lael-labs/linux

.mailmap+1−0

@@ -416,6 +416,7 @@ Kenneth W Chen <kenneth.w.chen@intel.com> · 415 unmodified lines
416	Kenneth Westfield <quic_kwestfie@quicinc.com> <kwestfie@codeaurora.org>	416	Kenneth Westfield <quic_kwestfie@quicinc.com> <kwestfie@codeaurora.org>
417	Kiran Gunda <quic_kgunda@quicinc.com> <kgunda@codeaurora.org>	417	Kiran Gunda <quic_kgunda@quicinc.com> <kgunda@codeaurora.org>
418	Kirill Tkhai <tkhai@ya.ru> <ktkhai@virtuozzo.com>	418	Kirill Tkhai <tkhai@ya.ru> <ktkhai@virtuozzo.com>
		419	Kirill A. Shutemov <kas@kernel.org> <kirill.shutemov@linux.intel.com>
419	Kishon Vijay Abraham I <kishon@kernel.org> <kishon@ti.com>	420	Kishon Vijay Abraham I <kishon@kernel.org> <kishon@ti.com>
420	Konrad Dybcio <konradybcio@kernel.org> <konrad.dybcio@linaro.org>	421	Konrad Dybcio <konradybcio@kernel.org> <konrad.dybcio@linaro.org>
421	Konrad Dybcio <konradybcio@kernel.org> <konrad.dybcio@somainline.org>	422	Konrad Dybcio <konradybcio@kernel.org> <konrad.dybcio@somainline.org>

Documentation/ABI/testing/sysfs-devices-system-cpu+1−0

@@ -584,6 +584,7 @@ What: /sys/devices/system/cpu/vulnerabilities · 583 unmodified lines
584	/sys/devices/system/cpu/vulnerabilities/spectre_v1	584	/sys/devices/system/cpu/vulnerabilities/spectre_v1
585	/sys/devices/system/cpu/vulnerabilities/spectre_v2	585	/sys/devices/system/cpu/vulnerabilities/spectre_v2
586	/sys/devices/system/cpu/vulnerabilities/srbds	586	/sys/devices/system/cpu/vulnerabilities/srbds
		587	/sys/devices/system/cpu/vulnerabilities/tsa
587	/sys/devices/system/cpu/vulnerabilities/tsx_async_abort	588	/sys/devices/system/cpu/vulnerabilities/tsx_async_abort
588	Date: January 2018	589	Date: January 2018
589	Contact: Linux kernel mailing list <linux-kernel@vger.kernel.org>	590	Contact: Linux kernel mailing list <linux-kernel@vger.kernel.org>

Documentation/admin-guide/cgroup-v2.rst+0−6

 	  numa_hint_faults (npn)
 		Number of NUMA hinting faults.
-	  numa_task_migrated (npn)
-		Number of task migration by NUMA balancing.
-	  numa_task_swapped (npn)
-		Number of task swap by NUMA balancing.
 	  pgdemote_kswapd
 		Number of pages demoted by kswapd.

Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst+1−3

@@ -157,9 +157,7 @@ This is achieved by using the otherwise unused and obsolete VERW instruction in · 156 unmodified lines
157	combination with a microcode update. The microcode clears the affected CPU	157	combination with a microcode update. The microcode clears the affected CPU
158	buffers when the VERW instruction is executed.	158	buffers when the VERW instruction is executed.
159		159
160	Kernel reuses the MDS function to invoke the buffer clearing:	160	Kernel does the buffer clearing with x86_clear_cpu_buffers().
161
162	mds_clear_cpu_buffers()
163		161
164	On MDS affected CPUs, the kernel already invokes CPU buffer clear on	162	On MDS affected CPUs, the kernel already invokes CPU buffer clear on
165	kernel/userspace, hypervisor/guest and C-state (idle) transitions. No	163	kernel/userspace, hypervisor/guest and C-state (idle) transitions. No

Documentation/admin-guide/kernel-parameters.txt+13−0

@@ -7488,6 +7488,19 @@ · 7487 unmodified lines
7488	having this key zero'ed is acceptable. E.g. in testing	7488	having this key zero'ed is acceptable. E.g. in testing
7489	scenarios.	7489	scenarios.
7490		7490
		7491	tsa= [X86] Control mitigation for Transient Scheduler
		7492	Attacks on AMD CPUs. Search the following in your
		7493	favourite search engine for more details:
		7494
		7495	"Technical guidance for mitigating transient scheduler
		7496	attacks".
		7497
		7498	off - disable the mitigation
		7499	on - enable the mitigation (default)
		7500	user - mitigate only user/kernel transitions
		7501	vm - mitigate only guest/host transitions
		7502
		7503
7491	tsc= Disable clocksource stability checks for TSC.	7504	tsc= Disable clocksource stability checks for TSC.
7492	Format: <string>	7505	Format: <string>
7493	[x86] reliable: mark tsc clocksource as reliable, this	7506	[x86] reliable: mark tsc clocksource as reliable, this

Documentation/arch/x86/mds.rst+4−4

@@ -93,7 +93,7 @@ enters a C-state. · 92 unmodified lines
93		93
94	The kernel provides a function to invoke the buffer clearing:	94	The kernel provides a function to invoke the buffer clearing:
95		95
96	mds_clear_cpu_buffers()	96	x86_clear_cpu_buffers()
97		97
98	Also macro CLEAR_CPU_BUFFERS can be used in ASM late in exit-to-user path.	98	Also macro CLEAR_CPU_BUFFERS can be used in ASM late in exit-to-user path.
99	Other than CFLAGS.ZF, this macro doesn't clobber any registers.	99	Other than CFLAGS.ZF, this macro doesn't clobber any registers.
@@ -185,9 +185,9 @@ Mitigation points · 85 unmodified lines
185	idle clearing would be a window dressing exercise and is therefore not	185	idle clearing would be a window dressing exercise and is therefore not
186	activated.	186	activated.
187		187
188	The invocation is controlled by the static key mds_idle_clear which is	188	The invocation is controlled by the static key cpu_buf_idle_clear which is
189	switched depending on the chosen mitigation mode and the SMT state of	189	switched depending on the chosen mitigation mode and the SMT state of the
190	the system.	190	system.
191		191
192	The buffer clear is only invoked before entering the C-State to prevent	192	The buffer clear is only invoked before entering the C-State to prevent
193	that stale data from the idling CPU from spilling to the Hyper-Thread	193	that stale data from the idling CPU from spilling to the Hyper-Thread

Documentation/devicetree/bindings/clock/mediatek,mt8188-clock.yaml+3−0

@@ -52,6 +52,9 @@ properties: · 51 unmodified lines
52	'#clock-cells':	52	'#clock-cells':
53	const: 1	53	const: 1
54		54
		55	'#reset-cells':
		56	const: 1
		57
55	required:	58	required:
56	- compatible	59	- compatible
57	- reg	60	- reg

Documentation/devicetree/bindings/net/allwinner,sun8i-a83t-emac.yaml+1−1

@@ -23,7 +23,7 @@ properties: · 22 unmodified lines
23	- allwinner,sun20i-d1-emac	23	- allwinner,sun20i-d1-emac
24	- allwinner,sun50i-h6-emac	24	- allwinner,sun50i-h6-emac
25	- allwinner,sun50i-h616-emac0	25	- allwinner,sun50i-h616-emac0
26	- allwinner,sun55i-a523-emac0	26	- allwinner,sun55i-a523-gmac0
27	- const: allwinner,sun50i-a64-emac	27	- const: allwinner,sun50i-a64-emac
28		28
29	reg:	29	reg:

Documentation/virt/kvm/api.rst+22−15

@@ -7196,6 +7196,10 @@ The valid value for 'flags' is: · 7195 unmodified lines
7196	u64 leaf;	7196	u64 leaf;
7197	u64 r11, r12, r13, r14;	7197	u64 r11, r12, r13, r14;
7198	} get_tdvmcall_info;	7198	} get_tdvmcall_info;
		7199	struct {
		7200	u64 ret;
		7201	u64 vector;
		7202	} setup_event_notify;
7199	};	7203	};
7200	} tdx;	7204	} tdx;
7201		7205
@@ -7210,21 +7214,24 @@ number from register R11. The remaining field of the union provide the · 8 unmodified lines
7210	inputs and outputs of the TDVMCALL. Currently the following values of	7214	inputs and outputs of the TDVMCALL. Currently the following values of
7211	``nr`` are defined:	7215	``nr`` are defined:
7212		7216
7213	* ``TDVMCALL_GET_QUOTE``: the guest has requested to generate a TD-Quote	7217	* ``TDVMCALL_GET_QUOTE``: the guest has requested to generate a TD-Quote
7214	signed by a service hosting TD-Quoting Enclave operating on the host.	7218	signed by a service hosting TD-Quoting Enclave operating on the host.
7215	Parameters and return value are in the ``get_quote`` field of the union.	7219	Parameters and return value are in the ``get_quote`` field of the union.
7216	The ``gpa`` field and ``size`` specify the guest physical address	7220	The ``gpa`` field and ``size`` specify the guest physical address
7217	(without the shared bit set) and the size of a shared-memory buffer, in	7221	(without the shared bit set) and the size of a shared-memory buffer, in
7218	which the TDX guest passes a TD Report. The ``ret`` field represents	7222	which the TDX guest passes a TD Report. The ``ret`` field represents
7219	the return value of the GetQuote request. When the request has been	7223	the return value of the GetQuote request. When the request has been
7220	queued successfully, the TDX guest can poll the status field in the	7224	queued successfully, the TDX guest can poll the status field in the
7221	shared-memory area to check whether the Quote generation is completed or	7225	shared-memory area to check whether the Quote generation is completed or
7222	not. When completed, the generated Quote is returned via the same buffer.	7226	not. When completed, the generated Quote is returned via the same buffer.
7223		7227
7224	* ``TDVMCALL_GET_TD_VM_CALL_INFO``: the guest has requested the support	7228	* ``TDVMCALL_GET_TD_VM_CALL_INFO``: the guest has requested the support
7225	status of TDVMCALLs. The output values for the given leaf should be	7229	status of TDVMCALLs. The output values for the given leaf should be
7226	placed in fields from ``r11`` to ``r14`` of the ``get_tdvmcall_info``	7230	placed in fields from ``r11`` to ``r14`` of the ``get_tdvmcall_info``
7227	field of the union.	7231	field of the union.
		7232
		7233	* ``TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUPT``: the guest has requested to
		7234	set up a notification interrupt for vector ``vector``.
7228		7235
7229	KVM may add support for more values in the future that may cause a userspace	7236	KVM may add support for more values in the future that may cause a userspace
7230	exit, even without calls to ``KVM_ENABLE_CAP`` or similar. In this case,	7237	exit, even without calls to ``KVM_ENABLE_CAP`` or similar. In this case,

Documentation/virt/kvm/x86/intel-tdx.rst+14−1

@@ -79,7 +79,20 @@ to be configured to the TDX guest. · 78 unmodified lines
79	struct kvm_tdx_capabilities {	79	struct kvm_tdx_capabilities {
80	__u64 supported_attrs;	80	__u64 supported_attrs;
81	__u64 supported_xfam;	81	__u64 supported_xfam;
82	__u64 reserved[254];	82
		83	/* TDG.VP.VMCALL hypercalls executed in kernel and forwarded to
		84	* userspace, respectively
		85	*/
		86	__u64 kernel_tdvmcallinfo_1_r11;
		87	__u64 user_tdvmcallinfo_1_r11;
		88
		89	/* TDG.VP.VMCALL instruction executions subfunctions executed in kernel
		90	* and forwarded to userspace, respectively
		91	*/
		92	__u64 kernel_tdvmcallinfo_1_r12;
		93	__u64 user_tdvmcallinfo_1_r12;
		94
		95	__u64 reserved[250];
83		96
84	/* Configurable CPUID bits for userspace */	97	/* Configurable CPUID bits for userspace */
85	struct kvm_cpuid2 cpuid;	98	struct kvm_cpuid2 cpuid;

MAINTAINERS+13−25

@@ -4181,6 +4181,7 @@ F: include/linux/cpumask_types.h · 4180 unmodified lines
4181	F: include/linux/find.h	4181	F: include/linux/find.h
4182	F: include/linux/nodemask.h	4182	F: include/linux/nodemask.h
4183	F: include/linux/nodemask_types.h	4183	F: include/linux/nodemask_types.h
		4184	F: include/uapi/linux/bits.h
4184	F: include/vdso/bits.h	4185	F: include/vdso/bits.h
4185	F: lib/bitmap-str.c	4186	F: lib/bitmap-str.c
4186	F: lib/bitmap.c	4187	F: lib/bitmap.c
@@ -4193,6 +4194,7 @@ F: tools/include/linux/bitfield.h · 6 unmodified lines
4193	F: tools/include/linux/bitmap.h	4194	F: tools/include/linux/bitmap.h
4194	F: tools/include/linux/bits.h	4195	F: tools/include/linux/bits.h
4195	F: tools/include/linux/find.h	4196	F: tools/include/linux/find.h
		4197	F: tools/include/uapi/linux/bits.h
4196	F: tools/include/vdso/bits.h	4198	F: tools/include/vdso/bits.h
4197	F: tools/lib/bitmap.c	4199	F: tools/lib/bitmap.c
4198	F: tools/lib/find_bit.c	4200	F: tools/lib/find_bit.c
@@ -10504,7 +10506,7 @@ S: Maintained · 6305 unmodified lines
10504	F: block/partitions/efi.*	10506	F: block/partitions/efi.*
10505		10507
10506	HABANALABS PCI DRIVER	10508	HABANALABS PCI DRIVER
10507	M: Ofir Bitton <obitton@habana.ai>	10509	M: Yaron Avizrat <yaron.avizrat@intel.com>
10508	L: dri-devel@lists.freedesktop.org	10510	L: dri-devel@lists.freedesktop.org
10509	S: Supported	10511	S: Supported
10510	C: irc://irc.oftc.net/dri-devel	10512	C: irc://irc.oftc.net/dri-devel
@@ -16822,8 +16824,8 @@ F: include/dt-bindings/clock/mobileye,eyeq5-clk.h · 6311 unmodified lines
16822	MODULE SUPPORT	16824	MODULE SUPPORT
16823	M: Luis Chamberlain <mcgrof@kernel.org>	16825	M: Luis Chamberlain <mcgrof@kernel.org>
16824	M: Petr Pavlu <petr.pavlu@suse.com>	16826	M: Petr Pavlu <petr.pavlu@suse.com>
		16827	M: Daniel Gomez <da.gomez@kernel.org>
16825	R: Sami Tolvanen <samitolvanen@google.com>	16828	R: Sami Tolvanen <samitolvanen@google.com>
16826	R: Daniel Gomez <da.gomez@samsung.com>
16827	L: linux-modules@vger.kernel.org	16829	L: linux-modules@vger.kernel.org
16828	L: linux-kernel@vger.kernel.org	16830	L: linux-kernel@vger.kernel.org
16829	S: Maintained	16831	S: Maintained
@@ -17222,10 +17224,10 @@ F: drivers/rtc/rtc-ntxec.c · 392 unmodified lines
17222	F: include/linux/mfd/ntxec.h	17224	F: include/linux/mfd/ntxec.h
17223		17225
17224	NETRONOME ETHERNET DRIVERS	17226	NETRONOME ETHERNET DRIVERS
17225	M: Louis Peens <louis.peens@corigine.com>
17226	R: Jakub Kicinski <kuba@kernel.org>	17227	R: Jakub Kicinski <kuba@kernel.org>
		17228	R: Simon Horman <horms@kernel.org>
17227	L: oss-drivers@corigine.com	17229	L: oss-drivers@corigine.com
17228	S: Maintained	17230	S: Odd Fixes
17229	F: drivers/net/ethernet/netronome/	17231	F: drivers/net/ethernet/netronome/
17230		17232
17231	NETWORK BLOCK DEVICE (NBD)	17233	NETWORK BLOCK DEVICE (NBD)
@@ -19601,8 +19603,7 @@ T: git git://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/intel.git · 2369 unmodified lines
19601	F: drivers/pinctrl/intel/	19603	F: drivers/pinctrl/intel/
19602		19604
19603	PIN CONTROLLER - KEEMBAY	19605	PIN CONTROLLER - KEEMBAY
19604	M: Lakshmi Sowjanya D <lakshmi.sowjanya.d@intel.com>	19606	S: Orphan
19605	S: Supported
19606	F: drivers/pinctrl/pinctrl-keembay*	19607	F: drivers/pinctrl/pinctrl-keembay*
19607		19608
19608	PIN CONTROLLER - MEDIATEK	19609	PIN CONTROLLER - MEDIATEK
@@ -20155,21 +20156,15 @@ S: Supported · 546 unmodified lines
20155	F: Documentation/devicetree/bindings/soc/qcom/qcom,apr*	20156	F: Documentation/devicetree/bindings/soc/qcom/qcom,apr*
20156	F: Documentation/devicetree/bindings/sound/qcom,*	20157	F: Documentation/devicetree/bindings/sound/qcom,*
20157	F: drivers/soc/qcom/apr.c	20158	F: drivers/soc/qcom/apr.c
20158	F: include/dt-bindings/sound/qcom,wcd9335.h	20159	F: drivers/soundwire/qcom.c
20159	F: include/dt-bindings/sound/qcom,wcd934x.h	20160	F: include/dt-bindings/sound/qcom,wcd93*
20160	F: sound/soc/codecs/lpass-rx-macro.*	20161	F: sound/soc/codecs/lpass-.
20161	F: sound/soc/codecs/lpass-tx-macro.*
20162	F: sound/soc/codecs/lpass-va-macro.c
20163	F: sound/soc/codecs/lpass-wsa-macro.*
20164	F: sound/soc/codecs/msm8916-wcd-analog.c	20162	F: sound/soc/codecs/msm8916-wcd-analog.c
20165	F: sound/soc/codecs/msm8916-wcd-digital.c	20163	F: sound/soc/codecs/msm8916-wcd-digital.c
20166	F: sound/soc/codecs/wcd-clsh-v2.*	20164	F: sound/soc/codecs/wcd-clsh-v2.*
20167	F: sound/soc/codecs/wcd-mbhc-v2.*	20165	F: sound/soc/codecs/wcd-mbhc-v2.*
20168	F: sound/soc/codecs/wcd9335.*	20166	F: sound/soc/codecs/wcd93.
20169	F: sound/soc/codecs/wcd934x.c	20167	F: sound/soc/codecs/wsa88.
20170	F: sound/soc/codecs/wsa881x.c
20171	F: sound/soc/codecs/wsa883x.c
20172	F: sound/soc/codecs/wsa884x.c
20173	F: sound/soc/qcom/	20168	F: sound/soc/qcom/
20174		20169
20175	QCOM EMBEDDED USB DEBUGGER (EUD)	20170	QCOM EMBEDDED USB DEBUGGER (EUD)
@@ -26955,7 +26950,7 @@ F: arch/x86/kernel/stacktrace.c · 6779 unmodified lines
26955	F: arch/x86/kernel/unwind_*.c	26950	F: arch/x86/kernel/unwind_*.c
26956		26951
26957	X86 TRUST DOMAIN EXTENSIONS (TDX)	26952	X86 TRUST DOMAIN EXTENSIONS (TDX)
26958	M: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>	26953	M: Kirill A. Shutemov <kas@kernel.org>
26959	R: Dave Hansen <dave.hansen@linux.intel.com>	26954	R: Dave Hansen <dave.hansen@linux.intel.com>
26960	L: x86@kernel.org	26955	L: x86@kernel.org
26961	L: linux-coco@lists.linux.dev	26956	L: linux-coco@lists.linux.dev
@@ -27324,13 +27319,6 @@ S: Supported · 362 unmodified lines
27324	W: http://www.marvell.com	27319	W: http://www.marvell.com
27325	F: drivers/i2c/busses/i2c-xlp9xx.c	27320	F: drivers/i2c/busses/i2c-xlp9xx.c
27326		27321
27327	XRA1403 GPIO EXPANDER
27328	M: Nandor Han <nandor.han@ge.com>
27329	L: linux-gpio@vger.kernel.org
27330	S: Maintained
27331	F: Documentation/devicetree/bindings/gpio/gpio-xra1403.txt
27332	F: drivers/gpio/gpio-xra1403.c
27333
27334	XTENSA XTFPGA PLATFORM SUPPORT	27322	XTENSA XTFPGA PLATFORM SUPPORT
27335	M: Max Filippov <jcmvbkbc@gmail.com>	27323	M: Max Filippov <jcmvbkbc@gmail.com>
27336	S: Maintained	27324	S: Maintained

Makefile+1−1

@@ -2,7 +2,7 @@ · 1 unmodified line
2	VERSION = 6	2	VERSION = 6
3	PATCHLEVEL = 16	3	PATCHLEVEL = 16
4	SUBLEVEL = 0	4	SUBLEVEL = 0
5	EXTRAVERSION = -rc5	5	EXTRAVERSION = -rc6
6	NAME = Baby Opossum Posse	6	NAME = Baby Opossum Posse
7		7
8	# DOCUMENTATION	8	# DOCUMENTATION

arch/arm64/Kconfig+1−0

@@ -256,6 +256,7 @@ config ARM64 · 255 unmodified lines
256	select HOTPLUG_SMT if HOTPLUG_CPU	256	select HOTPLUG_SMT if HOTPLUG_CPU
257	select IRQ_DOMAIN	257	select IRQ_DOMAIN
258	select IRQ_FORCED_THREADING	258	select IRQ_FORCED_THREADING
		259	select JUMP_LABEL
259	select KASAN_VMALLOC if KASAN	260	select KASAN_VMALLOC if KASAN
260	select LOCK_MM_AND_FIND_VMA	261	select LOCK_MM_AND_FIND_VMA
261	select MODULES_USE_ELF_RELA	262	select MODULES_USE_ELF_RELA

arch/arm64/include/asm/el2_setup.h+7−12

 .Lskip_fgt2_\@:
 .endm
-.macro __init_el2_gcs
-	mrs_s	x1, SYS_ID_AA64PFR1_EL1
-	ubfx	x1, x1, #ID_AA64PFR1_EL1_GCS_SHIFT, #4
-	cbz	x1, .Lskip_gcs_\@
-	/* Ensure GCS is not enabled when we start trying to do BLs */
-	msr_s	SYS_GCSCR_EL1, xzr
-	msr_s	SYS_GCSCRE0_EL1, xzr
-.Lskip_gcs_\@:
-.endm
 /**
  * Initialize EL2 registers to sane values. This should be called early on all
  * cores that were booted in EL2. Note that everything gets initialised as
 	__init_el2_cptr
 	__init_el2_fgt
 	__init_el2_fgt2
-        __init_el2_gcs
 .endm
 #ifndef __KVM_NVHE_HYPERVISOR__
 	msr_s   SYS_MPAMHCR_EL2, xzr		// clear TRAP_MPAMIDR_EL1 -> EL2
 .Lskip_mpam_\@:
+	check_override id_aa64pfr1, ID_AA64PFR1_EL1_GCS_SHIFT, .Linit_gcs_\@, .Lskip_gcs_\@, x1, x2
+.Linit_gcs_\@:
+	msr_s	SYS_GCSCR_EL1, xzr
+	msr_s	SYS_GCSCRE0_EL1, xzr
+.Lskip_gcs_\@:
 	check_override id_aa64pfr0, ID_AA64PFR0_EL1_SVE_SHIFT, .Linit_sve_\@, .Lskip_sve_\@, x1, x2
 .Linit_sve_\@:	/* SVE register access */

arch/arm64/include/asm/kvm_host.h+0−1

@@ -1480,7 +1480,6 @@ int kvm_vm_ioctl_get_reg_writable_masks(struct kvm *kvm, · 1479 unmodified lines
1480	struct reg_mask_range *range);	1480	struct reg_mask_range *range);
1481		1481
1482	/* Guest/host FPSIMD coordination helpers */	1482	/* Guest/host FPSIMD coordination helpers */
1483	int kvm_arch_vcpu_run_map_fp(struct kvm_vcpu *vcpu);
1484	void kvm_arch_vcpu_load_fp(struct kvm_vcpu *vcpu);	1483	void kvm_arch_vcpu_load_fp(struct kvm_vcpu *vcpu);
1485	void kvm_arch_vcpu_ctxflush_fp(struct kvm_vcpu *vcpu);	1484	void kvm_arch_vcpu_ctxflush_fp(struct kvm_vcpu *vcpu);
1486	void kvm_arch_vcpu_ctxsync_fp(struct kvm_vcpu *vcpu);	1485	void kvm_arch_vcpu_ctxsync_fp(struct kvm_vcpu *vcpu);

arch/arm64/kernel/Makefile+1−2

 			   cpufeature.o alternative.o cacheinfo.o		\
 			   smp.o smp_spin_table.o topology.o smccc-call.o	\
 			   syscall.o proton-pack.o idle.o patching.o pi/	\
-			   rsi.o
+			   rsi.o jump_label.o
 obj-$(CONFIG_COMPAT)			+= sys32.o signal32.o			\
 					   sys_compat.o
 obj-$(CONFIG_HARDLOCKUP_DETECTOR_PERF)	+= watchdog_hld.o
 obj-$(CONFIG_HAVE_HW_BREAKPOINT)	+= hw_breakpoint.o
 obj-$(CONFIG_CPU_PM)			+= sleep.o suspend.o
-obj-$(CONFIG_JUMP_LABEL)		+= jump_label.o
 obj-$(CONFIG_KGDB)			+= kgdb.o
 obj-$(CONFIG_EFI)			+= efi.o efi-rt-wrapper.o
 obj-$(CONFIG_PCI)			+= pci.o

arch/arm64/kernel/cpufeature.c+32−25

arch/arm64/kernel/efi.c+8−3

 #include <asm/efi.h>
 #include <asm/stacktrace.h>
+#include <asm/vmap_stack.h>
 static bool region_is_misaligned(const efi_memory_desc_t *md)
 {
 	if (!efi_enabled(EFI_RUNTIME_SERVICES))
 		return 0;
-	p = __vmalloc_node(THREAD_SIZE, THREAD_ALIGN, GFP_KERNEL,
+	if (!IS_ENABLED(CONFIG_VMAP_STACK)) {
-			   NUMA_NO_NODE, &&l);
+		clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
-l:	if (!p) {
+		return -ENOMEM;
+	}
+	p = arch_alloc_vmap_stack(THREAD_SIZE, NUMA_NO_NODE);
+	if (!p) {
 		pr_warn("Failed to allocate EFI runtime stack\n");
 		clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
 		return -ENOMEM;

arch/arm64/kernel/process.c+5−0

 	current->thread.por_el0 = read_sysreg_s(SYS_POR_EL0);
 	if (current->thread.por_el0 != next->thread.por_el0) {
 		write_sysreg_s(next->thread.por_el0, SYS_POR_EL0);
+		/*
+		 * No ISB required as we can tolerate spurious Overlay faults -
+		 * the fault handler will check again based on the new value
+		 * of POR_EL0.
+		 */
 	}
 }

arch/arm64/kernel/smp.c+1−1

@@ -1143,7 +1143,7 @@ static inline unsigned int num_other_online_cpus(void) · 1142 unmodified lines
1143	void smp_send_stop(void)	1143	void smp_send_stop(void)
1144	{	1144	{
1145	static unsigned long stop_in_progress;	1145	static unsigned long stop_in_progress;
1146	cpumask_t mask;	1146	static cpumask_t mask;
1147	unsigned long timeout;	1147	unsigned long timeout;
1148		1148
1149	/*	1149	/*

arch/arm64/kvm/arm.c+10−6

@@ -825,10 +825,6 @@ int kvm_arch_vcpu_run_pid_change(struct kvm_vcpu *vcpu) · 824 unmodified lines
825	if (!kvm_arm_vcpu_is_finalized(vcpu))	825	if (!kvm_arm_vcpu_is_finalized(vcpu))
826	return -EPERM;	826	return -EPERM;
827		827
828	ret = kvm_arch_vcpu_run_map_fp(vcpu);
829	if (ret)
830	return ret;
831
832	if (likely(vcpu_has_run_once(vcpu)))	828	if (likely(vcpu_has_run_once(vcpu)))
833	return 0;	829	return 0;
834		830
@@ -2129,7 +2125,7 @@ static void cpu_hyp_init(void *discard) · 1294 unmodified lines
2129		2125
2130	static void cpu_hyp_uninit(void *discard)	2126	static void cpu_hyp_uninit(void *discard)
2131	{	2127	{
2132	if (__this_cpu_read(kvm_hyp_initialized)) {	2128	if (!is_protected_kvm_enabled() && __this_cpu_read(kvm_hyp_initialized)) {
2133	cpu_hyp_reset();	2129	cpu_hyp_reset();
2134	__this_cpu_write(kvm_hyp_initialized, 0);	2130	__this_cpu_write(kvm_hyp_initialized, 0);
2135	}	2131	}
@@ -2345,8 +2341,13 @@ static void __init teardown_hyp_mode(void) · 209 unmodified lines
2345		2341
2346	free_hyp_pgds();	2342	free_hyp_pgds();
2347	for_each_possible_cpu(cpu) {	2343	for_each_possible_cpu(cpu) {
		2344	if (per_cpu(kvm_hyp_initialized, cpu))
		2345	continue;
		2346
2348	free_pages(per_cpu(kvm_arm_hyp_stack_base, cpu), NVHE_STACK_SHIFT - PAGE_SHIFT);	2347	free_pages(per_cpu(kvm_arm_hyp_stack_base, cpu), NVHE_STACK_SHIFT - PAGE_SHIFT);
2349	free_pages(kvm_nvhe_sym(kvm_arm_hyp_percpu_base)[cpu], nvhe_percpu_order());	2348
		2349	if (!kvm_nvhe_sym(kvm_arm_hyp_percpu_base)[cpu])
		2350	continue;
2350		2351
2351	if (free_sve) {	2352	if (free_sve) {
2352	struct cpu_sve_state *sve_state;	2353	struct cpu_sve_state *sve_state;
@@ -2354,6 +2355,9 @@ static void __init teardown_hyp_mode(void) · 1 unmodified line
2354	sve_state = per_cpu_ptr_nvhe_sym(kvm_host_data, cpu)->sve_state;	2355	sve_state = per_cpu_ptr_nvhe_sym(kvm_host_data, cpu)->sve_state;
2355	free_pages((unsigned long) sve_state, pkvm_host_sve_state_order());	2356	free_pages((unsigned long) sve_state, pkvm_host_sve_state_order());
2356	}	2357	}
		2358
		2359	free_pages(kvm_nvhe_sym(kvm_arm_hyp_percpu_base)[cpu], nvhe_percpu_order());
		2360
2357	}	2361	}
2358	}	2362	}
2359		2363

arch/arm64/kvm/fpsimd.c+0−26

@@ -14,32 +14,6 @@ · 13 unmodified lines
14	#include <asm/kvm_mmu.h>	14	#include <asm/kvm_mmu.h>
15	#include <asm/sysreg.h>	15	#include <asm/sysreg.h>
16		16
17	/*
18	* Called on entry to KVM_RUN unless this vcpu previously ran at least
19	* once and the most recent prior KVM_RUN for this vcpu was called from
20	* the same task as current (highly likely).
21	*
22	* This is guaranteed to execute before kvm_arch_vcpu_load_fp(vcpu),
23	* such that on entering hyp the relevant parts of current are already
24	* mapped.
25	*/
26	int kvm_arch_vcpu_run_map_fp(struct kvm_vcpu *vcpu)
27	{
28	struct user_fpsimd_state *fpsimd = &current->thread.uw.fpsimd_state;
29	int ret;
30
31	/* pKVM has its own tracking of the host fpsimd state. */
32	if (is_protected_kvm_enabled())
33	return 0;
34
35	/* Make sure the host task fpsimd state is visible to hyp: */
36	ret = kvm_share_hyp(fpsimd, fpsimd + 1);
37	if (ret)
38	return ret;
39
40	return 0;
41	}
42
43	/*	17	/*
44	* Prepare vcpu for saving the host's FPSIMD state and loading the guest's.	18	* Prepare vcpu for saving the host's FPSIMD state and loading the guest's.
45	* The actual loading is done by the FPSIMD access trap taken to hyp.	19	* The actual loading is done by the FPSIMD access trap taken to hyp.

arch/arm64/kvm/hyp/nvhe/mem_protect.c+12−8

 {
 	struct kvm_mem_range cur;
 	kvm_pte_t pte;
+	u64 granule;
 	s8 level;
 	int ret;
 		return -EPERM;
 	}
-	do {
+	for (; level <= KVM_PGTABLE_LAST_LEVEL; level++) {
-		u64 granule = kvm_granule_size(level);
+		if (!kvm_level_supports_block_mapping(level))
+			continue;
+		granule = kvm_granule_size(level);
 		cur.start = ALIGN_DOWN(addr, granule);
 		cur.end = cur.start + granule;
-		level++;
+		if (!range_included(&cur, range))
-	} while ((level <= KVM_PGTABLE_LAST_LEVEL) &&
+			continue;
-			!(kvm_level_supports_block_mapping(level) &&
+		*range = cur;
-			  range_included(&cur, range)));
+		return 0;
+	}
-	*range = cur;
+	WARN_ON(1);
-	return 0;
+	return -EINVAL;
 }
 int host_stage2_idmap_locked(phys_addr_t addr, u64 size,

arch/arm64/kvm/nested.c+23−3

 	}
 }
+#define has_tgran_2(__r, __sz)						\
+	({								\
+		u64 _s1, _s2, _mmfr0 = __r;				\
+									\
+		_s2 = SYS_FIELD_GET(ID_AA64MMFR0_EL1,			\
+				    TGRAN##__sz##_2, _mmfr0);		\
+									\
+		_s1 = SYS_FIELD_GET(ID_AA64MMFR0_EL1,			\
+				    TGRAN##__sz, _mmfr0);		\
+									\
+		((_s2 != ID_AA64MMFR0_EL1_TGRAN##__sz##_2_NI &&		\
+		  _s2 != ID_AA64MMFR0_EL1_TGRAN##__sz##_2_TGRAN##__sz) || \
+		 (_s2 == ID_AA64MMFR0_EL1_TGRAN##__sz##_2_TGRAN##__sz && \
+		  _s1 != ID_AA64MMFR0_EL1_TGRAN##__sz##_NI));		\
+	})
 /*
  * Our emulated CPU doesn't support all the possible features. For the
  * sake of simplicity (and probably mental sanity), wipe out a number
  */
 u64 limit_nv_id_reg(struct kvm *kvm, u32 reg, u64 val)
 {
+	u64 orig_val = val;
 	switch (reg) {
 	case SYS_ID_AA64ISAR0_EL1:
 		/* Support everything but TME */
 		 */
 		switch (PAGE_SIZE) {
 		case SZ_4K:
-			val |= SYS_FIELD_PREP_ENUM(ID_AA64MMFR0_EL1, TGRAN4_2, IMP);
+			if (has_tgran_2(orig_val, 4))
+				val |= SYS_FIELD_PREP_ENUM(ID_AA64MMFR0_EL1, TGRAN4_2, IMP);
 			fallthrough;
 		case SZ_16K:
-			val |= SYS_FIELD_PREP_ENUM(ID_AA64MMFR0_EL1, TGRAN16_2, IMP);
+			if (has_tgran_2(orig_val, 16))
+				val |= SYS_FIELD_PREP_ENUM(ID_AA64MMFR0_EL1, TGRAN16_2, IMP);
 			fallthrough;
 		case SZ_64K:
-			val |= SYS_FIELD_PREP_ENUM(ID_AA64MMFR0_EL1, TGRAN64_2, IMP);
+			if (has_tgran_2(orig_val, 64))
+				val |= SYS_FIELD_PREP_ENUM(ID_AA64MMFR0_EL1, TGRAN64_2, IMP);
 			break;
 		}

arch/arm64/kvm/vgic/vgic-v3-nested.c+1−3

 {
 	bool level;
-	level  = __vcpu_sys_reg(vcpu, ICH_HCR_EL2) & ICH_HCR_EL2_En;
+	level = (__vcpu_sys_reg(vcpu, ICH_HCR_EL2) & ICH_HCR_EL2_En) && vgic_v3_get_misr(vcpu);
-	if (level)
-		level &= vgic_v3_get_misr(vcpu);
 	kvm_vgic_inject_irq(vcpu->kvm, vcpu,
 			    vcpu->kvm->arch.vgic.mi_intid, level, vcpu);
 }

arch/arm64/mm/fault.c+21−9

@@ -487,17 +487,29 @@ static void do_bad_area(unsigned long far, unsigned long esr, · 486 unmodified lines
487	}	487	}
488	}	488	}
489		489
490	static bool fault_from_pkey(unsigned long esr, struct vm_area_struct *vma,	490	static bool fault_from_pkey(struct vm_area_struct *vma, unsigned int mm_flags)
491	unsigned int mm_flags)
492	{	491	{
493	unsigned long iss2 = ESR_ELx_ISS2(esr);
494
495	if (!system_supports_poe())	492	if (!system_supports_poe())
496	return false;	493	return false;
497		494
498	if (esr_fsc_is_permission_fault(esr) && (iss2 & ESR_ELx_Overlay))	495	/*
499	return true;	496	* We do not check whether an Overlay fault has occurred because we
500		497	* cannot make a decision based solely on its value:
		498	*
		499	* - If Overlay is set, a fault did occur due to POE, but it may be
		500	* spurious in those cases where we update POR_EL0 without ISB (e.g.
		501	* on context-switch). We would then need to manually check POR_EL0
		502	* against vma_pkey(vma), which is exactly what
		503	* arch_vma_access_permitted() does.
		504	*
		505	* - If Overlay is not set, we may still need to report a pkey fault.
		506	* This is the case if an access was made within a mapping but with no
		507	* page mapped, and POR_EL0 forbids the access (according to
		508	* vma_pkey()). Such access will result in a SIGSEGV regardless
		509	* because core code checks arch_vma_access_permitted(), but in order
		510	* to report the correct error code - SEGV_PKUERR - we must handle
		511	* that case here.
		512	*/
501	return !arch_vma_access_permitted(vma,	513	return !arch_vma_access_permitted(vma,
502	mm_flags & FAULT_FLAG_WRITE,	514	mm_flags & FAULT_FLAG_WRITE,
503	mm_flags & FAULT_FLAG_INSTRUCTION,	515	mm_flags & FAULT_FLAG_INSTRUCTION,
@@ -635,7 +647,7 @@ static int __kprobes do_page_fault(unsigned long far, unsigned long esr, · 131 unmodified lines
635	goto bad_area;	647	goto bad_area;
636	}	648	}
637		649
638	if (fault_from_pkey(esr, vma, mm_flags)) {	650	if (fault_from_pkey(vma, mm_flags)) {
639	pkey = vma_pkey(vma);	651	pkey = vma_pkey(vma);
640	vma_end_read(vma);	652	vma_end_read(vma);
641	fault = 0;	653	fault = 0;
@@ -679,7 +691,7 @@ retry: · 37 unmodified lines
679	goto bad_area;	691	goto bad_area;
680	}	692	}
681		693
682	if (fault_from_pkey(esr, vma, mm_flags)) {	694	if (fault_from_pkey(vma, mm_flags)) {
683	pkey = vma_pkey(vma);	695	pkey = vma_pkey(vma);
684	mmap_read_unlock(mm);	696	mmap_read_unlock(mm);
685	fault = 0;	697	fault = 0;

arch/arm64/mm/proc.S+0−1

@@ -518,7 +518,6 @@ alternative_else_nop_endif · 517 unmodified lines
518	msr REG_PIR_EL1, x0	518	msr REG_PIR_EL1, x0
519		519
520	orr tcr2, tcr2, TCR2_EL1_PIE	520	orr tcr2, tcr2, TCR2_EL1_PIE
521	msr REG_TCR2_EL1, x0
522		521
523	.Lskip_indirection:	522	.Lskip_indirection:
524		523

arch/s390/crypto/sha1_s390.c+2−0

 	sctx->state[4] = SHA1_H4;
 	sctx->count = 0;
 	sctx->func = CPACF_KIMD_SHA_1;
+	sctx->first_message_part = 0;
 	return 0;
 }
 	sctx->count = ictx->count;
 	memcpy(sctx->state, ictx->state, sizeof(ictx->state));
 	sctx->func = CPACF_KIMD_SHA_1;
+	sctx->first_message_part = 0;
 	return 0;
 }

arch/s390/crypto/sha512_s390.c+3−0

 	ctx->count = 0;
 	ctx->sha512.count_hi = 0;
 	ctx->func = CPACF_KIMD_SHA_512;
+	ctx->first_message_part = 0;
 	return 0;
 }
 	memcpy(sctx->state, ictx->state, sizeof(ictx->state));
 	sctx->func = CPACF_KIMD_SHA_512;
+	sctx->first_message_part = 0;
 	return 0;
 }
 	ctx->count = 0;
 	ctx->sha512.count_hi = 0;
 	ctx->func = CPACF_KIMD_SHA_512;
+	ctx->first_message_part = 0;
 	return 0;
 }

arch/x86/Kconfig+10−1

 	select ARCH_WANTS_DYNAMIC_TASK_STRUCT
 	select ARCH_WANTS_NO_INSTR
 	select ARCH_WANT_GENERAL_HUGETLB
-	select ARCH_WANT_HUGE_PMD_SHARE
+	select ARCH_WANT_HUGE_PMD_SHARE		if X86_64
 	select ARCH_WANT_LD_ORPHAN_WARN
 	select ARCH_WANT_OPTIMIZE_DAX_VMEMMAP	if X86_64
 	select ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP	if X86_64
 	  disabled, mitigation cannot be enabled via cmdline.
 	  See <file:Documentation/admin-guide/hw-vuln/indirect-target-selection.rst>
+config MITIGATION_TSA
+	bool "Mitigate Transient Scheduler Attacks"
+	depends on CPU_SUP_AMD
+	default y
+	help
+	  Enable mitigation for Transient Scheduler Attacks. TSA is a hardware
+	  security vulnerability on AMD CPUs which can lead to forwarding of
+	  invalid info to subsequent instructions and thus can affect their
+	  timing and thereby cause a leakage.
 endif
 config ARCH_HAS_ADD_PAGES

arch/x86/entry/entry.S+4−4

@@ -36,20 +36,20 @@ EXPORT_SYMBOL_GPL(write_ibpb); · 35 unmodified lines
36		36
37	/*	37	/*
38	* Define the VERW operand that is disguised as entry code so that	38	* Define the VERW operand that is disguised as entry code so that
39	* it can be referenced with KPTI enabled. This ensure VERW can be	39	* it can be referenced with KPTI enabled. This ensures VERW can be
40	* used late in exit-to-user path after page tables are switched.	40	* used late in exit-to-user path after page tables are switched.
41	*/	41	*/
42	.pushsection .entry.text, "ax"	42	.pushsection .entry.text, "ax"
43		43
44	.align L1_CACHE_BYTES, 0xcc	44	.align L1_CACHE_BYTES, 0xcc
45	SYM_CODE_START_NOALIGN(mds_verw_sel)	45	SYM_CODE_START_NOALIGN(x86_verw_sel)
46	UNWIND_HINT_UNDEFINED	46	UNWIND_HINT_UNDEFINED
47	ANNOTATE_NOENDBR	47	ANNOTATE_NOENDBR
48	.word __KERNEL_DS	48	.word __KERNEL_DS
49	.align L1_CACHE_BYTES, 0xcc	49	.align L1_CACHE_BYTES, 0xcc
50	SYM_CODE_END(mds_verw_sel);	50	SYM_CODE_END(x86_verw_sel);
51	/* For KVM */	51	/* For KVM */
52	EXPORT_SYMBOL_GPL(mds_verw_sel);	52	EXPORT_SYMBOL_GPL(x86_verw_sel);
53		53
54	.popsection	54	.popsection
55		55

arch/x86/include/asm/cpufeatures.h+5−1

@@ -456,6 +456,7 @@ · 455 unmodified lines
456	#define X86_FEATURE_NO_NESTED_DATA_BP (2032+ 0) / No Nested Data Breakpoints */	456	#define X86_FEATURE_NO_NESTED_DATA_BP (2032+ 0) / No Nested Data Breakpoints */
457	#define X86_FEATURE_WRMSR_XX_BASE_NS (2032+ 1) / WRMSR to {FS,GS,KERNEL_GS}_BASE is non-serializing */	457	#define X86_FEATURE_WRMSR_XX_BASE_NS (2032+ 1) / WRMSR to {FS,GS,KERNEL_GS}_BASE is non-serializing */
458	#define X86_FEATURE_LFENCE_RDTSC (2032+ 2) / LFENCE always serializing / synchronizes RDTSC */	458	#define X86_FEATURE_LFENCE_RDTSC (2032+ 2) / LFENCE always serializing / synchronizes RDTSC */
		459	#define X86_FEATURE_VERW_CLEAR (2032+ 5) / The memory form of VERW mitigates TSA */
459	#define X86_FEATURE_NULL_SEL_CLR_BASE (2032+ 6) / Null Selector Clears Base */	460	#define X86_FEATURE_NULL_SEL_CLR_BASE (2032+ 6) / Null Selector Clears Base */
460	#define X86_FEATURE_AUTOIBRS (2032+ 8) / Automatic IBRS */	461	#define X86_FEATURE_AUTOIBRS (2032+ 8) / Automatic IBRS */
461	#define X86_FEATURE_NO_SMM_CTL_MSR (2032+ 9) / SMM_CTL MSR is not present */	462	#define X86_FEATURE_NO_SMM_CTL_MSR (2032+ 9) / SMM_CTL MSR is not present */
@@ -487,6 +488,9 @@ · 25 unmodified lines
487	#define X86_FEATURE_PREFER_YMM (2132+ 8) / Avoid ZMM registers due to downclocking */	488	#define X86_FEATURE_PREFER_YMM (2132+ 8) / Avoid ZMM registers due to downclocking */
488	#define X86_FEATURE_APX (2132+ 9) / Advanced Performance Extensions */	489	#define X86_FEATURE_APX (2132+ 9) / Advanced Performance Extensions */
489	#define X86_FEATURE_INDIRECT_THUNK_ITS (2132+10) / Use thunk for indirect branches in lower half of cacheline */	490	#define X86_FEATURE_INDIRECT_THUNK_ITS (2132+10) / Use thunk for indirect branches in lower half of cacheline */
		491	#define X86_FEATURE_TSA_SQ_NO (2132+11) / AMD CPU not vulnerable to TSA-SQ */
		492	#define X86_FEATURE_TSA_L1_NO (2132+12) / AMD CPU not vulnerable to TSA-L1 */
		493	#define X86_FEATURE_CLEAR_CPU_BUF_VM (2132+13) / Clear CPU buffers using VERW before VMRUN */
490		494
491	/*	495	/*
492	* BUG word(s)	496	* BUG word(s)
@@ -542,5 +546,5 @@ · 49 unmodified lines
542	#define X86_BUG_OLD_MICROCODE X86_BUG( 132+ 6) / "old_microcode" CPU has old microcode, it is surely vulnerable to something */	546	#define X86_BUG_OLD_MICROCODE X86_BUG( 132+ 6) / "old_microcode" CPU has old microcode, it is surely vulnerable to something */
543	#define X86_BUG_ITS X86_BUG( 132+ 7) / "its" CPU is affected by Indirect Target Selection */	547	#define X86_BUG_ITS X86_BUG( 132+ 7) / "its" CPU is affected by Indirect Target Selection */
544	#define X86_BUG_ITS_NATIVE_ONLY X86_BUG( 132+ 8) / "its_native_only" CPU is affected by ITS, VMX is not affected */	548	#define X86_BUG_ITS_NATIVE_ONLY X86_BUG( 132+ 8) / "its_native_only" CPU is affected by ITS, VMX is not affected */
545		549	#define X86_BUG_TSA X86_BUG( 132+ 9) / "tsa" CPU is affected by Transient Scheduler Attacks */
546	#endif /* _ASM_X86_CPUFEATURES_H */	550	#endif /* _ASM_X86_CPUFEATURES_H */

arch/x86/include/asm/irqflags.h+2−2

@@ -44,13 +44,13 @@ static __always_inline void native_irq_enable(void) · 43 unmodified lines
44		44
45	static __always_inline void native_safe_halt(void)	45	static __always_inline void native_safe_halt(void)
46	{	46	{
47	mds_idle_clear_cpu_buffers();	47	x86_idle_clear_cpu_buffers();
48	asm volatile("sti; hlt": : :"memory");	48	asm volatile("sti; hlt": : :"memory");
49	}	49	}
50		50
51	static __always_inline void native_halt(void)	51	static __always_inline void native_halt(void)
52	{	52	{
53	mds_idle_clear_cpu_buffers();	53	x86_idle_clear_cpu_buffers();
54	asm volatile("hlt": : :"memory");	54	asm volatile("hlt": : :"memory");
55	}	55	}
56		56

arch/x86/include/asm/kvm_host.h+7−1

 	struct kvm_vcpu_hv_tlb_flush_fifo tlb_flush_fifo[HV_NR_TLB_FLUSH_FIFOS];
-	/* Preallocated buffer for handling hypercalls passing sparse vCPU set */
+	/*
+	 * Preallocated buffers for handling hypercalls that pass sparse vCPU
+	 * sets (for high vCPU counts, they're too large to comfortably fit on
+	 * the stack).
+	 */
 	u64 sparse_banks[HV_MAX_SPARSE_VCPU_BANKS];
+	DECLARE_BITMAP(vcpu_mask, KVM_MAX_VCPUS);
 	struct hv_vp_assist_page vp_assist_page;
 	CPUID_8000_0022_EAX,
 	CPUID_7_2_EDX,
 	CPUID_24_0_EBX,
+	CPUID_8000_0021_ECX,
 	NR_KVM_CPU_CAPS,
 	NKVMCAPINTS = NR_KVM_CPU_CAPS - NCAPINTS,

arch/x86/include/asm/msr-index.h+1−0

@@ -628,6 +628,7 @@ · 627 unmodified lines
628	#define MSR_AMD64_OSVW_STATUS 0xc0010141	628	#define MSR_AMD64_OSVW_STATUS 0xc0010141
629	#define MSR_AMD_PPIN_CTL 0xc00102f0	629	#define MSR_AMD_PPIN_CTL 0xc00102f0
630	#define MSR_AMD_PPIN 0xc00102f1	630	#define MSR_AMD_PPIN 0xc00102f1
		631	#define MSR_AMD64_CPUID_FN_7 0xc0011002
631	#define MSR_AMD64_CPUID_FN_1 0xc0011004	632	#define MSR_AMD64_CPUID_FN_1 0xc0011004
632	#define MSR_AMD64_LS_CFG 0xc0011020	633	#define MSR_AMD64_LS_CFG 0xc0011020
633	#define MSR_AMD64_DC_CFG 0xc0011022	634	#define MSR_AMD64_DC_CFG 0xc0011022

arch/x86/include/asm/mwait.h+16−11

@@ -43,8 +43,6 @@ static __always_inline void __monitorx(const void *eax, u32 ecx, u32 edx) · 42 unmodified lines
43		43
44	static __always_inline void __mwait(u32 eax, u32 ecx)	44	static __always_inline void __mwait(u32 eax, u32 ecx)
45	{	45	{
46	mds_idle_clear_cpu_buffers();
47
48	/*	46	/*
49	* Use the instruction mnemonic with implicit operands, as the LLVM	47	* Use the instruction mnemonic with implicit operands, as the LLVM
50	* assembler fails to assemble the mnemonic with explicit operands:	48	* assembler fails to assemble the mnemonic with explicit operands:
@@ -80,7 +78,7 @@ static __always_inline void __mwait(u32 eax, u32 ecx) · 29 unmodified lines
80	*/	78	*/
81	static __always_inline void __mwaitx(u32 eax, u32 ebx, u32 ecx)	79	static __always_inline void __mwaitx(u32 eax, u32 ebx, u32 ecx)
82	{	80	{
83	/* No MDS buffer clear as this is AMD/HYGON only */	81	/* No need for TSA buffer clearing on AMD */
84		82
85	/* "mwaitx %eax, %ebx, %ecx" */	83	/* "mwaitx %eax, %ebx, %ecx" */
86	asm volatile(".byte 0x0f, 0x01, 0xfb"	84	asm volatile(".byte 0x0f, 0x01, 0xfb"
@@ -98,7 +96,6 @@ static __always_inline void __mwaitx(u32 eax, u32 ebx, u32 ecx) · 11 unmodified lines
98	*/	96	*/
99	static __always_inline void __sti_mwait(u32 eax, u32 ecx)	97	static __always_inline void __sti_mwait(u32 eax, u32 ecx)
100	{	98	{
101	mds_idle_clear_cpu_buffers();
102		99
103	asm volatile("sti; mwait" :: "a" (eax), "c" (ecx));	100	asm volatile("sti; mwait" :: "a" (eax), "c" (ecx));
104	}	101	}
@@ -115,21 +112,29 @@ static __always_inline void __sti_mwait(u32 eax, u32 ecx) · 10 unmodified lines
115	*/	112	*/
116	static __always_inline void mwait_idle_with_hints(u32 eax, u32 ecx)	113	static __always_inline void mwait_idle_with_hints(u32 eax, u32 ecx)
117	{	114	{
		115	if (need_resched())
		116	return;
		117
		118	x86_idle_clear_cpu_buffers();
		119
118	if (static_cpu_has_bug(X86_BUG_MONITOR) \|\| !current_set_polling_and_test()) {	120	if (static_cpu_has_bug(X86_BUG_MONITOR) \|\| !current_set_polling_and_test()) {
119	const void *addr = &current_thread_info()->flags;	121	const void *addr = &current_thread_info()->flags;
120		122
121	alternative_input("", "clflush (%[addr])", X86_BUG_CLFLUSH_MONITOR, [addr] "a" (addr));	123	alternative_input("", "clflush (%[addr])", X86_BUG_CLFLUSH_MONITOR, [addr] "a" (addr));
122	__monitor(addr, 0, 0);	124	__monitor(addr, 0, 0);
123		125
124	if (!need_resched()) {	126	if (need_resched())
125	if (ecx & 1) {	127	goto out;
126	__mwait(eax, ecx);	128
127	} else {	129	if (ecx & 1) {
128	__sti_mwait(eax, ecx);	130	__mwait(eax, ecx);
129	raw_local_irq_disable();	131	} else {
130	}	132	__sti_mwait(eax, ecx);
		133	raw_local_irq_disable();
131	}	134	}
132	}	135	}
		136
		137	out:
133	current_clr_polling();	138	current_clr_polling();
134	}	139	}
135		140

arch/x86/include/asm/nospec-branch.h+22−15

 .endm
 /*
- * Macro to execute VERW instruction that mitigate transient data sampling
+ * Macro to execute VERW insns that mitigate transient data sampling
- * attacks such as MDS. On affected systems a microcode update overloaded VERW
+ * attacks such as MDS or TSA. On affected systems a microcode update
- * instruction to also clear the CPU buffers. VERW clobbers CFLAGS.ZF.
+ * overloaded VERW insns to also clear the CPU buffers. VERW clobbers
- *
+ * CFLAGS.ZF.
  * Note: Only the memory operand variant of VERW clears the CPU buffers.
  */
-.macro CLEAR_CPU_BUFFERS
+.macro __CLEAR_CPU_BUFFERS feature
 #ifdef CONFIG_X86_64
-	ALTERNATIVE "", "verw mds_verw_sel(%rip)", X86_FEATURE_CLEAR_CPU_BUF
+	ALTERNATIVE "", "verw x86_verw_sel(%rip)", \feature
 #else
 	/*
 	 * In 32bit mode, the memory operand must be a %cs reference. The data
 	 * segments may not be usable (vm86 mode), and the stack segment may not
 	 * be flat (ESPFIX32).
 	 */
-	ALTERNATIVE "", "verw %cs:mds_verw_sel", X86_FEATURE_CLEAR_CPU_BUF
+	ALTERNATIVE "", "verw %cs:x86_verw_sel", \feature
 #endif
 .endm
+#define CLEAR_CPU_BUFFERS \
+	__CLEAR_CPU_BUFFERS X86_FEATURE_CLEAR_CPU_BUF
+#define VM_CLEAR_CPU_BUFFERS \
+	__CLEAR_CPU_BUFFERS X86_FEATURE_CLEAR_CPU_BUF_VM
 #ifdef CONFIG_X86_64
 .macro CLEAR_BRANCH_HISTORY
 	ALTERNATIVE "", "call clear_bhb_loop", X86_FEATURE_CLEAR_BHB_LOOP
 DECLARE_STATIC_KEY_FALSE(switch_vcpu_ibpb);
-DECLARE_STATIC_KEY_FALSE(mds_idle_clear);
+DECLARE_STATIC_KEY_FALSE(cpu_buf_idle_clear);
 DECLARE_STATIC_KEY_FALSE(switch_mm_cond_l1d_flush);
 DECLARE_STATIC_KEY_FALSE(cpu_buf_vm_clear);
-extern u16 mds_verw_sel;
+extern u16 x86_verw_sel;
 #include <asm/segment.h>
 /**
- * mds_clear_cpu_buffers - Mitigation for MDS and TAA vulnerability
+ * x86_clear_cpu_buffers - Buffer clearing support for different x86 CPU vulns
  *
  * This uses the otherwise unused and obsolete VERW instruction in
  * combination with microcode which triggers a CPU buffer flush when the
  * instruction is executed.
  */
-static __always_inline void mds_clear_cpu_buffers(void)
+static __always_inline void x86_clear_cpu_buffers(void)
 {
 	static const u16 ds = __KERNEL_DS;
 }
 /**
- * mds_idle_clear_cpu_buffers - Mitigation for MDS vulnerability
+ * x86_idle_clear_cpu_buffers - Buffer clearing support in idle for the MDS
+ * and TSA vulnerabilities.
  *
  * Clear CPU buffers if the corresponding static key is enabled
  */
-static __always_inline void mds_idle_clear_cpu_buffers(void)
+static __always_inline void x86_idle_clear_cpu_buffers(void)
 {
-	if (static_branch_likely(&mds_idle_clear))
+	if (static_branch_likely(&cpu_buf_idle_clear))
-		mds_clear_cpu_buffers();
+		x86_clear_cpu_buffers();
 }
 #endif /* __ASSEMBLER__ */

arch/x86/include/asm/shared/tdx.h+1−0

@@ -72,6 +72,7 @@ · 71 unmodified lines
72	#define TDVMCALL_MAP_GPA 0x10001	72	#define TDVMCALL_MAP_GPA 0x10001
73	#define TDVMCALL_GET_QUOTE 0x10002	73	#define TDVMCALL_GET_QUOTE 0x10002
74	#define TDVMCALL_REPORT_FATAL_ERROR 0x10003	74	#define TDVMCALL_REPORT_FATAL_ERROR 0x10003
		75	#define TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUPT 0x10004ULL
75		76
76	/*	77	/*
77	* TDG.VP.VMCALL Status Codes (returned in R10)	78	* TDG.VP.VMCALL Status Codes (returned in R10)

arch/x86/include/uapi/asm/kvm.h+7−1

@@ -965,7 +965,13 @@ struct kvm_tdx_cmd { · 964 unmodified lines
965	struct kvm_tdx_capabilities {	965	struct kvm_tdx_capabilities {
966	__u64 supported_attrs;	966	__u64 supported_attrs;
967	__u64 supported_xfam;	967	__u64 supported_xfam;
968	__u64 reserved[254];	968
		969	__u64 kernel_tdvmcallinfo_1_r11;
		970	__u64 user_tdvmcallinfo_1_r11;
		971	__u64 kernel_tdvmcallinfo_1_r12;
		972	__u64 user_tdvmcallinfo_1_r12;
		973
		974	__u64 reserved[250];
969		975
970	/* Configurable CPUID bits for userspace */	976	/* Configurable CPUID bits for userspace */
971	struct kvm_cpuid2 cpuid;	977	struct kvm_cpuid2 cpuid;

arch/x86/kernel/cpu/amd.c+54−0

@@ -377,6 +377,47 @@ static void bsp_determine_snp(struct cpuinfo_x86 *c) · 376 unmodified lines
377	#endif	377	#endif
378	}	378	}
379		379
		380	#define ZEN_MODEL_STEP_UCODE(fam, model, step, ucode) \
		381	X86_MATCH_VFM_STEPS(VFM_MAKE(X86_VENDOR_AMD, fam, model), \
		382	step, step, ucode)
		383
		384	static const struct x86_cpu_id amd_tsa_microcode[] = {
		385	ZEN_MODEL_STEP_UCODE(0x19, 0x01, 0x1, 0x0a0011d7),
		386	ZEN_MODEL_STEP_UCODE(0x19, 0x01, 0x2, 0x0a00123b),
		387	ZEN_MODEL_STEP_UCODE(0x19, 0x08, 0x2, 0x0a00820d),
		388	ZEN_MODEL_STEP_UCODE(0x19, 0x11, 0x1, 0x0a10114c),
		389	ZEN_MODEL_STEP_UCODE(0x19, 0x11, 0x2, 0x0a10124c),
		390	ZEN_MODEL_STEP_UCODE(0x19, 0x18, 0x1, 0x0a108109),
		391	ZEN_MODEL_STEP_UCODE(0x19, 0x21, 0x0, 0x0a20102e),
		392	ZEN_MODEL_STEP_UCODE(0x19, 0x21, 0x2, 0x0a201211),
		393	ZEN_MODEL_STEP_UCODE(0x19, 0x44, 0x1, 0x0a404108),
		394	ZEN_MODEL_STEP_UCODE(0x19, 0x50, 0x0, 0x0a500012),
		395	ZEN_MODEL_STEP_UCODE(0x19, 0x61, 0x2, 0x0a60120a),
		396	ZEN_MODEL_STEP_UCODE(0x19, 0x74, 0x1, 0x0a704108),
		397	ZEN_MODEL_STEP_UCODE(0x19, 0x75, 0x2, 0x0a705208),
		398	ZEN_MODEL_STEP_UCODE(0x19, 0x78, 0x0, 0x0a708008),
		399	ZEN_MODEL_STEP_UCODE(0x19, 0x7c, 0x0, 0x0a70c008),
		400	ZEN_MODEL_STEP_UCODE(0x19, 0xa0, 0x2, 0x0aa00216),
		401	{},
		402	};
		403
		404	static void tsa_init(struct cpuinfo_x86 *c)
		405	{
		406	if (cpu_has(c, X86_FEATURE_HYPERVISOR))
		407	return;
		408
		409	if (cpu_has(c, X86_FEATURE_ZEN3) \|\|
		410	cpu_has(c, X86_FEATURE_ZEN4)) {
		411	if (x86_match_min_microcode_rev(amd_tsa_microcode))
		412	setup_force_cpu_cap(X86_FEATURE_VERW_CLEAR);
		413	else
		414	pr_debug("%s: current revision: 0x%x\n", __func__, c->microcode);
		415	} else {
		416	setup_force_cpu_cap(X86_FEATURE_TSA_SQ_NO);
		417	setup_force_cpu_cap(X86_FEATURE_TSA_L1_NO);
		418	}
		419	}
		420
380	static void bsp_init_amd(struct cpuinfo_x86 *c)	421	static void bsp_init_amd(struct cpuinfo_x86 *c)
381	{	422	{
382	if (cpu_has(c, X86_FEATURE_CONSTANT_TSC)) {	423	if (cpu_has(c, X86_FEATURE_CONSTANT_TSC)) {
@@ -489,6 +530,9 @@ static void bsp_init_amd(struct cpuinfo_x86 *c) · 106 unmodified lines
489	}	530	}
490		531
491	bsp_determine_snp(c);	532	bsp_determine_snp(c);
		533
		534	tsa_init(c);
		535
492	return;	536	return;
493		537
494	warn:	538	warn:
@@ -930,6 +974,16 @@ static void init_amd_zen2(struct cpuinfo_x86 *c) · 435 unmodified lines
930	init_spectral_chicken(c);	974	init_spectral_chicken(c);
931	fix_erratum_1386(c);	975	fix_erratum_1386(c);
932	zen2_zenbleed_check(c);	976	zen2_zenbleed_check(c);
		977
		978	/* Disable RDSEED on AMD Cyan Skillfish because of an error. */
		979	if (c->x86_model == 0x47 && c->x86_stepping == 0x0) {
		980	clear_cpu_cap(c, X86_FEATURE_RDSEED);
		981	msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18);
		982	pr_emerg("RDSEED is not reliable on this platform; disabling.\n");
		983	}
		984
		985	/* Correct misconfigured CPUID on some clients. */
		986	clear_cpu_cap(c, X86_FEATURE_INVLPGB);
933	}	987	}
934		988
935	static void init_amd_zen3(struct cpuinfo_x86 *c)	989	static void init_amd_zen3(struct cpuinfo_x86 *c)

arch/x86/kernel/cpu/bugs.c+130−6

@@ -94,6 +94,8 @@ static void __init bhi_apply_mitigation(void); · 93 unmodified lines
94	static void __init its_select_mitigation(void);	94	static void __init its_select_mitigation(void);
95	static void __init its_update_mitigation(void);	95	static void __init its_update_mitigation(void);
96	static void __init its_apply_mitigation(void);	96	static void __init its_apply_mitigation(void);
		97	static void __init tsa_select_mitigation(void);
		98	static void __init tsa_apply_mitigation(void);
97		99
98	/* The base value of the SPEC_CTRL MSR without task-specific bits set */	100	/* The base value of the SPEC_CTRL MSR without task-specific bits set */
99	u64 x86_spec_ctrl_base;	101	u64 x86_spec_ctrl_base;
@@ -169,9 +171,9 @@ DEFINE_STATIC_KEY_FALSE(switch_mm_always_ibpb); · 69 unmodified lines
169	DEFINE_STATIC_KEY_FALSE(switch_vcpu_ibpb);	171	DEFINE_STATIC_KEY_FALSE(switch_vcpu_ibpb);
170	EXPORT_SYMBOL_GPL(switch_vcpu_ibpb);	172	EXPORT_SYMBOL_GPL(switch_vcpu_ibpb);
171		173
172	/* Control MDS CPU buffer clear before idling (halt, mwait) */	174	/* Control CPU buffer clear before idling (halt, mwait) */
173	DEFINE_STATIC_KEY_FALSE(mds_idle_clear);	175	DEFINE_STATIC_KEY_FALSE(cpu_buf_idle_clear);
174	EXPORT_SYMBOL_GPL(mds_idle_clear);	176	EXPORT_SYMBOL_GPL(cpu_buf_idle_clear);
175		177
176	/*	178	/*
177	* Controls whether l1d flush based mitigations are enabled,	179	* Controls whether l1d flush based mitigations are enabled,
@@ -225,6 +227,7 @@ void __init cpu_select_mitigations(void) · 47 unmodified lines
225	gds_select_mitigation();	227	gds_select_mitigation();
226	its_select_mitigation();	228	its_select_mitigation();
227	bhi_select_mitigation();	229	bhi_select_mitigation();
		230	tsa_select_mitigation();
228		231
229	/*	232	/*
230	* After mitigations are selected, some may need to update their	233	* After mitigations are selected, some may need to update their
@@ -272,6 +275,7 @@ void __init cpu_select_mitigations(void) · 41 unmodified lines
272	gds_apply_mitigation();	275	gds_apply_mitigation();
273	its_apply_mitigation();	276	its_apply_mitigation();
274	bhi_apply_mitigation();	277	bhi_apply_mitigation();
		278	tsa_apply_mitigation();
275	}	279	}
276		280
277	/*	281	/*
@@ -637,7 +641,7 @@ static void __init mmio_apply_mitigation(void) · 359 unmodified lines
637	* is required irrespective of SMT state.	641	* is required irrespective of SMT state.
638	*/	642	*/
639	if (!(x86_arch_cap_msr & ARCH_CAP_FBSDP_NO))	643	if (!(x86_arch_cap_msr & ARCH_CAP_FBSDP_NO))
640	static_branch_enable(&mds_idle_clear);	644	static_branch_enable(&cpu_buf_idle_clear);
641		645
642	if (mmio_nosmt \|\| cpu_mitigations_auto_nosmt())	646	if (mmio_nosmt \|\| cpu_mitigations_auto_nosmt())
643	cpu_smt_disable(false);	647	cpu_smt_disable(false);
@@ -1487,6 +1491,94 @@ static void __init its_apply_mitigation(void) · 843 unmodified lines
1487	set_return_thunk(its_return_thunk);	1491	set_return_thunk(its_return_thunk);
1488	}	1492	}
1489		1493
		1494	#undef pr_fmt
		1495	#define pr_fmt(fmt) "Transient Scheduler Attacks: " fmt
		1496
		1497	enum tsa_mitigations {
		1498	TSA_MITIGATION_NONE,
		1499	TSA_MITIGATION_AUTO,
		1500	TSA_MITIGATION_UCODE_NEEDED,
		1501	TSA_MITIGATION_USER_KERNEL,
		1502	TSA_MITIGATION_VM,
		1503	TSA_MITIGATION_FULL,
		1504	};
		1505
		1506	static const char * const tsa_strings[] = {
		1507	[TSA_MITIGATION_NONE] = "Vulnerable",
		1508	[TSA_MITIGATION_UCODE_NEEDED] = "Vulnerable: No microcode",
		1509	[TSA_MITIGATION_USER_KERNEL] = "Mitigation: Clear CPU buffers: user/kernel boundary",
		1510	[TSA_MITIGATION_VM] = "Mitigation: Clear CPU buffers: VM",
		1511	[TSA_MITIGATION_FULL] = "Mitigation: Clear CPU buffers",
		1512	};
		1513
		1514	static enum tsa_mitigations tsa_mitigation __ro_after_init =
		1515	IS_ENABLED(CONFIG_MITIGATION_TSA) ? TSA_MITIGATION_AUTO : TSA_MITIGATION_NONE;
		1516
		1517	static int __init tsa_parse_cmdline(char *str)
		1518	{
		1519	if (!str)
		1520	return -EINVAL;
		1521
		1522	if (!strcmp(str, "off"))
		1523	tsa_mitigation = TSA_MITIGATION_NONE;
		1524	else if (!strcmp(str, "on"))
		1525	tsa_mitigation = TSA_MITIGATION_FULL;
		1526	else if (!strcmp(str, "user"))
		1527	tsa_mitigation = TSA_MITIGATION_USER_KERNEL;
		1528	else if (!strcmp(str, "vm"))
		1529	tsa_mitigation = TSA_MITIGATION_VM;
		1530	else
		1531	pr_err("Ignoring unknown tsa=%s option.\n", str);
		1532
		1533	return 0;
		1534	}
		1535	early_param("tsa", tsa_parse_cmdline);
		1536
		1537	static void __init tsa_select_mitigation(void)
		1538	{
		1539	if (cpu_mitigations_off() \|\| !boot_cpu_has_bug(X86_BUG_TSA)) {
		1540	tsa_mitigation = TSA_MITIGATION_NONE;
		1541	return;
		1542	}
		1543
		1544	if (tsa_mitigation == TSA_MITIGATION_NONE)
		1545	return;
		1546
		1547	if (!boot_cpu_has(X86_FEATURE_VERW_CLEAR)) {
		1548	tsa_mitigation = TSA_MITIGATION_UCODE_NEEDED;
		1549	goto out;
		1550	}
		1551
		1552	if (tsa_mitigation == TSA_MITIGATION_AUTO)
		1553	tsa_mitigation = TSA_MITIGATION_FULL;
		1554
		1555	/*
		1556	* No need to set verw_clear_cpu_buf_mitigation_selected - it
		1557	* doesn't fit all cases here and it is not needed because this
		1558	* is the only VERW-based mitigation on AMD.
		1559	*/
		1560	out:
		1561	pr_info("%s\n", tsa_strings[tsa_mitigation]);
		1562	}
		1563
		1564	static void __init tsa_apply_mitigation(void)
		1565	{
		1566	switch (tsa_mitigation) {
		1567	case TSA_MITIGATION_USER_KERNEL:
		1568	setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
		1569	break;
		1570	case TSA_MITIGATION_VM:
		1571	setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF_VM);
		1572	break;
		1573	case TSA_MITIGATION_FULL:
		1574	setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
		1575	setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF_VM);
		1576	break;
		1577	default:
		1578	break;
		1579	}
		1580	}
		1581
1490	#undef pr_fmt	1582	#undef pr_fmt
1491	#define pr_fmt(fmt) "Spectre V2 : " fmt	1583	#define pr_fmt(fmt) "Spectre V2 : " fmt
1492		1584
@@ -2249,10 +2341,10 @@ static void update_mds_branch_idle(void) · 756 unmodified lines
2249	return;	2341	return;
2250		2342
2251	if (sched_smt_active()) {	2343	if (sched_smt_active()) {
2252	static_branch_enable(&mds_idle_clear);	2344	static_branch_enable(&cpu_buf_idle_clear);
2253	} else if (mmio_mitigation == MMIO_MITIGATION_OFF \|\|	2345	} else if (mmio_mitigation == MMIO_MITIGATION_OFF \|\|
2254	(x86_arch_cap_msr & ARCH_CAP_FBSDP_NO)) {	2346	(x86_arch_cap_msr & ARCH_CAP_FBSDP_NO)) {
2255	static_branch_disable(&mds_idle_clear);	2347	static_branch_disable(&cpu_buf_idle_clear);
2256	}	2348	}
2257	}	2349	}
2258		2350
@@ -2316,6 +2408,25 @@ void cpu_bugs_smt_update(void) · 57 unmodified lines
2316	break;	2408	break;
2317	}	2409	}
2318		2410
		2411	switch (tsa_mitigation) {
		2412	case TSA_MITIGATION_USER_KERNEL:
		2413	case TSA_MITIGATION_VM:
		2414	case TSA_MITIGATION_AUTO:
		2415	case TSA_MITIGATION_FULL:
		2416	/*
		2417	* TSA-SQ can potentially lead to info leakage between
		2418	* SMT threads.
		2419	*/
		2420	if (sched_smt_active())
		2421	static_branch_enable(&cpu_buf_idle_clear);
		2422	else
		2423	static_branch_disable(&cpu_buf_idle_clear);
		2424	break;
		2425	case TSA_MITIGATION_NONE:
		2426	case TSA_MITIGATION_UCODE_NEEDED:
		2427	break;
		2428	}
		2429
2319	mutex_unlock(&spec_ctrl_mutex);	2430	mutex_unlock(&spec_ctrl_mutex);
2320	}	2431	}
2321		2432
@@ -3265,6 +3376,11 @@ static ssize_t gds_show_state(char *buf) · 943 unmodified lines
3265	return sysfs_emit(buf, "%s\n", gds_strings[gds_mitigation]);	3376	return sysfs_emit(buf, "%s\n", gds_strings[gds_mitigation]);
3266	}	3377	}
3267		3378
		3379	static ssize_t tsa_show_state(char *buf)
		3380	{
		3381	return sysfs_emit(buf, "%s\n", tsa_strings[tsa_mitigation]);
		3382	}
		3383
3268	static ssize_t cpu_show_common(struct device dev, struct device_attribute attr,	3384	static ssize_t cpu_show_common(struct device dev, struct device_attribute attr,
3269	char *buf, unsigned int bug)	3385	char *buf, unsigned int bug)
3270	{	3386	{
@@ -3328,6 +3444,9 @@ static ssize_t cpu_show_common(struct device dev, struct device_attribute attr · 57 unmodified lines
3328	case X86_BUG_ITS:	3444	case X86_BUG_ITS:
3329	return its_show_state(buf);	3445	return its_show_state(buf);
3330		3446
		3447	case X86_BUG_TSA:
		3448	return tsa_show_state(buf);
		3449
3331	default:	3450	default:
3332	break;	3451	break;
3333	}	3452	}
@@ -3414,6 +3533,11 @@ ssize_t cpu_show_indirect_target_selection(struct device *dev, struct device_att · 80 unmodified lines
3414	{	3533	{
3415	return cpu_show_common(dev, attr, buf, X86_BUG_ITS);	3534	return cpu_show_common(dev, attr, buf, X86_BUG_ITS);
3416	}	3535	}
		3536
		3537	ssize_t cpu_show_tsa(struct device dev, struct device_attribute attr, char *buf)
		3538	{
		3539	return cpu_show_common(dev, attr, buf, X86_BUG_TSA);
		3540	}
3417	#endif	3541	#endif
3418		3542
3419	void __warn_thunk(void)	3543	void __warn_thunk(void)

arch/x86/kernel/cpu/common.c+13−1

 #define ITS		BIT(8)
 /* CPU is affected by Indirect Target Selection, but guest-host isolation is not affected */
 #define ITS_NATIVE_ONLY	BIT(9)
+/* CPU is affected by Transient Scheduler Attacks */
+#define TSA		BIT(10)
 static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
 	VULNBL_INTEL_STEPS(INTEL_IVYBRIDGE,	     X86_STEP_MAX,	SRBDS),
 	VULNBL_AMD(0x16, RETBLEED),
 	VULNBL_AMD(0x17, RETBLEED | SMT_RSB | SRSO),
 	VULNBL_HYGON(0x18, RETBLEED | SMT_RSB | SRSO),
-	VULNBL_AMD(0x19, SRSO),
+	VULNBL_AMD(0x19, SRSO | TSA),
 	VULNBL_AMD(0x1a, SRSO),
 	{}
 };
 			setup_force_cpu_bug(X86_BUG_ITS_NATIVE_ONLY);
 	}
+	if (c->x86_vendor == X86_VENDOR_AMD) {
+		if (!cpu_has(c, X86_FEATURE_TSA_SQ_NO) ||
+		    !cpu_has(c, X86_FEATURE_TSA_L1_NO)) {
+			if (cpu_matches(cpu_vuln_blacklist, TSA) ||
+			    /* Enable bug on Zen guests to allow for live migration. */
+			    (cpu_has(c, X86_FEATURE_HYPERVISOR) && cpu_has(c, X86_FEATURE_ZEN)))
+				setup_force_cpu_bug(X86_BUG_TSA);
+		}
+	}
 	if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN))
 		return;

arch/x86/kernel/cpu/microcode/amd_shas.c+112−0

@@ -231,6 +231,13 @@ static const struct patch_digest phashes[] = { · 230 unmodified lines
231	0x0d,0x5b,0x65,0x34,0x69,0xb2,0x62,0x21,	231	0x0d,0x5b,0x65,0x34,0x69,0xb2,0x62,0x21,
232	}	232	}
233	},	233	},
		234	{ 0xa0011d7, {
		235	0x35,0x07,0xcd,0x40,0x94,0xbc,0x81,0x6b,
		236	0xfc,0x61,0x56,0x1a,0xe2,0xdb,0x96,0x12,
		237	0x1c,0x1c,0x31,0xb1,0x02,0x6f,0xe5,0xd2,
		238	0xfe,0x1b,0x04,0x03,0x2c,0x8f,0x4c,0x36,
		239	}
		240	},
234	{ 0xa001223, {	241	{ 0xa001223, {
235	0xfb,0x32,0x5f,0xc6,0x83,0x4f,0x8c,0xb8,	242	0xfb,0x32,0x5f,0xc6,0x83,0x4f,0x8c,0xb8,
236	0xa4,0x05,0xf9,0x71,0x53,0x01,0x16,0xc4,	243	0xa4,0x05,0xf9,0x71,0x53,0x01,0x16,0xc4,
@@ -294,6 +301,13 @@ static const struct patch_digest phashes[] = { · 57 unmodified lines
294	0xc0,0xcd,0x33,0xf2,0x8d,0xf9,0xef,0x59,	301	0xc0,0xcd,0x33,0xf2,0x8d,0xf9,0xef,0x59,
295	}	302	}
296	},	303	},
		304	{ 0xa00123b, {
		305	0xef,0xa1,0x1e,0x71,0xf1,0xc3,0x2c,0xe2,
		306	0xc3,0xef,0x69,0x41,0x7a,0x54,0xca,0xc3,
		307	0x8f,0x62,0x84,0xee,0xc2,0x39,0xd9,0x28,
		308	0x95,0xa7,0x12,0x49,0x1e,0x30,0x71,0x72,
		309	}
		310	},
297	{ 0xa00820c, {	311	{ 0xa00820c, {
298	0xa8,0x0c,0x81,0xc0,0xa6,0x00,0xe7,0xf3,	312	0xa8,0x0c,0x81,0xc0,0xa6,0x00,0xe7,0xf3,
299	0x5f,0x65,0xd3,0xb9,0x6f,0xea,0x93,0x63,	313	0x5f,0x65,0xd3,0xb9,0x6f,0xea,0x93,0x63,
@@ -301,6 +315,13 @@ static const struct patch_digest phashes[] = { · 1 unmodified line
301	0xe1,0x3b,0x8d,0xb2,0xf8,0x22,0x03,0xe2,	315	0xe1,0x3b,0x8d,0xb2,0xf8,0x22,0x03,0xe2,
302	}	316	}
303	},	317	},
		318	{ 0xa00820d, {
		319	0xf9,0x2a,0xc0,0xf4,0x9e,0xa4,0x87,0xa4,
		320	0x7d,0x87,0x00,0xfd,0xab,0xda,0x19,0xca,
		321	0x26,0x51,0x32,0xc1,0x57,0x91,0xdf,0xc1,
		322	0x05,0xeb,0x01,0x7c,0x5a,0x95,0x21,0xb7,
		323	}
		324	},
304	{ 0xa10113e, {	325	{ 0xa10113e, {
305	0x05,0x3c,0x66,0xd7,0xa9,0x5a,0x33,0x10,	326	0x05,0x3c,0x66,0xd7,0xa9,0x5a,0x33,0x10,
306	0x1b,0xf8,0x9c,0x8f,0xed,0xfc,0xa7,0xa0,	327	0x1b,0xf8,0x9c,0x8f,0xed,0xfc,0xa7,0xa0,
@@ -322,6 +343,13 @@ static const struct patch_digest phashes[] = { · 15 unmodified lines
322	0xf1,0x5e,0xb0,0xde,0xb4,0x98,0xae,0xc4,	343	0xf1,0x5e,0xb0,0xde,0xb4,0x98,0xae,0xc4,
323	}	344	}
324	},	345	},
		346	{ 0xa10114c, {
		347	0x9e,0xb6,0xa2,0xd9,0x87,0x38,0xc5,0x64,
		348	0xd8,0x88,0xfa,0x78,0x98,0xf9,0x6f,0x74,
		349	0x39,0x90,0x1b,0xa5,0xcf,0x5e,0xb4,0x2a,
		350	0x02,0xff,0xd4,0x8c,0x71,0x8b,0xe2,0xc0,
		351	}
		352	},
325	{ 0xa10123e, {	353	{ 0xa10123e, {
326	0x03,0xb9,0x2c,0x76,0x48,0x93,0xc9,0x18,	354	0x03,0xb9,0x2c,0x76,0x48,0x93,0xc9,0x18,
327	0xfb,0x56,0xfd,0xf7,0xe2,0x1d,0xca,0x4d,	355	0xfb,0x56,0xfd,0xf7,0xe2,0x1d,0xca,0x4d,
@@ -343,6 +371,13 @@ static const struct patch_digest phashes[] = { · 15 unmodified lines
343	0x1b,0x7d,0x64,0x9d,0x4b,0x53,0x13,0x75,	371	0x1b,0x7d,0x64,0x9d,0x4b,0x53,0x13,0x75,
344	}	372	}
345	},	373	},
		374	{ 0xa10124c, {
		375	0x29,0xea,0xf1,0x2c,0xb2,0xe4,0xef,0x90,
		376	0xa4,0xcd,0x1d,0x86,0x97,0x17,0x61,0x46,
		377	0xfc,0x22,0xcb,0x57,0x75,0x19,0xc8,0xcc,
		378	0x0c,0xf5,0xbc,0xac,0x81,0x9d,0x9a,0xd2,
		379	}
		380	},
346	{ 0xa108108, {	381	{ 0xa108108, {
347	0xed,0xc2,0xec,0xa1,0x15,0xc6,0x65,0xe9,	382	0xed,0xc2,0xec,0xa1,0x15,0xc6,0x65,0xe9,
348	0xd0,0xef,0x39,0xaa,0x7f,0x55,0x06,0xc6,	383	0xd0,0xef,0x39,0xaa,0x7f,0x55,0x06,0xc6,
@@ -350,6 +385,13 @@ static const struct patch_digest phashes[] = { · 1 unmodified line
350	0x28,0x1e,0x9c,0x59,0x69,0x99,0x4d,0x16,	385	0x28,0x1e,0x9c,0x59,0x69,0x99,0x4d,0x16,
351	}	386	}
352	},	387	},
		388	{ 0xa108109, {
		389	0x85,0xb4,0xbd,0x7c,0x49,0xa7,0xbd,0xfa,
		390	0x49,0x36,0x80,0x81,0xc5,0xb7,0x39,0x1b,
		391	0x9a,0xaa,0x50,0xde,0x9b,0xe9,0x32,0x35,
		392	0x42,0x7e,0x51,0x4f,0x52,0x2c,0x28,0x59,
		393	}
		394	},
353	{ 0xa20102d, {	395	{ 0xa20102d, {
354	0xf9,0x6e,0xf2,0x32,0xd3,0x0f,0x5f,0x11,	396	0xf9,0x6e,0xf2,0x32,0xd3,0x0f,0x5f,0x11,
355	0x59,0xa1,0xfe,0xcc,0xcd,0x9b,0x42,0x89,	397	0x59,0xa1,0xfe,0xcc,0xcd,0x9b,0x42,0x89,
@@ -357,6 +399,13 @@ static const struct patch_digest phashes[] = { · 1 unmodified line
357	0x8c,0xe9,0x19,0x3e,0xcc,0x3f,0x7b,0xb4,	399	0x8c,0xe9,0x19,0x3e,0xcc,0x3f,0x7b,0xb4,
358	}	400	}
359	},	401	},
		402	{ 0xa20102e, {
		403	0xbe,0x1f,0x32,0x04,0x0d,0x3c,0x9c,0xdd,
		404	0xe1,0xa4,0xbf,0x76,0x3a,0xec,0xc2,0xf6,
		405	0x11,0x00,0xa7,0xaf,0x0f,0xe5,0x02,0xc5,
		406	0x54,0x3a,0x1f,0x8c,0x16,0xb5,0xff,0xbe,
		407	}
		408	},
360	{ 0xa201210, {	409	{ 0xa201210, {
361	0xe8,0x6d,0x51,0x6a,0x8e,0x72,0xf3,0xfe,	410	0xe8,0x6d,0x51,0x6a,0x8e,0x72,0xf3,0xfe,
362	0x6e,0x16,0xbc,0x62,0x59,0x40,0x17,0xe9,	411	0x6e,0x16,0xbc,0x62,0x59,0x40,0x17,0xe9,
@@ -364,6 +413,13 @@ static const struct patch_digest phashes[] = { · 1 unmodified line
364	0xf7,0x55,0xf0,0x13,0xbb,0x22,0xf6,0x41,	413	0xf7,0x55,0xf0,0x13,0xbb,0x22,0xf6,0x41,
365	}	414	}
366	},	415	},
		416	{ 0xa201211, {
		417	0x69,0xa1,0x17,0xec,0xd0,0xf6,0x6c,0x95,
		418	0xe2,0x1e,0xc5,0x59,0x1a,0x52,0x0a,0x27,
		419	0xc4,0xed,0xd5,0x59,0x1f,0xbf,0x00,0xff,
		420	0x08,0x88,0xb5,0xe1,0x12,0xb6,0xcc,0x27,
		421	}
		422	},
367	{ 0xa404107, {	423	{ 0xa404107, {
368	0xbb,0x04,0x4e,0x47,0xdd,0x5e,0x26,0x45,	424	0xbb,0x04,0x4e,0x47,0xdd,0x5e,0x26,0x45,
369	0x1a,0xc9,0x56,0x24,0xa4,0x4c,0x82,0xb0,	425	0x1a,0xc9,0x56,0x24,0xa4,0x4c,0x82,0xb0,
@@ -371,6 +427,13 @@ static const struct patch_digest phashes[] = { · 1 unmodified line
371	0x13,0xbc,0xc5,0x25,0xe4,0xc5,0xc3,0x99,	427	0x13,0xbc,0xc5,0x25,0xe4,0xc5,0xc3,0x99,
372	}	428	}
373	},	429	},
		430	{ 0xa404108, {
		431	0x69,0x67,0x43,0x06,0xf8,0x0c,0x62,0xdc,
		432	0xa4,0x21,0x30,0x4f,0x0f,0x21,0x2c,0xcb,
		433	0xcc,0x37,0xf1,0x1c,0xc3,0xf8,0x2f,0x19,
		434	0xdf,0x53,0x53,0x46,0xb1,0x15,0xea,0x00,
		435	}
		436	},
374	{ 0xa500011, {	437	{ 0xa500011, {
375	0x23,0x3d,0x70,0x7d,0x03,0xc3,0xc4,0xf4,	438	0x23,0x3d,0x70,0x7d,0x03,0xc3,0xc4,0xf4,
376	0x2b,0x82,0xc6,0x05,0xda,0x80,0x0a,0xf1,	439	0x2b,0x82,0xc6,0x05,0xda,0x80,0x0a,0xf1,
@@ -378,6 +441,13 @@ static const struct patch_digest phashes[] = { · 1 unmodified line
378	0x11,0x5e,0x96,0x7e,0x71,0xe9,0xfc,0x74,	441	0x11,0x5e,0x96,0x7e,0x71,0xe9,0xfc,0x74,
379	}	442	}
380	},	443	},
		444	{ 0xa500012, {
		445	0xeb,0x74,0x0d,0x47,0xa1,0x8e,0x09,0xe4,
		446	0x93,0x4c,0xad,0x03,0x32,0x4c,0x38,0x16,
		447	0x10,0x39,0xdd,0x06,0xaa,0xce,0xd6,0x0f,
		448	0x62,0x83,0x9d,0x8e,0x64,0x55,0xbe,0x63,
		449	}
		450	},
381	{ 0xa601209, {	451	{ 0xa601209, {
382	0x66,0x48,0xd4,0x09,0x05,0xcb,0x29,0x32,	452	0x66,0x48,0xd4,0x09,0x05,0xcb,0x29,0x32,
383	0x66,0xb7,0x9a,0x76,0xcd,0x11,0xf3,0x30,	453	0x66,0xb7,0x9a,0x76,0xcd,0x11,0xf3,0x30,
@@ -385,6 +455,13 @@ static const struct patch_digest phashes[] = { · 1 unmodified line
385	0xe8,0x73,0xe2,0xd6,0xdb,0xd2,0x77,0x1d,	455	0xe8,0x73,0xe2,0xd6,0xdb,0xd2,0x77,0x1d,
386	}	456	}
387	},	457	},
		458	{ 0xa60120a, {
		459	0x0c,0x8b,0x3d,0xfd,0x52,0x52,0x85,0x7d,
		460	0x20,0x3a,0xe1,0x7e,0xa4,0x21,0x3b,0x7b,
		461	0x17,0x86,0xae,0xac,0x13,0xb8,0x63,0x9d,
		462	0x06,0x01,0xd0,0xa0,0x51,0x9a,0x91,0x2c,
		463	}
		464	},
388	{ 0xa704107, {	465	{ 0xa704107, {
389	0xf3,0xc6,0x58,0x26,0xee,0xac,0x3f,0xd6,	466	0xf3,0xc6,0x58,0x26,0xee,0xac,0x3f,0xd6,
390	0xce,0xa1,0x72,0x47,0x3b,0xba,0x2b,0x93,	467	0xce,0xa1,0x72,0x47,0x3b,0xba,0x2b,0x93,
@@ -392,6 +469,13 @@ static const struct patch_digest phashes[] = { · 1 unmodified line
392	0x64,0x39,0x71,0x8c,0xce,0xe7,0x41,0x39,	469	0x64,0x39,0x71,0x8c,0xce,0xe7,0x41,0x39,
393	}	470	}
394	},	471	},
		472	{ 0xa704108, {
		473	0xd7,0x55,0x15,0x2b,0xfe,0xc4,0xbc,0x93,
		474	0xec,0x91,0xa0,0xae,0x45,0xb7,0xc3,0x98,
		475	0x4e,0xff,0x61,0x77,0x88,0xc2,0x70,0x49,
		476	0xe0,0x3a,0x1d,0x84,0x38,0x52,0xbf,0x5a,
		477	}
		478	},
395	{ 0xa705206, {	479	{ 0xa705206, {
396	0x8d,0xc0,0x76,0xbd,0x58,0x9f,0x8f,0xa4,	480	0x8d,0xc0,0x76,0xbd,0x58,0x9f,0x8f,0xa4,
397	0x12,0x9d,0x21,0xfb,0x48,0x21,0xbc,0xe7,	481	0x12,0x9d,0x21,0xfb,0x48,0x21,0xbc,0xe7,
@@ -399,6 +483,13 @@ static const struct patch_digest phashes[] = { · 1 unmodified line
399	0x03,0x35,0xe9,0xbe,0xfb,0x06,0xdf,0xfc,	483	0x03,0x35,0xe9,0xbe,0xfb,0x06,0xdf,0xfc,
400	}	484	}
401	},	485	},
		486	{ 0xa705208, {
		487	0x30,0x1d,0x55,0x24,0xbc,0x6b,0x5a,0x19,
		488	0x0c,0x7d,0x1d,0x74,0xaa,0xd1,0xeb,0xd2,
		489	0x16,0x62,0xf7,0x5b,0xe1,0x1f,0x18,0x11,
		490	0x5c,0xf0,0x94,0x90,0x26,0xec,0x69,0xff,
		491	}
		492	},
402	{ 0xa708007, {	493	{ 0xa708007, {
403	0x6b,0x76,0xcc,0x78,0xc5,0x8a,0xa3,0xe3,	494	0x6b,0x76,0xcc,0x78,0xc5,0x8a,0xa3,0xe3,
404	0x32,0x2d,0x79,0xe4,0xc3,0x80,0xdb,0xb2,	495	0x32,0x2d,0x79,0xe4,0xc3,0x80,0xdb,0xb2,
@@ -406,6 +497,13 @@ static const struct patch_digest phashes[] = { · 1 unmodified line
406	0xdf,0x92,0x73,0x84,0x87,0x3c,0x73,0x93,	497	0xdf,0x92,0x73,0x84,0x87,0x3c,0x73,0x93,
407	}	498	}
408	},	499	},
		500	{ 0xa708008, {
		501	0x08,0x6e,0xf0,0x22,0x4b,0x8e,0xc4,0x46,
		502	0x58,0x34,0xe6,0x47,0xa2,0x28,0xfd,0xab,
		503	0x22,0x3d,0xdd,0xd8,0x52,0x9e,0x1d,0x16,
		504	0xfa,0x01,0x68,0x14,0x79,0x3e,0xe8,0x6b,
		505	}
		506	},
409	{ 0xa70c005, {	507	{ 0xa70c005, {
410	0x88,0x5d,0xfb,0x79,0x64,0xd8,0x46,0x3b,	508	0x88,0x5d,0xfb,0x79,0x64,0xd8,0x46,0x3b,
411	0x4a,0x83,0x8e,0x77,0x7e,0xcf,0xb3,0x0f,	509	0x4a,0x83,0x8e,0x77,0x7e,0xcf,0xb3,0x0f,
@@ -413,6 +511,13 @@ static const struct patch_digest phashes[] = { · 1 unmodified line
413	0xee,0x49,0xac,0xe1,0x8b,0x13,0xc5,0x13,	511	0xee,0x49,0xac,0xe1,0x8b,0x13,0xc5,0x13,
414	}	512	}
415	},	513	},
		514	{ 0xa70c008, {
		515	0x0f,0xdb,0x37,0xa1,0x10,0xaf,0xd4,0x21,
		516	0x94,0x0d,0xa4,0xa2,0xe9,0x86,0x6c,0x0e,
		517	0x85,0x7c,0x36,0x30,0xa3,0x3a,0x78,0x66,
		518	0x18,0x10,0x60,0x0d,0x78,0x3d,0x44,0xd0,
		519	}
		520	},
416	{ 0xaa00116, {	521	{ 0xaa00116, {
417	0xe8,0x4c,0x2c,0x88,0xa1,0xac,0x24,0x63,	522	0xe8,0x4c,0x2c,0x88,0xa1,0xac,0x24,0x63,
418	0x65,0xe5,0xaa,0x2d,0x16,0xa9,0xc3,0xf5,	523	0x65,0xe5,0xaa,0x2d,0x16,0xa9,0xc3,0xf5,
@@ -441,4 +546,11 @@ static const struct patch_digest phashes[] = { · 22 unmodified lines
441	0x68,0x2f,0x46,0xee,0xfe,0xc6,0x6d,0xef,	546	0x68,0x2f,0x46,0xee,0xfe,0xc6,0x6d,0xef,
442	}	547	}
443	},	548	},
		549	{ 0xaa00216, {
		550	0x79,0xfb,0x5b,0x9f,0xb6,0xe6,0xa8,0xf5,
		551	0x4e,0x7c,0x4f,0x8e,0x1d,0xad,0xd0,0x08,
		552	0xc2,0x43,0x7c,0x8b,0xe6,0xdb,0xd0,0xd2,
		553	0xe8,0x39,0x26,0xc1,0xe5,0x5a,0x48,0xf1,
		554	}
		555	},
444	};	556	};

arch/x86/kernel/cpu/scattered.c+2−0

 	{ X86_FEATURE_MBA,			CPUID_EBX,  6, 0x80000008, 0 },
 	{ X86_FEATURE_SMBA,			CPUID_EBX,  2, 0x80000020, 0 },
 	{ X86_FEATURE_BMEC,			CPUID_EBX,  3, 0x80000020, 0 },
+	{ X86_FEATURE_TSA_SQ_NO,		CPUID_ECX,  1, 0x80000021, 0 },
+	{ X86_FEATURE_TSA_L1_NO,		CPUID_ECX,  2, 0x80000021, 0 },
 	{ X86_FEATURE_AMD_WORKLOAD_CLASS,	CPUID_EAX, 22, 0x80000021, 0 },
 	{ X86_FEATURE_PERFMON_V2,		CPUID_EAX,  0, 0x80000022, 0 },
 	{ X86_FEATURE_AMD_LBR_V2,		CPUID_EAX,  1, 0x80000022, 0 },

arch/x86/kernel/process.c+12−4

@@ -907,16 +907,24 @@ static __init bool prefer_mwait_c1_over_halt(void) · 906 unmodified lines
907	*/	907	*/
908	static __cpuidle void mwait_idle(void)	908	static __cpuidle void mwait_idle(void)
909	{	909	{
		910	if (need_resched())
		911	return;
		912
		913	x86_idle_clear_cpu_buffers();
		914
910	if (!current_set_polling_and_test()) {	915	if (!current_set_polling_and_test()) {
911	const void *addr = &current_thread_info()->flags;	916	const void *addr = &current_thread_info()->flags;
912		917
913	alternative_input("", "clflush (%[addr])", X86_BUG_CLFLUSH_MONITOR, [addr] "a" (addr));	918	alternative_input("", "clflush (%[addr])", X86_BUG_CLFLUSH_MONITOR, [addr] "a" (addr));
914	__monitor(addr, 0, 0);	919	__monitor(addr, 0, 0);
915	if (!need_resched()) {	920	if (need_resched())
916	__sti_mwait(0, 0);	921	goto out;
917	raw_local_irq_disable();	922
918	}	923	__sti_mwait(0, 0);
		924	raw_local_irq_disable();
919	}	925	}
		926
		927	out:
920	__current_clr_polling();	928	__current_clr_polling();
921	}	929	}
922		930

arch/x86/kvm/cpuid.c+9−1

 		 */
 		SYNTHESIZED_F(LFENCE_RDTSC),
 		/* SmmPgCfgLock */
+		/* 4: Resv */
+		SYNTHESIZED_F(VERW_CLEAR),
 		F(NULL_SEL_CLR_BASE),
 		/* UpperAddressIgnore */
 		F(AUTOIBRS),
 		F(SRSO_USER_KERNEL_NO),
 	);
+	kvm_cpu_cap_init(CPUID_8000_0021_ECX,
+		SYNTHESIZED_F(TSA_SQ_NO),
+		SYNTHESIZED_F(TSA_L1_NO),
+	);
 	kvm_cpu_cap_init(CPUID_8000_0022_EAX,
 		F(PERFMON_V2),
 	);
 		entry->eax = entry->ebx = entry->ecx = entry->edx = 0;
 		break;
 	case 0x80000021:
-		entry->ebx = entry->ecx = entry->edx = 0;
+		entry->ebx = entry->edx = 0;
 		cpuid_entry_override(entry, CPUID_8000_0021_EAX);
+		cpuid_entry_override(entry, CPUID_8000_0021_ECX);
 		break;
 	/* AMD Extended Performance Monitoring and Debug */
 	case 0x80000022: {

arch/x86/kvm/hyperv.c+4−1

 		if (entries[i] == KVM_HV_TLB_FLUSHALL_ENTRY)
 			goto out_flush_all;
+		if (is_noncanonical_invlpg_address(entries[i], vcpu))
+			continue;
 		/*
 		 * Lower 12 bits of 'address' encode the number of additional
 		 * pages to flush.
 static u64 kvm_hv_flush_tlb(struct kvm_vcpu *vcpu, struct kvm_hv_hcall *hc)
 {
 	struct kvm_vcpu_hv *hv_vcpu = to_hv_vcpu(vcpu);
+	unsigned long *vcpu_mask = hv_vcpu->vcpu_mask;
 	u64 *sparse_banks = hv_vcpu->sparse_banks;
 	struct kvm *kvm = vcpu->kvm;
 	struct hv_tlb_flush_ex flush_ex;
 	struct hv_tlb_flush flush;
-	DECLARE_BITMAP(vcpu_mask, KVM_MAX_VCPUS);
 	struct kvm_vcpu_hv_tlb_flush_fifo *tlb_flush_fifo;
 	/*
 	 * Normally, there can be no more than 'KVM_HV_TLB_FLUSH_FIFO_SIZE'

arch/x86/kvm/reverse_cpuid.h+7−0

 /* CPUID level 0x80000022 (EAX) */
 #define KVM_X86_FEATURE_PERFMON_V2	KVM_X86_FEATURE(CPUID_8000_0022_EAX, 0)
+/* CPUID level 0x80000021 (ECX) */
+#define KVM_X86_FEATURE_TSA_SQ_NO	KVM_X86_FEATURE(CPUID_8000_0021_ECX, 1)
+#define KVM_X86_FEATURE_TSA_L1_NO	KVM_X86_FEATURE(CPUID_8000_0021_ECX, 2)
 struct cpuid_reg {
 	u32 function;
 	u32 index;
 	[CPUID_8000_0022_EAX] = {0x80000022, 0, CPUID_EAX},
 	[CPUID_7_2_EDX]       = {         7, 2, CPUID_EDX},
 	[CPUID_24_0_EBX]      = {      0x24, 0, CPUID_EBX},
+	[CPUID_8000_0021_ECX] = {0x80000021, 0, CPUID_ECX},
 };
 /*
 	KVM_X86_TRANSLATE_FEATURE(PERFMON_V2);
 	KVM_X86_TRANSLATE_FEATURE(RRSBA_CTRL);
 	KVM_X86_TRANSLATE_FEATURE(BHI_CTRL);
+	KVM_X86_TRANSLATE_FEATURE(TSA_SQ_NO);
+	KVM_X86_TRANSLATE_FEATURE(TSA_L1_NO);
 	default:
 		return x86_feature;
 	}

arch/x86/kvm/svm/sev.c+10−2

 	struct kvm_vcpu *src_vcpu;
 	unsigned long i;
+	if (src->created_vcpus != atomic_read(&src->online_vcpus) ||
+	    dst->created_vcpus != atomic_read(&dst->online_vcpus))
+		return -EBUSY;
 	if (!sev_es_guest(src))
 		return 0;
 	 * the VMSA will be NULL if this vCPU is the destination for intrahost
 	 * migration, and will be copied later.
 	 */
-	if (svm->sev_es.vmsa && !svm->sev_es.snp_has_guest_vmsa)
+	if (!svm->sev_es.snp_has_guest_vmsa) {
-		svm->vmcb->control.vmsa_pa = __pa(svm->sev_es.vmsa);
+		if (svm->sev_es.vmsa)
+			svm->vmcb->control.vmsa_pa = __pa(svm->sev_es.vmsa);
+		else
+			svm->vmcb->control.vmsa_pa = INVALID_PAGE;
+	}
 	if (cpu_feature_enabled(X86_FEATURE_ALLOWED_SEV_FEATURES))
 		svm->vmcb->control.allowed_sev_features = sev->vmsa_features |

arch/x86/kvm/svm/vmenter.S+6−0

 #endif
 	mov VCPU_RDI(%_ASM_DI), %_ASM_DI
+	/* Clobbers EFLAGS.ZF */
+	VM_CLEAR_CPU_BUFFERS
 	/* Enter guest mode */
 3:	vmrun %_ASM_AX
 4:
 	mov SVM_current_vmcb(%rdi), %rax
 	mov KVM_VMCB_pa(%rax), %rax
+	/* Clobbers EFLAGS.ZF */
+	VM_CLEAR_CPU_BUFFERS
 	/* Enter guest mode */
 1:	vmrun %rax
 2:

arch/x86/kvm/vmx/tdx.c+30−0

@@ -173,6 +173,9 @@ static void td_init_cpuid_entry2(struct kvm_cpuid_entry2 *entry, unsigned char i · 172 unmodified lines
173	tdx_clear_unsupported_cpuid(entry);	173	tdx_clear_unsupported_cpuid(entry);
174	}	174	}
175		175
		176	#define TDVMCALLINFO_GET_QUOTE BIT(0)
		177	#define TDVMCALLINFO_SETUP_EVENT_NOTIFY_INTERRUPT BIT(1)
		178
176	static int init_kvm_tdx_caps(const struct tdx_sys_info_td_conf *td_conf,	179	static int init_kvm_tdx_caps(const struct tdx_sys_info_td_conf *td_conf,
177	struct kvm_tdx_capabilities *caps)	180	struct kvm_tdx_capabilities *caps)
178	{	181	{
@@ -188,6 +191,10 @@ static int init_kvm_tdx_caps(const struct tdx_sys_info_td_conf *td_conf, · 9 unmodified lines
188		191
189	caps->cpuid.nent = td_conf->num_cpuid_config;	192	caps->cpuid.nent = td_conf->num_cpuid_config;
190		193
		194	caps->user_tdvmcallinfo_1_r11 =
		195	TDVMCALLINFO_GET_QUOTE \|
		196	TDVMCALLINFO_SETUP_EVENT_NOTIFY_INTERRUPT;
		197
191	for (i = 0; i < td_conf->num_cpuid_config; i++)	198	for (i = 0; i < td_conf->num_cpuid_config; i++)
192	td_init_cpuid_entry2(&caps->cpuid.entries[i], i);	199	td_init_cpuid_entry2(&caps->cpuid.entries[i], i);
193		200
@@ -1530,6 +1537,27 @@ static int tdx_get_quote(struct kvm_vcpu *vcpu) · 1336 unmodified lines
1530	return 0;	1537	return 0;
1531	}	1538	}
1532		1539
		1540	static int tdx_setup_event_notify_interrupt(struct kvm_vcpu *vcpu)
		1541	{
		1542	struct vcpu_tdx *tdx = to_tdx(vcpu);
		1543	u64 vector = tdx->vp_enter_args.r12;
		1544
		1545	if (vector < 32 \|\| vector > 255) {
		1546	tdvmcall_set_return_code(vcpu, TDVMCALL_STATUS_INVALID_OPERAND);
		1547	return 1;
		1548	}
		1549
		1550	vcpu->run->exit_reason = KVM_EXIT_TDX;
		1551	vcpu->run->tdx.flags = 0;
		1552	vcpu->run->tdx.nr = TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUPT;
		1553	vcpu->run->tdx.setup_event_notify.ret = TDVMCALL_STATUS_SUBFUNC_UNSUPPORTED;
		1554	vcpu->run->tdx.setup_event_notify.vector = vector;
		1555
		1556	vcpu->arch.complete_userspace_io = tdx_complete_simple;
		1557
		1558	return 0;
		1559	}
		1560
1533	static int handle_tdvmcall(struct kvm_vcpu *vcpu)	1561	static int handle_tdvmcall(struct kvm_vcpu *vcpu)
1534	{	1562	{
1535	switch (tdvmcall_leaf(vcpu)) {	1563	switch (tdvmcall_leaf(vcpu)) {
@@ -1541,6 +1569,8 @@ static int handle_tdvmcall(struct kvm_vcpu *vcpu) · 5 unmodified lines
1541	return tdx_get_td_vm_call_info(vcpu);	1569	return tdx_get_td_vm_call_info(vcpu);
1542	case TDVMCALL_GET_QUOTE:	1570	case TDVMCALL_GET_QUOTE:
1543	return tdx_get_quote(vcpu);	1571	return tdx_get_quote(vcpu);
		1572	case TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUPT:
		1573	return tdx_setup_event_notify_interrupt(vcpu);
1544	default:	1574	default:
1545	break;	1575	break;
1546	}	1576	}

arch/x86/kvm/vmx/vmx.c+1−1

@@ -7291,7 +7291,7 @@ static noinstr void vmx_vcpu_enter_exit(struct kvm_vcpu *vcpu, · 7290 unmodified lines
7291	vmx_l1d_flush(vcpu);	7291	vmx_l1d_flush(vcpu);
7292	else if (static_branch_unlikely(&cpu_buf_vm_clear) &&	7292	else if (static_branch_unlikely(&cpu_buf_vm_clear) &&
7293	kvm_arch_has_assigned_device(vcpu->kvm))	7293	kvm_arch_has_assigned_device(vcpu->kvm))
7294	mds_clear_cpu_buffers();	7294	x86_clear_cpu_buffers();
7295		7295
7296	vmx_disable_fb_clear(vmx);	7296	vmx_disable_fb_clear(vmx);
7297		7297

arch/x86/kvm/x86.c+3−1

 	/* With all the info we got, fill in the values */
-	if (kvm_caps.has_tsc_control)
+	if (kvm_caps.has_tsc_control) {
 		tgt_tsc_khz = kvm_scale_tsc(tgt_tsc_khz,
 					    v->arch.l1_tsc_scaling_ratio);
+		tgt_tsc_khz = tgt_tsc_khz ? : 1;
+	}
 	if (unlikely(vcpu->hw_tsc_khz != tgt_tsc_khz)) {
 		kvm_get_time_scale(NSEC_PER_SEC, tgt_tsc_khz * 1000LL,

arch/x86/kvm/xen.c+13−2

@@ -1971,8 +1971,19 @@ int kvm_xen_setup_evtchn(struct kvm *kvm, · 1970 unmodified lines
1971	{	1971	{
1972	struct kvm_vcpu *vcpu;	1972	struct kvm_vcpu *vcpu;
1973		1973
1974	if (ue->u.xen_evtchn.port >= max_evtchn_port(kvm))	1974	/*
1975	return -EINVAL;	1975	* Don't check for the port being within range of max_evtchn_port().
		1976	* Userspace can configure what ever targets it likes; events just won't
		1977	* be delivered if/while the target is invalid, just like userspace can
		1978	* configure MSIs which target non-existent APICs.
		1979	*
		1980	* This allow on Live Migration and Live Update, the IRQ routing table
		1981	* can be restored independently of other things like creating vCPUs,
		1982	* without imposing an ordering dependency on userspace. In this
		1983	* particular case, the problematic ordering would be with setting the
		1984	* Xen 'long mode' flag, which changes max_evtchn_port() to allow 4096
		1985	* instead of 1024 event channels.
		1986	*/
1976		1987
1977	/* We only support 2 level event channels for now */	1988	/* We only support 2 level event channels for now */
1978	if (ue->u.xen_evtchn.priority != KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL)	1989	if (ue->u.xen_evtchn.priority != KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL)

drivers/base/cpu.c+3−0

 CPU_SHOW_VULN_FALLBACK(ghostwrite);
 CPU_SHOW_VULN_FALLBACK(old_microcode);
 CPU_SHOW_VULN_FALLBACK(indirect_target_selection);
+CPU_SHOW_VULN_FALLBACK(tsa);
 static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
 static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
 static DEVICE_ATTR(ghostwrite, 0444, cpu_show_ghostwrite, NULL);
 static DEVICE_ATTR(old_microcode, 0444, cpu_show_old_microcode, NULL);
 static DEVICE_ATTR(indirect_target_selection, 0444, cpu_show_indirect_target_selection, NULL);
+static DEVICE_ATTR(tsa, 0444, cpu_show_tsa, NULL);
 static struct attribute *cpu_root_vulnerabilities_attrs[] = {
 	&dev_attr_meltdown.attr,
 	&dev_attr_ghostwrite.attr,
 	&dev_attr_old_microcode.attr,
 	&dev_attr_indirect_target_selection.attr,
+	&dev_attr_tsa.attr,
 	NULL
 };

drivers/base/power/main.c+1−1

  */
 void dpm_resume_end(pm_message_t state)
 {
-	pm_restore_gfp_mask();
 	dpm_resume(state);
+	pm_restore_gfp_mask();
 	dpm_complete(state);
 }
 EXPORT_SYMBOL_GPL(dpm_resume_end);

drivers/block/nbd.c+3−3

@@ -2198,9 +2198,7 @@ again: · 2197 unmodified lines
2198	goto out;	2198	goto out;
2199	}	2199	}
2200	}	2200	}
2201	ret = nbd_start_device(nbd);	2201
2202	if (ret)
2203	goto out;
2204	if (info->attrs[NBD_ATTR_BACKEND_IDENTIFIER]) {	2202	if (info->attrs[NBD_ATTR_BACKEND_IDENTIFIER]) {
2205	nbd->backend = nla_strdup(info->attrs[NBD_ATTR_BACKEND_IDENTIFIER],	2203	nbd->backend = nla_strdup(info->attrs[NBD_ATTR_BACKEND_IDENTIFIER],
2206	GFP_KERNEL);	2204	GFP_KERNEL);
@@ -2216,6 +2214,8 @@ again: · 9 unmodified lines
2216	goto out;	2214	goto out;
2217	}	2215	}
2218	set_bit(NBD_RT_HAS_BACKEND_FILE, &config->runtime_flags);	2216	set_bit(NBD_RT_HAS_BACKEND_FILE, &config->runtime_flags);
		2217
		2218	ret = nbd_start_device(nbd);
2219	out:	2219	out:
2220	mutex_unlock(&nbd->config_lock);	2220	mutex_unlock(&nbd->config_lock);
2221	if (!ret) {	2221	if (!ret) {

drivers/char/agp/amd64-agp.c+8−8

 MODULE_DEVICE_TABLE(pci, agp_amd64_pci_table);
-static const struct pci_device_id agp_amd64_pci_promisc_table[] = {
-	{ PCI_DEVICE_CLASS(0, 0) },
-	{ }
-};
 static DEFINE_SIMPLE_DEV_PM_OPS(agp_amd64_pm_ops, NULL, agp_amd64_resume);
 static struct pci_driver agp_amd64_pci_driver = {
 /* Not static due to IOMMU code calling it early. */
 int __init agp_amd64_init(void)
 {
+	struct pci_dev *pdev = NULL;
 	int err = 0;
 	if (agp_off)
 		}
 		/* Look for any AGP bridge */
-		agp_amd64_pci_driver.id_table = agp_amd64_pci_promisc_table;
+		for_each_pci_dev(pdev)
-		err = driver_attach(&agp_amd64_pci_driver.driver);
+			if (pci_find_capability(pdev, PCI_CAP_ID_AGP))
-		if (err == 0 && agp_bridges_found == 0) {
+				pci_add_dynid(&agp_amd64_pci_driver,
+					      pdev->vendor, pdev->device,
+					      pdev->subsystem_vendor,
+					      pdev->subsystem_device, 0, 0, 0);
+		if (agp_bridges_found == 0) {
 			pci_unregister_driver(&agp_amd64_pci_driver);
 			err = -ENODEV;
 		}

drivers/clk/clk-scmi.c+10−8

 	const struct scmi_handle *handle = sdev->handle;
 	struct scmi_protocol_handle *ph;
 	const struct clk_ops *scmi_clk_ops_db[SCMI_MAX_CLK_OPS] = {};
+	struct scmi_clk *sclks;
 	if (!handle)
 		return -ENODEV;
 	transport_is_atomic = handle->is_transport_atomic(handle,
 							  &atomic_threshold_us);
+	sclks = devm_kcalloc(dev, count, sizeof(*sclks), GFP_KERNEL);
+	if (!sclks)
+		return -ENOMEM;
+	for (idx = 0; idx < count; idx++)
+		hws[idx] = &sclks[idx].hw;
 	for (idx = 0; idx < count; idx++) {
-		struct scmi_clk *sclk;
+		struct scmi_clk *sclk = &sclks[idx];
 		const struct clk_ops *scmi_ops;
-		sclk = devm_kzalloc(dev, sizeof(*sclk), GFP_KERNEL);
-		if (!sclk)
-			return -ENOMEM;
 		sclk->info = scmi_proto_clk_ops->info_get(ph, idx);
 		if (!sclk->info) {
 			dev_dbg(dev, "invalid clock info for idx %d\n", idx);
-			devm_kfree(dev, sclk);
+			hws[idx] = NULL;
 			continue;
 		}
 		if (err) {
 			dev_err(dev, "failed to register clock %d\n", idx);
 			devm_kfree(dev, sclk->parent_data);
-			devm_kfree(dev, sclk);
 			hws[idx] = NULL;
 		} else {
 			dev_dbg(dev, "Registered clock:%s%s\n",
 				sclk->info->name,
 				scmi_ops->enable ? " (atomic ops)" : "");
-			hws[idx] = &sclk->hw;
 		}
 	}

drivers/clk/imx/clk-imx95-blk-ctl.c+8−4

 	.clk_reg_offset = 0,
 };
+static const char * const disp_engine_parents[] = {
+	"videopll1", "dsi_pll", "ldb_pll_div7"
+};
 static const struct imx95_blk_ctl_clk_dev_data dispmix_csr_clk_dev_data[] = {
 	[IMX95_CLK_DISPMIX_ENG0_SEL] = {
 		.name = "disp_engine0_sel",
-		.parent_names = (const char *[]){"videopll1", "dsi_pll", "ldb_pll_div7", },
+		.parent_names = disp_engine_parents,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(disp_engine_parents),
 		.reg = 0,
 		.bit_idx = 0,
 		.bit_width = 2,
 	},
 	[IMX95_CLK_DISPMIX_ENG1_SEL] = {
 		.name = "disp_engine1_sel",
-		.parent_names = (const char *[]){"videopll1", "dsi_pll", "ldb_pll_div7", },
+		.parent_names = disp_engine_parents,
-		.num_parents = 4,
+		.num_parents = ARRAY_SIZE(disp_engine_parents),
 		.reg = 0,
 		.bit_idx = 2,
 		.bit_width = 2,

drivers/firmware/efi/libstub/zboot.lds+2−4

 		. = _etext;
 	}
-#ifdef CONFIG_EFI_SBAT
         .sbat : ALIGN(4096) {
 		_sbat = .;
 		*(.sbat)
 		_esbat = ALIGN(4096);
 		. = _esbat;
 	}
-#endif
 	.data : ALIGN(4096) {
 		_data = .;
 PROVIDE(__efistub__gzdata_size =
 		ABSOLUTE(__efistub__gzdata_end - __efistub__gzdata_start));
-PROVIDE(__data_rawsize = ABSOLUTE(_edata - _etext));
+PROVIDE(__data_rawsize = ABSOLUTE(_edata - _data));
-PROVIDE(__data_size = ABSOLUTE(_end - _etext));
+PROVIDE(__data_size = ABSOLUTE(_end - _data));
 PROVIDE(__sbat_size = ABSOLUTE(_esbat - _sbat));

drivers/gpio/gpiolib-of.c+1−1

@@ -708,7 +708,7 @@ struct gpio_desc of_find_gpio(struct device_node np, const char *con_id, · 707 unmodified lines
708	unsigned int idx, unsigned long *flags)	708	unsigned int idx, unsigned long *flags)
709	{	709	{
710	char propname[32]; /* 32 is max size of property name */	710	char propname[32]; /* 32 is max size of property name */
711	enum of_gpio_flags of_flags;	711	enum of_gpio_flags of_flags = 0;
712	const of_find_gpio_quirk *q;	712	const of_find_gpio_quirk *q;
713	struct gpio_desc *desc;	713	struct gpio_desc *desc;
714		714

drivers/gpio/gpiolib.c+3−2

 static int gpio_chip_get_multiple(struct gpio_chip *gc,
 				  unsigned long *mask, unsigned long *bits)
 {
-	int ret;
 	lockdep_assert_held(&gc->gpiodev->srcu);
 	if (gc->get_multiple) {
+		int ret;
 		ret = gc->get_multiple(gc, mask, bits);
 		if (ret > 0)
 			return -EBADE;
+		return ret;
 	}
 	if (gc->get) {

drivers/gpu/drm/drm_framebuffer.c+29−2

@@ -862,11 +862,23 @@ EXPORT_SYMBOL_FOR_TESTS_ONLY(drm_framebuffer_free); · 861 unmodified lines
862	int drm_framebuffer_init(struct drm_device dev, struct drm_framebuffer fb,	862	int drm_framebuffer_init(struct drm_device dev, struct drm_framebuffer fb,
863	const struct drm_framebuffer_funcs *funcs)	863	const struct drm_framebuffer_funcs *funcs)
864	{	864	{
		865	unsigned int i;
865	int ret;	866	int ret;
		867	bool exists;
866		868
867	if (WARN_ON_ONCE(fb->dev != dev \|\| !fb->format))	869	if (WARN_ON_ONCE(fb->dev != dev \|\| !fb->format))
868	return -EINVAL;	870	return -EINVAL;
869		871
		872	for (i = 0; i < fb->format->num_planes; i++) {
		873	if (drm_WARN_ON_ONCE(dev, fb->internal_flags & DRM_FRAMEBUFFER_HAS_HANDLE_REF(i)))
		874	fb->internal_flags &= ~DRM_FRAMEBUFFER_HAS_HANDLE_REF(i);
		875	if (fb->obj[i]) {
		876	exists = drm_gem_object_handle_get_if_exists_unlocked(fb->obj[i]);
		877	if (exists)
		878	fb->internal_flags \|= DRM_FRAMEBUFFER_HAS_HANDLE_REF(i);
		879	}
		880	}
		881
870	INIT_LIST_HEAD(&fb->filp_head);	882	INIT_LIST_HEAD(&fb->filp_head);
871		883
872	fb->funcs = funcs;	884	fb->funcs = funcs;
@@ -875,7 +887,7 @@ int drm_framebuffer_init(struct drm_device dev, struct drm_framebuffer fb, · 2 unmodified lines
875	ret = __drm_mode_object_add(dev, &fb->base, DRM_MODE_OBJECT_FB,	887	ret = __drm_mode_object_add(dev, &fb->base, DRM_MODE_OBJECT_FB,
876	false, drm_framebuffer_free);	888	false, drm_framebuffer_free);
877	if (ret)	889	if (ret)
878	goto out;	890	goto err;
879		891
880	mutex_lock(&dev->mode_config.fb_lock);	892	mutex_lock(&dev->mode_config.fb_lock);
881	dev->mode_config.num_fb++;	893	dev->mode_config.num_fb++;
@@ -883,7 +895,16 @@ int drm_framebuffer_init(struct drm_device dev, struct drm_framebuffer fb, · 1 unmodified line
883	mutex_unlock(&dev->mode_config.fb_lock);	895	mutex_unlock(&dev->mode_config.fb_lock);
884		896
885	drm_mode_object_register(dev, &fb->base);	897	drm_mode_object_register(dev, &fb->base);
886	out:	898
		899	return 0;
		900
		901	err:
		902	for (i = 0; i < fb->format->num_planes; i++) {
		903	if (fb->internal_flags & DRM_FRAMEBUFFER_HAS_HANDLE_REF(i)) {
		904	drm_gem_object_handle_put_unlocked(fb->obj[i]);
		905	fb->internal_flags &= ~DRM_FRAMEBUFFER_HAS_HANDLE_REF(i);
		906	}
		907	}
887	return ret;	908	return ret;
888	}	909	}
889	EXPORT_SYMBOL(drm_framebuffer_init);	910	EXPORT_SYMBOL(drm_framebuffer_init);
@@ -960,6 +981,12 @@ EXPORT_SYMBOL(drm_framebuffer_unregister_private); · 70 unmodified lines
960	void drm_framebuffer_cleanup(struct drm_framebuffer *fb)	981	void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
961	{	982	{
962	struct drm_device *dev = fb->dev;	983	struct drm_device *dev = fb->dev;
		984	unsigned int i;
		985
		986	for (i = 0; i < fb->format->num_planes; i++) {
		987	if (fb->internal_flags & DRM_FRAMEBUFFER_HAS_HANDLE_REF(i))
		988	drm_gem_object_handle_put_unlocked(fb->obj[i]);
		989	}
963		990
964	mutex_lock(&dev->mode_config.fb_lock);	991	mutex_lock(&dev->mode_config.fb_lock);
965	list_del(&fb->head);	992	list_del(&fb->head);

drivers/gpu/drm/drm_gem.c+33−15

 }
 /**
- * drm_gem_object_handle_get_unlocked - acquire reference on user-space handles
+ * drm_gem_object_handle_get_if_exists_unlocked - acquire reference on user-space handle, if any
  * @obj: GEM object
  *
- * Acquires a reference on the GEM buffer object's handle. Required
+ * Acquires a reference on the GEM buffer object's handle. Required to keep
- * to keep the GEM object alive. Call drm_gem_object_handle_put_unlocked()
+ * the GEM object alive. Call drm_gem_object_handle_put_if_exists_unlocked()
- * to release the reference.
+ * to release the reference. Does nothing if the buffer object has no handle.
+ *
+ * Returns:
+ * True if a handle exists, or false otherwise
  */
-void drm_gem_object_handle_get_unlocked(struct drm_gem_object *obj)
+bool drm_gem_object_handle_get_if_exists_unlocked(struct drm_gem_object *obj)
 {
 	struct drm_device *dev = obj->dev;
 	guard(mutex)(&dev->object_name_lock);
-	drm_WARN_ON(dev, !obj->handle_count); /* first ref taken in create-tail helper */
+	/*
+	 * First ref taken during GEM object creation, if any. Some
+	 * drivers set up internal framebuffers with GEM objects that
+	 * do not have a GEM handle. Hence, this counter can be zero.
+	 */
+	if (!obj->handle_count)
+		return false;
 	drm_gem_object_handle_get(obj);
+	return true;
 }
-EXPORT_SYMBOL(drm_gem_object_handle_get_unlocked);
 /**
  * drm_gem_object_handle_free - release resources bound to userspace handles
 }
 /**
- * drm_gem_object_handle_put_unlocked - releases reference on user-space handles
+ * drm_gem_object_handle_put_unlocked - releases reference on user-space handle
  * @obj: GEM object
  *
  * Releases a reference on the GEM buffer object's handle. Possibly releases
 	struct drm_device *dev = obj->dev;
 	bool final = false;
-	if (WARN_ON(READ_ONCE(obj->handle_count) == 0))
+	if (drm_WARN_ON(dev, READ_ONCE(obj->handle_count) == 0))
 		return;
 	/*
-	* Must bump handle count first as this may be the last
+	 * Must bump handle count first as this may be the last
-	* ref, in which case the object would disappear before we
+	 * ref, in which case the object would disappear before
-	* checked for a name
+	 * we checked for a name.
-	*/
+	 */
 	mutex_lock(&dev->object_name_lock);
 	if (--obj->handle_count == 0) {
 	if (final)
 		drm_gem_object_put(obj);
 }
-EXPORT_SYMBOL(drm_gem_object_handle_put_unlocked);
 /*
  * Called at device or object close to release the file's
 	struct drm_file *file_priv = data;
 	struct drm_gem_object *obj = ptr;
+	if (drm_WARN_ON(obj->dev, !data))
+		return 0;
 	if (obj->funcs->close)
 		obj->funcs->close(obj, file_priv);
 	idr_preload(GFP_KERNEL);
 	spin_lock(&file_priv->table_lock);
-	ret = idr_alloc(&file_priv->object_idr, obj, 1, 0, GFP_NOWAIT);
+	ret = idr_alloc(&file_priv->object_idr, NULL, 1, 0, GFP_NOWAIT);
 	spin_unlock(&file_priv->table_lock);
 	idr_preload_end();
 			goto err_revoke;
 	}
+	/* mirrors drm_gem_handle_delete to avoid races */
+	spin_lock(&file_priv->table_lock);
+	obj = idr_replace(&file_priv->object_idr, obj, handle);
+	WARN_ON(obj != NULL);
+	spin_unlock(&file_priv->table_lock);
 	*handlep = handle;
 	return 0;

drivers/gpu/drm/drm_gem_framebuffer_helper.c+7−9

 	unsigned int i;
 	for (i = 0; i < fb->format->num_planes; i++)
-		drm_gem_object_handle_put_unlocked(fb->obj[i]);
+		drm_gem_object_put(fb->obj[i]);
 	drm_framebuffer_cleanup(fb);
 	kfree(fb);
 		if (!objs[i]) {
 			drm_dbg_kms(dev, "Failed to lookup GEM object\n");
 			ret = -ENOENT;
-			goto err_gem_object_handle_put_unlocked;
+			goto err_gem_object_put;
 		}
-		drm_gem_object_handle_get_unlocked(objs[i]);
-		drm_gem_object_put(objs[i]);
 		min_size = (height - 1) * mode_cmd->pitches[i]
 			 + drm_format_info_min_pitch(info, i, width)
 			drm_dbg_kms(dev,
 				    "GEM object size (%zu) smaller than minimum size (%u) for plane %d\n",
 				    objs[i]->size, min_size, i);
-			drm_gem_object_handle_put_unlocked(objs[i]);
+			drm_gem_object_put(objs[i]);
 			ret = -EINVAL;
-			goto err_gem_object_handle_put_unlocked;
+			goto err_gem_object_put;
 		}
 	}
 	ret = drm_gem_fb_init(dev, fb, mode_cmd, objs, i, funcs);
 	if (ret)
-		goto err_gem_object_handle_put_unlocked;
+		goto err_gem_object_put;
 	return 0;
-err_gem_object_handle_put_unlocked:
+err_gem_object_put:
 	while (i > 0) {
 		--i;
-		drm_gem_object_handle_put_unlocked(objs[i]);
+		drm_gem_object_put(objs[i]);
 	}
 	return ret;
 }

drivers/gpu/drm/drm_internal.h+1−1

@@ -161,7 +161,7 @@ void drm_sysfs_lease_event(struct drm_device *dev); · 160 unmodified lines
161		161
162	/* drm_gem.c */	162	/* drm_gem.c */
163	int drm_gem_init(struct drm_device *dev);	163	int drm_gem_init(struct drm_device *dev);
164	void drm_gem_object_handle_get_unlocked(struct drm_gem_object *obj);	164	bool drm_gem_object_handle_get_if_exists_unlocked(struct drm_gem_object *obj);
165	void drm_gem_object_handle_put_unlocked(struct drm_gem_object *obj);	165	void drm_gem_object_handle_put_unlocked(struct drm_gem_object *obj);
166	int drm_gem_handle_create_tail(struct drm_file *file_priv,	166	int drm_gem_handle_create_tail(struct drm_file *file_priv,
167	struct drm_gem_object *obj,	167	struct drm_gem_object *obj,

drivers/gpu/drm/drm_panic_qr.rs+1−1

@@ -27,7 +27,7 @@ · 26 unmodified lines
27	//! * <https://github.com/erwanvivien/fast_qr>	27	//! * <https://github.com/erwanvivien/fast_qr>
28	//! * <https://github.com/bjguillot/qr>	28	//! * <https://github.com/bjguillot/qr>
29		29
30	use kernel::{prelude::*, str::CStr};	30	use kernel::prelude::*;
31		31
32	#[derive(Debug, Clone, Copy, PartialEq, Eq, Ord, PartialOrd)]	32	#[derive(Debug, Clone, Copy, PartialEq, Eq, Ord, PartialOrd)]
33	struct Version(usize);	33	struct Version(usize);

drivers/gpu/drm/i915/display/intel_bios.c+4−4

@@ -1938,7 +1938,7 @@ static int get_init_otp_deassert_fragment_len(struct intel_display *display, · 1937 unmodified lines
1938	int index, len;	1938	int index, len;
1939		1939
1940	if (drm_WARN_ON(display->drm,	1940	if (drm_WARN_ON(display->drm,
1941	!data \|\| panel->vbt.dsi.seq_version != 1))	1941	!data \|\| panel->vbt.dsi.seq_version >= 3))
1942	return 0;	1942	return 0;
1943		1943
1944	/* index = 1 to skip sequence byte */	1944	/* index = 1 to skip sequence byte */
@@ -1961,7 +1961,7 @@ static int get_init_otp_deassert_fragment_len(struct intel_display *display, · 16 unmodified lines
1961	}	1961	}
1962		1962
1963	/*	1963	/*
1964	* Some v1 VBT MIPI sequences do the deassert in the init OTP sequence.	1964	* Some v1/v2 VBT MIPI sequences do the deassert in the init OTP sequence.
1965	* The deassert must be done before calling intel_dsi_device_ready, so for	1965	* The deassert must be done before calling intel_dsi_device_ready, so for
1966	* these devices we split the init OTP sequence into a deassert sequence and	1966	* these devices we split the init OTP sequence into a deassert sequence and
1967	* the actual init OTP part.	1967	* the actual init OTP part.
@@ -1972,9 +1972,9 @@ static void vlv_fixup_mipi_sequences(struct intel_display *display, · 4 unmodified lines
1972	u8 *init_otp;	1972	u8 *init_otp;
1973	int len;	1973	int len;
1974		1974
1975	/* Limit this to v1 vid-mode sequences */	1975	/* Limit this to v1/v2 vid-mode sequences */
1976	if (panel->vbt.dsi.config->is_cmd_mode \|\|	1976	if (panel->vbt.dsi.config->is_cmd_mode \|\|
1977	panel->vbt.dsi.seq_version != 1)	1977	panel->vbt.dsi.seq_version >= 3)
1978	return;	1978	return;
1979		1979
1980	/* Only do this if there are otp and assert seqs and no deassert seq */	1980	/* Only do this if there are otp and assert seqs and no deassert seq */

drivers/gpu/drm/imagination/pvr_power.c+2−2

@@ -386,13 +386,13 @@ pvr_power_reset(struct pvr_device *pvr_dev, bool hard_reset) · 385 unmodified lines
386	if (!err) {	386	if (!err) {
387	if (hard_reset) {	387	if (hard_reset) {
388	pvr_dev->fw_dev.booted = false;	388	pvr_dev->fw_dev.booted = false;
389	WARN_ON(pm_runtime_force_suspend(from_pvr_device(pvr_dev)->dev));	389	WARN_ON(pvr_power_device_suspend(from_pvr_device(pvr_dev)->dev));
390		390
391	err = pvr_fw_hard_reset(pvr_dev);	391	err = pvr_fw_hard_reset(pvr_dev);
392	if (err)	392	if (err)
393	goto err_device_lost;	393	goto err_device_lost;
394		394
395	err = pm_runtime_force_resume(from_pvr_device(pvr_dev)->dev);	395	err = pvr_power_device_resume(from_pvr_device(pvr_dev)->dev);
396	pvr_dev->fw_dev.booted = true;	396	pvr_dev->fw_dev.booted = true;
397	if (err)	397	if (err)
398	goto err_device_lost;	398	goto err_device_lost;

drivers/gpu/drm/nouveau/nouveau_debugfs.c+1−5

 	drm->debugfs = NULL;
 }
-int
+void
 nouveau_module_debugfs_init(void)
 {
 	nouveau_debugfs_root = debugfs_create_dir("nouveau", NULL);
-	if (IS_ERR(nouveau_debugfs_root))
-		return PTR_ERR(nouveau_debugfs_root);
-	return 0;
 }
 void

drivers/gpu/drm/nouveau/nouveau_debugfs.h+2−3

 extern struct dentry *nouveau_debugfs_root;
-int  nouveau_module_debugfs_init(void);
+void nouveau_module_debugfs_init(void);
 void nouveau_module_debugfs_fini(void);
 #else
 static inline void
 {
 }
-static inline int
+static inline void
 nouveau_module_debugfs_init(void)
 {
-	return 0;
 }
 static inline void

drivers/gpu/drm/nouveau/nouveau_drm.c+1−3

@@ -1461,9 +1461,7 @@ nouveau_drm_init(void) · 1460 unmodified lines
1461	if (!nouveau_modeset)	1461	if (!nouveau_modeset)
1462	return 0;	1462	return 0;
1463		1463
1464	ret = nouveau_module_debugfs_init();	1464	nouveau_module_debugfs_init();
1465	if (ret)
1466	return ret;
1467		1465
1468	#ifdef CONFIG_NOUVEAU_PLATFORM_DRIVER	1466	#ifdef CONFIG_NOUVEAU_PLATFORM_DRIVER
1469	platform_driver_register(&nouveau_platform_driver);	1467	platform_driver_register(&nouveau_platform_driver);

drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c+21−6

 	union acpi_object argv4 = {
 		.buffer.type    = ACPI_TYPE_BUFFER,
 		.buffer.length  = 4,
-		.buffer.pointer = kmalloc(argv4.buffer.length, GFP_KERNEL),
 	}, *obj;
 	caps->status = 0xffff;
 	if (!acpi_check_dsm(handle, &NVOP_DSM_GUID, NVOP_DSM_REV, BIT_ULL(0x1a)))
 		return;
+	argv4.buffer.pointer = kmalloc(argv4.buffer.length, GFP_KERNEL);
+	if (!argv4.buffer.pointer)
+		return;
 	obj = acpi_evaluate_dsm(handle, &NVOP_DSM_GUID, NVOP_DSM_REV, 0x1a, &argv4);
 	if (!obj)
-		return;
+		goto done;
 	if (WARN_ON(obj->type != ACPI_TYPE_BUFFER) ||
 	    WARN_ON(obj->buffer.length != 4))
-		return;
+		goto done;
 	caps->status = 0;
 	caps->optimusCaps = *(u32 *)obj->buffer.pointer;
+done:
 	ACPI_FREE(obj);
 	kfree(argv4.buffer.pointer);
 	union acpi_object argv4 = {
 		.buffer.type    = ACPI_TYPE_BUFFER,
 		.buffer.length  = sizeof(caps),
-		.buffer.pointer = kmalloc(argv4.buffer.length, GFP_KERNEL),
 	}, *obj;
 	jt->status = 0xffff;
+	argv4.buffer.pointer = kmalloc(argv4.buffer.length, GFP_KERNEL);
+	if (!argv4.buffer.pointer)
+		return;
 	obj = acpi_evaluate_dsm(handle, &JT_DSM_GUID, JT_DSM_REV, 0x1, &argv4);
 	if (!obj)
-		return;
+		goto done;
 	if (WARN_ON(obj->type != ACPI_TYPE_BUFFER) ||
 	    WARN_ON(obj->buffer.length != 4))
-		return;
+		goto done;
 	jt->status = 0;
 	jt->jtCaps = *(u32 *)obj->buffer.pointer;
 	jt->jtRevId = (jt->jtCaps & 0xfff00000) >> 20;
 	jt->bSBIOSCaps = 0;
+done:
 	ACPI_FREE(obj);
 	kfree(argv4.buffer.pointer);
 			nvkm_gsp_sg_free(gsp->subdev.device, &gsp->sr.sgt);
 			return ret;
 		}
+		/*
+		 * TODO: Debug the GSP firmware / RPC handling to find out why
+		 * without this Turing (but none of the other architectures)
+		 * ends up resetting all channels after resume.
+		 */
+		msleep(50);
 	}
 	ret = r535_gsp_rpc_unloading_guest_driver(gsp, suspend);

drivers/gpu/drm/tegra/nvdec.c+2−4

@@ -261,10 +261,8 @@ static int nvdec_load_falcon_firmware(struct nvdec *nvdec) · 260 unmodified lines
261		261
262	if (!client->group) {	262	if (!client->group) {
263	virt = dma_alloc_coherent(nvdec->dev, size, &iova, GFP_KERNEL);	263	virt = dma_alloc_coherent(nvdec->dev, size, &iova, GFP_KERNEL);
264		264	if (!virt)
265	err = dma_mapping_error(nvdec->dev, iova);	265	return -ENOMEM;
266	if (err < 0)
267	return err;
268	} else {	266	} else {
269	virt = tegra_drm_alloc(tegra, size, &iova);	267	virt = tegra_drm_alloc(tegra, size, &iova);
270	if (IS_ERR(virt))	268	if (IS_ERR(virt))

drivers/gpu/drm/xe/xe_devcoredump.c+28−10

 #define XE_DEVCOREDUMP_CHUNK_MAX	(SZ_512M + SZ_1G)
+/**
+ * xe_devcoredump_read() - Read data from the Xe device coredump snapshot
+ * @buffer: Destination buffer to copy the coredump data into
+ * @offset: Offset in the coredump data to start reading from
+ * @count: Number of bytes to read
+ * @data: Pointer to the xe_devcoredump structure
+ * @datalen: Length of the data (unused)
+ *
+ * Reads a chunk of the coredump snapshot data into the provided buffer.
+ * If the devcoredump is smaller than 1.5 GB (XE_DEVCOREDUMP_CHUNK_MAX),
+ * it is read directly from a pre-written buffer. For larger devcoredumps,
+ * the pre-written buffer must be periodically repopulated from the snapshot
+ * state due to kmalloc size limitations.
+ *
+ * Return: Number of bytes copied on success, or a negative error code on failure.
+ */
 static ssize_t xe_devcoredump_read(char *buffer, loff_t offset,
 				   size_t count, void *data, size_t datalen)
 {
 	struct xe_devcoredump *coredump = data;
 	struct xe_devcoredump_snapshot *ss;
-	ssize_t byte_copied;
+	ssize_t byte_copied = 0;
 	u32 chunk_offset;
 	ssize_t new_chunk_position;
+	bool pm_needed = false;
+	int ret = 0;
 	if (!coredump)
 		return -ENODEV;
 	/* Ensure delayed work is captured before continuing */
 	flush_work(&ss->work);
-	if (ss->read.size > XE_DEVCOREDUMP_CHUNK_MAX)
+	pm_needed = ss->read.size > XE_DEVCOREDUMP_CHUNK_MAX;
+	if (pm_needed)
 		xe_pm_runtime_get(gt_to_xe(ss->gt));
 	mutex_lock(&coredump->lock);
 	if (!ss->read.buffer) {
-		mutex_unlock(&coredump->lock);
+		ret = -ENODEV;
-		return -ENODEV;
+		goto unlock;
 	}
-	if (offset >= ss->read.size) {
+	if (offset >= ss->read.size)
-		mutex_unlock(&coredump->lock);
+		goto unlock;
-		return 0;
-	}
 	new_chunk_position = div_u64_rem(offset,
 					 XE_DEVCOREDUMP_CHUNK_MAX,
 		ss->read.size - offset;
 	memcpy(buffer, ss->read.buffer + chunk_offset, byte_copied);
+unlock:
 	mutex_unlock(&coredump->lock);
-	if (ss->read.size > XE_DEVCOREDUMP_CHUNK_MAX)
+	if (pm_needed)
 		xe_pm_runtime_put(gt_to_xe(ss->gt));
-	return byte_copied;
+	return byte_copied ? byte_copied : ret;
 }
 static void xe_devcoredump_free(void *data)

drivers/gpu/drm/xe/xe_gt_pagefault.c+1−0

@@ -444,6 +444,7 @@ static int xe_alloc_pf_queue(struct xe_gt gt, struct pf_queue pf_queue) · 443 unmodified lines
444	#define PF_MULTIPLIER 8	444	#define PF_MULTIPLIER 8
445	pf_queue->num_dw =	445	pf_queue->num_dw =
446	(num_eus + XE_NUM_HW_ENGINES) * PF_MSG_LEN_DW * PF_MULTIPLIER;	446	(num_eus + XE_NUM_HW_ENGINES) * PF_MSG_LEN_DW * PF_MULTIPLIER;
		447	pf_queue->num_dw = roundup_pow_of_two(pf_queue->num_dw);
447	#undef PF_MULTIPLIER	448	#undef PF_MULTIPLIER
448		449
449	pf_queue->gt = gt;	450	pf_queue->gt = gt;

drivers/gpu/drm/xe/xe_lmtt.c+11−0

 	}
 	lmtt_assert(lmtt, xe_bo_is_vram(bo));
+	lmtt_debug(lmtt, "level=%u addr=%#llx\n", level, (u64)xe_bo_main_addr(bo, XE_PAGE_SIZE));
+	xe_map_memset(lmtt_to_xe(lmtt), &bo->vmap, 0, 0, bo->size);
 	pt->level = level;
 	pt->bo = bo;
 static void lmtt_pt_free(struct xe_lmtt_pt *pt)
 {
+	lmtt_debug(&pt->bo->tile->sriov.pf.lmtt, "level=%u addr=%llx\n",
+		   pt->level, (u64)xe_bo_main_addr(pt->bo, XE_PAGE_SIZE));
 	xe_bo_unpin_map_no_vm(pt->bo);
 	kfree(pt);
 }
 	switch (lmtt->ops->lmtt_pte_size(level)) {
 	case sizeof(u32):
+		lmtt_assert(lmtt, !overflows_type(pte, u32));
+		lmtt_assert(lmtt, !pte || !iosys_map_rd(&pt->bo->vmap, idx * sizeof(u32), u32));
 		xe_map_wr(lmtt_to_xe(lmtt), &pt->bo->vmap, idx * sizeof(u32), u32, pte);
 		break;
 	case sizeof(u64):
+		lmtt_assert(lmtt, !pte || !iosys_map_rd(&pt->bo->vmap, idx * sizeof(u64), u64));
 		xe_map_wr(lmtt_to_xe(lmtt), &pt->bo->vmap, idx * sizeof(u64), u64, pte);
 		break;
 	default:

drivers/gpu/drm/xe/xe_migrate.c+1−1

@@ -863,7 +863,7 @@ struct dma_fence xe_migrate_copy(struct xe_migrate m, · 862 unmodified lines
863	if (src_is_vram && xe_migrate_allow_identity(src_L0, &src_it))	863	if (src_is_vram && xe_migrate_allow_identity(src_L0, &src_it))
864	xe_res_next(&src_it, src_L0);	864	xe_res_next(&src_it, src_L0);
865	else	865	else
866	emit_pte(m, bb, src_L0_pt, src_is_vram, copy_system_ccs,	866	emit_pte(m, bb, src_L0_pt, src_is_vram, copy_system_ccs \|\| use_comp_pat,
867	&src_it, src_L0, src);	867	&src_it, src_L0, src);
868		868
869	if (dst_is_vram && xe_migrate_allow_identity(src_L0, &dst_it))	869	if (dst_is_vram && xe_migrate_allow_identity(src_L0, &dst_it))

drivers/gpu/drm/xe/xe_module.c+1−1

@@ -20,7 +20,7 @@ · 19 unmodified lines
20		20
21	struct xe_modparam xe_modparam = {	21	struct xe_modparam xe_modparam = {
22	.probe_display = true,	22	.probe_display = true,
23	.guc_log_level = 3,	23	.guc_log_level = IS_ENABLED(CONFIG_DRM_XE_DEBUG) ? 3 : 1,
24	.force_probe = CONFIG_DRM_XE_FORCE_PROBE,	24	.force_probe = CONFIG_DRM_XE_FORCE_PROBE,
25	.wedged_mode = 1,	25	.wedged_mode = 1,
26	.svm_notifier_size = 512,	26	.svm_notifier_size = 512,

drivers/gpu/drm/xe/xe_pci.c+0−1

@@ -140,7 +140,6 @@ static const struct xe_graphics_desc graphics_xelpg = { · 139 unmodified lines
140	.has_asid = 1, \	140	.has_asid = 1, \
141	.has_atomic_enable_pte_bit = 1, \	141	.has_atomic_enable_pte_bit = 1, \
142	.has_flat_ccs = 1, \	142	.has_flat_ccs = 1, \
143	.has_indirect_ring_state = 1, \
144	.has_range_tlb_invalidation = 1, \	143	.has_range_tlb_invalidation = 1, \
145	.has_usm = 1, \	144	.has_usm = 1, \
146	.has_64bit_timestamp = 1, \	145	.has_64bit_timestamp = 1, \

drivers/gpu/drm/xe/xe_pm.c+6−5

 	/* FIXME: Super racey... */
 	err = xe_bo_evict_all(xe);
 	if (err)
-		goto err_pxp;
+		goto err_display;
 	for_each_gt(gt, xe, id) {
 		err = xe_gt_suspend(gt);
 err_display:
 	xe_display_pm_resume(xe);
-err_pxp:
 	xe_pxp_pm_resume(xe->pxp);
 err:
 	drm_dbg(&xe->drm, "Device suspend failed %d\n", err);
 }
 /**
- * xe_pm_set_vram_threshold - Set a vram threshold for allowing/blocking D3Cold
+ * xe_pm_set_vram_threshold - Set a VRAM threshold for allowing/blocking D3Cold
  * @xe: xe device instance
- * @threshold: VRAM size in bites for the D3cold threshold
+ * @threshold: VRAM size in MiB for the D3cold threshold
  *
- * Returns 0 for success, negative error code otherwise.
+ * Return:
+ * * 0		- success
+ * * -EINVAL	- invalid argument
  */
 int xe_pm_set_vram_threshold(struct xe_device *xe, u32 threshold)
 {

drivers/gpu/drm/xe/xe_uc_fw.c+3−3

@@ -114,10 +114,10 @@ struct fw_blobs_by_type { · 113 unmodified lines
114	#define XE_GT_TYPE_ANY XE_GT_TYPE_UNINITIALIZED	114	#define XE_GT_TYPE_ANY XE_GT_TYPE_UNINITIALIZED
115		115
116	#define XE_GUC_FIRMWARE_DEFS(fw_def, mmp_ver, major_ver) \	116	#define XE_GUC_FIRMWARE_DEFS(fw_def, mmp_ver, major_ver) \
117	fw_def(BATTLEMAGE, GT_TYPE_ANY, major_ver(xe, guc, bmg, 70, 44, 1)) \	117	fw_def(BATTLEMAGE, GT_TYPE_ANY, major_ver(xe, guc, bmg, 70, 45, 2)) \
118	fw_def(LUNARLAKE, GT_TYPE_ANY, major_ver(xe, guc, lnl, 70, 44, 1)) \	118	fw_def(LUNARLAKE, GT_TYPE_ANY, major_ver(xe, guc, lnl, 70, 45, 2)) \
119	fw_def(METEORLAKE, GT_TYPE_ANY, major_ver(i915, guc, mtl, 70, 44, 1)) \	119	fw_def(METEORLAKE, GT_TYPE_ANY, major_ver(i915, guc, mtl, 70, 44, 1)) \
120	fw_def(DG2, GT_TYPE_ANY, major_ver(i915, guc, dg2, 70, 44, 1)) \	120	fw_def(DG2, GT_TYPE_ANY, major_ver(i915, guc, dg2, 70, 45, 2)) \
121	fw_def(DG1, GT_TYPE_ANY, major_ver(i915, guc, dg1, 70, 44, 1)) \	121	fw_def(DG1, GT_TYPE_ANY, major_ver(i915, guc, dg1, 70, 44, 1)) \
122	fw_def(ALDERLAKE_N, GT_TYPE_ANY, major_ver(i915, guc, tgl, 70, 44, 1)) \	122	fw_def(ALDERLAKE_N, GT_TYPE_ANY, major_ver(i915, guc, tgl, 70, 44, 1)) \
123	fw_def(ALDERLAKE_P, GT_TYPE_ANY, major_ver(i915, guc, adlp, 70, 44, 1)) \	123	fw_def(ALDERLAKE_P, GT_TYPE_ANY, major_ver(i915, guc, adlp, 70, 44, 1)) \

drivers/gpu/drm/xe/xe_wa_oob.rules+2−2

@@ -38,10 +38,10 @@ · 37 unmodified lines
38	GRAPHICS_VERSION(2004)	38	GRAPHICS_VERSION(2004)
39	GRAPHICS_VERSION_RANGE(3000, 3001)	39	GRAPHICS_VERSION_RANGE(3000, 3001)
40	22019338487 MEDIA_VERSION(2000)	40	22019338487 MEDIA_VERSION(2000)
41	GRAPHICS_VERSION(2001)	41	GRAPHICS_VERSION(2001), FUNC(xe_rtp_match_not_sriov_vf)
42	MEDIA_VERSION(3000), MEDIA_STEP(A0, B0), FUNC(xe_rtp_match_not_sriov_vf)	42	MEDIA_VERSION(3000), MEDIA_STEP(A0, B0), FUNC(xe_rtp_match_not_sriov_vf)
43	22019338487_display PLATFORM(LUNARLAKE)	43	22019338487_display PLATFORM(LUNARLAKE)
44	16023588340 GRAPHICS_VERSION(2001)	44	16023588340 GRAPHICS_VERSION(2001), FUNC(xe_rtp_match_not_sriov_vf)
45	14019789679 GRAPHICS_VERSION(1255)	45	14019789679 GRAPHICS_VERSION(1255)
46	GRAPHICS_VERSION_RANGE(1270, 2004)	46	GRAPHICS_VERSION_RANGE(1270, 2004)
47	no_media_l3 MEDIA_VERSION(3000)	47	no_media_l3 MEDIA_VERSION(3000)

drivers/md/md-bitmap.c+1−2

@@ -2366,8 +2366,7 @@ static int bitmap_get_stats(void data, struct md_bitmap_stats stats) · 2365 unmodified lines
2366		2366
2367	if (!bitmap)	2367	if (!bitmap)
2368	return -ENOENT;	2368	return -ENOENT;
2369	if (!bitmap->mddev->bitmap_info.external &&	2369	if (!bitmap->storage.sb_page)
2370	!bitmap->storage.sb_page)
2371	return -EINVAL;	2370	return -EINVAL;
2372	sb = kmap_local_page(bitmap->storage.sb_page);	2371	sb = kmap_local_page(bitmap->storage.sb_page);
2373	stats->sync_size = le64_to_cpu(sb->sync_size);	2372	stats->sync_size = le64_to_cpu(sb->sync_size);

drivers/md/raid1.c+3−1

@@ -1399,7 +1399,7 @@ static void raid1_read_request(struct mddev mddev, struct bio bio, · 1398 unmodified lines
1399	}	1399	}
1400	read_bio = bio_alloc_clone(mirror->rdev->bdev, bio, gfp,	1400	read_bio = bio_alloc_clone(mirror->rdev->bdev, bio, gfp,
1401	&mddev->bio_set);	1401	&mddev->bio_set);
1402		1402	read_bio->bi_opf &= ~REQ_NOWAIT;
1403	r1_bio->bios[rdisk] = read_bio;	1403	r1_bio->bios[rdisk] = read_bio;
1404		1404
1405	read_bio->bi_iter.bi_sector = r1_bio->sector +	1405	read_bio->bi_iter.bi_sector = r1_bio->sector +
@@ -1649,6 +1649,7 @@ static void raid1_write_request(struct mddev mddev, struct bio bio, · 243 unmodified lines
1649	wait_for_serialization(rdev, r1_bio);	1649	wait_for_serialization(rdev, r1_bio);
1650	}	1650	}
1651		1651
		1652	mbio->bi_opf &= ~REQ_NOWAIT;
1652	r1_bio->bios[i] = mbio;	1653	r1_bio->bios[i] = mbio;
1653		1654
1654	mbio->bi_iter.bi_sector = (r1_bio->sector + rdev->data_offset);	1655	mbio->bi_iter.bi_sector = (r1_bio->sector + rdev->data_offset);
@@ -3428,6 +3429,7 @@ static int raid1_reshape(struct mddev *mddev) · 1773 unmodified lines
3428	/* ok, everything is stopped */	3429	/* ok, everything is stopped */
3429	oldpool = conf->r1bio_pool;	3430	oldpool = conf->r1bio_pool;
3430	conf->r1bio_pool = newpool;	3431	conf->r1bio_pool = newpool;
		3432	init_waitqueue_head(&conf->r1bio_pool.wait);
3431		3433
3432	for (d = d2 = 0; d < conf->raid_disks; d++) {	3434	for (d = d2 = 0; d < conf->raid_disks; d++) {
3433	struct md_rdev *rdev = conf->mirrors[d].rdev;	3435	struct md_rdev *rdev = conf->mirrors[d].rdev;

drivers/md/raid10.c+10−2

 		}
 	}
-	if (!regular_request_wait(mddev, conf, bio, r10_bio->sectors))
+	if (!regular_request_wait(mddev, conf, bio, r10_bio->sectors)) {
+		raid_end_bio_io(r10_bio);
 		return;
+	}
 	rdev = read_balance(conf, r10_bio, &max_sectors);
 	if (!rdev) {
 		if (err_rdev) {
 		r10_bio->master_bio = bio;
 	}
 	read_bio = bio_alloc_clone(rdev->bdev, bio, gfp, &mddev->bio_set);
+	read_bio->bi_opf &= ~REQ_NOWAIT;
 	r10_bio->devs[slot].bio = read_bio;
 	r10_bio->devs[slot].rdev = rdev;
 			     conf->mirrors[devnum].rdev;
 	mbio = bio_alloc_clone(rdev->bdev, bio, GFP_NOIO, &mddev->bio_set);
+	mbio->bi_opf &= ~REQ_NOWAIT;
 	if (replacement)
 		r10_bio->devs[n_copy].repl_bio = mbio;
 	else
 	}
 	sectors = r10_bio->sectors;
-	if (!regular_request_wait(mddev, conf, bio, sectors))
+	if (!regular_request_wait(mddev, conf, bio, sectors)) {
+		raid_end_bio_io(r10_bio);
 		return;
+	}
 	if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
 	    (mddev->reshape_backwards
 	     ? (bio->bi_iter.bi_sector < conf->reshape_safe &&

drivers/net/can/m_can/m_can.c+1−1

@@ -665,7 +665,7 @@ static int m_can_handle_lost_msg(struct net_device *dev) · 664 unmodified lines
665	struct can_frame *frame;	665	struct can_frame *frame;
666	u32 timestamp = 0;	666	u32 timestamp = 0;
667		667
668	netdev_err(dev, "msg lost in rxf0\n");	668	netdev_dbg(dev, "msg lost in rxf0\n");
669		669
670	stats->rx_errors++;	670	stats->rx_errors++;
671	stats->rx_over_errors++;	671	stats->rx_over_errors++;

drivers/net/ethernet/airoha/airoha_eth.c+1−0

@@ -2984,6 +2984,7 @@ static int airoha_probe(struct platform_device *pdev) · 2983 unmodified lines
2984	error_napi_stop:	2984	error_napi_stop:
2985	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)	2985	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)
2986	airoha_qdma_stop_napi(&eth->qdma[i]);	2986	airoha_qdma_stop_napi(&eth->qdma[i]);
		2987	airoha_ppe_deinit(eth);
2987	error_hw_cleanup:	2988	error_hw_cleanup:
2988	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)	2989	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)
2989	airoha_hw_cleanup(&eth->qdma[i]);	2990	airoha_hw_cleanup(&eth->qdma[i]);

drivers/net/ethernet/broadcom/bnxt/bnxt.c+4−6

@@ -11607,11 +11607,9 @@ static void bnxt_free_irq(struct bnxt *bp) · 11606 unmodified lines
11607		11607
11608	static int bnxt_request_irq(struct bnxt *bp)	11608	static int bnxt_request_irq(struct bnxt *bp)
11609	{	11609	{
		11610	struct cpu_rmap *rmap = NULL;
11610	int i, j, rc = 0;	11611	int i, j, rc = 0;
11611	unsigned long flags = 0;	11612	unsigned long flags = 0;
11612	#ifdef CONFIG_RFS_ACCEL
11613	struct cpu_rmap *rmap;
11614	#endif
11615		11613
11616	rc = bnxt_setup_int_mode(bp);	11614	rc = bnxt_setup_int_mode(bp);
11617	if (rc) {	11615	if (rc) {
@@ -11632,15 +11630,15 @@ static int bnxt_request_irq(struct bnxt *bp) · 14 unmodified lines
11632	int map_idx = bnxt_cp_num_to_irq_num(bp, i);	11630	int map_idx = bnxt_cp_num_to_irq_num(bp, i);
11633	struct bnxt_irq *irq = &bp->irq_tbl[map_idx];	11631	struct bnxt_irq *irq = &bp->irq_tbl[map_idx];
11634		11632
11635	#ifdef CONFIG_RFS_ACCEL	11633	if (IS_ENABLED(CONFIG_RFS_ACCEL) &&
11636	if (rmap && bp->bnapi[i]->rx_ring) {	11634	rmap && bp->bnapi[i]->rx_ring) {
11637	rc = irq_cpu_rmap_add(rmap, irq->vector);	11635	rc = irq_cpu_rmap_add(rmap, irq->vector);
11638	if (rc)	11636	if (rc)
11639	netdev_warn(bp->dev, "failed adding irq rmap for ring %d\n",	11637	netdev_warn(bp->dev, "failed adding irq rmap for ring %d\n",
11640	j);	11638	j);
11641	j++;	11639	j++;
11642	}	11640	}
11643	#endif	11641
11644	rc = request_irq(irq->vector, irq->handler, flags, irq->name,	11642	rc = request_irq(irq->vector, irq->handler, flags, irq->name,
11645	bp->bnapi[i]);	11643	bp->bnapi[i]);
11646	if (rc)	11644	if (rc)

drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c+11−7

 		if (!ctxm->mem_valid || !seg_id)
 			continue;
-		if (trace)
+		if (trace) {
 			extra_hlen = BNXT_SEG_RCD_LEN;
+			if (buf) {
+				u16 trace_type = bnxt_bstore_to_trace[type];
+				bnxt_fill_drv_seg_record(bp, &record, ctxm,
+							 trace_type);
+			}
+		}
 		if (buf)
 			data = buf + BNXT_SEG_HDR_LEN + extra_hlen;
 		seg_len = bnxt_copy_ctx_mem(bp, ctxm, data, 0) + extra_hlen;
 		if (buf) {
 			bnxt_fill_coredump_seg_hdr(bp, &seg_hdr, NULL, seg_len,
 						   0, 0, 0, comp_id, seg_id);
 			memcpy(buf, &seg_hdr, BNXT_SEG_HDR_LEN);
 			buf += BNXT_SEG_HDR_LEN;
-			if (trace) {
+			if (trace)
-				u16 trace_type = bnxt_bstore_to_trace[type];
-				bnxt_fill_drv_seg_record(bp, &record, ctxm,
-							 trace_type);
 				memcpy(buf, &record, BNXT_SEG_RCD_LEN);
-			}
 			buf += seg_len;
 		}
 		len += BNXT_SEG_HDR_LEN + seg_len;

drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c+2−0

@@ -487,7 +487,9 @@ static int bnxt_ets_validate(struct bnxt bp, struct ieee_ets ets, u8 *tc) · 486 unmodified lines
487		487
488	if ((ets->tc_tx_bw[i] \|\| ets->tc_tsa[i]) && i > bp->max_tc)	488	if ((ets->tc_tx_bw[i] \|\| ets->tc_tsa[i]) && i > bp->max_tc)
489	return -EINVAL;	489	return -EINVAL;
		490	}
490		491
		492	for (i = 0; i < max_tc; i++) {
491	switch (ets->tc_tsa[i]) {	493	switch (ets->tc_tsa[i]) {
492	case IEEE_8021QAZ_TSA_STRICT:	494	case IEEE_8021QAZ_TSA_STRICT:
493	break;	495	break;

drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c+1−1

@@ -115,7 +115,7 @@ static void __bnxt_xmit_xdp_redirect(struct bnxt *bp, · 114 unmodified lines
115	tx_buf->action = XDP_REDIRECT;	115	tx_buf->action = XDP_REDIRECT;
116	tx_buf->xdpf = xdpf;	116	tx_buf->xdpf = xdpf;
117	dma_unmap_addr_set(tx_buf, mapping, mapping);	117	dma_unmap_addr_set(tx_buf, mapping, mapping);
118	dma_unmap_len_set(tx_buf, len, 0);	118	dma_unmap_len_set(tx_buf, len, len);
119	}	119	}
120		120
121	void bnxt_tx_int_xdp(struct bnxt bp, struct bnxt_napi bnapi, int budget)	121	void bnxt_tx_int_xdp(struct bnxt bp, struct bnxt_napi bnapi, int budget)

drivers/net/ethernet/broadcom/genet/bcmgenet.c+6−0

 	for (i = 0; i <= priv->hw_params->rx_queues; i++)
 		priv->rx_rings[i].rx_max_coalesced_frames = 1;
+	/* Initialize u64 stats seq counter for 32bit machines */
+	for (i = 0; i <= priv->hw_params->rx_queues; i++)
+		u64_stats_init(&priv->rx_rings[i].stats64.syncp);
+	for (i = 0; i <= priv->hw_params->tx_queues; i++)
+		u64_stats_init(&priv->tx_rings[i].stats64.syncp);
 	/* libphy will determine the link state */
 	netif_carrier_off(dev);

drivers/net/ethernet/cavium/thunder/nicvf_main.c+3−9

@@ -1578,7 +1578,6 @@ napi_del: · 1577 unmodified lines
1578	static int nicvf_change_mtu(struct net_device *netdev, int new_mtu)	1578	static int nicvf_change_mtu(struct net_device *netdev, int new_mtu)
1579	{	1579	{
1580	struct nicvf *nic = netdev_priv(netdev);	1580	struct nicvf *nic = netdev_priv(netdev);
1581	int orig_mtu = netdev->mtu;
1582		1581
1583	/* For now just support only the usual MTU sized frames,	1582	/* For now just support only the usual MTU sized frames,
1584	* plus some headroom for VLAN, QinQ.	1583	* plus some headroom for VLAN, QinQ.
@@ -1589,15 +1588,10 @@ static int nicvf_change_mtu(struct net_device *netdev, int new_mtu) · 4 unmodified lines
1589	return -EINVAL;	1588	return -EINVAL;
1590	}	1589	}
1591		1590
1592	WRITE_ONCE(netdev->mtu, new_mtu);	1591	if (netif_running(netdev) && nicvf_update_hw_max_frs(nic, new_mtu))
1593
1594	if (!netif_running(netdev))
1595	return 0;
1596
1597	if (nicvf_update_hw_max_frs(nic, new_mtu)) {
1598	netdev->mtu = orig_mtu;
1599	return -EINVAL;	1592	return -EINVAL;
1600	}	1593
		1594	WRITE_ONCE(netdev->mtu, new_mtu);
1601		1595
1602	return 0;	1596	return 0;
1603	}	1597	}

drivers/net/ethernet/ibm/ibmvnic.h+6−2

 	u8 reserved[72];
 } __packed __aligned(8);
-#define NUM_TX_STATS 3
 struct ibmvnic_tx_queue_stats {
 	u64 batched_packets;
 	u64 direct_packets;
 	u64 dropped_packets;
 };
-#define NUM_RX_STATS 3
+#define NUM_TX_STATS \
+	(sizeof(struct ibmvnic_tx_queue_stats) / sizeof(u64))
 struct ibmvnic_rx_queue_stats {
 	u64 packets;
 	u64 bytes;
 	u64 interrupts;
 };
+#define NUM_RX_STATS \
+	(sizeof(struct ibmvnic_rx_queue_stats) / sizeof(u64))
 struct ibmvnic_acl_buffer {
 	__be32 len;
 	__be32 version;

drivers/net/ethernet/mellanox/mlx5/core/en/fs.h+7−2

 enum {
 	MLX5E_TC_PRIO = 0,
-	MLX5E_NIC_PRIO
+	MLX5E_PROMISC_PRIO,
+	MLX5E_NIC_PRIO,
 };
 struct mlx5e_flow_table {
 				 MLX5_HASH_FIELD_SEL_DST_IP   |\
 				 MLX5_HASH_FIELD_SEL_IPSEC_SPI)
-/* NIC prio FTS */
+/* NIC promisc FT level */
 enum {
 	MLX5E_PROMISC_FT_LEVEL,
+};
+/* NIC prio FTS */
+enum {
 	MLX5E_VLAN_FT_LEVEL,
 	MLX5E_L2_FT_LEVEL,
 	MLX5E_TTC_FT_LEVEL,

drivers/net/ethernet/mellanox/mlx5/core/en_dim.c+2−2

@@ -113,7 +113,7 @@ int mlx5e_dim_rx_change(struct mlx5e_rq *rq, bool enable) · 112 unmodified lines
113	__set_bit(MLX5E_RQ_STATE_DIM, &rq->state);	113	__set_bit(MLX5E_RQ_STATE_DIM, &rq->state);
114	} else {	114	} else {
115	__clear_bit(MLX5E_RQ_STATE_DIM, &rq->state);	115	__clear_bit(MLX5E_RQ_STATE_DIM, &rq->state);
116		116	synchronize_net();
117	mlx5e_dim_disable(rq->dim);	117	mlx5e_dim_disable(rq->dim);
118	rq->dim = NULL;	118	rq->dim = NULL;
119	}	119	}
@@ -140,7 +140,7 @@ int mlx5e_dim_tx_change(struct mlx5e_txqsq *sq, bool enable) · 20 unmodified lines
140	__set_bit(MLX5E_SQ_STATE_DIM, &sq->state);	140	__set_bit(MLX5E_SQ_STATE_DIM, &sq->state);
141	} else {	141	} else {
142	__clear_bit(MLX5E_SQ_STATE_DIM, &sq->state);	142	__clear_bit(MLX5E_SQ_STATE_DIM, &sq->state);
143		143	synchronize_net();
144	mlx5e_dim_disable(sq->dim);	144	mlx5e_dim_disable(sq->dim);
145	sq->dim = NULL;	145	sq->dim = NULL;
146	}	146	}

drivers/net/ethernet/mellanox/mlx5/core/en_fs.c+1−1

@@ -780,7 +780,7 @@ static int mlx5e_create_promisc_table(struct mlx5e_flow_steering *fs) · 779 unmodified lines
780	ft_attr.max_fte = MLX5E_PROMISC_TABLE_SIZE;	780	ft_attr.max_fte = MLX5E_PROMISC_TABLE_SIZE;
781	ft_attr.autogroup.max_num_groups = 1;	781	ft_attr.autogroup.max_num_groups = 1;
782	ft_attr.level = MLX5E_PROMISC_FT_LEVEL;	782	ft_attr.level = MLX5E_PROMISC_FT_LEVEL;
783	ft_attr.prio = MLX5E_NIC_PRIO;	783	ft_attr.prio = MLX5E_PROMISC_PRIO;
784		784
785	ft->t = mlx5_create_auto_grouped_flow_table(fs->ns, &ft_attr);	785	ft->t = mlx5_create_auto_grouped_flow_table(fs->ns, &ft_attr);
786	if (IS_ERR(ft->t)) {	786	if (IS_ERR(ft->t)) {

drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c+1−0

@@ -1076,6 +1076,7 @@ static int esw_qos_vports_node_update_parent(struct mlx5_esw_sched_node *node, · 1075 unmodified lines
1076	return err;	1076	return err;
1077	}	1077	}
1078	esw_qos_node_set_parent(node, parent);	1078	esw_qos_node_set_parent(node, parent);
		1079	node->bw_share = 0;
1079		1080
1080	return 0;	1081	return 0;
1081	}	1082	}

drivers/net/ethernet/mellanox/mlx5/core/fs_core.c+9−4

 #define ETHTOOL_PRIO_NUM_LEVELS 1
 #define ETHTOOL_NUM_PRIOS 11
 #define ETHTOOL_MIN_LEVEL (KERNEL_MIN_LEVEL + ETHTOOL_NUM_PRIOS)
-/* Promiscuous, Vlan, mac, ttc, inner ttc, {UDP/ANY/aRFS/accel/{esp, esp_err}}, IPsec policy,
+/* Vlan, mac, ttc, inner ttc, {UDP/ANY/aRFS/accel/{esp, esp_err}}, IPsec policy,
  * {IPsec RoCE MPV,Alias table},IPsec RoCE policy
  */
-#define KERNEL_NIC_PRIO_NUM_LEVELS 11
+#define KERNEL_NIC_PRIO_NUM_LEVELS 10
 #define KERNEL_NIC_NUM_PRIOS 1
-/* One more level for tc */
+/* One more level for tc, and one more for promisc */
-#define KERNEL_MIN_LEVEL (KERNEL_NIC_PRIO_NUM_LEVELS + 1)
+#define KERNEL_MIN_LEVEL (KERNEL_NIC_PRIO_NUM_LEVELS + 2)
+#define KERNEL_NIC_PROMISC_NUM_PRIOS 1
+#define KERNEL_NIC_PROMISC_NUM_LEVELS 1
 #define KERNEL_NIC_TC_NUM_PRIOS  1
 #define KERNEL_NIC_TC_NUM_LEVELS 3
 			   ADD_NS(MLX5_FLOW_TABLE_MISS_ACTION_DEF,
 				  ADD_MULTIPLE_PRIO(KERNEL_NIC_TC_NUM_PRIOS,
 						    KERNEL_NIC_TC_NUM_LEVELS),
+				  ADD_MULTIPLE_PRIO(KERNEL_NIC_PROMISC_NUM_PRIOS,
+						    KERNEL_NIC_PROMISC_NUM_LEVELS),
 				  ADD_MULTIPLE_PRIO(KERNEL_NIC_NUM_PRIOS,
 						    KERNEL_NIC_PRIO_NUM_LEVELS))),
 		  ADD_PRIO(0, BY_PASS_MIN_LEVEL, 0, FS_CHAINING_CAPS,

drivers/net/ethernet/renesas/rtsn.c+5−0

 	priv = netdev_priv(ndev);
 	priv->pdev = pdev;
 	priv->ndev = ndev;
 	priv->ptp_priv = rcar_gen4_ptp_alloc(pdev);
+	if (!priv->ptp_priv) {
+		ret = -ENOMEM;
+		goto error_free;
+	}
 	spin_lock_init(&priv->lock);
 	platform_set_drvdata(pdev, priv);

drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c+11−13

@@ -364,19 +364,17 @@ static int dwxgmac2_dma_interrupt(struct stmmac_priv *priv, · 363 unmodified lines
364	}	364	}
365		365
366	/* TX/RX NORMAL interrupts */	366	/* TX/RX NORMAL interrupts */
367	if (likely(intr_status & XGMAC_NIS)) {	367	if (likely(intr_status & XGMAC_RI)) {
368	if (likely(intr_status & XGMAC_RI)) {	368	u64_stats_update_begin(&stats->syncp);
369	u64_stats_update_begin(&stats->syncp);	369	u64_stats_inc(&stats->rx_normal_irq_n[chan]);
370	u64_stats_inc(&stats->rx_normal_irq_n[chan]);	370	u64_stats_update_end(&stats->syncp);
371	u64_stats_update_end(&stats->syncp);	371	ret \|= handle_rx;
372	ret \|= handle_rx;	372	}
373	}	373	if (likely(intr_status & (XGMAC_TI \| XGMAC_TBU))) {
374	if (likely(intr_status & (XGMAC_TI \| XGMAC_TBU))) {	374	u64_stats_update_begin(&stats->syncp);
375	u64_stats_update_begin(&stats->syncp);	375	u64_stats_inc(&stats->tx_normal_irq_n[chan]);
376	u64_stats_inc(&stats->tx_normal_irq_n[chan]);	376	u64_stats_update_end(&stats->syncp);
377	u64_stats_update_end(&stats->syncp);	377	ret \|= handle_tx;
378	ret \|= handle_tx;
379	}
380	}	378	}
381		379
382	/* Clear interrupts */	380	/* Clear interrupts */

drivers/net/ethernet/ti/am65-cpsw-nuss.c+1−3

 {
 	struct sk_buff *skb;
-	len += AM65_CPSW_HEADROOM;
 	skb = build_skb(page_addr, len);
 	if (unlikely(!skb))
 		return NULL;
 	}
 	skb = am65_cpsw_build_skb(page_addr, ndev,
-				  AM65_CPSW_MAX_PACKET_SIZE, headroom);
+				  PAGE_SIZE, headroom);
 	if (unlikely(!skb)) {
 		new_page = page;
 		goto requeue;

drivers/net/ethernet/xilinx/ll_temac_main.c+1−1

@@ -1309,7 +1309,7 @@ ll_temac_ethtools_set_ringparam(struct net_device *ndev, · 1308 unmodified lines
1309	if (ering->rx_pending > RX_BD_NUM_MAX \|\|	1309	if (ering->rx_pending > RX_BD_NUM_MAX \|\|
1310	ering->rx_mini_pending \|\|	1310	ering->rx_mini_pending \|\|
1311	ering->rx_jumbo_pending \|\|	1311	ering->rx_jumbo_pending \|\|
1312	ering->rx_pending > TX_BD_NUM_MAX)	1312	ering->tx_pending > TX_BD_NUM_MAX)
1313	return -EINVAL;	1313	return -EINVAL;
1314		1314
1315	if (netif_running(ndev))	1315	if (netif_running(ndev))

drivers/net/phy/microchip.c+2−1

 	 * As workaround, set to 10 before setting to 100
 	 * at forced 100 F/H mode.
 	 */
-	if (!phydev->autoneg && phydev->speed == 100) {
+	if (phydev->state == PHY_NOLINK && !phydev->autoneg && phydev->speed == 100) {
 		/* disable phy interrupt */
 		temp = phy_read(phydev, LAN88XX_INT_MASK);
 		temp &= ~LAN88XX_INT_MASK_MDINTPIN_EN_;
 	.config_init	= lan88xx_config_init,
 	.config_aneg	= lan88xx_config_aneg,
 	.link_change_notify = lan88xx_link_change_notify,
+	.soft_reset	= genphy_soft_reset,
 	/* Interrupt handling is broken, do not define related
 	 * functions to force polling.

drivers/net/phy/qcom/at803x.c+0−27

@@ -26,9 +26,6 @@ · 25 unmodified lines
26		26
27	#define AT803X_LED_CONTROL 0x18	27	#define AT803X_LED_CONTROL 0x18
28		28
29	#define AT803X_PHY_MMD3_WOL_CTRL 0x8012
30	#define AT803X_WOL_EN BIT(5)
31
32	#define AT803X_REG_CHIP_CONFIG 0x1f	29	#define AT803X_REG_CHIP_CONFIG 0x1f
33	#define AT803X_BT_BX_REG_SEL 0x8000	30	#define AT803X_BT_BX_REG_SEL 0x8000
34		31
@@ -866,30 +863,6 @@ static int at8031_config_init(struct phy_device *phydev) · 831 unmodified lines
866	return at803x_config_init(phydev);	863	return at803x_config_init(phydev);
867	}	864	}
868		865
869	static int at8031_set_wol(struct phy_device *phydev,
870	struct ethtool_wolinfo *wol)
871	{
872	int ret;
873
874	/* First setup MAC address and enable WOL interrupt */
875	ret = at803x_set_wol(phydev, wol);
876	if (ret)
877	return ret;
878
879	if (wol->wolopts & WAKE_MAGIC)
880	/* Enable WOL function for 1588 */
881	ret = phy_modify_mmd(phydev, MDIO_MMD_PCS,
882	AT803X_PHY_MMD3_WOL_CTRL,
883	0, AT803X_WOL_EN);
884	else
885	/* Disable WoL function for 1588 */
886	ret = phy_modify_mmd(phydev, MDIO_MMD_PCS,
887	AT803X_PHY_MMD3_WOL_CTRL,
888	AT803X_WOL_EN, 0);
889
890	return ret;
891	}
892
893	static int at8031_config_intr(struct phy_device *phydev)	866	static int at8031_config_intr(struct phy_device *phydev)
894	{	867	{
895	struct at803x_priv *priv = phydev->priv;	868	struct at803x_priv *priv = phydev->priv;

drivers/net/phy/qcom/qca808x.c+1−1

@@ -633,7 +633,7 @@ static struct phy_driver qca808x_driver[] = { · 632 unmodified lines
633	.handle_interrupt = at803x_handle_interrupt,	633	.handle_interrupt = at803x_handle_interrupt,
634	.get_tunable = at803x_get_tunable,	634	.get_tunable = at803x_get_tunable,
635	.set_tunable = at803x_set_tunable,	635	.set_tunable = at803x_set_tunable,
636	.set_wol = at803x_set_wol,	636	.set_wol = at8031_set_wol,
637	.get_wol = at803x_get_wol,	637	.get_wol = at803x_get_wol,
638	.get_features = qca808x_get_features,	638	.get_features = qca808x_get_features,
639	.config_aneg = qca808x_config_aneg,	639	.config_aneg = qca808x_config_aneg,

drivers/net/phy/qcom/qcom-phy-lib.c+25−0

@@ -115,6 +115,31 @@ int at803x_set_wol(struct phy_device *phydev, · 114 unmodified lines
115	}	115	}
116	EXPORT_SYMBOL_GPL(at803x_set_wol);	116	EXPORT_SYMBOL_GPL(at803x_set_wol);
117		117
		118	int at8031_set_wol(struct phy_device *phydev,
		119	struct ethtool_wolinfo *wol)
		120	{
		121	int ret;
		122
		123	/* First setup MAC address and enable WOL interrupt */
		124	ret = at803x_set_wol(phydev, wol);
		125	if (ret)
		126	return ret;
		127
		128	if (wol->wolopts & WAKE_MAGIC)
		129	/* Enable WOL function for 1588 */
		130	ret = phy_modify_mmd(phydev, MDIO_MMD_PCS,
		131	AT803X_PHY_MMD3_WOL_CTRL,
		132	0, AT803X_WOL_EN);
		133	else
		134	/* Disable WoL function for 1588 */
		135	ret = phy_modify_mmd(phydev, MDIO_MMD_PCS,
		136	AT803X_PHY_MMD3_WOL_CTRL,
		137	AT803X_WOL_EN, 0);
		138
		139	return ret;
		140	}
		141	EXPORT_SYMBOL_GPL(at8031_set_wol);
		142
118	void at803x_get_wol(struct phy_device *phydev,	143	void at803x_get_wol(struct phy_device *phydev,
119	struct ethtool_wolinfo *wol)	144	struct ethtool_wolinfo *wol)
120	{	145	{

drivers/net/phy/qcom/qcom.h+5−0

 #define AT803X_LOC_MAC_ADDR_16_31_OFFSET	0x804B
 #define AT803X_LOC_MAC_ADDR_32_47_OFFSET	0x804A
+#define AT803X_PHY_MMD3_WOL_CTRL		0x8012
+#define AT803X_WOL_EN				BIT(5)
 #define AT803X_DEBUG_ADDR			0x1D
 #define AT803X_DEBUG_DATA			0x1E
 int at803x_debug_reg_write(struct phy_device *phydev, u16 reg, u16 data);
 int at803x_set_wol(struct phy_device *phydev,
 		   struct ethtool_wolinfo *wol);
+int at8031_set_wol(struct phy_device *phydev,
+		   struct ethtool_wolinfo *wol);
 void at803x_get_wol(struct phy_device *phydev,
 		    struct ethtool_wolinfo *wol);
 int at803x_ack_interrupt(struct phy_device *phydev);

drivers/net/phy/smsc.c+52−5

@@ -155,10 +155,29 @@ static int smsc_phy_reset(struct phy_device *phydev) · 154 unmodified lines
155		155
156	static int lan87xx_config_aneg(struct phy_device *phydev)	156	static int lan87xx_config_aneg(struct phy_device *phydev)
157	{	157	{
158	int rc;	158	u8 mdix_ctrl;
159	int val;	159	int val;
		160	int rc;
		161
		162	/* When auto-negotiation is disabled (forced mode), the PHY's
		163	* Auto-MDIX will continue toggling the TX/RX pairs.
		164	*
		165	* To establish a stable link, we must select a fixed MDI mode.
		166	* If the user has not specified a fixed MDI mode (i.e., mdix_ctrl is
		167	* 'auto'), we default to ETH_TP_MDI. This choice of a ETH_TP_MDI mode
		168	* mirrors the behavior the hardware would exhibit if the AUTOMDIX_EN
		169	* strap were configured for a fixed MDI connection.
		170	*/
		171	if (phydev->autoneg == AUTONEG_DISABLE) {
		172	if (phydev->mdix_ctrl == ETH_TP_MDI_AUTO)
		173	mdix_ctrl = ETH_TP_MDI;
		174	else
		175	mdix_ctrl = phydev->mdix_ctrl;
		176	} else {
		177	mdix_ctrl = phydev->mdix_ctrl;
		178	}
160		179
161	switch (phydev->mdix_ctrl) {	180	switch (mdix_ctrl) {
162	case ETH_TP_MDI:	181	case ETH_TP_MDI:
163	val = SPECIAL_CTRL_STS_OVRRD_AMDIX_;	182	val = SPECIAL_CTRL_STS_OVRRD_AMDIX_;
164	break;	183	break;
@@ -167,7 +186,8 @@ static int lan87xx_config_aneg(struct phy_device *phydev) · 2 unmodified lines
167	SPECIAL_CTRL_STS_AMDIX_STATE_;	186	SPECIAL_CTRL_STS_AMDIX_STATE_;
168	break;	187	break;
169	case ETH_TP_MDI_AUTO:	188	case ETH_TP_MDI_AUTO:
170	val = SPECIAL_CTRL_STS_AMDIX_ENABLE_;	189	val = SPECIAL_CTRL_STS_OVRRD_AMDIX_ \|
		190	SPECIAL_CTRL_STS_AMDIX_ENABLE_;
171	break;	191	break;
172	default:	192	default:
173	return genphy_config_aneg(phydev);	193	return genphy_config_aneg(phydev);
@@ -183,7 +203,7 @@ static int lan87xx_config_aneg(struct phy_device *phydev) · 9 unmodified lines
183	rc \|= val;	203	rc \|= val;
184	phy_write(phydev, SPECIAL_CTRL_STS, rc);	204	phy_write(phydev, SPECIAL_CTRL_STS, rc);
185		205
186	phydev->mdix = phydev->mdix_ctrl;	206	phydev->mdix = mdix_ctrl;
187	return genphy_config_aneg(phydev);	207	return genphy_config_aneg(phydev);
188	}	208	}
189		209
@@ -261,6 +281,33 @@ int lan87xx_read_status(struct phy_device *phydev) · 71 unmodified lines
261	}	281	}
262	EXPORT_SYMBOL_GPL(lan87xx_read_status);	282	EXPORT_SYMBOL_GPL(lan87xx_read_status);
263		283
		284	static int lan87xx_phy_config_init(struct phy_device *phydev)
		285	{
		286	int rc;
		287
		288	/* The LAN87xx PHY's initial MDI-X mode is determined by the AUTOMDIX_EN
		289	* hardware strap, but the driver cannot read the strap's status. This
		290	* creates an unpredictable initial state.
		291	*
		292	* To ensure consistent and reliable behavior across all boards,
		293	* override the strap configuration on initialization and force the PHY
		294	* into a known state with Auto-MDIX enabled, which is the expected
		295	* default for modern hardware.
		296	*/
		297	rc = phy_modify(phydev, SPECIAL_CTRL_STS,
		298	SPECIAL_CTRL_STS_OVRRD_AMDIX_ \|
		299	SPECIAL_CTRL_STS_AMDIX_ENABLE_ \|
		300	SPECIAL_CTRL_STS_AMDIX_STATE_,
		301	SPECIAL_CTRL_STS_OVRRD_AMDIX_ \|
		302	SPECIAL_CTRL_STS_AMDIX_ENABLE_);
		303	if (rc < 0)
		304	return rc;
		305
		306	phydev->mdix_ctrl = ETH_TP_MDI_AUTO;
		307
		308	return smsc_phy_config_init(phydev);
		309	}
		310
264	static int lan874x_phy_config_init(struct phy_device *phydev)	311	static int lan874x_phy_config_init(struct phy_device *phydev)
265	{	312	{
266	u16 val;	313	u16 val;
@@ -695,7 +742,7 @@ static struct phy_driver smsc_phy_driver[] = { · 428 unmodified lines
695		742
696	/* basic functions */	743	/* basic functions */
697	.read_status = lan87xx_read_status,	744	.read_status = lan87xx_read_status,
698	.config_init = smsc_phy_config_init,	745	.config_init = lan87xx_phy_config_init,
699	.soft_reset = smsc_phy_reset,	746	.soft_reset = smsc_phy_reset,
700	.config_aneg = lan87xx_config_aneg,	747	.config_aneg = lan87xx_config_aneg,
701		748

drivers/net/wireless/marvell/mwifiex/util.c+3−1

 				    "auth: receive authentication from %pM\n",
 				    ieee_hdr->addr3);
 		} else {
-			if (!priv->wdev.connected)
+			if (!priv->wdev.connected ||
+			    !ether_addr_equal(ieee_hdr->addr3,
+					      priv->curr_bss_params.bss_descriptor.mac_address))
 				return 0;
 			if (ieee80211_is_deauth(ieee_hdr->frame_control)) {

drivers/net/wireless/mediatek/mt76/mt76.h+10−0

@@ -1224,6 +1224,16 @@ static inline int mt76_wed_dma_setup(struct mt76_dev dev, struct mt76_queue q, · 1223 unmodified lines
1224	#define mt76_dereference(p, dev) \	1224	#define mt76_dereference(p, dev) \
1225	rcu_dereference_protected(p, lockdep_is_held(&(dev)->mutex))	1225	rcu_dereference_protected(p, lockdep_is_held(&(dev)->mutex))
1226		1226
		1227	static inline struct mt76_wcid *
		1228	__mt76_wcid_ptr(struct mt76_dev *dev, u16 idx)
		1229	{
		1230	if (idx >= ARRAY_SIZE(dev->wcid))
		1231	return NULL;
		1232	return rcu_dereference(dev->wcid[idx]);
		1233	}
		1234
		1235	#define mt76_wcid_ptr(dev, idx) __mt76_wcid_ptr(&(dev)->mt76, idx)
		1236
1227	struct mt76_dev mt76_alloc_device(struct device pdev, unsigned int size,	1237	struct mt76_dev mt76_alloc_device(struct device pdev, unsigned int size,
1228	const struct ieee80211_ops *ops,	1238	const struct ieee80211_ops *ops,
1229	const struct mt76_driver_ops *drv_ops);	1239	const struct mt76_driver_ops *drv_ops);

drivers/net/wireless/mediatek/mt76/mt7603/dma.c+1−1

@@ -44,7 +44,7 @@ mt7603_rx_loopback_skb(struct mt7603_dev dev, struct sk_buff skb) · 43 unmodified lines
44	if (idx >= MT7603_WTBL_STA - 1)	44	if (idx >= MT7603_WTBL_STA - 1)
45	goto free;	45	goto free;
46		46
47	wcid = rcu_dereference(dev->mt76.wcid[idx]);	47	wcid = mt76_wcid_ptr(dev, idx);
48	if (!wcid)	48	if (!wcid)
49	goto free;	49	goto free;
50		50

drivers/net/wireless/mediatek/mt76/mt7603/mac.c+2−8

 	struct mt7603_sta *sta;
 	struct mt76_wcid *wcid;
-	if (idx >= MT7603_WTBL_SIZE)
+	wcid = mt76_wcid_ptr(dev, idx);
-		return NULL;
-	wcid = rcu_dereference(dev->mt76.wcid[idx]);
 	if (unicast || !wcid)
 		return wcid;
 	if (pid == MT_PACKET_ID_NO_ACK)
 		return;
-	if (wcidx >= MT7603_WTBL_SIZE)
-		return;
 	rcu_read_lock();
-	wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
+	wcid = mt76_wcid_ptr(dev, wcidx);
 	if (!wcid)
 		goto out;

drivers/net/wireless/mediatek/mt76/mt7615/mac.c+2−5

 	struct mt7615_sta *sta;
 	struct mt76_wcid *wcid;
-	if (idx >= MT7615_WTBL_SIZE)
+	wcid = mt76_wcid_ptr(dev, idx);
-		return NULL;
-	wcid = rcu_dereference(dev->mt76.wcid[idx]);
 	if (unicast || !wcid)
 		return wcid;
 	rcu_read_lock();
-	wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
+	wcid = mt76_wcid_ptr(dev, wcidx);
 	if (!wcid)
 		goto out;

drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c+1−1

@@ -1172,7 +1172,7 @@ void mt76_connac2_txwi_free(struct mt76_dev dev, struct mt76_txwi_cache t, · 1171 unmodified lines
1172	wcid_idx = wcid->idx;	1172	wcid_idx = wcid->idx;
1173	} else {	1173	} else {
1174	wcid_idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);	1174	wcid_idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);
1175	wcid = rcu_dereference(dev->wcid[wcid_idx]);	1175	wcid = __mt76_wcid_ptr(dev, wcid_idx);
1176		1176
1177	if (wcid && wcid->sta) {	1177	if (wcid && wcid->sta) {
1178	sta = container_of((void *)wcid, struct ieee80211_sta,	1178	sta = container_of((void *)wcid, struct ieee80211_sta,

drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c+3−3

@@ -287,7 +287,7 @@ __mt76_connac_mcu_alloc_sta_req(struct mt76_dev dev, struct mt76_vif_link mvif · 286 unmodified lines
287		287
288	mt76_connac_mcu_get_wlan_idx(dev, wcid, &hdr.wlan_idx_lo,	288	mt76_connac_mcu_get_wlan_idx(dev, wcid, &hdr.wlan_idx_lo,
289	&hdr.wlan_idx_hi);	289	&hdr.wlan_idx_hi);
290	skb = mt76_mcu_msg_alloc(dev, NULL, len);	290	skb = __mt76_mcu_msg_alloc(dev, NULL, len, len, GFP_ATOMIC);
291	if (!skb)	291	if (!skb)
292	return ERR_PTR(-ENOMEM);	292	return ERR_PTR(-ENOMEM);
293		293
@@ -1740,8 +1740,8 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy phy, struct ieee80211_vif vif, · 1446 unmodified lines
1740	if (!sreq->ssids[i].ssid_len)	1740	if (!sreq->ssids[i].ssid_len)
1741	continue;	1741	continue;
1742		1742
1743	req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);	1743	req->ssids[n_ssids].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
1744	memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,	1744	memcpy(req->ssids[n_ssids].ssid, sreq->ssids[i].ssid,
1745	sreq->ssids[i].ssid_len);	1745	sreq->ssids[i].ssid_len);
1746	n_ssids++;	1746	n_ssids++;
1747	}	1747	}

drivers/net/wireless/mediatek/mt76/mt76x02.h+1−4

@@ -262,10 +262,7 @@ mt76x02_rx_get_sta(struct mt76_dev *dev, u8 idx) · 261 unmodified lines
262	{	262	{
263	struct mt76_wcid *wcid;	263	struct mt76_wcid *wcid;
264		264
265	if (idx >= MT76x02_N_WCIDS)	265	wcid = __mt76_wcid_ptr(dev, idx);
266	return NULL;
267
268	wcid = rcu_dereference(dev->wcid[idx]);
269	if (!wcid)	266	if (!wcid)
270	return NULL;	267	return NULL;
271		268

drivers/net/wireless/mediatek/mt76/mt76x02_mac.c+1−3

@@ -564,9 +564,7 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev, · 563 unmodified lines
564		564
565	rcu_read_lock();	565	rcu_read_lock();
566		566
567	if (stat->wcid < MT76x02_N_WCIDS)	567	wcid = mt76_wcid_ptr(dev, stat->wcid);
568	wcid = rcu_dereference(dev->mt76.wcid[stat->wcid]);
569
570	if (wcid && wcid->sta) {	568	if (wcid && wcid->sta) {
571	void *priv;	569	void *priv;
572		570

drivers/net/wireless/mediatek/mt76/mt7915/mac.c+3−9

 	struct mt7915_sta *sta;
 	struct mt76_wcid *wcid;
-	if (idx >= ARRAY_SIZE(dev->mt76.wcid))
+	wcid = mt76_wcid_ptr(dev, idx);
-		return NULL;
-	wcid = rcu_dereference(dev->mt76.wcid[idx]);
 	if (unicast || !wcid)
 		return wcid;
 			u16 idx;
 			idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
-			wcid = rcu_dereference(dev->mt76.wcid[idx]);
+			wcid = mt76_wcid_ptr(dev, idx);
 			sta = wcid_to_sta(wcid);
 			if (!sta)
 				continue;
 	if (pid < MT_PACKET_ID_WED)
 		return;
-	if (wcidx >= mt7915_wtbl_size(dev))
-		return;
 	rcu_read_lock();
-	wcid = rcu_dereference(dev->mt76.wcid[wcidx]);
+	wcid = mt76_wcid_ptr(dev, wcidx);
 	if (!wcid)
 		goto out;

drivers/net/wireless/mediatek/mt76/mt7915/mcu.c+1−1

@@ -3986,7 +3986,7 @@ int mt7915_mcu_wed_wa_tx_stats(struct mt7915_dev *dev, u16 wlan_idx) · 3985 unmodified lines
3986		3986
3987	rcu_read_lock();	3987	rcu_read_lock();
3988		3988
3989	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);	3989	wcid = mt76_wcid_ptr(dev, wlan_idx);
3990	if (wcid)	3990	if (wcid)
3991	wcid->stats.tx_packets += le32_to_cpu(res->tx_packets);	3991	wcid->stats.tx_packets += le32_to_cpu(res->tx_packets);
3992	else	3992	else

drivers/net/wireless/mediatek/mt76/mt7915/mmio.c+1−4

 	dev = container_of(wed, struct mt7915_dev, mt76.mmio.wed);
-	if (idx >= mt7915_wtbl_size(dev))
-		return;
 	rcu_read_lock();
-	wcid = rcu_dereference(dev->mt76.wcid[idx]);
+	wcid = mt76_wcid_ptr(dev, idx);
 	if (wcid) {
 		wcid->stats.rx_bytes += le32_to_cpu(stats->rx_byte_cnt);
 		wcid->stats.rx_packets += le32_to_cpu(stats->rx_pkt_cnt);

drivers/net/wireless/mediatek/mt76/mt7921/mac.c+3−3

@@ -465,7 +465,7 @@ void mt7921_mac_add_txs(struct mt792x_dev dev, void data) · 464 unmodified lines
465		465
466	rcu_read_lock();	466	rcu_read_lock();
467		467
468	wcid = rcu_dereference(dev->mt76.wcid[wcidx]);	468	wcid = mt76_wcid_ptr(dev, wcidx);
469	if (!wcid)	469	if (!wcid)
470	goto out;	470	goto out;
471		471
@@ -516,7 +516,7 @@ static void mt7921_mac_tx_free(struct mt792x_dev dev, void data, int len) · 44 unmodified lines
516		516
517	count++;	517	count++;
518	idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);	518	idx = FIELD_GET(MT_TX_FREE_WLAN_ID, info);
519	wcid = rcu_dereference(dev->mt76.wcid[idx]);	519	wcid = mt76_wcid_ptr(dev, idx);
520	sta = wcid_to_sta(wcid);	520	sta = wcid_to_sta(wcid);
521	if (!sta)	521	if (!sta)
522	continue;	522	continue;
@@ -816,7 +816,7 @@ void mt7921_usb_sdio_tx_complete_skb(struct mt76_dev *mdev, · 293 unmodified lines
816	u16 idx;	816	u16 idx;
817		817
818	idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);	818	idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);
819	wcid = rcu_dereference(mdev->wcid[idx]);	819	wcid = __mt76_wcid_ptr(mdev, idx);
820	sta = wcid_to_sta(wcid);	820	sta = wcid_to_sta(wcid);
821		821
822	if (sta && likely(e->skb->protocol != cpu_to_be16(ETH_P_PAE)))	822	if (sta && likely(e->skb->protocol != cpu_to_be16(ETH_P_PAE)))

drivers/net/wireless/mediatek/mt76/mt7921/main.c+3−0

@@ -1180,6 +1180,9 @@ static void mt7921_sta_set_decap_offload(struct ieee80211_hw *hw, · 1179 unmodified lines
1180	struct mt792x_sta msta = (struct mt792x_sta )sta->drv_priv;	1180	struct mt792x_sta msta = (struct mt792x_sta )sta->drv_priv;
1181	struct mt792x_dev *dev = mt792x_hw_dev(hw);	1181	struct mt792x_dev *dev = mt792x_hw_dev(hw);
1182		1182
		1183	if (!msta->deflink.wcid.sta)
		1184	return;
		1185
1183	mt792x_mutex_acquire(dev);	1186	mt792x_mutex_acquire(dev);
1184		1187
1185	if (enabled)	1188	if (enabled)

drivers/net/wireless/mediatek/mt76/mt7925/init.c+2−0

@@ -52,6 +52,8 @@ static int mt7925_thermal_init(struct mt792x_phy *phy) · 51 unmodified lines
52		52
53	name = devm_kasprintf(&wiphy->dev, GFP_KERNEL, "mt7925_%s",	53	name = devm_kasprintf(&wiphy->dev, GFP_KERNEL, "mt7925_%s",
54	wiphy_name(wiphy));	54	wiphy_name(wiphy));
		55	if (!name)
		56	return -ENOMEM;
55		57
56	hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev, name, phy,	58	hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev, name, phy,
57	mt7925_hwmon_groups);	59	mt7925_hwmon_groups);

drivers/net/wireless/mediatek/mt76/mt7925/mac.c+3−3

@@ -1040,7 +1040,7 @@ void mt7925_mac_add_txs(struct mt792x_dev dev, void data) · 1039 unmodified lines
1040		1040
1041	rcu_read_lock();	1041	rcu_read_lock();
1042		1042
1043	wcid = rcu_dereference(dev->mt76.wcid[wcidx]);	1043	wcid = mt76_wcid_ptr(dev, wcidx);
1044	if (!wcid)	1044	if (!wcid)
1045	goto out;	1045	goto out;
1046		1046
@@ -1122,7 +1122,7 @@ mt7925_mac_tx_free(struct mt792x_dev dev, void data, int len) · 75 unmodified lines
1122	u16 idx;	1122	u16 idx;
1123		1123
1124	idx = FIELD_GET(MT_TXFREE_INFO_WLAN_ID, info);	1124	idx = FIELD_GET(MT_TXFREE_INFO_WLAN_ID, info);
1125	wcid = rcu_dereference(dev->mt76.wcid[idx]);	1125	wcid = mt76_wcid_ptr(dev, idx);
1126	sta = wcid_to_sta(wcid);	1126	sta = wcid_to_sta(wcid);
1127	if (!sta)	1127	if (!sta)
1128	continue;	1128	continue;
@@ -1445,7 +1445,7 @@ void mt7925_usb_sdio_tx_complete_skb(struct mt76_dev *mdev, · 316 unmodified lines
1445	u16 idx;	1445	u16 idx;
1446		1446
1447	idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);	1447	idx = le32_get_bits(txwi[1], MT_TXD1_WLAN_IDX);
1448	wcid = rcu_dereference(mdev->wcid[idx]);	1448	wcid = __mt76_wcid_ptr(mdev, idx);
1449	sta = wcid_to_sta(wcid);	1449	sta = wcid_to_sta(wcid);
1450		1450
1451	if (sta && likely(e->skb->protocol != cpu_to_be16(ETH_P_PAE)))	1451	if (sta && likely(e->skb->protocol != cpu_to_be16(ETH_P_PAE)))

drivers/net/wireless/mediatek/mt76/mt7925/main.c+7−1

 	mt792x_mutex_acquire(dev);
-	err = mt7925_mcu_sched_scan_req(mphy, vif, req);
+	err = mt7925_mcu_sched_scan_req(mphy, vif, req, ies);
 	if (err < 0)
 		goto out;
 	unsigned long valid = mvif->valid_links;
 	u8 i;
+	if (!msta->vif)
+		return;
 	mt792x_mutex_acquire(dev);
 	valid = ieee80211_vif_is_mld(vif) ? mvif->valid_links : BIT(0);
 		else
 			clear_bit(MT_WCID_FLAG_HDR_TRANS, &mlink->wcid.flags);
+		if (!mlink->wcid.sta)
+			continue;
 		mt7925_mcu_wtbl_update_hdr_trans(dev, vif, sta, i);
 	}

drivers/net/wireless/mediatek/mt76/mt7925/mcu.c+61−18

 			       bool suspend, struct cfg80211_wowlan *wowlan)
 {
 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
+	struct ieee80211_scan_ies ies = {};
 	struct mt76_dev *dev = phy->dev;
 	struct {
 		struct {
 		req.wow_ctrl_tlv.trigger |= (UNI_WOW_DETECT_TYPE_DISCONNECT |
 					     UNI_WOW_DETECT_TYPE_BCN_LOST);
 	if (wowlan->nd_config) {
-		mt7925_mcu_sched_scan_req(phy, vif, wowlan->nd_config);
+		mt7925_mcu_sched_scan_req(phy, vif, wowlan->nd_config, &ies);
 		req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_SCH_SCAN_HIT;
 		mt7925_mcu_sched_scan_enable(phy, vif, suspend);
 	}
 	return err;
 }
+static void
+mt7925_mcu_build_scan_ie_tlv(struct mt76_dev *mdev,
+			     struct sk_buff *skb,
+			     struct ieee80211_scan_ies *scan_ies)
+{
+	u32 max_len = sizeof(struct scan_ie_tlv) + MT76_CONNAC_SCAN_IE_LEN;
+	struct scan_ie_tlv *ie;
+	enum nl80211_band i;
+	struct tlv *tlv;
+	const u8 *ies;
+	u16 ies_len;
+	for (i = 0; i <= NL80211_BAND_6GHZ; i++) {
+		if (i == NL80211_BAND_60GHZ)
+			continue;
+		ies = scan_ies->ies[i];
+		ies_len = scan_ies->len[i];
+		if (!ies || !ies_len)
+			continue;
+		if (ies_len > max_len)
+			return;
+		tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE,
+					      sizeof(*ie) + ies_len);
+		ie = (struct scan_ie_tlv *)tlv;
+		memcpy(ie->ies, ies, ies_len);
+		ie->ies_len = cpu_to_le16(ies_len);
+		switch (i) {
+		case NL80211_BAND_2GHZ:
+			ie->band = 1;
+			break;
+		case NL80211_BAND_6GHZ:
+			ie->band = 3;
+			break;
+		default:
+			ie->band = 2;
+			break;
+		}
+		max_len -= (sizeof(*ie) + ies_len);
+	}
+}
 int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
 		       struct ieee80211_scan_request *scan_req)
 {
 	max_len = sizeof(*hdr) + sizeof(*req) + sizeof(*ssid) +
 		  sizeof(*bssid) * MT7925_RNR_SCAN_MAX_BSSIDS +
-		  sizeof(*chan_info) + sizeof(*misc) + sizeof(*ie);
+		  sizeof(*chan_info) + sizeof(*misc) + sizeof(*ie) +
+		  MT76_CONNAC_SCAN_IE_LEN;
 	skb = mt76_mcu_msg_alloc(mdev, NULL, max_len);
 	if (!skb)
 		if (i > MT7925_RNR_SCAN_MAX_BSSIDS)
 			break;
-		ssid->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
+		ssid->ssids[n_ssids].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
-		memcpy(ssid->ssids[i].ssid, sreq->ssids[i].ssid,
+		memcpy(ssid->ssids[n_ssids].ssid, sreq->ssids[i].ssid,
 		       sreq->ssids[i].ssid_len);
 		n_ssids++;
 	}
 	}
 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
-	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
-	ie = (struct scan_ie_tlv *)tlv;
-	if (sreq->ie_len > 0) {
-		memcpy(ie->ies, sreq->ie, sreq->ie_len);
-		ie->ies_len = cpu_to_le16(sreq->ie_len);
-	}
 	req->scan_func |= SCAN_FUNC_SPLIT_SCAN;
 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_MISC, sizeof(*misc));
 		req->scan_func |= SCAN_FUNC_RANDOM_MAC;
 	}
+	/* Append scan probe IEs as the last tlv */
+	mt7925_mcu_build_scan_ie_tlv(mdev, skb, &scan_req->ies);
 	err = mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
 				    true);
 	if (err < 0)
 int mt7925_mcu_sched_scan_req(struct mt76_phy *phy,
 			      struct ieee80211_vif *vif,
-			      struct cfg80211_sched_scan_request *sreq)
+			      struct cfg80211_sched_scan_request *sreq,
+			      struct ieee80211_scan_ies *ies)
 {
 	struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
 	struct ieee80211_channel **scan_list = sreq->channels;
 	}
 	chan_info->channel_type = sreq->n_channels ? 4 : 0;
-	tlv = mt76_connac_mcu_add_tlv(skb, UNI_SCAN_IE, sizeof(*ie));
+	/* Append scan probe IEs as the last tlv */
-	ie = (struct scan_ie_tlv *)tlv;
+	mt7925_mcu_build_scan_ie_tlv(mdev, skb, ies);
-	if (sreq->ie_len > 0) {
-		memcpy(ie->ies, sreq->ie, sreq->ie_len);
-		ie->ies_len = cpu_to_le16(sreq->ie_len);
-	}
 	return mt76_mcu_skb_send_msg(mdev, skb, MCU_UNI_CMD(SCAN_REQ),
 				     true);

drivers/net/wireless/mediatek/mt76/mt7925/mcu.h+3−2

 	__le16 ies_len;
 	u8 band;
 	u8 pad;
-	u8 ies[MT76_CONNAC_SCAN_IE_LEN];
+	u8 ies[];
 };
 struct scan_misc_tlv {
 			      struct ieee80211_vif *vif);
 int mt7925_mcu_sched_scan_req(struct mt76_phy *phy,
 			      struct ieee80211_vif *vif,
-			      struct cfg80211_sched_scan_request *sreq);
+			      struct cfg80211_sched_scan_request *sreq,
+			      struct ieee80211_scan_ies *ies);
 int mt7925_mcu_sched_scan_enable(struct mt76_phy *phy,
 				 struct ieee80211_vif *vif,
 				 bool enable);

drivers/net/wireless/mediatek/mt76/mt7925/regs.h+1−1

@@ -58,7 +58,7 @@ · 57 unmodified lines
58		58
59	#define MT_INT_TX_DONE_MCU (MT_INT_TX_DONE_MCU_WM \| \	59	#define MT_INT_TX_DONE_MCU (MT_INT_TX_DONE_MCU_WM \| \
60	MT_INT_TX_DONE_FWDL)	60	MT_INT_TX_DONE_FWDL)
61	#define MT_INT_TX_DONE_ALL (MT_INT_TX_DONE_MCU_WM \| \	61	#define MT_INT_TX_DONE_ALL (MT_INT_TX_DONE_MCU \| \
62	MT_INT_TX_DONE_BAND0 \| \	62	MT_INT_TX_DONE_BAND0 \| \
63	GENMASK(18, 4))	63	GENMASK(18, 4))
64		64

drivers/net/wireless/mediatek/mt76/mt792x_core.c+27−5

 	},
 };
-static const struct ieee80211_iface_limit if_limits_chanctx[] = {
+static const struct ieee80211_iface_limit if_limits_chanctx_mcc[] = {
 	{
 		.max = 2,
 		.types = BIT(NL80211_IFTYPE_STATION) |
 	},
 	{
 		.max = 1,
-		.types = BIT(NL80211_IFTYPE_AP) |
+		.types = BIT(NL80211_IFTYPE_P2P_GO)
-			 BIT(NL80211_IFTYPE_P2P_GO)
+	},
+	{
+		.max = 1,
+		.types = BIT(NL80211_IFTYPE_P2P_DEVICE)
+	}
+};
+static const struct ieee80211_iface_limit if_limits_chanctx_scc[] = {
+	{
+		.max = 2,
+		.types = BIT(NL80211_IFTYPE_STATION) |
+			 BIT(NL80211_IFTYPE_P2P_CLIENT)
+	},
+	{
+		.max = 1,
+		.types = BIT(NL80211_IFTYPE_AP)
 	},
 	{
 		.max = 1,
 static const struct ieee80211_iface_combination if_comb_chanctx[] = {
 	{
-		.limits = if_limits_chanctx,
+		.limits = if_limits_chanctx_mcc,
-		.n_limits = ARRAY_SIZE(if_limits_chanctx),
+		.n_limits = ARRAY_SIZE(if_limits_chanctx_mcc),
 		.max_interfaces = 3,
 		.num_different_channels = 2,
 		.beacon_int_infra_match = false,
+	},
+	{
+		.limits = if_limits_chanctx_scc,
+		.n_limits = ARRAY_SIZE(if_limits_chanctx_scc),
+		.max_interfaces = 3,
+		.num_different_channels = 1,
+		.beacon_int_infra_match = false,
 	}
 };

drivers/net/wireless/mediatek/mt76/mt792x_mac.c+1−4

@@ -142,10 +142,7 @@ struct mt76_wcid mt792x_rx_get_wcid(struct mt792x_dev dev, u16 idx, · 141 unmodified lines
142	struct mt792x_sta *sta;	142	struct mt792x_sta *sta;
143	struct mt76_wcid *wcid;	143	struct mt76_wcid *wcid;
144		144
145	if (idx >= ARRAY_SIZE(dev->mt76.wcid))	145	wcid = mt76_wcid_ptr(dev, idx);
146	return NULL;
147
148	wcid = rcu_dereference(dev->mt76.wcid[idx]);
149	if (unicast \|\| !wcid)	146	if (unicast \|\| !wcid)
150	return wcid;	147	return wcid;
151		148

drivers/net/wireless/mediatek/mt76/mt7996/mac.c+10−42

@@ -61,10 +61,7 @@ static struct mt76_wcid mt7996_rx_get_wcid(struct mt7996_dev dev, · 60 unmodified lines
61	struct mt76_wcid *wcid;	61	struct mt76_wcid *wcid;
62	int i;	62	int i;
63		63
64	if (idx >= ARRAY_SIZE(dev->mt76.wcid))	64	wcid = mt76_wcid_ptr(dev, idx);
65	return NULL;
66
67	wcid = rcu_dereference(dev->mt76.wcid[idx]);
68	if (!wcid)	65	if (!wcid)
69	return NULL;	66	return NULL;
70		67
@@ -1249,7 +1246,7 @@ mt7996_mac_tx_free(struct mt7996_dev dev, void data, int len) · 1178 unmodified lines
1249	u16 idx;	1246	u16 idx;
1250		1247
1251	idx = FIELD_GET(MT_TXFREE_INFO_WLAN_ID, info);	1248	idx = FIELD_GET(MT_TXFREE_INFO_WLAN_ID, info);
1252	wcid = rcu_dereference(dev->mt76.wcid[idx]);	1249	wcid = mt76_wcid_ptr(dev, idx);
1253	sta = wcid_to_sta(wcid);	1250	sta = wcid_to_sta(wcid);
1254	if (!sta)	1251	if (!sta)
1255	goto next;	1252	goto next;
@@ -1471,12 +1468,9 @@ static void mt7996_mac_add_txs(struct mt7996_dev dev, void data) · 215 unmodified lines
1471	if (pid < MT_PACKET_ID_NO_SKB)	1468	if (pid < MT_PACKET_ID_NO_SKB)
1472	return;	1469	return;
1473		1470
1474	if (wcidx >= mt7996_wtbl_size(dev))
1475	return;
1476
1477	rcu_read_lock();	1471	rcu_read_lock();
1478		1472
1479	wcid = rcu_dereference(dev->mt76.wcid[wcidx]);	1473	wcid = mt76_wcid_ptr(dev, wcidx);
1480	if (!wcid)	1474	if (!wcid)
1481	goto out;	1475	goto out;
1482		1476
@@ -2353,20 +2347,12 @@ void mt7996_mac_update_stats(struct mt7996_phy *phy) · 870 unmodified lines
2353	void mt7996_mac_sta_rc_work(struct work_struct *work)	2347	void mt7996_mac_sta_rc_work(struct work_struct *work)
2354	{	2348	{
2355	struct mt7996_dev *dev = container_of(work, struct mt7996_dev, rc_work);	2349	struct mt7996_dev *dev = container_of(work, struct mt7996_dev, rc_work);
2356	struct ieee80211_bss_conf *link_conf;
2357	struct ieee80211_link_sta *link_sta;
2358	struct mt7996_sta_link *msta_link;	2350	struct mt7996_sta_link *msta_link;
2359	struct mt7996_vif_link *link;
2360	struct mt76_vif_link *mlink;
2361	struct ieee80211_sta *sta;
2362	struct ieee80211_vif *vif;	2351	struct ieee80211_vif *vif;
2363	struct mt7996_sta *msta;
2364	struct mt7996_vif *mvif;	2352	struct mt7996_vif *mvif;
2365	LIST_HEAD(list);	2353	LIST_HEAD(list);
2366	u32 changed;	2354	u32 changed;
2367	u8 link_id;
2368		2355
2369	rcu_read_lock();
2370	spin_lock_bh(&dev->mt76.sta_poll_lock);	2356	spin_lock_bh(&dev->mt76.sta_poll_lock);
2371	list_splice_init(&dev->sta_rc_list, &list);	2357	list_splice_init(&dev->sta_rc_list, &list);
2372		2358
@@ -2377,46 +2363,28 @@ void mt7996_mac_sta_rc_work(struct work_struct *work) · 4 unmodified lines
2377		2363
2378	changed = msta_link->changed;	2364	changed = msta_link->changed;
2379	msta_link->changed = 0;	2365	msta_link->changed = 0;
2380		2366	mvif = msta_link->sta->vif;
2381	sta = wcid_to_sta(&msta_link->wcid);	2367	vif = container_of((void *)mvif, struct ieee80211_vif,
2382	link_id = msta_link->wcid.link_id;	2368	drv_priv);
2383	msta = msta_link->sta;
2384	mvif = msta->vif;
2385	vif = container_of((void *)mvif, struct ieee80211_vif, drv_priv);
2386
2387	mlink = rcu_dereference(mvif->mt76.link[link_id]);
2388	if (!mlink)
2389	continue;
2390
2391	link_sta = rcu_dereference(sta->link[link_id]);
2392	if (!link_sta)
2393	continue;
2394
2395	link_conf = rcu_dereference(vif->link_conf[link_id]);
2396	if (!link_conf)
2397	continue;
2398		2369
2399	spin_unlock_bh(&dev->mt76.sta_poll_lock);	2370	spin_unlock_bh(&dev->mt76.sta_poll_lock);
2400		2371
2401	link = (struct mt7996_vif_link *)mlink;
2402
2403	if (changed & (IEEE80211_RC_SUPP_RATES_CHANGED \|	2372	if (changed & (IEEE80211_RC_SUPP_RATES_CHANGED \|
2404	IEEE80211_RC_NSS_CHANGED \|	2373	IEEE80211_RC_NSS_CHANGED \|
2405	IEEE80211_RC_BW_CHANGED))	2374	IEEE80211_RC_BW_CHANGED))
2406	mt7996_mcu_add_rate_ctrl(dev, vif, link_conf,	2375	mt7996_mcu_add_rate_ctrl(dev, msta_link->sta, vif,
2407	link_sta, link, msta_link,	2376	msta_link->wcid.link_id,
2408	true);	2377	true);
2409		2378
2410	if (changed & IEEE80211_RC_SMPS_CHANGED)	2379	if (changed & IEEE80211_RC_SMPS_CHANGED)
2411	mt7996_mcu_set_fixed_field(dev, link_sta, link,	2380	mt7996_mcu_set_fixed_field(dev, msta_link->sta, NULL,
2412	msta_link, NULL,	2381	msta_link->wcid.link_id,
2413	RATE_PARAM_MMPS_UPDATE);	2382	RATE_PARAM_MMPS_UPDATE);
2414		2383
2415	spin_lock_bh(&dev->mt76.sta_poll_lock);	2384	spin_lock_bh(&dev->mt76.sta_poll_lock);
2416	}	2385	}
2417		2386
2418	spin_unlock_bh(&dev->mt76.sta_poll_lock);	2387	spin_unlock_bh(&dev->mt76.sta_poll_lock);
2419	rcu_read_unlock();
2420	}	2388	}
2421		2389
2422	void mt7996_mac_work(struct work_struct *work)	2390	void mt7996_mac_work(struct work_struct *work)

drivers/net/wireless/mediatek/mt76/mt7996/main.c+2−3

@@ -1112,9 +1112,8 @@ mt7996_mac_sta_event(struct mt7996_dev dev, struct ieee80211_vif vif, · 1111 unmodified lines
1112	if (err)	1112	if (err)
1113	return err;	1113	return err;
1114		1114
1115	err = mt7996_mcu_add_rate_ctrl(dev, vif, link_conf,	1115	err = mt7996_mcu_add_rate_ctrl(dev, msta_link->sta, vif,
1116	link_sta, link,	1116	link_id, false);
1117	msta_link, false);
1118	if (err)	1117	if (err)
1119	return err;	1118	return err;
1120		1119

drivers/net/wireless/mediatek/mt76/mt7996/mcu.c+141−58

 		switch (le16_to_cpu(res->tag)) {
 		case UNI_ALL_STA_TXRX_RATE:
 			wlan_idx = le16_to_cpu(res->rate[i].wlan_idx);
-			wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
+			wcid = mt76_wcid_ptr(dev, wlan_idx);
 			if (!wcid)
 				break;
 			break;
 		case UNI_ALL_STA_TXRX_ADM_STAT:
 			wlan_idx = le16_to_cpu(res->adm_stat[i].wlan_idx);
-			wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
+			wcid = mt76_wcid_ptr(dev, wlan_idx);
 			if (!wcid)
 				break;
 			break;
 		case UNI_ALL_STA_TXRX_MSDU_COUNT:
 			wlan_idx = le16_to_cpu(res->msdu_cnt[i].wlan_idx);
-			wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
+			wcid = mt76_wcid_ptr(dev, wlan_idx);
 			if (!wcid)
 				break;
 			e = (void *)skb->data;
 			idx = le16_to_cpu(e->wlan_id);
-			if (idx >= ARRAY_SIZE(dev->mt76.wcid))
+			wcid = mt76_wcid_ptr(dev, idx);
-				break;
-			wcid = rcu_dereference(dev->mt76.wcid[idx]);
 			if (!wcid || !wcid->sta)
 				break;
 				     MCU_WM_UNI_CMD(RA), true);
 }
-int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
+int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct mt7996_sta *msta,
-			       struct ieee80211_link_sta *link_sta,
+			       void *data, u8 link_id, u32 field)
-			       struct mt7996_vif_link *link,
-			       struct mt7996_sta_link *msta_link,
-			       void *data, u32 field)
 {
-	struct sta_phy_uni *phy = data;
+	struct mt7996_vif *mvif = msta->vif;
+	struct mt7996_sta_link *msta_link;
 	struct sta_rec_ra_fixed_uni *ra;
+	struct sta_phy_uni *phy = data;
+	struct mt76_vif_link *mlink;
 	struct sk_buff *skb;
+	int err = -ENODEV;
 	struct tlv *tlv;
-	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &link->mt76,
+	rcu_read_lock();
+	mlink = rcu_dereference(mvif->mt76.link[link_id]);
+	if (!mlink)
+		goto error_unlock;
+	msta_link = rcu_dereference(msta->link[link_id]);
+	if (!msta_link)
+		goto error_unlock;
+	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, mlink,
 					      &msta_link->wcid,
 					      MT7996_STA_UPDATE_MAX_SIZE);
-	if (IS_ERR(skb))
+	if (IS_ERR(skb)) {
-		return PTR_ERR(skb);
+		err = PTR_ERR(skb);
+		goto error_unlock;
+	}
 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_RA_UPDATE, sizeof(*ra));
 	ra = (struct sta_rec_ra_fixed_uni *)tlv;
 		if (phy)
 			ra->phy = *phy;
 		break;
-	case RATE_PARAM_MMPS_UPDATE:
+	case RATE_PARAM_MMPS_UPDATE: {
+		struct ieee80211_sta *sta = wcid_to_sta(&msta_link->wcid);
+		struct ieee80211_link_sta *link_sta;
+		link_sta = rcu_dereference(sta->link[link_id]);
+		if (!link_sta) {
+			dev_kfree_skb(skb);
+			goto error_unlock;
+		}
 		ra->mmps_mode = mt7996_mcu_get_mmps_mode(link_sta->smps_mode);
 		break;
+	}
 	default:
 		break;
 	}
 	ra->field = cpu_to_le32(field);
+	rcu_read_unlock();
 	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
 				     MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
+error_unlock:
+	rcu_read_unlock();
+	return err;
 }
 static int
-mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev,
+mt7996_mcu_add_rate_ctrl_fixed(struct mt7996_dev *dev, struct mt7996_sta *msta,
-			       struct ieee80211_link_sta *link_sta,
+			       struct ieee80211_vif *vif, u8 link_id)
-			       struct mt7996_vif_link *link,
-			       struct mt7996_sta_link *msta_link)
 {
-	struct cfg80211_chan_def *chandef = &link->phy->mt76->chandef;
+	struct ieee80211_link_sta *link_sta;
-	struct cfg80211_bitrate_mask *mask = &link->bitrate_mask;
+	struct cfg80211_bitrate_mask mask;
-	enum nl80211_band band = chandef->chan->band;
+	struct mt7996_sta_link *msta_link;
+	struct mt7996_vif_link *link;
 	struct sta_phy_uni phy = {};
-	int ret, nrates = 0;
+	struct ieee80211_sta *sta;
+	int ret, nrates = 0, idx;
+	enum nl80211_band band;
+	bool has_he;
 #define __sta_phy_bitrate_mask_check(_mcs, _gi, _ht, _he)			\
 	do {									\
-		u8 i, gi = mask->control[band]._gi;				\
+		u8 i, gi = mask.control[band]._gi;				\
 		gi = (_he) ? gi : gi == NL80211_TXRATE_FORCE_SGI;		\
 		phy.sgi = gi;							\
-		phy.he_ltf = mask->control[band].he_ltf;			\
+		phy.he_ltf = mask.control[band].he_ltf;				\
-		for (i = 0; i < ARRAY_SIZE(mask->control[band]._mcs); i++) {	\
+		for (i = 0; i < ARRAY_SIZE(mask.control[band]._mcs); i++) {	\
-			if (!mask->control[band]._mcs[i])			\
+			if (!mask.control[band]._mcs[i])			\
 				continue;					\
-			nrates += hweight16(mask->control[band]._mcs[i]);	\
+			nrates += hweight16(mask.control[band]._mcs[i]);	\
-			phy.mcs = ffs(mask->control[band]._mcs[i]) - 1;		\
+			phy.mcs = ffs(mask.control[band]._mcs[i]) - 1;		\
 			if (_ht)						\
 				phy.mcs += 8 * i;				\
 		}								\
 	} while (0)
-	if (link_sta->he_cap.has_he) {
+	rcu_read_lock();
+	link = mt7996_vif_link(dev, vif, link_id);
+	if (!link)
+		goto error_unlock;
+	msta_link = rcu_dereference(msta->link[link_id]);
+	if (!msta_link)
+		goto error_unlock;
+	sta = wcid_to_sta(&msta_link->wcid);
+	link_sta = rcu_dereference(sta->link[link_id]);
+	if (!link_sta)
+		goto error_unlock;
+	band = link->phy->mt76->chandef.chan->band;
+	has_he = link_sta->he_cap.has_he;
+	mask = link->bitrate_mask;
+	idx = msta_link->wcid.idx;
+	if (has_he) {
 		__sta_phy_bitrate_mask_check(he_mcs, he_gi, 0, 1);
 	} else if (link_sta->vht_cap.vht_supported) {
 		__sta_phy_bitrate_mask_check(vht_mcs, gi, 0, 0);
 	} else if (link_sta->ht_cap.ht_supported) {
 		__sta_phy_bitrate_mask_check(ht_mcs, gi, 1, 0);
 	} else {
-		nrates = hweight32(mask->control[band].legacy);
+		nrates = hweight32(mask.control[band].legacy);
-		phy.mcs = ffs(mask->control[band].legacy) - 1;
+		phy.mcs = ffs(mask.control[band].legacy) - 1;
 	}
+	rcu_read_unlock();
 #undef __sta_phy_bitrate_mask_check
 	/* fall back to auto rate control */
-	if (mask->control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
+	if (mask.control[band].gi == NL80211_TXRATE_DEFAULT_GI &&
-	    mask->control[band].he_gi == GENMASK(7, 0) &&
+	    mask.control[band].he_gi == GENMASK(7, 0) &&
-	    mask->control[band].he_ltf == GENMASK(7, 0) &&
+	    mask.control[band].he_ltf == GENMASK(7, 0) &&
 	    nrates != 1)
 		return 0;
 	/* fixed single rate */
 	if (nrates == 1) {
-		ret = mt7996_mcu_set_fixed_field(dev, link_sta, link,
+		ret = mt7996_mcu_set_fixed_field(dev, msta, &phy, link_id,
-						 msta_link, &phy,
 						 RATE_PARAM_FIXED_MCS);
 		if (ret)
 			return ret;
 	}
 	/* fixed GI */
-	if (mask->control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
+	if (mask.control[band].gi != NL80211_TXRATE_DEFAULT_GI ||
-	    mask->control[band].he_gi != GENMASK(7, 0)) {
+	    mask.control[band].he_gi != GENMASK(7, 0)) {
 		u32 addr;
 		/* firmware updates only TXCMD but doesn't take WTBL into
 		 * account, so driver should update here to reflect the
 		 * actual txrate hardware sends out.
 		 */
-		addr = mt7996_mac_wtbl_lmac_addr(dev, msta_link->wcid.idx, 7);
+		addr = mt7996_mac_wtbl_lmac_addr(dev, idx, 7);
-		if (link_sta->he_cap.has_he)
+		if (has_he)
 			mt76_rmw_field(dev, addr, GENMASK(31, 24), phy.sgi);
 		else
 			mt76_rmw_field(dev, addr, GENMASK(15, 12), phy.sgi);
-		ret = mt7996_mcu_set_fixed_field(dev, link_sta, link,
+		ret = mt7996_mcu_set_fixed_field(dev, msta, &phy, link_id,
-						 msta_link, &phy,
 						 RATE_PARAM_FIXED_GI);
 		if (ret)
 			return ret;
 	}
 	/* fixed HE_LTF */
-	if (mask->control[band].he_ltf != GENMASK(7, 0)) {
+	if (mask.control[band].he_ltf != GENMASK(7, 0)) {
-		ret = mt7996_mcu_set_fixed_field(dev, link_sta, link,
+		ret = mt7996_mcu_set_fixed_field(dev, msta, &phy, link_id,
-						 msta_link, &phy,
 						 RATE_PARAM_FIXED_HE_LTF);
 		if (ret)
 			return ret;
 	}
 	return 0;
+error_unlock:
+	rcu_read_unlock();
+	return -ENODEV;
 }
 static void
 	memset(ra->rx_rcpi, INIT_RCPI, sizeof(ra->rx_rcpi));
 }
-int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct mt7996_sta *msta,
-			     struct ieee80211_vif *vif,
+			     struct ieee80211_vif *vif, u8 link_id,
-			     struct ieee80211_bss_conf *link_conf,
+			     bool changed)
-			     struct ieee80211_link_sta *link_sta,
-			     struct mt7996_vif_link *link,
-			     struct mt7996_sta_link *msta_link, bool changed)
 {
+	struct ieee80211_bss_conf *link_conf;
+	struct ieee80211_link_sta *link_sta;
+	struct mt7996_sta_link *msta_link;
+	struct mt7996_vif_link *link;
+	struct ieee80211_sta *sta;
 	struct sk_buff *skb;
-	int ret;
+	int ret = -ENODEV;
+	rcu_read_lock();
+	link = mt7996_vif_link(dev, vif, link_id);
+	if (!link)
+		goto error_unlock;
+	msta_link = rcu_dereference(msta->link[link_id]);
+	if (!msta_link)
+		goto error_unlock;
+	sta = wcid_to_sta(&msta_link->wcid);
+	link_sta = rcu_dereference(sta->link[link_id]);
+	if (!link_sta)
+		goto error_unlock;
+	link_conf = rcu_dereference(vif->link_conf[link_id]);
+	if (!link_conf)
+		goto error_unlock;
 	skb = __mt76_connac_mcu_alloc_sta_req(&dev->mt76, &link->mt76,
 					      &msta_link->wcid,
 					      MT7996_STA_UPDATE_MAX_SIZE);
-	if (IS_ERR(skb))
+	if (IS_ERR(skb)) {
-		return PTR_ERR(skb);
+		ret = PTR_ERR(skb);
+		goto error_unlock;
+	}
 	/* firmware rc algorithm refers to sta_rec_he for HE control.
 	 * once dev->rc_work changes the settings driver should also
 	 */
 	mt7996_mcu_sta_rate_ctrl_tlv(skb, dev, vif, link_conf, link_sta, link);
+	rcu_read_unlock();
 	ret = mt76_mcu_skb_send_msg(&dev->mt76, skb,
 				    MCU_WMWA_UNI_CMD(STA_REC_UPDATE), true);
 	if (ret)
 		return ret;
-	return mt7996_mcu_add_rate_ctrl_fixed(dev, link_sta, link, msta_link);
+	return mt7996_mcu_add_rate_ctrl_fixed(dev, msta, vif, link_id);
+error_unlock:
+	rcu_read_unlock();
+	return ret;
 }
 static int

drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h+5−11

 int mt7996_mcu_add_obss_spr(struct mt7996_phy *phy,
 			    struct mt7996_vif_link *link,
 			    struct ieee80211_he_obss_pd *he_obss_pd);
-int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev,
+int mt7996_mcu_add_rate_ctrl(struct mt7996_dev *dev, struct mt7996_sta *msta,
-			     struct ieee80211_vif *vif,
+			     struct ieee80211_vif *vif, u8 link_id,
-			     struct ieee80211_bss_conf *link_conf,
+			     bool changed);
-			     struct ieee80211_link_sta *link_sta,
-			     struct mt7996_vif_link *link,
-			     struct mt7996_sta_link *msta_link, bool changed);
 int mt7996_set_channel(struct mt76_phy *mphy);
 int mt7996_mcu_set_chan_info(struct mt7996_phy *phy, u16 tag);
 int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif,
 		      struct ieee80211_bss_conf *link_conf);
 int mt7996_mcu_set_fixed_rate_ctrl(struct mt7996_dev *dev,
 				   void *data, u16 version);
-int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev,
+int mt7996_mcu_set_fixed_field(struct mt7996_dev *dev, struct mt7996_sta *msta,
-			       struct ieee80211_link_sta *link_sta,
+			       void *data, u8 link_id, u32 field);
-			       struct mt7996_vif_link *link,
-			       struct mt7996_sta_link *msta_link,
-			       void *data, u32 field);
 int mt7996_mcu_set_eeprom(struct mt7996_dev *dev);
 int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset, u8 *buf, u32 buf_len);
 int mt7996_mcu_get_eeprom_free_block(struct mt7996_dev *dev, u8 *block_num);

drivers/net/wireless/mediatek/mt76/tx.c+5−6

 		struct mt76_tx_cb *cb = mt76_tx_skb_cb(skb);
 		struct mt76_wcid *wcid;
-		wcid = rcu_dereference(dev->wcid[cb->wcid]);
+		wcid = __mt76_wcid_ptr(dev, cb->wcid);
 		if (wcid) {
 			status.sta = wcid_to_sta(wcid);
 			if (status.sta && (wcid->rate.flags || wcid->rate.legacy)) {
 	rcu_read_lock();
-	if (wcid_idx < ARRAY_SIZE(dev->wcid))
+	wcid = __mt76_wcid_ptr(dev, wcid_idx);
-		wcid = rcu_dereference(dev->wcid[wcid_idx]);
 	mt76_tx_check_non_aql(dev, wcid, skb);
 #ifdef CONFIG_NL80211_TESTMODE
 			break;
 		mtxq = (struct mt76_txq *)txq->drv_priv;
-		wcid = rcu_dereference(dev->wcid[mtxq->wcid]);
+		wcid = __mt76_wcid_ptr(dev, mtxq->wcid);
 		if (!wcid || test_bit(MT_WCID_FLAG_PS, &wcid->flags))
 			continue;
 		if ((dev->drv->drv_flags & MT_DRV_HW_MGMT_TXQ) &&
 		    !(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
 		    !ieee80211_is_data(hdr->frame_control) &&
-		    !ieee80211_is_bufferable_mmpdu(skb))
+		    (!ieee80211_is_bufferable_mmpdu(skb) ||
+		     ieee80211_is_deauth(hdr->frame_control)))
 			qid = MT_TXQ_PSD;
 		q = phy->q_tx[qid];

drivers/net/wireless/mediatek/mt76/util.c+1−1

@@ -83,7 +83,7 @@ int mt76_get_min_avg_rssi(struct mt76_dev *dev, u8 phy_idx) · 82 unmodified lines
83	if (!(mask & 1))	83	if (!(mask & 1))
84	continue;	84	continue;
85		85
86	wcid = rcu_dereference(dev->wcid[j]);	86	wcid = __mt76_wcid_ptr(dev, j);
87	if (!wcid \|\| wcid->phy_idx != phy_idx)	87	if (!wcid \|\| wcid->phy_idx != phy_idx)
88	continue;	88	continue;
89		89

drivers/net/wireless/ralink/rt2x00/rt2x00soc.c+1−3

 }
 EXPORT_SYMBOL_GPL(rt2x00soc_probe);
-int rt2x00soc_remove(struct platform_device *pdev)
+void rt2x00soc_remove(struct platform_device *pdev)
 {
 	struct ieee80211_hw *hw = platform_get_drvdata(pdev);
 	struct rt2x00_dev *rt2x00dev = hw->priv;
 	rt2x00lib_remove_dev(rt2x00dev);
 	rt2x00soc_free_reg(rt2x00dev);
 	ieee80211_free_hw(hw);
-	return 0;
 }
 EXPORT_SYMBOL_GPL(rt2x00soc_remove);

drivers/net/wireless/ralink/rt2x00/rt2x00soc.h+1−1

@@ -17,7 +17,7 @@ · 16 unmodified lines
17	* SoC driver handlers.	17	* SoC driver handlers.
18	*/	18	*/
19	int rt2x00soc_probe(struct platform_device pdev, const struct rt2x00_ops ops);	19	int rt2x00soc_probe(struct platform_device pdev, const struct rt2x00_ops ops);
20	int rt2x00soc_remove(struct platform_device *pdev);	20	void rt2x00soc_remove(struct platform_device *pdev);
21	#ifdef CONFIG_PM	21	#ifdef CONFIG_PM
22	int rt2x00soc_suspend(struct platform_device *pdev, pm_message_t state);	22	int rt2x00soc_suspend(struct platform_device *pdev, pm_message_t state);
23	int rt2x00soc_resume(struct platform_device *pdev);	23	int rt2x00soc_resume(struct platform_device *pdev);

drivers/net/wireless/zydas/zd1211rw/zd_mac.c+5−1

 		skb_queue_tail(q, skb);
 		while (skb_queue_len(q) > ZD_MAC_MAX_ACK_WAITERS) {
-			zd_mac_tx_status(hw, skb_dequeue(q),
+			skb = skb_dequeue(q);
+			if (!skb)
+				break;
+			zd_mac_tx_status(hw, skb,
 					 mac->ack_pending ? mac->ack_signal : 0,
 					 NULL);
 			mac->ack_pending = 0;

drivers/pci/controller/pci-host-common.c+2−2

 	of_pci_check_probe_only();
+	platform_set_drvdata(pdev, bridge);
 	/* Parse and map our Configuration Space windows */
 	cfg = gen_pci_init(dev, bridge, ops);
 	if (IS_ERR(cfg))
 		return PTR_ERR(cfg);
-	platform_set_drvdata(pdev, bridge);
 	bridge->sysdata = cfg;
 	bridge->ops = (struct pci_ops *)&ops->pci_ops;
 	bridge->enable_device = ops->enable_device;

drivers/pci/controller/pcie-apple.c+49−4

 	const struct hw_info	*hw;
 	unsigned long		*bitmap;
 	struct list_head	ports;
+	struct list_head	entry;
 	struct completion	event;
 	struct irq_fwspec	fwspec;
 	u32			nvecs;
 	int			idx;
 };
+static LIST_HEAD(pcie_list);
+static DEFINE_MUTEX(pcie_list_lock);
 static void rmw_set(u32 set, void __iomem *addr)
 {
 	writel_relaxed(readl_relaxed(addr) | set, addr);
 	return 0;
 }
+static void apple_pcie_register(struct apple_pcie *pcie)
+{
+	guard(mutex)(&pcie_list_lock);
+	list_add_tail(&pcie->entry, &pcie_list);
+}
+static void apple_pcie_unregister(struct apple_pcie *pcie)
+{
+	guard(mutex)(&pcie_list_lock);
+	list_del(&pcie->entry);
+}
+static struct apple_pcie *apple_pcie_lookup(struct device *dev)
+{
+	struct apple_pcie *pcie;
+	guard(mutex)(&pcie_list_lock);
+	list_for_each_entry(pcie, &pcie_list, entry) {
+		if (pcie->dev == dev)
+			return pcie;
+	}
+	return NULL;
+}
 static struct apple_pcie_port *apple_pcie_get_port(struct pci_dev *pdev)
 {
 	struct pci_config_window *cfg = pdev->sysdata;
-	struct apple_pcie *pcie = cfg->priv;
+	struct apple_pcie *pcie;
 	struct pci_dev *port_pdev;
 	struct apple_pcie_port *port;
+	pcie = apple_pcie_lookup(cfg->parent);
+	if (WARN_ON(!pcie))
+		return NULL;
 	/* Find the root port this device is on */
 	port_pdev = pcie_find_root_port(pdev);
 static int apple_pcie_init(struct pci_config_window *cfg)
 {
-	struct apple_pcie *pcie = cfg->priv;
 	struct device *dev = cfg->parent;
+	struct apple_pcie *pcie;
 	int ret;
+	pcie = apple_pcie_lookup(dev);
+	if (WARN_ON(!pcie))
+		return -ENOENT;
 	for_each_available_child_of_node_scoped(dev->of_node, of_port) {
 		ret = apple_pcie_setup_port(pcie, of_port);
 		if (ret) {
 	mutex_init(&pcie->lock);
 	INIT_LIST_HEAD(&pcie->ports);
-	dev_set_drvdata(dev, pcie);
 	ret = apple_msi_init(pcie);
 	if (ret)
 		return ret;
-	return pci_host_common_init(pdev, &apple_pcie_cfg_ecam_ops);
+	apple_pcie_register(pcie);
+	ret = pci_host_common_init(pdev, &apple_pcie_cfg_ecam_ops);
+	if (ret)
+		apple_pcie_unregister(pcie);
+	return ret;
 }
 static const struct of_device_id apple_pcie_of_match[] = {

drivers/pci/ecam.c+0−2

@@ -84,8 +84,6 @@ struct pci_config_window pci_ecam_create(struct device dev, · 83 unmodified lines
84	goto err_exit_iomap;	84	goto err_exit_iomap;
85	}	85	}
86		86
87	cfg->priv = dev_get_drvdata(dev);
88
89	if (ops->init) {	87	if (ops->init) {
90	err = ops->init(cfg);	88	err = ops->init(cfg);
91	if (err)	89	if (err)

drivers/pci/msi/msi.c+3−1

 	if (!pdev->msix_enabled)
 		return -ENXIO;
-	guard(msi_descs_lock)(&pdev->dev);
 	virq = msi_get_virq(&pdev->dev, index);
 	if (!virq)
 		return -ENXIO;
+	guard(msi_descs_lock)(&pdev->dev);
 	/*
 	 * This is a horrible hack, but short of implementing a PCI
 	 * specific interrupt chip callback and a huge pile of

drivers/pinctrl/nuvoton/pinctrl-ma35.c+8−2

 	u32 idx = 0;
 	int ret;
-	for_each_gpiochip_node(dev, child) {
+	device_for_each_child_node(dev, child) {
+		if (fwnode_property_present(child, "gpio-controller"))
+			continue;
 		npctl->nfunctions++;
 		npctl->ngroups += of_get_child_count(to_of_node(child));
 	}
 	if (!npctl->groups)
 		return -ENOMEM;
-	for_each_gpiochip_node(dev, child) {
+	device_for_each_child_node(dev, child) {
+		if (fwnode_property_present(child, "gpio-controller"))
+			continue;
 		ret = ma35_pinctrl_parse_functions(child, npctl, idx++);
 		if (ret) {
 			fwnode_handle_put(child);

drivers/pinctrl/pinctrl-amd.c+11−0

@@ -979,6 +979,17 @@ static int amd_gpio_suspend_hibernate_common(struct device *dev, bool is_suspend · 978 unmodified lines
979	pin, is_suspend ? "suspend" : "hibernate");	979	pin, is_suspend ? "suspend" : "hibernate");
980	}	980	}
981		981
		982	/*
		983	* debounce enabled over suspend has shown issues with a GPIO
		984	* being unable to wake the system, as we're only interested in
		985	* the actual wakeup event, clear it.
		986	*/
		987	if (gpio_dev->saved_regs[i] & (DB_CNTRl_MASK << DB_CNTRL_OFF)) {
		988	amd_gpio_set_debounce(gpio_dev, pin, 0);
		989	pm_pr_dbg("Clearing debounce for GPIO #%d during %s.\n",
		990	pin, is_suspend ? "suspend" : "hibernate");
		991	}
		992
982	raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);	993	raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
983	}	994	}
984		995

drivers/pinctrl/pinctrl-aw9523.c+1−1

@@ -784,7 +784,7 @@ static int aw9523_init_gpiochip(struct aw9523 *awi, unsigned int npins) · 783 unmodified lines
784	gc->set_config = gpiochip_generic_config;	784	gc->set_config = gpiochip_generic_config;
785	gc->parent = dev;	785	gc->parent = dev;
786	gc->owner = THIS_MODULE;	786	gc->owner = THIS_MODULE;
787	gc->can_sleep = false;	787	gc->can_sleep = true;
788		788
789	return 0;	789	return 0;
790	}	790	}

drivers/pinctrl/qcom/pinctrl-msm.c+20−0

@@ -1038,6 +1038,25 @@ static bool msm_gpio_needs_dual_edge_parent_workaround(struct irq_data *d, · 1037 unmodified lines
1038	test_bit(d->hwirq, pctrl->skip_wake_irqs);	1038	test_bit(d->hwirq, pctrl->skip_wake_irqs);
1039	}	1039	}
1040		1040
		1041	static void msm_gpio_irq_init_valid_mask(struct gpio_chip *gc,
		1042	unsigned long *valid_mask,
		1043	unsigned int ngpios)
		1044	{
		1045	struct msm_pinctrl *pctrl = gpiochip_get_data(gc);
		1046	const struct msm_pingroup *g;
		1047	int i;
		1048
		1049	bitmap_fill(valid_mask, ngpios);
		1050
		1051	for (i = 0; i < ngpios; i++) {
		1052	g = &pctrl->soc->groups[i];
		1053
		1054	if (g->intr_detection_width != 1 &&
		1055	g->intr_detection_width != 2)
		1056	clear_bit(i, valid_mask);
		1057	}
		1058	}
		1059
1041	static int msm_gpio_irq_set_type(struct irq_data *d, unsigned int type)	1060	static int msm_gpio_irq_set_type(struct irq_data *d, unsigned int type)
1042	{	1061	{
1043	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);	1062	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
@@ -1441,6 +1460,7 @@ static int msm_gpio_init(struct msm_pinctrl *pctrl) · 397 unmodified lines
1441	girq->default_type = IRQ_TYPE_NONE;	1460	girq->default_type = IRQ_TYPE_NONE;
1442	girq->handler = handle_bad_irq;	1461	girq->handler = handle_bad_irq;
1443	girq->parents[0] = pctrl->irq;	1462	girq->parents[0] = pctrl->irq;
		1463	girq->init_valid_mask = msm_gpio_irq_init_valid_mask;
1444		1464
1445	ret = devm_gpiochip_add_data(pctrl->dev, &pctrl->chip, pctrl);	1465	ret = devm_gpiochip_add_data(pctrl->dev, &pctrl->chip, pctrl);
1446	if (ret) {	1466	if (ret) {

drivers/pwm/core.c+1−1

@@ -596,7 +596,7 @@ static bool pwm_state_valid(const struct pwm_state *state) · 595 unmodified lines
596	* and supposed to be ignored. So also ignore any strange values and	596	* and supposed to be ignored. So also ignore any strange values and
597	* consider the state ok.	597	* consider the state ok.
598	*/	598	*/
599	if (state->enabled)	599	if (!state->enabled)
600	return true;	600	return true;
601		601
602	if (!state->period)	602	if (!state->period)

drivers/pwm/pwm-mediatek.c+8−5

 		return ret;
 	clk_rate = clk_get_rate(pc->clk_pwms[pwm->hwpwm]);
-	if (!clk_rate)
+	if (!clk_rate) {
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out;
+	}
 	/* Make sure we use the bus clock and not the 26MHz clock */
 	if (pc->soc->has_ck_26m_sel)
 	}
 	if (clkdiv > PWM_CLK_DIV_MAX) {
-		pwm_mediatek_clk_disable(chip, pwm);
 		dev_err(pwmchip_parent(chip), "period of %d ns not supported\n", period_ns);
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out;
 	}
 	if (pc->soc->pwm45_fixup && pwm->hwpwm > 2) {
 	pwm_mediatek_writel(pc, pwm->hwpwm, reg_width, cnt_period);
 	pwm_mediatek_writel(pc, pwm->hwpwm, reg_thres, cnt_duty);
+out:
 	pwm_mediatek_clk_disable(chip, pwm);
-	return 0;
+	return ret;
 }
 static int pwm_mediatek_enable(struct pwm_chip *chip, struct pwm_device *pwm)

fs/bcachefs/btree_cache.c+13−13

 	six_unlock_intent(&b->c.lock);
 }
-static void __btree_node_data_free(struct btree_cache *bc, struct btree *b)
+void __btree_node_data_free(struct btree *b)
 {
 	BUG_ON(!list_empty(&b->list));
 	BUG_ON(btree_node_hashed(b));
 	munmap(b->aux_data, btree_aux_data_bytes(b));
 #endif
 	b->aux_data = NULL;
-	btree_node_to_freedlist(bc, b);
 }
 static void btree_node_data_free(struct btree_cache *bc, struct btree *b)
 {
 	BUG_ON(list_empty(&b->list));
 	list_del_init(&b->list);
+	__btree_node_data_free(b);
 	--bc->nr_freeable;
-	__btree_node_data_free(bc, b);
+	btree_node_to_freedlist(bc, b);
 }
 static int bch2_btree_cache_cmp_fn(struct rhashtable_compare_arg *arg,
 struct btree *__bch2_btree_node_mem_alloc(struct bch_fs *c)
 {
-	struct btree_cache *bc = &c->btree_cache;
+	struct btree *b = __btree_node_mem_alloc(c, GFP_KERNEL);
-	struct btree *b;
-	b = __btree_node_mem_alloc(c, GFP_KERNEL);
 	if (!b)
 		return NULL;
 	}
 	bch2_btree_lock_init(&b->c, 0, GFP_KERNEL);
-	__bch2_btree_node_to_freelist(bc, b);
 	return b;
 }
 			--touched;;
 		} else if (!btree_node_reclaim(c, b)) {
 			__bch2_btree_node_hash_remove(bc, b);
-			__btree_node_data_free(bc, b);
+			__btree_node_data_free(b);
+			btree_node_to_freedlist(bc, b);
 			freed++;
 			bc->nr_freed++;
 	bch2_recalc_btree_reserve(c);
-	for (i = 0; i < bc->nr_reserve; i++)
+	for (i = 0; i < bc->nr_reserve; i++) {
-		if (!__bch2_btree_node_mem_alloc(c))
+		struct btree *b = __bch2_btree_node_mem_alloc(c);
+		if (!b)
 			goto err;
+		__bch2_btree_node_to_freelist(bc, b);
+	}
 	list_splice_init(&bc->live[0].list, &bc->freeable);

fs/bcachefs/btree_cache.h+1−0

@@ -30,6 +30,7 @@ void bch2_btree_node_update_key_early(struct btree_trans *, enum btree_id, unsig · 29 unmodified lines
30	void bch2_btree_cache_cannibalize_unlock(struct btree_trans *);	30	void bch2_btree_cache_cannibalize_unlock(struct btree_trans *);
31	int bch2_btree_cache_cannibalize_lock(struct btree_trans , struct closure );	31	int bch2_btree_cache_cannibalize_lock(struct btree_trans , struct closure );
32		32
		33	void __btree_node_data_free(struct btree *);
33	struct btree __bch2_btree_node_mem_alloc(struct bch_fs );	34	struct btree __bch2_btree_node_mem_alloc(struct bch_fs );
34	struct btree bch2_btree_node_mem_alloc(struct btree_trans , bool);	35	struct btree bch2_btree_node_mem_alloc(struct btree_trans , bool);
35		36

fs/bcachefs/btree_io.c+3−5

 		bch2_mark_btree_validate_failure(failed, ca->dev_idx);
 		struct extent_ptr_decoded pick;
-		have_retry = !bch2_bkey_pick_read_device(c,
+		have_retry = bch2_bkey_pick_read_device(c,
 					bkey_i_to_s_c(&b->key),
-					failed, &pick, -1);
+					failed, &pick, -1) == 1;
 	}
 	if (!have_retry && ret == -BCH_ERR_btree_node_read_err_want_retry)
 			goto out;
 		case -BCH_ERR_btree_node_read_err_bad_node:
 			prt_str(&out, ", ");
-			ret = __bch2_topology_error(c, &out);
 			break;
 		}
 		goto out;
 	case -BCH_ERR_btree_node_read_err_bad_node:
 		prt_str(&out, ", ");
-		ret = __bch2_topology_error(c, &out);
 		break;
 	}
 print:
 		ret = bch2_bkey_pick_read_device(c,
 					bkey_i_to_s_c(&b->key),
 					&failed, &rb->pick, -1);
-		if (ret) {
+		if (ret <= 0) {
 			set_btree_node_read_error(b);
 			break;
 		}

fs/bcachefs/btree_node_scan.c+41−43

 	}
 }
-static bool found_btree_node_is_readable(struct btree_trans *trans,
-					 struct found_btree_node *f)
-{
-	struct { __BKEY_PADDED(k, BKEY_BTREE_PTR_VAL_U64s_MAX); } tmp;
-	found_btree_node_to_key(&tmp.k, f);
-	struct btree *b = bch2_btree_node_get_noiter(trans, &tmp.k, f->btree_id, f->level, false);
-	bool ret = !IS_ERR_OR_NULL(b);
-	if (!ret)
-		return ret;
-	f->sectors_written = b->written;
-	f->journal_seq = le64_to_cpu(b->data->keys.journal_seq);
-	struct bkey_s_c k;
-	struct bkey unpacked;
-	struct btree_node_iter iter;
-	for_each_btree_node_key_unpack(b, k, &iter, &unpacked)
-		f->journal_seq = max(f->journal_seq, bkey_journal_seq(k));
-	six_unlock_read(&b->c.lock);
-	/*
-	 * We might update this node's range; if that happens, we need the node
-	 * to be re-read so the read path can trim keys that are no longer in
-	 * this node
-	 */
-	if (b != btree_node_root(trans->c, b))
-		bch2_btree_node_evict(trans, &tmp.k);
-	return ret;
-}
 static int found_btree_node_cmp_cookie(const void *_l, const void *_r)
 {
 	const struct found_btree_node *l = _l;
 };
 static void try_read_btree_node(struct find_btree_nodes *f, struct bch_dev *ca,
-				struct bio *bio, struct btree_node *bn, u64 offset)
+				struct btree *b, struct bio *bio, u64 offset)
 {
 	struct bch_fs *c = container_of(f, struct bch_fs, found_btree_nodes);
+	struct btree_node *bn = b->data;
 	bio_reset(bio, ca->disk_sb.bdev, REQ_OP_READ);
 	bio->bi_iter.bi_sector	= offset;
-	bch2_bio_map(bio, bn, PAGE_SIZE);
+	bch2_bio_map(bio, b->data, c->opts.block_size);
 	u64 submit_time = local_clock();
 	submit_bio_wait(bio);
 	bch2_account_io_completion(ca, BCH_MEMBER_ERROR_read, submit_time, !bio->bi_status);
 	if (bio->bi_status) {
 	if (BTREE_NODE_ID(bn) >= BTREE_ID_NR_MAX)
 		return;
+	bio_reset(bio, ca->disk_sb.bdev, REQ_OP_READ);
+	bio->bi_iter.bi_sector	= offset;
+	bch2_bio_map(bio, b->data, c->opts.btree_node_size);
+	submit_time = local_clock();
+	submit_bio_wait(bio);
+	bch2_account_io_completion(ca, BCH_MEMBER_ERROR_read, submit_time, !bio->bi_status);
 	rcu_read_lock();
 	struct found_btree_node n = {
 		.btree_id	= BTREE_NODE_ID(bn),
 	};
 	rcu_read_unlock();
-	if (bch2_trans_run(c, found_btree_node_is_readable(trans, &n))) {
+	found_btree_node_to_key(&b->key, &n);
+	CLASS(printbuf, buf)();
+	if (!bch2_btree_node_read_done(c, ca, b, NULL, &buf)) {
+		/* read_done will swap out b->data for another buffer */
+		bn = b->data;
+		/*
+		 * Grab journal_seq here because we want the max journal_seq of
+		 * any bset; read_done sorts down to a single set and picks the
+		 * max journal_seq
+		 */
+		n.journal_seq		= le64_to_cpu(bn->keys.journal_seq),
+		n.sectors_written	= b->written;
 		mutex_lock(&f->lock);
 		if (BSET_BIG_ENDIAN(&bn->keys) != CPU_BIG_ENDIAN) {
 			bch_err(c, "try_read_btree_node() can't handle endian conversion");
 	struct find_btree_nodes_worker *w = p;
 	struct bch_fs *c = container_of(w->f, struct bch_fs, found_btree_nodes);
 	struct bch_dev *ca = w->ca;
-	void *buf = (void *) __get_free_page(GFP_KERNEL);
-	struct bio *bio = bio_alloc(NULL, 1, 0, GFP_KERNEL);
 	unsigned long last_print = jiffies;
+	struct btree *b = NULL;
+	struct bio *bio = NULL;
+	b = __bch2_btree_node_mem_alloc(c);
+	if (!b) {
+		bch_err(c, "read_btree_nodes_worker: error allocating buf");
+		w->f->ret = -ENOMEM;
+		goto err;
+	}
-	if (!buf || !bio) {
+	bio = bio_alloc(NULL, buf_pages(b->data, c->opts.btree_node_size), 0, GFP_KERNEL);
-		bch_err(c, "read_btree_nodes_worker: error allocating bio/buf");
+	if (!bio) {
+		bch_err(c, "read_btree_nodes_worker: error allocating bio");
 		w->f->ret = -ENOMEM;
 		goto err;
 	}
 			    !bch2_dev_btree_bitmap_marked_sectors(ca, sector, btree_sectors(c)))
 				continue;
-			try_read_btree_node(w->f, ca, bio, buf, sector);
+			try_read_btree_node(w->f, ca, b, bio, sector);
 		}
 err:
+	if (b)
+		__btree_node_data_free(b);
+	kfree(b);
 	bio_put(bio);
-	free_page((unsigned long) buf);
 	enumerated_ref_put(&ca->io_ref[READ], BCH_DEV_READ_REF_btree_node_scan);
 	closure_put(w->cl);
 	kfree(w);

fs/bcachefs/debug.c+9−2

 		c->verify_data = __bch2_btree_node_mem_alloc(c);
 		if (!c->verify_data)
 			goto out;
-		list_del_init(&c->verify_data->list);
 	}
 	BUG_ON(b->nsets != 1);
 	i->ubuf = buf;
 	i->size	= size;
 	i->ret	= 0;
+	int srcu_idx = srcu_read_lock(&c->btree_trans_barrier);
 restart:
 	seqmutex_lock(&c->btree_trans_lock);
 	list_sort(&c->btree_trans_list, list_ptr_order_cmp);
 		if (!closure_get_not_zero(&trans->ref))
 			continue;
+		if (!trans->srcu_held) {
+			closure_put(&trans->ref);
+			continue;
+		}
 		u32 seq = seqmutex_unlock(&c->btree_trans_lock);
 		bch2_btree_trans_to_text(&i->buf, trans);
 	}
 	seqmutex_unlock(&c->btree_trans_lock);
 unlocked:
+	srcu_read_unlock(&c->btree_trans_barrier, srcu_idx);
 	if (i->buf.allocation_failure)
 		ret = -ENOMEM;

fs/bcachefs/errcode.h+0−1

@@ -282,7 +282,6 @@ · 281 unmodified lines
282	x(EIO, sb_not_downgraded) \	282	x(EIO, sb_not_downgraded) \
283	x(EIO, btree_node_write_all_failed) \	283	x(EIO, btree_node_write_all_failed) \
284	x(EIO, btree_node_read_error) \	284	x(EIO, btree_node_read_error) \
285	x(EIO, btree_node_read_validate_error) \
286	x(EIO, btree_need_topology_repair) \	285	x(EIO, btree_need_topology_repair) \
287	x(EIO, bucket_ref_update) \	286	x(EIO, bucket_ref_update) \
288	x(EIO, trigger_alloc) \	287	x(EIO, trigger_alloc) \

fs/bcachefs/error.c+4−2

 		return bch_err_throw(c, btree_need_topology_repair);
 	} else {
 		return bch2_run_explicit_recovery_pass(c, out, BCH_RECOVERY_PASS_check_topology, 0) ?:
-			bch_err_throw(c, btree_node_read_validate_error);
+			bch_err_throw(c, btree_need_topology_repair);
 	}
 }
 	 * log_fsck_err()s: that would require us to track for every error type
 	 * which recovery pass corrects it, to get the fsck exit status correct:
 	 */
-	if (bch2_err_matches(ret, BCH_ERR_fsck_fix)) {
+	if (bch2_err_matches(ret, BCH_ERR_transaction_restart)) {
+		/* nothing */
+	} else if (bch2_err_matches(ret, BCH_ERR_fsck_fix)) {
 		set_bit(BCH_FS_errors_fixed, &c->flags);
 	} else {
 		set_bit(BCH_FS_errors_not_fixed, &c->flags);

fs/bcachefs/extents.c+8−8

@@ -50,19 +50,17 @@ void bch2_io_failures_to_text(struct printbuf *out, · 49 unmodified lines
50	struct bch_io_failures *failed)	50	struct bch_io_failures *failed)
51	{	51	{
52	static const char * const error_types[] = {	52	static const char * const error_types[] = {
53	"io", "checksum", "ec reconstruct", NULL	53	"btree validate", "io", "checksum", "ec reconstruct", NULL
54	};	54	};
55		55
56	for (struct bch_dev_io_failures *f = failed->devs;	56	for (struct bch_dev_io_failures *f = failed->devs;
57	f < failed->devs + failed->nr;	57	f < failed->devs + failed->nr;
58	f++) {	58	f++) {
59	unsigned errflags =	59	unsigned errflags =
60	((!!f->failed_io) << 0) \|	60	((!!f->failed_btree_validate) << 0) \|
61	((!!f->failed_csum_nr) << 1) \|	61	((!!f->failed_io) << 1) \|
62	((!!f->failed_ec) << 2);	62	((!!f->failed_csum_nr) << 2) \|
63		63	((!!f->failed_ec) << 3);
64	if (!errflags)
65	continue;
66		64
67	bch2_printbuf_make_room(out, 1024);	65	bch2_printbuf_make_room(out, 1024);
68	out->atomic++;	66	out->atomic++;
@@ -77,7 +75,9 @@ void bch2_io_failures_to_text(struct printbuf *out, · 8 unmodified lines
77		75
78	prt_char(out, ' ');	76	prt_char(out, ' ');
79		77
80	if (is_power_of_2(errflags)) {	78	if (!errflags) {
		79	prt_str(out, "no error - confused");
		80	} else if (is_power_of_2(errflags)) {
81	prt_bitflags(out, error_types, errflags);	81	prt_bitflags(out, error_types, errflags);
82	prt_str(out, " error");	82	prt_str(out, " error");
83	} else {	83	} else {

fs/bcachefs/fsck.c+6−27

@@ -12,6 +12,7 @@ · 11 unmodified lines
12	#include "fs.h"	12	#include "fs.h"
13	#include "fsck.h"	13	#include "fsck.h"
14	#include "inode.h"	14	#include "inode.h"
		15	#include "io_misc.h"
15	#include "keylist.h"	16	#include "keylist.h"
16	#include "namei.h"	17	#include "namei.h"
17	#include "recovery_passes.h"	18	#include "recovery_passes.h"
@@ -1919,33 +1920,11 @@ static int check_extent(struct btree_trans trans, struct btree_iter iter, · 1901 unmodified lines
1919	"extent type past end of inode %llu:%u, i_size %llu\n%s",	1920	"extent type past end of inode %llu:%u, i_size %llu\n%s",
1920	i->inode.bi_inum, i->inode.bi_snapshot, i->inode.bi_size,	1921	i->inode.bi_inum, i->inode.bi_snapshot, i->inode.bi_size,
1921	(bch2_bkey_val_to_text(&buf, c, k), buf.buf))) {	1922	(bch2_bkey_val_to_text(&buf, c, k), buf.buf))) {
1922	struct bkey_i whiteout = bch2_trans_kmalloc(trans, sizeof(whiteout));	1923	ret = bch2_fpunch_snapshot(trans,
1923	ret = PTR_ERR_OR_ZERO(whiteout);	1924	SPOS(i->inode.bi_inum,
1924	if (ret)	1925	last_block,
1925	goto err;	1926	i->inode.bi_snapshot),
1926		1927	POS(i->inode.bi_inum, U64_MAX));
1927	bkey_init(&whiteout->k);
1928	whiteout->k.p = SPOS(k.k->p.inode,
1929	last_block,
1930	i->inode.bi_snapshot);
1931	bch2_key_resize(&whiteout->k,
1932	min(KEY_SIZE_MAX & (~0 << c->block_bits),
1933	U64_MAX - whiteout->k.p.offset));
1934
1935
1936	/*
1937	* Need a normal (not BTREE_ITER_all_snapshots)
1938	* iterator, if we're deleting in a different
1939	* snapshot and need to emit a whiteout
1940	*/
1941	struct btree_iter iter2;
1942	bch2_trans_iter_init(trans, &iter2, BTREE_ID_extents,
1943	bkey_start_pos(&whiteout->k),
1944	BTREE_ITER_intent);
1945	ret = bch2_btree_iter_traverse(trans, &iter2) ?:
1946	bch2_trans_update(trans, &iter2, whiteout,
1947	BTREE_UPDATE_internal_snapshot_node);
1948	bch2_trans_iter_exit(trans, &iter2);
1949	if (ret)	1928	if (ret)
1950	goto err;	1929	goto err;
1951		1930

fs/bcachefs/io_misc.c+27−0

@@ -135,6 +135,33 @@ err_noprint: · 134 unmodified lines
135	return ret;	135	return ret;
136	}	136	}
137		137
		138	/* For fsck */
		139	int bch2_fpunch_snapshot(struct btree_trans *trans, struct bpos start, struct bpos end)
		140	{
		141	u32 restart_count = trans->restart_count;
		142	struct bch_fs *c = trans->c;
		143	struct disk_reservation disk_res = bch2_disk_reservation_init(c, 0);
		144	unsigned max_sectors = KEY_SIZE_MAX & (~0 << c->block_bits);
		145	struct bkey_i delete;
		146
		147	int ret = for_each_btree_key_max_commit(trans, iter, BTREE_ID_extents,
		148	start, end, 0, k,
		149	&disk_res, NULL, BCH_TRANS_COMMIT_no_enospc, ({
		150	bkey_init(&delete.k);
		151	delete.k.p = iter.pos;
		152
		153	/* create the biggest key we can */
		154	bch2_key_resize(&delete.k, max_sectors);
		155	bch2_cut_back(end, &delete);
		156
		157	bch2_extent_trim_atomic(trans, &iter, &delete) ?:
		158	bch2_trans_update(trans, &iter, &delete, 0);
		159	}));
		160
		161	bch2_disk_reservation_put(c, &disk_res);
		162	return ret ?: trans_was_restarted(trans, restart_count);
		163	}
		164
138	/*	165	/*
139	* Returns -BCH_ERR_transacton_restart if we had to drop locks:	166	* Returns -BCH_ERR_transacton_restart if we had to drop locks:
140	*/	167	*/

fs/bcachefs/io_misc.h+2−0

@@ -5,6 +5,8 @@ · 4 unmodified lines
5	int bch2_extent_fallocate(struct btree_trans , subvol_inum, struct btree_iter ,	5	int bch2_extent_fallocate(struct btree_trans , subvol_inum, struct btree_iter ,
6	u64, struct bch_io_opts, s64 *,	6	u64, struct bch_io_opts, s64 *,
7	struct write_point_specifier);	7	struct write_point_specifier);
		8
		9	int bch2_fpunch_snapshot(struct btree_trans *, struct bpos, struct bpos);
8	int bch2_fpunch_at(struct btree_trans , struct btree_iter ,	10	int bch2_fpunch_at(struct btree_trans , struct btree_iter ,
9	subvol_inum, u64, s64 *);	11	subvol_inum, u64, s64 *);
10	int bch2_fpunch(struct bch_fs c, subvol_inum, u64, u64, s64 );	12	int bch2_fpunch(struct bch_fs c, subvol_inum, u64, u64, s64 );

fs/bcachefs/journal_reclaim.c+6−0

 	if (nr_devs < nr_devs_want)
 		return (struct journal_space) { 0, 0 };
+	/*
+	 * It's possible for bucket size to be misaligned w.r.t. the filesystem
+	 * block size:
+	 */
+	min_bucket_size = round_down(min_bucket_size, block_sectors(c));
 	/*
 	 * We sorted largest to smallest, and we want the smallest out of the
 	 * @nr_devs_want largest devices:

fs/bcachefs/recovery.c+17−6

@@ -273,24 +273,35 @@ static int bch2_journal_replay_key(struct btree_trans *trans, · 272 unmodified lines
273	goto out;	273	goto out;
274		274
275	struct btree_path *path = btree_iter_path(trans, &iter);	275	struct btree_path *path = btree_iter_path(trans, &iter);
276	if (unlikely(!btree_path_node(path, k->level) &&	276	if (unlikely(!btree_path_node(path, k->level))) {
277	!k->allocated)) {
278	struct bch_fs *c = trans->c;	277	struct bch_fs *c = trans->c;
279		278
		279	CLASS(printbuf, buf)();
		280	prt_str(&buf, "btree=");
		281	bch2_btree_id_to_text(&buf, k->btree_id);
		282	prt_printf(&buf, " level=%u ", k->level);
		283	bch2_bkey_val_to_text(&buf, c, bkey_i_to_s_c(k->k));
		284
280	if (!(c->recovery.passes_complete & (BIT_ULL(BCH_RECOVERY_PASS_scan_for_btree_nodes)\|	285	if (!(c->recovery.passes_complete & (BIT_ULL(BCH_RECOVERY_PASS_scan_for_btree_nodes)\|
281	BIT_ULL(BCH_RECOVERY_PASS_check_topology)))) {	286	BIT_ULL(BCH_RECOVERY_PASS_check_topology)))) {
282	bch_err(c, "have key in journal replay for btree depth that does not exist, confused");	287	bch_err(c, "have key in journal replay for btree depth that does not exist, confused\n%s",
		288	buf.buf);
283	ret = -EINVAL;	289	ret = -EINVAL;
284	}	290	}
285	#if 0	291
		292	if (!k->allocated) {
		293	bch_notice(c, "dropping key in journal replay for depth that does not exist because we're recovering from scan\n%s",
		294	buf.buf);
		295	k->overwritten = true;
		296	goto out;
		297	}
		298
286	bch2_trans_iter_exit(trans, &iter);	299	bch2_trans_iter_exit(trans, &iter);
287	bch2_trans_node_iter_init(trans, &iter, k->btree_id, k->k->k.p,	300	bch2_trans_node_iter_init(trans, &iter, k->btree_id, k->k->k.p,
288	BTREE_MAX_DEPTH, 0, iter_flags);	301	BTREE_MAX_DEPTH, 0, iter_flags);
289	ret = bch2_btree_iter_traverse(trans, &iter) ?:	302	ret = bch2_btree_iter_traverse(trans, &iter) ?:
290	bch2_btree_increase_depth(trans, iter.path, 0) ?:	303	bch2_btree_increase_depth(trans, iter.path, 0) ?:
291	-BCH_ERR_transaction_restart_nested;	304	-BCH_ERR_transaction_restart_nested;
292	#endif
293	k->overwritten = true;
294	goto out;	305	goto out;
295	}	306	}
296		307

fs/bcachefs/recovery_passes.c+1−1

@@ -360,7 +360,7 @@ int __bch2_run_explicit_recovery_pass(struct bch_fs *c, · 359 unmodified lines
360	!(r->passes_complete & BIT_ULL(pass));	360	!(r->passes_complete & BIT_ULL(pass));
361	bool ratelimit = flags & RUN_RECOVERY_PASS_ratelimit;	361	bool ratelimit = flags & RUN_RECOVERY_PASS_ratelimit;
362		362
363	if (!(in_recovery && (flags & RUN_RECOVERY_PASS_nopersistent))) {	363	if (!(flags & RUN_RECOVERY_PASS_nopersistent)) {
364	struct bch_sb_field_ext *ext = bch2_sb_field_get(c->disk_sb.sb, ext);	364	struct bch_sb_field_ext *ext = bch2_sb_field_get(c->disk_sb.sb, ext);
365	__set_bit_le64(bch2_recovery_pass_to_stable(pass), ext->recovery_passes_required);	365	__set_bit_le64(bch2_recovery_pass_to_stable(pass), ext->recovery_passes_required);
366	}	366	}

fs/erofs/data.c+16−5

 /*
  * bit 30: I/O error occurred on this folio
+ * bit 29: CPU has dirty data in D-cache (needs aliasing handling);
  * bit 0 - 29: remaining parts to complete this folio
  */
-#define EROFS_ONLINEFOLIO_EIO			(1 << 30)
+#define EROFS_ONLINEFOLIO_EIO		30
+#define EROFS_ONLINEFOLIO_DIRTY		29
 void erofs_onlinefolio_init(struct folio *folio)
 {
 	atomic_inc((atomic_t *)&folio->private);
 }
-void erofs_onlinefolio_end(struct folio *folio, int err)
+void erofs_onlinefolio_end(struct folio *folio, int err, bool dirty)
 {
 	int orig, v;
 	do {
 		orig = atomic_read((atomic_t *)&folio->private);
-		v = (orig - 1) | (err ? EROFS_ONLINEFOLIO_EIO : 0);
+		DBG_BUGON(orig <= 0);
+		v = dirty << EROFS_ONLINEFOLIO_DIRTY;
+		v |= (orig - 1) | (!!err << EROFS_ONLINEFOLIO_EIO);
 	} while (atomic_cmpxchg((atomic_t *)&folio->private, orig, v) != orig);
-	if (v & ~EROFS_ONLINEFOLIO_EIO)
+	if (v & (BIT(EROFS_ONLINEFOLIO_DIRTY) - 1))
 		return;
 	folio->private = 0;
-	folio_end_read(folio, !(v & EROFS_ONLINEFOLIO_EIO));
+	if (v & BIT(EROFS_ONLINEFOLIO_DIRTY))
+		flush_dcache_folio(folio);
+	folio_end_read(folio, !(v & BIT(EROFS_ONLINEFOLIO_EIO)));
 }
 static int erofs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
  */
 static int erofs_read_folio(struct file *file, struct folio *folio)
 {
+	trace_erofs_read_folio(folio, true);
 	return iomap_read_folio(folio, &erofs_iomap_ops);
 }
 static void erofs_readahead(struct readahead_control *rac)
 {
+	trace_erofs_readahead(rac->mapping->host, readahead_index(rac),
+					readahead_count(rac), true);
 	return iomap_readahead(rac, &erofs_iomap_ops);
 }

fs/erofs/decompressor.c+4−8

 		cur = min(cur, rq->outputsize);
 		if (cur && rq->out[0]) {
 			kin = kmap_local_page(rq->in[nrpages_in - 1]);
-			if (rq->out[0] == rq->in[nrpages_in - 1]) {
+			if (rq->out[0] == rq->in[nrpages_in - 1])
 				memmove(kin + rq->pageofs_out, kin + pi, cur);
-				flush_dcache_page(rq->out[0]);
+			else
-			} else {
 				memcpy_to_page(rq->out[0], rq->pageofs_out,
 					       kin + pi, cur);
-			}
 			kunmap_local(kin);
 		}
 		rq->outputsize -= cur;
 			po = (rq->pageofs_out + cur + pi) & ~PAGE_MASK;
 			DBG_BUGON(no >= nrpages_out);
 			cnt = min(insz - pi, PAGE_SIZE - po);
-			if (rq->out[no] == rq->in[ni]) {
+			if (rq->out[no] == rq->in[ni])
 				memmove(kin + po,
 					kin + rq->pageofs_in + pi, cnt);
-				flush_dcache_page(rq->out[no]);
+			else if (rq->out[no])
-			} else if (rq->out[no]) {
 				memcpy_to_page(rq->out[no], po,
 					       kin + rq->pageofs_in + pi, cnt);
-			}
 			pi += cnt;
 		} while (pi < insz);
 		kunmap_local(kin);

fs/erofs/dir.c+6−0

 		struct erofs_dirent *de;
 		unsigned int nameoff, maxsize;
+		if (fatal_signal_pending(current)) {
+			err = -ERESTARTSYS;
+			break;
+		}
 		de = erofs_bread(&buf, dbstart, true);
 		if (IS_ERR(de)) {
 			erofs_err(sb, "failed to readdir of logical block %llu of nid %llu",
 			break;
 		ctx->pos = dbstart + maxsize;
 		ofs = 0;
+		cond_resched();
 	}
 	erofs_put_metabuf(&buf);
 	if (EROFS_I(dir)->dot_omitted && ctx->pos == dir->i_size) {

fs/erofs/fileio.c+3−11

 	} else {
 		bio_for_each_folio_all(fi, &rq->bio) {
 			DBG_BUGON(folio_test_uptodate(fi.folio));
-			erofs_onlinefolio_end(fi.folio, ret);
+			erofs_onlinefolio_end(fi.folio, ret, false);
 		}
 	}
 	bio_uninit(&rq->bio);
 	struct erofs_map_blocks *map = &io->map;
 	unsigned int cur = 0, end = folio_size(folio), len, attached = 0;
 	loff_t pos = folio_pos(folio), ofs;
-	struct iov_iter iter;
-	struct bio_vec bv;
 	int err = 0;
 	erofs_onlinefolio_init(folio);
 				err = PTR_ERR(src);
 				break;
 			}
-			bvec_set_folio(&bv, folio, len, cur);
+			memcpy_to_folio(folio, cur, src, len);
-			iov_iter_bvec(&iter, ITER_DEST, &bv, 1, len);
-			if (copy_to_iter(src, len, &iter) != len) {
-				erofs_put_metabuf(&buf);
-				err = -EIO;
-				break;
-			}
 			erofs_put_metabuf(&buf);
 		} else if (!(map->m_flags & EROFS_MAP_MAPPED)) {
 			folio_zero_segment(folio, cur, cur + len);
 		}
 		cur += len;
 	}
-	erofs_onlinefolio_end(folio, err);
+	erofs_onlinefolio_end(folio, err, false);
 	return err;
 }

fs/erofs/internal.h+4−2

 /* The length of extent is full */
 #define EROFS_MAP_FULL_MAPPED	0x0008
 /* Located in the special packed inode */
-#define EROFS_MAP_FRAGMENT	0x0010
+#define __EROFS_MAP_FRAGMENT	0x0010
 /* The extent refers to partial decompressed data */
 #define EROFS_MAP_PARTIAL_REF	0x0020
+#define EROFS_MAP_FRAGMENT	(EROFS_MAP_MAPPED | __EROFS_MAP_FRAGMENT)
 struct erofs_map_blocks {
 	struct erofs_buf buf;
 int erofs_map_blocks(struct inode *inode, struct erofs_map_blocks *map);
 void erofs_onlinefolio_init(struct folio *folio);
 void erofs_onlinefolio_split(struct folio *folio);
-void erofs_onlinefolio_end(struct folio *folio, int err);
+void erofs_onlinefolio_end(struct folio *folio, int err, bool dirty);
 struct inode *erofs_iget(struct super_block *sb, erofs_nid_t nid);
 int erofs_getattr(struct mnt_idmap *idmap, const struct path *path,
 		  struct kstat *stat, u32 request_mask,

fs/erofs/zdata.c+4−4

@@ -1034,7 +1034,7 @@ static int z_erofs_scan_folio(struct z_erofs_frontend *f, · 1033 unmodified lines
1034	if (!(map->m_flags & EROFS_MAP_MAPPED)) {	1034	if (!(map->m_flags & EROFS_MAP_MAPPED)) {
1035	folio_zero_segment(folio, cur, end);	1035	folio_zero_segment(folio, cur, end);
1036	tight = false;	1036	tight = false;
1037	} else if (map->m_flags & EROFS_MAP_FRAGMENT) {	1037	} else if (map->m_flags & __EROFS_MAP_FRAGMENT) {
1038	erofs_off_t fpos = offset + cur - map->m_la;	1038	erofs_off_t fpos = offset + cur - map->m_la;
1039		1039
1040	err = z_erofs_read_fragment(inode->i_sb, folio, cur,	1040	err = z_erofs_read_fragment(inode->i_sb, folio, cur,
@@ -1091,7 +1091,7 @@ static int z_erofs_scan_folio(struct z_erofs_frontend *f, · 50 unmodified lines
1091	tight = (bs == PAGE_SIZE);	1091	tight = (bs == PAGE_SIZE);
1092	}	1092	}
1093	} while ((end = cur) > 0);	1093	} while ((end = cur) > 0);
1094	erofs_onlinefolio_end(folio, err);	1094	erofs_onlinefolio_end(folio, err, false);
1095	return err;	1095	return err;
1096	}	1096	}
1097		1097
@@ -1196,7 +1196,7 @@ static void z_erofs_fill_other_copies(struct z_erofs_backend *be, int err) · 98 unmodified lines
1196	cur += len;	1196	cur += len;
1197	}	1197	}
1198	kunmap_local(dst);	1198	kunmap_local(dst);
1199	erofs_onlinefolio_end(page_folio(bvi->bvec.page), err);	1199	erofs_onlinefolio_end(page_folio(bvi->bvec.page), err, true);
1200	list_del(p);	1200	list_del(p);
1201	kfree(bvi);	1201	kfree(bvi);
1202	}	1202	}
@@ -1355,7 +1355,7 @@ static int z_erofs_decompress_pcluster(struct z_erofs_backend *be, int err) · 152 unmodified lines
1355		1355
1356	DBG_BUGON(z_erofs_page_is_invalidated(page));	1356	DBG_BUGON(z_erofs_page_is_invalidated(page));
1357	if (!z_erofs_is_shortlived_page(page)) {	1357	if (!z_erofs_is_shortlived_page(page)) {
1358	erofs_onlinefolio_end(page_folio(page), err);	1358	erofs_onlinefolio_end(page_folio(page), err, true);
1359	continue;	1359	continue;
1360	}	1360	}
1361	if (pcl->algorithmformat != Z_EROFS_COMPRESSION_LZ4) {	1361	if (pcl->algorithmformat != Z_EROFS_COMPRESSION_LZ4) {

fs/erofs/zmap.c+4−5

 	    !vi->z_tailextent_headlcn) {
 		map->m_la = 0;
 		map->m_llen = inode->i_size;
-		map->m_flags = EROFS_MAP_MAPPED |
+		map->m_flags = EROFS_MAP_FRAGMENT;
-			EROFS_MAP_FULL_MAPPED | EROFS_MAP_FRAGMENT;
 		return 0;
 	}
 	initial_lcn = ofs >> lclusterbits;
 			goto unmap_out;
 		}
 	} else if (fragment && m.lcn == vi->z_tailextent_headlcn) {
-		map->m_flags |= EROFS_MAP_FRAGMENT;
+		map->m_flags = EROFS_MAP_FRAGMENT;
 	} else {
 		map->m_pa = erofs_pos(sb, m.pblk);
 		err = z_erofs_get_extent_compressedlen(&m, initial_lcn);
 	if (lstart < lend) {
 		map->m_la = lstart;
 		if (last && (vi->z_advise & Z_EROFS_ADVISE_FRAGMENT_PCLUSTER)) {
-			map->m_flags |= EROFS_MAP_MAPPED | EROFS_MAP_FRAGMENT;
+			map->m_flags = EROFS_MAP_FRAGMENT;
 			vi->z_fragmentoff = map->m_plen;
 			if (recsz > offsetof(struct z_erofs_extent, pstart_lo))
 				vi->z_fragmentoff |= map->m_pa << 32;
 	iomap->length = map.m_llen;
 	if (map.m_flags & EROFS_MAP_MAPPED) {
 		iomap->type = IOMAP_MAPPED;
-		iomap->addr = map.m_flags & EROFS_MAP_FRAGMENT ?
+		iomap->addr = map.m_flags & __EROFS_MAP_FRAGMENT ?
 			      IOMAP_NULL_ADDR : map.m_pa;
 	} else {
 		iomap->type = IOMAP_HOLE;

fs/eventpoll.c+329−141

@@ -137,7 +137,13 @@ struct epitem { · 136 unmodified lines
137	};	137	};
138		138
139	/* List header used to link this structure to the eventpoll ready list */	139	/* List header used to link this structure to the eventpoll ready list */
140	struct llist_node rdllink;	140	struct list_head rdllink;
		141
		142	/*
		143	* Works together "struct eventpoll"->ovflist in keeping the
		144	* single linked chain of items.
		145	*/
		146	struct epitem *next;
141		147
142	/* The file descriptor information this item refers to */	148	/* The file descriptor information this item refers to */
143	struct epoll_filefd ffd;	149	struct epoll_filefd ffd;
@@ -185,15 +191,22 @@ struct eventpoll { · 41 unmodified lines
185	/* Wait queue used by file->poll() */	191	/* Wait queue used by file->poll() */
186	wait_queue_head_t poll_wait;	192	wait_queue_head_t poll_wait;
187		193
188	/*	194	/* List of ready file descriptors */
189	* List of ready file descriptors. Adding to this list is lockless. Items can be removed	195	struct list_head rdllist;
190	* only with eventpoll::mtx	196
191	*/	197	/* Lock which protects rdllist and ovflist */
192	struct llist_head rdllist;	198	rwlock_t lock;
193		199
194	/* RB tree root used to store monitored fd structs */	200	/* RB tree root used to store monitored fd structs */
195	struct rb_root_cached rbr;	201	struct rb_root_cached rbr;
196		202
		203	/*
		204	* This is a single linked list that chains all the "struct epitem" that
		205	* happened while transferring ready events to userspace w/out
		206	* holding ->lock.
		207	*/
		208	struct epitem *ovflist;
		209
197	/* wakeup_source used when ep_send_events or __ep_eventpoll_poll is running */	210	/* wakeup_source used when ep_send_events or __ep_eventpoll_poll is running */
198	struct wakeup_source *ws;	211	struct wakeup_source *ws;
199		212
@@ -348,14 +361,10 @@ static inline int ep_cmp_ffd(struct epoll_filefd *p1, · 148 unmodified lines
348	(p1->file < p2->file ? -1 : p1->fd - p2->fd));	361	(p1->file < p2->file ? -1 : p1->fd - p2->fd));
349	}	362	}
350		363
351	/*	364	/* Tells us if the item is currently linked */
352	* Add the item to its container eventpoll's rdllist; do nothing if the item is already on rdllist.	365	static inline int ep_is_linked(struct epitem *epi)
353	*/
354	static void epitem_ready(struct epitem *epi)
355	{	366	{
356	if (&epi->rdllink == cmpxchg(&epi->rdllink.next, &epi->rdllink, NULL))	367	return !list_empty(&epi->rdllink);
357	llist_add(&epi->rdllink, &epi->ep->rdllist);
358
359	}	368	}
360		369
361	static inline struct eppoll_entry ep_pwq_from_wait(wait_queue_entry_t p)	370	static inline struct eppoll_entry ep_pwq_from_wait(wait_queue_entry_t p)
@@ -374,26 +383,13 @@ static inline struct epitem ep_item_from_wait(wait_queue_entry_t p) · 12 unmodified lines
374	*	383	*
375	* @ep: Pointer to the eventpoll context.	384	* @ep: Pointer to the eventpoll context.
376	*	385	*
377	* Return: true if ready events might be available, false otherwise.	386	* Return: a value different than %zero if ready events are available,
		387	* or %zero otherwise.
378	*/	388	*/
379	static inline bool ep_events_available(struct eventpoll *ep)	389	static inline int ep_events_available(struct eventpoll *ep)
380	{	390	{
381	bool available;	391	return !list_empty_careful(&ep->rdllist) \|\|
382	int locked;	392	READ_ONCE(ep->ovflist) != EP_UNACTIVE_PTR;
383
384	locked = mutex_trylock(&ep->mtx);
385	if (!locked) {
386	/*
387	* The lock held and someone might have removed all items while inspecting it. The
388	* llist_empty() check in this case is futile. Assume that something is enqueued and
389	* let ep_try_send_events() figure it out.
390	*/
391	return true;
392	}
393
394	available = !llist_empty(&ep->rdllist);
395	mutex_unlock(&ep->mtx);
396	return available;
397	}	393	}
398		394
399	#ifdef CONFIG_NET_RX_BUSY_POLL	395	#ifdef CONFIG_NET_RX_BUSY_POLL
@@ -728,6 +724,77 @@ static inline void ep_pm_stay_awake_rcu(struct epitem *epi) · 328 unmodified lines
728	rcu_read_unlock();	724	rcu_read_unlock();
729	}	725	}
730		726
		727
		728	/*
		729	* ep->mutex needs to be held because we could be hit by
		730	* eventpoll_release_file() and epoll_ctl().
		731	*/
		732	static void ep_start_scan(struct eventpoll ep, struct list_head txlist)
		733	{
		734	/*
		735	* Steal the ready list, and re-init the original one to the
		736	* empty list. Also, set ep->ovflist to NULL so that events
		737	* happening while looping w/out locks, are not lost. We cannot
		738	* have the poll callback to queue directly on ep->rdllist,
		739	* because we want the "sproc" callback to be able to do it
		740	* in a lockless way.
		741	*/
		742	lockdep_assert_irqs_enabled();
		743	write_lock_irq(&ep->lock);
		744	list_splice_init(&ep->rdllist, txlist);
		745	WRITE_ONCE(ep->ovflist, NULL);
		746	write_unlock_irq(&ep->lock);
		747	}
		748
		749	static void ep_done_scan(struct eventpoll *ep,
		750	struct list_head *txlist)
		751	{
		752	struct epitem epi, nepi;
		753
		754	write_lock_irq(&ep->lock);
		755	/*
		756	* During the time we spent inside the "sproc" callback, some
		757	* other events might have been queued by the poll callback.
		758	* We re-insert them inside the main ready-list here.
		759	*/
		760	for (nepi = READ_ONCE(ep->ovflist); (epi = nepi) != NULL;
		761	nepi = epi->next, epi->next = EP_UNACTIVE_PTR) {
		762	/*
		763	* We need to check if the item is already in the list.
		764	* During the "sproc" callback execution time, items are
		765	* queued into ->ovflist but the "txlist" might already
		766	* contain them, and the list_splice() below takes care of them.
		767	*/
		768	if (!ep_is_linked(epi)) {
		769	/*
		770	* ->ovflist is LIFO, so we have to reverse it in order
		771	* to keep in FIFO.
		772	*/
		773	list_add(&epi->rdllink, &ep->rdllist);
		774	ep_pm_stay_awake(epi);
		775	}
		776	}
		777	/*
		778	* We need to set back ep->ovflist to EP_UNACTIVE_PTR, so that after
		779	* releasing the lock, events will be queued in the normal way inside
		780	* ep->rdllist.
		781	*/
		782	WRITE_ONCE(ep->ovflist, EP_UNACTIVE_PTR);
		783
		784	/*
		785	* Quickly re-inject items left on "txlist".
		786	*/
		787	list_splice(txlist, &ep->rdllist);
		788	__pm_relax(ep->ws);
		789
		790	if (!list_empty(&ep->rdllist)) {
		791	if (waitqueue_active(&ep->wq))
		792	wake_up(&ep->wq);
		793	}
		794
		795	write_unlock_irq(&ep->lock);
		796	}
		797
731	static void ep_get(struct eventpoll *ep)	798	static void ep_get(struct eventpoll *ep)
732	{	799	{
733	refcount_inc(&ep->refcount);	800	refcount_inc(&ep->refcount);
@@ -765,12 +832,10 @@ static void ep_free(struct eventpoll *ep) · 31 unmodified lines
765	static bool __ep_remove(struct eventpoll ep, struct epitem epi, bool force)	832	static bool __ep_remove(struct eventpoll ep, struct epitem epi, bool force)
766	{	833	{
767	struct file *file = epi->ffd.file;	834	struct file *file = epi->ffd.file;
768	struct llist_node *put_back_last;
769	struct epitems_head *to_free;	835	struct epitems_head *to_free;
770	struct hlist_head *head;	836	struct hlist_head *head;
771	LLIST_HEAD(put_back);
772		837
773	lockdep_assert_held(&ep->mtx);	838	lockdep_assert_irqs_enabled();
774		839
775	/*	840	/*
776	* Removes poll wait queue hooks.	841	* Removes poll wait queue hooks.
@@ -802,20 +867,10 @@ static bool __ep_remove(struct eventpoll ep, struct epitem epi, bool force) · 25 unmodified lines
802		867
803	rb_erase_cached(&epi->rbn, &ep->rbr);	868	rb_erase_cached(&epi->rbn, &ep->rbr);
804		869
805	if (llist_on_list(&epi->rdllink)) {	870	write_lock_irq(&ep->lock);
806	put_back_last = NULL;	871	if (ep_is_linked(epi))
807	while (true) {	872	list_del_init(&epi->rdllink);
808	struct llist_node *n = llist_del_first(&ep->rdllist);	873	write_unlock_irq(&ep->lock);
809
810	if (&epi->rdllink == n \|\| WARN_ON(!n))
811	break;
812	if (!put_back_last)
813	put_back_last = n;
814	__llist_add(n, &put_back);
815	}
816	if (put_back_last)
817	llist_add_batch(put_back.first, put_back_last, &ep->rdllist);
818	}
819		874
820	wakeup_source_unregister(ep_wakeup_source(epi));	875	wakeup_source_unregister(ep_wakeup_source(epi));
821	/*	876	/*
@@ -828,7 +883,7 @@ static bool __ep_remove(struct eventpoll ep, struct epitem epi, bool force) · 6 unmodified lines
828	kfree_rcu(epi, rcu);	883	kfree_rcu(epi, rcu);
829		884
830	percpu_counter_dec(&ep->user->epoll_watches);	885	percpu_counter_dec(&ep->user->epoll_watches);
831	return ep_refcount_dec_and_test(ep);	886	return true;
832	}	887	}
833		888
834	/*	889	/*
@@ -836,14 +891,14 @@ static bool __ep_remove(struct eventpoll ep, struct epitem epi, bool force) · 1 unmodified line
836	*/	891	*/
837	static void ep_remove_safe(struct eventpoll ep, struct epitem epi)	892	static void ep_remove_safe(struct eventpoll ep, struct epitem epi)
838	{	893	{
839	WARN_ON_ONCE(__ep_remove(ep, epi, false));	894	if (__ep_remove(ep, epi, false))
		895	WARN_ON_ONCE(ep_refcount_dec_and_test(ep));
840	}	896	}
841		897
842	static void ep_clear_and_put(struct eventpoll *ep)	898	static void ep_clear_and_put(struct eventpoll *ep)
843	{	899	{
844	struct rb_node rbp, next;	900	struct rb_node rbp, next;
845	struct epitem *epi;	901	struct epitem *epi;
846	bool dispose;
847		902
848	/* We need to release all tasks waiting for these file */	903	/* We need to release all tasks waiting for these file */
849	if (waitqueue_active(&ep->poll_wait))	904	if (waitqueue_active(&ep->poll_wait))
@@ -876,10 +931,8 @@ static void ep_clear_and_put(struct eventpoll *ep) · 26 unmodified lines
876	cond_resched();	931	cond_resched();
877	}	932	}
878		933
879	dispose = ep_refcount_dec_and_test(ep);
880	mutex_unlock(&ep->mtx);	934	mutex_unlock(&ep->mtx);
881		935	if (ep_refcount_dec_and_test(ep))
882	if (dispose)
883	ep_free(ep);	936	ep_free(ep);
884	}	937	}
885		938
@@ -919,9 +972,8 @@ static __poll_t ep_item_poll(const struct epitem epi, poll_table pt, int depth · 33 unmodified lines
919	static __poll_t __ep_eventpoll_poll(struct file file, poll_table wait, int depth)	972	static __poll_t __ep_eventpoll_poll(struct file file, poll_table wait, int depth)
920	{	973	{
921	struct eventpoll *ep = file->private_data;	974	struct eventpoll *ep = file->private_data;
922	struct wakeup_source *ws;	975	LIST_HEAD(txlist);
923	struct llist_node *n;	976	struct epitem epi, tmp;
924	struct epitem *epi;
925	poll_table pt;	977	poll_table pt;
926	__poll_t res = 0;	978	__poll_t res = 0;
927		979
@@ -935,39 +987,22 @@ static __poll_t __ep_eventpoll_poll(struct file file, poll_table wait, int dep · 7 unmodified lines
935	* the ready list.	987	* the ready list.
936	*/	988	*/
937	mutex_lock_nested(&ep->mtx, depth);	989	mutex_lock_nested(&ep->mtx, depth);
938	while (true) {	990	ep_start_scan(ep, &txlist);
939	n = llist_del_first_init(&ep->rdllist);	991	list_for_each_entry_safe(epi, tmp, &txlist, rdllink) {
940	if (!n)
941	break;
942
943	epi = llist_entry(n, struct epitem, rdllink);
944
945	if (ep_item_poll(epi, &pt, depth + 1)) {	992	if (ep_item_poll(epi, &pt, depth + 1)) {
946	res = EPOLLIN \| EPOLLRDNORM;	993	res = EPOLLIN \| EPOLLRDNORM;
947	epitem_ready(epi);
948	break;	994	break;
949	} else {	995	} else {
950	/*	996	/*
951	* We need to activate ep before deactivating epi, to prevent autosuspend	997	* Item has been dropped into the ready list by the poll
952	* just in case epi becomes active after ep_item_poll() above.	998	* callback, but it's not actually ready, as far as
953	*	999	* caller requested events goes. We can remove it here.
954	* This is similar to ep_send_events().
955	*/	1000	*/
956	ws = ep_wakeup_source(epi);
957	if (ws) {
958	if (ws->active)
959	__pm_stay_awake(ep->ws);
960	__pm_relax(ws);
961	}
962	__pm_relax(ep_wakeup_source(epi));	1001	__pm_relax(ep_wakeup_source(epi));
963		1002	list_del_init(&epi->rdllink);
964	/* Just in case epi becomes active right before __pm_relax() */
965	if (unlikely(ep_item_poll(epi, &pt, depth + 1)))
966	ep_pm_stay_awake(epi);
967
968	__pm_relax(ep->ws);
969	}	1003	}
970	}	1004	}
		1005	ep_done_scan(ep, &txlist);
971	mutex_unlock(&ep->mtx);	1006	mutex_unlock(&ep->mtx);
972	return res;	1007	return res;
973	}	1008	}
@@ -1100,7 +1135,7 @@ again: · 126 unmodified lines
1100	dispose = __ep_remove(ep, epi, true);	1135	dispose = __ep_remove(ep, epi, true);
1101	mutex_unlock(&ep->mtx);	1136	mutex_unlock(&ep->mtx);
1102		1137
1103	if (dispose)	1138	if (dispose && ep_refcount_dec_and_test(ep))
1104	ep_free(ep);	1139	ep_free(ep);
1105	goto again;	1140	goto again;
1106	}	1141	}
@@ -1116,10 +1151,12 @@ static int ep_alloc(struct eventpoll **pep) · 9 unmodified lines
1116	return -ENOMEM;	1151	return -ENOMEM;
1117		1152
1118	mutex_init(&ep->mtx);	1153	mutex_init(&ep->mtx);
		1154	rwlock_init(&ep->lock);
1119	init_waitqueue_head(&ep->wq);	1155	init_waitqueue_head(&ep->wq);
1120	init_waitqueue_head(&ep->poll_wait);	1156	init_waitqueue_head(&ep->poll_wait);
1121	init_llist_head(&ep->rdllist);	1157	INIT_LIST_HEAD(&ep->rdllist);
1122	ep->rbr = RB_ROOT_CACHED;	1158	ep->rbr = RB_ROOT_CACHED;
		1159	ep->ovflist = EP_UNACTIVE_PTR;
1123	ep->user = get_current_user();	1160	ep->user = get_current_user();
1124	refcount_set(&ep->refcount, 1);	1161	refcount_set(&ep->refcount, 1);
1125		1162
@@ -1201,11 +1238,94 @@ struct file get_epoll_tfile_raw_ptr(struct file file, int tfd, · 75 unmodified lines
1201	}	1238	}
1202	#endif /* CONFIG_KCMP */	1239	#endif /* CONFIG_KCMP */
1203		1240
		1241	/*
		1242	* Adds a new entry to the tail of the list in a lockless way, i.e.
		1243	* multiple CPUs are allowed to call this function concurrently.
		1244	*
		1245	* Beware: it is necessary to prevent any other modifications of the
		1246	* existing list until all changes are completed, in other words
		1247	* concurrent list_add_tail_lockless() calls should be protected
		1248	* with a read lock, where write lock acts as a barrier which
		1249	* makes sure all list_add_tail_lockless() calls are fully
		1250	* completed.
		1251	*
		1252	* Also an element can be locklessly added to the list only in one
		1253	* direction i.e. either to the tail or to the head, otherwise
		1254	* concurrent access will corrupt the list.
		1255	*
		1256	* Return: %false if element has been already added to the list, %true
		1257	* otherwise.
		1258	*/
		1259	static inline bool list_add_tail_lockless(struct list_head *new,
		1260	struct list_head *head)
		1261	{
		1262	struct list_head *prev;
		1263
		1264	/*
		1265	* This is simple 'new->next = head' operation, but cmpxchg()
		1266	* is used in order to detect that same element has been just
		1267	* added to the list from another CPU: the winner observes
		1268	* new->next == new.
		1269	*/
		1270	if (!try_cmpxchg(&new->next, &new, head))
		1271	return false;
		1272
		1273	/*
		1274	* Initially ->next of a new element must be updated with the head
		1275	* (we are inserting to the tail) and only then pointers are atomically
		1276	* exchanged. XCHG guarantees memory ordering, thus ->next should be
		1277	* updated before pointers are actually swapped and pointers are
		1278	* swapped before prev->next is updated.
		1279	*/
		1280
		1281	prev = xchg(&head->prev, new);
		1282
		1283	/*
		1284	* It is safe to modify prev->next and new->prev, because a new element
		1285	* is added only to the tail and new->next is updated before XCHG.
		1286	*/
		1287
		1288	prev->next = new;
		1289	new->prev = prev;
		1290
		1291	return true;
		1292	}
		1293
		1294	/*
		1295	* Chains a new epi entry to the tail of the ep->ovflist in a lockless way,
		1296	* i.e. multiple CPUs are allowed to call this function concurrently.
		1297	*
		1298	* Return: %false if epi element has been already chained, %true otherwise.
		1299	*/
		1300	static inline bool chain_epi_lockless(struct epitem *epi)
		1301	{
		1302	struct eventpoll *ep = epi->ep;
		1303
		1304	/* Fast preliminary check */
		1305	if (epi->next != EP_UNACTIVE_PTR)
		1306	return false;
		1307
		1308	/* Check that the same epi has not been just chained from another CPU */
		1309	if (cmpxchg(&epi->next, EP_UNACTIVE_PTR, NULL) != EP_UNACTIVE_PTR)
		1310	return false;
		1311
		1312	/* Atomically exchange tail */
		1313	epi->next = xchg(&ep->ovflist, epi);
		1314
		1315	return true;
		1316	}
		1317
1204	/*	1318	/*
1205	* This is the callback that is passed to the wait queue wakeup	1319	* This is the callback that is passed to the wait queue wakeup
1206	* mechanism. It is called by the stored file descriptors when they	1320	* mechanism. It is called by the stored file descriptors when they
1207	* have events to report.	1321	* have events to report.
1208	*	1322	*
		1323	* This callback takes a read lock in order not to contend with concurrent
		1324	* events from another file descriptor, thus all modifications to ->rdllist
		1325	* or ->ovflist are lockless. Read lock is paired with the write lock from
		1326	* ep_start/done_scan(), which stops all list modifications and guarantees
		1327	* that lists state is seen correctly.
		1328	*
1209	* Another thing worth to mention is that ep_poll_callback() can be called	1329	* Another thing worth to mention is that ep_poll_callback() can be called
1210	* concurrently for the same @epi from different CPUs if poll table was inited	1330	* concurrently for the same @epi from different CPUs if poll table was inited
1211	* with several wait queues entries. Plural wakeup from different CPUs of a	1331	* with several wait queues entries. Plural wakeup from different CPUs of a
@@ -1215,11 +1335,15 @@ struct file get_epoll_tfile_raw_ptr(struct file file, int tfd, · 3 unmodified lines
1215	*/	1335	*/
1216	static int ep_poll_callback(wait_queue_entry_t wait, unsigned mode, int sync, void key)	1336	static int ep_poll_callback(wait_queue_entry_t wait, unsigned mode, int sync, void key)
1217	{	1337	{
		1338	int pwake = 0;
1218	struct epitem *epi = ep_item_from_wait(wait);	1339	struct epitem *epi = ep_item_from_wait(wait);
1219	struct eventpoll *ep = epi->ep;	1340	struct eventpoll *ep = epi->ep;
1220	__poll_t pollflags = key_to_poll(key);	1341	__poll_t pollflags = key_to_poll(key);
		1342	unsigned long flags;
1221	int ewake = 0;	1343	int ewake = 0;
1222		1344
		1345	read_lock_irqsave(&ep->lock, flags);
		1346
1223	ep_set_busy_poll_napi_id(epi);	1347	ep_set_busy_poll_napi_id(epi);
1224		1348
1225	/*	1349	/*
@@ -1229,7 +1353,7 @@ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, v · 3 unmodified lines
1229	* until the next EPOLL_CTL_MOD will be issued.	1353	* until the next EPOLL_CTL_MOD will be issued.
1230	*/	1354	*/
1231	if (!(epi->event.events & ~EP_PRIVATE_BITS))	1355	if (!(epi->event.events & ~EP_PRIVATE_BITS))
1232	goto out;	1356	goto out_unlock;
1233		1357
1234	/*	1358	/*
1235	* Check the events coming with the callback. At this stage, not	1359	* Check the events coming with the callback. At this stage, not
@@ -1238,10 +1362,22 @@ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, v · 2 unmodified lines
1238	* test for "key" != NULL before the event match test.	1362	* test for "key" != NULL before the event match test.
1239	*/	1363	*/
1240	if (pollflags && !(pollflags & epi->event.events))	1364	if (pollflags && !(pollflags & epi->event.events))
1241	goto out;	1365	goto out_unlock;
1242		1366
1243	ep_pm_stay_awake_rcu(epi);	1367	/*
1244	epitem_ready(epi);	1368	* If we are transferring events to userspace, we can hold no locks
		1369	* (because we're accessing user memory, and because of linux f_op->poll()
		1370	* semantics). All the events that happen during that period of time are
		1371	* chained in ep->ovflist and requeued later on.
		1372	*/
		1373	if (READ_ONCE(ep->ovflist) != EP_UNACTIVE_PTR) {
		1374	if (chain_epi_lockless(epi))
		1375	ep_pm_stay_awake_rcu(epi);
		1376	} else if (!ep_is_linked(epi)) {
		1377	/* In the usual case, add event to ready list. */
		1378	if (list_add_tail_lockless(&epi->rdllink, &ep->rdllist))
		1379	ep_pm_stay_awake_rcu(epi);
		1380	}
1245		1381
1246	/*	1382	/*
1247	* Wake up ( if active ) both the eventpoll wait list and the ->poll()	1383	* Wake up ( if active ) both the eventpoll wait list and the ->poll()
@@ -1270,9 +1406,15 @@ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, v · 22 unmodified lines
1270	wake_up(&ep->wq);	1406	wake_up(&ep->wq);
1271	}	1407	}
1272	if (waitqueue_active(&ep->poll_wait))	1408	if (waitqueue_active(&ep->poll_wait))
		1409	pwake++;
		1410
		1411	out_unlock:
		1412	read_unlock_irqrestore(&ep->lock, flags);
		1413
		1414	/* We have to call this outside the lock */
		1415	if (pwake)
1273	ep_poll_safewake(ep, epi, pollflags & EPOLL_URING_WAKE);	1416	ep_poll_safewake(ep, epi, pollflags & EPOLL_URING_WAKE);
1274		1417
1275	out:
1276	if (!(epi->event.events & EPOLLEXCLUSIVE))	1418	if (!(epi->event.events & EPOLLEXCLUSIVE))
1277	ewake = 1;	1419	ewake = 1;
1278		1420
@@ -1517,6 +1659,8 @@ static int ep_insert(struct eventpoll ep, const struct epoll_event event, · 238 unmodified lines
1517	if (is_file_epoll(tfile))	1659	if (is_file_epoll(tfile))
1518	tep = tfile->private_data;	1660	tep = tfile->private_data;
1519		1661
		1662	lockdep_assert_irqs_enabled();
		1663
1520	if (unlikely(percpu_counter_compare(&ep->user->epoll_watches,	1664	if (unlikely(percpu_counter_compare(&ep->user->epoll_watches,
1521	max_user_watches) >= 0))	1665	max_user_watches) >= 0))
1522	return -ENOSPC;	1666	return -ENOSPC;
@@ -1528,10 +1672,11 @@ static int ep_insert(struct eventpoll ep, const struct epoll_event event, · 5 unmodified lines
1528	}	1672	}
1529		1673
1530	/* Item initialization follow here ... */	1674	/* Item initialization follow here ... */
1531	init_llist_node(&epi->rdllink);	1675	INIT_LIST_HEAD(&epi->rdllink);
1532	epi->ep = ep;	1676	epi->ep = ep;
1533	ep_set_ffd(&epi->ffd, tfile, fd);	1677	ep_set_ffd(&epi->ffd, tfile, fd);
1534	epi->event = *event;	1678	epi->event = *event;
		1679	epi->next = EP_UNACTIVE_PTR;
1535		1680
1536	if (tep)	1681	if (tep)
1537	mutex_lock_nested(&tep->mtx, 1);	1682	mutex_lock_nested(&tep->mtx, 1);
@@ -1598,13 +1743,16 @@ static int ep_insert(struct eventpoll ep, const struct epoll_event event, · 60 unmodified lines
1598	return -ENOMEM;	1743	return -ENOMEM;
1599	}	1744	}
1600		1745
		1746	/* We have to drop the new item inside our item list to keep track of it */
		1747	write_lock_irq(&ep->lock);
		1748
1601	/* record NAPI ID of new item if present */	1749	/* record NAPI ID of new item if present */
1602	ep_set_busy_poll_napi_id(epi);	1750	ep_set_busy_poll_napi_id(epi);
1603		1751
1604	/* If the file is already "ready" we drop it inside the ready list */	1752	/* If the file is already "ready" we drop it inside the ready list */
1605	if (revents) {	1753	if (revents && !ep_is_linked(epi)) {
		1754	list_add_tail(&epi->rdllink, &ep->rdllist);
1606	ep_pm_stay_awake(epi);	1755	ep_pm_stay_awake(epi);
1607	epitem_ready(epi);
1608		1756
1609	/* Notify waiting tasks that events are available */	1757	/* Notify waiting tasks that events are available */
1610	if (waitqueue_active(&ep->wq))	1758	if (waitqueue_active(&ep->wq))
@@ -1613,6 +1761,8 @@ static int ep_insert(struct eventpoll ep, const struct epoll_event event, · 2 unmodified lines
1613	pwake++;	1761	pwake++;
1614	}	1762	}
1615		1763
		1764	write_unlock_irq(&ep->lock);
		1765
1616	/* We have to call this outside the lock */	1766	/* We have to call this outside the lock */
1617	if (pwake)	1767	if (pwake)
1618	ep_poll_safewake(ep, NULL, 0);	1768	ep_poll_safewake(ep, NULL, 0);
@@ -1627,8 +1777,11 @@ static int ep_insert(struct eventpoll ep, const struct epoll_event event, · 8 unmodified lines
1627	static int ep_modify(struct eventpoll ep, struct epitem epi,	1777	static int ep_modify(struct eventpoll ep, struct epitem epi,
1628	const struct epoll_event *event)	1778	const struct epoll_event *event)
1629	{	1779	{
		1780	int pwake = 0;
1630	poll_table pt;	1781	poll_table pt;
1631		1782
		1783	lockdep_assert_irqs_enabled();
		1784
1632	init_poll_funcptr(&pt, NULL);	1785	init_poll_funcptr(&pt, NULL);
1633		1786
1634	/*	1787	/*
@@ -1672,16 +1825,24 @@ static int ep_modify(struct eventpoll ep, struct epitem epi, · 37 unmodified lines
1672	* list, push it inside.	1825	* list, push it inside.
1673	*/	1826	*/
1674	if (ep_item_poll(epi, &pt, 1)) {	1827	if (ep_item_poll(epi, &pt, 1)) {
1675	ep_pm_stay_awake(epi);	1828	write_lock_irq(&ep->lock);
1676	epitem_ready(epi);	1829	if (!ep_is_linked(epi)) {
		1830	list_add_tail(&epi->rdllink, &ep->rdllist);
		1831	ep_pm_stay_awake(epi);
1677		1832
1678	/* Notify waiting tasks that events are available */	1833	/* Notify waiting tasks that events are available */
1679	if (waitqueue_active(&ep->wq))	1834	if (waitqueue_active(&ep->wq))
1680	wake_up(&ep->wq);	1835	wake_up(&ep->wq);
1681	if (waitqueue_active(&ep->poll_wait))	1836	if (waitqueue_active(&ep->poll_wait))
1682	ep_poll_safewake(ep, NULL, 0);	1837	pwake++;
		1838	}
		1839	write_unlock_irq(&ep->lock);
1683	}	1840	}
1684		1841
		1842	/* We have to call this outside the lock */
		1843	if (pwake)
		1844	ep_poll_safewake(ep, NULL, 0);
		1845
1685	return 0;	1846	return 0;
1686	}	1847	}
1687		1848
@@ -1689,7 +1850,7 @@ static int ep_send_events(struct eventpoll *ep, · 1 unmodified line
1689	struct epoll_event __user *events, int maxevents)	1850	struct epoll_event __user *events, int maxevents)
1690	{	1851	{
1691	struct epitem epi, tmp;	1852	struct epitem epi, tmp;
1692	LLIST_HEAD(txlist);	1853	LIST_HEAD(txlist);
1693	poll_table pt;	1854	poll_table pt;
1694	int res = 0;	1855	int res = 0;
1695		1856
@@ -1704,18 +1865,19 @@ static int ep_send_events(struct eventpoll *ep, · 8 unmodified lines
1704	init_poll_funcptr(&pt, NULL);	1865	init_poll_funcptr(&pt, NULL);
1705		1866
1706	mutex_lock(&ep->mtx);	1867	mutex_lock(&ep->mtx);
		1868	ep_start_scan(ep, &txlist);
1707		1869
1708	while (res < maxevents) {	1870	/*
		1871	* We can loop without lock because we are passed a task private list.
		1872	* Items cannot vanish during the loop we are holding ep->mtx.
		1873	*/
		1874	list_for_each_entry_safe(epi, tmp, &txlist, rdllink) {
1709	struct wakeup_source *ws;	1875	struct wakeup_source *ws;
1710	struct llist_node *n;
1711	__poll_t revents;	1876	__poll_t revents;
1712		1877
1713	n = llist_del_first(&ep->rdllist);	1878	if (res >= maxevents)
1714	if (!n)
1715	break;	1879	break;
1716		1880
1717	epi = llist_entry(n, struct epitem, rdllink);
1718
1719	/*	1881	/*
1720	* Activate ep->ws before deactivating epi->ws to prevent	1882	* Activate ep->ws before deactivating epi->ws to prevent
1721	* triggering auto-suspend here (in case we reactive epi->ws	1883	* triggering auto-suspend here (in case we reactive epi->ws
@@ -1732,30 +1894,21 @@ static int ep_send_events(struct eventpoll *ep, · 10 unmodified lines
1732	__pm_relax(ws);	1894	__pm_relax(ws);
1733	}	1895	}
1734		1896
		1897	list_del_init(&epi->rdllink);
		1898
1735	/*	1899	/*
1736	* If the event mask intersect the caller-requested one,	1900	* If the event mask intersect the caller-requested one,
1737	* deliver the event to userspace. Again, we are holding ep->mtx,	1901	* deliver the event to userspace. Again, we are holding ep->mtx,
1738	* so no operations coming from userspace can change the item.	1902	* so no operations coming from userspace can change the item.
1739	*/	1903	*/
1740	revents = ep_item_poll(epi, &pt, 1);	1904	revents = ep_item_poll(epi, &pt, 1);
1741	if (!revents) {	1905	if (!revents)
1742	init_llist_node(n);
1743
1744	/*
1745	* Just in case epi becomes ready after ep_item_poll() above, but before
1746	* init_llist_node(). Make sure to add it to the ready list, otherwise an
1747	* event may be lost.
1748	*/
1749	if (unlikely(ep_item_poll(epi, &pt, 1))) {
1750	ep_pm_stay_awake(epi);
1751	epitem_ready(epi);
1752	}
1753	continue;	1906	continue;
1754	}
1755		1907
1756	events = epoll_put_uevent(revents, epi->event.data, events);	1908	events = epoll_put_uevent(revents, epi->event.data, events);
1757	if (!events) {	1909	if (!events) {
1758	llist_add(&epi->rdllink, &ep->rdllist);	1910	list_add(&epi->rdllink, &txlist);
		1911	ep_pm_stay_awake(epi);
1759	if (!res)	1912	if (!res)
1760	res = -EFAULT;	1913	res = -EFAULT;
1761	break;	1914	break;
@@ -1763,31 +1916,25 @@ static int ep_send_events(struct eventpoll *ep, · 1 unmodified line
1763	res++;	1916	res++;
1764	if (epi->event.events & EPOLLONESHOT)	1917	if (epi->event.events & EPOLLONESHOT)
1765	epi->event.events &= EP_PRIVATE_BITS;	1918	epi->event.events &= EP_PRIVATE_BITS;
1766	__llist_add(n, &txlist);	1919	else if (!(epi->event.events & EPOLLET)) {
1767	}
1768
1769	llist_for_each_entry_safe(epi, tmp, txlist.first, rdllink) {
1770	init_llist_node(&epi->rdllink);
1771
1772	if (!(epi->event.events & EPOLLET)) {
1773	/*	1920	/*
1774	* If this file has been added with Level Trigger mode, we need to insert	1921	* If this file has been added with Level
1775	* back inside the ready list, so that the next call to epoll_wait() will	1922	* Trigger mode, we need to insert back inside
1776	* check again the events availability.	1923	* the ready list, so that the next call to
		1924	* epoll_wait() will check again the events
		1925	* availability. At this point, no one can insert
		1926	* into ep->rdllist besides us. The epoll_ctl()
		1927	* callers are locked out by
		1928	* ep_send_events() holding "mtx" and the
		1929	* poll callback will queue them in ep->ovflist.
1777	*/	1930	*/
		1931	list_add_tail(&epi->rdllink, &ep->rdllist);
1778	ep_pm_stay_awake(epi);	1932	ep_pm_stay_awake(epi);
1779	epitem_ready(epi);
1780	}	1933	}
1781	}	1934	}
1782		1935	ep_done_scan(ep, &txlist);
1783	__pm_relax(ep->ws);
1784	mutex_unlock(&ep->mtx);	1936	mutex_unlock(&ep->mtx);
1785		1937
1786	if (!llist_empty(&ep->rdllist)) {
1787	if (waitqueue_active(&ep->wq))
1788	wake_up(&ep->wq);
1789	}
1790
1791	return res;	1938	return res;
1792	}	1939	}
1793		1940
@@ -1880,6 +2027,8 @@ static int ep_poll(struct eventpoll ep, struct epoll_event __user events, · 86 unmodified lines
1880	wait_queue_entry_t wait;	2027	wait_queue_entry_t wait;
1881	ktime_t expires, *to = NULL;	2028	ktime_t expires, *to = NULL;
1882		2029
		2030	lockdep_assert_irqs_enabled();
		2031
1883	if (timeout && (timeout->tv_sec \| timeout->tv_nsec)) {	2032	if (timeout && (timeout->tv_sec \| timeout->tv_nsec)) {
1884	slack = select_estimate_accuracy(timeout);	2033	slack = select_estimate_accuracy(timeout);
1885	to = &expires;	2034	to = &expires;
@@ -1939,15 +2088,54 @@ static int ep_poll(struct eventpoll ep, struct epoll_event __user events, · 53 unmodified lines
1939	init_wait(&wait);	2088	init_wait(&wait);
1940	wait.func = ep_autoremove_wake_function;	2089	wait.func = ep_autoremove_wake_function;
1941		2090
1942	prepare_to_wait_exclusive(&ep->wq, &wait, TASK_INTERRUPTIBLE);	2091	write_lock_irq(&ep->lock);
		2092	/*
		2093	* Barrierless variant, waitqueue_active() is called under
		2094	* the same lock on wakeup ep_poll_callback() side, so it
		2095	* is safe to avoid an explicit barrier.
		2096	*/
		2097	__set_current_state(TASK_INTERRUPTIBLE);
		2098
		2099	/*
		2100	* Do the final check under the lock. ep_start/done_scan()
		2101	* plays with two lists (->rdllist and ->ovflist) and there
		2102	* is always a race when both lists are empty for short
		2103	* period of time although events are pending, so lock is
		2104	* important.
		2105	*/
		2106	eavail = ep_events_available(ep);
		2107	if (!eavail)
		2108	__add_wait_queue_exclusive(&ep->wq, &wait);
		2109
		2110	write_unlock_irq(&ep->lock);
1943		2111
1944	if (!ep_events_available(ep))	2112	if (!eavail)
1945	timed_out = !ep_schedule_timeout(to) \|\|	2113	timed_out = !ep_schedule_timeout(to) \|\|
1946	!schedule_hrtimeout_range(to, slack,	2114	!schedule_hrtimeout_range(to, slack,
1947	HRTIMER_MODE_ABS);	2115	HRTIMER_MODE_ABS);
		2116	__set_current_state(TASK_RUNNING);
1948		2117
1949	finish_wait(&ep->wq, &wait);	2118	/*
1950	eavail = ep_events_available(ep);	2119	* We were woken up, thus go and try to harvest some events.
		2120	* If timed out and still on the wait queue, recheck eavail
		2121	* carefully under lock, below.
		2122	*/
		2123	eavail = 1;
		2124
		2125	if (!list_empty_careful(&wait.entry)) {
		2126	write_lock_irq(&ep->lock);
		2127	/*
		2128	* If the thread timed out and is not on the wait queue,
		2129	* it means that the thread was woken up after its
		2130	* timeout expired before it could reacquire the lock.
		2131	* Thus, when wait.entry is empty, it needs to harvest
		2132	* events.
		2133	*/
		2134	if (timed_out)
		2135	eavail = list_empty(&wait.entry);
		2136	__remove_wait_queue(&ep->wq, &wait);
		2137	write_unlock_irq(&ep->lock);
		2138	}
1951	}	2139	}
1952	}	2140	}
1953		2141

fs/proc/task_mmu.c+7−7

@@ -36,9 +36,9 @@ void task_mem(struct seq_file m, struct mm_struct mm) · 35 unmodified lines
36	unsigned long text, lib, swap, anon, file, shmem;	36	unsigned long text, lib, swap, anon, file, shmem;
37	unsigned long hiwater_vm, total_vm, hiwater_rss, total_rss;	37	unsigned long hiwater_vm, total_vm, hiwater_rss, total_rss;
38		38
39	anon = get_mm_counter(mm, MM_ANONPAGES);	39	anon = get_mm_counter_sum(mm, MM_ANONPAGES);
40	file = get_mm_counter(mm, MM_FILEPAGES);	40	file = get_mm_counter_sum(mm, MM_FILEPAGES);
41	shmem = get_mm_counter(mm, MM_SHMEMPAGES);	41	shmem = get_mm_counter_sum(mm, MM_SHMEMPAGES);
42		42
43	/*	43	/*
44	* Note: to minimize their overhead, mm maintains hiwater_vm and	44	* Note: to minimize their overhead, mm maintains hiwater_vm and
@@ -59,7 +59,7 @@ void task_mem(struct seq_file m, struct mm_struct mm) · 14 unmodified lines
59	text = min(text, mm->exec_vm << PAGE_SHIFT);	59	text = min(text, mm->exec_vm << PAGE_SHIFT);
60	lib = (mm->exec_vm << PAGE_SHIFT) - text;	60	lib = (mm->exec_vm << PAGE_SHIFT) - text;
61		61
62	swap = get_mm_counter(mm, MM_SWAPENTS);	62	swap = get_mm_counter_sum(mm, MM_SWAPENTS);
63	SEQ_PUT_DEC("VmPeak:\t", hiwater_vm);	63	SEQ_PUT_DEC("VmPeak:\t", hiwater_vm);
64	SEQ_PUT_DEC(" kB\nVmSize:\t", total_vm);	64	SEQ_PUT_DEC(" kB\nVmSize:\t", total_vm);
65	SEQ_PUT_DEC(" kB\nVmLck:\t", mm->locked_vm);	65	SEQ_PUT_DEC(" kB\nVmLck:\t", mm->locked_vm);
@@ -92,12 +92,12 @@ unsigned long task_statm(struct mm_struct *mm, · 26 unmodified lines
92	unsigned long shared, unsigned long text,	92	unsigned long shared, unsigned long text,
93	unsigned long data, unsigned long resident)	93	unsigned long data, unsigned long resident)
94	{	94	{
95	*shared = get_mm_counter(mm, MM_FILEPAGES) +	95	*shared = get_mm_counter_sum(mm, MM_FILEPAGES) +
96	get_mm_counter(mm, MM_SHMEMPAGES);	96	get_mm_counter_sum(mm, MM_SHMEMPAGES);
97	*text = (PAGE_ALIGN(mm->end_code) - (mm->start_code & PAGE_MASK))	97	*text = (PAGE_ALIGN(mm->end_code) - (mm->start_code & PAGE_MASK))
98	>> PAGE_SHIFT;	98	>> PAGE_SHIFT;
99	*data = mm->data_vm + mm->stack_vm;	99	*data = mm->data_vm + mm->stack_vm;
100	resident = shared + get_mm_counter(mm, MM_ANONPAGES);	100	resident = shared + get_mm_counter_sum(mm, MM_ANONPAGES);
101	return mm->total_vm;	101	return mm->total_vm;
102	}	102	}
103		103

fs/smb/server/smb2pdu.c+9−20

 		goto err_out;
 	}
-	opinfo->op_state = OPLOCK_STATE_NONE;
-	wake_up_interruptible_all(&opinfo->oplock_q);
-	opinfo_put(opinfo);
-	ksmbd_fd_put(work, fp);
 	rsp->StructureSize = cpu_to_le16(24);
 	rsp->OplockLevel = rsp_oplevel;
 	rsp->Reserved = 0;
 	rsp->VolatileFid = volatile_id;
 	rsp->PersistentFid = persistent_id;
 	ret = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_oplock_break));
-	if (!ret)
+	if (ret) {
-		return;
 err_out:
+		smb2_set_err_rsp(work);
+	}
 	opinfo->op_state = OPLOCK_STATE_NONE;
 	wake_up_interruptible_all(&opinfo->oplock_q);
 	opinfo_put(opinfo);
 	ksmbd_fd_put(work, fp);
-	smb2_set_err_rsp(work);
 }
 static int check_lease_state(struct lease *lease, __le32 req_state)
 	}
 	lease_state = lease->state;
-	opinfo->op_state = OPLOCK_STATE_NONE;
-	wake_up_interruptible_all(&opinfo->oplock_q);
-	atomic_dec(&opinfo->breaking_cnt);
-	wake_up_interruptible_all(&opinfo->oplock_brk);
-	opinfo_put(opinfo);
 	rsp->StructureSize = cpu_to_le16(36);
 	rsp->Reserved = 0;
 	rsp->LeaseState = lease_state;
 	rsp->LeaseDuration = 0;
 	ret = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_lease_ack));
-	if (!ret)
+	if (ret) {
-		return;
 err_out:
+		smb2_set_err_rsp(work);
+	}
+	opinfo->op_state = OPLOCK_STATE_NONE;
 	wake_up_interruptible_all(&opinfo->oplock_q);
 	atomic_dec(&opinfo->breaking_cnt);
 	wake_up_interruptible_all(&opinfo->oplock_brk);
 	opinfo_put(opinfo);
-	smb2_set_err_rsp(work);
 }
 /**

fs/smb/server/transport_rdma.c+3−2

 	if (t->qp) {
 		ib_drain_qp(t->qp);
 		ib_mr_pool_destroy(t->qp, &t->qp->rdma_mrs);
-		ib_destroy_qp(t->qp);
+		t->qp = NULL;
+		rdma_destroy_qp(t->cm_id);
 	}
 	ksmbd_debug(RDMA, "drain the reassembly queue\n");
 	return 0;
 err:
 	if (t->qp) {
-		ib_destroy_qp(t->qp);
 		t->qp = NULL;
+		rdma_destroy_qp(t->cm_id);
 	}
 	if (t->recv_cq) {
 		ib_destroy_cq(t->recv_cq);

fs/smb/server/vfs.c+1−0

@@ -1282,6 +1282,7 @@ out1: · 1281 unmodified lines
1282		1282
1283	err = ksmbd_vfs_lock_parent(parent_path->dentry, path->dentry);	1283	err = ksmbd_vfs_lock_parent(parent_path->dentry, path->dentry);
1284	if (err) {	1284	if (err) {
		1285	mnt_drop_write(parent_path->mnt);
1285	path_put(path);	1286	path_put(path);
1286	path_put(parent_path);	1287	path_put(parent_path);
1287	}	1288	}

include/drm/drm_file.h+3−0

 	 *
 	 * Mapping of mm object handles to object pointers. Used by the GEM
 	 * subsystem. Protected by @table_lock.
+	 *
+	 * Note that allocated entries might be NULL as a transient state when
+	 * creating or deleting a handle.
 	 */
 	struct idr object_idr;

include/drm/drm_framebuffer.h+7−0

 #ifndef __DRM_FRAMEBUFFER_H__
 #define __DRM_FRAMEBUFFER_H__
+#include <linux/bits.h>
 #include <linux/ctype.h>
 #include <linux/list.h>
 #include <linux/sched.h>
 		     unsigned num_clips);
 };
+#define DRM_FRAMEBUFFER_HAS_HANDLE_REF(_i)	BIT(0u + (_i))
 /**
  * struct drm_framebuffer - frame buffer object
  *
 	 * DRM_MODE_FB_MODIFIERS.
 	 */
 	int flags;
+	/**
+	 * @internal_flags: Framebuffer flags like DRM_FRAMEBUFFER_HAS_HANDLE_REF.
+	 */
+	unsigned int internal_flags;
 	/**
 	 * @filp_head: Placed on &drm_file.fbs, protected by &drm_file.fbs_lock.
 	 */

include/linux/blkdev.h+5−0

 	return MKDEV(disk->major, disk->first_minor);
 }
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
 /*
  * We should strive for 1 << (PAGE_SHIFT + MAX_PAGECACHE_ORDER)
  * however we constrain this to what we can validate and test.
  */
 #define BLK_MAX_BLOCK_SIZE      SZ_64K
+#else
+#define BLK_MAX_BLOCK_SIZE      PAGE_SIZE
+#endif
 /* blk_validate_limits() validates bsize, so drivers don't usually need to */
 static inline int blk_validate_block_size(unsigned long bsize)

include/linux/cpu.h+1−0

@@ -82,6 +82,7 @@ extern ssize_t cpu_show_old_microcode(struct device *dev, · 81 unmodified lines
82	struct device_attribute attr, char buf);	82	struct device_attribute attr, char buf);
83	extern ssize_t cpu_show_indirect_target_selection(struct device *dev,	83	extern ssize_t cpu_show_indirect_target_selection(struct device *dev,
84	struct device_attribute attr, char buf);	84	struct device_attribute attr, char buf);
		85	extern ssize_t cpu_show_tsa(struct device dev, struct device_attribute attr, char *buf);
85		86
86	extern __printf(4, 5)	87	extern __printf(4, 5)
87	struct device cpu_device_create(struct device parent, void *drvdata,	88	struct device cpu_device_create(struct device parent, void *drvdata,

include/linux/ieee80211.h+33−12

@@ -662,18 +662,6 @@ static inline bool ieee80211_s1g_has_cssid(__le16 fc) · 661 unmodified lines
662	(fc & cpu_to_le16(IEEE80211_S1G_BCN_CSSID));	662	(fc & cpu_to_le16(IEEE80211_S1G_BCN_CSSID));
663	}	663	}
664		664
665	/**
666	* ieee80211_is_s1g_short_beacon - check if frame is an S1G short beacon
667	* @fc: frame control bytes in little-endian byteorder
668	* Return: whether or not the frame is an S1G short beacon,
669	* i.e. it is an S1G beacon with 'next TBTT' flag set
670	*/
671	static inline bool ieee80211_is_s1g_short_beacon(__le16 fc)
672	{
673	return ieee80211_is_s1g_beacon(fc) &&
674	(fc & cpu_to_le16(IEEE80211_S1G_BCN_NEXT_TBTT));
675	}
676
677	/**	665	/**
678	* ieee80211_is_atim - check if IEEE80211_FTYPE_MGMT && IEEE80211_STYPE_ATIM	666	* ieee80211_is_atim - check if IEEE80211_FTYPE_MGMT && IEEE80211_STYPE_ATIM
679	* @fc: frame control bytes in little-endian byteorder	667	* @fc: frame control bytes in little-endian byteorder
@@ -4901,6 +4889,39 @@ static inline bool ieee80211_is_ftm(struct sk_buff *skb) · 4221 unmodified lines
4901	return false;	4889	return false;
4902	}	4890	}
4903		4891
		4892	/**
		4893	* ieee80211_is_s1g_short_beacon - check if frame is an S1G short beacon
		4894	* @fc: frame control bytes in little-endian byteorder
		4895	* @variable: pointer to the beacon frame elements
		4896	* @variable_len: length of the frame elements
		4897	* Return: whether or not the frame is an S1G short beacon. As per
		4898	* IEEE80211-2024 11.1.3.10.1, The S1G beacon compatibility element shall
		4899	* always be present as the first element in beacon frames generated at a
		4900	* TBTT (Target Beacon Transmission Time), so any frame not containing
		4901	* this element must have been generated at a TSBTT (Target Short Beacon
		4902	* Transmission Time) that is not a TBTT. Additionally, short beacons are
		4903	* prohibited from containing the S1G beacon compatibility element as per
		4904	* IEEE80211-2024 9.3.4.3 Table 9-76, so if we have an S1G beacon with
		4905	* either no elements or the first element is not the beacon compatibility
		4906	* element, we have a short beacon.
		4907	*/
		4908	static inline bool ieee80211_is_s1g_short_beacon(__le16 fc, const u8 *variable,
		4909	size_t variable_len)
		4910	{
		4911	if (!ieee80211_is_s1g_beacon(fc))
		4912	return false;
		4913
		4914	/*
		4915	* If the frame does not contain at least 1 element (this is perfectly
		4916	* valid in a short beacon) and is an S1G beacon, we have a short
		4917	* beacon.
		4918	*/
		4919	if (variable_len < 2)
		4920	return true;
		4921
		4922	return variable[0] != WLAN_EID_S1G_BCN_COMPAT;
		4923	}
		4924
4904	struct element {	4925	struct element {
4905	u8 id;	4926	u8 id;
4906	u8 datalen;	4927	u8 datalen;

include/linux/io_uring_types.h+2−0

 		struct hlist_node	hash_node;
 		/* For IOPOLL setup queues, with hybrid polling */
 		u64                     iopoll_start;
+		/* for private io_kiocb freeing */
+		struct rcu_head		rcu_head;
 	};
 	/* internal polling, see IORING_FEAT_FAST_POLL */
 	struct async_poll		*apoll;

include/linux/irqchip/irq-msi-lib.h+1−0

@@ -17,6 +17,7 @@ · 16 unmodified lines
17		17
18	#define MATCH_PLATFORM_MSI BIT(DOMAIN_BUS_PLATFORM_MSI)	18	#define MATCH_PLATFORM_MSI BIT(DOMAIN_BUS_PLATFORM_MSI)
19		19
		20	struct msi_domain_info;
20	int msi_lib_irq_domain_select(struct irq_domain d, struct irq_fwspec fwspec,	21	int msi_lib_irq_domain_select(struct irq_domain d, struct irq_fwspec fwspec,
21	enum irq_domain_bus_token bus_token);	22	enum irq_domain_bus_token bus_token);
22		23

include/linux/mm.h+5−0

 	return percpu_counter_read_positive(&mm->rss_stat[member]);
 }
+static inline unsigned long get_mm_counter_sum(struct mm_struct *mm, int member)
+{
+	return percpu_counter_sum_positive(&mm->rss_stat[member]);
+}
 void mm_trace_rss_stat(struct mm_struct *mm, int member);
 static inline void add_mm_counter(struct mm_struct *mm, int member, long value)

include/linux/psp-sev.h+2−0

  * @imi_en: launch flow is launching an IMI (Incoming Migration Image) for the
  *          purpose of guest-assisted migration.
  * @rsvd: reserved
+ * @desired_tsc_khz: hypervisor desired mean TSC freq in kHz of the guest
  * @gosvw: guest OS-visible workarounds, as defined by hypervisor
  */
 struct sev_data_snp_launch_start {
 	u32 ma_en:1;				/* In */
 	u32 imi_en:1;				/* In */
 	u32 rsvd:30;
+	u32 desired_tsc_khz;			/* In */
 	u8 gosvw[16];				/* In */
 } __packed;

include/linux/sched.h+0−4

 	u64				nr_failed_migrations_running;
 	u64				nr_failed_migrations_hot;
 	u64				nr_forced_migrations;
-#ifdef CONFIG_NUMA_BALANCING
-	u64				numa_task_migrated;
-	u64				numa_task_swapped;
-#endif
 	u64				nr_wakeups;
 	u64				nr_wakeups_sync;

include/linux/vm_event_item.h+0−2

 		NUMA_HINT_FAULTS,
 		NUMA_HINT_FAULTS_LOCAL,
 		NUMA_PAGE_MIGRATE,
-		NUMA_TASK_MIGRATE,
-		NUMA_TASK_SWAP,
 #endif
 #ifdef CONFIG_MIGRATION
 		PGMIGRATE_SUCCESS, PGMIGRATE_FAIL,

include/net/af_vsock.h+1−1

 int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
 			size_t len, int flags);
-#ifdef CONFIG_BPF_SYSCALL
 extern struct proto vsock_proto;
+#ifdef CONFIG_BPF_SYSCALL
 int vsock_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore);
 void __init vsock_bpf_build_proto(void);
 #else

include/net/bluetooth/hci_core.h+1−2

@@ -1350,8 +1350,7 @@ hci_conn_hash_lookup_big_state(struct hci_dev *hdev, __u8 handle, __u16 state) · 1349 unmodified lines
1350	rcu_read_lock();	1350	rcu_read_lock();
1351		1351
1352	list_for_each_entry_rcu(c, &h->list, list) {	1352	list_for_each_entry_rcu(c, &h->list, list) {
1353	if (c->type != BIS_LINK \|\| bacmp(&c->dst, BDADDR_ANY) \|\|	1353	if (c->type != BIS_LINK \|\| c->state != state)
1354	c->state != state)
1355	continue;	1354	continue;
1356		1355
1357	if (handle == c->iso_qos.bcast.big) {	1356	if (handle == c->iso_qos.bcast.big) {

include/net/netfilter/nf_flow_table.h+1−1

@@ -370,7 +370,7 @@ static inline __be16 __nf_flow_pppoe_proto(const struct sk_buff *skb) · 369 unmodified lines
370		370
371	static inline bool nf_flow_pppoe_proto(struct sk_buff skb, __be16 inner_proto)	371	static inline bool nf_flow_pppoe_proto(struct sk_buff skb, __be16 inner_proto)
372	{	372	{
373	if (!pskb_may_pull(skb, PPPOE_SES_HLEN))	373	if (!pskb_may_pull(skb, ETH_HLEN + PPPOE_SES_HLEN))
374	return false;	374	return false;
375		375
376	*inner_proto = __nf_flow_pppoe_proto(skb);	376	*inner_proto = __nf_flow_pppoe_proto(skb);

include/net/pkt_sched.h+24−1

@@ -114,7 +114,6 @@ struct qdisc_rate_table qdisc_get_rtab(struct tc_ratespec r, · 113 unmodified lines
114	struct netlink_ext_ack *extack);	114	struct netlink_ext_ack *extack);
115	void qdisc_put_rtab(struct qdisc_rate_table *tab);	115	void qdisc_put_rtab(struct qdisc_rate_table *tab);
116	void qdisc_put_stab(struct qdisc_size_table *tab);	116	void qdisc_put_stab(struct qdisc_size_table *tab);
117	void qdisc_warn_nonwc(const char txt, struct Qdisc qdisc);
118	bool sch_direct_xmit(struct sk_buff skb, struct Qdisc q,	117	bool sch_direct_xmit(struct sk_buff skb, struct Qdisc q,
119	struct net_device dev, struct netdev_queue txq,	118	struct net_device dev, struct netdev_queue txq,
120	spinlock_t *root_lock, bool validate);	119	spinlock_t *root_lock, bool validate);
@@ -290,4 +289,28 @@ static inline bool tc_qdisc_stats_dump(struct Qdisc *sch, · 169 unmodified lines
290	return true;	289	return true;
291	}	290	}
292		291
		292	static inline void qdisc_warn_nonwc(const char txt, struct Qdisc qdisc)
		293	{
		294	if (!(qdisc->flags & TCQ_F_WARN_NONWC)) {
		295	pr_warn("%s: %s qdisc %X: is non-work-conserving?\n",
		296	txt, qdisc->ops->id, qdisc->handle >> 16);
		297	qdisc->flags \|= TCQ_F_WARN_NONWC;
		298	}
		299	}
		300
		301	static inline unsigned int qdisc_peek_len(struct Qdisc *sch)
		302	{
		303	struct sk_buff *skb;
		304	unsigned int len;
		305
		306	skb = sch->ops->peek(sch);
		307	if (unlikely(skb == NULL)) {
		308	qdisc_warn_nonwc("qdisc_peek_len", sch);
		309	return 0;
		310	}
		311	len = qdisc_pkt_len(skb);
		312
		313	return len;
		314	}
		315
293	#endif	316	#endif

include/sound/tlv320aic32x4.h+0−9

@@ -40,13 +40,4 @@ · 39 unmodified lines
40	struct aic32x4_setup_data {	40	struct aic32x4_setup_data {
41	unsigned int gpio_func[5];	41	unsigned int gpio_func[5];
42	};	42	};
43
44	struct aic32x4_pdata {
45	struct aic32x4_setup_data *setup;
46	u32 power_cfg;
47	u32 micpga_routing;
48	bool swapdacs;
49	int rstn_gpio;
50	};
51
52	#endif	43	#endif

include/uapi/linux/bits.h+2−2

@@ -4,9 +4,9 @@ · 3 unmodified lines
4	#ifndef _UAPI_LINUX_BITS_H	4	#ifndef _UAPI_LINUX_BITS_H
5	#define _UAPI_LINUX_BITS_H	5	#define _UAPI_LINUX_BITS_H
6		6
7	#define __GENMASK(h, l) (((~_UL(0)) << (l)) & (~_UL(0) >> (BITS_PER_LONG - 1 - (h))))	7	#define __GENMASK(h, l) (((~_UL(0)) << (l)) & (~_UL(0) >> (__BITS_PER_LONG - 1 - (h))))
8		8
9	#define __GENMASK_ULL(h, l) (((~_ULL(0)) << (l)) & (~_ULL(0) >> (BITS_PER_LONG_LONG - 1 - (h))))	9	#define __GENMASK_ULL(h, l) (((~_ULL(0)) << (l)) & (~_ULL(0) >> (__BITS_PER_LONG_LONG - 1 - (h))))
10		10
11	#define __GENMASK_U128(h, l) \	11	#define __GENMASK_U128(h, l) \
12	((_BIT128((h)) << 1) - (_BIT128(l)))	12	((_BIT128((h)) << 1) - (_BIT128(l)))

include/uapi/linux/kvm.h+4−0

 					__u64 leaf;
 					__u64 r11, r12, r13, r14;
 				} get_tdvmcall_info;
+				struct {
+					__u64 ret;
+					__u64 vector;
+				} setup_event_notify;
 			};
 		} tdx;
 		/* Fix the size of the union. */

io_uring/io_uring.c+1−2

 io_req_flags_t io_file_get_flags(struct file *file)
 {
-	struct inode *inode = file_inode(file);
 	io_req_flags_t res = 0;
 	BUILD_BUG_ON(REQ_F_ISREG_BIT != REQ_F_SUPPORT_NOWAIT_BIT + 1);
-	if (S_ISREG(inode->i_mode) && !(inode->i_flags & S_ANON_INODE))
+	if (S_ISREG(file_inode(file)->i_mode))
 		res |= REQ_F_ISREG;
 	if ((file->f_flags & O_NONBLOCK) || (file->f_mode & FMODE_NOWAIT))
 		res |= REQ_F_SUPPORT_NOWAIT;

io_uring/msg_ring.c+2−2

@@ -82,7 +82,7 @@ static void io_msg_tw_complete(struct io_kiocb *req, io_tw_token_t tw) · 81 unmodified lines
82	spin_unlock(&ctx->msg_lock);	82	spin_unlock(&ctx->msg_lock);
83	}	83	}
84	if (req)	84	if (req)
85	kmem_cache_free(req_cachep, req);	85	kfree_rcu(req, rcu_head);
86	percpu_ref_put(&ctx->refs);	86	percpu_ref_put(&ctx->refs);
87	}	87	}
88		88
@@ -90,7 +90,7 @@ static int io_msg_remote_post(struct io_ring_ctx ctx, struct io_kiocb req, · 1 unmodified line
90	int res, u32 cflags, u64 user_data)	90	int res, u32 cflags, u64 user_data)
91	{	91	{
92	if (!READ_ONCE(ctx->submitter_task)) {	92	if (!READ_ONCE(ctx->submitter_task)) {
93	kmem_cache_free(req_cachep, req);	93	kfree_rcu(req, rcu_head);
94	return -EOWNERDEAD;	94	return -EOWNERDEAD;
95	}	95	}
96	req->opcode = IORING_OP_NOP;	96	req->opcode = IORING_OP_NOP;

io_uring/zcrx.c+0−3

 static void io_pp_zc_destroy(struct page_pool *pp)
 {
 	struct io_zcrx_ifq *ifq = io_pp_to_ifq(pp);
-	struct io_zcrx_area *area = ifq->area;
-	if (WARN_ON_ONCE(area->free_count != area->nia.num_niovs))
-		return;
 	percpu_ref_put(&ifq->ctx->refs);
 }

kernel/dma/contiguous.c+4−1

@@ -222,7 +222,10 @@ void __init dma_contiguous_reserve(phys_addr_t limit) · 221 unmodified lines
222	if (size_cmdline != -1) {	222	if (size_cmdline != -1) {
223	selected_size = size_cmdline;	223	selected_size = size_cmdline;
224	selected_base = base_cmdline;	224	selected_base = base_cmdline;
225	selected_limit = min_not_zero(limit_cmdline, limit);	225
		226	/* Hornor the user setup dma address limit */
		227	selected_limit = limit_cmdline ?: limit;
		228
226	if (base_cmdline + size_cmdline == limit_cmdline)	229	if (base_cmdline + size_cmdline == limit_cmdline)
227	fixed = true;	230	fixed = true;
228	} else {	231	} else {

kernel/events/core.c+7−7

 static void perf_sigtrap(struct perf_event *event)
 {
 	/*
-	 * We'd expect this to only occur if the irq_work is delayed and either
+	 * Both perf_pending_task() and perf_pending_irq() can race with the
-	 * ctx->task or current has changed in the meantime. This can be the
+	 * task exiting.
-	 * case on architectures that do not implement arch_irq_work_raise().
 	 */
-	if (WARN_ON_ONCE(event->ctx->task != current))
+	if (current->flags & PF_EXITING)
 		return;
 	/*
-	 * Both perf_pending_task() and perf_pending_irq() can race with the
+	 * We'd expect this to only occur if the irq_work is delayed and either
-	 * task exiting.
+	 * ctx->task or current has changed in the meantime. This can be the
+	 * case on architectures that do not implement arch_irq_work_raise().
 	 */
-	if (current->flags & PF_EXITING)
+	if (WARN_ON_ONCE(event->ctx->task != current))
 		return;
 	send_sig_perf((void __user *)event->pending_addr,

kernel/module/main.c+11−6

 		if (infosec >= info->hdr->e_shnum)
 			continue;
-		/* Don't bother with non-allocated sections */
+		/*
-		if (!(info->sechdrs[infosec].sh_flags & SHF_ALLOC))
+		 * Don't bother with non-allocated sections.
+		 * An exception is the percpu section, which has separate allocations
+		 * for individual CPUs. We relocate the percpu section in the initial
+		 * ELF template and subsequently copy it to the per-CPU destinations.
+		 */
+		if (!(info->sechdrs[infosec].sh_flags & SHF_ALLOC) &&
+		    (!infosec || infosec != info->index.pcpu))
 			continue;
 		if (info->sechdrs[i].sh_flags & SHF_RELA_LIVEPATCH)
 static int move_module(struct module *mod, struct load_info *info)
 {
-	int i;
+	int i, ret;
-	enum mod_mem_type t = 0;
+	enum mod_mem_type t = MOD_MEM_NUM_TYPES;
-	int ret = -ENOMEM;
 	bool codetag_section_found = false;
 	for_each_mod_mem_type(type) {
 	return 0;
 out_err:
 	module_memory_restore_rox(mod);
-	for (t--; t >= 0; t--)
+	while (t--)
 		module_memory_free(mod, t);
 	if (codetag_section_found)
 		codetag_free_module_sections(mod);

kernel/sched/core.c+2−7

@@ -3362,10 +3362,6 @@ void set_task_cpu(struct task_struct *p, unsigned int new_cpu) · 3361 unmodified lines
3362	#ifdef CONFIG_NUMA_BALANCING	3362	#ifdef CONFIG_NUMA_BALANCING
3363	static void __migrate_swap_task(struct task_struct *p, int cpu)	3363	static void __migrate_swap_task(struct task_struct *p, int cpu)
3364	{	3364	{
3365	__schedstat_inc(p->stats.numa_task_swapped);
3366	count_vm_numa_event(NUMA_TASK_SWAP);
3367	count_memcg_event_mm(p->mm, NUMA_TASK_SWAP);
3368
3369	if (task_on_rq_queued(p)) {	3365	if (task_on_rq_queued(p)) {
3370	struct rq src_rq, dst_rq;	3366	struct rq src_rq, dst_rq;
3371	struct rq_flags srf, drf;	3367	struct rq_flags srf, drf;
@@ -7939,9 +7935,8 @@ int migrate_task_to(struct task_struct *p, int target_cpu) · 4567 unmodified lines
7939	if (!cpumask_test_cpu(target_cpu, p->cpus_ptr))	7935	if (!cpumask_test_cpu(target_cpu, p->cpus_ptr))
7940	return -EINVAL;	7936	return -EINVAL;
7941		7937
7942	__schedstat_inc(p->stats.numa_task_migrated);	7938	/* TODO: This is not properly updating schedstats */
7943	count_vm_numa_event(NUMA_TASK_MIGRATE);	7939
7944	count_memcg_event_mm(p->mm, NUMA_TASK_MIGRATE);
7945	trace_sched_move_numa(p, curr_cpu, target_cpu);	7940	trace_sched_move_numa(p, curr_cpu, target_cpu);
7946	return stop_one_cpu(curr_cpu, migration_cpu_stop, &arg);	7941	return stop_one_cpu(curr_cpu, migration_cpu_stop, &arg);
7947	}	7942	}

kernel/sched/debug.c+0−4

 		P_SCHEDSTAT(nr_failed_migrations_running);
 		P_SCHEDSTAT(nr_failed_migrations_hot);
 		P_SCHEDSTAT(nr_forced_migrations);
-#ifdef CONFIG_NUMA_BALANCING
-		P_SCHEDSTAT(numa_task_migrated);
-		P_SCHEDSTAT(numa_task_swapped);
-#endif
 		P_SCHEDSTAT(nr_wakeups);
 		P_SCHEDSTAT(nr_wakeups_sync);
 		P_SCHEDSTAT(nr_wakeups_migrate);

lib/alloc_tag.c+3−0

@@ -135,6 +135,9 @@ size_t alloc_tag_top_users(struct codetag_bytes *tags, size_t count, bool can_sl · 134 unmodified lines
135	struct codetag_bytes n;	135	struct codetag_bytes n;
136	unsigned int i, nr = 0;	136	unsigned int i, nr = 0;
137		137
		138	if (IS_ERR_OR_NULL(alloc_tag_cttype))
		139	return 0;
		140
138	if (can_sleep)	141	if (can_sleep)
139	codetag_lock_module_list(alloc_tag_cttype, true);	142	codetag_lock_module_list(alloc_tag_cttype, true);
140	else if (!codetag_trylock_module_list(alloc_tag_cttype))	143	else if (!codetag_trylock_module_list(alloc_tag_cttype))

lib/maple_tree.c+1−0

@@ -5319,6 +5319,7 @@ static void mt_destroy_walk(struct maple_enode enode, struct maple_tree mt, · 5318 unmodified lines
5319	struct maple_enode *start;	5319	struct maple_enode *start;
5320		5320
5321	if (mte_is_leaf(enode)) {	5321	if (mte_is_leaf(enode)) {
		5322	mte_set_node_dead(enode);
5322	node->type = mte_node_type(enode);	5323	node->type = mte_node_type(enode);
5323	goto free_leaf;	5324	goto free_leaf;
5324	}	5325	}

mm/damon/core.c+4−4

 		}
 	}
 	target_access_events = max_access_events * goal_bp / 10000;
+	target_access_events = target_access_events ? : 1;
 	return access_events * 10000 / target_access_events;
 }
  *
  * If there is a &struct damon_call_control request that registered via
  * &damon_call() on @ctx, do or cancel the invocation of the function depending
- * on @cancel.  @cancel is set when the kdamond is deactivated by DAMOS
+ * on @cancel.  @cancel is set when the kdamond is already out of the main loop
- * watermarks, or the kdamond is already out of the main loop and therefore
+ * and therefore will be terminated.
- * will be terminated.
  */
 static void kdamond_call(struct damon_ctx *ctx, bool cancel)
 {
 		if (ctx->callback.after_wmarks_check &&
 				ctx->callback.after_wmarks_check(ctx))
 			break;
-		kdamond_call(ctx, true);
+		kdamond_call(ctx, false);
 		damos_walk_cancel(ctx);
 	}
 	return -EBUSY;

mm/hugetlb.c+6−3

 	struct folio *folio;
 	spin_lock_irq(&hugetlb_lock);
+	if (!h->resv_huge_pages) {
+		spin_unlock_irq(&hugetlb_lock);
+		return NULL;
+	}
 	folio = dequeue_hugetlb_folio_nodemask(h, gfp_mask, preferred_nid,
 					       nmask);
-	if (folio) {
+	if (folio)
-		VM_BUG_ON(!h->resv_huge_pages);
 		h->resv_huge_pages--;
-	}
 	spin_unlock_irq(&hugetlb_lock);
 	return folio;

mm/kasan/report.c+2−43

@@ -370,36 +370,6 @@ static inline bool init_task_stack_addr(const void *addr) · 369 unmodified lines
370	sizeof(init_thread_union.stack));	370	sizeof(init_thread_union.stack));
371	}	371	}
372		372
373	/*
374	* This function is invoked with report_lock (a raw_spinlock) held. A
375	* PREEMPT_RT kernel cannot call find_vm_area() as it will acquire a sleeping
376	* rt_spinlock.
377	*
378	* For !RT kernel, the PROVE_RAW_LOCK_NESTING config option will print a
379	* lockdep warning for this raw_spinlock -> spinlock dependency. This config
380	* option is enabled by default to ensure better test coverage to expose this
381	* kind of RT kernel problem. This lockdep splat, however, can be suppressed
382	* by using DEFINE_WAIT_OVERRIDE_MAP() if it serves a useful purpose and the
383	* invalid PREEMPT_RT case has been taken care of.
384	*/
385	static inline struct vm_struct kasan_find_vm_area(void addr)
386	{
387	static DEFINE_WAIT_OVERRIDE_MAP(vmalloc_map, LD_WAIT_SLEEP);
388	struct vm_struct *va;
389
390	if (IS_ENABLED(CONFIG_PREEMPT_RT))
391	return NULL;
392
393	/*
394	* Suppress lockdep warning and fetch vmalloc area of the
395	* offending address.
396	*/
397	lock_map_acquire_try(&vmalloc_map);
398	va = find_vm_area(addr);
399	lock_map_release(&vmalloc_map);
400	return va;
401	}
402
403	static void print_address_description(void *addr, u8 tag,	373	static void print_address_description(void *addr, u8 tag,
404	struct kasan_report_info *info)	374	struct kasan_report_info *info)
405	{	375	{
@@ -429,19 +399,8 @@ static void print_address_description(void *addr, u8 tag, · 23 unmodified lines
429	}	399	}
430		400
431	if (is_vmalloc_addr(addr)) {	401	if (is_vmalloc_addr(addr)) {
432	struct vm_struct *va = kasan_find_vm_area(addr);	402	pr_err("The buggy address %px belongs to a vmalloc virtual mapping\n", addr);
433		403	page = vmalloc_to_page(addr);
434	if (va) {
435	pr_err("The buggy address belongs to the virtual mapping at\n"
436	" [%px, %px) created by:\n"
437	" %pS\n",
438	va->addr, va->addr + va->size, va->caller);
439	pr_err("\n");
440
441	page = vmalloc_to_page(addr);
442	} else {
443	pr_err("The buggy address %px belongs to a vmalloc virtual mapping\n", addr);
444	}
445	}	404	}
446		405
447	if (page) {	406	if (page) {

mm/memcontrol.c+0−2

@@ -474,8 +474,6 @@ static const unsigned int memcg_vm_event_stat[] = { · 473 unmodified lines
474	NUMA_PAGE_MIGRATE,	474	NUMA_PAGE_MIGRATE,
475	NUMA_PTE_UPDATES,	475	NUMA_PTE_UPDATES,
476	NUMA_HINT_FAULTS,	476	NUMA_HINT_FAULTS,
477	NUMA_TASK_MIGRATE,
478	NUMA_TASK_SWAP,
479	#endif	477	#endif
480	};	478	};
481		479

mm/migrate.c+8−6

 static int get_compat_pages_array(const void __user *chunk_pages[],
 				  const void __user * __user *pages,
+				  unsigned long chunk_offset,
 				  unsigned long chunk_nr)
 {
 	compat_uptr_t __user *pages32 = (compat_uptr_t __user *)pages;
 	int i;
 	for (i = 0; i < chunk_nr; i++) {
-		if (get_user(p, pages32 + i))
+		if (get_user(p, pages32 + chunk_offset + i))
 			return -EFAULT;
 		chunk_pages[i] = compat_ptr(p);
 	}
 #define DO_PAGES_STAT_CHUNK_NR 16UL
 	const void __user *chunk_pages[DO_PAGES_STAT_CHUNK_NR];
 	int chunk_status[DO_PAGES_STAT_CHUNK_NR];
+	unsigned long chunk_offset = 0;
 	while (nr_pages) {
 		unsigned long chunk_nr = min(nr_pages, DO_PAGES_STAT_CHUNK_NR);
 		if (in_compat_syscall()) {
 			if (get_compat_pages_array(chunk_pages, pages,
-						   chunk_nr))
+						   chunk_offset, chunk_nr))
 				break;
 		} else {
-			if (copy_from_user(chunk_pages, pages,
+			if (copy_from_user(chunk_pages, pages + chunk_offset,
 				      chunk_nr * sizeof(*chunk_pages)))
 				break;
 		}
 		do_pages_stat_array(mm, chunk_nr, chunk_pages, chunk_status);
-		if (copy_to_user(status, chunk_status, chunk_nr * sizeof(*status)))
+		if (copy_to_user(status + chunk_offset, chunk_status,
+				 chunk_nr * sizeof(*status)))
 			break;
-		pages += chunk_nr;
+		chunk_offset += chunk_nr;
-		status += chunk_nr;
 		nr_pages -= chunk_nr;
 	}
 	return nr_pages ? -EFAULT : 0;

mm/rmap.c+28−18

@@ -1845,23 +1845,32 @@ void folio_remove_rmap_pud(struct folio folio, struct page page, · 1844 unmodified lines
1845	#endif	1845	#endif
1846	}	1846	}
1847		1847
1848	/* We support batch unmapping of PTEs for lazyfree large folios */	1848	static inline unsigned int folio_unmap_pte_batch(struct folio *folio,
1849	static inline bool can_batch_unmap_folio_ptes(unsigned long addr,	1849	struct page_vma_mapped_walk *pvmw,
1850	struct folio folio, pte_t ptep)	1850	enum ttu_flags flags, pte_t pte)
1851	{	1851	{
1852	const fpb_t fpb_flags = FPB_IGNORE_DIRTY \| FPB_IGNORE_SOFT_DIRTY;	1852	const fpb_t fpb_flags = FPB_IGNORE_DIRTY \| FPB_IGNORE_SOFT_DIRTY;
1853	int max_nr = folio_nr_pages(folio);	1853	unsigned long end_addr, addr = pvmw->address;
1854	pte_t pte = ptep_get(ptep);	1854	struct vm_area_struct *vma = pvmw->vma;
		1855	unsigned int max_nr;
		1856
		1857	if (flags & TTU_HWPOISON)
		1858	return 1;
		1859	if (!folio_test_large(folio))
		1860	return 1;
1855		1861
		1862	/* We may only batch within a single VMA and a single page table. */
		1863	end_addr = pmd_addr_end(addr, vma->vm_end);
		1864	max_nr = (end_addr - addr) >> PAGE_SHIFT;
		1865
		1866	/* We only support lazyfree batching for now ... */
1856	if (!folio_test_anon(folio) \|\| folio_test_swapbacked(folio))	1867	if (!folio_test_anon(folio) \|\| folio_test_swapbacked(folio))
1857	return false;	1868	return 1;
1858	if (pte_unused(pte))	1869	if (pte_unused(pte))
1859	return false;	1870	return 1;
1860	if (pte_pfn(pte) != folio_pfn(folio))
1861	return false;
1862		1871
1863	return folio_pte_batch(folio, addr, ptep, pte, max_nr, fpb_flags, NULL,	1872	return folio_pte_batch(folio, addr, pvmw->pte, pte, max_nr, fpb_flags,
1864	NULL, NULL) == max_nr;	1873	NULL, NULL, NULL);
1865	}	1874	}
1866		1875
1867	/*	1876	/*
@@ -2024,9 +2033,7 @@ static bool try_to_unmap_one(struct folio folio, struct vm_area_struct vma, · 156 unmodified lines
2024	if (pte_dirty(pteval))	2033	if (pte_dirty(pteval))
2025	folio_mark_dirty(folio);	2034	folio_mark_dirty(folio);
2026	} else if (likely(pte_present(pteval))) {	2035	} else if (likely(pte_present(pteval))) {
2027	if (folio_test_large(folio) && !(flags & TTU_HWPOISON) &&	2036	nr_pages = folio_unmap_pte_batch(folio, &pvmw, flags, pteval);
2028	can_batch_unmap_folio_ptes(address, folio, pvmw.pte))
2029	nr_pages = folio_nr_pages(folio);
2030	end_addr = address + nr_pages * PAGE_SIZE;	2037	end_addr = address + nr_pages * PAGE_SIZE;
2031	flush_cache_range(vma, address, end_addr);	2038	flush_cache_range(vma, address, end_addr);
2032		2039
@@ -2206,13 +2213,16 @@ discard: · 173 unmodified lines
2206	hugetlb_remove_rmap(folio);	2213	hugetlb_remove_rmap(folio);
2207	} else {	2214	} else {
2208	folio_remove_rmap_ptes(folio, subpage, nr_pages, vma);	2215	folio_remove_rmap_ptes(folio, subpage, nr_pages, vma);
2209	folio_ref_sub(folio, nr_pages - 1);
2210	}	2216	}
2211	if (vma->vm_flags & VM_LOCKED)	2217	if (vma->vm_flags & VM_LOCKED)
2212	mlock_drain_local();	2218	mlock_drain_local();
2213	folio_put(folio);	2219	folio_put_refs(folio, nr_pages);
2214	/* We have already batched the entire folio */	2220
2215	if (nr_pages > 1)	2221	/*
		2222	* If we are sure that we batched the entire folio and cleared
		2223	* all PTEs, we can just optimize and stop right here.
		2224	*/
		2225	if (nr_pages == folio_nr_pages(folio))
2216	goto walk_done;	2226	goto walk_done;
2217	continue;	2227	continue;
2218	walk_abort:	2228	walk_abort:

mm/vmalloc.c+15−7

@@ -514,6 +514,7 @@ static int vmap_pages_pte_range(pmd_t *pmd, unsigned long addr, · 513 unmodified lines
514	unsigned long end, pgprot_t prot, struct page *pages, int nr,	514	unsigned long end, pgprot_t prot, struct page *pages, int nr,
515	pgtbl_mod_mask *mask)	515	pgtbl_mod_mask *mask)
516	{	516	{
		517	int err = 0;
517	pte_t *pte;	518	pte_t *pte;
518		519
519	/*	520	/*
@@ -530,12 +531,18 @@ static int vmap_pages_pte_range(pmd_t *pmd, unsigned long addr, · 10 unmodified lines
530	do {	531	do {
531	struct page page = pages[nr];	532	struct page page = pages[nr];
532		533
533	if (WARN_ON(!pte_none(ptep_get(pte))))	534	if (WARN_ON(!pte_none(ptep_get(pte)))) {
534	return -EBUSY;	535	err = -EBUSY;
535	if (WARN_ON(!page))	536	break;
536	return -ENOMEM;	537	}
537	if (WARN_ON(!pfn_valid(page_to_pfn(page))))	538	if (WARN_ON(!page)) {
538	return -EINVAL;	539	err = -ENOMEM;
		540	break;
		541	}
		542	if (WARN_ON(!pfn_valid(page_to_pfn(page)))) {
		543	err = -EINVAL;
		544	break;
		545	}
539		546
540	set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));	547	set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
541	(*nr)++;	548	(*nr)++;
@@ -543,7 +550,8 @@ static int vmap_pages_pte_range(pmd_t *pmd, unsigned long addr, · 1 unmodified line
543		550
544	arch_leave_lazy_mmu_mode();	551	arch_leave_lazy_mmu_mode();
545	*mask \|= PGTBL_PTE_MODIFIED;	552	*mask \|= PGTBL_PTE_MODIFIED;
546	return 0;	553
		554	return err;
547	}	555	}
548		556
549	static int vmap_pages_pmd_range(pud_t *pud, unsigned long addr,	557	static int vmap_pages_pmd_range(pud_t *pud, unsigned long addr,

mm/vmstat.c+0−2

 	"numa_hint_faults",
 	"numa_hint_faults_local",
 	"numa_pages_migrated",
-	"numa_task_migrated",
-	"numa_task_swapped",
 #endif
 #ifdef CONFIG_MIGRATION
 	"pgmigrate_success",

net/appletalk/ddp.c+1−0

@@ -576,6 +576,7 @@ static int atrtr_create(struct rtentry r, struct net_device devhint) · 575 unmodified lines
576		576
577	/* Fill in the routing entry */	577	/* Fill in the routing entry */
578	rt->target = ta->sat_addr;	578	rt->target = ta->sat_addr;
		579	dev_put(rt->dev); /* Release old device */
579	dev_hold(devhint);	580	dev_hold(devhint);
580	rt->dev = devhint;	581	rt->dev = devhint;
581	rt->flags = r->rt_flags;	582	rt->flags = r->rt_flags;

net/atm/clip.c+48−16

@@ -45,7 +45,8 @@ · 44 unmodified lines
45	#include <net/atmclip.h>	45	#include <net/atmclip.h>
46		46
47	static struct net_device *clip_devs;	47	static struct net_device *clip_devs;
48	static struct atm_vcc *atmarpd;	48	static struct atm_vcc __rcu *atmarpd;
		49	static DEFINE_MUTEX(atmarpd_lock);
49	static struct timer_list idle_timer;	50	static struct timer_list idle_timer;
50	static const struct neigh_ops clip_neigh_ops;	51	static const struct neigh_ops clip_neigh_ops;
51		52
@@ -53,24 +54,35 @@ static int to_atmarpd(enum atmarp_ctrl_type type, int itf, __be32 ip) · 1 unmodified line
53	{	54	{
54	struct sock *sk;	55	struct sock *sk;
55	struct atmarp_ctrl *ctrl;	56	struct atmarp_ctrl *ctrl;
		57	struct atm_vcc *vcc;
56	struct sk_buff *skb;	58	struct sk_buff *skb;
		59	int err = 0;
57		60
58	pr_debug("(%d)\n", type);	61	pr_debug("(%d)\n", type);
59	if (!atmarpd)	62
60	return -EUNATCH;	63	rcu_read_lock();
		64	vcc = rcu_dereference(atmarpd);
		65	if (!vcc) {
		66	err = -EUNATCH;
		67	goto unlock;
		68	}
61	skb = alloc_skb(sizeof(struct atmarp_ctrl), GFP_ATOMIC);	69	skb = alloc_skb(sizeof(struct atmarp_ctrl), GFP_ATOMIC);
62	if (!skb)	70	if (!skb) {
63	return -ENOMEM;	71	err = -ENOMEM;
		72	goto unlock;
		73	}
64	ctrl = skb_put(skb, sizeof(struct atmarp_ctrl));	74	ctrl = skb_put(skb, sizeof(struct atmarp_ctrl));
65	ctrl->type = type;	75	ctrl->type = type;
66	ctrl->itf_num = itf;	76	ctrl->itf_num = itf;
67	ctrl->ip = ip;	77	ctrl->ip = ip;
68	atm_force_charge(atmarpd, skb->truesize);	78	atm_force_charge(vcc, skb->truesize);
69		79
70	sk = sk_atm(atmarpd);	80	sk = sk_atm(vcc);
71	skb_queue_tail(&sk->sk_receive_queue, skb);	81	skb_queue_tail(&sk->sk_receive_queue, skb);
72	sk->sk_data_ready(sk);	82	sk->sk_data_ready(sk);
73	return 0;	83	unlock:
		84	rcu_read_unlock();
		85	return err;
74	}	86	}
75		87
76	static void link_vcc(struct clip_vcc clip_vcc, struct atmarp_entry entry)	88	static void link_vcc(struct clip_vcc clip_vcc, struct atmarp_entry entry)
@@ -417,6 +429,8 @@ static int clip_mkip(struct atm_vcc *vcc, int timeout) · 340 unmodified lines
417		429
418	if (!vcc->push)	430	if (!vcc->push)
419	return -EBADFD;	431	return -EBADFD;
		432	if (vcc->user_back)
		433	return -EINVAL;
420	clip_vcc = kmalloc(sizeof(struct clip_vcc), GFP_KERNEL);	434	clip_vcc = kmalloc(sizeof(struct clip_vcc), GFP_KERNEL);
421	if (!clip_vcc)	435	if (!clip_vcc)
422	return -ENOMEM;	436	return -ENOMEM;
@@ -607,17 +621,27 @@ static void atmarpd_close(struct atm_vcc *vcc) · 184 unmodified lines
607	{	621	{
608	pr_debug("\n");	622	pr_debug("\n");
609		623
610	rtnl_lock();	624	mutex_lock(&atmarpd_lock);
611	atmarpd = NULL;	625	RCU_INIT_POINTER(atmarpd, NULL);
		626	mutex_unlock(&atmarpd_lock);
		627
		628	synchronize_rcu();
612	skb_queue_purge(&sk_atm(vcc)->sk_receive_queue);	629	skb_queue_purge(&sk_atm(vcc)->sk_receive_queue);
613	rtnl_unlock();
614		630
615	pr_debug("(done)\n");	631	pr_debug("(done)\n");
616	module_put(THIS_MODULE);	632	module_put(THIS_MODULE);
617	}	633	}
618		634
		635	static int atmarpd_send(struct atm_vcc vcc, struct sk_buff skb)
		636	{
		637	atm_return_tx(vcc, skb);
		638	dev_kfree_skb_any(skb);
		639	return 0;
		640	}
		641
619	static const struct atmdev_ops atmarpd_dev_ops = {	642	static const struct atmdev_ops atmarpd_dev_ops = {
620	.close = atmarpd_close	643	.close = atmarpd_close,
		644	.send = atmarpd_send
621	};	645	};
622		646
623		647
@@ -631,15 +655,18 @@ static struct atm_dev atmarpd_dev = { · 7 unmodified lines
631		655
632	static int atm_init_atmarp(struct atm_vcc *vcc)	656	static int atm_init_atmarp(struct atm_vcc *vcc)
633	{	657	{
634	rtnl_lock();	658	if (vcc->push == clip_push)
		659	return -EINVAL;
		660
		661	mutex_lock(&atmarpd_lock);
635	if (atmarpd) {	662	if (atmarpd) {
636	rtnl_unlock();	663	mutex_unlock(&atmarpd_lock);
637	return -EADDRINUSE;	664	return -EADDRINUSE;
638	}	665	}
639		666
640	mod_timer(&idle_timer, jiffies + CLIP_CHECK_INTERVAL * HZ);	667	mod_timer(&idle_timer, jiffies + CLIP_CHECK_INTERVAL * HZ);
641		668
642	atmarpd = vcc;	669	rcu_assign_pointer(atmarpd, vcc);
643	set_bit(ATM_VF_META, &vcc->flags);	670	set_bit(ATM_VF_META, &vcc->flags);
644	set_bit(ATM_VF_READY, &vcc->flags);	671	set_bit(ATM_VF_READY, &vcc->flags);
645	/* allow replies and avoid getting closed if signaling dies */	672	/* allow replies and avoid getting closed if signaling dies */
@@ -648,13 +675,14 @@ static int atm_init_atmarp(struct atm_vcc *vcc) · 2 unmodified lines
648	vcc->push = NULL;	675	vcc->push = NULL;
649	vcc->pop = NULL; /* crash */	676	vcc->pop = NULL; /* crash */
650	vcc->push_oam = NULL; /* crash */	677	vcc->push_oam = NULL; /* crash */
651	rtnl_unlock();	678	mutex_unlock(&atmarpd_lock);
652	return 0;	679	return 0;
653	}	680	}
654		681
655	static int clip_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)	682	static int clip_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
656	{	683	{
657	struct atm_vcc *vcc = ATM_SD(sock);	684	struct atm_vcc *vcc = ATM_SD(sock);
		685	struct sock *sk = sock->sk;
658	int err = 0;	686	int err = 0;
659		687
660	switch (cmd) {	688	switch (cmd) {
@@ -675,14 +703,18 @@ static int clip_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) · 14 unmodified lines
675	err = clip_create(arg);	703	err = clip_create(arg);
676	break;	704	break;
677	case ATMARPD_CTRL:	705	case ATMARPD_CTRL:
		706	lock_sock(sk);
678	err = atm_init_atmarp(vcc);	707	err = atm_init_atmarp(vcc);
679	if (!err) {	708	if (!err) {
680	sock->state = SS_CONNECTED;	709	sock->state = SS_CONNECTED;
681	__module_get(THIS_MODULE);	710	__module_get(THIS_MODULE);
682	}	711	}
		712	release_sock(sk);
683	break;	713	break;
684	case ATMARP_MKIP:	714	case ATMARP_MKIP:
		715	lock_sock(sk);
685	err = clip_mkip(vcc, arg);	716	err = clip_mkip(vcc, arg);
		717	release_sock(sk);
686	break;	718	break;
687	case ATMARP_SETENTRY:	719	case ATMARP_SETENTRY:
688	err = clip_setentry(vcc, (__force __be32)arg);	720	err = clip_setentry(vcc, (__force __be32)arg);

net/bluetooth/hci_event.c+3−0

 		bis->iso_qos.bcast.in.sdu = le16_to_cpu(ev->max_pdu);
 		if (!ev->status) {
+			bis->state = BT_CONNECTED;
 			set_bit(HCI_CONN_BIG_SYNC, &bis->flags);
+			hci_debugfs_create_conn(bis);
+			hci_conn_add_sysfs(bis);
 			hci_iso_setup_path(bis);
 		}
 	}

net/bluetooth/hci_sync.c+2−2

@@ -1345,7 +1345,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) · 1344 unmodified lines
1345	* Command Disallowed error, so we must first disable the	1345	* Command Disallowed error, so we must first disable the
1346	* instance if it is active.	1346	* instance if it is active.
1347	*/	1347	*/
1348	if (adv && !adv->pending) {	1348	if (adv) {
1349	err = hci_disable_ext_adv_instance_sync(hdev, instance);	1349	err = hci_disable_ext_adv_instance_sync(hdev, instance);
1350	if (err)	1350	if (err)
1351	return err;	1351	return err;
@@ -5493,7 +5493,7 @@ static int hci_disconnect_sync(struct hci_dev hdev, struct hci_conn conn, · 4141 unmodified lines
5493	{	5493	{
5494	struct hci_cp_disconnect cp;	5494	struct hci_cp_disconnect cp;
5495		5495
5496	if (test_bit(HCI_CONN_BIG_CREATED, &conn->flags)) {	5496	if (conn->type == BIS_LINK) {
5497	/* This is a BIS connection, hci_conn_del will	5497	/* This is a BIS connection, hci_conn_del will
5498	* do the necessary cleanup.	5498	* do the necessary cleanup.
5499	*/	5499	*/

net/ipv4/tcp.c+1−1

@@ -1176,7 +1176,7 @@ restart: · 1175 unmodified lines
1176	goto do_error;	1176	goto do_error;
1177		1177
1178	while (msg_data_left(msg)) {	1178	while (msg_data_left(msg)) {
1179	ssize_t copy = 0;	1179	int copy = 0;
1180		1180
1181	skb = tcp_write_queue_tail(sk);	1181	skb = tcp_write_queue_tail(sk);
1182	if (skb)	1182	if (skb)

net/ipv4/tcp_input.c+3−1

 		skb_condense(skb);
 		skb_set_owner_r(skb, sk);
 	}
-	tcp_rcvbuf_grow(sk);
+	/* do not grow rcvbuf for not-yet-accepted or orphaned sockets. */
+	if (sk->sk_socket)
+		tcp_rcvbuf_grow(sk);
 }
 static int __must_check tcp_queue_rcv(struct sock *sk, struct sk_buff *skb,

net/ipv6/addrconf.c+2−7

 	ASSERT_RTNL();
-	idev = ipv6_find_idev(dev);
+	idev = addrconf_add_dev(dev);
-	if (IS_ERR(idev)) {
+	if (IS_ERR(idev))
-		pr_debug("%s: add_dev failed\n", __func__);
 		return;
-	}
 	/* Generate the IPv6 link-local address using addrconf_addr_gen(),
 	 * unless we have an IPv4 GRE device not bound to an IP address and
 	}
 	add_v4_addrs(idev);
-	if (dev->flags & IFF_POINTOPOINT)
-		addrconf_add_mroute(dev);
 }
 #endif

net/mac80211/cfg.c+14−0

@@ -1959,6 +1959,20 @@ static int sta_link_apply_parameters(struct ieee80211_local *local, · 1958 unmodified lines
1959	ieee80211_sta_init_nss(link_sta);	1959	ieee80211_sta_init_nss(link_sta);
1960		1960
1961	if (params->opmode_notif_used) {	1961	if (params->opmode_notif_used) {
		1962	enum nl80211_chan_width width = link->conf->chanreq.oper.width;
		1963
		1964	switch (width) {
		1965	case NL80211_CHAN_WIDTH_20:
		1966	case NL80211_CHAN_WIDTH_40:
		1967	case NL80211_CHAN_WIDTH_80:
		1968	case NL80211_CHAN_WIDTH_160:
		1969	case NL80211_CHAN_WIDTH_80P80:
		1970	case NL80211_CHAN_WIDTH_320: /* not VHT, allowed for HE/EHT */
		1971	break;
		1972	default:
		1973	return -EINVAL;
		1974	}
		1975
1962	/* returned value is only needed for rc update, but the	1976	/* returned value is only needed for rc update, but the
1963	* rc isn't initialized here yet, so ignore it	1977	* rc isn't initialized here yet, so ignore it
1964	*/	1978	*/

net/mac80211/iface.c+2−2

 {
 	sdata->local = local;
+	INIT_LIST_HEAD(&sdata->key_list);
 	/*
 	 * Initialize the default link, so we can use link_id 0 for non-MLD,
 	 * and that continues to work for non-MLD-aware drivers that use just
 	ieee80211_init_frag_cache(&sdata->frags);
-	INIT_LIST_HEAD(&sdata->key_list);
 	wiphy_delayed_work_init(&sdata->dec_tailroom_needed_wk,
 				ieee80211_delayed_tailroom_dec);

net/mac80211/mlme.c+9−3

 	lockdep_assert_wiphy(local->hw.wiphy);
+	if (frame_buf)
+		memset(frame_buf, 0, IEEE80211_DEAUTH_FRAME_LEN);
 	if (WARN_ON(!ap_sta))
 		return;
 	struct ieee80211_bss_conf *bss_conf = link->conf;
 	struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
 	struct ieee80211_mgmt *mgmt = (void *) hdr;
+	struct ieee80211_ext *ext = NULL;
 	size_t baselen;
 	struct ieee802_11_elems *elems;
 	struct ieee80211_local *local = sdata->local;
 	/* Process beacon from the current BSS */
 	bssid = ieee80211_get_bssid(hdr, len, sdata->vif.type);
 	if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
-		struct ieee80211_ext *ext = (void *) mgmt;
+		ext = (void *)mgmt;
 		variable = ext->u.s1g_beacon.variable +
 			   ieee80211_s1g_optional_len(ext->frame_control);
 	}
 	}
 	if ((ncrc == link->u.mgd.beacon_crc && link->u.mgd.beacon_crc_valid) ||
-	    ieee80211_is_s1g_short_beacon(mgmt->frame_control))
+	    (ext && ieee80211_is_s1g_short_beacon(ext->frame_control,
+						  parse_params.start,
+						  parse_params.len)))
 		goto free;
 	link->u.mgd.beacon_crc = ncrc;
 	link->u.mgd.beacon_crc_valid = true;
 	 */
 	for_each_mle_subelement(sub, (const u8 *)elems->ml_epcs,
 				elems->ml_epcs_len) {
+		struct ieee802_11_elems *link_elems __free(kfree) = NULL;
 		struct ieee80211_link_data *link;
-		struct ieee802_11_elems *link_elems __free(kfree);
 		u8 *pos = (void *)sub->data;
 		u16 control;
 		ssize_t len;

net/mac80211/parse.c+2−4

 {
 	const struct element *elem, *sub;
 	size_t profile_len = 0;
-	bool found = false;
 	if (!bss || !bss->transmitted_bss)
 		return profile_len;
 					       index[2],
 					       new_bssid);
 			if (ether_addr_equal(new_bssid, bss->bssid)) {
-				found = true;
 				elems->bssid_index_len = index[1];
 				elems->bssid_index = (void *)&index[2];
-				break;
+				return profile_len;
 			}
 		}
 	}
-	return found ? profile_len : 0;
+	return 0;
 }
 static void

net/mac80211/util.c+4−5

 		cfg80211_sched_scan_stopped_locked(local->hw.wiphy, 0);
  wake_up:
-	if (local->virt_monitors > 0 &&
-	    local->virt_monitors == local->open_count)
-		ieee80211_add_virtual_monitor(local);
 	/*
 	 * Clear the WLAN_STA_BLOCK_BA flag so new aggregation
 	 * sessions can be established after a resume.
 		}
 	}
+	if (local->virt_monitors > 0 &&
+	    local->virt_monitors == local->open_count)
+		ieee80211_add_virtual_monitor(local);
 	if (!suspended)
 		return 0;

net/netlink/af_netlink.c+50−32

@@ -387,7 +387,6 @@ static void netlink_skb_set_owner_r(struct sk_buff skb, struct sock sk) · 386 unmodified lines
387	WARN_ON(skb->sk != NULL);	387	WARN_ON(skb->sk != NULL);
388	skb->sk = sk;	388	skb->sk = sk;
389	skb->destructor = netlink_skb_destructor;	389	skb->destructor = netlink_skb_destructor;
390	atomic_add(skb->truesize, &sk->sk_rmem_alloc);
391	sk_mem_charge(sk, skb->truesize);	390	sk_mem_charge(sk, skb->truesize);
392	}	391	}
393		392
@@ -1212,41 +1211,48 @@ struct sk_buff *netlink_alloc_large_skb(unsigned int size, int broadcast) · 818 unmodified lines
1212	int netlink_attachskb(struct sock sk, struct sk_buff skb,	1211	int netlink_attachskb(struct sock sk, struct sk_buff skb,
1213	long timeo, struct sock ssk)	1212	long timeo, struct sock ssk)
1214	{	1213	{
		1214	DECLARE_WAITQUEUE(wait, current);
1215	struct netlink_sock *nlk;	1215	struct netlink_sock *nlk;
		1216	unsigned int rmem;
1216		1217
1217	nlk = nlk_sk(sk);	1218	nlk = nlk_sk(sk);
		1219	rmem = atomic_add_return(skb->truesize, &sk->sk_rmem_alloc);
1218		1220
1219	if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf \|\|	1221	if ((rmem == skb->truesize \|\| rmem < READ_ONCE(sk->sk_rcvbuf)) &&
1220	test_bit(NETLINK_S_CONGESTED, &nlk->state))) {	1222	!test_bit(NETLINK_S_CONGESTED, &nlk->state)) {
1221	DECLARE_WAITQUEUE(wait, current);	1223	netlink_skb_set_owner_r(skb, sk);
1222	if (!*timeo) {	1224	return 0;
1223	if (!ssk \|\| netlink_is_kernel(ssk))	1225	}
1224	netlink_overrun(sk);
1225	sock_put(sk);
1226	kfree_skb(skb);
1227	return -EAGAIN;
1228	}
1229
1230	__set_current_state(TASK_INTERRUPTIBLE);
1231	add_wait_queue(&nlk->wait, &wait);
1232		1226
1233	if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf \|\|	1227	atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
1234	test_bit(NETLINK_S_CONGESTED, &nlk->state)) &&
1235	!sock_flag(sk, SOCK_DEAD))
1236	timeo = schedule_timeout(timeo);
1237		1228
1238	__set_current_state(TASK_RUNNING);	1229	if (!*timeo) {
1239	remove_wait_queue(&nlk->wait, &wait);	1230	if (!ssk \|\| netlink_is_kernel(ssk))
		1231	netlink_overrun(sk);
1240	sock_put(sk);	1232	sock_put(sk);
		1233	kfree_skb(skb);
		1234	return -EAGAIN;
		1235	}
1241		1236
1242	if (signal_pending(current)) {	1237	__set_current_state(TASK_INTERRUPTIBLE);
1243	kfree_skb(skb);	1238	add_wait_queue(&nlk->wait, &wait);
1244	return sock_intr_errno(*timeo);	1239	rmem = atomic_read(&sk->sk_rmem_alloc);
1245	}	1240
1246	return 1;	1241	if (((rmem && rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf)) \|\|
		1242	test_bit(NETLINK_S_CONGESTED, &nlk->state)) &&
		1243	!sock_flag(sk, SOCK_DEAD))
		1244	timeo = schedule_timeout(timeo);
		1245
		1246	__set_current_state(TASK_RUNNING);
		1247	remove_wait_queue(&nlk->wait, &wait);
		1248	sock_put(sk);
		1249
		1250	if (signal_pending(current)) {
		1251	kfree_skb(skb);
		1252	return sock_intr_errno(*timeo);
1247	}	1253	}
1248	netlink_skb_set_owner_r(skb, sk);	1254
1249	return 0;	1255	return 1;
1250	}	1256	}
1251		1257
1252	static int __netlink_sendskb(struct sock sk, struct sk_buff skb)	1258	static int __netlink_sendskb(struct sock sk, struct sk_buff skb)
@@ -1307,6 +1313,7 @@ static int netlink_unicast_kernel(struct sock sk, struct sk_buff skb, · 54 unmodified lines
1307	ret = -ECONNREFUSED;	1313	ret = -ECONNREFUSED;
1308	if (nlk->netlink_rcv != NULL) {	1314	if (nlk->netlink_rcv != NULL) {
1309	ret = skb->len;	1315	ret = skb->len;
		1316	atomic_add(skb->truesize, &sk->sk_rmem_alloc);
1310	netlink_skb_set_owner_r(skb, sk);	1317	netlink_skb_set_owner_r(skb, sk);
1311	NETLINK_CB(skb).sk = ssk;	1318	NETLINK_CB(skb).sk = ssk;
1312	netlink_deliver_tap_kernel(sk, ssk, skb);	1319	netlink_deliver_tap_kernel(sk, ssk, skb);
@@ -1383,13 +1390,19 @@ EXPORT_SYMBOL_GPL(netlink_strict_get_check); · 70 unmodified lines
1383	static int netlink_broadcast_deliver(struct sock sk, struct sk_buff skb)	1390	static int netlink_broadcast_deliver(struct sock sk, struct sk_buff skb)
1384	{	1391	{
1385	struct netlink_sock *nlk = nlk_sk(sk);	1392	struct netlink_sock *nlk = nlk_sk(sk);
		1393	unsigned int rmem, rcvbuf;
1386		1394
1387	if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&	1395	rmem = atomic_add_return(skb->truesize, &sk->sk_rmem_alloc);
		1396	rcvbuf = READ_ONCE(sk->sk_rcvbuf);
		1397
		1398	if ((rmem == skb->truesize \|\| rmem <= rcvbuf) &&
1388	!test_bit(NETLINK_S_CONGESTED, &nlk->state)) {	1399	!test_bit(NETLINK_S_CONGESTED, &nlk->state)) {
1389	netlink_skb_set_owner_r(skb, sk);	1400	netlink_skb_set_owner_r(skb, sk);
1390	__netlink_sendskb(sk, skb);	1401	__netlink_sendskb(sk, skb);
1391	return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1);	1402	return rmem > (rcvbuf >> 1);
1392	}	1403	}
		1404
		1405	atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
1393	return -1;	1406	return -1;
1394	}	1407	}
1395		1408
@@ -2245,6 +2258,7 @@ static int netlink_dump(struct sock *sk, bool lock_taken) · 849 unmodified lines
2245	struct netlink_ext_ack extack = {};	2258	struct netlink_ext_ack extack = {};
2246	struct netlink_callback *cb;	2259	struct netlink_callback *cb;
2247	struct sk_buff *skb = NULL;	2260	struct sk_buff *skb = NULL;
		2261	unsigned int rmem, rcvbuf;
2248	size_t max_recvmsg_len;	2262	size_t max_recvmsg_len;
2249	struct module *module;	2263	struct module *module;
2250	int err = -ENOBUFS;	2264	int err = -ENOBUFS;
@@ -2258,9 +2272,6 @@ static int netlink_dump(struct sock *sk, bool lock_taken) · 7 unmodified lines
2258	goto errout_skb;	2272	goto errout_skb;
2259	}	2273	}
2260		2274
2261	if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
2262	goto errout_skb;
2263
2264	/* NLMSG_GOODSIZE is small to avoid high order allocations being	2275	/* NLMSG_GOODSIZE is small to avoid high order allocations being
2265	* required, but it makes sense to _attempt_ a 32KiB allocation	2276	* required, but it makes sense to _attempt_ a 32KiB allocation
2266	* to reduce number of system calls on dump operations, if user	2277	* to reduce number of system calls on dump operations, if user
@@ -2283,6 +2294,13 @@ static int netlink_dump(struct sock *sk, bool lock_taken) · 16 unmodified lines
2283	if (!skb)	2294	if (!skb)
2284	goto errout_skb;	2295	goto errout_skb;
2285		2296
		2297	rcvbuf = READ_ONCE(sk->sk_rcvbuf);
		2298	rmem = atomic_add_return(skb->truesize, &sk->sk_rmem_alloc);
		2299	if (rmem != skb->truesize && rmem >= rcvbuf) {
		2300	atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
		2301	goto errout_skb;
		2302	}
		2303
2286	/* Trim skb to allocated size. User is expected to provide buffer as	2304	/* Trim skb to allocated size. User is expected to provide buffer as
2287	* large as max(min_dump_alloc, 32KiB (max_recvmsg_len capped at	2305	* large as max(min_dump_alloc, 32KiB (max_recvmsg_len capped at
2288	* netlink_recvmsg())). dump will pack as many smaller messages as	2306	* netlink_recvmsg())). dump will pack as many smaller messages as

net/rxrpc/ar-internal.h+9−6

@@ -361,12 +361,15 @@ struct rxrpc_local { · 360 unmodified lines
361	struct list_head new_client_calls; /* Newly created client calls need connection */	361	struct list_head new_client_calls; /* Newly created client calls need connection */
362	spinlock_t client_call_lock; /* Lock for ->new_client_calls */	362	spinlock_t client_call_lock; /* Lock for ->new_client_calls */
363	struct sockaddr_rxrpc srx; /* local address */	363	struct sockaddr_rxrpc srx; /* local address */
364	/* Provide a kvec table sufficiently large to manage either a DATA	364	union {
365	* packet with a maximum set of jumbo subpackets or a PING ACK padded	365	/* Provide a kvec table sufficiently large to manage either a
366	* out to 64K with zeropages for PMTUD.	366	* DATA packet with a maximum set of jumbo subpackets or a PING
367	*/	367	* ACK padded out to 64K with zeropages for PMTUD.
368	struct kvec kvec[1 + RXRPC_MAX_NR_JUMBO > 3 + 16 ?	368	*/
369	1 + RXRPC_MAX_NR_JUMBO : 3 + 16];	369	struct kvec kvec[1 + RXRPC_MAX_NR_JUMBO > 3 + 16 ?
		370	1 + RXRPC_MAX_NR_JUMBO : 3 + 16];
		371	struct bio_vec bvec[3 + 16];
		372	};
370	};	373	};
371		374
372	/*	375	/*

net/rxrpc/call_accept.c+4−0

 id_in_use:
 	write_unlock(&rx->call_lock);
+	rxrpc_prefail_call(call, RXRPC_CALL_LOCAL_ERROR, -EBADSLT);
 	rxrpc_cleanup_call(call);
 	_leave(" = -EBADSLT");
 	return -EBADSLT;
 	unsigned short call_tail, conn_tail, peer_tail;
 	unsigned short call_count, conn_count;
+	if (!b)
+		return NULL;
 	/* #calls >= #conns >= #peers must hold true. */
 	call_head = smp_load_acquire(&b->call_backlog_head);
 	call_tail = b->call_backlog_tail;

net/rxrpc/output.c+4−1

 {
 	struct rxrpc_skb_priv *sp = rxrpc_skb(response);
 	struct scatterlist sg[16];
-	struct bio_vec bvec[16];
+	struct bio_vec *bvec = conn->local->bvec;
 	struct msghdr msg;
 	size_t len = sp->resp.len;
 	__be32 wserial;
 	if (ret < 0)
 		goto fail;
 	nr_sg = ret;
+	ret = -EIO;
+	if (WARN_ON_ONCE(nr_sg > ARRAY_SIZE(conn->local->bvec)))
+		goto fail;
 	for (int i = 0; i < nr_sg; i++)
 		bvec_set_page(&bvec[i], sg_page(&sg[i]), sg[i].length, sg[i].offset);

net/sched/sch_api.c+16−17

 	return q;
 }
-static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid)
+static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid,
+				struct netlink_ext_ack *extack)
 {
 	unsigned long cl;
 	const struct Qdisc_class_ops *cops = p->ops->cl_ops;
-	if (cops == NULL)
+	if (cops == NULL) {
-		return NULL;
+		NL_SET_ERR_MSG(extack, "Parent qdisc is not classful");
+		return ERR_PTR(-EOPNOTSUPP);
+	}
 	cl = cops->find(p, classid);
-	if (cl == 0)
+	if (cl == 0) {
-		return NULL;
+		NL_SET_ERR_MSG(extack, "Specified class not found");
+		return ERR_PTR(-ENOENT);
+	}
 	return cops->leaf(p, cl);
 }
 	qdisc_skb_cb(skb)->pkt_len = pkt_len;
 }
-void qdisc_warn_nonwc(const char *txt, struct Qdisc *qdisc)
-{
-	if (!(qdisc->flags & TCQ_F_WARN_NONWC)) {
-		pr_warn("%s: %s qdisc %X: is non-work-conserving?\n",
-			txt, qdisc->ops->id, qdisc->handle >> 16);
-		qdisc->flags |= TCQ_F_WARN_NONWC;
-	}
-}
-EXPORT_SYMBOL(qdisc_warn_nonwc);
 static enum hrtimer_restart qdisc_watchdog(struct hrtimer *timer)
 {
 	struct qdisc_watchdog *wd = container_of(timer, struct qdisc_watchdog,
 					NL_SET_ERR_MSG(extack, "Failed to find qdisc with specified classid");
 					return -ENOENT;
 				}
-				q = qdisc_leaf(p, clid);
+				q = qdisc_leaf(p, clid, extack);
 			} else if (dev_ingress_queue(dev)) {
 				q = rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping);
 			}
 			NL_SET_ERR_MSG(extack, "Cannot find specified qdisc on specified device");
 			return -ENOENT;
 		}
+		if (IS_ERR(q))
+			return PTR_ERR(q);
 		if (tcm->tcm_handle && q->handle != tcm->tcm_handle) {
 			NL_SET_ERR_MSG(extack, "Invalid handle");
 					NL_SET_ERR_MSG(extack, "Failed to find specified qdisc");
 					return -ENOENT;
 				}
-				q = qdisc_leaf(p, clid);
+				q = qdisc_leaf(p, clid, extack);
+				if (IS_ERR(q))
+					return PTR_ERR(q);
 			} else if (dev_ingress_queue_create(dev)) {
 				q = rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping);
 			}

net/sched/sch_hfsc.c+0−16

@@ -835,22 +835,6 @@ update_vf(struct hfsc_class *cl, unsigned int len, u64 cur_time) · 834 unmodified lines
835	}	835	}
836	}	836	}
837		837
838	static unsigned int
839	qdisc_peek_len(struct Qdisc *sch)
840	{
841	struct sk_buff *skb;
842	unsigned int len;
843
844	skb = sch->ops->peek(sch);
845	if (unlikely(skb == NULL)) {
846	qdisc_warn_nonwc("qdisc_peek_len", sch);
847	return 0;
848	}
849	len = qdisc_pkt_len(skb);
850
851	return len;
852	}
853
854	static void	838	static void
855	hfsc_adjust_levels(struct hfsc_class *cl)	839	hfsc_adjust_levels(struct hfsc_class *cl)
856	{	840	{

net/sched/sch_qfq.c+1−1

@@ -989,7 +989,7 @@ static struct sk_buff agg_dequeue(struct qfq_aggregate agg, · 988 unmodified lines
989		989
990	if (cl->qdisc->q.qlen == 0) /* no more packets, remove from list */	990	if (cl->qdisc->q.qlen == 0) /* no more packets, remove from list */
991	list_del_init(&cl->alist);	991	list_del_init(&cl->alist);
992	else if (cl->deficit < qdisc_pkt_len(cl->qdisc->ops->peek(cl->qdisc))) {	992	else if (cl->deficit < qdisc_peek_len(cl->qdisc)) {
993	cl->deficit += agg->lmax;	993	cl->deficit += agg->lmax;
994	list_move_tail(&cl->alist, &agg->active);	994	list_move_tail(&cl->alist, &agg->active);
995	}	995	}

net/tipc/topsrv.c+2−0

 	for (id = 0; srv->idr_in_use; id++) {
 		con = idr_find(&srv->conn_idr, id);
 		if (con) {
+			conn_get(con);
 			spin_unlock_bh(&srv->idr_lock);
 			tipc_conn_close(con);
+			conn_put(con);
 			spin_lock_bh(&srv->idr_lock);
 		}
 	}

net/vmw_vsock/af_vsock.c+46−11

 static bool vsock_use_local_transport(unsigned int remote_cid)
 {
+	lockdep_assert_held(&vsock_register_mutex);
 	if (!transport_local)
 		return false;
 	remote_flags = vsk->remote_addr.svm_flags;
+	mutex_lock(&vsock_register_mutex);
 	switch (sk->sk_type) {
 	case SOCK_DGRAM:
 		new_transport = transport_dgram;
 			new_transport = transport_h2g;
 		break;
 	default:
-		return -ESOCKTNOSUPPORT;
+		ret = -ESOCKTNOSUPPORT;
+		goto err;
 	}
 	if (vsk->transport) {
-		if (vsk->transport == new_transport)
+		if (vsk->transport == new_transport) {
-			return 0;
+			ret = 0;
+			goto err;
+		}
 		/* transport->release() must be called with sock lock acquired.
 		 * This path can only be taken during vsock_connect(), where we
 	/* We increase the module refcnt to prevent the transport unloading
 	 * while there are open sockets assigned to it.
 	 */
-	if (!new_transport || !try_module_get(new_transport->module))
+	if (!new_transport || !try_module_get(new_transport->module)) {
-		return -ENODEV;
+		ret = -ENODEV;
+		goto err;
+	}
+	/* It's safe to release the mutex after a successful try_module_get().
+	 * Whichever transport `new_transport` points at, it won't go away until
+	 * the last module_put() below or in vsock_deassign_transport().
+	 */
+	mutex_unlock(&vsock_register_mutex);
 	if (sk->sk_type == SOCK_SEQPACKET) {
 		if (!new_transport->seqpacket_allow ||
 	vsk->transport = new_transport;
 	return 0;
+err:
+	mutex_unlock(&vsock_register_mutex);
+	return ret;
 }
 EXPORT_SYMBOL_GPL(vsock_assign_transport);
+/*
+ * Provide safe access to static transport_{h2g,g2h,dgram,local} callbacks.
+ * Otherwise we may race with module removal. Do not use on `vsk->transport`.
+ */
+static u32 vsock_registered_transport_cid(const struct vsock_transport **transport)
+{
+	u32 cid = VMADDR_CID_ANY;
+	mutex_lock(&vsock_register_mutex);
+	if (*transport)
+		cid = (*transport)->get_local_cid();
+	mutex_unlock(&vsock_register_mutex);
+	return cid;
+}
 bool vsock_find_cid(unsigned int cid)
 {
-	if (transport_g2h && cid == transport_g2h->get_local_cid())
+	if (cid == vsock_registered_transport_cid(&transport_g2h))
 		return true;
 	if (transport_h2g && cid == VMADDR_CID_HOST)
 			       unsigned int cmd, void __user *ptr)
 {
 	u32 __user *p = ptr;
-	u32 cid = VMADDR_CID_ANY;
 	int retval = 0;
+	u32 cid;
 	switch (cmd) {
 	case IOCTL_VM_SOCKETS_GET_LOCAL_CID:
 		/* To be compatible with the VMCI behavior, we prioritize the
 		 * guest CID instead of well-know host CID (VMADDR_CID_HOST).
 		 */
-		if (transport_g2h)
+		cid = vsock_registered_transport_cid(&transport_g2h);
-			cid = transport_g2h->get_local_cid();
+		if (cid == VMADDR_CID_ANY)
-		else if (transport_h2g)
+			cid = vsock_registered_transport_cid(&transport_h2g);
-			cid = transport_h2g->get_local_cid();
+		if (cid == VMADDR_CID_ANY)
+			cid = vsock_registered_transport_cid(&transport_local);
 		if (put_user(cid, p) != 0)
 			retval = -EFAULT;

net/wireless/nl80211.c+5−2

 	unsigned int len = nla_len(attr);
 	const struct element *elem;
 	const struct ieee80211_mgmt *mgmt = (void *)data;
+	const struct ieee80211_ext *ext;
 	unsigned int fixedlen, hdrlen;
 	bool s1g_bcn;
 	s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
 	if (s1g_bcn) {
-		fixedlen = offsetof(struct ieee80211_ext,
+		ext = (struct ieee80211_ext *)mgmt;
-				    u.s1g_beacon.variable);
+		fixedlen =
+			offsetof(struct ieee80211_ext, u.s1g_beacon.variable) +
+			ieee80211_s1g_optional_len(ext->frame_control);
 		hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
 	} else {
 		fixedlen = offsetof(struct ieee80211_mgmt,

net/wireless/util.c+50−2

@@ -820,6 +820,52 @@ bool ieee80211_is_valid_amsdu(struct sk_buff *skb, u8 mesh_hdr) · 819 unmodified lines
820	}	820	}
821	EXPORT_SYMBOL(ieee80211_is_valid_amsdu);	821	EXPORT_SYMBOL(ieee80211_is_valid_amsdu);
822		822
		823
		824	/*
		825	* Detects if an MSDU frame was maliciously converted into an A-MSDU
		826	* frame by an adversary. This is done by parsing the received frame
		827	* as if it were a regular MSDU, even though the A-MSDU flag is set.
		828	*
		829	* For non-mesh interfaces, detection involves checking whether the
		830	* payload, when interpreted as an MSDU, begins with a valid RFC1042
		831	* header. This is done by comparing the A-MSDU subheader's destination
		832	* address to the start of the RFC1042 header.
		833	*
		834	* For mesh interfaces, the MSDU includes a 6-byte Mesh Control field
		835	* and an optional variable-length Mesh Address Extension field before
		836	* the RFC1042 header. The position of the RFC1042 header must therefore
		837	* be calculated based on the mesh header length.
		838	*
		839	* Since this function intentionally parses an A-MSDU frame as an MSDU,
		840	* it only assumes that the A-MSDU subframe header is present, and
		841	* beyond this it performs its own bounds checks under the assumption
		842	* that the frame is instead parsed as a non-aggregated MSDU.
		843	*/
		844	static bool
		845	is_amsdu_aggregation_attack(struct ethhdr eth, struct sk_buff skb,
		846	enum nl80211_iftype iftype)
		847	{
		848	int offset;
		849
		850	/* Non-mesh case can be directly compared */
		851	if (iftype != NL80211_IFTYPE_MESH_POINT)
		852	return ether_addr_equal(eth->h_dest, rfc1042_header);
		853
		854	offset = __ieee80211_get_mesh_hdrlen(eth->h_dest[0]);
		855	if (offset == 6) {
		856	/* Mesh case with empty address extension field */
		857	return ether_addr_equal(eth->h_source, rfc1042_header);
		858	} else if (offset + ETH_ALEN <= skb->len) {
		859	/* Mesh case with non-empty address extension field */
		860	u8 temp[ETH_ALEN];
		861
		862	skb_copy_bits(skb, offset, temp, ETH_ALEN);
		863	return ether_addr_equal(temp, rfc1042_header);
		864	}
		865
		866	return false;
		867	}
		868
823	void ieee80211_amsdu_to_8023s(struct sk_buff skb, struct sk_buff_head list,	869	void ieee80211_amsdu_to_8023s(struct sk_buff skb, struct sk_buff_head list,
824	const u8 *addr, enum nl80211_iftype iftype,	870	const u8 *addr, enum nl80211_iftype iftype,
825	const unsigned int extra_headroom,	871	const unsigned int extra_headroom,
@@ -861,8 +907,10 @@ void ieee80211_amsdu_to_8023s(struct sk_buff skb, struct sk_buff_head list, · 35 unmodified lines
861	/* the last MSDU has no padding */	907	/* the last MSDU has no padding */
862	if (subframe_len > remaining)	908	if (subframe_len > remaining)
863	goto purge;	909	goto purge;
864	/* mitigate A-MSDU aggregation injection attacks */	910	/* mitigate A-MSDU aggregation injection attacks, to be
865	if (ether_addr_equal(hdr.eth.h_dest, rfc1042_header))	911	* checked when processing first subframe (offset == 0).
		912	*/
		913	if (offset == 0 && is_amsdu_aggregation_attack(&hdr.eth, skb, iftype))
866	goto purge;	914	goto purge;
867		915
868	offset += sizeof(struct ethhdr);	916	offset += sizeof(struct ethhdr);

rust/kernel/drm/device.rs+11−1

         open: Some(drm::File::<T::File>::open_callback),
         postclose: Some(drm::File::<T::File>::postclose_callback),
         unload: None,
-        release: None,
+        release: Some(Self::release),
         master_set: None,
         master_drop: None,
         debugfs_init: None,
         // SAFETY: `ptr` is valid by the safety requirements of this function.
         unsafe { &*ptr.cast() }
     }
+    extern "C" fn release(ptr: *mut bindings::drm_device) {
+        // SAFETY: `ptr` is a valid pointer to a `struct drm_device` and embedded in `Self`.
+        let this = unsafe { Self::from_drm_device(ptr) };
+        // SAFETY:
+        // - When `release` runs it is guaranteed that there is no further access to `this`.
+        // - `this` is valid for dropping.
+        unsafe { core::ptr::drop_in_place(this) };
+    }
 }
 impl<T: drm::Driver> Deref for Device<T> {

rust/kernel/drm/driver.rs+0−1

@@ -10,7 +10,6 @@ use crate::{ · 9 unmodified lines
10	drm,	10	drm,
11	error::{to_result, Result},	11	error::{to_result, Result},
12	prelude::*,	12	prelude::*,
13	str::CStr,
14	types::ARef,	13	types::ARef,
15	};	14	};
16	use macros::vtable;	15	use macros::vtable;

samples/damon/mtier.c+6−2

 	if (enable == enabled)
 		return 0;
-	if (enable)
+	if (enable) {
-		return damon_sample_mtier_start();
+		err = damon_sample_mtier_start();
+		if (err)
+			enable = false;
+		return err;
+	}
 	damon_sample_mtier_stop();
 	return 0;
 }

samples/damon/prcl.c+6−2

 	if (enable == enabled)
 		return 0;
-	if (enable)
+	if (enable) {
-		return damon_sample_prcl_start();
+		err = damon_sample_prcl_start();
+		if (err)
+			enable = false;
+		return err;
+	}
 	damon_sample_prcl_stop();
 	return 0;
 }

samples/damon/wsse.c+6−2

 	if (enable == enabled)
 		return 0;
-	if (enable)
+	if (enable) {
-		return damon_sample_wsse_start();
+		err = damon_sample_wsse_start();
+		if (err)
+			enable = false;
+		return err;
+	}
 	damon_sample_wsse_stop();
 	return 0;
 }

scripts/gdb/linux/constants.py.in+7−0

 #include <linux/of_fdt.h>
 #include <linux/page_ext.h>
 #include <linux/radix-tree.h>
+#include <linux/maple_tree.h>
 #include <linux/slab.h>
 #include <linux/threads.h>
 #include <linux/vmalloc.h>
 LX_GDBPARSED(RADIX_TREE_MAP_SHIFT)
 LX_GDBPARSED(RADIX_TREE_MAP_MASK)
+/* linux/maple_tree.h */
+LX_VALUE(MAPLE_NODE_SLOTS)
+LX_VALUE(MAPLE_RANGE64_SLOTS)
+LX_VALUE(MAPLE_ARANGE64_SLOTS)
+LX_GDBPARSED(MAPLE_NODE_MASK)
 /* linux/vmalloc.h */
 LX_VALUE(VM_IOREMAP)
 LX_VALUE(VM_ALLOC)

scripts/gdb/linux/interrupts.py+8−8

@@ -7,7 +7,7 @@ import gdb · 6 unmodified lines
7	from linux import constants	7	from linux import constants
8	from linux import cpus	8	from linux import cpus
9	from linux import utils	9	from linux import utils
10	from linux import radixtree	10	from linux import mapletree
11		11
12	irq_desc_type = utils.CachedType("struct irq_desc")	12	irq_desc_type = utils.CachedType("struct irq_desc")
13		13
@@ -23,12 +23,12 @@ def irqd_is_level(desc): · 9 unmodified lines
23	def show_irq_desc(prec, irq):	23	def show_irq_desc(prec, irq):
24	text = ""	24	text = ""
25		25
26	desc = radixtree.lookup(gdb.parse_and_eval("&irq_desc_tree"), irq)	26	desc = mapletree.mtree_load(gdb.parse_and_eval("&sparse_irqs"), irq)
27	if desc is None:	27	if desc is None:
28	return text	28	return text
29		29
30	desc = desc.cast(irq_desc_type.get_type())	30	desc = desc.cast(irq_desc_type.get_type().pointer())
31	if desc is None:	31	if desc == 0:
32	return text	32	return text
33		33
34	if irq_settings_is_hidden(desc):	34	if irq_settings_is_hidden(desc):
@@ -110,7 +110,7 @@ def x86_show_mce(prec, var, pfx, desc): · 75 unmodified lines
110	pvar = gdb.parse_and_eval(var)	110	pvar = gdb.parse_and_eval(var)
111	text = "%*s: " % (prec, pfx)	111	text = "%*s: " % (prec, pfx)
112	for cpu in cpus.each_online_cpu():	112	for cpu in cpus.each_online_cpu():
113	text += "%10u " % (cpus.per_cpu(pvar, cpu))	113	text += "%10u " % (cpus.per_cpu(pvar, cpu).dereference())
114	text += " %s\n" % (desc)	114	text += " %s\n" % (desc)
115	return text	115	return text
116		116
@@ -142,7 +142,7 @@ def x86_show_interupts(prec): · 25 unmodified lines
142		142
143	if constants.LX_CONFIG_X86_MCE:	143	if constants.LX_CONFIG_X86_MCE:
144	text += x86_show_mce(prec, "&mce_exception_count", "MCE", "Machine check exceptions")	144	text += x86_show_mce(prec, "&mce_exception_count", "MCE", "Machine check exceptions")
145	text == x86_show_mce(prec, "&mce_poll_count", "MCP", "Machine check polls")	145	text += x86_show_mce(prec, "&mce_poll_count", "MCP", "Machine check polls")
146		146
147	text += show_irq_err_count(prec)	147	text += show_irq_err_count(prec)
148		148
@@ -221,8 +221,8 @@ class LxInterruptList(gdb.Command): · 72 unmodified lines
221	gdb.write("CPU%-8d" % cpu)	221	gdb.write("CPU%-8d" % cpu)
222	gdb.write("\n")	222	gdb.write("\n")
223		223
224	if utils.gdb_eval_or_none("&irq_desc_tree") is None:	224	if utils.gdb_eval_or_none("&sparse_irqs") is None:
225	return	225	raise gdb.GdbError("Unable to find the sparse IRQ tree, is CONFIG_SPARSE_IRQ enabled?")
226		226
227	for irq in range(nr_irqs):	227	for irq in range(nr_irqs):
228	gdb.write(show_irq_desc(prec, irq))	228	gdb.write(show_irq_desc(prec, irq))

scripts/gdb/linux/mapletree.py+252−0

@@ -0,0 +1,252 @@
	1	# SPDX-License-Identifier: GPL-2.0
	2	#
	3	# Maple tree helpers
	4	#
	5	# Copyright (c) 2025 Broadcom
	6	#
	7	# Authors:
	8	# Florian Fainelli <florian.fainelli@broadcom.com>
	9
	10	import gdb
	11
	12	from linux import utils
	13	from linux import constants
	14	from linux import xarray
	15
	16	maple_tree_root_type = utils.CachedType("struct maple_tree")
	17	maple_node_type = utils.CachedType("struct maple_node")
	18	maple_enode_type = utils.CachedType("void")
	19
	20	maple_dense = 0
	21	maple_leaf_64 = 1
	22	maple_range_64 = 2
	23	maple_arange_64 = 3
	24
	25	class Mas(object):
	26	ma_active = 0
	27	ma_start = 1
	28	ma_root = 2
	29	ma_none = 3
	30	ma_pause = 4
	31	ma_overflow = 5
	32	ma_underflow = 6
	33	ma_error = 7
	34
	35	def __init__(self, mt, first, end):
	36	if mt.type == maple_tree_root_type.get_type().pointer():
	37	self.tree = mt.dereference()
	38	elif mt.type != maple_tree_root_type.get_type():
	39	raise gdb.GdbError("must be {} not {}"
	40	.format(maple_tree_root_type.get_type().pointer(), mt.type))
	41	self.tree = mt
	42	self.index = first
	43	self.last = end
	44	self.node = None
	45	self.status = self.ma_start
	46	self.min = 0
	47	self.max = -1
	48
	49	def is_start(self):
	50	# mas_is_start()
	51	return self.status == self.ma_start
	52
	53	def is_ptr(self):
	54	# mas_is_ptr()
	55	return self.status == self.ma_root
	56
	57	def is_none(self):
	58	# mas_is_none()
	59	return self.status == self.ma_none
	60
	61	def root(self):
	62	# mas_root()
	63	return self.tree['ma_root'].cast(maple_enode_type.get_type().pointer())
	64
	65	def start(self):
	66	# mas_start()
	67	if self.is_start() is False:
	68	return None
	69
	70	self.min = 0
	71	self.max = ~0
	72
	73	while True:
	74	self.depth = 0
	75	root = self.root()
	76	if xarray.xa_is_node(root):
	77	self.depth = 0
	78	self.status = self.ma_active
	79	self.node = mte_safe_root(root)
	80	self.offset = 0
	81	if mte_dead_node(self.node) is True:
	82	continue
	83
	84	return None
	85
	86	self.node = None
	87	# Empty tree
	88	if root is None:
	89	self.status = self.ma_none
	90	self.offset = constants.LX_MAPLE_NODE_SLOTS
	91	return None
	92
	93	# Single entry tree
	94	self.status = self.ma_root
	95	self.offset = constants.LX_MAPLE_NODE_SLOTS
	96
	97	if self.index != 0:
	98	return None
	99
	100	return root
	101
	102	return None
	103
	104	def reset(self):
	105	# mas_reset()
	106	self.status = self.ma_start
	107	self.node = None
	108
	109	def mte_safe_root(node):
	110	if node.type != maple_enode_type.get_type().pointer():
	111	raise gdb.GdbError("{} must be {} not {}"
	112	.format(mte_safe_root.__name__, maple_enode_type.get_type().pointer(), node.type))
	113	ulong_type = utils.get_ulong_type()
	114	indirect_ptr = node.cast(ulong_type) & ~0x2
	115	val = indirect_ptr.cast(maple_enode_type.get_type().pointer())
	116	return val
	117
	118	def mte_node_type(entry):
	119	ulong_type = utils.get_ulong_type()
	120	val = None
	121	if entry.type == maple_enode_type.get_type().pointer():
	122	val = entry.cast(ulong_type)
	123	elif entry.type == ulong_type:
	124	val = entry
	125	else:
	126	raise gdb.GdbError("{} must be {} not {}"
	127	.format(mte_node_type.__name__, maple_enode_type.get_type().pointer(), entry.type))
	128	return (val >> 0x3) & 0xf
	129
	130	def ma_dead_node(node):
	131	if node.type != maple_node_type.get_type().pointer():
	132	raise gdb.GdbError("{} must be {} not {}"
	133	.format(ma_dead_node.__name__, maple_node_type.get_type().pointer(), node.type))
	134	ulong_type = utils.get_ulong_type()
	135	parent = node['parent']
	136	indirect_ptr = node['parent'].cast(ulong_type) & ~constants.LX_MAPLE_NODE_MASK
	137	return indirect_ptr == node
	138
	139	def mte_to_node(enode):
	140	ulong_type = utils.get_ulong_type()
	141	if enode.type == maple_enode_type.get_type().pointer():
	142	indirect_ptr = enode.cast(ulong_type)
	143	elif enode.type == ulong_type:
	144	indirect_ptr = enode
	145	else:
	146	raise gdb.GdbError("{} must be {} not {}"
	147	.format(mte_to_node.__name__, maple_enode_type.get_type().pointer(), enode.type))
	148	indirect_ptr = indirect_ptr & ~constants.LX_MAPLE_NODE_MASK
	149	return indirect_ptr.cast(maple_node_type.get_type().pointer())
	150
	151	def mte_dead_node(enode):
	152	if enode.type != maple_enode_type.get_type().pointer():
	153	raise gdb.GdbError("{} must be {} not {}"
	154	.format(mte_dead_node.__name__, maple_enode_type.get_type().pointer(), enode.type))
	155	node = mte_to_node(enode)
	156	return ma_dead_node(node)
	157
	158	def ma_is_leaf(tp):
	159	result = tp < maple_range_64
	160	return tp < maple_range_64
	161
	162	def mt_pivots(t):
	163	if t == maple_dense:
	164	return 0
	165	elif t == maple_leaf_64 or t == maple_range_64:
	166	return constants.LX_MAPLE_RANGE64_SLOTS - 1
	167	elif t == maple_arange_64:
	168	return constants.LX_MAPLE_ARANGE64_SLOTS - 1
	169
	170	def ma_pivots(node, t):
	171	if node.type != maple_node_type.get_type().pointer():
	172	raise gdb.GdbError("{}: must be {} not {}"
	173	.format(ma_pivots.__name__, maple_node_type.get_type().pointer(), node.type))
	174	if t == maple_arange_64:
	175	return node['ma64']['pivot']
	176	elif t == maple_leaf_64 or t == maple_range_64:
	177	return node['mr64']['pivot']
	178	else:
	179	return None
	180
	181	def ma_slots(node, tp):
	182	if node.type != maple_node_type.get_type().pointer():
	183	raise gdb.GdbError("{}: must be {} not {}"
	184	.format(ma_slots.__name__, maple_node_type.get_type().pointer(), node.type))
	185	if tp == maple_arange_64:
	186	return node['ma64']['slot']
	187	elif tp == maple_range_64 or tp == maple_leaf_64:
	188	return node['mr64']['slot']
	189	elif tp == maple_dense:
	190	return node['slot']
	191	else:
	192	return None
	193
	194	def mt_slot(mt, slots, offset):
	195	ulong_type = utils.get_ulong_type()
	196	return slots[offset].cast(ulong_type)
	197
	198	def mtree_lookup_walk(mas):
	199	ulong_type = utils.get_ulong_type()
	200	n = mas.node
	201
	202	while True:
	203	node = mte_to_node(n)
	204	tp = mte_node_type(n)
	205	pivots = ma_pivots(node, tp)
	206	end = mt_pivots(tp)
	207	offset = 0
	208	while True:
	209	if pivots[offset] >= mas.index:
	210	break
	211	if offset >= end:
	212	break
	213	offset += 1
	214
	215	slots = ma_slots(node, tp)
	216	n = mt_slot(mas.tree, slots, offset)
	217	if ma_dead_node(node) is True:
	218	mas.reset()
	219	return None
	220	break
	221
	222	if ma_is_leaf(tp) is True:
	223	break
	224
	225	return n
	226
	227	def mtree_load(mt, index):
	228	ulong_type = utils.get_ulong_type()
	229	# MT_STATE(...)
	230	mas = Mas(mt, index, index)
	231	entry = None
	232
	233	while True:
	234	entry = mas.start()
	235	if mas.is_none():
	236	return None
	237
	238	if mas.is_ptr():
	239	if index != 0:
	240	entry = None
	241	return entry
	242
	243	entry = mtree_lookup_walk(mas)
	244	if entry is None and mas.is_start():
	245	continue
	246	else:
	247	break
	248
	249	if xarray.xa_is_zero(entry):
	250	return None
	251
	252	return entry

scripts/gdb/linux/vfs.py+1−1

@@ -22,7 +22,7 @@ def dentry_name(d): · 21 unmodified lines
22	if parent == d or parent == 0:	22	if parent == d or parent == 0:
23	return ""	23	return ""
24	p = dentry_name(d['d_parent']) + "/"	24	p = dentry_name(d['d_parent']) + "/"
25	return p + d['d_shortname']['string'].string()	25	return p + d['d_name']['name'].string()
26		26
27	class DentryName(gdb.Function):	27	class DentryName(gdb.Function):
28	"""Return string of the full path of a dentry.	28	"""Return string of the full path of a dentry.

scripts/gdb/linux/xarray.py+28−0

@@ -0,0 +1,28 @@
	1	# SPDX-License-Identifier: GPL-2.0
	2	#
	3	# Xarray helpers
	4	#
	5	# Copyright (c) 2025 Broadcom
	6	#
	7	# Authors:
	8	# Florian Fainelli <florian.fainelli@broadcom.com>
	9
	10	import gdb
	11
	12	from linux import utils
	13	from linux import constants
	14
	15	def xa_is_internal(entry):
	16	ulong_type = utils.get_ulong_type()
	17	return ((entry.cast(ulong_type) & 3) == 2)
	18
	19	def xa_mk_internal(v):
	20	return ((v << 2) \| 2)
	21
	22	def xa_is_zero(entry):
	23	ulong_type = utils.get_ulong_type()
	24	return entry.cast(ulong_type) == xa_mk_internal(257)
	25
	26	def xa_is_node(entry):
	27	ulong_type = utils.get_ulong_type()
	28	return xa_is_internal(entry) and (entry.cast(ulong_type) > 4096)

sound/isa/ad1816a/ad1816a.c+1−1

@@ -98,7 +98,7 @@ static int snd_card_ad1816a_pnp(int dev, struct pnp_card_link *card, · 97 unmodified lines
98	pdev = pnp_request_card_device(card, id->devs[1].id, NULL);	98	pdev = pnp_request_card_device(card, id->devs[1].id, NULL);
99	if (pdev == NULL) {	99	if (pdev == NULL) {
100	mpu_port[dev] = -1;	100	mpu_port[dev] = -1;
101	dev_warn(&pdev->dev, "MPU401 device busy, skipping.\n");	101	pr_warn("MPU401 device busy, skipping.\n");
102	return 0;	102	return 0;
103	}	103	}
104		104

sound/pci/hda/patch_hdmi.c+19−0

 HDA_CODEC_ENTRY(0x10de002f, "Tegra194 HDMI/DP2", patch_tegra_hdmi),
 HDA_CODEC_ENTRY(0x10de0030, "Tegra194 HDMI/DP3", patch_tegra_hdmi),
 HDA_CODEC_ENTRY(0x10de0031, "Tegra234 HDMI/DP", patch_tegra234_hdmi),
+HDA_CODEC_ENTRY(0x10de0033, "SoC 33 HDMI/DP",	patch_tegra234_hdmi),
 HDA_CODEC_ENTRY(0x10de0034, "Tegra264 HDMI/DP",	patch_tegra234_hdmi),
+HDA_CODEC_ENTRY(0x10de0035, "SoC 35 HDMI/DP",	patch_tegra234_hdmi),
 HDA_CODEC_ENTRY(0x10de0040, "GPU 40 HDMI/DP",	patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de0041, "GPU 41 HDMI/DP",	patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de0042, "GPU 42 HDMI/DP",	patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de0098, "GPU 98 HDMI/DP",	patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de0099, "GPU 99 HDMI/DP",	patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de009a, "GPU 9a HDMI/DP",	patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de009b, "GPU 9b HDMI/DP",	patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de009c, "GPU 9c HDMI/DP",	patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de009d, "GPU 9d HDMI/DP",	patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de009e, "GPU 9e HDMI/DP",	patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de009f, "GPU 9f HDMI/DP",	patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de00a0, "GPU a0 HDMI/DP",	patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de00a1, "GPU a1 HDMI/DP",	patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de00a3, "GPU a3 HDMI/DP",	patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de00a4, "GPU a4 HDMI/DP",	patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de00a5, "GPU a5 HDMI/DP",	patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de00a6, "GPU a6 HDMI/DP",	patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de00a7, "GPU a7 HDMI/DP",	patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de00a8, "GPU a8 HDMI/DP",	patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de00a9, "GPU a9 HDMI/DP",	patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de00aa, "GPU aa HDMI/DP",	patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de00ab, "GPU ab HDMI/DP",	patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de00ad, "GPU ad HDMI/DP",	patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de00ae, "GPU ae HDMI/DP",	patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de00af, "GPU af HDMI/DP",	patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de00b0, "GPU b0 HDMI/DP",	patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de00b1, "GPU b1 HDMI/DP",	patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de00c0, "GPU c0 HDMI/DP",	patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de00c1, "GPU c1 HDMI/DP",	patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de00c3, "GPU c3 HDMI/DP",	patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de00c4, "GPU c4 HDMI/DP",	patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de00c5, "GPU c5 HDMI/DP",	patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI",	patch_nvhdmi_2ch),
 HDA_CODEC_ENTRY(0x10de8067, "MCP67/68 HDMI",	patch_nvhdmi_2ch),
 HDA_CODEC_ENTRY(0x67663d82, "Arise 82 HDMI/DP",	patch_gf_hdmi),

sound/pci/hda/patch_realtek.c+3−0

 	SND_PCI_QUIRK(0x103c, 0x8ce0, "HP SnowWhite", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8cf5, "HP ZBook Studio 16", ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8d01, "HP ZBook Power 14 G12", ALC285_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8d07, "HP Victus 15-fb2xxx (MB 8D07)", ALC245_FIXUP_HP_MUTE_LED_COEFBIT),
 	SND_PCI_QUIRK(0x103c, 0x8d18, "HP EliteStudio 8 AIO", ALC274_FIXUP_HP_AIO_BIND_DACS),
 	SND_PCI_QUIRK(0x103c, 0x8d84, "HP EliteBook X G1i", ALC285_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8d85, "HP EliteBook 14 G12", ALC285_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x1043, 0x1e63, "ASUS H7606W", ALC285_FIXUP_ASUS_GU605_SPI_SPEAKER2_TO_DAC1),
 	SND_PCI_QUIRK(0x1043, 0x1e83, "ASUS GA605W", ALC285_FIXUP_ASUS_GU605_SPI_SPEAKER2_TO_DAC1),
 	SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401),
+	SND_PCI_QUIRK(0x1043, 0x1e93, "ASUS ExpertBook B9403CVAR", ALC294_FIXUP_ASUS_HPE),
 	SND_PCI_QUIRK(0x1043, 0x1eb3, "ASUS Ally RCLA72", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x1043, 0x1ed3, "ASUS HN7306W", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x1043, 0x1ee2, "ASUS UM6702RA/RC", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x2782, 0x0228, "Infinix ZERO BOOK 13", ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13),
 	SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO),
 	SND_PCI_QUIRK(0x2782, 0x1407, "Positivo P15X", ALC269_FIXUP_POSITIVO_P15X_HEADSET_MIC),
+	SND_PCI_QUIRK(0x2782, 0x1409, "Positivo K116J", ALC269_FIXUP_POSITIVO_P15X_HEADSET_MIC),
 	SND_PCI_QUIRK(0x2782, 0x1701, "Infinix Y4 Max", ALC269VC_FIXUP_INFINIX_Y4_MAX),
 	SND_PCI_QUIRK(0x2782, 0x1705, "MEDION E15433", ALC269VC_FIXUP_INFINIX_Y4_MAX),
 	SND_PCI_QUIRK(0x2782, 0x1707, "Vaio VJFE-ADL", ALC298_FIXUP_SPK_VOLUME),

sound/pci/hda/tas2781_hda.c+5−3

 		TASDEVICE_REG(0, 0x13, 0x70),
 		TASDEVICE_REG(0, 0x18, 0x7c),
 	};
-	unsigned int crc, oft;
+	unsigned int crc, oft, node_num;
 	unsigned char *buf;
 	int i, j, k, l;
 			dev_err(p->dev, "%s: CRC error\n", __func__);
 			return;
 		}
+		node_num = tmp_val[1];
-		for (j = 0, k = 0; j < tmp_val[1]; j++) {
+		for (j = 0, k = 0; j < node_num; j++) {
 			oft = j * 6 + 3;
 			if (tmp_val[oft] == TASDEV_UEFI_CALI_REG_ADDR_FLG) {
 				for (i = 0; i < TASDEV_CALIB_N; i++) {
 				}
 				data[l] = k;
+				oft++;
 				for (i = 0; i < TASDEV_CALIB_N * 4; i++)
-					data[l + i] = data[4 * oft + i];
+					data[l + i + 1] = data[4 * oft + i];
 				k++;
 			}
 		}

sound/soc/codecs/cs35l56-shared.c+1−1

@@ -980,7 +980,7 @@ int cs35l56_hw_init(struct cs35l56_base *cs35l56_base) · 979 unmodified lines
980	break;	980	break;
981	default:	981	default:
982	dev_err(cs35l56_base->dev, "Unknown device %x\n", devid);	982	dev_err(cs35l56_base->dev, "Unknown device %x\n", devid);
983	return ret;	983	return -ENODEV;
984	}	984	}
985		985
986	cs35l56_base->type = devid & 0xFF;	986	cs35l56_base->type = devid & 0xFF;

sound/soc/codecs/tlv320aic32x4.c+23−30

  * Based on sound/soc/codecs/wm8974 and TI driver for kernel 2.6.27.
  */
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/init.h>
-#include <linux/delay.h>
-#include <linux/pm.h>
-#include <linux/gpio.h>
-#include <linux/of_gpio.h>
 #include <linux/cdev.h>
-#include <linux/slab.h>
 #include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/gpio/consumer.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
 #include <linux/of_clk.h>
+#include <linux/pm.h>
 #include <linux/regulator/consumer.h>
+#include <linux/slab.h>
-#include <sound/tlv320aic32x4.h>
 #include <sound/core.h>
+#include <sound/initval.h>
 #include <sound/pcm.h>
 #include <sound/pcm_params.h>
 #include <sound/soc.h>
 #include <sound/soc-dapm.h>
-#include <sound/initval.h>
 #include <sound/tlv.h>
+#include <sound/tlv320aic32x4.h>
 #include "tlv320aic32x4.h"
 	u32 power_cfg;
 	u32 micpga_routing;
 	bool swapdacs;
-	int rstn_gpio;
+	struct gpio_desc *rstn_gpio;
 	const char *mclk_name;
 	struct regulator *supply_ldo;
 	aic32x4->swapdacs = false;
 	aic32x4->micpga_routing = 0;
-	aic32x4->rstn_gpio = of_get_named_gpio(np, "reset-gpios", 0);
+	/* Assert reset using GPIOD_OUT_HIGH, because reset is GPIO_ACTIVE_LOW */
+	aic32x4->rstn_gpio = devm_gpiod_get_optional(aic32x4->dev, "reset", GPIOD_OUT_HIGH);
+	if (IS_ERR(aic32x4->rstn_gpio)) {
+		return dev_err_probe(aic32x4->dev, PTR_ERR(aic32x4->rstn_gpio),
+				     "Failed to get reset gpio\n");
+	} else {
+		gpiod_set_consumer_name(aic32x4->rstn_gpio, "tlv320aic32x4_rstn");
+	}
 	if (of_property_read_u32_array(np, "aic32x4-gpio-func",
 				aic32x4_setup->gpio_func, 5) >= 0)
 		  enum aic32x4_type type)
 {
 	struct aic32x4_priv *aic32x4;
-	struct aic32x4_pdata *pdata = dev->platform_data;
 	struct device_node *np = dev->of_node;
 	int ret;
 	dev_set_drvdata(dev, aic32x4);
-	if (pdata) {
+	if (np) {
-		aic32x4->power_cfg = pdata->power_cfg;
-		aic32x4->swapdacs = pdata->swapdacs;
-		aic32x4->micpga_routing = pdata->micpga_routing;
-		aic32x4->rstn_gpio = pdata->rstn_gpio;
-		aic32x4->mclk_name = "mclk";
-	} else if (np) {
 		ret = aic32x4_parse_dt(aic32x4, np);
 		if (ret) {
 			dev_err(dev, "Failed to parse DT node\n");
 		aic32x4->power_cfg = 0;
 		aic32x4->swapdacs = false;
 		aic32x4->micpga_routing = 0;
-		aic32x4->rstn_gpio = -1;
+		aic32x4->rstn_gpio = NULL;
 		aic32x4->mclk_name = "mclk";
 	}
-	if (gpio_is_valid(aic32x4->rstn_gpio)) {
-		ret = devm_gpio_request_one(dev, aic32x4->rstn_gpio,
-				GPIOF_OUT_INIT_LOW, "tlv320aic32x4 rstn");
-		if (ret != 0)
-			return ret;
-	}
 	ret = aic32x4_setup_regulators(dev, aic32x4);
 	if (ret) {
 		dev_err(dev, "Failed to setup regulators\n");
 		return ret;
 	}
-	if (gpio_is_valid(aic32x4->rstn_gpio)) {
+	if (!aic32x4->rstn_gpio) {
 		ndelay(10);
-		gpio_set_value_cansleep(aic32x4->rstn_gpio, 1);
+		/* deassert reset */
+		gpiod_set_value_cansleep(aic32x4->rstn_gpio, 0);
 		mdelay(1);
 	}

sound/soc/fsl/fsl_asrc.c+2−1

@@ -517,7 +517,8 @@ static int fsl_asrc_config_pair(struct fsl_asrc_pair *pair, bool use_ideal_rate) · 516 unmodified lines
517	regmap_update_bits(asrc->regmap, REG_ASRCTR,	517	regmap_update_bits(asrc->regmap, REG_ASRCTR,
518	ASRCTR_ATSi_MASK(index), ASRCTR_ATS(index));	518	ASRCTR_ATSi_MASK(index), ASRCTR_ATS(index));
519	regmap_update_bits(asrc->regmap, REG_ASRCTR,	519	regmap_update_bits(asrc->regmap, REG_ASRCTR,
520	ASRCTR_USRi_MASK(index), 0);	520	ASRCTR_IDRi_MASK(index) \| ASRCTR_USRi_MASK(index),
		521	ASRCTR_USR(index));
521		522
522	/* Set the input and output clock sources */	523	/* Set the input and output clock sources */
523	regmap_update_bits(asrc->regmap, REG_ASRCSR,	524	regmap_update_bits(asrc->regmap, REG_ASRCSR,

sound/soc/fsl/fsl_sai.c+8−6

 	 * anymore. Add software reset to fix this issue.
 	 * This is a hardware bug, and will be fix in the
 	 * next sai version.
+	 *
+	 * In consumer mode, this can happen even after a
+	 * single open/close, especially if both tx and rx
+	 * are running concurrently.
 	 */
-	if (!sai->is_consumer_mode[tx]) {
+	/* Software Reset */
-		/* Software Reset */
+	regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR);
-		regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR);
+	/* Clear SR bit to finish the reset */
-		/* Clear SR bit to finish the reset */
+	regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), 0);
-		regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), 0);
-	}
 }
 static int fsl_sai_trigger(struct snd_pcm_substream *substream, int cmd,

sound/soc/intel/boards/Kconfig+1−0

@@ -42,6 +42,7 @@ config SND_SOC_INTEL_SOF_NUVOTON_COMMON · 41 unmodified lines
42	tristate	42	tristate
43		43
44	config SND_SOC_INTEL_SOF_BOARD_HELPERS	44	config SND_SOC_INTEL_SOF_BOARD_HELPERS
		45	select SND_SOC_ACPI_INTEL_MATCH
45	tristate	46	tristate
46		47
47	if SND_SOC_INTEL_CATPT	48	if SND_SOC_INTEL_CATPT

sound/soc/intel/boards/sof_sdw.c+3−0

 static const struct snd_pci_quirk sof_sdw_ssid_quirk_table[] = {
 	SND_PCI_QUIRK(0x1043, 0x1e13, "ASUS Zenbook S14", SOC_SDW_CODEC_MIC),
 	SND_PCI_QUIRK(0x1043, 0x1f43, "ASUS Zenbook S16", SOC_SDW_CODEC_MIC),
+	SND_PCI_QUIRK(0x17aa, 0x2347, "Lenovo P16", SOC_SDW_CODEC_MIC),
+	SND_PCI_QUIRK(0x17aa, 0x2348, "Lenovo P16", SOC_SDW_CODEC_MIC),
+	SND_PCI_QUIRK(0x17aa, 0x2349, "Lenovo P1", SOC_SDW_CODEC_MIC),
 	{}
 };

sound/soc/intel/common/soc-acpi-intel-arl-match.c+6−6

@@ -468,17 +468,17 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_arl_sdw_machines[] = { · 467 unmodified lines
468	.get_function_tplg_files = sof_sdw_get_tplg_files,	468	.get_function_tplg_files = sof_sdw_get_tplg_files,
469	},	469	},
470	{	470	{
471	.link_mask = BIT(2),	471	.link_mask = BIT(2) \| BIT(3),
472	.links = arl_cs42l43_l2,	472	.links = arl_cs42l43_l2_cs35l56_l3,
473	.drv_name = "sof_sdw",	473	.drv_name = "sof_sdw",
474	.sof_tplg_filename = "sof-arl-cs42l43-l2.tplg",	474	.sof_tplg_filename = "sof-arl-cs42l43-l2-cs35l56-l3.tplg",
475	.get_function_tplg_files = sof_sdw_get_tplg_files,	475	.get_function_tplg_files = sof_sdw_get_tplg_files,
476	},	476	},
477	{	477	{
478	.link_mask = BIT(2) \| BIT(3),	478	.link_mask = BIT(2),
479	.links = arl_cs42l43_l2_cs35l56_l3,	479	.links = arl_cs42l43_l2,
480	.drv_name = "sof_sdw",	480	.drv_name = "sof_sdw",
481	.sof_tplg_filename = "sof-arl-cs42l43-l2-cs35l56-l3.tplg",	481	.sof_tplg_filename = "sof-arl-cs42l43-l2.tplg",
482	.get_function_tplg_files = sof_sdw_get_tplg_files,	482	.get_function_tplg_files = sof_sdw_get_tplg_files,
483	},	483	},
484	{	484	{

sound/usb/format.c+10−12

@@ -310,16 +310,14 @@ static bool focusrite_valid_sample_rate(struct snd_usb_audio *chip, · 309 unmodified lines
310	struct audioformat *fp,	310	struct audioformat *fp,
311	unsigned int rate)	311	unsigned int rate)
312	{	312	{
313	struct usb_interface *iface;
314	struct usb_host_interface *alts;	313	struct usb_host_interface *alts;
315	unsigned char *fmt;	314	unsigned char *fmt;
316	unsigned int max_rate;	315	unsigned int max_rate;
317		316
318	iface = usb_ifnum_to_if(chip->dev, fp->iface);	317	alts = snd_usb_get_host_interface(chip, fp->iface, fp->altsetting);
319	if (!iface)	318	if (!alts)
320	return true;	319	return true;
321		320
322	alts = &iface->altsetting[fp->altset_idx];
323	fmt = snd_usb_find_csint_desc(alts->extra, alts->extralen,	321	fmt = snd_usb_find_csint_desc(alts->extra, alts->extralen,
324	NULL, UAC_FORMAT_TYPE);	322	NULL, UAC_FORMAT_TYPE);
325	if (!fmt)	323	if (!fmt)
@@ -328,20 +326,20 @@ static bool focusrite_valid_sample_rate(struct snd_usb_audio *chip, · 2 unmodified lines
328	if (fmt[0] == 10) { /* bLength */	326	if (fmt[0] == 10) { /* bLength */
329	max_rate = combine_quad(&fmt[6]);	327	max_rate = combine_quad(&fmt[6]);
330		328
331	/* Validate max rate */	329	switch (max_rate) {
332	if (max_rate != 48000 &&	330	case 48000:
333	max_rate != 96000 &&	331	return (rate == 44100 \|\| rate == 48000);
334	max_rate != 192000 &&	332	case 96000:
335	max_rate != 384000) {	333	return (rate == 88200 \|\| rate == 96000);
336		334	case 192000:
		335	return (rate == 176400 \|\| rate == 192000);
		336	default:
337	usb_audio_info(chip,	337	usb_audio_info(chip,
338	"%u:%d : unexpected max rate: %u\n",	338	"%u:%d : unexpected max rate: %u\n",
339	fp->iface, fp->altsetting, max_rate);	339	fp->iface, fp->altsetting, max_rate);
340		340
341	return true;	341	return true;
342	}	342	}
343
344	return rate <= max_rate;
345	}	343	}
346		344
347	return true;	345	return true;

tools/arch/x86/include/asm/msr-index.h+1−0

@@ -628,6 +628,7 @@ · 627 unmodified lines
628	#define MSR_AMD64_OSVW_STATUS 0xc0010141	628	#define MSR_AMD64_OSVW_STATUS 0xc0010141
629	#define MSR_AMD_PPIN_CTL 0xc00102f0	629	#define MSR_AMD_PPIN_CTL 0xc00102f0
630	#define MSR_AMD_PPIN 0xc00102f1	630	#define MSR_AMD_PPIN 0xc00102f1
		631	#define MSR_AMD64_CPUID_FN_7 0xc0011002
631	#define MSR_AMD64_CPUID_FN_1 0xc0011004	632	#define MSR_AMD64_CPUID_FN_1 0xc0011004
632	#define MSR_AMD64_LS_CFG 0xc0011020	633	#define MSR_AMD64_LS_CFG 0xc0011020
633	#define MSR_AMD64_DC_CFG 0xc0011022	634	#define MSR_AMD64_DC_CFG 0xc0011022

tools/include/linux/kallsyms.h+4−0

 	return NULL;
 }
+#ifdef HAVE_BACKTRACE_SUPPORT
 #include <execinfo.h>
 #include <stdlib.h>
 static inline void print_ip_sym(const char *loglvl, unsigned long ip)
 	free(name);
 }
+#else
+static inline void print_ip_sym(const char *loglvl, unsigned long ip) {}
+#endif
 #endif

tools/include/uapi/linux/bits.h+2−2

@@ -4,9 +4,9 @@ · 3 unmodified lines
4	#ifndef _UAPI_LINUX_BITS_H	4	#ifndef _UAPI_LINUX_BITS_H
5	#define _UAPI_LINUX_BITS_H	5	#define _UAPI_LINUX_BITS_H
6		6
7	#define __GENMASK(h, l) (((~_UL(0)) << (l)) & (~_UL(0) >> (BITS_PER_LONG - 1 - (h))))	7	#define __GENMASK(h, l) (((~_UL(0)) << (l)) & (~_UL(0) >> (__BITS_PER_LONG - 1 - (h))))
8		8
9	#define __GENMASK_ULL(h, l) (((~_ULL(0)) << (l)) & (~_ULL(0) >> (BITS_PER_LONG_LONG - 1 - (h))))	9	#define __GENMASK_ULL(h, l) (((~_ULL(0)) << (l)) & (~_ULL(0) >> (__BITS_PER_LONG_LONG - 1 - (h))))
10		10
11	#define __GENMASK_U128(h, l) \	11	#define __GENMASK_U128(h, l) \
12	((_BIT128((h)) << 1) - (_BIT128(l)))	12	((_BIT128((h)) << 1) - (_BIT128(l)))

tools/testing/selftests/kvm/x86/monitor_mwait_test.c+1−0

@@ -74,6 +74,7 @@ int main(int argc, char *argv[]) · 73 unmodified lines
74	int testcase;	74	int testcase;
75	char test[80];	75	char test[80];
76		76
		77	TEST_REQUIRE(this_cpu_has(X86_FEATURE_MWAIT));
77	TEST_REQUIRE(kvm_has_cap(KVM_CAP_DISABLE_QUIRKS2));	78	TEST_REQUIRE(kvm_has_cap(KVM_CAP_DISABLE_QUIRKS2));
78		79
79	ksft_print_header();	80	ksft_print_header();

tools/testing/selftests/net/gre_ipv6_lladdr.sh+17−10

 	ip -netns "${NS0}" address add dev lo 2001:db8::10/64 nodad
 }
-# Check if network device has an IPv6 link-local address assigned.
+# Check the IPv6 configuration of a network device.
+#
+# We currently check the generation of the link-local IPv6 address and the
+# creation of the ff00::/8 multicast route.
 #
 # Parameters:
 #
 #         a link-local address)
 #   * $4: The user visible name for the scenario being tested
 #
-check_ipv6_ll_addr()
+check_ipv6_device_config()
 {
 	local DEV="$1"
 	local EXTRA_MATCH="$2"
 	RET=0
 	set +e
 	ip -netns "${NS0}" -6 address show dev "${DEV}" scope link | grep "fe80::" | grep -q "${EXTRA_MATCH}"
-	check_err_fail "${XRET}" $? ""
+	check_err_fail "${XRET}" $? "IPv6 link-local address generation"
+	ip -netns "${NS0}" -6 route show table local type multicast ff00::/8 proto kernel | grep -q "${DEV}"
+	check_err_fail 0 $? "IPv6 multicast route creation"
 	log_test "${MSG}"
 	set -e
 }
 		;;
 	esac
-	# Check that IPv6 link-local address is generated when device goes up
+	# Check the IPv6 device configuration when it goes up
 	ip netns exec "${NS0}" sysctl -qw net.ipv6.conf.gretest.addr_gen_mode="${ADDR_GEN_MODE}"
 	ip -netns "${NS0}" link set dev gretest up
-	check_ipv6_ll_addr gretest "${MATCH_REGEXP}" "${XRET}" "config: ${MSG}"
+	check_ipv6_device_config gretest "${MATCH_REGEXP}" "${XRET}" "config: ${MSG}"
 	# Now disable link-local address generation
 	ip -netns "${NS0}" link set dev gretest down
 	ip netns exec "${NS0}" sysctl -qw net.ipv6.conf.gretest.addr_gen_mode=1
 	ip -netns "${NS0}" link set dev gretest up
-	# Check that link-local address generation works when re-enabled while
+	# Check the IPv6 device configuration when link-local address
-	# the device is already up
+	# generation is re-enabled while the device is already up
 	ip netns exec "${NS0}" sysctl -qw net.ipv6.conf.gretest.addr_gen_mode="${ADDR_GEN_MODE}"
-	check_ipv6_ll_addr gretest "${MATCH_REGEXP}" "${XRET}" "update: ${MSG}"
+	check_ipv6_device_config gretest "${MATCH_REGEXP}" "${XRET}" "update: ${MSG}"
 	ip -netns "${NS0}" link del dev gretest
 }
 	local MODE
 	for GRE_TYPE in "gre" "gretap"; do
-		printf "\n####\nTesting IPv6 link-local address generation on ${GRE_TYPE} devices\n####\n\n"
+		printf "\n####\nTesting IPv6 configuration of ${GRE_TYPE} devices\n####\n\n"
 		for MODE in "eui64" "none" "stable-privacy" "random"; do
 			test_gre_device "${GRE_TYPE}" 192.0.2.10 192.0.2.11 "${MODE}"
 	local MODE
 	for GRE_TYPE in "ip6gre" "ip6gretap"; do
-		printf "\n####\nTesting IPv6 link-local address generation on ${GRE_TYPE} devices\n####\n\n"
+		printf "\n####\nTesting IPv6 configuration of ${GRE_TYPE} devices\n####\n\n"
 		for MODE in "eui64" "none" "stable-privacy" "random"; do
 			test_gre_device "${GRE_TYPE}" 2001:db8::10 2001:db8::11 "${MODE}"

tools/testing/selftests/net/lib.sh+1−1

@@ -312,7 +312,7 @@ log_test_result() · 311 unmodified lines
312	local test_name=$1; shift	312	local test_name=$1; shift
313	local opt_str=$1; shift	313	local opt_str=$1; shift
314	local result=$1; shift	314	local result=$1; shift
315	local retmsg=$1; shift	315	local retmsg=$1
316		316
317	printf "TEST: %-60s [%s]\n" "$test_name $opt_str" "$result"	317	printf "TEST: %-60s [%s]\n" "$test_name $opt_str" "$result"
318	if [[ $retmsg ]]; then	318	if [[ $retmsg ]]; then

tools/testing/selftests/net/packetdrill/tcp_ooo-before-and-after-accept.pkt+53−0

@@ -0,0 +1,53 @@
	1	// SPDX-License-Identifier: GPL-2.0
	2
	3	--mss=1000
	4
	5	`./defaults.sh
	6	sysctl -q net.ipv4.tcp_rmem="4096 131072 $((3210241024))"`
	7
	8	// Test that a not-yet-accepted socket does not change
	9	// its initial sk_rcvbuf (tcp_rmem[1]) when receiving ooo packets.
	10
	11	+0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
	12	+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
	13	+0 bind(3, ..., ...) = 0
	14	+0 listen(3, 1) = 0
	15
	16	+0 < S 0:0(0) win 65535 <mss 1000,nop,nop,sackOK,nop,wscale 7>
	17	+0 > S. 0:0(0) ack 1 <mss 1460,nop,nop,sackOK,nop,wscale 10>
	18	+.1 < . 1:1(0) ack 1 win 257
	19	+0 < . 2001:41001(39000) ack 1 win 257
	20	+0 > . 1:1(0) ack 1 <nop,nop,sack 2001:41001>
	21	+0 < . 41001:101001(60000) ack 1 win 257
	22	+0 > . 1:1(0) ack 1 <nop,nop,sack 2001:101001>
	23	+0 < . 1:1001(1000) ack 1 win 257
	24	+0 > . 1:1(0) ack 1001 <nop,nop,sack 2001:101001>
	25	+0 < . 1001:2001(1000) ack 1 win 257
	26	+0 > . 1:1(0) ack 101001
	27
	28	+0 accept(3, ..., ...) = 4
	29
	30	+0 %{ assert SK_MEMINFO_RCVBUF == 131072, SK_MEMINFO_RCVBUF }%
	31
	32	+0 close(4) = 0
	33	+0 close(3) = 0
	34
	35	// Test that ooo packets for accepted sockets do increase sk_rcvbuf
	36	+0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
	37	+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
	38	+0 bind(3, ..., ...) = 0
	39	+0 listen(3, 1) = 0
	40
	41	+0 < S 0:0(0) win 65535 <mss 1000,nop,nop,sackOK,nop,wscale 7>
	42	+0 > S. 0:0(0) ack 1 <mss 1460,nop,nop,sackOK,nop,wscale 10>
	43	+.1 < . 1:1(0) ack 1 win 257
	44
	45	+0 accept(3, ..., ...) = 4
	46
	47	+0 < . 2001:41001(39000) ack 1 win 257
	48	+0 > . 1:1(0) ack 1 <nop,nop,sack 2001:41001>
	49	+0 < . 41001:101001(60000) ack 1 win 257
	50	+0 > . 1:1(0) ack 1 <nop,nop,sack 2001:101001>
	51
	52	+0 %{ assert SK_MEMINFO_RCVBUF > 131072, SK_MEMINFO_RCVBUF }%
	53

tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json+37−0

@@ -635,5 +635,42 @@ · 634 unmodified lines
635	"$TC qdisc del dev $DUMMY handle 1:0 root",	635	"$TC qdisc del dev $DUMMY handle 1:0 root",
636	"$IP addr del 10.10.10.10/24 dev $DUMMY \|\| true"	636	"$IP addr del 10.10.10.10/24 dev $DUMMY \|\| true"
637	]	637	]
		638	},
		639	{
		640	"id": "d74b",
		641	"name": "Test use-after-free with DRR/NETEM/BLACKHOLE chain",
		642	"category": [
		643	"qdisc",
		644	"hfsc",
		645	"drr",
		646	"netem",
		647	"blackhole"
		648	],
		649	"plugins": {
		650	"requires": [
		651	"nsPlugin",
		652	"scapyPlugin"
		653	]
		654	},
		655	"setup": [
		656	"$IP link set dev $DUMMY up \|\| true",
		657	"$IP addr add 10.10.11.10/24 dev $DUMMY \|\| true",
		658	"$TC qdisc add dev $DUMMY root handle 1: drr",
		659	"$TC filter add dev $DUMMY parent 1: basic classid 1:1",
		660	"$TC class add dev $DUMMY parent 1: classid 1:1 drr",
		661	"$TC qdisc add dev $DUMMY parent 1:1 handle 2: hfsc def 1",
		662	"$TC class add dev $DUMMY parent 2: classid 2:1 hfsc rt m1 8 d 1 m2 0",
		663	"$TC qdisc add dev $DUMMY parent 2:1 handle 3: netem",
		664	"$TC qdisc add dev $DUMMY parent 3:1 handle 4: blackhole",
		665	"ping -c1 -W0.01 -I $DUMMY 10.10.11.11 \|\| true",
		666	"$TC class del dev $DUMMY classid 1:1"
		667	],
		668	"cmdUnderTest": "ping -c1 -W0.01 -I $DUMMY 10.10.11.11",
		669	"expExitCode": "1",
		670	"verifyCmd": "$TC -j class ls dev $DUMMY classid 1:1",
		671	"matchJSON": [],
		672	"teardown": [
		673	"$TC qdisc del dev $DUMMY root handle 1: drr"
		674	]
638	}	675	}
639	]	676	]

virt/kvm/kvm_main.c+3−0

 		r = xa_reserve(&kvm->mem_attr_array, i, GFP_KERNEL_ACCOUNT);
 		if (r)
 			goto out_unlock;
+		cond_resched();
 	}
 	kvm_handle_gfn_range(kvm, &pre_set_range);
 		r = xa_err(xa_store(&kvm->mem_attr_array, i, entry,
 				    GFP_KERNEL_ACCOUNT));
 		KVM_BUG_ON(r, kvm);
+		cond_resched();
 	}
 	kvm_handle_gfn_range(kvm, &post_set_range);

@@ -3135,6 +3135,13 @@ static bool has_sve_feature(const struct arm64_cpu_capabilities *cap, int scope) · 3134 unmodified lines
3135	}	3135	}
3136	#endif	3136	#endif
3137		3137
		3138	#ifdef CONFIG_ARM64_SME
		3139	static bool has_sme_feature(const struct arm64_cpu_capabilities *cap, int scope)
		3140	{
		3141	return system_supports_sme() && has_user_cpuid_feature(cap, scope);
		3142	}
		3143	#endif
		3144
3138	static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = {	3145	static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = {
3139	HWCAP_CAP(ID_AA64ISAR0_EL1, AES, PMULL, CAP_HWCAP, KERNEL_HWCAP_PMULL),	3146	HWCAP_CAP(ID_AA64ISAR0_EL1, AES, PMULL, CAP_HWCAP, KERNEL_HWCAP_PMULL),
3140	HWCAP_CAP(ID_AA64ISAR0_EL1, AES, AES, CAP_HWCAP, KERNEL_HWCAP_AES),	3147	HWCAP_CAP(ID_AA64ISAR0_EL1, AES, AES, CAP_HWCAP, KERNEL_HWCAP_AES),
@@ -3223,31 +3230,31 @@ static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = { · 82 unmodified lines
3223	HWCAP_CAP(ID_AA64ISAR2_EL1, BC, IMP, CAP_HWCAP, KERNEL_HWCAP_HBC),	3230	HWCAP_CAP(ID_AA64ISAR2_EL1, BC, IMP, CAP_HWCAP, KERNEL_HWCAP_HBC),
3224	#ifdef CONFIG_ARM64_SME	3231	#ifdef CONFIG_ARM64_SME
3225	HWCAP_CAP(ID_AA64PFR1_EL1, SME, IMP, CAP_HWCAP, KERNEL_HWCAP_SME),	3232	HWCAP_CAP(ID_AA64PFR1_EL1, SME, IMP, CAP_HWCAP, KERNEL_HWCAP_SME),
3226	HWCAP_CAP(ID_AA64SMFR0_EL1, FA64, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_FA64),	3233	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, FA64, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_FA64),
3227	HWCAP_CAP(ID_AA64SMFR0_EL1, LUTv2, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_LUTV2),	3234	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, LUTv2, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_LUTV2),
3228	HWCAP_CAP(ID_AA64SMFR0_EL1, SMEver, SME2p2, CAP_HWCAP, KERNEL_HWCAP_SME2P2),	3235	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, SMEver, SME2p2, CAP_HWCAP, KERNEL_HWCAP_SME2P2),
3229	HWCAP_CAP(ID_AA64SMFR0_EL1, SMEver, SME2p1, CAP_HWCAP, KERNEL_HWCAP_SME2P1),	3236	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, SMEver, SME2p1, CAP_HWCAP, KERNEL_HWCAP_SME2P1),
3230	HWCAP_CAP(ID_AA64SMFR0_EL1, SMEver, SME2, CAP_HWCAP, KERNEL_HWCAP_SME2),	3237	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, SMEver, SME2, CAP_HWCAP, KERNEL_HWCAP_SME2),
3231	HWCAP_CAP(ID_AA64SMFR0_EL1, I16I64, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_I16I64),	3238	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, I16I64, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_I16I64),
3232	HWCAP_CAP(ID_AA64SMFR0_EL1, F64F64, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F64F64),	3239	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, F64F64, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F64F64),
3233	HWCAP_CAP(ID_AA64SMFR0_EL1, I16I32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_I16I32),	3240	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, I16I32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_I16I32),
3234	HWCAP_CAP(ID_AA64SMFR0_EL1, B16B16, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_B16B16),	3241	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, B16B16, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_B16B16),
3235	HWCAP_CAP(ID_AA64SMFR0_EL1, F16F16, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F16F16),	3242	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, F16F16, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F16F16),
3236	HWCAP_CAP(ID_AA64SMFR0_EL1, F8F16, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F8F16),	3243	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, F8F16, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F8F16),
3237	HWCAP_CAP(ID_AA64SMFR0_EL1, F8F32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F8F32),	3244	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, F8F32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F8F32),
3238	HWCAP_CAP(ID_AA64SMFR0_EL1, I8I32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_I8I32),	3245	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, I8I32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_I8I32),
3239	HWCAP_CAP(ID_AA64SMFR0_EL1, F16F32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F16F32),	3246	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, F16F32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F16F32),
3240	HWCAP_CAP(ID_AA64SMFR0_EL1, B16F32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_B16F32),	3247	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, B16F32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_B16F32),
3241	HWCAP_CAP(ID_AA64SMFR0_EL1, BI32I32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_BI32I32),	3248	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, BI32I32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_BI32I32),
3242	HWCAP_CAP(ID_AA64SMFR0_EL1, F32F32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F32F32),	3249	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, F32F32, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_F32F32),
3243	HWCAP_CAP(ID_AA64SMFR0_EL1, SF8FMA, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SF8FMA),	3250	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, SF8FMA, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SF8FMA),
3244	HWCAP_CAP(ID_AA64SMFR0_EL1, SF8DP4, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SF8DP4),	3251	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, SF8DP4, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SF8DP4),
3245	HWCAP_CAP(ID_AA64SMFR0_EL1, SF8DP2, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SF8DP2),	3252	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, SF8DP2, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SF8DP2),
3246	HWCAP_CAP(ID_AA64SMFR0_EL1, SBitPerm, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SBITPERM),	3253	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, SBitPerm, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SBITPERM),
3247	HWCAP_CAP(ID_AA64SMFR0_EL1, AES, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_AES),	3254	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, AES, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_AES),
3248	HWCAP_CAP(ID_AA64SMFR0_EL1, SFEXPA, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SFEXPA),	3255	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, SFEXPA, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SFEXPA),
3249	HWCAP_CAP(ID_AA64SMFR0_EL1, STMOP, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_STMOP),	3256	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, STMOP, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_STMOP),
3250	HWCAP_CAP(ID_AA64SMFR0_EL1, SMOP4, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SMOP4),	3257	HWCAP_CAP_MATCH_ID(has_sme_feature, ID_AA64SMFR0_EL1, SMOP4, IMP, CAP_HWCAP, KERNEL_HWCAP_SME_SMOP4),
3251	#endif /* CONFIG_ARM64_SME */	3258	#endif /* CONFIG_ARM64_SME */
3252	HWCAP_CAP(ID_AA64FPFR0_EL1, F8CVT, IMP, CAP_HWCAP, KERNEL_HWCAP_F8CVT),	3259	HWCAP_CAP(ID_AA64FPFR0_EL1, F8CVT, IMP, CAP_HWCAP, KERNEL_HWCAP_F8CVT),
3253	HWCAP_CAP(ID_AA64FPFR0_EL1, F8FMA, IMP, CAP_HWCAP, KERNEL_HWCAP_F8FMA),	3260	HWCAP_CAP(ID_AA64FPFR0_EL1, F8FMA, IMP, CAP_HWCAP, KERNEL_HWCAP_F8FMA),