kvm_vcpu *vcpus[])
7777 {
7878 struct vm_gic v;
@@ -84,7 +84,7 @@ static struct vm_gic vm_gic_create_with_vcpus(uint32_t gic_dev_type, · 5 unmodified lines
8484 return v;
8585 }
8686
87−static struct vm_gic vm_gic_create_barebones(uint32_t gic_dev_type)
87+static struct vm_gic vm_gic_create_barebones(u32 gic_dev_type)
8888 {
8989 struct vm_gic v;
9090
@@ -103,9 +103,9 @@ static void vm_gic_destroy(struct vm_gic *v) · 12 unmodified lines
103103 }
104104
105105 struct vgic_region_attr {
106− uint64_t attr;
107− uint64_t size;
108− uint64_t alignment;
106+ u64 attr;
107+ u64 size;
108+ u64 alignment;
109109 };
110110
111111 struct vgic_region_attr gic_v3_dist_region = {
@@ -143,7 +143,7 @@ struct vgic_region_attr gic_v2_cpu_region = { · 31 unmodified lines
143143 static void subtest_dist_rdist(struct vm_gic *v)
144144 {
145145 int ret;
146− uint64_t addr;
146+ u64 addr;
147147 struct vgic_region_attr rdist; /* CPU interface in GICv2*/
148148 struct vgic_region_attr dist;
149149
@@ -223,7 +223,7 @@ static void subtest_dist_rdist(struct vm_gic *v) · 73 unmodified lines
223223 /* Test the new REDIST region API */
224224 static void subtest_v3_redist_regions(struct vm_gic *v)
225225 {
226− uint64_t addr, expected_addr;
226+ u64 addr, expected_addr;
227227 int ret;
228228
229229 ret = __kvm_has_device_attr(v->gic_fd, KVM_DEV_ARM_VGIC_GRP_ADDR,
@@ -332,7 +332,7 @@ static void subtest_v3_redist_regions(struct vm_gic *v) · 102 unmodified lines
332332 * VGIC KVM device is created and initialized before the secondary CPUs
333333 * get created
334334 */
335−static void test_vgic_then_vcpus(uint32_t gic_dev_type)
335+static void test_vgic_then_vcpus(u32 gic_dev_type)
336336 {
337337 struct kvm_vcpu *vcpus[NR_VCPUS];
338338 struct vm_gic v;
@@ -353,7 +353,7 @@ static void test_vgic_then_vcpus(uint32_t gic_dev_type) · 14 unmodified lines
353353 }
354354
355355 /* All the VCPUs are created before the VGIC KVM device gets initialized */
356−static void test_vcpus_then_vgic(uint32_t gic_dev_type)
356+static void test_vcpus_then_vgic(u32 gic_dev_type)
357357 {
358358 struct kvm_vcpu *vcpus[NR_VCPUS];
359359 struct vm_gic v;
@@ -408,7 +408,7 @@ static void test_v3_new_redist_regions(void) · 48 unmodified lines
408408 struct kvm_vcpu *vcpus[NR_VCPUS];
409409 void *dummy = NULL;
410410 struct vm_gic v;
411− uint64_t addr;
411+ u64 addr;
412412 int ret;
413413
414414 v = vm_gic_create_with_vcpus(KVM_DEV_TYPE_ARM_VGIC_V3, NR_VCPUS, vcpus);
@@ -460,7 +460,7 @@ static void test_v3_new_redist_regions(void) · 45 unmodified lines
460460 static void test_v3_typer_accesses(void)
461461 {
462462 struct vm_gic v;
463− uint64_t addr;
463+ u64 addr;
464464 int ret, i;
465465
466466 v.vm = vm_create(NR_VCPUS);
@@ -518,7 +518,7 @@ static void test_v3_typer_accesses(void) · 51 unmodified lines
518518 }
519519
520520 static struct vm_gic vm_gic_v3_create_with_vcpuids(int nr_vcpus,
521− uint32_t vcpuids[])
521+ u32 vcpuids[])
522522 {
523523 struct vm_gic v;
524524 int i;
@@ -544,9 +544,9 @@ static struct vm_gic vm_gic_v3_create_with_vcpuids(int nr_vcpus, · 19 unmodified lines
544544 */
545545 static void test_v3_last_bit_redist_regions(void)
546546 {
547− uint32_t vcpuids[] = { 0, 3, 5, 4, 1, 2 };
547+ u32 vcpuids[] = { 0, 3, 5, 4, 1, 2 };
548548 struct vm_gic v;
549− uint64_t addr;
549+ u64 addr;
550550
551551 v = vm_gic_v3_create_with_vcpuids(ARRAY_SIZE(vcpuids), vcpuids);
552552
@@ -578,9 +578,9 @@ static void test_v3_last_bit_redist_regions(void) · 25 unmodified lines
578578 /* Test last bit with legacy region */
579579 static void test_v3_last_bit_single_rdist(void)
580580 {
581− uint32_t vcpuids[] = { 0, 3, 5, 4, 1, 2 };
581+ u32 vcpuids[] = { 0, 3, 5, 4, 1, 2 };
582582 struct vm_gic v;
583− uint64_t addr;
583+ u64 addr;
584584
585585 v = vm_gic_v3_create_with_vcpuids(ARRAY_SIZE(vcpuids), vcpuids);
586586
@@ -606,7 +606,7 @@ static void test_v3_redist_ipa_range_check_at_vcpu_run(void) · 19 unmodified lines
606606 struct kvm_vcpu *vcpus[NR_VCPUS];
607607 struct vm_gic v;
608608 int ret, i;
609− uint64_t addr;
609+ u64 addr;
610610
611611 v = vm_gic_create_with_vcpus(KVM_DEV_TYPE_ARM_VGIC_V3, 1, vcpus);
612612
@@ -638,7 +638,7 @@ static void test_v3_its_region(void) · 25 unmodified lines
638638 {
639639 struct kvm_vcpu *vcpus[NR_VCPUS];
640640 struct vm_gic v;
641− uint64_t addr;
641+ u64 addr;
642642 int its_fd, ret;
643643
644644 v = vm_gic_create_with_vcpus(KVM_DEV_TYPE_ARM_VGIC_V3, NR_VCPUS, vcpus);
@@ -717,11 +717,11 @@ static void test_v3_nassgicap(void) · 72 unmodified lines
717717 /*
718718 * Returns 0 if it's possible to create GIC device of a given type (V2 or V3).
719719 */
720−int test_kvm_device(uint32_t gic_dev_type)
720+int test_kvm_device(u32 gic_dev_type)
721721 {
722722 struct kvm_vcpu *vcpus[NR_VCPUS];
723723 struct vm_gic v;
724− uint32_t other;
724+ u32 other;
725725 int ret;
726726
727727 v.vm = vm_create_with_vcpus(NR_VCPUS, guest_code, vcpus);
@@ -968,7 +968,7 @@ static void test_v3_sysregs(void) · 240 unmodified lines
968968 kvm_vm_free(vm);
969969 }
970970
971−void run_tests(uint32_t gic_dev_type)
971+void run_tests(u32 gic_dev_type)
972972 {
973973 test_vcpus_then_vgic(gic_dev_type);
974974 test_vgic_then_vcpus(gic_dev_type);
tools/testing/selftests/kvm/arm64/vgic_irq.c+69−68
@@ -24,12 +24,12 @@ · 23 unmodified lines
2424 * function.
2525 */
2626 struct test_args {
27− uint32_t nr_irqs; /* number of KVM supported IRQs. */
27+ u32 nr_irqs; /* number of KVM supported IRQs. */
2828 bool eoi_split; /* 1 is eoir+dir, 0 is eoir only */
2929 bool level_sensitive; /* 1 is level, 0 is edge */
3030 int kvm_max_routes; /* output of KVM_CAP_IRQ_ROUTING */
3131 bool kvm_supports_irqfd; /* output of KVM_CAP_IRQFD */
32− uint32_t shared_data;
32+ u32 shared_data;
3333 };
3434
3535 /*
@@ -64,15 +64,15 @@ typedef enum { · 28 unmodified lines
6464
6565 struct kvm_inject_args {
6666 kvm_inject_cmd cmd;
67− uint32_t first_intid;
68− uint32_t num;
67+ u32 first_intid;
68+ u32 num;
6969 int level;
7070 bool expect_failure;
7171 };
7272
7373 /* Used on the guest side to perform the hypercall. */
74−static void kvm_inject_call(kvm_inject_cmd cmd, uint32_t first_intid,
75− uint32_t num, int level, bool expect_failure);
74+static void kvm_inject_call(kvm_inject_cmd cmd, u32 first_intid,
75+ u32 num, int level, bool expect_failure);
7676
7777 /* Used on the host side to get the hypercall info. */
7878 static void kvm_inject_get_call(struct kvm_vm *vm, struct ucall *uc,
@@ -133,8 +133,8 @@ static struct kvm_inject_desc set_active_fns[] = { · 54 unmodified lines
133133 for_each_supported_inject_fn((args), (t), (f))
134134
135135 /* Shared between the guest main thread and the IRQ handlers. */
136−volatile uint64_t irq_handled;
137−volatile uint32_t irqnr_received[MAX_SPI + 1];
136+volatile u64 irq_handled;
137+volatile u32 irqnr_received[MAX_SPI + 1];
138138
139139 static void reset_stats(void)
140140 {
@@ -145,25 +145,25 @@ static void reset_stats(void) · 4 unmodified lines
145145 irqnr_received[i] = 0;
146146 }
147147
148−static uint64_t gic_read_ap1r0(void)
148+static u64 gic_read_ap1r0(void)
149149 {
150− uint64_t reg = read_sysreg_s(SYS_ICC_AP1R0_EL1);
150+ u64 reg = read_sysreg_s(SYS_ICC_AP1R0_EL1);
151151
152152 dsb(sy);
153153 return reg;
154154 }
155155
156−static void gic_write_ap1r0(uint64_t val)
156+static void gic_write_ap1r0(u64 val)
157157 {
158158 write_sysreg_s(val, SYS_ICC_AP1R0_EL1);
159159 isb();
160160 }
161161
162−static void guest_set_irq_line(uint32_t intid, uint32_t level);
162+static void guest_set_irq_line(u32 intid, u32 level);
163163
164164 static void guest_irq_generic_handler(bool eoi_split, bool level_sensitive)
165165 {
166− uint32_t intid = gic_get_and_ack_irq();
166+ u32 intid = gic_get_and_ack_irq();
167167
168168 if (intid == IAR_SPURIOUS)
169169 return;
@@ -189,8 +189,8 @@ static void guest_irq_generic_handler(bool eoi_split, bool level_sensitive) · 19 unmodified lines
189189 GUEST_ASSERT(!gic_irq_get_pending(intid));
190190 }
191191
192−static void kvm_inject_call(kvm_inject_cmd cmd, uint32_t first_intid,
193− uint32_t num, int level, bool expect_failure)
192+static void kvm_inject_call(kvm_inject_cmd cmd, u32 first_intid,
193+ u32 num, int level, bool expect_failure)
194194 {
195195 struct kvm_inject_args args = {
196196 .cmd = cmd,
@@ -204,7 +204,7 @@ static void kvm_inject_call(kvm_inject_cmd cmd, uint32_t first_intid, · 7 unmodified lines
204204
205205 #define GUEST_ASSERT_IAR_EMPTY() \
206206 do { \
207− uint32_t _intid; \
207+ u32 _intid; \
208208 _intid = gic_get_and_ack_irq(); \
209209 GUEST_ASSERT(_intid == IAR_SPURIOUS); \
210210 } while (0)
@@ -237,13 +237,13 @@ static void reset_priorities(struct test_args *args) · 26 unmodified lines
237237 gic_set_priority(i, IRQ_DEFAULT_PRIO_REG);
238238 }
239239
240−static void guest_set_irq_line(uint32_t intid, uint32_t level)
240+static void guest_set_irq_line(u32 intid, u32 level)
241241 {
242242 kvm_inject_call(KVM_SET_IRQ_LINE, intid, 1, level, false);
243243 }
244244
245245 static void test_inject_fail(struct test_args *args,
246− uint32_t intid, kvm_inject_cmd cmd)
246+ u32 intid, kvm_inject_cmd cmd)
247247 {
248248 reset_stats();
249249
@@ -255,10 +255,10 @@ static void test_inject_fail(struct test_args *args, · 5 unmodified lines
255255 }
256256
257257 static void guest_inject(struct test_args *args,
258− uint32_t first_intid, uint32_t num,
259− kvm_inject_cmd cmd)
258+ u32 first_intid, u32 num,
259+ kvm_inject_cmd cmd)
260260 {
261− uint32_t i;
261+ u32 i;
262262
263263 reset_stats();
264264
@@ -292,10 +292,10 @@ static void guest_inject(struct test_args *args, · 27 unmodified lines
292292 * deactivated yet.
293293 */
294294 static void guest_restore_active(struct test_args *args,
295− uint32_t first_intid, uint32_t num,
296− kvm_inject_cmd cmd)
295+ u32 first_intid, u32 num,
296+ kvm_inject_cmd cmd)
297297 {
298− uint32_t prio, intid, ap1r;
298+ u32 prio, intid, ap1r;
299299 int i;
300300
301301 /*
@@ -342,9 +342,9 @@ static void guest_restore_active(struct test_args *args, · 40 unmodified lines
342342 * This function should only be used in test_inject_preemption (with IRQs
343343 * masked).
344344 */
345−static uint32_t wait_for_and_activate_irq(void)
345+static u32 wait_for_and_activate_irq(void)
346346 {
347− uint32_t intid;
347+ u32 intid;
348348
349349 do {
350350 asm volatile("wfi" : : : "memory");
@@ -360,11 +360,11 @@ static uint32_t wait_for_and_activate_irq(void) · 9 unmodified lines
360360 * interrupts for the whole test.
361361 */
362362 static void test_inject_preemption(struct test_args *args,
363− uint32_t first_intid, int num,
363+ u32 first_intid, int num,
364364 const unsigned long *exclude,
365365 kvm_inject_cmd cmd)
366366 {
367− uint32_t intid, prio, step = KVM_PRIO_STEPS;
367+ u32 intid, prio, step = KVM_PRIO_STEPS;
368368 int i;
369369
370370 /* Set the priorities of the first (KVM_NUM_PRIOS - 1) IRQs
@@ -379,7 +379,7 @@ static void test_inject_preemption(struct test_args *args, · 8 unmodified lines
379379 local_irq_disable();
380380
381381 for (i = 0; i < num; i++) {
382− uint32_t tmp;
382+ u32 tmp;
383383 intid = i + first_intid;
384384
385385 if (exclude && test_bit(i, exclude))
@@ -431,7 +431,7 @@ static void test_inject_preemption(struct test_args *args, · 45 unmodified lines
431431
432432 static void test_injection(struct test_args *args, struct kvm_inject_desc *f)
433433 {
434− uint32_t nr_irqs = args->nr_irqs;
434+ u32 nr_irqs = args->nr_irqs;
435435
436436 if (f->sgi) {
437437 guest_inject(args, MIN_SGI, 1, f->cmd);
@@ -451,7 +451,7 @@ static void test_injection(struct test_args *args, struct kvm_inject_desc *f) · 13 unmodified lines
451451 static void test_injection_failure(struct test_args *args,
452452 struct kvm_inject_desc *f)
453453 {
454− uint32_t bad_intid[] = { args->nr_irqs, 1020, 1024, 1120, 5120, ~0U, };
454+ u32 bad_intid[] = { args->nr_irqs, 1020, 1024, 1120, 5120, ~0U, };
455455 int i;
456456
457457 for (i = 0; i < ARRAY_SIZE(bad_intid); i++)
@@ -490,7 +490,7 @@ static void test_restore_active(struct test_args *args, struct kvm_inject_desc * · 32 unmodified lines
490490
491491 static void guest_code(struct test_args *args)
492492 {
493− uint32_t i, nr_irqs = args->nr_irqs;
493+ u32 i, nr_irqs = args->nr_irqs;
494494 bool level_sensitive = args->level_sensitive;
495495 struct kvm_inject_desc *f, *inject_fns;
496496
@@ -529,8 +529,8 @@ static void guest_code(struct test_args *args) · 32 unmodified lines
529529 GUEST_DONE();
530530 }
531531
532−static void kvm_irq_line_check(struct kvm_vm *vm, uint32_t intid, int level,
533− struct test_args *test_args, bool expect_failure)
532+static void kvm_irq_line_check(struct kvm_vm *vm, u32 intid, int level,
533+ struct test_args *test_args, bool expect_failure)
534534 {
535535 int ret;
536536
@@ -548,8 +548,8 @@ static void kvm_irq_line_check(struct kvm_vm *vm, uint32_t intid, int level, · 11 unmodified lines
548548 }
549549 }
550550
551−void kvm_irq_set_level_info_check(int gic_fd, uint32_t intid, int level,
552− bool expect_failure)
551+void kvm_irq_set_level_info_check(int gic_fd, u32 intid, int level,
552+ bool expect_failure)
553553 {
554554 if (!expect_failure) {
555555 kvm_irq_set_level_info(gic_fd, intid, level);
@@ -573,17 +573,18 @@ void kvm_irq_set_level_info_check(int gic_fd, uint32_t intid, int level, · 17 unmodified lines
573573 }
574574
575575 static void kvm_set_gsi_routing_irqchip_check(struct kvm_vm *vm,
576− uint32_t intid, uint32_t num, uint32_t kvm_max_routes,
577− bool expect_failure)
576+ u32 intid, u32 num,
577+ u32 kvm_max_routes,
578+ bool expect_failure)
578579 {
579580 struct kvm_irq_routing *routing;
580581 int ret;
581− uint64_t i;
582+ u64 i;
582583
583584 assert(num <= kvm_max_routes && kvm_max_routes <= KVM_MAX_IRQ_ROUTES);
584585
585586 routing = kvm_gsi_routing_create();
586− for (i = intid; i < (uint64_t)intid + num; i++)
587+ for (i = intid; i < (u64)intid + num; i++)
587588 kvm_gsi_routing_irqchip_add(routing, i - MIN_SPI, i - MIN_SPI);
588589
589590 if (!expect_failure) {
@@ -591,7 +592,7 @@ static void kvm_set_gsi_routing_irqchip_check(struct kvm_vm *vm, · 1 unmodified line
591592 } else {
592593 ret = _kvm_gsi_routing_write(vm, routing);
593594 /* The kernel only checks e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS */
594− if (((uint64_t)intid + num - 1 - MIN_SPI) >= KVM_IRQCHIP_NUM_PINS)
595+ if (((u64)intid + num - 1 - MIN_SPI) >= KVM_IRQCHIP_NUM_PINS)
595596 TEST_ASSERT(ret != 0 && errno == EINVAL,
596597 "Bad intid %u did not cause KVM_SET_GSI_ROUTING "
597598 "error: rc: %i errno: %i", intid, ret, errno);
@@ -602,7 +603,7 @@ static void kvm_set_gsi_routing_irqchip_check(struct kvm_vm *vm, · 4 unmodified lines
602603 }
603604 }
604605
605−static void kvm_irq_write_ispendr_check(int gic_fd, uint32_t intid,
606+static void kvm_irq_write_ispendr_check(int gic_fd, u32 intid,
606607 struct kvm_vcpu *vcpu,
607608 bool expect_failure)
608609 {
@@ -618,13 +619,13 @@ static void kvm_irq_write_ispendr_check(int gic_fd, uint32_t intid, · 9 unmodified lines
618619 }
619620
620621 static void kvm_routing_and_irqfd_check(struct kvm_vm *vm,
621− uint32_t intid, uint32_t num, uint32_t kvm_max_routes,
622− bool expect_failure)
622+ u32 intid, u32 num, u32 kvm_max_routes,
623+ bool expect_failure)
623624 {
624625 int fd[MAX_SPI];
625− uint64_t val;
626+ u64 val;
626627 int ret, f;
627− uint64_t i;
628+ u64 i;
628629
629630 /*
630631 * There is no way to try injecting an SGI or PPI as the interface
@@ -643,29 +644,29 @@ static void kvm_routing_and_irqfd_check(struct kvm_vm *vm, · 12 unmodified lines
643644 * that no actual interrupt was injected for those cases.
644645 */
645646
646− for (f = 0, i = intid; i < (uint64_t)intid + num; i++, f++)
647+ for (f = 0, i = intid; i < (u64)intid + num; i++, f++)
647648 fd[f] = kvm_new_eventfd();
648649
649− for (f = 0, i = intid; i < (uint64_t)intid + num; i++, f++) {
650− assert(i <= (uint64_t)UINT_MAX);
650+ for (f = 0, i = intid; i < (u64)intid + num; i++, f++) {
651+ assert(i <= (u64)UINT_MAX);
651652 kvm_assign_irqfd(vm, i - MIN_SPI, fd[f]);
652653 }
653654
654− for (f = 0, i = intid; i < (uint64_t)intid + num; i++, f++) {
655+ for (f = 0, i = intid; i < (u64)intid + num; i++, f++) {
655656 val = 1;
656− ret = write(fd[f], &val, sizeof(uint64_t));
657− TEST_ASSERT(ret == sizeof(uint64_t),
657+ ret = write(fd[f], &val, sizeof(u64));
658+ TEST_ASSERT(ret == sizeof(u64),
658659 __KVM_SYSCALL_ERROR("write()", ret));
659660 }
660661
661− for (f = 0, i = intid; i < (uint64_t)intid + num; i++, f++)
662+ for (f = 0, i = intid; i < (u64)intid + num; i++, f++)
662663 kvm_close(fd[f]);
663664 }
664665
665666 /* handles the valid case: intid=0xffffffff num=1 */
666667 #define for_each_intid(first, num, tmp, i) \
667668 for ((tmp) = (i) = (first); \
668− (tmp) < (uint64_t)(first) + (uint64_t)(num); \
669+ (tmp) < (u64)(first) + (u64)(num); \
669670 (tmp)++, (i)++)
670671
671672 static void run_guest_cmd(struct kvm_vcpu *vcpu, int gic_fd,
@@ -673,13 +674,13 @@ static void run_guest_cmd(struct kvm_vcpu *vcpu, int gic_fd, · 1 unmodified line
673674 struct test_args *test_args)
674675 {
675676 kvm_inject_cmd cmd = inject_args->cmd;
676− uint32_t intid = inject_args->first_intid;
677− uint32_t num = inject_args->num;
677+ u32 intid = inject_args->first_intid;
678+ u32 num = inject_args->num;
678679 int level = inject_args->level;
679680 bool expect_failure = inject_args->expect_failure;
680681 struct kvm_vm *vm = vcpu->vm;
681− uint64_t tmp;
682− uint32_t i;
682+ u64 tmp;
683+ u32 i;
683684
684685 /* handles the valid case: intid=0xffffffff num=1 */
685686 assert(intid < UINT_MAX - num || num == 1);
@@ -731,7 +732,7 @@ static void kvm_inject_get_call(struct kvm_vm *vm, struct ucall *uc, · 45 unmodified lines
731732 struct kvm_inject_args *args)
732733 {
733734 struct kvm_inject_args *kvm_args_hva;
734− vm_vaddr_t kvm_args_gva;
735+ gva_t kvm_args_gva;
735736
736737 kvm_args_gva = uc->args[1];
737738 kvm_args_hva = (struct kvm_inject_args *)addr_gva2hva(vm, kvm_args_gva);
@@ -745,14 +746,14 @@ static void print_args(struct test_args *args) · 7 unmodified lines
745746 args->eoi_split);
746747 }
747748
748−static void test_vgic(uint32_t nr_irqs, bool level_sensitive, bool eoi_split)
749+static void test_vgic(u32 nr_irqs, bool level_sensitive, bool eoi_split)
749750 {
750751 struct ucall uc;
751752 int gic_fd;
752753 struct kvm_vcpu *vcpu;
753754 struct kvm_vm *vm;
754755 struct kvm_inject_args inject_args;
755− vm_vaddr_t args_gva;
756+ gva_t args_gva;
756757
757758 struct test_args args = {
758759 .nr_irqs = nr_irqs,
@@ -770,7 +771,7 @@ static void test_vgic(uint32_t nr_irqs, bool level_sensitive, bool eoi_split) · 11 unmodified lines
770771 vcpu_init_descriptor_tables(vcpu);
771772
772773 /* Setup the guest args page (so it gets the args). */
773− args_gva = vm_vaddr_alloc_page(vm);
774+ args_gva = vm_alloc_page(vm);
774775 memcpy(addr_gva2hva(vm, args_gva), &args, sizeof(args));
775776 vcpu_args_set(vcpu, 1, args_gva);
776777
@@ -810,7 +811,7 @@ static void guest_code_asym_dir(struct test_args *args, int cpuid) · 33 unmodified lines
810811 gic_set_priority_mask(CPU_PRIO_MASK);
811812
812813 if (cpuid == 0) {
813− uint32_t intid;
814+ u32 intid;
814815
815816 local_irq_disable();
816817
@@ -848,7 +849,7 @@ static void guest_code_asym_dir(struct test_args *args, int cpuid) · 31 unmodified lines
848849
849850 static void guest_code_group_en(struct test_args *args, int cpuid)
850851 {
851− uint32_t intid;
852+ u32 intid;
852853
853854 gic_init(GIC_V3, 2);
854855
@@ -896,7 +897,7 @@ static void guest_code_group_en(struct test_args *args, int cpuid) · 41 unmodified lines
896897
897898 static void guest_code_timer_spi(struct test_args *args, int cpuid)
898899 {
899− uint32_t intid;
900+ u32 intid;
900901 u64 val;
901902
902903 gic_init(GIC_V3, 2);
@@ -986,7 +987,7 @@ static void test_vgic_two_cpus(void *gcode) · 83 unmodified lines
986987 struct kvm_vcpu *vcpus[2];
987988 struct test_args args = {};
988989 struct kvm_vm *vm;
989− vm_vaddr_t args_gva;
990+ gva_t args_gva;
990991 int gic_fd, ret;
991992
992993 vm = vm_create_with_vcpus(2, gcode, vcpus);
@@ -996,7 +997,7 @@ static void test_vgic_two_cpus(void *gcode) · 3 unmodified lines
996997 vcpu_init_descriptor_tables(vcpus[1]);
997998
998999 /* Setup the guest args page (so it gets the args). */
999− args_gva = vm_vaddr_alloc_page(vm);
1000+ args_gva = vm_alloc_page(vm);
10001001 memcpy(addr_gva2hva(vm, args_gva), &args, sizeof(args));
10011002 vcpu_args_set(vcpus[0], 2, args_gva, 0);
10021003 vcpu_args_set(vcpus[1], 2, args_gva, 1);
@@ -1033,7 +1034,7 @@ static void help(const char *name) · 30 unmodified lines
10331034
10341035 int main(int argc, char **argv)
10351036 {
1036− uint32_t nr_irqs = 64;
1037+ u32 nr_irqs = 64;
10371038 bool default_args = true;
10381039 bool level_sensitive = false;
10391040 int opt;
tools/testing/selftests/kvm/arm64/vgic_lpi_stress.c+10−10
@@ -23,7 +23,7 @@ · 22 unmodified lines
2323 #define GIC_LPI_OFFSET 8192
2424
2525 static size_t nr_iterations = 1000;
26−static vm_paddr_t gpa_base;
26+static gpa_t gpa_base;
2727
2828 static struct kvm_vm *vm;
2929 static struct kvm_vcpu **vcpus;
@@ -35,14 +35,14 @@ static struct test_data { · 5 unmodified lines
3535 u32 nr_devices;
3636 u32 nr_event_ids;
3737
38− vm_paddr_t device_table;
39− vm_paddr_t collection_table;
40− vm_paddr_t cmdq_base;
38+ gpa_t device_table;
39+ gpa_t collection_table;
40+ gpa_t cmdq_base;
4141 void *cmdq_base_va;
42− vm_paddr_t itt_tables;
42+ gpa_t itt_tables;
4343
44− vm_paddr_t lpi_prop_table;
45− vm_paddr_t lpi_pend_tables;
44+ gpa_t lpi_prop_table;
45+ gpa_t lpi_pend_tables;
4646 } test_data = {
4747 .nr_cpus = 1,
4848 .nr_devices = 1,
@@ -73,7 +73,7 @@ static void guest_setup_its_mappings(void) · 24 unmodified lines
7373 /* Round-robin the LPIs to all of the vCPUs in the VM */
7474 coll_id = 0;
7575 for (device_id = 0; device_id < nr_devices; device_id++) {
76− vm_paddr_t itt_base = test_data.itt_tables + (device_id * SZ_64K);
76+ gpa_t itt_base = test_data.itt_tables + (device_id * SZ_64K);
7777
7878 its_send_mapd_cmd(test_data.cmdq_base_va, device_id,
7979 itt_base, SZ_64K, true);
@@ -188,7 +188,7 @@ static void setup_test_data(void) · 108 unmodified lines
188188 size_t pages_per_64k = vm_calc_num_guest_pages(vm->mode, SZ_64K);
189189 u32 nr_devices = test_data.nr_devices;
190190 u32 nr_cpus = test_data.nr_cpus;
191− vm_paddr_t cmdq_base;
191+ gpa_t cmdq_base;
192192
193193 test_data.device_table = vm_phy_pages_alloc(vm, pages_per_64k,
194194 gpa_base,
@@ -224,7 +224,7 @@ static void setup_gic(void) · 29 unmodified lines
224224
225225 static void signal_lpi(u32 device_id, u32 event_id)
226226 {
227− vm_paddr_t db_addr = GITS_BASE_GPA + GITS_TRANSLATER;
227+ gpa_t db_addr = GITS_BASE_GPA + GITS_TRANSLATER;
228228
229229 struct kvm_msi msi = {
230230 .address_lo = db_addr,
tools/testing/selftests/kvm/arm64/vgic_v5.c+5−5
@@ -17,10 +17,10 @@ · 16 unmodified lines
1717 struct vm_gic {
1818 struct kvm_vm *vm;
1919 int gic_fd;
20− uint32_t gic_dev_type;
20+ u32 gic_dev_type;
2121 };
2222
23−static uint64_t max_phys_size;
23+static u64 max_phys_size;
2424
2525 #define GUEST_CMD_IRQ_CDIA 10
2626 #define GUEST_CMD_IRQ_DIEOI 11
@@ -96,7 +96,7 @@ static void vm_gic_destroy(struct vm_gic *v) · 69 unmodified lines
9696 kvm_vm_free(v->vm);
9797 }
9898
99−static void test_vgic_v5_ppis(uint32_t gic_dev_type)
99+static void test_vgic_v5_ppis(u32 gic_dev_type)
100100 {
101101 struct kvm_vcpu *vcpus[NR_VCPUS];
102102 struct ucall uc;
@@ -173,7 +173,7 @@ done: · 70 unmodified lines
173173 /*
174174 * Returns 0 if it's possible to create GIC device of a given type (V5).
175175 */
176−int test_kvm_device(uint32_t gic_dev_type)
176+int test_kvm_device(u32 gic_dev_type)
177177 {
178178 struct kvm_vcpu *vcpus[NR_VCPUS];
179179 struct vm_gic v;
@@ -199,7 +199,7 @@ int test_kvm_device(uint32_t gic_dev_type) · 19 unmodified lines
199199 return 0;
200200 }
201201
202−void run_tests(uint32_t gic_dev_type)
202+void run_tests(u32 gic_dev_type)
203203 {
204204 pr_info("Test VGICv5 PPIs\n");
205205 test_vgic_v5_ppis(gic_dev_type);
tools/testing/selftests/kvm/arm64/vpmu_counter_access.c+28−28
@@ -33,20 +33,20 @@ struct vpmu_vm { · 32 unmodified lines
3333 static struct vpmu_vm vpmu_vm;
3434
3535 struct pmreg_sets {
36− uint64_t set_reg_id;
37− uint64_t clr_reg_id;
36+ u64 set_reg_id;
37+ u64 clr_reg_id;
3838 };
3939
4040 #define PMREG_SET(set, clr) {.set_reg_id = set, .clr_reg_id = clr}
4141
42−static uint64_t get_pmcr_n(uint64_t pmcr)
42+static u64 get_pmcr_n(u64 pmcr)
4343 {
4444 return FIELD_GET(ARMV8_PMU_PMCR_N, pmcr);
4545 }
4646
47−static uint64_t get_counters_mask(uint64_t n)
47+static u64 get_counters_mask(u64 n)
4848 {
49− uint64_t mask = BIT(ARMV8_PMU_CYCLE_IDX);
49+ u64 mask = BIT(ARMV8_PMU_CYCLE_IDX);
5050
5151 if (n)
5252 mask |= GENMASK(n - 1, 0);
@@ -89,7 +89,7 @@ static inline void write_sel_evtyper(int sel, unsigned long val) · 36 unmodified lines
8989
9090 static void pmu_disable_reset(void)
9191 {
92− uint64_t pmcr = read_sysreg(pmcr_el0);
92+ u64 pmcr = read_sysreg(pmcr_el0);
9393
9494 /* Reset all counters, disabling them */
9595 pmcr &= ~ARMV8_PMU_PMCR_E;
@@ -169,7 +169,7 @@ struct pmc_accessor pmc_accessors[] = { · 73 unmodified lines
169169
170170 #define GUEST_ASSERT_BITMAP_REG(regname, mask, set_expected) \
171171 { \
172− uint64_t _tval = read_sysreg(regname); \
172+ u64 _tval = read_sysreg(regname); \
173173 \
174174 if (set_expected) \
175175 __GUEST_ASSERT((_tval & mask), \
@@ -185,7 +185,7 @@ struct pmc_accessor pmc_accessors[] = { · 9 unmodified lines
185185 * Check if @mask bits in {PMCNTEN,PMINTEN,PMOVS}{SET,CLR} registers
186186 * are set or cleared as specified in @set_expected.
187187 */
188−static void check_bitmap_pmu_regs(uint64_t mask, bool set_expected)
188+static void check_bitmap_pmu_regs(u64 mask, bool set_expected)
189189 {
190190 GUEST_ASSERT_BITMAP_REG(pmcntenset_el0, mask, set_expected);
191191 GUEST_ASSERT_BITMAP_REG(pmcntenclr_el0, mask, set_expected);
@@ -207,7 +207,7 @@ static void check_bitmap_pmu_regs(uint64_t mask, bool set_expected) · 15 unmodified lines
207207 */
208208 static void test_bitmap_pmu_regs(int pmc_idx, bool set_op)
209209 {
210− uint64_t pmcr_n, test_bit = BIT(pmc_idx);
210+ u64 pmcr_n, test_bit = BIT(pmc_idx);
211211 bool set_expected = false;
212212
213213 if (set_op) {
@@ -232,7 +232,7 @@ static void test_bitmap_pmu_regs(int pmc_idx, bool set_op) · 18 unmodified lines
232232 */
233233 static void test_access_pmc_regs(struct pmc_accessor *acc, int pmc_idx)
234234 {
235− uint64_t write_data, read_data;
235+ u64 write_data, read_data;
236236
237237 /* Disable all PMCs and reset all PMCs to zero. */
238238 pmu_disable_reset();
@@ -287,11 +287,11 @@ static void test_access_pmc_regs(struct pmc_accessor *acc, int pmc_idx) · 48 unmodified lines
287287 }
288288
289289 #define INVALID_EC (-1ul)
290−uint64_t expected_ec = INVALID_EC;
290+u64 expected_ec = INVALID_EC;
291291
292292 static void guest_sync_handler(struct ex_regs *regs)
293293 {
294− uint64_t esr, ec;
294+ u64 esr, ec;
295295
296296 esr = read_sysreg(esr_el1);
297297 ec = ESR_ELx_EC(esr);
@@ -351,9 +351,9 @@ static void test_access_invalid_pmc_regs(struct pmc_accessor *acc, int pmc_idx) · 53 unmodified lines
351351 * if reading/writing PMU registers for implemented or unimplemented
352352 * counters works as expected.
353353 */
354−static void guest_code(uint64_t expected_pmcr_n)
354+static void guest_code(u64 expected_pmcr_n)
355355 {
356− uint64_t pmcr, pmcr_n, unimp_mask;
356+ u64 pmcr, pmcr_n, unimp_mask;
357357 int i, pmc;
358358
359359 __GUEST_ASSERT(expected_pmcr_n <= ARMV8_PMU_MAX_GENERAL_COUNTERS,
@@ -402,12 +402,12 @@ static void guest_code(uint64_t expected_pmcr_n) · 42 unmodified lines
402402 static void create_vpmu_vm(void *guest_code)
403403 {
404404 struct kvm_vcpu_init init;
405− uint8_t pmuver, ec;
406− uint64_t dfr0, irq = 23;
405+ u8 pmuver, ec;
406+ u64 dfr0, irq = 23;
407407 struct kvm_device_attr irq_attr = {
408408 .group = KVM_ARM_VCPU_PMU_V3_CTRL,
409409 .attr = KVM_ARM_VCPU_PMU_V3_IRQ,
410− .addr = (uint64_t)&irq,
410+ .addr = (u64)&irq,
411411 };
412412
413413 /* The test creates the vpmu_vm multiple times. Ensure a clean state */
@@ -443,7 +443,7 @@ static void destroy_vpmu_vm(void) · 29 unmodified lines
443443 kvm_vm_free(vpmu_vm.vm);
444444 }
445445
446−static void run_vcpu(struct kvm_vcpu *vcpu, uint64_t pmcr_n)
446+static void run_vcpu(struct kvm_vcpu *vcpu, u64 pmcr_n)
447447 {
448448 struct ucall uc;
449449
@@ -489,9 +489,9 @@ static void test_create_vpmu_vm_with_nr_counters(unsigned int nr_counters, bool · 39 unmodified lines
489489 * Create a guest with one vCPU, set the PMCR_EL0.N for the vCPU to @pmcr_n,
490490 * and run the test.
491491 */
492−static void run_access_test(uint64_t pmcr_n)
492+static void run_access_test(u64 pmcr_n)
493493 {
494− uint64_t sp;
494+ u64 sp;
495495 struct kvm_vcpu *vcpu;
496496 struct kvm_vcpu_init init;
497497
@@ -514,7 +514,7 @@ static void run_access_test(uint64_t pmcr_n) · 16 unmodified lines
514514 aarch64_vcpu_setup(vcpu, &init);
515515 vcpu_init_descriptor_tables(vcpu);
516516 vcpu_set_reg(vcpu, ctxt_reg_alias(vcpu, SYS_SP_EL1), sp);
517− vcpu_set_reg(vcpu, ARM64_CORE_REG(regs.pc), (uint64_t)guest_code);
517+ vcpu_set_reg(vcpu, ARM64_CORE_REG(regs.pc), (u64)guest_code);
518518
519519 run_vcpu(vcpu, pmcr_n);
520520
@@ -531,12 +531,12 @@ static struct pmreg_sets validity_check_reg_sets[] = { · 10 unmodified lines
531531 * Create a VM, and check if KVM handles the userspace accesses of
532532 * the PMU register sets in @validity_check_reg_sets[] correctly.
533533 */
534−static void run_pmregs_validity_test(uint64_t pmcr_n)
534+static void run_pmregs_validity_test(u64 pmcr_n)
535535 {
536536 int i;
537537 struct kvm_vcpu *vcpu;
538− uint64_t set_reg_id, clr_reg_id, reg_val;
539− uint64_t valid_counters_mask, max_counters_mask;
538+ u64 set_reg_id, clr_reg_id, reg_val;
539+ u64 valid_counters_mask, max_counters_mask;
540540
541541 test_create_vpmu_vm_with_nr_counters(pmcr_n, false);
542542 vcpu = vpmu_vm.vcpu;
@@ -588,7 +588,7 @@ static void run_pmregs_validity_test(uint64_t pmcr_n) · 45 unmodified lines
588588 * the vCPU to @pmcr_n, which is larger than the host value.
589589 * The attempt should fail as @pmcr_n is too big to set for the vCPU.
590590 */
591−static void run_error_test(uint64_t pmcr_n)
591+static void run_error_test(u64 pmcr_n)
592592 {
593593 pr_debug("Error test with pmcr_n %lu (larger than the host)\n", pmcr_n);
594594
@@ -600,9 +600,9 @@ static void run_error_test(uint64_t pmcr_n) · 5 unmodified lines
600600 * Return the default number of implemented PMU event counters excluding
601601 * the cycle counter (i.e. PMCR_EL0.N value) for the guest.
602602 */
603−static uint64_t get_pmcr_n_limit(void)
603+static u64 get_pmcr_n_limit(void)
604604 {
605− uint64_t pmcr;
605+ u64 pmcr;
606606
607607 create_vpmu_vm(guest_code);
608608 pmcr = vcpu_get_reg(vpmu_vm.vcpu, KVM_ARM64_SYS_REG(SYS_PMCR_EL0));
@@ -624,7 +624,7 @@ static bool kvm_supports_nr_counters_attr(void) · 15 unmodified lines
624624
625625 int main(void)
626626 {
627− uint64_t i, pmcr_n;
627+ u64 i, pmcr_n;
628628
629629 TEST_REQUIRE(kvm_has_cap(KVM_CAP_ARM_PMU_V3));
630630 TEST_REQUIRE(kvm_supports_vgic_v3());
tools/testing/selftests/kvm/coalesced_io_test.c+19−19
@@ -14,16 +14,16 @@ · 13 unmodified lines
1414
1515 struct kvm_coalesced_io {
1616 struct kvm_coalesced_mmio_ring *ring;
17− uint32_t ring_size;
18− uint64_t mmio_gpa;
19− uint64_t *mmio;
17+ u32 ring_size;
18+ u64 mmio_gpa;
19+ u64 *mmio;
2020
2121 /*
2222 * x86-only, but define pio_port for all architectures to minimize the
2323 * amount of #ifdeffery and complexity, without having to sacrifice
2424 * verbose error messages.
2525 */
26− uint8_t pio_port;
26+ u8 pio_port;
2727 };
2828
2929 static struct kvm_coalesced_io kvm_builtin_io_ring;
@@ -70,13 +70,13 @@ static void guest_code(struct kvm_coalesced_io *io) · 40 unmodified lines
7070
7171 static void vcpu_run_and_verify_io_exit(struct kvm_vcpu *vcpu,
7272 struct kvm_coalesced_io *io,
73− uint32_t ring_start,
74− uint32_t expected_exit)
73+ u32 ring_start,
74+ u32 expected_exit)
7575 {
7676 const bool want_pio = expected_exit == KVM_EXIT_IO;
7777 struct kvm_coalesced_mmio_ring *ring = io->ring;
7878 struct kvm_run *run = vcpu->run;
79− uint32_t pio_value;
79+ u32 pio_value;
8080
8181 WRITE_ONCE(ring->first, ring_start);
8282 WRITE_ONCE(ring->last, ring_start);
@@ -88,13 +88,13 @@ static void vcpu_run_and_verify_io_exit(struct kvm_vcpu *vcpu, · 5 unmodified lines
8888 * data_offset is garbage, e.g. an MMIO gpa.
8989 */
9090 if (run->exit_reason == KVM_EXIT_IO)
91− pio_value = *(uint32_t *)((void *)run + run->io.data_offset);
91+ pio_value = *(u32 *)((void *)run + run->io.data_offset);
9292 else
9393 pio_value = 0;
9494
9595 TEST_ASSERT((!want_pio && (run->exit_reason == KVM_EXIT_MMIO && run->mmio.is_write &&
9696 run->mmio.phys_addr == io->mmio_gpa && run->mmio.len == 8 &&
97− *(uint64_t *)run->mmio.data == io->mmio_gpa + io->ring_size - 1)) ||
97+ *(u64 *)run->mmio.data == io->mmio_gpa + io->ring_size - 1)) ||
9898 (want_pio && (run->exit_reason == KVM_EXIT_IO && run->io.port == io->pio_port &&
9999 run->io.direction == KVM_EXIT_IO_OUT && run->io.count == 1 &&
100100 pio_value == io->pio_port + io->ring_size - 1)),
@@ -105,14 +105,14 @@ static void vcpu_run_and_verify_io_exit(struct kvm_vcpu *vcpu, · 4 unmodified lines
105105 want_pio ? (unsigned long long)io->pio_port : io->mmio_gpa,
106106 (want_pio ? io->pio_port : io->mmio_gpa) + io->ring_size - 1, run->exit_reason,
107107 run->exit_reason == KVM_EXIT_MMIO ? "MMIO" : run->exit_reason == KVM_EXIT_IO ? "PIO" : "other",
108− run->mmio.phys_addr, run->mmio.is_write, run->mmio.len, *(uint64_t *)run->mmio.data,
108+ run->mmio.phys_addr, run->mmio.is_write, run->mmio.len, *(u64 *)run->mmio.data,
109109 run->io.port, run->io.direction, run->io.size, run->io.count, pio_value);
110110 }
111111
112112 static void vcpu_run_and_verify_coalesced_io(struct kvm_vcpu *vcpu,
113113 struct kvm_coalesced_io *io,
114− uint32_t ring_start,
115− uint32_t expected_exit)
114+ u32 ring_start,
115+ u32 expected_exit)
116116 {
117117 struct kvm_coalesced_mmio_ring *ring = io->ring;
118118 int i;
@@ -124,18 +124,18 @@ static void vcpu_run_and_verify_coalesced_io(struct kvm_vcpu *vcpu, · 5 unmodified lines
124124 ring->first, ring->last, io->ring_size, ring_start);
125125
126126 for (i = 0; i < io->ring_size - 1; i++) {
127− uint32_t idx = (ring->first + i) % io->ring_size;
127+ u32 idx = (ring->first + i) % io->ring_size;
128128 struct kvm_coalesced_mmio *entry = &ring->coalesced_mmio[idx];
129129
130130 #ifdef __x86_64__
131131 if (i & 1)
132132 TEST_ASSERT(entry->phys_addr == io->pio_port &&
133133 entry->len == 4 && entry->pio &&
134− *(uint32_t *)entry->data == io->pio_port + i,
134+ *(u32 *)entry->data == io->pio_port + i,
135135 "Wanted 4-byte port I/O 0x%x = 0x%x in entry %u, got %u-byte %s 0x%llx = 0x%x",
136136 io->pio_port, io->pio_port + i, i,
137137 entry->len, entry->pio ? "PIO" : "MMIO",
138− entry->phys_addr, *(uint32_t *)entry->data);
138+ entry->phys_addr, *(u32 *)entry->data);
139139 else
140140 #endif
141141 TEST_ASSERT(entry->phys_addr == io->mmio_gpa &&
@@ -143,12 +143,12 @@ static void vcpu_run_and_verify_coalesced_io(struct kvm_vcpu *vcpu, · 1 unmodified line
143143 "Wanted 8-byte MMIO to 0x%lx = %lx in entry %u, got %u-byte %s 0x%llx = 0x%lx",
144144 io->mmio_gpa, io->mmio_gpa + i, i,
145145 entry->len, entry->pio ? "PIO" : "MMIO",
146− entry->phys_addr, *(uint64_t *)entry->data);
146+ entry->phys_addr, *(u64 *)entry->data);
147147 }
148148 }
149149
150150 static void test_coalesced_io(struct kvm_vcpu *vcpu,
151− struct kvm_coalesced_io *io, uint32_t ring_start)
151+ struct kvm_coalesced_io *io, u32 ring_start)
152152 {
153153 struct kvm_coalesced_mmio_ring *ring = io->ring;
154154
@@ -219,11 +219,11 @@ int main(int argc, char *argv[]) · 64 unmodified lines
219219 * the MMIO GPA identity mapped in the guest.
220220 */
221221 .mmio_gpa = 4ull * SZ_1G,
222− .mmio = (uint64_t *)(4ull * SZ_1G),
222+ .mmio = (u64 *)(4ull * SZ_1G),
223223 .pio_port = 0x80,
224224 };
225225
226− virt_map(vm, (uint64_t)kvm_builtin_io_ring.mmio, kvm_builtin_io_ring.mmio_gpa, 1);
226+ virt_map(vm, (u64)kvm_builtin_io_ring.mmio, kvm_builtin_io_ring.mmio_gpa, 1);
227227
228228 sync_global_to_guest(vm, kvm_builtin_io_ring);
229229 vcpu_args_set(vcpu, 1, &kvm_builtin_io_ring);
tools/testing/selftests/kvm/demand_paging_test.c+5−5
@@ -24,7 +24,7 @@ · 23 unmodified lines
2424 #ifdef __NR_userfaultfd
2525
2626 static int nr_vcpus = 1;
27−static uint64_t guest_percpu_mem_size = DEFAULT_PER_VCPU_MEM_SIZE;
27+static u64 guest_percpu_mem_size = DEFAULT_PER_VCPU_MEM_SIZE;
2828
2929 static size_t demand_paging_size;
3030 static char *guest_data_prototype;
@@ -58,7 +58,7 @@ static int handle_uffd_page_request(int uffd_mode, int uffd, · 27 unmodified lines
5858 struct uffd_msg *msg)
5959 {
6060 pid_t tid = syscall(__NR_gettid);
61− uint64_t addr = msg->arg.pagefault.address;
61+ u64 addr = msg->arg.pagefault.address;
6262 struct timespec start;
6363 struct timespec ts_diff;
6464 int r;
@@ -68,7 +68,7 @@ static int handle_uffd_page_request(int uffd_mode, int uffd, · 3 unmodified lines
6868 if (uffd_mode == UFFDIO_REGISTER_MODE_MISSING) {
6969 struct uffdio_copy copy;
7070
71− copy.src = (uint64_t)guest_data_prototype;
71+ copy.src = (u64)guest_data_prototype;
7272 copy.dst = addr;
7373 copy.len = demand_paging_size;
7474 copy.mode = 0;
@@ -138,7 +138,7 @@ struct test_params { · 63 unmodified lines
138138 bool partition_vcpu_memory_access;
139139 };
140140
141−static void prefault_mem(void *alias, uint64_t len)
141+static void prefault_mem(void *alias, u64 len)
142142 {
143143 size_t p;
144144
@@ -154,7 +154,7 @@ static void run_test(enum vm_guest_mode mode, void *arg) · 9 unmodified lines
154154 struct memstress_vcpu_args *vcpu_args;
155155 struct test_params *p = arg;
156156 struct uffd_desc **uffd_descs = NULL;
157− uint64_t uffd_region_size;
157+ u64 uffd_region_size;
158158 struct timespec start;
159159 struct timespec ts_diff;
160160 double vcpu_paging_rate;
tools/testing/selftests/kvm/dirty_log_perf_test.c+7−7
@@ -24,7 +24,7 @@ · 23 unmodified lines
2424 #define TEST_HOST_LOOP_N 2UL
2525
2626 static int nr_vcpus = 1;
27−static uint64_t guest_percpu_mem_size = DEFAULT_PER_VCPU_MEM_SIZE;
27+static u64 guest_percpu_mem_size = DEFAULT_PER_VCPU_MEM_SIZE;
2828 static bool run_vcpus_while_disabling_dirty_logging;
2929
3030 /* Host variables */
@@ -37,7 +37,7 @@ static void vcpu_worker(struct memstress_vcpu_args *vcpu_args) · 6 unmodified lines
3737 {
3838 struct kvm_vcpu *vcpu = vcpu_args->vcpu;
3939 int vcpu_idx = vcpu_args->vcpu_idx;
40− uint64_t pages_count = 0;
40+ u64 pages_count = 0;
4141 struct kvm_run *run;
4242 struct timespec start;
4343 struct timespec ts_diff;
@@ -93,11 +93,11 @@ static void vcpu_worker(struct memstress_vcpu_args *vcpu_args) · 49 unmodified lines
9393
9494 struct test_params {
9595 unsigned long iterations;
96− uint64_t phys_offset;
96+ u64 phys_offset;
9797 bool partition_vcpu_memory_access;
9898 enum vm_mem_backing_src_type backing_src;
9999 int slots;
100− uint32_t write_percent;
100+ u32 write_percent;
101101 bool random_access;
102102 };
103103
@@ -106,9 +106,9 @@ static void run_test(enum vm_guest_mode mode, void *arg) · 2 unmodified lines
106106 struct test_params *p = arg;
107107 struct kvm_vm *vm;
108108 unsigned long **bitmaps;
109− uint64_t guest_num_pages;
110− uint64_t host_num_pages;
111− uint64_t pages_per_slot;
109+ u64 guest_num_pages;
110+ u64 host_num_pages;
111+ u64 pages_per_slot;
112112 struct timespec start;
113113 struct timespec ts_diff;
114114 struct timespec get_dirty_log_total = (struct timespec){0};
tools/testing/selftests/kvm/dirty_log_test.c+41−41
@@ -74,11 +74,11 @@ · 73 unmodified lines
7474 * the host. READ/WRITE_ONCE() should also be used with anything
7575 * that may change.
7676 */
77−static uint64_t host_page_size;
78−static uint64_t guest_page_size;
79−static uint64_t guest_num_pages;
80−static uint64_t iteration;
81−static uint64_t nr_writes;
77+static u64 host_page_size;
78+static u64 guest_page_size;
79+static u64 guest_num_pages;
80+static u64 iteration;
81+static u64 nr_writes;
8282 static bool vcpu_stop;
8383
8484 /*
@@ -86,13 +86,13 @@ static bool vcpu_stop; · 1 unmodified line
8686 * This will be set to the topmost valid physical address minus
8787 * the test memory size.
8888 */
89−static uint64_t guest_test_phys_mem;
89+static u64 guest_test_phys_mem;
9090
9191 /*
9292 * Guest virtual memory offset of the testing memory slot.
9393 * Must not conflict with identity mapped test code.
9494 */
95−static uint64_t guest_test_virt_mem = DEFAULT_GUEST_TEST_MEM;
95+static u64 guest_test_virt_mem = DEFAULT_GUEST_TEST_MEM;
9696
9797 /*
9898 * Continuously write to the first 8 bytes of a random pages within
@@ -100,10 +100,10 @@ static uint64_t guest_test_virt_mem = DEFAULT_GUEST_TEST_MEM; · 1 unmodified line
100100 */
101101 static void guest_code(void)
102102 {
103− uint64_t addr;
103+ u64 addr;
104104
105105 #ifdef __s390x__
106− uint64_t i;
106+ u64 i;
107107
108108 /*
109109 * On s390x, all pages of a 1M segment are initially marked as dirty
@@ -113,7 +113,7 @@ static void guest_code(void) · 3 unmodified lines
113113 */
114114 for (i = 0; i < guest_num_pages; i++) {
115115 addr = guest_test_virt_mem + i * guest_page_size;
116− vcpu_arch_put_guest(*(uint64_t *)addr, READ_ONCE(iteration));
116+ vcpu_arch_put_guest(*(u64 *)addr, READ_ONCE(iteration));
117117 nr_writes++;
118118 }
119119 #endif
@@ -125,7 +125,7 @@ static void guest_code(void) · 5 unmodified lines
125125 * guest_page_size;
126126 addr = align_down(addr, host_page_size);
127127
128− vcpu_arch_put_guest(*(uint64_t *)addr, READ_ONCE(iteration));
128+ vcpu_arch_put_guest(*(u64 *)addr, READ_ONCE(iteration));
129129 nr_writes++;
130130 }
131131
@@ -138,11 +138,11 @@ static bool host_quit; · 6 unmodified lines
138138
139139 /* Points to the test VM memory region on which we track dirty logs */
140140 static void *host_test_mem;
141−static uint64_t host_num_pages;
141+static u64 host_num_pages;
142142
143143 /* For statistics only */
144−static uint64_t host_dirty_count;
145−static uint64_t host_clear_count;
144+static u64 host_dirty_count;
145+static u64 host_clear_count;
146146
147147 /* Whether dirty ring reset is requested, or finished */
148148 static sem_t sem_vcpu_stop;
@@ -169,7 +169,7 @@ static bool dirty_ring_vcpu_ring_full; · 20 unmodified lines
169169 * dirty gfn we've collected, so that if a mismatch of data found later in the
170170 * verifying process, we let it pass.
171171 */
172−static uint64_t dirty_ring_last_page = -1ULL;
172+static u64 dirty_ring_last_page = -1ULL;
173173
174174 /*
175175 * In addition to the above, it is possible (especially if this
@@ -213,7 +213,7 @@ static uint64_t dirty_ring_last_page = -1ULL; · 37 unmodified lines
213213 * and also don't fail when it is reported in the next iteration, together with
214214 * an outdated iteration count.
215215 */
216−static uint64_t dirty_ring_prev_iteration_last_page;
216+static u64 dirty_ring_prev_iteration_last_page;
217217
218218 enum log_mode_t {
219219 /* Only use KVM_GET_DIRTY_LOG for logging */
@@ -236,7 +236,7 @@ static enum log_mode_t host_log_mode_option = LOG_MODE_ALL; · 16 unmodified lines
236236 /* Logging mode for current run */
237237 static enum log_mode_t host_log_mode;
238238 static pthread_t vcpu_thread;
239−static uint32_t test_dirty_ring_count = TEST_DIRTY_RING_COUNT;
239+static u32 test_dirty_ring_count = TEST_DIRTY_RING_COUNT;
240240
241241 static bool clear_log_supported(void)
242242 {
@@ -255,15 +255,15 @@ static void clear_log_create_vm_done(struct kvm_vm *vm) · 12 unmodified lines
255255 }
256256
257257 static void dirty_log_collect_dirty_pages(struct kvm_vcpu *vcpu, int slot,
258− void *bitmap, uint32_t num_pages,
259− uint32_t *unused)
258+ void *bitmap, u32 num_pages,
259+ u32 *unused)
260260 {
261261 kvm_vm_get_dirty_log(vcpu->vm, slot, bitmap);
262262 }
263263
264264 static void clear_log_collect_dirty_pages(struct kvm_vcpu *vcpu, int slot,
265− void *bitmap, uint32_t num_pages,
266− uint32_t *unused)
265+ void *bitmap, u32 num_pages,
266+ u32 *unused)
267267 {
268268 kvm_vm_get_dirty_log(vcpu->vm, slot, bitmap);
269269 kvm_vm_clear_dirty_log(vcpu->vm, slot, bitmap, 0, num_pages);
@@ -297,8 +297,8 @@ static bool dirty_ring_supported(void) · 27 unmodified lines
297297
298298 static void dirty_ring_create_vm_done(struct kvm_vm *vm)
299299 {
300− uint64_t pages;
301− uint32_t limit;
300+ u64 pages;
301+ u32 limit;
302302
303303 /*
304304 * We rely on vcpu exit due to full dirty ring state. Adjust
@@ -333,12 +333,12 @@ static inline void dirty_gfn_set_collected(struct kvm_dirty_gfn *gfn) · 28 unmodified lines
333333 smp_store_release(&gfn->flags, KVM_DIRTY_GFN_F_RESET);
334334 }
335335
336−static uint32_t dirty_ring_collect_one(struct kvm_dirty_gfn *dirty_gfns,
337− int slot, void *bitmap,
338− uint32_t num_pages, uint32_t *fetch_index)
336+static u32 dirty_ring_collect_one(struct kvm_dirty_gfn *dirty_gfns,
337+ int slot, void *bitmap,
338+ u32 num_pages, u32 *fetch_index)
339339 {
340340 struct kvm_dirty_gfn *cur;
341− uint32_t count = 0;
341+ u32 count = 0;
342342
343343 while (true) {
344344 cur = &dirty_gfns[*fetch_index % test_dirty_ring_count];
@@ -359,10 +359,10 @@ static uint32_t dirty_ring_collect_one(struct kvm_dirty_gfn *dirty_gfns, · 14 unmodified lines
359359 }
360360
361361 static void dirty_ring_collect_dirty_pages(struct kvm_vcpu *vcpu, int slot,
362− void *bitmap, uint32_t num_pages,
363− uint32_t *ring_buf_idx)
362+ void *bitmap, u32 num_pages,
363+ u32 *ring_buf_idx)
364364 {
365− uint32_t count, cleared;
365+ u32 count, cleared;
366366
367367 /* Only have one vcpu */
368368 count = dirty_ring_collect_one(vcpu_map_dirty_ring(vcpu),
@@ -404,8 +404,8 @@ struct log_mode { · 35 unmodified lines
404404 void (*create_vm_done)(struct kvm_vm *vm);
405405 /* Hook to collect the dirty pages into the bitmap provided */
406406 void (*collect_dirty_pages) (struct kvm_vcpu *vcpu, int slot,
407− void *bitmap, uint32_t num_pages,

68 more lines aren’t shown here.

tools/testing/selftests/kvm/get-reg-list.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/guest_memfd_test.c+9−9

This diff is large: its 71 lines aren’t shown here.

tools/testing/selftests/kvm/guest_print_test.c+11−11

This diff is large: its 42 lines aren’t shown here.

tools/testing/selftests/kvm/hardware_disable_test.c+3−3

This diff is large: its 27 lines aren’t shown here.

tools/testing/selftests/kvm/include/arm64/arch_timer.h+15−15

This diff is large: its 100 lines aren’t shown here.

tools/testing/selftests/kvm/include/arm64/delay.h+2−2

This diff is large: its 13 lines aren’t shown here.

tools/testing/selftests/kvm/include/arm64/gic.h+4−4

This diff is large: its 21 lines aren’t shown here.

tools/testing/selftests/kvm/include/arm64/gic_v3_its.h+3−4

This diff is large: its 15 lines aren’t shown here.

tools/testing/selftests/kvm/include/arm64/processor.h+11−11

This diff is large: its 57 lines aren’t shown here.

tools/testing/selftests/kvm/include/arm64/ucall.h+2−2

This diff is large: its 12 lines aren’t shown here.

tools/testing/selftests/kvm/include/arm64/vgic.h+11−11

This diff is large: its 39 lines aren’t shown here.

tools/testing/selftests/kvm/include/kvm_util.h+166−180

This diff is large: its 806 lines aren’t shown here.

tools/testing/selftests/kvm/include/kvm_util_types.h+5−3

This diff is large: its 22 lines aren’t shown here.

tools/testing/selftests/kvm/include/loongarch/arch_timer.h+2−2

This diff is large: its 12 lines aren’t shown here.

tools/testing/selftests/kvm/include/loongarch/ucall.h+2−2

This diff is large: its 12 lines aren’t shown here.

tools/testing/selftests/kvm/include/memstress.h+15−15

This diff is large: its 73 lines aren’t shown here.

tools/testing/selftests/kvm/include/riscv/arch_timer.h+11−11

This diff is large: its 55 lines aren’t shown here.

tools/testing/selftests/kvm/include/riscv/processor.h+4−5

This diff is large: its 28 lines aren’t shown here.

tools/testing/selftests/kvm/include/riscv/ucall.h+2−2

This diff is large: its 14 lines aren’t shown here.

tools/testing/selftests/kvm/include/s390/diag318_test_handler.h+1−1

This diff is large: its 8 lines aren’t shown here.

tools/testing/selftests/kvm/include/s390/facility.h+2−2

This diff is large: its 18 lines aren’t shown here.

tools/testing/selftests/kvm/include/s390/ucall.h+2−2

This diff is large: its 14 lines aren’t shown here.

tools/testing/selftests/kvm/include/sparsebit.h+3−3

This diff is large: its 20 lines aren’t shown here.

tools/testing/selftests/kvm/include/test_util.h+21−19

This diff is large: its 117 lines aren’t shown here.

tools/testing/selftests/kvm/include/timer_test.h+9−9

This diff is large: its 31 lines aren’t shown here.

tools/testing/selftests/kvm/include/ucall_common.h+11−11

This diff is large: its 46 lines aren’t shown here.

tools/testing/selftests/kvm/include/userfaultfd_util.h+3−3

This diff is large: its 20 lines aren’t shown here.

tools/testing/selftests/kvm/include/x86/apic.h+11−11

This diff is large: its 54 lines aren’t shown here.

tools/testing/selftests/kvm/include/x86/evmcs.h+11−11

This diff is large: its 73 lines aren’t shown here.

tools/testing/selftests/kvm/include/x86/hyperv.h+14−14

This diff is large: its 67 lines aren’t shown here.

tools/testing/selftests/kvm/include/x86/kvm_util_arch.h+18−18

This diff is large: its 59 lines aren’t shown here.

tools/testing/selftests/kvm/include/x86/pmu.h+5−4

This diff is large: its 29 lines aren’t shown here.

tools/testing/selftests/kvm/include/x86/processor.h+144−148

This diff is large: its 726 lines aren’t shown here.

tools/testing/selftests/kvm/include/x86/sev.h+10−10

This diff is large: its 53 lines aren’t shown here.

tools/testing/selftests/kvm/include/x86/smm.h+1−2

This diff is large: its 10 lines aren’t shown here.

tools/testing/selftests/kvm/include/x86/svm_util.h+6−6

This diff is large: its 37 lines aren’t shown here.

tools/testing/selftests/kvm/include/x86/ucall.h+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/include/x86/vmx.h+35−35

This diff is large: its 189 lines aren’t shown here.

tools/testing/selftests/kvm/kvm_page_table_test.c+27−27

This diff is large: its 156 lines aren’t shown here.

tools/testing/selftests/kvm/lib/arm64/gic.c+3−3

This diff is large: its 27 lines aren’t shown here.

tools/testing/selftests/kvm/lib/arm64/gic_private.h+13−13

This diff is large: its 34 lines aren’t shown here.

tools/testing/selftests/kvm/lib/arm64/gic_v3.c+45−45

This diff is large: its 258 lines aren’t shown here.

tools/testing/selftests/kvm/lib/arm64/gic_v3_its.c+5−6

This diff is large: its 39 lines aren’t shown here.

tools/testing/selftests/kvm/lib/arm64/processor.c+82−83

This diff is large: its 407 lines aren’t shown here.

tools/testing/selftests/kvm/lib/arm64/ucall.c+6−6

This diff is large: its 34 lines aren’t shown here.

tools/testing/selftests/kvm/lib/arm64/vgic.c+20−20

This diff is large: its 105 lines aren’t shown here.

tools/testing/selftests/kvm/lib/elf.c+8−9

This diff is large: its 30 lines aren’t shown here.

tools/testing/selftests/kvm/lib/guest_modes.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/lib/guest_sprintf.c+9−9

This diff is large: its 58 lines aren’t shown here.

tools/testing/selftests/kvm/lib/kvm_util.c+144−215

This diff is large: its 859 lines aren’t shown here.

tools/testing/selftests/kvm/lib/loongarch/processor.c+55−55

This diff is large: its 267 lines aren’t shown here.

tools/testing/selftests/kvm/lib/loongarch/ucall.c+6−6

This diff is large: its 35 lines aren’t shown here.

tools/testing/selftests/kvm/lib/memstress.c+19−19

This diff is large: its 118 lines aren’t shown here.

tools/testing/selftests/kvm/lib/riscv/processor.c+45−46

This diff is large: its 246 lines aren’t shown here.

tools/testing/selftests/kvm/lib/s390/diag318_test_handler.c+6−6

This diff is large: its 38 lines aren’t shown here.

tools/testing/selftests/kvm/lib/s390/facility.c+1−1

This diff is large: its 7 lines aren’t shown here.

tools/testing/selftests/kvm/lib/s390/processor.c+31−34

This diff is large: its 171 lines aren’t shown here.

tools/testing/selftests/kvm/lib/sparsebit.c+9−9

This diff is large: its 49 lines aren’t shown here.

tools/testing/selftests/kvm/lib/test_util.c+15−15

This diff is large: its 94 lines aren’t shown here.

tools/testing/selftests/kvm/lib/ucall_common.c+17−17

This diff is large: its 108 lines aren’t shown here.

tools/testing/selftests/kvm/lib/userfaultfd_util.c+7−7

This diff is large: its 50 lines aren’t shown here.

tools/testing/selftests/kvm/lib/x86/apic.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/lib/x86/hyperv.c+7−7

This diff is large: its 41 lines aren’t shown here.

tools/testing/selftests/kvm/lib/x86/memstress.c+7−7

This diff is large: its 63 lines aren’t shown here.

tools/testing/selftests/kvm/lib/x86/pmu.c+4−4

This diff is large: its 36 lines aren’t shown here.

tools/testing/selftests/kvm/lib/x86/processor.c+142−150

This diff is large: its 726 lines aren’t shown here.

tools/testing/selftests/kvm/lib/x86/sev.c+10−10

This diff is large: its 77 lines aren’t shown here.

tools/testing/selftests/kvm/lib/x86/svm.c+8−8

This diff is large: its 52 lines aren’t shown here.

tools/testing/selftests/kvm/lib/x86/ucall.c+2−2

This diff is large: its 12 lines aren’t shown here.

tools/testing/selftests/kvm/lib/x86/vmx.c+22−22

This diff is large: its 159 lines aren’t shown here.

tools/testing/selftests/kvm/loongarch/arch_timer.c+14−14

This diff is large: its 74 lines aren’t shown here.

tools/testing/selftests/kvm/loongarch/pmu_test.c+5−5

This diff is large: its 38 lines aren’t shown here.

tools/testing/selftests/kvm/memslot_modification_stress_test.c+5−5

This diff is large: its 32 lines aren’t shown here.

tools/testing/selftests/kvm/memslot_perf_test.c+82−82

This diff is large: its 452 lines aren’t shown here.

tools/testing/selftests/kvm/mmu_stress_test.c+14−14

This diff is large: its 98 lines aren’t shown here.

tools/testing/selftests/kvm/pre_fault_memory_test.c+6−6

This diff is large: its 37 lines aren’t shown here.

tools/testing/selftests/kvm/riscv/arch_timer.c+4−4

This diff is large: its 30 lines aren’t shown here.

tools/testing/selftests/kvm/riscv/ebreak_test.c+3−3

This diff is large: its 22 lines aren’t shown here.

tools/testing/selftests/kvm/riscv/get-reg-list.c+2−2

This diff is large: its 18 lines aren’t shown here.

tools/testing/selftests/kvm/riscv/sbi_pmu_test.c+4−4

This diff is large: its 36 lines aren’t shown here.

tools/testing/selftests/kvm/s390/debug_test.c+4−4

This diff is large: its 36 lines aren’t shown here.

tools/testing/selftests/kvm/s390/irq_routing.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/s390/memop.c+47−47

This diff is large: its 243 lines aren’t shown here.

tools/testing/selftests/kvm/s390/resets.c+3−3

This diff is large: its 21 lines aren’t shown here.

tools/testing/selftests/kvm/s390/shared_zeropage_test.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/s390/tprot.c+12−12

This diff is large: its 78 lines aren’t shown here.

tools/testing/selftests/kvm/s390/ucontrol_test.c+4−4

This diff is large: its 36 lines aren’t shown here.

tools/testing/selftests/kvm/set_memory_region_test.c+20−20

This diff is large: its 124 lines aren’t shown here.

tools/testing/selftests/kvm/steal_time.c+42−37

This diff is large: its 255 lines aren’t shown here.

tools/testing/selftests/kvm/system_counter_offset_test.c+6−6

This diff is large: its 45 lines aren’t shown here.

tools/testing/selftests/kvm/x86/amx_test.c+7−7

This diff is large: its 42 lines aren’t shown here.

tools/testing/selftests/kvm/x86/aperfmperf_test.c+8−8

This diff is large: its 45 lines aren’t shown here.

tools/testing/selftests/kvm/x86/apic_bus_clock_test.c+12−12

This diff is large: its 64 lines aren’t shown here.

tools/testing/selftests/kvm/x86/cpuid_test.c+3−3

This diff is large: its 22 lines aren’t shown here.

tools/testing/selftests/kvm/x86/debug_regs.c+2−2

This diff is large: its 18 lines aren’t shown here.

tools/testing/selftests/kvm/x86/dirty_log_page_splitting_test.c+8−8

This diff is large: its 37 lines aren’t shown here.

tools/testing/selftests/kvm/x86/evmcs_smm_controls_test.c+3−3

This diff is large: its 25 lines aren’t shown here.

tools/testing/selftests/kvm/x86/fastops_test.c+26−26

This diff is large: its 135 lines aren’t shown here.

tools/testing/selftests/kvm/x86/feature_msrs_test.c+6−6

This diff is large: its 38 lines aren’t shown here.

tools/testing/selftests/kvm/x86/fix_hypercall_test.c+10−10

This diff is large: its 47 lines aren’t shown here.

tools/testing/selftests/kvm/x86/flds_emulation.h+3−3

This diff is large: its 20 lines aren’t shown here.

tools/testing/selftests/kvm/x86/hwcr_msr_test.c+5−5

This diff is large: its 17 lines aren’t shown here.

tools/testing/selftests/kvm/x86/hyperv_clock.c+3−3

This diff is large: its 27 lines aren’t shown here.

tools/testing/selftests/kvm/x86/hyperv_evmcs.c+5−5

This diff is large: its 38 lines aren’t shown here.

tools/testing/selftests/kvm/x86/hyperv_extended_hypercalls.c+10−10

This diff is large: its 55 lines aren’t shown here.

tools/testing/selftests/kvm/x86/hyperv_features.c+13−13

This diff is large: its 85 lines aren’t shown here.

tools/testing/selftests/kvm/x86/hyperv_ipi.c+6−6

This diff is large: its 52 lines aren’t shown here.

tools/testing/selftests/kvm/x86/hyperv_svm_test.c+5−5

This diff is large: its 38 lines aren’t shown here.

tools/testing/selftests/kvm/x86/hyperv_tlb_flush.c+18−18

This diff is large: its 97 lines aren’t shown here.

tools/testing/selftests/kvm/x86/kvm_buslock_test.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/x86/kvm_clock_test.c+7−7

This diff is large: its 49 lines aren’t shown here.

tools/testing/selftests/kvm/x86/kvm_pv_test.c+5−5

This diff is large: its 38 lines aren’t shown here.

tools/testing/selftests/kvm/x86/monitor_mwait_test.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/x86/nested_close_kvm_test.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/x86/nested_dirty_log_test.c+5−5

This diff is large: its 32 lines aren’t shown here.

tools/testing/selftests/kvm/x86/nested_emulation_test.c+10−10

This diff is large: its 50 lines aren’t shown here.

tools/testing/selftests/kvm/x86/nested_exceptions_test.c+3−3

This diff is large: its 27 lines aren’t shown here.

tools/testing/selftests/kvm/x86/nested_invalid_cr3_test.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/x86/nested_set_state_test.c+2−2

This diff is large: its 17 lines aren’t shown here.

tools/testing/selftests/kvm/x86/nested_tsc_adjust_test.c+6−6

This diff is large: its 48 lines aren’t shown here.

tools/testing/selftests/kvm/x86/nested_tsc_scaling_test.c+13−13

This diff is large: its 62 lines aren’t shown here.

tools/testing/selftests/kvm/x86/nested_vmsave_vmload_test.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/x86/nx_huge_pages_test.c+9−9

This diff is large: its 51 lines aren’t shown here.

tools/testing/selftests/kvm/x86/platform_info_test.c+3−3

This diff is large: its 20 lines aren’t shown here.

tools/testing/selftests/kvm/x86/pmu_counters_test.c+54−55

This diff is large: its 296 lines aren’t shown here.

tools/testing/selftests/kvm/x86/pmu_event_filter_test.c+51−51

This diff is large: its 291 lines aren’t shown here.

tools/testing/selftests/kvm/x86/private_mem_conversions_test.c+39−39

This diff is large: its 220 lines aren’t shown here.

tools/testing/selftests/kvm/x86/private_mem_kvm_exits_test.c+7−7

This diff is large: its 49 lines aren’t shown here.

tools/testing/selftests/kvm/x86/set_boot_cpu_id.c+3−3

This diff is large: its 23 lines aren’t shown here.

tools/testing/selftests/kvm/x86/set_sregs_test.c+3−3

This diff is large: its 21 lines aren’t shown here.

tools/testing/selftests/kvm/x86/sev_init2_tests.c+3−3

This diff is large: its 27 lines aren’t shown here.

tools/testing/selftests/kvm/x86/sev_smoke_test.c+11−11

This diff is large: its 81 lines aren’t shown here.

tools/testing/selftests/kvm/x86/smaller_maxphyaddr_emulation_test.c+4−4

This diff is large: its 22 lines aren’t shown here.

tools/testing/selftests/kvm/x86/smm_test.c+4−4

This diff is large: its 34 lines aren’t shown here.

tools/testing/selftests/kvm/x86/state_test.c+7−7

This diff is large: its 42 lines aren’t shown here.

tools/testing/selftests/kvm/x86/svm_int_ctl_test.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/x86/svm_lbr_nested_state.c+1−1

This diff is large: its 11 lines aren’t shown here.

tools/testing/selftests/kvm/x86/svm_nested_clear_efer_svme.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/x86/svm_nested_shutdown_test.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/x86/svm_nested_soft_inject_test.c+5−5

This diff is large: its 37 lines aren’t shown here.

tools/testing/selftests/kvm/x86/svm_nested_vmcb12_gpa.c+7−7

This diff is large: its 60 lines aren’t shown here.

tools/testing/selftests/kvm/x86/svm_vmcall_test.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/x86/sync_regs_test.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/x86/triple_fault_event_test.c+2−2

This diff is large: its 16 lines aren’t shown here.

tools/testing/selftests/kvm/x86/tsc_msrs_test.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/x86/tsc_scaling_sync.c+2−2

This diff is large: its 13 lines aren’t shown here.

tools/testing/selftests/kvm/x86/ucna_injection_test.c+23−22

This diff is large: its 120 lines aren’t shown here.

tools/testing/selftests/kvm/x86/userspace_io_test.c+2−2

This diff is large: its 18 lines aren’t shown here.

tools/testing/selftests/kvm/x86/userspace_msr_exit_test.c+29−29

This diff is large: its 211 lines aren’t shown here.

tools/testing/selftests/kvm/x86/vmx_apic_access_test.c+2−2

This diff is large: its 18 lines aren’t shown here.

tools/testing/selftests/kvm/x86/vmx_apicv_updates_test.c+2−2

This diff is large: its 18 lines aren’t shown here.

tools/testing/selftests/kvm/x86/vmx_invalid_nested_guest_state.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/x86/vmx_msrs_test.c+10−12

This diff is large: its 61 lines aren’t shown here.

tools/testing/selftests/kvm/x86/vmx_nested_la57_state_test.c+2−2

This diff is large: its 18 lines aren’t shown here.

tools/testing/selftests/kvm/x86/vmx_pmu_caps_test.c+6−6

This diff is large: its 47 lines aren’t shown here.

tools/testing/selftests/kvm/x86/vmx_preemption_timer_test.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/kvm/x86/xapic_ipi_test.c+32−32

This diff is large: its 134 lines aren’t shown here.

tools/testing/selftests/kvm/x86/xapic_state_test.c+10−10

This diff is large: its 75 lines aren’t shown here.

tools/testing/selftests/kvm/x86/xapic_tpr_test.c+12−12

This diff is large: its 86 lines aren’t shown here.

tools/testing/selftests/kvm/x86/xcr0_cpuid_test.c+4−4

This diff is large: its 29 lines aren’t shown here.

tools/testing/selftests/kvm/x86/xen_shinfo_test.c+11−11

This diff is large: its 60 lines aren’t shown here.

tools/testing/selftests/kvm/x86/xss_msr_test.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/mm/config+1−0

This diff is large: its 5 lines aren’t shown here.

tools/testing/selftests/sched_ext/Makefile+1−0

This diff is large: its 8 lines aren’t shown here.

tools/testing/selftests/sched_ext/non_scx_kfunc_deny.bpf.c+44−0

This diff is large: its 45 lines aren’t shown here.

tools/testing/selftests/sched_ext/non_scx_kfunc_deny.c+47−0

This diff is large: its 48 lines aren’t shown here.

tools/testing/selftests/tc-testing/tc-tests/qdiscs/taprio.json+26−0

This diff is large: its 32 lines aren’t shown here.

tools/testing/vma/include/dup.h+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/vma/include/stubs.h+2−1

This diff is large: its 10 lines aren’t shown here.

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t