lael-labs/linux

Documentation/devicetree/bindings/interconnect/qcom,sdm660.yaml+42−4

@@ -31,11 +31,11 @@ properties: · 30 unmodified lines
31		31
32	clocks:	32	clocks:
33	minItems: 1	33	minItems: 1
34	maxItems: 3	34	maxItems: 7
35		35
36	clock-names:	36	clock-names:
37	minItems: 1	37	minItems: 1
38	maxItems: 3	38	maxItems: 7
39		39
40	required:	40	required:
41	- compatible	41	- compatible
@@ -72,6 +72,32 @@ allOf: · 30 unmodified lines
72	contains:	72	contains:
73	enum:	73	enum:
74	- qcom,sdm660-a2noc	74	- qcom,sdm660-a2noc
		75	then:
		76	properties:
		77	clocks:
		78	items:
		79	- description: Bus Clock.
		80	- description: Bus A Clock.
		81	- description: IPA Clock.
		82	- description: UFS AXI Clock.
		83	- description: Aggregate2 UFS AXI Clock.
		84	- description: Aggregate2 USB3 AXI Clock.
		85	- description: Config NoC USB2 AXI Clock.
		86	clock-names:
		87	items:
		88	- const: bus
		89	- const: bus_a
		90	- const: ipa
		91	- const: ufs_axi
		92	- const: aggre2_ufs_axi
		93	- const: aggre2_usb3_axi
		94	- const: cfg_noc_usb2_axi
		95
		96	- if:
		97	properties:
		98	compatible:
		99	contains:
		100	enum:
75	- qcom,sdm660-bimc	101	- qcom,sdm660-bimc
76	- qcom,sdm660-cnoc	102	- qcom,sdm660-cnoc
77	- qcom,sdm660-gnoc	103	- qcom,sdm660-gnoc
@@ -91,6 +117,7 @@ examples: · 13 unmodified lines
91	- \|	117	- \|
92	#include <dt-bindings/clock/qcom,rpmcc.h>	118	#include <dt-bindings/clock/qcom,rpmcc.h>
93	#include <dt-bindings/clock/qcom,mmcc-sdm660.h>	119	#include <dt-bindings/clock/qcom,mmcc-sdm660.h>
		120	#include <dt-bindings/clock/qcom,gcc-sdm660.h>
94		121
95	bimc: interconnect@1008000 {	122	bimc: interconnect@1008000 {
96	compatible = "qcom,sdm660-bimc";	123	compatible = "qcom,sdm660-bimc";
@@ -123,9 +150,20 @@ examples: · 26 unmodified lines
123	compatible = "qcom,sdm660-a2noc";	150	compatible = "qcom,sdm660-a2noc";
124	reg = <0x01704000 0xc100>;	151	reg = <0x01704000 0xc100>;
125	#interconnect-cells = <1>;	152	#interconnect-cells = <1>;
126	clock-names = "bus", "bus_a";	153	clock-names = "bus",
		154	"bus_a",
		155	"ipa",
		156	"ufs_axi",
		157	"aggre2_ufs_axi",
		158	"aggre2_usb3_axi",
		159	"cfg_noc_usb2_axi";
127	clocks = <&rpmcc RPM_SMD_AGGR2_NOC_CLK>,	160	clocks = <&rpmcc RPM_SMD_AGGR2_NOC_CLK>,
128	<&rpmcc RPM_SMD_AGGR2_NOC_A_CLK>;	161	<&rpmcc RPM_SMD_AGGR2_NOC_A_CLK>,
		162	<&rpmcc RPM_SMD_IPA_CLK>,
		163	<&gcc GCC_UFS_AXI_CLK>,
		164	<&gcc GCC_AGGRE2_UFS_AXI_CLK>,
		165	<&gcc GCC_AGGRE2_USB3_AXI_CLK>,
		166	<&gcc GCC_CFG_NOC_USB2_AXI_CLK>;
129	};	167	};
130		168
131	mnoc: interconnect@1745000 {	169	mnoc: interconnect@1745000 {

Documentation/hwmon/k10temp.rst+0−17

@@ -132,20 +132,3 @@ On Family 17h and Family 18h CPUs, additional temperature sensors may report · 131 unmodified lines
132	Core Complex Die (CCD) temperatures. Up to 8 such temperatures are reported	132	Core Complex Die (CCD) temperatures. Up to 8 such temperatures are reported
133	as temp{3..10}_input, labeled Tccd{1..8}. Actual support depends on the CPU	133	as temp{3..10}_input, labeled Tccd{1..8}. Actual support depends on the CPU
134	variant.	134	variant.
135
136	Various Family 17h and 18h CPUs report voltage and current telemetry
137	information. The following attributes may be reported.
138
139	Attribute Label Description
140	=============== ======= ================
141	in0_input Vcore Core voltage
142	in1_input Vsoc SoC voltage
143	curr1_input Icore Core current
144	curr2_input Isoc SoC current
145	=============== ======= ================
146
147	Current values are raw (unscaled) as reported by the CPU. Core current is
148	reported as multiples of 1A / LSB. SoC is reported as multiples of 0.25A
149	/ LSB. The real current is board specific. Reported currents should be seen
150	as rough guidance, and should be scaled using sensors3.conf as appropriate
151	for a given board.

MAINTAINERS+16−12

@@ -414,7 +414,8 @@ T: git git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 413 unmodified lines
414	F: drivers/acpi/pmic/	414	F: drivers/acpi/pmic/
415		415
416	ACPI THERMAL DRIVER	416	ACPI THERMAL DRIVER
417	M: Zhang Rui <rui.zhang@intel.com>	417	M: Rafael J. Wysocki <rafael@kernel.org>
		418	R: Zhang Rui <rui.zhang@intel.com>
418	L: linux-acpi@vger.kernel.org	419	L: linux-acpi@vger.kernel.org
419	S: Supported	420	S: Supported
420	W: https://01.org/linux-acpi	421	W: https://01.org/linux-acpi
@@ -810,7 +811,7 @@ F: Documentation/devicetree/bindings/dma/altr,msgdma.yaml · 389 unmodified lines
810	F: drivers/dma/altera-msgdma.c	811	F: drivers/dma/altera-msgdma.c
811		812
812	ALTERA PIO DRIVER	813	ALTERA PIO DRIVER
813	M: Joyce Ooi <joyce.ooi@intel.com>	814	M: Mun Yew Tham <mun.yew.tham@intel.com>
814	L: linux-gpio@vger.kernel.org	815	L: linux-gpio@vger.kernel.org
815	S: Maintained	816	S: Maintained
816	F: drivers/gpio/gpio-altera.c	817	F: drivers/gpio/gpio-altera.c
@@ -2961,7 +2962,7 @@ F: crypto/async_tx/ · 2144 unmodified lines
2961	F: include/linux/async_tx.h	2962	F: include/linux/async_tx.h
2962		2963
2963	AT24 EEPROM DRIVER	2964	AT24 EEPROM DRIVER
2964	M: Bartosz Golaszewski <bgolaszewski@baylibre.com>	2965	M: Bartosz Golaszewski <brgl@bgdev.pl>
2965	L: linux-i2c@vger.kernel.org	2966	L: linux-i2c@vger.kernel.org
2966	S: Maintained	2967	S: Maintained
2967	T: git git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux.git	2968	T: git git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux.git
@@ -3384,9 +3385,11 @@ F: Documentation/networking/filter.rst · 416 unmodified lines
3384	F: Documentation/userspace-api/ebpf/	3385	F: Documentation/userspace-api/ebpf/
3385	F: arch//net/	3386	F: arch//net/
3386	F: include/linux/bpf*	3387	F: include/linux/bpf*
		3388	F: include/linux/btf*
3387	F: include/linux/filter.h	3389	F: include/linux/filter.h
3388	F: include/trace/events/xdp.h	3390	F: include/trace/events/xdp.h
3389	F: include/uapi/linux/bpf*	3391	F: include/uapi/linux/bpf*
		3392	F: include/uapi/linux/btf*
3390	F: include/uapi/linux/filter.h	3393	F: include/uapi/linux/filter.h
3391	F: kernel/bpf/	3394	F: kernel/bpf/
3392	F: kernel/trace/bpf_trace.c	3395	F: kernel/trace/bpf_trace.c
@@ -3820,7 +3823,6 @@ F: drivers/scsi/mpi3mr/ · 427 unmodified lines
3820		3823
3821	BROADCOM NETXTREME-E ROCE DRIVER	3824	BROADCOM NETXTREME-E ROCE DRIVER
3822	M: Selvin Xavier <selvin.xavier@broadcom.com>	3825	M: Selvin Xavier <selvin.xavier@broadcom.com>
3823	M: Naresh Kumar PBS <nareshkumar.pbs@broadcom.com>
3824	L: linux-rdma@vger.kernel.org	3826	L: linux-rdma@vger.kernel.org
3825	S: Supported	3827	S: Supported
3826	W: http://www.broadcom.com	3828	W: http://www.broadcom.com
@@ -4655,7 +4657,7 @@ W: http://linux-cifs.samba.org/ · 828 unmodified lines
4655	T: git git://git.samba.org/sfrench/cifs-2.6.git	4657	T: git git://git.samba.org/sfrench/cifs-2.6.git
4656	F: Documentation/admin-guide/cifs/	4658	F: Documentation/admin-guide/cifs/
4657	F: fs/cifs/	4659	F: fs/cifs/
4658	F: fs/cifs_common/	4660	F: fs/smbfs_common/
4659		4661
4660	COMPACTPCI HOTPLUG CORE	4662	COMPACTPCI HOTPLUG CORE
4661	M: Scott Murray <scott@spiteful.org>	4663	M: Scott Murray <scott@spiteful.org>
@@ -7985,7 +7987,7 @@ F: include/linux/gpio/regmap.h · 3323 unmodified lines
7985		7987
7986	GPIO SUBSYSTEM	7988	GPIO SUBSYSTEM
7987	M: Linus Walleij <linus.walleij@linaro.org>	7989	M: Linus Walleij <linus.walleij@linaro.org>
7988	M: Bartosz Golaszewski <bgolaszewski@baylibre.com>	7990	M: Bartosz Golaszewski <brgl@bgdev.pl>
7989	L: linux-gpio@vger.kernel.org	7991	L: linux-gpio@vger.kernel.org
7990	S: Maintained	7992	S: Maintained
7991	T: git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio.git	7993	T: git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio.git
@@ -10193,8 +10195,8 @@ M: Hyunchul Lee <hyc.lee@gmail.com> · 2201 unmodified lines
10193	L: linux-cifs@vger.kernel.org	10195	L: linux-cifs@vger.kernel.org
10194	S: Maintained	10196	S: Maintained
10195	T: git git://git.samba.org/ksmbd.git	10197	T: git git://git.samba.org/ksmbd.git
10196	F: fs/cifs_common/
10197	F: fs/ksmbd/	10198	F: fs/ksmbd/
		10199	F: fs/smbfs_common/
10198		10200
10199	KERNEL UNIT TESTING FRAMEWORK (KUnit)	10201	KERNEL UNIT TESTING FRAMEWORK (KUnit)
10200	M: Brendan Higgins <brendanhiggins@google.com>	10202	M: Brendan Higgins <brendanhiggins@google.com>
@@ -11366,7 +11368,7 @@ F: Documentation/devicetree/bindings/iio/proximity/maxbotix,mb1232.yaml · 1165 unmodified lines
11366	F: drivers/iio/proximity/mb1232.c	11368	F: drivers/iio/proximity/mb1232.c
11367		11369
11368	MAXIM MAX77650 PMIC MFD DRIVER	11370	MAXIM MAX77650 PMIC MFD DRIVER
11369	M: Bartosz Golaszewski <bgolaszewski@baylibre.com>	11371	M: Bartosz Golaszewski <brgl@bgdev.pl>
11370	L: linux-kernel@vger.kernel.org	11372	L: linux-kernel@vger.kernel.org
11371	S: Maintained	11373	S: Maintained
11372	F: Documentation/devicetree/bindings//max77650.yaml	11374	F: Documentation/devicetree/bindings//max77650.yaml
@@ -17883,7 +17885,8 @@ M: Olivier Moysan <olivier.moysan@foss.st.com> · 6510 unmodified lines
17883	M: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>	17885	M: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
17884	L: alsa-devel@alsa-project.org (moderated for non-subscribers)	17886	L: alsa-devel@alsa-project.org (moderated for non-subscribers)
17885	S: Maintained	17887	S: Maintained
17886	F: Documentation/devicetree/bindings/iio/adc/st,stm32-*.yaml	17888	F: Documentation/devicetree/bindings/iio/adc/st,stm32-dfsdm-adc.yaml
		17889	F: Documentation/devicetree/bindings/sound/st,stm32-*.yaml
17887	F: sound/soc/stm/	17890	F: sound/soc/stm/
17888		17891
17889	STM32 TIMER/LPTIMER DRIVERS	17892	STM32 TIMER/LPTIMER DRIVERS
@@ -18547,13 +18550,14 @@ T: git git://linuxtv.org/media_tree.git · 657 unmodified lines
18547	F: drivers/media/radio/radio-raremono.c	18550	F: drivers/media/radio/radio-raremono.c
18548		18551
18549	THERMAL	18552	THERMAL
18550	M: Zhang Rui <rui.zhang@intel.com>	18553	M: Rafael J. Wysocki <rafael@kernel.org>
18551	M: Daniel Lezcano <daniel.lezcano@linaro.org>	18554	M: Daniel Lezcano <daniel.lezcano@linaro.org>
18552	R: Amit Kucheria <amitk@kernel.org>	18555	R: Amit Kucheria <amitk@kernel.org>
		18556	R: Zhang Rui <rui.zhang@intel.com>
18553	L: linux-pm@vger.kernel.org	18557	L: linux-pm@vger.kernel.org
18554	S: Supported	18558	S: Supported
18555	Q: https://patchwork.kernel.org/project/linux-pm/list/	18559	Q: https://patchwork.kernel.org/project/linux-pm/list/
18556	T: git git://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux.git	18560	T: git git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git thermal
18557	F: Documentation/devicetree/bindings/thermal/	18561	F: Documentation/devicetree/bindings/thermal/
18558	F: drivers/thermal/	18562	F: drivers/thermal/
18559	F: include/linux/cpu_cooling.h	18563	F: include/linux/cpu_cooling.h
@@ -18682,7 +18686,7 @@ F: include/linux/clk/ti.h · 122 unmodified lines
18682		18686
18683	TI DAVINCI MACHINE SUPPORT	18687	TI DAVINCI MACHINE SUPPORT
18684	M: Sekhar Nori <nsekhar@ti.com>	18688	M: Sekhar Nori <nsekhar@ti.com>
18685	R: Bartosz Golaszewski <bgolaszewski@baylibre.com>	18689	R: Bartosz Golaszewski <brgl@bgdev.pl>
18686	L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)	18690	L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
18687	S: Supported	18691	S: Supported
18688	T: git git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci.git	18692	T: git git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci.git

Makefile+1−1

@@ -2,7 +2,7 @@ · 1 unmodified line
2	VERSION = 5	2	VERSION = 5
3	PATCHLEVEL = 15	3	PATCHLEVEL = 15
4	SUBLEVEL = 0	4	SUBLEVEL = 0
5	EXTRAVERSION = -rc3	5	EXTRAVERSION = -rc4
6	NAME = Opossums on Parade	6	NAME = Opossums on Parade
7		7
8	# DOCUMENTATION	8	# DOCUMENTATION

arch/arm64/kvm/hyp/nvhe/Makefile+1−1

@@ -54,7 +54,7 @@ $(obj)/kvm_nvhe.tmp.o: $(obj)/hyp.lds $(addprefix $(obj)/,$(hyp-obj)) FORCE · 53 unmodified lines
54	# runtime. Because the hypervisor is part of the kernel binary, relocations	54	# runtime. Because the hypervisor is part of the kernel binary, relocations
55	# produce a kernel VA. We enumerate relocations targeting hyp at build time	55	# produce a kernel VA. We enumerate relocations targeting hyp at build time
56	# and convert the kernel VAs at those positions to hyp VAs.	56	# and convert the kernel VAs at those positions to hyp VAs.
57	$(obj)/hyp-reloc.S: $(obj)/kvm_nvhe.tmp.o $(obj)/gen-hyprel	57	$(obj)/hyp-reloc.S: $(obj)/kvm_nvhe.tmp.o $(obj)/gen-hyprel FORCE
58	$(call if_changed,hyprel)	58	$(call if_changed,hyprel)
59		59
60	# 5) Compile hyp-reloc.S and link it into the existing partially linked object.	60	# 5) Compile hyp-reloc.S and link it into the existing partially linked object.

arch/arm64/kvm/perf.c+0−3

@@ -50,9 +50,6 @@ static struct perf_guest_info_callbacks kvm_guest_cbs = { · 49 unmodified lines
50		50
51	int kvm_perf_init(void)	51	int kvm_perf_init(void)
52	{	52	{
53	if (kvm_pmu_probe_pmuver() != ID_AA64DFR0_PMUVER_IMP_DEF && !is_protected_kvm_enabled())
54	static_branch_enable(&kvm_arm_pmu_available);
55
56	return perf_register_guest_info_callbacks(&kvm_guest_cbs);	53	return perf_register_guest_info_callbacks(&kvm_guest_cbs);
57	}	54	}
58		55

arch/arm64/kvm/pmu-emul.c+8−1

 	kvm_pmu_create_perf_event(vcpu, select_idx);
 }
-int kvm_pmu_probe_pmuver(void)
+void kvm_host_pmu_init(struct arm_pmu *pmu)
+{
+	if (pmu->pmuver != 0 && pmu->pmuver != ID_AA64DFR0_PMUVER_IMP_DEF &&
+	    !kvm_arm_support_pmu_v3() && !is_protected_kvm_enabled())
+		static_branch_enable(&kvm_arm_pmu_available);
+}
+static int kvm_pmu_probe_pmuver(void)
 {
 	struct perf_event_attr attr = { };
 	struct perf_event *event;

arch/m68k/68000/entry.S+0−4

 #include <asm/unistd.h>
 #include <asm/errno.h>
 #include <asm/setup.h>
-#include <asm/segment.h>
 #include <asm/traps.h>
 #include <asm/asm-offsets.h>
 #include <asm/entry.h>
 .globl system_call
 .globl resume
 .globl ret_from_exception
-.globl ret_from_signal
 .globl sys_call_table
 .globl bad_interrupt
 .globl inthandler1
 	subql	#4,%sp			/* dummy return address */
 	SAVE_SWITCH_STACK
 	jbsr	syscall_trace_leave
-ret_from_signal:
 	RESTORE_SWITCH_STACK
 	addql	#4,%sp
 	jra	ret_from_exception

arch/m68k/Kconfig+0−1

@@ -29,7 +29,6 @@ config M68K · 28 unmodified lines
29	select NO_DMA if !MMU && !COLDFIRE	29	select NO_DMA if !MMU && !COLDFIRE
30	select OLD_SIGACTION	30	select OLD_SIGACTION
31	select OLD_SIGSUSPEND3	31	select OLD_SIGSUSPEND3
32	select SET_FS
33	select UACCESS_MEMCPY if !MMU	32	select UACCESS_MEMCPY if !MMU
34	select VIRT_TO_BUS	33	select VIRT_TO_BUS
35	select ZONE_DMA	34	select ZONE_DMA

arch/m68k/coldfire/entry.S+0−4

 #include <asm/thread_info.h>
 #include <asm/errno.h>
 #include <asm/setup.h>
-#include <asm/segment.h>
 #include <asm/asm-offsets.h>
 #include <asm/entry.h>
 .globl system_call
 .globl resume
 .globl ret_from_exception
-.globl ret_from_signal
 .globl sys_call_table
 .globl inthandler
 	subql	#4,%sp			/* dummy return address */
 	SAVE_SWITCH_STACK
 	jbsr	syscall_trace_leave
-ret_from_signal:
 	RESTORE_SWITCH_STACK
 	addql	#4,%sp

arch/m68k/include/asm/processor.h+28−3

@@ -9,7 +9,6 @@ · 8 unmodified lines
9	#define __ASM_M68K_PROCESSOR_H	9	#define __ASM_M68K_PROCESSOR_H
10		10
11	#include <linux/thread_info.h>	11	#include <linux/thread_info.h>
12	#include <asm/segment.h>
13	#include <asm/fpu.h>	12	#include <asm/fpu.h>
14	#include <asm/ptrace.h>	13	#include <asm/ptrace.h>
15		14
@@ -75,11 +74,37 @@ static inline void wrusp(unsigned long usp) · 59 unmodified lines
75	#define TASK_UNMAPPED_BASE 0	74	#define TASK_UNMAPPED_BASE 0
76	#endif	75	#endif
77		76
		77	/* Address spaces (or Function Codes in Motorola lingo) */
		78	#define USER_DATA 1
		79	#define USER_PROGRAM 2
		80	#define SUPER_DATA 5
		81	#define SUPER_PROGRAM 6
		82	#define CPU_SPACE 7
		83
		84	#ifdef CONFIG_CPU_HAS_ADDRESS_SPACES
		85	/*
		86	* Set the SFC/DFC registers for special MM operations. For most normal
		87	* operation these remain set to USER_DATA for the uaccess routines.
		88	*/
		89	static inline void set_fc(unsigned long val)
		90	{
		91	WARN_ON_ONCE(in_interrupt());
		92
		93	__asm__ __volatile__ ("movec %0,%/sfc\n\t"
		94	"movec %0,%/dfc\n\t"
		95	: /* no outputs */ : "r" (val) : "memory");
		96	}
		97	#else
		98	static inline void set_fc(unsigned long val)
		99	{
		100	}
		101	#endif /* CONFIG_CPU_HAS_ADDRESS_SPACES */
		102
78	struct thread_struct {	103	struct thread_struct {
79	unsigned long ksp; /* kernel stack pointer */	104	unsigned long ksp; /* kernel stack pointer */
80	unsigned long usp; /* user stack pointer */	105	unsigned long usp; /* user stack pointer */
81	unsigned short sr; /* saved status register */	106	unsigned short sr; /* saved status register */
82	unsigned short fs; /* saved fs (sfc, dfc) */	107	unsigned short fc; /* saved fc (sfc, dfc) */
83	unsigned long crp[2]; /* cpu root pointer */	108	unsigned long crp[2]; /* cpu root pointer */
84	unsigned long esp0; /* points to SR of stack frame */	109	unsigned long esp0; /* points to SR of stack frame */
85	unsigned long faddr; /* info about last fault */	110	unsigned long faddr; /* info about last fault */
@@ -92,7 +117,7 @@ struct thread_struct { · 6 unmodified lines
92	#define INIT_THREAD { \	117	#define INIT_THREAD { \
93	.ksp = sizeof(init_stack) + (unsigned long) init_stack, \	118	.ksp = sizeof(init_stack) + (unsigned long) init_stack, \
94	.sr = PS_S, \	119	.sr = PS_S, \
95	.fs = __KERNEL_DS, \	120	.fc = USER_DATA, \
96	}	121	}
97		122
98	/*	123	/*

arch/m68k/include/asm/segment.h+0−59

@@ -1,59 +0,0 @@
1	/* SPDX-License-Identifier: GPL-2.0 */
2	#ifndef _M68K_SEGMENT_H
3	#define _M68K_SEGMENT_H
4
5	/* define constants */
6	/* Address spaces (FC0-FC2) */
7	#define USER_DATA (1)
8	#ifndef __USER_DS
9	#define __USER_DS (USER_DATA)
10	#endif
11	#define USER_PROGRAM (2)
12	#define SUPER_DATA (5)
13	#ifndef __KERNEL_DS
14	#define __KERNEL_DS (SUPER_DATA)
15	#endif
16	#define SUPER_PROGRAM (6)
17	#define CPU_SPACE (7)
18
19	#ifndef __ASSEMBLY__
20
21	typedef struct {
22	unsigned long seg;
23	} mm_segment_t;
24
25	#define MAKE_MM_SEG(s) ((mm_segment_t) { (s) })
26
27	#ifdef CONFIG_CPU_HAS_ADDRESS_SPACES
28	/*
29	* Get/set the SFC/DFC registers for MOVES instructions
30	*/
31	#define USER_DS MAKE_MM_SEG(__USER_DS)
32	#define KERNEL_DS MAKE_MM_SEG(__KERNEL_DS)
33
34	static inline mm_segment_t get_fs(void)
35	{
36	mm_segment_t _v;
37	__asm__ ("movec %/dfc,%0":"=r" (_v.seg):);
38	return _v;
39	}
40
41	static inline void set_fs(mm_segment_t val)
42	{
43	__asm__ __volatile__ ("movec %0,%/sfc\n\t"
44	"movec %0,%/dfc\n\t"
45	: /* no outputs */ : "r" (val.seg) : "memory");
46	}
47
48	#else
49	#define USER_DS MAKE_MM_SEG(TASK_SIZE)
50	#define KERNEL_DS MAKE_MM_SEG(0xFFFFFFFF)
51	#define get_fs() (current_thread_info()->addr_limit)
52	#define set_fs(x) (current_thread_info()->addr_limit = (x))
53	#endif
54
55	#define uaccess_kernel() (get_fs().seg == KERNEL_DS.seg)
56
57	#endif /* __ASSEMBLY__ */
58
59	#endif /* _M68K_SEGMENT_H */

arch/m68k/include/asm/thread_info.h+0−3

 #include <asm/types.h>
 #include <asm/page.h>
-#include <asm/segment.h>
 /*
  * On machines with 4k pages we default to an 8k thread size, though we
 struct thread_info {
 	struct task_struct	*task;		/* main task structure */
 	unsigned long		flags;
-	mm_segment_t		addr_limit;	/* thread address space */
 	int			preempt_count;	/* 0 => preemptable, <0 => BUG */
 	__u32			cpu;		/* should always be 0 on m68k */
 	unsigned long		tp_value;	/* thread pointer */
 #define INIT_THREAD_INFO(tsk)			\
 {						\
 	.task		= &tsk,			\
-	.addr_limit	= KERNEL_DS,		\
 	.preempt_count	= INIT_PREEMPT_COUNT,	\
 }

arch/m68k/include/asm/tlbflush.h+3−8

 	if (CPU_IS_COLDFIRE) {
 		mmu_write(MMUOR, MMUOR_CNL);
 	} else if (CPU_IS_040_OR_060) {
-		mm_segment_t old_fs = get_fs();
+		set_fc(SUPER_DATA);
-		set_fs(KERNEL_DS);
 		__asm__ __volatile__(".chip 68040\n\t"
 				     "pflush (%0)\n\t"
 				     ".chip 68k"
 				     : : "a" (addr));
-		set_fs(old_fs);
+		set_fc(USER_DATA);
 	} else if (CPU_IS_020_OR_030)
 		__asm__ __volatile__("pflush #4,#4,(%0)" : : "a" (addr));
 }
 static inline void flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
 {
-	if (vma->vm_mm == current->active_mm) {
+	if (vma->vm_mm == current->active_mm)
-		mm_segment_t old_fs = force_uaccess_begin();
 		__flush_tlb_one(addr);
-		force_uaccess_end(old_fs);
-	}
 }
 static inline void flush_tlb_range(struct vm_area_struct *vma,

arch/m68k/include/asm/traps.h+4−0

@@ -267,6 +267,10 @@ struct frame { · 266 unmodified lines
267	} un;	267	} un;
268	};	268	};
269		269
		270	#ifdef CONFIG_M68040
		271	asmlinkage void berr_040cleanup(struct frame *fp);
		272	#endif
		273
270	#endif /* __ASSEMBLY__ */	274	#endif /* __ASSEMBLY__ */
271		275
272	#endif /* _M68K_TRAPS_H */	276	#endif /* _M68K_TRAPS_H */

arch/m68k/include/asm/uaccess.h+141−74

@@ -9,13 +9,16 @@ · 8 unmodified lines
9	*/	9	*/
10	#include <linux/compiler.h>	10	#include <linux/compiler.h>
11	#include <linux/types.h>	11	#include <linux/types.h>
12	#include <asm/segment.h>
13	#include <asm/extable.h>	12	#include <asm/extable.h>
14		13
15	/* We let the MMU do all checking */	14	/* We let the MMU do all checking */
16	static inline int access_ok(const void __user *addr,	15	static inline int access_ok(const void __user *addr,
17	unsigned long size)	16	unsigned long size)
18	{	17	{
		18	/*
		19	* XXX: for !CONFIG_CPU_HAS_ADDRESS_SPACES this really needs to check
		20	* for TASK_SIZE!
		21	*/
19	return 1;	22	return 1;
20	}	23	}
21		24
@@ -35,12 +38,9 @@ static inline int access_ok(const void __user *addr, · 13 unmodified lines
35	#define MOVES "move"	38	#define MOVES "move"
36	#endif	39	#endif
37		40
38	extern int __put_user_bad(void);	41	#define __put_user_asm(inst, res, x, ptr, bwl, reg, err) \
39	extern int __get_user_bad(void);
40
41	#define __put_user_asm(res, x, ptr, bwl, reg, err) \
42	asm volatile ("\n" \	42	asm volatile ("\n" \
43	"1: "MOVES"."#bwl" %2,%1\n" \	43	"1: "inst"."#bwl" %2,%1\n" \
44	"2:\n" \	44	"2:\n" \
45	" .section .fixup,\"ax\"\n" \	45	" .section .fixup,\"ax\"\n" \
46	" .even\n" \	46	" .even\n" \
@@ -56,6 +56,31 @@ asm volatile ("\n" \ · 9 unmodified lines
56	: "+d" (res), "=m" (*(ptr)) \	56	: "+d" (res), "=m" (*(ptr)) \
57	: #reg (x), "i" (err))	57	: #reg (x), "i" (err))
58		58
		59	#define __put_user_asm8(inst, res, x, ptr) \
		60	do { \
		61	const void __pu_ptr = (const void __force )(ptr); \
		62	\
		63	asm volatile ("\n" \
		64	"1: "inst".l %2,(%1)+\n" \
		65	"2: "inst".l %R2,(%1)\n" \
		66	"3:\n" \
		67	" .section .fixup,\"ax\"\n" \
		68	" .even\n" \
		69	"10: movel %3,%0\n" \
		70	" jra 3b\n" \
		71	" .previous\n" \
		72	"\n" \
		73	" .section __ex_table,\"a\"\n" \
		74	" .align 4\n" \
		75	" .long 1b,10b\n" \
		76	" .long 2b,10b\n" \
		77	" .long 3b,10b\n" \
		78	" .previous" \
		79	: "+d" (res), "+a" (__pu_ptr) \
		80	: "r" (x), "i" (-EFAULT) \
		81	: "memory"); \
		82	} while (0)
		83
59	/*	84	/*
60	* These are the main single-value transfer routines. They automatically	85	* These are the main single-value transfer routines. They automatically
61	* use the right size if we just have the right pointer type.	86	* use the right size if we just have the right pointer type.
@@ -68,51 +93,29 @@ asm volatile ("\n" \ · 6 unmodified lines
68	__chk_user_ptr(ptr); \	93	__chk_user_ptr(ptr); \
69	switch (sizeof (*(ptr))) { \	94	switch (sizeof (*(ptr))) { \
70	case 1: \	95	case 1: \
71	__put_user_asm(__pu_err, __pu_val, ptr, b, d, -EFAULT); \	96	__put_user_asm(MOVES, __pu_err, __pu_val, ptr, b, d, -EFAULT); \
72	break; \	97	break; \
73	case 2: \	98	case 2: \
74	__put_user_asm(__pu_err, __pu_val, ptr, w, r, -EFAULT); \	99	__put_user_asm(MOVES, __pu_err, __pu_val, ptr, w, r, -EFAULT); \
75	break; \	100	break; \
76	case 4: \	101	case 4: \
77	__put_user_asm(__pu_err, __pu_val, ptr, l, r, -EFAULT); \	102	__put_user_asm(MOVES, __pu_err, __pu_val, ptr, l, r, -EFAULT); \
78	break; \	103	break; \
79	case 8: \	104	case 8: \
80	{ \	105	__put_user_asm8(MOVES, __pu_err, __pu_val, ptr); \
81	const void __user *__pu_ptr = (ptr); \
82	asm volatile ("\n" \
83	"1: "MOVES".l %2,(%1)+\n" \
84	"2: "MOVES".l %R2,(%1)\n" \
85	"3:\n" \
86	" .section .fixup,\"ax\"\n" \
87	" .even\n" \
88	"10: movel %3,%0\n" \
89	" jra 3b\n" \
90	" .previous\n" \
91	"\n" \
92	" .section __ex_table,\"a\"\n" \
93	" .align 4\n" \
94	" .long 1b,10b\n" \
95	" .long 2b,10b\n" \
96	" .long 3b,10b\n" \
97	" .previous" \
98	: "+d" (__pu_err), "+a" (__pu_ptr) \
99	: "r" (__pu_val), "i" (-EFAULT) \
100	: "memory"); \
101	break; \	106	break; \
102	} \
103	default: \	107	default: \
104	__pu_err = __put_user_bad(); \	108	BUILD_BUG(); \
105	break; \
106	} \	109	} \
107	__pu_err; \	110	__pu_err; \
108	})	111	})
109	#define put_user(x, ptr) __put_user(x, ptr)	112	#define put_user(x, ptr) __put_user(x, ptr)
110		113
111		114
112	#define __get_user_asm(res, x, ptr, type, bwl, reg, err) ({ \	115	#define __get_user_asm(inst, res, x, ptr, type, bwl, reg, err) ({ \
113	type __gu_val; \	116	type __gu_val; \
114	asm volatile ("\n" \	117	asm volatile ("\n" \
115	"1: "MOVES"."#bwl" %2,%1\n" \	118	"1: "inst"."#bwl" %2,%1\n" \
116	"2:\n" \	119	"2:\n" \
117	" .section .fixup,\"ax\"\n" \	120	" .section .fixup,\"ax\"\n" \
118	" .even\n" \	121	" .even\n" \
@@ -130,53 +133,57 @@ asm volatile ("\n" \ · 11 unmodified lines
130	(x) = (__force typeof(*(ptr)))(__force unsigned long)__gu_val; \	133	(x) = (__force typeof(*(ptr)))(__force unsigned long)__gu_val; \
131	})	134	})
132		135
		136	#define __get_user_asm8(inst, res, x, ptr) \
		137	do { \
		138	const void __gu_ptr = (const void __force )(ptr); \
		139	union { \
		140	u64 l; \
		141	__typeof__(*(ptr)) t; \
		142	} __gu_val; \
		143	\
		144	asm volatile ("\n" \
		145	"1: "inst".l (%2)+,%1\n" \
		146	"2: "inst".l (%2),%R1\n" \
		147	"3:\n" \
		148	" .section .fixup,\"ax\"\n" \
		149	" .even\n" \
		150	"10: move.l %3,%0\n" \
		151	" sub.l %1,%1\n" \
		152	" sub.l %R1,%R1\n" \
		153	" jra 3b\n" \
		154	" .previous\n" \
		155	"\n" \
		156	" .section __ex_table,\"a\"\n" \
		157	" .align 4\n" \
		158	" .long 1b,10b\n" \
		159	" .long 2b,10b\n" \
		160	" .previous" \
		161	: "+d" (res), "=&r" (__gu_val.l), \
		162	"+a" (__gu_ptr) \
		163	: "i" (-EFAULT) \
		164	: "memory"); \
		165	(x) = __gu_val.t; \
		166	} while (0)
		167
133	#define __get_user(x, ptr) \	168	#define __get_user(x, ptr) \
134	({ \	169	({ \
135	int __gu_err = 0; \	170	int __gu_err = 0; \
136	__chk_user_ptr(ptr); \	171	__chk_user_ptr(ptr); \
137	switch (sizeof(*(ptr))) { \	172	switch (sizeof(*(ptr))) { \
138	case 1: \	173	case 1: \
139	__get_user_asm(__gu_err, x, ptr, u8, b, d, -EFAULT); \	174	__get_user_asm(MOVES, __gu_err, x, ptr, u8, b, d, -EFAULT); \
140	break; \	175	break; \
141	case 2: \	176	case 2: \
142	__get_user_asm(__gu_err, x, ptr, u16, w, r, -EFAULT); \	177	__get_user_asm(MOVES, __gu_err, x, ptr, u16, w, r, -EFAULT); \
143	break; \	178	break; \
144	case 4: \	179	case 4: \
145	__get_user_asm(__gu_err, x, ptr, u32, l, r, -EFAULT); \	180	__get_user_asm(MOVES, __gu_err, x, ptr, u32, l, r, -EFAULT); \
146	break; \	181	break; \
147	case 8: { \	182	case 8: \
148	const void __user *__gu_ptr = (ptr); \	183	__get_user_asm8(MOVES, __gu_err, x, ptr); \
149	union { \
150	u64 l; \
151	__typeof__(*(ptr)) t; \
152	} __gu_val; \
153	asm volatile ("\n" \
154	"1: "MOVES".l (%2)+,%1\n" \
155	"2: "MOVES".l (%2),%R1\n" \
156	"3:\n" \
157	" .section .fixup,\"ax\"\n" \
158	" .even\n" \
159	"10: move.l %3,%0\n" \
160	" sub.l %1,%1\n" \
161	" sub.l %R1,%R1\n" \
162	" jra 3b\n" \
163	" .previous\n" \
164	"\n" \
165	" .section __ex_table,\"a\"\n" \
166	" .align 4\n" \
167	" .long 1b,10b\n" \
168	" .long 2b,10b\n" \
169	" .previous" \
170	: "+d" (__gu_err), "=&r" (__gu_val.l), \
171	"+a" (__gu_ptr) \
172	: "i" (-EFAULT) \
173	: "memory"); \
174	(x) = __gu_val.t; \
175	break; \	184	break; \
176	} \
177	default: \	185	default: \
178	__gu_err = __get_user_bad(); \	186	BUILD_BUG(); \
179	break; \
180	} \	187	} \
181	__gu_err; \	188	__gu_err; \
182	})	189	})
@@ -322,16 +329,19 @@ __constant_copy_to_user(void __user to, const void from, unsigned long n) · 139 unmodified lines
322		329
323	switch (n) {	330	switch (n) {
324	case 1:	331	case 1:
325	__put_user_asm(res, (u8 )from, (u8 __user *)to, b, d, 1);	332	__put_user_asm(MOVES, res, (u8 )from, (u8 __user *)to,
		333	b, d, 1);
326	break;	334	break;
327	case 2:	335	case 2:
328	__put_user_asm(res, (u16 )from, (u16 __user *)to, w, r, 2);	336	__put_user_asm(MOVES, res, (u16 )from, (u16 __user *)to,
		337	w, r, 2);
329	break;	338	break;
330	case 3:	339	case 3:
331	__constant_copy_to_user_asm(res, to, from, tmp, 3, w, b,);	340	__constant_copy_to_user_asm(res, to, from, tmp, 3, w, b,);
332	break;	341	break;
333	case 4:	342	case 4:
334	__put_user_asm(res, (u32 )from, (u32 __user *)to, l, r, 4);	343	__put_user_asm(MOVES, res, (u32 )from, (u32 __user *)to,
		344	l, r, 4);
335	break;	345	break;
336	case 5:	346	case 5:
337	__constant_copy_to_user_asm(res, to, from, tmp, 5, l, b,);	347	__constant_copy_to_user_asm(res, to, from, tmp, 5, l, b,);
@@ -380,8 +390,65 @@ raw_copy_to_user(void __user to, const void from, unsigned long n) · 42 unmodified lines
380	#define INLINE_COPY_FROM_USER	390	#define INLINE_COPY_FROM_USER
381	#define INLINE_COPY_TO_USER	391	#define INLINE_COPY_TO_USER
382		392
383	#define user_addr_max() \	393	#define HAVE_GET_KERNEL_NOFAULT
384	(uaccess_kernel() ? ~0UL : TASK_SIZE)	394
		395	#define __get_kernel_nofault(dst, src, type, err_label) \
		396	do { \
		397	type __gk_dst = (type )(dst); \
		398	type __gk_src = (type )(src); \
		399	int __gk_err = 0; \
		400	\
		401	switch (sizeof(type)) { \
		402	case 1: \
		403	__get_user_asm("move", __gk_err, *__gk_dst, __gk_src, \
		404	u8, b, d, -EFAULT); \
		405	break; \
		406	case 2: \
		407	__get_user_asm("move", __gk_err, *__gk_dst, __gk_src, \
		408	u16, w, r, -EFAULT); \
		409	break; \
		410	case 4: \
		411	__get_user_asm("move", __gk_err, *__gk_dst, __gk_src, \
		412	u32, l, r, -EFAULT); \
		413	break; \
		414	case 8: \
		415	__get_user_asm8("move", __gk_err, *__gk_dst, __gk_src); \
		416	break; \
		417	default: \
		418	BUILD_BUG(); \
		419	} \
		420	if (unlikely(__gk_err)) \
		421	goto err_label; \
		422	} while (0)
		423
		424	#define __put_kernel_nofault(dst, src, type, err_label) \
		425	do { \
		426	type __pk_src = (type )(src); \
		427	type __pk_dst = (type )(dst); \
		428	int __pk_err = 0; \
		429	\
		430	switch (sizeof(type)) { \
		431	case 1: \
		432	__put_user_asm("move", __pk_err, __pk_src, __pk_dst, \
		433	b, d, -EFAULT); \
		434	break; \
		435	case 2: \
		436	__put_user_asm("move", __pk_err, __pk_src, __pk_dst, \
		437	w, r, -EFAULT); \
		438	break; \
		439	case 4: \
		440	__put_user_asm("move", __pk_err, __pk_src, __pk_dst, \
		441	l, r, -EFAULT); \
		442	break; \
		443	case 8: \
		444	__put_user_asm8("move", __pk_err, __pk_src, __pk_dst); \
		445	break; \
		446	default: \
		447	BUILD_BUG(); \
		448	} \
		449	if (unlikely(__pk_err)) \
		450	goto err_label; \
		451	} while (0)
385		452
386	extern long strncpy_from_user(char dst, const char __user src, long count);	453	extern long strncpy_from_user(char dst, const char __user src, long count);
387	extern __must_check long strnlen_user(const char __user *str, long n);	454	extern __must_check long strnlen_user(const char __user *str, long n);

arch/m68k/kernel/asm-offsets.c+1−1

@@ -31,7 +31,7 @@ int main(void) · 30 unmodified lines
31	DEFINE(THREAD_KSP, offsetof(struct thread_struct, ksp));	31	DEFINE(THREAD_KSP, offsetof(struct thread_struct, ksp));
32	DEFINE(THREAD_USP, offsetof(struct thread_struct, usp));	32	DEFINE(THREAD_USP, offsetof(struct thread_struct, usp));
33	DEFINE(THREAD_SR, offsetof(struct thread_struct, sr));	33	DEFINE(THREAD_SR, offsetof(struct thread_struct, sr));
34	DEFINE(THREAD_FS, offsetof(struct thread_struct, fs));	34	DEFINE(THREAD_FC, offsetof(struct thread_struct, fc));
35	DEFINE(THREAD_CRP, offsetof(struct thread_struct, crp));	35	DEFINE(THREAD_CRP, offsetof(struct thread_struct, crp));
36	DEFINE(THREAD_ESP0, offsetof(struct thread_struct, esp0));	36	DEFINE(THREAD_ESP0, offsetof(struct thread_struct, esp0));
37	DEFINE(THREAD_FPREG, offsetof(struct thread_struct, fp));	37	DEFINE(THREAD_FPREG, offsetof(struct thread_struct, fp));

arch/m68k/kernel/entry.S+28−30

@@ -36,7 +36,6 @@ · 35 unmodified lines
36	#include <linux/linkage.h>	36	#include <linux/linkage.h>
37	#include <asm/errno.h>	37	#include <asm/errno.h>
38	#include <asm/setup.h>	38	#include <asm/setup.h>
39	#include <asm/segment.h>
40	#include <asm/traps.h>	39	#include <asm/traps.h>
41	#include <asm/unistd.h>	40	#include <asm/unistd.h>
42	#include <asm/asm-offsets.h>	41	#include <asm/asm-offsets.h>
@@ -78,20 +77,38 @@ ENTRY(__sys_clone3) · 35 unmodified lines
78		77
79	ENTRY(sys_sigreturn)	78	ENTRY(sys_sigreturn)
80	SAVE_SWITCH_STACK	79	SAVE_SWITCH_STACK
81	movel %sp,%sp@- \| switch_stack pointer	80	movel %sp,%a1 \| switch_stack pointer
82	pea %sp@(SWITCH_STACK_SIZE+4) \| pt_regs pointer	81	lea %sp@(SWITCH_STACK_SIZE),%a0 \| pt_regs pointer
		82	lea %sp@(-84),%sp \| leave a gap
		83	movel %a1,%sp@-
		84	movel %a0,%sp@-
83	jbsr do_sigreturn	85	jbsr do_sigreturn
84	addql #8,%sp	86	jra 1f \| shared with rt_sigreturn()
85	RESTORE_SWITCH_STACK
86	rts
87		87
88	ENTRY(sys_rt_sigreturn)	88	ENTRY(sys_rt_sigreturn)
89	SAVE_SWITCH_STACK	89	SAVE_SWITCH_STACK
90	movel %sp,%sp@- \| switch_stack pointer	90	movel %sp,%a1 \| switch_stack pointer
91	pea %sp@(SWITCH_STACK_SIZE+4) \| pt_regs pointer	91	lea %sp@(SWITCH_STACK_SIZE),%a0 \| pt_regs pointer
		92	lea %sp@(-84),%sp \| leave a gap
		93	movel %a1,%sp@-
		94	movel %a0,%sp@-
		95	\| stack contents:
		96	\| [original pt_regs address] [original switch_stack address]
		97	\| [gap] [switch_stack] [pt_regs] [exception frame]
92	jbsr do_rt_sigreturn	98	jbsr do_rt_sigreturn
93	addql #8,%sp	99
		100	1:
		101	\| stack contents now:
		102	\| [original pt_regs address] [original switch_stack address]
		103	\| [unused part of the gap] [moved switch_stack] [moved pt_regs]
		104	\| [replacement exception frame]
		105	\| return value of do_{rt_,}sigreturn() points to moved switch_stack.
		106
		107	movel %d0,%sp \| discard the leftover junk
94	RESTORE_SWITCH_STACK	108	RESTORE_SWITCH_STACK
		109	\| stack contents now is just [syscall return address] [pt_regs] [frame]
		110	\| return pt_regs.d0
		111	movel %sp@(PT_OFF_D0+4),%d0
95	rts	112	rts
96		113
97	ENTRY(buserr)	114	ENTRY(buserr)
@@ -182,25 +199,6 @@ do_trace_exit: · 84 unmodified lines
182	addql #4,%sp	199	addql #4,%sp
183	jra .Lret_from_exception	200	jra .Lret_from_exception
184		201
185	ENTRY(ret_from_signal)
186	movel %curptr@(TASK_STACK),%a1
187	tstb %a1@(TINFO_FLAGS+2)
188	jge 1f
189	jbsr syscall_trace
190	1: RESTORE_SWITCH_STACK
191	addql #4,%sp
192	/* on 68040 complete pending writebacks if any */
193	#ifdef CONFIG_M68040
194	bfextu %sp@(PT_OFF_FORMATVEC){#0,#4},%d0
195	subql #7,%d0 \| bus error frame ?
196	jbne 1f
197	movel %sp,%sp@-
198	jbsr berr_040cleanup
199	addql #4,%sp
200	1:
201	#endif
202	jra .Lret_from_exception
203
204	ENTRY(system_call)	202	ENTRY(system_call)
205	SAVE_ALL_SYS	203	SAVE_ALL_SYS
206		204
@@ -338,7 +336,7 @@ resume: · 131 unmodified lines
338		336
339	/* save fs (sfc,%dfc) (may be pointing to kernel memory) */	337	/* save fs (sfc,%dfc) (may be pointing to kernel memory) */
340	movec %sfc,%d0	338	movec %sfc,%d0
341	movew %d0,%a0@(TASK_THREAD+THREAD_FS)	339	movew %d0,%a0@(TASK_THREAD+THREAD_FC)
342		340
343	/* save usp */	341	/* save usp */
344	/* it is better to use a movel here instead of a movew 8) /	342	/* it is better to use a movel here instead of a movew 8) /
@@ -424,7 +422,7 @@ resume: · 79 unmodified lines
424	movel %a0,%usp	422	movel %a0,%usp
425		423
426	/* restore fs (sfc,%dfc) */	424	/* restore fs (sfc,%dfc) */
427	movew %a1@(TASK_THREAD+THREAD_FS),%a0	425	movew %a1@(TASK_THREAD+THREAD_FC),%a0
428	movec %a0,%sfc	426	movec %a0,%sfc
429	movec %a0,%dfc	427	movec %a0,%dfc
430		428

arch/m68k/kernel/process.c+2−2

@@ -92,7 +92,7 @@ void show_regs(struct pt_regs * regs) · 91 unmodified lines
92		92
93	void flush_thread(void)	93	void flush_thread(void)
94	{	94	{
95	current->thread.fs = __USER_DS;	95	current->thread.fc = USER_DATA;
96	#ifdef CONFIG_FPU	96	#ifdef CONFIG_FPU
97	if (!FPU_IS_EMU) {	97	if (!FPU_IS_EMU) {
98	unsigned long zero = 0;	98	unsigned long zero = 0;
@@ -155,7 +155,7 @@ int copy_thread(unsigned long clone_flags, unsigned long usp, unsigned long arg, · 56 unmodified lines
155	* Must save the current SFC/DFC value, NOT the value when	155	* Must save the current SFC/DFC value, NOT the value when
156	* the parent was last descheduled - RGH 10-08-96	156	* the parent was last descheduled - RGH 10-08-96
157	*/	157	*/
158	p->thread.fs = get_fs().seg;	158	p->thread.fc = USER_DATA;
159		159
160	if (unlikely(p->flags & (PF_KTHREAD \| PF_IO_WORKER))) {	160	if (unlikely(p->flags & (PF_KTHREAD \| PF_IO_WORKER))) {
161	/* kernel thread */	161	/* kernel thread */

arch/m68k/kernel/signal.c+83−116

@@ -447,7 +447,7 @@ static inline void save_fpu_state(struct sigcontext sc, struct pt_regs regs) · 446 unmodified lines
447		447
448	if (CPU_IS_060 ? sc->sc_fpstate[2] : sc->sc_fpstate[0]) {	448	if (CPU_IS_060 ? sc->sc_fpstate[2] : sc->sc_fpstate[0]) {
449	fpu_version = sc->sc_fpstate[0];	449	fpu_version = sc->sc_fpstate[0];
450	if (CPU_IS_020_OR_030 &&	450	if (CPU_IS_020_OR_030 && !regs->stkadj &&
451	regs->vector >= (VEC_FPBRUC * 4) &&	451	regs->vector >= (VEC_FPBRUC * 4) &&
452	regs->vector <= (VEC_FPNAN * 4)) {	452	regs->vector <= (VEC_FPNAN * 4)) {
453	/* Clear pending exception in 68882 idle frame */	453	/* Clear pending exception in 68882 idle frame */
@@ -510,7 +510,7 @@ static inline int rt_save_fpu_state(struct ucontext __user uc, struct pt_regs · 56 unmodified lines
510	if (!(CPU_IS_060 \|\| CPU_IS_COLDFIRE))	510	if (!(CPU_IS_060 \|\| CPU_IS_COLDFIRE))
511	context_size = fpstate[1];	511	context_size = fpstate[1];
512	fpu_version = fpstate[0];	512	fpu_version = fpstate[0];
513	if (CPU_IS_020_OR_030 &&	513	if (CPU_IS_020_OR_030 && !regs->stkadj &&
514	regs->vector >= (VEC_FPBRUC * 4) &&	514	regs->vector >= (VEC_FPBRUC * 4) &&
515	regs->vector <= (VEC_FPNAN * 4)) {	515	regs->vector <= (VEC_FPNAN * 4)) {
516	/* Clear pending exception in 68882 idle frame */	516	/* Clear pending exception in 68882 idle frame */
@@ -641,56 +641,35 @@ static inline void siginfo_build_tests(void) · 124 unmodified lines
641	static int mangle_kernel_stack(struct pt_regs *regs, int formatvec,	641	static int mangle_kernel_stack(struct pt_regs *regs, int formatvec,
642	void __user *fp)	642	void __user *fp)
643	{	643	{
644	int fsize = frame_extra_sizes(formatvec >> 12);	644	int extra = frame_extra_sizes(formatvec >> 12);
645	if (fsize < 0) {	645	char buf[sizeof_field(struct frame, un)];
		646
		647	if (extra < 0) {
646	/*	648	/*
647	* user process trying to return with weird frame format	649	* user process trying to return with weird frame format
648	*/	650	*/
649	pr_debug("user process returning with weird frame format\n");	651	pr_debug("user process returning with weird frame format\n");
650	return 1;	652	return -1;
651	}	653	}
652	if (!fsize) {	654	if (extra && copy_from_user(buf, fp, extra))
653	regs->format = formatvec >> 12;	655	return -1;
654	regs->vector = formatvec & 0xfff;	656	regs->format = formatvec >> 12;
655	} else {	657	regs->vector = formatvec & 0xfff;
656	struct switch_stack sw = (struct switch_stack )regs - 1;	658	if (extra) {
657	/* yes, twice as much as max(sizeof(frame.un.fmt<x>)) */	659	void p = (struct switch_stack )regs - 1;
658	unsigned long buf[sizeof_field(struct frame, un) / 2];	660	struct frame new = (void )regs - extra;
659		661	int size = sizeof(struct pt_regs)+sizeof(struct switch_stack);
660	/* that'll make sure that expansion won't crap over data */	662
661	if (copy_from_user(buf + fsize / 4, fp, fsize))	663	memmove(p - extra, p, size);
662	return 1;	664	memcpy(p - extra + size, buf, extra);
663		665	current->thread.esp0 = (unsigned long)&new->ptregs;
664	/* point of no return */	666	#ifdef CONFIG_M68040
665	regs->format = formatvec >> 12;	667	/* on 68040 complete pending writebacks if any */
666	regs->vector = formatvec & 0xfff;	668	if (new->ptregs.format == 7) // bus error frame
667	#define frame_offset (sizeof(struct pt_regs)+sizeof(struct switch_stack))	669	berr_040cleanup(new);
668	__asm__ __volatile__ (
669	#ifdef CONFIG_COLDFIRE
670	" movel %0,%/sp\n\t"
671	" bra ret_from_signal\n"
672	#else
673	" movel %0,%/a0\n\t"
674	" subl %1,%/a0\n\t" /* make room on stack */
675	" movel %/a0,%/sp\n\t" /* set stack pointer */
676	/* move switch_stack and pt_regs */
677	"1: movel %0@+,%/a0@+\n\t"
678	" dbra %2,1b\n\t"
679	" lea %/sp@(%c3),%/a0\n\t" /* add offset of fmt */
680	" lsrl #2,%1\n\t"
681	" subql #1,%1\n\t"
682	/* copy to the gap we'd made */
683	"2: movel %4@+,%/a0@+\n\t"
684	" dbra %1,2b\n\t"
685	" bral ret_from_signal\n"
686	#endif	670	#endif
687	: /* no outputs, it doesn't ever return */
688	: "a" (sw), "d" (fsize), "d" (frame_offset/4-1),
689	"n" (frame_offset), "a" (buf + fsize/4)
690	: "a0");
691	#undef frame_offset
692	}	671	}
693	return 0;	672	return extra;
694	}	673	}
695		674
696	static inline int	675	static inline int
@@ -698,7 +677,6 @@ restore_sigcontext(struct pt_regs regs, struct sigcontext __user usc, void __u · 1 unmodified line
698	{	677	{
699	int formatvec;	678	int formatvec;
700	struct sigcontext context;	679	struct sigcontext context;
701	int err = 0;
702		680
703	siginfo_build_tests();	681	siginfo_build_tests();
704		682
@@ -707,7 +685,7 @@ restore_sigcontext(struct pt_regs regs, struct sigcontext __user usc, void __u · 2 unmodified lines
707		685
708	/* get previous context */	686	/* get previous context */
709	if (copy_from_user(&context, usc, sizeof(context)))	687	if (copy_from_user(&context, usc, sizeof(context)))
710	goto badframe;	688	return -1;
711		689
712	/* restore passed registers */	690	/* restore passed registers */
713	regs->d0 = context.sc_d0;	691	regs->d0 = context.sc_d0;
@@ -720,15 +698,10 @@ restore_sigcontext(struct pt_regs regs, struct sigcontext __user usc, void __u · 6 unmodified lines
720	wrusp(context.sc_usp);	698	wrusp(context.sc_usp);
721	formatvec = context.sc_formatvec;	699	formatvec = context.sc_formatvec;
722		700
723	err = restore_fpu_state(&context);	701	if (restore_fpu_state(&context))
		702	return -1;
724		703
725	if (err \|\| mangle_kernel_stack(regs, formatvec, fp))	704	return mangle_kernel_stack(regs, formatvec, fp);
726	goto badframe;
727
728	return 0;
729
730	badframe:
731	return 1;
732	}	705	}
733		706
734	static inline int	707	static inline int
@@ -745,7 +718,7 @@ rt_restore_ucontext(struct pt_regs regs, struct switch_stack sw, · 10 unmodified lines
745		718
746	err = __get_user(temp, &uc->uc_mcontext.version);	719	err = __get_user(temp, &uc->uc_mcontext.version);
747	if (temp != MCONTEXT_VERSION)	720	if (temp != MCONTEXT_VERSION)
748	goto badframe;	721	return -1;
749	/* restore passed registers */	722	/* restore passed registers */
750	err \|= __get_user(regs->d0, &gregs[0]);	723	err \|= __get_user(regs->d0, &gregs[0]);
751	err \|= __get_user(regs->d1, &gregs[1]);	724	err \|= __get_user(regs->d1, &gregs[1]);
@@ -774,22 +747,17 @@ rt_restore_ucontext(struct pt_regs regs, struct switch_stack sw, · 22 unmodified lines
774	err \|= restore_altstack(&uc->uc_stack);	747	err \|= restore_altstack(&uc->uc_stack);
775		748
776	if (err)	749	if (err)
777	goto badframe;	750	return -1;
778		751
779	if (mangle_kernel_stack(regs, temp, &uc->uc_extra))	752	return mangle_kernel_stack(regs, temp, &uc->uc_extra);
780	goto badframe;
781
782	return 0;
783
784	badframe:
785	return 1;
786	}	753	}
787		754
788	asmlinkage int do_sigreturn(struct pt_regs regs, struct switch_stack sw)	755	asmlinkage void do_sigreturn(struct pt_regs regs, struct switch_stack *sw)
789	{	756	{
790	unsigned long usp = rdusp();	757	unsigned long usp = rdusp();
791	struct sigframe __user frame = (struct sigframe __user )(usp - 4);	758	struct sigframe __user frame = (struct sigframe __user )(usp - 4);
792	sigset_t set;	759	sigset_t set;
		760	int size;
793		761
794	if (!access_ok(frame, sizeof(*frame)))	762	if (!access_ok(frame, sizeof(*frame)))
795	goto badframe;	763	goto badframe;
@@ -801,20 +769,22 @@ asmlinkage int do_sigreturn(struct pt_regs regs, struct switch_stack sw) · 5 unmodified lines
801		769
802	set_current_blocked(&set);	770	set_current_blocked(&set);
803		771
804	if (restore_sigcontext(regs, &frame->sc, frame + 1))	772	size = restore_sigcontext(regs, &frame->sc, frame + 1);
		773	if (size < 0)
805	goto badframe;	774	goto badframe;
806	return regs->d0;	775	return (void *)sw - size;
807		776
808	badframe:	777	badframe:
809	force_sig(SIGSEGV);	778	force_sig(SIGSEGV);
810	return 0;	779	return sw;
811	}	780	}
812		781
813	asmlinkage int do_rt_sigreturn(struct pt_regs regs, struct switch_stack sw)	782	asmlinkage void do_rt_sigreturn(struct pt_regs regs, struct switch_stack *sw)
814	{	783	{
815	unsigned long usp = rdusp();	784	unsigned long usp = rdusp();
816	struct rt_sigframe __user frame = (struct rt_sigframe __user )(usp - 4);	785	struct rt_sigframe __user frame = (struct rt_sigframe __user )(usp - 4);
817	sigset_t set;	786	sigset_t set;
		787	int size;
818		788
819	if (!access_ok(frame, sizeof(*frame)))	789	if (!access_ok(frame, sizeof(*frame)))
820	goto badframe;	790	goto badframe;
@@ -823,27 +793,34 @@ asmlinkage int do_rt_sigreturn(struct pt_regs regs, struct switch_stack sw) · 2 unmodified lines
823		793
824	set_current_blocked(&set);	794	set_current_blocked(&set);
825		795
826	if (rt_restore_ucontext(regs, sw, &frame->uc))	796	size = rt_restore_ucontext(regs, sw, &frame->uc);
		797	if (size < 0)
827	goto badframe;	798	goto badframe;
828	return regs->d0;	799	return (void *)sw - size;
829		800
830	badframe:	801	badframe:
831	force_sig(SIGSEGV);	802	force_sig(SIGSEGV);
832	return 0;	803	return sw;
		804	}
		805
		806	static inline struct pt_regs rte_regs(struct pt_regs regs)
		807	{
		808	return (void *)regs + regs->stkadj;
833	}	809	}
834		810
835	static void setup_sigcontext(struct sigcontext sc, struct pt_regs regs,	811	static void setup_sigcontext(struct sigcontext sc, struct pt_regs regs,
836	unsigned long mask)	812	unsigned long mask)
837	{	813	{
		814	struct pt_regs *tregs = rte_regs(regs);
838	sc->sc_mask = mask;	815	sc->sc_mask = mask;
839	sc->sc_usp = rdusp();	816	sc->sc_usp = rdusp();
840	sc->sc_d0 = regs->d0;	817	sc->sc_d0 = regs->d0;
841	sc->sc_d1 = regs->d1;	818	sc->sc_d1 = regs->d1;
842	sc->sc_a0 = regs->a0;	819	sc->sc_a0 = regs->a0;
843	sc->sc_a1 = regs->a1;	820	sc->sc_a1 = regs->a1;
844	sc->sc_sr = regs->sr;	821	sc->sc_sr = tregs->sr;
845	sc->sc_pc = regs->pc;	822	sc->sc_pc = tregs->pc;
846	sc->sc_formatvec = regs->format << 12 \| regs->vector;	823	sc->sc_formatvec = tregs->format << 12 \| tregs->vector;
847	save_a5_state(sc, regs);	824	save_a5_state(sc, regs);
848	save_fpu_state(sc, regs);	825	save_fpu_state(sc, regs);
849	}	826	}
@@ -851,6 +828,7 @@ static void setup_sigcontext(struct sigcontext sc, struct pt_regs regs, · 1 unmodified line
851	static inline int rt_setup_ucontext(struct ucontext __user uc, struct pt_regs regs)	828	static inline int rt_setup_ucontext(struct ucontext __user uc, struct pt_regs regs)
852	{	829	{
853	struct switch_stack sw = (struct switch_stack )regs - 1;	830	struct switch_stack sw = (struct switch_stack )regs - 1;
		831	struct pt_regs *tregs = rte_regs(regs);
854	greg_t __user *gregs = uc->uc_mcontext.gregs;	832	greg_t __user *gregs = uc->uc_mcontext.gregs;
855	int err = 0;	833	int err = 0;
856		834
@@ -871,9 +849,9 @@ static inline int rt_setup_ucontext(struct ucontext __user uc, struct pt_regs · 14 unmodified lines
871	err \|= __put_user(sw->a5, &gregs[13]);	849	err \|= __put_user(sw->a5, &gregs[13]);
872	err \|= __put_user(sw->a6, &gregs[14]);	850	err \|= __put_user(sw->a6, &gregs[14]);
873	err \|= __put_user(rdusp(), &gregs[15]);	851	err \|= __put_user(rdusp(), &gregs[15]);
874	err \|= __put_user(regs->pc, &gregs[16]);	852	err \|= __put_user(tregs->pc, &gregs[16]);
875	err \|= __put_user(regs->sr, &gregs[17]);	853	err \|= __put_user(tregs->sr, &gregs[17]);
876	err \|= __put_user((regs->format << 12) \| regs->vector, &uc->uc_formatvec);	854	err \|= __put_user((tregs->format << 12) \| tregs->vector, &uc->uc_formatvec);
877	err \|= rt_save_fpu_state(uc, regs);	855	err \|= rt_save_fpu_state(uc, regs);
878	return err;	856	return err;
879	}	857	}
@@ -890,13 +868,14 @@ static int setup_frame(struct ksignal ksig, sigset_t set, · 10 unmodified lines
890	struct pt_regs *regs)	868	struct pt_regs *regs)
891	{	869	{
892	struct sigframe __user *frame;	870	struct sigframe __user *frame;
893	int fsize = frame_extra_sizes(regs->format);	871	struct pt_regs *tregs = rte_regs(regs);
		872	int fsize = frame_extra_sizes(tregs->format);
894	struct sigcontext context;	873	struct sigcontext context;
895	int err = 0, sig = ksig->sig;	874	int err = 0, sig = ksig->sig;
896		875
897	if (fsize < 0) {	876	if (fsize < 0) {
898	pr_debug("setup_frame: Unknown frame format %#x\n",	877	pr_debug("setup_frame: Unknown frame format %#x\n",
899	regs->format);	878	tregs->format);
900	return -EFAULT;	879	return -EFAULT;
901	}	880	}
902		881
@@ -907,7 +886,7 @@ static int setup_frame(struct ksignal ksig, sigset_t set, · 4 unmodified lines
907		886
908	err \|= __put_user(sig, &frame->sig);	887	err \|= __put_user(sig, &frame->sig);
909		888
910	err \|= __put_user(regs->vector, &frame->code);	889	err \|= __put_user(tregs->vector, &frame->code);
911	err \|= __put_user(&frame->sc, &frame->psc);	890	err \|= __put_user(&frame->sc, &frame->psc);
912		891
913	if (_NSIG_WORDS > 1)	892	if (_NSIG_WORDS > 1)
@@ -933,34 +912,28 @@ static int setup_frame(struct ksignal ksig, sigset_t set, · 19 unmodified lines
933		912
934	push_cache ((unsigned long) &frame->retcode);	913	push_cache ((unsigned long) &frame->retcode);
935		914
936	/*
937	* Set up registers for signal handler. All the state we are about
938	* to destroy is successfully copied to sigframe.
939	*/
940	wrusp ((unsigned long) frame);
941	regs->pc = (unsigned long) ksig->ka.sa.sa_handler;
942	adjustformat(regs);
943
944	/*	915	/*
945	* This is subtle; if we build more than one sigframe, all but the	916	* This is subtle; if we build more than one sigframe, all but the
946	* first one will see frame format 0 and have fsize == 0, so we won't	917	* first one will see frame format 0 and have fsize == 0, so we won't
947	* screw stkadj.	918	* screw stkadj.
948	*/	919	*/
949	if (fsize)	920	if (fsize) {
950	regs->stkadj = fsize;	921	regs->stkadj = fsize;
951		922	tregs = rte_regs(regs);
952	/* Prepare to skip over the extra stuff in the exception frame. */
953	if (regs->stkadj) {
954	struct pt_regs *tregs =
955	(struct pt_regs *)((ulong)regs + regs->stkadj);
956	pr_debug("Performing stackadjust=%04lx\n", regs->stkadj);	923	pr_debug("Performing stackadjust=%04lx\n", regs->stkadj);
957	/* This must be copied with decreasing addresses to
958	handle overlaps. */
959	tregs->vector = 0;	924	tregs->vector = 0;
960	tregs->format = 0;	925	tregs->format = 0;
961	tregs->pc = regs->pc;
962	tregs->sr = regs->sr;	926	tregs->sr = regs->sr;
963	}	927	}
		928
		929	/*
		930	* Set up registers for signal handler. All the state we are about
		931	* to destroy is successfully copied to sigframe.
		932	*/
		933	wrusp ((unsigned long) frame);
		934	tregs->pc = (unsigned long) ksig->ka.sa.sa_handler;
		935	adjustformat(regs);
		936
964	return 0;	937	return 0;
965	}	938	}
966		939
@@ -968,7 +941,8 @@ static int setup_rt_frame(struct ksignal ksig, sigset_t set, · 1 unmodified line
968	struct pt_regs *regs)	941	struct pt_regs *regs)
969	{	942	{
970	struct rt_sigframe __user *frame;	943	struct rt_sigframe __user *frame;
971	int fsize = frame_extra_sizes(regs->format);	944	struct pt_regs *tregs = rte_regs(regs);
		945	int fsize = frame_extra_sizes(tregs->format);
972	int err = 0, sig = ksig->sig;	946	int err = 0, sig = ksig->sig;
973		947
974	if (fsize < 0) {	948	if (fsize < 0) {
@@ -1018,34 +992,27 @@ static int setup_rt_frame(struct ksignal ksig, sigset_t set, · 43 unmodified lines
1018		992
1019	push_cache ((unsigned long) &frame->retcode);	993	push_cache ((unsigned long) &frame->retcode);
1020		994
1021	/*
1022	* Set up registers for signal handler. All the state we are about
1023	* to destroy is successfully copied to sigframe.
1024	*/
1025	wrusp ((unsigned long) frame);
1026	regs->pc = (unsigned long) ksig->ka.sa.sa_handler;
1027	adjustformat(regs);
1028
1029	/*	995	/*
1030	* This is subtle; if we build more than one sigframe, all but the	996	* This is subtle; if we build more than one sigframe, all but the
1031	* first one will see frame format 0 and have fsize == 0, so we won't	997	* first one will see frame format 0 and have fsize == 0, so we won't
1032	* screw stkadj.	998	* screw stkadj.
1033	*/	999	*/
1034	if (fsize)	1000	if (fsize) {
1035	regs->stkadj = fsize;	1001	regs->stkadj = fsize;
1036		1002	tregs = rte_regs(regs);
1037	/* Prepare to skip over the extra stuff in the exception frame. */
1038	if (regs->stkadj) {
1039	struct pt_regs *tregs =
1040	(struct pt_regs *)((ulong)regs + regs->stkadj);
1041	pr_debug("Performing stackadjust=%04lx\n", regs->stkadj);	1003	pr_debug("Performing stackadjust=%04lx\n", regs->stkadj);
1042	/* This must be copied with decreasing addresses to
1043	handle overlaps. */
1044	tregs->vector = 0;	1004	tregs->vector = 0;
1045	tregs->format = 0;	1005	tregs->format = 0;
1046	tregs->pc = regs->pc;
1047	tregs->sr = regs->sr;	1006	tregs->sr = regs->sr;
1048	}	1007	}
		1008
		1009	/*
		1010	* Set up registers for signal handler. All the state we are about
		1011	* to destroy is successfully copied to sigframe.
		1012	*/
		1013	wrusp ((unsigned long) frame);
		1014	tregs->pc = (unsigned long) ksig->ka.sa.sa_handler;
		1015	adjustformat(regs);
1049	return 0;	1016	return 0;
1050	}	1017	}
1051		1018

arch/m68k/kernel/traps.c+4−9

 static inline unsigned long probe040(int iswrite, unsigned long addr, int wbs)
 {
 	unsigned long mmusr;
-	mm_segment_t old_fs = get_fs();
-	set_fs(MAKE_MM_SEG(wbs));
+	set_fc(wbs);
 	if (iswrite)
 		asm volatile (".chip 68040; ptestw (%0); .chip 68k" : : "a" (addr));
 	asm volatile (".chip 68040; movec %%mmusr,%0; .chip 68k" : "=r" (mmusr));
-	set_fs(old_fs);
+	set_fc(USER_DATA);
 	return mmusr;
 }
 				   unsigned long wbd)
 {
 	int res = 0;
-	mm_segment_t old_fs = get_fs();
-	/* set_fs can not be moved, otherwise put_user() may oops */
+	set_fc(wbs);
-	set_fs(MAKE_MM_SEG(wbs));
 	switch (wbs & WBSIZ_040) {
 	case BA_SIZE_BYTE:
 		break;
 	}
-	/* set_fs can not be moved, otherwise put_user() may oops */
+	set_fc(USER_DATA);
-	set_fs(old_fs);
 	pr_debug("do_040writeback1, res=%d\n", res);

arch/m68k/mac/misc.c+0−1

@@ -18,7 +18,6 @@ · 17 unmodified lines
18		18
19	#include <linux/uaccess.h>	19	#include <linux/uaccess.h>
20	#include <asm/io.h>	20	#include <asm/io.h>
21	#include <asm/segment.h>
22	#include <asm/setup.h>	21	#include <asm/setup.h>
23	#include <asm/macintosh.h>	22	#include <asm/macintosh.h>
24	#include <asm/mac_via.h>	23	#include <asm/mac_via.h>

arch/m68k/mm/cache.c+3−22

@@ -49,24 +49,7 @@ static unsigned long virt_to_phys_slow(unsigned long vaddr) · 48 unmodified lines
49	if (mmusr & MMU_R_040)	49	if (mmusr & MMU_R_040)
50	return (mmusr & PAGE_MASK) \| (vaddr & ~PAGE_MASK);	50	return (mmusr & PAGE_MASK) \| (vaddr & ~PAGE_MASK);
51	} else {	51	} else {
52	unsigned short mmusr;	52	WARN_ON_ONCE(!CPU_IS_040_OR_060);
53	unsigned long *descaddr;
54
55	asm volatile ("ptestr %3,%2@,#7,%0\n\t"
56	"pmove %%psr,%1"
57	: "=a&" (descaddr), "=m" (mmusr)
58	: "a" (vaddr), "d" (get_fs().seg));
59	if (mmusr & (MMU_I\|MMU_B\|MMU_L))
60	return 0;
61	descaddr = phys_to_virt((unsigned long)descaddr);
62	switch (mmusr & MMU_NUM) {
63	case 1:
64	return (*descaddr & 0xfe000000) \| (vaddr & 0x01ffffff);
65	case 2:
66	return (*descaddr & 0xfffc0000) \| (vaddr & 0x0003ffff);
67	case 3:
68	return (*descaddr & PAGE_MASK) \| (vaddr & ~PAGE_MASK);
69	}
70	}	53	}
71	return 0;	54	return 0;
72	}	55	}
@@ -107,11 +90,9 @@ void flush_icache_user_range(unsigned long address, unsigned long endaddr) · 34 unmodified lines
107		90
108	void flush_icache_range(unsigned long address, unsigned long endaddr)	91	void flush_icache_range(unsigned long address, unsigned long endaddr)
109	{	92	{
110	mm_segment_t old_fs = get_fs();	93	set_fc(SUPER_DATA);
111
112	set_fs(KERNEL_DS);
113	flush_icache_user_range(address, endaddr);	94	flush_icache_user_range(address, endaddr);
114	set_fs(old_fs);	95	set_fc(USER_DATA);
115	}	96	}
116	EXPORT_SYMBOL(flush_icache_range);	97	EXPORT_SYMBOL(flush_icache_range);
117		98

arch/m68k/mm/init.c+0−6

 	if (!empty_zero_page)
 		panic("%s: Failed to allocate %lu bytes align=0x%lx\n",
 		      __func__, PAGE_SIZE, PAGE_SIZE);
-	/*
-	 * Set up SFC/DFC registers (user data space).
-	 */
-	set_fs (USER_DS);
 	max_zone_pfn[ZONE_DMA] = end_mem >> PAGE_SHIFT;
 	free_area_init(max_zone_pfn);
 }

arch/m68k/mm/kmap.c+0−1

@@ -17,7 +17,6 @@ · 16 unmodified lines
17	#include <linux/vmalloc.h>	17	#include <linux/vmalloc.h>
18		18
19	#include <asm/setup.h>	19	#include <asm/setup.h>
20	#include <asm/segment.h>
21	#include <asm/page.h>	20	#include <asm/page.h>
22	#include <asm/io.h>	21	#include <asm/io.h>
23	#include <asm/tlbflush.h>	22	#include <asm/tlbflush.h>

arch/m68k/mm/memory.c+0−1

@@ -15,7 +15,6 @@ · 14 unmodified lines
15	#include <linux/gfp.h>	15	#include <linux/gfp.h>
16		16
17	#include <asm/setup.h>	17	#include <asm/setup.h>
18	#include <asm/segment.h>
19	#include <asm/page.h>	18	#include <asm/page.h>
20	#include <asm/traps.h>	19	#include <asm/traps.h>
21	#include <asm/machdep.h>	20	#include <asm/machdep.h>

arch/m68k/mm/motorola.c+1−1

@@ -467,7 +467,7 @@ void __init paging_init(void) · 466 unmodified lines
467	/*	467	/*
468	* Set up SFC/DFC registers	468	* Set up SFC/DFC registers
469	*/	469	*/
470	set_fs(KERNEL_DS);	470	set_fc(USER_DATA);
471		471
472	#ifdef DEBUG	472	#ifdef DEBUG
473	printk ("before free_area_init\n");	473	printk ("before free_area_init\n");

arch/m68k/sun3/config.c+1−2

 #include <asm/intersil.h>
 #include <asm/irq.h>
 #include <asm/sections.h>
-#include <asm/segment.h>
 #include <asm/sun3ints.h>
 char sun3_reserved_pmeg[SUN3_PMEGS_NUM];
 	sun3_reserved_pmeg[249] = 1;
 	sun3_reserved_pmeg[252] = 1;
 	sun3_reserved_pmeg[253] = 1;
-	set_fs(KERNEL_DS);
+	set_fc(USER_DATA);
 }
 /* Without this, Bad Things happen when something calls arch_reset. */

arch/m68k/sun3/mmu_emu.c+2−4

 #include <linux/uaccess.h>
 #include <asm/page.h>
 #include <asm/sun3mmu.h>
-#include <asm/segment.h>
 #include <asm/oplib.h>
 #include <asm/mmu_context.h>
 #include <asm/dvma.h>
 	for(seg = 0; seg < PAGE_OFFSET; seg += SUN3_PMEG_SIZE)
 		sun3_put_segmap(seg, SUN3_INVALID_PMEG);
-	set_fs(MAKE_MM_SEG(3));
+	set_fc(3);
 	for(seg = 0; seg < 0x10000000; seg += SUN3_PMEG_SIZE) {
 		i = sun3_get_segmap(seg);
 		for(j = 1; j < CONTEXTS_NUM; j++)
 			(*(romvec->pv_setctxt))(j, (void *)seg, i);
 	}
-	set_fs(KERNEL_DS);
+	set_fc(USER_DATA);
 }
 /* erase the mappings for a dead context.  Uses the pg_dir for hints

arch/m68k/sun3/sun3ints.c+0−1

@@ -11,7 +11,6 @@ · 10 unmodified lines
11	#include <linux/sched.h>	11	#include <linux/sched.h>
12	#include <linux/kernel_stat.h>	12	#include <linux/kernel_stat.h>
13	#include <linux/interrupt.h>	13	#include <linux/interrupt.h>
14	#include <asm/segment.h>
15	#include <asm/intersil.h>	14	#include <asm/intersil.h>
16	#include <asm/oplib.h>	15	#include <asm/oplib.h>
17	#include <asm/sun3ints.h>	16	#include <asm/sun3ints.h>

arch/m68k/sun3x/prom.c+0−1

@@ -14,7 +14,6 @@ · 13 unmodified lines
14	#include <asm/traps.h>	14	#include <asm/traps.h>
15	#include <asm/sun3xprom.h>	15	#include <asm/sun3xprom.h>
16	#include <asm/idprom.h>	16	#include <asm/idprom.h>
17	#include <asm/segment.h>
18	#include <asm/sun3ints.h>	17	#include <asm/sun3ints.h>
19	#include <asm/openprom.h>	18	#include <asm/openprom.h>
20	#include <asm/machines.h>	19	#include <asm/machines.h>

arch/mips/net/bpf_jit.c+43−14

 	((int)K < 0 ? ((int)K >= SKF_LL_OFF ? func##_negative : func) : \
 	 func##_positive)
+static bool is_bad_offset(int b_off)
+{
+	return b_off > 0x1ffff || b_off < -0x20000;
+}
 static int build_body(struct jit_ctx *ctx)
 {
 	const struct bpf_prog *prog = ctx->skf;
 			/* Load return register on DS for failures */
 			emit_reg_move(r_ret, r_zero, ctx);
 			/* Return with error */
-			emit_b(b_imm(prog->len, ctx), ctx);
+			b_off = b_imm(prog->len, ctx);
+			if (is_bad_offset(b_off))
+				return -E2BIG;
+			emit_b(b_off, ctx);
 			emit_nop(ctx);
 			break;
 		case BPF_LD | BPF_W | BPF_IND:
 			emit_jalr(MIPS_R_RA, r_s0, ctx);
 			emit_reg_move(MIPS_R_A0, r_skb, ctx); /* delay slot */
 			/* Check the error value */
-			emit_bcond(MIPS_COND_NE, r_ret, 0,
+			b_off = b_imm(prog->len, ctx);
-				   b_imm(prog->len, ctx), ctx);
+			if (is_bad_offset(b_off))
+				return -E2BIG;
+			emit_bcond(MIPS_COND_NE, r_ret, 0, b_off, ctx);
 			emit_reg_move(r_ret, r_zero, ctx);
 			/* We are good */
 			/* X <- P[1:K] & 0xf */
 			/* A /= X */
 			ctx->flags |= SEEN_X | SEEN_A;
 			/* Check if r_X is zero */
-			emit_bcond(MIPS_COND_EQ, r_X, r_zero,
+			b_off = b_imm(prog->len, ctx);
-				   b_imm(prog->len, ctx), ctx);
+			if (is_bad_offset(b_off))
+				return -E2BIG;
+			emit_bcond(MIPS_COND_EQ, r_X, r_zero, b_off, ctx);
 			emit_load_imm(r_ret, 0, ctx); /* delay slot */
 			emit_div(r_A, r_X, ctx);
 			break;
 			/* A %= X */
 			ctx->flags |= SEEN_X | SEEN_A;
 			/* Check if r_X is zero */
-			emit_bcond(MIPS_COND_EQ, r_X, r_zero,
+			b_off = b_imm(prog->len, ctx);
-				   b_imm(prog->len, ctx), ctx);
+			if (is_bad_offset(b_off))
+				return -E2BIG;
+			emit_bcond(MIPS_COND_EQ, r_X, r_zero, b_off, ctx);
 			emit_load_imm(r_ret, 0, ctx); /* delay slot */
 			emit_mod(r_A, r_X, ctx);
 			break;
 			break;
 		case BPF_JMP | BPF_JA:
 			/* pc += K */
-			emit_b(b_imm(i + k + 1, ctx), ctx);
+			b_off = b_imm(i + k + 1, ctx);
+			if (is_bad_offset(b_off))
+				return -E2BIG;
+			emit_b(b_off, ctx);
 			emit_nop(ctx);
 			break;
 		case BPF_JMP | BPF_JEQ | BPF_K:
 			break;
 		case BPF_RET | BPF_A:
 			ctx->flags |= SEEN_A;
-			if (i != prog->len - 1)
+			if (i != prog->len - 1) {
 				/*
 				 * If this is not the last instruction
 				 * then jump to the epilogue
 				 */
-				emit_b(b_imm(prog->len, ctx), ctx);
+				b_off = b_imm(prog->len, ctx);
+				if (is_bad_offset(b_off))
+					return -E2BIG;
+				emit_b(b_off, ctx);
+			}
 			emit_reg_move(r_ret, r_A, ctx); /* delay slot */
 			break;
 		case BPF_RET | BPF_K:
 				 * If this is not the last instruction
 				 * then jump to the epilogue
 				 */
-				emit_b(b_imm(prog->len, ctx), ctx);
+				b_off = b_imm(prog->len, ctx);
+				if (is_bad_offset(b_off))
+					return -E2BIG;
+				emit_b(b_off, ctx);
 				emit_nop(ctx);
 			}
 			break;
 			/* Load *dev pointer */
 			emit_load_ptr(r_s0, r_skb, off, ctx);
 			/* error (0) in the delay slot */
-			emit_bcond(MIPS_COND_EQ, r_s0, r_zero,
+			b_off = b_imm(prog->len, ctx);
-				   b_imm(prog->len, ctx), ctx);
+			if (is_bad_offset(b_off))
+				return -E2BIG;
+			emit_bcond(MIPS_COND_EQ, r_s0, r_zero, b_off, ctx);
 			emit_reg_move(r_ret, r_zero, ctx);
 			if (code == (BPF_ANC | SKF_AD_IFINDEX)) {
 				BUILD_BUG_ON(sizeof_field(struct net_device, ifindex) != 4);
 	/* Generate the actual JIT code */
 	build_prologue(&ctx);
-	build_body(&ctx);
+	if (build_body(&ctx)) {
+		module_memfree(ctx.target);
+		goto out;
+	}
 	build_epilogue(&ctx);
 	/* Update the icache */

arch/nios2/Kconfig.debug+2−1

 config EARLY_PRINTK
 	bool "Activate early kernel debugging"
 	default y
+	depends on TTY
 	select SERIAL_CORE_CONSOLE
 	help
-	  Enable early printk on console
+	  Enable early printk on console.
 	  This is useful for kernel debugging when your machine crashes very
 	  early before the console code is initialized.
 	  You should normally say N here, unless you want to debug such a crash.

arch/nios2/kernel/setup.c+0−2

@@ -149,8 +149,6 @@ static void __init find_limits(unsigned long min, unsigned long max_low, · 148 unmodified lines
149		149
150	void __init setup_arch(char **cmdline_p)	150	void __init setup_arch(char **cmdline_p)
151	{	151	{
152	int dram_start;
153
154	console_verbose();	152	console_verbose();
155		153
156	memory_start = memblock_start_of_DRAM();	154	memory_start = memblock_start_of_DRAM();

arch/s390/kvm/interrupt.c+2−2

@@ -419,13 +419,13 @@ static unsigned long deliverable_irqs(struct kvm_vcpu *vcpu) · 418 unmodified lines
419	static void __set_cpu_idle(struct kvm_vcpu *vcpu)	419	static void __set_cpu_idle(struct kvm_vcpu *vcpu)
420	{	420	{
421	kvm_s390_set_cpuflags(vcpu, CPUSTAT_WAIT);	421	kvm_s390_set_cpuflags(vcpu, CPUSTAT_WAIT);
422	set_bit(kvm_vcpu_get_idx(vcpu), vcpu->kvm->arch.idle_mask);	422	set_bit(vcpu->vcpu_idx, vcpu->kvm->arch.idle_mask);
423	}	423	}
424		424
425	static void __unset_cpu_idle(struct kvm_vcpu *vcpu)	425	static void __unset_cpu_idle(struct kvm_vcpu *vcpu)
426	{	426	{
427	kvm_s390_clear_cpuflags(vcpu, CPUSTAT_WAIT);	427	kvm_s390_clear_cpuflags(vcpu, CPUSTAT_WAIT);
428	clear_bit(kvm_vcpu_get_idx(vcpu), vcpu->kvm->arch.idle_mask);	428	clear_bit(vcpu->vcpu_idx, vcpu->kvm->arch.idle_mask);
429	}	429	}
430		430
431	static void __reset_intercept_indicators(struct kvm_vcpu *vcpu)	431	static void __reset_intercept_indicators(struct kvm_vcpu *vcpu)

arch/s390/kvm/kvm-s390.c+1−1

@@ -4066,7 +4066,7 @@ static int vcpu_pre_run(struct kvm_vcpu *vcpu) · 4065 unmodified lines
4066	kvm_s390_patch_guest_per_regs(vcpu);	4066	kvm_s390_patch_guest_per_regs(vcpu);
4067	}	4067	}
4068		4068
4069	clear_bit(kvm_vcpu_get_idx(vcpu), vcpu->kvm->arch.gisa_int.kicked_mask);	4069	clear_bit(vcpu->vcpu_idx, vcpu->kvm->arch.gisa_int.kicked_mask);
4070		4070
4071	vcpu->arch.sie_block->icptcode = 0;	4071	vcpu->arch.sie_block->icptcode = 0;
4072	cpuflags = atomic_read(&vcpu->arch.sie_block->cpuflags);	4072	cpuflags = atomic_read(&vcpu->arch.sie_block->cpuflags);

arch/s390/kvm/kvm-s390.h+1−1

@@ -79,7 +79,7 @@ static inline int is_vcpu_stopped(struct kvm_vcpu *vcpu) · 78 unmodified lines
79		79
80	static inline int is_vcpu_idle(struct kvm_vcpu *vcpu)	80	static inline int is_vcpu_idle(struct kvm_vcpu *vcpu)
81	{	81	{
82	return test_bit(kvm_vcpu_get_idx(vcpu), vcpu->kvm->arch.idle_mask);	82	return test_bit(vcpu->vcpu_idx, vcpu->kvm->arch.idle_mask);
83	}	83	}
84		84
85	static inline int kvm_is_ucontrol(struct kvm *kvm)	85	static inline int kvm_is_ucontrol(struct kvm *kvm)

arch/x86/crypto/sm4-aesni-avx-asm_64.S+3−2

 	 *	%rdx: src (1..8 blocks)
 	 *	%rcx: num blocks (1..8)
 	 */
-	FRAME_BEGIN
 	cmpq $5, %rcx;
 	jb sm4_aesni_avx_crypt4;
+	FRAME_BEGIN
 	vmovdqu (0 * 16)(%rdx), RA0;
 	vmovdqu (1 * 16)(%rdx), RA1;
 	vmovdqu (2 * 16)(%rdx), RA2;

arch/x86/events/core.c+1−0

@@ -2465,6 +2465,7 @@ static int x86_pmu_event_init(struct perf_event *event) · 2464 unmodified lines
2465	if (err) {	2465	if (err) {
2466	if (event->destroy)	2466	if (event->destroy)
2467	event->destroy(event);	2467	event->destroy(event);
		2468	event->destroy = NULL;
2468	}	2469	}
2469		2470
2470	if (READ_ONCE(x86_pmu.attr_rdpmc) &&	2471	if (READ_ONCE(x86_pmu.attr_rdpmc) &&

arch/x86/events/intel/core.c+1−0

@@ -263,6 +263,7 @@ static struct event_constraint intel_icl_event_constraints[] = { · 262 unmodified lines
263	INTEL_EVENT_CONSTRAINT_RANGE(0xa8, 0xb0, 0xf),	263	INTEL_EVENT_CONSTRAINT_RANGE(0xa8, 0xb0, 0xf),
264	INTEL_EVENT_CONSTRAINT_RANGE(0xb7, 0xbd, 0xf),	264	INTEL_EVENT_CONSTRAINT_RANGE(0xb7, 0xbd, 0xf),
265	INTEL_EVENT_CONSTRAINT_RANGE(0xd0, 0xe6, 0xf),	265	INTEL_EVENT_CONSTRAINT_RANGE(0xd0, 0xe6, 0xf),
		266	INTEL_EVENT_CONSTRAINT(0xef, 0xf),
266	INTEL_EVENT_CONSTRAINT_RANGE(0xf0, 0xf4, 0xf),	267	INTEL_EVENT_CONSTRAINT_RANGE(0xf0, 0xf4, 0xf),
267	EVENT_CONSTRAINT_END	268	EVENT_CONSTRAINT_END
268	};	269	};

arch/x86/include/asm/kvm_page_track.h+1−1

@@ -46,7 +46,7 @@ struct kvm_page_track_notifier_node { · 45 unmodified lines
46	struct kvm_page_track_notifier_node *node);	46	struct kvm_page_track_notifier_node *node);
47	};	47	};
48		48
49	void kvm_page_track_init(struct kvm *kvm);	49	int kvm_page_track_init(struct kvm *kvm);
50	void kvm_page_track_cleanup(struct kvm *kvm);	50	void kvm_page_track_cleanup(struct kvm *kvm);
51		51
52	void kvm_page_track_free_memslot(struct kvm_memory_slot *slot);	52	void kvm_page_track_free_memslot(struct kvm_memory_slot *slot);

arch/x86/include/asm/kvmclock.h+14−0

@@ -2,6 +2,20 @@ · 1 unmodified line
2	#ifndef _ASM_X86_KVM_CLOCK_H	2	#ifndef _ASM_X86_KVM_CLOCK_H
3	#define _ASM_X86_KVM_CLOCK_H	3	#define _ASM_X86_KVM_CLOCK_H
4		4
		5	#include <linux/percpu.h>
		6
5	extern struct clocksource kvm_clock;	7	extern struct clocksource kvm_clock;
6		8
		9	DECLARE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu);
		10
		11	static inline struct pvclock_vcpu_time_info *this_cpu_pvti(void)
		12	{
		13	return &this_cpu_read(hv_clock_per_cpu)->pvti;
		14	}
		15
		16	static inline struct pvclock_vsyscall_time_info *this_cpu_hvclock(void)
		17	{
		18	return this_cpu_read(hv_clock_per_cpu);
		19	}
		20
7	#endif /* _ASM_X86_KVM_CLOCK_H */	21	#endif /* _ASM_X86_KVM_CLOCK_H */

arch/x86/kernel/kvmclock.c+2−11

@@ -49,18 +49,9 @@ early_param("no-kvmclock-vsyscall", parse_no_kvmclock_vsyscall); · 48 unmodified lines
49	static struct pvclock_vsyscall_time_info	49	static struct pvclock_vsyscall_time_info
50	hv_clock_boot[HVC_BOOT_ARRAY_SIZE] __bss_decrypted __aligned(PAGE_SIZE);	50	hv_clock_boot[HVC_BOOT_ARRAY_SIZE] __bss_decrypted __aligned(PAGE_SIZE);
51	static struct pvclock_wall_clock wall_clock __bss_decrypted;	51	static struct pvclock_wall_clock wall_clock __bss_decrypted;
52	static DEFINE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu);
53	static struct pvclock_vsyscall_time_info *hvclock_mem;	52	static struct pvclock_vsyscall_time_info *hvclock_mem;
54		53	DEFINE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu);
55	static inline struct pvclock_vcpu_time_info *this_cpu_pvti(void)	54	EXPORT_PER_CPU_SYMBOL_GPL(hv_clock_per_cpu);
56	{
57	return &this_cpu_read(hv_clock_per_cpu)->pvti;
58	}
59
60	static inline struct pvclock_vsyscall_time_info *this_cpu_hvclock(void)
61	{
62	return this_cpu_read(hv_clock_per_cpu);
63	}
64		55
65	/*	56	/*
66	* The wallclock is the time of day when we booted. Since then, some time may	57	* The wallclock is the time of day when we booted. Since then, some time may

arch/x86/kvm/cpuid.c+2−2

@@ -65,8 +65,8 @@ static inline struct kvm_cpuid_entry2 *cpuid_entry2_find( · 64 unmodified lines
65	for (i = 0; i < nent; i++) {	65	for (i = 0; i < nent; i++) {
66	e = &entries[i];	66	e = &entries[i];
67		67
68	if (e->function == function && (e->index == index \|\|	68	if (e->function == function &&
69	!(e->flags & KVM_CPUID_FLAG_SIGNIFCANT_INDEX)))	69	(!(e->flags & KVM_CPUID_FLAG_SIGNIFCANT_INDEX) \|\| e->index == index))
70	return e;	70	return e;
71	}	71	}
72		72

arch/x86/kvm/emulate.c+1−2

 	__FOP_RET(#op)
 asm(".pushsection .fixup, \"ax\"\n"
-    ".global kvm_fastop_exception \n"
     "kvm_fastop_exception: xor %esi, %esi; ret\n"
     ".popsection");
 	u64 cr4 = ctxt->ops->get_cr(ctxt, 4);
 	if (cr4 & X86_CR4_TSD && ctxt->ops->cpl(ctxt))
-		return emulate_ud(ctxt);
+		return emulate_gp(ctxt, 0);
 	return X86EMUL_CONTINUE;
 }

arch/x86/kvm/hyperv.c+3−4

 	for (i = 0; i < ARRAY_SIZE(hv_vcpu->stimer); i++)
 		stimer_init(&hv_vcpu->stimer[i], i);
-	hv_vcpu->vp_index = kvm_vcpu_get_idx(vcpu);
+	hv_vcpu->vp_index = vcpu->vcpu_idx;
 	return 0;
 }
 	switch (msr) {
 	case HV_X64_MSR_VP_INDEX: {
 		struct kvm_hv *hv = to_kvm_hv(vcpu->kvm);
-		int vcpu_idx = kvm_vcpu_get_idx(vcpu);
 		u32 new_vp_index = (u32)data;
 		if (!host || new_vp_index >= KVM_MAX_VCPUS)
 		 * VP index is changing, adjust num_mismatched_vp_indexes if
 		 * it now matches or no longer matches vcpu_idx.
 		 */
-		if (hv_vcpu->vp_index == vcpu_idx)
+		if (hv_vcpu->vp_index == vcpu->vcpu_idx)
 			atomic_inc(&hv->num_mismatched_vp_indexes);
-		else if (new_vp_index == vcpu_idx)
+		else if (new_vp_index == vcpu->vcpu_idx)
 			atomic_dec(&hv->num_mismatched_vp_indexes);
 		hv_vcpu->vp_index = new_vp_index;

arch/x86/kvm/hyperv.h+1−1

@@ -83,7 +83,7 @@ static inline u32 kvm_hv_get_vpindex(struct kvm_vcpu *vcpu) · 82 unmodified lines
83	{	83	{
84	struct kvm_vcpu_hv *hv_vcpu = to_hv_vcpu(vcpu);	84	struct kvm_vcpu_hv *hv_vcpu = to_hv_vcpu(vcpu);
85		85
86	return hv_vcpu ? hv_vcpu->vp_index : kvm_vcpu_get_idx(vcpu);	86	return hv_vcpu ? hv_vcpu->vp_index : vcpu->vcpu_idx;
87	}	87	}
88		88
89	int kvm_hv_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data, bool host);	89	int kvm_hv_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data, bool host);

arch/x86/kvm/ioapic.c+5−5

 	unsigned index;
 	bool mask_before, mask_after;
 	union kvm_ioapic_redirect_entry *e;
-	unsigned long vcpu_bitmap;
 	int old_remote_irr, old_delivery_status, old_dest_id, old_dest_mode;
+	DECLARE_BITMAP(vcpu_bitmap, KVM_MAX_VCPUS);
 	switch (ioapic->ioregsel) {
 	case IOAPIC_REG_VERSION:
 			irq.shorthand = APIC_DEST_NOSHORT;
 			irq.dest_id = e->fields.dest_id;
 			irq.msi_redir_hint = false;
-			bitmap_zero(&vcpu_bitmap, 16);
+			bitmap_zero(vcpu_bitmap, KVM_MAX_VCPUS);
 			kvm_bitmap_or_dest_vcpus(ioapic->kvm, &irq,
-						 &vcpu_bitmap);
+						 vcpu_bitmap);
 			if (old_dest_mode != e->fields.dest_mode ||
 			    old_dest_id != e->fields.dest_id) {
 				/*
 				    kvm_lapic_irq_dest_mode(
 					!!e->fields.dest_mode);
 				kvm_bitmap_or_dest_vcpus(ioapic->kvm, &irq,
-							 &vcpu_bitmap);
+							 vcpu_bitmap);
 			}
 			kvm_make_scan_ioapic_request_mask(ioapic->kvm,
-							  &vcpu_bitmap);
+							  vcpu_bitmap);
 		} else {
 			kvm_make_scan_ioapic_request(ioapic->kvm);
 		}

arch/x86/kvm/mmu/mmu.c+10−7

 	} while (!sp->unsync_children);
 }
-static void mmu_sync_children(struct kvm_vcpu *vcpu,
+static int mmu_sync_children(struct kvm_vcpu *vcpu,
-			      struct kvm_mmu_page *parent)
+			     struct kvm_mmu_page *parent, bool can_yield)
 {
 	int i;
 	struct kvm_mmu_page *sp;
 		}
 		if (need_resched() || rwlock_needbreak(&vcpu->kvm->mmu_lock)) {
 			kvm_mmu_flush_or_zap(vcpu, &invalid_list, false, flush);
+			if (!can_yield) {
+				kvm_make_request(KVM_REQ_MMU_SYNC, vcpu);
+				return -EINTR;
+			}
 			cond_resched_rwlock_write(&vcpu->kvm->mmu_lock);
 			flush = false;
 		}
 	}
 	kvm_mmu_flush_or_zap(vcpu, &invalid_list, false, flush);
+	return 0;
 }
 static void __clear_sp_write_flooding_count(struct kvm_mmu_page *sp)
 			kvm_make_request(KVM_REQ_TLB_FLUSH_CURRENT, vcpu);
 		}
-		if (sp->unsync_children)
-			kvm_make_request(KVM_REQ_MMU_SYNC, vcpu);
 		__clear_sp_write_flooding_count(sp);
 trace_get_page:
 		write_lock(&vcpu->kvm->mmu_lock);
 		kvm_mmu_audit(vcpu, AUDIT_PRE_SYNC);
-		mmu_sync_children(vcpu, sp);
+		mmu_sync_children(vcpu, sp, true);
 		kvm_mmu_audit(vcpu, AUDIT_POST_SYNC);
 		write_unlock(&vcpu->kvm->mmu_lock);
 		if (IS_VALID_PAE_ROOT(root)) {
 			root &= PT64_BASE_ADDR_MASK;
 			sp = to_shadow_page(root);
-			mmu_sync_children(vcpu, sp);
+			mmu_sync_children(vcpu, sp, true);
 		}
 	}

arch/x86/kvm/mmu/page_track.c+2−2

 	cleanup_srcu_struct(&head->track_srcu);
 }
-void kvm_page_track_init(struct kvm *kvm)
+int kvm_page_track_init(struct kvm *kvm)
 {
 	struct kvm_page_track_notifier_head *head;
 	head = &kvm->arch.track_notifier_head;
-	init_srcu_struct(&head->track_srcu);
 	INIT_HLIST_HEAD(&head->track_notifier_list);
+	return init_srcu_struct(&head->track_srcu);
 }
 /*

arch/x86/kvm/mmu/paging_tmpl.h+23−23

 		if (!is_shadow_present_pte(*it.sptep)) {
 			table_gfn = gw->table_gfn[it.level - 2];
 			access = gw->pt_access[it.level - 2];
-			sp = kvm_mmu_get_page(vcpu, table_gfn, addr, it.level-1,
+			sp = kvm_mmu_get_page(vcpu, table_gfn, addr,
-					      false, access);
+					      it.level-1, false, access);
+			/*
+			 * We must synchronize the pagetable before linking it
+			 * because the guest doesn't need to flush tlb when
+			 * the gpte is changed from non-present to present.
+			 * Otherwise, the guest may use the wrong mapping.
+			 *
+			 * For PG_LEVEL_4K, kvm_mmu_get_page() has already
+			 * synchronized it transiently via kvm_sync_page().
+			 *
+			 * For higher level pagetable, we synchronize it via
+			 * the slower mmu_sync_children().  If it needs to
+			 * break, some progress has been made; return
+			 * RET_PF_RETRY and retry on the next #PF.
+			 * KVM_REQ_MMU_SYNC is not necessary but it
+			 * expedites the process.
+			 */
+			if (sp->unsync_children &&
+			    mmu_sync_children(vcpu, sp, false))
+				return RET_PF_RETRY;
 		}
 		/*
  * Using the cached information from sp->gfns is safe because:
  * - The spte has a reference to the struct page, so the pfn for a given gfn
  *   can't change unless all sptes pointing to it are nuked first.
- *
- * Note:
- *   We should flush all tlbs if spte is dropped even though guest is
- *   responsible for it. Since if we don't, kvm_mmu_notifier_invalidate_page
- *   and kvm_mmu_notifier_invalidate_range_start detect the mapping page isn't
- *   used by guest then tlbs are not flushed, so guest is allowed to access the
- *   freed pages.
- *   And we increase kvm->tlbs_dirty to delay tlbs flush in this case.
  */
 static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
 {
 			return 0;
 		if (FNAME(prefetch_invalid_gpte)(vcpu, sp, &sp->spt[i], gpte)) {
-			/*
+			set_spte_ret |= SET_SPTE_NEED_REMOTE_TLB_FLUSH;
-			 * Update spte before increasing tlbs_dirty to make
-			 * sure no tlb flush is lost after spte is zapped; see
-			 * the comments in kvm_flush_remote_tlbs().
-			 */
-			smp_wmb();
-			vcpu->kvm->tlbs_dirty++;
 			continue;
 		}
 		if (gfn != sp->gfns[i]) {
 			drop_spte(vcpu->kvm, &sp->spt[i]);
-			/*
+			set_spte_ret |= SET_SPTE_NEED_REMOTE_TLB_FLUSH;
-			 * The same as above where we are doing
-			 * prefetch_invalid_gpte().
-			 */
-			smp_wmb();
-			vcpu->kvm->tlbs_dirty++;
 			continue;
 		}

arch/x86/kvm/svm/nested.c+6−4

 		(svm->nested.ctl.int_ctl & int_ctl_vmcb12_bits) |
 		(svm->vmcb01.ptr->control.int_ctl & int_ctl_vmcb01_bits);
-	svm->vmcb->control.virt_ext            = svm->nested.ctl.virt_ext;
 	svm->vmcb->control.int_vector          = svm->nested.ctl.int_vector;
 	svm->vmcb->control.int_state           = svm->nested.ctl.int_state;
 	svm->vmcb->control.event_inj           = svm->nested.ctl.event_inj;
 }
 int enter_svm_guest_mode(struct kvm_vcpu *vcpu, u64 vmcb12_gpa,
-			 struct vmcb *vmcb12)
+			 struct vmcb *vmcb12, bool from_vmrun)
 {
 	struct vcpu_svm *svm = to_svm(vcpu);
 	int ret;
 	nested_vmcb02_prepare_save(svm, vmcb12);
 	ret = nested_svm_load_cr3(&svm->vcpu, vmcb12->save.cr3,
-				  nested_npt_enabled(svm), true);
+				  nested_npt_enabled(svm), from_vmrun);
 	if (ret)
 		return ret;
 	if (!npt_enabled)
 		vcpu->arch.mmu->inject_page_fault = svm_inject_page_fault_nested;
+	if (!from_vmrun)
+		kvm_make_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu);
 	svm_set_gif(svm, true);
 	return 0;
 	svm->nested.nested_run_pending = 1;
-	if (enter_svm_guest_mode(vcpu, vmcb12_gpa, vmcb12))
+	if (enter_svm_guest_mode(vcpu, vmcb12_gpa, vmcb12, true))
 		goto out_exit_err;
 	if (nested_svm_vmrun_msrpm(svm))

arch/x86/kvm/svm/sev.c+62−30

 	return 0;
 }
-static int sev_launch_update_vmsa(struct kvm *kvm, struct kvm_sev_cmd *argp)
+static int __sev_launch_update_vmsa(struct kvm *kvm, struct kvm_vcpu *vcpu,
+				    int *error)
 {
-	struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
 	struct sev_data_launch_update_vmsa vmsa;
+	struct vcpu_svm *svm = to_svm(vcpu);
+	int ret;
+	/* Perform some pre-encryption checks against the VMSA */
+	ret = sev_es_sync_vmsa(svm);
+	if (ret)
+		return ret;
+	/*
+	 * The LAUNCH_UPDATE_VMSA command will perform in-place encryption of
+	 * the VMSA memory content (i.e it will write the same memory region
+	 * with the guest's key), so invalidate it first.
+	 */
+	clflush_cache_range(svm->vmsa, PAGE_SIZE);
+	vmsa.reserved = 0;
+	vmsa.handle = to_kvm_svm(kvm)->sev_info.handle;
+	vmsa.address = __sme_pa(svm->vmsa);
+	vmsa.len = PAGE_SIZE;
+	return sev_issue_cmd(kvm, SEV_CMD_LAUNCH_UPDATE_VMSA, &vmsa, error);
+}
+static int sev_launch_update_vmsa(struct kvm *kvm, struct kvm_sev_cmd *argp)
+{
 	struct kvm_vcpu *vcpu;
 	int i, ret;
 	if (!sev_es_guest(kvm))
 		return -ENOTTY;
-	vmsa.reserved = 0;
 	kvm_for_each_vcpu(i, vcpu, kvm) {
-		struct vcpu_svm *svm = to_svm(vcpu);
+		ret = mutex_lock_killable(&vcpu->mutex);
-		/* Perform some pre-encryption checks against the VMSA */
-		ret = sev_es_sync_vmsa(svm);
 		if (ret)
 			return ret;
-		/*
+		ret = __sev_launch_update_vmsa(kvm, vcpu, &argp->error);
-		 * The LAUNCH_UPDATE_VMSA command will perform in-place
-		 * encryption of the VMSA memory content (i.e it will write
-		 * the same memory region with the guest's key), so invalidate
-		 * it first.
-		 */
-		clflush_cache_range(svm->vmsa, PAGE_SIZE);
-		vmsa.handle = sev->handle;
+		mutex_unlock(&vcpu->mutex);
-		vmsa.address = __sme_pa(svm->vmsa);
-		vmsa.len = PAGE_SIZE;
-		ret = sev_issue_cmd(kvm, SEV_CMD_LAUNCH_UPDATE_VMSA, &vmsa,
-				    &argp->error);
 		if (ret)
 			return ret;
-		svm->vcpu.arch.guest_state_protected = true;
 	}
 	return 0;
 	/* Bind ASID to this guest */
 	ret = sev_bind_asid(kvm, start.handle, error);
-	if (ret)
+	if (ret) {
+		sev_decommission(start.handle);
 		goto e_free_session;
+	}
 	params.handle = start.handle;
 	if (copy_to_user((void __user *)(uintptr_t)argp->data,
 	/* Pin guest memory */
 	guest_page = sev_pin_memory(kvm, params.guest_uaddr & PAGE_MASK,
-				    PAGE_SIZE, &n, 0);
+				    PAGE_SIZE, &n, 1);
 	if (IS_ERR(guest_page)) {
 		ret = PTR_ERR(guest_page);
 		goto e_free_trans;
 	return sev_issue_cmd(kvm, SEV_CMD_RECEIVE_FINISH, &data, &argp->error);
 }
+static bool cmd_allowed_from_miror(u32 cmd_id)
+{
+	/*
+	 * Allow mirrors VM to call KVM_SEV_LAUNCH_UPDATE_VMSA to enable SEV-ES
+	 * active mirror VMs. Also allow the debugging and status commands.
+	 */
+	if (cmd_id == KVM_SEV_LAUNCH_UPDATE_VMSA ||
+	    cmd_id == KVM_SEV_GUEST_STATUS || cmd_id == KVM_SEV_DBG_DECRYPT ||
+	    cmd_id == KVM_SEV_DBG_ENCRYPT)
+		return true;
+	return false;
+}
 int svm_mem_enc_op(struct kvm *kvm, void __user *argp)
 {
 	struct kvm_sev_cmd sev_cmd;
 	mutex_lock(&kvm->lock);
-	/* enc_context_owner handles all memory enc operations */
+	/* Only the enc_context_owner handles some memory enc operations. */
-	if (is_mirroring_enc_context(kvm)) {
+	if (is_mirroring_enc_context(kvm) &&
+	    !cmd_allowed_from_miror(sev_cmd.id)) {
 		r = -EINVAL;
 		goto out;
 	}
 {
 	struct file *source_kvm_file;
 	struct kvm *source_kvm;
-	struct kvm_sev_info *mirror_sev;
+	struct kvm_sev_info source_sev, *mirror_sev;
-	unsigned int asid;
 	int ret;
 	source_kvm_file = fget(source_fd);
 		goto e_source_unlock;
 	}
-	asid = to_kvm_svm(source_kvm)->sev_info.asid;
+	memcpy(&source_sev, &to_kvm_svm(source_kvm)->sev_info,
+	       sizeof(source_sev));
 	/*
 	 * The mirror kvm holds an enc_context_owner ref so its asid can't
 	/* Set enc_context_owner and copy its encryption context over */
 	mirror_sev = &to_kvm_svm(kvm)->sev_info;
 	mirror_sev->enc_context_owner = source_kvm;
-	mirror_sev->asid = asid;
 	mirror_sev->active = true;
+	mirror_sev->asid = source_sev.asid;
+	mirror_sev->fd = source_sev.fd;
+	mirror_sev->es_active = source_sev.es_active;
+	mirror_sev->handle = source_sev.handle;
+	/*
+	 * Do not copy ap_jump_table. Since the mirror does not share the same
+	 * KVM contexts as the original, and they may have different
+	 * memory-views.
+	 */
 	mutex_unlock(&kvm->lock);
 	return 0;

arch/x86/kvm/svm/svm.c+74−63

 		svm->vmcb->control.int_ctl |= svm->nested.ctl.int_ctl &
 			V_IRQ_INJECTION_BITS_MASK;
+		svm->vmcb->control.int_vector = svm->nested.ctl.int_vector;
 	}
 	vmcb_mark_dirty(svm->vmcb, VMCB_INTR);
 	if (error_code)
 		goto reinject;
+	/* All SVM instructions expect page aligned RAX */
+	if (svm->vmcb->save.rax & ~PAGE_MASK)
+		goto reinject;
 	/* Decode the instruction for usage later */
 	if (x86_decode_emulated_instruction(vcpu, 0, NULL, 0) != EMULATION_OK)
 		goto reinject;
 	struct kvm_host_map map_save;
 	int ret;
-	if (is_guest_mode(vcpu)) {
+	if (!is_guest_mode(vcpu))
-		/* FED8h - SVM Guest */
+		return 0;
-		put_smstate(u64, smstate, 0x7ed8, 1);
-		/* FEE0h - SVM Guest VMCB Physical Address */
-		put_smstate(u64, smstate, 0x7ee0, svm->nested.vmcb12_gpa);
-		svm->vmcb->save.rax = vcpu->arch.regs[VCPU_REGS_RAX];
+	/* FED8h - SVM Guest */
-		svm->vmcb->save.rsp = vcpu->arch.regs[VCPU_REGS_RSP];
+	put_smstate(u64, smstate, 0x7ed8, 1);
-		svm->vmcb->save.rip = vcpu->arch.regs[VCPU_REGS_RIP];
+	/* FEE0h - SVM Guest VMCB Physical Address */
+	put_smstate(u64, smstate, 0x7ee0, svm->nested.vmcb12_gpa);
-		ret = nested_svm_vmexit(svm);
+	svm->vmcb->save.rax = vcpu->arch.regs[VCPU_REGS_RAX];
-		if (ret)
+	svm->vmcb->save.rsp = vcpu->arch.regs[VCPU_REGS_RSP];
-			return ret;
+	svm->vmcb->save.rip = vcpu->arch.regs[VCPU_REGS_RIP];
-		/*
+	ret = nested_svm_vmexit(svm);
-		 * KVM uses VMCB01 to store L1 host state while L2 runs but
+	if (ret)
-		 * VMCB01 is going to be used during SMM and thus the state will
+		return ret;
-		 * be lost. Temporary save non-VMLOAD/VMSAVE state to the host save
-		 * area pointed to by MSR_VM_HSAVE_PA. APM guarantees that the
-		 * format of the area is identical to guest save area offsetted
-		 * by 0x400 (matches the offset of 'struct vmcb_save_area'
-		 * within 'struct vmcb'). Note: HSAVE area may also be used by
-		 * L1 hypervisor to save additional host context (e.g. KVM does
-		 * that, see svm_prepare_guest_switch()) which must be
-		 * preserved.
-		 */
-		if (kvm_vcpu_map(vcpu, gpa_to_gfn(svm->nested.hsave_msr),
-				 &map_save) == -EINVAL)
-			return 1;
-		BUILD_BUG_ON(offsetof(struct vmcb, save) != 0x400);
+	/*
+	 * KVM uses VMCB01 to store L1 host state while L2 runs but
+	 * VMCB01 is going to be used during SMM and thus the state will
+	 * be lost. Temporary save non-VMLOAD/VMSAVE state to the host save
+	 * area pointed to by MSR_VM_HSAVE_PA. APM guarantees that the
+	 * format of the area is identical to guest save area offsetted
+	 * by 0x400 (matches the offset of 'struct vmcb_save_area'
+	 * within 'struct vmcb'). Note: HSAVE area may also be used by
+	 * L1 hypervisor to save additional host context (e.g. KVM does
+	 * that, see svm_prepare_guest_switch()) which must be
+	 * preserved.
+	 */
+	if (kvm_vcpu_map(vcpu, gpa_to_gfn(svm->nested.hsave_msr),
+			 &map_save) == -EINVAL)
+		return 1;
-		svm_copy_vmrun_state(map_save.hva + 0x400,
+	BUILD_BUG_ON(offsetof(struct vmcb, save) != 0x400);
-				     &svm->vmcb01.ptr->save);
-		kvm_vcpu_unmap(vcpu, &map_save, true);
+	svm_copy_vmrun_state(map_save.hva + 0x400,
-	}
+			     &svm->vmcb01.ptr->save);
+	kvm_vcpu_unmap(vcpu, &map_save, true);
 	return 0;
 }
 {
 	struct vcpu_svm *svm = to_svm(vcpu);
 	struct kvm_host_map map, map_save;
-	int ret = 0;
+	u64 saved_efer, vmcb12_gpa;
+	struct vmcb *vmcb12;
+	int ret;
-	if (guest_cpuid_has(vcpu, X86_FEATURE_LM)) {
+	if (!guest_cpuid_has(vcpu, X86_FEATURE_LM))
-		u64 saved_efer = GET_SMSTATE(u64, smstate, 0x7ed0);
+		return 0;
-		u64 guest = GET_SMSTATE(u64, smstate, 0x7ed8);
-		u64 vmcb12_gpa = GET_SMSTATE(u64, smstate, 0x7ee0);
-		struct vmcb *vmcb12;
-		if (guest) {
+	/* Non-zero if SMI arrived while vCPU was in guest mode. */
-			if (!guest_cpuid_has(vcpu, X86_FEATURE_SVM))
+	if (!GET_SMSTATE(u64, smstate, 0x7ed8))
-				return 1;
+		return 0;
-			if (!(saved_efer & EFER_SVME))
+	if (!guest_cpuid_has(vcpu, X86_FEATURE_SVM))
-				return 1;
+		return 1;
-			if (kvm_vcpu_map(vcpu,
+	saved_efer = GET_SMSTATE(u64, smstate, 0x7ed0);
-					 gpa_to_gfn(vmcb12_gpa), &map) == -EINVAL)
+	if (!(saved_efer & EFER_SVME))
-				return 1;
+		return 1;
-			if (svm_allocate_nested(svm))
+	vmcb12_gpa = GET_SMSTATE(u64, smstate, 0x7ee0);
-				return 1;
+	if (kvm_vcpu_map(vcpu, gpa_to_gfn(vmcb12_gpa), &map) == -EINVAL)
+		return 1;
-			vmcb12 = map.hva;
+	ret = 1;
+	if (kvm_vcpu_map(vcpu, gpa_to_gfn(svm->nested.hsave_msr), &map_save) == -EINVAL)
+		goto unmap_map;
-			nested_load_control_from_vmcb12(svm, &vmcb12->control);
+	if (svm_allocate_nested(svm))
+		goto unmap_save;
-			ret = enter_svm_guest_mode(vcpu, vmcb12_gpa, vmcb12);
+	/*
-			kvm_vcpu_unmap(vcpu, &map, true);
+	 * Restore L1 host state from L1 HSAVE area as VMCB01 was
+	 * used during SMM (see svm_enter_smm())
+	 */
-			/*
+	svm_copy_vmrun_state(&svm->vmcb01.ptr->save, map_save.hva + 0x400);
-			 * Restore L1 host state from L1 HSAVE area as VMCB01 was
-			 * used during SMM (see svm_enter_smm())
-			 */
-			if (kvm_vcpu_map(vcpu, gpa_to_gfn(svm->nested.hsave_msr),
-					 &map_save) == -EINVAL)
-				return 1;
-			svm_copy_vmrun_state(&svm->vmcb01.ptr->save,
+	/*
-					     map_save.hva + 0x400);
+	 * Enter the nested guest now
+	 */
-			kvm_vcpu_unmap(vcpu, &map_save, true);
+	vmcb12 = map.hva;
-		}
+	nested_load_control_from_vmcb12(svm, &vmcb12->control);
-	}
+	ret = enter_svm_guest_mode(vcpu, vmcb12_gpa, vmcb12, false);
+unmap_save:
+	kvm_vcpu_unmap(vcpu, &map_save, true);
+unmap_map:
+	kvm_vcpu_unmap(vcpu, &map, true);
 	return ret;
 }

arch/x86/kvm/svm/svm.h+2−1

@@ -459,7 +459,8 @@ static inline bool nested_exit_on_nmi(struct vcpu_svm *svm) · 458 unmodified lines
459	return vmcb_is_intercept(&svm->nested.ctl, INTERCEPT_NMI);	459	return vmcb_is_intercept(&svm->nested.ctl, INTERCEPT_NMI);
460	}	460	}
461		461
462	int enter_svm_guest_mode(struct kvm_vcpu vcpu, u64 vmcb_gpa, struct vmcb vmcb12);	462	int enter_svm_guest_mode(struct kvm_vcpu *vcpu,
		463	u64 vmcb_gpa, struct vmcb *vmcb12, bool from_vmrun);
463	void svm_leave_nested(struct vcpu_svm *svm);	464	void svm_leave_nested(struct vcpu_svm *svm);
464	void svm_free_nested(struct vcpu_svm *svm);	465	void svm_free_nested(struct vcpu_svm *svm);
465	int svm_allocate_nested(struct vcpu_svm *svm);	466	int svm_allocate_nested(struct vcpu_svm *svm);

arch/x86/kvm/vmx/evmcs.c+9−3

 	switch (msr_index) {
 	case MSR_IA32_VMX_EXIT_CTLS:
 	case MSR_IA32_VMX_TRUE_EXIT_CTLS:
-		ctl_high &= ~VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL;
+		ctl_high &= ~EVMCS1_UNSUPPORTED_VMEXIT_CTRL;
 		break;
 	case MSR_IA32_VMX_ENTRY_CTLS:
 	case MSR_IA32_VMX_TRUE_ENTRY_CTLS:
-		ctl_high &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
+		ctl_high &= ~EVMCS1_UNSUPPORTED_VMENTRY_CTRL;
 		break;
 	case MSR_IA32_VMX_PROCBASED_CTLS2:
-		ctl_high &= ~SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
+		ctl_high &= ~EVMCS1_UNSUPPORTED_2NDEXEC;
+		break;
+	case MSR_IA32_VMX_PINBASED_CTLS:
+		ctl_high &= ~EVMCS1_UNSUPPORTED_PINCTRL;
+		break;
+	case MSR_IA32_VMX_VMFUNC:
+		ctl_low &= ~EVMCS1_UNSUPPORTED_VMFUNC;
 		break;
 	}

arch/x86/kvm/vmx/nested.c+15−9

 	 * Guest state is invalid and unrestricted guest is disabled,
 	 * which means L1 attempted VMEntry to L2 with invalid state.
 	 * Fail the VMEntry.
+	 *
+	 * However when force loading the guest state (SMM exit or
+	 * loading nested state after migration, it is possible to
+	 * have invalid guest state now, which will be later fixed by
+	 * restoring L2 register state
 	 */
-	if (CC(!vmx_guest_state_valid(vcpu))) {
+	if (CC(from_vmentry && !vmx_guest_state_valid(vcpu))) {
 		*entry_failure_code = ENTRY_FAIL_DEFAULT;
 		return -EINVAL;
 	}
 	if (nested_vmx_load_msr(vcpu, vmcs12->vm_exit_msr_load_addr,
 				vmcs12->vm_exit_msr_load_count))
 		nested_vmx_abort(vcpu, VMX_ABORT_LOAD_HOST_MSR_FAIL);
+	to_vmx(vcpu)->emulation_required = vmx_emulation_required(vcpu);
 }
 static inline u64 nested_vmx_get_vmcs01_guest_efer(struct vcpu_vmx *vmx)
 	return -ENOMEM;
 }
-/*
+/* Emulate the VMXON instruction. */
- * Emulate the VMXON instruction.
- * Currently, we just remember that VMX is active, and do not save or even
- * inspect the argument to VMXON (the so-called "VMXON pointer") because we
- * do not currently need to store anything in that guest-allocated memory
- * region. Consequently, VMCLEAR and VMPTRLD also do not verify that the their
- * argument is different from the VMXON pointer (which the spec says they do).
- */
 static int handle_vmon(struct kvm_vcpu *vcpu)
 {
 	int ret;
 	case EXIT_REASON_VMFUNC:
 		/* VM functions are emulated through L2->L0 vmexits. */
 		return true;
+	case EXIT_REASON_BUS_LOCK:
+		/*
+		 * At present, bus lock VM exit is never exposed to L1.
+		 * Handle L2's bus locks in L0 directly.
+		 */
+		return true;
 	default:
 		break;
 	}

arch/x86/kvm/vmx/vmx.c+27−12

 	vmx_prepare_switch_to_host(to_vmx(vcpu));
 }
-static bool emulation_required(struct kvm_vcpu *vcpu)
+bool vmx_emulation_required(struct kvm_vcpu *vcpu)
 {
 	return emulate_invalid_guest_state && !vmx_guest_state_valid(vcpu);
 }
 	vmcs_writel(GUEST_RFLAGS, rflags);
 	if ((old_rflags ^ vmx->rflags) & X86_EFLAGS_VM)
-		vmx->emulation_required = emulation_required(vcpu);
+		vmx->emulation_required = vmx_emulation_required(vcpu);
 }
 u32 vmx_get_interrupt_shadow(struct kvm_vcpu *vcpu)
 				    &msr_info->data))
 			return 1;
 		/*
-		 * Enlightened VMCS v1 doesn't have certain fields, but buggy
+		 * Enlightened VMCS v1 doesn't have certain VMCS fields but
-		 * Hyper-V versions are still trying to use corresponding
+		 * instead of just ignoring the features, different Hyper-V
-		 * features when they are exposed. Filter out the essential
+		 * versions are either trying to use them and fail or do some
-		 * minimum.
+		 * sanity checking and refuse to boot. Filter all unsupported
+		 * features out.
 		 */
 		if (!msr_info->host_initiated &&
 		    vmx->nested.enlightened_vmcs_enabled)
 	}
 	/* depends on vcpu->arch.cr0 to be set to a new value */
-	vmx->emulation_required = emulation_required(vcpu);
+	vmx->emulation_required = vmx_emulation_required(vcpu);
 }
 static int vmx_get_max_tdp_level(void)
 {
 	__vmx_set_segment(vcpu, var, seg);
-	to_vmx(vcpu)->emulation_required = emulation_required(vcpu);
+	to_vmx(vcpu)->emulation_required = vmx_emulation_required(vcpu);
 }
 static void vmx_get_cs_db_l_bits(struct kvm_vcpu *vcpu, int *db, int *l)
 		     vmx->loaded_vmcs->soft_vnmi_blocked))
 		vmx->loaded_vmcs->entry_time = ktime_get();
-	/* Don't enter VMX if guest state is invalid, let the exit handler
+	/*
-	   start emulation until we arrive back to a valid state */
+	 * Don't enter VMX if guest state is invalid, let the exit handler
-	if (vmx->emulation_required)
+	 * start emulation until we arrive back to a valid state.  Synthesize a
+	 * consistency check VM-Exit due to invalid guest state and bail.
+	 */
+	if (unlikely(vmx->emulation_required)) {
+		/* We don't emulate invalid state of a nested guest */
+		vmx->fail = is_guest_mode(vcpu);
+		vmx->exit_reason.full = EXIT_REASON_INVALID_STATE;
+		vmx->exit_reason.failed_vmentry = 1;
+		kvm_register_mark_available(vcpu, VCPU_EXREG_EXIT_INFO_1);
+		vmx->exit_qualification = ENTRY_FAIL_DEFAULT;
+		kvm_register_mark_available(vcpu, VCPU_EXREG_EXIT_INFO_2);
+		vmx->exit_intr_info = 0;
 		return EXIT_FASTPATH_NONE;
+	}
 	trace_kvm_entry(vcpu);
 		 */
 		tsx_ctrl = vmx_find_uret_msr(vmx, MSR_IA32_TSX_CTRL);
 		if (tsx_ctrl)
-			vmx->guest_uret_msrs[i].mask = ~(u64)TSX_CTRL_CPUID_CLEAR;
+			tsx_ctrl->mask = ~(u64)TSX_CTRL_CPUID_CLEAR;
 	}
 	err = alloc_loaded_vmcs(&vmx->vmcs01);

arch/x86/kvm/vmx/vmx.h+1−4

 	 * only loaded into hardware when necessary, e.g. SYSCALL #UDs outside
 	 * of 64-bit mode or if EFER.SCE=1, thus the SYSCALL MSRs don't need to
 	 * be loaded into hardware if those conditions aren't met.
-	 * nr_active_uret_msrs tracks the number of MSRs that need to be loaded
-	 * into hardware when running the guest.  guest_uret_msrs[] is resorted
-	 * whenever the number of "active" uret MSRs is modified.
 	 */
 	struct vmx_uret_msr   guest_uret_msrs[MAX_NR_USER_RETURN_MSRS];
-	int                   nr_active_uret_msrs;
 	bool                  guest_uret_msrs_loaded;
 #ifdef CONFIG_X86_64
 	u64		      msr_host_kernel_gs_base;
 void vmx_set_host_fs_gs(struct vmcs_host_state *host, u16 fs_sel, u16 gs_sel,
 			unsigned long fs_base, unsigned long gs_base);
 int vmx_get_cpl(struct kvm_vcpu *vcpu);
+bool vmx_emulation_required(struct kvm_vcpu *vcpu);
 unsigned long vmx_get_rflags(struct kvm_vcpu *vcpu);
 void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags);
 u32 vmx_get_interrupt_shadow(struct kvm_vcpu *vcpu);

arch/x86/kvm/x86.c+26−2

 	MSR_ARCH_PERFMON_EVENTSEL0 + 12, MSR_ARCH_PERFMON_EVENTSEL0 + 13,
 	MSR_ARCH_PERFMON_EVENTSEL0 + 14, MSR_ARCH_PERFMON_EVENTSEL0 + 15,
 	MSR_ARCH_PERFMON_EVENTSEL0 + 16, MSR_ARCH_PERFMON_EVENTSEL0 + 17,
+	MSR_K7_EVNTSEL0, MSR_K7_EVNTSEL1, MSR_K7_EVNTSEL2, MSR_K7_EVNTSEL3,
+	MSR_K7_PERFCTR0, MSR_K7_PERFCTR1, MSR_K7_PERFCTR2, MSR_K7_PERFCTR3,
+	MSR_F15H_PERF_CTL0, MSR_F15H_PERF_CTL1, MSR_F15H_PERF_CTL2,
+	MSR_F15H_PERF_CTL3, MSR_F15H_PERF_CTL4, MSR_F15H_PERF_CTL5,
+	MSR_F15H_PERF_CTR0, MSR_F15H_PERF_CTR1, MSR_F15H_PERF_CTR2,
+	MSR_F15H_PERF_CTR3, MSR_F15H_PERF_CTR4, MSR_F15H_PERF_CTR5,
 };
 static u32 msrs_to_save[ARRAY_SIZE(msrs_to_save_all)];
 				       offsetof(struct compat_vcpu_info, time));
 	if (vcpu->xen.vcpu_time_info_set)
 		kvm_setup_pvclock_page(v, &vcpu->xen.vcpu_time_info_cache, 0);
-	if (v == kvm_get_vcpu(v->kvm, 0))
+	if (!v->vcpu_idx)
 		kvm_hv_setup_tsc_page(v->kvm, &vcpu->hv_clock);
 	return 0;
 }
 		/* Process a latched INIT or SMI, if any.  */
 		kvm_make_request(KVM_REQ_EVENT, vcpu);
+		/*
+		 * Even if KVM_SET_SREGS2 loaded PDPTRs out of band,
+		 * on SMM exit we still need to reload them from
+		 * guest memory
+		 */
+		vcpu->arch.pdptrs_from_userspace = false;
 	}
 	kvm_mmu_reset_context(vcpu);
 	int r;
 	vcpu->arch.last_vmentry_cpu = -1;
+	vcpu->arch.regs_avail = ~0;
+	vcpu->arch.regs_dirty = ~0;
 	if (!irqchip_in_kernel(vcpu->kvm) || kvm_vcpu_is_reset_bsp(vcpu))
 		vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
 	kvm_set_rflags(vcpu, X86_EFLAGS_FIXED);
 	kvm_rip_write(vcpu, 0xfff0);
+	vcpu->arch.cr3 = 0;
+	kvm_register_mark_dirty(vcpu, VCPU_EXREG_CR3);
 	/*
 	 * CR0.CD/NW are set on RESET, preserved on INIT.  Note, some versions
 	 * of Intel's SDM list CD/NW as being set on INIT, but they contradict
 int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
 {
+	int ret;
 	if (type)
 		return -EINVAL;
+	ret = kvm_page_track_init(kvm);
+	if (ret)
+		return ret;
 	INIT_HLIST_HEAD(&kvm->arch.mask_notifier_list);
 	INIT_LIST_HEAD(&kvm->arch.active_mmu_pages);
 	INIT_LIST_HEAD(&kvm->arch.zapped_obsolete_pages);
 	kvm_apicv_init(kvm);
 	kvm_hv_init_vm(kvm);
-	kvm_page_track_init(kvm);
 	kvm_mmu_init_vm(kvm);
 	kvm_xen_init_vm(kvm);

arch/x86/net/bpf_jit_comp.c+48−18

 			if (insn->imm == (BPF_AND | BPF_FETCH) ||
 			    insn->imm == (BPF_OR | BPF_FETCH) ||
 			    insn->imm == (BPF_XOR | BPF_FETCH)) {
-				u8 *branch_target;
 				bool is64 = BPF_SIZE(insn->code) == BPF_DW;
 				u32 real_src_reg = src_reg;
+				u32 real_dst_reg = dst_reg;
+				u8 *branch_target;
 				/*
 				 * Can't be implemented with a single x86 insn.
 				emit_mov_reg(&prog, true, BPF_REG_AX, BPF_REG_0);
 				if (src_reg == BPF_REG_0)
 					real_src_reg = BPF_REG_AX;
+				if (dst_reg == BPF_REG_0)
+					real_dst_reg = BPF_REG_AX;
 				branch_target = prog;
 				/* Load old value */
 				emit_ldx(&prog, BPF_SIZE(insn->code),
-					 BPF_REG_0, dst_reg, insn->off);
+					 BPF_REG_0, real_dst_reg, insn->off);
 				/*
 				 * Perform the (commutative) operation locally,
 				 * put the result in the AUX_REG.
 				      add_2reg(0xC0, AUX_REG, real_src_reg));
 				/* Attempt to swap in new value */
 				err = emit_atomic(&prog, BPF_CMPXCHG,
-						  dst_reg, AUX_REG, insn->off,
+						  real_dst_reg, AUX_REG,
+						  insn->off,
 						  BPF_SIZE(insn->code));
 				if (WARN_ON(err))
 					return err;
 				/* Restore R0 after clobbering RAX */
 				emit_mov_reg(&prog, true, BPF_REG_0, BPF_REG_AX);
 				break;
 			}
 			err = emit_atomic(&prog, insn->imm, dst_reg, src_reg,
-						  insn->off, BPF_SIZE(insn->code));
+					  insn->off, BPF_SIZE(insn->code));
 			if (err)
 				return err;
 			break;
 }
 static int invoke_bpf_prog(const struct btf_func_model *m, u8 **pprog,
-			   struct bpf_prog *p, int stack_size, bool mod_ret)
+			   struct bpf_prog *p, int stack_size, bool save_ret)
 {
 	u8 *prog = *pprog;
 	u8 *jmp_insn;
 	if (emit_call(&prog, p->bpf_func, prog))
 		return -EINVAL;
-	/* BPF_TRAMP_MODIFY_RETURN trampolines can modify the return
+	/*
+	 * BPF_TRAMP_MODIFY_RETURN trampolines can modify the return
 	 * of the previous call which is then passed on the stack to
 	 * the next BPF program.
+	 *
+	 * BPF_TRAMP_FENTRY trampoline may need to return the return
+	 * value of BPF_PROG_TYPE_STRUCT_OPS prog.
 	 */
-	if (mod_ret)
+	if (save_ret)
 		emit_stx(&prog, BPF_DW, BPF_REG_FP, BPF_REG_0, -8);
 	/* replace 2 nops with JE insn, since jmp target is known */
 }
 static int invoke_bpf(const struct btf_func_model *m, u8 **pprog,
-		      struct bpf_tramp_progs *tp, int stack_size)
+		      struct bpf_tramp_progs *tp, int stack_size,
+		      bool save_ret)
 {
 	int i;
 	u8 *prog = *pprog;
 	for (i = 0; i < tp->nr_progs; i++) {
-		if (invoke_bpf_prog(m, &prog, tp->progs[i], stack_size, false))
+		if (invoke_bpf_prog(m, &prog, tp->progs[i], stack_size,
+				    save_ret))
 			return -EINVAL;
 	}
 	*pprog = prog;
 	return 0;
 }
+static bool is_valid_bpf_tramp_flags(unsigned int flags)
+{
+	if ((flags & BPF_TRAMP_F_RESTORE_REGS) &&
+	    (flags & BPF_TRAMP_F_SKIP_FRAME))
+		return false;
+	/*
+	 * BPF_TRAMP_F_RET_FENTRY_RET is only used by bpf_struct_ops,
+	 * and it must be used alone.
+	 */
+	if ((flags & BPF_TRAMP_F_RET_FENTRY_RET) &&
+	    (flags & ~BPF_TRAMP_F_RET_FENTRY_RET))
+		return false;
+	return true;
+}
 /* Example:
  * __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev);
  * its 'struct btf_func_model' will be nr_args=2
 	struct bpf_tramp_progs *fmod_ret = &tprogs[BPF_TRAMP_MODIFY_RETURN];
 	u8 **branches = NULL;
 	u8 *prog;
+	bool save_ret;
 	/* x86-64 supports up to 6 arguments. 7+ can be added in the future */
 	if (nr_args > 6)
 		return -ENOTSUPP;
-	if ((flags & BPF_TRAMP_F_RESTORE_REGS) &&
+	if (!is_valid_bpf_tramp_flags(flags))
-	    (flags & BPF_TRAMP_F_SKIP_FRAME))
 		return -EINVAL;
-	if (flags & BPF_TRAMP_F_CALL_ORIG)
+	/* room for return value of orig_call or fentry prog */
-		stack_size += 8; /* room for return value of orig_call */
+	save_ret = flags & (BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_RET_FENTRY_RET);
+	if (save_ret)
+		stack_size += 8;
 	if (flags & BPF_TRAMP_F_IP_ARG)
 		stack_size += 8; /* room for IP address argument */
 	}
 	if (fentry->nr_progs)
-		if (invoke_bpf(m, &prog, fentry, stack_size))
+		if (invoke_bpf(m, &prog, fentry, stack_size,
+			       flags & BPF_TRAMP_F_RET_FENTRY_RET))
 			return -EINVAL;
 	if (fmod_ret->nr_progs) {
 	}
 	if (fexit->nr_progs)
-		if (invoke_bpf(m, &prog, fexit, stack_size)) {
+		if (invoke_bpf(m, &prog, fexit, stack_size, false)) {
 			ret = -EINVAL;
 			goto cleanup;
 		}
 			ret = -EINVAL;
 			goto cleanup;
 		}
-		/* restore original return value back into RAX */
-		emit_ldx(&prog, BPF_DW, BPF_REG_0, BPF_REG_FP, -8);
 	}
+	/* restore return value of orig_call or fentry prog back into RAX */
+	if (save_ret)
+		emit_ldx(&prog, BPF_DW, BPF_REG_0, BPF_REG_FP, -8);
 	EMIT1(0x5B); /* pop rbx */
 	EMIT1(0xC9); /* leave */

block/bfq-iosched.c+3−13

 	 * are likely to increase the throughput.
 	 */
 	bfqq->new_bfqq = new_bfqq;
-	/*
-	 * The above assignment schedules the following redirections:
-	 * each time some I/O for bfqq arrives, the process that
-	 * generated that I/O is disassociated from bfqq and
-	 * associated with new_bfqq. Here we increases new_bfqq->ref
-	 * in advance, adding the number of processes that are
-	 * expected to be associated with new_bfqq as they happen to
-	 * issue I/O.
-	 */
 	new_bfqq->ref += process_refs;
 	return new_bfqq;
 }
 {
 	struct bfq_queue *in_service_bfqq, *new_bfqq;
-	/* if a merge has already been setup, then proceed with that first */
-	if (bfqq->new_bfqq)
-		return bfqq->new_bfqq;
 	/*
 	 * Check delayed stable merge for rotational or non-queueing
 	 * devs. For this branch to be executed, bfqq must not be
 	if (bfq_too_late_for_merging(bfqq))
 		return NULL;
+	if (bfqq->new_bfqq)
+		return bfqq->new_bfqq;
 	if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq))
 		return NULL;

drivers/acpi/nfit/core.c+12−0

@@ -3007,6 +3007,18 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc, · 3006 unmodified lines
3007	ndr_desc->target_node = NUMA_NO_NODE;	3007	ndr_desc->target_node = NUMA_NO_NODE;
3008	}	3008	}
3009		3009
		3010	/* Fallback to address based numa information if node lookup failed */
		3011	if (ndr_desc->numa_node == NUMA_NO_NODE) {
		3012	ndr_desc->numa_node = memory_add_physaddr_to_nid(spa->address);
		3013	dev_info(acpi_desc->dev, "changing numa node from %d to %d for nfit region [%pa-%pa]",
		3014	NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
		3015	}
		3016	if (ndr_desc->target_node == NUMA_NO_NODE) {
		3017	ndr_desc->target_node = phys_to_target_node(spa->address);
		3018	dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]",
		3019	NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
		3020	}
		3021
3010	/*	3022	/*
3011	* Persistence domain bits are hierarchical, if	3023	* Persistence domain bits are hierarchical, if
3012	* ACPI_NFIT_CAPABILITY_CACHE_FLUSH is set then	3024	* ACPI_NFIT_CAPABILITY_CACHE_FLUSH is set then

drivers/base/core.c+63−27

 	list_add(&link->s_hook, &sup->consumers);
 	list_add(&link->c_hook, &con->suppliers);
+	pr_debug("%pfwP Linked as a fwnode consumer to %pfwP\n",
+		 con, sup);
 out:
 	mutex_unlock(&fwnode_link_lock);
 	return ret;
 }
+/**
+ * __fwnode_link_del - Delete a link between two fwnode_handles.
+ * @link: the fwnode_link to be deleted
+ *
+ * The fwnode_link_lock needs to be held when this function is called.
+ */
+static void __fwnode_link_del(struct fwnode_link *link)
+{
+	pr_debug("%pfwP Dropping the fwnode link to %pfwP\n",
+		 link->consumer, link->supplier);
+	list_del(&link->s_hook);
+	list_del(&link->c_hook);
+	kfree(link);
+}
 /**
  * fwnode_links_purge_suppliers - Delete all supplier links of fwnode_handle.
  * @fwnode: fwnode whose supplier links need to be deleted
 	struct fwnode_link *link, *tmp;
 	mutex_lock(&fwnode_link_lock);
-	list_for_each_entry_safe(link, tmp, &fwnode->suppliers, c_hook) {
+	list_for_each_entry_safe(link, tmp, &fwnode->suppliers, c_hook)
-		list_del(&link->s_hook);
+		__fwnode_link_del(link);
-		list_del(&link->c_hook);
-		kfree(link);
-	}
 	mutex_unlock(&fwnode_link_lock);
 }
 	struct fwnode_link *link, *tmp;
 	mutex_lock(&fwnode_link_lock);
-	list_for_each_entry_safe(link, tmp, &fwnode->consumers, s_hook) {
+	list_for_each_entry_safe(link, tmp, &fwnode->consumers, s_hook)
-		list_del(&link->s_hook);
+		__fwnode_link_del(link);
-		list_del(&link->c_hook);
-		kfree(link);
-	}
 	mutex_unlock(&fwnode_link_lock);
 }
 {
 	struct device_link *link;
 	int ret = 0;
+	struct fwnode_handle *sup_fw;
 	/*
 	 * Device waiting for supplier to become available is not allowed to
 	mutex_lock(&fwnode_link_lock);
 	if (dev->fwnode && !list_empty(&dev->fwnode->suppliers) &&
 	    !fw_devlink_is_permissive()) {
-		dev_dbg(dev, "probe deferral - wait for supplier %pfwP\n",
+		sup_fw = list_first_entry(&dev->fwnode->suppliers,
-			list_first_entry(&dev->fwnode->suppliers,
+					  struct fwnode_link,
-			struct fwnode_link,
+					  c_hook)->supplier;
-			c_hook)->supplier);
+		dev_err_probe(dev, -EPROBE_DEFER, "wait for supplier %pfwP\n",
+			      sup_fw);
 		mutex_unlock(&fwnode_link_lock);
 		return -EPROBE_DEFER;
 	}
 		if (link->status != DL_STATE_AVAILABLE &&
 		    !(link->flags & DL_FLAG_SYNC_STATE_ONLY)) {
 			device_links_missing_supplier(dev);
-			dev_dbg(dev, "probe deferral - supplier %s not ready\n",
+			dev_err_probe(dev, -EPROBE_DEFER,
-				dev_name(link->supplier));
+				      "supplier %s not ready\n",
+				      dev_name(link->supplier));
 			ret = -EPROBE_DEFER;
 			break;
 		}
 	struct device *sup_dev;
 	int ret = 0;
+	/*
+	 * In some cases, a device P might also be a supplier to its child node
+	 * C. However, this would defer the probe of C until the probe of P
+	 * completes successfully. This is perfectly fine in the device driver
+	 * model. device_add() doesn't guarantee probe completion of the device
+	 * by the time it returns.
+	 *
+	 * However, there are a few drivers that assume C will finish probing
+	 * as soon as it's added and before P finishes probing. So, we provide
+	 * a flag to let fw_devlink know not to delay the probe of C until the
+	 * probe of P completes successfully.
+	 *
+	 * When such a flag is set, we can't create device links where P is the
+	 * supplier of C as that would delay the probe of C.
+	 */
+	if (sup_handle->flags & FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD &&
+	    fwnode_is_ancestor_of(sup_handle, con->fwnode))
+		return -EINVAL;
 	sup_dev = get_dev_from_fwnode(sup_handle);
 	if (sup_dev) {
 		/*
 	 * be broken by applying logic. Check for these types of cycles and
 	 * break them so that devices in the cycle probe properly.
 	 *
-	 * If the supplier's parent is dependent on the consumer, then
+	 * If the supplier's parent is dependent on the consumer, then the
-	 * the consumer-supplier dependency is a false dependency. So,
+	 * consumer and supplier have a cyclic dependency. Since fw_devlink
-	 * treat it as an invalid link.
+	 * can't tell which of the inferred dependencies are incorrect, don't
+	 * enforce probe ordering between any of the devices in this cyclic
+	 * dependency. Do this by relaxing all the fw_devlink device links in
+	 * this cycle and by treating the fwnode link between the consumer and
+	 * the supplier as an invalid dependency.
 	 */
 	sup_dev = fwnode_get_next_parent_dev(sup_handle);
 	if (sup_dev && device_is_dependent(con, sup_dev)) {
-		dev_dbg(con, "Not linking to %pfwP - False link\n",
+		dev_info(con, "Fixing up cyclic dependency with %pfwP (%s)\n",
-			sup_handle);
+			 sup_handle, dev_name(sup_dev));
+		device_links_write_lock();
+		fw_devlink_relax_cycle(con, sup_dev);
+		device_links_write_unlock();
 		ret = -EINVAL;
 	} else {
 		/*
 		if (!own_link || ret == -EAGAIN)
 			continue;
-		list_del(&link->s_hook);
+		__fwnode_link_del(link);
-		list_del(&link->c_hook);
-		kfree(link);
 	}
 }
 		if (!own_link || ret == -EAGAIN)
 			continue;
-		list_del(&link->s_hook);
+		__fwnode_link_del(link);
-		list_del(&link->c_hook);
-		kfree(link);
 		/* If no device link was created, nothing more to do. */
 		if (ret)

drivers/block/nbd.c+17−12

 	atomic_t recv_threads;
 	wait_queue_head_t recv_wq;
-	loff_t blksize;
+	unsigned int blksize_bits;
 	loff_t bytesize;
 #if IS_ENABLED(CONFIG_DEBUG_FS)
 	struct dentry *dbg_dir;
 #endif
 };
+static inline unsigned int nbd_blksize(struct nbd_config *config)
+{
+	return 1u << config->blksize_bits;
+}
 struct nbd_device {
 	struct blk_mq_tag_set tag_set;
 #define NBD_MAGIC 0x68797548
-#define NBD_DEF_BLKSIZE 1024
+#define NBD_DEF_BLKSIZE_BITS 10
 static unsigned int nbds_max = 16;
 static int max_part = 16;
 		loff_t blksize)
 {
 	if (!blksize)
-		blksize = NBD_DEF_BLKSIZE;
+		blksize = 1u << NBD_DEF_BLKSIZE_BITS;
 	if (blksize < 512 || blksize > PAGE_SIZE || !is_power_of_2(blksize))
 		return -EINVAL;
 	nbd->config->bytesize = bytesize;
-	nbd->config->blksize = blksize;
+	nbd->config->blksize_bits = __ffs(blksize);
 	if (!nbd->task_recv)
 		return 0;
 		args->index = i;
 		queue_work(nbd->recv_workq, &args->work);
 	}
-	return nbd_set_size(nbd, config->bytesize, config->blksize);
+	return nbd_set_size(nbd, config->bytesize, nbd_blksize(config));
 }
 static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *bdev)
 	case NBD_SET_BLKSIZE:
 		return nbd_set_size(nbd, config->bytesize, arg);
 	case NBD_SET_SIZE:
-		return nbd_set_size(nbd, arg, config->blksize);
+		return nbd_set_size(nbd, arg, nbd_blksize(config));
 	case NBD_SET_SIZE_BLOCKS:
-		if (check_mul_overflow((loff_t)arg, config->blksize, &bytesize))
+		if (check_shl_overflow(arg, config->blksize_bits, &bytesize))
 			return -EINVAL;
-		return nbd_set_size(nbd, bytesize, config->blksize);
+		return nbd_set_size(nbd, bytesize, nbd_blksize(config));
 	case NBD_SET_TIMEOUT:
 		nbd_set_cmd_timeout(nbd, arg);
 		return 0;
 	atomic_set(&config->recv_threads, 0);
 	init_waitqueue_head(&config->recv_wq);
 	init_waitqueue_head(&config->conn_wait);
-	config->blksize = NBD_DEF_BLKSIZE;
+	config->blksize_bits = NBD_DEF_BLKSIZE_BITS;
 	atomic_set(&config->live_connections, 0);
 	try_module_get(THIS_MODULE);
 	return config;
 	debugfs_create_file("tasks", 0444, dir, nbd, &nbd_dbg_tasks_fops);
 	debugfs_create_u64("size_bytes", 0444, dir, &config->bytesize);
 	debugfs_create_u32("timeout", 0444, dir, &nbd->tag_set.timeout);
-	debugfs_create_u64("blocksize", 0444, dir, &config->blksize);
+	debugfs_create_u32("blocksize_bits", 0444, dir, &config->blksize_bits);
 	debugfs_create_file("flags", 0444, dir, nbd, &nbd_dbg_flags_fops);
 	return 0;
 static int nbd_genl_size_set(struct genl_info *info, struct nbd_device *nbd)
 {
 	struct nbd_config *config = nbd->config;
-	u64 bsize = config->blksize;
+	u64 bsize = nbd_blksize(config);
 	u64 bytes = config->bytesize;
 	if (info->attrs[NBD_ATTR_SIZE_BYTES])
 	if (info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES])
 		bsize = nla_get_u64(info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES]);
-	if (bytes != config->bytesize || bsize != config->blksize)
+	if (bytes != config->bytesize || bsize != nbd_blksize(config))
 		return nbd_set_size(nbd, bytes, bsize);
 	return 0;
 }

drivers/crypto/ccp/ccp-ops.c+8−6

 				    in_place ? DMA_BIDIRECTIONAL
 					     : DMA_TO_DEVICE);
 		if (ret)
-			goto e_ctx;
+			goto e_aad;
 		if (in_place) {
 			dst = src;
 	op.u.aes.size = 0;
 	ret = cmd_q->ccp->vdata->perform->aes(&op);
 	if (ret)
-		goto e_dst;
+		goto e_final_wa;
 	if (aes->action == CCP_AES_ACTION_ENCRYPT) {
 		/* Put the ciphered tag after the ciphertext. */
 		ret = ccp_init_dm_workarea(&tag, cmd_q, authsize,
 					   DMA_BIDIRECTIONAL);
 		if (ret)
-			goto e_tag;
+			goto e_final_wa;
 		ret = ccp_set_dm_area(&tag, 0, p_tag, 0, authsize);
-		if (ret)
+		if (ret) {
-			goto e_tag;
+			ccp_dm_free(&tag);
+			goto e_final_wa;
+		}
 		ret = crypto_memneq(tag.address, final_wa.address,
 				    authsize) ? -EBADMSG : 0;
 		ccp_dm_free(&tag);
 	}
-e_tag:
+e_final_wa:
 	ccp_dm_free(&final_wa);
 e_dst:

drivers/gpio/gpio-pca953x.c+2−9

 	mutex_lock(&chip->i2c_lock);
 	ret = regmap_read(chip->regmap, inreg, &reg_val);
 	mutex_unlock(&chip->i2c_lock);
-	if (ret < 0) {
+	if (ret < 0)
-		/*
+		return ret;
-		 * NOTE:
-		 * diagnostic already emitted; that's all we should
-		 * do unless gpio_*_value_cansleep() calls become different
-		 * from their nonsleeping siblings (and report faults).
-		 */
-		return 0;
-	}
 	return !!(reg_val & bit);
 }

drivers/gpio/gpio-rockchip.c+22−0

@@ -689,6 +689,7 @@ static int rockchip_gpio_probe(struct platform_device *pdev) · 688 unmodified lines
689	struct device_node *pctlnp = of_get_parent(np);	689	struct device_node *pctlnp = of_get_parent(np);
690	struct pinctrl_dev *pctldev = NULL;	690	struct pinctrl_dev *pctldev = NULL;
691	struct rockchip_pin_bank *bank = NULL;	691	struct rockchip_pin_bank *bank = NULL;
		692	struct rockchip_pin_output_deferred *cfg;
692	static int gpio;	693	static int gpio;
693	int id, ret;	694	int id, ret;
694		695
@@ -716,12 +717,33 @@ static int rockchip_gpio_probe(struct platform_device *pdev) · 21 unmodified lines
716	if (ret)	717	if (ret)
717	return ret;	718	return ret;
718		719
		720	/*
		721	* Prevent clashes with a deferred output setting
		722	* being added right at this moment.
		723	*/
		724	mutex_lock(&bank->deferred_lock);
		725
719	ret = rockchip_gpiolib_register(bank);	726	ret = rockchip_gpiolib_register(bank);
720	if (ret) {	727	if (ret) {
721	clk_disable_unprepare(bank->clk);	728	clk_disable_unprepare(bank->clk);
		729	mutex_unlock(&bank->deferred_lock);
722	return ret;	730	return ret;
723	}	731	}
724		732
		733	while (!list_empty(&bank->deferred_output)) {
		734	cfg = list_first_entry(&bank->deferred_output,
		735	struct rockchip_pin_output_deferred, head);
		736	list_del(&cfg->head);
		737
		738	ret = rockchip_gpio_direction_output(&bank->gpio_chip, cfg->pin, cfg->arg);
		739	if (ret)
		740	dev_warn(dev, "setting output pin %u to %u failed\n", cfg->pin, cfg->arg);
		741
		742	kfree(cfg);
		743	}
		744
		745	mutex_unlock(&bank->deferred_lock);
		746
725	platform_set_drvdata(pdev, bank);	747	platform_set_drvdata(pdev, bank);
726	dev_info(dev, "probed %pOF\n", np);	748	dev_info(dev, "probed %pOF\n", np);
727		749

drivers/gpu/drm/amd/amdgpu/amdgpu_display.c+31−0

@@ -837,6 +837,28 @@ static int convert_tiling_flags_to_modifier(struct amdgpu_framebuffer *afb) · 836 unmodified lines
837	return 0;	837	return 0;
838	}	838	}
839		839
		840	/* Mirrors the is_displayable check in radeonsi's gfx6_compute_surface */
		841	static int check_tiling_flags_gfx6(struct amdgpu_framebuffer *afb)
		842	{
		843	u64 micro_tile_mode;
		844
		845	/* Zero swizzle mode means linear */
		846	if (AMDGPU_TILING_GET(afb->tiling_flags, SWIZZLE_MODE) == 0)
		847	return 0;
		848
		849	micro_tile_mode = AMDGPU_TILING_GET(afb->tiling_flags, MICRO_TILE_MODE);
		850	switch (micro_tile_mode) {
		851	case 0: /* DISPLAY */
		852	case 3: /* RENDER */
		853	return 0;
		854	default:
		855	drm_dbg_kms(afb->base.dev,
		856	"Micro tile mode %llu not supported for scanout\n",
		857	micro_tile_mode);
		858	return -EINVAL;
		859	}
		860	}
		861
840	static void get_block_dimensions(unsigned int block_log2, unsigned int cpp,	862	static void get_block_dimensions(unsigned int block_log2, unsigned int cpp,
841	unsigned int width, unsigned int height)	863	unsigned int width, unsigned int height)
842	{	864	{
@@ -1103,6 +1125,7 @@ int amdgpu_display_framebuffer_init(struct drm_device *dev, · 260 unmodified lines
1103	const struct drm_mode_fb_cmd2 *mode_cmd,	1125	const struct drm_mode_fb_cmd2 *mode_cmd,
1104	struct drm_gem_object *obj)	1126	struct drm_gem_object *obj)
1105	{	1127	{
		1128	struct amdgpu_device *adev = drm_to_adev(dev);
1106	int ret, i;	1129	int ret, i;
1107		1130
1108	/*	1131	/*
@@ -1122,6 +1145,14 @@ int amdgpu_display_framebuffer_init(struct drm_device *dev, · 13 unmodified lines
1122	if (ret)	1145	if (ret)
1123	return ret;	1146	return ret;
1124		1147
		1148	if (!dev->mode_config.allow_fb_modifiers) {
		1149	drm_WARN_ONCE(dev, adev->family >= AMDGPU_FAMILY_AI,
		1150	"GFX9+ requires FB check based on format modifier\n");
		1151	ret = check_tiling_flags_gfx6(rfb);
		1152	if (ret)
		1153	return ret;
		1154	}
		1155
1125	if (dev->mode_config.allow_fb_modifiers &&	1156	if (dev->mode_config.allow_fb_modifiers &&
1126	!(rfb->base.flags & DRM_MODE_FB_MODIFIERS)) {	1157	!(rfb->base.flags & DRM_MODE_FB_MODIFIERS)) {
1127	ret = convert_tiling_flags_to_modifier(rfb);	1158	ret = convert_tiling_flags_to_modifier(rfb);

drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c+1−1

@@ -3599,7 +3599,7 @@ static int gfx_v9_0_mqd_init(struct amdgpu_ring *ring) · 3598 unmodified lines
3599		3599
3600	/* set static priority for a queue/ring */	3600	/* set static priority for a queue/ring */
3601	gfx_v9_0_mqd_set_priority(ring, mqd);	3601	gfx_v9_0_mqd_set_priority(ring, mqd);
3602	mqd->cp_hqd_quantum = RREG32(mmCP_HQD_QUANTUM);	3602	mqd->cp_hqd_quantum = RREG32_SOC15(GC, 0, mmCP_HQD_QUANTUM);
3603		3603
3604	/* map_queues packet doesn't need activate the queue,	3604	/* map_queues packet doesn't need activate the queue,
3605	* so only kiq need set this field.	3605	* so only kiq need set this field.

drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c+2−1

 {
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+	gmc_v10_0_gart_disable(adev);
 	if (amdgpu_sriov_vf(adev)) {
 		/* full access mode, so don't touch any GMC register */
 		DRM_DEBUG("For SRIOV client, shouldn't do anything.\n");
 	amdgpu_irq_put(adev, &adev->gmc.ecc_irq, 0);
 	amdgpu_irq_put(adev, &adev->gmc.vm_fault, 0);
-	gmc_v10_0_gart_disable(adev);
 	return 0;
 }

drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c+2−1

 {
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+	gmc_v9_0_gart_disable(adev);
 	if (amdgpu_sriov_vf(adev)) {
 		/* full access mode, so don't touch any GMC register */
 		DRM_DEBUG("For SRIOV client, shouldn't do anything.\n");
 	amdgpu_irq_put(adev, &adev->gmc.ecc_irq, 0);
 	amdgpu_irq_put(adev, &adev->gmc.vm_fault, 0);
-	gmc_v9_0_gart_disable(adev);
 	return 0;
 }

drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c+8−0

 			msleep(1000);
 	}
+	/* TODO: check whether can submit a doorbell request to raise
+	 * a doorbell fence to exit gfxoff.
+	 */
+	if (adev->in_s0ix)
+		amdgpu_gfx_off_ctrl(adev, false);
 	sdma_v5_2_soft_reset(adev);
 	/* unhalt the MEs */
 	sdma_v5_2_enable(adev, true);
 	/* start the gfx rings and rlc compute queues */
 	r = sdma_v5_2_gfx_resume(adev);
+	if (adev->in_s0ix)
+		amdgpu_gfx_off_ctrl(adev, true);
 	if (r)
 		return r;
 	r = sdma_v5_2_rlc_resume(adev);

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c+2−0

 	init_data.asic_id.pci_revision_id = adev->pdev->revision;
 	init_data.asic_id.hw_internal_rev = adev->external_rev_id;
+	init_data.asic_id.chip_id = adev->pdev->device;
 	init_data.asic_id.vram_width = adev->gmc.vram_width;
 	/* TODO: initialize init_data.asic_id.vram_type here!!!! */
 		linear_lut[i] = 0xFFFF * i / 15;
 	params.set = 0;
+	params.backlight_ramping_override = false;
 	params.backlight_ramping_start = 0xCCCC;
 	params.backlight_ramping_reduction = 0xCCCCCCCC;
 	params.backlight_lut_array_size = 16;

drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c+7−8

@@ -1826,14 +1826,13 @@ bool perform_link_training_with_retries( · 1825 unmodified lines
1826	if (panel_mode == DP_PANEL_MODE_EDP) {	1826	if (panel_mode == DP_PANEL_MODE_EDP) {
1827	struct cp_psp *cp_psp = &stream->ctx->cp_psp;	1827	struct cp_psp *cp_psp = &stream->ctx->cp_psp;
1828		1828
1829	if (cp_psp && cp_psp->funcs.enable_assr) {	1829	if (cp_psp && cp_psp->funcs.enable_assr)
1830	if (!cp_psp->funcs.enable_assr(cp_psp->handle, link)) {	1830	/* ASSR is bound to fail with unsigned PSP
1831	/* since eDP implies ASSR on, change panel	1831	* verstage used during devlopment phase.
1832	* mode to disable ASSR	1832	* Report and continue with eDP panel mode to
1833	*/	1833	* perform eDP link training with right settings
1834	panel_mode = DP_PANEL_MODE_DEFAULT;	1834	*/
1835	}	1835	cp_psp->funcs.enable_assr(cp_psp->handle, link);
1836	}
1837	}	1836	}
1838	#endif	1837	#endif
1839		1838

drivers/gpu/drm/exynos/exynos5433_drm_decon.c+1−3

 {
 	struct device *dev = &pdev->dev;
 	struct decon_context *ctx;
-	struct resource *res;
 	int ret;
 	int i;
 		ctx->clks[i] = clk;
 	}
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	ctx->addr = devm_platform_ioremap_resource(pdev, 0);
-	ctx->addr = devm_ioremap_resource(dev, res);
 	if (IS_ERR(ctx->addr))
 		return PTR_ERR(ctx->addr);

drivers/gpu/drm/exynos/exynos_drm_dsi.c+1−3

 static int exynos_dsi_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
-	struct resource *res;
 	struct exynos_dsi *dsi;
 	int ret, i;
 		}
 	}
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	dsi->reg_base = devm_platform_ioremap_resource(pdev, 0);
-	dsi->reg_base = devm_ioremap_resource(dev, res);
 	if (IS_ERR(dsi->reg_base))
 		return PTR_ERR(dsi->reg_base);

drivers/gpu/drm/exynos/exynos_drm_fimc.c+1−4

 /*
  * A structure of fimc context.
  *
- * @regs_res: register resources.
  * @regs: memory mapped io registers.
  * @lock: locking of operations.
  * @clocks: fimc clocks.
 	struct exynos_drm_ipp_formats	*formats;
 	unsigned int			num_formats;
-	struct resource	*regs_res;
 	void __iomem	*regs;
 	spinlock_t	lock;
 	struct clk	*clocks[FIMC_CLKS_MAX];
 	ctx->num_formats = num_formats;
 	/* resource memory */
-	ctx->regs_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	ctx->regs = devm_platform_ioremap_resource(pdev, 0);
-	ctx->regs = devm_ioremap_resource(dev, ctx->regs_res);
 	if (IS_ERR(ctx->regs))
 		return PTR_ERR(ctx->regs);

drivers/gpu/drm/exynos/exynos_drm_fimd.c+1−3

@@ -1202,9 +1202,7 @@ static int fimd_probe(struct platform_device *pdev) · 1201 unmodified lines
1202	return PTR_ERR(ctx->lcd_clk);	1202	return PTR_ERR(ctx->lcd_clk);
1203	}	1203	}
1204		1204
1205	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);	1205	ctx->regs = devm_platform_ioremap_resource(pdev, 0);
1206
1207	ctx->regs = devm_ioremap_resource(dev, res);
1208	if (IS_ERR(ctx->regs))	1206	if (IS_ERR(ctx->regs))
1209	return PTR_ERR(ctx->regs);	1207	return PTR_ERR(ctx->regs);
1210		1208

drivers/gpu/drm/exynos/exynos_drm_g2d.c+1−4

 static int g2d_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
-	struct resource *res;
 	struct g2d_data *g2d;
 	int ret;
 	clear_bit(G2D_BIT_SUSPEND_RUNQUEUE, &g2d->flags);
 	clear_bit(G2D_BIT_ENGINE_BUSY, &g2d->flags);
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	g2d->regs = devm_platform_ioremap_resource(pdev, 0);
-	g2d->regs = devm_ioremap_resource(dev, res);
 	if (IS_ERR(g2d->regs)) {
 		ret = PTR_ERR(g2d->regs);
 		goto err_put_clk;

drivers/gpu/drm/exynos/exynos_drm_gsc.c+1−5

 /*
  * A structure of gsc context.
  *
- * @regs_res: register resources.
  * @regs: memory mapped io registers.
  * @gsc_clk: gsc gate clock.
  * @sc: scaler infomations.
 	struct exynos_drm_ipp_formats	*formats;
 	unsigned int			num_formats;
-	struct resource	*regs_res;
 	void __iomem	*regs;
 	const char	**clk_names;
 	struct clk	*clocks[GSC_MAX_CLOCKS];
 		}
 	}
-	/* resource memory */
+	ctx->regs = devm_platform_ioremap_resource(pdev, 0);
-	ctx->regs_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-	ctx->regs = devm_ioremap_resource(dev, ctx->regs_res);
 	if (IS_ERR(ctx->regs))
 		return PTR_ERR(ctx->regs);

drivers/gpu/drm/exynos/exynos_drm_rotator.c+1−3

 static int rotator_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
-	struct resource	*regs_res;
 	struct rot_context *rot;
 	const struct rot_variant *variant;
 	int irq;
 	rot->formats = variant->formats;
 	rot->num_formats = variant->num_formats;
 	rot->dev = dev;
-	regs_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	rot->regs = devm_platform_ioremap_resource(pdev, 0);
-	rot->regs = devm_ioremap_resource(dev, regs_res);
 	if (IS_ERR(rot->regs))
 		return PTR_ERR(rot->regs);

drivers/gpu/drm/exynos/exynos_drm_scaler.c+1−3

 static int scaler_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
-	struct resource	*regs_res;
 	struct scaler_context *scaler;
 	int irq;
 	int ret, i;
 		(struct scaler_data *)of_device_get_match_data(dev);
 	scaler->dev = dev;
-	regs_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	scaler->regs = devm_platform_ioremap_resource(pdev, 0);
-	scaler->regs = devm_ioremap_resource(dev, regs_res);
 	if (IS_ERR(scaler->regs))
 		return PTR_ERR(scaler->regs);

drivers/gpu/drm/exynos/exynos_hdmi.c+1−3

 	struct hdmi_audio_infoframe *audio_infoframe;
 	struct device *dev = &pdev->dev;
 	struct hdmi_context *hdata;
-	struct resource *res;
 	int ret;
 	hdata = devm_kzalloc(dev, sizeof(struct hdmi_context), GFP_KERNEL);
 		return ret;
 	}
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	hdata->regs = devm_platform_ioremap_resource(pdev, 0);
-	hdata->regs = devm_ioremap_resource(dev, res);
 	if (IS_ERR(hdata->regs)) {
 		ret = PTR_ERR(hdata->regs);
 		return ret;

drivers/gpu/drm/i915/gt/intel_context.c+3−2

 	return 0;
 }
-static int sw_fence_dummy_notify(struct i915_sw_fence *sf,
+static int __i915_sw_fence_call
-				 enum i915_sw_fence_notify state)
+sw_fence_dummy_notify(struct i915_sw_fence *sf,
+		      enum i915_sw_fence_notify state)
 {
 	return NOTIFY_DONE;
 }

drivers/gpu/drm/i915/gt/intel_rps.c+0−2

@@ -882,8 +882,6 @@ void intel_rps_park(struct intel_rps *rps) · 881 unmodified lines
882	if (!intel_rps_is_enabled(rps))	882	if (!intel_rps_is_enabled(rps))
883	return;	883	return;
884		884
885	GEM_BUG_ON(atomic_read(&rps->num_waiters));
886
887	if (!intel_rps_clear_active(rps))	885	if (!intel_rps_clear_active(rps))
888	return;	886	return;
889		887

drivers/gpu/drm/i915/gt/uc/abi/guc_communication_ctb_abi.h+5−5

@@ -102,11 +102,11 @@ static_assert(sizeof(struct guc_ct_buffer_desc) == 64); · 101 unmodified lines
102	* \| +-------+--------------------------------------------------------------+	102	* \| +-------+--------------------------------------------------------------+
103	* \| \| 7:0 \| NUM_DWORDS = length (in dwords) of the embedded HXG message \|	103	* \| \| 7:0 \| NUM_DWORDS = length (in dwords) of the embedded HXG message \|
104	* +---+-------+--------------------------------------------------------------+	104	* +---+-------+--------------------------------------------------------------+
105	* \| 1 \| 31:0 \| +--------------------------------------------------------+ \|	105	* \| 1 \| 31:0 \| \|
106	* +---+-------+ \| \| \|	106	* +---+-------+ \|
107	* \|...\| \| \| Embedded `HXG Message`_ \| \|	107	* \|...\| \| [Embedded `HXG Message`_] \|
108	* +---+-------+ \| \| \|	108	* +---+-------+ \|
109	* \| n \| 31:0 \| +--------------------------------------------------------+ \|	109	* \| n \| 31:0 \| \|
110	* +---+-------+--------------------------------------------------------------+	110	* +---+-------+--------------------------------------------------------------+
111	*/	111	*/
112		112

drivers/gpu/drm/i915/gt/uc/abi/guc_communication_mmio_abi.h+5−5

@@ -38,11 +38,11 @@ · 37 unmodified lines
38	* +---+-------+--------------------------------------------------------------+	38	* +---+-------+--------------------------------------------------------------+
39	* \| \| Bits \| Description \|	39	* \| \| Bits \| Description \|
40	* +===+=======+==============================================================+	40	* +===+=======+==============================================================+
41	* \| 0 \| 31:0 \| +--------------------------------------------------------+ \|	41	* \| 0 \| 31:0 \| \|
42	* +---+-------+ \| \| \|	42	* +---+-------+ \|
43	* \|...\| \| \| Embedded `HXG Message`_ \| \|	43	* \|...\| \| [Embedded `HXG Message`_] \|
44	* +---+-------+ \| \| \|	44	* +---+-------+ \|
45	* \| n \| 31:0 \| +--------------------------------------------------------+ \|	45	* \| n \| 31:0 \| \|
46	* +---+-------+--------------------------------------------------------------+	46	* +---+-------+--------------------------------------------------------------+
47	*/	47	*/
48		48

drivers/gpu/drm/i915/gvt/scheduler.c+2−2

@@ -576,7 +576,7 @@ retry: · 575 unmodified lines
576		576
577	/* No one is going to touch shadow bb from now on. */	577	/* No one is going to touch shadow bb from now on. */
578	i915_gem_object_flush_map(bb->obj);	578	i915_gem_object_flush_map(bb->obj);
579	i915_gem_object_unlock(bb->obj);	579	i915_gem_ww_ctx_fini(&ww);
580	}	580	}
581	}	581	}
582	return 0;	582	return 0;
@@ -630,7 +630,7 @@ retry: · 47 unmodified lines
630	return ret;	630	return ret;
631	}	631	}
632		632
633	i915_gem_object_unlock(wa_ctx->indirect_ctx.obj);	633	i915_gem_ww_ctx_fini(&ww);
634		634
635	/* FIXME: we are not tracking our pinned VMA leaving it	635	/* FIXME: we are not tracking our pinned VMA leaving it
636	* up to the core to fix up the stray pin_count upon	636	* up to the core to fix up the stray pin_count upon

drivers/gpu/drm/i915/i915_request.c+2−9

 	i915_sw_fence_init(&rq->submit, submit_notify);
 	i915_sw_fence_init(&rq->semaphore, semaphore_notify);
-	dma_fence_init(&rq->fence, &i915_fence_ops, &rq->lock, 0, 0);
 	rq->capture_list = NULL;
 	init_llist_head(&rq->execute_cb);
 	rq->ring = ce->ring;
 	rq->execution_mask = ce->engine->mask;
-	kref_init(&rq->fence.refcount);
-	rq->fence.flags = 0;
-	rq->fence.error = 0;
-	INIT_LIST_HEAD(&rq->fence.cb_list);
 	ret = intel_timeline_get_seqno(tl, rq, &seqno);
 	if (ret)
 		goto err_free;
-	rq->fence.context = tl->fence_context;
+	dma_fence_init(&rq->fence, &i915_fence_ops, &rq->lock,
-	rq->fence.seqno = seqno;
+		       tl->fence_context, seqno);
 	RCU_INIT_POINTER(rq->timeline, tl);
 	rq->hwsp_seqno = tl->hwsp_seqno;

drivers/gpu/drm/tegra/dc.c+0−3

 				   bool prepare_bandwidth_transition)
 {
 	const struct tegra_plane_state *old_tegra_state, *new_tegra_state;
-	const struct tegra_dc_state *old_dc_state, *new_dc_state;
 	u32 i, new_avg_bw, old_avg_bw, new_peak_bw, old_peak_bw;
 	const struct drm_plane_state *old_plane_state;
 	const struct drm_crtc_state *old_crtc_state;
 		return;
 	old_crtc_state = drm_atomic_get_old_crtc_state(state, crtc);
-	old_dc_state = to_const_dc_state(old_crtc_state);
-	new_dc_state = to_const_dc_state(crtc->state);
 	if (!crtc->state->active) {
 		if (!old_crtc_state->active)

drivers/gpu/drm/tegra/dc.h+0−6

 	return NULL;
 }
-static inline const struct tegra_dc_state *
-to_const_dc_state(const struct drm_crtc_state *state)
-{
-	return to_dc_state((struct drm_crtc_state *)state);
-}
 struct tegra_dc_stats {
 	unsigned long frames;
 	unsigned long vblank;

drivers/gpu/drm/tegra/uapi.c+1−1

@@ -222,7 +222,7 @@ int tegra_drm_ioctl_channel_map(struct drm_device drm, void data, struct drm_f · 221 unmodified lines
222	mapping->iova = sg_dma_address(mapping->sgt->sgl);	222	mapping->iova = sg_dma_address(mapping->sgt->sgl);
223	}	223	}
224		224
225	mapping->iova_end = mapping->iova + host1x_to_tegra_bo(mapping->bo)->size;	225	mapping->iova_end = mapping->iova + host1x_to_tegra_bo(mapping->bo)->gem.size;
226		226
227	err = xa_alloc(&context->mappings, &args->mapping, mapping, XA_LIMIT(1, U32_MAX),	227	err = xa_alloc(&context->mappings, &args->mapping, mapping, XA_LIMIT(1, U32_MAX),
228	GFP_KERNEL);	228	GFP_KERNEL);

drivers/gpu/host1x/fence.c+4−2

 #include "intr.h"
 #include "syncpt.h"
-DEFINE_SPINLOCK(lock);
+static DEFINE_SPINLOCK(lock);
 struct host1x_syncpt_fence {
 	struct dma_fence base;
 		return ERR_PTR(-ENOMEM);
 	fence->waiter = kzalloc(sizeof(*fence->waiter), GFP_KERNEL);
-	if (!fence->waiter)
+	if (!fence->waiter) {
+		kfree(fence);
 		return ERR_PTR(-ENOMEM);
+	}
 	fence->sp = sp;
 	fence->threshold = threshold;

drivers/hid/amd-sfh-hid/amd_sfh_pcie.c+4−4

 	if (!privdata->cl_data)
 		return -ENOMEM;
-	rc = devm_add_action_or_reset(&pdev->dev, amd_mp2_pci_remove, privdata);
+	mp2_select_ops(privdata);
+	rc = amd_sfh_hid_client_init(privdata);
 	if (rc)
 		return rc;
-	mp2_select_ops(privdata);
+	return devm_add_action_or_reset(&pdev->dev, amd_mp2_pci_remove, privdata);
-	return amd_sfh_hid_client_init(privdata);
 }
 static int __maybe_unused amd_mp2_pci_resume(struct device *dev)

drivers/hid/hid-apple.c+7−0

 /*
  * MacBook JIS keyboard has wrong logical maximum
+ * Magic Keyboard JIS has wrong logical maximum
  */
 static __u8 *apple_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 		unsigned int *rsize)
 {
 	struct apple_sc *asc = hid_get_drvdata(hdev);
+	if(*rsize >=71 && rdesc[70] == 0x65 && rdesc[64] == 0x65) {
+		hid_info(hdev,
+			 "fixing up Magic Keyboard JIS report descriptor\n");
+		rdesc[64] = rdesc[70] = 0xe7;
+	}
 	if ((asc->quirks & APPLE_RDESC_JIS) && *rsize >= 60 &&
 			rdesc[53] == 0x65 && rdesc[59] == 0x65) {
 		hid_info(hdev,

drivers/hid/hid-betopff.c+10−3

 {
 	struct betopff_device *betopff;
 	struct hid_report *report;
-	struct hid_input *hidinput =
+	struct hid_input *hidinput;
-			list_first_entry(&hid->inputs, struct hid_input, list);
 	struct list_head *report_list =
 			&hid->report_enum[HID_OUTPUT_REPORT].report_list;
-	struct input_dev *dev = hidinput->input;
+	struct input_dev *dev;
 	int field_count = 0;
 	int error;
 	int i, j;
+	if (list_empty(&hid->inputs)) {
+		hid_err(hid, "no inputs found\n");
+		return -ENODEV;
+	}
+	hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
+	dev = hidinput->input;
 	if (list_empty(report_list)) {
 		hid_err(hid, "no output reports found\n");
 		return -ENODEV;

drivers/hid/hid-u2fzero.c+3−1

@@ -198,7 +198,9 @@ static int u2fzero_rng_read(struct hwrng rng, void data, · 197 unmodified lines
198	}	198	}
199		199
200	ret = u2fzero_recv(dev, &req, &resp);	200	ret = u2fzero_recv(dev, &req, &resp);
201	if (ret < 0)	201
		202	/* ignore errors or packets without data */
		203	if (ret < offsetof(struct u2f_hid_msg, init.data))
202	return 0;	204	return 0;
203		205
204	/* only take the minimum amount of data it is safe to take */	206	/* only take the minimum amount of data it is safe to take */

drivers/hid/wacom_wac.c+8−0

 	{ "Wacom Intuos Pro S", 31920, 19950, 8191, 63,
 	  INTUOSP2S_BT, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 7,
 	  .touch_max = 10 };
+static const struct wacom_features wacom_features_0x3c6 =
+	{ "Wacom Intuos BT S", 15200, 9500, 4095, 63,
+	  INTUOSHT3_BT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 4 };
+static const struct wacom_features wacom_features_0x3c8 =
+	{ "Wacom Intuos BT M", 21600, 13500, 4095, 63,
+	  INTUOSHT3_BT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 4 };
 static const struct wacom_features wacom_features_HID_ANY_ID =
 	{ "Wacom HID", .type = HID_GENERIC, .oVid = HID_ANY_ID, .oPid = HID_ANY_ID };
 	{ USB_DEVICE_WACOM(0x37A) },
 	{ USB_DEVICE_WACOM(0x37B) },
 	{ BT_DEVICE_WACOM(0x393) },
+	{ BT_DEVICE_WACOM(0x3c6) },
+	{ BT_DEVICE_WACOM(0x3c8) },
 	{ USB_DEVICE_WACOM(0x4001) },
 	{ USB_DEVICE_WACOM(0x4004) },
 	{ USB_DEVICE_WACOM(0x5000) },

drivers/hwmon/k10temp.c+0−6

 			   HWMON_T_INPUT | HWMON_T_LABEL,
 			   HWMON_T_INPUT | HWMON_T_LABEL,
 			   HWMON_T_INPUT | HWMON_T_LABEL),
-	HWMON_CHANNEL_INFO(in,
-			   HWMON_I_INPUT | HWMON_I_LABEL,
-			   HWMON_I_INPUT | HWMON_I_LABEL),
-	HWMON_CHANNEL_INFO(curr,
-			   HWMON_C_INPUT | HWMON_C_LABEL,
-			   HWMON_C_INPUT | HWMON_C_LABEL),
 	NULL
 };

drivers/hwmon/ltc2947-core.c+6−2

 		return ret;
 	/* check external clock presence */
-	extclk = devm_clk_get(st->dev, NULL);
+	extclk = devm_clk_get_optional(st->dev, NULL);
-	if (!IS_ERR(extclk)) {
+	if (IS_ERR(extclk))
+		return dev_err_probe(st->dev, PTR_ERR(extclk),
+				     "Failed to get external clock\n");
+	if (extclk) {
 		unsigned long rate_hz;
 		u8 pre = 0, div, tbctl;
 		u64 aux;

drivers/hwmon/mlxreg-fan.c+9−3

 {
 	struct mlxreg_fan *fan = cdev->devdata;
 	unsigned long cur_state;
+	int i, config = 0;
 	u32 regval;
-	int i;
 	int err;
 	/*
 	 * overwritten.
 	 */
 	if (state >= MLXREG_FAN_SPEED_MIN && state <= MLXREG_FAN_SPEED_MAX) {
+		/*
+		 * This is configuration change, which is only supported through sysfs.
+		 * For configuration non-zero value is to be returned to avoid thermal
+		 * statistics update.
+		 */
+		config = 1;
 		state -= MLXREG_FAN_MAX_STATE;
 		for (i = 0; i < state; i++)
 			fan->cooling_levels[i] = state;
 		cur_state = MLXREG_FAN_PWM_DUTY2STATE(regval);
 		if (state < cur_state)
-			return 0;
+			return config;
 		state = cur_state;
 	}
 		dev_err(fan->dev, "Failed to write PWM duty\n");
 		return err;
 	}
-	return 0;
+	return config;
 }
 static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = {

drivers/hwmon/occ/common.c+5−12

 		if (val == OCC_TEMP_SENSOR_FAULT)
 			return -EREMOTEIO;
-		/*
+		/* sensor not ready */
-		 * VRM doesn't return temperature, only alarm bit. This
+		if (val == 0)
-		 * attribute maps to tempX_alarm instead of tempX_input for
+			return -EAGAIN;
-		 * VRM
-		 */
-		if (temp->fru_type != OCC_FRU_TYPE_VRM) {
-			/* sensor not ready */
-			if (val == 0)
-				return -EAGAIN;
-			val *= 1000;
+		val *= 1000;
-		}
 		break;
 	case 2:
 		val = temp->fru_type;
 					     0, i);
 		attr++;
-		if (sensors->temp.version > 1 &&
+		if (sensors->temp.version == 2 &&
 		    temp->fru_type == OCC_FRU_TYPE_VRM) {
 			snprintf(attr->name, sizeof(attr->name),
 				 "temp%d_alarm", s);

drivers/hwmon/pmbus/ibm-cffps.c+8−2

 		cmd = CFFPS_SN_CMD;
 		break;
 	case CFFPS_DEBUGFS_MAX_POWER_OUT:
-		rc = i2c_smbus_read_word_swapped(psu->client,
+		if (psu->version == cffps1) {
-						 CFFPS_MAX_POWER_OUT_CMD);
+			rc = i2c_smbus_read_word_swapped(psu->client,
+					CFFPS_MAX_POWER_OUT_CMD);
+		} else {
+			rc = i2c_smbus_read_word_data(psu->client,
+					CFFPS_MAX_POWER_OUT_CMD);
+		}
 		if (rc < 0)
 			return rc;

drivers/hwmon/pmbus/mp2975.c+1−1

@@ -54,7 +54,7 @@ · 53 unmodified lines
54		54
55	#define MP2975_RAIL2_FUNC (PMBUS_HAVE_VOUT \| PMBUS_HAVE_STATUS_VOUT \| \	55	#define MP2975_RAIL2_FUNC (PMBUS_HAVE_VOUT \| PMBUS_HAVE_STATUS_VOUT \| \
56	PMBUS_HAVE_IOUT \| PMBUS_HAVE_STATUS_IOUT \| \	56	PMBUS_HAVE_IOUT \| PMBUS_HAVE_STATUS_IOUT \| \
57	PMBUS_PHASE_VIRTUAL)	57	PMBUS_HAVE_POUT \| PMBUS_PHASE_VIRTUAL)
58		58
59	struct mp2975_data {	59	struct mp2975_data {
60	struct pmbus_driver_info info;	60	struct pmbus_driver_info info;

drivers/hwmon/tmp421.c+39−32

@@ -100,71 +100,81 @@ struct tmp421_data { · 99 unmodified lines
100	s16 temp[4];	100	s16 temp[4];
101	};	101	};
102		102
103	static int temp_from_s16(s16 reg)	103	static int temp_from_raw(u16 reg, bool extended)
104	{	104	{
105	/* Mask out status bits */	105	/* Mask out status bits */
106	int temp = reg & ~0xf;	106	int temp = reg & ~0xf;
107		107
108	return (temp * 1000 + 128) / 256;	108	if (extended)
109	}	109	temp = temp - 64 * 256;
110		110	else
111	static int temp_from_u16(u16 reg)	111	temp = (s16)temp;
112	{
113	/* Mask out status bits */
114	int temp = reg & ~0xf;
115
116	/* Add offset for extended temperature range. */
117	temp -= 64 * 256;
118		112
119	return (temp * 1000 + 128) / 256;	113	return DIV_ROUND_CLOSEST(temp * 1000, 256);
120	}	114	}
121		115
122	static struct tmp421_data tmp421_update_device(struct device dev)	116	static int tmp421_update_device(struct tmp421_data *data)
123	{	117	{
124	struct tmp421_data *data = dev_get_drvdata(dev);
125	struct i2c_client *client = data->client;	118	struct i2c_client *client = data->client;
		119	int ret = 0;
126	int i;	120	int i;
127		121
128	mutex_lock(&data->update_lock);	122	mutex_lock(&data->update_lock);
129		123
130	if (time_after(jiffies, data->last_updated + (HZ / 2)) \|\|	124	if (time_after(jiffies, data->last_updated + (HZ / 2)) \|\|
131	!data->valid) {	125	!data->valid) {
132	data->config = i2c_smbus_read_byte_data(client,	126	ret = i2c_smbus_read_byte_data(client, TMP421_CONFIG_REG_1);
133	TMP421_CONFIG_REG_1);	127	if (ret < 0)
		128	goto exit;
		129	data->config = ret;
134		130
135	for (i = 0; i < data->channels; i++) {	131	for (i = 0; i < data->channels; i++) {
136	data->temp[i] = i2c_smbus_read_byte_data(client,	132	ret = i2c_smbus_read_byte_data(client, TMP421_TEMP_MSB[i]);
137	TMP421_TEMP_MSB[i]) << 8;	133	if (ret < 0)
138	data->temp[i] \|= i2c_smbus_read_byte_data(client,	134	goto exit;
139	TMP421_TEMP_LSB[i]);	135	data->temp[i] = ret << 8;
		136
		137	ret = i2c_smbus_read_byte_data(client, TMP421_TEMP_LSB[i]);
		138	if (ret < 0)
		139	goto exit;
		140	data->temp[i] \|= ret;
140	}	141	}
141	data->last_updated = jiffies;	142	data->last_updated = jiffies;
142	data->valid = 1;	143	data->valid = 1;
143	}	144	}
144		145
		146	exit:
145	mutex_unlock(&data->update_lock);	147	mutex_unlock(&data->update_lock);
146		148
147	return data;	149	if (ret < 0) {
		150	data->valid = 0;
		151	return ret;
		152	}
		153
		154	return 0;
148	}	155	}
149		156
150	static int tmp421_read(struct device *dev, enum hwmon_sensor_types type,	157	static int tmp421_read(struct device *dev, enum hwmon_sensor_types type,
151	u32 attr, int channel, long *val)	158	u32 attr, int channel, long *val)
152	{	159	{
153	struct tmp421_data *tmp421 = tmp421_update_device(dev);	160	struct tmp421_data *tmp421 = dev_get_drvdata(dev);
		161	int ret = 0;
		162
		163	ret = tmp421_update_device(tmp421);
		164	if (ret)
		165	return ret;
154		166
155	switch (attr) {	167	switch (attr) {
156	case hwmon_temp_input:	168	case hwmon_temp_input:
157	if (tmp421->config & TMP421_CONFIG_RANGE)	169	*val = temp_from_raw(tmp421->temp[channel],
158	*val = temp_from_u16(tmp421->temp[channel]);	170	tmp421->config & TMP421_CONFIG_RANGE);
159	else
160	*val = temp_from_s16(tmp421->temp[channel]);
161	return 0;	171	return 0;
162	case hwmon_temp_fault:	172	case hwmon_temp_fault:
163	/*	173	/*
164	* The OPEN bit signals a fault. This is bit 0 of the temperature	174	* Any of OPEN or /PVLD bits indicate a hardware mulfunction
165	* register (low byte).	175	* and the conversion result may be incorrect
166	*/	176	*/
167	*val = tmp421->temp[channel] & 0x01;	177	*val = !!(tmp421->temp[channel] & 0x03);
168	return 0;	178	return 0;
169	default:	179	default:
170	return -EOPNOTSUPP;	180	return -EOPNOTSUPP;
@@ -177,9 +187,6 @@ static umode_t tmp421_is_visible(const void *data, enum hwmon_sensor_types type, · 6 unmodified lines
177	{	187	{
178	switch (attr) {	188	switch (attr) {
179	case hwmon_temp_fault:	189	case hwmon_temp_fault:
180	if (channel == 0)
181	return 0;
182	return 0444;
183	case hwmon_temp_input:	190	case hwmon_temp_input:
184	return 0444;	191	return 0444;
185	default:	192	default:

drivers/hwmon/w83791d.c+11−18

@@ -273,9 +273,6 @@ struct w83791d_data { · 272 unmodified lines
273	char valid; /* !=0 if following fields are valid */	273	char valid; /* !=0 if following fields are valid */
274	unsigned long last_updated; /* In jiffies */	274	unsigned long last_updated; /* In jiffies */
275		275
276	/* array of 2 pointers to subclients */
277	struct i2c_client *lm75[2];
278
279	/* volts */	276	/* volts */
280	u8 in[NUMBER_OF_VIN]; /* Register value */	277	u8 in[NUMBER_OF_VIN]; /* Register value */
281	u8 in_max[NUMBER_OF_VIN]; /* Register value */	278	u8 in_max[NUMBER_OF_VIN]; /* Register value */
@@ -1257,7 +1254,6 @@ static const struct attribute_group w83791d_group_fanpwm45 = { · 975 unmodified lines
1257	static int w83791d_detect_subclients(struct i2c_client *client)	1254	static int w83791d_detect_subclients(struct i2c_client *client)
1258	{	1255	{
1259	struct i2c_adapter *adapter = client->adapter;	1256	struct i2c_adapter *adapter = client->adapter;
1260	struct w83791d_data *data = i2c_get_clientdata(client);
1261	int address = client->addr;	1257	int address = client->addr;
1262	int i, id;	1258	int i, id;
1263	u8 val;	1259	u8 val;
@@ -1280,22 +1276,19 @@ static int w83791d_detect_subclients(struct i2c_client *client) · 16 unmodified lines
1280	}	1276	}
1281		1277
1282	val = w83791d_read(client, W83791D_REG_I2C_SUBADDR);	1278	val = w83791d_read(client, W83791D_REG_I2C_SUBADDR);
1283	if (!(val & 0x08))	1279
1284	data->lm75[0] = devm_i2c_new_dummy_device(&client->dev, adapter,	1280	if (!(val & 0x88) && (val & 0x7) == ((val >> 4) & 0x7)) {
1285	0x48 + (val & 0x7));	1281	dev_err(&client->dev,
1286	if (!(val & 0x80)) {	1282	"duplicate addresses 0x%x, use force_subclient\n", 0x48 + (val & 0x7));
1287	if (!IS_ERR(data->lm75[0]) &&	1283	return -ENODEV;
1288	((val & 0x7) == ((val >> 4) & 0x7))) {
1289	dev_err(&client->dev,
1290	"duplicate addresses 0x%x, "
1291	"use force_subclient\n",
1292	data->lm75[0]->addr);
1293	return -ENODEV;
1294	}
1295	data->lm75[1] = devm_i2c_new_dummy_device(&client->dev, adapter,
1296	0x48 + ((val >> 4) & 0x7));
1297	}	1284	}
1298		1285
		1286	if (!(val & 0x08))
		1287	devm_i2c_new_dummy_device(&client->dev, adapter, 0x48 + (val & 0x7));
		1288
		1289	if (!(val & 0x80))
		1290	devm_i2c_new_dummy_device(&client->dev, adapter, 0x48 + ((val >> 4) & 0x7));
		1291
1299	return 0;	1292	return 0;
1300	}	1293	}
1301		1294

drivers/hwmon/w83792d.c+11−17

@@ -264,9 +264,6 @@ struct w83792d_data { · 263 unmodified lines
264	char valid; /* !=0 if following fields are valid */	264	char valid; /* !=0 if following fields are valid */
265	unsigned long last_updated; /* In jiffies */	265	unsigned long last_updated; /* In jiffies */
266		266
267	/* array of 2 pointers to subclients */
268	struct i2c_client *lm75[2];
269
270	u8 in[9]; /* Register value */	267	u8 in[9]; /* Register value */
271	u8 in_max[9]; /* Register value */	268	u8 in_max[9]; /* Register value */
272	u8 in_min[9]; /* Register value */	269	u8 in_min[9]; /* Register value */
@@ -927,7 +924,6 @@ w83792d_detect_subclients(struct i2c_client *new_client) · 654 unmodified lines
927	int address = new_client->addr;	924	int address = new_client->addr;
928	u8 val;	925	u8 val;
929	struct i2c_adapter *adapter = new_client->adapter;	926	struct i2c_adapter *adapter = new_client->adapter;
930	struct w83792d_data *data = i2c_get_clientdata(new_client);
931		927
932	id = i2c_adapter_id(adapter);	928	id = i2c_adapter_id(adapter);
933	if (force_subclients[0] == id && force_subclients[1] == address) {	929	if (force_subclients[0] == id && force_subclients[1] == address) {
@@ -946,21 +942,19 @@ w83792d_detect_subclients(struct i2c_client *new_client) · 12 unmodified lines
946	}	942	}
947		943
948	val = w83792d_read_value(new_client, W83792D_REG_I2C_SUBADDR);	944	val = w83792d_read_value(new_client, W83792D_REG_I2C_SUBADDR);
949	if (!(val & 0x08))	945
950	data->lm75[0] = devm_i2c_new_dummy_device(&new_client->dev, adapter,	946	if (!(val & 0x88) && (val & 0x7) == ((val >> 4) & 0x7)) {
951	0x48 + (val & 0x7));	947	dev_err(&new_client->dev,
952	if (!(val & 0x80)) {	948	"duplicate addresses 0x%x, use force_subclient\n", 0x48 + (val & 0x7));
953	if (!IS_ERR(data->lm75[0]) &&	949	return -ENODEV;
954	((val & 0x7) == ((val >> 4) & 0x7))) {
955	dev_err(&new_client->dev,
956	"duplicate addresses 0x%x, use force_subclient\n",
957	data->lm75[0]->addr);
958	return -ENODEV;
959	}
960	data->lm75[1] = devm_i2c_new_dummy_device(&new_client->dev, adapter,
961	0x48 + ((val >> 4) & 0x7));
962	}	950	}
963		951
		952	if (!(val & 0x08))
		953	devm_i2c_new_dummy_device(&new_client->dev, adapter, 0x48 + (val & 0x7));
		954
		955	if (!(val & 0x80))
		956	devm_i2c_new_dummy_device(&new_client->dev, adapter, 0x48 + ((val >> 4) & 0x7));
		957
964	return 0;	958	return 0;
965	}	959	}
966		960

drivers/hwmon/w83793.c+11−15

@@ -202,7 +202,6 @@ static inline s8 TEMP_TO_REG(long val, s8 min, s8 max) · 201 unmodified lines
202	}	202	}
203		203
204	struct w83793_data {	204	struct w83793_data {
205	struct i2c_client *lm75[2];
206	struct device *hwmon_dev;	205	struct device *hwmon_dev;
207	struct mutex update_lock;	206	struct mutex update_lock;
208	char valid; /* !=0 if following fields are valid */	207	char valid; /* !=0 if following fields are valid */
@@ -1566,7 +1565,6 @@ w83793_detect_subclients(struct i2c_client *client) · 1357 unmodified lines
1566	int address = client->addr;	1565	int address = client->addr;
1567	u8 tmp;	1566	u8 tmp;
1568	struct i2c_adapter *adapter = client->adapter;	1567	struct i2c_adapter *adapter = client->adapter;
1569	struct w83793_data *data = i2c_get_clientdata(client);
1570		1568
1571	id = i2c_adapter_id(adapter);	1569	id = i2c_adapter_id(adapter);
1572	if (force_subclients[0] == id && force_subclients[1] == address) {	1570	if (force_subclients[0] == id && force_subclients[1] == address) {
@@ -1586,21 +1584,19 @@ w83793_detect_subclients(struct i2c_client *client) · 13 unmodified lines
1586	}	1584	}
1587		1585
1588	tmp = w83793_read_value(client, W83793_REG_I2C_SUBADDR);	1586	tmp = w83793_read_value(client, W83793_REG_I2C_SUBADDR);
1589	if (!(tmp & 0x08))	1587
1590	data->lm75[0] = devm_i2c_new_dummy_device(&client->dev, adapter,	1588	if (!(tmp & 0x88) && (tmp & 0x7) == ((tmp >> 4) & 0x7)) {
1591	0x48 + (tmp & 0x7));	1589	dev_err(&client->dev,
1592	if (!(tmp & 0x80)) {	1590	"duplicate addresses 0x%x, use force_subclient\n", 0x48 + (tmp & 0x7));
1593	if (!IS_ERR(data->lm75[0])	1591	return -ENODEV;
1594	&& ((tmp & 0x7) == ((tmp >> 4) & 0x7))) {
1595	dev_err(&client->dev,
1596	"duplicate addresses 0x%x, "
1597	"use force_subclients\n", data->lm75[0]->addr);
1598	return -ENODEV;
1599	}
1600	data->lm75[1] = devm_i2c_new_dummy_device(&client->dev, adapter,
1601	0x48 + ((tmp >> 4) & 0x7));
1602	}	1592	}
1603		1593
		1594	if (!(tmp & 0x08))
		1595	devm_i2c_new_dummy_device(&client->dev, adapter, 0x48 + (tmp & 0x7));
		1596
		1597	if (!(tmp & 0x80))
		1598	devm_i2c_new_dummy_device(&client->dev, adapter, 0x48 + ((tmp >> 4) & 0x7));
		1599
1604	return 0;	1600	return 0;
1605	}	1601	}
1606		1602

drivers/infiniband/core/cma.c+45−6

@@ -1746,15 +1746,16 @@ static void cma_cancel_route(struct rdma_id_private *id_priv) · 1745 unmodified lines
1746	}	1746	}
1747	}	1747	}
1748		1748
1749	static void cma_cancel_listens(struct rdma_id_private *id_priv)	1749	static void _cma_cancel_listens(struct rdma_id_private *id_priv)
1750	{	1750	{
1751	struct rdma_id_private *dev_id_priv;	1751	struct rdma_id_private *dev_id_priv;
1752		1752
		1753	lockdep_assert_held(&lock);
		1754
1753	/*	1755	/*
1754	* Remove from listen_any_list to prevent added devices from spawning	1756	* Remove from listen_any_list to prevent added devices from spawning
1755	* additional listen requests.	1757	* additional listen requests.
1756	*/	1758	*/
1757	mutex_lock(&lock);
1758	list_del(&id_priv->list);	1759	list_del(&id_priv->list);
1759		1760
1760	while (!list_empty(&id_priv->listen_list)) {	1761	while (!list_empty(&id_priv->listen_list)) {
@@ -1768,6 +1769,12 @@ static void cma_cancel_listens(struct rdma_id_private *id_priv) · 7 unmodified lines
1768	rdma_destroy_id(&dev_id_priv->id);	1769	rdma_destroy_id(&dev_id_priv->id);
1769	mutex_lock(&lock);	1770	mutex_lock(&lock);
1770	}	1771	}
		1772	}
		1773
		1774	static void cma_cancel_listens(struct rdma_id_private *id_priv)
		1775	{
		1776	mutex_lock(&lock);
		1777	_cma_cancel_listens(id_priv);
1771	mutex_unlock(&lock);	1778	mutex_unlock(&lock);
1772	}	1779	}
1773		1780
@@ -1776,6 +1783,14 @@ static void cma_cancel_operation(struct rdma_id_private *id_priv, · 2 unmodified lines
1776	{	1783	{
1777	switch (state) {	1784	switch (state) {
1778	case RDMA_CM_ADDR_QUERY:	1785	case RDMA_CM_ADDR_QUERY:
		1786	/*
		1787	* We can avoid doing the rdma_addr_cancel() based on state,
		1788	* only RDMA_CM_ADDR_QUERY has a work that could still execute.
		1789	* Notice that the addr_handler work could still be exiting
		1790	* outside this state, however due to the interaction with the
		1791	* handler_mutex the work is guaranteed not to touch id_priv
		1792	* during exit.
		1793	*/
1779	rdma_addr_cancel(&id_priv->id.route.addr.dev_addr);	1794	rdma_addr_cancel(&id_priv->id.route.addr.dev_addr);
1780	break;	1795	break;
1781	case RDMA_CM_ROUTE_QUERY:	1796	case RDMA_CM_ROUTE_QUERY:
@@ -1810,6 +1825,8 @@ static void cma_release_port(struct rdma_id_private *id_priv) · 28 unmodified lines
1810	static void destroy_mc(struct rdma_id_private *id_priv,	1825	static void destroy_mc(struct rdma_id_private *id_priv,
1811	struct cma_multicast *mc)	1826	struct cma_multicast *mc)
1812	{	1827	{
		1828	bool send_only = mc->join_state == BIT(SENDONLY_FULLMEMBER_JOIN);
		1829
1813	if (rdma_cap_ib_mcast(id_priv->id.device, id_priv->id.port_num))	1830	if (rdma_cap_ib_mcast(id_priv->id.device, id_priv->id.port_num))
1814	ib_sa_free_multicast(mc->sa_mc);	1831	ib_sa_free_multicast(mc->sa_mc);
1815		1832
@@ -1826,7 +1843,10 @@ static void destroy_mc(struct rdma_id_private *id_priv, · 10 unmodified lines
1826		1843
1827	cma_set_mgid(id_priv, (struct sockaddr *)&mc->addr,	1844	cma_set_mgid(id_priv, (struct sockaddr *)&mc->addr,
1828	&mgid);	1845	&mgid);
1829	cma_igmp_send(ndev, &mgid, false);	1846
		1847	if (!send_only)
		1848	cma_igmp_send(ndev, &mgid, false);
		1849
1830	dev_put(ndev);	1850	dev_put(ndev);
1831	}	1851	}
1832		1852
@@ -2574,7 +2594,7 @@ static int cma_listen_on_all(struct rdma_id_private *id_priv) · 741 unmodified lines
2574	return 0;	2594	return 0;
2575		2595
2576	err_listen:	2596	err_listen:
2577	list_del(&id_priv->list);	2597	_cma_cancel_listens(id_priv);
2578	mutex_unlock(&lock);	2598	mutex_unlock(&lock);
2579	if (to_destroy)	2599	if (to_destroy)
2580	rdma_destroy_id(&to_destroy->id);	2600	rdma_destroy_id(&to_destroy->id);
@@ -3413,6 +3433,21 @@ int rdma_resolve_addr(struct rdma_cm_id id, struct sockaddr src_addr, · 832 unmodified lines
3413	if (dst_addr->sa_family == AF_IB) {	3433	if (dst_addr->sa_family == AF_IB) {
3414	ret = cma_resolve_ib_addr(id_priv);	3434	ret = cma_resolve_ib_addr(id_priv);
3415	} else {	3435	} else {
		3436	/*
		3437	* The FSM can return back to RDMA_CM_ADDR_BOUND after
		3438	* rdma_resolve_ip() is called, eg through the error
		3439	* path in addr_handler(). If this happens the existing
		3440	* request must be canceled before issuing a new one.
		3441	* Since canceling a request is a bit slow and this
		3442	* oddball path is rare, keep track once a request has
		3443	* been issued. The track turns out to be a permanent
		3444	* state since this is the only cancel as it is
		3445	* immediately before rdma_resolve_ip().
		3446	*/
		3447	if (id_priv->used_resolve_ip)
		3448	rdma_addr_cancel(&id->route.addr.dev_addr);
		3449	else
		3450	id_priv->used_resolve_ip = 1;
3416	ret = rdma_resolve_ip(cma_src_addr(id_priv), dst_addr,	3451	ret = rdma_resolve_ip(cma_src_addr(id_priv), dst_addr,
3417	&id->route.addr.dev_addr,	3452	&id->route.addr.dev_addr,
3418	timeout_ms, addr_handler,	3453	timeout_ms, addr_handler,
@@ -3771,9 +3806,13 @@ int rdma_listen(struct rdma_cm_id *id, int backlog) · 352 unmodified lines
3771	int ret;	3806	int ret;
3772		3807
3773	if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND, RDMA_CM_LISTEN)) {	3808	if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND, RDMA_CM_LISTEN)) {
		3809	struct sockaddr_in any_in = {
		3810	.sin_family = AF_INET,
		3811	.sin_addr.s_addr = htonl(INADDR_ANY),
		3812	};
		3813
3774	/* For a well behaved ULP state will be RDMA_CM_IDLE */	3814	/* For a well behaved ULP state will be RDMA_CM_IDLE */
3775	id->route.addr.src_addr.ss_family = AF_INET;	3815	ret = rdma_bind_addr(id, (struct sockaddr *)&any_in);
3776	ret = rdma_bind_addr(id, cma_src_addr(id_priv));
3777	if (ret)	3816	if (ret)
3778	return ret;	3817	return ret;
3779	if (WARN_ON(!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,	3818	if (WARN_ON(!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,

drivers/infiniband/core/cma_priv.h+1−0

@@ -91,6 +91,7 @@ struct rdma_id_private { · 90 unmodified lines
91	u8 afonly;	91	u8 afonly;
92	u8 timeout;	92	u8 timeout;
93	u8 min_rnr_timer;	93	u8 min_rnr_timer;
		94	u8 used_resolve_ip;
94	enum ib_gid_type gid_type;	95	enum ib_gid_type gid_type;
95		96
96	/*	97	/*

drivers/infiniband/hw/hfi1/ipoib_tx.c+4−4

@@ -876,14 +876,14 @@ void hfi1_ipoib_tx_timeout(struct net_device *dev, unsigned int q) · 875 unmodified lines
876	struct hfi1_ipoib_txq *txq = &priv->txqs[q];	876	struct hfi1_ipoib_txq *txq = &priv->txqs[q];
877	u64 completed = atomic64_read(&txq->complete_txreqs);	877	u64 completed = atomic64_read(&txq->complete_txreqs);
878		878
879	dd_dev_info(priv->dd, "timeout txq %llx q %u stopped %u stops %d no_desc %d ring_full %d\n",	879	dd_dev_info(priv->dd, "timeout txq %p q %u stopped %u stops %d no_desc %d ring_full %d\n",
880	(unsigned long long)txq, q,	880	txq, q,
881	__netif_subqueue_stopped(dev, txq->q_idx),	881	__netif_subqueue_stopped(dev, txq->q_idx),
882	atomic_read(&txq->stops),	882	atomic_read(&txq->stops),
883	atomic_read(&txq->no_desc),	883	atomic_read(&txq->no_desc),
884	atomic_read(&txq->ring_full));	884	atomic_read(&txq->ring_full));
885	dd_dev_info(priv->dd, "sde %llx engine %u\n",	885	dd_dev_info(priv->dd, "sde %p engine %u\n",
886	(unsigned long long)txq->sde,	886	txq->sde,
887	txq->sde ? txq->sde->this_idx : 0);	887	txq->sde ? txq->sde->this_idx : 0);
888	dd_dev_info(priv->dd, "flow %x\n", txq->flow.as_int);	888	dd_dev_info(priv->dd, "flow %x\n", txq->flow.as_int);
889	dd_dev_info(priv->dd, "sent %llu completed %llu used %llu\n",	889	dd_dev_info(priv->dd, "sent %llu completed %llu used %llu\n",

drivers/infiniband/hw/hns/hns_roce_cq.c+22−9

 	INIT_LIST_HEAD(&hr_cq->rq_list);
 }
-static void set_cqe_size(struct hns_roce_cq *hr_cq, struct ib_udata *udata,
+static int set_cqe_size(struct hns_roce_cq *hr_cq, struct ib_udata *udata,
-			 struct hns_roce_ib_create_cq *ucmd)
+			struct hns_roce_ib_create_cq *ucmd)
 {
 	struct hns_roce_dev *hr_dev = to_hr_dev(hr_cq->ib_cq.device);
-	if (udata) {
+	if (!udata) {
-		if (udata->inlen >= offsetofend(typeof(*ucmd), cqe_size))
-			hr_cq->cqe_size = ucmd->cqe_size;
-		else
-			hr_cq->cqe_size = HNS_ROCE_V2_CQE_SIZE;
-	} else {
 		hr_cq->cqe_size = hr_dev->caps.cqe_sz;
+		return 0;
+	}
+	if (udata->inlen >= offsetofend(typeof(*ucmd), cqe_size)) {
+		if (ucmd->cqe_size != HNS_ROCE_V2_CQE_SIZE &&
+		    ucmd->cqe_size != HNS_ROCE_V3_CQE_SIZE) {
+			ibdev_err(&hr_dev->ib_dev,
+				  "invalid cqe size %u.\n", ucmd->cqe_size);
+			return -EINVAL;
+		}
+		hr_cq->cqe_size = ucmd->cqe_size;
+	} else {
+		hr_cq->cqe_size = HNS_ROCE_V2_CQE_SIZE;
 	}
+	return 0;
 }
 int hns_roce_create_cq(struct ib_cq *ib_cq, const struct ib_cq_init_attr *attr,
 	set_cq_param(hr_cq, attr->cqe, attr->comp_vector, &ucmd);
-	set_cqe_size(hr_cq, udata, &ucmd);
+	ret = set_cqe_size(hr_cq, udata, &ucmd);
+	if (ret)
+		return ret;
 	ret = alloc_cq_buf(hr_dev, hr_cq, udata, ucmd.buf_addr);
 	if (ret) {

drivers/infiniband/hw/hns/hns_roce_hw_v2.c+7−6

 			dest = get_cqe_v2(hr_cq, (prod_index + nfreed) &
 					  hr_cq->ib_cq.cqe);
 			owner_bit = hr_reg_read(dest, CQE_OWNER);
-			memcpy(dest, cqe, sizeof(*cqe));
+			memcpy(dest, cqe, hr_cq->cqe_size);
 			hr_reg_write(dest, CQE_OWNER, owner_bit);
 		}
 	}
 	hr_qp->path_mtu = ib_mtu;
 	mtu = ib_mtu_enum_to_int(ib_mtu);
-	if (WARN_ON(mtu < 0))
+	if (WARN_ON(mtu <= 0))
+		return -EINVAL;
+#define MAX_LP_MSG_LEN 65536
+	/* MTU * (2 ^ LP_PKTN_INI) shouldn't be bigger than 64KB */
+	lp_pktn_ini = ilog2(MAX_LP_MSG_LEN / mtu);
+	if (WARN_ON(lp_pktn_ini >= 0xF))
 		return -EINVAL;
 	if (attr_mask & IB_QP_PATH_MTU) {
 		hr_reg_clear(qpc_mask, QPC_MTU);
 	}
-#define MAX_LP_MSG_LEN 65536
-	/* MTU * (2 ^ LP_PKTN_INI) shouldn't be bigger than 64KB */
-	lp_pktn_ini = ilog2(MAX_LP_MSG_LEN / mtu);
 	hr_reg_write(context, QPC_LP_PKTN_INI, lp_pktn_ini);
 	hr_reg_clear(qpc_mask, QPC_LP_PKTN_INI);

drivers/infiniband/hw/irdma/cm.c+2−2

@@ -3496,7 +3496,7 @@ static void irdma_cm_disconn_true(struct irdma_qp *iwqp) · 3495 unmodified lines
3496	original_hw_tcp_state == IRDMA_TCP_STATE_TIME_WAIT \|\|	3496	original_hw_tcp_state == IRDMA_TCP_STATE_TIME_WAIT \|\|
3497	last_ae == IRDMA_AE_RDMAP_ROE_BAD_LLP_CLOSE \|\|	3497	last_ae == IRDMA_AE_RDMAP_ROE_BAD_LLP_CLOSE \|\|
3498	last_ae == IRDMA_AE_BAD_CLOSE \|\|	3498	last_ae == IRDMA_AE_BAD_CLOSE \|\|
3499	last_ae == IRDMA_AE_LLP_CONNECTION_RESET \|\| iwdev->reset)) {	3499	last_ae == IRDMA_AE_LLP_CONNECTION_RESET \|\| iwdev->rf->reset)) {
3500	issue_close = 1;	3500	issue_close = 1;
3501	iwqp->cm_id = NULL;	3501	iwqp->cm_id = NULL;
3502	qp->term_flags = 0;	3502	qp->term_flags = 0;
@@ -4250,7 +4250,7 @@ void irdma_cm_teardown_connections(struct irdma_device iwdev, u32 ipaddr, · 747 unmodified lines
4250	teardown_entry);	4250	teardown_entry);
4251	attr.qp_state = IB_QPS_ERR;	4251	attr.qp_state = IB_QPS_ERR;
4252	irdma_modify_qp(&cm_node->iwqp->ibqp, &attr, IB_QP_STATE, NULL);	4252	irdma_modify_qp(&cm_node->iwqp->ibqp, &attr, IB_QP_STATE, NULL);
4253	if (iwdev->reset)	4253	if (iwdev->rf->reset)
4254	irdma_cm_disconn(cm_node->iwqp);	4254	irdma_cm_disconn(cm_node->iwqp);
4255	irdma_rem_ref_cm_node(cm_node);	4255	irdma_rem_ref_cm_node(cm_node);
4256	}	4256	}

drivers/infiniband/hw/irdma/hw.c+11−3

 	case IRDMA_AE_LLP_RECEIVED_MPA_CRC_ERROR:
 		qp->flush_code = FLUSH_GENERAL_ERR;
 		break;
+	case IRDMA_AE_LLP_TOO_MANY_RETRIES:
+		qp->flush_code = FLUSH_RETRY_EXC_ERR;
+		break;
+	case IRDMA_AE_AMP_MWBIND_INVALID_RIGHTS:
+	case IRDMA_AE_AMP_MWBIND_BIND_DISABLED:
+	case IRDMA_AE_AMP_MWBIND_INVALID_BOUNDS:
+		qp->flush_code = FLUSH_MW_BIND_ERR;
+		break;
 	default:
 		qp->flush_code = FLUSH_FATAL_ERR;
 		break;
 	irdma_puda_dele_rsrc(vsi, IRDMA_PUDA_RSRC_TYPE_IEQ, false);
 	if (irdma_initialize_ieq(iwdev)) {
-		iwdev->reset = true;
+		iwdev->rf->reset = true;
 		rf->gen_ops.request_reset(rf);
 	}
 }
 	case IEQ_CREATED:
 		if (!iwdev->roce_mode)
 			irdma_puda_dele_rsrc(&iwdev->vsi, IRDMA_PUDA_RSRC_TYPE_IEQ,
-					     iwdev->reset);
+					     iwdev->rf->reset);
 		fallthrough;
 	case ILQ_CREATED:
 		if (!iwdev->roce_mode)
 			irdma_puda_dele_rsrc(&iwdev->vsi,
 					     IRDMA_PUDA_RSRC_TYPE_ILQ,
-					     iwdev->reset);
+					     iwdev->rf->reset);
 		break;
 	default:
 		ibdev_warn(&iwdev->ibdev, "bad init_state = %d\n", iwdev->init_state);

drivers/infiniband/hw/irdma/i40iw_if.c+1−1

@@ -55,7 +55,7 @@ static void i40iw_close(struct i40e_info cdev_info, struct i40e_client client, · 54 unmodified lines
55		55
56	iwdev = to_iwdev(ibdev);	56	iwdev = to_iwdev(ibdev);
57	if (reset)	57	if (reset)
58	iwdev->reset = true;	58	iwdev->rf->reset = true;
59		59
60	iwdev->iw_status = 0;	60	iwdev->iw_status = 0;
61	irdma_port_ibevent(iwdev);	61	irdma_port_ibevent(iwdev);

drivers/infiniband/hw/irdma/main.h+0−1

@@ -346,7 +346,6 @@ struct irdma_device { · 345 unmodified lines
346	bool roce_mode:1;	346	bool roce_mode:1;
347	bool roce_dcqcn_en:1;	347	bool roce_dcqcn_en:1;
348	bool dcb:1;	348	bool dcb:1;
349	bool reset:1;
350	bool iw_ooo:1;	349	bool iw_ooo:1;
351	enum init_completion_state init_state;	350	enum init_completion_state init_state;
352		351

drivers/infiniband/hw/irdma/user.h+2−0

@@ -102,6 +102,8 @@ enum irdma_flush_opcode { · 101 unmodified lines
102	FLUSH_REM_OP_ERR,	102	FLUSH_REM_OP_ERR,
103	FLUSH_LOC_LEN_ERR,	103	FLUSH_LOC_LEN_ERR,
104	FLUSH_FATAL_ERR,	104	FLUSH_FATAL_ERR,
		105	FLUSH_RETRY_EXC_ERR,
		106	FLUSH_MW_BIND_ERR,
105	};	107	};
106		108
107	enum irdma_cmpl_status {	109	enum irdma_cmpl_status {

drivers/infiniband/hw/irdma/utils.c+1−1

@@ -2507,7 +2507,7 @@ void irdma_modify_qp_to_err(struct irdma_sc_qp *sc_qp) · 2506 unmodified lines
2507	struct irdma_qp *qp = sc_qp->qp_uk.back_qp;	2507	struct irdma_qp *qp = sc_qp->qp_uk.back_qp;
2508	struct ib_qp_attr attr;	2508	struct ib_qp_attr attr;
2509		2509
2510	if (qp->iwdev->reset)	2510	if (qp->iwdev->rf->reset)
2511	return;	2511	return;
2512	attr.qp_state = IB_QPS_ERR;	2512	attr.qp_state = IB_QPS_ERR;
2513		2513

drivers/infiniband/hw/irdma/verbs.c+6−3

 	irdma_qp_rem_ref(&iwqp->ibqp);
 	wait_for_completion(&iwqp->free_qp);
 	irdma_free_lsmm_rsrc(iwqp);
-	if (!iwdev->reset)
+	irdma_cqp_qp_destroy_cmd(&iwdev->rf->sc_dev, &iwqp->sc_qp);
-		irdma_cqp_qp_destroy_cmd(&iwdev->rf->sc_dev, &iwqp->sc_qp);
 	if (!iwqp->user_mode) {
 		if (iwqp->iwscq) {
 		/* Kmode allocations */
 		int rsize;
-		if (entries > rf->max_cqe) {
+		if (entries < 1 || entries > rf->max_cqe) {
 			err_code = -EINVAL;
 			goto cq_free_rsrc;
 		}
 		return IB_WC_LOC_LEN_ERR;
 	case FLUSH_GENERAL_ERR:
 		return IB_WC_WR_FLUSH_ERR;
+	case FLUSH_RETRY_EXC_ERR:
+		return IB_WC_RETRY_EXC_ERR;
+	case FLUSH_MW_BIND_ERR:
+		return IB_WC_MW_BIND_ERR;
 	case FLUSH_FATAL_ERR:
 	default:
 		return IB_WC_FATAL_ERR;

drivers/infiniband/hw/qib/qib_sysfs.c+1−1

@@ -403,7 +403,7 @@ static ssize_t diagc_attr_store(struct ib_device *ibdev, u32 port_num, · 402 unmodified lines
403	}	403	}
404		404
405	#define QIB_DIAGC_ATTR(N) \	405	#define QIB_DIAGC_ATTR(N) \
406	static_assert(&((struct qib_ibport )0)->rvp.n_##N != (u64 )NULL); \	406	static_assert(__same_type(((struct qib_ibport *)0)->rvp.n_##N, u64)); \
407	static struct qib_diagc_attr qib_diagc_attr_##N = { \	407	static struct qib_diagc_attr qib_diagc_attr_##N = { \
408	.attr = __ATTR(N, 0664, diagc_attr_show, diagc_attr_store), \	408	.attr = __ATTR(N, 0664, diagc_attr_show, diagc_attr_store), \
409	.counter = \	409	.counter = \

drivers/infiniband/hw/usnic/usnic_ib.h+1−1

@@ -90,7 +90,7 @@ struct usnic_ib_dev { · 89 unmodified lines
90		90
91	struct usnic_ib_vf {	91	struct usnic_ib_vf {
92	struct usnic_ib_dev *pf;	92	struct usnic_ib_dev *pf;
93	spinlock_t lock;	93	struct mutex lock;
94	struct usnic_vnic *vnic;	94	struct usnic_vnic *vnic;
95	unsigned int qp_grp_ref_cnt;	95	unsigned int qp_grp_ref_cnt;
96	struct usnic_ib_pd *pd;	96	struct usnic_ib_pd *pd;

drivers/infiniband/hw/usnic/usnic_ib_main.c+1−1

@@ -572,7 +572,7 @@ static int usnic_ib_pci_probe(struct pci_dev *pdev, · 571 unmodified lines
572	}	572	}
573		573
574	vf->pf = pf;	574	vf->pf = pf;
575	spin_lock_init(&vf->lock);	575	mutex_init(&vf->lock);
576	mutex_lock(&pf->usdev_lock);	576	mutex_lock(&pf->usdev_lock);
577	list_add_tail(&vf->link, &pf->vf_dev_list);	577	list_add_tail(&vf->link, &pf->vf_dev_list);
578	/*	578	/*

drivers/infiniband/hw/usnic/usnic_ib_verbs.c+8−8

@@ -196,7 +196,7 @@ find_free_vf_and_create_qp_grp(struct ib_qp *qp, · 195 unmodified lines
196	for (i = 0; dev_list[i]; i++) {	196	for (i = 0; dev_list[i]; i++) {
197	dev = dev_list[i];	197	dev = dev_list[i];
198	vf = dev_get_drvdata(dev);	198	vf = dev_get_drvdata(dev);
199	spin_lock(&vf->lock);	199	mutex_lock(&vf->lock);
200	vnic = vf->vnic;	200	vnic = vf->vnic;
201	if (!usnic_vnic_check_room(vnic, res_spec)) {	201	if (!usnic_vnic_check_room(vnic, res_spec)) {
202	usnic_dbg("Found used vnic %s from %s\n",	202	usnic_dbg("Found used vnic %s from %s\n",
@@ -208,10 +208,10 @@ find_free_vf_and_create_qp_grp(struct ib_qp *qp, · 5 unmodified lines
208	vf, pd, res_spec,	208	vf, pd, res_spec,
209	trans_spec);	209	trans_spec);
210		210
211	spin_unlock(&vf->lock);	211	mutex_unlock(&vf->lock);
212	goto qp_grp_check;	212	goto qp_grp_check;
213	}	213	}
214	spin_unlock(&vf->lock);	214	mutex_unlock(&vf->lock);
215		215
216	}	216	}
217	usnic_uiom_free_dev_list(dev_list);	217	usnic_uiom_free_dev_list(dev_list);
@@ -220,7 +220,7 @@ find_free_vf_and_create_qp_grp(struct ib_qp *qp, · 2 unmodified lines
220		220
221	/* Try to find resources on an unused vf */	221	/* Try to find resources on an unused vf */
222	list_for_each_entry(vf, &us_ibdev->vf_dev_list, link) {	222	list_for_each_entry(vf, &us_ibdev->vf_dev_list, link) {
223	spin_lock(&vf->lock);	223	mutex_lock(&vf->lock);
224	vnic = vf->vnic;	224	vnic = vf->vnic;
225	if (vf->qp_grp_ref_cnt == 0 &&	225	if (vf->qp_grp_ref_cnt == 0 &&
226	usnic_vnic_check_room(vnic, res_spec) == 0) {	226	usnic_vnic_check_room(vnic, res_spec) == 0) {
@@ -228,10 +228,10 @@ find_free_vf_and_create_qp_grp(struct ib_qp *qp, · 1 unmodified line
228	vf, pd, res_spec,	228	vf, pd, res_spec,
229	trans_spec);	229	trans_spec);
230		230
231	spin_unlock(&vf->lock);	231	mutex_unlock(&vf->lock);
232	goto qp_grp_check;	232	goto qp_grp_check;
233	}	233	}
234	spin_unlock(&vf->lock);	234	mutex_unlock(&vf->lock);
235	}	235	}
236		236
237	usnic_info("No free qp grp found on %s\n",	237	usnic_info("No free qp grp found on %s\n",
@@ -253,9 +253,9 @@ static void qp_grp_destroy(struct usnic_ib_qp_grp *qp_grp) · 15 unmodified lines
253		253
254	WARN_ON(qp_grp->state != IB_QPS_RESET);	254	WARN_ON(qp_grp->state != IB_QPS_RESET);
255		255
256	spin_lock(&vf->lock);	256	mutex_lock(&vf->lock);
257	usnic_ib_qp_grp_destroy(qp_grp);	257	usnic_ib_qp_grp_destroy(qp_grp);
258	spin_unlock(&vf->lock);	258	mutex_unlock(&vf->lock);
259	}	259	}
260		260
261	static int create_qp_validate_user_data(struct usnic_ib_create_qp_cmd cmd)	261	static int create_qp_validate_user_data(struct usnic_ib_create_qp_cmd cmd)

drivers/interconnect/qcom/sdm660.c+19−6

 #define NOC_PERM_MODE_BYPASS		(1 << NOC_QOS_MODE_BYPASS)
 #define NOC_QOS_PRIORITYn_ADDR(n)	(0x8 + (n * 0x1000))
-#define NOC_QOS_PRIORITY_MASK		0xf
+#define NOC_QOS_PRIORITY_P1_MASK	0xc
+#define NOC_QOS_PRIORITY_P0_MASK	0x3
 #define NOC_QOS_PRIORITY_P1_SHIFT	0x2
-#define NOC_QOS_PRIORITY_P0_SHIFT	0x3
 #define NOC_QOS_MODEn_ADDR(n)		(0xc + (n * 0x1000))
 #define NOC_QOS_MODEn_MASK		0x3
 	{ .id = "iface" },
 };
+static const struct clk_bulk_data bus_a2noc_clocks[] = {
+	{ .id = "bus" },
+	{ .id = "bus_a" },
+	{ .id = "ipa" },
+	{ .id = "ufs_axi" },
+	{ .id = "aggre2_ufs_axi" },
+	{ .id = "aggre2_usb3_axi" },
+	{ .id = "cfg_noc_usb2_axi" },
+};
 /**
  * struct qcom_icc_provider - Qualcomm specific interconnect provider
  * @provider: generic interconnect provider
 DEFINE_QNODE(slv_prng, SDM660_SLAVE_PRNG, 4, -1, 44, true, -1, 0, -1, 0);
 DEFINE_QNODE(slv_spdm, SDM660_SLAVE_SPDM, 4, -1, 60, true, -1, 0, -1, 0);
 DEFINE_QNODE(slv_qdss_cfg, SDM660_SLAVE_QDSS_CFG, 4, -1, 63, true, -1, 0, -1, 0);
-DEFINE_QNODE(slv_cnoc_mnoc_cfg, SDM660_SLAVE_BLSP_1, 4, -1, 66, true, -1, 0, -1, SDM660_MASTER_CNOC_MNOC_CFG);
+DEFINE_QNODE(slv_cnoc_mnoc_cfg, SDM660_SLAVE_CNOC_MNOC_CFG, 4, -1, 66, true, -1, 0, -1, SDM660_MASTER_CNOC_MNOC_CFG);
 DEFINE_QNODE(slv_snoc_cfg, SDM660_SLAVE_SNOC_CFG, 4, -1, 70, true, -1, 0, -1, 0);
 DEFINE_QNODE(slv_qm_cfg, SDM660_SLAVE_QM_CFG, 4, -1, 212, true, -1, 0, -1, 0);
 DEFINE_QNODE(slv_clk_ctl, SDM660_SLAVE_CLK_CTL, 4, -1, 47, true, -1, 0, -1, 0);
 	/* Must be updated one at a time, P1 first, P0 last */
 	val = qos->areq_prio << NOC_QOS_PRIORITY_P1_SHIFT;
 	rc = regmap_update_bits(rmap, NOC_QOS_PRIORITYn_ADDR(qos->qos_port),
-				NOC_QOS_PRIORITY_MASK, val);
+				NOC_QOS_PRIORITY_P1_MASK, val);
 	if (rc)
 		return rc;
-	val = qos->prio_level << NOC_QOS_PRIORITY_P0_SHIFT;
 	return regmap_update_bits(rmap, NOC_QOS_PRIORITYn_ADDR(qos->qos_port),
-				  NOC_QOS_PRIORITY_MASK, val);
+				  NOC_QOS_PRIORITY_P0_MASK, qos->prio_level);
 }
 static int qcom_icc_set_noc_qos(struct icc_node *src, u64 max_bw)
 		qp->bus_clks = devm_kmemdup(dev, bus_mm_clocks,
 					    sizeof(bus_mm_clocks), GFP_KERNEL);
 		qp->num_clks = ARRAY_SIZE(bus_mm_clocks);
+	} else if (of_device_is_compatible(dev->of_node, "qcom,sdm660-a2noc")) {
+		qp->bus_clks = devm_kmemdup(dev, bus_a2noc_clocks,
+					    sizeof(bus_a2noc_clocks), GFP_KERNEL);
+		qp->num_clks = ARRAY_SIZE(bus_a2noc_clocks);
 	} else {
 		if (of_device_is_compatible(dev->of_node, "qcom,sdm660-bimc"))
 			qp->is_bimc_node = true;

drivers/iommu/apple-dart.c+35−21

 static struct platform_driver apple_dart_driver;
 static const struct iommu_ops apple_dart_iommu_ops;
-static const struct iommu_flush_ops apple_dart_tlb_ops;
 static struct apple_dart_domain *to_dart_domain(struct iommu_domain *dom)
 {
 	apple_dart_domain_flush_tlb(to_dart_domain(domain));
 }
-static void apple_dart_tlb_flush_all(void *cookie)
-{
-	apple_dart_domain_flush_tlb(cookie);
-}
-static void apple_dart_tlb_flush_walk(unsigned long iova, size_t size,
-				      size_t granule, void *cookie)
-{
-	apple_dart_domain_flush_tlb(cookie);
-}
-static const struct iommu_flush_ops apple_dart_tlb_ops = {
-	.tlb_flush_all = apple_dart_tlb_flush_all,
-	.tlb_flush_walk = apple_dart_tlb_flush_walk,
-};
 static phys_addr_t apple_dart_iova_to_phys(struct iommu_domain *domain,
 					   dma_addr_t iova)
 {
 		.ias = 32,
 		.oas = 36,
 		.coherent_walk = 1,
-		.tlb = &apple_dart_tlb_ops,
 		.iommu_dev = dart->dev,
 	};
 	return -EINVAL;
 }
+static DEFINE_MUTEX(apple_dart_groups_lock);
+static void apple_dart_release_group(void *iommu_data)
+{
+	int i, sid;
+	struct apple_dart_stream_map *stream_map;
+	struct apple_dart_master_cfg *group_master_cfg = iommu_data;
+	mutex_lock(&apple_dart_groups_lock);
+	for_each_stream_map(i, group_master_cfg, stream_map)
+		for_each_set_bit(sid, &stream_map->sidmap, DART_MAX_STREAMS)
+			stream_map->dart->sid2group[sid] = NULL;
+	kfree(iommu_data);
+	mutex_unlock(&apple_dart_groups_lock);
+}
 static struct iommu_group *apple_dart_device_group(struct device *dev)
 {
-	static DEFINE_MUTEX(lock);
 	int i, sid;
 	struct apple_dart_master_cfg *cfg = dev_iommu_priv_get(dev);
 	struct apple_dart_stream_map *stream_map;
+	struct apple_dart_master_cfg *group_master_cfg;
 	struct iommu_group *group = NULL;
 	struct iommu_group *res = ERR_PTR(-EINVAL);
-	mutex_lock(&lock);
+	mutex_lock(&apple_dart_groups_lock);
 	for_each_stream_map(i, cfg, stream_map) {
 		for_each_set_bit(sid, &stream_map->sidmap, DART_MAX_STREAMS) {
 #endif
 		group = generic_device_group(dev);
+	res = ERR_PTR(-ENOMEM);
+	if (!group)
+		goto out;
+	group_master_cfg = kzalloc(sizeof(*group_master_cfg), GFP_KERNEL);
+	if (!group_master_cfg) {
+		iommu_group_put(group);
+		goto out;
+	}
+	memcpy(group_master_cfg, cfg, sizeof(*group_master_cfg));
+	iommu_group_set_iommudata(group, group_master_cfg,
+		apple_dart_release_group);
 	for_each_stream_map(i, cfg, stream_map)
 		for_each_set_bit(sid, &stream_map->sidmap, DART_MAX_STREAMS)
 			stream_map->dart->sid2group[sid] = group;
 	res = group;
 out:
-	mutex_unlock(&lock);
+	mutex_unlock(&apple_dart_groups_lock);
 	return res;
 }

drivers/iommu/intel/dmar.c+3−3

drivers/ipack/devices/ipoctal.c+47−16

 	unsigned int			pointer_read;
 	unsigned int			pointer_write;
 	struct tty_port			tty_port;
+	bool				tty_registered;
 	union scc2698_channel __iomem	*regs;
 	union scc2698_block __iomem	*block_regs;
 	unsigned int			board_id;
 	return 0;
 }
-static int ipoctal_open(struct tty_struct *tty, struct file *file)
+static int ipoctal_install(struct tty_driver *driver, struct tty_struct *tty)
 {
 	struct ipoctal_channel *channel = dev_get_drvdata(tty->dev);
 	struct ipoctal *ipoctal = chan_to_ipoctal(channel, tty->index);
-	int err;
+	int res;
-	tty->driver_data = channel;
 	if (!ipack_get_carrier(ipoctal->dev))
 		return -EBUSY;
-	err = tty_port_open(&channel->tty_port, tty, file);
+	res = tty_standard_install(driver, tty);
-	if (err)
+	if (res)
-		ipack_put_carrier(ipoctal->dev);
+		goto err_put_carrier;
+	tty->driver_data = channel;
+	return 0;
+err_put_carrier:
+	ipack_put_carrier(ipoctal->dev);
+	return res;
+}
+static int ipoctal_open(struct tty_struct *tty, struct file *file)
+{
+	struct ipoctal_channel *channel = tty->driver_data;
-	return err;
+	return tty_port_open(&channel->tty_port, tty, file);
 }
 static void ipoctal_reset_stats(struct ipoctal_stats *stats)
 	int res;
 	int i;
 	struct tty_driver *tty;
-	char name[20];
 	struct ipoctal_channel *channel;
 	struct ipack_region *region;
 	void __iomem *addr;
 	/* Fill struct tty_driver with ipoctal data */
 	tty->owner = THIS_MODULE;
 	tty->driver_name = KBUILD_MODNAME;
-	sprintf(name, KBUILD_MODNAME ".%d.%d.", bus_nr, slot);
+	tty->name = kasprintf(GFP_KERNEL, KBUILD_MODNAME ".%d.%d.", bus_nr, slot);
-	tty->name = name;
+	if (!tty->name) {
+		res = -ENOMEM;
+		goto err_put_driver;
+	}
 	tty->major = 0;
 	tty->minor_start = 0;
 	res = tty_register_driver(tty);
 	if (res) {
 		dev_err(&ipoctal->dev->dev, "Can't register tty driver.\n");
-		tty_driver_kref_put(tty);
+		goto err_free_name;
-		return res;
 	}
 	/* Save struct tty_driver for use it when uninstalling the device */
 		channel = &ipoctal->channel[i];
 		tty_port_init(&channel->tty_port);
-		tty_port_alloc_xmit_buf(&channel->tty_port);
+		res = tty_port_alloc_xmit_buf(&channel->tty_port);
+		if (res)
+			continue;
 		channel->tty_port.ops = &ipoctal_tty_port_ops;
 		ipoctal_reset_stats(&channel->stats);
 		spin_lock_init(&channel->lock);
 		channel->pointer_read = 0;
 		channel->pointer_write = 0;
-		tty_dev = tty_port_register_device(&channel->tty_port, tty, i, NULL);
+		tty_dev = tty_port_register_device_attr(&channel->tty_port, tty,
+							i, NULL, channel, NULL);
 		if (IS_ERR(tty_dev)) {
 			dev_err(&ipoctal->dev->dev, "Failed to register tty device.\n");
+			tty_port_free_xmit_buf(&channel->tty_port);
 			tty_port_destroy(&channel->tty_port);
 			continue;
 		}
-		dev_set_drvdata(tty_dev, channel);
+		channel->tty_registered = true;
 	}
 	/*
 				       ipoctal_irq_handler, ipoctal);
 	return 0;
+err_free_name:
+	kfree(tty->name);
+err_put_driver:
+	tty_driver_kref_put(tty);
+	return res;
 }
 static inline int ipoctal_copy_write_buffer(struct ipoctal_channel *channel,
 static const struct tty_operations ipoctal_fops = {
 	.ioctl =		NULL,
+	.install =		ipoctal_install,
 	.open =			ipoctal_open,
 	.close =		ipoctal_close,
 	.write =		ipoctal_write_tty,
 	for (i = 0; i < NR_CHANNELS; i++) {
 		struct ipoctal_channel *channel = &ipoctal->channel[i];
+		if (!channel->tty_registered)
+			continue;
 		tty_unregister_device(ipoctal->tty_drv, i);
 		tty_port_free_xmit_buf(&channel->tty_port);
 		tty_port_destroy(&channel->tty_port);
 	}
 	tty_unregister_driver(ipoctal->tty_drv);
+	kfree(ipoctal->tty_drv->name);
 	tty_driver_kref_put(ipoctal->tty_drv);
 	kfree(ipoctal);
 }

drivers/media/platform/s5p-jpeg/jpeg-core.c+9−9

@@ -1140,8 +1140,8 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, · 1139 unmodified lines
1140	continue;	1140	continue;
1141	length = 0;	1141	length = 0;
1142	switch (c) {	1142	switch (c) {
1143	/* SOF0: baseline JPEG */	1143	/* JPEG_MARKER_SOF0: baseline JPEG */
1144	case SOF0:	1144	case JPEG_MARKER_SOF0:
1145	if (get_word_be(&jpeg_buffer, &word))	1145	if (get_word_be(&jpeg_buffer, &word))
1146	break;	1146	break;
1147	length = (long)word - 2;	1147	length = (long)word - 2;
@@ -1172,7 +1172,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, · 24 unmodified lines
1172	notfound = 0;	1172	notfound = 0;
1173	break;	1173	break;
1174		1174
1175	case DQT:	1175	case JPEG_MARKER_DQT:
1176	if (get_word_be(&jpeg_buffer, &word))	1176	if (get_word_be(&jpeg_buffer, &word))
1177	break;	1177	break;
1178	length = (long)word - 2;	1178	length = (long)word - 2;
@@ -1185,7 +1185,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, · 6 unmodified lines
1185	skip(&jpeg_buffer, length);	1185	skip(&jpeg_buffer, length);
1186	break;	1186	break;
1187		1187
1188	case DHT:	1188	case JPEG_MARKER_DHT:
1189	if (get_word_be(&jpeg_buffer, &word))	1189	if (get_word_be(&jpeg_buffer, &word))
1190	break;	1190	break;
1191	length = (long)word - 2;	1191	length = (long)word - 2;
@@ -1198,15 +1198,15 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, · 6 unmodified lines
1198	skip(&jpeg_buffer, length);	1198	skip(&jpeg_buffer, length);
1199	break;	1199	break;
1200		1200
1201	case SOS:	1201	case JPEG_MARKER_SOS:
1202	sos = jpeg_buffer.curr - 2; /* 0xffda */	1202	sos = jpeg_buffer.curr - 2; /* 0xffda */
1203	break;	1203	break;
1204		1204
1205	/* skip payload-less markers */	1205	/* skip payload-less markers */
1206	case RST ... RST + 7:	1206	case JPEG_MARKER_RST ... JPEG_MARKER_RST + 7:
1207	case SOI:	1207	case JPEG_MARKER_SOI:
1208	case EOI:	1208	case JPEG_MARKER_EOI:
1209	case TEM:	1209	case JPEG_MARKER_TEM:
1210	break;	1210	break;
1211		1211
1212	/* skip uninteresting payload markers */	1212	/* skip uninteresting payload markers */

drivers/media/platform/s5p-jpeg/jpeg-core.h+14−14

@@ -37,15 +37,15 @@ · 36 unmodified lines
37	#define EXYNOS3250_IRQ_TIMEOUT 0x10000000	37	#define EXYNOS3250_IRQ_TIMEOUT 0x10000000
38		38
39	/* a selection of JPEG markers */	39	/* a selection of JPEG markers */
40	#define TEM 0x01	40	#define JPEG_MARKER_TEM 0x01
41	#define SOF0 0xc0	41	#define JPEG_MARKER_SOF0 0xc0
42	#define DHT 0xc4	42	#define JPEG_MARKER_DHT 0xc4
43	#define RST 0xd0	43	#define JPEG_MARKER_RST 0xd0
44	#define SOI 0xd8	44	#define JPEG_MARKER_SOI 0xd8
45	#define EOI 0xd9	45	#define JPEG_MARKER_EOI 0xd9
46	#define SOS 0xda	46	#define JPEG_MARKER_SOS 0xda
47	#define DQT 0xdb	47	#define JPEG_MARKER_DQT 0xdb
48	#define DHP 0xde	48	#define JPEG_MARKER_DHP 0xde
49		49
50	/* Flags that indicate a format can be used for capture/output */	50	/* Flags that indicate a format can be used for capture/output */
51	#define SJPEG_FMT_FLAG_ENC_CAPTURE (1 << 0)	51	#define SJPEG_FMT_FLAG_ENC_CAPTURE (1 << 0)
@@ -187,11 +187,11 @@ struct s5p_jpeg_marker { · 135 unmodified lines
187	* @fmt: driver-specific format of this queue	187	* @fmt: driver-specific format of this queue
188	* @w: image width	188	* @w: image width
189	* @h: image height	189	* @h: image height
190	* @sos: SOS marker's position relative to the buffer beginning	190	* @sos: JPEG_MARKER_SOS's position relative to the buffer beginning
191	* @dht: DHT markers' positions relative to the buffer beginning	191	* @dht: JPEG_MARKER_DHT' positions relative to the buffer beginning
192	* @dqt: DQT markers' positions relative to the buffer beginning	192	* @dqt: JPEG_MARKER_DQT' positions relative to the buffer beginning
193	* @sof: SOF0 marker's position relative to the buffer beginning	193	* @sof: JPEG_MARKER_SOF0's position relative to the buffer beginning
194	* @sof_len: SOF0 marker's payload length (without length field itself)	194	* @sof_len: JPEG_MARKER_SOF0's payload length (without length field itself)
195	* @size: image buffer size in bytes	195	* @size: image buffer size in bytes
196	*/	196	*/
197	struct s5p_jpeg_q_data {	197	struct s5p_jpeg_q_data {

drivers/media/rc/ir_toy.c+20−1

@@ -24,6 +24,7 @@ static const u8 COMMAND_VERSION[] = { 'v' }; · 23 unmodified lines
24	// End transmit and repeat reset command so we exit sump mode	24	// End transmit and repeat reset command so we exit sump mode
25	static const u8 COMMAND_RESET[] = { 0xff, 0xff, 0, 0, 0, 0, 0 };	25	static const u8 COMMAND_RESET[] = { 0xff, 0xff, 0, 0, 0, 0, 0 };
26	static const u8 COMMAND_SMODE_ENTER[] = { 's' };	26	static const u8 COMMAND_SMODE_ENTER[] = { 's' };
		27	static const u8 COMMAND_SMODE_EXIT[] = { 0 };
27	static const u8 COMMAND_TXSTART[] = { 0x26, 0x24, 0x25, 0x03 };	28	static const u8 COMMAND_TXSTART[] = { 0x26, 0x24, 0x25, 0x03 };
28		29
29	#define REPLY_XMITCOUNT 't'	30	#define REPLY_XMITCOUNT 't'
@@ -309,12 +310,30 @@ static int irtoy_tx(struct rc_dev rc, uint txbuf, uint count) · 279 unmodified lines
309	buf[i] = cpu_to_be16(v);	310	buf[i] = cpu_to_be16(v);
310	}	311	}
311		312
312	buf[count] = cpu_to_be16(0xffff);	313	buf[count] = 0xffff;
313		314
314	irtoy->tx_buf = buf;	315	irtoy->tx_buf = buf;
315	irtoy->tx_len = size;	316	irtoy->tx_len = size;
316	irtoy->emitted = 0;	317	irtoy->emitted = 0;
317		318
		319	// There is an issue where if the unit is receiving IR while the
		320	// first TXSTART command is sent, the device might end up hanging
		321	// with its led on. It does not respond to any command when this
		322	// happens. To work around this, re-enter sample mode.
		323	err = irtoy_command(irtoy, COMMAND_SMODE_EXIT,
		324	sizeof(COMMAND_SMODE_EXIT), STATE_RESET);
		325	if (err) {
		326	dev_err(irtoy->dev, "exit sample mode: %d\n", err);
		327	return err;
		328	}
		329
		330	err = irtoy_command(irtoy, COMMAND_SMODE_ENTER,
		331	sizeof(COMMAND_SMODE_ENTER), STATE_COMMAND);
		332	if (err) {
		333	dev_err(irtoy->dev, "enter sample mode: %d\n", err);
		334	return err;
		335	}
		336
318	err = irtoy_command(irtoy, COMMAND_TXSTART, sizeof(COMMAND_TXSTART),	337	err = irtoy_command(irtoy, COMMAND_TXSTART, sizeof(COMMAND_TXSTART),
319	STATE_TX);	338	STATE_TX);
320	kfree(buf);	339	kfree(buf);

drivers/mmc/host/dw_mmc.c+12−3

 	spin_lock_irqsave(&host->irq_lock, flags);
-	if (!host->data_status)
+	/*
+	 * Only inject an error if we haven't already got an error or data over
+	 * interrupt.
+	 */
+	if (!host->data_status) {
 		host->data_status = SDMMC_INT_DCRC;
-	set_bit(EVENT_DATA_ERROR, &host->pending_events);
+		set_bit(EVENT_DATA_ERROR, &host->pending_events);
-	tasklet_schedule(&host->tasklet);
+		tasklet_schedule(&host->tasklet);
+	}
 	spin_unlock_irqrestore(&host->irq_lock, flags);
 		}
 		if (pending & DW_MCI_DATA_ERROR_FLAGS) {
+			spin_lock(&host->irq_lock);
 			/* if there is an error report DATA_ERROR */
 			mci_writel(host, RINTSTS, DW_MCI_DATA_ERROR_FLAGS);
 			host->data_status = pending;
 			smp_wmb(); /* drain writebuffer */
 			set_bit(EVENT_DATA_ERROR, &host->pending_events);
 			tasklet_schedule(&host->tasklet);
+			spin_unlock(&host->irq_lock);
 		}
 		if (pending & SDMMC_INT_DATA_OVER) {

drivers/mmc/host/renesas_sdhi_core.c+2−0

 		/* Unknown why but without polling reset status, it will hang */
 		read_poll_timeout(reset_control_status, ret, ret == 0, 1, 100,
 				  false, priv->rstc);
+		/* At least SDHI_VER_GEN2_SDR50 needs manual release of reset */
+		sd_ctrl_write16(host, CTL_RESET_SD, 0x0001);
 		priv->needs_adjust_hs400 = false;
 		renesas_sdhi_set_clock(host, host->clk_cache);
 	} else if (priv->scc_ctl) {

drivers/net/dsa/mv88e6xxx/chip.c+10−7

 	if (err)
 		return err;
-	/* Port Control 2: don't force a good FCS, set the maximum frame size to
+	/* Port Control 2: don't force a good FCS, set the MTU size to
-	 * 10240 bytes, disable 802.1q tags checking, don't discard tagged or
+	 * 10222 bytes, disable 802.1q tags checking, don't discard tagged or
 	 * untagged frames on this port, do a destination address lookup on all
 	 * received packets as usual, disable ARP mirroring and don't send a
 	 * copy of all transmitted/received frames on this port to the CPU.
 		return err;
 	if (chip->info->ops->port_set_jumbo_size) {
-		err = chip->info->ops->port_set_jumbo_size(chip, port, 10240);
+		err = chip->info->ops->port_set_jumbo_size(chip, port, 10218);
 		if (err)
 			return err;
 	}
 	struct mv88e6xxx_chip *chip = ds->priv;
 	if (chip->info->ops->port_set_jumbo_size)
-		return 10240;
+		return 10240 - VLAN_ETH_HLEN - EDSA_HLEN - ETH_FCS_LEN;
 	else if (chip->info->ops->set_max_frame_size)
-		return 1632;
+		return 1632 - VLAN_ETH_HLEN - EDSA_HLEN - ETH_FCS_LEN;
-	return 1522;
+	return 1522 - VLAN_ETH_HLEN - EDSA_HLEN - ETH_FCS_LEN;
 }
 static int mv88e6xxx_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
 	struct mv88e6xxx_chip *chip = ds->priv;
 	int ret = 0;
+	if (dsa_is_dsa_port(ds, port) || dsa_is_cpu_port(ds, port))
+		new_mtu += EDSA_HLEN;
 	mv88e6xxx_reg_lock(chip);
 	if (chip->info->ops->port_set_jumbo_size)
 		ret = chip->info->ops->port_set_jumbo_size(chip, port, new_mtu);
 	.port_set_ucast_flood = mv88e6352_port_set_ucast_flood,
 	.port_set_mcast_flood = mv88e6352_port_set_mcast_flood,
 	.port_set_ether_type = mv88e6351_port_set_ether_type,
-	.port_set_jumbo_size = mv88e6165_port_set_jumbo_size,
 	.port_egress_rate_limiting = mv88e6097_port_egress_rate_limiting,
 	.port_pause_limit = mv88e6097_port_pause_limit,
 	.port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit,
 	.avb_ops = &mv88e6165_avb_ops,
 	.ptp_ops = &mv88e6165_ptp_ops,
 	.phylink_validate = mv88e6185_phylink_validate,
+	.set_max_frame_size = mv88e6185_g1_set_max_frame_size,
 };
 static const struct mv88e6xxx_ops mv88e6165_ops = {

drivers/net/dsa/mv88e6xxx/chip.h+1−0

@@ -18,6 +18,7 @@ · 17 unmodified lines
18	#include <linux/timecounter.h>	18	#include <linux/timecounter.h>
19	#include <net/dsa.h>	19	#include <net/dsa.h>
20		20
		21	#define EDSA_HLEN 8
21	#define MV88E6XXX_N_FID 4096	22	#define MV88E6XXX_N_FID 4096
22		23
23	/* PVT limits for 4-bit port and 5-bit switch */	24	/* PVT limits for 4-bit port and 5-bit switch */

drivers/net/dsa/mv88e6xxx/global1.c+2−0

@@ -232,6 +232,8 @@ int mv88e6185_g1_set_max_frame_size(struct mv88e6xxx_chip *chip, int mtu) · 231 unmodified lines
232	u16 val;	232	u16 val;
233	int err;	233	int err;
234		234
		235	mtu += ETH_HLEN + ETH_FCS_LEN;
		236
235	err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, &val);	237	err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, &val);
236	if (err)	238	if (err)
237	return err;	239	return err;

drivers/net/dsa/mv88e6xxx/port.c+2−0

@@ -1277,6 +1277,8 @@ int mv88e6165_port_set_jumbo_size(struct mv88e6xxx_chip *chip, int port, · 1276 unmodified lines
1277	u16 reg;	1277	u16 reg;
1278	int err;	1278	int err;
1279		1279
		1280	size += VLAN_ETH_HLEN + ETH_FCS_LEN;
		1281
1280	err = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_CTL2, &reg);	1282	err = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_CTL2, &reg);
1281	if (err)	1283	if (err)
1282	return err;	1284	return err;

drivers/net/ethernet/broadcom/bgmac-platform.c+3−0

@@ -192,6 +192,9 @@ static int bgmac_probe(struct platform_device *pdev) · 191 unmodified lines
192	bgmac->dma_dev = &pdev->dev;	192	bgmac->dma_dev = &pdev->dev;
193		193
194	ret = of_get_mac_address(np, bgmac->net_dev->dev_addr);	194	ret = of_get_mac_address(np, bgmac->net_dev->dev_addr);
		195	if (ret == -EPROBE_DEFER)
		196	return ret;
		197
195	if (ret)	198	if (ret)
196	dev_warn(&pdev->dev,	199	dev_warn(&pdev->dev,
197	"MAC address not present in device tree\n");	200	"MAC address not present in device tree\n");

drivers/net/ethernet/freescale/enetc/enetc_pf.c+1−2

@@ -541,8 +541,7 @@ static void enetc_mac_config(struct enetc_hw *hw, phy_interface_t phy_mode) · 540 unmodified lines
541		541
542	if (phy_interface_mode_is_rgmii(phy_mode)) {	542	if (phy_interface_mode_is_rgmii(phy_mode)) {
543	val = enetc_port_rd(hw, ENETC_PM0_IF_MODE);	543	val = enetc_port_rd(hw, ENETC_PM0_IF_MODE);
544	val &= ~ENETC_PM0_IFM_EN_AUTO;	544	val &= ~(ENETC_PM0_IFM_EN_AUTO \| ENETC_PM0_IFM_IFMODE_MASK);
545	val &= ENETC_PM0_IFM_IFMODE_MASK;
546	val \|= ENETC_PM0_IFM_IFMODE_GMII \| ENETC_PM0_IFM_RG;	545	val \|= ENETC_PM0_IFM_IFMODE_GMII \| ENETC_PM0_IFM_RG;
547	enetc_port_wr(hw, ENETC_PM0_IF_MODE, val);	546	enetc_port_wr(hw, ENETC_PM0_IF_MODE, val);
548	}	547	}

drivers/net/ethernet/hisilicon/hns3/hnae3.h+0−1

@@ -752,7 +752,6 @@ struct hnae3_tc_info { · 751 unmodified lines
752	u8 prio_tc[HNAE3_MAX_USER_PRIO]; /* TC indexed by prio */	752	u8 prio_tc[HNAE3_MAX_USER_PRIO]; /* TC indexed by prio */
753	u16 tqp_count[HNAE3_MAX_TC];	753	u16 tqp_count[HNAE3_MAX_TC];
754	u16 tqp_offset[HNAE3_MAX_TC];	754	u16 tqp_offset[HNAE3_MAX_TC];
755	unsigned long tc_en; /* bitmap of TC enabled */
756	u8 num_tc; /* Total number of enabled TCs */	755	u8 num_tc; /* Total number of enabled TCs */
757	bool mqprio_active;	756	bool mqprio_active;
758	};	757	};

drivers/net/ethernet/hisilicon/hns3/hns3_enet.c+7−9

 			return ret;
 		}
-		for (i = 0; i < HNAE3_MAX_TC; i++) {
+		for (i = 0; i < tc_info->num_tc; i++)
-			if (!test_bit(i, &tc_info->tc_en))
-				continue;
 			netdev_set_tc_queue(netdev, i, tc_info->tqp_count[i],
 					    tc_info->tqp_offset[i]);
-		}
 	}
 	ret = netif_set_real_num_tx_queues(netdev, queue_size);
 	if (hns3_nic_resetting(netdev))
 		return -EBUSY;
+	if (!test_bit(HNS3_NIC_STATE_DOWN, &priv->state)) {
+		netdev_warn(netdev, "net open repeatedly!\n");
+		return 0;
+	}
 	netif_carrier_off(netdev);
 	ret = hns3_nic_set_real_num_queue(netdev);
 	struct hnae3_tc_info *tc_info = &kinfo->tc_info;
 	int i;
-	for (i = 0; i < HNAE3_MAX_TC; i++) {
+	for (i = 0; i < tc_info->num_tc; i++) {
 		int j;
-		if (!test_bit(i, &tc_info->tc_en))
-			continue;
 		for (j = 0; j < tc_info->tqp_count[i]; j++) {
 			struct hnae3_queue *q;

drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c+4−2

 #if IS_ENABLED(CONFIG_VLAN_8021Q)
 	/* Disable the vlan filter for selftest does not support it */
-	if (h->ae_algo->ops->enable_vlan_filter)
+	if (h->ae_algo->ops->enable_vlan_filter &&
+	    ndev->features & NETIF_F_HW_VLAN_CTAG_FILTER)
 		h->ae_algo->ops->enable_vlan_filter(h, false);
 #endif
 		h->ae_algo->ops->halt_autoneg(h, false);
 #if IS_ENABLED(CONFIG_VLAN_8021Q)
-	if (h->ae_algo->ops->enable_vlan_filter)
+	if (h->ae_algo->ops->enable_vlan_filter &&
+	    ndev->features & NETIF_F_HW_VLAN_CTAG_FILTER)
 		h->ae_algo->ops->enable_vlan_filter(h, true);
 #endif

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c+13−8

@@ -467,7 +467,7 @@ err_csq: · 466 unmodified lines
467	return ret;	467	return ret;
468	}	468	}
469		469
470	static int hclge_firmware_compat_config(struct hclge_dev *hdev)	470	static int hclge_firmware_compat_config(struct hclge_dev *hdev, bool en)
471	{	471	{
472	struct hclge_firmware_compat_cmd *req;	472	struct hclge_firmware_compat_cmd *req;
473	struct hclge_desc desc;	473	struct hclge_desc desc;
@@ -475,13 +475,16 @@ static int hclge_firmware_compat_config(struct hclge_dev *hdev) · 1 unmodified line
475		475
476	hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_IMP_COMPAT_CFG, false);	476	hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_IMP_COMPAT_CFG, false);
477		477
478	req = (struct hclge_firmware_compat_cmd *)desc.data;	478	if (en) {
		479	req = (struct hclge_firmware_compat_cmd *)desc.data;
479		480
480	hnae3_set_bit(compat, HCLGE_LINK_EVENT_REPORT_EN_B, 1);	481	hnae3_set_bit(compat, HCLGE_LINK_EVENT_REPORT_EN_B, 1);
481	hnae3_set_bit(compat, HCLGE_NCSI_ERROR_REPORT_EN_B, 1);	482	hnae3_set_bit(compat, HCLGE_NCSI_ERROR_REPORT_EN_B, 1);
482	if (hnae3_dev_phy_imp_supported(hdev))	483	if (hnae3_dev_phy_imp_supported(hdev))
483	hnae3_set_bit(compat, HCLGE_PHY_IMP_EN_B, 1);	484	hnae3_set_bit(compat, HCLGE_PHY_IMP_EN_B, 1);
484	req->compat = cpu_to_le32(compat);	485
		486	req->compat = cpu_to_le32(compat);
		487	}
485		488
486	return hclge_cmd_send(&hdev->hw, &desc, 1);	489	return hclge_cmd_send(&hdev->hw, &desc, 1);
487	}	490	}
@@ -538,7 +541,7 @@ int hclge_cmd_init(struct hclge_dev *hdev) · 50 unmodified lines
538	/* ask the firmware to enable some features, driver can work without	541	/* ask the firmware to enable some features, driver can work without
539	* it.	542	* it.
540	*/	543	*/
541	ret = hclge_firmware_compat_config(hdev);	544	ret = hclge_firmware_compat_config(hdev, true);
542	if (ret)	545	if (ret)
543	dev_warn(&hdev->pdev->dev,	546	dev_warn(&hdev->pdev->dev,
544	"Firmware compatible features not enabled(%d).\n",	547	"Firmware compatible features not enabled(%d).\n",
@@ -568,6 +571,8 @@ static void hclge_cmd_uninit_regs(struct hclge_hw *hw) · 23 unmodified lines
568		571
569	void hclge_cmd_uninit(struct hclge_dev *hdev)	572	void hclge_cmd_uninit(struct hclge_dev *hdev)
570	{	573	{
		574	hclge_firmware_compat_config(hdev, false);
		575
571	set_bit(HCLGE_STATE_CMD_DISABLE, &hdev->state);	576	set_bit(HCLGE_STATE_CMD_DISABLE, &hdev->state);
572	/* wait to ensure that the firmware completes the possible left	577	/* wait to ensure that the firmware completes the possible left
573	* over commands.	578	* over commands.

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c+16−13

@@ -247,6 +247,10 @@ static int hclge_ieee_setets(struct hnae3_handle h, struct ieee_ets ets) · 246 unmodified lines
247	}	247	}
248		248
249	hclge_tm_schd_info_update(hdev, num_tc);	249	hclge_tm_schd_info_update(hdev, num_tc);
		250	if (num_tc > 1)
		251	hdev->flag \|= HCLGE_FLAG_DCB_ENABLE;
		252	else
		253	hdev->flag &= ~HCLGE_FLAG_DCB_ENABLE;
250		254
251	ret = hclge_ieee_ets_to_tm_info(hdev, ets);	255	ret = hclge_ieee_ets_to_tm_info(hdev, ets);
252	if (ret)	256	if (ret)
@@ -306,8 +310,7 @@ static int hclge_ieee_setpfc(struct hnae3_handle h, struct ieee_pfc pfc) · 53 unmodified lines
306	u8 i, j, pfc_map, *prio_tc;	310	u8 i, j, pfc_map, *prio_tc;
307	int ret;	311	int ret;
308		312
309	if (!(hdev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE) \|\|	313	if (!(hdev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE))
310	hdev->flag & HCLGE_FLAG_MQPRIO_ENABLE)
311	return -EINVAL;	314	return -EINVAL;
312		315
313	if (pfc->pfc_en == hdev->tm_info.pfc_en)	316	if (pfc->pfc_en == hdev->tm_info.pfc_en)
@@ -441,8 +444,6 @@ static int hclge_mqprio_qopt_check(struct hclge_dev *hdev, · 127 unmodified lines
441	static void hclge_sync_mqprio_qopt(struct hnae3_tc_info *tc_info,	444	static void hclge_sync_mqprio_qopt(struct hnae3_tc_info *tc_info,
442	struct tc_mqprio_qopt_offload *mqprio_qopt)	445	struct tc_mqprio_qopt_offload *mqprio_qopt)
443	{	446	{
444	int i;
445
446	memset(tc_info, 0, sizeof(*tc_info));	447	memset(tc_info, 0, sizeof(*tc_info));
447	tc_info->num_tc = mqprio_qopt->qopt.num_tc;	448	tc_info->num_tc = mqprio_qopt->qopt.num_tc;
448	memcpy(tc_info->prio_tc, mqprio_qopt->qopt.prio_tc_map,	449	memcpy(tc_info->prio_tc, mqprio_qopt->qopt.prio_tc_map,
@@ -451,9 +452,6 @@ static void hclge_sync_mqprio_qopt(struct hnae3_tc_info *tc_info, · 2 unmodified lines
451	sizeof_field(struct hnae3_tc_info, tqp_count));	452	sizeof_field(struct hnae3_tc_info, tqp_count));
452	memcpy(tc_info->tqp_offset, mqprio_qopt->qopt.offset,	453	memcpy(tc_info->tqp_offset, mqprio_qopt->qopt.offset,
453	sizeof_field(struct hnae3_tc_info, tqp_offset));	454	sizeof_field(struct hnae3_tc_info, tqp_offset));
454
455	for (i = 0; i < HNAE3_MAX_USER_PRIO; i++)
456	set_bit(tc_info->prio_tc[i], &tc_info->tc_en);
457	}	455	}
458		456
459	static int hclge_config_tc(struct hclge_dev *hdev,	457	static int hclge_config_tc(struct hclge_dev *hdev,
@@ -519,12 +517,17 @@ static int hclge_setup_tc(struct hnae3_handle *h, · 59 unmodified lines
519	return hclge_notify_init_up(hdev);	517	return hclge_notify_init_up(hdev);
520		518
521	err_out:	519	err_out:
522	/* roll-back */	520	if (!tc) {
523	memcpy(&kinfo->tc_info, &old_tc_info, sizeof(old_tc_info));	521	dev_warn(&hdev->pdev->dev,
524	if (hclge_config_tc(hdev, &kinfo->tc_info))	522	"failed to destroy mqprio, will active after reset, ret = %d\n",
525	dev_err(&hdev->pdev->dev,	523	ret);
526	"failed to roll back tc configuration\n");	524	} else {
527		525	/* roll-back */
		526	memcpy(&kinfo->tc_info, &old_tc_info, sizeof(old_tc_info));
		527	if (hclge_config_tc(hdev, &kinfo->tc_info))
		528	dev_err(&hdev->pdev->dev,
		529	"failed to roll back tc configuration\n");
		530	}
528	hclge_notify_init_up(hdev);	531	hclge_notify_init_up(hdev);
529		532
530	return ret;	533	return ret;

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c+24−4

 	sprintf(result[(*index)++], "%6u", para->rate);
 }
-static int hclge_dbg_dump_tm_pg(struct hclge_dev *hdev, char *buf, int len)
+static int __hclge_dbg_dump_tm_pg(struct hclge_dev *hdev, char *data_str,
+				  char *buf, int len)
 {
-	char data_str[ARRAY_SIZE(tm_pg_items)][HCLGE_DBG_DATA_STR_LEN];
 	struct hclge_tm_shaper_para c_shaper_para, p_shaper_para;
 	char *result[ARRAY_SIZE(tm_pg_items)], *sch_mode_str;
 	u8 pg_id, sch_mode, weight, pri_bit_map, i, j;
 	int pos = 0;
 	int ret;
-	for (i = 0; i < ARRAY_SIZE(tm_pg_items); i++)
+	for (i = 0; i < ARRAY_SIZE(tm_pg_items); i++) {
-		result[i] = &data_str[i][0];
+		result[i] = data_str;
+		data_str += HCLGE_DBG_DATA_STR_LEN;
+	}
 	hclge_dbg_fill_content(content, sizeof(content), tm_pg_items,
 			       NULL, ARRAY_SIZE(tm_pg_items));
 	return 0;
 }
+static int hclge_dbg_dump_tm_pg(struct hclge_dev *hdev, char *buf, int len)
+{
+	char *data_str;
+	int ret;
+	data_str = kcalloc(ARRAY_SIZE(tm_pg_items),
+			   HCLGE_DBG_DATA_STR_LEN, GFP_KERNEL);
+	if (!data_str)
+		return -ENOMEM;
+	ret = __hclge_dbg_dump_tm_pg(hdev, data_str, buf, len);
+	kfree(data_str);
+	return ret;
+}
 static int hclge_dbg_dump_tm_port(struct hclge_dev *hdev,  char *buf, int len)
 {
 	struct hclge_tm_shaper_para shaper_para;

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c+15−12

@@ -8708,15 +8708,8 @@ int hclge_add_uc_addr_common(struct hclge_vport *vport, · 8707 unmodified lines
8708	}	8708	}
8709		8709
8710	/* check if we just hit the duplicate */	8710	/* check if we just hit the duplicate */
8711	if (!ret) {	8711	if (!ret)
8712	dev_warn(&hdev->pdev->dev, "VF %u mac(%pM) exists\n",	8712	return -EEXIST;
8713	vport->vport_id, addr);
8714	return 0;
8715	}
8716
8717	dev_err(&hdev->pdev->dev,
8718	"PF failed to add unicast entry(%pM) in the MAC table\n",
8719	addr);
8720		8713
8721	return ret;	8714	return ret;
8722	}	8715	}
@@ -8868,7 +8861,13 @@ static void hclge_sync_vport_mac_list(struct hclge_vport *vport, · 145 unmodified lines
8868	} else {	8861	} else {
8869	set_bit(HCLGE_VPORT_STATE_MAC_TBL_CHANGE,	8862	set_bit(HCLGE_VPORT_STATE_MAC_TBL_CHANGE,
8870	&vport->state);	8863	&vport->state);
8871	break;	8864
		8865	/* If one unicast mac address is existing in hardware,
		8866	* we need to try whether other unicast mac addresses
		8867	* are new addresses that can be added.
		8868	*/
		8869	if (ret != -EEXIST)
		8870	break;
8872	}	8871	}
8873	}	8872	}
8874	}	8873	}
@@ -12797,8 +12796,12 @@ static void hclge_sync_promisc_mode(struct hclge_dev *hdev) · 3922 unmodified lines
12797	continue;	12796	continue;
12798		12797
12799	if (vport->vf_info.trusted) {	12798	if (vport->vf_info.trusted) {
12800	uc_en = vport->vf_info.request_uc_en > 0;	12799	uc_en = vport->vf_info.request_uc_en > 0 \|\|
12801	mc_en = vport->vf_info.request_mc_en > 0;	12800	vport->overflow_promisc_flags &
		12801	HNAE3_OVERFLOW_UPE;
		12802	mc_en = vport->vf_info.request_mc_en > 0 \|\|
		12803	vport->overflow_promisc_flags &
		12804	HNAE3_OVERFLOW_MPE;
12802	}	12805	}
12803	bc_en = vport->vf_info.request_bc_en > 0;	12806	bc_en = vport->vf_info.request_bc_en > 0;
12804		12807

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c+5−28

 	for (i = 0; i < HNAE3_MAX_TC; i++) {
 		if (hdev->hw_tc_map & BIT(i) && i < kinfo->tc_info.num_tc) {
-			set_bit(i, &kinfo->tc_info.tc_en);
 			kinfo->tc_info.tqp_offset[i] = i * kinfo->rss_size;
 			kinfo->tc_info.tqp_count[i] = kinfo->rss_size;
 		} else {
 			/* Set to default queue if TC is disable */
-			clear_bit(i, &kinfo->tc_info.tc_en);
 			kinfo->tc_info.tqp_offset[i] = 0;
 			kinfo->tc_info.tqp_count[i] = 1;
 		}
 	for (i = 0; i < HNAE3_MAX_USER_PRIO; i++)
 		hdev->tm_info.prio_tc[i] =
 			(i >= hdev->tm_info.num_tc) ? 0 : i;
-	/* DCB is enabled if we have more than 1 TC or pfc_en is
-	 * non-zero.
-	 */
-	if (hdev->tm_info.num_tc > 1 || hdev->tm_info.pfc_en)
-		hdev->flag |= HCLGE_FLAG_DCB_ENABLE;
-	else
-		hdev->flag &= ~HCLGE_FLAG_DCB_ENABLE;
 }
 static void hclge_tm_pg_info_init(struct hclge_dev *hdev)
 static void hclge_update_fc_mode_by_dcb_flag(struct hclge_dev *hdev)
 {
-	if (!(hdev->flag & HCLGE_FLAG_DCB_ENABLE)) {
+	if (hdev->tm_info.num_tc == 1 && !hdev->tm_info.pfc_en) {
 		if (hdev->fc_mode_last_time == HCLGE_FC_PFC)
 			dev_warn(&hdev->pdev->dev,
-				 "DCB is disable, but last mode is FC_PFC\n");
+				 "Only 1 tc used, but last mode is FC_PFC\n");
 		hdev->tm_info.fc_mode = hdev->fc_mode_last_time;
 	} else if (hdev->tm_info.fc_mode != HCLGE_FC_PFC) {
 	}
 }
-static void hclge_pfc_info_init(struct hclge_dev *hdev)
+void hclge_tm_pfc_info_update(struct hclge_dev *hdev)
 {
 	if (hdev->ae_dev->dev_version >= HNAE3_DEVICE_VERSION_V3)
 		hclge_update_fc_mode(hdev);
 	hclge_tm_vport_info_update(hdev);
-	hclge_pfc_info_init(hdev);
+	hclge_tm_pfc_info_update(hdev);
 }
 static int hclge_tm_pg_to_pri_map(struct hclge_dev *hdev)
 	hclge_tm_schd_info_init(hdev);
 }
-void hclge_tm_pfc_info_update(struct hclge_dev *hdev)
-{
-	/* DCB is enabled if we have more than 1 TC or pfc_en is
-	 * non-zero.
-	 */
-	if (hdev->tm_info.num_tc > 1 || hdev->tm_info.pfc_en)
-		hdev->flag |= HCLGE_FLAG_DCB_ENABLE;
-	else
-		hdev->flag &= ~HCLGE_FLAG_DCB_ENABLE;
-	hclge_pfc_info_init(hdev);
-}
 int hclge_tm_init_hw(struct hclge_dev *hdev, bool init)
 {
 	int ret;
 	if (ret)
 		return ret;
-	if (!(hdev->flag & HCLGE_FLAG_DCB_ENABLE))
+	if (hdev->tm_info.num_tc == 1 && !hdev->tm_info.pfc_en)
 		return 0;
 	return hclge_tm_bp_setup(hdev);

drivers/net/ethernet/hisilicon/hns_mdio.c+1−1

@@ -354,7 +354,7 @@ static int hns_mdio_reset(struct mii_bus *bus) · 353 unmodified lines
354		354
355	if (dev_of_node(bus->parent)) {	355	if (dev_of_node(bus->parent)) {
356	if (!mdio_dev->subctrl_vbase) {	356	if (!mdio_dev->subctrl_vbase) {
357	dev_err(&bus->dev, "mdio sys ctl reg has not maped\n");	357	dev_err(&bus->dev, "mdio sys ctl reg has not mapped\n");
358	return -ENODEV;	358	return -ENODEV;
359	}	359	}
360		360

drivers/net/ethernet/ibm/ibmvnic.c+0−8

@@ -4708,14 +4708,6 @@ static int handle_login_rsp(union ibmvnic_crq *login_rsp_crq, · 4707 unmodified lines
4708	return 0;	4708	return 0;
4709	}	4709	}
4710		4710
4711	if (adapter->failover_pending) {
4712	adapter->init_done_rc = -EAGAIN;
4713	netdev_dbg(netdev, "Failover pending, ignoring login response\n");
4714	complete(&adapter->init_done);
4715	/* login response buffer will be released on reset */
4716	return 0;
4717	}
4718
4719	netdev->mtu = adapter->req_mtu - ETH_HLEN;	4711	netdev->mtu = adapter->req_mtu - ETH_HLEN;
4720		4712
4721	netdev_dbg(adapter->netdev, "Login Response Buffer:\n");	4713	netdev_dbg(adapter->netdev, "Login Response Buffer:\n");

drivers/net/ethernet/intel/e100.c+15−7

@@ -2437,11 +2437,15 @@ static void e100_get_drvinfo(struct net_device *netdev, · 2436 unmodified lines
2437	sizeof(info->bus_info));	2437	sizeof(info->bus_info));
2438	}	2438	}
2439		2439
2440	#define E100_PHY_REGS 0x1C	2440	#define E100_PHY_REGS 0x1D
2441	static int e100_get_regs_len(struct net_device *netdev)	2441	static int e100_get_regs_len(struct net_device *netdev)
2442	{	2442	{
2443	struct nic *nic = netdev_priv(netdev);	2443	struct nic *nic = netdev_priv(netdev);
2444	return 1 + E100_PHY_REGS + sizeof(nic->mem->dump_buf);	2444
		2445	/* We know the number of registers, and the size of the dump buffer.
		2446	* Calculate the total size in bytes.
		2447	*/
		2448	return (1 + E100_PHY_REGS) * sizeof(u32) + sizeof(nic->mem->dump_buf);
2445	}	2449	}
2446		2450
2447	static void e100_get_regs(struct net_device *netdev,	2451	static void e100_get_regs(struct net_device *netdev,
@@ -2455,14 +2459,18 @@ static void e100_get_regs(struct net_device *netdev, · 7 unmodified lines
2455	buff[0] = ioread8(&nic->csr->scb.cmd_hi) << 24 \|	2459	buff[0] = ioread8(&nic->csr->scb.cmd_hi) << 24 \|
2456	ioread8(&nic->csr->scb.cmd_lo) << 16 \|	2460	ioread8(&nic->csr->scb.cmd_lo) << 16 \|
2457	ioread16(&nic->csr->scb.status);	2461	ioread16(&nic->csr->scb.status);
2458	for (i = E100_PHY_REGS; i >= 0; i--)	2462	for (i = 0; i < E100_PHY_REGS; i++)
2459	buff[1 + E100_PHY_REGS - i] =	2463	/* Note that we read the registers in reverse order. This
2460	mdio_read(netdev, nic->mii.phy_id, i);	2464	* ordering is the ABI apparently used by ethtool and other
		2465	* applications.
		2466	*/
		2467	buff[1 + i] = mdio_read(netdev, nic->mii.phy_id,
		2468	E100_PHY_REGS - 1 - i);
2461	memset(nic->mem->dump_buf, 0, sizeof(nic->mem->dump_buf));	2469	memset(nic->mem->dump_buf, 0, sizeof(nic->mem->dump_buf));
2462	e100_exec_cb(nic, NULL, e100_dump);	2470	e100_exec_cb(nic, NULL, e100_dump);
2463	msleep(10);	2471	msleep(10);
2464	memcpy(&buff[2 + E100_PHY_REGS], nic->mem->dump_buf,	2472	memcpy(&buff[1 + E100_PHY_REGS], nic->mem->dump_buf,
2465	sizeof(nic->mem->dump_buf));	2473	sizeof(nic->mem->dump_buf));
2466	}	2474	}
2467		2475
2468	static void e100_get_wol(struct net_device netdev, struct ethtool_wolinfo wol)	2476	static void e100_get_wol(struct net_device netdev, struct ethtool_wolinfo wol)

drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c+1−1

@@ -3208,7 +3208,7 @@ static unsigned int ixgbe_max_channels(struct ixgbe_adapter *adapter) · 3207 unmodified lines
3208	max_combined = ixgbe_max_rss_indices(adapter);	3208	max_combined = ixgbe_max_rss_indices(adapter);
3209	}	3209	}
3210		3210
3211	return max_combined;	3211	return min_t(int, max_combined, num_online_cpus());
3212	}	3212	}
3213		3213
3214	static void ixgbe_get_channels(struct net_device *dev,	3214	static void ixgbe_get_channels(struct net_device *dev,

drivers/net/ethernet/intel/ixgbe/ixgbe_main.c+6−2

 	struct ixgbe_adapter *adapter = netdev_priv(dev);
 	struct bpf_prog *old_prog;
 	bool need_reset;
+	int num_queues;
 	if (adapter->flags & IXGBE_FLAG_SRIOV_ENABLED)
 		return -EINVAL;
 	/* Kick start the NAPI context if there is an AF_XDP socket open
 	 * on that queue id. This so that receiving will start.
 	 */
-	if (need_reset && prog)
+	if (need_reset && prog) {
-		for (i = 0; i < adapter->num_rx_queues; i++)
+		num_queues = min_t(int, adapter->num_rx_queues,
+				   adapter->num_xdp_queues);
+		for (i = 0; i < num_queues; i++)
 			if (adapter->xdp_ring[i]->xsk_pool)
 				(void)ixgbe_xsk_wakeup(adapter->netdev, i,
 						       XDP_WAKEUP_RX);
+	}
 	return 0;
 }

drivers/net/ethernet/micrel/Makefile+2−4

@@ -4,8 +4,6 @@ · 3 unmodified lines
4	#	4	#
5		5
6	obj-$(CONFIG_KS8842) += ks8842.o	6	obj-$(CONFIG_KS8842) += ks8842.o
7	obj-$(CONFIG_KS8851) += ks8851.o	7	obj-$(CONFIG_KS8851) += ks8851_common.o ks8851_spi.o
8	ks8851-objs = ks8851_common.o ks8851_spi.o	8	obj-$(CONFIG_KS8851_MLL) += ks8851_common.o ks8851_par.o
9	obj-$(CONFIG_KS8851_MLL) += ks8851_mll.o
10	ks8851_mll-objs = ks8851_common.o ks8851_par.o
11	obj-$(CONFIG_KSZ884X_PCI) += ksz884x.o	9	obj-$(CONFIG_KSZ884X_PCI) += ksz884x.o

drivers/net/ethernet/micrel/ks8851_common.c+8−0

 	return 0;
 }
+EXPORT_SYMBOL_GPL(ks8851_suspend);
 int ks8851_resume(struct device *dev)
 {
 	return 0;
 }
+EXPORT_SYMBOL_GPL(ks8851_resume);
 #endif
 static int ks8851_register_mdiobus(struct ks8851_net *ks, struct device *dev)
 err_reg_io:
 	return ret;
 }
+EXPORT_SYMBOL_GPL(ks8851_probe_common);
 int ks8851_remove_common(struct device *dev)
 {
 	return 0;
 }
+EXPORT_SYMBOL_GPL(ks8851_remove_common);
+MODULE_DESCRIPTION("KS8851 Network driver");
+MODULE_AUTHOR("Ben Dooks <ben@simtec.co.uk>");
+MODULE_LICENSE("GPL");

drivers/net/ethernet/pensando/ionic/ionic_stats.c+0−9

@@ -380,15 +380,6 @@ static void ionic_sw_stats_get_txq_values(struct ionic_lif lif, u64 *buf, · 379 unmodified lines
380	&ionic_dbg_intr_stats_desc[i]);	380	&ionic_dbg_intr_stats_desc[i]);
381	(*buf)++;	381	(*buf)++;
382	}	382	}
383	for (i = 0; i < IONIC_NUM_DBG_NAPI_STATS; i++) {
384	**buf = IONIC_READ_STAT64(&txqcq->napi_stats,
385	&ionic_dbg_napi_stats_desc[i]);
386	(*buf)++;
387	}
388	for (i = 0; i < IONIC_MAX_NUM_NAPI_CNTR; i++) {
389	**buf = txqcq->napi_stats.work_done_cntr[i];
390	(*buf)++;
391	}
392	for (i = 0; i < IONIC_MAX_NUM_SG_CNTR; i++) {	383	for (i = 0; i < IONIC_MAX_NUM_SG_CNTR; i++) {
393	**buf = txstats->sg_cntr[i];	384	**buf = txstats->sg_cntr[i];
394	(*buf)++;	385	(*buf)++;

drivers/net/ethernet/stmicro/stmmac/stmmac_main.c+4−0

 		timer_setup(&priv->eee_ctrl_timer, stmmac_eee_ctrl_timer, 0);
 		stmmac_set_eee_timer(priv, priv->hw, STMMAC_DEFAULT_LIT_LS,
 				     eee_tw_timer);
+		if (priv->hw->xpcs)
+			xpcs_config_eee(priv->hw->xpcs,
+					priv->plat->mult_fact_100ns,
+					true);
 	}
 	if (priv->plat->has_gmac4 && priv->tx_lpi_timer <= STMMAC_ET_MAX) {

drivers/net/ethernet/sun/Kconfig+1−0

@@ -73,6 +73,7 @@ config CASSINI · 72 unmodified lines
73	config SUNVNET_COMMON	73	config SUNVNET_COMMON
74	tristate "Common routines to support Sun Virtual Networking"	74	tristate "Common routines to support Sun Virtual Networking"
75	depends on SUN_LDOMS	75	depends on SUN_LDOMS
		76	depends on INET
76	default m	77	default m
77		78
78	config SUNVNET	79	config SUNVNET

drivers/net/hamradio/Kconfig+1−0

@@ -48,6 +48,7 @@ config BPQETHER · 47 unmodified lines
48	config DMASCC	48	config DMASCC
49	tristate "High-speed (DMA) SCC driver for AX.25"	49	tristate "High-speed (DMA) SCC driver for AX.25"
50	depends on ISA && AX25 && BROKEN_ON_SMP && ISA_DMA_API	50	depends on ISA && AX25 && BROKEN_ON_SMP && ISA_DMA_API
		51	depends on VIRT_TO_BUS
51	help	52	help
52	This is a driver for high-speed SCC boards, i.e. those supporting	53	This is a driver for high-speed SCC boards, i.e. those supporting
53	DMA on one port. You usually use those boards to connect your	54	DMA on one port. You usually use those boards to connect your

drivers/net/mdio/mdio-ipq4019.c+5−1

 {
 	struct ipq4019_mdio_data *priv;
 	struct mii_bus *bus;
+	struct resource *res;
 	int ret;
 	bus = devm_mdiobus_alloc_size(&pdev->dev, sizeof(*priv));
 		return PTR_ERR(priv->mdio_clk);
 	/* The platform resource is provided on the chipset IPQ5018 */
-	priv->eth_ldo_rdy = devm_platform_ioremap_resource(pdev, 1);
+	/* This resource is optional */
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+	if (res)
+		priv->eth_ldo_rdy = devm_ioremap_resource(&pdev->dev, res);
 	bus->name = "ipq4019_mdio";
 	bus->read = ipq4019_mdio_read;

drivers/net/mdio/mdio-mscc-miim.c+10−5

 static int mscc_miim_probe(struct platform_device *pdev)
 {
-	struct mii_bus *bus;
 	struct mscc_miim_dev *dev;
+	struct resource *res;
+	struct mii_bus *bus;
 	int ret;
 	bus = devm_mdiobus_alloc_size(&pdev->dev, sizeof(*dev));
 		return PTR_ERR(dev->regs);
 	}
-	dev->phy_regs = devm_platform_ioremap_resource(pdev, 1);
+	/* This resource is optional */
-	if (IS_ERR(dev->phy_regs)) {
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-		dev_err(&pdev->dev, "Unable to map internal phy registers\n");
+	if (res) {
-		return PTR_ERR(dev->phy_regs);
+		dev->phy_regs = devm_ioremap_resource(&pdev->dev, res);
+		if (IS_ERR(dev->phy_regs)) {
+			dev_err(&pdev->dev, "Unable to map internal phy registers\n");
+			return PTR_ERR(dev->phy_regs);
+		}
 	}
 	ret = of_mdiobus_register(bus, pdev->dev.of_node);

drivers/net/mhi_net.c+1−5

 	/* Start MHI channels */
 	err = mhi_prepare_for_transfer(mhi_dev);
 	if (err)
-		goto out_err;
+		return err;
 	/* Number of transfer descriptors determines size of the queue */
 	mhi_netdev->rx_queue_sz = mhi_get_free_desc_count(mhi_dev, DMA_FROM_DEVICE);
 		return err;
 	return 0;
-out_err:
-	free_netdev(ndev);
-	return err;
 }
 static void mhi_net_dellink(struct mhi_device *mhi_dev, struct net_device *ndev)

drivers/net/phy/bcm7xxx.c+110−4

@@ -27,7 +27,12 @@ · 26 unmodified lines
27	#define MII_BCM7XXX_SHD_2_ADDR_CTRL 0xe	27	#define MII_BCM7XXX_SHD_2_ADDR_CTRL 0xe
28	#define MII_BCM7XXX_SHD_2_CTRL_STAT 0xf	28	#define MII_BCM7XXX_SHD_2_CTRL_STAT 0xf
29	#define MII_BCM7XXX_SHD_2_BIAS_TRIM 0x1a	29	#define MII_BCM7XXX_SHD_2_BIAS_TRIM 0x1a
		30	#define MII_BCM7XXX_SHD_3_PCS_CTRL 0x0
		31	#define MII_BCM7XXX_SHD_3_PCS_STATUS 0x1
		32	#define MII_BCM7XXX_SHD_3_EEE_CAP 0x2
30	#define MII_BCM7XXX_SHD_3_AN_EEE_ADV 0x3	33	#define MII_BCM7XXX_SHD_3_AN_EEE_ADV 0x3
		34	#define MII_BCM7XXX_SHD_3_EEE_LP 0x4
		35	#define MII_BCM7XXX_SHD_3_EEE_WK_ERR 0x5
31	#define MII_BCM7XXX_SHD_3_PCS_CTRL_2 0x6	36	#define MII_BCM7XXX_SHD_3_PCS_CTRL_2 0x6
32	#define MII_BCM7XXX_PCS_CTRL_2_DEF 0x4400	37	#define MII_BCM7XXX_PCS_CTRL_2_DEF 0x4400
33	#define MII_BCM7XXX_SHD_3_AN_STAT 0xb	38	#define MII_BCM7XXX_SHD_3_AN_STAT 0xb
@@ -216,25 +221,37 @@ static int bcm7xxx_28nm_resume(struct phy_device *phydev) · 182 unmodified lines
216	return genphy_config_aneg(phydev);	221	return genphy_config_aneg(phydev);
217	}	222	}
218		223
219	static int phy_set_clr_bits(struct phy_device *dev, int location,	224	static int __phy_set_clr_bits(struct phy_device *dev, int location,
220	int set_mask, int clr_mask)	225	int set_mask, int clr_mask)
221	{	226	{
222	int v, ret;	227	int v, ret;
223		228
224	v = phy_read(dev, location);	229	v = __phy_read(dev, location);
225	if (v < 0)	230	if (v < 0)
226	return v;	231	return v;
227		232
228	v &= ~clr_mask;	233	v &= ~clr_mask;
229	v \|= set_mask;	234	v \|= set_mask;
230		235
231	ret = phy_write(dev, location, v);	236	ret = __phy_write(dev, location, v);
232	if (ret < 0)	237	if (ret < 0)
233	return ret;	238	return ret;
234		239
235	return v;	240	return v;
236	}	241	}
237		242
		243	static int phy_set_clr_bits(struct phy_device *dev, int location,
		244	int set_mask, int clr_mask)
		245	{
		246	int ret;
		247
		248	mutex_lock(&dev->mdio.bus->mdio_lock);
		249	ret = __phy_set_clr_bits(dev, location, set_mask, clr_mask);
		250	mutex_unlock(&dev->mdio.bus->mdio_lock);
		251
		252	return ret;
		253	}
		254
238	static int bcm7xxx_28nm_ephy_01_afe_config_init(struct phy_device *phydev)	255	static int bcm7xxx_28nm_ephy_01_afe_config_init(struct phy_device *phydev)
239	{	256	{
240	int ret;	257	int ret;
@@ -398,6 +415,93 @@ static int bcm7xxx_28nm_ephy_config_init(struct phy_device *phydev) · 157 unmodified lines
398	return bcm7xxx_28nm_ephy_apd_enable(phydev);	415	return bcm7xxx_28nm_ephy_apd_enable(phydev);
399	}	416	}
400		417
		418	#define MII_BCM7XXX_REG_INVALID 0xff
		419
		420	static u8 bcm7xxx_28nm_ephy_regnum_to_shd(u16 regnum)
		421	{
		422	switch (regnum) {
		423	case MDIO_CTRL1:
		424	return MII_BCM7XXX_SHD_3_PCS_CTRL;
		425	case MDIO_STAT1:
		426	return MII_BCM7XXX_SHD_3_PCS_STATUS;
		427	case MDIO_PCS_EEE_ABLE:
		428	return MII_BCM7XXX_SHD_3_EEE_CAP;
		429	case MDIO_AN_EEE_ADV:
		430	return MII_BCM7XXX_SHD_3_AN_EEE_ADV;
		431	case MDIO_AN_EEE_LPABLE:
		432	return MII_BCM7XXX_SHD_3_EEE_LP;
		433	case MDIO_PCS_EEE_WK_ERR:
		434	return MII_BCM7XXX_SHD_3_EEE_WK_ERR;
		435	default:
		436	return MII_BCM7XXX_REG_INVALID;
		437	}
		438	}
		439
		440	static bool bcm7xxx_28nm_ephy_dev_valid(int devnum)
		441	{
		442	return devnum == MDIO_MMD_AN \|\| devnum == MDIO_MMD_PCS;
		443	}
		444
		445	static int bcm7xxx_28nm_ephy_read_mmd(struct phy_device *phydev,
		446	int devnum, u16 regnum)
		447	{
		448	u8 shd = bcm7xxx_28nm_ephy_regnum_to_shd(regnum);
		449	int ret;
		450
		451	if (!bcm7xxx_28nm_ephy_dev_valid(devnum) \|\|
		452	shd == MII_BCM7XXX_REG_INVALID)
		453	return -EOPNOTSUPP;
		454
		455	/* set shadow mode 2 */
		456	ret = __phy_set_clr_bits(phydev, MII_BCM7XXX_TEST,
		457	MII_BCM7XXX_SHD_MODE_2, 0);
		458	if (ret < 0)
		459	return ret;
		460
		461	/* Access the desired shadow register address */
		462	ret = __phy_write(phydev, MII_BCM7XXX_SHD_2_ADDR_CTRL, shd);
		463	if (ret < 0)
		464	goto reset_shadow_mode;
		465
		466	ret = __phy_read(phydev, MII_BCM7XXX_SHD_2_CTRL_STAT);
		467
		468	reset_shadow_mode:
		469	/* reset shadow mode 2 */
		470	__phy_set_clr_bits(phydev, MII_BCM7XXX_TEST, 0,
		471	MII_BCM7XXX_SHD_MODE_2);
		472	return ret;
		473	}
		474
		475	static int bcm7xxx_28nm_ephy_write_mmd(struct phy_device *phydev,
		476	int devnum, u16 regnum, u16 val)
		477	{
		478	u8 shd = bcm7xxx_28nm_ephy_regnum_to_shd(regnum);
		479	int ret;
		480
		481	if (!bcm7xxx_28nm_ephy_dev_valid(devnum) \|\|
		482	shd == MII_BCM7XXX_REG_INVALID)
		483	return -EOPNOTSUPP;
		484
		485	/* set shadow mode 2 */
		486	ret = __phy_set_clr_bits(phydev, MII_BCM7XXX_TEST,
		487	MII_BCM7XXX_SHD_MODE_2, 0);
		488	if (ret < 0)
		489	return ret;
		490
		491	/* Access the desired shadow register address */
		492	ret = __phy_write(phydev, MII_BCM7XXX_SHD_2_ADDR_CTRL, shd);
		493	if (ret < 0)
		494	goto reset_shadow_mode;
		495
		496	/* Write the desired value in the shadow register */
		497	__phy_write(phydev, MII_BCM7XXX_SHD_2_CTRL_STAT, val);
		498
		499	reset_shadow_mode:
		500	/* reset shadow mode 2 */
		501	return __phy_set_clr_bits(phydev, MII_BCM7XXX_TEST, 0,
		502	MII_BCM7XXX_SHD_MODE_2);
		503	}
		504
401	static int bcm7xxx_28nm_ephy_resume(struct phy_device *phydev)	505	static int bcm7xxx_28nm_ephy_resume(struct phy_device *phydev)
402	{	506	{
403	int ret;	507	int ret;
@@ -595,6 +699,8 @@ static void bcm7xxx_28nm_remove(struct phy_device *phydev) · 191 unmodified lines
595	.get_stats = bcm7xxx_28nm_get_phy_stats, \	699	.get_stats = bcm7xxx_28nm_get_phy_stats, \
596	.probe = bcm7xxx_28nm_probe, \	700	.probe = bcm7xxx_28nm_probe, \
597	.remove = bcm7xxx_28nm_remove, \	701	.remove = bcm7xxx_28nm_remove, \
		702	.read_mmd = bcm7xxx_28nm_ephy_read_mmd, \
		703	.write_mmd = bcm7xxx_28nm_ephy_write_mmd, \
598	}	704	}
599		705
600	#define BCM7XXX_40NM_EPHY(_oui, _name) \	706	#define BCM7XXX_40NM_EPHY(_oui, _name) \

drivers/net/phy/mdio_bus.c+5−0

 	    NULL == bus->read || NULL == bus->write)
 		return -EINVAL;
+	if (bus->parent && bus->parent->of_node)
+		bus->parent->of_node->fwnode.flags |=
+					FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD;
 	BUG_ON(bus->state != MDIOBUS_ALLOCATED &&
 	       bus->state != MDIOBUS_UNREGISTERED);
 	err = device_register(&bus->dev);
 	if (err) {
 		pr_err("mii_bus %s failed to register\n", bus->id);
+		put_device(&bus->dev);
 		return -EINVAL;
 	}

drivers/net/phy/mxl-gpy.c+21−2

 	return ret;
 }
+static int gpy115_loopback(struct phy_device *phydev, bool enable)
+{
+	int ret;
+	int fw_minor;
+	if (enable)
+		return gpy_loopback(phydev, enable);
+	ret = phy_read(phydev, PHY_FWV);
+	if (ret < 0)
+		return ret;
+	fw_minor = FIELD_GET(PHY_FWV_MINOR_MASK, ret);
+	if (fw_minor > 0x0076)
+		return gpy_loopback(phydev, 0);
+	return genphy_soft_reset(phydev);
+}
 static struct phy_driver gpy_drivers[] = {
 	{
 		PHY_ID_MATCH_MODEL(PHY_ID_GPY2xx),
 		.handle_interrupt = gpy_handle_interrupt,
 		.set_wol	= gpy_set_wol,
 		.get_wol	= gpy_get_wol,
-		.set_loopback	= gpy_loopback,
+		.set_loopback	= gpy115_loopback,
 	},
 	{
 		PHY_ID_MATCH_MODEL(PHY_ID_GPY115C),
 		.handle_interrupt = gpy_handle_interrupt,
 		.set_wol	= gpy_set_wol,
 		.get_wol	= gpy_get_wol,
-		.set_loopback	= gpy_loopback,
+		.set_loopback	= gpy115_loopback,
 	},
 	{
 		.phy_id		= PHY_ID_GPY211B,

drivers/net/usb/smsc95xx.c+3−0

@@ -1178,7 +1178,10 @@ static void smsc95xx_unbind(struct usbnet dev, struct usb_interface intf) · 1177 unmodified lines
1178		1178
1179	static void smsc95xx_handle_link_change(struct net_device *net)	1179	static void smsc95xx_handle_link_change(struct net_device *net)
1180	{	1180	{
		1181	struct usbnet *dev = netdev_priv(net);
		1182
1181	phy_print_status(net->phydev);	1183	phy_print_status(net->phydev);
		1184	usbnet_defer_kevent(dev, EVENT_LINK_CHANGE);
1182	}	1185	}
1183		1186
1184	static int smsc95xx_start_phy(struct usbnet *dev)	1187	static int smsc95xx_start_phy(struct usbnet *dev)

drivers/net/wireless/mac80211_hwsim.c+2−2

@@ -1867,8 +1867,8 @@ mac80211_hwsim_beacon(struct hrtimer *timer) · 1866 unmodified lines
1867	bcn_int -= data->bcn_delta;	1867	bcn_int -= data->bcn_delta;
1868	data->bcn_delta = 0;	1868	data->bcn_delta = 0;
1869	}	1869	}
1870	hrtimer_forward(&data->beacon_timer, hrtimer_get_expires(timer),	1870	hrtimer_forward_now(&data->beacon_timer,
1871	ns_to_ktime(bcn_int * NSEC_PER_USEC));	1871	ns_to_ktime(bcn_int * NSEC_PER_USEC));
1872	return HRTIMER_RESTART;	1872	return HRTIMER_RESTART;
1873	}	1873	}
1874		1874

drivers/nvdimm/pmem.c+1−4

 	struct nd_pfn_sb *pfn_sb;
 	struct pmem_device *pmem;
 	struct request_queue *q;
-	struct device *gendev;
 	struct gendisk *disk;
 	void *addr;
 	int rc;
 	}
 	dax_write_cache(dax_dev, nvdimm_has_cache(nd_region));
 	pmem->dax_dev = dax_dev;
-	gendev = disk_to_dev(disk);
-	gendev->groups = pmem_attribute_groups;
-	device_add_disk(dev, disk, NULL);
+	device_add_disk(dev, disk, pmem_attribute_groups);
 	if (devm_add_action_or_reset(dev, pmem_release_disk, pmem))
 		return -ENOMEM;

drivers/nvme/host/core.c+3−1

 blk_status_t nvme_setup_cmd(struct nvme_ns *ns, struct request *req)
 {
 	struct nvme_command *cmd = nvme_req(req)->cmd;
+	struct nvme_ctrl *ctrl = nvme_req(req)->ctrl;
 	blk_status_t ret = BLK_STS_OK;
 	if (!(req->rq_flags & RQF_DONTPREP)) {
 		return BLK_STS_IOERR;
 	}
-	nvme_req(req)->genctr++;
+	if (!(ctrl->quirks & NVME_QUIRK_SKIP_CID_GEN))
+		nvme_req(req)->genctr++;
 	cmd->common.command_id = nvme_cid(req);
 	trace_nvme_setup_cmd(req, cmd);
 	return ret;

drivers/nvme/host/nvme.h+6−0

 	 * 48 bits.
 	 */
 	NVME_QUIRK_DMA_ADDRESS_BITS_48		= (1 << 16),
+	/*
+	 * The controller requires the command_id value be be limited, so skip
+	 * encoding the generation sequence number.
+	 */
+	NVME_QUIRK_SKIP_CID_GEN			= (1 << 17),
 };
 /*

drivers/nvme/host/pci.c+2−1

@@ -3369,7 +3369,8 @@ static const struct pci_device_id nvme_id_table[] = { · 3368 unmodified lines
3369	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2005),	3369	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2005),
3370	.driver_data = NVME_QUIRK_SINGLE_VECTOR \|	3370	.driver_data = NVME_QUIRK_SINGLE_VECTOR \|
3371	NVME_QUIRK_128_BYTES_SQES \|	3371	NVME_QUIRK_128_BYTES_SQES \|
3372	NVME_QUIRK_SHARED_TAGS },	3372	NVME_QUIRK_SHARED_TAGS \|
		3373	NVME_QUIRK_SKIP_CID_GEN },
3373		3374
3374	{ PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },	3375	{ PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },
3375	{ 0, }	3376	{ 0, }

drivers/perf/arm_pmu.c+2−0

@@ -952,6 +952,8 @@ int armpmu_register(struct arm_pmu *pmu) · 951 unmodified lines
952	pmu->name, pmu->num_events,	952	pmu->name, pmu->num_events,
953	has_nmi ? ", using NMIs" : "");	953	has_nmi ? ", using NMIs" : "");
954		954
		955	kvm_host_pmu_init(pmu);
		956
955	return 0;	957	return 0;
956		958
957	out_destroy:	959	out_destroy:

drivers/pinctrl/core.c+1−1

@@ -2306,7 +2306,7 @@ EXPORT_SYMBOL_GPL(devm_pinctrl_register_and_init); · 2305 unmodified lines
2306		2306
2307	/**	2307	/**
2308	* devm_pinctrl_unregister() - Resource managed version of pinctrl_unregister().	2308	* devm_pinctrl_unregister() - Resource managed version of pinctrl_unregister().
2309	* @dev: device for which which resource was allocated	2309	* @dev: device for which resource was allocated
2310	* @pctldev: the pinctrl device to unregister.	2310	* @pctldev: the pinctrl device to unregister.
2311	*/	2311	*/
2312	void devm_pinctrl_unregister(struct device dev, struct pinctrl_dev pctldev)	2312	void devm_pinctrl_unregister(struct device dev, struct pinctrl_dev pctldev)

drivers/pinctrl/pinctrl-amd.c+14−5

 	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
 	struct amd_gpio *gpio_dev = gpiochip_get_data(gc);
 	u32 wake_mask = BIT(WAKE_CNTRL_OFF_S0I3) | BIT(WAKE_CNTRL_OFF_S3);
+	int err;
 	raw_spin_lock_irqsave(&gpio_dev->lock, flags);
 	pin_reg = readl(gpio_dev->base + (d->hwirq)*4);
 	writel(pin_reg, gpio_dev->base + (d->hwirq)*4);
 	raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
+	if (on)
+		err = enable_irq_wake(gpio_dev->irq);
+	else
+		err = disable_irq_wake(gpio_dev->irq);
+	if (err)
+		dev_err(&gpio_dev->pdev->dev, "failed to %s wake-up interrupt\n",
+			on ? "enable" : "disable");
 	return 0;
 }
 static int amd_gpio_probe(struct platform_device *pdev)
 {
 	int ret = 0;
-	int irq_base;
 	struct resource *res;
 	struct amd_gpio *gpio_dev;
 	struct gpio_irq_chip *girq;
 	if (!gpio_dev->base)
 		return -ENOMEM;
-	irq_base = platform_get_irq(pdev, 0);
+	gpio_dev->irq = platform_get_irq(pdev, 0);
-	if (irq_base < 0)
+	if (gpio_dev->irq < 0)
-		return irq_base;
+		return gpio_dev->irq;
 #ifdef CONFIG_PM_SLEEP
 	gpio_dev->saved_regs = devm_kcalloc(&pdev->dev, amd_pinctrl_desc.npins,
 		goto out2;
 	}
-	ret = devm_request_irq(&pdev->dev, irq_base, amd_gpio_irq_handler,
+	ret = devm_request_irq(&pdev->dev, gpio_dev->irq, amd_gpio_irq_handler,
 			       IRQF_SHARED, KBUILD_MODNAME, gpio_dev);
 	if (ret)
 		goto out2;

drivers/pinctrl/pinctrl-amd.h+1−0

@@ -98,6 +98,7 @@ struct amd_gpio { · 97 unmodified lines
98	struct resource *res;	98	struct resource *res;
99	struct platform_device *pdev;	99	struct platform_device *pdev;
100	u32 *saved_regs;	100	u32 *saved_regs;
		101	int irq;
101	};	102	};
102		103
103	/* KERNCZ configuration*/	104	/* KERNCZ configuration*/

drivers/pinctrl/pinctrl-rockchip.c+67−0

@@ -2092,6 +2092,23 @@ static bool rockchip_pinconf_pull_valid(struct rockchip_pin_ctrl *ctrl, · 2091 unmodified lines
2092	return false;	2092	return false;
2093	}	2093	}
2094		2094
		2095	static int rockchip_pinconf_defer_output(struct rockchip_pin_bank *bank,
		2096	unsigned int pin, u32 arg)
		2097	{
		2098	struct rockchip_pin_output_deferred *cfg;
		2099
		2100	cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
		2101	if (!cfg)
		2102	return -ENOMEM;
		2103
		2104	cfg->pin = pin;
		2105	cfg->arg = arg;
		2106
		2107	list_add_tail(&cfg->head, &bank->deferred_output);
		2108
		2109	return 0;
		2110	}
		2111
2095	/* set the pin config settings for a specified pin */	2112	/* set the pin config settings for a specified pin */
2096	static int rockchip_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,	2113	static int rockchip_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,
2097	unsigned long *configs, unsigned num_configs)	2114	unsigned long *configs, unsigned num_configs)
@@ -2136,6 +2153,22 @@ static int rockchip_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin, · 38 unmodified lines
2136	if (rc != RK_FUNC_GPIO)	2153	if (rc != RK_FUNC_GPIO)
2137	return -EINVAL;	2154	return -EINVAL;
2138		2155
		2156	/*
		2157	* Check for gpio driver not being probed yet.
		2158	* The lock makes sure that either gpio-probe has completed
		2159	* or the gpio driver hasn't probed yet.
		2160	*/
		2161	mutex_lock(&bank->deferred_lock);
		2162	if (!gpio \|\| !gpio->direction_output) {
		2163	rc = rockchip_pinconf_defer_output(bank, pin - bank->pin_base, arg);
		2164	mutex_unlock(&bank->deferred_lock);
		2165	if (rc)
		2166	return rc;
		2167
		2168	break;
		2169	}
		2170	mutex_unlock(&bank->deferred_lock);
		2171
2139	rc = gpio->direction_output(gpio, pin - bank->pin_base,	2172	rc = gpio->direction_output(gpio, pin - bank->pin_base,
2140	arg);	2173	arg);
2141	if (rc)	2174	if (rc)
@@ -2204,6 +2237,11 @@ static int rockchip_pinconf_get(struct pinctrl_dev *pctldev, unsigned int pin, · 62 unmodified lines
2204	if (rc != RK_FUNC_GPIO)	2237	if (rc != RK_FUNC_GPIO)
2205	return -EINVAL;	2238	return -EINVAL;
2206		2239
		2240	if (!gpio \|\| !gpio->get) {
		2241	arg = 0;
		2242	break;
		2243	}
		2244
2207	rc = gpio->get(gpio, pin - bank->pin_base);	2245	rc = gpio->get(gpio, pin - bank->pin_base);
2208	if (rc < 0)	2246	if (rc < 0)
2209	return rc;	2247	return rc;
@@ -2450,6 +2488,9 @@ static int rockchip_pinctrl_register(struct platform_device *pdev, · 240 unmodified lines
2450	pin_bank->name, pin);	2488	pin_bank->name, pin);
2451	pdesc++;	2489	pdesc++;
2452	}	2490	}
		2491
		2492	INIT_LIST_HEAD(&pin_bank->deferred_output);
		2493	mutex_init(&pin_bank->deferred_lock);
2453	}	2494	}
2454		2495
2455	ret = rockchip_pinctrl_parse_dt(pdev, info);	2496	ret = rockchip_pinctrl_parse_dt(pdev, info);
@@ -2716,6 +2757,31 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev) · 260 unmodified lines
2716	return 0;	2757	return 0;
2717	}	2758	}
2718		2759
		2760	static int rockchip_pinctrl_remove(struct platform_device *pdev)
		2761	{
		2762	struct rockchip_pinctrl *info = platform_get_drvdata(pdev);
		2763	struct rockchip_pin_bank *bank;
		2764	struct rockchip_pin_output_deferred *cfg;
		2765	int i;
		2766
		2767	of_platform_depopulate(&pdev->dev);
		2768
		2769	for (i = 0; i < info->ctrl->nr_banks; i++) {
		2770	bank = &info->ctrl->pin_banks[i];
		2771
		2772	mutex_lock(&bank->deferred_lock);
		2773	while (!list_empty(&bank->deferred_output)) {
		2774	cfg = list_first_entry(&bank->deferred_output,
		2775	struct rockchip_pin_output_deferred, head);
		2776	list_del(&cfg->head);
		2777	kfree(cfg);
		2778	}
		2779	mutex_unlock(&bank->deferred_lock);
		2780	}
		2781
		2782	return 0;
		2783	}
		2784
2719	static struct rockchip_pin_bank px30_pin_banks[] = {	2785	static struct rockchip_pin_bank px30_pin_banks[] = {
2720	PIN_BANK_IOMUX_FLAGS(0, 32, "gpio0", IOMUX_SOURCE_PMU,	2786	PIN_BANK_IOMUX_FLAGS(0, 32, "gpio0", IOMUX_SOURCE_PMU,
2721	IOMUX_SOURCE_PMU,	2787	IOMUX_SOURCE_PMU,
@@ -3175,6 +3241,7 @@ static const struct of_device_id rockchip_pinctrl_dt_match[] = { · 453 unmodified lines
3175		3241
3176	static struct platform_driver rockchip_pinctrl_driver = {	3242	static struct platform_driver rockchip_pinctrl_driver = {
3177	.probe = rockchip_pinctrl_probe,	3243	.probe = rockchip_pinctrl_probe,
		3244	.remove = rockchip_pinctrl_remove,
3178	.driver = {	3245	.driver = {
3179	.name = "rockchip-pinctrl",	3246	.name = "rockchip-pinctrl",
3180	.pm = &rockchip_pinctrl_dev_pm_ops,	3247	.pm = &rockchip_pinctrl_dev_pm_ops,

drivers/pinctrl/pinctrl-rockchip.h+10−0

  * @toggle_edge_mode: bit mask to toggle (falling/rising) edge mode
  * @recalced_mask: bit mask to indicate a need to recalulate the mask
  * @route_mask: bits describing the routing pins of per bank
+ * @deferred_output: gpio output settings to be done after gpio bank probed
+ * @deferred_lock: mutex for the deferred_output shared btw gpio and pinctrl
  */
 struct rockchip_pin_bank {
 	struct device			*dev;
 	u32				toggle_edge_mode;
 	u32				recalced_mask;
 	u32				route_mask;
+	struct list_head		deferred_output;
+	struct mutex			deferred_lock;
 };
 /**
 	unsigned int		nconfigs;
 };
+struct rockchip_pin_output_deferred {
+	struct list_head head;
+	unsigned int pin;
+	u32 arg;
+};
 /**
  * struct rockchip_pin_group: represent group of pins of a pinmux function.
  * @name: name of the pin group, used to lookup the group.

drivers/pinctrl/qcom/pinctrl-sc7280.c+1−0

@@ -1496,6 +1496,7 @@ static const struct of_device_id sc7280_pinctrl_of_match[] = { · 1495 unmodified lines
1496	static struct platform_driver sc7280_pinctrl_driver = {	1496	static struct platform_driver sc7280_pinctrl_driver = {
1497	.driver = {	1497	.driver = {
1498	.name = "sc7280-pinctrl",	1498	.name = "sc7280-pinctrl",
		1499	.pm = &msm_pinctrl_dev_pm_ops,
1499	.of_match_table = sc7280_pinctrl_of_match,	1500	.of_match_table = sc7280_pinctrl_of_match,
1500	},	1501	},
1501	.probe = sc7280_pinctrl_probe,	1502	.probe = sc7280_pinctrl_probe,

drivers/pinctrl/qcom/pinctrl-spmi-gpio.c+34−3

 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2012-2014, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016-2021 The Linux Foundation. All rights reserved.
  */
 #include <linux/gpio/driver.h>
 #include <linux/platform_device.h>
 #include <linux/regmap.h>
 #include <linux/slab.h>
+#include <linux/spmi.h>
 #include <linux/types.h>
 #include <dt-bindings/pinctrl/qcom,pmic-gpio.h>
 	struct pinctrl_dev *ctrl;
 	struct gpio_chip chip;
 	struct irq_chip irq;
+	u8 usid;
+	u8 pid_base;
 };
 static const struct pinconf_generic_params pmic_gpio_bindings[] = {
 					   unsigned int *parent_hwirq,
 					   unsigned int *parent_type)
 {
-	*parent_hwirq = child_hwirq + 0xc0;
+	struct pmic_gpio_state *state = gpiochip_get_data(chip);
+	*parent_hwirq = child_hwirq + state->pid_base;
 	*parent_type = child_type;
 	return 0;
 }
+static void *pmic_gpio_populate_parent_fwspec(struct gpio_chip *chip,
+					     unsigned int parent_hwirq,
+					     unsigned int parent_type)
+{
+	struct pmic_gpio_state *state = gpiochip_get_data(chip);
+	struct irq_fwspec *fwspec;
+	fwspec = kzalloc(sizeof(*fwspec), GFP_KERNEL);
+	if (!fwspec)
+		return NULL;
+	fwspec->fwnode = chip->irq.parent_domain->fwnode;
+	fwspec->param_count = 4;
+	fwspec->param[0] = state->usid;
+	fwspec->param[1] = parent_hwirq;
+	/* param[2] must be left as 0 */
+	fwspec->param[3] = parent_type;
+	return fwspec;
+}
 static int pmic_gpio_probe(struct platform_device *pdev)
 {
 	struct irq_domain *parent_domain;
 	struct pmic_gpio_pad *pad, *pads;
 	struct pmic_gpio_state *state;
 	struct gpio_irq_chip *girq;
+	const struct spmi_device *parent_spmi_dev;
 	int ret, npins, i;
 	u32 reg;
 	state->dev = &pdev->dev;
 	state->map = dev_get_regmap(dev->parent, NULL);
+	parent_spmi_dev = to_spmi_device(dev->parent);
+	state->usid = parent_spmi_dev->usid;
+	state->pid_base = reg >> 8;
 	pindesc = devm_kcalloc(dev, npins, sizeof(*pindesc), GFP_KERNEL);
 	if (!pindesc)
 	girq->fwnode = of_node_to_fwnode(state->dev->of_node);
 	girq->parent_domain = parent_domain;
 	girq->child_to_parent_hwirq = pmic_gpio_child_to_parent_hwirq;
-	girq->populate_parent_alloc_arg = gpiochip_populate_parent_fwspec_fourcell;
+	girq->populate_parent_alloc_arg = pmic_gpio_populate_parent_fwspec;
 	girq->child_offset_to_irq = pmic_gpio_child_offset_to_irq;
 	girq->child_irq_domain_ops.translate = pmic_gpio_domain_translate;

drivers/ptp/ptp_kvm_x86.c+2−7

 #include <linux/ptp_clock_kernel.h>
 #include <linux/ptp_kvm.h>
-struct pvclock_vsyscall_time_info *hv_clock;
 static phys_addr_t clock_pair_gpa;
 static struct kvm_clock_pairing clock_pair;
 		return -ENODEV;
 	clock_pair_gpa = slow_virt_to_phys(&clock_pair);
-	hv_clock = pvclock_get_pvti_cpu0_va();
+	if (!pvclock_get_pvti_cpu0_va())
-	if (!hv_clock)
 		return -ENODEV;
 	ret = kvm_hypercall2(KVM_HC_CLOCK_PAIRING, clock_pair_gpa,
 	struct pvclock_vcpu_time_info *src;
 	unsigned int version;
 	long ret;
-	int cpu;
-	cpu = smp_processor_id();
+	src = this_cpu_pvti();
-	src = &hv_clock[cpu].pvti;
 	do {
 		/*

drivers/s390/cio/blacklist.c+5−3

 	if (strcmp("free", parm) == 0) {
 		rc = blacklist_parse_parameters(buf, free, 0);
-		/* There could be subchannels without proper devices connected.
+		/*
-		 * evaluate all the entries
+		 * Evaluate the subchannels without an online device. This way,
+		 * no path-verification will be triggered on those subchannels
+		 * and it avoids unnecessary delays.
 		 */
-		css_schedule_eval_all();
+		css_schedule_eval_cond(CSS_EVAL_NOT_ONLINE, 0);
 	} else if (strcmp("add", parm) == 0)
 		rc = blacklist_parse_parameters(buf, add, 0);
 	else if (strcmp("purge", parm) == 0)

drivers/s390/cio/css.c+31−9

 	return 0;
 }
-void css_schedule_eval_all_unreg(unsigned long delay)
+static int __unset_online(struct device *dev, void *data)
+{
+	struct idset *set = data;
+	struct subchannel *sch = to_subchannel(dev);
+	struct ccw_device *cdev = sch_get_cdev(sch);
+	if (cdev && cdev->online)
+		idset_sch_del(set, sch->schid);
+	return 0;
+}
+void css_schedule_eval_cond(enum css_eval_cond cond, unsigned long delay)
 {
 	unsigned long flags;
-	struct idset *unreg_set;
+	struct idset *set;
 	/* Find unregistered subchannels. */
-	unreg_set = idset_sch_new();
+	set = idset_sch_new();
-	if (!unreg_set) {
+	if (!set) {
 		/* Fallback. */
 		css_schedule_eval_all();
 		return;
 	}
-	idset_fill(unreg_set);
+	idset_fill(set);
-	bus_for_each_dev(&css_bus_type, NULL, unreg_set, __unset_registered);
+	switch (cond) {
+	case CSS_EVAL_UNREG:
+		bus_for_each_dev(&css_bus_type, NULL, set, __unset_registered);
+		break;
+	case CSS_EVAL_NOT_ONLINE:
+		bus_for_each_dev(&css_bus_type, NULL, set, __unset_online);
+		break;
+	default:
+		break;
+	}
 	/* Apply to slow_subchannel_set. */
 	spin_lock_irqsave(&slow_subchannel_lock, flags);
-	idset_add_set(slow_subchannel_set, unreg_set);
+	idset_add_set(slow_subchannel_set, set);
 	atomic_set(&css_eval_scheduled, 1);
 	queue_delayed_work(cio_work_q, &slow_path_work, delay);
 	spin_unlock_irqrestore(&slow_subchannel_lock, flags);
-	idset_free(unreg_set);
+	idset_free(set);
 }
 void css_wait_for_slow_path(void)
 void css_schedule_reprobe(void)
 {
 	/* Schedule with a delay to allow merging of subsequent calls. */
-	css_schedule_eval_all_unreg(1 * HZ);
+	css_schedule_eval_cond(CSS_EVAL_UNREG, 1 * HZ);
 }
 EXPORT_SYMBOL_GPL(css_schedule_reprobe);

drivers/s390/cio/css.h+9−1

 #define SNID_STATE3_MULTI_PATH	   1
 #define SNID_STATE3_SINGLE_PATH	   0
+/*
+ * Conditions used to specify which subchannels need evaluation
+ */
+enum css_eval_cond {
+	CSS_EVAL_UNREG,		/* unregistered subchannels */
+	CSS_EVAL_NOT_ONLINE	/* sch without an online-device */
+};
 struct path_state {
 	__u8  state1 : 2;	/* path state value 1 */
 	__u8  state2 : 2;	/* path state value 2 */
 /* Helper functions to build lists for the slow path. */
 void css_schedule_eval(struct subchannel_id schid);
 void css_schedule_eval_all(void);
-void css_schedule_eval_all_unreg(unsigned long delay);
+void css_schedule_eval_cond(enum css_eval_cond, unsigned long delay);
 int css_complete_work(void);
 int sch_is_pseudo_sch(struct subchannel *);

drivers/s390/crypto/vfio_ap_ops.c+3−1

 	mutex_lock(&matrix_dev->lock);
 	list_del(&matrix_mdev->node);
 	mutex_unlock(&matrix_dev->lock);
+	vfio_uninit_group_dev(&matrix_mdev->vdev);
 	kfree(matrix_mdev);
 err_dec_available:
 	atomic_inc(&matrix_dev->available_instances);
 	mutex_lock(&matrix_dev->lock);
 	vfio_ap_mdev_reset_queues(matrix_mdev);
 	list_del(&matrix_mdev->node);
+	mutex_unlock(&matrix_dev->lock);
+	vfio_uninit_group_dev(&matrix_mdev->vdev);
 	kfree(matrix_mdev);
 	atomic_inc(&matrix_dev->available_instances);
-	mutex_unlock(&matrix_dev->lock);
 }
 static ssize_t name_show(struct mdev_type *mtype,

drivers/scsi/csiostor/csio_init.c+1−0

@@ -1254,3 +1254,4 @@ MODULE_DEVICE_TABLE(pci, csio_pci_tbl); · 1253 unmodified lines
1254	MODULE_VERSION(CSIO_DRV_VERSION);	1254	MODULE_VERSION(CSIO_DRV_VERSION);
1255	MODULE_FIRMWARE(FW_FNAME_T5);	1255	MODULE_FIRMWARE(FW_FNAME_T5);
1256	MODULE_FIRMWARE(FW_FNAME_T6);	1256	MODULE_FIRMWARE(FW_FNAME_T6);
		1257	MODULE_SOFTDEP("pre: cxgb4");

drivers/scsi/qla2xxx/qla_isr.c+2−2

@@ -2634,7 +2634,7 @@ static void qla24xx_nvme_iocb_entry(scsi_qla_host_t vha, struct req_que req, · 2633 unmodified lines
2634	}	2634	}
2635		2635
2636	if (unlikely(logit))	2636	if (unlikely(logit))
2637	ql_log(ql_log_warn, fcport->vha, 0x5060,	2637	ql_log(ql_dbg_io, fcport->vha, 0x5060,
2638	"NVME-%s ERR Handling - hdl=%x status(%x) tr_len:%x resid=%x ox_id=%x\n",	2638	"NVME-%s ERR Handling - hdl=%x status(%x) tr_len:%x resid=%x ox_id=%x\n",
2639	sp->name, sp->handle, comp_status,	2639	sp->name, sp->handle, comp_status,
2640	fd->transferred_length, le32_to_cpu(sts->residual_len),	2640	fd->transferred_length, le32_to_cpu(sts->residual_len),
@@ -3491,7 +3491,7 @@ check_scsi_status: · 850 unmodified lines
3491		3491
3492	out:	3492	out:
3493	if (logit)	3493	if (logit)
3494	ql_log(ql_log_warn, fcport->vha, 0x3022,	3494	ql_log(ql_dbg_io, fcport->vha, 0x3022,
3495	"FCP command status: 0x%x-0x%x (0x%x) nexus=%ld:%d:%llu portid=%02x%02x%02x oxid=0x%x cdb=%10phN len=0x%x rsp_info=0x%x resid=0x%x fw_resid=0x%x sp=%p cp=%p.\n",	3495	"FCP command status: 0x%x-0x%x (0x%x) nexus=%ld:%d:%llu portid=%02x%02x%02x oxid=0x%x cdb=%10phN len=0x%x rsp_info=0x%x resid=0x%x fw_resid=0x%x sp=%p cp=%p.\n",
3496	comp_status, scsi_status, res, vha->host_no,	3496	comp_status, scsi_status, res, vha->host_no,
3497	cp->device->id, cp->device->lun, fcport->d_id.b.domain,	3497	cp->device->id, cp->device->lun, fcport->d_id.b.domain,

drivers/scsi/ses.c+1−1

@@ -118,7 +118,7 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code, · 117 unmodified lines
118	static int ses_send_diag(struct scsi_device *sdev, int page_code,	118	static int ses_send_diag(struct scsi_device *sdev, int page_code,
119	void *buf, int bufflen)	119	void *buf, int bufflen)
120	{	120	{
121	u32 result;	121	int result;
122		122
123	unsigned char cmd[] = {	123	unsigned char cmd[] = {
124	SEND_DIAGNOSTIC,	124	SEND_DIAGNOSTIC,

drivers/scsi/ufs/ufshcd.c+1−2

@@ -318,8 +318,7 @@ static void ufshcd_add_query_upiu_trace(struct ufs_hba *hba, · 317 unmodified lines
318	static void ufshcd_add_tm_upiu_trace(struct ufs_hba *hba, unsigned int tag,	318	static void ufshcd_add_tm_upiu_trace(struct ufs_hba *hba, unsigned int tag,
319	enum ufs_trace_str_t str_t)	319	enum ufs_trace_str_t str_t)
320	{	320	{
321	int off = (int)tag - hba->nutrs;	321	struct utp_task_req_desc *descp = &hba->utmrdl_base_addr[tag];
322	struct utp_task_req_desc *descp = &hba->utmrdl_base_addr[off];
323		322
324	if (!trace_ufshcd_upiu_enabled())	323	if (!trace_ufshcd_upiu_enabled())
325	return;	324	return;

drivers/scsi/virtio_scsi.c+2−2

@@ -300,7 +300,7 @@ static void virtscsi_handle_transport_reset(struct virtio_scsi *vscsi, · 299 unmodified lines
300	}	300	}
301	break;	301	break;
302	default:	302	default:
303	pr_info("Unsupport virtio scsi event reason %x\n", event->reason);	303	pr_info("Unsupported virtio scsi event reason %x\n", event->reason);
304	}	304	}
305	}	305	}
306		306
@@ -392,7 +392,7 @@ static void virtscsi_handle_event(struct work_struct *work) · 85 unmodified lines
392	virtscsi_handle_param_change(vscsi, event);	392	virtscsi_handle_param_change(vscsi, event);
393	break;	393	break;
394	default:	394	default:
395	pr_err("Unsupport virtio scsi event %x\n", event->event);	395	pr_err("Unsupported virtio scsi event %x\n", event->event);
396	}	396	}
397	virtscsi_kick_event(vscsi, event_node);	397	virtscsi_kick_event(vscsi, event_node);
398	}	398	}

drivers/staging/media/hantro/hantro_drv.c+1−1

@@ -919,7 +919,7 @@ static int hantro_probe(struct platform_device *pdev) · 918 unmodified lines
919	if (!vpu->variant->irqs[i].handler)	919	if (!vpu->variant->irqs[i].handler)
920	continue;	920	continue;
921		921
922	if (vpu->variant->num_clocks > 1) {	922	if (vpu->variant->num_irqs > 1) {
923	irq_name = vpu->variant->irqs[i].name;	923	irq_name = vpu->variant->irqs[i].name;
924	irq = platform_get_irq_byname(vpu->pdev, irq_name);	924	irq = platform_get_irq_byname(vpu->pdev, irq_name);
925	} else {	925	} else {

drivers/staging/media/sunxi/cedrus/cedrus_video.c+1−1

@@ -135,7 +135,7 @@ void cedrus_prepare_format(struct v4l2_pix_format *pix_fmt) · 134 unmodified lines
135	sizeimage = bytesperline * height;	135	sizeimage = bytesperline * height;
136		136
137	/* Chroma plane size. */	137	/* Chroma plane size. */
138	sizeimage += bytesperline * height / 2;	138	sizeimage += bytesperline * ALIGN(height, 64) / 2;
139		139
140	break;	140	break;
141		141

drivers/vdpa/mlx5/net/mlx5_vnet.c+5−0

 	struct mlx5_vdpa_net *ndev = to_mlx5_vdpa_ndev(mvdev);
 	struct mlx5_vdpa_virtqueue *mvq;
+	if (!mvdev->actual_features)
+		return;
 	if (!is_index_valid(mvdev, idx))
 		return;
 	for (i = 0; i < ndev->mvdev.max_vqs; i++)
 		ndev->vqs[i].ready = false;
+	ndev->mvdev.cvq.ready = false;
 }
 static void mlx5_vdpa_set_status(struct vdpa_device *vdev, u8 status)

drivers/vdpa/vdpa_user/vduse_dev.c+5−5

@@ -665,13 +665,11 @@ static void vduse_vdpa_set_config(struct vdpa_device *vdpa, unsigned int offset, · 664 unmodified lines
665	static int vduse_vdpa_reset(struct vdpa_device *vdpa)	665	static int vduse_vdpa_reset(struct vdpa_device *vdpa)
666	{	666	{
667	struct vduse_dev *dev = vdpa_to_vduse(vdpa);	667	struct vduse_dev *dev = vdpa_to_vduse(vdpa);
668		668	int ret = vduse_dev_set_status(dev, 0);
669	if (vduse_dev_set_status(dev, 0))
670	return -EIO;
671		669
672	vduse_dev_reset(dev);	670	vduse_dev_reset(dev);
673		671
674	return 0;	672	return ret;
675	}	673	}
676		674
677	static u32 vduse_vdpa_get_generation(struct vdpa_device *vdpa)	675	static u32 vduse_vdpa_get_generation(struct vdpa_device *vdpa)
@@ -1593,8 +1591,10 @@ static int vduse_init(void) · 915 unmodified lines
1593		1591
1594	vduse_irq_wq = alloc_workqueue("vduse-irq",	1592	vduse_irq_wq = alloc_workqueue("vduse-irq",
1595	WQ_HIGHPRI \| WQ_SYSFS \| WQ_UNBOUND, 0);	1593	WQ_HIGHPRI \| WQ_SYSFS \| WQ_UNBOUND, 0);
1596	if (!vduse_irq_wq)	1594	if (!vduse_irq_wq) {
		1595	ret = -ENOMEM;
1597	goto err_wq;	1596	goto err_wq;
		1597	}
1598		1598
1599	ret = vduse_domain_init();	1599	ret = vduse_domain_init();
1600	if (ret)	1600	if (ret)

drivers/vfio/pci/vfio_pci_core.c+1−1

@@ -565,7 +565,7 @@ static bool vfio_pci_dev_below_slot(struct pci_dev pdev, struct pci_slot slot) · 564 unmodified lines
565	}	565	}
566		566
567	struct vfio_pci_walk_info {	567	struct vfio_pci_walk_info {
568	int (fn)(struct pci_dev , void *data);	568	int (fn)(struct pci_dev pdev, void *data);
569	void *data;	569	void *data;
570	struct pci_dev *pdev;	570	struct pci_dev *pdev;
571	bool slot;	571	bool slot;

drivers/vhost/vdpa.c+1−1

@@ -640,7 +640,7 @@ static int vhost_vdpa_va_map(struct vhost_vdpa *v, · 639 unmodified lines
640	u64 offset, map_size, map_iova = iova;	640	u64 offset, map_size, map_iova = iova;
641	struct vdpa_map_file *map_file;	641	struct vdpa_map_file *map_file;
642	struct vm_area_struct *vma;	642	struct vm_area_struct *vma;
643	int ret;	643	int ret = 0;
644		644
645	mmap_read_lock(dev->mm);	645	mmap_read_lock(dev->mm);
646		646

drivers/virtio/virtio.c+6−1

 	ret = snprintf(compat, sizeof(compat), "virtio,device%x", dev->id.device);
 	BUG_ON(ret >= sizeof(compat));
+	/*
+	 * On powerpc/pseries virtio devices are PCI devices so PCI
+	 * vendor/device ids play the role of the "compatible" property.
+	 * Simply don't init of_node in this case.
+	 */
 	if (!of_device_is_compatible(np, compat)) {
-		ret = -EINVAL;
+		ret = 0;
 		goto out;
 	}

drivers/watchdog/Kconfig+1−1

@@ -1666,7 +1666,7 @@ config WDT_MTX1 · 1665 unmodified lines
1666		1666
1667	config SIBYTE_WDOG	1667	config SIBYTE_WDOG
1668	tristate "Sibyte SoC hardware watchdog"	1668	tristate "Sibyte SoC hardware watchdog"
1669	depends on CPU_SB1 \|\| (MIPS && COMPILE_TEST)	1669	depends on CPU_SB1
1670	help	1670	help
1671	Watchdog driver for the built in watchdog hardware in Sibyte	1671	Watchdog driver for the built in watchdog hardware in Sibyte
1672	SoC processors. There are apparently two watchdog timers	1672	SoC processors. There are apparently two watchdog timers

fs/binfmt_elf.c+1−1

@@ -630,7 +630,7 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, · 629 unmodified lines
630		630
631	vaddr = eppnt->p_vaddr;	631	vaddr = eppnt->p_vaddr;
632	if (interp_elf_ex->e_type == ET_EXEC \|\| load_addr_set)	632	if (interp_elf_ex->e_type == ET_EXEC \|\| load_addr_set)
633	elf_type \|= MAP_FIXED_NOREPLACE;	633	elf_type \|= MAP_FIXED;
634	else if (no_base && interp_elf_ex->e_type == ET_DYN)	634	else if (no_base && interp_elf_ex->e_type == ET_DYN)
635	load_addr = -vaddr;	635	load_addr = -vaddr;
636		636

fs/debugfs/inode.c+1−1

@@ -528,7 +528,7 @@ void debugfs_create_file_size(const char *name, umode_t mode, · 527 unmodified lines
528	{	528	{
529	struct dentry *de = debugfs_create_file(name, mode, parent, data, fops);	529	struct dentry *de = debugfs_create_file(name, mode, parent, data, fops);
530		530
531	if (de)	531	if (!IS_ERR(de))
532	d_inode(de)->i_size = file_size;	532	d_inode(de)->i_size = file_size;
533	}	533	}
534	EXPORT_SYMBOL_GPL(debugfs_create_file_size);	534	EXPORT_SYMBOL_GPL(debugfs_create_file_size);

fs/ext4/dir.c+3−3

@@ -551,7 +551,7 @@ static int ext4_dx_readdir(struct file file, struct dir_context ctx) · 550 unmodified lines
551	struct dir_private_info *info = file->private_data;	551	struct dir_private_info *info = file->private_data;
552	struct inode *inode = file_inode(file);	552	struct inode *inode = file_inode(file);
553	struct fname *fname;	553	struct fname *fname;
554	int ret;	554	int ret = 0;
555		555
556	if (!info) {	556	if (!info) {
557	info = ext4_htree_create_dir_info(file, ctx->pos);	557	info = ext4_htree_create_dir_info(file, ctx->pos);
@@ -599,7 +599,7 @@ static int ext4_dx_readdir(struct file file, struct dir_context ctx) · 41 unmodified lines
599	info->curr_minor_hash,	599	info->curr_minor_hash,
600	&info->next_hash);	600	&info->next_hash);
601	if (ret < 0)	601	if (ret < 0)
602	return ret;	602	goto finished;
603	if (ret == 0) {	603	if (ret == 0) {
604	ctx->pos = ext4_get_htree_eof(file);	604	ctx->pos = ext4_get_htree_eof(file);
605	break;	605	break;
@@ -630,7 +630,7 @@ static int ext4_dx_readdir(struct file file, struct dir_context ctx) · 24 unmodified lines
630	}	630	}
631	finished:	631	finished:
632	info->last_pos = ctx->pos;	632	info->last_pos = ctx->pos;
633	return 0;	633	return ret < 0 ? ret : 0;
634	}	634	}
635		635
636	static int ext4_release_dir(struct inode inode, struct file filp)	636	static int ext4_release_dir(struct inode inode, struct file filp)

fs/ext4/ext4.h+0−3

 					   unsigned flags,
 					   struct page **pagep,
 					   void **fsdata);
-extern int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos,
-					 unsigned len, unsigned copied,
-					 struct page *page);
 extern int ext4_try_add_inline_entry(handle_t *handle,
 				     struct ext4_filename *fname,
 				     struct inode *dir, struct inode *inode);

fs/ext4/extents.c+14−5

@@ -5916,7 +5916,7 @@ void ext4_ext_replay_shrink_inode(struct inode *inode, ext4_lblk_t end) · 5915 unmodified lines
5916	}	5916	}
5917		5917
5918	/* Check if cur is a hole and if it is, skip it /	5918	/* Check if cur is a hole and if it is, skip it /
5919	static void skip_hole(struct inode inode, ext4_lblk_t cur)	5919	static int skip_hole(struct inode inode, ext4_lblk_t cur)
5920	{	5920	{
5921	int ret;	5921	int ret;
5922	struct ext4_map_blocks map;	5922	struct ext4_map_blocks map;
@@ -5925,9 +5925,12 @@ static void skip_hole(struct inode inode, ext4_lblk_t cur) · 2 unmodified lines
5925	map.m_len = ((inode->i_size) >> inode->i_sb->s_blocksize_bits) - *cur;	5925	map.m_len = ((inode->i_size) >> inode->i_sb->s_blocksize_bits) - *cur;
5926		5926
5927	ret = ext4_map_blocks(NULL, inode, &map, 0);	5927	ret = ext4_map_blocks(NULL, inode, &map, 0);
		5928	if (ret < 0)
		5929	return ret;
5928	if (ret != 0)	5930	if (ret != 0)
5929	return;	5931	return 0;
5930	cur = cur + map.m_len;	5932	cur = cur + map.m_len;
		5933	return 0;
5931	}	5934	}
5932		5935
5933	/* Count number of blocks used by this inode and update i_blocks */	5936	/* Count number of blocks used by this inode and update i_blocks */
@@ -5976,7 +5979,9 @@ int ext4_ext_replay_set_iblocks(struct inode *inode) · 42 unmodified lines
5976	* iblocks by total number of differences found.	5979	* iblocks by total number of differences found.
5977	*/	5980	*/
5978	cur = 0;	5981	cur = 0;
5979	skip_hole(inode, &cur);	5982	ret = skip_hole(inode, &cur);
		5983	if (ret < 0)
		5984	goto out;
5980	path = ext4_find_extent(inode, cur, NULL, 0);	5985	path = ext4_find_extent(inode, cur, NULL, 0);
5981	if (IS_ERR(path))	5986	if (IS_ERR(path))
5982	goto out;	5987	goto out;
@@ -5995,8 +6000,12 @@ int ext4_ext_replay_set_iblocks(struct inode *inode) · 12 unmodified lines
5995	}	6000	}
5996	cur = max(cur + 1, le32_to_cpu(ex->ee_block) +	6001	cur = max(cur + 1, le32_to_cpu(ex->ee_block) +
5997	ext4_ext_get_actual_len(ex));	6002	ext4_ext_get_actual_len(ex));
5998	skip_hole(inode, &cur);	6003	ret = skip_hole(inode, &cur);
5999		6004	if (ret < 0) {
		6005	ext4_ext_drop_refs(path);
		6006	kfree(path);
		6007	break;
		6008	}
6000	path2 = ext4_find_extent(inode, cur, NULL, 0);	6009	path2 = ext4_find_extent(inode, cur, NULL, 0);
6001	if (IS_ERR(path2)) {	6010	if (IS_ERR(path2)) {
6002	ext4_ext_drop_refs(path);	6011	ext4_ext_drop_refs(path);

fs/ext4/fast_commit.c+6−0

 					    sizeof(lrange), (u8 *)&lrange, crc))
 				return -ENOSPC;
 		} else {
+			unsigned int max = (map.m_flags & EXT4_MAP_UNWRITTEN) ?
+				EXT_UNWRITTEN_MAX_LEN : EXT_INIT_MAX_LEN;
+			/* Limit the number of blocks in one extent */
+			map.m_len = min(max, map.m_len);
 			fc_ext.fc_ino = cpu_to_le32(inode->i_ino);
 			ex = (struct ext4_extent *)&fc_ext.fc_ex;
 			ex->ee_block = cpu_to_le32(map.m_lblk);

fs/ext4/inline.c+85−65

 #include <linux/iomap.h>
 #include <linux/fiemap.h>
 #include <linux/iversion.h>
+#include <linux/backing-dev.h>
 #include "ext4_jbd2.h"
 #include "ext4.h"
 int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
 			       unsigned copied, struct page *page)
 {
-	int ret, no_expand;
+	handle_t *handle = ext4_journal_current_handle();
+	int no_expand;
 	void *kaddr;
 	struct ext4_iloc iloc;
+	int ret = 0, ret2;
+	if (unlikely(copied < len) && !PageUptodate(page))
+		copied = 0;
-	if (unlikely(copied < len)) {
+	if (likely(copied)) {
-		if (!PageUptodate(page)) {
+		ret = ext4_get_inode_loc(inode, &iloc);
-			copied = 0;
+		if (ret) {
+			unlock_page(page);
+			put_page(page);
+			ext4_std_error(inode->i_sb, ret);
 			goto out;
 		}
-	}
+		ext4_write_lock_xattr(inode, &no_expand);
+		BUG_ON(!ext4_has_inline_data(inode));
-	ret = ext4_get_inode_loc(inode, &iloc);
+		/*
-	if (ret) {
+		 * ei->i_inline_off may have changed since
-		ext4_std_error(inode->i_sb, ret);
+		 * ext4_write_begin() called
-		copied = 0;
+		 * ext4_try_to_write_inline_data()
-		goto out;
+		 */
-	}
+		(void) ext4_find_inline_data_nolock(inode);
-	ext4_write_lock_xattr(inode, &no_expand);
+		kaddr = kmap_atomic(page);
-	BUG_ON(!ext4_has_inline_data(inode));
+		ext4_write_inline_data(inode, &iloc, kaddr, pos, copied);
+		kunmap_atomic(kaddr);
+		SetPageUptodate(page);
+		/* clear page dirty so that writepages wouldn't work for us. */
+		ClearPageDirty(page);
-	/*
+		ext4_write_unlock_xattr(inode, &no_expand);
-	 * ei->i_inline_off may have changed since ext4_write_begin()
+		brelse(iloc.bh);
-	 * called ext4_try_to_write_inline_data()
-	 */
-	(void) ext4_find_inline_data_nolock(inode);
-	kaddr = kmap_atomic(page);
+		/*
-	ext4_write_inline_data(inode, &iloc, kaddr, pos, len);
+		 * It's important to update i_size while still holding page
-	kunmap_atomic(kaddr);
+		 * lock: page writeout could otherwise come in and zero
-	SetPageUptodate(page);
+		 * beyond i_size.
-	/* clear page dirty so that writepages wouldn't work for us. */
+		 */
-	ClearPageDirty(page);
+		ext4_update_inode_size(inode, pos + copied);
+	}
+	unlock_page(page);
+	put_page(page);
-	ext4_write_unlock_xattr(inode, &no_expand);
+	/*
-	brelse(iloc.bh);
+	 * Don't mark the inode dirty under page lock. First, it unnecessarily
-	mark_inode_dirty(inode);
+	 * makes the holding time of page lock longer. Second, it forces lock
+	 * ordering of page lock and transaction start for journaling
+	 * filesystems.
+	 */
+	if (likely(copied))
+		mark_inode_dirty(inode);
 out:
-	return copied;
+	/*
+	 * If we didn't copy as much data as expected, we need to trim back
+	 * size of xattr containing inline data.
+	 */
+	if (pos + len > inode->i_size && ext4_can_truncate(inode))
+		ext4_orphan_add(handle, inode);
+	ret2 = ext4_journal_stop(handle);
+	if (!ret)
+		ret = ret2;
+	if (pos + len > inode->i_size) {
+		ext4_truncate_failed_write(inode);
+		/*
+		 * If truncate failed early the inode might still be
+		 * on the orphan list; we need to make sure the inode
+		 * is removed from the orphan list in that case.
+		 */
+		if (inode->i_nlink)
+			ext4_orphan_del(NULL, inode);
+	}
+	return ret ? ret : copied;
 }
 struct buffer_head *
 	return ret;
 }
-int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos,
-				  unsigned len, unsigned copied,
-				  struct page *page)
-{
-	int ret;
-	ret = ext4_write_inline_data_end(inode, pos, len, copied, page);
-	if (ret < 0) {
-		unlock_page(page);
-		put_page(page);
-		return ret;
-	}
-	copied = ret;
-	/*
-	 * No need to use i_size_read() here, the i_size
-	 * cannot change under us because we hold i_mutex.
-	 *
-	 * But it's important to update i_size while still holding page lock:
-	 * page writeout could otherwise come in and zero beyond i_size.
-	 */
-	if (pos+copied > inode->i_size)
-		i_size_write(inode, pos+copied);
-	unlock_page(page);
-	put_page(page);
-	/*
-	 * Don't mark the inode dirty under page lock. First, it unnecessarily
-	 * makes the holding time of page lock longer. Second, it forces lock
-	 * ordering of page lock and transaction start for journaling
-	 * filesystems.
-	 */
-	mark_inode_dirty(inode);
-	return copied;
-}
 #ifdef INLINE_DIR_DEBUG
 void ext4_show_inline_dir(struct inode *dir, struct buffer_head *bh,
 			  void *inline_start, int inline_size)
 	EXT4_I(inode)->i_disksize = i_size;
 	if (i_size < inline_size) {
+		/*
+		 * if there's inline data to truncate and this file was
+		 * converted to extents after that inline data was written,
+		 * the extent status cache must be cleared to avoid leaving
+		 * behind stale delayed allocated extent entries
+		 */
+		if (!ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) {
+retry:
+			err = ext4_es_remove_extent(inode, 0, EXT_MAX_BLOCKS);
+			if (err == -ENOMEM) {
+				cond_resched();
+				congestion_wait(BLK_RW_ASYNC, HZ/50);
+				goto retry;
+			}
+			if (err)
+				goto out_error;
+		}
 		/* Clear the content in the xattr space. */
 		if (inline_size > EXT4_MIN_INLINE_DATA_SIZE) {
 			if ((err = ext4_xattr_ibody_find(inode, &i, &is)) != 0)

fs/ext4/inode.c+59−117

@@ -1284,22 +1284,14 @@ static int ext4_write_end(struct file *file, · 1283 unmodified lines
1284	loff_t old_size = inode->i_size;	1284	loff_t old_size = inode->i_size;
1285	int ret = 0, ret2;	1285	int ret = 0, ret2;
1286	int i_size_changed = 0;	1286	int i_size_changed = 0;
1287	int inline_data = ext4_has_inline_data(inode);
1288	bool verity = ext4_verity_in_progress(inode);	1287	bool verity = ext4_verity_in_progress(inode);
1289		1288
1290	trace_ext4_write_end(inode, pos, len, copied);	1289	trace_ext4_write_end(inode, pos, len, copied);
1291	if (inline_data) {	1290
1292	ret = ext4_write_inline_data_end(inode, pos, len,	1291	if (ext4_has_inline_data(inode))
1293	copied, page);	1292	return ext4_write_inline_data_end(inode, pos, len, copied, page);
1294	if (ret < 0) {	1293
1295	unlock_page(page);	1294	copied = block_write_end(file, mapping, pos, len, copied, page, fsdata);
1296	put_page(page);
1297	goto errout;
1298	}
1299	copied = ret;
1300	} else
1301	copied = block_write_end(file, mapping, pos,
1302	len, copied, page, fsdata);
1303	/*	1295	/*
1304	* it's important to update i_size while still holding page lock:	1296	* it's important to update i_size while still holding page lock:
1305	* page writeout could otherwise come in and zero beyond i_size.	1297	* page writeout could otherwise come in and zero beyond i_size.
@@ -1320,7 +1312,7 @@ static int ext4_write_end(struct file *file, · 14 unmodified lines
1320	* ordering of page lock and transaction start for journaling	1312	* ordering of page lock and transaction start for journaling
1321	* filesystems.	1313	* filesystems.
1322	*/	1314	*/
1323	if (i_size_changed \|\| inline_data)	1315	if (i_size_changed)
1324	ret = ext4_mark_inode_dirty(handle, inode);	1316	ret = ext4_mark_inode_dirty(handle, inode);
1325		1317
1326	if (pos + len > inode->i_size && !verity && ext4_can_truncate(inode))	1318	if (pos + len > inode->i_size && !verity && ext4_can_truncate(inode))
@@ -1329,7 +1321,7 @@ static int ext4_write_end(struct file *file, · 2 unmodified lines
1329	* inode->i_size. So truncate them	1321	* inode->i_size. So truncate them
1330	*/	1322	*/
1331	ext4_orphan_add(handle, inode);	1323	ext4_orphan_add(handle, inode);
1332	errout:	1324
1333	ret2 = ext4_journal_stop(handle);	1325	ret2 = ext4_journal_stop(handle);
1334	if (!ret)	1326	if (!ret)
1335	ret = ret2;	1327	ret = ret2;
@@ -1395,7 +1387,6 @@ static int ext4_journalled_write_end(struct file *file, · 59 unmodified lines
1395	int partial = 0;	1387	int partial = 0;
1396	unsigned from, to;	1388	unsigned from, to;
1397	int size_changed = 0;	1389	int size_changed = 0;
1398	int inline_data = ext4_has_inline_data(inode);
1399	bool verity = ext4_verity_in_progress(inode);	1390	bool verity = ext4_verity_in_progress(inode);
1400		1391
1401	trace_ext4_journalled_write_end(inode, pos, len, copied);	1392	trace_ext4_journalled_write_end(inode, pos, len, copied);
@@ -1404,16 +1395,10 @@ static int ext4_journalled_write_end(struct file *file, · 2 unmodified lines
1404		1395
1405	BUG_ON(!ext4_handle_valid(handle));	1396	BUG_ON(!ext4_handle_valid(handle));
1406		1397
1407	if (inline_data) {	1398	if (ext4_has_inline_data(inode))
1408	ret = ext4_write_inline_data_end(inode, pos, len,	1399	return ext4_write_inline_data_end(inode, pos, len, copied, page);
1409	copied, page);	1400
1410	if (ret < 0) {	1401	if (unlikely(copied < len) && !PageUptodate(page)) {
1411	unlock_page(page);
1412	put_page(page);
1413	goto errout;
1414	}
1415	copied = ret;
1416	} else if (unlikely(copied < len) && !PageUptodate(page)) {
1417	copied = 0;	1402	copied = 0;
1418	ext4_journalled_zero_new_buffers(handle, inode, page, from, to);	1403	ext4_journalled_zero_new_buffers(handle, inode, page, from, to);
1419	} else {	1404	} else {
@@ -1436,7 +1421,7 @@ static int ext4_journalled_write_end(struct file *file, · 16 unmodified lines
1436	if (old_size < pos && !verity)	1421	if (old_size < pos && !verity)
1437	pagecache_isize_extended(inode, old_size, pos);	1422	pagecache_isize_extended(inode, old_size, pos);
1438		1423
1439	if (size_changed \|\| inline_data) {	1424	if (size_changed) {
1440	ret2 = ext4_mark_inode_dirty(handle, inode);	1425	ret2 = ext4_mark_inode_dirty(handle, inode);
1441	if (!ret)	1426	if (!ret)
1442	ret = ret2;	1427	ret = ret2;
@@ -1449,7 +1434,6 @@ static int ext4_journalled_write_end(struct file *file, · 6 unmodified lines
1449	*/	1434	*/
1450	ext4_orphan_add(handle, inode);	1435	ext4_orphan_add(handle, inode);
1451		1436
1452	errout:
1453	ret2 = ext4_journal_stop(handle);	1437	ret2 = ext4_journal_stop(handle);
1454	if (!ret)	1438	if (!ret)
1455	ret = ret2;	1439	ret = ret2;
@@ -1644,6 +1628,7 @@ static int ext4_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk) · 188 unmodified lines
1644	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);	1628	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
1645	int ret;	1629	int ret;
1646	bool allocated = false;	1630	bool allocated = false;
		1631	bool reserved = false;
1647		1632
1648	/*	1633	/*
1649	* If the cluster containing lblk is shared with a delayed,	1634	* If the cluster containing lblk is shared with a delayed,
@@ -1660,6 +1645,7 @@ static int ext4_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk) · 10 unmodified lines
1660	ret = ext4_da_reserve_space(inode);	1645	ret = ext4_da_reserve_space(inode);
1661	if (ret != 0) /* ENOSPC */	1646	if (ret != 0) /* ENOSPC */
1662	goto errout;	1647	goto errout;
		1648	reserved = true;
1663	} else { /* bigalloc */	1649	} else { /* bigalloc */
1664	if (!ext4_es_scan_clu(inode, &ext4_es_is_delonly, lblk)) {	1650	if (!ext4_es_scan_clu(inode, &ext4_es_is_delonly, lblk)) {
1665	if (!ext4_es_scan_clu(inode,	1651	if (!ext4_es_scan_clu(inode,
@@ -1672,6 +1658,7 @@ static int ext4_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk) · 6 unmodified lines
1672	ret = ext4_da_reserve_space(inode);	1658	ret = ext4_da_reserve_space(inode);
1673	if (ret != 0) /* ENOSPC */	1659	if (ret != 0) /* ENOSPC */
1674	goto errout;	1660	goto errout;
		1661	reserved = true;
1675	} else {	1662	} else {
1676	allocated = true;	1663	allocated = true;
1677	}	1664	}
@@ -1682,6 +1669,8 @@ static int ext4_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk) · 4 unmodified lines
1682	}	1669	}
1683		1670
1684	ret = ext4_es_insert_delayed_block(inode, lblk, allocated);	1671	ret = ext4_es_insert_delayed_block(inode, lblk, allocated);
		1672	if (ret && reserved)
		1673	ext4_da_release_space(inode, 1);
1685		1674
1686	errout:	1675	errout:
1687	return ret;	1676	return ret;
@@ -1722,13 +1711,16 @@ static int ext4_da_map_blocks(struct inode *inode, sector_t iblock, · 34 unmodified lines
1722	}	1711	}
1723		1712
1724	/*	1713	/*
1725	* Delayed extent could be allocated by fallocate.	1714	* the buffer head associated with a delayed and not unwritten
1726	* So we need to check it.	1715	* block found in the extent status cache must contain an
		1716	* invalid block number and have its BH_New and BH_Delay bits
		1717	* set, reflecting the state assigned when the block was
		1718	* initially delayed allocated
1727	*/	1719	*/
1728	if (ext4_es_is_delayed(&es) && !ext4_es_is_unwritten(&es)) {	1720	if (ext4_es_is_delonly(&es)) {
1729	map_bh(bh, inode->i_sb, invalid_block);	1721	BUG_ON(bh->b_blocknr != invalid_block);
1730	set_buffer_new(bh);	1722	BUG_ON(!buffer_new(bh));
1731	set_buffer_delay(bh);	1723	BUG_ON(!buffer_delay(bh));
1732	return 0;	1724	return 0;
1733	}	1725	}
1734		1726
@@ -2932,19 +2924,6 @@ static int ext4_nonda_switch(struct super_block *sb) · 1197 unmodified lines
2932	return 0;	2924	return 0;
2933	}	2925	}
2934		2926
2935	/* We always reserve for an inode update; the superblock could be there too */
2936	static int ext4_da_write_credits(struct inode *inode, loff_t pos, unsigned len)
2937	{
2938	if (likely(ext4_has_feature_large_file(inode->i_sb)))
2939	return 1;
2940
2941	if (pos + len <= 0x7fffffffULL)
2942	return 1;
2943
2944	/* We might need to update the superblock to set LARGE_FILE */
2945	return 2;
2946	}
2947
2948	static int ext4_da_write_begin(struct file file, struct address_space mapping,	2927	static int ext4_da_write_begin(struct file file, struct address_space mapping,
2949	loff_t pos, unsigned len, unsigned flags,	2928	loff_t pos, unsigned len, unsigned flags,
2950	struct page pagep, void fsdata)	2929	struct page pagep, void fsdata)
@@ -2953,7 +2932,6 @@ static int ext4_da_write_begin(struct file file, struct address_space mapping, · 2 unmodified lines
2953	struct page *page;	2932	struct page *page;
2954	pgoff_t index;	2933	pgoff_t index;
2955	struct inode *inode = mapping->host;	2934	struct inode *inode = mapping->host;
2956	handle_t *handle;
2957		2935
2958	if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb))))	2936	if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb))))
2959	return -EIO;	2937	return -EIO;
@@ -2979,41 +2957,11 @@ static int ext4_da_write_begin(struct file file, struct address_space mapping, · 19 unmodified lines
2979	return 0;	2957	return 0;
2980	}	2958	}
2981		2959
2982	/*	2960	retry:
2983	* grab_cache_page_write_begin() can take a long time if the
2984	* system is thrashing due to memory pressure, or if the page
2985	* is being written back. So grab it first before we start
2986	* the transaction handle. This also allows us to allocate
2987	* the page (if needed) without using GFP_NOFS.
2988	*/
2989	retry_grab:
2990	page = grab_cache_page_write_begin(mapping, index, flags);	2961	page = grab_cache_page_write_begin(mapping, index, flags);
2991	if (!page)	2962	if (!page)
2992	return -ENOMEM;	2963	return -ENOMEM;
2993	unlock_page(page);
2994		2964
2995	/*
2996	* With delayed allocation, we don't log the i_disksize update
2997	* if there is delayed block allocation. But we still need
2998	* to journalling the i_disksize update if writes to the end
2999	* of file which has an already mapped buffer.
3000	*/
3001	retry_journal:
3002	handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE,
3003	ext4_da_write_credits(inode, pos, len));
3004	if (IS_ERR(handle)) {
3005	put_page(page);
3006	return PTR_ERR(handle);
3007	}
3008
3009	lock_page(page);
3010	if (page->mapping != mapping) {
3011	/* The page got truncated from under us */
3012	unlock_page(page);
3013	put_page(page);
3014	ext4_journal_stop(handle);
3015	goto retry_grab;
3016	}
3017	/* In case writeback began while the page was unlocked */	2965	/* In case writeback began while the page was unlocked */
3018	wait_for_stable_page(page);	2966	wait_for_stable_page(page);
3019		2967
@@ -3025,20 +2973,18 @@ retry_journal: · 5 unmodified lines
3025	#endif	2973	#endif
3026	if (ret < 0) {	2974	if (ret < 0) {
3027	unlock_page(page);	2975	unlock_page(page);
3028	ext4_journal_stop(handle);	2976	put_page(page);
3029	/*	2977	/*
3030	* block_write_begin may have instantiated a few blocks	2978	* block_write_begin may have instantiated a few blocks
3031	* outside i_size. Trim these off again. Don't need	2979	* outside i_size. Trim these off again. Don't need
3032	* i_size_read because we hold i_mutex.	2980	* i_size_read because we hold inode lock.
3033	*/	2981	*/
3034	if (pos + len > inode->i_size)	2982	if (pos + len > inode->i_size)
3035	ext4_truncate_failed_write(inode);	2983	ext4_truncate_failed_write(inode);
3036		2984
3037	if (ret == -ENOSPC &&	2985	if (ret == -ENOSPC &&
3038	ext4_should_retry_alloc(inode->i_sb, &retries))	2986	ext4_should_retry_alloc(inode->i_sb, &retries))
3039	goto retry_journal;	2987	goto retry;
3040
3041	put_page(page);
3042	return ret;	2988	return ret;
3043	}	2989	}
3044		2990
@@ -3075,8 +3021,6 @@ static int ext4_da_write_end(struct file *file, · 30 unmodified lines
3075	struct page page, void fsdata)	3021	struct page page, void fsdata)
3076	{	3022	{
3077	struct inode *inode = mapping->host;	3023	struct inode *inode = mapping->host;
3078	int ret = 0, ret2;
3079	handle_t *handle = ext4_journal_current_handle();
3080	loff_t new_i_size;	3024	loff_t new_i_size;
3081	unsigned long start, end;	3025	unsigned long start, end;
3082	int write_mode = (int)(unsigned long)fsdata;	3026	int write_mode = (int)(unsigned long)fsdata;
@@ -3086,44 +3030,36 @@ static int ext4_da_write_end(struct file *file, · 3 unmodified lines
3086	len, copied, page, fsdata);	3030	len, copied, page, fsdata);
3087		3031
3088	trace_ext4_da_write_end(inode, pos, len, copied);	3032	trace_ext4_da_write_end(inode, pos, len, copied);
		3033
		3034	if (write_mode != CONVERT_INLINE_DATA &&
		3035	ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) &&
		3036	ext4_has_inline_data(inode))
		3037	return ext4_write_inline_data_end(inode, pos, len, copied, page);
		3038
3089	start = pos & (PAGE_SIZE - 1);	3039	start = pos & (PAGE_SIZE - 1);
3090	end = start + copied - 1;	3040	end = start + copied - 1;
3091		3041
3092	/*	3042	/*
3093	* generic_write_end() will run mark_inode_dirty() if i_size	3043	* Since we are holding inode lock, we are sure i_disksize <=
3094	* changes. So let's piggyback the i_disksize mark_inode_dirty	3044	* i_size. We also know that if i_disksize < i_size, there are
3095	* into that.	3045	* delalloc writes pending in the range upto i_size. If the end of
		3046	* the current write is <= i_size, there's no need to touch
		3047	* i_disksize since writeback will push i_disksize upto i_size
		3048	* eventually. If the end of the current write is > i_size and
		3049	* inside an allocated block (ext4_da_should_update_i_disksize()
		3050	* check), we need to update i_disksize here as neither
		3051	* ext4_writepage() nor certain ext4_writepages() paths not
		3052	* allocating blocks update i_disksize.
		3053	*
		3054	* Note that we defer inode dirtying to generic_write_end() /
		3055	* ext4_da_write_inline_data_end().
3096	*/	3056	*/
3097	new_i_size = pos + copied;	3057	new_i_size = pos + copied;
3098	if (copied && new_i_size > EXT4_I(inode)->i_disksize) {	3058	if (copied && new_i_size > inode->i_size &&
3099	if (ext4_has_inline_data(inode) \|\|	3059	ext4_da_should_update_i_disksize(page, end))
3100	ext4_da_should_update_i_disksize(page, end)) {	3060	ext4_update_i_disksize(inode, new_i_size);
3101	ext4_update_i_disksize(inode, new_i_size);
3102	/* We need to mark inode dirty even if
3103	* new_i_size is less that inode->i_size
3104	* bu greater than i_disksize.(hint delalloc)
3105	*/
3106	ret = ext4_mark_inode_dirty(handle, inode);
3107	}
3108	}
3109		3061
3110	if (write_mode != CONVERT_INLINE_DATA &&	3062	return generic_write_end(file, mapping, pos, len, copied, page, fsdata);
3111	ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) &&
3112	ext4_has_inline_data(inode))
3113	ret2 = ext4_da_write_inline_data_end(inode, pos, len, copied,
3114	page);
3115	else
3116	ret2 = generic_write_end(file, mapping, pos, len, copied,
3117	page, fsdata);
3118
3119	copied = ret2;
3120	if (ret2 < 0)
3121	ret = ret2;
3122	ret2 = ext4_journal_stop(handle);
3123	if (unlikely(ret2 && !ret))
3124	ret = ret2;
3125
3126	return ret ? ret : copied;
3127	}	3063	}
3128		3064
3129	/*	3065	/*
@@ -4340,6 +4276,12 @@ static int __ext4_get_inode_loc(struct super_block *sb, unsigned long ino, · 1210 unmodified lines
4340	goto has_buffer;	4276	goto has_buffer;
4341		4277
4342	lock_buffer(bh);	4278	lock_buffer(bh);
		4279	if (ext4_buffer_uptodate(bh)) {
		4280	/* Someone brought it uptodate while we waited */
		4281	unlock_buffer(bh);
		4282	goto has_buffer;
		4283	}
		4284
4343	/*	4285	/*
4344	* If we have all information of the inode in memory and this	4286	* If we have all information of the inode in memory and this
4345	* is the only valid inode in the block, we need not read the	4287	* is the only valid inode in the block, we need not read the

fs/ext4/super.c+15−6

@@ -658,7 +658,7 @@ static void ext4_handle_error(struct super_block *sb, bool force_ro, int error, · 657 unmodified lines
658	* constraints, it may not be safe to do it right here so we	658	* constraints, it may not be safe to do it right here so we
659	* defer superblock flushing to a workqueue.	659	* defer superblock flushing to a workqueue.
660	*/	660	*/
661	if (continue_fs)	661	if (continue_fs && journal)
662	schedule_work(&EXT4_SB(sb)->s_error_work);	662	schedule_work(&EXT4_SB(sb)->s_error_work);
663	else	663	else
664	ext4_commit_super(sb);	664	ext4_commit_super(sb);
@@ -1350,6 +1350,12 @@ static void ext4_destroy_inode(struct inode *inode) · 685 unmodified lines
1350	true);	1350	true);
1351	dump_stack();	1351	dump_stack();
1352	}	1352	}
		1353
		1354	if (EXT4_I(inode)->i_reserved_data_blocks)
		1355	ext4_msg(inode->i_sb, KERN_ERR,
		1356	"Inode %lu (%p): i_reserved_data_blocks (%u) not cleared!",
		1357	inode->i_ino, EXT4_I(inode),
		1358	EXT4_I(inode)->i_reserved_data_blocks);
1353	}	1359	}
1354		1360
1355	static void init_once(void *foo)	1361	static void init_once(void *foo)
@@ -3021,17 +3027,17 @@ static loff_t ext4_max_size(int blkbits, int has_huge_files) · 1665 unmodified lines
3021	*/	3027	*/
3022	static loff_t ext4_max_bitmap_size(int bits, int has_huge_files)	3028	static loff_t ext4_max_bitmap_size(int bits, int has_huge_files)
3023	{	3029	{
3024	loff_t res = EXT4_NDIR_BLOCKS;	3030	unsigned long long upper_limit, res = EXT4_NDIR_BLOCKS;
3025	int meta_blocks;	3031	int meta_blocks;
3026	loff_t upper_limit;	3032
3027	/* This is calculated to be the largest file size for a dense, block	3033	/*
		3034	* This is calculated to be the largest file size for a dense, block
3028	* mapped file such that the file's total number of 512-byte sectors,	3035	* mapped file such that the file's total number of 512-byte sectors,
3029	* including data and all indirect blocks, does not exceed (2^48 - 1).	3036	* including data and all indirect blocks, does not exceed (2^48 - 1).
3030	*	3037	*
3031	* __u32 i_blocks_lo and _u16 i_blocks_high represent the total	3038	* __u32 i_blocks_lo and _u16 i_blocks_high represent the total
3032	* number of 512-byte sectors of the file.	3039	* number of 512-byte sectors of the file.
3033	*/	3040	*/
3034
3035	if (!has_huge_files) {	3041	if (!has_huge_files) {
3036	/*	3042	/*
3037	* !has_huge_files or implies that the inode i_block field	3043	* !has_huge_files or implies that the inode i_block field
@@ -3074,7 +3080,7 @@ static loff_t ext4_max_bitmap_size(int bits, int has_huge_files) · 36 unmodified lines
3074	if (res > MAX_LFS_FILESIZE)	3080	if (res > MAX_LFS_FILESIZE)
3075	res = MAX_LFS_FILESIZE;	3081	res = MAX_LFS_FILESIZE;
3076		3082
3077	return res;	3083	return (loff_t)res;
3078	}	3084	}
3079		3085
3080	static ext4_fsblk_t descriptor_loc(struct super_block *sb,	3086	static ext4_fsblk_t descriptor_loc(struct super_block *sb,
@@ -5042,12 +5048,15 @@ failed_mount_wq: · 1961 unmodified lines
5042	sbi->s_ea_block_cache = NULL;	5048	sbi->s_ea_block_cache = NULL;
5043		5049
5044	if (sbi->s_journal) {	5050	if (sbi->s_journal) {
		5051	/* flush s_error_work before journal destroy. */
		5052	flush_work(&sbi->s_error_work);
5045	jbd2_journal_destroy(sbi->s_journal);	5053	jbd2_journal_destroy(sbi->s_journal);
5046	sbi->s_journal = NULL;	5054	sbi->s_journal = NULL;
5047	}	5055	}
5048	failed_mount3a:	5056	failed_mount3a:
5049	ext4_es_unregister_shrinker(sbi);	5057	ext4_es_unregister_shrinker(sbi);
5050	failed_mount3:	5058	failed_mount3:
		5059	/* flush s_error_work before sbi destroy */
5051	flush_work(&sbi->s_error_work);	5060	flush_work(&sbi->s_error_work);
5052	del_timer_sync(&sbi->s_err_report);	5061	del_timer_sync(&sbi->s_err_report);
5053	ext4_stop_mmpd(sbi);	5062	ext4_stop_mmpd(sbi);

fs/io-wq.c+1−4

 			if (!get_signal(&ksig))
 				continue;
-			if (fatal_signal_pending(current) ||
+			break;
-			    signal_group_exit(current->signal))
-				break;
-			continue;
 		}
 		last_timeout = !ret;
 	}

fs/io_uring.c+2−15

 		struct wait_queue_head	cq_wait;
 		unsigned		cq_extra;
 		atomic_t		cq_timeouts;
-		struct fasync_struct	*cq_fasync;
 		unsigned		cq_last_tm_flush;
 	} ____cacheline_aligned_in_smp;
 		wake_up(&ctx->sq_data->wait);
 	if (io_should_trigger_evfd(ctx))
 		eventfd_signal(ctx->cq_ev_fd, 1);
-	if (waitqueue_active(&ctx->poll_wait)) {
+	if (waitqueue_active(&ctx->poll_wait))
 		wake_up_interruptible(&ctx->poll_wait);
-		kill_fasync(&ctx->cq_fasync, SIGIO, POLL_IN);
-	}
 }
 static void io_cqring_ev_posted_iopoll(struct io_ring_ctx *ctx)
 	}
 	if (io_should_trigger_evfd(ctx))
 		eventfd_signal(ctx->cq_ev_fd, 1);
-	if (waitqueue_active(&ctx->poll_wait)) {
+	if (waitqueue_active(&ctx->poll_wait))
 		wake_up_interruptible(&ctx->poll_wait);
-		kill_fasync(&ctx->cq_fasync, SIGIO, POLL_IN);
-	}
 }
 /* Returns true if there are no backlogged entries after the flush */
 	return mask;
 }
-static int io_uring_fasync(int fd, struct file *file, int on)
-{
-	struct io_ring_ctx *ctx = file->private_data;
-	return fasync_helper(fd, file, on, &ctx->cq_fasync);
-}
 static int io_unregister_personality(struct io_ring_ctx *ctx, unsigned id)
 {
 	const struct cred *creds;
 	.mmap_capabilities = io_uring_nommu_mmap_capabilities,
 #endif
 	.poll		= io_uring_poll,
-	.fasync		= io_uring_fasync,
 #ifdef CONFIG_PROC_FS
 	.show_fdinfo	= io_uring_show_fdinfo,
 #endif

fs/kernfs/dir.c+7−2

 		if (!inode)
 			inode = ERR_PTR(-ENOMEM);
 	}
-	/* Needed only for negative dentry validation */
+	/*
-	if (!inode)
+	 * Needed for negative dentry validation.
+	 * The negative dentry can be created in kernfs_iop_lookup()
+	 * or transforms from positive dentry in dentry_unlink_inode()
+	 * called from vfs_rmdir().
+	 */
+	if (!IS_ERR(inode))
 		kernfs_set_rev(parent, dentry);
 	up_read(&kernfs_rwsem);

fs/ksmbd/auth.c+0−205

@@ -68,125 +68,6 @@ void ksmbd_copy_gss_neg_header(void *buf) · 67 unmodified lines
68	memcpy(buf, NEGOTIATE_GSS_HEADER, AUTH_GSS_LENGTH);	68	memcpy(buf, NEGOTIATE_GSS_HEADER, AUTH_GSS_LENGTH);
69	}	69	}
70		70
71	static void
72	str_to_key(unsigned char str, unsigned char key)
73	{
74	int i;
75
76	key[0] = str[0] >> 1;
77	key[1] = ((str[0] & 0x01) << 6) \| (str[1] >> 2);
78	key[2] = ((str[1] & 0x03) << 5) \| (str[2] >> 3);
79	key[3] = ((str[2] & 0x07) << 4) \| (str[3] >> 4);
80	key[4] = ((str[3] & 0x0F) << 3) \| (str[4] >> 5);
81	key[5] = ((str[4] & 0x1F) << 2) \| (str[5] >> 6);
82	key[6] = ((str[5] & 0x3F) << 1) \| (str[6] >> 7);
83	key[7] = str[6] & 0x7F;
84	for (i = 0; i < 8; i++)
85	key[i] = (key[i] << 1);
86	}
87
88	static int
89	smbhash(unsigned char out, const unsigned char in, unsigned char *key)
90	{
91	unsigned char key2[8];
92	struct des_ctx ctx;
93
94	if (fips_enabled) {
95	ksmbd_debug(AUTH, "FIPS compliance enabled: DES not permitted\n");
96	return -ENOENT;
97	}
98
99	str_to_key(key, key2);
100	des_expand_key(&ctx, key2, DES_KEY_SIZE);
101	des_encrypt(&ctx, out, in);
102	memzero_explicit(&ctx, sizeof(ctx));
103	return 0;
104	}
105
106	static int ksmbd_enc_p24(unsigned char p21, const unsigned char c8, unsigned char *p24)
107	{
108	int rc;
109
110	rc = smbhash(p24, c8, p21);
111	if (rc)
112	return rc;
113	rc = smbhash(p24 + 8, c8, p21 + 7);
114	if (rc)
115	return rc;
116	return smbhash(p24 + 16, c8, p21 + 14);
117	}
118
119	/* produce a md4 message digest from data of length n bytes */
120	static int ksmbd_enc_md4(unsigned char md4_hash, unsigned char link_str,
121	int link_len)
122	{
123	int rc;
124	struct ksmbd_crypto_ctx *ctx;
125
126	ctx = ksmbd_crypto_ctx_find_md4();
127	if (!ctx) {
128	ksmbd_debug(AUTH, "Crypto md4 allocation error\n");
129	return -ENOMEM;
130	}
131
132	rc = crypto_shash_init(CRYPTO_MD4(ctx));
133	if (rc) {
134	ksmbd_debug(AUTH, "Could not init md4 shash\n");
135	goto out;
136	}
137
138	rc = crypto_shash_update(CRYPTO_MD4(ctx), link_str, link_len);
139	if (rc) {
140	ksmbd_debug(AUTH, "Could not update with link_str\n");
141	goto out;
142	}
143
144	rc = crypto_shash_final(CRYPTO_MD4(ctx), md4_hash);
145	if (rc)
146	ksmbd_debug(AUTH, "Could not generate md4 hash\n");
147	out:
148	ksmbd_release_crypto_ctx(ctx);
149	return rc;
150	}
151
152	static int ksmbd_enc_update_sess_key(unsigned char md5_hash, char nonce,
153	char *server_challenge, int len)
154	{
155	int rc;
156	struct ksmbd_crypto_ctx *ctx;
157
158	ctx = ksmbd_crypto_ctx_find_md5();
159	if (!ctx) {
160	ksmbd_debug(AUTH, "Crypto md5 allocation error\n");
161	return -ENOMEM;
162	}
163
164	rc = crypto_shash_init(CRYPTO_MD5(ctx));
165	if (rc) {
166	ksmbd_debug(AUTH, "Could not init md5 shash\n");
167	goto out;
168	}
169
170	rc = crypto_shash_update(CRYPTO_MD5(ctx), server_challenge, len);
171	if (rc) {
172	ksmbd_debug(AUTH, "Could not update with challenge\n");
173	goto out;
174	}
175
176	rc = crypto_shash_update(CRYPTO_MD5(ctx), nonce, len);
177	if (rc) {
178	ksmbd_debug(AUTH, "Could not update with nonce\n");
179	goto out;
180	}
181
182	rc = crypto_shash_final(CRYPTO_MD5(ctx), md5_hash);
183	if (rc)
184	ksmbd_debug(AUTH, "Could not generate md5 hash\n");
185	out:
186	ksmbd_release_crypto_ctx(ctx);
187	return rc;
188	}
189
190	/**	71	/**
191	* ksmbd_gen_sess_key() - function to generate session key	72	* ksmbd_gen_sess_key() - function to generate session key
192	* @sess: session of connection	73	* @sess: session of connection
@@ -324,43 +205,6 @@ out: · 131 unmodified lines
324	return ret;	205	return ret;
325	}	206	}
326		207
327	/**
328	* ksmbd_auth_ntlm() - NTLM authentication handler
329	* @sess: session of connection
330	* @pw_buf: NTLM challenge response
331	* @passkey: user password
332	*
333	* Return: 0 on success, error number on error
334	*/
335	int ksmbd_auth_ntlm(struct ksmbd_session sess, char pw_buf)
336	{
337	int rc;
338	unsigned char p21[21];
339	char key[CIFS_AUTH_RESP_SIZE];
340
341	memset(p21, '\0', 21);
342	memcpy(p21, user_passkey(sess->user), CIFS_NTHASH_SIZE);
343	rc = ksmbd_enc_p24(p21, sess->ntlmssp.cryptkey, key);
344	if (rc) {
345	pr_err("password processing failed\n");
346	return rc;
347	}
348
349	ksmbd_enc_md4(sess->sess_key, user_passkey(sess->user),
350	CIFS_SMB1_SESSKEY_SIZE);
351	memcpy(sess->sess_key + CIFS_SMB1_SESSKEY_SIZE, key,
352	CIFS_AUTH_RESP_SIZE);
353	sess->sequence_number = 1;
354
355	if (strncmp(pw_buf, key, CIFS_AUTH_RESP_SIZE) != 0) {
356	ksmbd_debug(AUTH, "ntlmv1 authentication failed\n");
357	return -EINVAL;
358	}
359
360	ksmbd_debug(AUTH, "ntlmv1 authentication pass\n");
361	return 0;
362	}
363
364	/**	208	/**
365	* ksmbd_auth_ntlmv2() - NTLMv2 authentication handler	209	* ksmbd_auth_ntlmv2() - NTLMv2 authentication handler
366	* @sess: session of connection	210	* @sess: session of connection
@@ -441,44 +285,6 @@ out: · 74 unmodified lines
441	return rc;	285	return rc;
442	}	286	}
443		287
444	/**
445	* __ksmbd_auth_ntlmv2() - NTLM2(extended security) authentication handler
446	* @sess: session of connection
447	* @client_nonce: client nonce from LM response.
448	* @ntlm_resp: ntlm response data from client.
449	*
450	* Return: 0 on success, error number on error
451	*/
452	static int __ksmbd_auth_ntlmv2(struct ksmbd_session sess, char client_nonce,
453	char *ntlm_resp)
454	{
455	char sess_key[CIFS_SMB1_SESSKEY_SIZE] = {0};
456	int rc;
457	unsigned char p21[21];
458	char key[CIFS_AUTH_RESP_SIZE];
459
460	rc = ksmbd_enc_update_sess_key(sess_key,
461	client_nonce,
462	(char *)sess->ntlmssp.cryptkey, 8);
463	if (rc) {
464	pr_err("password processing failed\n");
465	goto out;
466	}
467
468	memset(p21, '\0', 21);
469	memcpy(p21, user_passkey(sess->user), CIFS_NTHASH_SIZE);
470	rc = ksmbd_enc_p24(p21, sess_key, key);
471	if (rc) {
472	pr_err("password processing failed\n");
473	goto out;
474	}
475
476	if (memcmp(ntlm_resp, key, CIFS_AUTH_RESP_SIZE) != 0)
477	rc = -EINVAL;
478	out:
479	return rc;
480	}
481
482	/**	288	/**
483	* ksmbd_decode_ntlmssp_auth_blob() - helper function to construct	289	* ksmbd_decode_ntlmssp_auth_blob() - helper function to construct
484	* authenticate blob	290	* authenticate blob
@@ -512,17 +318,6 @@ int ksmbd_decode_ntlmssp_auth_blob(struct authenticate_message *authblob, · 27 unmodified lines
512	nt_off = le32_to_cpu(authblob->NtChallengeResponse.BufferOffset);	318	nt_off = le32_to_cpu(authblob->NtChallengeResponse.BufferOffset);
513	nt_len = le16_to_cpu(authblob->NtChallengeResponse.Length);	319	nt_len = le16_to_cpu(authblob->NtChallengeResponse.Length);
514		320
515	/* process NTLM authentication */
516	if (nt_len == CIFS_AUTH_RESP_SIZE) {
517	if (le32_to_cpu(authblob->NegotiateFlags) &
518	NTLMSSP_NEGOTIATE_EXTENDED_SEC)
519	return __ksmbd_auth_ntlmv2(sess, (char *)authblob +
520	lm_off, (char *)authblob + nt_off);
521	else
522	return ksmbd_auth_ntlm(sess, (char *)authblob +
523	nt_off);
524	}
525
526	/* TODO : use domain name that imported from configuration file */	321	/* TODO : use domain name that imported from configuration file */
527	domain_name = smb_strndup_from_utf16((const char *)authblob +	322	domain_name = smb_strndup_from_utf16((const char *)authblob +
528	le32_to_cpu(authblob->DomainName.BufferOffset),	323	le32_to_cpu(authblob->DomainName.BufferOffset),

fs/ksmbd/crypto_ctx.c+0−16

@@ -81,12 +81,6 @@ static struct shash_desc *alloc_shash_desc(int id) · 80 unmodified lines
81	case CRYPTO_SHASH_SHA512:	81	case CRYPTO_SHASH_SHA512:
82	tfm = crypto_alloc_shash("sha512", 0, 0);	82	tfm = crypto_alloc_shash("sha512", 0, 0);
83	break;	83	break;
84	case CRYPTO_SHASH_MD4:
85	tfm = crypto_alloc_shash("md4", 0, 0);
86	break;
87	case CRYPTO_SHASH_MD5:
88	tfm = crypto_alloc_shash("md5", 0, 0);
89	break;
90	default:	84	default:
91	return NULL;	85	return NULL;
92	}	86	}
@@ -214,16 +208,6 @@ struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_sha512(void) · 121 unmodified lines
214	return ____crypto_shash_ctx_find(CRYPTO_SHASH_SHA512);	208	return ____crypto_shash_ctx_find(CRYPTO_SHASH_SHA512);
215	}	209	}
216		210
217	struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_md4(void)
218	{
219	return ____crypto_shash_ctx_find(CRYPTO_SHASH_MD4);
220	}
221
222	struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_md5(void)
223	{
224	return ____crypto_shash_ctx_find(CRYPTO_SHASH_MD5);
225	}
226
227	static struct ksmbd_crypto_ctx *____crypto_aead_ctx_find(int id)	211	static struct ksmbd_crypto_ctx *____crypto_aead_ctx_find(int id)
228	{	212	{
229	struct ksmbd_crypto_ctx *ctx;	213	struct ksmbd_crypto_ctx *ctx;

fs/ksmbd/crypto_ctx.h+0−8

 	CRYPTO_SHASH_CMACAES,
 	CRYPTO_SHASH_SHA256,
 	CRYPTO_SHASH_SHA512,
-	CRYPTO_SHASH_MD4,
-	CRYPTO_SHASH_MD5,
 	CRYPTO_SHASH_MAX,
 };
 #define CRYPTO_CMACAES(c)	((c)->desc[CRYPTO_SHASH_CMACAES])
 #define CRYPTO_SHA256(c)	((c)->desc[CRYPTO_SHASH_SHA256])
 #define CRYPTO_SHA512(c)	((c)->desc[CRYPTO_SHASH_SHA512])
-#define CRYPTO_MD4(c)		((c)->desc[CRYPTO_SHASH_MD4])
-#define CRYPTO_MD5(c)		((c)->desc[CRYPTO_SHASH_MD5])
 #define CRYPTO_HMACMD5_TFM(c)	((c)->desc[CRYPTO_SHASH_HMACMD5]->tfm)
 #define CRYPTO_HMACSHA256_TFM(c)\
 #define CRYPTO_CMACAES_TFM(c)	((c)->desc[CRYPTO_SHASH_CMACAES]->tfm)
 #define CRYPTO_SHA256_TFM(c)	((c)->desc[CRYPTO_SHASH_SHA256]->tfm)
 #define CRYPTO_SHA512_TFM(c)	((c)->desc[CRYPTO_SHASH_SHA512]->tfm)
-#define CRYPTO_MD4_TFM(c)	((c)->desc[CRYPTO_SHASH_MD4]->tfm)
-#define CRYPTO_MD5_TFM(c)	((c)->desc[CRYPTO_SHASH_MD5]->tfm)
 #define CRYPTO_GCM(c)		((c)->ccmaes[CRYPTO_AEAD_AES_GCM])
 #define CRYPTO_CCM(c)		((c)->ccmaes[CRYPTO_AEAD_AES_CCM])
 struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_cmacaes(void);
 struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_sha512(void);
 struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_sha256(void);
-struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_md4(void);
-struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_md5(void);
 struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_gcm(void);
 struct ksmbd_crypto_ctx *ksmbd_crypto_ctx_find_ccm(void);
 void ksmbd_crypto_destroy(void);

fs/ksmbd/misc.c+7−10

 {
 	char *ab_pathname;
-	if (strlen(filename) == 0) {
+	if (strlen(filename) == 0)
-		ab_pathname = kmalloc(2, GFP_KERNEL);
+		filename = "\\";
-		ab_pathname[0] = '\\';
-		ab_pathname[1] = '\0';
-	} else {
-		ab_pathname = kstrdup(filename, GFP_KERNEL);
-		if (!ab_pathname)
-			return NULL;
-		ksmbd_conv_path_to_windows(ab_pathname);
+	ab_pathname = kstrdup(filename, GFP_KERNEL);
-	}
+	if (!ab_pathname)
+		return NULL;
+	ksmbd_conv_path_to_windows(ab_pathname);
 	return ab_pathname;
 }

fs/ksmbd/oplock.c+31−10

@@ -1451,26 +1451,47 @@ struct lease_ctx_info parse_lease_state(void open_req) · 1450 unmodified lines
1451	*/	1451	*/
1452	struct create_context smb2_find_context_vals(void open_req, const char *tag)	1452	struct create_context smb2_find_context_vals(void open_req, const char *tag)
1453	{	1453	{
1454	char *data_offset;
1455	struct create_context *cc;	1454	struct create_context *cc;
1456	unsigned int next = 0;	1455	unsigned int next = 0;
1457	char *name;	1456	char *name;
1458	struct smb2_create_req req = (struct smb2_create_req )open_req;	1457	struct smb2_create_req req = (struct smb2_create_req )open_req;
		1458	unsigned int remain_len, name_off, name_len, value_off, value_len,
		1459	cc_len;
1459		1460
1460	data_offset = (char *)req + 4 + le32_to_cpu(req->CreateContextsOffset);	1461	/*
1461	cc = (struct create_context *)data_offset;	1462	* CreateContextsOffset and CreateContextsLength are guaranteed to
		1463	* be valid because of ksmbd_smb2_check_message().
		1464	*/
		1465	cc = (struct create_context )((char )req + 4 +
		1466	le32_to_cpu(req->CreateContextsOffset));
		1467	remain_len = le32_to_cpu(req->CreateContextsLength);
1462	do {	1468	do {
1463	int val;
1464
1465	cc = (struct create_context )((char )cc + next);	1469	cc = (struct create_context )((char )cc + next);
1466	name = le16_to_cpu(cc->NameOffset) + (char *)cc;	1470	if (remain_len < offsetof(struct create_context, Buffer))
1467	val = le16_to_cpu(cc->NameLength);
1468	if (val < 4)
1469	return ERR_PTR(-EINVAL);	1471	return ERR_PTR(-EINVAL);
1470		1472
1471	if (memcmp(name, tag, val) == 0)
1472	return cc;
1473	next = le32_to_cpu(cc->Next);	1473	next = le32_to_cpu(cc->Next);
		1474	name_off = le16_to_cpu(cc->NameOffset);
		1475	name_len = le16_to_cpu(cc->NameLength);
		1476	value_off = le16_to_cpu(cc->DataOffset);
		1477	value_len = le32_to_cpu(cc->DataLength);
		1478	cc_len = next ? next : remain_len;
		1479
		1480	if ((next & 0x7) != 0 \|\|
		1481	next > remain_len \|\|
		1482	name_off != offsetof(struct create_context, Buffer) \|\|
		1483	name_len < 4 \|\|
		1484	name_off + name_len > cc_len \|\|
		1485	(value_off & 0x7) != 0 \|\|
		1486	(value_off && (value_off < name_off + name_len)) \|\|
		1487	((u64)value_off + value_len > cc_len))
		1488	return ERR_PTR(-EINVAL);
		1489
		1490	name = (char *)cc + name_off;
		1491	if (memcmp(name, tag, name_len) == 0)
		1492	return cc;
		1493
		1494	remain_len -= next;
1474	} while (next != 0);	1495	} while (next != 0);
1475		1496
1476	return NULL;	1497	return NULL;

fs/ksmbd/smb2pdu.c+196−60

@@ -459,13 +459,22 @@ static void init_chained_smb2_rsp(struct ksmbd_work *work) · 458 unmodified lines
459	bool is_chained_smb2_message(struct ksmbd_work *work)	459	bool is_chained_smb2_message(struct ksmbd_work *work)
460	{	460	{
461	struct smb2_hdr *hdr = work->request_buf;	461	struct smb2_hdr *hdr = work->request_buf;
462	unsigned int len;	462	unsigned int len, next_cmd;
463		463
464	if (hdr->ProtocolId != SMB2_PROTO_NUMBER)	464	if (hdr->ProtocolId != SMB2_PROTO_NUMBER)
465	return false;	465	return false;
466		466
467	hdr = ksmbd_req_buf_next(work);	467	hdr = ksmbd_req_buf_next(work);
468	if (le32_to_cpu(hdr->NextCommand) > 0) {	468	next_cmd = le32_to_cpu(hdr->NextCommand);
		469	if (next_cmd > 0) {
		470	if ((u64)work->next_smb2_rcv_hdr_off + next_cmd +
		471	__SMB2_HEADER_STRUCTURE_SIZE >
		472	get_rfc1002_len(work->request_buf)) {
		473	pr_err("next command(%u) offset exceeds smb msg size\n",
		474	next_cmd);
		475	return false;
		476	}
		477
469	ksmbd_debug(SMB, "got SMB2 chained command\n");	478	ksmbd_debug(SMB, "got SMB2 chained command\n");
470	init_chained_smb2_rsp(work);	479	init_chained_smb2_rsp(work);
471	return true;	480	return true;
@@ -1058,6 +1067,7 @@ int smb2_handle_negotiate(struct ksmbd_work *work) · 586 unmodified lines
1058	struct smb2_negotiate_req *req = work->request_buf;	1067	struct smb2_negotiate_req *req = work->request_buf;
1059	struct smb2_negotiate_rsp *rsp = work->response_buf;	1068	struct smb2_negotiate_rsp *rsp = work->response_buf;
1060	int rc = 0;	1069	int rc = 0;
		1070	unsigned int smb2_buf_len, smb2_neg_size;
1061	__le32 status;	1071	__le32 status;
1062		1072
1063	ksmbd_debug(SMB, "Received negotiate request\n");	1073	ksmbd_debug(SMB, "Received negotiate request\n");
@@ -1075,6 +1085,44 @@ int smb2_handle_negotiate(struct ksmbd_work *work) · 11 unmodified lines
1075	goto err_out;	1085	goto err_out;
1076	}	1086	}
1077		1087
		1088	smb2_buf_len = get_rfc1002_len(work->request_buf);
		1089	smb2_neg_size = offsetof(struct smb2_negotiate_req, Dialects) - 4;
		1090	if (smb2_neg_size > smb2_buf_len) {
		1091	rsp->hdr.Status = STATUS_INVALID_PARAMETER;
		1092	rc = -EINVAL;
		1093	goto err_out;
		1094	}
		1095
		1096	if (conn->dialect == SMB311_PROT_ID) {
		1097	unsigned int nego_ctxt_off = le32_to_cpu(req->NegotiateContextOffset);
		1098
		1099	if (smb2_buf_len < nego_ctxt_off) {
		1100	rsp->hdr.Status = STATUS_INVALID_PARAMETER;
		1101	rc = -EINVAL;
		1102	goto err_out;
		1103	}
		1104
		1105	if (smb2_neg_size > nego_ctxt_off) {
		1106	rsp->hdr.Status = STATUS_INVALID_PARAMETER;
		1107	rc = -EINVAL;
		1108	goto err_out;
		1109	}
		1110
		1111	if (smb2_neg_size + le16_to_cpu(req->DialectCount) * sizeof(__le16) >
		1112	nego_ctxt_off) {
		1113	rsp->hdr.Status = STATUS_INVALID_PARAMETER;
		1114	rc = -EINVAL;
		1115	goto err_out;
		1116	}
		1117	} else {
		1118	if (smb2_neg_size + le16_to_cpu(req->DialectCount) * sizeof(__le16) >
		1119	smb2_buf_len) {
		1120	rsp->hdr.Status = STATUS_INVALID_PARAMETER;
		1121	rc = -EINVAL;
		1122	goto err_out;
		1123	}
		1124	}
		1125
1078	conn->cli_cap = le32_to_cpu(req->Capabilities);	1126	conn->cli_cap = le32_to_cpu(req->Capabilities);
1079	switch (conn->dialect) {	1127	switch (conn->dialect) {
1080	case SMB311_PROT_ID:	1128	case SMB311_PROT_ID:
@@ -2093,16 +2141,22 @@ out: · 1012 unmodified lines
2093	* smb2_set_ea() - handler for setting extended attributes using set	2141	* smb2_set_ea() - handler for setting extended attributes using set
2094	* info command	2142	* info command
2095	* @eabuf: set info command buffer	2143	* @eabuf: set info command buffer
		2144	* @buf_len: set info command buffer length
2096	* @path: dentry path for get ea	2145	* @path: dentry path for get ea
2097	*	2146	*
2098	* Return: 0 on success, otherwise error	2147	* Return: 0 on success, otherwise error
2099	*/	2148	*/
2100	static int smb2_set_ea(struct smb2_ea_info eabuf, struct path path)	2149	static int smb2_set_ea(struct smb2_ea_info *eabuf, unsigned int buf_len,
		2150	struct path *path)
2101	{	2151	{
2102	struct user_namespace *user_ns = mnt_user_ns(path->mnt);	2152	struct user_namespace *user_ns = mnt_user_ns(path->mnt);
2103	char attr_name = NULL, value;	2153	char attr_name = NULL, value;
2104	int rc = 0;	2154	int rc = 0;
2105	int next = 0;	2155	unsigned int next = 0;
		2156
		2157	if (buf_len < sizeof(struct smb2_ea_info) + eabuf->EaNameLength +
		2158	le16_to_cpu(eabuf->EaValueLength))
		2159	return -EINVAL;
2106		2160
2107	attr_name = kmalloc(XATTR_NAME_MAX + 1, GFP_KERNEL);	2161	attr_name = kmalloc(XATTR_NAME_MAX + 1, GFP_KERNEL);
2108	if (!attr_name)	2162	if (!attr_name)
@@ -2167,7 +2221,13 @@ static int smb2_set_ea(struct smb2_ea_info eabuf, struct path path) · 58 unmodified lines
2167		2221
2168	next:	2222	next:
2169	next = le32_to_cpu(eabuf->NextEntryOffset);	2223	next = le32_to_cpu(eabuf->NextEntryOffset);
		2224	if (next == 0 \|\| buf_len < next)
		2225	break;
		2226	buf_len -= next;
2170	eabuf = (struct smb2_ea_info )((char )eabuf + next);	2227	eabuf = (struct smb2_ea_info )((char )eabuf + next);
		2228	if (next < (u32)eabuf->EaNameLength + le16_to_cpu(eabuf->EaValueLength))
		2229	break;
		2230
2171	} while (next != 0);	2231	} while (next != 0);
2172		2232
2173	kfree(attr_name);	2233	kfree(attr_name);
@@ -2367,6 +2427,10 @@ static int smb2_create_sd_buffer(struct ksmbd_work *work, · 193 unmodified lines
2367	ksmbd_debug(SMB,	2427	ksmbd_debug(SMB,
2368	"Set ACLs using SMB2_CREATE_SD_BUFFER context\n");	2428	"Set ACLs using SMB2_CREATE_SD_BUFFER context\n");
2369	sd_buf = (struct create_sd_buf_req *)context;	2429	sd_buf = (struct create_sd_buf_req *)context;
		2430	if (le16_to_cpu(context->DataOffset) +
		2431	le32_to_cpu(context->DataLength) <
		2432	sizeof(struct create_sd_buf_req))
		2433	return -EINVAL;
2370	return set_info_sec(work->conn, work->tcon, path, &sd_buf->ntsd,	2434	return set_info_sec(work->conn, work->tcon, path, &sd_buf->ntsd,
2371	le32_to_cpu(sd_buf->ccontext.DataLength), true);	2435	le32_to_cpu(sd_buf->ccontext.DataLength), true);
2372	}	2436	}
@@ -2561,6 +2625,12 @@ int smb2_open(struct ksmbd_work *work) · 188 unmodified lines
2561	goto err_out1;	2625	goto err_out1;
2562	} else if (context) {	2626	} else if (context) {
2563	ea_buf = (struct create_ea_buf_req *)context;	2627	ea_buf = (struct create_ea_buf_req *)context;
		2628	if (le16_to_cpu(context->DataOffset) +
		2629	le32_to_cpu(context->DataLength) <
		2630	sizeof(struct create_ea_buf_req)) {
		2631	rc = -EINVAL;
		2632	goto err_out1;
		2633	}
2564	if (req->CreateOptions & FILE_NO_EA_KNOWLEDGE_LE) {	2634	if (req->CreateOptions & FILE_NO_EA_KNOWLEDGE_LE) {
2565	rsp->hdr.Status = STATUS_ACCESS_DENIED;	2635	rsp->hdr.Status = STATUS_ACCESS_DENIED;
2566	rc = -EACCES;	2636	rc = -EACCES;
@@ -2599,6 +2669,12 @@ int smb2_open(struct ksmbd_work *work) · 32 unmodified lines
2599	} else if (context) {	2669	} else if (context) {
2600	struct create_posix *posix =	2670	struct create_posix *posix =
2601	(struct create_posix *)context;	2671	(struct create_posix *)context;
		2672	if (le16_to_cpu(context->DataOffset) +
		2673	le32_to_cpu(context->DataLength) <
		2674	sizeof(struct create_posix)) {
		2675	rc = -EINVAL;
		2676	goto err_out1;
		2677	}
2602	ksmbd_debug(SMB, "get posix context\n");	2678	ksmbd_debug(SMB, "get posix context\n");
2603		2679
2604	posix_mode = le32_to_cpu(posix->Mode);	2680	posix_mode = le32_to_cpu(posix->Mode);
@@ -2748,7 +2824,15 @@ int smb2_open(struct ksmbd_work *work) · 143 unmodified lines
2748	created = true;	2824	created = true;
2749	user_ns = mnt_user_ns(path.mnt);	2825	user_ns = mnt_user_ns(path.mnt);
2750	if (ea_buf) {	2826	if (ea_buf) {
2751	rc = smb2_set_ea(&ea_buf->ea, &path);	2827	if (le32_to_cpu(ea_buf->ccontext.DataLength) <
		2828	sizeof(struct smb2_ea_info)) {
		2829	rc = -EINVAL;
		2830	goto err_out;
		2831	}
		2832
		2833	rc = smb2_set_ea(&ea_buf->ea,
		2834	le32_to_cpu(ea_buf->ccontext.DataLength),
		2835	&path);
2752	if (rc == -EOPNOTSUPP)	2836	if (rc == -EOPNOTSUPP)
2753	rc = 0;	2837	rc = 0;
2754	else if (rc)	2838	else if (rc)
@@ -2981,9 +3065,16 @@ int smb2_open(struct ksmbd_work *work) · 226 unmodified lines
2981	rc = PTR_ERR(az_req);	3065	rc = PTR_ERR(az_req);
2982	goto err_out;	3066	goto err_out;
2983	} else if (az_req) {	3067	} else if (az_req) {
2984	loff_t alloc_size = le64_to_cpu(az_req->AllocationSize);	3068	loff_t alloc_size;
2985	int err;	3069	int err;
2986		3070
		3071	if (le16_to_cpu(az_req->ccontext.DataOffset) +
		3072	le32_to_cpu(az_req->ccontext.DataLength) <
		3073	sizeof(struct create_alloc_size_req)) {
		3074	rc = -EINVAL;
		3075	goto err_out;
		3076	}
		3077	alloc_size = le64_to_cpu(az_req->AllocationSize);
2987	ksmbd_debug(SMB,	3078	ksmbd_debug(SMB,
2988	"request smb2 create allocate size : %llu\n",	3079	"request smb2 create allocate size : %llu\n",
2989	alloc_size);	3080	alloc_size);
@@ -4152,7 +4243,7 @@ static void get_file_access_info(struct smb2_query_info_rsp *rsp, · 1162 unmodified lines
4152	static int get_file_basic_info(struct smb2_query_info_rsp *rsp,	4243	static int get_file_basic_info(struct smb2_query_info_rsp *rsp,
4153	struct ksmbd_file fp, void rsp_org)	4244	struct ksmbd_file fp, void rsp_org)
4154	{	4245	{
4155	struct smb2_file_all_info *basic_info;	4246	struct smb2_file_basic_info *basic_info;
4156	struct kstat stat;	4247	struct kstat stat;
4157	u64 time;	4248	u64 time;
4158		4249
@@ -4162,7 +4253,7 @@ static int get_file_basic_info(struct smb2_query_info_rsp *rsp, · 3 unmodified lines
4162	return -EACCES;	4253	return -EACCES;
4163	}	4254	}
4164		4255
4165	basic_info = (struct smb2_file_all_info *)rsp->Buffer;	4256	basic_info = (struct smb2_file_basic_info *)rsp->Buffer;
4166	generic_fillattr(file_mnt_user_ns(fp->filp), file_inode(fp->filp),	4257	generic_fillattr(file_mnt_user_ns(fp->filp), file_inode(fp->filp),
4167	&stat);	4258	&stat);
4168	basic_info->CreationTime = cpu_to_le64(fp->create_time);	4259	basic_info->CreationTime = cpu_to_le64(fp->create_time);
@@ -4175,9 +4266,8 @@ static int get_file_basic_info(struct smb2_query_info_rsp *rsp, · 6 unmodified lines
4175	basic_info->Attributes = fp->f_ci->m_fattr;	4266	basic_info->Attributes = fp->f_ci->m_fattr;
4176	basic_info->Pad1 = 0;	4267	basic_info->Pad1 = 0;
4177	rsp->OutputBufferLength =	4268	rsp->OutputBufferLength =
4178	cpu_to_le32(offsetof(struct smb2_file_all_info, AllocationSize));	4269	cpu_to_le32(sizeof(struct smb2_file_basic_info));
4179	inc_rfc1001_len(rsp_org, offsetof(struct smb2_file_all_info,	4270	inc_rfc1001_len(rsp_org, sizeof(struct smb2_file_basic_info));
4180	AllocationSize));
4181	return 0;	4271	return 0;
4182	}	4272	}
4183		4273
@@ -5333,7 +5423,7 @@ out: · 1149 unmodified lines
5333	static int smb2_create_link(struct ksmbd_work *work,	5423	static int smb2_create_link(struct ksmbd_work *work,
5334	struct ksmbd_share_config *share,	5424	struct ksmbd_share_config *share,
5335	struct smb2_file_link_info *file_info,	5425	struct smb2_file_link_info *file_info,
5336	struct file *filp,	5426	unsigned int buf_len, struct file *filp,
5337	struct nls_table *local_nls)	5427	struct nls_table *local_nls)
5338	{	5428	{
5339	char link_name = NULL, target_name = NULL, *pathname = NULL;	5429	char link_name = NULL, target_name = NULL, *pathname = NULL;
@@ -5341,6 +5431,10 @@ static int smb2_create_link(struct ksmbd_work *work, · 1 unmodified line
5341	bool file_present = true;	5431	bool file_present = true;
5342	int rc;	5432	int rc;
5343		5433
		5434	if (buf_len < (u64)sizeof(struct smb2_file_link_info) +
		5435	le32_to_cpu(file_info->FileNameLength))
		5436	return -EINVAL;
		5437
5344	ksmbd_debug(SMB, "setting FILE_LINK_INFORMATION\n");	5438	ksmbd_debug(SMB, "setting FILE_LINK_INFORMATION\n");
5345	pathname = kmalloc(PATH_MAX, GFP_KERNEL);	5439	pathname = kmalloc(PATH_MAX, GFP_KERNEL);
5346	if (!pathname)	5440	if (!pathname)
@@ -5400,10 +5494,10 @@ out: · 53 unmodified lines
5400	return rc;	5494	return rc;
5401	}	5495	}
5402		5496
5403	static int set_file_basic_info(struct ksmbd_file fp, char buf,	5497	static int set_file_basic_info(struct ksmbd_file *fp,
		5498	struct smb2_file_basic_info *file_info,
5404	struct ksmbd_share_config *share)	5499	struct ksmbd_share_config *share)
5405	{	5500	{
5406	struct smb2_file_all_info *file_info;
5407	struct iattr attrs;	5501	struct iattr attrs;
5408	struct timespec64 ctime;	5502	struct timespec64 ctime;
5409	struct file *filp;	5503	struct file *filp;
@@ -5414,7 +5508,6 @@ static int set_file_basic_info(struct ksmbd_file fp, char buf, · 4 unmodified lines
5414	if (!(fp->daccess & FILE_WRITE_ATTRIBUTES_LE))	5508	if (!(fp->daccess & FILE_WRITE_ATTRIBUTES_LE))
5415	return -EACCES;	5509	return -EACCES;
5416		5510
5417	file_info = (struct smb2_file_all_info *)buf;
5418	attrs.ia_valid = 0;	5511	attrs.ia_valid = 0;
5419	filp = fp->filp;	5512	filp = fp->filp;
5420	inode = file_inode(filp);	5513	inode = file_inode(filp);
@@ -5491,7 +5584,8 @@ static int set_file_basic_info(struct ksmbd_file fp, char buf, · 70 unmodified lines
5491	}	5584	}
5492		5585
5493	static int set_file_allocation_info(struct ksmbd_work *work,	5586	static int set_file_allocation_info(struct ksmbd_work *work,
5494	struct ksmbd_file fp, char buf)	5587	struct ksmbd_file *fp,
		5588	struct smb2_file_alloc_info *file_alloc_info)
5495	{	5589	{
5496	/*	5590	/*
5497	* TODO : It's working fine only when store dos attributes	5591	* TODO : It's working fine only when store dos attributes
@@ -5499,7 +5593,6 @@ static int set_file_allocation_info(struct ksmbd_work *work, · 1 unmodified line
5499	* properly with any smb.conf option	5593	* properly with any smb.conf option
5500	*/	5594	*/
5501		5595
5502	struct smb2_file_alloc_info *file_alloc_info;
5503	loff_t alloc_blks;	5596	loff_t alloc_blks;
5504	struct inode *inode;	5597	struct inode *inode;
5505	int rc;	5598	int rc;
@@ -5507,7 +5600,6 @@ static int set_file_allocation_info(struct ksmbd_work *work, · 1 unmodified line
5507	if (!(fp->daccess & FILE_WRITE_DATA_LE))	5600	if (!(fp->daccess & FILE_WRITE_DATA_LE))
5508	return -EACCES;	5601	return -EACCES;
5509		5602
5510	file_alloc_info = (struct smb2_file_alloc_info *)buf;
5511	alloc_blks = (le64_to_cpu(file_alloc_info->AllocationSize) + 511) >> 9;	5603	alloc_blks = (le64_to_cpu(file_alloc_info->AllocationSize) + 511) >> 9;
5512	inode = file_inode(fp->filp);	5604	inode = file_inode(fp->filp);
5513		5605
@@ -5543,9 +5635,8 @@ static int set_file_allocation_info(struct ksmbd_work *work, · 29 unmodified lines
5543	}	5635	}
5544		5636
5545	static int set_end_of_file_info(struct ksmbd_work work, struct ksmbd_file fp,	5637	static int set_end_of_file_info(struct ksmbd_work work, struct ksmbd_file fp,
5546	char *buf)	5638	struct smb2_file_eof_info *file_eof_info)
5547	{	5639	{
5548	struct smb2_file_eof_info *file_eof_info;
5549	loff_t newsize;	5640	loff_t newsize;
5550	struct inode *inode;	5641	struct inode *inode;
5551	int rc;	5642	int rc;
@@ -5553,7 +5644,6 @@ static int set_end_of_file_info(struct ksmbd_work work, struct ksmbd_file fp, · 1 unmodified line
5553	if (!(fp->daccess & FILE_WRITE_DATA_LE))	5644	if (!(fp->daccess & FILE_WRITE_DATA_LE))
5554	return -EACCES;	5645	return -EACCES;
5555		5646
5556	file_eof_info = (struct smb2_file_eof_info *)buf;
5557	newsize = le64_to_cpu(file_eof_info->EndOfFile);	5647	newsize = le64_to_cpu(file_eof_info->EndOfFile);
5558	inode = file_inode(fp->filp);	5648	inode = file_inode(fp->filp);
5559		5649
@@ -5580,7 +5670,8 @@ static int set_end_of_file_info(struct ksmbd_work work, struct ksmbd_file fp, · 20 unmodified lines
5580	}	5670	}
5581		5671
5582	static int set_rename_info(struct ksmbd_work work, struct ksmbd_file fp,	5672	static int set_rename_info(struct ksmbd_work work, struct ksmbd_file fp,
5583	char *buf)	5673	struct smb2_file_rename_info *rename_info,
		5674	unsigned int buf_len)
5584	{	5675	{
5585	struct user_namespace *user_ns;	5676	struct user_namespace *user_ns;
5586	struct ksmbd_file *parent_fp;	5677	struct ksmbd_file *parent_fp;
@@ -5593,6 +5684,10 @@ static int set_rename_info(struct ksmbd_work work, struct ksmbd_file fp, · 6 unmodified lines
5593	return -EACCES;	5684	return -EACCES;
5594	}	5685	}
5595		5686
		5687	if (buf_len < (u64)sizeof(struct smb2_file_rename_info) +
		5688	le32_to_cpu(rename_info->FileNameLength))
		5689	return -EINVAL;
		5690
5596	user_ns = file_mnt_user_ns(fp->filp);	5691	user_ns = file_mnt_user_ns(fp->filp);
5597	if (ksmbd_stream_fd(fp))	5692	if (ksmbd_stream_fd(fp))
5598	goto next;	5693	goto next;
@@ -5615,14 +5710,13 @@ static int set_rename_info(struct ksmbd_work work, struct ksmbd_file fp, · 16 unmodified lines
5615	}	5710	}
5616	}	5711	}
5617	next:	5712	next:
5618	return smb2_rename(work, fp, user_ns,	5713	return smb2_rename(work, fp, user_ns, rename_info,
5619	(struct smb2_file_rename_info *)buf,
5620	work->sess->conn->local_nls);	5714	work->sess->conn->local_nls);
5621	}	5715	}
5622		5716
5623	static int set_file_disposition_info(struct ksmbd_file fp, char buf)	5717	static int set_file_disposition_info(struct ksmbd_file *fp,
		5718	struct smb2_file_disposition_info *file_info)
5624	{	5719	{
5625	struct smb2_file_disposition_info *file_info;
5626	struct inode *inode;	5720	struct inode *inode;
5627		5721
5628	if (!(fp->daccess & FILE_DELETE_LE)) {	5722	if (!(fp->daccess & FILE_DELETE_LE)) {
@@ -5631,7 +5725,6 @@ static int set_file_disposition_info(struct ksmbd_file fp, char buf) · 2 unmodified lines
5631	}	5725	}
5632		5726
5633	inode = file_inode(fp->filp);	5727	inode = file_inode(fp->filp);
5634	file_info = (struct smb2_file_disposition_info *)buf;
5635	if (file_info->DeletePending) {	5728	if (file_info->DeletePending) {
5636	if (S_ISDIR(inode->i_mode) &&	5729	if (S_ISDIR(inode->i_mode) &&
5637	ksmbd_vfs_empty_dir(fp) == -ENOTEMPTY)	5730	ksmbd_vfs_empty_dir(fp) == -ENOTEMPTY)
@@ -5643,15 +5736,14 @@ static int set_file_disposition_info(struct ksmbd_file fp, char buf) · 5 unmodified lines
5643	return 0;	5736	return 0;
5644	}	5737	}
5645		5738
5646	static int set_file_position_info(struct ksmbd_file fp, char buf)	5739	static int set_file_position_info(struct ksmbd_file *fp,
		5740	struct smb2_file_pos_info *file_info)
5647	{	5741	{
5648	struct smb2_file_pos_info *file_info;
5649	loff_t current_byte_offset;	5742	loff_t current_byte_offset;
5650	unsigned long sector_size;	5743	unsigned long sector_size;
5651	struct inode *inode;	5744	struct inode *inode;
5652		5745
5653	inode = file_inode(fp->filp);	5746	inode = file_inode(fp->filp);
5654	file_info = (struct smb2_file_pos_info *)buf;
5655	current_byte_offset = le64_to_cpu(file_info->CurrentByteOffset);	5747	current_byte_offset = le64_to_cpu(file_info->CurrentByteOffset);
5656	sector_size = inode->i_sb->s_blocksize;	5748	sector_size = inode->i_sb->s_blocksize;
5657		5749
@@ -5667,12 +5759,11 @@ static int set_file_position_info(struct ksmbd_file fp, char buf) · 9 unmodified lines
5667	return 0;	5759	return 0;
5668	}	5760	}
5669		5761
5670	static int set_file_mode_info(struct ksmbd_file fp, char buf)	5762	static int set_file_mode_info(struct ksmbd_file *fp,
		5763	struct smb2_file_mode_info *file_info)
5671	{	5764	{
5672	struct smb2_file_mode_info *file_info;
5673	__le32 mode;	5765	__le32 mode;
5674		5766
5675	file_info = (struct smb2_file_mode_info *)buf;
5676	mode = file_info->Mode;	5767	mode = file_info->Mode;
5677		5768
5678	if ((mode & ~FILE_MODE_INFO_MASK) \|\|	5769	if ((mode & ~FILE_MODE_INFO_MASK) \|\|
@@ -5702,40 +5793,74 @@ static int set_file_mode_info(struct ksmbd_file fp, char buf) · 23 unmodified lines
5702	* TODO: need to implement an error handling for STATUS_INFO_LENGTH_MISMATCH	5793	* TODO: need to implement an error handling for STATUS_INFO_LENGTH_MISMATCH
5703	*/	5794	*/
5704	static int smb2_set_info_file(struct ksmbd_work work, struct ksmbd_file fp,	5795	static int smb2_set_info_file(struct ksmbd_work work, struct ksmbd_file fp,
5705	int info_class, char *buf,	5796	struct smb2_set_info_req *req,
5706	struct ksmbd_share_config *share)	5797	struct ksmbd_share_config *share)
5707	{	5798	{
5708	switch (info_class) {	5799	unsigned int buf_len = le32_to_cpu(req->BufferLength);
		5800
		5801	switch (req->FileInfoClass) {
5709	case FILE_BASIC_INFORMATION:	5802	case FILE_BASIC_INFORMATION:
5710	return set_file_basic_info(fp, buf, share);	5803	{
		5804	if (buf_len < sizeof(struct smb2_file_basic_info))
		5805	return -EINVAL;
5711		5806
		5807	return set_file_basic_info(fp, (struct smb2_file_basic_info *)req->Buffer, share);
		5808	}
5712	case FILE_ALLOCATION_INFORMATION:	5809	case FILE_ALLOCATION_INFORMATION:
5713	return set_file_allocation_info(work, fp, buf);	5810	{
		5811	if (buf_len < sizeof(struct smb2_file_alloc_info))
		5812	return -EINVAL;
5714		5813
		5814	return set_file_allocation_info(work, fp,
		5815	(struct smb2_file_alloc_info *)req->Buffer);
		5816	}
5715	case FILE_END_OF_FILE_INFORMATION:	5817	case FILE_END_OF_FILE_INFORMATION:
5716	return set_end_of_file_info(work, fp, buf);	5818	{
		5819	if (buf_len < sizeof(struct smb2_file_eof_info))
		5820	return -EINVAL;
5717		5821
		5822	return set_end_of_file_info(work, fp,
		5823	(struct smb2_file_eof_info *)req->Buffer);
		5824	}
5718	case FILE_RENAME_INFORMATION:	5825	case FILE_RENAME_INFORMATION:
		5826	{
5719	if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {	5827	if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
5720	ksmbd_debug(SMB,	5828	ksmbd_debug(SMB,
5721	"User does not have write permission\n");	5829	"User does not have write permission\n");
5722	return -EACCES;	5830	return -EACCES;
5723	}	5831	}
5724	return set_rename_info(work, fp, buf);
5725		5832
		5833	if (buf_len < sizeof(struct smb2_file_rename_info))
		5834	return -EINVAL;
		5835
		5836	return set_rename_info(work, fp,
		5837	(struct smb2_file_rename_info *)req->Buffer,
		5838	buf_len);
		5839	}
5726	case FILE_LINK_INFORMATION:	5840	case FILE_LINK_INFORMATION:
		5841	{
		5842	if (buf_len < sizeof(struct smb2_file_link_info))
		5843	return -EINVAL;
		5844
5727	return smb2_create_link(work, work->tcon->share_conf,	5845	return smb2_create_link(work, work->tcon->share_conf,
5728	(struct smb2_file_link_info *)buf, fp->filp,	5846	(struct smb2_file_link_info *)req->Buffer,
		5847	buf_len, fp->filp,
5729	work->sess->conn->local_nls);	5848	work->sess->conn->local_nls);
5730		5849	}
5731	case FILE_DISPOSITION_INFORMATION:	5850	case FILE_DISPOSITION_INFORMATION:
		5851	{
5732	if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {	5852	if (!test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE)) {
5733	ksmbd_debug(SMB,	5853	ksmbd_debug(SMB,
5734	"User does not have write permission\n");	5854	"User does not have write permission\n");
5735	return -EACCES;	5855	return -EACCES;
5736	}	5856	}
5737	return set_file_disposition_info(fp, buf);
5738		5857
		5858	if (buf_len < sizeof(struct smb2_file_disposition_info))
		5859	return -EINVAL;
		5860
		5861	return set_file_disposition_info(fp,
		5862	(struct smb2_file_disposition_info *)req->Buffer);
		5863	}
5739	case FILE_FULL_EA_INFORMATION:	5864	case FILE_FULL_EA_INFORMATION:
5740	{	5865	{
5741	if (!(fp->daccess & FILE_WRITE_EA_LE)) {	5866	if (!(fp->daccess & FILE_WRITE_EA_LE)) {
@@ -5744,18 +5869,29 @@ static int smb2_set_info_file(struct ksmbd_work work, struct ksmbd_file fp, · 2 unmodified lines
5744	return -EACCES;	5869	return -EACCES;
5745	}	5870	}
5746		5871
5747	return smb2_set_ea((struct smb2_ea_info *)buf,	5872	if (buf_len < sizeof(struct smb2_ea_info))
5748	&fp->filp->f_path);	5873	return -EINVAL;
5749	}
5750		5874
		5875	return smb2_set_ea((struct smb2_ea_info *)req->Buffer,
		5876	buf_len, &fp->filp->f_path);
		5877	}
5751	case FILE_POSITION_INFORMATION:	5878	case FILE_POSITION_INFORMATION:
5752	return set_file_position_info(fp, buf);	5879	{
		5880	if (buf_len < sizeof(struct smb2_file_pos_info))
		5881	return -EINVAL;
5753		5882
		5883	return set_file_position_info(fp, (struct smb2_file_pos_info *)req->Buffer);
		5884	}
5754	case FILE_MODE_INFORMATION:	5885	case FILE_MODE_INFORMATION:
5755	return set_file_mode_info(fp, buf);	5886	{
		5887	if (buf_len < sizeof(struct smb2_file_mode_info))
		5888	return -EINVAL;
		5889
		5890	return set_file_mode_info(fp, (struct smb2_file_mode_info *)req->Buffer);
		5891	}
5756	}	5892	}
5757		5893
5758	pr_err("Unimplemented Fileinfoclass :%d\n", info_class);	5894	pr_err("Unimplemented Fileinfoclass :%d\n", req->FileInfoClass);
5759	return -EOPNOTSUPP;	5895	return -EOPNOTSUPP;
5760	}	5896	}
5761		5897
@@ -5816,8 +5952,7 @@ int smb2_set_info(struct ksmbd_work *work) · 54 unmodified lines
5816	switch (req->InfoType) {	5952	switch (req->InfoType) {
5817	case SMB2_O_INFO_FILE:	5953	case SMB2_O_INFO_FILE:
5818	ksmbd_debug(SMB, "GOT SMB2_O_INFO_FILE\n");	5954	ksmbd_debug(SMB, "GOT SMB2_O_INFO_FILE\n");
5819	rc = smb2_set_info_file(work, fp, req->FileInfoClass,	5955	rc = smb2_set_info_file(work, fp, req, work->tcon->share_conf);
5820	req->Buffer, work->tcon->share_conf);
5821	break;	5956	break;
5822	case SMB2_O_INFO_SECURITY:	5957	case SMB2_O_INFO_SECURITY:
5823	ksmbd_debug(SMB, "GOT SMB2_O_INFO_SECURITY\n");	5958	ksmbd_debug(SMB, "GOT SMB2_O_INFO_SECURITY\n");
@@ -8171,7 +8306,8 @@ void smb3_preauth_hash_rsp(struct ksmbd_work *work) · 2347 unmodified lines
8171		8306
8172	WORK_BUFFERS(work, req, rsp);	8307	WORK_BUFFERS(work, req, rsp);
8173		8308
8174	if (le16_to_cpu(req->Command) == SMB2_NEGOTIATE_HE)	8309	if (le16_to_cpu(req->Command) == SMB2_NEGOTIATE_HE &&
		8310	conn->preauth_info)
8175	ksmbd_gen_preauth_integrity_hash(conn, (char *)rsp,	8311	ksmbd_gen_preauth_integrity_hash(conn, (char *)rsp,
8176	conn->preauth_info->Preauth_HashValue);	8312	conn->preauth_info->Preauth_HashValue);
8177		8313
@@ -8278,16 +8414,8 @@ int smb3_decrypt_req(struct ksmbd_work *work) · 100 unmodified lines
8278	unsigned int buf_data_size = pdu_length + 4 -	8414	unsigned int buf_data_size = pdu_length + 4 -
8279	sizeof(struct smb2_transform_hdr);	8415	sizeof(struct smb2_transform_hdr);
8280	struct smb2_transform_hdr tr_hdr = (struct smb2_transform_hdr )buf;	8416	struct smb2_transform_hdr tr_hdr = (struct smb2_transform_hdr )buf;
8281	unsigned int orig_len = le32_to_cpu(tr_hdr->OriginalMessageSize);
8282	int rc = 0;	8417	int rc = 0;
8283		8418
8284	sess = ksmbd_session_lookup_all(conn, le64_to_cpu(tr_hdr->SessionId));
8285	if (!sess) {
8286	pr_err("invalid session id(%llx) in transform header\n",
8287	le64_to_cpu(tr_hdr->SessionId));
8288	return -ECONNABORTED;
8289	}
8290
8291	if (pdu_length + 4 <	8419	if (pdu_length + 4 <
8292	sizeof(struct smb2_transform_hdr) + sizeof(struct smb2_hdr)) {	8420	sizeof(struct smb2_transform_hdr) + sizeof(struct smb2_hdr)) {
8293	pr_err("Transform message is too small (%u)\n",	8421	pr_err("Transform message is too small (%u)\n",
@@ -8295,11 +8423,19 @@ int smb3_decrypt_req(struct ksmbd_work *work) · 1 unmodified line
8295	return -ECONNABORTED;	8423	return -ECONNABORTED;
8296	}	8424	}
8297		8425
8298	if (pdu_length + 4 < orig_len + sizeof(struct smb2_transform_hdr)) {	8426	if (pdu_length + 4 <
		8427	le32_to_cpu(tr_hdr->OriginalMessageSize) + sizeof(struct smb2_transform_hdr)) {
8299	pr_err("Transform message is broken\n");	8428	pr_err("Transform message is broken\n");
8300	return -ECONNABORTED;	8429	return -ECONNABORTED;
8301	}	8430	}
8302		8431
		8432	sess = ksmbd_session_lookup_all(conn, le64_to_cpu(tr_hdr->SessionId));
		8433	if (!sess) {
		8434	pr_err("invalid session id(%llx) in transform header\n",
		8435	le64_to_cpu(tr_hdr->SessionId));
		8436	return -ECONNABORTED;
		8437	}
		8438
8303	iov[0].iov_base = buf;	8439	iov[0].iov_base = buf;
8304	iov[0].iov_len = sizeof(struct smb2_transform_hdr);	8440	iov[0].iov_len = sizeof(struct smb2_transform_hdr);
8305	iov[1].iov_base = buf + sizeof(struct smb2_transform_hdr);	8441	iov[1].iov_base = buf + sizeof(struct smb2_transform_hdr);

fs/ksmbd/smb2pdu.h+9−0

@@ -1464,6 +1464,15 @@ struct smb2_file_all_info { /* data block encoding of response to level 18 */ · 1463 unmodified lines
1464	char FileName[1];	1464	char FileName[1];
1465	} __packed; /* level 18 Query */	1465	} __packed; /* level 18 Query */
1466		1466
		1467	struct smb2_file_basic_info { /* data block encoding of response to level 18 */
		1468	__le64 CreationTime; /* Beginning of FILE_BASIC_INFO equivalent */
		1469	__le64 LastAccessTime;
		1470	__le64 LastWriteTime;
		1471	__le64 ChangeTime;
		1472	__le32 Attributes;
		1473	__u32 Pad1; /* End of FILE_BASIC_INFO_INFO equivalent */
		1474	} __packed;
		1475
1467	struct smb2_file_alt_name_info {	1476	struct smb2_file_alt_name_info {
1468	__le32 FileNameLength;	1477	__le32 FileNameLength;
1469	char FileName[0];	1478	char FileName[0];

fs/ksmbd/smb_common.c+28−19

  */
 bool ksmbd_smb_request(struct ksmbd_conn *conn)
 {
-	int type = *(char *)conn->request_buf;
+	return conn->request_buf[0] == 0;
-	switch (type) {
-	case RFC1002_SESSION_MESSAGE:
-		/* Regular SMB request */
-		return true;
-	case RFC1002_SESSION_KEEP_ALIVE:
-		ksmbd_debug(SMB, "RFC 1002 session keep alive\n");
-		break;
-	default:
-		ksmbd_debug(SMB, "RFC 1002 unknown request type 0x%x\n", type);
-	}
-	return false;
 }
 static bool supported_protocol(int idx)
 		idx <= server_conf.max_protocol);
 }
-static char *next_dialect(char *dialect, int *next_off)
+static char *next_dialect(char *dialect, int *next_off, int bcount)
 {
 	dialect = dialect + *next_off;
-	*next_off = strlen(dialect);
+	*next_off = strnlen(dialect, bcount);
+	if (dialect[*next_off] != '\0')
+		return NULL;
 	return dialect;
 }
 		dialect = cli_dialects;
 		bcount = le16_to_cpu(byte_count);
 		do {
-			dialect = next_dialect(dialect, &next);
+			dialect = next_dialect(dialect, &next, bcount);
+			if (!dialect)
+				break;
 			ksmbd_debug(SMB, "client requested dialect %s\n",
 				    dialect);
 			if (!strcmp(dialect, smb1_protos[i].name)) {
 static int ksmbd_negotiate_smb_dialect(void *buf)
 {
-	__le32 proto;
+	int smb_buf_length = get_rfc1002_len(buf);
+	__le32 proto = ((struct smb2_hdr *)buf)->ProtocolId;
-	proto = ((struct smb2_hdr *)buf)->ProtocolId;
 	if (proto == SMB2_PROTO_NUMBER) {
 		struct smb2_negotiate_req *req;
+		int smb2_neg_size =
+			offsetof(struct smb2_negotiate_req, Dialects) - 4;
 		req = (struct smb2_negotiate_req *)buf;
+		if (smb2_neg_size > smb_buf_length)
+			goto err_out;
+		if (smb2_neg_size + le16_to_cpu(req->DialectCount) * sizeof(__le16) >
+		    smb_buf_length)
+			goto err_out;
 		return ksmbd_lookup_dialect_by_id(req->Dialects,
 						  req->DialectCount);
 	}
 		struct smb_negotiate_req *req;
 		req = (struct smb_negotiate_req *)buf;
+		if (le16_to_cpu(req->ByteCount) < 2)
+			goto err_out;
+		if (offsetof(struct smb_negotiate_req, DialectsArray) - 4 +
+			le16_to_cpu(req->ByteCount) > smb_buf_length) {
+			goto err_out;
+		}
 		return ksmbd_lookup_dialect_by_name(req->DialectsArray,
 						    req->ByteCount);
 	}
+err_out:
 	return BAD_PROT_ID;
 }

fs/ksmbd/smb_common.h+0−8

@@ -48,14 +48,6 @@ · 47 unmodified lines
48	#define CIFS_DEFAULT_IOSIZE (64 * 1024)	48	#define CIFS_DEFAULT_IOSIZE (64 * 1024)
49	#define MAX_CIFS_SMALL_BUFFER_SIZE 448 /* big enough for most */	49	#define MAX_CIFS_SMALL_BUFFER_SIZE 448 /* big enough for most */
50		50
51	/* RFC 1002 session packet types */
52	#define RFC1002_SESSION_MESSAGE 0x00
53	#define RFC1002_SESSION_REQUEST 0x81
54	#define RFC1002_POSITIVE_SESSION_RESPONSE 0x82
55	#define RFC1002_NEGATIVE_SESSION_RESPONSE 0x83
56	#define RFC1002_RETARGET_SESSION_RESPONSE 0x84
57	#define RFC1002_SESSION_KEEP_ALIVE 0x85
58
59	/* Responses when opening a file. */	51	/* Responses when opening a file. */
60	#define F_SUPERSEDED 0	52	#define F_SUPERSEDED 0
61	#define F_OPENED 1	53	#define F_OPENED 1

fs/ksmbd/smbacl.c+19−2

 {
 	int i, ret;
 	int num_aces = 0;
-	int acl_size;
+	unsigned int acl_size;
 	char *acl_base;
 	struct smb_ace **ppace;
 	struct posix_acl_entry *cf_pace, *cf_pdace;
 		return;
 	/* validate that we do not go past end of acl */
-	if (end_of_acl <= (char *)pdacl ||
+	if (end_of_acl < (char *)pdacl + sizeof(struct smb_acl) ||
 	    end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) {
 		pr_err("ACL too small to parse DACL\n");
 		return;
 	 * user/group/other have no permissions
 	 */
 	for (i = 0; i < num_aces; ++i) {
+		if (end_of_acl - acl_base < acl_size)
+			break;
 		ppace[i] = (struct smb_ace *)(acl_base + acl_size);
 		acl_base = (char *)ppace[i];
+		acl_size = offsetof(struct smb_ace, sid) +
+			offsetof(struct smb_sid, sub_auth);
+		if (end_of_acl - acl_base < acl_size ||
+		    ppace[i]->sid.num_subauth > SID_MAX_SUB_AUTHORITIES ||
+		    (end_of_acl - acl_base <
+		     acl_size + sizeof(__le32) * ppace[i]->sid.num_subauth) ||
+		    (le16_to_cpu(ppace[i]->size) <
+		     acl_size + sizeof(__le32) * ppace[i]->sid.num_subauth))
+			break;
 		acl_size = le16_to_cpu(ppace[i]->size);
 		ppace[i]->access_req =
 			smb_map_generic_desired_access(ppace[i]->access_req);
 	if (!pntsd)
 		return -EIO;
+	if (acl_len < sizeof(struct smb_ntsd))
+		return -EINVAL;
 	owner_sid_ptr = (struct smb_sid *)((char *)pntsd +
 			le32_to_cpu(pntsd->osidoffset));
 	group_sid_ptr = (struct smb_sid *)((char *)pntsd +

fs/ksmbd/transport_tcp.c+2−2

@@ -215,7 +215,7 @@ out_error: · 214 unmodified lines
215	* ksmbd_kthread_fn() - listen to new SMB connections and callback server	215	* ksmbd_kthread_fn() - listen to new SMB connections and callback server
216	* @p: arguments to forker thread	216	* @p: arguments to forker thread
217	*	217	*
218	* Return: Returns a task_struct or ERR_PTR	218	* Return: 0 on success, error number otherwise
219	*/	219	*/
220	static int ksmbd_kthread_fn(void *p)	220	static int ksmbd_kthread_fn(void *p)
221	{	221	{
@@ -387,7 +387,7 @@ static void tcp_destroy_socket(struct socket *ksmbd_socket) · 165 unmodified lines
387	/**	387	/**
388	* create_socket - create socket for ksmbd/0	388	* create_socket - create socket for ksmbd/0
389	*	389	*
390	* Return: Returns a task_struct or ERR_PTR	390	* Return: 0 on success, error number otherwise
391	*/	391	*/
392	static int create_socket(struct interface *iface)	392	static int create_socket(struct interface *iface)
393	{	393	{

fs/vboxsf/super.c+2−10

 #define VBOXSF_SUPER_MAGIC 0x786f4256 /* 'VBox' little endian */
-#define VBSF_MOUNT_SIGNATURE_BYTE_0 ('\000')
+static const unsigned char VBSF_MOUNT_SIGNATURE[4] = "\000\377\376\375";
-#define VBSF_MOUNT_SIGNATURE_BYTE_1 ('\377')
-#define VBSF_MOUNT_SIGNATURE_BYTE_2 ('\376')
-#define VBSF_MOUNT_SIGNATURE_BYTE_3 ('\375')
 static int follow_symlinks;
 module_param(follow_symlinks, int, 0444);
 static int vboxsf_parse_monolithic(struct fs_context *fc, void *data)
 {
-	unsigned char *options = data;
+	if (data && !memcmp(data, VBSF_MOUNT_SIGNATURE, 4)) {
-	if (options && options[0] == VBSF_MOUNT_SIGNATURE_BYTE_0 &&
-		       options[1] == VBSF_MOUNT_SIGNATURE_BYTE_1 &&
-		       options[2] == VBSF_MOUNT_SIGNATURE_BYTE_2 &&
-		       options[3] == VBSF_MOUNT_SIGNATURE_BYTE_3) {
 		vbg_err("vboxsf: Old binary mount data not supported, remove obsolete mount.vboxsf and/or update your VBoxService.\n");
 		return -EINVAL;
 	}

fs/verity/enable.c+1−1

@@ -177,7 +177,7 @@ static int build_merkle_tree(struct file *filp, · 176 unmodified lines
177	* (level 0) and ascending to the root node (level 'num_levels - 1').	177	* (level 0) and ascending to the root node (level 'num_levels - 1').
178	* Then at the end (level 'num_levels'), calculate the root hash.	178	* Then at the end (level 'num_levels'), calculate the root hash.
179	*/	179	*/
180	blocks = (inode->i_size + params->block_size - 1) >>	180	blocks = ((u64)inode->i_size + params->block_size - 1) >>
181	params->log_blocksize;	181	params->log_blocksize;
182	for (level = 0; level <= params->num_levels; level++) {	182	for (level = 0; level <= params->num_levels; level++) {
183	err = build_merkle_tree_level(filp, level, blocks, params,	183	err = build_merkle_tree_level(filp, level, blocks, params,

fs/verity/open.c+1−1

@@ -89,7 +89,7 @@ int fsverity_init_merkle_tree_params(struct merkle_tree_params *params, · 88 unmodified lines
89	*/	89	*/
90		90
91	/* Compute number of levels and the number of blocks in each level */	91	/* Compute number of levels and the number of blocks in each level */
92	blocks = (inode->i_size + params->block_size - 1) >> log_blocksize;	92	blocks = ((u64)inode->i_size + params->block_size - 1) >> log_blocksize;
93	pr_debug("Data is %lld bytes (%llu blocks)\n", inode->i_size, blocks);	93	pr_debug("Data is %lld bytes (%llu blocks)\n", inode->i_size, blocks);
94	while (blocks > 1) {	94	while (blocks > 1) {
95	if (params->num_levels >= FS_VERITY_MAX_LEVELS) {	95	if (params->num_levels >= FS_VERITY_MAX_LEVELS) {

include/kvm/arm_pmu.h+0−3

 int kvm_arm_pmu_v3_has_attr(struct kvm_vcpu *vcpu,
 			    struct kvm_device_attr *attr);
 int kvm_arm_pmu_v3_enable(struct kvm_vcpu *vcpu);
-int kvm_pmu_probe_pmuver(void);
 #else
 struct kvm_pmu {
 };
 	return 0;
 }
-static inline int kvm_pmu_probe_pmuver(void) { return 0xf; }
 #endif
 #endif

include/linux/bpf.h+2−1

  * programs only. Should not be used with normal calls and indirect calls.
  */
 #define BPF_TRAMP_F_SKIP_FRAME		BIT(2)
 /* Store IP address of the caller on the trampoline stack,
  * so it's available for trampoline's programs.
  */
 #define BPF_TRAMP_F_IP_ARG		BIT(3)
+/* Return the return value of fentry prog. Only used by bpf_struct_ops. */
+#define BPF_TRAMP_F_RET_FENTRY_RET	BIT(4)
 /* Each call __bpf_prog_enter + call bpf_func + call __bpf_prog_exit is ~50
  * bytes on x86.  Pick a number to fit into BPF_IMAGE_SIZE / 2

include/linux/cpumask.h+4−3

  * cpumask; Typically used by bin_attribute to export cpumask bitmask
  * ABI.
  *
- * Returns the length of how many bytes have been copied.
+ * Returns the length of how many bytes have been copied, excluding
+ * terminating '\0'.
  */
 static inline ssize_t
 cpumap_print_bitmask_to_buf(char *buf, const struct cpumask *mask,
 		loff_t off, size_t count)
 {
 	return bitmap_print_bitmask_to_buf(buf, cpumask_bits(mask),
-				   nr_cpu_ids, off, count);
+				   nr_cpu_ids, off, count) - 1;
 }
 /**
 		loff_t off, size_t count)
 {
 	return bitmap_print_list_to_buf(buf, cpumask_bits(mask),
-				   nr_cpu_ids, off, count);
+				   nr_cpu_ids, off, count) - 1;
 }
 #if NR_CPUS <= BITS_PER_LONG

include/linux/fwnode.h+8−3

  * LINKS_ADDED:	The fwnode has already be parsed to add fwnode links.
  * NOT_DEVICE:	The fwnode will never be populated as a struct device.
  * INITIALIZED: The hardware corresponding to fwnode has been initialized.
+ * NEEDS_CHILD_BOUND_ON_ADD: For this fwnode/device to probe successfully, its
+ *			     driver needs its child devices to be bound with
+ *			     their respective drivers as soon as they are
+ *			     added.
  */
-#define FWNODE_FLAG_LINKS_ADDED		BIT(0)
+#define FWNODE_FLAG_LINKS_ADDED			BIT(0)
-#define FWNODE_FLAG_NOT_DEVICE		BIT(1)
+#define FWNODE_FLAG_NOT_DEVICE			BIT(1)
-#define FWNODE_FLAG_INITIALIZED		BIT(2)
+#define FWNODE_FLAG_INITIALIZED			BIT(2)
+#define FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD	BIT(3)
 struct fwnode_handle {
 	struct fwnode_handle *secondary;

include/linux/kvm_host.h+0−6

 	unsigned long mmu_notifier_range_start;
 	unsigned long mmu_notifier_range_end;
 #endif
-	long tlbs_dirty;
 	struct list_head devices;
 	u64 manual_dirty_log_protect;
 	struct dentry *debugfs_dentry;
 	return NULL;
 }
-static inline int kvm_vcpu_get_idx(struct kvm_vcpu *vcpu)
-{
-	return vcpu->vcpu_idx;
-}
 #define kvm_for_each_memslot(memslot, slots)				\
 	for (memslot = &slots->memslots[0];				\
 	     memslot < slots->memslots + slots->used_slots; memslot++)	\

include/linux/perf/arm_pmu.h+6−0

 static inline int arm_pmu_acpi_probe(armpmu_init_fn init_fn) { return 0; }
 #endif
+#ifdef CONFIG_KVM
+void kvm_host_pmu_init(struct arm_pmu *pmu);
+#else
+#define kvm_host_pmu_init(x)	do { } while(0)
+#endif
 /* Internal functions only for core arm_pmu code */
 struct arm_pmu *armpmu_alloc(void);
 struct arm_pmu *armpmu_alloc_atomic(void);

include/linux/perf_event.h+3−1

 	/*
 	 * timestamp shadows the actual context timing but it can
 	 * be safely used in NMI interrupt context. It reflects the
-	 * context time as it was when the event was last scheduled in.
+	 * context time as it was when the event was last scheduled in,
+	 * or when ctx_sched_in failed to schedule the event because we
+	 * run out of PMC.
 	 *
 	 * ctx_time already accounts for ctx->timestamp. Therefore to
 	 * compute ctx_time for a sample, simply add perf_clock().

include/linux/sched.h+1−1

@@ -1720,7 +1720,7 @@ extern struct pid *cad_pid; · 1719 unmodified lines
1720	#define tsk_used_math(p) ((p)->flags & PF_USED_MATH)	1720	#define tsk_used_math(p) ((p)->flags & PF_USED_MATH)
1721	#define used_math() tsk_used_math(current)	1721	#define used_math() tsk_used_math(current)
1722		1722
1723	static inline bool is_percpu_thread(void)	1723	static __always_inline bool is_percpu_thread(void)
1724	{	1724	{
1725	#ifdef CONFIG_SMP	1725	#ifdef CONFIG_SMP
1726	return (current->flags & PF_NO_SETAFFINITY) &&	1726	return (current->flags & PF_NO_SETAFFINITY) &&

include/net/ip_fib.h+1−1

@@ -597,5 +597,5 @@ int ip_valid_fib_dump_req(struct net net, const struct nlmsghdr nlh, · 596 unmodified lines
597	int fib_nexthop_info(struct sk_buff skb, const struct fib_nh_common nh,	597	int fib_nexthop_info(struct sk_buff skb, const struct fib_nh_common nh,
598	u8 rt_family, unsigned char *flags, bool skip_oif);	598	u8 rt_family, unsigned char *flags, bool skip_oif);
599	int fib_add_nexthop(struct sk_buff skb, const struct fib_nh_common nh,	599	int fib_add_nexthop(struct sk_buff skb, const struct fib_nh_common nh,
600	int nh_weight, u8 rt_family);	600	int nh_weight, u8 rt_family, u32 nh_tclassid);
601	#endif /* _NET_FIB_H */	601	#endif /* _NET_FIB_H */

include/net/mac80211.h+4−4

  * Mac80211 drivers should set the @NL80211_EXT_FEATURE_CAN_REPLACE_PTK0 flag
  * when they are able to replace in-use PTK keys according to the following
  * requirements:
- * 1) They do not hand over frames decrypted with the old key to
+ * 1) They do not hand over frames decrypted with the old key to mac80211
-      mac80211 once the call to set_key() with command %DISABLE_KEY has been
+      once the call to set_key() with command %DISABLE_KEY has been completed,
-      completed when also setting @IEEE80211_KEY_FLAG_GENERATE_IV for any key,
    2) either drop or continue to use the old key for any outgoing frames queued
       at the time of the key deletion (including re-transmits),
    3) never send out a frame queued prior to the set_key() %SET_KEY command
-      encrypted with the new key and
+      encrypted with the new key when also needing
+      @IEEE80211_KEY_FLAG_GENERATE_IV and
    4) never send out a frame unencrypted when it should be encrypted.
    Mac80211 will not queue any new frames for a deleted key to the driver.
  */

include/net/nexthop.h+1−1

@@ -325,7 +325,7 @@ int nexthop_mpath_fill_node(struct sk_buff skb, struct nexthop nh, · 324 unmodified lines
325	struct fib_nh_common *nhc = &nhi->fib_nhc;	325	struct fib_nh_common *nhc = &nhi->fib_nhc;
326	int weight = nhg->nh_entries[i].weight;	326	int weight = nhg->nh_entries[i].weight;
327		327
328	if (fib_add_nexthop(skb, nhc, weight, rt_family) < 0)	328	if (fib_add_nexthop(skb, nhc, weight, rt_family, 0) < 0)
329	return -EMSGSIZE;	329	return -EMSGSIZE;
330	}	330	}
331		331

include/net/pkt_sched.h+1−0

@@ -11,6 +11,7 @@ · 10 unmodified lines
11	#include <uapi/linux/pkt_sched.h>	11	#include <uapi/linux/pkt_sched.h>
12		12
13	#define DEFAULT_TX_QUEUE_LEN 1000	13	#define DEFAULT_TX_QUEUE_LEN 1000
		14	#define STAB_SIZE_LOG_MAX 30
14		15
15	struct qdisc_walker {	16	struct qdisc_walker {
16	int stop;	17	int stop;

include/net/sock.h+32−1

@@ -488,8 +488,10 @@ struct sock { · 487 unmodified lines
488	u8 sk_prefer_busy_poll;	488	u8 sk_prefer_busy_poll;
489	u16 sk_busy_poll_budget;	489	u16 sk_busy_poll_budget;
490	#endif	490	#endif
		491	spinlock_t sk_peer_lock;
491	struct pid *sk_peer_pid;	492	struct pid *sk_peer_pid;
492	const struct cred *sk_peer_cred;	493	const struct cred *sk_peer_cred;
		494
493	long sk_rcvtimeo;	495	long sk_rcvtimeo;
494	ktime_t sk_stamp;	496	ktime_t sk_stamp;
495	#if BITS_PER_LONG==32	497	#if BITS_PER_LONG==32
@@ -1623,7 +1625,36 @@ void release_sock(struct sock *sk); · 1127 unmodified lines
1623	SINGLE_DEPTH_NESTING)	1625	SINGLE_DEPTH_NESTING)
1624	#define bh_unlock_sock(__sk) spin_unlock(&((__sk)->sk_lock.slock))	1626	#define bh_unlock_sock(__sk) spin_unlock(&((__sk)->sk_lock.slock))
1625		1627
1626	bool lock_sock_fast(struct sock *sk) __acquires(&sk->sk_lock.slock);	1628	bool __lock_sock_fast(struct sock *sk) __acquires(&sk->sk_lock.slock);
		1629
		1630	/**
		1631	* lock_sock_fast - fast version of lock_sock
		1632	* @sk: socket
		1633	*
		1634	* This version should be used for very small section, where process wont block
		1635	* return false if fast path is taken:
		1636	*
		1637	* sk_lock.slock locked, owned = 0, BH disabled
		1638	*
		1639	* return true if slow path is taken:
		1640	*
		1641	* sk_lock.slock unlocked, owned = 1, BH enabled
		1642	*/
		1643	static inline bool lock_sock_fast(struct sock *sk)
		1644	{
		1645	/* The sk_lock has mutex_lock() semantics here. */
		1646	mutex_acquire(&sk->sk_lock.dep_map, 0, 0, _RET_IP_);
		1647
		1648	return __lock_sock_fast(sk);
		1649	}
		1650
		1651	/* fast socket lock variant for caller already holding a [different] socket lock */
		1652	static inline bool lock_sock_fast_nested(struct sock *sk)
		1653	{
		1654	mutex_acquire(&sk->sk_lock.dep_map, SINGLE_DEPTH_NESTING, 0, _RET_IP_);
		1655
		1656	return __lock_sock_fast(sk);
		1657	}
1627		1658
1628	/**	1659	/**
1629	* unlock_sock_fast - complement of lock_sock_fast	1660	* unlock_sock_fast - complement of lock_sock_fast

include/sound/rawmidi.h+1−0

@@ -98,6 +98,7 @@ struct snd_rawmidi_file { · 97 unmodified lines
98	struct snd_rawmidi *rmidi;	98	struct snd_rawmidi *rmidi;
99	struct snd_rawmidi_substream *input;	99	struct snd_rawmidi_substream *input;
100	struct snd_rawmidi_substream *output;	100	struct snd_rawmidi_substream *output;
		101	unsigned int user_pversion; /* supported protocol version */
101	};	102	};
102		103
103	struct snd_rawmidi_str {	104	struct snd_rawmidi_str {

include/trace/events/cachefiles.h+1−1

@@ -305,7 +305,7 @@ TRACE_EVENT(cachefiles_mark_buried, · 304 unmodified lines
305	),	305	),
306		306
307	TP_fast_assign(	307	TP_fast_assign(
308	__entry->obj = obj->fscache.debug_id;	308	__entry->obj = obj ? obj->fscache.debug_id : UINT_MAX;
309	__entry->de = de;	309	__entry->de = de;
310	__entry->why = why;	310	__entry->why = why;
311	),	311	),

include/uapi/sound/asound.h+1−0

@@ -784,6 +784,7 @@ struct snd_rawmidi_status { · 783 unmodified lines
784		784
785	#define SNDRV_RAWMIDI_IOCTL_PVERSION _IOR('W', 0x00, int)	785	#define SNDRV_RAWMIDI_IOCTL_PVERSION _IOR('W', 0x00, int)
786	#define SNDRV_RAWMIDI_IOCTL_INFO _IOR('W', 0x01, struct snd_rawmidi_info)	786	#define SNDRV_RAWMIDI_IOCTL_INFO _IOR('W', 0x01, struct snd_rawmidi_info)
		787	#define SNDRV_RAWMIDI_IOCTL_USER_PVERSION _IOW('W', 0x02, int)
787	#define SNDRV_RAWMIDI_IOCTL_PARAMS _IOWR('W', 0x10, struct snd_rawmidi_params)	788	#define SNDRV_RAWMIDI_IOCTL_PARAMS _IOWR('W', 0x10, struct snd_rawmidi_params)
788	#define SNDRV_RAWMIDI_IOCTL_STATUS _IOWR('W', 0x20, struct snd_rawmidi_status)	789	#define SNDRV_RAWMIDI_IOCTL_STATUS _IOWR('W', 0x20, struct snd_rawmidi_status)
789	#define SNDRV_RAWMIDI_IOCTL_DROP _IOW('W', 0x30, int)	790	#define SNDRV_RAWMIDI_IOCTL_DROP _IOW('W', 0x30, int)

kernel/bpf/bpf_struct_ops.c+5−2

 		const struct btf_type *mtype, *ptype;
 		struct bpf_prog *prog;
 		u32 moff;
+		u32 flags;
 		moff = btf_member_bit_offset(t, member) / 8;
 		ptype = btf_type_resolve_ptr(btf_vmlinux, member->type, NULL);
 		tprogs[BPF_TRAMP_FENTRY].progs[0] = prog;
 		tprogs[BPF_TRAMP_FENTRY].nr_progs = 1;
+		flags = st_ops->func_models[i].ret_size > 0 ?
+			BPF_TRAMP_F_RET_FENTRY_RET : 0;
 		err = arch_prepare_bpf_trampoline(NULL, image,
 						  st_map->image + PAGE_SIZE,
-						  &st_ops->func_models[i], 0,
+						  &st_ops->func_models[i],
-						  tprogs, NULL);
+						  flags, tprogs, NULL);
 		if (err < 0)
 			goto reset_unlock;

kernel/bpf/core.c+1−1

@@ -827,7 +827,7 @@ int bpf_jit_charge_modmem(u32 pages) · 826 unmodified lines
827	{	827	{
828	if (atomic_long_add_return(pages, &bpf_jit_current) >	828	if (atomic_long_add_return(pages, &bpf_jit_current) >
829	(bpf_jit_limit >> PAGE_SHIFT)) {	829	(bpf_jit_limit >> PAGE_SHIFT)) {
830	if (!capable(CAP_SYS_ADMIN)) {	830	if (!bpf_capable()) {
831	atomic_long_sub(pages, &bpf_jit_current);	831	atomic_long_sub(pages, &bpf_jit_current);
832	return -EPERM;	832	return -EPERM;
833	}	833	}

kernel/cgroup/cgroup.c+12−5

 void cgroup_sk_alloc(struct sock_cgroup_data *skcd)
 {
-	/* Don't associate the sock with unrelated interrupted task's cgroup. */
+	struct cgroup *cgroup;
-	if (in_interrupt())
-		return;
 	rcu_read_lock();
+	/* Don't associate the sock with unrelated interrupted task's cgroup. */
+	if (in_interrupt()) {
+		cgroup = &cgrp_dfl_root.cgrp;
+		cgroup_get(cgroup);
+		goto out;
+	}
 	while (true) {
 		struct css_set *cset;
 		cset = task_css_set(current);
 		if (likely(cgroup_tryget(cset->dfl_cgrp))) {
-			skcd->cgroup = cset->dfl_cgrp;
+			cgroup = cset->dfl_cgrp;
-			cgroup_bpf_get(cset->dfl_cgrp);
 			break;
 		}
 		cpu_relax();
 	}
+out:
+	skcd->cgroup = cgroup;
+	cgroup_bpf_get(cgroup);
 	rcu_read_unlock();
 }

kernel/events/core.c+30−4

@@ -3707,6 +3707,29 @@ static noinline int visit_groups_merge(struct perf_cpu_context *cpuctx, · 3706 unmodified lines
3707	return 0;	3707	return 0;
3708	}	3708	}
3709		3709
		3710	static inline bool event_update_userpage(struct perf_event *event)
		3711	{
		3712	if (likely(!atomic_read(&event->mmap_count)))
		3713	return false;
		3714
		3715	perf_event_update_time(event);
		3716	perf_set_shadow_time(event, event->ctx);
		3717	perf_event_update_userpage(event);
		3718
		3719	return true;
		3720	}
		3721
		3722	static inline void group_update_userpage(struct perf_event *group_event)
		3723	{
		3724	struct perf_event *event;
		3725
		3726	if (!event_update_userpage(group_event))
		3727	return;
		3728
		3729	for_each_sibling_event(event, group_event)
		3730	event_update_userpage(event);
		3731	}
		3732
3710	static int merge_sched_in(struct perf_event event, void data)	3733	static int merge_sched_in(struct perf_event event, void data)
3711	{	3734	{
3712	struct perf_event_context *ctx = event->ctx;	3735	struct perf_event_context *ctx = event->ctx;
@@ -3725,14 +3748,15 @@ static int merge_sched_in(struct perf_event event, void data) · 12 unmodified lines
3725	}	3748	}
3726		3749
3727	if (event->state == PERF_EVENT_STATE_INACTIVE) {	3750	if (event->state == PERF_EVENT_STATE_INACTIVE) {
		3751	*can_add_hw = 0;
3728	if (event->attr.pinned) {	3752	if (event->attr.pinned) {
3729	perf_cgroup_event_disable(event, ctx);	3753	perf_cgroup_event_disable(event, ctx);
3730	perf_event_set_state(event, PERF_EVENT_STATE_ERROR);	3754	perf_event_set_state(event, PERF_EVENT_STATE_ERROR);
		3755	} else {
		3756	ctx->rotate_necessary = 1;
		3757	perf_mux_hrtimer_restart(cpuctx);
		3758	group_update_userpage(event);
3731	}	3759	}
3732
3733	*can_add_hw = 0;
3734	ctx->rotate_necessary = 1;
3735	perf_mux_hrtimer_restart(cpuctx);
3736	}	3760	}
3737		3761
3738	return 0;	3762	return 0;
@@ -6324,6 +6348,8 @@ accounting: · 2585 unmodified lines
6324		6348
6325	ring_buffer_attach(event, rb);	6349	ring_buffer_attach(event, rb);
6326		6350
		6351	perf_event_update_time(event);
		6352	perf_set_shadow_time(event, event->ctx);
6327	perf_event_init_userpage(event);	6353	perf_event_init_userpage(event);
6328	perf_event_update_userpage(event);	6354	perf_event_update_userpage(event);
6329	} else {	6355	} else {

kernel/sched/debug.c+7−1

 				   size_t cnt, loff_t *ppos)
 {
 	char buf[16];
+	unsigned int scaling;
 	if (cnt > 15)
 		cnt = 15;
 	if (copy_from_user(&buf, ubuf, cnt))
 		return -EFAULT;
+	buf[cnt] = '\0';
-	if (kstrtouint(buf, 10, &sysctl_sched_tunable_scaling))
+	if (kstrtouint(buf, 10, &scaling))
 		return -EINVAL;
+	if (scaling >= SCHED_TUNABLESCALING_END)
+		return -EINVAL;
+	sysctl_sched_tunable_scaling = scaling;
 	if (sched_update_scaling())
 		return -EINVAL;

kernel/sched/fair.c+5−1

 	/* update hierarchical throttle state */
 	walk_tg_tree_from(cfs_rq->tg, tg_nop, tg_unthrottle_up, (void *)rq);
-	if (!cfs_rq->load.weight)
+	/* Nothing to run but something to decay (on_list)? Complete the branch */
+	if (!cfs_rq->load.weight) {
+		if (cfs_rq->on_list)
+			goto unthrottle_throttle;
 		return;
+	}
 	task_delta = cfs_rq->h_nr_running;
 	idle_task_delta = cfs_rq->idle_h_nr_running;

net/bpf/test_run.c+9−5

 	__skb->gso_segs = skb_shinfo(skb)->gso_segs;
 }
+static struct proto bpf_dummy_proto = {
+	.name   = "bpf_dummy",
+	.owner  = THIS_MODULE,
+	.obj_size = sizeof(struct sock),
+};
 int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
 			  union bpf_attr __user *uattr)
 {
 		break;
 	}
-	sk = kzalloc(sizeof(struct sock), GFP_USER);
+	sk = sk_alloc(net, AF_UNSPEC, GFP_USER, &bpf_dummy_proto, 1);
 	if (!sk) {
 		kfree(data);
 		kfree(ctx);
 		return -ENOMEM;
 	}
-	sock_net_set(sk, net);
 	sock_init_data(NULL, sk);
 	skb = build_skb(data, 0);
 	if (!skb) {
 		kfree(data);
 		kfree(ctx);
-		kfree(sk);
+		sk_free(sk);
 		return -ENOMEM;
 	}
 	skb->sk = sk;
 	if (dev && dev != net->loopback_dev)
 		dev_put(dev);
 	kfree_skb(skb);
-	bpf_sk_storage_free(sk);
+	sk_free(sk);
-	kfree(sk);
 	kfree(ctx);
 	return ret;
 }

net/bridge/br_multicast.c+2−4

 					int ifindex,
 					struct br_ip *saddr)
 {
-	lockdep_assert_held_once(&brmctx->br->multicast_lock);
 	write_seqcount_begin(&querier->seq);
 	querier->port_ifidx = ifindex;
 	memcpy(&querier->addr, saddr, sizeof(*saddr));
 	brmctx->ip4_other_query.delay_time = 0;
 	brmctx->ip4_querier.port_ifidx = 0;
-	seqcount_init(&brmctx->ip4_querier.seq);
+	seqcount_spinlock_init(&brmctx->ip4_querier.seq, &br->multicast_lock);
 	brmctx->multicast_igmp_version = 2;
 #if IS_ENABLED(CONFIG_IPV6)
 	brmctx->multicast_mld_version = 1;
 	brmctx->ip6_other_query.delay_time = 0;
 	brmctx->ip6_querier.port_ifidx = 0;
-	seqcount_init(&brmctx->ip6_querier.seq);
+	seqcount_spinlock_init(&brmctx->ip6_querier.seq, &br->multicast_lock);
 #endif
 	timer_setup(&brmctx->ip4_mc_router_timer,

net/bridge/br_private.h+1−1

@@ -82,7 +82,7 @@ struct bridge_mcast_other_query { · 81 unmodified lines
82	struct bridge_mcast_querier {	82	struct bridge_mcast_querier {
83	struct br_ip addr;	83	struct br_ip addr;
84	int port_ifidx;	84	int port_ifidx;
85	seqcount_t seq;	85	seqcount_spinlock_t seq;
86	};	86	};
87		87
88	/* IGMP/MLD statistics */	88	/* IGMP/MLD statistics */

net/core/dev_addr_lists.c+6−0

 	if (addr_len > MAX_ADDR_LEN)
 		return -EINVAL;
+	ha = list_first_entry(&list->list, struct netdev_hw_addr, list);
+	if (ha && !memcmp(addr, ha->addr, addr_len) &&
+	    (!addr_type || addr_type == ha->type))
+		goto found_it;
 	while (*ins_point) {
 		int diff;
 		} else if (diff > 0) {
 			ins_point = &parent->rb_right;
 		} else {
+found_it:
 			if (exclusive)
 				return -EEXIST;
 			if (global) {

net/core/sock.c+28−24

 }
 EXPORT_SYMBOL(sock_setsockopt);
+static const struct cred *sk_get_peer_cred(struct sock *sk)
+{
+	const struct cred *cred;
+	spin_lock(&sk->sk_peer_lock);
+	cred = get_cred(sk->sk_peer_cred);
+	spin_unlock(&sk->sk_peer_lock);
+	return cred;
+}
 static void cred_to_ucred(struct pid *pid, const struct cred *cred,
 			  struct ucred *ucred)
 		struct ucred peercred;
 		if (len > sizeof(peercred))
 			len = sizeof(peercred);
+		spin_lock(&sk->sk_peer_lock);
 		cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred);
+		spin_unlock(&sk->sk_peer_lock);
 		if (copy_to_user(optval, &peercred, len))
 			return -EFAULT;
 		goto lenout;
 	case SO_PEERGROUPS:
 	{
+		const struct cred *cred;
 		int ret, n;
-		if (!sk->sk_peer_cred)
+		cred = sk_get_peer_cred(sk);
+		if (!cred)
 			return -ENODATA;
-		n = sk->sk_peer_cred->group_info->ngroups;
+		n = cred->group_info->ngroups;
 		if (len < n * sizeof(gid_t)) {
 			len = n * sizeof(gid_t);
+			put_cred(cred);
 			return put_user(len, optlen) ? -EFAULT : -ERANGE;
 		}
 		len = n * sizeof(gid_t);
-		ret = groups_to_user((gid_t __user *)optval,
+		ret = groups_to_user((gid_t __user *)optval, cred->group_info);
-				     sk->sk_peer_cred->group_info);
+		put_cred(cred);
 		if (ret)
 			return ret;
 		goto lenout;
 		sk->sk_frag.page = NULL;
 	}
-	if (sk->sk_peer_cred)
+	/* We do not need to acquire sk->sk_peer_lock, we are the last user. */
-		put_cred(sk->sk_peer_cred);
+	put_cred(sk->sk_peer_cred);
 	put_pid(sk->sk_peer_pid);
 	if (likely(sk->sk_net_refcnt))
 		put_net(sock_net(sk));
 	sk_prot_free(sk->sk_prot_creator, sk);
 	sk->sk_peer_pid 	=	NULL;
 	sk->sk_peer_cred	=	NULL;
+	spin_lock_init(&sk->sk_peer_lock);
 	sk->sk_write_pending	=	0;
 	sk->sk_rcvlowat		=	1;
 	sk->sk_rcvtimeo		=	MAX_SCHEDULE_TIMEOUT;
 }
 EXPORT_SYMBOL(release_sock);
-/**
+bool __lock_sock_fast(struct sock *sk) __acquires(&sk->sk_lock.slock)
- * lock_sock_fast - fast version of lock_sock
- * @sk: socket
- *
- * This version should be used for very small section, where process wont block
- * return false if fast path is taken:
- *
- *   sk_lock.slock locked, owned = 0, BH disabled
- *
- * return true if slow path is taken:
- *
- *   sk_lock.slock unlocked, owned = 1, BH enabled
- */
-bool lock_sock_fast(struct sock *sk) __acquires(&sk->sk_lock.slock)
 {
-	/* The sk_lock has mutex_lock() semantics here. */
-	mutex_acquire(&sk->sk_lock.dep_map, 0, 0, _RET_IP_);
 	might_sleep();
 	spin_lock_bh(&sk->sk_lock.slock);
 	spin_unlock_bh(&sk->sk_lock.slock);
 	return true;
 }
-EXPORT_SYMBOL(lock_sock_fast);
+EXPORT_SYMBOL(__lock_sock_fast);
 int sock_gettstamp(struct socket *sock, void __user *userstamp,
 		   bool timeval, bool time32)

net/ipv4/fib_semantics.c+9−7

 #if IS_ENABLED(CONFIG_IP_ROUTE_MULTIPATH) || IS_ENABLED(CONFIG_IPV6)
 int fib_add_nexthop(struct sk_buff *skb, const struct fib_nh_common *nhc,
-		    int nh_weight, u8 rt_family)
+		    int nh_weight, u8 rt_family, u32 nh_tclassid)
 {
 	const struct net_device *dev = nhc->nhc_dev;
 	struct rtnexthop *rtnh;
 	rtnh->rtnh_flags = flags;
+	if (nh_tclassid && nla_put_u32(skb, RTA_FLOW, nh_tclassid))
+		goto nla_put_failure;
 	/* length of rtnetlink header + attributes */
 	rtnh->rtnh_len = nlmsg_get_pos(skb) - (void *)rtnh;
 	}
 	for_nexthops(fi) {
-		if (fib_add_nexthop(skb, &nh->nh_common, nh->fib_nh_weight,
+		u32 nh_tclassid = 0;
-				    AF_INET) < 0)
-			goto nla_put_failure;
 #ifdef CONFIG_IP_ROUTE_CLASSID
-		if (nh->nh_tclassid &&
+		nh_tclassid = nh->nh_tclassid;
-		    nla_put_u32(skb, RTA_FLOW, nh->nh_tclassid))
-			goto nla_put_failure;
 #endif
+		if (fib_add_nexthop(skb, &nh->nh_common, nh->fib_nh_weight,
+				    AF_INET, nh_tclassid) < 0)
+			goto nla_put_failure;
 	} endfor_nexthops(fi);
 mp_end:

net/ipv4/netfilter/iptable_raw.c+1−1

@@ -42,7 +42,7 @@ iptable_raw_hook(void priv, struct sk_buff skb, · 41 unmodified lines
42		42
43	static struct nf_hook_ops *rawtable_ops __read_mostly;	43	static struct nf_hook_ops *rawtable_ops __read_mostly;
44		44
45	static int __net_init iptable_raw_table_init(struct net *net)	45	static int iptable_raw_table_init(struct net *net)
46	{	46	{
47	struct ipt_replace *repl;	47	struct ipt_replace *repl;
48	const struct xt_table *table = &packet_raw;	48	const struct xt_table *table = &packet_raw;

net/ipv4/udp.c+5−5

@@ -1053,7 +1053,7 @@ int udp_sendmsg(struct sock sk, struct msghdr msg, size_t len) · 1052 unmodified lines
1053	__be16 dport;	1053	__be16 dport;
1054	u8 tos;	1054	u8 tos;
1055	int err, is_udplite = IS_UDPLITE(sk);	1055	int err, is_udplite = IS_UDPLITE(sk);
1056	int corkreq = up->corkflag \|\| msg->msg_flags&MSG_MORE;	1056	int corkreq = READ_ONCE(up->corkflag) \|\| msg->msg_flags&MSG_MORE;
1057	int (getfrag)(void , char , int, int, int, struct sk_buff );	1057	int (getfrag)(void , char , int, int, int, struct sk_buff );
1058	struct sk_buff *skb;	1058	struct sk_buff *skb;
1059	struct ip_options_data opt_copy;	1059	struct ip_options_data opt_copy;
@@ -1361,7 +1361,7 @@ int udp_sendpage(struct sock sk, struct page page, int offset, · 301 unmodified lines
1361	}	1361	}
1362		1362
1363	up->len += size;	1363	up->len += size;
1364	if (!(up->corkflag \|\| (flags&MSG_MORE)))	1364	if (!(READ_ONCE(up->corkflag) \|\| (flags&MSG_MORE)))
1365	ret = udp_push_pending_frames(sk);	1365	ret = udp_push_pending_frames(sk);
1366	if (!ret)	1366	if (!ret)
1367	ret = size;	1367	ret = size;
@@ -2662,9 +2662,9 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname, · 1294 unmodified lines
2662	switch (optname) {	2662	switch (optname) {
2663	case UDP_CORK:	2663	case UDP_CORK:
2664	if (val != 0) {	2664	if (val != 0) {
2665	up->corkflag = 1;	2665	WRITE_ONCE(up->corkflag, 1);
2666	} else {	2666	} else {
2667	up->corkflag = 0;	2667	WRITE_ONCE(up->corkflag, 0);
2668	lock_sock(sk);	2668	lock_sock(sk);
2669	push_pending_frames(sk);	2669	push_pending_frames(sk);
2670	release_sock(sk);	2670	release_sock(sk);
@@ -2787,7 +2787,7 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname, · 116 unmodified lines
2787		2787
2788	switch (optname) {	2788	switch (optname) {
2789	case UDP_CORK:	2789	case UDP_CORK:
2790	val = up->corkflag;	2790	val = READ_ONCE(up->corkflag);
2791	break;	2791	break;
2792		2792
2793	case UDP_ENCAP:	2793	case UDP_ENCAP:

net/ipv6/netfilter/ip6_tables.c+1−0

@@ -273,6 +273,7 @@ ip6t_do_table(struct sk_buff *skb, · 272 unmodified lines
273	* things we don't know, ie. tcp syn flag or ports). If the	273	* things we don't know, ie. tcp syn flag or ports). If the
274	* rule is also a fragment-specific rule, non-fragments won't	274	* rule is also a fragment-specific rule, non-fragments won't
275	* match it. */	275	* match it. */
		276	acpar.fragoff = 0;
276	acpar.hotdrop = false;	277	acpar.hotdrop = false;
277	acpar.state = state;	278	acpar.state = state;
278		279

net/ipv6/route.c+3−2

 			goto nla_put_failure;
 		if (fib_add_nexthop(skb, &rt->fib6_nh->nh_common,
-				    rt->fib6_nh->fib_nh_weight, AF_INET6) < 0)
+				    rt->fib6_nh->fib_nh_weight, AF_INET6,
+				    0) < 0)
 			goto nla_put_failure;
 		list_for_each_entry_safe(sibling, next_sibling,
 					 &rt->fib6_siblings, fib6_siblings) {
 			if (fib_add_nexthop(skb, &sibling->fib6_nh->nh_common,
 					    sibling->fib6_nh->fib_nh_weight,
-					    AF_INET6) < 0)
+					    AF_INET6, 0) < 0)
 				goto nla_put_failure;
 		}

net/ipv6/udp.c+1−1

@@ -1303,7 +1303,7 @@ int udpv6_sendmsg(struct sock sk, struct msghdr msg, size_t len) · 1302 unmodified lines
1303	int addr_len = msg->msg_namelen;	1303	int addr_len = msg->msg_namelen;
1304	bool connected = false;	1304	bool connected = false;
1305	int ulen = len;	1305	int ulen = len;
1306	int corkreq = up->corkflag \|\| msg->msg_flags&MSG_MORE;	1306	int corkreq = READ_ONCE(up->corkflag) \|\| msg->msg_flags&MSG_MORE;
1307	int err;	1307	int err;
1308	int is_udplite = IS_UDPLITE(sk);	1308	int is_udplite = IS_UDPLITE(sk);
1309	int (getfrag)(void , char , int, int, int, struct sk_buff );	1309	int (getfrag)(void , char , int, int, int, struct sk_buff );

net/mac80211/mesh_pathtbl.c+4−1

 	atomic_set(&newtbl->entries,  0);
 	spin_lock_init(&newtbl->gates_lock);
 	spin_lock_init(&newtbl->walk_lock);
-	rhashtable_init(&newtbl->rhead, &mesh_rht_params);
+	if (rhashtable_init(&newtbl->rhead, &mesh_rht_params)) {
+		kfree(newtbl);
+		return NULL;
+	}
 	return newtbl;
 }

net/mac80211/mesh_ps.c+2−1

 /*
  * Copyright 2012-2013, Marco Porsch <marco.porsch@s2005.tu-chemnitz.de>
  * Copyright 2012-2013, cozybit Inc.
+ * Copyright (C) 2021 Intel Corporation
  */
 #include "mesh.h"
 	/* only transmit to PS STA with announced, non-zero awake window */
 	if (test_sta_flag(sta, WLAN_STA_PS_STA) &&
-	    (!elems->awake_window || !le16_to_cpu(*elems->awake_window)))
+	    (!elems->awake_window || !get_unaligned_le16(elems->awake_window)))
 		return;
 	if (!test_sta_flag(sta, WLAN_STA_MPSP_OWNER))

net/mac80211/rate.c+0−4

 	int mcast_rate;
 	bool use_basicrate = false;
-	if (ieee80211_is_tx_data(txrc->skb) &&
-	    info->flags & IEEE80211_TX_CTL_NO_ACK)
-		return false;
 	if (!pubsta || rc_no_data_or_no_ack_use_min(txrc)) {
 		__rate_control_send_low(txrc->hw, sband, pubsta, info,
 					txrc->rate_idx_mask);

net/mac80211/rx.c+2−1

 		if (!bssid)
 			return false;
 		if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
-		    ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
+		    ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2) ||
+		    !is_valid_ether_addr(hdr->addr2))
 			return false;
 		if (ieee80211_is_beacon(hdr->frame_control))
 			return true;

net/mac80211/tx.c+12−0

 			}
 			vht_mcs = iterator.this_arg[4] >> 4;
+			if (vht_mcs > 11)
+				vht_mcs = 0;
 			vht_nss = iterator.this_arg[4] & 0xF;
+			if (!vht_nss || vht_nss > 8)
+				vht_nss = 1;
 			break;
 		/*
 	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
 		goto out;
+	/* If n == 2, the "while (*frag_tail)" loop above didn't execute
+	 * and  frag_tail should be &skb_shinfo(head)->frag_list.
+	 * However, ieee80211_amsdu_prepare_head() can reallocate it.
+	 * Reload frag_tail to have it pointing to the correct place.
+	 */
+	if (n == 2)
+		frag_tail = &skb_shinfo(head)->frag_list;
 	/*
 	 * Pad out the previous subframe to a multiple of 4 by adding the
 	 * padding to the next one, that's being added. Note that head->len

net/mac80211/wpa.c+6−0

 			return RX_DROP_UNUSABLE;
 	}
+	/* reload hdr - skb might have been reallocated */
+	hdr = (void *)rx->skb->data;
 	data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len;
 	if (!rx->sta || data_len < 0)
 		return RX_DROP_UNUSABLE;
 			return RX_DROP_UNUSABLE;
 	}
+	/* reload hdr - skb might have been reallocated */
+	hdr = (void *)rx->skb->data;
 	data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - mic_len;
 	if (!rx->sta || data_len < 0)
 		return RX_DROP_UNUSABLE;

net/mptcp/mptcp_diag.c+1−1

@@ -36,7 +36,7 @@ static int mptcp_diag_dump_one(struct netlink_callback *cb, · 35 unmodified lines
36	struct sock *sk;	36	struct sock *sk;
37		37
38	net = sock_net(in_skb->sk);	38	net = sock_net(in_skb->sk);
39	msk = mptcp_token_get_sock(req->id.idiag_cookie[0]);	39	msk = mptcp_token_get_sock(net, req->id.idiag_cookie[0]);
40	if (!msk)	40	if (!msk)
41	goto out_nosk;	41	goto out_nosk;
42		42

net/mptcp/pm_netlink.c+1−3

@@ -1718,9 +1718,7 @@ static int mptcp_nl_cmd_set_flags(struct sk_buff skb, struct genl_info info) · 1717 unmodified lines
1718		1718
1719	list_for_each_entry(entry, &pernet->local_addr_list, list) {	1719	list_for_each_entry(entry, &pernet->local_addr_list, list) {
1720	if (addresses_equal(&entry->addr, &addr.addr, true)) {	1720	if (addresses_equal(&entry->addr, &addr.addr, true)) {
1721	ret = mptcp_nl_addr_backup(net, &entry->addr, bkup);	1721	mptcp_nl_addr_backup(net, &entry->addr, bkup);
1722	if (ret)
1723	return ret;
1724		1722
1725	if (bkup)	1723	if (bkup)
1726	entry->flags \|= MPTCP_PM_ADDR_FLAG_BACKUP;	1724	entry->flags \|= MPTCP_PM_ADDR_FLAG_BACKUP;

net/mptcp/protocol.c+1−1

@@ -2735,7 +2735,7 @@ cleanup: · 2734 unmodified lines
2735	inet_csk(sk)->icsk_mtup.probe_timestamp = tcp_jiffies32;	2735	inet_csk(sk)->icsk_mtup.probe_timestamp = tcp_jiffies32;
2736	mptcp_for_each_subflow(mptcp_sk(sk), subflow) {	2736	mptcp_for_each_subflow(mptcp_sk(sk), subflow) {
2737	struct sock *ssk = mptcp_subflow_tcp_sock(subflow);	2737	struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
2738	bool slow = lock_sock_fast(ssk);	2738	bool slow = lock_sock_fast_nested(ssk);
2739		2739
2740	sock_orphan(ssk);	2740	sock_orphan(ssk);
2741	unlock_sock_fast(ssk, slow);	2741	unlock_sock_fast(ssk, slow);

net/mptcp/protocol.h+1−1

@@ -709,7 +709,7 @@ int mptcp_token_new_connect(struct sock *sk); · 708 unmodified lines
709	void mptcp_token_accept(struct mptcp_subflow_request_sock *r,	709	void mptcp_token_accept(struct mptcp_subflow_request_sock *r,
710	struct mptcp_sock *msk);	710	struct mptcp_sock *msk);
711	bool mptcp_token_exists(u32 token);	711	bool mptcp_token_exists(u32 token);
712	struct mptcp_sock *mptcp_token_get_sock(u32 token);	712	struct mptcp_sock mptcp_token_get_sock(struct net net, u32 token);
713	struct mptcp_sock mptcp_token_iter_next(const struct net net, long *s_slot,	713	struct mptcp_sock mptcp_token_iter_next(const struct net net, long *s_slot,
714	long *s_num);	714	long *s_num);
715	void mptcp_token_destroy(struct mptcp_sock *msk);	715	void mptcp_token_destroy(struct mptcp_sock *msk);

net/mptcp/subflow.c+1−1

@@ -86,7 +86,7 @@ static struct mptcp_sock subflow_token_join_request(struct request_sock req) · 85 unmodified lines
86	struct mptcp_sock *msk;	86	struct mptcp_sock *msk;
87	int local_id;	87	int local_id;
88		88
89	msk = mptcp_token_get_sock(subflow_req->token);	89	msk = mptcp_token_get_sock(sock_net(req_to_sk(req)), subflow_req->token);
90	if (!msk) {	90	if (!msk) {
91	SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINNOTOKEN);	91	SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINNOTOKEN);
92	return NULL;	92	return NULL;

net/mptcp/syncookies.c+1−12

 	e->valid = 0;
-	msk = mptcp_token_get_sock(e->token);
+	msk = mptcp_token_get_sock(net, e->token);
 	if (!msk) {
 		spin_unlock_bh(&join_entry_locks[i]);
 		return false;
 	}
-	/* If this fails, the token got re-used in the mean time by another
-	 * mptcp socket in a different netns, i.e. entry is outdated.
-	 */
-	if (!net_eq(sock_net((struct sock *)msk), net))
-		goto err_put;
 	subflow_req->remote_nonce = e->remote_nonce;
 	subflow_req->local_nonce = e->local_nonce;
 	subflow_req->backup = e->backup;
 	subflow_req->msk = msk;
 	spin_unlock_bh(&join_entry_locks[i]);
 	return true;
-err_put:
-	spin_unlock_bh(&join_entry_locks[i]);
-	sock_put((struct sock *)msk);
-	return false;
 }
 void __init mptcp_join_cookie_init(void)

net/mptcp/token.c+8−3

@@ -231,6 +231,7 @@ found: · 230 unmodified lines
231		231
232	/**	232	/**
233	* mptcp_token_get_sock - retrieve mptcp connection sock using its token	233	* mptcp_token_get_sock - retrieve mptcp connection sock using its token
		234	* @net: restrict to this namespace
234	* @token: token of the mptcp connection to retrieve	235	* @token: token of the mptcp connection to retrieve
235	*	236	*
236	* This function returns the mptcp connection structure with the given token.	237	* This function returns the mptcp connection structure with the given token.
@@ -238,7 +239,7 @@ found: · 1 unmodified line
238	*	239	*
239	* returns NULL if no connection with the given token value exists.	240	* returns NULL if no connection with the given token value exists.
240	*/	241	*/
241	struct mptcp_sock *mptcp_token_get_sock(u32 token)	242	struct mptcp_sock mptcp_token_get_sock(struct net net, u32 token)
242	{	243	{
243	struct hlist_nulls_node *pos;	244	struct hlist_nulls_node *pos;
244	struct token_bucket *bucket;	245	struct token_bucket *bucket;
@@ -251,11 +252,15 @@ struct mptcp_sock *mptcp_token_get_sock(u32 token) · 6 unmodified lines
251	again:	252	again:
252	sk_nulls_for_each_rcu(sk, pos, &bucket->msk_chain) {	253	sk_nulls_for_each_rcu(sk, pos, &bucket->msk_chain) {
253	msk = mptcp_sk(sk);	254	msk = mptcp_sk(sk);
254	if (READ_ONCE(msk->token) != token)	255	if (READ_ONCE(msk->token) != token \|\|
		256	!net_eq(sock_net(sk), net))
255	continue;	257	continue;
		258
256	if (!refcount_inc_not_zero(&sk->sk_refcnt))	259	if (!refcount_inc_not_zero(&sk->sk_refcnt))
257	goto not_found;	260	goto not_found;
258	if (READ_ONCE(msk->token) != token) {	261
		262	if (READ_ONCE(msk->token) != token \|\|
		263	!net_eq(sock_net(sk), net)) {
259	sock_put(sk);	264	sock_put(sk);
260	goto again;	265	goto again;
261	}	266	}

net/mptcp/token_test.c+8−6

 			    GFP_USER);
 	KUNIT_EXPECT_NOT_ERR_OR_NULL(test, req);
 	mptcp_token_init_request((struct request_sock *)req);
+	sock_net_set((struct sock *)req, &init_net);
 	return req;
 }
 	KUNIT_ASSERT_EQ(test, 0,
 			mptcp_token_new_request((struct request_sock *)req));
 	KUNIT_EXPECT_NE(test, 0, (int)req->token);
-	KUNIT_EXPECT_PTR_EQ(test, null_msk, mptcp_token_get_sock(req->token));
+	KUNIT_EXPECT_PTR_EQ(test, null_msk, mptcp_token_get_sock(&init_net, req->token));
 	/* cleanup */
 	mptcp_token_destroy_request((struct request_sock *)req);
 	msk = kunit_kzalloc(test, sizeof(struct mptcp_sock), GFP_USER);
 	KUNIT_EXPECT_NOT_ERR_OR_NULL(test, msk);
 	refcount_set(&((struct sock *)msk)->sk_refcnt, 1);
+	sock_net_set((struct sock *)msk, &init_net);
 	return msk;
 }
 			mptcp_token_new_connect((struct sock *)icsk));
 	KUNIT_EXPECT_NE(test, 0, (int)ctx->token);
 	KUNIT_EXPECT_EQ(test, ctx->token, msk->token);
-	KUNIT_EXPECT_PTR_EQ(test, msk, mptcp_token_get_sock(ctx->token));
+	KUNIT_EXPECT_PTR_EQ(test, msk, mptcp_token_get_sock(&init_net, ctx->token));
 	KUNIT_EXPECT_EQ(test, 2, (int)refcount_read(&sk->sk_refcnt));
 	mptcp_token_destroy(msk);
-	KUNIT_EXPECT_PTR_EQ(test, null_msk, mptcp_token_get_sock(ctx->token));
+	KUNIT_EXPECT_PTR_EQ(test, null_msk, mptcp_token_get_sock(&init_net, ctx->token));
 }
 static void mptcp_token_test_accept(struct kunit *test)
 			mptcp_token_new_request((struct request_sock *)req));
 	msk->token = req->token;
 	mptcp_token_accept(req, msk);
-	KUNIT_EXPECT_PTR_EQ(test, msk, mptcp_token_get_sock(msk->token));
+	KUNIT_EXPECT_PTR_EQ(test, msk, mptcp_token_get_sock(&init_net, msk->token));
 	/* this is now a no-op */
 	mptcp_token_destroy_request((struct request_sock *)req);
-	KUNIT_EXPECT_PTR_EQ(test, msk, mptcp_token_get_sock(msk->token));
+	KUNIT_EXPECT_PTR_EQ(test, msk, mptcp_token_get_sock(&init_net, msk->token));
 	/* cleanup */
 	mptcp_token_destroy(msk);
 	/* simulate race on removal */
 	refcount_set(&sk->sk_refcnt, 0);
-	KUNIT_EXPECT_PTR_EQ(test, null_msk, mptcp_token_get_sock(msk->token));
+	KUNIT_EXPECT_PTR_EQ(test, null_msk, mptcp_token_get_sock(&init_net, msk->token));
 	/* cleanup */
 	mptcp_token_destroy(msk);

net/netfilter/ipset/ip_set_hash_gen.h+2−2

@@ -130,11 +130,11 @@ htable_size(u8 hbits) · 129 unmodified lines
130	{	130	{
131	size_t hsize;	131	size_t hsize;
132		132
133	/* We must fit both into u32 in jhash and size_t */	133	/* We must fit both into u32 in jhash and INT_MAX in kvmalloc_node() */
134	if (hbits > 31)	134	if (hbits > 31)
135	return 0;	135	return 0;
136	hsize = jhash_size(hbits);	136	hsize = jhash_size(hbits);
137	if ((((size_t)-1) - sizeof(struct htable)) / sizeof(struct hbucket *)	137	if ((INT_MAX - sizeof(struct htable)) / sizeof(struct hbucket *)
138	< hsize)	138	< hsize)
139	return 0;	139	return 0;
140		140

net/netfilter/ipvs/ip_vs_conn.c+4−0

 	int idx;
 	/* Compute size and mask */
+	if (ip_vs_conn_tab_bits < 8 || ip_vs_conn_tab_bits > 20) {
+		pr_info("conn_tab_bits not in [8, 20]. Using default value\n");
+		ip_vs_conn_tab_bits = CONFIG_IP_VS_TAB_BITS;
+	}
 	ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits;
 	ip_vs_conn_tab_mask = ip_vs_conn_tab_size - 1;

net/netfilter/nf_conntrack_core.c+100−54

@@ -74,10 +74,14 @@ static __read_mostly struct kmem_cache *nf_conntrack_cachep; · 73 unmodified lines
74	static DEFINE_SPINLOCK(nf_conntrack_locks_all_lock);	74	static DEFINE_SPINLOCK(nf_conntrack_locks_all_lock);
75	static __read_mostly bool nf_conntrack_locks_all;	75	static __read_mostly bool nf_conntrack_locks_all;
76		76
		77	/* serialize hash resizes and nf_ct_iterate_cleanup */
		78	static DEFINE_MUTEX(nf_conntrack_mutex);
		79
77	#define GC_SCAN_INTERVAL (120u * HZ)	80	#define GC_SCAN_INTERVAL (120u * HZ)
78	#define GC_SCAN_MAX_DURATION msecs_to_jiffies(10)	81	#define GC_SCAN_MAX_DURATION msecs_to_jiffies(10)
79		82
80	#define MAX_CHAINLEN 64u	83	#define MIN_CHAINLEN 8u
		84	#define MAX_CHAINLEN (32u - MIN_CHAINLEN)
81		85
82	static struct conntrack_gc_work conntrack_gc_work;	86	static struct conntrack_gc_work conntrack_gc_work;
83		87
@@ -188,11 +192,13 @@ seqcount_spinlock_t nf_conntrack_generation __read_mostly; · 104 unmodified lines
188	static siphash_key_t nf_conntrack_hash_rnd __read_mostly;	192	static siphash_key_t nf_conntrack_hash_rnd __read_mostly;
189		193
190	static u32 hash_conntrack_raw(const struct nf_conntrack_tuple *tuple,	194	static u32 hash_conntrack_raw(const struct nf_conntrack_tuple *tuple,
		195	unsigned int zoneid,
191	const struct net *net)	196	const struct net *net)
192	{	197	{
193	struct {	198	struct {
194	struct nf_conntrack_man src;	199	struct nf_conntrack_man src;
195	union nf_inet_addr dst_addr;	200	union nf_inet_addr dst_addr;
		201	unsigned int zone;
196	u32 net_mix;	202	u32 net_mix;
197	u16 dport;	203	u16 dport;
198	u16 proto;	204	u16 proto;
@@ -205,6 +211,7 @@ static u32 hash_conntrack_raw(const struct nf_conntrack_tuple *tuple, · 6 unmodified lines
205	/* The direction must be ignored, so handle usable members manually. */	211	/* The direction must be ignored, so handle usable members manually. */
206	combined.src = tuple->src;	212	combined.src = tuple->src;
207	combined.dst_addr = tuple->dst.u3;	213	combined.dst_addr = tuple->dst.u3;
		214	combined.zone = zoneid;
208	combined.net_mix = net_hash_mix(net);	215	combined.net_mix = net_hash_mix(net);
209	combined.dport = (__force __u16)tuple->dst.u.all;	216	combined.dport = (__force __u16)tuple->dst.u.all;
210	combined.proto = tuple->dst.protonum;	217	combined.proto = tuple->dst.protonum;
@@ -219,15 +226,17 @@ static u32 scale_hash(u32 hash) · 8 unmodified lines
219		226
220	static u32 __hash_conntrack(const struct net *net,	227	static u32 __hash_conntrack(const struct net *net,
221	const struct nf_conntrack_tuple *tuple,	228	const struct nf_conntrack_tuple *tuple,
		229	unsigned int zoneid,
222	unsigned int size)	230	unsigned int size)
223	{	231	{
224	return reciprocal_scale(hash_conntrack_raw(tuple, net), size);	232	return reciprocal_scale(hash_conntrack_raw(tuple, zoneid, net), size);
225	}	233	}
226		234
227	static u32 hash_conntrack(const struct net *net,	235	static u32 hash_conntrack(const struct net *net,
228	const struct nf_conntrack_tuple *tuple)	236	const struct nf_conntrack_tuple *tuple,
		237	unsigned int zoneid)
229	{	238	{
230	return scale_hash(hash_conntrack_raw(tuple, net));	239	return scale_hash(hash_conntrack_raw(tuple, zoneid, net));
231	}	240	}
232		241
233	static bool nf_ct_get_tuple_ports(const struct sk_buff *skb,	242	static bool nf_ct_get_tuple_ports(const struct sk_buff *skb,
@@ -650,9 +659,11 @@ static void nf_ct_delete_from_lists(struct nf_conn *ct) · 416 unmodified lines
650	do {	659	do {
651	sequence = read_seqcount_begin(&nf_conntrack_generation);	660	sequence = read_seqcount_begin(&nf_conntrack_generation);
652	hash = hash_conntrack(net,	661	hash = hash_conntrack(net,
653	&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);	662	&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
		663	nf_ct_zone_id(nf_ct_zone(ct), IP_CT_DIR_ORIGINAL));
654	reply_hash = hash_conntrack(net,	664	reply_hash = hash_conntrack(net,
655	&ct->tuplehash[IP_CT_DIR_REPLY].tuple);	665	&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
		666	nf_ct_zone_id(nf_ct_zone(ct), IP_CT_DIR_REPLY));
656	} while (nf_conntrack_double_lock(net, hash, reply_hash, sequence));	667	} while (nf_conntrack_double_lock(net, hash, reply_hash, sequence));
657		668
658	clean_from_lists(ct);	669	clean_from_lists(ct);
@@ -819,8 +830,20 @@ struct nf_conntrack_tuple_hash * · 160 unmodified lines
819	nf_conntrack_find_get(struct net net, const struct nf_conntrack_zone zone,	830	nf_conntrack_find_get(struct net net, const struct nf_conntrack_zone zone,
820	const struct nf_conntrack_tuple *tuple)	831	const struct nf_conntrack_tuple *tuple)
821	{	832	{
822	return __nf_conntrack_find_get(net, zone, tuple,	833	unsigned int rid, zone_id = nf_ct_zone_id(zone, IP_CT_DIR_ORIGINAL);
823	hash_conntrack_raw(tuple, net));	834	struct nf_conntrack_tuple_hash *thash;
		835
		836	thash = __nf_conntrack_find_get(net, zone, tuple,
		837	hash_conntrack_raw(tuple, zone_id, net));
		838
		839	if (thash)
		840	return thash;
		841
		842	rid = nf_ct_zone_id(zone, IP_CT_DIR_REPLY);
		843	if (rid != zone_id)
		844	return __nf_conntrack_find_get(net, zone, tuple,
		845	hash_conntrack_raw(tuple, rid, net));
		846	return thash;
824	}	847	}
825	EXPORT_SYMBOL_GPL(nf_conntrack_find_get);	848	EXPORT_SYMBOL_GPL(nf_conntrack_find_get);
826		849
@@ -842,6 +865,7 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct) · 15 unmodified lines
842	unsigned int hash, reply_hash;	865	unsigned int hash, reply_hash;
843	struct nf_conntrack_tuple_hash *h;	866	struct nf_conntrack_tuple_hash *h;
844	struct hlist_nulls_node *n;	867	struct hlist_nulls_node *n;
		868	unsigned int max_chainlen;
845	unsigned int chainlen = 0;	869	unsigned int chainlen = 0;
846	unsigned int sequence;	870	unsigned int sequence;
847	int err = -EEXIST;	871	int err = -EEXIST;
@@ -852,18 +876,22 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct) · 4 unmodified lines
852	do {	876	do {
853	sequence = read_seqcount_begin(&nf_conntrack_generation);	877	sequence = read_seqcount_begin(&nf_conntrack_generation);
854	hash = hash_conntrack(net,	878	hash = hash_conntrack(net,
855	&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);	879	&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
		880	nf_ct_zone_id(nf_ct_zone(ct), IP_CT_DIR_ORIGINAL));
856	reply_hash = hash_conntrack(net,	881	reply_hash = hash_conntrack(net,
857	&ct->tuplehash[IP_CT_DIR_REPLY].tuple);	882	&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
		883	nf_ct_zone_id(nf_ct_zone(ct), IP_CT_DIR_REPLY));
858	} while (nf_conntrack_double_lock(net, hash, reply_hash, sequence));	884	} while (nf_conntrack_double_lock(net, hash, reply_hash, sequence));
859		885
		886	max_chainlen = MIN_CHAINLEN + prandom_u32_max(MAX_CHAINLEN);
		887
860	/* See if there's one in the list already, including reverse */	888	/* See if there's one in the list already, including reverse */
861	hlist_nulls_for_each_entry(h, n, &nf_conntrack_hash[hash], hnnode) {	889	hlist_nulls_for_each_entry(h, n, &nf_conntrack_hash[hash], hnnode) {
862	if (nf_ct_key_equal(h, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,	890	if (nf_ct_key_equal(h, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
863	zone, net))	891	zone, net))
864	goto out;	892	goto out;
865		893
866	if (chainlen++ > MAX_CHAINLEN)	894	if (chainlen++ > max_chainlen)
867	goto chaintoolong;	895	goto chaintoolong;
868	}	896	}
869		897
@@ -873,7 +901,7 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct) · 3 unmodified lines
873	if (nf_ct_key_equal(h, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,	901	if (nf_ct_key_equal(h, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
874	zone, net))	902	zone, net))
875	goto out;	903	goto out;
876	if (chainlen++ > MAX_CHAINLEN)	904	if (chainlen++ > max_chainlen)
877	goto chaintoolong;	905	goto chaintoolong;
878	}	906	}
879		907
@@ -1103,8 +1131,8 @@ drop: · 223 unmodified lines
1103	int	1131	int
1104	__nf_conntrack_confirm(struct sk_buff *skb)	1132	__nf_conntrack_confirm(struct sk_buff *skb)
1105	{	1133	{
		1134	unsigned int chainlen = 0, sequence, max_chainlen;
1106	const struct nf_conntrack_zone *zone;	1135	const struct nf_conntrack_zone *zone;
1107	unsigned int chainlen = 0, sequence;
1108	unsigned int hash, reply_hash;	1136	unsigned int hash, reply_hash;
1109	struct nf_conntrack_tuple_hash *h;	1137	struct nf_conntrack_tuple_hash *h;
1110	struct nf_conn *ct;	1138	struct nf_conn *ct;
@@ -1133,8 +1161,8 @@ __nf_conntrack_confirm(struct sk_buff *skb) · 22 unmodified lines
1133	hash = (unsigned long )&ct->tuplehash[IP_CT_DIR_REPLY].hnnode.pprev;	1161	hash = (unsigned long )&ct->tuplehash[IP_CT_DIR_REPLY].hnnode.pprev;
1134	hash = scale_hash(hash);	1162	hash = scale_hash(hash);
1135	reply_hash = hash_conntrack(net,	1163	reply_hash = hash_conntrack(net,
1136	&ct->tuplehash[IP_CT_DIR_REPLY].tuple);	1164	&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
1137		1165	nf_ct_zone_id(nf_ct_zone(ct), IP_CT_DIR_REPLY));
1138	} while (nf_conntrack_double_lock(net, hash, reply_hash, sequence));	1166	} while (nf_conntrack_double_lock(net, hash, reply_hash, sequence));
1139		1167
1140	/* We're not in hash table, and we refuse to set up related	1168	/* We're not in hash table, and we refuse to set up related
@@ -1168,6 +1196,7 @@ __nf_conntrack_confirm(struct sk_buff *skb) · 27 unmodified lines
1168	goto dying;	1196	goto dying;
1169	}	1197	}
1170		1198
		1199	max_chainlen = MIN_CHAINLEN + prandom_u32_max(MAX_CHAINLEN);
1171	/* See if there's one in the list already, including reverse:	1200	/* See if there's one in the list already, including reverse:
1172	NAT could have grabbed it without realizing, since we're	1201	NAT could have grabbed it without realizing, since we're
1173	not in the hash. If there is, we lost race. */	1202	not in the hash. If there is, we lost race. */
@@ -1175,7 +1204,7 @@ __nf_conntrack_confirm(struct sk_buff *skb) · 1 unmodified line
1175	if (nf_ct_key_equal(h, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,	1204	if (nf_ct_key_equal(h, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
1176	zone, net))	1205	zone, net))
1177	goto out;	1206	goto out;
1178	if (chainlen++ > MAX_CHAINLEN)	1207	if (chainlen++ > max_chainlen)
1179	goto chaintoolong;	1208	goto chaintoolong;
1180	}	1209	}
1181		1210
@@ -1184,7 +1213,7 @@ __nf_conntrack_confirm(struct sk_buff *skb) · 2 unmodified lines
1184	if (nf_ct_key_equal(h, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,	1213	if (nf_ct_key_equal(h, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
1185	zone, net))	1214	zone, net))
1186	goto out;	1215	goto out;
1187	if (chainlen++ > MAX_CHAINLEN) {	1216	if (chainlen++ > max_chainlen) {
1188	chaintoolong:	1217	chaintoolong:
1189	nf_ct_add_to_dying_list(ct);	1218	nf_ct_add_to_dying_list(ct);
1190	NF_CT_STAT_INC(net, chaintoolong);	1219	NF_CT_STAT_INC(net, chaintoolong);
@@ -1246,7 +1275,7 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple, · 55 unmodified lines
1246	rcu_read_lock();	1275	rcu_read_lock();
1247	begin:	1276	begin:
1248	nf_conntrack_get_ht(&ct_hash, &hsize);	1277	nf_conntrack_get_ht(&ct_hash, &hsize);
1249	hash = __hash_conntrack(net, tuple, hsize);	1278	hash = __hash_conntrack(net, tuple, nf_ct_zone_id(zone, IP_CT_DIR_REPLY), hsize);
1250		1279
1251	hlist_nulls_for_each_entry_rcu(h, n, &ct_hash[hash], hnnode) {	1280	hlist_nulls_for_each_entry_rcu(h, n, &ct_hash[hash], hnnode) {
1252	ct = nf_ct_tuplehash_to_ctrack(h);	1281	ct = nf_ct_tuplehash_to_ctrack(h);
@@ -1687,8 +1716,8 @@ resolve_normal_ct(struct nf_conn *tmpl, · 434 unmodified lines
1687	struct nf_conntrack_tuple_hash *h;	1716	struct nf_conntrack_tuple_hash *h;
1688	enum ip_conntrack_info ctinfo;	1717	enum ip_conntrack_info ctinfo;
1689	struct nf_conntrack_zone tmp;	1718	struct nf_conntrack_zone tmp;
		1719	u32 hash, zone_id, rid;
1690	struct nf_conn *ct;	1720	struct nf_conn *ct;
1691	u32 hash;
1692		1721
1693	if (!nf_ct_get_tuple(skb, skb_network_offset(skb),	1722	if (!nf_ct_get_tuple(skb, skb_network_offset(skb),
1694	dataoff, state->pf, protonum, state->net,	1723	dataoff, state->pf, protonum, state->net,
@@ -1699,8 +1728,20 @@ resolve_normal_ct(struct nf_conn *tmpl, · 4 unmodified lines
1699		1728
1700	/* look for tuple match */	1729	/* look for tuple match */
1701	zone = nf_ct_zone_tmpl(tmpl, skb, &tmp);	1730	zone = nf_ct_zone_tmpl(tmpl, skb, &tmp);
1702	hash = hash_conntrack_raw(&tuple, state->net);	1731
		1732	zone_id = nf_ct_zone_id(zone, IP_CT_DIR_ORIGINAL);
		1733	hash = hash_conntrack_raw(&tuple, zone_id, state->net);
1703	h = __nf_conntrack_find_get(state->net, zone, &tuple, hash);	1734	h = __nf_conntrack_find_get(state->net, zone, &tuple, hash);
		1735
		1736	if (!h) {
		1737	rid = nf_ct_zone_id(zone, IP_CT_DIR_REPLY);
		1738	if (zone_id != rid) {
		1739	u32 tmp = hash_conntrack_raw(&tuple, rid, state->net);
		1740
		1741	h = __nf_conntrack_find_get(state->net, zone, &tuple, tmp);
		1742	}
		1743	}
		1744
1704	if (!h) {	1745	if (!h) {
1705	h = init_conntrack(state->net, tmpl, &tuple,	1746	h = init_conntrack(state->net, tmpl, &tuple,
1706	skb, dataoff, hash);	1747	skb, dataoff, hash);
@@ -2225,28 +2266,31 @@ get_next_corpse(int (iter)(struct nf_conn i, void *data), · 518 unmodified lines
2225	spinlock_t *lockp;	2266	spinlock_t *lockp;
2226		2267
2227	for (; bucket < nf_conntrack_htable_size; (bucket)++) {	2268	for (; bucket < nf_conntrack_htable_size; (bucket)++) {
		2269	struct hlist_nulls_head hslot = &nf_conntrack_hash[bucket];
		2270
		2271	if (hlist_nulls_empty(hslot))
		2272	continue;
		2273
2228	lockp = &nf_conntrack_locks[*bucket % CONNTRACK_LOCKS];	2274	lockp = &nf_conntrack_locks[*bucket % CONNTRACK_LOCKS];
2229	local_bh_disable();	2275	local_bh_disable();
2230	nf_conntrack_lock(lockp);	2276	nf_conntrack_lock(lockp);
2231	if (*bucket < nf_conntrack_htable_size) {	2277	hlist_nulls_for_each_entry(h, n, hslot, hnnode) {
2232	hlist_nulls_for_each_entry(h, n, &nf_conntrack_hash[*bucket], hnnode) {	2278	if (NF_CT_DIRECTION(h) != IP_CT_DIR_REPLY)
2233	if (NF_CT_DIRECTION(h) != IP_CT_DIR_REPLY)	2279	continue;
2234	continue;	2280	/* All nf_conn objects are added to hash table twice, one
2235	/* All nf_conn objects are added to hash table twice, one	2281	* for original direction tuple, once for the reply tuple.
2236	* for original direction tuple, once for the reply tuple.	2282	*
2237	*	2283	* Exception: In the IPS_NAT_CLASH case, only the reply
2238	* Exception: In the IPS_NAT_CLASH case, only the reply	2284	* tuple is added (the original tuple already existed for
2239	* tuple is added (the original tuple already existed for	2285	* a different object).
2240	* a different object).	2286	*
2241	*	2287	* We only need to call the iterator once for each
2242	* We only need to call the iterator once for each	2288	* conntrack, so we just use the 'reply' direction
2243	* conntrack, so we just use the 'reply' direction	2289	* tuple while iterating.
2244	* tuple while iterating.	2290	*/
2245	*/	2291	ct = nf_ct_tuplehash_to_ctrack(h);
2246	ct = nf_ct_tuplehash_to_ctrack(h);	2292	if (iter(ct, data))
2247	if (iter(ct, data))	2293	goto found;
2248	goto found;
2249	}
2250	}	2294	}
2251	spin_unlock(lockp);	2295	spin_unlock(lockp);
2252	local_bh_enable();	2296	local_bh_enable();
@@ -2264,26 +2308,20 @@ found: · 11 unmodified lines
2264	static void nf_ct_iterate_cleanup(int (iter)(struct nf_conn i, void *data),	2308	static void nf_ct_iterate_cleanup(int (iter)(struct nf_conn i, void *data),
2265	void *data, u32 portid, int report)	2309	void *data, u32 portid, int report)
2266	{	2310	{
2267	unsigned int bucket = 0, sequence;	2311	unsigned int bucket = 0;
2268	struct nf_conn *ct;	2312	struct nf_conn *ct;
2269		2313
2270	might_sleep();	2314	might_sleep();
2271		2315
2272	for (;;) {	2316	mutex_lock(&nf_conntrack_mutex);
2273	sequence = read_seqcount_begin(&nf_conntrack_generation);	2317	while ((ct = get_next_corpse(iter, data, &bucket)) != NULL) {
2274		2318	/* Time to push up daises... */
2275	while ((ct = get_next_corpse(iter, data, &bucket)) != NULL) {
2276	/* Time to push up daises... */
2277		2319
2278	nf_ct_delete(ct, portid, report);	2320	nf_ct_delete(ct, portid, report);
2279	nf_ct_put(ct);	2321	nf_ct_put(ct);
2280	cond_resched();	2322	cond_resched();
2281	}
2282
2283	if (!read_seqcount_retry(&nf_conntrack_generation, sequence))
2284	break;
2285	bucket = 0;
2286	}	2323	}
		2324	mutex_unlock(&nf_conntrack_mutex);
2287	}	2325	}
2288		2326
2289	struct iter_data {	2327	struct iter_data {
@@ -2519,8 +2557,10 @@ int nf_conntrack_hash_resize(unsigned int hashsize) · 229 unmodified lines
2519	if (!hash)	2557	if (!hash)
2520	return -ENOMEM;	2558	return -ENOMEM;
2521		2559
		2560	mutex_lock(&nf_conntrack_mutex);
2522	old_size = nf_conntrack_htable_size;	2561	old_size = nf_conntrack_htable_size;
2523	if (old_size == hashsize) {	2562	if (old_size == hashsize) {
		2563	mutex_unlock(&nf_conntrack_mutex);
2524	kvfree(hash);	2564	kvfree(hash);
2525	return 0;	2565	return 0;
2526	}	2566	}
@@ -2537,12 +2577,16 @@ int nf_conntrack_hash_resize(unsigned int hashsize) · 10 unmodified lines
2537		2577
2538	for (i = 0; i < nf_conntrack_htable_size; i++) {	2578	for (i = 0; i < nf_conntrack_htable_size; i++) {
2539	while (!hlist_nulls_empty(&nf_conntrack_hash[i])) {	2579	while (!hlist_nulls_empty(&nf_conntrack_hash[i])) {
		2580	unsigned int zone_id;
		2581
2540	h = hlist_nulls_entry(nf_conntrack_hash[i].first,	2582	h = hlist_nulls_entry(nf_conntrack_hash[i].first,
2541	struct nf_conntrack_tuple_hash, hnnode);	2583	struct nf_conntrack_tuple_hash, hnnode);
2542	ct = nf_ct_tuplehash_to_ctrack(h);	2584	ct = nf_ct_tuplehash_to_ctrack(h);
2543	hlist_nulls_del_rcu(&h->hnnode);	2585	hlist_nulls_del_rcu(&h->hnnode);
		2586
		2587	zone_id = nf_ct_zone_id(nf_ct_zone(ct), NF_CT_DIRECTION(h));
2544	bucket = __hash_conntrack(nf_ct_net(ct),	2588	bucket = __hash_conntrack(nf_ct_net(ct),
2545	&h->tuple, hashsize);	2589	&h->tuple, zone_id, hashsize);
2546	hlist_nulls_add_head_rcu(&h->hnnode, &hash[bucket]);	2590	hlist_nulls_add_head_rcu(&h->hnnode, &hash[bucket]);
2547	}	2591	}
2548	}	2592	}
@@ -2556,6 +2600,8 @@ int nf_conntrack_hash_resize(unsigned int hashsize) · 7 unmodified lines
2556	nf_conntrack_all_unlock();	2600	nf_conntrack_all_unlock();
2557	local_bh_enable();	2601	local_bh_enable();
2558		2602
		2603	mutex_unlock(&nf_conntrack_mutex);
		2604
2559	synchronize_net();	2605	synchronize_net();
2560	kvfree(old_hash);	2606	kvfree(old_hash);
2561	return 0;	2607	return 0;

net/netfilter/nf_nat_core.c+12−5

 /* We keep an extra hash for each conntrack, for fast searching. */
 static unsigned int
-hash_by_src(const struct net *n, const struct nf_conntrack_tuple *tuple)
+hash_by_src(const struct net *net,
+	    const struct nf_conntrack_zone *zone,
+	    const struct nf_conntrack_tuple *tuple)
 {
 	unsigned int hash;
 	struct {
 		struct nf_conntrack_man src;
 		u32 net_mix;
 		u32 protonum;
+		u32 zone;
 	} __aligned(SIPHASH_ALIGNMENT) combined;
 	get_random_once(&nf_nat_hash_rnd, sizeof(nf_nat_hash_rnd));
 	/* Original src, to ensure we map it consistently if poss. */
 	combined.src = tuple->src;
-	combined.net_mix = net_hash_mix(n);
+	combined.net_mix = net_hash_mix(net);
 	combined.protonum = tuple->dst.protonum;
+	/* Zone ID can be used provided its valid for both directions */
+	if (zone->dir == NF_CT_DEFAULT_ZONE_DIR)
+		combined.zone = zone->id;
 	hash = siphash(&combined, sizeof(combined), &nf_nat_hash_rnd);
 	return reciprocal_scale(hash, nf_nat_htable_size);
 		     struct nf_conntrack_tuple *result,
 		     const struct nf_nat_range2 *range)
 {
-	unsigned int h = hash_by_src(net, tuple);
+	unsigned int h = hash_by_src(net, zone, tuple);
 	const struct nf_conn *ct;
 	hlist_for_each_entry_rcu(ct, &nf_nat_bysource[h], nat_bysource) {
 		unsigned int srchash;
 		spinlock_t *lock;
-		srchash = hash_by_src(net,
+		srchash = hash_by_src(net, nf_ct_zone(ct),
 				      &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
 		lock = &nf_nat_locks[srchash % CONNTRACK_LOCKS];
 		spin_lock_bh(lock);
 {
 	unsigned int h;
-	h = hash_by_src(nf_ct_net(ct), &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+	h = hash_by_src(nf_ct_net(ct), nf_ct_zone(ct), &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
 	spin_lock_bh(&nf_nat_locks[h % CONNTRACK_LOCKS]);
 	hlist_del_rcu(&ct->nat_bysource);
 	spin_unlock_bh(&nf_nat_locks[h % CONNTRACK_LOCKS]);

net/netfilter/nf_nat_masquerade.c+97−71

@@ -9,8 +9,19 @@ · 8 unmodified lines
9		9
10	#include <net/netfilter/nf_nat_masquerade.h>	10	#include <net/netfilter/nf_nat_masquerade.h>
11		11
		12	struct masq_dev_work {
		13	struct work_struct work;
		14	struct net *net;
		15	union nf_inet_addr addr;
		16	int ifindex;
		17	int (iter)(struct nf_conn i, void *data);
		18	};
		19
		20	#define MAX_MASQ_WORKER_COUNT 16
		21
12	static DEFINE_MUTEX(masq_mutex);	22	static DEFINE_MUTEX(masq_mutex);
13	static unsigned int masq_refcnt __read_mostly;	23	static unsigned int masq_refcnt __read_mostly;
		24	static atomic_t masq_worker_count __read_mostly;
14		25
15	unsigned int	26	unsigned int
16	nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,	27	nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
@@ -63,13 +74,71 @@ nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum, · 46 unmodified lines
63	}	74	}
64	EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4);	75	EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4);
65		76
66	static int device_cmp(struct nf_conn i, void ifindex)	77	static void iterate_cleanup_work(struct work_struct *work)
		78	{
		79	struct masq_dev_work *w;
		80
		81	w = container_of(work, struct masq_dev_work, work);
		82
		83	nf_ct_iterate_cleanup_net(w->net, w->iter, (void *)w, 0, 0);
		84
		85	put_net(w->net);
		86	kfree(w);
		87	atomic_dec(&masq_worker_count);
		88	module_put(THIS_MODULE);
		89	}
		90
		91	/* Iterate conntrack table in the background and remove conntrack entries
		92	* that use the device/address being removed.
		93	*
		94	* In case too many work items have been queued already or memory allocation
		95	* fails iteration is skipped, conntrack entries will time out eventually.
		96	*/
		97	static void nf_nat_masq_schedule(struct net net, union nf_inet_addr addr,
		98	int ifindex,
		99	int (iter)(struct nf_conn i, void *data),
		100	gfp_t gfp_flags)
		101	{
		102	struct masq_dev_work *w;
		103
		104	if (atomic_read(&masq_worker_count) > MAX_MASQ_WORKER_COUNT)
		105	return;
		106
		107	net = maybe_get_net(net);
		108	if (!net)
		109	return;
		110
		111	if (!try_module_get(THIS_MODULE))
		112	goto err_module;
		113
		114	w = kzalloc(sizeof(*w), gfp_flags);
		115	if (w) {
		116	/* We can overshoot MAX_MASQ_WORKER_COUNT, no big deal */
		117	atomic_inc(&masq_worker_count);
		118
		119	INIT_WORK(&w->work, iterate_cleanup_work);
		120	w->ifindex = ifindex;
		121	w->net = net;
		122	w->iter = iter;
		123	if (addr)
		124	w->addr = *addr;
		125	schedule_work(&w->work);
		126	return;
		127	}
		128
		129	module_put(THIS_MODULE);
		130	err_module:
		131	put_net(net);
		132	}
		133
		134	static int device_cmp(struct nf_conn i, void arg)
67	{	135	{
68	const struct nf_conn_nat *nat = nfct_nat(i);	136	const struct nf_conn_nat *nat = nfct_nat(i);
		137	const struct masq_dev_work *w = arg;
69		138
70	if (!nat)	139	if (!nat)
71	return 0;	140	return 0;
72	return nat->masq_index == (int)(long)ifindex;	141	return nat->masq_index == w->ifindex;
73	}	142	}
74		143
75	static int masq_device_event(struct notifier_block *this,	144	static int masq_device_event(struct notifier_block *this,
@@ -85,8 +154,8 @@ static int masq_device_event(struct notifier_block *this, · 9 unmodified lines
85	* and forget them.	154	* and forget them.
86	*/	155	*/
87		156
88	nf_ct_iterate_cleanup_net(net, device_cmp,	157	nf_nat_masq_schedule(net, NULL, dev->ifindex,
89	(void *)(long)dev->ifindex, 0, 0);	158	device_cmp, GFP_KERNEL);
90	}	159	}
91		160
92	return NOTIFY_DONE;	161	return NOTIFY_DONE;
@@ -94,35 +163,45 @@ static int masq_device_event(struct notifier_block *this, · 1 unmodified line
94		163
95	static int inet_cmp(struct nf_conn ct, void ptr)	164	static int inet_cmp(struct nf_conn ct, void ptr)
96	{	165	{
97	struct in_ifaddr ifa = (struct in_ifaddr )ptr;
98	struct net_device *dev = ifa->ifa_dev->dev;
99	struct nf_conntrack_tuple *tuple;	166	struct nf_conntrack_tuple *tuple;
		167	struct masq_dev_work *w = ptr;
100		168
101	if (!device_cmp(ct, (void *)(long)dev->ifindex))	169	if (!device_cmp(ct, ptr))
102	return 0;	170	return 0;
103		171
104	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;	172	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
105		173
106	return ifa->ifa_address == tuple->dst.u3.ip;	174	return nf_inet_addr_cmp(&w->addr, &tuple->dst.u3);
107	}	175	}
108		176
109	static int masq_inet_event(struct notifier_block *this,	177	static int masq_inet_event(struct notifier_block *this,
110	unsigned long event,	178	unsigned long event,
111	void *ptr)	179	void *ptr)
112	{	180	{
113	struct in_device idev = ((struct in_ifaddr )ptr)->ifa_dev;	181	const struct in_ifaddr *ifa = ptr;
114	struct net *net = dev_net(idev->dev);	182	const struct in_device *idev;
		183	const struct net_device *dev;
		184	union nf_inet_addr addr;
		185
		186	if (event != NETDEV_DOWN)
		187	return NOTIFY_DONE;
115		188
116	/* The masq_dev_notifier will catch the case of the device going	189	/* The masq_dev_notifier will catch the case of the device going
117	* down. So if the inetdev is dead and being destroyed we have	190	* down. So if the inetdev is dead and being destroyed we have
118	* no work to do. Otherwise this is an individual address removal	191	* no work to do. Otherwise this is an individual address removal
119	* and we have to perform the flush.	192	* and we have to perform the flush.
120	*/	193	*/
		194	idev = ifa->ifa_dev;
121	if (idev->dead)	195	if (idev->dead)
122	return NOTIFY_DONE;	196	return NOTIFY_DONE;
123		197
124	if (event == NETDEV_DOWN)	198	memset(&addr, 0, sizeof(addr));
125	nf_ct_iterate_cleanup_net(net, inet_cmp, ptr, 0, 0);	199
		200	addr.ip = ifa->ifa_address;
		201
		202	dev = idev->dev;
		203	nf_nat_masq_schedule(dev_net(idev->dev), &addr, dev->ifindex,
		204	inet_cmp, GFP_KERNEL);
126		205
127	return NOTIFY_DONE;	206	return NOTIFY_DONE;
128	}	207	}
@@ -136,8 +215,6 @@ static struct notifier_block masq_inet_notifier = { · 7 unmodified lines
136	};	215	};
137		216
138	#if IS_ENABLED(CONFIG_IPV6)	217	#if IS_ENABLED(CONFIG_IPV6)
139	static atomic_t v6_worker_count __read_mostly;
140
141	static int	218	static int
142	nat_ipv6_dev_get_saddr(struct net net, const struct net_device dev,	219	nat_ipv6_dev_get_saddr(struct net net, const struct net_device dev,
143	const struct in6_addr *daddr, unsigned int srcprefs,	220	const struct in6_addr *daddr, unsigned int srcprefs,
@@ -187,40 +264,6 @@ nf_nat_masquerade_ipv6(struct sk_buff skb, const struct nf_nat_range2 range, · 43 unmodified lines
187	}	264	}
188	EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv6);	265	EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv6);
189		266
190	struct masq_dev_work {
191	struct work_struct work;
192	struct net *net;
193	struct in6_addr addr;
194	int ifindex;
195	};
196
197	static int inet6_cmp(struct nf_conn ct, void work)
198	{
199	struct masq_dev_work w = (struct masq_dev_work )work;
200	struct nf_conntrack_tuple *tuple;
201
202	if (!device_cmp(ct, (void *)(long)w->ifindex))
203	return 0;
204
205	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
206
207	return ipv6_addr_equal(&w->addr, &tuple->dst.u3.in6);
208	}
209
210	static void iterate_cleanup_work(struct work_struct *work)
211	{
212	struct masq_dev_work *w;
213
214	w = container_of(work, struct masq_dev_work, work);
215
216	nf_ct_iterate_cleanup_net(w->net, inet6_cmp, (void *)w, 0, 0);
217
218	put_net(w->net);
219	kfree(w);
220	atomic_dec(&v6_worker_count);
221	module_put(THIS_MODULE);
222	}
223
224	/* atomic notifier; can't call nf_ct_iterate_cleanup_net (it can sleep).	267	/* atomic notifier; can't call nf_ct_iterate_cleanup_net (it can sleep).
225	*	268	*
226	* Defer it to the system workqueue.	269	* Defer it to the system workqueue.
@@ -233,36 +276,19 @@ static int masq_inet6_event(struct notifier_block *this, · 6 unmodified lines
233	{	276	{
234	struct inet6_ifaddr *ifa = ptr;	277	struct inet6_ifaddr *ifa = ptr;
235	const struct net_device *dev;	278	const struct net_device *dev;
236	struct masq_dev_work *w;	279	union nf_inet_addr addr;
237	struct net *net;
238		280
239	if (event != NETDEV_DOWN \|\| atomic_read(&v6_worker_count) >= 16)	281	if (event != NETDEV_DOWN)
240	return NOTIFY_DONE;	282	return NOTIFY_DONE;
241		283
242	dev = ifa->idev->dev;	284	dev = ifa->idev->dev;
243	net = maybe_get_net(dev_net(dev));
244	if (!net)
245	return NOTIFY_DONE;
246		285
247	if (!try_module_get(THIS_MODULE))	286	memset(&addr, 0, sizeof(addr));
248	goto err_module;
249		287
250	w = kmalloc(sizeof(*w), GFP_ATOMIC);	288	addr.in6 = ifa->addr;
251	if (w) {
252	atomic_inc(&v6_worker_count);
253
254	INIT_WORK(&w->work, iterate_cleanup_work);
255	w->ifindex = dev->ifindex;
256	w->net = net;
257	w->addr = ifa->addr;
258	schedule_work(&w->work);
259		289
260	return NOTIFY_DONE;	290	nf_nat_masq_schedule(dev_net(dev), &addr, dev->ifindex, inet_cmp,
261	}	291	GFP_ATOMIC);
262
263	module_put(THIS_MODULE);
264	err_module:
265	put_net(net);
266	return NOTIFY_DONE;	292	return NOTIFY_DONE;
267	}	293	}
268		294

net/netfilter/nf_tables_api.c+19−11

@@ -4336,7 +4336,7 @@ static int nf_tables_newset(struct sk_buff skb, const struct nfnl_info info, · 4335 unmodified lines
4336	if (ops->privsize != NULL)	4336	if (ops->privsize != NULL)
4337	size = ops->privsize(nla, &desc);	4337	size = ops->privsize(nla, &desc);
4338	alloc_size = sizeof(*set) + size + udlen;	4338	alloc_size = sizeof(*set) + size + udlen;
4339	if (alloc_size < size)	4339	if (alloc_size < size \|\| alloc_size > INT_MAX)
4340	return -ENOMEM;	4340	return -ENOMEM;
4341	set = kvzalloc(alloc_size, GFP_KERNEL);	4341	set = kvzalloc(alloc_size, GFP_KERNEL);
4342	if (!set)	4342	if (!set)
@@ -9599,7 +9599,6 @@ static void __nft_release_table(struct net net, struct nft_table table) · 5256 unmodified lines
9599	table->use--;	9599	table->use--;
9600	nf_tables_chain_destroy(&ctx);	9600	nf_tables_chain_destroy(&ctx);
9601	}	9601	}
9602	list_del(&table->list);
9603	nf_tables_table_destroy(&ctx);	9602	nf_tables_table_destroy(&ctx);
9604	}	9603	}
9605		9604
@@ -9612,6 +9611,8 @@ static void __nft_release_tables(struct net *net) · 6 unmodified lines
9612	if (nft_table_has_owner(table))	9611	if (nft_table_has_owner(table))
9613	continue;	9612	continue;
9614		9613
		9614	list_del(&table->list);
		9615
9615	__nft_release_table(net, table);	9616	__nft_release_table(net, table);
9616	}	9617	}
9617	}	9618	}
@@ -9619,31 +9620,38 @@ static void __nft_release_tables(struct net *net) · 1 unmodified line
9619	static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event,	9620	static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event,
9620	void *ptr)	9621	void *ptr)
9621	{	9622	{
		9623	struct nft_table table, to_delete[8];
9622	struct nftables_pernet *nft_net;	9624	struct nftables_pernet *nft_net;
9623	struct netlink_notify *n = ptr;	9625	struct netlink_notify *n = ptr;
9624	struct nft_table table, nt;
9625	struct net *net = n->net;	9626	struct net *net = n->net;
9626	bool release = false;	9627	unsigned int deleted;
		9628	bool restart = false;
9627		9629
9628	if (event != NETLINK_URELEASE \|\| n->protocol != NETLINK_NETFILTER)	9630	if (event != NETLINK_URELEASE \|\| n->protocol != NETLINK_NETFILTER)
9629	return NOTIFY_DONE;	9631	return NOTIFY_DONE;
9630		9632
9631	nft_net = nft_pernet(net);	9633	nft_net = nft_pernet(net);
		9634	deleted = 0;
9632	mutex_lock(&nft_net->commit_mutex);	9635	mutex_lock(&nft_net->commit_mutex);
		9636	again:
9633	list_for_each_entry(table, &nft_net->tables, list) {	9637	list_for_each_entry(table, &nft_net->tables, list) {
9634	if (nft_table_has_owner(table) &&	9638	if (nft_table_has_owner(table) &&
9635	n->portid == table->nlpid) {	9639	n->portid == table->nlpid) {
9636	__nft_release_hook(net, table);	9640	__nft_release_hook(net, table);
9637	release = true;	9641	list_del_rcu(&table->list);
		9642	to_delete[deleted++] = table;
		9643	if (deleted >= ARRAY_SIZE(to_delete))
		9644	break;
9638	}	9645	}
9639	}	9646	}
9640	if (release) {	9647	if (deleted) {
		9648	restart = deleted >= ARRAY_SIZE(to_delete);
9641	synchronize_rcu();	9649	synchronize_rcu();
9642	list_for_each_entry_safe(table, nt, &nft_net->tables, list) {	9650	while (deleted)
9643	if (nft_table_has_owner(table) &&	9651	__nft_release_table(net, to_delete[--deleted]);
9644	n->portid == table->nlpid)	9652
9645	__nft_release_table(net, table);	9653	if (restart)
9646	}	9654	goto again;
9647	}	9655	}
9648	mutex_unlock(&nft_net->commit_mutex);	9656	mutex_unlock(&nft_net->commit_mutex);
9649		9657

net/netfilter/nft_compat.c+16−1

@@ -19,6 +19,7 @@ · 18 unmodified lines
19	#include <linux/netfilter_bridge/ebtables.h>	19	#include <linux/netfilter_bridge/ebtables.h>
20	#include <linux/netfilter_arp/arp_tables.h>	20	#include <linux/netfilter_arp/arp_tables.h>
21	#include <net/netfilter/nf_tables.h>	21	#include <net/netfilter/nf_tables.h>
		22	#include <net/netfilter/nf_log.h>
22		23
23	/* Used for matches where info is larger than X byte /	24	/* Used for matches where info is larger than X byte /
24	#define NFT_MATCH_LARGE_THRESH 192	25	#define NFT_MATCH_LARGE_THRESH 192
@@ -257,8 +258,22 @@ nft_target_init(const struct nft_ctx ctx, const struct nft_expr expr, · 232 unmodified lines
257	nft_compat_wait_for_destructors();	258	nft_compat_wait_for_destructors();
258		259
259	ret = xt_check_target(&par, size, proto, inv);	260	ret = xt_check_target(&par, size, proto, inv);
260	if (ret < 0)	261	if (ret < 0) {
		262	if (ret == -ENOENT) {
		263	const char *modname = NULL;
		264
		265	if (strcmp(target->name, "LOG") == 0)
		266	modname = "nf_log_syslog";
		267	else if (strcmp(target->name, "NFLOG") == 0)
		268	modname = "nfnetlink_log";
		269
		270	if (modname &&
		271	nft_request_module(ctx->net, "%s", modname) == -EAGAIN)
		272	return -EAGAIN;
		273	}
		274
261	return ret;	275	return ret;
		276	}
262		277
263	/* The standard target cannot be used */	278	/* The standard target cannot be used */
264	if (!target->target)	279	if (!target->target)

net/netfilter/xt_LOG.c+9−1

 static int log_tg_check(const struct xt_tgchk_param *par)
 {
 	const struct xt_log_info *loginfo = par->targinfo;
+	int ret;
 	if (par->family != NFPROTO_IPV4 && par->family != NFPROTO_IPV6)
 		return -EINVAL;
 		return -EINVAL;
 	}
-	return nf_logger_find_get(par->family, NF_LOG_TYPE_LOG);
+	ret = nf_logger_find_get(par->family, NF_LOG_TYPE_LOG);
+	if (ret != 0 && !par->nft_compat) {
+		request_module("%s", "nf_log_syslog");
+		ret = nf_logger_find_get(par->family, NF_LOG_TYPE_LOG);
+	}
+	return ret;
 }
 static void log_tg_destroy(const struct xt_tgdtor_param *par)

net/netfilter/xt_NFLOG.c+9−1

 static int nflog_tg_check(const struct xt_tgchk_param *par)
 {
 	const struct xt_nflog_info *info = par->targinfo;
+	int ret;
 	if (info->flags & ~XT_NFLOG_MASK)
 		return -EINVAL;
 	if (info->prefix[sizeof(info->prefix) - 1] != '\0')
 		return -EINVAL;
-	return nf_logger_find_get(par->family, NF_LOG_TYPE_ULOG);
+	ret = nf_logger_find_get(par->family, NF_LOG_TYPE_ULOG);
+	if (ret != 0 && !par->nft_compat) {
+		request_module("%s", "nfnetlink_log");
+		ret = nf_logger_find_get(par->family, NF_LOG_TYPE_ULOG);
+	}
+	return ret;
 }
 static void nflog_tg_destroy(const struct xt_tgdtor_param *par)

net/sched/cls_flower.c+6−0

 	arg->count = arg->skip;
+	rcu_read_lock();
 	idr_for_each_entry_continue_ul(&head->handle_idr, f, tmp, id) {
 		/* don't return filters that are being deleted */
 		if (!refcount_inc_not_zero(&f->refcnt))
 			continue;
+		rcu_read_unlock();
 		if (arg->fn(tp, f, arg) < 0) {
 			__fl_put(f);
 			arg->stop = 1;
+			rcu_read_lock();
 			break;
 		}
 		__fl_put(f);
 		arg->count++;
+		rcu_read_lock();
 	}
+	rcu_read_unlock();
 	arg->cookie = id;
 }

net/sched/sch_api.c+6−0

 		return stab;
 	}
+	if (s->size_log > STAB_SIZE_LOG_MAX ||
+	    s->cell_log > STAB_SIZE_LOG_MAX) {
+		NL_SET_ERR_MSG(extack, "Invalid logarithmic size of size table");
+		return ERR_PTR(-EINVAL);
+	}
 	stab = kmalloc(sizeof(*stab) + tsize * sizeof(u16), GFP_KERNEL);
 	if (!stab)
 		return ERR_PTR(-ENOMEM);

net/sctp/input.c+1−1

@@ -702,7 +702,7 @@ static int sctp_rcv_ootb(struct sk_buff *skb) · 701 unmodified lines
702	ch = skb_header_pointer(skb, offset, sizeof(*ch), &_ch);	702	ch = skb_header_pointer(skb, offset, sizeof(*ch), &_ch);
703		703
704	/* Break out if chunk length is less then minimal. */	704	/* Break out if chunk length is less then minimal. */
705	if (ntohs(ch->length) < sizeof(_ch))	705	if (!ch \|\| ntohs(ch->length) < sizeof(_ch))
706	break;	706	break;
707		707
708	ch_end = offset + SCTP_PAD4(ntohs(ch->length));	708	ch_end = offset + SCTP_PAD4(ntohs(ch->length));

net/unix/af_unix.c+60−23

@@ -608,20 +608,42 @@ static void unix_release_sock(struct sock *sk, int embrion) · 607 unmodified lines
608		608
609	static void init_peercred(struct sock *sk)	609	static void init_peercred(struct sock *sk)
610	{	610	{
611	put_pid(sk->sk_peer_pid);	611	const struct cred *old_cred;
612	if (sk->sk_peer_cred)	612	struct pid *old_pid;
613	put_cred(sk->sk_peer_cred);	613
		614	spin_lock(&sk->sk_peer_lock);
		615	old_pid = sk->sk_peer_pid;
		616	old_cred = sk->sk_peer_cred;
614	sk->sk_peer_pid = get_pid(task_tgid(current));	617	sk->sk_peer_pid = get_pid(task_tgid(current));
615	sk->sk_peer_cred = get_current_cred();	618	sk->sk_peer_cred = get_current_cred();
		619	spin_unlock(&sk->sk_peer_lock);
		620
		621	put_pid(old_pid);
		622	put_cred(old_cred);
616	}	623	}
617		624
618	static void copy_peercred(struct sock sk, struct sock peersk)	625	static void copy_peercred(struct sock sk, struct sock peersk)
619	{	626	{
620	put_pid(sk->sk_peer_pid);	627	const struct cred *old_cred;
621	if (sk->sk_peer_cred)	628	struct pid *old_pid;
622	put_cred(sk->sk_peer_cred);	629
		630	if (sk < peersk) {
		631	spin_lock(&sk->sk_peer_lock);
		632	spin_lock_nested(&peersk->sk_peer_lock, SINGLE_DEPTH_NESTING);
		633	} else {
		634	spin_lock(&peersk->sk_peer_lock);
		635	spin_lock_nested(&sk->sk_peer_lock, SINGLE_DEPTH_NESTING);
		636	}
		637	old_pid = sk->sk_peer_pid;
		638	old_cred = sk->sk_peer_cred;
623	sk->sk_peer_pid = get_pid(peersk->sk_peer_pid);	639	sk->sk_peer_pid = get_pid(peersk->sk_peer_pid);
624	sk->sk_peer_cred = get_cred(peersk->sk_peer_cred);	640	sk->sk_peer_cred = get_cred(peersk->sk_peer_cred);
		641
		642	spin_unlock(&sk->sk_peer_lock);
		643	spin_unlock(&peersk->sk_peer_lock);
		644
		645	put_pid(old_pid);
		646	put_cred(old_cred);
625	}	647	}
626		648
627	static int unix_listen(struct socket *sock, int backlog)	649	static int unix_listen(struct socket *sock, int backlog)
@@ -828,20 +850,25 @@ struct proto unix_stream_proto = { · 200 unmodified lines
828		850
829	static struct sock unix_create1(struct net net, struct socket *sock, int kern, int type)	851	static struct sock unix_create1(struct net net, struct socket *sock, int kern, int type)
830	{	852	{
831	struct sock *sk = NULL;
832	struct unix_sock *u;	853	struct unix_sock *u;
		854	struct sock *sk;
		855	int err;
833		856
834	atomic_long_inc(&unix_nr_socks);	857	atomic_long_inc(&unix_nr_socks);
835	if (atomic_long_read(&unix_nr_socks) > 2 * get_max_files())	858	if (atomic_long_read(&unix_nr_socks) > 2 * get_max_files()) {
836	goto out;	859	err = -ENFILE;
		860	goto err;
		861	}
837		862
838	if (type == SOCK_STREAM)	863	if (type == SOCK_STREAM)
839	sk = sk_alloc(net, PF_UNIX, GFP_KERNEL, &unix_stream_proto, kern);	864	sk = sk_alloc(net, PF_UNIX, GFP_KERNEL, &unix_stream_proto, kern);
840	else /dgram and seqpacket /	865	else /dgram and seqpacket /
841	sk = sk_alloc(net, PF_UNIX, GFP_KERNEL, &unix_dgram_proto, kern);	866	sk = sk_alloc(net, PF_UNIX, GFP_KERNEL, &unix_dgram_proto, kern);
842		867
843	if (!sk)	868	if (!sk) {
844	goto out;	869	err = -ENOMEM;
		870	goto err;
		871	}
845		872
846	sock_init_data(sock, sk);	873	sock_init_data(sock, sk);
847		874
@@ -861,20 +888,23 @@ static struct sock unix_create1(struct net net, struct socket *sock, int kern, · 13 unmodified lines
861	init_waitqueue_func_entry(&u->peer_wake, unix_dgram_peer_wake_relay);	888	init_waitqueue_func_entry(&u->peer_wake, unix_dgram_peer_wake_relay);
862	memset(&u->scm_stat, 0, sizeof(struct scm_stat));	889	memset(&u->scm_stat, 0, sizeof(struct scm_stat));
863	unix_insert_socket(unix_sockets_unbound(sk), sk);	890	unix_insert_socket(unix_sockets_unbound(sk), sk);
864	out:	891
865	if (sk == NULL)	892	local_bh_disable();
866	atomic_long_dec(&unix_nr_socks);	893	sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
867	else {	894	local_bh_enable();
868	local_bh_disable();	895
869	sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
870	local_bh_enable();
871	}
872	return sk;	896	return sk;
		897
		898	err:
		899	atomic_long_dec(&unix_nr_socks);
		900	return ERR_PTR(err);
873	}	901	}
874		902
875	static int unix_create(struct net net, struct socket sock, int protocol,	903	static int unix_create(struct net net, struct socket sock, int protocol,
876	int kern)	904	int kern)
877	{	905	{
		906	struct sock *sk;
		907
878	if (protocol && protocol != PF_UNIX)	908	if (protocol && protocol != PF_UNIX)
879	return -EPROTONOSUPPORT;	909	return -EPROTONOSUPPORT;
880		910
@@ -901,7 +931,11 @@ static int unix_create(struct net net, struct socket sock, int protocol, · 20 unmodified lines
901	return -ESOCKTNOSUPPORT;	931	return -ESOCKTNOSUPPORT;
902	}	932	}
903		933
904	return unix_create1(net, sock, kern, sock->type) ? 0 : -ENOMEM;	934	sk = unix_create1(net, sock, kern, sock->type);
		935	if (IS_ERR(sk))
		936	return PTR_ERR(sk);
		937
		938	return 0;
905	}	939	}
906		940
907	static int unix_release(struct socket *sock)	941	static int unix_release(struct socket *sock)
@@ -1314,12 +1348,15 @@ static int unix_stream_connect(struct socket sock, struct sockaddr uaddr, · 406 unmodified lines
1314	we will have to recheck all again in any case.	1348	we will have to recheck all again in any case.
1315	*/	1349	*/
1316		1350
1317	err = -ENOMEM;
1318
1319	/* create new sock for complete connection */	1351	/* create new sock for complete connection */
1320	newsk = unix_create1(sock_net(sk), NULL, 0, sock->type);	1352	newsk = unix_create1(sock_net(sk), NULL, 0, sock->type);
1321	if (newsk == NULL)	1353	if (IS_ERR(newsk)) {
		1354	err = PTR_ERR(newsk);
		1355	newsk = NULL;
1322	goto out;	1356	goto out;
		1357	}
		1358
		1359	err = -ENOMEM;
1323		1360
1324	/* Allocate skb for sending to listening sock */	1361	/* Allocate skb for sending to listening sock */
1325	skb = sock_wmalloc(newsk, 1, 0, GFP_KERNEL);	1362	skb = sock_wmalloc(newsk, 1, 0, GFP_KERNEL);

sound/core/rawmidi.c+9−0

 			return -EINVAL;
 		}
 	}
+	case SNDRV_RAWMIDI_IOCTL_USER_PVERSION:
+		if (get_user(rfile->user_pversion, (unsigned int __user *)arg))
+			return -EFAULT;
+		return 0;
 	case SNDRV_RAWMIDI_IOCTL_PARAMS:
 	{
 		struct snd_rawmidi_params params;
 		if (copy_from_user(&params, argp, sizeof(struct snd_rawmidi_params)))
 			return -EFAULT;
+		if (rfile->user_pversion < SNDRV_PROTOCOL_VERSION(2, 0, 2)) {
+			params.mode = 0;
+			memset(params.reserved, 0, sizeof(params.reserved));
+		}
 		switch (params.stream) {
 		case SNDRV_RAWMIDI_STREAM_OUTPUT:
 			if (rfile->output == NULL)

sound/drivers/pcsp/pcsp_lib.c+1−1

@@ -143,7 +143,7 @@ enum hrtimer_restart pcsp_do_timer(struct hrtimer *handle) · 142 unmodified lines
143	if (pointer_update)	143	if (pointer_update)
144	pcsp_pointer_update(chip);	144	pcsp_pointer_update(chip);
145		145
146	hrtimer_forward(handle, hrtimer_get_expires(handle), ns_to_ktime(ns));	146	hrtimer_forward_now(handle, ns_to_ktime(ns));
147		147
148	return HRTIMER_RESTART;	148	return HRTIMER_RESTART;
149	}	149	}

sound/firewire/motu/amdtp-motu.c+4−3

 	/* This is just for v2/v3 protocol. */
 	for (i = 0; i < data_blocks; ++i) {
-		*frames = (be32_to_cpu(buffer[1]) << 16) |
+		*frames = be32_to_cpu(buffer[1]);
-			  (be32_to_cpu(buffer[2]) >> 16);
+		*frames <<= 16;
+		*frames |= be32_to_cpu(buffer[2]) >> 16;
+		++frames;
 		buffer += data_block_quadlets;
-		frames++;
 	}
 }

sound/firewire/oxfw/oxfw.c+8−5

 			model = val;
 	}
-	/*
+	if (vendor == VENDOR_LOUD) {
-	 * Mackie Onyx Satellite with base station has a quirk to report a wrong
+		// Mackie Onyx Satellite with base station has a quirk to report a wrong
-	 * value in 'dbs' field of CIP header against its format information.
+		// value in 'dbs' field of CIP header against its format information.
-	 */
-	if (vendor == VENDOR_LOUD && model == MODEL_SATELLITE)
 		oxfw->quirks |= SND_OXFW_QUIRK_WRONG_DBS;
+		// OXFW971-based models may transfer events by blocking method.
+		if (!(oxfw->quirks & SND_OXFW_QUIRK_JUMBO_PAYLOAD))
+			oxfw->quirks |= SND_OXFW_QUIRK_BLOCKING_TRANSMISSION;
+	}
 	return 0;
 }

sound/pci/hda/hda_intel.c+9−3

 	return azx_get_pos_posbuf(chip, azx_dev);
 }
-static void azx_shutdown_chip(struct azx *chip)
+static void __azx_shutdown_chip(struct azx *chip, bool skip_link_reset)
 {
 	azx_stop_chip(chip);
-	azx_enter_link_reset(chip);
+	if (!skip_link_reset)
+		azx_enter_link_reset(chip);
 	azx_clear_irq_pending(chip);
 	display_power(chip, false);
 }
 static DEFINE_MUTEX(card_list_lock);
 static LIST_HEAD(card_list);
+static void azx_shutdown_chip(struct azx *chip)
+{
+	__azx_shutdown_chip(chip, false);
+}
 static void azx_add_card_list(struct azx *chip)
 {
 	struct hda_intel *hda = container_of(chip, struct hda_intel, chip);
 		return;
 	chip = card->private_data;
 	if (chip && chip->running)
-		azx_shutdown_chip(chip);
+		__azx_shutdown_chip(chip, true);
 }
 /* PCI IDs */

sound/pci/hda/patch_cs8409.c+3−0

@@ -1207,6 +1207,9 @@ void dolphin_fixups(struct hda_codec codec, const struct hda_fixup fix, int ac · 1206 unmodified lines
1207	snd_hda_jack_add_kctl(codec, DOLPHIN_LO_PIN_NID, "Line Out", true,	1207	snd_hda_jack_add_kctl(codec, DOLPHIN_LO_PIN_NID, "Line Out", true,
1208	SND_JACK_HEADPHONE, NULL);	1208	SND_JACK_HEADPHONE, NULL);
1209		1209
		1210	snd_hda_jack_add_kctl(codec, DOLPHIN_AMIC_PIN_NID, "Microphone", true,
		1211	SND_JACK_MICROPHONE, NULL);
		1212
1210	cs8409_fix_caps(codec, DOLPHIN_HP_PIN_NID);	1213	cs8409_fix_caps(codec, DOLPHIN_HP_PIN_NID);
1211	cs8409_fix_caps(codec, DOLPHIN_LO_PIN_NID);	1214	cs8409_fix_caps(codec, DOLPHIN_LO_PIN_NID);
1212	cs8409_fix_caps(codec, DOLPHIN_AMIC_PIN_NID);	1215	cs8409_fix_caps(codec, DOLPHIN_AMIC_PIN_NID);

sound/pci/hda/patch_realtek.c+129−0

@@ -6429,6 +6429,20 @@ static void alc_fixup_thinkpad_acpi(struct hda_codec *codec, · 6428 unmodified lines
6429	hda_fixup_thinkpad_acpi(codec, fix, action);	6429	hda_fixup_thinkpad_acpi(codec, fix, action);
6430	}	6430	}
6431		6431
		6432	/* Fixup for Lenovo Legion 15IMHg05 speaker output on headset removal. */
		6433	static void alc287_fixup_legion_15imhg05_speakers(struct hda_codec *codec,
		6434	const struct hda_fixup *fix,
		6435	int action)
		6436	{
		6437	struct alc_spec *spec = codec->spec;
		6438
		6439	switch (action) {
		6440	case HDA_FIXUP_ACT_PRE_PROBE:
		6441	spec->gen.suppress_auto_mute = 1;
		6442	break;
		6443	}
		6444	}
		6445
6432	/* for alc295_fixup_hp_top_speakers */	6446	/* for alc295_fixup_hp_top_speakers */
6433	#include "hp_x360_helper.c"	6447	#include "hp_x360_helper.c"
6434		6448
@@ -6646,6 +6660,10 @@ enum { · 211 unmodified lines
6646	ALC623_FIXUP_LENOVO_THINKSTATION_P340,	6660	ALC623_FIXUP_LENOVO_THINKSTATION_P340,
6647	ALC255_FIXUP_ACER_HEADPHONE_AND_MIC,	6661	ALC255_FIXUP_ACER_HEADPHONE_AND_MIC,
6648	ALC236_FIXUP_HP_LIMIT_INT_MIC_BOOST,	6662	ALC236_FIXUP_HP_LIMIT_INT_MIC_BOOST,
		6663	ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS,
		6664	ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE,
		6665	ALC287_FIXUP_YOGA7_14ITL_SPEAKERS,
		6666	ALC287_FIXUP_13S_GEN2_SPEAKERS
6649	};	6667	};
6650		6668
6651	static const struct hda_fixup alc269_fixups[] = {	6669	static const struct hda_fixup alc269_fixups[] = {
@@ -8236,6 +8254,113 @@ static const struct hda_fixup alc269_fixups[] = { · 1584 unmodified lines
8236	.chained = true,	8254	.chained = true,
8237	.chain_id = ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF,	8255	.chain_id = ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF,
8238	},	8256	},
		8257	[ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS] = {
		8258	.type = HDA_FIXUP_VERBS,
		8259	//.v.verbs = legion_15imhg05_coefs,
		8260	.v.verbs = (const struct hda_verb[]) {
		8261	// set left speaker Legion 7i.
		8262	{ 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
		8263	{ 0x20, AC_VERB_SET_PROC_COEF, 0x41 },
		8264
		8265	{ 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
		8266	{ 0x20, AC_VERB_SET_PROC_COEF, 0xc },
		8267	{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
		8268	{ 0x20, AC_VERB_SET_PROC_COEF, 0x1a },
		8269	{ 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
		8270
		8271	{ 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
		8272	{ 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
		8273	{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
		8274	{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
		8275	{ 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
		8276
		8277	// set right speaker Legion 7i.
		8278	{ 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
		8279	{ 0x20, AC_VERB_SET_PROC_COEF, 0x42 },
		8280
		8281	{ 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
		8282	{ 0x20, AC_VERB_SET_PROC_COEF, 0xc },
		8283	{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
		8284	{ 0x20, AC_VERB_SET_PROC_COEF, 0x2a },
		8285	{ 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
		8286
		8287	{ 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
		8288	{ 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
		8289	{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
		8290	{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
		8291	{ 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
		8292	{}
		8293	},
		8294	.chained = true,
		8295	.chain_id = ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE,
		8296	},
		8297	[ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE] = {
		8298	.type = HDA_FIXUP_FUNC,
		8299	.v.func = alc287_fixup_legion_15imhg05_speakers,
		8300	.chained = true,
		8301	.chain_id = ALC269_FIXUP_HEADSET_MODE,
		8302	},
		8303	[ALC287_FIXUP_YOGA7_14ITL_SPEAKERS] = {
		8304	.type = HDA_FIXUP_VERBS,
		8305	.v.verbs = (const struct hda_verb[]) {
		8306	// set left speaker Yoga 7i.
		8307	{ 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
		8308	{ 0x20, AC_VERB_SET_PROC_COEF, 0x41 },
		8309
		8310	{ 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
		8311	{ 0x20, AC_VERB_SET_PROC_COEF, 0xc },
		8312	{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
		8313	{ 0x20, AC_VERB_SET_PROC_COEF, 0x1a },
		8314	{ 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
		8315
		8316	{ 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
		8317	{ 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
		8318	{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
		8319	{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
		8320	{ 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
		8321
		8322	// set right speaker Yoga 7i.
		8323	{ 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
		8324	{ 0x20, AC_VERB_SET_PROC_COEF, 0x46 },
		8325
		8326	{ 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
		8327	{ 0x20, AC_VERB_SET_PROC_COEF, 0xc },
		8328	{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
		8329	{ 0x20, AC_VERB_SET_PROC_COEF, 0x2a },
		8330	{ 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
		8331
		8332	{ 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
		8333	{ 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
		8334	{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
		8335	{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
		8336	{ 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
		8337	{}
		8338	},
		8339	.chained = true,
		8340	.chain_id = ALC269_FIXUP_HEADSET_MODE,
		8341	},
		8342	[ALC287_FIXUP_13S_GEN2_SPEAKERS] = {
		8343	.type = HDA_FIXUP_VERBS,
		8344	.v.verbs = (const struct hda_verb[]) {
		8345	{ 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
		8346	{ 0x20, AC_VERB_SET_PROC_COEF, 0x41 },
		8347	{ 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
		8348	{ 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
		8349	{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
		8350	{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
		8351	{ 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
		8352	{ 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
		8353	{ 0x20, AC_VERB_SET_PROC_COEF, 0x42 },
		8354	{ 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
		8355	{ 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
		8356	{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
		8357	{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
		8358	{ 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
		8359	{}
		8360	},
		8361	.chained = true,
		8362	.chain_id = ALC269_FIXUP_HEADSET_MODE,
		8363	},
8239	};	8364	};
8240		8365
8241	static const struct snd_pci_quirk alc269_fixup_tbl[] = {	8366	static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -8630,6 +8755,10 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { · 388 unmodified lines
8630	SND_PCI_QUIRK(0x17aa, 0x3818, "Lenovo C940", ALC298_FIXUP_LENOVO_SPK_VOLUME),	8755	SND_PCI_QUIRK(0x17aa, 0x3818, "Lenovo C940", ALC298_FIXUP_LENOVO_SPK_VOLUME),
8631	SND_PCI_QUIRK(0x17aa, 0x3827, "Ideapad S740", ALC285_FIXUP_IDEAPAD_S740_COEF),	8756	SND_PCI_QUIRK(0x17aa, 0x3827, "Ideapad S740", ALC285_FIXUP_IDEAPAD_S740_COEF),
8632	SND_PCI_QUIRK(0x17aa, 0x3843, "Yoga 9i", ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP),	8757	SND_PCI_QUIRK(0x17aa, 0x3843, "Yoga 9i", ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP),
		8758	SND_PCI_QUIRK(0x17aa, 0x3813, "Legion 7i 15IMHG05", ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS),
		8759	SND_PCI_QUIRK(0x17aa, 0x3852, "Lenovo Yoga 7 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
		8760	SND_PCI_QUIRK(0x17aa, 0x3853, "Lenovo Yoga 7 15ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
		8761	SND_PCI_QUIRK(0x17aa, 0x3819, "Lenovo 13s Gen2 ITL", ALC287_FIXUP_13S_GEN2_SPEAKERS),
8633	SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),	8762	SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
8634	SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),	8763	SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
8635	SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),	8764	SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),

sound/pci/pcxhr/pcxhr_core.c+1−1

@@ -52,7 +52,7 @@ · 51 unmodified lines
52	#define PCXHR_DSP 2	52	#define PCXHR_DSP 2
53		53
54	#if (PCXHR_DSP_OFFSET_MAX > PCXHR_PLX_OFFSET_MIN)	54	#if (PCXHR_DSP_OFFSET_MAX > PCXHR_PLX_OFFSET_MIN)
55	#undef PCXHR_REG_TO_PORT(x)	55	#error PCXHR_REG_TO_PORT(x)
56	#else	56	#else
57	#define PCXHR_REG_TO_PORT(x) ((x)>PCXHR_DSP_OFFSET_MAX ? PCXHR_PLX : PCXHR_DSP)	57	#define PCXHR_REG_TO_PORT(x) ((x)>PCXHR_DSP_OFFSET_MAX ? PCXHR_PLX : PCXHR_DSP)
58	#endif	58	#endif

sound/soc/fsl/fsl_esai.c+10−6

 	if (ret < 0)
 		goto err_pm_get_sync;
+	/*
+	 * Register platform component before registering cpu dai for there
+	 * is not defer probe for platform component in snd_soc_add_pcm_runtime().
+	 */
+	ret = imx_pcm_dma_init(pdev, IMX_ESAI_DMABUF_SIZE);
+	if (ret) {
+		dev_err(&pdev->dev, "failed to init imx pcm dma: %d\n", ret);
+		goto err_pm_get_sync;
+	}
 	ret = devm_snd_soc_register_component(&pdev->dev, &fsl_esai_component,
 					      &fsl_esai_dai, 1);
 	if (ret) {
 	INIT_WORK(&esai_priv->work, fsl_esai_hw_reset);
-	ret = imx_pcm_dma_init(pdev, IMX_ESAI_DMABUF_SIZE);
-	if (ret) {
-		dev_err(&pdev->dev, "failed to init imx pcm dma: %d\n", ret);
-		goto err_pm_get_sync;
-	}
 	return ret;
 err_pm_get_sync:

sound/soc/fsl/fsl_micfil.c+10−5

 	pm_runtime_enable(&pdev->dev);
 	regcache_cache_only(micfil->regmap, true);
+	/*
+	 * Register platform component before registering cpu dai for there
+	 * is not defer probe for platform component in snd_soc_add_pcm_runtime().
+	 */
+	ret = devm_snd_dmaengine_pcm_register(&pdev->dev, NULL, 0);
+	if (ret) {
+		dev_err(&pdev->dev, "failed to pcm register\n");
+		return ret;
+	}
 	ret = devm_snd_soc_register_component(&pdev->dev, &fsl_micfil_component,
 					      &fsl_micfil_dai, 1);
 	if (ret) {
 		dev_err(&pdev->dev, "failed to register component %s\n",
 			fsl_micfil_component.name);
-		return ret;
 	}
-	ret = devm_snd_dmaengine_pcm_register(&pdev->dev, NULL, 0);
-	if (ret)
-		dev_err(&pdev->dev, "failed to pcm register\n");
 	return ret;
 }

sound/soc/fsl/fsl_sai.c+9−5

 	if (ret < 0)
 		goto err_pm_get_sync;
-	ret = devm_snd_soc_register_component(&pdev->dev, &fsl_component,
+	/*
-					      &sai->cpu_dai_drv, 1);
+	 * Register platform component before registering cpu dai for there
-	if (ret)
+	 * is not defer probe for platform component in snd_soc_add_pcm_runtime().
-		goto err_pm_get_sync;
+	 */
 	if (sai->soc_data->use_imx_pcm) {
 		ret = imx_pcm_dma_init(pdev, IMX_SAI_DMABUF_SIZE);
 		if (ret)
 			goto err_pm_get_sync;
 	}
+	ret = devm_snd_soc_register_component(&pdev->dev, &fsl_component,
+					      &sai->cpu_dai_drv, 1);
+	if (ret)
+		goto err_pm_get_sync;
 	return ret;
 err_pm_get_sync:

sound/soc/fsl/fsl_spdif.c+9−5

 	pm_runtime_enable(&pdev->dev);
 	regcache_cache_only(spdif_priv->regmap, true);
-	ret = devm_snd_soc_register_component(&pdev->dev, &fsl_spdif_component,
+	/*
-					      &spdif_priv->cpu_dai_drv, 1);
+	 * Register platform component before registering cpu dai for there
+	 * is not defer probe for platform component in snd_soc_add_pcm_runtime().
+	 */
+	ret = imx_pcm_dma_init(pdev, IMX_SPDIF_DMABUF_SIZE);
 	if (ret) {
-		dev_err(&pdev->dev, "failed to register DAI: %d\n", ret);
+		dev_err_probe(&pdev->dev, ret, "imx_pcm_dma_init failed\n");
 		goto err_pm_disable;
 	}
-	ret = imx_pcm_dma_init(pdev, IMX_SPDIF_DMABUF_SIZE);
+	ret = devm_snd_soc_register_component(&pdev->dev, &fsl_spdif_component,
+					      &spdif_priv->cpu_dai_drv, 1);
 	if (ret) {
-		dev_err_probe(&pdev->dev, ret, "imx_pcm_dma_init failed\n");
+		dev_err(&pdev->dev, "failed to register DAI: %d\n", ret);
 		goto err_pm_disable;
 	}

sound/soc/fsl/fsl_xcvr.c+10−5

 	pm_runtime_enable(dev);
 	regcache_cache_only(xcvr->regmap, true);
+	/*
+	 * Register platform component before registering cpu dai for there
+	 * is not defer probe for platform component in snd_soc_add_pcm_runtime().
+	 */
+	ret = devm_snd_dmaengine_pcm_register(dev, NULL, 0);
+	if (ret) {
+		dev_err(dev, "failed to pcm register\n");
+		return ret;
+	}
 	ret = devm_snd_soc_register_component(dev, &fsl_xcvr_comp,
 					      &fsl_xcvr_dai, 1);
 	if (ret) {
 		dev_err(dev, "failed to register component %s\n",
 			fsl_xcvr_comp.name);
-		return ret;
 	}
-	ret = devm_snd_dmaengine_pcm_register(dev, NULL, 0);
-	if (ret)
-		dev_err(dev, "failed to pcm register\n");
 	return ret;
 }

sound/soc/intel/boards/sof_sdw.c+5−0

 			      cpus + *cpu_id, cpu_dai_num,
 			      codecs, codec_num,
 			      NULL, &sdw_ops);
+		/*
+		 * SoundWire DAILINKs use 'stream' functions and Bank Switch operations
+		 * based on wait_for_completion(), tag them as 'nonatomic'.
+		 */
+		dai_links[*be_index].nonatomic = true;
 		ret = set_codec_init_func(card, link, dai_links + (*be_index)++,
 					  playback, group_id);

sound/soc/mediatek/Kconfig+3−0

 # SPDX-License-Identifier: GPL-2.0-only
 config SND_SOC_MEDIATEK
 	tristate
+	select REGMAP_MMIO
 config SND_SOC_MT2701
 	tristate "ASoC support for Mediatek MT2701 chip"
 config SND_SOC_MT8195
 	tristate "ASoC support for Mediatek MT8195 chip"
 	depends on ARCH_MEDIATEK || COMPILE_TEST
+	depends on COMMON_CLK
 	select SND_SOC_MEDIATEK
+	select MFD_SYSCON if SND_SOC_MT6359
 	help
 	  This adds ASoC platform driver support for Mediatek MT8195 chip
 	  that can be used with other codecs.

sound/soc/mediatek/common/mtk-afe-fe-dai.c+11−8

@@ -334,9 +334,11 @@ int mtk_afe_suspend(struct snd_soc_component *component) · 333 unmodified lines
334	devm_kcalloc(dev, afe->reg_back_up_list_num,	334	devm_kcalloc(dev, afe->reg_back_up_list_num,
335	sizeof(unsigned int), GFP_KERNEL);	335	sizeof(unsigned int), GFP_KERNEL);
336		336
337	for (i = 0; i < afe->reg_back_up_list_num; i++)	337	if (afe->reg_back_up) {
338	regmap_read(regmap, afe->reg_back_up_list[i],	338	for (i = 0; i < afe->reg_back_up_list_num; i++)
339	&afe->reg_back_up[i]);	339	regmap_read(regmap, afe->reg_back_up_list[i],
		340	&afe->reg_back_up[i]);
		341	}
340		342
341	afe->suspended = true;	343	afe->suspended = true;
342	afe->runtime_suspend(dev);	344	afe->runtime_suspend(dev);
@@ -356,12 +358,13 @@ int mtk_afe_resume(struct snd_soc_component *component) · 13 unmodified lines
356		358
357	afe->runtime_resume(dev);	359	afe->runtime_resume(dev);
358		360
359	if (!afe->reg_back_up)	361	if (!afe->reg_back_up) {
360	dev_dbg(dev, "%s no reg_backup\n", __func__);	362	dev_dbg(dev, "%s no reg_backup\n", __func__);
361		363	} else {
362	for (i = 0; i < afe->reg_back_up_list_num; i++)	364	for (i = 0; i < afe->reg_back_up_list_num; i++)
363	mtk_regmap_write(regmap, afe->reg_back_up_list[i],	365	mtk_regmap_write(regmap, afe->reg_back_up_list[i],
364	afe->reg_back_up[i]);	366	afe->reg_back_up[i]);
		367	}
365		368
366	afe->suspended = false;	369	afe->suspended = false;
367	return 0;	370	return 0;

sound/soc/mediatek/mt8195/mt8195-mt6359-rt1019-rt5682.c+3−4

 	return snd_soc_component_set_jack(cmpnt_codec, &priv->hdmi_jack, NULL);
 }
-static int mt8195_hdmitx_dptx_hw_params_fixup(struct snd_soc_pcm_runtime *rtd,
+static int mt8195_dptx_hw_params_fixup(struct snd_soc_pcm_runtime *rtd,
-					      struct snd_pcm_hw_params *params)
+				       struct snd_pcm_hw_params *params)
 {
 	/* fix BE i2s format to 32bit, clean param mask first */
 		.no_pcm = 1,
 		.dpcm_playback = 1,
 		.ops = &mt8195_dptx_ops,
-		.be_hw_params_fixup = mt8195_hdmitx_dptx_hw_params_fixup,
+		.be_hw_params_fixup = mt8195_dptx_hw_params_fixup,
 		SND_SOC_DAILINK_REG(DPTX_BE),
 	},
 	[DAI_LINK_ETDM1_IN_BE] = {
 			SND_SOC_DAIFMT_NB_NF |
 			SND_SOC_DAIFMT_CBS_CFS,
 		.dpcm_playback = 1,
-		.be_hw_params_fixup = mt8195_hdmitx_dptx_hw_params_fixup,
 		SND_SOC_DAILINK_REG(ETDM3_OUT_BE),
 	},
 	[DAI_LINK_PCM1_BE] = {

sound/soc/sof/core.c+1−3

 			dev_warn(dev, "error: %d failed to prepare DSP for device removal",
 				 ret);
-		snd_sof_fw_unload(sdev);
 		snd_sof_ipc_free(sdev);
 		snd_sof_free_debug(sdev);
 		snd_sof_free_trace(sdev);
 		snd_sof_remove(sdev);
 	/* release firmware */
-	release_firmware(pdata->fw);
+	snd_sof_fw_unload(sdev);
-	pdata->fw = NULL;
 	return 0;
 }

sound/soc/sof/imx/imx8.c+8−1

 /* on i.MX8 there is 1 to 1 match between type and BAR idx */
 static int imx8_get_bar_index(struct snd_sof_dev *sdev, u32 type)
 {
-	return type;
+	/* Only IRAM and SRAM bars are valid */
+	switch (type) {
+	case SOF_FW_BLK_TYPE_IRAM:
+	case SOF_FW_BLK_TYPE_SRAM:
+		return type;
+	default:
+		return -EINVAL;
+	}
 }
 static void imx8_ipc_msg_data(struct snd_sof_dev *sdev,

sound/soc/sof/imx/imx8m.c+8−1

 /* on i.MX8 there is 1 to 1 match between type and BAR idx */
 static int imx8m_get_bar_index(struct snd_sof_dev *sdev, u32 type)
 {
-	return type;
+	/* Only IRAM and SRAM bars are valid */
+	switch (type) {
+	case SOF_FW_BLK_TYPE_IRAM:
+	case SOF_FW_BLK_TYPE_SRAM:
+		return type;
+	default:
+		return -EINVAL;
+	}
 }
 static void imx8m_ipc_msg_data(struct snd_sof_dev *sdev,

sound/soc/sof/loader.c+5−3

 	ret = request_firmware(&plat_data->fw, fw_filename, sdev->dev);
 	if (ret < 0) {
-		dev_err(sdev->dev, "error: request firmware %s failed err: %d\n",
-			fw_filename, ret);
 		dev_err(sdev->dev,
-			"you may need to download the firmware from https://github.com/thesofproject/sof-bin/\n");
+			"error: sof firmware file is missing, you might need to\n");
+		dev_err(sdev->dev,
+			"       download it from https://github.com/thesofproject/sof-bin/\n");
 		goto err;
 	} else {
 		dev_dbg(sdev->dev, "request_firmware %s successful\n",
 void snd_sof_fw_unload(struct snd_sof_dev *sdev)
 {
 	/* TODO: support module unloading at runtime */
+	release_firmware(sdev->pdata->fw);
+	sdev->pdata->fw = NULL;
 }
 EXPORT_SYMBOL(snd_sof_fw_unload);

sound/soc/sof/trace.c+0−1

@@ -530,7 +530,6 @@ void snd_sof_trace_notify_for_error(struct snd_sof_dev *sdev) · 529 unmodified lines
530	return;	530	return;
531		531
532	if (sdev->dtrace_is_enabled) {	532	if (sdev->dtrace_is_enabled) {
533	dev_err(sdev->dev, "error: waking up any trace sleepers\n");
534	sdev->dtrace_error = true;	533	sdev->dtrace_error = true;
535	wake_up(&sdev->trace_sleep);	534	wake_up(&sdev->trace_sleep);
536	}	535	}

sound/soc/sof/xtensa/core.c+2−2

@@ -122,9 +122,9 @@ static void xtensa_stack(struct snd_sof_dev sdev, void oops, u32 *stack, · 121 unmodified lines
122	* 0x0049fbb0: 8000f2d0 0049fc00 6f6c6c61 00632e63	122	* 0x0049fbb0: 8000f2d0 0049fc00 6f6c6c61 00632e63
123	*/	123	*/
124	for (i = 0; i < stack_words; i += 4) {	124	for (i = 0; i < stack_words; i += 4) {
125	hex_dump_to_buffer(stack + i * 4, 16, 16, 4,	125	hex_dump_to_buffer(stack + i, 16, 16, 4,
126	buf, sizeof(buf), false);	126	buf, sizeof(buf), false);
127	dev_err(sdev->dev, "0x%08x: %s\n", stack_ptr + i, buf);	127	dev_err(sdev->dev, "0x%08x: %s\n", stack_ptr + i * 4, buf);
128	}	128	}
129	}	129	}
130		130

sound/usb/card.c+4−14

 	return 0;
 }
-static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume)
+static int usb_audio_resume(struct usb_interface *intf)
 {
 	struct snd_usb_audio *chip = usb_get_intfdata(intf);
 	struct snd_usb_stream *as;
 	 * we just notify and restart the mixers
 	 */
 	list_for_each_entry(mixer, &chip->mixer_list, list) {
-		err = snd_usb_mixer_resume(mixer, reset_resume);
+		err = snd_usb_mixer_resume(mixer);
 		if (err < 0)
 			goto err_out;
 	}
 	atomic_dec(&chip->active); /* allow autopm after this point */
 	return err;
 }
-static int usb_audio_resume(struct usb_interface *intf)
-{
-	return __usb_audio_resume(intf, false);
-}
-static int usb_audio_reset_resume(struct usb_interface *intf)
-{
-	return __usb_audio_resume(intf, true);
-}
 #else
 #define usb_audio_suspend	NULL
 #define usb_audio_resume	NULL
-#define usb_audio_reset_resume	NULL
+#define usb_audio_resume	NULL
 #endif		/* CONFIG_PM */
 static const struct usb_device_id usb_audio_ids [] = {
 	.disconnect =	usb_audio_disconnect,
 	.suspend =	usb_audio_suspend,
 	.resume =	usb_audio_resume,
-	.reset_resume =	usb_audio_reset_resume,
+	.reset_resume =	usb_audio_resume,
 	.id_table =	usb_audio_ids,
 	.supports_autosuspend = 1,
 };

sound/usb/mixer.c+4−22

 	return 0;
 }
-static int default_mixer_reset_resume(struct usb_mixer_elem_list *list)
+int snd_usb_mixer_resume(struct usb_mixer_interface *mixer)
-{
-	int err;
-	if (list->resume) {
-		err = list->resume(list);
-		if (err < 0)
-			return err;
-	}
-	return restore_mixer_value(list);
-}
-int snd_usb_mixer_resume(struct usb_mixer_interface *mixer, bool reset_resume)
 {
 	struct usb_mixer_elem_list *list;
-	usb_mixer_elem_resume_func_t f;
 	int id, err;
 	/* restore cached mixer values */
 	for (id = 0; id < MAX_ID_ELEMS; id++) {
 		for_each_mixer_elem(list, mixer, id) {
-			if (reset_resume)
+			if (list->resume) {
-				f = list->reset_resume;
+				err = list->resume(list);
-			else
-				f = list->resume;
-			if (f) {
-				err = f(list);
 				if (err < 0)
 					return err;
 			}
 	list->id = unitid;
 	list->dump = snd_usb_mixer_dump_cval;
 #ifdef CONFIG_PM
-	list->resume = NULL;
+	list->resume = restore_mixer_value;
-	list->reset_resume = default_mixer_reset_resume;
 #endif
 }

sound/usb/mixer.h+1−2

 	bool is_std_info;
 	usb_mixer_elem_dump_func_t dump;
 	usb_mixer_elem_resume_func_t resume;
-	usb_mixer_elem_resume_func_t reset_resume;
 };
 /* iterate over mixer element list of the given unit id */
 #ifdef CONFIG_PM
 int snd_usb_mixer_suspend(struct usb_mixer_interface *mixer);
-int snd_usb_mixer_resume(struct usb_mixer_interface *mixer, bool reset_resume);
+int snd_usb_mixer_resume(struct usb_mixer_interface *mixer);
 #endif
 int snd_usb_set_cur_mix_value(struct usb_mixer_elem_info *cval, int channel,

sound/usb/mixer_quirks.c+1−1

@@ -151,7 +151,7 @@ static int add_single_ctl_with_resume(struct usb_mixer_interface *mixer, · 150 unmodified lines
151	*listp = list;	151	*listp = list;
152	list->mixer = mixer;	152	list->mixer = mixer;
153	list->id = id;	153	list->id = id;
154	list->reset_resume = resume;	154	list->resume = resume;
155	kctl = snd_ctl_new1(knew, list);	155	kctl = snd_ctl_new1(knew, list);
156	if (!kctl) {	156	if (!kctl) {
157	kfree(list);	157	kfree(list);

tools/lib/bpf/linker.c+7−1

 static int find_glob_sym_btf(struct src_obj *obj, Elf64_Sym *sym, const char *sym_name,
 			     int *out_btf_sec_id, int *out_btf_id)
 {
-	int i, j, n = btf__get_nr_types(obj->btf), m, btf_id = 0;
+	int i, j, n, m, btf_id = 0;
 	const struct btf_type *t;
 	const struct btf_var_secinfo *vi;
 	const char *name;
+	if (!obj->btf) {
+		pr_warn("failed to find BTF info for object '%s'\n", obj->filename);
+		return -EINVAL;
+	}
+	n = btf__get_nr_types(obj->btf);
 	for (i = 1; i <= n; i++) {
 		t = btf__type_by_id(obj->btf, i);

tools/objtool/special.c+30−8

 {
 }
+static bool reloc2sec_off(struct reloc *reloc, struct section **sec, unsigned long *off)
+{
+	switch (reloc->sym->type) {
+	case STT_FUNC:
+		*sec = reloc->sym->sec;
+		*off = reloc->sym->offset + reloc->addend;
+		return true;
+	case STT_SECTION:
+		*sec = reloc->sym->sec;
+		*off = reloc->addend;
+		return true;
+	default:
+		return false;
+	}
+}
 static int get_alt_entry(struct elf *elf, struct special_entry *entry,
 			 struct section *sec, int idx,
 			 struct special_alt *alt)
 		WARN_FUNC("can't find orig reloc", sec, offset + entry->orig);
 		return -1;
 	}
-	if (orig_reloc->sym->type != STT_SECTION) {
+	if (!reloc2sec_off(orig_reloc, &alt->orig_sec, &alt->orig_off)) {
-		WARN_FUNC("don't know how to handle non-section reloc symbol %s",
+		WARN_FUNC("don't know how to handle reloc symbol type %d: %s",
-			   sec, offset + entry->orig, orig_reloc->sym->name);
+			   sec, offset + entry->orig,
+			   orig_reloc->sym->type,
+			   orig_reloc->sym->name);
 		return -1;
 	}
-	alt->orig_sec = orig_reloc->sym->sec;
-	alt->orig_off = orig_reloc->addend;
 	if (!entry->group || alt->new_len) {
 		new_reloc = find_reloc_by_dest(elf, sec, offset + entry->new);
 		if (!new_reloc) {
 		if (arch_is_retpoline(new_reloc->sym))
 			return 1;
-		alt->new_sec = new_reloc->sym->sec;
+		if (!reloc2sec_off(new_reloc, &alt->new_sec, &alt->new_off)) {
-		alt->new_off = (unsigned int)new_reloc->addend;
+			WARN_FUNC("don't know how to handle reloc symbol type %d: %s",
+				  sec, offset + entry->new,
+				  new_reloc->sym->type,
+				  new_reloc->sym->name);
+			return -1;
+		}
 		/* _ASM_EXTABLE_EX hack */
 		if (alt->new_off >= 0x7ffffff0)

tools/perf/Documentation/jitdump-specification.txt+1−1

@@ -164,7 +164,7 @@ const char unwinding_data[n]: an array of unwinding data, consisting of the EH F · 163 unmodified lines
164	The EH Frame header follows the Linux Standard Base (LSB) specification as described in the document at https://refspecs.linuxfoundation.org/LSB_1.3.0/gLSB/gLSB/ehframehdr.html	164	The EH Frame header follows the Linux Standard Base (LSB) specification as described in the document at https://refspecs.linuxfoundation.org/LSB_1.3.0/gLSB/gLSB/ehframehdr.html
165		165
166		166
167	The EH Frame follows the LSB specicfication as described in the document at https://refspecs.linuxbase.org/LSB_3.0.0/LSB-PDA/LSB-PDA/ehframechpt.html	167	The EH Frame follows the LSB specification as described in the document at https://refspecs.linuxbase.org/LSB_3.0.0/LSB-PDA/LSB-PDA/ehframechpt.html
168		168
169		169
170	NOTE: The mapped_size is generally either the same as unwind_data_size (if the unwinding data was mapped in memory by the running process) or zero (if the unwinding data is not mapped by the process). If the unwinding data was not mapped, then only the EH Frame Header will be read, which can be used to specify FP based unwinding for a function which does not have unwinding information.	170	NOTE: The mapped_size is generally either the same as unwind_data_size (if the unwinding data was mapped in memory by the running process) or zero (if the unwinding data is not mapped by the process). If the unwinding data was not mapped, then only the EH Frame Header will be read, which can be used to specify FP based unwinding for a function which does not have unwinding information.

tools/perf/Documentation/perf-c2c.txt+1−1

@@ -261,7 +261,7 @@ COALESCE · 260 unmodified lines
261	User can specify how to sort offsets for cacheline.	261	User can specify how to sort offsets for cacheline.
262		262
263	Following fields are available and governs the final	263	Following fields are available and governs the final
264	output fields set for caheline offsets output:	264	output fields set for cacheline offsets output:
265		265
266	tid - coalesced by process TIDs	266	tid - coalesced by process TIDs
267	pid - coalesced by process PIDs	267	pid - coalesced by process PIDs

tools/perf/Documentation/perf-intel-pt.txt+1−1

@@ -883,7 +883,7 @@ and "r" can be combined to get calls and returns. · 882 unmodified lines
883		883
884	"Transactions" events correspond to the start or end of transactions. The	884	"Transactions" events correspond to the start or end of transactions. The
885	'flags' field can be used in perf script to determine whether the event is a	885	'flags' field can be used in perf script to determine whether the event is a
886	tranasaction start, commit or abort.	886	transaction start, commit or abort.
887		887
888	Note that "instructions", "branches" and "transactions" events depend on code	888	Note that "instructions", "branches" and "transactions" events depend on code
889	flow packets which can be disabled by using the config term "branch=0". Refer	889	flow packets which can be disabled by using the config term "branch=0". Refer

tools/perf/Documentation/perf-lock.txt+1−1

@@ -44,7 +44,7 @@ COMMON OPTIONS · 43 unmodified lines
44		44
45	-f::	45	-f::
46	--force::	46	--force::
47	Don't complan, do it.	47	Don't complain, do it.
48		48
49	REPORT OPTIONS	49	REPORT OPTIONS
50	--------------	50	--------------

tools/perf/Documentation/perf-script-perl.txt+1−1

@@ -54,7 +54,7 @@ all sched_wakeup events in the system: · 53 unmodified lines
54	Traces meant to be processed using a script should be recorded with	54	Traces meant to be processed using a script should be recorded with
55	the above option: -a to enable system-wide collection.	55	the above option: -a to enable system-wide collection.
56		56
57	The format file for the sched_wakep event defines the following fields	57	The format file for the sched_wakeup event defines the following fields
58	(see /sys/kernel/debug/tracing/events/sched/sched_wakeup/format):	58	(see /sys/kernel/debug/tracing/events/sched/sched_wakeup/format):
59		59
60	----	60	----

tools/perf/Documentation/perf-script-python.txt+1−1

@@ -448,7 +448,7 @@ all sched_wakeup events in the system: · 447 unmodified lines
448	Traces meant to be processed using a script should be recorded with	448	Traces meant to be processed using a script should be recorded with
449	the above option: -a to enable system-wide collection.	449	the above option: -a to enable system-wide collection.
450		450
451	The format file for the sched_wakep event defines the following fields	451	The format file for the sched_wakeup event defines the following fields
452	(see /sys/kernel/debug/tracing/events/sched/sched_wakeup/format):	452	(see /sys/kernel/debug/tracing/events/sched/sched_wakeup/format):
453		453
454	----	454	----

tools/perf/Documentation/perf-stat.txt+1−1

@@ -385,7 +385,7 @@ Aggregate counts per physical processor for system-wide mode measurements. · 384 unmodified lines
385	Print metrics or metricgroups specified in a comma separated list.	385	Print metrics or metricgroups specified in a comma separated list.
386	For a group all metrics from the group are added.	386	For a group all metrics from the group are added.
387	The events from the metrics are automatically measured.	387	The events from the metrics are automatically measured.
388	See perf list output for the possble metrics and metricgroups.	388	See perf list output for the possible metrics and metricgroups.
389		389
390	-A::	390	-A::
391	--no-aggr::	391	--no-aggr::

tools/perf/Documentation/topdown.txt+1−1

@@ -2,7 +2,7 @@ Using TopDown metrics in user space · 1 unmodified line
2	-----------------------------------	2	-----------------------------------
3		3
4	Intel CPUs (since Sandy Bridge and Silvermont) support a TopDown	4	Intel CPUs (since Sandy Bridge and Silvermont) support a TopDown
5	methology to break down CPU pipeline execution into 4 bottlenecks:	5	methodology to break down CPU pipeline execution into 4 bottlenecks:
6	frontend bound, backend bound, bad speculation, retiring.	6	frontend bound, backend bound, bad speculation, retiring.
7		7
8	For more details on Topdown see [1][5]	8	For more details on Topdown see [1][5]

tools/perf/arch/arm/util/auxtrace.c+4−4

@@ -8,10 +8,10 @@ · 7 unmodified lines
8	#include <linux/coresight-pmu.h>	8	#include <linux/coresight-pmu.h>
9	#include <linux/zalloc.h>	9	#include <linux/zalloc.h>
10		10
11	#include "../../util/auxtrace.h"	11	#include "../../../util/auxtrace.h"
12	#include "../../util/debug.h"	12	#include "../../../util/debug.h"
13	#include "../../util/evlist.h"	13	#include "../../../util/evlist.h"
14	#include "../../util/pmu.h"	14	#include "../../../util/pmu.h"
15	#include "cs-etm.h"	15	#include "cs-etm.h"
16	#include "arm-spe.h"	16	#include "arm-spe.h"
17		17

tools/perf/arch/arm/util/cs-etm.c+12−12

@@ -16,19 +16,19 @@ · 15 unmodified lines
16	#include <linux/zalloc.h>	16	#include <linux/zalloc.h>
17		17
18	#include "cs-etm.h"	18	#include "cs-etm.h"
19	#include "../../util/debug.h"	19	#include "../../../util/debug.h"
20	#include "../../util/record.h"	20	#include "../../../util/record.h"
21	#include "../../util/auxtrace.h"	21	#include "../../../util/auxtrace.h"
22	#include "../../util/cpumap.h"	22	#include "../../../util/cpumap.h"
23	#include "../../util/event.h"	23	#include "../../../util/event.h"
24	#include "../../util/evlist.h"	24	#include "../../../util/evlist.h"
25	#include "../../util/evsel.h"	25	#include "../../../util/evsel.h"
26	#include "../../util/perf_api_probe.h"	26	#include "../../../util/perf_api_probe.h"
27	#include "../../util/evsel_config.h"	27	#include "../../../util/evsel_config.h"
28	#include "../../util/pmu.h"	28	#include "../../../util/pmu.h"
29	#include "../../util/cs-etm.h"	29	#include "../../../util/cs-etm.h"
30	#include <internal/lib.h> // page_size	30	#include <internal/lib.h> // page_size
31	#include "../../util/session.h"	31	#include "../../../util/session.h"
32		32
33	#include <errno.h>	33	#include <errno.h>
34	#include <stdlib.h>	34	#include <stdlib.h>

tools/perf/arch/arm/util/perf_regs.c+1−1

@@ -1,5 +1,5 @@
1	// SPDX-License-Identifier: GPL-2.0	1	// SPDX-License-Identifier: GPL-2.0
2	#include "../../util/perf_regs.h"	2	#include "../../../util/perf_regs.h"
3		3
4	const struct sample_reg sample_reg_masks[] = {	4	const struct sample_reg sample_reg_masks[] = {
5	SMPL_REG_END	5	SMPL_REG_END

tools/perf/arch/arm/util/pmu.c+1−1

@@ -10,7 +10,7 @@ · 9 unmodified lines
10	#include <linux/string.h>	10	#include <linux/string.h>
11		11
12	#include "arm-spe.h"	12	#include "arm-spe.h"
13	#include "../../util/pmu.h"	13	#include "../../../util/pmu.h"
14		14
15	struct perf_event_attr	15	struct perf_event_attr
16	perf_pmu__get_default_config(struct perf_pmu pmu __maybe_unused)	16	perf_pmu__get_default_config(struct perf_pmu pmu __maybe_unused)

tools/perf/arch/arm/util/unwind-libdw.c+3−3

@@ -1,8 +1,8 @@
1	// SPDX-License-Identifier: GPL-2.0	1	// SPDX-License-Identifier: GPL-2.0
2	#include <elfutils/libdwfl.h>	2	#include <elfutils/libdwfl.h>
3	#include "../../util/unwind-libdw.h"	3	#include "../../../util/unwind-libdw.h"
4	#include "../../util/perf_regs.h"	4	#include "../../../util/perf_regs.h"
5	#include "../../util/event.h"	5	#include "../../../util/event.h"
6		6
7	bool libdw__arch_set_initial_registers(Dwfl_Thread thread, void arg)	7	bool libdw__arch_set_initial_registers(Dwfl_Thread thread, void arg)
8	{	8	{

tools/perf/arch/arm/util/unwind-libunwind.c+2−2

@@ -3,8 +3,8 @@ · 2 unmodified lines
3	#include <errno.h>	3	#include <errno.h>
4	#include <libunwind.h>	4	#include <libunwind.h>
5	#include "perf_regs.h"	5	#include "perf_regs.h"
6	#include "../../util/unwind.h"	6	#include "../../../util/unwind.h"
7	#include "../../util/debug.h"	7	#include "../../../util/debug.h"
8		8
9	int libunwind__arch_reg_id(int regnum)	9	int libunwind__arch_reg_id(int regnum)
10	{	10	{

tools/perf/arch/x86/util/iostat.c+1−1

@@ -432,7 +432,7 @@ void iostat_print_metric(struct perf_stat_config config, struct evsel evsel, · 431 unmodified lines
432	u8 die = ((struct iio_root_port *)evsel->priv)->die;	432	u8 die = ((struct iio_root_port *)evsel->priv)->die;
433	struct perf_counts_values *count = perf_counts(evsel->counts, die, 0);	433	struct perf_counts_values *count = perf_counts(evsel->counts, die, 0);
434		434
435	if (count->run && count->ena) {	435	if (count && count->run && count->ena) {
436	if (evsel->prev_raw_counts && !out->force_header) {	436	if (evsel->prev_raw_counts && !out->force_header) {
437	struct perf_counts_values *prev_count =	437	struct perf_counts_values *prev_count =
438	perf_counts(evsel->prev_raw_counts, die, 0);	438	perf_counts(evsel->prev_raw_counts, die, 0);

tools/perf/builtin-stat.c+2−0

@@ -2408,6 +2408,8 @@ int cmd_stat(int argc, const char **argv) · 2407 unmodified lines
2408	goto out;	2408	goto out;
2409	} else if (verbose)	2409	} else if (verbose)
2410	iostat_list(evsel_list, &stat_config);	2410	iostat_list(evsel_list, &stat_config);
		2411	if (iostat_mode == IOSTAT_RUN && !target__has_cpu(&target))
		2412	target.system_wide = true;
2411	}	2413	}
2412		2414
2413	if (add_default_attributes())	2415	if (add_default_attributes())

tools/perf/pmu-events/arch/powerpc/power8/other.json+1−1

@@ -1046,7 +1046,7 @@ · 1045 unmodified lines
1046	{	1046	{
1047	"EventCode": "0x4e010",	1047	"EventCode": "0x4e010",
1048	"EventName": "PM_GCT_NOSLOT_IC_L3MISS",	1048	"EventName": "PM_GCT_NOSLOT_IC_L3MISS",
1049	"BriefDescription": "Gct empty for this thread due to icach l3 miss",	1049	"BriefDescription": "Gct empty for this thread due to icache l3 miss",
1050	"PublicDescription": ""	1050	"PublicDescription": ""
1051	},	1051	},
1052	{	1052	{

tools/perf/tests/code-reading.c+2−2

@@ -229,8 +229,8 @@ static int read_object_code(u64 addr, size_t len, u8 cpumode, · 228 unmodified lines
229	struct thread thread, struct state state)	229	struct thread thread, struct state state)
230	{	230	{
231	struct addr_location al;	231	struct addr_location al;
232	unsigned char buf1[BUFSZ];	232	unsigned char buf1[BUFSZ] = {0};
233	unsigned char buf2[BUFSZ];	233	unsigned char buf2[BUFSZ] = {0};
234	size_t ret_len;	234	size_t ret_len;
235	u64 objdump_addr;	235	u64 objdump_addr;
236	const char *objdump_name;	236	const char *objdump_name;

tools/perf/tests/dwarf-unwind.c+32−7

 /* For bsearch. We try to unwind functions in shared object. */
 #include <stdlib.h>
+/*
+ * The test will assert frames are on the stack but tail call optimizations lose
+ * the frame of the caller. Clang can disable this optimization on a called
+ * function but GCC currently (11/2020) lacks this attribute. The barrier is
+ * used to inhibit tail calls in these cases.
+ */
+#ifdef __has_attribute
+#if __has_attribute(disable_tail_calls)
+#define NO_TAIL_CALL_ATTRIBUTE __attribute__((disable_tail_calls))
+#define NO_TAIL_CALL_BARRIER
+#endif
+#endif
+#ifndef NO_TAIL_CALL_ATTRIBUTE
+#define NO_TAIL_CALL_ATTRIBUTE
+#define NO_TAIL_CALL_BARRIER __asm__ __volatile__("" : : : "memory");
+#endif
 static int mmap_handler(struct perf_tool *tool __maybe_unused,
 			union perf_event *event,
 			struct perf_sample *sample,
 	return strcmp((const char *) symbol, funcs[idx]);
 }
-noinline int test_dwarf_unwind__thread(struct thread *thread)
+NO_TAIL_CALL_ATTRIBUTE noinline int test_dwarf_unwind__thread(struct thread *thread)
 {
 	struct perf_sample sample;
 	unsigned long cnt = 0;
 static int global_unwind_retval = -INT_MAX;
-noinline int test_dwarf_unwind__compare(void *p1, void *p2)
+NO_TAIL_CALL_ATTRIBUTE noinline int test_dwarf_unwind__compare(void *p1, void *p2)
 {
 	/* Any possible value should be 'thread' */
 	struct thread *thread = *(struct thread **)p1;
 	return p1 - p2;
 }
-noinline int test_dwarf_unwind__krava_3(struct thread *thread)
+NO_TAIL_CALL_ATTRIBUTE noinline int test_dwarf_unwind__krava_3(struct thread *thread)
 {
 	struct thread *array[2] = {thread, thread};
 	void *fp = &bsearch;
 	return global_unwind_retval;
 }
-noinline int test_dwarf_unwind__krava_2(struct thread *thread)
+NO_TAIL_CALL_ATTRIBUTE noinline int test_dwarf_unwind__krava_2(struct thread *thread)
 {
-	return test_dwarf_unwind__krava_3(thread);
+	int ret;
+	ret =  test_dwarf_unwind__krava_3(thread);
+	NO_TAIL_CALL_BARRIER;
+	return ret;
 }
-noinline int test_dwarf_unwind__krava_1(struct thread *thread)
+NO_TAIL_CALL_ATTRIBUTE noinline int test_dwarf_unwind__krava_1(struct thread *thread)
 {
-	return test_dwarf_unwind__krava_2(thread);
+	int ret;
+	ret =  test_dwarf_unwind__krava_2(thread);
+	NO_TAIL_CALL_BARRIER;
+	return ret;
 }
 int test__dwarf_unwind(struct test *test __maybe_unused, int subtest __maybe_unused)

tools/perf/util/config.c+1−1

@@ -801,7 +801,7 @@ int perf_config_set(struct perf_config_set *set, · 800 unmodified lines
801	section->name, item->name);	801	section->name, item->name);
802	ret = fn(key, value, data);	802	ret = fn(key, value, data);
803	if (ret < 0) {	803	if (ret < 0) {
804	pr_err("Error: wrong config key-value pair %s=%s\n",	804	pr_err("Error in the given config file: wrong config key-value pair %s=%s\n",
805	key, value);	805	key, value);
806	/*	806	/*
807	* Can't be just a 'break', as perf_config_set__for_each_entry()	807	* Can't be just a 'break', as perf_config_set__for_each_entry()

tools/testing/selftests/bpf/Makefile+2−1

@@ -375,7 +375,8 @@ $(TRUNNER_BPF_OBJS): $(TRUNNER_OUTPUT)/%.o: \ · 374 unmodified lines
375	$(TRUNNER_BPF_PROGS_DIR)/%.c \	375	$(TRUNNER_BPF_PROGS_DIR)/%.c \
376	$(TRUNNER_BPF_PROGS_DIR)/*.h \	376	$(TRUNNER_BPF_PROGS_DIR)/*.h \
377	$$(INCLUDE_DIR)/vmlinux.h \	377	$$(INCLUDE_DIR)/vmlinux.h \
378	$(wildcard $(BPFDIR)/bpf_*.h) \| $(TRUNNER_OUTPUT)	378	$(wildcard $(BPFDIR)/bpf_*.h) \
		379	\| $(TRUNNER_OUTPUT) $$(BPFOBJ)
379	$$(call $(TRUNNER_BPF_BUILD_RULE),$$<,$$@, \	380	$$(call $(TRUNNER_BPF_BUILD_RULE),$$<,$$@, \
380	$(TRUNNER_BPF_CFLAGS))	381	$(TRUNNER_BPF_CFLAGS))
381		382

tools/testing/selftests/bpf/test_lwt_ip_encap.sh+8−5

 	ip netns add "${NS2}"
 	ip netns add "${NS3}"
+	# rp_filter gets confused by what these tests are doing, so disable it
+	ip netns exec ${NS1} sysctl -wq net.ipv4.conf.all.rp_filter=0
+	ip netns exec ${NS2} sysctl -wq net.ipv4.conf.all.rp_filter=0
+	ip netns exec ${NS3} sysctl -wq net.ipv4.conf.all.rp_filter=0
+	ip netns exec ${NS1} sysctl -wq net.ipv4.conf.default.rp_filter=0
+	ip netns exec ${NS2} sysctl -wq net.ipv4.conf.default.rp_filter=0
+	ip netns exec ${NS3} sysctl -wq net.ipv4.conf.default.rp_filter=0
 	ip link add veth1 type veth peer name veth2
 	ip link add veth3 type veth peer name veth4
 	ip link add veth5 type veth peer name veth6
 	ip -netns ${NS1} -6 route add ${IPv6_GRE}/128 dev veth5 via ${IPv6_6} ${VRF}
 	ip -netns ${NS2} -6 route add ${IPv6_GRE}/128 dev veth7 via ${IPv6_8} ${VRF}
-	# rp_filter gets confused by what these tests are doing, so disable it
-	ip netns exec ${NS1} sysctl -wq net.ipv4.conf.all.rp_filter=0
-	ip netns exec ${NS2} sysctl -wq net.ipv4.conf.all.rp_filter=0
-	ip netns exec ${NS3} sysctl -wq net.ipv4.conf.all.rp_filter=0
 	TMPFILE=$(mktemp /tmp/test_lwt_ip_encap.XXXXXX)
 	sleep 1  # reduce flakiness

tools/testing/selftests/kvm/.gitignore+1−0

@@ -24,6 +24,7 @@ · 23 unmodified lines
24	/x86_64/smm_test	24	/x86_64/smm_test
25	/x86_64/state_test	25	/x86_64/state_test
26	/x86_64/svm_vmcall_test	26	/x86_64/svm_vmcall_test
		27	/x86_64/svm_int_ctl_test
27	/x86_64/sync_regs_test	28	/x86_64/sync_regs_test
28	/x86_64/tsc_msrs_test	29	/x86_64/tsc_msrs_test
29	/x86_64/userspace_msr_exit_test	30	/x86_64/userspace_msr_exit_test

tools/testing/selftests/kvm/Makefile+1−0

@@ -56,6 +56,7 @@ TEST_GEN_PROGS_x86_64 += x86_64/smm_test · 55 unmodified lines
56	TEST_GEN_PROGS_x86_64 += x86_64/state_test	56	TEST_GEN_PROGS_x86_64 += x86_64/state_test
57	TEST_GEN_PROGS_x86_64 += x86_64/vmx_preemption_timer_test	57	TEST_GEN_PROGS_x86_64 += x86_64/vmx_preemption_timer_test
58	TEST_GEN_PROGS_x86_64 += x86_64/svm_vmcall_test	58	TEST_GEN_PROGS_x86_64 += x86_64/svm_vmcall_test
		59	TEST_GEN_PROGS_x86_64 += x86_64/svm_int_ctl_test
59	TEST_GEN_PROGS_x86_64 += x86_64/sync_regs_test	60	TEST_GEN_PROGS_x86_64 += x86_64/sync_regs_test
60	TEST_GEN_PROGS_x86_64 += x86_64/userspace_msr_exit_test	61	TEST_GEN_PROGS_x86_64 += x86_64/userspace_msr_exit_test
61	TEST_GEN_PROGS_x86_64 += x86_64/vmx_apic_access_test	62	TEST_GEN_PROGS_x86_64 += x86_64/vmx_apic_access_test

tools/testing/selftests/kvm/access_tracking_perf_test.c+2−4

 	printf(" -v: specify the number of vCPUs to run.\n");
 	printf(" -o: Overlap guest memory accesses instead of partitioning\n"
 	       "     them into a separate region of memory for each vCPU.\n");
-	printf(" -s: specify the type of memory that should be used to\n"
+	backing_src_help("-s");
-	       "     back the guest data region.\n\n");
-	backing_src_help();
 	puts("");
 	exit(0);
 }
 int main(int argc, char *argv[])
 {
 	struct test_params params = {
-		.backing_src = VM_MEM_SRC_ANONYMOUS,
+		.backing_src = DEFAULT_VM_MEM_SRC,
 		.vcpu_memory_bytes = DEFAULT_PER_VCPU_MEM_SIZE,
 		.vcpus = 1,
 	};

tools/testing/selftests/kvm/demand_paging_test.c+7−8

 			return NULL;
 		}
-		if (!pollfd[0].revents & POLLIN)
+		if (!(pollfd[0].revents & POLLIN))
 			continue;
 		r = read(uffd, &msg, sizeof(msg));
 {
 	puts("");
 	printf("usage: %s [-h] [-m vm_mode] [-u uffd_mode] [-d uffd_delay_usec]\n"
-	       "          [-b memory] [-t type] [-v vcpus] [-o]\n", name);
+	       "          [-b memory] [-s type] [-v vcpus] [-o]\n", name);
 	guest_modes_help();
 	printf(" -u: use userfaultfd to handle vCPU page faults. Mode is a\n"
 	       "     UFFD registration mode: 'MISSING' or 'MINOR'.\n");
 	printf(" -b: specify the size of the memory region which should be\n"
 	       "     demand paged by each vCPU. e.g. 10M or 3G.\n"
 	       "     Default: 1G\n");
-	printf(" -t: The type of backing memory to use. Default: anonymous\n");
+	backing_src_help("-s");
-	backing_src_help();
 	printf(" -v: specify the number of vCPUs to run.\n");
 	printf(" -o: Overlap guest memory accesses instead of partitioning\n"
 	       "     them into a separate region of memory for each vCPU.\n");
 {
 	int max_vcpus = kvm_check_cap(KVM_CAP_MAX_VCPUS);
 	struct test_params p = {
-		.src_type = VM_MEM_SRC_ANONYMOUS,
+		.src_type = DEFAULT_VM_MEM_SRC,
 		.partition_vcpu_memory_access = true,
 	};
 	int opt;
 	guest_modes_append_default();
-	while ((opt = getopt(argc, argv, "hm:u:d:b:t:v:o")) != -1) {
+	while ((opt = getopt(argc, argv, "hm:u:d:b:s:v:o")) != -1) {
 		switch (opt) {
 		case 'm':
 			guest_modes_cmdline(optarg);
 		case 'b':
 			guest_percpu_mem_size = parse_size(optarg);
 			break;
-		case 't':
+		case 's':
 			p.src_type = parse_backing_src_type(optarg);
 			break;
 		case 'v':
 	if (p.uffd_mode == UFFDIO_REGISTER_MODE_MINOR &&
 	    !backing_src_is_shared(p.src_type)) {
-		TEST_FAIL("userfaultfd MINOR mode requires shared memory; pick a different -t");
+		TEST_FAIL("userfaultfd MINOR mode requires shared memory; pick a different -s");
 	}
 	for_each_guest_mode(run_test, &p);

tools/testing/selftests/kvm/dirty_log_perf_test.c+42−20

 	toggle_dirty_logging(vm, slots, false);
 }
-static void get_dirty_log(struct kvm_vm *vm, int slots, unsigned long *bitmap,
+static void get_dirty_log(struct kvm_vm *vm, unsigned long *bitmaps[], int slots)
-			  uint64_t nr_pages)
 {
-	uint64_t slot_pages = nr_pages / slots;
 	int i;
 	for (i = 0; i < slots; i++) {
 		int slot = PERF_TEST_MEM_SLOT_INDEX + i;
-		unsigned long *slot_bitmap = bitmap + i * slot_pages;
-		kvm_vm_get_dirty_log(vm, slot, slot_bitmap);
+		kvm_vm_get_dirty_log(vm, slot, bitmaps[i]);
 	}
 }
-static void clear_dirty_log(struct kvm_vm *vm, int slots, unsigned long *bitmap,
+static void clear_dirty_log(struct kvm_vm *vm, unsigned long *bitmaps[],
-			    uint64_t nr_pages)
+			    int slots, uint64_t pages_per_slot)
 {
-	uint64_t slot_pages = nr_pages / slots;
 	int i;
 	for (i = 0; i < slots; i++) {
 		int slot = PERF_TEST_MEM_SLOT_INDEX + i;
-		unsigned long *slot_bitmap = bitmap + i * slot_pages;
-		kvm_vm_clear_dirty_log(vm, slot, slot_bitmap, 0, slot_pages);
+		kvm_vm_clear_dirty_log(vm, slot, bitmaps[i], 0, pages_per_slot);
 	}
 }
+static unsigned long **alloc_bitmaps(int slots, uint64_t pages_per_slot)
+{
+	unsigned long **bitmaps;
+	int i;
+	bitmaps = malloc(slots * sizeof(bitmaps[0]));
+	TEST_ASSERT(bitmaps, "Failed to allocate bitmaps array.");
+	for (i = 0; i < slots; i++) {
+		bitmaps[i] = bitmap_zalloc(pages_per_slot);
+		TEST_ASSERT(bitmaps[i], "Failed to allocate slot bitmap.");
+	}
+	return bitmaps;
+}
+static void free_bitmaps(unsigned long *bitmaps[], int slots)
+{
+	int i;
+	for (i = 0; i < slots; i++)
+		free(bitmaps[i]);
+	free(bitmaps);
+}
 static void run_test(enum vm_guest_mode mode, void *arg)
 {
 	struct test_params *p = arg;
 	pthread_t *vcpu_threads;
 	struct kvm_vm *vm;
-	unsigned long *bmap;
+	unsigned long **bitmaps;
 	uint64_t guest_num_pages;
 	uint64_t host_num_pages;
+	uint64_t pages_per_slot;
 	int vcpu_id;
 	struct timespec start;
 	struct timespec ts_diff;
 	guest_num_pages = (nr_vcpus * guest_percpu_mem_size) >> vm_get_page_shift(vm);
 	guest_num_pages = vm_adjust_num_guest_pages(mode, guest_num_pages);
 	host_num_pages = vm_num_host_pages(mode, guest_num_pages);
-	bmap = bitmap_zalloc(host_num_pages);
+	pages_per_slot = host_num_pages / p->slots;
+	bitmaps = alloc_bitmaps(p->slots, pages_per_slot);
 	if (dirty_log_manual_caps) {
 		cap.cap = KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2;
 			iteration, ts_diff.tv_sec, ts_diff.tv_nsec);
 		clock_gettime(CLOCK_MONOTONIC, &start);
-		get_dirty_log(vm, p->slots, bmap, host_num_pages);
+		get_dirty_log(vm, bitmaps, p->slots);
 		ts_diff = timespec_elapsed(start);
 		get_dirty_log_total = timespec_add(get_dirty_log_total,
 						   ts_diff);
 		if (dirty_log_manual_caps) {
 			clock_gettime(CLOCK_MONOTONIC, &start);
-			clear_dirty_log(vm, p->slots, bmap, host_num_pages);
+			clear_dirty_log(vm, bitmaps, p->slots, pages_per_slot);
 			ts_diff = timespec_elapsed(start);
 			clear_dirty_log_total = timespec_add(clear_dirty_log_total,
 							     ts_diff);
 			clear_dirty_log_total.tv_nsec, avg.tv_sec, avg.tv_nsec);
 	}
-	free(bmap);
+	free_bitmaps(bitmaps, p->slots);
 	free(vcpu_threads);
 	perf_test_destroy_vm(vm);
 }
 	printf(" -v: specify the number of vCPUs to run.\n");
 	printf(" -o: Overlap guest memory accesses instead of partitioning\n"
 	       "     them into a separate region of memory for each vCPU.\n");
-	printf(" -s: specify the type of memory that should be used to\n"
+	backing_src_help("-s");
-	       "     back the guest data region.\n\n");
 	printf(" -x: Split the memory region into this number of memslots.\n"
-	       "     (default: 1)");
+	       "     (default: 1)\n");
-	backing_src_help();
 	puts("");
 	exit(0);
 }
 		.iterations = TEST_HOST_LOOP_N,
 		.wr_fract = 1,
 		.partition_vcpu_memory_access = true,
-		.backing_src = VM_MEM_SRC_ANONYMOUS,
+		.backing_src = DEFAULT_VM_MEM_SRC,
 		.slots = 1,
 	};
 	int opt;

tools/testing/selftests/kvm/include/test_util.h+3−1

 	NUM_SRC_TYPES,
 };
+#define DEFAULT_VM_MEM_SRC VM_MEM_SRC_ANONYMOUS
 struct vm_mem_backing_src_alias {
 	const char *name;
 	uint32_t flag;
 size_t get_def_hugetlb_pagesz(void);
 const struct vm_mem_backing_src_alias *vm_mem_backing_src_alias(uint32_t i);
 size_t get_backing_src_pagesz(uint32_t i);
-void backing_src_help(void);
+void backing_src_help(const char *flag);
 enum vm_mem_backing_src_type parse_backing_src_type(const char *type_name);
 long get_run_delay(void);

tools/testing/selftests/kvm/include/x86_64/processor.h+17−17

 	}
 }
-typedef unsigned long v1di __attribute__ ((vector_size (8)));
+#define GET_XMM(__xmm)							\
+({									\
+	unsigned long __val;						\
+	asm volatile("movq %%"#__xmm", %0" : "=r"(__val));		\
+	__val;								\
+})
 static inline unsigned long get_xmm(int n)
 {
 	assert(n >= 0 && n <= 7);
-	register v1di xmm0 __asm__("%xmm0");
-	register v1di xmm1 __asm__("%xmm1");
-	register v1di xmm2 __asm__("%xmm2");
-	register v1di xmm3 __asm__("%xmm3");
-	register v1di xmm4 __asm__("%xmm4");
-	register v1di xmm5 __asm__("%xmm5");
-	register v1di xmm6 __asm__("%xmm6");
-	register v1di xmm7 __asm__("%xmm7");
 	switch (n) {
 	case 0:
-		return (unsigned long)xmm0;
+		return GET_XMM(xmm0);
 	case 1:
-		return (unsigned long)xmm1;
+		return GET_XMM(xmm1);
 	case 2:
-		return (unsigned long)xmm2;
+		return GET_XMM(xmm2);
 	case 3:
-		return (unsigned long)xmm3;
+		return GET_XMM(xmm3);
 	case 4:
-		return (unsigned long)xmm4;
+		return GET_XMM(xmm4);
 	case 5:
-		return (unsigned long)xmm5;
+		return GET_XMM(xmm5);
 	case 6:
-		return (unsigned long)xmm6;
+		return GET_XMM(xmm6);
 	case 7:
-		return (unsigned long)xmm7;
+		return GET_XMM(xmm7);
 	}
+	/* never reached */
 	return 0;
 }

tools/testing/selftests/kvm/kvm_page_table_test.c+2−5

 	       "     (default: 1G)\n");
 	printf(" -v: specify the number of vCPUs to run\n"
 	       "     (default: 1)\n");
-	printf(" -s: specify the type of memory that should be used to\n"
+	backing_src_help("-s");
-	       "     back the guest data region.\n"
-	       "     (default: anonymous)\n\n");
-	backing_src_help();
 	puts("");
 }
 	int max_vcpus = kvm_check_cap(KVM_CAP_MAX_VCPUS);
 	struct test_params p = {
 		.test_mem_size = DEFAULT_TEST_MEM_SIZE,
-		.src_type = VM_MEM_SRC_ANONYMOUS,
+		.src_type = DEFAULT_VM_MEM_SRC,
 	};
 	int opt;

tools/testing/selftests/kvm/lib/test_util.c+13−4

 	}
 }
-void backing_src_help(void)
+static void print_available_backing_src_types(const char *prefix)
 {
 	int i;
-	printf("Available backing src types:\n");
+	printf("%sAvailable backing src types:\n", prefix);
 	for (i = 0; i < NUM_SRC_TYPES; i++)
-		printf("\t%s\n", vm_mem_backing_src_alias(i)->name);
+		printf("%s    %s\n", prefix, vm_mem_backing_src_alias(i)->name);
+}
+void backing_src_help(const char *flag)
+{
+	printf(" %s: specify the type of memory that should be used to\n"
+	       "     back the guest data region. (default: %s)\n",
+	       flag, vm_mem_backing_src_alias(DEFAULT_VM_MEM_SRC)->name);
+	print_available_backing_src_types("     ");
 }
 enum vm_mem_backing_src_type parse_backing_src_type(const char *type_name)
 		if (!strcmp(type_name, vm_mem_backing_src_alias(i)->name))
 			return i;
-	backing_src_help();
+	print_available_backing_src_types("");
 	TEST_FAIL("Unknown backing src type: %s", type_name);
 	return -1;
 }

tools/testing/selftests/kvm/rseq_test.c+60−10

@@ -10,6 +10,7 @@ · 9 unmodified lines
10	#include <signal.h>	10	#include <signal.h>
11	#include <syscall.h>	11	#include <syscall.h>
12	#include <sys/ioctl.h>	12	#include <sys/ioctl.h>
		13	#include <sys/sysinfo.h>
13	#include <asm/barrier.h>	14	#include <asm/barrier.h>
14	#include <linux/atomic.h>	15	#include <linux/atomic.h>
15	#include <linux/rseq.h>	16	#include <linux/rseq.h>
@@ -39,6 +40,7 @@ static __thread volatile struct rseq __rseq = { · 23 unmodified lines
39		40
40	static pthread_t migration_thread;	41	static pthread_t migration_thread;
41	static cpu_set_t possible_mask;	42	static cpu_set_t possible_mask;
		43	static int min_cpu, max_cpu;
42	static bool done;	44	static bool done;
43		45
44	static atomic_t seq_cnt;	46	static atomic_t seq_cnt;
@@ -57,20 +59,37 @@ static void sys_rseq(int flags) · 12 unmodified lines
57	TEST_ASSERT(!r, "rseq failed, errno = %d (%s)", errno, strerror(errno));	59	TEST_ASSERT(!r, "rseq failed, errno = %d (%s)", errno, strerror(errno));
58	}	60	}
59		61
		62	static int next_cpu(int cpu)
		63	{
		64	/*
		65	* Advance to the next CPU, skipping those that weren't in the original
		66	* affinity set. Sadly, there is no CPU_SET_FOR_EACH, and cpu_set_t's
		67	* data storage is considered as opaque. Note, if this task is pinned
		68	* to a small set of discontigous CPUs, e.g. 2 and 1023, this loop will
		69	* burn a lot cycles and the test will take longer than normal to
		70	* complete.
		71	*/
		72	do {
		73	cpu++;
		74	if (cpu > max_cpu) {
		75	cpu = min_cpu;
		76	TEST_ASSERT(CPU_ISSET(cpu, &possible_mask),
		77	"Min CPU = %d must always be usable", cpu);
		78	break;
		79	}
		80	} while (!CPU_ISSET(cpu, &possible_mask));
		81
		82	return cpu;
		83	}
		84
60	static void migration_worker(void ign)	85	static void migration_worker(void ign)
61	{	86	{
62	cpu_set_t allowed_mask;	87	cpu_set_t allowed_mask;
63	int r, i, nr_cpus, cpu;	88	int r, i, cpu;
64		89
65	CPU_ZERO(&allowed_mask);	90	CPU_ZERO(&allowed_mask);
66		91
67	nr_cpus = CPU_COUNT(&possible_mask);	92	for (i = 0, cpu = min_cpu; i < NR_TASK_MIGRATIONS; i++, cpu = next_cpu(cpu)) {
68
69	for (i = 0; i < NR_TASK_MIGRATIONS; i++) {
70	cpu = i % nr_cpus;
71	if (!CPU_ISSET(cpu, &possible_mask))
72	continue;
73
74	CPU_SET(cpu, &allowed_mask);	93	CPU_SET(cpu, &allowed_mask);
75		94
76	/*	95	/*
@@ -154,6 +173,36 @@ static void migration_worker(void ign) · 77 unmodified lines
154	return NULL;	173	return NULL;
155	}	174	}
156		175
		176	static int calc_min_max_cpu(void)
		177	{
		178	int i, cnt, nproc;
		179
		180	if (CPU_COUNT(&possible_mask) < 2)
		181	return -EINVAL;
		182
		183	/*
		184	* CPU_SET doesn't provide a FOR_EACH helper, get the min/max CPU that
		185	* this task is affined to in order to reduce the time spent querying
		186	* unusable CPUs, e.g. if this task is pinned to a small percentage of
		187	* total CPUs.
		188	*/
		189	nproc = get_nprocs_conf();
		190	min_cpu = -1;
		191	max_cpu = -1;
		192	cnt = 0;
		193
		194	for (i = 0; i < nproc; i++) {
		195	if (!CPU_ISSET(i, &possible_mask))
		196	continue;
		197	if (min_cpu == -1)
		198	min_cpu = i;
		199	max_cpu = i;
		200	cnt++;
		201	}
		202
		203	return (cnt < 2) ? -EINVAL : 0;
		204	}
		205
157	int main(int argc, char *argv[])	206	int main(int argc, char *argv[])
158	{	207	{
159	int r, i, snapshot;	208	int r, i, snapshot;
@@ -167,8 +216,8 @@ int main(int argc, char *argv[]) · 7 unmodified lines
167	TEST_ASSERT(!r, "sched_getaffinity failed, errno = %d (%s)", errno,	216	TEST_ASSERT(!r, "sched_getaffinity failed, errno = %d (%s)", errno,
168	strerror(errno));	217	strerror(errno));
169		218
170	if (CPU_COUNT(&possible_mask) < 2) {	219	if (calc_min_max_cpu()) {
171	print_skip("Only one CPU, task migration not possible\n");	220	print_skip("Only one usable CPU, task migration not possible");
172	exit(KSFT_SKIP);	221	exit(KSFT_SKIP);
173	}	222	}
174		223
@@ -180,6 +229,7 @@ int main(int argc, char *argv[]) · 5 unmodified lines
180	* CPU affinity.	229	* CPU affinity.
181	*/	230	*/
182	vm = vm_create_default(VCPU_ID, 0, guest_code);	231	vm = vm_create_default(VCPU_ID, 0, guest_code);
		232	ucall_init(vm, NULL);
183		233
184	pthread_create(&migration_thread, NULL, migration_worker, 0);	234	pthread_create(&migration_thread, NULL, migration_worker, 0);
185		235

tools/testing/selftests/kvm/steal_time.c+2−2

@@ -116,12 +116,12 @@ struct st_time { · 115 unmodified lines
116	uint64_t st_time;	116	uint64_t st_time;
117	};	117	};
118		118
119	static int64_t smccc(uint32_t func, uint32_t arg)	119	static int64_t smccc(uint32_t func, uint64_t arg)
120	{	120	{
121	unsigned long ret;	121	unsigned long ret;
122		122
123	asm volatile(	123	asm volatile(
124	"mov x0, %1\n"	124	"mov w0, %w1\n"
125	"mov x1, %2\n"	125	"mov x1, %2\n"
126	"hvc #0\n"	126	"hvc #0\n"
127	"mov %0, x0\n"	127	"mov %0, x0\n"

tools/testing/selftests/kvm/x86_64/svm_int_ctl_test.c+128−0

@@ -0,0 +1,128 @@
	1	// SPDX-License-Identifier: GPL-2.0-only
	2	/*
	3	* svm_int_ctl_test
	4	*
	5	* Copyright (C) 2021, Red Hat, Inc.
	6	*
	7	* Nested SVM testing: test simultaneous use of V_IRQ from L1 and L0.
	8	*/
	9
	10	#include "test_util.h"
	11	#include "kvm_util.h"
	12	#include "processor.h"
	13	#include "svm_util.h"
	14	#include "apic.h"
	15
	16	#define VCPU_ID 0
	17
	18	static struct kvm_vm *vm;
	19
	20	bool vintr_irq_called;
	21	bool intr_irq_called;
	22
	23	#define VINTR_IRQ_NUMBER 0x20
	24	#define INTR_IRQ_NUMBER 0x30
	25
	26	static void vintr_irq_handler(struct ex_regs *regs)
	27	{
	28	vintr_irq_called = true;
	29	}
	30
	31	static void intr_irq_handler(struct ex_regs *regs)
	32	{
	33	x2apic_write_reg(APIC_EOI, 0x00);
	34	intr_irq_called = true;
	35	}
	36
	37	static void l2_guest_code(struct svm_test_data *svm)
	38	{
	39	/* This code raises interrupt INTR_IRQ_NUMBER in the L1's LAPIC,
	40	* and since L1 didn't enable virtual interrupt masking,
	41	* L2 should receive it and not L1.
	42	*
	43	* L2 also has virtual interrupt 'VINTR_IRQ_NUMBER' pending in V_IRQ
	44	* so it should also receive it after the following 'sti'.
	45	*/
	46	x2apic_write_reg(APIC_ICR,
	47	APIC_DEST_SELF \| APIC_INT_ASSERT \| INTR_IRQ_NUMBER);
	48
	49	__asm__ __volatile__(
	50	"sti\n"
	51	"nop\n"
	52	);
	53
	54	GUEST_ASSERT(vintr_irq_called);
	55	GUEST_ASSERT(intr_irq_called);
	56
	57	__asm__ __volatile__(
	58	"vmcall\n"
	59	);
	60	}
	61
	62	static void l1_guest_code(struct svm_test_data *svm)
	63	{
	64	#define L2_GUEST_STACK_SIZE 64
	65	unsigned long l2_guest_stack[L2_GUEST_STACK_SIZE];
	66	struct vmcb *vmcb = svm->vmcb;
	67
	68	x2apic_enable();
	69
	70	/* Prepare for L2 execution. */
	71	generic_svm_setup(svm, l2_guest_code,
	72	&l2_guest_stack[L2_GUEST_STACK_SIZE]);
	73
	74	/* No virtual interrupt masking */
	75	vmcb->control.int_ctl &= ~V_INTR_MASKING_MASK;
	76
	77	/* No intercepts for real and virtual interrupts */
	78	vmcb->control.intercept &= ~(1ULL << INTERCEPT_INTR \| INTERCEPT_VINTR);
	79
	80	/* Make a virtual interrupt VINTR_IRQ_NUMBER pending */
	81	vmcb->control.int_ctl \|= V_IRQ_MASK \| (0x1 << V_INTR_PRIO_SHIFT);
	82	vmcb->control.int_vector = VINTR_IRQ_NUMBER;
	83
	84	run_guest(vmcb, svm->vmcb_gpa);
	85	GUEST_ASSERT(vmcb->control.exit_code == SVM_EXIT_VMMCALL);
	86	GUEST_DONE();
	87	}
	88
	89	int main(int argc, char *argv[])
	90	{
	91	vm_vaddr_t svm_gva;
	92
	93	nested_svm_check_supported();
	94
	95	vm = vm_create_default(VCPU_ID, 0, (void *) l1_guest_code);
	96
	97	vm_init_descriptor_tables(vm);
	98	vcpu_init_descriptor_tables(vm, VCPU_ID);
	99
	100	vm_install_exception_handler(vm, VINTR_IRQ_NUMBER, vintr_irq_handler);
	101	vm_install_exception_handler(vm, INTR_IRQ_NUMBER, intr_irq_handler);
	102
	103	vcpu_alloc_svm(vm, &svm_gva);
	104	vcpu_args_set(vm, VCPU_ID, 1, svm_gva);
	105
	106	struct kvm_run *run = vcpu_state(vm, VCPU_ID);
	107	struct ucall uc;
	108
	109	vcpu_run(vm, VCPU_ID);
	110	TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
	111	"Got exit_reason other than KVM_EXIT_IO: %u (%s)\n",
	112	run->exit_reason,
	113	exit_reason_str(run->exit_reason));
	114
	115	switch (get_ucall(vm, VCPU_ID, &uc)) {
	116	case UCALL_ABORT:
	117	TEST_FAIL("%s", (const char *)uc.args[0]);
	118	break;
	119	/* NOT REACHED */
	120	case UCALL_DONE:
	121	goto done;
	122	default:
	123	TEST_FAIL("Unknown ucall 0x%lx.", uc.cmd);
	124	}
	125	done:
	126	kvm_vm_free(vm);
	127	return 0;
	128	}

tools/testing/selftests/netfilter/nft_nat_zones.sh+309−0

@@ -0,0 +1,309 @@
	1	#!/bin/bash
	2	#
	3	# Test connection tracking zone and NAT source port reallocation support.
	4	#
	5
	6	# Kselftest framework requirement - SKIP code is 4.
	7	ksft_skip=4
	8
	9	# Don't increase too much, 2000 clients should work
	10	# just fine but script can then take several minutes with
	11	# KASAN/debug builds.
	12	maxclients=100
	13
	14	have_iperf=1
	15	ret=0
	16
	17	# client1---.
	18	# veth1-.
	19	# \|
	20	# NAT Gateway --veth0--> Server
	21	# \| \|
	22	# veth2-' \|
	23	# client2---' \|
	24	# .... \|
	25	# clientX----vethX---'
	26
	27	# All clients share identical IP address.
	28	# NAT Gateway uses policy routing and conntrack zones to isolate client
	29	# namespaces. Each client connects to Server, each with colliding tuples:
	30	# clientsaddr:10000 -> serveraddr:dport
	31	# NAT Gateway is supposed to do port reallocation for each of the
	32	# connections.
	33
	34	sfx=$(mktemp -u "XXXXXXXX")
	35	gw="ns-gw-$sfx"
	36	cl1="ns-cl1-$sfx"
	37	cl2="ns-cl2-$sfx"
	38	srv="ns-srv-$sfx"
	39
	40	v4gc1=$(sysctl -n net.ipv4.neigh.default.gc_thresh1 2>/dev/null)
	41	v4gc2=$(sysctl -n net.ipv4.neigh.default.gc_thresh2 2>/dev/null)
	42	v4gc3=$(sysctl -n net.ipv4.neigh.default.gc_thresh3 2>/dev/null)
	43	v6gc1=$(sysctl -n net.ipv6.neigh.default.gc_thresh1 2>/dev/null)
	44	v6gc2=$(sysctl -n net.ipv6.neigh.default.gc_thresh2 2>/dev/null)
	45	v6gc3=$(sysctl -n net.ipv6.neigh.default.gc_thresh3 2>/dev/null)
	46
	47	cleanup()
	48	{
	49	ip netns del $gw
	50	ip netns del $srv
	51	for i in $(seq 1 $maxclients); do
	52	ip netns del ns-cl$i-$sfx 2>/dev/null
	53	done
	54
	55	sysctl -q net.ipv4.neigh.default.gc_thresh1=$v4gc1 2>/dev/null
	56	sysctl -q net.ipv4.neigh.default.gc_thresh2=$v4gc2 2>/dev/null
	57	sysctl -q net.ipv4.neigh.default.gc_thresh3=$v4gc3 2>/dev/null
	58	sysctl -q net.ipv6.neigh.default.gc_thresh1=$v6gc1 2>/dev/null
	59	sysctl -q net.ipv6.neigh.default.gc_thresh2=$v6gc2 2>/dev/null
	60	sysctl -q net.ipv6.neigh.default.gc_thresh3=$v6gc3 2>/dev/null
	61	}
	62
	63	nft --version > /dev/null 2>&1
	64	if [ $? -ne 0 ];then
	65	echo "SKIP: Could not run test without nft tool"
	66	exit $ksft_skip
	67	fi
	68
	69	ip -Version > /dev/null 2>&1
	70	if [ $? -ne 0 ];then
	71	echo "SKIP: Could not run test without ip tool"
	72	exit $ksft_skip
	73	fi
	74
	75	conntrack -V > /dev/null 2>&1
	76	if [ $? -ne 0 ];then
	77	echo "SKIP: Could not run test without conntrack tool"
	78	exit $ksft_skip
	79	fi
	80
	81	iperf3 -v >/dev/null 2>&1
	82	if [ $? -ne 0 ];then
	83	have_iperf=0
	84	fi
	85
	86	ip netns add "$gw"
	87	if [ $? -ne 0 ];then
	88	echo "SKIP: Could not create net namespace $gw"
	89	exit $ksft_skip
	90	fi
	91	ip -net "$gw" link set lo up
	92
	93	trap cleanup EXIT
	94
	95	ip netns add "$srv"
	96	if [ $? -ne 0 ];then
	97	echo "SKIP: Could not create server netns $srv"
	98	exit $ksft_skip
	99	fi
	100
	101	ip link add veth0 netns "$gw" type veth peer name eth0 netns "$srv"
	102	ip -net "$gw" link set veth0 up
	103	ip -net "$srv" link set lo up
	104	ip -net "$srv" link set eth0 up
	105
	106	sysctl -q net.ipv6.neigh.default.gc_thresh1=512 2>/dev/null
	107	sysctl -q net.ipv6.neigh.default.gc_thresh2=1024 2>/dev/null
	108	sysctl -q net.ipv6.neigh.default.gc_thresh3=4096 2>/dev/null
	109	sysctl -q net.ipv4.neigh.default.gc_thresh1=512 2>/dev/null
	110	sysctl -q net.ipv4.neigh.default.gc_thresh2=1024 2>/dev/null
	111	sysctl -q net.ipv4.neigh.default.gc_thresh3=4096 2>/dev/null
	112
	113	for i in $(seq 1 $maxclients);do
	114	cl="ns-cl$i-$sfx"
	115
	116	ip netns add "$cl"
	117	if [ $? -ne 0 ];then
	118	echo "SKIP: Could not create client netns $cl"
	119	exit $ksft_skip
	120	fi
	121	ip link add veth$i netns "$gw" type veth peer name eth0 netns "$cl" > /dev/null 2>&1
	122	if [ $? -ne 0 ];then
	123	echo "SKIP: No virtual ethernet pair device support in kernel"
	124	exit $ksft_skip
	125	fi
	126	done
	127
	128	for i in $(seq 1 $maxclients);do
	129	cl="ns-cl$i-$sfx"
	130	echo netns exec "$cl" ip link set lo up
	131	echo netns exec "$cl" ip link set eth0 up
	132	echo netns exec "$cl" sysctl -q net.ipv4.tcp_syn_retries=2
	133	echo netns exec "$gw" ip link set veth$i up
	134	echo netns exec "$gw" sysctl -q net.ipv4.conf.veth$i.arp_ignore=2
	135	echo netns exec "$gw" sysctl -q net.ipv4.conf.veth$i.rp_filter=0
	136
	137	# clients have same IP addresses.
	138	echo netns exec "$cl" ip addr add 10.1.0.3/24 dev eth0
	139	echo netns exec "$cl" ip addr add dead:1::3/64 dev eth0
	140	echo netns exec "$cl" ip route add default via 10.1.0.2 dev eth0
	141	echo netns exec "$cl" ip route add default via dead:1::2 dev eth0
	142
	143	# NB: same addresses on client-facing interfaces.
	144	echo netns exec "$gw" ip addr add 10.1.0.2/24 dev veth$i
	145	echo netns exec "$gw" ip addr add dead:1::2/64 dev veth$i
	146
	147	# gw: policy routing
	148	echo netns exec "$gw" ip route add 10.1.0.0/24 dev veth$i table $((1000+i))
	149	echo netns exec "$gw" ip route add dead:1::0/64 dev veth$i table $((1000+i))
	150	echo netns exec "$gw" ip route add 10.3.0.0/24 dev veth0 table $((1000+i))
	151	echo netns exec "$gw" ip route add dead:3::0/64 dev veth0 table $((1000+i))
	152	echo netns exec "$gw" ip rule add fwmark $i lookup $((1000+i))
	153	done \| ip -batch /dev/stdin
	154
	155	ip -net "$gw" addr add 10.3.0.1/24 dev veth0
	156	ip -net "$gw" addr add dead:3::1/64 dev veth0
	157
	158	ip -net "$srv" addr add 10.3.0.99/24 dev eth0
	159	ip -net "$srv" addr add dead:3::99/64 dev eth0
	160
	161	ip netns exec $gw nft -f /dev/stdin<<EOF
	162	table inet raw {
	163	map iiftomark {
	164	type ifname : mark
	165	}
	166
	167	map iiftozone {
	168	typeof iifname : ct zone
	169	}
	170
	171	set inicmp {
	172	flags dynamic
	173	type ipv4_addr . ifname . ipv4_addr
	174	}
	175	set inflows {
	176	flags dynamic
	177	type ipv4_addr . inet_service . ifname . ipv4_addr . inet_service
	178	}
	179
	180	set inflows6 {
	181	flags dynamic
	182	type ipv6_addr . inet_service . ifname . ipv6_addr . inet_service
	183	}
	184
	185	chain prerouting {
	186	type filter hook prerouting priority -64000; policy accept;
	187	ct original zone set meta iifname map @iiftozone
	188	meta mark set meta iifname map @iiftomark
	189
	190	tcp flags & (syn\|ack) == ack add @inflows { ip saddr . tcp sport . meta iifname . ip daddr . tcp dport counter }
	191	add @inflows6 { ip6 saddr . tcp sport . meta iifname . ip6 daddr . tcp dport counter }
	192	ip protocol icmp add @inicmp { ip saddr . meta iifname . ip daddr counter }
	193	}
	194
	195	chain nat_postrouting {
	196	type nat hook postrouting priority 0; policy accept;
	197	ct mark set meta mark meta oifname veth0 masquerade
	198	}
	199
	200	chain mangle_prerouting {
	201	type filter hook prerouting priority -100; policy accept;
	202	ct direction reply meta mark set ct mark
	203	}
	204	}
	205	EOF
	206
	207	( echo add element inet raw iiftomark \{
	208	for i in $(seq 1 $((maxclients-1))); do
	209	echo \"veth$i\" : $i,
	210	done
	211	echo \"veth$maxclients\" : $maxclients \}
	212	echo add element inet raw iiftozone \{
	213	for i in $(seq 1 $((maxclients-1))); do
	214	echo \"veth$i\" : $i,
	215	done
	216	echo \"veth$maxclients\" : $maxclients \}
	217	) \| ip netns exec $gw nft -f /dev/stdin
	218
	219	ip netns exec "$gw" sysctl -q net.ipv4.conf.all.forwarding=1 > /dev/null
	220	ip netns exec "$gw" sysctl -q net.ipv6.conf.all.forwarding=1 > /dev/null
	221	ip netns exec "$gw" sysctl -q net.ipv4.conf.all.rp_filter=0 >/dev/null
	222
	223	# useful for debugging: allows to use 'ping' from clients to gateway.
	224	ip netns exec "$gw" sysctl -q net.ipv4.fwmark_reflect=1 > /dev/null
	225	ip netns exec "$gw" sysctl -q net.ipv6.fwmark_reflect=1 > /dev/null
	226
	227	for i in $(seq 1 $maxclients); do
	228	cl="ns-cl$i-$sfx"
	229	ip netns exec $cl ping -i 0.5 -q -c 3 10.3.0.99 > /dev/null 2>&1 &
	230	if [ $? -ne 0 ]; then
	231	echo FAIL: Ping failure from $cl 1>&2
	232	ret=1
	233	break
	234	fi
	235	done
	236
	237	wait
	238
	239	for i in $(seq 1 $maxclients); do
	240	ip netns exec $gw nft get element inet raw inicmp "{ 10.1.0.3 . \"veth$i\" . 10.3.0.99 }" \| grep -q "{ 10.1.0.3 . \"veth$i\" . 10.3.0.99 counter packets 3 bytes 252 }"
	241	if [ $? -ne 0 ];then
	242	ret=1
	243	echo "FAIL: counter icmp mismatch for veth$i" 1>&2
	244	ip netns exec $gw nft get element inet raw inicmp "{ 10.1.0.3 . \"veth$i\" . 10.3.0.99 }" 1>&2
	245	break
	246	fi
	247	done
	248
	249	ip netns exec $gw nft get element inet raw inicmp "{ 10.3.0.99 . \"veth0\" . 10.3.0.1 }" \| grep -q "{ 10.3.0.99 . \"veth0\" . 10.3.0.1 counter packets $((3 * $maxclients)) bytes $((252 * $maxclients)) }"
	250	if [ $? -ne 0 ];then
	251	ret=1
	252	echo "FAIL: counter icmp mismatch for veth0: { 10.3.0.99 . \"veth0\" . 10.3.0.1 counter packets $((3 * $maxclients)) bytes $((252 * $maxclients)) }"
	253	ip netns exec $gw nft get element inet raw inicmp "{ 10.3.99 . \"veth0\" . 10.3.0.1 }" 1>&2
	254	fi
	255
	256	if [ $ret -eq 0 ]; then
	257	echo "PASS: ping test from all $maxclients namespaces"
	258	fi
	259
	260	if [ $have_iperf -eq 0 ];then
	261	echo "SKIP: iperf3 not installed"
	262	if [ $ret -ne 0 ];then
	263	exit $ret
	264	fi
	265	exit $ksft_skip
	266	fi
	267
	268	ip netns exec $srv iperf3 -s > /dev/null 2>&1 &
	269	iperfpid=$!
	270	sleep 1
	271
	272	for i in $(seq 1 $maxclients); do
	273	if [ $ret -ne 0 ]; then
	274	break
	275	fi
	276	cl="ns-cl$i-$sfx"
	277	ip netns exec $cl iperf3 -c 10.3.0.99 --cport 10000 -n 1 > /dev/null
	278	if [ $? -ne 0 ]; then
	279	echo FAIL: Failure to connect for $cl 1>&2
	280	ip netns exec $gw conntrack -S 1>&2
	281	ret=1
	282	fi
	283	done
	284	if [ $ret -eq 0 ];then
	285	echo "PASS: iperf3 connections for all $maxclients net namespaces"
	286	fi
	287
	288	kill $iperfpid
	289	wait
	290
	291	for i in $(seq 1 $maxclients); do
	292	ip netns exec $gw nft get element inet raw inflows "{ 10.1.0.3 . 10000 . \"veth$i\" . 10.3.0.99 . 5201 }" > /dev/null
	293	if [ $? -ne 0 ];then
	294	ret=1
	295	echo "FAIL: can't find expected tcp entry for veth$i" 1>&2
	296	break
	297	fi
	298	done
	299	if [ $ret -eq 0 ];then
	300	echo "PASS: Found client connection for all $maxclients net namespaces"
	301	fi
	302
	303	ip netns exec $gw nft get element inet raw inflows "{ 10.3.0.99 . 5201 . \"veth0\" . 10.3.0.1 . 10000 }" > /dev/null
	304	if [ $? -ne 0 ];then
	305	ret=1
	306	echo "FAIL: cannot find return entry on veth0" 1>&2
	307	fi
	308
	309	exit $ret

tools/testing/selftests/netfilter/nft_zones_many.sh+156−0

@@ -0,0 +1,156 @@
	1	#!/bin/bash
	2
	3	# Test insertion speed for packets with identical addresses/ports
	4	# that are all placed in distinct conntrack zones.
	5
	6	sfx=$(mktemp -u "XXXXXXXX")
	7	ns="ns-$sfx"
	8
	9	# Kselftest framework requirement - SKIP code is 4.
	10	ksft_skip=4
	11
	12	zones=20000
	13	have_ct_tool=0
	14	ret=0
	15
	16	cleanup()
	17	{
	18	ip netns del $ns
	19	}
	20
	21	ip netns add $ns
	22	if [ $? -ne 0 ];then
	23	echo "SKIP: Could not create net namespace $gw"
	24	exit $ksft_skip
	25	fi
	26
	27	trap cleanup EXIT
	28
	29	conntrack -V > /dev/null 2>&1
	30	if [ $? -eq 0 ];then
	31	have_ct_tool=1
	32	fi
	33
	34	ip -net "$ns" link set lo up
	35
	36	test_zones() {
	37	local max_zones=$1
	38
	39	ip netns exec $ns sysctl -q net.netfilter.nf_conntrack_udp_timeout=3600
	40	ip netns exec $ns nft -f /dev/stdin<<EOF
	41	flush ruleset
	42	table inet raw {
	43	map rndzone {
	44	typeof numgen inc mod $max_zones : ct zone
	45	}
	46
	47	chain output {
	48	type filter hook output priority -64000; policy accept;
	49	udp dport 12345 ct zone set numgen inc mod 65536 map @rndzone
	50	}
	51	}
	52	EOF
	53	(
	54	echo "add element inet raw rndzone {"
	55	for i in $(seq 1 $max_zones);do
	56	echo -n "$i : $i"
	57	if [ $i -lt $max_zones ]; then
	58	echo ","
	59	else
	60	echo "}"
	61	fi
	62	done
	63	) \| ip netns exec $ns nft -f /dev/stdin
	64
	65	local i=0
	66	local j=0
	67	local outerstart=$(date +%s%3N)
	68	local stop=$outerstart
	69
	70	while [ $i -lt $max_zones ]; do
	71	local start=$(date +%s%3N)
	72	i=$((i + 10000))
	73	j=$((j + 1))
	74	dd if=/dev/zero of=/dev/stdout bs=8k count=10000 2>/dev/null \| ip netns exec "$ns" nc -w 1 -q 1 -u -p 12345 127.0.0.1 12345 > /dev/null
	75	if [ $? -ne 0 ] ;then
	76	ret=1
	77	break
	78	fi
	79
	80	stop=$(date +%s%3N)
	81	local duration=$((stop-start))
	82	echo "PASS: added 10000 entries in $duration ms (now $i total, loop $j)"
	83	done
	84
	85	if [ $have_ct_tool -eq 1 ]; then
	86	local count=$(ip netns exec "$ns" conntrack -C)
	87	local duration=$((stop-outerstart))
	88
	89	if [ $count -eq $max_zones ]; then
	90	echo "PASS: inserted $count entries from packet path in $duration ms total"
	91	else
	92	ip netns exec $ns conntrack -S 1>&2
	93	echo "FAIL: inserted $count entries from packet path in $duration ms total, expected $max_zones entries"
	94	ret=1
	95	fi
	96	fi
	97
	98	if [ $ret -ne 0 ];then
	99	echo "FAIL: insert $max_zones entries from packet path" 1>&2
	100	fi
	101	}
	102
	103	test_conntrack_tool() {
	104	local max_zones=$1
	105
	106	ip netns exec $ns conntrack -F >/dev/null 2>/dev/null
	107
	108	local outerstart=$(date +%s%3N)
	109	local start=$(date +%s%3N)
	110	local stop=$start
	111	local i=0
	112	while [ $i -lt $max_zones ]; do
	113	i=$((i + 1))
	114	ip netns exec "$ns" conntrack -I -s 1.1.1.1 -d 2.2.2.2 --protonum 6 \
	115	--timeout 3600 --state ESTABLISHED --sport 12345 --dport 1000 --zone $i >/dev/null 2>&1
	116	if [ $? -ne 0 ];then
	117	ip netns exec "$ns" conntrack -I -s 1.1.1.1 -d 2.2.2.2 --protonum 6 \
	118	--timeout 3600 --state ESTABLISHED --sport 12345 --dport 1000 --zone $i > /dev/null
	119	echo "FAIL: conntrack -I returned an error"
	120	ret=1
	121	break
	122	fi
	123
	124	if [ $((i%10000)) -eq 0 ];then
	125	stop=$(date +%s%3N)
	126
	127	local duration=$((stop-start))
	128	echo "PASS: added 10000 entries in $duration ms (now $i total)"
	129	start=$stop
	130	fi
	131	done
	132
	133	local count=$(ip netns exec "$ns" conntrack -C)
	134	local duration=$((stop-outerstart))
	135
	136	if [ $count -eq $max_zones ]; then
	137	echo "PASS: inserted $count entries via ctnetlink in $duration ms"
	138	else
	139	ip netns exec $ns conntrack -S 1>&2
	140	echo "FAIL: inserted $count entries via ctnetlink in $duration ms, expected $max_zones entries ($duration ms)"
	141	ret=1
	142	fi
	143	}
	144
	145	test_zones $zones
	146
	147	if [ $have_ct_tool -eq 1 ];then
	148	test_conntrack_tool $zones
	149	else
	150	echo "SKIP: Could not run ctnetlink insertion test without conntrack tool"
	151	if [ $ret -eq 0 ];then
	152	exit $ksft_skip
	153	fi
	154	fi
	155
	156	exit $ret

virt/kvm/kvm_main.c+49−19

 {
 }
-static inline bool kvm_kick_many_cpus(const struct cpumask *cpus, bool wait)
+static inline bool kvm_kick_many_cpus(cpumask_var_t tmp, bool wait)
 {
-	if (unlikely(!cpus))
+	const struct cpumask *cpus;
+	if (likely(cpumask_available(tmp)))
+		cpus = tmp;
+	else
 		cpus = cpu_online_mask;
 	if (cpumask_empty(cpus))
 			continue;
 		kvm_make_request(req, vcpu);
-		cpu = vcpu->cpu;
 		if (!(req & KVM_REQUEST_NO_WAKEUP) && kvm_vcpu_wake_up(vcpu))
 			continue;
-		if (tmp != NULL && cpu != -1 && cpu != me &&
+		/*
-		    kvm_request_needs_ipi(vcpu, req))
+		 * tmp can be "unavailable" if cpumasks are allocated off stack
-			__cpumask_set_cpu(cpu, tmp);
+		 * as allocation of the mask is deliberately not fatal and is
+		 * handled by falling back to kicking all online CPUs.
+		 */
+		if (!cpumask_available(tmp))
+			continue;
+		/*
+		 * Note, the vCPU could get migrated to a different pCPU at any
+		 * point after kvm_request_needs_ipi(), which could result in
+		 * sending an IPI to the previous pCPU.  But, that's ok because
+		 * the purpose of the IPI is to ensure the vCPU returns to
+		 * OUTSIDE_GUEST_MODE, which is satisfied if the vCPU migrates.
+		 * Entering READING_SHADOW_PAGE_TABLES after this point is also
+		 * ok, as the requirement is only that KVM wait for vCPUs that
+		 * were reading SPTEs _before_ any changes were finalized.  See
+		 * kvm_vcpu_kick() for more details on handling requests.
+		 */
+		if (kvm_request_needs_ipi(vcpu, req)) {
+			cpu = READ_ONCE(vcpu->cpu);
+			if (cpu != -1 && cpu != me)
+				__cpumask_set_cpu(cpu, tmp);
+		}
 	}
 	called = kvm_kick_many_cpus(tmp, !!(req & KVM_REQUEST_WAIT));
 #ifndef CONFIG_HAVE_KVM_ARCH_TLB_FLUSH_ALL
 void kvm_flush_remote_tlbs(struct kvm *kvm)
 {
-	/*
-	 * Read tlbs_dirty before setting KVM_REQ_TLB_FLUSH in
-	 * kvm_make_all_cpus_request.
-	 */
-	long dirty_count = smp_load_acquire(&kvm->tlbs_dirty);
 	++kvm->stat.generic.remote_tlb_flush_requests;
 	/*
 	 * We want to publish modifications to the page tables before reading
 	 * mode. Pairs with a memory barrier in arch-specific code.
 	if (!kvm_arch_flush_remote_tlb(kvm)
 	    || kvm_make_all_cpus_request(kvm, KVM_REQ_TLB_FLUSH))
 		++kvm->stat.generic.remote_tlb_flush;
-	cmpxchg(&kvm->tlbs_dirty, dirty_count, 0);
 }
 EXPORT_SYMBOL_GPL(kvm_flush_remote_tlbs);
 #endif
 		}
 	}
-	if (range->flush_on_ret && (ret || kvm->tlbs_dirty))
+	if (range->flush_on_ret && ret)
 		kvm_flush_remote_tlbs(kvm);
 	if (locked)
 static void shrink_halt_poll_ns(struct kvm_vcpu *vcpu)
 {
-	unsigned int old, val, shrink;
+	unsigned int old, val, shrink, grow_start;
 	old = val = vcpu->halt_poll_ns;
 	shrink = READ_ONCE(halt_poll_ns_shrink);
+	grow_start = READ_ONCE(halt_poll_ns_grow_start);
 	if (shrink == 0)
 		val = 0;
 	else
 		val /= shrink;
+	if (val < grow_start)
+		val = 0;
 	vcpu->halt_poll_ns = val;
 	trace_kvm_halt_poll_ns_shrink(vcpu->vcpu_id, val, old);
 }
  */
 void kvm_vcpu_kick(struct kvm_vcpu *vcpu)
 {
-	int me;
+	int me, cpu;
-	int cpu = vcpu->cpu;
 	if (kvm_vcpu_wake_up(vcpu))
 		return;
+	/*
+	 * Note, the vCPU could get migrated to a different pCPU at any point
+	 * after kvm_arch_vcpu_should_kick(), which could result in sending an
+	 * IPI to the previous pCPU.  But, that's ok because the purpose of the
+	 * IPI is to force the vCPU to leave IN_GUEST_MODE, and migrating the
+	 * vCPU also requires it to leave IN_GUEST_MODE.
+	 */
 	me = get_cpu();
-	if (cpu != me && (unsigned)cpu < nr_cpu_ids && cpu_online(cpu))
+	if (kvm_arch_vcpu_should_kick(vcpu)) {
-		if (kvm_arch_vcpu_should_kick(vcpu))
+		cpu = READ_ONCE(vcpu->cpu);
+		if (cpu != me && (unsigned)cpu < nr_cpu_ids && cpu_online(cpu))
 			smp_send_reschedule(cpu);
+	}
 	put_cpu();
 }
 EXPORT_SYMBOL_GPL(kvm_vcpu_kick);

@@ -1942,18 +1942,18 @@ static int dmar_fault_do_one(struct intel_iommu *iommu, int type, · 1941 unmodified lines
1942	reason = dmar_get_fault_reason(fault_reason, &fault_type);	1942	reason = dmar_get_fault_reason(fault_reason, &fault_type);
1943		1943
1944	if (fault_type == INTR_REMAP)	1944	if (fault_type == INTR_REMAP)
1945	pr_err("[INTR-REMAP] Request device [0x%02x:0x%02x.%d] fault index 0x%llx [fault reason 0x%02x] %s\n",	1945	pr_err("[INTR-REMAP] Request device [%02x:%02x.%d] fault index 0x%llx [fault reason 0x%02x] %s\n",
1946	source_id >> 8, PCI_SLOT(source_id & 0xFF),	1946	source_id >> 8, PCI_SLOT(source_id & 0xFF),
1947	PCI_FUNC(source_id & 0xFF), addr >> 48,	1947	PCI_FUNC(source_id & 0xFF), addr >> 48,
1948	fault_reason, reason);	1948	fault_reason, reason);
1949	else if (pasid == INVALID_IOASID)	1949	else if (pasid == INVALID_IOASID)
1950	pr_err("[%s NO_PASID] Request device [0x%02x:0x%02x.%d] fault addr 0x%llx [fault reason 0x%02x] %s\n",	1950	pr_err("[%s NO_PASID] Request device [%02x:%02x.%d] fault addr 0x%llx [fault reason 0x%02x] %s\n",
1951	type ? "DMA Read" : "DMA Write",	1951	type ? "DMA Read" : "DMA Write",
1952	source_id >> 8, PCI_SLOT(source_id & 0xFF),	1952	source_id >> 8, PCI_SLOT(source_id & 0xFF),
1953	PCI_FUNC(source_id & 0xFF), addr,	1953	PCI_FUNC(source_id & 0xFF), addr,
1954	fault_reason, reason);	1954	fault_reason, reason);
1955	else	1955	else
1956	pr_err("[%s PASID 0x%x] Request device [0x%02x:0x%02x.%d] fault addr 0x%llx [fault reason 0x%02x] %s\n",	1956	pr_err("[%s PASID 0x%x] Request device [%02x:%02x.%d] fault addr 0x%llx [fault reason 0x%02x] %s\n",
1957	type ? "DMA Read" : "DMA Write", pasid,	1957	type ? "DMA Read" : "DMA Write", pasid,
1958	source_id >> 8, PCI_SLOT(source_id & 0xFF),	1958	source_id >> 8, PCI_SLOT(source_id & 0xFF),
1959	PCI_FUNC(source_id & 0xFF), addr,	1959	PCI_FUNC(source_id & 0xFF), addr,