lael-labs/linux

.mailmap+5−0

 Felipe W Damasio <felipewd@terra.com.br>
 Felix Kuhling <fxkuehl@gmx.de>
 Felix Moeller <felix@derklecks.de>
+Feng Tang <feng.79.tang@gmail.com> <feng.tang@intel.com>
 Fenglin Wu <quic_fenglinw@quicinc.com> <fenglinw@codeaurora.org>
 Filipe Lautert <filipe@icewall.org>
 Finn Thain <fthain@linux-m68k.org> <fthain@telegraphics.com.au>
 Jean Tourrilhes <jt@hpl.hp.com>
 Jeevan Shriram <quic_jshriram@quicinc.com> <jshriram@codeaurora.org>
 Jeff Garzik <jgarzik@pretzel.yyz.us>
+Jeff Johnson <jeff.johnson@oss.qualcomm.com> <jjohnson@codeaurora.org>
+Jeff Johnson <jeff.johnson@oss.qualcomm.com> <quic_jjohnson@quicinc.com>
 Jeff Layton <jlayton@kernel.org> <jlayton@poochiereds.net>
 Jeff Layton <jlayton@kernel.org> <jlayton@primarydata.com>
 Jeff Layton <jlayton@kernel.org> <jlayton@redhat.com>
 Julien Thierry <julien.thierry.kdev@gmail.com> <julien.thierry@arm.com>
 Iskren Chernev <me@iskren.info> <iskren.chernev@gmail.com>
 Kalle Valo <kvalo@kernel.org> <kvalo@codeaurora.org>
+Kalle Valo <kvalo@kernel.org> <quic_kvalo@quicinc.com>
 Kalyan Thota <quic_kalyant@quicinc.com> <kalyan_t@codeaurora.org>
 Karthikeyan Periyasamy <quic_periyasa@quicinc.com> <periyasa@codeaurora.org>
 Kathiravan T <quic_kathirav@quicinc.com> <kathirav@codeaurora.org>
 Nicholas Piggin <npiggin@gmail.com> <npiggin@suse.de>
 Nicholas Piggin <npiggin@gmail.com> <nickpiggin@yahoo.com.au>
 Nicholas Piggin <npiggin@gmail.com> <piggin@cyberone.com.au>
+Nick Desaulniers <nick.desaulniers+lkml@gmail.com> <ndesaulniers@google.com>
 Nicolas Ferre <nicolas.ferre@microchip.com> <nicolas.ferre@atmel.com>
 Nicolas Pitre <nico@fluxnic.net> <nicolas.pitre@linaro.org>
 Nicolas Pitre <nico@fluxnic.net> <nico@linaro.org>

CREDITS+2−4

@@ -2515,11 +2515,9 @@ D: SLS distribution · 2514 unmodified lines
2515	D: Initial implementation of VC's, pty's and select()	2515	D: Initial implementation of VC's, pty's and select()
2516		2516
2517	N: Pavel Machek	2517	N: Pavel Machek
2518	E: pavel@ucw.cz	2518	E: pavel@kernel.org
2519	P: 4096R/92DFCE96 4FA7 9EEF FCD4 C44F C585 B8C7 C060 2241 92DF CE96	2519	P: 4096R/92DFCE96 4FA7 9EEF FCD4 C44F C585 B8C7 C060 2241 92DF CE96
2520	D: Softcursor for vga, hypertech cdrom support, vcsa bugfix, nbd,	2520	D: NBD, Sun4/330 port, USB, work on suspend-to-ram/disk,
2521	D: sun4/330 port, capabilities for elf, speedup for rm on ext2, USB,
2522	D: work on suspend-to-ram/disk, killing duplicates from ioctl32,
2523	D: Altera SoCFPGA and Nokia N900 support.	2521	D: Altera SoCFPGA and Nokia N900 support.
2524	S: Czech Republic	2522	S: Czech Republic
2525		2523

Documentation/arch/arm64/gcs.rst+1−1

@@ -37,7 +37,7 @@ intended to be exhaustive. · 36 unmodified lines
37	shadow stacks rather than GCS.	37	shadow stacks rather than GCS.
38		38
39	* Support for GCS is reported to userspace via HWCAP_GCS in the aux vector	39	* Support for GCS is reported to userspace via HWCAP_GCS in the aux vector
40	AT_HWCAP2 entry.	40	AT_HWCAP entry.
41		41
42	* GCS is enabled per thread. While there is support for disabling GCS	42	* GCS is enabled per thread. While there is support for disabling GCS
43	at runtime this should be done with great care.	43	at runtime this should be done with great care.

Documentation/devicetree/bindings/clock/qcom,gpucc.yaml+3−0

 maintainers:
   - Taniya Das <quic_tdas@quicinc.com>
+  - Imran Shaik <quic_imrashai@quicinc.com>
 description: |
   Qualcomm graphics clock control module provides the clocks, resets and power
     include/dt-bindings/clock/qcom,gpucc-sm8150.h
     include/dt-bindings/clock/qcom,gpucc-sm8250.h
     include/dt-bindings/clock/qcom,gpucc-sm8350.h
+    include/dt-bindings/clock/qcom,qcs8300-gpucc.h
 properties:
   compatible:
     enum:
+      - qcom,qcs8300-gpucc
       - qcom,sdm845-gpucc
       - qcom,sa8775p-gpucc
       - qcom,sc7180-gpucc

Documentation/devicetree/bindings/clock/qcom,sa8775p-camcc.yaml+5−1

 maintainers:
   - Taniya Das <quic_tdas@quicinc.com>
+  - Imran Shaik <quic_imrashai@quicinc.com>
 description: |
   Qualcomm camera clock control module provides the clocks, resets and power
   domains on SA8775p.
-  See also: include/dt-bindings/clock/qcom,sa8775p-camcc.h
+  See also:
+    include/dt-bindings/clock/qcom,qcs8300-camcc.h
+    include/dt-bindings/clock/qcom,sa8775p-camcc.h
 properties:
   compatible:
     enum:
+      - qcom,qcs8300-camcc
       - qcom,sa8775p-camcc
   clocks:

Documentation/devicetree/bindings/clock/qcom,sa8775p-videocc.yaml+1−0

@@ -18,6 +18,7 @@ description: \| · 17 unmodified lines
18	properties:	18	properties:
19	compatible:	19	compatible:
20	enum:	20	enum:
		21	- qcom,qcs8300-videocc
21	- qcom,sa8775p-videocc	22	- qcom,sa8775p-videocc
22		23
23	clocks:	24	clocks:

Documentation/devicetree/bindings/display/panel/powertip,hx8238a.yaml+29−0

@@ -0,0 +1,29 @@
	1	# SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause
	2	%YAML 1.2
	3	---
	4	$id: http://devicetree.org/schemas/display/panel/powertip,hx8238a.yaml#
	5	$schema: http://devicetree.org/meta-schemas/core.yaml#
	6
	7	title: Powertip Electronic Technology Co. 320 x 240 LCD panel
	8
	9	maintainers:
	10	- Lukasz Majewski <lukma@denx.de>
	11
	12	allOf:
	13	- $ref: panel-dpi.yaml#
	14
	15	properties:
	16	compatible:
	17	items:
	18	- const: powertip,hx8238a
	19	- {} # panel-dpi, but not listed here to avoid false select
	20
	21	height-mm: true
	22	panel-timing: true
	23	port: true
	24	power-supply: true
	25	width-mm: true
	26
	27	additionalProperties: false
	28
	29	...

Documentation/devicetree/bindings/display/panel/powertip,st7272.yaml+29−0

@@ -0,0 +1,29 @@
	1	# SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause
	2	%YAML 1.2
	3	---
	4	$id: http://devicetree.org/schemas/display/panel/powertip,st7272.yaml#
	5	$schema: http://devicetree.org/meta-schemas/core.yaml#
	6
	7	title: Powertip Electronic Technology Co. 320 x 240 LCD panel
	8
	9	maintainers:
	10	- Lukasz Majewski <lukma@denx.de>
	11
	12	allOf:
	13	- $ref: panel-dpi.yaml#
	14
	15	properties:
	16	compatible:
	17	items:
	18	- const: powertip,st7272
	19	- {} # panel-dpi, but not listed here to avoid false select
	20
	21	height-mm: true
	22	panel-timing: true
	23	port: true
	24	power-supply: true
	25	width-mm: true
	26
	27	additionalProperties: false
	28
	29	...

Documentation/devicetree/bindings/display/ti/ti,am65x-dss.yaml+1−1

@@ -23,7 +23,7 @@ properties: · 22 unmodified lines
23	compatible:	23	compatible:
24	enum:	24	enum:
25	- ti,am625-dss	25	- ti,am625-dss
26	- ti,am62a7,dss	26	- ti,am62a7-dss
27	- ti,am65x-dss	27	- ti,am65x-dss
28		28
29	reg:	29	reg:

Documentation/devicetree/bindings/interrupt-controller/microchip,lan966x-oic.yaml+2−3

@@ -14,9 +14,8 @@ allOf: · 13 unmodified lines
14		14
15	description: \|	15	description: \|
16	The Microchip LAN966x outband interrupt controller (OIC) maps the internal	16	The Microchip LAN966x outband interrupt controller (OIC) maps the internal
17	interrupt sources of the LAN966x device to an external interrupt.	17	interrupt sources of the LAN966x device to a PCI interrupt when the LAN966x
18	When the LAN966x device is used as a PCI device, the external interrupt is	18	device is used as a PCI device.
19	routed to the PCI interrupt.
20		19
21	properties:	20	properties:
22	compatible:	21	compatible:

Documentation/devicetree/bindings/net/wireless/qcom,ath10k.yaml+0−1

@@ -7,7 +7,6 @@ $schema: http://devicetree.org/meta-schemas/core.yaml# · 6 unmodified lines
7	title: Qualcomm Technologies ath10k wireless devices	7	title: Qualcomm Technologies ath10k wireless devices
8		8
9	maintainers:	9	maintainers:
10	- Kalle Valo <kvalo@kernel.org>
11	- Jeff Johnson <jjohnson@kernel.org>	10	- Jeff Johnson <jjohnson@kernel.org>
12		11
13	description:	12	description:

Documentation/devicetree/bindings/net/wireless/qcom,ath11k-pci.yaml+0−1

@@ -8,7 +8,6 @@ $schema: http://devicetree.org/meta-schemas/core.yaml# · 7 unmodified lines
8	title: Qualcomm Technologies ath11k wireless devices (PCIe)	8	title: Qualcomm Technologies ath11k wireless devices (PCIe)
9		9
10	maintainers:	10	maintainers:
11	- Kalle Valo <kvalo@kernel.org>
12	- Jeff Johnson <jjohnson@kernel.org>	11	- Jeff Johnson <jjohnson@kernel.org>
13		12
14	description: \|	13	description: \|

Documentation/devicetree/bindings/net/wireless/qcom,ath11k.yaml+0−1

@@ -8,7 +8,6 @@ $schema: http://devicetree.org/meta-schemas/core.yaml# · 7 unmodified lines
8	title: Qualcomm Technologies ath11k wireless devices	8	title: Qualcomm Technologies ath11k wireless devices
9		9
10	maintainers:	10	maintainers:
11	- Kalle Valo <kvalo@kernel.org>
12	- Jeff Johnson <jjohnson@kernel.org>	11	- Jeff Johnson <jjohnson@kernel.org>
13		12
14	description: \|	13	description: \|

Documentation/devicetree/bindings/net/wireless/qcom,ath12k-wsi.yaml+0−1

@@ -9,7 +9,6 @@ title: Qualcomm Technologies ath12k wireless devices (PCIe) with WSI interface · 8 unmodified lines
9		9
10	maintainers:	10	maintainers:
11	- Jeff Johnson <jjohnson@kernel.org>	11	- Jeff Johnson <jjohnson@kernel.org>
12	- Kalle Valo <kvalo@kernel.org>
13		12
14	description: \|	13	description: \|
15	Qualcomm Technologies IEEE 802.11be PCIe devices with WSI interface.	14	Qualcomm Technologies IEEE 802.11be PCIe devices with WSI interface.

Documentation/devicetree/bindings/net/wireless/qcom,ath12k.yaml+0−1

@@ -9,7 +9,6 @@ title: Qualcomm Technologies ath12k wireless devices (PCIe) · 8 unmodified lines
9		9
10	maintainers:	10	maintainers:
11	- Jeff Johnson <quic_jjohnson@quicinc.com>	11	- Jeff Johnson <quic_jjohnson@quicinc.com>
12	- Kalle Valo <kvalo@kernel.org>
13		12
14	description:	13	description:
15	Qualcomm Technologies IEEE 802.11be PCIe devices.	14	Qualcomm Technologies IEEE 802.11be PCIe devices.

Documentation/devicetree/bindings/nvmem/qcom,qfprom.yaml+1−0

@@ -36,6 +36,7 @@ properties: · 35 unmodified lines
36	- qcom,qcs404-qfprom	36	- qcom,qcs404-qfprom
37	- qcom,qcs615-qfprom	37	- qcom,qcs615-qfprom
38	- qcom,qcs8300-qfprom	38	- qcom,qcs8300-qfprom
		39	- qcom,sar2130p-qfprom
39	- qcom,sc7180-qfprom	40	- qcom,sc7180-qfprom
40	- qcom,sc7280-qfprom	41	- qcom,sc7280-qfprom
41	- qcom,sc8280xp-qfprom	42	- qcom,sc8280xp-qfprom

Documentation/devicetree/bindings/regulator/qcom,smd-rpm-regulator.yaml+1−1

@@ -22,7 +22,7 @@ description: · 21 unmodified lines
22	Each sub-node is identified using the node's name, with valid values listed	22	Each sub-node is identified using the node's name, with valid values listed
23	for each of the pmics below.	23	for each of the pmics below.
24		24
25	For mp5496, s1, s2	25	For mp5496, s1, s2, l2, l5
26		26
27	For pm2250, s1, s2, s3, s4, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11,	27	For pm2250, s1, s2, s3, s4, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11,
28	l12, l13, l14, l15, l16, l17, l18, l19, l20, l21, l22	28	l12, l13, l14, l15, l16, l17, l18, l19, l20, l21, l22

Documentation/driver-api/infrastructure.rst+6−0

 .. kernel-doc:: drivers/base/class.c
    :export:
+.. kernel-doc:: include/linux/device/faux.h
+   :internal:
+.. kernel-doc:: drivers/base/faux.c
+   :export:
 .. kernel-doc:: drivers/base/node.c
    :internal:

Documentation/filesystems/bcachefs/SubmittingPatches.rst+98−0

@@ -0,0 +1,98 @@
	1	Submitting patches to bcachefs:
	2	===============================
	3
	4	Patches must be tested before being submitted, either with the xfstests suite
	5	[0], or the full bcachefs test suite in ktest [1], depending on what's being
	6	touched. Note that ktest wraps xfstests and will be an easier method to running
	7	it for most users; it includes single-command wrappers for all the mainstream
	8	in-kernel local filesystems.
	9
	10	Patches will undergo more testing after being merged (including
	11	lockdep/kasan/preempt/etc. variants), these are not generally required to be
	12	run by the submitter - but do put some thought into what you're changing and
	13	which tests might be relevant, e.g. are you dealing with tricky memory layout
	14	work? kasan, are you doing locking work? then lockdep; and ktest includes
	15	single-command variants for the debug build types you'll most likely need.
	16
	17	The exception to this rule is incomplete WIP/RFC patches: if you're working on
	18	something nontrivial, it's encouraged to send out a WIP patch to let people
	19	know what you're doing and make sure you're on the right track. Just make sure
	20	it includes a brief note as to what's done and what's incomplete, to avoid
	21	confusion.
	22
	23	Rigorous checkpatch.pl adherence is not required (many of its warnings are
	24	considered out of date), but try not to deviate too much without reason.
	25
	26	Focus on writing code that reads well and is organized well; code should be
	27	aesthetically pleasing.
	28
	29	CI:
	30	===
	31
	32	Instead of running your tests locally, when running the full test suite it's
	33	prefereable to let a server farm do it in parallel, and then have the results
	34	in a nice test dashboard (which can tell you which failures are new, and
	35	presents results in a git log view, avoiding the need for most bisecting).
	36
	37	That exists [2], and community members may request an account. If you work for
	38	a big tech company, you'll need to help out with server costs to get access -
	39	but the CI is not restricted to running bcachefs tests: it runs any ktest test
	40	(which generally makes it easy to wrap other tests that can run in qemu).
	41
	42	Other things to think about:
	43	============================
	44
	45	- How will we debug this code? Is there sufficient introspection to diagnose
	46	when something starts acting wonky on a user machine?
	47
	48	We don't necessarily need every single field of every data structure visible
	49	with introspection, but having the important fields of all the core data
	50	types wired up makes debugging drastically easier - a bit of thoughtful
	51	foresight greatly reduces the need to have people build custom kernels with
	52	debug patches.
	53
	54	More broadly, think about all the debug tooling that might be needed.
	55
	56	- Does it make the codebase more or less of a mess? Can we also try to do some
	57	organizing, too?
	58
	59	- Do new tests need to be written? New assertions? How do we know and verify
	60	that the code is correct, and what happens if something goes wrong?
	61
	62	We don't yet have automated code coverage analysis or easy fault injection -
	63	but for now, pretend we did and ask what they might tell us.
	64
	65	Assertions are hugely important, given that we don't yet have a systems
	66	language that can do ergonomic embedded correctness proofs. Hitting an assert
	67	in testing is much better than wandering off into undefined behaviour la-la
	68	land - use them. Use them judiciously, and not as a replacement for proper
	69	error handling, but use them.
	70
	71	- Does it need to be performance tested? Should we add new peformance counters?
	72
	73	bcachefs has a set of persistent runtime counters which can be viewed with
	74	the 'bcachefs fs top' command; this should give users a basic idea of what
	75	their filesystem is currently doing. If you're doing a new feature or looking
	76	at old code, think if anything should be added.
	77
	78	- If it's a new on disk format feature - have upgrades and downgrades been
	79	tested? (Automated tests exists but aren't in the CI, due to the hassle of
	80	disk image management; coordinate to have them run.)
	81
	82	Mailing list, IRC:
	83	==================
	84
	85	Patches should hit the list [3], but much discussion and code review happens on
	86	IRC as well [4]; many people appreciate the more conversational approach and
	87	quicker feedback.
	88
	89	Additionally, we have a lively user community doing excellent QA work, which
	90	exists primarily on IRC. Please make use of that resource; user feedback is
	91	important for any nontrivial feature, and documenting it in commit messages
	92	would be a good idea.
	93
	94	[0]: git://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git
	95	[1]: https://evilpiepirate.org/git/ktest.git/
	96	[2]: https://evilpiepirate.org/~testdashboard/ci/
	97	[3]: linux-bcachefs@vger.kernel.org
	98	[4]: irc.oftc.net#bcache, #bcachefs-dev

Documentation/filesystems/bcachefs/index.rst+1−0

@@ -9,4 +9,5 @@ bcachefs Documentation · 8 unmodified lines
9	:numbered:	9	:numbered:
10		10
11	CodingStyle	11	CodingStyle
		12	SubmittingPatches
12	errorcodes	13	errorcodes

Documentation/netlink/specs/ethtool.yaml+2−1

@@ -1524,7 +1524,8 @@ attribute-sets: · 1523 unmodified lines
1524	nested-attributes: bitset	1524	nested-attributes: bitset
1525	-	1525	-
1526	name: hwtstamp-flags	1526	name: hwtstamp-flags
1527	type: u32	1527	type: nest
		1528	nested-attributes: bitset
1528		1529
1529	operations:	1530	operations:
1530	enum-model: directional	1531	enum-model: directional

Documentation/networking/iso15765-2.rst+2−2

@@ -369,8 +369,8 @@ to their default. · 368 unmodified lines
369		369
370	addr.can_family = AF_CAN;	370	addr.can_family = AF_CAN;
371	addr.can_ifindex = if_nametoindex("can0");	371	addr.can_ifindex = if_nametoindex("can0");
372	addr.tp.tx_id = 0x18DA42F1 \| CAN_EFF_FLAG;	372	addr.can_addr.tp.tx_id = 0x18DA42F1 \| CAN_EFF_FLAG;
373	addr.tp.rx_id = 0x18DAF142 \| CAN_EFF_FLAG;	373	addr.can_addr.tp.rx_id = 0x18DAF142 \| CAN_EFF_FLAG;
374		374
375	ret = bind(s, (struct sockaddr *)&addr, sizeof(addr));	375	ret = bind(s, (struct sockaddr *)&addr, sizeof(addr));
376	if (ret < 0)	376	if (ret < 0)

Documentation/networking/strparser.rst+8−1

 Callbacks
 =========
-There are six callbacks:
+There are seven callbacks:
     ::
     the length of the message. skb->len - offset may be greater
     then full_len since strparser does not trim the skb.
+    ::
+	int (*read_sock)(struct strparser *strp, read_descriptor_t *desc,
+                     sk_read_actor_t recv_actor);
+    The read_sock callback is used by strparser instead of
+    sock->ops->read_sock, if provided.
     ::
 	int (*read_sock_done)(struct strparser *strp, int err);

Documentation/process/embargoed-hardware-issues.rst+1−1

@@ -308,7 +308,7 @@ an involved disclosed party. The current ambassadors list: · 307 unmodified lines
308		308
309	Google Kees Cook <keescook@chromium.org>	309	Google Kees Cook <keescook@chromium.org>
310		310
311	LLVM Nick Desaulniers <ndesaulniers@google.com>	311	LLVM Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
312	============= ========================================================	312	============= ========================================================
313		313
314	If you want your organization to be added to the ambassadors list, please	314	If you want your organization to be added to the ambassadors list, please

Documentation/translations/sp_SP/process/embargoed-hardware-issues.rst+1−1

@@ -287,7 +287,7 @@ revelada involucrada. La lista de embajadores actuales: · 286 unmodified lines
287		287
288	Google Kees Cook <keescook@chromium.org>	288	Google Kees Cook <keescook@chromium.org>
289		289
290	LLVM Nick Desaulniers <ndesaulniers@google.com>	290	LLVM Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
291	============= ========================================================	291	============= ========================================================
292		292
293	Si quiere que su organización se añada a la lista de embajadores, por	293	Si quiere que su organización se añada a la lista de embajadores, por

Documentation/virt/kvm/api.rst+1−1

@@ -1419,7 +1419,7 @@ fetch) is injected in the guest. · 1418 unmodified lines
1419	S390:	1419	S390:
1420	^^^^^	1420	^^^^^
1421		1421
1422	Returns -EINVAL if the VM has the KVM_VM_S390_UCONTROL flag set.	1422	Returns -EINVAL or -EEXIST if the VM has the KVM_VM_S390_UCONTROL flag set.
1423	Returns -EINVAL if called on a protected VM.	1423	Returns -EINVAL if called on a protected VM.
1424		1424
1425	4.36 KVM_SET_TSS_ADDR	1425	4.36 KVM_SET_TSS_ADDR

MAINTAINERS+73−23

 F:	sound/soc/codecs/ssm3515.c
 ARM/APPLE MACHINE SUPPORT
-M:	Hector Martin <marcan@marcan.st>
 M:	Sven Peter <sven@svenpeter.dev>
 R:	Alyssa Rosenzweig <alyssa@rosenzweig.io>
 L:	asahi@lists.linux.dev
 F:	drivers/phy/qualcomm/phy-ath79-usb.c
 ATHEROS ATH GENERIC UTILITIES
-M:	Kalle Valo <kvalo@kernel.org>
 M:	Jeff Johnson <jjohnson@kernel.org>
 L:	linux-wireless@vger.kernel.org
 S:	Supported
 F:	Documentation/devicetree/bindings/pwm/adi,axi-pwmgen.yaml
 F:	drivers/pwm/pwm-axi-pwmgen.c
-AXXIA I2C CONTROLLER
-M:	Krzysztof Adamski <krzysztof.adamski@nokia.com>
-L:	linux-i2c@vger.kernel.org
-S:	Maintained
-F:	Documentation/devicetree/bindings/i2c/i2c-axxia.txt
-F:	drivers/i2c/busses/i2c-axxia.c
 AZ6007 DVB DRIVER
 M:	Mauro Carvalho Chehab <mchehab@kernel.org>
 L:	linux-media@vger.kernel.org
 L:	linux-bcachefs@vger.kernel.org
 S:	Supported
 C:	irc://irc.oftc.net/bcache
+P:      Documentation/filesystems/bcachefs/SubmittingPatches.rst
 T:	git https://evilpiepirate.org/git/bcachefs.git
 F:	fs/bcachefs/
 F:	Documentation/filesystems/bcachefs/
 CLANG/LLVM BUILD SUPPORT
 M:	Nathan Chancellor <nathan@kernel.org>
-R:	Nick Desaulniers <ndesaulniers@google.com>
+R:	Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
 R:	Bill Wendling <morbo@google.com>
 R:	Justin Stitt <justinstitt@google.com>
 L:	llvm@lists.linux.dev
 F:	rust/kernel/device_id.rs
 F:	rust/kernel/devres.rs
 F:	rust/kernel/driver.rs
+F:	rust/kernel/faux.rs
 F:	rust/kernel/platform.rs
 F:	samples/rust/rust_driver_platform.rs
+F:	samples/rust/rust_driver_faux.rs
 DRIVERS FOR OMAP ADAPTIVE VOLTAGE SCALING (AVS)
 M:	Nishanth Menon <nm@ti.com>
 FREEZER
 M:	"Rafael J. Wysocki" <rafael@kernel.org>
-M:	Pavel Machek <pavel@ucw.cz>
+M:	Pavel Machek <pavel@kernel.org>
 L:	linux-pm@vger.kernel.org
 S:	Supported
 F:	Documentation/power/freezing-of-tasks.rst
 GOOGLE ETHERNET DRIVERS
 M:	Jeroen de Borst <jeroendb@google.com>
-M:	Praveen Kaligineedi <pkaligineedi@google.com>
+M:	Harshitha Ramamurthy <hramamurthy@google.com>
-R:	Shailend Chand <shailend@google.com>
 L:	netdev@vger.kernel.org
 S:	Maintained
 F:	Documentation/networking/device_drivers/ethernet/google/gve.rst
 F:	drivers/staging/gpib/
 GPIO ACPI SUPPORT
-M:	Mika Westerberg <mika.westerberg@linux.intel.com>
+M:	Mika Westerberg <westeri@kernel.org>
 M:	Andy Shevchenko <andriy.shevchenko@linux.intel.com>
 L:	linux-gpio@vger.kernel.org
 L:	linux-acpi@vger.kernel.org
 HIBERNATION (aka Software Suspend, aka swsusp)
 M:	"Rafael J. Wysocki" <rafael@kernel.org>
-M:	Pavel Machek <pavel@ucw.cz>
+M:	Pavel Machek <pavel@kernel.org>
 L:	linux-pm@vger.kernel.org
 S:	Supported
 B:	https://bugzilla.kernel.org
 F:	drivers/tty/hvc/
 I2C ACPI SUPPORT
-M:	Mika Westerberg <mika.westerberg@linux.intel.com>
+M:	Mika Westerberg <westeri@kernel.org>
 L:	linux-i2c@vger.kernel.org
 L:	linux-acpi@vger.kernel.org
 S:	Maintained
 F:	scripts/leaking_addresses.pl
 LED SUBSYSTEM
-M:	Pavel Machek <pavel@ucw.cz>
 M:	Lee Jones <lee@kernel.org>
+M:	Pavel Machek <pavel@kernel.org>
 L:	linux-leds@vger.kernel.org
 S:	Maintained
 T:	git git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds.git
 X:	drivers/net/wireless/
 NETWORKING DRIVERS (WIRELESS)
-M:	Kalle Valo <kvalo@kernel.org>
+M:	Johannes Berg <johannes@sipsolutions.net>
 L:	linux-wireless@vger.kernel.org
 S:	Maintained
 W:	https://wireless.wiki.kernel.org/
 F:	net/dsa/
 F:	tools/testing/selftests/drivers/net/dsa/
+NETWORKING [ETHTOOL]
+M:	Andrew Lunn <andrew@lunn.ch>
+M:	Jakub Kicinski <kuba@kernel.org>
+F:	Documentation/netlink/specs/ethtool.yaml
+F:	Documentation/networking/ethtool-netlink.rst
+F:	include/linux/ethtool*
+F:	include/uapi/linux/ethtool*
+F:	net/ethtool/
+F:	tools/testing/selftests/drivers/net/*/ethtool*
+NETWORKING [ETHTOOL CABLE TEST]
+M:	Andrew Lunn <andrew@lunn.ch>
+F:	net/ethtool/cabletest.c
+F:	tools/testing/selftests/drivers/net/*/ethtool*
+K:	cable_test
+NETWORKING [ETHTOOL MAC MERGE]
+M:	Vladimir Oltean <vladimir.oltean@nxp.com>
+F:	net/ethtool/mm.c
+F:	tools/testing/selftests/drivers/net/hw/ethtool_mm.sh
+K:	ethtool_mm
 NETWORKING [GENERAL]
 M:	"David S. Miller" <davem@davemloft.net>
 M:	Eric Dumazet <edumazet@google.com>
 F:	include/linux/netlink.h
 F:	include/linux/netpoll.h
 F:	include/linux/rtnetlink.h
+F:	include/linux/sctp.h
 F:	include/linux/seq_file_net.h
 F:	include/linux/skbuff*
 F:	include/net/
 F:	include/uapi/linux/netlink.h
 F:	include/uapi/linux/netlink_diag.h
 F:	include/uapi/linux/rtnetlink.h
+F:	include/uapi/linux/sctp.h
 F:	lib/net_utils.c
 F:	lib/random32.c
 F:	net/
 NETWORKING [TCP]
 M:	Eric Dumazet <edumazet@google.com>
 M:	Neal Cardwell <ncardwell@google.com>
+R:	Kuniyuki Iwashima <kuniyu@amazon.com>
 L:	netdev@vger.kernel.org
 S:	Maintained
 F:	Documentation/networking/net_cachelines/tcp_sock.rst
 F:	include/uapi/linux/tls.h
 F:	net/tls/*
+NETWORKING [SOCKETS]
+M:	Eric Dumazet <edumazet@google.com>
+M:	Kuniyuki Iwashima <kuniyu@amazon.com>
+M:	Paolo Abeni <pabeni@redhat.com>
+M:	Willem de Bruijn <willemb@google.com>
+S:	Maintained
+F:	include/linux/sock_diag.h
+F:	include/linux/socket.h
+F:	include/linux/sockptr.h
+F:	include/net/sock.h
+F:	include/net/sock_reuseport.h
+F:	include/uapi/linux/socket.h
+F:	net/core/*sock*
+F:	net/core/scm.c
+F:	net/socket.c
+NETWORKING [UNIX SOCKETS]
+M:	Kuniyuki Iwashima <kuniyu@amazon.com>
+S:	Maintained
+F:	include/net/af_unix.h
+F:	include/net/netns/unix.h
+F:	include/uapi/linux/unix_diag.h
+F:	net/unix/
+F:	tools/testing/selftests/net/af_unix/
 NETXEN (1/10) GbE SUPPORT
 M:	Manish Chopra <manishc@marvell.com>
 M:	Rahul Verma <rahulv@marvell.com>
 F:	kernel/time/tick*.*
 NOKIA N900 CAMERA SUPPORT (ET8EK8 SENSOR, AD5820 FOCUS)
-M:	Pavel Machek <pavel@ucw.cz>
+M:	Pavel Machek <pavel@kernel.org>
 M:	Sakari Ailus <sakari.ailus@iki.fi>
 L:	linux-media@vger.kernel.org
 S:	Maintained
 L:	dev@openvswitch.org
 S:	Maintained
 W:	http://openvswitch.org
+F:	Documentation/networking/openvswitch.rst
 F:	include/uapi/linux/openvswitch.h
 F:	net/openvswitch/
 F:	tools/testing/selftests/net/openvswitch/
 F:	drivers/media/tuners/qt1010*
 QUALCOMM ATH12K WIRELESS DRIVER
-M:	Kalle Valo <kvalo@kernel.org>
 M:	Jeff Johnson <jjohnson@kernel.org>
 L:	ath12k@lists.infradead.org
 S:	Supported
 N:	ath12k
 QUALCOMM ATHEROS ATH10K WIRELESS DRIVER
-M:	Kalle Valo <kvalo@kernel.org>
 M:	Jeff Johnson <jjohnson@kernel.org>
 L:	ath10k@lists.infradead.org
 S:	Supported
 N:	ath10k
 QUALCOMM ATHEROS ATH11K WIRELESS DRIVER
-M:	Kalle Valo <kvalo@kernel.org>
 M:	Jeff Johnson <jjohnson@kernel.org>
 L:	ath11k@lists.infradead.org
 S:	Supported
 S:	Supported
 F:	drivers/dma/qcom/hidma*
+QUALCOMM I2C QCOM GENI DRIVER
+M:	Mukesh Kumar Savaliya <quic_msavaliy@quicinc.com>
+M:	Viken Dadhaniya <quic_vdadhani@quicinc.com>
+L:	linux-i2c@vger.kernel.org
+L:	linux-arm-msm@vger.kernel.org
+S:	Maintained
+F:	Documentation/devicetree/bindings/i2c/qcom,i2c-geni-qcom.yaml
+F:	drivers/i2c/busses/i2c-qcom-geni.c
 QUALCOMM I2C CCI DRIVER
 M:	Loic Poulain <loic.poulain@linaro.org>
 M:	Robert Foss <rfoss@kernel.org>
 SUSPEND TO RAM
 M:	"Rafael J. Wysocki" <rafael@kernel.org>
 M:	Len Brown <len.brown@intel.com>
-M:	Pavel Machek <pavel@ucw.cz>
+M:	Pavel Machek <pavel@kernel.org>
 L:	linux-pm@vger.kernel.org
 S:	Supported
 B:	https://bugzilla.kernel.org

Makefile+5−10

 VERSION = 6
 PATCHLEVEL = 14
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc3
 NAME = Baby Opossum Posse
 # *DOCUMENTATION*
 endif
 # Align the bit size of userspace programs with the kernel
-KBUILD_USERCFLAGS  += $(filter -m32 -m64 --target=%, $(KBUILD_CFLAGS))
+KBUILD_USERCFLAGS  += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS))
-KBUILD_USERLDFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CFLAGS))
+KBUILD_USERLDFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS))
 # make the checker run with the right architecture
 CHECKFLAGS += --arch=$(ARCH)
 	$(Q)$(MAKE) -sC $(srctree)/tools/bpf/resolve_btfids O=$(resolve_btfids_O) clean
 endif
-# Clear a bunch of variables before executing the submake
-ifeq ($(quiet),silent_)
-tools_silent=s
-endif
 tools/: FORCE
 	$(Q)mkdir -p $(objtree)/tools
-	$(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(tools_silent) $(filter --j% -j,$(MAKEFLAGS))" O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/
+	$(Q)$(MAKE) LDFLAGS= O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/
 tools/%: FORCE
 	$(Q)mkdir -p $(objtree)/tools
-	$(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(tools_silent) $(filter --j% -j,$(MAKEFLAGS))" O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ $*
+	$(Q)$(MAKE) LDFLAGS= O=$(abspath $(objtree)) subdir=tools -C $(srctree)/tools/ $*
 # ---------------------------------------------------------------------------
 # Kernel selftest

arch/alpha/include/asm/elf.h+1−5

 /*
  * This is used to ensure we don't load something for the wrong architecture.
  */
-#define elf_check_arch(x) ((x)->e_machine == EM_ALPHA)
+#define elf_check_arch(x) (((x)->e_machine == EM_ALPHA) && !((x)->e_flags & EF_ALPHA_32BIT))
 /*
  * These are used to set parameters in the core dumps.
 	: amask (AMASK_CIX) ? "ev6" : "ev67");	\
 })
-#define SET_PERSONALITY(EX)					\
-	set_personality(((EX).e_flags & EF_ALPHA_32BIT)		\
-	   ? PER_LINUX_32BIT : PER_LINUX)
 extern int alpha_l1i_cacheshape;
 extern int alpha_l1d_cacheshape;
 extern int alpha_l2_cacheshape;

arch/alpha/include/asm/hwrpb.h+1−1

@@ -135,7 +135,7 @@ struct crb_struct { · 134 unmodified lines
135	/* virtual->physical map */	135	/* virtual->physical map */
136	unsigned long map_entries;	136	unsigned long map_entries;
137	unsigned long map_pages;	137	unsigned long map_pages;
138	struct vf_map_struct map[1];	138	struct vf_map_struct map[];
139	};	139	};
140		140
141	struct memclust_struct {	141	struct memclust_struct {

arch/alpha/include/asm/pgtable.h+1−1

@@ -360,7 +360,7 @@ static inline pte_t pte_swp_clear_exclusive(pte_t pte) · 359 unmodified lines
360		360
361	extern void paging_init(void);	361	extern void paging_init(void);
362		362
363	/* We have our own get_unmapped_area to cope with ADDR_LIMIT_32BIT. */	363	/* We have our own get_unmapped_area */
364	#define HAVE_ARCH_UNMAPPED_AREA	364	#define HAVE_ARCH_UNMAPPED_AREA
365		365
366	#endif /* _ALPHA_PGTABLE_H */	366	#endif /* _ALPHA_PGTABLE_H */

arch/alpha/include/asm/processor.h+2−6

 #ifndef __ASM_ALPHA_PROCESSOR_H
 #define __ASM_ALPHA_PROCESSOR_H
-#include <linux/personality.h>	/* for ADDR_LIMIT_32BIT */
 /*
  * We have a 42-bit user address space: 4TB user VM...
  */
 #define TASK_SIZE (0x40000000000UL)
-#define STACK_TOP \
+#define STACK_TOP (0x00120000000UL)
-  (current->personality & ADDR_LIMIT_32BIT ? 0x80000000 : 0x00120000000UL)
 #define STACK_TOP_MAX	0x00120000000UL
 /* This decides where the kernel will search for a free chunk of vm
  * space during mmap's.
  */
-#define TASK_UNMAPPED_BASE \
+#define TASK_UNMAPPED_BASE (TASK_SIZE / 2)
-  ((current->personality & ADDR_LIMIT_32BIT) ? 0x40000000 : TASK_SIZE / 2)
 /* This is dead.  Everything has been moved to thread_info.  */
 struct thread_struct { };

arch/alpha/include/uapi/asm/ptrace.h+2−0

 	unsigned long trap_a0;
 	unsigned long trap_a1;
 	unsigned long trap_a2;
+/* This makes the stack 16-byte aligned as GCC expects */
+	unsigned long __pad0;
 /* These are saved by PAL-code: */
 	unsigned long ps;
 	unsigned long pc;

arch/alpha/kernel/asm-offsets.c+4−0

 	DEFINE(TI_STATUS, offsetof(struct thread_info, status));
 	BLANK();
+	DEFINE(SP_OFF, offsetof(struct pt_regs, ps));
 	DEFINE(SIZEOF_PT_REGS, sizeof(struct pt_regs));
 	BLANK();
+	DEFINE(SWITCH_STACK_SIZE, sizeof(struct switch_stack));
+	BLANK();
 	DEFINE(HAE_CACHE, offsetof(struct alpha_machine_vector, hae_cache));
 	DEFINE(HAE_REG, offsetof(struct alpha_machine_vector, hae_register));
 }

arch/alpha/kernel/entry.S+10−14

 	.set noat
 	.cfi_sections	.debug_frame
-/* Stack offsets.  */
-#define SP_OFF			184
-#define SWITCH_STACK_SIZE	64
 .macro	CFI_START_OSF_FRAME	func
 	.align	4
 	.globl	\func
 CFI_START_OSF_FRAME entMM
 	SAVE_ALL
 /* save $9 - $15 so the inline exception code can manipulate them.  */
-	subq	$sp, 56, $sp
+	subq	$sp, 64, $sp
-	.cfi_adjust_cfa_offset	56
+	.cfi_adjust_cfa_offset	64
 	stq	$9, 0($sp)
 	stq	$10, 8($sp)
 	stq	$11, 16($sp)
 	.cfi_rel_offset	$13, 32
 	.cfi_rel_offset	$14, 40
 	.cfi_rel_offset	$15, 48
-	addq	$sp, 56, $19
+	addq	$sp, 64, $19
 /* handle the fault */
 	lda	$8, 0x3fff
 	bic	$sp, $8, $8
 	ldq	$13, 32($sp)
 	ldq	$14, 40($sp)
 	ldq	$15, 48($sp)
-	addq	$sp, 56, $sp
+	addq	$sp, 64, $sp
 	.cfi_restore	$9
 	.cfi_restore	$10
 	.cfi_restore	$11
 	.cfi_restore	$13
 	.cfi_restore	$14
 	.cfi_restore	$15
-	.cfi_adjust_cfa_offset	-56
+	.cfi_adjust_cfa_offset	-64
 /* finish up the syscall as normal.  */
 	br	ret_from_sys_call
 CFI_END_OSF_FRAME entMM
 	.cfi_restore	$0
 	.cfi_adjust_cfa_offset	-256
 	SAVE_ALL		/* setup normal kernel stack */
-	lda	$sp, -56($sp)
+	lda	$sp, -64($sp)
-	.cfi_adjust_cfa_offset	56
+	.cfi_adjust_cfa_offset	64
 	stq	$9, 0($sp)
 	stq	$10, 8($sp)
 	stq	$11, 16($sp)
 	.cfi_rel_offset	$14, 40
 	.cfi_rel_offset	$15, 48
 	lda	$8, 0x3fff
-	addq	$sp, 56, $19
+	addq	$sp, 64, $19
 	bic	$sp, $8, $8
 	jsr	$26, do_entUnaUser
 	ldq	$9, 0($sp)
 	ldq	$13, 32($sp)
 	ldq	$14, 40($sp)
 	ldq	$15, 48($sp)
-	lda	$sp, 56($sp)
+	lda	$sp, 64($sp)
 	.cfi_restore	$9
 	.cfi_restore	$10
 	.cfi_restore	$11
 	.cfi_restore	$13
 	.cfi_restore	$14
 	.cfi_restore	$15
-	.cfi_adjust_cfa_offset	-56
+	.cfi_adjust_cfa_offset	-64
 	br	ret_from_sys_call
 CFI_END_OSF_FRAME entUna

arch/alpha/kernel/osf_sys.c+2−9

 	return ret;
 }
-/* Get an address range which is currently unmapped.  Similar to the
+/* Get an address range which is currently unmapped. */
-   generic version except that we know how to honor ADDR_LIMIT_32BIT.  */
 static unsigned long
 arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
 		       unsigned long len, unsigned long pgoff,
 		       unsigned long flags, vm_flags_t vm_flags)
 {
-	unsigned long limit;
+	unsigned long limit = TASK_SIZE;
-	/* "32 bit" actually means 31 bit, since pointers sign extend.  */
-	if (current->personality & ADDR_LIMIT_32BIT)
-		limit = 0x80000000;
-	else
-		limit = TASK_SIZE;
 	if (len > limit)
 		return -ENOMEM;

arch/alpha/kernel/pci_iommu.c+2−1

 #include <linux/log2.h>
 #include <linux/dma-map-ops.h>
 #include <linux/iommu-helper.h>
+#include <linux/string_choices.h>
 #include <asm/io.h>
 #include <asm/hwrpb.h>
 	/* If both conditions above are met, we are fine. */
 	DBGA("pci_dac_dma_supported %s from %ps\n",
-	     ok ? "yes" : "no", __builtin_return_address(0));
+	     str_yes_no(ok), __builtin_return_address(0));
 	return ok;
 }

arch/alpha/kernel/traps.c+1−1

@@ -649,7 +649,7 @@ s_reg_to_mem (unsigned long s_reg) · 648 unmodified lines
649	static int unauser_reg_offsets[32] = {	649	static int unauser_reg_offsets[32] = {
650	R(r0), R(r1), R(r2), R(r3), R(r4), R(r5), R(r6), R(r7), R(r8),	650	R(r0), R(r1), R(r2), R(r3), R(r4), R(r5), R(r6), R(r7), R(r8),
651	/* r9 ... r15 are stored in front of regs. */	651	/* r9 ... r15 are stored in front of regs. */
652	-56, -48, -40, -32, -24, -16, -8,	652	-64, -56, -48, -40, -32, -24, -16, /* padding at -8 */
653	R(r16), R(r17), R(r18),	653	R(r16), R(r17), R(r18),
654	R(r19), R(r20), R(r21), R(r22), R(r23), R(r24), R(r25), R(r26),	654	R(r19), R(r20), R(r21), R(r22), R(r23), R(r24), R(r25), R(r26),
655	R(r27), R(r28), R(gp),	655	R(r27), R(r28), R(gp),

arch/alpha/mm/fault.c+2−2

@@ -78,8 +78,8 @@ __load_new_mm_context(struct mm_struct *next_mm) · 77 unmodified lines
78		78
79	/* Macro for exception fixup code to access integer registers. */	79	/* Macro for exception fixup code to access integer registers. */
80	#define dpf_reg(r) \	80	#define dpf_reg(r) \
81	(((unsigned long *)regs)[(r) <= 8 ? (r) : (r) <= 15 ? (r)-16 : \	81	(((unsigned long *)regs)[(r) <= 8 ? (r) : (r) <= 15 ? (r)-17 : \
82	(r) <= 18 ? (r)+10 : (r)-10])	82	(r) <= 18 ? (r)+11 : (r)-10])
83		83
84	asmlinkage void	84	asmlinkage void
85	do_page_fault(unsigned long address, unsigned long mmcsr,	85	do_page_fault(unsigned long address, unsigned long mmcsr,

arch/arm64/Kconfig+0−1

@@ -225,7 +225,6 @@ config ARM64 · 224 unmodified lines
225	select HAVE_FUNCTION_ERROR_INJECTION	225	select HAVE_FUNCTION_ERROR_INJECTION
226	select HAVE_FUNCTION_GRAPH_FREGS	226	select HAVE_FUNCTION_GRAPH_FREGS
227	select HAVE_FUNCTION_GRAPH_TRACER	227	select HAVE_FUNCTION_GRAPH_TRACER
228	select HAVE_FUNCTION_GRAPH_RETVAL
229	select HAVE_GCC_PLUGINS	228	select HAVE_GCC_PLUGINS
230	select HAVE_HARDLOCKUP_DETECTOR_PERF if PERF_EVENTS && \	229	select HAVE_HARDLOCKUP_DETECTOR_PERF if PERF_EVENTS && \
231	HW_PERF_EVENTS && HAVE_PERF_EVENTS_NMI	230	HW_PERF_EVENTS && HAVE_PERF_EVENTS_NMI

arch/arm64/Makefile+4−0

 KBUILD_CFLAGS	+= $(call cc-disable-warning, psabi)
 KBUILD_AFLAGS	+= $(compat_vdso)
+ifeq ($(call test-ge, $(CONFIG_RUSTC_VERSION), 108500),y)
+KBUILD_RUSTFLAGS += --target=aarch64-unknown-none-softfloat
+else
 KBUILD_RUSTFLAGS += --target=aarch64-unknown-none -Ctarget-feature="-neon"
+endif
 KBUILD_CFLAGS	+= $(call cc-option,-mabi=lp64)
 KBUILD_AFLAGS	+= $(call cc-option,-mabi=lp64)

arch/arm64/include/asm/kvm_emulate.h+0−42

@@ -605,48 +605,6 @@ static __always_inline void kvm_incr_pc(struct kvm_vcpu *vcpu) · 604 unmodified lines
605	__cpacr_to_cptr_set(clr, set));\	605	__cpacr_to_cptr_set(clr, set));\
606	} while (0)	606	} while (0)
607		607
608	static __always_inline void kvm_write_cptr_el2(u64 val)
609	{
610	if (has_vhe() \|\| has_hvhe())
611	write_sysreg(val, cpacr_el1);
612	else
613	write_sysreg(val, cptr_el2);
614	}
615
616	/* Resets the value of cptr_el2 when returning to the host. */
617	static __always_inline void __kvm_reset_cptr_el2(struct kvm *kvm)
618	{
619	u64 val;
620
621	if (has_vhe()) {
622	val = (CPACR_EL1_FPEN \| CPACR_EL1_ZEN_EL1EN);
623	if (cpus_have_final_cap(ARM64_SME))
624	val \|= CPACR_EL1_SMEN_EL1EN;
625	} else if (has_hvhe()) {
626	val = CPACR_EL1_FPEN;
627
628	if (!kvm_has_sve(kvm) \|\| !guest_owns_fp_regs())
629	val \|= CPACR_EL1_ZEN;
630	if (cpus_have_final_cap(ARM64_SME))
631	val \|= CPACR_EL1_SMEN;
632	} else {
633	val = CPTR_NVHE_EL2_RES1;
634
635	if (kvm_has_sve(kvm) && guest_owns_fp_regs())
636	val \|= CPTR_EL2_TZ;
637	if (!cpus_have_final_cap(ARM64_SME))
638	val \|= CPTR_EL2_TSM;
639	}
640
641	kvm_write_cptr_el2(val);
642	}
643
644	#ifdef __KVM_NVHE_HYPERVISOR__
645	#define kvm_reset_cptr_el2(v) __kvm_reset_cptr_el2(kern_hyp_va((v)->kvm))
646	#else
647	#define kvm_reset_cptr_el2(v) __kvm_reset_cptr_el2((v)->kvm)
648	#endif
649
650	/*	608	/*
651	* Returns a 'sanitised' view of CPTR_EL2, translating from nVHE to the VHE	609	* Returns a 'sanitised' view of CPTR_EL2, translating from nVHE to the VHE
652	* format if E2H isn't set.	610	* format if E2H isn't set.

arch/arm64/include/asm/kvm_host.h+6−18

@@ -100,7 +100,7 @@ static inline void push_hyp_memcache(struct kvm_hyp_memcache *mc, · 99 unmodified lines
100	static inline void pop_hyp_memcache(struct kvm_hyp_memcache mc,	100	static inline void pop_hyp_memcache(struct kvm_hyp_memcache mc,
101	void (to_va)(phys_addr_t phys))	101	void (to_va)(phys_addr_t phys))
102	{	102	{
103	phys_addr_t *p = to_va(mc->head);	103	phys_addr_t *p = to_va(mc->head & PAGE_MASK);
104		104
105	if (!mc->nr_pages)	105	if (!mc->nr_pages)
106	return NULL;	106	return NULL;
@@ -615,8 +615,6 @@ struct cpu_sve_state { · 508 unmodified lines
615	struct kvm_host_data {	615	struct kvm_host_data {
616	#define KVM_HOST_DATA_FLAG_HAS_SPE 0	616	#define KVM_HOST_DATA_FLAG_HAS_SPE 0
617	#define KVM_HOST_DATA_FLAG_HAS_TRBE 1	617	#define KVM_HOST_DATA_FLAG_HAS_TRBE 1
618	#define KVM_HOST_DATA_FLAG_HOST_SVE_ENABLED 2
619	#define KVM_HOST_DATA_FLAG_HOST_SME_ENABLED 3
620	#define KVM_HOST_DATA_FLAG_TRBE_ENABLED 4	618	#define KVM_HOST_DATA_FLAG_TRBE_ENABLED 4
621	#define KVM_HOST_DATA_FLAG_EL1_TRACING_CONFIGURED 5	619	#define KVM_HOST_DATA_FLAG_EL1_TRACING_CONFIGURED 5
622	unsigned long flags;	620	unsigned long flags;
@@ -624,23 +622,13 @@ struct kvm_host_data { · 1 unmodified line
624	struct kvm_cpu_context host_ctxt;	622	struct kvm_cpu_context host_ctxt;
625		623
626	/*	624	/*
627	* All pointers in this union are hyp VA.	625	* Hyp VA.
628	* sve_state is only used in pKVM and if system_supports_sve().	626	* sve_state is only used in pKVM and if system_supports_sve().
629	*/	627	*/
630	union {	628	struct cpu_sve_state *sve_state;
631	struct user_fpsimd_state *fpsimd_state;	629
632	struct cpu_sve_state *sve_state;	630	/* Used by pKVM only. */
633	};	631	u64 fpmr;
634
635	union {
636	/* HYP VA pointer to the host storage for FPMR */
637	u64 *fpmr_ptr;
638	/*
639	* Used by pKVM only, as it needs to provide storage
640	* for the host
641	*/
642	u64 fpmr;
643	};
644		632
645	/* Ownership of the FP regs */	633	/* Ownership of the FP regs */
646	enum {	634	enum {

arch/arm64/kernel/cacheinfo.c+7−5

 	unsigned int level, idx;
 	enum cache_type type;
 	struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
-	struct cacheinfo *this_leaf = this_cpu_ci->info_list;
+	struct cacheinfo *infos = this_cpu_ci->info_list;
 	for (idx = 0, level = 1; level <= this_cpu_ci->num_levels &&
-	     idx < this_cpu_ci->num_leaves; idx++, level++) {
+	     idx < this_cpu_ci->num_leaves; level++) {
 		type = get_cache_type(level);
 		if (type == CACHE_TYPE_SEPARATE) {
-			ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level);
+			if (idx + 1 >= this_cpu_ci->num_leaves)
-			ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level);
+				break;
+			ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level);
+			ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level);
 		} else {
-			ci_leaf_init(this_leaf++, type, level);
+			ci_leaf_init(&infos[idx++], type, level);
 		}
 	}
 	return 0;

arch/arm64/kernel/cpufeature.c+3−2

 	HWCAP_CAP(ID_AA64ISAR0_EL1, TS, FLAGM, CAP_HWCAP, KERNEL_HWCAP_FLAGM),
 	HWCAP_CAP(ID_AA64ISAR0_EL1, TS, FLAGM2, CAP_HWCAP, KERNEL_HWCAP_FLAGM2),
 	HWCAP_CAP(ID_AA64ISAR0_EL1, RNDR, IMP, CAP_HWCAP, KERNEL_HWCAP_RNG),
+	HWCAP_CAP(ID_AA64ISAR3_EL1, FPRCVT, IMP, CAP_HWCAP, KERNEL_HWCAP_FPRCVT),
 	HWCAP_CAP(ID_AA64PFR0_EL1, FP, IMP, CAP_HWCAP, KERNEL_HWCAP_FP),
 	HWCAP_CAP(ID_AA64PFR0_EL1, FP, FP16, CAP_HWCAP, KERNEL_HWCAP_FPHP),
 	HWCAP_CAP(ID_AA64PFR0_EL1, AdvSIMD, IMP, CAP_HWCAP, KERNEL_HWCAP_ASIMD),
 	HWCAP_CAP(ID_AA64SMFR0_EL1, SF8FMA, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SF8FMA),
 	HWCAP_CAP(ID_AA64SMFR0_EL1, SF8DP4, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SF8DP4),
 	HWCAP_CAP(ID_AA64SMFR0_EL1, SF8DP2, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SF8DP2),
-	HWCAP_CAP(ID_AA64SMFR0_EL1, SF8MM8, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SF8MM8),
-	HWCAP_CAP(ID_AA64SMFR0_EL1, SF8MM4, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SF8MM4),
 	HWCAP_CAP(ID_AA64SMFR0_EL1, SBitPerm, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SBITPERM),
 	HWCAP_CAP(ID_AA64SMFR0_EL1, AES, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_AES),
 	HWCAP_CAP(ID_AA64SMFR0_EL1, SFEXPA, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SFEXPA),
 	HWCAP_CAP(ID_AA64FPFR0_EL1, F8FMA, IMP, CAP_HWCAP, KERNEL_HWCAP_F8FMA),
 	HWCAP_CAP(ID_AA64FPFR0_EL1, F8DP4, IMP, CAP_HWCAP, KERNEL_HWCAP_F8DP4),
 	HWCAP_CAP(ID_AA64FPFR0_EL1, F8DP2, IMP, CAP_HWCAP, KERNEL_HWCAP_F8DP2),
+	HWCAP_CAP(ID_AA64FPFR0_EL1, F8MM8, IMP, CAP_HWCAP, KERNEL_HWCAP_F8MM8),
+	HWCAP_CAP(ID_AA64FPFR0_EL1, F8MM4, IMP, CAP_HWCAP, KERNEL_HWCAP_F8MM4),
 	HWCAP_CAP(ID_AA64FPFR0_EL1, F8E4M3, IMP, CAP_HWCAP, KERNEL_HWCAP_F8E4M3),
 	HWCAP_CAP(ID_AA64FPFR0_EL1, F8E5M2, IMP, CAP_HWCAP, KERNEL_HWCAP_F8E5M2),
 #ifdef CONFIG_ARM64_POE

arch/arm64/kernel/fpsimd.c+0−25

@@ -1694,31 +1694,6 @@ void fpsimd_signal_preserve_current_state(void) · 1693 unmodified lines
1694	sve_to_fpsimd(current);	1694	sve_to_fpsimd(current);
1695	}	1695	}
1696		1696
1697	/*
1698	* Called by KVM when entering the guest.
1699	*/
1700	void fpsimd_kvm_prepare(void)
1701	{
1702	if (!system_supports_sve())
1703	return;
1704
1705	/*
1706	* KVM does not save host SVE state since we can only enter
1707	* the guest from a syscall so the ABI means that only the
1708	* non-saved SVE state needs to be saved. If we have left
1709	* SVE enabled for performance reasons then update the task
1710	* state to be FPSIMD only.
1711	*/
1712	get_cpu_fpsimd_context();
1713
1714	if (test_and_clear_thread_flag(TIF_SVE)) {
1715	sve_to_fpsimd(current);
1716	current->thread.fp_type = FP_STATE_FPSIMD;
1717	}
1718
1719	put_cpu_fpsimd_context();
1720	}
1721
1722	/*	1697	/*
1723	* Associate current's FPSIMD context with this cpu	1698	* Associate current's FPSIMD context with this cpu
1724	* The caller must have ownership of the cpu FPSIMD context before calling	1699	* The caller must have ownership of the cpu FPSIMD context before calling

arch/arm64/kernel/topology.c+10−12

 	int cpu;
 	/* We are already set since the last insmod of cpufreq driver */
-	if (unlikely(cpumask_subset(cpus, amu_fie_cpus)))
+	if (cpumask_available(amu_fie_cpus) &&
+	    unlikely(cpumask_subset(cpus, amu_fie_cpus)))
 		return;
-	for_each_cpu(cpu, cpus) {
+	for_each_cpu(cpu, cpus)
 		if (!freq_counters_valid(cpu))
 			return;
+	if (!cpumask_available(amu_fie_cpus) &&
+	    !zalloc_cpumask_var(&amu_fie_cpus, GFP_KERNEL)) {
+		WARN_ONCE(1, "Failed to allocate FIE cpumask for CPUs[%*pbl]\n",
+			  cpumask_pr_args(cpus));
+		return;
 	}
 	cpumask_or(amu_fie_cpus, amu_fie_cpus, cpus);
 static int __init init_amu_fie(void)
 {
-	int ret;
+	return cpufreq_register_notifier(&init_amu_fie_notifier,
-	if (!zalloc_cpumask_var(&amu_fie_cpus, GFP_KERNEL))
-		return -ENOMEM;
-	ret = cpufreq_register_notifier(&init_amu_fie_notifier,
 					CPUFREQ_POLICY_NOTIFIER);
-	if (ret)
-		free_cpumask_var(amu_fie_cpus);
-	return ret;
 }
 core_initcall(init_amu_fie);

arch/arm64/kernel/vdso/vdso.lds.S+1−0

@@ -41,6 +41,7 @@ SECTIONS · 40 unmodified lines
41	*/	41	*/
42	/DISCARD/ : {	42	/DISCARD/ : {
43	*(.note.GNU-stack .note.gnu.property)	43	*(.note.GNU-stack .note.gnu.property)
		44	*(.ARM.attributes)
44	}	45	}
45	.note : { (.note.) } :text :note	46	.note : { (.note.) } :text :note
46		47

arch/arm64/kernel/vmlinux.lds.S+1−0

@@ -162,6 +162,7 @@ SECTIONS · 161 unmodified lines
162	/DISCARD/ : {	162	/DISCARD/ : {
163	*(.interp .dynamic)	163	*(.interp .dynamic)
164	*(.dynsym .dynstr .hash .gnu.hash)	164	*(.dynsym .dynstr .hash .gnu.hash)
		165	*(.ARM.attributes)
165	}	166	}
166		167
167	. = KIMAGE_VADDR;	168	. = KIMAGE_VADDR;

arch/arm64/kvm/arch_timer.c+18−47

@@ -447,21 +447,19 @@ static void kvm_timer_update_status(struct arch_timer_context *ctx, bool level) · 446 unmodified lines
447	static void kvm_timer_update_irq(struct kvm_vcpu *vcpu, bool new_level,	447	static void kvm_timer_update_irq(struct kvm_vcpu *vcpu, bool new_level,
448	struct arch_timer_context *timer_ctx)	448	struct arch_timer_context *timer_ctx)
449	{	449	{
450	int ret;
451
452	kvm_timer_update_status(timer_ctx, new_level);	450	kvm_timer_update_status(timer_ctx, new_level);
453		451
454	timer_ctx->irq.level = new_level;	452	timer_ctx->irq.level = new_level;
455	trace_kvm_timer_update_irq(vcpu->vcpu_id, timer_irq(timer_ctx),	453	trace_kvm_timer_update_irq(vcpu->vcpu_id, timer_irq(timer_ctx),
456	timer_ctx->irq.level);	454	timer_ctx->irq.level);
457		455
458	if (!userspace_irqchip(vcpu->kvm)) {	456	if (userspace_irqchip(vcpu->kvm))
459	ret = kvm_vgic_inject_irq(vcpu->kvm, vcpu,	457	return;
460	timer_irq(timer_ctx),	458
461	timer_ctx->irq.level,	459	kvm_vgic_inject_irq(vcpu->kvm, vcpu,
462	timer_ctx);	460	timer_irq(timer_ctx),
463	WARN_ON(ret);	461	timer_ctx->irq.level,
464	}	462	timer_ctx);
465	}	463	}
466		464
467	/* Only called for a fully emulated timer */	465	/* Only called for a fully emulated timer */
@@ -471,10 +469,8 @@ static void timer_emulate(struct arch_timer_context *ctx) · 3 unmodified lines
471		469
472	trace_kvm_timer_emulate(ctx, should_fire);	470	trace_kvm_timer_emulate(ctx, should_fire);
473		471
474	if (should_fire != ctx->irq.level) {	472	if (should_fire != ctx->irq.level)
475	kvm_timer_update_irq(ctx->vcpu, should_fire, ctx);	473	kvm_timer_update_irq(ctx->vcpu, should_fire, ctx);
476	return;
477	}
478		474
479	kvm_timer_update_status(ctx, should_fire);	475	kvm_timer_update_status(ctx, should_fire);
480		476
@@ -761,21 +757,6 @@ static void kvm_timer_vcpu_load_nested_switch(struct kvm_vcpu *vcpu, · 280 unmodified lines
761	timer_irq(map->direct_ptimer),	757	timer_irq(map->direct_ptimer),
762	&arch_timer_irq_ops);	758	&arch_timer_irq_ops);
763	WARN_ON_ONCE(ret);	759	WARN_ON_ONCE(ret);
764
765	/*
766	* The virtual offset behaviour is "interesting", as it
767	* always applies when HCR_EL2.E2H==0, but only when
768	* accessed from EL1 when HCR_EL2.E2H==1. So make sure we
769	* track E2H when putting the HV timer in "direct" mode.
770	*/
771	if (map->direct_vtimer == vcpu_hvtimer(vcpu)) {
772	struct arch_timer_offset *offs = &map->direct_vtimer->offset;
773
774	if (vcpu_el2_e2h_is_set(vcpu))
775	offs->vcpu_offset = NULL;
776	else
777	offs->vcpu_offset = &__vcpu_sys_reg(vcpu, CNTVOFF_EL2);
778	}
779	}	760	}
780	}	761	}
781		762
@@ -976,31 +957,21 @@ void kvm_timer_sync_nested(struct kvm_vcpu *vcpu) · 194 unmodified lines
976	* which allows trapping of the timer registers even with NV2.	957	* which allows trapping of the timer registers even with NV2.
977	* Still, this is still worse than FEAT_NV on its own. Meh.	958	* Still, this is still worse than FEAT_NV on its own. Meh.
978	*/	959	*/
979	if (!vcpu_el2_e2h_is_set(vcpu)) {	960	if (!cpus_have_final_cap(ARM64_HAS_ECV)) {
980	if (cpus_have_final_cap(ARM64_HAS_ECV))
981	return;
982
983	/*
984	* A non-VHE guest hypervisor doesn't have any direct access
985	* to its timers: the EL2 registers trap (and the HW is
986	* fully emulated), while the EL0 registers access memory
987	* despite the access being notionally direct. Boo.
988	*
989	* We update the hardware timer registers with the
990	* latest value written by the guest to the VNCR page
991	* and let the hardware take care of the rest.
992	*/
993	write_sysreg_el0(__vcpu_sys_reg(vcpu, CNTV_CTL_EL0), SYS_CNTV_CTL);
994	write_sysreg_el0(__vcpu_sys_reg(vcpu, CNTV_CVAL_EL0), SYS_CNTV_CVAL);
995	write_sysreg_el0(__vcpu_sys_reg(vcpu, CNTP_CTL_EL0), SYS_CNTP_CTL);
996	write_sysreg_el0(__vcpu_sys_reg(vcpu, CNTP_CVAL_EL0), SYS_CNTP_CVAL);
997	} else {
998	/*	961	/*
999	* For a VHE guest hypervisor, the EL2 state is directly	962	* For a VHE guest hypervisor, the EL2 state is directly
1000	* stored in the host EL1 timers, while the emulated EL0	963	* stored in the host EL1 timers, while the emulated EL1
1001	* state is stored in the VNCR page. The latter could have	964	* state is stored in the VNCR page. The latter could have
1002	* been updated behind our back, and we must reset the	965	* been updated behind our back, and we must reset the
1003	* emulation of the timers.	966	* emulation of the timers.
		967	*
		968	* A non-VHE guest hypervisor doesn't have any direct access
		969	* to its timers: the EL2 registers trap despite being
		970	* notionally direct (we use the EL1 HW, as for VHE), while
		971	* the EL1 registers access memory.
		972	*
		973	* In both cases, process the emulated timers on each guest
		974	* exit. Boo.
1004	*/	975	*/
1005	struct timer_map map;	976	struct timer_map map;
1006	get_timer_map(vcpu, &map);	977	get_timer_map(vcpu, &map);

arch/arm64/kvm/arm.c+20−8

 		break;
 	case -ENODEV:
 	case -ENXIO:
+		/*
+		 * No VGIC? No pKVM for you.
+		 *
+		 * Protected mode assumes that VGICv3 is present, so no point
+		 * in trying to hobble along if vgic initialization fails.
+		 */
+		if (is_protected_kvm_enabled())
+			goto out;
+		/*
+		 * Otherwise, userspace could choose to implement a GIC for its
+		 * guest on non-cooperative hardware.
+		 */
 		vgic_present = false;
 		err = 0;
 		break;
 	kvm_nvhe_sym(id_aa64smfr0_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64SMFR0_EL1);
 	kvm_nvhe_sym(__icache_flags) = __icache_flags;
 	kvm_nvhe_sym(kvm_arm_vmid_bits) = kvm_arm_vmid_bits;
+	/*
+	 * Flush entire BSS since part of its data containing init symbols is read
+	 * while the MMU is off.
+	 */
+	kvm_flush_dcache_to_poc(kvm_ksym_ref(__hyp_bss_start),
+				kvm_ksym_ref(__hyp_bss_end) - kvm_ksym_ref(__hyp_bss_start));
 }
 static int __init kvm_hyp_init_protection(u32 hyp_va_bits)
 			per_cpu_ptr_nvhe_sym(kvm_host_data, cpu)->sve_state =
 				kern_hyp_va(sve_state);
 		}
-	} else {
-		for_each_possible_cpu(cpu) {
-			struct user_fpsimd_state *fpsimd_state;
-			fpsimd_state = &per_cpu_ptr_nvhe_sym(kvm_host_data, cpu)->host_ctxt.fp_regs;
-			per_cpu_ptr_nvhe_sym(kvm_host_data, cpu)->fpsimd_state =
-				kern_hyp_va(fpsimd_state);
-		}
 	}
 }

arch/arm64/kvm/fpsimd.c+9−98

@@ -54,50 +54,18 @@ void kvm_arch_vcpu_load_fp(struct kvm_vcpu *vcpu) · 53 unmodified lines
54	if (!system_supports_fpsimd())	54	if (!system_supports_fpsimd())
55	return;	55	return;
56		56
57	fpsimd_kvm_prepare();
58
59	/*	57	/*
60	* We will check TIF_FOREIGN_FPSTATE just before entering the	58	* Ensure that any host FPSIMD/SVE/SME state is saved and unbound such
61	* guest in kvm_arch_vcpu_ctxflush_fp() and override this to	59	* that the host kernel is responsible for restoring this state upon
62	* FP_STATE_FREE if the flag set.	60	* return to userspace, and the hyp code doesn't need to save anything.
		61	*
		62	* When the host may use SME, fpsimd_save_and_flush_cpu_state() ensures
		63	* that PSTATE.{SM,ZA} == {0,0}.
63	*/	64	*/
64	*host_data_ptr(fp_owner) = FP_STATE_HOST_OWNED;	65	fpsimd_save_and_flush_cpu_state();
65	*host_data_ptr(fpsimd_state) = kern_hyp_va(&current->thread.uw.fpsimd_state);	66	*host_data_ptr(fp_owner) = FP_STATE_FREE;
66	*host_data_ptr(fpmr_ptr) = kern_hyp_va(&current->thread.uw.fpmr);
67
68	host_data_clear_flag(HOST_SVE_ENABLED);
69	if (read_sysreg(cpacr_el1) & CPACR_EL1_ZEN_EL0EN)
70	host_data_set_flag(HOST_SVE_ENABLED);
71
72	if (system_supports_sme()) {
73	host_data_clear_flag(HOST_SME_ENABLED);
74	if (read_sysreg(cpacr_el1) & CPACR_EL1_SMEN_EL0EN)
75	host_data_set_flag(HOST_SME_ENABLED);
76
77	/*
78	* If PSTATE.SM is enabled then save any pending FP
79	* state and disable PSTATE.SM. If we leave PSTATE.SM
80	* enabled and the guest does not enable SME via
81	* CPACR_EL1.SMEN then operations that should be valid
82	* may generate SME traps from EL1 to EL1 which we
83	* can't intercept and which would confuse the guest.
84	*
85	* Do the same for PSTATE.ZA in the case where there
86	* is state in the registers which has not already
87	* been saved, this is very unlikely to happen.
88	*/
89	if (read_sysreg_s(SYS_SVCR) & (SVCR_SM_MASK \| SVCR_ZA_MASK)) {
90	*host_data_ptr(fp_owner) = FP_STATE_FREE;
91	fpsimd_save_and_flush_cpu_state();
92	}
93	}
94		67
95	/*	68	WARN_ON_ONCE(system_supports_sme() && read_sysreg_s(SYS_SVCR));
96	* If normal guests gain SME support, maintain this behavior for pKVM
97	* guests, which don't support SME.
98	*/
99	WARN_ON(is_protected_kvm_enabled() && system_supports_sme() &&
100	read_sysreg_s(SYS_SVCR));
101	}	69	}
102		70
103	/*	71	/*
@@ -162,52 +130,7 @@ void kvm_arch_vcpu_put_fp(struct kvm_vcpu *vcpu) · 58 unmodified lines
162		130
163	local_irq_save(flags);	131	local_irq_save(flags);
164		132
165	/*
166	* If we have VHE then the Hyp code will reset CPACR_EL1 to
167	* the default value and we need to reenable SME.
168	*/
169	if (has_vhe() && system_supports_sme()) {
170	/* Also restore EL0 state seen on entry */
171	if (host_data_test_flag(HOST_SME_ENABLED))
172	sysreg_clear_set(CPACR_EL1, 0, CPACR_EL1_SMEN);
173	else
174	sysreg_clear_set(CPACR_EL1,
175	CPACR_EL1_SMEN_EL0EN,
176	CPACR_EL1_SMEN_EL1EN);
177	isb();
178	}
179
180	if (guest_owns_fp_regs()) {	133	if (guest_owns_fp_regs()) {
181	if (vcpu_has_sve(vcpu)) {
182	u64 zcr = read_sysreg_el1(SYS_ZCR);
183
184	/*
185	* If the vCPU is in the hyp context then ZCR_EL1 is
186	* loaded with its vEL2 counterpart.
187	*/
188	__vcpu_sys_reg(vcpu, vcpu_sve_zcr_elx(vcpu)) = zcr;
189
190	/*
191	* Restore the VL that was saved when bound to the CPU,
192	* which is the maximum VL for the guest. Because the
193	* layout of the data when saving the sve state depends
194	* on the VL, we need to use a consistent (i.e., the
195	* maximum) VL.
196	* Note that this means that at guest exit ZCR_EL1 is
197	* not necessarily the same as on guest entry.
198	*
199	* ZCR_EL2 holds the guest hypervisor's VL when running
200	* a nested guest, which could be smaller than the
201	* max for the vCPU. Similar to above, we first need to
202	* switch to a VL consistent with the layout of the
203	* vCPU's SVE state. KVM support for NV implies VHE, so
204	* using the ZCR_EL1 alias is safe.
205	*/
206	if (!has_vhe() \|\| (vcpu_has_nv(vcpu) && !is_hyp_ctxt(vcpu)))
207	sve_cond_update_zcr_vq(vcpu_sve_max_vq(vcpu) - 1,
208	SYS_ZCR_EL1);
209	}
210
211	/*	134	/*
212	* Flush (save and invalidate) the fpsimd/sve state so that if	135	* Flush (save and invalidate) the fpsimd/sve state so that if
213	* the host tries to use fpsimd/sve, it's not using stale data	136	* the host tries to use fpsimd/sve, it's not using stale data
@@ -219,18 +142,6 @@ void kvm_arch_vcpu_put_fp(struct kvm_vcpu *vcpu) · 5 unmodified lines
219	* when needed.	142	* when needed.
220	*/	143	*/
221	fpsimd_save_and_flush_cpu_state();	144	fpsimd_save_and_flush_cpu_state();
222	} else if (has_vhe() && system_supports_sve()) {
223	/*
224	* The FPSIMD/SVE state in the CPU has not been touched, and we
225	* have SVE (and VHE): CPACR_EL1 (alias CPTR_EL2) has been
226	* reset by kvm_reset_cptr_el2() in the Hyp code, disabling SVE
227	* for EL0. To avoid spurious traps, restore the trap state
228	* seen by kvm_arch_vcpu_load_fp():
229	*/
230	if (host_data_test_flag(HOST_SVE_ENABLED))
231	sysreg_clear_set(CPACR_EL1, 0, CPACR_EL1_ZEN_EL0EN);
232	else
233	sysreg_clear_set(CPACR_EL1, CPACR_EL1_ZEN_EL0EN, 0);
234	}	145	}
235		146
236	local_irq_restore(flags);	147	local_irq_restore(flags);

arch/arm64/kvm/hyp/entry.S+5−0

 alternative_else_nop_endif
 	mrs	x1, isr_el1
 	cbz	x1,  1f
+	// Ensure that __guest_enter() always provides a context
+	// synchronization event so that callers don't need ISBs for anything
+	// that would usually be synchonized by the ERET.
+	isb
 	mov	x0, #ARM_EXCEPTION_IRQ
 	ret

arch/arm64/kvm/hyp/include/hyp/switch.h+111−37

 	return __get_fault_info(vcpu->arch.fault.esr_el2, &vcpu->arch.fault);
 }
-static bool kvm_hyp_handle_mops(struct kvm_vcpu *vcpu, u64 *exit_code)
+static inline bool kvm_hyp_handle_mops(struct kvm_vcpu *vcpu, u64 *exit_code)
 {
 	*vcpu_pc(vcpu) = read_sysreg_el2(SYS_ELR);
 	arm64_mops_reset_regs(vcpu_gp_regs(vcpu), vcpu->arch.fault.esr_el2);
 			 true);
 }
-static void kvm_hyp_save_fpsimd_host(struct kvm_vcpu *vcpu);
+static inline void fpsimd_lazy_switch_to_guest(struct kvm_vcpu *vcpu)
+{
+	u64 zcr_el1, zcr_el2;
+	if (!guest_owns_fp_regs())
+		return;
+	if (vcpu_has_sve(vcpu)) {
+		/* A guest hypervisor may restrict the effective max VL. */
+		if (vcpu_has_nv(vcpu) && !is_hyp_ctxt(vcpu))
+			zcr_el2 = __vcpu_sys_reg(vcpu, ZCR_EL2);
+		else
+			zcr_el2 = vcpu_sve_max_vq(vcpu) - 1;
+		write_sysreg_el2(zcr_el2, SYS_ZCR);
+		zcr_el1 = __vcpu_sys_reg(vcpu, vcpu_sve_zcr_elx(vcpu));
+		write_sysreg_el1(zcr_el1, SYS_ZCR);
+	}
+}
+static inline void fpsimd_lazy_switch_to_host(struct kvm_vcpu *vcpu)
+{
+	u64 zcr_el1, zcr_el2;
+	if (!guest_owns_fp_regs())
+		return;
+	/*
+	 * When the guest owns the FP regs, we know that guest+hyp traps for
+	 * any FPSIMD/SVE/SME features exposed to the guest have been disabled
+	 * by either fpsimd_lazy_switch_to_guest() or kvm_hyp_handle_fpsimd()
+	 * prior to __guest_entry(). As __guest_entry() guarantees a context
+	 * synchronization event, we don't need an ISB here to avoid taking
+	 * traps for anything that was exposed to the guest.
+	 */
+	if (vcpu_has_sve(vcpu)) {
+		zcr_el1 = read_sysreg_el1(SYS_ZCR);
+		__vcpu_sys_reg(vcpu, vcpu_sve_zcr_elx(vcpu)) = zcr_el1;
+		/*
+		 * The guest's state is always saved using the guest's max VL.
+		 * Ensure that the host has the guest's max VL active such that
+		 * the host can save the guest's state lazily, but don't
+		 * artificially restrict the host to the guest's max VL.
+		 */
+		if (has_vhe()) {
+			zcr_el2 = vcpu_sve_max_vq(vcpu) - 1;
+			write_sysreg_el2(zcr_el2, SYS_ZCR);
+		} else {
+			zcr_el2 = sve_vq_from_vl(kvm_host_sve_max_vl) - 1;
+			write_sysreg_el2(zcr_el2, SYS_ZCR);
+			zcr_el1 = vcpu_sve_max_vq(vcpu) - 1;
+			write_sysreg_el1(zcr_el1, SYS_ZCR);
+		}
+	}
+}
+static void kvm_hyp_save_fpsimd_host(struct kvm_vcpu *vcpu)
+{
+	/*
+	 * Non-protected kvm relies on the host restoring its sve state.
+	 * Protected kvm restores the host's sve state as not to reveal that
+	 * fpsimd was used by a guest nor leak upper sve bits.
+	 */
+	if (system_supports_sve()) {
+		__hyp_sve_save_host();
+		/* Re-enable SVE traps if not supported for the guest vcpu. */
+		if (!vcpu_has_sve(vcpu))
+			cpacr_clear_set(CPACR_EL1_ZEN, 0);
+	} else {
+		__fpsimd_save_state(host_data_ptr(host_ctxt.fp_regs));
+	}
+	if (kvm_has_fpmr(kern_hyp_va(vcpu->kvm)))
+		*host_data_ptr(fpmr) = read_sysreg_s(SYS_FPMR);
+}
 /*
  * We trap the first access to the FP/SIMD to save the host context and
  * If FP/SIMD is not implemented, handle the trap and inject an undefined
  * instruction exception to the guest. Similarly for trapped SVE accesses.
  */
-static bool kvm_hyp_handle_fpsimd(struct kvm_vcpu *vcpu, u64 *exit_code)
+static inline bool kvm_hyp_handle_fpsimd(struct kvm_vcpu *vcpu, u64 *exit_code)
 {
 	bool sve_guest;
 	u8 esr_ec;
 	isb();
 	/* Write out the host state if it's in the registers */
-	if (host_owns_fp_regs())
+	if (is_protected_kvm_enabled() && host_owns_fp_regs())
 		kvm_hyp_save_fpsimd_host(vcpu);
 	/* Restore the guest state */
 	return true;
 }
+/* Open-coded version of timer_get_offset() to allow for kern_hyp_va() */
+static inline u64 hyp_timer_get_offset(struct arch_timer_context *ctxt)
+{
+	u64 offset = 0;
+	if (ctxt->offset.vm_offset)
+		offset += *kern_hyp_va(ctxt->offset.vm_offset);
+	if (ctxt->offset.vcpu_offset)
+		offset += *kern_hyp_va(ctxt->offset.vcpu_offset);
+	return offset;
+}
 static inline u64 compute_counter_value(struct arch_timer_context *ctxt)
 {
-	return arch_timer_read_cntpct_el0() - timer_get_offset(ctxt);
+	return arch_timer_read_cntpct_el0() - hyp_timer_get_offset(ctxt);
 }
 static bool kvm_handle_cntxct(struct kvm_vcpu *vcpu)
 	return true;
 }
-static bool kvm_hyp_handle_sysreg(struct kvm_vcpu *vcpu, u64 *exit_code)
+static inline bool kvm_hyp_handle_sysreg(struct kvm_vcpu *vcpu, u64 *exit_code)
 {
 	if (cpus_have_final_cap(ARM64_WORKAROUND_CAVIUM_TX2_219_TVM) &&
 	    handle_tx2_tvm(vcpu))
 	return false;
 }
-static bool kvm_hyp_handle_cp15_32(struct kvm_vcpu *vcpu, u64 *exit_code)
+static inline bool kvm_hyp_handle_cp15_32(struct kvm_vcpu *vcpu, u64 *exit_code)
 {
 	if (static_branch_unlikely(&vgic_v3_cpuif_trap) &&
 	    __vgic_v3_perform_cpuif_access(vcpu) == 1)
 	return false;
 }
-static bool kvm_hyp_handle_memory_fault(struct kvm_vcpu *vcpu, u64 *exit_code)
+static inline bool kvm_hyp_handle_memory_fault(struct kvm_vcpu *vcpu,
+					       u64 *exit_code)
 {
 	if (!__populate_fault_info(vcpu))
 		return true;
 	return false;
 }
-static bool kvm_hyp_handle_iabt_low(struct kvm_vcpu *vcpu, u64 *exit_code)
+#define kvm_hyp_handle_iabt_low		kvm_hyp_handle_memory_fault
-	__alias(kvm_hyp_handle_memory_fault);
+#define kvm_hyp_handle_watchpt_low	kvm_hyp_handle_memory_fault
-static bool kvm_hyp_handle_watchpt_low(struct kvm_vcpu *vcpu, u64 *exit_code)
-	__alias(kvm_hyp_handle_memory_fault);
-static bool kvm_hyp_handle_dabt_low(struct kvm_vcpu *vcpu, u64 *exit_code)
+static inline bool kvm_hyp_handle_dabt_low(struct kvm_vcpu *vcpu, u64 *exit_code)
 {
 	if (kvm_hyp_handle_memory_fault(vcpu, exit_code))
 		return true;
 typedef bool (*exit_handler_fn)(struct kvm_vcpu *, u64 *);
-static const exit_handler_fn *kvm_get_exit_handler_array(struct kvm_vcpu *vcpu);
-static void early_exit_filter(struct kvm_vcpu *vcpu, u64 *exit_code);
 /*
  * Allow the hypervisor to handle the exit with an exit handler if it has one.
  *
  * Returns true if the hypervisor handled the exit, and control should go back
  * to the guest, or false if it hasn't.
  */
-static inline bool kvm_hyp_handle_exit(struct kvm_vcpu *vcpu, u64 *exit_code)
+static inline bool kvm_hyp_handle_exit(struct kvm_vcpu *vcpu, u64 *exit_code,
+				       const exit_handler_fn *handlers)
 {
-	const exit_handler_fn *handlers = kvm_get_exit_handler_array(vcpu);
+	exit_handler_fn fn = handlers[kvm_vcpu_trap_get_class(vcpu)];
-	exit_handler_fn fn;
-	fn = handlers[kvm_vcpu_trap_get_class(vcpu)];
 	if (fn)
 		return fn(vcpu, exit_code);
  * the guest, false when we should restore the host state and return to the
  * main run loop.
  */
-static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code)
+static inline bool __fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code,
+				      const exit_handler_fn *handlers)
 {
-	/*
-	 * Save PSTATE early so that we can evaluate the vcpu mode
-	 * early on.
-	 */
-	synchronize_vcpu_pstate(vcpu, exit_code);
-	/*
-	 * Check whether we want to repaint the state one way or
-	 * another.
-	 */
-	early_exit_filter(vcpu, exit_code);
 	if (ARM_EXCEPTION_CODE(*exit_code) != ARM_EXCEPTION_IRQ)
 		vcpu->arch.fault.esr_el2 = read_sysreg_el2(SYS_ESR);
 		goto exit;
 	/* Check if there's an exit handler and allow it to handle the exit. */
-	if (kvm_hyp_handle_exit(vcpu, exit_code))
+	if (kvm_hyp_handle_exit(vcpu, exit_code, handlers))
 		goto guest;
 exit:
 	/* Return to the host kernel and handle the exit */

arch/arm64/kvm/hyp/nvhe/hyp-main.c+31−8

  */
 #include <hyp/adjust_pc.h>
+#include <hyp/switch.h>
 #include <asm/pgtable-types.h>
 #include <asm/kvm_asm.h>
 	if (system_supports_sve())
 		__hyp_sve_restore_host();
 	else
-		__fpsimd_restore_state(*host_data_ptr(fpsimd_state));
+		__fpsimd_restore_state(host_data_ptr(host_ctxt.fp_regs));
 	if (has_fpmr)
 		write_sysreg_s(*host_data_ptr(fpmr), SYS_FPMR);
 	*host_data_ptr(fp_owner) = FP_STATE_HOST_OWNED;
 }
+static void flush_debug_state(struct pkvm_hyp_vcpu *hyp_vcpu)
+{
+	struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu;
+	hyp_vcpu->vcpu.arch.debug_owner = host_vcpu->arch.debug_owner;
+	if (kvm_guest_owns_debug_regs(&hyp_vcpu->vcpu))
+		hyp_vcpu->vcpu.arch.vcpu_debug_state = host_vcpu->arch.vcpu_debug_state;
+	else if (kvm_host_owns_debug_regs(&hyp_vcpu->vcpu))
+		hyp_vcpu->vcpu.arch.external_debug_state = host_vcpu->arch.external_debug_state;
+}
+static void sync_debug_state(struct pkvm_hyp_vcpu *hyp_vcpu)
+{
+	struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu;
+	if (kvm_guest_owns_debug_regs(&hyp_vcpu->vcpu))
+		host_vcpu->arch.vcpu_debug_state = hyp_vcpu->vcpu.arch.vcpu_debug_state;
+	else if (kvm_host_owns_debug_regs(&hyp_vcpu->vcpu))
+		host_vcpu->arch.external_debug_state = hyp_vcpu->vcpu.arch.external_debug_state;
+}
 static void flush_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu)
 {
 	struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu;
 	fpsimd_sve_flush();
+	flush_debug_state(hyp_vcpu);
 	hyp_vcpu->vcpu.arch.ctxt	= host_vcpu->arch.ctxt;
 	unsigned int i;
 	fpsimd_sve_sync(&hyp_vcpu->vcpu);
+	sync_debug_state(hyp_vcpu);
 	host_vcpu->arch.ctxt		= hyp_vcpu->vcpu.arch.ctxt;
 		sync_hyp_vcpu(hyp_vcpu);
 	} else {
+		struct kvm_vcpu *vcpu = kern_hyp_va(host_vcpu);
 		/* The host is fully trusted, run its vCPU directly. */
-		ret = __kvm_vcpu_run(kern_hyp_va(host_vcpu));
+		fpsimd_lazy_switch_to_guest(vcpu);
+		ret = __kvm_vcpu_run(vcpu);
+		fpsimd_lazy_switch_to_host(vcpu);
 	}
 out:
 	cpu_reg(host_ctxt, 1) =  ret;
 	case ESR_ELx_EC_SMC64:
 		handle_host_smc(host_ctxt);
 		break;
-	case ESR_ELx_EC_SVE:
-		cpacr_clear_set(0, CPACR_EL1_ZEN);
-		isb();
-		sve_cond_update_zcr_vq(sve_vq_from_vl(kvm_host_sve_max_vl) - 1,
-				       SYS_ZCR_EL2);
-		break;
 	case ESR_ELx_EC_IABT_LOW:
 	case ESR_ELx_EC_DABT_LOW:
 		handle_host_mem_abort(host_ctxt);

arch/arm64/kvm/hyp/nvhe/mem_protect.c+41−35

@@ -943,10 +943,10 @@ static int __check_host_shared_guest(struct pkvm_hyp_vm vm, u64 __phys, u64 ip · 942 unmodified lines
943	ret = kvm_pgtable_get_leaf(&vm->pgt, ipa, &pte, &level);	943	ret = kvm_pgtable_get_leaf(&vm->pgt, ipa, &pte, &level);
944	if (ret)	944	if (ret)
945	return ret;	945	return ret;
946	if (level != KVM_PGTABLE_LAST_LEVEL)
947	return -E2BIG;
948	if (!kvm_pte_valid(pte))	946	if (!kvm_pte_valid(pte))
949	return -ENOENT;	947	return -ENOENT;
		948	if (level != KVM_PGTABLE_LAST_LEVEL)
		949	return -E2BIG;
950		950
951	state = guest_get_page_state(pte, ipa);	951	state = guest_get_page_state(pte, ipa);
952	if (state != PKVM_PAGE_SHARED_BORROWED)	952	if (state != PKVM_PAGE_SHARED_BORROWED)
@@ -998,63 +998,73 @@ unlock: · 45 unmodified lines
998	return ret;	998	return ret;
999	}	999	}
1000		1000
1001	int __pkvm_host_relax_perms_guest(u64 gfn, struct pkvm_hyp_vcpu *vcpu, enum kvm_pgtable_prot prot)	1001	static void assert_host_shared_guest(struct pkvm_hyp_vm *vm, u64 ipa)
1002	{	1002	{
1003	struct pkvm_hyp_vm *vm = pkvm_hyp_vcpu_to_hyp_vm(vcpu);
1004	u64 ipa = hyp_pfn_to_phys(gfn);
1005	u64 phys;	1003	u64 phys;
1006	int ret;	1004	int ret;
1007		1005
1008	if (prot & ~KVM_PGTABLE_PROT_RWX)	1006	if (!IS_ENABLED(CONFIG_NVHE_EL2_DEBUG))
1009	return -EINVAL;	1007	return;
1010		1008
1011	host_lock_component();	1009	host_lock_component();
1012	guest_lock_component(vm);	1010	guest_lock_component(vm);
1013		1011
1014	ret = __check_host_shared_guest(vm, &phys, ipa);	1012	ret = __check_host_shared_guest(vm, &phys, ipa);
1015	if (!ret)
1016	ret = kvm_pgtable_stage2_relax_perms(&vm->pgt, ipa, prot, 0);
1017		1013
1018	guest_unlock_component(vm);	1014	guest_unlock_component(vm);
1019	host_unlock_component();	1015	host_unlock_component();
1020		1016
1021	return ret;	1017	WARN_ON(ret && ret != -ENOENT);
1022	}	1018	}
1023		1019
1024	int __pkvm_host_wrprotect_guest(u64 gfn, struct pkvm_hyp_vm *vm)	1020	int __pkvm_host_relax_perms_guest(u64 gfn, struct pkvm_hyp_vcpu *vcpu, enum kvm_pgtable_prot prot)
1025	{	1021	{
		1022	struct pkvm_hyp_vm *vm = pkvm_hyp_vcpu_to_hyp_vm(vcpu);
1026	u64 ipa = hyp_pfn_to_phys(gfn);	1023	u64 ipa = hyp_pfn_to_phys(gfn);
1027	u64 phys;
1028	int ret;	1024	int ret;
1029		1025
1030	host_lock_component();	1026	if (pkvm_hyp_vm_is_protected(vm))
1031	guest_lock_component(vm);	1027	return -EPERM;
1032		1028
1033	ret = __check_host_shared_guest(vm, &phys, ipa);	1029	if (prot & ~KVM_PGTABLE_PROT_RWX)
1034	if (!ret)	1030	return -EINVAL;
1035	ret = kvm_pgtable_stage2_wrprotect(&vm->pgt, ipa, PAGE_SIZE);
1036		1031
		1032	assert_host_shared_guest(vm, ipa);
		1033	guest_lock_component(vm);
		1034	ret = kvm_pgtable_stage2_relax_perms(&vm->pgt, ipa, prot, 0);
1037	guest_unlock_component(vm);	1035	guest_unlock_component(vm);
1038	host_unlock_component();
1039		1036
1040	return ret;	1037	return ret;
1041	}	1038	}
1042		1039
1043	int __pkvm_host_test_clear_young_guest(u64 gfn, bool mkold, struct pkvm_hyp_vm *vm)	1040	int __pkvm_host_wrprotect_guest(u64 gfn, struct pkvm_hyp_vm *vm)
1044	{	1041	{
1045	u64 ipa = hyp_pfn_to_phys(gfn);	1042	u64 ipa = hyp_pfn_to_phys(gfn);
1046	u64 phys;
1047	int ret;	1043	int ret;
1048		1044
1049	host_lock_component();	1045	if (pkvm_hyp_vm_is_protected(vm))
		1046	return -EPERM;
		1047
		1048	assert_host_shared_guest(vm, ipa);
1050	guest_lock_component(vm);	1049	guest_lock_component(vm);
		1050	ret = kvm_pgtable_stage2_wrprotect(&vm->pgt, ipa, PAGE_SIZE);
		1051	guest_unlock_component(vm);
1051		1052
1052	ret = __check_host_shared_guest(vm, &phys, ipa);	1053	return ret;
1053	if (!ret)	1054	}
1054	ret = kvm_pgtable_stage2_test_clear_young(&vm->pgt, ipa, PAGE_SIZE, mkold);	1055
		1056	int __pkvm_host_test_clear_young_guest(u64 gfn, bool mkold, struct pkvm_hyp_vm *vm)
		1057	{
		1058	u64 ipa = hyp_pfn_to_phys(gfn);
		1059	int ret;
		1060
		1061	if (pkvm_hyp_vm_is_protected(vm))
		1062	return -EPERM;
1055		1063
		1064	assert_host_shared_guest(vm, ipa);
		1065	guest_lock_component(vm);
		1066	ret = kvm_pgtable_stage2_test_clear_young(&vm->pgt, ipa, PAGE_SIZE, mkold);
1056	guest_unlock_component(vm);	1067	guest_unlock_component(vm);
1057	host_unlock_component();
1058		1068
1059	return ret;	1069	return ret;
1060	}	1070	}
@@ -1063,18 +1073,14 @@ int __pkvm_host_mkyoung_guest(u64 gfn, struct pkvm_hyp_vcpu *vcpu) · 2 unmodified lines
1063	{	1073	{
1064	struct pkvm_hyp_vm *vm = pkvm_hyp_vcpu_to_hyp_vm(vcpu);	1074	struct pkvm_hyp_vm *vm = pkvm_hyp_vcpu_to_hyp_vm(vcpu);
1065	u64 ipa = hyp_pfn_to_phys(gfn);	1075	u64 ipa = hyp_pfn_to_phys(gfn);
1066	u64 phys;
1067	int ret;
1068
1069	host_lock_component();
1070	guest_lock_component(vm);
1071		1076
1072	ret = __check_host_shared_guest(vm, &phys, ipa);	1077	if (pkvm_hyp_vm_is_protected(vm))
1073	if (!ret)	1078	return -EPERM;
1074	kvm_pgtable_stage2_mkyoung(&vm->pgt, ipa, 0);
1075		1079
		1080	assert_host_shared_guest(vm, ipa);
		1081	guest_lock_component(vm);
		1082	kvm_pgtable_stage2_mkyoung(&vm->pgt, ipa, 0);
1076	guest_unlock_component(vm);	1083	guest_unlock_component(vm);
1077	host_unlock_component();
1078		1084
1079	return ret;	1085	return 0;
1080	}	1086	}

arch/arm64/kvm/hyp/nvhe/switch.c+45−44

 {
 	u64 val = CPTR_EL2_TAM;	/* Same bit irrespective of E2H */
+	if (!guest_owns_fp_regs())
+		__activate_traps_fpsimd32(vcpu);
 	if (has_hvhe()) {
 		val |= CPACR_EL1_TTA;
 			if (vcpu_has_sve(vcpu))
 				val |= CPACR_EL1_ZEN;
 		}
+		write_sysreg(val, cpacr_el1);
 	} else {
 		val |= CPTR_EL2_TTA | CPTR_NVHE_EL2_RES1;
 		if (!guest_owns_fp_regs())
 			val |= CPTR_EL2_TFP;
+		write_sysreg(val, cptr_el2);
 	}
+}
-	if (!guest_owns_fp_regs())
+static void __deactivate_cptr_traps(struct kvm_vcpu *vcpu)
-		__activate_traps_fpsimd32(vcpu);
+{
+	if (has_hvhe()) {
+		u64 val = CPACR_EL1_FPEN;
+		if (cpus_have_final_cap(ARM64_SVE))
+			val |= CPACR_EL1_ZEN;
+		if (cpus_have_final_cap(ARM64_SME))
+			val |= CPACR_EL1_SMEN;
-	kvm_write_cptr_el2(val);
+		write_sysreg(val, cpacr_el1);
+	} else {
+		u64 val = CPTR_NVHE_EL2_RES1;
+		if (!cpus_have_final_cap(ARM64_SVE))
+			val |= CPTR_EL2_TZ;
+		if (!cpus_have_final_cap(ARM64_SME))
+			val |= CPTR_EL2_TSM;
+		write_sysreg(val, cptr_el2);
+	}
 }
 static void __activate_traps(struct kvm_vcpu *vcpu)
 	write_sysreg(this_cpu_ptr(&kvm_init_params)->hcr_el2, hcr_el2);
-	kvm_reset_cptr_el2(vcpu);
+	__deactivate_cptr_traps(vcpu);
 	write_sysreg(__kvm_hyp_host_vector, vbar_el2);
 }
 		kvm_handle_pvm_sysreg(vcpu, exit_code));
 }
-static void kvm_hyp_save_fpsimd_host(struct kvm_vcpu *vcpu)
-{
-	/*
-	 * Non-protected kvm relies on the host restoring its sve state.
-	 * Protected kvm restores the host's sve state as not to reveal that
-	 * fpsimd was used by a guest nor leak upper sve bits.
-	 */
-	if (unlikely(is_protected_kvm_enabled() && system_supports_sve())) {
-		__hyp_sve_save_host();
-		/* Re-enable SVE traps if not supported for the guest vcpu. */
-		if (!vcpu_has_sve(vcpu))
-			cpacr_clear_set(CPACR_EL1_ZEN, 0);
-	} else {
-		__fpsimd_save_state(*host_data_ptr(fpsimd_state));
-	}
-	if (kvm_has_fpmr(kern_hyp_va(vcpu->kvm))) {
-		u64 val = read_sysreg_s(SYS_FPMR);
-		if (unlikely(is_protected_kvm_enabled()))
-			*host_data_ptr(fpmr) = val;
-		else
-			**host_data_ptr(fpmr_ptr) = val;
-	}
-}
 static const exit_handler_fn hyp_exit_handlers[] = {
 	[0 ... ESR_ELx_EC_MAX]		= NULL,
 	[ESR_ELx_EC_CP15_32]		= kvm_hyp_handle_cp15_32,
 	return hyp_exit_handlers;
 }
-/*
+static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code)
- * Some guests (e.g., protected VMs) are not be allowed to run in AArch32.
- * The ARMv8 architecture does not give the hypervisor a mechanism to prevent a
- * guest from dropping to AArch32 EL0 if implemented by the CPU. If the
- * hypervisor spots a guest in such a state ensure it is handled, and don't
- * trust the host to spot or fix it.  The check below is based on the one in
- * kvm_arch_vcpu_ioctl_run().
- *
- * Returns false if the guest ran in AArch32 when it shouldn't have, and
- * thus should exit to the host, or true if a the guest run loop can continue.
- */
-static void early_exit_filter(struct kvm_vcpu *vcpu, u64 *exit_code)
 {
+	const exit_handler_fn *handlers = kvm_get_exit_handler_array(vcpu);
+	synchronize_vcpu_pstate(vcpu, exit_code);
+	/*
+	 * Some guests (e.g., protected VMs) are not be allowed to run in
+	 * AArch32.  The ARMv8 architecture does not give the hypervisor a
+	 * mechanism to prevent a guest from dropping to AArch32 EL0 if
+	 * implemented by the CPU. If the hypervisor spots a guest in such a
+	 * state ensure it is handled, and don't trust the host to spot or fix
+	 * it.  The check below is based on the one in
+	 * kvm_arch_vcpu_ioctl_run().
+	 */
 	if (unlikely(vcpu_is_protected(vcpu) && vcpu_mode_is_32bit(vcpu))) {
 		/*
 		 * As we have caught the guest red-handed, decide that it isn't
 		*exit_code &= BIT(ARM_EXIT_WITH_SERROR_BIT);
 		*exit_code |= ARM_EXCEPTION_IL;
 	}
+	return __fixup_guest_exit(vcpu, exit_code, handlers);
 }
 /* Switch to the guest for legacy non-VHE systems */

arch/arm64/kvm/hyp/vhe/switch.c+19−14

 	write_sysreg(val, cpacr_el1);
 }
+static void __deactivate_cptr_traps(struct kvm_vcpu *vcpu)
+{
+	u64 val = CPACR_EL1_FPEN | CPACR_EL1_ZEN_EL1EN;
+	if (cpus_have_final_cap(ARM64_SME))
+		val |= CPACR_EL1_SMEN_EL1EN;
+	write_sysreg(val, cpacr_el1);
+}
 static void __activate_traps(struct kvm_vcpu *vcpu)
 {
 	u64 val;
 	 */
 	asm(ALTERNATIVE("nop", "isb", ARM64_WORKAROUND_SPECULATIVE_AT));
-	kvm_reset_cptr_el2(vcpu);
+	__deactivate_cptr_traps(vcpu);
 	if (!arm64_kernel_unmapped_at_el0())
 		host_vectors = __this_cpu_read(this_cpu_vector);
 	return true;
 }
-static void kvm_hyp_save_fpsimd_host(struct kvm_vcpu *vcpu)
-{
-	__fpsimd_save_state(*host_data_ptr(fpsimd_state));
-	if (kvm_has_fpmr(vcpu->kvm))
-		**host_data_ptr(fpmr_ptr) = read_sysreg_s(SYS_FPMR);
-}
 static bool kvm_hyp_handle_tlbi_el2(struct kvm_vcpu *vcpu, u64 *exit_code)
 {
 	int ret = -EINVAL;
 	[ESR_ELx_EC_MOPS]		= kvm_hyp_handle_mops,
 };
-static const exit_handler_fn *kvm_get_exit_handler_array(struct kvm_vcpu *vcpu)
+static inline bool fixup_guest_exit(struct kvm_vcpu *vcpu, u64 *exit_code)
 {
-	return hyp_exit_handlers;
+	synchronize_vcpu_pstate(vcpu, exit_code);
-}
-static void early_exit_filter(struct kvm_vcpu *vcpu, u64 *exit_code)
-{
 	/*
 	 * If we were in HYP context on entry, adjust the PSTATE view
 	 * so that the usual helpers work correctly.
 		*vcpu_cpsr(vcpu) &= ~(PSR_MODE_MASK | PSR_MODE32_BIT);
 		*vcpu_cpsr(vcpu) |= mode;
 	}
+	return __fixup_guest_exit(vcpu, exit_code, hyp_exit_handlers);
 }
 /* Switch to the guest for VHE systems running in EL2 */
 	sysreg_save_host_state_vhe(host_ctxt);
+	fpsimd_lazy_switch_to_guest(vcpu);
 	/*
 	 * Note that ARM erratum 1165522 requires us to configure both stage 1
 	 * and stage 2 translation for the guest context before we clear
 	__deactivate_traps(vcpu);
+	fpsimd_lazy_switch_to_host(vcpu);
 	sysreg_restore_host_state_vhe(host_ctxt);
 	if (guest_owns_fp_regs())

arch/arm64/kvm/nested.c+5−4

 	if (!tmp)
 		return -ENOMEM;
+	swap(kvm->arch.nested_mmus, tmp);
 	/*
 	 * If we went through a realocation, adjust the MMU back-pointers in
 	 * the previously initialised kvm_pgtable structures.
 	 */
 	if (kvm->arch.nested_mmus != tmp)
 		for (int i = 0; i < kvm->arch.nested_mmus_size; i++)
-			tmp[i].pgt->mmu = &tmp[i];
+			kvm->arch.nested_mmus[i].pgt->mmu = &kvm->arch.nested_mmus[i];
 	for (int i = kvm->arch.nested_mmus_size; !ret && i < num_mmus; i++)
-		ret = init_nested_s2_mmu(kvm, &tmp[i]);
+		ret = init_nested_s2_mmu(kvm, &kvm->arch.nested_mmus[i]);
 	if (ret) {
 		for (int i = kvm->arch.nested_mmus_size; i < num_mmus; i++)
-			kvm_free_stage2_pgd(&tmp[i]);
+			kvm_free_stage2_pgd(&kvm->arch.nested_mmus[i]);
 		return ret;
 	}
 	kvm->arch.nested_mmus_size = num_mmus;
-	kvm->arch.nested_mmus = tmp;
 	return 0;
 }

arch/arm64/kvm/sys_regs.c+13−3

 	return true;
 }
+static bool access_hv_timer(struct kvm_vcpu *vcpu,
+			    struct sys_reg_params *p,
+			    const struct sys_reg_desc *r)
+{
+	if (!vcpu_el2_e2h_is_set(vcpu))
+		return undef_access(vcpu, p, r);
+	return access_arch_timer(vcpu, p, r);
+}
 static s64 kvm_arm64_ftr_safe_value(u32 id, const struct arm64_ftr_bits *ftrp,
 				    s64 new, s64 cur)
 {
 	EL2_REG(CNTHP_CTL_EL2, access_arch_timer, reset_val, 0),
 	EL2_REG(CNTHP_CVAL_EL2, access_arch_timer, reset_val, 0),
-	{ SYS_DESC(SYS_CNTHV_TVAL_EL2), access_arch_timer },
+	{ SYS_DESC(SYS_CNTHV_TVAL_EL2), access_hv_timer },
-	EL2_REG(CNTHV_CTL_EL2, access_arch_timer, reset_val, 0),
+	EL2_REG(CNTHV_CTL_EL2, access_hv_timer, reset_val, 0),
-	EL2_REG(CNTHV_CVAL_EL2, access_arch_timer, reset_val, 0),
+	EL2_REG(CNTHV_CVAL_EL2, access_hv_timer, reset_val, 0),
 	{ SYS_DESC(SYS_CNTKCTL_EL12), access_cntkctl_el12 },

arch/arm64/kvm/vgic/vgic-init.c+37−37

  *
  * CPU Interface:
  *
- * - kvm_vgic_vcpu_init(): initialization of static data that
+ * - kvm_vgic_vcpu_init(): initialization of static data that doesn't depend
- *   doesn't depend on any sizing information or emulation type. No
+ *   on any sizing information. Private interrupts are allocated if not
- *   allocation is allowed there.
+ *   already allocated at vgic-creation time.
  */
 /* EARLY INIT */
 /* CREATION */
+static int vgic_allocate_private_irqs_locked(struct kvm_vcpu *vcpu, u32 type);
 /**
  * kvm_vgic_create: triggered by the instantiation of the VGIC device by
  * user space, either through the legacy KVM_CREATE_IRQCHIP ioctl (v2 only)
 		goto out_unlock;
 	}
+	kvm_for_each_vcpu(i, vcpu, kvm) {
+		ret = vgic_allocate_private_irqs_locked(vcpu, type);
+		if (ret)
+			break;
+	}
+	if (ret) {
+		kvm_for_each_vcpu(i, vcpu, kvm) {
+			struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
+			kfree(vgic_cpu->private_irqs);
+			vgic_cpu->private_irqs = NULL;
+		}
+		goto out_unlock;
+	}
 	kvm->arch.vgic.in_kernel = true;
 	kvm->arch.vgic.vgic_model = type;
 	return 0;
 }
-static int vgic_allocate_private_irqs_locked(struct kvm_vcpu *vcpu)
+static int vgic_allocate_private_irqs_locked(struct kvm_vcpu *vcpu, u32 type)
 {
 	struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
 	int i;
 			/* PPIs */
 			irq->config = VGIC_CONFIG_LEVEL;
 		}
+		switch (type) {
+		case KVM_DEV_TYPE_ARM_VGIC_V3:
+			irq->group = 1;
+			irq->mpidr = kvm_vcpu_get_mpidr_aff(vcpu);
+			break;
+		case KVM_DEV_TYPE_ARM_VGIC_V2:
+			irq->group = 0;
+			irq->targets = BIT(vcpu->vcpu_id);
+			break;
+		}
 	}
 	return 0;
 }
-static int vgic_allocate_private_irqs(struct kvm_vcpu *vcpu)
+static int vgic_allocate_private_irqs(struct kvm_vcpu *vcpu, u32 type)
 {
 	int ret;
 	mutex_lock(&vcpu->kvm->arch.config_lock);
-	ret = vgic_allocate_private_irqs_locked(vcpu);
+	ret = vgic_allocate_private_irqs_locked(vcpu, type);
 	mutex_unlock(&vcpu->kvm->arch.config_lock);
 	return ret;
 	if (!irqchip_in_kernel(vcpu->kvm))
 		return 0;
-	ret = vgic_allocate_private_irqs(vcpu);
+	ret = vgic_allocate_private_irqs(vcpu, dist->vgic_model);
 	if (ret)
 		return ret;
 {
 	struct vgic_dist *dist = &kvm->arch.vgic;
 	struct kvm_vcpu *vcpu;
-	int ret = 0, i;
+	int ret = 0;
 	unsigned long idx;
 	lockdep_assert_held(&kvm->arch.config_lock);
 	if (ret)
 		goto out;
-	/* Initialize groups on CPUs created before the VGIC type was known */
-	kvm_for_each_vcpu(idx, vcpu, kvm) {
-		ret = vgic_allocate_private_irqs_locked(vcpu);
-		if (ret)
-			goto out;
-		for (i = 0; i < VGIC_NR_PRIVATE_IRQS; i++) {
-			struct vgic_irq *irq = vgic_get_vcpu_irq(vcpu, i);
-			switch (dist->vgic_model) {
-			case KVM_DEV_TYPE_ARM_VGIC_V3:
-				irq->group = 1;
-				irq->mpidr = kvm_vcpu_get_mpidr_aff(vcpu);
-				break;
-			case KVM_DEV_TYPE_ARM_VGIC_V2:
-				irq->group = 0;
-				irq->targets = 1U << idx;
-				break;
-			default:
-				ret = -EINVAL;
-			}
-			vgic_put_irq(kvm, irq);
-			if (ret)
-				goto out;
-		}
-	}
 	/*
 	 * If we have GICv4.1 enabled, unconditionally request enable the
 	 * v4 support so that we get HW-accelerated vSGIs. Otherwise, only

arch/arm64/mm/trans_pgd.c+7−0

@@ -162,6 +162,13 @@ static int copy_p4d(struct trans_pgd_info info, pgd_t dst_pgdp, · 161 unmodified lines
162	unsigned long next;	162	unsigned long next;
163	unsigned long addr = start;	163	unsigned long addr = start;
164		164
		165	if (pgd_none(READ_ONCE(*dst_pgdp))) {
		166	dst_p4dp = trans_alloc(info);
		167	if (!dst_p4dp)
		168	return -ENOMEM;
		169	pgd_populate(NULL, dst_pgdp, dst_p4dp);
		170	}
		171
165	dst_p4dp = p4d_offset(dst_pgdp, start);	172	dst_p4dp = p4d_offset(dst_pgdp, start);
166	src_p4dp = p4d_offset(src_pgdp, start);	173	src_p4dp = p4d_offset(src_pgdp, start);
167	do {	174	do {

arch/loongarch/include/asm/cpu-info.h+0−21

@@ -76,27 +76,6 @@ extern const char *__cpu_full_name[]; · 75 unmodified lines
76	#define cpu_family_string() __cpu_family[raw_smp_processor_id()]	76	#define cpu_family_string() __cpu_family[raw_smp_processor_id()]
77	#define cpu_full_name_string() __cpu_full_name[raw_smp_processor_id()]	77	#define cpu_full_name_string() __cpu_full_name[raw_smp_processor_id()]
78		78
79	struct seq_file;
80	struct notifier_block;
81
82	extern int register_proc_cpuinfo_notifier(struct notifier_block *nb);
83	extern int proc_cpuinfo_notifier_call_chain(unsigned long val, void *v);
84
85	#define proc_cpuinfo_notifier(fn, pri) \
86	({ \
87	static struct notifier_block fn##_nb = { \
88	.notifier_call = fn, \
89	.priority = pri \
90	}; \
91	\
92	register_proc_cpuinfo_notifier(&fn##_nb); \
93	})
94
95	struct proc_cpuinfo_notifier_args {
96	struct seq_file *m;
97	unsigned long n;
98	};
99
100	static inline bool cpus_are_siblings(int cpua, int cpub)	79	static inline bool cpus_are_siblings(int cpua, int cpub)
101	{	80	{
102	struct cpuinfo_loongarch *infoa = &cpu_data[cpua];	81	struct cpuinfo_loongarch *infoa = &cpu_data[cpua];

arch/loongarch/include/asm/smp.h+2−0

@@ -77,6 +77,8 @@ extern int __cpu_logical_map[NR_CPUS]; · 76 unmodified lines
77	#define SMP_IRQ_WORK BIT(ACTION_IRQ_WORK)	77	#define SMP_IRQ_WORK BIT(ACTION_IRQ_WORK)
78	#define SMP_CLEAR_VECTOR BIT(ACTION_CLEAR_VECTOR)	78	#define SMP_CLEAR_VECTOR BIT(ACTION_CLEAR_VECTOR)
79		79
		80	struct seq_file;
		81
80	struct secondary_data {	82	struct secondary_data {
81	unsigned long stack;	83	unsigned long stack;
82	unsigned long thread_info;	84	unsigned long thread_info;

arch/loongarch/kernel/genex.S+15−13

@@ -18,16 +18,19 @@ · 17 unmodified lines
18		18
19	.align 5	19	.align 5
20	SYM_FUNC_START(__arch_cpu_idle)	20	SYM_FUNC_START(__arch_cpu_idle)
21	/* start of rollback region */	21	/* start of idle interrupt region */
22	LONG_L t0, tp, TI_FLAGS	22	ori t0, zero, CSR_CRMD_IE
23	nop	23	/* idle instruction needs irq enabled */
24	andi t0, t0, _TIF_NEED_RESCHED	24	csrxchg t0, t0, LOONGARCH_CSR_CRMD
25	bnez t0, 1f	25	/*
26	nop	26	* If an interrupt lands here; between enabling interrupts above and
27	nop	27	* going idle on the next instruction, we must NOT go idle since the
28	nop	28	* interrupt could have set TIF_NEED_RESCHED or caused an timer to need
		29	* reprogramming. Fall through -- see handle_vint() below -- and have
		30	* the idle loop take care of things.
		31	*/
29	idle 0	32	idle 0
30	/* end of rollback region */	33	/* end of idle interrupt region */
31	1: jr ra	34	1: jr ra
32	SYM_FUNC_END(__arch_cpu_idle)	35	SYM_FUNC_END(__arch_cpu_idle)
33		36
@@ -35,11 +38,10 @@ SYM_CODE_START(handle_vint) · 1 unmodified line
35	UNWIND_HINT_UNDEFINED	38	UNWIND_HINT_UNDEFINED
36	BACKUP_T0T1	39	BACKUP_T0T1
37	SAVE_ALL	40	SAVE_ALL
38	la_abs t1, __arch_cpu_idle	41	la_abs t1, 1b
39	LONG_L t0, sp, PT_ERA	42	LONG_L t0, sp, PT_ERA
40	/* 32 byte rollback region */	43	/* 3 instructions idle interrupt region */
41	ori t0, t0, 0x1f	44	ori t0, t0, 0b1100
42	xori t0, t0, 0x1f
43	bne t0, t1, 1f	45	bne t0, t1, 1f
44	LONG_S t0, sp, PT_ERA	46	LONG_S t0, sp, PT_ERA
45	1: move a0, sp	47	1: move a0, sp

arch/loongarch/kernel/idle.c+1−2

@@ -11,7 +11,6 @@ · 10 unmodified lines
11		11
12	void __cpuidle arch_cpu_idle(void)	12	void __cpuidle arch_cpu_idle(void)
13	{	13	{
14	raw_local_irq_enable();	14	__arch_cpu_idle();
15	__arch_cpu_idle(); /* idle instruction needs irq enabled */
16	raw_local_irq_disable();	15	raw_local_irq_disable();
17	}	16	}

arch/loongarch/kernel/proc.c+3−26

 #include <asm/processor.h>
 #include <asm/time.h>
-/*
- * No lock; only written during early bootup by CPU 0.
- */
-static RAW_NOTIFIER_HEAD(proc_cpuinfo_chain);
-int __ref register_proc_cpuinfo_notifier(struct notifier_block *nb)
-{
-	return raw_notifier_chain_register(&proc_cpuinfo_chain, nb);
-}
-int proc_cpuinfo_notifier_call_chain(unsigned long val, void *v)
-{
-	return raw_notifier_call_chain(&proc_cpuinfo_chain, val, v);
-}
 static int show_cpuinfo(struct seq_file *m, void *v)
 {
 	unsigned long n = (unsigned long) v - 1;
 	unsigned int isa = cpu_data[n].isa_level;
 	unsigned int version = cpu_data[n].processor_id & 0xff;
 	unsigned int fp_version = cpu_data[n].fpu_vers;
-	struct proc_cpuinfo_notifier_args proc_cpuinfo_notifier_args;
 #ifdef CONFIG_SMP
 	if (!cpu_online(n))
 	if (cpu_has_lbt_mips)	seq_printf(m, " lbt_mips");
 	seq_printf(m, "\n");
-	seq_printf(m, "Hardware Watchpoint\t: %s",
+	seq_printf(m, "Hardware Watchpoint\t: %s", str_yes_no(cpu_has_watch));
-		      cpu_has_watch ? "yes, " : "no\n");
 	if (cpu_has_watch) {
-		seq_printf(m, "iwatch count: %d, dwatch count: %d\n",
+		seq_printf(m, ", iwatch count: %d, dwatch count: %d",
 		      cpu_data[n].watch_ireg_count, cpu_data[n].watch_dreg_count);
 	}
-	proc_cpuinfo_notifier_args.m = m;
+	seq_printf(m, "\n\n");
-	proc_cpuinfo_notifier_args.n = n;
-	raw_notifier_call_chain(&proc_cpuinfo_chain, 0,
-				&proc_cpuinfo_notifier_args);
-	seq_printf(m, "\n");
 	return 0;
 }

arch/loongarch/kernel/reset.c+3−3

@@ -33,7 +33,7 @@ void machine_halt(void) · 32 unmodified lines
33	console_flush_on_panic(CONSOLE_FLUSH_PENDING);	33	console_flush_on_panic(CONSOLE_FLUSH_PENDING);
34		34
35	while (true) {	35	while (true) {
36	__arch_cpu_idle();	36	__asm__ __volatile__("idle 0" : : : "memory");
37	}	37	}
38	}	38	}
39		39
@@ -53,7 +53,7 @@ void machine_power_off(void) · 13 unmodified lines
53	#endif	53	#endif
54		54
55	while (true) {	55	while (true) {
56	__arch_cpu_idle();	56	__asm__ __volatile__("idle 0" : : : "memory");
57	}	57	}
58	}	58	}
59		59
@@ -74,6 +74,6 @@ void machine_restart(char *command) · 14 unmodified lines
74	acpi_reboot();	74	acpi_reboot();
75		75
76	while (true) {	76	while (true) {
77	__arch_cpu_idle();	77	__asm__ __volatile__("idle 0" : : : "memory");
78	}	78	}
79	}	79	}

arch/loongarch/kvm/main.c+2−2

@@ -303,9 +303,9 @@ int kvm_arch_enable_virtualization_cpu(void) · 302 unmodified lines
303	* TOE=0: Trap on Exception.	303	* TOE=0: Trap on Exception.
304	* TIT=0: Trap on Timer.	304	* TIT=0: Trap on Timer.
305	*/	305	*/
306	if (env & CSR_GCFG_GCIP_ALL)	306	if (env & CSR_GCFG_GCIP_SECURE)
307	gcfg \|= CSR_GCFG_GCI_SECURE;	307	gcfg \|= CSR_GCFG_GCI_SECURE;
308	if (env & CSR_GCFG_MATC_ROOT)	308	if (env & CSR_GCFG_MATP_ROOT)
309	gcfg \|= CSR_GCFG_MATC_ROOT;	309	gcfg \|= CSR_GCFG_MATC_ROOT;
310		310
311	write_csr_gcfg(gcfg);	311	write_csr_gcfg(gcfg);

arch/loongarch/kvm/switch.S+1−1

@@ -85,7 +85,7 @@ · 84 unmodified lines
85	* Guest CRMD comes from separate GCSR_CRMD register	85	* Guest CRMD comes from separate GCSR_CRMD register
86	*/	86	*/
87	ori t0, zero, CSR_PRMD_PIE	87	ori t0, zero, CSR_PRMD_PIE
88	csrxchg t0, t0, LOONGARCH_CSR_PRMD	88	csrwr t0, LOONGARCH_CSR_PRMD
89		89
90	/* Set PVM bit to setup ertn to guest context */	90	/* Set PVM bit to setup ertn to guest context */
91	ori t0, zero, CSR_GSTAT_PVM	91	ori t0, zero, CSR_GSTAT_PVM

arch/loongarch/kvm/vcpu.c+0−3

@@ -1548,9 +1548,6 @@ static int _kvm_vcpu_load(struct kvm_vcpu *vcpu, int cpu) · 1547 unmodified lines
1548		1548
1549	/* Restore timer state regardless */	1549	/* Restore timer state regardless */
1550	kvm_restore_timer(vcpu);	1550	kvm_restore_timer(vcpu);
1551
1552	/* Control guest page CCA attribute */
1553	change_csr_gcfg(CSR_GCFG_MATC_MASK, CSR_GCFG_MATC_ROOT);
1554	kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu);	1551	kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu);
1555		1552
1556	/* Restore hardware PMU CSRs */	1553	/* Restore hardware PMU CSRs */

arch/loongarch/lib/csum.c+1−1

@@ -25,7 +25,7 @@ unsigned int __no_sanitize_address do_csum(const unsigned char *buff, int len) · 24 unmodified lines
25	const u64 *ptr;	25	const u64 *ptr;
26	u64 data, sum64 = 0;	26	u64 data, sum64 = 0;
27		27
28	if (unlikely(len == 0))	28	if (unlikely(len <= 0))
29	return 0;	29	return 0;
30		30
31	offset = (unsigned long)buff & 7;	31	offset = (unsigned long)buff & 7;

arch/loongarch/mm/pageattr.c+2−1

  * Copyright (C) 2024 Loongson Technology Corporation Limited
  */
+#include <linux/memblock.h>
 #include <linux/pagewalk.h>
 #include <linux/pgtable.h>
 #include <asm/set_memory.h>
 	unsigned long addr = (unsigned long)page_address(page);
 	if (addr < vm_map_base)
-		return true;
+		return memblock_is_memory(__pa(addr));
 	pgd = pgd_offset_k(addr);
 	if (pgd_none(pgdp_get(pgd)))

arch/mips/include/asm/ptrace.h+2−2

@@ -27,8 +27,8 @@ · 26 unmodified lines
27	*/	27	*/
28	struct pt_regs {	28	struct pt_regs {
29	#ifdef CONFIG_32BIT	29	#ifdef CONFIG_32BIT
30	/* Pad bytes for argument save space on the stack. */	30	/* Saved syscall stack arguments; entries 0-3 unused. */
31	unsigned long pad0[8];	31	unsigned long args[8];
32	#endif	32	#endif
33		33
34	/* Saved main processor registers. */	34	/* Saved main processor registers. */

arch/mips/include/asm/syscall.h+8−24

@@ -57,37 +57,21 @@ static inline void mips_syscall_update_nr(struct task_struct *task, · 56 unmodified lines
57	static inline void mips_get_syscall_arg(unsigned long *arg,	57	static inline void mips_get_syscall_arg(unsigned long *arg,
58	struct task_struct task, struct pt_regs regs, unsigned int n)	58	struct task_struct task, struct pt_regs regs, unsigned int n)
59	{	59	{
60	unsigned long usp __maybe_unused = regs->regs[29];	60	#ifdef CONFIG_32BIT
61
62	switch (n) {	61	switch (n) {
63	case 0: case 1: case 2: case 3:	62	case 0: case 1: case 2: case 3:
64	*arg = regs->regs[4 + n];	63	*arg = regs->regs[4 + n];
65
66	return;
67
68	#ifdef CONFIG_32BIT
69	case 4: case 5: case 6: case 7:
70	get_user(arg, (int )usp + n);
71	return;	64	return;
72	#endif
73
74	#ifdef CONFIG_64BIT
75	case 4: case 5: case 6: case 7:	65	case 4: case 5: case 6: case 7:
76	#ifdef CONFIG_MIPS32_O32	66	*arg = regs->args[n];
77	if (test_tsk_thread_flag(task, TIF_32BIT_REGS))
78	get_user(arg, (int )usp + n);
79	else
80	#endif
81	*arg = regs->regs[4 + n];
82
83	return;	67	return;
84	#endif
85
86	default:
87	BUG();
88	}	68	}
89		69	#else
90	unreachable();	70	*arg = regs->regs[4 + n];
		71	if ((IS_ENABLED(CONFIG_MIPS32_O32) &&
		72	test_tsk_thread_flag(task, TIF_32BIT_REGS)))
		73	arg = (unsigned int)arg;
		74	#endif
91	}	75	}
92		76
93	static inline long syscall_get_error(struct task_struct *task,	77	static inline long syscall_get_error(struct task_struct *task,

arch/mips/kernel/asm-offsets.c+6−0

 void output_ptreg_defines(void)
 {
 	COMMENT("MIPS pt_regs offsets.");
+#ifdef CONFIG_32BIT
+	OFFSET(PT_ARG4, pt_regs, args[4]);
+	OFFSET(PT_ARG5, pt_regs, args[5]);
+	OFFSET(PT_ARG6, pt_regs, args[6]);
+	OFFSET(PT_ARG7, pt_regs, args[7]);
+#endif
 	OFFSET(PT_R0, pt_regs, regs[0]);
 	OFFSET(PT_R1, pt_regs, regs[1]);
 	OFFSET(PT_R2, pt_regs, regs[2]);

arch/mips/kernel/scall32-o32.S+4−4

@@ -64,10 +64,10 @@ load_a6: user_lw(t7, 24(t0)) # argument #7 from usp · 63 unmodified lines
64	load_a7: user_lw(t8, 28(t0)) # argument #8 from usp	64	load_a7: user_lw(t8, 28(t0)) # argument #8 from usp
65	loads_done:	65	loads_done:
66		66
67	sw t5, 16(sp) # argument #5 to ksp	67	sw t5, PT_ARG4(sp) # argument #5 to ksp
68	sw t6, 20(sp) # argument #6 to ksp	68	sw t6, PT_ARG5(sp) # argument #6 to ksp
69	sw t7, 24(sp) # argument #7 to ksp	69	sw t7, PT_ARG6(sp) # argument #7 to ksp
70	sw t8, 28(sp) # argument #8 to ksp	70	sw t8, PT_ARG7(sp) # argument #8 to ksp
71	.set pop	71	.set pop
72		72
73	.section __ex_table,"a"	73	.section __ex_table,"a"

arch/powerpc/include/asm/book3s/64/hash-4k.h+10−2

@@ -77,9 +77,17 @@ · 76 unmodified lines
77	/*	77	/*
78	* With 4K page size the real_pte machinery is all nops.	78	* With 4K page size the real_pte machinery is all nops.
79	*/	79	*/
80	#define __real_pte(e, p, o) ((real_pte_t){(e)})	80	static inline real_pte_t __real_pte(pte_t pte, pte_t *ptep, int offset)
		81	{
		82	return (real_pte_t){pte};
		83	}
		84
81	#define __rpte_to_pte(r) ((r).pte)	85	#define __rpte_to_pte(r) ((r).pte)
82	#define __rpte_to_hidx(r,index) (pte_val(__rpte_to_pte(r)) >> H_PAGE_F_GIX_SHIFT)	86
		87	static inline unsigned long __rpte_to_hidx(real_pte_t rpte, unsigned long index)
		88	{
		89	return pte_val(__rpte_to_pte(rpte)) >> H_PAGE_F_GIX_SHIFT;
		90	}
83		91
84	#define pte_iterate_hashed_subpages(rpte, psize, va, index, shift) \	92	#define pte_iterate_hashed_subpages(rpte, psize, va, index, shift) \
85	do { \	93	do { \

arch/powerpc/lib/code-patching.c+3−1

 	unsigned long addr;
 	int err;
-	area = get_vm_area(PAGE_SIZE, VM_ALLOC);
+	area = get_vm_area(PAGE_SIZE, 0);
 	if (!area) {
 		WARN_ONCE(1, "Failed to create text area for cpu %d\n",
 			cpu);
 	orig_mm = start_using_temp_mm(patching_mm);
+	kasan_disable_current();
 	err = __patch_instructions(patch_addr, code, len, repeat_instr);
+	kasan_enable_current();
 	/* context synchronisation performed by __patch_instructions */
 	stop_using_temp_mm(patching_mm, orig_mm);

arch/powerpc/sysdev/fsl_msi.c+1−1

@@ -75,7 +75,7 @@ static void fsl_msi_print_chip(struct irq_data irqd, struct seq_file p) · 74 unmodified lines
75	srs = (hwirq >> msi_data->srs_shift) & MSI_SRS_MASK;	75	srs = (hwirq >> msi_data->srs_shift) & MSI_SRS_MASK;
76	cascade_virq = msi_data->cascade_array[srs]->virq;	76	cascade_virq = msi_data->cascade_array[srs]->virq;
77		77
78	seq_printf(p, " fsl-msi-%d", cascade_virq);	78	seq_printf(p, "fsl-msi-%d", cascade_virq);
79	}	79	}
80		80
81		81

arch/s390/configs/debug_defconfig+0−1

@@ -740,7 +740,6 @@ CONFIG_IMA=y · 739 unmodified lines
740	CONFIG_IMA_DEFAULT_HASH_SHA256=y	740	CONFIG_IMA_DEFAULT_HASH_SHA256=y
741	CONFIG_IMA_WRITE_POLICY=y	741	CONFIG_IMA_WRITE_POLICY=y
742	CONFIG_IMA_APPRAISE=y	742	CONFIG_IMA_APPRAISE=y
743	CONFIG_LSM="yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor"
744	CONFIG_BUG_ON_DATA_CORRUPTION=y	743	CONFIG_BUG_ON_DATA_CORRUPTION=y
745	CONFIG_CRYPTO_USER=m	744	CONFIG_CRYPTO_USER=m
746	# CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set	745	# CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set

arch/s390/configs/defconfig+0−1

@@ -725,7 +725,6 @@ CONFIG_IMA=y · 724 unmodified lines
725	CONFIG_IMA_DEFAULT_HASH_SHA256=y	725	CONFIG_IMA_DEFAULT_HASH_SHA256=y
726	CONFIG_IMA_WRITE_POLICY=y	726	CONFIG_IMA_WRITE_POLICY=y
727	CONFIG_IMA_APPRAISE=y	727	CONFIG_IMA_APPRAISE=y
728	CONFIG_LSM="yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor"
729	CONFIG_BUG_ON_DATA_CORRUPTION=y	728	CONFIG_BUG_ON_DATA_CORRUPTION=y
730	CONFIG_CRYPTO_FIPS=y	729	CONFIG_CRYPTO_FIPS=y
731	CONFIG_CRYPTO_USER=m	730	CONFIG_CRYPTO_USER=m

arch/s390/configs/zfcpdump_defconfig+0−1

@@ -62,7 +62,6 @@ CONFIG_ZFCP=y · 61 unmodified lines
62	# CONFIG_INOTIFY_USER is not set	62	# CONFIG_INOTIFY_USER is not set
63	# CONFIG_MISC_FILESYSTEMS is not set	63	# CONFIG_MISC_FILESYSTEMS is not set
64	# CONFIG_NETWORK_FILESYSTEMS is not set	64	# CONFIG_NETWORK_FILESYSTEMS is not set
65	CONFIG_LSM="yama,loadpin,safesetid,integrity"
66	# CONFIG_ZLIB_DFLTCC is not set	65	# CONFIG_ZLIB_DFLTCC is not set
67	CONFIG_XZ_DEC_MICROLZMA=y	66	CONFIG_XZ_DEC_MICROLZMA=y
68	CONFIG_PRINTK_TIME=y	67	CONFIG_PRINTK_TIME=y

arch/s390/include/asm/bitops.h+5−1

 	unsigned long mask;
 	int cc;
-	if (__builtin_constant_p(nr)) {
+	/*
+	 * With CONFIG_PROFILE_ALL_BRANCHES enabled gcc fails to
+	 * handle __builtin_constant_p() in some cases.
+	 */
+	if (!IS_ENABLED(CONFIG_PROFILE_ALL_BRANCHES) && __builtin_constant_p(nr)) {
 		addr = (const volatile unsigned char *)ptr;
 		addr += (nr ^ (BITS_PER_LONG - BITS_PER_BYTE)) / BITS_PER_BYTE;
 		mask = 1UL << (nr & (BITS_PER_BYTE - 1));

arch/s390/include/asm/gmap.h+6−14

 /**
  * struct gmap_struct - guest address space
  * @list: list head for the mm->context gmap list
- * @crst_list: list of all crst tables used in the guest address space
  * @mm: pointer to the parent mm_struct
  * @guest_to_host: radix tree with guest to host address translation
  * @host_to_guest: radix tree with pointer to segment table entries
  * @guest_handle: protected virtual machine handle for the ultravisor
  * @host_to_rmap: radix tree with gmap_rmap lists
  * @children: list of shadow gmap structures
- * @pt_list: list of all page tables used in the shadow guest address space
  * @shadow_lock: spinlock to protect the shadow gmap list
  * @parent: pointer to the parent gmap for shadow guest address spaces
  * @orig_asce: ASCE for which the shadow page table has been created
  */
 struct gmap {
 	struct list_head list;
-	struct list_head crst_list;
 	struct mm_struct *mm;
 	struct radix_tree_root guest_to_host;
 	struct radix_tree_root host_to_guest;
 	/* Additional data for shadow guest address spaces */
 	struct radix_tree_root host_to_rmap;
 	struct list_head children;
-	struct list_head pt_list;
 	spinlock_t shadow_lock;
 	struct gmap *parent;
 	unsigned long orig_asce;
 void gmap_remove(struct gmap *gmap);
 struct gmap *gmap_get(struct gmap *gmap);
 void gmap_put(struct gmap *gmap);
+void gmap_free(struct gmap *gmap);
+struct gmap *gmap_alloc(unsigned long limit);
 int gmap_map_segment(struct gmap *gmap, unsigned long from,
 		     unsigned long to, unsigned long len);
 int gmap_unmap_segment(struct gmap *gmap, unsigned long to, unsigned long len);
 unsigned long __gmap_translate(struct gmap *, unsigned long gaddr);
-unsigned long gmap_translate(struct gmap *, unsigned long gaddr);
 int __gmap_link(struct gmap *gmap, unsigned long gaddr, unsigned long vmaddr);
-int gmap_fault(struct gmap *, unsigned long gaddr, unsigned int fault_flags);
 void gmap_discard(struct gmap *, unsigned long from, unsigned long to);
 void __gmap_zap(struct gmap *, unsigned long gaddr);
 void gmap_unlink(struct mm_struct *, unsigned long *table, unsigned long vmaddr);
 int gmap_read_table(struct gmap *gmap, unsigned long gaddr, unsigned long *val);
-struct gmap *gmap_shadow(struct gmap *parent, unsigned long asce,
+void gmap_unshadow(struct gmap *sg);
-			 int edat_level);
-int gmap_shadow_valid(struct gmap *sg, unsigned long asce, int edat_level);
 int gmap_shadow_r2t(struct gmap *sg, unsigned long saddr, unsigned long r2t,
 		    int fake);
 int gmap_shadow_r3t(struct gmap *sg, unsigned long saddr, unsigned long r3t,
 		    int fake);
 int gmap_shadow_pgt(struct gmap *sg, unsigned long saddr, unsigned long pgt,
 		    int fake);
-int gmap_shadow_pgt_lookup(struct gmap *sg, unsigned long saddr,
-			   unsigned long *pgt, int *dat_protection, int *fake);
 int gmap_shadow_page(struct gmap *sg, unsigned long saddr, pte_t pte);
 void gmap_register_pte_notifier(struct gmap_notifier *);
 void gmap_unregister_pte_notifier(struct gmap_notifier *);
-int gmap_mprotect_notify(struct gmap *, unsigned long start,
+int gmap_protect_one(struct gmap *gmap, unsigned long gaddr, int prot, unsigned long bits);
-			 unsigned long len, int prot);
 void gmap_sync_dirty_log_pmd(struct gmap *gmap, unsigned long dirty_bitmap[4],
 			     unsigned long gaddr, unsigned long vmaddr);
 int s390_disable_cow_sharing(void);
-void s390_unlist_old_asce(struct gmap *gmap);
 int s390_replace_asce(struct gmap *gmap);
 void s390_uv_destroy_pfns(unsigned long count, unsigned long *pfns);
 int __s390_uv_destroy_range(struct mm_struct *mm, unsigned long start,
 			    unsigned long end, bool interruptible);
+int kvm_s390_wiggle_split_folio(struct mm_struct *mm, struct folio *folio, bool split);
+unsigned long *gmap_table_walk(struct gmap *gmap, unsigned long gaddr, int level);
 /**
  * s390_uv_destroy_range - Destroy a range of pages in the given mm.

arch/s390/include/asm/kvm_host.h+5−1

 #define KVM_S390_ESCA_CPU_SLOTS 248
 #define KVM_MAX_VCPUS 255
+#define KVM_INTERNAL_MEM_SLOTS 1
 /*
  * These seem to be used for allocating ->chip in the routing table, which we
  * don't use. 1 is as small as we can get to reduce the needed memory. If we
 	u8 reserved928[0x1000 - 0x928];			/* 0x0928 */
 };
+struct vsie_page;
 struct kvm_s390_vsie {
 	struct mutex mutex;
 	struct radix_tree_root addr_to_page;
 	int page_count;
 	int next;
-	struct page *pages[KVM_MAX_VCPUS];
+	struct vsie_page *pages[KVM_MAX_VCPUS];
 };
 struct kvm_s390_gisa_iam {

arch/s390/include/asm/pgtable.h+18−3

@@ -420,9 +420,10 @@ void setup_protection_map(void); · 419 unmodified lines
420	#define PGSTE_HC_BIT 0x0020000000000000UL	420	#define PGSTE_HC_BIT 0x0020000000000000UL
421	#define PGSTE_GR_BIT 0x0004000000000000UL	421	#define PGSTE_GR_BIT 0x0004000000000000UL
422	#define PGSTE_GC_BIT 0x0002000000000000UL	422	#define PGSTE_GC_BIT 0x0002000000000000UL
423	#define PGSTE_UC_BIT 0x0000800000000000UL /* user dirty (migration) */	423	#define PGSTE_ST2_MASK 0x0000ffff00000000UL
424	#define PGSTE_IN_BIT 0x0000400000000000UL /* IPTE notify bit */	424	#define PGSTE_UC_BIT 0x0000000000008000UL /* user dirty (migration) */
425	#define PGSTE_VSIE_BIT 0x0000200000000000UL /* ref'd in a shadow table */	425	#define PGSTE_IN_BIT 0x0000000000004000UL /* IPTE notify bit */
		426	#define PGSTE_VSIE_BIT 0x0000000000002000UL /* ref'd in a shadow table */
426		427
427	/* Guest Page State used for virtualization */	428	/* Guest Page State used for virtualization */
428	#define _PGSTE_GPS_ZERO 0x0000000080000000UL	429	#define _PGSTE_GPS_ZERO 0x0000000080000000UL
@@ -2007,4 +2008,18 @@ extern void s390_reset_cmma(struct mm_struct *mm); · 1578 unmodified lines
2007	#define pmd_pgtable(pmd) \	2008	#define pmd_pgtable(pmd) \
2008	((pgtable_t)__va(pmd_val(pmd) & -sizeof(pte_t)*PTRS_PER_PTE))	2009	((pgtable_t)__va(pmd_val(pmd) & -sizeof(pte_t)*PTRS_PER_PTE))
2009		2010
		2011	static inline unsigned long gmap_pgste_get_pgt_addr(unsigned long *pgt)
		2012	{
		2013	unsigned long *pgstes, res;
		2014
		2015	pgstes = pgt + _PAGE_ENTRIES;
		2016
		2017	res = (pgstes[0] & PGSTE_ST2_MASK) << 16;
		2018	res \|= pgstes[1] & PGSTE_ST2_MASK;
		2019	res \|= (pgstes[2] & PGSTE_ST2_MASK) >> 16;
		2020	res \|= (pgstes[3] & PGSTE_ST2_MASK) >> 32;
		2021
		2022	return res;
		2023	}
		2024
2010	#endif /* _S390_PAGE_H */	2025	#endif /* _S390_PAGE_H */

arch/s390/include/asm/uv.h+3−3

 }
 int uv_pin_shared(unsigned long paddr);
-int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb);
-int gmap_destroy_page(struct gmap *gmap, unsigned long gaddr);
 int uv_destroy_folio(struct folio *folio);
 int uv_destroy_pte(pte_t pte);
 int uv_convert_from_secure_pte(pte_t pte);
-int gmap_convert_to_secure(struct gmap *gmap, unsigned long gaddr);
+int make_folio_secure(struct folio *folio, struct uv_cb_header *uvcb);
+int uv_convert_from_secure(unsigned long paddr);
+int uv_convert_from_secure_folio(struct folio *folio);
 void setup_uv(void);

arch/s390/kernel/uv.c+29−263

@@ -19,19 +19,6 @@ · 18 unmodified lines
19	#include <asm/sections.h>	19	#include <asm/sections.h>
20	#include <asm/uv.h>	20	#include <asm/uv.h>
21		21
22	#if !IS_ENABLED(CONFIG_KVM)
23	unsigned long __gmap_translate(struct gmap *gmap, unsigned long gaddr)
24	{
25	return 0;
26	}
27
28	int gmap_fault(struct gmap *gmap, unsigned long gaddr,
29	unsigned int fault_flags)
30	{
31	return 0;
32	}
33	#endif
34
35	/* the bootdata_preserved fields come from ones in arch/s390/boot/uv.c */	22	/* the bootdata_preserved fields come from ones in arch/s390/boot/uv.c */
36	int __bootdata_preserved(prot_virt_guest);	23	int __bootdata_preserved(prot_virt_guest);
37	EXPORT_SYMBOL(prot_virt_guest);	24	EXPORT_SYMBOL(prot_virt_guest);
@@ -159,6 +146,7 @@ int uv_destroy_folio(struct folio *folio) · 121 unmodified lines
159	folio_put(folio);	146	folio_put(folio);
160	return rc;	147	return rc;
161	}	148	}
		149	EXPORT_SYMBOL(uv_destroy_folio);
162		150
163	/*	151	/*
164	* The present PTE still indirectly holds a folio reference through the mapping.	152	* The present PTE still indirectly holds a folio reference through the mapping.
@@ -175,7 +163,7 @@ int uv_destroy_pte(pte_t pte) · 10 unmodified lines
175	*	163	*
176	* @paddr: Absolute host address of page to be exported	164	* @paddr: Absolute host address of page to be exported
177	*/	165	*/
178	static int uv_convert_from_secure(unsigned long paddr)	166	int uv_convert_from_secure(unsigned long paddr)
179	{	167	{
180	struct uv_cb_cfs uvcb = {	168	struct uv_cb_cfs uvcb = {
181	.header.cmd = UVC_CMD_CONV_FROM_SEC_STOR,	169	.header.cmd = UVC_CMD_CONV_FROM_SEC_STOR,
@@ -187,11 +175,12 @@ static int uv_convert_from_secure(unsigned long paddr) · 5 unmodified lines
187	return -EINVAL;	175	return -EINVAL;
188	return 0;	176	return 0;
189	}	177	}
		178	EXPORT_SYMBOL_GPL(uv_convert_from_secure);
190		179
191	/*	180	/*
192	* The caller must already hold a reference to the folio.	181	* The caller must already hold a reference to the folio.
193	*/	182	*/
194	static int uv_convert_from_secure_folio(struct folio *folio)	183	int uv_convert_from_secure_folio(struct folio *folio)
195	{	184	{
196	int rc;	185	int rc;
197		186
@@ -206,6 +195,7 @@ static int uv_convert_from_secure_folio(struct folio *folio) · 8 unmodified lines
206	folio_put(folio);	195	folio_put(folio);
207	return rc;	196	return rc;
208	}	197	}
		198	EXPORT_SYMBOL_GPL(uv_convert_from_secure_folio);
209		199
210	/*	200	/*
211	* The present PTE still indirectly holds a folio reference through the mapping.	201	* The present PTE still indirectly holds a folio reference through the mapping.
@@ -237,13 +227,33 @@ static int expected_folio_refs(struct folio *folio) · 25 unmodified lines
237	return res;	227	return res;
238	}	228	}
239		229
240	static int make_folio_secure(struct folio folio, struct uv_cb_header uvcb)	230	/**
		231	* make_folio_secure() - make a folio secure
		232	* @folio: the folio to make secure
		233	* @uvcb: the uvcb that describes the UVC to be used
		234	*
		235	* The folio @folio will be made secure if possible, @uvcb will be passed
		236	* as-is to the UVC.
		237	*
		238	* Return: 0 on success;
		239	* -EBUSY if the folio is in writeback or has too many references;
		240	* -E2BIG if the folio is large;
		241	* -EAGAIN if the UVC needs to be attempted again;
		242	* -ENXIO if the address is not mapped;
		243	* -EINVAL if the UVC failed for other reasons.
		244	*
		245	* Context: The caller must hold exactly one extra reference on the folio
		246	* (it's the same logic as split_folio())
		247	*/
		248	int make_folio_secure(struct folio folio, struct uv_cb_header uvcb)
241	{	249	{
242	int expected, cc = 0;	250	int expected, cc = 0;
243		251
		252	if (folio_test_large(folio))
		253	return -E2BIG;
244	if (folio_test_writeback(folio))	254	if (folio_test_writeback(folio))
245	return -EAGAIN;	255	return -EBUSY;
246	expected = expected_folio_refs(folio);	256	expected = expected_folio_refs(folio) + 1;
247	if (!folio_ref_freeze(folio, expected))	257	if (!folio_ref_freeze(folio, expected))
248	return -EBUSY;	258	return -EBUSY;
249	set_bit(PG_arch_1, &folio->flags);	259	set_bit(PG_arch_1, &folio->flags);
@@ -267,251 +277,7 @@ static int make_folio_secure(struct folio folio, struct uv_cb_header uvcb) · 17 unmodified lines
267	return -EAGAIN;	277	return -EAGAIN;
268	return uvcb->rc == 0x10a ? -ENXIO : -EINVAL;	278	return uvcb->rc == 0x10a ? -ENXIO : -EINVAL;
269	}	279	}
270		280	EXPORT_SYMBOL_GPL(make_folio_secure);
271	/**
272	* should_export_before_import - Determine whether an export is needed
273	* before an import-like operation
274	* @uvcb: the Ultravisor control block of the UVC to be performed
275	* @mm: the mm of the process
276	*
277	* Returns whether an export is needed before every import-like operation.
278	* This is needed for shared pages, which don't trigger a secure storage
279	* exception when accessed from a different guest.
280	*
281	* Although considered as one, the Unpin Page UVC is not an actual import,
282	* so it is not affected.
283	*
284	* No export is needed also when there is only one protected VM, because the
285	* page cannot belong to the wrong VM in that case (there is no "other VM"
286	* it can belong to).
287	*
288	* Return: true if an export is needed before every import, otherwise false.
289	*/
290	static bool should_export_before_import(struct uv_cb_header uvcb, struct mm_struct mm)
291	{
292	/*
293	* The misc feature indicates, among other things, that importing a
294	* shared page from a different protected VM will automatically also
295	* transfer its ownership.
296	*/
297	if (uv_has_feature(BIT_UV_FEAT_MISC))
298	return false;
299	if (uvcb->cmd == UVC_CMD_UNPIN_PAGE_SHARED)
300	return false;
301	return atomic_read(&mm->context.protected_count) > 1;
302	}
303
304	/*
305	* Drain LRU caches: the local one on first invocation and the ones of all
306	* CPUs on successive invocations. Returns "true" on the first invocation.
307	*/
308	static bool drain_lru(bool *drain_lru_called)
309	{
310	/*
311	* If we have tried a local drain and the folio refcount
312	* still does not match our expected safe value, try with a
313	* system wide drain. This is needed if the pagevecs holding
314	* the page are on a different CPU.
315	*/
316	if (*drain_lru_called) {
317	lru_add_drain_all();
318	/* We give up here, don't retry immediately. */
319	return false;
320	}
321	/*
322	* We are here if the folio refcount does not match the
323	* expected safe value. The main culprits are usually
324	* pagevecs. With lru_add_drain() we drain the pagevecs
325	* on the local CPU so that hopefully the refcount will
326	* reach the expected safe value.
327	*/
328	lru_add_drain();
329	*drain_lru_called = true;
330	/* The caller should try again immediately */
331	return true;
332	}
333
334	/*
335	* Requests the Ultravisor to make a page accessible to a guest.
336	* If it's brought in the first time, it will be cleared. If
337	* it has been exported before, it will be decrypted and integrity
338	* checked.
339	*/
340	int gmap_make_secure(struct gmap gmap, unsigned long gaddr, void uvcb)
341	{
342	struct vm_area_struct *vma;
343	bool drain_lru_called = false;
344	spinlock_t *ptelock;
345	unsigned long uaddr;
346	struct folio *folio;
347	pte_t *ptep;
348	int rc;
349
350	again:
351	rc = -EFAULT;
352	mmap_read_lock(gmap->mm);
353
354	uaddr = __gmap_translate(gmap, gaddr);
355	if (IS_ERR_VALUE(uaddr))
356	goto out;
357	vma = vma_lookup(gmap->mm, uaddr);
358	if (!vma)
359	goto out;
360	/*
361	* Secure pages cannot be huge and userspace should not combine both.
362	* In case userspace does it anyway this will result in an -EFAULT for
363	* the unpack. The guest is thus never reaching secure mode. If
364	* userspace is playing dirty tricky with mapping huge pages later
365	* on this will result in a segmentation fault.
366	*/
367	if (is_vm_hugetlb_page(vma))
368	goto out;
369
370	rc = -ENXIO;
371	ptep = get_locked_pte(gmap->mm, uaddr, &ptelock);
372	if (!ptep)
373	goto out;
374	if (pte_present(ptep) && !(pte_val(ptep) & _PAGE_INVALID) && pte_write(*ptep)) {
375	folio = page_folio(pte_page(*ptep));
376	rc = -EAGAIN;
377	if (folio_test_large(folio)) {
378	rc = -E2BIG;
379	} else if (folio_trylock(folio)) {
380	if (should_export_before_import(uvcb, gmap->mm))
381	uv_convert_from_secure(PFN_PHYS(folio_pfn(folio)));
382	rc = make_folio_secure(folio, uvcb);
383	folio_unlock(folio);
384	}
385
386	/*
387	* Once we drop the PTL, the folio may get unmapped and
388	* freed immediately. We need a temporary reference.
389	*/
390	if (rc == -EAGAIN \|\| rc == -E2BIG)
391	folio_get(folio);
392	}
393	pte_unmap_unlock(ptep, ptelock);
394	out:
395	mmap_read_unlock(gmap->mm);
396
397	switch (rc) {
398	case -E2BIG:
399	folio_lock(folio);
400	rc = split_folio(folio);
401	folio_unlock(folio);
402	folio_put(folio);
403
404	switch (rc) {
405	case 0:
406	/* Splitting succeeded, try again immediately. */
407	goto again;
408	case -EAGAIN:
409	/* Additional folio references. */
410	if (drain_lru(&drain_lru_called))
411	goto again;
412	return -EAGAIN;
413	case -EBUSY:
414	/* Unexpected race. */
415	return -EAGAIN;
416	}
417	WARN_ON_ONCE(1);
418	return -ENXIO;
419	case -EAGAIN:
420	/*
421	* If we are here because the UVC returned busy or partial
422	* completion, this is just a useless check, but it is safe.
423	*/
424	folio_wait_writeback(folio);
425	folio_put(folio);
426	return -EAGAIN;
427	case -EBUSY:
428	/* Additional folio references. */
429	if (drain_lru(&drain_lru_called))
430	goto again;
431	return -EAGAIN;
432	case -ENXIO:
433	if (gmap_fault(gmap, gaddr, FAULT_FLAG_WRITE))
434	return -EFAULT;
435	return -EAGAIN;
436	}
437	return rc;
438	}
439	EXPORT_SYMBOL_GPL(gmap_make_secure);
440
441	int gmap_convert_to_secure(struct gmap *gmap, unsigned long gaddr)
442	{
443	struct uv_cb_cts uvcb = {
444	.header.cmd = UVC_CMD_CONV_TO_SEC_STOR,
445	.header.len = sizeof(uvcb),
446	.guest_handle = gmap->guest_handle,
447	.gaddr = gaddr,
448	};
449
450	return gmap_make_secure(gmap, gaddr, &uvcb);
451	}
452	EXPORT_SYMBOL_GPL(gmap_convert_to_secure);
453
454	/**
455	* gmap_destroy_page - Destroy a guest page.
456	* @gmap: the gmap of the guest
457	* @gaddr: the guest address to destroy
458	*
459	* An attempt will be made to destroy the given guest page. If the attempt
460	* fails, an attempt is made to export the page. If both attempts fail, an
461	* appropriate error is returned.
462	*/
463	int gmap_destroy_page(struct gmap *gmap, unsigned long gaddr)
464	{
465	struct vm_area_struct *vma;
466	struct folio_walk fw;
467	unsigned long uaddr;
468	struct folio *folio;
469	int rc;
470
471	rc = -EFAULT;
472	mmap_read_lock(gmap->mm);
473
474	uaddr = __gmap_translate(gmap, gaddr);
475	if (IS_ERR_VALUE(uaddr))
476	goto out;
477	vma = vma_lookup(gmap->mm, uaddr);
478	if (!vma)
479	goto out;
480	/*
481	* Huge pages should not be able to become secure
482	*/
483	if (is_vm_hugetlb_page(vma))
484	goto out;
485
486	rc = 0;
487	folio = folio_walk_start(&fw, vma, uaddr, 0);
488	if (!folio)
489	goto out;
490	/*
491	* See gmap_make_secure(): large folios cannot be secure. Small
492	* folio implies FW_LEVEL_PTE.
493	*/
494	if (folio_test_large(folio) \|\| !pte_write(fw.pte))
495	goto out_walk_end;
496	rc = uv_destroy_folio(folio);
497	/*
498	* Fault handlers can race; it is possible that two CPUs will fault
499	* on the same secure page. One CPU can destroy the page, reboot,
500	* re-enter secure mode and import it, while the second CPU was
501	* stuck at the beginning of the handler. At some point the second
502	* CPU will be able to progress, and it will not be able to destroy
503	* the page. In that case we do not want to terminate the process,
504	* we instead try to export the page.
505	*/
506	if (rc)
507	rc = uv_convert_from_secure_folio(folio);
508	out_walk_end:
509	folio_walk_end(&fw, vma);
510	out:
511	mmap_read_unlock(gmap->mm);
512	return rc;
513	}
514	EXPORT_SYMBOL_GPL(gmap_destroy_page);
515		281
516	/*	282	/*
517	* To be called with the folio locked or with an extra reference! This will	283	* To be called with the folio locked or with an extra reference! This will

arch/s390/kvm/Makefile+1−1

@@ -8,7 +8,7 @@ include $(srctree)/virt/kvm/Makefile.kvm · 7 unmodified lines
8	ccflags-y := -Ivirt/kvm -Iarch/s390/kvm	8	ccflags-y := -Ivirt/kvm -Iarch/s390/kvm
9		9
10	kvm-y += kvm-s390.o intercept.o interrupt.o priv.o sigp.o	10	kvm-y += kvm-s390.o intercept.o interrupt.o priv.o sigp.o
11	kvm-y += diag.o gaccess.o guestdbg.o vsie.o pv.o	11	kvm-y += diag.o gaccess.o guestdbg.o vsie.o pv.o gmap.o gmap-vsie.o
12		12
13	kvm-$(CONFIG_VFIO_PCI_ZDEV_KVM) += pci.o	13	kvm-$(CONFIG_VFIO_PCI_ZDEV_KVM) += pci.o
14	obj-$(CONFIG_KVM) += kvm.o	14	obj-$(CONFIG_KVM) += kvm.o

arch/s390/kvm/gaccess.c+43−1

@@ -16,6 +16,7 @@ · 15 unmodified lines
16	#include <asm/gmap.h>	16	#include <asm/gmap.h>
17	#include <asm/dat-bits.h>	17	#include <asm/dat-bits.h>
18	#include "kvm-s390.h"	18	#include "kvm-s390.h"
		19	#include "gmap.h"
19	#include "gaccess.h"	20	#include "gaccess.h"
20		21
21	/*	22	/*
@@ -1392,6 +1393,44 @@ shadow_pgt: · 1370 unmodified lines
1392	return 0;	1393	return 0;
1393	}	1394	}
1394		1395
		1396	/**
		1397	* shadow_pgt_lookup() - find a shadow page table
		1398	* @sg: pointer to the shadow guest address space structure
		1399	* @saddr: the address in the shadow aguest address space
		1400	* @pgt: parent gmap address of the page table to get shadowed
		1401	* @dat_protection: if the pgtable is marked as protected by dat
		1402	* @fake: pgt references contiguous guest memory block, not a pgtable
		1403	*
		1404	* Returns 0 if the shadow page table was found and -EAGAIN if the page
		1405	* table was not found.
		1406	*
		1407	* Called with sg->mm->mmap_lock in read.
		1408	*/
		1409	static int shadow_pgt_lookup(struct gmap sg, unsigned long saddr, unsigned long pgt,
		1410	int dat_protection, int fake)
		1411	{
		1412	unsigned long pt_index;
		1413	unsigned long *table;
		1414	struct page *page;
		1415	int rc;
		1416
		1417	spin_lock(&sg->guest_table_lock);
		1418	table = gmap_table_walk(sg, saddr, 1); /* get segment pointer */
		1419	if (table && !(*table & _SEGMENT_ENTRY_INVALID)) {
		1420	/* Shadow page tables are full pages (pte+pgste) */
		1421	page = pfn_to_page(*table >> PAGE_SHIFT);
		1422	pt_index = gmap_pgste_get_pgt_addr(page_to_virt(page));
		1423	*pgt = pt_index & ~GMAP_SHADOW_FAKE_TABLE;
		1424	dat_protection = !!(table & _SEGMENT_ENTRY_PROTECT);
		1425	*fake = !!(pt_index & GMAP_SHADOW_FAKE_TABLE);
		1426	rc = 0;
		1427	} else {
		1428	rc = -EAGAIN;
		1429	}
		1430	spin_unlock(&sg->guest_table_lock);
		1431	return rc;
		1432	}
		1433
1395	/**	1434	/**
1396	* kvm_s390_shadow_fault - handle fault on a shadow page table	1435	* kvm_s390_shadow_fault - handle fault on a shadow page table
1397	* @vcpu: virtual cpu	1436	* @vcpu: virtual cpu
@@ -1415,6 +1454,9 @@ int kvm_s390_shadow_fault(struct kvm_vcpu vcpu, struct gmap sg, · 17 unmodified lines
1415	int dat_protection, fake;	1454	int dat_protection, fake;
1416	int rc;	1455	int rc;
1417		1456
		1457	if (KVM_BUG_ON(!gmap_is_shadow(sg), vcpu->kvm))
		1458	return -EFAULT;
		1459
1418	mmap_read_lock(sg->mm);	1460	mmap_read_lock(sg->mm);
1419	/*	1461	/*
1420	* We don't want any guest-2 tables to change - so the parent	1462	* We don't want any guest-2 tables to change - so the parent
@@ -1423,7 +1465,7 @@ int kvm_s390_shadow_fault(struct kvm_vcpu vcpu, struct gmap sg, · 2 unmodified lines
1423	*/	1465	*/
1424	ipte_lock(vcpu->kvm);	1466	ipte_lock(vcpu->kvm);
1425		1467
1426	rc = gmap_shadow_pgt_lookup(sg, saddr, &pgt, &dat_protection, &fake);	1468	rc = shadow_pgt_lookup(sg, saddr, &pgt, &dat_protection, &fake);
1427	if (rc)	1469	if (rc)
1428	rc = kvm_s390_shadow_tables(sg, saddr, &pgt, &dat_protection,	1470	rc = kvm_s390_shadow_tables(sg, saddr, &pgt, &dat_protection,
1429	&fake);	1471	&fake);

arch/s390/kvm/gmap-vsie.c+142−0

@@ -0,0 +1,142 @@
	1	// SPDX-License-Identifier: GPL-2.0
	2	/*
	3	* Guest memory management for KVM/s390 nested VMs.
	4	*
	5	* Copyright IBM Corp. 2008, 2020, 2024
	6	*
	7	* Author(s): Claudio Imbrenda <imbrenda@linux.ibm.com>
	8	* Martin Schwidefsky <schwidefsky@de.ibm.com>
	9	* David Hildenbrand <david@redhat.com>
	10	* Janosch Frank <frankja@linux.vnet.ibm.com>
	11	*/
	12
	13	#include <linux/compiler.h>
	14	#include <linux/kvm.h>
	15	#include <linux/kvm_host.h>
	16	#include <linux/pgtable.h>
	17	#include <linux/pagemap.h>
	18	#include <linux/mman.h>
	19
	20	#include <asm/lowcore.h>
	21	#include <asm/gmap.h>
	22	#include <asm/uv.h>
	23
	24	#include "kvm-s390.h"
	25	#include "gmap.h"
	26
	27	/**
	28	* gmap_find_shadow - find a specific asce in the list of shadow tables
	29	* @parent: pointer to the parent gmap
	30	* @asce: ASCE for which the shadow table is created
	31	* @edat_level: edat level to be used for the shadow translation
	32	*
	33	* Returns the pointer to a gmap if a shadow table with the given asce is
	34	* already available, ERR_PTR(-EAGAIN) if another one is just being created,
	35	* otherwise NULL
	36	*
	37	* Context: Called with parent->shadow_lock held
	38	*/
	39	static struct gmap gmap_find_shadow(struct gmap parent, unsigned long asce, int edat_level)
	40	{
	41	struct gmap *sg;
	42
	43	lockdep_assert_held(&parent->shadow_lock);
	44	list_for_each_entry(sg, &parent->children, list) {
	45	if (!gmap_shadow_valid(sg, asce, edat_level))
	46	continue;
	47	if (!sg->initialized)
	48	return ERR_PTR(-EAGAIN);
	49	refcount_inc(&sg->ref_count);
	50	return sg;
	51	}
	52	return NULL;
	53	}
	54
	55	/**
	56	* gmap_shadow - create/find a shadow guest address space
	57	* @parent: pointer to the parent gmap
	58	* @asce: ASCE for which the shadow table is created
	59	* @edat_level: edat level to be used for the shadow translation
	60	*
	61	* The pages of the top level page table referred by the asce parameter
	62	* will be set to read-only and marked in the PGSTEs of the kvm process.
	63	* The shadow table will be removed automatically on any change to the
	64	* PTE mapping for the source table.
	65	*
	66	* Returns a guest address space structure, ERR_PTR(-ENOMEM) if out of memory,
	67	* ERR_PTR(-EAGAIN) if the caller has to retry and ERR_PTR(-EFAULT) if the
	68	* parent gmap table could not be protected.
	69	*/
	70	struct gmap gmap_shadow(struct gmap parent, unsigned long asce, int edat_level)
	71	{
	72	struct gmap sg, new;
	73	unsigned long limit;
	74	int rc;
	75
	76	if (KVM_BUG_ON(parent->mm->context.allow_gmap_hpage_1m, (struct kvm *)parent->private) \|\|
	77	KVM_BUG_ON(gmap_is_shadow(parent), (struct kvm *)parent->private))
	78	return ERR_PTR(-EFAULT);
	79	spin_lock(&parent->shadow_lock);
	80	sg = gmap_find_shadow(parent, asce, edat_level);
	81	spin_unlock(&parent->shadow_lock);
	82	if (sg)
	83	return sg;
	84	/* Create a new shadow gmap */
	85	limit = -1UL >> (33 - (((asce & _ASCE_TYPE_MASK) >> 2) * 11));
	86	if (asce & _ASCE_REAL_SPACE)
	87	limit = -1UL;
	88	new = gmap_alloc(limit);
	89	if (!new)
	90	return ERR_PTR(-ENOMEM);
	91	new->mm = parent->mm;
	92	new->parent = gmap_get(parent);
	93	new->private = parent->private;
	94	new->orig_asce = asce;
	95	new->edat_level = edat_level;
	96	new->initialized = false;
	97	spin_lock(&parent->shadow_lock);
	98	/* Recheck if another CPU created the same shadow */
	99	sg = gmap_find_shadow(parent, asce, edat_level);
	100	if (sg) {
	101	spin_unlock(&parent->shadow_lock);
	102	gmap_free(new);
	103	return sg;
	104	}
	105	if (asce & _ASCE_REAL_SPACE) {
	106	/* only allow one real-space gmap shadow */
	107	list_for_each_entry(sg, &parent->children, list) {
	108	if (sg->orig_asce & _ASCE_REAL_SPACE) {
	109	spin_lock(&sg->guest_table_lock);
	110	gmap_unshadow(sg);
	111	spin_unlock(&sg->guest_table_lock);
	112	list_del(&sg->list);
	113	gmap_put(sg);
	114	break;
	115	}
	116	}
	117	}
	118	refcount_set(&new->ref_count, 2);
	119	list_add(&new->list, &parent->children);
	120	if (asce & _ASCE_REAL_SPACE) {
	121	/* nothing to protect, return right away */
	122	new->initialized = true;
	123	spin_unlock(&parent->shadow_lock);
	124	return new;
	125	}
	126	spin_unlock(&parent->shadow_lock);
	127	/* protect after insertion, so it will get properly invalidated */
	128	mmap_read_lock(parent->mm);
	129	rc = __kvm_s390_mprotect_many(parent, asce & _ASCE_ORIGIN,
	130	((asce & _ASCE_TABLE_LENGTH) + 1),
	131	PROT_READ, GMAP_NOTIFY_SHADOW);
	132	mmap_read_unlock(parent->mm);
	133	spin_lock(&parent->shadow_lock);
	134	new->initialized = true;
	135	if (rc) {
	136	list_del(&new->list);
	137	gmap_free(new);
	138	new = ERR_PTR(rc);
	139	}
	140	spin_unlock(&parent->shadow_lock);
	141	return new;
	142	}

arch/s390/kvm/gmap.c+212−0

@@ -0,0 +1,212 @@
	1	// SPDX-License-Identifier: GPL-2.0
	2	/*
	3	* Guest memory management for KVM/s390
	4	*
	5	* Copyright IBM Corp. 2008, 2020, 2024
	6	*
	7	* Author(s): Claudio Imbrenda <imbrenda@linux.ibm.com>
	8	* Martin Schwidefsky <schwidefsky@de.ibm.com>
	9	* David Hildenbrand <david@redhat.com>
	10	* Janosch Frank <frankja@linux.vnet.ibm.com>
	11	*/
	12
	13	#include <linux/compiler.h>
	14	#include <linux/kvm.h>
	15	#include <linux/kvm_host.h>
	16	#include <linux/pgtable.h>
	17	#include <linux/pagemap.h>
	18
	19	#include <asm/lowcore.h>
	20	#include <asm/gmap.h>
	21	#include <asm/uv.h>
	22
	23	#include "gmap.h"
	24
	25	/**
	26	* should_export_before_import - Determine whether an export is needed
	27	* before an import-like operation
	28	* @uvcb: the Ultravisor control block of the UVC to be performed
	29	* @mm: the mm of the process
	30	*
	31	* Returns whether an export is needed before every import-like operation.
	32	* This is needed for shared pages, which don't trigger a secure storage
	33	* exception when accessed from a different guest.
	34	*
	35	* Although considered as one, the Unpin Page UVC is not an actual import,
	36	* so it is not affected.
	37	*
	38	* No export is needed also when there is only one protected VM, because the
	39	* page cannot belong to the wrong VM in that case (there is no "other VM"
	40	* it can belong to).
	41	*
	42	* Return: true if an export is needed before every import, otherwise false.
	43	*/
	44	static bool should_export_before_import(struct uv_cb_header uvcb, struct mm_struct mm)
	45	{
	46	/*
	47	* The misc feature indicates, among other things, that importing a
	48	* shared page from a different protected VM will automatically also
	49	* transfer its ownership.
	50	*/
	51	if (uv_has_feature(BIT_UV_FEAT_MISC))
	52	return false;
	53	if (uvcb->cmd == UVC_CMD_UNPIN_PAGE_SHARED)
	54	return false;
	55	return atomic_read(&mm->context.protected_count) > 1;
	56	}
	57
	58	static int __gmap_make_secure(struct gmap gmap, struct page page, void *uvcb)
	59	{
	60	struct folio *folio = page_folio(page);
	61	int rc;
	62
	63	/*
	64	* Secure pages cannot be huge and userspace should not combine both.
	65	* In case userspace does it anyway this will result in an -EFAULT for
	66	* the unpack. The guest is thus never reaching secure mode.
	67	* If userspace plays dirty tricks and decides to map huge pages at a
	68	* later point in time, it will receive a segmentation fault or
	69	* KVM_RUN will return -EFAULT.
	70	*/
	71	if (folio_test_hugetlb(folio))
	72	return -EFAULT;
	73	if (folio_test_large(folio)) {
	74	mmap_read_unlock(gmap->mm);
	75	rc = kvm_s390_wiggle_split_folio(gmap->mm, folio, true);
	76	mmap_read_lock(gmap->mm);
	77	if (rc)
	78	return rc;
	79	folio = page_folio(page);
	80	}
	81
	82	if (!folio_trylock(folio))
	83	return -EAGAIN;
	84	if (should_export_before_import(uvcb, gmap->mm))
	85	uv_convert_from_secure(folio_to_phys(folio));
	86	rc = make_folio_secure(folio, uvcb);
	87	folio_unlock(folio);
	88
	89	/*
	90	* In theory a race is possible and the folio might have become
	91	* large again before the folio_trylock() above. In that case, no
	92	* action is performed and -EAGAIN is returned; the callers will
	93	* have to try again later.
	94	* In most cases this implies running the VM again, getting the same
	95	* exception again, and make another attempt in this function.
	96	* This is expected to happen extremely rarely.
	97	*/
	98	if (rc == -E2BIG)
	99	return -EAGAIN;
	100	/* The folio has too many references, try to shake some off */
	101	if (rc == -EBUSY) {
	102	mmap_read_unlock(gmap->mm);
	103	kvm_s390_wiggle_split_folio(gmap->mm, folio, false);
	104	mmap_read_lock(gmap->mm);
	105	return -EAGAIN;
	106	}
	107
	108	return rc;
	109	}
	110
	111	/**
	112	* gmap_make_secure() - make one guest page secure
	113	* @gmap: the guest gmap
	114	* @gaddr: the guest address that needs to be made secure
	115	* @uvcb: the UVCB specifying which operation needs to be performed
	116	*
	117	* Context: needs to be called with kvm->srcu held.
	118	* Return: 0 on success, < 0 in case of error (see __gmap_make_secure()).
	119	*/
	120	int gmap_make_secure(struct gmap gmap, unsigned long gaddr, void uvcb)
	121	{
	122	struct kvm *kvm = gmap->private;
	123	struct page *page;
	124	int rc = 0;
	125
	126	lockdep_assert_held(&kvm->srcu);
	127
	128	page = gfn_to_page(kvm, gpa_to_gfn(gaddr));
	129	mmap_read_lock(gmap->mm);
	130	if (page)
	131	rc = __gmap_make_secure(gmap, page, uvcb);
	132	kvm_release_page_clean(page);
	133	mmap_read_unlock(gmap->mm);
	134
	135	return rc;
	136	}
	137
	138	int gmap_convert_to_secure(struct gmap *gmap, unsigned long gaddr)
	139	{
	140	struct uv_cb_cts uvcb = {
	141	.header.cmd = UVC_CMD_CONV_TO_SEC_STOR,
	142	.header.len = sizeof(uvcb),
	143	.guest_handle = gmap->guest_handle,
	144	.gaddr = gaddr,
	145	};
	146
	147	return gmap_make_secure(gmap, gaddr, &uvcb);
	148	}
	149
	150	/**
	151	* __gmap_destroy_page() - Destroy a guest page.
	152	* @gmap: the gmap of the guest
	153	* @page: the page to destroy
	154	*
	155	* An attempt will be made to destroy the given guest page. If the attempt
	156	* fails, an attempt is made to export the page. If both attempts fail, an
	157	* appropriate error is returned.
	158	*
	159	* Context: must be called holding the mm lock for gmap->mm
	160	*/
	161	static int __gmap_destroy_page(struct gmap gmap, struct page page)
	162	{
	163	struct folio *folio = page_folio(page);
	164	int rc;
	165
	166	/*
	167	* See gmap_make_secure(): large folios cannot be secure. Small
	168	* folio implies FW_LEVEL_PTE.
	169	*/
	170	if (folio_test_large(folio))
	171	return -EFAULT;
	172
	173	rc = uv_destroy_folio(folio);
	174	/*
	175	* Fault handlers can race; it is possible that two CPUs will fault
	176	* on the same secure page. One CPU can destroy the page, reboot,
	177	* re-enter secure mode and import it, while the second CPU was
	178	* stuck at the beginning of the handler. At some point the second
	179	* CPU will be able to progress, and it will not be able to destroy
	180	* the page. In that case we do not want to terminate the process,
	181	* we instead try to export the page.
	182	*/
	183	if (rc)
	184	rc = uv_convert_from_secure_folio(folio);
	185
	186	return rc;
	187	}
	188
	189	/**
	190	* gmap_destroy_page() - Destroy a guest page.
	191	* @gmap: the gmap of the guest
	192	* @gaddr: the guest address to destroy
	193	*
	194	* An attempt will be made to destroy the given guest page. If the attempt
	195	* fails, an attempt is made to export the page. If both attempts fail, an
	196	* appropriate error is returned.
	197	*
	198	* Context: may sleep.
	199	*/
	200	int gmap_destroy_page(struct gmap *gmap, unsigned long gaddr)
	201	{
	202	struct page *page;
	203	int rc = 0;
	204
	205	mmap_read_lock(gmap->mm);
	206	page = gfn_to_page(gmap->private, gpa_to_gfn(gaddr));
	207	if (page)
	208	rc = __gmap_destroy_page(gmap, page);
	209	kvm_release_page_clean(page);
	210	mmap_read_unlock(gmap->mm);
	211	return rc;
	212	}

arch/s390/kvm/gmap.h+39−0

@@ -0,0 +1,39 @@
	1	/* SPDX-License-Identifier: GPL-2.0 */
	2	/*
	3	* KVM guest address space mapping code
	4	*
	5	* Copyright IBM Corp. 2007, 2016, 2025
	6	* Author(s): Martin Schwidefsky <schwidefsky@de.ibm.com>
	7	* Claudio Imbrenda <imbrenda@linux.ibm.com>
	8	*/
	9
	10	#ifndef ARCH_KVM_S390_GMAP_H
	11	#define ARCH_KVM_S390_GMAP_H
	12
	13	#define GMAP_SHADOW_FAKE_TABLE 1ULL
	14
	15	int gmap_make_secure(struct gmap gmap, unsigned long gaddr, void uvcb);
	16	int gmap_convert_to_secure(struct gmap *gmap, unsigned long gaddr);
	17	int gmap_destroy_page(struct gmap *gmap, unsigned long gaddr);
	18	struct gmap gmap_shadow(struct gmap parent, unsigned long asce, int edat_level);
	19
	20	/**
	21	* gmap_shadow_valid - check if a shadow guest address space matches the
	22	* given properties and is still valid
	23	* @sg: pointer to the shadow guest address space structure
	24	* @asce: ASCE for which the shadow table is requested
	25	* @edat_level: edat level to be used for the shadow translation
	26	*
	27	* Returns 1 if the gmap shadow is still valid and matches the given
	28	* properties, the caller can continue using it. Returns 0 otherwise, the
	29	* caller has to request a new shadow gmap in this case.
	30	*
	31	*/
	32	static inline int gmap_shadow_valid(struct gmap *sg, unsigned long asce, int edat_level)
	33	{
	34	if (sg->removed)
	35	return 0;
	36	return sg->orig_asce == asce && sg->edat_level == edat_level;
	37	}
	38
	39	#endif

arch/s390/kvm/intercept.c+4−3

 #include "gaccess.h"
 #include "trace.h"
 #include "trace-s390.h"
+#include "gmap.h"
 u8 kvm_s390_get_ilen(struct kvm_vcpu *vcpu)
 {
 					      reg2, &srcaddr, GACC_FETCH, 0);
 	if (rc)
 		return kvm_s390_inject_prog_cond(vcpu, rc);
-	rc = gmap_fault(vcpu->arch.gmap, srcaddr, 0);
+	rc = kvm_s390_handle_dat_fault(vcpu, srcaddr, 0);
 	if (rc != 0)
 		return rc;
 					      reg1, &dstaddr, GACC_STORE, 0);
 	if (rc)
 		return kvm_s390_inject_prog_cond(vcpu, rc);
-	rc = gmap_fault(vcpu->arch.gmap, dstaddr, FAULT_FLAG_WRITE);
+	rc = kvm_s390_handle_dat_fault(vcpu, dstaddr, FOLL_WRITE);
 	if (rc != 0)
 		return rc;
 	 * If the unpin did not succeed, the guest will exit again for the UVC
 	 * and we will retry the unpin.
 	 */
-	if (rc == -EINVAL)
+	if (rc == -EINVAL || rc == -ENXIO)
 		return 0;
 	/*
 	 * If we got -EAGAIN here, we simply return it. It will eventually

arch/s390/kvm/interrupt.c+11−8

@@ -2893,7 +2893,8 @@ int kvm_set_routing_entry(struct kvm *kvm, · 2892 unmodified lines
2893	struct kvm_kernel_irq_routing_entry *e,	2893	struct kvm_kernel_irq_routing_entry *e,
2894	const struct kvm_irq_routing_entry *ue)	2894	const struct kvm_irq_routing_entry *ue)
2895	{	2895	{
2896	u64 uaddr;	2896	u64 uaddr_s, uaddr_i;
		2897	int idx;
2897		2898
2898	switch (ue->type) {	2899	switch (ue->type) {
2899	/* we store the userspace addresses instead of the guest addresses */	2900	/* we store the userspace addresses instead of the guest addresses */
@@ -2901,14 +2902,16 @@ int kvm_set_routing_entry(struct kvm *kvm, · 1 unmodified line
2901	if (kvm_is_ucontrol(kvm))	2902	if (kvm_is_ucontrol(kvm))
2902	return -EINVAL;	2903	return -EINVAL;
2903	e->set = set_adapter_int;	2904	e->set = set_adapter_int;
2904	uaddr = gmap_translate(kvm->arch.gmap, ue->u.adapter.summary_addr);	2905
2905	if (uaddr == -EFAULT)	2906	idx = srcu_read_lock(&kvm->srcu);
2906	return -EFAULT;	2907	uaddr_s = gpa_to_hva(kvm, ue->u.adapter.summary_addr);
2907	e->adapter.summary_addr = uaddr;	2908	uaddr_i = gpa_to_hva(kvm, ue->u.adapter.ind_addr);
2908	uaddr = gmap_translate(kvm->arch.gmap, ue->u.adapter.ind_addr);	2909	srcu_read_unlock(&kvm->srcu, idx);
2909	if (uaddr == -EFAULT)	2910
		2911	if (kvm_is_error_hva(uaddr_s) \|\| kvm_is_error_hva(uaddr_i))
2910	return -EFAULT;	2912	return -EFAULT;
2911	e->adapter.ind_addr = uaddr;	2913	e->adapter.summary_addr = uaddr_s;
		2914	e->adapter.ind_addr = uaddr_i;
2912	e->adapter.summary_offset = ue->u.adapter.summary_offset;	2915	e->adapter.summary_offset = ue->u.adapter.summary_offset;
2913	e->adapter.ind_offset = ue->u.adapter.ind_offset;	2916	e->adapter.ind_offset = ue->u.adapter.ind_offset;
2914	e->adapter.adapter_id = ue->u.adapter.adapter_id;	2917	e->adapter.adapter_id = ue->u.adapter.adapter_id;

arch/s390/kvm/kvm-s390.c+197−40

@@ -50,6 +50,7 @@ · 49 unmodified lines
50	#include "kvm-s390.h"	50	#include "kvm-s390.h"
51	#include "gaccess.h"	51	#include "gaccess.h"
52	#include "pci.h"	52	#include "pci.h"
		53	#include "gmap.h"
53		54
54	#define CREATE_TRACE_POINTS	55	#define CREATE_TRACE_POINTS
55	#include "trace.h"	56	#include "trace.h"
@@ -3428,8 +3429,20 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type) · 3372 unmodified lines
3428	VM_EVENT(kvm, 3, "vm created with type %lu", type);	3429	VM_EVENT(kvm, 3, "vm created with type %lu", type);
3429		3430
3430	if (type & KVM_VM_S390_UCONTROL) {	3431	if (type & KVM_VM_S390_UCONTROL) {
		3432	struct kvm_userspace_memory_region2 fake_memslot = {
		3433	.slot = KVM_S390_UCONTROL_MEMSLOT,
		3434	.guest_phys_addr = 0,
		3435	.userspace_addr = 0,
		3436	.memory_size = ALIGN_DOWN(TASK_SIZE, _SEGMENT_SIZE),
		3437	.flags = 0,
		3438	};
		3439
3431	kvm->arch.gmap = NULL;	3440	kvm->arch.gmap = NULL;
3432	kvm->arch.mem_limit = KVM_S390_NO_MEM_LIMIT;	3441	kvm->arch.mem_limit = KVM_S390_NO_MEM_LIMIT;
		3442	/* one flat fake memslot covering the whole address-space */
		3443	mutex_lock(&kvm->slots_lock);
		3444	KVM_BUG_ON(kvm_set_internal_memslot(kvm, &fake_memslot), kvm);
		3445	mutex_unlock(&kvm->slots_lock);
3433	} else {	3446	} else {
3434	if (sclp.hamax == U64_MAX)	3447	if (sclp.hamax == U64_MAX)
3435	kvm->arch.mem_limit = TASK_SIZE_MAX;	3448	kvm->arch.mem_limit = TASK_SIZE_MAX;
@@ -4498,6 +4511,75 @@ static bool ibs_enabled(struct kvm_vcpu *vcpu) · 1062 unmodified lines
4498	return kvm_s390_test_cpuflags(vcpu, CPUSTAT_IBS);	4511	return kvm_s390_test_cpuflags(vcpu, CPUSTAT_IBS);
4499	}	4512	}
4500		4513
		4514	static int __kvm_s390_fixup_fault_sync(struct gmap *gmap, gpa_t gaddr, unsigned int flags)
		4515	{
		4516	struct kvm *kvm = gmap->private;
		4517	gfn_t gfn = gpa_to_gfn(gaddr);
		4518	bool unlocked;
		4519	hva_t vmaddr;
		4520	gpa_t tmp;
		4521	int rc;
		4522
		4523	if (kvm_is_ucontrol(kvm)) {
		4524	tmp = __gmap_translate(gmap, gaddr);
		4525	gfn = gpa_to_gfn(tmp);
		4526	}
		4527
		4528	vmaddr = gfn_to_hva(kvm, gfn);
		4529	rc = fixup_user_fault(gmap->mm, vmaddr, FAULT_FLAG_WRITE, &unlocked);
		4530	if (!rc)
		4531	rc = __gmap_link(gmap, gaddr, vmaddr);
		4532	return rc;
		4533	}
		4534
		4535	/**
		4536	* __kvm_s390_mprotect_many() - Apply specified protection to guest pages
		4537	* @gmap: the gmap of the guest
		4538	* @gpa: the starting guest address
		4539	* @npages: how many pages to protect
		4540	* @prot: indicates access rights: PROT_NONE, PROT_READ or PROT_WRITE
		4541	* @bits: pgste notification bits to set
		4542	*
		4543	* Returns: 0 in case of success, < 0 in case of error - see gmap_protect_one()
		4544	*
		4545	* Context: kvm->srcu and gmap->mm need to be held in read mode
		4546	*/
		4547	int __kvm_s390_mprotect_many(struct gmap *gmap, gpa_t gpa, u8 npages, unsigned int prot,
		4548	unsigned long bits)
		4549	{
		4550	unsigned int fault_flag = (prot & PROT_WRITE) ? FAULT_FLAG_WRITE : 0;
		4551	gpa_t end = gpa + npages * PAGE_SIZE;
		4552	int rc;
		4553
		4554	for (; gpa < end; gpa = ALIGN(gpa + 1, rc)) {
		4555	rc = gmap_protect_one(gmap, gpa, prot, bits);
		4556	if (rc == -EAGAIN) {
		4557	__kvm_s390_fixup_fault_sync(gmap, gpa, fault_flag);
		4558	rc = gmap_protect_one(gmap, gpa, prot, bits);
		4559	}
		4560	if (rc < 0)
		4561	return rc;
		4562	}
		4563
		4564	return 0;
		4565	}
		4566
		4567	static int kvm_s390_mprotect_notify_prefix(struct kvm_vcpu *vcpu)
		4568	{
		4569	gpa_t gaddr = kvm_s390_get_prefix(vcpu);
		4570	int idx, rc;
		4571
		4572	idx = srcu_read_lock(&vcpu->kvm->srcu);
		4573	mmap_read_lock(vcpu->arch.gmap->mm);
		4574
		4575	rc = __kvm_s390_mprotect_many(vcpu->arch.gmap, gaddr, 2, PROT_WRITE, GMAP_NOTIFY_MPROT);
		4576
		4577	mmap_read_unlock(vcpu->arch.gmap->mm);
		4578	srcu_read_unlock(&vcpu->kvm->srcu, idx);
		4579
		4580	return rc;
		4581	}
		4582
4501	static int kvm_s390_handle_requests(struct kvm_vcpu *vcpu)	4583	static int kvm_s390_handle_requests(struct kvm_vcpu *vcpu)
4502	{	4584	{
4503	retry:	4585	retry:
@@ -4513,9 +4595,8 @@ retry: · 9 unmodified lines
4513	*/	4595	*/
4514	if (kvm_check_request(KVM_REQ_REFRESH_GUEST_PREFIX, vcpu)) {	4596	if (kvm_check_request(KVM_REQ_REFRESH_GUEST_PREFIX, vcpu)) {
4515	int rc;	4597	int rc;
4516	rc = gmap_mprotect_notify(vcpu->arch.gmap,	4598
4517	kvm_s390_get_prefix(vcpu),	4599	rc = kvm_s390_mprotect_notify_prefix(vcpu);
4518	PAGE_SIZE * 2, PROT_WRITE);
4519	if (rc) {	4600	if (rc) {
4520	kvm_make_request(KVM_REQ_REFRESH_GUEST_PREFIX, vcpu);	4601	kvm_make_request(KVM_REQ_REFRESH_GUEST_PREFIX, vcpu);
4521	return rc;	4602	return rc;
@@ -4766,11 +4847,111 @@ static int vcpu_post_run_addressing_exception(struct kvm_vcpu *vcpu) · 244 unmodified lines
4766	return kvm_s390_inject_prog_irq(vcpu, &pgm_info);	4847	return kvm_s390_inject_prog_irq(vcpu, &pgm_info);
4767	}	4848	}
4768		4849
		4850	static void kvm_s390_assert_primary_as(struct kvm_vcpu *vcpu)
		4851	{
		4852	KVM_BUG(current->thread.gmap_teid.as != PSW_BITS_AS_PRIMARY, vcpu->kvm,
		4853	"Unexpected program interrupt 0x%x, TEID 0x%016lx",
		4854	current->thread.gmap_int_code, current->thread.gmap_teid.val);
		4855	}
		4856
		4857	/*
		4858	* __kvm_s390_handle_dat_fault() - handle a dat fault for the gmap of a vcpu
		4859	* @vcpu: the vCPU whose gmap is to be fixed up
		4860	* @gfn: the guest frame number used for memslots (including fake memslots)
		4861	* @gaddr: the gmap address, does not have to match @gfn for ucontrol gmaps
		4862	* @flags: FOLL_* flags
		4863	*
		4864	* Return: 0 on success, < 0 in case of error.
		4865	* Context: The mm lock must not be held before calling. May sleep.
		4866	*/
		4867	int __kvm_s390_handle_dat_fault(struct kvm_vcpu *vcpu, gfn_t gfn, gpa_t gaddr, unsigned int flags)
		4868	{
		4869	struct kvm_memory_slot *slot;
		4870	unsigned int fault_flags;
		4871	bool writable, unlocked;
		4872	unsigned long vmaddr;
		4873	struct page *page;
		4874	kvm_pfn_t pfn;
		4875	int rc;
		4876
		4877	slot = kvm_vcpu_gfn_to_memslot(vcpu, gfn);
		4878	if (!slot \|\| slot->flags & KVM_MEMSLOT_INVALID)
		4879	return vcpu_post_run_addressing_exception(vcpu);
		4880
		4881	fault_flags = flags & FOLL_WRITE ? FAULT_FLAG_WRITE : 0;
		4882	if (vcpu->arch.gmap->pfault_enabled)
		4883	flags \|= FOLL_NOWAIT;
		4884	vmaddr = __gfn_to_hva_memslot(slot, gfn);
		4885
		4886	try_again:
		4887	pfn = __kvm_faultin_pfn(slot, gfn, flags, &writable, &page);
		4888
		4889	/* Access outside memory, inject addressing exception */
		4890	if (is_noslot_pfn(pfn))
		4891	return vcpu_post_run_addressing_exception(vcpu);
		4892	/* Signal pending: try again */
		4893	if (pfn == KVM_PFN_ERR_SIGPENDING)
		4894	return -EAGAIN;
		4895
		4896	/* Needs I/O, try to setup async pfault (only possible with FOLL_NOWAIT) */
		4897	if (pfn == KVM_PFN_ERR_NEEDS_IO) {
		4898	trace_kvm_s390_major_guest_pfault(vcpu);
		4899	if (kvm_arch_setup_async_pf(vcpu))
		4900	return 0;
		4901	vcpu->stat.pfault_sync++;
		4902	/* Could not setup async pfault, try again synchronously */
		4903	flags &= ~FOLL_NOWAIT;
		4904	goto try_again;
		4905	}
		4906	/* Any other error */
		4907	if (is_error_pfn(pfn))
		4908	return -EFAULT;
		4909
		4910	/* Success */
		4911	mmap_read_lock(vcpu->arch.gmap->mm);
		4912	/* Mark the userspace PTEs as young and/or dirty, to avoid page fault loops */
		4913	rc = fixup_user_fault(vcpu->arch.gmap->mm, vmaddr, fault_flags, &unlocked);
		4914	if (!rc)
		4915	rc = __gmap_link(vcpu->arch.gmap, gaddr, vmaddr);
		4916	scoped_guard(spinlock, &vcpu->kvm->mmu_lock) {
		4917	kvm_release_faultin_page(vcpu->kvm, page, false, writable);
		4918	}
		4919	mmap_read_unlock(vcpu->arch.gmap->mm);
		4920	return rc;
		4921	}
		4922
		4923	static int vcpu_dat_fault_handler(struct kvm_vcpu *vcpu, unsigned long gaddr, unsigned int flags)
		4924	{
		4925	unsigned long gaddr_tmp;
		4926	gfn_t gfn;
		4927
		4928	gfn = gpa_to_gfn(gaddr);
		4929	if (kvm_is_ucontrol(vcpu->kvm)) {
		4930	/*
		4931	* This translates the per-vCPU guest address into a
		4932	* fake guest address, which can then be used with the
		4933	* fake memslots that are identity mapping userspace.
		4934	* This allows ucontrol VMs to use the normal fault
		4935	* resolution path, like normal VMs.
		4936	*/
		4937	mmap_read_lock(vcpu->arch.gmap->mm);
		4938	gaddr_tmp = __gmap_translate(vcpu->arch.gmap, gaddr);
		4939	mmap_read_unlock(vcpu->arch.gmap->mm);
		4940	if (gaddr_tmp == -EFAULT) {
		4941	vcpu->run->exit_reason = KVM_EXIT_S390_UCONTROL;
		4942	vcpu->run->s390_ucontrol.trans_exc_code = gaddr;
		4943	vcpu->run->s390_ucontrol.pgm_code = PGM_SEGMENT_TRANSLATION;
		4944	return -EREMOTE;
		4945	}
		4946	gfn = gpa_to_gfn(gaddr_tmp);
		4947	}
		4948	return __kvm_s390_handle_dat_fault(vcpu, gfn, gaddr, flags);
		4949	}
		4950
4769	static int vcpu_post_run_handle_fault(struct kvm_vcpu *vcpu)	4951	static int vcpu_post_run_handle_fault(struct kvm_vcpu *vcpu)
4770	{	4952	{
4771	unsigned int flags = 0;	4953	unsigned int flags = 0;
4772	unsigned long gaddr;	4954	unsigned long gaddr;
4773	int rc = 0;
4774		4955
4775	gaddr = current->thread.gmap_teid.addr * PAGE_SIZE;	4956	gaddr = current->thread.gmap_teid.addr * PAGE_SIZE;
4776	if (kvm_s390_cur_gmap_fault_is_write())	4957	if (kvm_s390_cur_gmap_fault_is_write())
@@ -4781,9 +4962,7 @@ static int vcpu_post_run_handle_fault(struct kvm_vcpu *vcpu) · 4 unmodified lines
4781	vcpu->stat.exit_null++;	4962	vcpu->stat.exit_null++;
4782	break;	4963	break;
4783	case PGM_NON_SECURE_STORAGE_ACCESS:	4964	case PGM_NON_SECURE_STORAGE_ACCESS:
4784	KVM_BUG(current->thread.gmap_teid.as != PSW_BITS_AS_PRIMARY, vcpu->kvm,	4965	kvm_s390_assert_primary_as(vcpu);
4785	"Unexpected program interrupt 0x%x, TEID 0x%016lx",
4786	current->thread.gmap_int_code, current->thread.gmap_teid.val);
4787	/*	4966	/*
4788	* This is normal operation; a page belonging to a protected	4967	* This is normal operation; a page belonging to a protected
4789	* guest has not been imported yet. Try to import the page into	4968	* guest has not been imported yet. Try to import the page into
@@ -4794,9 +4973,7 @@ static int vcpu_post_run_handle_fault(struct kvm_vcpu *vcpu) · 4 unmodified lines
4794	break;	4973	break;
4795	case PGM_SECURE_STORAGE_ACCESS:	4974	case PGM_SECURE_STORAGE_ACCESS:
4796	case PGM_SECURE_STORAGE_VIOLATION:	4975	case PGM_SECURE_STORAGE_VIOLATION:
4797	KVM_BUG(current->thread.gmap_teid.as != PSW_BITS_AS_PRIMARY, vcpu->kvm,	4976	kvm_s390_assert_primary_as(vcpu);
4798	"Unexpected program interrupt 0x%x, TEID 0x%016lx",
4799	current->thread.gmap_int_code, current->thread.gmap_teid.val);
4800	/*	4977	/*
4801	* This can happen after a reboot with asynchronous teardown;	4978	* This can happen after a reboot with asynchronous teardown;
4802	* the new guest (normal or protected) will run on top of the	4979	* the new guest (normal or protected) will run on top of the
@@ -4825,40 +5002,15 @@ static int vcpu_post_run_handle_fault(struct kvm_vcpu *vcpu) · 22 unmodified lines
4825	case PGM_REGION_FIRST_TRANS:	5002	case PGM_REGION_FIRST_TRANS:
4826	case PGM_REGION_SECOND_TRANS:	5003	case PGM_REGION_SECOND_TRANS:
4827	case PGM_REGION_THIRD_TRANS:	5004	case PGM_REGION_THIRD_TRANS:
4828	KVM_BUG(current->thread.gmap_teid.as != PSW_BITS_AS_PRIMARY, vcpu->kvm,	5005	kvm_s390_assert_primary_as(vcpu);
4829	"Unexpected program interrupt 0x%x, TEID 0x%016lx",	5006	return vcpu_dat_fault_handler(vcpu, gaddr, flags);
4830	current->thread.gmap_int_code, current->thread.gmap_teid.val);
4831	if (vcpu->arch.gmap->pfault_enabled) {
4832	rc = gmap_fault(vcpu->arch.gmap, gaddr, flags \| FAULT_FLAG_RETRY_NOWAIT);
4833	if (rc == -EFAULT)
4834	return vcpu_post_run_addressing_exception(vcpu);
4835	if (rc == -EAGAIN) {
4836	trace_kvm_s390_major_guest_pfault(vcpu);
4837	if (kvm_arch_setup_async_pf(vcpu))
4838	return 0;
4839	vcpu->stat.pfault_sync++;
4840	} else {
4841	return rc;
4842	}
4843	}
4844	rc = gmap_fault(vcpu->arch.gmap, gaddr, flags);
4845	if (rc == -EFAULT) {
4846	if (kvm_is_ucontrol(vcpu->kvm)) {
4847	vcpu->run->exit_reason = KVM_EXIT_S390_UCONTROL;
4848	vcpu->run->s390_ucontrol.trans_exc_code = gaddr;
4849	vcpu->run->s390_ucontrol.pgm_code = 0x10;
4850	return -EREMOTE;
4851	}
4852	return vcpu_post_run_addressing_exception(vcpu);
4853	}
4854	break;
4855	default:	5007	default:
4856	KVM_BUG(1, vcpu->kvm, "Unexpected program interrupt 0x%x, TEID 0x%016lx",	5008	KVM_BUG(1, vcpu->kvm, "Unexpected program interrupt 0x%x, TEID 0x%016lx",
4857	current->thread.gmap_int_code, current->thread.gmap_teid.val);	5009	current->thread.gmap_int_code, current->thread.gmap_teid.val);
4858	send_sig(SIGSEGV, current, 0);	5010	send_sig(SIGSEGV, current, 0);
4859	break;	5011	break;
4860	}	5012	}
4861	return rc;	5013	return 0;
4862	}	5014	}
4863		5015
4864	static int vcpu_post_run(struct kvm_vcpu *vcpu, int exit_reason)	5016	static int vcpu_post_run(struct kvm_vcpu *vcpu, int exit_reason)
@@ -5737,7 +5889,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp, · 872 unmodified lines
5737	}	5889	}
5738	#endif	5890	#endif
5739	case KVM_S390_VCPU_FAULT: {	5891	case KVM_S390_VCPU_FAULT: {
5740	r = gmap_fault(vcpu->arch.gmap, arg, 0);	5892	idx = srcu_read_lock(&vcpu->kvm->srcu);
		5893	r = vcpu_dat_fault_handler(vcpu, arg, 0);
		5894	srcu_read_unlock(&vcpu->kvm->srcu, idx);
5741	break;	5895	break;
5742	}	5896	}
5743	case KVM_ENABLE_CAP:	5897	case KVM_ENABLE_CAP:
@@ -5853,7 +6007,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, · 109 unmodified lines
5853	{	6007	{
5854	gpa_t size;	6008	gpa_t size;
5855		6009
5856	if (kvm_is_ucontrol(kvm))	6010	if (kvm_is_ucontrol(kvm) && new->id < KVM_USER_MEM_SLOTS)
5857	return -EINVAL;	6011	return -EINVAL;
5858		6012
5859	/* When we are protected, we should not change the memory slots */	6013	/* When we are protected, we should not change the memory slots */
@@ -5905,6 +6059,9 @@ void kvm_arch_commit_memory_region(struct kvm *kvm, · 45 unmodified lines
5905	{	6059	{
5906	int rc = 0;	6060	int rc = 0;
5907		6061
		6062	if (kvm_is_ucontrol(kvm))
		6063	return;
		6064
5908	switch (change) {	6065	switch (change) {
5909	case KVM_MR_DELETE:	6066	case KVM_MR_DELETE:
5910	rc = gmap_unmap_segment(kvm->arch.gmap, old->base_gfn * PAGE_SIZE,	6067	rc = gmap_unmap_segment(kvm->arch.gmap, old->base_gfn * PAGE_SIZE,

arch/s390/kvm/kvm-s390.h+19−0

@@ -20,6 +20,8 @@ · 19 unmodified lines
20	#include <asm/processor.h>	20	#include <asm/processor.h>
21	#include <asm/sclp.h>	21	#include <asm/sclp.h>
22		22
		23	#define KVM_S390_UCONTROL_MEMSLOT (KVM_USER_MEM_SLOTS + 0)
		24
23	static inline void kvm_s390_fpu_store(struct kvm_run *run)	25	static inline void kvm_s390_fpu_store(struct kvm_run *run)
24	{	26	{
25	fpu_stfpc(&run->s.regs.fpc);	27	fpu_stfpc(&run->s.regs.fpc);
@@ -279,6 +281,15 @@ static inline u32 kvm_s390_get_gisa_desc(struct kvm *kvm) · 253 unmodified lines
279	return gd;	281	return gd;
280	}	282	}
281		283
		284	static inline hva_t gpa_to_hva(struct kvm *kvm, gpa_t gpa)
		285	{
		286	hva_t hva = gfn_to_hva(kvm, gpa_to_gfn(gpa));
		287
		288	if (!kvm_is_error_hva(hva))
		289	hva \|= offset_in_page(gpa);
		290	return hva;
		291	}
		292
282	/* implemented in pv.c */	293	/* implemented in pv.c */
283	int kvm_s390_pv_destroy_cpu(struct kvm_vcpu vcpu, u16 rc, u16 *rrc);	294	int kvm_s390_pv_destroy_cpu(struct kvm_vcpu vcpu, u16 rc, u16 *rrc);
284	int kvm_s390_pv_create_cpu(struct kvm_vcpu vcpu, u16 rc, u16 *rrc);	295	int kvm_s390_pv_create_cpu(struct kvm_vcpu vcpu, u16 rc, u16 *rrc);
@@ -408,6 +419,14 @@ void kvm_s390_vcpu_unsetup_cmma(struct kvm_vcpu *vcpu); · 123 unmodified lines
408	void kvm_s390_set_cpu_timer(struct kvm_vcpu *vcpu, __u64 cputm);	419	void kvm_s390_set_cpu_timer(struct kvm_vcpu *vcpu, __u64 cputm);
409	__u64 kvm_s390_get_cpu_timer(struct kvm_vcpu *vcpu);	420	__u64 kvm_s390_get_cpu_timer(struct kvm_vcpu *vcpu);
410	int kvm_s390_cpus_from_pv(struct kvm kvm, u16 rc, u16 *rrc);	421	int kvm_s390_cpus_from_pv(struct kvm kvm, u16 rc, u16 *rrc);
		422	int __kvm_s390_handle_dat_fault(struct kvm_vcpu *vcpu, gfn_t gfn, gpa_t gaddr, unsigned int flags);
		423	int __kvm_s390_mprotect_many(struct gmap *gmap, gpa_t gpa, u8 npages, unsigned int prot,
		424	unsigned long bits);
		425
		426	static inline int kvm_s390_handle_dat_fault(struct kvm_vcpu *vcpu, gpa_t gaddr, unsigned int flags)
		427	{
		428	return __kvm_s390_handle_dat_fault(vcpu, gpa_to_gfn(gaddr), gaddr, flags);
		429	}
411		430
412	/* implemented in diag.c */	431	/* implemented in diag.c */
413	int kvm_s390_handle_diag(struct kvm_vcpu *vcpu);	432	int kvm_s390_handle_diag(struct kvm_vcpu *vcpu);

arch/s390/kvm/pv.c+21−0

 #include <linux/sched/mm.h>
 #include <linux/mmu_notifier.h>
 #include "kvm-s390.h"
+#include "gmap.h"
 bool kvm_s390_pv_is_protected(struct kvm *kvm)
 {
 		.tweak[1] = offset,
 	};
 	int ret = gmap_make_secure(kvm->arch.gmap, addr, &uvcb);
+	unsigned long vmaddr;
+	bool unlocked;
 	*rc = uvcb.header.rc;
 	*rrc = uvcb.header.rrc;
+	if (ret == -ENXIO) {
+		mmap_read_lock(kvm->mm);
+		vmaddr = gfn_to_hva(kvm, gpa_to_gfn(addr));
+		if (kvm_is_error_hva(vmaddr)) {
+			ret = -EFAULT;
+		} else {
+			ret = fixup_user_fault(kvm->mm, vmaddr, FAULT_FLAG_WRITE, &unlocked);
+			if (!ret)
+				ret = __gmap_link(kvm->arch.gmap, addr, vmaddr);
+		}
+		mmap_read_unlock(kvm->mm);
+		if (!ret)
+			return -EAGAIN;
+		return ret;
+	}
 	if (ret && ret != -EAGAIN)
 		KVM_UV_EVENT(kvm, 3, "PROTVIRT VM UNPACK: failed addr %llx with rc %x rrc %x",
 			     uvcb.gaddr, *rc, *rrc);
 	KVM_UV_EVENT(kvm, 3, "PROTVIRT VM UNPACK: start addr %lx size %lx",
 		     addr, size);
+	guard(srcu)(&kvm->srcu);
 	while (offset < size) {
 		ret = unpack_one(kvm, addr, tweak, offset, rc, rrc);
 		if (ret == -EAGAIN) {

arch/s390/kvm/vsie.c+68−38

@@ -13,6 +13,7 @@ · 12 unmodified lines
13	#include <linux/bitmap.h>	13	#include <linux/bitmap.h>
14	#include <linux/sched/signal.h>	14	#include <linux/sched/signal.h>
15	#include <linux/io.h>	15	#include <linux/io.h>
		16	#include <linux/mman.h>
16		17
17	#include <asm/gmap.h>	18	#include <asm/gmap.h>
18	#include <asm/mmu_context.h>	19	#include <asm/mmu_context.h>
@@ -22,6 +23,11 @@ · 3 unmodified lines
22	#include <asm/facility.h>	23	#include <asm/facility.h>
23	#include "kvm-s390.h"	24	#include "kvm-s390.h"
24	#include "gaccess.h"	25	#include "gaccess.h"
		26	#include "gmap.h"
		27
		28	enum vsie_page_flags {
		29	VSIE_PAGE_IN_USE = 0,
		30	};
25		31
26	struct vsie_page {	32	struct vsie_page {
27	struct kvm_s390_sie_block scb_s; /* 0x0000 */	33	struct kvm_s390_sie_block scb_s; /* 0x0000 */
@@ -46,7 +52,18 @@ struct vsie_page { · 18 unmodified lines
46	gpa_t gvrd_gpa; /* 0x0240 */	52	gpa_t gvrd_gpa; /* 0x0240 */
47	gpa_t riccbd_gpa; /* 0x0248 */	53	gpa_t riccbd_gpa; /* 0x0248 */
48	gpa_t sdnx_gpa; /* 0x0250 */	54	gpa_t sdnx_gpa; /* 0x0250 */
49	__u8 reserved[0x0700 - 0x0258]; /* 0x0258 */	55	/*
		56	* guest address of the original SCB. Remains set for free vsie
		57	* pages, so we can properly look them up in our addr_to_page
		58	* radix tree.
		59	*/
		60	gpa_t scb_gpa; /* 0x0258 */
		61	/*
		62	* Flags: must be set/cleared atomically after the vsie page can be
		63	* looked up by other CPUs.
		64	*/
		65	unsigned long flags; /* 0x0260 */
		66	__u8 reserved[0x0700 - 0x0268]; /* 0x0268 */
50	struct kvm_s390_crypto_cb crycb; /* 0x0700 */	67	struct kvm_s390_crypto_cb crycb; /* 0x0700 */
51	__u8 fac[S390_ARCH_FAC_LIST_SIZE_BYTE]; /* 0x0800 */	68	__u8 fac[S390_ARCH_FAC_LIST_SIZE_BYTE]; /* 0x0800 */
52	};	69	};
@@ -584,7 +601,6 @@ void kvm_s390_vsie_gmap_notifier(struct gmap *gmap, unsigned long start, · 531 unmodified lines
584	struct kvm *kvm = gmap->private;	601	struct kvm *kvm = gmap->private;
585	struct vsie_page *cur;	602	struct vsie_page *cur;
586	unsigned long prefix;	603	unsigned long prefix;
587	struct page *page;
588	int i;	604	int i;
589		605
590	if (!gmap_is_shadow(gmap))	606	if (!gmap_is_shadow(gmap))
@@ -594,10 +610,9 @@ void kvm_s390_vsie_gmap_notifier(struct gmap *gmap, unsigned long start, · 3 unmodified lines
594	* therefore we can safely reference them all the time.	610	* therefore we can safely reference them all the time.
595	*/	611	*/
596	for (i = 0; i < kvm->arch.vsie.page_count; i++) {	612	for (i = 0; i < kvm->arch.vsie.page_count; i++) {
597	page = READ_ONCE(kvm->arch.vsie.pages[i]);	613	cur = READ_ONCE(kvm->arch.vsie.pages[i]);
598	if (!page)	614	if (!cur)
599	continue;	615	continue;
600	cur = page_to_virt(page);
601	if (READ_ONCE(cur->gmap) != gmap)	616	if (READ_ONCE(cur->gmap) != gmap)
602	continue;	617	continue;
603	prefix = cur->scb_s.prefix << GUEST_PREFIX_SHIFT;	618	prefix = cur->scb_s.prefix << GUEST_PREFIX_SHIFT;
@@ -1345,6 +1360,20 @@ static int vsie_run(struct kvm_vcpu vcpu, struct vsie_page vsie_page) · 741 unmodified lines
1345	return rc;	1360	return rc;
1346	}	1361	}
1347		1362
		1363	/* Try getting a given vsie page, returning "true" on success. */
		1364	static inline bool try_get_vsie_page(struct vsie_page *vsie_page)
		1365	{
		1366	if (test_bit(VSIE_PAGE_IN_USE, &vsie_page->flags))
		1367	return false;
		1368	return !test_and_set_bit(VSIE_PAGE_IN_USE, &vsie_page->flags);
		1369	}
		1370
		1371	/* Put a vsie page acquired through get_vsie_page / try_get_vsie_page. */
		1372	static void put_vsie_page(struct vsie_page *vsie_page)
		1373	{
		1374	clear_bit(VSIE_PAGE_IN_USE, &vsie_page->flags);
		1375	}
		1376
1348	/*	1377	/*
1349	* Get or create a vsie page for a scb address.	1378	* Get or create a vsie page for a scb address.
1350	*	1379	*
@@ -1355,16 +1384,21 @@ static int vsie_run(struct kvm_vcpu vcpu, struct vsie_page vsie_page) · 4 unmodified lines
1355	static struct vsie_page get_vsie_page(struct kvm kvm, unsigned long addr)	1384	static struct vsie_page get_vsie_page(struct kvm kvm, unsigned long addr)
1356	{	1385	{
1357	struct vsie_page *vsie_page;	1386	struct vsie_page *vsie_page;
1358	struct page *page;
1359	int nr_vcpus;	1387	int nr_vcpus;
1360		1388
1361	rcu_read_lock();	1389	rcu_read_lock();
1362	page = radix_tree_lookup(&kvm->arch.vsie.addr_to_page, addr >> 9);	1390	vsie_page = radix_tree_lookup(&kvm->arch.vsie.addr_to_page, addr >> 9);
1363	rcu_read_unlock();	1391	rcu_read_unlock();
1364	if (page) {	1392	if (vsie_page) {
1365	if (page_ref_inc_return(page) == 2)	1393	if (try_get_vsie_page(vsie_page)) {
1366	return page_to_virt(page);	1394	if (vsie_page->scb_gpa == addr)
1367	page_ref_dec(page);	1395	return vsie_page;
		1396	/*
		1397	* We raced with someone reusing + putting this vsie
		1398	* page before we grabbed it.
		1399	*/
		1400	put_vsie_page(vsie_page);
		1401	}
1368	}	1402	}
1369		1403
1370	/*	1404	/*
@@ -1375,36 +1409,40 @@ static struct vsie_page get_vsie_page(struct kvm kvm, unsigned long addr) · 4 unmodified lines
1375		1409
1376	mutex_lock(&kvm->arch.vsie.mutex);	1410	mutex_lock(&kvm->arch.vsie.mutex);
1377	if (kvm->arch.vsie.page_count < nr_vcpus) {	1411	if (kvm->arch.vsie.page_count < nr_vcpus) {
1378	page = alloc_page(GFP_KERNEL_ACCOUNT \| __GFP_ZERO \| GFP_DMA);	1412	vsie_page = (void *)__get_free_page(GFP_KERNEL_ACCOUNT \| __GFP_ZERO \| GFP_DMA);
1379	if (!page) {	1413	if (!vsie_page) {
1380	mutex_unlock(&kvm->arch.vsie.mutex);	1414	mutex_unlock(&kvm->arch.vsie.mutex);
1381	return ERR_PTR(-ENOMEM);	1415	return ERR_PTR(-ENOMEM);
1382	}	1416	}
1383	page_ref_inc(page);	1417	__set_bit(VSIE_PAGE_IN_USE, &vsie_page->flags);
1384	kvm->arch.vsie.pages[kvm->arch.vsie.page_count] = page;	1418	kvm->arch.vsie.pages[kvm->arch.vsie.page_count] = vsie_page;
1385	kvm->arch.vsie.page_count++;	1419	kvm->arch.vsie.page_count++;
1386	} else {	1420	} else {
1387	/* reuse an existing entry that belongs to nobody */	1421	/* reuse an existing entry that belongs to nobody */
1388	while (true) {	1422	while (true) {
1389	page = kvm->arch.vsie.pages[kvm->arch.vsie.next];	1423	vsie_page = kvm->arch.vsie.pages[kvm->arch.vsie.next];
1390	if (page_ref_inc_return(page) == 2)	1424	if (try_get_vsie_page(vsie_page))
1391	break;	1425	break;
1392	page_ref_dec(page);
1393	kvm->arch.vsie.next++;	1426	kvm->arch.vsie.next++;
1394	kvm->arch.vsie.next %= nr_vcpus;	1427	kvm->arch.vsie.next %= nr_vcpus;
1395	}	1428	}
1396	radix_tree_delete(&kvm->arch.vsie.addr_to_page, page->index >> 9);	1429	if (vsie_page->scb_gpa != ULONG_MAX)
		1430	radix_tree_delete(&kvm->arch.vsie.addr_to_page,
		1431	vsie_page->scb_gpa >> 9);
1397	}	1432	}
1398	page->index = addr;	1433	/* Mark it as invalid until it resides in the tree. */
1399	/* double use of the same address */	1434	vsie_page->scb_gpa = ULONG_MAX;
1400	if (radix_tree_insert(&kvm->arch.vsie.addr_to_page, addr >> 9, page)) {	1435
1401	page_ref_dec(page);	1436	/* Double use of the same address or allocation failure. */
		1437	if (radix_tree_insert(&kvm->arch.vsie.addr_to_page, addr >> 9,
		1438	vsie_page)) {
		1439	put_vsie_page(vsie_page);
1402	mutex_unlock(&kvm->arch.vsie.mutex);	1440	mutex_unlock(&kvm->arch.vsie.mutex);
1403	return NULL;	1441	return NULL;
1404	}	1442	}
		1443	vsie_page->scb_gpa = addr;
1405	mutex_unlock(&kvm->arch.vsie.mutex);	1444	mutex_unlock(&kvm->arch.vsie.mutex);
1406		1445
1407	vsie_page = page_to_virt(page);
1408	memset(&vsie_page->scb_s, 0, sizeof(struct kvm_s390_sie_block));	1446	memset(&vsie_page->scb_s, 0, sizeof(struct kvm_s390_sie_block));
1409	release_gmap_shadow(vsie_page);	1447	release_gmap_shadow(vsie_page);
1410	vsie_page->fault_addr = 0;	1448	vsie_page->fault_addr = 0;
@@ -1412,14 +1450,6 @@ static struct vsie_page get_vsie_page(struct kvm kvm, unsigned long addr) · 1 unmodified line
1412	return vsie_page;	1450	return vsie_page;
1413	}	1451	}
1414		1452
1415	/* put a vsie page acquired via get_vsie_page */
1416	static void put_vsie_page(struct kvm kvm, struct vsie_page vsie_page)
1417	{
1418	struct page *page = pfn_to_page(__pa(vsie_page) >> PAGE_SHIFT);
1419
1420	page_ref_dec(page);
1421	}
1422
1423	int kvm_s390_handle_vsie(struct kvm_vcpu *vcpu)	1453	int kvm_s390_handle_vsie(struct kvm_vcpu *vcpu)
1424	{	1454	{
1425	struct vsie_page *vsie_page;	1455	struct vsie_page *vsie_page;
@@ -1470,7 +1500,7 @@ out_unshadow: · 44 unmodified lines
1470	out_unpin_scb:	1500	out_unpin_scb:
1471	unpin_scb(vcpu, vsie_page, scb_addr);	1501	unpin_scb(vcpu, vsie_page, scb_addr);
1472	out_put:	1502	out_put:
1473	put_vsie_page(vcpu->kvm, vsie_page);	1503	put_vsie_page(vsie_page);
1474		1504
1475	return rc < 0 ? rc : 0;	1505	return rc < 0 ? rc : 0;
1476	}	1506	}
@@ -1486,18 +1516,18 @@ void kvm_s390_vsie_init(struct kvm *kvm) · 9 unmodified lines
1486	void kvm_s390_vsie_destroy(struct kvm *kvm)	1516	void kvm_s390_vsie_destroy(struct kvm *kvm)
1487	{	1517	{
1488	struct vsie_page *vsie_page;	1518	struct vsie_page *vsie_page;
1489	struct page *page;
1490	int i;	1519	int i;
1491		1520
1492	mutex_lock(&kvm->arch.vsie.mutex);	1521	mutex_lock(&kvm->arch.vsie.mutex);
1493	for (i = 0; i < kvm->arch.vsie.page_count; i++) {	1522	for (i = 0; i < kvm->arch.vsie.page_count; i++) {
1494	page = kvm->arch.vsie.pages[i];	1523	vsie_page = kvm->arch.vsie.pages[i];
1495	kvm->arch.vsie.pages[i] = NULL;	1524	kvm->arch.vsie.pages[i] = NULL;
1496	vsie_page = page_to_virt(page);
1497	release_gmap_shadow(vsie_page);	1525	release_gmap_shadow(vsie_page);
1498	/* free the radix tree entry */	1526	/* free the radix tree entry */
1499	radix_tree_delete(&kvm->arch.vsie.addr_to_page, page->index >> 9);	1527	if (vsie_page->scb_gpa != ULONG_MAX)
1500	__free_page(page);	1528	radix_tree_delete(&kvm->arch.vsie.addr_to_page,
		1529	vsie_page->scb_gpa >> 9);
		1530	free_page((unsigned long)vsie_page);
1501	}	1531	}
1502	kvm->arch.vsie.page_count = 0;	1532	kvm->arch.vsie.page_count = 0;
1503	mutex_unlock(&kvm->arch.vsie.mutex);	1533	mutex_unlock(&kvm->arch.vsie.mutex);

arch/s390/mm/gmap.c+150−531

@@ -24,6 +24,16 @@ · 23 unmodified lines
24	#include <asm/page.h>	24	#include <asm/page.h>
25	#include <asm/tlb.h>	25	#include <asm/tlb.h>
26		26
		27	/*
		28	* The address is saved in a radix tree directly; NULL would be ambiguous,
		29	* since 0 is a valid address, and NULL is returned when nothing was found.
		30	* The lower bits are ignored by all users of the macro, so it can be used
		31	* to distinguish a valid address 0 from a NULL.
		32	*/
		33	#define VALID_GADDR_FLAG 1
		34	#define IS_GADDR_VALID(gaddr) ((gaddr) & VALID_GADDR_FLAG)
		35	#define MAKE_VALID_GADDR(gaddr) (((gaddr) & HPAGE_MASK) \| VALID_GADDR_FLAG)
		36
27	#define GMAP_SHADOW_FAKE_TABLE 1ULL	37	#define GMAP_SHADOW_FAKE_TABLE 1ULL
28		38
29	static struct page *gmap_alloc_crst(void)	39	static struct page *gmap_alloc_crst(void)
@@ -43,7 +53,7 @@ static struct page *gmap_alloc_crst(void) · 13 unmodified lines
43	*	53	*
44	* Returns a guest address space structure.	54	* Returns a guest address space structure.
45	*/	55	*/
46	static struct gmap *gmap_alloc(unsigned long limit)	56	struct gmap *gmap_alloc(unsigned long limit)
47	{	57	{
48	struct gmap *gmap;	58	struct gmap *gmap;
49	struct page *page;	59	struct page *page;
@@ -70,9 +80,7 @@ static struct gmap *gmap_alloc(unsigned long limit) · 20 unmodified lines
70	gmap = kzalloc(sizeof(struct gmap), GFP_KERNEL_ACCOUNT);	80	gmap = kzalloc(sizeof(struct gmap), GFP_KERNEL_ACCOUNT);
71	if (!gmap)	81	if (!gmap)
72	goto out;	82	goto out;
73	INIT_LIST_HEAD(&gmap->crst_list);
74	INIT_LIST_HEAD(&gmap->children);	83	INIT_LIST_HEAD(&gmap->children);
75	INIT_LIST_HEAD(&gmap->pt_list);
76	INIT_RADIX_TREE(&gmap->guest_to_host, GFP_KERNEL_ACCOUNT);	84	INIT_RADIX_TREE(&gmap->guest_to_host, GFP_KERNEL_ACCOUNT);
77	INIT_RADIX_TREE(&gmap->host_to_guest, GFP_ATOMIC \| __GFP_ACCOUNT);	85	INIT_RADIX_TREE(&gmap->host_to_guest, GFP_ATOMIC \| __GFP_ACCOUNT);
78	INIT_RADIX_TREE(&gmap->host_to_rmap, GFP_ATOMIC \| __GFP_ACCOUNT);	86	INIT_RADIX_TREE(&gmap->host_to_rmap, GFP_ATOMIC \| __GFP_ACCOUNT);
@@ -82,8 +90,6 @@ static struct gmap *gmap_alloc(unsigned long limit) · 3 unmodified lines
82	page = gmap_alloc_crst();	90	page = gmap_alloc_crst();
83	if (!page)	91	if (!page)
84	goto out_free;	92	goto out_free;
85	page->index = 0;
86	list_add(&page->lru, &gmap->crst_list);
87	table = page_to_virt(page);	93	table = page_to_virt(page);
88	crst_table_init(table, etype);	94	crst_table_init(table, etype);
89	gmap->table = table;	95	gmap->table = table;
@@ -97,6 +103,7 @@ out_free: · 7 unmodified lines
97	out:	103	out:
98	return NULL;	104	return NULL;
99	}	105	}
		106	EXPORT_SYMBOL_GPL(gmap_alloc);
100		107
101	/**	108	/**
102	* gmap_create - create a guest address space	109	* gmap_create - create a guest address space
@@ -185,32 +192,46 @@ static void gmap_rmap_radix_tree_free(struct radix_tree_root *root) · 82 unmodified lines
185	} while (nr > 0);	192	} while (nr > 0);
186	}	193	}
187		194
		195	static void gmap_free_crst(unsigned long *table, bool free_ptes)
		196	{
		197	bool is_segment = (table[0] & _SEGMENT_ENTRY_TYPE_MASK) == 0;
		198	int i;
		199
		200	if (is_segment) {
		201	if (!free_ptes)
		202	goto out;
		203	for (i = 0; i < _CRST_ENTRIES; i++)
		204	if (!(table[i] & _SEGMENT_ENTRY_INVALID))
		205	page_table_free_pgste(page_ptdesc(phys_to_page(table[i])));
		206	} else {
		207	for (i = 0; i < _CRST_ENTRIES; i++)
		208	if (!(table[i] & _REGION_ENTRY_INVALID))
		209	gmap_free_crst(__va(table[i] & PAGE_MASK), free_ptes);
		210	}
		211
		212	out:
		213	free_pages((unsigned long)table, CRST_ALLOC_ORDER);
		214	}
		215
188	/**	216	/**
189	* gmap_free - free a guest address space	217	* gmap_free - free a guest address space
190	* @gmap: pointer to the guest address space structure	218	* @gmap: pointer to the guest address space structure
191	*	219	*
192	* No locks required. There are no references to this gmap anymore.	220	* No locks required. There are no references to this gmap anymore.
193	*/	221	*/
194	static void gmap_free(struct gmap *gmap)	222	void gmap_free(struct gmap *gmap)
195	{	223	{
196	struct page page, next;
197
198	/* Flush tlb of all gmaps (if not already done for shadows) */	224	/* Flush tlb of all gmaps (if not already done for shadows) */
199	if (!(gmap_is_shadow(gmap) && gmap->removed))	225	if (!(gmap_is_shadow(gmap) && gmap->removed))
200	gmap_flush_tlb(gmap);	226	gmap_flush_tlb(gmap);
201	/* Free all segment & region tables. */	227	/* Free all segment & region tables. */
202	list_for_each_entry_safe(page, next, &gmap->crst_list, lru)	228	gmap_free_crst(gmap->table, gmap_is_shadow(gmap));
203	__free_pages(page, CRST_ALLOC_ORDER);	229
204	gmap_radix_tree_free(&gmap->guest_to_host);	230	gmap_radix_tree_free(&gmap->guest_to_host);
205	gmap_radix_tree_free(&gmap->host_to_guest);	231	gmap_radix_tree_free(&gmap->host_to_guest);
206		232
207	/* Free additional data for a shadow gmap */	233	/* Free additional data for a shadow gmap */
208	if (gmap_is_shadow(gmap)) {	234	if (gmap_is_shadow(gmap)) {
209	struct ptdesc ptdesc, n;
210
211	/* Free all page tables. */
212	list_for_each_entry_safe(ptdesc, n, &gmap->pt_list, pt_list)
213	page_table_free_pgste(ptdesc);
214	gmap_rmap_radix_tree_free(&gmap->host_to_rmap);	235	gmap_rmap_radix_tree_free(&gmap->host_to_rmap);
215	/* Release reference to the parent */	236	/* Release reference to the parent */
216	gmap_put(gmap->parent);	237	gmap_put(gmap->parent);
@@ -218,6 +239,7 @@ static void gmap_free(struct gmap *gmap) · 1 unmodified line
218		239
219	kfree(gmap);	240	kfree(gmap);
220	}	241	}
		242	EXPORT_SYMBOL_GPL(gmap_free);
221		243
222	/**	244	/**
223	* gmap_get - increase reference counter for guest address space	245	* gmap_get - increase reference counter for guest address space
@@ -298,10 +320,8 @@ static int gmap_alloc_table(struct gmap gmap, unsigned long table, · 74 unmodified lines
298	crst_table_init(new, init);	320	crst_table_init(new, init);
299	spin_lock(&gmap->guest_table_lock);	321	spin_lock(&gmap->guest_table_lock);
300	if (*table & _REGION_ENTRY_INVALID) {	322	if (*table & _REGION_ENTRY_INVALID) {
301	list_add(&page->lru, &gmap->crst_list);
302	*table = __pa(new) \| _REGION_ENTRY_LENGTH \|	323	*table = __pa(new) \| _REGION_ENTRY_LENGTH \|
303	(*table & _REGION_ENTRY_TYPE_MASK);	324	(*table & _REGION_ENTRY_TYPE_MASK);
304	page->index = gaddr;
305	page = NULL;	325	page = NULL;
306	}	326	}
307	spin_unlock(&gmap->guest_table_lock);	327	spin_unlock(&gmap->guest_table_lock);
@@ -310,21 +330,23 @@ static int gmap_alloc_table(struct gmap gmap, unsigned long table, · 2 unmodified lines
310	return 0;	330	return 0;
311	}	331	}
312		332
313	/**	333	static unsigned long host_to_guest_lookup(struct gmap *gmap, unsigned long vmaddr)
314	* __gmap_segment_gaddr - find virtual address from segment pointer
315	* @entry: pointer to a segment table entry in the guest address space
316	*
317	* Returns the virtual address in the guest address space for the segment
318	*/
319	static unsigned long __gmap_segment_gaddr(unsigned long *entry)
320	{	334	{
321	struct page *page;	335	return (unsigned long)radix_tree_lookup(&gmap->host_to_guest, vmaddr >> PMD_SHIFT);
322	unsigned long offset;	336	}
323		337
324	offset = (unsigned long) entry / sizeof(unsigned long);	338	static unsigned long host_to_guest_delete(struct gmap *gmap, unsigned long vmaddr)
325	offset = (offset & (PTRS_PER_PMD - 1)) * PMD_SIZE;	339	{
326	page = pmd_pgtable_page((pmd_t *) entry);	340	return (unsigned long)radix_tree_delete(&gmap->host_to_guest, vmaddr >> PMD_SHIFT);
327	return page->index + offset;	341	}
		342
		343	static pmd_t host_to_guest_pmd_delete(struct gmap gmap, unsigned long vmaddr,
		344	unsigned long *gaddr)
		345	{
		346	*gaddr = host_to_guest_delete(gmap, vmaddr);
		347	if (IS_GADDR_VALID(*gaddr))
		348	return (pmd_t )gmap_table_walk(gmap, gaddr, 1);
		349	return NULL;
328	}	350	}
329		351
330	/**	352	/**
@@ -336,16 +358,19 @@ static unsigned long __gmap_segment_gaddr(unsigned long *entry) · 5 unmodified lines
336	*/	358	*/
337	static int __gmap_unlink_by_vmaddr(struct gmap *gmap, unsigned long vmaddr)	359	static int __gmap_unlink_by_vmaddr(struct gmap *gmap, unsigned long vmaddr)
338	{	360	{
339	unsigned long *entry;	361	unsigned long gaddr;
340	int flush = 0;	362	int flush = 0;
		363	pmd_t *pmdp;
341		364
342	BUG_ON(gmap_is_shadow(gmap));	365	BUG_ON(gmap_is_shadow(gmap));
343	spin_lock(&gmap->guest_table_lock);	366	spin_lock(&gmap->guest_table_lock);
344	entry = radix_tree_delete(&gmap->host_to_guest, vmaddr >> PMD_SHIFT);	367
345	if (entry) {	368	pmdp = host_to_guest_pmd_delete(gmap, vmaddr, &gaddr);
346	flush = (*entry != _SEGMENT_ENTRY_EMPTY);	369	if (pmdp) {
347	*entry = _SEGMENT_ENTRY_EMPTY;	370	flush = (pmd_val(*pmdp) != _SEGMENT_ENTRY_EMPTY);
		371	*pmdp = __pmd(_SEGMENT_ENTRY_EMPTY);
348	}	372	}
		373
349	spin_unlock(&gmap->guest_table_lock);	374	spin_unlock(&gmap->guest_table_lock);
350	return flush;	375	return flush;
351	}	376	}
@@ -463,26 +488,6 @@ unsigned long __gmap_translate(struct gmap *gmap, unsigned long gaddr) · 111 unmodified lines
463	}	488	}
464	EXPORT_SYMBOL_GPL(__gmap_translate);	489	EXPORT_SYMBOL_GPL(__gmap_translate);
465		490
466	/**
467	* gmap_translate - translate a guest address to a user space address
468	* @gmap: pointer to guest mapping meta data structure
469	* @gaddr: guest address
470	*
471	* Returns user space address which corresponds to the guest address or
472	* -EFAULT if no such mapping exists.
473	* This function does not establish potentially missing page table entries.
474	*/
475	unsigned long gmap_translate(struct gmap *gmap, unsigned long gaddr)
476	{
477	unsigned long rc;
478
479	mmap_read_lock(gmap->mm);
480	rc = __gmap_translate(gmap, gaddr);
481	mmap_read_unlock(gmap->mm);
482	return rc;
483	}
484	EXPORT_SYMBOL_GPL(gmap_translate);
485
486	/**	491	/**
487	* gmap_unlink - disconnect a page table from the gmap shadow tables	492	* gmap_unlink - disconnect a page table from the gmap shadow tables
488	* @mm: pointer to the parent mm_struct	493	* @mm: pointer to the parent mm_struct
@@ -582,7 +587,8 @@ int __gmap_link(struct gmap *gmap, unsigned long gaddr, unsigned long vmaddr) · 93 unmodified lines
582	spin_lock(&gmap->guest_table_lock);	587	spin_lock(&gmap->guest_table_lock);
583	if (*table == _SEGMENT_ENTRY_EMPTY) {	588	if (*table == _SEGMENT_ENTRY_EMPTY) {
584	rc = radix_tree_insert(&gmap->host_to_guest,	589	rc = radix_tree_insert(&gmap->host_to_guest,
585	vmaddr >> PMD_SHIFT, table);	590	vmaddr >> PMD_SHIFT,
		591	(void *)MAKE_VALID_GADDR(gaddr));
586	if (!rc) {	592	if (!rc) {
587	if (pmd_leaf(*pmd)) {	593	if (pmd_leaf(*pmd)) {
588	table = (pmd_val(pmd) &	594	table = (pmd_val(pmd) &
@@ -605,130 +611,7 @@ int __gmap_link(struct gmap *gmap, unsigned long gaddr, unsigned long vmaddr) · 16 unmodified lines
605	radix_tree_preload_end();	611	radix_tree_preload_end();
606	return rc;	612	return rc;
607	}	613	}
608		614	EXPORT_SYMBOL(__gmap_link);
609	/**
610	* fixup_user_fault_nowait - manually resolve a user page fault without waiting
611	* @mm: mm_struct of target mm
612	* @address: user address
613	* @fault_flags:flags to pass down to handle_mm_fault()
614	* @unlocked: did we unlock the mmap_lock while retrying
615	*
616	* This function behaves similarly to fixup_user_fault(), but it guarantees
617	* that the fault will be resolved without waiting. The function might drop
618	* and re-acquire the mm lock, in which case @unlocked will be set to true.
619	*
620	* The guarantee is that the fault is handled without waiting, but the
621	* function itself might sleep, due to the lock.
622	*
623	* Context: Needs to be called with mm->mmap_lock held in read mode, and will
624	* return with the lock held in read mode; @unlocked will indicate whether
625	* the lock has been dropped and re-acquired. This is the same behaviour as
626	* fixup_user_fault().
627	*
628	* Return: 0 on success, -EAGAIN if the fault cannot be resolved without
629	* waiting, -EFAULT if the fault cannot be resolved, -ENOMEM if out of
630	* memory.
631	*/
632	static int fixup_user_fault_nowait(struct mm_struct *mm, unsigned long address,
633	unsigned int fault_flags, bool *unlocked)
634	{
635	struct vm_area_struct *vma;
636	unsigned int test_flags;
637	vm_fault_t fault;
638	int rc;
639
640	fault_flags \|= FAULT_FLAG_ALLOW_RETRY \| FAULT_FLAG_RETRY_NOWAIT;
641	test_flags = fault_flags & FAULT_FLAG_WRITE ? VM_WRITE : VM_READ;
642
643	vma = find_vma(mm, address);
644	if (unlikely(!vma \|\| address < vma->vm_start))
645	return -EFAULT;
646	if (unlikely(!(vma->vm_flags & test_flags)))
647	return -EFAULT;
648
649	fault = handle_mm_fault(vma, address, fault_flags, NULL);
650	/* the mm lock has been dropped, take it again */
651	if (fault & VM_FAULT_COMPLETED) {
652	*unlocked = true;
653	mmap_read_lock(mm);
654	return 0;
655	}
656	/* the mm lock has not been dropped */
657	if (fault & VM_FAULT_ERROR) {
658	rc = vm_fault_to_errno(fault, 0);
659	BUG_ON(!rc);
660	return rc;
661	}
662	/* the mm lock has not been dropped because of FAULT_FLAG_RETRY_NOWAIT */
663	if (fault & VM_FAULT_RETRY)
664	return -EAGAIN;
665	/* nothing needed to be done and the mm lock has not been dropped */
666	return 0;
667	}
668
669	/**
670	* __gmap_fault - resolve a fault on a guest address
671	* @gmap: pointer to guest mapping meta data structure
672	* @gaddr: guest address
673	* @fault_flags: flags to pass down to handle_mm_fault()
674	*
675	* Context: Needs to be called with mm->mmap_lock held in read mode. Might
676	* drop and re-acquire the lock. Will always return with the lock held.
677	*/
678	static int __gmap_fault(struct gmap *gmap, unsigned long gaddr, unsigned int fault_flags)
679	{
680	unsigned long vmaddr;
681	bool unlocked;
682	int rc = 0;
683
684	retry:
685	unlocked = false;
686
687	vmaddr = __gmap_translate(gmap, gaddr);
688	if (IS_ERR_VALUE(vmaddr))
689	return vmaddr;
690
691	if (fault_flags & FAULT_FLAG_RETRY_NOWAIT)
692	rc = fixup_user_fault_nowait(gmap->mm, vmaddr, fault_flags, &unlocked);
693	else
694	rc = fixup_user_fault(gmap->mm, vmaddr, fault_flags, &unlocked);
695	if (rc)
696	return rc;
697	/*
698	* In the case that fixup_user_fault unlocked the mmap_lock during
699	* fault-in, redo __gmap_translate() to avoid racing with a
700	* map/unmap_segment.
701	* In particular, __gmap_translate(), fixup_user_fault{,_nowait}(),
702	* and __gmap_link() must all be called atomically in one go; if the
703	* lock had been dropped in between, a retry is needed.
704	*/
705	if (unlocked)
706	goto retry;
707
708	return __gmap_link(gmap, gaddr, vmaddr);
709	}
710
711	/**
712	* gmap_fault - resolve a fault on a guest address
713	* @gmap: pointer to guest mapping meta data structure
714	* @gaddr: guest address
715	* @fault_flags: flags to pass down to handle_mm_fault()
716	*
717	* Returns 0 on success, -ENOMEM for out of memory conditions, -EFAULT if the
718	* vm address is already mapped to a different guest segment, and -EAGAIN if
719	* FAULT_FLAG_RETRY_NOWAIT was specified and the fault could not be processed
720	* immediately.
721	*/
722	int gmap_fault(struct gmap *gmap, unsigned long gaddr, unsigned int fault_flags)
723	{
724	int rc;
725
726	mmap_read_lock(gmap->mm);
727	rc = __gmap_fault(gmap, gaddr, fault_flags);
728	mmap_read_unlock(gmap->mm);
729	return rc;
730	}
731	EXPORT_SYMBOL_GPL(gmap_fault);
732		615
733	/*	616	/*
734	* this function is assumed to be called with mmap_lock held	617	* this function is assumed to be called with mmap_lock held
@@ -853,8 +736,7 @@ static void gmap_call_notifier(struct gmap *gmap, unsigned long start, · 118 unmodified lines
853	*	736	*
854	* Note: Can also be called for shadow gmaps.	737	* Note: Can also be called for shadow gmaps.
855	*/	738	*/
856	static inline unsigned long gmap_table_walk(struct gmap gmap,	739	unsigned long gmap_table_walk(struct gmap gmap, unsigned long gaddr, int level)
857	unsigned long gaddr, int level)
858	{	740	{
859	const int asce_type = gmap->asce & _ASCE_TYPE_MASK;	741	const int asce_type = gmap->asce & _ASCE_TYPE_MASK;
860	unsigned long *table = gmap->table;	742	unsigned long *table = gmap->table;
@@ -905,6 +787,7 @@ static inline unsigned long gmap_table_walk(struct gmap gmap, · 44 unmodified lines
905	}	787	}
906	return table;	788	return table;
907	}	789	}
		790	EXPORT_SYMBOL(gmap_table_walk);
908		791
909	/**	792	/**
910	* gmap_pte_op_walk - walk the gmap page table, get the page table lock	793	* gmap_pte_op_walk - walk the gmap page table, get the page table lock
@@ -1101,86 +984,40 @@ static int gmap_protect_pte(struct gmap *gmap, unsigned long gaddr, · 190 unmodified lines
1101	* @prot: indicates access rights: PROT_NONE, PROT_READ or PROT_WRITE	984	* @prot: indicates access rights: PROT_NONE, PROT_READ or PROT_WRITE
1102	* @bits: pgste notification bits to set	985	* @bits: pgste notification bits to set
1103	*	986	*
1104	* Returns 0 if successfully protected, -ENOMEM if out of memory and	987	* Returns:
1105	* -EFAULT if gaddr is invalid (or mapping for shadows is missing).	988	* PAGE_SIZE if a small page was successfully protected;
		989	* HPAGE_SIZE if a large page was successfully protected;
		990	* -ENOMEM if out of memory;
		991	* -EFAULT if gaddr is invalid (or mapping for shadows is missing);
		992	* -EAGAIN if the guest mapping is missing and should be fixed by the caller.
1106	*	993	*
1107	* Called with sg->mm->mmap_lock in read.	994	* Context: Called with sg->mm->mmap_lock in read.
1108	*/	995	*/
1109	static int gmap_protect_range(struct gmap *gmap, unsigned long gaddr,	996	int gmap_protect_one(struct gmap *gmap, unsigned long gaddr, int prot, unsigned long bits)
1110	unsigned long len, int prot, unsigned long bits)
1111	{	997	{
1112	unsigned long vmaddr, dist;
1113	pmd_t *pmdp;	998	pmd_t *pmdp;
1114	int rc;	999	int rc = 0;
1115		1000
1116	BUG_ON(gmap_is_shadow(gmap));	1001	BUG_ON(gmap_is_shadow(gmap));
1117	while (len) {
1118	rc = -EAGAIN;
1119	pmdp = gmap_pmd_op_walk(gmap, gaddr);
1120	if (pmdp) {
1121	if (!pmd_leaf(*pmdp)) {
1122	rc = gmap_protect_pte(gmap, gaddr, pmdp, prot,
1123	bits);
1124	if (!rc) {
1125	len -= PAGE_SIZE;
1126	gaddr += PAGE_SIZE;
1127	}
1128	} else {
1129	rc = gmap_protect_pmd(gmap, gaddr, pmdp, prot,
1130	bits);
1131	if (!rc) {
1132	dist = HPAGE_SIZE - (gaddr & ~HPAGE_MASK);
1133	len = len < dist ? 0 : len - dist;
1134	gaddr = (gaddr & HPAGE_MASK) + HPAGE_SIZE;
1135	}
1136	}
1137	gmap_pmd_op_end(gmap, pmdp);
1138	}
1139	if (rc) {
1140	if (rc == -EINVAL)
1141	return rc;
1142		1002
1143	/* -EAGAIN, fixup of userspace mm and gmap */	1003	pmdp = gmap_pmd_op_walk(gmap, gaddr);
1144	vmaddr = __gmap_translate(gmap, gaddr);	1004	if (!pmdp)
1145	if (IS_ERR_VALUE(vmaddr))	1005	return -EAGAIN;
1146	return vmaddr;
1147	rc = gmap_pte_op_fixup(gmap, gaddr, vmaddr, prot);
1148	if (rc)
1149	return rc;
1150	}
1151	}
1152	return 0;
1153	}
1154		1006
1155	/**	1007	if (!pmd_leaf(*pmdp)) {
1156	* gmap_mprotect_notify - change access rights for a range of ptes and	1008	rc = gmap_protect_pte(gmap, gaddr, pmdp, prot, bits);
1157	* call the notifier if any pte changes again	1009	if (!rc)
1158	* @gmap: pointer to guest mapping meta data structure	1010	rc = PAGE_SIZE;
1159	* @gaddr: virtual address in the guest address space	1011	} else {
1160	* @len: size of area	1012	rc = gmap_protect_pmd(gmap, gaddr, pmdp, prot, bits);
1161	* @prot: indicates access rights: PROT_NONE, PROT_READ or PROT_WRITE	1013	if (!rc)
1162	*	1014	rc = HPAGE_SIZE;
1163	* Returns 0 if for each page in the given range a gmap mapping exists,	1015	}
1164	* the new access rights could be set and the notifier could be armed.	1016	gmap_pmd_op_end(gmap, pmdp);
1165	* If the gmap mapping is missing for one or more pages -EFAULT is
1166	* returned. If no memory could be allocated -ENOMEM is returned.
1167	* This function establishes missing page table entries.
1168	*/
1169	int gmap_mprotect_notify(struct gmap *gmap, unsigned long gaddr,
1170	unsigned long len, int prot)
1171	{
1172	int rc;
1173		1017
1174	if ((gaddr & ~PAGE_MASK) \|\| (len & ~PAGE_MASK) \|\| gmap_is_shadow(gmap))
1175	return -EINVAL;
1176	if (!MACHINE_HAS_ESOP && prot == PROT_READ)
1177	return -EINVAL;
1178	mmap_read_lock(gmap->mm);
1179	rc = gmap_protect_range(gmap, gaddr, len, prot, GMAP_NOTIFY_MPROT);
1180	mmap_read_unlock(gmap->mm);
1181	return rc;	1018	return rc;
1182	}	1019	}
1183	EXPORT_SYMBOL_GPL(gmap_mprotect_notify);	1020	EXPORT_SYMBOL_GPL(gmap_protect_one);
1184		1021
1185	/**	1022	/**
1186	* gmap_read_table - get an unsigned long value from a guest page table using	1023	* gmap_read_table - get an unsigned long value from a guest page table using
@@ -1414,7 +1251,6 @@ static void gmap_unshadow_pgt(struct gmap *sg, unsigned long raddr) · 227 unmodified lines
1414	__gmap_unshadow_pgt(sg, raddr, __va(pgt));	1251	__gmap_unshadow_pgt(sg, raddr, __va(pgt));
1415	/* Free page table */	1252	/* Free page table */
1416	ptdesc = page_ptdesc(phys_to_page(pgt));	1253	ptdesc = page_ptdesc(phys_to_page(pgt));
1417	list_del(&ptdesc->pt_list);
1418	page_table_free_pgste(ptdesc);	1254	page_table_free_pgste(ptdesc);
1419	}	1255	}
1420		1256
@@ -1442,7 +1278,6 @@ static void __gmap_unshadow_sgt(struct gmap *sg, unsigned long raddr, · 21 unmodified lines
1442	__gmap_unshadow_pgt(sg, raddr, __va(pgt));	1278	__gmap_unshadow_pgt(sg, raddr, __va(pgt));
1443	/* Free page table */	1279	/* Free page table */
1444	ptdesc = page_ptdesc(phys_to_page(pgt));	1280	ptdesc = page_ptdesc(phys_to_page(pgt));
1445	list_del(&ptdesc->pt_list);
1446	page_table_free_pgste(ptdesc);	1281	page_table_free_pgste(ptdesc);
1447	}	1282	}
1448	}	1283	}
@@ -1472,7 +1307,6 @@ static void gmap_unshadow_sgt(struct gmap *sg, unsigned long raddr) · 23 unmodified lines
1472	__gmap_unshadow_sgt(sg, raddr, __va(sgt));	1307	__gmap_unshadow_sgt(sg, raddr, __va(sgt));
1473	/* Free segment table */	1308	/* Free segment table */
1474	page = phys_to_page(sgt);	1309	page = phys_to_page(sgt);
1475	list_del(&page->lru);
1476	__free_pages(page, CRST_ALLOC_ORDER);	1310	__free_pages(page, CRST_ALLOC_ORDER);
1477	}	1311	}
1478		1312
@@ -1500,7 +1334,6 @@ static void __gmap_unshadow_r3t(struct gmap *sg, unsigned long raddr, · 21 unmodified lines
1500	__gmap_unshadow_sgt(sg, raddr, __va(sgt));	1334	__gmap_unshadow_sgt(sg, raddr, __va(sgt));
1501	/* Free segment table */	1335	/* Free segment table */
1502	page = phys_to_page(sgt);	1336	page = phys_to_page(sgt);
1503	list_del(&page->lru);
1504	__free_pages(page, CRST_ALLOC_ORDER);	1337	__free_pages(page, CRST_ALLOC_ORDER);
1505	}	1338	}
1506	}	1339	}
@@ -1530,7 +1363,6 @@ static void gmap_unshadow_r3t(struct gmap *sg, unsigned long raddr) · 23 unmodified lines
1530	__gmap_unshadow_r3t(sg, raddr, __va(r3t));	1363	__gmap_unshadow_r3t(sg, raddr, __va(r3t));
1531	/* Free region 3 table */	1364	/* Free region 3 table */
1532	page = phys_to_page(r3t);	1365	page = phys_to_page(r3t);
1533	list_del(&page->lru);
1534	__free_pages(page, CRST_ALLOC_ORDER);	1366	__free_pages(page, CRST_ALLOC_ORDER);
1535	}	1367	}
1536		1368
@@ -1558,7 +1390,6 @@ static void __gmap_unshadow_r2t(struct gmap *sg, unsigned long raddr, · 21 unmodified lines
1558	__gmap_unshadow_r3t(sg, raddr, __va(r3t));	1390	__gmap_unshadow_r3t(sg, raddr, __va(r3t));
1559	/* Free region 3 table */	1391	/* Free region 3 table */
1560	page = phys_to_page(r3t);	1392	page = phys_to_page(r3t);
1561	list_del(&page->lru);
1562	__free_pages(page, CRST_ALLOC_ORDER);	1393	__free_pages(page, CRST_ALLOC_ORDER);
1563	}	1394	}
1564	}	1395	}
@@ -1588,7 +1419,6 @@ static void gmap_unshadow_r2t(struct gmap *sg, unsigned long raddr) · 23 unmodified lines
1588	__gmap_unshadow_r2t(sg, raddr, __va(r2t));	1419	__gmap_unshadow_r2t(sg, raddr, __va(r2t));
1589	/* Free region 2 table */	1420	/* Free region 2 table */
1590	page = phys_to_page(r2t);	1421	page = phys_to_page(r2t);
1591	list_del(&page->lru);
1592	__free_pages(page, CRST_ALLOC_ORDER);	1422	__free_pages(page, CRST_ALLOC_ORDER);
1593	}	1423	}
1594		1424
@@ -1620,7 +1450,6 @@ static void __gmap_unshadow_r1t(struct gmap *sg, unsigned long raddr, · 25 unmodified lines
1620	r1t[i] = _REGION1_ENTRY_EMPTY;	1450	r1t[i] = _REGION1_ENTRY_EMPTY;
1621	/* Free region 2 table */	1451	/* Free region 2 table */
1622	page = phys_to_page(r2t);	1452	page = phys_to_page(r2t);
1623	list_del(&page->lru);
1624	__free_pages(page, CRST_ALLOC_ORDER);	1453	__free_pages(page, CRST_ALLOC_ORDER);
1625	}	1454	}
1626	}	1455	}
@@ -1631,7 +1460,7 @@ static void __gmap_unshadow_r1t(struct gmap *sg, unsigned long raddr, · 4 unmodified lines
1631	*	1460	*
1632	* Called with sg->guest_table_lock	1461	* Called with sg->guest_table_lock
1633	*/	1462	*/
1634	static void gmap_unshadow(struct gmap *sg)	1463	void gmap_unshadow(struct gmap *sg)
1635	{	1464	{
1636	unsigned long *table;	1465	unsigned long *table;
1637		1466
@@ -1657,143 +1486,7 @@ static void gmap_unshadow(struct gmap *sg) · 19 unmodified lines
1657	break;	1486	break;
1658	}	1487	}
1659	}	1488	}
1660		1489	EXPORT_SYMBOL(gmap_unshadow);
1661	/**
1662	* gmap_find_shadow - find a specific asce in the list of shadow tables
1663	* @parent: pointer to the parent gmap
1664	* @asce: ASCE for which the shadow table is created
1665	* @edat_level: edat level to be used for the shadow translation
1666	*
1667	* Returns the pointer to a gmap if a shadow table with the given asce is
1668	* already available, ERR_PTR(-EAGAIN) if another one is just being created,
1669	* otherwise NULL
1670	*/
1671	static struct gmap gmap_find_shadow(struct gmap parent, unsigned long asce,
1672	int edat_level)
1673	{
1674	struct gmap *sg;
1675
1676	list_for_each_entry(sg, &parent->children, list) {
1677	if (sg->orig_asce != asce \|\| sg->edat_level != edat_level \|\|
1678	sg->removed)
1679	continue;
1680	if (!sg->initialized)
1681	return ERR_PTR(-EAGAIN);
1682	refcount_inc(&sg->ref_count);
1683	return sg;
1684	}
1685	return NULL;
1686	}
1687
1688	/**
1689	* gmap_shadow_valid - check if a shadow guest address space matches the
1690	* given properties and is still valid
1691	* @sg: pointer to the shadow guest address space structure
1692	* @asce: ASCE for which the shadow table is requested
1693	* @edat_level: edat level to be used for the shadow translation
1694	*
1695	* Returns 1 if the gmap shadow is still valid and matches the given
1696	* properties, the caller can continue using it. Returns 0 otherwise, the
1697	* caller has to request a new shadow gmap in this case.
1698	*
1699	*/
1700	int gmap_shadow_valid(struct gmap *sg, unsigned long asce, int edat_level)
1701	{
1702	if (sg->removed)
1703	return 0;
1704	return sg->orig_asce == asce && sg->edat_level == edat_level;
1705	}
1706	EXPORT_SYMBOL_GPL(gmap_shadow_valid);
1707
1708	/**
1709	* gmap_shadow - create/find a shadow guest address space
1710	* @parent: pointer to the parent gmap
1711	* @asce: ASCE for which the shadow table is created
1712	* @edat_level: edat level to be used for the shadow translation
1713	*
1714	* The pages of the top level page table referred by the asce parameter
1715	* will be set to read-only and marked in the PGSTEs of the kvm process.
1716	* The shadow table will be removed automatically on any change to the
1717	* PTE mapping for the source table.
1718	*
1719	* Returns a guest address space structure, ERR_PTR(-ENOMEM) if out of memory,
1720	* ERR_PTR(-EAGAIN) if the caller has to retry and ERR_PTR(-EFAULT) if the
1721	* parent gmap table could not be protected.
1722	*/
1723	struct gmap gmap_shadow(struct gmap parent, unsigned long asce,
1724	int edat_level)
1725	{
1726	struct gmap sg, new;
1727	unsigned long limit;
1728	int rc;
1729
1730	BUG_ON(parent->mm->context.allow_gmap_hpage_1m);
1731	BUG_ON(gmap_is_shadow(parent));
1732	spin_lock(&parent->shadow_lock);
1733	sg = gmap_find_shadow(parent, asce, edat_level);
1734	spin_unlock(&parent->shadow_lock);
1735	if (sg)
1736	return sg;
1737	/* Create a new shadow gmap */
1738	limit = -1UL >> (33 - (((asce & _ASCE_TYPE_MASK) >> 2) * 11));
1739	if (asce & _ASCE_REAL_SPACE)
1740	limit = -1UL;
1741	new = gmap_alloc(limit);
1742	if (!new)
1743	return ERR_PTR(-ENOMEM);
1744	new->mm = parent->mm;
1745	new->parent = gmap_get(parent);
1746	new->private = parent->private;
1747	new->orig_asce = asce;
1748	new->edat_level = edat_level;
1749	new->initialized = false;
1750	spin_lock(&parent->shadow_lock);
1751	/* Recheck if another CPU created the same shadow */
1752	sg = gmap_find_shadow(parent, asce, edat_level);
1753	if (sg) {
1754	spin_unlock(&parent->shadow_lock);
1755	gmap_free(new);
1756	return sg;
1757	}
1758	if (asce & _ASCE_REAL_SPACE) {
1759	/* only allow one real-space gmap shadow */
1760	list_for_each_entry(sg, &parent->children, list) {
1761	if (sg->orig_asce & _ASCE_REAL_SPACE) {
1762	spin_lock(&sg->guest_table_lock);
1763	gmap_unshadow(sg);
1764	spin_unlock(&sg->guest_table_lock);
1765	list_del(&sg->list);
1766	gmap_put(sg);
1767	break;
1768	}
1769	}
1770	}
1771	refcount_set(&new->ref_count, 2);
1772	list_add(&new->list, &parent->children);
1773	if (asce & _ASCE_REAL_SPACE) {
1774	/* nothing to protect, return right away */
1775	new->initialized = true;
1776	spin_unlock(&parent->shadow_lock);
1777	return new;
1778	}
1779	spin_unlock(&parent->shadow_lock);
1780	/* protect after insertion, so it will get properly invalidated */
1781	mmap_read_lock(parent->mm);
1782	rc = gmap_protect_range(parent, asce & _ASCE_ORIGIN,
1783	((asce & _ASCE_TABLE_LENGTH) + 1) * PAGE_SIZE,
1784	PROT_READ, GMAP_NOTIFY_SHADOW);
1785	mmap_read_unlock(parent->mm);
1786	spin_lock(&parent->shadow_lock);
1787	new->initialized = true;
1788	if (rc) {
1789	list_del(&new->list);
1790	gmap_free(new);
1791	new = ERR_PTR(rc);
1792	}
1793	spin_unlock(&parent->shadow_lock);
1794	return new;
1795	}
1796	EXPORT_SYMBOL_GPL(gmap_shadow);
1797		1490
1798	/**	1491	/**
1799	* gmap_shadow_r2t - create an empty shadow region 2 table	1492	* gmap_shadow_r2t - create an empty shadow region 2 table
@@ -1827,9 +1520,6 @@ int gmap_shadow_r2t(struct gmap *sg, unsigned long saddr, unsigned long r2t, · 27 unmodified lines
1827	page = gmap_alloc_crst();	1520	page = gmap_alloc_crst();
1828	if (!page)	1521	if (!page)
1829	return -ENOMEM;	1522	return -ENOMEM;
1830	page->index = r2t & _REGION_ENTRY_ORIGIN;
1831	if (fake)
1832	page->index \|= GMAP_SHADOW_FAKE_TABLE;
1833	s_r2t = page_to_phys(page);	1523	s_r2t = page_to_phys(page);
1834	/* Install shadow region second table */	1524	/* Install shadow region second table */
1835	spin_lock(&sg->guest_table_lock);	1525	spin_lock(&sg->guest_table_lock);
@@ -1851,7 +1541,6 @@ int gmap_shadow_r2t(struct gmap *sg, unsigned long saddr, unsigned long r2t, · 15 unmodified lines
1851	_REGION_ENTRY_TYPE_R1 \| _REGION_ENTRY_INVALID;	1541	_REGION_ENTRY_TYPE_R1 \| _REGION_ENTRY_INVALID;
1852	if (sg->edat_level >= 1)	1542	if (sg->edat_level >= 1)
1853	*table \|= (r2t & _REGION_ENTRY_PROTECT);	1543	*table \|= (r2t & _REGION_ENTRY_PROTECT);
1854	list_add(&page->lru, &sg->crst_list);
1855	if (fake) {	1544	if (fake) {
1856	/* nothing to protect for fake tables */	1545	/* nothing to protect for fake tables */
1857	*table &= ~_REGION_ENTRY_INVALID;	1546	*table &= ~_REGION_ENTRY_INVALID;
@@ -1911,9 +1600,6 @@ int gmap_shadow_r3t(struct gmap *sg, unsigned long saddr, unsigned long r3t, · 53 unmodified lines
1911	page = gmap_alloc_crst();	1600	page = gmap_alloc_crst();
1912	if (!page)	1601	if (!page)
1913	return -ENOMEM;	1602	return -ENOMEM;
1914	page->index = r3t & _REGION_ENTRY_ORIGIN;
1915	if (fake)
1916	page->index \|= GMAP_SHADOW_FAKE_TABLE;
1917	s_r3t = page_to_phys(page);	1603	s_r3t = page_to_phys(page);
1918	/* Install shadow region second table */	1604	/* Install shadow region second table */
1919	spin_lock(&sg->guest_table_lock);	1605	spin_lock(&sg->guest_table_lock);
@@ -1935,7 +1621,6 @@ int gmap_shadow_r3t(struct gmap *sg, unsigned long saddr, unsigned long r3t, · 15 unmodified lines
1935	_REGION_ENTRY_TYPE_R2 \| _REGION_ENTRY_INVALID;	1621	_REGION_ENTRY_TYPE_R2 \| _REGION_ENTRY_INVALID;
1936	if (sg->edat_level >= 1)	1622	if (sg->edat_level >= 1)
1937	*table \|= (r3t & _REGION_ENTRY_PROTECT);	1623	*table \|= (r3t & _REGION_ENTRY_PROTECT);
1938	list_add(&page->lru, &sg->crst_list);
1939	if (fake) {	1624	if (fake) {
1940	/* nothing to protect for fake tables */	1625	/* nothing to protect for fake tables */
1941	*table &= ~_REGION_ENTRY_INVALID;	1626	*table &= ~_REGION_ENTRY_INVALID;
@@ -1995,9 +1680,6 @@ int gmap_shadow_sgt(struct gmap *sg, unsigned long saddr, unsigned long sgt, · 53 unmodified lines
1995	page = gmap_alloc_crst();	1680	page = gmap_alloc_crst();
1996	if (!page)	1681	if (!page)
1997	return -ENOMEM;	1682	return -ENOMEM;
1998	page->index = sgt & _REGION_ENTRY_ORIGIN;
1999	if (fake)
2000	page->index \|= GMAP_SHADOW_FAKE_TABLE;
2001	s_sgt = page_to_phys(page);	1683	s_sgt = page_to_phys(page);
2002	/* Install shadow region second table */	1684	/* Install shadow region second table */
2003	spin_lock(&sg->guest_table_lock);	1685	spin_lock(&sg->guest_table_lock);
@@ -2019,7 +1701,6 @@ int gmap_shadow_sgt(struct gmap *sg, unsigned long saddr, unsigned long sgt, · 15 unmodified lines
2019	_REGION_ENTRY_TYPE_R3 \| _REGION_ENTRY_INVALID;	1701	_REGION_ENTRY_TYPE_R3 \| _REGION_ENTRY_INVALID;
2020	if (sg->edat_level >= 1)	1702	if (sg->edat_level >= 1)
2021	*table \|= sgt & _REGION_ENTRY_PROTECT;	1703	*table \|= sgt & _REGION_ENTRY_PROTECT;
2022	list_add(&page->lru, &sg->crst_list);
2023	if (fake) {	1704	if (fake) {
2024	/* nothing to protect for fake tables */	1705	/* nothing to protect for fake tables */
2025	*table &= ~_REGION_ENTRY_INVALID;	1706	*table &= ~_REGION_ENTRY_INVALID;
@@ -2052,45 +1733,22 @@ out_free: · 26 unmodified lines
2052	}	1733	}
2053	EXPORT_SYMBOL_GPL(gmap_shadow_sgt);	1734	EXPORT_SYMBOL_GPL(gmap_shadow_sgt);
2054		1735
2055	/**	1736	static void gmap_pgste_set_pgt_addr(struct ptdesc *ptdesc, unsigned long pgt_addr)
2056	* gmap_shadow_pgt_lookup - find a shadow page table
2057	* @sg: pointer to the shadow guest address space structure
2058	* @saddr: the address in the shadow aguest address space
2059	* @pgt: parent gmap address of the page table to get shadowed
2060	* @dat_protection: if the pgtable is marked as protected by dat
2061	* @fake: pgt references contiguous guest memory block, not a pgtable
2062	*
2063	* Returns 0 if the shadow page table was found and -EAGAIN if the page
2064	* table was not found.
2065	*
2066	* Called with sg->mm->mmap_lock in read.
2067	*/
2068	int gmap_shadow_pgt_lookup(struct gmap *sg, unsigned long saddr,
2069	unsigned long pgt, int dat_protection,
2070	int *fake)
2071	{	1737	{
2072	unsigned long *table;	1738	unsigned long *pgstes = page_to_virt(ptdesc_page(ptdesc));
2073	struct page *page;
2074	int rc;
2075		1739
2076	BUG_ON(!gmap_is_shadow(sg));	1740	pgstes += _PAGE_ENTRIES;
2077	spin_lock(&sg->guest_table_lock);	1741
2078	table = gmap_table_walk(sg, saddr, 1); /* get segment pointer */	1742	pgstes[0] &= ~PGSTE_ST2_MASK;
2079	if (table && !(*table & _SEGMENT_ENTRY_INVALID)) {	1743	pgstes[1] &= ~PGSTE_ST2_MASK;
2080	/* Shadow page tables are full pages (pte+pgste) */	1744	pgstes[2] &= ~PGSTE_ST2_MASK;
2081	page = pfn_to_page(*table >> PAGE_SHIFT);	1745	pgstes[3] &= ~PGSTE_ST2_MASK;
2082	*pgt = page->index & ~GMAP_SHADOW_FAKE_TABLE;
2083	dat_protection = !!(table & _SEGMENT_ENTRY_PROTECT);
2084	*fake = !!(page->index & GMAP_SHADOW_FAKE_TABLE);
2085	rc = 0;
2086	} else {
2087	rc = -EAGAIN;
2088	}
2089	spin_unlock(&sg->guest_table_lock);
2090	return rc;
2091		1746
		1747	pgstes[0] \|= (pgt_addr >> 16) & PGSTE_ST2_MASK;
		1748	pgstes[1] \|= pgt_addr & PGSTE_ST2_MASK;
		1749	pgstes[2] \|= (pgt_addr << 16) & PGSTE_ST2_MASK;
		1750	pgstes[3] \|= (pgt_addr << 32) & PGSTE_ST2_MASK;
2092	}	1751	}
2093	EXPORT_SYMBOL_GPL(gmap_shadow_pgt_lookup);
2094		1752
2095	/**	1753	/**
2096	* gmap_shadow_pgt - instantiate a shadow page table	1754	* gmap_shadow_pgt - instantiate a shadow page table
@@ -2119,9 +1777,10 @@ int gmap_shadow_pgt(struct gmap *sg, unsigned long saddr, unsigned long pgt, · 22 unmodified lines
2119	ptdesc = page_table_alloc_pgste(sg->mm);	1777	ptdesc = page_table_alloc_pgste(sg->mm);
2120	if (!ptdesc)	1778	if (!ptdesc)
2121	return -ENOMEM;	1779	return -ENOMEM;
2122	ptdesc->pt_index = pgt & _SEGMENT_ENTRY_ORIGIN;	1780	origin = pgt & _SEGMENT_ENTRY_ORIGIN;
2123	if (fake)	1781	if (fake)
2124	ptdesc->pt_index \|= GMAP_SHADOW_FAKE_TABLE;	1782	origin \|= GMAP_SHADOW_FAKE_TABLE;
		1783	gmap_pgste_set_pgt_addr(ptdesc, origin);
2125	s_pgt = page_to_phys(ptdesc_page(ptdesc));	1784	s_pgt = page_to_phys(ptdesc_page(ptdesc));
2126	/* Install shadow page table */	1785	/* Install shadow page table */
2127	spin_lock(&sg->guest_table_lock);	1786	spin_lock(&sg->guest_table_lock);
@@ -2140,7 +1799,6 @@ int gmap_shadow_pgt(struct gmap *sg, unsigned long saddr, unsigned long pgt, · 12 unmodified lines
2140	/* mark as invalid as long as the parent table is not protected */	1799	/* mark as invalid as long as the parent table is not protected */
2141	*table = (unsigned long) s_pgt \| _SEGMENT_ENTRY \|	1800	*table = (unsigned long) s_pgt \| _SEGMENT_ENTRY \|
2142	(pgt & _SEGMENT_ENTRY_PROTECT) \| _SEGMENT_ENTRY_INVALID;	1801	(pgt & _SEGMENT_ENTRY_PROTECT) \| _SEGMENT_ENTRY_INVALID;
2143	list_add(&ptdesc->pt_list, &sg->pt_list);
2144	if (fake) {	1802	if (fake) {
2145	/* nothing to protect for fake tables */	1803	/* nothing to protect for fake tables */
2146	*table &= ~_SEGMENT_ENTRY_INVALID;	1804	*table &= ~_SEGMENT_ENTRY_INVALID;
@@ -2318,7 +1976,6 @@ void ptep_notify(struct mm_struct *mm, unsigned long vmaddr, · 171 unmodified lines
2318	pte_t *pte, unsigned long bits)	1976	pte_t *pte, unsigned long bits)
2319	{	1977	{
2320	unsigned long offset, gaddr = 0;	1978	unsigned long offset, gaddr = 0;
2321	unsigned long *table;
2322	struct gmap gmap, sg, *next;	1979	struct gmap gmap, sg, *next;
2323		1980
2324	offset = ((unsigned long) pte) & (255 * sizeof(pte_t));	1981	offset = ((unsigned long) pte) & (255 * sizeof(pte_t));
@@ -2326,12 +1983,9 @@ void ptep_notify(struct mm_struct *mm, unsigned long vmaddr, · 1 unmodified line
2326	rcu_read_lock();	1983	rcu_read_lock();
2327	list_for_each_entry_rcu(gmap, &mm->context.gmap_list, list) {	1984	list_for_each_entry_rcu(gmap, &mm->context.gmap_list, list) {
2328	spin_lock(&gmap->guest_table_lock);	1985	spin_lock(&gmap->guest_table_lock);
2329	table = radix_tree_lookup(&gmap->host_to_guest,	1986	gaddr = host_to_guest_lookup(gmap, vmaddr) + offset;
2330	vmaddr >> PMD_SHIFT);
2331	if (table)
2332	gaddr = __gmap_segment_gaddr(table) + offset;
2333	spin_unlock(&gmap->guest_table_lock);	1987	spin_unlock(&gmap->guest_table_lock);
2334	if (!table)	1988	if (!IS_GADDR_VALID(gaddr))
2335	continue;	1989	continue;
2336		1990
2337	if (!list_empty(&gmap->children) && (bits & PGSTE_VSIE_BIT)) {	1991	if (!list_empty(&gmap->children) && (bits & PGSTE_VSIE_BIT)) {
@@ -2391,10 +2045,8 @@ static void gmap_pmdp_clear(struct mm_struct *mm, unsigned long vmaddr, · 53 unmodified lines
2391	rcu_read_lock();	2045	rcu_read_lock();
2392	list_for_each_entry_rcu(gmap, &mm->context.gmap_list, list) {	2046	list_for_each_entry_rcu(gmap, &mm->context.gmap_list, list) {
2393	spin_lock(&gmap->guest_table_lock);	2047	spin_lock(&gmap->guest_table_lock);
2394	pmdp = (pmd_t *)radix_tree_delete(&gmap->host_to_guest,	2048	pmdp = host_to_guest_pmd_delete(gmap, vmaddr, &gaddr);
2395	vmaddr >> PMD_SHIFT);
2396	if (pmdp) {	2049	if (pmdp) {
2397	gaddr = __gmap_segment_gaddr((unsigned long *)pmdp);
2398	pmdp_notify_gmap(gmap, pmdp, gaddr);	2050	pmdp_notify_gmap(gmap, pmdp, gaddr);
2399	WARN_ON(pmd_val(*pmdp) & ~(_SEGMENT_ENTRY_HARDWARE_BITS_LARGE \|	2051	WARN_ON(pmd_val(*pmdp) & ~(_SEGMENT_ENTRY_HARDWARE_BITS_LARGE \|
2400	_SEGMENT_ENTRY_GMAP_UC \|	2052	_SEGMENT_ENTRY_GMAP_UC \|
@@ -2438,28 +2090,25 @@ EXPORT_SYMBOL_GPL(gmap_pmdp_csp); · 37 unmodified lines
2438	*/	2090	*/
2439	void gmap_pmdp_idte_local(struct mm_struct *mm, unsigned long vmaddr)	2091	void gmap_pmdp_idte_local(struct mm_struct *mm, unsigned long vmaddr)
2440	{	2092	{
2441	unsigned long *entry, gaddr;	2093	unsigned long gaddr;
2442	struct gmap *gmap;	2094	struct gmap *gmap;
2443	pmd_t *pmdp;	2095	pmd_t *pmdp;
2444		2096
2445	rcu_read_lock();	2097	rcu_read_lock();
2446	list_for_each_entry_rcu(gmap, &mm->context.gmap_list, list) {	2098	list_for_each_entry_rcu(gmap, &mm->context.gmap_list, list) {
2447	spin_lock(&gmap->guest_table_lock);	2099	spin_lock(&gmap->guest_table_lock);
2448	entry = radix_tree_delete(&gmap->host_to_guest,	2100	pmdp = host_to_guest_pmd_delete(gmap, vmaddr, &gaddr);
2449	vmaddr >> PMD_SHIFT);	2101	if (pmdp) {
2450	if (entry) {
2451	pmdp = (pmd_t *)entry;
2452	gaddr = __gmap_segment_gaddr(entry);
2453	pmdp_notify_gmap(gmap, pmdp, gaddr);	2102	pmdp_notify_gmap(gmap, pmdp, gaddr);
2454	WARN_ON(*entry & ~(_SEGMENT_ENTRY_HARDWARE_BITS_LARGE \|	2103	WARN_ON(pmd_val(*pmdp) & ~(_SEGMENT_ENTRY_HARDWARE_BITS_LARGE \|
2455	_SEGMENT_ENTRY_GMAP_UC \|	2104	_SEGMENT_ENTRY_GMAP_UC \|
2456	_SEGMENT_ENTRY));	2105	_SEGMENT_ENTRY));
2457	if (MACHINE_HAS_TLB_GUEST)	2106	if (MACHINE_HAS_TLB_GUEST)
2458	__pmdp_idte(gaddr, pmdp, IDTE_GUEST_ASCE,	2107	__pmdp_idte(gaddr, pmdp, IDTE_GUEST_ASCE,
2459	gmap->asce, IDTE_LOCAL);	2108	gmap->asce, IDTE_LOCAL);
2460	else if (MACHINE_HAS_IDTE)	2109	else if (MACHINE_HAS_IDTE)
2461	__pmdp_idte(gaddr, pmdp, 0, 0, IDTE_LOCAL);	2110	__pmdp_idte(gaddr, pmdp, 0, 0, IDTE_LOCAL);
2462	*entry = _SEGMENT_ENTRY_EMPTY;	2111	*pmdp = __pmd(_SEGMENT_ENTRY_EMPTY);
2463	}	2112	}
2464	spin_unlock(&gmap->guest_table_lock);	2113	spin_unlock(&gmap->guest_table_lock);
2465	}	2114	}
@@ -2474,22 +2123,19 @@ EXPORT_SYMBOL_GPL(gmap_pmdp_idte_local); · 8 unmodified lines
2474	*/	2123	*/
2475	void gmap_pmdp_idte_global(struct mm_struct *mm, unsigned long vmaddr)	2124	void gmap_pmdp_idte_global(struct mm_struct *mm, unsigned long vmaddr)
2476	{	2125	{
2477	unsigned long *entry, gaddr;	2126	unsigned long gaddr;
2478	struct gmap *gmap;	2127	struct gmap *gmap;
2479	pmd_t *pmdp;	2128	pmd_t *pmdp;
2480		2129
2481	rcu_read_lock();	2130	rcu_read_lock();
2482	list_for_each_entry_rcu(gmap, &mm->context.gmap_list, list) {	2131	list_for_each_entry_rcu(gmap, &mm->context.gmap_list, list) {
2483	spin_lock(&gmap->guest_table_lock);	2132	spin_lock(&gmap->guest_table_lock);
2484	entry = radix_tree_delete(&gmap->host_to_guest,	2133	pmdp = host_to_guest_pmd_delete(gmap, vmaddr, &gaddr);
2485	vmaddr >> PMD_SHIFT);	2134	if (pmdp) {
2486	if (entry) {
2487	pmdp = (pmd_t *)entry;
2488	gaddr = __gmap_segment_gaddr(entry);
2489	pmdp_notify_gmap(gmap, pmdp, gaddr);	2135	pmdp_notify_gmap(gmap, pmdp, gaddr);
2490	WARN_ON(*entry & ~(_SEGMENT_ENTRY_HARDWARE_BITS_LARGE \|	2136	WARN_ON(pmd_val(*pmdp) & ~(_SEGMENT_ENTRY_HARDWARE_BITS_LARGE \|
2491	_SEGMENT_ENTRY_GMAP_UC \|	2137	_SEGMENT_ENTRY_GMAP_UC \|
2492	_SEGMENT_ENTRY));	2138	_SEGMENT_ENTRY));
2493	if (MACHINE_HAS_TLB_GUEST)	2139	if (MACHINE_HAS_TLB_GUEST)
2494	__pmdp_idte(gaddr, pmdp, IDTE_GUEST_ASCE,	2140	__pmdp_idte(gaddr, pmdp, IDTE_GUEST_ASCE,
2495	gmap->asce, IDTE_GLOBAL);	2141	gmap->asce, IDTE_GLOBAL);
@@ -2497,7 +2143,7 @@ void gmap_pmdp_idte_global(struct mm_struct *mm, unsigned long vmaddr) · 1 unmodified line
2497	__pmdp_idte(gaddr, pmdp, 0, 0, IDTE_GLOBAL);	2143	__pmdp_idte(gaddr, pmdp, 0, 0, IDTE_GLOBAL);
2498	else	2144	else
2499	__pmdp_csp(pmdp);	2145	__pmdp_csp(pmdp);
2500	*entry = _SEGMENT_ENTRY_EMPTY;	2146	*pmdp = __pmd(_SEGMENT_ENTRY_EMPTY);
2501	}	2147	}
2502	spin_unlock(&gmap->guest_table_lock);	2148	spin_unlock(&gmap->guest_table_lock);
2503	}	2149	}
@@ -2942,49 +2588,6 @@ int __s390_uv_destroy_range(struct mm_struct *mm, unsigned long start, · 438 unmodified lines
2942	}	2588	}
2943	EXPORT_SYMBOL_GPL(__s390_uv_destroy_range);	2589	EXPORT_SYMBOL_GPL(__s390_uv_destroy_range);
2944		2590
2945	/**
2946	* s390_unlist_old_asce - Remove the topmost level of page tables from the
2947	* list of page tables of the gmap.
2948	* @gmap: the gmap whose table is to be removed
2949	*
2950	* On s390x, KVM keeps a list of all pages containing the page tables of the
2951	* gmap (the CRST list). This list is used at tear down time to free all
2952	* pages that are now not needed anymore.
2953	*
2954	* This function removes the topmost page of the tree (the one pointed to by
2955	* the ASCE) from the CRST list.
2956	*
2957	* This means that it will not be freed when the VM is torn down, and needs
2958	* to be handled separately by the caller, unless a leak is actually
2959	* intended. Notice that this function will only remove the page from the
2960	* list, the page will still be used as a top level page table (and ASCE).
2961	*/
2962	void s390_unlist_old_asce(struct gmap *gmap)
2963	{
2964	struct page *old;
2965
2966	old = virt_to_page(gmap->table);
2967	spin_lock(&gmap->guest_table_lock);
2968	list_del(&old->lru);
2969	/*
2970	* Sometimes the topmost page might need to be "removed" multiple
2971	* times, for example if the VM is rebooted into secure mode several
2972	* times concurrently, or if s390_replace_asce fails after calling
2973	* s390_remove_old_asce and is attempted again later. In that case
2974	* the old asce has been removed from the list, and therefore it
2975	* will not be freed when the VM terminates, but the ASCE is still
2976	* in use and still pointed to.
2977	* A subsequent call to replace_asce will follow the pointer and try
2978	* to remove the same page from the list again.
2979	* Therefore it's necessary that the page of the ASCE has valid
2980	* pointers, so list_del can work (and do nothing) without
2981	* dereferencing stale or invalid pointers.
2982	*/
2983	INIT_LIST_HEAD(&old->lru);
2984	spin_unlock(&gmap->guest_table_lock);
2985	}
2986	EXPORT_SYMBOL_GPL(s390_unlist_old_asce);
2987
2988	/**	2591	/**
2989	* s390_replace_asce - Try to replace the current ASCE of a gmap with a copy	2592	* s390_replace_asce - Try to replace the current ASCE of a gmap with a copy
2990	* @gmap: the gmap whose ASCE needs to be replaced	2593	* @gmap: the gmap whose ASCE needs to be replaced
@@ -3004,8 +2607,6 @@ int s390_replace_asce(struct gmap *gmap) · 13 unmodified lines
3004	struct page *page;	2607	struct page *page;
3005	void *table;	2608	void *table;
3006		2609
3007	s390_unlist_old_asce(gmap);
3008
3009	/* Replacing segment type ASCEs would cause serious issues */	2610	/* Replacing segment type ASCEs would cause serious issues */
3010	if ((gmap->asce & _ASCE_TYPE_MASK) == _ASCE_TYPE_SEGMENT)	2611	if ((gmap->asce & _ASCE_TYPE_MASK) == _ASCE_TYPE_SEGMENT)
3011	return -EINVAL;	2612	return -EINVAL;
@@ -3013,19 +2614,9 @@ int s390_replace_asce(struct gmap *gmap) · 1 unmodified line
3013	page = gmap_alloc_crst();	2614	page = gmap_alloc_crst();
3014	if (!page)	2615	if (!page)
3015	return -ENOMEM;	2616	return -ENOMEM;
3016	page->index = 0;
3017	table = page_to_virt(page);	2617	table = page_to_virt(page);
3018	memcpy(table, gmap->table, 1UL << (CRST_ALLOC_ORDER + PAGE_SHIFT));	2618	memcpy(table, gmap->table, 1UL << (CRST_ALLOC_ORDER + PAGE_SHIFT));
3019		2619
3020	/*
3021	* The caller has to deal with the old ASCE, but here we make sure
3022	* the new one is properly added to the CRST list, so that
3023	* it will be freed when the VM is torn down.
3024	*/
3025	spin_lock(&gmap->guest_table_lock);
3026	list_add(&page->lru, &gmap->crst_list);
3027	spin_unlock(&gmap->guest_table_lock);
3028
3029	/* Set new table origin while preserving existing ASCE control bits */	2620	/* Set new table origin while preserving existing ASCE control bits */
3030	asce = (gmap->asce & ~_ASCE_ORIGIN) \| __pa(table);	2621	asce = (gmap->asce & ~_ASCE_ORIGIN) \| __pa(table);
3031	WRITE_ONCE(gmap->asce, asce);	2622	WRITE_ONCE(gmap->asce, asce);
@@ -3035,3 +2626,31 @@ int s390_replace_asce(struct gmap *gmap) · 3 unmodified lines
3035	return 0;	2626	return 0;
3036	}	2627	}
3037	EXPORT_SYMBOL_GPL(s390_replace_asce);	2628	EXPORT_SYMBOL_GPL(s390_replace_asce);
		2629
		2630	/**
		2631	* kvm_s390_wiggle_split_folio() - try to drain extra references to a folio and optionally split
		2632	* @mm: the mm containing the folio to work on
		2633	* @folio: the folio
		2634	* @split: whether to split a large folio
		2635	*
		2636	* Context: Must be called while holding an extra reference to the folio;
		2637	* the mm lock should not be held.
		2638	*/
		2639	int kvm_s390_wiggle_split_folio(struct mm_struct mm, struct folio folio, bool split)
		2640	{
		2641	int rc;
		2642
		2643	lockdep_assert_not_held(&mm->mmap_lock);
		2644	folio_wait_writeback(folio);
		2645	lru_add_drain_all();
		2646	if (split) {
		2647	folio_lock(folio);
		2648	rc = split_folio(folio);
		2649	folio_unlock(folio);
		2650
		2651	if (rc != -EBUSY)
		2652	return rc;
		2653	}
		2654	return -EAGAIN;
		2655	}
		2656	EXPORT_SYMBOL_GPL(kvm_s390_wiggle_split_folio);

arch/s390/mm/pgalloc.c+0−2

 	}
 	table = ptdesc_to_virt(ptdesc);
 	__arch_set_page_dat(table, 1);
-	/* pt_list is used by gmap only */
-	INIT_LIST_HEAD(&ptdesc->pt_list);
 	memset64((u64 *)table, _PAGE_INVALID, PTRS_PER_PTE);
 	memset64((u64 *)table + PTRS_PER_PTE, 0, PTRS_PER_PTE);
 	return table;

arch/s390/pci/pci_bus.c+20−0

@@ -331,6 +331,17 @@ error: · 330 unmodified lines
331	return rc;	331	return rc;
332	}	332	}
333		333
		334	static bool zpci_bus_is_isolated_vf(struct zpci_bus zbus, struct zpci_dev zdev)
		335	{
		336	struct pci_dev *pdev;
		337
		338	pdev = zpci_iov_find_parent_pf(zbus, zdev);
		339	if (!pdev)
		340	return true;
		341	pci_dev_put(pdev);
		342	return false;
		343	}
		344
334	int zpci_bus_device_register(struct zpci_dev zdev, struct pci_ops ops)	345	int zpci_bus_device_register(struct zpci_dev zdev, struct pci_ops ops)
335	{	346	{
336	bool topo_is_tid = zdev->tid_avail;	347	bool topo_is_tid = zdev->tid_avail;
@@ -345,6 +356,15 @@ int zpci_bus_device_register(struct zpci_dev zdev, struct pci_ops ops) · 8 unmodified lines
345		356
346	topo = topo_is_tid ? zdev->tid : zdev->pchid;	357	topo = topo_is_tid ? zdev->tid : zdev->pchid;
347	zbus = zpci_bus_get(topo, topo_is_tid);	358	zbus = zpci_bus_get(topo, topo_is_tid);
		359	/*
		360	* An isolated VF gets its own domain/bus even if there exists
		361	* a matching domain/bus already
		362	*/
		363	if (zbus && zpci_bus_is_isolated_vf(zbus, zdev)) {
		364	zpci_bus_put(zbus);
		365	zbus = NULL;
		366	}
		367
348	if (!zbus) {	368	if (!zbus) {
349	zbus = zpci_bus_alloc(topo, topo_is_tid);	369	zbus = zpci_bus_alloc(topo, topo_is_tid);
350	if (!zbus)	370	if (!zbus)

arch/s390/pci/pci_iov.c+42−14

@@ -60,18 +60,35 @@ static int zpci_iov_link_virtfn(struct pci_dev pdev, struct pci_dev virtfn, in · 59 unmodified lines
60	return 0;	60	return 0;
61	}	61	}
62		62
63	int zpci_iov_setup_virtfn(struct zpci_bus zbus, struct pci_dev virtfn, int vfn)	63	/**
		64	* zpci_iov_find_parent_pf - Find the parent PF, if any, of the given function
		65	* @zbus: The bus that the PCI function is on, or would be added on
		66	* @zdev: The PCI function
		67	*
		68	* Finds the parent PF, if it exists and is configured, of the given PCI function
		69	* and increments its refcount. Th PF is searched for on the provided bus so the
		70	* caller has to ensure that this is the correct bus to search. This function may
		71	* be used before adding the PCI function to a zbus.
		72	*
		73	* Return: Pointer to the struct pci_dev of the parent PF or NULL if it not
		74	* found. If the function is not a VF or has no RequesterID information,
		75	* NULL is returned as well.
		76	*/
		77	struct pci_dev zpci_iov_find_parent_pf(struct zpci_bus zbus, struct zpci_dev *zdev)
64	{	78	{
65	int i, cand_devfn;	79	int i, vfid, devfn, cand_devfn;
66	struct zpci_dev *zdev;
67	struct pci_dev *pdev;	80	struct pci_dev *pdev;
68	int vfid = vfn - 1; /* Linux' vfid's start at 0 vfn at 1*/
69	int rc = 0;
70		81
71	if (!zbus->multifunction)	82	if (!zbus->multifunction)
72	return 0;	83	return NULL;
73		84	/* Non-VFs and VFs without RID available don't have a parent */
74	/* If the parent PF for the given VF is also configured in the	85	if (!zdev->vfn \|\| !zdev->rid_available)
		86	return NULL;
		87	/* Linux vfid starts at 0 vfn at 1 */
		88	vfid = zdev->vfn - 1;
		89	devfn = zdev->rid & ZPCI_RID_MASK_DEVFN;
		90	/*
		91	* If the parent PF for the given VF is also configured in the
75	* instance, it must be on the same zbus.	92	* instance, it must be on the same zbus.
76	* We can then identify the parent PF by checking what	93	* We can then identify the parent PF by checking what
77	* devfn the VF would have if it belonged to that PF using the PF's	94	* devfn the VF would have if it belonged to that PF using the PF's
@@ -85,15 +102,26 @@ int zpci_iov_setup_virtfn(struct zpci_bus zbus, struct pci_dev virtfn, int vfn · 7 unmodified lines
85	if (!pdev)	102	if (!pdev)
86	continue;	103	continue;
87	cand_devfn = pci_iov_virtfn_devfn(pdev, vfid);	104	cand_devfn = pci_iov_virtfn_devfn(pdev, vfid);
88	if (cand_devfn == virtfn->devfn) {	105	if (cand_devfn == devfn)
89	rc = zpci_iov_link_virtfn(pdev, virtfn, vfid);	106	return pdev;
90	/* balance pci_get_slot() */
91	pci_dev_put(pdev);
92	break;
93	}
94	/* balance pci_get_slot() */	107	/* balance pci_get_slot() */
95	pci_dev_put(pdev);	108	pci_dev_put(pdev);
96	}	109	}
97	}	110	}
		111	return NULL;
		112	}
		113
		114	int zpci_iov_setup_virtfn(struct zpci_bus zbus, struct pci_dev virtfn, int vfn)
		115	{
		116	struct zpci_dev *zdev = to_zpci(virtfn);
		117	struct pci_dev *pdev_pf;
		118	int rc = 0;
		119
		120	pdev_pf = zpci_iov_find_parent_pf(zbus, zdev);
		121	if (pdev_pf) {
		122	/* Linux' vfids start at 0 while zdev->vfn starts at 1 */
		123	rc = zpci_iov_link_virtfn(pdev_pf, virtfn, zdev->vfn - 1);
		124	pci_dev_put(pdev_pf);
		125	}
98	return rc;	126	return rc;
99	}	127	}

arch/s390/pci/pci_iov.h+7−0

 int zpci_iov_setup_virtfn(struct zpci_bus *zbus, struct pci_dev *virtfn, int vfn);
+struct pci_dev *zpci_iov_find_parent_pf(struct zpci_bus *zbus, struct zpci_dev *zdev);
 #else /* CONFIG_PCI_IOV */
 static inline void zpci_iov_remove_virtfn(struct pci_dev *pdev, int vfn) {}
 {
 	return 0;
 }
+static inline struct pci_dev *zpci_iov_find_parent_pf(struct zpci_bus *zbus, struct zpci_dev *zdev)
+{
+	return NULL;
+}
 #endif /* CONFIG_PCI_IOV */
 #endif /* __S390_PCI_IOV_h */

arch/um/drivers/virt-pci.c+102−96

@@ -25,8 +25,10 @@ · 24 unmodified lines
25	#define MAX_IRQ_MSG_SIZE (sizeof(struct virtio_pcidev_msg) + sizeof(u32))	25	#define MAX_IRQ_MSG_SIZE (sizeof(struct virtio_pcidev_msg) + sizeof(u32))
26	#define NUM_IRQ_MSGS 10	26	#define NUM_IRQ_MSGS 10
27		27
28	#define HANDLE_NO_FREE(ptr) ((void *)((unsigned long)(ptr) \| 1))	28	struct um_pci_message_buffer {
29	#define HANDLE_IS_NO_FREE(ptr) ((unsigned long)(ptr) & 1)	29	struct virtio_pcidev_msg hdr;
		30	u8 data[8];
		31	};
30		32
31	struct um_pci_device {	33	struct um_pci_device {
32	struct virtio_device *vdev;	34	struct virtio_device *vdev;
@@ -36,6 +38,11 @@ struct um_pci_device { · 3 unmodified lines
36		38
37	struct virtqueue cmd_vq, irq_vq;	39	struct virtqueue cmd_vq, irq_vq;
38		40
		41	#define UM_PCI_WRITE_BUFS 20
		42	struct um_pci_message_buffer bufs[UM_PCI_WRITE_BUFS + 1];
		43	void *extra_ptrs[UM_PCI_WRITE_BUFS + 1];
		44	DECLARE_BITMAP(used_bufs, UM_PCI_WRITE_BUFS);
		45
39	#define UM_PCI_STAT_WAITING 0	46	#define UM_PCI_STAT_WAITING 0
40	unsigned long status;	47	unsigned long status;
41		48
@@ -61,12 +68,40 @@ static unsigned long um_pci_msi_used[BITS_TO_LONGS(MAX_MSI_VECTORS)]; · 19 unmodified lines
61	static unsigned int um_pci_max_delay_us = 40000;	68	static unsigned int um_pci_max_delay_us = 40000;
62	module_param_named(max_delay_us, um_pci_max_delay_us, uint, 0644);	69	module_param_named(max_delay_us, um_pci_max_delay_us, uint, 0644);
63		70
64	struct um_pci_message_buffer {	71	static int um_pci_get_buf(struct um_pci_device dev, bool posted)
65	struct virtio_pcidev_msg hdr;	72	{
66	u8 data[8];	73	int i;
67	};	74
		75	for (i = 0; i < UM_PCI_WRITE_BUFS; i++) {
		76	if (!test_and_set_bit(i, dev->used_bufs))
		77	return i;
		78	}
68		79
69	static struct um_pci_message_buffer __percpu *um_pci_msg_bufs;	80	*posted = false;
		81	return UM_PCI_WRITE_BUFS;
		82	}
		83
		84	static void um_pci_free_buf(struct um_pci_device dev, void buf)
		85	{
		86	int i;
		87
		88	if (buf == &dev->bufs[UM_PCI_WRITE_BUFS]) {
		89	kfree(dev->extra_ptrs[UM_PCI_WRITE_BUFS]);
		90	dev->extra_ptrs[UM_PCI_WRITE_BUFS] = NULL;
		91	return;
		92	}
		93
		94	for (i = 0; i < UM_PCI_WRITE_BUFS; i++) {
		95	if (buf == &dev->bufs[i]) {
		96	kfree(dev->extra_ptrs[i]);
		97	dev->extra_ptrs[i] = NULL;
		98	WARN_ON(!test_and_clear_bit(i, dev->used_bufs));
		99	return;
		100	}
		101	}
		102
		103	WARN_ON(1);
		104	}
70		105
71	static int um_pci_send_cmd(struct um_pci_device *dev,	106	static int um_pci_send_cmd(struct um_pci_device *dev,
72	struct virtio_pcidev_msg *cmd,	107	struct virtio_pcidev_msg *cmd,
@@ -82,7 +117,9 @@ static int um_pci_send_cmd(struct um_pci_device *dev, · 9 unmodified lines
82	};	117	};
83	struct um_pci_message_buffer *buf;	118	struct um_pci_message_buffer *buf;
84	int delay_count = 0;	119	int delay_count = 0;
		120	bool bounce_out;
85	int ret, len;	121	int ret, len;
		122	int buf_idx;
86	bool posted;	123	bool posted;
87		124
88	if (WARN_ON(cmd_size < sizeof(cmd) \|\| cmd_size > sizeof(buf)))	125	if (WARN_ON(cmd_size < sizeof(cmd) \|\| cmd_size > sizeof(buf)))
@@ -101,26 +138,28 @@ static int um_pci_send_cmd(struct um_pci_device *dev, · 12 unmodified lines
101	break;	138	break;
102	}	139	}
103		140
104	buf = get_cpu_var(um_pci_msg_bufs);	141	bounce_out = !posted && cmd_size <= sizeof(*cmd) &&
105	if (buf)	142	out && out_size <= sizeof(buf->data);
106	memcpy(buf, cmd, cmd_size);
107		143
108	if (posted) {	144	buf_idx = um_pci_get_buf(dev, &posted);
109	u8 *ncmd = kmalloc(cmd_size + extra_size, GFP_ATOMIC);	145	buf = &dev->bufs[buf_idx];
110		146	memcpy(buf, cmd, cmd_size);
111	if (ncmd) {	147
112	memcpy(ncmd, cmd, cmd_size);	148	if (posted && extra && extra_size > sizeof(buf) - cmd_size) {
113	if (extra)	149	dev->extra_ptrs[buf_idx] = kmemdup(extra, extra_size,
114	memcpy(ncmd + cmd_size, extra, extra_size);	150	GFP_ATOMIC);
115	cmd = (void *)ncmd;	151
116	cmd_size += extra_size;	152	if (!dev->extra_ptrs[buf_idx]) {
117	extra = NULL;	153	um_pci_free_buf(dev, buf);
118	extra_size = 0;	154	return -ENOMEM;
119	} else {
120	/* try without allocating memory */
121	posted = false;
122	cmd = (void *)buf;
123	}	155	}
		156	extra = dev->extra_ptrs[buf_idx];
		157	} else if (extra && extra_size <= sizeof(buf) - cmd_size) {
		158	memcpy((u8 *)buf + cmd_size, extra, extra_size);
		159	cmd_size += extra_size;
		160	extra_size = 0;
		161	extra = NULL;
		162	cmd = (void *)buf;
124	} else {	163	} else {
125	cmd = (void *)buf;	164	cmd = (void *)buf;
126	}	165	}
@@ -128,39 +167,40 @@ static int um_pci_send_cmd(struct um_pci_device *dev, · 1 unmodified line
128	sg_init_one(&out_sg, cmd, cmd_size);	167	sg_init_one(&out_sg, cmd, cmd_size);
129	if (extra)	168	if (extra)
130	sg_init_one(&extra_sg, extra, extra_size);	169	sg_init_one(&extra_sg, extra, extra_size);
131	if (out)	170	/* allow stack for small buffers */
		171	if (bounce_out)
		172	sg_init_one(&in_sg, buf->data, out_size);
		173	else if (out)
132	sg_init_one(&in_sg, out, out_size);	174	sg_init_one(&in_sg, out, out_size);
133		175
134	/* add to internal virtio queue */	176	/* add to internal virtio queue */
135	ret = virtqueue_add_sgs(dev->cmd_vq, sgs_list,	177	ret = virtqueue_add_sgs(dev->cmd_vq, sgs_list,
136	extra ? 2 : 1,	178	extra ? 2 : 1,
137	out ? 1 : 0,	179	out ? 1 : 0,
138	posted ? cmd : HANDLE_NO_FREE(cmd),	180	cmd, GFP_ATOMIC);
139	GFP_ATOMIC);
140	if (ret) {	181	if (ret) {
141	if (posted)	182	um_pci_free_buf(dev, buf);
142	kfree(cmd);	183	return ret;
143	goto out;
144	}	184	}
145		185
146	if (posted) {	186	if (posted) {
147	virtqueue_kick(dev->cmd_vq);	187	virtqueue_kick(dev->cmd_vq);
148	ret = 0;	188	return 0;
149	goto out;
150	}	189	}
151		190
152	/* kick and poll for getting a response on the queue */	191	/* kick and poll for getting a response on the queue */
153	set_bit(UM_PCI_STAT_WAITING, &dev->status);	192	set_bit(UM_PCI_STAT_WAITING, &dev->status);
154	virtqueue_kick(dev->cmd_vq);	193	virtqueue_kick(dev->cmd_vq);
		194	ret = 0;
155		195
156	while (1) {	196	while (1) {
157	void *completed = virtqueue_get_buf(dev->cmd_vq, &len);	197	void *completed = virtqueue_get_buf(dev->cmd_vq, &len);
158		198
159	if (completed == HANDLE_NO_FREE(cmd))	199	if (completed == buf)
160	break;	200	break;
161		201
162	if (completed && !HANDLE_IS_NO_FREE(completed))	202	if (completed)
163	kfree(completed);	203	um_pci_free_buf(dev, completed);
164		204
165	if (WARN_ONCE(virtqueue_is_broken(dev->cmd_vq) \|\|	205	if (WARN_ONCE(virtqueue_is_broken(dev->cmd_vq) \|\|
166	++delay_count > um_pci_max_delay_us,	206	++delay_count > um_pci_max_delay_us,
@@ -172,8 +212,11 @@ static int um_pci_send_cmd(struct um_pci_device *dev, · 5 unmodified lines
172	}	212	}
173	clear_bit(UM_PCI_STAT_WAITING, &dev->status);	213	clear_bit(UM_PCI_STAT_WAITING, &dev->status);
174		214
175	out:	215	if (bounce_out)
176	put_cpu_var(um_pci_msg_bufs);	216	memcpy(out, buf->data, out_size);
		217
		218	um_pci_free_buf(dev, buf);
		219
177	return ret;	220	return ret;
178	}	221	}
179		222
@@ -187,20 +230,13 @@ static unsigned long um_pci_cfgspace_read(void *priv, unsigned int offset, · 7 unmodified lines
187	.size = size,	230	.size = size,
188	.addr = offset,	231	.addr = offset,
189	};	232	};
190	/* buf->data is maximum size - we may only use parts of it */	233	/* max 8, we might not use it all */
191	struct um_pci_message_buffer *buf;	234	u8 data[8];
192	u8 *data;
193	unsigned long ret = ULONG_MAX;
194	size_t bytes = sizeof(buf->data);
195		235
196	if (!dev)	236	if (!dev)
197	return ULONG_MAX;	237	return ULONG_MAX;
198		238
199	buf = get_cpu_var(um_pci_msg_bufs);	239	memset(data, 0xff, sizeof(data));
200	data = buf->data;
201
202	if (buf)
203	memset(data, 0xff, bytes);
204		240
205	switch (size) {	241	switch (size) {
206	case 1:	242	case 1:
@@ -212,34 +248,26 @@ static unsigned long um_pci_cfgspace_read(void *priv, unsigned int offset, · 5 unmodified lines
212	break;	248	break;
213	default:	249	default:
214	WARN(1, "invalid config space read size %d\n", size);	250	WARN(1, "invalid config space read size %d\n", size);
215	goto out;	251	return ULONG_MAX;
216	}	252	}
217		253
218	if (um_pci_send_cmd(dev, &hdr, sizeof(hdr), NULL, 0, data, bytes))	254	if (um_pci_send_cmd(dev, &hdr, sizeof(hdr), NULL, 0, data, size))
219	goto out;	255	return ULONG_MAX;
220		256
221	switch (size) {	257	switch (size) {
222	case 1:	258	case 1:
223	ret = data[0];	259	return data[0];
224	break;
225	case 2:	260	case 2:
226	ret = le16_to_cpup((void *)data);	261	return le16_to_cpup((void *)data);
227	break;
228	case 4:	262	case 4:
229	ret = le32_to_cpup((void *)data);	263	return le32_to_cpup((void *)data);
230	break;
231	#ifdef CONFIG_64BIT	264	#ifdef CONFIG_64BIT
232	case 8:	265	case 8:
233	ret = le64_to_cpup((void *)data);	266	return le64_to_cpup((void *)data);
234	break;
235	#endif	267	#endif
236	default:	268	default:
237	break;	269	return ULONG_MAX;
238	}	270	}
239
240	out:
241	put_cpu_var(um_pci_msg_bufs);
242	return ret;
243	}	271	}
244		272
245	static void um_pci_cfgspace_write(void *priv, unsigned int offset, int size,	273	static void um_pci_cfgspace_write(void *priv, unsigned int offset, int size,
@@ -312,13 +340,8 @@ static void um_pci_bar_copy_from(void priv, void buffer, · 66 unmodified lines
312	static unsigned long um_pci_bar_read(void *priv, unsigned int offset,	340	static unsigned long um_pci_bar_read(void *priv, unsigned int offset,
313	int size)	341	int size)
314	{	342	{
315	/* buf->data is maximum size - we may only use parts of it */	343	/* 8 is maximum size - we may only use parts of it */
316	struct um_pci_message_buffer *buf;	344	u8 data[8];
317	u8 *data;
318	unsigned long ret = ULONG_MAX;
319
320	buf = get_cpu_var(um_pci_msg_bufs);
321	data = buf->data;
322		345
323	switch (size) {	346	switch (size) {
324	case 1:	347	case 1:
@@ -330,33 +353,25 @@ static unsigned long um_pci_bar_read(void *priv, unsigned int offset, · 5 unmodified lines
330	break;	353	break;
331	default:	354	default:
332	WARN(1, "invalid config space read size %d\n", size);	355	WARN(1, "invalid config space read size %d\n", size);
333	goto out;	356	return ULONG_MAX;
334	}	357	}
335		358
336	um_pci_bar_copy_from(priv, data, offset, size);	359	um_pci_bar_copy_from(priv, data, offset, size);
337		360
338	switch (size) {	361	switch (size) {
339	case 1:	362	case 1:
340	ret = data[0];	363	return data[0];
341	break;
342	case 2:	364	case 2:
343	ret = le16_to_cpup((void *)data);	365	return le16_to_cpup((void *)data);
344	break;
345	case 4:	366	case 4:
346	ret = le32_to_cpup((void *)data);	367	return le32_to_cpup((void *)data);
347	break;
348	#ifdef CONFIG_64BIT	368	#ifdef CONFIG_64BIT
349	case 8:	369	case 8:
350	ret = le64_to_cpup((void *)data);	370	return le64_to_cpup((void *)data);
351	break;
352	#endif	371	#endif
353	default:	372	default:
354	break;	373	return ULONG_MAX;
355	}	374	}
356
357	out:
358	put_cpu_var(um_pci_msg_bufs);
359	return ret;
360	}	375	}
361		376
362	static void um_pci_bar_copy_to(void *priv, unsigned int offset,	377	static void um_pci_bar_copy_to(void *priv, unsigned int offset,
@@ -523,11 +538,8 @@ static void um_pci_cmd_vq_cb(struct virtqueue *vq) · 160 unmodified lines
523	if (test_bit(UM_PCI_STAT_WAITING, &dev->status))	538	if (test_bit(UM_PCI_STAT_WAITING, &dev->status))
524	return;	539	return;
525		540
526	while ((cmd = virtqueue_get_buf(vq, &len))) {	541	while ((cmd = virtqueue_get_buf(vq, &len)))
527	if (WARN_ON(HANDLE_IS_NO_FREE(cmd)))	542	um_pci_free_buf(dev, cmd);
528	continue;
529	kfree(cmd);
530	}
531	}	543	}
532		544
533	static void um_pci_irq_vq_cb(struct virtqueue *vq)	545	static void um_pci_irq_vq_cb(struct virtqueue *vq)
@@ -1006,10 +1018,6 @@ static int __init um_pci_init(void) · 472 unmodified lines
1006	"No virtio device ID configured for PCI - no PCI support\n"))	1018	"No virtio device ID configured for PCI - no PCI support\n"))
1007	return 0;	1019	return 0;
1008		1020
1009	um_pci_msg_bufs = alloc_percpu(struct um_pci_message_buffer);
1010	if (!um_pci_msg_bufs)
1011	return -ENOMEM;
1012
1013	bridge = pci_alloc_host_bridge(0);	1021	bridge = pci_alloc_host_bridge(0);
1014	if (!bridge) {	1022	if (!bridge) {
1015	err = -ENOMEM;	1023	err = -ENOMEM;
@@ -1070,7 +1078,6 @@ free: · 54 unmodified lines
1070	pci_free_resource_list(&bridge->windows);	1078	pci_free_resource_list(&bridge->windows);
1071	pci_free_host_bridge(bridge);	1079	pci_free_host_bridge(bridge);
1072	}	1080	}
1073	free_percpu(um_pci_msg_bufs);
1074	return err;	1081	return err;
1075	}	1082	}
1076	module_init(um_pci_init);	1083	module_init(um_pci_init);
@@ -1082,6 +1089,5 @@ static void __exit um_pci_exit(void) · 5 unmodified lines
1082	irq_domain_remove(um_pci_inner_domain);	1089	irq_domain_remove(um_pci_inner_domain);
1083	pci_free_resource_list(&bridge->windows);	1090	pci_free_resource_list(&bridge->windows);
1084	pci_free_host_bridge(bridge);	1091	pci_free_host_bridge(bridge);
1085	free_percpu(um_pci_msg_bufs);
1086	}	1092	}
1087	module_exit(um_pci_exit);	1093	module_exit(um_pci_exit);

arch/um/drivers/virtio_uml.c+4−4

@@ -52,7 +52,7 @@ struct virtio_uml_device { · 51 unmodified lines
52	struct platform_device *pdev;	52	struct platform_device *pdev;
53	struct virtio_uml_platform_data *pdata;	53	struct virtio_uml_platform_data *pdata;
54		54
55	spinlock_t sock_lock;	55	raw_spinlock_t sock_lock;
56	int sock, req_fd, irq;	56	int sock, req_fd, irq;
57	u64 features;	57	u64 features;
58	u64 protocol_features;	58	u64 protocol_features;
@@ -246,7 +246,7 @@ static int vhost_user_send(struct virtio_uml_device *vu_dev, · 187 unmodified lines
246	if (request_ack)	246	if (request_ack)
247	msg->header.flags \|= VHOST_USER_FLAG_NEED_REPLY;	247	msg->header.flags \|= VHOST_USER_FLAG_NEED_REPLY;
248		248
249	spin_lock_irqsave(&vu_dev->sock_lock, flags);	249	raw_spin_lock_irqsave(&vu_dev->sock_lock, flags);
250	rc = full_sendmsg_fds(vu_dev->sock, msg, size, fds, num_fds);	250	rc = full_sendmsg_fds(vu_dev->sock, msg, size, fds, num_fds);
251	if (rc < 0)	251	if (rc < 0)
252	goto out;	252	goto out;
@@ -266,7 +266,7 @@ static int vhost_user_send(struct virtio_uml_device *vu_dev, · 13 unmodified lines
266	}	266	}
267		267
268	out:	268	out:
269	spin_unlock_irqrestore(&vu_dev->sock_lock, flags);	269	raw_spin_unlock_irqrestore(&vu_dev->sock_lock, flags);
270	return rc;	270	return rc;
271	}	271	}
272		272
@@ -1239,7 +1239,7 @@ static int virtio_uml_probe(struct platform_device *pdev) · 966 unmodified lines
1239	goto error_free;	1239	goto error_free;
1240	vu_dev->sock = rc;	1240	vu_dev->sock = rc;
1241		1241
1242	spin_lock_init(&vu_dev->sock_lock);	1242	raw_spin_lock_init(&vu_dev->sock_lock);
1243		1243
1244	rc = vhost_user_init(vu_dev);	1244	rc = vhost_user_init(vu_dev);
1245	if (rc)	1245	if (rc)

arch/um/kernel/irq.c+47−32

@@ -52,7 +52,7 @@ struct irq_entry { · 51 unmodified lines
52	bool sigio_workaround;	52	bool sigio_workaround;
53	};	53	};
54		54
55	static DEFINE_SPINLOCK(irq_lock);	55	static DEFINE_RAW_SPINLOCK(irq_lock);
56	static LIST_HEAD(active_fds);	56	static LIST_HEAD(active_fds);
57	static DECLARE_BITMAP(irqs_allocated, UM_LAST_SIGNAL_IRQ);	57	static DECLARE_BITMAP(irqs_allocated, UM_LAST_SIGNAL_IRQ);
58	static bool irqs_suspended;	58	static bool irqs_suspended;
@@ -257,7 +257,7 @@ static struct irq_entry *get_irq_entry_by_fd(int fd) · 198 unmodified lines
257	return NULL;	257	return NULL;
258	}	258	}
259		259
260	static void free_irq_entry(struct irq_entry *to_free, bool remove)	260	static void remove_irq_entry(struct irq_entry *to_free, bool remove)
261	{	261	{
262	if (!to_free)	262	if (!to_free)
263	return;	263	return;
@@ -265,7 +265,6 @@ static void free_irq_entry(struct irq_entry *to_free, bool remove) · 1 unmodified line
265	if (remove)	265	if (remove)
266	os_del_epoll_fd(to_free->fd);	266	os_del_epoll_fd(to_free->fd);
267	list_del(&to_free->list);	267	list_del(&to_free->list);
268	kfree(to_free);
269	}	268	}
270		269
271	static bool update_irq_entry(struct irq_entry *entry)	270	static bool update_irq_entry(struct irq_entry *entry)
@@ -286,17 +285,19 @@ static bool update_irq_entry(struct irq_entry *entry) · 14 unmodified lines
286	return false;	285	return false;
287	}	286	}
288		287
289	static void update_or_free_irq_entry(struct irq_entry *entry)	288	static struct irq_entry update_or_remove_irq_entry(struct irq_entry entry)
290	{	289	{
291	if (!update_irq_entry(entry))	290	if (update_irq_entry(entry))
292	free_irq_entry(entry, false);	291	return NULL;
		292	remove_irq_entry(entry, false);
		293	return entry;
293	}	294	}
294		295
295	static int activate_fd(int irq, int fd, enum um_irq_type type, void *dev_id,	296	static int activate_fd(int irq, int fd, enum um_irq_type type, void *dev_id,
296	void (timetravel_handler)(int, int, void ,	297	void (timetravel_handler)(int, int, void ,
297	struct time_travel_event *))	298	struct time_travel_event *))
298	{	299	{
299	struct irq_entry *irq_entry;	300	struct irq_entry irq_entry, to_free = NULL;
300	int err, events = os_event_mask(type);	301	int err, events = os_event_mask(type);
301	unsigned long flags;	302	unsigned long flags;
302		303
@@ -304,9 +305,10 @@ static int activate_fd(int irq, int fd, enum um_irq_type type, void *dev_id, · 1 unmodified line
304	if (err < 0)	305	if (err < 0)
305	goto out;	306	goto out;
306		307
307	spin_lock_irqsave(&irq_lock, flags);	308	raw_spin_lock_irqsave(&irq_lock, flags);
308	irq_entry = get_irq_entry_by_fd(fd);	309	irq_entry = get_irq_entry_by_fd(fd);
309	if (irq_entry) {	310	if (irq_entry) {
		311	already:
310	/* cannot register the same FD twice with the same type */	312	/* cannot register the same FD twice with the same type */
311	if (WARN_ON(irq_entry->reg[type].events)) {	313	if (WARN_ON(irq_entry->reg[type].events)) {
312	err = -EALREADY;	314	err = -EALREADY;
@@ -316,11 +318,22 @@ static int activate_fd(int irq, int fd, enum um_irq_type type, void *dev_id, · 3 unmodified lines
316	/* temporarily disable to avoid IRQ-side locking */	318	/* temporarily disable to avoid IRQ-side locking */
317	os_del_epoll_fd(fd);	319	os_del_epoll_fd(fd);
318	} else {	320	} else {
319	irq_entry = kzalloc(sizeof(*irq_entry), GFP_ATOMIC);	321	struct irq_entry *new;
320	if (!irq_entry) {	322
321	err = -ENOMEM;	323	/* don't restore interrupts */
322	goto out_unlock;	324	raw_spin_unlock(&irq_lock);
		325	new = kzalloc(sizeof(*irq_entry), GFP_ATOMIC);
		326	if (!new) {
		327	local_irq_restore(flags);
		328	return -ENOMEM;
323	}	329	}
		330	raw_spin_lock(&irq_lock);
		331	irq_entry = get_irq_entry_by_fd(fd);
		332	if (irq_entry) {
		333	to_free = new;
		334	goto already;
		335	}
		336	irq_entry = new;
324	irq_entry->fd = fd;	337	irq_entry->fd = fd;
325	list_add_tail(&irq_entry->list, &active_fds);	338	list_add_tail(&irq_entry->list, &active_fds);
326	maybe_sigio_broken(fd);	339	maybe_sigio_broken(fd);
@@ -339,12 +352,11 @@ static int activate_fd(int irq, int fd, enum um_irq_type type, void *dev_id, · 12 unmodified lines
339	#endif	352	#endif
340		353
341	WARN_ON(!update_irq_entry(irq_entry));	354	WARN_ON(!update_irq_entry(irq_entry));
342	spin_unlock_irqrestore(&irq_lock, flags);	355	err = 0;
343
344	return 0;
345	out_unlock:	356	out_unlock:
346	spin_unlock_irqrestore(&irq_lock, flags);	357	raw_spin_unlock_irqrestore(&irq_lock, flags);
347	out:	358	out:
		359	kfree(to_free);
348	return err;	360	return err;
349	}	361	}
350		362
@@ -358,19 +370,20 @@ void free_irq_by_fd(int fd) · 7 unmodified lines
358	struct irq_entry *to_free;	370	struct irq_entry *to_free;
359	unsigned long flags;	371	unsigned long flags;
360		372
361	spin_lock_irqsave(&irq_lock, flags);	373	raw_spin_lock_irqsave(&irq_lock, flags);
362	to_free = get_irq_entry_by_fd(fd);	374	to_free = get_irq_entry_by_fd(fd);
363	free_irq_entry(to_free, true);	375	remove_irq_entry(to_free, true);
364	spin_unlock_irqrestore(&irq_lock, flags);	376	raw_spin_unlock_irqrestore(&irq_lock, flags);
		377	kfree(to_free);
365	}	378	}
366	EXPORT_SYMBOL(free_irq_by_fd);	379	EXPORT_SYMBOL(free_irq_by_fd);
367		380
368	static void free_irq_by_irq_and_dev(unsigned int irq, void *dev)	381	static void free_irq_by_irq_and_dev(unsigned int irq, void *dev)
369	{	382	{
370	struct irq_entry *entry;	383	struct irq_entry entry, to_free = NULL;
371	unsigned long flags;	384	unsigned long flags;
372		385
373	spin_lock_irqsave(&irq_lock, flags);	386	raw_spin_lock_irqsave(&irq_lock, flags);
374	list_for_each_entry(entry, &active_fds, list) {	387	list_for_each_entry(entry, &active_fds, list) {
375	enum um_irq_type i;	388	enum um_irq_type i;
376		389
@@ -386,12 +399,13 @@ static void free_irq_by_irq_and_dev(unsigned int irq, void *dev) · 9 unmodified lines
386		399
387	os_del_epoll_fd(entry->fd);	400	os_del_epoll_fd(entry->fd);
388	reg->events = 0;	401	reg->events = 0;
389	update_or_free_irq_entry(entry);	402	to_free = update_or_remove_irq_entry(entry);
390	goto out;	403	goto out;
391	}	404	}
392	}	405	}
393	out:	406	out:
394	spin_unlock_irqrestore(&irq_lock, flags);	407	raw_spin_unlock_irqrestore(&irq_lock, flags);
		408	kfree(to_free);
395	}	409	}
396		410
397	void deactivate_fd(int fd, int irqnum)	411	void deactivate_fd(int fd, int irqnum)
@@ -402,7 +416,7 @@ void deactivate_fd(int fd, int irqnum) · 4 unmodified lines
402		416
403	os_del_epoll_fd(fd);	417	os_del_epoll_fd(fd);
404		418
405	spin_lock_irqsave(&irq_lock, flags);	419	raw_spin_lock_irqsave(&irq_lock, flags);
406	entry = get_irq_entry_by_fd(fd);	420	entry = get_irq_entry_by_fd(fd);
407	if (!entry)	421	if (!entry)
408	goto out;	422	goto out;
@@ -414,9 +428,10 @@ void deactivate_fd(int fd, int irqnum) · 5 unmodified lines
414	entry->reg[i].events = 0;	428	entry->reg[i].events = 0;
415	}	429	}
416		430
417	update_or_free_irq_entry(entry);	431	entry = update_or_remove_irq_entry(entry);
418	out:	432	out:
419	spin_unlock_irqrestore(&irq_lock, flags);	433	raw_spin_unlock_irqrestore(&irq_lock, flags);
		434	kfree(entry);
420		435
421	ignore_sigio_fd(fd);	436	ignore_sigio_fd(fd);
422	}	437	}
@@ -546,7 +561,7 @@ void um_irqs_suspend(void) · 123 unmodified lines
546		561
547	irqs_suspended = true;	562	irqs_suspended = true;
548		563
549	spin_lock_irqsave(&irq_lock, flags);	564	raw_spin_lock_irqsave(&irq_lock, flags);
550	list_for_each_entry(entry, &active_fds, list) {	565	list_for_each_entry(entry, &active_fds, list) {
551	enum um_irq_type t;	566	enum um_irq_type t;
552	bool clear = true;	567	bool clear = true;
@@ -579,7 +594,7 @@ void um_irqs_suspend(void) · 26 unmodified lines
579	!__ignore_sigio_fd(entry->fd);	594	!__ignore_sigio_fd(entry->fd);
580	}	595	}
581	}	596	}
582	spin_unlock_irqrestore(&irq_lock, flags);	597	raw_spin_unlock_irqrestore(&irq_lock, flags);
583	}	598	}
584		599
585	void um_irqs_resume(void)	600	void um_irqs_resume(void)
@@ -588,7 +603,7 @@ void um_irqs_resume(void) · 2 unmodified lines
588	unsigned long flags;	603	unsigned long flags;
589		604
590		605
591	spin_lock_irqsave(&irq_lock, flags);	606	raw_spin_lock_irqsave(&irq_lock, flags);
592	list_for_each_entry(entry, &active_fds, list) {	607	list_for_each_entry(entry, &active_fds, list) {
593	if (entry->suspended) {	608	if (entry->suspended) {
594	int err = os_set_fd_async(entry->fd);	609	int err = os_set_fd_async(entry->fd);
@@ -602,7 +617,7 @@ void um_irqs_resume(void) · 7 unmodified lines
602	}	617	}
603	}	618	}
604	}	619	}
605	spin_unlock_irqrestore(&irq_lock, flags);	620	raw_spin_unlock_irqrestore(&irq_lock, flags);
606		621
607	irqs_suspended = false;	622	irqs_suspended = false;
608	send_sigio_to_self();	623	send_sigio_to_self();
@@ -613,7 +628,7 @@ static int normal_irq_set_wake(struct irq_data *d, unsigned int on) · 4 unmodified lines
613	struct irq_entry *entry;	628	struct irq_entry *entry;
614	unsigned long flags;	629	unsigned long flags;
615		630
616	spin_lock_irqsave(&irq_lock, flags);	631	raw_spin_lock_irqsave(&irq_lock, flags);
617	list_for_each_entry(entry, &active_fds, list) {	632	list_for_each_entry(entry, &active_fds, list) {
618	enum um_irq_type t;	633	enum um_irq_type t;
619		634
@@ -628,7 +643,7 @@ static int normal_irq_set_wake(struct irq_data *d, unsigned int on) · 8 unmodified lines
628	}	643	}
629	}	644	}
630	unlock:	645	unlock:
631	spin_unlock_irqrestore(&irq_lock, flags);	646	raw_spin_unlock_irqrestore(&irq_lock, flags);
632	return 0;	647	return 0;
633	}	648	}
634	#else	649	#else

arch/um/kernel/process.c+9−1

@@ -191,7 +191,15 @@ void initial_thread_cb(void (proc)(void ), void *arg) · 190 unmodified lines
191	int arch_dup_task_struct(struct task_struct *dst,	191	int arch_dup_task_struct(struct task_struct *dst,
192	struct task_struct *src)	192	struct task_struct *src)
193	{	193	{
194	memcpy(dst, src, arch_task_struct_size);	194	/* init_task is not dynamically sized (missing FPU state) */
		195	if (unlikely(src == &init_task)) {
		196	memcpy(dst, src, sizeof(init_task));
		197	memset((void *)dst + sizeof(init_task), 0,
		198	arch_task_struct_size - sizeof(init_task));
		199	} else {
		200	memcpy(dst, src, arch_task_struct_size);
		201	}
		202
195	return 0;	203	return 0;
196	}	204	}
197		205

arch/um/os-Linux/skas/process.c+13−3

 static int stub_exe_fd;
+#ifndef CLOSE_RANGE_CLOEXEC
+#define CLOSE_RANGE_CLOEXEC	(1U << 2)
+#endif
 static int userspace_tramp(void *stack)
 {
 	char *const argv[] = { "uml-userspace", NULL };
 	init_data.stub_data_fd = phys_mapping(uml_to_phys(stack), &offset);
 	init_data.stub_data_offset = MMAP_OFFSET(offset);
-	/* Set CLOEXEC on all FDs and then unset on all memory related FDs */
+	/*
-	close_range(0, ~0U, CLOSE_RANGE_CLOEXEC);
+	 * Avoid leaking unneeded FDs to the stub by setting CLOEXEC on all FDs
+	 * and then unsetting it on all memory related FDs.
+	 * This is not strictly necessary from a safety perspective.
+	 */
+	syscall(__NR_close_range, 0, ~0U, CLOSE_RANGE_CLOEXEC);
 	fcntl(init_data.stub_data_fd, F_SETFD, 0);
 	for (iomem = iomem_regions; iomem; iomem = iomem->next)
 	if (ret != sizeof(init_data))
 		exit(4);
-	execveat(stub_exe_fd, "", argv, NULL, AT_EMPTY_PATH);
+	/* Raw execveat for compatibility with older libc versions */
+	syscall(__NR_execveat, stub_exe_fd, (unsigned long)"",
+		(unsigned long)argv, NULL, AT_EMPTY_PATH);
 	exit(5);
 }

arch/x86/Kconfig+2−1

@@ -2599,7 +2599,8 @@ config MITIGATION_IBPB_ENTRY · 2598 unmodified lines
2599	depends on CPU_SUP_AMD && X86_64	2599	depends on CPU_SUP_AMD && X86_64
2600	default y	2600	default y
2601	help	2601	help
2602	Compile the kernel with support for the retbleed=ibpb mitigation.	2602	Compile the kernel with support for the retbleed=ibpb and
		2603	spec_rstack_overflow={ibpb,ibpb-vmexit} mitigations.
2603		2604
2604	config MITIGATION_IBRS_ENTRY	2605	config MITIGATION_IBRS_ENTRY
2605	bool "Enable IBRS on kernel entry"	2606	bool "Enable IBRS on kernel entry"

arch/x86/boot/compressed/Makefile+1−0

@@ -25,6 +25,7 @@ targets := vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 vmlinux.bin.lzma \ · 24 unmodified lines
25	# avoid errors with '-march=i386', and future flags may depend on the target to	25	# avoid errors with '-march=i386', and future flags may depend on the target to
26	# be valid.	26	# be valid.
27	KBUILD_CFLAGS := -m$(BITS) -O2 $(CLANG_FLAGS)	27	KBUILD_CFLAGS := -m$(BITS) -O2 $(CLANG_FLAGS)
		28	KBUILD_CFLAGS += -std=gnu11
28	KBUILD_CFLAGS += -fno-strict-aliasing -fPIE	29	KBUILD_CFLAGS += -fno-strict-aliasing -fPIE
29	KBUILD_CFLAGS += -Wundef	30	KBUILD_CFLAGS += -Wundef
30	KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING	31	KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING

arch/x86/events/intel/core.c+14−19

 static void update_pmu_cap(struct x86_hybrid_pmu *pmu)
 {
-	unsigned int sub_bitmaps, eax, ebx, ecx, edx;
+	unsigned int cntr, fixed_cntr, ecx, edx;
+	union cpuid35_eax eax;
+	union cpuid35_ebx ebx;
-	cpuid(ARCH_PERFMON_EXT_LEAF, &sub_bitmaps, &ebx, &ecx, &edx);
+	cpuid(ARCH_PERFMON_EXT_LEAF, &eax.full, &ebx.full, &ecx, &edx);
-	if (ebx & ARCH_PERFMON_EXT_UMASK2)
+	if (ebx.split.umask2)
 		pmu->config_mask |= ARCH_PERFMON_EVENTSEL_UMASK2;
-	if (ebx & ARCH_PERFMON_EXT_EQ)
+	if (ebx.split.eq)
 		pmu->config_mask |= ARCH_PERFMON_EVENTSEL_EQ;
-	if (sub_bitmaps & ARCH_PERFMON_NUM_COUNTER_LEAF_BIT) {
+	if (eax.split.cntr_subleaf) {
 		cpuid_count(ARCH_PERFMON_EXT_LEAF, ARCH_PERFMON_NUM_COUNTER_LEAF,
-			    &eax, &ebx, &ecx, &edx);
+			    &cntr, &fixed_cntr, &ecx, &edx);
-		pmu->cntr_mask64 = eax;
+		pmu->cntr_mask64 = cntr;
-		pmu->fixed_cntr_mask64 = ebx;
+		pmu->fixed_cntr_mask64 = fixed_cntr;
 	}
 	if (!intel_pmu_broken_perf_cap()) {
 	else
 		pmu->intel_ctrl &= ~(1ULL << GLOBAL_CTRL_EN_PERF_METRICS);
-	if (pmu->intel_cap.pebs_output_pt_available)
-		pmu->pmu.capabilities |= PERF_PMU_CAP_AUX_OUTPUT;
-	else
-		pmu->pmu.capabilities &= ~PERF_PMU_CAP_AUX_OUTPUT;
 	intel_pmu_check_event_constraints(pmu->event_constraints,
 					  pmu->cntr_mask64,
 					  pmu->fixed_cntr_mask64,
 	pr_info("%s PMU driver: ", pmu->name);
-	if (pmu->intel_cap.pebs_output_pt_available)
-		pr_cont("PEBS-via-PT ");
 	pr_cont("\n");
 	x86_pmu_show_pmu_cap(&pmu->pmu);
 	init_debug_store_on_cpu(cpu);
 	/*
-	 * Deal with CPUs that don't clear their LBRs on power-up.
+	 * Deal with CPUs that don't clear their LBRs on power-up, and that may
+	 * even boot with LBRs enabled.
 	 */
+	if (!static_cpu_has(X86_FEATURE_ARCH_LBR) && x86_pmu.lbr_nr)
+		msr_clear_bit(MSR_IA32_DEBUGCTLMSR, DEBUGCTLMSR_LBR_BIT);
 	intel_pmu_lbr_reset();
 	cpuc->lbr_sel = NULL;
 		pmu->intel_cap.capabilities = x86_pmu.intel_cap.capabilities;
 		if (pmu->pmu_type & hybrid_small_tiny) {
 			pmu->intel_cap.perf_metrics = 0;
-			pmu->intel_cap.pebs_output_pt_available = 1;
 			pmu->mid_ack = true;
 		} else if (pmu->pmu_type & hybrid_big) {
 			pmu->intel_cap.perf_metrics = 1;
-			pmu->intel_cap.pebs_output_pt_available = 0;
 			pmu->late_ack = true;
 		}
 	}

arch/x86/events/intel/ds.c+9−1

@@ -2578,7 +2578,15 @@ void __init intel_ds_init(void) · 2577 unmodified lines
2578	}	2578	}
2579	pr_cont("PEBS fmt4%c%s, ", pebs_type, pebs_qual);	2579	pr_cont("PEBS fmt4%c%s, ", pebs_type, pebs_qual);
2580		2580
2581	if (!is_hybrid() && x86_pmu.intel_cap.pebs_output_pt_available) {	2581	/*
		2582	* The PEBS-via-PT is not supported on hybrid platforms,
		2583	* because not all CPUs of a hybrid machine support it.
		2584	* The global x86_pmu.intel_cap, which only contains the
		2585	* common capabilities, is used to check the availability
		2586	* of the feature. The per-PMU pebs_output_pt_available
		2587	* in a hybrid machine should be ignored.
		2588	*/
		2589	if (x86_pmu.intel_cap.pebs_output_pt_available) {
2582	pr_cont("PEBS-via-PT, ");	2590	pr_cont("PEBS-via-PT, ");
2583	x86_get_pmu(smp_processor_id())->capabilities \|= PERF_PMU_CAP_AUX_OUTPUT;	2591	x86_get_pmu(smp_processor_id())->capabilities \|= PERF_PMU_CAP_AUX_OUTPUT;
2584	}	2592	}

arch/x86/events/rapl.c+4−8

 	unsigned int rapl_pmu_idx;
 	struct rapl_pmus *rapl_pmus;
+	/* only look at RAPL events */
+	if (event->attr.type != event->pmu->type)
+		return -ENOENT;
 	/* unsupported modes and filters */
 	if (event->attr.sample_period) /* no sampling */
 		return -EINVAL;
 	rapl_pmus_scope = rapl_pmus->pmu.scope;
 	if (rapl_pmus_scope == PERF_PMU_SCOPE_PKG || rapl_pmus_scope == PERF_PMU_SCOPE_DIE) {
-		/* only look at RAPL package events */
-		if (event->attr.type != rapl_pmus_pkg->pmu.type)
-			return -ENOENT;
 		cfg = array_index_nospec((long)cfg, NR_RAPL_PKG_DOMAINS + 1);
 		if (!cfg || cfg >= NR_RAPL_PKG_DOMAINS + 1)
 			return -EINVAL;
 		bit = cfg - 1;
 		event->hw.event_base = rapl_model->rapl_pkg_msrs[bit].msr;
 	} else if (rapl_pmus_scope == PERF_PMU_SCOPE_CORE) {
-		/* only look at RAPL core events */
-		if (event->attr.type != rapl_pmus_core->pmu.type)
-			return -ENOENT;
 		cfg = array_index_nospec((long)cfg, NR_RAPL_CORE_DOMAINS + 1);
 		if (!cfg || cfg >= NR_RAPL_PKG_DOMAINS + 1)
 			return -EINVAL;

arch/x86/include/asm/kvm-x86-ops.h+1−0

@@ -48,6 +48,7 @@ KVM_X86_OP(set_idt) · 47 unmodified lines
48	KVM_X86_OP(get_gdt)	48	KVM_X86_OP(get_gdt)
49	KVM_X86_OP(set_gdt)	49	KVM_X86_OP(set_gdt)
50	KVM_X86_OP(sync_dirty_debug_regs)	50	KVM_X86_OP(sync_dirty_debug_regs)
		51	KVM_X86_OP(set_dr6)
51	KVM_X86_OP(set_dr7)	52	KVM_X86_OP(set_dr7)
52	KVM_X86_OP(cache_reg)	53	KVM_X86_OP(cache_reg)
53	KVM_X86_OP(get_rflags)	54	KVM_X86_OP(get_rflags)

arch/x86/include/asm/kvm_host.h+1−0

@@ -1696,6 +1696,7 @@ struct kvm_x86_ops { · 1695 unmodified lines
1696	void (get_gdt)(struct kvm_vcpu vcpu, struct desc_ptr *dt);	1696	void (get_gdt)(struct kvm_vcpu vcpu, struct desc_ptr *dt);
1697	void (set_gdt)(struct kvm_vcpu vcpu, struct desc_ptr *dt);	1697	void (set_gdt)(struct kvm_vcpu vcpu, struct desc_ptr *dt);
1698	void (sync_dirty_debug_regs)(struct kvm_vcpu vcpu);	1698	void (sync_dirty_debug_regs)(struct kvm_vcpu vcpu);
		1699	void (set_dr6)(struct kvm_vcpu vcpu, unsigned long value);
1699	void (set_dr7)(struct kvm_vcpu vcpu, unsigned long value);	1700	void (set_dr7)(struct kvm_vcpu vcpu, unsigned long value);
1700	void (cache_reg)(struct kvm_vcpu vcpu, enum kvm_reg reg);	1701	void (cache_reg)(struct kvm_vcpu vcpu, enum kvm_reg reg);
1701	unsigned long (get_rflags)(struct kvm_vcpu vcpu);	1702	unsigned long (get_rflags)(struct kvm_vcpu vcpu);

arch/x86/include/asm/msr-index.h+2−1

@@ -395,7 +395,8 @@ · 394 unmodified lines
395	#define MSR_IA32_PASID_VALID BIT_ULL(31)	395	#define MSR_IA32_PASID_VALID BIT_ULL(31)
396		396
397	/* DEBUGCTLMSR bits (others vary by model): */	397	/* DEBUGCTLMSR bits (others vary by model): */
398	#define DEBUGCTLMSR_LBR (1UL << 0) /* last branch recording */	398	#define DEBUGCTLMSR_LBR_BIT 0 /* last branch recording */
		399	#define DEBUGCTLMSR_LBR (1UL << DEBUGCTLMSR_LBR_BIT)
399	#define DEBUGCTLMSR_BTF_SHIFT 1	400	#define DEBUGCTLMSR_BTF_SHIFT 1
400	#define DEBUGCTLMSR_BTF (1UL << 1) /* single-step on branches */	401	#define DEBUGCTLMSR_BTF (1UL << 1) /* single-step on branches */
401	#define DEBUGCTLMSR_BUS_LOCK_DETECT (1UL << 2)	402	#define DEBUGCTLMSR_BUS_LOCK_DETECT (1UL << 2)

arch/x86/include/asm/perf_event.h+25−3

@@ -188,11 +188,33 @@ union cpuid10_edx { · 187 unmodified lines
188	* detection/enumeration details:	188	* detection/enumeration details:
189	*/	189	*/
190	#define ARCH_PERFMON_EXT_LEAF 0x00000023	190	#define ARCH_PERFMON_EXT_LEAF 0x00000023
191	#define ARCH_PERFMON_EXT_UMASK2 0x1
192	#define ARCH_PERFMON_EXT_EQ 0x2
193	#define ARCH_PERFMON_NUM_COUNTER_LEAF_BIT 0x1
194	#define ARCH_PERFMON_NUM_COUNTER_LEAF 0x1	191	#define ARCH_PERFMON_NUM_COUNTER_LEAF 0x1
195		192
		193	union cpuid35_eax {
		194	struct {
		195	unsigned int leaf0:1;
		196	/* Counters Sub-Leaf */
		197	unsigned int cntr_subleaf:1;
		198	/* Auto Counter Reload Sub-Leaf */
		199	unsigned int acr_subleaf:1;
		200	/* Events Sub-Leaf */
		201	unsigned int events_subleaf:1;
		202	unsigned int reserved:28;
		203	} split;
		204	unsigned int full;
		205	};
		206
		207	union cpuid35_ebx {
		208	struct {
		209	/* UnitMask2 Supported */
		210	unsigned int umask2:1;
		211	/* EQ-bit Supported */
		212	unsigned int eq:1;
		213	unsigned int reserved:30;
		214	} split;
		215	unsigned int full;
		216	};
		217
196	/*	218	/*
197	* Intel Architectural LBR CPUID detection/enumeration details:	219	* Intel Architectural LBR CPUID detection/enumeration details:
198	*/	220	*/

arch/x86/include/asm/sev.h+2−0

 #ifdef CONFIG_KVM_AMD_SEV
 bool snp_probe_rmptable_info(void);
+int snp_rmptable_init(void);
 int snp_lookup_rmpentry(u64 pfn, bool *assigned, int *level);
 void snp_dump_hva_rmpentry(unsigned long address);
 int psmash(u64 pfn);
 void snp_fixup_e820_tables(void);
 #else
 static inline bool snp_probe_rmptable_info(void) { return false; }
+static inline int snp_rmptable_init(void) { return -ENOSYS; }
 static inline int snp_lookup_rmpentry(u64 pfn, bool *assigned, int *level) { return -ENODEV; }
 static inline void snp_dump_hva_rmpentry(unsigned long address) {}
 static inline int psmash(u64 pfn) { return -ENODEV; }

arch/x86/kernel/cpu/bugs.c+14−7

 	case RETBLEED_MITIGATION_IBPB:
 		setup_force_cpu_cap(X86_FEATURE_ENTRY_IBPB);
+		setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
+		mitigate_smt = true;
 		/*
 		 * IBPB on entry already obviates the need for
 		setup_clear_cpu_cap(X86_FEATURE_UNRET);
 		setup_clear_cpu_cap(X86_FEATURE_RETHUNK);
-		setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
-		mitigate_smt = true;
 		/*
 		 * There is no need for RSB filling: entry_ibpb() ensures
 		 * all predictions, including the RSB, are invalidated,
 		if (IS_ENABLED(CONFIG_MITIGATION_IBPB_ENTRY)) {
 			if (has_microcode) {
 				setup_force_cpu_cap(X86_FEATURE_ENTRY_IBPB);
+				setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
 				srso_mitigation = SRSO_MITIGATION_IBPB;
 				/*
 				 */
 				setup_clear_cpu_cap(X86_FEATURE_UNRET);
 				setup_clear_cpu_cap(X86_FEATURE_RETHUNK);
+				/*
+				 * There is no need for RSB filling: entry_ibpb() ensures
+				 * all predictions, including the RSB, are invalidated,
+				 * regardless of IBPB implementation.
+				 */
+				setup_clear_cpu_cap(X86_FEATURE_RSB_VMEXIT);
 			}
 		} else {
 			pr_err("WARNING: kernel not compiled with MITIGATION_IBPB_ENTRY.\n");
 ibpb_on_vmexit:
 	case SRSO_CMD_IBPB_ON_VMEXIT:
-		if (IS_ENABLED(CONFIG_MITIGATION_SRSO)) {
+		if (IS_ENABLED(CONFIG_MITIGATION_IBPB_ENTRY)) {
-			if (!boot_cpu_has(X86_FEATURE_ENTRY_IBPB) && has_microcode) {
+			if (has_microcode) {
 				setup_force_cpu_cap(X86_FEATURE_IBPB_ON_VMEXIT);
 				srso_mitigation = SRSO_MITIGATION_IBPB_ON_VMEXIT;
 				setup_clear_cpu_cap(X86_FEATURE_RSB_VMEXIT);
 			}
 		} else {
-			pr_err("WARNING: kernel not compiled with MITIGATION_SRSO.\n");
+			pr_err("WARNING: kernel not compiled with MITIGATION_IBPB_ENTRY.\n");
-                }
+		}
 		break;
 	default:
 		break;

arch/x86/kvm/cpuid.c+1−1

@@ -1180,7 +1180,7 @@ void kvm_set_cpu_caps(void) · 1179 unmodified lines
1180	SYNTHESIZED_F(SBPB),	1180	SYNTHESIZED_F(SBPB),
1181	SYNTHESIZED_F(IBPB_BRTYPE),	1181	SYNTHESIZED_F(IBPB_BRTYPE),
1182	SYNTHESIZED_F(SRSO_NO),	1182	SYNTHESIZED_F(SRSO_NO),
1183	SYNTHESIZED_F(SRSO_USER_KERNEL_NO),	1183	F(SRSO_USER_KERNEL_NO),
1184	);	1184	);
1185		1185
1186	kvm_cpu_cap_init(CPUID_8000_0022_EAX,	1186	kvm_cpu_cap_init(CPUID_8000_0022_EAX,

arch/x86/kvm/hyperv.c+5−1

 	u32 vector;
 	bool all_cpus;
+	if (!lapic_in_kernel(vcpu))
+		return HV_STATUS_INVALID_HYPERCALL_INPUT;
 	if (hc->code == HVCALL_SEND_IPI) {
 		if (!hc->fast) {
 			if (unlikely(kvm_read_guest(kvm, hc->ingpa, &send_ipi,
 			ent->eax |= HV_X64_REMOTE_TLB_FLUSH_RECOMMENDED;
 			ent->eax |= HV_X64_APIC_ACCESS_RECOMMENDED;
 			ent->eax |= HV_X64_RELAXED_TIMING_RECOMMENDED;
-			ent->eax |= HV_X64_CLUSTER_IPI_RECOMMENDED;
+			if (!vcpu || lapic_in_kernel(vcpu))
+				ent->eax |= HV_X64_CLUSTER_IPI_RECOMMENDED;
 			ent->eax |= HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED;
 			if (evmcs_ver)
 				ent->eax |= HV_X64_ENLIGHTENED_VMCS_RECOMMENDED;

arch/x86/kvm/mmu/mmu.c+27−8

 	union kvm_mmu_page_role root_role;
 	/* NPT requires CR0.PG=1. */
-	WARN_ON_ONCE(cpu_role.base.direct);
+	WARN_ON_ONCE(cpu_role.base.direct || !cpu_role.base.guest_mode);
 	root_role = cpu_role.base;
 	root_role.level = kvm_mmu_get_tdp_level(vcpu);
 	kmem_cache_destroy(mmu_page_header_cache);
 }
+static void kvm_wake_nx_recovery_thread(struct kvm *kvm)
+{
+	/*
+	 * The NX recovery thread is spawned on-demand at the first KVM_RUN and
+	 * may not be valid even though the VM is globally visible.  Do nothing,
+	 * as such a VM can't have any possible NX huge pages.
+	 */
+	struct vhost_task *nx_thread = READ_ONCE(kvm->arch.nx_huge_page_recovery_thread);
+	if (nx_thread)
+		vhost_task_wake(nx_thread);
+}
 static int get_nx_huge_pages(char *buffer, const struct kernel_param *kp)
 {
 	if (nx_hugepage_mitigation_hard_disabled)
 			kvm_mmu_zap_all_fast(kvm);
 			mutex_unlock(&kvm->slots_lock);
-			vhost_task_wake(kvm->arch.nx_huge_page_recovery_thread);
+			kvm_wake_nx_recovery_thread(kvm);
 		}
 		mutex_unlock(&kvm_lock);
 	}
 		mutex_lock(&kvm_lock);
 		list_for_each_entry(kvm, &vm_list, vm_list)
-			vhost_task_wake(kvm->arch.nx_huge_page_recovery_thread);
+			kvm_wake_nx_recovery_thread(kvm);
 		mutex_unlock(&kvm_lock);
 	}
 {
 	struct kvm_arch *ka = container_of(once, struct kvm_arch, nx_once);
 	struct kvm *kvm = container_of(ka, struct kvm, arch);
+	struct vhost_task *nx_thread;
 	kvm->arch.nx_huge_page_last = get_jiffies_64();
-	kvm->arch.nx_huge_page_recovery_thread = vhost_task_create(
+	nx_thread = vhost_task_create(kvm_nx_huge_page_recovery_worker,
-		kvm_nx_huge_page_recovery_worker, kvm_nx_huge_page_recovery_worker_kill,
+				      kvm_nx_huge_page_recovery_worker_kill,
-		kvm, "kvm-nx-lpage-recovery");
+				      kvm, "kvm-nx-lpage-recovery");
-	if (kvm->arch.nx_huge_page_recovery_thread)
+	if (!nx_thread)
-		vhost_task_start(kvm->arch.nx_huge_page_recovery_thread);
+		return;
+	vhost_task_start(nx_thread);
+	/* Make the task visible only once it is fully started. */
+	WRITE_ONCE(kvm->arch.nx_huge_page_recovery_thread, nx_thread);
 }
 int kvm_mmu_post_init_vm(struct kvm *kvm)

arch/x86/kvm/svm/nested.c+5−5

 	u32 pause_count12;
 	u32 pause_thresh12;
+	nested_svm_transition_tlb_flush(vcpu);
+	/* Enter Guest-Mode */
+	enter_guest_mode(vcpu);
 	/*
 	 * Filled at exit: exit_code, exit_code_hi, exit_info_1, exit_info_2,
 	 * exit_int_info, exit_int_info_err, next_rip, insn_len, insn_bytes.
 		}
 	}
-	nested_svm_transition_tlb_flush(vcpu);
-	/* Enter Guest-Mode */
-	enter_guest_mode(vcpu);
 	/*
 	 * Merge guest and host intercepts - must be called with vcpu in
 	 * guest-mode to take effect.

arch/x86/kvm/svm/sev.c+10−0

@@ -2972,6 +2972,16 @@ void __init sev_hardware_setup(void) · 2971 unmodified lines
2972	WARN_ON_ONCE(!boot_cpu_has(X86_FEATURE_FLUSHBYASID)))	2972	WARN_ON_ONCE(!boot_cpu_has(X86_FEATURE_FLUSHBYASID)))
2973	goto out;	2973	goto out;
2974		2974
		2975	/*
		2976	* The kernel's initcall infrastructure lacks the ability to express
		2977	* dependencies between initcalls, whereas the modules infrastructure
		2978	* automatically handles dependencies via symbol loading. Ensure the
		2979	* PSP SEV driver is initialized before proceeding if KVM is built-in,
		2980	* as the dependency isn't handled by the initcall infrastructure.
		2981	*/
		2982	if (IS_BUILTIN(CONFIG_KVM_AMD) && sev_module_init())
		2983	goto out;
		2984
2975	/* Retrieve SEV CPUID information */	2985	/* Retrieve SEV CPUID information */
2976	cpuid(0x8000001f, &eax, &ebx, &ecx, &edx);	2986	cpuid(0x8000001f, &eax, &ebx, &ecx, &edx);
2977		2987

arch/x86/kvm/svm/svm.c+6−7

 	svm->asid = sd->next_asid++;
 }
-static void svm_set_dr6(struct vcpu_svm *svm, unsigned long value)
+static void svm_set_dr6(struct kvm_vcpu *vcpu, unsigned long value)
 {
-	struct vmcb *vmcb = svm->vmcb;
+	struct vmcb *vmcb = to_svm(vcpu)->vmcb;
-	if (svm->vcpu.arch.guest_state_protected)
+	if (vcpu->arch.guest_state_protected)
 		return;
 	if (unlikely(value != vmcb->save.dr6)) {
 	 * Run with all-zero DR6 unless needed, so that we can get the exact cause
 	 * of a #DB.
 	 */
-	if (unlikely(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT))
+	if (likely(!(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)))
-		svm_set_dr6(svm, vcpu->arch.dr6);
+		svm_set_dr6(vcpu, DR6_ACTIVE_LOW);
-	else
-		svm_set_dr6(svm, DR6_ACTIVE_LOW);
 	clgi();
 	kvm_load_guest_xsave_state(vcpu);
 	.set_idt = svm_set_idt,
 	.get_gdt = svm_get_gdt,
 	.set_gdt = svm_set_gdt,
+	.set_dr6 = svm_set_dr6,
 	.set_dr7 = svm_set_dr7,
 	.sync_dirty_debug_regs = svm_sync_dirty_debug_regs,
 	.cache_reg = svm_cache_reg,

arch/x86/kvm/vmx/main.c+1−0

@@ -61,6 +61,7 @@ struct kvm_x86_ops vt_x86_ops __initdata = { · 60 unmodified lines
61	.set_idt = vmx_set_idt,	61	.set_idt = vmx_set_idt,
62	.get_gdt = vmx_get_gdt,	62	.get_gdt = vmx_get_gdt,
63	.set_gdt = vmx_set_gdt,	63	.set_gdt = vmx_set_gdt,
		64	.set_dr6 = vmx_set_dr6,
64	.set_dr7 = vmx_set_dr7,	65	.set_dr7 = vmx_set_dr7,
65	.sync_dirty_debug_regs = vmx_sync_dirty_debug_regs,	66	.sync_dirty_debug_regs = vmx_sync_dirty_debug_regs,
66	.cache_reg = vmx_cache_reg,	67	.cache_reg = vmx_cache_reg,

arch/x86/kvm/vmx/vmx.c+6−4

 	set_debugreg(DR6_RESERVED, 6);
 }
+void vmx_set_dr6(struct kvm_vcpu *vcpu, unsigned long val)
+{
+	lockdep_assert_irqs_disabled();
+	set_debugreg(vcpu->arch.dr6, 6);
+}
 void vmx_set_dr7(struct kvm_vcpu *vcpu, unsigned long val)
 {
 	vmcs_writel(GUEST_DR7, val);
 		vmx->loaded_vmcs->host_state.cr4 = cr4;
 	}
-	/* When KVM_DEBUGREG_WONT_EXIT, dr6 is accessible in guest. */
-	if (unlikely(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT))
-		set_debugreg(vcpu->arch.dr6, 6);
 	/* When single-stepping over STI and MOV SS, we must clear the
 	 * corresponding interruptibility bits in the guest state. Otherwise
 	 * vmentry fails as it then expects bit 14 (BS) in pending debug

arch/x86/kvm/vmx/x86_ops.h+1−0

@@ -73,6 +73,7 @@ void vmx_get_idt(struct kvm_vcpu vcpu, struct desc_ptr dt); · 72 unmodified lines
73	void vmx_set_idt(struct kvm_vcpu vcpu, struct desc_ptr dt);	73	void vmx_set_idt(struct kvm_vcpu vcpu, struct desc_ptr dt);
74	void vmx_get_gdt(struct kvm_vcpu vcpu, struct desc_ptr dt);	74	void vmx_get_gdt(struct kvm_vcpu vcpu, struct desc_ptr dt);
75	void vmx_set_gdt(struct kvm_vcpu vcpu, struct desc_ptr dt);	75	void vmx_set_gdt(struct kvm_vcpu vcpu, struct desc_ptr dt);
		76	void vmx_set_dr6(struct kvm_vcpu *vcpu, unsigned long val);
76	void vmx_set_dr7(struct kvm_vcpu *vcpu, unsigned long val);	77	void vmx_set_dr7(struct kvm_vcpu *vcpu, unsigned long val);
77	void vmx_sync_dirty_debug_regs(struct kvm_vcpu *vcpu);	78	void vmx_sync_dirty_debug_regs(struct kvm_vcpu *vcpu);
78	void vmx_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg);	79	void vmx_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg);

arch/x86/kvm/x86.c+4−6

 		set_debugreg(vcpu->arch.eff_db[1], 1);
 		set_debugreg(vcpu->arch.eff_db[2], 2);
 		set_debugreg(vcpu->arch.eff_db[3], 3);
+		/* When KVM_DEBUGREG_WONT_EXIT, dr6 is accessible in guest. */
+		if (unlikely(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT))
+			kvm_x86_call(set_dr6)(vcpu, vcpu->arch.dr6);
 	} else if (unlikely(hw_breakpoint_active())) {
 		set_debugreg(0, 7);
 	}
 			     "does not run without ignore_msrs=1, please report it to kvm@vger.kernel.org.\n");
 	}
+	once_init(&kvm->arch.nx_once);
 	return 0;
 out_uninit_mmu:
 	return ret;
 }
-int kvm_arch_post_init_vm(struct kvm *kvm)
-{
-	once_init(&kvm->arch.nx_once);
-	return 0;
-}
 static void kvm_unload_vcpu_mmu(struct kvm_vcpu *vcpu)
 {
 	vcpu_load(vcpu);

arch/x86/um/os-Linux/registers.c+18−3

 #include <registers.h>
 #include <sys/mman.h>
+static unsigned long ptrace_regset;
 unsigned long host_fp_size;
 int get_fp_registers(int pid, unsigned long *regs)
 		.iov_len = host_fp_size,
 	};
-	if (ptrace(PTRACE_GETREGSET, pid, NT_X86_XSTATE, &iov) < 0)
+	if (ptrace(PTRACE_GETREGSET, pid, ptrace_regset, &iov) < 0)
 		return -errno;
 	return 0;
 }
 		.iov_len = host_fp_size,
 	};
-	if (ptrace(PTRACE_SETREGSET, pid, NT_X86_XSTATE, &iov) < 0)
+	if (ptrace(PTRACE_SETREGSET, pid, ptrace_regset, &iov) < 0)
 		return -errno;
 	return 0;
 }
 		return -ENOMEM;
 	/* GDB has x86_xsave_length, which uses x86_cpuid_count */
-	ret = ptrace(PTRACE_GETREGSET, pid, NT_X86_XSTATE, &iov);
+	ptrace_regset = NT_X86_XSTATE;
+	ret = ptrace(PTRACE_GETREGSET, pid, ptrace_regset, &iov);
 	if (ret)
 		ret = -errno;
+	if (ret == -ENODEV) {
+#ifdef CONFIG_X86_32
+		ptrace_regset = NT_PRXFPREG;
+#else
+		ptrace_regset = NT_PRFPREG;
+#endif
+		iov.iov_len = 2 * 1024 * 1024;
+		ret = ptrace(PTRACE_GETREGSET, pid, ptrace_regset, &iov);
+		if (ret)
+			ret = -errno;
+	}
 	munmap(iov.iov_base, 2 * 1024 * 1024);
 	host_fp_size = iov.iov_len;

arch/x86/um/signal.c+10−3

 	 * Put magic/size values for userspace. We do not bother to verify them
 	 * later on, however, userspace needs them should it try to read the
 	 * XSTATE data. And ptrace does not fill in these parts.
+	 *
+	 * Skip this if we do not have an XSTATE frame.
 	 */
+	if (host_fp_size <= sizeof(to_fp64->fpstate))
+		return 0;
 	BUILD_BUG_ON(sizeof(int) != FP_XSTATE_MAGIC2_SIZE);
 #ifdef CONFIG_X86_32
 	__put_user(offsetof(struct _fpstate_32, _fxsr_env) +
 	int err = 0, sig = ksig->sig;
 	unsigned long fp_to;
-	frame = (struct rt_sigframe __user *)
+	frame = (void __user *)stack_top - sizeof(struct rt_sigframe);
-		round_down(stack_top - sizeof(struct rt_sigframe), 16);
 	/* Add required space for math frame */
-	frame = (struct rt_sigframe __user *)((unsigned long)frame - math_size);
+	frame = (void __user *)((unsigned long)frame - math_size);
+	/* ABI requires 16 byte boundary alignment */
+	frame = (void __user *)round_down((unsigned long)frame, 16);
 	/* Subtract 128 for a red zone and 8 for proper alignment */
 	frame = (struct rt_sigframe __user *) ((unsigned long) frame - 128 - 8);

arch/x86/virt/svm/sev.c+7−16

  * described in the SNP_INIT_EX firmware command description in the SNP
  * firmware ABI spec.
  */
-static int __init snp_rmptable_init(void)
+int __init snp_rmptable_init(void)
 {
 	unsigned int i;
 	u64 val;
-	if (!cc_platform_has(CC_ATTR_HOST_SEV_SNP))
+	if (WARN_ON_ONCE(!cc_platform_has(CC_ATTR_HOST_SEV_SNP)))
-		return 0;
+		return -ENOSYS;
-	if (!amd_iommu_snp_en)
+	if (WARN_ON_ONCE(!amd_iommu_snp_en))
-		goto nosnp;
+		return -ENOSYS;
 	if (!setup_rmptable())
-		goto nosnp;
+		return -ENOSYS;
 	/*
 	 * Check if SEV-SNP is already enabled, this can happen in case of
 	/* Zero out the RMP bookkeeping area */
 	if (!clear_rmptable_bookkeeping()) {
 		free_rmp_segment_table();
-		goto nosnp;
+		return -ENOSYS;
 	}
 	/* Zero out the RMP entries */
 	crash_kexec_post_notifiers = true;
 	return 0;
-nosnp:
-	cc_platform_clear(CC_ATTR_HOST_SEV_SNP);
-	return -ENOSYS;
 }
-/*
- * This must be called after the IOMMU has been initialized.
- */
-device_initcall(snp_rmptable_init);
 static void set_rmp_segment_info(unsigned int segment_shift)
 {
 	rmp_segment_shift = segment_shift;

arch/x86/xen/mmu_pv.c+62−9

  */
 static DEFINE_SPINLOCK(xen_reservation_lock);
+/* Protected by xen_reservation_lock. */
+#define MIN_CONTIG_ORDER 9 /* 2MB */
+static unsigned int discontig_frames_order = MIN_CONTIG_ORDER;
+static unsigned long discontig_frames_early[1UL << MIN_CONTIG_ORDER] __initdata;
+static unsigned long *discontig_frames __refdata = discontig_frames_early;
+static bool discontig_frames_dyn;
+static int alloc_discontig_frames(unsigned int order)
+{
+	unsigned long *new_array, *old_array;
+	unsigned int old_order;
+	unsigned long flags;
+	BUG_ON(order < MIN_CONTIG_ORDER);
+	BUILD_BUG_ON(sizeof(discontig_frames_early) != PAGE_SIZE);
+	new_array = (unsigned long *)__get_free_pages(GFP_KERNEL,
+						      order - MIN_CONTIG_ORDER);
+	if (!new_array)
+		return -ENOMEM;
+	spin_lock_irqsave(&xen_reservation_lock, flags);
+	old_order = discontig_frames_order;
+	if (order > discontig_frames_order || !discontig_frames_dyn) {
+		if (!discontig_frames_dyn)
+			old_array = NULL;
+		else
+			old_array = discontig_frames;
+		discontig_frames = new_array;
+		discontig_frames_order = order;
+		discontig_frames_dyn = true;
+	} else {
+		old_array = new_array;
+	}
+	spin_unlock_irqrestore(&xen_reservation_lock, flags);
+	free_pages((unsigned long)old_array, old_order - MIN_CONTIG_ORDER);
+	return 0;
+}
 /*
  * Note about cr3 (pagetable base) values:
  *
 	SetPagePinned(virt_to_page(level3_user_vsyscall));
 #endif
 	xen_pgd_walk(&init_mm, xen_mark_pinned, FIXADDR_TOP);
+	if (alloc_discontig_frames(MIN_CONTIG_ORDER))
+		BUG();
 }
 static void xen_unpin_page(struct mm_struct *mm, struct page *page,
 	memset(dummy_mapping, 0xff, PAGE_SIZE);
 }
-/* Protected by xen_reservation_lock. */
-#define MAX_CONTIG_ORDER 9 /* 2MB */
-static unsigned long discontig_frames[1<<MAX_CONTIG_ORDER];
 #define VOID_PTE (mfn_pte(0, __pgprot(0)))
 static void xen_zap_pfn_range(unsigned long vaddr, unsigned int order,
 				unsigned long *in_frames,
 				 unsigned int address_bits,
 				 dma_addr_t *dma_handle)
 {
-	unsigned long *in_frames = discontig_frames, out_frame;
+	unsigned long *in_frames, out_frame;
 	unsigned long  flags;
 	int            success;
 	unsigned long vstart = (unsigned long)phys_to_virt(pstart);
-	if (unlikely(order > MAX_CONTIG_ORDER))
+	if (unlikely(order > discontig_frames_order)) {
-		return -ENOMEM;
+		if (!discontig_frames_dyn)
+			return -ENOMEM;
+		if (alloc_discontig_frames(order))
+			return -ENOMEM;
+	}
 	memset((void *) vstart, 0, PAGE_SIZE << order);
 	spin_lock_irqsave(&xen_reservation_lock, flags);
+	in_frames = discontig_frames;
 	/* 1. Zap current PTEs, remembering MFNs. */
 	xen_zap_pfn_range(vstart, order, in_frames, NULL);
 void xen_destroy_contiguous_region(phys_addr_t pstart, unsigned int order)
 {
-	unsigned long *out_frames = discontig_frames, in_frame;
+	unsigned long *out_frames, in_frame;
 	unsigned long  flags;
 	int success;
 	unsigned long vstart;
-	if (unlikely(order > MAX_CONTIG_ORDER))
+	if (unlikely(order > discontig_frames_order))
 		return;
 	vstart = (unsigned long)phys_to_virt(pstart);
 	spin_lock_irqsave(&xen_reservation_lock, flags);
+	out_frames = discontig_frames;
 	/* 1. Find start MFN of contiguous extent. */
 	in_frame = virt_to_mfn((void *)vstart);

arch/x86/xen/xen-head.S+3−8

 	push %r10
 	push %r9
 	push %r8
-#ifdef CONFIG_FRAME_POINTER
-	pushq $0	/* Dummy push for stack alignment. */
-#endif
 #endif
 	/* Set the vendor specific function. */
 	call __xen_hypercall_setfunc
 	pop %ebx
 	pop %eax
 #else
-	lea xen_hypercall_amd(%rip), %rbx
+	lea xen_hypercall_amd(%rip), %rcx
-	cmp %rax, %rbx
+	cmp %rax, %rcx
-#ifdef CONFIG_FRAME_POINTER
-	pop %rax	/* Dummy pop. */
-#endif
 	pop %r8
 	pop %r9
 	pop %r10
 	pop %rcx
 	pop %rax
 #endif
+	FRAME_END
 	/* Use correct hypercall function. */
 	jz xen_hypercall_amd
 	jmp xen_hypercall_intel

block/partitions/mac.c+15−3

 	}
 	secsize = be16_to_cpu(md->block_size);
 	put_dev_sector(sect);
+	/*
+	 * If the "block size" is not a power of 2, things get weird - we might
+	 * end up with a partition straddling a sector boundary, so we wouldn't
+	 * be able to read a partition entry with read_part_sector().
+	 * Real block sizes are probably (?) powers of two, so just require
+	 * that.
+	 */
+	if (!is_power_of_2(secsize))
+		return -1;
 	datasize = round_down(secsize, 512);
 	data = read_part_sector(state, datasize / 512, &sect);
 	if (!data)
 		return -1;
 	partoffset = secsize % 512;
-	if (partoffset + sizeof(*part) > datasize)
+	if (partoffset + sizeof(*part) > datasize) {
+		put_dev_sector(sect);
 		return -1;
+	}
 	part = (struct mac_partition *) (data + partoffset);
 	if (be16_to_cpu(part->signature) != MAC_PARTITION_MAGIC) {
 		put_dev_sector(sect);
 				int i, l;
 				goodness++;
-				l = strlen(part->name);
+				l = strnlen(part->name, sizeof(part->name));
-				if (strcmp(part->name, "/") == 0)
+				if (strncmp(part->name, "/", sizeof(part->name)) == 0)
 					goodness++;
 				for (i = 0; i <= l - 4; ++i) {
 					if (strncasecmp(part->name + i, "root",

drivers/accel/amdxdna/amdxdna_pci_drv.c+5−0

 #define AMDXDNA_AUTOSUSPEND_DELAY	5000 /* milliseconds */
+MODULE_FIRMWARE("amdnpu/1502_00/npu.sbin");
+MODULE_FIRMWARE("amdnpu/17f0_10/npu.sbin");
+MODULE_FIRMWARE("amdnpu/17f0_11/npu.sbin");
+MODULE_FIRMWARE("amdnpu/17f0_20/npu.sbin");
 /*
  * Bind the driver base on (vendor_id, device_id) pair and later use the
  * (device_id, rev_id) pair as a key to select the devices. The devices with

drivers/accel/ivpu/ivpu_drv.c+6−2

 	if (ivpu_fw_is_cold_boot(vdev)) {
 		ret = ivpu_pm_dct_init(vdev);
 		if (ret)
-			goto err_diagnose_failure;
+			goto err_disable_ipc;
 		ret = ivpu_hw_sched_init(vdev);
 		if (ret)
-			goto err_diagnose_failure;
+			goto err_disable_ipc;
 	}
 	return 0;
+err_disable_ipc:
+	ivpu_ipc_disable(vdev);
+	ivpu_hw_irq_disable(vdev);
+	disable_irq(vdev->irq);
 err_diagnose_failure:
 	ivpu_hw_diagnose_failure(vdev);
 	ivpu_mmu_evtq_dump(vdev);

drivers/accel/ivpu/ivpu_pm.c+47−37

@@ -115,41 +115,57 @@ err_power_down: · 114 unmodified lines
115	return ret;	115	return ret;
116	}	116	}
117		117
118	static void ivpu_pm_recovery_work(struct work_struct *work)	118	static void ivpu_pm_reset_begin(struct ivpu_device *vdev)
119	{	119	{
120	struct ivpu_pm_info *pm = container_of(work, struct ivpu_pm_info, recovery_work);	120	pm_runtime_disable(vdev->drm.dev);
121	struct ivpu_device *vdev = pm->vdev;
122	char *evt[2] = {"IVPU_PM_EVENT=IVPU_RECOVER", NULL};
123	int ret;
124
125	ivpu_err(vdev, "Recovering the NPU (reset #%d)\n", atomic_read(&vdev->pm->reset_counter));
126
127	ret = pm_runtime_resume_and_get(vdev->drm.dev);
128	if (ret)
129	ivpu_err(vdev, "Failed to resume NPU: %d\n", ret);
130
131	ivpu_jsm_state_dump(vdev);
132	ivpu_dev_coredump(vdev);
133		121
134	atomic_inc(&vdev->pm->reset_counter);	122	atomic_inc(&vdev->pm->reset_counter);
135	atomic_set(&vdev->pm->reset_pending, 1);	123	atomic_set(&vdev->pm->reset_pending, 1);
136	down_write(&vdev->pm->reset_lock);	124	down_write(&vdev->pm->reset_lock);
		125	}
		126
		127	static void ivpu_pm_reset_complete(struct ivpu_device *vdev)
		128	{
		129	int ret;
137		130
138	ivpu_suspend(vdev);
139	ivpu_pm_prepare_cold_boot(vdev);	131	ivpu_pm_prepare_cold_boot(vdev);
140	ivpu_jobs_abort_all(vdev);	132	ivpu_jobs_abort_all(vdev);
141	ivpu_ms_cleanup_all(vdev);	133	ivpu_ms_cleanup_all(vdev);
142		134
143	ret = ivpu_resume(vdev);	135	ret = ivpu_resume(vdev);
144	if (ret)	136	if (ret) {
145	ivpu_err(vdev, "Failed to resume NPU: %d\n", ret);	137	ivpu_err(vdev, "Failed to resume NPU: %d\n", ret);
		138	pm_runtime_set_suspended(vdev->drm.dev);
		139	} else {
		140	pm_runtime_set_active(vdev->drm.dev);
		141	}
146		142
147	up_write(&vdev->pm->reset_lock);	143	up_write(&vdev->pm->reset_lock);
148	atomic_set(&vdev->pm->reset_pending, 0);	144	atomic_set(&vdev->pm->reset_pending, 0);
149		145
150	kobject_uevent_env(&vdev->drm.dev->kobj, KOBJ_CHANGE, evt);
151	pm_runtime_mark_last_busy(vdev->drm.dev);	146	pm_runtime_mark_last_busy(vdev->drm.dev);
152	pm_runtime_put_autosuspend(vdev->drm.dev);	147	pm_runtime_enable(vdev->drm.dev);
		148	}
		149
		150	static void ivpu_pm_recovery_work(struct work_struct *work)
		151	{
		152	struct ivpu_pm_info *pm = container_of(work, struct ivpu_pm_info, recovery_work);
		153	struct ivpu_device *vdev = pm->vdev;
		154	char *evt[2] = {"IVPU_PM_EVENT=IVPU_RECOVER", NULL};
		155
		156	ivpu_err(vdev, "Recovering the NPU (reset #%d)\n", atomic_read(&vdev->pm->reset_counter));
		157
		158	ivpu_pm_reset_begin(vdev);
		159
		160	if (!pm_runtime_status_suspended(vdev->drm.dev)) {
		161	ivpu_jsm_state_dump(vdev);
		162	ivpu_dev_coredump(vdev);
		163	ivpu_suspend(vdev);
		164	}
		165
		166	ivpu_pm_reset_complete(vdev);
		167
		168	kobject_uevent_env(&vdev->drm.dev->kobj, KOBJ_CHANGE, evt);
153	}	169	}
154		170
155	void ivpu_pm_trigger_recovery(struct ivpu_device vdev, const char reason)	171	void ivpu_pm_trigger_recovery(struct ivpu_device vdev, const char reason)
@@ -309,7 +325,10 @@ int ivpu_rpm_get(struct ivpu_device *vdev) · 153 unmodified lines
309	int ret;	325	int ret;
310		326
311	ret = pm_runtime_resume_and_get(vdev->drm.dev);	327	ret = pm_runtime_resume_and_get(vdev->drm.dev);
312	drm_WARN_ON(&vdev->drm, ret < 0);	328	if (ret < 0) {
		329	ivpu_err(vdev, "Failed to resume NPU: %d\n", ret);
		330	pm_runtime_set_suspended(vdev->drm.dev);
		331	}
313		332
314	return ret;	333	return ret;
315	}	334	}
@@ -325,16 +344,13 @@ void ivpu_pm_reset_prepare_cb(struct pci_dev *pdev) · 9 unmodified lines
325	struct ivpu_device *vdev = pci_get_drvdata(pdev);	344	struct ivpu_device *vdev = pci_get_drvdata(pdev);
326		345
327	ivpu_dbg(vdev, PM, "Pre-reset..\n");	346	ivpu_dbg(vdev, PM, "Pre-reset..\n");
328	atomic_inc(&vdev->pm->reset_counter);
329	atomic_set(&vdev->pm->reset_pending, 1);
330		347
331	pm_runtime_get_sync(vdev->drm.dev);	348	ivpu_pm_reset_begin(vdev);
332	down_write(&vdev->pm->reset_lock);	349
333	ivpu_prepare_for_reset(vdev);	350	if (!pm_runtime_status_suspended(vdev->drm.dev)) {
334	ivpu_hw_reset(vdev);	351	ivpu_prepare_for_reset(vdev);
335	ivpu_pm_prepare_cold_boot(vdev);	352	ivpu_hw_reset(vdev);
336	ivpu_jobs_abort_all(vdev);	353	}
337	ivpu_ms_cleanup_all(vdev);
338		354
339	ivpu_dbg(vdev, PM, "Pre-reset done.\n");	355	ivpu_dbg(vdev, PM, "Pre-reset done.\n");
340	}	356	}
@@ -342,18 +358,12 @@ void ivpu_pm_reset_prepare_cb(struct pci_dev *pdev) · 1 unmodified line
342	void ivpu_pm_reset_done_cb(struct pci_dev *pdev)	358	void ivpu_pm_reset_done_cb(struct pci_dev *pdev)
343	{	359	{
344	struct ivpu_device *vdev = pci_get_drvdata(pdev);	360	struct ivpu_device *vdev = pci_get_drvdata(pdev);
345	int ret;
346		361
347	ivpu_dbg(vdev, PM, "Post-reset..\n");	362	ivpu_dbg(vdev, PM, "Post-reset..\n");
348	ret = ivpu_resume(vdev);
349	if (ret)
350	ivpu_err(vdev, "Failed to set RESUME state: %d\n", ret);
351	up_write(&vdev->pm->reset_lock);
352	atomic_set(&vdev->pm->reset_pending, 0);
353	ivpu_dbg(vdev, PM, "Post-reset done.\n");
354		363
355	pm_runtime_mark_last_busy(vdev->drm.dev);	364	ivpu_pm_reset_complete(vdev);
356	pm_runtime_put_autosuspend(vdev->drm.dev);	365
		366	ivpu_dbg(vdev, PM, "Post-reset done.\n");
357	}	367	}
358		368
359	void ivpu_pm_init(struct ivpu_device *vdev)	369	void ivpu_pm_init(struct ivpu_device *vdev)

drivers/acpi/arm64/gtdt.c+8−4

 {
 	void *platform_timer;
 	struct acpi_table_gtdt *gtdt;
-	int cnt = 0;
+	u32 cnt = 0;
 	gtdt = container_of(table, struct acpi_table_gtdt, header);
 	acpi_gtdt_desc.gtdt = gtdt;
 		cnt++;
 	if (cnt != gtdt->platform_timer_count) {
+		cnt = min(cnt, gtdt->platform_timer_count);
+		pr_err(FW_BUG "limiting Platform Timer count to %d\n", cnt);
+	}
+	if (!cnt) {
 		acpi_gtdt_desc.platform_timer = NULL;
-		pr_err(FW_BUG "invalid timer data.\n");
+		return 0;
-		return -EINVAL;
 	}
 	if (platform_timer_count)
-		*platform_timer_count = gtdt->platform_timer_count;
+		*platform_timer_count = cnt;
 	return 0;
 }

drivers/acpi/prmt.c+1−3

 		if (!handler || !module)
 			goto invalid_guid;
-		if (!handler->handler_addr ||
+		if (!handler->handler_addr) {
-		    !handler->static_data_buffer_addr ||
-		    !handler->acpi_param_buffer_addr) {
 			buffer->prm_status = PRM_HANDLER_ERROR;
 			return AE_OK;
 		}

drivers/acpi/property.c+5−5

 		}
 		break;
 	}
-	if (nval == 0)
-		return -EINVAL;
 	if (obj->type == ACPI_TYPE_BUFFER) {
 		if (proptype != DEV_PROP_U8)
 		ret = acpi_copy_property_array_uint(items, (u64 *)val, nval);
 		break;
 	case DEV_PROP_STRING:
-		ret = acpi_copy_property_array_string(
+		nval = min_t(u32, nval, obj->package.count);
-			items, (char **)val,
+		if (nval == 0)
-			min_t(u32, nval, obj->package.count));
+			return -ENODATA;
+		ret = acpi_copy_property_array_string(items, (char **)val, nval);
 		break;
 	default:
 		ret = -EINVAL;

drivers/acpi/resource.c+6−0

 			DMI_MATCH(DMI_BOARD_NAME, "RP-15"),
 		},
 	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Eluktronics Inc."),
+			DMI_MATCH(DMI_BOARD_NAME, "MECH-17"),
+		},
+	},
 	{
 		/* TongFang GM6XGxX/TUXEDO Stellaris 16 Gen5 AMD */
 		.matches = {

drivers/base/Makefile+1−1

@@ -6,7 +6,7 @@ obj-y := component.o core.o bus.o dd.o syscore.o \ · 5 unmodified lines
6	cpu.o firmware.o init.o map.o devres.o \	6	cpu.o firmware.o init.o map.o devres.o \
7	attribute_container.o transport_class.o \	7	attribute_container.o transport_class.o \
8	topology.o container.o property.o cacheinfo.o \	8	topology.o container.o property.o cacheinfo.o \
9	swnode.o	9	swnode.o faux.o
10	obj-$(CONFIG_AUXILIARY_BUS) += auxiliary.o	10	obj-$(CONFIG_AUXILIARY_BUS) += auxiliary.o
11	obj-$(CONFIG_DEVTMPFS) += devtmpfs.o	11	obj-$(CONFIG_DEVTMPFS) += devtmpfs.o
12	obj-y += power/	12	obj-y += power/

drivers/base/base.h+1−0

@@ -137,6 +137,7 @@ int hypervisor_init(void); · 136 unmodified lines
137	static inline int hypervisor_init(void) { return 0; }	137	static inline int hypervisor_init(void) { return 0; }
138	#endif	138	#endif
139	int platform_bus_init(void);	139	int platform_bus_init(void);
		140	int faux_bus_init(void);
140	void cpu_dev_init(void);	141	void cpu_dev_init(void);
141	void container_dev_init(void);	142	void container_dev_init(void);
142	#ifdef CONFIG_AUXILIARY_BUS	143	#ifdef CONFIG_AUXILIARY_BUS

drivers/base/faux.c+232−0

@@ -0,0 +1,232 @@
	1	// SPDX-License-Identifier: GPL-2.0-only
	2	/*
	3	* Copyright (c) 2025 Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	4	* Copyright (c) 2025 The Linux Foundation
	5	*
	6	* A "simple" faux bus that allows devices to be created and added
	7	* automatically to it. This is to be used whenever you need to create a
	8	* device that is not associated with any "real" system resources, and do
	9	* not want to have to deal with a bus/driver binding logic. It is
	10	* intended to be very simple, with only a create and a destroy function
	11	* available.
	12	*/
	13	#include <linux/err.h>
	14	#include <linux/init.h>
	15	#include <linux/slab.h>
	16	#include <linux/string.h>
	17	#include <linux/container_of.h>
	18	#include <linux/device/faux.h>
	19	#include "base.h"
	20
	21	/*
	22	* Internal wrapper structure so we can hold a pointer to the
	23	* faux_device_ops for this device.
	24	*/
	25	struct faux_object {
	26	struct faux_device faux_dev;
	27	const struct faux_device_ops *faux_ops;
	28	};
	29	#define to_faux_object(dev) container_of_const(dev, struct faux_object, faux_dev.dev)
	30
	31	static struct device faux_bus_root = {
	32	.init_name = "faux",
	33	};
	34
	35	static int faux_match(struct device dev, const struct device_driver drv)
	36	{
	37	/* Match always succeeds, we only have one driver */
	38	return 1;
	39	}
	40
	41	static int faux_probe(struct device *dev)
	42	{
	43	struct faux_object *faux_obj = to_faux_object(dev);
	44	struct faux_device *faux_dev = &faux_obj->faux_dev;
	45	const struct faux_device_ops *faux_ops = faux_obj->faux_ops;
	46	int ret = 0;
	47
	48	if (faux_ops && faux_ops->probe)
	49	ret = faux_ops->probe(faux_dev);
	50
	51	return ret;
	52	}
	53
	54	static void faux_remove(struct device *dev)
	55	{
	56	struct faux_object *faux_obj = to_faux_object(dev);
	57	struct faux_device *faux_dev = &faux_obj->faux_dev;
	58	const struct faux_device_ops *faux_ops = faux_obj->faux_ops;
	59
	60	if (faux_ops && faux_ops->remove)
	61	faux_ops->remove(faux_dev);
	62	}
	63
	64	static const struct bus_type faux_bus_type = {
	65	.name = "faux",
	66	.match = faux_match,
	67	.probe = faux_probe,
	68	.remove = faux_remove,
	69	};
	70
	71	static struct device_driver faux_driver = {
	72	.name = "faux_driver",
	73	.bus = &faux_bus_type,
	74	.probe_type = PROBE_FORCE_SYNCHRONOUS,
	75	};
	76
	77	static void faux_device_release(struct device *dev)
	78	{
	79	struct faux_object *faux_obj = to_faux_object(dev);
	80
	81	kfree(faux_obj);
	82	}
	83
	84	/**
	85	* faux_device_create_with_groups - Create and register with the driver
	86	* core a faux device and populate the device with an initial
	87	* set of sysfs attributes.
	88	* @name: The name of the device we are adding, must be unique for
	89	* all faux devices.
	90	* @parent: Pointer to a potential parent struct device. If set to
	91	* NULL, the device will be created in the "root" of the faux
	92	* device tree in sysfs.
	93	* @faux_ops: struct faux_device_ops that the new device will call back
	94	* into, can be NULL.
	95	* @groups: The set of sysfs attributes that will be created for this
	96	* device when it is registered with the driver core.
	97	*
	98	* Create a new faux device and register it in the driver core properly.
	99	* If present, callbacks in @faux_ops will be called with the device that
	100	* for the caller to do something with at the proper time given the
	101	* device's lifecycle.
	102	*
	103	* Note, when this function is called, the functions specified in struct
	104	* faux_ops can be called before the function returns, so be prepared for
	105	* everything to be properly initialized before that point in time.
	106	*
	107	* Return:
	108	* * NULL if an error happened with creating the device
	109	* * pointer to a valid struct faux_device that is registered with sysfs
	110	*/
	111	struct faux_device faux_device_create_with_groups(const char name,
	112	struct device *parent,
	113	const struct faux_device_ops *faux_ops,
	114	const struct attribute_group **groups)
	115	{
	116	struct faux_object *faux_obj;
	117	struct faux_device *faux_dev;
	118	struct device *dev;
	119	int ret;
	120
	121	faux_obj = kzalloc(sizeof(*faux_obj), GFP_KERNEL);
	122	if (!faux_obj)
	123	return NULL;
	124
	125	/* Save off the callbacks so we can use them in the future */
	126	faux_obj->faux_ops = faux_ops;
	127
	128	/* Initialize the device portion and register it with the driver core */
	129	faux_dev = &faux_obj->faux_dev;
	130	dev = &faux_dev->dev;
	131
	132	device_initialize(dev);
	133	dev->release = faux_device_release;
	134	if (parent)
	135	dev->parent = parent;
	136	else
	137	dev->parent = &faux_bus_root;
	138	dev->bus = &faux_bus_type;
	139	dev->groups = groups;
	140	dev_set_name(dev, "%s", name);
	141
	142	ret = device_add(dev);
	143	if (ret) {
	144	pr_err("%s: device_add for faux device '%s' failed with %d\n",
	145	__func__, name, ret);
	146	put_device(dev);
	147	return NULL;
	148	}
	149
	150	return faux_dev;
	151	}
	152	EXPORT_SYMBOL_GPL(faux_device_create_with_groups);
	153
	154	/**
	155	* faux_device_create - create and register with the driver core a faux device
	156	* @name: The name of the device we are adding, must be unique for all
	157	* faux devices.
	158	* @parent: Pointer to a potential parent struct device. If set to
	159	* NULL, the device will be created in the "root" of the faux
	160	* device tree in sysfs.
	161	* @faux_ops: struct faux_device_ops that the new device will call back
	162	* into, can be NULL.
	163	*
	164	* Create a new faux device and register it in the driver core properly.
	165	* If present, callbacks in @faux_ops will be called with the device that
	166	* for the caller to do something with at the proper time given the
	167	* device's lifecycle.
	168	*
	169	* Note, when this function is called, the functions specified in struct
	170	* faux_ops can be called before the function returns, so be prepared for
	171	* everything to be properly initialized before that point in time.
	172	*
	173	* Return:
	174	* * NULL if an error happened with creating the device
	175	* * pointer to a valid struct faux_device that is registered with sysfs
	176	*/
	177	struct faux_device faux_device_create(const char name,
	178	struct device *parent,
	179	const struct faux_device_ops *faux_ops)
	180	{
	181	return faux_device_create_with_groups(name, parent, faux_ops, NULL);
	182	}
	183	EXPORT_SYMBOL_GPL(faux_device_create);
	184
	185	/**
	186	* faux_device_destroy - destroy a faux device
	187	* @faux_dev: faux device to destroy
	188	*
	189	* Unregisters and cleans up a device that was created with a call to
	190	* faux_device_create()
	191	*/
	192	void faux_device_destroy(struct faux_device *faux_dev)
	193	{
	194	struct device *dev = &faux_dev->dev;
	195
	196	if (!faux_dev)
	197	return;
	198
	199	device_del(dev);
	200
	201	/* The final put_device() will clean up the memory we allocated for this device. */
	202	put_device(dev);
	203	}
	204	EXPORT_SYMBOL_GPL(faux_device_destroy);
	205
	206	int __init faux_bus_init(void)
	207	{
	208	int ret;
	209
	210	ret = device_register(&faux_bus_root);
	211	if (ret) {
	212	put_device(&faux_bus_root);
	213	return ret;
	214	}
	215
	216	ret = bus_register(&faux_bus_type);
	217	if (ret)
	218	goto error_bus;
	219
	220	ret = driver_register(&faux_driver);
	221	if (ret)
	222	goto error_driver;
	223
	224	return ret;
	225
	226	error_driver:
	227	bus_unregister(&faux_bus_type);
	228
	229	error_bus:
	230	device_unregister(&faux_bus_root);
	231	return ret;
	232	}

drivers/base/init.c+1−0

@@ -32,6 +32,7 @@ void __init driver_init(void) · 31 unmodified lines
32	/* These are also core pieces, but must come after the	32	/* These are also core pieces, but must come after the
33	* core core pieces.	33	* core core pieces.
34	*/	34	*/
		35	faux_bus_init();
35	of_core_init();	36	of_core_init();
36	platform_bus_init();	37	platform_bus_init();
37	auxiliary_bus_init();	38	auxiliary_bus_init();

drivers/base/power/main.c+9−12

 	return PMSG_ON;
 }
-static void dpm_superior_set_must_resume(struct device *dev, bool set_active)
+static void dpm_superior_set_must_resume(struct device *dev)
 {
 	struct device_link *link;
 	int idx;
-	if (dev->parent) {
+	if (dev->parent)
 		dev->parent->power.must_resume = true;
-		if (set_active)
-			dev->parent->power.set_active = true;
-	}
 	idx = device_links_read_lock();
-	list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node) {
+	list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node)
 		link->supplier->power.must_resume = true;
-		if (set_active)
-			link->supplier->power.set_active = true;
-	}
 	device_links_read_unlock(idx);
 }
 		dev->power.must_resume = true;
 	if (dev->power.must_resume) {
-		dev->power.set_active = dev->power.set_active ||
+		if (dev_pm_test_driver_flags(dev, DPM_FLAG_SMART_SUSPEND)) {
-			dev_pm_test_driver_flags(dev, DPM_FLAG_SMART_SUSPEND);
+			dev->power.set_active = true;
-		dpm_superior_set_must_resume(dev, dev->power.set_active);
+			if (dev->parent && !dev->parent->power.ignore_children)
+				dev->parent->power.set_active = true;
+		}
+		dpm_superior_set_must_resume(dev);
 	}
 Complete:

drivers/base/regmap/regmap-irq.c+2−0

 	kfree(d->wake_buf);
 	kfree(d->mask_buf_def);
 	kfree(d->mask_buf);
+	kfree(d->main_status_buf);
 	kfree(d->status_buf);
 	kfree(d->status_reg_buf);
 	if (d->config_buf) {
 	kfree(d->wake_buf);
 	kfree(d->mask_buf_def);
 	kfree(d->mask_buf);
+	kfree(d->main_status_buf);
 	kfree(d->status_reg_buf);
 	kfree(d->status_buf);
 	if (d->config_buf) {

drivers/block/sunvdc.c+2−2

@@ -1127,8 +1127,8 @@ static void vdc_queue_drain(struct vdc_port *port) · 1126 unmodified lines
1127		1127
1128	spin_lock_irq(&port->vio.lock);	1128	spin_lock_irq(&port->vio.lock);
1129	port->drain = 0;	1129	port->drain = 0;
1130	blk_mq_unquiesce_queue(q, memflags);	1130	blk_mq_unquiesce_queue(q);
1131	blk_mq_unfreeze_queue(q);	1131	blk_mq_unfreeze_queue(q, memflags);
1132	}	1132	}
1133		1133
1134	static void vdc_ldc_reset_timer_work(struct work_struct *work)	1134	static void vdc_ldc_reset_timer_work(struct work_struct *work)

drivers/bluetooth/btintel_pcie.c+4−1

 			if (opcode == 0xfc01)
 				btintel_pcie_inject_cmd_complete(hdev, opcode);
 		}
+		/* Firmware raises alive interrupt on HCI_OP_RESET */
+		if (opcode == HCI_OP_RESET)
+			data->gp0_received = false;
 		hdev->stat.cmd_tx++;
 		break;
 	case HCI_ACLDATA_PKT:
 			   opcode, btintel_pcie_alivectxt_state2str(old_ctxt),
 			   btintel_pcie_alivectxt_state2str(data->alive_intr_ctxt));
 		if (opcode == HCI_OP_RESET) {
-			data->gp0_received = false;
 			ret = wait_event_timeout(data->gp0_wait_q,
 						 data->gp0_received,
 						 msecs_to_jiffies(BTINTEL_DEFAULT_INTR_TIMEOUT_MS));

drivers/bus/moxtet.c+1−1

@@ -657,7 +657,7 @@ static void moxtet_irq_print_chip(struct irq_data d, struct seq_file p) · 656 unmodified lines
657		657
658	id = moxtet->modules[pos->idx];	658	id = moxtet->modules[pos->idx];
659		659
660	seq_printf(p, " moxtet-%s.%i#%i", mox_module_name(id), pos->idx,	660	seq_printf(p, "moxtet-%s.%i#%i", mox_module_name(id), pos->idx,
661	pos->bit);	661	pos->bit);
662	}	662	}
663		663

drivers/cpufreq/Kconfig.arm+2−1

@@ -17,7 +17,8 @@ config ARM_ALLWINNER_SUN50I_CPUFREQ_NVMEM · 16 unmodified lines
17		17
18	config ARM_AIROHA_SOC_CPUFREQ	18	config ARM_AIROHA_SOC_CPUFREQ
19	tristate "Airoha EN7581 SoC CPUFreq support"	19	tristate "Airoha EN7581 SoC CPUFreq support"
20	depends on (ARCH_AIROHA && OF) \|\| COMPILE_TEST	20	depends on ARCH_AIROHA \|\| COMPILE_TEST
		21	depends on OF
21	select PM_OPP	22	select PM_OPP
22	default ARCH_AIROHA	23	default ARCH_AIROHA
23	help	24	help

drivers/cpufreq/amd-pstate.c+10−10

 	if (min_perf < lowest_nonlinear_perf)
 		min_perf = lowest_nonlinear_perf;
-	max_perf = cap_perf;
+	max_perf = cpudata->max_limit_perf;
 	if (max_perf < min_perf)
 		max_perf = min_perf;
 	guard(mutex)(&amd_pstate_driver_lock);
 	ret = amd_pstate_cpu_boost_update(policy, state);
-	policy->boost_enabled = !ret ? state : false;
 	refresh_frequency_limits(policy);
 	return ret;
 static void amd_pstate_update_limits(unsigned int cpu)
 {
-	struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
+	struct cpufreq_policy *policy = NULL;
 	struct amd_cpudata *cpudata;
 	u32 prev_high = 0, cur_high = 0;
 	int ret;
 	bool highest_perf_changed = false;
+	if (!amd_pstate_prefcore)
+		return;
+	policy = cpufreq_cpu_get(cpu);
 	if (!policy)
 		return;
 	cpudata = policy->driver_data;
-	if (!amd_pstate_prefcore)
-		return;
 	guard(mutex)(&amd_pstate_driver_lock);
 	ret = amd_get_highest_perf(cpu, &cur_high);
-	if (ret)
+	if (ret) {
-		goto free_cpufreq_put;
+		cpufreq_cpu_put(policy);
+		return;
+	}
 	prev_high = READ_ONCE(cpudata->prefcore_ranking);
 	highest_perf_changed = (prev_high != cur_high);
 		if (cur_high < CPPC_MAX_PERF)
 			sched_set_itmt_core_prio((int)cur_high, cpu);
 	}
-free_cpufreq_put:
 	cpufreq_cpu_put(policy);
 	if (!highest_perf_changed)

drivers/cpufreq/cpufreq.c+2−1

@@ -1571,7 +1571,8 @@ static int cpufreq_online(unsigned int cpu) · 1570 unmodified lines
1571	policy->cdev = of_cpufreq_cooling_register(policy);	1571	policy->cdev = of_cpufreq_cooling_register(policy);
1572		1572
1573	/* Let the per-policy boost flag mirror the cpufreq_driver boost during init */	1573	/* Let the per-policy boost flag mirror the cpufreq_driver boost during init */
1574	if (policy->boost_enabled != cpufreq_boost_enabled()) {	1574	if (cpufreq_driver->set_boost &&
		1575	policy->boost_enabled != cpufreq_boost_enabled()) {
1575	policy->boost_enabled = cpufreq_boost_enabled();	1576	policy->boost_enabled = cpufreq_boost_enabled();
1576	ret = cpufreq_driver->set_boost(policy, policy->boost_enabled);	1577	ret = cpufreq_driver->set_boost(policy, policy->boost_enabled);
1577	if (ret) {	1578	if (ret) {

drivers/crypto/ccp/sp-dev.c+14−0

 #include <linux/types.h>
 #include <linux/ccp.h>
+#include "sev-dev.h"
 #include "ccp-dev.h"
 #include "sp-dev.h"
 static int __init sp_mod_init(void)
 {
 #ifdef CONFIG_X86
+	static bool initialized;
 	int ret;
+	if (initialized)
+		return 0;
 	ret = sp_pci_init();
 	if (ret)
 		return ret;
 	psp_pci_init();
 #endif
+	initialized = true;
 	return 0;
 #endif
 	return -ENODEV;
 }
+#if IS_BUILTIN(CONFIG_KVM_AMD) && IS_ENABLED(CONFIG_KVM_AMD_SEV)
+int __init sev_module_init(void)
+{
+	return sp_mod_init();
+}
+#endif
 static void __exit sp_mod_exit(void)
 {
 #ifdef CONFIG_X86

drivers/dma/tegra210-adma.c+14−3

 	const struct tegra_adma_chip_data *cdata;
 	struct tegra_adma *tdma;
 	struct resource *res_page, *res_base;
-	int ret, i, page_no;
+	int ret, i;
 	cdata = of_device_get_match_data(&pdev->dev);
 	if (!cdata) {
 		res_base = platform_get_resource_byname(pdev, IORESOURCE_MEM, "global");
 		if (res_base) {
-			page_no = (res_page->start - res_base->start) / cdata->ch_base_offset;
+			resource_size_t page_offset, page_no;
-			if (page_no <= 0)
+			unsigned int ch_base_offset;
+			if (res_page->start < res_base->start)
+				return -EINVAL;
+			page_offset = res_page->start - res_base->start;
+			ch_base_offset = cdata->ch_base_offset;
+			if (!ch_base_offset)
 				return -EINVAL;
+			page_no = div_u64(page_offset, ch_base_offset);
+			if (!page_no || page_no > INT_MAX)
+				return -EINVAL;
 			tdma->ch_page_no = page_no - 1;
 			tdma->base_addr = devm_ioremap_resource(&pdev->dev, res_base);
 			if (IS_ERR(tdma->base_addr))

drivers/firmware/Kconfig+1−1

@@ -106,7 +106,7 @@ config ISCSI_IBFT · 105 unmodified lines
106	select ISCSI_BOOT_SYSFS	106	select ISCSI_BOOT_SYSFS
107	select ISCSI_IBFT_FIND if X86	107	select ISCSI_IBFT_FIND if X86
108	depends on ACPI && SCSI && SCSI_LOWLEVEL	108	depends on ACPI && SCSI && SCSI_LOWLEVEL
109	default n	109	default n
110	help	110	help
111	This option enables support for detection and exposing of iSCSI	111	This option enables support for detection and exposing of iSCSI
112	Boot Firmware Table (iBFT) via sysfs to userspace. If you wish to	112	Boot Firmware Table (iBFT) via sysfs to userspace. If you wish to

drivers/firmware/efi/efi.c+4−2

 		     EFI_MEMORY_WB | EFI_MEMORY_UCE | EFI_MEMORY_RO |
 		     EFI_MEMORY_WP | EFI_MEMORY_RP | EFI_MEMORY_XP |
 		     EFI_MEMORY_NV | EFI_MEMORY_SP | EFI_MEMORY_CPU_CRYPTO |
-		     EFI_MEMORY_RUNTIME | EFI_MEMORY_MORE_RELIABLE))
+		     EFI_MEMORY_MORE_RELIABLE | EFI_MEMORY_HOT_PLUGGABLE |
+		     EFI_MEMORY_RUNTIME))
 		snprintf(pos, size, "|attr=0x%016llx]",
 			 (unsigned long long)attr);
 	else
 		snprintf(pos, size,
-			 "|%3s|%2s|%2s|%2s|%2s|%2s|%2s|%2s|%2s|%3s|%2s|%2s|%2s|%2s]",
+			 "|%3s|%2s|%2s|%2s|%2s|%2s|%2s|%2s|%2s|%2s|%3s|%2s|%2s|%2s|%2s]",
 			 attr & EFI_MEMORY_RUNTIME		? "RUN" : "",
+			 attr & EFI_MEMORY_HOT_PLUGGABLE	? "HP"  : "",
 			 attr & EFI_MEMORY_MORE_RELIABLE	? "MR"  : "",
 			 attr & EFI_MEMORY_CPU_CRYPTO   	? "CC"  : "",
 			 attr & EFI_MEMORY_SP			? "SP"  : "",

drivers/firmware/efi/libstub/randomalloc.c+3−0

@@ -25,6 +25,9 @@ static unsigned long get_entry_num_slots(efi_memory_desc_t *md, · 24 unmodified lines
25	if (md->type != EFI_CONVENTIONAL_MEMORY)	25	if (md->type != EFI_CONVENTIONAL_MEMORY)
26	return 0;	26	return 0;
27		27
		28	if (md->attribute & EFI_MEMORY_HOT_PLUGGABLE)
		29	return 0;
		30
28	if (efi_soft_reserve_enabled() &&	31	if (efi_soft_reserve_enabled() &&
29	(md->attribute & EFI_MEMORY_SP))	32	(md->attribute & EFI_MEMORY_SP))
30	return 0;	33	return 0;

drivers/firmware/efi/libstub/relocate.c+3−0

@@ -53,6 +53,9 @@ efi_status_t efi_low_alloc_above(unsigned long size, unsigned long align, · 52 unmodified lines
53	if (desc->type != EFI_CONVENTIONAL_MEMORY)	53	if (desc->type != EFI_CONVENTIONAL_MEMORY)
54	continue;	54	continue;
55		55
		56	if (desc->attribute & EFI_MEMORY_HOT_PLUGGABLE)
		57	continue;
		58
56	if (efi_soft_reserve_enabled() &&	59	if (efi_soft_reserve_enabled() &&
57	(desc->attribute & EFI_MEMORY_SP))	60	(desc->attribute & EFI_MEMORY_SP))
58	continue;	61	continue;

drivers/firmware/iscsi_ibft.c+4−1

 		str += sprintf_ipaddr(str, nic->ip_addr);
 		break;
 	case ISCSI_BOOT_ETH_SUBNET_MASK:
-		val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1));
+		if (nic->subnet_mask_prefix > 32)
+			val = cpu_to_be32(~0);
+		else
+			val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1));
 		str += sprintf(str, "%pI4", &val);
 		break;
 	case ISCSI_BOOT_ETH_PREFIX_LEN:

drivers/gpio/Kconfig+1−0

@@ -338,6 +338,7 @@ config GPIO_GRANITERAPIDS · 337 unmodified lines
338		338
339	config GPIO_GRGPIO	339	config GPIO_GRGPIO
340	tristate "Aeroflex Gaisler GRGPIO support"	340	tristate "Aeroflex Gaisler GRGPIO support"
		341	depends on OF \|\| COMPILE_TEST
341	select GPIO_GENERIC	342	select GPIO_GENERIC
342	select IRQ_DOMAIN	343	select IRQ_DOMAIN
343	help	344	help

drivers/gpio/gpio-bcm-kona.c+58−13

 struct bcm_kona_gpio_bank {
 	int id;
 	int irq;
+	/*
+	 * Used to keep track of lock/unlock operations for each GPIO in the
+	 * bank.
+	 *
+	 * All GPIOs are locked by default (see bcm_kona_gpio_reset), and the
+	 * unlock count for all GPIOs is 0 by default. Each unlock increments
+	 * the counter, and each lock decrements the counter.
+	 *
+	 * The lock function only locks the GPIO once its unlock counter is
+	 * down to 0. This is necessary because the GPIO is unlocked in two
+	 * places in this driver: once for requested GPIOs, and once for
+	 * requested IRQs. Since it is possible for a GPIO to be requested
+	 * as both a GPIO and an IRQ, we need to ensure that we don't lock it
+	 * too early.
+	 */
+	u8 gpio_unlock_count[GPIO_PER_BANK];
 	/* Used in the interrupt handler */
 	struct bcm_kona_gpio *kona_gpio;
 };
 	u32 val;
 	unsigned long flags;
 	int bank_id = GPIO_BANK(gpio);
+	int bit = GPIO_BIT(gpio);
+	struct bcm_kona_gpio_bank *bank = &kona_gpio->banks[bank_id];
-	raw_spin_lock_irqsave(&kona_gpio->lock, flags);
+	if (bank->gpio_unlock_count[bit] == 0) {
+		dev_err(kona_gpio->gpio_chip.parent,
+			"Unbalanced locks for GPIO %u\n", gpio);
+		return;
+	}
-	val = readl(kona_gpio->reg_base + GPIO_PWD_STATUS(bank_id));
+	if (--bank->gpio_unlock_count[bit] == 0) {
-	val |= BIT(gpio);
+		raw_spin_lock_irqsave(&kona_gpio->lock, flags);
-	bcm_kona_gpio_write_lock_regs(kona_gpio->reg_base, bank_id, val);
-	raw_spin_unlock_irqrestore(&kona_gpio->lock, flags);
+		val = readl(kona_gpio->reg_base + GPIO_PWD_STATUS(bank_id));
+		val |= BIT(bit);
+		bcm_kona_gpio_write_lock_regs(kona_gpio->reg_base, bank_id, val);
+		raw_spin_unlock_irqrestore(&kona_gpio->lock, flags);
+	}
 }
 static void bcm_kona_gpio_unlock_gpio(struct bcm_kona_gpio *kona_gpio,
 	u32 val;
 	unsigned long flags;
 	int bank_id = GPIO_BANK(gpio);
+	int bit = GPIO_BIT(gpio);
+	struct bcm_kona_gpio_bank *bank = &kona_gpio->banks[bank_id];
-	raw_spin_lock_irqsave(&kona_gpio->lock, flags);
+	if (bank->gpio_unlock_count[bit] == 0) {
+		raw_spin_lock_irqsave(&kona_gpio->lock, flags);
-	val = readl(kona_gpio->reg_base + GPIO_PWD_STATUS(bank_id));
+		val = readl(kona_gpio->reg_base + GPIO_PWD_STATUS(bank_id));
-	val &= ~BIT(gpio);
+		val &= ~BIT(bit);
-	bcm_kona_gpio_write_lock_regs(kona_gpio->reg_base, bank_id, val);
+		bcm_kona_gpio_write_lock_regs(kona_gpio->reg_base, bank_id, val);
-	raw_spin_unlock_irqrestore(&kona_gpio->lock, flags);
+		raw_spin_unlock_irqrestore(&kona_gpio->lock, flags);
+	}
+	++bank->gpio_unlock_count[bit];
 }
 static int bcm_kona_gpio_get_dir(struct gpio_chip *chip, unsigned gpio)
 	kona_gpio = irq_data_get_irq_chip_data(d);
 	reg_base = kona_gpio->reg_base;
 	raw_spin_lock_irqsave(&kona_gpio->lock, flags);
 	val = readl(reg_base + GPIO_INT_MASK(bank_id));
 	kona_gpio = irq_data_get_irq_chip_data(d);
 	reg_base = kona_gpio->reg_base;
 	raw_spin_lock_irqsave(&kona_gpio->lock, flags);
 	val = readl(reg_base + GPIO_INT_MSKCLR(bank_id));
 static int bcm_kona_gpio_irq_reqres(struct irq_data *d)
 {
 	struct bcm_kona_gpio *kona_gpio = irq_data_get_irq_chip_data(d);
+	unsigned int gpio = d->hwirq;
-	return gpiochip_reqres_irq(&kona_gpio->gpio_chip, d->hwirq);
+	/*
+	 * We need to unlock the GPIO before any other operations are performed
+	 * on the relevant GPIO configuration registers
+	 */
+	bcm_kona_gpio_unlock_gpio(kona_gpio, gpio);
+	return gpiochip_reqres_irq(&kona_gpio->gpio_chip, gpio);
 }
 static void bcm_kona_gpio_irq_relres(struct irq_data *d)
 {
 	struct bcm_kona_gpio *kona_gpio = irq_data_get_irq_chip_data(d);
+	unsigned int gpio = d->hwirq;
+	/* Once we no longer use it, lock the GPIO again */
+	bcm_kona_gpio_lock_gpio(kona_gpio, gpio);
-	gpiochip_relres_irq(&kona_gpio->gpio_chip, d->hwirq);
+	gpiochip_relres_irq(&kona_gpio->gpio_chip, gpio);
 }
 static struct irq_chip bcm_gpio_irq_chip = {
 		bank->irq = platform_get_irq(pdev, i);
 		bank->kona_gpio = kona_gpio;
 		if (bank->irq < 0) {
-			dev_err(dev, "Couldn't get IRQ for bank %d", i);
+			dev_err(dev, "Couldn't get IRQ for bank %d\n", i);
 			ret = -ENOENT;
 			goto err_irq_domain;
 		}

drivers/gpio/gpio-pca953x.c+0−19

@@ -841,25 +841,6 @@ static bool pca953x_irq_pending(struct pca953x_chip chip, unsigned long pendin · 840 unmodified lines
841	DECLARE_BITMAP(trigger, MAX_LINE);	841	DECLARE_BITMAP(trigger, MAX_LINE);
842	int ret;	842	int ret;
843		843
844	if (chip->driver_data & PCA_PCAL) {
845	/* Read the current interrupt status from the device */
846	ret = pca953x_read_regs(chip, PCAL953X_INT_STAT, trigger);
847	if (ret)
848	return false;
849
850	/* Check latched inputs and clear interrupt status */
851	ret = pca953x_read_regs(chip, chip->regs->input, cur_stat);
852	if (ret)
853	return false;
854
855	/* Apply filter for rising/falling edge selection */
856	bitmap_replace(new_stat, chip->irq_trig_fall, chip->irq_trig_raise, cur_stat, gc->ngpio);
857
858	bitmap_and(pending, new_stat, trigger, gc->ngpio);
859
860	return !bitmap_empty(pending, gc->ngpio);
861	}
862
863	ret = pca953x_read_regs(chip, chip->regs->input, cur_stat);	844	ret = pca953x_read_regs(chip, chip->regs->input, cur_stat);
864	if (ret)	845	if (ret)
865	return false;	846	return false;

drivers/gpio/gpio-sim.c+8−5

 	struct configfs_subsystem *subsys = dev->group.cg_subsys;
 	struct gpio_sim_bank *bank;
 	struct gpio_sim_line *line;
+	struct config_item *item;
 	/*
-	 * The device only needs to depend on leaf line entries. This is
+	 * The device only needs to depend on leaf entries. This is
 	 * sufficient to lock up all the configfs entries that the
 	 * instantiated, alive device depends on.
 	 */
 	list_for_each_entry(bank, &dev->bank_list, siblings) {
 		list_for_each_entry(line, &bank->line_list, siblings) {
+			item = line->hog ? &line->hog->item
+					 : &line->group.cg_item;
 			if (lock)
-				WARN_ON(configfs_depend_item_unlocked(
+				WARN_ON(configfs_depend_item_unlocked(subsys,
-						subsys, &line->group.cg_item));
+								      item));
 			else
-				configfs_undepend_item_unlocked(
+				configfs_undepend_item_unlocked(item);
-						&line->group.cg_item);
 		}
 	}
 }

drivers/gpio/gpio-stmpe.c+12−3

 		[REG_IE][CSB] = STMPE_IDX_IEGPIOR_CSB,
 		[REG_IE][MSB] = STMPE_IDX_IEGPIOR_MSB,
 	};
-	int i, j;
+	int ret, i, j;
 	/*
 	 * STMPE1600: to be able to get IRQ from pins,
 	 * GPSR or GPCR registers
 	 */
 	if (stmpe->partnum == STMPE1600) {
-		stmpe_reg_read(stmpe, stmpe->regs[STMPE_IDX_GPMR_LSB]);
+		ret = stmpe_reg_read(stmpe, stmpe->regs[STMPE_IDX_GPMR_LSB]);
-		stmpe_reg_read(stmpe, stmpe->regs[STMPE_IDX_GPMR_CSB]);
+		if (ret < 0) {
+			dev_err(stmpe->dev, "Failed to read GPMR_LSB: %d\n", ret);
+			goto err;
+		}
+		ret = stmpe_reg_read(stmpe, stmpe->regs[STMPE_IDX_GPMR_CSB]);
+		if (ret < 0) {
+			dev_err(stmpe->dev, "Failed to read GPMR_CSB: %d\n", ret);
+			goto err;
+		}
 	}
 	for (i = 0; i < CACHE_NR_REGS; i++) {
 		}
 	}
+err:
 	mutex_unlock(&stmpe_gpio->irq_lock);
 }

drivers/gpio/gpiolib-acpi.c+14−0

@@ -1689,6 +1689,20 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] __initconst = { · 1688 unmodified lines
1689	.ignore_wake = "PNP0C50:00@8",	1689	.ignore_wake = "PNP0C50:00@8",
1690	},	1690	},
1691	},	1691	},
		1692	{
		1693	/*
		1694	* Spurious wakeups from GPIO 11
		1695	* Found in BIOS 1.04
		1696	* https://gitlab.freedesktop.org/drm/amd/-/issues/3954
		1697	*/
		1698	.matches = {
		1699	DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
		1700	DMI_MATCH(DMI_PRODUCT_FAMILY, "Acer Nitro V 14"),
		1701	},
		1702	.driver_data = &(struct acpi_gpiolib_dmi_quirk) {
		1703	.ignore_interrupt = "AMDI0030:00@11",
		1704	},
		1705	},
1692	{} /* Terminating entry */	1706	{} /* Terminating entry */
1693	};	1707	};
1694		1708

drivers/gpio/gpiolib.c+3−3

@@ -904,13 +904,13 @@ int gpiochip_get_ngpios(struct gpio_chip gc, struct device dev) · 903 unmodified lines
904	}	904	}
905		905
906	if (gc->ngpio == 0) {	906	if (gc->ngpio == 0) {
907	chip_err(gc, "tried to insert a GPIO chip with zero lines\n");	907	dev_err(dev, "tried to insert a GPIO chip with zero lines\n");
908	return -EINVAL;	908	return -EINVAL;
909	}	909	}
910		910
911	if (gc->ngpio > FASTPATH_NGPIO)	911	if (gc->ngpio > FASTPATH_NGPIO)
912	chip_warn(gc, "line cnt %u is greater than fast path cnt %u\n",	912	dev_warn(dev, "line cnt %u is greater than fast path cnt %u\n",
913	gc->ngpio, FASTPATH_NGPIO);	913	gc->ngpio, FASTPATH_NGPIO);
914		914
915	return 0;	915	return 0;
916	}	916	}

drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c+3−1

  * - 3.57.0 - Compute tunneling on GFX10+
  * - 3.58.0 - Add GFX12 DCC support
  * - 3.59.0 - Cleared VRAM
+ * - 3.60.0 - Add AMDGPU_TILING_GFX12_DCC_WRITE_COMPRESS_DISABLE (Vulkan requirement)
+ * - 3.61.0 - Contains fix for RV/PCO compute queues
  */
 #define KMS_DRIVER_MAJOR	3
-#define KMS_DRIVER_MINOR	59
+#define KMS_DRIVER_MINOR	61
 #define KMS_DRIVER_PATCHLEVEL	0
 /*

drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c+3−2

 		if (err == -ENODEV) {
 			dev_warn(adev->dev, "cap microcode does not exist, skip\n");
 			err = 0;
-			goto out;
+		} else {
+			dev_err(adev->dev, "fail to initialize cap microcode\n");
 		}
-		dev_err(adev->dev, "fail to initialize cap microcode\n");
+		goto out;
 	}
 	info = &adev->firmware.ucode[AMDGPU_UCODE_ID_CAP];

drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c+6−2

 	mutex_lock(&adev->mman.gtt_window_lock);
 	while (src_mm.remaining) {
 		uint64_t from, to, cur_size, tiling_flags;
-		uint32_t num_type, data_format, max_com;
+		uint32_t num_type, data_format, max_com, write_compress_disable;
 		struct dma_fence *next;
 		/* Never copy more than 256MiB at once to avoid a timeout */
 			max_com = AMDGPU_TILING_GET(tiling_flags, GFX12_DCC_MAX_COMPRESSED_BLOCK);
 			num_type = AMDGPU_TILING_GET(tiling_flags, GFX12_DCC_NUMBER_TYPE);
 			data_format = AMDGPU_TILING_GET(tiling_flags, GFX12_DCC_DATA_FORMAT);
+			write_compress_disable =
+				AMDGPU_TILING_GET(tiling_flags, GFX12_DCC_WRITE_COMPRESS_DISABLE);
 			copy_flags |= (AMDGPU_COPY_FLAGS_SET(MAX_COMPRESSED, max_com) |
 				       AMDGPU_COPY_FLAGS_SET(NUMBER_TYPE, num_type) |
-				       AMDGPU_COPY_FLAGS_SET(DATA_FORMAT, data_format));
+				       AMDGPU_COPY_FLAGS_SET(DATA_FORMAT, data_format) |
+				       AMDGPU_COPY_FLAGS_SET(WRITE_COMPRESS_DISABLE,
+							     write_compress_disable));
 		}
 		r = amdgpu_copy_buffer(ring, from, to, cur_size, resv,

drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h+2−0

@@ -119,6 +119,8 @@ struct amdgpu_copy_mem { · 118 unmodified lines
119	#define AMDGPU_COPY_FLAGS_NUMBER_TYPE_MASK 0x07	119	#define AMDGPU_COPY_FLAGS_NUMBER_TYPE_MASK 0x07
120	#define AMDGPU_COPY_FLAGS_DATA_FORMAT_SHIFT 8	120	#define AMDGPU_COPY_FLAGS_DATA_FORMAT_SHIFT 8
121	#define AMDGPU_COPY_FLAGS_DATA_FORMAT_MASK 0x3f	121	#define AMDGPU_COPY_FLAGS_DATA_FORMAT_MASK 0x3f
		122	#define AMDGPU_COPY_FLAGS_WRITE_COMPRESS_DISABLE_SHIFT 14
		123	#define AMDGPU_COPY_FLAGS_WRITE_COMPRESS_DISABLE_MASK 0x1
122		124
123	#define AMDGPU_COPY_FLAGS_SET(field, value) \	125	#define AMDGPU_COPY_FLAGS_SET(field, value) \
124	(((__u32)(value) & AMDGPU_COPY_FLAGS_##field##_MASK) << AMDGPU_COPY_FLAGS_##field##_SHIFT)	126	(((__u32)(value) & AMDGPU_COPY_FLAGS_##field##_MASK) << AMDGPU_COPY_FLAGS_##field##_SHIFT)

drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c+34−2

@@ -7437,6 +7437,38 @@ static void gfx_v9_0_ring_emit_cleaner_shader(struct amdgpu_ring *ring) · 7436 unmodified lines
7437	amdgpu_ring_write(ring, 0); /* RESERVED field, programmed to zero */	7437	amdgpu_ring_write(ring, 0); /* RESERVED field, programmed to zero */
7438	}	7438	}
7439		7439
		7440	static void gfx_v9_0_ring_begin_use_compute(struct amdgpu_ring *ring)
		7441	{
		7442	struct amdgpu_device *adev = ring->adev;
		7443	struct amdgpu_ip_block *gfx_block =
		7444	amdgpu_device_ip_get_ip_block(adev, AMD_IP_BLOCK_TYPE_GFX);
		7445
		7446	amdgpu_gfx_enforce_isolation_ring_begin_use(ring);
		7447
		7448	/* Raven and PCO APUs seem to have stability issues
		7449	* with compute and gfxoff and gfx pg. Disable gfx pg during
		7450	* submission and allow again afterwards.
		7451	*/
		7452	if (gfx_block && amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(9, 1, 0))
		7453	gfx_v9_0_set_powergating_state(gfx_block, AMD_PG_STATE_UNGATE);
		7454	}
		7455
		7456	static void gfx_v9_0_ring_end_use_compute(struct amdgpu_ring *ring)
		7457	{
		7458	struct amdgpu_device *adev = ring->adev;
		7459	struct amdgpu_ip_block *gfx_block =
		7460	amdgpu_device_ip_get_ip_block(adev, AMD_IP_BLOCK_TYPE_GFX);
		7461
		7462	/* Raven and PCO APUs seem to have stability issues
		7463	* with compute and gfxoff and gfx pg. Disable gfx pg during
		7464	* submission and allow again afterwards.
		7465	*/
		7466	if (gfx_block && amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(9, 1, 0))
		7467	gfx_v9_0_set_powergating_state(gfx_block, AMD_PG_STATE_GATE);
		7468
		7469	amdgpu_gfx_enforce_isolation_ring_end_use(ring);
		7470	}
		7471
7440	static const struct amd_ip_funcs gfx_v9_0_ip_funcs = {	7472	static const struct amd_ip_funcs gfx_v9_0_ip_funcs = {
7441	.name = "gfx_v9_0",	7473	.name = "gfx_v9_0",
7442	.early_init = gfx_v9_0_early_init,	7474	.early_init = gfx_v9_0_early_init,
@@ -7613,8 +7645,8 @@ static const struct amdgpu_ring_funcs gfx_v9_0_ring_funcs_compute = { · 170 unmodified lines
7613	.emit_wave_limit = gfx_v9_0_emit_wave_limit,	7645	.emit_wave_limit = gfx_v9_0_emit_wave_limit,
7614	.reset = gfx_v9_0_reset_kcq,	7646	.reset = gfx_v9_0_reset_kcq,
7615	.emit_cleaner_shader = gfx_v9_0_ring_emit_cleaner_shader,	7647	.emit_cleaner_shader = gfx_v9_0_ring_emit_cleaner_shader,
7616	.begin_use = amdgpu_gfx_enforce_isolation_ring_begin_use,	7648	.begin_use = gfx_v9_0_ring_begin_use_compute,
7617	.end_use = amdgpu_gfx_enforce_isolation_ring_end_use,	7649	.end_use = gfx_v9_0_ring_end_use_compute,
7618	};	7650	};
7619		7651
7620	static const struct amdgpu_ring_funcs gfx_v9_0_ring_funcs_kiq = {	7652	static const struct amdgpu_ring_funcs gfx_v9_0_ring_funcs_kiq = {

drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c+3−2

 				       uint32_t byte_count,
 				       uint32_t copy_flags)
 {
-	uint32_t num_type, data_format, max_com;
+	uint32_t num_type, data_format, max_com, write_cm;
 	max_com = AMDGPU_COPY_FLAGS_GET(copy_flags, MAX_COMPRESSED);
 	data_format = AMDGPU_COPY_FLAGS_GET(copy_flags, DATA_FORMAT);
 	num_type = AMDGPU_COPY_FLAGS_GET(copy_flags, NUMBER_TYPE);
+	write_cm = AMDGPU_COPY_FLAGS_GET(copy_flags, WRITE_COMPRESS_DISABLE) ? 2 : 1;
 	ib->ptr[ib->length_dw++] = SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_COPY) |
 		SDMA_PKT_COPY_LINEAR_HEADER_SUB_OP(SDMA_SUBOP_COPY_LINEAR) |
 	if ((copy_flags & (AMDGPU_COPY_FLAGS_READ_DECOMPRESSED | AMDGPU_COPY_FLAGS_WRITE_COMPRESSED)))
 		ib->ptr[ib->length_dw++] = SDMA_DCC_DATA_FORMAT(data_format) | SDMA_DCC_NUM_TYPE(num_type) |
 			((copy_flags & AMDGPU_COPY_FLAGS_READ_DECOMPRESSED) ? SDMA_DCC_READ_CM(2) : 0) |
-			((copy_flags & AMDGPU_COPY_FLAGS_WRITE_COMPRESSED) ? SDMA_DCC_WRITE_CM(1) : 0) |
+			((copy_flags & AMDGPU_COPY_FLAGS_WRITE_COMPRESSED) ? SDMA_DCC_WRITE_CM(write_cm) : 0) |
 			SDMA_DCC_MAX_COM(max_com) | SDMA_DCC_MAX_UCOM(1);
 	else
 		ib->ptr[ib->length_dw++] = 0;

drivers/gpu/drm/amd/amdkfd/cwsr_trap_handler.h+2−1

 	0x0000ffff, 0x8bfe7e7e,
 	0x8bea6a6a, 0xb97af804,
 	0xbe804ec2, 0xbf94fffe,
-	0xbe804a6c, 0xbfb10000,
+	0xbe804a6c, 0xbe804ec2,
+	0xbf94fffe, 0xbfb10000,
 	0xbf9f0000, 0xbf9f0000,
 	0xbf9f0000, 0xbf9f0000,
 	0xbf9f0000, 0x00000000,

drivers/gpu/drm/amd/amdkfd/cwsr_trap_handler_gfx12.asm+4−0

 	s_rfe_b64	s_restore_pc_lo						//Return to the main shader program and resume execution
 L_END_PGM:
+	// Make sure that no wave of the workgroup can exit the trap handler
+	// before the workgroup barrier state is saved.
+	s_barrier_signal	-2
+	s_barrier_wait	-2
 	s_endpgm_saved
 end

drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c+1−1

@@ -300,7 +300,7 @@ static int init_user_queue(struct process_queue_manager *pqm, · 299 unmodified lines
300	return 0;	300	return 0;
301		301
302	free_gang_ctx_bo:	302	free_gang_ctx_bo:
303	amdgpu_amdkfd_free_gtt_mem(dev->adev, (*q)->gang_ctx_bo);	303	amdgpu_amdkfd_free_gtt_mem(dev->adev, &(*q)->gang_ctx_bo);
304	cleanup:	304	cleanup:
305	uninit_queue(*q);	305	uninit_queue(*q);
306	*q = NULL;	306	*q = NULL;

drivers/gpu/drm/amd/display/dc/core/dc.c+1−1

@@ -2133,7 +2133,7 @@ static enum dc_status dc_commit_state_no_check(struct dc dc, struct dc_state c · 2132 unmodified lines
2133		2133
2134	dc_enable_stereo(dc, context, dc_streams, context->stream_count);	2134	dc_enable_stereo(dc, context, dc_streams, context->stream_count);
2135		2135
2136	if (context->stream_count > get_seamless_boot_stream_count(context) \|\|	2136	if (get_seamless_boot_stream_count(context) == 0 \|\|
2137	context->stream_count == 0) {	2137	context->stream_count == 0) {
2138	/* Must wait for no flips to be pending before doing optimize bw */	2138	/* Must wait for no flips to be pending before doing optimize bw */
2139	hwss_wait_for_no_pipes_pending(dc, context);	2139	hwss_wait_for_no_pipes_pending(dc, context);

drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c+1−2

@@ -63,8 +63,7 @@ void dmub_hw_lock_mgr_inbox0_cmd(struct dc_dmub_srv *dmub_srv, · 62 unmodified lines
63		63
64	bool should_use_dmub_lock(struct dc_link *link)	64	bool should_use_dmub_lock(struct dc_link *link)
65	{	65	{
66	if (link->psr_settings.psr_version == DC_PSR_VERSION_SU_1 \|\|	66	if (link->psr_settings.psr_version == DC_PSR_VERSION_SU_1)
67	link->psr_settings.psr_version == DC_PSR_VERSION_1)
68	return true;	67	return true;
69		68
70	if (link->replay_settings.replay_feature_enabled)	69	if (link->replay_settings.replay_feature_enabled)

drivers/gpu/drm/amd/display/dc/dml/Makefile+9−5

@@ -29,11 +29,15 @@ dml_ccflags := $(CC_FLAGS_FPU) · 28 unmodified lines
29	dml_rcflags := $(CC_FLAGS_NO_FPU)	29	dml_rcflags := $(CC_FLAGS_NO_FPU)
30		30
31	ifneq ($(CONFIG_FRAME_WARN),0)	31	ifneq ($(CONFIG_FRAME_WARN),0)
32	ifeq ($(filter y,$(CONFIG_KASAN)$(CONFIG_KCSAN)),y)	32	ifeq ($(filter y,$(CONFIG_KASAN)$(CONFIG_KCSAN)),y)
33	frame_warn_flag := -Wframe-larger-than=3072	33	frame_warn_limit := 3072
34	else	34	else
35	frame_warn_flag := -Wframe-larger-than=2048	35	frame_warn_limit := 2048
36	endif	36	endif
		37
		38	ifeq ($(call test-lt, $(CONFIG_FRAME_WARN), $(frame_warn_limit)),y)
		39	frame_warn_flag := -Wframe-larger-than=$(frame_warn_limit)
		40	endif
37	endif	41	endif
38		42
39	CFLAGS_$(AMDDALPATH)/dc/dml/display_mode_lib.o := $(dml_ccflags)	43	CFLAGS_$(AMDDALPATH)/dc/dml/display_mode_lib.o := $(dml_ccflags)

drivers/gpu/drm/amd/display/dc/dml2/Makefile+13−9

@@ -28,15 +28,19 @@ dml2_ccflags := $(CC_FLAGS_FPU) · 27 unmodified lines
28	dml2_rcflags := $(CC_FLAGS_NO_FPU)	28	dml2_rcflags := $(CC_FLAGS_NO_FPU)
29		29
30	ifneq ($(CONFIG_FRAME_WARN),0)	30	ifneq ($(CONFIG_FRAME_WARN),0)
31	ifeq ($(filter y,$(CONFIG_KASAN)$(CONFIG_KCSAN)),y)	31	ifeq ($(filter y,$(CONFIG_KASAN)$(CONFIG_KCSAN)),y)
32	ifeq ($(CONFIG_CC_IS_CLANG)$(CONFIG_COMPILE_TEST),yy)	32	ifeq ($(CONFIG_CC_IS_CLANG)$(CONFIG_COMPILE_TEST),yy)
33	frame_warn_flag := -Wframe-larger-than=4096	33	frame_warn_limit := 4096
34	else	34	else
35	frame_warn_flag := -Wframe-larger-than=3072	35	frame_warn_limit := 3072
36	endif	36	endif
37	else	37	else
38	frame_warn_flag := -Wframe-larger-than=2048	38	frame_warn_limit := 2048
39	endif	39	endif
		40
		41	ifeq ($(call test-lt, $(CONFIG_FRAME_WARN), $(frame_warn_limit)),y)
		42	frame_warn_flag := -Wframe-larger-than=$(frame_warn_limit)
		43	endif
40	endif	44	endif
41		45
42	subdir-ccflags-y += -I$(FULL_AMD_DISPLAY_PATH)/dc/dml2	46	subdir-ccflags-y += -I$(FULL_AMD_DISPLAY_PATH)/dc/dml2

drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_translation_helper.c+2−2

@@ -1017,7 +1017,7 @@ bool dml21_map_dc_state_into_dml_display_cfg(const struct dc *in_dc, struct dc_s · 1016 unmodified lines
1017	if (disp_cfg_stream_location < 0)	1017	if (disp_cfg_stream_location < 0)
1018	disp_cfg_stream_location = dml_dispcfg->num_streams++;	1018	disp_cfg_stream_location = dml_dispcfg->num_streams++;
1019		1019
1020	ASSERT(disp_cfg_stream_location >= 0 && disp_cfg_stream_location <= __DML2_WRAPPER_MAX_STREAMS_PLANES__);	1020	ASSERT(disp_cfg_stream_location >= 0 && disp_cfg_stream_location < __DML2_WRAPPER_MAX_STREAMS_PLANES__);
1021	populate_dml21_timing_config_from_stream_state(&dml_dispcfg->stream_descriptors[disp_cfg_stream_location].timing, context->streams[stream_index], dml_ctx);	1021	populate_dml21_timing_config_from_stream_state(&dml_dispcfg->stream_descriptors[disp_cfg_stream_location].timing, context->streams[stream_index], dml_ctx);
1022	adjust_dml21_hblank_timing_config_from_pipe_ctx(&dml_dispcfg->stream_descriptors[disp_cfg_stream_location].timing, &context->res_ctx.pipe_ctx[stream_index]);	1022	adjust_dml21_hblank_timing_config_from_pipe_ctx(&dml_dispcfg->stream_descriptors[disp_cfg_stream_location].timing, &context->res_ctx.pipe_ctx[stream_index]);
1023	populate_dml21_output_config_from_stream_state(&dml_dispcfg->stream_descriptors[disp_cfg_stream_location].output, context->streams[stream_index], &context->res_ctx.pipe_ctx[stream_index]);	1023	populate_dml21_output_config_from_stream_state(&dml_dispcfg->stream_descriptors[disp_cfg_stream_location].output, context->streams[stream_index], &context->res_ctx.pipe_ctx[stream_index]);
@@ -1042,7 +1042,7 @@ bool dml21_map_dc_state_into_dml_display_cfg(const struct dc *in_dc, struct dc_s · 18 unmodified lines
1042	if (disp_cfg_plane_location < 0)	1042	if (disp_cfg_plane_location < 0)
1043	disp_cfg_plane_location = dml_dispcfg->num_planes++;	1043	disp_cfg_plane_location = dml_dispcfg->num_planes++;
1044		1044
1045	ASSERT(disp_cfg_plane_location >= 0 && disp_cfg_plane_location <= __DML2_WRAPPER_MAX_STREAMS_PLANES__);	1045	ASSERT(disp_cfg_plane_location >= 0 && disp_cfg_plane_location < __DML2_WRAPPER_MAX_STREAMS_PLANES__);
1046		1046
1047	populate_dml21_surface_config_from_plane_state(in_dc, &dml_dispcfg->plane_descriptors[disp_cfg_plane_location].surface, context->stream_status[stream_index].plane_states[plane_index]);	1047	populate_dml21_surface_config_from_plane_state(in_dc, &dml_dispcfg->plane_descriptors[disp_cfg_plane_location].surface, context->stream_status[stream_index].plane_states[plane_index]);
1048	populate_dml21_plane_config_from_plane_state(dml_ctx, &dml_dispcfg->plane_descriptors[disp_cfg_plane_location], context->stream_status[stream_index].plane_states[plane_index], context, stream_index);	1048	populate_dml21_plane_config_from_plane_state(dml_ctx, &dml_dispcfg->plane_descriptors[disp_cfg_plane_location], context->stream_status[stream_index].plane_states[plane_index], context, stream_index);

drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c+3−3

drivers/gpu/drm/amd/display/dc/hubbub/dcn30/dcn30_hubbub.c+2−1

@@ -129,7 +129,8 @@ bool hubbub3_program_watermarks( · 128 unmodified lines
129	REG_UPDATE(DCHUBBUB_ARB_DF_REQ_OUTSTAND,	129	REG_UPDATE(DCHUBBUB_ARB_DF_REQ_OUTSTAND,
130	DCHUBBUB_ARB_MIN_REQ_OUTSTAND, 0x1FF);	130	DCHUBBUB_ARB_MIN_REQ_OUTSTAND, 0x1FF);
131		131
132	hubbub1_allow_self_refresh_control(hubbub, !hubbub->ctx->dc->debug.disable_stutter);	132	if (safe_to_lower \|\| hubbub->ctx->dc->debug.disable_stutter)
		133	hubbub1_allow_self_refresh_control(hubbub, !hubbub->ctx->dc->debug.disable_stutter);
133		134
134	return wm_pending;	135	return wm_pending;
135	}	136	}

drivers/gpu/drm/amd/display/dc/hubbub/dcn31/dcn31_hubbub.c+2−1

@@ -750,7 +750,8 @@ static bool hubbub31_program_watermarks( · 749 unmodified lines
750	REG_UPDATE(DCHUBBUB_ARB_DF_REQ_OUTSTAND,	750	REG_UPDATE(DCHUBBUB_ARB_DF_REQ_OUTSTAND,
751	DCHUBBUB_ARB_MIN_REQ_OUTSTAND, 0x1FF);*/	751	DCHUBBUB_ARB_MIN_REQ_OUTSTAND, 0x1FF);*/
752		752
753	hubbub1_allow_self_refresh_control(hubbub, !hubbub->ctx->dc->debug.disable_stutter);	753	if (safe_to_lower \|\| hubbub->ctx->dc->debug.disable_stutter)
		754	hubbub1_allow_self_refresh_control(hubbub, !hubbub->ctx->dc->debug.disable_stutter);
754	return wm_pending;	755	return wm_pending;
755	}	756	}
756		757

drivers/gpu/drm/amd/display/dc/hubbub/dcn32/dcn32_hubbub.c+2−1

@@ -786,7 +786,8 @@ static bool hubbub32_program_watermarks( · 785 unmodified lines
786	REG_UPDATE(DCHUBBUB_ARB_DF_REQ_OUTSTAND,	786	REG_UPDATE(DCHUBBUB_ARB_DF_REQ_OUTSTAND,
787	DCHUBBUB_ARB_MIN_REQ_OUTSTAND, 0x1FF);*/	787	DCHUBBUB_ARB_MIN_REQ_OUTSTAND, 0x1FF);*/
788		788
789	hubbub1_allow_self_refresh_control(hubbub, !hubbub->ctx->dc->debug.disable_stutter);	789	if (safe_to_lower \|\| hubbub->ctx->dc->debug.disable_stutter)
		790	hubbub1_allow_self_refresh_control(hubbub, !hubbub->ctx->dc->debug.disable_stutter);
790		791
791	hubbub32_force_usr_retraining_allow(hubbub, hubbub->ctx->dc->debug.force_usr_allow);	792	hubbub32_force_usr_retraining_allow(hubbub, hubbub->ctx->dc->debug.force_usr_allow);
792		793

drivers/gpu/drm/amd/display/dc/hubbub/dcn35/dcn35_hubbub.c+2−1

@@ -326,7 +326,8 @@ static bool hubbub35_program_watermarks( · 325 unmodified lines
326	DCHUBBUB_ARB_MIN_REQ_OUTSTAND_COMMIT_THRESHOLD, 0xA);/hw delta/	326	DCHUBBUB_ARB_MIN_REQ_OUTSTAND_COMMIT_THRESHOLD, 0xA);/hw delta/
327	REG_UPDATE(DCHUBBUB_ARB_HOSTVM_CNTL, DCHUBBUB_ARB_MAX_QOS_COMMIT_THRESHOLD, 0xF);	327	REG_UPDATE(DCHUBBUB_ARB_HOSTVM_CNTL, DCHUBBUB_ARB_MAX_QOS_COMMIT_THRESHOLD, 0xF);
328		328
329	hubbub1_allow_self_refresh_control(hubbub, !hubbub->ctx->dc->debug.disable_stutter);	329	if (safe_to_lower \|\| hubbub->ctx->dc->debug.disable_stutter)
		330	hubbub1_allow_self_refresh_control(hubbub, !hubbub->ctx->dc->debug.disable_stutter);
330		331
331	hubbub32_force_usr_retraining_allow(hubbub, hubbub->ctx->dc->debug.force_usr_allow);	332	hubbub32_force_usr_retraining_allow(hubbub, hubbub->ctx->dc->debug.force_usr_allow);
332		333

drivers/gpu/drm/amd/display/dc/hubp/dcn30/dcn30_hubp.c+2−0

@@ -500,6 +500,8 @@ void hubp3_init(struct hubp *hubp) · 499 unmodified lines
500	//hubp[i].HUBPREQ_DEBUG.HUBPREQ_DEBUG[26] = 1;	500	//hubp[i].HUBPREQ_DEBUG.HUBPREQ_DEBUG[26] = 1;
501	REG_WRITE(HUBPREQ_DEBUG, 1 << 26);	501	REG_WRITE(HUBPREQ_DEBUG, 1 << 26);
502		502
		503	REG_UPDATE(DCHUBP_CNTL, HUBP_TTU_DISABLE, 0);
		504
503	hubp_reset(hubp);	505	hubp_reset(hubp);
504	}	506	}
505		507

drivers/gpu/drm/amd/display/dc/hubp/dcn32/dcn32_hubp.c+2−0

@@ -168,6 +168,8 @@ void hubp32_init(struct hubp *hubp) · 167 unmodified lines
168	{	168	{
169	struct dcn20_hubp *hubp2 = TO_DCN20_HUBP(hubp);	169	struct dcn20_hubp *hubp2 = TO_DCN20_HUBP(hubp);
170	REG_WRITE(HUBPREQ_DEBUG_DB, 1 << 8);	170	REG_WRITE(HUBPREQ_DEBUG_DB, 1 << 8);
		171
		172	REG_UPDATE(DCHUBP_CNTL, HUBP_TTU_DISABLE, 0);
171	}	173	}
172	static struct hubp_funcs dcn32_hubp_funcs = {	174	static struct hubp_funcs dcn32_hubp_funcs = {
173	.hubp_enable_tripleBuffer = hubp2_enable_triplebuffer,	175	.hubp_enable_tripleBuffer = hubp2_enable_triplebuffer,

drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c+2−1

@@ -236,7 +236,8 @@ void dcn35_init_hw(struct dc *dc) · 235 unmodified lines
236	}	236	}
237		237
238	hws->funcs.init_pipes(dc, dc->current_state);	238	hws->funcs.init_pipes(dc, dc->current_state);
239	if (dc->res_pool->hubbub->funcs->allow_self_refresh_control)	239	if (dc->res_pool->hubbub->funcs->allow_self_refresh_control &&
		240	!dc->res_pool->hubbub->ctx->dc->debug.disable_stutter)
240	dc->res_pool->hubbub->funcs->allow_self_refresh_control(dc->res_pool->hubbub,	241	dc->res_pool->hubbub->funcs->allow_self_refresh_control(dc->res_pool->hubbub,
241	!dc->res_pool->hubbub->ctx->dc->debug.disable_stutter);	242	!dc->res_pool->hubbub->ctx->dc->debug.disable_stutter);
242	}	243	}

drivers/gpu/drm/amd/pm/amdgpu_dpm.c+1−1

@@ -78,7 +78,7 @@ int amdgpu_dpm_set_powergating_by_smu(struct amdgpu_device *adev, · 77 unmodified lines
78	int ret = 0;	78	int ret = 0;
79	const struct amd_pm_funcs *pp_funcs = adev->powerplay.pp_funcs;	79	const struct amd_pm_funcs *pp_funcs = adev->powerplay.pp_funcs;
80	enum ip_power_state pwr_state = gate ? POWER_STATE_OFF : POWER_STATE_ON;	80	enum ip_power_state pwr_state = gate ? POWER_STATE_OFF : POWER_STATE_ON;
81	bool is_vcn = (block_type == AMD_IP_BLOCK_TYPE_UVD \|\| block_type == AMD_IP_BLOCK_TYPE_VCN);	81	bool is_vcn = block_type == AMD_IP_BLOCK_TYPE_VCN;
82		82
83	if (atomic_read(&adev->pm.pwr_state[block_type]) == pwr_state &&	83	if (atomic_read(&adev->pm.pwr_state[block_type]) == pwr_state &&
84	(!is_vcn \|\| adev->vcn.num_vcn_inst == 1)) {	84	(!is_vcn \|\| adev->vcn.num_vcn_inst == 1)) {

drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c+2−1

@@ -612,7 +612,8 @@ static int smu_sys_set_pp_table(void *handle, · 611 unmodified lines
612	return -EIO;	612	return -EIO;
613	}	613	}
614		614
615	if (!smu_table->hardcode_pptable) {	615	if (!smu_table->hardcode_pptable \|\| smu_table->power_play_table_size < size) {
		616	kfree(smu_table->hardcode_pptable);
616	smu_table->hardcode_pptable = kzalloc(size, GFP_KERNEL);	617	smu_table->hardcode_pptable = kzalloc(size, GFP_KERNEL);
617	if (!smu_table->hardcode_pptable)	618	if (!smu_table->hardcode_pptable)
618	return -ENOMEM;	619	return -ENOMEM;

drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c+4−0

 	formats = komeda_get_layer_fourcc_list(&mdev->fmt_tbl,
 					       kwb_conn->wb_layer->layer_type,
 					       &n_formats);
+	if (!formats) {
+		kfree(kwb_conn);
+		return -ENOMEM;
+	}
 	err = drm_writeback_connector_init(&kms->base, wb_conn,
 					   &komeda_wb_connector_funcs,

drivers/gpu/drm/ast/ast_dp.c+1−1

@@ -195,7 +195,7 @@ static bool __ast_dp_wait_enable(struct ast_device *ast, bool enabled) · 194 unmodified lines
195	if (enabled)	195	if (enabled)
196	vgacrdf_test \|= AST_IO_VGACRDF_DP_VIDEO_ENABLE;	196	vgacrdf_test \|= AST_IO_VGACRDF_DP_VIDEO_ENABLE;
197		197
198	for (i = 0; i < 200; ++i) {	198	for (i = 0; i < 1000; ++i) {
199	if (i)	199	if (i)
200	mdelay(1);	200	mdelay(1);
201	vgacrdf = ast_get_index_reg_mask(ast, AST_IO_VGACRI, 0xdf,	201	vgacrdf = ast_get_index_reg_mask(ast, AST_IO_VGACRI, 0xdf,

drivers/gpu/drm/display/drm_dp_cec.c+3−11

 	if (!aux->transfer)
 		return;
-#ifndef CONFIG_MEDIA_CEC_RC
-	/*
-	 * CEC_CAP_RC is part of CEC_CAP_DEFAULTS, but it is stripped by
-	 * cec_allocate_adapter() if CONFIG_MEDIA_CEC_RC is undefined.
-	 *
-	 * Do this here as well to ensure the tests against cec_caps are
-	 * correct.
-	 */
-	cec_caps &= ~CEC_CAP_RC;
-#endif
 	cancel_delayed_work_sync(&aux->cec.unregister_work);
 	mutex_lock(&aux->cec.lock);
 		num_las = CEC_MAX_LOG_ADDRS;
 	if (aux->cec.adap) {
-		if (aux->cec.adap->capabilities == cec_caps &&
+		/* Check if the adapter properties have changed */
+		if ((aux->cec.adap->capabilities & CEC_CAP_MONITOR_ALL) ==
+		    (cec_caps & CEC_CAP_MONITOR_ALL) &&
 		    aux->cec.adap->available_log_addrs == num_las) {
 			/* Unchanged, so just set the phys addr */
 			cec_s_phys_addr(aux->cec.adap, source_physical_address, false);

drivers/gpu/drm/display/drm_dp_helper.c+1−1

@@ -2544,7 +2544,7 @@ u8 drm_dp_dsc_sink_bpp_incr(const u8 dsc_dpcd[DP_DSC_RECEIVER_CAP_SIZE]) · 2543 unmodified lines
2544	{	2544	{
2545	u8 bpp_increment_dpcd = dsc_dpcd[DP_DSC_BITS_PER_PIXEL_INC - DP_DSC_SUPPORT];	2545	u8 bpp_increment_dpcd = dsc_dpcd[DP_DSC_BITS_PER_PIXEL_INC - DP_DSC_SUPPORT];
2546		2546
2547	switch (bpp_increment_dpcd) {	2547	switch (bpp_increment_dpcd & DP_DSC_BITS_PER_PIXEL_MASK) {
2548	case DP_DSC_BITS_PER_PIXEL_1_16:	2548	case DP_DSC_BITS_PER_PIXEL_1_16:
2549	return 16;	2549	return 16;
2550	case DP_DSC_BITS_PER_PIXEL_1_8:	2550	case DP_DSC_BITS_PER_PIXEL_1_8:

drivers/gpu/drm/hisilicon/hibmc/Kconfig+2−0

 	depends on DRM && PCI
 	depends on MMU
 	select DRM_CLIENT_SELECTION
+	select DRM_DISPLAY_HELPER
+	select DRM_DISPLAY_DP_HELPER
 	select DRM_KMS_HELPER
 	select DRM_VRAM_HELPER
 	select DRM_TTM

drivers/gpu/drm/i915/display/intel_backlight.c+3−2

@@ -41,8 +41,9 @@ static u32 scale(u32 source_val, · 40 unmodified lines
41	{	41	{
42	u64 target_val;	42	u64 target_val;
43		43
44	WARN_ON(source_min > source_max);	44	if (WARN_ON(source_min >= source_max) \|\|
45	WARN_ON(target_min > target_max);	45	WARN_ON(target_min > target_max))
		46	return target_min;
46		47
47	/* defensive */	48	/* defensive */
48	source_val = clamp(source_val, source_min, source_max);	49	source_val = clamp(source_val, source_min, source_max);

drivers/gpu/drm/i915/display/intel_dp.c+5−7

 	if (DISPLAY_VER(display) == 11)
 		return 10;
-	return 0;
+	return intel_dp_dsc_min_src_input_bpc();
 }
 int intel_dp_dsc_compute_max_bpp(const struct intel_connector *connector,
 	/* Compressed BPP should be less than the Input DSC bpp */
 	dsc_max_bpp = min(dsc_max_bpp, pipe_bpp - 1);
-	for (i = 0; i < ARRAY_SIZE(valid_dsc_bpp); i++) {
+	for (i = ARRAY_SIZE(valid_dsc_bpp) - 1; i >= 0; i--) {
-		if (valid_dsc_bpp[i] < dsc_min_bpp)
+		if (valid_dsc_bpp[i] < dsc_min_bpp ||
+		    valid_dsc_bpp[i] > dsc_max_bpp)
 			continue;
-		if (valid_dsc_bpp[i] > dsc_max_bpp)
-			break;
 		ret = dsc_compute_link_config(intel_dp,
 					      pipe_config,
 	crtc_state->infoframes.enable |= intel_hdmi_infoframe_enable(DP_SDP_ADAPTIVE_SYNC);
-	/* Currently only DP_AS_SDP_AVT_FIXED_VTOTAL mode supported */
 	as_sdp->sdp_type = DP_SDP_ADAPTIVE_SYNC;
 	as_sdp->length = 0x9;
 	as_sdp->duration_incr_ms = 0;
 		as_sdp->target_rr = drm_mode_vrefresh(adjusted_mode);
 		as_sdp->target_rr_divider = true;
 	} else {
-		as_sdp->mode = DP_AS_SDP_AVT_FIXED_VTOTAL;
+		as_sdp->mode = DP_AS_SDP_AVT_DYNAMIC_VTOTAL;
 		as_sdp->vtotal = adjusted_mode->vtotal;
 		as_sdp->target_rr = 0;
 	}

drivers/gpu/drm/i915/display/intel_dp_mst.c+4−0

@@ -341,6 +341,10 @@ int intel_dp_mtp_tu_compute_config(struct intel_dp *intel_dp, · 340 unmodified lines
341		341
342	break;	342	break;
343	}	343	}
		344
		345	/* Allow using zero step to indicate one try */
		346	if (!step)
		347	break;
344	}	348	}
345		349
346	if (slots < 0) {	350	if (slots < 0) {

drivers/gpu/drm/i915/display/intel_hdcp.c+14−1

 	u32 rekey_bit = 0;
 	/* Here we assume HDMI is in TMDS mode of operation */
-	if (encoder->type != INTEL_OUTPUT_HDMI)
+	if (!intel_encoder_is_hdmi(encoder))
 		return;
 	if (DISPLAY_VER(display) >= 30) {
 		drm_dbg_kms(display->drm,
 			    "HDCP2.2 Downstream topology change\n");
+		ret = hdcp2_authenticate_repeater_topology(connector);
+		if (!ret) {
+			intel_hdcp_update_value(connector,
+						DRM_MODE_CONTENT_PROTECTION_ENABLED,
+						true);
+			goto out;
+		}
+		drm_dbg_kms(display->drm,
+			    "[CONNECTOR:%d:%s] Repeater topology auth failed.(%d)\n",
+			    connector->base.base.id, connector->base.name,
+			    ret);
 	} else {
 		drm_dbg_kms(display->drm,
 			    "[CONNECTOR:%d:%s] HDCP2.2 link failed, retrying auth\n",

drivers/gpu/drm/i915/display/skl_universal_plane.c+0−4

 	DRM_FORMAT_Y216,
 	DRM_FORMAT_XYUV8888,
 	DRM_FORMAT_XVYU2101010,
-	DRM_FORMAT_XVYU12_16161616,
-	DRM_FORMAT_XVYU16161616,
 };
 static const u32 icl_sdr_uv_plane_formats[] = {
 	DRM_FORMAT_Y216,
 	DRM_FORMAT_XYUV8888,
 	DRM_FORMAT_XVYU2101010,
-	DRM_FORMAT_XVYU12_16161616,
-	DRM_FORMAT_XVYU16161616,
 };
 static const u32 icl_hdr_plane_formats[] = {

drivers/gpu/drm/i915/gem/i915_gem_shmem.c+1−5

 	struct address_space *mapping = obj->base.filp->f_mapping;
 	unsigned int max_segment = i915_sg_segment_size(i915->drm.dev);
 	struct sg_table *st;
-	struct sgt_iter sgt_iter;
-	struct page *page;
 	int ret;
 	/*
 		 * for PAGE_SIZE chunks instead may be helpful.
 		 */
 		if (max_segment > PAGE_SIZE) {
-			for_each_sgt_page(page, sgt_iter, st)
+			shmem_sg_free_table(st, mapping, false, false);
-				put_page(page);
-			sg_free_table(st);
 			kfree(st);
 			max_segment = PAGE_SIZE;

drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c+30−6

 	spin_unlock_irqrestore(&guc->timestamp.lock, flags);
 }
+static void __update_guc_busyness_running_state(struct intel_guc *guc)
+{
+	struct intel_gt *gt = guc_to_gt(guc);
+	struct intel_engine_cs *engine;
+	enum intel_engine_id id;
+	unsigned long flags;
+	spin_lock_irqsave(&guc->timestamp.lock, flags);
+	for_each_engine(engine, gt, id)
+		engine->stats.guc.running = false;
+	spin_unlock_irqrestore(&guc->timestamp.lock, flags);
+}
 static void __update_guc_busyness_stats(struct intel_guc *guc)
 {
 	struct intel_gt *gt = guc_to_gt(guc);
 	if (!guc_submission_initialized(guc))
 		return;
+	/* Assume no engines are running and set running state to false */
+	__update_guc_busyness_running_state(guc);
 	/*
 	 * There is a race with suspend flow where the worker runs after suspend
 	 * and causes an unclaimed register access warning. Cancel the worker
 {
 	drm_printf(p, "GuC lrc descriptor %u:\n", ce->guc_id.id);
 	drm_printf(p, "\tHW Context Desc: 0x%08x\n", ce->lrc.lrca);
-	drm_printf(p, "\t\tLRC Head: Internal %u, Memory %u\n",
+	if (intel_context_pin_if_active(ce)) {
-		   ce->ring->head,
+		drm_printf(p, "\t\tLRC Head: Internal %u, Memory %u\n",
-		   ce->lrc_reg_state[CTX_RING_HEAD]);
+			   ce->ring->head,
-	drm_printf(p, "\t\tLRC Tail: Internal %u, Memory %u\n",
+			   ce->lrc_reg_state[CTX_RING_HEAD]);
-		   ce->ring->tail,
+		drm_printf(p, "\t\tLRC Tail: Internal %u, Memory %u\n",
-		   ce->lrc_reg_state[CTX_RING_TAIL]);
+			   ce->ring->tail,
+			   ce->lrc_reg_state[CTX_RING_TAIL]);
+		intel_context_unpin(ce);
+	} else {
+		drm_printf(p, "\t\tLRC Head: Internal %u, Memory not pinned\n",
+			   ce->ring->head);
+		drm_printf(p, "\t\tLRC Tail: Internal %u, Memory not pinned\n",
+			   ce->ring->tail);
+	}
 	drm_printf(p, "\t\tContext Pin Count: %u\n",
 		   atomic_read(&ce->pin_count));
 	drm_printf(p, "\t\tGuC ID Ref Count: %u\n",

drivers/gpu/drm/i915/selftests/i915_gem_gtt.c+2−2

@@ -168,7 +168,7 @@ static int igt_ppgtt_alloc(void *arg) · 167 unmodified lines
168	return PTR_ERR(ppgtt);	168	return PTR_ERR(ppgtt);
169		169
170	if (!ppgtt->vm.allocate_va_range)	170	if (!ppgtt->vm.allocate_va_range)
171	goto err_ppgtt_cleanup;	171	goto ppgtt_vm_put;
172		172
173	/*	173	/*
174	* While we only allocate the page tables here and so we could	174	* While we only allocate the page tables here and so we could
@@ -236,7 +236,7 @@ err_ppgtt_cleanup: · 61 unmodified lines
236	goto retry;	236	goto retry;
237	}	237	}
238	i915_gem_ww_ctx_fini(&ww);	238	i915_gem_ww_ctx_fini(&ww);
239		239	ppgtt_vm_put:
240	i915_vm_put(&ppgtt->vm);	240	i915_vm_put(&ppgtt->vm);
241	return err;	241	return err;
242	}	242	}

drivers/gpu/drm/panthor/panthor_drv.c+1−0

@@ -802,6 +802,7 @@ static void panthor_query_group_priorities_info(struct drm_file *file, · 801 unmodified lines
802	{	802	{
803	int prio;	803	int prio;
804		804
		805	memset(arg, 0, sizeof(*arg));
805	for (prio = PANTHOR_GROUP_PRIORITY_REALTIME; prio >= 0; prio--) {	806	for (prio = PANTHOR_GROUP_PRIORITY_REALTIME; prio >= 0; prio--) {
806	if (!group_priority_permit(file, prio))	807	if (!group_priority_permit(file, prio))
807	arg->allowed_mask \|= BIT(prio);	808	arg->allowed_mask \|= BIT(prio);

drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c+103−97

 	state = drm_kunit_helper_atomic_state_alloc(test, drm, ctx);
 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, state);
+retry:
 	conn_state = drm_atomic_get_connector_state(state, connector);
 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, conn_state);
 	ret = drm_atomic_set_crtc_for_connector(conn_state, crtc);
+	if (ret == -EDEADLK) {
+		drm_atomic_state_clear(state);
+		ret = drm_modeset_backoff(ctx);
+		if (!ret)
+			goto retry;
+	}
 	KUNIT_EXPECT_EQ(test, ret, 0);
 	crtc_state = drm_atomic_get_crtc_state(state, crtc);
 						    8);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
+	drm = &priv->drm;
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 						    8);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
+	drm = &priv->drm;
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 						    8);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
+	drm = &priv->drm;
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	KUNIT_ASSERT_TRUE(test, conn->display_info.is_hdmi);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
 	KUNIT_ASSERT_NE(test, drm_match_cea_mode(preferred), 1);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 	mode = drm_kunit_display_mode_from_cea_vic(test, drm, 1);
 	KUNIT_ASSERT_NOT_NULL(test, mode);
-	drm = &priv->drm;
 	crtc = priv->crtc;
 	ret = light_up_connector(test, drm, crtc, conn, mode, ctx);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 						    8);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
+	drm = &priv->drm;
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	KUNIT_ASSERT_TRUE(test, conn->display_info.is_hdmi);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
 	KUNIT_ASSERT_NE(test, drm_match_cea_mode(preferred), 1);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 	mode = drm_kunit_display_mode_from_cea_vic(test, drm, 1);
 	KUNIT_ASSERT_NOT_NULL(test, mode);
-	drm = &priv->drm;
 	crtc = priv->crtc;
 	ret = light_up_connector(test, drm, crtc, conn, mode, ctx);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 						    8);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
+	drm = &priv->drm;
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	KUNIT_ASSERT_TRUE(test, conn->display_info.is_hdmi);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
 	KUNIT_ASSERT_NE(test, drm_match_cea_mode(preferred), 1);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 	mode = drm_kunit_display_mode_from_cea_vic(test, drm, 1);
 	KUNIT_ASSERT_NOT_NULL(test, mode);
-	drm = &priv->drm;
 	crtc = priv->crtc;
 	ret = light_up_connector(test, drm, crtc, conn, mode, ctx);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 						    10);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
+	drm = &priv->drm;
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	ret = set_connector_edid(test, conn,
 				 test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz,
 				 ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz));
 	KUNIT_ASSERT_GT(test, ret, 0);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 						    10);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
+	drm = &priv->drm;
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	ret = set_connector_edid(test, conn,
 				 test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz,
 				 ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz));
 	KUNIT_ASSERT_GT(test, ret, 0);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 						    12);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
+	drm = &priv->drm;
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	ret = set_connector_edid(test, conn,
 				 test_edid_dvi_1080p,
 	info = &conn->display_info;
 	KUNIT_ASSERT_FALSE(test, info->is_hdmi);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 						    8);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
+	drm = &priv->drm;
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	ret = set_connector_edid(test, conn,
 				 test_edid_hdmi_1080p_rgb_max_200mhz,
 				 ARRAY_SIZE(test_edid_hdmi_1080p_rgb_max_200mhz));
 	KUNIT_ASSERT_GT(test, ret, 0);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
 	KUNIT_ASSERT_FALSE(test, preferred->flags & DRM_MODE_FLAG_DBLCLK);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 						    10);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
+	drm = &priv->drm;
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	ret = set_connector_edid(test, conn,
 				 test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz,
 				 ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz));
 	KUNIT_ASSERT_GT(test, ret, 0);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
 	KUNIT_ASSERT_FALSE(test, preferred->flags & DRM_MODE_FLAG_DBLCLK);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 						    12);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
+	drm = &priv->drm;
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	ret = set_connector_edid(test, conn,
 				 test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz,
 				 ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz));
 	KUNIT_ASSERT_GT(test, ret, 0);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
 	KUNIT_ASSERT_FALSE(test, preferred->flags & DRM_MODE_FLAG_DBLCLK);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 						    8);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
+	drm = &priv->drm;
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_ASSERT_EQ(test, ret, 0);
 						    12);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
+	drm = &priv->drm;
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	ret = set_connector_edid(test, conn,
 				 test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz,
 	KUNIT_ASSERT_TRUE(test, info->is_hdmi);
 	KUNIT_ASSERT_GT(test, info->max_tmds_clock, 0);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
 	KUNIT_ASSERT_FALSE(test, preferred->flags & DRM_MODE_FLAG_DBLCLK);
 	rate = drm_hdmi_compute_mode_clock(preferred, 10, HDMI_COLORSPACE_RGB);
 	KUNIT_ASSERT_LT(test, rate, info->max_tmds_clock * 1000);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_EXPECT_EQ(test, ret, 0);
 						    12);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
+	drm = &priv->drm;
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	ret = set_connector_edid(test, conn,
 				 test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz,
 	KUNIT_ASSERT_TRUE(test, info->is_hdmi);
 	KUNIT_ASSERT_GT(test, info->max_tmds_clock, 0);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
 	KUNIT_ASSERT_FALSE(test, preferred->flags & DRM_MODE_FLAG_DBLCLK);
 	rate = drm_hdmi_compute_mode_clock(preferred, 12, HDMI_COLORSPACE_YUV422);
 	KUNIT_ASSERT_LT(test, rate, info->max_tmds_clock * 1000);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_EXPECT_EQ(test, ret, 0);
 	KUNIT_ASSERT_TRUE(test, info->is_hdmi);
 	KUNIT_ASSERT_GT(test, info->max_tmds_clock, 0);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	mode = drm_kunit_display_mode_from_cea_vic(test, drm, 1);
 	KUNIT_ASSERT_NOT_NULL(test, mode);
 	rate = mode->clock * 1500;
 	KUNIT_ASSERT_LT(test, rate, info->max_tmds_clock * 1000);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	crtc = priv->crtc;
 	ret = light_up_connector(test, drm, crtc, conn, mode, ctx);
 	KUNIT_EXPECT_EQ(test, ret, 0);
 						    12);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
+	drm = &priv->drm;
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	ret = set_connector_edid(test, conn,
 				 test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz,
 	KUNIT_ASSERT_TRUE(test, info->is_hdmi);
 	KUNIT_ASSERT_GT(test, info->max_tmds_clock, 0);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
 	rate = drm_hdmi_compute_mode_clock(preferred, 12, HDMI_COLORSPACE_YUV422);
 	KUNIT_ASSERT_LT(test, rate, info->max_tmds_clock * 1000);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_EXPECT_EQ(test, ret, 0);
 						    12);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
+	drm = &priv->drm;
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	ret = set_connector_edid(test, conn,
 				 test_edid_hdmi_1080p_rgb_max_200mhz,
 	KUNIT_ASSERT_TRUE(test, info->is_hdmi);
 	KUNIT_ASSERT_GT(test, info->max_tmds_clock, 0);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
 	rate = drm_hdmi_compute_mode_clock(preferred, 12, HDMI_COLORSPACE_YUV422);
 	KUNIT_ASSERT_LT(test, rate, info->max_tmds_clock * 1000);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_EXPECT_EQ(test, ret, 0);
 						    8);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
+	drm = &priv->drm;
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	ret = set_connector_edid(test, conn,
 				 test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz,
 	KUNIT_ASSERT_TRUE(test, info->is_hdmi);
 	KUNIT_ASSERT_GT(test, info->max_tmds_clock, 0);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
 	rate = drm_hdmi_compute_mode_clock(preferred, 12, HDMI_COLORSPACE_RGB);
 	KUNIT_ASSERT_LT(test, rate, info->max_tmds_clock * 1000);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_EXPECT_EQ(test, ret, 0);
 						    12);
 	KUNIT_ASSERT_NOT_NULL(test, priv);
+	drm = &priv->drm;
+	crtc = priv->crtc;
 	conn = &priv->connector;
 	ret = set_connector_edid(test, conn,
 				 test_edid_hdmi_1080p_rgb_max_340mhz,
 	KUNIT_ASSERT_TRUE(test, info->is_hdmi);
 	KUNIT_ASSERT_GT(test, info->max_tmds_clock, 0);
-	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	preferred = find_preferred_mode(conn);
 	KUNIT_ASSERT_NOT_NULL(test, preferred);
 	rate = drm_hdmi_compute_mode_clock(preferred, 12, HDMI_COLORSPACE_RGB);
 	KUNIT_ASSERT_LT(test, rate, info->max_tmds_clock * 1000);
-	drm = &priv->drm;
+	ctx = drm_kunit_helper_acquire_ctx_alloc(test);
-	crtc = priv->crtc;
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
 	ret = light_up_connector(test, drm, crtc, conn, preferred, ctx);
 	KUNIT_EXPECT_EQ(test, ret, 0);

drivers/gpu/drm/xe/regs/xe_oa_regs.h+6−0

 /* Common to all OA units */
 #define  OA_OACONTROL_REPORT_BC_MASK		REG_GENMASK(9, 9)
 #define  OA_OACONTROL_COUNTER_SIZE_MASK		REG_GENMASK(8, 8)
+#define  OAG_OACONTROL_USED_BITS \
+	(OAG_OACONTROL_OA_PES_DISAG_EN | OAG_OACONTROL_OA_CCS_SELECT_MASK | \
+	 OAG_OACONTROL_OA_COUNTER_SEL_MASK | OAG_OACONTROL_OA_COUNTER_ENABLE | \
+	 OA_OACONTROL_REPORT_BC_MASK | OA_OACONTROL_COUNTER_SIZE_MASK)
 #define OAG_OA_DEBUG XE_REG(0xdaf8, XE_REG_OPTION_MASKED)
 #define  OAG_OA_DEBUG_DISABLE_MMIO_TRG			REG_BIT(14)
 #define OAM_CONTEXT_CONTROL_OFFSET		(0x1bc)
 #define OAM_CONTROL_OFFSET			(0x194)
 #define  OAM_CONTROL_COUNTER_SEL_MASK		REG_GENMASK(3, 1)
+#define  OAM_OACONTROL_USED_BITS \
+	(OAM_CONTROL_COUNTER_SEL_MASK | OAG_OACONTROL_OA_COUNTER_ENABLE)
 #define OAM_DEBUG_OFFSET			(0x198)
 #define OAM_STATUS_OFFSET			(0x19c)
 #define OAM_MMIO_TRG_OFFSET			(0x1d0)

drivers/gpu/drm/xe/xe_devcoredump.c+14−26

 	drm_puts(&p, "\n**** GuC CT ****\n");
 	xe_guc_ct_snapshot_print(ss->guc.ct, &p);
-	/*
+	drm_puts(&p, "\n**** Contexts ****\n");
-	 * Don't add a new section header here because the mesa debug decoder
-	 * tool expects the context information to be in the 'GuC CT' section.
-	 */
-	/* drm_puts(&p, "\n**** Contexts ****\n"); */
 	xe_guc_exec_queue_snapshot_print(ss->ge, &p);
 	drm_puts(&p, "\n**** Job ****\n");
 /**
  * xe_print_blob_ascii85 - print a BLOB to some useful location in ASCII85
  *
- * The output is split to multiple lines because some print targets, e.g. dmesg
+ * The output is split into multiple calls to drm_puts() because some print
- * cannot handle arbitrarily long lines. Note also that printing to dmesg in
+ * targets, e.g. dmesg, cannot handle arbitrarily long lines. These targets may
- * piece-meal fashion is not possible, each separate call to drm_puts() has a
+ * add newlines, as is the case with dmesg: each drm_puts() call creates a
- * line-feed automatically added! Therefore, the entire output line must be
+ * separate line.
- * constructed in a local buffer first, then printed in one atomic output call.
  *
  * There is also a scheduler yield call to prevent the 'task has been stuck for
  * 120s' kernel hang check feature from firing when printing to a slow target
  * such as dmesg over a serial port.
  *
- * TODO: Add compression prior to the ASCII85 encoding to shrink huge buffers down.
- *
  * @p: the printer object to output to
  * @prefix: optional prefix to add to output string
+ * @suffix: optional suffix to add at the end. 0 disables it and is
+ *          not added to the output, which is useful when using multiple calls
+ *          to dump data to @p
  * @blob: the Binary Large OBject to dump out
  * @offset: offset in bytes to skip from the front of the BLOB, must be a multiple of sizeof(u32)
  * @size: the size in bytes of the BLOB, must be a multiple of sizeof(u32)
  */
-void xe_print_blob_ascii85(struct drm_printer *p, const char *prefix,
+void xe_print_blob_ascii85(struct drm_printer *p, const char *prefix, char suffix,
 			   const void *blob, size_t offset, size_t size)
 {
 	const u32 *blob32 = (const u32 *)blob;
 	char buff[ASCII85_BUFSZ], *line_buff;
 	size_t line_pos = 0;
-	/*
-	 * Splitting blobs across multiple lines is not compatible with the mesa
-	 * debug decoder tool. Note that even dropping the explicit '\n' below
-	 * doesn't help because the GuC log is so big some underlying implementation
-	 * still splits the lines at 512K characters. So just bail completely for
-	 * the moment.
-	 */
-	return;
 #define DMESG_MAX_LINE_LEN	800
-#define MIN_SPACE		(ASCII85_BUFSZ + 2)		/* 85 + "\n\0" */
+	/* Always leave space for the suffix char and the \0 */
+#define MIN_SPACE		(ASCII85_BUFSZ + 2)	/* 85 + "<suffix>\0" */
 	if (size & 3)
 		drm_printf(p, "Size not word aligned: %zu", size);
 		line_pos += strlen(line_buff + line_pos);
 		if ((line_pos + MIN_SPACE) >= DMESG_MAX_LINE_LEN) {
-			line_buff[line_pos++] = '\n';
 			line_buff[line_pos++] = 0;
 			drm_puts(p, line_buff);
 		}
 	}
+	if (suffix)
+		line_buff[line_pos++] = suffix;
 	if (line_pos) {
-		line_buff[line_pos++] = '\n';
 		line_buff[line_pos++] = 0;
 		drm_puts(p, line_buff);
 	}

drivers/gpu/drm/xe/xe_devcoredump.h+1−1

@@ -29,7 +29,7 @@ static inline int xe_devcoredump_init(struct xe_device *xe) · 28 unmodified lines
29	}	29	}
30	#endif	30	#endif
31		31
32	void xe_print_blob_ascii85(struct drm_printer p, const char prefix,	32	void xe_print_blob_ascii85(struct drm_printer p, const char prefix, char suffix,
33	const void *blob, size_t offset, size_t size);	33	const void *blob, size_t offset, size_t size);
34		34
35	#endif	35	#endif

drivers/gpu/drm/xe/xe_drm_client.c+1−1

 	XE_WARN_ON(bo->client);
 	XE_WARN_ON(!list_empty(&bo->client_link));
-	spin_lock(&client->bos_lock);
 	bo->client = xe_drm_client_get(client);
+	spin_lock(&client->bos_lock);
 	list_add_tail(&bo->client_link, &client->bos_list);
 	spin_unlock(&client->bos_lock);
 }

drivers/gpu/drm/xe/xe_gt.c+3−1

@@ -532,8 +532,10 @@ static int all_fw_domain_init(struct xe_gt *gt) · 531 unmodified lines
532	if (IS_SRIOV_PF(gt_to_xe(gt)) && !xe_gt_is_media_type(gt))	532	if (IS_SRIOV_PF(gt_to_xe(gt)) && !xe_gt_is_media_type(gt))
533	xe_lmtt_init_hw(&gt_to_tile(gt)->sriov.pf.lmtt);	533	xe_lmtt_init_hw(&gt_to_tile(gt)->sriov.pf.lmtt);
534		534
535	if (IS_SRIOV_PF(gt_to_xe(gt)))	535	if (IS_SRIOV_PF(gt_to_xe(gt))) {
		536	xe_gt_sriov_pf_init(gt);
536	xe_gt_sriov_pf_init_hw(gt);	537	xe_gt_sriov_pf_init_hw(gt);
		538	}
537		539
538	xe_force_wake_put(gt_to_fw(gt), fw_ref);	540	xe_force_wake_put(gt_to_fw(gt), fw_ref);
539		541

drivers/gpu/drm/xe/xe_gt_sriov_pf.c+13−1

 	return 0;
 }
+/**
+ * xe_gt_sriov_pf_init - Prepare SR-IOV PF data structures on PF.
+ * @gt: the &xe_gt to initialize
+ *
+ * Late one-time initialization of the PF data.
+ *
+ * Return: 0 on success or a negative error code on failure.
+ */
+int xe_gt_sriov_pf_init(struct xe_gt *gt)
+{
+	return xe_gt_sriov_pf_migration_init(gt);
+}
 static bool pf_needs_enable_ggtt_guest_update(struct xe_device *xe)
 {
 	return GRAPHICS_VERx100(xe) == 1200;
 		pf_enable_ggtt_guest_update(gt);
 	xe_gt_sriov_pf_service_update(gt);
-	xe_gt_sriov_pf_migration_init(gt);
 }
 static u32 pf_get_vf_regs_stride(struct xe_device *xe)

drivers/gpu/drm/xe/xe_gt_sriov_pf.h+6−0

 #ifdef CONFIG_PCI_IOV
 int xe_gt_sriov_pf_init_early(struct xe_gt *gt);
+int xe_gt_sriov_pf_init(struct xe_gt *gt);
 void xe_gt_sriov_pf_init_hw(struct xe_gt *gt);
 void xe_gt_sriov_pf_sanitize_hw(struct xe_gt *gt, unsigned int vfid);
 void xe_gt_sriov_pf_restart(struct xe_gt *gt);
 	return 0;
 }
+static inline int xe_gt_sriov_pf_init(struct xe_gt *gt)
+{
+	return 0;
+}
 static inline void xe_gt_sriov_pf_init_hw(struct xe_gt *gt)
 {
 }

drivers/gpu/drm/xe/xe_guc_ct.c+2−1

@@ -1724,7 +1724,8 @@ void xe_guc_ct_snapshot_print(struct xe_guc_ct_snapshot *snapshot, · 1723 unmodified lines
1724	snapshot->g2h_outstanding);	1724	snapshot->g2h_outstanding);
1725		1725
1726	if (snapshot->ctb)	1726	if (snapshot->ctb)
1727	xe_print_blob_ascii85(p, "CTB data", snapshot->ctb, 0, snapshot->ctb_size);	1727	xe_print_blob_ascii85(p, "CTB data", '\n',
		1728	snapshot->ctb, 0, snapshot->ctb_size);
1728	} else {	1729	} else {
1729	drm_puts(p, "CT disabled\n");	1730	drm_puts(p, "CT disabled\n");
1730	}	1731	}

drivers/gpu/drm/xe/xe_guc_log.c+3−1

 	remain = snapshot->size;
 	for (i = 0; i < snapshot->num_chunks; i++) {
 		size_t size = min(GUC_LOG_CHUNK_SIZE, remain);
+		const char *prefix = i ? NULL : "Log data";
+		char suffix = i == snapshot->num_chunks - 1 ? '\n' : 0;
-		xe_print_blob_ascii85(p, i ? NULL : "Log data", snapshot->copy[i], 0, size);
+		xe_print_blob_ascii85(p, prefix, suffix, snapshot->copy[i], 0, size);
 		remain -= size;
 	}
 }

drivers/gpu/drm/xe/xe_oa.c+13−8

 	u32 tail, hw_tail, partial_report_size, available;
 	int report_size = stream->oa_buffer.format->size;
 	unsigned long flags;
-	bool pollin;
 	spin_lock_irqsave(&stream->oa_buffer.ptr_lock, flags);
 	stream->oa_buffer.tail = tail;
 	available = xe_oa_circ_diff(stream, stream->oa_buffer.tail, stream->oa_buffer.head);
-	pollin = available >= stream->wait_num_reports * report_size;
+	stream->pollin = available >= stream->wait_num_reports * report_size;
 	spin_unlock_irqrestore(&stream->oa_buffer.ptr_lock, flags);
-	return pollin;
+	return stream->pollin;
 }
 static enum hrtimer_restart xe_oa_poll_check_timer_cb(struct hrtimer *hrtimer)
 	struct xe_oa_stream *stream =
 		container_of(hrtimer, typeof(*stream), poll_check_timer);
-	if (xe_oa_buffer_check_unlocked(stream)) {
+	if (xe_oa_buffer_check_unlocked(stream))
-		stream->pollin = true;
 		wake_up(&stream->poll_wq);
-	}
 	hrtimer_forward_now(hrtimer, ns_to_ktime(stream->poll_period_ns));
 	return val;
 }
+static u32 __oactrl_used_bits(struct xe_oa_stream *stream)
+{
+	return stream->hwe->oa_unit->type == DRM_XE_OA_UNIT_TYPE_OAG ?
+		OAG_OACONTROL_USED_BITS : OAM_OACONTROL_USED_BITS;
+}
 static void xe_oa_enable(struct xe_oa_stream *stream)
 {
 	const struct xe_oa_format *format = stream->oa_buffer.format;
 	    stream->hwe->oa_unit->type == DRM_XE_OA_UNIT_TYPE_OAG)
 		val |= OAG_OACONTROL_OA_PES_DISAG_EN;
-	xe_mmio_write32(&stream->gt->mmio, regs->oa_ctrl, val);
+	xe_mmio_rmw32(&stream->gt->mmio, regs->oa_ctrl, __oactrl_used_bits(stream), val);
 }
 static void xe_oa_disable(struct xe_oa_stream *stream)
 {
 	struct xe_mmio *mmio = &stream->gt->mmio;
-	xe_mmio_write32(mmio, __oa_regs(stream)->oa_ctrl, 0);
+	xe_mmio_rmw32(mmio, __oa_regs(stream)->oa_ctrl, __oactrl_used_bits(stream), 0);
 	if (xe_mmio_wait32(mmio, __oa_regs(stream)->oa_ctrl,
 			   OAG_OACONTROL_OA_COUNTER_ENABLE, 0, 50000, NULL, false))
 		drm_err(&stream->oa->xe->drm,
 			u->type = DRM_XE_OA_UNIT_TYPE_OAM;
 		}
+		xe_mmio_write32(&gt->mmio, u->regs.oa_ctrl, 0);
 		/* Ensure MMIO trigger remains disabled till there is a stream */
 		xe_mmio_write32(&gt->mmio, u->regs.oa_debug,
 				oag_configure_mmio_trigger(NULL, false));

drivers/gpu/drm/xe/xe_ttm_stolen_mgr.c+30−24

 	return GRAPHICS_VERx100(xe) < 1270 && !IS_DGFX(xe);
 }
+static u32 get_wopcm_size(struct xe_device *xe)
+{
+	u32 wopcm_size;
+	u64 val;
+	val = xe_mmio_read64_2x32(xe_root_tile_mmio(xe), STOLEN_RESERVED);
+	val = REG_FIELD_GET64(WOPCM_SIZE_MASK, val);
+	switch (val) {
+	case 0x5 ... 0x6:
+		val--;
+		fallthrough;
+	case 0x0 ... 0x3:
+		wopcm_size = (1U << val) * SZ_1M;
+		break;
+	default:
+		WARN(1, "Missing case wopcm_size=%llx\n", val);
+		wopcm_size = 0;
+	}
+	return wopcm_size;
+}
 static s64 detect_bar2_dgfx(struct xe_device *xe, struct xe_ttm_stolen_mgr *mgr)
 {
 	struct xe_tile *tile = xe_device_get_root_tile(xe);
 	struct xe_mmio *mmio = xe_root_tile_mmio(xe);
 	struct pci_dev *pdev = to_pci_dev(xe->drm.dev);
-	u64 stolen_size;
+	u64 stolen_size, wopcm_size;
 	u64 tile_offset;
 	u64 tile_size;
 	if (drm_WARN_ON(&xe->drm, tile_size < mgr->stolen_base))
 		return 0;
+	/* Carve out the top of DSM as it contains the reserved WOPCM region */
+	wopcm_size = get_wopcm_size(xe);
+	if (drm_WARN_ON(&xe->drm, !wopcm_size))
+		return 0;
 	stolen_size = tile_size - mgr->stolen_base;
+	stolen_size -= wopcm_size;
 	/* Verify usage fits in the actual resource available */
 	if (mgr->stolen_base + stolen_size <= pci_resource_len(pdev, LMEM_BAR))
 	return ALIGN_DOWN(stolen_size, SZ_1M);
 }
-static u32 get_wopcm_size(struct xe_device *xe)
-{
-	u32 wopcm_size;
-	u64 val;
-	val = xe_mmio_read64_2x32(xe_root_tile_mmio(xe), STOLEN_RESERVED);
-	val = REG_FIELD_GET64(WOPCM_SIZE_MASK, val);
-	switch (val) {
-	case 0x5 ... 0x6:
-		val--;
-		fallthrough;
-	case 0x0 ... 0x3:
-		wopcm_size = (1U << val) * SZ_1M;
-		break;
-	default:
-		WARN(1, "Missing case wopcm_size=%llx\n", val);
-		wopcm_size = 0;
-	}
-	return wopcm_size;
-}
 static u32 detect_bar2_integrated(struct xe_device *xe, struct xe_ttm_stolen_mgr *mgr)
 {
 	struct pci_dev *pdev = to_pci_dev(xe->drm.dev);

drivers/gpu/host1x/dev.c+2−0

@@ -619,6 +619,8 @@ static int host1x_probe(struct platform_device *pdev) · 618 unmodified lines
619	goto free_contexts;	619	goto free_contexts;
620	}	620	}
621		621
		622	mutex_init(&host->intr_mutex);
		623
622	pm_runtime_enable(&pdev->dev);	624	pm_runtime_enable(&pdev->dev);
623		625
624	err = devm_tegra_core_dev_init_opp_table_common(&pdev->dev);	626	err = devm_tegra_core_dev_init_opp_table_common(&pdev->dev);

drivers/gpu/host1x/intr.c+0−2

@@ -104,8 +104,6 @@ int host1x_intr_init(struct host1x *host) · 103 unmodified lines
104	unsigned int id;	104	unsigned int id;
105	int i, err;	105	int i, err;
106		106
107	mutex_init(&host->intr_mutex);
108
109	for (id = 0; id < host1x_syncpt_nb_pts(host); ++id) {	107	for (id = 0; id < host1x_syncpt_nb_pts(host); ++id) {
110	struct host1x_syncpt *syncpt = &host->syncpt[id];	108	struct host1x_syncpt *syncpt = &host->syncpt[id];
111		109

drivers/hid/Kconfig+10−5

 config HID_LENOVO
 	tristate "Lenovo / Thinkpad devices"
+	depends on ACPI
+	select ACPI_PLATFORM_PROFILE
 	select NEW_LEDS
 	select LEDS_CLASS
 	help
 	tristate "Topre REALFORCE keyboards"
 	depends on HID
 	help
-	  Say Y for N-key rollover support on Topre REALFORCE R2 108/87 key keyboards.
+	  Say Y for N-key rollover support on Topre REALFORCE R2 108/87 key and
+          Topre REALFORCE R3S 87 key keyboards.
 config HID_THINGM
 	tristate "ThingM blink(1) USB RGB LED"
 source "drivers/hid/bpf/Kconfig"
-endif # HID
-source "drivers/hid/usbhid/Kconfig"
 source "drivers/hid/i2c-hid/Kconfig"
 source "drivers/hid/intel-ish-hid/Kconfig"
 source "drivers/hid/intel-thc-hid/Kconfig"
+endif # HID
+# USB support may be used with HID disabled
+source "drivers/hid/usbhid/Kconfig"
 endif # HID_SUPPORT

drivers/hid/amd-sfh-hid/Kconfig+0−1

@@ -5,7 +5,6 @@ menu "AMD SFH HID Support" · 4 unmodified lines
5		5
6	config AMD_SFH_HID	6	config AMD_SFH_HID
7	tristate "AMD Sensor Fusion Hub"	7	tristate "AMD Sensor Fusion Hub"
8	depends on HID
9	depends on X86	8	depends on X86
10	help	9	help
11	If you say yes to this option, support will be included for the	10	If you say yes to this option, support will be included for the

drivers/hid/hid-apple.c+8−0

 			 hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2015)
 			table = magic_keyboard_2015_fn_keys;
 		else if (hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021 ||
+			 hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024 ||
 			 hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021 ||
 			 hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2021)
 			table = apple2021_fn_keys;
 		}
 	}
+	if (usage->hid == 0xc0301) /* Omoton KB066 quirk */
+		code = KEY_F6;
 	if (usage->code != code) {
 		input_event_with_scancode(input, usage->type, code, usage->hid, value);
 		.driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK | APPLE_RDESC_BATTERY },
 	{ HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021),
 		.driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024),
+		.driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK | APPLE_RDESC_BATTERY },
+	{ HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024),
+		.driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021),
 		.driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK | APPLE_RDESC_BATTERY },
 	{ HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021),

drivers/hid/hid-corsair-void.c+2−1

 static void corsair_void_battery_add_work_handler(struct work_struct *work)
 {
 	struct corsair_void_drvdata *drvdata;
-	struct power_supply_config psy_cfg;
+	struct power_supply_config psy_cfg = {};
 	struct power_supply *new_supply;
 	drvdata = container_of(work, struct corsair_void_drvdata,
 	if (drvdata->battery)
 		power_supply_unregister(drvdata->battery);
+	cancel_delayed_work_sync(&drvdata->delayed_status_work);
 	cancel_delayed_work_sync(&drvdata->delayed_firmware_work);
 	sysfs_remove_group(&hid_dev->dev.kobj, &corsair_void_attr_group);
 }

drivers/hid/hid-ids.h+3−0

 #define USB_DEVICE_ID_APPLE_IRCONTROL4	0x8242
 #define USB_DEVICE_ID_APPLE_IRCONTROL5	0x8243
 #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021   0x029c
+#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024   0x0320
 #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021   0x029a
 #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2021   0x029f
 #define USB_DEVICE_ID_APPLE_TOUCHBAR_BACKLIGHT 0x8102
 #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001		0x3001
 #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003		0x3003
 #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008		0x3008
+#define USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473		0x5473
 #define I2C_VENDOR_ID_RAYDIUM		0x2386
 #define I2C_PRODUCT_ID_RAYDIUM_4B33	0x4b33
 #define USB_VENDOR_ID_TOPRE			0x0853
 #define USB_DEVICE_ID_TOPRE_REALFORCE_R2_108			0x0148
 #define USB_DEVICE_ID_TOPRE_REALFORCE_R2_87			0x0146
+#define USB_DEVICE_ID_TOPRE_REALFORCE_R3S_87			0x0313
 #define USB_VENDOR_ID_TOPSEED		0x0766
 #define USB_DEVICE_ID_TOPSEED_CYBERLINK	0x0204

drivers/hid/hid-lenovo.c+1−6

 #include <linux/leds.h>
 #include <linux/workqueue.h>
-#if IS_ENABLED(CONFIG_ACPI_PLATFORM_PROFILE)
 #include <linux/platform_profile.h>
-#endif /* CONFIG_ACPI_PLATFORM_PROFILE */
 #include "hid-ids.h"
 			if (hdev->product == USB_DEVICE_ID_LENOVO_X12_TAB) {
 				report_key_event(input, KEY_RFKILL);
 				return 1;
-			}
+			} else {
-#if IS_ENABLED(CONFIG_ACPI_PLATFORM_PROFILE)
-			else {
 				platform_profile_cycle();
 				return 1;
 			}
-#endif /* CONFIG_ACPI_PLATFORM_PROFILE */
 			return 0;
 		case TP_X12_RAW_HOTKEY_FN_F10:
 			/* TAB1 has PICKUP Phone and TAB2 use Snipping tool*/

drivers/hid/hid-multitouch.c+4−1

 		break;
 	}
-	if (suffix)
+	if (suffix) {
 		hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,
 						 "%s %s", hdev->name, suffix);
+		if (!hi->input->name)
+			return -ENOMEM;
+	}
 	return 0;
 }

drivers/hid/hid-quirks.c+1−0

@@ -891,6 +891,7 @@ static const struct hid_device_id hid_ignore_list[] = { · 890 unmodified lines
891	{ HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_DPAD) },	891	{ HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_DPAD) },
892	#endif	892	#endif
893	{ HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) },	893	{ HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) },
		894	{ HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) },
894	{ }	895	{ }
895	};	896	};
896		897

drivers/hid/hid-steam.c+35−11

 	u16 rumble_left;
 	u16 rumble_right;
 	unsigned int sensor_timestamp_us;
+	struct work_struct unregister_work;
 };
 static int steam_recv_report(struct steam_device *steam,
 							struct steam_device, mode_switch);
 	unsigned long flags;
 	bool client_opened;
-	steam->gamepad_mode = !steam->gamepad_mode;
 	if (!lizard_mode)
 		return;
+	steam->gamepad_mode = !steam->gamepad_mode;
 	if (steam->gamepad_mode)
 		steam_set_lizard_mode(steam, false);
 	else {
 	}
 }
+static void steam_work_unregister_cb(struct work_struct *work)
+{
+	struct steam_device *steam = container_of(work, struct steam_device,
+							unregister_work);
+	unsigned long flags;
+	bool connected;
+	bool opened;
+	spin_lock_irqsave(&steam->lock, flags);
+	opened = steam->client_opened;
+	connected = steam->connected;
+	spin_unlock_irqrestore(&steam->lock, flags);
+	if (connected) {
+		if (opened) {
+			steam_sensors_unregister(steam);
+			steam_input_unregister(steam);
+		} else {
+			steam_set_lizard_mode(steam, lizard_mode);
+			steam_input_register(steam);
+			steam_sensors_register(steam);
+		}
+	}
+}
 static bool steam_is_valve_interface(struct hid_device *hdev)
 {
 	struct hid_report_enum *rep_enum;
 	steam->client_opened++;
 	spin_unlock_irqrestore(&steam->lock, flags);
-	steam_sensors_unregister(steam);
+	schedule_work(&steam->unregister_work);
-	steam_input_unregister(steam);
 	return 0;
 }
 	connected = steam->connected && !steam->client_opened;
 	spin_unlock_irqrestore(&steam->lock, flags);
-	if (connected) {
+	schedule_work(&steam->unregister_work);
-		steam_set_lizard_mode(steam, lizard_mode);
-		steam_input_register(steam);
-		steam_sensors_register(steam);
-	}
 }
 static int steam_client_ll_raw_request(struct hid_device *hdev,
 	INIT_LIST_HEAD(&steam->list);
 	INIT_WORK(&steam->rumble_work, steam_haptic_rumble_cb);
 	steam->sensor_timestamp_us = 0;
+	INIT_WORK(&steam->unregister_work, steam_work_unregister_cb);
 	/*
 	 * With the real steam controller interface, do not connect hidraw.
 	cancel_work_sync(&steam->work_connect);
 	cancel_delayed_work_sync(&steam->mode_switch);
 	cancel_work_sync(&steam->rumble_work);
+	cancel_work_sync(&steam->unregister_work);
 	return ret;
 }
 	cancel_delayed_work_sync(&steam->mode_switch);
 	cancel_work_sync(&steam->work_connect);
 	cancel_work_sync(&steam->rumble_work);
+	cancel_work_sync(&steam->unregister_work);
 	hid_destroy_device(steam->client_hdev);
 	steam->client_hdev = NULL;
 	steam->client_opened = 0;
 	if (!(b9 & BIT(6)) && steam->did_mode_switch) {
 		steam->did_mode_switch = false;
-		cancel_delayed_work_sync(&steam->mode_switch);
+		cancel_delayed_work(&steam->mode_switch);
 	} else if (!steam->client_opened && (b9 & BIT(6)) && !steam->did_mode_switch) {
 		steam->did_mode_switch = true;
 		schedule_delayed_work(&steam->mode_switch, 45 * HZ / 100);
 	}
-	if (!steam->gamepad_mode)
+	if (!steam->gamepad_mode && lizard_mode)
 		return;
 	lpad_touched = b10 & BIT(3);
 	 */
 	steam->sensor_timestamp_us += 4000;
-	if (!steam->gamepad_mode)
+	if (!steam->gamepad_mode && lizard_mode)
 		return;
 	input_event(sensors, EV_MSC, MSC_TIMESTAMP, steam->sensor_timestamp_us);

drivers/hid/hid-thrustmaster.c+1−1

@@ -171,7 +171,7 @@ static void thrustmaster_interrupts(struct hid_device *hdev) · 170 unmodified lines
171	b_ep = ep->desc.bEndpointAddress;	171	b_ep = ep->desc.bEndpointAddress;
172		172
173	/* Are the expected endpoints present? */	173	/* Are the expected endpoints present? */
174	u8 ep_addr[1] = {b_ep};	174	u8 ep_addr[2] = {b_ep, 0};
175		175
176	if (!usb_check_int_endpoints(usbif, ep_addr)) {	176	if (!usb_check_int_endpoints(usbif, ep_addr)) {
177	hid_err(hdev, "Unexpected non-int endpoint\n");	177	hid_err(hdev, "Unexpected non-int endpoint\n");

drivers/hid/hid-topre.c+7−0

 		hid_info(hdev,
 			"fixing up Topre REALFORCE keyboard report descriptor\n");
 		rdesc[72] = 0x02;
+	} else if (*rsize >= 106 && rdesc[28] == 0x29 && rdesc[29] == 0xe7 &&
+				    rdesc[30] == 0x81 && rdesc[31] == 0x00) {
+		hid_info(hdev,
+			"fixing up Topre REALFORCE keyboard report descriptor\n");
+		rdesc[31] = 0x02;
 	}
 	return rdesc;
 }
 			 USB_DEVICE_ID_TOPRE_REALFORCE_R2_108) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_TOPRE,
 			 USB_DEVICE_ID_TOPRE_REALFORCE_R2_87) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_TOPRE,
+			 USB_DEVICE_ID_TOPRE_REALFORCE_R3S_87) },
 	{ }
 };
 MODULE_DEVICE_TABLE(hid, topre_id_table);

drivers/hid/hid-winwing.c+2−0

@@ -106,6 +106,8 @@ static int winwing_init_led(struct hid_device *hdev, · 105 unmodified lines
106	"%s::%s",	106	"%s::%s",
107	dev_name(&input->dev),	107	dev_name(&input->dev),
108	info->led_name);	108	info->led_name);
		109	if (!led->cdev.name)
		110	return -ENOMEM;
109		111
110	ret = devm_led_classdev_register(&hdev->dev, &led->cdev);	112	ret = devm_led_classdev_register(&hdev->dev, &led->cdev);
111	if (ret)	113	if (ret)

drivers/hid/i2c-hid/Kconfig+1−1

@@ -2,7 +2,7 @@ · 1 unmodified line
2	menuconfig I2C_HID	2	menuconfig I2C_HID
3	tristate "I2C HID support"	3	tristate "I2C HID support"
4	default y	4	default y
5	depends on I2C && INPUT && HID	5	depends on I2C
6		6
7	if I2C_HID	7	if I2C_HID
8		8

drivers/hid/intel-ish-hid/Kconfig+0−1

@@ -6,7 +6,6 @@ config INTEL_ISH_HID · 5 unmodified lines
6	tristate "Intel Integrated Sensor Hub"	6	tristate "Intel Integrated Sensor Hub"
7	default n	7	default n
8	depends on X86	8	depends on X86
9	depends on HID
10	help	9	help
11	The Integrated Sensor Hub (ISH) enables the ability to offload	10	The Integrated Sensor Hub (ISH) enables the ability to offload
12	sensor polling and algorithm processing to a dedicated low power	11	sensor polling and algorithm processing to a dedicated low power

drivers/hid/intel-ish-hid/ipc/hw-ish.h+2−0

@@ -36,6 +36,8 @@ · 35 unmodified lines
36	#define PCI_DEVICE_ID_INTEL_ISH_ARL_H 0x7745	36	#define PCI_DEVICE_ID_INTEL_ISH_ARL_H 0x7745
37	#define PCI_DEVICE_ID_INTEL_ISH_ARL_S 0x7F78	37	#define PCI_DEVICE_ID_INTEL_ISH_ARL_S 0x7F78
38	#define PCI_DEVICE_ID_INTEL_ISH_LNL_M 0xA845	38	#define PCI_DEVICE_ID_INTEL_ISH_LNL_M 0xA845
		39	#define PCI_DEVICE_ID_INTEL_ISH_PTL_H 0xE345
		40	#define PCI_DEVICE_ID_INTEL_ISH_PTL_P 0xE445
39		41
40	#define REVISION_ID_CHT_A0 0x6	42	#define REVISION_ID_CHT_A0 0x6
41	#define REVISION_ID_CHT_Ax_SI 0x0	43	#define REVISION_ID_CHT_Ax_SI 0x0

drivers/hid/intel-ish-hid/ipc/ipc.c+9−6

 	/* ISH FW is dead */
 	if (!ish_is_input_ready(dev))
 		return	-EPIPE;
+	/* Send clock sync at once after reset */
+	ishtp_dev->prev_sync = 0;
 	/*
 	 * Set HOST2ISH.ILUP. Apparently we need this BEFORE sending
 	 * RESET_NOTIFY_ACK - FW will be checking for it
  */
 static void _ish_sync_fw_clock(struct ishtp_device *dev)
 {
-	static unsigned long	prev_sync;
+	struct ipc_time_update_msg time = {};
-	uint64_t	usec;
-	if (prev_sync && time_before(jiffies, prev_sync + 20 * HZ))
+	if (dev->prev_sync && time_before(jiffies, dev->prev_sync + 20 * HZ))
 		return;
-	prev_sync = jiffies;
+	dev->prev_sync = jiffies;
-	usec = ktime_to_us(ktime_get_boottime());
+	/* The fields of time would be updated while sending message */
-	ipc_send_mng_msg(dev, MNG_SYNC_FW_CLOCK, &usec, sizeof(uint64_t));
+	ipc_send_mng_msg(dev, MNG_SYNC_FW_CLOCK, &time, sizeof(time));
 }
 /**

drivers/hid/intel-ish-hid/ipc/pci-ish.c+7−0

 enum ishtp_driver_data_index {
 	ISHTP_DRIVER_DATA_NONE,
 	ISHTP_DRIVER_DATA_LNL_M,
+	ISHTP_DRIVER_DATA_PTL,
 };
 #define ISH_FW_GEN_LNL_M "lnlm"
+#define ISH_FW_GEN_PTL "ptl"
 #define ISH_FIRMWARE_PATH(gen) "intel/ish/ish_" gen ".bin"
 #define ISH_FIRMWARE_PATH_ALL "intel/ish/ish_*.bin"
 	[ISHTP_DRIVER_DATA_LNL_M] = {
 		.fw_generation = ISH_FW_GEN_LNL_M,
 	},
+	[ISHTP_DRIVER_DATA_PTL] = {
+		.fw_generation = ISH_FW_GEN_PTL,
+	},
 };
 static const struct pci_device_id ish_pci_tbl[] = {
 	{PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ISH_ARL_H)},
 	{PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ISH_ARL_S)},
 	{PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ISH_LNL_M), .driver_data = ISHTP_DRIVER_DATA_LNL_M},
+	{PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ISH_PTL_H), .driver_data = ISHTP_DRIVER_DATA_PTL},
+	{PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ISH_PTL_P), .driver_data = ISHTP_DRIVER_DATA_PTL},
 	{}
 };
 MODULE_DEVICE_TABLE(pci, ish_pci_tbl);

drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h+2−0

@@ -253,6 +253,8 @@ struct ishtp_device { · 252 unmodified lines
253	unsigned int ipc_tx_cnt;	253	unsigned int ipc_tx_cnt;
254	unsigned long long ipc_tx_bytes_cnt;	254	unsigned long long ipc_tx_bytes_cnt;
255		255
		256	/* Time of the last clock sync */
		257	unsigned long prev_sync;
256	const struct ishtp_hw_ops *ops;	258	const struct ishtp_hw_ops *ops;
257	size_t mtu;	259	size_t mtu;
258	uint32_t ishtp_msg_hdr;	260	uint32_t ishtp_msg_hdr;

drivers/hid/intel-thc-hid/Kconfig+0−1

@@ -7,7 +7,6 @@ menu "Intel THC HID Support" · 6 unmodified lines
7	config INTEL_THC_HID	7	config INTEL_THC_HID
8	tristate "Intel Touch Host Controller"	8	tristate "Intel Touch Host Controller"
9	depends on ACPI	9	depends on ACPI
10	select HID
11	help	10	help
12	THC (Touch Host Controller) is the name of the IP block in PCH that	11	THC (Touch Host Controller) is the name of the IP block in PCH that
13	interfaces with Touch Devices (ex: touchscreen, touchpad etc.). It	12	interfaces with Touch Devices (ex: touchscreen, touchpad etc.). It

drivers/hid/surface-hid/Kconfig+0−2

 # SPDX-License-Identifier: GPL-2.0+
 menu "Surface System Aggregator Module HID support"
 	depends on SURFACE_AGGREGATOR
-	depends on INPUT
 config SURFACE_HID
 	tristate "HID transport driver for Surface System Aggregator Module"
 config SURFACE_HID_CORE
 	tristate
-	select HID

drivers/hid/usbhid/Kconfig+1−2

 config USB_HID
 	tristate "USB HID transport layer"
 	default y
-	depends on USB && INPUT
+	depends on HID
-	select HID
 	help
 	  Say Y here if you want to connect USB keyboards,
 	  mice, joysticks, graphic tablets, or any other HID based devices

drivers/i2c/i2c-core-base.c+75−38

@@ -1300,12 +1300,14 @@ new_device_store(struct device dev, struct device_attribute attr, · 1299 unmodified lines
1300	info.flags \|= I2C_CLIENT_SLAVE;	1300	info.flags \|= I2C_CLIENT_SLAVE;
1301	}	1301	}
1302		1302
1303	info.flags \|= I2C_CLIENT_USER;
1304
1305	client = i2c_new_client_device(adap, &info);	1303	client = i2c_new_client_device(adap, &info);
1306	if (IS_ERR(client))	1304	if (IS_ERR(client))
1307	return PTR_ERR(client);	1305	return PTR_ERR(client);
1308		1306
		1307	/* Keep track of the added device */
		1308	mutex_lock(&adap->userspace_clients_lock);
		1309	list_add_tail(&client->detected, &adap->userspace_clients);
		1310	mutex_unlock(&adap->userspace_clients_lock);
1309	dev_info(dev, "%s: Instantiated device %s at 0x%02hx\n", "new_device",	1311	dev_info(dev, "%s: Instantiated device %s at 0x%02hx\n", "new_device",
1310	info.type, info.addr);	1312	info.type, info.addr);
1311		1313
@@ -1313,15 +1315,6 @@ new_device_store(struct device dev, struct device_attribute attr, · 1 unmodified line
1313	}	1315	}
1314	static DEVICE_ATTR_WO(new_device);	1316	static DEVICE_ATTR_WO(new_device);
1315		1317
1316	static int __i2c_find_user_addr(struct device dev, const void addrp)
1317	{
1318	struct i2c_client *client = i2c_verify_client(dev);
1319	unsigned short addr = (unsigned short )addrp;
1320
1321	return client && client->flags & I2C_CLIENT_USER &&
1322	i2c_encode_flags_to_addr(client) == addr;
1323	}
1324
1325	/*	1318	/*
1326	* And of course let the users delete the devices they instantiated, if	1319	* And of course let the users delete the devices they instantiated, if
1327	* they got it wrong. This interface can only be used to delete devices	1320	* they got it wrong. This interface can only be used to delete devices
@@ -1336,7 +1329,7 @@ delete_device_store(struct device dev, struct device_attribute attr, · 8 unmodified lines
1336	const char *buf, size_t count)	1329	const char *buf, size_t count)
1337	{	1330	{
1338	struct i2c_adapter *adap = to_i2c_adapter(dev);	1331	struct i2c_adapter *adap = to_i2c_adapter(dev);
1339	struct device *child_dev;	1332	struct i2c_client client, next;
1340	unsigned short addr;	1333	unsigned short addr;
1341	char end;	1334	char end;
1342	int res;	1335	int res;
@@ -1352,19 +1345,28 @@ delete_device_store(struct device dev, struct device_attribute attr, · 9 unmodified lines
1352	return -EINVAL;	1345	return -EINVAL;
1353	}	1346	}
1354		1347
1355	mutex_lock(&core_lock);
1356	/* Make sure the device was added through sysfs */	1348	/* Make sure the device was added through sysfs */
1357	child_dev = device_find_child(&adap->dev, &addr, __i2c_find_user_addr);	1349	res = -ENOENT;
1358	if (child_dev) {	1350	mutex_lock_nested(&adap->userspace_clients_lock,
1359	i2c_unregister_device(i2c_verify_client(child_dev));	1351	i2c_adapter_depth(adap));
1360	put_device(child_dev);	1352	list_for_each_entry_safe(client, next, &adap->userspace_clients,
1361	} else {	1353	detected) {
1362	dev_err(dev, "Can't find userspace-created device at %#x\n", addr);	1354	if (i2c_encode_flags_to_addr(client) == addr) {
1363	count = -ENOENT;	1355	dev_info(dev, "%s: Deleting device %s at 0x%02hx\n",
		1356	"delete_device", client->name, client->addr);
		1357
		1358	list_del(&client->detected);
		1359	i2c_unregister_device(client);
		1360	res = count;
		1361	break;
		1362	}
1364	}	1363	}
1365	mutex_unlock(&core_lock);	1364	mutex_unlock(&adap->userspace_clients_lock);
1366		1365
1367	return count;	1366	if (res < 0)
		1367	dev_err(dev, "%s: Can't find device in list\n",
		1368	"delete_device");
		1369	return res;
1368	}	1370	}
1369	static DEVICE_ATTR_IGNORE_LOCKDEP(delete_device, S_IWUSR, NULL,	1371	static DEVICE_ATTR_IGNORE_LOCKDEP(delete_device, S_IWUSR, NULL,
1370	delete_device_store);	1372	delete_device_store);
@@ -1535,6 +1537,8 @@ static int i2c_register_adapter(struct i2c_adapter *adap) · 164 unmodified lines
1535	adap->locked_flags = 0;	1537	adap->locked_flags = 0;
1536	rt_mutex_init(&adap->bus_lock);	1538	rt_mutex_init(&adap->bus_lock);
1537	rt_mutex_init(&adap->mux_lock);	1539	rt_mutex_init(&adap->mux_lock);
		1540	mutex_init(&adap->userspace_clients_lock);
		1541	INIT_LIST_HEAD(&adap->userspace_clients);
1538		1542
1539	/* Set default timeout to 1 second if not already set */	1543	/* Set default timeout to 1 second if not already set */
1540	if (adap->timeout == 0)	1544	if (adap->timeout == 0)
@@ -1700,6 +1704,23 @@ int i2c_add_numbered_adapter(struct i2c_adapter *adap) · 159 unmodified lines
1700	}	1704	}
1701	EXPORT_SYMBOL_GPL(i2c_add_numbered_adapter);	1705	EXPORT_SYMBOL_GPL(i2c_add_numbered_adapter);
1702		1706
		1707	static void i2c_do_del_adapter(struct i2c_driver *driver,
		1708	struct i2c_adapter *adapter)
		1709	{
		1710	struct i2c_client client, _n;
		1711
		1712	/* Remove the devices we created ourselves as the result of hardware
		1713	* probing (using a driver's detect method) */
		1714	list_for_each_entry_safe(client, _n, &driver->clients, detected) {
		1715	if (client->adapter == adapter) {
		1716	dev_dbg(&adapter->dev, "Removing %s at 0x%x\n",
		1717	client->name, client->addr);
		1718	list_del(&client->detected);
		1719	i2c_unregister_device(client);
		1720	}
		1721	}
		1722	}
		1723
1703	static int __unregister_client(struct device dev, void dummy)	1724	static int __unregister_client(struct device dev, void dummy)
1704	{	1725	{
1705	struct i2c_client *client = i2c_verify_client(dev);	1726	struct i2c_client *client = i2c_verify_client(dev);
@@ -1715,6 +1736,12 @@ static int __unregister_dummy(struct device dev, void dummy) · 9 unmodified lines
1715	return 0;	1736	return 0;
1716	}	1737	}
1717		1738
		1739	static int __process_removed_adapter(struct device_driver d, void data)
		1740	{
		1741	i2c_do_del_adapter(to_i2c_driver(d), data);
		1742	return 0;
		1743	}
		1744
1718	/**	1745	/**
1719	* i2c_del_adapter - unregister I2C adapter	1746	* i2c_del_adapter - unregister I2C adapter
1720	* @adap: the adapter being unregistered	1747	* @adap: the adapter being unregistered
@@ -1726,6 +1753,7 @@ static int __unregister_dummy(struct device dev, void dummy) · 5 unmodified lines
1726	void i2c_del_adapter(struct i2c_adapter *adap)	1753	void i2c_del_adapter(struct i2c_adapter *adap)
1727	{	1754	{
1728	struct i2c_adapter *found;	1755	struct i2c_adapter *found;
		1756	struct i2c_client client, next;
1729		1757
1730	/* First make sure that this adapter was ever added */	1758	/* First make sure that this adapter was ever added */
1731	mutex_lock(&core_lock);	1759	mutex_lock(&core_lock);
@@ -1737,16 +1765,31 @@ void i2c_del_adapter(struct i2c_adapter *adap) · 5 unmodified lines
1737	}	1765	}
1738		1766
1739	i2c_acpi_remove_space_handler(adap);	1767	i2c_acpi_remove_space_handler(adap);
		1768	/* Tell drivers about this removal */
		1769	mutex_lock(&core_lock);
		1770	bus_for_each_drv(&i2c_bus_type, NULL, adap,
		1771	__process_removed_adapter);
		1772	mutex_unlock(&core_lock);
		1773
		1774	/* Remove devices instantiated from sysfs */
		1775	mutex_lock_nested(&adap->userspace_clients_lock,
		1776	i2c_adapter_depth(adap));
		1777	list_for_each_entry_safe(client, next, &adap->userspace_clients,
		1778	detected) {
		1779	dev_dbg(&adap->dev, "Removing %s at 0x%x\n", client->name,
		1780	client->addr);
		1781	list_del(&client->detected);
		1782	i2c_unregister_device(client);
		1783	}
		1784	mutex_unlock(&adap->userspace_clients_lock);
1740		1785
1741	/* Detach any active clients. This can't fail, thus we do not	1786	/* Detach any active clients. This can't fail, thus we do not
1742	* check the returned value. This is a two-pass process, because	1787	* check the returned value. This is a two-pass process, because
1743	* we can't remove the dummy devices during the first pass: they	1788	* we can't remove the dummy devices during the first pass: they
1744	* could have been instantiated by real devices wishing to clean	1789	* could have been instantiated by real devices wishing to clean
1745	* them up properly, so we give them a chance to do that first. */	1790	* them up properly, so we give them a chance to do that first. */
1746	mutex_lock(&core_lock);
1747	device_for_each_child(&adap->dev, NULL, __unregister_client);	1791	device_for_each_child(&adap->dev, NULL, __unregister_client);
1748	device_for_each_child(&adap->dev, NULL, __unregister_dummy);	1792	device_for_each_child(&adap->dev, NULL, __unregister_dummy);
1749	mutex_unlock(&core_lock);
1750		1793
1751	/* device name is gone after device_unregister */	1794	/* device name is gone after device_unregister */
1752	dev_dbg(&adap->dev, "adapter [%s] unregistered\n", adap->name);	1795	dev_dbg(&adap->dev, "adapter [%s] unregistered\n", adap->name);
@@ -1966,6 +2009,7 @@ int i2c_register_driver(struct module owner, struct i2c_driver driver) · 213 unmodified lines
1966	/* add the driver to the list of i2c drivers in the driver core */	2009	/* add the driver to the list of i2c drivers in the driver core */
1967	driver->driver.owner = owner;	2010	driver->driver.owner = owner;
1968	driver->driver.bus = &i2c_bus_type;	2011	driver->driver.bus = &i2c_bus_type;
		2012	INIT_LIST_HEAD(&driver->clients);
1969		2013
1970	/* When registration returns, the driver core	2014	/* When registration returns, the driver core
1971	* will have called probe() for all matching-but-unbound devices.	2015	* will have called probe() for all matching-but-unbound devices.
@@ -1983,13 +2027,10 @@ int i2c_register_driver(struct module owner, struct i2c_driver driver) · 11 unmodified lines
1983	}	2027	}
1984	EXPORT_SYMBOL(i2c_register_driver);	2028	EXPORT_SYMBOL(i2c_register_driver);
1985		2029
1986	static int __i2c_unregister_detected_client(struct device dev, void argp)	2030	static int __process_removed_driver(struct device dev, void data)
1987	{	2031	{
1988	struct i2c_client *client = i2c_verify_client(dev);	2032	if (dev->type == &i2c_adapter_type)
1989		2033	i2c_do_del_adapter(data, to_i2c_adapter(dev));
1990	if (client && client->flags & I2C_CLIENT_AUTO)
1991	i2c_unregister_device(client);
1992
1993	return 0;	2034	return 0;
1994	}	2035	}
1995		2036
@@ -2000,12 +2041,7 @@ static int __i2c_unregister_detected_client(struct device dev, void argp) · 4 unmodified lines
2000	*/	2041	*/
2001	void i2c_del_driver(struct i2c_driver *driver)	2042	void i2c_del_driver(struct i2c_driver *driver)
2002	{	2043	{
2003	mutex_lock(&core_lock);	2044	i2c_for_each_dev(driver, __process_removed_driver);
2004	/* Satisfy __must_check, function can't fail */
2005	if (driver_for_each_device(&driver->driver, NULL, NULL,
2006	__i2c_unregister_detected_client)) {
2007	}
2008	mutex_unlock(&core_lock);
2009		2045
2010	driver_unregister(&driver->driver);	2046	driver_unregister(&driver->driver);
2011	pr_debug("driver [%s] unregistered\n", driver->driver.name);	2047	pr_debug("driver [%s] unregistered\n", driver->driver.name);
@@ -2432,7 +2468,6 @@ static int i2c_detect_address(struct i2c_client *temp_client, · 420 unmodified lines
2432	/* Finally call the custom detection function */	2468	/* Finally call the custom detection function */
2433	memset(&info, 0, sizeof(struct i2c_board_info));	2469	memset(&info, 0, sizeof(struct i2c_board_info));
2434	info.addr = addr;	2470	info.addr = addr;
2435	info.flags = I2C_CLIENT_AUTO;
2436	err = driver->detect(temp_client, &info);	2471	err = driver->detect(temp_client, &info);
2437	if (err) {	2472	if (err) {
2438	/* -ENODEV is returned if the detection fails. We catch it	2473	/* -ENODEV is returned if the detection fails. We catch it
@@ -2459,7 +2494,9 @@ static int i2c_detect_address(struct i2c_client *temp_client, · 20 unmodified lines
2459	dev_dbg(&adapter->dev, "Creating %s at 0x%02x\n",	2494	dev_dbg(&adapter->dev, "Creating %s at 0x%02x\n",
2460	info.type, info.addr);	2495	info.type, info.addr);
2461	client = i2c_new_client_device(adapter, &info);	2496	client = i2c_new_client_device(adapter, &info);
2462	if (IS_ERR(client))	2497	if (!IS_ERR(client))
		2498	list_add_tail(&client->detected, &driver->clients);
		2499	else
2463	dev_err(&adapter->dev, "Failed creating %s at 0x%02x\n",	2500	dev_err(&adapter->dev, "Failed creating %s at 0x%02x\n",
2464	info.type, info.addr);	2501	info.type, info.addr);
2465	}	2502	}

drivers/iommu/amd/amd_iommu_types.h+1−0

@@ -175,6 +175,7 @@ · 174 unmodified lines
175	#define CONTROL_GAM_EN 25	175	#define CONTROL_GAM_EN 25
176	#define CONTROL_GALOG_EN 28	176	#define CONTROL_GALOG_EN 28
177	#define CONTROL_GAINT_EN 29	177	#define CONTROL_GAINT_EN 29
		178	#define CONTROL_EPH_EN 45
178	#define CONTROL_XT_EN 50	179	#define CONTROL_XT_EN 50
179	#define CONTROL_INTCAPXT_EN 51	180	#define CONTROL_INTCAPXT_EN 51
180	#define CONTROL_IRTCACHEDIS 59	181	#define CONTROL_IRTCACHEDIS 59

drivers/iommu/amd/init.c+34−4

 	/* Set IOTLB invalidation timeout to 1s */
 	iommu_set_inv_tlb_timeout(iommu, CTRL_INV_TO_1S);
+	/* Enable Enhanced Peripheral Page Request Handling */
+	if (check_feature(FEATURE_EPHSUP))
+		iommu_feature_enable(iommu, CONTROL_EPH_EN);
 }
 static void iommu_apply_resume_quirks(struct amd_iommu *iommu)
 	return true;
 }
-static void iommu_snp_enable(void)
+static __init void iommu_snp_enable(void)
 {
 #ifdef CONFIG_KVM_AMD_SEV
 	if (!cc_platform_has(CC_ATTR_HOST_SEV_SNP))
 		goto disable_snp;
 	}
+	/*
+	 * Enable host SNP support once SNP support is checked on IOMMU.
+	 */
+	if (snp_rmptable_init()) {
+		pr_warn("SNP: RMP initialization failed, SNP cannot be supported.\n");
+		goto disable_snp;
+	}
 	pr_info("IOMMU SNP support enabled.\n");
 	return;
 		ret = state_next();
 	}
+	/*
+	 * SNP platform initilazation requires IOMMUs to be fully configured.
+	 * If the SNP support on IOMMUs has NOT been checked, simply mark SNP
+	 * as unsupported. If the SNP support on IOMMUs has been checked and
+	 * host SNP support enabled but RMP enforcement has not been enabled
+	 * in IOMMUs, then the system is in a half-baked state, but can limp
+	 * along as all memory should be Hypervisor-Owned in the RMP. WARN,
+	 * but leave SNP as "supported" to avoid confusing the kernel.
+	 */
+	if (ret && cc_platform_has(CC_ATTR_HOST_SEV_SNP) &&
+	    !WARN_ON_ONCE(amd_iommu_snp_en))
+		cc_platform_clear(CC_ATTR_HOST_SEV_SNP);
 	return ret;
 }
 	int ret;
 	if (no_iommu || (iommu_detected && !gart_iommu_aperture))
-		return;
+		goto disable_snp;
 	if (!amd_iommu_sme_check())
-		return;
+		goto disable_snp;
 	ret = iommu_go_to_state(IOMMU_IVRS_DETECTED);
 	if (ret)
-		return;
+		goto disable_snp;
 	amd_iommu_detected = true;
 	iommu_detected = 1;
 	x86_init.iommu.iommu_init = amd_iommu_init;
+	return;
+disable_snp:
+	if (cc_platform_has(CC_ATTR_HOST_SEV_SNP))
+		cc_platform_clear(CC_ATTR_HOST_SEV_SNP);
 }
 /****************************************************************************

drivers/iommu/exynos-iommu.c+3−3

drivers/iommu/intel/prq.c+3−1

 		struct page_req_dsc *req;
 		req = &iommu->prq[head / sizeof(*req)];
-		if (!req->pasid_present || req->pasid != pasid) {
+		if (req->rid != sid ||
+		    (req->pasid_present && pasid != req->pasid) ||
+		    (!req->pasid_present && pasid != IOMMU_NO_PASID)) {
 			head = (head + sizeof(*req)) & PRQ_RING_MASK;
 			continue;
 		}

drivers/iommu/io-pgfault.c+1−0

@@ -478,6 +478,7 @@ void iopf_queue_remove_device(struct iopf_queue queue, struct device dev) · 477 unmodified lines
478		478
479	ops->page_response(dev, iopf, &resp);	479	ops->page_response(dev, iopf, &resp);
480	list_del_init(&group->pending_node);	480	list_del_init(&group->pending_node);
		481	iopf_free_group(group);
481	}	482	}
482	mutex_unlock(&fault_param->lock);	483	mutex_unlock(&fault_param->lock);
483		484

drivers/iommu/iommu.c+1−1

@@ -1756,7 +1756,7 @@ static int iommu_get_def_domain_type(struct iommu_group *group, · 1755 unmodified lines
1756	group->id);	1756	group->id);
1757		1757
1758	/*	1758	/*
1759	* Try to recover, drivers are allowed to force IDENITY or DMA, IDENTITY	1759	* Try to recover, drivers are allowed to force IDENTITY or DMA, IDENTITY
1760	* takes precedence.	1760	* takes precedence.
1761	*/	1761	*/
1762	if (type == IOMMU_DOMAIN_IDENTITY)	1762	if (type == IOMMU_DOMAIN_IDENTITY)

drivers/irqchip/Kconfig+1−0

@@ -169,6 +169,7 @@ config IXP4XX_IRQ · 168 unmodified lines
169		169
170	config LAN966X_OIC	170	config LAN966X_OIC
171	tristate "Microchip LAN966x OIC Support"	171	tristate "Microchip LAN966x OIC Support"
		172	depends on MCHP_LAN966X_PCI \|\| COMPILE_TEST
172	select GENERIC_IRQ_CHIP	173	select GENERIC_IRQ_CHIP
173	select IRQ_DOMAIN	174	select IRQ_DOMAIN
174	help	175	help

drivers/irqchip/irq-apple-aic.c+2−1

@@ -577,7 +577,8 @@ static void __exception_irq_entry aic_handle_fiq(struct pt_regs *regs) · 576 unmodified lines
577	AIC_FIQ_HWIRQ(AIC_TMR_EL02_VIRT));	577	AIC_FIQ_HWIRQ(AIC_TMR_EL02_VIRT));
578	}	578	}
579		579
580	if (read_sysreg_s(SYS_IMP_APL_PMCR0_EL1) & PMCR0_IACT) {	580	if ((read_sysreg_s(SYS_IMP_APL_PMCR0_EL1) & (PMCR0_IMODE \| PMCR0_IACT)) ==
		581	(FIELD_PREP(PMCR0_IMODE, PMCR0_IMODE_FIQ) \| PMCR0_IACT)) {
581	int irq;	582	int irq;
582	if (cpumask_test_cpu(smp_processor_id(),	583	if (cpumask_test_cpu(smp_processor_id(),
583	&aic_irqc->fiq_aff[AIC_CPU_PMU_P]->aff))	584	&aic_irqc->fiq_aff[AIC_CPU_PMU_P]->aff))

drivers/irqchip/irq-mvebu-icu.c+2−1

@@ -68,7 +68,8 @@ static int mvebu_icu_translate(struct irq_domain d, struct irq_fwspec fwspec, · 67 unmodified lines
68	unsigned long hwirq, unsigned int type)	68	unsigned long hwirq, unsigned int type)
69	{	69	{
70	unsigned int param_count = static_branch_unlikely(&legacy_bindings) ? 3 : 2;	70	unsigned int param_count = static_branch_unlikely(&legacy_bindings) ? 3 : 2;
71	struct mvebu_icu_msi_data *msi_data = d->host_data;	71	struct msi_domain_info *info = d->host_data;
		72	struct mvebu_icu_msi_data *msi_data = info->chip_data;
72	struct mvebu_icu *icu = msi_data->icu;	73	struct mvebu_icu *icu = msi_data->icu;
73		74
74	/* Check the count of the parameters in dt */	75	/* Check the count of the parameters in dt */

drivers/irqchip/irq-partition-percpu.c+1−1

@@ -98,7 +98,7 @@ static void partition_irq_print_chip(struct irq_data d, struct seq_file p) · 97 unmodified lines
98	struct irq_chip *chip = irq_desc_get_chip(part->chained_desc);	98	struct irq_chip *chip = irq_desc_get_chip(part->chained_desc);
99	struct irq_data *data = irq_desc_get_irq_data(part->chained_desc);	99	struct irq_data *data = irq_desc_get_irq_data(part->chained_desc);
100		100
101	seq_printf(p, " %5s-%lu", chip->name, data->hwirq);	101	seq_printf(p, "%5s-%lu", chip->name, data->hwirq);
102	}	102	}
103		103
104	static struct irq_chip partition_irq_chip = {	104	static struct irq_chip partition_irq_chip = {

drivers/irqchip/irq-riscv-imsic-early.c+1−1

@@ -27,7 +27,7 @@ static void imsic_ipi_send(unsigned int cpu) · 26 unmodified lines
27	{	27	{
28	struct imsic_local_config *local = per_cpu_ptr(imsic->global.local, cpu);	28	struct imsic_local_config *local = per_cpu_ptr(imsic->global.local, cpu);
29		29
30	writel_relaxed(IMSIC_IPI_ID, local->msi_va);	30	writel(IMSIC_IPI_ID, local->msi_va);
31	}	31	}
32		32
33	static void imsic_ipi_starting_cpu(void)	33	static void imsic_ipi_starting_cpu(void)

drivers/irqchip/irq-thead-c900-aclint-sswi.c+1−1

@@ -31,7 +31,7 @@ static DEFINE_PER_CPU(void __iomem *, sswi_cpu_regs); · 30 unmodified lines
31		31
32	static void thead_aclint_sswi_ipi_send(unsigned int cpu)	32	static void thead_aclint_sswi_ipi_send(unsigned int cpu)
33	{	33	{
34	writel_relaxed(0x1, per_cpu(sswi_cpu_regs, cpu));	34	writel(0x1, per_cpu(sswi_cpu_regs, cpu));
35	}	35	}
36		36
37	static void thead_aclint_sswi_ipi_clear(void)	37	static void thead_aclint_sswi_ipi_clear(void)

drivers/md/md-linear.c+1−3

 	lim.max_write_zeroes_sectors = mddev->chunk_sectors;
 	lim.io_min = mddev->chunk_sectors << 9;
 	err = mddev_stack_rdev_limits(mddev, &lim, MDDEV_STACK_INTEGRITY);
-	if (err) {
+	if (err)
-		queue_limits_cancel_update(mddev->gendisk->queue);
 		return err;
-	}
 	return queue_limits_set(mddev->gendisk->queue, &lim);
 }

drivers/mfd/syscon.c+26−3

 }
 static struct regmap *device_node_get_regmap(struct device_node *np,
+					     bool create_regmap,
 					     bool check_res)
 {
 	struct syscon *entry, *syscon = NULL;
 		}
 	if (!syscon) {
-		if (of_device_is_compatible(np, "syscon"))
+		if (create_regmap)
 			syscon = of_syscon_register(np, check_res);
 		else
 			syscon = ERR_PTR(-EINVAL);
 }
 EXPORT_SYMBOL_GPL(of_syscon_register_regmap);
+/**
+ * device_node_to_regmap() - Get or create a regmap for specified device node
+ * @np: Device tree node
+ *
+ * Get a regmap for the specified device node. If there's not an existing
+ * regmap, then one is instantiated. This function should not be used if the
+ * device node has a custom regmap driver or has resources (clocks, resets) to
+ * be managed. Use syscon_node_to_regmap() instead for those cases.
+ *
+ * Return: regmap ptr on success, negative error code on failure.
+ */
 struct regmap *device_node_to_regmap(struct device_node *np)
 {
-	return device_node_get_regmap(np, false);
+	return device_node_get_regmap(np, true, false);
 }
 EXPORT_SYMBOL_GPL(device_node_to_regmap);
+/**
+ * syscon_node_to_regmap() - Get or create a regmap for specified syscon device node
+ * @np: Device tree node
+ *
+ * Get a regmap for the specified device node. If there's not an existing
+ * regmap, then one is instantiated if the node is a generic "syscon". This
+ * function is safe to use for a syscon registered with
+ * of_syscon_register_regmap().
+ *
+ * Return: regmap ptr on success, negative error code on failure.
+ */
 struct regmap *syscon_node_to_regmap(struct device_node *np)
 {
-	return device_node_get_regmap(np, true);
+	return device_node_get_regmap(np, of_device_is_compatible(np, "syscon"), true);
 }
 EXPORT_SYMBOL_GPL(syscon_node_to_regmap);

drivers/mmc/host/mtk-sd.c+20−11

 #define MSDC_PAD_TUNE_CMD2_SEL	  BIT(21)   /* RW */
 #define PAD_DS_TUNE_DLY_SEL       BIT(0)	  /* RW */
+#define PAD_DS_TUNE_DLY2_SEL      BIT(1)	  /* RW */
 #define PAD_DS_TUNE_DLY1	  GENMASK(6, 2)   /* RW */
 #define PAD_DS_TUNE_DLY2	  GENMASK(11, 7)  /* RW */
 #define PAD_DS_TUNE_DLY3	  GENMASK(16, 12) /* RW */
 /* EMMC50_PAD_DS_TUNE mask */
 #define PAD_DS_DLY_SEL		BIT(16)	/* RW */
+#define PAD_DS_DLY2_SEL		BIT(15)	/* RW */
 #define PAD_DS_DLY1		GENMASK(14, 10)	/* RW */
 #define PAD_DS_DLY3		GENMASK(4, 0)	/* RW */
 static int msdc_prepare_hs400_tuning(struct mmc_host *mmc, struct mmc_ios *ios)
 {
 	struct msdc_host *host = mmc_priv(mmc);
 	host->hs400_mode = true;
-	if (host->top_base)
+	if (host->top_base) {
-		writel(host->hs400_ds_delay,
+		if (host->hs400_ds_dly3)
-		       host->top_base + EMMC50_PAD_DS_TUNE);
+			sdr_set_field(host->top_base + EMMC50_PAD_DS_TUNE,
-	else
+				      PAD_DS_DLY3, host->hs400_ds_dly3);
-		writel(host->hs400_ds_delay, host->base + PAD_DS_TUNE);
+		if (host->hs400_ds_delay)
+			writel(host->hs400_ds_delay,
+			       host->top_base + EMMC50_PAD_DS_TUNE);
+	} else {
+		if (host->hs400_ds_dly3)
+			sdr_set_field(host->base + PAD_DS_TUNE,
+				      PAD_DS_TUNE_DLY3, host->hs400_ds_dly3);
+		if (host->hs400_ds_delay)
+			writel(host->hs400_ds_delay, host->base + PAD_DS_TUNE);
+	}
 	/* hs400 mode must set it to 0 */
 	sdr_clr_bits(host->base + MSDC_PATCH_BIT2, MSDC_PATCH_BIT2_CFGCRCSTS);
 	/* to improve read performance, set outstanding to 2 */
 	if (host->top_base) {
 		sdr_set_bits(host->top_base + EMMC50_PAD_DS_TUNE,
 			     PAD_DS_DLY_SEL);
-		if (host->hs400_ds_dly3)
+		sdr_clr_bits(host->top_base + EMMC50_PAD_DS_TUNE,
-			sdr_set_field(host->top_base + EMMC50_PAD_DS_TUNE,
+			     PAD_DS_DLY2_SEL);
-				      PAD_DS_DLY3, host->hs400_ds_dly3);
 	} else {
 		sdr_set_bits(host->base + PAD_DS_TUNE, PAD_DS_TUNE_DLY_SEL);
-		if (host->hs400_ds_dly3)
+		sdr_clr_bits(host->base + PAD_DS_TUNE, PAD_DS_TUNE_DLY2_SEL);
-			sdr_set_field(host->base + PAD_DS_TUNE,
-				      PAD_DS_TUNE_DLY3, host->hs400_ds_dly3);
 	}
 	host->hs400_tuning = true;

drivers/mmc/host/sdhci_am654.c+0−30

@@ -155,7 +155,6 @@ struct sdhci_am654_data { · 154 unmodified lines
155	u32 tuning_loop;	155	u32 tuning_loop;
156		156
157	#define SDHCI_AM654_QUIRK_FORCE_CDTEST BIT(0)	157	#define SDHCI_AM654_QUIRK_FORCE_CDTEST BIT(0)
158	#define SDHCI_AM654_QUIRK_SUPPRESS_V1P8_ENA BIT(1)
159	};	158	};
160		159
161	struct window {	160	struct window {
@@ -357,29 +356,6 @@ static void sdhci_j721e_4bit_set_clock(struct sdhci_host *host, · 195 unmodified lines
357	sdhci_set_clock(host, clock);	356	sdhci_set_clock(host, clock);
358	}	357	}
359		358
360	static int sdhci_am654_start_signal_voltage_switch(struct mmc_host mmc, struct mmc_ios ios)
361	{
362	struct sdhci_host *host = mmc_priv(mmc);
363	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
364	struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host);
365	int ret;
366
367	if ((sdhci_am654->quirks & SDHCI_AM654_QUIRK_SUPPRESS_V1P8_ENA) &&
368	ios->signal_voltage == MMC_SIGNAL_VOLTAGE_180) {
369	if (!IS_ERR(mmc->supply.vqmmc)) {
370	ret = mmc_regulator_set_vqmmc(mmc, ios);
371	if (ret < 0) {
372	pr_err("%s: Switching to 1.8V signalling voltage failed,\n",
373	mmc_hostname(mmc));
374	return -EIO;
375	}
376	}
377	return 0;
378	}
379
380	return sdhci_start_signal_voltage_switch(mmc, ios);
381	}
382
383	static u8 sdhci_am654_write_power_on(struct sdhci_host *host, u8 val, int reg)	359	static u8 sdhci_am654_write_power_on(struct sdhci_host *host, u8 val, int reg)
384	{	360	{
385	writeb(val, host->ioaddr + reg);	361	writeb(val, host->ioaddr + reg);
@@ -868,11 +844,6 @@ static int sdhci_am654_get_of_property(struct platform_device *pdev, · 482 unmodified lines
868	if (device_property_read_bool(dev, "ti,fails-without-test-cd"))	844	if (device_property_read_bool(dev, "ti,fails-without-test-cd"))
869	sdhci_am654->quirks \|= SDHCI_AM654_QUIRK_FORCE_CDTEST;	845	sdhci_am654->quirks \|= SDHCI_AM654_QUIRK_FORCE_CDTEST;
870		846
871	/* Suppress v1p8 ena for eMMC and SD with vqmmc supply */
872	if (!!of_parse_phandle(dev->of_node, "vmmc-supply", 0) ==
873	!!of_parse_phandle(dev->of_node, "vqmmc-supply", 0))
874	sdhci_am654->quirks \|= SDHCI_AM654_QUIRK_SUPPRESS_V1P8_ENA;
875
876	sdhci_get_of_property(pdev);	847	sdhci_get_of_property(pdev);
877		848
878	return 0;	849	return 0;
@@ -969,7 +940,6 @@ static int sdhci_am654_probe(struct platform_device *pdev) · 90 unmodified lines
969	goto err_pltfm_free;	940	goto err_pltfm_free;
970	}	941	}
971		942
972	host->mmc_host_ops.start_signal_voltage_switch = sdhci_am654_start_signal_voltage_switch;
973	host->mmc_host_ops.execute_tuning = sdhci_am654_execute_tuning;	943	host->mmc_host_ops.execute_tuning = sdhci_am654_execute_tuning;
974		944
975	pm_runtime_get_noresume(dev);	945	pm_runtime_get_noresume(dev);

drivers/net/can/c_can/c_can_platform.c+3−2

 	if (ret) {
 		dev_err(&pdev->dev, "registering %s failed (err=%d)\n",
 			KBUILD_MODNAME, ret);
-		goto exit_free_device;
+		goto exit_pm_runtime;
 	}
 	dev_info(&pdev->dev, "%s device registered (regs=%p, irq=%d)\n",
 		 KBUILD_MODNAME, priv->base, dev->irq);
 	return 0;
-exit_free_device:
+exit_pm_runtime:
 	pm_runtime_disable(priv->device);
+exit_free_device:
 	free_c_can_dev(dev);
 exit:
 	dev_err(&pdev->dev, "probe failed\n");

drivers/net/can/ctucanfd/ctucanfd_base.c+6−4

 			}
 			break;
 		case CAN_STATE_ERROR_ACTIVE:
-			cf->can_id |= CAN_ERR_CNT;
+			if (skb) {
-			cf->data[1] = CAN_ERR_CRTL_ACTIVE;
+				cf->can_id |= CAN_ERR_CNT;
-			cf->data[6] = bec.txerr;
+				cf->data[1] = CAN_ERR_CRTL_ACTIVE;
-			cf->data[7] = bec.rxerr;
+				cf->data[6] = bec.txerr;
+				cf->data[7] = bec.rxerr;
+			}
 			break;
 		default:
 			netdev_warn(ndev, "unhandled error state (%d:%s)!\n",

drivers/net/can/rockchip/rockchip_canfd-core.c+1−1

@@ -622,7 +622,7 @@ rkcanfd_handle_rx_fifo_overflow_int(struct rkcanfd_priv *priv) · 621 unmodified lines
622	netdev_dbg(priv->ndev, "RX-FIFO overflow\n");	622	netdev_dbg(priv->ndev, "RX-FIFO overflow\n");
623		623
624	skb = rkcanfd_alloc_can_err_skb(priv, &cf, &timestamp);	624	skb = rkcanfd_alloc_can_err_skb(priv, &cf, &timestamp);
625	if (skb)	625	if (!skb)
626	return 0;	626	return 0;
627		627
628	rkcanfd_get_berr_counter_corrected(priv, &bec);	628	rkcanfd_get_berr_counter_corrected(priv, &bec);

drivers/net/can/usb/etas_es58x/es58x_devlink.c+5−1

 			return ret;
 	}
-	return devlink_info_serial_number_put(req, es58x_dev->udev->serial);
+	if (es58x_dev->udev->serial)
+		ret = devlink_info_serial_number_put(req,
+						     es58x_dev->udev->serial);
+	return ret;
 }
 const struct devlink_ops es58x_dl_ops = {

drivers/net/ethernet/aquantia/atlantic/aq_nic.c+3−1

 	aq_ptp_ring_free(self);
 	aq_ptp_free(self);
-	if (likely(self->aq_fw_ops->deinit) && link_down) {
+	/* May be invoked during hot unplug. */
+	if (pci_device_is_present(self->pdev) &&
+	    likely(self->aq_fw_ops->deinit) && link_down) {
 		mutex_lock(&self->fwreq_mutex);
 		self->aq_fw_ops->deinit(self->aq_hw);
 		mutex_unlock(&self->fwreq_mutex);

drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c+12−4

 {
 	struct bcmgenet_priv *priv = netdev_priv(dev);
 	struct device *kdev = &priv->pdev->dev;
+	u32 phy_wolopts = 0;
-	if (dev->phydev)
+	if (dev->phydev) {
 		phy_ethtool_get_wol(dev->phydev, wol);
+		phy_wolopts = wol->wolopts;
+	}
 	/* MAC is not wake-up capable, return what the PHY does */
 	if (!device_can_wakeup(kdev))
 	/* Overlay MAC capabilities with that of the PHY queried before */
 	wol->supported |= WAKE_MAGIC | WAKE_MAGICSECURE | WAKE_FILTER;
-	wol->wolopts = priv->wolopts;
+	wol->wolopts |= priv->wolopts;
-	memset(wol->sopass, 0, sizeof(wol->sopass));
+	/* Return the PHY configured magic password */
+	if (phy_wolopts & WAKE_MAGICSECURE)
+		return;
+	/* Otherwise the MAC one */
+	memset(wol->sopass, 0, sizeof(wol->sopass));
 	if (wol->wolopts & WAKE_MAGICSECURE)
 		memcpy(wol->sopass, priv->sopass, sizeof(priv->sopass));
 }
 	/* Try Wake-on-LAN from the PHY first */
 	if (dev->phydev) {
 		ret = phy_ethtool_set_wol(dev->phydev, wol);
-		if (ret != -EOPNOTSUPP)
+		if (ret != -EOPNOTSUPP && wol->wolopts)
 			return ret;
 	}

drivers/net/ethernet/broadcom/tg3.c+58−0

@@ -55,6 +55,7 @@ · 54 unmodified lines
55	#include <linux/hwmon.h>	55	#include <linux/hwmon.h>
56	#include <linux/hwmon-sysfs.h>	56	#include <linux/hwmon-sysfs.h>
57	#include <linux/crc32poly.h>	57	#include <linux/crc32poly.h>
		58	#include <linux/dmi.h>
58		59
59	#include <net/checksum.h>	60	#include <net/checksum.h>
60	#include <net/gso.h>	61	#include <net/gso.h>
@@ -18212,6 +18213,50 @@ unlock: · 18151 unmodified lines
18212		18213
18213	static SIMPLE_DEV_PM_OPS(tg3_pm_ops, tg3_suspend, tg3_resume);	18214	static SIMPLE_DEV_PM_OPS(tg3_pm_ops, tg3_suspend, tg3_resume);
18214		18215
		18216	/* Systems where ACPI _PTS (Prepare To Sleep) S5 will result in a fatal
		18217	* PCIe AER event on the tg3 device if the tg3 device is not, or cannot
		18218	* be, powered down.
		18219	*/
		18220	static const struct dmi_system_id tg3_restart_aer_quirk_table[] = {
		18221	{
		18222	.matches = {
		18223	DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
		18224	DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R440"),
		18225	},
		18226	},
		18227	{
		18228	.matches = {
		18229	DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
		18230	DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R540"),
		18231	},
		18232	},
		18233	{
		18234	.matches = {
		18235	DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
		18236	DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R640"),
		18237	},
		18238	},
		18239	{
		18240	.matches = {
		18241	DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
		18242	DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R650"),
		18243	},
		18244	},
		18245	{
		18246	.matches = {
		18247	DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
		18248	DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R740"),
		18249	},
		18250	},
		18251	{
		18252	.matches = {
		18253	DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
		18254	DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R750"),
		18255	},
		18256	},
		18257	{}
		18258	};
		18259
18215	static void tg3_shutdown(struct pci_dev *pdev)	18260	static void tg3_shutdown(struct pci_dev *pdev)
18216	{	18261	{
18217	struct net_device *dev = pci_get_drvdata(pdev);	18262	struct net_device *dev = pci_get_drvdata(pdev);
@@ -18228,6 +18273,19 @@ static void tg3_shutdown(struct pci_dev *pdev) · 10 unmodified lines
18228		18273
18229	if (system_state == SYSTEM_POWER_OFF)	18274	if (system_state == SYSTEM_POWER_OFF)
18230	tg3_power_down(tp);	18275	tg3_power_down(tp);
		18276	else if (system_state == SYSTEM_RESTART &&
		18277	dmi_first_match(tg3_restart_aer_quirk_table) &&
		18278	pdev->current_state != PCI_D3cold &&
		18279	pdev->current_state != PCI_UNKNOWN) {
		18280	/* Disable PCIe AER on the tg3 to avoid a fatal
		18281	* error during this system restart.
		18282	*/
		18283	pcie_capability_clear_word(pdev, PCI_EXP_DEVCTL,
		18284	PCI_EXP_DEVCTL_CERE \|
		18285	PCI_EXP_DEVCTL_NFERE \|
		18286	PCI_EXP_DEVCTL_FERE \|
		18287	PCI_EXP_DEVCTL_URRE);
		18288	}
18231		18289
18232	rtnl_unlock();	18290	rtnl_unlock();
18233		18291

drivers/net/ethernet/google/gve/gve.h+10−0

@@ -1116,6 +1116,16 @@ static inline u32 gve_xdp_tx_start_queue_id(struct gve_priv *priv) · 1115 unmodified lines
1116	return gve_xdp_tx_queue_id(priv, 0);	1116	return gve_xdp_tx_queue_id(priv, 0);
1117	}	1117	}
1118		1118
		1119	static inline bool gve_supports_xdp_xmit(struct gve_priv *priv)
		1120	{
		1121	switch (priv->queue_format) {
		1122	case GVE_GQI_QPL_FORMAT:
		1123	return true;
		1124	default:
		1125	return false;
		1126	}
		1127	}
		1128
1119	/* gqi napi handler defined in gve_main.c */	1129	/* gqi napi handler defined in gve_main.c */
1120	int gve_napi_poll(struct napi_struct *napi, int budget);	1130	int gve_napi_poll(struct napi_struct *napi, int budget);
1121		1131

drivers/net/ethernet/google/gve/gve_main.c+5−1

 	/* Stop tx queues */
 	netif_tx_disable(priv->dev);
+	xdp_features_clear_redirect_target(priv->dev);
 	gve_clear_napi_enabled(priv);
 	gve_clear_report_stats(priv);
 		napi_schedule(&block->napi);
 	}
+	if (priv->num_xdp_queues && gve_supports_xdp_xmit(priv))
+		xdp_features_set_redirect_target(priv->dev, false);
 	gve_set_napi_enabled(priv);
 }
 	if (priv->queue_format == GVE_GQI_QPL_FORMAT) {
 		xdp_features = NETDEV_XDP_ACT_BASIC;
 		xdp_features |= NETDEV_XDP_ACT_REDIRECT;
-		xdp_features |= NETDEV_XDP_ACT_NDO_XMIT;
 		xdp_features |= NETDEV_XDP_ACT_XSK_ZEROCOPY;
 	} else {
 		xdp_features = 0;

drivers/net/ethernet/ibm/ibmvnic.c+3−1

 	dma_addr_t data_dma_addr;
 	struct netdev_queue *txq;
 	unsigned long lpar_rc;
+	unsigned int skblen;
 	union sub_crq tx_crq;
 	unsigned int offset;
 	bool use_scrq_send_direct = false;
 	tx_buff->skb = skb;
 	tx_buff->index = bufidx;
 	tx_buff->pool_index = queue_num;
+	skblen = skb->len;
 	memset(&tx_crq, 0, sizeof(tx_crq));
 	tx_crq.v1.first = IBMVNIC_CRQ_CMD;
 		netif_stop_subqueue(netdev, queue_num);
 	}
-	tx_bytes += skb->len;
+	tx_bytes += skblen;
 	txq_trans_cond_update(txq);
 	ret = NETDEV_TX_OK;
 	goto out;

drivers/net/ethernet/intel/iavf/iavf_main.c+1−1

 	}
 	mutex_unlock(&adapter->crit_lock);
-	netdev_unlock(netdev);
 restart_watchdog:
+	netdev_unlock(netdev);
 	if (adapter->state >= __IAVF_DOWN)
 		queue_work(adapter->wq, &adapter->adminq_task);
 	if (adapter->aq_required)

drivers/net/ethernet/intel/ice/devlink/devlink.c+3−0

@@ -981,6 +981,9 @@ static int ice_devlink_rate_node_new(struct devlink_rate rate_node, void *priv · 980 unmodified lines
981		981
982	/* preallocate memory for ice_sched_node */	982	/* preallocate memory for ice_sched_node */
983	node = devm_kzalloc(ice_hw_to_dev(pi->hw), sizeof(*node), GFP_KERNEL);	983	node = devm_kzalloc(ice_hw_to_dev(pi->hw), sizeof(*node), GFP_KERNEL);
		984	if (!node)
		985	return -ENOMEM;
		986
984	*priv = node;	987	*priv = node;
985		988
986	return 0;	989	return 0;

drivers/net/ethernet/intel/ice/ice_txrx.c+103−47

@@ -527,15 +527,14 @@ err: · 526 unmodified lines
527	* @xdp: xdp_buff used as input to the XDP program	527	* @xdp: xdp_buff used as input to the XDP program
528	* @xdp_prog: XDP program to run	528	* @xdp_prog: XDP program to run
529	* @xdp_ring: ring to be used for XDP_TX action	529	* @xdp_ring: ring to be used for XDP_TX action
530	* @rx_buf: Rx buffer to store the XDP action
531	* @eop_desc: Last descriptor in packet to read metadata from	530	* @eop_desc: Last descriptor in packet to read metadata from
532	*	531	*
533	* Returns any of ICE_XDP_{PASS, CONSUMED, TX, REDIR}	532	* Returns any of ICE_XDP_{PASS, CONSUMED, TX, REDIR}
534	*/	533	*/
535	static void	534	static u32
536	ice_run_xdp(struct ice_rx_ring rx_ring, struct xdp_buff xdp,	535	ice_run_xdp(struct ice_rx_ring rx_ring, struct xdp_buff xdp,
537	struct bpf_prog xdp_prog, struct ice_tx_ring xdp_ring,	536	struct bpf_prog xdp_prog, struct ice_tx_ring xdp_ring,
538	struct ice_rx_buf rx_buf, union ice_32b_rx_flex_desc eop_desc)	537	union ice_32b_rx_flex_desc *eop_desc)
539	{	538	{
540	unsigned int ret = ICE_XDP_PASS;	539	unsigned int ret = ICE_XDP_PASS;
541	u32 act;	540	u32 act;
@@ -574,7 +573,7 @@ out_failure: · 32 unmodified lines
574	ret = ICE_XDP_CONSUMED;	573	ret = ICE_XDP_CONSUMED;
575	}	574	}
576	exit:	575	exit:
577	ice_set_rx_bufs_act(xdp, rx_ring, ret);	576	return ret;
578	}	577	}
579		578
580	/**	579	/**
@@ -860,10 +859,8 @@ ice_add_xdp_frag(struct ice_rx_ring rx_ring, struct xdp_buff xdp, · 279 unmodified lines
860	xdp_buff_set_frags_flag(xdp);	859	xdp_buff_set_frags_flag(xdp);
861	}	860	}
862		861
863	if (unlikely(sinfo->nr_frags == MAX_SKB_FRAGS)) {	862	if (unlikely(sinfo->nr_frags == MAX_SKB_FRAGS))
864	ice_set_rx_bufs_act(xdp, rx_ring, ICE_XDP_CONSUMED);
865	return -ENOMEM;	863	return -ENOMEM;
866	}
867		864
868	__skb_fill_page_desc_noacc(sinfo, sinfo->nr_frags++, rx_buf->page,	865	__skb_fill_page_desc_noacc(sinfo, sinfo->nr_frags++, rx_buf->page,
869	rx_buf->page_offset, size);	866	rx_buf->page_offset, size);
@@ -924,7 +921,6 @@ ice_get_rx_buf(struct ice_rx_ring *rx_ring, const unsigned int size, · 54 unmodified lines
924	struct ice_rx_buf *rx_buf;	921	struct ice_rx_buf *rx_buf;
925		922
926	rx_buf = &rx_ring->rx_buf[ntc];	923	rx_buf = &rx_ring->rx_buf[ntc];
927	rx_buf->pgcnt = page_count(rx_buf->page);
928	prefetchw(rx_buf->page);	924	prefetchw(rx_buf->page);
929		925
930	if (!size)	926	if (!size)
@@ -940,6 +936,31 @@ ice_get_rx_buf(struct ice_rx_ring *rx_ring, const unsigned int size, · 9 unmodified lines
940	return rx_buf;	936	return rx_buf;
941	}	937	}
942		938
		939	/**
		940	* ice_get_pgcnts - grab page_count() for gathered fragments
		941	* @rx_ring: Rx descriptor ring to store the page counts on
		942	*
		943	* This function is intended to be called right before running XDP
		944	* program so that the page recycling mechanism will be able to take
		945	* a correct decision regarding underlying pages; this is done in such
		946	* way as XDP program can change the refcount of page
		947	*/
		948	static void ice_get_pgcnts(struct ice_rx_ring *rx_ring)
		949	{
		950	u32 nr_frags = rx_ring->nr_frags + 1;
		951	u32 idx = rx_ring->first_desc;
		952	struct ice_rx_buf *rx_buf;
		953	u32 cnt = rx_ring->count;
		954
		955	for (int i = 0; i < nr_frags; i++) {
		956	rx_buf = &rx_ring->rx_buf[idx];
		957	rx_buf->pgcnt = page_count(rx_buf->page);
		958
		959	if (++idx == cnt)
		960	idx = 0;
		961	}
		962	}
		963
943	/**	964	/**
944	* ice_build_skb - Build skb around an existing buffer	965	* ice_build_skb - Build skb around an existing buffer
945	* @rx_ring: Rx descriptor ring to transact packets on	966	* @rx_ring: Rx descriptor ring to transact packets on
@@ -1051,12 +1072,12 @@ ice_construct_skb(struct ice_rx_ring rx_ring, struct xdp_buff xdp) · 105 unmodified lines
1051	rx_buf->page_offset + headlen, size,	1072	rx_buf->page_offset + headlen, size,
1052	xdp->frame_sz);	1073	xdp->frame_sz);
1053	} else {	1074	} else {
1054	/* buffer is unused, change the act that should be taken later	1075	/* buffer is unused, restore biased page count in Rx buffer;
1055	* on; data was copied onto skb's linear part so there's no	1076	* data was copied onto skb's linear part so there's no
1056	* need for adjusting page offset and we can reuse this buffer	1077	* need for adjusting page offset and we can reuse this buffer
1057	* as-is	1078	* as-is
1058	*/	1079	*/
1059	rx_buf->act = ICE_SKB_CONSUMED;	1080	rx_buf->pagecnt_bias++;
1060	}	1081	}
1061		1082
1062	if (unlikely(xdp_buff_has_frags(xdp))) {	1083	if (unlikely(xdp_buff_has_frags(xdp))) {
@@ -1103,6 +1124,65 @@ ice_put_rx_buf(struct ice_rx_ring rx_ring, struct ice_rx_buf rx_buf) · 40 unmodified lines
1103	rx_buf->page = NULL;	1124	rx_buf->page = NULL;
1104	}	1125	}
1105		1126
		1127	/**
		1128	* ice_put_rx_mbuf - ice_put_rx_buf() caller, for all frame frags
		1129	* @rx_ring: Rx ring with all the auxiliary data
		1130	* @xdp: XDP buffer carrying linear + frags part
		1131	* @xdp_xmit: XDP_TX/XDP_REDIRECT verdict storage
		1132	* @ntc: a current next_to_clean value to be stored at rx_ring
		1133	* @verdict: return code from XDP program execution
		1134	*
		1135	* Walk through gathered fragments and satisfy internal page
		1136	* recycle mechanism; we take here an action related to verdict
		1137	* returned by XDP program;
		1138	*/
		1139	static void ice_put_rx_mbuf(struct ice_rx_ring rx_ring, struct xdp_buff xdp,
		1140	u32 *xdp_xmit, u32 ntc, u32 verdict)
		1141	{
		1142	u32 nr_frags = rx_ring->nr_frags + 1;
		1143	u32 idx = rx_ring->first_desc;
		1144	u32 cnt = rx_ring->count;
		1145	u32 post_xdp_frags = 1;
		1146	struct ice_rx_buf *buf;
		1147	int i;
		1148
		1149	if (unlikely(xdp_buff_has_frags(xdp)))
		1150	post_xdp_frags += xdp_get_shared_info_from_buff(xdp)->nr_frags;
		1151
		1152	for (i = 0; i < post_xdp_frags; i++) {
		1153	buf = &rx_ring->rx_buf[idx];
		1154
		1155	if (verdict & (ICE_XDP_TX \| ICE_XDP_REDIR)) {
		1156	ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz);
		1157	*xdp_xmit \|= verdict;
		1158	} else if (verdict & ICE_XDP_CONSUMED) {
		1159	buf->pagecnt_bias++;
		1160	} else if (verdict == ICE_XDP_PASS) {
		1161	ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz);
		1162	}
		1163
		1164	ice_put_rx_buf(rx_ring, buf);
		1165
		1166	if (++idx == cnt)
		1167	idx = 0;
		1168	}
		1169	/* handle buffers that represented frags released by XDP prog;
		1170	* for these we keep pagecnt_bias as-is; refcount from struct page
		1171	* has been decremented within XDP prog and we do not have to increase
		1172	* the biased refcnt
		1173	*/
		1174	for (; i < nr_frags; i++) {
		1175	buf = &rx_ring->rx_buf[idx];
		1176	ice_put_rx_buf(rx_ring, buf);
		1177	if (++idx == cnt)
		1178	idx = 0;
		1179	}
		1180
		1181	xdp->data = NULL;
		1182	rx_ring->first_desc = ntc;
		1183	rx_ring->nr_frags = 0;
		1184	}
		1185
1106	/**	1186	/**
1107	* ice_clean_rx_irq - Clean completed descriptors from Rx ring - bounce buf	1187	* ice_clean_rx_irq - Clean completed descriptors from Rx ring - bounce buf
1108	* @rx_ring: Rx descriptor ring to transact packets on	1188	* @rx_ring: Rx descriptor ring to transact packets on
@@ -1120,15 +1200,13 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget) · 11 unmodified lines
1120	unsigned int total_rx_bytes = 0, total_rx_pkts = 0;	1200	unsigned int total_rx_bytes = 0, total_rx_pkts = 0;
1121	unsigned int offset = rx_ring->rx_offset;	1201	unsigned int offset = rx_ring->rx_offset;
1122	struct xdp_buff *xdp = &rx_ring->xdp;	1202	struct xdp_buff *xdp = &rx_ring->xdp;
1123	u32 cached_ntc = rx_ring->first_desc;
1124	struct ice_tx_ring *xdp_ring = NULL;	1203	struct ice_tx_ring *xdp_ring = NULL;
1125	struct bpf_prog *xdp_prog = NULL;	1204	struct bpf_prog *xdp_prog = NULL;
1126	u32 ntc = rx_ring->next_to_clean;	1205	u32 ntc = rx_ring->next_to_clean;
		1206	u32 cached_ntu, xdp_verdict;
1127	u32 cnt = rx_ring->count;	1207	u32 cnt = rx_ring->count;
1128	u32 xdp_xmit = 0;	1208	u32 xdp_xmit = 0;
1129	u32 cached_ntu;
1130	bool failure;	1209	bool failure;
1131	u32 first;
1132		1210
1133	xdp_prog = READ_ONCE(rx_ring->xdp_prog);	1211	xdp_prog = READ_ONCE(rx_ring->xdp_prog);
1134	if (xdp_prog) {	1212	if (xdp_prog) {
@@ -1190,6 +1268,7 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget) · 55 unmodified lines
1190	xdp_prepare_buff(xdp, hard_start, offset, size, !!offset);	1268	xdp_prepare_buff(xdp, hard_start, offset, size, !!offset);
1191	xdp_buff_clear_frags_flag(xdp);	1269	xdp_buff_clear_frags_flag(xdp);
1192	} else if (ice_add_xdp_frag(rx_ring, xdp, rx_buf, size)) {	1270	} else if (ice_add_xdp_frag(rx_ring, xdp, rx_buf, size)) {
		1271	ice_put_rx_mbuf(rx_ring, xdp, NULL, ntc, ICE_XDP_CONSUMED);
1193	break;	1272	break;
1194	}	1273	}
1195	if (++ntc == cnt)	1274	if (++ntc == cnt)
@@ -1199,15 +1278,15 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget) · 3 unmodified lines
1199	if (ice_is_non_eop(rx_ring, rx_desc))	1278	if (ice_is_non_eop(rx_ring, rx_desc))
1200	continue;	1279	continue;
1201		1280
1202	ice_run_xdp(rx_ring, xdp, xdp_prog, xdp_ring, rx_buf, rx_desc);	1281	ice_get_pgcnts(rx_ring);
1203	if (rx_buf->act == ICE_XDP_PASS)	1282	xdp_verdict = ice_run_xdp(rx_ring, xdp, xdp_prog, xdp_ring, rx_desc);
		1283	if (xdp_verdict == ICE_XDP_PASS)
1204	goto construct_skb;	1284	goto construct_skb;
1205	total_rx_bytes += xdp_get_buff_len(xdp);	1285	total_rx_bytes += xdp_get_buff_len(xdp);
1206	total_rx_pkts++;	1286	total_rx_pkts++;
1207		1287
1208	xdp->data = NULL;	1288	ice_put_rx_mbuf(rx_ring, xdp, &xdp_xmit, ntc, xdp_verdict);
1209	rx_ring->first_desc = ntc;	1289
1210	rx_ring->nr_frags = 0;
1211	continue;	1290	continue;
1212	construct_skb:	1291	construct_skb:
1213	if (likely(ice_ring_uses_build_skb(rx_ring)))	1292	if (likely(ice_ring_uses_build_skb(rx_ring)))
@@ -1217,18 +1296,12 @@ construct_skb: · 3 unmodified lines
1217	/* exit if we failed to retrieve a buffer */	1296	/* exit if we failed to retrieve a buffer */
1218	if (!skb) {	1297	if (!skb) {
1219	rx_ring->ring_stats->rx_stats.alloc_page_failed++;	1298	rx_ring->ring_stats->rx_stats.alloc_page_failed++;
1220	rx_buf->act = ICE_XDP_CONSUMED;	1299	xdp_verdict = ICE_XDP_CONSUMED;
1221	if (unlikely(xdp_buff_has_frags(xdp)))
1222	ice_set_rx_bufs_act(xdp, rx_ring,
1223	ICE_XDP_CONSUMED);
1224	xdp->data = NULL;
1225	rx_ring->first_desc = ntc;
1226	rx_ring->nr_frags = 0;
1227	break;
1228	}	1300	}
1229	xdp->data = NULL;	1301	ice_put_rx_mbuf(rx_ring, xdp, &xdp_xmit, ntc, xdp_verdict);
1230	rx_ring->first_desc = ntc;	1302
1231	rx_ring->nr_frags = 0;	1303	if (!skb)
		1304	break;
1232		1305
1233	stat_err_bits = BIT(ICE_RX_FLEX_DESC_STATUS0_RXE_S);	1306	stat_err_bits = BIT(ICE_RX_FLEX_DESC_STATUS0_RXE_S);
1234	if (unlikely(ice_test_staterr(rx_desc->wb.status_error0,	1307	if (unlikely(ice_test_staterr(rx_desc->wb.status_error0,
@@ -1257,23 +1330,6 @@ construct_skb: · 22 unmodified lines
1257	total_rx_pkts++;	1330	total_rx_pkts++;
1258	}	1331	}
1259		1332
1260	first = rx_ring->first_desc;
1261	while (cached_ntc != first) {
1262	struct ice_rx_buf *buf = &rx_ring->rx_buf[cached_ntc];
1263
1264	if (buf->act & (ICE_XDP_TX \| ICE_XDP_REDIR)) {
1265	ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz);
1266	xdp_xmit \|= buf->act;
1267	} else if (buf->act & ICE_XDP_CONSUMED) {
1268	buf->pagecnt_bias++;
1269	} else if (buf->act == ICE_XDP_PASS) {
1270	ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz);
1271	}
1272
1273	ice_put_rx_buf(rx_ring, buf);
1274	if (++cached_ntc >= cnt)
1275	cached_ntc = 0;
1276	}
1277	rx_ring->next_to_clean = ntc;	1333	rx_ring->next_to_clean = ntc;
1278	/* return up to cleaned_count buffers to hardware */	1334	/* return up to cleaned_count buffers to hardware */
1279	failure = ice_alloc_rx_bufs(rx_ring, ICE_RX_DESC_UNUSED(rx_ring));	1335	failure = ice_alloc_rx_bufs(rx_ring, ICE_RX_DESC_UNUSED(rx_ring));

drivers/net/ethernet/intel/ice/ice_txrx.h+0−1

@@ -201,7 +201,6 @@ struct ice_rx_buf { · 200 unmodified lines
201	struct page *page;	201	struct page *page;
202	unsigned int page_offset;	202	unsigned int page_offset;
203	unsigned int pgcnt;	203	unsigned int pgcnt;
204	unsigned int act;
205	unsigned int pagecnt_bias;	204	unsigned int pagecnt_bias;
206	};	205	};
207		206

drivers/net/ethernet/intel/ice/ice_txrx_lib.h+0−43

@@ -5,49 +5,6 @@ · 4 unmodified lines
5	#define _ICE_TXRX_LIB_H_	5	#define _ICE_TXRX_LIB_H_
6	#include "ice.h"	6	#include "ice.h"
7		7
8	/**
9	* ice_set_rx_bufs_act - propagate Rx buffer action to frags
10	* @xdp: XDP buffer representing frame (linear and frags part)
11	* @rx_ring: Rx ring struct
12	* act: action to store onto Rx buffers related to XDP buffer parts
13	*
14	* Set action that should be taken before putting Rx buffer from first frag
15	* to the last.
16	*/
17	static inline void
18	ice_set_rx_bufs_act(struct xdp_buff xdp, const struct ice_rx_ring rx_ring,
19	const unsigned int act)
20	{
21	u32 sinfo_frags = xdp_get_shared_info_from_buff(xdp)->nr_frags;
22	u32 nr_frags = rx_ring->nr_frags + 1;
23	u32 idx = rx_ring->first_desc;
24	u32 cnt = rx_ring->count;
25	struct ice_rx_buf *buf;
26
27	for (int i = 0; i < nr_frags; i++) {
28	buf = &rx_ring->rx_buf[idx];
29	buf->act = act;
30
31	if (++idx == cnt)
32	idx = 0;
33	}
34
35	/* adjust pagecnt_bias on frags freed by XDP prog */
36	if (sinfo_frags < rx_ring->nr_frags && act == ICE_XDP_CONSUMED) {
37	u32 delta = rx_ring->nr_frags - sinfo_frags;
38
39	while (delta) {
40	if (idx == 0)
41	idx = cnt - 1;
42	else
43	idx--;
44	buf = &rx_ring->rx_buf[idx];
45	buf->pagecnt_bias--;
46	delta--;
47	}
48	}
49	}
50
51	/**	8	/**
52	* ice_test_staterr - tests bits in Rx descriptor status and error fields	9	* ice_test_staterr - tests bits in Rx descriptor status and error fields
53	* @status_err_n: Rx descriptor status_error0 or status_error1 bits	10	* @status_err_n: Rx descriptor status_error0 or status_error1 bits

drivers/net/ethernet/intel/idpf/idpf_lib.c+5−0

 	idpf_vport_ctrl_lock(netdev);
 	vport = idpf_netdev_to_vport(netdev);
+	err = idpf_set_real_num_queues(vport);
+	if (err)
+		goto unlock;
 	err = idpf_vport_open(vport);
+unlock:
 	idpf_vport_ctrl_unlock(netdev);
 	return err;

drivers/net/ethernet/intel/idpf/idpf_txrx.c+1−4

 		return -EINVAL;
 	rsc_segments = DIV_ROUND_UP(skb->data_len, rsc_seg_len);
-	if (unlikely(rsc_segments == 1))
-		return 0;
 	NAPI_GRO_CB(skb)->count = rsc_segments;
 	skb_shinfo(skb)->gso_size = rsc_seg_len;
 	idpf_rx_hash(rxq, skb, rx_desc, decoded);
 	skb->protocol = eth_type_trans(skb, rxq->netdev);
+	skb_record_rx_queue(skb, rxq->idx);
 	if (le16_get_bits(rx_desc->hdrlen_flags,
 			  VIRTCHNL2_RX_FLEX_DESC_ADV_RSC_M))
 	csum_bits = idpf_rx_splitq_extract_csum_bits(rx_desc);
 	idpf_rx_csum(rxq, skb, csum_bits, decoded);
-	skb_record_rx_queue(skb, rxq->idx);
 	return 0;
 }

drivers/net/ethernet/intel/igc/igc_main.c+13−9

 		return -ENOMEM;
 	}
+	buffer->type = IGC_TX_BUFFER_TYPE_SKB;
 	buffer->skb = skb;
 	buffer->protocol = 0;
 	buffer->bytecount = skb->len;
 }
 static struct sk_buff *igc_construct_skb_zc(struct igc_ring *ring,
-					    struct xdp_buff *xdp)
+					    struct igc_xdp_buff *ctx)
 {
+	struct xdp_buff *xdp = &ctx->xdp;
 	unsigned int totalsize = xdp->data_end - xdp->data_meta;
 	unsigned int metasize = xdp->data - xdp->data_meta;
 	struct sk_buff *skb;
 		__skb_pull(skb, metasize);
 	}
+	if (ctx->rx_ts) {
+		skb_shinfo(skb)->tx_flags |= SKBTX_HW_TSTAMP_NETDEV;
+		skb_hwtstamps(skb)->netdev_data = ctx->rx_ts;
+	}
 	return skb;
 }
 static void igc_dispatch_skb_zc(struct igc_q_vector *q_vector,
 				union igc_adv_rx_desc *desc,
-				struct xdp_buff *xdp,
+				struct igc_xdp_buff *ctx)
-				ktime_t timestamp)
 {
 	struct igc_ring *ring = q_vector->rx.ring;
 	struct sk_buff *skb;
-	skb = igc_construct_skb_zc(ring, xdp);
+	skb = igc_construct_skb_zc(ring, ctx);
 	if (!skb) {
 		ring->rx_stats.alloc_failed++;
 		set_bit(IGC_RING_FLAG_RX_ALLOC_FAILED, &ring->flags);
 		return;
 	}
-	if (timestamp)
-		skb_hwtstamps(skb)->hwtstamp = timestamp;
 	if (igc_cleanup_headers(ring, desc, skb))
 		return;
 		union igc_adv_rx_desc *desc;
 		struct igc_rx_buffer *bi;
 		struct igc_xdp_buff *ctx;
-		ktime_t timestamp = 0;
 		unsigned int size;
 		int res;
 			 */
 			bi->xdp->data_meta += IGC_TS_HDR_LEN;
 			size -= IGC_TS_HDR_LEN;
+		} else {
+			ctx->rx_ts = NULL;
 		}
 		bi->xdp->data_end = bi->xdp->data + size;
 		res = __igc_xdp_run_prog(adapter, prog, bi->xdp);
 		switch (res) {
 		case IGC_XDP_PASS:
-			igc_dispatch_skb_zc(q_vector, desc, bi->xdp, timestamp);
+			igc_dispatch_skb_zc(q_vector, desc, ctx);
 			fallthrough;
 		case IGC_XDP_CONSUMED:
 			xsk_buff_free(bi->xdp);

drivers/net/ethernet/intel/ixgbe/ixgbe_main.c+1−1

@@ -2105,7 +2105,7 @@ static void ixgbe_put_rx_buffer(struct ixgbe_ring *rx_ring, · 2104 unmodified lines
2105	/* hand second half of page back to the ring */	2105	/* hand second half of page back to the ring */
2106	ixgbe_reuse_rx_page(rx_ring, rx_buffer);	2106	ixgbe_reuse_rx_page(rx_ring, rx_buffer);
2107	} else {	2107	} else {
2108	if (!IS_ERR(skb) && IXGBE_CB(skb)->dma == rx_buffer->dma) {	2108	if (skb && IXGBE_CB(skb)->dma == rx_buffer->dma) {
2109	/* the page has been released from the ring */	2109	/* the page has been released from the ring */
2110	IXGBE_CB(skb)->page_released = true;	2110	IXGBE_CB(skb)->page_released = true;
2111	} else {	2111	} else {

drivers/net/ethernet/mellanox/mlxsw/spectrum_ethtool.c+3−1

 	err = mlxsw_sp_get_hw_stats_by_group(&hw_stats, &len, grp);
 	if (err)
 		return;
-	mlxsw_sp_port_get_stats_raw(dev, grp, prio, ppcnt_pl);
+	err = mlxsw_sp_port_get_stats_raw(dev, grp, prio, ppcnt_pl);
+	if (err)
+		return;
 	for (i = 0; i < len; i++) {
 		data[data_index + i] = hw_stats[i].getter(ppcnt_pl);
 		if (!hw_stats[i].cells_bytes)

drivers/net/ethernet/netronome/nfp/bpf/cmsg.c+2−0

@@ -20,6 +20,8 @@ nfp_bpf_cmsg_alloc(struct nfp_app_bpf *bpf, unsigned int size) · 19 unmodified lines
20	struct sk_buff *skb;	20	struct sk_buff *skb;
21		21
22	skb = nfp_app_ctrl_msg_alloc(bpf->app, size, GFP_KERNEL);	22	skb = nfp_app_ctrl_msg_alloc(bpf->app, size, GFP_KERNEL);
		23	if (!skb)
		24	return NULL;
23	skb_put(skb, size);	25	skb_put(skb, size);
24		26
25	return skb;	27	return skb;

drivers/net/ethernet/stmicro/stmmac/stmmac_main.c+22−18

 	pp_params.offset = stmmac_rx_offset(priv);
 	pp_params.max_len = dma_conf->dma_buf_sz;
+	if (priv->sph) {
+		pp_params.offset = 0;
+		pp_params.max_len += stmmac_rx_offset(priv);
+	}
 	rx_q->page_pool = page_pool_create(&pp_params);
 	if (IS_ERR(rx_q->page_pool)) {
 		ret = PTR_ERR(rx_q->page_pool);
 	u32 chan = 0;
 	u8 qmode = 0;
+	if (rxfifosz == 0)
+		rxfifosz = priv->dma_cap.rx_fifo_size;
+	if (txfifosz == 0)
+		txfifosz = priv->dma_cap.tx_fifo_size;
 	/* Split up the shared Tx/Rx FIFO memory on DW QoS Eth and DW XGMAC */
 	if (priv->plat->has_gmac4 || priv->plat->has_xgmac) {
 		rxfifosz /= rx_channels_count;
 	int rxfifosz = priv->plat->rx_fifo_size;
 	int txfifosz = priv->plat->tx_fifo_size;
+	if (rxfifosz == 0)
+		rxfifosz = priv->dma_cap.rx_fifo_size;
+	if (txfifosz == 0)
+		txfifosz = priv->dma_cap.tx_fifo_size;
 	/* Adjust for real per queue fifo size */
 	rxfifosz /= rx_channels_count;
 	txfifosz /= tx_channels_count;
 	const int mtu = new_mtu;
 	int ret;
+	if (txfifosz == 0)
+		txfifosz = priv->dma_cap.tx_fifo_size;
 	txfifosz /= priv->plat->tx_queues_to_use;
 	if (stmmac_xdp_is_enabled(priv) && new_mtu > ETH_DATA_LEN) {
 		priv->plat->tx_queues_to_use = priv->dma_cap.number_tx_queues;
 	}
-	if (!priv->plat->rx_fifo_size) {
+	if (priv->dma_cap.rx_fifo_size &&
-		if (priv->dma_cap.rx_fifo_size) {
+	    priv->plat->rx_fifo_size > priv->dma_cap.rx_fifo_size) {
-			priv->plat->rx_fifo_size = priv->dma_cap.rx_fifo_size;
-		} else {
-			dev_err(priv->device, "Can't specify Rx FIFO size\n");
-			return -ENODEV;
-		}
-	} else if (priv->dma_cap.rx_fifo_size &&
-		   priv->plat->rx_fifo_size > priv->dma_cap.rx_fifo_size) {
 		dev_warn(priv->device,
 			 "Rx FIFO size (%u) exceeds dma capability\n",
 			 priv->plat->rx_fifo_size);
 		priv->plat->rx_fifo_size = priv->dma_cap.rx_fifo_size;
 	}
-	if (!priv->plat->tx_fifo_size) {
+	if (priv->dma_cap.tx_fifo_size &&
-		if (priv->dma_cap.tx_fifo_size) {
+	    priv->plat->tx_fifo_size > priv->dma_cap.tx_fifo_size) {
-			priv->plat->tx_fifo_size = priv->dma_cap.tx_fifo_size;
-		} else {
-			dev_err(priv->device, "Can't specify Tx FIFO size\n");
-			return -ENODEV;
-		}
-	} else if (priv->dma_cap.tx_fifo_size &&
-		   priv->plat->tx_fifo_size > priv->dma_cap.tx_fifo_size) {
 		dev_warn(priv->device,
 			 "Tx FIFO size (%u) exceeds dma capability\n",
 			 priv->plat->tx_fifo_size);

drivers/net/ethernet/ti/am65-cpsw-nuss.c+31−19

 static void am65_cpsw_nuss_tx_cleanup(void *data, dma_addr_t desc_dma)
 {
 	struct am65_cpsw_tx_chn *tx_chn = data;
+	enum am65_cpsw_tx_buf_type buf_type;
 	struct cppi5_host_desc_t *desc_tx;
+	struct xdp_frame *xdpf;
 	struct sk_buff *skb;
 	void **swdata;
 	desc_tx = k3_cppi_desc_pool_dma2virt(tx_chn->desc_pool, desc_dma);
 	swdata = cppi5_hdesc_get_swdata(desc_tx);
-	skb = *(swdata);
+	buf_type = am65_cpsw_nuss_buf_type(tx_chn, desc_dma);
-	am65_cpsw_nuss_xmit_free(tx_chn, desc_tx);
+	if (buf_type == AM65_CPSW_TX_BUF_TYPE_SKB) {
+		skb = *(swdata);
+		dev_kfree_skb_any(skb);
+	} else {
+		xdpf = *(swdata);
+		xdp_return_frame(xdpf);
+	}
-	dev_kfree_skb_any(skb);
+	am65_cpsw_nuss_xmit_free(tx_chn, desc_tx);
 }
 static struct sk_buff *am65_cpsw_build_skb(void *page_addr,
 					   struct net_device *ndev,
-					   unsigned int len)
+					   unsigned int len,
+					   unsigned int headroom)
 {
 	struct sk_buff *skb;
 	if (unlikely(!skb))
 		return NULL;
-	skb_reserve(skb, AM65_CPSW_HEADROOM);
+	skb_reserve(skb, headroom);
 	skb->dev = ndev;
 	return skb;
 	struct xdp_frame *xdpf;
 	struct bpf_prog *prog;
 	struct page *page;
+	int pkt_len;
 	u32 act;
 	int err;
+	pkt_len = *len;
 	prog = READ_ONCE(port->xdp_prog);
 	if (!prog)
 		return AM65_CPSW_XDP_PASS;
 		netif_txq = netdev_get_tx_queue(ndev, tx_chn->id);
 		xdpf = xdp_convert_buff_to_frame(xdp);
-		if (unlikely(!xdpf))
+		if (unlikely(!xdpf)) {
+			ndev->stats.tx_dropped++;
 			goto drop;
+		}
 		__netif_tx_lock(netif_txq, cpu);
 		err = am65_cpsw_xdp_tx_frame(ndev, tx_chn, xdpf,
 		if (err)
 			goto drop;
-		dev_sw_netstats_tx_add(ndev, 1, *len);
+		dev_sw_netstats_rx_add(ndev, pkt_len);
 		ret = AM65_CPSW_XDP_CONSUMED;
 		goto out;
 	case XDP_REDIRECT:
 		if (unlikely(xdp_do_redirect(ndev, xdp, prog)))
 			goto drop;
-		dev_sw_netstats_rx_add(ndev, *len);
+		dev_sw_netstats_rx_add(ndev, pkt_len);
 		ret = AM65_CPSW_XDP_REDIRECT;
 		goto out;
 	default:
 	dev_dbg(dev, "%s rx csum_info:%#x\n", __func__, csum_info);
 	dma_unmap_single(rx_chn->dma_dev, buf_dma, buf_dma_len, DMA_FROM_DEVICE);
 	k3_cppi_desc_pool_free(rx_chn->desc_pool, desc_rx);
-	skb = am65_cpsw_build_skb(page_addr, ndev,
-				  AM65_CPSW_MAX_PACKET_SIZE);
-	if (unlikely(!skb)) {
-		new_page = page;
-		goto requeue;
-	}
 	if (port->xdp_prog) {
 		xdp_init_buff(&xdp, PAGE_SIZE, &port->xdp_rxq[flow->id]);
 		xdp_prepare_buff(&xdp, page_addr, AM65_CPSW_HEADROOM,
 		if (*xdp_state != AM65_CPSW_XDP_PASS)
 			goto allocate;
-		/* Compute additional headroom to be reserved */
+		headroom = xdp.data - xdp.data_hard_start;
-		headroom = (xdp.data - xdp.data_hard_start) - skb_headroom(skb);
+	} else {
-		skb_reserve(skb, headroom);
+		headroom = AM65_CPSW_HEADROOM;
+	}
+	skb = am65_cpsw_build_skb(page_addr, ndev,
+				  AM65_CPSW_MAX_PACKET_SIZE, headroom);
+	if (unlikely(!skb)) {
+		new_page = page;
+		goto requeue;
 	}
 	ndev_priv = netdev_priv(ndev);

drivers/net/ethernet/xilinx/xilinx_axienet_main.c+1−0

@@ -2897,6 +2897,7 @@ static int axienet_probe(struct platform_device *pdev) · 2896 unmodified lines
2897		2897
2898	lp->phylink_config.dev = &ndev->dev;	2898	lp->phylink_config.dev = &ndev->dev;
2899	lp->phylink_config.type = PHYLINK_NETDEV;	2899	lp->phylink_config.type = PHYLINK_NETDEV;
		2900	lp->phylink_config.mac_managed_pm = true;
2900	lp->phylink_config.mac_capabilities = MAC_SYM_PAUSE \| MAC_ASYM_PAUSE \|	2901	lp->phylink_config.mac_capabilities = MAC_SYM_PAUSE \| MAC_ASYM_PAUSE \|
2901	MAC_10FD \| MAC_100FD \| MAC_1000FD;	2902	MAC_10FD \| MAC_100FD \| MAC_1000FD;
2902		2903

drivers/net/geneve.c+2−14

@@ -1902,21 +1902,9 @@ static void geneve_destroy_tunnels(struct net net, struct list_head head) · 1901 unmodified lines
1902	{	1902	{
1903	struct geneve_net *gn = net_generic(net, geneve_net_id);	1903	struct geneve_net *gn = net_generic(net, geneve_net_id);
1904	struct geneve_dev geneve, next;	1904	struct geneve_dev geneve, next;
1905	struct net_device dev, aux;
1906		1905
1907	/* gather any geneve devices that were moved into this ns */	1906	list_for_each_entry_safe(geneve, next, &gn->geneve_list, next)
1908	for_each_netdev_safe(net, dev, aux)	1907	geneve_dellink(geneve->dev, head);
1909	if (dev->rtnl_link_ops == &geneve_link_ops)
1910	unregister_netdevice_queue(dev, head);
1911
1912	/* now gather any other geneve devices that were created in this ns */
1913	list_for_each_entry_safe(geneve, next, &gn->geneve_list, next) {
1914	/* If geneve->dev is in the same netns, it was already added
1915	* to the list by the previous loop.
1916	*/
1917	if (!net_eq(dev_net(geneve->dev), net))
1918	unregister_netdevice_queue(geneve->dev, head);
1919	}
1920	}	1908	}
1921		1909
1922	static void __net_exit geneve_exit_batch_rtnl(struct list_head *net_list,	1910	static void __net_exit geneve_exit_batch_rtnl(struct list_head *net_list,

drivers/net/gtp.c+0−5

 	list_for_each_entry(net, net_list, exit_list) {
 		struct gtp_net *gn = net_generic(net, gtp_net_id);
 		struct gtp_dev *gtp, *gtp_next;
-		struct net_device *dev;
-		for_each_netdev(net, dev)
-			if (dev->rtnl_link_ops == &gtp_link_ops)
-				gtp_dellink(dev, dev_to_kill);
 		list_for_each_entry_safe(gtp, gtp_next, &gn->gtp_dev_list, list)
 			gtp_dellink(gtp->dev, dev_to_kill);

drivers/net/phy/phylink.c+9−6

@@ -2265,12 +2265,15 @@ static int phylink_bringup_phy(struct phylink pl, struct phy_device phy, · 2264 unmodified lines
2265	/* Allow the MAC to stop its clock if the PHY has the capability */	2265	/* Allow the MAC to stop its clock if the PHY has the capability */
2266	pl->mac_tx_clk_stop = phy_eee_tx_clock_stop_capable(phy) > 0;	2266	pl->mac_tx_clk_stop = phy_eee_tx_clock_stop_capable(phy) > 0;
2267		2267
2268	/* Explicitly configure whether the PHY is allowed to stop it's	2268	if (pl->mac_supports_eee_ops) {
2269	* receive clock.	2269	/* Explicitly configure whether the PHY is allowed to stop it's
2270	*/	2270	* receive clock.
2271	ret = phy_eee_rx_clock_stop(phy, pl->config->eee_rx_clk_stop_enable);	2271	*/
2272	if (ret == -EOPNOTSUPP)	2272	ret = phy_eee_rx_clock_stop(phy,
2273	ret = 0;	2273	pl->config->eee_rx_clk_stop_enable);
		2274	if (ret == -EOPNOTSUPP)
		2275	ret = 0;
		2276	}
2274		2277
2275	return ret;	2278	return ret;
2276	}	2279	}

drivers/net/pse-pd/pd692x0.c+1−1

@@ -1047,7 +1047,7 @@ static int pd692x0_pi_get_pw_limit(struct pse_controller_dev *pcdev, · 1046 unmodified lines
1047	if (ret < 0)	1047	if (ret < 0)
1048	return ret;	1048	return ret;
1049		1049
1050	return pd692x0_pi_get_pw_from_table(buf.data[2], buf.data[3]);	1050	return pd692x0_pi_get_pw_from_table(buf.data[0], buf.data[1]);
1051	}	1051	}
1052		1052
1053	static int pd692x0_pi_set_pw_limit(struct pse_controller_dev *pcdev,	1053	static int pd692x0_pi_set_pw_limit(struct pse_controller_dev *pcdev,

drivers/net/pse-pd/pse_core.c+2−2

@@ -319,7 +319,7 @@ static int pse_pi_get_current_limit(struct regulator_dev *rdev) · 318 unmodified lines
319	goto out;	319	goto out;
320	mW = ret;	320	mW = ret;
321		321
322	ret = pse_pi_get_voltage(rdev);	322	ret = _pse_pi_get_voltage(rdev);
323	if (!ret) {	323	if (!ret) {
324	dev_err(pcdev->dev, "Voltage null\n");	324	dev_err(pcdev->dev, "Voltage null\n");
325	ret = -ERANGE;	325	ret = -ERANGE;
@@ -356,7 +356,7 @@ static int pse_pi_set_current_limit(struct regulator_dev *rdev, int min_uA, · 30 unmodified lines
356		356
357	id = rdev_get_id(rdev);	357	id = rdev_get_id(rdev);
358	mutex_lock(&pcdev->lock);	358	mutex_lock(&pcdev->lock);
359	ret = pse_pi_get_voltage(rdev);	359	ret = _pse_pi_get_voltage(rdev);
360	if (!ret) {	360	if (!ret) {
361	dev_err(pcdev->dev, "Voltage null\n");	361	dev_err(pcdev->dev, "Voltage null\n");
362	ret = -ERANGE;	362	ret = -ERANGE;

drivers/net/team/team_core.c+3−1

 				ctx.data.u32_val = nla_get_u32(attr_data);
 				break;
 			case TEAM_OPTION_TYPE_STRING:
-				if (nla_len(attr_data) > TEAM_STRING_MAX_LEN) {
+				if (nla_len(attr_data) > TEAM_STRING_MAX_LEN ||
+				    !memchr(nla_data(attr_data), '\0',
+					    nla_len(attr_data))) {
 					err = -EINVAL;
 					goto team_put;
 				}

drivers/net/tun.c+5−9

 	return ret;
 }
-static inline bool tun_capable(struct tun_struct *tun)
+static inline bool tun_not_capable(struct tun_struct *tun)
 {
 	const struct cred *cred = current_cred();
 	struct net *net = dev_net(tun->dev);
-	if (ns_capable(net->user_ns, CAP_NET_ADMIN))
+	return ((uid_valid(tun->owner) && !uid_eq(cred->euid, tun->owner)) ||
-		return 1;
+		(gid_valid(tun->group) && !in_egroup_p(tun->group))) &&
-	if (uid_valid(tun->owner) && uid_eq(cred->euid, tun->owner))
+		!ns_capable(net->user_ns, CAP_NET_ADMIN);
-		return 1;
-	if (gid_valid(tun->group) && in_egroup_p(tun->group))
-		return 1;
-	return 0;
 }
 static void tun_set_real_num_queues(struct tun_struct *tun)
 		    !!(tun->flags & IFF_MULTI_QUEUE))
 			return -EINVAL;
-		if (!tun_capable(tun))
+		if (tun_not_capable(tun))
 			return -EPERM;
 		err = security_tun_dev_open(tun->security);
 		if (err < 0)

drivers/net/vmxnet3/vmxnet3_xdp.c+12−2

 	if (likely(cpu < tq_number))
 		tq = &adapter->tx_queue[cpu];
 	else
-		tq = &adapter->tx_queue[reciprocal_scale(cpu, tq_number)];
+		tq = &adapter->tx_queue[cpu % tq_number];
 	return tq;
 }
 	u32 buf_size;
 	u32 dw2;
+	spin_lock_irq(&tq->tx_lock);
 	dw2 = (tq->tx_ring.gen ^ 0x1) << VMXNET3_TXD_GEN_SHIFT;
 	dw2 |= xdpf->len;
 	ctx.sop_txd = tq->tx_ring.base + tq->tx_ring.next2fill;
 	if (vmxnet3_cmd_ring_desc_avail(&tq->tx_ring) == 0) {
 		tq->stats.tx_ring_full++;
+		spin_unlock_irq(&tq->tx_lock);
 		return -ENOSPC;
 	}
 		tbi->dma_addr = dma_map_single(&adapter->pdev->dev,
 					       xdpf->data, buf_size,
 					       DMA_TO_DEVICE);
-		if (dma_mapping_error(&adapter->pdev->dev, tbi->dma_addr))
+		if (dma_mapping_error(&adapter->pdev->dev, tbi->dma_addr)) {
+			spin_unlock_irq(&tq->tx_lock);
 			return -EFAULT;
+		}
 		tbi->map_type |= VMXNET3_MAP_SINGLE;
 	} else { /* XDP buffer from page pool */
 		page = virt_to_page(xdpf->data);
 	dma_wmb();
 	gdesc->dword[2] = cpu_to_le32(le32_to_cpu(gdesc->dword[2]) ^
 						  VMXNET3_TXD_GEN);
+	spin_unlock_irq(&tq->tx_lock);
 	/* No need to handle the case when tx_num_deferred doesn't reach
 	 * threshold. Backend driver at hypervisor side will poll and reset
 {
 	struct vmxnet3_adapter *adapter = netdev_priv(dev);
 	struct vmxnet3_tx_queue *tq;
+	struct netdev_queue *nq;
 	int i;
 	if (unlikely(test_bit(VMXNET3_STATE_BIT_QUIESCED, &adapter->state)))
 	if (tq->stopped)
 		return -ENETDOWN;
+	nq = netdev_get_tx_queue(adapter->netdev, tq->qid);
+	__netif_tx_lock(nq, smp_processor_id());
 	for (i = 0; i < n; i++) {
 		if (vmxnet3_xdp_xmit_frame(adapter, frames[i], tq, true)) {
 			tq->stats.xdp_xmit_err++;
 		}
 	}
 	tq->stats.xdp_xmit += i;
+	__netif_tx_unlock(nq);
 	return i;
 }

drivers/net/vxlan/vxlan_core.c+5−2

 	struct vxlan_dev *vxlan = netdev_priv(dev);
 	int err;
-	if (vxlan->cfg.flags & VXLAN_F_VNIFILTER)
+	if (vxlan->cfg.flags & VXLAN_F_VNIFILTER) {
-		vxlan_vnigroup_init(vxlan);
+		err = vxlan_vnigroup_init(vxlan);
+		if (err)
+			return err;
+	}
 	err = gro_cells_init(&vxlan->gro_cells, dev);
 	if (err)

drivers/net/wireless/ath/ath12k/wmi.c+45−16

 	return reg_rule_ptr;
 }
+static u8 ath12k_wmi_ignore_num_extra_rules(struct ath12k_wmi_reg_rule_ext_params *rule,
+					    u32 num_reg_rules)
+{
+	u8 num_invalid_5ghz_rules = 0;
+	u32 count, start_freq;
+	for (count = 0; count < num_reg_rules; count++) {
+		start_freq = le32_get_bits(rule[count].freq_info, REG_RULE_START_FREQ);
+		if (start_freq >= ATH12K_MIN_6G_FREQ)
+			num_invalid_5ghz_rules++;
+	}
+	return num_invalid_5ghz_rules;
+}
 static int ath12k_pull_reg_chan_list_ext_update_ev(struct ath12k_base *ab,
 						   struct sk_buff *skb,
 						   struct ath12k_reg_info *reg_info)
 	u32 num_2g_reg_rules, num_5g_reg_rules;
 	u32 num_6g_reg_rules_ap[WMI_REG_CURRENT_MAX_AP_TYPE];
 	u32 num_6g_reg_rules_cl[WMI_REG_CURRENT_MAX_AP_TYPE][WMI_REG_MAX_CLIENT_TYPE];
+	u8 num_invalid_5ghz_ext_rules;
 	u32 total_reg_rules = 0;
 	int ret, i, j;
 	memcpy(reg_info->alpha2, &ev->alpha2, REG_ALPHA2_LEN);
-	/* FIXME: Currently FW includes 6G reg rule also in 5G rule
-	 * list for country US.
-	 * Having same 6G reg rule in 5G and 6G rules list causes
-	 * intersect check to be true, and same rules will be shown
-	 * multiple times in iw cmd. So added hack below to avoid
-	 * parsing 6G rule from 5G reg rule list, and this can be
-	 * removed later, after FW updates to remove 6G reg rule
-	 * from 5G rules list.
-	 */
-	if (memcmp(reg_info->alpha2, "US", 2) == 0) {
-		reg_info->num_5g_reg_rules = REG_US_5G_NUM_REG_RULES;
-		num_5g_reg_rules = reg_info->num_5g_reg_rules;
-	}
 	reg_info->dfs_region = le32_to_cpu(ev->dfs_region);
 	reg_info->phybitmap = le32_to_cpu(ev->phybitmap);
 	reg_info->num_phy = le32_to_cpu(ev->num_phy);
 		}
 	}
+	ext_wmi_reg_rule += num_2g_reg_rules;
+	/* Firmware might include 6 GHz reg rule in 5 GHz rule list
+	 * for few countries along with separate 6 GHz rule.
+	 * Having same 6 GHz reg rule in 5 GHz and 6 GHz rules list
+	 * causes intersect check to be true, and same rules will be
+	 * shown multiple times in iw cmd.
+	 * Hence, avoid parsing 6 GHz rule from 5 GHz reg rule list
+	 */
+	num_invalid_5ghz_ext_rules = ath12k_wmi_ignore_num_extra_rules(ext_wmi_reg_rule,
+								       num_5g_reg_rules);
+	if (num_invalid_5ghz_ext_rules) {
+		ath12k_dbg(ab, ATH12K_DBG_WMI,
+			   "CC: %s 5 GHz reg rules number %d from fw, %d number of invalid 5 GHz rules",
+			   reg_info->alpha2, reg_info->num_5g_reg_rules,
+			   num_invalid_5ghz_ext_rules);
+		num_5g_reg_rules = num_5g_reg_rules - num_invalid_5ghz_ext_rules;
+		reg_info->num_5g_reg_rules = num_5g_reg_rules;
+	}
 	if (num_5g_reg_rules) {
-		ext_wmi_reg_rule += num_2g_reg_rules;
 		reg_info->reg_rules_5g_ptr =
 			create_ext_reg_rules_from_wmi(num_5g_reg_rules,
 						      ext_wmi_reg_rule);
 		}
 	}
-	ext_wmi_reg_rule += num_5g_reg_rules;
+	/* We have adjusted the number of 5 GHz reg rules above. But still those
+	 * many rules needs to be adjusted in ext_wmi_reg_rule.
+	 *
+	 * NOTE: num_invalid_5ghz_ext_rules will be 0 for rest other cases.
+	 */
+	ext_wmi_reg_rule += (num_5g_reg_rules + num_invalid_5ghz_ext_rules);
 	for (i = 0; i < WMI_REG_CURRENT_MAX_AP_TYPE; i++) {
 		reg_info->reg_rules_6g_ap_ptr[i] =

drivers/net/wireless/ath/ath12k/wmi.h+0−1

@@ -4073,7 +4073,6 @@ struct ath12k_wmi_eht_rate_set_params { · 4072 unmodified lines
4073	#define MAX_REG_RULES 10	4073	#define MAX_REG_RULES 10
4074	#define REG_ALPHA2_LEN 2	4074	#define REG_ALPHA2_LEN 2
4075	#define MAX_6G_REG_RULES 5	4075	#define MAX_6G_REG_RULES 5
4076	#define REG_US_5G_NUM_REG_RULES 4
4077		4076
4078	enum wmi_start_event_param {	4077	enum wmi_start_event_param {
4079	WMI_VDEV_START_RESP_EVENT = 0,	4078	WMI_VDEV_START_RESP_EVENT = 0,

drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c+2−2

drivers/net/wwan/mhi_wwan_mbim.c+1−1

@@ -220,7 +220,7 @@ static int mbim_rx_verify_nth16(struct mhi_mbim_context mbim, struct sk_buff s · 219 unmodified lines
220	if (mbim->rx_seq + 1 != le16_to_cpu(nth16->wSequence) &&	220	if (mbim->rx_seq + 1 != le16_to_cpu(nth16->wSequence) &&
221	(mbim->rx_seq \|\| le16_to_cpu(nth16->wSequence)) &&	221	(mbim->rx_seq \|\| le16_to_cpu(nth16->wSequence)) &&
222	!(mbim->rx_seq == 0xffff && !le16_to_cpu(nth16->wSequence))) {	222	!(mbim->rx_seq == 0xffff && !le16_to_cpu(nth16->wSequence))) {
223	net_err_ratelimited("sequence number glitch prev=%d curr=%d\n",	223	net_dbg_ratelimited("sequence number glitch prev=%d curr=%d\n",
224	mbim->rx_seq, le16_to_cpu(nth16->wSequence));	224	mbim->rx_seq, le16_to_cpu(nth16->wSequence));
225	}	225	}
226	mbim->rx_seq = le16_to_cpu(nth16->wSequence);	226	mbim->rx_seq = le16_to_cpu(nth16->wSequence);

drivers/nvme/host/core.c+7−1

@@ -1700,7 +1700,13 @@ int nvme_set_queue_count(struct nvme_ctrl ctrl, int count) · 1699 unmodified lines
1700		1700
1701	status = nvme_set_features(ctrl, NVME_FEAT_NUM_QUEUES, q_count, NULL, 0,	1701	status = nvme_set_features(ctrl, NVME_FEAT_NUM_QUEUES, q_count, NULL, 0,
1702	&result);	1702	&result);
1703	if (status < 0)	1703
		1704	/*
		1705	* It's either a kernel error or the host observed a connection
		1706	* lost. In either case it's not possible communicate with the
		1707	* controller and thus enter the error code path.
		1708	*/
		1709	if (status < 0 \|\| status == NVME_SC_HOST_PATH_ERROR)
1704	return status;	1710	return status;
1705		1711
1706	/*	1712	/*

drivers/nvme/host/fc.c+25−10

 static void
 nvme_fc_ctrl_connectivity_loss(struct nvme_fc_ctrl *ctrl)
 {
+	enum nvme_ctrl_state state;
+	unsigned long flags;
 	dev_info(ctrl->ctrl.device,
 		"NVME-FC{%d}: controller connectivity lost. Awaiting "
 		"Reconnect", ctrl->cnum);
-	switch (nvme_ctrl_state(&ctrl->ctrl)) {
+	spin_lock_irqsave(&ctrl->lock, flags);
+	set_bit(ASSOC_FAILED, &ctrl->flags);
+	state = nvme_ctrl_state(&ctrl->ctrl);
+	spin_unlock_irqrestore(&ctrl->lock, flags);
+	switch (state) {
 	case NVME_CTRL_NEW:
 	case NVME_CTRL_LIVE:
 		/*
 		nvme_fc_complete_rq(rq);
 check_error:
-	if (terminate_assoc && ctrl->ctrl.state != NVME_CTRL_RESETTING)
+	if (terminate_assoc &&
+	    nvme_ctrl_state(&ctrl->ctrl) != NVME_CTRL_RESETTING)
 		queue_work(nvme_reset_wq, &ctrl->ioerr_work);
 }
 static void
 nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg)
 {
+	enum nvme_ctrl_state state = nvme_ctrl_state(&ctrl->ctrl);
 	/*
 	 * if an error (io timeout, etc) while (re)connecting, the remote
 	 * port requested terminating of the association (disconnect_ls)
 	 * the controller.  Abort any ios on the association and let the
 	 * create_association error path resolve things.
 	 */
-	if (ctrl->ctrl.state == NVME_CTRL_CONNECTING) {
+	if (state == NVME_CTRL_CONNECTING) {
 		__nvme_fc_abort_outstanding_ios(ctrl, true);
-		set_bit(ASSOC_FAILED, &ctrl->flags);
 		dev_warn(ctrl->ctrl.device,
 			"NVME-FC{%d}: transport error during (re)connect\n",
 			ctrl->cnum);
 	}
 	/* Otherwise, only proceed if in LIVE state - e.g. on first error */
-	if (ctrl->ctrl.state != NVME_CTRL_LIVE)
+	if (state != NVME_CTRL_LIVE)
 		return;
 	dev_warn(ctrl->ctrl.device,
 		else
 			ret = nvme_fc_recreate_io_queues(ctrl);
 	}
-	if (!ret && test_bit(ASSOC_FAILED, &ctrl->flags))
-		ret = -EIO;
 	if (ret)
 		goto out_term_aen_ops;
-	changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
+	spin_lock_irqsave(&ctrl->lock, flags);
+	if (!test_bit(ASSOC_FAILED, &ctrl->flags))
+		changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
+	else
+		ret = -EIO;
+	spin_unlock_irqrestore(&ctrl->lock, flags);
+	if (ret)
+		goto out_term_aen_ops;
 	ctrl->ctrl.nr_reconnects = 0;
 	list_add_tail(&ctrl->ctrl_list, &rport->ctrl_list);
 	spin_unlock_irqrestore(&rport->lock, flags);
-	if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RESETTING) ||
+	if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
-	    !nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
 		dev_err(ctrl->ctrl.device,
 			"NVME-FC{%d}: failed to init ctrl state\n", ctrl->cnum);
 		goto fail_ctrl;

drivers/nvme/host/pci.c+3−9

 	return 0;
 out_free_bufs:
-	while (--i >= 0) {
-		size_t size = le32_to_cpu(descs[i].size) * NVME_CTRL_PAGE_SIZE;
-		dma_free_attrs(dev->dev, size, bufs[i],
-			       le64_to_cpu(descs[i].addr),
-			       DMA_ATTR_NO_KERNEL_MAPPING | DMA_ATTR_NO_WARN);
-	}
 	kfree(bufs);
 out_free_descs:
 	dma_free_coherent(dev->dev, descs_size, descs, descs_dma);
 		 * because of high power consumption (> 2 Watt) in s2idle
 		 * sleep. Only some boards with Intel CPU are affected.
 		 */
-		if (dmi_match(DMI_BOARD_NAME, "GMxPXxx") ||
+		if (dmi_match(DMI_BOARD_NAME, "DN50Z-140HC-YD") ||
+		    dmi_match(DMI_BOARD_NAME, "GMxPXxx") ||
+		    dmi_match(DMI_BOARD_NAME, "GXxMRXx") ||
 		    dmi_match(DMI_BOARD_NAME, "PH4PG31") ||
 		    dmi_match(DMI_BOARD_NAME, "PH4PRX1_PH6PRX1") ||
 		    dmi_match(DMI_BOARD_NAME, "PH6PG01_PH6PG71"))

drivers/nvme/host/sysfs.c+1−1

@@ -792,7 +792,7 @@ static umode_t nvme_tls_attrs_are_visible(struct kobject *kobj, · 791 unmodified lines
792	return a->mode;	792	return a->mode;
793	}	793	}
794		794
795	const struct attribute_group nvme_tls_attrs_group = {	795	static const struct attribute_group nvme_tls_attrs_group = {
796	.attrs = nvme_tls_attrs,	796	.attrs = nvme_tls_attrs,
797	.is_visible = nvme_tls_attrs_are_visible,	797	.is_visible = nvme_tls_attrs_are_visible,
798	};	798	};

drivers/nvme/target/admin-cmd.c+1−0

@@ -1068,6 +1068,7 @@ static void nvme_execute_identify_ns_nvm(struct nvmet_req *req) · 1067 unmodified lines
1068	goto out;	1068	goto out;
1069	}	1069	}
1070	status = nvmet_copy_to_sgl(req, 0, id, sizeof(*id));	1070	status = nvmet_copy_to_sgl(req, 0, id, sizeof(*id));
		1071	kfree(id);
1071	out:	1072	out:
1072	nvmet_req_complete(req, status);	1073	nvmet_req_complete(req, status);
1073	}	1074	}

drivers/nvme/target/fabrics-cmd.c+1−1

@@ -287,7 +287,7 @@ static void nvmet_execute_admin_connect(struct nvmet_req *req) · 286 unmodified lines
287	args.subsysnqn = d->subsysnqn;	287	args.subsysnqn = d->subsysnqn;
288	args.hostnqn = d->hostnqn;	288	args.hostnqn = d->hostnqn;
289	args.hostid = &d->hostid;	289	args.hostid = &d->hostid;
290	args.kato = c->kato;	290	args.kato = le32_to_cpu(c->kato);
291		291
292	ctrl = nvmet_alloc_ctrl(&args);	292	ctrl = nvmet_alloc_ctrl(&args);
293	if (!ctrl)	293	if (!ctrl)

drivers/nvme/target/io-cmd-bdev.c+1−1

@@ -272,7 +272,7 @@ static void nvmet_bdev_execute_rw(struct nvmet_req *req) · 271 unmodified lines
272	iter_flags = SG_MITER_FROM_SG;	272	iter_flags = SG_MITER_FROM_SG;
273	}	273	}
274		274
275	if (req->cmd->rw.control & NVME_RW_LR)	275	if (req->cmd->rw.control & cpu_to_le16(NVME_RW_LR))
276	opf \|= REQ_FAILFAST_DEV;	276	opf \|= REQ_FAILFAST_DEV;
277		277
278	if (is_pci_p2pdma_page(sg_page(req->sg)))	278	if (is_pci_p2pdma_page(sg_page(req->sg)))

drivers/nvme/target/nvmet.h+1−1

@@ -589,7 +589,7 @@ struct nvmet_alloc_ctrl_args { · 588 unmodified lines
589	const struct nvmet_fabrics_ops *ops;	589	const struct nvmet_fabrics_ops *ops;
590	struct device *p2p_client;	590	struct device *p2p_client;
591	u32 kato;	591	u32 kato;
592	u32 result;	592	__le32 result;
593	u16 error_loc;	593	u16 error_loc;
594	u16 status;	594	u16 status;
595	};	595	};

drivers/of/address.c+4−1

 #include <linux/string.h>
 #include <linux/dma-direct.h> /* for bus_dma_region */
+#include <kunit/visibility.h>
 /* Uncomment me to enable of_dump_addr() debugging output */
 // #define DEBUG
 #endif /* CONFIG_PCI */
-static int __of_address_resource_bounds(struct resource *r, u64 start, u64 size)
+VISIBLE_IF_KUNIT int __of_address_resource_bounds(struct resource *r, u64 start, u64 size)
 {
 	if (overflows_type(start, r->start))
 		return -EOVERFLOW;
 	return 0;
 }
+EXPORT_SYMBOL_IF_KUNIT(__of_address_resource_bounds);
 /*
  * of_pci_range_to_resource - Create a resource from an of_pci_range

drivers/of/of_private.h+4−0

@@ -208,4 +208,8 @@ static void __maybe_unused of_dump_addr(const char s, const __be32 addr, int n · 207 unmodified lines
208	static void __maybe_unused of_dump_addr(const char s, const __be32 addr, int na) { }	208	static void __maybe_unused of_dump_addr(const char s, const __be32 addr, int na) { }
209	#endif	209	#endif
210		210
		211	#if IS_ENABLED(CONFIG_KUNIT)
		212	int __of_address_resource_bounds(struct resource *r, u64 start, u64 size);
		213	#endif
		214
211	#endif /* _LINUX_OF_PRIVATE_H */	215	#endif /* _LINUX_OF_PRIVATE_H */

drivers/of/of_test.c+118−1

@@ -2,6 +2,7 @@ · 1 unmodified line
2	/*	2	/*
3	* KUnit tests for OF APIs	3	* KUnit tests for OF APIs
4	*/	4	*/
		5	#include <linux/ioport.h>
5	#include <linux/module.h>	6	#include <linux/module.h>
6	#include <linux/of.h>	7	#include <linux/of.h>
7		8
@@ -54,8 +55,124 @@ static struct kunit_suite of_dtb_suite = { · 46 unmodified lines
54	.init = of_dtb_test_init,	55	.init = of_dtb_test_init,
55	};	56	};
56		57
		58	struct of_address_resource_bounds_case {
		59	u64 start;
		60	u64 size;
		61	int ret;
		62
		63	u64 res_start;
		64	u64 res_end;
		65	};
		66
		67	static void of_address_resource_bounds_case_desc(const struct of_address_resource_bounds_case *p,
		68	char *name)
		69	{
		70	snprintf(name, KUNIT_PARAM_DESC_SIZE, "start=0x%016llx,size=0x%016llx", p->start, p->size);
		71	}
		72
		73	static const struct of_address_resource_bounds_case of_address_resource_bounds_cases[] = {
		74	{
		75	.start = 0,
		76	.size = 0,
		77	.ret = 0,
		78	.res_start = 0,
		79	.res_end = -1,
		80	},
		81	{
		82	.start = 0,
		83	.size = 0x1000,
		84	.ret = 0,
		85	.res_start = 0,
		86	.res_end = 0xfff,
		87	},
		88	{
		89	.start = 0x1000,
		90	.size = 0,
		91	.ret = 0,
		92	.res_start = 0x1000,
		93	.res_end = 0xfff,
		94	},
		95	{
		96	.start = 0x1000,
		97	.size = 0x1000,
		98	.ret = 0,
		99	.res_start = 0x1000,
		100	.res_end = 0x1fff,
		101	},
		102	{
		103	.start = 1,
		104	.size = RESOURCE_SIZE_MAX,
		105	.ret = 0,
		106	.res_start = 1,
		107	.res_end = RESOURCE_SIZE_MAX,
		108	},
		109	{
		110	.start = RESOURCE_SIZE_MAX,
		111	.size = 1,
		112	.ret = 0,
		113	.res_start = RESOURCE_SIZE_MAX,
		114	.res_end = RESOURCE_SIZE_MAX,
		115	},
		116	{
		117	.start = 2,
		118	.size = RESOURCE_SIZE_MAX,
		119	.ret = -EOVERFLOW,
		120	},
		121	{
		122	.start = RESOURCE_SIZE_MAX,
		123	.size = 2,
		124	.ret = -EOVERFLOW,
		125	},
		126	{
		127	.start = ULL(0x100000000),
		128	.size = 1,
		129	.ret = sizeof(resource_size_t) > sizeof(u32) ? 0 : -EOVERFLOW,
		130	.res_start = ULL(0x100000000),
		131	.res_end = ULL(0x100000000),
		132	},
		133	{
		134	.start = 0x1000,
		135	.size = 0xffffffff,
		136	.ret = sizeof(resource_size_t) > sizeof(u32) ? 0 : -EOVERFLOW,
		137	.res_start = 0x1000,
		138	.res_end = ULL(0x100000ffe),
		139	},
		140	};
		141
		142	KUNIT_ARRAY_PARAM(of_address_resource_bounds,
		143	of_address_resource_bounds_cases, of_address_resource_bounds_case_desc);
		144
		145	static void of_address_resource_bounds(struct kunit *test)
		146	{
		147	const struct of_address_resource_bounds_case *param = test->param_value;
		148	struct resource r; /* Intentionally uninitialized */
		149	int ret;
		150
		151	if (!IS_ENABLED(CONFIG_OF_ADDRESS))
		152	kunit_skip(test, "CONFIG_OF_ADDRESS not enabled\n");
		153
		154	ret = __of_address_resource_bounds(&r, param->start, param->size);
		155	KUNIT_EXPECT_EQ(test, param->ret, ret);
		156	if (ret == 0) {
		157	KUNIT_EXPECT_EQ(test, (resource_size_t)param->res_start, r.start);
		158	KUNIT_EXPECT_EQ(test, (resource_size_t)param->res_end, r.end);
		159	KUNIT_EXPECT_EQ(test, param->size, resource_size(&r));
		160	}
		161	}
		162
		163	static struct kunit_case of_address_test_cases[] = {
		164	KUNIT_CASE_PARAM(of_address_resource_bounds, of_address_resource_bounds_gen_params),
		165	{}
		166	};
		167
		168	static struct kunit_suite of_address_suite = {
		169	.name = "of_address",
		170	.test_cases = of_address_test_cases,
		171	};
		172
57	kunit_test_suites(	173	kunit_test_suites(
58	&of_dtb_suite,	174	&of_dtb_suite, &of_address_suite,
59	);	175	);
60	MODULE_DESCRIPTION("KUnit tests for OF APIs");	176	MODULE_DESCRIPTION("KUnit tests for OF APIs");
		177	MODULE_IMPORT_NS("EXPORTED_FOR_KUNIT_TESTING");
61	MODULE_LICENSE("GPL");	178	MODULE_LICENSE("GPL");

drivers/pci/pcie/aspm.c+0−3

@@ -108,9 +108,6 @@ void pci_save_aspm_l1ss_state(struct pci_dev *pdev) · 107 unmodified lines
108	pci_read_config_dword(pdev, pdev->l1ss + PCI_L1SS_CTL2, cap++);	108	pci_read_config_dword(pdev, pdev->l1ss + PCI_L1SS_CTL2, cap++);
109	pci_read_config_dword(pdev, pdev->l1ss + PCI_L1SS_CTL1, cap++);	109	pci_read_config_dword(pdev, pdev->l1ss + PCI_L1SS_CTL1, cap++);
110		110
111	if (parent->state_saved)
112	return;
113
114	/*	111	/*
115	* Save parent's L1 substate configuration so we have it for	112	* Save parent's L1 substate configuration so we have it for
116	* pci_restore_aspm_l1ss_state(pdev) to restore.	113	* pci_restore_aspm_l1ss_state(pdev) to restore.

drivers/pci/probe.c+3−2

 	return (res->flags & IORESOURCE_MEM_64) ? 1 : 0;
 }
-static void pci_read_bases(struct pci_dev *dev, unsigned int howmany, int rom)
+static __always_inline void pci_read_bases(struct pci_dev *dev,
+					   unsigned int howmany, int rom)
 {
 	u32 rombar, stdbars[PCI_STD_NUM_BARS];
 	unsigned int pos, reg;
 	u16 orig_cmd;
-	BUILD_BUG_ON(howmany > PCI_STD_NUM_BARS);
+	BUILD_BUG_ON(statically_true(howmany > PCI_STD_NUM_BARS));
 	if (dev->non_compliant_bars)
 		return;

drivers/pci/quirks.c+2−1

  * AMD Matisse USB 3.0 Host Controller 0x149c
  * Intel 82579LM Gigabit Ethernet Controller 0x1502
  * Intel 82579V Gigabit Ethernet Controller 0x1503
- *
+ * Mediatek MT7922 802.11ax PCI Express Wireless Network Adapter
  */
 static void quirk_no_flr(struct pci_dev *dev)
 {
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x7901, quirk_no_flr);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1502, quirk_no_flr);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1503, quirk_no_flr);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_MEDIATEK, 0x0616, quirk_no_flr);
 /* FLR may cause the SolidRun SNET DPU (rev 0x1) to hang */
 static void quirk_no_flr_snet(struct pci_dev *dev)

drivers/pci/tph.c+1−1

@@ -360,7 +360,7 @@ int pcie_tph_set_st_entry(struct pci_dev *pdev, unsigned int index, u16 tag) · 359 unmodified lines
360	return err;	360	return err;
361	}	361	}
362		362
363	set_ctrl_reg_req_en(pdev, pdev->tph_mode);	363	set_ctrl_reg_req_en(pdev, pdev->tph_req_type);
364		364
365	pci_dbg(pdev, "set steering tag: %s table, index=%d, tag=%#04x\n",	365	pci_dbg(pdev, "set steering tag: %s table, index=%d, tag=%#04x\n",
366	(loc == PCI_TPH_LOC_MSIX) ? "MSI-X" : "ST", index, tag);	366	(loc == PCI_TPH_LOC_MSIX) ? "MSI-X" : "ST", index, tag);

drivers/pinctrl/pinconf-generic.c+4−4

@@ -89,12 +89,12 @@ static void pinconf_generic_dump_one(struct pinctrl_dev *pctldev, · 88 unmodified lines
89	seq_puts(s, items[i].display);	89	seq_puts(s, items[i].display);
90	/* Print unit if available */	90	/* Print unit if available */
91	if (items[i].has_arg) {	91	if (items[i].has_arg) {
92	seq_printf(s, " (0x%x",	92	u32 val = pinconf_to_config_argument(config);
93	pinconf_to_config_argument(config));	93
94	if (items[i].format)	94	if (items[i].format)
95	seq_printf(s, " %s)", items[i].format);	95	seq_printf(s, " (%u %s)", val, items[i].format);
96	else	96	else
97	seq_puts(s, ")");	97	seq_printf(s, " (0x%x)", val);
98	}	98	}
99	}	99	}
100	}	100	}

drivers/pinctrl/pinctrl-cy8c95x0.c+25−17

 #define CY8C95X0_PORTSEL	0x18
 /* Port settings, write PORTSEL first */
 #define CY8C95X0_INTMASK	0x19
-#define CY8C95X0_PWMSEL		0x1A
+#define CY8C95X0_SELPWM		0x1A
 #define CY8C95X0_INVERT		0x1B
 #define CY8C95X0_DIRECTION	0x1C
 /* Drive mode register change state on writing '1' */
 static bool cy8c95x0_readable_register(struct device *dev, unsigned int reg)
 {
 	/*
-	 * Only 12 registers are present per port (see Table 6 in the
+	 * Only 12 registers are present per port (see Table 6 in the datasheet).
-	 * datasheet).
 	 */
-	if (reg >= CY8C95X0_VIRTUAL && (reg % MUXED_STRIDE) < 12)
+	if (reg >= CY8C95X0_VIRTUAL && (reg % MUXED_STRIDE) >= 12)
-		return true;
+		return false;
 	switch (reg) {
 	case 0x24 ... 0x27:
+	case 0x31 ... 0x3f:
 		return false;
 	default:
 		return true;
 static bool cy8c95x0_writeable_register(struct device *dev, unsigned int reg)
 {
-	if (reg >= CY8C95X0_VIRTUAL)
+	/*
-		return true;
+	 * Only 12 registers are present per port (see Table 6 in the datasheet).
+	 */
+	if (reg >= CY8C95X0_VIRTUAL && (reg % MUXED_STRIDE) >= 12)
+		return false;
 	switch (reg) {
 	case CY8C95X0_INPUT_(0) ... CY8C95X0_INPUT_(7):
 	case CY8C95X0_DEVID:
 		return false;
 	case 0x24 ... 0x27:
+	case 0x31 ... 0x3f:
 		return false;
 	default:
 		return true;
 	case CY8C95X0_INPUT_(0) ... CY8C95X0_INPUT_(7):
 	case CY8C95X0_INTSTATUS_(0) ... CY8C95X0_INTSTATUS_(7):
 	case CY8C95X0_INTMASK:
+	case CY8C95X0_SELPWM:
 	case CY8C95X0_INVERT:
-	case CY8C95X0_PWMSEL:
 	case CY8C95X0_DIRECTION:
 	case CY8C95X0_DRV_PU:
 	case CY8C95X0_DRV_PD:
 {
 	switch (reg) {
 	case CY8C95X0_INTMASK:
-	case CY8C95X0_PWMSEL:
+	case CY8C95X0_SELPWM:
 	case CY8C95X0_INVERT:
 	case CY8C95X0_DIRECTION:
 	case CY8C95X0_DRV_PU:
 	.max_register = 0,		/* Updated at runtime */
 	.num_reg_defaults_raw = 0,	/* Updated at runtime */
 	.use_single_read = true,	/* Workaround for regcache bug */
+#if IS_ENABLED(CONFIG_DEBUG_PINCTRL)
+	.disable_locking = false,
+#else
 	.disable_locking = true,
+#endif
 };
 static inline int cy8c95x0_regmap_update_bits_base(struct cy8c95x0_pinctrl *chip,
 		reg = CY8C95X0_DIRECTION;
 		break;
 	case PIN_CONFIG_MODE_PWM:
-		reg = CY8C95X0_PWMSEL;
+		reg = CY8C95X0_SELPWM;
 		break;
 	case PIN_CONFIG_OUTPUT:
 		reg = CY8C95X0_OUTPUT;
 		reg = CY8C95X0_DRV_PP_FAST;
 		break;
 	case PIN_CONFIG_MODE_PWM:
-		reg = CY8C95X0_PWMSEL;
+		reg = CY8C95X0_SELPWM;
 		break;
 	case PIN_CONFIG_OUTPUT_ENABLE:
 		return cy8c95x0_pinmux_direction(chip, off, !arg);
 	bitmap_zero(mask, MAX_LINE);
 	__set_bit(pin, mask);
-	if (cy8c95x0_read_regs_mask(chip, CY8C95X0_PWMSEL, pwm, mask)) {
+	if (cy8c95x0_read_regs_mask(chip, CY8C95X0_SELPWM, pwm, mask)) {
 		seq_puts(s, "not available");
 		return;
 	}
 	u8 port = cypress_get_port(chip, off);
 	u8 bit = cypress_get_pin_mask(chip, off);
-	return cy8c95x0_regmap_write_bits(chip, CY8C95X0_PWMSEL, port, bit, mode ? bit : 0);
+	return cy8c95x0_regmap_write_bits(chip, CY8C95X0_SELPWM, port, bit, mode ? bit : 0);
 }
 static int cy8c95x0_pinmux_mode(struct cy8c95x0_pinctrl *chip,
 	ret = devm_request_threaded_irq(chip->dev, irq,
 					NULL, cy8c95x0_irq_handler,
-					IRQF_ONESHOT | IRQF_SHARED | IRQF_TRIGGER_HIGH,
+					IRQF_ONESHOT | IRQF_SHARED,
 					dev_name(chip->dev), chip);
 	if (ret) {
 		dev_err(chip->dev, "failed to request irq %d\n", irq);
 	switch (chip->tpin) {
 	case 20:
 		strscpy(chip->name, cy8c95x0_id[0].name);
-		regmap_range_conf.range_max = CY8C95X0_VIRTUAL + 3 * MUXED_STRIDE;
+		regmap_range_conf.range_max = CY8C95X0_VIRTUAL + 3 * MUXED_STRIDE - 1;
 		break;
 	case 40:
 		strscpy(chip->name, cy8c95x0_id[1].name);
-		regmap_range_conf.range_max = CY8C95X0_VIRTUAL + 6 * MUXED_STRIDE;
+		regmap_range_conf.range_max = CY8C95X0_VIRTUAL + 6 * MUXED_STRIDE - 1;
 		break;
 	case 60:
 		strscpy(chip->name, cy8c95x0_id[2].name);
-		regmap_range_conf.range_max = CY8C95X0_VIRTUAL + 8 * MUXED_STRIDE;
+		regmap_range_conf.range_max = CY8C95X0_VIRTUAL + 8 * MUXED_STRIDE - 1;
 		break;
 	default:
 		return -ENODEV;

drivers/platform/x86/ideapad-laptop.c+1−1

@@ -1121,7 +1121,7 @@ static int ideapad_dytc_profile_init(struct ideapad_private *priv) · 1120 unmodified lines
1121		1121
1122	/* Create platform_profile structure and register */	1122	/* Create platform_profile structure and register */
1123	priv->dytc->ppdev = devm_platform_profile_register(&priv->platform_device->dev,	1123	priv->dytc->ppdev = devm_platform_profile_register(&priv->platform_device->dev,
1124	"ideapad-laptop", &priv->dytc,	1124	"ideapad-laptop", priv->dytc,
1125	&dytc_profile_ops);	1125	&dytc_profile_ops);
1126	if (IS_ERR(priv->dytc->ppdev)) {	1126	if (IS_ERR(priv->dytc->ppdev)) {
1127	err = PTR_ERR(priv->dytc->ppdev);	1127	err = PTR_ERR(priv->dytc->ppdev);

drivers/platform/x86/intel/ifs/ifs.h+4−5

  * IFS Image
  * ---------
  *
- * Intel provides a firmware file containing the scan tests via
+ * Intel provides firmware files containing the scan tests via the webpage [#f1]_.
- * github [#f1]_.  Similar to microcode there is a separate file for each
+ * Look under "In-Field Scan Test Images Download" section towards the
+ * end of the page. Similar to microcode, there are separate files for each
  * family-model-stepping. IFS Images are not applicable for some test types.
  * Wherever applicable the sysfs directory would provide a "current_batch" file
  * (see below) for loading the image.
  *
+ * .. [#f1] https://intel.com/InFieldScan
  *
  * IFS Image Loading
  * -----------------
  * 2) Hardware allows for some number of cores to be tested in parallel.
  * The driver does not make use of this, it only tests one core at a time.
  *
- * .. [#f1] https://github.com/intel/TBD
- *
- *
  * Structural Based Functional Test at Field (SBAF):
  * -------------------------------------------------
  *

drivers/platform/x86/intel/int3472/discrete.c+65−20

 /* Author: Dan Scally <djrscally@gmail.com> */
 #include <linux/acpi.h>
+#include <linux/array_size.h>
 #include <linux/bitfield.h>
 #include <linux/device.h>
 #include <linux/gpio/consumer.h>
 static int skl_int3472_fill_gpiod_lookup(struct gpiod_lookup *table_entry,
 					 struct acpi_resource_gpio *agpio,
-					 const char *func, u32 polarity)
+					 const char *func, unsigned long gpio_flags)
 {
 	char *path = agpio->resource_source.string_ptr;
 	struct acpi_device *adev;
 	if (!adev)
 		return -ENODEV;
-	*table_entry = GPIO_LOOKUP(acpi_dev_name(adev), agpio->pin_table[0], func, polarity);
+	*table_entry = GPIO_LOOKUP(acpi_dev_name(adev), agpio->pin_table[0], func, gpio_flags);
 	return 0;
 }
 static int skl_int3472_map_gpio_to_sensor(struct int3472_discrete_device *int3472,
 					  struct acpi_resource_gpio *agpio,
-					  const char *func, u32 polarity)
+					  const char *func, unsigned long gpio_flags)
 {
 	int ret;
 	}
 	ret = skl_int3472_fill_gpiod_lookup(&int3472->gpios.table[int3472->n_sensor_gpios],
-					    agpio, func, polarity);
+					    agpio, func, gpio_flags);
 	if (ret)
 		return ret;
 static struct gpio_desc *
 skl_int3472_gpiod_get_from_temp_lookup(struct int3472_discrete_device *int3472,
 				       struct acpi_resource_gpio *agpio,
-				       const char *func, u32 polarity)
+				       const char *func, unsigned long gpio_flags)
 {
 	struct gpio_desc *desc;
 	int ret;
 		return ERR_PTR(-ENOMEM);
 	lookup->dev_id = dev_name(int3472->dev);
-	ret = skl_int3472_fill_gpiod_lookup(&lookup->table[0], agpio, func, polarity);
+	ret = skl_int3472_fill_gpiod_lookup(&lookup->table[0], agpio, func, gpio_flags);
 	if (ret)
 		return ERR_PTR(ret);
 	return desc;
 }
-static void int3472_get_func_and_polarity(u8 type, const char **func, u32 *polarity)
+/**
+ * struct int3472_gpio_map - Map GPIOs to whatever is expected by the
+ * sensor driver (as in DT bindings)
+ * @hid: The ACPI HID of the device without the instance number e.g. INT347E
+ * @type_from: The GPIO type from ACPI ?SDT
+ * @type_to: The assigned GPIO type, typically same as @type_from
+ * @func: The function, e.g. "enable"
+ * @polarity_low: GPIO_ACTIVE_LOW true if the @polarity_low is true,
+ * GPIO_ACTIVE_HIGH otherwise
+ */
+struct int3472_gpio_map {
+	const char *hid;
+	u8 type_from;
+	u8 type_to;
+	bool polarity_low;
+	const char *func;
+};
+static const struct int3472_gpio_map int3472_gpio_map[] = {
+	{ "INT347E", INT3472_GPIO_TYPE_RESET, INT3472_GPIO_TYPE_RESET, false, "enable" },
+};
+static void int3472_get_func_and_polarity(struct acpi_device *adev, u8 *type,
+					  const char **func, unsigned long *gpio_flags)
 {
-	switch (type) {
+	unsigned int i;
+	for (i = 0; i < ARRAY_SIZE(int3472_gpio_map); i++) {
+		/*
+		 * Map the firmware-provided GPIO to whatever a driver expects
+		 * (as in DT bindings). First check if the type matches with the
+		 * GPIO map, then further check that the device _HID matches.
+		 */
+		if (*type != int3472_gpio_map[i].type_from)
+			continue;
+		if (!acpi_dev_hid_uid_match(adev, int3472_gpio_map[i].hid, NULL))
+			continue;
+		*type = int3472_gpio_map[i].type_to;
+		*gpio_flags = int3472_gpio_map[i].polarity_low ?
+			      GPIO_ACTIVE_LOW : GPIO_ACTIVE_HIGH;
+		*func = int3472_gpio_map[i].func;
+		return;
+	}
+	switch (*type) {
 	case INT3472_GPIO_TYPE_RESET:
 		*func = "reset";
-		*polarity = GPIO_ACTIVE_LOW;
+		*gpio_flags = GPIO_ACTIVE_LOW;
 		break;
 	case INT3472_GPIO_TYPE_POWERDOWN:
 		*func = "powerdown";
-		*polarity = GPIO_ACTIVE_LOW;
+		*gpio_flags = GPIO_ACTIVE_LOW;
 		break;
 	case INT3472_GPIO_TYPE_CLK_ENABLE:
 		*func = "clk-enable";
-		*polarity = GPIO_ACTIVE_HIGH;
+		*gpio_flags = GPIO_ACTIVE_HIGH;
 		break;
 	case INT3472_GPIO_TYPE_PRIVACY_LED:
 		*func = "privacy-led";
-		*polarity = GPIO_ACTIVE_HIGH;
+		*gpio_flags = GPIO_ACTIVE_HIGH;
 		break;
 	case INT3472_GPIO_TYPE_POWER_ENABLE:
 		*func = "power-enable";
-		*polarity = GPIO_ACTIVE_HIGH;
+		*gpio_flags = GPIO_ACTIVE_HIGH;
 		break;
 	default:
 		*func = "unknown";
-		*polarity = GPIO_ACTIVE_HIGH;
+		*gpio_flags = GPIO_ACTIVE_HIGH;
 		break;
 	}
 }
 	struct gpio_desc *gpio;
 	const char *err_msg;
 	const char *func;
-	u32 polarity;
+	unsigned long gpio_flags;
 	int ret;
 	if (!acpi_gpio_get_io_resource(ares, &agpio))
 	type = FIELD_GET(INT3472_GPIO_DSM_TYPE, obj->integer.value);
-	int3472_get_func_and_polarity(type, &func, &polarity);
+	int3472_get_func_and_polarity(int3472->sensor, &type, &func, &gpio_flags);
 	pin = FIELD_GET(INT3472_GPIO_DSM_PIN, obj->integer.value);
 	/* Pin field is not really used under Windows and wraps around at 8 bits */
 	active_value = FIELD_GET(INT3472_GPIO_DSM_SENSOR_ON_VAL, obj->integer.value);
 	if (!active_value)
-		polarity ^= GPIO_ACTIVE_LOW;
+		gpio_flags ^= GPIO_ACTIVE_LOW;
 	dev_dbg(int3472->dev, "%s %s pin %d active-%s\n", func,
 		agpio->resource_source.string_ptr, agpio->pin_table[0],
-		str_high_low(polarity == GPIO_ACTIVE_HIGH));
+		str_high_low(gpio_flags == GPIO_ACTIVE_HIGH));
 	switch (type) {
 	case INT3472_GPIO_TYPE_RESET:
 	case INT3472_GPIO_TYPE_POWERDOWN:
-		ret = skl_int3472_map_gpio_to_sensor(int3472, agpio, func, polarity);
+		ret = skl_int3472_map_gpio_to_sensor(int3472, agpio, func, gpio_flags);
 		if (ret)
 			err_msg = "Failed to map GPIO pin to sensor\n";
 	case INT3472_GPIO_TYPE_CLK_ENABLE:
 	case INT3472_GPIO_TYPE_PRIVACY_LED:
 	case INT3472_GPIO_TYPE_POWER_ENABLE:
-		gpio = skl_int3472_gpiod_get_from_temp_lookup(int3472, agpio, func, polarity);
+		gpio = skl_int3472_gpiod_get_from_temp_lookup(int3472, agpio, func, gpio_flags);
 		if (IS_ERR(gpio)) {
 			ret = PTR_ERR(gpio);
 			err_msg = "Failed to get GPIO\n";

drivers/platform/x86/intel/pmc/core.c+2−2

@@ -626,8 +626,8 @@ static u32 convert_ltr_scale(u32 val) · 625 unmodified lines
626	static int pmc_core_ltr_show(struct seq_file s, void unused)	626	static int pmc_core_ltr_show(struct seq_file s, void unused)
627	{	627	{
628	struct pmc_dev *pmcdev = s->private;	628	struct pmc_dev *pmcdev = s->private;
629	u64 decoded_snoop_ltr, decoded_non_snoop_ltr;	629	u64 decoded_snoop_ltr, decoded_non_snoop_ltr, val;
630	u32 ltr_raw_data, scale, val;	630	u32 ltr_raw_data, scale;
631	u16 snoop_ltr, nonsnoop_ltr;	631	u16 snoop_ltr, nonsnoop_ltr;
632	unsigned int i, index, ltr_index = 0;	632	unsigned int i, index, ltr_index = 0;
633		633

drivers/platform/x86/thinkpad_acpi.c+45−16

@@ -7885,6 +7885,7 @@ static struct ibm_struct volume_driver_data = { · 7884 unmodified lines
7885		7885
7886	#define FAN_NS_CTRL_STATUS BIT(2) /* Bit which determines control is enabled or not */	7886	#define FAN_NS_CTRL_STATUS BIT(2) /* Bit which determines control is enabled or not */
7887	#define FAN_NS_CTRL BIT(4) /* Bit which determines control is by host or EC */	7887	#define FAN_NS_CTRL BIT(4) /* Bit which determines control is by host or EC */
		7888	#define FAN_CLOCK_TPM (2250060) / Ticks per minute for a 22.5 kHz clock */
7888		7889
7889	enum { /* Fan control constants */	7890	enum { /* Fan control constants */
7890	fan_status_offset = 0x2f, /* EC register 0x2f */	7891	fan_status_offset = 0x2f, /* EC register 0x2f */
@@ -7940,6 +7941,7 @@ static int fan_watchdog_maxinterval; · 49 unmodified lines
7940		7941
7941	static bool fan_with_ns_addr;	7942	static bool fan_with_ns_addr;
7942	static bool ecfw_with_fan_dec_rpm;	7943	static bool ecfw_with_fan_dec_rpm;
		7944	static bool fan_speed_in_tpr;
7943		7945
7944	static struct mutex fan_mutex;	7946	static struct mutex fan_mutex;
7945		7947
@@ -8142,8 +8144,11 @@ static int fan_get_speed(unsigned int *speed) · 196 unmodified lines
8142	!acpi_ec_read(fan_rpm_offset + 1, &hi)))	8144	!acpi_ec_read(fan_rpm_offset + 1, &hi)))
8143	return -EIO;	8145	return -EIO;
8144		8146
8145	if (likely(speed))	8147	if (likely(speed)) {
8146	*speed = (hi << 8) \| lo;	8148	*speed = (hi << 8) \| lo;
		8149	if (fan_speed_in_tpr && *speed != 0)
		8150	speed = FAN_CLOCK_TPM / speed;
		8151	}
8147	break;	8152	break;
8148	case TPACPI_FAN_RD_TPEC_NS:	8153	case TPACPI_FAN_RD_TPEC_NS:
8149	if (!acpi_ec_read(fan_rpm_status_ns, &lo))	8154	if (!acpi_ec_read(fan_rpm_status_ns, &lo))
@@ -8176,8 +8181,11 @@ static int fan2_get_speed(unsigned int *speed) · 26 unmodified lines
8176	if (rc)	8181	if (rc)
8177	return -EIO;	8182	return -EIO;
8178		8183
8179	if (likely(speed))	8184	if (likely(speed)) {
8180	*speed = (hi << 8) \| lo;	8185	*speed = (hi << 8) \| lo;
		8186	if (fan_speed_in_tpr && *speed != 0)
		8187	speed = FAN_CLOCK_TPM / speed;
		8188	}
8181	break;	8189	break;
8182		8190
8183	case TPACPI_FAN_RD_TPEC_NS:	8191	case TPACPI_FAN_RD_TPEC_NS:
@@ -8788,6 +8796,7 @@ static const struct attribute_group fan_driver_attr_group = { · 604 unmodified lines
8788	#define TPACPI_FAN_NOFAN 0x0008 /* no fan available */	8796	#define TPACPI_FAN_NOFAN 0x0008 /* no fan available */
8789	#define TPACPI_FAN_NS 0x0010 /* For EC with non-Standard register addresses */	8797	#define TPACPI_FAN_NS 0x0010 /* For EC with non-Standard register addresses */
8790	#define TPACPI_FAN_DECRPM 0x0020 /* For ECFW's with RPM in register as decimal */	8798	#define TPACPI_FAN_DECRPM 0x0020 /* For ECFW's with RPM in register as decimal */
		8799	#define TPACPI_FAN_TPR 0x0040 /* Fan speed is in Ticks Per Revolution */
8791		8800
8792	static const struct tpacpi_quirk fan_quirk_table[] __initconst = {	8801	static const struct tpacpi_quirk fan_quirk_table[] __initconst = {
8793	TPACPI_QEC_IBM('1', 'Y', TPACPI_FAN_Q1),	8802	TPACPI_QEC_IBM('1', 'Y', TPACPI_FAN_Q1),
@@ -8817,6 +8826,7 @@ static const struct tpacpi_quirk fan_quirk_table[] __initconst = { · 23 unmodified lines
8817	TPACPI_Q_LNV3('R', '0', 'V', TPACPI_FAN_NS), /* 11e Gen5 KL-Y */	8826	TPACPI_Q_LNV3('R', '0', 'V', TPACPI_FAN_NS), /* 11e Gen5 KL-Y */
8818	TPACPI_Q_LNV3('N', '1', 'O', TPACPI_FAN_NOFAN), /* X1 Tablet (2nd gen) */	8827	TPACPI_Q_LNV3('N', '1', 'O', TPACPI_FAN_NOFAN), /* X1 Tablet (2nd gen) */
8819	TPACPI_Q_LNV3('R', '0', 'Q', TPACPI_FAN_DECRPM),/* L480 */	8828	TPACPI_Q_LNV3('R', '0', 'Q', TPACPI_FAN_DECRPM),/* L480 */
		8829	TPACPI_Q_LNV('8', 'F', TPACPI_FAN_TPR), /* ThinkPad x120e */
8820	};	8830	};
8821		8831
8822	static int __init fan_init(struct ibm_init_struct *iibm)	8832	static int __init fan_init(struct ibm_init_struct *iibm)
@@ -8887,6 +8897,8 @@ static int __init fan_init(struct ibm_init_struct *iibm) · 64 unmodified lines
8887		8897
8888	if (quirks & TPACPI_FAN_Q1)	8898	if (quirks & TPACPI_FAN_Q1)
8889	fan_quirk1_setup();	8899	fan_quirk1_setup();
		8900	if (quirks & TPACPI_FAN_TPR)
		8901	fan_speed_in_tpr = true;
8890	/* Try and probe the 2nd fan */	8902	/* Try and probe the 2nd fan */
8891	tp_features.second_fan = 1; /* needed for get_speed to work */	8903	tp_features.second_fan = 1; /* needed for get_speed to work */
8892	res = fan2_get_speed(&speed);	8904	res = fan2_get_speed(&speed);
@@ -10319,6 +10331,10 @@ static struct ibm_struct proxsensor_driver_data = { · 1426 unmodified lines
10319	#define DYTC_MODE_PSC_BALANCE 5 /* Default mode aka balanced */	10331	#define DYTC_MODE_PSC_BALANCE 5 /* Default mode aka balanced */
10320	#define DYTC_MODE_PSC_PERFORM 7 /* High power mode aka performance */	10332	#define DYTC_MODE_PSC_PERFORM 7 /* High power mode aka performance */
10321		10333
		10334	#define DYTC_MODE_PSCV9_LOWPOWER 1 /* Low power mode */
		10335	#define DYTC_MODE_PSCV9_BALANCE 3 /* Default mode aka balanced */
		10336	#define DYTC_MODE_PSCV9_PERFORM 4 /* High power mode aka performance */
		10337
10322	#define DYTC_ERR_MASK 0xF /* Bits 0-3 in cmd result are the error result */	10338	#define DYTC_ERR_MASK 0xF /* Bits 0-3 in cmd result are the error result */
10323	#define DYTC_ERR_SUCCESS 1 /* CMD completed successful */	10339	#define DYTC_ERR_SUCCESS 1 /* CMD completed successful */
10324		10340
@@ -10339,6 +10355,10 @@ static int dytc_capabilities; · 14 unmodified lines
10339	static bool dytc_mmc_get_available;	10355	static bool dytc_mmc_get_available;
10340	static int profile_force;	10356	static int profile_force;
10341		10357
		10358	static int platform_psc_profile_lowpower = DYTC_MODE_PSC_LOWPOWER;
		10359	static int platform_psc_profile_balanced = DYTC_MODE_PSC_BALANCE;
		10360	static int platform_psc_profile_performance = DYTC_MODE_PSC_PERFORM;
		10361
10342	static int convert_dytc_to_profile(int funcmode, int dytcmode,	10362	static int convert_dytc_to_profile(int funcmode, int dytcmode,
10343	enum platform_profile_option *profile)	10363	enum platform_profile_option *profile)
10344	{	10364	{
@@ -10360,19 +10380,15 @@ static int convert_dytc_to_profile(int funcmode, int dytcmode, · 15 unmodified lines
10360	}	10380	}
10361	return 0;	10381	return 0;
10362	case DYTC_FUNCTION_PSC:	10382	case DYTC_FUNCTION_PSC:
10363	switch (dytcmode) {	10383	if (dytcmode == platform_psc_profile_lowpower)
10364	case DYTC_MODE_PSC_LOWPOWER:
10365	*profile = PLATFORM_PROFILE_LOW_POWER;	10384	*profile = PLATFORM_PROFILE_LOW_POWER;
10366	break;	10385	else if (dytcmode == platform_psc_profile_balanced)
10367	case DYTC_MODE_PSC_BALANCE:
10368	*profile = PLATFORM_PROFILE_BALANCED;	10386	*profile = PLATFORM_PROFILE_BALANCED;
10369	break;	10387	else if (dytcmode == platform_psc_profile_performance)
10370	case DYTC_MODE_PSC_PERFORM:
10371	*profile = PLATFORM_PROFILE_PERFORMANCE;	10388	*profile = PLATFORM_PROFILE_PERFORMANCE;
10372	break;	10389	else
10373	default: /* Unknown mode */
10374	return -EINVAL;	10390	return -EINVAL;
10375	}	10391
10376	return 0;	10392	return 0;
10377	case DYTC_FUNCTION_AMT:	10393	case DYTC_FUNCTION_AMT:
10378	/* For now return balanced. It's the closest we have to 'auto' */	10394	/* For now return balanced. It's the closest we have to 'auto' */
@@ -10393,19 +10409,19 @@ static int convert_profile_to_dytc(enum platform_profile_option profile, int *pe · 14 unmodified lines
10393	if (dytc_capabilities & BIT(DYTC_FC_MMC))	10409	if (dytc_capabilities & BIT(DYTC_FC_MMC))
10394	*perfmode = DYTC_MODE_MMC_LOWPOWER;	10410	*perfmode = DYTC_MODE_MMC_LOWPOWER;
10395	else if (dytc_capabilities & BIT(DYTC_FC_PSC))	10411	else if (dytc_capabilities & BIT(DYTC_FC_PSC))
10396	*perfmode = DYTC_MODE_PSC_LOWPOWER;	10412	*perfmode = platform_psc_profile_lowpower;
10397	break;	10413	break;
10398	case PLATFORM_PROFILE_BALANCED:	10414	case PLATFORM_PROFILE_BALANCED:
10399	if (dytc_capabilities & BIT(DYTC_FC_MMC))	10415	if (dytc_capabilities & BIT(DYTC_FC_MMC))
10400	*perfmode = DYTC_MODE_MMC_BALANCE;	10416	*perfmode = DYTC_MODE_MMC_BALANCE;
10401	else if (dytc_capabilities & BIT(DYTC_FC_PSC))	10417	else if (dytc_capabilities & BIT(DYTC_FC_PSC))
10402	*perfmode = DYTC_MODE_PSC_BALANCE;	10418	*perfmode = platform_psc_profile_balanced;
10403	break;	10419	break;
10404	case PLATFORM_PROFILE_PERFORMANCE:	10420	case PLATFORM_PROFILE_PERFORMANCE:
10405	if (dytc_capabilities & BIT(DYTC_FC_MMC))	10421	if (dytc_capabilities & BIT(DYTC_FC_MMC))
10406	*perfmode = DYTC_MODE_MMC_PERFORM;	10422	*perfmode = DYTC_MODE_MMC_PERFORM;
10407	else if (dytc_capabilities & BIT(DYTC_FC_PSC))	10423	else if (dytc_capabilities & BIT(DYTC_FC_PSC))
10408	*perfmode = DYTC_MODE_PSC_PERFORM;	10424	*perfmode = platform_psc_profile_performance;
10409	break;	10425	break;
10410	default: /* Unknown profile */	10426	default: /* Unknown profile */
10411	return -EOPNOTSUPP;	10427	return -EOPNOTSUPP;
@@ -10599,6 +10615,7 @@ static int tpacpi_dytc_profile_init(struct ibm_init_struct *iibm) · 187 unmodified lines
10599	if (output & BIT(DYTC_QUERY_ENABLE_BIT))	10615	if (output & BIT(DYTC_QUERY_ENABLE_BIT))
10600	dytc_version = (output >> DYTC_QUERY_REV_BIT) & 0xF;	10616	dytc_version = (output >> DYTC_QUERY_REV_BIT) & 0xF;
10601		10617
		10618	dbg_printk(TPACPI_DBG_INIT, "DYTC version %d\n", dytc_version);
10602	/* Check DYTC is enabled and supports mode setting */	10619	/* Check DYTC is enabled and supports mode setting */
10603	if (dytc_version < 5)	10620	if (dytc_version < 5)
10604	return -ENODEV;	10621	return -ENODEV;
@@ -10637,6 +10654,11 @@ static int tpacpi_dytc_profile_init(struct ibm_init_struct *iibm) · 32 unmodified lines
10637	}	10654	}
10638	} else if (dytc_capabilities & BIT(DYTC_FC_PSC)) { /* PSC MODE */	10655	} else if (dytc_capabilities & BIT(DYTC_FC_PSC)) { /* PSC MODE */
10639	pr_debug("PSC is supported\n");	10656	pr_debug("PSC is supported\n");
		10657	if (dytc_version >= 9) { /* update profiles for DYTC 9 and up */
		10658	platform_psc_profile_lowpower = DYTC_MODE_PSCV9_LOWPOWER;
		10659	platform_psc_profile_balanced = DYTC_MODE_PSCV9_BALANCE;
		10660	platform_psc_profile_performance = DYTC_MODE_PSCV9_PERFORM;
		10661	}
10640	} else {	10662	} else {
10641	dbg_printk(TPACPI_DBG_INIT, "No DYTC support available\n");	10663	dbg_printk(TPACPI_DBG_INIT, "No DYTC support available\n");
10642	return -ENODEV;	10664	return -ENODEV;
@@ -10646,8 +10668,8 @@ static int tpacpi_dytc_profile_init(struct ibm_init_struct *iibm) · 3 unmodified lines
10646	"DYTC version %d: thermal mode available\n", dytc_version);	10668	"DYTC version %d: thermal mode available\n", dytc_version);
10647		10669
10648	/* Create platform_profile structure and register */	10670	/* Create platform_profile structure and register */
10649	tpacpi_pprof = devm_platform_profile_register(&tpacpi_pdev->dev, "thinkpad-acpi",	10671	tpacpi_pprof = platform_profile_register(&tpacpi_pdev->dev, "thinkpad-acpi-profile",
10650	NULL, &dytc_profile_ops);	10672	NULL, &dytc_profile_ops);
10651	/*	10673	/*
10652	* If for some reason platform_profiles aren't enabled	10674	* If for some reason platform_profiles aren't enabled
10653	* don't quit terminally.	10675	* don't quit terminally.
@@ -10665,8 +10687,15 @@ static int tpacpi_dytc_profile_init(struct ibm_init_struct *iibm) · 11 unmodified lines
10665	return 0;	10687	return 0;
10666	}	10688	}
10667		10689
		10690	static void dytc_profile_exit(void)
		10691	{
		10692	if (!IS_ERR_OR_NULL(tpacpi_pprof))
		10693	platform_profile_remove(tpacpi_pprof);
		10694	}
		10695
10668	static struct ibm_struct dytc_profile_driver_data = {	10696	static struct ibm_struct dytc_profile_driver_data = {
10669	.name = "dytc-profile",	10697	.name = "dytc-profile",
		10698	.exit = dytc_profile_exit,
10670	};	10699	};
10671		10700
10672	/*************************************************************************	10701	/*************************************************************************

drivers/powercap/powercap_sys.c+1−2

 	dev_set_name(&control_type->dev, "%s", name);
 	result = device_register(&control_type->dev);
 	if (result) {
-		if (control_type->allocated)
+		put_device(&control_type->dev);
-			kfree(control_type);
 		return ERR_PTR(result);
 	}
 	idr_init(&control_type->idr);

drivers/ptp/ptp_vmclock.c+21−26

@@ -414,16 +414,16 @@ static ssize_t vmclock_miscdev_read(struct file fp, char __user buf, · 413 unmodified lines
414	}	414	}
415		415
416	static const struct file_operations vmclock_miscdev_fops = {	416	static const struct file_operations vmclock_miscdev_fops = {
		417	.owner = THIS_MODULE,
417	.mmap = vmclock_miscdev_mmap,	418	.mmap = vmclock_miscdev_mmap,
418	.read = vmclock_miscdev_read,	419	.read = vmclock_miscdev_read,
419	};	420	};
420		421
421	/* module operations */	422	/* module operations */
422		423
423	static void vmclock_remove(struct platform_device *pdev)	424	static void vmclock_remove(void *data)
424	{	425	{
425	struct device *dev = &pdev->dev;	426	struct vmclock_state *st = data;
426	struct vmclock_state *st = dev_get_drvdata(dev);
427		427
428	if (st->ptp_clock)	428	if (st->ptp_clock)
429	ptp_clock_unregister(st->ptp_clock);	429	ptp_clock_unregister(st->ptp_clock);
@@ -506,14 +506,13 @@ static int vmclock_probe(struct platform_device *pdev) · 76 unmodified lines
506		506
507	if (ret) {	507	if (ret) {
508	dev_info(dev, "Failed to obtain physical address: %d\n", ret);	508	dev_info(dev, "Failed to obtain physical address: %d\n", ret);
509	goto out;	509	return ret;
510	}	510	}
511		511
512	if (resource_size(&st->res) < VMCLOCK_MIN_SIZE) {	512	if (resource_size(&st->res) < VMCLOCK_MIN_SIZE) {
513	dev_info(dev, "Region too small (0x%llx)\n",	513	dev_info(dev, "Region too small (0x%llx)\n",
514	resource_size(&st->res));	514	resource_size(&st->res));
515	ret = -EINVAL;	515	return -EINVAL;
516	goto out;
517	}	516	}
518	st->clk = devm_memremap(dev, st->res.start, resource_size(&st->res),	517	st->clk = devm_memremap(dev, st->res.start, resource_size(&st->res),
519	MEMREMAP_WB \| MEMREMAP_DEC);	518	MEMREMAP_WB \| MEMREMAP_DEC);
@@ -521,31 +520,34 @@ static int vmclock_probe(struct platform_device *pdev) · 1 unmodified line
521	ret = PTR_ERR(st->clk);	520	ret = PTR_ERR(st->clk);
522	dev_info(dev, "failed to map shared memory\n");	521	dev_info(dev, "failed to map shared memory\n");
523	st->clk = NULL;	522	st->clk = NULL;
524	goto out;	523	return ret;
525	}	524	}
526		525
527	if (le32_to_cpu(st->clk->magic) != VMCLOCK_MAGIC \|\|	526	if (le32_to_cpu(st->clk->magic) != VMCLOCK_MAGIC \|\|
528	le32_to_cpu(st->clk->size) > resource_size(&st->res) \|\|	527	le32_to_cpu(st->clk->size) > resource_size(&st->res) \|\|
529	le16_to_cpu(st->clk->version) != 1) {	528	le16_to_cpu(st->clk->version) != 1) {
530	dev_info(dev, "vmclock magic fields invalid\n");	529	dev_info(dev, "vmclock magic fields invalid\n");
531	ret = -EINVAL;	530	return -EINVAL;
532	goto out;
533	}	531	}
534		532
535	ret = ida_alloc(&vmclock_ida, GFP_KERNEL);	533	ret = ida_alloc(&vmclock_ida, GFP_KERNEL);
536	if (ret < 0)	534	if (ret < 0)
537	goto out;	535	return ret;
538		536
539	st->index = ret;	537	st->index = ret;
540	ret = devm_add_action_or_reset(&pdev->dev, vmclock_put_idx, st);	538	ret = devm_add_action_or_reset(&pdev->dev, vmclock_put_idx, st);
541	if (ret)	539	if (ret)
542	goto out;	540	return ret;
543		541
544	st->name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "vmclock%d", st->index);	542	st->name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "vmclock%d", st->index);
545	if (!st->name) {	543	if (!st->name)
546	ret = -ENOMEM;	544	return -ENOMEM;
547	goto out;	545
548	}	546	st->miscdev.minor = MISC_DYNAMIC_MINOR;
		547
		548	ret = devm_add_action_or_reset(&pdev->dev, vmclock_remove, st);
		549	if (ret)
		550	return ret;
549		551
550	/*	552	/*
551	* If the structure is big enough, it can be mapped to userspace.	553	* If the structure is big enough, it can be mapped to userspace.
@@ -554,13 +556,12 @@ static int vmclock_probe(struct platform_device *pdev) · 2 unmodified lines
554	* cross that bridge if/when we come to it.	556	* cross that bridge if/when we come to it.
555	*/	557	*/
556	if (le32_to_cpu(st->clk->size) >= PAGE_SIZE) {	558	if (le32_to_cpu(st->clk->size) >= PAGE_SIZE) {
557	st->miscdev.minor = MISC_DYNAMIC_MINOR;
558	st->miscdev.fops = &vmclock_miscdev_fops;	559	st->miscdev.fops = &vmclock_miscdev_fops;
559	st->miscdev.name = st->name;	560	st->miscdev.name = st->name;
560		561
561	ret = misc_register(&st->miscdev);	562	ret = misc_register(&st->miscdev);
562	if (ret)	563	if (ret)
563	goto out;	564	return ret;
564	}	565	}
565		566
566	/* If there is valid clock information, register a PTP clock */	567	/* If there is valid clock information, register a PTP clock */
@@ -570,16 +571,14 @@ static int vmclock_probe(struct platform_device *pdev) · 3 unmodified lines
570	if (IS_ERR(st->ptp_clock)) {	571	if (IS_ERR(st->ptp_clock)) {
571	ret = PTR_ERR(st->ptp_clock);	572	ret = PTR_ERR(st->ptp_clock);
572	st->ptp_clock = NULL;	573	st->ptp_clock = NULL;
573	vmclock_remove(pdev);	574	return ret;
574	goto out;
575	}	575	}
576	}	576	}
577		577
578	if (!st->miscdev.minor && !st->ptp_clock) {	578	if (!st->miscdev.minor && !st->ptp_clock) {
579	/* Neither miscdev nor PTP registered */	579	/* Neither miscdev nor PTP registered */
580	dev_info(dev, "vmclock: Neither miscdev nor PTP available; not registering\n");	580	dev_info(dev, "vmclock: Neither miscdev nor PTP available; not registering\n");
581	ret = -ENODEV;	581	return -ENODEV;
582	goto out;
583	}	582	}
584		583
585	dev_info(dev, "%s: registered %s%s%s\n", st->name,	584	dev_info(dev, "%s: registered %s%s%s\n", st->name,
@@ -587,10 +586,7 @@ static int vmclock_probe(struct platform_device *pdev) · 1 unmodified line
587	(st->miscdev.minor && st->ptp_clock) ? ", " : "",	586	(st->miscdev.minor && st->ptp_clock) ? ", " : "",
588	st->ptp_clock ? "PTP" : "");	587	st->ptp_clock ? "PTP" : "");
589		588
590	dev_set_drvdata(dev, st);	589	return 0;
591
592	out:
593	return ret;
594	}	590	}
595		591
596	static const struct acpi_device_id vmclock_acpi_ids[] = {	592	static const struct acpi_device_id vmclock_acpi_ids[] = {
@@ -601,7 +597,6 @@ MODULE_DEVICE_TABLE(acpi, vmclock_acpi_ids); · 4 unmodified lines
601		597
602	static struct platform_driver vmclock_platform_driver = {	598	static struct platform_driver vmclock_platform_driver = {
603	.probe = vmclock_probe,	599	.probe = vmclock_probe,
604	.remove = vmclock_remove,
605	.driver = {	600	.driver = {
606	.name = "vmclock",	601	.name = "vmclock",
607	.acpi_match_table = vmclock_acpi_ids,	602	.acpi_match_table = vmclock_acpi_ids,

drivers/regulator/core.c+27−34

 		goto clean;
 	}
-	if (config->init_data) {
+	/*
-		/*
+	 * DT may override the config->init_data provided if the platform
-		 * Providing of_match means the framework is expected to parse
+	 * needs to do so. If so, config->init_data is completely ignored.
-		 * DT to get the init_data. This would conflict with provided
+	 */
-		 * init_data, if set. Warn if it happens.
+	init_data = regulator_of_get_init_data(dev, regulator_desc, config,
-		 */
+					       &rdev->dev.of_node);
-		if (regulator_desc->of_match)
-			dev_warn(dev, "Using provided init data - OF match ignored\n");
+	/*
+	 * Sometimes not all resources are probed already so we need to take
+	 * that into account. This happens most the time if the ena_gpiod comes
+	 * from a gpio extender or something else.
+	 */
+	if (PTR_ERR(init_data) == -EPROBE_DEFER) {
+		ret = -EPROBE_DEFER;
+		goto clean;
+	}
+	/*
+	 * We need to keep track of any GPIO descriptor coming from the
+	 * device tree until we have handled it over to the core. If the
+	 * config that was passed in to this function DOES NOT contain
+	 * a descriptor, and the config after this call DOES contain
+	 * a descriptor, we definitely got one from parsing the device
+	 * tree.
+	 */
+	if (!cfg->ena_gpiod && config->ena_gpiod)
+		dangling_of_gpiod = true;
+	if (!init_data) {
 		init_data = config->init_data;
 		rdev->dev.of_node = of_node_get(config->of_node);
-	} else {
-		init_data = regulator_of_get_init_data(dev, regulator_desc,
-						       config,
-						       &rdev->dev.of_node);
-		/*
-		 * Sometimes not all resources are probed already so we need to
-		 * take that into account. This happens most the time if the
-		 * ena_gpiod comes from a gpio extender or something else.
-		 */
-		if (PTR_ERR(init_data) == -EPROBE_DEFER) {
-			ret = -EPROBE_DEFER;
-			goto clean;
-		}
-		/*
-		 * We need to keep track of any GPIO descriptor coming from the
-		 * device tree until we have handled it over to the core. If the
-		 * config that was passed in to this function DOES NOT contain a
-		 * descriptor, and the config after this call DOES contain a
-		 * descriptor, we definitely got one from parsing the device
-		 * tree.
-		 */
-		if (!cfg->ena_gpiod && config->ena_gpiod)
-			dangling_of_gpiod = true;
 	}
 	ww_mutex_init(&rdev->mutex, &regulator_ww_class);

drivers/s390/cio/chp.c+2−1

@@ -695,7 +695,8 @@ static int info_update(void) · 694 unmodified lines
695	if (time_after(jiffies, chp_info_expires)) {	695	if (time_after(jiffies, chp_info_expires)) {
696	/* Data is too old, update. */	696	/* Data is too old, update. */
697	rc = sclp_chp_read_info(&chp_info);	697	rc = sclp_chp_read_info(&chp_info);
698	chp_info_expires = jiffies + CHP_INFO_UPDATE_INTERVAL ;	698	if (!rc)
		699	chp_info_expires = jiffies + CHP_INFO_UPDATE_INTERVAL;
699	}	700	}
700	mutex_unlock(&info_lock);	701	mutex_unlock(&info_lock);
701		702

drivers/s390/net/ism_drv.c+12−2

 	return ret;
 }
+static void ism_dev_release(struct device *dev)
+{
+	struct ism_dev *ism;
+	ism = container_of(dev, struct ism_dev, dev);
+	kfree(ism);
+}
 static int ism_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
 	struct ism_dev *ism;
 	dev_set_drvdata(&pdev->dev, ism);
 	ism->pdev = pdev;
 	ism->dev.parent = &pdev->dev;
+	ism->dev.release = ism_dev_release;
 	device_initialize(&ism->dev);
 	dev_set_name(&ism->dev, dev_name(&pdev->dev));
 	ret = device_add(&ism->dev);
 	device_del(&ism->dev);
 err_dev:
 	dev_set_drvdata(&pdev->dev, NULL);
-	kfree(ism);
+	put_device(&ism->dev);
 	return ret;
 }
 	pci_disable_device(pdev);
 	device_del(&ism->dev);
 	dev_set_drvdata(&pdev->dev, NULL);
-	kfree(ism);
+	put_device(&ism->dev);
 }
 static struct pci_driver ism_driver = {

drivers/s390/net/qeth_core_main.c+5−3

 	card->data.state = CH_STATE_UP;
 	netif_tx_start_all_queues(dev);
-	local_bh_disable();
 	qeth_for_each_output_queue(card, queue, i) {
 		netif_napi_add_tx(dev, &queue->napi, qeth_tx_poll);
 		napi_enable(&queue->napi);
-		napi_schedule(&queue->napi);
 	}
 	napi_enable(&card->napi);
+	local_bh_disable();
+	qeth_for_each_output_queue(card, queue, i) {
+		napi_schedule(&queue->napi);
+	}
 	napi_schedule(&card->napi);
 	/* kick-start the NAPI softirq: */
 	local_bh_enable();

drivers/scsi/qla1280.c+1−1

@@ -2867,7 +2867,7 @@ qla1280_64bit_start_scsi(struct scsi_qla_host ha, struct srb sp) · 2866 unmodified lines
2867	dprintk(3, "S/G Segment phys_addr=%x %x, len=0x%x\n",	2867	dprintk(3, "S/G Segment phys_addr=%x %x, len=0x%x\n",
2868	cpu_to_le32(upper_32_bits(dma_handle)),	2868	cpu_to_le32(upper_32_bits(dma_handle)),
2869	cpu_to_le32(lower_32_bits(dma_handle)),	2869	cpu_to_le32(lower_32_bits(dma_handle)),
2870	cpu_to_le32(sg_dma_len(sg_next(s))));	2870	cpu_to_le32(sg_dma_len(s)));
2871	remseg--;	2871	remseg--;
2872	}	2872	}
2873	dprintk(5, "qla1280_64bit_start_scsi: Scatter/gather "	2873	dprintk(5, "qla1280_64bit_start_scsi: Scatter/gather "

drivers/scsi/scsi_lib.c+7−2

 				case 0x1a: /* start stop unit in progress */
 				case 0x1b: /* sanitize in progress */
 				case 0x1d: /* configuration in progress */
-				case 0x24: /* depopulation in progress */
-				case 0x25: /* depopulation restore in progress */
 					action = ACTION_DELAYED_RETRY;
 					break;
 				case 0x0a: /* ALUA state transition */
 					action = ACTION_DELAYED_REPREP;
 					break;
+				/*
+				 * Depopulation might take many hours,
+				 * thus it is not worthwhile to retry.
+				 */
+				case 0x24: /* depopulation in progress */
+				case 0x25: /* depopulation restore in progress */
+					fallthrough;
 				default:
 					action = ACTION_FAIL;
 					break;

drivers/scsi/scsi_lib_test.c+7−0

@@ -67,6 +67,13 @@ static void scsi_lib_test_multiple_sense(struct kunit *test) · 66 unmodified lines
67	};	67	};
68	int i;	68	int i;
69		69
		70	/* Success */
		71	sc.result = 0;
		72	KUNIT_EXPECT_EQ(test, 0, scsi_check_passthrough(&sc, &failures));
		73	KUNIT_EXPECT_EQ(test, 0, scsi_check_passthrough(&sc, NULL));
		74	/* Command failed but caller did not pass in a failures array */
		75	scsi_build_sense(&sc, 0, ILLEGAL_REQUEST, 0x91, 0x36);
		76	KUNIT_EXPECT_EQ(test, 0, scsi_check_passthrough(&sc, NULL));
70	/* Match end of array */	77	/* Match end of array */
71	scsi_build_sense(&sc, 0, ILLEGAL_REQUEST, 0x91, 0x36);	78	scsi_build_sense(&sc, 0, ILLEGAL_REQUEST, 0x91, 0x36);
72	KUNIT_EXPECT_EQ(test, -EAGAIN, scsi_check_passthrough(&sc, &failures));	79	KUNIT_EXPECT_EQ(test, -EAGAIN, scsi_check_passthrough(&sc, &failures));

drivers/scsi/scsi_scan.c+1−1

@@ -246,7 +246,7 @@ static int scsi_realloc_sdev_budget_map(struct scsi_device *sdev, · 245 unmodified lines
246	}	246	}
247	ret = sbitmap_init_node(&sdev->budget_map,	247	ret = sbitmap_init_node(&sdev->budget_map,
248	scsi_device_max_queue_depth(sdev),	248	scsi_device_max_queue_depth(sdev),
249	new_shift, GFP_KERNEL,	249	new_shift, GFP_NOIO,
250	sdev->request_queue->node, false, true);	250	sdev->request_queue->node, false, true);
251	if (!ret)	251	if (!ret)
252	sbitmap_resize(&sdev->budget_map, depth);	252	sbitmap_resize(&sdev->budget_map, depth);

drivers/scsi/storvsc_drv.c+1−0

@@ -1800,6 +1800,7 @@ static int storvsc_queuecommand(struct Scsi_Host host, struct scsi_cmnd scmnd) · 1799 unmodified lines
1800		1800
1801	length = scsi_bufflen(scmnd);	1801	length = scsi_bufflen(scmnd);
1802	payload = (struct vmbus_packet_mpb_array *)&cmd_request->mpb;	1802	payload = (struct vmbus_packet_mpb_array *)&cmd_request->mpb;
		1803	payload->range.len = 0;
1803	payload_sz = 0;	1804	payload_sz = 0;
1804		1805
1805	if (scsi_sg_count(scmnd)) {	1806	if (scsi_sg_count(scmnd)) {

drivers/soc/qcom/smp2p.c+1−1

@@ -365,7 +365,7 @@ static void smp2p_irq_print_chip(struct irq_data irqd, struct seq_file p) · 364 unmodified lines
365	{	365	{
366	struct smp2p_entry *entry = irq_data_get_irq_chip_data(irqd);	366	struct smp2p_entry *entry = irq_data_get_irq_chip_data(irqd);
367		367
368	seq_printf(p, " %8s", dev_name(entry->smp2p->dev));	368	seq_printf(p, "%8s", dev_name(entry->smp2p->dev));
369	}	369	}
370		370
371	static struct irq_chip smp2p_irq_chip = {	371	static struct irq_chip smp2p_irq_chip = {

drivers/spi/atmel-quadspi.c+2−2

@@ -235,8 +235,8 @@ · 234 unmodified lines
235	/**	235	/**
236	* struct atmel_qspi_pcal - Pad Calibration Clock Division	236	* struct atmel_qspi_pcal - Pad Calibration Clock Division
237	* @pclk_rate: peripheral clock rate.	237	* @pclk_rate: peripheral clock rate.
238	* @pclkdiv: calibration clock division. The clock applied to the calibration	238	* @pclk_div: calibration clock division. The clock applied to the calibration
239	* cell is divided by pclkdiv + 1.	239	* cell is divided by pclk_div + 1.
240	*/	240	*/
241	struct atmel_qspi_pcal {	241	struct atmel_qspi_pcal {
242	u32 pclk_rate;	242	u32 pclk_rate;

drivers/spi/spi-pxa2xx.c+1−1

@@ -399,7 +399,7 @@ static void lpss_ssp_cs_control(struct spi_device *spi, bool enable) · 398 unmodified lines
399	lpss_ssp_select_cs(spi, config);	399	lpss_ssp_select_cs(spi, config);
400		400
401	mask = LPSS_CS_CONTROL_CS_HIGH;	401	mask = LPSS_CS_CONTROL_CS_HIGH;
402	__lpss_ssp_update_priv(drv_data, config->reg_cs_ctrl, mask, enable ? mask : 0);	402	__lpss_ssp_update_priv(drv_data, config->reg_cs_ctrl, mask, enable ? 0 : mask);
403	if (config->cs_clk_stays_gated) {	403	if (config->cs_clk_stays_gated) {
404	/*	404	/*
405	* Changing CS alone when dynamic clock gating is on won't	405	* Changing CS alone when dynamic clock gating is on won't

drivers/spi/spi-sn-f-ospi.c+3−0

@@ -116,6 +116,9 @@ struct f_ospi { · 115 unmodified lines
116		116
117	static u32 f_ospi_get_dummy_cycle(const struct spi_mem_op *op)	117	static u32 f_ospi_get_dummy_cycle(const struct spi_mem_op *op)
118	{	118	{
		119	if (!op->dummy.nbytes)
		120	return 0;
		121
119	return (op->dummy.nbytes * 8) / op->dummy.buswidth;	122	return (op->dummy.nbytes * 8) / op->dummy.buswidth;
120	}	123	}
121		124

drivers/target/target_core_stat.c+2−2

@@ -117,9 +117,9 @@ static ssize_t target_stat_tgt_status_show(struct config_item *item, · 116 unmodified lines
117	char *page)	117	char *page)
118	{	118	{
119	if (to_stat_tgt_dev(item)->export_count)	119	if (to_stat_tgt_dev(item)->export_count)
120	return snprintf(page, PAGE_SIZE, "activated");	120	return snprintf(page, PAGE_SIZE, "activated\n");
121	else	121	else
122	return snprintf(page, PAGE_SIZE, "deactivated");	122	return snprintf(page, PAGE_SIZE, "deactivated\n");
123	}	123	}
124		124
125	static ssize_t target_stat_tgt_non_access_lus_show(struct config_item *item,	125	static ssize_t target_stat_tgt_non_access_lus_show(struct config_item *item,

drivers/thermal/cpufreq_cooling.c+0−2

  * @max_level: maximum cooling level. One less than total number of valid
  *	cpufreq frequencies.
  * @em: Reference on the Energy Model of the device
- * @cdev: thermal_cooling_device pointer to keep track of the
- *	registered cooling device.
  * @policy: cpufreq policy.
  * @cooling_ops: cpufreq callbacks to thermal cooling device ops
  * @idle_time: idle time stats

drivers/tty/pty.c+1−1

@@ -798,7 +798,7 @@ static int ptmx_open(struct inode inode, struct file filp) · 797 unmodified lines
798	nonseekable_open(inode, filp);	798	nonseekable_open(inode, filp);
799		799
800	/* We refuse fsnotify events on ptmx, since it's a shared resource */	800	/* We refuse fsnotify events on ptmx, since it's a shared resource */
801	filp->f_mode \|= FMODE_NONOTIFY;	801	file_set_fsnotify_mode(filp, FMODE_NONOTIFY);
802		802
803	retval = tty_alloc_file(filp);	803	retval = tty_alloc_file(filp);
804	if (retval)	804	if (retval)

drivers/tty/serial/8250/8250.h+2−0

 #ifdef CONFIG_SERIAL_8250_DMA
 extern int serial8250_tx_dma(struct uart_8250_port *);
+extern void serial8250_tx_dma_flush(struct uart_8250_port *);
 extern int serial8250_rx_dma(struct uart_8250_port *);
 extern void serial8250_rx_dma_flush(struct uart_8250_port *);
 extern int serial8250_request_dma(struct uart_8250_port *);
 {
 	return -1;
 }
+static inline void serial8250_tx_dma_flush(struct uart_8250_port *p) { }
 static inline int serial8250_rx_dma(struct uart_8250_port *p)
 {
 	return -1;

drivers/tty/serial/8250/8250_dma.c+16−0

@@ -149,6 +149,22 @@ err: · 148 unmodified lines
149	return ret;	149	return ret;
150	}	150	}
151		151
		152	void serial8250_tx_dma_flush(struct uart_8250_port *p)
		153	{
		154	struct uart_8250_dma *dma = p->dma;
		155
		156	if (!dma->tx_running)
		157	return;
		158
		159	/*
		160	* kfifo_reset() has been called by the serial core, avoid
		161	* advancing and underflowing in __dma_tx_complete().
		162	*/
		163	dma->tx_size = 0;
		164
		165	dmaengine_terminate_async(dma->rxchan);
		166	}
		167
152	int serial8250_rx_dma(struct uart_8250_port *p)	168	int serial8250_rx_dma(struct uart_8250_port *p)
153	{	169	{
154	struct uart_8250_dma *dma = p->dma;	170	struct uart_8250_dma *dma = p->dma;

drivers/tty/serial/8250/8250_of.c+0−1

@@ -110,7 +110,6 @@ static int of_platform_serial_setup(struct platform_device *ofdev, · 109 unmodified lines
110	spin_lock_init(&port->lock);	110	spin_lock_init(&port->lock);
111		111
112	if (resource_type(&resource) == IORESOURCE_IO) {	112	if (resource_type(&resource) == IORESOURCE_IO) {
113	port->iotype = UPIO_PORT;
114	port->iobase = resource.start;	113	port->iobase = resource.start;
115	} else {	114	} else {
116	port->mapbase = resource.start;	115	port->mapbase = resource.start;

drivers/tty/serial/8250/8250_platform.c+0−9

 	struct device *dev = &pdev->dev;
 	struct uart_8250_port uart = { };
 	struct resource *regs;
-	unsigned char iotype;
 	int ret, line;
 	regs = platform_get_mem_or_io(pdev, 0);
 	switch (resource_type(regs)) {
 	case IORESOURCE_IO:
 		uart.port.iobase = regs->start;
-		iotype = UPIO_PORT;
 		break;
 	case IORESOURCE_MEM:
 		uart.port.mapbase = regs->start;
 		uart.port.mapsize = resource_size(regs);
 		uart.port.flags = UPF_IOREMAP;
-		iotype = UPIO_MEM;
 		break;
 	default:
 		return -EINVAL;
 	if (ret)
 		return ret;
-	/*
-	 * The previous call may not set iotype correctly when reg-io-width
-	 * property is absent and it doesn't support IO port resource.
-	 */
-	uart.port.iotype = iotype;
 	line = serial8250_register_8250_port(&uart);
 	if (line < 0)
 		return line;

drivers/tty/serial/8250/8250_pnp.c+0−10

 {
 	struct uart_8250_port uart, *port;
 	int ret, flags = dev_id->driver_data;
-	unsigned char iotype;
 	long line;
 	if (flags & UNKNOWN_DEV) {
 	memset(&uart, 0, sizeof(uart));
 	if ((flags & CIR_PORT) && pnp_port_valid(dev, 2)) {
 		uart.port.iobase = pnp_port_start(dev, 2);
-		iotype = UPIO_PORT;
 	} else if (pnp_port_valid(dev, 0)) {
 		uart.port.iobase = pnp_port_start(dev, 0);
-		iotype = UPIO_PORT;
 	} else if (pnp_mem_valid(dev, 0)) {
 		uart.port.mapbase = pnp_mem_start(dev, 0);
 		uart.port.mapsize = pnp_mem_len(dev, 0);
-		iotype = UPIO_MEM;
 		uart.port.flags = UPF_IOREMAP;
 	} else
 		return -ENODEV;
 	if (ret)
 		return ret;
-	/*
-	 * The previous call may not set iotype correctly when reg-io-width
-	 * property is absent and it doesn't support IO port resource.
-	 */
-	uart.port.iotype = iotype;
 	if (flags & CIR_PORT) {
 		uart.port.flags |= UPF_FIXED_PORT | UPF_FIXED_TYPE;
 		uart.port.type = PORT_8250_CIR;

drivers/tty/serial/8250/8250_port.c+9−0

 		serial8250_do_shutdown(port);
 }
+static void serial8250_flush_buffer(struct uart_port *port)
+{
+	struct uart_8250_port *up = up_to_u8250p(port);
+	if (up->dma)
+		serial8250_tx_dma_flush(up);
+}
 static unsigned int serial8250_do_get_divisor(struct uart_port *port,
 					      unsigned int baud,
 					      unsigned int *frac)
 	.break_ctl	= serial8250_break_ctl,
 	.startup	= serial8250_startup,
 	.shutdown	= serial8250_shutdown,
+	.flush_buffer	= serial8250_flush_buffer,
 	.set_termios	= serial8250_set_termios,
 	.set_ldisc	= serial8250_set_ldisc,
 	.pm		= serial8250_pm,

drivers/tty/serial/sc16is7xx.c+1−1

@@ -1561,7 +1561,7 @@ int sc16is7xx_probe(struct device dev, const struct sc16is7xx_devtype devtype, · 1560 unmodified lines
1561	/* Always ask for fixed clock rate from a property. */	1561	/* Always ask for fixed clock rate from a property. */
1562	device_property_read_u32(dev, "clock-frequency", &uartclk);	1562	device_property_read_u32(dev, "clock-frequency", &uartclk);
1563		1563
1564	s->polling = !!irq;	1564	s->polling = (irq <= 0);
1565	if (s->polling)	1565	if (s->polling)
1566	dev_dbg(dev,	1566	dev_dbg(dev,
1567	"No interrupt pin definition, falling back to polling mode\n");	1567	"No interrupt pin definition, falling back to polling mode\n");

drivers/tty/serial/serial_port.c+7−5

  * The caller is responsible to initialize the following fields of the @port
  *   ->dev (must be valid)
  *   ->flags
+ *   ->iobase
  *   ->mapbase
  *   ->mapsize
  *   ->regshift (if @use_defaults is false)
 	/* Read the registers I/O access type (default: MMIO 8-bit) */
 	ret = device_property_read_u32(dev, "reg-io-width", &value);
 	if (ret) {
-		port->iotype = UPIO_MEM;
+		port->iotype = port->iobase ? UPIO_PORT : UPIO_MEM;
 	} else {
 		switch (value) {
 		case 1:
 			port->iotype = device_is_big_endian(dev) ? UPIO_MEM32BE : UPIO_MEM32;
 			break;
 		default:
-			if (!use_defaults) {
-				dev_err(dev, "Unsupported reg-io-width (%u)\n", value);
-				return -EINVAL;
-			}
 			port->iotype = UPIO_UNKNOWN;
 			break;
 		}
 	}
+	if (!use_defaults && port->iotype == UPIO_UNKNOWN) {
+		dev_err(dev, "Unsupported reg-io-width (%u)\n", value);
+		return -EINVAL;
+	}
 	/* Read the address mapping base offset (default: no offset) */
 	ret = device_property_read_u32(dev, "reg-offset", &value);
 	if (ret)

drivers/ufs/core/ufshcd.c+35−33

 	INIT_DELAYED_WORK(&hba->clk_gating.gate_work, ufshcd_gate_work);
 	INIT_WORK(&hba->clk_gating.ungate_work, ufshcd_ungate_work);
-	spin_lock_init(&hba->clk_gating.lock);
 	hba->clk_gating.clk_gating_workq = alloc_ordered_workqueue(
 		"ufs_clk_gating_%d", WQ_MEM_RECLAIM | WQ_HIGHPRI,
 		hba->host->host_no);
 	case UPIU_TRANSACTION_QUERY_RSP: {
 		u8 response = lrbp->ucd_rsp_ptr->header.response;
-		if (response == 0)
+		if (response == 0) {
 			err = ufshcd_copy_query_response(hba, lrbp);
+		} else {
+			err = -EINVAL;
+			dev_err(hba->dev, "%s: unexpected response in Query RSP: %x\n",
+					__func__, response);
+		}
 		break;
 	}
 	case UPIU_TRANSACTION_REJECT_UPIU:
 				__func__, err);
 }
-static void ufshcd_temp_exception_event_handler(struct ufs_hba *hba, u16 status)
-{
-	u32 value;
-	if (ufshcd_query_attr_retry(hba, UPIU_QUERY_OPCODE_READ_ATTR,
-				QUERY_ATTR_IDN_CASE_ROUGH_TEMP, 0, 0, &value))
-		return;
-	dev_info(hba->dev, "exception Tcase %d\n", value - 80);
-	ufs_hwmon_notify_event(hba, status & MASK_EE_URGENT_TEMP);
-	/*
-	 * A placeholder for the platform vendors to add whatever additional
-	 * steps required
-	 */
-}
 static int __ufshcd_wb_toggle(struct ufs_hba *hba, bool set, enum flag_idn idn)
 {
 	u8 index;
 		ufshcd_bkops_exception_event_handler(hba);
 	if (status & hba->ee_drv_mask & MASK_EE_URGENT_TEMP)
-		ufshcd_temp_exception_event_handler(hba, status);
+		ufs_hwmon_notify_event(hba, status & MASK_EE_URGENT_TEMP);
 	ufs_debugfs_exception_event(hba, status);
 }
 			if (!IS_ERR_OR_NULL(clki->clk) && clki->enabled)
 				clk_disable_unprepare(clki->clk);
 		}
-	} else if (!ret && on) {
+	} else if (!ret && on && hba->clk_gating.is_initialized) {
 		scoped_guard(spinlock_irqsave, &hba->clk_gating.lock)
 			hba->clk_gating.state = CLKS_ON;
 		trace_ufshcd_clk_gating(dev_name(hba->dev),
 EXPORT_SYMBOL_GPL(ufshcd_system_thaw);
 #endif /* CONFIG_PM_SLEEP  */
-/**
- * ufshcd_dealloc_host - deallocate Host Bus Adapter (HBA)
- * @hba: pointer to Host Bus Adapter (HBA)
- */
-void ufshcd_dealloc_host(struct ufs_hba *hba)
-{
-	scsi_host_put(hba->host);
-}
-EXPORT_SYMBOL_GPL(ufshcd_dealloc_host);
 /**
  * ufshcd_set_dma_mask - Set dma mask based on the controller
  *			 addressing capability
 	return dma_set_mask_and_coherent(hba->dev, DMA_BIT_MASK(32));
 }
+/**
+ * ufshcd_devres_release - devres cleanup handler, invoked during release of
+ *			   hba->dev
+ * @host: pointer to SCSI host
+ */
+static void ufshcd_devres_release(void *host)
+{
+	scsi_host_put(host);
+}
 /**
  * ufshcd_alloc_host - allocate Host Bus Adapter (HBA)
  * @dev: pointer to device handle
  * @hba_handle: driver private handle
  *
  * Return: 0 on success, non-zero value on failure.
+ *
+ * NOTE: There is no corresponding ufshcd_dealloc_host() because this function
+ * keeps track of its allocations using devres and deallocates everything on
+ * device removal automatically.
  */
 int ufshcd_alloc_host(struct device *dev, struct ufs_hba **hba_handle)
 {
 		err = -ENOMEM;
 		goto out_error;
 	}
+	err = devm_add_action_or_reset(dev, ufshcd_devres_release,
+				       host);
+	if (err)
+		return dev_err_probe(dev, err,
+				     "failed to add ufshcd dealloc action\n");
 	host->nr_maps = HCTX_TYPE_POLL + 1;
 	hba = shost_priv(host);
 	hba->host = host;
 	hba->irq = irq;
 	hba->vps = &ufs_hba_vps;
+	/*
+	 * Initialize clk_gating.lock early since it is being used in
+	 * ufshcd_setup_clocks()
+	 */
+	spin_lock_init(&hba->clk_gating.lock);
 	err = ufshcd_hba_init(hba);
 	if (err)
 		goto out_error;

drivers/ufs/host/ufshcd-pci.c+0−2

 	pm_runtime_forbid(&pdev->dev);
 	pm_runtime_get_noresume(&pdev->dev);
 	ufshcd_remove(hba);
-	ufshcd_dealloc_host(hba);
 }
 /**
 	err = ufshcd_init(hba, mmio_base, pdev->irq);
 	if (err) {
 		dev_err(&pdev->dev, "Initialization failed\n");
-		ufshcd_dealloc_host(hba);
 		return err;
 	}

drivers/ufs/host/ufshcd-pltfrm.c+9−19

 	struct device *dev = &pdev->dev;
 	mmio_base = devm_platform_ioremap_resource(pdev, 0);
-	if (IS_ERR(mmio_base)) {
+	if (IS_ERR(mmio_base))
-		err = PTR_ERR(mmio_base);
+		return PTR_ERR(mmio_base);
-		goto out;
-	}
 	irq = platform_get_irq(pdev, 0);
-	if (irq < 0) {
+	if (irq < 0)
-		err = irq;
+		return irq;
-		goto out;
-	}
 	err = ufshcd_alloc_host(dev, &hba);
 	if (err) {
 		dev_err(dev, "Allocation failed\n");
-		goto out;
+		return err;
 	}
 	hba->vops = vops;
 	if (err) {
 		dev_err(dev, "%s: clock parse failed %d\n",
 				__func__, err);
-		goto dealloc_host;
+		return err;
 	}
 	err = ufshcd_parse_regulator_info(hba);
 	if (err) {
 		dev_err(dev, "%s: regulator init failed %d\n",
 				__func__, err);
-		goto dealloc_host;
+		return err;
 	}
 	ufshcd_init_lanes_per_dir(hba);
 	err = ufshcd_parse_operating_points(hba);
 	if (err) {
 		dev_err(dev, "%s: OPP parse failed %d\n", __func__, err);
-		goto dealloc_host;
+		return err;
 	}
 	err = ufshcd_init(hba, mmio_base, irq);
 	if (err) {
 		dev_err_probe(dev, err, "Initialization failed with error %d\n",
 			      err);
-		goto dealloc_host;
+		return err;
 	}
 	pm_runtime_set_active(dev);
 	pm_runtime_enable(dev);
 	return 0;
-dealloc_host:
-	ufshcd_dealloc_host(hba);
-out:
-	return err;
 }
 EXPORT_SYMBOL_GPL(ufshcd_pltfrm_init);
 	pm_runtime_get_sync(&pdev->dev);
 	ufshcd_remove(hba);
-	ufshcd_dealloc_host(hba);
 	pm_runtime_disable(&pdev->dev);
 	pm_runtime_put_noidle(&pdev->dev);
 }

drivers/usb/class/cdc-acm.c+21−7

@@ -371,7 +371,7 @@ static void acm_process_notification(struct acm acm, unsigned char buf) · 370 unmodified lines
371	static void acm_ctrl_irq(struct urb *urb)	371	static void acm_ctrl_irq(struct urb *urb)
372	{	372	{
373	struct acm *acm = urb->context;	373	struct acm *acm = urb->context;
374	struct usb_cdc_notification *dr = urb->transfer_buffer;	374	struct usb_cdc_notification *dr;
375	unsigned int current_size = urb->actual_length;	375	unsigned int current_size = urb->actual_length;
376	unsigned int expected_size, copy_size, alloc_size;	376	unsigned int expected_size, copy_size, alloc_size;
377	int retval;	377	int retval;
@@ -398,14 +398,25 @@ static void acm_ctrl_irq(struct urb *urb) · 20 unmodified lines
398		398
399	usb_mark_last_busy(acm->dev);	399	usb_mark_last_busy(acm->dev);
400		400
401	if (acm->nb_index)	401	if (acm->nb_index == 0) {
		402	/*
		403	* The first chunk of a message must contain at least the
		404	* notification header with the length field, otherwise we
		405	* can't get an expected_size.
		406	*/
		407	if (current_size < sizeof(struct usb_cdc_notification)) {
		408	dev_dbg(&acm->control->dev, "urb too short\n");
		409	goto exit;
		410	}
		411	dr = urb->transfer_buffer;
		412	} else {
402	dr = (struct usb_cdc_notification *)acm->notification_buffer;	413	dr = (struct usb_cdc_notification *)acm->notification_buffer;
403		414	}
404	/* size = notification-header + (optional) data */	415	/* size = notification-header + (optional) data */
405	expected_size = sizeof(struct usb_cdc_notification) +	416	expected_size = sizeof(struct usb_cdc_notification) +
406	le16_to_cpu(dr->wLength);	417	le16_to_cpu(dr->wLength);
407		418
408	if (current_size < expected_size) {	419	if (acm->nb_index != 0 \|\| current_size < expected_size) {
409	/* notification is transmitted fragmented, reassemble */	420	/* notification is transmitted fragmented, reassemble */
410	if (acm->nb_size < expected_size) {	421	if (acm->nb_size < expected_size) {
411	u8 *new_buffer;	422	u8 *new_buffer;
@@ -1727,13 +1738,16 @@ static const struct usb_device_id acm_ids[] = { · 1315 unmodified lines
1727	{ USB_DEVICE(0x0870, 0x0001), /* Metricom GS Modem */	1738	{ USB_DEVICE(0x0870, 0x0001), /* Metricom GS Modem */
1728	.driver_info = NO_UNION_NORMAL, /* has no union descriptor */	1739	.driver_info = NO_UNION_NORMAL, /* has no union descriptor */
1729	},	1740	},
1730	{ USB_DEVICE(0x045b, 0x023c), /* Renesas USB Download mode */	1741	{ USB_DEVICE(0x045b, 0x023c), /* Renesas R-Car H3 USB Download mode */
		1742	.driver_info = DISABLE_ECHO, /* Don't echo banner */
		1743	},
		1744	{ USB_DEVICE(0x045b, 0x0247), /* Renesas R-Car D3 USB Download mode */
1731	.driver_info = DISABLE_ECHO, /* Don't echo banner */	1745	.driver_info = DISABLE_ECHO, /* Don't echo banner */
1732	},	1746	},
1733	{ USB_DEVICE(0x045b, 0x0248), /* Renesas USB Download mode */	1747	{ USB_DEVICE(0x045b, 0x0248), /* Renesas R-Car M3-N USB Download mode */
1734	.driver_info = DISABLE_ECHO, /* Don't echo banner */	1748	.driver_info = DISABLE_ECHO, /* Don't echo banner */
1735	},	1749	},
1736	{ USB_DEVICE(0x045b, 0x024D), /* Renesas USB Download mode */	1750	{ USB_DEVICE(0x045b, 0x024D), /* Renesas R-Car E3 USB Download mode */
1737	.driver_info = DISABLE_ECHO, /* Don't echo banner */	1751	.driver_info = DISABLE_ECHO, /* Don't echo banner */
1738	},	1752	},
1739	{ USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */	1753	{ USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */

drivers/usb/core/hub.c+12−2

 	desc = intf->cur_altsetting;
 	hdev = interface_to_usbdev(intf);
+	/*
+	 * The USB 2.0 spec prohibits hubs from having more than one
+	 * configuration or interface, and we rely on this prohibition.
+	 * Refuse to accept a device that violates it.
+	 */
+	if (hdev->descriptor.bNumConfigurations > 1 ||
+			hdev->actconfig->desc.bNumInterfaces > 1) {
+		dev_err(&intf->dev, "Invalid hub with more than one config or interface\n");
+		return -EINVAL;
+	}
 	/*
 	 * Set default autosuspend delay as 0 to speedup bus suspend,
 	 * based on the below considerations:
 EXPORT_SYMBOL_GPL(usb_ep0_reinit);
 #define usb_sndaddr0pipe()	(PIPE_CONTROL << 30)
-#define usb_rcvaddr0pipe()	((PIPE_CONTROL << 30) | USB_DIR_IN)
 static int hub_set_address(struct usb_device *udev, int devnum)
 {
 	for (i = 0; i < GET_MAXPACKET0_TRIES; ++i) {
 		/* Start with invalid values in case the transfer fails */
 		buf->bDescriptorType = buf->bMaxPacketSize0 = 0;
-		rc = usb_control_msg(udev, usb_rcvaddr0pipe(),
+		rc = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 				USB_REQ_GET_DESCRIPTOR, USB_DIR_IN,
 				USB_DT_DEVICE << 8, 0,
 				buf, size,

drivers/usb/core/quirks.c+6−0

 	{ USB_DEVICE(0x0c45, 0x7056), .driver_info =
 			USB_QUIRK_IGNORE_REMOTE_WAKEUP },
+	/* Sony Xperia XZ1 Compact (lilac) smartphone in fastboot mode */
+	{ USB_DEVICE(0x0fce, 0x0dde), .driver_info = USB_QUIRK_NO_LPM },
 	/* Action Semiconductor flash disk */
 	{ USB_DEVICE(0x10d6, 0x2200), .driver_info =
 			USB_QUIRK_STRING_FETCH_255 },
 	/* Blackmagic Design UltraStudio SDI */
 	{ USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM },
+	/* Teclast disk */
+	{ USB_DEVICE(0x1f75, 0x0917), .driver_info = USB_QUIRK_NO_LPM },
 	/* Hauppauge HVR-950q */
 	{ USB_DEVICE(0x2040, 0x7200), .driver_info =
 			USB_QUIRK_CONFIG_INTF_STRINGS },

drivers/usb/dwc2/gadget.c+1−0

@@ -4615,6 +4615,7 @@ static int dwc2_hsotg_udc_stop(struct usb_gadget *gadget) · 4614 unmodified lines
4615	spin_lock_irqsave(&hsotg->lock, flags);	4615	spin_lock_irqsave(&hsotg->lock, flags);
4616		4616
4617	hsotg->driver = NULL;	4617	hsotg->driver = NULL;
		4618	hsotg->gadget.dev.of_node = NULL;
4618	hsotg->gadget.speed = USB_SPEED_UNKNOWN;	4619	hsotg->gadget.speed = USB_SPEED_UNKNOWN;
4619	hsotg->enabled = 0;	4620	hsotg->enabled = 0;
4620		4621

drivers/usb/dwc3/core.h+1−0

@@ -717,6 +717,7 @@ struct dwc3_event_buffer { · 716 unmodified lines
717	/**	717	/**
718	* struct dwc3_ep - device side endpoint representation	718	* struct dwc3_ep - device side endpoint representation
719	* @endpoint: usb endpoint	719	* @endpoint: usb endpoint
		720	* @nostream_work: work for handling bulk NoStream
720	* @cancelled_list: list of cancelled requests for this endpoint	721	* @cancelled_list: list of cancelled requests for this endpoint
721	* @pending_list: list of pending requests for this endpoint	722	* @pending_list: list of pending requests for this endpoint
722	* @started_list: list of started requests on this endpoint	723	* @started_list: list of started requests on this endpoint

drivers/usb/dwc3/gadget.c+34−0

@@ -2629,10 +2629,38 @@ static int dwc3_gadget_run_stop(struct dwc3 *dwc, int is_on) · 2628 unmodified lines
2629	{	2629	{
2630	u32 reg;	2630	u32 reg;
2631	u32 timeout = 2000;	2631	u32 timeout = 2000;
		2632	u32 saved_config = 0;
2632		2633
2633	if (pm_runtime_suspended(dwc->dev))	2634	if (pm_runtime_suspended(dwc->dev))
2634	return 0;	2635	return 0;
2635		2636
		2637	/*
		2638	* When operating in USB 2.0 speeds (HS/FS), ensure that
		2639	* GUSB2PHYCFG.ENBLSLPM and GUSB2PHYCFG.SUSPHY are cleared before starting
		2640	* or stopping the controller. This resolves timeout issues that occur
		2641	* during frequent role switches between host and device modes.
		2642	*
		2643	* Save and clear these settings, then restore them after completing the
		2644	* controller start or stop sequence.
		2645	*
		2646	* This solution was discovered through experimentation as it is not
		2647	* mentioned in the dwc3 programming guide. It has been tested on an
		2648	* Exynos platforms.
		2649	*/
		2650	reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
		2651	if (reg & DWC3_GUSB2PHYCFG_SUSPHY) {
		2652	saved_config \|= DWC3_GUSB2PHYCFG_SUSPHY;
		2653	reg &= ~DWC3_GUSB2PHYCFG_SUSPHY;
		2654	}
		2655
		2656	if (reg & DWC3_GUSB2PHYCFG_ENBLSLPM) {
		2657	saved_config \|= DWC3_GUSB2PHYCFG_ENBLSLPM;
		2658	reg &= ~DWC3_GUSB2PHYCFG_ENBLSLPM;
		2659	}
		2660
		2661	if (saved_config)
		2662	dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
		2663
2636	reg = dwc3_readl(dwc->regs, DWC3_DCTL);	2664	reg = dwc3_readl(dwc->regs, DWC3_DCTL);
2637	if (is_on) {	2665	if (is_on) {
2638	if (DWC3_VER_IS_WITHIN(DWC3, ANY, 187A)) {	2666	if (DWC3_VER_IS_WITHIN(DWC3, ANY, 187A)) {
@@ -2660,6 +2688,12 @@ static int dwc3_gadget_run_stop(struct dwc3 *dwc, int is_on) · 21 unmodified lines
2660	reg &= DWC3_DSTS_DEVCTRLHLT;	2688	reg &= DWC3_DSTS_DEVCTRLHLT;
2661	} while (--timeout && !(!is_on ^ !reg));	2689	} while (--timeout && !(!is_on ^ !reg));
2662		2690
		2691	if (saved_config) {
		2692	reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
		2693	reg \|= saved_config;
		2694	dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
		2695	}
		2696
2663	if (!timeout)	2697	if (!timeout)
2664	return -ETIMEDOUT;	2698	return -ETIMEDOUT;
2665		2699

drivers/usb/gadget/function/f_midi.c+14−5

 			/* Our transmit completed. See if there's more to go.
 			 * f_midi_transmit eats req, don't queue it again. */
 			req->length = 0;
-			f_midi_transmit(midi);
+			queue_work(system_highpri_wq, &midi->work);
 			return;
 		}
 		break;
 	status = -ENODEV;
+	/*
+	 * Reset wMaxPacketSize with maximum packet size of FS bulk transfer before
+	 * endpoint claim. This ensures that the wMaxPacketSize does not exceed the
+	 * limit during bind retries where configured dwc3 TX/RX FIFO's maxpacket
+	 * size of 512 bytes for IN/OUT endpoints in support HS speed only.
+	 */
+	bulk_in_desc.wMaxPacketSize = cpu_to_le16(64);
+	bulk_out_desc.wMaxPacketSize = cpu_to_le16(64);
 	/* allocate instance-specific endpoints */
 	midi->in_ep = usb_ep_autoconfig(cdev->gadget, &bulk_in_desc);
 	if (!midi->in_ep)
 	}
 	/* configure the endpoint descriptors ... */
-	ms_out_desc.bLength = USB_DT_MS_ENDPOINT_SIZE(midi->in_ports);
+	ms_out_desc.bLength = USB_DT_MS_ENDPOINT_SIZE(midi->out_ports);
-	ms_out_desc.bNumEmbMIDIJack = midi->in_ports;
+	ms_out_desc.bNumEmbMIDIJack = midi->out_ports;
-	ms_in_desc.bLength = USB_DT_MS_ENDPOINT_SIZE(midi->out_ports);
+	ms_in_desc.bLength = USB_DT_MS_ENDPOINT_SIZE(midi->in_ports);
-	ms_in_desc.bNumEmbMIDIJack = midi->out_ports;
+	ms_in_desc.bNumEmbMIDIJack = midi->in_ports;
 	/* ... and add them to the list */
 	endpoint_descriptor_index = i;

drivers/usb/gadget/function/uvc_video.c+1−1

@@ -818,7 +818,7 @@ int uvcg_video_init(struct uvc_video video, struct uvc_device uvc) · 817 unmodified lines
818	return -EINVAL;	818	return -EINVAL;
819		819
820	/* Allocate a kthread for asynchronous hw submit handler. */	820	/* Allocate a kthread for asynchronous hw submit handler. */
821	video->kworker = kthread_create_worker(0, "UVCG");	821	video->kworker = kthread_run_worker(0, "UVCG");
822	if (IS_ERR(video->kworker)) {	822	if (IS_ERR(video->kworker)) {
823	uvcg_err(&video->uvc->func, "failed to create UVCG kworker\n");	823	uvcg_err(&video->uvc->func, "failed to create UVCG kworker\n");
824	return PTR_ERR(video->kworker);	824	return PTR_ERR(video->kworker);

drivers/usb/gadget/udc/core.c+1−1

 	kobject_uevent(&udc->dev.kobj, KOBJ_REMOVE);
 	sysfs_remove_link(&udc->dev.kobj, "gadget");
-	flush_work(&gadget->work);
 	device_del(&gadget->dev);
+	flush_work(&gadget->work);
 	ida_free(&gadget_id_numbers, gadget->id_number);
 	cancel_work_sync(&udc->vbus_work);
 	device_unregister(&udc->dev);

drivers/usb/gadget/udc/renesas_usb3.c+1−1

@@ -310,7 +310,7 @@ struct renesas_usb3_request { · 309 unmodified lines
310	struct list_head queue;	310	struct list_head queue;
311	};	311	};
312		312
313	#define USB3_EP_NAME_SIZE 8	313	#define USB3_EP_NAME_SIZE 16
314	struct renesas_usb3_ep {	314	struct renesas_usb3_ep {
315	struct usb_ep ep;	315	struct usb_ep ep;
316	struct renesas_usb3 *usb3;	316	struct renesas_usb3 *usb3;

drivers/usb/host/pci-quirks.c+9−0

@@ -958,6 +958,15 @@ static void quirk_usb_disable_ehci(struct pci_dev *pdev) · 957 unmodified lines
958	* booting from USB disk or using a usb keyboard	958	* booting from USB disk or using a usb keyboard
959	*/	959	*/
960	hcc_params = readl(base + EHCI_HCC_PARAMS);	960	hcc_params = readl(base + EHCI_HCC_PARAMS);
		961
		962	/* LS7A EHCI controller doesn't have extended capabilities, the
		963	* EECP (EHCI Extended Capabilities Pointer) field of HCCPARAMS
		964	* register should be 0x0 but it reads as 0xa0. So clear it to
		965	* avoid error messages on boot.
		966	*/
		967	if (pdev->vendor == PCI_VENDOR_ID_LOONGSON && pdev->device == 0x7a14)
		968	hcc_params &= ~(0xffL << 8);
		969
961	offset = (hcc_params >> 8) & 0xff;	970	offset = (hcc_params >> 8) & 0xff;
962	while (offset && --count) {	971	while (offset && --count) {
963	pci_read_config_dword(pdev, offset, &cap);	972	pci_read_config_dword(pdev, offset, &cap);

drivers/usb/host/xhci-pci.c+4−3

 }
 EXPORT_SYMBOL_NS_GPL(xhci_pci_common_probe, "xhci");
-static const struct pci_device_id pci_ids_reject[] = {
+/* handled by xhci-pci-renesas if enabled */
-	/* handled by xhci-pci-renesas */
+static const struct pci_device_id pci_ids_renesas[] = {
 	{ PCI_DEVICE(PCI_VENDOR_ID_RENESAS, 0x0014) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_RENESAS, 0x0015) },
 	{ /* end: all zeroes */ }
 static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
 {
-	if (pci_match_id(pci_ids_reject, dev))
+	if (IS_ENABLED(CONFIG_USB_XHCI_PCI_RENESAS) &&
+			pci_match_id(pci_ids_renesas, dev))
 		return -ENODEV;
 	return xhci_pci_common_probe(dev, id);

drivers/usb/phy/phy-generic.c+1−1

@@ -212,7 +212,7 @@ int usb_phy_gen_create_phy(struct device dev, struct usb_phy_generic nop) · 211 unmodified lines
212	if (of_property_read_u32(node, "clock-frequency", &clk_rate))	212	if (of_property_read_u32(node, "clock-frequency", &clk_rate))
213	clk_rate = 0;	213	clk_rate = 0;
214		214
215	needs_clk = of_property_read_bool(node, "clocks");	215	needs_clk = of_property_present(node, "clocks");
216	}	216	}
217	nop->gpiod_reset = devm_gpiod_get_optional(dev, "reset",	217	nop->gpiod_reset = devm_gpiod_get_optional(dev, "reset",
218	GPIOD_ASIS);	218	GPIOD_ASIS);

drivers/usb/roles/class.c+3−2

 	dev_set_name(&sw->dev, "%s-role-switch",
 		     desc->name ? desc->name : dev_name(parent));
+	sw->registered = true;
 	ret = device_register(&sw->dev);
 	if (ret) {
+		sw->registered = false;
 		put_device(&sw->dev);
 		return ERR_PTR(ret);
 	}
 			dev_warn(&sw->dev, "failed to add component\n");
 	}
-	sw->registered = true;
 	/* TODO: Symlinks for the host port and the device controller. */
 	return sw;

drivers/usb/serial/option.c+29−20

 /* Luat Air72*U series based on UNISOC UIS8910 uses UNISOC's vendor ID */
 #define LUAT_PRODUCT_AIR720U			0x4e00
-/* MeiG Smart Technology products */
-#define MEIGSMART_VENDOR_ID			0x2dee
-/* MeiG Smart SRM815/SRM825L based on Qualcomm 315 */
-#define MEIGSMART_PRODUCT_SRM825L		0x4d22
-/* MeiG Smart SLM320 based on UNISOC UIS8910 */
-#define MEIGSMART_PRODUCT_SLM320		0x4d41
-/* MeiG Smart SLM770A based on ASR1803 */
-#define MEIGSMART_PRODUCT_SLM770A		0x4d57
 /* Device flags */
 /* Highest interface number which can be used with NCTRL() and RSVD() */
 	  .driver_info = NCTRL(2) | RSVD(3) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1063, 0xff),	/* Telit LN920 (ECM) */
 	  .driver_info = NCTRL(0) | RSVD(1) },
-	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1070, 0xff),	/* Telit FN990 (rmnet) */
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1070, 0xff),	/* Telit FN990A (rmnet) */
 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
-	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1071, 0xff),	/* Telit FN990 (MBIM) */
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1071, 0xff),	/* Telit FN990A (MBIM) */
 	  .driver_info = NCTRL(0) | RSVD(1) },
-	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1072, 0xff),	/* Telit FN990 (RNDIS) */
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1072, 0xff),	/* Telit FN990A (RNDIS) */
 	  .driver_info = NCTRL(2) | RSVD(3) },
-	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff),	/* Telit FN990 (ECM) */
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff),	/* Telit FN990A (ECM) */
 	  .driver_info = NCTRL(0) | RSVD(1) },
-	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff),	/* Telit FN990 (PCIe) */
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff),	/* Telit FN990A (PCIe) */
 	  .driver_info = RSVD(0) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff),	/* Telit FE990 (rmnet) */
 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
 	  .driver_info = RSVD(0) | NCTRL(3) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff),	/* Telit FE910C04 (rmnet) */
 	  .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) },
+	{ USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x60) },	/* Telit FN990B (rmnet) */
+	{ USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x40) },
+	{ USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x30),
+	  .driver_info = NCTRL(5) },
+	{ USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x60) },	/* Telit FN990B (MBIM) */
+	{ USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x40) },
+	{ USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x30),
+	  .driver_info = NCTRL(6) },
+	{ USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x60) },	/* Telit FN990B (RNDIS) */
+	{ USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x40) },
+	{ USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x30),
+	  .driver_info = NCTRL(6) },
+	{ USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x60) },	/* Telit FN990B (ECM) */
+	{ USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x40) },
+	{ USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x30),
+	  .driver_info = NCTRL(6) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a05, 0xff) },			/* Fibocom FM650-CN (NCM mode) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a06, 0xff) },			/* Fibocom FM650-CN (RNDIS mode) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a07, 0xff) },			/* Fibocom FM650-CN (MBIM mode) */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d41, 0xff, 0, 0) },		/* MeiG Smart SLM320 */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d57, 0xff, 0, 0) },		/* MeiG Smart SLM770A */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0, 0) },		/* MeiG Smart SRM815 */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0x10, 0x02) },	/* MeiG Smart SLM828 */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0x10, 0x03) },	/* MeiG Smart SLM828 */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x30) },	/* MeiG Smart SRM815 and SRM825L */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x40) },	/* MeiG Smart SRM825L */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x2dee, 0x4d22, 0xff, 0xff, 0x60) },	/* MeiG Smart SRM825L */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) },			/* LongSung M5710 */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) },			/* GosunCn GM500 RNDIS */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) },			/* GosunCn GM500 MBIM */
 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) },
-	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) },
-	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM770A, 0xff, 0, 0) },
-	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0, 0) },
-	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) },
-	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) },
-	{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0530, 0xff),			/* TCL IK512 MBIM */
 	  .driver_info = NCTRL(1) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0640, 0xff),			/* TCL IK512 ECM */

drivers/usb/typec/tcpm/tcpm.c+1−2

 		tcpm_set_auto_vbus_discharge_threshold(port, TYPEC_PWR_MODE_USB,
 						       port->pps_data.active, 0);
 		tcpm_set_charge(port, false);
-		tcpm_set_state(port, hard_reset_state(port),
+		tcpm_set_state(port, ERROR_RECOVERY, port->timings.ps_src_off_time);
-			       port->timings.ps_src_off_time);
 		break;
 	case PR_SWAP_SNK_SRC_SOURCE_ON:
 		tcpm_enable_auto_vbus_discharge(port, true);

drivers/xen/swiotlb-xen.c+13−9

 	return xen_bus_to_phys(dev, dma_to_phys(dev, dma_addr));
 }
+static inline bool range_requires_alignment(phys_addr_t p, size_t size)
+{
+	phys_addr_t algn = 1ULL << (get_order(size) + PAGE_SHIFT);
+	phys_addr_t bus_addr = pfn_to_bfn(XEN_PFN_DOWN(p)) << XEN_PAGE_SHIFT;
+	return IS_ALIGNED(p, algn) && !IS_ALIGNED(bus_addr, algn);
+}
 static inline int range_straddles_page_boundary(phys_addr_t p, size_t size)
 {
 	unsigned long next_bfn, xen_pfn = XEN_PFN_DOWN(p);
 	unsigned int i, nr_pages = XEN_PFN_UP(xen_offset_in_page(p) + size);
-	phys_addr_t algn = 1ULL << (get_order(size) + PAGE_SHIFT);
 	next_bfn = pfn_to_bfn(xen_pfn);
-	/* If buffer is physically aligned, ensure DMA alignment. */
-	if (IS_ALIGNED(p, algn) &&
-	    !IS_ALIGNED((phys_addr_t)next_bfn << XEN_PAGE_SHIFT, algn))
-		return 1;
 	for (i = 1; i < nr_pages; i++)
 		if (pfn_to_bfn(++xen_pfn) != ++next_bfn)
 			return 1;
 }
 #ifdef CONFIG_X86
-int xen_swiotlb_fixup(void *buf, unsigned long nslabs)
+int __init xen_swiotlb_fixup(void *buf, unsigned long nslabs)
 {
 	int rc;
 	unsigned int order = get_order(IO_TLB_SEGSIZE << IO_TLB_SHIFT);
 	*dma_handle = xen_phys_to_dma(dev, phys);
 	if (*dma_handle + size - 1 > dma_mask ||
-	    range_straddles_page_boundary(phys, size)) {
+	    range_straddles_page_boundary(phys, size) ||
+	    range_requires_alignment(phys, size)) {
 		if (xen_create_contiguous_region(phys, order, fls64(dma_mask),
 				dma_handle) != 0)
 			goto out_free_pages;
 	size = ALIGN(size, XEN_PAGE_SIZE);
 	if (WARN_ON_ONCE(dma_handle + size - 1 > dev->coherent_dma_mask) ||
-	    WARN_ON_ONCE(range_straddles_page_boundary(phys, size)))
+	    WARN_ON_ONCE(range_straddles_page_boundary(phys, size) ||
+			 range_requires_alignment(phys, size)))
 	    	return;
 	if (TestClearPageXenRemapped(virt_to_page(vaddr)))

fs/bcachefs/Kconfig+7−0

@@ -61,6 +61,13 @@ config BCACHEFS_DEBUG · 60 unmodified lines
61	The resulting code will be significantly slower than normal; you	61	The resulting code will be significantly slower than normal; you
62	probably shouldn't select this option unless you're a developer.	62	probably shouldn't select this option unless you're a developer.
63		63
		64	config BCACHEFS_INJECT_TRANSACTION_RESTARTS
		65	bool "Randomly inject transaction restarts"
		66	depends on BCACHEFS_DEBUG
		67	help
		68	Randomly inject transaction restarts in a few core paths - may have a
		69	significant performance penalty
		70
64	config BCACHEFS_TESTS	71	config BCACHEFS_TESTS
65	bool "bcachefs unit and performance tests"	72	bool "bcachefs unit and performance tests"
66	depends on BCACHEFS_FS	73	depends on BCACHEFS_FS

fs/bcachefs/alloc_background.c+25−22

 	u64		open;
 	u64		need_journal_commit;
 	u64		discarded;
-	u64		need_journal_commit_this_dev;
 };
 static int bch2_discard_one_bucket(struct btree_trans *trans,
 		goto out;
 	}
-	if (bch2_bucket_needs_journal_commit(&c->buckets_waiting_for_journal,
+	u64 seq_ready = bch2_bucket_journal_seq_ready(&c->buckets_waiting_for_journal,
-			c->journal.flushed_seq_ondisk,
+						      pos.inode, pos.offset);
-			pos.inode, pos.offset)) {
+	if (seq_ready > c->journal.flushed_seq_ondisk) {
-		s->need_journal_commit++;
+		if (seq_ready > c->journal.flushing_seq)
-		s->need_journal_commit_this_dev++;
+			s->need_journal_commit++;
 		goto out;
 	}
 		discard_locked = true;
 	}
-	if (!bkey_eq(*discard_pos_done, iter.pos) &&
+	if (!bkey_eq(*discard_pos_done, iter.pos)) {
-	    ca->mi.discard && !c->opts.nochanges) {
-		/*
-		 * This works without any other locks because this is the only
-		 * thread that removes items from the need_discard tree
-		 */
-		bch2_trans_unlock_long(trans);
-		blkdev_issue_discard(ca->disk_sb.bdev,
-				     k.k->p.offset * ca->mi.bucket_size,
-				     ca->mi.bucket_size,
-				     GFP_KERNEL);
-		*discard_pos_done = iter.pos;
 		s->discarded++;
+		*discard_pos_done = iter.pos;
-		ret = bch2_trans_relock_notrace(trans);
+		if (ca->mi.discard && !c->opts.nochanges) {
-		if (ret)
+			/*
-			goto out;
+			 * This works without any other locks because this is the only
+			 * thread that removes items from the need_discard tree
+			 */
+			bch2_trans_unlock_long(trans);
+			blkdev_issue_discard(ca->disk_sb.bdev,
+					     k.k->p.offset * ca->mi.bucket_size,
+					     ca->mi.bucket_size,
+					     GFP_KERNEL);
+			ret = bch2_trans_relock_notrace(trans);
+			if (ret)
+				goto out;
+		}
 	}
 	SET_BCH_ALLOC_V4_NEED_DISCARD(&a->v, false);
 				   POS(ca->dev_idx, U64_MAX), 0, k,
 			bch2_discard_one_bucket(trans, ca, &iter, &discard_pos_done, &s, false)));
+	if (s.need_journal_commit > dev_buckets_available(ca, BCH_WATERMARK_normal))
+		bch2_journal_flush_async(&c->journal, NULL);
 	trace_discard_buckets(c, s.seen, s.open, s.need_journal_commit, s.discarded,
 			      bch2_err_str(ret));
 			break;
 	}
-	trace_discard_buckets(c, s.seen, s.open, s.need_journal_commit, s.discarded, bch2_err_str(ret));
+	trace_discard_buckets_fast(c, s.seen, s.open, s.need_journal_commit, s.discarded, bch2_err_str(ret));
 	bch2_trans_put(trans);
 	percpu_ref_put(&ca->io_ref);

fs/bcachefs/alloc_foreground.c+7−3

 		return false;
 	}
-	if (bch2_bucket_needs_journal_commit(&c->buckets_waiting_for_journal,
+	u64 journal_seq_ready =
-			c->journal.flushed_seq_ondisk, bucket.inode, bucket.offset)) {
+		bch2_bucket_journal_seq_ready(&c->buckets_waiting_for_journal,
+					      bucket.inode, bucket.offset);
+	if (journal_seq_ready > c->journal.flushed_seq_ondisk) {
+		if (journal_seq_ready > c->journal.flushing_seq)
+			s->need_journal_commit++;
 		s->skipped_need_journal_commit++;
 		return false;
 	}
 		? bch2_bucket_alloc_freelist(trans, ca, watermark, &s, cl)
 		: bch2_bucket_alloc_early(trans, ca, watermark, &s, cl);
-	if (s.skipped_need_journal_commit * 2 > avail)
+	if (s.need_journal_commit * 2 > avail)
 		bch2_journal_flush_async(&c->journal, NULL);
 	if (!ob && s.btree_bitmap != BTREE_BITMAP_ANY) {

fs/bcachefs/alloc_types.h+1−0

@@ -18,6 +18,7 @@ struct bucket_alloc_state { · 17 unmodified lines
18	u64 buckets_seen;	18	u64 buckets_seen;
19	u64 skipped_open;	19	u64 skipped_open;
20	u64 skipped_need_journal_commit;	20	u64 skipped_need_journal_commit;
		21	u64 need_journal_commit;
21	u64 skipped_nocow;	22	u64 skipped_nocow;
22	u64 skipped_nouse;	23	u64 skipped_nouse;
23	u64 skipped_mi_btree_bitmap;	24	u64 skipped_mi_btree_bitmap;

fs/bcachefs/btree_iter.c+32−1

 	bch2_btree_iter_verify_entry_exit(iter);
 	EBUG_ON((iter->flags & BTREE_ITER_filter_snapshots) && bkey_eq(end, POS_MAX));
+	ret = trans_maybe_inject_restart(trans, _RET_IP_);
+	if (unlikely(ret)) {
+		k = bkey_s_c_err(ret);
+		goto out_no_locked;
+	}
 	if (iter->update_path) {
 		bch2_path_put_nokeep(trans, iter->update_path,
 				     iter->flags & BTREE_ITER_intent);
 	bch2_btree_iter_verify_entry_exit(iter);
 	EBUG_ON((iter->flags & BTREE_ITER_filter_snapshots) && bpos_eq(end, POS_MIN));
+	int ret = trans_maybe_inject_restart(trans, _RET_IP_);
+	if (unlikely(ret)) {
+		k = bkey_s_c_err(ret);
+		goto out_no_locked;
+	}
 	while (1) {
 		k = __bch2_btree_iter_peek_prev(iter, search_key);
 		if (unlikely(!k.k))
 	bch2_btree_iter_verify_entry_exit(iter);
 	EBUG_ON(btree_iter_path(trans, iter)->level && (iter->flags & BTREE_ITER_with_key_cache));
+	ret = trans_maybe_inject_restart(trans, _RET_IP_);
+	if (unlikely(ret)) {
+		k = bkey_s_c_err(ret);
+		goto out_no_locked;
+	}
 	/* extents can't span inode numbers: */
 	if ((iter->flags & BTREE_ITER_is_extents) &&
 	    unlikely(iter->pos.offset == KEY_OFFSET_MAX)) {
 	WARN_ON_ONCE(new_bytes > BTREE_TRANS_MEM_MAX);
+	ret = trans_maybe_inject_restart(trans, _RET_IP_);
+	if (ret)
+		return ERR_PTR(ret);
 	struct btree_transaction_stats *s = btree_trans_stats(trans);
 	s->max_mem = max(s->max_mem, new_bytes);
 	if (old_bytes) {
 		trace_and_count(c, trans_restart_mem_realloced, trans, _RET_IP_, new_bytes);
-		return ERR_PTR(btree_trans_restart(trans, BCH_ERR_transaction_restart_mem_realloced));
+		return ERR_PTR(btree_trans_restart_ip(trans,
+					BCH_ERR_transaction_restart_mem_realloced, _RET_IP_));
 	}
 out_change_top:
 	p = trans->mem + trans->mem_top;
 	trans->last_begin_ip = _RET_IP_;
+#ifdef CONFIG_BCACHEFS_INJECT_TRANSACTION_RESTARTS
+	if (trans->restarted) {
+		trans->restart_count_this_trans++;
+	} else {
+		trans->restart_count_this_trans = 0;
+	}
+#endif
 	trans_set_locked(trans, false);
 	if (trans->restarted) {

fs/bcachefs/btree_iter.h+13−1

 	return btree_trans_restart_ip(trans, err, _THIS_IP_);
 }
+static inline int trans_maybe_inject_restart(struct btree_trans *trans, unsigned long ip)
+{
+#ifdef CONFIG_BCACHEFS_INJECT_TRANSACTION_RESTARTS
+	if (!(ktime_get_ns() & ~(~0ULL << min(63, (10 + trans->restart_count_this_trans))))) {
+		trace_and_count(trans->c, trans_restart_injected, trans, ip);
+		return btree_trans_restart_ip(trans,
+					BCH_ERR_transaction_restart_fault_inject, ip);
+	}
+#endif
+	return 0;
+}
 bool bch2_btree_node_upgrade(struct btree_trans *,
 			     struct btree_path *, unsigned);
 	if (!_ret2)							\
 		bch2_trans_verify_not_restarted(_trans, _restart_count);\
 									\
-	_ret2 ?: trans_was_restarted(_trans, _restart_count);		\
+	_ret2 ?: trans_was_restarted(_trans, _orig_restart_count);		\
 })
 #define for_each_btree_key_max_continue(_trans, _iter,			\

fs/bcachefs/btree_key_cache.c+0−1

@@ -748,7 +748,6 @@ void bch2_fs_btree_key_cache_exit(struct btree_key_cache *bc) · 747 unmodified lines
748	rcu_read_unlock();	748	rcu_read_unlock();
749	mutex_lock(&bc->table.mutex);	749	mutex_lock(&bc->table.mutex);
750	mutex_unlock(&bc->table.mutex);	750	mutex_unlock(&bc->table.mutex);
751	rcu_read_lock();
752	continue;	751	continue;
753	}	752	}
754	for (i = 0; i < tbl->size; i++)	753	for (i = 0; i < tbl->size; i++)

fs/bcachefs/btree_trans_commit.c+4−0

@@ -999,6 +999,10 @@ int __bch2_trans_commit(struct btree_trans *trans, unsigned flags) · 998 unmodified lines
999		999
1000	bch2_trans_verify_not_unlocked_or_in_restart(trans);	1000	bch2_trans_verify_not_unlocked_or_in_restart(trans);
1001		1001
		1002	ret = trans_maybe_inject_restart(trans, _RET_IP_);
		1003	if (unlikely(ret))
		1004	goto out_reset;
		1005
1002	if (!trans->nr_updates &&	1006	if (!trans->nr_updates &&
1003	!trans->journal_entries_u64s)	1007	!trans->journal_entries_u64s)
1004	goto out_reset;	1008	goto out_reset;

fs/bcachefs/btree_types.h+3−0

 	bool			notrace_relock_fail:1;
 	enum bch_errcode	restarted:16;
 	u32			restart_count;
+#ifdef CONFIG_BCACHEFS_INJECT_TRANSACTION_RESTARTS
+	u32			restart_count_this_trans;
+#endif
 	u64			last_begin_time;
 	unsigned long		last_begin_ip;

fs/bcachefs/btree_update_interior.c+2−0

 		b = as->old_nodes[i];
+		bch2_trans_begin(trans);
 		btree_node_lock_nopath_nofail(trans, &b->c, SIX_LOCK_read);
 		seq = b->data ? b->data->keys.seq : 0;
 		six_unlock_read(&b->c.lock);
+		bch2_trans_unlock_long(trans);
 		if (seq == as->old_nodes_seq[i])
 			wait_on_bit_io(&b->flags, BTREE_NODE_write_in_flight_inner,

fs/bcachefs/btree_update_interior.h+2−2

@@ -278,12 +278,12 @@ static inline struct btree_node_entry want_new_bset(struct bch_fs c, struct bt · 277 unmodified lines
278	{	278	{
279	struct bset_tree *t = bset_tree_last(b);	279	struct bset_tree *t = bset_tree_last(b);
280	struct btree_node_entry *bne = max(write_block(b),	280	struct btree_node_entry *bne = max(write_block(b),
281	(void *) btree_bkey_last(b, bset_tree_last(b)));	281	(void *) btree_bkey_last(b, t));
282	ssize_t remaining_space =	282	ssize_t remaining_space =
283	__bch2_btree_u64s_remaining(b, bne->keys.start);	283	__bch2_btree_u64s_remaining(b, bne->keys.start);
284		284
285	if (unlikely(bset_written(b, bset(b, t)))) {	285	if (unlikely(bset_written(b, bset(b, t)))) {
286	if (remaining_space > (ssize_t) (block_bytes(c) >> 3))	286	if (b->written + block_sectors(c) <= btree_sectors(c))
287	return bne;	287	return bne;
288	} else {	288	} else {
289	if (unlikely(bset_u64s(t) * sizeof(u64) > btree_write_set_buffer(b)) &&	289	if (unlikely(bset_u64s(t) * sizeof(u64) > btree_write_set_buffer(b)) &&

fs/bcachefs/buckets_waiting_for_journal.c+5−7

 	memset(t->d, 0, sizeof(t->d[0]) << t->bits);
 }
-bool bch2_bucket_needs_journal_commit(struct buckets_waiting_for_journal *b,
+u64 bch2_bucket_journal_seq_ready(struct buckets_waiting_for_journal *b,
-				      u64 flushed_seq,
+				  unsigned dev, u64 bucket)
-				      unsigned dev, u64 bucket)
 {
 	struct buckets_waiting_for_journal_table *t;
 	u64 dev_bucket = (u64) dev << 56 | bucket;
-	bool ret = false;
+	u64 ret = 0;
-	unsigned i;
 	mutex_lock(&b->lock);
 	t = b->t;
-	for (i = 0; i < ARRAY_SIZE(t->hash_seeds); i++) {
+	for (unsigned i = 0; i < ARRAY_SIZE(t->hash_seeds); i++) {
 		struct bucket_hashed *h = bucket_hash(t, i, dev_bucket);
 		if (h->dev_bucket == dev_bucket) {
-			ret = h->journal_seq > flushed_seq;
+			ret = h->journal_seq;
 			break;
 		}
 	}

fs/bcachefs/buckets_waiting_for_journal.h+2−2

@@ -4,8 +4,8 @@ · 3 unmodified lines
4		4
5	#include "buckets_waiting_for_journal_types.h"	5	#include "buckets_waiting_for_journal_types.h"
6		6
7	bool bch2_bucket_needs_journal_commit(struct buckets_waiting_for_journal *,	7	u64 bch2_bucket_journal_seq_ready(struct buckets_waiting_for_journal *,
8	u64, unsigned, u64);	8	unsigned, u64);
9	int bch2_set_bucket_needs_journal_commit(struct buckets_waiting_for_journal *,	9	int bch2_set_bucket_needs_journal_commit(struct buckets_waiting_for_journal *,
10	u64, unsigned, u64, u64);	10	u64, unsigned, u64, u64);
11		11

fs/bcachefs/disk_accounting.h+2−0

 static inline void bch2_accounting_mem_read(struct bch_fs *c, struct bpos p,
 					    u64 *v, unsigned nr)
 {
+	percpu_down_read(&c->mark_lock);
 	struct bch_accounting_mem *acc = &c->accounting;
 	unsigned idx = eytzinger0_find(acc->k.data, acc->k.nr, sizeof(acc->k.data[0]),
 				       accounting_pos_cmp, &p);
 	bch2_accounting_mem_read_counters(acc, idx, v, nr, false);
+	percpu_up_read(&c->mark_lock);
 }
 static inline struct bversion journal_pos_to_bversion(struct journal_res *res, unsigned offset)

fs/bcachefs/fsck.c+31−47

 	struct bch_inode_unpacked inode;
 	u32			snapshot;
 	u64			count;
+	u64			i_size;
 };
 struct inode_walker {
 	if (k.k->p.snapshot != i->snapshot && !is_whiteout) {
 		struct inode_walker_entry new = *i;
-		new.snapshot = k.k->p.snapshot;
+		new.snapshot	= k.k->p.snapshot;
-		new.count = 0;
+		new.count	= 0;
+		new.i_size	= 0;
 		struct printbuf buf = PRINTBUF;
 		bch2_bkey_val_to_text(&buf, c, k);
 	return ret;
 }
-static int check_directory_size(struct btree_trans *trans,
-				struct bch_inode_unpacked *inode_u,
-				struct bkey_s_c inode_k, bool *write_inode)
-{
-	struct btree_iter iter;
-	struct bkey_s_c k;
-	u64 new_size = 0;
-	int ret;
-	for_each_btree_key_max_norestart(trans, iter, BTREE_ID_dirents,
-			SPOS(inode_k.k->p.offset, 0, inode_k.k->p.snapshot),
-			POS(inode_k.k->p.offset, U64_MAX),
-			0, k, ret) {
-		if (k.k->type != KEY_TYPE_dirent)
-			continue;
-		struct bkey_s_c_dirent dirent = bkey_s_c_to_dirent(k);
-		struct qstr name = bch2_dirent_get_name(dirent);
-		new_size += dirent_occupied_size(&name);
-	}
-	bch2_trans_iter_exit(trans, &iter);
-	if (!ret && inode_u->bi_size != new_size) {
-		inode_u->bi_size = new_size;
-		*write_inode = true;
-	}
-	return ret;
-}
 static int check_inode(struct btree_trans *trans,
 		       struct btree_iter *iter,
 		       struct bkey_s_c k,
 		u.bi_journal_seq = journal_cur_seq(&c->journal);
 		do_update = true;
 	}
-	if (S_ISDIR(u.bi_mode)) {
-		ret = check_directory_size(trans, &u, k, &do_update);
-		fsck_err_on(ret,
-			    trans, directory_size_mismatch,
-			    "directory inode %llu:%u with the mismatch directory size",
-			    u.bi_inum, k.k->p.snapshot);
-		ret = 0;
-	}
 do_update:
 	if (do_update) {
 		ret = __bch2_fsck_write_inode(trans, &u);
 	return ret;
 }
-static int check_subdir_count(struct btree_trans *trans, struct inode_walker *w)
+static int check_dir_i_size_notnested(struct btree_trans *trans, struct inode_walker *w)
+{
+	struct bch_fs *c = trans->c;
+	int ret = 0;
+	darray_for_each(w->inodes, i)
+		if (fsck_err_on(i->inode.bi_size != i->i_size,
+				trans, inode_dir_wrong_nlink,
+				"directory %llu:%u with wrong i_size: got %llu, should be %llu",
+				w->last_pos.inode, i->snapshot, i->inode.bi_size, i->i_size)) {
+			i->inode.bi_size = i->i_size;
+			ret = bch2_fsck_write_inode(trans, &i->inode);
+			if (ret)
+				break;
+		}
+fsck_err:
+	bch_err_fn(c, ret);
+	return ret;
+}
+static int check_subdir_dirents_count(struct btree_trans *trans, struct inode_walker *w)
 {
 	u32 restart_count = trans->restart_count;
 	return check_subdir_count_notnested(trans, w) ?:
+		check_dir_i_size_notnested(trans, w) ?:
 		trans_was_restarted(trans, restart_count);
 }
 		goto out;
 	if (dir->last_pos.inode != k.k->p.inode && dir->have_inodes) {
-		ret = check_subdir_count(trans, dir);
+		ret = check_subdir_dirents_count(trans, dir);
 		if (ret)
 			goto err;
 	}
 	if (ret)
 		goto err;
-	if (d.v->d_type == DT_DIR)
+	for_each_visible_inode(c, s, dir, d.k->p.snapshot, i) {
-		for_each_visible_inode(c, s, dir, d.k->p.snapshot, i)
+		if (d.v->d_type == DT_DIR)
 			i->count++;
+		i->i_size += bkey_bytes(d.k);
+	}
 out:
 err:
 fsck_err:

fs/bcachefs/inode.h+3−1

 			 struct bch_inode_unpacked *);
 int bch2_inum_opts_get(struct btree_trans*, subvol_inum, struct bch_io_opts *);
+#include "rebalance.h"
 static inline struct bch_extent_rebalance
 bch2_inode_rebalance_opts_get(struct bch_fs *c, struct bch_inode_unpacked *inode)
 {
 	struct bch_io_opts io_opts;
 	bch2_inode_opts_get(&io_opts, c, inode);
-	return io_opts_to_rebalance_opts(&io_opts);
+	return io_opts_to_rebalance_opts(c, &io_opts);
 }
 int bch2_inode_rm_snapshot(struct btree_trans *, u64, u32);

fs/bcachefs/io_write.c+11−1

 	__bch2_write_op_error(out, op, op->pos.offset);
 }
+static void bch2_write_op_error_trans(struct btree_trans *trans, struct printbuf *out,
+				      struct bch_write_op *op, u64 offset)
+{
+	bch2_inum_offset_err_msg_trans(trans, out,
+				       (subvol_inum) { op->subvol, op->pos.inode, },
+				       offset << 9);
+	prt_printf(out, "write error%s: ",
+		   op->flags & BCH_WRITE_MOVE ? "(internal move)" : "");
+}
 void bch2_submit_wbio_replicas(struct bch_write_bio *wbio, struct bch_fs *c,
 			       enum bch_data_type type,
 			       const struct bkey_i *k,
 			struct bkey_i *insert = bch2_keylist_front(&op->insert_keys);
 			struct printbuf buf = PRINTBUF;
-			__bch2_write_op_error(&buf, op, bkey_start_offset(&insert->k));
+			bch2_write_op_error_trans(trans, &buf, op, bkey_start_offset(&insert->k));
 			prt_printf(&buf, "btree update error: %s", bch2_err_str(ret));
 			bch_err_ratelimited(c, "%s", buf.buf);
 			printbuf_exit(&buf);

fs/bcachefs/journal.c+16−2

 	spin_unlock(&j->lock);
 }
+void bch2_journal_halt_locked(struct journal *j)
+{
+	lockdep_assert_held(&j->lock);
+	__journal_entry_close(j, JOURNAL_ENTRY_ERROR_VAL, true);
+	if (!j->err_seq)
+		j->err_seq = journal_cur_seq(j);
+	journal_wake(j);
+}
 static bool journal_entry_want_write(struct journal *j)
 {
 	bool ret = !journal_entry_is_open(j) ||
 	if (nr_unwritten_journal_entries(j) == ARRAY_SIZE(j->buf))
 		return JOURNAL_ERR_max_in_flight;
-	if (bch2_fs_fatal_err_on(journal_cur_seq(j) >= JOURNAL_SEQ_MAX,
+	if (journal_cur_seq(j) >= JOURNAL_SEQ_MAX) {
-				 c, "cannot start: journal seq overflow"))
+		bch_err(c, "cannot start: journal seq overflow");
+		if (bch2_fs_emergency_read_only_locked(c))
+			bch_err(c, "fatal error - emergency read only");
 		return JOURNAL_ERR_insufficient_devices; /* -EROFS */
+	}
 	BUG_ON(!j->cur_entry_sectors);
 	}
 	buf->must_flush = true;
+	j->flushing_seq = max(j->flushing_seq, seq);
 	if (parent && !closure_wait(&buf->wait, parent))
 		BUG();

fs/bcachefs/journal.h+1−0

@@ -409,6 +409,7 @@ bool bch2_journal_noflush_seq(struct journal *, u64, u64); · 408 unmodified lines
409	int bch2_journal_meta(struct journal *);	409	int bch2_journal_meta(struct journal *);
410		410
411	void bch2_journal_halt(struct journal *);	411	void bch2_journal_halt(struct journal *);
		412	void bch2_journal_halt_locked(struct journal *);
412		413
413	static inline int bch2_journal_error(struct journal *j)	414	static inline int bch2_journal_error(struct journal *j)
414	{	415	{

fs/bcachefs/journal_reclaim.c+18−19

@@ -384,12 +384,16 @@ void bch2_journal_pin_drop(struct journal *j, · 383 unmodified lines
384	spin_unlock(&j->lock);	384	spin_unlock(&j->lock);
385	}	385	}
386		386
387	static enum journal_pin_type journal_pin_type(journal_pin_flush_fn fn)	387	static enum journal_pin_type journal_pin_type(struct journal_entry_pin *pin,
		388	journal_pin_flush_fn fn)
388	{	389	{
389	if (fn == bch2_btree_node_flush0 \|\|	390	if (fn == bch2_btree_node_flush0 \|\|
390	fn == bch2_btree_node_flush1)	391	fn == bch2_btree_node_flush1) {
391	return JOURNAL_PIN_TYPE_btree;	392	unsigned idx = fn == bch2_btree_node_flush1;
392	else if (fn == bch2_btree_key_cache_journal_flush)	393	struct btree *b = container_of(pin, struct btree, writes[idx].journal);
		394
		395	return JOURNAL_PIN_TYPE_btree0 - b->c.level;
		396	} else if (fn == bch2_btree_key_cache_journal_flush)
393	return JOURNAL_PIN_TYPE_key_cache;	397	return JOURNAL_PIN_TYPE_key_cache;
394	else	398	else
395	return JOURNAL_PIN_TYPE_other;	399	return JOURNAL_PIN_TYPE_other;
@@ -441,7 +445,7 @@ void bch2_journal_pin_copy(struct journal *j, · 45 unmodified lines
441		445
442	bool reclaim = __journal_pin_drop(j, dst);	446	bool reclaim = __journal_pin_drop(j, dst);
443		447
444	bch2_journal_pin_set_locked(j, seq, dst, flush_fn, journal_pin_type(flush_fn));	448	bch2_journal_pin_set_locked(j, seq, dst, flush_fn, journal_pin_type(dst, flush_fn));
445		449
446	if (reclaim)	450	if (reclaim)
447	bch2_journal_reclaim_fast(j);	451	bch2_journal_reclaim_fast(j);
@@ -465,7 +469,7 @@ void bch2_journal_pin_set(struct journal *j, u64 seq, · 17 unmodified lines
465		469
466	bool reclaim = __journal_pin_drop(j, pin);	470	bool reclaim = __journal_pin_drop(j, pin);
467		471
468	bch2_journal_pin_set_locked(j, seq, pin, flush_fn, journal_pin_type(flush_fn));	472	bch2_journal_pin_set_locked(j, seq, pin, flush_fn, journal_pin_type(pin, flush_fn));
469		473
470	if (reclaim)	474	if (reclaim)
471	bch2_journal_reclaim_fast(j);	475	bch2_journal_reclaim_fast(j);
@@ -587,7 +591,7 @@ static size_t journal_flush_pins(struct journal *j, · 115 unmodified lines
587	spin_lock(&j->lock);	591	spin_lock(&j->lock);
588	/* Pin might have been dropped or rearmed: */	592	/* Pin might have been dropped or rearmed: */
589	if (likely(!err && !j->flush_in_progress_dropped))	593	if (likely(!err && !j->flush_in_progress_dropped))
590	list_move(&pin->list, &journal_seq_pin(j, seq)->flushed[journal_pin_type(flush_fn)]);	594	list_move(&pin->list, &journal_seq_pin(j, seq)->flushed[journal_pin_type(pin, flush_fn)]);
591	j->flush_in_progress = NULL;	595	j->flush_in_progress = NULL;
592	j->flush_in_progress_dropped = false;	596	j->flush_in_progress_dropped = false;
593	spin_unlock(&j->lock);	597	spin_unlock(&j->lock);
@@ -869,18 +873,13 @@ static int journal_flush_done(struct journal *j, u64 seq_to_flush, · 275 unmodified lines
869		873
870	mutex_lock(&j->reclaim_lock);	874	mutex_lock(&j->reclaim_lock);
871		875
872	if (journal_flush_pins_or_still_flushing(j, seq_to_flush,	876	for (int type = JOURNAL_PIN_TYPE_NR - 1;
873	BIT(JOURNAL_PIN_TYPE_key_cache)\|	877	type >= 0;
874	BIT(JOURNAL_PIN_TYPE_other))) {	878	--type)
875	*did_work = true;	879	if (journal_flush_pins_or_still_flushing(j, seq_to_flush, BIT(type))) {
876	goto unlock;	880	*did_work = true;
877	}	881	goto unlock;
878		882	}
879	if (journal_flush_pins_or_still_flushing(j, seq_to_flush,
880	BIT(JOURNAL_PIN_TYPE_btree))) {
881	*did_work = true;
882	goto unlock;
883	}
884		883
885	if (seq_to_flush > journal_cur_seq(j))	884	if (seq_to_flush > journal_cur_seq(j))
886	bch2_journal_entry_close(j);	885	bch2_journal_entry_close(j);

fs/bcachefs/journal_types.h+5−1

  */
 enum journal_pin_type {
-	JOURNAL_PIN_TYPE_btree,
+	JOURNAL_PIN_TYPE_btree3,
+	JOURNAL_PIN_TYPE_btree2,
+	JOURNAL_PIN_TYPE_btree1,
+	JOURNAL_PIN_TYPE_btree0,
 	JOURNAL_PIN_TYPE_key_cache,
 	JOURNAL_PIN_TYPE_other,
 	JOURNAL_PIN_TYPE_NR,
 	/* seq, last_seq from the most recent journal entry successfully written */
 	u64			seq_ondisk;
 	u64			flushed_seq_ondisk;
+	u64			flushing_seq;
 	u64			last_seq_ondisk;
 	u64			err_seq;
 	u64			last_empty_seq;

fs/bcachefs/opts.h+0−14

@@ -659,18 +659,4 @@ static inline void bch2_io_opts_fixups(struct bch_io_opts *opts) · 658 unmodified lines
659	struct bch_io_opts bch2_opts_to_inode_opts(struct bch_opts);	659	struct bch_io_opts bch2_opts_to_inode_opts(struct bch_opts);
660	bool bch2_opt_is_inode_opt(enum bch_opt_id);	660	bool bch2_opt_is_inode_opt(enum bch_opt_id);
661		661
662	/* rebalance opts: */
663
664	static inline struct bch_extent_rebalance io_opts_to_rebalance_opts(struct bch_io_opts *opts)
665	{
666	return (struct bch_extent_rebalance) {
667	.type = BIT(BCH_EXTENT_ENTRY_rebalance),
668	#define x(_name) \
669	._name = opts->_name, \
670	._name##_from_inode = opts->_name##_from_inode,
671	BCH_REBALANCE_OPTS()
672	#undef x
673	};
674	};
675
676	#endif /* _BCACHEFS_OPTS_H */	662	#endif /* _BCACHEFS_OPTS_H */

fs/bcachefs/rebalance.c+3−5

 		}
 	}
 incompressible:
-	if (opts->background_target &&
+	if (opts->background_target)
-	    bch2_target_accepts_data(c, BCH_DATA_user, opts->background_target)) {
 		bkey_for_each_ptr_decode(k.k, ptrs, p, entry)
 			if (!p.ptr.cached && !bch2_dev_in_target(c, p.ptr.dev, opts->background_target))
 				sectors += p.crc.compressed_size;
-	}
 	return sectors;
 }
 	const struct bch_extent_rebalance *old = bch2_bkey_rebalance_opts(k);
 	if (k.k->type == KEY_TYPE_reflink_v || bch2_bkey_ptrs_need_rebalance(c, opts, k)) {
-		struct bch_extent_rebalance new = io_opts_to_rebalance_opts(opts);
+		struct bch_extent_rebalance new = io_opts_to_rebalance_opts(c, opts);
 		return old == NULL || memcmp(old, &new, sizeof(new));
 	} else {
 		return old != NULL;
 			k.k->u64s += sizeof(*old) / sizeof(u64);
 		}
-		*old = io_opts_to_rebalance_opts(opts);
+		*old = io_opts_to_rebalance_opts(c, opts);
 	} else {
 		if (old)
 			extent_entry_drop(k, (union bch_extent_entry *) old);

fs/bcachefs/rebalance.h+20−0

@@ -4,8 +4,28 @@ · 3 unmodified lines
4		4
5	#include "compress.h"	5	#include "compress.h"
6	#include "disk_groups.h"	6	#include "disk_groups.h"
		7	#include "opts.h"
7	#include "rebalance_types.h"	8	#include "rebalance_types.h"
8		9
		10	static inline struct bch_extent_rebalance io_opts_to_rebalance_opts(struct bch_fs *c,
		11	struct bch_io_opts *opts)
		12	{
		13	struct bch_extent_rebalance r = {
		14	.type = BIT(BCH_EXTENT_ENTRY_rebalance),
		15	#define x(_name) \
		16	._name = opts->_name, \
		17	._name##_from_inode = opts->_name##_from_inode,
		18	BCH_REBALANCE_OPTS()
		19	#undef x
		20	};
		21
		22	if (r.background_target &&
		23	!bch2_target_accepts_data(c, BCH_DATA_user, r.background_target))
		24	r.background_target = 0;
		25
		26	return r;
		27	};
		28
9	u64 bch2_bkey_sectors_need_rebalance(struct bch_fs *, struct bkey_s_c);	29	u64 bch2_bkey_sectors_need_rebalance(struct bch_fs *, struct bkey_s_c);
10	int bch2_bkey_set_needs_rebalance(struct bch_fs , struct bch_io_opts , struct bkey_i *);	30	int bch2_bkey_set_needs_rebalance(struct bch_fs , struct bch_io_opts , struct bkey_i *);
11	int bch2_get_update_rebalance_opts(struct btree_trans *,	31	int bch2_get_update_rebalance_opts(struct btree_trans *,

fs/bcachefs/reflink.c+8−8

 					      bool should_commit)
 {
 	if (REFLINK_P_ERROR(p.v))
-		return -BCH_ERR_missing_indirect_extent;
+		return 0;
 	struct bch_fs *c = trans->c;
 	u64 live_start	= REFLINK_P_IDX(p.v);
 		return k;
 	if (unlikely(!bkey_extent_is_reflink_data(k.k))) {
-		bch2_trans_iter_exit(trans, iter);
 		unsigned size = min((u64) k.k->size,
 				    REFLINK_P_IDX(p.v) + p.k->size + le32_to_cpu(p.v->back_pad) -
 				    reflink_offset);
 		int ret = bch2_indirect_extent_missing_error(trans, p, reflink_offset,
 							     k.k->p.offset, should_commit);
-		if (ret)
+		if (ret) {
+			bch2_trans_iter_exit(trans, iter);
 			return bkey_s_c_err(ret);
+		}
 	} else if (unlikely(REFLINK_P_ERROR(p.v))) {
-		bch2_trans_iter_exit(trans, iter);
 		int ret = bch2_indirect_extent_not_missing(trans, p, should_commit);
-		if (ret)
+		if (ret) {
+			bch2_trans_iter_exit(trans, iter);
 			return bkey_s_c_err(ret);
+		}
 	}
 	*offset_into_extent = reflink_offset - bkey_start_offset(k.k);
 	if (ret)
 		return ret;
-	if (bkey_deleted(k.k)) {
+	if (!bkey_refcount_c(k)) {
 		if (!(flags & BTREE_TRIGGER_overwrite))
 			ret = -BCH_ERR_missing_indirect_extent;
 		goto next;

fs/bcachefs/sb-downgrade.c+1−1

@@ -92,7 +92,7 @@ · 91 unmodified lines
92	BCH_FSCK_ERR_accounting_key_replicas_nr_devs_0, \	92	BCH_FSCK_ERR_accounting_key_replicas_nr_devs_0, \
93	BCH_FSCK_ERR_accounting_key_junk_at_end) \	93	BCH_FSCK_ERR_accounting_key_junk_at_end) \
94	x(directory_size, \	94	x(directory_size, \
95	BIT_ULL(BCH_RECOVERY_PASS_check_inodes), \	95	BIT_ULL(BCH_RECOVERY_PASS_check_dirents), \
96	BCH_FSCK_ERR_directory_size_mismatch) \	96	BCH_FSCK_ERR_directory_size_mismatch) \
97		97
98	#define DOWNGRADE_TABLE() \	98	#define DOWNGRADE_TABLE() \

fs/bcachefs/sb-errors_format.h+2−2

@@ -180,9 +180,9 @@ enum bch_fsck_flags { · 179 unmodified lines
180	x(ptr_crc_nonce_mismatch, 162, 0) \	180	x(ptr_crc_nonce_mismatch, 162, 0) \
181	x(ptr_stripe_redundant, 163, 0) \	181	x(ptr_stripe_redundant, 163, 0) \
182	x(reservation_key_nr_replicas_invalid, 164, 0) \	182	x(reservation_key_nr_replicas_invalid, 164, 0) \
183	x(reflink_v_refcount_wrong, 165, 0) \	183	x(reflink_v_refcount_wrong, 165, FSCK_AUTOFIX) \
184	x(reflink_v_pos_bad, 292, 0) \	184	x(reflink_v_pos_bad, 292, 0) \
185	x(reflink_p_to_missing_reflink_v, 166, 0) \	185	x(reflink_p_to_missing_reflink_v, 166, FSCK_AUTOFIX) \
186	x(reflink_refcount_underflow, 293, 0) \	186	x(reflink_refcount_underflow, 293, 0) \
187	x(stripe_pos_bad, 167, 0) \	187	x(stripe_pos_bad, 167, 0) \
188	x(stripe_val_size_bad, 168, 0) \	188	x(stripe_val_size_bad, 168, 0) \

fs/bcachefs/subvolume.c+6−1

 		bch2_bkey_get_iter_typed(trans, &snapshot_iter,
 				BTREE_ID_snapshots, POS(0, snapid),
 				0, snapshot);
-	ret = bkey_err(subvol);
+	ret = bkey_err(snapshot);
 	bch2_fs_inconsistent_on(bch2_err_matches(ret, ENOENT), trans->c,
 				"missing snapshot %u", snapid);
 	if (ret)
 		bch2_bkey_get_iter_typed(trans, &snapshot_tree_iter,
 				BTREE_ID_snapshot_trees, POS(0, treeid),
 				0, snapshot_tree);
+	ret = bkey_err(snapshot_tree);
+	bch2_fs_inconsistent_on(bch2_err_matches(ret, ENOENT), trans->c,
+				"missing snapshot tree %u", treeid);
+	if (ret)
+		goto err;
 	if (le32_to_cpu(snapshot_tree.v->master_subvol) == subvolid) {
 		struct bkey_i_snapshot_tree *snapshot_tree_mut =

fs/bcachefs/super.c+11−0

@@ -411,6 +411,17 @@ bool bch2_fs_emergency_read_only(struct bch_fs *c) · 410 unmodified lines
411	return ret;	411	return ret;
412	}	412	}
413		413
		414	bool bch2_fs_emergency_read_only_locked(struct bch_fs *c)
		415	{
		416	bool ret = !test_and_set_bit(BCH_FS_emergency_ro, &c->flags);
		417
		418	bch2_journal_halt_locked(&c->journal);
		419	bch2_fs_read_only_async(c);
		420
		421	wake_up(&bch2_read_only_wait);
		422	return ret;
		423	}
		424
414	static int bch2_fs_read_write_late(struct bch_fs *c)	425	static int bch2_fs_read_write_late(struct bch_fs *c)
415	{	426	{
416	int ret;	427	int ret;

fs/bcachefs/super.h+1−0

@@ -29,6 +29,7 @@ int bch2_dev_resize(struct bch_fs , struct bch_dev , u64); · 28 unmodified lines
29	struct bch_dev bch2_dev_lookup(struct bch_fs , const char *);	29	struct bch_dev bch2_dev_lookup(struct bch_fs , const char *);
30		30
31	bool bch2_fs_emergency_read_only(struct bch_fs *);	31	bool bch2_fs_emergency_read_only(struct bch_fs *);
		32	bool bch2_fs_emergency_read_only_locked(struct bch_fs *);
32	void bch2_fs_read_only(struct bch_fs *);	33	void bch2_fs_read_only(struct bch_fs *);
33		34
34	int bch2_fs_read_write(struct bch_fs *);	35	int bch2_fs_read_write(struct bch_fs *);

fs/bcachefs/trace.h+13−1

 	TP_ARGS(c, str)
 );
-TRACE_EVENT(discard_buckets,
+DECLARE_EVENT_CLASS(discard_buckets_class,
 	TP_PROTO(struct bch_fs *c, u64 seen, u64 open,
 		 u64 need_journal_commit, u64 discarded, const char *err),
 	TP_ARGS(c, seen, open, need_journal_commit, discarded, err),
 		  __entry->err)
 );
+DEFINE_EVENT(discard_buckets_class, discard_buckets,
+	TP_PROTO(struct bch_fs *c, u64 seen, u64 open,
+		 u64 need_journal_commit, u64 discarded, const char *err),
+	TP_ARGS(c, seen, open, need_journal_commit, discarded, err)
+);
+DEFINE_EVENT(discard_buckets_class, discard_buckets_fast,
+	TP_PROTO(struct bch_fs *c, u64 seen, u64 open,
+		 u64 need_journal_commit, u64 discarded, const char *err),
+	TP_ARGS(c, seen, open, need_journal_commit, discarded, err)
+);
 TRACE_EVENT(bucket_invalidate,
 	TP_PROTO(struct bch_fs *c, unsigned dev, u64 bucket, u32 sectors),
 	TP_ARGS(c, dev, bucket, sectors),

fs/btrfs/ctree.c+2−0

 		if (!p->skip_locking) {
 			btrfs_unlock_up_safe(p, parent_level + 1);
+			btrfs_maybe_reset_lockdep_class(root, tmp);
 			tmp_locked = true;
 			btrfs_tree_read_lock(tmp);
 			btrfs_release_path(p);
 	if (!p->skip_locking) {
 		ASSERT(ret == -EAGAIN);
+		btrfs_maybe_reset_lockdep_class(root, tmp);
 		tmp_locked = true;
 		btrfs_tree_read_lock(tmp);
 		btrfs_release_path(p);

fs/btrfs/extent_io.c+20−9

 		u64 end;
 		u32 len;
-		/* For now only order 0 folios are supported for data. */
-		ASSERT(folio_order(folio) == 0);
 		btrfs_debug(fs_info,
 			"%s: bi_sector=%llu, err=%d, mirror=%u",
 			__func__, bio->bi_iter.bi_sector, bio->bi_status,
 		if (likely(uptodate)) {
 			loff_t i_size = i_size_read(inode);
-			pgoff_t end_index = i_size >> folio_shift(folio);
 			/*
 			 * Zero out the remaining part if this range straddles
 			 * Here we should only zero the range inside the folio,
 			 * not touch anything else.
 			 *
-			 * NOTE: i_size is exclusive while end is inclusive.
+			 * NOTE: i_size is exclusive while end is inclusive and
+			 * folio_contains() takes PAGE_SIZE units.
 			 */
-			if (folio_index(folio) == end_index && i_size <= end) {
+			if (folio_contains(folio, i_size >> PAGE_SHIFT) &&
+			    i_size <= end) {
 				u32 zero_start = max(offset_in_folio(folio, i_size),
 						     offset_in_folio(folio, start));
 				u32 zero_len = offset_in_folio(folio, end) + 1 -
 					 u64 len, struct extent_map **em_cached)
 {
 	struct extent_map *em;
-	struct extent_state *cached_state = NULL;
 	ASSERT(em_cached);
 		*em_cached = NULL;
 	}
-	btrfs_lock_and_flush_ordered_range(inode, start, start + len - 1, &cached_state);
 	em = btrfs_get_extent(inode, folio, start, len);
 	if (!IS_ERR(em)) {
 		BUG_ON(*em_cached);
 		refcount_inc(&em->refs);
 		*em_cached = em;
 	}
-	unlock_extent(&inode->io_tree, start, start + len - 1, &cached_state);
 	return em;
 }
 		return ret;
 	}
-	if (folio->index == last_byte >> folio_shift(folio)) {
+	if (folio_contains(folio, last_byte >> PAGE_SHIFT)) {
 		size_t zero_offset = offset_in_folio(folio, last_byte);
 		if (zero_offset) {
 int btrfs_read_folio(struct file *file, struct folio *folio)
 {
+	struct btrfs_inode *inode = folio_to_inode(folio);
+	const u64 start = folio_pos(folio);
+	const u64 end = start + folio_size(folio) - 1;
+	struct extent_state *cached_state = NULL;
 	struct btrfs_bio_ctrl bio_ctrl = { .opf = REQ_OP_READ };
 	struct extent_map *em_cached = NULL;
 	int ret;
+	btrfs_lock_and_flush_ordered_range(inode, start, end, &cached_state);
 	ret = btrfs_do_readpage(folio, &em_cached, &bio_ctrl, NULL);
+	unlock_extent(&inode->io_tree, start, end, &cached_state);
 	free_extent_map(em_cached);
 	/*
 {
 	struct btrfs_bio_ctrl bio_ctrl = { .opf = REQ_OP_READ | REQ_RAHEAD };
 	struct folio *folio;
+	struct btrfs_inode *inode = BTRFS_I(rac->mapping->host);
+	const u64 start = readahead_pos(rac);
+	const u64 end = start + readahead_length(rac) - 1;
+	struct extent_state *cached_state = NULL;
 	struct extent_map *em_cached = NULL;
 	u64 prev_em_start = (u64)-1;
+	btrfs_lock_and_flush_ordered_range(inode, start, end, &cached_state);
 	while ((folio = readahead_folio(rac)) != NULL)
 		btrfs_do_readpage(folio, &em_cached, &bio_ctrl, &prev_em_start);
+	unlock_extent(&inode->io_tree, start, end, &cached_state);
 	if (em_cached)
 		free_extent_map(em_cached);
 	submit_one_bio(&bio_ctrl);

fs/btrfs/file.c+1−3

 	loff_t pos = iocb->ki_pos;
 	int ret;
 	loff_t oldsize;
-	loff_t start_pos;
 	/*
 	 * Quickly bail out on NOWAIT writes if we don't have the nodatacow or
 		inode_inc_iversion(inode);
 	}
-	start_pos = round_down(pos, fs_info->sectorsize);
 	oldsize = i_size_read(inode);
-	if (start_pos > oldsize) {
+	if (pos > oldsize) {
 		/* Expand hole size to cover write data, preventing empty gap */
 		loff_t end_pos = round_up(pos + count, fs_info->sectorsize);

fs/btrfs/ordered-data.c+12−0

@@ -1229,6 +1229,18 @@ struct btrfs_ordered_extent *btrfs_split_ordered_extent( · 1228 unmodified lines
1229	*/	1229	*/
1230	if (WARN_ON_ONCE(len >= ordered->num_bytes))	1230	if (WARN_ON_ONCE(len >= ordered->num_bytes))
1231	return ERR_PTR(-EINVAL);	1231	return ERR_PTR(-EINVAL);
		1232	/*
		1233	* If our ordered extent had an error there's no point in continuing.
		1234	* The error may have come from a transaction abort done either by this
		1235	* task or some other concurrent task, and the transaction abort path
		1236	* iterates over all existing ordered extents and sets the flag
		1237	* BTRFS_ORDERED_IOERR on them.
		1238	*/
		1239	if (unlikely(flags & (1U << BTRFS_ORDERED_IOERR))) {
		1240	const int fs_error = BTRFS_FS_ERROR(fs_info);
		1241
		1242	return fs_error ? ERR_PTR(fs_error) : ERR_PTR(-EIO);
		1243	}
1232	/* We cannot split partially completed ordered extents. */	1244	/* We cannot split partially completed ordered extents. */
1233	if (ordered->bytes_left) {	1245	if (ordered->bytes_left) {
1234	ASSERT(!(flags & ~BTRFS_ORDERED_TYPE_FLAGS));	1246	ASSERT(!(flags & ~BTRFS_ORDERED_TYPE_FLAGS));

fs/btrfs/qgroup.c+5−6

 	 * Commit current transaction to make sure all the rfer/excl numbers
 	 * get updated.
 	 */
-	trans = btrfs_start_transaction(fs_info->quota_root, 0);
+	ret = btrfs_commit_current_transaction(fs_info->quota_root);
-	if (IS_ERR(trans))
-		return PTR_ERR(trans);
-	ret = btrfs_commit_transaction(trans);
 	if (ret < 0)
 		return ret;
 	/*
 	 * It's squota and the subvolume still has numbers needed for future
 	 * accounting, in this case we can not delete it.  Just skip it.
+	 *
+	 * Or the qgroup is already removed by a qgroup rescan. For both cases we're
+	 * safe to ignore them.
 	 */
-	if (ret == -EBUSY)
+	if (ret == -EBUSY || ret == -ENOENT)
 		ret = 0;
 	return ret;
 }

fs/btrfs/transaction.c+3−1

 	cur_trans = fs_info->running_transaction;
 	if (cur_trans) {
 		if (TRANS_ABORTED(cur_trans)) {
+			const int abort_error = cur_trans->aborted;
 			spin_unlock(&fs_info->trans_lock);
-			return cur_trans->aborted;
+			return abort_error;
 		}
 		if (btrfs_blocked_trans_types[cur_trans->state] & type) {
 			spin_unlock(&fs_info->trans_lock);

fs/dcache.c+3−3

@@ -1700,7 +1700,7 @@ static struct dentry __d_alloc(struct super_block sb, const struct qstr *name) · 1699 unmodified lines
1700	smp_store_release(&dentry->d_name.name, dname); /* ^^^ */	1700	smp_store_release(&dentry->d_name.name, dname); /* ^^^ */
1701		1701
1702	dentry->d_flags = 0;	1702	dentry->d_flags = 0;
1703	lockref_init(&dentry->d_lockref, 1);	1703	lockref_init(&dentry->d_lockref);
1704	seqcount_spinlock_init(&dentry->d_seq, &dentry->d_lock);	1704	seqcount_spinlock_init(&dentry->d_seq, &dentry->d_lock);
1705	dentry->d_inode = NULL;	1705	dentry->d_inode = NULL;
1706	dentry->d_parent = dentry;	1706	dentry->d_parent = dentry;
@@ -2966,11 +2966,11 @@ static int __d_unalias(struct dentry dentry, struct dentry alias) · 1259 unmodified lines
2966	goto out_err;	2966	goto out_err;
2967	m2 = &alias->d_parent->d_inode->i_rwsem;	2967	m2 = &alias->d_parent->d_inode->i_rwsem;
2968	out_unalias:	2968	out_unalias:
2969	if (alias->d_op->d_unalias_trylock &&	2969	if (alias->d_op && alias->d_op->d_unalias_trylock &&
2970	!alias->d_op->d_unalias_trylock(alias))	2970	!alias->d_op->d_unalias_trylock(alias))
2971	goto out_err;	2971	goto out_err;
2972	__d_move(alias, dentry, false);	2972	__d_move(alias, dentry, false);
2973	if (alias->d_op->d_unalias_unlock)	2973	if (alias->d_op && alias->d_op->d_unalias_unlock)
2974	alias->d_op->d_unalias_unlock(alias);	2974	alias->d_op->d_unalias_unlock(alias);
2975	ret = 0;	2975	ret = 0;
2976	out_err:	2976	out_err:

fs/erofs/zdata.c+1−1

@@ -726,7 +726,7 @@ static int z_erofs_register_pcluster(struct z_erofs_frontend *fe) · 725 unmodified lines
726	if (IS_ERR(pcl))	726	if (IS_ERR(pcl))
727	return PTR_ERR(pcl);	727	return PTR_ERR(pcl);
728		728
729	lockref_init(&pcl->lockref, 1); /* one ref for this request */	729	lockref_init(&pcl->lockref); /* one ref for this request */
730	pcl->algorithmformat = map->m_algorithmformat;	730	pcl->algorithmformat = map->m_algorithmformat;
731	pcl->length = 0;	731	pcl->length = 0;
732	pcl->partial = true;	732	pcl->partial = true;

fs/file_table.c+16−0

 	 * refcount bumps we should reinitialize the reused file first.
 	 */
 	file_ref_init(&f->f_ref, 1);
+	/*
+	 * Disable permission and pre-content events for all files by default.
+	 * They may be enabled later by file_set_fsnotify_mode_from_watchers().
+	 */
+	file_set_fsnotify_mode(f, FMODE_NONOTIFY_PERM);
 	return 0;
 }
 	if (IS_ERR(file)) {
 		ihold(inode);
 		path_put(&path);
+		return file;
 	}
+	/*
+	 * Disable all fsnotify events for pseudo files by default.
+	 * They may be enabled by caller with file_set_fsnotify_mode().
+	 */
+	file_set_fsnotify_mode(file, FMODE_NONOTIFY);
 	return file;
 }
 EXPORT_SYMBOL(alloc_file_pseudo);
 		return file;
 	}
 	file_init_path(file, &path, fops);
+	/*
+	 * Disable all fsnotify events for pseudo files by default.
+	 * They may be enabled by caller with file_set_fsnotify_mode().
+	 */
+	file_set_fsnotify_mode(file, FMODE_NONOTIFY);
 	return file;
 }
 EXPORT_SYMBOL_GPL(alloc_file_pseudo_noaccount);

fs/gfs2/glock.c+1−1

 	if (glops->go_instantiate)
 		gl->gl_flags |= BIT(GLF_INSTANTIATE_NEEDED);
 	gl->gl_name = name;
+	lockref_init(&gl->gl_lockref);
 	lockdep_set_subclass(&gl->gl_lockref.lock, glops->go_subclass);
-	gl->gl_lockref.count = 1;
 	gl->gl_state = LM_ST_UNLOCKED;
 	gl->gl_target = LM_ST_UNLOCKED;
 	gl->gl_demote_state = LM_ST_EXCLUSIVE;

fs/gfs2/main.c+0−1

@@ -51,7 +51,6 @@ static void gfs2_init_glock_once(void *foo) · 50 unmodified lines
51	{	51	{
52	struct gfs2_glock *gl = foo;	52	struct gfs2_glock *gl = foo;
53		53
54	spin_lock_init(&gl->gl_lockref.lock);
55	INIT_LIST_HEAD(&gl->gl_holders);	54	INIT_LIST_HEAD(&gl->gl_holders);
56	INIT_LIST_HEAD(&gl->gl_lru);	55	INIT_LIST_HEAD(&gl->gl_lru);
57	INIT_LIST_HEAD(&gl->gl_ail_list);	56	INIT_LIST_HEAD(&gl->gl_ail_list);

fs/gfs2/quota.c+2−2

 		return NULL;
 	qd->qd_sbd = sdp;
-	lockref_init(&qd->qd_lockref, 0);
+	lockref_init(&qd->qd_lockref);
 	qd->qd_id = qid;
 	qd->qd_slot = -1;
 	INIT_LIST_HEAD(&qd->qd_lru);
 	spin_lock_bucket(hash);
 	*qdp = qd = gfs2_qd_search_bucket(hash, sdp, qid);
 	if (qd == NULL) {
-		new_qd->qd_lockref.count++;
 		*qdp = new_qd;
 		list_add(&new_qd->qd_list, &sdp->sd_quota_list);
 		hlist_bl_add_head_rcu(&new_qd->qd_hlist, &qd_hash_table[hash]);
 			if (qd == NULL)
 				goto fail_brelse;
+			qd->qd_lockref.count = 0;
 			set_bit(QDF_CHANGE, &qd->qd_flags);
 			qd->qd_change = qc_change;
 			qd->qd_slot = slot;

fs/namespace.c+30−24

@@ -5087,30 +5087,29 @@ static int statmount_mnt_opts(struct kstatmount s, struct seq_file seq) · 5086 unmodified lines
5087	{	5087	{
5088	struct vfsmount *mnt = s->mnt;	5088	struct vfsmount *mnt = s->mnt;
5089	struct super_block *sb = mnt->mnt_sb;	5089	struct super_block *sb = mnt->mnt_sb;
		5090	size_t start = seq->count;
5090	int err;	5091	int err;
5091		5092
5092	if (sb->s_op->show_options) {	5093	err = security_sb_show_options(seq, sb);
5093	size_t start = seq->count;	5094	if (err)
5094		5095	return err;
5095	err = security_sb_show_options(seq, sb);
5096	if (err)
5097	return err;
5098		5096
		5097	if (sb->s_op->show_options) {
5099	err = sb->s_op->show_options(seq, mnt->mnt_root);	5098	err = sb->s_op->show_options(seq, mnt->mnt_root);
5100	if (err)	5099	if (err)
5101	return err;	5100	return err;
		5101	}
5102		5102
5103	if (unlikely(seq_has_overflowed(seq)))	5103	if (unlikely(seq_has_overflowed(seq)))
5104	return -EAGAIN;	5104	return -EAGAIN;
5105		5105
5106	if (seq->count == start)	5106	if (seq->count == start)
5107	return 0;	5107	return 0;
5108		5108
5109	/* skip leading comma */	5109	/* skip leading comma */
5110	memmove(seq->buf + start, seq->buf + start + 1,	5110	memmove(seq->buf + start, seq->buf + start + 1,
5111	seq->count - start - 1);	5111	seq->count - start - 1);
5112	seq->count--;	5112	seq->count--;
5113	}
5114		5113
5115	return 0;	5114	return 0;
5116	}	5115	}
@@ -5191,39 +5190,45 @@ static int statmount_string(struct kstatmount *s, u64 flag) · 74 unmodified lines
5191	size_t kbufsize;	5190	size_t kbufsize;
5192	struct seq_file *seq = &s->seq;	5191	struct seq_file *seq = &s->seq;
5193	struct statmount *sm = &s->sm;	5192	struct statmount *sm = &s->sm;
5194	u32 start = seq->count;	5193	u32 start, *offp;
		5194
		5195	/* Reserve an empty string at the beginning for any unset offsets */
		5196	if (!seq->count)
		5197	seq_putc(seq, 0);
		5198
		5199	start = seq->count;
5195		5200
5196	switch (flag) {	5201	switch (flag) {
5197	case STATMOUNT_FS_TYPE:	5202	case STATMOUNT_FS_TYPE:
5198	sm->fs_type = start;	5203	offp = &sm->fs_type;
5199	ret = statmount_fs_type(s, seq);	5204	ret = statmount_fs_type(s, seq);
5200	break;	5205	break;
5201	case STATMOUNT_MNT_ROOT:	5206	case STATMOUNT_MNT_ROOT:
5202	sm->mnt_root = start;	5207	offp = &sm->mnt_root;
5203	ret = statmount_mnt_root(s, seq);	5208	ret = statmount_mnt_root(s, seq);
5204	break;	5209	break;
5205	case STATMOUNT_MNT_POINT:	5210	case STATMOUNT_MNT_POINT:
5206	sm->mnt_point = start;	5211	offp = &sm->mnt_point;
5207	ret = statmount_mnt_point(s, seq);	5212	ret = statmount_mnt_point(s, seq);
5208	break;	5213	break;
5209	case STATMOUNT_MNT_OPTS:	5214	case STATMOUNT_MNT_OPTS:
5210	sm->mnt_opts = start;	5215	offp = &sm->mnt_opts;
5211	ret = statmount_mnt_opts(s, seq);	5216	ret = statmount_mnt_opts(s, seq);
5212	break;	5217	break;
5213	case STATMOUNT_OPT_ARRAY:	5218	case STATMOUNT_OPT_ARRAY:
5214	sm->opt_array = start;	5219	offp = &sm->opt_array;
5215	ret = statmount_opt_array(s, seq);	5220	ret = statmount_opt_array(s, seq);
5216	break;	5221	break;
5217	case STATMOUNT_OPT_SEC_ARRAY:	5222	case STATMOUNT_OPT_SEC_ARRAY:
5218	sm->opt_sec_array = start;	5223	offp = &sm->opt_sec_array;
5219	ret = statmount_opt_sec_array(s, seq);	5224	ret = statmount_opt_sec_array(s, seq);
5220	break;	5225	break;
5221	case STATMOUNT_FS_SUBTYPE:	5226	case STATMOUNT_FS_SUBTYPE:
5222	sm->fs_subtype = start;	5227	offp = &sm->fs_subtype;
5223	statmount_fs_subtype(s, seq);	5228	statmount_fs_subtype(s, seq);
5224	break;	5229	break;
5225	case STATMOUNT_SB_SOURCE:	5230	case STATMOUNT_SB_SOURCE:
5226	sm->sb_source = start;	5231	offp = &sm->sb_source;
5227	ret = statmount_sb_source(s, seq);	5232	ret = statmount_sb_source(s, seq);
5228	break;	5233	break;
5229	default:	5234	default:
@@ -5251,6 +5256,7 @@ static int statmount_string(struct kstatmount *s, u64 flag) · 21 unmodified lines
5251		5256
5252	seq->buf[seq->count++] = '\0';	5257	seq->buf[seq->count++] = '\0';
5253	sm->mask \|= flag;	5258	sm->mask \|= flag;
		5259	*offp = start;
5254	return 0;	5260	return 0;
5255	}	5261	}
5256		5262

fs/netfs/buffered_read.c+13−6

 			netfs_cache_read_terminated, subreq);
 }
-static void netfs_issue_read(struct netfs_io_request *rreq,
+static void netfs_queue_read(struct netfs_io_request *rreq,
-			     struct netfs_io_subrequest *subreq)
+			     struct netfs_io_subrequest *subreq,
+			     bool last_subreq)
 {
 	struct netfs_io_stream *stream = &rreq->io_streams[0];
 		}
 	}
+	if (last_subreq) {
+		smp_wmb(); /* Write lists before ALL_QUEUED. */
+		set_bit(NETFS_RREQ_ALL_QUEUED, &rreq->flags);
+	}
 	spin_unlock(&rreq->lock);
+}
+static void netfs_issue_read(struct netfs_io_request *rreq,
+			     struct netfs_io_subrequest *subreq)
+{
 	switch (subreq->source) {
 	case NETFS_DOWNLOAD_FROM_SERVER:
 		rreq->netfs_ops->issue_read(subreq);
 		}
 		size -= slice;
 		start += slice;
-		if (size <= 0) {
-			smp_wmb(); /* Write lists before ALL_QUEUED. */
-			set_bit(NETFS_RREQ_ALL_QUEUED, &rreq->flags);
-		}
+		netfs_queue_read(rreq, subreq, size <= 0);
 		netfs_issue_read(rreq, subreq);
 		cond_resched();
 	} while (size > 0);

fs/netfs/internal.h+4−0

 extern atomic_t netfs_n_rh_write_done;
 extern atomic_t netfs_n_rh_write_failed;
 extern atomic_t netfs_n_rh_write_zskip;
+extern atomic_t netfs_n_rh_retry_read_req;
+extern atomic_t netfs_n_rh_retry_read_subreq;
 extern atomic_t netfs_n_wh_buffered_write;
 extern atomic_t netfs_n_wh_writethrough;
 extern atomic_t netfs_n_wh_dio_write;
 extern atomic_t netfs_n_wh_write;
 extern atomic_t netfs_n_wh_write_done;
 extern atomic_t netfs_n_wh_write_failed;
+extern atomic_t netfs_n_wh_retry_write_req;
+extern atomic_t netfs_n_wh_retry_write_subreq;
 extern atomic_t netfs_n_wb_lock_skip;
 extern atomic_t netfs_n_wb_lock_wait;
 extern atomic_t netfs_n_folioq;

fs/netfs/read_collect.c+4−2

  */
 void netfs_wake_read_collector(struct netfs_io_request *rreq)
 {
-	if (test_bit(NETFS_RREQ_OFFLOAD_COLLECTION, &rreq->flags)) {
+	if (test_bit(NETFS_RREQ_OFFLOAD_COLLECTION, &rreq->flags) &&
+	    !test_bit(NETFS_RREQ_RETRYING, &rreq->flags)) {
 		if (!work_pending(&rreq->work)) {
 			netfs_get_request(rreq, netfs_rreq_trace_get_work);
 			if (!queue_work(system_unbound_wq, &rreq->work))
 	smp_mb__after_atomic(); /* Clear IN_PROGRESS before task state */
 	/* If we are at the head of the queue, wake up the collector. */
-	if (list_is_first(&subreq->rreq_link, &stream->subrequests))
+	if (list_is_first(&subreq->rreq_link, &stream->subrequests) ||
+	    test_bit(NETFS_RREQ_RETRYING, &rreq->flags))
 		netfs_wake_read_collector(rreq);
 	netfs_put_subrequest(subreq, true, netfs_sreq_trace_put_terminated);

fs/netfs/read_retry.c+33−10

 {
 	__clear_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags);
 	__set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags);
-	netfs_get_subrequest(subreq, netfs_sreq_trace_get_resubmit);
+	netfs_stat(&netfs_n_rh_retry_read_subreq);
 	subreq->rreq->netfs_ops->issue_read(subreq);
 }
 				__clear_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags);
 				subreq->retry_count++;
 				netfs_reset_iter(subreq);
+				netfs_get_subrequest(subreq, netfs_sreq_trace_get_resubmit);
 				netfs_reissue_read(rreq, subreq);
 			}
 		}
 		struct iov_iter source;
 		unsigned long long start, len;
 		size_t part;
-		bool boundary = false;
+		bool boundary = false, subreq_superfluous = false;
 		/* Go through the subreqs and find the next span of contiguous
 		 * buffer that we then rejig (cifs, for example, needs the
 		/* Work through the sublist. */
 		subreq = from;
 		list_for_each_entry_from(subreq, &stream->subrequests, rreq_link) {
-			if (!len)
+			if (!len) {
+				subreq_superfluous = true;
 				break;
+			}
 			subreq->source	= NETFS_DOWNLOAD_FROM_SERVER;
 			subreq->start	= start - subreq->transferred;
 			subreq->len	= len   + subreq->transferred;
 			netfs_get_subrequest(subreq, netfs_sreq_trace_get_resubmit);
 			netfs_reissue_read(rreq, subreq);
-			if (subreq == to)
+			if (subreq == to) {
+				subreq_superfluous = false;
 				break;
+			}
 		}
 		/* If we managed to use fewer subreqs, we can discard the
 		 * excess; if we used the same number, then we're done.
 		 */
 		if (!len) {
-			if (subreq == to)
+			if (!subreq_superfluous)
 				continue;
 			list_for_each_entry_safe_from(subreq, tmp,
 						      &stream->subrequests, rreq_link) {
-				trace_netfs_sreq(subreq, netfs_sreq_trace_discard);
+				trace_netfs_sreq(subreq, netfs_sreq_trace_superfluous);
 				list_del(&subreq->rreq_link);
 				netfs_put_subrequest(subreq, false, netfs_sreq_trace_put_done);
 				if (subreq == to)
 			subreq->source		= NETFS_DOWNLOAD_FROM_SERVER;
 			subreq->start		= start;
 			subreq->len		= len;
-			subreq->debug_index	= atomic_inc_return(&rreq->subreq_counter);
 			subreq->stream_nr	= stream->stream_nr;
 			subreq->retry_count	= 1;
 			trace_netfs_sreq_ref(rreq->debug_id, subreq->debug_index,
 					     refcount_read(&subreq->ref),
 					     netfs_sreq_trace_new);
-			netfs_get_subrequest(subreq, netfs_sreq_trace_get_resubmit);
 			list_add(&subreq->rreq_link, &to->rreq_link);
 			to = list_next_entry(to, rreq_link);
 {
 	struct netfs_io_subrequest *subreq;
 	struct netfs_io_stream *stream = &rreq->io_streams[0];
+	DEFINE_WAIT(myself);
+	netfs_stat(&netfs_n_rh_retry_read_req);
+	set_bit(NETFS_RREQ_RETRYING, &rreq->flags);
 	/* Wait for all outstanding I/O to quiesce before performing retries as
 	 * we may need to renegotiate the I/O sizes.
 	 */
 	list_for_each_entry(subreq, &stream->subrequests, rreq_link) {
-		wait_on_bit(&subreq->flags, NETFS_SREQ_IN_PROGRESS,
+		if (!test_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags))
-			    TASK_UNINTERRUPTIBLE);
+			continue;
+		trace_netfs_rreq(rreq, netfs_rreq_trace_wait_queue);
+		for (;;) {
+			prepare_to_wait(&rreq->waitq, &myself, TASK_UNINTERRUPTIBLE);
+			if (!test_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags))
+				break;
+			trace_netfs_sreq(subreq, netfs_sreq_trace_wait_for);
+			schedule();
+			trace_netfs_rreq(rreq, netfs_rreq_trace_woke_queue);
+		}
+		finish_wait(&rreq->waitq, &myself);
 	}
+	clear_bit(NETFS_RREQ_RETRYING, &rreq->flags);
 	trace_netfs_rreq(rreq, netfs_rreq_trace_resubmit);
 	netfs_retry_read_subrequests(rreq);

fs/netfs/stats.c+9−0

 atomic_t netfs_n_rh_write_done;
 atomic_t netfs_n_rh_write_failed;
 atomic_t netfs_n_rh_write_zskip;
+atomic_t netfs_n_rh_retry_read_req;
+atomic_t netfs_n_rh_retry_read_subreq;
 atomic_t netfs_n_wh_buffered_write;
 atomic_t netfs_n_wh_writethrough;
 atomic_t netfs_n_wh_dio_write;
 atomic_t netfs_n_wh_write;
 atomic_t netfs_n_wh_write_done;
 atomic_t netfs_n_wh_write_failed;
+atomic_t netfs_n_wh_retry_write_req;
+atomic_t netfs_n_wh_retry_write_subreq;
 atomic_t netfs_n_wb_lock_skip;
 atomic_t netfs_n_wb_lock_wait;
 atomic_t netfs_n_folioq;
 		   atomic_read(&netfs_n_wh_write),
 		   atomic_read(&netfs_n_wh_write_done),
 		   atomic_read(&netfs_n_wh_write_failed));
+	seq_printf(m, "Retries: rq=%u rs=%u wq=%u ws=%u\n",
+		   atomic_read(&netfs_n_rh_retry_read_req),
+		   atomic_read(&netfs_n_rh_retry_read_subreq),
+		   atomic_read(&netfs_n_wh_retry_write_req),
+		   atomic_read(&netfs_n_wh_retry_write_subreq));
 	seq_printf(m, "Objs   : rr=%u sr=%u foq=%u wsc=%u\n",
 		   atomic_read(&netfs_n_rh_rreq),
 		   atomic_read(&netfs_n_rh_sreq),

fs/netfs/write_issue.c+1−0

@@ -253,6 +253,7 @@ void netfs_reissue_write(struct netfs_io_stream *stream, · 252 unmodified lines
253	subreq->retry_count++;	253	subreq->retry_count++;
254	__clear_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags);	254	__clear_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags);
255	__set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags);	255	__set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags);
		256	netfs_stat(&netfs_n_wh_retry_write_subreq);
256	netfs_do_issue_write(stream, subreq);	257	netfs_do_issue_write(stream, subreq);
257	}	258	}
258		259

fs/netfs/write_retry.c+2−0

@@ -203,6 +203,8 @@ void netfs_retry_writes(struct netfs_io_request *wreq) · 202 unmodified lines
203	struct netfs_io_stream *stream;	203	struct netfs_io_stream *stream;
204	int s;	204	int s;
205		205
		206	netfs_stat(&netfs_n_wh_retry_write_req);
		207
206	/* Wait for all outstanding I/O to quiesce before performing retries as	208	/* Wait for all outstanding I/O to quiesce before performing retries as
207	* we may need to renegotiate the I/O sizes.	209	* we may need to renegotiate the I/O sizes.
208	*/	210	*/

fs/nfsd/filecache.c+10−1

@@ -446,11 +446,20 @@ nfsd_file_dispose_list_delayed(struct list_head *dispose) · 445 unmodified lines
446	struct nfsd_file, nf_gc);	446	struct nfsd_file, nf_gc);
447	struct nfsd_net *nn = net_generic(nf->nf_net, nfsd_net_id);	447	struct nfsd_net *nn = net_generic(nf->nf_net, nfsd_net_id);
448	struct nfsd_fcache_disposal *l = nn->fcache_disposal;	448	struct nfsd_fcache_disposal *l = nn->fcache_disposal;
		449	struct svc_serv *serv;
449		450
450	spin_lock(&l->lock);	451	spin_lock(&l->lock);
451	list_move_tail(&nf->nf_gc, &l->freeme);	452	list_move_tail(&nf->nf_gc, &l->freeme);
452	spin_unlock(&l->lock);	453	spin_unlock(&l->lock);
453	svc_wake_up(nn->nfsd_serv);	454
		455	/*
		456	* The filecache laundrette is shut down after the
		457	* nn->nfsd_serv pointer is cleared, but before the
		458	* svc_serv is freed.
		459	*/
		460	serv = nn->nfsd_serv;
		461	if (serv)
		462	svc_wake_up(serv);
454	}	463	}
455	}	464	}
456		465

fs/nfsd/nfs2acl.c+2−0

@@ -84,6 +84,8 @@ out: · 83 unmodified lines
84	fail:	84	fail:
85	posix_acl_release(resp->acl_access);	85	posix_acl_release(resp->acl_access);
86	posix_acl_release(resp->acl_default);	86	posix_acl_release(resp->acl_default);
		87	resp->acl_access = NULL;
		88	resp->acl_default = NULL;
87	goto out;	89	goto out;
88	}	90	}
89		91

fs/nfsd/nfs3acl.c+2−0

@@ -76,6 +76,8 @@ out: · 75 unmodified lines
76	fail:	76	fail:
77	posix_acl_release(resp->acl_access);	77	posix_acl_release(resp->acl_access);
78	posix_acl_release(resp->acl_default);	78	posix_acl_release(resp->acl_default);
		79	resp->acl_access = NULL;
		80	resp->acl_default = NULL;
79	goto out;	81	goto out;
80	}	82	}
81		83

fs/nfsd/nfs4callback.c+6−3

 		return status;
 	status = decode_cb_op_status(xdr, OP_CB_GETATTR, &cb->cb_status);
-	if (unlikely(status || cb->cb_seq_status))
+	if (unlikely(status || cb->cb_status))
 		return status;
 	if (xdr_stream_decode_uint32_array(xdr, bitmap, 3) < 0)
 		return -NFSERR_BAD_XDR;
 		nfsd4_process_cb_update(cb);
 	clnt = clp->cl_cb_client;
-	if (!clnt) {
+	if (!clnt || clp->cl_state == NFSD4_COURTESY) {
-		/* Callback channel broken, or client killed; give up: */
+		/*
+		 * Callback channel broken, client killed or
+		 * nfs4_client in courtesy state; give up.
+		 */
 		nfsd41_destroy_cb(cb);
 		return;
 	}

fs/nfsd/nfs4state.c+2−1

 			}
 		} while (slot && --cnt > 0);
 	}
+out:
 	seq->maxslots = max(session->se_target_maxslots, seq->maxslots);
 	seq->target_maxslots = session->se_target_maxslots;
-out:
 	switch (clp->cl_cb_state) {
 	case NFSD4_CB_DOWN:
 		seq->status_flags = SEQ4_STATUS_CB_PATH_DOWN;

fs/nfsd/nfsfh.c+3−2

@@ -380,8 +380,9 @@ __fh_verify(struct svc_rqst *rqstp, · 379 unmodified lines
380	error = check_nfsd_access(exp, rqstp, may_bypass_gss);	380	error = check_nfsd_access(exp, rqstp, may_bypass_gss);
381	if (error)	381	if (error)
382	goto out;	382	goto out;
383		383	/* During LOCALIO call to fh_verify will be called with a NULL rqstp */
384	svc_xprt_set_valid(rqstp->rq_xprt);	384	if (rqstp)
		385	svc_xprt_set_valid(rqstp->rq_xprt);
385		386
386	/* Finally, check access permissions. */	387	/* Finally, check access permissions. */
387	error = nfsd_permission(cred, exp, dentry, access);	388	error = nfsd_permission(cred, exp, dentry, access);

fs/notify/fsnotify.c+12−6

  * Later, fsnotify permission hooks do not check if there are permission event
  * watches, but that there were permission event watches at open time.
  */
-void file_set_fsnotify_mode(struct file *file)
+void file_set_fsnotify_mode_from_watchers(struct file *file)
 {
 	struct dentry *dentry = file->f_path.dentry, *parent;
 	struct super_block *sb = dentry->d_sb;
 	 */
 	if (likely(!fsnotify_sb_has_priority_watchers(sb,
 						FSNOTIFY_PRIO_CONTENT))) {
-		file->f_mode |= FMODE_NONOTIFY_PERM;
+		file_set_fsnotify_mode(file, FMODE_NONOTIFY_PERM);
 		return;
 	}
 	if ((!d_is_dir(dentry) && !d_is_reg(dentry)) ||
 	    likely(!fsnotify_sb_has_priority_watchers(sb,
 						FSNOTIFY_PRIO_PRE_CONTENT))) {
-		file->f_mode |= FMODE_NONOTIFY | FMODE_NONOTIFY_PERM;
+		file_set_fsnotify_mode(file, FMODE_NONOTIFY | FMODE_NONOTIFY_PERM);
 		return;
 	}
 	 */
 	mnt_mask = READ_ONCE(real_mount(file->f_path.mnt)->mnt_fsnotify_mask);
 	if (unlikely(fsnotify_object_watched(d_inode(dentry), mnt_mask,
-				     FSNOTIFY_PRE_CONTENT_EVENTS)))
+				     FSNOTIFY_PRE_CONTENT_EVENTS))) {
+		/* Enable pre-content events */
+		file_set_fsnotify_mode(file, 0);
 		return;
+	}
 	/* Is parent watching for pre-content events on this file? */
 	if (dentry->d_flags & DCACHE_FSNOTIFY_PARENT_WATCHED) {
 		parent = dget_parent(dentry);
 		p_mask = fsnotify_inode_watches_children(d_inode(parent));
 		dput(parent);
-		if (p_mask & FSNOTIFY_PRE_CONTENT_EVENTS)
+		if (p_mask & FSNOTIFY_PRE_CONTENT_EVENTS) {
+			/* Enable pre-content events */
+			file_set_fsnotify_mode(file, 0);
 			return;
+		}
 	}
 	/* Nobody watching for pre-content events from this file */
-	file->f_mode |= FMODE_NONOTIFY | FMODE_NONOTIFY_PERM;
+	file_set_fsnotify_mode(file, FMODE_NONOTIFY | FMODE_NONOTIFY_PERM);
 }
 #endif

fs/open.c+6−5

 	f->f_sb_err = file_sample_sb_err(f);
 	if (unlikely(f->f_flags & O_PATH)) {
-		f->f_mode = FMODE_PATH | FMODE_OPENED | FMODE_NONOTIFY;
+		f->f_mode = FMODE_PATH | FMODE_OPENED;
+		file_set_fsnotify_mode(f, FMODE_NONOTIFY);
 		f->f_op = &empty_fops;
 		return 0;
 	}
 	/*
 	 * Set FMODE_NONOTIFY_* bits according to existing permission watches.
-	 * If FMODE_NONOTIFY was already set for an fanotify fd, this doesn't
+	 * If FMODE_NONOTIFY mode was already set for an fanotify fd or for a
-	 * change anything.
+	 * pseudo file, this call will not change the mode.
 	 */
-	file_set_fsnotify_mode(f);
+	file_set_fsnotify_mode_from_watchers(f);
 	error = fsnotify_open_perm(f);
 	if (error)
 		goto cleanup_all;
 	if (!IS_ERR(f)) {
 		int error;
-		f->f_mode |= FMODE_NONOTIFY;
+		file_set_fsnotify_mode(f, FMODE_NONOTIFY);
 		error = vfs_open(path, f);
 		if (error) {
 			fput(f);

fs/pidfs.c+11−1

 	switch (cmd) {
 	case FS_IOC_GETVERSION:
 	case PIDFD_GET_CGROUP_NAMESPACE:
-	case PIDFD_GET_INFO:
 	case PIDFD_GET_IPC_NAMESPACE:
 	case PIDFD_GET_MNT_NAMESPACE:
 	case PIDFD_GET_NET_NAMESPACE:
 		return true;
 	}
+	/* Extensible ioctls require some more careful checks. */
+	switch (_IOC_NR(cmd)) {
+	case _IOC_NR(PIDFD_GET_INFO):
+		/*
+		 * Try to prevent performing a pidfd ioctl when someone
+		 * erronously mistook the file descriptor for a pidfd.
+		 * This is not perfect but will catch most cases.
+		 */
+		return (_IOC_TYPE(cmd) == _IOC_TYPE(PIDFD_GET_INFO));
+	}
 	return false;
 }

fs/pipe.c+6−0

 	res[1] = f;
 	stream_open(inode, res[0]);
 	stream_open(inode, res[1]);
+	/*
+	 * Disable permission and pre-content events, but enable legacy
+	 * inotify events for legacy users.
+	 */
+	file_set_fsnotify_mode(res[0], FMODE_NONOTIFY_PERM);
+	file_set_fsnotify_mode(res[1], FMODE_NONOTIFY_PERM);
 	return 0;
 }

fs/proc/vmcore.c+4−1

 		pr_warn_once("Unexpected adding of device dump\n");
 	if (vmcore_open) {
 		ret = -EBUSY;
-		goto out_err;
+		goto unlock;
 	}
 	list_add_tail(&dump->list, &vmcoredd_list);
 	mutex_unlock(&vmcore_mutex);
 	return 0;
+unlock:
+	mutex_unlock(&vmcore_mutex);
 out_err:
 	vfree(buf);
 	vfree(dump);

fs/smb/client/cifsglob.h+10−10

 struct cifs_open_info_data {
 	bool adjust_tz;
 	bool reparse_point;
+	bool contains_posix_file_info;
 	struct {
 		/* ioctl response buffer */
 		struct {
 	int (*handle_cancelled_mid)(struct mid_q_entry *, struct TCP_Server_Info *);
 	void (*downgrade_oplock)(struct TCP_Server_Info *server,
 				 struct cifsInodeInfo *cinode, __u32 oplock,
-				 unsigned int epoch, bool *purge_cache);
+				 __u16 epoch, bool *purge_cache);
 	/* process transaction2 response */
 	bool (*check_trans2)(struct mid_q_entry *, struct TCP_Server_Info *,
 			     char *, int);
 	/* if we can do cache read operations */
 	bool (*is_read_op)(__u32);
 	/* set oplock level for the inode */
-	void (*set_oplock_level)(struct cifsInodeInfo *, __u32, unsigned int,
+	void (*set_oplock_level)(struct cifsInodeInfo *cinode, __u32 oplock, __u16 epoch,
-				 bool *);
+				 bool *purge_cache);
 	/* create lease context buffer for CREATE request */
 	char * (*create_lease_buf)(u8 *lease_key, u8 oplock);
 	/* parse lease context buffer and return oplock/epoch info */
-	__u8 (*parse_lease_buf)(void *buf, unsigned int *epoch, char *lkey);
+	__u8 (*parse_lease_buf)(void *buf, __u16 *epoch, char *lkey);
 	ssize_t (*copychunk_range)(const unsigned int,
 			struct cifsFileInfo *src_file,
 			struct cifsFileInfo *target_file,
 	__u8 create_guid[16];
 	__u32 access;
 	struct cifs_pending_open *pending_open;
-	unsigned int epoch;
+	__u16 epoch;
 #ifdef CONFIG_CIFS_DEBUG2
 	__u64 mid;
 #endif /* CIFS_DEBUG2 */
 	bool oplock_break_cancelled:1;
 	bool status_file_deleted:1; /* file has been deleted */
 	bool offload:1; /* offload final part of _put to a wq */
-	unsigned int oplock_epoch; /* epoch from the lease break */
+	__u16 oplock_epoch; /* epoch from the lease break */
 	__u32 oplock_level; /* oplock/lease level from the lease break */
 	int count;
 	spinlock_t file_info_lock; /* protects four flag/count fields above */
 struct cifs_io_request {
 	struct netfs_io_request		rreq;
 	struct cifsFileInfo		*cfile;
-	struct TCP_Server_Info		*server;
 	pid_t				pid;
 };
 	spinlock_t	open_file_lock;	/* protects openFileList */
 	__u32 cifsAttrs; /* e.g. DOS archive bit, sparse, compressed, system */
 	unsigned int oplock;		/* oplock/lease level we have */
-	unsigned int epoch;		/* used to track lease state changes */
+	__u16 epoch;		/* used to track lease state changes */
 #define CIFS_INODE_PENDING_OPLOCK_BREAK   (0) /* oplock break in progress */
 #define CIFS_INODE_PENDING_WRITERS	  (1) /* Writes in progress */
 #define CIFS_INODE_FLAG_UNUSED		  (2) /* Unused flag */
 	struct kvec io_iov[SMB2_IOCTL_IOV_SIZE];
 	struct kvec si_iov[SMB2_SET_INFO_IOV_SIZE];
 	struct kvec close_iov;
-	struct smb2_file_rename_info rename_info;
+	struct smb2_file_rename_info_hdr rename_info;
-	struct smb2_file_link_info link_info;
+	struct smb2_file_link_info_hdr link_info;
 	struct kvec ea_iov;
 };

fs/smb/client/dfs.c+16−14

@@ -150,25 +150,27 @@ again: · 149 unmodified lines
150	if (rc)	150	if (rc)
151	continue;	151	continue;
152		152
153	if (tgt.flags & DFSREF_STORAGE_SERVER) {	153	rc = cifs_mount_get_tcon(mnt_ctx);
154	rc = cifs_mount_get_tcon(mnt_ctx);	154	if (rc) {
155	if (!rc)	155	if (tgt.server_type == DFS_TYPE_LINK &&
156	rc = cifs_is_path_remote(mnt_ctx);	156	DFS_INTERLINK(tgt.flags))
		157	rc = -EREMOTE;
		158	} else {
		159	rc = cifs_is_path_remote(mnt_ctx);
157	if (!rc) {	160	if (!rc) {
158	ref_walk_set_tgt_hint(rw);	161	ref_walk_set_tgt_hint(rw);
159	break;	162	break;
160	}	163	}
161	if (rc != -EREMOTE)
162	continue;
163	}	164	}
164		165	if (rc == -EREMOTE) {
165	rc = ref_walk_advance(rw);	166	rc = ref_walk_advance(rw);
166	if (!rc) {	167	if (!rc) {
167	rc = setup_dfs_ref(&tgt, rw);	168	rc = setup_dfs_ref(&tgt, rw);
168	if (rc)	169	if (rc)
169	break;	170	break;
170	ref_walk_mark_end(rw);	171	ref_walk_mark_end(rw);
171	goto again;	172	goto again;
		173	}
172	}	174	}
173	}	175	}
174	} while (rc && ref_walk_descend(rw));	176	} while (rc && ref_walk_descend(rw));

fs/smb/client/dfs.h+7−0

@@ -188,4 +188,11 @@ static inline void dfs_put_root_smb_sessions(struct list_head *head) · 187 unmodified lines
188	}	188	}
189	}	189	}
190		190
		191	static inline const char dfs_ses_refpath(struct cifs_ses ses)
		192	{
		193	const char *path = ses->server->leaf_fullpath;
		194
		195	return path ? path + 1 : ERR_PTR(-ENOENT);
		196	}
		197
191	#endif /* _CIFS_DFS_H */	198	#endif /* _CIFS_DFS_H */

fs/smb/client/dfs_cache.c+5−22

 	return ret;
 }
-static char *get_ses_refpath(struct cifs_ses *ses)
-{
-	struct TCP_Server_Info *server = ses->server;
-	char *path = ERR_PTR(-ENOENT);
-	if (server->leaf_fullpath) {
-		path = kstrdup(server->leaf_fullpath + 1, GFP_KERNEL);
-		if (!path)
-			path = ERR_PTR(-ENOMEM);
-	}
-	return path;
-}
 /* Refresh dfs referral of @ses */
 static void refresh_ses_referral(struct cifs_ses *ses)
 {
 	struct cache_entry *ce;
 	unsigned int xid;
-	char *path;
+	const char *path;
 	int rc = 0;
 	xid = get_xid();
-	path = get_ses_refpath(ses);
+	path = dfs_ses_refpath(ses);
 	if (IS_ERR(path)) {
 		rc = PTR_ERR(path);
-		path = NULL;
 		goto out;
 	}
 out:
 	free_xid(xid);
-	kfree(path);
 }
 static int __refresh_tcon_referral(struct cifs_tcon *tcon,
 	struct dfs_info3_param *refs = NULL;
 	struct cache_entry *ce;
 	struct cifs_ses *ses;
-	unsigned int xid;
 	bool needs_refresh;
-	char *path;
+	const char *path;
+	unsigned int xid;
 	int numrefs = 0;
 	int rc = 0;
 	xid = get_xid();
 	ses = tcon->ses;
-	path = get_ses_refpath(ses);
+	path = dfs_ses_refpath(ses);
 	if (IS_ERR(path)) {
 		rc = PTR_ERR(path);
-		path = NULL;
 		goto out;
 	}
 out:
 	free_xid(xid);
-	kfree(path);
 	free_dfs_info_array(refs, numrefs);
 }

fs/smb/client/file.c+4−3

 	struct netfs_io_request *rreq = subreq->rreq;
 	struct cifs_io_subrequest *rdata = container_of(subreq, struct cifs_io_subrequest, subreq);
 	struct cifs_io_request *req = container_of(subreq->rreq, struct cifs_io_request, rreq);
-	struct TCP_Server_Info *server = req->server;
+	struct TCP_Server_Info *server;
 	struct cifs_sb_info *cifs_sb = CIFS_SB(rreq->inode->i_sb);
 	size_t size;
 	int rc = 0;
 		rdata->xid = get_xid();
 		rdata->have_xid = true;
 	}
+	server = cifs_pick_channel(tlink_tcon(req->cfile->tlink)->ses);
 	rdata->server = server;
 	if (cifs_sb->ctx->rsize == 0)
 	struct netfs_io_request *rreq = subreq->rreq;
 	struct cifs_io_subrequest *rdata = container_of(subreq, struct cifs_io_subrequest, subreq);
 	struct cifs_io_request *req = container_of(subreq->rreq, struct cifs_io_request, rreq);
-	struct TCP_Server_Info *server = req->server;
+	struct TCP_Server_Info *server = rdata->server;
 	int rc = 0;
 	cifs_dbg(FYI, "%s: op=%08x[%x] mapping=%p len=%zu/%zu\n",
 		open_file = file->private_data;
 		rreq->netfs_priv = file->private_data;
 		req->cfile = cifsFileInfo_get(open_file);
-		req->server = cifs_pick_channel(tlink_tcon(req->cfile->tlink)->ses);
 		if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_RWPIDFORWARD)
 			req->pid = req->cfile->pid;
 	} else if (rreq->origin != NETFS_WRITEBACK) {

fs/smb/client/inode.c+15−2

 			rc = server->ops->parse_reparse_point(cifs_sb,
 							      full_path,
 							      iov, data);
+			/*
+			 * If the reparse point was not handled but it is the
+			 * name surrogate which points to directory, then treat
+			 * is as a new mount point. Name surrogate reparse point
+			 * represents another named entity in the system.
+			 */
+			if (rc == -EOPNOTSUPP &&
+			    IS_REPARSE_TAG_NAME_SURROGATE(data->reparse.tag) &&
+			    (le32_to_cpu(data->fi.Attributes) & ATTR_DIRECTORY)) {
+				rc = 0;
+				cifs_create_junction_fattr(fattr, sb);
+				goto out;
+			}
 		}
 		if (data->reparse.tag == IO_REPARSE_TAG_SYMLINK && !rc) {
 	struct cifs_fattr fattr = {};
 	int rc;
-	if (is_inode_cache_good(*inode)) {
+	if (!data && is_inode_cache_good(*inode)) {
 		cifs_dbg(FYI, "No need to revalidate cached inode sizes\n");
 		return 0;
 	}
 	struct cifs_fattr fattr = {};
 	int rc;
-	if (is_inode_cache_good(*inode)) {
+	if (!data && is_inode_cache_good(*inode)) {
 		cifs_dbg(FYI, "No need to revalidate cached inode sizes\n");
 		return 0;
 	}

fs/smb/client/reparse.c+2−3

 				 le32_to_cpu(buf->ReparseTag));
 			return -EIO;
 		}
-		break;
+		return 0;
 	default:
 		cifs_tcon_dbg(VFS | ONCE, "unhandled reparse tag: 0x%08x\n",
 			      le32_to_cpu(buf->ReparseTag));
-		break;
+		return -EOPNOTSUPP;
 	}
-	return 0;
 }
 int smb2_parse_reparse_point(struct cifs_sb_info *cifs_sb,

fs/smb/client/reparse.h+22−6

@@ -99,14 +99,30 @@ static inline bool reparse_inode_match(struct inode *inode, · 98 unmodified lines
99		99
100	static inline bool cifs_open_data_reparse(struct cifs_open_info_data *data)	100	static inline bool cifs_open_data_reparse(struct cifs_open_info_data *data)
101	{	101	{
102	struct smb2_file_all_info *fi = &data->fi;	102	u32 attrs;
103	u32 attrs = le32_to_cpu(fi->Attributes);
104	bool ret;	103	bool ret;
105		104
106	ret = data->reparse_point \|\| (attrs & ATTR_REPARSE);	105	if (data->contains_posix_file_info) {
107	if (ret)	106	struct smb311_posix_qinfo *fi = &data->posix_fi;
108	attrs \|= ATTR_REPARSE;	107
109	fi->Attributes = cpu_to_le32(attrs);	108	attrs = le32_to_cpu(fi->DosAttributes);
		109	if (data->reparse_point) {
		110	attrs \|= ATTR_REPARSE;
		111	fi->DosAttributes = cpu_to_le32(attrs);
		112	}
		113
		114	} else {
		115	struct smb2_file_all_info *fi = &data->fi;
		116
		117	attrs = le32_to_cpu(fi->Attributes);
		118	if (data->reparse_point) {
		119	attrs \|= ATTR_REPARSE;
		120	fi->Attributes = cpu_to_le32(attrs);
		121	}
		122	}
		123
		124	ret = attrs & ATTR_REPARSE;
		125
110	return ret;	126	return ret;
111	}	127	}
112		128

fs/smb/client/smb1ops.c+1−1

@@ -377,7 +377,7 @@ coalesce_t2(char second_buf, struct smb_hdr target_hdr) · 376 unmodified lines
377	static void	377	static void
378	cifs_downgrade_oplock(struct TCP_Server_Info *server,	378	cifs_downgrade_oplock(struct TCP_Server_Info *server,
379	struct cifsInodeInfo *cinode, __u32 oplock,	379	struct cifsInodeInfo *cinode, __u32 oplock,
380	unsigned int epoch, bool *purge_cache)	380	__u16 epoch, bool *purge_cache)
381	{	381	{
382	cifs_set_oplock_level(cinode, oplock);	382	cifs_set_oplock_level(cinode, oplock);
383	}	383	}

fs/smb/client/smb2inode.c+4−0

 		switch (cmds[i]) {
 		case SMB2_OP_QUERY_INFO:
 			idata = in_iov[i].iov_base;
+			idata->contains_posix_file_info = false;
 			if (rc == 0 && cfile && cfile->symlink_target) {
 				idata->symlink_target = kstrdup(cfile->symlink_target, GFP_KERNEL);
 				if (!idata->symlink_target)
 			break;
 		case SMB2_OP_POSIX_QUERY_INFO:
 			idata = in_iov[i].iov_base;
+			idata->contains_posix_file_info = true;
 			if (rc == 0 && cfile && cfile->symlink_target) {
 				idata->symlink_target = kstrdup(cfile->symlink_target, GFP_KERNEL);
 				if (!idata->symlink_target)
 				idata = in_iov[i].iov_base;
 				idata->reparse.io.iov = *iov;
 				idata->reparse.io.buftype = resp_buftype[i + 1];
+				idata->contains_posix_file_info = false; /* BB VERIFY */
 				rbuf = reparse_buf_ptr(iov);
 				if (IS_ERR(rbuf)) {
 					rc = PTR_ERR(rbuf);
 		case SMB2_OP_QUERY_WSL_EA:
 			if (!rc) {
 				idata = in_iov[i].iov_base;
+				idata->contains_posix_file_info = false;
 				qi_rsp = rsp_iov[i + 1].iov_base;
 				data[0] = (u8 *)qi_rsp + le16_to_cpu(qi_rsp->OutputBufferOffset);
 				size[0] = le32_to_cpu(qi_rsp->OutputBufferLength);

fs/smb/client/smb2ops.c+11−10

@@ -1001,6 +1001,7 @@ static int smb2_query_file_info(const unsigned int xid, struct cifs_tcon *tcon, · 1000 unmodified lines
1001	if (!data->symlink_target)	1001	if (!data->symlink_target)
1002	return -ENOMEM;	1002	return -ENOMEM;
1003	}	1003	}
		1004	data->contains_posix_file_info = false;
1004	return SMB2_query_info(xid, tcon, fid->persistent_fid, fid->volatile_fid, &data->fi);	1005	return SMB2_query_info(xid, tcon, fid->persistent_fid, fid->volatile_fid, &data->fi);
1005	}	1006	}
1006		1007
@@ -3904,22 +3905,22 @@ static long smb3_fallocate(struct file file, struct cifs_tcon tcon, int mode, · 2897 unmodified lines
3904	static void	3905	static void
3905	smb2_downgrade_oplock(struct TCP_Server_Info *server,	3906	smb2_downgrade_oplock(struct TCP_Server_Info *server,
3906	struct cifsInodeInfo *cinode, __u32 oplock,	3907	struct cifsInodeInfo *cinode, __u32 oplock,
3907	unsigned int epoch, bool *purge_cache)	3908	__u16 epoch, bool *purge_cache)
3908	{	3909	{
3909	server->ops->set_oplock_level(cinode, oplock, 0, NULL);	3910	server->ops->set_oplock_level(cinode, oplock, 0, NULL);
3910	}	3911	}
3911		3912
3912	static void	3913	static void
3913	smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,	3914	smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
3914	unsigned int epoch, bool *purge_cache);	3915	__u16 epoch, bool *purge_cache);
3915		3916
3916	static void	3917	static void
3917	smb3_downgrade_oplock(struct TCP_Server_Info *server,	3918	smb3_downgrade_oplock(struct TCP_Server_Info *server,
3918	struct cifsInodeInfo *cinode, __u32 oplock,	3919	struct cifsInodeInfo *cinode, __u32 oplock,
3919	unsigned int epoch, bool *purge_cache)	3920	__u16 epoch, bool *purge_cache)
3920	{	3921	{
3921	unsigned int old_state = cinode->oplock;	3922	unsigned int old_state = cinode->oplock;
3922	unsigned int old_epoch = cinode->epoch;	3923	__u16 old_epoch = cinode->epoch;
3923	unsigned int new_state;	3924	unsigned int new_state;
3924		3925
3925	if (epoch > old_epoch) {	3926	if (epoch > old_epoch) {
@@ -3939,7 +3940,7 @@ smb3_downgrade_oplock(struct TCP_Server_Info *server, · 13 unmodified lines
3939		3940
3940	static void	3941	static void
3941	smb2_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,	3942	smb2_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
3942	unsigned int epoch, bool *purge_cache)	3943	__u16 epoch, bool *purge_cache)
3943	{	3944	{
3944	oplock &= 0xFF;	3945	oplock &= 0xFF;
3945	cinode->lease_granted = false;	3946	cinode->lease_granted = false;
@@ -3963,7 +3964,7 @@ smb2_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock, · 17 unmodified lines
3963		3964
3964	static void	3965	static void
3965	smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,	3966	smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
3966	unsigned int epoch, bool *purge_cache)	3967	__u16 epoch, bool *purge_cache)
3967	{	3968	{
3968	char message[5] = {0};	3969	char message[5] = {0};
3969	unsigned int new_oplock = 0;	3970	unsigned int new_oplock = 0;
@@ -4000,7 +4001,7 @@ smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock, · 30 unmodified lines
4000		4001
4001	static void	4002	static void
4002	smb3_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,	4003	smb3_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
4003	unsigned int epoch, bool *purge_cache)	4004	__u16 epoch, bool *purge_cache)
4004	{	4005	{
4005	unsigned int old_oplock = cinode->oplock;	4006	unsigned int old_oplock = cinode->oplock;
4006		4007
@@ -4114,7 +4115,7 @@ smb3_create_lease_buf(u8 *lease_key, u8 oplock) · 107 unmodified lines
4114	}	4115	}
4115		4116
4116	static __u8	4117	static __u8
4117	smb2_parse_lease_buf(void buf, unsigned int epoch, char *lease_key)	4118	smb2_parse_lease_buf(void buf, __u16 epoch, char *lease_key)
4118	{	4119	{
4119	struct create_lease lc = (struct create_lease )buf;	4120	struct create_lease lc = (struct create_lease )buf;
4120		4121
@@ -4125,7 +4126,7 @@ smb2_parse_lease_buf(void buf, unsigned int epoch, char *lease_key) · 4 unmodified lines
4125	}	4126	}
4126		4127
4127	static __u8	4128	static __u8
4128	smb3_parse_lease_buf(void buf, unsigned int epoch, char *lease_key)	4129	smb3_parse_lease_buf(void buf, __u16 epoch, char *lease_key)
4129	{	4130	{
4130	struct create_lease_v2 lc = (struct create_lease_v2 )buf;	4131	struct create_lease_v2 lc = (struct create_lease_v2 )buf;
4131		4132
@@ -5146,7 +5147,7 @@ int __cifs_sfu_make_node(unsigned int xid, struct inode *inode, · 1014 unmodified lines
5146	FILE_CREATE, CREATE_NOT_DIR \|	5147	FILE_CREATE, CREATE_NOT_DIR \|
5147	CREATE_OPTION_SPECIAL, ACL_NO_MODE);	5148	CREATE_OPTION_SPECIAL, ACL_NO_MODE);
5148	oparms.fid = &fid;	5149	oparms.fid = &fid;
5149		5150	idata.contains_posix_file_info = false;
5150	rc = server->ops->open(xid, &oparms, &oplock, &idata);	5151	rc = server->ops->open(xid, &oparms, &oplock, &idata);
5151	if (rc)	5152	if (rc)
5152	goto out;	5153	goto out;

fs/smb/client/smb2pdu.c+2−2

@@ -2169,7 +2169,7 @@ tcon_exit: · 2168 unmodified lines
2169		2169
2170	tcon_error_exit:	2170	tcon_error_exit:
2171	if (rsp && rsp->hdr.Status == STATUS_BAD_NETWORK_NAME)	2171	if (rsp && rsp->hdr.Status == STATUS_BAD_NETWORK_NAME)
2172	cifs_tcon_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);	2172	cifs_dbg(VFS \| ONCE, "BAD_NETWORK_NAME: %s\n", tree);
2173	goto tcon_exit;	2173	goto tcon_exit;
2174	}	2174	}
2175		2175
@@ -2329,7 +2329,7 @@ parse_posix_ctxt(struct create_context cc, struct smb2_file_all_info info, · 153 unmodified lines
2329		2329
2330	int smb2_parse_contexts(struct TCP_Server_Info *server,	2330	int smb2_parse_contexts(struct TCP_Server_Info *server,
2331	struct kvec *rsp_iov,	2331	struct kvec *rsp_iov,
2332	unsigned int *epoch,	2332	__u16 *epoch,
2333	char lease_key, __u8 oplock,	2333	char lease_key, __u8 oplock,
2334	struct smb2_file_all_info *buf,	2334	struct smb2_file_all_info *buf,
2335	struct create_posix_rsp *posix)	2335	struct create_posix_rsp *posix)

fs/smb/client/smb2proto.h+1−1

@@ -283,7 +283,7 @@ extern enum securityEnum smb2_select_sectype(struct TCP_Server_Info *, · 282 unmodified lines
283	enum securityEnum);	283	enum securityEnum);
284	int smb2_parse_contexts(struct TCP_Server_Info *server,	284	int smb2_parse_contexts(struct TCP_Server_Info *server,
285	struct kvec *rsp_iov,	285	struct kvec *rsp_iov,
286	unsigned int *epoch,	286	__u16 *epoch,
287	char lease_key, __u8 oplock,	287	char lease_key, __u8 oplock,
288	struct smb2_file_all_info *buf,	288	struct smb2_file_all_info *buf,
289	struct create_posix_rsp *posix);	289	struct create_posix_rsp *posix);

fs/smb/common/smb2pdu.h+20−10

 } __packed; /* level 6 Query */
 struct smb2_file_rename_info { /* encoding of request for level 10 */
-	__u8   ReplaceIfExists; /* 1 = replace existing target with new */
+	/* New members MUST be added within the struct_group() macro below. */
-				/* 0 = fail if target already exists */
+	__struct_group(smb2_file_rename_info_hdr, __hdr, __packed,
-	__u8   Reserved[7];
+		__u8   ReplaceIfExists; /* 1 = replace existing target with new */
-	__u64  RootDirectory;  /* MBZ for network operations (why says spec?) */
+					/* 0 = fail if target already exists */
-	__le32 FileNameLength;
+		__u8   Reserved[7];
+		__u64  RootDirectory;  /* MBZ for network operations (why says spec?) */
+		__le32 FileNameLength;
+	);
 	char   FileName[];     /* New name to be assigned */
 	/* padding - overall struct size must be >= 24 so filename + pad >= 6 */
 } __packed; /* level 10 Set */
+static_assert(offsetof(struct smb2_file_rename_info, FileName) == sizeof(struct smb2_file_rename_info_hdr),
+	      "struct member likely outside of __struct_group()");
 struct smb2_file_link_info { /* encoding of request for level 11 */
-	__u8   ReplaceIfExists; /* 1 = replace existing link with new */
+	/* New members MUST be added within the struct_group() macro below. */
-				/* 0 = fail if link already exists */
+	__struct_group(smb2_file_link_info_hdr, __hdr, __packed,
-	__u8   Reserved[7];
+		__u8   ReplaceIfExists; /* 1 = replace existing link with new */
-	__u64  RootDirectory;  /* MBZ for network operations (why says spec?) */
+					/* 0 = fail if link already exists */
-	__le32 FileNameLength;
+		__u8   Reserved[7];
+		__u64  RootDirectory;  /* MBZ for network operations (why says spec?) */
+		__le32 FileNameLength;
+	);
 	char   FileName[];     /* Name to be assigned to new link */
 } __packed; /* level 11 Set */
+static_assert(offsetof(struct smb2_file_link_info, FileName) == sizeof(struct smb2_file_link_info_hdr),
+	      "struct member likely outside of __struct_group()");
 /*
  * This level 18, although with struct with same name is different from cifs

fs/smb/common/smbfsctl.h+3−0

@@ -159,6 +159,9 @@ · 158 unmodified lines
159	#define IO_REPARSE_TAG_LX_CHR 0x80000025	159	#define IO_REPARSE_TAG_LX_CHR 0x80000025
160	#define IO_REPARSE_TAG_LX_BLK 0x80000026	160	#define IO_REPARSE_TAG_LX_BLK 0x80000026
161		161
		162	/* If Name Surrogate Bit is set, the file or directory represents another named entity in the system. */
		163	#define IS_REPARSE_TAG_NAME_SURROGATE(tag) (!!((tag) & 0x20000000))
		164
162	/* fsctl flags */	165	/* fsctl flags */
163	/* If Flags is set to this value, the request is an FSCTL not ioctl request */	166	/* If Flags is set to this value, the request is an FSCTL not ioctl request */
164	#define SMB2_0_IOCTL_IS_FSCTL 0x00000001	167	#define SMB2_0_IOCTL_IS_FSCTL 0x00000001

fs/stat.c+3−1

 			  u32 request_mask)
 {
 	int error = vfs_getattr(path, stat, request_mask, flags);
+	if (error)
+		return error;
 	if (request_mask & STATX_MNT_ID_UNIQUE) {
 		stat->mnt_id = real_mount(path->mnt)->mnt_id_unique;
 	if (S_ISBLK(stat->mode))
 		bdev_statx(path, stat, request_mask);
-	return error;
+	return 0;
 }
 static int vfs_statx_fd(int fd, int flags, struct kstat *stat,

fs/vboxsf/super.c+2−1

@@ -21,7 +21,8 @@ · 20 unmodified lines
21		21
22	#define VBOXSF_SUPER_MAGIC 0x786f4256 /* 'VBox' little endian */	22	#define VBOXSF_SUPER_MAGIC 0x786f4256 /* 'VBox' little endian */
23		23
24	static const unsigned char VBSF_MOUNT_SIGNATURE[4] = "\000\377\376\375";	24	static const unsigned char VBSF_MOUNT_SIGNATURE[4] = { '\000', '\377', '\376',
		25	'\375' };
25		26
26	static int follow_symlinks;	27	static int follow_symlinks;
27	module_param(follow_symlinks, int, 0444);	28	module_param(follow_symlinks, int, 0444);

fs/xfs/libxfs/xfs_bmap.c+7−6

 	int			error;
 	/*
-	 * If there are already extents in the file, try an exact EOF block
+	 * If there are already extents in the file, and xfs_bmap_adjacent() has
-	 * allocation to extend the file as a contiguous extent. If that fails,
+	 * given a better blkno, try an exact EOF block allocation to extend the
-	 * or it's the first allocation in a file, just try for a stripe aligned
+	 * file as a contiguous extent. If that fails, or it's the first
-	 * allocation.
+	 * allocation in a file, just try for a stripe aligned allocation.
 	 */
-	if (ap->offset) {
+	if (ap->eof) {
 		xfs_extlen_t	nextminlen = 0;
 		/*
 	int			error;
 	ap->blkno = XFS_INO_TO_FSB(args->mp, ap->ip->i_ino);
-	xfs_bmap_adjacent(ap);
+	if (!xfs_bmap_adjacent(ap))
+		ap->eof = false;
 	/*
 	 * Search for an allocation group with a single extent large enough for

fs/xfs/scrub/common.h+0−5

 bool xchk_dir_looks_zapped(struct xfs_inode *dp);
 bool xchk_pptr_looks_zapped(struct xfs_inode *ip);
-#ifdef CONFIG_XFS_ONLINE_REPAIR
 /* Decide if a repair is required. */
 static inline bool xchk_needs_repair(const struct xfs_scrub_metadata *sm)
 {
 	return (sc->sm->sm_flags & XFS_SCRUB_IFLAG_REPAIR) &&
 		!(sc->flags & XREP_ALREADY_FIXED);
 }
-#else
-# define xchk_needs_repair(sc)		(false)
-# define xchk_could_repair(sc)		(false)
-#endif /* CONFIG_XFS_ONLINE_REPAIR */
 int xchk_metadata_inode_forks(struct xfs_scrub *sc);

fs/xfs/scrub/inode_repair.c+10−2

 			return true;
 		break;
 	case S_IFREG:
-		if (fmt == XFS_DINODE_FMT_LOCAL)
+		switch (fmt) {
+		case XFS_DINODE_FMT_LOCAL:
 			return true;
-		fallthrough;
+		case XFS_DINODE_FMT_EXTENTS:
+		case XFS_DINODE_FMT_BTREE:
+		case XFS_DINODE_FMT_META_BTREE:
+			break;
+		default:
+			return true;
+		}
+		break;
 	case S_IFLNK:
 	case S_IFDIR:
 		switch (fmt) {

fs/xfs/scrub/repair.h+10−1

@@ -191,7 +191,16 @@ int xrep_reset_metafile_resv(struct xfs_scrub *sc); · 190 unmodified lines
191	#else	191	#else
192		192
193	#define xrep_ino_dqattach(sc) (0)	193	#define xrep_ino_dqattach(sc) (0)
194	#define xrep_will_attempt(sc) (false)	194
		195	/*
		196	* When online repair is not built into the kernel, we still want to attempt
		197	* the repair so that the stub xrep_attempt below will return EOPNOTSUPP.
		198	*/
		199	static inline bool xrep_will_attempt(const struct xfs_scrub *sc)
		200	{
		201	return (sc->sm->sm_flags & XFS_SCRUB_IFLAG_FORCE_REBUILD) \|\|
		202	xchk_needs_repair(sc->sm);
		203	}
195		204
196	static inline int	205	static inline int
197	xrep_attempt(	206	xrep_attempt(

fs/xfs/scrub/scrub.c+12−0

@@ -149,6 +149,18 @@ xchk_probe( · 148 unmodified lines
149	if (xchk_should_terminate(sc, &error))	149	if (xchk_should_terminate(sc, &error))
150	return error;	150	return error;
151		151
		152	/*
		153	* If the caller is probing to see if repair works but repair isn't
		154	* built into the kernel, return EOPNOTSUPP because that's the signal
		155	* that userspace expects. If online repair is built in, set the
		156	* CORRUPT flag (without any of the usual tracing/logging) to force us
		157	* into xrep_probe.
		158	*/
		159	if (xchk_could_repair(sc)) {
		160	if (!IS_ENABLED(CONFIG_XFS_ONLINE_REPAIR))
		161	return -EOPNOTSUPP;
		162	sc->sm->sm_flags \|= XFS_SCRUB_OFLAG_CORRUPT;
		163	}
152	return 0;	164	return 0;
153	}	165	}
154		166

fs/xfs/xfs_aops.c+37−4

@@ -19,6 +19,7 @@ · 18 unmodified lines
19	#include "xfs_reflink.h"	19	#include "xfs_reflink.h"
20	#include "xfs_errortag.h"	20	#include "xfs_errortag.h"
21	#include "xfs_error.h"	21	#include "xfs_error.h"
		22	#include "xfs_icache.h"
22		23
23	struct xfs_writepage_ctx {	24	struct xfs_writepage_ctx {
24	struct iomap_writepage_ctx ctx;	25	struct iomap_writepage_ctx ctx;
@@ -528,12 +529,44 @@ xfs_vm_readahead( · 503 unmodified lines
528	}	529	}
529		530
530	static int	531	static int
531	xfs_iomap_swapfile_activate(	532	xfs_vm_swap_activate(
532	struct swap_info_struct *sis,	533	struct swap_info_struct *sis,
533	struct file *swap_file,	534	struct file *swap_file,
534	sector_t *span)	535	sector_t *span)
535	{	536	{
536	sis->bdev = xfs_inode_buftarg(XFS_I(file_inode(swap_file)))->bt_bdev;	537	struct xfs_inode *ip = XFS_I(file_inode(swap_file));
		538
		539	/*
		540	* Swap file activation can race against concurrent shared extent
		541	* removal in files that have been cloned. If this happens,
		542	* iomap_swapfile_iter() can fail because it encountered a shared
		543	* extent even though an operation is in progress to remove those
		544	* shared extents.
		545	*
		546	* This race becomes problematic when we defer extent removal
		547	* operations beyond the end of a syscall (i.e. use async background
		548	* processing algorithms). Users think the extents are no longer
		549	* shared, but iomap_swapfile_iter() still sees them as shared
		550	* because the refcountbt entries for the extents being removed have
		551	* not yet been updated. Hence the swapon call fails unexpectedly.
		552	*
		553	* The race condition is currently most obvious from the unlink()
		554	* operation as extent removal is deferred until after the last
		555	* reference to the inode goes away. We then process the extent
		556	* removal asynchronously, hence triggers the "syscall completed but
		557	* work not done" condition mentioned above. To close this race
		558	* window, we need to flush any pending inodegc operations to ensure
		559	* they have updated the refcountbt records before we try to map the
		560	* swapfile.
		561	*/
		562	xfs_inodegc_flush(ip->i_mount);
		563
		564	/*
		565	* Direct the swap code to the correct block device when this file
		566	* sits on the RT device.
		567	*/
		568	sis->bdev = xfs_inode_buftarg(ip)->bt_bdev;
		569
537	return iomap_swapfile_activate(sis, swap_file, span,	570	return iomap_swapfile_activate(sis, swap_file, span,
538	&xfs_read_iomap_ops);	571	&xfs_read_iomap_ops);
539	}	572	}
@@ -549,11 +582,11 @@ const struct address_space_operations xfs_address_space_operations = { · 9 unmodified lines
549	.migrate_folio = filemap_migrate_folio,	582	.migrate_folio = filemap_migrate_folio,
550	.is_partially_uptodate = iomap_is_partially_uptodate,	583	.is_partially_uptodate = iomap_is_partially_uptodate,
551	.error_remove_folio = generic_error_remove_folio,	584	.error_remove_folio = generic_error_remove_folio,
552	.swap_activate = xfs_iomap_swapfile_activate,	585	.swap_activate = xfs_vm_swap_activate,
553	};	586	};
554		587
555	const struct address_space_operations xfs_dax_aops = {	588	const struct address_space_operations xfs_dax_aops = {
556	.writepages = xfs_dax_writepages,	589	.writepages = xfs_dax_writepages,
557	.dirty_folio = noop_dirty_folio,	590	.dirty_folio = noop_dirty_folio,
558	.swap_activate = xfs_iomap_swapfile_activate,	591	.swap_activate = xfs_vm_swap_activate,
559	};	592	};

fs/xfs/xfs_buf.c+17−19

  *
  * xfs_buf_rele:
  *	b_lock
- *	  pag_buf_lock
+ *	  lru_lock
- *	    lru_lock
  *
  * xfs_buftarg_drain_rele
  *	lru_lock
 	 */
 	flags &= ~(XBF_UNMAPPED | XBF_TRYLOCK | XBF_ASYNC | XBF_READ_AHEAD);
-	spin_lock_init(&bp->b_lock);
+	/*
+	 * A new buffer is held and locked by the owner.  This ensures that the
+	 * buffer is owned by the caller and racing RCU lookups right after
+	 * inserting into the hash table are safe (and will have to wait for
+	 * the unlock to do anything non-trivial).
+	 */
 	bp->b_hold = 1;
+	sema_init(&bp->b_sema, 0); /* held, no waiters */
+	spin_lock_init(&bp->b_lock);
 	atomic_set(&bp->b_lru_ref, 1);
 	init_completion(&bp->b_iowait);
 	INIT_LIST_HEAD(&bp->b_lru);
 	INIT_LIST_HEAD(&bp->b_list);
 	INIT_LIST_HEAD(&bp->b_li_list);
-	sema_init(&bp->b_sema, 0); /* held, no waiters */
 	bp->b_target = target;
 	bp->b_mount = target->bt_mount;
 	bp->b_flags = flags;
-	/*
-	 * Set length and io_length to the same value initially.
-	 * I/O routines should use io_length, which will be the same in
-	 * most cases but may be reset (e.g. XFS recovery).
-	 */
 	error = xfs_buf_get_maps(bp, nmaps);
 	if (error)  {
 		kmem_cache_free(xfs_buf_cache, bp);
 xfs_buf_cache_init(
 	struct xfs_buf_cache	*bch)
 {
-	spin_lock_init(&bch->bc_lock);
 	return rhashtable_init(&bch->bc_hash, &xfs_buf_hash_params);
 }
 	if (error)
 		goto out_free_buf;
-	spin_lock(&bch->bc_lock);
+	/* The new buffer keeps the perag reference until it is freed. */
+	new_bp->b_pag = pag;
+	rcu_read_lock();
 	bp = rhashtable_lookup_get_insert_fast(&bch->bc_hash,
 			&new_bp->b_rhash_head, xfs_buf_hash_params);
 	if (IS_ERR(bp)) {
+		rcu_read_unlock();
 		error = PTR_ERR(bp);
-		spin_unlock(&bch->bc_lock);
 		goto out_free_buf;
 	}
 	if (bp && xfs_buf_try_hold(bp)) {
 		/* found an existing buffer */
-		spin_unlock(&bch->bc_lock);
+		rcu_read_unlock();
 		error = xfs_buf_find_lock(bp, flags);
 		if (error)
 			xfs_buf_rele(bp);
 			*bpp = bp;
 		goto out_free_buf;
 	}
+	rcu_read_unlock();
-	/* The new buffer keeps the perag reference until it is freed. */
-	new_bp->b_pag = pag;
-	spin_unlock(&bch->bc_lock);
 	*bpp = new_bp;
 	return 0;
 	}
 	/* we are asked to drop the last reference */
-	spin_lock(&bch->bc_lock);
 	__xfs_buf_ioacct_dec(bp);
 	if (!(bp->b_flags & XBF_STALE) && atomic_read(&bp->b_lru_ref)) {
 		/*
 			bp->b_state &= ~XFS_BSTATE_DISPOSE;
 		else
 			bp->b_hold--;
-		spin_unlock(&bch->bc_lock);
 	} else {
 		bp->b_hold--;
 		/*
 		ASSERT(!(bp->b_flags & _XBF_DELWRI_Q));
 		rhashtable_remove_fast(&bch->bc_hash, &bp->b_rhash_head,
 				xfs_buf_hash_params);
-		spin_unlock(&bch->bc_lock);
 		if (pag)
 			xfs_perag_put(pag);
 		freebuf = true;

fs/xfs/xfs_buf.h+0−1

@@ -80,7 +80,6 @@ typedef unsigned int xfs_buf_flags_t; · 79 unmodified lines
80	#define XFS_BSTATE_IN_FLIGHT (1 << 1) /* I/O in flight */	80	#define XFS_BSTATE_IN_FLIGHT (1 << 1) /* I/O in flight */
81		81
82	struct xfs_buf_cache {	82	struct xfs_buf_cache {
83	spinlock_t bc_lock;
84	struct rhashtable bc_hash;	83	struct rhashtable bc_hash;
85	};	84	};
86		85

fs/xfs/xfs_exchrange.c+27−44

@@ -329,22 +329,6 @@ out_trans_cancel: · 328 unmodified lines
329	* successfully but before locks are dropped.	329	* successfully but before locks are dropped.
330	*/	330	*/
331		331
332	/* Verify that we have security clearance to perform this operation. */
333	static int
334	xfs_exchange_range_verify_area(
335	struct xfs_exchrange *fxr)
336	{
337	int ret;
338
339	ret = remap_verify_area(fxr->file1, fxr->file1_offset, fxr->length,
340	true);
341	if (ret)
342	return ret;
343
344	return remap_verify_area(fxr->file2, fxr->file2_offset, fxr->length,
345	true);
346	}
347
348	/*	332	/*
349	* Performs necessary checks before doing a range exchange, having stabilized	333	* Performs necessary checks before doing a range exchange, having stabilized
350	* mutable inode attributes via i_rwsem.	334	* mutable inode attributes via i_rwsem.
@@ -355,11 +339,13 @@ xfs_exchange_range_checks( · 4 unmodified lines
355	unsigned int alloc_unit)	339	unsigned int alloc_unit)
356	{	340	{
357	struct inode *inode1 = file_inode(fxr->file1);	341	struct inode *inode1 = file_inode(fxr->file1);
		342	loff_t size1 = i_size_read(inode1);
358	struct inode *inode2 = file_inode(fxr->file2);	343	struct inode *inode2 = file_inode(fxr->file2);
		344	loff_t size2 = i_size_read(inode2);
359	uint64_t allocmask = alloc_unit - 1;	345	uint64_t allocmask = alloc_unit - 1;
360	int64_t test_len;	346	int64_t test_len;
361	uint64_t blen;	347	uint64_t blen;
362	loff_t size1, size2, tmp;	348	loff_t tmp;
363	int error;	349	int error;
364		350
365	/* Don't touch certain kinds of inodes */	351	/* Don't touch certain kinds of inodes */
@@ -368,24 +354,25 @@ xfs_exchange_range_checks( · 2 unmodified lines
368	if (IS_SWAPFILE(inode1) \|\| IS_SWAPFILE(inode2))	354	if (IS_SWAPFILE(inode1) \|\| IS_SWAPFILE(inode2))
369	return -ETXTBSY;	355	return -ETXTBSY;
370		356
371	size1 = i_size_read(inode1);
372	size2 = i_size_read(inode2);
373
374	/* Ranges cannot start after EOF. */	357	/* Ranges cannot start after EOF. */
375	if (fxr->file1_offset > size1 \|\| fxr->file2_offset > size2)	358	if (fxr->file1_offset > size1 \|\| fxr->file2_offset > size2)
376	return -EINVAL;	359	return -EINVAL;
377		360
378	/*
379	* If the caller said to exchange to EOF, we set the length of the
380	* request large enough to cover everything to the end of both files.
381	*/
382	if (fxr->flags & XFS_EXCHANGE_RANGE_TO_EOF) {	361	if (fxr->flags & XFS_EXCHANGE_RANGE_TO_EOF) {
		362	/*
		363	* If the caller said to exchange to EOF, we set the length of
		364	* the request large enough to cover everything to the end of
		365	* both files.
		366	*/
383	fxr->length = max_t(int64_t, size1 - fxr->file1_offset,	367	fxr->length = max_t(int64_t, size1 - fxr->file1_offset,
384	size2 - fxr->file2_offset);	368	size2 - fxr->file2_offset);
385		369	} else {
386	error = xfs_exchange_range_verify_area(fxr);	370	/*
387	if (error)	371	* Otherwise we require both ranges to end within EOF.
388	return error;	372	*/
		373	if (fxr->file1_offset + fxr->length > size1 \|\|
		374	fxr->file2_offset + fxr->length > size2)
		375	return -EINVAL;
389	}	376	}
390		377
391	/*	378	/*
@@ -401,15 +388,6 @@ xfs_exchange_range_checks( · 9 unmodified lines
401	check_add_overflow(fxr->file2_offset, fxr->length, &tmp))	388	check_add_overflow(fxr->file2_offset, fxr->length, &tmp))
402	return -EINVAL;	389	return -EINVAL;
403		390
404	/*
405	* We require both ranges to end within EOF, unless we're exchanging
406	* to EOF.
407	*/
408	if (!(fxr->flags & XFS_EXCHANGE_RANGE_TO_EOF) &&
409	(fxr->file1_offset + fxr->length > size1 \|\|
410	fxr->file2_offset + fxr->length > size2))
411	return -EINVAL;
412
413	/*	391	/*
414	* Make sure we don't hit any file size limits. If we hit any size	392	* Make sure we don't hit any file size limits. If we hit any size
415	* limits such that test_length was adjusted, we abort the whole	393	* limits such that test_length was adjusted, we abort the whole
@@ -747,6 +725,7 @@ xfs_exchange_range( · 331 unmodified lines
747	{	725	{
748	struct inode *inode1 = file_inode(fxr->file1);	726	struct inode *inode1 = file_inode(fxr->file1);
749	struct inode *inode2 = file_inode(fxr->file2);	727	struct inode *inode2 = file_inode(fxr->file2);
		728	loff_t check_len = fxr->length;
750	int ret;	729	int ret;
751		730
752	BUILD_BUG_ON(XFS_EXCHANGE_RANGE_ALL_FLAGS &	731	BUILD_BUG_ON(XFS_EXCHANGE_RANGE_ALL_FLAGS &
@@ -779,14 +758,18 @@ xfs_exchange_range( · 26 unmodified lines
779	return -EBADF;	758	return -EBADF;
780		759
781	/*	760	/*
782	* If we're not exchanging to EOF, we can check the areas before	761	* If we're exchanging to EOF we can't calculate the length until taking
783	* stabilizing both files' i_size.	762	* the iolock. Pass a 0 length to remap_verify_area similar to the
		763	* FICLONE and FICLONERANGE ioctls that support cloning to EOF as well.
784	*/	764	*/
785	if (!(fxr->flags & XFS_EXCHANGE_RANGE_TO_EOF)) {	765	if (fxr->flags & XFS_EXCHANGE_RANGE_TO_EOF)
786	ret = xfs_exchange_range_verify_area(fxr);	766	check_len = 0;
787	if (ret)	767	ret = remap_verify_area(fxr->file1, fxr->file1_offset, check_len, true);
788	return ret;	768	if (ret)
789	}	769	return ret;
		770	ret = remap_verify_area(fxr->file2, fxr->file2_offset, check_len, true);
		771	if (ret)
		772	return ret;
790		773
791	/* Update cmtime if the fd/inode don't forbid it. */	774	/* Update cmtime if the fd/inode don't forbid it. */
792	if (!(fxr->file1->f_mode & FMODE_NOCMTIME) && !IS_NOCMTIME(inode1))	775	if (!(fxr->file1->f_mode & FMODE_NOCMTIME) && !IS_NOCMTIME(inode1))

fs/xfs/xfs_inode.c+5−2

 		goto out;
 	/* Try to clean out the cow blocks if there are any. */
-	if (xfs_inode_has_cow_data(ip))
+	if (xfs_inode_has_cow_data(ip)) {
-		xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF, true);
+		error = xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF, true);
+		if (error)
+			goto out;
+	}
 	if (VFS_I(ip)->i_nlink != 0) {
 		/*

fs/xfs/xfs_iomap.c+2−4

 	if (!xfs_is_cow_inode(ip))
 		return 0;
-	if (!written) {
+	if (!written)
-		xfs_reflink_cancel_cow_range(ip, pos, length, true);
+		return xfs_reflink_cancel_cow_range(ip, pos, length, true);
-		return 0;
-	}
 	return xfs_reflink_end_cow(ip, pos, written);
 }

fs/xfs/xfs_qm_bhv.c+39−16

@@ -78,6 +78,28 @@ xfs_qm_statvfs( · 77 unmodified lines
78	}	78	}
79	}	79	}
80		80
		81	STATIC int
		82	xfs_qm_validate_state_change(
		83	struct xfs_mount *mp,
		84	uint uqd,
		85	uint gqd,
		86	uint pqd)
		87	{
		88	int state;
		89
		90	/* Is quota state changing? */
		91	state = ((uqd && !XFS_IS_UQUOTA_ON(mp)) \|\|
		92	(!uqd && XFS_IS_UQUOTA_ON(mp)) \|\|
		93	(gqd && !XFS_IS_GQUOTA_ON(mp)) \|\|
		94	(!gqd && XFS_IS_GQUOTA_ON(mp)) \|\|
		95	(pqd && !XFS_IS_PQUOTA_ON(mp)) \|\|
		96	(!pqd && XFS_IS_PQUOTA_ON(mp)));
		97
		98	return state &&
		99	(xfs_dev_is_read_only(mp, "changing quota state") \|\|
		100	xfs_has_norecovery(mp));
		101	}
		102
81	int	103	int
82	xfs_qm_newmount(	104	xfs_qm_newmount(
83	xfs_mount_t *mp,	105	xfs_mount_t *mp,
@@ -97,24 +119,25 @@ xfs_qm_newmount( · 13 unmodified lines
97	}	119	}
98		120
99	/*	121	/*
100	* If the device itself is read-only, we can't allow	122	* If the device itself is read-only and/or in norecovery
101	* the user to change the state of quota on the mount -	123	* mode, we can't allow the user to change the state of
102	* this would generate a transaction on the ro device,	124	* quota on the mount - this would generate a transaction
103	* which would lead to an I/O error and shutdown	125	* on the ro device, which would lead to an I/O error and
		126	* shutdown.
104	*/	127	*/
105		128
106	if (((uquotaondisk && !XFS_IS_UQUOTA_ON(mp)) \|\|	129	if (xfs_qm_validate_state_change(mp, uquotaondisk,
107	(!uquotaondisk && XFS_IS_UQUOTA_ON(mp)) \|\|	130	gquotaondisk, pquotaondisk)) {
108	(gquotaondisk && !XFS_IS_GQUOTA_ON(mp)) \|\|	131
109	(!gquotaondisk && XFS_IS_GQUOTA_ON(mp)) \|\|	132	if (xfs_has_metadir(mp))
110	(pquotaondisk && !XFS_IS_PQUOTA_ON(mp)) \|\|	133	xfs_warn(mp,
111	(!pquotaondisk && XFS_IS_PQUOTA_ON(mp))) &&	134	"metadir enabled, please mount without any quota mount options");
112	xfs_dev_is_read_only(mp, "changing quota state")) {	135	else
113	xfs_warn(mp, "please mount with%s%s%s%s.",	136	xfs_warn(mp, "please mount with%s%s%s%s.",
114	(!quotaondisk ? "out quota" : ""),	137	(!quotaondisk ? "out quota" : ""),
115	(uquotaondisk ? " usrquota" : ""),	138	(uquotaondisk ? " usrquota" : ""),
116	(gquotaondisk ? " grpquota" : ""),	139	(gquotaondisk ? " grpquota" : ""),
117	(pquotaondisk ? " prjquota" : ""));	140	(pquotaondisk ? " prjquota" : ""));
118	return -EPERM;	141	return -EPERM;
119	}	142	}
120		143

fs/xfs/xfs_super.c+6−2

 #endif
 	}
-	/* Filesystem claims it needs repair, so refuse the mount. */
+	/*
-	if (xfs_has_needsrepair(mp)) {
+	 * Filesystem claims it needs repair, so refuse the mount unless
+	 * norecovery is also specified, in which case the filesystem can
+	 * be mounted with no risk of further damage.
+	 */
+	if (xfs_has_needsrepair(mp) && !xfs_has_norecovery(mp)) {
 		xfs_warn(mp, "Filesystem needs repair.  Please run xfs_repair.");
 		error = -EFSCORRUPTED;
 		goto out_free_sb;

include/asm-generic/vmlinux.lds.h+1−0

@@ -1038,6 +1038,7 @@ defined(CONFIG_AUTOFDO_CLANG) \|\| defined(CONFIG_PROPELLER_CLANG) · 1037 unmodified lines
1038	*(.discard) \	1038	*(.discard) \
1039	(.discard.) \	1039	(.discard.) \
1040	*(.export_symbol) \	1040	*(.export_symbol) \
		1041	*(.no_trim_symbol) \
1041	*(.modinfo) \	1042	*(.modinfo) \
1042	/* ld.bfd warns about .gnu.version* even when not emitted */ \	1043	/* ld.bfd warns about .gnu.version* even when not emitted */ \
1043	(.gnu.version) \	1044	(.gnu.version) \

include/drm/display/drm_dp.h+1−0

@@ -359,6 +359,7 @@ · 358 unmodified lines
359	# define DP_DSC_BITS_PER_PIXEL_1_4 0x2	359	# define DP_DSC_BITS_PER_PIXEL_1_4 0x2
360	# define DP_DSC_BITS_PER_PIXEL_1_2 0x3	360	# define DP_DSC_BITS_PER_PIXEL_1_2 0x3
361	# define DP_DSC_BITS_PER_PIXEL_1_1 0x4	361	# define DP_DSC_BITS_PER_PIXEL_1_1 0x4
		362	# define DP_DSC_BITS_PER_PIXEL_MASK 0x7
362		363
363	#define DP_PSR_SUPPORT 0x070 /* XXX 1.2? */	364	#define DP_PSR_SUPPORT 0x070 /* XXX 1.2? */
364	# define DP_PSR_IS_SUPPORTED 1	365	# define DP_PSR_IS_SUPPORTED 1

include/drm/drm_print.h+1−0

@@ -32,6 +32,7 @@ · 31 unmodified lines
32	#include <linux/dynamic_debug.h>	32	#include <linux/dynamic_debug.h>
33		33
34	#include <drm/drm.h>	34	#include <drm/drm.h>
		35	#include <drm/drm_device.h>
35		36
36	struct debugfs_regset32;	37	struct debugfs_regset32;
37	struct drm_device;	38	struct drm_device;

include/dt-bindings/clock/qcom,qcs8300-camcc.h+16−0

@@ -0,0 +1,16 @@
	1	/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
	2	/*
	3	* Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
	4	*/
	5
	6	#ifndef _DT_BINDINGS_CLK_QCOM_QCS8300_CAM_CC_H
	7	#define _DT_BINDINGS_CLK_QCOM_QCS8300_CAM_CC_H
	8
	9	#include "qcom,sa8775p-camcc.h"
	10
	11	/* QCS8300 introduces below new clocks compared to SA8775P */
	12
	13	/* CAM_CC clocks */
	14	#define CAM_CC_TITAN_TOP_ACCU_SHIFT_CLK 86
	15
	16	#endif

include/dt-bindings/clock/qcom,qcs8300-gpucc.h+17−0

@@ -0,0 +1,17 @@
	1	/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */
	2	/*
	3	* Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved.
	4	*/
	5
	6	#ifndef _DT_BINDINGS_CLK_QCOM_GPUCC_QCS8300_H
	7	#define _DT_BINDINGS_CLK_QCOM_GPUCC_QCS8300_H
	8
	9	#include "qcom,sa8775p-gpucc.h"
	10
	11	/* QCS8300 introduces below new clocks compared to SA8775P */
	12
	13	/* GPU_CC clocks */
	14	#define GPU_CC_CX_ACCU_SHIFT_CLK 23
	15	#define GPU_CC_GX_ACCU_SHIFT_CLK 24
	16
	17	#endif

include/linux/blk-mq.h+14−4

 				       void (*complete)(struct io_comp_batch *))
 {
 	/*
-	 * blk_mq_end_request_batch() can't end request allocated from
+	 * Check various conditions that exclude batch processing:
-	 * sched tags
+	 * 1) No batch container
+	 * 2) Has scheduler data attached
+	 * 3) Not a passthrough request and end_io set
+	 * 4) Not a passthrough request and an ioerror
 	 */
-	if (!iob || (req->rq_flags & RQF_SCHED_TAGS) || ioerror ||
+	if (!iob)
-			(req->end_io && !blk_rq_is_passthrough(req)))
 		return false;
+	if (req->rq_flags & RQF_SCHED_TAGS)
+		return false;
+	if (!blk_rq_is_passthrough(req)) {
+		if (req->end_io)
+			return false;
+		if (ioerror < 0)
+			return false;
+	}
 	if (!iob->complete)
 		iob->complete = complete;

include/linux/cgroup-defs.h+3−3

 	/* Cgroup is frozen. */
 	CGRP_FROZEN,
-	/* Control group has to be killed. */
-	CGRP_KILL,
 };
 /* cgroup_root->flags */
 	int nr_threaded_children;	/* # of live threaded child cgroups */
+	/* sequence number for cgroup.kill, serialized by css_set_lock. */
+	unsigned int kill_seq;
 	struct kernfs_node *kn;		/* cgroup kernfs entry */
 	struct cgroup_file procs_file;	/* handle for "cgroup.procs" */
 	struct cgroup_file events_file;	/* handle for "cgroup.events" */

include/linux/compiler.h+19−13

 	__v;								\
 })
+#ifdef __CHECKER__
+#define __BUILD_BUG_ON_ZERO_MSG(e, msg) (0)
+#else /* __CHECKER__ */
+#define __BUILD_BUG_ON_ZERO_MSG(e, msg) ((int)sizeof(struct {_Static_assert(!(e), msg);}))
+#endif /* __CHECKER__ */
+/* &a[0] degrades to a pointer: a different type from an array */
+#define __is_array(a)		(!__same_type((a), &(a)[0]))
+#define __must_be_array(a)	__BUILD_BUG_ON_ZERO_MSG(!__is_array(a), \
+							"must be array")
+#define __is_byte_array(a)	(__is_array(a) && sizeof((a)[0]) == 1)
+#define __must_be_byte_array(a)	__BUILD_BUG_ON_ZERO_MSG(!__is_byte_array(a), \
+							"must be byte array")
+/* Require C Strings (i.e. NUL-terminated) lack the "nonstring" attribute. */
+#define __must_be_cstr(p) \
+	__BUILD_BUG_ON_ZERO_MSG(__annotated(p, nonstring), "must be cstr (NUL-terminated)")
 #endif /* __KERNEL__ */
 /**
 #define __ADDRESSABLE_ASM_STR(sym) __stringify(__ADDRESSABLE_ASM(sym))
-#ifdef __CHECKER__
-#define __BUILD_BUG_ON_ZERO_MSG(e, msg) (0)
-#else /* __CHECKER__ */
-#define __BUILD_BUG_ON_ZERO_MSG(e, msg) ((int)sizeof(struct {_Static_assert(!(e), msg);}))
-#endif /* __CHECKER__ */
-/* &a[0] degrades to a pointer: a different type from an array */
-#define __must_be_array(a)	__BUILD_BUG_ON_ZERO_MSG(__same_type((a), &(a)[0]), "must be array")
-/* Require C Strings (i.e. NUL-terminated) lack the "nonstring" attribute. */
-#define __must_be_cstr(p) \
-	__BUILD_BUG_ON_ZERO_MSG(__annotated(p, nonstring), "must be cstr (NUL-terminated)")
 /*
  * This returns a constant expression while determining if an argument is
  * a constant expression, most importantly without evaluating the argument.

include/linux/device/faux.h+69−0

@@ -0,0 +1,69 @@
	1	/* SPDX-License-Identifier: GPL-2.0-only */
	2	/*
	3	* Copyright (c) 2025 Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	4	* Copyright (c) 2025 The Linux Foundation
	5	*
	6	* A "simple" faux bus that allows devices to be created and added
	7	* automatically to it. This is to be used whenever you need to create a
	8	* device that is not associated with any "real" system resources, and do
	9	* not want to have to deal with a bus/driver binding logic. It is
	10	* intended to be very simple, with only a create and a destroy function
	11	* available.
	12	*/
	13	#ifndef _FAUX_DEVICE_H_
	14	#define _FAUX_DEVICE_H_
	15
	16	#include <linux/container_of.h>
	17	#include <linux/device.h>
	18
	19	/**
	20	* struct faux_device - a "faux" device
	21	* @dev: internal struct device of the object
	22	*
	23	* A simple faux device that can be created/destroyed. To be used when a
	24	* driver only needs to have a device to "hang" something off. This can be
	25	* used for downloading firmware or other basic tasks. Use this instead of
	26	* a struct platform_device if the device has no resources assigned to
	27	* it at all.
	28	*/
	29	struct faux_device {
	30	struct device dev;
	31	};
	32	#define to_faux_device(x) container_of_const((x), struct faux_device, dev)
	33
	34	/**
	35	* struct faux_device_ops - a set of callbacks for a struct faux_device
	36	* @probe: called when a faux device is probed by the driver core
	37	* before the device is fully bound to the internal faux bus
	38	* code. If probe succeeds, return 0, otherwise return a
	39	* negative error number to stop the probe sequence from
	40	* succeeding.
	41	* @remove: called when a faux device is removed from the system
	42	*
	43	* Both @probe and @remove are optional, if not needed, set to NULL.
	44	*/
	45	struct faux_device_ops {
	46	int (probe)(struct faux_device faux_dev);
	47	void (remove)(struct faux_device faux_dev);
	48	};
	49
	50	struct faux_device faux_device_create(const char name,
	51	struct device *parent,
	52	const struct faux_device_ops *faux_ops);
	53	struct faux_device faux_device_create_with_groups(const char name,
	54	struct device *parent,
	55	const struct faux_device_ops *faux_ops,
	56	const struct attribute_group **groups);
	57	void faux_device_destroy(struct faux_device *faux_dev);
	58
	59	static inline void faux_device_get_drvdata(const struct faux_device faux_dev)
	60	{
	61	return dev_get_drvdata(&faux_dev->dev);
	62	}
	63
	64	static inline void faux_device_set_drvdata(struct faux_device faux_dev, void data)
	65	{
	66	dev_set_drvdata(&faux_dev->dev, data);
	67	}
	68
	69	#endif /* _FAUX_DEVICE_H_ */

include/linux/efi.h+16−15

@@ -114,21 +114,22 @@ typedef struct { · 113 unmodified lines
114	#define EFI_MAX_MEMORY_TYPE 16	114	#define EFI_MAX_MEMORY_TYPE 16
115		115
116	/* Attribute values: */	116	/* Attribute values: */
117	#define EFI_MEMORY_UC ((u64)0x0000000000000001ULL) /* uncached */	117	#define EFI_MEMORY_UC BIT_ULL(0) /* uncached */
118	#define EFI_MEMORY_WC ((u64)0x0000000000000002ULL) /* write-coalescing */	118	#define EFI_MEMORY_WC BIT_ULL(1) /* write-coalescing */
119	#define EFI_MEMORY_WT ((u64)0x0000000000000004ULL) /* write-through */	119	#define EFI_MEMORY_WT BIT_ULL(2) /* write-through */
120	#define EFI_MEMORY_WB ((u64)0x0000000000000008ULL) /* write-back */	120	#define EFI_MEMORY_WB BIT_ULL(3) /* write-back */
121	#define EFI_MEMORY_UCE ((u64)0x0000000000000010ULL) /* uncached, exported */	121	#define EFI_MEMORY_UCE BIT_ULL(4) /* uncached, exported */
122	#define EFI_MEMORY_WP ((u64)0x0000000000001000ULL) /* write-protect */	122	#define EFI_MEMORY_WP BIT_ULL(12) /* write-protect */
123	#define EFI_MEMORY_RP ((u64)0x0000000000002000ULL) /* read-protect */	123	#define EFI_MEMORY_RP BIT_ULL(13) /* read-protect */
124	#define EFI_MEMORY_XP ((u64)0x0000000000004000ULL) /* execute-protect */	124	#define EFI_MEMORY_XP BIT_ULL(14) /* execute-protect */
125	#define EFI_MEMORY_NV ((u64)0x0000000000008000ULL) /* non-volatile */	125	#define EFI_MEMORY_NV BIT_ULL(15) /* non-volatile */
126	#define EFI_MEMORY_MORE_RELIABLE \	126	#define EFI_MEMORY_MORE_RELIABLE BIT_ULL(16) /* higher reliability */
127	((u64)0x0000000000010000ULL) /* higher reliability */	127	#define EFI_MEMORY_RO BIT_ULL(17) /* read-only */
128	#define EFI_MEMORY_RO ((u64)0x0000000000020000ULL) /* read-only */	128	#define EFI_MEMORY_SP BIT_ULL(18) /* soft reserved */
129	#define EFI_MEMORY_SP ((u64)0x0000000000040000ULL) /* soft reserved */	129	#define EFI_MEMORY_CPU_CRYPTO BIT_ULL(19) /* supports encryption */
130	#define EFI_MEMORY_CPU_CRYPTO ((u64)0x0000000000080000ULL) /* supports encryption */	130	#define EFI_MEMORY_HOT_PLUGGABLE BIT_ULL(20) /* supports unplugging at runtime */
131	#define EFI_MEMORY_RUNTIME ((u64)0x8000000000000000ULL) /* range requires runtime mapping */	131	#define EFI_MEMORY_RUNTIME BIT_ULL(63) /* range requires runtime mapping */
		132
132	#define EFI_MEMORY_DESCRIPTOR_VERSION 1	133	#define EFI_MEMORY_DESCRIPTOR_VERSION 1
133		134
134	#define EFI_PAGE_SHIFT 12	135	#define EFI_PAGE_SHIFT 12

include/linux/fs.h+19−1

 #define FMODE_FSNOTIFY_HSM(mode)	0
 #endif
 /*
  * Attribute flags.  These should be or-ed together to figure out what
  * has been changed!
 static inline void inode_set_cached_link(struct inode *inode, char *link, int linklen)
 {
+	int testlen;
+	/*
+	 * TODO: patch it into a debug-only check if relevant macros show up.
+	 * In the meantime, since we are suffering strlen even on production kernels
+	 * to find the right length, do a fixup if the wrong value got passed.
+	 */
+	testlen = strlen(link);
+	if (testlen != linklen) {
+		WARN_ONCE(1, "bad length passed for symlink [%s] (got %d, expected %d)",
+			  link, linklen, testlen);
+		linklen = testlen;
+	}
 	inode->i_link = link;
 	inode->i_linklen = linklen;
 	inode->i_opflags |= IOP_CACHED_LINK;
 	allow_write_access(exe_file);
 }
+static inline void file_set_fsnotify_mode(struct file *file, fmode_t mode)
+{
+	file->f_mode &= ~FMODE_FSNOTIFY_MASK;
+	file->f_mode |= mode;
+}
 static inline bool inode_is_open_for_write(const struct inode *inode)
 {
 	return atomic_read(&inode->i_writecount) > 0;

include/linux/fsnotify.h+2−2

@@ -129,7 +129,7 @@ static inline int fsnotify_file(struct file *file, __u32 mask) · 128 unmodified lines
129		129
130	#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS	130	#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
131		131
132	void file_set_fsnotify_mode(struct file *file);	132	void file_set_fsnotify_mode_from_watchers(struct file *file);
133		133
134	/*	134	/*
135	* fsnotify_file_area_perm - permission hook before access to file range	135	* fsnotify_file_area_perm - permission hook before access to file range
@@ -213,7 +213,7 @@ static inline int fsnotify_open_perm(struct file *file) · 77 unmodified lines
213	}	213	}
214		214
215	#else	215	#else
216	static inline void file_set_fsnotify_mode(struct file *file)	216	static inline void file_set_fsnotify_mode_from_watchers(struct file *file)
217	{	217	{
218	}	218	}
219		219

include/linux/hrtimer_defs.h+1−0

@@ -125,6 +125,7 @@ struct hrtimer_cpu_base { · 124 unmodified lines
125	ktime_t softirq_expires_next;	125	ktime_t softirq_expires_next;
126	struct hrtimer *softirq_next_timer;	126	struct hrtimer *softirq_next_timer;
127	struct hrtimer_clock_base clock_base[HRTIMER_MAX_CLOCK_BASES];	127	struct hrtimer_clock_base clock_base[HRTIMER_MAX_CLOCK_BASES];
		128	call_single_data_t csd;
128	} ____cacheline_aligned;	129	} ____cacheline_aligned;
129		130
130		131

include/linux/i2c.h+8−2

  * @id_table: List of I2C devices supported by this driver
  * @detect: Callback for device detection
  * @address_list: The I2C addresses to probe (for detect)
+ * @clients: List of detected clients we created (for i2c-core use only)
  * @flags: A bitmask of flags defined in &enum i2c_driver_flags
  *
  * The driver.owner field should be set to the module owner of this driver.
 	/* Device detection callback for automatic device creation */
 	int (*detect)(struct i2c_client *client, struct i2c_board_info *info);
 	const unsigned short *address_list;
+	struct list_head clients;
 	u32 flags;
 };
  * @dev: Driver model device node for the slave.
  * @init_irq: IRQ that was set at initialization
  * @irq: indicates the IRQ generated by this device (if any)
+ * @detected: member of an i2c_driver.clients list or i2c-core's
+ *	userspace_devices list
  * @slave_cb: Callback when I2C slave mode of an adapter is used. The adapter
  *	calls it to pass on slave events to the slave driver.
  * @devres_group_id: id of the devres group that will be created for resources
 #define I2C_CLIENT_SLAVE	0x20	/* we are the slave */
 #define I2C_CLIENT_HOST_NOTIFY	0x40	/* We want to use I2C host notify */
 #define I2C_CLIENT_WAKE		0x80	/* for board_info; true iff can wake */
-#define I2C_CLIENT_AUTO		0x100	/* client was auto-detected */
-#define I2C_CLIENT_USER		0x200	/* client was userspace-created */
 #define I2C_CLIENT_SCCB		0x9000	/* Use Omnivision SCCB protocol */
 					/* Must match I2C_M_STOP|IGNORE_NAK */
 	struct device dev;		/* the device structure		*/
 	int init_irq;			/* irq set at initialization	*/
 	int irq;			/* irq issued by device		*/
+	struct list_head detected;
 #if IS_ENABLED(CONFIG_I2C_SLAVE)
 	i2c_slave_cb_t slave_cb;	/* callback for slave mode	*/
 #endif
 	char name[48];
 	struct completion dev_released;
+	struct mutex userspace_clients_lock;
+	struct list_head userspace_clients;
 	struct i2c_bus_recovery_info *bus_recovery_info;
 	const struct i2c_adapter_quirks *quirks;

include/linux/jiffies.h+1−1

@@ -537,7 +537,7 @@ static __always_inline unsigned long msecs_to_jiffies(const unsigned int m) · 536 unmodified lines
537	*	537	*
538	* Return: jiffies value	538	* Return: jiffies value
539	*/	539	*/
540	#define secs_to_jiffies(_secs) ((_secs) * HZ)	540	#define secs_to_jiffies(_secs) (unsigned long)((_secs) * HZ)
541		541
542	extern unsigned long __usecs_to_jiffies(const unsigned int u);	542	extern unsigned long __usecs_to_jiffies(const unsigned int u);
543	#if !(USEC_PER_SEC % HZ)	543	#if !(USEC_PER_SEC % HZ)

include/linux/kvm_host.h+0−1

@@ -1615,7 +1615,6 @@ int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu); · 1614 unmodified lines
1615	bool kvm_arch_dy_runnable(struct kvm_vcpu *vcpu);	1615	bool kvm_arch_dy_runnable(struct kvm_vcpu *vcpu);
1616	bool kvm_arch_dy_has_pending_interrupt(struct kvm_vcpu *vcpu);	1616	bool kvm_arch_dy_has_pending_interrupt(struct kvm_vcpu *vcpu);
1617	bool kvm_arch_vcpu_preempted_in_kernel(struct kvm_vcpu *vcpu);	1617	bool kvm_arch_vcpu_preempted_in_kernel(struct kvm_vcpu *vcpu);
1618	int kvm_arch_post_init_vm(struct kvm *kvm);
1619	void kvm_arch_pre_destroy_vm(struct kvm *kvm);	1618	void kvm_arch_pre_destroy_vm(struct kvm *kvm);
1620	void kvm_arch_create_vm_debugfs(struct kvm *kvm);	1619	void kvm_arch_create_vm_debugfs(struct kvm *kvm);
1621		1620

include/linux/lockref.h+4−3

 /**
  * lockref_init - Initialize a lockref
  * @lockref: pointer to lockref structure
- * @count: initial count
+ *
+ * Initializes @lockref->count to 1.
  */
-static inline void lockref_init(struct lockref *lockref, unsigned int count)
+static inline void lockref_init(struct lockref *lockref)
 {
 	spin_lock_init(&lockref->lock);
-	lockref->count = count;
+	lockref->count = 1;
 }
 void lockref_get(struct lockref *lockref);

include/linux/module.h+4−1

 /* Get/put a kernel symbol (calls must be symmetric) */
 void *__symbol_get(const char *symbol);
 void *__symbol_get_gpl(const char *symbol);
-#define symbol_get(x) ((typeof(&x))(__symbol_get(__stringify(x))))
+#define symbol_get(x)	({ \
+	static const char __notrim[] \
+		__used __section(".no_trim_symbol") = __stringify(x); \
+	(typeof(&x))(__symbol_get(__stringify(x))); })
 /* modules using other modules: kdb wants to see this. */
 struct module_use {

include/linux/netdevice.h+9−2

 	return read_pnet(&dev->nd_net);
 }
+static inline
+struct net *dev_net_rcu(const struct net_device *dev)
+{
+	return read_pnet_rcu(&dev->nd_net);
+}
 static inline
 void dev_net_set(struct net_device *dev, struct net *net)
 {
 struct pcpu_dstats {
 	u64_stats_t		rx_packets;
 	u64_stats_t		rx_bytes;
-	u64_stats_t		rx_drops;
 	u64_stats_t		tx_packets;
 	u64_stats_t		tx_bytes;
+	u64_stats_t		rx_drops;
 	u64_stats_t		tx_drops;
 	struct u64_stats_sync	syncp;
 } __aligned(8 * sizeof(u64));
 }
 int netdev_boot_setup_check(struct net_device *dev);
+struct net_device *dev_getbyhwaddr(struct net *net, unsigned short type,
+				   const char *hwaddr);
 struct net_device *dev_getbyhwaddr_rcu(struct net *net, unsigned short type,
 				       const char *hwaddr);
 struct net_device *dev_getfirstbyhwtype(struct net *net, unsigned short type);
 gro_result_t napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb);
 void napi_gro_flush(struct napi_struct *napi, bool flush_old);
 struct sk_buff *napi_get_frags(struct napi_struct *napi);
-void napi_get_frags_check(struct napi_struct *napi);
 gro_result_t napi_gro_frags(struct napi_struct *napi);
 static inline void napi_free_frags(struct napi_struct *napi)

include/linux/netfs.h+1−1

@@ -278,7 +278,7 @@ struct netfs_io_request { · 277 unmodified lines
278	#define NETFS_RREQ_PAUSE 11 /* Pause subrequest generation */	278	#define NETFS_RREQ_PAUSE 11 /* Pause subrequest generation */
279	#define NETFS_RREQ_USE_IO_ITER 12 /* Use ->io_iter rather than ->i_pages */	279	#define NETFS_RREQ_USE_IO_ITER 12 /* Use ->io_iter rather than ->i_pages */
280	#define NETFS_RREQ_ALL_QUEUED 13 /* All subreqs are now queued */	280	#define NETFS_RREQ_ALL_QUEUED 13 /* All subreqs are now queued */
281	#define NETFS_RREQ_NEED_RETRY 14 /* Need to try retrying */	281	#define NETFS_RREQ_RETRYING 14 /* Set if we're in the retry path */
282	#define NETFS_RREQ_USE_PGPRIV2 31 /* [DEPRECATED] Use PG_private_2 to mark	282	#define NETFS_RREQ_USE_PGPRIV2 31 /* [DEPRECATED] Use PG_private_2 to mark
283	* write to cache on read */	283	* write to cache on read */
284	const struct netfs_request_ops *netfs_ops;	284	const struct netfs_request_ops *netfs_ops;

include/linux/pci_ids.h+1−0

@@ -3134,6 +3134,7 @@ · 3133 unmodified lines
3134	#define PCI_DEVICE_ID_INTEL_HDA_LNL_P 0xa828	3134	#define PCI_DEVICE_ID_INTEL_HDA_LNL_P 0xa828
3135	#define PCI_DEVICE_ID_INTEL_S21152BB 0xb152	3135	#define PCI_DEVICE_ID_INTEL_S21152BB 0xb152
3136	#define PCI_DEVICE_ID_INTEL_HDA_BMG 0xe2f7	3136	#define PCI_DEVICE_ID_INTEL_HDA_BMG 0xe2f7
		3137	#define PCI_DEVICE_ID_INTEL_HDA_PTL_H 0xe328
3137	#define PCI_DEVICE_ID_INTEL_HDA_PTL 0xe428	3138	#define PCI_DEVICE_ID_INTEL_HDA_PTL 0xe428
3138	#define PCI_DEVICE_ID_INTEL_HDA_CML_R 0xf0c8	3139	#define PCI_DEVICE_ID_INTEL_HDA_CML_R 0xf0c8
3139	#define PCI_DEVICE_ID_INTEL_HDA_RKL_S 0xf1c8	3140	#define PCI_DEVICE_ID_INTEL_HDA_RKL_S 0xf1c8

include/linux/psp-sev.h+9−0

@@ -814,6 +814,15 @@ struct sev_data_snp_commit { · 813 unmodified lines
814		814
815	#ifdef CONFIG_CRYPTO_DEV_SP_PSP	815	#ifdef CONFIG_CRYPTO_DEV_SP_PSP
816		816
		817	/**
		818	* sev_module_init - perform PSP SEV module initialization
		819	*
		820	* Returns:
		821	* 0 if the PSP module is successfully initialized
		822	* negative value if the PSP module initialization fails
		823	*/
		824	int sev_module_init(void);
		825
817	/**	826	/**
818	* sev_platform_init - perform SEV INIT command	827	* sev_platform_init - perform SEV INIT command
819	*	828	*

include/linux/sched/task.h+1−0

@@ -43,6 +43,7 @@ struct kernel_clone_args { · 42 unmodified lines
43	void *fn_arg;	43	void *fn_arg;
44	struct cgroup *cgrp;	44	struct cgroup *cgrp;
45	struct css_set *cset;	45	struct css_set *cset;
		46	unsigned int kill_seq;
46	};	47	};
47		48
48	/*	49	/*

include/linux/skmsg.h+2−0

 	struct sk_psock_progs		progs;
 #if IS_ENABLED(CONFIG_BPF_STREAM_PARSER)
 	struct strparser		strp;
+	u32				copied_seq;
+	u32				ingress_bytes;
 #endif
 	struct sk_buff_head		ingress_skb;
 	struct list_head		ingress_msg;

include/linux/string.h+8−4

  * must be discoverable by the compiler.
  */
 #define strtomem_pad(dest, src, pad)	do {				\
-	const size_t _dest_len = __builtin_object_size(dest, 1);	\
+	const size_t _dest_len = __must_be_byte_array(dest) +		\
+				 ARRAY_SIZE(dest);			\
 	const size_t _src_len = __builtin_object_size(src, 1);		\
 									\
 	BUILD_BUG_ON(!__builtin_constant_p(_dest_len) ||		\
  * must be discoverable by the compiler.
  */
 #define strtomem(dest, src)	do {					\
-	const size_t _dest_len = __builtin_object_size(dest, 1);	\
+	const size_t _dest_len = __must_be_byte_array(dest) +		\
+				 ARRAY_SIZE(dest);			\
 	const size_t _src_len = __builtin_object_size(src, 1);		\
 									\
 	BUILD_BUG_ON(!__builtin_constant_p(_dest_len) ||		\
  * Note that sizes of @dest and @src must be known at compile-time.
  */
 #define memtostr(dest, src)	do {					\
-	const size_t _dest_len = __builtin_object_size(dest, 1);	\
+	const size_t _dest_len = __must_be_byte_array(dest) +		\
+				 ARRAY_SIZE(dest);			\
 	const size_t _src_len = __builtin_object_size(src, 1);		\
 	const size_t _src_chars = strnlen(src, _src_len);		\
 	const size_t _copy_len = min(_dest_len - 1, _src_chars);	\
  * Note that sizes of @dest and @src must be known at compile-time.
  */
 #define memtostr_pad(dest, src)		do {				\
-	const size_t _dest_len = __builtin_object_size(dest, 1);	\
+	const size_t _dest_len = __must_be_byte_array(dest) +		\
+				 ARRAY_SIZE(dest);			\
 	const size_t _src_len = __builtin_object_size(src, 1);		\
 	const size_t _src_chars = strnlen(src, _src_len);		\
 	const size_t _copy_len = min(_dest_len - 1, _src_chars);	\

include/net/bluetooth/l2cap.h+2−1

 	struct l2cap_chan	*smp;
 	struct list_head	chan_l;
-	struct mutex		chan_lock;
+	struct mutex		lock;
 	struct kref		ref;
 	struct list_head	users;
 };
 void l2cap_send_conn_req(struct l2cap_chan *chan);
 struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn);
+struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *conn);
 void l2cap_conn_put(struct l2cap_conn *conn);
 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user);

include/net/gro.h+3−0

@@ -11,6 +11,9 @@ · 10 unmodified lines
11	#include <net/udp.h>	11	#include <net/udp.h>
12	#include <net/hotdata.h>	12	#include <net/hotdata.h>
13		13
		14	/* This should be increased if a protocol with a bigger head is added. */
		15	#define GRO_MAX_HEAD (MAX_HEADER + 128)
		16
14	struct napi_gro_cb {	17	struct napi_gro_cb {
15	union {	18	union {
16	struct {	19	struct {

include/net/ip.h+10−3

 						    bool forwarding)
 {
 	const struct rtable *rt = dst_rtable(dst);
-	struct net *net = dev_net(dst->dev);
+	unsigned int mtu, res;
-	unsigned int mtu;
+	struct net *net;
+	rcu_read_lock();
+	net = dev_net_rcu(dst->dev);
 	if (READ_ONCE(net->ipv4.sysctl_ip_fwd_use_pmtu) ||
 	    ip_mtu_locked(dst) ||
 	    !forwarding) {
 out:
 	mtu = min_t(unsigned int, mtu, IP_MAX_MTU);
-	return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
+	res = mtu - lwtunnel_headroom(dst->lwtstate, mtu);
+	rcu_read_unlock();
+	return res;
 }
 static inline unsigned int ip_skb_dst_mtu(struct sock *sk,

include/net/l3mdev.h+2−0

 	if (netif_is_l3_slave(dev)) {
 		struct net_device *master;
+		rcu_read_lock();
 		master = netdev_master_upper_dev_get_rcu(dev);
 		if (master && master->l3mdev_ops->l3mdev_l3_out)
 			skb = master->l3mdev_ops->l3mdev_l3_out(master, sk,
 								skb, proto);
+		rcu_read_unlock();
 	}
 	return skb;

include/net/net_namespace.h+12−1

 }
 void net_drop_ns(void *);
+void net_passive_dec(struct net *net);
 #else
 }
 #define net_drop_ns NULL
+static inline void net_passive_dec(struct net *net)
+{
+	refcount_dec(&net->passive);
+}
 #endif
+static inline void net_passive_inc(struct net *net)
+{
+	refcount_inc(&net->passive);
+}
 /* Returns true if the netns initialization is completed successfully */
 static inline bool net_initialized(const struct net *net)
 {
 #endif
 }
-static inline struct net *read_pnet_rcu(possible_net_t *pnet)
+static inline struct net *read_pnet_rcu(const possible_net_t *pnet)
 {
 #ifdef CONFIG_NET_NS
 	return rcu_dereference(pnet->net);

include/net/route.h+7−2

 static inline int ip4_dst_hoplimit(const struct dst_entry *dst)
 {
 	int hoplimit = dst_metric_raw(dst, RTAX_HOPLIMIT);
-	struct net *net = dev_net(dst->dev);
-	if (hoplimit == 0)
+	if (hoplimit == 0) {
+		const struct net *net;
+		rcu_read_lock();
+		net = dev_net_rcu(dst->dev);
 		hoplimit = READ_ONCE(net->ipv4.sysctl_ip_default_ttl);
+		rcu_read_unlock();
+	}
 	return hoplimit;
 }

include/net/sch_generic.h+1−1

@@ -851,7 +851,7 @@ static inline int qdisc_enqueue(struct sk_buff skb, struct Qdisc sch, · 850 unmodified lines
851	}	851	}
852		852
853	static inline void _bstats_update(struct gnet_stats_basic_sync *bstats,	853	static inline void _bstats_update(struct gnet_stats_basic_sync *bstats,
854	__u64 bytes, __u32 packets)	854	__u64 bytes, __u64 packets)
855	{	855	{
856	u64_stats_update_begin(&bstats->syncp);	856	u64_stats_update_begin(&bstats->syncp);
857	u64_stats_add(&bstats->bytes, bytes);	857	u64_stats_add(&bstats->bytes, bytes);

include/net/strparser.h+2−0

 struct strp_callbacks {
 	int (*parse_msg)(struct strparser *strp, struct sk_buff *skb);
 	void (*rcv_msg)(struct strparser *strp, struct sk_buff *skb);
+	int (*read_sock)(struct strparser *strp, read_descriptor_t *desc,
+			 sk_read_actor_t recv_actor);
 	int (*read_sock_done)(struct strparser *strp, int err);
 	void (*abort_parser)(struct strparser *strp, int err);
 	void (*lock)(struct strparser *strp);

include/net/tcp.h+22−0

 #include <net/inet_ecn.h>
 #include <net/dst.h>
 #include <net/mptcp.h>
+#include <net/xfrm.h>
 #include <linux/seq_file.h>
 #include <linux/memcontrol.h>
 void tcp_check_space(struct sock *sk);
 void tcp_sack_compress_send_ack(struct sock *sk);
+static inline void tcp_cleanup_skb(struct sk_buff *skb)
+{
+	skb_dst_drop(skb);
+	secpath_reset(skb);
+}
+static inline void tcp_add_receive_queue(struct sock *sk, struct sk_buff *skb)
+{
+	DEBUG_NET_WARN_ON_ONCE(skb_dst(skb));
+	DEBUG_NET_WARN_ON_ONCE(secpath_exists(skb));
+	__skb_queue_tail(&sk->sk_receive_queue, skb);
+}
 /* tcp_timer.c */
 void tcp_init_xmit_timers(struct sock *);
 static inline void tcp_clear_xmit_timers(struct sock *sk)
 /* Read 'sendfile()'-style from a TCP socket */
 int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
 		  sk_read_actor_t recv_actor);
+int tcp_read_sock_noack(struct sock *sk, read_descriptor_t *desc,
+			sk_read_actor_t recv_actor, bool noack,
+			u32 *copied_seq);
 int tcp_read_skb(struct sock *sk, skb_read_actor_t recv_actor);
 struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off);
 void tcp_read_done(struct sock *sk, size_t len);
 #ifdef CONFIG_BPF_SYSCALL
 int tcp_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore);
 void tcp_bpf_clone(const struct sock *sk, struct sock *newsk);
+#ifdef CONFIG_BPF_STREAM_PARSER
+struct strparser;
+int tcp_bpf_strp_read_sock(struct strparser *strp, read_descriptor_t *desc,
+			   sk_read_actor_t recv_actor);
+#endif /* CONFIG_BPF_STREAM_PARSER */
 #endif /* CONFIG_BPF_SYSCALL */
 #ifdef CONFIG_INET

include/trace/events/netfs.h+3−1

 	EM(netfs_sreq_trace_limited,		"LIMIT")	\
 	EM(netfs_sreq_trace_need_clear,		"N-CLR")	\
 	EM(netfs_sreq_trace_partial_read,	"PARTR")	\
-	EM(netfs_sreq_trace_need_retry,		"NRTRY")	\
+	EM(netfs_sreq_trace_need_retry,		"ND-RT")	\
 	EM(netfs_sreq_trace_prepare,		"PREP ")	\
 	EM(netfs_sreq_trace_prep_failed,	"PRPFL")	\
 	EM(netfs_sreq_trace_progress,		"PRGRS")	\
 	EM(netfs_sreq_trace_short,		"SHORT")	\
 	EM(netfs_sreq_trace_split,		"SPLIT")	\
 	EM(netfs_sreq_trace_submit,		"SUBMT")	\
+	EM(netfs_sreq_trace_superfluous,	"SPRFL")	\
 	EM(netfs_sreq_trace_terminated,		"TERM ")	\
+	EM(netfs_sreq_trace_wait_for,		"_WAIT")	\
 	EM(netfs_sreq_trace_write,		"WRITE")	\
 	EM(netfs_sreq_trace_write_skip,		"SKIP ")	\
 	E_(netfs_sreq_trace_write_term,		"WTERM")

include/trace/events/rxrpc.h+1−0

@@ -219,6 +219,7 @@ · 218 unmodified lines
219	EM(rxrpc_conn_get_conn_input, "GET inp-conn") \	219	EM(rxrpc_conn_get_conn_input, "GET inp-conn") \
220	EM(rxrpc_conn_get_idle, "GET idle ") \	220	EM(rxrpc_conn_get_idle, "GET idle ") \
221	EM(rxrpc_conn_get_poke_abort, "GET pk-abort") \	221	EM(rxrpc_conn_get_poke_abort, "GET pk-abort") \
		222	EM(rxrpc_conn_get_poke_secured, "GET secured ") \
222	EM(rxrpc_conn_get_poke_timer, "GET poke ") \	223	EM(rxrpc_conn_get_poke_timer, "GET poke ") \
223	EM(rxrpc_conn_get_service_conn, "GET svc-conn") \	224	EM(rxrpc_conn_get_service_conn, "GET svc-conn") \
224	EM(rxrpc_conn_new_client, "NEW client ") \	225	EM(rxrpc_conn_new_client, "NEW client ") \

include/uapi/drm/amdgpu_drm.h+8−1

 /* GFX12 and later: */
 #define AMDGPU_TILING_GFX12_SWIZZLE_MODE_SHIFT			0
 #define AMDGPU_TILING_GFX12_SWIZZLE_MODE_MASK			0x7
-/* These are DCC recompression setting for memory management: */
+/* These are DCC recompression settings for memory management: */
 #define AMDGPU_TILING_GFX12_DCC_MAX_COMPRESSED_BLOCK_SHIFT	3
 #define AMDGPU_TILING_GFX12_DCC_MAX_COMPRESSED_BLOCK_MASK	0x3 /* 0:64B, 1:128B, 2:256B */
 #define AMDGPU_TILING_GFX12_DCC_NUMBER_TYPE_SHIFT		5
 #define AMDGPU_TILING_GFX12_DCC_NUMBER_TYPE_MASK		0x7 /* CB_COLOR0_INFO.NUMBER_TYPE */
 #define AMDGPU_TILING_GFX12_DCC_DATA_FORMAT_SHIFT		8
 #define AMDGPU_TILING_GFX12_DCC_DATA_FORMAT_MASK		0x3f /* [0:4]:CB_COLOR0_INFO.FORMAT, [5]:MM */
+/* When clearing the buffer or moving it from VRAM to GTT, don't compress and set DCC metadata
+ * to uncompressed. Set when parts of an allocation bypass DCC and read raw data. */
+#define AMDGPU_TILING_GFX12_DCC_WRITE_COMPRESS_DISABLE_SHIFT	14
+#define AMDGPU_TILING_GFX12_DCC_WRITE_COMPRESS_DISABLE_MASK	0x1
+/* bit gap */
+#define AMDGPU_TILING_GFX12_SCANOUT_SHIFT			63
+#define AMDGPU_TILING_GFX12_SCANOUT_MASK			0x1
 /* Set/Get helpers for tiling flags. */
 #define AMDGPU_TILING_SET(field, value) \

include/uapi/linux/ethtool.h+2−0

  * @ETH_SS_STATS_ETH_CTRL: names of IEEE 802.3 MAC Control statistics
  * @ETH_SS_STATS_RMON: names of RMON statistics
  * @ETH_SS_STATS_PHY: names of PHY(dev) statistics
+ * @ETH_SS_TS_FLAGS: hardware timestamping flags
  *
  * @ETH_SS_COUNT: number of defined string sets
  */
 	ETH_SS_STATS_ETH_CTRL,
 	ETH_SS_STATS_RMON,
 	ETH_SS_STATS_PHY,
+	ETH_SS_TS_FLAGS,
 	/* add new constants above here */
 	ETH_SS_COUNT

include/uapi/linux/taskstats.h+1−1

@@ -34,7 +34,7 @@ · 33 unmodified lines
34	*/	34	*/
35		35
36		36
37	#define TASKSTATS_VERSION 14	37	#define TASKSTATS_VERSION 15
38	#define TS_COMM_LEN 32 /* should be >= TASK_COMM_LEN	38	#define TS_COMM_LEN 32 /* should be >= TASK_COMM_LEN
39	* in linux/sched.h */	39	* in linux/sched.h */
40		40

include/uapi/linux/thermal.h+1−1

 	THERMAL_GENL_ATTR_TZ,
 	THERMAL_GENL_ATTR_TZ_ID,
 	THERMAL_GENL_ATTR_TZ_TEMP,
-	THERMAL_GENL_ATTR_TZ_PREV_TEMP,
 	THERMAL_GENL_ATTR_TZ_TRIP,
 	THERMAL_GENL_ATTR_TZ_TRIP_ID,
 	THERMAL_GENL_ATTR_TZ_TRIP_TYPE,
 	THERMAL_GENL_ATTR_THRESHOLD,
 	THERMAL_GENL_ATTR_THRESHOLD_TEMP,
 	THERMAL_GENL_ATTR_THRESHOLD_DIRECTION,
+	THERMAL_GENL_ATTR_TZ_PREV_TEMP,
 	__THERMAL_GENL_ATTR_MAX,
 };
 #define THERMAL_GENL_ATTR_MAX (__THERMAL_GENL_ATTR_MAX - 1)

include/uapi/linux/virtio_snd.h+1−1

@@ -25,7 +25,7 @@ struct virtio_snd_config { · 24 unmodified lines
25	__le32 streams;	25	__le32 streams;
26	/* # of available channel maps */	26	/* # of available channel maps */
27	__le32 chmaps;	27	__le32 chmaps;
28	/* # of available control elements */	28	/* # of available control elements (if VIRTIO_SND_F_CTLS) */
29	__le32 controls;	29	__le32 controls;
30	};	30	};
31		31

include/ufs/ufs.h+2−2

@@ -385,8 +385,8 @@ enum { · 384 unmodified lines
385		385
386	/* Possible values for dExtendedUFSFeaturesSupport */	386	/* Possible values for dExtendedUFSFeaturesSupport */
387	enum {	387	enum {
388	UFS_DEV_LOW_TEMP_NOTIF = BIT(4),	388	UFS_DEV_HIGH_TEMP_NOTIF = BIT(4),
389	UFS_DEV_HIGH_TEMP_NOTIF = BIT(5),	389	UFS_DEV_LOW_TEMP_NOTIF = BIT(5),
390	UFS_DEV_EXT_TEMP_NOTIF = BIT(6),	390	UFS_DEV_EXT_TEMP_NOTIF = BIT(6),
391	UFS_DEV_HPB_SUPPORT = BIT(7),	391	UFS_DEV_HPB_SUPPORT = BIT(7),
392	UFS_DEV_WRITE_BOOSTER_SUP = BIT(8),	392	UFS_DEV_WRITE_BOOSTER_SUP = BIT(8),

include/ufs/ufshcd.h+0−1

@@ -1309,7 +1309,6 @@ static inline void ufshcd_rmwl(struct ufs_hba *hba, u32 mask, u32 val, u32 reg) · 1308 unmodified lines
1309	void ufshcd_enable_irq(struct ufs_hba *hba);	1309	void ufshcd_enable_irq(struct ufs_hba *hba);
1310	void ufshcd_disable_irq(struct ufs_hba *hba);	1310	void ufshcd_disable_irq(struct ufs_hba *hba);
1311	int ufshcd_alloc_host(struct device , struct ufs_hba *);	1311	int ufshcd_alloc_host(struct device , struct ufs_hba *);
1312	void ufshcd_dealloc_host(struct ufs_hba *);
1313	int ufshcd_hba_enable(struct ufs_hba *hba);	1312	int ufshcd_hba_enable(struct ufs_hba *hba);
1314	int ufshcd_init(struct ufs_hba , void __iomem , unsigned int);	1313	int ufshcd_init(struct ufs_hba , void __iomem , unsigned int);
1315	int ufshcd_link_recovery(struct ufs_hba *hba);	1314	int ufshcd_link_recovery(struct ufs_hba *hba);

io_uring/futex.c+1−1

@@ -338,7 +338,7 @@ int io_futex_wait(struct io_kiocb *req, unsigned int issue_flags) · 337 unmodified lines
338	hlist_add_head(&req->hash_node, &ctx->futex_list);	338	hlist_add_head(&req->hash_node, &ctx->futex_list);
339	io_ring_submit_unlock(ctx, issue_flags);	339	io_ring_submit_unlock(ctx, issue_flags);
340		340
341	futex_queue(&ifd->q, hb);	341	futex_queue(&ifd->q, hb, NULL);
342	return IOU_ISSUE_SKIP_COMPLETE;	342	return IOU_ISSUE_SKIP_COMPLETE;
343	}	343	}
344		344

io_uring/kbuf.c+12−4

 	}
 }
+static void io_destroy_bl(struct io_ring_ctx *ctx, struct io_buffer_list *bl)
+{
+	scoped_guard(mutex, &ctx->mmap_lock)
+		WARN_ON_ONCE(xa_erase(&ctx->io_bl_xa, bl->bgid) != bl);
+	io_put_bl(ctx, bl);
+}
 int io_remove_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
 	struct io_provide_buf *p = io_kiocb_to_cmd(req, struct io_provide_buf);
 		/* if mapped buffer ring OR classic exists, don't allow */
 		if (bl->flags & IOBL_BUF_RING || !list_empty(&bl->buf_list))
 			return -EEXIST;
-	} else {
+		io_destroy_bl(ctx, bl);
-		free_bl = bl = kzalloc(sizeof(*bl), GFP_KERNEL);
-		if (!bl)
-			return -ENOMEM;
 	}
+	free_bl = bl = kzalloc(sizeof(*bl), GFP_KERNEL);
+	if (!bl)
+		return -ENOMEM;
 	mmap_offset = (unsigned long)reg.bgid << IORING_OFF_PBUF_SHIFT;
 	ring_size = flex_array_size(br, bufs, reg.ring_entries);

io_uring/uring_cmd.c+9−19

@@ -54,9 +54,6 @@ bool io_uring_try_cancel_uring_cmd(struct io_ring_ctx *ctx, · 53 unmodified lines
54	continue;	54	continue;
55		55
56	if (cmd->flags & IORING_URING_CMD_CANCELABLE) {	56	if (cmd->flags & IORING_URING_CMD_CANCELABLE) {
57	/* ->sqe isn't available if no async data */
58	if (!req_has_async_data(req))
59	cmd->sqe = NULL;
60	file->f_op->uring_cmd(cmd, IO_URING_F_CANCEL \|	57	file->f_op->uring_cmd(cmd, IO_URING_F_CANCEL \|
61	IO_URING_F_COMPLETE_DEFER);	58	IO_URING_F_COMPLETE_DEFER);
62	ret = true;	59	ret = true;
@@ -179,12 +176,13 @@ static int io_uring_cmd_prep_setup(struct io_kiocb *req, · 116 unmodified lines
179	return -ENOMEM;	176	return -ENOMEM;
180	cache->op_data = NULL;	177	cache->op_data = NULL;
181		178
182	if (!(req->flags & REQ_F_FORCE_ASYNC)) {	179	/*
183	/* defer memcpy until we need it */	180	* Unconditionally cache the SQE for now - this is only needed for
184	ioucmd->sqe = sqe;	181	* requests that go async, but prep handlers must ensure that any
185	return 0;	182	* sqe data is stable beyond prep. Since uring_cmd is special in
186	}	183	* that it doesn't read in per-op data, play it safe and ensure that
187		184	* any SQE data is stable beyond prep. This can later get relaxed.
		185	*/
188	memcpy(cache->sqes, sqe, uring_sqe_size(req->ctx));	186	memcpy(cache->sqes, sqe, uring_sqe_size(req->ctx));
189	ioucmd->sqe = cache->sqes;	187	ioucmd->sqe = cache->sqes;
190	return 0;	188	return 0;
@@ -249,16 +247,8 @@ int io_uring_cmd(struct io_kiocb *req, unsigned int issue_flags) · 58 unmodified lines
249	}	247	}
250		248
251	ret = file->f_op->uring_cmd(ioucmd, issue_flags);	249	ret = file->f_op->uring_cmd(ioucmd, issue_flags);
252	if (ret == -EAGAIN) {	250	if (ret == -EAGAIN \|\| ret == -EIOCBQUEUED)
253	struct io_uring_cmd_data *cache = req->async_data;	251	return ret;
254
255	if (ioucmd->sqe != (void *) cache)
256	memcpy(cache->sqes, ioucmd->sqe, uring_sqe_size(req->ctx));
257	return -EAGAIN;
258	} else if (ret == -EIOCBQUEUED) {
259	return -EIOCBQUEUED;
260	}
261
262	if (ret < 0)	252	if (ret < 0)
263	req_set_fail(req);	253	req_set_fail(req);
264	io_req_uring_cleanup(req, issue_flags);	254	io_req_uring_cleanup(req, issue_flags);

io_uring/waitid.c+9−9

 static void io_waitid_complete(struct io_kiocb *req, int ret)
 {
 	struct io_waitid *iw = io_kiocb_to_cmd(req, struct io_waitid);
-	struct io_tw_state ts = {};
 	/* anyone completing better be holding a reference */
 	WARN_ON_ONCE(!(atomic_read(&iw->refs) & IO_WAITID_REF_MASK));
 	if (ret < 0)
 		req_set_fail(req);
 	io_req_set_res(req, ret, 0);
-	io_req_task_complete(req, &ts);
 }
 static bool __io_waitid_cancel(struct io_ring_ctx *ctx, struct io_kiocb *req)
 	list_del_init(&iwa->wo.child_wait.entry);
 	spin_unlock_irq(&iw->head->lock);
 	io_waitid_complete(req, -ECANCELED);
+	io_req_queue_tw_complete(req, -ECANCELED);
 	return true;
 }
 	}
 	io_waitid_complete(req, ret);
+	io_req_task_complete(req, ts);
 }
 static int io_waitid_wait(struct wait_queue_entry *wait, unsigned mode,
 int io_waitid_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
 	struct io_waitid *iw = io_kiocb_to_cmd(req, struct io_waitid);
+	struct io_waitid_async *iwa;
 	if (sqe->addr || sqe->buf_index || sqe->addr3 || sqe->waitid_flags)
 		return -EINVAL;
+	iwa = io_uring_alloc_async_data(NULL, req);
+	if (!unlikely(iwa))
+		return -ENOMEM;
+	iwa->req = req;
 	iw->which = READ_ONCE(sqe->len);
 	iw->upid = READ_ONCE(sqe->fd);
 	iw->options = READ_ONCE(sqe->file_index);
 int io_waitid(struct io_kiocb *req, unsigned int issue_flags)
 {
 	struct io_waitid *iw = io_kiocb_to_cmd(req, struct io_waitid);
+	struct io_waitid_async *iwa = req->async_data;
 	struct io_ring_ctx *ctx = req->ctx;
-	struct io_waitid_async *iwa;
 	int ret;
-	iwa = io_uring_alloc_async_data(NULL, req);
-	if (!iwa)
-		return -ENOMEM;
-	iwa->req = req;
 	ret = kernel_waitid_prepare(&iwa->wo, iw->which, iw->upid, &iw->info,
 					iw->options, NULL);
 	if (ret)

kernel/acct.c+84−50

@@ -103,48 +103,50 @@ struct bsd_acct_struct { · 102 unmodified lines
103	atomic_long_t count;	103	atomic_long_t count;
104	struct rcu_head rcu;	104	struct rcu_head rcu;
105	struct mutex lock;	105	struct mutex lock;
106	int active;	106	bool active;
		107	bool check_space;
107	unsigned long needcheck;	108	unsigned long needcheck;
108	struct file *file;	109	struct file *file;
109	struct pid_namespace *ns;	110	struct pid_namespace *ns;
110	struct work_struct work;	111	struct work_struct work;
111	struct completion done;	112	struct completion done;
		113	acct_t ac;
112	};	114	};
113		115
114	static void do_acct_process(struct bsd_acct_struct *acct);	116	static void fill_ac(struct bsd_acct_struct *acct);
		117	static void acct_write_process(struct bsd_acct_struct *acct);
115		118
116	/*	119	/*
117	* Check the amount of free space and suspend/resume accordingly.	120	* Check the amount of free space and suspend/resume accordingly.
118	*/	121	*/
119	static int check_free_space(struct bsd_acct_struct *acct)	122	static bool check_free_space(struct bsd_acct_struct *acct)
120	{	123	{
121	struct kstatfs sbuf;	124	struct kstatfs sbuf;
122		125
123	if (time_is_after_jiffies(acct->needcheck))	126	if (!acct->check_space)
124	goto out;	127	return acct->active;
125		128
126	/* May block */	129	/* May block */
127	if (vfs_statfs(&acct->file->f_path, &sbuf))	130	if (vfs_statfs(&acct->file->f_path, &sbuf))
128	goto out;	131	return acct->active;
129		132
130	if (acct->active) {	133	if (acct->active) {
131	u64 suspend = sbuf.f_blocks * SUSPEND;	134	u64 suspend = sbuf.f_blocks * SUSPEND;
132	do_div(suspend, 100);	135	do_div(suspend, 100);
133	if (sbuf.f_bavail <= suspend) {	136	if (sbuf.f_bavail <= suspend) {
134	acct->active = 0;	137	acct->active = false;
135	pr_info("Process accounting paused\n");	138	pr_info("Process accounting paused\n");
136	}	139	}
137	} else {	140	} else {
138	u64 resume = sbuf.f_blocks * RESUME;	141	u64 resume = sbuf.f_blocks * RESUME;
139	do_div(resume, 100);	142	do_div(resume, 100);
140	if (sbuf.f_bavail >= resume) {	143	if (sbuf.f_bavail >= resume) {
141	acct->active = 1;	144	acct->active = true;
142	pr_info("Process accounting resumed\n");	145	pr_info("Process accounting resumed\n");
143	}	146	}
144	}	147	}
145		148
146	acct->needcheck = jiffies + ACCT_TIMEOUT*HZ;	149	acct->needcheck = jiffies + ACCT_TIMEOUT*HZ;
147	out:
148	return acct->active;	150	return acct->active;
149	}	151	}
150		152
@@ -189,7 +191,11 @@ static void acct_pin_kill(struct fs_pin *pin) · 38 unmodified lines
189	{	191	{
190	struct bsd_acct_struct *acct = to_acct(pin);	192	struct bsd_acct_struct *acct = to_acct(pin);
191	mutex_lock(&acct->lock);	193	mutex_lock(&acct->lock);
192	do_acct_process(acct);	194	/*
		195	* Fill the accounting struct with the exiting task's info
		196	* before punting to the workqueue.
		197	*/
		198	fill_ac(acct);
193	schedule_work(&acct->work);	199	schedule_work(&acct->work);
194	wait_for_completion(&acct->done);	200	wait_for_completion(&acct->done);
195	cmpxchg(&acct->ns->bacct, pin, NULL);	201	cmpxchg(&acct->ns->bacct, pin, NULL);
@@ -202,6 +208,9 @@ static void close_work(struct work_struct *work) · 6 unmodified lines
202	{	208	{
203	struct bsd_acct_struct *acct = container_of(work, struct bsd_acct_struct, work);	209	struct bsd_acct_struct *acct = container_of(work, struct bsd_acct_struct, work);
204	struct file *file = acct->file;	210	struct file *file = acct->file;
		211
		212	/* We were fired by acct_pin_kill() which holds acct->lock. */
		213	acct_write_process(acct);
205	if (file->f_op->flush)	214	if (file->f_op->flush)
206	file->f_op->flush(file, NULL);	215	file->f_op->flush(file, NULL);
207	__fput_sync(file);	216	__fput_sync(file);
@@ -234,6 +243,20 @@ static int acct_on(struct filename *pathname) · 26 unmodified lines
234	return -EACCES;	243	return -EACCES;
235	}	244	}
236		245
		246	/* Exclude kernel kernel internal filesystems. */
		247	if (file_inode(file)->i_sb->s_flags & (SB_NOUSER \| SB_KERNMOUNT)) {
		248	kfree(acct);
		249	filp_close(file, NULL);
		250	return -EINVAL;
		251	}
		252
		253	/* Exclude procfs and sysfs. */
		254	if (file_inode(file)->i_sb->s_iflags & SB_I_USERNS_VISIBLE) {
		255	kfree(acct);
		256	filp_close(file, NULL);
		257	return -EINVAL;
		258	}
		259
237	if (!(file->f_mode & FMODE_CAN_WRITE)) {	260	if (!(file->f_mode & FMODE_CAN_WRITE)) {
238	kfree(acct);	261	kfree(acct);
239	filp_close(file, NULL);	262	filp_close(file, NULL);
@@ -430,13 +453,27 @@ static u32 encode_float(u64 value) · 190 unmodified lines
430	* do_exit() or when switching to a different output file.	453	* do_exit() or when switching to a different output file.
431	*/	454	*/
432		455
433	static void fill_ac(acct_t *ac)	456	static void fill_ac(struct bsd_acct_struct *acct)
434	{	457	{
435	struct pacct_struct *pacct = &current->signal->pacct;	458	struct pacct_struct *pacct = &current->signal->pacct;
		459	struct file *file = acct->file;
		460	acct_t *ac = &acct->ac;
436	u64 elapsed, run_time;	461	u64 elapsed, run_time;
437	time64_t btime;	462	time64_t btime;
438	struct tty_struct *tty;	463	struct tty_struct *tty;
439		464
		465	lockdep_assert_held(&acct->lock);
		466
		467	if (time_is_after_jiffies(acct->needcheck)) {
		468	acct->check_space = false;
		469
		470	/* Don't fill in @ac if nothing will be written. */
		471	if (!acct->active)
		472	return;
		473	} else {
		474	acct->check_space = true;
		475	}
		476
440	/*	477	/*
441	* Fill the accounting struct with the needed info as recorded	478	* Fill the accounting struct with the needed info as recorded
442	* by the different kernel functions.	479	* by the different kernel functions.
@@ -484,64 +521,61 @@ static void fill_ac(acct_t *ac) · 41 unmodified lines
484	ac->ac_majflt = encode_comp_t(pacct->ac_majflt);	521	ac->ac_majflt = encode_comp_t(pacct->ac_majflt);
485	ac->ac_exitcode = pacct->ac_exitcode;	522	ac->ac_exitcode = pacct->ac_exitcode;
486	spin_unlock_irq(&current->sighand->siglock);	523	spin_unlock_irq(&current->sighand->siglock);
487	}
488	/*
489	* do_acct_process does all actual work. Caller holds the reference to file.
490	*/
491	static void do_acct_process(struct bsd_acct_struct *acct)
492	{
493	acct_t ac;
494	unsigned long flim;
495	const struct cred *orig_cred;
496	struct file *file = acct->file;
497		524
498	/*
499	* Accounting records are not subject to resource limits.
500	*/
501	flim = rlimit(RLIMIT_FSIZE);
502	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
503	/* Perform file operations on behalf of whoever enabled accounting */
504	orig_cred = override_creds(file->f_cred);
505
506	/*
507	* First check to see if there is enough free_space to continue
508	* the process accounting system.
509	*/
510	if (!check_free_space(acct))
511	goto out;
512
513	fill_ac(&ac);
514	/* we really need to bite the bullet and change layout */	525	/* we really need to bite the bullet and change layout */
515	ac.ac_uid = from_kuid_munged(file->f_cred->user_ns, orig_cred->uid);	526	ac->ac_uid = from_kuid_munged(file->f_cred->user_ns, current_uid());
516	ac.ac_gid = from_kgid_munged(file->f_cred->user_ns, orig_cred->gid);	527	ac->ac_gid = from_kgid_munged(file->f_cred->user_ns, current_gid());
517	#if ACCT_VERSION == 1 \|\| ACCT_VERSION == 2	528	#if ACCT_VERSION == 1 \|\| ACCT_VERSION == 2
518	/* backward-compatible 16 bit fields */	529	/* backward-compatible 16 bit fields */
519	ac.ac_uid16 = ac.ac_uid;	530	ac->ac_uid16 = ac->ac_uid;
520	ac.ac_gid16 = ac.ac_gid;	531	ac->ac_gid16 = ac->ac_gid;
521	#elif ACCT_VERSION == 3	532	#elif ACCT_VERSION == 3
522	{	533	{
523	struct pid_namespace *ns = acct->ns;	534	struct pid_namespace *ns = acct->ns;
524		535
525	ac.ac_pid = task_tgid_nr_ns(current, ns);	536	ac->ac_pid = task_tgid_nr_ns(current, ns);
526	rcu_read_lock();	537	rcu_read_lock();
527	ac.ac_ppid = task_tgid_nr_ns(rcu_dereference(current->real_parent),	538	ac->ac_ppid = task_tgid_nr_ns(rcu_dereference(current->real_parent), ns);
528	ns);
529	rcu_read_unlock();	539	rcu_read_unlock();
530	}	540	}
531	#endif	541	#endif
		542	}
		543
		544	static void acct_write_process(struct bsd_acct_struct *acct)
		545	{
		546	struct file *file = acct->file;
		547	const struct cred *cred;
		548	acct_t *ac = &acct->ac;
		549
		550	/* Perform file operations on behalf of whoever enabled accounting */
		551	cred = override_creds(file->f_cred);
		552
532	/*	553	/*
533	* Get freeze protection. If the fs is frozen, just skip the write	554	* First check to see if there is enough free_space to continue
534	* as we could deadlock the system otherwise.	555	* the process accounting system. Then get freeze protection. If
		556	* the fs is frozen, just skip the write as we could deadlock
		557	* the system otherwise.
535	*/	558	*/
536	if (file_start_write_trylock(file)) {	559	if (check_free_space(acct) && file_start_write_trylock(file)) {
537	/* it's been opened O_APPEND, so position is irrelevant */	560	/* it's been opened O_APPEND, so position is irrelevant */
538	loff_t pos = 0;	561	loff_t pos = 0;
539	__kernel_write(file, &ac, sizeof(acct_t), &pos);	562	__kernel_write(file, ac, sizeof(acct_t), &pos);
540	file_end_write(file);	563	file_end_write(file);
541	}	564	}
542	out:	565
		566	revert_creds(cred);
		567	}
		568
		569	static void do_acct_process(struct bsd_acct_struct *acct)
		570	{
		571	unsigned long flim;
		572
		573	/* Accounting records are not subject to resource limits. */
		574	flim = rlimit(RLIMIT_FSIZE);
		575	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
		576	fill_ac(acct);
		577	acct_write_process(acct);
543	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;	578	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
544	revert_creds(orig_cred);
545	}	579	}
546		580
547	/**	581	/**

kernel/bpf/arena.c+1−1

@@ -39,7 +39,7 @@ · 38 unmodified lines
39	*/	39	*/
40		40
41	/* number of bytes addressable by LDX/STX insn with 16-bit 'off' field */	41	/* number of bytes addressable by LDX/STX insn with 16-bit 'off' field */
42	#define GUARD_SZ (1ull << sizeof_field(struct bpf_insn, off) * 8)	42	#define GUARD_SZ round_up(1ull << sizeof_field(struct bpf_insn, off) * 8, PAGE_SIZE << 1)
43	#define KERN_VM_SZ (SZ_4G + GUARD_SZ)	43	#define KERN_VM_SZ (SZ_4G + GUARD_SZ)
44		44
45	struct bpf_arena {	45	struct bpf_arena {

kernel/bpf/bpf_cgrp_storage.c+1−1

@@ -153,7 +153,7 @@ static struct bpf_map cgroup_storage_map_alloc(union bpf_attr attr) · 152 unmodified lines
153		153
154	static void cgroup_storage_map_free(struct bpf_map *map)	154	static void cgroup_storage_map_free(struct bpf_map *map)
155	{	155	{
156	bpf_local_storage_map_free(map, &cgroup_cache, NULL);	156	bpf_local_storage_map_free(map, &cgroup_cache, &bpf_cgrp_storage_busy);
157	}	157	}
158		158
159	/* gfp_flags is a hidden argument provided by the verifier */	159	/* gfp_flags is a hidden argument provided by the verifier */

kernel/bpf/btf.c+2−0

 	{ "rxrpc_resend", 0x10 },
 	{ "rxrpc_tq", 0x10 },
 	{ "rxrpc_client", 0x1 },
+	/* skb */
+	{"kfree_skb", 0x1000},
 	/* sunrpc */
 	{ "xs_stream_read_data", 0x1 },
 	/* ... from xprt_cong_event event class */

kernel/bpf/ringbuf.c+0−4

 		/* allow writable mapping for the consumer_pos only */
 		if (vma->vm_pgoff != 0 || vma->vm_end - vma->vm_start != PAGE_SIZE)
 			return -EPERM;
-	} else {
-		vm_flags_clear(vma, VM_MAYWRITE);
 	}
 	/* remap_vmalloc_range() checks size and offset constraints */
 	return remap_vmalloc_range(vma, rb_map->rb,
 			 * position, and the ring buffer data itself.
 			 */
 			return -EPERM;
-	} else {
-		vm_flags_clear(vma, VM_MAYWRITE);
 	}
 	/* remap_vmalloc_range() checks size and offset constraints */
 	return remap_vmalloc_range(vma, rb_map->rb, vma->vm_pgoff + RINGBUF_PGOFF);

kernel/bpf/syscall.c+22−21

 static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma)
 {
 	struct bpf_map *map = filp->private_data;
-	int err;
+	int err = 0;
 	if (!map->ops->map_mmap || !IS_ERR_OR_NULL(map->record))
 		return -ENOTSUPP;
 			err = -EACCES;
 			goto out;
 		}
+		bpf_map_write_active_inc(map);
 	}
+out:
+	mutex_unlock(&map->freeze_mutex);
+	if (err)
+		return err;
 	/* set default open/close callbacks */
 	vma->vm_ops = &bpf_map_default_vmops;
 	vma->vm_private_data = map;
 	vm_flags_clear(vma, VM_MAYEXEC);
+	/* If mapping is read-only, then disallow potentially re-mapping with
+	 * PROT_WRITE by dropping VM_MAYWRITE flag. This VM_MAYWRITE clearing
+	 * means that as far as BPF map's memory-mapped VMAs are concerned,
+	 * VM_WRITE and VM_MAYWRITE and equivalent, if one of them is set,
+	 * both should be set, so we can forget about VM_MAYWRITE and always
+	 * check just VM_WRITE
+	 */
 	if (!(vma->vm_flags & VM_WRITE))
-		/* disallow re-mapping with PROT_WRITE */
 		vm_flags_clear(vma, VM_MAYWRITE);
 	err = map->ops->map_mmap(map, vma);
-	if (err)
+	if (err) {
-		goto out;
+		if (vma->vm_flags & VM_WRITE)
+			bpf_map_write_active_dec(map);
+	}
-	if (vma->vm_flags & VM_MAYWRITE)
-		bpf_map_write_active_inc(map);
-out:
-	mutex_unlock(&map->freeze_mutex);
 	return err;
 }
 	return err;
 }
-#define MAP_LOOKUP_RETRIES 3
 int generic_map_lookup_batch(struct bpf_map *map,
 				    const union bpf_attr *attr,
 				    union bpf_attr __user *uattr)
 	void __user *values = u64_to_user_ptr(attr->batch.values);
 	void __user *keys = u64_to_user_ptr(attr->batch.keys);
 	void *buf, *buf_prevkey, *prev_key, *key, *value;
-	int err, retry = MAP_LOOKUP_RETRIES;
 	u32 value_size, cp, max_count;
+	int err;
 	if (attr->batch.elem_flags & ~BPF_F_LOCK)
 		return -EINVAL;
 		err = bpf_map_copy_value(map, key, value,
 					 attr->batch.elem_flags);
-		if (err == -ENOENT) {
+		if (err == -ENOENT)
-			if (retry) {
+			goto next_key;
-				retry--;
-				continue;
-			}
-			err = -EINTR;
-			break;
-		}
 		if (err)
 			goto free_buf;
 			goto free_buf;
 		}
+		cp++;
+next_key:
 		if (!prev_key)
 			prev_key = buf_prevkey;
 		swap(prev_key, key);
-		retry = MAP_LOOKUP_RETRIES;
-		cp++;
 		cond_resched();
 	}

kernel/bpf/verifier.c+23−8

 	struct bpf_reference_state *s;
 	s = acquire_reference_state(env, insn_idx);
+	if (!s)
+		return -ENOMEM;
 	s->type = type;
 	s->id = id;
 	s->ptr = ptr;
 	return 0;
 }
-/* Returns constant key value if possible, else negative error */
+/* Returns constant key value in `value` if possible, else negative error */
-static s64 get_constant_map_key(struct bpf_verifier_env *env,
+static int get_constant_map_key(struct bpf_verifier_env *env,
 				struct bpf_reg_state *key,
-				u32 key_size)
+				u32 key_size,
+				s64 *value)
 {
 	struct bpf_func_state *state = func(env, key);
 	struct bpf_reg_state *reg;
 	/* First handle precisely tracked STACK_ZERO */
 	for (i = off; i >= 0 && stype[i] == STACK_ZERO; i--)
 		zero_size++;
-	if (zero_size >= key_size)
+	if (zero_size >= key_size) {
+		*value = 0;
 		return 0;
+	}
 	/* Check that stack contains a scalar spill of expected size */
 	if (!is_spilled_scalar_reg(&state->stack[spi]))
 	if (err < 0)
 		return err;
-	return reg->var_off.value;
+	*value = reg->var_off.value;
+	return 0;
 }
+static bool can_elide_value_nullness(enum bpf_map_type type);
 static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
 			  struct bpf_call_arg_meta *meta,
 			  const struct bpf_func_proto *fn,
 		err = check_helper_mem_access(env, regno, key_size, BPF_READ, false, NULL);
 		if (err)
 			return err;
-		meta->const_map_key = get_constant_map_key(env, reg, key_size);
+		if (can_elide_value_nullness(meta->map_ptr->map_type)) {
-		if (meta->const_map_key < 0 && meta->const_map_key != -EOPNOTSUPP)
+			err = get_constant_map_key(env, reg, key_size, &meta->const_map_key);
-			return meta->const_map_key;
+			if (err < 0) {
+				meta->const_map_key = -1;
+				if (err == -EOPNOTSUPP)
+					err = 0;
+				else
+					return err;
+			}
+		}
 		break;
 	case ARG_PTR_TO_MAP_VALUE:
 		if (type_may_be_null(arg_type) && register_is_null(reg))

kernel/cgroup/cgroup.c+12−8

 	lockdep_assert_held(&cgroup_mutex);
 	spin_lock_irq(&css_set_lock);
-	set_bit(CGRP_KILL, &cgrp->flags);
+	cgrp->kill_seq++;
 	spin_unlock_irq(&css_set_lock);
 	css_task_iter_start(&cgrp->self, CSS_TASK_ITER_PROCS | CSS_TASK_ITER_THREADED, &it);
 		send_sig(SIGKILL, task, 0);
 	}
 	css_task_iter_end(&it);
-	spin_lock_irq(&css_set_lock);
-	clear_bit(CGRP_KILL, &cgrp->flags);
-	spin_unlock_irq(&css_set_lock);
 }
 static void cgroup_kill(struct cgroup *cgrp)
 	spin_lock_irq(&css_set_lock);
 	cset = task_css_set(current);
 	get_css_set(cset);
+	if (kargs->cgrp)
+		kargs->kill_seq = kargs->cgrp->kill_seq;
+	else
+		kargs->kill_seq = cset->dfl_cgrp->kill_seq;
 	spin_unlock_irq(&css_set_lock);
 	if (!(kargs->flags & CLONE_INTO_CGROUP)) {
 		      struct kernel_clone_args *kargs)
 	__releases(&cgroup_threadgroup_rwsem) __releases(&cgroup_mutex)
 {
+	unsigned int cgrp_kill_seq = 0;
 	unsigned long cgrp_flags = 0;
 	bool kill = false;
 	struct cgroup_subsys *ss;
 	/* init tasks are special, only link regular threads */
 	if (likely(child->pid)) {
-		if (kargs->cgrp)
+		if (kargs->cgrp) {
 			cgrp_flags = kargs->cgrp->flags;
-		else
+			cgrp_kill_seq = kargs->cgrp->kill_seq;
+		} else {
 			cgrp_flags = cset->dfl_cgrp->flags;
+			cgrp_kill_seq = cset->dfl_cgrp->kill_seq;
+		}
 		WARN_ON_ONCE(!list_empty(&child->cg_list));
 		cset->nr_tasks++;
 		 * child down right after we finished preparing it for
 		 * userspace.
 		 */
-		kill = test_bit(CGRP_KILL, &cgrp_flags);
+		kill = kargs->kill_seq != cgrp_kill_seq;
 	}
 	spin_unlock_irq(&css_set_lock);

kernel/cgroup/rstat.c+0−1

@@ -590,7 +590,6 @@ static void root_cgroup_cputime(struct cgroup_base_stat *bstat) · 589 unmodified lines
590		590
591	cputime->sum_exec_runtime += user;	591	cputime->sum_exec_runtime += user;
592	cputime->sum_exec_runtime += sys;	592	cputime->sum_exec_runtime += sys;
593	cputime->sum_exec_runtime += cpustat[CPUTIME_STEAL];
594		593
595	#ifdef CONFIG_SCHED_CORE	594	#ifdef CONFIG_SCHED_CORE
596	bstat->forceidle_sum += cpustat[CPUTIME_FORCEIDLE];	595	bstat->forceidle_sum += cpustat[CPUTIME_FORCEIDLE];

kernel/futex/core.c+3−2

 	futex_hb_waiters_dec(hb);
 }
-void __futex_queue(struct futex_q *q, struct futex_hash_bucket *hb)
+void __futex_queue(struct futex_q *q, struct futex_hash_bucket *hb,
+		   struct task_struct *task)
 {
 	int prio;
 	plist_node_init(&q->list, prio);
 	plist_add(&q->list, &hb->chain);
-	q->task = current;
+	q->task = task;
 }
 /**

kernel/futex/futex.h+8−3

 }
 extern void __futex_unqueue(struct futex_q *q);
-extern void __futex_queue(struct futex_q *q, struct futex_hash_bucket *hb);
+extern void __futex_queue(struct futex_q *q, struct futex_hash_bucket *hb,
+				struct task_struct *task);
 extern int futex_unqueue(struct futex_q *q);
 /**
  * futex_queue() - Enqueue the futex_q on the futex_hash_bucket
  * @q:	The futex_q to enqueue
  * @hb:	The destination hash bucket
+ * @task: Task queueing this futex
  *
  * The hb->lock must be held by the caller, and is released here. A call to
  * futex_queue() is typically paired with exactly one call to futex_unqueue().  The
  * or nothing if the unqueue is done as part of the wake process and the unqueue
  * state is implicit in the state of woken task (see futex_wait_requeue_pi() for
  * an example).
+ *
+ * Note that @task may be NULL, for async usage of futexes.
  */
-static inline void futex_queue(struct futex_q *q, struct futex_hash_bucket *hb)
+static inline void futex_queue(struct futex_q *q, struct futex_hash_bucket *hb,
+			       struct task_struct *task)
 	__releases(&hb->lock)
 {
-	__futex_queue(q, hb);
+	__futex_queue(q, hb, task);
 	spin_unlock(&hb->lock);
 }

kernel/futex/pi.c+1−1

@@ -982,7 +982,7 @@ retry_private: · 981 unmodified lines
982	/*	982	/*
983	* Only actually queue now that the atomic ops are done:	983	* Only actually queue now that the atomic ops are done:
984	*/	984	*/
985	__futex_queue(&q, hb);	985	__futex_queue(&q, hb, current);
986		986
987	if (trylock) {	987	if (trylock) {
988	ret = rt_mutex_futex_trylock(&q.pi_state->pi_mutex);	988	ret = rt_mutex_futex_trylock(&q.pi_state->pi_mutex);

kernel/futex/waitwake.c+2−2

@@ -349,7 +349,7 @@ void futex_wait_queue(struct futex_hash_bucket hb, struct futex_q q, · 348 unmodified lines
349	* access to the hash list and forcing another memory barrier.	349	* access to the hash list and forcing another memory barrier.
350	*/	350	*/
351	set_current_state(TASK_INTERRUPTIBLE\|TASK_FREEZABLE);	351	set_current_state(TASK_INTERRUPTIBLE\|TASK_FREEZABLE);
352	futex_queue(q, hb);	352	futex_queue(q, hb, current);
353		353
354	/* Arm the timer */	354	/* Arm the timer */
355	if (timeout)	355	if (timeout)
@@ -460,7 +460,7 @@ retry: · 104 unmodified lines
460	* next futex. Queue each futex at this moment so hb can	460	* next futex. Queue each futex at this moment so hb can
461	* be unlocked.	461	* be unlocked.
462	*/	462	*/
463	futex_queue(q, hb);	463	futex_queue(q, hb, current);
464	continue;	464	continue;
465	}	465	}
466		466

kernel/irq/Kconfig+0−4

 config GENERIC_PENDING_IRQ
 	bool
-# Deduce delayed migration from top-level interrupt chip flags
-config GENERIC_PENDING_IRQ_CHIPFLAGS
-	bool
 # Support for generic irq migrating off cpu before the cpu is offline.
 config GENERIC_IRQ_MIGRATION
 	bool

kernel/kthread.c+2−2

@@ -859,7 +859,7 @@ int kthread_affine_preferred(struct task_struct p, const struct cpumask mask) · 858 unmodified lines
859	struct kthread *kthread = to_kthread(p);	859	struct kthread *kthread = to_kthread(p);
860	cpumask_var_t affinity;	860	cpumask_var_t affinity;
861	unsigned long flags;	861	unsigned long flags;
862	int ret;	862	int ret = 0;
863		863
864	if (!wait_task_inactive(p, TASK_UNINTERRUPTIBLE) \|\| kthread->started) {	864	if (!wait_task_inactive(p, TASK_UNINTERRUPTIBLE) \|\| kthread->started) {
865	WARN_ON(1);	865	WARN_ON(1);
@@ -892,7 +892,7 @@ int kthread_affine_preferred(struct task_struct p, const struct cpumask mask) · 26 unmodified lines
892	out:	892	out:
893	free_cpumask_var(affinity);	893	free_cpumask_var(affinity);
894		894
895	return 0;	895	return ret;
896	}	896	}
897		897
898	/*	898	/*

kernel/sched/autogroup.c+2−2

@@ -150,7 +150,7 @@ void sched_autogroup_exit_task(struct task_struct *p) · 149 unmodified lines
150	* see this thread after that: we can no longer use signal->autogroup.	150	* see this thread after that: we can no longer use signal->autogroup.
151	* See the PF_EXITING check in task_wants_autogroup().	151	* See the PF_EXITING check in task_wants_autogroup().
152	*/	152	*/
153	sched_move_task(p);	153	sched_move_task(p, true);
154	}	154	}
155		155
156	static void	156	static void
@@ -182,7 +182,7 @@ autogroup_move_group(struct task_struct p, struct autogroup ag) · 25 unmodified lines
182	* sched_autogroup_exit_task().	182	* sched_autogroup_exit_task().
183	*/	183	*/
184	for_each_thread(p, t)	184	for_each_thread(p, t)
185	sched_move_task(t);	185	sched_move_task(t, true);
186		186
187	unlock_task_sighand(p, &flags);	187	unlock_task_sighand(p, &flags);
188	autogroup_kref_put(prev);	188	autogroup_kref_put(prev);

kernel/sched/core.c+7−5

 		struct task_struct *task;
 		task = container_of(node, struct task_struct, wake_q);
-		/* Task can safely be re-inserted now: */
 		node = node->next;
-		task->wake_q.next = NULL;
+		/* pairs with cmpxchg_relaxed() in __wake_q_add() */
+		WRITE_ONCE(task->wake_q.next, NULL);
+		/* Task can safely be re-inserted now. */
 		/*
 		 * wake_up_process() executes a full barrier, which pairs with
  * now. This function just updates tsk->se.cfs_rq and tsk->se.parent to reflect
  * its new group.
  */
-void sched_move_task(struct task_struct *tsk)
+void sched_move_task(struct task_struct *tsk, bool for_autogroup)
 {
 	int queued, running, queue_flags =
 		DEQUEUE_SAVE | DEQUEUE_MOVE | DEQUEUE_NOCLOCK;
 		put_prev_task(rq, tsk);
 	sched_change_group(tsk, group);
-	scx_move_task(tsk);
+	if (!for_autogroup)
+		scx_cgroup_move_task(tsk);
 	if (queued)
 		enqueue_task(rq, tsk, queue_flags);
 	struct cgroup_subsys_state *css;
 	cgroup_taskset_for_each(task, css, tset)
-		sched_move_task(task);
+		sched_move_task(task, false);
 	scx_cgroup_finish_attach();
 }

kernel/sched/debug.c+2−0

 	if (task_has_dl_policy(p)) {
 		P(dl.runtime);
 		P(dl.deadline);
+	} else if (fair_policy(p->policy)) {
+		P(se.slice);
 	}
 #ifdef CONFIG_SCHED_CLASS_EXT
 	__PS("ext.enabled", task_on_scx(p));

kernel/sched/ext.c+76−37

 	 */
 	SCX_OPS_SWITCH_PARTIAL	= 1LLU << 3,
+	/*
+	 * A migration disabled task can only execute on its current CPU. By
+	 * default, such tasks are automatically put on the CPU's local DSQ with
+	 * the default slice on enqueue. If this ops flag is set, they also go
+	 * through ops.enqueue().
+	 *
+	 * A migration disabled task never invokes ops.select_cpu() as it can
+	 * only select the current CPU. Also, p->cpus_ptr will only contain its
+	 * current CPU while p->nr_cpus_allowed keeps tracking p->user_cpus_ptr
+	 * and thus may disagree with cpumask_weight(p->cpus_ptr).
+	 */
+	SCX_OPS_ENQ_MIGRATION_DISABLED = 1LLU << 4,
 	/*
 	 * CPU cgroup support flags
 	 */
 	SCX_OPS_ALL_FLAGS	= SCX_OPS_KEEP_BUILTIN_IDLE |
 				  SCX_OPS_ENQ_LAST |
 				  SCX_OPS_ENQ_EXITING |
+				  SCX_OPS_ENQ_MIGRATION_DISABLED |
 				  SCX_OPS_SWITCH_PARTIAL |
 				  SCX_OPS_HAS_CGROUP_WEIGHT,
 };
 	/**
 	 * @update_idle: Update the idle state of a CPU
-	 * @cpu: CPU to udpate the idle state for
+	 * @cpu: CPU to update the idle state for
 	 * @idle: whether entering or exiting the idle state
 	 *
 	 * This operation is called when @rq's CPU goes or leaves the idle
 static DEFINE_STATIC_KEY_FALSE(scx_ops_enq_last);
 static DEFINE_STATIC_KEY_FALSE(scx_ops_enq_exiting);
+static DEFINE_STATIC_KEY_FALSE(scx_ops_enq_migration_disabled);
 static DEFINE_STATIC_KEY_FALSE(scx_ops_cpu_preempt);
 static DEFINE_STATIC_KEY_FALSE(scx_builtin_idle_enabled);
 /**
  * nldsq_next_task - Iterate to the next task in a non-local DSQ
- * @dsq: user dsq being interated
+ * @dsq: user dsq being iterated
  * @cur: current position, %NULL to start iteration
  * @rev: walk backwards
  *
 	    unlikely(p->flags & PF_EXITING))
 		goto local;
+	/* see %SCX_OPS_ENQ_MIGRATION_DISABLED */
+	if (!static_branch_unlikely(&scx_ops_enq_migration_disabled) &&
+	    is_migration_disabled(p))
+		goto local;
 	if (!SCX_HAS_OP(enqueue))
 		goto global;
 	/*
 	 * list_add_tail() must be used. scx_ops_bypass() depends on tasks being
-	 * appened to the runnable_list.
+	 * appended to the runnable_list.
 	 */
 	list_add_tail(&p->scx.runnable_node, &rq->scx.runnable_list);
 }
  *
  * - The BPF scheduler is bypassed while the rq is offline and we can always say
  *   no to the BPF scheduler initiated migrations while offline.
+ *
+ * The caller must ensure that @p and @rq are on different CPUs.
  */
 static bool task_can_run_on_remote_rq(struct task_struct *p, struct rq *rq,
 				      bool trigger_error)
 {
 	int cpu = cpu_of(rq);
+	SCHED_WARN_ON(task_cpu(p) == cpu);
+	/*
+	 * If @p has migration disabled, @p->cpus_ptr is updated to contain only
+	 * the pinned CPU in migrate_disable_switch() while @p is being switched
+	 * out. However, put_prev_task_scx() is called before @p->cpus_ptr is
+	 * updated and thus another CPU may see @p on a DSQ inbetween leading to
+	 * @p passing the below task_allowed_on_cpu() check while migration is
+	 * disabled.
+	 *
+	 * Test the migration disabled state first as the race window is narrow
+	 * and the BPF scheduler failing to check migration disabled state can
+	 * easily be masked if task_allowed_on_cpu() is done first.
+	 */
+	if (unlikely(is_migration_disabled(p))) {
+		if (trigger_error)
+			scx_ops_error("SCX_DSQ_LOCAL[_ON] cannot move migration disabled %s[%d] from CPU %d to %d",
+				      p->comm, p->pid, task_cpu(p), cpu);
+		return false;
+	}
 	/*
 	 * We don't require the BPF scheduler to avoid dispatching to offline
 	 * CPUs mostly for convenience but also because CPUs can go offline
 	 */
 	if (!task_allowed_on_cpu(p, cpu)) {
 		if (trigger_error)
-			scx_ops_error("SCX_DSQ_LOCAL[_ON] verdict target cpu %d not allowed for %s[%d]",
+			scx_ops_error("SCX_DSQ_LOCAL[_ON] target CPU %d not allowed for %s[%d]",
-				      cpu_of(rq), p->comm, p->pid);
+				      cpu, p->comm, p->pid);
 		return false;
 	}
-	if (unlikely(is_migration_disabled(p)))
-		return false;
 	if (!scx_rq_online(rq))
 		return false;
 	if (dst_dsq->id == SCX_DSQ_LOCAL) {
 		dst_rq = container_of(dst_dsq, struct rq, scx.local_dsq);
-		if (!task_can_run_on_remote_rq(p, dst_rq, true)) {
+		if (src_rq != dst_rq &&
+		    unlikely(!task_can_run_on_remote_rq(p, dst_rq, true))) {
 			dst_dsq = find_global_dsq(p);
 			dst_rq = src_rq;
 		}
 /*
  * A poorly behaving BPF scheduler can live-lock the system by e.g. incessantly
  * banging on the same DSQ on a large NUMA system to the point where switching
- * to the bypass mode can take a long time. Inject artifical delays while the
+ * to the bypass mode can take a long time. Inject artificial delays while the
  * bypass mode is switching to guarantee timely completion.
  */
 static void scx_ops_breather(struct rq *rq)
 {
 	struct rq *src_rq = task_rq(p);
 	struct rq *dst_rq = container_of(dst_dsq, struct rq, scx.local_dsq);
+#ifdef CONFIG_SMP
+	struct rq *locked_rq = rq;
+#endif
 	/*
 	 * We're synchronized against dequeue through DISPATCHING. As @p can't
 	}
 #ifdef CONFIG_SMP
-	if (unlikely(!task_can_run_on_remote_rq(p, dst_rq, true))) {
+	if (src_rq != dst_rq &&
+	    unlikely(!task_can_run_on_remote_rq(p, dst_rq, true))) {
 		dispatch_enqueue(find_global_dsq(p), p,
 				 enq_flags | SCX_ENQ_CLEAR_OPSS);
 		return;
 	atomic_long_set_release(&p->scx.ops_state, SCX_OPSS_NONE);
 	/* switch to @src_rq lock */
-	if (rq != src_rq) {
+	if (locked_rq != src_rq) {
-		raw_spin_rq_unlock(rq);
+		raw_spin_rq_unlock(locked_rq);
+		locked_rq = src_rq;
 		raw_spin_rq_lock(src_rq);
 	}
 		} else {
 			move_remote_task_to_local_dsq(p, enq_flags,
 						      src_rq, dst_rq);
+			/* task has been moved to dst_rq, which is now locked */
+			locked_rq = dst_rq;
 		}
 		/* if the destination CPU is idle, wake it up */
 	}
 	/* switch back to @rq lock */
-	if (rq != dst_rq) {
+	if (locked_rq != rq) {
-		raw_spin_rq_unlock(dst_rq);
+		raw_spin_rq_unlock(locked_rq);
 		raw_spin_rq_lock(rq);
 	}
 #else	/* CONFIG_SMP */
  *
  * Unless overridden by ops.core_sched_before(), @p->scx.core_sched_at is used
  * to implement the default task ordering. The older the timestamp, the higher
- * prority the task - the global FIFO ordering matching the default scheduling
+ * priority the task - the global FIFO ordering matching the default scheduling
  * behavior.
  *
  * When ops.core_sched_before() is enabled, @p->scx.core_sched_at is used to
 		curr->scx.slice = 0;
 		touch_core_sched(rq, curr);
 	} else if (SCX_HAS_OP(tick)) {
-		SCX_CALL_OP(SCX_KF_REST, tick, curr);
+		SCX_CALL_OP_TASK(SCX_KF_REST, tick, curr);
 	}
 	if (!curr->scx.slice)
 	WARN_ON_ONCE(scx_get_task_state(p) != SCX_TASK_ENABLED);
 	if (SCX_HAS_OP(disable))
-		SCX_CALL_OP(SCX_KF_REST, disable, p);
+		SCX_CALL_OP_TASK(SCX_KF_REST, disable, p);
 	scx_set_task_state(p, SCX_TASK_READY);
 }
 	}
 	if (SCX_HAS_OP(exit_task))
-		SCX_CALL_OP(SCX_KF_REST, exit_task, p, &args);
+		SCX_CALL_OP_TASK(SCX_KF_REST, exit_task, p, &args);
 	scx_set_task_state(p, SCX_TASK_NONE);
 }
 	return ops_sanitize_err("cgroup_prep_move", ret);
 }
-void scx_move_task(struct task_struct *p)
+void scx_cgroup_move_task(struct task_struct *p)
 {
 	if (!scx_cgroup_enabled)
 		return;
-	/*
-	 * We're called from sched_move_task() which handles both cgroup and
-	 * autogroup moves. Ignore the latter.
-	 *
-	 * Also ignore exiting tasks, because in the exit path tasks transition
-	 * from the autogroup to the root group, so task_group_is_autogroup()
-	 * alone isn't able to catch exiting autogroup tasks. This is safe for
-	 * cgroup_move(), because cgroup migrations never happen for PF_EXITING
-	 * tasks.
-	 */
-	if (task_group_is_autogroup(task_group(p)) || (p->flags & PF_EXITING))
-		return;
 	/*
 	 * @p must have ops.cgroup_prep_move() called on it and thus
 	 * cgrp_moving_from set.
 	cgroup_warned_missing_idle = false;
 	/*
-	 * scx_tg_on/offline() are excluded thorugh scx_cgroup_rwsem. If we walk
+	 * scx_tg_on/offline() are excluded through scx_cgroup_rwsem. If we walk
 	 * cgroups and init, all online cgroups are initialized.
 	 */
 	rcu_read_lock();
 		static_branch_disable(&scx_has_op[i]);
 	static_branch_disable(&scx_ops_enq_last);
 	static_branch_disable(&scx_ops_enq_exiting);
+	static_branch_disable(&scx_ops_enq_migration_disabled);
 	static_branch_disable(&scx_ops_cpu_preempt);
 	static_branch_disable(&scx_builtin_idle_enabled);
 	synchronize_rcu();
 		  scx_get_task_state(p), p->scx.flags & ~SCX_TASK_STATE_MASK,
 		  p->scx.dsq_flags, ops_state & SCX_OPSS_STATE_MASK,
 		  ops_state >> SCX_OPSS_QSEQ_SHIFT);
-	dump_line(s, "      sticky/holding_cpu=%d/%d dsq_id=%s dsq_vtime=%llu slice=%llu",
+	dump_line(s, "      sticky/holding_cpu=%d/%d dsq_id=%s",
-		  p->scx.sticky_cpu, p->scx.holding_cpu, dsq_id_buf,
+		  p->scx.sticky_cpu, p->scx.holding_cpu, dsq_id_buf);
-		  p->scx.dsq_vtime, p->scx.slice);
+	dump_line(s, "      dsq_vtime=%llu slice=%llu weight=%u",
+		  p->scx.dsq_vtime, p->scx.slice, p->scx.weight);
 	dump_line(s, "      cpus=%*pb", cpumask_pr_args(p->cpus_ptr));
 	if (SCX_HAS_OP(dump_task)) {
 	if (ops->flags & SCX_OPS_ENQ_EXITING)
 		static_branch_enable(&scx_ops_enq_exiting);
+	if (ops->flags & SCX_OPS_ENQ_MIGRATION_DISABLED)
+		static_branch_enable(&scx_ops_enq_migration_disabled);
 	if (scx_ops.cpu_acquire || scx_ops.cpu_release)
 		static_branch_enable(&scx_ops_cpu_preempt);

kernel/sched/ext.h+2−2

kernel/sched/fair.c+19−0

@@ -5385,6 +5385,15 @@ static __always_inline void return_cfs_rq_runtime(struct cfs_rq *cfs_rq); · 5384 unmodified lines
5385	static void set_delayed(struct sched_entity *se)	5385	static void set_delayed(struct sched_entity *se)
5386	{	5386	{
5387	se->sched_delayed = 1;	5387	se->sched_delayed = 1;
		5388
		5389	/*
		5390	* Delayed se of cfs_rq have no tasks queued on them.
		5391	* Do not adjust h_nr_runnable since dequeue_entities()
		5392	* will account it for blocked tasks.
		5393	*/
		5394	if (!entity_is_task(se))
		5395	return;
		5396
5388	for_each_sched_entity(se) {	5397	for_each_sched_entity(se) {
5389	struct cfs_rq *cfs_rq = cfs_rq_of(se);	5398	struct cfs_rq *cfs_rq = cfs_rq_of(se);
5390		5399
@@ -5397,6 +5406,16 @@ static void set_delayed(struct sched_entity *se) · 6 unmodified lines
5397	static void clear_delayed(struct sched_entity *se)	5406	static void clear_delayed(struct sched_entity *se)
5398	{	5407	{
5399	se->sched_delayed = 0;	5408	se->sched_delayed = 0;
		5409
		5410	/*
		5411	* Delayed se of cfs_rq have no tasks queued on them.
		5412	* Do not adjust h_nr_runnable since a dequeue has
		5413	* already accounted for it or an enqueue of a task
		5414	* below it will account for it in enqueue_task_fair().
		5415	*/
		5416	if (!entity_is_task(se))
		5417	return;
		5418
5400	for_each_sched_entity(se) {	5419	for_each_sched_entity(se) {
5401	struct cfs_rq *cfs_rq = cfs_rq_of(se);	5420	struct cfs_rq *cfs_rq = cfs_rq_of(se);
5402		5421

kernel/sched/sched.h+1−1

@@ -572,7 +572,7 @@ extern void sched_online_group(struct task_group *tg, · 571 unmodified lines
572	extern void sched_destroy_group(struct task_group *tg);	572	extern void sched_destroy_group(struct task_group *tg);
573	extern void sched_release_group(struct task_group *tg);	573	extern void sched_release_group(struct task_group *tg);
574		574
575	extern void sched_move_task(struct task_struct *tsk);	575	extern void sched_move_task(struct task_struct *tsk, bool for_autogroup);
576		576
577	#ifdef CONFIG_FAIR_GROUP_SCHED	577	#ifdef CONFIG_FAIR_GROUP_SCHED
578	extern int sched_group_set_shares(struct task_group *tg, unsigned long shares);	578	extern int sched_group_set_shares(struct task_group *tg, unsigned long shares);

kernel/seccomp.c+12−0

 	if (WARN_ON_ONCE(!fprog))
 		return false;
+	/* Our single exception to filtering. */
+#ifdef __NR_uretprobe
+#ifdef SECCOMP_ARCH_COMPAT
+	if (sd->arch == SECCOMP_ARCH_NATIVE)
+#endif
+		if (sd->nr == __NR_uretprobe)
+			return true;
+#endif
 	for (pc = 0; pc < fprog->len; pc++) {
 		struct sock_filter *insn = &fprog->filter[pc];
 		u16 code = insn->code;
  */
 static const int mode1_syscalls[] = {
 	__NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
+#ifdef __NR_uretprobe
+	__NR_uretprobe,
+#endif
 	-1, /* negative terminated */
 };

kernel/time/clocksource.c+6−3

 	cpumask_clear(&cpus_ahead);
 	cpumask_clear(&cpus_behind);
 	cpus_read_lock();
-	preempt_disable();
+	migrate_disable();
 	clocksource_verify_choose_cpus();
 	if (cpumask_empty(&cpus_chosen)) {
-		preempt_enable();
+		migrate_enable();
 		cpus_read_unlock();
 		pr_warn("Not enough CPUs to check clocksource '%s'.\n", cs->name);
 		return;
 	}
 	testcpu = smp_processor_id();
-	pr_warn("Checking clocksource %s synchronization from CPU %d to CPUs %*pbl.\n", cs->name, testcpu, cpumask_pr_args(&cpus_chosen));
+	pr_info("Checking clocksource %s synchronization from CPU %d to CPUs %*pbl.\n",
+		cs->name, testcpu, cpumask_pr_args(&cpus_chosen));
+	preempt_disable();
 	for_each_cpu(cpu, &cpus_chosen) {
 		if (cpu == testcpu)
 			continue;
 			cs_nsec_min = cs_nsec;
 	}
 	preempt_enable();
+	migrate_enable();
 	cpus_read_unlock();
 	if (!cpumask_empty(&cpus_ahead))
 		pr_warn("        CPUs %*pbl ahead of CPU %d for clocksource %s.\n",

kernel/time/hrtimer.c+94−31

@@ -58,6 +58,8 @@ · 57 unmodified lines
58	#define HRTIMER_ACTIVE_SOFT (HRTIMER_ACTIVE_HARD << MASK_SHIFT)	58	#define HRTIMER_ACTIVE_SOFT (HRTIMER_ACTIVE_HARD << MASK_SHIFT)
59	#define HRTIMER_ACTIVE_ALL (HRTIMER_ACTIVE_SOFT \| HRTIMER_ACTIVE_HARD)	59	#define HRTIMER_ACTIVE_ALL (HRTIMER_ACTIVE_SOFT \| HRTIMER_ACTIVE_HARD)
60		60
		61	static void retrigger_next_event(void *arg);
		62
61	/*	63	/*
62	* The timer bases:	64	* The timer bases:
63	*	65	*
@@ -111,7 +113,8 @@ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) = · 47 unmodified lines
111	.clockid = CLOCK_TAI,	113	.clockid = CLOCK_TAI,
112	.get_time = &ktime_get_clocktai,	114	.get_time = &ktime_get_clocktai,
113	},	115	},
114	}	116	},
		117	.csd = CSD_INIT(retrigger_next_event, NULL)
115	};	118	};
116		119
117	static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = {	120	static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = {
@@ -124,6 +127,14 @@ static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = { · 6 unmodified lines
124	[CLOCK_TAI] = HRTIMER_BASE_TAI,	127	[CLOCK_TAI] = HRTIMER_BASE_TAI,
125	};	128	};
126		129
		130	static inline bool hrtimer_base_is_online(struct hrtimer_cpu_base *base)
		131	{
		132	if (!IS_ENABLED(CONFIG_HOTPLUG_CPU))
		133	return true;
		134	else
		135	return likely(base->online);
		136	}
		137
127	/*	138	/*
128	* Functions and macros which are different for UP/SMP systems are kept in a	139	* Functions and macros which are different for UP/SMP systems are kept in a
129	* single place	140	* single place
@@ -145,11 +156,6 @@ static struct hrtimer_cpu_base migration_cpu_base = { · 15 unmodified lines
145		156
146	#define migration_base migration_cpu_base.clock_base[0]	157	#define migration_base migration_cpu_base.clock_base[0]
147		158
148	static inline bool is_migration_base(struct hrtimer_clock_base *base)
149	{
150	return base == &migration_base;
151	}
152
153	/*	159	/*
154	* We are using hashed locking: holding per_cpu(hrtimer_bases)[n].lock	160	* We are using hashed locking: holding per_cpu(hrtimer_bases)[n].lock
155	* means that all timers which are tied to this base via timer->base are	161	* means that all timers which are tied to this base via timer->base are
@@ -183,27 +189,54 @@ struct hrtimer_clock_base lock_hrtimer_base(const struct hrtimer timer, · 27 unmodified lines
183	}	189	}
184		190
185	/*	191	/*
186	* We do not migrate the timer when it is expiring before the next	192	* Check if the elected target is suitable considering its next
187	* event on the target cpu. When high resolution is enabled, we cannot	193	* event and the hotplug state of the current CPU.
188	* reprogram the target cpu hardware and we would cause it to fire	194	*
189	* late. To keep it simple, we handle the high resolution enabled and	195	* If the elected target is remote and its next event is after the timer
190	* disabled case similar.	196	* to queue, then a remote reprogram is necessary. However there is no
		197	* guarantee the IPI handling the operation would arrive in time to meet
		198	* the high resolution deadline. In this case the local CPU becomes a
		199	* preferred target, unless it is offline.
		200	*
		201	* High and low resolution modes are handled the same way for simplicity.
191	*	202	*
192	* Called with cpu_base->lock of target cpu held.	203	* Called with cpu_base->lock of target cpu held.
193	*/	204	*/
194	static int	205	static bool hrtimer_suitable_target(struct hrtimer timer, struct hrtimer_clock_base new_base,
195	hrtimer_check_target(struct hrtimer timer, struct hrtimer_clock_base new_base)	206	struct hrtimer_cpu_base *new_cpu_base,
		207	struct hrtimer_cpu_base *this_cpu_base)
196	{	208	{
197	ktime_t expires;	209	ktime_t expires;
198		210
		211	/*
		212	* The local CPU clockevent can be reprogrammed. Also get_target_base()
		213	* guarantees it is online.
		214	*/
		215	if (new_cpu_base == this_cpu_base)
		216	return true;
		217
		218	/*
		219	* The offline local CPU can't be the default target if the
		220	* next remote target event is after this timer. Keep the
		221	* elected new base. An IPI will we issued to reprogram
		222	* it as a last resort.
		223	*/
		224	if (!hrtimer_base_is_online(this_cpu_base))
		225	return true;
		226
199	expires = ktime_sub(hrtimer_get_expires(timer), new_base->offset);	227	expires = ktime_sub(hrtimer_get_expires(timer), new_base->offset);
200	return expires < new_base->cpu_base->expires_next;	228
		229	return expires >= new_base->cpu_base->expires_next;
201	}	230	}
202		231
203	static inline	232	static inline struct hrtimer_cpu_base get_target_base(struct hrtimer_cpu_base base, int pinned)
204	struct hrtimer_cpu_base get_target_base(struct hrtimer_cpu_base base,
205	int pinned)
206	{	233	{
		234	if (!hrtimer_base_is_online(base)) {
		235	int cpu = cpumask_any_and(cpu_online_mask, housekeeping_cpumask(HK_TYPE_TIMER));
		236
		237	return &per_cpu(hrtimer_bases, cpu);
		238	}
		239
207	#if defined(CONFIG_SMP) && defined(CONFIG_NO_HZ_COMMON)	240	#if defined(CONFIG_SMP) && defined(CONFIG_NO_HZ_COMMON)
208	if (static_branch_likely(&timers_migration_enabled) && !pinned)	241	if (static_branch_likely(&timers_migration_enabled) && !pinned)
209	return &per_cpu(hrtimer_bases, get_nohz_timer_target());	242	return &per_cpu(hrtimer_bases, get_nohz_timer_target());
@@ -254,8 +287,8 @@ again: · 44 unmodified lines
254	raw_spin_unlock(&base->cpu_base->lock);	287	raw_spin_unlock(&base->cpu_base->lock);
255	raw_spin_lock(&new_base->cpu_base->lock);	288	raw_spin_lock(&new_base->cpu_base->lock);
256		289
257	if (new_cpu_base != this_cpu_base &&	290	if (!hrtimer_suitable_target(timer, new_base, new_cpu_base,
258	hrtimer_check_target(timer, new_base)) {	291	this_cpu_base)) {
259	raw_spin_unlock(&new_base->cpu_base->lock);	292	raw_spin_unlock(&new_base->cpu_base->lock);
260	raw_spin_lock(&base->cpu_base->lock);	293	raw_spin_lock(&base->cpu_base->lock);
261	new_cpu_base = this_cpu_base;	294	new_cpu_base = this_cpu_base;
@@ -264,8 +297,7 @@ again: · 2 unmodified lines
264	}	297	}
265	WRITE_ONCE(timer->base, new_base);	298	WRITE_ONCE(timer->base, new_base);
266	} else {	299	} else {
267	if (new_cpu_base != this_cpu_base &&	300	if (!hrtimer_suitable_target(timer, new_base, new_cpu_base, this_cpu_base)) {
268	hrtimer_check_target(timer, new_base)) {
269	new_cpu_base = this_cpu_base;	301	new_cpu_base = this_cpu_base;
270	goto again;	302	goto again;
271	}	303	}
@@ -275,11 +307,6 @@ again: · 3 unmodified lines
275		307
276	#else /* CONFIG_SMP */	308	#else /* CONFIG_SMP */
277		309
278	static inline bool is_migration_base(struct hrtimer_clock_base *base)
279	{
280	return false;
281	}
282
283	static inline struct hrtimer_clock_base *	310	static inline struct hrtimer_clock_base *
284	lock_hrtimer_base(const struct hrtimer timer, unsigned long flags)	311	lock_hrtimer_base(const struct hrtimer timer, unsigned long flags)
285	__acquires(&timer->base->cpu_base->lock)	312	__acquires(&timer->base->cpu_base->lock)
@@ -716,8 +743,6 @@ static inline int hrtimer_is_hres_enabled(void) · 430 unmodified lines
716	return hrtimer_hres_enabled;	743	return hrtimer_hres_enabled;
717	}	744	}
718		745
719	static void retrigger_next_event(void *arg);
720
721	/*	746	/*
722	* Switch to high resolution mode	747	* Switch to high resolution mode
723	*/	748	*/
@@ -1205,6 +1230,7 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, · 481 unmodified lines
1205	u64 delta_ns, const enum hrtimer_mode mode,	1230	u64 delta_ns, const enum hrtimer_mode mode,
1206	struct hrtimer_clock_base *base)	1231	struct hrtimer_clock_base *base)
1207	{	1232	{
		1233	struct hrtimer_cpu_base *this_cpu_base = this_cpu_ptr(&hrtimer_bases);
1208	struct hrtimer_clock_base *new_base;	1234	struct hrtimer_clock_base *new_base;
1209	bool force_local, first;	1235	bool force_local, first;
1210		1236
@@ -1216,9 +1242,15 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, · 5 unmodified lines
1216	* and enforce reprogramming after it is queued no matter whether	1242	* and enforce reprogramming after it is queued no matter whether
1217	* it is the new first expiring timer again or not.	1243	* it is the new first expiring timer again or not.
1218	*/	1244	*/
1219	force_local = base->cpu_base == this_cpu_ptr(&hrtimer_bases);	1245	force_local = base->cpu_base == this_cpu_base;
1220	force_local &= base->cpu_base->next_timer == timer;	1246	force_local &= base->cpu_base->next_timer == timer;
1221		1247
		1248	/*
		1249	* Don't force local queuing if this enqueue happens on a unplugged
		1250	* CPU after hrtimer_cpu_dying() has been invoked.
		1251	*/
		1252	force_local &= this_cpu_base->online;
		1253
1222	/*	1254	/*
1223	* Remove an active timer from the queue. In case it is not queued	1255	* Remove an active timer from the queue. In case it is not queued
1224	* on the current CPU, make sure that remove_hrtimer() updates the	1256	* on the current CPU, make sure that remove_hrtimer() updates the
@@ -1248,8 +1280,27 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, · 23 unmodified lines
1248	}	1280	}
1249		1281
1250	first = enqueue_hrtimer(timer, new_base, mode);	1282	first = enqueue_hrtimer(timer, new_base, mode);
1251	if (!force_local)	1283	if (!force_local) {
1252	return first;	1284	/*
		1285	* If the current CPU base is online, then the timer is
		1286	* never queued on a remote CPU if it would be the first
		1287	* expiring timer there.
		1288	*/
		1289	if (hrtimer_base_is_online(this_cpu_base))
		1290	return first;
		1291
		1292	/*
		1293	* Timer was enqueued remote because the current base is
		1294	* already offline. If the timer is the first to expire,
		1295	* kick the remote CPU to reprogram the clock event.
		1296	*/
		1297	if (first) {
		1298	struct hrtimer_cpu_base *new_cpu_base = new_base->cpu_base;
		1299
		1300	smp_call_function_single_async(new_cpu_base->cpu, &new_cpu_base->csd);
		1301	}
		1302	return 0;
		1303	}
1253		1304
1254	/*	1305	/*
1255	* Timer was forced to stay on the current CPU to avoid	1306	* Timer was forced to stay on the current CPU to avoid
@@ -1370,6 +1421,18 @@ static void hrtimer_sync_wait_running(struct hrtimer_cpu_base *cpu_base, · 114 unmodified lines
1370	}	1421	}
1371	}	1422	}
1372		1423
		1424	#ifdef CONFIG_SMP
		1425	static __always_inline bool is_migration_base(struct hrtimer_clock_base *base)
		1426	{
		1427	return base == &migration_base;
		1428	}
		1429	#else
		1430	static __always_inline bool is_migration_base(struct hrtimer_clock_base *base)
		1431	{
		1432	return false;
		1433	}
		1434	#endif
		1435
1373	/*	1436	/*
1374	* This function is called on PREEMPT_RT kernels when the fast path	1437	* This function is called on PREEMPT_RT kernels when the fast path
1375	* deletion of a timer failed because the timer callback function was	1438	* deletion of a timer failed because the timer callback function was

kernel/time/timer_migration.c+9−1

@@ -1675,6 +1675,9 @@ static int tmigr_setup_groups(unsigned int cpu, unsigned int node) · 1674 unmodified lines
1675		1675
1676	} while (i < tmigr_hierarchy_levels);	1676	} while (i < tmigr_hierarchy_levels);
1677		1677
		1678	/* Assert single root */
		1679	WARN_ON_ONCE(!err && !group->parent && !list_is_singular(&tmigr_level_list[top]));
		1680
1678	while (i > 0) {	1681	while (i > 0) {
1679	group = stack[--i];	1682	group = stack[--i];
1680		1683
@@ -1716,7 +1719,12 @@ static int tmigr_setup_groups(unsigned int cpu, unsigned int node) · 35 unmodified lines
1716	WARN_ON_ONCE(top == 0);	1719	WARN_ON_ONCE(top == 0);
1717		1720
1718	lvllist = &tmigr_level_list[top];	1721	lvllist = &tmigr_level_list[top];
1719	if (group->num_children == 1 && list_is_singular(lvllist)) {	1722
		1723	/*
		1724	* Newly created root level should have accounted the upcoming
		1725	* CPU's child group and pre-accounted the old root.
		1726	*/
		1727	if (group->num_children == 2 && list_is_singular(lvllist)) {
1720	/*	1728	/*
1721	* The target CPU must never do the prepare work, except	1729	* The target CPU must never do the prepare work, except
1722	* on early boot when the boot CPU is the target. Otherwise	1730	* on early boot when the boot CPU is the target. Otherwise

kernel/trace/ring_buffer.c+26−2

  * must be the same.
  */
 static bool rb_meta_valid(struct ring_buffer_meta *meta, int cpu,
-			  struct trace_buffer *buffer, int nr_pages)
+			  struct trace_buffer *buffer, int nr_pages,
+			  unsigned long *subbuf_mask)
 {
 	int subbuf_size = PAGE_SIZE;
 	struct buffer_data_page *subbuf;
 	unsigned long buffers_end;
 	int i;
+	if (!subbuf_mask)
+		return false;
 	/* Check the meta magic and meta struct size */
 	if (meta->magic != RING_BUFFER_META_MAGIC ||
 	    meta->struct_size != sizeof(*meta)) {
 	subbuf = rb_subbufs_from_meta(meta);
+	bitmap_clear(subbuf_mask, 0, meta->nr_subbufs);
 	/* Is the meta buffers and the subbufs themselves have correct data? */
 	for (i = 0; i < meta->nr_subbufs; i++) {
 		if (meta->buffers[i] < 0 ||
 			return false;
 		}
+		if (test_bit(meta->buffers[i], subbuf_mask)) {
+			pr_info("Ring buffer boot meta [%d] array has duplicates\n", cpu);
+			return false;
+		}
+		set_bit(meta->buffers[i], subbuf_mask);
 		subbuf = (void *)subbuf + subbuf_size;
 	}
 				cpu_buffer->cpu);
 			goto invalid;
 		}
+		/* If the buffer has content, update pages_touched */
+		if (ret)
+			local_inc(&cpu_buffer->pages_touched);
 		entries += ret;
 		entry_bytes += local_read(&head_page->page->commit);
 		local_set(&cpu_buffer->head_page->entries, ret);
 static void rb_range_meta_init(struct trace_buffer *buffer, int nr_pages)
 {
 	struct ring_buffer_meta *meta;
+	unsigned long *subbuf_mask;
 	unsigned long delta;
 	void *subbuf;
 	int cpu;
 	int i;
+	/* Create a mask to test the subbuf array */
+	subbuf_mask = bitmap_alloc(nr_pages + 1, GFP_KERNEL);
+	/* If subbuf_mask fails to allocate, then rb_meta_valid() will return false */
 	for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
 		void *next_meta;
 		meta = rb_range_meta(buffer, nr_pages, cpu);
-		if (rb_meta_valid(meta, cpu, buffer, nr_pages)) {
+		if (rb_meta_valid(meta, cpu, buffer, nr_pages, subbuf_mask)) {
 			/* Make the mappings match the current address */
 			subbuf = rb_subbufs_from_meta(meta);
 			delta = (unsigned long)subbuf - meta->first_buffer;
 			subbuf += meta->subbuf_size;
 		}
 	}
+	bitmap_free(subbuf_mask);
 }
 static void *rbm_start(struct seq_file *m, loff_t *pos)
 		kfree(cpu_buffer->subbuf_ids);
 		cpu_buffer->subbuf_ids = NULL;
 		rb_free_meta_page(cpu_buffer);
+		atomic_dec(&cpu_buffer->resize_disabled);
 	}
 unlock:

kernel/trace/trace.c+5−7

 ssize_t tracing_resize_ring_buffer(struct trace_array *tr,
 				  unsigned long size, int cpu_id)
 {
-	int ret;
 	guard(mutex)(&trace_types_lock);
 	if (cpu_id != RING_BUFFER_ALL_CPUS) {
 			return -EINVAL;
 	}
-	ret = __tracing_resize_ring_buffer(tr, size, cpu_id);
+	return __tracing_resize_ring_buffer(tr, size, cpu_id);
-	if (ret < 0)
-		ret = -ENOMEM;
-	return ret;
 }
 static void update_last_data(struct trace_array *tr)
 	struct trace_iterator *iter = &info->iter;
 	int ret = 0;
+	/* Currently the boot mapped buffer is not supported for mmap */
+	if (iter->tr->flags & TRACE_ARRAY_FL_BOOT)
+		return -ENODEV;
 	ret = get_snapshot_map(iter->tr);
 	if (ret)
 		return ret;

kernel/trace/trace_functions_graph.c+1−1

@@ -198,7 +198,7 @@ int trace_graph_entry(struct ftrace_graph_ent *trace, · 197 unmodified lines
198	* returning from the function.	198	* returning from the function.
199	*/	199	*/
200	if (ftrace_graph_notrace_addr(trace->func)) {	200	if (ftrace_graph_notrace_addr(trace->func)) {
201	*task_var \|= TRACE_GRAPH_NOTRACE_BIT;	201	*task_var \|= TRACE_GRAPH_NOTRACE;
202	/*	202	/*
203	* Need to return 1 to have the return called	203	* Need to return 1 to have the return called
204	* that will clear the NOTRACE bit.	204	* that will clear the NOTRACE bit.

kernel/workqueue.c+6−6

 			}
 		}
-		/*
-		 * Put the reference grabbed by send_mayday().  @pool won't
-		 * go away while we're still attached to it.
-		 */
-		put_pwq(pwq);
 		/*
 		 * Leave this pool. Notify regular workers; otherwise, we end up
 		 * with 0 concurrency and stalling the execution.
 		worker_detach_from_pool(rescuer);

10 more lines aren’t shown here.

lib/iov_iter.c+2−1

This diff is large: its 17 lines aren’t shown here.

lib/stackinit_kunit.c+4−2

This diff is large: its 25 lines aren’t shown here.

lib/test_xarray.c+8−7

This diff is large: its 49 lines aren’t shown here.

mm/hugetlb.c+1−1

This diff is large: its 9 lines aren’t shown here.

mm/kasan/report.c+33−1

This diff is large: its 55 lines aren’t shown here.

mm/madvise.c+10−1

This diff is large: its 18 lines aren’t shown here.

mm/memcontrol.c+1−0

This diff is large: its 8 lines aren’t shown here.

mm/memory.c+14−3

This diff is large: its 43 lines aren’t shown here.

mm/migrate_device.c+4−9

This diff is large: its 25 lines aren’t shown here.

mm/zswap.c+16−19

This diff is large: its 91 lines aren’t shown here.

net/ax25/af_ax25.c+11−0

This diff is large: its 25 lines aren’t shown here.

net/batman-adv/bat_v.c+0−2

This diff is large: its 9 lines aren’t shown here.

net/batman-adv/bat_v_elp.c+86−36

This diff is large: its 246 lines aren’t shown here.

net/batman-adv/bat_v_elp.h+0−2

This diff is large: its 15 lines aren’t shown here.

net/batman-adv/translation-table.c+5−7

This diff is large: its 29 lines aren’t shown here.

net/batman-adv/types.h+0−3

This diff is large: its 10 lines aren’t shown here.

net/bluetooth/hidp/Kconfig+1−2

This diff is large: its 10 lines aren’t shown here.

net/bluetooth/l2cap_core.c+79−90

This diff is large: its 538 lines aren’t shown here.

net/bluetooth/l2cap_sock.c+7−8

This diff is large: its 40 lines aren’t shown here.

net/bpf/test_run.c+1−4

This diff is large: its 14 lines aren’t shown here.

net/can/j1939/socket.c+2−2

This diff is large: its 18 lines aren’t shown here.

net/can/j1939/transport.c+3−2

This diff is large: its 12 lines aren’t shown here.

net/core/bpf_sk_storage.c+1−12

This diff is large: its 27 lines aren’t shown here.

net/core/dev.c+111−11

This diff is large: its 195 lines aren’t shown here.

net/core/drop_monitor.c+14−15

This diff is large: its 65 lines aren’t shown here.

net/core/fib_rules.c+13−11

This diff is large: its 71 lines aren’t shown here.

net/core/flow_dissector.c+40−30

This diff is large: its 129 lines aren’t shown here.

net/core/gro.c+0−3

This diff is large: its 10 lines aren’t shown here.

net/core/neighbour.c+6−2

This diff is large: its 27 lines aren’t shown here.

net/core/net_namespace.c+4−4

This diff is large: its 36 lines aren’t shown here.

net/core/rtnetlink.c+1−0

This diff is large: its 8 lines aren’t shown here.

net/core/skbuff.c+10−100

This diff is large: its 169 lines aren’t shown here.

net/core/skmsg.c+7−0

This diff is large: its 21 lines aren’t shown here.

net/core/sock_map.c+7−1

This diff is large: its 22 lines aren’t shown here.

net/ethtool/common.c+5−0

This diff is large: its 12 lines aren’t shown here.

net/ethtool/common.h+2−0

This diff is large: its 16 lines aren’t shown here.

net/ethtool/ioctl.c+1−1

This diff is large: its 9 lines aren’t shown here.

net/ethtool/rss.c+2−1

This diff is large: its 17 lines aren’t shown here.

net/ethtool/strset.c+5−0

This diff is large: its 12 lines aren’t shown here.

net/ethtool/tsconfig.c+23−10

This diff is large: its 76 lines aren’t shown here.

net/ipv4/arp.c+4−2

This diff is large: its 23 lines aren’t shown here.

net/ipv4/devinet.c+2−1

This diff is large: its 13 lines aren’t shown here.

net/ipv4/icmp.c+17−14

This diff is large: its 117 lines aren’t shown here.

net/ipv4/route.c+21−9

This diff is large: its 82 lines aren’t shown here.

net/ipv4/tcp.c+24−5

This diff is large: its 58 lines aren’t shown here.

net/ipv4/tcp_bpf.c+36−0

This diff is large: its 43 lines aren’t shown here.

net/ipv4/tcp_fastopen.c+2−2

This diff is large: its 18 lines aren’t shown here.

net/ipv4/tcp_input.c+13−7

This diff is large: its 55 lines aren’t shown here.

net/ipv4/tcp_ipv4.c+1−1

This diff is large: its 9 lines aren’t shown here.

net/ipv4/udp.c+2−2

This diff is large: its 12 lines aren’t shown here.

net/ipv6/icmp.c+23−19

This diff is large: its 160 lines aren’t shown here.

net/ipv6/ioam6_iptunnel.c+9−5

This diff is large: its 40 lines aren’t shown here.

net/ipv6/ip6_input.c+9−5

This diff is large: its 29 lines aren’t shown here.

net/ipv6/mcast.c+25−20

This diff is large: its 113 lines aren’t shown here.

net/ipv6/ndisc.c+13−11

This diff is large: its 77 lines aren’t shown here.

net/ipv6/route.c+6−1

This diff is large: its 20 lines aren’t shown here.

net/ipv6/rpl_iptunnel.c+10−5

This diff is large: its 40 lines aren’t shown here.

net/ipv6/seg6_iptunnel.c+10−5

This diff is large: its 40 lines aren’t shown here.

net/ipv6/udp.c+2−2

This diff is large: its 12 lines aren’t shown here.

net/netfilter/nf_flow_table_ip.c+2−6

This diff is large: its 24 lines aren’t shown here.

net/openvswitch/datapath.c+9−3

This diff is large: its 36 lines aren’t shown here.

net/rose/af_rose.c+16−8

This diff is large: its 54 lines aren’t shown here.

net/rxrpc/ar-internal.h+4−5

This diff is large: its 37 lines aren’t shown here.

net/rxrpc/call_object.c+2−4

This diff is large: its 28 lines aren’t shown here.

net/rxrpc/conn_event.c+11−10

This diff is large: its 44 lines aren’t shown here.

net/rxrpc/conn_object.c+1−0

This diff is large: its 8 lines aren’t shown here.

net/rxrpc/input.c+10−2

This diff is large: its 30 lines aren’t shown here.

net/rxrpc/output.c+35−15

This diff is large: its 138 lines aren’t shown here.

net/rxrpc/peer_event.c+7−0

This diff is large: its 14 lines aren’t shown here.

net/rxrpc/rxkad.c+5−8

This diff is large: its 49 lines aren’t shown here.

net/rxrpc/sendmsg.c+2−4

This diff is large: its 27 lines aren’t shown here.

net/rxrpc/txbuf.c+10−27

This diff is large: its 74 lines aren’t shown here.

net/sched/cls_api.c+1−1

This diff is large: its 9 lines aren’t shown here.

net/sched/sch_fifo.c+3−0

This diff is large: its 10 lines aren’t shown here.

net/sched/sch_netem.c+1−1

This diff is large: its 11 lines aren’t shown here.

net/sctp/stream.c+1−1

This diff is large: its 9 lines aren’t shown here.

net/socket.c+5−0

This diff is large: its 12 lines aren’t shown here.

net/strparser/strparser.c+9−2

This diff is large: its 32 lines aren’t shown here.

net/vmw_vsock/af_vsock.c+10−1

This diff is large: its 31 lines aren’t shown here.

net/vmw_vsock/virtio_transport.c+7−3

This diff is large: its 24 lines aren’t shown here.

net/vmw_vsock/vsock_bpf.c+1−1

This diff is large: its 9 lines aren’t shown here.

rust/Makefile+3−2

This diff is large: its 26 lines aren’t shown here.

rust/bindings/bindings_helper.h+1−0

This diff is large: its 8 lines aren’t shown here.

rust/kernel/faux.rs+67−0

This diff is large: its 68 lines aren’t shown here.

rust/kernel/init.rs+1−1

This diff is large: its 9 lines aren’t shown here.

rust/kernel/lib.rs+1−0

This diff is large: its 8 lines aren’t shown here.

rust/kernel/rbtree.rs+1−1

This diff is large: its 9 lines aren’t shown here.

samples/hid/Makefile+7−6

This diff is large: its 40 lines aren’t shown here.

samples/rust/Kconfig+10−0

This diff is large: its 17 lines aren’t shown here.

samples/rust/Makefile+1−0

This diff is large: its 8 lines aren’t shown here.

samples/rust/rust_driver_faux.rs+29−0

This diff is large: its 30 lines aren’t shown here.

scripts/Makefile.extrawarn+9−6

This diff is large: its 43 lines aren’t shown here.

scripts/Makefile.lib+1−1

This diff is large: its 9 lines aren’t shown here.

scripts/generate_rust_target.rs+18−0

This diff is large: its 39 lines aren’t shown here.

scripts/mod/modpost.c+37−2

This diff is large: its 74 lines aren’t shown here.

scripts/mod/modpost.h+6−0

This diff is large: its 27 lines aren’t shown here.

scripts/module.lds.S+1−0

This diff is large: its 8 lines aren’t shown here.

scripts/package/install-extmod-build+2−2

This diff is large: its 11 lines aren’t shown here.

security/tomoyo/common.c+112−33

This diff is large: its 168 lines aren’t shown here.

security/tomoyo/domain.c+1−1

This diff is large: its 9 lines aren’t shown here.

security/tomoyo/securityfs_if.c+3−3

This diff is large: its 20 lines aren’t shown here.

security/tomoyo/tomoyo.c+1−4

This diff is large: its 12 lines aren’t shown here.

sound/core/hrtimer.c+1−2

This diff is large: its 11 lines aren’t shown here.

sound/core/seq/seq_clientmgr.c+9−3

This diff is large: its 22 lines aren’t shown here.

sound/drivers/dummy.c+1−2

This diff is large: its 10 lines aren’t shown here.

sound/drivers/pcsp/pcsp.c+1−2

This diff is large: its 10 lines aren’t shown here.

sound/hda/intel-dsp-config.c+5−0

This diff is large: its 12 lines aren’t shown here.

sound/pci/hda/hda_codec.c+3−1

This diff is large: its 11 lines aren’t shown here.

sound/pci/hda/hda_intel.c+2−0

This diff is large: its 9 lines aren’t shown here.

sound/pci/hda/patch_conexant.c+1−0

This diff is large: its 8 lines aren’t shown here.

sound/pci/hda/patch_cs8409-tables.c+6−6

This diff is large: its 54 lines aren’t shown here.

sound/pci/hda/patch_cs8409.c+16−10

This diff is large: its 58 lines aren’t shown here.

sound/pci/hda/patch_cs8409.h+4−3

This diff is large: its 22 lines aren’t shown here.

sound/pci/hda/patch_realtek.c+2−0

This diff is large: its 16 lines aren’t shown here.

sound/pci/hda/tas2781_hda_spi.c+14−13

This diff is large: its 73 lines aren’t shown here.

sound/pci/hda/tas2781_spi_fwlib.c+5−5

This diff is large: its 33 lines aren’t shown here.

sound/sh/sh_dac_audio.c+1−2

This diff is large: its 10 lines aren’t shown here.

sound/soc/codecs/arizona.c+7−7

This diff is large: its 58 lines aren’t shown here.

sound/soc/codecs/cs35l41.c+23−7

This diff is large: its 52 lines aren’t shown here.

sound/soc/codecs/madera.c+5−5

This diff is large: its 40 lines aren’t shown here.

sound/soc/codecs/tas2781-i2c.c+1−3

This diff is large: its 18 lines aren’t shown here.

sound/soc/codecs/wm5110.c+4−4

This diff is large: its 36 lines aren’t shown here.

sound/soc/fsl/fsl_micfil.c+2−0

This diff is large: its 9 lines aren’t shown here.

sound/soc/fsl/imx-audmix.c+0−31

This diff is large: its 57 lines aren’t shown here.

sound/soc/generic/simple-card-utils.c+1−0

This diff is large: its 8 lines aren’t shown here.

sound/soc/intel/boards/sof_sdw.c+35−6

This diff is large: its 72 lines aren’t shown here.

sound/soc/intel/common/soc-acpi-intel-mtl-match.c+1−1

This diff is large: its 9 lines aren’t shown here.

sound/soc/intel/common/soc-acpi-intel-ptl-match.c+6−6

This diff is large: its 40 lines aren’t shown here.

sound/soc/intel/common/soc-acpi-intel-tgl-match.c+8−8

This diff is large: its 60 lines aren’t shown here.

sound/soc/renesas/rcar/core.c+0−14

This diff is large: its 21 lines aren’t shown here.

sound/soc/renesas/rcar/rsnd.h+0−1

This diff is large: its 8 lines aren’t shown here.

sound/soc/renesas/rcar/src.c+93−23

This diff is large: its 211 lines aren’t shown here.

sound/soc/renesas/rcar/ssi.c+2−1

This diff is large: its 10 lines aren’t shown here.

sound/soc/rockchip/rockchip_i2s_tdm.c+2−2

This diff is large: its 14 lines aren’t shown here.

sound/soc/sof/amd/acp-ipc.c+17−8

This diff is large: its 40 lines aren’t shown here.

sound/soc/sof/amd/acp.c+1−0

This diff is large: its 8 lines aren’t shown here.

sound/soc/sof/amd/acp.h+1−0

This diff is large: its 8 lines aren’t shown here.

sound/soc/sof/amd/pci-vangogh.c+0−2

This diff is large: its 12 lines aren’t shown here.

sound/soc/sof/amd/vangogh.c+18−4

This diff is large: its 46 lines aren’t shown here.

sound/soc/sof/intel/hda-codec.c+1−0

This diff is large: its 8 lines aren’t shown here.

sound/soc/sof/intel/pci-ptl.c+1−0

This diff is large: its 8 lines aren’t shown here.

sound/soc/sof/ipc4-topology.c+10−2

This diff is large: its 33 lines aren’t shown here.

sound/soc/sof/pcm.c+2−0

This diff is large: its 9 lines aren’t shown here.

sound/soc/sof/stream-ipc.c+5−1

This diff is large: its 20 lines aren’t shown here.

tools/accounting/getdelays.c+16−16

This diff is large: its 39 lines aren’t shown here.

tools/mm/page-types.c+2−2

This diff is large: its 11 lines aren’t shown here.

tools/objtool/check.c+11−1

This diff is large: its 40 lines aren’t shown here.

tools/sched_ext/include/scx/common.bpf.h+22−3

This diff is large: its 46 lines aren’t shown here.

tools/testing/selftests/bpf/map_tests/map_in_map_batch_ops.c+44−18

This diff is large: its 132 lines aren’t shown here.

tools/testing/selftests/bpf/prog_tests/flow_dissector_classification.c+6−1

This diff is large: its 22 lines aren’t shown here.

tools/testing/selftests/bpf/prog_tests/sockmap_basic.c+55−74

This diff is large: its 183 lines aren’t shown here.

tools/testing/selftests/bpf/prog_tests/sockmap_strp.c+454−0

This diff is large: its 455 lines aren’t shown here.

tools/testing/selftests/bpf/prog_tests/xdp_cpumap_attach.c+2−2

This diff is large: its 13 lines aren’t shown here.

tools/testing/selftests/bpf/prog_tests/xdp_devmap_attach.c+4−4

This diff is large: its 36 lines aren’t shown here.

tools/testing/selftests/bpf/progs/test_sockmap_strp.c+53−0

This diff is large: its 54 lines aren’t shown here.

tools/testing/selftests/bpf/progs/verifier_array_access.c+15−0

This diff is large: its 20 lines aren’t shown here.

tools/testing/selftests/cgroup/test_cpuset_v1_hp.sh+1−1

This diff is large: its 6 lines aren’t shown here.

tools/testing/selftests/drivers/net/hw/rss_ctx.py+8−1

This diff is large: its 23 lines aren’t shown here.

tools/testing/selftests/filesystems/statmount/statmount_test.c+21−1

This diff is large: its 57 lines aren’t shown here.

tools/testing/selftests/kvm/s390/cmma_test.c+2−2

This diff is large: its 18 lines aren’t shown here.

tools/testing/selftests/kvm/s390/ucontrol_test.c+12−20

This diff is large: its 72 lines aren’t shown here.

tools/testing/selftests/kvm/x86/hyperv_cpuid.c+32−15

This diff is large: its 109 lines aren’t shown here.

tools/testing/selftests/livepatch/functions.sh+2−1

This diff is large: its 10 lines aren’t shown here.

tools/testing/selftests/mm/run_vmtests.sh+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/net/forwarding/tc_flower_port_range.sh+46−0

This diff is large: its 60 lines aren’t shown here.

tools/testing/selftests/net/mptcp/mptcp_connect.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/net/udpgso.c+26−0

This diff is large: its 40 lines aren’t shown here.

tools/testing/selftests/sched_ext/create_dsq.c+5−5

This diff is large: its 17 lines aren’t shown here.

tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.c+5−2

This diff is large: its 14 lines aren’t shown here.

tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.c+5−2

This diff is large: its 14 lines aren’t shown here.

tools/testing/selftests/sched_ext/dsp_local_on.bpf.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/sched_ext/dsp_local_on.c+1−0

This diff is large: its 8 lines aren’t shown here.

tools/testing/selftests/sched_ext/enq_last_no_enq_fails.c+5−5

This diff is large: its 17 lines aren’t shown here.

tools/testing/selftests/sched_ext/enq_select_cpu_fails.c+5−5

This diff is large: its 17 lines aren’t shown here.

tools/testing/selftests/sched_ext/exit.c+1−0

This diff is large: its 8 lines aren’t shown here.

tools/testing/selftests/sched_ext/hotplug.c+4−2

This diff is large: its 13 lines aren’t shown here.

tools/testing/selftests/sched_ext/init_enable_count.c+9−18

This diff is large: its 48 lines aren’t shown here.

tools/testing/selftests/sched_ext/maximal.c+5−2

This diff is large: its 14 lines aren’t shown here.

tools/testing/selftests/sched_ext/maybe_null.c+1−1

This diff is large: its 9 lines aren’t shown here.

tools/testing/selftests/sched_ext/minimal.c+5−5

This diff is large: its 17 lines aren’t shown here.

tools/testing/selftests/sched_ext/prog_run.c+5−5

This diff is large: its 17 lines aren’t shown here.

tools/testing/selftests/sched_ext/reload_loop.c+4−5

This diff is large: its 16 lines aren’t shown here.

tools/testing/selftests/sched_ext/select_cpu_dfl.c+5−2

This diff is large: its 14 lines aren’t shown here.

tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.c+5−2

This diff is large: its 14 lines aren’t shown here.

tools/testing/selftests/sched_ext/select_cpu_dispatch.c+5−2

This diff is large: its 14 lines aren’t shown here.

tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.c+5−2

This diff is large: its 14 lines aren’t shown here.

tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.c+5−2

This diff is large: its 14 lines aren’t shown here.

tools/testing/selftests/sched_ext/select_cpu_vtime.c+5−2

This diff is large: its 14 lines aren’t shown here.

tools/testing/selftests/seccomp/seccomp_bpf.c+199−0

This diff is large: its 220 lines aren’t shown here.

tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json+33−1

This diff is large: its 39 lines aren’t shown here.

tools/testing/selftests/tc-testing/tc-tests/qdiscs/fifo.json+23−0

This diff is large: its 30 lines aren’t shown here.

tools/testing/vsock/vsock_test.c+41−0

This diff is large: its 55 lines aren’t shown here.

virt/kvm/kvm_main.c+9−16

This diff is large: its 53 lines aren’t shown here.

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf bpf-6.14-rc4

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code

@@ -786,7 +786,7 @@ static void populate_dml_output_cfg_from_stream_state(struct dml_output_cfg_st * · 785 unmodified lines
786	case SIGNAL_TYPE_DISPLAY_PORT_MST:	786	case SIGNAL_TYPE_DISPLAY_PORT_MST:
787	case SIGNAL_TYPE_DISPLAY_PORT:	787	case SIGNAL_TYPE_DISPLAY_PORT:
788	out->OutputEncoder[location] = dml_dp;	788	out->OutputEncoder[location] = dml_dp;
789	if (dml2->v20.scratch.hpo_stream_to_link_encoder_mapping[location] != -1)	789	if (location < MAX_HPO_DP2_ENCODERS && dml2->v20.scratch.hpo_stream_to_link_encoder_mapping[location] != -1)
790	out->OutputEncoder[dml2->v20.scratch.hpo_stream_to_link_encoder_mapping[location]] = dml_dp2p0;	790	out->OutputEncoder[dml2->v20.scratch.hpo_stream_to_link_encoder_mapping[location]] = dml_dp2p0;
791	break;	791	break;
792	case SIGNAL_TYPE_EDP:	792	case SIGNAL_TYPE_EDP:
@@ -1343,7 +1343,7 @@ void map_dc_state_into_dml_display_cfg(struct dml2_context *dml2, struct dc_stat · 550 unmodified lines
1343	if (disp_cfg_stream_location < 0)	1343	if (disp_cfg_stream_location < 0)
1344	disp_cfg_stream_location = dml_dispcfg->num_timings++;	1344	disp_cfg_stream_location = dml_dispcfg->num_timings++;
1345		1345
1346	ASSERT(disp_cfg_stream_location >= 0 && disp_cfg_stream_location <= __DML2_WRAPPER_MAX_STREAMS_PLANES__);	1346	ASSERT(disp_cfg_stream_location >= 0 && disp_cfg_stream_location < __DML2_WRAPPER_MAX_STREAMS_PLANES__);
1347		1347
1348	populate_dml_timing_cfg_from_stream_state(&dml_dispcfg->timing, disp_cfg_stream_location, context->streams[i]);	1348	populate_dml_timing_cfg_from_stream_state(&dml_dispcfg->timing, disp_cfg_stream_location, context->streams[i]);
1349	populate_dml_output_cfg_from_stream_state(&dml_dispcfg->output, disp_cfg_stream_location, context->streams[i], current_pipe_context, dml2);	1349	populate_dml_output_cfg_from_stream_state(&dml_dispcfg->output, disp_cfg_stream_location, context->streams[i], current_pipe_context, dml2);
@@ -1383,7 +1383,7 @@ void map_dc_state_into_dml_display_cfg(struct dml2_context *dml2, struct dc_stat · 33 unmodified lines
1383	if (disp_cfg_plane_location < 0)	1383	if (disp_cfg_plane_location < 0)
1384	disp_cfg_plane_location = dml_dispcfg->num_surfaces++;	1384	disp_cfg_plane_location = dml_dispcfg->num_surfaces++;
1385		1385
1386	ASSERT(disp_cfg_plane_location >= 0 && disp_cfg_plane_location <= __DML2_WRAPPER_MAX_STREAMS_PLANES__);	1386	ASSERT(disp_cfg_plane_location >= 0 && disp_cfg_plane_location < __DML2_WRAPPER_MAX_STREAMS_PLANES__);
1387		1387
1388	populate_dml_surface_cfg_from_plane_state(dml2->v20.dml_core_ctx.project, &dml_dispcfg->surface, disp_cfg_plane_location, context->stream_status[i].plane_states[j]);	1388	populate_dml_surface_cfg_from_plane_state(dml2->v20.dml_core_ctx.project, &dml_dispcfg->surface, disp_cfg_plane_location, context->stream_status[i].plane_states[j]);
1389	populate_dml_plane_cfg_from_plane_state(	1389	populate_dml_plane_cfg_from_plane_state(

@@ -249,7 +249,7 @@ struct exynos_iommu_domain { · 248 unmodified lines
249	struct list_head clients; /* list of sysmmu_drvdata.domain_node */	249	struct list_head clients; /* list of sysmmu_drvdata.domain_node */
250	sysmmu_pte_t pgtable; / lv1 page table, 16KB */	250	sysmmu_pte_t pgtable; / lv1 page table, 16KB */
251	short lv2entcnt; / free lv2 entry counter for each section */	251	short lv2entcnt; / free lv2 entry counter for each section */
252	spinlock_t lock; /* lock for modyfying list of clients */	252	spinlock_t lock; /* lock for modifying list of clients */
253	spinlock_t pgtablelock; /* lock for modifying page table @ pgtable */	253	spinlock_t pgtablelock; /* lock for modifying page table @ pgtable */
254	struct iommu_domain domain; /* generic domain data structure */	254	struct iommu_domain domain; /* generic domain data structure */
255	};	255	};
@@ -292,7 +292,7 @@ struct sysmmu_drvdata { · 36 unmodified lines
292	struct clk aclk; / SYSMMU's aclk clock */	292	struct clk aclk; / SYSMMU's aclk clock */
293	struct clk pclk; / SYSMMU's pclk clock */	293	struct clk pclk; / SYSMMU's pclk clock */
294	struct clk clk_master; / master's device clock */	294	struct clk clk_master; / master's device clock */
295	spinlock_t lock; /* lock for modyfying state */	295	spinlock_t lock; /* lock for modifying state */
296	bool active; /* current status */	296	bool active; /* current status */
297	struct exynos_iommu_domain domain; / domain we belong to */	297	struct exynos_iommu_domain domain; / domain we belong to */
298	struct list_head domain_node; /* node for domain clients list */	298	struct list_head domain_node; /* node for domain clients list */
@@ -746,7 +746,7 @@ static int exynos_sysmmu_probe(struct platform_device *pdev) · 447 unmodified lines
746	ret = devm_request_irq(dev, irq, exynos_sysmmu_irq, 0,	746	ret = devm_request_irq(dev, irq, exynos_sysmmu_irq, 0,
747	dev_name(dev), data);	747	dev_name(dev), data);
748	if (ret) {	748	if (ret) {
749	dev_err(dev, "Unabled to register handler of irq %d\n", irq);	749	dev_err(dev, "Unable to register handler of irq %d\n", irq);
750	return ret;	750	return ret;
751	}	751	}
752		752

@@ -2712,7 +2712,7 @@ static const struct pci_device_id brcmf_pcie_devid_table[] = { · 2711 unmodified lines
2712	BRCMF_PCIE_DEVICE(BRCM_PCIE_4350_DEVICE_ID, WCC),	2712	BRCMF_PCIE_DEVICE(BRCM_PCIE_4350_DEVICE_ID, WCC),
2713	BRCMF_PCIE_DEVICE_SUB(0x4355, BRCM_PCIE_VENDOR_ID_BROADCOM, 0x4355, WCC),	2713	BRCMF_PCIE_DEVICE_SUB(0x4355, BRCM_PCIE_VENDOR_ID_BROADCOM, 0x4355, WCC),
2714	BRCMF_PCIE_DEVICE(BRCM_PCIE_4354_RAW_DEVICE_ID, WCC),	2714	BRCMF_PCIE_DEVICE(BRCM_PCIE_4354_RAW_DEVICE_ID, WCC),
2715	BRCMF_PCIE_DEVICE(BRCM_PCIE_4355_DEVICE_ID, WCC),	2715	BRCMF_PCIE_DEVICE(BRCM_PCIE_4355_DEVICE_ID, WCC_SEED),
2716	BRCMF_PCIE_DEVICE(BRCM_PCIE_4356_DEVICE_ID, WCC),	2716	BRCMF_PCIE_DEVICE(BRCM_PCIE_4356_DEVICE_ID, WCC),
2717	BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID, WCC),	2717	BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID, WCC),
2718	BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID, WCC),	2718	BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID, WCC),
@@ -2723,7 +2723,7 @@ static const struct pci_device_id brcmf_pcie_devid_table[] = { · 4 unmodified lines
2723	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_2G_DEVICE_ID, WCC),	2723	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_2G_DEVICE_ID, WCC),
2724	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_5G_DEVICE_ID, WCC),	2724	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_5G_DEVICE_ID, WCC),
2725	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_RAW_DEVICE_ID, WCC),	2725	BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_RAW_DEVICE_ID, WCC),
2726	BRCMF_PCIE_DEVICE(BRCM_PCIE_4364_DEVICE_ID, WCC),	2726	BRCMF_PCIE_DEVICE(BRCM_PCIE_4364_DEVICE_ID, WCC_SEED),
2727	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_DEVICE_ID, BCA),	2727	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_DEVICE_ID, BCA),
2728	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_2G_DEVICE_ID, BCA),	2728	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_2G_DEVICE_ID, BCA),
2729	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_5G_DEVICE_ID, BCA),	2729	BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_5G_DEVICE_ID, BCA),

@@ -73,7 +73,7 @@ static inline void scx_update_idle(struct rq *rq, bool idle, bool do_notify) {} · 72 unmodified lines
73	int scx_tg_online(struct task_group *tg);	73	int scx_tg_online(struct task_group *tg);
74	void scx_tg_offline(struct task_group *tg);	74	void scx_tg_offline(struct task_group *tg);
75	int scx_cgroup_can_attach(struct cgroup_taskset *tset);	75	int scx_cgroup_can_attach(struct cgroup_taskset *tset);
76	void scx_move_task(struct task_struct *p);	76	void scx_cgroup_move_task(struct task_struct *p);
77	void scx_cgroup_finish_attach(void);	77	void scx_cgroup_finish_attach(void);
78	void scx_cgroup_cancel_attach(struct cgroup_taskset *tset);	78	void scx_cgroup_cancel_attach(struct cgroup_taskset *tset);
79	void scx_group_set_weight(struct task_group *tg, unsigned long cgrp_weight);	79	void scx_group_set_weight(struct task_group *tg, unsigned long cgrp_weight);
@@ -82,7 +82,7 @@ void scx_group_set_idle(struct task_group *tg, bool idle); · 2 unmodified lines
82	static inline int scx_tg_online(struct task_group *tg) { return 0; }	82	static inline int scx_tg_online(struct task_group *tg) { return 0; }
83	static inline void scx_tg_offline(struct task_group *tg) {}	83	static inline void scx_tg_offline(struct task_group *tg) {}
84	static inline int scx_cgroup_can_attach(struct cgroup_taskset *tset) { return 0; }	84	static inline int scx_cgroup_can_attach(struct cgroup_taskset *tset) { return 0; }
85	static inline void scx_move_task(struct task_struct *p) {}	85	static inline void scx_cgroup_move_task(struct task_struct *p) {}
86	static inline void scx_cgroup_finish_attach(void) {}	86	static inline void scx_cgroup_finish_attach(void) {}
87	static inline void scx_cgroup_cancel_attach(struct cgroup_taskset *tset) {}	87	static inline void scx_cgroup_cancel_attach(struct cgroup_taskset *tset) {}
88	static inline void scx_group_set_weight(struct task_group *tg, unsigned long cgrp_weight) {}	88	static inline void scx_group_set_weight(struct task_group *tg, unsigned long cgrp_weight) {}