lael-labs/linux

.mailmap+1−0

@@ -327,6 +327,7 @@ Henrik Rydberg <rydberg@bitmath.org> · 326 unmodified lines
327	Herbert Xu <herbert@gondor.apana.org.au>	327	Herbert Xu <herbert@gondor.apana.org.au>
328	Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>	328	Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>
329	Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>	329	Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>
		330	Ignat Korchagin <ignat@linux.win> <ignat@cloudflare.com>
330	Ike Panhc <ikepanhc@gmail.com> <ike.pan@canonical.com>	331	Ike Panhc <ikepanhc@gmail.com> <ike.pan@canonical.com>
331	J. Bruce Fields <bfields@fieldses.org> <bfields@redhat.com>	332	J. Bruce Fields <bfields@fieldses.org> <bfields@redhat.com>
332	J. Bruce Fields <bfields@fieldses.org> <bfields@citi.umich.edu>	333	J. Bruce Fields <bfields@fieldses.org> <bfields@citi.umich.edu>

Documentation/admin-guide/kernel-parameters.txt+3−0

 				p = USB_QUIRK_SHORT_SET_ADDRESS_REQ_TIMEOUT
 					(Reduce timeout of the SET_ADDRESS
 					request from 5000 ms to 500 ms);
+				q = USB_QUIRK_FORCE_ONE_CONFIG (Device
+					claims zero configurations,
+					forcing to 1);
 			Example: quirks=0781:5580:bk,0a5c:5834:gij
 	usbhid.mousepoll=

Documentation/dev-tools/kunit/run_wrapper.rst+2−0

@@ -336,6 +336,8 @@ command line arguments: · 335 unmodified lines
336	- ``--list_tests_attr``: If set, lists all tests that will be run and all of their	336	- ``--list_tests_attr``: If set, lists all tests that will be run and all of their
337	attributes.	337	attributes.
338		338
		339	- ``--list_suites``: If set, lists all suites that will be run.
		340
339	Command-line completion	341	Command-line completion
340	==============================	342	==============================
341		343

Documentation/devicetree/bindings/display/msm/dp-controller.yaml+20−1

@@ -253,7 +253,6 @@ allOf: · 252 unmodified lines
253	enum:	253	enum:
254	# these platforms support 2 streams MST on some interfaces,	254	# these platforms support 2 streams MST on some interfaces,
255	# others are SST only	255	# others are SST only
256	- qcom,glymur-dp
257	- qcom,sc8280xp-dp	256	- qcom,sc8280xp-dp
258	- qcom,x1e80100-dp	257	- qcom,x1e80100-dp
259	then:	258	then:
@@ -310,6 +309,26 @@ allOf: · 50 unmodified lines
310	minItems: 6	309	minItems: 6
311	maxItems: 8	310	maxItems: 8
312		311
		312	- if:
		313	properties:
		314	compatible:
		315	contains:
		316	enum:
		317	# these platforms support 2 streams MST on some interfaces,
		318	# others are SST only, but all controllers have 4 ports
		319	- qcom,glymur-dp
		320	then:
		321	properties:
		322	reg:
		323	minItems: 9
		324	maxItems: 9
		325	clocks:
		326	minItems: 5
		327	maxItems: 6
		328	clocks-names:
		329	minItems: 5
		330	maxItems: 6
		331
313	unevaluatedProperties: false	332	unevaluatedProperties: false
314		333
315	examples:	334	examples:

Documentation/devicetree/bindings/display/msm/qcom,glymur-mdss.yaml+10−6

                 };
             };
-            displayport-controller@ae90000 {
+            displayport-controller@af54000 {
                 compatible = "qcom,glymur-dp";
-                reg = <0xae90000 0x200>,
+                reg = <0xaf54000 0x200>,
-                      <0xae90200 0x200>,
+                      <0xaf54200 0x200>,
-                      <0xae90400 0x600>,
+                      <0xaf55000 0xc00>,
-                      <0xae91000 0x400>,
+                      <0xaf56000 0x400>,
-                      <0xae91400 0x400>;
+                      <0xaf57000 0x400>,
+                      <0xaf58000 0x400>,
+                      <0xaf59000 0x400>,
+                      <0xaf5a000 0x600>,
+                      <0xaf5b000 0x600>;
                 interrupt-parent = <&mdss>;
                 interrupts = <12>;

Documentation/devicetree/bindings/display/msm/qcom,sm8750-mdss.yaml+1−1

@@ -10,7 +10,7 @@ maintainers: · 9 unmodified lines
10	- Krzysztof Kozlowski <krzk@kernel.org>	10	- Krzysztof Kozlowski <krzk@kernel.org>
11		11
12	description:	12	description:
13	SM8650 MSM Mobile Display Subsystem(MDSS), which encapsulates sub-blocks like	13	SM8750 MSM Mobile Display Subsystem(MDSS), which encapsulates sub-blocks like
14	DPU display controller, DSI and DP interfaces etc.	14	DPU display controller, DSI and DP interfaces etc.
15		15
16	$ref: /schemas/display/msm/mdss-common.yaml#	16	$ref: /schemas/display/msm/mdss-common.yaml#

Documentation/devicetree/bindings/i2c/snps,designware-i2c.yaml+1−1

@@ -7,7 +7,7 @@ $schema: http://devicetree.org/meta-schemas/core.yaml# · 6 unmodified lines
7	title: Synopsys DesignWare APB I2C Controller	7	title: Synopsys DesignWare APB I2C Controller
8		8
9	maintainers:	9	maintainers:
10	- Jarkko Nikula <jarkko.nikula@linux.intel.com>	10	- Mika Westerberg <mika.westerberg@linux.intel.com>
11		11
12	allOf:	12	allOf:
13	- $ref: /schemas/i2c/i2c-controller.yaml#	13	- $ref: /schemas/i2c/i2c-controller.yaml#

Documentation/devicetree/bindings/spi/allwinner,sun6i-a31-spi.yaml+24−5

 title: Allwinner A31 SPI Controller
-allOf:
-  - $ref: spi-controller.yaml
 maintainers:
   - Chen-Yu Tsai <wens@csie.org>
   - Maxime Ripard <mripard@kernel.org>
       spi-rx-bus-width:
         items:
-          - const: 1
+          enum: [0, 1, 2, 4]
       spi-tx-bus-width:
         items:
-          - const: 1
+          enum: [0, 1, 2, 4]
 required:
   - compatible
   - clocks
   - clock-names
+allOf:
+  - $ref: spi-controller.yaml
+  - if:
+      not:
+        properties:
+          compatible:
+            contains:
+              enum:
+                - allwinner,sun50i-r329-spi
+                - allwinner,sun55i-a523-spi
+    then:
+      patternProperties:
+        "^.*@[0-9a-f]+":
+          properties:
+            spi-rx-bus-width:
+              items:
+                enum: [0, 1]
+            spi-tx-bus-width:
+              items:
+                enum: [0, 1]
 unevaluatedProperties: false
 examples:

Documentation/netlink/specs/net_shaper.yaml+6−6

@@ -247,8 +247,8 @@ operations: · 246 unmodified lines
247	flags: [admin-perm]	247	flags: [admin-perm]
248		248
249	do:	249	do:
250	pre: net-shaper-nl-pre-doit	250	pre: net-shaper-nl-pre-doit-write
251	post: net-shaper-nl-post-doit	251	post: net-shaper-nl-post-doit-write
252	request:	252	request:
253	attributes:	253	attributes:
254	- ifindex	254	- ifindex
@@ -278,8 +278,8 @@ operations: · 23 unmodified lines
278	flags: [admin-perm]	278	flags: [admin-perm]
279		279
280	do:	280	do:
281	pre: net-shaper-nl-pre-doit	281	pre: net-shaper-nl-pre-doit-write
282	post: net-shaper-nl-post-doit	282	post: net-shaper-nl-post-doit-write
283	request:	283	request:
284	attributes: *ns-binding	284	attributes: *ns-binding
285		285
@@ -309,8 +309,8 @@ operations: · 23 unmodified lines
309	flags: [admin-perm]	309	flags: [admin-perm]
310		310
311	do:	311	do:
312	pre: net-shaper-nl-pre-doit	312	pre: net-shaper-nl-pre-doit-write
313	post: net-shaper-nl-post-doit	313	post: net-shaper-nl-post-doit-write
314	request:	314	request:
315	attributes:	315	attributes:
316	- ifindex	316	- ifindex

Documentation/scheduler/sched-ext.rst+27−3

     CONFIG_DEBUG_INFO_BTF=y
     CONFIG_BPF_JIT_ALWAYS_ON=y
     CONFIG_BPF_JIT_DEFAULT_ON=y
-    CONFIG_PAHOLE_HAS_BTF_TAG=y
 sched_ext is used only when the BPF scheduler is loaded and running.
 However, when the BPF scheduler is loaded and ``SCX_OPS_SWITCH_PARTIAL`` is
 set in ``ops->flags``, only tasks with the ``SCHED_EXT`` policy are scheduled
 by sched_ext, while tasks with ``SCHED_NORMAL``, ``SCHED_BATCH`` and
-``SCHED_IDLE`` policies are scheduled by the fair-class scheduler.
+``SCHED_IDLE`` policies are scheduled by the fair-class scheduler which has
+higher sched_class precedence than ``SCHED_EXT``.
 Terminating the sched_ext scheduler program, triggering `SysRq-S`, or
 detection of any internal error including stalled runnable tasks aborts the
   The functions prefixed with ``scx_bpf_`` can be called from the BPF
   scheduler.
+* ``kernel/sched/ext_idle.c`` contains the built-in idle CPU selection policy.
 * ``tools/sched_ext/`` hosts example BPF scheduler implementations.
   * ``scx_simple[.bpf].c``: Minimal global FIFO scheduler example using a
   * ``scx_qmap[.bpf].c``: A multi-level FIFO scheduler supporting five
     levels of priority implemented with ``BPF_MAP_TYPE_QUEUE``.
+  * ``scx_central[.bpf].c``: A central FIFO scheduler where all scheduling
+    decisions are made on one CPU, demonstrating ``LOCAL_ON`` dispatching,
+    tickless operation, and kthread preemption.
+  * ``scx_cpu0[.bpf].c``: A scheduler that queues all tasks to a shared DSQ
+    and only dispatches them on CPU0 in FIFO order. Useful for testing bypass
+    behavior.
+  * ``scx_flatcg[.bpf].c``: A flattened cgroup hierarchy scheduler
+    implementing hierarchical weight-based cgroup CPU control by compounding
+    each cgroup's share at every level into a single flat scheduling layer.
+  * ``scx_pair[.bpf].c``: A core-scheduling example that always makes
+    sibling CPU pairs execute tasks from the same CPU cgroup.
+  * ``scx_sdt[.bpf].c``: A variation of ``scx_simple`` demonstrating BPF
+    arena memory management for per-task data.
+  * ``scx_userland[.bpf].c``: A minimal scheduler demonstrating user space
+    scheduling. Tasks with CPU affinity are direct-dispatched in FIFO order;
+    all others are scheduled in user space by a simple vruntime scheduler.
 ABI Instability
 ===============
 The APIs provided by sched_ext to BPF schedulers programs have no stability
 guarantees. This includes the ops table callbacks and constants defined in
 ``include/linux/sched/ext.h``, as well as the ``scx_bpf_`` kfuncs defined in
-``kernel/sched/ext.c``.
+``kernel/sched/ext.c`` and ``kernel/sched/ext_idle.c``.
 While we will attempt to provide a relatively stable API surface when
 possible, they are subject to change without warning between kernel

Documentation/virt/kvm/api.rst+117−109

Documentation/virt/kvm/locking.rst+2−0

@@ -17,6 +17,8 @@ The acquisition orders for mutexes are as follows: · 16 unmodified lines
17		17
18	- kvm->lock is taken outside kvm->slots_lock and kvm->irq_lock	18	- kvm->lock is taken outside kvm->slots_lock and kvm->irq_lock
19		19
		20	- vcpu->mutex is taken outside kvm->slots_lock and kvm->slots_arch_lock
		21
20	- kvm->slots_lock is taken outside kvm->irq_lock, though acquiring	22	- kvm->slots_lock is taken outside kvm->irq_lock, though acquiring
21	them together is quite rare.	23	them together is quite rare.
22		24

MAINTAINERS+6−7

 ASYMMETRIC KEYS
 M:	David Howells <dhowells@redhat.com>
 M:	Lukas Wunner <lukas@wunner.de>
-M:	Ignat Korchagin <ignat@cloudflare.com>
+M:	Ignat Korchagin <ignat@linux.win>
 L:	keyrings@vger.kernel.org
 L:	linux-crypto@vger.kernel.org
 S:	Maintained
 ASYMMETRIC KEYS - ECDSA
 M:	Lukas Wunner <lukas@wunner.de>
-M:	Ignat Korchagin <ignat@cloudflare.com>
+M:	Ignat Korchagin <ignat@linux.win>
 R:	Stefan Berger <stefanb@linux.ibm.com>
 L:	linux-crypto@vger.kernel.org
 S:	Maintained
 ASYMMETRIC KEYS - GOST
 M:	Lukas Wunner <lukas@wunner.de>
-M:	Ignat Korchagin <ignat@cloudflare.com>
+M:	Ignat Korchagin <ignat@linux.win>
 L:	linux-crypto@vger.kernel.org
 S:	Odd fixes
 F:	crypto/ecrdsa*
 ASYMMETRIC KEYS - RSA
 M:	Lukas Wunner <lukas@wunner.de>
-M:	Ignat Korchagin <ignat@cloudflare.com>
+M:	Ignat Korchagin <ignat@linux.win>
 L:	linux-crypto@vger.kernel.org
 S:	Maintained
 F:	crypto/rsa*
 F:	include/uapi/drm/lima_drm.h
 DRM DRIVERS FOR LOONGSON
-M:	Sui Jingfeng <suijingfeng@loongson.cn>
 L:	dri-devel@lists.freedesktop.org
-S:	Supported
+S:	Orphan
 T:	git https://gitlab.freedesktop.org/drm/misc/kernel.git
 F:	drivers/gpu/drm/loongson/
 RADOS BLOCK DEVICE (RBD)
 M:	Ilya Dryomov <idryomov@gmail.com>
-R:	Dongsheng Yang <dongsheng.yang@easystack.cn>
+R:	Dongsheng Yang <dongsheng.yang@linux.dev>
 L:	ceph-devel@vger.kernel.org
 S:	Supported
 W:	http://ceph.com/

Makefile+5−1

 VERSION = 7
 PATCHLEVEL = 0
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME = Baby Opossum Posse
 # *DOCUMENTATION*
 export rust_common_flags := --edition=2021 \
 			    -Zbinary_dep_depinfo=y \
 			    -Astable_features \
+			    -Aunused_features \
 			    -Dnon_ascii_idents \
 			    -Dunsafe_op_in_unsafe_fn \
 			    -Wmissing_docs \
 # change __FILE__ to the relative path to the source directory
 ifdef building_out_of_srctree
 KBUILD_CPPFLAGS += -fmacro-prefix-map=$(srcroot)/=
+ifeq ($(call rustc-option-yn, --remap-path-scope=macro),y)
+KBUILD_RUSTFLAGS += --remap-path-prefix=$(srcroot)/= --remap-path-scope=macro
+endif
 endif
 # include additional Makefiles when needed

arch/arm/configs/multi_v7_defconfig+0−1

@@ -279,7 +279,6 @@ CONFIG_TI_CPSW_SWITCHDEV=y · 278 unmodified lines
279	CONFIG_TI_CPTS=y	279	CONFIG_TI_CPTS=y
280	CONFIG_TI_KEYSTONE_NETCP=y	280	CONFIG_TI_KEYSTONE_NETCP=y
281	CONFIG_TI_KEYSTONE_NETCP_ETHSS=y	281	CONFIG_TI_KEYSTONE_NETCP_ETHSS=y
282	CONFIG_TI_PRUSS=m
283	CONFIG_TI_PRUETH=m	282	CONFIG_TI_PRUETH=m
284	CONFIG_XILINX_EMACLITE=y	283	CONFIG_XILINX_EMACLITE=y
285	CONFIG_SFP=m	284	CONFIG_SFP=m

arch/arm64/boot/dts/renesas/r8a78000.dtsi+8−8

@@ -698,7 +698,7 @@ · 697 unmodified lines
698	compatible = "renesas,scif-r8a78000",	698	compatible = "renesas,scif-r8a78000",
699	"renesas,rcar-gen5-scif", "renesas,scif";	699	"renesas,rcar-gen5-scif", "renesas,scif";
700	reg = <0 0xc0700000 0 0x40>;	700	reg = <0 0xc0700000 0 0x40>;
701	interrupts = <GIC_SPI 4074 IRQ_TYPE_LEVEL_HIGH>;	701	interrupts = <GIC_ESPI 10 IRQ_TYPE_LEVEL_HIGH>;
702	clocks = <&dummy_clk_sgasyncd16>, <&dummy_clk_sgasyncd16>, <&scif_clk>;	702	clocks = <&dummy_clk_sgasyncd16>, <&dummy_clk_sgasyncd16>, <&scif_clk>;
703	clock-names = "fck", "brg_int", "scif_clk";	703	clock-names = "fck", "brg_int", "scif_clk";
704	status = "disabled";	704	status = "disabled";
@@ -708,7 +708,7 @@ · 3 unmodified lines
708	compatible = "renesas,scif-r8a78000",	708	compatible = "renesas,scif-r8a78000",
709	"renesas,rcar-gen5-scif", "renesas,scif";	709	"renesas,rcar-gen5-scif", "renesas,scif";
710	reg = <0 0xc0704000 0 0x40>;	710	reg = <0 0xc0704000 0 0x40>;
711	interrupts = <GIC_SPI 4075 IRQ_TYPE_LEVEL_HIGH>;	711	interrupts = <GIC_ESPI 11 IRQ_TYPE_LEVEL_HIGH>;
712	clocks = <&dummy_clk_sgasyncd16>, <&dummy_clk_sgasyncd16>, <&scif_clk>;	712	clocks = <&dummy_clk_sgasyncd16>, <&dummy_clk_sgasyncd16>, <&scif_clk>;
713	clock-names = "fck", "brg_int", "scif_clk";	713	clock-names = "fck", "brg_int", "scif_clk";
714	status = "disabled";	714	status = "disabled";
@@ -718,7 +718,7 @@ · 3 unmodified lines
718	compatible = "renesas,scif-r8a78000",	718	compatible = "renesas,scif-r8a78000",
719	"renesas,rcar-gen5-scif", "renesas,scif";	719	"renesas,rcar-gen5-scif", "renesas,scif";
720	reg = <0 0xc0708000 0 0x40>;	720	reg = <0 0xc0708000 0 0x40>;
721	interrupts = <GIC_SPI 4076 IRQ_TYPE_LEVEL_HIGH>;	721	interrupts = <GIC_ESPI 12 IRQ_TYPE_LEVEL_HIGH>;
722	clocks = <&dummy_clk_sgasyncd16>, <&dummy_clk_sgasyncd16>, <&scif_clk>;	722	clocks = <&dummy_clk_sgasyncd16>, <&dummy_clk_sgasyncd16>, <&scif_clk>;
723	clock-names = "fck", "brg_int", "scif_clk";	723	clock-names = "fck", "brg_int", "scif_clk";
724	status = "disabled";	724	status = "disabled";
@@ -728,7 +728,7 @@ · 3 unmodified lines
728	compatible = "renesas,scif-r8a78000",	728	compatible = "renesas,scif-r8a78000",
729	"renesas,rcar-gen5-scif", "renesas,scif";	729	"renesas,rcar-gen5-scif", "renesas,scif";
730	reg = <0 0xc070c000 0 0x40>;	730	reg = <0 0xc070c000 0 0x40>;
731	interrupts = <GIC_SPI 4077 IRQ_TYPE_LEVEL_HIGH>;	731	interrupts = <GIC_ESPI 13 IRQ_TYPE_LEVEL_HIGH>;
732	clocks = <&dummy_clk_sgasyncd16>, <&dummy_clk_sgasyncd16>, <&scif_clk>;	732	clocks = <&dummy_clk_sgasyncd16>, <&dummy_clk_sgasyncd16>, <&scif_clk>;
733	clock-names = "fck", "brg_int", "scif_clk";	733	clock-names = "fck", "brg_int", "scif_clk";
734	status = "disabled";	734	status = "disabled";
@@ -738,7 +738,7 @@ · 3 unmodified lines
738	compatible = "renesas,hscif-r8a78000",	738	compatible = "renesas,hscif-r8a78000",
739	"renesas,rcar-gen5-hscif", "renesas,hscif";	739	"renesas,rcar-gen5-hscif", "renesas,hscif";
740	reg = <0 0xc0710000 0 0x60>;	740	reg = <0 0xc0710000 0 0x60>;
741	interrupts = <GIC_SPI 4078 IRQ_TYPE_LEVEL_HIGH>;	741	interrupts = <GIC_ESPI 14 IRQ_TYPE_LEVEL_HIGH>;
742	clocks = <&dummy_clk_sgasyncd4>, <&dummy_clk_sgasyncd4>, <&scif_clk>;	742	clocks = <&dummy_clk_sgasyncd4>, <&dummy_clk_sgasyncd4>, <&scif_clk>;
743	clock-names = "fck", "brg_int", "scif_clk";	743	clock-names = "fck", "brg_int", "scif_clk";
744	status = "disabled";	744	status = "disabled";
@@ -748,7 +748,7 @@ · 3 unmodified lines
748	compatible = "renesas,hscif-r8a78000",	748	compatible = "renesas,hscif-r8a78000",
749	"renesas,rcar-gen5-hscif", "renesas,hscif";	749	"renesas,rcar-gen5-hscif", "renesas,hscif";
750	reg = <0 0xc0714000 0 0x60>;	750	reg = <0 0xc0714000 0 0x60>;
751	interrupts = <GIC_SPI 4079 IRQ_TYPE_LEVEL_HIGH>;	751	interrupts = <GIC_ESPI 15 IRQ_TYPE_LEVEL_HIGH>;
752	clocks = <&dummy_clk_sgasyncd4>, <&dummy_clk_sgasyncd4>, <&scif_clk>;	752	clocks = <&dummy_clk_sgasyncd4>, <&dummy_clk_sgasyncd4>, <&scif_clk>;
753	clock-names = "fck", "brg_int", "scif_clk";	753	clock-names = "fck", "brg_int", "scif_clk";
754	status = "disabled";	754	status = "disabled";
@@ -758,7 +758,7 @@ · 3 unmodified lines
758	compatible = "renesas,hscif-r8a78000",	758	compatible = "renesas,hscif-r8a78000",
759	"renesas,rcar-gen5-hscif", "renesas,hscif";	759	"renesas,rcar-gen5-hscif", "renesas,hscif";
760	reg = <0 0xc0718000 0 0x60>;	760	reg = <0 0xc0718000 0 0x60>;
761	interrupts = <GIC_SPI 4080 IRQ_TYPE_LEVEL_HIGH>;	761	interrupts = <GIC_ESPI 16 IRQ_TYPE_LEVEL_HIGH>;
762	clocks = <&dummy_clk_sgasyncd4>, <&dummy_clk_sgasyncd4>, <&scif_clk>;	762	clocks = <&dummy_clk_sgasyncd4>, <&dummy_clk_sgasyncd4>, <&scif_clk>;
763	clock-names = "fck", "brg_int", "scif_clk";	763	clock-names = "fck", "brg_int", "scif_clk";
764	status = "disabled";	764	status = "disabled";
@@ -768,7 +768,7 @@ · 3 unmodified lines
768	compatible = "renesas,hscif-r8a78000",	768	compatible = "renesas,hscif-r8a78000",
769	"renesas,rcar-gen5-hscif", "renesas,hscif";	769	"renesas,rcar-gen5-hscif", "renesas,hscif";
770	reg = <0 0xc071c000 0 0x60>;	770	reg = <0 0xc071c000 0 0x60>;
771	interrupts = <GIC_SPI 4081 IRQ_TYPE_LEVEL_HIGH>;	771	interrupts = <GIC_ESPI 17 IRQ_TYPE_LEVEL_HIGH>;
772	clocks = <&dummy_clk_sgasyncd4>, <&dummy_clk_sgasyncd4>, <&scif_clk>;	772	clocks = <&dummy_clk_sgasyncd4>, <&dummy_clk_sgasyncd4>, <&scif_clk>;
773	clock-names = "fck", "brg_int", "scif_clk";	773	clock-names = "fck", "brg_int", "scif_clk";
774	status = "disabled";	774	status = "disabled";

arch/arm64/boot/dts/renesas/r9a09g057.dtsi+0−30

@@ -581,16 +581,6 @@ · 580 unmodified lines
581	status = "disabled";	581	status = "disabled";
582	};	582	};
583		583
584	wdt0: watchdog@11c00400 {
585	compatible = "renesas,r9a09g057-wdt";
586	reg = <0 0x11c00400 0 0x400>;
587	clocks = <&cpg CPG_MOD 0x4b>, <&cpg CPG_MOD 0x4c>;
588	clock-names = "pclk", "oscclk";
589	resets = <&cpg 0x75>;
590	power-domains = <&cpg>;
591	status = "disabled";
592	};
593
594	wdt1: watchdog@14400000 {	584	wdt1: watchdog@14400000 {
595	compatible = "renesas,r9a09g057-wdt";	585	compatible = "renesas,r9a09g057-wdt";
596	reg = <0 0x14400000 0 0x400>;	586	reg = <0 0x14400000 0 0x400>;
@@ -601,26 +591,6 @@ · 4 unmodified lines
601	status = "disabled";	591	status = "disabled";
602	};	592	};
603		593
604	wdt2: watchdog@13000000 {
605	compatible = "renesas,r9a09g057-wdt";
606	reg = <0 0x13000000 0 0x400>;
607	clocks = <&cpg CPG_MOD 0x4f>, <&cpg CPG_MOD 0x50>;
608	clock-names = "pclk", "oscclk";
609	resets = <&cpg 0x77>;
610	power-domains = <&cpg>;
611	status = "disabled";
612	};
613
614	wdt3: watchdog@13000400 {
615	compatible = "renesas,r9a09g057-wdt";
616	reg = <0 0x13000400 0 0x400>;
617	clocks = <&cpg CPG_MOD 0x51>, <&cpg CPG_MOD 0x52>;
618	clock-names = "pclk", "oscclk";
619	resets = <&cpg 0x78>;
620	power-domains = <&cpg>;
621	status = "disabled";
622	};
623
624	rtc: rtc@11c00800 {	594	rtc: rtc@11c00800 {
625	compatible = "renesas,r9a09g057-rtca3", "renesas,rz-rtca3";	595	compatible = "renesas,r9a09g057-rtca3", "renesas,rz-rtca3";
626	reg = <0 0x11c00800 0 0x400>;	596	reg = <0 0x11c00800 0 0x400>;

arch/arm64/boot/dts/renesas/r9a09g077.dtsi+2−2

@@ -974,8 +974,8 @@ · 973 unmodified lines
974		974
975	cpg: clock-controller@80280000 {	975	cpg: clock-controller@80280000 {
976	compatible = "renesas,r9a09g077-cpg-mssr";	976	compatible = "renesas,r9a09g077-cpg-mssr";
977	reg = <0 0x80280000 0 0x1000>,	977	reg = <0 0x80280000 0 0x10000>,
978	<0 0x81280000 0 0x9000>;	978	<0 0x81280000 0 0x10000>;
979	clocks = <&extal_clk>;	979	clocks = <&extal_clk>;
980	clock-names = "extal";	980	clock-names = "extal";
981	#clock-cells = <2>;	981	#clock-cells = <2>;

arch/arm64/boot/dts/renesas/r9a09g087.dtsi+2−2

@@ -977,8 +977,8 @@ · 976 unmodified lines
977		977
978	cpg: clock-controller@80280000 {	978	cpg: clock-controller@80280000 {
979	compatible = "renesas,r9a09g087-cpg-mssr";	979	compatible = "renesas,r9a09g087-cpg-mssr";
980	reg = <0 0x80280000 0 0x1000>,	980	reg = <0 0x80280000 0 0x10000>,
981	<0 0x81280000 0 0x9000>;	981	<0 0x81280000 0 0x10000>;
982	clocks = <&extal_clk>;	982	clocks = <&extal_clk>;
983	clock-names = "extal";	983	clock-names = "extal";
984	#clock-cells = <2>;	984	#clock-cells = <2>;

arch/arm64/boot/dts/renesas/rzg3s-smarc-som.dtsi+1−1

@@ -162,7 +162,7 @@ · 161 unmodified lines
162	<100000000>;	162	<100000000>;
163	renesas,settings = [	163	renesas,settings = [
164	80 00 11 19 4c 42 dc 2f 06 7d 20 1a 5f 1e f2 27	164	80 00 11 19 4c 42 dc 2f 06 7d 20 1a 5f 1e f2 27
165	00 40 00 00 00 00 00 00 06 0c 19 02 3f f0 90 86	165	00 40 00 00 00 00 00 00 06 0c 19 02 3b f0 90 86
166	a0 80 30 30 9c	166	a0 80 30 30 9c
167	];	167	];
168	};	168	};

arch/arm64/boot/dts/renesas/rzt2h-n2h-evk-common.dtsi+1−0

@@ -53,6 +53,7 @@ · 52 unmodified lines
53	regulator-max-microvolt = <3300000>;	53	regulator-max-microvolt = <3300000>;
54	gpios-states = <0>;	54	gpios-states = <0>;
55	states = <3300000 0>, <1800000 1>;	55	states = <3300000 0>, <1800000 1>;
		56	regulator-ramp-delay = <60>;
56	};	57	};
57	#endif	58	#endif
58		59

arch/arm64/boot/dts/renesas/rzv2-evk-cn15-sd.dtso+1−0

@@ -25,6 +25,7 @@ · 24 unmodified lines
25	regulator-max-microvolt = <3300000>;	25	regulator-max-microvolt = <3300000>;
26	gpios-states = <0>;	26	gpios-states = <0>;
27	states = <3300000 0>, <1800000 1>;	27	states = <3300000 0>, <1800000 1>;
		28	regulator-ramp-delay = <60>;
28	};	29	};
29	};	30	};
30		31

arch/arm64/crypto/aes-neonbs-glue.c+23−14

@@ -76,19 +76,24 @@ static int aesbs_setkey(struct crypto_skcipher tfm, const u8 in_key, · 75 unmodified lines
76	unsigned int key_len)	76	unsigned int key_len)
77	{	77	{
78	struct aesbs_ctx *ctx = crypto_skcipher_ctx(tfm);	78	struct aesbs_ctx *ctx = crypto_skcipher_ctx(tfm);
79	struct crypto_aes_ctx rk;	79	struct crypto_aes_ctx *rk;
80	int err;	80	int err;
81		81
82	err = aes_expandkey(&rk, in_key, key_len);	82	rk = kmalloc(sizeof(*rk), GFP_KERNEL);
		83	if (!rk)
		84	return -ENOMEM;
		85
		86	err = aes_expandkey(rk, in_key, key_len);
83	if (err)	87	if (err)
84	return err;	88	goto out;
85		89
86	ctx->rounds = 6 + key_len / 4;	90	ctx->rounds = 6 + key_len / 4;
87		91
88	scoped_ksimd()	92	scoped_ksimd()
89	aesbs_convert_key(ctx->rk, rk.key_enc, ctx->rounds);	93	aesbs_convert_key(ctx->rk, rk->key_enc, ctx->rounds);
90		94	out:
91	return 0;	95	kfree_sensitive(rk);
		96	return err;
92	}	97	}
93		98
94	static int __ecb_crypt(struct skcipher_request *req,	99	static int __ecb_crypt(struct skcipher_request *req,
@@ -133,22 +138,26 @@ static int aesbs_cbc_ctr_setkey(struct crypto_skcipher tfm, const u8 in_key, · 38 unmodified lines
133	unsigned int key_len)	138	unsigned int key_len)
134	{	139	{
135	struct aesbs_cbc_ctr_ctx *ctx = crypto_skcipher_ctx(tfm);	140	struct aesbs_cbc_ctr_ctx *ctx = crypto_skcipher_ctx(tfm);
136	struct crypto_aes_ctx rk;	141	struct crypto_aes_ctx *rk;
137	int err;	142	int err;
138		143
139	err = aes_expandkey(&rk, in_key, key_len);	144	rk = kmalloc(sizeof(*rk), GFP_KERNEL);
		145	if (!rk)
		146	return -ENOMEM;
		147
		148	err = aes_expandkey(rk, in_key, key_len);
140	if (err)	149	if (err)
141	return err;	150	goto out;
142		151
143	ctx->key.rounds = 6 + key_len / 4;	152	ctx->key.rounds = 6 + key_len / 4;
144		153
145	memcpy(ctx->enc, rk.key_enc, sizeof(ctx->enc));	154	memcpy(ctx->enc, rk->key_enc, sizeof(ctx->enc));
146		155
147	scoped_ksimd()	156	scoped_ksimd()
148	aesbs_convert_key(ctx->key.rk, rk.key_enc, ctx->key.rounds);	157	aesbs_convert_key(ctx->key.rk, rk->key_enc, ctx->key.rounds);
149	memzero_explicit(&rk, sizeof(rk));	158	out:
150		159	kfree_sensitive(rk);
151	return 0;	160	return err;
152	}	161	}
153		162
154	static int cbc_encrypt(struct skcipher_request *req)	163	static int cbc_encrypt(struct skcipher_request *req)

arch/arm64/include/asm/kvm_host.h+3−0

@@ -784,6 +784,9 @@ struct kvm_host_data { · 783 unmodified lines
784	/* Number of debug breakpoints/watchpoints for this CPU (minus 1) */	784	/* Number of debug breakpoints/watchpoints for this CPU (minus 1) */
785	unsigned int debug_brps;	785	unsigned int debug_brps;
786	unsigned int debug_wrps;	786	unsigned int debug_wrps;
		787
		788	/* Last vgic_irq part of the AP list recorded in an LR */
		789	struct vgic_irq *last_lr_irq;
787	};	790	};
788		791
789	struct kvm_host_psci_config {	792	struct kvm_host_psci_config {

arch/arm64/kernel/cpufeature.c+9−0

@@ -2345,6 +2345,15 @@ static bool can_trap_icv_dir_el1(const struct arm64_cpu_capabilities *entry, · 2344 unmodified lines
2345	!is_midr_in_range_list(has_vgic_v3))	2345	!is_midr_in_range_list(has_vgic_v3))
2346	return false;	2346	return false;
2347		2347
		2348	/*
		2349	* pKVM prevents late onlining of CPUs. This means that whatever
		2350	* state the capability is in after deprivilege cannot be affected
		2351	* by a new CPU booting -- this is garanteed to be a CPU we have
		2352	* already seen, and the cap is therefore unchanged.
		2353	*/
		2354	if (system_capabilities_finalized() && is_protected_kvm_enabled())
		2355	return cpus_have_final_cap(ARM64_HAS_ICH_HCR_EL2_TDIR);
		2356
2348	if (is_kernel_in_hyp_mode())	2357	if (is_kernel_in_hyp_mode())
2349	res.a1 = read_sysreg_s(SYS_ICH_VTR_EL2);	2358	res.a1 = read_sysreg_s(SYS_ICH_VTR_EL2);
2350	else	2359	else

arch/arm64/kvm/at.c+0−2

@@ -1504,8 +1504,6 @@ int __kvm_at_s1e2(struct kvm_vcpu *vcpu, u32 op, u64 vaddr) · 1503 unmodified lines
1504	fail = true;	1504	fail = true;
1505	}	1505	}
1506		1506
1507	isb();
1508
1509	if (!fail)	1507	if (!fail)
1510	par = read_sysreg_par();	1508	par = read_sysreg_par();
1511		1509

arch/arm64/kvm/guest.c+2−2

@@ -29,7 +29,7 @@ · 28 unmodified lines
29		29
30	#include "trace.h"	30	#include "trace.h"
31		31
32	const struct _kvm_stats_desc kvm_vm_stats_desc[] = {	32	const struct kvm_stats_desc kvm_vm_stats_desc[] = {
33	KVM_GENERIC_VM_STATS()	33	KVM_GENERIC_VM_STATS()
34	};	34	};
35		35
@@ -42,7 +42,7 @@ const struct kvm_stats_header kvm_vm_stats_header = { · 6 unmodified lines
42	sizeof(kvm_vm_stats_desc),	42	sizeof(kvm_vm_stats_desc),
43	};	43	};
44		44
45	const struct _kvm_stats_desc kvm_vcpu_stats_desc[] = {	45	const struct kvm_stats_desc kvm_vcpu_stats_desc[] = {
46	KVM_GENERIC_VCPU_STATS(),	46	KVM_GENERIC_VCPU_STATS(),
47	STATS_DESC_COUNTER(VCPU, hvc_exit_stat),	47	STATS_DESC_COUNTER(VCPU, hvc_exit_stat),
48	STATS_DESC_COUNTER(VCPU, wfe_exit_stat),	48	STATS_DESC_COUNTER(VCPU, wfe_exit_stat),

arch/arm64/kvm/hyp/nvhe/mem_protect.c+1−1

@@ -518,7 +518,7 @@ static int host_stage2_adjust_range(u64 addr, struct kvm_mem_range *range) · 517 unmodified lines
518	granule = kvm_granule_size(level);	518	granule = kvm_granule_size(level);
519	cur.start = ALIGN_DOWN(addr, granule);	519	cur.start = ALIGN_DOWN(addr, granule);
520	cur.end = cur.start + granule;	520	cur.end = cur.start + granule;
521	if (!range_included(&cur, range))	521	if (!range_included(&cur, range) && level < KVM_PGTABLE_LAST_LEVEL)
522	continue;	522	continue;
523	*range = cur;	523	*range = cur;
524	return 0;	524	return 0;

arch/arm64/kvm/mmu.c+9−5

 		force_pte = (max_map_size == PAGE_SIZE);
 		vma_pagesize = min_t(long, vma_pagesize, max_map_size);
+		vma_shift = __ffs(vma_pagesize);
 	}
 	/*
 	if (exec_fault && s2_force_noncacheable)
 		ret = -ENOEXEC;
-	if (ret) {
+	if (ret)
-		kvm_release_page_unused(page);
+		goto out_put_page;
-		return ret;
-	}
 	/*
 	 * Guest performs atomic/exclusive operations on memory with unsupported
 	 */
 	if (esr_fsc_is_excl_atomic_fault(kvm_vcpu_get_esr(vcpu))) {
 		kvm_inject_dabt_excl_atomic(vcpu, kvm_vcpu_get_hfar(vcpu));
-		return 1;
+		ret = 1;
+		goto out_put_page;
 	}
 	if (nested)
 		mark_page_dirty_in_slot(kvm, memslot, gfn);
 	return ret != -EAGAIN ? ret : 0;
+out_put_page:
+	kvm_release_page_unused(page);
+	return ret;
 }
 /* Resolve the access fault by making the page young again. */

arch/arm64/kvm/nested.c+16−11

 	return 64 - wi->t0sz;
 }
-static int check_base_s2_limits(struct s2_walk_info *wi,
+static int check_base_s2_limits(struct kvm_vcpu *vcpu, struct s2_walk_info *wi,
 				int level, int input_size, int stride)
 {
-	int start_size, ia_size;
+	int start_size, pa_max;
-	ia_size = get_ia_size(wi);
+	pa_max = kvm_get_pa_bits(vcpu->kvm);
 	/* Check translation limits */
 	switch (BIT(wi->pgshift)) {
 	case SZ_64K:
-		if (level == 0 || (level == 1 && ia_size <= 42))
+		if (level == 0 || (level == 1 && pa_max <= 42))
 			return -EFAULT;
 		break;
 	case SZ_16K:
-		if (level == 0 || (level == 1 && ia_size <= 40))
+		if (level == 0 || (level == 1 && pa_max <= 40))
 			return -EFAULT;
 		break;
 	case SZ_4K:
-		if (level < 0 || (level == 0 && ia_size <= 42))
+		if (level < 0 || (level == 0 && pa_max <= 42))
 			return -EFAULT;
 		break;
 	}
 	/* Check input size limits */
-	if (input_size > ia_size)
+	if (input_size > pa_max)
 		return -EFAULT;
 	/* Check number of entries in starting level table */
 	if (input_size > 48 || input_size < 25)
 		return -EFAULT;
-	ret = check_base_s2_limits(wi, level, input_size, stride);
+	ret = check_base_s2_limits(vcpu, wi, level, input_size, stride);
-	if (WARN_ON(ret))
+	if (WARN_ON(ret)) {
+		out->esr = compute_fsc(0, ESR_ELx_FSC_FAULT);
 		return ret;
+	}
 	base_lower_bound = 3 + input_size - ((3 - level) * stride +
 			   wi->pgshift);
 	base_addr = wi->baddr & GENMASK_ULL(47, base_lower_bound);
 	if (check_output_size(wi, base_addr)) {
-		out->esr = compute_fsc(level, ESR_ELx_FSC_ADDRSZ);
+		/* R_BFHQH */
+		out->esr = compute_fsc(0, ESR_ELx_FSC_ADDRSZ);
 		return 1;
 	}
 		paddr = base_addr | index;
 		ret = read_guest_s2_desc(vcpu, paddr, &desc, wi);
-		if (ret < 0)
+		if (ret < 0) {
+			out->esr = ESR_ELx_FSC_SEA_TTW(level);
 			return ret;
+		}
 		new_desc = desc;

arch/arm64/kvm/vgic/vgic-init.c+16−16

 	kvm->arch.vgic.in_kernel = true;
 	kvm->arch.vgic.vgic_model = type;
 	kvm->arch.vgic.implementation_rev = KVM_VGIC_IMP_REV_LATEST;
+	kvm->arch.vgic.vgic_dist_base = VGIC_ADDR_UNDEF;
+	aa64pfr0 = kvm_read_vm_id_reg(kvm, SYS_ID_AA64PFR0_EL1) & ~ID_AA64PFR0_EL1_GIC;
+	pfr1 = kvm_read_vm_id_reg(kvm, SYS_ID_PFR1_EL1) & ~ID_PFR1_EL1_GIC;
+	if (type == KVM_DEV_TYPE_ARM_VGIC_V2) {
+		kvm->arch.vgic.vgic_cpu_base = VGIC_ADDR_UNDEF;
+	} else {
+		INIT_LIST_HEAD(&kvm->arch.vgic.rd_regions);
+		aa64pfr0 |= SYS_FIELD_PREP_ENUM(ID_AA64PFR0_EL1, GIC, IMP);
+		pfr1 |= SYS_FIELD_PREP_ENUM(ID_PFR1_EL1, GIC, GICv3);
+	}
+	kvm_set_vm_id_reg(kvm, SYS_ID_AA64PFR0_EL1, aa64pfr0);
+	kvm_set_vm_id_reg(kvm, SYS_ID_PFR1_EL1, pfr1);
 	kvm_for_each_vcpu(i, vcpu, kvm) {
 		ret = vgic_allocate_private_irqs_locked(vcpu, type);
 			vgic_cpu->private_irqs = NULL;
 		}
+		kvm->arch.vgic.vgic_model = 0;
 		goto out_unlock;
 	}
-	kvm->arch.vgic.vgic_dist_base = VGIC_ADDR_UNDEF;
-	aa64pfr0 = kvm_read_vm_id_reg(kvm, SYS_ID_AA64PFR0_EL1) & ~ID_AA64PFR0_EL1_GIC;
-	pfr1 = kvm_read_vm_id_reg(kvm, SYS_ID_PFR1_EL1) & ~ID_PFR1_EL1_GIC;
-	if (type == KVM_DEV_TYPE_ARM_VGIC_V2) {
-		kvm->arch.vgic.vgic_cpu_base = VGIC_ADDR_UNDEF;
-	} else {
-		INIT_LIST_HEAD(&kvm->arch.vgic.rd_regions);
-		aa64pfr0 |= SYS_FIELD_PREP_ENUM(ID_AA64PFR0_EL1, GIC, IMP);
-		pfr1 |= SYS_FIELD_PREP_ENUM(ID_PFR1_EL1, GIC, GICv3);
-	}
-	kvm_set_vm_id_reg(kvm, SYS_ID_AA64PFR0_EL1, aa64pfr0);
-	kvm_set_vm_id_reg(kvm, SYS_ID_PFR1_EL1, pfr1);
 	if (type == KVM_DEV_TYPE_ARM_VGIC_V3)
 		kvm->arch.vgic.nassgicap = system_supports_direct_sgis();

arch/arm64/kvm/vgic/vgic-v2.c+2−2

@@ -115,7 +115,7 @@ void vgic_v2_fold_lr_state(struct kvm_vcpu *vcpu) · 114 unmodified lines
115	struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;	115	struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
116	struct vgic_v2_cpu_if *cpuif = &vgic_cpu->vgic_v2;	116	struct vgic_v2_cpu_if *cpuif = &vgic_cpu->vgic_v2;
117	u32 eoicount = FIELD_GET(GICH_HCR_EOICOUNT, cpuif->vgic_hcr);	117	u32 eoicount = FIELD_GET(GICH_HCR_EOICOUNT, cpuif->vgic_hcr);
118	struct vgic_irq *irq;	118	struct vgic_irq irq = host_data_ptr(last_lr_irq);
119		119
120	DEBUG_SPINLOCK_BUG_ON(!irqs_disabled());	120	DEBUG_SPINLOCK_BUG_ON(!irqs_disabled());
121		121
@@ -123,7 +123,7 @@ void vgic_v2_fold_lr_state(struct kvm_vcpu *vcpu) · 1 unmodified line
123	vgic_v2_fold_lr(vcpu, cpuif->vgic_lr[lr]);	123	vgic_v2_fold_lr(vcpu, cpuif->vgic_lr[lr]);
124		124
125	/* See the GICv3 equivalent for the EOIcount handling rationale */	125	/* See the GICv3 equivalent for the EOIcount handling rationale */
126	list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) {	126	list_for_each_entry_continue(irq, &vgic_cpu->ap_list_head, ap_list) {
127	u32 lr;	127	u32 lr;
128		128
129	if (!eoicount) {	129	if (!eoicount) {

arch/arm64/kvm/vgic/vgic-v3.c+6−6

@@ -148,7 +148,7 @@ void vgic_v3_fold_lr_state(struct kvm_vcpu *vcpu) · 147 unmodified lines
148	struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;	148	struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
149	struct vgic_v3_cpu_if *cpuif = &vgic_cpu->vgic_v3;	149	struct vgic_v3_cpu_if *cpuif = &vgic_cpu->vgic_v3;
150	u32 eoicount = FIELD_GET(ICH_HCR_EL2_EOIcount, cpuif->vgic_hcr);	150	u32 eoicount = FIELD_GET(ICH_HCR_EL2_EOIcount, cpuif->vgic_hcr);
151	struct vgic_irq *irq;	151	struct vgic_irq irq = host_data_ptr(last_lr_irq);
152		152
153	DEBUG_SPINLOCK_BUG_ON(!irqs_disabled());	153	DEBUG_SPINLOCK_BUG_ON(!irqs_disabled());
154		154
@@ -158,12 +158,12 @@ void vgic_v3_fold_lr_state(struct kvm_vcpu *vcpu) · 3 unmodified lines
158	/*	158	/*
159	* EOIMode=0: use EOIcount to emulate deactivation. We are	159	* EOIMode=0: use EOIcount to emulate deactivation. We are
160	* guaranteed to deactivate in reverse order of the activation, so	160	* guaranteed to deactivate in reverse order of the activation, so
161	* just pick one active interrupt after the other in the ap_list,	161	* just pick one active interrupt after the other in the tail part
162	* and replay the deactivation as if the CPU was doing it. We also	162	* of the ap_list, past the LRs, and replay the deactivation as if
163	* rely on priority drop to have taken place, and the list to be	163	* the CPU was doing it. We also rely on priority drop to have taken
164	* sorted by priority.	164	* place, and the list to be sorted by priority.
165	*/	165	*/
166	list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) {	166	list_for_each_entry_continue(irq, &vgic_cpu->ap_list_head, ap_list) {
167	u64 lr;	167	u64 lr;
168		168
169	/*	169	/*

arch/arm64/kvm/vgic/vgic.c+6−0

 static inline void vgic_fold_lr_state(struct kvm_vcpu *vcpu)
 {
+	if (!*host_data_ptr(last_lr_irq))
+		return;
 	if (kvm_vgic_global_state.type == VGIC_V2)
 		vgic_v2_fold_lr_state(vcpu);
 	else
 	if (irqs_outside_lrs(&als))
 		vgic_sort_ap_list(vcpu);
+	*host_data_ptr(last_lr_irq) = NULL;
 	list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) {
 		scoped_guard(raw_spinlock,  &irq->irq_lock) {
 			if (likely(vgic_target_oracle(irq) == vcpu)) {
 				vgic_populate_lr(vcpu, irq, count++);
+				*host_data_ptr(last_lr_irq) = irq;
 			}
 		}

arch/loongarch/Kconfig+3−0

@@ -304,6 +304,9 @@ config AS_HAS_LBT_EXTENSION · 303 unmodified lines
304	config AS_HAS_LVZ_EXTENSION	304	config AS_HAS_LVZ_EXTENSION
305	def_bool $(as-instr,hvcl 0)	305	def_bool $(as-instr,hvcl 0)
306		306
		307	config AS_HAS_SCQ_EXTENSION
		308	def_bool $(as-instr,sc.q \$t0$(comma)\$t1$(comma)\$t2)
		309
307	config CC_HAS_ANNOTATE_TABLEJUMP	310	config CC_HAS_ANNOTATE_TABLEJUMP
308	def_bool $(cc-option,-mannotate-tablejump)	311	def_bool $(cc-option,-mannotate-tablejump)
309		312

arch/loongarch/include/asm/cmpxchg.h+5−0

 	arch_cmpxchg((ptr), (o), (n));					\
   })
+#ifdef CONFIG_AS_HAS_SCQ_EXTENSION
 union __u128_halves {
 	u128 full;
 	struct {
 	BUILD_BUG_ON(sizeof(*(ptr)) != 16);				\
 	__arch_cmpxchg128(ptr, o, n, "");				\
 })
+#endif /* CONFIG_AS_HAS_SCQ_EXTENSION */
 #else
 #include <asm-generic/cmpxchg-local.h>
 #define arch_cmpxchg64_local(ptr, o, n) __generic_cmpxchg64_local((ptr), (o), (n))

arch/loongarch/include/asm/uaccess.h+12−2

 									\
 	__get_kernel_common(*((type *)(dst)), sizeof(type),		\
 			    (__force type *)(src));			\
-	if (unlikely(__gu_err))						\
+	if (unlikely(__gu_err))	{					\
+		pr_info("%s: memory access failed, ecode 0x%x\n",	\
+			__func__, read_csr_excode());			\
+		pr_info("%s: the caller is %pS\n",			\
+			__func__, __builtin_return_address(0));		\
 		goto err_label;						\
+	}								\
 } while (0)
 #define __put_kernel_nofault(dst, src, type, err_label)			\
 									\
 	__pu_val = *(__force type *)(src);				\
 	__put_kernel_common(((type *)(dst)), sizeof(type));		\
-	if (unlikely(__pu_err))						\
+	if (unlikely(__pu_err))	{					\
+		pr_info("%s: memory access failed, ecode 0x%x\n",	\
+			__func__, read_csr_excode());			\
+		pr_info("%s: the caller is %pS\n",			\
+			__func__, __builtin_return_address(0));		\
 		goto err_label;						\
+	}								\
 } while (0)
 extern unsigned long __copy_user(void *to, const void *from, __kernel_size_t n);

arch/loongarch/kernel/inst.c+25−6

 	if (smp_processor_id() == copy->cpu) {
 		ret = copy_to_kernel_nofault(copy->dst, copy->src, copy->len);
-		if (ret)
+		if (ret) {
 			pr_err("%s: operation failed\n", __func__);
+			return ret;
+		}
 	}
 	flush_icache_range((unsigned long)copy->dst, (unsigned long)copy->dst + copy->len);
-	return ret;
+	return 0;
 }
 int larch_insn_text_copy(void *dst, void *src, size_t len)
 {
 	int ret = 0;
+	int err = 0;
 	size_t start, end;
 	struct insn_copy copy = {
 		.dst = dst,
 		.src = src,
 		.len = len,
-		.cpu = smp_processor_id(),
+		.cpu = raw_smp_processor_id(),
 	};
+	/*
+	 * Ensure copy.cpu won't be hot removed before stop_machine.
+	 * If it is removed nobody will really update the text.
+	 */
+	lockdep_assert_cpus_held();
 	start = round_down((size_t)dst, PAGE_SIZE);
 	end   = round_up((size_t)dst + len, PAGE_SIZE);
-	set_memory_rw(start, (end - start) / PAGE_SIZE);
+	err = set_memory_rw(start, (end - start) / PAGE_SIZE);
-	ret = stop_machine(text_copy_cb, &copy, cpu_online_mask);
+	if (err) {
-	set_memory_rox(start, (end - start) / PAGE_SIZE);
+		pr_info("%s: set_memory_rw() failed\n", __func__);
+		return err;
+	}
+	ret = stop_machine_cpuslocked(text_copy_cb, &copy, cpu_online_mask);
+	err = set_memory_rox(start, (end - start) / PAGE_SIZE);
+	if (err) {
+		pr_info("%s: set_memory_rox() failed\n", __func__);
+		return err;
+	}
 	return ret;
 }

arch/loongarch/kvm/vcpu.c+1−1

@@ -14,7 +14,7 @@ · 13 unmodified lines
14	#define CREATE_TRACE_POINTS	14	#define CREATE_TRACE_POINTS
15	#include "trace.h"	15	#include "trace.h"
16		16
17	const struct _kvm_stats_desc kvm_vcpu_stats_desc[] = {	17	const struct kvm_stats_desc kvm_vcpu_stats_desc[] = {
18	KVM_GENERIC_VCPU_STATS(),	18	KVM_GENERIC_VCPU_STATS(),
19	STATS_DESC_COUNTER(VCPU, int_exits),	19	STATS_DESC_COUNTER(VCPU, int_exits),
20	STATS_DESC_COUNTER(VCPU, idle_exits),	20	STATS_DESC_COUNTER(VCPU, idle_exits),

arch/loongarch/kvm/vm.c+3−3

@@ -10,7 +10,7 @@ · 9 unmodified lines
10	#include <asm/kvm_eiointc.h>	10	#include <asm/kvm_eiointc.h>
11	#include <asm/kvm_pch_pic.h>	11	#include <asm/kvm_pch_pic.h>
12		12
13	const struct _kvm_stats_desc kvm_vm_stats_desc[] = {	13	const struct kvm_stats_desc kvm_vm_stats_desc[] = {
14	KVM_GENERIC_VM_STATS(),	14	KVM_GENERIC_VM_STATS(),
15	STATS_DESC_ICOUNTER(VM, pages),	15	STATS_DESC_ICOUNTER(VM, pages),
16	STATS_DESC_ICOUNTER(VM, hugepages),	16	STATS_DESC_ICOUNTER(VM, hugepages),
@@ -49,8 +49,8 @@ static void kvm_vm_init_features(struct kvm *kvm) · 32 unmodified lines
49	kvm->arch.kvm_features \|= BIT(KVM_LOONGARCH_VM_FEAT_PMU);	49	kvm->arch.kvm_features \|= BIT(KVM_LOONGARCH_VM_FEAT_PMU);
50		50
51	/* Enable all PV features by default */	51	/* Enable all PV features by default */
52	kvm->arch.pv_features = BIT(KVM_FEATURE_IPI);	52	kvm->arch.pv_features \|= BIT(KVM_FEATURE_IPI);
53	kvm->arch.kvm_features = BIT(KVM_LOONGARCH_VM_FEAT_PV_IPI);	53	kvm->arch.kvm_features \|= BIT(KVM_LOONGARCH_VM_FEAT_PV_IPI);
54	if (kvm_pvtime_supported()) {	54	if (kvm_pvtime_supported()) {
55	kvm->arch.pv_features \|= BIT(KVM_FEATURE_PREEMPT);	55	kvm->arch.pv_features \|= BIT(KVM_FEATURE_PREEMPT);
56	kvm->arch.pv_features \|= BIT(KVM_FEATURE_STEAL_TIME);	56	kvm->arch.pv_features \|= BIT(KVM_FEATURE_STEAL_TIME);

arch/loongarch/net/bpf_jit.c+11−0

 {
 	int ret;
+	cpus_read_lock();
 	mutex_lock(&text_mutex);
 	ret = larch_insn_text_copy(dst, src, len);
 	mutex_unlock(&text_mutex);
+	cpus_read_unlock();
 	return ret ? ERR_PTR(-EINVAL) : dst;
 }
 	if (ret)
 		return ret;
+	cpus_read_lock();
 	mutex_lock(&text_mutex);
 	if (memcmp(ip, new_insns, LOONGARCH_LONG_JUMP_NBYTES))
 		ret = larch_insn_text_copy(ip, new_insns, LOONGARCH_LONG_JUMP_NBYTES);
 	mutex_unlock(&text_mutex);
+	cpus_read_unlock();
 	return ret;
 }
 	for (i = 0; i < (len / sizeof(u32)); i++)
 		inst[i] = INSN_BREAK;
+	cpus_read_lock();
 	mutex_lock(&text_mutex);
 	if (larch_insn_text_copy(dst, inst, len))
 		ret = -EINVAL;
 	mutex_unlock(&text_mutex);
+	cpus_read_unlock();
 	kvfree(inst);
 	bpf_prog_pack_free(image, size);
 }
+int arch_protect_bpf_trampoline(void *image, unsigned int size)
+{
+	return 0;
+}
 /*
  * Sign-extend the register if necessary
  */

arch/mips/kvm/mips.c+2−2

@@ -38,7 +38,7 @@ · 37 unmodified lines
38	#define VECTORSPACING 0x100 /* for EI/VI mode */	38	#define VECTORSPACING 0x100 /* for EI/VI mode */
39	#endif	39	#endif
40		40
41	const struct _kvm_stats_desc kvm_vm_stats_desc[] = {	41	const struct kvm_stats_desc kvm_vm_stats_desc[] = {
42	KVM_GENERIC_VM_STATS()	42	KVM_GENERIC_VM_STATS()
43	};	43	};
44		44
@@ -51,7 +51,7 @@ const struct kvm_stats_header kvm_vm_stats_header = { · 6 unmodified lines
51	sizeof(kvm_vm_stats_desc),	51	sizeof(kvm_vm_stats_desc),
52	};	52	};
53		53
54	const struct _kvm_stats_desc kvm_vcpu_stats_desc[] = {	54	const struct kvm_stats_desc kvm_vcpu_stats_desc[] = {
55	KVM_GENERIC_VCPU_STATS(),	55	KVM_GENERIC_VCPU_STATS(),
56	STATS_DESC_COUNTER(VCPU, wait_exits),	56	STATS_DESC_COUNTER(VCPU, wait_exits),
57	STATS_DESC_COUNTER(VCPU, cache_exits),	57	STATS_DESC_COUNTER(VCPU, cache_exits),

arch/powerpc/include/asm/uaccess.h+45−20

@@ -15,6 +15,9 @@ · 14 unmodified lines
15	#define TASK_SIZE_MAX TASK_SIZE_USER64	15	#define TASK_SIZE_MAX TASK_SIZE_USER64
16	#endif	16	#endif
17		17
		18	/* Threshold above which VMX copy path is used */
		19	#define VMX_COPY_THRESHOLD 3328
		20
18	#include <asm-generic/access_ok.h>	21	#include <asm-generic/access_ok.h>
19		22
20	/*	23	/*
@@ -326,40 +329,62 @@ do { \ · 305 unmodified lines
326	extern unsigned long __copy_tofrom_user(void __user *to,	329	extern unsigned long __copy_tofrom_user(void __user *to,
327	const void __user *from, unsigned long size);	330	const void __user *from, unsigned long size);
328		331
329	#ifdef __powerpc64__	332	unsigned long __copy_tofrom_user_base(void __user *to,
330	static inline unsigned long	333	const void __user *from, unsigned long size);
331	raw_copy_in_user(void __user to, const void __user from, unsigned long n)	334
		335	unsigned long __copy_tofrom_user_power7_vmx(void __user *to,
		336	const void __user *from, unsigned long size);
		337
		338	static __always_inline bool will_use_vmx(unsigned long n)
		339	{
		340	return IS_ENABLED(CONFIG_ALTIVEC) && cpu_has_feature(CPU_FTR_VMX_COPY) &&
		341	n > VMX_COPY_THRESHOLD;
		342	}
		343
		344	static __always_inline unsigned long
		345	raw_copy_tofrom_user(void __user to, const void __user from,
		346	unsigned long n, unsigned long dir)
332	{	347	{
333	unsigned long ret;	348	unsigned long ret;
334		349
335	barrier_nospec();	350	if (will_use_vmx(n) && enter_vmx_usercopy()) {
336	allow_user_access(to, KUAP_READ_WRITE);	351	allow_user_access(to, dir);
		352	ret = __copy_tofrom_user_power7_vmx(to, from, n);
		353	prevent_user_access(dir);
		354	exit_vmx_usercopy();
		355
		356	if (unlikely(ret)) {
		357	allow_user_access(to, dir);
		358	ret = __copy_tofrom_user_base(to, from, n);
		359	prevent_user_access(dir);
		360	}
		361	return ret;
		362	}
		363
		364	allow_user_access(to, dir);
337	ret = __copy_tofrom_user(to, from, n);	365	ret = __copy_tofrom_user(to, from, n);
338	prevent_user_access(KUAP_READ_WRITE);	366	prevent_user_access(dir);
339	return ret;	367	return ret;
340	}	368	}
341	#endif /* __powerpc64__ */
342		369
343	static inline unsigned long raw_copy_from_user(void *to,	370	#ifdef CONFIG_PPC64
344	const void __user *from, unsigned long n)	371	static inline unsigned long
		372	raw_copy_in_user(void __user to, const void __user from, unsigned long n)
345	{	373	{
346	unsigned long ret;	374	barrier_nospec();
		375	return raw_copy_tofrom_user(to, from, n, KUAP_READ_WRITE);
		376	}
		377	#endif /* CONFIG_PPC64 */
347		378
348	allow_user_access(NULL, KUAP_READ);	379	static inline unsigned long raw_copy_from_user(void to, const void __user from, unsigned long n)
349	ret = __copy_tofrom_user((__force void __user *)to, from, n);	380	{
350	prevent_user_access(KUAP_READ);	381	return raw_copy_tofrom_user((__force void __user *)to, from, n, KUAP_READ);
351	return ret;
352	}	382	}
353		383
354	static inline unsigned long	384	static inline unsigned long
355	raw_copy_to_user(void __user to, const void from, unsigned long n)	385	raw_copy_to_user(void __user to, const void from, unsigned long n)
356	{	386	{
357	unsigned long ret;	387	return raw_copy_tofrom_user(to, (__force const void __user *)from, n, KUAP_WRITE);
358
359	allow_user_access(to, KUAP_WRITE);
360	ret = __copy_tofrom_user(to, (__force const void __user *)from, n);
361	prevent_user_access(KUAP_WRITE);
362	return ret;
363	}	388	}
364		389
365	unsigned long __arch_clear_user(void __user *addr, unsigned long size);	390	unsigned long __arch_clear_user(void __user *addr, unsigned long size);

arch/powerpc/kernel/iommu.c+1−1

@@ -1159,7 +1159,7 @@ spapr_tce_platform_iommu_attach_dev(struct iommu_domain *platform_domain, · 1158 unmodified lines
1159	struct device *dev,	1159	struct device *dev,
1160	struct iommu_domain *old)	1160	struct iommu_domain *old)
1161	{	1161	{
1162	struct iommu_domain *domain = iommu_get_domain_for_dev(dev);	1162	struct iommu_domain *domain = iommu_driver_get_domain_for_dev(dev);
1163	struct iommu_table_group *table_group;	1163	struct iommu_table_group *table_group;
1164	struct iommu_group *grp;	1164	struct iommu_group *grp;
1165		1165

arch/powerpc/kernel/setup-common.c+0−10

 #include <linux/of_irq.h>
 #include <linux/hugetlb.h>
 #include <linux/pgtable.h>
-#include <asm/kexec.h>
 #include <asm/io.h>
 #include <asm/paca.h>
 #include <asm/processor.h>
 	initmem_init();
-	/*
-	 * Reserve large chunks of memory for use by CMA for kdump, fadump, KVM and
-	 * hugetlb. These must be called after initmem_init(), so that
-	 * pageblock_order is initialised.
-	 */
-	fadump_cma_init();
-	kdump_cma_reserve();
-	kvm_cma_reserve();
 	early_memtest(min_low_pfn << PAGE_SHIFT, max_low_pfn << PAGE_SHIFT);
 	if (ppc_md.setup_arch)

arch/powerpc/kvm/book3s.c+2−2

@@ -38,7 +38,7 @@ · 37 unmodified lines
38		38
39	/* #define EXIT_DEBUG */	39	/* #define EXIT_DEBUG */
40		40
41	const struct _kvm_stats_desc kvm_vm_stats_desc[] = {	41	const struct kvm_stats_desc kvm_vm_stats_desc[] = {
42	KVM_GENERIC_VM_STATS(),	42	KVM_GENERIC_VM_STATS(),
43	STATS_DESC_ICOUNTER(VM, num_2M_pages),	43	STATS_DESC_ICOUNTER(VM, num_2M_pages),
44	STATS_DESC_ICOUNTER(VM, num_1G_pages)	44	STATS_DESC_ICOUNTER(VM, num_1G_pages)
@@ -53,7 +53,7 @@ const struct kvm_stats_header kvm_vm_stats_header = { · 8 unmodified lines
53	sizeof(kvm_vm_stats_desc),	53	sizeof(kvm_vm_stats_desc),
54	};	54	};
55		55
56	const struct _kvm_stats_desc kvm_vcpu_stats_desc[] = {	56	const struct kvm_stats_desc kvm_vcpu_stats_desc[] = {
57	KVM_GENERIC_VCPU_STATS(),	57	KVM_GENERIC_VCPU_STATS(),
58	STATS_DESC_COUNTER(VCPU, sum_exits),	58	STATS_DESC_COUNTER(VCPU, sum_exits),
59	STATS_DESC_COUNTER(VCPU, mmio_exits),	59	STATS_DESC_COUNTER(VCPU, mmio_exits),

arch/powerpc/kvm/booke.c+2−2

@@ -36,7 +36,7 @@ · 35 unmodified lines
36		36
37	unsigned long kvmppc_booke_handlers;	37	unsigned long kvmppc_booke_handlers;
38		38
39	const struct _kvm_stats_desc kvm_vm_stats_desc[] = {	39	const struct kvm_stats_desc kvm_vm_stats_desc[] = {
40	KVM_GENERIC_VM_STATS(),	40	KVM_GENERIC_VM_STATS(),
41	STATS_DESC_ICOUNTER(VM, num_2M_pages),	41	STATS_DESC_ICOUNTER(VM, num_2M_pages),
42	STATS_DESC_ICOUNTER(VM, num_1G_pages)	42	STATS_DESC_ICOUNTER(VM, num_1G_pages)
@@ -51,7 +51,7 @@ const struct kvm_stats_header kvm_vm_stats_header = { · 8 unmodified lines
51	sizeof(kvm_vm_stats_desc),	51	sizeof(kvm_vm_stats_desc),
52	};	52	};
53		53
54	const struct _kvm_stats_desc kvm_vcpu_stats_desc[] = {	54	const struct kvm_stats_desc kvm_vcpu_stats_desc[] = {
55	KVM_GENERIC_VCPU_STATS(),	55	KVM_GENERIC_VCPU_STATS(),
56	STATS_DESC_COUNTER(VCPU, sum_exits),	56	STATS_DESC_COUNTER(VCPU, sum_exits),
57	STATS_DESC_COUNTER(VCPU, mmio_exits),	57	STATS_DESC_COUNTER(VCPU, mmio_exits),

arch/powerpc/kvm/e500.h+1−5

 /* bits [6-5] MAS2_X1 and MAS2_X0 and [4-0] bits for WIMGE */
 #define E500_TLB_MAS2_ATTR	(0x7f)
-struct tlbe_ref {
+struct tlbe_priv {
 	kvm_pfn_t pfn;		/* valid only for TLB0, except briefly */
 	unsigned int flags;	/* E500_TLB_* */
 };
-struct tlbe_priv {
-	struct tlbe_ref ref;
-};
 #ifdef CONFIG_KVM_E500V2
 struct vcpu_id_table;
 #endif

arch/powerpc/kvm/e500_mmu.c+2−2

@@ -920,12 +920,12 @@ int kvmppc_e500_tlb_init(struct kvmppc_vcpu_e500 *vcpu_e500) · 919 unmodified lines
920	vcpu_e500->gtlb_offset[0] = 0;	920	vcpu_e500->gtlb_offset[0] = 0;
921	vcpu_e500->gtlb_offset[1] = KVM_E500_TLB0_SIZE;	921	vcpu_e500->gtlb_offset[1] = KVM_E500_TLB0_SIZE;
922		922
923	vcpu_e500->gtlb_priv[0] = kzalloc_objs(struct tlbe_ref,	923	vcpu_e500->gtlb_priv[0] = kzalloc_objs(struct tlbe_priv,
924	vcpu_e500->gtlb_params[0].entries);	924	vcpu_e500->gtlb_params[0].entries);
925	if (!vcpu_e500->gtlb_priv[0])	925	if (!vcpu_e500->gtlb_priv[0])
926	goto free_vcpu;	926	goto free_vcpu;
927		927
928	vcpu_e500->gtlb_priv[1] = kzalloc_objs(struct tlbe_ref,	928	vcpu_e500->gtlb_priv[1] = kzalloc_objs(struct tlbe_priv,
929	vcpu_e500->gtlb_params[1].entries);	929	vcpu_e500->gtlb_params[1].entries);
930	if (!vcpu_e500->gtlb_priv[1])	930	if (!vcpu_e500->gtlb_priv[1])
931	goto free_vcpu;	931	goto free_vcpu;

arch/powerpc/kvm/e500_mmu_host.c+44−47

 {
 	struct kvm_book3e_206_tlb_entry *gtlbe =
 		get_entry(vcpu_e500, tlbsel, esel);
-	struct tlbe_ref *ref = &vcpu_e500->gtlb_priv[tlbsel][esel].ref;
+	struct tlbe_priv *tlbe = &vcpu_e500->gtlb_priv[tlbsel][esel];
 	/* Don't bother with unmapped entries */
-	if (!(ref->flags & E500_TLB_VALID)) {
+	if (!(tlbe->flags & E500_TLB_VALID)) {
-		WARN(ref->flags & (E500_TLB_BITMAP | E500_TLB_TLB0),
+		WARN(tlbe->flags & (E500_TLB_BITMAP | E500_TLB_TLB0),
-		     "%s: flags %x\n", __func__, ref->flags);
+		     "%s: flags %x\n", __func__, tlbe->flags);
 		WARN_ON(tlbsel == 1 && vcpu_e500->g2h_tlb1_map[esel]);
 	}
-	if (tlbsel == 1 && ref->flags & E500_TLB_BITMAP) {
+	if (tlbsel == 1 && tlbe->flags & E500_TLB_BITMAP) {
 		u64 tmp = vcpu_e500->g2h_tlb1_map[esel];
 		int hw_tlb_indx;
 		unsigned long flags;
 		}
 		mb();
 		vcpu_e500->g2h_tlb1_map[esel] = 0;
-		ref->flags &= ~(E500_TLB_BITMAP | E500_TLB_VALID);
+		tlbe->flags &= ~(E500_TLB_BITMAP | E500_TLB_VALID);
 		local_irq_restore(flags);
 	}
-	if (tlbsel == 1 && ref->flags & E500_TLB_TLB0) {
+	if (tlbsel == 1 && tlbe->flags & E500_TLB_TLB0) {
 		/*
 		 * TLB1 entry is backed by 4k pages. This should happen
 		 * rarely and is not worth optimizing. Invalidate everything.
 		 */
 		kvmppc_e500_tlbil_all(vcpu_e500);
-		ref->flags &= ~(E500_TLB_TLB0 | E500_TLB_VALID);
+		tlbe->flags &= ~(E500_TLB_TLB0 | E500_TLB_VALID);
 	}
 	/*
 	 * If TLB entry is still valid then it's a TLB0 entry, and thus
 	 * backed by at most one host tlbe per shadow pid
 	 */
-	if (ref->flags & E500_TLB_VALID)
+	if (tlbe->flags & E500_TLB_VALID)
 		kvmppc_e500_tlbil_one(vcpu_e500, gtlbe);
 	/* Mark the TLB as not backed by the host anymore */
-	ref->flags = 0;
+	tlbe->flags = 0;
 }
 static inline int tlbe_is_writable(struct kvm_book3e_206_tlb_entry *tlbe)
 	return tlbe->mas7_3 & (MAS3_SW|MAS3_UW);
 }
-static inline void kvmppc_e500_ref_setup(struct tlbe_ref *ref,
+static inline void kvmppc_e500_tlbe_setup(struct tlbe_priv *tlbe,
-					 struct kvm_book3e_206_tlb_entry *gtlbe,
+					  struct kvm_book3e_206_tlb_entry *gtlbe,
-					 kvm_pfn_t pfn, unsigned int wimg,
+					  kvm_pfn_t pfn, unsigned int wimg,
-					 bool writable)
+					  bool writable)
 {
-	ref->pfn = pfn;
+	tlbe->pfn = pfn;
-	ref->flags = E500_TLB_VALID;
+	tlbe->flags = E500_TLB_VALID;
 	if (writable)
-		ref->flags |= E500_TLB_WRITABLE;
+		tlbe->flags |= E500_TLB_WRITABLE;
 	/* Use guest supplied MAS2_G and MAS2_E */
-	ref->flags |= (gtlbe->mas2 & MAS2_ATTRIB_MASK) | wimg;
+	tlbe->flags |= (gtlbe->mas2 & MAS2_ATTRIB_MASK) | wimg;
 }
-static inline void kvmppc_e500_ref_release(struct tlbe_ref *ref)
+static inline void kvmppc_e500_tlbe_release(struct tlbe_priv *tlbe)
 {
-	if (ref->flags & E500_TLB_VALID) {
+	if (tlbe->flags & E500_TLB_VALID) {
 		/* FIXME: don't log bogus pfn for TLB1 */
-		trace_kvm_booke206_ref_release(ref->pfn, ref->flags);
+		trace_kvm_booke206_ref_release(tlbe->pfn, tlbe->flags);
-		ref->flags = 0;
+		tlbe->flags = 0;
 	}
 }
 	int i;
 	for (tlbsel = 0; tlbsel <= 1; tlbsel++) {
-		for (i = 0; i < vcpu_e500->gtlb_params[tlbsel].entries; i++) {
+		for (i = 0; i < vcpu_e500->gtlb_params[tlbsel].entries; i++)
-			struct tlbe_ref *ref =
+			kvmppc_e500_tlbe_release(&vcpu_e500->gtlb_priv[tlbsel][i]);
-				&vcpu_e500->gtlb_priv[tlbsel][i].ref;
-			kvmppc_e500_ref_release(ref);
-		}
 	}
 }
 static void kvmppc_e500_setup_stlbe(
 	struct kvm_vcpu *vcpu,
 	struct kvm_book3e_206_tlb_entry *gtlbe,
-	int tsize, struct tlbe_ref *ref, u64 gvaddr,
+	int tsize, struct tlbe_priv *tlbe, u64 gvaddr,
 	struct kvm_book3e_206_tlb_entry *stlbe)
 {
-	kvm_pfn_t pfn = ref->pfn;
+	kvm_pfn_t pfn = tlbe->pfn;
 	u32 pr = vcpu->arch.shared->msr & MSR_PR;
-	bool writable = !!(ref->flags & E500_TLB_WRITABLE);
+	bool writable = !!(tlbe->flags & E500_TLB_WRITABLE);
-	BUG_ON(!(ref->flags & E500_TLB_VALID));
+	BUG_ON(!(tlbe->flags & E500_TLB_VALID));
 	/* Force IPROT=0 for all guest mappings. */
 	stlbe->mas1 = MAS1_TSIZE(tsize) | get_tlb_sts(gtlbe) | MAS1_VALID;
-	stlbe->mas2 = (gvaddr & MAS2_EPN) | (ref->flags & E500_TLB_MAS2_ATTR);
+	stlbe->mas2 = (gvaddr & MAS2_EPN) | (tlbe->flags & E500_TLB_MAS2_ATTR);
 	stlbe->mas7_3 = ((u64)pfn << PAGE_SHIFT) |
 			e500_shadow_mas3_attrib(gtlbe->mas7_3, writable, pr);
 }
 static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500,
 	u64 gvaddr, gfn_t gfn, struct kvm_book3e_206_tlb_entry *gtlbe,
 	int tlbsel, struct kvm_book3e_206_tlb_entry *stlbe,
-	struct tlbe_ref *ref)
+	struct tlbe_priv *tlbe)
 {
 	struct kvm_memory_slot *slot;
 	unsigned int psize;
 		}
 	}
-	kvmppc_e500_ref_setup(ref, gtlbe, pfn, wimg, writable);
+	kvmppc_e500_tlbe_setup(tlbe, gtlbe, pfn, wimg, writable);
 	kvmppc_e500_setup_stlbe(&vcpu_e500->vcpu, gtlbe, tsize,
-				ref, gvaddr, stlbe);
+				tlbe, gvaddr, stlbe);
 	writable = tlbe_is_writable(stlbe);
 	/* Clear i-cache for new pages */
 				struct kvm_book3e_206_tlb_entry *stlbe)
 {
 	struct kvm_book3e_206_tlb_entry *gtlbe;
-	struct tlbe_ref *ref;
+	struct tlbe_priv *tlbe;
 	int stlbsel = 0;
 	int sesel = 0;
 	int r;
 	gtlbe = get_entry(vcpu_e500, 0, esel);
-	ref = &vcpu_e500->gtlb_priv[0][esel].ref;
+	tlbe = &vcpu_e500->gtlb_priv[0][esel];
 	r = kvmppc_e500_shadow_map(vcpu_e500, get_tlb_eaddr(gtlbe),
 			get_tlb_raddr(gtlbe) >> PAGE_SHIFT,
-			gtlbe, 0, stlbe, ref);
+			gtlbe, 0, stlbe, tlbe);
 	if (r)
 		return r;
 }
 static int kvmppc_e500_tlb1_map_tlb1(struct kvmppc_vcpu_e500 *vcpu_e500,
-				     struct tlbe_ref *ref,
+				     struct tlbe_priv *tlbe,
 				     int esel)
 {
 	unsigned int sesel = vcpu_e500->host_tlb1_nv++;
 		vcpu_e500->g2h_tlb1_map[idx] &= ~(1ULL << sesel);
 	}
-	vcpu_e500->gtlb_priv[1][esel].ref.flags |= E500_TLB_BITMAP;
+	vcpu_e500->gtlb_priv[1][esel].flags |= E500_TLB_BITMAP;
 	vcpu_e500->g2h_tlb1_map[esel] |= (u64)1 << sesel;
 	vcpu_e500->h2g_tlb1_rmap[sesel] = esel + 1;
-	WARN_ON(!(ref->flags & E500_TLB_VALID));
+	WARN_ON(!(tlbe->flags & E500_TLB_VALID));
 	return sesel;
 }
 		u64 gvaddr, gfn_t gfn, struct kvm_book3e_206_tlb_entry *gtlbe,
 		struct kvm_book3e_206_tlb_entry *stlbe, int esel)
 {
-	struct tlbe_ref *ref = &vcpu_e500->gtlb_priv[1][esel].ref;
+	struct tlbe_priv *tlbe = &vcpu_e500->gtlb_priv[1][esel];
 	int sesel;
 	int r;
 	r = kvmppc_e500_shadow_map(vcpu_e500, gvaddr, gfn, gtlbe, 1, stlbe,
-				   ref);
+				   tlbe);
 	if (r)
 		return r;
 	/* Use TLB0 when we can only map a page with 4k */
 	if (get_tlb_tsize(stlbe) == BOOK3E_PAGESZ_4K) {
-		vcpu_e500->gtlb_priv[1][esel].ref.flags |= E500_TLB_TLB0;
+		vcpu_e500->gtlb_priv[1][esel].flags |= E500_TLB_TLB0;
 		write_stlbe(vcpu_e500, gtlbe, stlbe, 0, 0);
 		return 0;
 	}
 	/* Otherwise map into TLB1 */
-	sesel = kvmppc_e500_tlb1_map_tlb1(vcpu_e500, ref, esel);
+	sesel = kvmppc_e500_tlb1_map_tlb1(vcpu_e500, tlbe, esel);
 	write_stlbe(vcpu_e500, gtlbe, stlbe, 1, sesel);
 	return 0;
 		priv = &vcpu_e500->gtlb_priv[tlbsel][esel];
 		/* Triggers after clear_tlb_privs or on initial mapping */
-		if (!(priv->ref.flags & E500_TLB_VALID)) {
+		if (!(priv->flags & E500_TLB_VALID)) {
 			kvmppc_e500_tlb0_map(vcpu_e500, esel, &stlbe);
 		} else {
 			kvmppc_e500_setup_stlbe(vcpu, gtlbe, BOOK3E_PAGESZ_4K,
-						&priv->ref, eaddr, &stlbe);
+						priv, eaddr, &stlbe);
 			write_stlbe(vcpu_e500, gtlbe, &stlbe, 0, 0);
 		}
 		break;

arch/powerpc/lib/copyuser_64.S+1−0

@@ -562,3 +562,4 @@ exc; std r10,32(3) · 561 unmodified lines
562	li r5,4096	562	li r5,4096
563	b .Ldst_aligned	563	b .Ldst_aligned
564	EXPORT_SYMBOL(__copy_tofrom_user)	564	EXPORT_SYMBOL(__copy_tofrom_user)
		565	EXPORT_SYMBOL(__copy_tofrom_user_base)

arch/powerpc/lib/copyuser_power7.S+15−30

  *
  * Author: Anton Blanchard <anton@au.ibm.com>
  */
+#include <linux/export.h>
 #include <asm/ppc_asm.h>
-#ifndef SELFTEST_CASE
-/* 0 == don't use VMX, 1 == use VMX */
-#define SELFTEST_CASE	0
-#endif
 #ifdef __BIG_ENDIAN__
 #define LVS(VRT,RA,RB)		lvsl	VRT,RA,RB
 #define VPERM(VRT,VRA,VRB,VRC)	vperm	VRT,VRA,VRB,VRC
 	ld	r15,STK_REG(R15)(r1)
 	ld	r14,STK_REG(R14)(r1)
 .Ldo_err3:
-	bl	CFUNC(exit_vmx_usercopy)
+	ld      r6,STK_REG(R31)(r1)	/* original destination pointer */
+	ld      r5,STK_REG(R29)(r1)	/* original number of bytes */
+	subf    r7,r6,r3		/* #bytes copied */
+	subf    r3,r7,r5		/* #bytes not copied in r3 */
 	ld	r0,STACKFRAMESIZE+16(r1)
 	mtlr	r0
-	b	.Lexit
+	addi    r1,r1,STACKFRAMESIZE
+	blr
 #endif /* CONFIG_ALTIVEC */
 .Ldo_err2:
 _GLOBAL(__copy_tofrom_user_power7)
 	cmpldi	r5,16
-	cmpldi	cr1,r5,3328
 	std	r3,-STACKFRAMESIZE+STK_REG(R31)(r1)
 	std	r4,-STACKFRAMESIZE+STK_REG(R30)(r1)
 	blt	.Lshort_copy
-#ifdef CONFIG_ALTIVEC
-test_feature = SELFTEST_CASE
-BEGIN_FTR_SECTION
-	bgt	cr1,.Lvmx_copy
-END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
-#endif
 .Lnonvmx_copy:
 	/* Get the source 8B aligned */
 15:	li	r3,0
 	blr
-.Lunwind_stack_nonvmx_copy:
-	addi	r1,r1,STACKFRAMESIZE
-	b	.Lnonvmx_copy
-.Lvmx_copy:
 #ifdef CONFIG_ALTIVEC
+_GLOBAL(__copy_tofrom_user_power7_vmx)
 	mflr	r0
 	std	r0,16(r1)
 	stdu	r1,-STACKFRAMESIZE(r1)
-	bl	CFUNC(enter_vmx_usercopy)
-	cmpwi	cr1,r3,0
-	ld	r0,STACKFRAMESIZE+16(r1)
-	ld	r3,STK_REG(R31)(r1)
-	ld	r4,STK_REG(R30)(r1)
-	ld	r5,STK_REG(R29)(r1)
-	mtlr	r0
+	std     r3,STK_REG(R31)(r1)
+	std     r5,STK_REG(R29)(r1)
 	/*
 	 * We prefetch both the source and destination using enhanced touch
 	 * instructions. We use a stream ID of 0 for the load side and
 	DCBT_SETUP_STREAMS(r6, r7, r9, r10, r8)
-	beq	cr1,.Lunwind_stack_nonvmx_copy
 	/*
 	 * If source and destination are not relatively aligned we use a
 	 * slower permute loop.
 err3;	stb	r0,0(r3)
 15:	addi	r1,r1,STACKFRAMESIZE
-	b	CFUNC(exit_vmx_usercopy)	/* tail call optimise */
+	li r3,0
+	blr
 .Lvmx_unaligned_copy:
 	/* Get the destination 16B aligned */
 err3;	stb	r0,0(r3)
 15:	addi	r1,r1,STACKFRAMESIZE
-	b	CFUNC(exit_vmx_usercopy)	/* tail call optimise */
+	li r3,0
+	blr
+EXPORT_SYMBOL(__copy_tofrom_user_power7_vmx)
 #endif /* CONFIG_ALTIVEC */

arch/powerpc/lib/vmx-helper.c+2−0

 	return 1;
 }
+EXPORT_SYMBOL(enter_vmx_usercopy);
 /*
  * This function must return 0 because we tail call optimise when calling
 		set_dec(1);
 	return 0;
 }
+EXPORT_SYMBOL(exit_vmx_usercopy);
 int enter_vmx_ops(void)
 {

arch/powerpc/mm/mem.c+14−0

@@ -30,6 +30,10 @@ · 29 unmodified lines
30	#include <asm/setup.h>	30	#include <asm/setup.h>
31	#include <asm/fixmap.h>	31	#include <asm/fixmap.h>
32		32
		33	#include <asm/fadump.h>
		34	#include <asm/kexec.h>
		35	#include <asm/kvm_ppc.h>
		36
33	#include <mm/mmu_decl.h>	37	#include <mm/mmu_decl.h>
34		38
35	unsigned long long memory_limit __initdata;	39	unsigned long long memory_limit __initdata;
@@ -268,6 +272,16 @@ void __init paging_init(void) · 232 unmodified lines
268		272
269	void __init arch_mm_preinit(void)	273	void __init arch_mm_preinit(void)
270	{	274	{
		275
		276	/*
		277	* Reserve large chunks of memory for use by CMA for kdump, fadump, KVM
		278	* and hugetlb. These must be called after pageblock_order is
		279	* initialised.
		280	*/
		281	fadump_cma_init();
		282	kdump_cma_reserve();
		283	kvm_cma_reserve();
		284
271	/*	285	/*
272	* book3s is limited to 16 page sizes due to encoding this in	286	* book3s is limited to 16 page sizes due to encoding this in
273	* a 4-bit field for slices.	287	* a 4-bit field for slices.

arch/powerpc/perf/callchain.c+5−0

 void
 perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs)
 {
+	perf_callchain_store(entry, perf_arch_instruction_pointer(regs));
+	if (!current->mm)
+		return;
 	if (!is_32bit_task())
 		perf_callchain_user_64(entry, regs);
 	else

arch/powerpc/perf/callchain_32.c+0−1

@@ -142,7 +142,6 @@ void perf_callchain_user_32(struct perf_callchain_entry_ctx *entry, · 141 unmodified lines
142	next_ip = perf_arch_instruction_pointer(regs);	142	next_ip = perf_arch_instruction_pointer(regs);
143	lr = regs->link;	143	lr = regs->link;
144	sp = regs->gpr[1];	144	sp = regs->gpr[1];
145	perf_callchain_store(entry, next_ip);
146		145
147	while (entry->nr < entry->max_stack) {	146	while (entry->nr < entry->max_stack) {
148	fp = (unsigned int __user *) (unsigned long) sp;	147	fp = (unsigned int __user *) (unsigned long) sp;

arch/powerpc/perf/callchain_64.c+0−1

@@ -77,7 +77,6 @@ void perf_callchain_user_64(struct perf_callchain_entry_ctx *entry, · 76 unmodified lines
77	next_ip = perf_arch_instruction_pointer(regs);	77	next_ip = perf_arch_instruction_pointer(regs);
78	lr = regs->link;	78	lr = regs->link;
79	sp = regs->gpr[1];	79	sp = regs->gpr[1];
80	perf_callchain_store(entry, next_ip);
81		80
82	while (entry->nr < entry->max_stack) {	81	while (entry->nr < entry->max_stack) {
83	fp = (unsigned long __user *) sp;	82	fp = (unsigned long __user *) sp;

arch/riscv/boot/dts/microchip/mpfs.dtsi+2−0

 			clocks = <&clkcfg CLK_CAN0>, <&clkcfg CLK_MSSPLL3>;
 			interrupt-parent = <&plic>;
 			interrupts = <56>;
+			resets = <&mss_top_sysreg CLK_CAN0>;
 			status = "disabled";
 		};
 			clocks = <&clkcfg CLK_CAN1>, <&clkcfg CLK_MSSPLL3>;
 			interrupt-parent = <&plic>;
 			interrupts = <57>;
+			resets = <&mss_top_sysreg CLK_CAN1>;
 			status = "disabled";
 		};

arch/riscv/kvm/aia.c+13−2

 #include <linux/irqchip/riscv-imsic.h>
 #include <linux/irqdomain.h>
 #include <linux/kvm_host.h>
+#include <linux/nospec.h>
 #include <linux/percpu.h>
 #include <linux/spinlock.h>
 #include <asm/cpufeature.h>
 			       unsigned long *out_val)
 {
 	struct kvm_vcpu_aia_csr *csr = &vcpu->arch.aia_context.guest_csr;
+	unsigned long regs_max = sizeof(struct kvm_riscv_aia_csr) / sizeof(unsigned long);
-	if (reg_num >= sizeof(struct kvm_riscv_aia_csr) / sizeof(unsigned long))
+	if (!riscv_isa_extension_available(vcpu->arch.isa, SSAIA))
 		return -ENOENT;
+	if (reg_num >= regs_max)
+		return -ENOENT;
+	reg_num = array_index_nospec(reg_num, regs_max);
 	*out_val = 0;
 	if (kvm_riscv_aia_available())
 			       unsigned long val)
 {
 	struct kvm_vcpu_aia_csr *csr = &vcpu->arch.aia_context.guest_csr;
+	unsigned long regs_max = sizeof(struct kvm_riscv_aia_csr) / sizeof(unsigned long);
-	if (reg_num >= sizeof(struct kvm_riscv_aia_csr) / sizeof(unsigned long))
+	if (!riscv_isa_extension_available(vcpu->arch.isa, SSAIA))
 		return -ENOENT;
+	if (reg_num >= regs_max)
+		return -ENOENT;
+	reg_num = array_index_nospec(reg_num, regs_max);
 	if (kvm_riscv_aia_available()) {
 		((unsigned long *)csr)[reg_num] = val;

arch/riscv/kvm/aia_aplic.c+12−11

 #include <linux/irqchip/riscv-aplic.h>
 #include <linux/kvm_host.h>
 #include <linux/math.h>
+#include <linux/nospec.h>
 #include <linux/spinlock.h>
 #include <linux/swab.h>
 #include <kvm/iodev.h>
 	if (!irq || aplic->nr_irqs <= irq)
 		return 0;
-	irqd = &aplic->irqs[irq];
+	irqd = &aplic->irqs[array_index_nospec(irq, aplic->nr_irqs)];
 	raw_spin_lock_irqsave(&irqd->lock, flags);
 	ret = irqd->sourcecfg;
 	if (!irq || aplic->nr_irqs <= irq)
 		return;
-	irqd = &aplic->irqs[irq];
+	irqd = &aplic->irqs[array_index_nospec(irq, aplic->nr_irqs)];
 	if (val & APLIC_SOURCECFG_D)
 		val = 0;
 	if (!irq || aplic->nr_irqs <= irq)
 		return 0;
-	irqd = &aplic->irqs[irq];
+	irqd = &aplic->irqs[array_index_nospec(irq, aplic->nr_irqs)];
 	raw_spin_lock_irqsave(&irqd->lock, flags);
 	ret = irqd->target;
 	if (!irq || aplic->nr_irqs <= irq)
 		return;
-	irqd = &aplic->irqs[irq];
+	irqd = &aplic->irqs[array_index_nospec(irq, aplic->nr_irqs)];
 	val &= APLIC_TARGET_EIID_MASK |
 	       (APLIC_TARGET_HART_IDX_MASK << APLIC_TARGET_HART_IDX_SHIFT) |
 	if (!irq || aplic->nr_irqs <= irq)
 		return false;
-	irqd = &aplic->irqs[irq];
+	irqd = &aplic->irqs[array_index_nospec(irq, aplic->nr_irqs)];
 	raw_spin_lock_irqsave(&irqd->lock, flags);
 	ret = (irqd->state & APLIC_IRQ_STATE_PENDING) ? true : false;
 	if (!irq || aplic->nr_irqs <= irq)
 		return;
-	irqd = &aplic->irqs[irq];
+	irqd = &aplic->irqs[array_index_nospec(irq, aplic->nr_irqs)];
 	raw_spin_lock_irqsave(&irqd->lock, flags);
 	if (!irq || aplic->nr_irqs <= irq)
 		return false;
-	irqd = &aplic->irqs[irq];
+	irqd = &aplic->irqs[array_index_nospec(irq, aplic->nr_irqs)];
 	raw_spin_lock_irqsave(&irqd->lock, flags);
 	ret = (irqd->state & APLIC_IRQ_STATE_ENABLED) ? true : false;
 	if (!irq || aplic->nr_irqs <= irq)
 		return;
-	irqd = &aplic->irqs[irq];
+	irqd = &aplic->irqs[array_index_nospec(irq, aplic->nr_irqs)];
 	raw_spin_lock_irqsave(&irqd->lock, flags);
 	if (enabled)
 	if (!irq || aplic->nr_irqs <= irq)
 		return false;
-	irqd = &aplic->irqs[irq];
+	irqd = &aplic->irqs[array_index_nospec(irq, aplic->nr_irqs)];
 	raw_spin_lock_irqsave(&irqd->lock, flags);
 	for (irq = first; irq <= last; irq++) {
 		if (!irq || aplic->nr_irqs <= irq)
 			continue;
-		irqd = &aplic->irqs[irq];
+		irqd = &aplic->irqs[array_index_nospec(irq, aplic->nr_irqs)];
 		raw_spin_lock_irqsave(&irqd->lock, flags);
 	if (!aplic || !source || (aplic->nr_irqs <= source))
 		return -ENODEV;
-	irqd = &aplic->irqs[source];
+	irqd = &aplic->irqs[array_index_nospec(source, aplic->nr_irqs)];
 	ie = (aplic->domaincfg & APLIC_DOMAINCFG_IE) ? true : false;
 	raw_spin_lock_irqsave(&irqd->lock, flags);

arch/riscv/kvm/aia_device.c+14−4

 #include <linux/irqchip/riscv-imsic.h>
 #include <linux/kvm_host.h>
 #include <linux/uaccess.h>
+#include <linux/cpufeature.h>
 static int aia_create(struct kvm_device *dev, u32 type)
 {
 	if (irqchip_in_kernel(kvm))
 		return -EEXIST;
+	if (!riscv_isa_extension_available(NULL, SSAIA))
+		return -ENODEV;
 	ret = -EBUSY;
 	if (kvm_trylock_all_vcpus(kvm))
 		return ret;
 static int aia_has_attr(struct kvm_device *dev, struct kvm_device_attr *attr)
 {
-	int nr_vcpus;
+	int nr_vcpus, r = -ENXIO;
 	switch (attr->group) {
 	case KVM_DEV_RISCV_AIA_GRP_CONFIG:
 		}
 		break;
 	case KVM_DEV_RISCV_AIA_GRP_APLIC:
-		return kvm_riscv_aia_aplic_has_attr(dev->kvm, attr->attr);
+		mutex_lock(&dev->kvm->lock);
+		r = kvm_riscv_aia_aplic_has_attr(dev->kvm, attr->attr);
+		mutex_unlock(&dev->kvm->lock);
+		break;
 	case KVM_DEV_RISCV_AIA_GRP_IMSIC:
-		return kvm_riscv_aia_imsic_has_attr(dev->kvm, attr->attr);
+		mutex_lock(&dev->kvm->lock);
+		r = kvm_riscv_aia_imsic_has_attr(dev->kvm, attr->attr);
+		mutex_unlock(&dev->kvm->lock);
+		break;
 	}
-	return -ENXIO;
+	return r;
 }
 struct kvm_device_ops kvm_riscv_aia_device_ops = {

arch/riscv/kvm/aia_imsic.c+4−0

 	int r, rc = KVM_INSN_CONTINUE_NEXT_SEPC;
 	struct imsic *imsic = vcpu->arch.aia_context.imsic_state;
+	/* If IMSIC vCPU state not initialized then forward to user space */
+	if (!imsic)
+		return KVM_INSN_EXIT_TO_USER_SPACE;
 	if (isel == KVM_RISCV_AIA_IMSIC_TOPEI) {
 		/* Read pending and enabled interrupt with highest priority */
 		topei = imsic_mrif_topei(imsic->swfile, imsic->nr_eix,

arch/riscv/kvm/mmu.c+5−1

 bool kvm_unmap_gfn_range(struct kvm *kvm, struct kvm_gfn_range *range)
 {
 	struct kvm_gstage gstage;
+	bool mmu_locked;
 	if (!kvm->arch.pgd)
 		return false;
 	gstage.flags = 0;
 	gstage.vmid = READ_ONCE(kvm->arch.vmid.vmid);
 	gstage.pgd = kvm->arch.pgd;
+	mmu_locked = spin_trylock(&kvm->mmu_lock);
 	kvm_riscv_gstage_unmap_range(&gstage, range->start << PAGE_SHIFT,
 				     (range->end - range->start) << PAGE_SHIFT,
 				     range->may_block);
+	if (mmu_locked)
+		spin_unlock(&kvm->mmu_lock);
 	return false;
 }
 		goto out_unlock;
 	/* Check if we are backed by a THP and thus use block mapping if possible */
-	if (vma_pagesize == PAGE_SIZE)
+	if (!logging && (vma_pagesize == PAGE_SIZE))
 		vma_pagesize = transparent_hugepage_adjust(kvm, memslot, hva, &hfn, &gpa);
 	if (writable) {

arch/riscv/kvm/vcpu.c+1−1

@@ -24,7 +24,7 @@ · 23 unmodified lines
24	#define CREATE_TRACE_POINTS	24	#define CREATE_TRACE_POINTS
25	#include "trace.h"	25	#include "trace.h"
26		26
27	const struct _kvm_stats_desc kvm_vcpu_stats_desc[] = {	27	const struct kvm_stats_desc kvm_vcpu_stats_desc[] = {
28	KVM_GENERIC_VCPU_STATS(),	28	KVM_GENERIC_VCPU_STATS(),
29	STATS_DESC_COUNTER(VCPU, ecall_exit_stat),	29	STATS_DESC_COUNTER(VCPU, ecall_exit_stat),
30	STATS_DESC_COUNTER(VCPU, wfi_exit_stat),	30	STATS_DESC_COUNTER(VCPU, wfi_exit_stat),

arch/riscv/kvm/vcpu_fp.c+13−4

 #include <linux/errno.h>
 #include <linux/err.h>
 #include <linux/kvm_host.h>
+#include <linux/nospec.h>
 #include <linux/uaccess.h>
 #include <asm/cpufeature.h>
 		if (reg_num == KVM_REG_RISCV_FP_F_REG(fcsr))
 			reg_val = &cntx->fp.f.fcsr;
 		else if ((KVM_REG_RISCV_FP_F_REG(f[0]) <= reg_num) &&
-			  reg_num <= KVM_REG_RISCV_FP_F_REG(f[31]))
+			  reg_num <= KVM_REG_RISCV_FP_F_REG(f[31])) {
+			reg_num = array_index_nospec(reg_num,
+					ARRAY_SIZE(cntx->fp.f.f));
 			reg_val = &cntx->fp.f.f[reg_num];
-		else
+		} else
 			return -ENOENT;
 	} else if ((rtype == KVM_REG_RISCV_FP_D) &&
 		   riscv_isa_extension_available(vcpu->arch.isa, d)) {
 			   reg_num <= KVM_REG_RISCV_FP_D_REG(f[31])) {
 			if (KVM_REG_SIZE(reg->id) != sizeof(u64))
 				return -EINVAL;
+			reg_num = array_index_nospec(reg_num,
+					ARRAY_SIZE(cntx->fp.d.f));
 			reg_val = &cntx->fp.d.f[reg_num];
 		} else
 			return -ENOENT;
 		if (reg_num == KVM_REG_RISCV_FP_F_REG(fcsr))
 			reg_val = &cntx->fp.f.fcsr;
 		else if ((KVM_REG_RISCV_FP_F_REG(f[0]) <= reg_num) &&
-			  reg_num <= KVM_REG_RISCV_FP_F_REG(f[31]))
+			  reg_num <= KVM_REG_RISCV_FP_F_REG(f[31])) {
+			reg_num = array_index_nospec(reg_num,
+					ARRAY_SIZE(cntx->fp.f.f));
 			reg_val = &cntx->fp.f.f[reg_num];
-		else
+		} else
 			return -ENOENT;
 	} else if ((rtype == KVM_REG_RISCV_FP_D) &&
 		   riscv_isa_extension_available(vcpu->arch.isa, d)) {
 			   reg_num <= KVM_REG_RISCV_FP_D_REG(f[31])) {
 			if (KVM_REG_SIZE(reg->id) != sizeof(u64))
 				return -EINVAL;
+			reg_num = array_index_nospec(reg_num,
+					ARRAY_SIZE(cntx->fp.d.f));
 			reg_val = &cntx->fp.d.f[reg_num];
 		} else
 			return -ENOENT;

arch/riscv/kvm/vcpu_onereg.c+36−18

 #include <linux/bitops.h>
 #include <linux/errno.h>
 #include <linux/err.h>
+#include <linux/nospec.h>
 #include <linux/uaccess.h>
 #include <linux/kvm_host.h>
 #include <asm/cacheflush.h>
 	    kvm_ext >= ARRAY_SIZE(kvm_isa_ext_arr))
 		return -ENOENT;
+	kvm_ext = array_index_nospec(kvm_ext, ARRAY_SIZE(kvm_isa_ext_arr));
 	*guest_ext = kvm_isa_ext_arr[kvm_ext];
 	switch (*guest_ext) {
 	case RISCV_ISA_EXT_SMNPM:
 	unsigned long reg_num = reg->id & ~(KVM_REG_ARCH_MASK |
 					    KVM_REG_SIZE_MASK |
 					    KVM_REG_RISCV_CORE);
+	unsigned long regs_max = sizeof(struct kvm_riscv_core) / sizeof(unsigned long);
 	unsigned long reg_val;
 	if (KVM_REG_SIZE(reg->id) != sizeof(unsigned long))
 		return -EINVAL;
-	if (reg_num >= sizeof(struct kvm_riscv_core) / sizeof(unsigned long))
+	if (reg_num >= regs_max)
 		return -ENOENT;
+	reg_num = array_index_nospec(reg_num, regs_max);
 	if (reg_num == KVM_REG_RISCV_CORE_REG(regs.pc))
 		reg_val = cntx->sepc;
 	else if (KVM_REG_RISCV_CORE_REG(regs.pc) < reg_num &&
 	unsigned long reg_num = reg->id & ~(KVM_REG_ARCH_MASK |
 					    KVM_REG_SIZE_MASK |
 					    KVM_REG_RISCV_CORE);
+	unsigned long regs_max = sizeof(struct kvm_riscv_core) / sizeof(unsigned long);
 	unsigned long reg_val;
 	if (KVM_REG_SIZE(reg->id) != sizeof(unsigned long))
 		return -EINVAL;
-	if (reg_num >= sizeof(struct kvm_riscv_core) / sizeof(unsigned long))
+	if (reg_num >= regs_max)
 		return -ENOENT;
+	reg_num = array_index_nospec(reg_num, regs_max);
 	if (copy_from_user(&reg_val, uaddr, KVM_REG_SIZE(reg->id)))
 		return -EFAULT;
 					  unsigned long *out_val)
 {
 	struct kvm_vcpu_csr *csr = &vcpu->arch.guest_csr;
+	unsigned long regs_max = sizeof(struct kvm_riscv_csr) / sizeof(unsigned long);
-	if (reg_num >= sizeof(struct kvm_riscv_csr) / sizeof(unsigned long))
+	if (reg_num >= regs_max)
 		return -ENOENT;
+	reg_num = array_index_nospec(reg_num, regs_max);
 	if (reg_num == KVM_REG_RISCV_CSR_REG(sip)) {
 		kvm_riscv_vcpu_flush_interrupts(vcpu);
 		*out_val = (csr->hvip >> VSIP_TO_HVIP_SHIFT) & VSIP_VALID_MASK;
 					  unsigned long reg_val)
 {
 	struct kvm_vcpu_csr *csr = &vcpu->arch.guest_csr;
+	unsigned long regs_max = sizeof(struct kvm_riscv_csr) / sizeof(unsigned long);
-	if (reg_num >= sizeof(struct kvm_riscv_csr) / sizeof(unsigned long))
+	if (reg_num >= regs_max)
 		return -ENOENT;
+	reg_num = array_index_nospec(reg_num, regs_max);
 	if (reg_num == KVM_REG_RISCV_CSR_REG(sip)) {
 		reg_val &= VSIP_VALID_MASK;
 		reg_val <<= VSIP_TO_HVIP_SHIFT;
 						   unsigned long reg_val)
 {
 	struct kvm_vcpu_smstateen_csr *csr = &vcpu->arch.smstateen_csr;
+	unsigned long regs_max = sizeof(struct kvm_riscv_smstateen_csr) /
+		sizeof(unsigned long);
-	if (reg_num >= sizeof(struct kvm_riscv_smstateen_csr) /
+	if (!riscv_isa_extension_available(vcpu->arch.isa, SMSTATEEN))
-		sizeof(unsigned long))
+		return -ENOENT;
-		return -EINVAL;
+	if (reg_num >= regs_max)
+		return -ENOENT;
+	reg_num = array_index_nospec(reg_num, regs_max);
 	((unsigned long *)csr)[reg_num] = reg_val;
 	return 0;
 					    unsigned long *out_val)
 {
 	struct kvm_vcpu_smstateen_csr *csr = &vcpu->arch.smstateen_csr;
+	unsigned long regs_max = sizeof(struct kvm_riscv_smstateen_csr) /
+		sizeof(unsigned long);
-	if (reg_num >= sizeof(struct kvm_riscv_smstateen_csr) /
+	if (!riscv_isa_extension_available(vcpu->arch.isa, SMSTATEEN))
-		sizeof(unsigned long))
+		return -ENOENT;
-		return -EINVAL;
+	if (reg_num >= regs_max)
+		return -ENOENT;
+	reg_num = array_index_nospec(reg_num, regs_max);
 	*out_val = ((unsigned long *)csr)[reg_num];
 	return 0;
 		rc = kvm_riscv_vcpu_aia_get_csr(vcpu, reg_num, &reg_val);
 		break;
 	case KVM_REG_RISCV_CSR_SMSTATEEN:
-		rc = -EINVAL;
+		rc = kvm_riscv_vcpu_smstateen_get_csr(vcpu, reg_num, &reg_val);
-		if (riscv_has_extension_unlikely(RISCV_ISA_EXT_SMSTATEEN))
-			rc = kvm_riscv_vcpu_smstateen_get_csr(vcpu, reg_num,
-							      &reg_val);
 		break;
 	default:
 		rc = -ENOENT;
 		rc = kvm_riscv_vcpu_aia_set_csr(vcpu, reg_num, reg_val);
 		break;
 	case KVM_REG_RISCV_CSR_SMSTATEEN:
-		rc = -EINVAL;
+		rc = kvm_riscv_vcpu_smstateen_set_csr(vcpu, reg_num, reg_val);
-		if (riscv_has_extension_unlikely(RISCV_ISA_EXT_SMSTATEEN))
-			rc = kvm_riscv_vcpu_smstateen_set_csr(vcpu, reg_num,
-							      reg_val);
 		break;
 	default:
 		rc = -ENOENT;

arch/riscv/kvm/vcpu_pmu.c+12−4

 #include <linux/errno.h>
 #include <linux/err.h>
 #include <linux/kvm_host.h>
+#include <linux/nospec.h>
 #include <linux/perf/riscv_pmu.h>
 #include <asm/csr.h>
 #include <asm/kvm_vcpu_sbi.h>
 static u64 kvm_pmu_get_perf_event_hw_config(u32 sbi_event_code)
 {
-	return hw_event_perf_map[sbi_event_code];
+	return hw_event_perf_map[array_index_nospec(sbi_event_code,
+						    SBI_PMU_HW_GENERAL_MAX)];
 }
 static u64 kvm_pmu_get_perf_event_cache_config(u32 sbi_event_code)
 		return -EINVAL;
 	}
+	cidx = array_index_nospec(cidx, RISCV_KVM_MAX_COUNTERS);
 	pmc = &kvpmu->pmc[cidx];
 	if (pmc->cinfo.type != SBI_PMU_CTR_TYPE_FW)
 		return -EINVAL;
 	}
+	cidx = array_index_nospec(cidx, RISCV_KVM_MAX_COUNTERS);
 	pmc = &kvpmu->pmc[cidx];
 	if (pmc->cinfo.type == SBI_PMU_CTR_TYPE_FW) {
 {
 	struct kvm_pmu *kvpmu = vcpu_to_pmu(vcpu);
-	if (cidx > RISCV_KVM_MAX_COUNTERS || cidx == 1) {
+	if (cidx >= RISCV_KVM_MAX_COUNTERS || cidx == 1) {
 		retdata->err_val = SBI_ERR_INVALID_PARAM;
 		return 0;
 	}
+	cidx = array_index_nospec(cidx, RISCV_KVM_MAX_COUNTERS);
 	retdata->out_val = kvpmu->pmc[cidx].cinfo.value;
 	return 0;
 	}
 	/* Start the counters that have been configured and requested by the guest */
 	for_each_set_bit(i, &ctr_mask, RISCV_MAX_COUNTERS) {
-		pmc_index = i + ctr_base;
+		pmc_index = array_index_nospec(i + ctr_base,
+					       RISCV_KVM_MAX_COUNTERS);
 		if (!test_bit(pmc_index, kvpmu->pmc_in_use))
 			continue;
 		/* The guest started the counter again. Reset the overflow status */
 	/* Stop the counters that have been configured and requested by the guest */
 	for_each_set_bit(i, &ctr_mask, RISCV_MAX_COUNTERS) {
-		pmc_index = i + ctr_base;
+		pmc_index = array_index_nospec(i + ctr_base,
+					       RISCV_KVM_MAX_COUNTERS);
 		if (!test_bit(pmc_index, kvpmu->pmc_in_use))
 			continue;
 		pmc = &kvpmu->pmc[pmc_index];
 		}
 	}
+	ctr_idx = array_index_nospec(ctr_idx, RISCV_KVM_MAX_COUNTERS);
 	pmc = &kvpmu->pmc[ctr_idx];
 	pmc->idx = ctr_idx;

arch/riscv/kvm/vm.c+1−1

@@ -13,7 +13,7 @@ · 12 unmodified lines
13	#include <linux/kvm_host.h>	13	#include <linux/kvm_host.h>
14	#include <asm/kvm_mmu.h>	14	#include <asm/kvm_mmu.h>
15		15
16	const struct _kvm_stats_desc kvm_vm_stats_desc[] = {	16	const struct kvm_stats_desc kvm_vm_stats_desc[] = {
17	KVM_GENERIC_VM_STATS()	17	KVM_GENERIC_VM_STATS()
18	};	18	};
19	static_assert(ARRAY_SIZE(kvm_vm_stats_desc) ==	19	static_assert(ARRAY_SIZE(kvm_vm_stats_desc) ==

arch/s390/kernel/irq.c+8−6

 	bool from_idle;
 	from_idle = test_and_clear_cpu_flag(CIF_ENABLED_WAIT);
-	if (from_idle) {
+	if (from_idle)
 		update_timer_idle();
-		regs->psw.mask &= ~(PSW_MASK_EXT | PSW_MASK_IO | PSW_MASK_WAIT);
-	}
 	irq_enter_rcu();
 	set_irq_regs(old_regs);
 	irqentry_exit(regs, state);
+	if (from_idle)
+		regs->psw.mask &= ~(PSW_MASK_EXT | PSW_MASK_IO | PSW_MASK_WAIT);
 }
 void noinstr do_ext_irq(struct pt_regs *regs)
 	bool from_idle;
 	from_idle = test_and_clear_cpu_flag(CIF_ENABLED_WAIT);
-	if (from_idle) {
+	if (from_idle)
 		update_timer_idle();
-		regs->psw.mask &= ~(PSW_MASK_EXT | PSW_MASK_IO | PSW_MASK_WAIT);
-	}
 	irq_enter_rcu();
 	irq_exit_rcu();
 	set_irq_regs(old_regs);
 	irqentry_exit(regs, state);
+	if (from_idle)
+		regs->psw.mask &= ~(PSW_MASK_EXT | PSW_MASK_IO | PSW_MASK_WAIT);
 }
 static void show_msi_interrupt(struct seq_file *p, int irq)

arch/s390/kvm/kvm-s390.c+2−2

@@ -65,7 +65,7 @@ · 64 unmodified lines
65	#define VCPU_IRQS_MAX_BUF (sizeof(struct kvm_s390_irq) * \	65	#define VCPU_IRQS_MAX_BUF (sizeof(struct kvm_s390_irq) * \
66	(KVM_MAX_VCPUS + LOCAL_IRQS))	66	(KVM_MAX_VCPUS + LOCAL_IRQS))
67		67
68	const struct _kvm_stats_desc kvm_vm_stats_desc[] = {	68	const struct kvm_stats_desc kvm_vm_stats_desc[] = {
69	KVM_GENERIC_VM_STATS(),	69	KVM_GENERIC_VM_STATS(),
70	STATS_DESC_COUNTER(VM, inject_io),	70	STATS_DESC_COUNTER(VM, inject_io),
71	STATS_DESC_COUNTER(VM, inject_float_mchk),	71	STATS_DESC_COUNTER(VM, inject_float_mchk),
@@ -91,7 +91,7 @@ const struct kvm_stats_header kvm_vm_stats_header = { · 19 unmodified lines
91	sizeof(kvm_vm_stats_desc),	91	sizeof(kvm_vm_stats_desc),
92	};	92	};
93		93
94	const struct _kvm_stats_desc kvm_vcpu_stats_desc[] = {	94	const struct kvm_stats_desc kvm_vcpu_stats_desc[] = {
95	KVM_GENERIC_VCPU_STATS(),	95	KVM_GENERIC_VCPU_STATS(),
96	STATS_DESC_COUNTER(VCPU, exit_userspace),	96	STATS_DESC_COUNTER(VCPU, exit_userspace),
97	STATS_DESC_COUNTER(VCPU, exit_null),	97	STATS_DESC_COUNTER(VCPU, exit_null),

arch/x86/include/asm/kvm_host.h+2−1

@@ -2485,7 +2485,8 @@ int memslot_rmap_alloc(struct kvm_memory_slot *slot, unsigned long npages); · 2484 unmodified lines
2485	KVM_X86_QUIRK_MWAIT_NEVER_UD_FAULTS \| \	2485	KVM_X86_QUIRK_MWAIT_NEVER_UD_FAULTS \| \
2486	KVM_X86_QUIRK_SLOT_ZAP_ALL \| \	2486	KVM_X86_QUIRK_SLOT_ZAP_ALL \| \
2487	KVM_X86_QUIRK_STUFF_FEATURE_MSRS \| \	2487	KVM_X86_QUIRK_STUFF_FEATURE_MSRS \| \
2488	KVM_X86_QUIRK_IGNORE_GUEST_PAT)	2488	KVM_X86_QUIRK_IGNORE_GUEST_PAT \| \
		2489	KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM)
2489		2490
2490	#define KVM_X86_CONDITIONAL_QUIRKS \	2491	#define KVM_X86_CONDITIONAL_QUIRKS \
2491	(KVM_X86_QUIRK_CD_NW_CLEARED \| \	2492	(KVM_X86_QUIRK_CD_NW_CLEARED \| \

arch/x86/include/uapi/asm/kvm.h+1−0

@@ -476,6 +476,7 @@ struct kvm_sync_regs { · 475 unmodified lines
476	#define KVM_X86_QUIRK_SLOT_ZAP_ALL (1 << 7)	476	#define KVM_X86_QUIRK_SLOT_ZAP_ALL (1 << 7)
477	#define KVM_X86_QUIRK_STUFF_FEATURE_MSRS (1 << 8)	477	#define KVM_X86_QUIRK_STUFF_FEATURE_MSRS (1 << 8)
478	#define KVM_X86_QUIRK_IGNORE_GUEST_PAT (1 << 9)	478	#define KVM_X86_QUIRK_IGNORE_GUEST_PAT (1 << 9)
		479	#define KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM (1 << 10)
479		480
480	#define KVM_STATE_NESTED_FORMAT_VMX 0	481	#define KVM_STATE_NESTED_FORMAT_VMX 0
481	#define KVM_STATE_NESTED_FORMAT_SVM 1	482	#define KVM_STATE_NESTED_FORMAT_SVM 1

arch/x86/kernel/apic/apic.c+6−0

 static inline void try_to_enable_x2apic(int remap_mode) { }
 static inline void __x2apic_enable(void) { }
+static inline void __x2apic_disable(void) { }
 #endif /* !CONFIG_X86_X2APIC */
 void __init enable_IR_x2apic(void)
 	if (x2apic_mode) {
 		__x2apic_enable();
 	} else {
+		if (x2apic_enabled()) {
+			pr_warn_once("x2apic: re-enabled by firmware during resume. Disabling\n");
+			__x2apic_disable();
+		}
 		/*
 		 * Make sure the APICBASE points to the right address
 		 *

arch/x86/kvm/cpuid.c+4−1

 #define SYNTHESIZED_F(name)					\
 ({								\
 	kvm_cpu_cap_synthesized |= feature_bit(name);		\
-	F(name);						\
+								\
+	BUILD_BUG_ON(X86_FEATURE_##name >= MAX_CPU_FEATURES);	\
+	if (boot_cpu_has(X86_FEATURE_##name))			\
+		F(name);					\
 })
 /*

arch/x86/kvm/hyperv.c+5−4

 		if (entries[i] == KVM_HV_TLB_FLUSHALL_ENTRY)
 			goto out_flush_all;
-		if (is_noncanonical_invlpg_address(entries[i], vcpu))
-			continue;
 		/*
 		 * Lower 12 bits of 'address' encode the number of additional
 		 * pages to flush.
 		 */
 		gva = entries[i] & PAGE_MASK;
-		for (j = 0; j < (entries[i] & ~PAGE_MASK) + 1; j++)
+		for (j = 0; j < (entries[i] & ~PAGE_MASK) + 1; j++) {
+			if (is_noncanonical_invlpg_address(gva + j * PAGE_SIZE, vcpu))
+				continue;
 			kvm_x86_call(flush_tlb_gva)(vcpu, gva + j * PAGE_SIZE);
+		}
 		++vcpu->stat.tlb_flush;
 	}

arch/x86/kvm/ioapic.c+2−1

 	idx = srcu_read_lock(&kvm->irq_srcu);
 	gsi = kvm_irq_map_chip_pin(kvm, irqchip, pin);
 	if (gsi != -1)
-		hlist_for_each_entry_rcu(kimn, &ioapic->mask_notifier_list, link)
+		hlist_for_each_entry_srcu(kimn, &ioapic->mask_notifier_list, link,
+				srcu_read_lock_held(&kvm->irq_srcu))
 			if (kimn->irq == gsi)
 				kimn->func(kimn, mask);
 	srcu_read_unlock(&kvm->irq_srcu, idx);

arch/x86/kvm/svm/avic.c+6−3

 	struct kvm_vcpu *vcpu = &svm->vcpu;
 	vmcb->control.int_ctl &= ~(AVIC_ENABLE_MASK | X2APIC_MODE_MASK);
 	vmcb->control.avic_physical_id &= ~AVIC_PHYSICAL_MAX_INDEX_MASK;
 	vmcb->control.avic_physical_id |= avic_get_max_physical_id(vcpu);
 	vmcb->control.int_ctl |= AVIC_ENABLE_MASK;
+	svm_clr_intercept(svm, INTERCEPT_CR8_WRITE);
 	/*
 	 * Note: KVM supports hybrid-AVIC mode, where KVM emulates x2APIC MSR
 	 * accesses, while interrupt injection to a running vCPU can be
 	vmcb->control.int_ctl &= ~(AVIC_ENABLE_MASK | X2APIC_MODE_MASK);
 	vmcb->control.avic_physical_id &= ~AVIC_PHYSICAL_MAX_INDEX_MASK;
+	if (!sev_es_guest(svm->vcpu.kvm))
+		svm_set_intercept(svm, INTERCEPT_CR8_WRITE);
 	/*
 	 * If running nested and the guest uses its own MSR bitmap, there
 	 * is no need to update L0's msr bitmap
 	vmcb->control.avic_physical_id = __sme_set(__pa(kvm_svm->avic_physical_id_table));
 	vmcb->control.avic_vapic_bar = APIC_DEFAULT_PHYS_BASE;
-	if (kvm_apicv_activated(svm->vcpu.kvm))
+	if (kvm_vcpu_apicv_active(&svm->vcpu))
 		avic_activate_vmcb(svm);
 	else
 		avic_deactivate_vmcb(svm);

arch/x86/kvm/svm/nested.c+10−2

 	return __nested_vmcb_check_controls(vcpu, ctl);
 }
+int nested_svm_check_cached_vmcb12(struct kvm_vcpu *vcpu)
+{
+	if (!nested_vmcb_check_save(vcpu) ||
+	    !nested_vmcb_check_controls(vcpu))
+		return -EINVAL;
+	return 0;
+}
 /*
  * If a feature is not advertised to L1, clear the corresponding vmcb12
  * intercept.
 	nested_copy_vmcb_control_to_cache(svm, &vmcb12->control);
 	nested_copy_vmcb_save_to_cache(svm, &vmcb12->save);
-	if (!nested_vmcb_check_save(vcpu) ||
+	if (nested_svm_check_cached_vmcb12(vcpu) < 0) {
-	    !nested_vmcb_check_controls(vcpu)) {
 		vmcb12->control.exit_code    = SVM_EXIT_ERR;
 		vmcb12->control.exit_info_1  = 0;
 		vmcb12->control.exit_info_2  = 0;

arch/x86/kvm/svm/svm.c+11−6

 	svm_set_intercept(svm, INTERCEPT_CR0_WRITE);
 	svm_set_intercept(svm, INTERCEPT_CR3_WRITE);
 	svm_set_intercept(svm, INTERCEPT_CR4_WRITE);
-	if (!kvm_vcpu_apicv_active(vcpu))
+	svm_set_intercept(svm, INTERCEPT_CR8_WRITE);
-		svm_set_intercept(svm, INTERCEPT_CR8_WRITE);
 	set_dr_intercepts(svm);
 	if (guest_cpu_cap_has(vcpu, X86_FEATURE_ERAPS))
 		svm->vmcb->control.erap_ctl |= ERAP_CONTROL_ALLOW_LARGER_RAP;
-	if (kvm_vcpu_apicv_active(vcpu))
+	if (enable_apicv && irqchip_in_kernel(vcpu->kvm))
 		avic_init_vmcb(svm, vmcb);
 	if (vnmi)
 static int cr8_write_interception(struct kvm_vcpu *vcpu)
 {
+	u8 cr8_prev = kvm_get_cr8(vcpu);
 	int r;
-	u8 cr8_prev = kvm_get_cr8(vcpu);
+	WARN_ON_ONCE(kvm_vcpu_apicv_active(vcpu));
 	/* instruction emulation calls kvm_set_cr8() */
 	r = cr_interception(vcpu);
 	if (lapic_in_kernel(vcpu))
 	vmcb12 = map.hva;
 	nested_copy_vmcb_control_to_cache(svm, &vmcb12->control);
 	nested_copy_vmcb_save_to_cache(svm, &vmcb12->save);
-	ret = enter_svm_guest_mode(vcpu, smram64->svm_guest_vmcb_gpa, vmcb12, false);
-	if (ret)
+	if (nested_svm_check_cached_vmcb12(vcpu) < 0)
+		goto unmap_save;
+	if (enter_svm_guest_mode(vcpu, smram64->svm_guest_vmcb_gpa,
+				 vmcb12, false) != 0)
 		goto unmap_save;
+	ret = 0;
 	svm->nested.nested_run_pending = 1;
 unmap_save:

arch/x86/kvm/svm/svm.h+1−0

@@ -797,6 +797,7 @@ static inline int nested_svm_simple_vmexit(struct vcpu_svm *svm, u32 exit_code) · 796 unmodified lines
797		797
798	int nested_svm_exit_handled(struct vcpu_svm *svm);	798	int nested_svm_exit_handled(struct vcpu_svm *svm);
799	int nested_svm_check_permissions(struct kvm_vcpu *vcpu);	799	int nested_svm_check_permissions(struct kvm_vcpu *vcpu);
		800	int nested_svm_check_cached_vmcb12(struct kvm_vcpu *vcpu);
800	int nested_svm_check_exception(struct vcpu_svm *svm, unsigned nr,	801	int nested_svm_check_exception(struct vcpu_svm *svm, unsigned nr,
801	bool has_error_code, u32 error_code);	802	bool has_error_code, u32 error_code);
802	int nested_svm_exit_special(struct vcpu_svm *svm);	803	int nested_svm_exit_special(struct vcpu_svm *svm);

arch/x86/kvm/vmx/nested.c+45−16

@@ -3300,10 +3300,24 @@ static int nested_vmx_check_guest_state(struct kvm_vcpu *vcpu, · 3299 unmodified lines
3300	if (CC(vmcs12->guest_cr4 & X86_CR4_CET && !(vmcs12->guest_cr0 & X86_CR0_WP)))	3300	if (CC(vmcs12->guest_cr4 & X86_CR4_CET && !(vmcs12->guest_cr0 & X86_CR0_WP)))
3301	return -EINVAL;	3301	return -EINVAL;
3302		3302
3303	if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) &&	3303	if (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_DEBUG_CONTROLS) {
3304	(CC(!kvm_dr7_valid(vmcs12->guest_dr7)) \|\|	3304	u64 debugctl = vmcs12->guest_ia32_debugctl;
3305	CC(!vmx_is_valid_debugctl(vcpu, vmcs12->guest_ia32_debugctl, false))))	3305
3306	return -EINVAL;	3306	/*
		3307	* FREEZE_IN_SMM is not virtualized, but allow L1 to set it in
		3308	* vmcs12's DEBUGCTL under a quirk for backwards compatibility.
		3309	* Note that the quirk only relaxes the consistency check. The
		3310	* vmcc02 bit is still under the control of the host. In
		3311	* particular, if a host administrator decides to clear the bit,
		3312	* then L1 has no say in the matter.
		3313	*/
		3314	if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM))
		3315	debugctl &= ~DEBUGCTLMSR_FREEZE_IN_SMM;
		3316
		3317	if (CC(!kvm_dr7_valid(vmcs12->guest_dr7)) \|\|
		3318	CC(!vmx_is_valid_debugctl(vcpu, debugctl, false)))
		3319	return -EINVAL;
		3320	}
3307		3321
3308	if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_PAT) &&	3322	if ((vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_PAT) &&
3309	CC(!kvm_pat_valid(vmcs12->guest_ia32_pat)))	3323	CC(!kvm_pat_valid(vmcs12->guest_ia32_pat)))
@@ -6842,13 +6856,34 @@ void vmx_leave_nested(struct kvm_vcpu *vcpu) · 3532 unmodified lines
6842	free_nested(vcpu);	6856	free_nested(vcpu);
6843	}	6857	}
6844		6858
		6859	int nested_vmx_check_restored_vmcs12(struct kvm_vcpu *vcpu)
		6860	{
		6861	enum vm_entry_failure_code ignored;
		6862	struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
		6863
		6864	if (nested_cpu_has_shadow_vmcs(vmcs12) &&
		6865	vmcs12->vmcs_link_pointer != INVALID_GPA) {
		6866	struct vmcs12 *shadow_vmcs12 = get_shadow_vmcs12(vcpu);
		6867
		6868	if (shadow_vmcs12->hdr.revision_id != VMCS12_REVISION \|\|
		6869	!shadow_vmcs12->hdr.shadow_vmcs)
		6870	return -EINVAL;
		6871	}
		6872
		6873	if (nested_vmx_check_controls(vcpu, vmcs12) \|\|
		6874	nested_vmx_check_host_state(vcpu, vmcs12) \|\|
		6875	nested_vmx_check_guest_state(vcpu, vmcs12, &ignored))
		6876	return -EINVAL;
		6877
		6878	return 0;
		6879	}
		6880
6845	static int vmx_set_nested_state(struct kvm_vcpu *vcpu,	6881	static int vmx_set_nested_state(struct kvm_vcpu *vcpu,
6846	struct kvm_nested_state __user *user_kvm_nested_state,	6882	struct kvm_nested_state __user *user_kvm_nested_state,
6847	struct kvm_nested_state *kvm_state)	6883	struct kvm_nested_state *kvm_state)
6848	{	6884	{
6849	struct vcpu_vmx *vmx = to_vmx(vcpu);	6885	struct vcpu_vmx *vmx = to_vmx(vcpu);
6850	struct vmcs12 *vmcs12;	6886	struct vmcs12 *vmcs12;
6851	enum vm_entry_failure_code ignored;
6852	struct kvm_vmx_nested_state_data __user *user_vmx_nested_state =	6887	struct kvm_vmx_nested_state_data __user *user_vmx_nested_state =
6853	&user_kvm_nested_state->data.vmx[0];	6888	&user_kvm_nested_state->data.vmx[0];
6854	int ret;	6889	int ret;
@@ -6979,25 +7014,20 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcpu, · 124 unmodified lines
6979	vmx->nested.mtf_pending =	7014	vmx->nested.mtf_pending =
6980	!!(kvm_state->flags & KVM_STATE_NESTED_MTF_PENDING);	7015	!!(kvm_state->flags & KVM_STATE_NESTED_MTF_PENDING);
6981		7016
6982	ret = -EINVAL;
6983	if (nested_cpu_has_shadow_vmcs(vmcs12) &&	7017	if (nested_cpu_has_shadow_vmcs(vmcs12) &&
6984	vmcs12->vmcs_link_pointer != INVALID_GPA) {	7018	vmcs12->vmcs_link_pointer != INVALID_GPA) {
6985	struct vmcs12 *shadow_vmcs12 = get_shadow_vmcs12(vcpu);	7019	struct vmcs12 *shadow_vmcs12 = get_shadow_vmcs12(vcpu);
6986		7020
		7021	ret = -EINVAL;
6987	if (kvm_state->size <	7022	if (kvm_state->size <
6988	sizeof(*kvm_state) +	7023	sizeof(*kvm_state) +
6989	sizeof(user_vmx_nested_state->vmcs12) + sizeof(*shadow_vmcs12))	7024	sizeof(user_vmx_nested_state->vmcs12) + sizeof(*shadow_vmcs12))
6990	goto error_guest_mode;	7025	goto error_guest_mode;
6991		7026
		7027	ret = -EFAULT;
6992	if (copy_from_user(shadow_vmcs12,	7028	if (copy_from_user(shadow_vmcs12,
6993	user_vmx_nested_state->shadow_vmcs12,	7029	user_vmx_nested_state->shadow_vmcs12,
6994	sizeof(*shadow_vmcs12))) {	7030	sizeof(*shadow_vmcs12)))
6995	ret = -EFAULT;
6996	goto error_guest_mode;
6997	}
6998
6999	if (shadow_vmcs12->hdr.revision_id != VMCS12_REVISION \|\|
7000	!shadow_vmcs12->hdr.shadow_vmcs)
7001	goto error_guest_mode;	7031	goto error_guest_mode;
7002	}	7032	}
7003		7033
@@ -7008,9 +7038,8 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcpu, · 4 unmodified lines
7008	kvm_state->hdr.vmx.preemption_timer_deadline;	7038	kvm_state->hdr.vmx.preemption_timer_deadline;
7009	}	7039	}
7010		7040
7011	if (nested_vmx_check_controls(vcpu, vmcs12) \|\|	7041	ret = nested_vmx_check_restored_vmcs12(vcpu);
7012	nested_vmx_check_host_state(vcpu, vmcs12) \|\|	7042	if (ret < 0)
7013	nested_vmx_check_guest_state(vcpu, vmcs12, &ignored))
7014	goto error_guest_mode;	7043	goto error_guest_mode;
7015		7044
7016	vmx->nested.dirty_vmcs12 = true;	7045	vmx->nested.dirty_vmcs12 = true;

arch/x86/kvm/vmx/nested.h+1−0

@@ -22,6 +22,7 @@ void nested_vmx_setup_ctls_msrs(struct vmcs_config *vmcs_conf, u32 ept_caps); · 21 unmodified lines
22	void nested_vmx_hardware_unsetup(void);	22	void nested_vmx_hardware_unsetup(void);
23	__init int nested_vmx_hardware_setup(int (exit_handlers[])(struct kvm_vcpu ));	23	__init int nested_vmx_hardware_setup(int (exit_handlers[])(struct kvm_vcpu ));
24	void nested_vmx_set_vmcs_shadowing_bitmap(void);	24	void nested_vmx_set_vmcs_shadowing_bitmap(void);
		25	int nested_vmx_check_restored_vmcs12(struct kvm_vcpu *vcpu);
25	void nested_vmx_free_vcpu(struct kvm_vcpu *vcpu);	26	void nested_vmx_free_vcpu(struct kvm_vcpu *vcpu);
26	enum nvmx_vmentry_status nested_vmx_enter_non_root_mode(struct kvm_vcpu *vcpu,	27	enum nvmx_vmentry_status nested_vmx_enter_non_root_mode(struct kvm_vcpu *vcpu,
27	bool from_vmentry);	28	bool from_vmentry);

arch/x86/kvm/vmx/vmx.c+7−3

 	}
 	vmx_add_auto_msr(&m->guest, msr, guest_val, VM_ENTRY_MSR_LOAD_COUNT, kvm);
-	vmx_add_auto_msr(&m->guest, msr, host_val, VM_EXIT_MSR_LOAD_COUNT, kvm);
+	vmx_add_auto_msr(&m->host, msr, host_val, VM_EXIT_MSR_LOAD_COUNT, kvm);
 }
 static bool update_transition_efer(struct vcpu_vmx *vmx)
 	}
 	if (vmx->nested.smm.guest_mode) {
+		/* Triple fault if the state is invalid.  */
+		if (nested_vmx_check_restored_vmcs12(vcpu) < 0)
+			return 1;
 		ret = nested_vmx_enter_non_root_mode(vcpu, false);
-		if (ret)
+		if (ret != NVMX_VMENTRY_SUCCESS)
-			return ret;
+			return 1;
 		vmx->nested.nested_run_pending = 1;
 		vmx->nested.smm.guest_mode = false;

arch/x86/kvm/x86.c+2−2

@@ -243,7 +243,7 @@ EXPORT_SYMBOL_FOR_KVM_INTERNAL(enable_ipiv); · 242 unmodified lines
243	bool __read_mostly enable_device_posted_irqs = true;	243	bool __read_mostly enable_device_posted_irqs = true;
244	EXPORT_SYMBOL_FOR_KVM_INTERNAL(enable_device_posted_irqs);	244	EXPORT_SYMBOL_FOR_KVM_INTERNAL(enable_device_posted_irqs);
245		245
246	const struct _kvm_stats_desc kvm_vm_stats_desc[] = {	246	const struct kvm_stats_desc kvm_vm_stats_desc[] = {
247	KVM_GENERIC_VM_STATS(),	247	KVM_GENERIC_VM_STATS(),
248	STATS_DESC_COUNTER(VM, mmu_shadow_zapped),	248	STATS_DESC_COUNTER(VM, mmu_shadow_zapped),
249	STATS_DESC_COUNTER(VM, mmu_pte_write),	249	STATS_DESC_COUNTER(VM, mmu_pte_write),
@@ -269,7 +269,7 @@ const struct kvm_stats_header kvm_vm_stats_header = { · 19 unmodified lines
269	sizeof(kvm_vm_stats_desc),	269	sizeof(kvm_vm_stats_desc),
270	};	270	};
271		271
272	const struct _kvm_stats_desc kvm_vcpu_stats_desc[] = {	272	const struct kvm_stats_desc kvm_vcpu_stats_desc[] = {
273	KVM_GENERIC_VCPU_STATS(),	273	KVM_GENERIC_VCPU_STATS(),
274	STATS_DESC_COUNTER(VCPU, pf_taken),	274	STATS_DESC_COUNTER(VCPU, pf_taken),
275	STATS_DESC_COUNTER(VCPU, pf_fixed),	275	STATS_DESC_COUNTER(VCPU, pf_fixed),

drivers/accel/amdxdna/aie2_ctx.c+2−12

 	trace_xdna_job(&job->base, job->hwctx->name, "signaled fence", job->seq);
-	amdxdna_pm_suspend_put(job->hwctx->client->xdna);
 	job->hwctx->priv->completed++;
 	dma_fence_signal(fence);
 	struct dma_fence *fence;
 	int ret;
-	ret = amdxdna_pm_resume_get(hwctx->client->xdna);
+	if (!hwctx->priv->mbox_chann)
-	if (ret)
 		return NULL;
-	if (!hwctx->priv->mbox_chann) {
+	if (!mmget_not_zero(job->mm))
-		amdxdna_pm_suspend_put(hwctx->client->xdna);
-		return NULL;
-	}
-	if (!mmget_not_zero(job->mm)) {
-		amdxdna_pm_suspend_put(hwctx->client->xdna);
 		return ERR_PTR(-ESRCH);
-	}
 	kref_get(&job->refcnt);
 	fence = dma_fence_get(job->fence);
 out:
 	if (ret) {
-		amdxdna_pm_suspend_put(hwctx->client->xdna);
 		dma_fence_put(job->fence);
 		aie2_job_put(job);
 		mmput(job->mm);

drivers/accel/amdxdna/amdxdna_ctx.c+10−0

 #include "amdxdna_ctx.h"
 #include "amdxdna_gem.h"
 #include "amdxdna_pci_drv.h"
+#include "amdxdna_pm.h"
 #define MAX_HWCTX_ID		255
 #define MAX_ARG_COUNT		4095
 void amdxdna_sched_job_cleanup(struct amdxdna_sched_job *job)
 {
 	trace_amdxdna_debug_point(job->hwctx->name, job->seq, "job release");
+	amdxdna_pm_suspend_put(job->hwctx->client->xdna);
 	amdxdna_arg_bos_put(job);
 	amdxdna_gem_put_obj(job->cmd_bo);
 	dma_fence_put(job->fence);
 		goto cmd_put;
 	}
+	ret = amdxdna_pm_resume_get(xdna);
+	if (ret) {
+		XDNA_ERR(xdna, "Resume failed, ret %d", ret);
+		goto put_bos;
+	}
 	idx = srcu_read_lock(&client->hwctx_srcu);
 	hwctx = xa_load(&client->hwctx_xa, hwctx_hdl);
 	if (!hwctx) {
 	dma_fence_put(job->fence);
 unlock_srcu:
 	srcu_read_unlock(&client->hwctx_srcu, idx);
+	amdxdna_pm_suspend_put(xdna);
+put_bos:
 	amdxdna_arg_bos_put(job);
 cmd_put:
 	amdxdna_gem_put_obj(job->cmd_bo);

drivers/accel/ivpu/ivpu_hw_40xx_reg.h+0−6

 #define VPU_50XX_HOST_SS_AON_PWR_ISLAND_STATUS_DLY			0x0003006cu
 #define VPU_50XX_HOST_SS_AON_PWR_ISLAND_STATUS_DLY_STATUS_DLY_MASK	GENMASK(7, 0)
-#define VPU_40XX_HOST_SS_AON_RETENTION0                                 0x0003000cu
-#define VPU_40XX_HOST_SS_AON_RETENTION1                                 0x00030010u
-#define VPU_40XX_HOST_SS_AON_RETENTION2                                 0x00030014u
-#define VPU_40XX_HOST_SS_AON_RETENTION3                                 0x00030018u
-#define VPU_40XX_HOST_SS_AON_RETENTION4                                 0x0003001cu
 #define VPU_40XX_HOST_SS_AON_IDLE_GEN					0x00030200u
 #define VPU_40XX_HOST_SS_AON_IDLE_GEN_EN_MASK				BIT_MASK(0)
 #define VPU_40XX_HOST_SS_AON_IDLE_GEN_HW_PG_EN_MASK			BIT_MASK(1)

drivers/accel/ivpu/ivpu_hw_ip.c+0−1

@@ -931,7 +931,6 @@ static int soc_cpu_boot_40xx(struct ivpu_device *vdev) · 930 unmodified lines
931		931
932	static int soc_cpu_boot_60xx(struct ivpu_device *vdev)	932	static int soc_cpu_boot_60xx(struct ivpu_device *vdev)
933	{	933	{
934	REGV_WR64(VPU_40XX_HOST_SS_AON_RETENTION1, vdev->fw->mem_bp->vpu_addr);
935	soc_cpu_set_entry_point_40xx(vdev, vdev->fw->cold_boot_entry_point);	934	soc_cpu_set_entry_point_40xx(vdev, vdev->fw->cold_boot_entry_point);
936		935
937	return 0;	936	return 0;

drivers/acpi/Kconfig+1−0

@@ -9,6 +9,7 @@ config ARCH_SUPPORTS_ACPI · 8 unmodified lines
9	menuconfig ACPI	9	menuconfig ACPI
10	bool "ACPI (Advanced Configuration and Power Interface) Support"	10	bool "ACPI (Advanced Configuration and Power Interface) Support"
11	depends on ARCH_SUPPORTS_ACPI	11	depends on ARCH_SUPPORTS_ACPI
		12	select AUXILIARY_BUS
12	select PNP	13	select PNP
13	select NLS	14	select NLS
14	select CRC32	15	select CRC32

drivers/acpi/acpi_platform.c+1−1

@@ -135,7 +135,7 @@ struct platform_device acpi_create_platform_device(struct acpi_device adev, · 134 unmodified lines
135	}	135	}
136	}	136	}
137		137
138	if (adev->device_type == ACPI_BUS_TYPE_DEVICE && !adev->pnp.type.backlight) {	138	if (adev->device_type == ACPI_BUS_TYPE_DEVICE) {
139	LIST_HEAD(resource_list);	139	LIST_HEAD(resource_list);
140		140
141	count = acpi_dev_get_resources(adev, &resource_list, NULL, NULL);	141	count = acpi_dev_get_resources(adev, &resource_list, NULL, NULL);

drivers/acpi/acpi_processor.c+8−7

 				     PCI_ANY_ID, PCI_ANY_ID, NULL);
 		if (ide_dev) {
 			errata.piix4.bmisx = pci_resource_start(ide_dev, 4);
+			if (errata.piix4.bmisx)
+				dev_dbg(&ide_dev->dev,
+					"Bus master activity detection (BM-IDE) erratum enabled\n");
 			pci_dev_put(ide_dev);
 		}
 		if (isa_dev) {
 			pci_read_config_byte(isa_dev, 0x76, &value1);
 			pci_read_config_byte(isa_dev, 0x77, &value2);
-			if ((value1 & 0x80) || (value2 & 0x80))
+			if ((value1 & 0x80) || (value2 & 0x80)) {
 				errata.piix4.fdma = 1;
+				dev_dbg(&isa_dev->dev,
+					"Type-F DMA livelock erratum (C3 disabled)\n");
+			}
 			pci_dev_put(isa_dev);
 		}
 		break;
 	}
-	if (ide_dev)
-		dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
-	if (isa_dev)
-		dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
 	return 0;
 }

drivers/acpi/acpi_video.c+22−23

 #define pr_fmt(fmt) "ACPI: video: " fmt
+#include <linux/auxiliary_bus.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/sort.h>
 #include <linux/pci.h>
 #include <linux/pci_ids.h>
-#include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <linux/dmi.h>
 #include <linux/suspend.h>
 static DEFINE_MUTEX(register_count_mutex);
 static DEFINE_MUTEX(video_list_lock);
 static LIST_HEAD(video_bus_head);
-static int acpi_video_bus_probe(struct platform_device *pdev);
+static int acpi_video_bus_probe(struct auxiliary_device *aux_dev,
-static void acpi_video_bus_remove(struct platform_device *pdev);
+				const struct auxiliary_device_id *id);
+static void acpi_video_bus_remove(struct auxiliary_device *aux);
 static void acpi_video_bus_notify(acpi_handle handle, u32 event, void *data);
 /*
 	ACPI_VIDEO_FIRST_LEVEL,		/* actual supported levels begin here */
 };
-static const struct acpi_device_id video_device_ids[] = {
+static const struct auxiliary_device_id video_bus_auxiliary_id_table[] = {
-	{ACPI_VIDEO_HID, 0},
+	{ .name = "acpi.video_bus" },
-	{"", 0},
+	{},
 };
-MODULE_DEVICE_TABLE(acpi, video_device_ids);
+MODULE_DEVICE_TABLE(auxiliary, video_bus_auxiliary_id_table);
-static struct platform_driver acpi_video_bus = {
+static struct auxiliary_driver acpi_video_bus = {
 	.probe = acpi_video_bus_probe,
 	.remove = acpi_video_bus_remove,
-	.driver = {
+	.id_table = video_bus_auxiliary_id_table,
-		.name = "acpi-video",
-		.acpi_match_table = video_device_ids,
-	},
 };
 struct acpi_video_bus_flags {
 }
 static int acpi_video_bus_add_notify_handler(struct acpi_video_bus *video,
-					     struct platform_device *pdev)
+					     struct device *parent)
 {
 	struct input_dev *input;
 	struct acpi_video_device *dev;
 	input->phys = video->phys;
 	input->id.bustype = BUS_HOST;
 	input->id.product = 0x06;
-	input->dev.parent = &pdev->dev;
+	input->dev.parent = parent;
 	input->evbit[0] = BIT(EV_KEY);
 	set_bit(KEY_SWITCHVIDEOMODE, input->keybit);
 	set_bit(KEY_VIDEO_NEXT, input->keybit);
 static int instance;
-static int acpi_video_bus_probe(struct platform_device *pdev)
+static int acpi_video_bus_probe(struct auxiliary_device *aux_dev,
+				const struct auxiliary_device_id *id_unused)
 {
-	struct acpi_device *device = ACPI_COMPANION(&pdev->dev);
+	struct acpi_device *device = ACPI_COMPANION(&aux_dev->dev);
 	struct acpi_video_bus *video;
 	bool auto_detect;
 	int error;
 		instance++;
 	}
-	platform_set_drvdata(pdev, video);
+	auxiliary_set_drvdata(aux_dev, video);
 	video->device = device;
 	strscpy(acpi_device_name(device), ACPI_VIDEO_BUS_NAME);
 	    !auto_detect)
 		acpi_video_bus_register_backlight(video);
-	error = acpi_video_bus_add_notify_handler(video, pdev);
+	error = acpi_video_bus_add_notify_handler(video, &aux_dev->dev);
 	if (error)
 		goto err_del;
 	return error;
 }
-static void acpi_video_bus_remove(struct platform_device *pdev)
+static void acpi_video_bus_remove(struct auxiliary_device *aux_dev)
 {
-	struct acpi_video_bus *video = platform_get_drvdata(pdev);
+	struct acpi_video_bus *video = auxiliary_get_drvdata(aux_dev);
-	struct acpi_device *device = ACPI_COMPANION(&pdev->dev);
+	struct acpi_device *device = ACPI_COMPANION(&aux_dev->dev);
 	acpi_dev_remove_notify_handler(device, ACPI_DEVICE_NOTIFY,
 				       acpi_video_bus_notify);
 	dmi_check_system(video_dmi_table);
-	ret = platform_driver_register(&acpi_video_bus);
+	ret = auxiliary_driver_register(&acpi_video_bus);
 	if (ret)
 		goto leave;
 {
 	mutex_lock(&register_count_mutex);
 	if (register_count) {
-		platform_driver_unregister(&acpi_video_bus);
+		auxiliary_driver_unregister(&acpi_video_bus);
 		register_count = 0;
 		may_report_brightness_keys = false;
 	}

drivers/acpi/acpica/acpredef.h+1−1

@@ -451,7 +451,7 @@ const union acpi_predefined_info acpi_gbl_predefined_methods[] = { · 450 unmodified lines
451		451
452	{{"_DSM",	452	{{"_DSM",
453	METHOD_4ARGS(ACPI_TYPE_BUFFER, ACPI_TYPE_INTEGER, ACPI_TYPE_INTEGER,	453	METHOD_4ARGS(ACPI_TYPE_BUFFER, ACPI_TYPE_INTEGER, ACPI_TYPE_INTEGER,
454	ACPI_TYPE_ANY \| ACPI_TYPE_PACKAGE) \|	454	ACPI_TYPE_PACKAGE \| ACPI_TYPE_ANY) \|
455	ARG_COUNT_IS_MINIMUM,	455	ARG_COUNT_IS_MINIMUM,
456	METHOD_RETURNS(ACPI_RTYPE_ALL)}}, /* Must return a value, but it can be of any type */	456	METHOD_RETURNS(ACPI_RTYPE_ALL)}}, /* Must return a value, but it can be of any type */
457		457

drivers/acpi/bus.c+0−3

@@ -818,9 +818,6 @@ const struct acpi_device acpi_companion_match(const struct device dev) · 817 unmodified lines
818	if (list_empty(&adev->pnp.ids))	818	if (list_empty(&adev->pnp.ids))
819	return NULL;	819	return NULL;
820		820
821	if (adev->pnp.type.backlight)
822	return adev;
823
824	return acpi_primary_dev_companion(adev, dev);	821	return acpi_primary_dev_companion(adev, dev);
825	}	822	}
826		823

drivers/acpi/osl.c+1−1

@@ -1681,7 +1681,7 @@ acpi_status __init acpi_os_initialize(void) · 1680 unmodified lines
1681	* Use acpi_os_map_generic_address to pre-map the reset	1681	* Use acpi_os_map_generic_address to pre-map the reset
1682	* register if it's in system memory.	1682	* register if it's in system memory.
1683	*/	1683	*/
1684	void *rv;	1684	void __iomem *rv;
1685		1685
1686	rv = acpi_os_map_generic_address(&acpi_gbl_FADT.reset_register);	1686	rv = acpi_os_map_generic_address(&acpi_gbl_FADT.reset_register);
1687	pr_debug("%s: Reset register mapping %s\n", __func__,	1687	pr_debug("%s: Reset register mapping %s\n", __func__,

drivers/acpi/scan.c+45−0

@@ -6,6 +6,7 @@ · 5 unmodified lines
6	#define pr_fmt(fmt) "ACPI: " fmt	6	#define pr_fmt(fmt) "ACPI: " fmt
7		7
8	#include <linux/async.h>	8	#include <linux/async.h>
		9	#include <linux/auxiliary_bus.h>
9	#include <linux/module.h>	10	#include <linux/module.h>
10	#include <linux/init.h>	11	#include <linux/init.h>
11	#include <linux/slab.h>	12	#include <linux/slab.h>
@@ -2192,6 +2193,44 @@ static acpi_status acpi_bus_check_add_2(acpi_handle handle, u32 lvl_not_used, · 2180 unmodified lines
2192	return acpi_bus_check_add(handle, false, (struct acpi_device **)ret_p);	2193	return acpi_bus_check_add(handle, false, (struct acpi_device **)ret_p);
2193	}	2194	}
2194		2195
		2196	static void acpi_video_bus_device_release(struct device *dev)
		2197	{
		2198	struct auxiliary_device *aux_dev = to_auxiliary_dev(dev);
		2199
		2200	kfree(aux_dev);
		2201	}
		2202
		2203	static void acpi_create_video_bus_device(struct acpi_device *adev,
		2204	struct acpi_device *parent)
		2205	{
		2206	struct auxiliary_device *aux_dev;
		2207	static unsigned int aux_dev_id;
		2208
		2209	aux_dev = kzalloc_obj(*aux_dev);
		2210	if (!aux_dev)
		2211	return;
		2212
		2213	aux_dev->id = aux_dev_id++;
		2214	aux_dev->name = "video_bus";
		2215	aux_dev->dev.parent = acpi_get_first_physical_node(parent);
		2216	if (!aux_dev->dev.parent)
		2217	goto err;
		2218
		2219	aux_dev->dev.release = acpi_video_bus_device_release;
		2220
		2221	if (auxiliary_device_init(aux_dev))
		2222	goto err;
		2223
		2224	ACPI_COMPANION_SET(&aux_dev->dev, adev);
		2225	if (__auxiliary_device_add(aux_dev, "acpi"))
		2226	auxiliary_device_uninit(aux_dev);
		2227
		2228	return;
		2229
		2230	err:
		2231	kfree(aux_dev);
		2232	}
		2233
2195	struct acpi_scan_system_dev {	2234	struct acpi_scan_system_dev {
2196	struct list_head node;	2235	struct list_head node;
2197	struct acpi_device *adev;	2236	struct acpi_device *adev;
@@ -2229,6 +2268,12 @@ static void acpi_default_enumeration(struct acpi_device *device) · 31 unmodified lines
2229	sd->adev = device;	2268	sd->adev = device;
2230	list_add_tail(&sd->node, &acpi_scan_system_dev_list);	2269	list_add_tail(&sd->node, &acpi_scan_system_dev_list);
2231	}	2270	}
		2271	} else if (device->pnp.type.backlight) {
		2272	struct acpi_device *parent;
		2273
		2274	parent = acpi_dev_parent(device);
		2275	if (parent)
		2276	acpi_create_video_bus_device(device, parent);
2232	} else {	2277	} else {
2233	/* For a regular device object, create a platform device. */	2278	/* For a regular device object, create a platform device. */
2234	acpi_create_platform_device(device, NULL);	2279	acpi_create_platform_device(device, NULL);

drivers/android/binder/page_range.rs+64−20

@@ -142,6 +142,30 @@ pub(crate) struct ShrinkablePageRange { · 141 unmodified lines
142	_pin: PhantomPinned,	142	_pin: PhantomPinned,
143	}	143	}
144		144
		145	// We do not define any ops. For now, used only to check identity of vmas.
		146	static BINDER_VM_OPS: bindings::vm_operations_struct = pin_init::zeroed();
		147
		148	// To ensure that we do not accidentally install pages into or zap pages from the wrong vma, we
		149	// check its vm_ops and private data before using it.
		150	fn check_vma(vma: &virt::VmaRef, owner: *const ShrinkablePageRange) -> Option<&virt::VmaMixedMap> {
		151	// SAFETY: Just reading the vm_ops pointer of any active vma is safe.
		152	let vm_ops = unsafe { (*vma.as_ptr()).vm_ops };
		153	if !ptr::eq(vm_ops, &BINDER_VM_OPS) {
		154	return None;
		155	}
		156
		157	// SAFETY: Reading the vm_private_data pointer of a binder-owned vma is safe.
		158	let vm_private_data = unsafe { (*vma.as_ptr()).vm_private_data };
		159	// The ShrinkablePageRange is only dropped when the Process is dropped, which only happens once
		160	// the file's ->release handler is invoked, which means the ShrinkablePageRange outlives any
		161	// VMA associated with it, so there can't be any false positives due to pointer reuse here.
		162	if !ptr::eq(vm_private_data, owner.cast()) {
		163	return None;
		164	}
		165
		166	vma.as_mixedmap_vma()
		167	}
		168
145	struct Inner {	169	struct Inner {
146	/// Array of pages.	170	/// Array of pages.
147	///	171	///
@@ -308,6 +332,18 @@ impl ShrinkablePageRange { · 160 unmodified lines
308	inner.size = num_pages;	332	inner.size = num_pages;
309	inner.vma_addr = vma.start();	333	inner.vma_addr = vma.start();
310		334
		335	// This pointer is only used for comparison - it's not dereferenced.
		336	//
		337	// SAFETY: We own the vma, and we don't use any methods on VmaNew that rely on
		338	// `vm_private_data`.
		339	unsafe {
		340	(*vma.as_ptr()).vm_private_data = ptr::from_ref(self).cast_mut().cast::<c_void>()
		341	};
		342
		343	// SAFETY: We own the vma, and we don't use any methods on VmaNew that rely on
		344	// `vm_ops`.
		345	unsafe { (*vma.as_ptr()).vm_ops = &BINDER_VM_OPS };
		346
311	Ok(num_pages)	347	Ok(num_pages)
312	}	348	}
313		349
@@ -399,22 +435,25 @@ impl ShrinkablePageRange { · 85 unmodified lines
399	//	435	//
400	// Using `mmput_async` avoids this, because then the `mm` cleanup is instead queued to a	436	// Using `mmput_async` avoids this, because then the `mm` cleanup is instead queued to a
401	// workqueue.	437	// workqueue.
402	MmWithUser::into_mmput_async(self.mm.mmget_not_zero().ok_or(ESRCH)?)	438	let mm = MmWithUser::into_mmput_async(self.mm.mmget_not_zero().ok_or(ESRCH)?);
403	.mmap_read_lock()	439	{
404	.vma_lookup(vma_addr)	440	let vma_read;
405	.ok_or(ESRCH)?	441	let mmap_read;
406	.as_mixedmap_vma()	442	let vma = if let Some(ret) = mm.lock_vma_under_rcu(vma_addr) {
407	.ok_or(ESRCH)?	443	vma_read = ret;
408	.vm_insert_page(user_page_addr, &new_page)	444	check_vma(&vma_read, self)
409	.inspect_err(\|err\| {	445	} else {
410	pr_warn!(	446	mmap_read = mm.mmap_read_lock();
411	"Failed to vm_insert_page({}): vma_addr:{} i:{} err:{:?}",	447	mmap_read
412	user_page_addr,	448	.vma_lookup(vma_addr)
413	vma_addr,	449	.and_then(\|vma\| check_vma(vma, self))
414	i,	450	};
415	err	451
416	)	452	match vma {
417	})?;	453	Some(vma) => vma.vm_insert_page(user_page_addr, &new_page)?,
		454	None => return Err(ESRCH),
		455	}
		456	}
418		457
419	let inner = self.lock.lock();	458	let inner = self.lock.lock();
420		459
@@ -667,12 +706,15 @@ unsafe extern "C" fn rust_shrink_free_page( · 246 unmodified lines
667	let mmap_read;	706	let mmap_read;
668	let mm_mutex;	707	let mm_mutex;
669	let vma_addr;	708	let vma_addr;
		709	let range_ptr;
670		710
671	{	711	{
672	// CAST: The `list_head` field is first in `PageInfo`.	712	// CAST: The `list_head` field is first in `PageInfo`.
673	let info = item as *mut PageInfo;	713	let info = item as *mut PageInfo;
674	// SAFETY: The `range` field of `PageInfo` is immutable.	714	// SAFETY: The `range` field of `PageInfo` is immutable.
675	let range = unsafe { &((info).range) };	715	range_ptr = unsafe { (*info).range };
		716	// SAFETY: The `range` outlives its `PageInfo` values.
		717	let range = unsafe { &*range_ptr };
676		718
677	mm = match range.mm.mmget_not_zero() {	719	mm = match range.mm.mmget_not_zero() {
678	Some(mm) => MmWithUser::into_mmput_async(mm),	720	Some(mm) => MmWithUser::into_mmput_async(mm),
@@ -717,9 +759,11 @@ unsafe extern "C" fn rust_shrink_free_page( · 38 unmodified lines
717	// SAFETY: The lru lock is locked when this method is called.	759	// SAFETY: The lru lock is locked when this method is called.
718	unsafe { bindings::spin_unlock(&raw mut (*lru).lock) };	760	unsafe { bindings::spin_unlock(&raw mut (*lru).lock) };
719		761
720	if let Some(vma) = mmap_read.vma_lookup(vma_addr) {	762	if let Some(unchecked_vma) = mmap_read.vma_lookup(vma_addr) {
721	let user_page_addr = vma_addr + (page_index << PAGE_SHIFT);	763	if let Some(vma) = check_vma(unchecked_vma, range_ptr) {
722	vma.zap_page_range_single(user_page_addr, PAGE_SIZE);	764	let user_page_addr = vma_addr + (page_index << PAGE_SHIFT);
		765	vma.zap_page_range_single(user_page_addr, PAGE_SIZE);
		766	}
723	}	767	}
724		768
725	drop(mmap_read);	769	drop(mmap_read);

drivers/android/binder/process.rs+2−1

@@ -1295,7 +1295,8 @@ impl Process { · 1294 unmodified lines
1295	}	1295	}
1296		1296
1297	pub(crate) fn dead_binder_done(&self, cookie: u64, thread: &Thread) {	1297	pub(crate) fn dead_binder_done(&self, cookie: u64, thread: &Thread) {
1298	if let Some(death) = self.inner.lock().pull_delivered_death(cookie) {	1298	let death = self.inner.lock().pull_delivered_death(cookie);
		1299	if let Some(death) = death {
1299	death.set_notification_done(thread);	1300	death.set_notification_done(thread);
1300	}	1301	}
1301	}	1302	}

drivers/android/binder/range_alloc/array.rs+33−2

@@ -118,7 +118,7 @@ impl<T> ArrayRangeAllocator<T> { · 117 unmodified lines
118	size: usize,	118	size: usize,
119	is_oneway: bool,	119	is_oneway: bool,
120	pid: Pid,	120	pid: Pid,
121	) -> Result<usize> {	121	) -> Result<(usize, bool)> {
122	// Compute new value of free_oneway_space, which is set only on success.	122	// Compute new value of free_oneway_space, which is set only on success.
123	let new_oneway_space = if is_oneway {	123	let new_oneway_space = if is_oneway {
124	match self.free_oneway_space.checked_sub(size) {	124	match self.free_oneway_space.checked_sub(size) {
@@ -146,7 +146,38 @@ impl<T> ArrayRangeAllocator<T> { · 21 unmodified lines
146	.ok()	146	.ok()
147	.unwrap();	147	.unwrap();
148		148
149	Ok(insert_at_offset)	149	// Start detecting spammers once we have less than 20%
		150	// of async space left (which is less than 10% of total
		151	// buffer size).
		152	//
		153	// (This will short-circuit, so `low_oneway_space` is
		154	// only called when necessary.)
		155	let oneway_spam_detected =
		156	is_oneway && new_oneway_space < self.size / 10 && self.low_oneway_space(pid);
		157
		158	Ok((insert_at_offset, oneway_spam_detected))
		159	}
		160
		161	/// Find the amount and size of buffers allocated by the current caller.
		162	///
		163	/// The idea is that once we cross the threshold, whoever is responsible
		164	/// for the low async space is likely to try to send another async transaction,
		165	/// and at some point we'll catch them in the act. This is more efficient
		166	/// than keeping a map per pid.
		167	fn low_oneway_space(&self, calling_pid: Pid) -> bool {
		168	let mut total_alloc_size = 0;
		169	let mut num_buffers = 0;
		170
		171	// Warn if this pid has more than 50 transactions, or more than 50% of
		172	// async space (which is 25% of total buffer size). Oneway spam is only
		173	// detected when the threshold is exceeded.
		174	for range in &self.ranges {
		175	if range.state.is_oneway() && range.state.pid() == calling_pid {
		176	total_alloc_size += range.size;
		177	num_buffers += 1;
		178	}
		179	}
		180	num_buffers > 50 \|\| total_alloc_size > self.size / 4
150	}	181	}
151		182
152	pub(crate) fn reservation_abort(&mut self, offset: usize) -> Result<FreedRange> {	183	pub(crate) fn reservation_abort(&mut self, offset: usize) -> Result<FreedRange> {

drivers/android/binder/range_alloc/mod.rs+2−2

@@ -188,11 +188,11 @@ impl<T> RangeAllocator<T> { · 187 unmodified lines
188	self.reserve_new(args)	188	self.reserve_new(args)
189	}	189	}
190	Impl::Array(array) => {	190	Impl::Array(array) => {
191	let offset =	191	let (offset, oneway_spam_detected) =
192	array.reserve_new(args.debug_id, args.size, args.is_oneway, args.pid)?;	192	array.reserve_new(args.debug_id, args.size, args.is_oneway, args.pid)?;
193	Ok(ReserveNew::Success(ReserveNewSuccess {	193	Ok(ReserveNew::Success(ReserveNewSuccess {
194	offset,	194	offset,
195	oneway_spam_detected: false,	195	oneway_spam_detected,
196	_empty_array_alloc: args.empty_array_alloc,	196	_empty_array_alloc: args.empty_array_alloc,
197	_new_tree_alloc: args.new_tree_alloc,	197	_new_tree_alloc: args.new_tree_alloc,
198	_tree_alloc: args.tree_alloc,	198	_tree_alloc: args.tree_alloc,

drivers/android/binder/range_alloc/tree.rs+9−9

             self.free_oneway_space
         };
-        // Start detecting spammers once we have less than 20%
-        // of async space left (which is less than 10% of total
-        // buffer size).
-        //
-        // (This will short-circut, so `low_oneway_space` is
-        // only called when necessary.)
-        let oneway_spam_detected =
-            is_oneway && new_oneway_space < self.size / 10 && self.low_oneway_space(pid);
         let (found_size, found_off, tree_node, free_tree_node) = match self.find_best_match(size) {
             None => {
                 pr_warn!("ENOSPC from range_alloc.reserve_new - size: {}", size);
             self.free_tree.insert(free_tree_node);
         }
+        // Start detecting spammers once we have less than 20%
+        // of async space left (which is less than 10% of total
+        // buffer size).
+        //
+        // (This will short-circuit, so `low_oneway_space` is
+        // only called when necessary.)
+        let oneway_spam_detected =
+            is_oneway && new_oneway_space < self.size / 10 && self.low_oneway_space(pid);
         Ok((found_off, oneway_spam_detected))
     }

drivers/android/binder/thread.rs+6−11

         // Copy offsets if there are any.
         if offsets_size > 0 {
-            {
+            let mut offsets_reader =
-                let mut reader =
+                UserSlice::new(UserPtr::from_addr(trd_data_ptr.offsets as _), offsets_size)
-                    UserSlice::new(UserPtr::from_addr(trd_data_ptr.offsets as _), offsets_size)
+                    .reader();
-                        .reader();
-                alloc.copy_into(&mut reader, aligned_data_size, offsets_size)?;
-            }
             let offsets_start = aligned_data_size;
             let offsets_end = aligned_data_size + offsets_size;
                 .step_by(size_of::<u64>())
                 .enumerate()
             {
-                let offset: usize = view
+                let offset = offsets_reader.read::<u64>()?;
-                    .alloc
+                view.alloc.write(index_offset, &offset)?;
-                    .read::<u64>(index_offset)?
+                let offset: usize = offset.try_into().map_err(|_| EINVAL)?;
-                    .try_into()
-                    .map_err(|_| EINVAL)?;
                 if offset < end_of_previous_object || !is_aligned(offset, size_of::<u32>()) {
                     pr_warn!("Got transaction with invalid offset.");

drivers/base/power/runtime.c+1−0

@@ -1895,6 +1895,7 @@ void pm_runtime_reinit(struct device *dev) · 1894 unmodified lines
1895	void pm_runtime_remove(struct device *dev)	1895	void pm_runtime_remove(struct device *dev)
1896	{	1896	{
1897	__pm_runtime_disable(dev, false);	1897	__pm_runtime_disable(dev, false);
		1898	flush_work(&dev->power.work);
1898	pm_runtime_reinit(dev);	1899	pm_runtime_reinit(dev);
1899	}	1900	}
1900		1901

drivers/block/ublk_drv.c+12−4

 	/* Skip partition scan if disabled by user */
 	if (ub->dev_info.flags & UBLK_F_NO_AUTO_PART_SCAN) {
-		clear_bit(GD_SUPPRESS_PART_SCAN, &disk->state);
+		/* Not clear for unprivileged daemons, see comment above */
+		if (!ub->unprivileged_daemons)
+			clear_bit(GD_SUPPRESS_PART_SCAN, &disk->state);
 	} else {
 		/* Schedule async partition scan for trusted daemons */
 		if (!ub->unprivileged_daemons)
 	return 0;
 }
-static void ublk_ctrl_set_size(struct ublk_device *ub, const struct ublksrv_ctrl_cmd *header)
+static int ublk_ctrl_set_size(struct ublk_device *ub, const struct ublksrv_ctrl_cmd *header)
 {
 	struct ublk_param_basic *p = &ub->params.basic;
 	u64 new_size = header->data[0];
+	int ret = 0;
 	mutex_lock(&ub->mutex);
+	if (!ub->ub_disk) {
+		ret = -ENODEV;
+		goto out;
+	}
 	p->dev_sectors = new_size;
 	set_capacity_and_notify(ub->ub_disk, p->dev_sectors);
+out:
 	mutex_unlock(&ub->mutex);
+	return ret;
 }
 struct count_busy {
 		ret = ublk_ctrl_end_recovery(ub, &header);
 		break;
 	case UBLK_CMD_UPDATE_SIZE:
-		ublk_ctrl_set_size(ub, &header);
+		ret = ublk_ctrl_set_size(ub, &header);
-		ret = 0;
 		break;
 	case UBLK_CMD_QUIESCE_DEV:
 		ret = ublk_ctrl_quiesce_dev(ub, &header);

drivers/bluetooth/btqca.c+2−0

@@ -787,6 +787,8 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate, · 786 unmodified lines
787	*/	787	*/
788	if (soc_type == QCA_WCN3988)	788	if (soc_type == QCA_WCN3988)
789	rom_ver = ((soc_ver & 0x00000f00) >> 0x05) \| (soc_ver & 0x0000000f);	789	rom_ver = ((soc_ver & 0x00000f00) >> 0x05) \| (soc_ver & 0x0000000f);
		790	else if (soc_type == QCA_WCN3998)
		791	rom_ver = ((soc_ver & 0x0000f000) >> 0x07) \| (soc_ver & 0x0000000f);
790	else	792	else
791	rom_ver = ((soc_ver & 0x00000f00) >> 0x04) \| (soc_ver & 0x0000000f);	793	rom_ver = ((soc_ver & 0x00000f00) >> 0x04) \| (soc_ver & 0x0000000f);
792		794

drivers/cache/ax45mp_cache.c+2−2

 static int __init ax45mp_cache_init(void)
 {
-	struct device_node *np;
 	struct resource res;
 	int ret;
-	np = of_find_matching_node(NULL, ax45mp_cache_ids);
+	struct device_node *np __free(device_node) =
+		of_find_matching_node(NULL, ax45mp_cache_ids);
 	if (!of_device_is_available(np))
 		return -ENODEV;

drivers/cache/starfive_starlink_cache.c+2−2

 static int __init starlink_cache_init(void)
 {
-	struct device_node *np;
 	u32 block_size;
 	int ret;
-	np = of_find_matching_node(NULL, starlink_cache_ids);
+	struct device_node *np __free(device_node) =
+		of_find_matching_node(NULL, starlink_cache_ids);
 	if (!of_device_is_available(np))
 		return -ENODEV;

drivers/cpuidle/cpuidle.c+0−10

@@ -359,16 +359,6 @@ noinstr int cpuidle_enter_state(struct cpuidle_device *dev, · 358 unmodified lines
359	int cpuidle_select(struct cpuidle_driver drv, struct cpuidle_device dev,	359	int cpuidle_select(struct cpuidle_driver drv, struct cpuidle_device dev,
360	bool *stop_tick)	360	bool *stop_tick)
361	{	361	{
362	/*
363	* If there is only a single idle state (or none), there is nothing
364	* meaningful for the governor to choose. Skip the governor and
365	* always use state 0 with the tick running.
366	*/
367	if (drv->state_count <= 1) {
368	*stop_tick = false;
369	return 0;
370	}
371
372	return cpuidle_curr_governor->select(drv, dev, stop_tick);	362	return cpuidle_curr_governor->select(drv, dev, stop_tick);
373	}	363	}
374		364

drivers/crypto/ccp/sev-dev.c+1−3

 		 * in Firmware state on failure. Use snp_reclaim_pages() to
 		 * transition either case back to Hypervisor-owned state.
 		 */
-		if (snp_reclaim_pages(__pa(data), 1, true)) {
+		if (snp_reclaim_pages(__pa(data), 1, true))
-			snp_leak_pages(__page_to_pfn(status_page), 1);
 			return -EFAULT;
-		}
 	}
 	if (ret)

drivers/crypto/padlock-sha.c+7−0

@@ -332,6 +332,13 @@ static int __init padlock_init(void) · 331 unmodified lines
332	if (!x86_match_cpu(padlock_sha_ids) \|\| !boot_cpu_has(X86_FEATURE_PHE_EN))	332	if (!x86_match_cpu(padlock_sha_ids) \|\| !boot_cpu_has(X86_FEATURE_PHE_EN))
333	return -ENODEV;	333	return -ENODEV;
334		334
		335	/*
		336	* Skip family 0x07 and newer used by Zhaoxin processors,
		337	* as the driver's self-tests fail on these CPUs.
		338	*/
		339	if (c->x86 >= 0x07)
		340	return -ENODEV;
		341
335	/* Register the newly added algorithm module if on *	342	/* Register the newly added algorithm module if on *
336	* VIA Nano processor, or else just do as before */	343	* VIA Nano processor, or else just do as before */
337	if (c->x86_model < 0x0f) {	344	if (c->x86_model < 0x0f) {

drivers/firewire/net.c+3−2

 	memcpy((u8 *)hh->hh_data + HH_DATA_OFF(FWNET_HLEN), haddr, net->addr_len);
 }
-static int fwnet_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+static int fwnet_header_parse(const struct sk_buff *skb, const struct net_device *dev,
+			      unsigned char *haddr)
 {
-	memcpy(haddr, skb->dev->dev_addr, FWNET_ALEN);
+	memcpy(haddr, dev->dev_addr, FWNET_ALEN);
 	return FWNET_ALEN;
 }

drivers/firmware/arm_ffa/driver.c+4−4

@@ -205,12 +205,12 @@ static int ffa_rxtx_map(phys_addr_t tx_buf, phys_addr_t rx_buf, u32 pg_cnt) · 204 unmodified lines
205	return 0;	205	return 0;
206	}	206	}
207		207
208	static int ffa_rxtx_unmap(u16 vm_id)	208	static int ffa_rxtx_unmap(void)
209	{	209	{
210	ffa_value_t ret;	210	ffa_value_t ret;
211		211
212	invoke_ffa_fn((ffa_value_t){	212	invoke_ffa_fn((ffa_value_t){
213	.a0 = FFA_RXTX_UNMAP, .a1 = PACK_TARGET_INFO(vm_id, 0),	213	.a0 = FFA_RXTX_UNMAP,
214	}, &ret);	214	}, &ret);
215		215
216	if (ret.a0 == FFA_ERROR)	216	if (ret.a0 == FFA_ERROR)
@@ -2097,7 +2097,7 @@ static int __init ffa_init(void) · 1880 unmodified lines
2097		2097
2098	pr_err("failed to setup partitions\n");	2098	pr_err("failed to setup partitions\n");
2099	ffa_notifications_cleanup();	2099	ffa_notifications_cleanup();
2100	ffa_rxtx_unmap(drv_info->vm_id);	2100	ffa_rxtx_unmap();
2101	free_pages:	2101	free_pages:
2102	if (drv_info->tx_buffer)	2102	if (drv_info->tx_buffer)
2103	free_pages_exact(drv_info->tx_buffer, rxtx_bufsz);	2103	free_pages_exact(drv_info->tx_buffer, rxtx_bufsz);
@@ -2112,7 +2112,7 @@ static void __exit ffa_exit(void) · 8 unmodified lines
2112	{	2112	{
2113	ffa_notifications_cleanup();	2113	ffa_notifications_cleanup();
2114	ffa_partitions_cleanup();	2114	ffa_partitions_cleanup();
2115	ffa_rxtx_unmap(drv_info->vm_id);	2115	ffa_rxtx_unmap();
2116	free_pages_exact(drv_info->tx_buffer, drv_info->rxtx_bufsz);	2116	free_pages_exact(drv_info->tx_buffer, drv_info->rxtx_bufsz);
2117	free_pages_exact(drv_info->rx_buffer, drv_info->rxtx_bufsz);	2117	free_pages_exact(drv_info->rx_buffer, drv_info->rxtx_bufsz);
2118	kfree(drv_info);	2118	kfree(drv_info);

drivers/firmware/arm_scmi/notify.c+2−2

@@ -1066,7 +1066,7 @@ static int scmi_register_event_handler(struct scmi_notify_instance *ni, · 1065 unmodified lines
1066	* since at creation time we usually want to have all setup and ready before	1066	* since at creation time we usually want to have all setup and ready before
1067	* events really start flowing.	1067	* events really start flowing.
1068	*	1068	*
1069	* Return: A properly refcounted handler on Success, NULL on Failure	1069	* Return: A properly refcounted handler on Success, ERR_PTR on Failure
1070	*/	1070	*/
1071	static inline struct scmi_event_handler *	1071	static inline struct scmi_event_handler *
1072	__scmi_event_handler_get_ops(struct scmi_notify_instance *ni,	1072	__scmi_event_handler_get_ops(struct scmi_notify_instance *ni,
@@ -1113,7 +1113,7 @@ __scmi_event_handler_get_ops(struct scmi_notify_instance *ni, · 40 unmodified lines
1113	}	1113	}
1114	mutex_unlock(&ni->pending_mtx);	1114	mutex_unlock(&ni->pending_mtx);
1115		1115
1116	return hndl;	1116	return hndl ?: ERR_PTR(-ENODEV);
1117	}	1117	}
1118		1118
1119	static struct scmi_event_handler *	1119	static struct scmi_event_handler *

drivers/firmware/arm_scmi/protocols.h+2−2

@@ -189,13 +189,13 @@ struct scmi_protocol_handle { · 188 unmodified lines
189		189
190	/**	190	/**
191	* struct scmi_iterator_state - Iterator current state descriptor	191	* struct scmi_iterator_state - Iterator current state descriptor
192	* @desc_index: Starting index for the current mulit-part request.	192	* @desc_index: Starting index for the current multi-part request.
193	* @num_returned: Number of returned items in the last multi-part reply.	193	* @num_returned: Number of returned items in the last multi-part reply.
194	* @num_remaining: Number of remaining items in the multi-part message.	194	* @num_remaining: Number of remaining items in the multi-part message.
195	* @max_resources: Maximum acceptable number of items, configured by the caller	195	* @max_resources: Maximum acceptable number of items, configured by the caller
196	* depending on the underlying resources that it is querying.	196	* depending on the underlying resources that it is querying.
197	* @loop_idx: The iterator loop index in the current multi-part reply.	197	* @loop_idx: The iterator loop index in the current multi-part reply.
198	* @rx_len: Size in bytes of the currenly processed message; it can be used by	198	* @rx_len: Size in bytes of the currently processed message; it can be used by
199	* the user of the iterator to verify a reply size.	199	* the user of the iterator to verify a reply size.
200	* @priv: Optional pointer to some additional state-related private data setup	200	* @priv: Optional pointer to some additional state-related private data setup
201	* by the caller during the iterations.	201	* by the caller during the iterations.

drivers/firmware/arm_scpi.c+3−2

 #include <linux/bitmap.h>
 #include <linux/bitfield.h>
+#include <linux/cleanup.h>
 #include <linux/device.h>
 #include <linux/err.h>
 #include <linux/export.h>
 		int idx = scpi_drvinfo->num_chans;
 		struct scpi_chan *pchan = scpi_drvinfo->channels + idx;
 		struct mbox_client *cl = &pchan->cl;
-		struct device_node *shmem = of_parse_phandle(np, "shmem", idx);
+		struct device_node *shmem __free(device_node) =
+			of_parse_phandle(np, "shmem", idx);
 		if (!of_match_node(shmem_of_match, shmem))
 			return -ENXIO;
 		ret = of_address_to_resource(shmem, 0, &res);
-		of_node_put(shmem);
 		if (ret) {
 			dev_err(dev, "failed to get SCPI payload mem resource\n");
 			return ret;

drivers/firmware/cirrus/cs_dsp.c+18−6

 			   region_name);
 		if (reg) {
+			/*
+			 * Although we expect the underlying bus does not require
+			 * physically-contiguous buffers, we pessimistically use
+			 * a temporary buffer instead of trusting that the
+			 * alignment of region->data is ok.
+			 */
 			region_len = le32_to_cpu(region->len);
 			if (region_len > buf_len) {
 				buf_len = round_up(region_len, PAGE_SIZE);
-				kfree(buf);
+				vfree(buf);
-				buf = kmalloc(buf_len, GFP_KERNEL | GFP_DMA);
+				buf = vmalloc(buf_len);
 				if (!buf) {
 					ret = -ENOMEM;
 					goto out_fw;
 	ret = 0;
 out_fw:
-	kfree(buf);
+	vfree(buf);
 	if (ret == -EOVERFLOW)
 		cs_dsp_err(dsp, "%s: file content overflows file data\n", file);
 		}
 		if (reg) {
+			/*
+			 * Although we expect the underlying bus does not require
+			 * physically-contiguous buffers, we pessimistically use
+			 * a temporary buffer instead of trusting that the
+			 * alignment of blk->data is ok.
+			 */
 			region_len = le32_to_cpu(blk->len);
 			if (region_len > buf_len) {
 				buf_len = round_up(region_len, PAGE_SIZE);
-				kfree(buf);
+				vfree(buf);
-				buf = kmalloc(buf_len, GFP_KERNEL | GFP_DMA);
+				buf = vmalloc(buf_len);
 				if (!buf) {
 					ret = -ENOMEM;
 					goto out_fw;
 	ret = 0;
 out_fw:
-	kfree(buf);
+	vfree(buf);
 	if (ret == -EOVERFLOW)
 		cs_dsp_err(dsp, "%s: file content overflows file data\n", file);

drivers/firmware/stratix10-rsu.c+2−0

 				 rsu_async_status_callback);
 	if (ret) {
 		dev_err(dev, "Error, getting RSU status %i\n", ret);
+		stratix10_svc_remove_async_client(priv->chan);
 		stratix10_svc_free_channel(priv->chan);
+		return ret;
 	}
 	/* get DCMF version from firmware */

drivers/firmware/stratix10-svc.c+126−102

@@ -37,15 +37,14 @@ · 36 unmodified lines
37	* service layer will return error to FPGA manager when timeout occurs,	37	* service layer will return error to FPGA manager when timeout occurs,
38	* timeout is set to 30 seconds (30 * 1000) at Intel Stratix10 SoC.	38	* timeout is set to 30 seconds (30 * 1000) at Intel Stratix10 SoC.
39	*/	39	*/
40	#define SVC_NUM_DATA_IN_FIFO 32	40	#define SVC_NUM_DATA_IN_FIFO 8
41	#define SVC_NUM_CHANNEL 4	41	#define SVC_NUM_CHANNEL 4
42	#define FPGA_CONFIG_DATA_CLAIM_TIMEOUT_MS 200	42	#define FPGA_CONFIG_DATA_CLAIM_TIMEOUT_MS 2000
43	#define FPGA_CONFIG_STATUS_TIMEOUT_SEC 30	43	#define FPGA_CONFIG_STATUS_TIMEOUT_SEC 30
44	#define BYTE_TO_WORD_SIZE 4	44	#define BYTE_TO_WORD_SIZE 4
45		45
46	/* stratix10 service layer clients */	46	/* stratix10 service layer clients */
47	#define STRATIX10_RSU "stratix10-rsu"	47	#define STRATIX10_RSU "stratix10-rsu"
48	#define INTEL_FCS "intel-fcs"
49		48
50	/* Maximum number of SDM client IDs. */	49	/* Maximum number of SDM client IDs. */
51	#define MAX_SDM_CLIENT_IDS 16	50	#define MAX_SDM_CLIENT_IDS 16
@@ -105,11 +104,9 @@ struct stratix10_svc_chan; · 53 unmodified lines
105	/**	104	/**
106	* struct stratix10_svc - svc private data	105	* struct stratix10_svc - svc private data
107	* @stratix10_svc_rsu: pointer to stratix10 RSU device	106	* @stratix10_svc_rsu: pointer to stratix10 RSU device
108	* @intel_svc_fcs: pointer to the FCS device
109	*/	107	*/
110	struct stratix10_svc {	108	struct stratix10_svc {
111	struct platform_device *stratix10_svc_rsu;	109	struct platform_device *stratix10_svc_rsu;
112	struct platform_device *intel_svc_fcs;
113	};	110	};
114		111
115	/**	112	/**
@@ -251,12 +248,10 @@ struct stratix10_async_ctrl { · 135 unmodified lines
251	* @num_active_client: number of active service client	248	* @num_active_client: number of active service client
252	* @node: list management	249	* @node: list management
253	* @genpool: memory pool pointing to the memory region	250	* @genpool: memory pool pointing to the memory region
254	* @task: pointer to the thread task which handles SMC or HVC call
255	* @svc_fifo: a queue for storing service message data
256	* @complete_status: state for completion	251	* @complete_status: state for completion
257	* @svc_fifo_lock: protect access to service message data queue
258	* @invoke_fn: function to issue secure monitor call or hypervisor call	252	* @invoke_fn: function to issue secure monitor call or hypervisor call
259	* @svc: manages the list of client svc drivers	253	* @svc: manages the list of client svc drivers
		254	* @sdm_lock: only allows a single command single response to SDM
260	* @actrl: async control structure	255	* @actrl: async control structure
261	*	256	*
262	* This struct is used to create communication channels for service clients, to	257	* This struct is used to create communication channels for service clients, to
@@ -269,12 +264,10 @@ struct stratix10_svc_controller { · 6 unmodified lines
269	int num_active_client;	264	int num_active_client;
270	struct list_head node;	265	struct list_head node;
271	struct gen_pool *genpool;	266	struct gen_pool *genpool;
272	struct task_struct *task;
273	struct kfifo svc_fifo;
274	struct completion complete_status;	267	struct completion complete_status;
275	spinlock_t svc_fifo_lock;
276	svc_invoke_fn *invoke_fn;	268	svc_invoke_fn *invoke_fn;
277	struct stratix10_svc *svc;	269	struct stratix10_svc *svc;
		270	struct mutex sdm_lock;
278	struct stratix10_async_ctrl actrl;	271	struct stratix10_async_ctrl actrl;
279	};	272	};
280		273
@@ -283,6 +276,9 @@ struct stratix10_svc_controller { · 2 unmodified lines
283	* @ctrl: pointer to service controller which is the provider of this channel	276	* @ctrl: pointer to service controller which is the provider of this channel
284	* @scl: pointer to service client which owns the channel	277	* @scl: pointer to service client which owns the channel
285	* @name: service client name associated with the channel	278	* @name: service client name associated with the channel
		279	* @task: pointer to the thread task which handles SMC or HVC call
		280	* @svc_fifo: a queue for storing service message data (separate fifo for every channel)
		281	* @svc_fifo_lock: protect access to service message data queue (locking pending fifo)
286	* @lock: protect access to the channel	282	* @lock: protect access to the channel
287	* @async_chan: reference to asynchronous channel object for this channel	283	* @async_chan: reference to asynchronous channel object for this channel
288	*	284	*
@@ -293,6 +289,9 @@ struct stratix10_svc_chan { · 4 unmodified lines
293	struct stratix10_svc_controller *ctrl;	289	struct stratix10_svc_controller *ctrl;
294	struct stratix10_svc_client *scl;	290	struct stratix10_svc_client *scl;
295	char *name;	291	char *name;
		292	struct task_struct *task;
		293	struct kfifo svc_fifo;
		294	spinlock_t svc_fifo_lock;
296	spinlock_t lock;	295	spinlock_t lock;
297	struct stratix10_async_chan *async_chan;	296	struct stratix10_async_chan *async_chan;
298	};	297	};
@@ -527,10 +526,10 @@ static void svc_thread_recv_status_ok(struct stratix10_svc_data *p_data, · 228 unmodified lines
527	*/	526	*/
528	static int svc_normal_to_secure_thread(void *data)	527	static int svc_normal_to_secure_thread(void *data)
529	{	528	{
530	struct stratix10_svc_controller	529	struct stratix10_svc_chan chan = (struct stratix10_svc_chan )data;
531	ctrl = (struct stratix10_svc_controller )data;	530	struct stratix10_svc_controller *ctrl = chan->ctrl;
532	struct stratix10_svc_data *pdata;	531	struct stratix10_svc_data *pdata = NULL;
533	struct stratix10_svc_cb_data *cbdata;	532	struct stratix10_svc_cb_data *cbdata = NULL;
534	struct arm_smccc_res res;	533	struct arm_smccc_res res;
535	unsigned long a0, a1, a2, a3, a4, a5, a6, a7;	534	unsigned long a0, a1, a2, a3, a4, a5, a6, a7;
536	int ret_fifo = 0;	535	int ret_fifo = 0;
@@ -555,12 +554,12 @@ static int svc_normal_to_secure_thread(void *data) · 18 unmodified lines
555	a6 = 0;	554	a6 = 0;
556	a7 = 0;	555	a7 = 0;
557		556
558	pr_debug("smc_hvc_shm_thread is running\n");	557	pr_debug("%s: %s: Thread is running!\n", __func__, chan->name);
559		558
560	while (!kthread_should_stop()) {	559	while (!kthread_should_stop()) {
561	ret_fifo = kfifo_out_spinlocked(&ctrl->svc_fifo,	560	ret_fifo = kfifo_out_spinlocked(&chan->svc_fifo,
562	pdata, sizeof(*pdata),	561	pdata, sizeof(*pdata),
563	&ctrl->svc_fifo_lock);	562	&chan->svc_fifo_lock);
564		563
565	if (!ret_fifo)	564	if (!ret_fifo)
566	continue;	565	continue;
@@ -569,9 +568,25 @@ static int svc_normal_to_secure_thread(void *data) · 2 unmodified lines
569	(unsigned int)pdata->paddr, pdata->command,	568	(unsigned int)pdata->paddr, pdata->command,
570	(unsigned int)pdata->size);	569	(unsigned int)pdata->size);
571		570
		571	/* SDM can only process one command at a time */
		572	pr_debug("%s: %s: Thread is waiting for mutex!\n",
		573	__func__, chan->name);
		574	if (mutex_lock_interruptible(&ctrl->sdm_lock)) {
		575	/* item already dequeued; notify client to unblock it */
		576	cbdata->status = BIT(SVC_STATUS_ERROR);
		577	cbdata->kaddr1 = NULL;
		578	cbdata->kaddr2 = NULL;
		579	cbdata->kaddr3 = NULL;
		580	if (pdata->chan->scl)
		581	pdata->chan->scl->receive_cb(pdata->chan->scl,
		582	cbdata);
		583	break;
		584	}
		585
572	switch (pdata->command) {	586	switch (pdata->command) {
573	case COMMAND_RECONFIG_DATA_CLAIM:	587	case COMMAND_RECONFIG_DATA_CLAIM:
574	svc_thread_cmd_data_claim(ctrl, pdata, cbdata);	588	svc_thread_cmd_data_claim(ctrl, pdata, cbdata);
		589	mutex_unlock(&ctrl->sdm_lock);
575	continue;	590	continue;
576	case COMMAND_RECONFIG:	591	case COMMAND_RECONFIG:
577	a0 = INTEL_SIP_SMC_FPGA_CONFIG_START;	592	a0 = INTEL_SIP_SMC_FPGA_CONFIG_START;
@@ -700,10 +715,11 @@ static int svc_normal_to_secure_thread(void *data) · 122 unmodified lines
700	break;	715	break;
701	default:	716	default:
702	pr_warn("it shouldn't happen\n");	717	pr_warn("it shouldn't happen\n");
703	break;	718	mutex_unlock(&ctrl->sdm_lock);
		719	continue;
704	}	720	}
705	pr_debug("%s: before SMC call -- a0=0x%016x a1=0x%016x",	721	pr_debug("%s: %s: before SMC call -- a0=0x%016x a1=0x%016x",
706	__func__,	722	__func__, chan->name,
707	(unsigned int)a0,	723	(unsigned int)a0,
708	(unsigned int)a1);	724	(unsigned int)a1);
709	pr_debug(" a2=0x%016x\n", (unsigned int)a2);	725	pr_debug(" a2=0x%016x\n", (unsigned int)a2);
@@ -712,8 +728,8 @@ static int svc_normal_to_secure_thread(void *data) · 2 unmodified lines
712	pr_debug(" a5=0x%016x\n", (unsigned int)a5);	728	pr_debug(" a5=0x%016x\n", (unsigned int)a5);
713	ctrl->invoke_fn(a0, a1, a2, a3, a4, a5, a6, a7, &res);	729	ctrl->invoke_fn(a0, a1, a2, a3, a4, a5, a6, a7, &res);
714		730
715	pr_debug("%s: after SMC call -- res.a0=0x%016x",	731	pr_debug("%s: %s: after SMC call -- res.a0=0x%016x",
716	__func__, (unsigned int)res.a0);	732	__func__, chan->name, (unsigned int)res.a0);
717	pr_debug(" res.a1=0x%016x, res.a2=0x%016x",	733	pr_debug(" res.a1=0x%016x, res.a2=0x%016x",
718	(unsigned int)res.a1, (unsigned int)res.a2);	734	(unsigned int)res.a1, (unsigned int)res.a2);
719	pr_debug(" res.a3=0x%016x\n", (unsigned int)res.a3);	735	pr_debug(" res.a3=0x%016x\n", (unsigned int)res.a3);
@@ -728,6 +744,7 @@ static int svc_normal_to_secure_thread(void *data) · 8 unmodified lines
728	cbdata->kaddr2 = NULL;	744	cbdata->kaddr2 = NULL;
729	cbdata->kaddr3 = NULL;	745	cbdata->kaddr3 = NULL;
730	pdata->chan->scl->receive_cb(pdata->chan->scl, cbdata);	746	pdata->chan->scl->receive_cb(pdata->chan->scl, cbdata);
		747	mutex_unlock(&ctrl->sdm_lock);
731	continue;	748	continue;
732	}	749	}
733		750
@@ -801,6 +818,8 @@ static int svc_normal_to_secure_thread(void *data) · 67 unmodified lines
801	break;	818	break;
802		819
803	}	820	}
		821
		822	mutex_unlock(&ctrl->sdm_lock);
804	}	823	}
805		824
806	kfree(cbdata);	825	kfree(cbdata);
@@ -1696,22 +1715,33 @@ int stratix10_svc_send(struct stratix10_svc_chan chan, void msg) · 889 unmodified lines
1696	if (!p_data)	1715	if (!p_data)
1697	return -ENOMEM;	1716	return -ENOMEM;
1698		1717
1699	/* first client will create kernel thread */	1718	/* first caller creates the per-channel kthread */
1700	if (!chan->ctrl->task) {	1719	if (!chan->task) {
1701	chan->ctrl->task =	1720	struct task_struct *task;
1702	kthread_run_on_cpu(svc_normal_to_secure_thread,	1721
1703	(void *)chan->ctrl,	1722	task = kthread_run_on_cpu(svc_normal_to_secure_thread,
1704	cpu, "svc_smc_hvc_thread");	1723	(void *)chan,
1705	if (IS_ERR(chan->ctrl->task)) {	1724	cpu, "svc_smc_hvc_thread");
		1725	if (IS_ERR(task)) {
1706	dev_err(chan->ctrl->dev,	1726	dev_err(chan->ctrl->dev,
1707	"failed to create svc_smc_hvc_thread\n");	1727	"failed to create svc_smc_hvc_thread\n");
1708	kfree(p_data);	1728	kfree(p_data);
1709	return -EINVAL;	1729	return -EINVAL;
1710	}	1730	}
		1731
		1732	spin_lock(&chan->lock);
		1733	if (chan->task) {
		1734	/* another caller won the race; discard our thread */
		1735	spin_unlock(&chan->lock);
		1736	kthread_stop(task);
		1737	} else {
		1738	chan->task = task;
		1739	spin_unlock(&chan->lock);
		1740	}
1711	}	1741	}
1712		1742
1713	pr_debug("%s: sent P-va=%p, P-com=%x, P-size=%u\n", __func__,	1743	pr_debug("%s: %s: sent P-va=%p, P-com=%x, P-size=%u\n", __func__,
1714	p_msg->payload, p_msg->command,	1744	chan->name, p_msg->payload, p_msg->command,
1715	(unsigned int)p_msg->payload_length);	1745	(unsigned int)p_msg->payload_length);
1716		1746
1717	if (list_empty(&svc_data_mem)) {	1747	if (list_empty(&svc_data_mem)) {
@@ -1747,12 +1777,16 @@ int stratix10_svc_send(struct stratix10_svc_chan chan, void msg) · 29 unmodified lines
1747	p_data->arg[2] = p_msg->arg[2];	1777	p_data->arg[2] = p_msg->arg[2];
1748	p_data->size = p_msg->payload_length;	1778	p_data->size = p_msg->payload_length;
1749	p_data->chan = chan;	1779	p_data->chan = chan;
1750	pr_debug("%s: put to FIFO pa=0x%016x, cmd=%x, size=%u\n", __func__,	1780	pr_debug("%s: %s: put to FIFO pa=0x%016x, cmd=%x, size=%u\n",
1751	(unsigned int)p_data->paddr, p_data->command,	1781	__func__,
1752	(unsigned int)p_data->size);	1782	chan->name,
1753	ret = kfifo_in_spinlocked(&chan->ctrl->svc_fifo, p_data,	1783	(unsigned int)p_data->paddr,
		1784	p_data->command,
		1785	(unsigned int)p_data->size);
		1786
		1787	ret = kfifo_in_spinlocked(&chan->svc_fifo, p_data,
1754	sizeof(*p_data),	1788	sizeof(*p_data),
1755	&chan->ctrl->svc_fifo_lock);	1789	&chan->svc_fifo_lock);
1756		1790
1757	kfree(p_data);	1791	kfree(p_data);
1758		1792
@@ -1773,11 +1807,12 @@ EXPORT_SYMBOL_GPL(stratix10_svc_send); · 14 unmodified lines
1773	*/	1807	*/
1774	void stratix10_svc_done(struct stratix10_svc_chan *chan)	1808	void stratix10_svc_done(struct stratix10_svc_chan *chan)
1775	{	1809	{
1776	/* stop thread when thread is running AND only one active client */	1810	/* stop thread when thread is running */
1777	if (chan->ctrl->task && chan->ctrl->num_active_client <= 1) {	1811	if (chan->task) {
1778	pr_debug("svc_smc_hvc_shm_thread is stopped\n");	1812	pr_debug("%s: %s: svc_smc_hvc_shm_thread is stopping\n",
1779	kthread_stop(chan->ctrl->task);	1813	__func__, chan->name);
1780	chan->ctrl->task = NULL;	1814	kthread_stop(chan->task);
		1815	chan->task = NULL;
1781	}	1816	}
1782	}	1817	}
1783	EXPORT_SYMBOL_GPL(stratix10_svc_done);	1818	EXPORT_SYMBOL_GPL(stratix10_svc_done);
@@ -1817,8 +1852,8 @@ void stratix10_svc_allocate_memory(struct stratix10_svc_chan chan, · 33 unmodified lines
1817	pmem->paddr = pa;	1852	pmem->paddr = pa;
1818	pmem->size = s;	1853	pmem->size = s;
1819	list_add_tail(&pmem->node, &svc_data_mem);	1854	list_add_tail(&pmem->node, &svc_data_mem);
1820	pr_debug("%s: va=%p, pa=0x%016x\n", __func__,	1855	pr_debug("%s: %s: va=%p, pa=0x%016x\n", __func__,
1821	pmem->vaddr, (unsigned int)pmem->paddr);	1856	chan->name, pmem->vaddr, (unsigned int)pmem->paddr);
1822		1857
1823	return (void *)va;	1858	return (void *)va;
1824	}	1859	}
@@ -1855,6 +1890,13 @@ static const struct of_device_id stratix10_svc_drv_match[] = { · 30 unmodified lines
1855	{},	1890	{},
1856	};	1891	};
1857		1892
		1893	static const char * const chan_names[SVC_NUM_CHANNEL] = {
		1894	SVC_CLIENT_FPGA,
		1895	SVC_CLIENT_RSU,
		1896	SVC_CLIENT_FCS,
		1897	SVC_CLIENT_HWMON
		1898	};
		1899
1858	static int stratix10_svc_drv_probe(struct platform_device *pdev)	1900	static int stratix10_svc_drv_probe(struct platform_device *pdev)
1859	{	1901	{
1860	struct device *dev = &pdev->dev;	1902	struct device *dev = &pdev->dev;
@@ -1862,11 +1904,11 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) · 1 unmodified line
1862	struct stratix10_svc_chan *chans;	1904	struct stratix10_svc_chan *chans;
1863	struct gen_pool *genpool;	1905	struct gen_pool *genpool;
1864	struct stratix10_svc_sh_memory *sh_memory;	1906	struct stratix10_svc_sh_memory *sh_memory;
1865	struct stratix10_svc *svc;	1907	struct stratix10_svc *svc = NULL;
1866		1908
1867	svc_invoke_fn *invoke_fn;	1909	svc_invoke_fn *invoke_fn;
1868	size_t fifo_size;	1910	size_t fifo_size;
1869	int ret;	1911	int ret, i = 0;
1870		1912
1871	/* get SMC or HVC function */	1913	/* get SMC or HVC function */
1872	invoke_fn = get_invoke_func(dev);	1914	invoke_fn = get_invoke_func(dev);
@@ -1905,8 +1947,8 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) · 32 unmodified lines
1905	controller->num_active_client = 0;	1947	controller->num_active_client = 0;
1906	controller->chans = chans;	1948	controller->chans = chans;
1907	controller->genpool = genpool;	1949	controller->genpool = genpool;
1908	controller->task = NULL;
1909	controller->invoke_fn = invoke_fn;	1950	controller->invoke_fn = invoke_fn;
		1951	INIT_LIST_HEAD(&controller->node);
1910	init_completion(&controller->complete_status);	1952	init_completion(&controller->complete_status);
1911		1953
1912	ret = stratix10_svc_async_init(controller);	1954	ret = stratix10_svc_async_init(controller);
@@ -1917,32 +1959,20 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) · 4 unmodified lines
1917	}	1959	}
1918		1960
1919	fifo_size = sizeof(struct stratix10_svc_data) * SVC_NUM_DATA_IN_FIFO;	1961	fifo_size = sizeof(struct stratix10_svc_data) * SVC_NUM_DATA_IN_FIFO;
1920	ret = kfifo_alloc(&controller->svc_fifo, fifo_size, GFP_KERNEL);	1962	mutex_init(&controller->sdm_lock);
1921	if (ret) {
1922	dev_err(dev, "failed to allocate FIFO\n");
1923	goto err_async_exit;
1924	}
1925	spin_lock_init(&controller->svc_fifo_lock);
1926
1927	chans[0].scl = NULL;
1928	chans[0].ctrl = controller;
1929	chans[0].name = SVC_CLIENT_FPGA;
1930	spin_lock_init(&chans[0].lock);
1931		1963
1932	chans[1].scl = NULL;	1964	for (i = 0; i < SVC_NUM_CHANNEL; i++) {
1933	chans[1].ctrl = controller;	1965	chans[i].scl = NULL;
1934	chans[1].name = SVC_CLIENT_RSU;	1966	chans[i].ctrl = controller;
1935	spin_lock_init(&chans[1].lock);	1967	chans[i].name = (char *)chan_names[i];
1936		1968	spin_lock_init(&chans[i].lock);
1937	chans[2].scl = NULL;	1969	ret = kfifo_alloc(&chans[i].svc_fifo, fifo_size, GFP_KERNEL);
1938	chans[2].ctrl = controller;	1970	if (ret) {
1939	chans[2].name = SVC_CLIENT_FCS;	1971	dev_err(dev, "failed to allocate FIFO %d\n", i);
1940	spin_lock_init(&chans[2].lock);	1972	goto err_free_fifos;
1941		1973	}
1942	chans[3].scl = NULL;	1974	spin_lock_init(&chans[i].svc_fifo_lock);
1943	chans[3].ctrl = controller;	1975	}
1944	chans[3].name = SVC_CLIENT_HWMON;
1945	spin_lock_init(&chans[3].lock);
1946		1976
1947	list_add_tail(&controller->node, &svc_ctrl);	1977	list_add_tail(&controller->node, &svc_ctrl);
1948	platform_set_drvdata(pdev, controller);	1978	platform_set_drvdata(pdev, controller);
@@ -1951,7 +1981,7 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) · 2 unmodified lines
1951	svc = devm_kzalloc(dev, sizeof(*svc), GFP_KERNEL);	1981	svc = devm_kzalloc(dev, sizeof(*svc), GFP_KERNEL);
1952	if (!svc) {	1982	if (!svc) {
1953	ret = -ENOMEM;	1983	ret = -ENOMEM;
1954	goto err_free_kfifo;	1984	goto err_free_fifos;
1955	}	1985	}
1956	controller->svc = svc;	1986	controller->svc = svc;
1957		1987
@@ -1959,51 +1989,43 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) · 1 unmodified line
1959	if (!svc->stratix10_svc_rsu) {	1989	if (!svc->stratix10_svc_rsu) {
1960	dev_err(dev, "failed to allocate %s device\n", STRATIX10_RSU);	1990	dev_err(dev, "failed to allocate %s device\n", STRATIX10_RSU);
1961	ret = -ENOMEM;	1991	ret = -ENOMEM;
1962	goto err_free_kfifo;	1992	goto err_free_fifos;
1963	}	1993	}
1964		1994
1965	ret = platform_device_add(svc->stratix10_svc_rsu);	1995	ret = platform_device_add(svc->stratix10_svc_rsu);
1966	if (ret) {	1996	if (ret)
1967	platform_device_put(svc->stratix10_svc_rsu);	1997	goto err_put_device;
1968	goto err_free_kfifo;
1969	}
1970
1971	svc->intel_svc_fcs = platform_device_alloc(INTEL_FCS, 1);
1972	if (!svc->intel_svc_fcs) {
1973	dev_err(dev, "failed to allocate %s device\n", INTEL_FCS);
1974	ret = -ENOMEM;
1975	goto err_unregister_rsu_dev;
1976	}
1977
1978	ret = platform_device_add(svc->intel_svc_fcs);
1979	if (ret) {
1980	platform_device_put(svc->intel_svc_fcs);
1981	goto err_unregister_rsu_dev;
1982	}
1983		1998
1984	ret = of_platform_default_populate(dev_of_node(dev), NULL, dev);	1999	ret = of_platform_default_populate(dev_of_node(dev), NULL, dev);
1985	if (ret)	2000	if (ret)
1986	goto err_unregister_fcs_dev;	2001	goto err_unregister_rsu_dev;
1987		2002
1988	pr_info("Intel Service Layer Driver Initialized\n");	2003	pr_info("Intel Service Layer Driver Initialized\n");
1989		2004
1990	return 0;	2005	return 0;
1991		2006
1992	err_unregister_fcs_dev:
1993	platform_device_unregister(svc->intel_svc_fcs);
1994	err_unregister_rsu_dev:	2007	err_unregister_rsu_dev:
1995	platform_device_unregister(svc->stratix10_svc_rsu);	2008	platform_device_unregister(svc->stratix10_svc_rsu);
1996	err_free_kfifo:	2009	goto err_free_fifos;
1997	kfifo_free(&controller->svc_fifo);	2010	err_put_device:
1998	err_async_exit:	2011	platform_device_put(svc->stratix10_svc_rsu);
		2012	err_free_fifos:
		2013	/* only remove from list if list_add_tail() was reached */
		2014	if (!list_empty(&controller->node))
		2015	list_del(&controller->node);
		2016	/* free only the FIFOs that were successfully allocated */
		2017	while (i--)
		2018	kfifo_free(&chans[i].svc_fifo);
1999	stratix10_svc_async_exit(controller);	2019	stratix10_svc_async_exit(controller);
2000	err_destroy_pool:	2020	err_destroy_pool:
2001	gen_pool_destroy(genpool);	2021	gen_pool_destroy(genpool);
		2022
2002	return ret;	2023	return ret;
2003	}	2024	}
2004		2025
2005	static void stratix10_svc_drv_remove(struct platform_device *pdev)	2026	static void stratix10_svc_drv_remove(struct platform_device *pdev)
2006	{	2027	{
		2028	int i;
2007	struct stratix10_svc_controller *ctrl = platform_get_drvdata(pdev);	2029	struct stratix10_svc_controller *ctrl = platform_get_drvdata(pdev);
2008	struct stratix10_svc *svc = ctrl->svc;	2030	struct stratix10_svc *svc = ctrl->svc;
2009		2031
@@ -2011,14 +2033,16 @@ static void stratix10_svc_drv_remove(struct platform_device *pdev) · 1 unmodified line
2011		2033
2012	of_platform_depopulate(ctrl->dev);	2034	of_platform_depopulate(ctrl->dev);
2013		2035
2014	platform_device_unregister(svc->intel_svc_fcs);
2015	platform_device_unregister(svc->stratix10_svc_rsu);	2036	platform_device_unregister(svc->stratix10_svc_rsu);
2016		2037
2017	kfifo_free(&ctrl->svc_fifo);	2038	for (i = 0; i < SVC_NUM_CHANNEL; i++) {
2018	if (ctrl->task) {	2039	if (ctrl->chans[i].task) {
2019	kthread_stop(ctrl->task);	2040	kthread_stop(ctrl->chans[i].task);
2020	ctrl->task = NULL;	2041	ctrl->chans[i].task = NULL;
		2042	}
		2043	kfifo_free(&ctrl->chans[i].svc_fifo);
2021	}	2044	}
		2045
2022	if (ctrl->genpool)	2046	if (ctrl->genpool)
2023	gen_pool_destroy(ctrl->genpool);	2047	gen_pool_destroy(ctrl->genpool);
2024	list_del(&ctrl->node);	2048	list_del(&ctrl->node);

drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c+4−3

 /*
  * Table of devices that work with this driver.
  *
- * Currently, only one device is known to be used in the
+ * Currently, only one device is known to be used in the lpvo_usb_gpib
- * lpvo_usb_gpib adapter (FTDI 0403:6001).
+ * adapter (FTDI 0403:6001) but as this device id is already handled by the
+ * ftdi_sio USB serial driver the LPVO driver must not bind to it by default.
+ *
  * If your adapter uses a different chip, insert a line
  * in the following table with proper <Vendor-id>, <Product-id>.
  *
  */
 static const struct usb_device_id skel_table[] = {
-	{ USB_DEVICE(0x0403, 0x6001) },
 	{ }					   /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, skel_table);

drivers/gpu/drm/amd/amdgpu/amdgpu_device.c+13−1

 		break;
 	default:
 		r = amdgpu_discovery_set_ip_blocks(adev);
-		if (r)
+		if (r) {
+			adev->num_ip_blocks = 0;
 			return r;
+		}
 		break;
 	}
 		i = state == AMD_CG_STATE_GATE ? j : adev->num_ip_blocks - j - 1;
 		if (!adev->ip_blocks[i].status.late_initialized)
 			continue;
+		if (!adev->ip_blocks[i].version)
+			continue;
 		/* skip CG for GFX, SDMA on S0ix */
 		if (adev->in_s0ix &&
 		    (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GFX ||
 		i = state == AMD_PG_STATE_GATE ? j : adev->num_ip_blocks - j - 1;
 		if (!adev->ip_blocks[i].status.late_initialized)
 			continue;
+		if (!adev->ip_blocks[i].version)
+			continue;
 		/* skip PG for GFX, SDMA on S0ix */
 		if (adev->in_s0ix &&
 		    (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GFX ||
 	int i, r;
 	for (i = 0; i < adev->num_ip_blocks; i++) {
+		if (!adev->ip_blocks[i].version)
+			continue;
 		if (!adev->ip_blocks[i].version->funcs->early_fini)
 			continue;
 		if (!adev->ip_blocks[i].status.sw)
 			continue;
+		if (!adev->ip_blocks[i].version)
+			continue;
 		if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GMC) {
 			amdgpu_ucode_free_bo(adev);
 			amdgpu_free_static_csa(&adev->virt.csa_obj);
 	for (i = adev->num_ip_blocks - 1; i >= 0; i--) {
 		if (!adev->ip_blocks[i].status.late_initialized)
 			continue;
+		if (!adev->ip_blocks[i].version)
+			continue;
 		if (adev->ip_blocks[i].version->funcs->late_fini)
 			adev->ip_blocks[i].version->funcs->late_fini(&adev->ip_blocks[i]);
 		adev->ip_blocks[i].status.late_initialized = false;

drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c+1−1

@@ -83,7 +83,7 @@ void amdgpu_driver_unload_kms(struct drm_device *dev) · 82 unmodified lines
83	{	83	{
84	struct amdgpu_device *adev = drm_to_adev(dev);	84	struct amdgpu_device *adev = drm_to_adev(dev);
85		85
86	if (adev == NULL)	86	if (adev == NULL \|\| !adev->num_ip_blocks)
87	return;	87	return;
88		88
89	amdgpu_unregister_gpu_instance(adev);	89	amdgpu_unregister_gpu_instance(adev);

drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h+8−8

drivers/gpu/drm/amd/amdgpu/mes_v12_0.c+4−1

 	int i;
 	struct amdgpu_device *adev = mes->adev;
 	union MESAPI_SET_HW_RESOURCES mes_set_hw_res_pkt;
+	uint32_t mes_rev = (pipe == AMDGPU_MES_SCHED_PIPE) ?
+		(mes->sched_version & AMDGPU_MES_VERSION_MASK) :
+		(mes->kiq_version & AMDGPU_MES_VERSION_MASK);
 	memset(&mes_set_hw_res_pkt, 0, sizeof(mes_set_hw_res_pkt));
 	 * handling support, other queue will not use the oversubscribe timer.
 	 * handling  mode - 0: disabled; 1: basic version; 2: basic+ version
 	 */
-	mes_set_hw_res_pkt.oversubscription_timer = 50;
+	mes_set_hw_res_pkt.oversubscription_timer = mes_rev < 0x8b ? 0 : 50;
 	mes_set_hw_res_pkt.unmapped_doorbell_handling = 1;
 	if (amdgpu_mes_log_enable) {

drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c+1−0

@@ -593,6 +593,7 @@ int pqm_update_queue_properties(struct process_queue_manager *pqm, · 592 unmodified lines
593	p->queue_size)) {	593	p->queue_size)) {
594	pr_debug("ring buf 0x%llx size 0x%llx not mapped on GPU\n",	594	pr_debug("ring buf 0x%llx size 0x%llx not mapped on GPU\n",
595	p->queue_address, p->queue_size);	595	p->queue_address, p->queue_size);
		596	amdgpu_bo_unreserve(vm->root.bo);
596	return -EFAULT;	597	return -EFAULT;
597	}	598	}
598		599

drivers/gpu/drm/amd/display/dc/dccg/dcn20/dcn20_dccg.h+5−1

 	DCCG_SRII(PIXEL_RATE_CNTL, OTG, 0),\
 	DCCG_SRII(PIXEL_RATE_CNTL, OTG, 1),\
 	SR(DISPCLK_FREQ_CHANGE_CNTL),\
-	SR(DC_MEM_GLOBAL_PWR_REQ_CNTL)
+	SR(DC_MEM_GLOBAL_PWR_REQ_CNTL),\
+	SR(MICROSECOND_TIME_BASE_DIV),\
+	SR(MILLISECOND_TIME_BASE_DIV),\
+	SR(DCCG_GATE_DISABLE_CNTL),\
+	SR(DCCG_GATE_DISABLE_CNTL2)
 #define DCCG_REG_LIST_DCN2() \
 	DCCG_COMMON_REG_LIST_DCN_BASE(),\

drivers/gpu/drm/amd/display/dc/dccg/dcn21/dcn21_dccg.c+20−1

@@ -96,6 +96,25 @@ static void dccg21_update_dpp_dto(struct dccg *dccg, int dpp_inst, int req_dppcl · 95 unmodified lines
96	dccg->pipe_dppclk_khz[dpp_inst] = req_dppclk;	96	dccg->pipe_dppclk_khz[dpp_inst] = req_dppclk;
97	}	97	}
98		98
		99	/*
		100	* On DCN21 S0i3 resume, BIOS programs MICROSECOND_TIME_BASE_DIV to
		101	* 0x00120464 as a marker that golden init has already been done.
		102	* dcn21_s0i3_golden_init_wa() reads this marker later in bios_golden_init()
		103	* to decide whether to skip golden init.
		104	*
		105	* dccg2_init() unconditionally overwrites MICROSECOND_TIME_BASE_DIV to
		106	* 0x00120264, destroying the marker before it can be read.
		107	*
		108	* Guard the call: if the S0i3 marker is present, skip dccg2_init() so the
		109	* WA can function correctly. bios_golden_init() will handle init in that case.
		110	*/
		111	static void dccg21_init(struct dccg *dccg)
		112	{
		113	if (dccg2_is_s0i3_golden_init_wa_done(dccg))
		114	return;
		115
		116	dccg2_init(dccg);
		117	}
99		118
100	static const struct dccg_funcs dccg21_funcs = {	119	static const struct dccg_funcs dccg21_funcs = {
101	.update_dpp_dto = dccg21_update_dpp_dto,	120	.update_dpp_dto = dccg21_update_dpp_dto,
@@ -103,7 +122,7 @@ static const struct dccg_funcs dccg21_funcs = { · 1 unmodified line
103	.set_fifo_errdet_ovr_en = dccg2_set_fifo_errdet_ovr_en,	122	.set_fifo_errdet_ovr_en = dccg2_set_fifo_errdet_ovr_en,
104	.otg_add_pixel = dccg2_otg_add_pixel,	123	.otg_add_pixel = dccg2_otg_add_pixel,
105	.otg_drop_pixel = dccg2_otg_drop_pixel,	124	.otg_drop_pixel = dccg2_otg_drop_pixel,
106	.dccg_init = dccg2_init,	125	.dccg_init = dccg21_init,
107	.refclk_setup = dccg2_refclk_setup, /* Deprecated - for backward compatibility only */	126	.refclk_setup = dccg2_refclk_setup, /* Deprecated - for backward compatibility only */
108	.allow_clock_gating = dccg2_allow_clock_gating,	127	.allow_clock_gating = dccg2_allow_clock_gating,
109	.enable_memory_low_power = dccg2_enable_memory_low_power,	128	.enable_memory_low_power = dccg2_enable_memory_low_power,

drivers/gpu/drm/amd/display/dc/dccg/dcn301/dcn301_dccg.h+7−1

 	DCCG_SRII(DTO_PARAM, DPPCLK, 1),\
 	DCCG_SRII(DTO_PARAM, DPPCLK, 2),\
 	DCCG_SRII(DTO_PARAM, DPPCLK, 3),\
-	SR(REFCLK_CNTL)
+	SR(REFCLK_CNTL),\
+	SR(DISPCLK_FREQ_CHANGE_CNTL),\
+	SR(DC_MEM_GLOBAL_PWR_REQ_CNTL),\
+	SR(MICROSECOND_TIME_BASE_DIV),\
+	SR(MILLISECOND_TIME_BASE_DIV),\
+	SR(DCCG_GATE_DISABLE_CNTL),\
+	SR(DCCG_GATE_DISABLE_CNTL2)
 #define DCCG_MASK_SH_LIST_DCN301(mask_sh) \
 	DCCG_SFI(DPPCLK_DTO_CTRL, DTO_ENABLE, DPPCLK, 0, mask_sh),\

drivers/gpu/drm/amd/display/dc/dccg/dcn31/dcn31_dccg.h+4−1

 	SR(DSCCLK1_DTO_PARAM),\
 	SR(DSCCLK2_DTO_PARAM),\
 	SR(DSCCLK_DTO_CTRL),\
+	SR(DCCG_GATE_DISABLE_CNTL),\
 	SR(DCCG_GATE_DISABLE_CNTL2),\
 	SR(DCCG_GATE_DISABLE_CNTL3),\
-	SR(HDMISTREAMCLK0_DTO_PARAM)
+	SR(HDMISTREAMCLK0_DTO_PARAM),\
+	SR(DC_MEM_GLOBAL_PWR_REQ_CNTL),\
+	SR(MICROSECOND_TIME_BASE_DIV)
 #define DCCG_MASK_SH_LIST_DCN31(mask_sh) \

drivers/gpu/drm/amd/display/dc/dccg/dcn314/dcn314_dccg.h+4−1

 	SR(DSCCLK2_DTO_PARAM),\
 	SR(DSCCLK3_DTO_PARAM),\
 	SR(DSCCLK_DTO_CTRL),\
+	SR(DCCG_GATE_DISABLE_CNTL),\
 	SR(DCCG_GATE_DISABLE_CNTL2),\
 	SR(DCCG_GATE_DISABLE_CNTL3),\
 	SR(HDMISTREAMCLK0_DTO_PARAM),\
 	SR(OTG_PIXEL_RATE_DIV),\
-	SR(DTBCLK_P_CNTL)
+	SR(DTBCLK_P_CNTL),\
+	SR(DC_MEM_GLOBAL_PWR_REQ_CNTL),\
+	SR(MICROSECOND_TIME_BASE_DIV)
 #define DCCG_MASK_SH_LIST_DCN314_COMMON(mask_sh) \
 	DCCG_SFI(DPPCLK_DTO_CTRL, DTO_DB_EN, DPPCLK, 0, mask_sh),\

drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c+2−1

 	user_od_table->OverDriveTable.FeatureCtrlMask = BIT(PP_OD_FEATURE_GFXCLK_BIT) |
 							BIT(PP_OD_FEATURE_UCLK_BIT) |
 							BIT(PP_OD_FEATURE_GFX_VF_CURVE_BIT) |
-							BIT(PP_OD_FEATURE_FAN_CURVE_BIT);
+							BIT(PP_OD_FEATURE_FAN_CURVE_BIT) |
+							BIT(PP_OD_FEATURE_ZERO_FAN_BIT);
 	res = smu_v13_0_0_upload_overdrive_table(smu, user_od_table);
 	user_od_table->OverDriveTable.FeatureCtrlMask = 0;
 	if (res == 0)

drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c+2−1

 	user_od_table->OverDriveTable.FeatureCtrlMask = BIT(PP_OD_FEATURE_GFXCLK_BIT) |
 							BIT(PP_OD_FEATURE_UCLK_BIT) |
 							BIT(PP_OD_FEATURE_GFX_VF_CURVE_BIT) |
-							BIT(PP_OD_FEATURE_FAN_CURVE_BIT);
+							BIT(PP_OD_FEATURE_FAN_CURVE_BIT) |
+							BIT(PP_OD_FEATURE_ZERO_FAN_BIT);
 	res = smu_v13_0_7_upload_overdrive_table(smu, user_od_table);
 	user_od_table->OverDriveTable.FeatureCtrlMask = 0;
 	if (res == 0)

drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c+2−1

 	user_od_table->OverDriveTable.FeatureCtrlMask = BIT(PP_OD_FEATURE_GFXCLK_BIT) |
 							BIT(PP_OD_FEATURE_UCLK_BIT) |
 							BIT(PP_OD_FEATURE_GFX_VF_CURVE_BIT) |
-							BIT(PP_OD_FEATURE_FAN_CURVE_BIT);
+							BIT(PP_OD_FEATURE_FAN_CURVE_BIT) |
+							BIT(PP_OD_FEATURE_ZERO_FAN_BIT);
 	res = smu_v14_0_2_upload_overdrive_table(smu, user_od_table);
 	user_od_table->OverDriveTable.FeatureCtrlMask = 0;
 	if (res == 0)

drivers/gpu/drm/bridge/ti-sn65dsi83.c+7−6

 	 *  DSI_CLK = mode clock * bpp / dsi_data_lanes / 2
 	 * the 2 is there because the bus is DDR.
 	 */
-	return DIV_ROUND_UP(clamp((unsigned int)mode->clock *
+	return clamp((unsigned int)mode->clock *
-			    mipi_dsi_pixel_format_to_bpp(ctx->dsi->format) /
+		     mipi_dsi_pixel_format_to_bpp(ctx->dsi->format) /
-			    ctx->dsi->lanes / 2, 40000U, 500000U), 5000U);
+		     ctx->dsi->lanes / 2, 40000U, 500000U) / 5000U;
 }
 static u8 sn65dsi83_get_dsi_div(struct sn65dsi83 *ctx)
 					struct drm_atomic_state *state)
 {
 	struct sn65dsi83 *ctx = bridge_to_sn65dsi83(bridge);
+	const unsigned int dual_factor = ctx->lvds_dual_link ? 2 : 1;
 	const struct drm_bridge_state *bridge_state;
 	const struct drm_crtc_state *crtc_state;
 	const struct drm_display_mode *mode;
 	/* 32 + 1 pixel clock to ensure proper operation */
 	le16val = cpu_to_le16(32 + 1);
 	regmap_bulk_write(ctx->regmap, REG_VID_CHA_SYNC_DELAY_LOW, &le16val, 2);
-	le16val = cpu_to_le16(mode->hsync_end - mode->hsync_start);
+	le16val = cpu_to_le16((mode->hsync_end - mode->hsync_start) / dual_factor);
 	regmap_bulk_write(ctx->regmap, REG_VID_CHA_HSYNC_PULSE_WIDTH_LOW,
 			  &le16val, 2);
 	le16val = cpu_to_le16(mode->vsync_end - mode->vsync_start);
 	regmap_bulk_write(ctx->regmap, REG_VID_CHA_VSYNC_PULSE_WIDTH_LOW,
 			  &le16val, 2);
 	regmap_write(ctx->regmap, REG_VID_CHA_HORIZONTAL_BACK_PORCH,
-		     mode->htotal - mode->hsync_end);
+		     (mode->htotal - mode->hsync_end) / dual_factor);
 	regmap_write(ctx->regmap, REG_VID_CHA_VERTICAL_BACK_PORCH,
 		     mode->vtotal - mode->vsync_end);
 	regmap_write(ctx->regmap, REG_VID_CHA_HORIZONTAL_FRONT_PORCH,
-		     mode->hsync_start - mode->hdisplay);
+		     (mode->hsync_start - mode->hdisplay) / dual_factor);
 	regmap_write(ctx->regmap, REG_VID_CHA_VERTICAL_FRONT_PORCH,
 		     mode->vsync_start - mode->vdisplay);
 	regmap_write(ctx->regmap, REG_VID_CHA_TEST_PATTERN, 0x00);

drivers/gpu/drm/gud/gud_drv.c+8−1

 }
 static const struct drm_crtc_helper_funcs gud_crtc_helper_funcs = {
-	.atomic_check = drm_crtc_helper_atomic_check
+	.atomic_check = drm_crtc_helper_atomic_check,
+	.atomic_enable = gud_crtc_atomic_enable,
+	.atomic_disable = gud_crtc_atomic_disable,
 };
 static const struct drm_crtc_funcs gud_crtc_funcs = {
 	DRM_GEM_SHADOW_PLANE_FUNCS,
 };
+static const struct drm_mode_config_helper_funcs gud_mode_config_helpers = {
+	.atomic_commit_tail = drm_atomic_helper_commit_tail_rpm,
+};
 static const struct drm_mode_config_funcs gud_mode_config_funcs = {
 	.fb_create = drm_gem_fb_create_with_dirty,
 	.atomic_check = drm_atomic_helper_check,
 	drm->mode_config.min_height = le32_to_cpu(desc.min_height);
 	drm->mode_config.max_height = le32_to_cpu(desc.max_height);
 	drm->mode_config.funcs = &gud_mode_config_funcs;
+	drm->mode_config.helper_private = &gud_mode_config_helpers;
 	/* Format init */
 	formats_dev = devm_kmalloc(dev, GUD_FORMATS_MAX_NUM, GFP_KERNEL);

drivers/gpu/drm/gud/gud_internal.h+4−0

 void gud_clear_damage(struct gud_device *gdrm);
 void gud_flush_work(struct work_struct *work);
+void gud_crtc_atomic_enable(struct drm_crtc *crtc,
+			    struct drm_atomic_state *state);
+void gud_crtc_atomic_disable(struct drm_crtc *crtc,
+			     struct drm_atomic_state *state);
 int gud_plane_atomic_check(struct drm_plane *plane,
 			   struct drm_atomic_state *state);
 void gud_plane_atomic_update(struct drm_plane *plane,

drivers/gpu/drm/gud/gud_pipe.c+36−18

 	return ret;
 }
+void gud_crtc_atomic_enable(struct drm_crtc *crtc,
+			    struct drm_atomic_state *state)
+{
+	struct drm_device *drm = crtc->dev;
+	struct gud_device *gdrm = to_gud_device(drm);
+	int idx;
+	if (!drm_dev_enter(drm, &idx))
+		return;
+	gud_usb_set_u8(gdrm, GUD_REQ_SET_CONTROLLER_ENABLE, 1);
+	gud_usb_set(gdrm, GUD_REQ_SET_STATE_COMMIT, 0, NULL, 0);
+	gud_usb_set_u8(gdrm, GUD_REQ_SET_DISPLAY_ENABLE, 1);
+	drm_dev_exit(idx);
+}
+void gud_crtc_atomic_disable(struct drm_crtc *crtc,
+			     struct drm_atomic_state *state)
+{
+	struct drm_device *drm = crtc->dev;
+	struct gud_device *gdrm = to_gud_device(drm);
+	int idx;
+	if (!drm_dev_enter(drm, &idx))
+		return;
+	gud_usb_set_u8(gdrm, GUD_REQ_SET_DISPLAY_ENABLE, 0);
+	gud_usb_set_u8(gdrm, GUD_REQ_SET_CONTROLLER_ENABLE, 0);
+	drm_dev_exit(idx);
+}
 void gud_plane_atomic_update(struct drm_plane *plane,
 			     struct drm_atomic_state *atomic_state)
 {
 		mutex_unlock(&gdrm->damage_lock);
 	}
-	if (!drm_dev_enter(drm, &idx))
+	if (!crtc || !drm_dev_enter(drm, &idx))
 		return;
-	if (!old_state->fb)
-		gud_usb_set_u8(gdrm, GUD_REQ_SET_CONTROLLER_ENABLE, 1);
-	if (fb && (crtc->state->mode_changed || crtc->state->connectors_changed))
-		gud_usb_set(gdrm, GUD_REQ_SET_STATE_COMMIT, 0, NULL, 0);
-	if (crtc->state->active_changed)
-		gud_usb_set_u8(gdrm, GUD_REQ_SET_DISPLAY_ENABLE, crtc->state->active);
-	if (!fb)
-		goto ctrl_disable;
 	ret = drm_gem_fb_begin_cpu_access(fb, DMA_FROM_DEVICE);
 	if (ret)
-		goto ctrl_disable;
+		goto out;
 	drm_atomic_helper_damage_iter_init(&iter, old_state, new_state);
 	drm_atomic_for_each_plane_damage(&iter, &damage)
 	drm_gem_fb_end_cpu_access(fb, DMA_FROM_DEVICE);
-ctrl_disable:
+out:
-	if (!crtc->state->enable)
-		gud_usb_set_u8(gdrm, GUD_REQ_SET_CONTROLLER_ENABLE, 0);
 	drm_dev_exit(idx);
 }

drivers/gpu/drm/i915/display/intel_alpm.c+0−6

 void intel_alpm_init(struct intel_dp *intel_dp)
 {
-	u8 dpcd;
-	if (drm_dp_dpcd_readb(&intel_dp->aux, DP_RECEIVER_ALPM_CAP, &dpcd) < 0)
-		return;
-	intel_dp->alpm_dpcd = dpcd;
 	mutex_init(&intel_dp->alpm.lock);
 }

drivers/gpu/drm/i915/display/intel_display.c+0−1

@@ -1614,7 +1614,6 @@ static void hsw_configure_cpu_transcoder(const struct intel_crtc_state *crtc_sta · 1613 unmodified lines
1614	}	1614	}
1615		1615
1616	intel_set_transcoder_timings(crtc_state);	1616	intel_set_transcoder_timings(crtc_state);
1617	intel_vrr_set_transcoder_timings(crtc_state);
1618		1617
1619	if (cpu_transcoder != TRANSCODER_EDP)	1618	if (cpu_transcoder != TRANSCODER_EDP)
1620	intel_de_write(display, TRANS_MULT(display, cpu_transcoder),	1619	intel_de_write(display, TRANS_MULT(display, cpu_transcoder),

drivers/gpu/drm/i915/display/intel_dp.c+7−0

 intel_edp_init_dpcd(struct intel_dp *intel_dp, struct intel_connector *connector)
 {
 	struct intel_display *display = to_intel_display(intel_dp);
+	int ret;
 	/* this function is meant to be called only once */
 	drm_WARN_ON(display->drm, intel_dp->dpcd[DP_DPCD_REV] != 0);
 	 */
 	intel_dp_init_source_oui(intel_dp);
+	/* Read the ALPM DPCD caps */
+	ret = drm_dp_dpcd_read_byte(&intel_dp->aux, DP_RECEIVER_ALPM_CAP,
+				    &intel_dp->alpm_dpcd);
+	if (ret < 0)
+		return false;
 	/*
 	 * This has to be called after intel_dp->edp_dpcd is filled, PSR checks
 	 * for SET_POWER_CAPABLE bit in intel_dp->edp_dpcd[1]

drivers/gpu/drm/i915/display/intel_psr.c+48−12

 	intel_de_write_dsb(display, dsb, PIPE_SRCSZ_ERLY_TPT(crtc->pipe),
 			   crtc_state->pipe_srcsz_early_tpt);
+	if (!crtc_state->dsc.compression_enable)
+		return;
+	intel_dsc_su_et_parameters_configure(dsb, encoder, crtc_state,
+					     drm_rect_height(&crtc_state->psr2_su_area));
 }
 static void psr2_man_trk_ctl_calc(struct intel_crtc_state *crtc_state,
 		overlap_damage_area->y2 = damage_area->y2;
 }
-static void intel_psr2_sel_fetch_pipe_alignment(struct intel_crtc_state *crtc_state)
+static bool intel_psr2_sel_fetch_pipe_alignment(struct intel_crtc_state *crtc_state)
 {
 	struct intel_display *display = to_intel_display(crtc_state);
 	const struct drm_dsc_config *vdsc_cfg = &crtc_state->dsc.config;
 	u16 y_alignment;
+	bool su_area_changed = false;
 	/* ADLP aligns the SU region to vdsc slice height in case dsc is enabled */
 	if (crtc_state->dsc.compression_enable &&
 	else
 		y_alignment = crtc_state->su_y_granularity;
-	crtc_state->psr2_su_area.y1 -= crtc_state->psr2_su_area.y1 % y_alignment;
+	if (crtc_state->psr2_su_area.y1 % y_alignment) {
-	if (crtc_state->psr2_su_area.y2 % y_alignment)
+		crtc_state->psr2_su_area.y1 -= crtc_state->psr2_su_area.y1 % y_alignment;
+		su_area_changed = true;
+	}
+	if (crtc_state->psr2_su_area.y2 % y_alignment) {
 		crtc_state->psr2_su_area.y2 = ((crtc_state->psr2_su_area.y2 /
 						y_alignment) + 1) * y_alignment;
+		su_area_changed = true;
+	}
+	return su_area_changed;
 }
 /*
 	struct intel_crtc_state *crtc_state = intel_atomic_get_new_crtc_state(state, crtc);
 	struct intel_plane_state *new_plane_state, *old_plane_state;
 	struct intel_plane *plane;
-	bool full_update = false, cursor_in_su_area = false;
+	bool full_update = false, su_area_changed;
 	int i, ret;
 	if (!crtc_state->enable_psr2_sel_fetch)
 	if (ret)
 		return ret;
-	/*
+	do {
-	 * Adjust su area to cover cursor fully as necessary (early
+		bool cursor_in_su_area;
-	 * transport). This needs to be done after
-	 * drm_atomic_add_affected_planes to ensure visible cursor is added into
-	 * affected planes even when cursor is not updated by itself.
-	 */
-	intel_psr2_sel_fetch_et_alignment(state, crtc, &cursor_in_su_area);
-	intel_psr2_sel_fetch_pipe_alignment(crtc_state);
+		/*
+		 * Adjust su area to cover cursor fully as necessary
+		 * (early transport). This needs to be done after
+		 * drm_atomic_add_affected_planes to ensure visible
+		 * cursor is added into affected planes even when
+		 * cursor is not updated by itself.
+		 */
+		intel_psr2_sel_fetch_et_alignment(state, crtc, &cursor_in_su_area);
+		su_area_changed = intel_psr2_sel_fetch_pipe_alignment(crtc_state);
+		/*
+		 * If the cursor was outside the SU area before
+		 * alignment, the alignment step (which only expands
+		 * SU) may pull the cursor partially inside, so we
+		 * must run ET alignment again to fully cover it. But
+		 * if the cursor was already fully inside before
+		 * alignment, expanding the SU area won't change that,
+		 * so no further work is needed.
+		 */
+		if (cursor_in_su_area)
+			break;
+	} while (su_area_changed);
 	/*
 	 * Now that we have the pipe damaged area check if it intersect with
 	}
 skip_sel_fetch_set_loop:
+	if (full_update)
+		clip_area_update(&crtc_state->psr2_su_area, &crtc_state->pipe_src,
+				 &crtc_state->pipe_src);
 	psr2_man_trk_ctl_calc(crtc_state, full_update);
 	crtc_state->pipe_srcsz_early_tpt =
 		psr2_pipe_srcsz_early_tpt_calc(crtc_state, full_update);

drivers/gpu/drm/i915/display/intel_vdsc.c+23−0

@@ -767,6 +767,29 @@ void intel_dsc_dp_pps_write(struct intel_encoder *encoder, · 766 unmodified lines
767	sizeof(dp_dsc_pps_sdp));	767	sizeof(dp_dsc_pps_sdp));
768	}	768	}
769		769
		770	void intel_dsc_su_et_parameters_configure(struct intel_dsb dsb, struct intel_encoder encoder,
		771	const struct intel_crtc_state *crtc_state, int su_lines)
		772	{
		773	struct intel_display *display = to_intel_display(crtc_state);
		774	struct intel_crtc *crtc = to_intel_crtc(crtc_state->uapi.crtc);
		775	const struct drm_dsc_config *vdsc_cfg = &crtc_state->dsc.config;
		776	enum pipe pipe = crtc->pipe;
		777	int vdsc_instances_per_pipe = intel_dsc_get_vdsc_per_pipe(crtc_state);
		778	int slice_row_per_frame = su_lines / vdsc_cfg->slice_height;
		779	u32 val;
		780
		781	drm_WARN_ON_ONCE(display->drm, su_lines % vdsc_cfg->slice_height);
		782	drm_WARN_ON_ONCE(display->drm, vdsc_instances_per_pipe > 2);
		783
		784	val = DSC_SUPS0_SU_SLICE_ROW_PER_FRAME(slice_row_per_frame);
		785	val \|= DSC_SUPS0_SU_PIC_HEIGHT(su_lines);
		786
		787	intel_de_write_dsb(display, dsb, LNL_DSC0_SU_PARAMETER_SET_0(pipe), val);
		788
		789	if (vdsc_instances_per_pipe == 2)
		790	intel_de_write_dsb(display, dsb, LNL_DSC1_SU_PARAMETER_SET_0(pipe), val);
		791	}
		792
770	static i915_reg_t dss_ctl1_reg(struct intel_crtc *crtc, enum transcoder cpu_transcoder)	793	static i915_reg_t dss_ctl1_reg(struct intel_crtc *crtc, enum transcoder cpu_transcoder)
771	{	794	{
772	return is_pipe_dsc(crtc, cpu_transcoder) ?	795	return is_pipe_dsc(crtc, cpu_transcoder) ?

drivers/gpu/drm/i915/display/intel_vdsc.h+3−0

 enum transcoder;
 struct intel_crtc;
 struct intel_crtc_state;
+struct intel_dsb;
 struct intel_encoder;
 bool intel_dsc_source_support(const struct intel_crtc_state *crtc_state);
 			     const struct intel_crtc_state *crtc_state);
 void intel_dsc_dp_pps_write(struct intel_encoder *encoder,
 			    const struct intel_crtc_state *crtc_state);
+void intel_dsc_su_et_parameters_configure(struct intel_dsb *dsb, struct intel_encoder *encoder,
+					  const struct intel_crtc_state *crtc_state, int su_lines);
 void intel_vdsc_state_dump(struct drm_printer *p, int indent,
 			   const struct intel_crtc_state *crtc_state);
 int intel_vdsc_min_cdclk(const struct intel_crtc_state *crtc_state);

drivers/gpu/drm/i915/display/intel_vdsc_regs.h+12−0

@@ -196,6 +196,18 @@ · 195 unmodified lines
196	#define DSC_PPS18_NSL_BPG_OFFSET(offset) REG_FIELD_PREP(DSC_PPS18_NSL_BPG_OFFSET_MASK, offset)	196	#define DSC_PPS18_NSL_BPG_OFFSET(offset) REG_FIELD_PREP(DSC_PPS18_NSL_BPG_OFFSET_MASK, offset)
197	#define DSC_PPS18_SL_OFFSET_ADJ(offset) REG_FIELD_PREP(DSC_PPS18_SL_OFFSET_ADJ_MASK, offset)	197	#define DSC_PPS18_SL_OFFSET_ADJ(offset) REG_FIELD_PREP(DSC_PPS18_SL_OFFSET_ADJ_MASK, offset)
198		198
		199	#define _LNL_DSC0_SU_PARAMETER_SET_0_PA 0x78064
		200	#define _LNL_DSC1_SU_PARAMETER_SET_0_PA 0x78164
		201	#define _LNL_DSC0_SU_PARAMETER_SET_0_PB 0x78264
		202	#define _LNL_DSC1_SU_PARAMETER_SET_0_PB 0x78364
		203	#define LNL_DSC0_SU_PARAMETER_SET_0(pipe) _MMIO_PIPE((pipe), _LNL_DSC0_SU_PARAMETER_SET_0_PA, _LNL_DSC0_SU_PARAMETER_SET_0_PB)
		204	#define LNL_DSC1_SU_PARAMETER_SET_0(pipe) _MMIO_PIPE((pipe), _LNL_DSC1_SU_PARAMETER_SET_0_PA, _LNL_DSC1_SU_PARAMETER_SET_0_PB)
		205
		206	#define DSC_SUPS0_SU_SLICE_ROW_PER_FRAME_MASK REG_GENMASK(31, 20)
		207	#define DSC_SUPS0_SU_SLICE_ROW_PER_FRAME(rows) REG_FIELD_PREP(DSC_SUPS0_SU_SLICE_ROW_PER_FRAME_MASK, (rows))
		208	#define DSC_SUPS0_SU_PIC_HEIGHT_MASK REG_GENMASK(15, 0)
		209	#define DSC_SUPS0_SU_PIC_HEIGHT(h) REG_FIELD_PREP(DSC_SUPS0_SU_PIC_HEIGHT_MASK, (h))
		210
199	/* Icelake Rate Control Buffer Threshold Registers */	211	/* Icelake Rate Control Buffer Threshold Registers */
200	#define DSCA_RC_BUF_THRESH_0 _MMIO(0x6B230)	212	#define DSCA_RC_BUF_THRESH_0 _MMIO(0x6B230)
201	#define DSCA_RC_BUF_THRESH_0_UDW _MMIO(0x6B230 + 4)	213	#define DSCA_RC_BUF_THRESH_0_UDW _MMIO(0x6B230 + 4)

drivers/gpu/drm/i915/display/intel_vrr.c+14−0

@@ -597,6 +597,18 @@ void intel_vrr_set_transcoder_timings(const struct intel_crtc_state *crtc_state) · 596 unmodified lines
597	if (!HAS_VRR(display))	597	if (!HAS_VRR(display))
598	return;	598	return;
599		599
		600	/*
		601	* Bspec says:
		602	* "(note: VRR needs to be programmed after
		603	* TRANS_DDI_FUNC_CTL and before TRANS_CONF)."
		604	*
		605	* In practice it turns out that ICL can hang if
		606	* TRANS_VRR_VMAX/FLIPLINE are written before
		607	* enabling TRANS_DDI_FUNC_CTL.
		608	*/
		609	drm_WARN_ON(display->drm,
		610	!(intel_de_read(display, TRANS_DDI_FUNC_CTL(display, cpu_transcoder)) & TRANS_DDI_FUNC_ENABLE));
		611
600	/*	612	/*
601	* This bit seems to have two meanings depending on the platform:	613	* This bit seems to have two meanings depending on the platform:
602	* TGL: generate VRR "safe window" for DSB vblank waits	614	* TGL: generate VRR "safe window" for DSB vblank waits
@@ -939,6 +951,8 @@ void intel_vrr_transcoder_enable(const struct intel_crtc_state *crtc_state) · 336 unmodified lines
939	{	951	{
940	struct intel_display *display = to_intel_display(crtc_state);	952	struct intel_display *display = to_intel_display(crtc_state);
941		953
		954	intel_vrr_set_transcoder_timings(crtc_state);
		955
942	if (!intel_vrr_possible(crtc_state))	956	if (!intel_vrr_possible(crtc_state))
943	return;	957	return;
944		958

drivers/gpu/drm/i915/gem/i915_gem_shmem.c+9−3

 			}
 		} while (1);
-		nr_pages = min_t(unsigned long,
+		nr_pages = min_array(((unsigned long[]) {
-				folio_nr_pages(folio), page_count - i);
+					folio_nr_pages(folio),
+					page_count - i,
+					max_segment / PAGE_SIZE,
+				      }), 3);
 		if (!i ||
 		    sg->length >= max_segment ||
 		    folio_pfn(folio) != next_pfn) {
 			st->nents++;
 			sg_set_folio(sg, folio, nr_pages * PAGE_SIZE, 0);
 		} else {
-			/* XXX: could overflow? */
+			nr_pages = min_t(unsigned long, nr_pages,
+					 (max_segment - sg->length) / PAGE_SIZE);
 			sg->length += nr_pages * PAGE_SIZE;
 		}
 		next_pfn = folio_pfn(folio) + nr_pages;

drivers/gpu/drm/msm/adreno/a2xx_gpummu.c+1−1

@@ -78,7 +78,7 @@ static void a2xx_gpummu_destroy(struct msm_mmu *mmu) · 77 unmodified lines
78	{	78	{
79	struct a2xx_gpummu *gpummu = to_a2xx_gpummu(mmu);	79	struct a2xx_gpummu *gpummu = to_a2xx_gpummu(mmu);
80		80
81	dma_free_attrs(mmu->dev, TABLE_SIZE, gpummu->table, gpummu->pt_base,	81	dma_free_attrs(mmu->dev, TABLE_SIZE + 32, gpummu->table, gpummu->pt_base,
82	DMA_ATTR_FORCE_CONTIGUOUS);	82	DMA_ATTR_FORCE_CONTIGUOUS);
83		83
84	kfree(gpummu);	84	kfree(gpummu);

drivers/gpu/drm/msm/adreno/a6xx_catalog.c+1−2

 	A6XX_PROTECT_NORDWR(0x27c06, 0x0000),
 };
-DECLARE_ADRENO_PROTECT(x285_protect, 64);
+DECLARE_ADRENO_PROTECT(x285_protect, 15);
 static const struct adreno_reglist_pipe a840_nonctxt_regs[] = {
 	{ REG_A8XX_CP_SMMU_STREAM_ID_LPAC, 0x00000101, BIT(PIPE_NONE) },
 	BUILD_BUG_ON(a660_protect.count > a660_protect.count_max);
 	BUILD_BUG_ON(a690_protect.count > a690_protect.count_max);
 	BUILD_BUG_ON(a730_protect.count > a730_protect.count_max);
-	BUILD_BUG_ON(a840_protect.count > a840_protect.count_max);
 }

drivers/gpu/drm/msm/adreno/a8xx_gpu.c+12−2

@@ -310,11 +310,21 @@ static void a8xx_set_ubwc_config(struct msm_gpu *gpu) · 309 unmodified lines
310	hbb = cfg->highest_bank_bit - 13;	310	hbb = cfg->highest_bank_bit - 13;
311	hbb_hi = hbb >> 2;	311	hbb_hi = hbb >> 2;
312	hbb_lo = hbb & 3;	312	hbb_lo = hbb & 3;
313	a8xx_write_pipe(gpu, PIPE_BV, REG_A8XX_GRAS_NC_MODE_CNTL, hbb << 5);	313
314	a8xx_write_pipe(gpu, PIPE_BR, REG_A8XX_GRAS_NC_MODE_CNTL, hbb << 5);	314	a8xx_write_pipe(gpu, PIPE_BV, REG_A8XX_GRAS_NC_MODE_CNTL,
		315	hbb << 5 \|
		316	level3_swizzling_dis << 4 \|
		317	level2_swizzling_dis << 3);
		318
		319	a8xx_write_pipe(gpu, PIPE_BR, REG_A8XX_GRAS_NC_MODE_CNTL,
		320	hbb << 5 \|
		321	level3_swizzling_dis << 4 \|
		322	level2_swizzling_dis << 3);
315		323
316	a8xx_write_pipe(gpu, PIPE_BR, REG_A8XX_RB_CCU_NC_MODE_CNTL,	324	a8xx_write_pipe(gpu, PIPE_BR, REG_A8XX_RB_CCU_NC_MODE_CNTL,
317	yuvnotcomptofc << 6 \|	325	yuvnotcomptofc << 6 \|
		326	level3_swizzling_dis << 5 \|
		327	level2_swizzling_dis << 4 \|
318	hbb_hi << 3 \|	328	hbb_hi << 3 \|
319	hbb_lo << 1);	329	hbb_lo << 1);
320		330

drivers/gpu/drm/msm/adreno/adreno_device.c+1−0

@@ -302,6 +302,7 @@ static const struct of_device_id dt_match[] = { · 301 unmodified lines
302	{ .compatible = "qcom,kgsl-3d0" },	302	{ .compatible = "qcom,kgsl-3d0" },
303	{}	303	{}
304	};	304	};
		305	MODULE_DEVICE_TABLE(of, dt_match);
305		306
306	static int adreno_runtime_resume(struct device *dev)	307	static int adreno_runtime_resume(struct device *dev)
307	{	308	{

drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_0_sc8280xp.h+6−6

@@ -133,7 +133,7 @@ static const struct dpu_sspp_cfg sc8280xp_sspp[] = { · 132 unmodified lines
133	static const struct dpu_lm_cfg sc8280xp_lm[] = {	133	static const struct dpu_lm_cfg sc8280xp_lm[] = {
134	{	134	{
135	.name = "lm_0", .id = LM_0,	135	.name = "lm_0", .id = LM_0,
136	.base = 0x44000, .len = 0x320,	136	.base = 0x44000, .len = 0x400,
137	.features = MIXER_MSM8998_MASK,	137	.features = MIXER_MSM8998_MASK,
138	.sblk = &sdm845_lm_sblk,	138	.sblk = &sdm845_lm_sblk,
139	.lm_pair = LM_1,	139	.lm_pair = LM_1,
@@ -141,7 +141,7 @@ static const struct dpu_lm_cfg sc8280xp_lm[] = { · 1 unmodified line
141	.dspp = DSPP_0,	141	.dspp = DSPP_0,
142	}, {	142	}, {
143	.name = "lm_1", .id = LM_1,	143	.name = "lm_1", .id = LM_1,
144	.base = 0x45000, .len = 0x320,	144	.base = 0x45000, .len = 0x400,
145	.features = MIXER_MSM8998_MASK,	145	.features = MIXER_MSM8998_MASK,
146	.sblk = &sdm845_lm_sblk,	146	.sblk = &sdm845_lm_sblk,
147	.lm_pair = LM_0,	147	.lm_pair = LM_0,
@@ -149,7 +149,7 @@ static const struct dpu_lm_cfg sc8280xp_lm[] = { · 1 unmodified line
149	.dspp = DSPP_1,	149	.dspp = DSPP_1,
150	}, {	150	}, {
151	.name = "lm_2", .id = LM_2,	151	.name = "lm_2", .id = LM_2,
152	.base = 0x46000, .len = 0x320,	152	.base = 0x46000, .len = 0x400,
153	.features = MIXER_MSM8998_MASK,	153	.features = MIXER_MSM8998_MASK,
154	.sblk = &sdm845_lm_sblk,	154	.sblk = &sdm845_lm_sblk,
155	.lm_pair = LM_3,	155	.lm_pair = LM_3,
@@ -157,7 +157,7 @@ static const struct dpu_lm_cfg sc8280xp_lm[] = { · 1 unmodified line
157	.dspp = DSPP_2,	157	.dspp = DSPP_2,
158	}, {	158	}, {
159	.name = "lm_3", .id = LM_3,	159	.name = "lm_3", .id = LM_3,
160	.base = 0x47000, .len = 0x320,	160	.base = 0x47000, .len = 0x400,
161	.features = MIXER_MSM8998_MASK,	161	.features = MIXER_MSM8998_MASK,
162	.sblk = &sdm845_lm_sblk,	162	.sblk = &sdm845_lm_sblk,
163	.lm_pair = LM_2,	163	.lm_pair = LM_2,
@@ -165,14 +165,14 @@ static const struct dpu_lm_cfg sc8280xp_lm[] = { · 1 unmodified line
165	.dspp = DSPP_3,	165	.dspp = DSPP_3,
166	}, {	166	}, {
167	.name = "lm_4", .id = LM_4,	167	.name = "lm_4", .id = LM_4,
168	.base = 0x48000, .len = 0x320,	168	.base = 0x48000, .len = 0x400,
169	.features = MIXER_MSM8998_MASK,	169	.features = MIXER_MSM8998_MASK,
170	.sblk = &sdm845_lm_sblk,	170	.sblk = &sdm845_lm_sblk,
171	.lm_pair = LM_5,	171	.lm_pair = LM_5,
172	.pingpong = PINGPONG_4,	172	.pingpong = PINGPONG_4,
173	}, {	173	}, {
174	.name = "lm_5", .id = LM_5,	174	.name = "lm_5", .id = LM_5,
175	.base = 0x49000, .len = 0x320,	175	.base = 0x49000, .len = 0x400,
176	.features = MIXER_MSM8998_MASK,	176	.features = MIXER_MSM8998_MASK,
177	.sblk = &sdm845_lm_sblk,	177	.sblk = &sdm845_lm_sblk,
178	.lm_pair = LM_4,	178	.lm_pair = LM_4,

drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h+6−6

@@ -134,7 +134,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = { · 133 unmodified lines
134	static const struct dpu_lm_cfg sm8450_lm[] = {	134	static const struct dpu_lm_cfg sm8450_lm[] = {
135	{	135	{
136	.name = "lm_0", .id = LM_0,	136	.name = "lm_0", .id = LM_0,
137	.base = 0x44000, .len = 0x320,	137	.base = 0x44000, .len = 0x400,
138	.features = MIXER_MSM8998_MASK,	138	.features = MIXER_MSM8998_MASK,
139	.sblk = &sdm845_lm_sblk,	139	.sblk = &sdm845_lm_sblk,
140	.lm_pair = LM_1,	140	.lm_pair = LM_1,
@@ -142,7 +142,7 @@ static const struct dpu_lm_cfg sm8450_lm[] = { · 1 unmodified line
142	.dspp = DSPP_0,	142	.dspp = DSPP_0,
143	}, {	143	}, {
144	.name = "lm_1", .id = LM_1,	144	.name = "lm_1", .id = LM_1,
145	.base = 0x45000, .len = 0x320,	145	.base = 0x45000, .len = 0x400,
146	.features = MIXER_MSM8998_MASK,	146	.features = MIXER_MSM8998_MASK,
147	.sblk = &sdm845_lm_sblk,	147	.sblk = &sdm845_lm_sblk,
148	.lm_pair = LM_0,	148	.lm_pair = LM_0,
@@ -150,7 +150,7 @@ static const struct dpu_lm_cfg sm8450_lm[] = { · 1 unmodified line
150	.dspp = DSPP_1,	150	.dspp = DSPP_1,
151	}, {	151	}, {
152	.name = "lm_2", .id = LM_2,	152	.name = "lm_2", .id = LM_2,
153	.base = 0x46000, .len = 0x320,	153	.base = 0x46000, .len = 0x400,
154	.features = MIXER_MSM8998_MASK,	154	.features = MIXER_MSM8998_MASK,
155	.sblk = &sdm845_lm_sblk,	155	.sblk = &sdm845_lm_sblk,
156	.lm_pair = LM_3,	156	.lm_pair = LM_3,
@@ -158,7 +158,7 @@ static const struct dpu_lm_cfg sm8450_lm[] = { · 1 unmodified line
158	.dspp = DSPP_2,	158	.dspp = DSPP_2,
159	}, {	159	}, {
160	.name = "lm_3", .id = LM_3,	160	.name = "lm_3", .id = LM_3,
161	.base = 0x47000, .len = 0x320,	161	.base = 0x47000, .len = 0x400,
162	.features = MIXER_MSM8998_MASK,	162	.features = MIXER_MSM8998_MASK,
163	.sblk = &sdm845_lm_sblk,	163	.sblk = &sdm845_lm_sblk,
164	.lm_pair = LM_2,	164	.lm_pair = LM_2,
@@ -166,14 +166,14 @@ static const struct dpu_lm_cfg sm8450_lm[] = { · 1 unmodified line
166	.dspp = DSPP_3,	166	.dspp = DSPP_3,
167	}, {	167	}, {
168	.name = "lm_4", .id = LM_4,	168	.name = "lm_4", .id = LM_4,
169	.base = 0x48000, .len = 0x320,	169	.base = 0x48000, .len = 0x400,
170	.features = MIXER_MSM8998_MASK,	170	.features = MIXER_MSM8998_MASK,
171	.sblk = &sdm845_lm_sblk,	171	.sblk = &sdm845_lm_sblk,
172	.lm_pair = LM_5,	172	.lm_pair = LM_5,
173	.pingpong = PINGPONG_4,	173	.pingpong = PINGPONG_4,
174	}, {	174	}, {
175	.name = "lm_5", .id = LM_5,	175	.name = "lm_5", .id = LM_5,
176	.base = 0x49000, .len = 0x320,	176	.base = 0x49000, .len = 0x400,
177	.features = MIXER_MSM8998_MASK,	177	.features = MIXER_MSM8998_MASK,
178	.sblk = &sdm845_lm_sblk,	178	.sblk = &sdm845_lm_sblk,
179	.lm_pair = LM_4,	179	.lm_pair = LM_4,

drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_4_sa8775p.h+2−2

@@ -366,8 +366,8 @@ static const struct dpu_intf_cfg sa8775p_intf[] = { · 365 unmodified lines
366	.type = INTF_NONE,	366	.type = INTF_NONE,
367	.controller_id = MSM_DP_CONTROLLER_0, /* pair with intf_0 for DP MST */	367	.controller_id = MSM_DP_CONTROLLER_0, /* pair with intf_0 for DP MST */
368	.prog_fetch_lines_worst_case = 24,	368	.prog_fetch_lines_worst_case = 24,
369	.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 17),	369	.intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 16),
370	.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 16),	370	.intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 17),
371	}, {	371	}, {
372	.name = "intf_7", .id = INTF_7,	372	.name = "intf_7", .id = INTF_7,
373	.base = 0x3b000, .len = 0x280,	373	.base = 0x3b000, .len = 0x280,

drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_9_0_sm8550.h+6−6

@@ -131,7 +131,7 @@ static const struct dpu_sspp_cfg sm8550_sspp[] = { · 130 unmodified lines
131	static const struct dpu_lm_cfg sm8550_lm[] = {	131	static const struct dpu_lm_cfg sm8550_lm[] = {
132	{	132	{
133	.name = "lm_0", .id = LM_0,	133	.name = "lm_0", .id = LM_0,
134	.base = 0x44000, .len = 0x320,	134	.base = 0x44000, .len = 0x400,
135	.features = MIXER_MSM8998_MASK,	135	.features = MIXER_MSM8998_MASK,
136	.sblk = &sdm845_lm_sblk,	136	.sblk = &sdm845_lm_sblk,
137	.lm_pair = LM_1,	137	.lm_pair = LM_1,
@@ -139,7 +139,7 @@ static const struct dpu_lm_cfg sm8550_lm[] = { · 1 unmodified line
139	.dspp = DSPP_0,	139	.dspp = DSPP_0,
140	}, {	140	}, {
141	.name = "lm_1", .id = LM_1,	141	.name = "lm_1", .id = LM_1,
142	.base = 0x45000, .len = 0x320,	142	.base = 0x45000, .len = 0x400,
143	.features = MIXER_MSM8998_MASK,	143	.features = MIXER_MSM8998_MASK,
144	.sblk = &sdm845_lm_sblk,	144	.sblk = &sdm845_lm_sblk,
145	.lm_pair = LM_0,	145	.lm_pair = LM_0,
@@ -147,7 +147,7 @@ static const struct dpu_lm_cfg sm8550_lm[] = { · 1 unmodified line
147	.dspp = DSPP_1,	147	.dspp = DSPP_1,
148	}, {	148	}, {
149	.name = "lm_2", .id = LM_2,	149	.name = "lm_2", .id = LM_2,
150	.base = 0x46000, .len = 0x320,	150	.base = 0x46000, .len = 0x400,
151	.features = MIXER_MSM8998_MASK,	151	.features = MIXER_MSM8998_MASK,
152	.sblk = &sdm845_lm_sblk,	152	.sblk = &sdm845_lm_sblk,
153	.lm_pair = LM_3,	153	.lm_pair = LM_3,
@@ -155,7 +155,7 @@ static const struct dpu_lm_cfg sm8550_lm[] = { · 1 unmodified line
155	.dspp = DSPP_2,	155	.dspp = DSPP_2,
156	}, {	156	}, {
157	.name = "lm_3", .id = LM_3,	157	.name = "lm_3", .id = LM_3,
158	.base = 0x47000, .len = 0x320,	158	.base = 0x47000, .len = 0x400,
159	.features = MIXER_MSM8998_MASK,	159	.features = MIXER_MSM8998_MASK,
160	.sblk = &sdm845_lm_sblk,	160	.sblk = &sdm845_lm_sblk,
161	.lm_pair = LM_2,	161	.lm_pair = LM_2,
@@ -163,14 +163,14 @@ static const struct dpu_lm_cfg sm8550_lm[] = { · 1 unmodified line
163	.dspp = DSPP_3,	163	.dspp = DSPP_3,
164	}, {	164	}, {
165	.name = "lm_4", .id = LM_4,	165	.name = "lm_4", .id = LM_4,
166	.base = 0x48000, .len = 0x320,	166	.base = 0x48000, .len = 0x400,
167	.features = MIXER_MSM8998_MASK,	167	.features = MIXER_MSM8998_MASK,
168	.sblk = &sdm845_lm_sblk,	168	.sblk = &sdm845_lm_sblk,
169	.lm_pair = LM_5,	169	.lm_pair = LM_5,
170	.pingpong = PINGPONG_4,	170	.pingpong = PINGPONG_4,
171	}, {	171	}, {
172	.name = "lm_5", .id = LM_5,	172	.name = "lm_5", .id = LM_5,
173	.base = 0x49000, .len = 0x320,	173	.base = 0x49000, .len = 0x400,
174	.features = MIXER_MSM8998_MASK,	174	.features = MIXER_MSM8998_MASK,
175	.sblk = &sdm845_lm_sblk,	175	.sblk = &sdm845_lm_sblk,
176	.lm_pair = LM_4,	176	.lm_pair = LM_4,

drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_9_1_sar2130p.h+6−6

@@ -131,7 +131,7 @@ static const struct dpu_sspp_cfg sar2130p_sspp[] = { · 130 unmodified lines
131	static const struct dpu_lm_cfg sar2130p_lm[] = {	131	static const struct dpu_lm_cfg sar2130p_lm[] = {
132	{	132	{
133	.name = "lm_0", .id = LM_0,	133	.name = "lm_0", .id = LM_0,
134	.base = 0x44000, .len = 0x320,	134	.base = 0x44000, .len = 0x400,
135	.features = MIXER_MSM8998_MASK,	135	.features = MIXER_MSM8998_MASK,
136	.sblk = &sdm845_lm_sblk,	136	.sblk = &sdm845_lm_sblk,
137	.lm_pair = LM_1,	137	.lm_pair = LM_1,
@@ -139,7 +139,7 @@ static const struct dpu_lm_cfg sar2130p_lm[] = { · 1 unmodified line
139	.dspp = DSPP_0,	139	.dspp = DSPP_0,
140	}, {	140	}, {
141	.name = "lm_1", .id = LM_1,	141	.name = "lm_1", .id = LM_1,
142	.base = 0x45000, .len = 0x320,	142	.base = 0x45000, .len = 0x400,
143	.features = MIXER_MSM8998_MASK,	143	.features = MIXER_MSM8998_MASK,
144	.sblk = &sdm845_lm_sblk,	144	.sblk = &sdm845_lm_sblk,
145	.lm_pair = LM_0,	145	.lm_pair = LM_0,
@@ -147,7 +147,7 @@ static const struct dpu_lm_cfg sar2130p_lm[] = { · 1 unmodified line
147	.dspp = DSPP_1,	147	.dspp = DSPP_1,
148	}, {	148	}, {
149	.name = "lm_2", .id = LM_2,	149	.name = "lm_2", .id = LM_2,
150	.base = 0x46000, .len = 0x320,	150	.base = 0x46000, .len = 0x400,
151	.features = MIXER_MSM8998_MASK,	151	.features = MIXER_MSM8998_MASK,
152	.sblk = &sdm845_lm_sblk,	152	.sblk = &sdm845_lm_sblk,
153	.lm_pair = LM_3,	153	.lm_pair = LM_3,
@@ -155,7 +155,7 @@ static const struct dpu_lm_cfg sar2130p_lm[] = { · 1 unmodified line
155	.dspp = DSPP_2,	155	.dspp = DSPP_2,
156	}, {	156	}, {
157	.name = "lm_3", .id = LM_3,	157	.name = "lm_3", .id = LM_3,
158	.base = 0x47000, .len = 0x320,	158	.base = 0x47000, .len = 0x400,
159	.features = MIXER_MSM8998_MASK,	159	.features = MIXER_MSM8998_MASK,
160	.sblk = &sdm845_lm_sblk,	160	.sblk = &sdm845_lm_sblk,
161	.lm_pair = LM_2,	161	.lm_pair = LM_2,
@@ -163,14 +163,14 @@ static const struct dpu_lm_cfg sar2130p_lm[] = { · 1 unmodified line
163	.dspp = DSPP_3,	163	.dspp = DSPP_3,
164	}, {	164	}, {
165	.name = "lm_4", .id = LM_4,	165	.name = "lm_4", .id = LM_4,
166	.base = 0x48000, .len = 0x320,	166	.base = 0x48000, .len = 0x400,
167	.features = MIXER_MSM8998_MASK,	167	.features = MIXER_MSM8998_MASK,
168	.sblk = &sdm845_lm_sblk,	168	.sblk = &sdm845_lm_sblk,
169	.lm_pair = LM_5,	169	.lm_pair = LM_5,
170	.pingpong = PINGPONG_4,	170	.pingpong = PINGPONG_4,
171	}, {	171	}, {
172	.name = "lm_5", .id = LM_5,	172	.name = "lm_5", .id = LM_5,
173	.base = 0x49000, .len = 0x320,	173	.base = 0x49000, .len = 0x400,
174	.features = MIXER_MSM8998_MASK,	174	.features = MIXER_MSM8998_MASK,
175	.sblk = &sdm845_lm_sblk,	175	.sblk = &sdm845_lm_sblk,
176	.lm_pair = LM_4,	176	.lm_pair = LM_4,

drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_9_2_x1e80100.h+6−6

@@ -130,7 +130,7 @@ static const struct dpu_sspp_cfg x1e80100_sspp[] = { · 129 unmodified lines
130	static const struct dpu_lm_cfg x1e80100_lm[] = {	130	static const struct dpu_lm_cfg x1e80100_lm[] = {
131	{	131	{
132	.name = "lm_0", .id = LM_0,	132	.name = "lm_0", .id = LM_0,
133	.base = 0x44000, .len = 0x320,	133	.base = 0x44000, .len = 0x400,
134	.features = MIXER_MSM8998_MASK,	134	.features = MIXER_MSM8998_MASK,
135	.sblk = &sdm845_lm_sblk,	135	.sblk = &sdm845_lm_sblk,
136	.lm_pair = LM_1,	136	.lm_pair = LM_1,
@@ -138,7 +138,7 @@ static const struct dpu_lm_cfg x1e80100_lm[] = { · 1 unmodified line
138	.dspp = DSPP_0,	138	.dspp = DSPP_0,
139	}, {	139	}, {
140	.name = "lm_1", .id = LM_1,	140	.name = "lm_1", .id = LM_1,
141	.base = 0x45000, .len = 0x320,	141	.base = 0x45000, .len = 0x400,
142	.features = MIXER_MSM8998_MASK,	142	.features = MIXER_MSM8998_MASK,
143	.sblk = &sdm845_lm_sblk,	143	.sblk = &sdm845_lm_sblk,
144	.lm_pair = LM_0,	144	.lm_pair = LM_0,
@@ -146,7 +146,7 @@ static const struct dpu_lm_cfg x1e80100_lm[] = { · 1 unmodified line
146	.dspp = DSPP_1,	146	.dspp = DSPP_1,
147	}, {	147	}, {
148	.name = "lm_2", .id = LM_2,	148	.name = "lm_2", .id = LM_2,
149	.base = 0x46000, .len = 0x320,	149	.base = 0x46000, .len = 0x400,
150	.features = MIXER_MSM8998_MASK,	150	.features = MIXER_MSM8998_MASK,
151	.sblk = &sdm845_lm_sblk,	151	.sblk = &sdm845_lm_sblk,
152	.lm_pair = LM_3,	152	.lm_pair = LM_3,
@@ -154,7 +154,7 @@ static const struct dpu_lm_cfg x1e80100_lm[] = { · 1 unmodified line
154	.dspp = DSPP_2,	154	.dspp = DSPP_2,
155	}, {	155	}, {
156	.name = "lm_3", .id = LM_3,	156	.name = "lm_3", .id = LM_3,
157	.base = 0x47000, .len = 0x320,	157	.base = 0x47000, .len = 0x400,
158	.features = MIXER_MSM8998_MASK,	158	.features = MIXER_MSM8998_MASK,
159	.sblk = &sdm845_lm_sblk,	159	.sblk = &sdm845_lm_sblk,
160	.lm_pair = LM_2,	160	.lm_pair = LM_2,
@@ -162,14 +162,14 @@ static const struct dpu_lm_cfg x1e80100_lm[] = { · 1 unmodified line
162	.dspp = DSPP_3,	162	.dspp = DSPP_3,
163	}, {	163	}, {
164	.name = "lm_4", .id = LM_4,	164	.name = "lm_4", .id = LM_4,
165	.base = 0x48000, .len = 0x320,	165	.base = 0x48000, .len = 0x400,
166	.features = MIXER_MSM8998_MASK,	166	.features = MIXER_MSM8998_MASK,
167	.sblk = &sdm845_lm_sblk,	167	.sblk = &sdm845_lm_sblk,
168	.lm_pair = LM_5,	168	.lm_pair = LM_5,
169	.pingpong = PINGPONG_4,	169	.pingpong = PINGPONG_4,
170	}, {	170	}, {
171	.name = "lm_5", .id = LM_5,	171	.name = "lm_5", .id = LM_5,
172	.base = 0x49000, .len = 0x320,	172	.base = 0x49000, .len = 0x400,
173	.features = MIXER_MSM8998_MASK,	173	.features = MIXER_MSM8998_MASK,
174	.sblk = &sdm845_lm_sblk,	174	.sblk = &sdm845_lm_sblk,
175	.lm_pair = LM_4,	175	.lm_pair = LM_4,

drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dspp.c+1−1

@@ -89,7 +89,7 @@ static void dpu_setup_dspp_gc(struct dpu_hw_dspp *ctx, · 88 unmodified lines
89	base = ctx->cap->sblk->gc.base;	89	base = ctx->cap->sblk->gc.base;
90		90
91	if (!base) {	91	if (!base) {
92	DRM_ERROR("invalid ctx %pK gc base\n", ctx);	92	DRM_ERROR("invalid ctx %p gc base\n", ctx);
93	return;	93	return;
94	}	94	}
95		95

drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp_v13.c+3−1

 	u8 color;
 	u32 lr_pe[4], tb_pe[4];
 	const u32 bytemask = 0xff;
-	u32 offset = ctx->cap->sblk->sspp_rec0_blk.base;
+	u32 offset;
 	if (!ctx || !pe_ext)
 		return;
+	offset = ctx->cap->sblk->sspp_rec0_blk.base;
 	c = &ctx->hw;
 	/* program SW pixel extension override for all pipes*/
 	for (color = 0; color < DPU_MAX_PLANES; color++) {

drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c+14−38

 	return true;
 }
-static bool dpu_rm_find_lms(struct dpu_rm *rm,
+static int _dpu_rm_reserve_lms(struct dpu_rm *rm,
-			    struct dpu_global_state *global_state,
+			       struct dpu_global_state *global_state,
-			    uint32_t crtc_id, bool skip_dspp,
+			       uint32_t crtc_id,
-			    struct msm_display_topology *topology,
+			       struct msm_display_topology *topology)
-			    int *lm_idx, int *pp_idx, int *dspp_idx)
 {
+	int lm_idx[MAX_BLOCKS];
+	int pp_idx[MAX_BLOCKS];
+	int dspp_idx[MAX_BLOCKS] = {0};
 	int i, lm_count = 0;
+	if (!topology->num_lm) {
+		DPU_ERROR("zero LMs in topology\n");
+		return -EINVAL;
+	}
 	/* Find a primary mixer */
 	for (i = 0; i < ARRAY_SIZE(rm->mixer_blks) &&
 			lm_count < topology->num_lm; i++) {
 		if (!rm->mixer_blks[i])
 			continue;
-		if (skip_dspp && to_dpu_hw_mixer(rm->mixer_blks[i])->cap->dspp) {
-			DPU_DEBUG("Skipping LM_%d, skipping LMs with DSPPs\n", i);
-			continue;
-		}
 		/*
 		 * Reset lm_count to an even index. This will drop the previous
 		 * primary mixer if failed to find its peer.
 		}
 	}
-	return lm_count == topology->num_lm;
+	if (lm_count != topology->num_lm) {
-}
-static int _dpu_rm_reserve_lms(struct dpu_rm *rm,
-			       struct dpu_global_state *global_state,
-			       uint32_t crtc_id,
-			       struct msm_display_topology *topology)
-{
-	int lm_idx[MAX_BLOCKS];
-	int pp_idx[MAX_BLOCKS];
-	int dspp_idx[MAX_BLOCKS] = {0};
-	int i;
-	bool found;
-	if (!topology->num_lm) {
-		DPU_ERROR("zero LMs in topology\n");
-		return -EINVAL;
-	}
-	/* Try using non-DSPP LM blocks first */
-	found = dpu_rm_find_lms(rm, global_state, crtc_id, !topology->num_dspp,
-				topology, lm_idx, pp_idx, dspp_idx);
-	if (!found && !topology->num_dspp)
-		found = dpu_rm_find_lms(rm, global_state, crtc_id, false,
-					topology, lm_idx, pp_idx, dspp_idx);
-	if (!found) {
 		DPU_DEBUG("unable to find appropriate mixers\n");
 		return -ENAVAIL;
 	}
-	for (i = 0; i < topology->num_lm; i++) {
+	for (i = 0; i < lm_count; i++) {
 		global_state->mixer_to_crtc_id[lm_idx[i]] = crtc_id;
 		global_state->pingpong_to_crtc_id[pp_idx[i]] = crtc_id;
 		global_state->dspp_to_crtc_id[dspp_idx[i]] =

drivers/gpu/drm/msm/dsi/dsi_host.c+31−12

  *  FIXME: Reconsider this if/when CMD mode handling is rewritten to use
  *  transfer time and data overhead as a starting point of the calculations.
  */
-static unsigned long dsi_adjust_pclk_for_compression(const struct drm_display_mode *mode,
+static unsigned long
-		const struct drm_dsc_config *dsc)
+dsi_adjust_pclk_for_compression(const struct drm_display_mode *mode,
+				const struct drm_dsc_config *dsc,
+				bool is_bonded_dsi)
 {
-	int new_hdisplay = DIV_ROUND_UP(mode->hdisplay * drm_dsc_get_bpp_int(dsc),
+	int hdisplay, new_hdisplay, new_htotal;
-			dsc->bits_per_component * 3);
-	int new_htotal = mode->htotal - mode->hdisplay + new_hdisplay;
+	/*
+	 * For bonded DSI, split hdisplay across two links and round up each
+	 * half separately, passing the full hdisplay would only round up once.
+	 * This also aligns with the hdisplay we program later in
+	 * dsi_timing_setup()
+	 */
+	hdisplay = mode->hdisplay;
+	if (is_bonded_dsi)
+		hdisplay /= 2;
+	new_hdisplay = DIV_ROUND_UP(hdisplay * drm_dsc_get_bpp_int(dsc),
+				    dsc->bits_per_component * 3);
+	if (is_bonded_dsi)
+		new_hdisplay *= 2;
+	new_htotal = mode->htotal - mode->hdisplay + new_hdisplay;
 	return mult_frac(mode->clock * 1000u, new_htotal, mode->htotal);
 }
 	pclk_rate = mode->clock * 1000u;
 	if (dsc)
-		pclk_rate = dsi_adjust_pclk_for_compression(mode, dsc);
+		pclk_rate = dsi_adjust_pclk_for_compression(mode, dsc, is_bonded_dsi);
 	/*
 	 * For bonded DSI mode, the current DRM mode has the complete width of the
 	if (msm_host->dsc) {
 		struct drm_dsc_config *dsc = msm_host->dsc;
-		u32 bytes_per_pclk;
+		u32 bits_per_pclk;
 		/* update dsc params with timing params */
 		if (!dsc || !mode->hdisplay || !mode->vdisplay) {
 		/*
 		 * DPU sends 3 bytes per pclk cycle to DSI. If widebus is
-		 * enabled, bus width is extended to 6 bytes.
+		 * enabled, MDP always sends out 48-bit compressed data per
+		 * pclk and on average, DSI consumes an amount of compressed
+		 * data equivalent to the uncompressed pixel depth per pclk.
 		 *
 		 * Calculate the number of pclks needed to transmit one line of
 		 * the compressed data.
 		 * unused anyway.
 		 */
 		h_total -= hdisplay;
-		if (wide_bus_enabled && !(msm_host->mode_flags & MIPI_DSI_MODE_VIDEO))
+		if (wide_bus_enabled)
-			bytes_per_pclk = 6;
+			bits_per_pclk = mipi_dsi_pixel_format_to_bpp(msm_host->format);
 		else
-			bytes_per_pclk = 3;
+			bits_per_pclk = 24;
-		hdisplay = DIV_ROUND_UP(msm_dsc_get_bytes_per_line(msm_host->dsc), bytes_per_pclk);
+		hdisplay = DIV_ROUND_UP(msm_dsc_get_bytes_per_line(msm_host->dsc) * 8, bits_per_pclk);
 		h_total += hdisplay;
 		ha_end = ha_start + hdisplay;

drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c+11−11

@@ -51,8 +51,8 @@ · 50 unmodified lines
51	#define DSI_PHY_7NM_QUIRK_V4_3 BIT(3)	51	#define DSI_PHY_7NM_QUIRK_V4_3 BIT(3)
52	/* Hardware is V5.2 */	52	/* Hardware is V5.2 */
53	#define DSI_PHY_7NM_QUIRK_V5_2 BIT(4)	53	#define DSI_PHY_7NM_QUIRK_V5_2 BIT(4)
54	/* Hardware is V7.0 */	54	/* Hardware is V7.2 */
55	#define DSI_PHY_7NM_QUIRK_V7_0 BIT(5)	55	#define DSI_PHY_7NM_QUIRK_V7_2 BIT(5)
56		56
57	struct dsi_pll_config {	57	struct dsi_pll_config {
58	bool enable_ssc;	58	bool enable_ssc;
@@ -143,7 +143,7 @@ static void dsi_pll_calc_dec_frac(struct dsi_pll_7nm *pll, struct dsi_pll_config · 84 unmodified lines
143		143
144	if (pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_PRE_V4_1) {	144	if (pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_PRE_V4_1) {
145	config->pll_clock_inverters = 0x28;	145	config->pll_clock_inverters = 0x28;
146	} else if ((pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V7_0)) {	146	} else if ((pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V7_2)) {
147	if (pll_freq < 163000000ULL)	147	if (pll_freq < 163000000ULL)
148	config->pll_clock_inverters = 0xa0;	148	config->pll_clock_inverters = 0xa0;
149	else if (pll_freq < 175000000ULL)	149	else if (pll_freq < 175000000ULL)
@@ -284,7 +284,7 @@ static void dsi_pll_config_hzindep_reg(struct dsi_pll_7nm *pll) · 134 unmodified lines
284	}	284	}
285		285
286	if ((pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V5_2) \|\|	286	if ((pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V5_2) \|\|
287	(pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V7_0)) {	287	(pll->phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V7_2)) {
288	if (pll->vco_current_rate < 1557000000ULL)	288	if (pll->vco_current_rate < 1557000000ULL)
289	vco_config_1 = 0x08;	289	vco_config_1 = 0x08;
290	else	290	else
@@ -699,7 +699,7 @@ static int dsi_7nm_set_usecase(struct msm_dsi_phy *phy) · 408 unmodified lines
699	case MSM_DSI_PHY_MASTER:	699	case MSM_DSI_PHY_MASTER:
700	pll_7nm->slave = pll_7nm_list[(pll_7nm->phy->id + 1) % DSI_MAX];	700	pll_7nm->slave = pll_7nm_list[(pll_7nm->phy->id + 1) % DSI_MAX];
701	/* v7.0: Enable ATB_EN0 and alternate clock output to external phy */	701	/* v7.0: Enable ATB_EN0 and alternate clock output to external phy */
702	if (phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V7_0)	702	if (phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V7_2)
703	writel(0x07, base + REG_DSI_7nm_PHY_CMN_CTRL_5);	703	writel(0x07, base + REG_DSI_7nm_PHY_CMN_CTRL_5);
704	break;	704	break;
705	case MSM_DSI_PHY_SLAVE:	705	case MSM_DSI_PHY_SLAVE:
@@ -987,7 +987,7 @@ static int dsi_7nm_phy_enable(struct msm_dsi_phy *phy, · 281 unmodified lines
987	/* Request for REFGEN READY */	987	/* Request for REFGEN READY */
988	if ((phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V4_3) \|\|	988	if ((phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V4_3) \|\|
989	(phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V5_2) \|\|	989	(phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V5_2) \|\|
990	(phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V7_0)) {	990	(phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V7_2)) {
991	writel(0x1, phy->base + REG_DSI_7nm_PHY_CMN_GLBL_DIGTOP_SPARE10);	991	writel(0x1, phy->base + REG_DSI_7nm_PHY_CMN_GLBL_DIGTOP_SPARE10);
992	udelay(500);	992	udelay(500);
993	}	993	}
@@ -1021,7 +1021,7 @@ static int dsi_7nm_phy_enable(struct msm_dsi_phy *phy, · 27 unmodified lines
1021	lane_ctrl0 = 0x1f;	1021	lane_ctrl0 = 0x1f;
1022	}	1022	}
1023		1023
1024	if ((phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V7_0)) {	1024	if ((phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V7_2)) {
1025	if (phy->cphy_mode) {	1025	if (phy->cphy_mode) {
1026	/* TODO: different for second phy */	1026	/* TODO: different for second phy */
1027	vreg_ctrl_0 = 0x57;	1027	vreg_ctrl_0 = 0x57;
@@ -1097,7 +1097,7 @@ static int dsi_7nm_phy_enable(struct msm_dsi_phy *phy, · 69 unmodified lines
1097		1097
1098	/* program CMN_CTRL_4 for minor_ver 2 chipsets*/	1098	/* program CMN_CTRL_4 for minor_ver 2 chipsets*/
1099	if ((phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V5_2) \|\|	1099	if ((phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V5_2) \|\|
1100	(phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V7_0) \|\|	1100	(phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V7_2) \|\|
1101	(readl(base + REG_DSI_7nm_PHY_CMN_REVISION_ID0) & (0xf0)) == 0x20)	1101	(readl(base + REG_DSI_7nm_PHY_CMN_REVISION_ID0) & (0xf0)) == 0x20)
1102	writel(0x04, base + REG_DSI_7nm_PHY_CMN_CTRL_4);	1102	writel(0x04, base + REG_DSI_7nm_PHY_CMN_CTRL_4);
1103		1103
@@ -1213,7 +1213,7 @@ static void dsi_7nm_phy_disable(struct msm_dsi_phy *phy) · 109 unmodified lines
1213	/* Turn off REFGEN Vote */	1213	/* Turn off REFGEN Vote */
1214	if ((phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V4_3) \|\|	1214	if ((phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V4_3) \|\|
1215	(phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V5_2) \|\|	1215	(phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V5_2) \|\|
1216	(phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V7_0)) {	1216	(phy->cfg->quirks & DSI_PHY_7NM_QUIRK_V7_2)) {
1217	writel(0x0, base + REG_DSI_7nm_PHY_CMN_GLBL_DIGTOP_SPARE10);	1217	writel(0x0, base + REG_DSI_7nm_PHY_CMN_GLBL_DIGTOP_SPARE10);
1218	wmb();	1218	wmb();
1219	/* Delay to ensure HW removes vote before PHY shut down */	1219	/* Delay to ensure HW removes vote before PHY shut down */
@@ -1502,7 +1502,7 @@ const struct msm_dsi_phy_cfg dsi_phy_3nm_8750_cfgs = { · 282 unmodified lines
1502	#endif	1502	#endif
1503	.io_start = { 0xae95000, 0xae97000 },	1503	.io_start = { 0xae95000, 0xae97000 },
1504	.num_dsi_phy = 2,	1504	.num_dsi_phy = 2,
1505	.quirks = DSI_PHY_7NM_QUIRK_V7_0,	1505	.quirks = DSI_PHY_7NM_QUIRK_V7_2,
1506	};	1506	};
1507		1507
1508	const struct msm_dsi_phy_cfg dsi_phy_3nm_kaanapali_cfgs = {	1508	const struct msm_dsi_phy_cfg dsi_phy_3nm_kaanapali_cfgs = {
@@ -1525,5 +1525,5 @@ const struct msm_dsi_phy_cfg dsi_phy_3nm_kaanapali_cfgs = { · 16 unmodified lines
1525	#endif	1525	#endif
1526	.io_start = { 0x9ac1000, 0x9ac4000 },	1526	.io_start = { 0x9ac1000, 0x9ac4000 },
1527	.num_dsi_phy = 2,	1527	.num_dsi_phy = 2,
1528	.quirks = DSI_PHY_7NM_QUIRK_V7_0,	1528	.quirks = DSI_PHY_7NM_QUIRK_V7_2,
1529	};	1529	};

drivers/gpu/drm/sitronix/st7586.c+6−9

 	if (ret)
 		return ret;
+	/*
+	 * Override value set by mipi_dbi_spi_init(). This driver is a bit
+	 * non-standard, so best to set it explicitly here.
+	 */
+	dbi->write_memory_bpw = 8;
 	/* Cannot read from this controller via SPI */
 	dbi->read_commands = NULL;
 	if (ret)
 		return ret;
-	/*
-	 * we are using 8-bit data, so we are not actually swapping anything,
-	 * but setting mipi->swap_bytes makes mipi_dbi_typec3_command() do the
-	 * right thing and not use 16-bit transfers (which results in swapped
-	 * bytes on little-endian systems and causes out of order data to be
-	 * sent to the display).
-	 */
-	dbi->swap_bytes = true;
 	drm_mode_config_reset(drm);
 	ret = drm_dev_register(drm, 0);

drivers/gpu/nova-core/gsp.rs+24−22

@@ -47,16 +47,12 @@ struct PteArray<const NUM_ENTRIES: usize>([u64; NUM_ENTRIES]); · 46 unmodified lines
47	unsafe impl<const NUM_ENTRIES: usize> AsBytes for PteArray<NUM_ENTRIES> {}	47	unsafe impl<const NUM_ENTRIES: usize> AsBytes for PteArray<NUM_ENTRIES> {}
48		48
49	impl<const NUM_PAGES: usize> PteArray<NUM_PAGES> {	49	impl<const NUM_PAGES: usize> PteArray<NUM_PAGES> {
50	/// Creates a new page table array mapping `NUM_PAGES` GSP pages starting at address `start`.	50	/// Returns the page table entry for `index`, for a mapping starting at `start`.
51	fn new(start: DmaAddress) -> Result<Self> {	51	// TODO: Replace with `IoView` projection once available.
52	let mut ptes = [0u64; NUM_PAGES];	52	fn entry(start: DmaAddress, index: usize) -> Result<u64> {
53	for (i, pte) in ptes.iter_mut().enumerate() {	53	start
54	*pte = start	54	.checked_add(num::usize_as_u64(index) << GSP_PAGE_SHIFT)
55	.checked_add(num::usize_as_u64(i) << GSP_PAGE_SHIFT)	55	.ok_or(EOVERFLOW)
56	.ok_or(EOVERFLOW)?;
57	}
58
59	Ok(Self(ptes))
60	}	56	}
61	}	57	}
62		58
@@ -86,16 +82,22 @@ impl LogBuffer { · 23 unmodified lines
86	NUM_PAGES * GSP_PAGE_SIZE,	82	NUM_PAGES * GSP_PAGE_SIZE,
87	GFP_KERNEL \| __GFP_ZERO,	83	GFP_KERNEL \| __GFP_ZERO,
88	)?);	84	)?);
89	let ptes = PteArray::<NUM_PAGES>::new(obj.0.dma_handle())?;	85
		86	let start_addr = obj.0.dma_handle();
90		87
91	// SAFETY: `obj` has just been created and we are its sole user.	88	// SAFETY: `obj` has just been created and we are its sole user.
92	unsafe {	89	let pte_region = unsafe {
93	// Copy the self-mapping PTE at the expected location.
94	obj.0	90	obj.0
95	.as_slice_mut(size_of::<u64>(), size_of_val(&ptes))?	91	.as_slice_mut(size_of::<u64>(), NUM_PAGES * size_of::<u64>())?
96	.copy_from_slice(ptes.as_bytes())
97	};	92	};
98		93
		94	// Write values one by one to avoid an on-stack instance of `PteArray`.
		95	for (i, chunk) in pte_region.chunks_exact_mut(size_of::<u64>()).enumerate() {
		96	let pte_value = PteArray::<0>::entry(start_addr, i)?;
		97
		98	chunk.copy_from_slice(&pte_value.to_ne_bytes());
		99	}
		100
99	Ok(obj)	101	Ok(obj)
100	}	102	}
101	}	103	}
@@ -143,14 +145,14 @@ impl Gsp { · 41 unmodified lines
143	// _kgspInitLibosLoggingStructures (allocates memory for buffers)	145	// _kgspInitLibosLoggingStructures (allocates memory for buffers)
144	// kgspSetupLibosInitArgs_IMPL (creates pLibosInitArgs[] array)	146	// kgspSetupLibosInitArgs_IMPL (creates pLibosInitArgs[] array)
145	dma_write!(	147	dma_write!(
146	libos[0] = LibosMemoryRegionInitArgument::new("LOGINIT", &loginit.0)	148	libos, [0]?, LibosMemoryRegionInitArgument::new("LOGINIT", &loginit.0)
147	)?;	149	);
148	dma_write!(	150	dma_write!(
149	libos[1] = LibosMemoryRegionInitArgument::new("LOGINTR", &logintr.0)	151	libos, [1]?, LibosMemoryRegionInitArgument::new("LOGINTR", &logintr.0)
150	)?;	152	);
151	dma_write!(libos[2] = LibosMemoryRegionInitArgument::new("LOGRM", &logrm.0))?;	153	dma_write!(libos, [2]?, LibosMemoryRegionInitArgument::new("LOGRM", &logrm.0));
152	dma_write!(rmargs[0].inner = fw::GspArgumentsCached::new(cmdq))?;	154	dma_write!(rmargs, [0]?.inner, fw::GspArgumentsCached::new(cmdq));
153	dma_write!(libos[3] = LibosMemoryRegionInitArgument::new("RMARGS", rmargs))?;	155	dma_write!(libos, [3]?, LibosMemoryRegionInitArgument::new("RMARGS", rmargs));
154	},	156	},
155	}))	157	}))
156	})	158	})

drivers/gpu/nova-core/gsp/boot.rs+1−1

@@ -157,7 +157,7 @@ impl super::Gsp { · 156 unmodified lines
157		157
158	let wpr_meta =	158	let wpr_meta =
159	CoherentAllocation::<GspFwWprMeta>::alloc_coherent(dev, 1, GFP_KERNEL \| __GFP_ZERO)?;	159	CoherentAllocation::<GspFwWprMeta>::alloc_coherent(dev, 1, GFP_KERNEL \| __GFP_ZERO)?;
160	dma_write!(wpr_meta[0] = GspFwWprMeta::new(&gsp_fw, &fb_layout))?;	160	dma_write!(wpr_meta, [0]?, GspFwWprMeta::new(&gsp_fw, &fb_layout));
161		161
162	self.cmdq	162	self.cmdq
163	.send_command(bar, commands::SetSystemInfo::new(pdev))?;	163	.send_command(bar, commands::SetSystemInfo::new(pdev))?;

drivers/gpu/nova-core/gsp/cmdq.rs+33−60

@@ -2,11 +2,7 @@ · 1 unmodified line
2		2
3	use core::{	3	use core::{
4	cmp,	4	cmp,
5	mem,	5	mem, //
6	sync::atomic::{
7	fence,
8	Ordering, //
9	}, //
10	};	6	};
11		7
12	use kernel::{	8	use kernel::{
@@ -146,30 +142,36 @@ static_assert!(align_of::<MsgqData>() == GSP_PAGE_SIZE); · 133 unmodified lines
146	#[repr(C)]	142	#[repr(C)]
147	// There is no struct defined for this in the open-gpu-kernel-source headers.	143	// There is no struct defined for this in the open-gpu-kernel-source headers.
148	// Instead it is defined by code in `GspMsgQueuesInit()`.	144	// Instead it is defined by code in `GspMsgQueuesInit()`.
149	struct Msgq {	145	// TODO: Revert to private once `IoView` projections replace the `gsp_mem` module.
		146	pub(super) struct Msgq {
150	/// Header for sending messages, including the write pointer.	147	/// Header for sending messages, including the write pointer.
151	tx: MsgqTxHeader,	148	pub(super) tx: MsgqTxHeader,
152	/// Header for receiving messages, including the read pointer.	149	/// Header for receiving messages, including the read pointer.
153	rx: MsgqRxHeader,	150	pub(super) rx: MsgqRxHeader,
154	/// The message queue proper.	151	/// The message queue proper.
155	msgq: MsgqData,	152	msgq: MsgqData,
156	}	153	}
157		154
158	/// Structure shared between the driver and the GSP and containing the command and message queues.	155	/// Structure shared between the driver and the GSP and containing the command and message queues.
159	#[repr(C)]	156	#[repr(C)]
160	struct GspMem {	157	// TODO: Revert to private once `IoView` projections replace the `gsp_mem` module.
		158	pub(super) struct GspMem {
161	/// Self-mapping page table entries.	159	/// Self-mapping page table entries.
162	ptes: PteArray<{ GSP_PAGE_SIZE / size_of::<u64>() }>,	160	ptes: PteArray<{ Self::PTE_ARRAY_SIZE }>,
163	/// CPU queue: the driver writes commands here, and the GSP reads them. It also contains the	161	/// CPU queue: the driver writes commands here, and the GSP reads them. It also contains the
164	/// write and read pointers that the CPU updates.	162	/// write and read pointers that the CPU updates.
165	///	163	///
166	/// This member is read-only for the GSP.	164	/// This member is read-only for the GSP.
167	cpuq: Msgq,	165	pub(super) cpuq: Msgq,
168	/// GSP queue: the GSP writes messages here, and the driver reads them. It also contains the	166	/// GSP queue: the GSP writes messages here, and the driver reads them. It also contains the
169	/// write and read pointers that the GSP updates.	167	/// write and read pointers that the GSP updates.
170	///	168	///
171	/// This member is read-only for the driver.	169	/// This member is read-only for the driver.
172	gspq: Msgq,	170	pub(super) gspq: Msgq,
		171	}
		172
		173	impl GspMem {
		174	const PTE_ARRAY_SIZE: usize = GSP_PAGE_SIZE / size_of::<u64>();
173	}	175	}
174		176
175	// SAFETY: These structs don't meet the no-padding requirements of AsBytes but	177	// SAFETY: These structs don't meet the no-padding requirements of AsBytes but
@@ -201,9 +203,19 @@ impl DmaGspMem { · 25 unmodified lines
201		203
202	let gsp_mem =	204	let gsp_mem =
203	CoherentAllocation::<GspMem>::alloc_coherent(dev, 1, GFP_KERNEL \| __GFP_ZERO)?;	205	CoherentAllocation::<GspMem>::alloc_coherent(dev, 1, GFP_KERNEL \| __GFP_ZERO)?;
204	dma_write!(gsp_mem[0].ptes = PteArray::new(gsp_mem.dma_handle())?)?;	206
205	dma_write!(gsp_mem[0].cpuq.tx = MsgqTxHeader::new(MSGQ_SIZE, RX_HDR_OFF, MSGQ_NUM_PAGES))?;	207	let start = gsp_mem.dma_handle();
206	dma_write!(gsp_mem[0].cpuq.rx = MsgqRxHeader::new())?;	208	// Write values one by one to avoid an on-stack instance of `PteArray`.
		209	for i in 0..GspMem::PTE_ARRAY_SIZE {
		210	dma_write!(gsp_mem, [0]?.ptes.0[i], PteArray::<0>::entry(start, i)?);
		211	}
		212
		213	dma_write!(
		214	gsp_mem,
		215	[0]?.cpuq.tx,
		216	MsgqTxHeader::new(MSGQ_SIZE, RX_HDR_OFF, MSGQ_NUM_PAGES)
		217	);
		218	dma_write!(gsp_mem, [0]?.cpuq.rx, MsgqRxHeader::new());
207		219
208	Ok(Self(gsp_mem))	220	Ok(Self(gsp_mem))
209	}	221	}
@@ -317,12 +329,7 @@ impl DmaGspMem { · 107 unmodified lines
317	//	329	//
318	// - The returned value is between `0` and `MSGQ_NUM_PAGES`.	330	// - The returned value is between `0` and `MSGQ_NUM_PAGES`.
319	fn gsp_write_ptr(&self) -> u32 {	331	fn gsp_write_ptr(&self) -> u32 {
320	let gsp_mem = self.0.start_ptr();	332	super::fw::gsp_mem::gsp_write_ptr(&self.0)
321
322	// SAFETY:
323	// - The 'CoherentAllocation' contains at least one object.
324	// - By the invariants of `CoherentAllocation` the pointer is valid.
325	(unsafe { (*gsp_mem).gspq.tx.write_ptr() } % MSGQ_NUM_PAGES)
326	}	333	}
327		334
328	// Returns the index of the memory page the GSP will read the next command from.	335	// Returns the index of the memory page the GSP will read the next command from.
@@ -331,12 +338,7 @@ impl DmaGspMem { · 2 unmodified lines
331	//	338	//
332	// - The returned value is between `0` and `MSGQ_NUM_PAGES`.	339	// - The returned value is between `0` and `MSGQ_NUM_PAGES`.
333	fn gsp_read_ptr(&self) -> u32 {	340	fn gsp_read_ptr(&self) -> u32 {
334	let gsp_mem = self.0.start_ptr();	341	super::fw::gsp_mem::gsp_read_ptr(&self.0)
335
336	// SAFETY:
337	// - The 'CoherentAllocation' contains at least one object.
338	// - By the invariants of `CoherentAllocation` the pointer is valid.
339	(unsafe { (*gsp_mem).gspq.rx.read_ptr() } % MSGQ_NUM_PAGES)
340	}	342	}
341		343
342	// Returns the index of the memory page the CPU can read the next message from.	344	// Returns the index of the memory page the CPU can read the next message from.
@@ -345,27 +347,12 @@ impl DmaGspMem { · 2 unmodified lines
345	//	347	//
346	// - The returned value is between `0` and `MSGQ_NUM_PAGES`.	348	// - The returned value is between `0` and `MSGQ_NUM_PAGES`.
347	fn cpu_read_ptr(&self) -> u32 {	349	fn cpu_read_ptr(&self) -> u32 {
348	let gsp_mem = self.0.start_ptr();	350	super::fw::gsp_mem::cpu_read_ptr(&self.0)
349
350	// SAFETY:
351	// - The ['CoherentAllocation'] contains at least one object.
352	// - By the invariants of CoherentAllocation the pointer is valid.
353	(unsafe { (*gsp_mem).cpuq.rx.read_ptr() } % MSGQ_NUM_PAGES)
354	}	351	}
355		352
356	// Informs the GSP that it can send `elem_count` new pages into the message queue.	353	// Informs the GSP that it can send `elem_count` new pages into the message queue.
357	fn advance_cpu_read_ptr(&mut self, elem_count: u32) {	354	fn advance_cpu_read_ptr(&mut self, elem_count: u32) {
358	let rptr = self.cpu_read_ptr().wrapping_add(elem_count) % MSGQ_NUM_PAGES;	355	super::fw::gsp_mem::advance_cpu_read_ptr(&self.0, elem_count)
359
360	// Ensure read pointer is properly ordered.
361	fence(Ordering::SeqCst);
362
363	let gsp_mem = self.0.start_ptr_mut();
364
365	// SAFETY:
366	// - The 'CoherentAllocation' contains at least one object.
367	// - By the invariants of `CoherentAllocation` the pointer is valid.
368	unsafe { (*gsp_mem).cpuq.rx.set_read_ptr(rptr) };
369	}	356	}
370		357
371	// Returns the index of the memory page the CPU can write the next command to.	358	// Returns the index of the memory page the CPU can write the next command to.
@@ -374,26 +361,12 @@ impl DmaGspMem { · 2 unmodified lines
374	//	361	//
375	// - The returned value is between `0` and `MSGQ_NUM_PAGES`.	362	// - The returned value is between `0` and `MSGQ_NUM_PAGES`.
376	fn cpu_write_ptr(&self) -> u32 {	363	fn cpu_write_ptr(&self) -> u32 {
377	let gsp_mem = self.0.start_ptr();	364	super::fw::gsp_mem::cpu_write_ptr(&self.0)
378
379	// SAFETY:
380	// - The 'CoherentAllocation' contains at least one object.
381	// - By the invariants of `CoherentAllocation` the pointer is valid.
382	(unsafe { (*gsp_mem).cpuq.tx.write_ptr() } % MSGQ_NUM_PAGES)
383	}	365	}
384		366
385	// Informs the GSP that it can process `elem_count` new pages from the command queue.	367	// Informs the GSP that it can process `elem_count` new pages from the command queue.
386	fn advance_cpu_write_ptr(&mut self, elem_count: u32) {	368	fn advance_cpu_write_ptr(&mut self, elem_count: u32) {
387	let wptr = self.cpu_write_ptr().wrapping_add(elem_count) & MSGQ_NUM_PAGES;	369	super::fw::gsp_mem::advance_cpu_write_ptr(&self.0, elem_count)
388	let gsp_mem = self.0.start_ptr_mut();
389
390	// SAFETY:
391	// - The 'CoherentAllocation' contains at least one object.
392	// - By the invariants of `CoherentAllocation` the pointer is valid.
393	unsafe { (*gsp_mem).cpuq.tx.set_write_ptr(wptr) };
394
395	// Ensure all command data is visible before triggering the GSP read.
396	fence(Ordering::SeqCst);
397	}	370	}
398	}	371	}
399		372

drivers/gpu/nova-core/gsp/fw.rs+69−32

@@ -40,6 +40,75 @@ use crate::{ · 39 unmodified lines
40	},	40	},
41	};	41	};
42		42
		43	// TODO: Replace with `IoView` projections once available; the `unwrap()` calls go away once we
		44	// switch to the new `dma::Coherent` API.
		45	pub(super) mod gsp_mem {
		46	use core::sync::atomic::{
		47	fence,
		48	Ordering, //
		49	};
		50
		51	use kernel::{
		52	dma::CoherentAllocation,
		53	dma_read,
		54	dma_write,
		55	prelude::*, //
		56	};
		57
		58	use crate::gsp::cmdq::{
		59	GspMem,
		60	MSGQ_NUM_PAGES, //
		61	};
		62
		63	pub(in crate::gsp) fn gsp_write_ptr(qs: &CoherentAllocation<GspMem>) -> u32 {
		64	// PANIC: A `dma::CoherentAllocation` always contains at least one element.
		65	\|\| -> Result<u32> { Ok(dma_read!(qs, [0]?.gspq.tx.0.writePtr) % MSGQ_NUM_PAGES) }().unwrap()
		66	}
		67
		68	pub(in crate::gsp) fn gsp_read_ptr(qs: &CoherentAllocation<GspMem>) -> u32 {
		69	// PANIC: A `dma::CoherentAllocation` always contains at least one element.
		70	\|\| -> Result<u32> { Ok(dma_read!(qs, [0]?.gspq.rx.0.readPtr) % MSGQ_NUM_PAGES) }().unwrap()
		71	}
		72
		73	pub(in crate::gsp) fn cpu_read_ptr(qs: &CoherentAllocation<GspMem>) -> u32 {
		74	// PANIC: A `dma::CoherentAllocation` always contains at least one element.
		75	\|\| -> Result<u32> { Ok(dma_read!(qs, [0]?.cpuq.rx.0.readPtr) % MSGQ_NUM_PAGES) }().unwrap()
		76	}
		77
		78	pub(in crate::gsp) fn advance_cpu_read_ptr(qs: &CoherentAllocation<GspMem>, count: u32) {
		79	let rptr = cpu_read_ptr(qs).wrapping_add(count) % MSGQ_NUM_PAGES;
		80
		81	// Ensure read pointer is properly ordered.
		82	fence(Ordering::SeqCst);
		83
		84	// PANIC: A `dma::CoherentAllocation` always contains at least one element.
		85	\|\| -> Result {
		86	dma_write!(qs, [0]?.cpuq.rx.0.readPtr, rptr);
		87	Ok(())
		88	}()
		89	.unwrap()
		90	}
		91
		92	pub(in crate::gsp) fn cpu_write_ptr(qs: &CoherentAllocation<GspMem>) -> u32 {
		93	// PANIC: A `dma::CoherentAllocation` always contains at least one element.
		94	\|\| -> Result<u32> { Ok(dma_read!(qs, [0]?.cpuq.tx.0.writePtr) % MSGQ_NUM_PAGES) }().unwrap()
		95	}
		96
		97	pub(in crate::gsp) fn advance_cpu_write_ptr(qs: &CoherentAllocation<GspMem>, count: u32) {
		98	let wptr = cpu_write_ptr(qs).wrapping_add(count) % MSGQ_NUM_PAGES;
		99
		100	// PANIC: A `dma::CoherentAllocation` always contains at least one element.
		101	\|\| -> Result {
		102	dma_write!(qs, [0]?.cpuq.tx.0.writePtr, wptr);
		103	Ok(())
		104	}()
		105	.unwrap();
		106
		107	// Ensure all command data is visible before triggering the GSP read.
		108	fence(Ordering::SeqCst);
		109	}
		110	}
		111
43	/// Empty type to group methods related to heap parameters for running the GSP firmware.	112	/// Empty type to group methods related to heap parameters for running the GSP firmware.
44	enum GspFwHeapParams {}	113	enum GspFwHeapParams {}
45		114
@@ -708,22 +777,6 @@ impl MsgqTxHeader { · 662 unmodified lines
708	entryOff: num::usize_into_u32::<GSP_PAGE_SIZE>(),	777	entryOff: num::usize_into_u32::<GSP_PAGE_SIZE>(),
709	})	778	})
710	}	779	}
711
712	/// Returns the value of the write pointer for this queue.
713	pub(crate) fn write_ptr(&self) -> u32 {
714	let ptr = core::ptr::from_ref(&self.0.writePtr);
715
716	// SAFETY: `ptr` is a valid pointer to a `u32`.
717	unsafe { ptr.read_volatile() }
718	}
719
720	/// Sets the value of the write pointer for this queue.
721	pub(crate) fn set_write_ptr(&mut self, val: u32) {
722	let ptr = core::ptr::from_mut(&mut self.0.writePtr);
723
724	// SAFETY: `ptr` is a valid pointer to a `u32`.
725	unsafe { ptr.write_volatile(val) }
726	}
727	}	780	}
728		781
729	// SAFETY: Padding is explicit and does not contain uninitialized data.	782	// SAFETY: Padding is explicit and does not contain uninitialized data.
@@ -739,22 +792,6 @@ impl MsgqRxHeader { · 9 unmodified lines
739	pub(crate) fn new() -> Self {	792	pub(crate) fn new() -> Self {
740	Self(Default::default())	793	Self(Default::default())
741	}	794	}
742
743	/// Returns the value of the read pointer for this queue.
744	pub(crate) fn read_ptr(&self) -> u32 {
745	let ptr = core::ptr::from_ref(&self.0.readPtr);
746
747	// SAFETY: `ptr` is a valid pointer to a `u32`.
748	unsafe { ptr.read_volatile() }
749	}
750
751	/// Sets the value of the read pointer for this queue.
752	pub(crate) fn set_read_ptr(&mut self, val: u32) {
753	let ptr = core::ptr::from_mut(&mut self.0.readPtr);
754
755	// SAFETY: `ptr` is a valid pointer to a `u32`.
756	unsafe { ptr.write_volatile(val) }
757	}
758	}	795	}
759		796
760	// SAFETY: Padding is explicit and does not contain uninitialized data.	797	// SAFETY: Padding is explicit and does not contain uninitialized data.

drivers/hid/bpf/hid_bpf_dispatch.c+2−0

@@ -444,6 +444,8 @@ hid_bpf_hw_request(struct hid_bpf_ctx ctx, __u8 buf, size_t buf__sz, · 443 unmodified lines
444	(u64)(long)ctx,	444	(u64)(long)ctx,
445	true); /* prevent infinite recursions */	445	true); /* prevent infinite recursions */
446		446
		447	if (ret > size)
		448	ret = size;
447	if (ret > 0)	449	if (ret > 0)
448	memcpy(buf, dma_data, ret);	450	memcpy(buf, dma_data, ret);
449		451

drivers/hid/hid-appletb-kbd.c+3−2

 	return 0;
 }
-static int appletb_kbd_reset_resume(struct hid_device *hdev)
+static int appletb_kbd_resume(struct hid_device *hdev)
 {
 	struct appletb_kbd *kbd = hid_get_drvdata(hdev);
 	.event = appletb_kbd_hid_event,
 	.input_configured = appletb_kbd_input_configured,
 	.suspend = pm_ptr(appletb_kbd_suspend),
-	.reset_resume = pm_ptr(appletb_kbd_reset_resume),
+	.resume = pm_ptr(appletb_kbd_resume),
+	.reset_resume = pm_ptr(appletb_kbd_resume),
 	.driver.dev_groups = appletb_kbd_groups,
 };
 module_hid_driver(appletb_kbd_hid_driver);

drivers/hid/hid-asus.c+3−0

 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
 	    USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X),
 	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD | QUIRK_ROG_ALLY_XPAD },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+	    USB_DEVICE_ID_ASUSTEK_XGM_2022),
+	},
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
 	    USB_DEVICE_ID_ASUSTEK_XGM_2023),
 	},

drivers/hid/hid-core.c+4−3

 		rsize = max_buffer_size;
 	if (csize < rsize) {
-		dbg_hid("report %d is too short, (%d < %d)\n", report->id,
+		hid_warn_ratelimited(hid, "Event data for report %d was too short (%d vs %d)\n",
-				csize, rsize);
+				     report->id, rsize, csize);
-		memset(cdata + csize, 0, rsize - csize);
+		ret = -EINVAL;
+		goto out;
 	}
 	if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event)

drivers/hid/hid-ids.h+1−2

 #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X		0x1b4c
 #define USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD	0x196b
 #define USB_DEVICE_ID_ASUSTEK_FX503VD_KEYBOARD	0x1869
+#define USB_DEVICE_ID_ASUSTEK_XGM_2022	0x1970
 #define USB_DEVICE_ID_ASUSTEK_XGM_2023	0x1a9a
 #define USB_VENDOR_ID_ATEN		0x0557
 #define USB_DEVICE_ID_TOSHIBA_CLICK_L9W	0x0401
 #define USB_DEVICE_ID_HP_X2		0x074d
 #define USB_DEVICE_ID_HP_X2_10_COVER	0x0755
-#define USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN	0x2544
-#define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN	0x2706
 #define I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM	0x2F81
 #define USB_VENDOR_ID_ELECOM		0x056e

drivers/hid/hid-input.c+11−7

 #define HID_BATTERY_QUIRK_FEATURE	(1 << 1) /* ask for feature report */
 #define HID_BATTERY_QUIRK_IGNORE	(1 << 2) /* completely ignore the battery */
 #define HID_BATTERY_QUIRK_AVOID_QUERY	(1 << 3) /* do not query the battery */
+#define HID_BATTERY_QUIRK_DYNAMIC	(1 << 4) /* report present only after life signs */
 static const struct hid_device_id hid_battery_quirks[] = {
 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
 		USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD),
 	  HID_BATTERY_QUIRK_IGNORE },
-	{ HID_USB_DEVICE(USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN),
-	  HID_BATTERY_QUIRK_IGNORE },
-	{ HID_USB_DEVICE(USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN),
-	  HID_BATTERY_QUIRK_IGNORE },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L),
 	  HID_BATTERY_QUIRK_AVOID_QUERY },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_MW),
 	 * Elan HID touchscreens seem to all report a non present battery,
 	 * set HID_BATTERY_QUIRK_IGNORE for all Elan I2C and USB HID devices.
 	 */
-	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE },
+	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_DYNAMIC },
-	{ HID_USB_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_DYNAMIC },
 	{}
 };
 	int ret = 0;
 	switch (prop) {
-	case POWER_SUPPLY_PROP_PRESENT:
 	case POWER_SUPPLY_PROP_ONLINE:
 		val->intval = 1;
 		break;
+	case POWER_SUPPLY_PROP_PRESENT:
+		val->intval = dev->battery_present;
+		break;
 	case POWER_SUPPLY_PROP_CAPACITY:
 		if (dev->battery_status != HID_BATTERY_REPORTED &&
 		    !dev->battery_avoid_query) {
 	if (quirks & HID_BATTERY_QUIRK_AVOID_QUERY)
 		dev->battery_avoid_query = true;
+	dev->battery_present = (quirks & HID_BATTERY_QUIRK_DYNAMIC) ? false : true;
 	dev->battery = power_supply_register(&dev->dev, psy_desc, &psy_cfg);
 	if (IS_ERR(dev->battery)) {
 		error = PTR_ERR(dev->battery);
 		return;
 	if (hidinput_update_battery_charge_status(dev, usage, value)) {
+		dev->battery_present = true;
 		power_supply_changed(dev->battery);
 		return;
 	}
 	if (dev->battery_status != HID_BATTERY_REPORTED ||
 	    capacity != dev->battery_capacity ||
 	    ktime_after(ktime_get_coarse(), dev->battery_ratelimit_time)) {
+		dev->battery_present = true;
 		dev->battery_capacity = capacity;
 		dev->battery_status = HID_BATTERY_REPORTED;
 		dev->battery_ratelimit_time =

drivers/hid/hid-logitech-hidpp.c+5−1

 		if (!ret)
 			ret = hidpp_ff_init(hidpp, &data);
-		if (ret)
+		if (ret) {
 			hid_warn(hidpp->hid_dev,
 		     "Unable to initialize force feedback support, errno %d\n",
 				 ret);
+			ret = 0;
+		}
 	}
 	/*
 	  HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb038) },
 	{ /* Slim Solar+ K980 Keyboard over Bluetooth */
 	  HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb391) },
+	{ /* MX Master 4 mouse over Bluetooth */
+	  HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb042) },
 	{}
 };

drivers/hid/hid-multitouch.c+7−0

 		dev_warn(&hdev->dev, "failed to fetch feature %d\n",
 			 report->id);
 	} else {
+		/* The report ID in the request and the response should match */
+		if (report->id != buf[0]) {
+			hid_err(hdev, "Returned feature report did not match the request\n");
+			goto free;
+		}
 		ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, buf,
 					   size, 0);
 		if (ret)
 			dev_warn(&hdev->dev, "failed to report feature\n");
 	}
+free:
 	kfree(buf);
 }

drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-hid.c+1−0

@@ -127,6 +127,7 @@ int quicki2c_hid_probe(struct quicki2c_device *qcdev) · 126 unmodified lines
127	hid->product = le16_to_cpu(qcdev->dev_desc.product_id);	127	hid->product = le16_to_cpu(qcdev->dev_desc.product_id);
128	snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X", "quicki2c-hid",	128	snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X", "quicki2c-hid",
129	hid->vendor, hid->product);	129	hid->vendor, hid->product);
		130	strscpy(hid->phys, dev_name(qcdev->dev), sizeof(hid->phys));
130		131
131	ret = hid_add_device(hid);	132	ret = hid_add_device(hid);
132	if (ret) {	133	if (ret) {

drivers/hid/intel-thc-hid/intel-quickspi/quickspi-hid.c+1−0

@@ -118,6 +118,7 @@ int quickspi_hid_probe(struct quickspi_device *qsdev) · 117 unmodified lines
118	hid->product = le16_to_cpu(qsdev->dev_desc.product_id);	118	hid->product = le16_to_cpu(qsdev->dev_desc.product_id);
119	snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X", "quickspi-hid",	119	snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X", "quickspi-hid",
120	hid->vendor, hid->product);	120	hid->vendor, hid->product);
		121	strscpy(hid->phys, dev_name(qsdev->dev), sizeof(hid->phys));
121		122
122	ret = hid_add_device(hid);	123	ret = hid_add_device(hid);
123	if (ret) {	124	if (ret) {

drivers/hid/wacom_wac.c+10−0

 	switch (data[0]) {
 	case 0x04:
+		if (len < 32) {
+			dev_warn(wacom->pen_input->dev.parent,
+				 "Report 0x04 too short: %zu bytes\n", len);
+			break;
+		}
 		wacom_intuos_bt_process_data(wacom, data + i);
 		i += 10;
 		fallthrough;
 	case 0x03:
+		if (i == 1 && len < 22) {
+			dev_warn(wacom->pen_input->dev.parent,
+				 "Report 0x03 too short: %zu bytes\n", len);
+			break;
+		}
 		wacom_intuos_bt_process_data(wacom, data + i);
 		i += 10;
 		wacom_intuos_bt_process_data(wacom, data + i);

drivers/hwmon/Kconfig+2−4

 config SENSORS_LM75
 	tristate "National Semiconductor LM75 and compatibles"
-	depends on I2C
+	depends on I3C_OR_I2C
-	depends on I3C || !I3C
 	select REGMAP_I2C
 	select REGMAP_I3C if I3C
 	help
 config SENSORS_TMP108
 	tristate "Texas Instruments TMP108"
-	depends on I2C
+	depends on I3C_OR_I2C
-	depends on I3C || !I3C
 	select REGMAP_I2C
 	select REGMAP_I3C if I3C
 	help

drivers/i3c/Kconfig+12−0

@@ -22,3 +22,15 @@ menuconfig I3C · 21 unmodified lines
22	if I3C	22	if I3C
23	source "drivers/i3c/master/Kconfig"	23	source "drivers/i3c/master/Kconfig"
24	endif # I3C	24	endif # I3C
		25
		26	config I3C_OR_I2C
		27	tristate
		28	default m if I3C=m
		29	default I2C
		30	help
		31	Device drivers using module_i3c_i2c_driver() can use either
		32	i2c or i3c hosts, but cannot be built-in for the kernel when
		33	CONFIG_I3C=m.
		34
		35	Add 'depends on I2C_OR_I3C' in Kconfig for those drivers to
		36	get the correct dependencies.

drivers/i3c/master/dw-i3c-master.c+4−2

 		master->free_pos &= ~BIT(pos);
 	}
-	writel(DEV_ADDR_TABLE_DYNAMIC_ADDR(dev->info.dyn_addr),
+	writel(DEV_ADDR_TABLE_DYNAMIC_ADDR(dev->info.dyn_addr) | DEV_ADDR_TABLE_SIR_REJECT,
 	       master->regs +
 	       DEV_ADDR_TABLE_LOC(master->datstartaddr, data->index));
 	master->free_pos &= ~BIT(pos);
 	i3c_dev_set_master_data(dev, data);
-	writel(DEV_ADDR_TABLE_DYNAMIC_ADDR(master->devs[pos].addr),
+	writel(DEV_ADDR_TABLE_DYNAMIC_ADDR(master->devs[pos].addr) | DEV_ADDR_TABLE_SIR_REJECT,
 	       master->regs +
 	       DEV_ADDR_TABLE_LOC(master->datstartaddr, data->index));
 		pm_runtime_get_noresume(&pdev->dev);
 	INIT_WORK(&master->hj_work, dw_i3c_hj_work);
+	device_set_of_node_from_dev(&master->base.i2c.dev, &pdev->dev);
 	ret = i3c_master_register(&master->base, &pdev->dev,
 				  &dw_mipi_i3c_ops, false);
 	if (ret)

drivers/i3c/master/mipi-i3c-hci/cmd.h+1−0

@@ -17,6 +17,7 @@ · 16 unmodified lines
17	#define CMD_0_TOC W0_BIT_(31)	17	#define CMD_0_TOC W0_BIT_(31)
18	#define CMD_0_ROC W0_BIT_(30)	18	#define CMD_0_ROC W0_BIT_(30)
19	#define CMD_0_ATTR W0_MASK(2, 0)	19	#define CMD_0_ATTR W0_MASK(2, 0)
		20	#define CMD_0_TID W0_MASK(6, 3)
20		21
21	/*	22	/*
22	* Response Descriptor Structure	23	* Response Descriptor Structure

drivers/i3c/master/mipi-i3c-hci/cmd_v1.c+3−5

 			CMD_A0_ROC | CMD_A0_TOC;
 		xfer->cmd_desc[1] = 0;
 		xfer->completion = &done;
-		hci->io->queue_xfer(hci, xfer, 1);
+		xfer->timeout = HZ;
-		if (!wait_for_completion_timeout(&done, HZ) &&
+		ret = i3c_hci_process_xfer(hci, xfer, 1);
-		    hci->io->dequeue_xfer(hci, xfer, 1)) {
+		if (ret)
-			ret = -ETIME;
 			break;
-		}
 		if ((RESP_STATUS(xfer->response) == RESP_ERR_ADDR_HEADER ||
 		     RESP_STATUS(xfer->response) == RESP_ERR_NACK) &&
 		    RESP_DATA_LENGTH(xfer->response) == 1) {

drivers/i3c/master/mipi-i3c-hci/cmd_v2.c+3−5

 	xfer[0].rnw = true;
 	xfer[0].cmd_desc[1] = CMD_A1_DATA_LENGTH(8);
 	xfer[1].completion = &done;
+	xfer[1].timeout = HZ;
 	for (;;) {
 		ret = i3c_master_get_free_addr(&hci->master, next_addr);
 			CMD_A0_ASSIGN_ADDRESS(next_addr) |
 			CMD_A0_ROC |
 			CMD_A0_TOC;
-		hci->io->queue_xfer(hci, xfer, 2);
+		ret = i3c_hci_process_xfer(hci, xfer, 2);
-		if (!wait_for_completion_timeout(&done, HZ) &&
+		if (ret)
-		    hci->io->dequeue_xfer(hci, xfer, 2)) {
-			ret = -ETIME;
 			break;
-		}
 		if (RESP_STATUS(xfer[0].response) != RESP_SUCCESS) {
 			ret = 0;  /* no more devices to be assigned */
 			break;

drivers/i3c/master/mipi-i3c-hci/core.c+90−53

 	if (hci->quirks & HCI_QUIRK_RESP_BUF_THLD)
 		amd_set_resp_buf_thld(hci);
-	reg_set(HC_CONTROL, HC_CONTROL_BUS_ENABLE);
+	scoped_guard(spinlock_irqsave, &hci->lock)
+		hci->irq_inactive = false;
+	/* Enable bus with Hot-Join disabled */
+	reg_set(HC_CONTROL, HC_CONTROL_BUS_ENABLE | HC_CONTROL_HOT_JOIN_CTRL);
 	dev_dbg(&hci->master.dev, "HC_CONTROL = %#x", reg_read(HC_CONTROL));
 	return 0;
 	return ret;
 }
+static int i3c_hci_software_reset(struct i3c_hci *hci)
+{
+	u32 regval;
+	int ret;
+	/*
+	 * SOFT_RST must be clear before we write to it.
+	 * Then we must wait until it clears again.
+	 */
+	ret = readx_poll_timeout(reg_read, RESET_CONTROL, regval,
+				 !(regval & SOFT_RST), 0, 10 * USEC_PER_MSEC);
+	if (ret) {
+		dev_err(&hci->master.dev, "%s: Software reset stuck\n", __func__);
+		return ret;
+	}
+	reg_write(RESET_CONTROL, SOFT_RST);
+	ret = readx_poll_timeout(reg_read, RESET_CONTROL, regval,
+				 !(regval & SOFT_RST), 0, 10 * USEC_PER_MSEC);
+	if (ret) {
+		dev_err(&hci->master.dev, "%s: Software reset failed\n", __func__);
+		return ret;
+	}
+	return 0;
+}
 void i3c_hci_sync_irq_inactive(struct i3c_hci *hci)
 {
 	struct platform_device *pdev = to_platform_device(hci->master.dev.parent);
 	int irq = platform_get_irq(pdev, 0);
 	reg_write(INTR_SIGNAL_ENABLE, 0x0);
-	hci->irq_inactive = true;
 	synchronize_irq(irq);
+	scoped_guard(spinlock_irqsave, &hci->lock)
+		hci->irq_inactive = true;
 }
 static void i3c_hci_bus_cleanup(struct i3c_master_controller *m)
 {
 	struct i3c_hci *hci = to_i3c_hci(m);
-	i3c_hci_bus_disable(hci);
+	if (i3c_hci_bus_disable(hci))
+		i3c_hci_software_reset(hci);
 	hci->io->cleanup(hci);
 }
 	reg_write(DCT_SECTION, FIELD_PREP(DCT_TABLE_INDEX, 0));
 }
+int i3c_hci_process_xfer(struct i3c_hci *hci, struct hci_xfer *xfer, int n)
+{
+	struct completion *done = xfer[n - 1].completion;
+	unsigned long timeout = xfer[n - 1].timeout;
+	int ret;
+	ret = hci->io->queue_xfer(hci, xfer, n);
+	if (ret)
+		return ret;
+	if (!wait_for_completion_timeout(done, timeout)) {
+		if (hci->io->dequeue_xfer(hci, xfer, n)) {
+			dev_err(&hci->master.dev, "%s: timeout error\n", __func__);
+			return -ETIMEDOUT;
+		}
+		return 0;
+	}
+	if (hci->io->handle_error) {
+		bool error = false;
+		for (int i = 0; i < n && !error; i++)
+			error = RESP_STATUS(xfer[i].response);
+		if (error)
+			return hci->io->handle_error(hci, xfer, n);
+	}
+	return 0;
+}
 static int i3c_hci_send_ccc_cmd(struct i3c_master_controller *m,
 				struct i3c_ccc_cmd *ccc)
 {
 	last = i - 1;
 	xfer[last].cmd_desc[0] |= CMD_0_TOC;
 	xfer[last].completion = &done;
+	xfer[last].timeout = HZ;
 	if (prefixed)
 		xfer--;
-	ret = hci->io->queue_xfer(hci, xfer, nxfers);
+	ret = i3c_hci_process_xfer(hci, xfer, nxfers);
 	if (ret)
 		goto out;
-	if (!wait_for_completion_timeout(&done, HZ) &&
-	    hci->io->dequeue_xfer(hci, xfer, nxfers)) {
-		ret = -ETIME;
-		goto out;
-	}
 	for (i = prefixed; i < nxfers; i++) {
 		if (ccc->rnw)
 			ccc->dests[i - prefixed].payload.len =
 	last = i - 1;
 	xfer[last].cmd_desc[0] |= CMD_0_TOC;
 	xfer[last].completion = &done;
+	xfer[last].timeout = HZ;
-	ret = hci->io->queue_xfer(hci, xfer, nxfers);
+	ret = i3c_hci_process_xfer(hci, xfer, nxfers);
 	if (ret)
 		goto out;
-	if (!wait_for_completion_timeout(&done, HZ) &&
-	    hci->io->dequeue_xfer(hci, xfer, nxfers)) {
-		ret = -ETIME;
-		goto out;
-	}
 	for (i = 0; i < nxfers; i++) {
 		if (i3c_xfers[i].rnw)
 			i3c_xfers[i].len = RESP_DATA_LENGTH(xfer[i].response);
 	last = i - 1;
 	xfer[last].cmd_desc[0] |= CMD_0_TOC;
 	xfer[last].completion = &done;
+	xfer[last].timeout = m->i2c.timeout;
-	ret = hci->io->queue_xfer(hci, xfer, nxfers);
+	ret = i3c_hci_process_xfer(hci, xfer, nxfers);
 	if (ret)
 		goto out;
-	if (!wait_for_completion_timeout(&done, m->i2c.timeout) &&
-	    hci->io->dequeue_xfer(hci, xfer, nxfers)) {
-		ret = -ETIME;
-		goto out;
-	}
 	for (i = 0; i < nxfers; i++) {
 		if (RESP_STATUS(xfer[i].response) != RESP_SUCCESS) {
 			ret = -EIO;
 	irqreturn_t result = IRQ_NONE;
 	u32 val;
+	guard(spinlock)(&hci->lock);
 	/*
 	 * The IRQ can be shared, so the handler may be called when the IRQ is
 	 * due to a different device. That could happen when runtime suspended,
 	return result;
 }
-static int i3c_hci_software_reset(struct i3c_hci *hci)
-{
-	u32 regval;
-	int ret;
-	/*
-	 * SOFT_RST must be clear before we write to it.
-	 * Then we must wait until it clears again.
-	 */
-	ret = readx_poll_timeout(reg_read, RESET_CONTROL, regval,
-				 !(regval & SOFT_RST), 0, 10 * USEC_PER_MSEC);
-	if (ret) {
-		dev_err(&hci->master.dev, "%s: Software reset stuck\n", __func__);
-		return ret;
-	}
-	reg_write(RESET_CONTROL, SOFT_RST);
-	ret = readx_poll_timeout(reg_read, RESET_CONTROL, regval,
-				 !(regval & SOFT_RST), 0, 10 * USEC_PER_MSEC);
-	if (ret) {
-		dev_err(&hci->master.dev, "%s: Software reset failed\n", __func__);
-		return ret;
-	}
-	return 0;
-}
 static inline bool is_version_1_1_or_newer(struct i3c_hci *hci)
 {
 	return hci->version_major > 1 || (hci->version_major == 1 && hci->version_minor > 0);
 	int ret;
 	ret = i3c_hci_bus_disable(hci);
-	if (ret)
+	if (ret) {
+		/* Fall back to software reset to disable the bus */
+		ret = i3c_hci_software_reset(hci);
+		i3c_hci_sync_irq_inactive(hci);
 		return ret;
+	}
 	hci->io->suspend(hci);
 	mipi_i3c_hci_dat_v1.restore(hci);
-	hci->irq_inactive = false;
 	hci->io->resume(hci);
-	reg_set(HC_CONTROL, HC_CONTROL_BUS_ENABLE);
+	scoped_guard(spinlock_irqsave, &hci->lock)
+		hci->irq_inactive = false;
+	/* Enable bus with Hot-Join disabled */
+	reg_set(HC_CONTROL, HC_CONTROL_BUS_ENABLE | HC_CONTROL_HOT_JOIN_CTRL);
 	return 0;
 }
 	if (!hci)
 		return -ENOMEM;
+	spin_lock_init(&hci->lock);
+	mutex_init(&hci->control_mutex);
 	/*
 	 * Multi-bus instances share the same MMIO address range, but not
 	 * necessarily in separate contiguous sub-ranges. To avoid overlapping
 	if (ret)
 		return ret;
+	hci->irq_inactive = true;
 	irq = platform_get_irq(pdev, 0);
 	ret = devm_request_irq(&pdev->dev, irq, i3c_hci_irq_handler,
 			       IRQF_SHARED, NULL, hci);

drivers/i3c/master/mipi-i3c-hci/dma.c+84−74

@@ -129,9 +129,8 @@ struct hci_rh_data { · 128 unmodified lines
129	dma_addr_t xfer_dma, resp_dma, ibi_status_dma, ibi_data_dma;	129	dma_addr_t xfer_dma, resp_dma, ibi_status_dma, ibi_data_dma;
130	unsigned int xfer_entries, ibi_status_entries, ibi_chunks_total;	130	unsigned int xfer_entries, ibi_status_entries, ibi_chunks_total;
131	unsigned int xfer_struct_sz, resp_struct_sz, ibi_status_sz, ibi_chunk_sz;	131	unsigned int xfer_struct_sz, resp_struct_sz, ibi_status_sz, ibi_chunk_sz;
132	unsigned int done_ptr, ibi_chunk_ptr;	132	unsigned int done_ptr, ibi_chunk_ptr, xfer_space;
133	struct hci_xfer **src_xfers;	133	struct hci_xfer **src_xfers;
134	spinlock_t lock;
135	struct completion op_done;	134	struct completion op_done;
136	};	135	};
137		136
@@ -261,6 +260,7 @@ ring_ready: · 123 unmodified lines
261		260
262	rh->done_ptr = 0;	261	rh->done_ptr = 0;
263	rh->ibi_chunk_ptr = 0;	262	rh->ibi_chunk_ptr = 0;
		263	rh->xfer_space = rh->xfer_entries;
264	}	264	}
265		265
266	static void hci_dma_init_rings(struct i3c_hci *hci)	266	static void hci_dma_init_rings(struct i3c_hci *hci)
@@ -344,7 +344,6 @@ static int hci_dma_init(struct i3c_hci *hci) · 77 unmodified lines
344	goto err_out;	344	goto err_out;
345	rh = &rings->headers[i];	345	rh = &rings->headers[i];
346	rh->regs = hci->base_regs + offset;	346	rh->regs = hci->base_regs + offset;
347	spin_lock_init(&rh->lock);
348	init_completion(&rh->op_done);	347	init_completion(&rh->op_done);
349		348
350	rh->xfer_entries = XFER_RING_ENTRIES;	349	rh->xfer_entries = XFER_RING_ENTRIES;
@@ -439,26 +438,63 @@ static void hci_dma_unmap_xfer(struct i3c_hci *hci, · 88 unmodified lines
439	}	438	}
440	}	439	}
441		440
		441	static struct i3c_dma hci_dma_map_xfer(struct device dev, struct hci_xfer *xfer)
		442	{
		443	enum dma_data_direction dir = xfer->rnw ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
		444	bool need_bounce = device_iommu_mapped(dev) && xfer->rnw && (xfer->data_len & 3);
		445
		446	return i3c_master_dma_map_single(dev, xfer->data, xfer->data_len, need_bounce, dir);
		447	}
		448
		449	static int hci_dma_map_xfer_list(struct i3c_hci hci, struct device dev,
		450	struct hci_xfer *xfer_list, int n)
		451	{
		452	for (int i = 0; i < n; i++) {
		453	struct hci_xfer *xfer = xfer_list + i;
		454
		455	if (!xfer->data)
		456	continue;
		457
		458	xfer->dma = hci_dma_map_xfer(dev, xfer);
		459	if (!xfer->dma) {
		460	hci_dma_unmap_xfer(hci, xfer_list, i);
		461	return -ENOMEM;
		462	}
		463	}
		464
		465	return 0;
		466	}
		467
442	static int hci_dma_queue_xfer(struct i3c_hci *hci,	468	static int hci_dma_queue_xfer(struct i3c_hci *hci,
443	struct hci_xfer *xfer_list, int n)	469	struct hci_xfer *xfer_list, int n)
444	{	470	{
445	struct hci_rings_data *rings = hci->io_data;	471	struct hci_rings_data *rings = hci->io_data;
446	struct hci_rh_data *rh;	472	struct hci_rh_data *rh;
447	unsigned int i, ring, enqueue_ptr;	473	unsigned int i, ring, enqueue_ptr;
448	u32 op1_val, op2_val;	474	u32 op1_val;
		475	int ret;
		476
		477	ret = hci_dma_map_xfer_list(hci, rings->sysdev, xfer_list, n);
		478	if (ret)
		479	return ret;
449		480
450	/* For now we only use ring 0 */	481	/* For now we only use ring 0 */
451	ring = 0;	482	ring = 0;
452	rh = &rings->headers[ring];	483	rh = &rings->headers[ring];
453		484
		485	spin_lock_irq(&hci->lock);
		486
		487	if (n > rh->xfer_space) {
		488	spin_unlock_irq(&hci->lock);
		489	hci_dma_unmap_xfer(hci, xfer_list, n);
		490	return -EBUSY;
		491	}
		492
454	op1_val = rh_reg_read(RING_OPERATION1);	493	op1_val = rh_reg_read(RING_OPERATION1);
455	enqueue_ptr = FIELD_GET(RING_OP1_CR_ENQ_PTR, op1_val);	494	enqueue_ptr = FIELD_GET(RING_OP1_CR_ENQ_PTR, op1_val);
456	for (i = 0; i < n; i++) {	495	for (i = 0; i < n; i++) {
457	struct hci_xfer *xfer = xfer_list + i;	496	struct hci_xfer *xfer = xfer_list + i;
458	u32 ring_data = rh->xfer + rh->xfer_struct_sz enqueue_ptr;	497	u32 ring_data = rh->xfer + rh->xfer_struct_sz enqueue_ptr;
459	enum dma_data_direction dir = xfer->rnw ? DMA_FROM_DEVICE :
460	DMA_TO_DEVICE;
461	bool need_bounce;
462		498
463	/* store cmd descriptor */	499	/* store cmd descriptor */
464	*ring_data++ = xfer->cmd_desc[0];	500	*ring_data++ = xfer->cmd_desc[0];
@@ -477,18 +513,6 @@ static int hci_dma_queue_xfer(struct i3c_hci *hci, · 12 unmodified lines
477		513
478	/* 2nd and 3rd words of Data Buffer Descriptor Structure */	514	/* 2nd and 3rd words of Data Buffer Descriptor Structure */
479	if (xfer->data) {	515	if (xfer->data) {
480	need_bounce = device_iommu_mapped(rings->sysdev) &&
481	xfer->rnw &&
482	xfer->data_len != ALIGN(xfer->data_len, 4);
483	xfer->dma = i3c_master_dma_map_single(rings->sysdev,
484	xfer->data,
485	xfer->data_len,
486	need_bounce,
487	dir);
488	if (!xfer->dma) {
489	hci_dma_unmap_xfer(hci, xfer_list, i);
490	return -ENOMEM;
491	}
492	*ring_data++ = lower_32_bits(xfer->dma->addr);	516	*ring_data++ = lower_32_bits(xfer->dma->addr);
493	*ring_data++ = upper_32_bits(xfer->dma->addr);	517	*ring_data++ = upper_32_bits(xfer->dma->addr);
494	} else {	518	} else {
@@ -503,26 +527,14 @@ static int hci_dma_queue_xfer(struct i3c_hci *hci, · 8 unmodified lines
503	xfer->ring_entry = enqueue_ptr;	527	xfer->ring_entry = enqueue_ptr;
504		528
505	enqueue_ptr = (enqueue_ptr + 1) % rh->xfer_entries;	529	enqueue_ptr = (enqueue_ptr + 1) % rh->xfer_entries;
506
507	/*
508	* We may update the hardware view of the enqueue pointer
509	* only if we didn't reach its dequeue pointer.
510	*/
511	op2_val = rh_reg_read(RING_OPERATION2);
512	if (enqueue_ptr == FIELD_GET(RING_OP2_CR_DEQ_PTR, op2_val)) {
513	/* the ring is full */
514	hci_dma_unmap_xfer(hci, xfer_list, i + 1);
515	return -EBUSY;
516	}
517	}	530	}
518		531
519	/* take care to update the hardware enqueue pointer atomically */	532	rh->xfer_space -= n;
520	spin_lock_irq(&rh->lock);	533
521	op1_val = rh_reg_read(RING_OPERATION1);
522	op1_val &= ~RING_OP1_CR_ENQ_PTR;	534	op1_val &= ~RING_OP1_CR_ENQ_PTR;
523	op1_val \|= FIELD_PREP(RING_OP1_CR_ENQ_PTR, enqueue_ptr);	535	op1_val \|= FIELD_PREP(RING_OP1_CR_ENQ_PTR, enqueue_ptr);
524	rh_reg_write(RING_OPERATION1, op1_val);	536	rh_reg_write(RING_OPERATION1, op1_val);
525	spin_unlock_irq(&rh->lock);	537	spin_unlock_irq(&hci->lock);
526		538
527	return 0;	539	return 0;
528	}	540	}
@@ -534,18 +546,29 @@ static bool hci_dma_dequeue_xfer(struct i3c_hci *hci, · 5 unmodified lines
534	struct hci_rh_data *rh = &rings->headers[xfer_list[0].ring_number];	546	struct hci_rh_data *rh = &rings->headers[xfer_list[0].ring_number];
535	unsigned int i;	547	unsigned int i;
536	bool did_unqueue = false;	548	bool did_unqueue = false;
537		549	u32 ring_status;
538	/* stop the ring */	550
539	rh_reg_write(RING_CONTROL, RING_CTRL_ABORT);	551	guard(mutex)(&hci->control_mutex);
540	if (wait_for_completion_timeout(&rh->op_done, HZ) == 0) {	552
541	/*	553	ring_status = rh_reg_read(RING_STATUS);
542	* We're deep in it if ever this condition is ever met.	554	if (ring_status & RING_STATUS_RUNNING) {
543	* Hardware might still be writing to memory, etc.	555	/* stop the ring */
544	*/	556	reinit_completion(&rh->op_done);
545	dev_crit(&hci->master.dev, "unable to abort the ring\n");	557	rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE \| RING_CTRL_ABORT);
546	WARN_ON(1);	558	wait_for_completion_timeout(&rh->op_done, HZ);
		559	ring_status = rh_reg_read(RING_STATUS);
		560	if (ring_status & RING_STATUS_RUNNING) {
		561	/*
		562	* We're deep in it if ever this condition is ever met.
		563	* Hardware might still be writing to memory, etc.
		564	*/
		565	dev_crit(&hci->master.dev, "unable to abort the ring\n");
		566	WARN_ON(1);
		567	}
547	}	568	}
548		569
		570	spin_lock_irq(&hci->lock);
		571
549	for (i = 0; i < n; i++) {	572	for (i = 0; i < n; i++) {
550	struct hci_xfer *xfer = xfer_list + i;	573	struct hci_xfer *xfer = xfer_list + i;
551	int idx = xfer->ring_entry;	574	int idx = xfer->ring_entry;
@@ -559,7 +582,7 @@ static bool hci_dma_dequeue_xfer(struct i3c_hci *hci, · 7 unmodified lines
559	u32 ring_data = rh->xfer + rh->xfer_struct_sz idx;	582	u32 ring_data = rh->xfer + rh->xfer_struct_sz idx;
560		583
561	/* store no-op cmd descriptor */	584	/* store no-op cmd descriptor */
562	*ring_data++ = FIELD_PREP(CMD_0_ATTR, 0x7);	585	*ring_data++ = FIELD_PREP(CMD_0_ATTR, 0x7) \| FIELD_PREP(CMD_0_TID, xfer->cmd_tid);
563	*ring_data++ = 0;	586	*ring_data++ = 0;
564	if (hci->cmd == &mipi_i3c_hci_cmd_v2) {	587	if (hci->cmd == &mipi_i3c_hci_cmd_v2) {
565	*ring_data++ = 0;	588	*ring_data++ = 0;
@@ -577,15 +600,25 @@ static bool hci_dma_dequeue_xfer(struct i3c_hci *hci, · 11 unmodified lines
577	}	600	}
578		601
579	/* restart the ring */	602	/* restart the ring */
		603	mipi_i3c_hci_resume(hci);
580	rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE);	604	rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE);
		605	rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE \| RING_CTRL_RUN_STOP);
		606
		607	spin_unlock_irq(&hci->lock);
581		608
582	return did_unqueue;	609	return did_unqueue;
583	}	610	}
584		611
		612	static int hci_dma_handle_error(struct i3c_hci hci, struct hci_xfer xfer_list, int n)
		613	{
		614	return hci_dma_dequeue_xfer(hci, xfer_list, n) ? -EIO : 0;
		615	}
		616
585	static void hci_dma_xfer_done(struct i3c_hci hci, struct hci_rh_data rh)	617	static void hci_dma_xfer_done(struct i3c_hci hci, struct hci_rh_data rh)
586	{	618	{
587	u32 op1_val, op2_val, resp, *ring_resp;	619	u32 op1_val, op2_val, resp, *ring_resp;
588	unsigned int tid, done_ptr = rh->done_ptr;	620	unsigned int tid, done_ptr = rh->done_ptr;
		621	unsigned int done_cnt = 0;
589	struct hci_xfer *xfer;	622	struct hci_xfer *xfer;
590		623
591	for (;;) {	624	for (;;) {
@@ -603,6 +636,7 @@ static void hci_dma_xfer_done(struct i3c_hci hci, struct hci_rh_data rh) · 11 unmodified lines
603	dev_dbg(&hci->master.dev, "orphaned ring entry");	636	dev_dbg(&hci->master.dev, "orphaned ring entry");
604	} else {	637	} else {
605	hci_dma_unmap_xfer(hci, xfer, 1);	638	hci_dma_unmap_xfer(hci, xfer, 1);
		639	rh->src_xfers[done_ptr] = NULL;
606	xfer->ring_entry = -1;	640	xfer->ring_entry = -1;
607	xfer->response = resp;	641	xfer->response = resp;
608	if (tid != xfer->cmd_tid) {	642	if (tid != xfer->cmd_tid) {
@@ -617,15 +651,14 @@ static void hci_dma_xfer_done(struct i3c_hci hci, struct hci_rh_data rh) · 8 unmodified lines
617		651
618	done_ptr = (done_ptr + 1) % rh->xfer_entries;	652	done_ptr = (done_ptr + 1) % rh->xfer_entries;
619	rh->done_ptr = done_ptr;	653	rh->done_ptr = done_ptr;
		654	done_cnt += 1;
620	}	655	}
621		656
622	/* take care to update the software dequeue pointer atomically */	657	rh->xfer_space += done_cnt;
623	spin_lock(&rh->lock);
624	op1_val = rh_reg_read(RING_OPERATION1);	658	op1_val = rh_reg_read(RING_OPERATION1);
625	op1_val &= ~RING_OP1_CR_SW_DEQ_PTR;	659	op1_val &= ~RING_OP1_CR_SW_DEQ_PTR;
626	op1_val \|= FIELD_PREP(RING_OP1_CR_SW_DEQ_PTR, done_ptr);	660	op1_val \|= FIELD_PREP(RING_OP1_CR_SW_DEQ_PTR, done_ptr);
627	rh_reg_write(RING_OPERATION1, op1_val);	661	rh_reg_write(RING_OPERATION1, op1_val);
628	spin_unlock(&rh->lock);
629	}	662	}
630		663
631	static int hci_dma_request_ibi(struct i3c_hci hci, struct i3c_dev_desc dev,	664	static int hci_dma_request_ibi(struct i3c_hci hci, struct i3c_dev_desc dev,
@@ -805,13 +838,10 @@ static void hci_dma_process_ibi(struct i3c_hci hci, struct hci_rh_data rh) · 173 unmodified lines
805	i3c_master_queue_ibi(dev, slot);	838	i3c_master_queue_ibi(dev, slot);
806		839
807	done:	840	done:
808	/* take care to update the ibi dequeue pointer atomically */
809	spin_lock(&rh->lock);
810	op1_val = rh_reg_read(RING_OPERATION1);	841	op1_val = rh_reg_read(RING_OPERATION1);
811	op1_val &= ~RING_OP1_IBI_DEQ_PTR;	842	op1_val &= ~RING_OP1_IBI_DEQ_PTR;
812	op1_val \|= FIELD_PREP(RING_OP1_IBI_DEQ_PTR, deq_ptr);	843	op1_val \|= FIELD_PREP(RING_OP1_IBI_DEQ_PTR, deq_ptr);
813	rh_reg_write(RING_OPERATION1, op1_val);	844	rh_reg_write(RING_OPERATION1, op1_val);
814	spin_unlock(&rh->lock);
815		845
816	/* update the chunk pointer */	846	/* update the chunk pointer */
817	rh->ibi_chunk_ptr += ibi_chunks;	847	rh->ibi_chunk_ptr += ibi_chunks;
@@ -845,29 +875,8 @@ static bool hci_dma_irq_handler(struct i3c_hci *hci) · 27 unmodified lines
845	hci_dma_xfer_done(hci, rh);	875	hci_dma_xfer_done(hci, rh);
846	if (status & INTR_RING_OP)	876	if (status & INTR_RING_OP)
847	complete(&rh->op_done);	877	complete(&rh->op_done);
848		878	if (status & INTR_TRANSFER_ABORT)
849	if (status & INTR_TRANSFER_ABORT) {	879	dev_dbg(&hci->master.dev, "Ring %d: Transfer Aborted\n", i);
850	u32 ring_status;
851
852	dev_notice_ratelimited(&hci->master.dev,
853	"Ring %d: Transfer Aborted\n", i);
854	mipi_i3c_hci_resume(hci);
855	ring_status = rh_reg_read(RING_STATUS);
856	if (!(ring_status & RING_STATUS_RUNNING) &&
857	status & INTR_TRANSFER_COMPLETION &&
858	status & INTR_TRANSFER_ERR) {
859	/*
860	* Ring stop followed by run is an Intel
861	* specific required quirk after resuming the
862	* halted controller. Do it only when the ring
863	* is not in running state after a transfer
864	* error.
865	*/
866	rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE);
867	rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE \|
868	RING_CTRL_RUN_STOP);
869	}
870	}
871	if (status & INTR_IBI_RING_FULL)	880	if (status & INTR_IBI_RING_FULL)
872	dev_err_ratelimited(&hci->master.dev,	881	dev_err_ratelimited(&hci->master.dev,
873	"Ring %d: IBI Ring Full Condition\n", i);	882	"Ring %d: IBI Ring Full Condition\n", i);
@@ -883,6 +892,7 @@ const struct hci_io_ops mipi_i3c_hci_dma = { · 9 unmodified lines
883	.cleanup = hci_dma_cleanup,	892	.cleanup = hci_dma_cleanup,
884	.queue_xfer = hci_dma_queue_xfer,	893	.queue_xfer = hci_dma_queue_xfer,
885	.dequeue_xfer = hci_dma_dequeue_xfer,	894	.dequeue_xfer = hci_dma_dequeue_xfer,
		895	.handle_error = hci_dma_handle_error,
886	.irq_handler = hci_dma_irq_handler,	896	.irq_handler = hci_dma_irq_handler,
887	.request_ibi = hci_dma_request_ibi,	897	.request_ibi = hci_dma_request_ibi,
888	.free_ibi = hci_dma_free_ibi,	898	.free_ibi = hci_dma_free_ibi,

drivers/i3c/master/mipi-i3c-hci/hci.h+5−0

 	const struct hci_io_ops *io;
 	void *io_data;
 	const struct hci_cmd_ops *cmd;
+	spinlock_t lock;
+	struct mutex control_mutex;
 	atomic_t next_cmd_tid;
 	bool irq_inactive;
 	u32 caps;
 	unsigned int data_len;
 	unsigned int cmd_tid;
 	struct completion *completion;
+	unsigned long timeout;
 	union {
 		struct {
 			/* PIO specific */
 	bool (*irq_handler)(struct i3c_hci *hci);
 	int (*queue_xfer)(struct i3c_hci *hci, struct hci_xfer *xfer, int n);
 	bool (*dequeue_xfer)(struct i3c_hci *hci, struct hci_xfer *xfer, int n);
+	int (*handle_error)(struct i3c_hci *hci, struct hci_xfer *xfer, int n);
 	int (*request_ibi)(struct i3c_hci *hci, struct i3c_dev_desc *dev,
 			   const struct i3c_ibi_setup *req);
 	void (*free_ibi)(struct i3c_hci *hci, struct i3c_dev_desc *dev);
 void amd_set_od_pp_timing(struct i3c_hci *hci);
 void amd_set_resp_buf_thld(struct i3c_hci *hci);
 void i3c_hci_sync_irq_inactive(struct i3c_hci *hci);
+int i3c_hci_process_xfer(struct i3c_hci *hci, struct hci_xfer *xfer, int n);
 #endif

drivers/i3c/master/mipi-i3c-hci/pio.c+5−11

 };
 struct hci_pio_data {
-	spinlock_t lock;
 	struct hci_xfer *curr_xfer, *xfer_queue;
 	struct hci_xfer *curr_rx, *rx_queue;
 	struct hci_xfer *curr_tx, *tx_queue;
 		return -ENOMEM;
 	hci->io_data = pio;
-	spin_lock_init(&pio->lock);
 	__hci_pio_init(hci, &size_val);
 		xfer[i].data_left = xfer[i].data_len;
 	}
-	spin_lock_irq(&pio->lock);
+	spin_lock_irq(&hci->lock);
 	prev_queue_tail = pio->xfer_queue;
 	pio->xfer_queue = &xfer[n - 1];
 	if (pio->curr_xfer) {
 			pio_reg_read(INTR_STATUS),
 			pio_reg_read(INTR_SIGNAL_ENABLE));
 	}
-	spin_unlock_irq(&pio->lock);
+	spin_unlock_irq(&hci->lock);
 	return 0;
 }
 	struct hci_pio_data *pio = hci->io_data;
 	int ret;
-	spin_lock_irq(&pio->lock);
+	spin_lock_irq(&hci->lock);
 	dev_dbg(&hci->master.dev, "n=%d status=%#x/%#x", n,
 		pio_reg_read(INTR_STATUS), pio_reg_read(INTR_SIGNAL_ENABLE));
 	dev_dbg(&hci->master.dev, "main_status = %#x/%#x",
 		readl(hci->base_regs + 0x20), readl(hci->base_regs + 0x28));
 	ret = hci_pio_dequeue_xfer_common(hci, pio, xfer, n);
-	spin_unlock_irq(&pio->lock);
+	spin_unlock_irq(&hci->lock);
 	return ret;
 }
 	struct hci_pio_data *pio = hci->io_data;
 	u32 status;
-	spin_lock(&pio->lock);
 	status = pio_reg_read(INTR_STATUS);
 	dev_dbg(&hci->master.dev, "PIO_INTR_STATUS %#x/%#x",
 		status, pio->enabled_irqs);
 	status &= pio->enabled_irqs | STAT_LATENCY_WARNINGS;
-	if (!status) {
+	if (!status)
-		spin_unlock(&pio->lock);
 		return false;
-	}
 	if (status & STAT_IBI_STATUS_THLD)
 		hci_pio_process_ibi(hci, pio);
 	pio_reg_write(INTR_SIGNAL_ENABLE, pio->enabled_irqs);
 	dev_dbg(&hci->master.dev, "PIO_INTR_STATUS %#x/%#x",
 		pio_reg_read(INTR_STATUS), pio_reg_read(INTR_SIGNAL_ENABLE));
-	spin_unlock(&pio->lock);
 	return true;
 }

drivers/iio/adc/ad7768-1.c+11−2

 	return ret;
 }
-static void ad7768_fill_scale_tbl(struct iio_dev *dev)
+static int ad7768_fill_scale_tbl(struct iio_dev *dev)
 {
 	struct ad7768_state *st = iio_priv(dev);
 	const struct iio_scan_type *scan_type;
 	u64 tmp2;
 	scan_type = iio_get_current_scan_type(dev, &dev->channels[0]);
+	if (IS_ERR(scan_type)) {
+		dev_err(&st->spi->dev, "Failed to get scan type.\n");
+		return PTR_ERR(scan_type);
+	}
 	if (scan_type->sign == 's')
 		val2 = scan_type->realbits - 1;
 	else
 		st->scale_tbl[i][0] = tmp0; /* Integer part */
 		st->scale_tbl[i][1] = abs(tmp1); /* Fractional part */
 	}
+	return 0;
 }
 static int ad7768_set_sinc3_dec_rate(struct ad7768_state *st,
 	}
 	/* Update scale table: scale values vary according to the precision */
-	ad7768_fill_scale_tbl(dev);
+	ret = ad7768_fill_scale_tbl(dev);
+	if (ret)
+		return ret;
 	ad7768_fill_samp_freq_tbl(st);

drivers/iio/chemical/bme680_core.c+1−1

@@ -613,7 +613,7 @@ static int bme680_wait_for_eoc(struct bme680_data *data) · 612 unmodified lines
613	* + heater duration	613	* + heater duration
614	*/	614	*/
615	int wait_eoc_us = ((data->oversampling_temp + data->oversampling_press +	615	int wait_eoc_us = ((data->oversampling_temp + data->oversampling_press +
616	data->oversampling_humid) * 1936) + (477 * 4) +	616	data->oversampling_humid) * 1963) + (477 * 4) +
617	(477 * 5) + 1000 + (data->heater_dur * 1000);	617	(477 * 5) + 1000 + (data->heater_dur * 1000);
618		618
619	fsleep(wait_eoc_us);	619	fsleep(wait_eoc_us);

drivers/iio/chemical/sps30_i2c.c+1−1

@@ -171,7 +171,7 @@ static int sps30_i2c_read_meas(struct sps30_state state, __be32 meas, size_t n · 170 unmodified lines
171	if (!sps30_i2c_meas_ready(state))	171	if (!sps30_i2c_meas_ready(state))
172	return -ETIMEDOUT;	172	return -ETIMEDOUT;
173		173
174	return sps30_i2c_command(state, SPS30_I2C_READ_MEAS, NULL, 0, meas, sizeof(num) * num);	174	return sps30_i2c_command(state, SPS30_I2C_READ_MEAS, NULL, 0, meas, sizeof(meas) num);
175	}	175	}
176		176
177	static int sps30_i2c_clean_fan(struct sps30_state *state)	177	static int sps30_i2c_clean_fan(struct sps30_state *state)

drivers/iio/chemical/sps30_serial.c+1−1

@@ -303,7 +303,7 @@ static int sps30_serial_read_meas(struct sps30_state state, __be32 meas, size_ · 302 unmodified lines
303	if (msleep_interruptible(1000))	303	if (msleep_interruptible(1000))
304	return -EINTR;	304	return -EINTR;
305		305
306	ret = sps30_serial_command(state, SPS30_SERIAL_READ_MEAS, NULL, 0, meas, num * sizeof(num));	306	ret = sps30_serial_command(state, SPS30_SERIAL_READ_MEAS, NULL, 0, meas, num * sizeof(*meas));
307	if (ret < 0)	307	if (ret < 0)
308	return ret;	308	return ret;
309	/* if measurements aren't ready sensor returns empty frame */	309	/* if measurements aren't ready sensor returns empty frame */

drivers/iio/dac/ds4424.c+1−1

@@ -140,7 +140,7 @@ static int ds4424_write_raw(struct iio_dev *indio_dev, · 139 unmodified lines
140		140
141	switch (mask) {	141	switch (mask) {
142	case IIO_CHAN_INFO_RAW:	142	case IIO_CHAN_INFO_RAW:
143	if (val < S8_MIN \|\| val > S8_MAX)	143	if (val <= S8_MIN \|\| val > S8_MAX)
144	return -EINVAL;	144	return -EINVAL;
145		145
146	if (val > 0) {	146	if (val > 0) {

drivers/iio/frequency/adf4377.c+1−1

@@ -508,7 +508,7 @@ static int adf4377_soft_reset(struct adf4377_state *st) · 507 unmodified lines
508	return ret;	508	return ret;
509		509
510	return regmap_read_poll_timeout(st->regmap, 0x0, read_val,	510	return regmap_read_poll_timeout(st->regmap, 0x0, read_val,
511	!(read_val & (ADF4377_0000_SOFT_RESET_R_MSK \|	511	!(read_val & (ADF4377_0000_SOFT_RESET_MSK \|
512	ADF4377_0000_SOFT_RESET_R_MSK)), 200, 200 * 100);	512	ADF4377_0000_SOFT_RESET_R_MSK)), 200, 200 * 100);
513	}	513	}
514		514

drivers/iio/gyro/mpu3050-core.c+13−5

 		}
 	case IIO_CHAN_INFO_RAW:
 		/* Resume device */
-		pm_runtime_get_sync(mpu3050->dev);
+		ret = pm_runtime_resume_and_get(mpu3050->dev);
+		if (ret)
+			return ret;
 		mutex_lock(&mpu3050->lock);
 		ret = mpu3050_set_8khz_samplerate(mpu3050);
 static int mpu3050_buffer_preenable(struct iio_dev *indio_dev)
 {
 	struct mpu3050 *mpu3050 = iio_priv(indio_dev);
+	int ret;
-	pm_runtime_get_sync(mpu3050->dev);
+	ret = pm_runtime_resume_and_get(mpu3050->dev);
+	if (ret)
+		return ret;
 	/* Unless we have OUR trigger active, run at full speed */
-	if (!mpu3050->hw_irq_trigger)
+	if (!mpu3050->hw_irq_trigger) {
-		return mpu3050_set_8khz_samplerate(mpu3050);
+		ret = mpu3050_set_8khz_samplerate(mpu3050);
+		if (ret)
+			pm_runtime_put_autosuspend(mpu3050->dev);
+	}
-	return 0;
+	return ret;
 }
 static int mpu3050_buffer_postdisable(struct iio_dev *indio_dev)

drivers/iio/gyro/mpu3050-i2c.c+1−2

@@ -19,8 +19,7 @@ static int mpu3050_i2c_bypass_select(struct i2c_mux_core *mux, u32 chan_id) · 18 unmodified lines
19	struct mpu3050 *mpu3050 = i2c_mux_priv(mux);	19	struct mpu3050 *mpu3050 = i2c_mux_priv(mux);
20		20
21	/* Just power up the device, that is all that is needed */	21	/* Just power up the device, that is all that is needed */
22	pm_runtime_get_sync(mpu3050->dev);	22	return pm_runtime_resume_and_get(mpu3050->dev);
23	return 0;
24	}	23	}
25		24
26	static int mpu3050_i2c_bypass_deselect(struct i2c_mux_core *mux, u32 chan_id)	25	static int mpu3050_i2c_bypass_deselect(struct i2c_mux_core *mux, u32 chan_id)

drivers/iio/imu/adis.c+1−1

@@ -526,7 +526,7 @@ int adis_init(struct adis adis, struct iio_dev indio_dev, · 525 unmodified lines
526		526
527	adis->spi = spi;	527	adis->spi = spi;
528	adis->data = data;	528	adis->data = data;
529	if (!adis->ops->write && !adis->ops->read && !adis->ops->reset)	529	if (!adis->ops)
530	adis->ops = &adis_default_ops;	530	adis->ops = &adis_default_ops;
531	else if (!adis->ops->write \|\| !adis->ops->read \|\| !adis->ops->reset)	531	else if (!adis->ops->write \|\| !adis->ops->read \|\| !adis->ops->reset)
532	return -EINVAL;	532	return -EINVAL;

drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c+2−0

@@ -651,6 +651,8 @@ static int inv_icm42600_accel_write_odr(struct iio_dev *indio_dev, · 650 unmodified lines
651	return -EINVAL;	651	return -EINVAL;
652		652
653	conf.odr = inv_icm42600_accel_odr_conv[idx / 2];	653	conf.odr = inv_icm42600_accel_odr_conv[idx / 2];
		654	if (conf.odr == st->conf.accel.odr)
		655	return 0;
654		656
655	pm_runtime_get_sync(dev);	657	pm_runtime_get_sync(dev);
656	mutex_lock(&st->lock);	658	mutex_lock(&st->lock);

drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c+4−0

 static int inv_icm42600_buffer_postdisable(struct iio_dev *indio_dev)
 {
 	struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev);
+	struct inv_icm42600_sensor_state *sensor_st = iio_priv(indio_dev);
+	struct inv_sensors_timestamp *ts = &sensor_st->ts;
 	struct device *dev = regmap_get_device(st->map);
 	unsigned int sensor;
 	unsigned int *watermark;
 	mutex_lock(&st->lock);
+	inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
 	ret = inv_icm42600_buffer_set_fifo_en(st, st->fifo.en & ~sensor);
 	if (ret)
 		goto out_unlock;

drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c+2−0

@@ -358,6 +358,8 @@ static int inv_icm42600_gyro_write_odr(struct iio_dev *indio_dev, · 357 unmodified lines
358	return -EINVAL;	358	return -EINVAL;
359		359
360	conf.odr = inv_icm42600_gyro_odr_conv[idx / 2];	360	conf.odr = inv_icm42600_gyro_odr_conv[idx / 2];
		361	if (conf.odr == st->conf.gyro.odr)
		362	return 0;
361		363
362	pm_runtime_get_sync(dev);	364	pm_runtime_get_sync(dev);
363	mutex_lock(&st->lock);	365	mutex_lock(&st->lock);

drivers/iio/imu/inv_icm45600/inv_icm45600.h+1−1

@@ -205,7 +205,7 @@ struct inv_icm45600_sensor_state { · 204 unmodified lines
205	#define INV_ICM45600_SPI_SLEW_RATE_38NS 0	205	#define INV_ICM45600_SPI_SLEW_RATE_38NS 0
206		206
207	#define INV_ICM45600_REG_INT1_CONFIG2 0x0018	207	#define INV_ICM45600_REG_INT1_CONFIG2 0x0018
208	#define INV_ICM45600_INT1_CONFIG2_PUSH_PULL BIT(2)	208	#define INV_ICM45600_INT1_CONFIG2_OPEN_DRAIN BIT(2)
209	#define INV_ICM45600_INT1_CONFIG2_LATCHED BIT(1)	209	#define INV_ICM45600_INT1_CONFIG2_LATCHED BIT(1)
210	#define INV_ICM45600_INT1_CONFIG2_ACTIVE_HIGH BIT(0)	210	#define INV_ICM45600_INT1_CONFIG2_ACTIVE_HIGH BIT(0)
211	#define INV_ICM45600_INT1_CONFIG2_ACTIVE_LOW 0x00	211	#define INV_ICM45600_INT1_CONFIG2_ACTIVE_LOW 0x00

drivers/iio/imu/inv_icm45600/inv_icm45600_core.c+8−3

 		break;
 	}
-	if (!open_drain)
+	if (open_drain)
-		val |= INV_ICM45600_INT1_CONFIG2_PUSH_PULL;
+		val |= INV_ICM45600_INT1_CONFIG2_OPEN_DRAIN;
 	ret = regmap_write(st->map, INV_ICM45600_REG_INT1_CONFIG2, val);
 	if (ret)
 	 */
 	fsleep(5 * USEC_PER_MSEC);
+	/* set pm_runtime active early for disable vddio resource cleanup */
+	ret = pm_runtime_set_active(dev);
+	if (ret)
+		return ret;
 	ret = inv_icm45600_enable_regulator_vddio(st);
 	if (ret)
 		return ret;
 	if (ret)
 		return ret;
-	ret = devm_pm_runtime_set_active_enabled(dev);
+	ret = devm_pm_runtime_enable(dev);
 	if (ret)
 		return ret;

drivers/iio/imu/inv_mpu6050/inv_mpu_core.c+8−0

@@ -1943,6 +1943,14 @@ int inv_mpu_core_probe(struct regmap regmap, int irq, const char name, · 1942 unmodified lines
1943	irq_type);	1943	irq_type);
1944	return -EINVAL;	1944	return -EINVAL;
1945	}	1945	}
		1946
		1947	/*
		1948	* Acking interrupts by status register does not work reliably
		1949	* but seem to work when this bit is set.
		1950	*/
		1951	if (st->chip_type == INV_MPU9150)
		1952	st->irq_mask \|= INV_MPU6050_INT_RD_CLEAR;
		1953
1946	device_set_wakeup_capable(dev, true);	1954	device_set_wakeup_capable(dev, true);
1947		1955
1948	st->vdd_supply = devm_regulator_get(dev, "vdd");	1956	st->vdd_supply = devm_regulator_get(dev, "vdd");

drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h+2−0

@@ -390,6 +390,8 @@ struct inv_mpu6050_state { · 389 unmodified lines
390	/* enable level triggering */	390	/* enable level triggering */
391	#define INV_MPU6050_LATCH_INT_EN 0x20	391	#define INV_MPU6050_LATCH_INT_EN 0x20
392	#define INV_MPU6050_BIT_BYPASS_EN 0x2	392	#define INV_MPU6050_BIT_BYPASS_EN 0x2
		393	/* allow acking interrupts by any register read */
		394	#define INV_MPU6050_INT_RD_CLEAR 0x10
393		395
394	/* Allowed timestamp period jitter in percent */	396	/* Allowed timestamp period jitter in percent */
395	#define INV_MPU6050_TS_PERIOD_JITTER 4	397	#define INV_MPU6050_TS_PERIOD_JITTER 4

drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c+4−1

 	switch (st->chip_type) {
 	case INV_MPU6000:
 	case INV_MPU6050:
-	case INV_MPU9150:
 		/*
 		 * WoM is not supported and interrupt status read seems to be broken for
 		 * some chips. Since data ready is the only interrupt, bypass interrupt
 		wom_bits = 0;
 		int_status = INV_MPU6050_BIT_RAW_DATA_RDY_INT;
 		goto data_ready_interrupt;
+	case INV_MPU9150:
+		/* IRQ needs to be acked */
+		wom_bits = 0;
+		break;
 	case INV_MPU6500:
 	case INV_MPU6515:
 	case INV_MPU6880:

drivers/iio/industrialio-buffer.c+4−2

 	written = 0;
 	add_wait_queue(&rb->pollq, &wait);
 	do {
-		if (!indio_dev->info)
+		if (!indio_dev->info) {
-			return -ENODEV;
+			ret = -ENODEV;
+			break;
+		}
 		if (!iio_buffer_space_available(rb)) {
 			if (signal_pending(current)) {

drivers/iio/light/bh1780.c+1−1

 		case IIO_LIGHT:
 			pm_runtime_get_sync(&bh1780->client->dev);
 			value = bh1780_read_word(bh1780, BH1780_REG_DLOW);
+			pm_runtime_put_autosuspend(&bh1780->client->dev);
 			if (value < 0)
 				return value;
-			pm_runtime_put_autosuspend(&bh1780->client->dev);
 			*val = value;
 			return IIO_VAL_INT;

drivers/iio/magnetometer/Kconfig+1−2

 	tristate "MEMSIC MMC5633 3-axis magnetic sensor"
 	select REGMAP_I2C
 	select REGMAP_I3C if I3C
-	depends on I2C
+	depends on I3C_OR_I2C
-	depends on I3C || !I3C
 	help
 	  Say yes here to build support for the MEMSIC MMC5633 3-axis
 	  magnetic sensor.

drivers/iio/magnetometer/tlv493d.c+1−1

@@ -171,7 +171,7 @@ static s16 tlv493d_get_channel_data(u8 *b, enum tlv493d_channels ch) · 170 unmodified lines
171	switch (ch) {	171	switch (ch) {
172	case TLV493D_AXIS_X:	172	case TLV493D_AXIS_X:
173	val = FIELD_GET(TLV493D_BX_MAG_X_AXIS_MSB, b[TLV493D_RD_REG_BX]) << 4 \|	173	val = FIELD_GET(TLV493D_BX_MAG_X_AXIS_MSB, b[TLV493D_RD_REG_BX]) << 4 \|
174	FIELD_GET(TLV493D_BX2_MAG_X_AXIS_LSB, b[TLV493D_RD_REG_BX2]) >> 4;	174	FIELD_GET(TLV493D_BX2_MAG_X_AXIS_LSB, b[TLV493D_RD_REG_BX2]);
175	break;	175	break;
176	case TLV493D_AXIS_Y:	176	case TLV493D_AXIS_Y:
177	val = FIELD_GET(TLV493D_BY_MAG_Y_AXIS_MSB, b[TLV493D_RD_REG_BY]) << 4 \|	177	val = FIELD_GET(TLV493D_BY_MAG_Y_AXIS_MSB, b[TLV493D_RD_REG_BY]) << 4 \|

drivers/iio/potentiometer/mcp4131.c+1−1

@@ -221,7 +221,7 @@ static int mcp4131_write_raw(struct iio_dev *indio_dev, · 220 unmodified lines
221		221
222	mutex_lock(&data->lock);	222	mutex_lock(&data->lock);
223		223
224	data->buf[0] = address << MCP4131_WIPER_SHIFT;	224	data->buf[0] = address;
225	data->buf[0] \|= MCP4131_WRITE \| (val >> 8);	225	data->buf[0] \|= MCP4131_WRITE \| (val >> 8);
226	data->buf[1] = val & 0xFF; /* 8 bits here */	226	data->buf[1] = val & 0xFF; /* 8 bits here */
227		227

drivers/iio/proximity/hx9023s.c+4−2

 	struct device *dev = regmap_get_device(data->regmap);
 	unsigned int i, period_ms;
+	if (!val && !val2)
+		return -EINVAL;
 	period_ms = div_u64(NANO, (val * MEGA + val2));
 	for (i = 0; i < ARRAY_SIZE(hx9023s_samp_freq_table); i++) {
 	if (!bin)
 		return -ENOMEM;
-	memcpy(bin->data, fw->data, fw->size);
 	bin->fw_size = fw->size;
+	memcpy(bin->data, fw->data, bin->fw_size);
 	bin->fw_ver = bin->data[FW_VER_OFFSET];
 	bin->reg_count = get_unaligned_le16(bin->data + FW_REG_CNT_OFFSET);

drivers/irqchip/irq-riscv-aplic-main.c+17−4

@@ -116,6 +116,16 @@ static struct syscore aplic_syscore = { · 115 unmodified lines
116	.ops = &aplic_syscore_ops,	116	.ops = &aplic_syscore_ops,
117	};	117	};
118		118
		119	static bool aplic_syscore_registered __ro_after_init;
		120
		121	static void aplic_syscore_init(void)
		122	{
		123	if (!aplic_syscore_registered) {
		124	register_syscore(&aplic_syscore);
		125	aplic_syscore_registered = true;
		126	}
		127	}
		128
119	static int aplic_pm_notifier(struct notifier_block nb, unsigned long action, void data)	129	static int aplic_pm_notifier(struct notifier_block nb, unsigned long action, void data)
120	{	130	{
121	struct aplic_priv *priv = container_of(nb, struct aplic_priv, genpd_nb);	131	struct aplic_priv *priv = container_of(nb, struct aplic_priv, genpd_nb);
@@ -372,18 +382,21 @@ static int aplic_probe(struct platform_device *pdev) · 250 unmodified lines
372	rc = aplic_msi_setup(dev, regs);	382	rc = aplic_msi_setup(dev, regs);
373	else	383	else
374	rc = aplic_direct_setup(dev, regs);	384	rc = aplic_direct_setup(dev, regs);
375	if (rc)	385
		386	if (rc) {
376	dev_err_probe(dev, rc, "failed to setup APLIC in %s mode\n",	387	dev_err_probe(dev, rc, "failed to setup APLIC in %s mode\n",
377	msi_mode ? "MSI" : "direct");	388	msi_mode ? "MSI" : "direct");
378	else	389	return rc;
379	register_syscore(&aplic_syscore);	390	}
		391
		392	aplic_syscore_init();
380		393
381	#ifdef CONFIG_ACPI	394	#ifdef CONFIG_ACPI
382	if (!acpi_disabled)	395	if (!acpi_disabled)
383	acpi_dev_clear_dependencies(ACPI_COMPANION(dev));	396	acpi_dev_clear_dependencies(ACPI_COMPANION(dev));
384	#endif	397	#endif
385		398
386	return rc;	399	return 0;
387	}	400	}
388		401
389	static const struct of_device_id aplic_match[] = {	402	static const struct of_device_id aplic_match[] = {

drivers/misc/amd-sbi/Kconfig+1−2

 # SPDX-License-Identifier: GPL-2.0-only
 config AMD_SBRMI_I2C
 	tristate "AMD side band RMI support"
-	depends on I2C
+	depends on I3C_OR_I2C
 	depends on ARM || ARM64 || COMPILE_TEST
 	select REGMAP_I2C
-	depends on I3C || !I3C
 	select REGMAP_I3C if I3C
 	help
 	  Side band RMI over I2C/I3C support for AMD out of band management.

drivers/net/bonding/bond_debugfs.c+11−5

 	for (; hash_index != RLB_NULL_INDEX;
 	     hash_index = client_info->used_next) {
 		client_info = &(bond_info->rx_hashtbl[hash_index]);
-		seq_printf(m, "%-15pI4 %-15pI4 %-17pM %s\n",
+		if (client_info->slave)
-			&client_info->ip_src,
+			seq_printf(m, "%-15pI4 %-15pI4 %-17pM %s\n",
-			&client_info->ip_dst,
+				   &client_info->ip_src,
-			&client_info->mac_dst,
+				   &client_info->ip_dst,
-			client_info->slave->dev->name);
+				   &client_info->mac_dst,
+				   client_info->slave->dev->name);
+		else
+			seq_printf(m, "%-15pI4 %-15pI4 %-17pM (none)\n",
+				   &client_info->ip_src,
+				   &client_info->ip_dst,
+				   &client_info->mac_dst);
 	}
 	spin_unlock_bh(&bond->mode_lock);

drivers/net/bonding/bond_main.c+5−3

 	return ret;
 }
-static int bond_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+static int bond_header_parse(const struct sk_buff *skb,
+			     const struct net_device *dev,
+			     unsigned char *haddr)
 {
-	struct bonding *bond = netdev_priv(skb->dev);
+	struct bonding *bond = netdev_priv(dev);
 	const struct header_ops *slave_ops;
 	struct slave *slave;
 	int ret = 0;
 	if (slave) {
 		slave_ops = READ_ONCE(slave->dev->header_ops);
 		if (slave_ops && slave_ops->parse)
-			ret = slave_ops->parse(skb, haddr);
+			ret = slave_ops->parse(skb, slave->dev, haddr);
 	}
 	rcu_read_unlock();
 	return ret;

drivers/net/dsa/bcm_sf2.c+6−2

@@ -980,15 +980,19 @@ static int bcm_sf2_sw_resume(struct dsa_switch *ds) · 979 unmodified lines
980	ret = bcm_sf2_sw_rst(priv);	980	ret = bcm_sf2_sw_rst(priv);
981	if (ret) {	981	if (ret) {
982	pr_err("%s: failed to software reset switch\n", __func__);	982	pr_err("%s: failed to software reset switch\n", __func__);
		983	if (!priv->wol_ports_mask)
		984	clk_disable_unprepare(priv->clk);
983	return ret;	985	return ret;
984	}	986	}
985		987
986	bcm_sf2_crossbar_setup(priv);	988	bcm_sf2_crossbar_setup(priv);
987		989
988	ret = bcm_sf2_cfp_resume(ds);	990	ret = bcm_sf2_cfp_resume(ds);
989	if (ret)	991	if (ret) {
		992	if (!priv->wol_ports_mask)
		993	clk_disable_unprepare(priv->clk);
990	return ret;	994	return ret;
991		995	}
992	if (priv->hw_params.num_gphy == 1)	996	if (priv->hw_params.num_gphy == 1)
993	bcm_sf2_gphy_enable_set(ds, true);	997	bcm_sf2_gphy_enable_set(ds, true);
994		998

drivers/net/ethernet/airoha/airoha_eth.c+0−1

@@ -3093,7 +3093,6 @@ static void airoha_remove(struct platform_device *pdev) · 3092 unmodified lines
3093	if (!port)	3093	if (!port)
3094	continue;	3094	continue;
3095		3095
3096	airoha_dev_stop(port->dev);
3097	unregister_netdev(port->dev);	3096	unregister_netdev(port->dev);
3098	airoha_metadata_dst_free(port);	3097	airoha_metadata_dst_free(port);
3099	}	3098	}

drivers/net/ethernet/broadcom/bnxt/bnxt.c+2−0

@@ -2929,6 +2929,8 @@ static int bnxt_async_event_process(struct bnxt *bp, · 2928 unmodified lines
2929	u16 type = (u16)BNXT_EVENT_BUF_PRODUCER_TYPE(data1);	2929	u16 type = (u16)BNXT_EVENT_BUF_PRODUCER_TYPE(data1);
2930	u32 offset = BNXT_EVENT_BUF_PRODUCER_OFFSET(data2);	2930	u32 offset = BNXT_EVENT_BUF_PRODUCER_OFFSET(data2);
2931		2931
		2932	if (type >= ARRAY_SIZE(bp->bs_trace))
		2933	goto async_event_process_exit;
2932	bnxt_bs_trace_check_wrap(&bp->bs_trace[type], offset);	2934	bnxt_bs_trace_check_wrap(&bp->bs_trace[type], offset);
2933	goto async_event_process_exit;	2935	goto async_event_process_exit;
2934	}	2936	}

drivers/net/ethernet/broadcom/bnxt/bnxt.h+1−1

@@ -2146,7 +2146,7 @@ enum board_idx { · 2145 unmodified lines
2146	};	2146	};
2147		2147
2148	#define BNXT_TRACE_BUF_MAGIC_BYTE ((u8)0xbc)	2148	#define BNXT_TRACE_BUF_MAGIC_BYTE ((u8)0xbc)
2149	#define BNXT_TRACE_MAX 11	2149	#define BNXT_TRACE_MAX (DBG_LOG_BUFFER_FLUSH_REQ_TYPE_ERR_QPC_TRACE + 1)
2150		2150
2151	struct bnxt_bs_trace_info {	2151	struct bnxt_bs_trace_info {
2152	u8 *magic_byte;	2152	u8 *magic_byte;

drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c+1−1

@@ -123,7 +123,7 @@ static int bcmgenet_poll_wol_status(struct bcmgenet_priv *priv) · 122 unmodified lines
123	while (!(bcmgenet_rbuf_readl(priv, RBUF_STATUS)	123	while (!(bcmgenet_rbuf_readl(priv, RBUF_STATUS)
124	& RBUF_STATUS_WOL)) {	124	& RBUF_STATUS_WOL)) {
125	retries++;	125	retries++;
126	if (retries > 5) {	126	if (retries > 50) {
127	netdev_crit(dev, "polling wol mode timeout\n");	127	netdev_crit(dev, "polling wol mode timeout\n");
128	return -ETIMEDOUT;	128	return -ETIMEDOUT;
129	}	129	}

drivers/net/ethernet/broadcom/tg3.c+11−0

 	return err;
 }
+static int tg3_is_default_mac_address(u8 *addr)
+{
+	static const u8 default_mac_address[ETH_ALEN] = { 0x00, 0x10, 0x18, 0x00, 0x00, 0x00 };
+	return ether_addr_equal(default_mac_address, addr);
+}
 static int tg3_get_device_address(struct tg3 *tp, u8 *addr)
 {
 	u32 hi, lo, mac_offset;
 	if (!is_valid_ether_addr(addr))
 		return -EINVAL;
+	if (tg3_is_default_mac_address(addr))
+		return device_get_mac_address(&tp->pdev->dev, addr);
 	return 0;
 }

drivers/net/ethernet/cadence/macb_main.c+22−4

 	desc->ctrl = 0;
 }
+static void gem_init_rx_ring(struct macb_queue *queue)
+{
+	queue->rx_tail = 0;
+	queue->rx_prepared_head = 0;
+	gem_rx_refill(queue);
+}
 static void gem_init_rings(struct macb *bp)
 {
 	struct macb_queue *queue;
 		queue->tx_head = 0;
 		queue->tx_tail = 0;
-		queue->rx_tail = 0;
+		gem_init_rx_ring(queue);
-		queue->rx_prepared_head = 0;
-		gem_rx_refill(queue);
 	}
 	macb_init_tieoff(bp);
 	struct macb *bp = netdev_priv(netdev);
 	int ret;
+	if (!(netdev->hw_features & NETIF_F_NTUPLE))
+		return -EOPNOTSUPP;
 	switch (cmd->cmd) {
 	case ETHTOOL_SRXCLSRLINS:
 		if ((cmd->fs.location >= bp->max_tuples)
 		rtnl_unlock();
 	}
+	if (!(bp->caps & MACB_CAPS_MACB_IS_EMAC))
+		macb_init_buffers(bp);
 	for (q = 0, queue = bp->queues; q < bp->num_queues;
 	     ++q, ++queue) {
+		if (!(bp->caps & MACB_CAPS_MACB_IS_EMAC)) {
+			if (macb_is_gem(bp))
+				gem_init_rx_ring(queue);
+			else
+				macb_init_rx_ring(queue);
+		}
 		napi_enable(&queue->napi_rx);
 		napi_enable(&queue->napi_tx);
 	}

drivers/net/ethernet/cadence/macb_ptp.c+3−1

@@ -357,8 +357,10 @@ void gem_ptp_remove(struct net_device *ndev) · 356 unmodified lines
357	{	357	{
358	struct macb *bp = netdev_priv(ndev);	358	struct macb *bp = netdev_priv(ndev);
359		359
360	if (bp->ptp_clock)	360	if (bp->ptp_clock) {
361	ptp_clock_unregister(bp->ptp_clock);	361	ptp_clock_unregister(bp->ptp_clock);
		362	bp->ptp_clock = NULL;
		363	}
362		364
363	gem_ptp_clear_timer(bp);	365	gem_ptp_clear_timer(bp);
364		366

drivers/net/ethernet/intel/iavf/iavf_main.c+6−3

 		adapter->num_vlan_filters++;
 		iavf_schedule_aq_request(adapter, IAVF_FLAG_AQ_ADD_VLAN_FILTER);
 	} else if (f->state == IAVF_VLAN_REMOVE) {
-		/* IAVF_VLAN_REMOVE means that VLAN wasn't yet removed.
+		/* Re-add the filter since we cannot tell whether the
-		 * We can safely only change the state here.
+		 * pending delete has already been processed by the PF.
+		 * A duplicate add is harmless.
 		 */
-		f->state = IAVF_VLAN_ACTIVE;
+		f->state = IAVF_VLAN_ADD;
+		iavf_schedule_aq_request(adapter,
+					 IAVF_FLAG_AQ_ADD_VLAN_FILTER);
 	}
 clearout:

drivers/net/ethernet/intel/igc/igc.h+2−0

@@ -781,6 +781,8 @@ int igc_ptp_hwtstamp_set(struct net_device *netdev, · 780 unmodified lines
781	struct kernel_hwtstamp_config *config,	781	struct kernel_hwtstamp_config *config,
782	struct netlink_ext_ack *extack);	782	struct netlink_ext_ack *extack);
783	void igc_ptp_tx_hang(struct igc_adapter *adapter);	783	void igc_ptp_tx_hang(struct igc_adapter *adapter);
		784	void igc_ptp_clear_xsk_tx_tstamp_queue(struct igc_adapter *adapter,
		785	u16 queue_id);
784	void igc_ptp_read(struct igc_adapter adapter, struct timespec64 ts);	786	void igc_ptp_read(struct igc_adapter adapter, struct timespec64 ts);
785	void igc_ptp_tx_tstamp_event(struct igc_adapter *adapter);	787	void igc_ptp_tx_tstamp_event(struct igc_adapter *adapter);
786		788

drivers/net/ethernet/intel/igc/igc_main.c+9−5

 	/* reset next_to_use and next_to_clean */
 	tx_ring->next_to_use = 0;
 	tx_ring->next_to_clean = 0;
+	/* Clear any lingering XSK TX timestamp requests */
+	if (test_bit(IGC_RING_FLAG_TX_HWTSTAMP, &tx_ring->flags)) {
+		struct igc_adapter *adapter = netdev_priv(tx_ring->netdev);
+		igc_ptp_clear_xsk_tx_tstamp_queue(adapter, tx_ring->queue_index);
+	}
 }
 /**
 	/* The minimum packet size with TCTL.PSP set is 17 so pad the skb
 	 * in order to meet this minimum size requirement.
 	 */
-	if (skb->len < 17) {
+	if (skb_put_padto(skb, 17))
-		if (skb_padto(skb, 17))
+		return NETDEV_TX_OK;
-			return NETDEV_TX_OK;
-		skb->len = 17;
-	}
 	return igc_xmit_frame_ring(skb, igc_tx_queue_mapping(adapter, skb));
 }

drivers/net/ethernet/intel/igc/igc_ptp.c+33−0

@@ -577,6 +577,39 @@ static void igc_ptp_clear_tx_tstamp(struct igc_adapter *adapter) · 576 unmodified lines
577	spin_unlock_irqrestore(&adapter->ptp_tx_lock, flags);	577	spin_unlock_irqrestore(&adapter->ptp_tx_lock, flags);
578	}	578	}
579		579
		580	/**
		581	* igc_ptp_clear_xsk_tx_tstamp_queue - Clear pending XSK TX timestamps for a queue
		582	* @adapter: Board private structure
		583	* @queue_id: TX queue index to clear timestamps for
		584	*
		585	* Iterates over all TX timestamp registers and releases any pending
		586	* timestamp requests associated with the given TX queue. This is
		587	* called when an XDP pool is being disabled to ensure no stale
		588	* timestamp references remain.
		589	*/
		590	void igc_ptp_clear_xsk_tx_tstamp_queue(struct igc_adapter *adapter, u16 queue_id)
		591	{
		592	unsigned long flags;
		593	int i;
		594
		595	spin_lock_irqsave(&adapter->ptp_tx_lock, flags);
		596
		597	for (i = 0; i < IGC_MAX_TX_TSTAMP_REGS; i++) {
		598	struct igc_tx_timestamp_request *tstamp = &adapter->tx_tstamp[i];
		599
		600	if (tstamp->buffer_type != IGC_TX_BUFFER_TYPE_XSK)
		601	continue;
		602	if (tstamp->xsk_queue_index != queue_id)
		603	continue;
		604	if (!tstamp->xsk_tx_buffer)
		605	continue;
		606
		607	igc_ptp_free_tx_buffer(adapter, tstamp);
		608	}
		609
		610	spin_unlock_irqrestore(&adapter->ptp_tx_lock, flags);
		611	}
		612
580	static void igc_ptp_disable_tx_timestamp(struct igc_adapter *adapter)	613	static void igc_ptp_disable_tx_timestamp(struct igc_adapter *adapter)
581	{	614	{
582	struct igc_hw *hw = &adapter->hw;	615	struct igc_hw *hw = &adapter->hw;

drivers/net/ethernet/intel/libie/fwlog.c+36−13

 	module = libie_find_module_by_dentry(fwlog->debugfs_modules, dentry);
 	if (module < 0) {
 		dev_info(dev, "unknown module\n");
-		return -EINVAL;
+		count = -EINVAL;
+		goto free_cmd_buf;
 	}
 	cnt = sscanf(cmd_buf, "%s", user_val);
-	if (cnt != 1)
+	if (cnt != 1) {
-		return -EINVAL;
+		count = -EINVAL;
+		goto free_cmd_buf;
+	}
 	log_level = sysfs_match_string(libie_fwlog_level_string, user_val);
 	if (log_level < 0) {
 		dev_info(dev, "unknown log level '%s'\n", user_val);
-		return -EINVAL;
+		count = -EINVAL;
+		goto free_cmd_buf;
 	}
 	if (module != LIBIE_AQC_FW_LOG_ID_MAX) {
 			fwlog->cfg.module_entries[i].log_level = log_level;
 	}
+free_cmd_buf:
+	kfree(cmd_buf);
 	return count;
 }
 		return PTR_ERR(cmd_buf);
 	ret = sscanf(cmd_buf, "%s", user_val);
-	if (ret != 1)
+	if (ret != 1) {
-		return -EINVAL;
+		count = -EINVAL;
+		goto free_cmd_buf;
+	}
 	ret = kstrtos16(user_val, 0, &nr_messages);
-	if (ret)
+	if (ret) {
-		return ret;
+		count = ret;
+		goto free_cmd_buf;
+	}
 	if (nr_messages < LIBIE_AQC_FW_LOG_MIN_RESOLUTION ||
 	    nr_messages > LIBIE_AQC_FW_LOG_MAX_RESOLUTION) {
 		dev_err(dev, "Invalid FW log number of messages %d, value must be between %d - %d\n",
 			nr_messages, LIBIE_AQC_FW_LOG_MIN_RESOLUTION,
 			LIBIE_AQC_FW_LOG_MAX_RESOLUTION);
-		return -EINVAL;
+		count = -EINVAL;
+		goto free_cmd_buf;
 	}
 	fwlog->cfg.log_resolution = nr_messages;
+free_cmd_buf:
+	kfree(cmd_buf);
 	return count;
 }
 		return PTR_ERR(cmd_buf);
 	ret = sscanf(cmd_buf, "%s", user_val);
-	if (ret != 1)
+	if (ret != 1) {
-		return -EINVAL;
+		ret = -EINVAL;
+		goto free_cmd_buf;
+	}
 	ret = kstrtobool(user_val, &enable);
 	if (ret)
 	 */
 	if (WARN_ON(ret != (ssize_t)count && ret >= 0))
 		ret = -EIO;
+free_cmd_buf:
+	kfree(cmd_buf);
 	return ret;
 }
 		return PTR_ERR(cmd_buf);
 	ret = sscanf(cmd_buf, "%s", user_val);
-	if (ret != 1)
+	if (ret != 1) {
-		return -EINVAL;
+		ret = -EINVAL;
+		goto free_cmd_buf;
+	}
 	index = sysfs_match_string(libie_fwlog_log_size, user_val);
 	if (index < 0) {
 	 */
 	if (WARN_ON(ret != (ssize_t)count && ret >= 0))
 		ret = -EIO;
+free_cmd_buf:
+	kfree(cmd_buf);
 	return ret;
 }

drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c+2−2

@@ -5016,7 +5016,7 @@ static int mvpp2_bm_switch_buffers(struct mvpp2 *priv, bool percpu) · 5015 unmodified lines
5016	if (priv->percpu_pools)	5016	if (priv->percpu_pools)
5017	numbufs = port->nrxqs * 2;	5017	numbufs = port->nrxqs * 2;
5018		5018
5019	if (change_percpu)	5019	if (change_percpu && priv->global_tx_fc)
5020	mvpp2_bm_pool_update_priv_fc(priv, false);	5020	mvpp2_bm_pool_update_priv_fc(priv, false);
5021		5021
5022	for (i = 0; i < numbufs; i++)	5022	for (i = 0; i < numbufs; i++)
@@ -5041,7 +5041,7 @@ static int mvpp2_bm_switch_buffers(struct mvpp2 *priv, bool percpu) · 18 unmodified lines
5041	mvpp2_open(port->dev);	5041	mvpp2_open(port->dev);
5042	}	5042	}
5043		5043
5044	if (change_percpu)	5044	if (change_percpu && priv->global_tx_fc)
5045	mvpp2_bm_pool_update_priv_fc(priv, true);	5045	mvpp2_bm_pool_update_priv_fc(priv, true);
5046		5046
5047	return 0;	5047	return 0;

drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h+1−0

@@ -287,6 +287,7 @@ struct mlx5e_ipsec_sa_entry { · 286 unmodified lines
287	struct mlx5e_ipsec_dwork *dwork;	287	struct mlx5e_ipsec_dwork *dwork;
288	struct mlx5e_ipsec_limits limits;	288	struct mlx5e_ipsec_limits limits;
289	u32 rx_mapped_id;	289	u32 rx_mapped_id;
		290	u8 ctx[MLX5_ST_SZ_BYTES(ipsec_aso)];
290	};	291	};
291		292
292	struct mlx5_accel_pol_xfrm_attrs {	293	struct mlx5_accel_pol_xfrm_attrs {

drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c+22−28

 	mlx5e_ipsec_aso_query(sa_entry, data);
 }
-static void mlx5e_ipsec_update_esn_state(struct mlx5e_ipsec_sa_entry *sa_entry,
+static void
-					 u32 mode_param)
+mlx5e_ipsec_update_esn_state(struct mlx5e_ipsec_sa_entry *sa_entry,
+			     u32 mode_param,
+			     struct mlx5_accel_esp_xfrm_attrs *attrs)
 {
-	struct mlx5_accel_esp_xfrm_attrs attrs = {};
 	struct mlx5_wqe_aso_ctrl_seg data = {};
 	if (mode_param < MLX5E_IPSEC_ESN_SCOPE_MID) {
 		sa_entry->esn_state.overlap = 1;
 	}
-	mlx5e_ipsec_build_accel_xfrm_attrs(sa_entry, &attrs);
+	mlx5e_ipsec_build_accel_xfrm_attrs(sa_entry, attrs);
-	/* It is safe to execute the modify below unlocked since the only flows
-	 * that could affect this HW object, are create, destroy and this work.
-	 *
-	 * Creation flow can't co-exist with this modify work, the destruction
-	 * flow would cancel this work, and this work is a single entity that
-	 * can't conflict with it self.
-	 */
-	spin_unlock_bh(&sa_entry->x->lock);
-	mlx5_accel_esp_modify_xfrm(sa_entry, &attrs);
-	spin_lock_bh(&sa_entry->x->lock);
 	data.data_offset_condition_operand =
 		MLX5_IPSEC_ASO_REMOVE_FLOW_PKT_CNT_OFFSET;
 static void mlx5e_ipsec_handle_limits(struct mlx5e_ipsec_sa_entry *sa_entry)
 {
 	struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs;
-	struct mlx5e_ipsec *ipsec = sa_entry->ipsec;
-	struct mlx5e_ipsec_aso *aso = ipsec->aso;
 	bool soft_arm, hard_arm;
 	u64 hard_cnt;
 	lockdep_assert_held(&sa_entry->x->lock);
-	soft_arm = !MLX5_GET(ipsec_aso, aso->ctx, soft_lft_arm);
+	soft_arm = !MLX5_GET(ipsec_aso, sa_entry->ctx, soft_lft_arm);
-	hard_arm = !MLX5_GET(ipsec_aso, aso->ctx, hard_lft_arm);
+	hard_arm = !MLX5_GET(ipsec_aso, sa_entry->ctx, hard_lft_arm);
 	if (!soft_arm && !hard_arm)
 		/* It is not lifetime event */
 		return;
-	hard_cnt = MLX5_GET(ipsec_aso, aso->ctx, remove_flow_pkt_cnt);
+	hard_cnt = MLX5_GET(ipsec_aso, sa_entry->ctx, remove_flow_pkt_cnt);
 	if (!hard_cnt || hard_arm) {
 		/* It is possible to see packet counter equal to zero without
 		 * hard limit event armed. Such situation can be if packet
 	struct mlx5e_ipsec_work *work =
 		container_of(_work, struct mlx5e_ipsec_work, work);
 	struct mlx5e_ipsec_sa_entry *sa_entry = work->data;
+	struct mlx5_accel_esp_xfrm_attrs tmp = {};
 	struct mlx5_accel_esp_xfrm_attrs *attrs;
-	struct mlx5e_ipsec_aso *aso;
+	bool need_modify = false;
 	int ret;
-	aso = sa_entry->ipsec->aso;
 	attrs = &sa_entry->attrs;
 	spin_lock_bh(&sa_entry->x->lock);
 	if (ret)
 		goto unlock;
+	if (attrs->lft.soft_packet_limit != XFRM_INF)
+		mlx5e_ipsec_handle_limits(sa_entry);
 	if (attrs->replay_esn.trigger &&
-	    !MLX5_GET(ipsec_aso, aso->ctx, esn_event_arm)) {
+	    !MLX5_GET(ipsec_aso, sa_entry->ctx, esn_event_arm)) {
-		u32 mode_param = MLX5_GET(ipsec_aso, aso->ctx, mode_parameter);
+		u32 mode_param = MLX5_GET(ipsec_aso, sa_entry->ctx,
+					  mode_parameter);
-		mlx5e_ipsec_update_esn_state(sa_entry, mode_param);
+		mlx5e_ipsec_update_esn_state(sa_entry, mode_param, &tmp);
+		need_modify = true;
 	}
-	if (attrs->lft.soft_packet_limit != XFRM_INF)
-		mlx5e_ipsec_handle_limits(sa_entry);
 unlock:
 	spin_unlock_bh(&sa_entry->x->lock);
+	if (need_modify)
+		mlx5_accel_esp_modify_xfrm(sa_entry, &tmp);
 	kfree(work);
 }
 			/* We are in atomic context */
 			udelay(10);
 	} while (ret && time_is_after_jiffies(expires));
+	if (!ret)
+		memcpy(sa_entry->ctx, aso->ctx, MLX5_ST_SZ_BYTES(ipsec_aso));
 	spin_unlock_bh(&aso->lock);
 	return ret;
 }

drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c+9−14

 	return err;
 }
-static u32 mlx5_esw_qos_lag_link_speed_get_locked(struct mlx5_core_dev *mdev)
+static u32 mlx5_esw_qos_lag_link_speed_get(struct mlx5_core_dev *mdev,
+					   bool take_rtnl)
 {
 	struct ethtool_link_ksettings lksettings;
 	struct net_device *slave, *master;
 	u32 speed = SPEED_UNKNOWN;
-	/* Lock ensures a stable reference to master and slave netdevice
-	 * while port speed of master is queried.
-	 */
-	ASSERT_RTNL();
 	slave = mlx5_uplink_netdev_get(mdev);
 	if (!slave)
 		goto out;
+	if (take_rtnl)
+		rtnl_lock();
 	master = netdev_master_upper_dev_get(slave);
 	if (master && !__ethtool_get_link_ksettings(master, &lksettings))
 		speed = lksettings.base.speed;
+	if (take_rtnl)
+		rtnl_unlock();
 out:
 	mlx5_uplink_netdev_put(mdev, slave);
 }
 static int mlx5_esw_qos_max_link_speed_get(struct mlx5_core_dev *mdev, u32 *link_speed_max,
-					   bool hold_rtnl_lock, struct netlink_ext_ack *extack)
+					   bool take_rtnl,
+					   struct netlink_ext_ack *extack)
 {
 	int err;
 	if (!mlx5_lag_is_active(mdev))
 		goto skip_lag;
-	if (hold_rtnl_lock)
+	*link_speed_max = mlx5_esw_qos_lag_link_speed_get(mdev, take_rtnl);
-		rtnl_lock();
-	*link_speed_max = mlx5_esw_qos_lag_link_speed_get_locked(mdev);
-	if (hold_rtnl_lock)
-		rtnl_unlock();
 	if (*link_speed_max != (u32)SPEED_UNKNOWN)
 		return 0;

drivers/net/ethernet/microsoft/mana/hw_channel.c+3−3

 		gc->max_num_cqs = 0;
 	}
-	kfree(hwc->caller_ctx);
-	hwc->caller_ctx = NULL;
 	if (hwc->txq)
 		mana_hwc_destroy_wq(hwc, hwc->txq);
 	if (hwc->cq)
 		mana_hwc_destroy_cq(hwc->gdma_dev->gdma_context, hwc->cq);
+	kfree(hwc->caller_ctx);
+	hwc->caller_ctx = NULL;
 	mana_gd_free_res_map(&hwc->inflight_msg_res);
 	hwc->num_inflight_msg = 0;

drivers/net/ethernet/ti/icssg/icssg_common.c+5−0

 		xdp_prepare_buff(&xdp, pa, PRUETH_HEADROOM, pkt_len, false);
 		*xdp_state = emac_run_xdp(emac, &xdp, &pkt_len);
+		if (*xdp_state == ICSSG_XDP_CONSUMED) {
+			page_pool_recycle_direct(pool, page);
+			goto requeue;
+		}
 		if (*xdp_state != ICSSG_XDP_PASS)
 			goto requeue;
 		headroom = xdp.data - xdp.data_hard_start;

drivers/net/netdevsim/netdev.c+4−1

 	int ret;
 	ret = __dev_forward_skb(rx_dev, skb);
-	if (ret)
+	if (ret) {
+		if (psp_ext)
+			__skb_ext_put(psp_ext);
 		return ret;
+	}
 	nsim_psp_handle_ext(skb, psp_ext);

drivers/net/usb/aqc111.c+6−6

@@ -1395,14 +1395,14 @@ static int aqc111_suspend(struct usb_interface *intf, pm_message_t message) · 1394 unmodified lines
1395	aqc111_write16_cmd_nopm(dev, AQ_ACCESS_MAC,	1395	aqc111_write16_cmd_nopm(dev, AQ_ACCESS_MAC,
1396	SFR_MEDIUM_STATUS_MODE, 2, &reg16);	1396	SFR_MEDIUM_STATUS_MODE, 2, &reg16);
1397		1397
1398	aqc111_write_cmd(dev, AQ_WOL_CFG, 0, 0,	1398	aqc111_write_cmd_nopm(dev, AQ_WOL_CFG, 0, 0,
1399	WOL_CFG_SIZE, &wol_cfg);	1399	WOL_CFG_SIZE, &wol_cfg);
1400	aqc111_write32_cmd(dev, AQ_PHY_OPS, 0, 0,	1400	aqc111_write32_cmd_nopm(dev, AQ_PHY_OPS, 0, 0,
1401	&aqc111_data->phy_cfg);	1401	&aqc111_data->phy_cfg);
1402	} else {	1402	} else {
1403	aqc111_data->phy_cfg \|= AQ_LOW_POWER;	1403	aqc111_data->phy_cfg \|= AQ_LOW_POWER;
1404	aqc111_write32_cmd(dev, AQ_PHY_OPS, 0, 0,	1404	aqc111_write32_cmd_nopm(dev, AQ_PHY_OPS, 0, 0,
1405	&aqc111_data->phy_cfg);	1405	&aqc111_data->phy_cfg);
1406		1406
1407	/* Disable RX path */	1407	/* Disable RX path */
1408	aqc111_read16_cmd_nopm(dev, AQ_ACCESS_MAC,	1408	aqc111_read16_cmd_nopm(dev, AQ_ACCESS_MAC,

drivers/net/usb/cdc_ncm.c+6−4

 	struct usbnet *dev = netdev_priv(skb_in->dev);
 	struct usb_cdc_ncm_ndp16 *ndp16;
 	int ret = -EINVAL;
+	size_t ndp_len;
 	if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) > skb_in->len) {
 		netif_dbg(dev, rx_err, dev->net, "invalid NDP offset  <%u>\n",
 					sizeof(struct usb_cdc_ncm_dpe16));
 	ret--; /* we process NDP entries except for the last one */
-	if ((sizeof(struct usb_cdc_ncm_ndp16) +
+	ndp_len = struct_size_t(struct usb_cdc_ncm_ndp16, dpe16, ret);
-	     ret * (sizeof(struct usb_cdc_ncm_dpe16))) > skb_in->len) {
+	if (ndpoffset + ndp_len > skb_in->len) {
 		netif_dbg(dev, rx_err, dev->net, "Invalid nframes = %d\n", ret);
 		ret = -EINVAL;
 	}
 	struct usbnet *dev = netdev_priv(skb_in->dev);
 	struct usb_cdc_ncm_ndp32 *ndp32;
 	int ret = -EINVAL;
+	size_t ndp_len;
 	if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp32)) > skb_in->len) {
 		netif_dbg(dev, rx_err, dev->net, "invalid NDP offset  <%u>\n",
 					sizeof(struct usb_cdc_ncm_dpe32));
 	ret--; /* we process NDP entries except for the last one */
-	if ((sizeof(struct usb_cdc_ncm_ndp32) +
+	ndp_len = struct_size_t(struct usb_cdc_ncm_ndp32, dpe32, ret);
-	     ret * (sizeof(struct usb_cdc_ncm_dpe32))) > skb_in->len) {
+	if (ndpoffset + ndp_len > skb_in->len) {
 		netif_dbg(dev, rx_err, dev->net, "Invalid nframes = %d\n", ret);
 		ret = -EINVAL;
 	}

drivers/net/wireless/ath/ath9k/channel.c+2−4

 	skb_set_queue_mapping(skb, IEEE80211_AC_VO);
 	if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, NULL))
-		goto error;
+		return;
 	txctl.txq = sc->tx.txq_map[IEEE80211_AC_VO];
 	if (ath_tx_start(sc->hw, skb, &txctl))
 		skb->priority = 7;
 		skb_set_queue_mapping(skb, IEEE80211_AC_VO);
-		if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, &sta)) {
+		if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, &sta))
-			dev_kfree_skb_any(skb);
 			return false;
-		}
 		break;
 	default:
 		return false;

drivers/net/wireless/mediatek/mt76/scan.c+1−3

@@ -63,10 +63,8 @@ mt76_scan_send_probe(struct mt76_dev dev, struct cfg80211_ssid ssid) · 62 unmodified lines
63		63
64	rcu_read_lock();	64	rcu_read_lock();
65		65
66	if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL)) {	66	if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL))
67	ieee80211_free_txskb(phy->hw, skb);
68	goto out;	67	goto out;
69	}
70		68
71	info = IEEE80211_SKB_CB(skb);	69	info = IEEE80211_SKB_CB(skb);
72	if (req->no_cck)	70	if (req->no_cck)

drivers/net/wireless/ti/wlcore/tx.c+1−1

@@ -210,7 +210,7 @@ static int wl1271_tx_allocate(struct wl1271 wl, struct wl12xx_vif wlvif, · 209 unmodified lines
210	if (skb_headroom(skb) < (total_len - skb->len) &&	210	if (skb_headroom(skb) < (total_len - skb->len) &&
211	pskb_expand_head(skb, (total_len - skb->len), 0, GFP_ATOMIC)) {	211	pskb_expand_head(skb, (total_len - skb->len), 0, GFP_ATOMIC)) {
212	wl1271_free_tx_id(wl, id);	212	wl1271_free_tx_id(wl, id);
213	return -EAGAIN;	213	return -ENOMEM;
214	}	214	}
215	desc = skb_push(skb, total_len - skb->len);	215	desc = skb_push(skb, total_len - skb->len);
216		216

drivers/net/wireless/virtual/mac80211_hwsim.c+1−2

 						      hwsim->tmp_chan->band,
 						      NULL)) {
 				rcu_read_unlock();
-				kfree_skb(probe);
 				continue;
 			}
 	if (info->attrs[HWSIM_ATTR_PMSR_SUPPORT]) {
 		struct cfg80211_pmsr_capabilities *pmsr_capa;
-		pmsr_capa = kmalloc_obj(*pmsr_capa);
+		pmsr_capa = kzalloc_obj(*pmsr_capa);
 		if (!pmsr_capa) {
 			ret = -ENOMEM;
 			goto out_free;

drivers/nfc/nxp-nci/i2c.c+2−2

@@ -47,8 +47,8 @@ static int nxp_nci_i2c_set_mode(void *phy_id, · 46 unmodified lines
47	{	47	{
48	struct nxp_nci_i2c_phy phy = (struct nxp_nci_i2c_phy ) phy_id;	48	struct nxp_nci_i2c_phy phy = (struct nxp_nci_i2c_phy ) phy_id;
49		49
50	gpiod_set_value(phy->gpiod_fw, (mode == NXP_NCI_MODE_FW) ? 1 : 0);	50	gpiod_set_value_cansleep(phy->gpiod_fw, (mode == NXP_NCI_MODE_FW) ? 1 : 0);
51	gpiod_set_value(phy->gpiod_en, (mode != NXP_NCI_MODE_COLD) ? 1 : 0);	51	gpiod_set_value_cansleep(phy->gpiod_en, (mode != NXP_NCI_MODE_COLD) ? 1 : 0);
52	usleep_range(10000, 15000);	52	usleep_range(10000, 15000);
53		53
54	if (mode == NXP_NCI_MODE_COLD)	54	if (mode == NXP_NCI_MODE_COLD)

drivers/nvdimm/bus.c+3−2

 static void nd_async_device_register(void *d, async_cookie_t cookie)
 {
 	struct device *dev = d;
+	struct device *parent = dev->parent;
 	if (device_add(dev) != 0) {
 		dev_err(dev, "%s: failed\n", __func__);
 		put_device(dev);
 	}
 	put_device(dev);
-	if (dev->parent)
+	if (parent)
-		put_device(dev->parent);
+		put_device(parent);
 }
 static void nd_async_device_unregister(void *d, async_cookie_t cookie)

drivers/nvme/host/core.c+1−2

 int nvme_alloc_admin_tag_set(struct nvme_ctrl *ctrl, struct blk_mq_tag_set *set,
 		const struct blk_mq_ops *ops, unsigned int cmd_size)
 {
-	struct queue_limits lim = {};
 	int ret;
 	memset(set, 0, sizeof(*set));
 	if (ctrl->admin_q)
 		blk_put_queue(ctrl->admin_q);
-	ctrl->admin_q = blk_mq_alloc_queue(set, &lim, NULL);
+	ctrl->admin_q = blk_mq_alloc_queue(set, NULL, NULL);
 	if (IS_ERR(ctrl->admin_q)) {
 		ret = PTR_ERR(ctrl->admin_q);
 		goto out_free_tagset;

drivers/nvme/host/pci.c+5−3

 		/* Free memory and continue on */
 		nvme_dbbuf_dma_free(dev);
-		for (i = 1; i <= dev->online_queues; i++)
+		for (i = 1; i < dev->online_queues; i++)
 			nvme_dbbuf_free(&dev->queues[i]);
 	}
 }
 static void nvme_poll_irqdisable(struct nvme_queue *nvmeq)
 {
 	struct pci_dev *pdev = to_pci_dev(nvmeq->dev->dev);
+	int irq;
 	WARN_ON_ONCE(test_bit(NVMEQ_POLLED, &nvmeq->flags));
-	disable_irq(pci_irq_vector(pdev, nvmeq->cq_vector));
+	irq = pci_irq_vector(pdev, nvmeq->cq_vector);
+	disable_irq(irq);
 	spin_lock(&nvmeq->cq_poll_lock);
 	nvme_poll_cq(nvmeq, NULL);
 	spin_unlock(&nvmeq->cq_poll_lock);
-	enable_irq(pci_irq_vector(pdev, nvmeq->cq_vector));
+	enable_irq(irq);
 }
 static int nvme_poll(struct blk_mq_hw_ctx *hctx, struct io_comp_batch *iob)

drivers/nvme/target/admin-cmd.c+1−1

@@ -1585,7 +1585,7 @@ void nvmet_execute_async_event(struct nvmet_req *req) · 1584 unmodified lines
1585	ctrl->async_event_cmds[ctrl->nr_async_event_cmds++] = req;	1585	ctrl->async_event_cmds[ctrl->nr_async_event_cmds++] = req;
1586	mutex_unlock(&ctrl->lock);	1586	mutex_unlock(&ctrl->lock);
1587		1587
1588	queue_work(nvmet_wq, &ctrl->async_event_work);	1588	queue_work(nvmet_aen_wq, &ctrl->async_event_work);
1589	}	1589	}
1590		1590
1591	void nvmet_execute_keep_alive(struct nvmet_req *req)	1591	void nvmet_execute_keep_alive(struct nvmet_req *req)

drivers/nvme/target/core.c+12−2

 struct workqueue_struct *nvmet_wq;
 EXPORT_SYMBOL_GPL(nvmet_wq);
+struct workqueue_struct *nvmet_aen_wq;
+EXPORT_SYMBOL_GPL(nvmet_aen_wq);
 /*
  * This read/write semaphore is used to synchronize access to configuration
 	list_add_tail(&aen->entry, &ctrl->async_events);
 	mutex_unlock(&ctrl->lock);
-	queue_work(nvmet_wq, &ctrl->async_event_work);
+	queue_work(nvmet_aen_wq, &ctrl->async_event_work);
 }
 static void nvmet_add_to_changed_ns_log(struct nvmet_ctrl *ctrl, __le32 nsid)
 	if (!nvmet_wq)
 		goto out_free_buffered_work_queue;
+	nvmet_aen_wq = alloc_workqueue("nvmet-aen-wq",
+			WQ_MEM_RECLAIM | WQ_UNBOUND, 0);
+	if (!nvmet_aen_wq)
+		goto out_free_nvmet_work_queue;
 	error = nvmet_init_debugfs();
 	if (error)
-		goto out_free_nvmet_work_queue;
+		goto out_free_nvmet_aen_work_queue;
 	error = nvmet_init_discovery();
 	if (error)
 	nvmet_exit_discovery();
 out_exit_debugfs:
 	nvmet_exit_debugfs();
+out_free_nvmet_aen_work_queue:
+	destroy_workqueue(nvmet_aen_wq);
 out_free_nvmet_work_queue:
 	destroy_workqueue(nvmet_wq);
 out_free_buffered_work_queue:
 	nvmet_exit_discovery();
 	nvmet_exit_debugfs();
 	ida_destroy(&cntlid_ida);
+	destroy_workqueue(nvmet_aen_wq);
 	destroy_workqueue(nvmet_wq);
 	destroy_workqueue(buffered_io_wq);
 	destroy_workqueue(zbd_wq);

drivers/nvme/target/nvmet.h+1−0

@@ -501,6 +501,7 @@ extern struct kmem_cache *nvmet_bvec_cache; · 500 unmodified lines
501	extern struct workqueue_struct *buffered_io_wq;	501	extern struct workqueue_struct *buffered_io_wq;
502	extern struct workqueue_struct *zbd_wq;	502	extern struct workqueue_struct *zbd_wq;
503	extern struct workqueue_struct *nvmet_wq;	503	extern struct workqueue_struct *nvmet_wq;
		504	extern struct workqueue_struct *nvmet_aen_wq;
504		505
505	static inline void nvmet_set_result(struct nvmet_req *req, u32 result)	506	static inline void nvmet_set_result(struct nvmet_req *req, u32 result)
506	{	507	{

drivers/nvme/target/rdma.c+1−0

@@ -2087,6 +2087,7 @@ static void nvmet_rdma_remove_one(struct ib_device ib_device, void client_data · 2086 unmodified lines
2087	mutex_unlock(&nvmet_rdma_queue_mutex);	2087	mutex_unlock(&nvmet_rdma_queue_mutex);
2088		2088
2089	flush_workqueue(nvmet_wq);	2089	flush_workqueue(nvmet_wq);
		2090	flush_workqueue(nvmet_aen_wq);
2090	}	2091	}
2091		2092
2092	static struct ib_client nvmet_rdma_ib_client = {	2093	static struct ib_client nvmet_rdma_ib_client = {

drivers/power/sequencing/pwrseq-pcie-m2.c+1−1

@@ -109,7 +109,7 @@ static int pwrseq_pcie_m2_probe(struct platform_device *pdev) · 108 unmodified lines
109	if (!ctx)	109	if (!ctx)
110	return -ENOMEM;	110	return -ENOMEM;
111		111
112	ctx->of_node = of_node_get(dev->of_node);	112	ctx->of_node = dev_of_node(dev);
113	ctx->pdata = device_get_match_data(dev);	113	ctx->pdata = device_get_match_data(dev);
114	if (!ctx->pdata)	114	if (!ctx->pdata)
115	return dev_err_probe(dev, -ENODEV,	115	return dev_err_probe(dev, -ENODEV,

drivers/regulator/pca9450-regulator.c+10−4

 	struct regulator_dev *ldo5;
 	struct pca9450 *pca9450;
 	unsigned int device_id, i;
+	const char *type_name;
 	int ret;
 	pca9450 = devm_kzalloc(&i2c->dev, sizeof(struct pca9450), GFP_KERNEL);
 	case PCA9450_TYPE_PCA9450A:
 		regulator_desc = pca9450a_regulators;
 		pca9450->rcnt = ARRAY_SIZE(pca9450a_regulators);
+		type_name = "pca9450a";
 		break;
 	case PCA9450_TYPE_PCA9450BC:
 		regulator_desc = pca9450bc_regulators;
 		pca9450->rcnt = ARRAY_SIZE(pca9450bc_regulators);
+		type_name = "pca9450bc";
 		break;
 	case PCA9450_TYPE_PCA9451A:
+		regulator_desc = pca9451a_regulators;
+		pca9450->rcnt = ARRAY_SIZE(pca9451a_regulators);
+		type_name = "pca9451a";
+		break;
 	case PCA9450_TYPE_PCA9452:
 		regulator_desc = pca9451a_regulators;
 		pca9450->rcnt = ARRAY_SIZE(pca9451a_regulators);
+		type_name = "pca9452";
 		break;
 	default:
 		dev_err(&i2c->dev, "Unknown device type");
 	if (pca9450->irq) {
 		ret = devm_request_threaded_irq(pca9450->dev, pca9450->irq, NULL,
 						pca9450_irq_handler,
-						(IRQF_TRIGGER_FALLING | IRQF_ONESHOT),
+						(IRQF_TRIGGER_LOW | IRQF_ONESHOT),
 						"pca9450-irq", pca9450);
 		if (ret != 0)
 			return dev_err_probe(pca9450->dev, ret, "Failed to request IRQ: %d\n",
 					  pca9450_i2c_restart_handler, pca9450))
 		dev_warn(&i2c->dev, "Failed to register restart handler\n");
-	dev_info(&i2c->dev, "%s probed.\n",
+	dev_info(&i2c->dev, "%s probed.\n", type_name);
-		type == PCA9450_TYPE_PCA9450A ? "pca9450a" :
-		(type == PCA9450_TYPE_PCA9451A ? "pca9451a" : "pca9450bc"));
 	return 0;
 }

drivers/reset/reset-rzg2l-usbphy-ctrl.c+3−0

@@ -136,6 +136,9 @@ static int rzg2l_usbphy_ctrl_set_pwrrdy(struct regmap_field *pwrrdy, · 135 unmodified lines
136	{	136	{
137	u32 val = power_on ? 0 : 1;	137	u32 val = power_on ? 0 : 1;
138		138
		139	if (!pwrrdy)
		140	return 0;
		141
139	/* The initialization path guarantees that the mask is 1 bit long. */	142	/* The initialization path guarantees that the mask is 1 bit long. */
140	return regmap_field_update_bits(pwrrdy, 1, val);	143	return regmap_field_update_bits(pwrrdy, 1, val);
141	}	144	}

drivers/s390/block/dasd_eckd.c+16−0

 static int dasd_eckd_copy_pair_swap(struct dasd_device *device, char *prim_busid,
 				    char *sec_busid)
 {
+	struct dasd_eckd_private *prim_priv, *sec_priv;
 	struct dasd_device *primary, *secondary;
 	struct dasd_copy_relation *copy;
 	struct dasd_block *block;
 	if (!secondary)
 		return DASD_COPYPAIRSWAP_SECONDARY;
+	prim_priv = primary->private;
+	sec_priv = secondary->private;
 	/*
 	 * usually the device should be quiesced for swap
 	 * for paranoia stop device and requeue requests again
 			dev_name(&secondary->cdev->dev), rc);
 	}
+	if (primary->stopped & DASD_STOPPED_QUIESCE) {
+		dasd_device_set_stop_bits(secondary, DASD_STOPPED_QUIESCE);
+		dasd_device_remove_stop_bits(primary, DASD_STOPPED_QUIESCE);
+	}
+	/*
+	 * The secondary device never got through format detection, but since it
+	 * is a copy of the primary device, the format is exactly the same;
+	 * therefore, the detected layout can simply be copied.
+	 */
+	sec_priv->uses_cdl = prim_priv->uses_cdl;
 	/* re-enable device */
 	dasd_device_remove_stop_bits(primary, DASD_STOPPED_PPRC);
 	dasd_device_remove_stop_bits(secondary, DASD_STOPPED_PPRC);

drivers/s390/crypto/zcrypt_ccamisc.c+7−5

@@ -1639,11 +1639,13 @@ int cca_get_info(u16 cardnr, u16 domain, struct cca_info *ci, u32 xflags) · 1638 unmodified lines
1639		1639
1640	memset(ci, 0, sizeof(*ci));	1640	memset(ci, 0, sizeof(*ci));
1641		1641
1642	/* get first info from zcrypt device driver about this apqn */	1642	/* if specific domain given, fetch status and hw info for this apqn */
1643	rc = zcrypt_device_status_ext(cardnr, domain, &devstat);	1643	if (domain != AUTOSEL_DOM) {
1644	if (rc)	1644	rc = zcrypt_device_status_ext(cardnr, domain, &devstat);
1645	return rc;	1645	if (rc)
1646	ci->hwtype = devstat.hwtype;	1646	return rc;
		1647	ci->hwtype = devstat.hwtype;
		1648	}
1647		1649
1648	/*	1650	/*
1649	* Prep memory for rule array and var array use.	1651	* Prep memory for rule array and var array use.

drivers/s390/crypto/zcrypt_cex4.c+1−2

@@ -85,8 +85,7 @@ static ssize_t cca_serialnr_show(struct device *dev, · 84 unmodified lines
85		85
86	memset(&ci, 0, sizeof(ci));	86	memset(&ci, 0, sizeof(ci));
87		87
88	if (ap_domain_index >= 0)	88	cca_get_info(ac->id, AUTOSEL_DOM, &ci, 0);
89	cca_get_info(ac->id, ap_domain_index, &ci, 0);
90		89
91	return sysfs_emit(buf, "%s\n", ci.serial);	90	return sysfs_emit(buf, "%s\n", ci.serial);
92	}	91	}

drivers/scsi/hisi_sas/hisi_sas_main.c+1−1

@@ -2578,7 +2578,7 @@ int hisi_sas_probe(struct platform_device *pdev, · 2577 unmodified lines
2578	shost->transportt = hisi_sas_stt;	2578	shost->transportt = hisi_sas_stt;
2579	shost->max_id = HISI_SAS_MAX_DEVICES;	2579	shost->max_id = HISI_SAS_MAX_DEVICES;
2580	shost->max_lun = ~0;	2580	shost->max_lun = ~0;
2581	shost->max_channel = 1;	2581	shost->max_channel = 0;
2582	shost->max_cmd_len = HISI_SAS_MAX_CDB_LEN;	2582	shost->max_cmd_len = HISI_SAS_MAX_CDB_LEN;
2583	if (hisi_hba->hw->slot_index_alloc) {	2583	if (hisi_hba->hw->slot_index_alloc) {
2584	shost->can_queue = HISI_SAS_MAX_COMMANDS;	2584	shost->can_queue = HISI_SAS_MAX_COMMANDS;

drivers/scsi/hisi_sas/hisi_sas_v3_hw.c+1−1

@@ -4993,7 +4993,7 @@ hisi_sas_v3_probe(struct pci_dev pdev, const struct pci_device_id id) · 4992 unmodified lines
4993	shost->transportt = hisi_sas_stt;	4993	shost->transportt = hisi_sas_stt;
4994	shost->max_id = HISI_SAS_MAX_DEVICES;	4994	shost->max_id = HISI_SAS_MAX_DEVICES;
4995	shost->max_lun = ~0;	4995	shost->max_lun = ~0;
4996	shost->max_channel = 1;	4996	shost->max_channel = 0;
4997	shost->max_cmd_len = HISI_SAS_MAX_CDB_LEN;	4997	shost->max_cmd_len = HISI_SAS_MAX_CDB_LEN;
4998	shost->can_queue = HISI_SAS_UNRESERVED_IPTT;	4998	shost->can_queue = HISI_SAS_UNRESERVED_IPTT;
4999	shost->cmd_per_lun = HISI_SAS_UNRESERVED_IPTT;	4999	shost->cmd_per_lun = HISI_SAS_UNRESERVED_IPTT;

drivers/scsi/qla2xxx/qla_iocb.c+0−2

 	if (!elsio->u.els_logo.els_logo_pyld) {
 		/* ref: INIT */
 		kref_put(&sp->cmd_kref, qla2x00_sp_release);
-		qla2x00_free_fcport(fcport);
 		return QLA_FUNCTION_FAILED;
 	}
 	if (rval != QLA_SUCCESS) {
 		/* ref: INIT */
 		kref_put(&sp->cmd_kref, qla2x00_sp_release);
-		qla2x00_free_fcport(fcport);
 		return QLA_FUNCTION_FAILED;
 	}

drivers/scsi/scsi_scan.c+2−6

 	 * default device queue depth to figure out sbitmap shift
 	 * since we use this queue depth most of times.
 	 */
-	if (scsi_realloc_sdev_budget_map(sdev, depth)) {
+	if (scsi_realloc_sdev_budget_map(sdev, depth))
-		kref_put(&sdev->host->tagset_refcnt, scsi_mq_free_tags);
+		goto out_device_destroy;
-		put_device(&starget->dev);
-		kfree(sdev);
-		goto out;
-	}
 	scsi_change_queue_depth(sdev, depth);

drivers/soc/fsl/qbman/qman.c+22−2

@@ -1827,6 +1827,8 @@ EXPORT_SYMBOL(qman_create_fq); · 1826 unmodified lines
1827		1827
1828	void qman_destroy_fq(struct qman_fq *fq)	1828	void qman_destroy_fq(struct qman_fq *fq)
1829	{	1829	{
		1830	int leaked;
		1831
1830	/*	1832	/*
1831	* We don't need to lock the FQ as it is a pre-condition that the FQ be	1833	* We don't need to lock the FQ as it is a pre-condition that the FQ be
1832	* quiesced. Instead, run some checks.	1834	* quiesced. Instead, run some checks.
@@ -1834,11 +1836,29 @@ void qman_destroy_fq(struct qman_fq *fq) · 1 unmodified line
1834	switch (fq->state) {	1836	switch (fq->state) {
1835	case qman_fq_state_parked:	1837	case qman_fq_state_parked:
1836	case qman_fq_state_oos:	1838	case qman_fq_state_oos:
1837	if (fq_isset(fq, QMAN_FQ_FLAG_DYNAMIC_FQID))	1839	/*
1838	qman_release_fqid(fq->fqid);	1840	* There's a race condition here on releasing the fqid,
		1841	* setting the fq_table to NULL, and freeing the fqid.
		1842	* To prevent it, this order should be respected:
		1843	*/
		1844	if (fq_isset(fq, QMAN_FQ_FLAG_DYNAMIC_FQID)) {
		1845	leaked = qman_shutdown_fq(fq->fqid);
		1846	if (leaked)
		1847	pr_debug("FQID %d leaked\n", fq->fqid);
		1848	}
1839		1849
1840	DPAA_ASSERT(fq_table[fq->idx]);	1850	DPAA_ASSERT(fq_table[fq->idx]);
1841	fq_table[fq->idx] = NULL;	1851	fq_table[fq->idx] = NULL;
		1852
		1853	if (fq_isset(fq, QMAN_FQ_FLAG_DYNAMIC_FQID) && !leaked) {
		1854	/*
		1855	* fq_table[fq->idx] should be set to null before
		1856	* freeing fq->fqid otherwise it could by allocated by
		1857	* qman_alloc_fqid() while still being !NULL
		1858	*/
		1859	smp_wmb();
		1860	gen_pool_free(qm_fqalloc, fq->fqid \| DPAA_GENALLOC_OFF, 1);
		1861	}
1842	return;	1862	return;
1843	default:	1863	default:
1844	break;	1864	break;

drivers/soc/fsl/qe/qmc.c+2−2

@@ -1790,8 +1790,8 @@ static int qmc_qe_init_resources(struct qmc qmc, struct platform_device pdev) · 1789 unmodified lines
1790	return -EINVAL;	1790	return -EINVAL;
1791	qmc->dpram_offset = res->start - qe_muram_dma(qe_muram_addr(0));	1791	qmc->dpram_offset = res->start - qe_muram_dma(qe_muram_addr(0));
1792	qmc->dpram = devm_ioremap_resource(qmc->dev, res);	1792	qmc->dpram = devm_ioremap_resource(qmc->dev, res);
1793	if (IS_ERR(qmc->scc_pram))	1793	if (IS_ERR(qmc->dpram))
1794	return PTR_ERR(qmc->scc_pram);	1794	return PTR_ERR(qmc->dpram);
1795		1795
1796	return 0;	1796	return 0;
1797	}	1797	}

drivers/soc/microchip/mpfs-sys-controller.c+9−4

 	sys_controller->flash = of_get_mtd_device_by_node(np);
 	of_node_put(np);
-	if (IS_ERR(sys_controller->flash))
+	if (IS_ERR(sys_controller->flash)) {
-		return dev_err_probe(dev, PTR_ERR(sys_controller->flash), "Failed to get flash\n");
+		ret = dev_err_probe(dev, PTR_ERR(sys_controller->flash), "Failed to get flash\n");
+		goto out_free;
+	}
 no_flash:
 	sys_controller->client.dev = dev;
 	if (IS_ERR(sys_controller->chan)) {
 		ret = dev_err_probe(dev, PTR_ERR(sys_controller->chan),
 				    "Failed to get mbox channel\n");
-		kfree(sys_controller);
+		goto out_free;
-		return ret;
 	}
 	init_completion(&sys_controller->c);
 	dev_info(&pdev->dev, "Registered MPFS system controller\n");
 	return 0;
+out_free:
+	kfree(sys_controller);
+	return ret;
 }
 static void mpfs_sys_controller_remove(struct platform_device *pdev)

drivers/soc/rockchip/grf.c+1−0

@@ -231,6 +231,7 @@ static int __init rockchip_grf_init(void) · 230 unmodified lines
231	grf = syscon_node_to_regmap(np);	231	grf = syscon_node_to_regmap(np);
232	if (IS_ERR(grf)) {	232	if (IS_ERR(grf)) {
233	pr_err("%s: could not get grf syscon\n", __func__);	233	pr_err("%s: could not get grf syscon\n", __func__);
		234	of_node_put(np);
234	return PTR_ERR(grf);	235	return PTR_ERR(grf);
235	}	236	}
236		237

drivers/spi/spi-amlogic-spifc-a4.c+2−3

 	ret = dma_mapping_error(sfc->dev, sfc->daddr);
 	if (ret) {
 		dev_err(sfc->dev, "DMA mapping error\n");
-		goto out_map_data;
+		return ret;
 	}
 	cmd = CMD_DATA_ADDRL(sfc->daddr);
 		ret = dma_mapping_error(sfc->dev, sfc->iaddr);
 		if (ret) {
 			dev_err(sfc->dev, "DMA mapping error\n");
-			dma_unmap_single(sfc->dev, sfc->daddr, datalen, dir);
 			goto out_map_data;
 		}
 	return 0;
 out_map_info:
-	dma_unmap_single(sfc->dev, sfc->iaddr, datalen, dir);
+	dma_unmap_single(sfc->dev, sfc->iaddr, infolen, dir);
 out_map_data:
 	dma_unmap_single(sfc->dev, sfc->daddr, datalen, dir);

drivers/spi/spi-atcspi200.c+16−22

 	if (op->addr.buswidth > 1)
 		tc |= TRANS_ADDR_FMT;
 	if (op->data.nbytes) {
-		tc |= TRANS_DUAL_QUAD(ffs(op->data.buswidth) - 1);
+		unsigned int width_code;
+		width_code = ffs(op->data.buswidth) - 1;
+		if (unlikely(width_code > 3)) {
+			WARN_ON_ONCE(1);
+			width_code = 0;
+		}
+		tc |= TRANS_DUAL_QUAD(width_code);
 		if (op->data.dir == SPI_MEM_DATA_IN) {
 			if (op->dummy.nbytes)
 				tc |= TRANS_MODE_DMY_READ |
 static int atcspi_configure_dma(struct atcspi_dev *spi)
 {
-	struct dma_chan *dma_chan;
+	spi->host->dma_rx = devm_dma_request_chan(spi->dev, "rx");
-	int ret = 0;
+	if (IS_ERR(spi->host->dma_rx))
+		return PTR_ERR(spi->host->dma_rx);
-	dma_chan = devm_dma_request_chan(spi->dev, "rx");
+	spi->host->dma_tx = devm_dma_request_chan(spi->dev, "tx");
-	if (IS_ERR(dma_chan)) {
+	if (IS_ERR(spi->host->dma_tx))
-		ret = PTR_ERR(dma_chan);
+		return PTR_ERR(spi->host->dma_tx);
-		goto err_exit;
-	}
-	spi->host->dma_rx = dma_chan;
-	dma_chan = devm_dma_request_chan(spi->dev, "tx");
-	if (IS_ERR(dma_chan)) {
-		ret = PTR_ERR(dma_chan);
-		goto free_rx;
-	}
-	spi->host->dma_tx = dma_chan;
 	init_completion(&spi->dma_completion);
-	return ret;
+	return 0;
-free_rx:
-	dma_release_channel(spi->host->dma_rx);
-	spi->host->dma_rx = NULL;
-err_exit:
-	return ret;
 }
 static int atcspi_enable_clk(struct atcspi_dev *spi)

drivers/spi/spi-cadence-quadspi.c+6−0

 	u8		cs;
 };
+static const struct clk_bulk_data cqspi_clks[CLK_QSPI_NUM] = {
+	[CLK_QSPI_APB] = { .id = "apb" },
+	[CLK_QSPI_AHB] = { .id = "ahb" },
+};
 struct cqspi_st {
 	struct platform_device	*pdev;
 	struct spi_controller	*host;
 	}
 	/* Obtain QSPI clocks. */
+	memcpy(&cqspi->clks, &cqspi_clks, sizeof(cqspi->clks));
 	ret = devm_clk_bulk_get_optional(dev, CLK_QSPI_NUM, cqspi->clks);
 	if (ret)
 		return dev_err_probe(dev, ret, "Failed to get clocks\n");

drivers/spi/spi-intel-pci.c+1−0

@@ -96,6 +96,7 @@ static const struct pci_device_id intel_spi_pci_ids[] = { · 95 unmodified lines
96	{ PCI_VDEVICE(INTEL, 0xa324), (unsigned long)&cnl_info },	96	{ PCI_VDEVICE(INTEL, 0xa324), (unsigned long)&cnl_info },
97	{ PCI_VDEVICE(INTEL, 0xa3a4), (unsigned long)&cnl_info },	97	{ PCI_VDEVICE(INTEL, 0xa3a4), (unsigned long)&cnl_info },
98	{ PCI_VDEVICE(INTEL, 0xa823), (unsigned long)&cnl_info },	98	{ PCI_VDEVICE(INTEL, 0xa823), (unsigned long)&cnl_info },
		99	{ PCI_VDEVICE(INTEL, 0xd323), (unsigned long)&cnl_info },
99	{ PCI_VDEVICE(INTEL, 0xe323), (unsigned long)&cnl_info },	100	{ PCI_VDEVICE(INTEL, 0xe323), (unsigned long)&cnl_info },
100	{ PCI_VDEVICE(INTEL, 0xe423), (unsigned long)&cnl_info },	101	{ PCI_VDEVICE(INTEL, 0xe423), (unsigned long)&cnl_info },
101	{ },	102	{ },

drivers/spi/spi-rockchip-sfc.c+1−1

@@ -711,7 +711,7 @@ static int rockchip_sfc_probe(struct platform_device *pdev) · 710 unmodified lines
711	}	711	}
712	}	712	}
713		713
714	ret = devm_spi_register_controller(dev, host);	714	ret = spi_register_controller(host);
715	if (ret)	715	if (ret)
716	goto err_register;	716	goto err_register;
717		717

drivers/staging/rtl8723bs/core/rtw_ieee80211.c+10−5

 	cnt = 0;
-	while (cnt < in_len) {
+	while (cnt + 2 <= in_len) {
+		u8 ie_len = in_ie[cnt + 1];
+		if (cnt + 2 + ie_len > in_len)
+			break;
 		if (eid == in_ie[cnt]
-			&& (!oui || !memcmp(&in_ie[cnt+2], oui, oui_len))) {
+			&& (!oui || (ie_len >= oui_len && !memcmp(&in_ie[cnt + 2], oui, oui_len)))) {
 			target_ie = &in_ie[cnt];
 			if (ie)
-				memcpy(ie, &in_ie[cnt], in_ie[cnt+1]+2);
+				memcpy(ie, &in_ie[cnt], ie_len + 2);
 			if (ielen)
-				*ielen = in_ie[cnt+1]+2;
+				*ielen = ie_len + 2;
 			break;
 		}
-		cnt += in_ie[cnt+1]+2; /* goto next */
+		cnt += ie_len + 2; /* goto next */
 	}
 	return target_ie;

drivers/staging/rtl8723bs/core/rtw_mlme.c+4−1

 	while (i < in_len) {
 		ielength = initial_out_len;
-		if (in_ie[i] == 0xDD && in_ie[i + 2] == 0x00 && in_ie[i + 3] == 0x50  && in_ie[i + 4] == 0xF2 && in_ie[i + 5] == 0x02 && i + 5 < in_len) { /* WMM element ID and OUI */
+		if (i + 5 < in_len &&
+		    in_ie[i] == 0xDD && in_ie[i + 2] == 0x00 &&
+		    in_ie[i + 3] == 0x50 && in_ie[i + 4] == 0xF2 &&
+		    in_ie[i + 5] == 0x02) {
 			for (j = i; j < i + 9; j++) {
 				out_ie[ielength] = in_ie[j];
 				ielength++;

drivers/staging/sm750fb/sm750.c+1−0

@@ -1123,6 +1123,7 @@ static void lynxfb_pci_remove(struct pci_dev *pdev) · 1122 unmodified lines
1123		1123
1124	iounmap(sm750_dev->pvReg);	1124	iounmap(sm750_dev->pvReg);
1125	iounmap(sm750_dev->pvMem);	1125	iounmap(sm750_dev->pvMem);
		1126	pci_release_region(pdev, 1);
1126	kfree(g_settings);	1127	kfree(g_settings);
1127	}	1128	}
1128		1129

drivers/staging/sm750fb/sm750_hw.c+11−11

@@ -36,16 +36,11 @@ int hw_sm750_map(struct sm750_dev sm750_dev, struct pci_dev pdev) · 35 unmodified lines
36		36
37	pr_info("mmio phyAddr = %lx\n", sm750_dev->vidreg_start);	37	pr_info("mmio phyAddr = %lx\n", sm750_dev->vidreg_start);
38		38
39	/*	39	/* reserve the vidreg space of smi adaptor */
40	* reserve the vidreg space of smi adaptor
41	* if you do this, you need to add release region code
42	* in lynxfb_remove, or memory will not be mapped again
43	* successfully
44	*/
45	ret = pci_request_region(pdev, 1, "sm750fb");	40	ret = pci_request_region(pdev, 1, "sm750fb");
46	if (ret) {	41	if (ret) {
47	pr_err("Can not request PCI regions.\n");	42	pr_err("Can not request PCI regions.\n");
48	goto exit;	43	return ret;
49	}	44	}
50		45
51	/* now map mmio and vidmem */	46	/* now map mmio and vidmem */
@@ -54,7 +49,7 @@ int hw_sm750_map(struct sm750_dev sm750_dev, struct pci_dev pdev) · 2 unmodified lines
54	if (!sm750_dev->pvReg) {	49	if (!sm750_dev->pvReg) {
55	pr_err("mmio failed\n");	50	pr_err("mmio failed\n");
56	ret = -EFAULT;	51	ret = -EFAULT;
57	goto exit;	52	goto err_release_region;
58	}	53	}
59	pr_info("mmio virtual addr = %p\n", sm750_dev->pvReg);	54	pr_info("mmio virtual addr = %p\n", sm750_dev->pvReg);
60		55
@@ -79,13 +74,18 @@ int hw_sm750_map(struct sm750_dev sm750_dev, struct pci_dev pdev) · 18 unmodified lines
79	sm750_dev->pvMem =	74	sm750_dev->pvMem =
80	ioremap_wc(sm750_dev->vidmem_start, sm750_dev->vidmem_size);	75	ioremap_wc(sm750_dev->vidmem_start, sm750_dev->vidmem_size);
81	if (!sm750_dev->pvMem) {	76	if (!sm750_dev->pvMem) {
82	iounmap(sm750_dev->pvReg);
83	pr_err("Map video memory failed\n");	77	pr_err("Map video memory failed\n");
84	ret = -EFAULT;	78	ret = -EFAULT;
85	goto exit;	79	goto err_unmap_reg;
86	}	80	}
87	pr_info("video memory vaddr = %p\n", sm750_dev->pvMem);	81	pr_info("video memory vaddr = %p\n", sm750_dev->pvMem);
88	exit:	82
		83	return 0;
		84
		85	err_unmap_reg:
		86	iounmap(sm750_dev->pvReg);
		87	err_release_region:
		88	pci_release_region(pdev, 1);
89	return ret;	89	return ret;
90	}	90	}
91		91

drivers/tee/tee_shm.c+0−27

@@ -23,29 +23,11 @@ struct tee_shm_dma_mem { · 22 unmodified lines
23	struct page *page;	23	struct page *page;
24	};	24	};
25		25
26	static void shm_put_kernel_pages(struct page **pages, size_t page_count)
27	{
28	size_t n;
29
30	for (n = 0; n < page_count; n++)
31	put_page(pages[n]);
32	}
33
34	static void shm_get_kernel_pages(struct page **pages, size_t page_count)
35	{
36	size_t n;
37
38	for (n = 0; n < page_count; n++)
39	get_page(pages[n]);
40	}
41
42	static void release_registered_pages(struct tee_shm *shm)	26	static void release_registered_pages(struct tee_shm *shm)
43	{	27	{
44	if (shm->pages) {	28	if (shm->pages) {
45	if (shm->flags & TEE_SHM_USER_MAPPED)	29	if (shm->flags & TEE_SHM_USER_MAPPED)
46	unpin_user_pages(shm->pages, shm->num_pages);	30	unpin_user_pages(shm->pages, shm->num_pages);
47	else
48	shm_put_kernel_pages(shm->pages, shm->num_pages);
49		31
50	kfree(shm->pages);	32	kfree(shm->pages);
51	}	33	}
@@ -477,13 +459,6 @@ register_shm_helper(struct tee_context ctx, struct iov_iter iter, u32 flags, · 425 unmodified lines
477	goto err_put_shm_pages;	459	goto err_put_shm_pages;
478	}	460	}
479		461
480	/*
481	* iov_iter_extract_kvec_pages does not get reference on the pages,
482	* get a reference on them.
483	*/
484	if (iov_iter_is_kvec(iter))
485	shm_get_kernel_pages(shm->pages, num_pages);
486
487	shm->offset = off;	462	shm->offset = off;
488	shm->size = len;	463	shm->size = len;
489	shm->num_pages = num_pages;	464	shm->num_pages = num_pages;
@@ -499,8 +474,6 @@ register_shm_helper(struct tee_context ctx, struct iov_iter iter, u32 flags, · 9 unmodified lines
499	err_put_shm_pages:	474	err_put_shm_pages:
500	if (!iov_iter_is_kvec(iter))	475	if (!iov_iter_is_kvec(iter))
501	unpin_user_pages(shm->pages, shm->num_pages);	476	unpin_user_pages(shm->pages, shm->num_pages);
502	else
503	shm_put_kernel_pages(shm->pages, shm->num_pages);
504	err_free_shm_pages:	477	err_free_shm_pages:
505	kfree(shm->pages);	478	kfree(shm->pages);
506	err_free_shm:	479	err_free_shm:

drivers/ufs/core/ufshcd.c+1−1

 	}
 	flush_work(&hba->eeh_work);
+	cancel_delayed_work_sync(&hba->ufs_rtc_update_work);
 	ret = ufshcd_vops_suspend(hba, pm_op, PRE_CHANGE);
 	if (ret)
 	if (ret)
 		goto set_link_active;
-	cancel_delayed_work_sync(&hba->ufs_rtc_update_work);
 	goto out;
 set_link_active:

drivers/usb/class/cdc-acm.c+5−0

 		acm->ctrl_caps = h.usb_cdc_acm_descriptor->bmCapabilities;
 	if (quirks & NO_CAP_LINE)
 		acm->ctrl_caps &= ~USB_CDC_CAP_LINE;
+	if (quirks & MISSING_CAP_BRK)
+		acm->ctrl_caps |= USB_CDC_CAP_BRK;
 	acm->ctrlsize = ctrlsize;
 	acm->readsize = readsize;
 	acm->rx_buflimit = num_rx_buf;
 	.driver_info = IGNORE_DEVICE,
 	},
+	/* CH343 supports CAP_BRK, but doesn't advertise it */
+	{ USB_DEVICE(0x1a86, 0x55d3), .driver_info = MISSING_CAP_BRK, },
 	/* control interfaces without any protocol set */
 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
 		USB_CDC_PROTO_NONE) },

drivers/usb/class/cdc-acm.h+1−0

@@ -113,3 +113,4 @@ struct acm { · 112 unmodified lines
113	#define CLEAR_HALT_CONDITIONS BIT(5)	113	#define CLEAR_HALT_CONDITIONS BIT(5)
114	#define SEND_ZERO_PACKET BIT(6)	114	#define SEND_ZERO_PACKET BIT(6)
115	#define DISABLE_ECHO BIT(7)	115	#define DISABLE_ECHO BIT(7)
		116	#define MISSING_CAP_BRK BIT(8)

drivers/usb/class/cdc-wdm.c+3−1

 		/* we may already be in overflow */
 		if (!test_bit(WDM_OVERFLOW, &desc->flags)) {
 			memmove(desc->ubuf + desc->length, desc->inbuf, length);
-			desc->length += length;
+			smp_wmb(); /* against wdm_read() */
+			WRITE_ONCE(desc->length, desc->length + length);
 		}
 	}
 skip_error:
 		return -ERESTARTSYS;
 	cntr = READ_ONCE(desc->length);
+	smp_rmb(); /* against wdm_in_callback() */
 	if (cntr == 0) {
 		desc->read = 0;
 retry:

drivers/usb/class/usbtmc.c+3−3

@@ -727,7 +727,7 @@ static int usbtmc488_ioctl_trigger(struct usbtmc_file_data *file_data) · 726 unmodified lines
727	buffer[1] = data->bTag;	727	buffer[1] = data->bTag;
728	buffer[2] = ~data->bTag;	728	buffer[2] = ~data->bTag;
729		729
730	retval = usb_bulk_msg(data->usb_dev,	730	retval = usb_bulk_msg_killable(data->usb_dev,
731	usb_sndbulkpipe(data->usb_dev,	731	usb_sndbulkpipe(data->usb_dev,
732	data->bulk_out),	732	data->bulk_out),
733	buffer, USBTMC_HEADER_SIZE,	733	buffer, USBTMC_HEADER_SIZE,
@@ -1347,7 +1347,7 @@ static int send_request_dev_dep_msg_in(struct usbtmc_file_data *file_data, · 613 unmodified lines
1347	buffer[11] = 0; /* Reserved */	1347	buffer[11] = 0; /* Reserved */
1348		1348
1349	/* Send bulk URB */	1349	/* Send bulk URB */
1350	retval = usb_bulk_msg(data->usb_dev,	1350	retval = usb_bulk_msg_killable(data->usb_dev,
1351	usb_sndbulkpipe(data->usb_dev,	1351	usb_sndbulkpipe(data->usb_dev,
1352	data->bulk_out),	1352	data->bulk_out),
1353	buffer, USBTMC_HEADER_SIZE,	1353	buffer, USBTMC_HEADER_SIZE,
@@ -1419,7 +1419,7 @@ static ssize_t usbtmc_read(struct file filp, char __user buf, · 65 unmodified lines
1419	actual = 0;	1419	actual = 0;
1420		1420
1421	/* Send bulk URB */	1421	/* Send bulk URB */
1422	retval = usb_bulk_msg(data->usb_dev,	1422	retval = usb_bulk_msg_killable(data->usb_dev,
1423	usb_rcvbulkpipe(data->usb_dev,	1423	usb_rcvbulkpipe(data->usb_dev,
1424	data->bulk_in),	1424	data->bulk_in),
1425	buffer, bufsize, &actual,	1425	buffer, bufsize, &actual,

drivers/usb/core/config.c+5−1

 		dev->descriptor.bNumConfigurations = ncfg = USB_MAXCONFIG;
 	}
-	if (ncfg < 1) {
+	if (ncfg < 1 && dev->quirks & USB_QUIRK_FORCE_ONE_CONFIG) {
+		dev_info(ddev, "Device claims zero configurations, forcing to 1\n");
+		dev->descriptor.bNumConfigurations = 1;
+		ncfg = 1;
+	} else if (ncfg < 1) {
 		dev_err(ddev, "no configurations\n");
 		return -EINVAL;
 	}

drivers/usb/core/message.c+79−21

 /*
- * Starts urb and waits for completion or timeout. Note that this call
+ * Starts urb and waits for completion or timeout.
- * is NOT interruptible. Many device driver i/o requests should be
+ * Whether or not the wait is killable depends on the flag passed in.
- * interruptible and therefore these drivers should implement their
+ * For example, compare usb_bulk_msg() and usb_bulk_msg_killable().
- * own interruptible routines.
+ *
+ * For non-killable waits, we enforce a maximum limit on the timeout value.
  */
-static int usb_start_wait_urb(struct urb *urb, int timeout, int *actual_length)
+static int usb_start_wait_urb(struct urb *urb, int timeout, int *actual_length,
+		bool killable)
 {
 	struct api_context ctx;
 	unsigned long expire;
 	int retval;
+	long rc;
 	init_completion(&ctx.done);
 	urb->context = &ctx;
 	if (unlikely(retval))
 		goto out;
-	expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT;
+	if (!killable && (timeout <= 0 || timeout > USB_MAX_SYNCHRONOUS_TIMEOUT))
-	if (!wait_for_completion_timeout(&ctx.done, expire)) {
+		timeout = USB_MAX_SYNCHRONOUS_TIMEOUT;
+	expire = (timeout > 0) ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT;
+	if (killable)
+		rc = wait_for_completion_killable_timeout(&ctx.done, expire);
+	else
+		rc = wait_for_completion_timeout(&ctx.done, expire);
+	if (rc <= 0) {
 		usb_kill_urb(urb);
-		retval = (ctx.status == -ENOENT ? -ETIMEDOUT : ctx.status);
+		if (ctx.status != -ENOENT)
+			retval = ctx.status;
+		else if (rc == 0)
+			retval = -ETIMEDOUT;
+		else
+			retval = rc;
 		dev_dbg(&urb->dev->dev,
-			"%s timed out on ep%d%s len=%u/%u\n",
+			"%s timed out or killed on ep%d%s len=%u/%u\n",
 			current->comm,
 			usb_endpoint_num(&urb->ep->desc),
 			usb_urb_dir_in(urb) ? "in" : "out",
 	usb_fill_control_urb(urb, usb_dev, pipe, (unsigned char *)cmd, data,
 			     len, usb_api_blocking_completion, NULL);
-	retv = usb_start_wait_urb(urb, timeout, &length);
+	retv = usb_start_wait_urb(urb, timeout, &length, false);
 	if (retv < 0)
 		return retv;
 	else
  * @index: USB message index value
  * @data: pointer to the data to send
  * @size: length in bytes of the data to send
- * @timeout: time in msecs to wait for the message to complete before timing
+ * @timeout: time in msecs to wait for the message to complete before timing out
- *	out (if 0 the wait is forever)
  *
  * Context: task context, might sleep.
  *
  * @index: USB message index value
  * @driver_data: pointer to the data to send
  * @size: length in bytes of the data to send
- * @timeout: time in msecs to wait for the message to complete before timing
+ * @timeout: time in msecs to wait for the message to complete before timing out
- *	out (if 0 the wait is forever)
  * @memflags: the flags for memory allocation for buffers
  *
  * Context: !in_interrupt ()
  * @index: USB message index value
  * @driver_data: pointer to the data to be filled in by the message
  * @size: length in bytes of the data to be received
- * @timeout: time in msecs to wait for the message to complete before timing
+ * @timeout: time in msecs to wait for the message to complete before timing out
- *	out (if 0 the wait is forever)
  * @memflags: the flags for memory allocation for buffers
  *
  * Context: !in_interrupt ()
  * @len: length in bytes of the data to send
  * @actual_length: pointer to a location to put the actual length transferred
  *	in bytes
- * @timeout: time in msecs to wait for the message to complete before
+ * @timeout: time in msecs to wait for the message to complete before timing out
- *	timing out (if 0 the wait is forever)
  *
  * Context: task context, might sleep.
  *
  * @len: length in bytes of the data to send
  * @actual_length: pointer to a location to put the actual length transferred
  *	in bytes
- * @timeout: time in msecs to wait for the message to complete before
+ * @timeout: time in msecs to wait for the message to complete before timing out
- *	timing out (if 0 the wait is forever)
  *
  * Context: task context, might sleep.
  *
 		usb_fill_bulk_urb(urb, usb_dev, pipe, data, len,
 				usb_api_blocking_completion, NULL);
-	return usb_start_wait_urb(urb, timeout, actual_length);
+	return usb_start_wait_urb(urb, timeout, actual_length, false);
 }
 EXPORT_SYMBOL_GPL(usb_bulk_msg);
+/**
+ * usb_bulk_msg_killable - Builds a bulk urb, sends it off and waits for completion in a killable state
+ * @usb_dev: pointer to the usb device to send the message to
+ * @pipe: endpoint "pipe" to send the message to
+ * @data: pointer to the data to send
+ * @len: length in bytes of the data to send
+ * @actual_length: pointer to a location to put the actual length transferred
+ *	in bytes
+ * @timeout: time in msecs to wait for the message to complete before
+ *	timing out (if <= 0, the wait is as long as possible)
+ *
+ * Context: task context, might sleep.
+ *
+ * This function is just like usb_blk_msg(), except that it waits in a
+ * killable state and there is no limit on the timeout length.
+ *
+ * Return:
+ * If successful, 0. Otherwise a negative error number. The number of actual
+ * bytes transferred will be stored in the @actual_length parameter.
+ *
+ */
+int usb_bulk_msg_killable(struct usb_device *usb_dev, unsigned int pipe,
+		 void *data, int len, int *actual_length, int timeout)
+{
+	struct urb *urb;
+	struct usb_host_endpoint *ep;
+	ep = usb_pipe_endpoint(usb_dev, pipe);
+	if (!ep || len < 0)
+		return -EINVAL;
+	urb = usb_alloc_urb(0, GFP_KERNEL);
+	if (!urb)
+		return -ENOMEM;
+	if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
+			USB_ENDPOINT_XFER_INT) {
+		pipe = (pipe & ~(3 << 30)) | (PIPE_INTERRUPT << 30);
+		usb_fill_int_urb(urb, usb_dev, pipe, data, len,
+				usb_api_blocking_completion, NULL,
+				ep->desc.bInterval);
+	} else
+		usb_fill_bulk_urb(urb, usb_dev, pipe, data, len,
+				usb_api_blocking_completion, NULL);
+	return usb_start_wait_urb(urb, timeout, actual_length, true);
+}
+EXPORT_SYMBOL_GPL(usb_bulk_msg_killable);
 /*-------------------------------------------------------------------*/
 static void sg_clean(struct usb_sg_request *io)

drivers/usb/core/phy.c+1−7

 	list_for_each_entry(roothub_entry, head, list) {
 		err = phy_set_mode(roothub_entry->phy, mode);
 		if (err)
-			goto err_out;
+			return err;
 	}
 	return 0;
-err_out:
-	list_for_each_entry_continue_reverse(roothub_entry, head, list)
-		phy_power_off(roothub_entry->phy);
-	return err;
 }
 EXPORT_SYMBOL_GPL(usb_phy_roothub_set_mode);

drivers/usb/core/quirks.c+21−0

 			case 'p':
 				flags |= USB_QUIRK_SHORT_SET_ADDRESS_REQ_TIMEOUT;
 				break;
+			case 'q':
+				flags |= USB_QUIRK_FORCE_ONE_CONFIG;
 			/* Ignore unrecognized flag characters */
 			}
 		}
 	/* HP v222w 16GB Mini USB Drive */
 	{ USB_DEVICE(0x03f0, 0x3f40), .driver_info = USB_QUIRK_DELAY_INIT },
+	/* Huawei 4G LTE module ME906S  */
+	{ USB_DEVICE(0x03f0, 0xa31d), .driver_info =
+			USB_QUIRK_DISCONNECT_SUSPEND },
 	/* Creative SB Audigy 2 NX */
 	{ USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
 	/* SanDisk Extreme 55AE */
 	{ USB_DEVICE(0x0781, 0x55ae), .driver_info = USB_QUIRK_NO_LPM },
+	/* Avermedia Live Gamer Ultra 2.1 (GC553G2) - BOS descriptor fetch hangs at SuperSpeed Plus */
+	{ USB_DEVICE(0x07ca, 0x2553), .driver_info = USB_QUIRK_NO_BOS },
 	/* Realforce 87U Keyboard */
 	{ USB_DEVICE(0x0853, 0x011b), .driver_info = USB_QUIRK_NO_LPM },
 	{ USB_DEVICE(0x0b05, 0x17e0), .driver_info =
 			USB_QUIRK_IGNORE_REMOTE_WAKEUP },
+	/* ASUS TUF 4K PRO - BOS descriptor fetch hangs at SuperSpeed Plus */
+	{ USB_DEVICE(0x0b05, 0x1ab9), .driver_info = USB_QUIRK_NO_BOS },
 	/* Realtek Semiconductor Corp. Mass Storage Device (Multicard Reader)*/
 	{ USB_DEVICE(0x0bda, 0x0151), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS },
 	{ USB_DEVICE(0x2386, 0x350e), .driver_info = USB_QUIRK_NO_LPM },
+	/* UGREEN 35871 - BOS descriptor fetch hangs at SuperSpeed Plus */
+	{ USB_DEVICE(0x2b89, 0x5871), .driver_info = USB_QUIRK_NO_BOS },
 	/* APTIV AUTOMOTIVE HUB */
 	{ USB_DEVICE(0x2c48, 0x0132), .driver_info =
 			USB_QUIRK_SHORT_SET_ADDRESS_REQ_TIMEOUT },
 	/* Alcor Link AK9563 SC Reader used in 2022 Lenovo ThinkPads */
 	{ USB_DEVICE(0x2ce3, 0x9563), .driver_info = USB_QUIRK_NO_LPM },
+	/* ezcap401 - BOS descriptor fetch hangs at SuperSpeed Plus */
+	{ USB_DEVICE(0x32ed, 0x0401), .driver_info = USB_QUIRK_NO_BOS },
 	/* DELL USB GEN2 */
 	{ USB_DEVICE(0x413c, 0xb062), .driver_info = USB_QUIRK_NO_LPM | USB_QUIRK_RESET_RESUME },
 	/* VCOM device */
 	{ USB_DEVICE(0x4296, 0x7570), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS },
+	/* Noji-MCS SmartCard Reader */
+	{ USB_DEVICE(0x5131, 0x2007), .driver_info = USB_QUIRK_FORCE_ONE_CONFIG },
 	/* INTEL VALUE SSD */
 	{ USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },

drivers/usb/dwc3/dwc3-pci.c+2−0

 #define PCI_DEVICE_ID_INTEL_CNPH		0xa36e
 #define PCI_DEVICE_ID_INTEL_CNPV		0xa3b0
 #define PCI_DEVICE_ID_INTEL_RPL			0xa70e
+#define PCI_DEVICE_ID_INTEL_NVLH		0xd37f
 #define PCI_DEVICE_ID_INTEL_PTLH		0xe332
 #define PCI_DEVICE_ID_INTEL_PTLH_PCH		0xe37e
 #define PCI_DEVICE_ID_INTEL_PTLU		0xe432
 	{ PCI_DEVICE_DATA(INTEL, CNPH, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, CNPV, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, RPL, &dwc3_pci_intel_swnode) },
+	{ PCI_DEVICE_DATA(INTEL, NVLH, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, PTLH, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, PTLH_PCH, &dwc3_pci_intel_swnode) },
 	{ PCI_DEVICE_DATA(INTEL, PTLU, &dwc3_pci_intel_swnode) },

drivers/usb/gadget/function/f_hid.c+4−0

 	if (!hidg->interval_user_set) {
 		hidg_fs_in_ep_desc.bInterval = 10;
 		hidg_hs_in_ep_desc.bInterval = 4;
+		hidg_ss_in_ep_desc.bInterval = 4;
 	} else {
 		hidg_fs_in_ep_desc.bInterval = hidg->interval;
 		hidg_hs_in_ep_desc.bInterval = hidg->interval;
+		hidg_ss_in_ep_desc.bInterval = hidg->interval;
 	}
 	hidg_ss_out_comp_desc.wBytesPerInterval =
 		if (!hidg->interval_user_set) {
 			hidg_fs_out_ep_desc.bInterval = 10;
 			hidg_hs_out_ep_desc.bInterval = 4;
+			hidg_ss_out_ep_desc.bInterval = 4;
 		} else {
 			hidg_fs_out_ep_desc.bInterval = hidg->interval;
 			hidg_hs_out_ep_desc.bInterval = hidg->interval;
+			hidg_ss_out_ep_desc.bInterval = hidg->interval;
 		}
 		status = usb_assign_descriptors(f,
 			    hidg_fs_descriptors_intout,

drivers/usb/gadget/function/f_mass_storage.c+10−2

 #include <linux/kthread.h>
 #include <linux/sched/signal.h>
 #include <linux/limits.h>
+#include <linux/overflow.h>
 #include <linux/pagemap.h>
 #include <linux/rwsem.h>
 #include <linux/slab.h>
 		int cmnd_size, enum data_direction data_dir,
 		unsigned int mask, int needs_medium, const char *name)
 {
-	if (common->curlun)
+	if (common->curlun) {
-		common->data_size_from_cmnd <<= common->curlun->blkbits;
+		if (check_shl_overflow(common->data_size_from_cmnd,
+				       common->curlun->blkbits,
+				       &common->data_size_from_cmnd)) {
+			common->phase_error = 1;
+			return -EINVAL;
+		}
+	}
 	return check_command(common, cmnd_size, data_dir,
 			mask, needs_medium, name);
 }

drivers/usb/gadget/function/f_ncm.c+80−66

@@ -83,11 +83,6 @@ static inline struct f_ncm func_to_ncm(struct usb_function f) · 82 unmodified lines
83	return container_of(f, struct f_ncm, port.func);	83	return container_of(f, struct f_ncm, port.func);
84	}	84	}
85		85
86	static inline struct f_ncm_opts func_to_ncm_opts(struct usb_function f)
87	{
88	return container_of(f->fi, struct f_ncm_opts, func_inst);
89	}
90
91	/-------------------------------------------------------------------------/	86	/-------------------------------------------------------------------------/
92		87
93	/*	88	/*
@@ -864,7 +859,6 @@ invalid: · 770 unmodified lines
864	static int ncm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)	859	static int ncm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
865	{	860	{
866	struct f_ncm *ncm = func_to_ncm(f);	861	struct f_ncm *ncm = func_to_ncm(f);
867	struct f_ncm_opts *opts = func_to_ncm_opts(f);
868	struct usb_composite_dev *cdev = f->config->cdev;	862	struct usb_composite_dev *cdev = f->config->cdev;
869		863
870	/* Control interface has only altsetting 0 */	864	/* Control interface has only altsetting 0 */
@@ -887,13 +881,12 @@ static int ncm_set_alt(struct usb_function *f, unsigned intf, unsigned alt) · 16 unmodified lines
887	if (alt > 1)	881	if (alt > 1)
888	goto fail;	882	goto fail;
889		883
890	scoped_guard(mutex, &opts->lock)	884	if (ncm->netdev) {
891	if (opts->net) {	885	DBG(cdev, "reset ncm\n");
892	DBG(cdev, "reset ncm\n");	886	ncm->netdev = NULL;
893	opts->net = NULL;	887	gether_disconnect(&ncm->port);
894	gether_disconnect(&ncm->port);	888	ncm_reset_values(ncm);
895	ncm_reset_values(ncm);	889	}
896	}
897		890
898	/*	891	/*
899	* CDC Network only sends data in non-default altsettings.	892	* CDC Network only sends data in non-default altsettings.
@@ -926,8 +919,7 @@ static int ncm_set_alt(struct usb_function *f, unsigned intf, unsigned alt) · 26 unmodified lines
926	net = gether_connect(&ncm->port);	919	net = gether_connect(&ncm->port);
927	if (IS_ERR(net))	920	if (IS_ERR(net))
928	return PTR_ERR(net);	921	return PTR_ERR(net);
929	scoped_guard(mutex, &opts->lock)	922	ncm->netdev = net;
930	opts->net = net;
931	}	923	}
932		924
933	spin_lock(&ncm->lock);	925	spin_lock(&ncm->lock);
@@ -1374,16 +1366,14 @@ err: · 440 unmodified lines
1374	static void ncm_disable(struct usb_function *f)	1366	static void ncm_disable(struct usb_function *f)
1375	{	1367	{
1376	struct f_ncm *ncm = func_to_ncm(f);	1368	struct f_ncm *ncm = func_to_ncm(f);
1377	struct f_ncm_opts *opts = func_to_ncm_opts(f);
1378	struct usb_composite_dev *cdev = f->config->cdev;	1369	struct usb_composite_dev *cdev = f->config->cdev;
1379		1370
1380	DBG(cdev, "ncm deactivated\n");	1371	DBG(cdev, "ncm deactivated\n");
1381		1372
1382	scoped_guard(mutex, &opts->lock)	1373	if (ncm->netdev) {
1383	if (opts->net) {	1374	ncm->netdev = NULL;
1384	opts->net = NULL;	1375	gether_disconnect(&ncm->port);
1385	gether_disconnect(&ncm->port);	1376	}
1386	}
1387		1377
1388	if (ncm->notify->enabled) {	1378	if (ncm->notify->enabled) {
1389	usb_ep_disable(ncm->notify);	1379	usb_ep_disable(ncm->notify);
@@ -1443,44 +1433,41 @@ static int ncm_bind(struct usb_configuration c, struct usb_function f) · 53 unmodified lines
1443	{	1433	{
1444	struct usb_composite_dev *cdev = c->cdev;	1434	struct usb_composite_dev *cdev = c->cdev;
1445	struct f_ncm *ncm = func_to_ncm(f);	1435	struct f_ncm *ncm = func_to_ncm(f);
1446	struct f_ncm_opts *ncm_opts = func_to_ncm_opts(f);
1447	struct usb_string *us;	1436	struct usb_string *us;
1448	int status = 0;	1437	int status = 0;
1449	struct usb_ep *ep;	1438	struct usb_ep *ep;
		1439	struct f_ncm_opts *ncm_opts;
1450		1440
1451	struct usb_os_desc_table *os_desc_table __free(kfree) = NULL;	1441	struct usb_os_desc_table *os_desc_table __free(kfree) = NULL;
1452	struct net_device *netdev __free(free_gether_netdev) = NULL;	1442	struct net_device *net __free(detach_gadget) = NULL;
1453	struct usb_request *request __free(free_usb_request) = NULL;	1443	struct usb_request *request __free(free_usb_request) = NULL;
1454		1444
1455	if (!can_support_ecm(cdev->gadget))	1445	if (!can_support_ecm(cdev->gadget))
1456	return -EINVAL;	1446	return -EINVAL;
1457		1447
		1448	ncm_opts = container_of(f->fi, struct f_ncm_opts, func_inst);
		1449
1458	if (cdev->use_os_string) {	1450	if (cdev->use_os_string) {
1459	os_desc_table = kzalloc(sizeof(*os_desc_table), GFP_KERNEL);	1451	os_desc_table = kzalloc(sizeof(*os_desc_table), GFP_KERNEL);
1460	if (!os_desc_table)	1452	if (!os_desc_table)
1461	return -ENOMEM;	1453	return -ENOMEM;
1462	}	1454	}
1463		1455
1464	netdev = gether_setup_default();	1456	scoped_guard(mutex, &ncm_opts->lock)
1465	if (IS_ERR(netdev))	1457	if (ncm_opts->bind_count == 0) {
1466	return -ENOMEM;	1458	if (!device_is_registered(&ncm_opts->net->dev)) {
1467		1459	ncm_opts->net->mtu = (ncm_opts->max_segment_size - ETH_HLEN);
1468	scoped_guard(mutex, &ncm_opts->lock) {	1460	gether_set_gadget(ncm_opts->net, cdev->gadget);
1469	gether_apply_opts(netdev, &ncm_opts->net_opts);	1461	status = gether_register_netdev(ncm_opts->net);
1470	netdev->mtu = ncm_opts->max_segment_size - ETH_HLEN;	1462	} else
1471	}	1463	status = gether_attach_gadget(ncm_opts->net, cdev->gadget);
1472		1464
1473	gether_set_gadget(netdev, cdev->gadget);	1465	if (status)
1474	status = gether_register_netdev(netdev);	1466	return status;
1475	if (status)	1467	net = ncm_opts->net;
1476	return status;	1468	}
1477		1469
1478	/* export host's Ethernet address in CDC format */	1470	ncm_string_defs[1].s = ncm->ethaddr;
1479	status = gether_get_host_addr_cdc(netdev, ncm->ethaddr,
1480	sizeof(ncm->ethaddr));
1481	if (status < 12)
1482	return -EINVAL;
1483	ncm_string_defs[STRING_MAC_IDX].s = ncm->ethaddr;
1484		1471
1485	us = usb_gstrings_attach(cdev, ncm_strings,	1472	us = usb_gstrings_attach(cdev, ncm_strings,
1486	ARRAY_SIZE(ncm_string_defs));	1473	ARRAY_SIZE(ncm_string_defs));
@@ -1578,8 +1565,9 @@ static int ncm_bind(struct usb_configuration c, struct usb_function f) · 91 unmodified lines
1578	f->os_desc_n = 1;	1565	f->os_desc_n = 1;
1579	}	1566	}
1580	ncm->notify_req = no_free_ptr(request);	1567	ncm->notify_req = no_free_ptr(request);
1581	ncm->netdev = no_free_ptr(netdev);	1568
1582	ncm->port.ioport = netdev_priv(ncm->netdev);	1569	ncm_opts->bind_count++;
		1570	retain_and_null_ptr(net);
1583		1571
1584	DBG(cdev, "CDC Network: IN/%s OUT/%s NOTIFY/%s\n",	1572	DBG(cdev, "CDC Network: IN/%s OUT/%s NOTIFY/%s\n",
1585	ncm->port.in_ep->name, ncm->port.out_ep->name,	1573	ncm->port.in_ep->name, ncm->port.out_ep->name,
@@ -1594,19 +1582,19 @@ static inline struct f_ncm_opts to_f_ncm_opts(struct config_item item) · 8 unmodified lines
1594	}	1582	}
1595		1583
1596	/* f_ncm_item_ops */	1584	/* f_ncm_item_ops */
1597	USB_ETHER_OPTS_ITEM(ncm);	1585	USB_ETHERNET_CONFIGFS_ITEM(ncm);
1598		1586
1599	/* f_ncm_opts_dev_addr */	1587	/* f_ncm_opts_dev_addr */
1600	USB_ETHER_OPTS_ATTR_DEV_ADDR(ncm);	1588	USB_ETHERNET_CONFIGFS_ITEM_ATTR_DEV_ADDR(ncm);
1601		1589
1602	/* f_ncm_opts_host_addr */	1590	/* f_ncm_opts_host_addr */
1603	USB_ETHER_OPTS_ATTR_HOST_ADDR(ncm);	1591	USB_ETHERNET_CONFIGFS_ITEM_ATTR_HOST_ADDR(ncm);
1604		1592
1605	/* f_ncm_opts_qmult */	1593	/* f_ncm_opts_qmult */
1606	USB_ETHER_OPTS_ATTR_QMULT(ncm);	1594	USB_ETHERNET_CONFIGFS_ITEM_ATTR_QMULT(ncm);
1607		1595
1608	/* f_ncm_opts_ifname */	1596	/* f_ncm_opts_ifname */
1609	USB_ETHER_OPTS_ATTR_IFNAME(ncm);	1597	USB_ETHERNET_CONFIGFS_ITEM_ATTR_IFNAME(ncm);
1610		1598
1611	static ssize_t ncm_opts_max_segment_size_show(struct config_item *item,	1599	static ssize_t ncm_opts_max_segment_size_show(struct config_item *item,
1612	char *page)	1600	char *page)
@@ -1672,27 +1660,34 @@ static void ncm_free_inst(struct usb_function_instance *f) · 59 unmodified lines
1672	struct f_ncm_opts *opts;	1660	struct f_ncm_opts *opts;
1673		1661
1674	opts = container_of(f, struct f_ncm_opts, func_inst);	1662	opts = container_of(f, struct f_ncm_opts, func_inst);
		1663	if (device_is_registered(&opts->net->dev))
		1664	gether_cleanup(netdev_priv(opts->net));
		1665	else
		1666	free_netdev(opts->net);
1675	kfree(opts->ncm_interf_group);	1667	kfree(opts->ncm_interf_group);
1676	kfree(opts);	1668	kfree(opts);
1677	}	1669	}
1678		1670
1679	static struct usb_function_instance *ncm_alloc_inst(void)	1671	static struct usb_function_instance *ncm_alloc_inst(void)
1680	{	1672	{
1681	struct usb_function_instance *ret;	1673	struct f_ncm_opts *opts;
1682	struct usb_os_desc *descs[1];	1674	struct usb_os_desc *descs[1];
1683	char *names[1];	1675	char *names[1];
1684	struct config_group *ncm_interf_group;	1676	struct config_group *ncm_interf_group;
1685		1677
1686	struct f_ncm_opts opts __free(kfree) = kzalloc_obj(opts);	1678	opts = kzalloc_obj(*opts);
1687	if (!opts)	1679	if (!opts)
1688	return ERR_PTR(-ENOMEM);	1680	return ERR_PTR(-ENOMEM);
1689
1690	opts->net = NULL;
1691	opts->ncm_os_desc.ext_compat_id = opts->ncm_ext_compat_id;	1681	opts->ncm_os_desc.ext_compat_id = opts->ncm_ext_compat_id;
1692	gether_setup_opts_default(&opts->net_opts, "usb");
1693		1682
1694	mutex_init(&opts->lock);	1683	mutex_init(&opts->lock);
1695	opts->func_inst.free_func_inst = ncm_free_inst;	1684	opts->func_inst.free_func_inst = ncm_free_inst;
		1685	opts->net = gether_setup_default();
		1686	if (IS_ERR(opts->net)) {
		1687	struct net_device *net = opts->net;
		1688	kfree(opts);
		1689	return ERR_CAST(net);
		1690	}
1696	opts->max_segment_size = ETH_FRAME_LEN;	1691	opts->max_segment_size = ETH_FRAME_LEN;
1697	INIT_LIST_HEAD(&opts->ncm_os_desc.ext_prop);	1692	INIT_LIST_HEAD(&opts->ncm_os_desc.ext_prop);
1698		1693
@@ -1703,30 +1698,37 @@ static struct usb_function_instance *ncm_alloc_inst(void) · 4 unmodified lines
1703	ncm_interf_group =	1698	ncm_interf_group =
1704	usb_os_desc_prepare_interf_dir(&opts->func_inst.group, 1, descs,	1699	usb_os_desc_prepare_interf_dir(&opts->func_inst.group, 1, descs,
1705	names, THIS_MODULE);	1700	names, THIS_MODULE);
1706	if (IS_ERR(ncm_interf_group))	1701	if (IS_ERR(ncm_interf_group)) {
		1702	ncm_free_inst(&opts->func_inst);
1707	return ERR_CAST(ncm_interf_group);	1703	return ERR_CAST(ncm_interf_group);
		1704	}
1708	opts->ncm_interf_group = ncm_interf_group;	1705	opts->ncm_interf_group = ncm_interf_group;
1709		1706
1710	ret = &opts->func_inst;	1707	return &opts->func_inst;
1711	retain_and_null_ptr(opts);
1712	return ret;
1713	}	1708	}
1714		1709
1715	static void ncm_free(struct usb_function *f)	1710	static void ncm_free(struct usb_function *f)
1716	{	1711	{
1717	struct f_ncm_opts *opts = func_to_ncm_opts(f);	1712	struct f_ncm *ncm;
		1713	struct f_ncm_opts *opts;
1718		1714
1719	scoped_guard(mutex, &opts->lock)	1715	ncm = func_to_ncm(f);
1720	opts->refcnt--;	1716	opts = container_of(f->fi, struct f_ncm_opts, func_inst);
1721	kfree(func_to_ncm(f));	1717	kfree(ncm);
		1718	mutex_lock(&opts->lock);
		1719	opts->refcnt--;
		1720	mutex_unlock(&opts->lock);
1722	}	1721	}
1723		1722
1724	static void ncm_unbind(struct usb_configuration c, struct usb_function f)	1723	static void ncm_unbind(struct usb_configuration c, struct usb_function f)
1725	{	1724	{
1726	struct f_ncm *ncm = func_to_ncm(f);	1725	struct f_ncm *ncm = func_to_ncm(f);
		1726	struct f_ncm_opts *ncm_opts;
1727		1727
1728	DBG(c->cdev, "ncm unbind\n");	1728	DBG(c->cdev, "ncm unbind\n");
1729		1729
		1730	ncm_opts = container_of(f->fi, struct f_ncm_opts, func_inst);
		1731
1730	hrtimer_cancel(&ncm->task_timer);	1732	hrtimer_cancel(&ncm->task_timer);
1731		1733
1732	kfree(f->os_desc_table);	1734	kfree(f->os_desc_table);
@@ -1743,14 +1745,16 @@ static void ncm_unbind(struct usb_configuration c, struct usb_function f) · 10 unmodified lines
1743	kfree(ncm->notify_req->buf);	1745	kfree(ncm->notify_req->buf);
1744	usb_ep_free_request(ncm->notify, ncm->notify_req);	1746	usb_ep_free_request(ncm->notify, ncm->notify_req);
1745		1747
1746	ncm->port.ioport = NULL;	1748	ncm_opts->bind_count--;
1747	gether_cleanup(netdev_priv(ncm->netdev));	1749	if (ncm_opts->bind_count == 0)
		1750	gether_detach_gadget(ncm_opts->net);
1748	}	1751	}
1749		1752
1750	static struct usb_function ncm_alloc(struct usb_function_instance fi)	1753	static struct usb_function ncm_alloc(struct usb_function_instance fi)
1751	{	1754	{
1752	struct f_ncm *ncm;	1755	struct f_ncm *ncm;
1753	struct f_ncm_opts *opts;	1756	struct f_ncm_opts *opts;
		1757	int status;
1754		1758
1755	/* allocate and initialize one new instance */	1759	/* allocate and initialize one new instance */
1756	ncm = kzalloc(sizeof(*ncm), GFP_KERNEL);	1760	ncm = kzalloc(sizeof(*ncm), GFP_KERNEL);
@@ -1758,12 +1762,22 @@ static struct usb_function ncm_alloc(struct usb_function_instance fi) · 1 unmodified line
1758	return ERR_PTR(-ENOMEM);	1762	return ERR_PTR(-ENOMEM);
1759		1763
1760	opts = container_of(fi, struct f_ncm_opts, func_inst);	1764	opts = container_of(fi, struct f_ncm_opts, func_inst);
		1765	mutex_lock(&opts->lock);
		1766	opts->refcnt++;
1761		1767
1762	scoped_guard(mutex, &opts->lock)	1768	/* export host's Ethernet address in CDC format */
1763	opts->refcnt++;	1769	status = gether_get_host_addr_cdc(opts->net, ncm->ethaddr,
		1770	sizeof(ncm->ethaddr));
		1771	if (status < 12) { /* strlen("01234567890a") */
		1772	kfree(ncm);
		1773	mutex_unlock(&opts->lock);
		1774	return ERR_PTR(-EINVAL);
		1775	}
1764		1776
1765	spin_lock_init(&ncm->lock);	1777	spin_lock_init(&ncm->lock);
1766	ncm_reset_values(ncm);	1778	ncm_reset_values(ncm);
		1779	ncm->port.ioport = netdev_priv(opts->net);
		1780	mutex_unlock(&opts->lock);
1767	ncm->port.is_fixed = true;	1781	ncm->port.is_fixed = true;
1768	ncm->port.supports_multi_frame = true;	1782	ncm->port.supports_multi_frame = true;
1769		1783

drivers/usb/gadget/function/f_tcm.c+14−0

@@ -1222,6 +1222,13 @@ static void usbg_submit_cmd(struct usbg_cmd *cmd) · 1221 unmodified lines
1222	se_cmd = &cmd->se_cmd;	1222	se_cmd = &cmd->se_cmd;
1223	tpg = cmd->fu->tpg;	1223	tpg = cmd->fu->tpg;
1224	tv_nexus = tpg->tpg_nexus;	1224	tv_nexus = tpg->tpg_nexus;
		1225	if (!tv_nexus) {
		1226	struct usb_gadget *gadget = fuas_to_gadget(cmd->fu);
		1227
		1228	dev_err(&gadget->dev, "Missing nexus, ignoring command\n");
		1229	return;
		1230	}
		1231
1225	dir = get_cmd_dir(cmd->cmd_buf);	1232	dir = get_cmd_dir(cmd->cmd_buf);
1226	if (dir < 0)	1233	if (dir < 0)
1227	goto out;	1234	goto out;
@@ -1483,6 +1490,13 @@ static void bot_cmd_work(struct work_struct *work) · 255 unmodified lines
1483	se_cmd = &cmd->se_cmd;	1490	se_cmd = &cmd->se_cmd;
1484	tpg = cmd->fu->tpg;	1491	tpg = cmd->fu->tpg;
1485	tv_nexus = tpg->tpg_nexus;	1492	tv_nexus = tpg->tpg_nexus;
		1493	if (!tv_nexus) {
		1494	struct usb_gadget *gadget = fuas_to_gadget(cmd->fu);
		1495
		1496	dev_err(&gadget->dev, "Missing nexus, ignoring command\n");
		1497	return;
		1498	}
		1499
1486	dir = get_cmd_dir(cmd->cmd_buf);	1500	dir = get_cmd_dir(cmd->cmd_buf);
1487	if (dir < 0)	1501	if (dir < 0)
1488	goto out;	1502	goto out;

drivers/usb/gadget/function/u_ether.c+22−45

@@ -897,6 +897,28 @@ void gether_set_gadget(struct net_device net, struct usb_gadget g) · 896 unmodified lines
897	}	897	}
898	EXPORT_SYMBOL_GPL(gether_set_gadget);	898	EXPORT_SYMBOL_GPL(gether_set_gadget);
899		899
		900	int gether_attach_gadget(struct net_device net, struct usb_gadget g)
		901	{
		902	int ret;
		903
		904	ret = device_move(&net->dev, &g->dev, DPM_ORDER_DEV_AFTER_PARENT);
		905	if (ret)
		906	return ret;
		907
		908	gether_set_gadget(net, g);
		909	return 0;
		910	}
		911	EXPORT_SYMBOL_GPL(gether_attach_gadget);
		912
		913	void gether_detach_gadget(struct net_device *net)
		914	{
		915	struct eth_dev *dev = netdev_priv(net);
		916
		917	device_move(&net->dev, NULL, DPM_ORDER_NONE);
		918	dev->gadget = NULL;
		919	}
		920	EXPORT_SYMBOL_GPL(gether_detach_gadget);
		921
900	int gether_set_dev_addr(struct net_device net, const char dev_addr)	922	int gether_set_dev_addr(struct net_device net, const char dev_addr)
901	{	923	{
902	struct eth_dev *dev;	924	struct eth_dev *dev;
@@ -1040,36 +1062,6 @@ int gether_set_ifname(struct net_device net, const char name, int len) · 137 unmodified lines
1040	}	1062	}
1041	EXPORT_SYMBOL_GPL(gether_set_ifname);	1063	EXPORT_SYMBOL_GPL(gether_set_ifname);
1042		1064
1043	void gether_setup_opts_default(struct gether_opts opts, const char name)
1044	{
1045	opts->qmult = QMULT_DEFAULT;
1046	snprintf(opts->name, sizeof(opts->name), "%s%%d", name);
1047	eth_random_addr(opts->dev_mac);
1048	opts->addr_assign_type = NET_ADDR_RANDOM;
1049	eth_random_addr(opts->host_mac);
1050	}
1051	EXPORT_SYMBOL_GPL(gether_setup_opts_default);
1052
1053	void gether_apply_opts(struct net_device net, struct gether_opts opts)
1054	{
1055	struct eth_dev *dev = netdev_priv(net);
1056
1057	dev->qmult = opts->qmult;
1058
1059	if (opts->ifname_set) {
1060	strscpy(net->name, opts->name, sizeof(net->name));
1061	dev->ifname_set = true;
1062	}
1063
1064	memcpy(dev->host_mac, opts->host_mac, sizeof(dev->host_mac));
1065
1066	if (opts->addr_assign_type == NET_ADDR_SET) {
1067	memcpy(dev->dev_mac, opts->dev_mac, sizeof(dev->dev_mac));
1068	net->addr_assign_type = opts->addr_assign_type;
1069	}
1070	}
1071	EXPORT_SYMBOL_GPL(gether_apply_opts);
1072
1073	void gether_suspend(struct gether *link)	1065	void gether_suspend(struct gether *link)
1074	{	1066	{
1075	struct eth_dev *dev = link->ioport;	1067	struct eth_dev *dev = link->ioport;
@@ -1126,21 +1118,6 @@ void gether_cleanup(struct eth_dev *dev) · 50 unmodified lines
1126	}	1118	}
1127	EXPORT_SYMBOL_GPL(gether_cleanup);	1119	EXPORT_SYMBOL_GPL(gether_cleanup);
1128		1120
1129	void gether_unregister_free_netdev(struct net_device *net)
1130	{
1131	if (!net)
1132	return;
1133
1134	struct eth_dev *dev = netdev_priv(net);
1135
1136	if (net->reg_state == NETREG_REGISTERED) {
1137	unregister_netdev(net);
1138	flush_work(&dev->work);
1139	}
1140	free_netdev(net);
1141	}
1142	EXPORT_SYMBOL_GPL(gether_unregister_free_netdev);
1143
1144	/**	1121	/**
1145	* gether_connect - notify network layer that USB link is active	1122	* gether_connect - notify network layer that USB link is active
1146	* @link: the USB link, set up with endpoints, descriptors matching	1123	* @link: the USB link, set up with endpoints, descriptors matching

drivers/usb/gadget/function/u_ether.h+26−30

 struct eth_dev;
-/**
- * struct gether_opts - Options for Ethernet gadget function instances
- * @name: Pattern for the network interface name (e.g., "usb%d").
- *        Used to generate the net device name.
- * @qmult: Queue length multiplier for high/super speed.
- * @host_mac: The MAC address to be used by the host side.
- * @dev_mac: The MAC address to be used by the device side.
- * @ifname_set: True if the interface name pattern has been set by userspace.
- * @addr_assign_type: The method used for assigning the device MAC address
- *                    (e.g., NET_ADDR_RANDOM, NET_ADDR_SET).
- *
- * This structure caches network-related settings provided through configfs
- * before the net_device is fully instantiated. This allows for early
- * configuration while deferring net_device allocation until the function
- * is bound.
- */
-struct gether_opts {
-	char			name[IFNAMSIZ];
-	unsigned int		qmult;
-	u8			host_mac[ETH_ALEN];
-	u8			dev_mac[ETH_ALEN];
-	bool			ifname_set;
-	unsigned char		addr_assign_type;
-};
 /*
  * This represents the USB side of an "ethernet" link, managed by a USB
  * function which provides control and (maybe) framing.  Two functions
  */
 void gether_set_gadget(struct net_device *net, struct usb_gadget *g);
+/**
+ * gether_attach_gadget - Reparent net_device to the gadget device.
+ * @net: The network device to reparent.
+ * @g: The target USB gadget device to parent to.
+ *
+ * This function moves the network device to be a child of the USB gadget
+ * device in the device hierarchy. This is typically done when the function
+ * is bound to a configuration.
+ *
+ * Returns 0 on success, or a negative error code on failure.
+ */
+int gether_attach_gadget(struct net_device *net, struct usb_gadget *g);
+/**
+ * gether_detach_gadget - Detach net_device from its gadget parent.
+ * @net: The network device to detach.
+ *
+ * This function moves the network device to be a child of the virtual
+ * devices parent, effectively detaching it from the USB gadget device
+ * hierarchy. This is typically done when the function is unbound
+ * from a configuration but the instance is not yet freed.
+ */
+void gether_detach_gadget(struct net_device *net);
+DEFINE_FREE(detach_gadget, struct net_device *, if (_T) gether_detach_gadget(_T))
 /**
  * gether_set_dev_addr - initialize an ethernet-over-usb link with eth address
  * @net: device representing this link
 int gether_set_ifname(struct net_device *net, const char *name, int len);
 void gether_cleanup(struct eth_dev *dev);
-void gether_unregister_free_netdev(struct net_device *net);
-DEFINE_FREE(free_gether_netdev, struct net_device *, gether_unregister_free_netdev(_T));
-void gether_setup_opts_default(struct gether_opts *opts, const char *name);
-void gether_apply_opts(struct net_device *net, struct gether_opts *opts);
 void gether_suspend(struct gether *link);
 void gether_resume(struct gether *link);

drivers/usb/gadget/function/u_ether_configfs.h+0−177

@@ -13,13 +13,6 @@ · 12 unmodified lines
13	#ifndef __U_ETHER_CONFIGFS_H	13	#ifndef __U_ETHER_CONFIGFS_H
14	#define __U_ETHER_CONFIGFS_H	14	#define __U_ETHER_CONFIGFS_H
15		15
16	#include <linux/cleanup.h>
17	#include <linux/hex.h>
18	#include <linux/if_ether.h>
19	#include <linux/mutex.h>
20	#include <linux/netdevice.h>
21	#include <linux/rtnetlink.h>
22
23	#define USB_ETHERNET_CONFIGFS_ITEM(_f_) \	16	#define USB_ETHERNET_CONFIGFS_ITEM(_f_) \
24	static void _f_##_attr_release(struct config_item *item) \	17	static void _f_##_attr_release(struct config_item *item) \
25	{ \	18	{ \
@@ -204,174 +197,4 @@ out: \ · 178 unmodified lines
204	\	197	\
205	CONFIGFS_ATTR(_f_##_opts_, _n_)	198	CONFIGFS_ATTR(_f_##_opts_, _n_)
206		199
207	#define USB_ETHER_OPTS_ITEM(_f_) \
208	static void _f_##_attr_release(struct config_item *item) \
209	{ \
210	struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item); \
211	\
212	usb_put_function_instance(&opts->func_inst); \
213	} \
214	\
215	static struct configfs_item_operations _f_##_item_ops = { \
216	.release = _f_##_attr_release, \
217	}
218
219	#define USB_ETHER_OPTS_ATTR_DEV_ADDR(_f_) \
220	static ssize_t _f_##_opts_dev_addr_show(struct config_item *item, \
221	char *page) \
222	{ \
223	struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item); \
224	\
225	guard(mutex)(&opts->lock); \
226	return sysfs_emit(page, "%pM\n", opts->net_opts.dev_mac); \
227	} \
228	\
229	static ssize_t _f_##_opts_dev_addr_store(struct config_item *item, \
230	const char *page, size_t len) \
231	{ \
232	struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item); \
233	u8 new_addr[ETH_ALEN]; \
234	const char *p = page; \
235	\
236	guard(mutex)(&opts->lock); \
237	if (opts->refcnt) \
238	return -EBUSY; \
239	\
240	for (int i = 0; i < ETH_ALEN; i++) { \
241	unsigned char num; \
242	if ((p == '.') \|\| (p == ':')) \
243	p++; \
244	num = hex_to_bin(*p++) << 4; \
245	num \|= hex_to_bin(*p++); \
246	new_addr[i] = num; \
247	} \
248	if (!is_valid_ether_addr(new_addr)) \
249	return -EINVAL; \
250	memcpy(opts->net_opts.dev_mac, new_addr, ETH_ALEN); \
251	opts->net_opts.addr_assign_type = NET_ADDR_SET; \
252	return len; \
253	} \
254	\
255	CONFIGFS_ATTR(_f_##_opts_, dev_addr)
256
257	#define USB_ETHER_OPTS_ATTR_HOST_ADDR(_f_) \
258	static ssize_t _f_##_opts_host_addr_show(struct config_item *item, \
259	char *page) \
260	{ \
261	struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item); \
262	\
263	guard(mutex)(&opts->lock); \
264	return sysfs_emit(page, "%pM\n", opts->net_opts.host_mac); \
265	} \
266	\
267	static ssize_t _f_##_opts_host_addr_store(struct config_item *item, \
268	const char *page, size_t len) \
269	{ \
270	struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item); \
271	u8 new_addr[ETH_ALEN]; \
272	const char *p = page; \
273	\
274	guard(mutex)(&opts->lock); \
275	if (opts->refcnt) \
276	return -EBUSY; \
277	\
278	for (int i = 0; i < ETH_ALEN; i++) { \
279	unsigned char num; \
280	if ((p == '.') \|\| (p == ':')) \
281	p++; \
282	num = hex_to_bin(*p++) << 4; \
283	num \|= hex_to_bin(*p++); \
284	new_addr[i] = num; \
285	} \
286	if (!is_valid_ether_addr(new_addr)) \
287	return -EINVAL; \
288	memcpy(opts->net_opts.host_mac, new_addr, ETH_ALEN); \
289	return len; \
290	} \
291	\
292	CONFIGFS_ATTR(_f_##_opts_, host_addr)
293
294	#define USB_ETHER_OPTS_ATTR_QMULT(_f_) \
295	static ssize_t _f_##_opts_qmult_show(struct config_item *item, \
296	char *page) \
297	{ \
298	struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item); \
299	\
300	guard(mutex)(&opts->lock); \
301	return sysfs_emit(page, "%u\n", opts->net_opts.qmult); \
302	} \
303	\
304	static ssize_t _f_##_opts_qmult_store(struct config_item *item, \
305	const char *page, size_t len) \
306	{ \
307	struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item); \
308	u32 val; \
309	int ret; \
310	\
311	guard(mutex)(&opts->lock); \
312	if (opts->refcnt) \
313	return -EBUSY; \
314	\
315	ret = kstrtou32(page, 0, &val); \
316	if (ret) \
317	return ret; \
318	\
319	opts->net_opts.qmult = val; \
320	return len; \
321	} \
322	\
323	CONFIGFS_ATTR(_f_##_opts_, qmult)
324
325	#define USB_ETHER_OPTS_ATTR_IFNAME(_f_) \
326	static ssize_t _f_##_opts_ifname_show(struct config_item *item, \
327	char *page) \
328	{ \
329	struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item); \
330	const char *name; \
331	\
332	guard(mutex)(&opts->lock); \
333	rtnl_lock(); \
334	if (opts->net_opts.ifname_set) \
335	name = opts->net_opts.name; \
336	else if (opts->net) \
337	name = netdev_name(opts->net); \
338	else \
339	name = "(inactive net_device)"; \
340	rtnl_unlock(); \
341	return sysfs_emit(page, "%s\n", name); \
342	} \
343	\
344	static ssize_t _f_##_opts_ifname_store(struct config_item *item, \
345	const char *page, size_t len) \
346	{ \
347	struct f_##_f_##_opts *opts = to_f_##_f_##_opts(item); \
348	char tmp[IFNAMSIZ]; \
349	const char *p; \
350	size_t c_len = len; \
351	\
352	if (c_len > 0 && page[c_len - 1] == '\n') \
353	c_len--; \
354	\
355	if (c_len >= sizeof(tmp)) \
356	return -E2BIG; \
357	\
358	strscpy(tmp, page, c_len + 1); \
359	if (!dev_valid_name(tmp)) \
360	return -EINVAL; \
361	\
362	/* Require exactly one %d */ \
363	p = strchr(tmp, '%'); \
364	if (!p \|\| p[1] != 'd' \|\| strchr(p + 2, '%')) \
365	return -EINVAL; \
366	\
367	guard(mutex)(&opts->lock); \
368	if (opts->refcnt) \
369	return -EBUSY; \
370	strscpy(opts->net_opts.name, tmp, sizeof(opts->net_opts.name)); \
371	opts->net_opts.ifname_set = true; \
372	return len; \
373	} \
374	\
375	CONFIGFS_ATTR(_f_##_opts_, ifname)
376
377	#endif /* __U_ETHER_CONFIGFS_H */	200	#endif /* __U_ETHER_CONFIGFS_H */

drivers/usb/gadget/function/u_ncm.h+1−3

 #include <linux/usb/composite.h>
-#include "u_ether.h"
 struct f_ncm_opts {
 	struct usb_function_instance	func_inst;
 	struct net_device		*net;
+	int				bind_count;
-	struct gether_opts		net_opts;
 	struct config_group		*ncm_interf_group;
 	struct usb_os_desc		ncm_os_desc;
 	char				ncm_ext_compat_id[16];

drivers/usb/gadget/function/uvc_video.c+1−1

@@ -513,7 +513,7 @@ uvc_video_prep_requests(struct uvc_video *video) · 512 unmodified lines
513	return;	513	return;
514	}	514	}
515		515
516	interval_duration = 2 << (video->ep->desc->bInterval - 1);	516	interval_duration = 1 << (video->ep->desc->bInterval - 1);
517	if (cdev->gadget->speed < USB_SPEED_HIGH)	517	if (cdev->gadget->speed < USB_SPEED_HIGH)
518	interval_duration *= 10000;	518	interval_duration *= 10000;
519	else	519	else

drivers/usb/host/xhci-debugfs.c+9−1

 static int xhci_portli_show(struct seq_file *s, void *unused)
 {
 	struct xhci_port	*port = s->private;
-	struct xhci_hcd		*xhci = hcd_to_xhci(port->rhub->hcd);
+	struct xhci_hcd		*xhci;
 	u32			portli;
 	portli = readl(&port->port_reg->portli);
+	/* port without protocol capability isn't added to a roothub */
+	if (!port->rhub) {
+		seq_printf(s, "0x%08x\n", portli);
+		return 0;
+	}
+	xhci = hcd_to_xhci(port->rhub->hcd);
 	/* PORTLI fields are valid if port is a USB3 or eUSB2V2 port */
 	if (port->rhub == &xhci->usb3_rhub)
 		seq_printf(s, "0x%08x LEC=%u RLC=%u TLC=%u\n", portli,

drivers/usb/host/xhci-ring.c+1−0

@@ -3195,6 +3195,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) · 3194 unmodified lines
3195		3195
3196	if (status & STS_HCE) {	3196	if (status & STS_HCE) {
3197	xhci_warn(xhci, "WARNING: Host Controller Error\n");	3197	xhci_warn(xhci, "WARNING: Host Controller Error\n");
		3198	xhci_halt(xhci);
3198	goto out;	3199	goto out;
3199	}	3200	}
3200		3201

drivers/usb/host/xhci.c+2−2

@@ -4146,7 +4146,7 @@ int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id) · 4145 unmodified lines
4146	if (state == 0xffffffff \|\| (xhci->xhc_state & XHCI_STATE_DYING) \|\|	4146	if (state == 0xffffffff \|\| (xhci->xhc_state & XHCI_STATE_DYING) \|\|
4147	(xhci->xhc_state & XHCI_STATE_HALTED)) {	4147	(xhci->xhc_state & XHCI_STATE_HALTED)) {
4148	spin_unlock_irqrestore(&xhci->lock, flags);	4148	spin_unlock_irqrestore(&xhci->lock, flags);
4149	kfree(command);	4149	xhci_free_command(xhci, command);
4150	return -ENODEV;	4150	return -ENODEV;
4151	}	4151	}
4152		4152
@@ -4154,7 +4154,7 @@ int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id) · 1 unmodified line
4154	slot_id);	4154	slot_id);
4155	if (ret) {	4155	if (ret) {
4156	spin_unlock_irqrestore(&xhci->lock, flags);	4156	spin_unlock_irqrestore(&xhci->lock, flags);
4157	kfree(command);	4157	xhci_free_command(xhci, command);
4158	return ret;	4158	return ret;
4159	}	4159	}
4160	xhci_ring_cmd_db(xhci);	4160	xhci_ring_cmd_db(xhci);

drivers/usb/image/mdc800.c+4−2

 		if (signal_pending (current))
 		{
 			mutex_unlock(&mdc800->io_lock);
-			return -EINTR;
+			return len == left ? -EINTR : len-left;
 		}
 		sts=left > (mdc800->out_count-mdc800->out_ptr)?mdc800->out_count-mdc800->out_ptr:left;
 					mutex_unlock(&mdc800->io_lock);
 					return len-left;
 				}
-				wait_event_timeout(mdc800->download_wait,
+				retval = wait_event_timeout(mdc800->download_wait,
 				     mdc800->downloaded,
 				     msecs_to_jiffies(TO_DOWNLOAD_GET_READY));
+				if (!retval)
+					usb_kill_urb(mdc800->download_urb);
 				mdc800->downloaded = 0;
 				if (mdc800->download_urb->status != 0)
 				{

drivers/usb/misc/uss720.c+1−1

@@ -736,7 +736,7 @@ static int uss720_probe(struct usb_interface *intf, · 735 unmodified lines
736	ret = get_1284_register(pp, 0, &reg, GFP_KERNEL);	736	ret = get_1284_register(pp, 0, &reg, GFP_KERNEL);
737	dev_dbg(&intf->dev, "reg: %7ph\n", priv->reg);	737	dev_dbg(&intf->dev, "reg: %7ph\n", priv->reg);
738	if (ret < 0)	738	if (ret < 0)
739	return ret;	739	goto probe_abort;
740		740
741	ret = usb_find_last_int_in_endpoint(interface, &epd);	741	ret = usb_find_last_int_in_endpoint(interface, &epd);
742	if (!ret) {	742	if (!ret) {

drivers/usb/misc/yurex.c+1−1

 			 dev->int_buffer, YUREX_BUF_SIZE, yurex_interrupt,
 			 dev, 1);
 	dev->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+	dev->bbu = -1;
 	if (usb_submit_urb(dev->urb, GFP_KERNEL)) {
 		retval = -EIO;
 		dev_err(&interface->dev, "Could not submitting URB\n");
 	/* save our data pointer in this interface device */
 	usb_set_intfdata(interface, dev);
-	dev->bbu = -1;
 	/* we can register the device now, as it is ready */
 	retval = usb_register_dev(interface, &yurex_class);

drivers/usb/renesas_usbhs/common.c+9−0

@@ -815,6 +815,15 @@ static void usbhs_remove(struct platform_device *pdev) · 814 unmodified lines
815		815
816	usbhs_platform_call(priv, hardware_exit, pdev);	816	usbhs_platform_call(priv, hardware_exit, pdev);
817	reset_control_assert(priv->rsts);	817	reset_control_assert(priv->rsts);
		818
		819	/*
		820	* Explicitly free the IRQ to ensure the interrupt handler is
		821	* disabled and synchronized before freeing resources.
		822	* devm_free_irq() calls free_irq() which waits for any running
		823	* ISR to complete, preventing UAF.
		824	*/
		825	devm_free_irq(&pdev->dev, priv->irq, priv);
		826
818	usbhs_mod_remove(priv);	827	usbhs_mod_remove(priv);
819	usbhs_fifo_remove(priv);	828	usbhs_fifo_remove(priv);
820	usbhs_pipe_remove(priv);	829	usbhs_pipe_remove(priv);

drivers/usb/roles/class.c+6−1

 static struct usb_role_switch *
 usb_role_switch_is_parent(struct fwnode_handle *fwnode)
 {
-	struct fwnode_handle *parent = fwnode_get_parent(fwnode);
+	struct fwnode_handle *parent;
 	struct device *dev;
+	if (!fwnode_device_is_compatible(fwnode, "usb-b-connector"))
+		return NULL;
+	parent = fwnode_get_parent(fwnode);
 	if (!fwnode_property_present(parent, "usb-role-switch")) {
 		fwnode_handle_put(parent);
 		return NULL;

drivers/usb/typec/altmodes/displayport.c+6−1

 {
 	u8 pin_assign = 0;
 	u32 conf;
+	u32 signal;
 	/* DP Signalling */
-	conf = (dp->data.conf & DP_CONF_SIGNALLING_MASK) >> DP_CONF_SIGNALLING_SHIFT;
+	signal = DP_CAP_DP_SIGNALLING(dp->port->vdo) & DP_CAP_DP_SIGNALLING(dp->alt->vdo);
+	if (dp->plug_prime)
+		signal &= DP_CAP_DP_SIGNALLING(dp->plug_prime->vdo);
+	conf = signal << DP_CONF_SIGNALLING_SHIFT;
 	switch (con) {
 	case DP_STATUS_CON_DISABLED:

drivers/usb/typec/tcpm/tcpm.c+1−1

@@ -7890,7 +7890,7 @@ struct tcpm_port tcpm_register_port(struct device dev, struct tcpc_dev *tcpc) · 7889 unmodified lines
7890	port->partner_desc.identity = &port->partner_ident;	7890	port->partner_desc.identity = &port->partner_ident;
7891		7891
7892	port->role_sw = fwnode_usb_role_switch_get(tcpc->fwnode);	7892	port->role_sw = fwnode_usb_role_switch_get(tcpc->fwnode);
7893	if (IS_ERR_OR_NULL(port->role_sw))	7893	if (!port->role_sw)
7894	port->role_sw = usb_role_switch_get(port->dev);	7894	port->role_sw = usb_role_switch_get(port->dev);
7895	if (IS_ERR(port->role_sw)) {	7895	if (IS_ERR(port->role_sw)) {
7896	err = PTR_ERR(port->role_sw);	7896	err = PTR_ERR(port->role_sw);

fs/btrfs/disk-io.c+6−1

 		}
 	}
-	btrfs_zoned_reserve_data_reloc_bg(fs_info);
 	btrfs_free_zone_cache(fs_info);
 	btrfs_check_active_zone_reservation(fs_info);
 		goto fail_cleaner;
 	}
+	/*
+	 * Starts a transaction, must be called after the transaction kthread
+	 * is initialized.
+	 */
+	btrfs_zoned_reserve_data_reloc_bg(fs_info);
 	ret = btrfs_read_qgroup_config(fs_info);
 	if (ret)
 		goto fail_trans_kthread;

fs/btrfs/extent_io.c+1−0

@@ -4507,6 +4507,7 @@ static int try_release_subpage_extent_buffer(struct folio *folio) · 4506 unmodified lines
4507	*/	4507	*/
4508	if (!test_and_clear_bit(EXTENT_BUFFER_TREE_REF, &eb->bflags)) {	4508	if (!test_and_clear_bit(EXTENT_BUFFER_TREE_REF, &eb->bflags)) {
4509	spin_unlock(&eb->refs_lock);	4509	spin_unlock(&eb->refs_lock);
		4510	rcu_read_lock();
4510	break;	4511	break;
4511	}	4512	}
4512		4513

fs/btrfs/inode.c+19−0

@@ -6612,6 +6612,25 @@ int btrfs_create_new_inode(struct btrfs_trans_handle *trans, · 6611 unmodified lines
6612	int ret;	6612	int ret;
6613	bool xa_reserved = false;	6613	bool xa_reserved = false;
6614		6614
		6615	if (!args->orphan && !args->subvol) {
		6616	/*
		6617	* Before anything else, check if we can add the name to the
		6618	* parent directory. We want to avoid a dir item overflow in
		6619	* case we have an existing dir item due to existing name
		6620	* hash collisions. We do this check here before we call
		6621	* btrfs_add_link() down below so that we can avoid a
		6622	* transaction abort (which could be exploited by malicious
		6623	* users).
		6624	*
		6625	* For subvolumes we already do this in btrfs_mksubvol().
		6626	*/
		6627	ret = btrfs_check_dir_item_collision(BTRFS_I(dir)->root,
		6628	btrfs_ino(BTRFS_I(dir)),
		6629	name);
		6630	if (ret < 0)
		6631	return ret;
		6632	}
		6633
6615	path = btrfs_alloc_path();	6634	path = btrfs_alloc_path();
6616	if (!path)	6635	if (!path)
6617	return -ENOMEM;	6636	return -ENOMEM;

fs/btrfs/ioctl.c+28−4

 		goto out;
 	}
+	/*
+	 * Subvolumes have orphans cleaned on first dentry lookup. A new
+	 * subvolume cannot have any orphans, so we should set the bit before we
+	 * add the subvolume dentry to the dentry cache, so that it is in the
+	 * same state as a subvolume after first lookup.
+	 */
+	set_bit(BTRFS_ROOT_ORPHAN_CLEANUP, &new_root->state);
 	d_instantiate_new(dentry, new_inode_args.inode);
 	new_inode_args.inode = NULL;
 		goto out;
 	}
+	received_uuid_changed = memcmp(root_item->received_uuid, sa->uuid,
+				       BTRFS_UUID_SIZE);
+	/*
+	 * Before we attempt to add the new received uuid, check if we have room
+	 * for it in case there's already an item. If the size of the existing
+	 * item plus this root's ID (u64) exceeds the maximum item size, we can
+	 * return here without the need to abort a transaction. If we don't do
+	 * this check, the btrfs_uuid_tree_add() call below would fail with
+	 * -EOVERFLOW and result in a transaction abort. Malicious users could
+	 * exploit this to turn the fs into RO mode.
+	 */
+	if (received_uuid_changed && !btrfs_is_empty_uuid(sa->uuid)) {
+		ret = btrfs_uuid_tree_check_overflow(fs_info, sa->uuid,
+						     BTRFS_UUID_KEY_RECEIVED_SUBVOL);
+		if (ret < 0)
+			goto out;
+	}
 	/*
 	 * 1 - root item
 	 * 2 - uuid items (received uuid + subvol uuid)
 	sa->rtime.sec = ct.tv_sec;
 	sa->rtime.nsec = ct.tv_nsec;
-	received_uuid_changed = memcmp(root_item->received_uuid, sa->uuid,
-				       BTRFS_UUID_SIZE);
 	if (received_uuid_changed &&
 	    !btrfs_is_empty_uuid(root_item->received_uuid)) {
 		ret = btrfs_uuid_tree_remove(trans, root_item->received_uuid,
 					  BTRFS_UUID_KEY_RECEIVED_SUBVOL,
 					  btrfs_root_id(root));
 		if (unlikely(ret && ret != -ENOENT)) {
-		        btrfs_abort_transaction(trans, ret);
 		        btrfs_end_transaction(trans);
 		        goto out;
 		}
 	ret = btrfs_update_root(trans, fs_info->tree_root,
 				&root->root_key, &root->root_item);
-	if (ret < 0) {
+	if (unlikely(ret < 0)) {
+		btrfs_abort_transaction(trans, ret);
 		btrfs_end_transaction(trans);
 		goto out;
 	}

fs/btrfs/messages.h+0−3

@@ -28,9 +28,6 @@ void _btrfs_printk(const struct btrfs_fs_info *fs_info, unsigned int level, cons · 27 unmodified lines
28		28
29	#else	29	#else
30		30
31	#define btrfs_printk_in_rcu(fs_info, level, fmt, args...) \
32	btrfs_no_printk(fs_info, fmt, ##args)
33
34	#define btrfs_printk_in_rcu(fs_info, level, fmt, args...) \	31	#define btrfs_printk_in_rcu(fs_info, level, fmt, args...) \
35	btrfs_no_printk(fs_info, fmt, ##args)	32	btrfs_no_printk(fs_info, fmt, ##args)
36		33

fs/btrfs/print-tree.c+10−0

 	{ BTRFS_BLOCK_GROUP_TREE_OBJECTID,	"BLOCK_GROUP_TREE"	},
 	{ BTRFS_DATA_RELOC_TREE_OBJECTID,	"DATA_RELOC_TREE"	},
 	{ BTRFS_RAID_STRIPE_TREE_OBJECTID,	"RAID_STRIPE_TREE"	},
+	{ BTRFS_REMAP_TREE_OBJECTID,		"REMAP_TREE"		},
 };
 const char *btrfs_root_name(const struct btrfs_key *key, char *buf)
 		[BTRFS_UUID_KEY_SUBVOL]			= "UUID_KEY_SUBVOL",
 		[BTRFS_UUID_KEY_RECEIVED_SUBVOL]	= "UUID_KEY_RECEIVED_SUBVOL",
 		[BTRFS_RAID_STRIPE_KEY]			= "RAID_STRIPE",
+		[BTRFS_IDENTITY_REMAP_KEY]		= "IDENTITY_REMAP",
+		[BTRFS_REMAP_KEY]			= "REMAP",
+		[BTRFS_REMAP_BACKREF_KEY]		= "REMAP_BACKREF",
 	};
 	if (key->type == 0 && key->objectid == BTRFS_FREE_SPACE_OBJECTID)
 	struct btrfs_extent_data_ref *dref;
 	struct btrfs_shared_data_ref *sref;
 	struct btrfs_dev_extent *dev_extent;
+	struct btrfs_remap_item *remap;
 	struct btrfs_key key;
 	if (!l)
 			print_raid_stripe_key(l, btrfs_item_size(l, i),
 				btrfs_item_ptr(l, i, struct btrfs_stripe_extent));
 			break;
+		case BTRFS_REMAP_KEY:
+		case BTRFS_REMAP_BACKREF_KEY:
+			remap = btrfs_item_ptr(l, i, struct btrfs_remap_item);
+			pr_info("\t\taddress %llu\n", btrfs_remap_address(l, remap));
+			break;
 		}
 	}
 }

fs/btrfs/relocation.c+2−0

@@ -4399,6 +4399,8 @@ static int move_existing_remaps(struct btrfs_fs_info *fs_info, · 4398 unmodified lines
4399		4399
4400	leaf = path->nodes[0];	4400	leaf = path->nodes[0];
4401	}	4401	}
		4402
		4403	btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
4402	}	4404	}
4403		4405
4404	remap = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_remap_item);	4406	remap = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_remap_item);

fs/btrfs/space-info.c+4−1

 		if (!btrfs_should_periodic_reclaim(space_info))
 			continue;
 		for (raid = 0; raid < BTRFS_NR_RAID_TYPES; raid++) {
-			if (do_reclaim_sweep(space_info, raid))
+			if (do_reclaim_sweep(space_info, raid)) {
+				spin_lock(&space_info->lock);
 				btrfs_set_periodic_reclaim_ready(space_info, false);
+				spin_unlock(&space_info->lock);
+			}
 		}
 	}
 }

fs/btrfs/transaction.c+16−0

@@ -1905,6 +1905,22 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans, · 1904 unmodified lines
1905	ret = btrfs_uuid_tree_add(trans, new_root_item->received_uuid,	1905	ret = btrfs_uuid_tree_add(trans, new_root_item->received_uuid,
1906	BTRFS_UUID_KEY_RECEIVED_SUBVOL,	1906	BTRFS_UUID_KEY_RECEIVED_SUBVOL,
1907	objectid);	1907	objectid);
		1908	/*
		1909	* We are creating of lot of snapshots of the same root that was
		1910	* received (has a received UUID) and reached a leaf's limit for
		1911	* an item. We can safely ignore this and avoid a transaction
		1912	* abort. A deletion of this snapshot will still work since we
		1913	* ignore if an item with a BTRFS_UUID_KEY_RECEIVED_SUBVOL key
		1914	* is missing (see btrfs_delete_subvolume()). Send/receive will
		1915	* work too since it peeks the first root id from the existing
		1916	* item (it could peek any), and in case it's missing it
		1917	* falls back to search by BTRFS_UUID_KEY_SUBVOL keys.
		1918	* Creation of a snapshot does not require CAP_SYS_ADMIN, so
		1919	* we don't want users triggering transaction aborts, either
		1920	* intentionally or not.
		1921	*/
		1922	if (ret == -EOVERFLOW)
		1923	ret = 0;
1908	if (unlikely(ret && ret != -EEXIST)) {	1924	if (unlikely(ret && ret != -EEXIST)) {
1909	btrfs_abort_transaction(trans, ret);	1925	btrfs_abort_transaction(trans, ret);
1910	goto fail;	1926	goto fail;

fs/btrfs/tree-checker.c+1−1

@@ -1284,7 +1284,7 @@ static int check_root_item(struct extent_buffer leaf, struct btrfs_key key, · 1283 unmodified lines
1284	}	1284	}
1285	if (unlikely(btrfs_root_drop_level(&ri) >= BTRFS_MAX_LEVEL)) {	1285	if (unlikely(btrfs_root_drop_level(&ri) >= BTRFS_MAX_LEVEL)) {
1286	generic_err(leaf, slot,	1286	generic_err(leaf, slot,
1287	"invalid root level, have %u expect [0, %u]",	1287	"invalid root drop_level, have %u expect [0, %u]",
1288	btrfs_root_drop_level(&ri), BTRFS_MAX_LEVEL - 1);	1288	btrfs_root_drop_level(&ri), BTRFS_MAX_LEVEL - 1);
1289	return -EUCLEAN;	1289	return -EUCLEAN;
1290	}	1290	}

fs/btrfs/tree-log.c+6−0

 				  struct btrfs_root *root,
 				  struct btrfs_log_ctx *ctx)
 {
+	const bool orig_log_new_dentries = ctx->log_new_dentries;
 	int ret = 0;
 	/*
 			 * dir index key range logged for the directory. So we
 			 * must make sure the deletion is recorded.
 			 */
+			ctx->log_new_dentries = false;
 			ret = btrfs_log_inode(trans, inode, LOG_INODE_ALL, ctx);
+			if (!ret && ctx->log_new_dentries)
+				ret = log_new_dir_dentries(trans, inode, ctx);
 			btrfs_add_delayed_iput(inode);
 			if (ret)
 				break;
 			break;
 	}
+	ctx->log_new_dentries = orig_log_new_dentries;
 	ctx->logging_conflict_inodes = false;
 	if (ret)
 		free_conflicting_inodes(ctx);

fs/btrfs/uuid-tree.c+38−0

@@ -199,6 +199,44 @@ int btrfs_uuid_tree_remove(struct btrfs_trans_handle trans, const u8 uuid, u8 · 198 unmodified lines
199	return 0;	199	return 0;
200	}	200	}
201		201
		202	/*
		203	* Check if we can add one root ID to a UUID key.
		204	* If the key does not yet exists, we can, otherwise only if extended item does
		205	* not exceeds the maximum item size permitted by the leaf size.
		206	*
		207	* Returns 0 on success, negative value on error.
		208	*/
		209	int btrfs_uuid_tree_check_overflow(struct btrfs_fs_info *fs_info,
		210	const u8 *uuid, u8 type)
		211	{
		212	BTRFS_PATH_AUTO_FREE(path);
		213	int ret;
		214	u32 item_size;
		215	struct btrfs_key key;
		216
		217	if (WARN_ON_ONCE(!fs_info->uuid_root))
		218	return -EINVAL;
		219
		220	path = btrfs_alloc_path();
		221	if (!path)
		222	return -ENOMEM;
		223
		224	btrfs_uuid_to_key(uuid, type, &key);
		225	ret = btrfs_search_slot(NULL, fs_info->uuid_root, &key, path, 0, 0);
		226	if (ret < 0)
		227	return ret;
		228	if (ret > 0)
		229	return 0;
		230
		231	item_size = btrfs_item_size(path->nodes[0], path->slots[0]);
		232
		233	if (sizeof(struct btrfs_item) + item_size + sizeof(u64) >
		234	BTRFS_LEAF_DATA_SIZE(fs_info))
		235	return -EOVERFLOW;
		236
		237	return 0;
		238	}
		239
202	static int btrfs_uuid_iter_rem(struct btrfs_root uuid_root, u8 uuid, u8 type,	240	static int btrfs_uuid_iter_rem(struct btrfs_root uuid_root, u8 uuid, u8 type,
203	u64 subid)	241	u64 subid)
204	{	242	{

fs/btrfs/uuid-tree.h+2−0

 			u64 subid);
 int btrfs_uuid_tree_remove(struct btrfs_trans_handle *trans, const u8 *uuid, u8 type,
 			u64 subid);
+int btrfs_uuid_tree_check_overflow(struct btrfs_fs_info *fs_info,
+				   const u8 *uuid, u8 type);
 int btrfs_uuid_tree_iterate(struct btrfs_fs_info *fs_info);
 int btrfs_create_uuid_tree(struct btrfs_fs_info *fs_info);
 int btrfs_uuid_scan_kthread(void *data);

fs/btrfs/volumes.c+1−1

@@ -3587,7 +3587,7 @@ int btrfs_relocate_chunk(struct btrfs_fs_info *fs_info, u64 chunk_offset, bool v · 3586 unmodified lines
3587		3587
3588	/* step one, relocate all the extents inside this chunk */	3588	/* step one, relocate all the extents inside this chunk */
3589	btrfs_scrub_pause(fs_info);	3589	btrfs_scrub_pause(fs_info);
3590	ret = btrfs_relocate_block_group(fs_info, chunk_offset, true);	3590	ret = btrfs_relocate_block_group(fs_info, chunk_offset, verbose);
3591	btrfs_scrub_continue(fs_info);	3591	btrfs_scrub_continue(fs_info);
3592	if (ret) {	3592	if (ret) {
3593	/*	3593	/*

fs/btrfs/zoned.c+4−2

 	if (!btrfs_fs_incompat(fs_info, ZONED))
 		return 0;
-	mutex_lock(&fs_devices->device_list_mutex);
+	/*
+	 * No need to take the device_list mutex here, we're still in the mount
+	 * path and devices cannot be added to or removed from the list yet.
+	 */
 	list_for_each_entry(device, &fs_devices->devices, dev_list) {
 		/* We can skip reading of zone info for missing devices */
 		if (!device->bdev)
 		if (ret)
 			break;
 	}
-	mutex_unlock(&fs_devices->device_list_mutex);
 	return ret;
 }

fs/ceph/addr.c+0−1

@@ -1326,7 +1326,6 @@ void ceph_process_folio_batch(struct address_space *mapping, · 1325 unmodified lines
1326	continue;	1326	continue;
1327	} else if (rc == -E2BIG) {	1327	} else if (rc == -E2BIG) {
1328	folio_unlock(folio);	1328	folio_unlock(folio);
1329	ceph_wbc->fbatch.folios[i] = NULL;
1330	break;	1329	break;
1331	}	1330	}
1332		1331

fs/ceph/debugfs.c+2−2

@@ -79,7 +79,7 @@ static int mdsc_show(struct seq_file s, void p) · 78 unmodified lines
79	if (req->r_inode) {	79	if (req->r_inode) {
80	seq_printf(s, " #%llx", ceph_ino(req->r_inode));	80	seq_printf(s, " #%llx", ceph_ino(req->r_inode));
81	} else if (req->r_dentry) {	81	} else if (req->r_dentry) {
82	struct ceph_path_info path_info;	82	struct ceph_path_info path_info = {0};
83	path = ceph_mdsc_build_path(mdsc, req->r_dentry, &path_info, 0);	83	path = ceph_mdsc_build_path(mdsc, req->r_dentry, &path_info, 0);
84	if (IS_ERR(path))	84	if (IS_ERR(path))
85	path = NULL;	85	path = NULL;
@@ -98,7 +98,7 @@ static int mdsc_show(struct seq_file s, void p) · 12 unmodified lines
98	}	98	}
99		99
100	if (req->r_old_dentry) {	100	if (req->r_old_dentry) {
101	struct ceph_path_info path_info;	101	struct ceph_path_info path_info = {0};
102	path = ceph_mdsc_build_path(mdsc, req->r_old_dentry, &path_info, 0);	102	path = ceph_mdsc_build_path(mdsc, req->r_old_dentry, &path_info, 0);
103	if (IS_ERR(path))	103	if (IS_ERR(path))
104	path = NULL;	104	path = NULL;

fs/ceph/dir.c+15−2

@@ -1339,6 +1339,7 @@ static int ceph_unlink(struct inode dir, struct dentry dentry) · 1338 unmodified lines
1339	struct ceph_client *cl = fsc->client;	1339	struct ceph_client *cl = fsc->client;
1340	struct ceph_mds_client *mdsc = fsc->mdsc;	1340	struct ceph_mds_client *mdsc = fsc->mdsc;
1341	struct inode *inode = d_inode(dentry);	1341	struct inode *inode = d_inode(dentry);
		1342	struct ceph_inode_info *ci = ceph_inode(inode);
1342	struct ceph_mds_request *req;	1343	struct ceph_mds_request *req;
1343	bool try_async = ceph_test_mount_opt(fsc, ASYNC_DIROPS);	1344	bool try_async = ceph_test_mount_opt(fsc, ASYNC_DIROPS);
1344	struct dentry *dn;	1345	struct dentry *dn;
@@ -1363,7 +1364,7 @@ static int ceph_unlink(struct inode dir, struct dentry dentry) · 18 unmodified lines
1363	if (!dn) {	1364	if (!dn) {
1364	try_async = false;	1365	try_async = false;
1365	} else {	1366	} else {
1366	struct ceph_path_info path_info;	1367	struct ceph_path_info path_info = {0};
1367	path = ceph_mdsc_build_path(mdsc, dn, &path_info, 0);	1368	path = ceph_mdsc_build_path(mdsc, dn, &path_info, 0);
1368	if (IS_ERR(path)) {	1369	if (IS_ERR(path)) {
1369	try_async = false;	1370	try_async = false;
@@ -1424,7 +1425,19 @@ retry: · 54 unmodified lines
1424	* We have enough caps, so we assume that the unlink	1425	* We have enough caps, so we assume that the unlink
1425	* will succeed. Fix up the target inode and dcache.	1426	* will succeed. Fix up the target inode and dcache.
1426	*/	1427	*/
1427	drop_nlink(inode);	1428
		1429	/*
		1430	* Protect the i_nlink update with i_ceph_lock
		1431	* to precent racing against ceph_fill_inode()
		1432	* handling our completion on a worker thread
		1433	* and don't decrement if i_nlink has already
		1434	* been updated to zero by this completion.
		1435	*/
		1436	spin_lock(&ci->i_ceph_lock);
		1437	if (inode->i_nlink > 0)
		1438	drop_nlink(inode);
		1439	spin_unlock(&ci->i_ceph_lock);
		1440
1428	d_delete(dentry);	1441	d_delete(dentry);
1429	} else {	1442	} else {
1430	spin_lock(&fsc->async_unlink_conflict_lock);	1443	spin_lock(&fsc->async_unlink_conflict_lock);

fs/ceph/file.c+2−2

@@ -397,7 +397,7 @@ int ceph_open(struct inode inode, struct file file) · 396 unmodified lines
397	if (!dentry) {	397	if (!dentry) {
398	do_sync = true;	398	do_sync = true;
399	} else {	399	} else {
400	struct ceph_path_info path_info;	400	struct ceph_path_info path_info = {0};
401	path = ceph_mdsc_build_path(mdsc, dentry, &path_info, 0);	401	path = ceph_mdsc_build_path(mdsc, dentry, &path_info, 0);
402	if (IS_ERR(path)) {	402	if (IS_ERR(path)) {
403	do_sync = true;	403	do_sync = true;
@@ -807,7 +807,7 @@ int ceph_atomic_open(struct inode dir, struct dentry dentry, · 403 unmodified lines
807	if (!dn) {	807	if (!dn) {
808	try_async = false;	808	try_async = false;
809	} else {	809	} else {
810	struct ceph_path_info path_info;	810	struct ceph_path_info path_info = {0};
811	path = ceph_mdsc_build_path(mdsc, dn, &path_info, 0);	811	path = ceph_mdsc_build_path(mdsc, dn, &path_info, 0);
812	if (IS_ERR(path)) {	812	if (IS_ERR(path)) {
813	try_async = false;	813	try_async = false;

fs/ceph/inode.c+1−1

@@ -2551,7 +2551,7 @@ int __ceph_setattr(struct mnt_idmap idmap, struct inode inode, · 2550 unmodified lines
2551	if (!dentry) {	2551	if (!dentry) {
2552	do_sync = true;	2552	do_sync = true;
2553	} else {	2553	} else {
2554	struct ceph_path_info path_info;	2554	struct ceph_path_info path_info = {0};
2555	path = ceph_mdsc_build_path(mdsc, dentry, &path_info, 0);	2555	path = ceph_mdsc_build_path(mdsc, dentry, &path_info, 0);
2556	if (IS_ERR(path)) {	2556	if (IS_ERR(path)) {
2557	do_sync = true;	2557	do_sync = true;

fs/ceph/mds_client.c+3−0

 			if (ret < 0) {
 				dput(parent);
 				dput(cur);
+				__putname(path);
 				return ERR_PTR(ret);
 			}
 				if (len < 0) {
 					dput(parent);
 					dput(cur);
+					__putname(path);
 					return ERR_PTR(len);
 				}
 			}
 		 * cannot ever succeed.  Creating paths that long is
 		 * possible with Ceph, but Linux cannot use them.
 		 */
+		__putname(path);
 		return ERR_PTR(-ENAMETOOLONG);
 	}

fs/nfs/Kconfig+2−1

 	  space programs which can be found in the Linux nfs-utils package,
 	  available from http://linux-nfs.org/.
-	  If unsure, say Y.
+	  If unsure, say N.
 config NFS_SWAP
 	bool "Provide swap over NFS support"
 config NFS_V4_0
 	bool "NFS client support for NFSv4.0"
 	depends on NFS_V4
+	default y
 	help
 	  This option enables support for minor version 0 of the NFSv4 protocol
 	  (RFC 3530) in the kernel's NFS client.

fs/nfs/nfs3proc.c+6−1

 	if (status != 0)
 		goto out_release_acls;
-	if (d_alias)
+	if (d_alias) {
+		if (d_is_dir(d_alias)) {
+			status = -EISDIR;
+			goto out_dput;
+		}
 		dentry = d_alias;
+	}
 	/* When we created the file with exclusive semantics, make
 	 * sure we set the attributes afterwards. */

fs/nfsd/export.c+54−9

  * second map contains a reference to the entry in the first map.
  */
+static struct workqueue_struct *nfsd_export_wq;
 #define	EXPKEY_HASHBITS		8
 #define	EXPKEY_HASHMAX		(1 << EXPKEY_HASHBITS)
 #define	EXPKEY_HASHMASK		(EXPKEY_HASHMAX -1)
-static void expkey_put(struct kref *ref)
+static void expkey_release(struct work_struct *work)
 {
-	struct svc_expkey *key = container_of(ref, struct svc_expkey, h.ref);
+	struct svc_expkey *key = container_of(to_rcu_work(work),
+					      struct svc_expkey, ek_rwork);
 	if (test_bit(CACHE_VALID, &key->h.flags) &&
 	    !test_bit(CACHE_NEGATIVE, &key->h.flags))
 		path_put(&key->ek_path);
 	auth_domain_put(key->ek_client);
-	kfree_rcu(key, ek_rcu);
+	kfree(key);
+}
+static void expkey_put(struct kref *ref)
+{
+	struct svc_expkey *key = container_of(ref, struct svc_expkey, h.ref);
+	INIT_RCU_WORK(&key->ek_rwork, expkey_release);
+	queue_rcu_work(nfsd_export_wq, &key->ek_rwork);
 }
 static int expkey_upcall(struct cache_detail *cd, struct cache_head *h)
 					    EXP_STATS_COUNTERS_NUM);
 }
-static void svc_export_release(struct rcu_head *rcu_head)
+static void svc_export_release(struct work_struct *work)
 {
-	struct svc_export *exp = container_of(rcu_head, struct svc_export,
+	struct svc_export *exp = container_of(to_rcu_work(work),
-			ex_rcu);
+					      struct svc_export, ex_rwork);
+	path_put(&exp->ex_path);
+	auth_domain_put(exp->ex_client);
 	nfsd4_fslocs_free(&exp->ex_fslocs);
 	export_stats_destroy(exp->ex_stats);
 	kfree(exp->ex_stats);
 {
 	struct svc_export *exp = container_of(ref, struct svc_export, h.ref);
-	path_put(&exp->ex_path);
+	INIT_RCU_WORK(&exp->ex_rwork, svc_export_release);
-	auth_domain_put(exp->ex_client);
+	queue_rcu_work(nfsd_export_wq, &exp->ex_rwork);
-	call_rcu(&exp->ex_rcu, svc_export_release);
 }
 static int svc_export_upcall(struct cache_detail *cd, struct cache_head *h)
 	.show	= e_show,
 };
+/**
+ * nfsd_export_wq_init - allocate the export release workqueue
+ *
+ * Called once at module load. The workqueue runs deferred svc_export and
+ * svc_expkey release work scheduled by queue_rcu_work() in the cache put
+ * callbacks.
+ *
+ * Return values:
+ *   %0: workqueue allocated
+ *   %-ENOMEM: allocation failed
+ */
+int nfsd_export_wq_init(void)
+{
+	nfsd_export_wq = alloc_workqueue("nfsd_export", WQ_UNBOUND, 0);
+	if (!nfsd_export_wq)
+		return -ENOMEM;
+	return 0;
+}
+/**
+ * nfsd_export_wq_shutdown - drain and free the export release workqueue
+ *
+ * Called once at module unload. Per-namespace teardown in
+ * nfsd_export_shutdown() has already drained all deferred work.
+ */
+void nfsd_export_wq_shutdown(void)
+{
+	destroy_workqueue(nfsd_export_wq);
+}
 /*
  * Initialize the exports module.
  */
 	cache_unregister_net(nn->svc_expkey_cache, net);
 	cache_unregister_net(nn->svc_export_cache, net);
+	/* Drain deferred export and expkey release work. */
+	rcu_barrier();
+	flush_workqueue(nfsd_export_wq);
 	cache_destroy_net(nn->svc_expkey_cache, net);
 	cache_destroy_net(nn->svc_export_cache, net);
 	svcauth_unix_purge(net);

fs/nfsd/export.h+5−2

 #include <linux/sunrpc/cache.h>
 #include <linux/percpu_counter.h>
+#include <linux/workqueue.h>
 #include <uapi/linux/nfsd/export.h>
 #include <linux/nfs4.h>
 	u32			ex_layout_types;
 	struct nfsd4_deviceid_map *ex_devid_map;
 	struct cache_detail	*cd;
-	struct rcu_head		ex_rcu;
+	struct rcu_work		ex_rwork;
 	unsigned long		ex_xprtsec_modes;
 	struct export_stats	*ex_stats;
 };
 	u32			ek_fsid[6];
 	struct path		ek_path;
-	struct rcu_head		ek_rcu;
+	struct rcu_work		ek_rwork;
 };
 #define EX_ISSYNC(exp)		(!((exp)->ex_flags & NFSEXP_ASYNC))
 /*
  * Function declarations
  */
+int			nfsd_export_wq_init(void);
+void			nfsd_export_wq_shutdown(void);
 int			nfsd_export_init(struct net *);
 void			nfsd_export_shutdown(struct net *);
 void			nfsd_export_flush(struct net *);

fs/nfsd/nfs4xdr.c+7−2

 		int len = xdr->buf->len - (op_status_offset + XDR_UNIT);
 		so->so_replay.rp_status = op->status;
-		so->so_replay.rp_buflen = len;
+		if (len <= NFSD4_REPLAY_ISIZE) {
-		read_bytes_from_xdr_buf(xdr->buf, op_status_offset + XDR_UNIT,
+			so->so_replay.rp_buflen = len;
+			read_bytes_from_xdr_buf(xdr->buf,
+						op_status_offset + XDR_UNIT,
 						so->so_replay.rp_buf, len);
+		} else {
+			so->so_replay.rp_buflen = 0;
+		}
 	}
 status:
 	op->status = nfsd4_map_status(op->status,

fs/nfsd/nfsctl.c+19−3

 	seq = file->private_data;
 	seq->private = nn->svc_export_cache;
+	get_net(net);
 	return 0;
 }
+static int exports_release(struct inode *inode, struct file *file)
+{
+	struct seq_file *seq = file->private_data;
+	struct cache_detail *cd = seq->private;
+	put_net(cd->net);
+	return seq_release(inode, file);
+}
 static int exports_nfsd_open(struct inode *inode, struct file *file)
 {
 	return exports_net_open(inode->i_sb->s_fs_info, file);
 	.open		= exports_nfsd_open,
 	.read		= seq_read,
 	.llseek		= seq_lseek,
-	.release	= seq_release,
+	.release	= exports_release,
 };
 static int export_features_show(struct seq_file *m, void *v)
 	.proc_open	= exports_proc_open,
 	.proc_read	= seq_read,
 	.proc_lseek	= seq_lseek,
-	.proc_release	= seq_release,
+	.proc_release	= exports_release,
 };
 static int create_proc_exports_entry(void)
 	if (retval)
 		goto out_free_pnfs;
 	nfsd_lockd_init();	/* lockd->nfsd callbacks */
+	retval = nfsd_export_wq_init();
+	if (retval)
+		goto out_free_lockd;
 	retval = register_pernet_subsys(&nfsd_net_ops);
 	if (retval < 0)
-		goto out_free_lockd;
+		goto out_free_export_wq;
 	retval = register_cld_notifier();
 	if (retval)
 		goto out_free_subsys;
 	unregister_cld_notifier();
 out_free_subsys:
 	unregister_pernet_subsys(&nfsd_net_ops);
+out_free_export_wq:
+	nfsd_export_wq_shutdown();
 out_free_lockd:
 	nfsd_lockd_shutdown();
 	nfsd_drc_slab_free();
 	nfsd4_destroy_laundry_wq();
 	unregister_cld_notifier();
 	unregister_pernet_subsys(&nfsd_net_ops);
+	nfsd_export_wq_shutdown();
 	nfsd_drc_slab_free();
 	nfsd_lockd_shutdown();
 	nfsd4_free_slabs();

fs/nfsd/state.h+12−5

 	struct xdr_netobj	cr_princhash;
 };
-/* A reasonable value for REPLAY_ISIZE was estimated as follows:
+/*
- * The OPEN response, typically the largest, requires
+ * REPLAY_ISIZE is sized for an OPEN response with delegation:
- *   4(status) + 8(stateid) + 20(changeinfo) + 4(rflags) +  8(verifier) +
+ *   4(status) + 8(stateid) + 20(changeinfo) + 4(rflags) +
- *   4(deleg. type) + 8(deleg. stateid) + 4(deleg. recall flag) +
+ *   8(verifier) + 4(deleg. type) + 8(deleg. stateid) +
- *   20(deleg. space limit) + ~32(deleg. ace) = 112 bytes
+ *   4(deleg. recall flag) + 20(deleg. space limit) +
+ *   ~32(deleg. ace) = 112 bytes
+ *
+ * Some responses can exceed this. A LOCK denial includes the conflicting
+ * lock owner, which can be up to 1024 bytes (NFS4_OPAQUE_LIMIT). Responses
+ * larger than REPLAY_ISIZE are not cached in rp_ibuf; only rp_status is
+ * saved. Enlarging this constant increases the size of every
+ * nfs4_stateowner.
  */
 #define NFSD4_REPLAY_ISIZE       112

fs/smb/client/cifsacl.c+1−1

@@ -1489,7 +1489,7 @@ struct smb_ntsd get_cifs_acl(struct cifs_sb_info cifs_sb, · 1488 unmodified lines
1489	struct cifsFileInfo *open_file = NULL;	1489	struct cifsFileInfo *open_file = NULL;
1490		1490
1491	if (inode)	1491	if (inode)
1492	open_file = find_readable_file(CIFS_I(inode), true);	1492	open_file = find_readable_file(CIFS_I(inode), FIND_FSUID_ONLY);
1493	if (!open_file)	1493	if (!open_file)
1494	return get_cifs_acl_by_path(cifs_sb, path, pacllen, info);	1494	return get_cifs_acl_by_path(cifs_sb, path, pacllen, info);
1495		1495

fs/smb/client/cifsfs.c+1−1

@@ -1269,7 +1269,7 @@ static int cifs_precopy_set_eof(struct inode src_inode, struct cifsInodeInfo s · 1268 unmodified lines
1269	struct cifsFileInfo *writeable_srcfile;	1269	struct cifsFileInfo *writeable_srcfile;
1270	int rc = -EINVAL;	1270	int rc = -EINVAL;
1271		1271
1272	writeable_srcfile = find_writable_file(src_cifsi, FIND_WR_FSUID_ONLY);	1272	writeable_srcfile = find_writable_file(src_cifsi, FIND_FSUID_ONLY);
1273	if (writeable_srcfile) {	1273	if (writeable_srcfile) {
1274	if (src_tcon->ses->server->ops->set_file_size)	1274	if (src_tcon->ses->server->ops->set_file_size)
1275	rc = src_tcon->ses->server->ops->set_file_size(	1275	rc = src_tcon->ses->server->ops->set_file_size(

fs/smb/client/cifsglob.h+17−6

 #include <linux/utsname.h>
 #include <linux/sched/mm.h>
 #include <linux/netfs.h>
+#include <linux/fcntl.h>
 #include "cifs_fs_sb.h"
 #include "cifsacl.h"
 #include <crypto/internal/hash.h>
 }
-/* cifs_get_writable_file() flags */
+enum cifs_find_flags {
-enum cifs_writable_file_flags {
+	FIND_ANY		= 0U,
-	FIND_WR_ANY			= 0U,
+	FIND_FSUID_ONLY		= (1U << 0),
-	FIND_WR_FSUID_ONLY		= (1U << 0),
+	FIND_WITH_DELETE	= (1U << 1),
-	FIND_WR_WITH_DELETE		= (1U << 1),
+	FIND_NO_PENDING_DELETE	= (1U << 2),
-	FIND_WR_NO_PENDING_DELETE	= (1U << 2),
+	FIND_OPEN_FLAGS		= (1U << 3),
 };
 #define   MID_FREE 0
 	return cifs_sb_flags(sbi) & CIFS_MOUNT_SHUTDOWN;
 }
+static inline int cifs_open_create_options(unsigned int oflags, int opts)
+{
+	/* O_SYNC also has bit for O_DSYNC so following check picks up either */
+	if (oflags & O_SYNC)
+		opts |= CREATE_WRITE_THROUGH;
+	if (oflags & O_DIRECT)
+		opts |= CREATE_NO_BUFFER;
+	return opts;
+}
 #endif	/* _CIFS_GLOB_H */

fs/smb/client/cifsproto.h+22−4

@@ -138,12 +138,14 @@ void cifs_write_subrequest_terminated(struct cifs_io_subrequest *wdata, · 137 unmodified lines
138	ssize_t result);	138	ssize_t result);
139	struct cifsFileInfo find_writable_file(struct cifsInodeInfo cifs_inode,	139	struct cifsFileInfo find_writable_file(struct cifsInodeInfo cifs_inode,
140	int flags);	140	int flags);
141	int cifs_get_writable_file(struct cifsInodeInfo *cifs_inode, int flags,	141	int __cifs_get_writable_file(struct cifsInodeInfo *cifs_inode,
142	struct cifsFileInfo **ret_file);	142	unsigned int find_flags, unsigned int open_flags,
		143	struct cifsFileInfo **ret_file);
143	int cifs_get_writable_path(struct cifs_tcon tcon, const char name, int flags,	144	int cifs_get_writable_path(struct cifs_tcon tcon, const char name, int flags,
144	struct cifsFileInfo **ret_file);	145	struct cifsFileInfo **ret_file);
145	struct cifsFileInfo find_readable_file(struct cifsInodeInfo cifs_inode,	146	struct cifsFileInfo __find_readable_file(struct cifsInodeInfo cifs_inode,
146	bool fsuid_only);	147	unsigned int find_flags,
		148	unsigned int open_flags);
147	int cifs_get_readable_path(struct cifs_tcon tcon, const char name,	149	int cifs_get_readable_path(struct cifs_tcon tcon, const char name,
148	struct cifsFileInfo **ret_file);	150	struct cifsFileInfo **ret_file);
149	int cifs_get_hardlink_path(struct cifs_tcon tcon, struct inode inode,	151	int cifs_get_hardlink_path(struct cifs_tcon tcon, struct inode inode,
@@ -596,4 +598,20 @@ static inline void cifs_sg_set_buf(struct sg_table *sgtable, · 446 unmodified lines
596	}	598	}
597	}	599	}
598		600
		601	static inline int cifs_get_writable_file(struct cifsInodeInfo *cifs_inode,
		602	unsigned int find_flags,
		603	struct cifsFileInfo **ret_file)
		604	{
		605	find_flags &= ~FIND_OPEN_FLAGS;
		606	return __cifs_get_writable_file(cifs_inode, find_flags, 0, ret_file);
		607	}
		608
		609	static inline struct cifsFileInfo *
		610	find_readable_file(struct cifsInodeInfo *cinode, unsigned int find_flags)
		611	{
		612	find_flags &= ~FIND_OPEN_FLAGS;
		613	find_flags \|= FIND_NO_PENDING_DELETE;
		614	return __find_readable_file(cinode, find_flags, 0);
		615	}
		616
599	#endif /* _CIFSPROTO_H */	617	#endif /* _CIFSPROTO_H */

fs/smb/client/dir.c+2−2

 	const char *full_path;
 	void *page = alloc_dentry_path();
 	struct inode *newinode = NULL;
-	unsigned int sbflags;
+	unsigned int sbflags = cifs_sb_flags(cifs_sb);
 	int disposition;
 	struct TCP_Server_Info *server = tcon->ses->server;
 	struct cifs_open_parms oparms;
 		goto out;
 	}
+	create_options |= cifs_open_create_options(oflags, create_options);
 	/*
 	 * if we're not using unix extensions, see if we need to set
 	 * ATTR_READONLY on the create call
 	 * If Open reported that we actually created a file then we now have to
 	 * set the mode if possible.
 	 */
-	sbflags = cifs_sb_flags(cifs_sb);
 	if ((tcon->unix_ext) && (*oplock & CIFS_CREATE_ACTION)) {
 		struct cifs_unix_set_info_args args = {
 				.mode	= mode,

fs/smb/client/file.c+70−61

@@ -255,7 +255,7 @@ static void cifs_begin_writeback(struct netfs_io_request *wreq) · 254 unmodified lines
255	struct cifs_io_request *req = container_of(wreq, struct cifs_io_request, rreq);	255	struct cifs_io_request *req = container_of(wreq, struct cifs_io_request, rreq);
256	int ret;	256	int ret;
257		257
258	ret = cifs_get_writable_file(CIFS_I(wreq->inode), FIND_WR_ANY, &req->cfile);	258	ret = cifs_get_writable_file(CIFS_I(wreq->inode), FIND_ANY, &req->cfile);
259	if (ret) {	259	if (ret) {
260	cifs_dbg(VFS, "No writable handle in writepages ret=%d\n", ret);	260	cifs_dbg(VFS, "No writable handle in writepages ret=%d\n", ret);
261	return;	261	return;
@@ -584,15 +584,8 @@ static int cifs_nt_open(const char full_path, struct inode inode, struct cifs_ · 322 unmodified lines
584	*********************************************************************/	584	*********************************************************************/
585		585
586	disposition = cifs_get_disposition(f_flags);	586	disposition = cifs_get_disposition(f_flags);
587
588	/* BB pass O_SYNC flag through on file attributes .. BB */	587	/* BB pass O_SYNC flag through on file attributes .. BB */
589		588	create_options \|= cifs_open_create_options(f_flags, create_options);
590	/* O_SYNC also has bit for O_DSYNC so following check picks up either */
591	if (f_flags & O_SYNC)
592	create_options \|= CREATE_WRITE_THROUGH;
593
594	if (f_flags & O_DIRECT)
595	create_options \|= CREATE_NO_BUFFER;
596		589
597	retry_open:	590	retry_open:
598	oparms = (struct cifs_open_parms) {	591	oparms = (struct cifs_open_parms) {
@@ -963,7 +956,7 @@ int cifs_file_flush(const unsigned int xid, struct inode *inode, · 364 unmodified lines
963	return tcon->ses->server->ops->flush(xid, tcon,	956	return tcon->ses->server->ops->flush(xid, tcon,
964	&cfile->fid);	957	&cfile->fid);
965	}	958	}
966	rc = cifs_get_writable_file(CIFS_I(inode), FIND_WR_ANY, &cfile);	959	rc = cifs_get_writable_file(CIFS_I(inode), FIND_ANY, &cfile);
967	if (!rc) {	960	if (!rc) {
968	tcon = tlink_tcon(cfile->tlink);	961	tcon = tlink_tcon(cfile->tlink);
969	rc = tcon->ses->server->ops->flush(xid, tcon, &cfile->fid);	962	rc = tcon->ses->server->ops->flush(xid, tcon, &cfile->fid);
@@ -988,7 +981,7 @@ static int cifs_do_truncate(const unsigned int xid, struct dentry *dentry) · 18 unmodified lines
988	return -ERESTARTSYS;	981	return -ERESTARTSYS;
989	mapping_set_error(inode->i_mapping, rc);	982	mapping_set_error(inode->i_mapping, rc);
990		983
991	cfile = find_writable_file(cinode, FIND_WR_FSUID_ONLY);	984	cfile = find_writable_file(cinode, FIND_FSUID_ONLY);
992	rc = cifs_file_flush(xid, inode, cfile);	985	rc = cifs_file_flush(xid, inode, cfile);
993	if (!rc) {	986	if (!rc) {
994	if (cfile) {	987	if (cfile) {
@@ -1068,32 +1061,29 @@ int cifs_open(struct inode inode, struct file file) · 73 unmodified lines
1068		1061
1069	/* Get the cached handle as SMB2 close is deferred */	1062	/* Get the cached handle as SMB2 close is deferred */
1070	if (OPEN_FMODE(file->f_flags) & FMODE_WRITE) {	1063	if (OPEN_FMODE(file->f_flags) & FMODE_WRITE) {
1071	rc = cifs_get_writable_path(tcon, full_path,	1064	rc = __cifs_get_writable_file(CIFS_I(inode),
1072	FIND_WR_FSUID_ONLY \|	1065	FIND_FSUID_ONLY \|
1073	FIND_WR_NO_PENDING_DELETE,	1066	FIND_NO_PENDING_DELETE \|
1074	&cfile);	1067	FIND_OPEN_FLAGS,
		1068	file->f_flags, &cfile);
1075	} else {	1069	} else {
1076	rc = cifs_get_readable_path(tcon, full_path, &cfile);	1070	cfile = __find_readable_file(CIFS_I(inode),
		1071	FIND_NO_PENDING_DELETE \|
		1072	FIND_OPEN_FLAGS,
		1073	file->f_flags);
		1074	rc = cfile ? 0 : -ENOENT;
1077	}	1075	}
1078	if (rc == 0) {	1076	if (rc == 0) {
1079	unsigned int oflags = file->f_flags & ~(O_CREAT\|O_EXCL\|O_TRUNC);	1077	file->private_data = cfile;
1080	unsigned int cflags = cfile->f_flags & ~(O_CREAT\|O_EXCL\|O_TRUNC);	1078	spin_lock(&CIFS_I(inode)->deferred_lock);
1081		1079	cifs_del_deferred_close(cfile);
1082	if (cifs_convert_flags(oflags, 0) == cifs_convert_flags(cflags, 0) &&	1080	spin_unlock(&CIFS_I(inode)->deferred_lock);
1083	(oflags & (O_SYNC\|O_DIRECT)) == (cflags & (O_SYNC\|O_DIRECT))) {	1081	goto use_cache;
1084	file->private_data = cfile;	1082	}
1085	spin_lock(&CIFS_I(inode)->deferred_lock);	1083	/* hard link on the deferred close file */
1086	cifs_del_deferred_close(cfile);	1084	rc = cifs_get_hardlink_path(tcon, inode, file);
1087	spin_unlock(&CIFS_I(inode)->deferred_lock);	1085	if (rc)
1088	goto use_cache;	1086	cifs_close_deferred_file(CIFS_I(inode));
1089	}
1090	_cifsFileInfo_put(cfile, true, false);
1091	} else {
1092	/* hard link on the defeered close file */
1093	rc = cifs_get_hardlink_path(tcon, inode, file);
1094	if (rc)
1095	cifs_close_deferred_file(CIFS_I(inode));
1096	}
1097		1087
1098	if (server->oplocks)	1088	if (server->oplocks)
1099	oplock = REQ_OPLOCK;	1089	oplock = REQ_OPLOCK;
@@ -1314,13 +1304,8 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush) · 214 unmodified lines
1314	rdwr_for_fscache = 1;	1304	rdwr_for_fscache = 1;
1315		1305
1316	desired_access = cifs_convert_flags(cfile->f_flags, rdwr_for_fscache);	1306	desired_access = cifs_convert_flags(cfile->f_flags, rdwr_for_fscache);
1317		1307	create_options \|= cifs_open_create_options(cfile->f_flags,
1318	/* O_SYNC also has bit for O_DSYNC so following check picks up either */	1308	create_options);
1319	if (cfile->f_flags & O_SYNC)
1320	create_options \|= CREATE_WRITE_THROUGH;
1321
1322	if (cfile->f_flags & O_DIRECT)
1323	create_options \|= CREATE_NO_BUFFER;
1324		1309
1325	if (server->ops->get_lease_key)	1310	if (server->ops->get_lease_key)
1326	server->ops->get_lease_key(inode, &cfile->fid);	1311	server->ops->get_lease_key(inode, &cfile->fid);
@@ -2524,10 +2509,33 @@ void cifs_write_subrequest_terminated(struct cifs_io_subrequest *wdata, ssize_t · 1197 unmodified lines
2524	netfs_write_subrequest_terminated(&wdata->subreq, result);	2509	netfs_write_subrequest_terminated(&wdata->subreq, result);
2525	}	2510	}
2526		2511
2527	struct cifsFileInfo find_readable_file(struct cifsInodeInfo cifs_inode,	2512	static bool open_flags_match(struct cifsInodeInfo *cinode,
2528	bool fsuid_only)	2513	unsigned int oflags, unsigned int cflags)
		2514	{
		2515	struct inode *inode = &cinode->netfs.inode;
		2516	int crw = 0, orw = 0;
		2517
		2518	oflags &= ~(O_CREAT \| O_EXCL \| O_TRUNC);
		2519	cflags &= ~(O_CREAT \| O_EXCL \| O_TRUNC);
		2520
		2521	if (cifs_fscache_enabled(inode)) {
		2522	if (OPEN_FMODE(cflags) & FMODE_WRITE)
		2523	crw = 1;
		2524	if (OPEN_FMODE(oflags) & FMODE_WRITE)
		2525	orw = 1;
		2526	}
		2527	if (cifs_convert_flags(oflags, orw) != cifs_convert_flags(cflags, crw))
		2528	return false;
		2529
		2530	return (oflags & (O_SYNC \| O_DIRECT)) == (cflags & (O_SYNC \| O_DIRECT));
		2531	}
		2532
		2533	struct cifsFileInfo __find_readable_file(struct cifsInodeInfo cifs_inode,
		2534	unsigned int find_flags,
		2535	unsigned int open_flags)
2529	{	2536	{
2530	struct cifs_sb_info *cifs_sb = CIFS_SB(cifs_inode);	2537	struct cifs_sb_info *cifs_sb = CIFS_SB(cifs_inode);
		2538	bool fsuid_only = find_flags & FIND_FSUID_ONLY;
2531	struct cifsFileInfo *open_file = NULL;	2539	struct cifsFileInfo *open_file = NULL;
2532		2540
2533	/* only filter by fsuid on multiuser mounts */	2541	/* only filter by fsuid on multiuser mounts */
@@ -2541,6 +2549,13 @@ struct cifsFileInfo find_readable_file(struct cifsInodeInfo cifs_inode, · 7 unmodified lines
2541	list_for_each_entry(open_file, &cifs_inode->openFileList, flist) {	2549	list_for_each_entry(open_file, &cifs_inode->openFileList, flist) {
2542	if (fsuid_only && !uid_eq(open_file->uid, current_fsuid()))	2550	if (fsuid_only && !uid_eq(open_file->uid, current_fsuid()))
2543	continue;	2551	continue;
		2552	if ((find_flags & FIND_NO_PENDING_DELETE) &&
		2553	open_file->status_file_deleted)
		2554	continue;
		2555	if ((find_flags & FIND_OPEN_FLAGS) &&
		2556	!open_flags_match(cifs_inode, open_flags,
		2557	open_file->f_flags))
		2558	continue;
2544	if (OPEN_FMODE(open_file->f_flags) & FMODE_READ) {	2559	if (OPEN_FMODE(open_file->f_flags) & FMODE_READ) {
2545	if ((!open_file->invalidHandle)) {	2560	if ((!open_file->invalidHandle)) {
2546	/* found a good file */	2561	/* found a good file */
@@ -2559,17 +2574,17 @@ struct cifsFileInfo find_readable_file(struct cifsInodeInfo cifs_inode, · 12 unmodified lines
2559	}	2574	}
2560		2575
2561	/* Return -EBADF if no handle is found and general rc otherwise */	2576	/* Return -EBADF if no handle is found and general rc otherwise */
2562	int	2577	int __cifs_get_writable_file(struct cifsInodeInfo *cifs_inode,
2563	cifs_get_writable_file(struct cifsInodeInfo *cifs_inode, int flags,	2578	unsigned int find_flags, unsigned int open_flags,
2564	struct cifsFileInfo **ret_file)	2579	struct cifsFileInfo **ret_file)
2565	{	2580	{
2566	struct cifsFileInfo open_file, inv_file = NULL;	2581	struct cifsFileInfo open_file, inv_file = NULL;
2567	struct cifs_sb_info *cifs_sb;	2582	struct cifs_sb_info *cifs_sb;
2568	bool any_available = false;	2583	bool any_available = false;
2569	int rc = -EBADF;	2584	int rc = -EBADF;
2570	unsigned int refind = 0;	2585	unsigned int refind = 0;
2571	bool fsuid_only = flags & FIND_WR_FSUID_ONLY;	2586	bool fsuid_only = find_flags & FIND_FSUID_ONLY;
2572	bool with_delete = flags & FIND_WR_WITH_DELETE;	2587	bool with_delete = find_flags & FIND_WITH_DELETE;
2573	*ret_file = NULL;	2588	*ret_file = NULL;
2574		2589
2575	/*	2590	/*
@@ -2603,9 +2618,13 @@ refind_writable: · 27 unmodified lines
2603	continue;	2618	continue;
2604	if (with_delete && !(open_file->fid.access & DELETE))	2619	if (with_delete && !(open_file->fid.access & DELETE))
2605	continue;	2620	continue;
2606	if ((flags & FIND_WR_NO_PENDING_DELETE) &&	2621	if ((find_flags & FIND_NO_PENDING_DELETE) &&
2607	open_file->status_file_deleted)	2622	open_file->status_file_deleted)
2608	continue;	2623	continue;
		2624	if ((find_flags & FIND_OPEN_FLAGS) &&
		2625	!open_flags_match(cifs_inode, open_flags,
		2626	open_file->f_flags))
		2627	continue;
2609	if (OPEN_FMODE(open_file->f_flags) & FMODE_WRITE) {	2628	if (OPEN_FMODE(open_file->f_flags) & FMODE_WRITE) {
2610	if (!open_file->invalidHandle) {	2629	if (!open_file->invalidHandle) {
2611	/* found a good writable file */	2630	/* found a good writable file */
@@ -2722,17 +2741,7 @@ cifs_get_readable_path(struct cifs_tcon tcon, const char name, · 110 unmodified lines
2722	cinode = CIFS_I(d_inode(cfile->dentry));	2741	cinode = CIFS_I(d_inode(cfile->dentry));
2723	spin_unlock(&tcon->open_file_lock);	2742	spin_unlock(&tcon->open_file_lock);
2724	free_dentry_path(page);	2743	free_dentry_path(page);
2725	*ret_file = find_readable_file(cinode, 0);	2744	*ret_file = find_readable_file(cinode, FIND_ANY);
2726	if (*ret_file) {
2727	spin_lock(&cinode->open_file_lock);
2728	if ((*ret_file)->status_file_deleted) {
2729	spin_unlock(&cinode->open_file_lock);
2730	cifsFileInfo_put(*ret_file);
2731	*ret_file = NULL;
2732	} else {
2733	spin_unlock(&cinode->open_file_lock);
2734	}
2735	}
2736	return *ret_file ? 0 : -ENOENT;	2745	return *ret_file ? 0 : -ENOENT;
2737	}	2746	}
2738		2747
@@ -2804,7 +2813,7 @@ int cifs_fsync(struct file *file, loff_t start, loff_t end, int datasync) · 65 unmodified lines
2804	}	2813	}
2805		2814
2806	if ((OPEN_FMODE(smbfile->f_flags) & FMODE_WRITE) == 0) {	2815	if ((OPEN_FMODE(smbfile->f_flags) & FMODE_WRITE) == 0) {
2807	smbfile = find_writable_file(CIFS_I(inode), FIND_WR_ANY);	2816	smbfile = find_writable_file(CIFS_I(inode), FIND_ANY);
2808	if (smbfile) {	2817	if (smbfile) {
2809	rc = server->ops->flush(xid, tcon, &smbfile->fid);	2818	rc = server->ops->flush(xid, tcon, &smbfile->fid);
2810	cifsFileInfo_put(smbfile);	2819	cifsFileInfo_put(smbfile);

fs/smb/client/fs_context.c+1−1

@@ -1997,7 +1997,7 @@ int smb3_init_fs_context(struct fs_context *fc) · 1996 unmodified lines
1997	ctx->backupuid_specified = false; /* no backup intent for a user */	1997	ctx->backupuid_specified = false; /* no backup intent for a user */
1998	ctx->backupgid_specified = false; /* no backup intent for a group */	1998	ctx->backupgid_specified = false; /* no backup intent for a group */
1999		1999
2000	ctx->retrans = 1;	2000	ctx->retrans = 0;
2001	ctx->reparse_type = CIFS_REPARSE_TYPE_DEFAULT;	2001	ctx->reparse_type = CIFS_REPARSE_TYPE_DEFAULT;
2002	ctx->symlink_type = CIFS_SYMLINK_TYPE_DEFAULT;	2002	ctx->symlink_type = CIFS_SYMLINK_TYPE_DEFAULT;
2003	ctx->nonativesocket = 0;	2003	ctx->nonativesocket = 0;

fs/smb/client/inode.c+3−3

@@ -2997,7 +2997,7 @@ int cifs_fiemap(struct inode inode, struct fiemap_extent_info fei, u64 start, · 2996 unmodified lines
2997	}	2997	}
2998	}	2998	}
2999		2999
3000	cfile = find_readable_file(cifs_i, false);	3000	cfile = find_readable_file(cifs_i, FIND_ANY);
3001	if (cfile == NULL)	3001	if (cfile == NULL)
3002	return -EINVAL;	3002	return -EINVAL;
3003		3003
@@ -3050,7 +3050,7 @@ int cifs_file_set_size(const unsigned int xid, struct dentry *dentry, · 46 unmodified lines
3050	size, false);	3050	size, false);
3051	cifs_dbg(FYI, "%s: set_file_size: rc = %d\n", __func__, rc);	3051	cifs_dbg(FYI, "%s: set_file_size: rc = %d\n", __func__, rc);
3052	} else {	3052	} else {
3053	open_file = find_writable_file(cifsInode, FIND_WR_FSUID_ONLY);	3053	open_file = find_writable_file(cifsInode, FIND_FSUID_ONLY);
3054	if (open_file) {	3054	if (open_file) {
3055	tcon = tlink_tcon(open_file->tlink);	3055	tcon = tlink_tcon(open_file->tlink);
3056	server = tcon->ses->server;	3056	server = tcon->ses->server;
@@ -3219,7 +3219,7 @@ cifs_setattr_unix(struct dentry direntry, struct iattr attrs) · 162 unmodified lines
3219	open_file->fid.netfid,	3219	open_file->fid.netfid,
3220	open_file->pid);	3220	open_file->pid);
3221	} else {	3221	} else {
3222	open_file = find_writable_file(cifsInode, FIND_WR_FSUID_ONLY);	3222	open_file = find_writable_file(cifsInode, FIND_FSUID_ONLY);
3223	if (open_file) {	3223	if (open_file) {
3224	pTcon = tlink_tcon(open_file->tlink);	3224	pTcon = tlink_tcon(open_file->tlink);
3225	rc = CIFSSMBUnixSetFileInfo(xid, pTcon, args,	3225	rc = CIFSSMBUnixSetFileInfo(xid, pTcon, args,

fs/smb/client/smb1ops.c+1−1

@@ -960,7 +960,7 @@ smb_set_file_info(struct inode inode, const char full_path, · 959 unmodified lines
960	struct cifs_tcon *tcon;	960	struct cifs_tcon *tcon;
961		961
962	/* if the file is already open for write, just use that fileid */	962	/* if the file is already open for write, just use that fileid */
963	open_file = find_writable_file(cinode, FIND_WR_FSUID_ONLY);	963	open_file = find_writable_file(cinode, FIND_FSUID_ONLY);
964		964
965	if (open_file) {	965	if (open_file) {
966	fid.netfid = open_file->fid.netfid;	966	fid.netfid = open_file->fid.netfid;

fs/smb/client/smb2inode.c+10−12

 	cifs_i = CIFS_I(inode);
 	dosattrs = cifs_i->cifsAttrs | ATTR_READONLY;
 	data.Attributes = cpu_to_le32(dosattrs);
-	cifs_get_writable_path(tcon, name, FIND_WR_ANY, &cfile);
+	cifs_get_writable_path(tcon, name, FIND_ANY, &cfile);
 	oparms = CIFS_OPARMS(cifs_sb, tcon, name, FILE_WRITE_ATTRIBUTES,
 			     FILE_CREATE, CREATE_NOT_FILE, ACL_NO_MODE);
 	tmprc = smb2_compound_op(xid, tcon, cifs_sb, name,
 	__u32 co = file_create_options(source_dentry);
 	drop_cached_dir_by_name(xid, tcon, from_name, cifs_sb);
-	cifs_get_writable_path(tcon, from_name, FIND_WR_WITH_DELETE, &cfile);
+	cifs_get_writable_path(tcon, from_name, FIND_WITH_DELETE, &cfile);
 	int rc = smb2_set_path_attr(xid, tcon, from_name, to_name, cifs_sb,
 				  co, DELETE, SMB2_OP_RENAME, cfile, source_dentry);
 	if (rc == -EINVAL) {
 		cifs_dbg(FYI, "invalid lease key, resending request without lease");
-		cifs_get_writable_path(tcon, from_name,
+		cifs_get_writable_path(tcon, from_name, FIND_WITH_DELETE, &cfile);
-				       FIND_WR_WITH_DELETE, &cfile);
 		rc = smb2_set_path_attr(xid, tcon, from_name, to_name, cifs_sb,
 				  co, DELETE, SMB2_OP_RENAME, cfile, NULL);
 	}
 	in_iov.iov_base = &eof;
 	in_iov.iov_len = sizeof(eof);
-	cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile);
+	cifs_get_writable_path(tcon, full_path, FIND_ANY, &cfile);
 	oparms = CIFS_OPARMS(cifs_sb, tcon, full_path, FILE_WRITE_DATA,
 			     FILE_OPEN, 0, ACL_NO_MODE);
 			      cfile, NULL, NULL, dentry);
 	if (rc == -EINVAL) {
 		cifs_dbg(FYI, "invalid lease key, resending request without lease");
-		cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile);
+		cifs_get_writable_path(tcon, full_path, FIND_ANY, &cfile);
 		rc = smb2_compound_op(xid, tcon, cifs_sb,
 				      full_path, &oparms, &in_iov,
 				      &(int){SMB2_OP_SET_EOF}, 1,
 	    (buf->LastWriteTime == 0) && (buf->ChangeTime == 0)) {
 		if (buf->Attributes == 0)
 			goto out; /* would be a no op, no sense sending this */
-		cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile);
+		cifs_get_writable_path(tcon, full_path, FIND_ANY, &cfile);
 	}
 	oparms = CIFS_OPARMS(cifs_sb, tcon, full_path, FILE_WRITE_ATTRIBUTES,
 	if (tcon->posix_extensions) {
 		cmds[1] = SMB2_OP_POSIX_QUERY_INFO;
-		cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile);
+		cifs_get_writable_path(tcon, full_path, FIND_ANY, &cfile);
 		rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, &oparms,
 				      in_iov, cmds, 2, cfile, out_iov, out_buftype, NULL);
 		if (!rc) {
 		}
 	} else {
 		cmds[1] = SMB2_OP_QUERY_INFO;
-		cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile);
+		cifs_get_writable_path(tcon, full_path, FIND_ANY, &cfile);
 		rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, &oparms,
 				      in_iov, cmds, 2, cfile, out_iov, out_buftype, NULL);
 		if (!rc) {
 	iov[1].iov_base = utf16_path;
 	iov[1].iov_len = sizeof(*utf16_path) * UniStrlen((wchar_t *)utf16_path);
-	cifs_get_writable_path(tcon, full_path, FIND_WR_WITH_DELETE, &cfile);
+	cifs_get_writable_path(tcon, full_path, FIND_WITH_DELETE, &cfile);
 	rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, &oparms, iov,
 			      cmds, num_cmds, cfile, NULL, NULL, dentry);
 	if (rc == -EINVAL) {
 		cifs_dbg(FYI, "invalid lease key, resending request without lease\n");
-		cifs_get_writable_path(tcon, full_path,
+		cifs_get_writable_path(tcon, full_path, FIND_WITH_DELETE, &cfile);
-				       FIND_WR_WITH_DELETE, &cfile);
 		rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, &oparms, iov,
 				      cmds, num_cmds, cfile, NULL, NULL, NULL);
 	}

fs/smb/client/smb2maperror.c+6−3

 }
 #if IS_ENABLED(CONFIG_SMB_KUNIT_TESTS)
+#define EXPORT_SYMBOL_FOR_SMB_TEST(sym) \
+	EXPORT_SYMBOL_FOR_MODULES(sym, "smb2maperror_test")
 /* Previous prototype for eliminating the build warning. */
 const struct status_to_posix_error *smb2_get_err_map_test(__u32 smb2_status);
 {
 	return smb2_get_err_map(smb2_status);
 }
-EXPORT_SYMBOL_GPL(smb2_get_err_map_test);
+EXPORT_SYMBOL_FOR_SMB_TEST(smb2_get_err_map_test);
 const struct status_to_posix_error *smb2_error_map_table_test = smb2_error_map_table;
-EXPORT_SYMBOL_GPL(smb2_error_map_table_test);
+EXPORT_SYMBOL_FOR_SMB_TEST(smb2_error_map_table_test);
 unsigned int smb2_error_map_num = ARRAY_SIZE(smb2_error_map_table);
-EXPORT_SYMBOL_GPL(smb2_error_map_num);
+EXPORT_SYMBOL_FOR_SMB_TEST(smb2_error_map_num);
 #endif

fs/smb/client/smb2ops.c+14−4

 	struct smb_sockaddr_in6 *p6;
 	struct cifs_server_iface *info = NULL, *iface = NULL, *niface = NULL;
 	struct cifs_server_iface tmp_iface;
+	__be16 port;
 	ssize_t bytes_left;
 	size_t next = 0;
 	int nb_iface = 0;
 		goto out;
 	}
+	spin_lock(&ses->server->srv_lock);
+	if (ses->server->dstaddr.ss_family == AF_INET)
+		port = ((struct sockaddr_in *)&ses->server->dstaddr)->sin_port;
+	else if (ses->server->dstaddr.ss_family == AF_INET6)
+		port = ((struct sockaddr_in6 *)&ses->server->dstaddr)->sin6_port;
+	else
+		port = cpu_to_be16(CIFS_PORT);
+	spin_unlock(&ses->server->srv_lock);
 	while (bytes_left >= (ssize_t)sizeof(*p)) {
 		memset(&tmp_iface, 0, sizeof(tmp_iface));
 		/* default to 1Gbps when link speed is unset */
 			memcpy(&addr4->sin_addr, &p4->IPv4Address, 4);
 			/* [MS-SMB2] 2.2.32.5.1.1 Clients MUST ignore these */
-			addr4->sin_port = cpu_to_be16(CIFS_PORT);
+			addr4->sin_port = port;
 			cifs_dbg(FYI, "%s: ipv4 %pI4\n", __func__,
 				 &addr4->sin_addr);
 			/* [MS-SMB2] 2.2.32.5.1.2 Clients MUST ignore these */
 			addr6->sin6_flowinfo = 0;
 			addr6->sin6_scope_id = 0;
-			addr6->sin6_port = cpu_to_be16(CIFS_PORT);
+			addr6->sin6_port = port;
 			cifs_dbg(FYI, "%s: ipv6 %pI6\n", __func__,
 				 &addr6->sin6_addr);
 	struct cifsFileInfo *open_file = NULL;
 	if (inode && !(info & SACL_SECINFO))
-		open_file = find_readable_file(CIFS_I(inode), true);
+		open_file = find_readable_file(CIFS_I(inode), FIND_FSUID_ONLY);
 	if (!open_file || (info & SACL_SECINFO))
 		return get_smb2_acl_by_path(cifs_sb, path, pacllen, info);
 	 * some servers (Windows2016) will not reflect recent writes in
 	 * QUERY_ALLOCATED_RANGES until SMB2_flush is called.
 	 */
-	wrcfile = find_writable_file(cifsi, FIND_WR_ANY);
+	wrcfile = find_writable_file(cifsi, FIND_ANY);
 	if (wrcfile) {
 		filemap_write_and_wait(inode->i_mapping);
 		smb2_flush_file(xid, tcon, &wrcfile->fid);

fs/smb/client/smb2pdu.c+4−1

 	memset(&rqst, 0, sizeof(struct smb_rqst));
 	rqst.rq_iov = iov;
-	rqst.rq_nvec = n_vec + 1;
+	/* iov[0] is the SMB header; move payload to rq_iter for encryption safety */
+	rqst.rq_nvec = 1;
+	iov_iter_kvec(&rqst.rq_iter, ITER_SOURCE, &iov[1], n_vec,
+		      io_parms->length);
 	if (retries) {
 		/* Back-off before retry */

fs/xfs/libxfs/xfs_da_btree.c+2−6

 	 * larger one that needs to be free by the caller.
 	 */
 	if (nirecs > 1) {
-		map = kzalloc(nirecs * sizeof(struct xfs_buf_map),
+		map = kcalloc(nirecs, sizeof(struct xfs_buf_map),
-				GFP_KERNEL | __GFP_NOLOCKDEP | __GFP_NOFAIL);
+			      GFP_KERNEL | __GFP_NOLOCKDEP | __GFP_NOFAIL);
-		if (!map) {
-			error = -ENOMEM;
-			goto out_free_irecs;
-		}
 		*mapp = map;
 	}

fs/xfs/libxfs/xfs_defer.c+1−1

@@ -809,7 +809,7 @@ xfs_defer_can_append( · 808 unmodified lines
809		809
810	/* Paused items cannot absorb more work */	810	/* Paused items cannot absorb more work */
811	if (dfp->dfp_flags & XFS_DEFER_PAUSED)	811	if (dfp->dfp_flags & XFS_DEFER_PAUSED)
812	return NULL;	812	return false;
813		813
814	/* Already full? */	814	/* Already full? */
815	if (ops->max_items && dfp->dfp_count >= ops->max_items)	815	if (ops->max_items && dfp->dfp_count >= ops->max_items)

fs/xfs/xfs_bmap_item.c+1−1

@@ -245,7 +245,7 @@ xfs_bmap_update_diff_items( · 244 unmodified lines
245	struct xfs_bmap_intent *ba = bi_entry(a);	245	struct xfs_bmap_intent *ba = bi_entry(a);
246	struct xfs_bmap_intent *bb = bi_entry(b);	246	struct xfs_bmap_intent *bb = bi_entry(b);
247		247
248	return ba->bi_owner->i_ino - bb->bi_owner->i_ino;	248	return cmp_int(ba->bi_owner->i_ino, bb->bi_owner->i_ino);
249	}	249	}
250		250
251	/* Log bmap updates in the intent item. */	251	/* Log bmap updates in the intent item. */

fs/xfs/xfs_dquot.c+7−1

 	return 0;
 out_abort:
+	/*
+	 * Shut down the log before removing the dquot item from the AIL.
+	 * Otherwise, the log tail may advance past this item's LSN while
+	 * log writes are still in progress, making these unflushed changes
+	 * unrecoverable on the next mount.
+	 */
+	xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
 	dqp->q_flags &= ~XFS_DQFLAG_DIRTY;
 	xfs_trans_ail_delete(lip, 0);
-	xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
 	xfs_dqfunlock(dqp);
 	return error;
 }

fs/xfs/xfs_healthmon.c+10−7

 	hm->mount_cookie = DETACHED_MOUNT_COOKIE;
 	spin_unlock(&xfs_healthmon_lock);
+	/*
+	 * Wake up any readers that might remain.  This can happen if unmount
+	 * races with the healthmon fd owner entering ->read_iter, having
+	 * already emptied the event queue.
+	 *
+	 * In the ->release case there shouldn't be any readers because the
+	 * only users of the waiter are read and poll.
+	 */
+	wake_up_all(&hm->wait);
 	trace_xfs_healthmon_detach(hm);
 	xfs_healthmon_put(hm);
 }
 	 * process can create another health monitor file.
 	 */
 	xfs_healthmon_detach(hm);
-	/*
-	 * Wake up any readers that might be left.  There shouldn't be any
-	 * because the only users of the waiter are read and poll.
-	 */
-	wake_up_all(&hm->wait);
 	xfs_healthmon_put(hm);
 	return 0;
 }

fs/xfs/xfs_icache.c+0−1

@@ -159,7 +159,6 @@ xfs_inode_free_callback( · 158 unmodified lines
159	ASSERT(!test_bit(XFS_LI_IN_AIL,	159	ASSERT(!test_bit(XFS_LI_IN_AIL,
160	&ip->i_itemp->ili_item.li_flags));	160	&ip->i_itemp->ili_item.li_flags));
161	xfs_inode_item_destroy(ip);	161	xfs_inode_item_destroy(ip);
162	ip->i_itemp = NULL;
163	}	162	}
164		163
165	kmem_cache_free(xfs_inode_cache, ip);	164	kmem_cache_free(xfs_inode_cache, ip);

fs/xfs/xfs_log.c+2−0

@@ -1357,6 +1357,8 @@ xlog_alloc_log( · 1356 unmodified lines
1357		1357
1358	if (xfs_has_logv2(mp) && mp->m_sb.sb_logsunit > 1)	1358	if (xfs_has_logv2(mp) && mp->m_sb.sb_logsunit > 1)
1359	log->l_iclog_roundoff = mp->m_sb.sb_logsunit;	1359	log->l_iclog_roundoff = mp->m_sb.sb_logsunit;
		1360	else if (mp->m_sb.sb_logsectsize > 0)
		1361	log->l_iclog_roundoff = mp->m_sb.sb_logsectsize;
1360	else	1362	else
1361	log->l_iclog_roundoff = BBSIZE;	1363	log->l_iclog_roundoff = BBSIZE;
1362		1364

fs/xfs/xfs_zone_gc.c+0−2

 	 */
 	xfs_fsblock_t			old_startblock;
 	xfs_daddr_t			new_daddr;
-	struct xfs_zone_scratch		*scratch;
 	/* Are we writing to a sequential write required zone? */
 	bool				is_seq;
 	ihold(VFS_I(chunk->ip));
 	split_chunk->ip = chunk->ip;
 	split_chunk->is_seq = chunk->is_seq;
-	split_chunk->scratch = chunk->scratch;
 	split_chunk->offset = chunk->offset;
 	split_chunk->len = split_len;
 	split_chunk->old_startblock = chunk->old_startblock;

include/linux/build_bug.h+3−1

 /**
  * BUILD_BUG_ON_MSG - break compile if a condition is true & emit supplied
  *		      error message.
- * @condition: the condition which the compiler should know is false.
+ * @cond: the condition which the compiler should know is false.
+ * @msg: build-time error message
  *
  * See BUILD_BUG_ON for description.
  */
 /**
  * static_assert - check integer constant expression at build time
+ * @expr: expression to be checked
  *
  * static_assert() is a wrapper for the C11 _Static_assert, with a
  * little macro magic to make the message optional (defaulting to the

include/linux/etherdevice.h+2−1

@@ -42,7 +42,8 @@ extern const struct header_ops eth_header_ops; · 41 unmodified lines
42		42
43	int eth_header(struct sk_buff skb, struct net_device dev, unsigned short type,	43	int eth_header(struct sk_buff skb, struct net_device dev, unsigned short type,
44	const void daddr, const void saddr, unsigned len);	44	const void daddr, const void saddr, unsigned len);
45	int eth_header_parse(const struct sk_buff skb, unsigned char haddr);	45	int eth_header_parse(const struct sk_buff skb, const struct net_device dev,
		46	unsigned char *haddr);
46	int eth_header_cache(const struct neighbour neigh, struct hh_cache hh,	47	int eth_header_cache(const struct neighbour neigh, struct hh_cache hh,
47	__be16 type);	48	__be16 type);
48	void eth_header_cache_update(struct hh_cache hh, const struct net_device dev,	49	void eth_header_cache_update(struct hh_cache hh, const struct net_device dev,

include/linux/firmware/intel/stratix10-svc-client.h+4−4

@@ -68,12 +68,12 @@ · 67 unmodified lines
68	* timeout value used in Stratix10 FPGA manager driver.	68	* timeout value used in Stratix10 FPGA manager driver.
69	* timeout value used in RSU driver	69	* timeout value used in RSU driver
70	*/	70	*/
71	#define SVC_RECONFIG_REQUEST_TIMEOUT_MS 300	71	#define SVC_RECONFIG_REQUEST_TIMEOUT_MS 5000
72	#define SVC_RECONFIG_BUFFER_TIMEOUT_MS 720	72	#define SVC_RECONFIG_BUFFER_TIMEOUT_MS 5000
73	#define SVC_RSU_REQUEST_TIMEOUT_MS 300	73	#define SVC_RSU_REQUEST_TIMEOUT_MS 2000
74	#define SVC_FCS_REQUEST_TIMEOUT_MS 2000	74	#define SVC_FCS_REQUEST_TIMEOUT_MS 2000
75	#define SVC_COMPLETED_TIMEOUT_MS 30000	75	#define SVC_COMPLETED_TIMEOUT_MS 30000
76	#define SVC_HWMON_REQUEST_TIMEOUT_MS 300	76	#define SVC_HWMON_REQUEST_TIMEOUT_MS 2000
77		77
78	struct stratix10_svc_chan;	78	struct stratix10_svc_chan;
79		79

include/linux/hid.h+1−0

@@ -682,6 +682,7 @@ struct hid_device { · 681 unmodified lines
682	__s32 battery_charge_status;	682	__s32 battery_charge_status;
683	enum hid_battery_status battery_status;	683	enum hid_battery_status battery_status;
684	bool battery_avoid_query;	684	bool battery_avoid_query;
		685	bool battery_present;
685	ktime_t battery_ratelimit_time;	686	ktime_t battery_ratelimit_time;
686	#endif	687	#endif
687		688

include/linux/if_ether.h+2−1

@@ -40,7 +40,8 @@ static inline struct ethhdr inner_eth_hdr(const struct sk_buff skb) · 39 unmodified lines
40	return (struct ethhdr *)skb_inner_mac_header(skb);	40	return (struct ethhdr *)skb_inner_mac_header(skb);
41	}	41	}
42		42
43	int eth_header_parse(const struct sk_buff skb, unsigned char haddr);	43	int eth_header_parse(const struct sk_buff skb, const struct net_device dev,
		44	unsigned char *haddr);
44		45
45	extern ssize_t sysfs_format_mac(char buf, const unsigned char addr, int len);	46	extern ssize_t sysfs_format_mac(char buf, const unsigned char addr, int len);
46		47

include/linux/io_uring_types.h+1−0

@@ -388,6 +388,7 @@ struct io_ring_ctx { · 387 unmodified lines
388	* regularly bounce b/w CPUs.	388	* regularly bounce b/w CPUs.
389	*/	389	*/
390	struct {	390	struct {
		391	struct io_rings __rcu *rings_rcu;
391	struct llist_head work_llist;	392	struct llist_head work_llist;
392	struct llist_head retry_llist;	393	struct llist_head retry_llist;
393	unsigned long check_cq;	394	unsigned long check_cq;

include/linux/kvm_host.h+35−48

@@ -1940,56 +1940,43 @@ enum kvm_stat_kind { · 1939 unmodified lines
1940		1940
1941	struct kvm_stat_data {	1941	struct kvm_stat_data {
1942	struct kvm *kvm;	1942	struct kvm *kvm;
1943	const struct _kvm_stats_desc *desc;	1943	const struct kvm_stats_desc *desc;
1944	enum kvm_stat_kind kind;	1944	enum kvm_stat_kind kind;
1945	};	1945	};
1946		1946
1947	struct _kvm_stats_desc {	1947	#define STATS_DESC_COMMON(type, unit, base, exp, sz, bsz) \
1948	struct kvm_stats_desc desc;	1948	.flags = type \| unit \| base \| \
1949	char name[KVM_STATS_NAME_SIZE];	1949	BUILD_BUG_ON_ZERO(type & ~KVM_STATS_TYPE_MASK) \| \
1950	};	1950	BUILD_BUG_ON_ZERO(unit & ~KVM_STATS_UNIT_MASK) \| \
1951		1951	BUILD_BUG_ON_ZERO(base & ~KVM_STATS_BASE_MASK), \
1952	#define STATS_DESC_COMMON(type, unit, base, exp, sz, bsz) \	1952	.exponent = exp, \
1953	.flags = type \| unit \| base \| \	1953	.size = sz, \
1954	BUILD_BUG_ON_ZERO(type & ~KVM_STATS_TYPE_MASK) \| \
1955	BUILD_BUG_ON_ZERO(unit & ~KVM_STATS_UNIT_MASK) \| \
1956	BUILD_BUG_ON_ZERO(base & ~KVM_STATS_BASE_MASK), \
1957	.exponent = exp, \
1958	.size = sz, \
1959	.bucket_size = bsz	1954	.bucket_size = bsz
1960		1955
1961	#define VM_GENERIC_STATS_DESC(stat, type, unit, base, exp, sz, bsz) \	1956	#define VM_GENERIC_STATS_DESC(stat, type, unit, base, exp, sz, bsz) \
1962	{ \	1957	{ \
1963	{ \	1958	STATS_DESC_COMMON(type, unit, base, exp, sz, bsz), \
1964	STATS_DESC_COMMON(type, unit, base, exp, sz, bsz), \	1959	.offset = offsetof(struct kvm_vm_stat, generic.stat), \
1965	.offset = offsetof(struct kvm_vm_stat, generic.stat) \	1960	.name = #stat, \
1966	}, \	1961	}
1967	.name = #stat, \	1962	#define VCPU_GENERIC_STATS_DESC(stat, type, unit, base, exp, sz, bsz) \
1968	}	1963	{ \
1969	#define VCPU_GENERIC_STATS_DESC(stat, type, unit, base, exp, sz, bsz) \	1964	STATS_DESC_COMMON(type, unit, base, exp, sz, bsz), \
1970	{ \	1965	.offset = offsetof(struct kvm_vcpu_stat, generic.stat), \
1971	{ \	1966	.name = #stat, \
1972	STATS_DESC_COMMON(type, unit, base, exp, sz, bsz), \	1967	}
1973	.offset = offsetof(struct kvm_vcpu_stat, generic.stat) \	1968	#define VM_STATS_DESC(stat, type, unit, base, exp, sz, bsz) \
1974	}, \	1969	{ \
1975	.name = #stat, \	1970	STATS_DESC_COMMON(type, unit, base, exp, sz, bsz), \
1976	}	1971	.offset = offsetof(struct kvm_vm_stat, stat), \
1977	#define VM_STATS_DESC(stat, type, unit, base, exp, sz, bsz) \	1972	.name = #stat, \
1978	{ \	1973	}
1979	{ \	1974	#define VCPU_STATS_DESC(stat, type, unit, base, exp, sz, bsz) \
1980	STATS_DESC_COMMON(type, unit, base, exp, sz, bsz), \	1975	{ \
1981	.offset = offsetof(struct kvm_vm_stat, stat) \	1976	STATS_DESC_COMMON(type, unit, base, exp, sz, bsz), \
1982	}, \	1977	.offset = offsetof(struct kvm_vcpu_stat, stat), \
1983	.name = #stat, \	1978	.name = #stat, \
1984	}	1979	}
1985	#define VCPU_STATS_DESC(stat, type, unit, base, exp, sz, bsz) \
1986	{ \
1987	{ \
1988	STATS_DESC_COMMON(type, unit, base, exp, sz, bsz), \
1989	.offset = offsetof(struct kvm_vcpu_stat, stat) \
1990	}, \
1991	.name = #stat, \
1992	}
1993	/* SCOPE: VM, VM_GENERIC, VCPU, VCPU_GENERIC */	1980	/* SCOPE: VM, VM_GENERIC, VCPU, VCPU_GENERIC */
1994	#define STATS_DESC(SCOPE, stat, type, unit, base, exp, sz, bsz) \	1981	#define STATS_DESC(SCOPE, stat, type, unit, base, exp, sz, bsz) \
1995	SCOPE##_STATS_DESC(stat, type, unit, base, exp, sz, bsz)	1982	SCOPE##_STATS_DESC(stat, type, unit, base, exp, sz, bsz)
@@ -2066,7 +2053,7 @@ struct _kvm_stats_desc { · 70 unmodified lines
2066	STATS_DESC_IBOOLEAN(VCPU_GENERIC, blocking)	2053	STATS_DESC_IBOOLEAN(VCPU_GENERIC, blocking)
2067		2054
2068	ssize_t kvm_stats_read(char id, const struct kvm_stats_header header,	2055	ssize_t kvm_stats_read(char id, const struct kvm_stats_header header,
2069	const struct _kvm_stats_desc *desc,	2056	const struct kvm_stats_desc *desc,
2070	void *stats, size_t size_stats,	2057	void *stats, size_t size_stats,
2071	char __user user_buffer, size_t size, loff_t offset);	2058	char __user user_buffer, size_t size, loff_t offset);
2072		2059
@@ -2111,9 +2098,9 @@ static inline void kvm_stats_log_hist_update(u64 *data, size_t size, u64 value) · 38 unmodified lines
2111		2098
2112		2099
2113	extern const struct kvm_stats_header kvm_vm_stats_header;	2100	extern const struct kvm_stats_header kvm_vm_stats_header;
2114	extern const struct _kvm_stats_desc kvm_vm_stats_desc[];	2101	extern const struct kvm_stats_desc kvm_vm_stats_desc[];
2115	extern const struct kvm_stats_header kvm_vcpu_stats_header;	2102	extern const struct kvm_stats_header kvm_vcpu_stats_header;
2116	extern const struct _kvm_stats_desc kvm_vcpu_stats_desc[];	2103	extern const struct kvm_stats_desc kvm_vcpu_stats_desc[];
2117		2104
2118	static inline int mmu_invalidate_retry(struct kvm *kvm, unsigned long mmu_seq)	2105	static inline int mmu_invalidate_retry(struct kvm *kvm, unsigned long mmu_seq)
2119	{	2106	{

include/linux/netdevice.h+5−4

 	int	(*create) (struct sk_buff *skb, struct net_device *dev,
 			   unsigned short type, const void *daddr,
 			   const void *saddr, unsigned int len);
-	int	(*parse)(const struct sk_buff *skb, unsigned char *haddr);
+	int	(*parse)(const struct sk_buff *skb,
+			 const struct net_device *dev,
+			 unsigned char *haddr);
 	int	(*cache)(const struct neighbour *neigh, struct hh_cache *hh, __be16 type);
 	void	(*cache_update)(struct hh_cache *hh,
 				const struct net_device *dev,
 	unsigned long		state;
 	unsigned int		flags;
 	unsigned short		hard_header_len;
+	enum netdev_stat_type	pcpu_stat_type:8;
 	netdev_features_t	features;
 	struct inet6_dev __rcu	*ip6_ptr;
 	__cacheline_group_end(net_device_read_txrx);
 	void				*ml_priv;
 	enum netdev_ml_priv_type	ml_priv_type;
-	enum netdev_stat_type		pcpu_stat_type:8;
 #if IS_ENABLED(CONFIG_GARP)
 	struct garp_port __rcu	*garp_port;
 #endif
 	if (!dev->header_ops || !dev->header_ops->parse)
 		return 0;
-	return dev->header_ops->parse(skb, haddr);
+	return dev->header_ops->parse(skb, dev, haddr);
 }
 static inline __be16 dev_parse_header_protocol(const struct sk_buff *skb)

include/linux/nvme-auth.h+1−1

@@ -11,7 +11,7 @@ · 10 unmodified lines
11	struct nvme_dhchap_key {	11	struct nvme_dhchap_key {
12	size_t len;	12	size_t len;
13	u8 hash;	13	u8 hash;
14	u8 key[];	14	u8 key[] __counted_by(len);
15	};	15	};
16		16
17	u32 nvme_auth_get_seqnum(void);	17	u32 nvme_auth_get_seqnum(void);

include/linux/rseq_types.h+5−1

  * @active:	MM CID is active for the task
  * @cid:	The CID associated to the task either permanently or
  *		borrowed from the CPU
+ * @node:	Queued in the per MM MMCID list
  */
 struct sched_mm_cid {
 	unsigned int		active;
 	unsigned int		cid;
+	struct hlist_node	node;
 };
 /**
  * @work:		Regular work to handle the affinity mode change case
  * @lock:		Spinlock to protect against affinity setting which can't take @mutex
  * @mutex:		Mutex to serialize forks and exits related to this mm
+ * @user_list:		List of the MM CID users of a MM
  * @nr_cpus_allowed:	The number of CPUs in the per MM allowed CPUs map. The map
  *			is growth only.
  * @users:		The number of tasks sharing this MM. Separate from mm::mm_users
 	raw_spinlock_t		lock;
 	struct mutex		mutex;
+	struct hlist_head	user_list;
 	/* Low frequency modified */
 	unsigned int		nr_cpus_allowed;
 	unsigned int		users;
 	unsigned int		pcpu_thrs;
 	unsigned int		update_deferred;
-}____cacheline_aligned_in_smp;
+} ____cacheline_aligned;
 #else /* CONFIG_SCHED_MM_CID */
 struct mm_mm_cid { };
 struct sched_mm_cid { };

include/linux/sched.h+0−2

 #ifdef CONFIG_SCHED_MM_CID
 void sched_mm_cid_before_execve(struct task_struct *t);
 void sched_mm_cid_after_execve(struct task_struct *t);
-void sched_mm_cid_fork(struct task_struct *t);
 void sched_mm_cid_exit(struct task_struct *t);
 static __always_inline int task_mm_cid(struct task_struct *t)
 {
 #else
 static inline void sched_mm_cid_before_execve(struct task_struct *t) { }
 static inline void sched_mm_cid_after_execve(struct task_struct *t) { }
-static inline void sched_mm_cid_fork(struct task_struct *t) { }
 static inline void sched_mm_cid_exit(struct task_struct *t) { }
 static __always_inline int task_mm_cid(struct task_struct *t)
 {

include/linux/usb.h+6−2

  *                         SYNCHRONOUS CALL SUPPORT                  *
  *-------------------------------------------------------------------*/
+/* Maximum value allowed for timeout in synchronous routines below */
+#define USB_MAX_SYNCHRONOUS_TIMEOUT		60000	/* ms */
 extern int usb_control_msg(struct usb_device *dev, unsigned int pipe,
 	__u8 request, __u8 requesttype, __u16 value, __u16 index,
 	void *data, __u16 size, int timeout);
 extern int usb_interrupt_msg(struct usb_device *usb_dev, unsigned int pipe,
 	void *data, int len, int *actual_length, int timeout);
 extern int usb_bulk_msg(struct usb_device *usb_dev, unsigned int pipe,
-	void *data, int len, int *actual_length,
+	void *data, int len, int *actual_length, int timeout);
-	int timeout);
+extern int usb_bulk_msg_killable(struct usb_device *usb_dev, unsigned int pipe,
+	void *data, int len, int *actual_length, int timeout);
 /* wrappers around usb_control_msg() for the most common standard requests */
 int usb_control_msg_send(struct usb_device *dev, __u8 endpoint, __u8 request,

include/linux/usb/quirks.h+3−0

@@ -78,4 +78,7 @@ · 77 unmodified lines
78	/* skip BOS descriptor request */	78	/* skip BOS descriptor request */
79	#define USB_QUIRK_NO_BOS BIT(17)	79	#define USB_QUIRK_NO_BOS BIT(17)
80		80
		81	/* Device claims zero configurations, forcing to 1 */
		82	#define USB_QUIRK_FORCE_ONE_CONFIG BIT(18)
		83
81	#endif /* __LINUX_USB_QUIRKS_H */	84	#endif /* __LINUX_USB_QUIRKS_H */

include/net/ip_tunnels.h+23−7

@@ -665,13 +665,29 @@ static inline int iptunnel_pull_offloads(struct sk_buff *skb) · 664 unmodified lines
665	static inline void iptunnel_xmit_stats(struct net_device *dev, int pkt_len)	665	static inline void iptunnel_xmit_stats(struct net_device *dev, int pkt_len)
666	{	666	{
667	if (pkt_len > 0) {	667	if (pkt_len > 0) {
668	struct pcpu_sw_netstats *tstats = get_cpu_ptr(dev->tstats);	668	if (dev->pcpu_stat_type == NETDEV_PCPU_STAT_DSTATS) {
669		669	struct pcpu_dstats *dstats = get_cpu_ptr(dev->dstats);
670	u64_stats_update_begin(&tstats->syncp);	670
671	u64_stats_add(&tstats->tx_bytes, pkt_len);	671	u64_stats_update_begin(&dstats->syncp);
672	u64_stats_inc(&tstats->tx_packets);	672	u64_stats_add(&dstats->tx_bytes, pkt_len);
673	u64_stats_update_end(&tstats->syncp);	673	u64_stats_inc(&dstats->tx_packets);
674	put_cpu_ptr(tstats);	674	u64_stats_update_end(&dstats->syncp);
		675	put_cpu_ptr(dstats);
		676	return;
		677	}
		678	if (dev->pcpu_stat_type == NETDEV_PCPU_STAT_TSTATS) {
		679	struct pcpu_sw_netstats *tstats = get_cpu_ptr(dev->tstats);
		680
		681	u64_stats_update_begin(&tstats->syncp);
		682	u64_stats_add(&tstats->tx_bytes, pkt_len);
		683	u64_stats_inc(&tstats->tx_packets);
		684	u64_stats_update_end(&tstats->syncp);
		685	put_cpu_ptr(tstats);
		686	return;
		687	}
		688	pr_err_once("iptunnel_xmit_stats pcpu_stat_type=%d\n",
		689	dev->pcpu_stat_type);
		690	WARN_ON_ONCE(1);
675	return;	691	return;
676	}	692	}
677		693

include/net/mac80211.h+3−1

  * @band: the band to transmit on
  * @sta: optional pointer to get the station to send the frame to
  *
- * Return: %true if the skb was prepared, %false otherwise
+ * Return: %true if the skb was prepared, %false otherwise.
+ * On failure, the skb is freed by this function; callers must not
+ * free it again.
  *
  * Note: must be called under RCU lock
  */

include/net/netfilter/nf_tables.h+2−4

 	unsigned char		data[];
 };
-#define NFT_SET_ELEM_INTERNAL_LAST	0x1
 /* placeholder structure for opaque set element backend representation. */
 struct nft_elem_priv { };
  *	@key: element key
  *	@key_end: closing element key
  *	@data: element data
- * 	@flags: flags
  *	@priv: element private data and extensions
  */
 struct nft_set_elem {
 		u32		buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)];
 		struct nft_data val;
 	} data;
-	u32			flags;
 	struct nft_elem_priv	*priv;
 };
 					u64 timeout, u64 expiration, gfp_t gfp);
 int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,
 			    struct nft_expr *expr_array[]);
+void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
+			       struct nft_set_elem_expr *elem_expr);
 void nft_set_elem_destroy(const struct nft_set *set,
 			  const struct nft_elem_priv *elem_priv,
 			  bool destroy_expr);

include/net/sch_generic.h+33−0

@@ -719,6 +719,34 @@ void qdisc_destroy(struct Qdisc *qdisc); · 718 unmodified lines
719	void qdisc_put(struct Qdisc *qdisc);	719	void qdisc_put(struct Qdisc *qdisc);
720	void qdisc_put_unlocked(struct Qdisc *qdisc);	720	void qdisc_put_unlocked(struct Qdisc *qdisc);
721	void qdisc_tree_reduce_backlog(struct Qdisc *qdisc, int n, int len);	721	void qdisc_tree_reduce_backlog(struct Qdisc *qdisc, int n, int len);
		722
		723	static inline void dev_reset_queue(struct net_device *dev,
		724	struct netdev_queue *dev_queue,
		725	void *_unused)
		726	{
		727	struct Qdisc *qdisc;
		728	bool nolock;
		729
		730	qdisc = rtnl_dereference(dev_queue->qdisc_sleeping);
		731	if (!qdisc)
		732	return;
		733
		734	nolock = qdisc->flags & TCQ_F_NOLOCK;
		735
		736	if (nolock)
		737	spin_lock_bh(&qdisc->seqlock);
		738	spin_lock_bh(qdisc_lock(qdisc));
		739
		740	qdisc_reset(qdisc);
		741
		742	spin_unlock_bh(qdisc_lock(qdisc));
		743	if (nolock) {
		744	clear_bit(__QDISC_STATE_MISSED, &qdisc->state);
		745	clear_bit(__QDISC_STATE_DRAINING, &qdisc->state);
		746	spin_unlock_bh(&qdisc->seqlock);
		747	}
		748	}
		749
722	#ifdef CONFIG_NET_SCHED	750	#ifdef CONFIG_NET_SCHED
723	int qdisc_offload_dump_helper(struct Qdisc *q, enum tc_setup_type type,	751	int qdisc_offload_dump_helper(struct Qdisc *q, enum tc_setup_type type,
724	void *type_data);	752	void *type_data);
@@ -1446,6 +1474,11 @@ void mini_qdisc_pair_init(struct mini_Qdisc_pair miniqp, struct Qdisc qdisc, · 721 unmodified lines
1446	void mini_qdisc_pair_block_init(struct mini_Qdisc_pair *miniqp,	1474	void mini_qdisc_pair_block_init(struct mini_Qdisc_pair *miniqp,
1447	struct tcf_block *block);	1475	struct tcf_block *block);
1448		1476
		1477	static inline bool mini_qdisc_pair_inited(struct mini_Qdisc_pair *miniqp)
		1478	{
		1479	return !!miniqp->p_miniq;
		1480	}
		1481
1449	void mq_change_real_num_tx(struct Qdisc *sch, unsigned int new_real_tx);	1482	void mq_change_real_num_tx(struct Qdisc *sch, unsigned int new_real_tx);
1450		1483
1451	int sch_frag_xmit_hook(struct sk_buff skb, int (xmit)(struct sk_buff *skb));	1484	int sch_frag_xmit_hook(struct sk_buff skb, int (xmit)(struct sk_buff *skb));

include/net/udp_tunnel.h+1−1

@@ -52,7 +52,7 @@ int udp_sock_create6(struct net net, struct udp_port_cfg cfg, · 51 unmodified lines
52	static inline int udp_sock_create6(struct net net, struct udp_port_cfg cfg,	52	static inline int udp_sock_create6(struct net net, struct udp_port_cfg cfg,
53	struct socket **sockp)	53	struct socket **sockp)
54	{	54	{
55	return 0;	55	return -EPFNOSUPPORT;
56	}	56	}
57	#endif	57	#endif
58		58

include/uapi/linux/kvm.h+8−0

 #include <linux/ioctl.h>
 #include <asm/kvm.h>
+#ifdef __KERNEL__
+#include <linux/kvm_types.h>
+#endif
 #define KVM_API_VERSION 12
 /*
 	__u16 size;
 	__u32 offset;
 	__u32 bucket_size;
+#ifdef __KERNEL__
+	char name[KVM_STATS_NAME_SIZE];
+#else
 	char name[];
+#endif
 };
 #define KVM_GET_STATS_FD  _IO(KVMIO,  0xce)

io_uring/bpf_filter.c+1−1

@@ -85,7 +85,7 @@ int __io_uring_run_bpf_filters(struct io_bpf_filter __rcu **filters, · 84 unmodified lines
85	do {	85	do {
86	if (filter == &dummy_filter)	86	if (filter == &dummy_filter)
87	return -EACCES;	87	return -EACCES;
88	ret = bpf_prog_run(filter->prog, &bpf_ctx);	88	ret = bpf_prog_run_pin_on_cpu(filter->prog, &bpf_ctx);
89	if (!ret)	89	if (!ret)
90	return -EACCES;	90	return -EACCES;
91	filter = filter->next;	91	filter = filter->next;

io_uring/eventfd.c+7−3

@@ -76,11 +76,15 @@ void io_eventfd_signal(struct io_ring_ctx *ctx, bool cqe_event) · 75 unmodified lines
76	{	76	{
77	bool skip = false;	77	bool skip = false;
78	struct io_ev_fd *ev_fd;	78	struct io_ev_fd *ev_fd;
79		79	struct io_rings *rings;
80	if (READ_ONCE(ctx->rings->cq_flags) & IORING_CQ_EVENTFD_DISABLED)
81	return;
82		80
83	guard(rcu)();	81	guard(rcu)();
		82
		83	rings = rcu_dereference(ctx->rings_rcu);
		84	if (!rings)
		85	return;
		86	if (READ_ONCE(rings->cq_flags) & IORING_CQ_EVENTFD_DISABLED)
		87	return;
84	ev_fd = rcu_dereference(ctx->io_ev_fd);	88	ev_fd = rcu_dereference(ctx->io_ev_fd);
85	/*	89	/*
86	* Check again if ev_fd exists in case an io_eventfd_unregister call	90	* Check again if ev_fd exists in case an io_eventfd_unregister call

io_uring/io_uring.c+3−1

 		 * well as 2 contiguous entries.
 		 */
 		if (!(ctx->flags & IORING_SETUP_SQE_MIXED) || *left < 2 ||
-		    !(ctx->cached_sq_head & (ctx->sq_entries - 1)))
+		    (unsigned)(sqe - ctx->sq_sqes) >= ctx->sq_entries - 1)
 			return io_init_fail_req(req, -EINVAL);
 		/*
 		 * A 128b operation on a mixed SQ uses two entries, so we have
 	io_free_region(ctx->user, &ctx->sq_region);
 	io_free_region(ctx->user, &ctx->ring_region);
 	ctx->rings = NULL;
+	RCU_INIT_POINTER(ctx->rings_rcu, NULL);
 	ctx->sq_sqes = NULL;
 }
 	if (ret)
 		return ret;
 	ctx->rings = rings = io_region_get_ptr(&ctx->ring_region);
+	rcu_assign_pointer(ctx->rings_rcu, rings);
 	if (!(ctx->flags & IORING_SETUP_NO_SQARRAY))
 		ctx->sq_array = (u32 *)((char *)rings + rl->sq_array_offset);

io_uring/kbuf.c+11−2

 	buf = req->kbuf;
 	bl = io_buffer_get_list(ctx, buf->bgid);
-	list_add(&buf->list, &bl->buf_list);
+	/*
-	bl->nbufs++;
+	 * If the buffer list was upgraded to a ring-based one, or removed,
+	 * while the request was in-flight in io-wq, drop it.
+	 */
+	if (bl && !(bl->flags & IOBL_BUF_RING)) {
+		list_add(&buf->list, &bl->buf_list);
+		bl->nbufs++;
+	} else {
+		kfree(buf);
+	}
 	req->flags &= ~REQ_F_BUFFER_SELECTED;
+	req->kbuf = NULL;
 	io_ring_submit_unlock(ctx, issue_flags);
 	return true;

io_uring/register.c+13−2

 		return -EPERM;
 	/*
 	 * Similar to seccomp, disallow setting a filter if task_no_new_privs
-	 * is true and we're not CAP_SYS_ADMIN.
+	 * is false and we're not CAP_SYS_ADMIN.
 	 */
 	if (!task_no_new_privs(current) &&
 	    !ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
 	/*
 	 * Similar to seccomp, disallow setting a filter if task_no_new_privs
-	 * is true and we're not CAP_SYS_ADMIN.
+	 * is false and we're not CAP_SYS_ADMIN.
 	 */
 	if (!task_no_new_privs(current) &&
 	    !ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
 	ctx->sq_entries = p->sq_entries;
 	ctx->cq_entries = p->cq_entries;
+	/*
+	 * Just mark any flag we may have missed and that the application
+	 * should act on unconditionally. Worst case it'll be an extra
+	 * syscall.
+	 */
+	atomic_or(IORING_SQ_TASKRUN | IORING_SQ_NEED_WAKEUP, &n.rings->sq_flags);
 	ctx->rings = n.rings;
+	rcu_assign_pointer(ctx->rings_rcu, n.rings);
 	ctx->sq_sqes = n.sq_sqes;
 	swap_old(ctx, o, n, ring_region);
 	swap_old(ctx, o, n, sq_region);
 out:
 	spin_unlock(&ctx->completion_lock);
 	mutex_unlock(&ctx->mmap_lock);
+	/* Wait for concurrent io_ctx_mark_taskrun() */
+	if (to_free == &o)
+		synchronize_rcu_expedited();
 	io_register_free_rings(ctx, to_free);
 	if (ctx->sq_data)

io_uring/tw.c+20−2

 	WARN_ON_ONCE(ret);
 }
+/*
+ * Sets IORING_SQ_TASKRUN in the sq_flags shared with userspace, using the
+ * RCU protected rings pointer to be safe against concurrent ring resizing.
+ */
+static void io_ctx_mark_taskrun(struct io_ring_ctx *ctx)
+{
+	lockdep_assert_in_rcu_read_lock();
+	if (ctx->flags & IORING_SETUP_TASKRUN_FLAG) {
+		struct io_rings *rings = rcu_dereference(ctx->rings_rcu);
+		atomic_or(IORING_SQ_TASKRUN, &rings->sq_flags);
+	}
+}
 void io_req_local_work_add(struct io_kiocb *req, unsigned flags)
 {
 	struct io_ring_ctx *ctx = req->ctx;
 	 */
 	if (!head) {
-		if (ctx->flags & IORING_SETUP_TASKRUN_FLAG)
+		io_ctx_mark_taskrun(ctx);
-			atomic_or(IORING_SQ_TASKRUN, &ctx->rings->sq_flags);
 		if (ctx->has_evfd)
 			io_eventfd_signal(ctx, false);
 	}
 	if (!llist_add(&req->io_task_work.node, &tctx->task_list))
 		return;
+	/*
+	 * Doesn't need to use ->rings_rcu, as resizing isn't supported for
+	 * !DEFER_TASKRUN.
+	 */
 	if (ctx->flags & IORING_SETUP_TASKRUN_FLAG)
 		atomic_or(IORING_SQ_TASKRUN, &ctx->rings->sq_flags);

kernel/cgroup/cgroup.c+6−0

 		return;
 	task = list_entry(it->task_pos, struct task_struct, cg_list);
+	/*
+	 * Hide tasks that are exiting but not yet removed. Keep zombie
+	 * leaders with live threads visible.
+	 */
+	if ((task->flags & PF_EXITING) && !atomic_read(&task->signal->live))
+		goto repeat;
 	if (it->flags & CSS_TASK_ITER_PROCS) {
 		/* if PROCS, skip over tasks which aren't group leaders */

kernel/cgroup/cpuset.c+31−28

 	/*
 	 * Cgroup v2 doesn't support domain attributes, just set all of them
 	 * to SD_ATTR_INIT. Also non-isolating partition root CPUs are a
-	 * subset of HK_TYPE_DOMAIN housekeeping CPUs.
+	 * subset of HK_TYPE_DOMAIN_BOOT housekeeping CPUs.
 	 */
 	for (i = 0; i < ndoms; i++) {
 		/*
 		 */
 		if (!csa || csa[i] == &top_cpuset)
 			cpumask_and(doms[i], top_cpuset.effective_cpus,
-				    housekeeping_cpumask(HK_TYPE_DOMAIN));
+				    housekeeping_cpumask(HK_TYPE_DOMAIN_BOOT));
 		else
 			cpumask_copy(doms[i], csa[i]->effective_cpus);
 		if (dattr)
 }
 /*
- * update_hk_sched_domains - Update HK cpumasks & rebuild sched domains
+ * cpuset_update_sd_hk_unlock - Rebuild sched domains, update HK & unlock
  *
- * Update housekeeping cpumasks and rebuild sched domains if necessary.
+ * Update housekeeping cpumasks and rebuild sched domains if necessary and
- * This should be called at the end of cpuset or hotplug actions.
+ * then do a cpuset_full_unlock().
+ * This should be called at the end of cpuset operation.
  */
-static void update_hk_sched_domains(void)
+static void cpuset_update_sd_hk_unlock(void)
+	__releases(&cpuset_mutex)
+	__releases(&cpuset_top_mutex)
 {
+	/* force_sd_rebuild will be cleared in rebuild_sched_domains_locked() */
+	if (force_sd_rebuild)
+		rebuild_sched_domains_locked();
 	if (update_housekeeping) {
-		/* Updating HK cpumasks implies rebuild sched domains */
 		update_housekeeping = false;
-		force_sd_rebuild = true;
 		cpumask_copy(isolated_hk_cpus, isolated_cpus);
 		/*
 		mutex_unlock(&cpuset_mutex);
 		cpus_read_unlock();
 		WARN_ON_ONCE(housekeeping_update(isolated_hk_cpus));
-		cpus_read_lock();
+		mutex_unlock(&cpuset_top_mutex);
-		mutex_lock(&cpuset_mutex);
+	} else {
+		cpuset_full_unlock();
 	}
-	/* force_sd_rebuild will be cleared in rebuild_sched_domains_locked() */
-	if (force_sd_rebuild)
-		rebuild_sched_domains_locked();
 }
 /*
- * Work function to invoke update_hk_sched_domains()
+ * Work function to invoke cpuset_update_sd_hk_unlock()
  */
 static void hk_sd_workfn(struct work_struct *work)
 {
 	cpuset_full_lock();
-	update_hk_sched_domains();
+	cpuset_update_sd_hk_unlock();
-	cpuset_full_unlock();
 }
 /**
 	free_cpuset(trialcs);
 out_unlock:
-	update_hk_sched_domains();
+	cpuset_update_sd_hk_unlock();
-	cpuset_full_unlock();
 	if (of_cft(of)->private == FILE_MEMLIST)
 		schedule_flush_migrate_mm();
 	return retval ?: nbytes;
 	cpuset_full_lock();
 	if (is_cpuset_online(cs))
 		retval = update_prstate(cs, val);
-	update_hk_sched_domains();
+	cpuset_update_sd_hk_unlock();
-	cpuset_full_unlock();
 	return retval ?: nbytes;
 }
 	/* Reset valid partition back to member */
 	if (is_partition_valid(cs))
 		update_prstate(cs, PRS_MEMBER);
-	update_hk_sched_domains();
+	cpuset_update_sd_hk_unlock();
-	cpuset_full_unlock();
 }
 static void cpuset_css_free(struct cgroup_subsys_state *css)
 		rcu_read_unlock();
 	}
 	/*
-	 * Queue a work to call housekeeping_update() & rebuild_sched_domains()
+	 * rebuild_sched_domains() will always be called directly if needed
-	 * There will be a slight delay before the HK_TYPE_DOMAIN housekeeping
+	 * to make sure that newly added or removed CPU will be reflected in
-	 * cpumask can correctly reflect what is in isolated_cpus.
+	 * the sched domains. However, if isolated partition invalidation
+	 * or recreation is being done (update_housekeeping set), a work item
+	 * will be queued to call housekeeping_update() to update the
+	 * corresponding housekeeping cpumasks after some slight delay.
 	 *
 	 * We rely on WORK_STRUCT_PENDING_BIT to not requeue a work item that
 	 * is still pending. Before the pending bit is cleared, the work data
 	 * previously queued work. Since hk_sd_workfn() doesn't use the work
 	 * item at all, this is not a problem.
 	 */
-	if (update_housekeeping || force_sd_rebuild)
+	if (force_sd_rebuild)
-		queue_work(system_unbound_wq, &hk_sd_work);
+		rebuild_sched_domains_cpuslocked();
+	if (update_housekeeping)
+		queue_work(system_dfl_wq, &hk_sd_work);
 	free_tmpmasks(ptmp);
 }

kernel/crash_dump_dm_crypt.c+2−2

@@ -168,8 +168,8 @@ static int read_key_from_user_keying(struct dm_crypt_key *dm_key) · 167 unmodified lines
168		168
169	memcpy(dm_key->data, ukp->data, ukp->datalen);	169	memcpy(dm_key->data, ukp->data, ukp->datalen);
170	dm_key->key_size = ukp->datalen;	170	dm_key->key_size = ukp->datalen;
171	kexec_dprintk("Get dm crypt key (size=%u) %s: %8ph\n", dm_key->key_size,	171	kexec_dprintk("Get dm crypt key (size=%u) %s\n", dm_key->key_size,
172	dm_key->key_desc, dm_key->data);	172	dm_key->key_desc);
173		173
174	out:	174	out:
175	up_read(&key->sem);	175	up_read(&key->sem);

kernel/fork.c+1−2

 #ifdef CONFIG_SCHED_MM_CID
 	tsk->mm_cid.cid = MM_CID_UNSET;
 	tsk->mm_cid.active = 0;
+	INIT_HLIST_NODE(&tsk->mm_cid.node);
 #endif
 	return tsk;
 	tsk->mm = mm;
 	tsk->active_mm = mm;
-	sched_mm_cid_fork(tsk);
 	return 0;
 }
 	exit_nsproxy_namespaces(p);
 bad_fork_cleanup_mm:
 	if (p->mm) {
-		sched_mm_cid_exit(p);
 		mm_clear_owner(p->mm, p);
 		mmput(p->mm);
 	}

kernel/kprobes.c+6−2

 	lockdep_assert_held(&kprobe_mutex);
 	ret = ftrace_set_filter_ip(ops, (unsigned long)p->addr, 0, 0);
-	if (WARN_ONCE(ret < 0, "Failed to arm kprobe-ftrace at %pS (error %d)\n", p->addr, ret))
+	if (ret < 0)
 		return ret;
 	if (*cnt == 0) {
 		ret = register_ftrace_function(ops);
-		if (WARN(ret < 0, "Failed to register kprobe-ftrace (error %d)\n", ret)) {
+		if (ret < 0) {
 			/*
 			 * At this point, sinec ops is not registered, we should be sefe from
 			 * registering empty filter.
 	int ret;
 	lockdep_assert_held(&kprobe_mutex);
+	if (unlikely(kprobe_ftrace_disabled)) {
+		/* Now ftrace is disabled forever, disarm is already done. */
+		return 0;
+	}
 	if (*cnt == 1) {
 		ret = unregister_ftrace_function(ops);

kernel/sched/core.c+28−51

 	scx_cancel_fork(p);
 }
+static void sched_mm_cid_fork(struct task_struct *t);
 void sched_post_fork(struct task_struct *p)
 {
+	sched_mm_cid_fork(p);
 	uclamp_post_fork(p);
 	scx_post_fork(p);
 }
 	}
 }
-static bool mm_cid_fixup_task_to_cpu(struct task_struct *t, struct mm_struct *mm)
+static void mm_cid_fixup_task_to_cpu(struct task_struct *t, struct mm_struct *mm)
 {
 	/* Remote access to mm::mm_cid::pcpu requires rq_lock */
 	guard(task_rq_lock)(t);
-	/* If the task is not active it is not in the users count */
-	if (!t->mm_cid.active)
-		return false;
 	if (cid_on_task(t->mm_cid.cid)) {
 		/* If running on the CPU, put the CID in transit mode, otherwise drop it */
 		if (task_rq(t)->curr == t)
 		else
 			mm_unset_cid_on_task(t);
 	}
-	return true;
 }
-static void mm_cid_do_fixup_tasks_to_cpus(struct mm_struct *mm)
+static void mm_cid_fixup_tasks_to_cpus(void)
 {
-	struct task_struct *p, *t;
+	struct mm_struct *mm = current->mm;
-	unsigned int users;
+	struct task_struct *t;
-	/*
+	lockdep_assert_held(&mm->mm_cid.mutex);
-	 * This can obviously race with a concurrent affinity change, which
-	 * increases the number of allowed CPUs for this mm, but that does
-	 * not affect the mode and only changes the CID constraints. A
-	 * possible switch back to per task mode happens either in the
-	 * deferred handler function or in the next fork()/exit().
-	 *
-	 * The caller has already transferred. The newly incoming task is
-	 * already accounted for, but not yet visible.
-	 */
-	users = mm->mm_cid.users - 2;
-	if (!users)
-		return;
-	guard(rcu)();
+	hlist_for_each_entry(t, &mm->mm_cid.user_list, mm_cid.node) {
-	for_other_threads(current, t) {
+		/* Current has already transferred before invoking the fixup. */
-		if (mm_cid_fixup_task_to_cpu(t, mm))
+		if (t != current)
-			users--;
+			mm_cid_fixup_task_to_cpu(t, mm);
 	}
-	if (!users)
-		return;
-	/* Happens only for VM_CLONE processes. */
-	for_each_process_thread(p, t) {
-		if (t == current || t->mm != mm)
-			continue;
-		if (mm_cid_fixup_task_to_cpu(t, mm)) {
-			if (--users == 0)
-				return;
-		}
-	}
-}
-static void mm_cid_fixup_tasks_to_cpus(void)
-{
-	struct mm_struct *mm = current->mm;
-	mm_cid_do_fixup_tasks_to_cpus(mm);
 	mm_cid_complete_transit(mm, MM_CID_ONCPU);
 }
 static bool sched_mm_cid_add_user(struct task_struct *t, struct mm_struct *mm)
 {
+	lockdep_assert_held(&mm->mm_cid.lock);
 	t->mm_cid.active = 1;
+	hlist_add_head(&t->mm_cid.node, &mm->mm_cid.user_list);
 	mm->mm_cid.users++;
 	return mm_update_max_cids(mm);
 }
-void sched_mm_cid_fork(struct task_struct *t)
+static void sched_mm_cid_fork(struct task_struct *t)
 {
 	struct mm_struct *mm = t->mm;
 	bool percpu;
-	WARN_ON_ONCE(!mm || t->mm_cid.cid != MM_CID_UNSET);
+	if (!mm)
+		return;
+	WARN_ON_ONCE(t->mm_cid.cid != MM_CID_UNSET);
 	guard(mutex)(&mm->mm_cid.mutex);
 	scoped_guard(raw_spinlock_irq, &mm->mm_cid.lock) {
 static bool sched_mm_cid_remove_user(struct task_struct *t)
 {
+	lockdep_assert_held(&t->mm->mm_cid.lock);
 	t->mm_cid.active = 0;
-	scoped_guard(preempt) {
+	/* Clear the transition bit */
-		/* Clear the transition bit */
+	t->mm_cid.cid = cid_from_transit_cid(t->mm_cid.cid);
-		t->mm_cid.cid = cid_from_transit_cid(t->mm_cid.cid);
+	mm_unset_cid_on_task(t);
-		mm_unset_cid_on_task(t);
+	hlist_del_init(&t->mm_cid.node);
-	}
 	t->mm->mm_cid.users--;
 	return mm_update_max_cids(t->mm);
 }
 	mutex_init(&mm->mm_cid.mutex);
 	mm->mm_cid.irq_work = IRQ_WORK_INIT_HARD(mm_cid_irq_work);
 	INIT_WORK(&mm->mm_cid.work, mm_cid_work_fn);
+	INIT_HLIST_HEAD(&mm->mm_cid.user_list);
 	cpumask_copy(mm_cpus_allowed(mm), &p->cpus_mask);
 	bitmap_zero(mm_cidmask(mm), num_possible_cpus());
 }
 #else /* CONFIG_SCHED_MM_CID */
 static inline void mm_update_cpus_allowed(struct mm_struct *mm, const struct cpumask *affmsk) { }
+static inline void sched_mm_cid_fork(struct task_struct *t) { }
 #endif /* !CONFIG_SCHED_MM_CID */
 static DEFINE_PER_CPU(struct sched_change_ctx, sched_change_ctx);

kernel/sched/ext.c+11−11

 	}
 	/* seq records the order tasks are queued, used by BPF DSQ iterator */
-	dsq->seq++;
+	WRITE_ONCE(dsq->seq, dsq->seq + 1);
 	p->scx.dsq_seq = dsq->seq;
 	dsq_mod_nr(dsq, 1);
 		p->scx.flags |= SCX_TASK_RESET_RUNNABLE_AT;
 }
-static void enqueue_task_scx(struct rq *rq, struct task_struct *p, int enq_flags)
+static void enqueue_task_scx(struct rq *rq, struct task_struct *p, int core_enq_flags)
 {
 	struct scx_sched *sch = scx_root;
 	int sticky_cpu = p->scx.sticky_cpu;
+	u64 enq_flags = core_enq_flags | rq->scx.extra_enq_flags;
 	if (enq_flags & ENQUEUE_WAKEUP)
 		rq->scx.flags |= SCX_RQ_IN_WAKEUP;
-	enq_flags |= rq->scx.extra_enq_flags;
 	if (sticky_cpu >= 0)
 		p->scx.sticky_cpu = -1;
 	 * consider offloading iff the total queued duration is over the
 	 * threshold.
 	 */
-	min_delta_us = scx_bypass_lb_intv_us / SCX_BYPASS_LB_MIN_DELTA_DIV;
+	min_delta_us = READ_ONCE(scx_bypass_lb_intv_us) / SCX_BYPASS_LB_MIN_DELTA_DIV;
-	if (delta < DIV_ROUND_UP(min_delta_us, scx_slice_bypass_us))
+	if (delta < DIV_ROUND_UP(min_delta_us, READ_ONCE(scx_slice_bypass_us)))
 		return 0;
 	raw_spin_rq_lock_irq(rq);
 		WARN_ON_ONCE(scx_bypass_depth <= 0);
 		if (scx_bypass_depth != 1)
 			goto unlock;
-		WRITE_ONCE(scx_slice_dfl, scx_slice_bypass_us * NSEC_PER_USEC);
+		WRITE_ONCE(scx_slice_dfl, READ_ONCE(scx_slice_bypass_us) * NSEC_PER_USEC);
 		bypass_timestamp = ktime_get_ns();
 		if (sch)
 			scx_add_event(sch, SCX_EV_BYPASS_ACTIVATE, 1);
 	if (!READ_ONCE(helper)) {
 		mutex_lock(&helper_mutex);
 		if (!helper) {
-			helper = kthread_run_worker(0, "scx_enable_helper");
+			struct kthread_worker *w =
-			if (IS_ERR_OR_NULL(helper)) {
+				kthread_run_worker(0, "scx_enable_helper");
-				helper = NULL;
+			if (IS_ERR_OR_NULL(w)) {
 				mutex_unlock(&helper_mutex);
 				return -ENOMEM;
 			}
-			sched_set_fifo(helper->task);
+			sched_set_fifo(w->task);
+			WRITE_ONCE(helper, w);
 		}
 		mutex_unlock(&helper_mutex);
 	}

kernel/sched/ext_internal.h+98−16

@@ -1035,26 +1035,108 @@ static const char *scx_enable_state_str[] = { · 1034 unmodified lines
1035	};	1035	};
1036		1036
1037	/*	1037	/*
1038	* sched_ext_entity->ops_state	1038	* Task Ownership State Machine (sched_ext_entity->ops_state)
1039	*	1039	*
1040	* Used to track the task ownership between the SCX core and the BPF scheduler.	1040	* The sched_ext core uses this state machine to track task ownership
1041	* State transitions look as follows:	1041	* between the SCX core and the BPF scheduler. This allows the BPF
		1042	* scheduler to dispatch tasks without strict ordering requirements, while
		1043	* the SCX core safely rejects invalid dispatches.
1042	*	1044	*
1043	* NONE -> QUEUEING -> QUEUED -> DISPATCHING	1045	* State Transitions
1044	* ^ \| \|
1045	* \| v v
1046	* \-------------------------------/
1047	*	1046	*
1048	* QUEUEING and DISPATCHING states can be waited upon. See wait_ops_state() call	1047	* .------------> NONE (owned by SCX core)
1049	* sites for explanations on the conditions being waited upon and why they are	1048	* \| \| ^
1050	* safe. Transitions out of them into NONE or QUEUED must store_release and the	1049	* \| enqueue \| \| direct dispatch
1051	* waiters should load_acquire.	1050	* \| v \|
		1051	* \| QUEUEING -------'
		1052	* \| \|
		1053	* \| enqueue \|
		1054	* \| completes \|
		1055	* \| v
		1056	* \| QUEUED (owned by BPF scheduler)
		1057	* \| \|
		1058	* \| dispatch \|
		1059	* \| \|
		1060	* \| v
		1061	* \| DISPATCHING
		1062	* \| \|
		1063	* \| dispatch \|
		1064	* \| completes \|
		1065	* `---------------'
1052	*	1066	*
1053	* Tracking scx_ops_state enables sched_ext core to reliably determine whether	1067	* State Descriptions
1054	* any given task can be dispatched by the BPF scheduler at all times and thus	1068	*
1055	* relaxes the requirements on the BPF scheduler. This allows the BPF scheduler	1069	* - %SCX_OPSS_NONE:
1056	* to try to dispatch any task anytime regardless of its state as the SCX core	1070	* Task is owned by the SCX core. It's either on a run queue, running,
1057	* can safely reject invalid dispatches.	1071	* or being manipulated by the core scheduler. The BPF scheduler has no
		1072	* claim on this task.
		1073	*
		1074	* - %SCX_OPSS_QUEUEING:
		1075	* Transitional state while transferring a task from the SCX core to
		1076	* the BPF scheduler. The task's rq lock is held during this state.
		1077	* Since QUEUEING is both entered and exited under the rq lock, dequeue
		1078	* can never observe this state (it would be a BUG). When finishing a
		1079	* dispatch, if the task is still in %SCX_OPSS_QUEUEING the completion
		1080	* path busy-waits for it to leave this state (via wait_ops_state())
		1081	* before retrying.
		1082	*
		1083	* - %SCX_OPSS_QUEUED:
		1084	* Task is owned by the BPF scheduler. It's on a DSQ (dispatch queue)
		1085	* and the BPF scheduler is responsible for dispatching it. A QSEQ
		1086	* (queue sequence number) is embedded in this state to detect
		1087	* dispatch/dequeue races: if a task is dequeued and re-enqueued, the
		1088	* QSEQ changes and any in-flight dispatch operations targeting the old
		1089	* QSEQ are safely ignored.
		1090	*
		1091	* - %SCX_OPSS_DISPATCHING:
		1092	* Transitional state while transferring a task from the BPF scheduler
		1093	* back to the SCX core. This state indicates the BPF scheduler has
		1094	* selected the task for execution. When dequeue needs to take the task
		1095	* off a DSQ and it is still in %SCX_OPSS_DISPATCHING, the dequeue path
		1096	* busy-waits for it to leave this state (via wait_ops_state()) before
		1097	* proceeding. Exits to %SCX_OPSS_NONE when dispatch completes.
		1098	*
		1099	* Memory Ordering
		1100	*
		1101	* Transitions out of %SCX_OPSS_QUEUEING and %SCX_OPSS_DISPATCHING into
		1102	* %SCX_OPSS_NONE or %SCX_OPSS_QUEUED must use atomic_long_set_release()
		1103	* and waiters must use atomic_long_read_acquire(). This ensures proper
		1104	* synchronization between concurrent operations.
		1105	*
		1106	* Cross-CPU Task Migration
		1107	*
		1108	* When moving a task in the %SCX_OPSS_DISPATCHING state, we can't simply
		1109	* grab the target CPU's rq lock because a concurrent dequeue might be
		1110	* waiting on %SCX_OPSS_DISPATCHING while holding the source rq lock
		1111	* (deadlock).
		1112	*
		1113	* The sched_ext core uses a "lock dancing" protocol coordinated by
		1114	* p->scx.holding_cpu. When moving a task to a different rq:
		1115	*
		1116	* 1. Verify task can be moved (CPU affinity, migration_disabled, etc.)
		1117	* 2. Set p->scx.holding_cpu to the current CPU
		1118	* 3. Set task state to %SCX_OPSS_NONE; dequeue waits while DISPATCHING
		1119	* is set, so clearing DISPATCHING first prevents the circular wait
		1120	* (safe to lock the rq we need)
		1121	* 4. Unlock the current CPU's rq
		1122	* 5. Lock src_rq (where the task currently lives)
		1123	* 6. Verify p->scx.holding_cpu == current CPU, if not, dequeue won the
		1124	* race (dequeue clears holding_cpu to -1 when it takes the task), in
		1125	* this case migration is aborted
		1126	* 7. If src_rq == dst_rq: clear holding_cpu and enqueue directly
		1127	* into dst_rq's local DSQ (no lock swap needed)
		1128	* 8. Otherwise: call move_remote_task_to_local_dsq(), which releases
		1129	* src_rq, locks dst_rq, and performs the deactivate/activate
		1130	* migration cycle (dst_rq is held on return)
		1131	* 9. Unlock dst_rq and re-lock the current CPU's rq to restore
		1132	* the lock state expected by the caller
		1133	*
		1134	* If any verification fails, abort the migration.
		1135	*
		1136	* This state tracking allows the BPF scheduler to try to dispatch any task
		1137	* at any time regardless of its state. The SCX core can safely
		1138	* reject/ignore invalid dispatches, simplifying the BPF scheduler
		1139	* implementation.
1058	*/	1140	*/
1059	enum scx_ops_state {	1141	enum scx_ops_state {
1060	SCX_OPSS_NONE, /* owned by the SCX core */	1142	SCX_OPSS_NONE, /* owned by the SCX core */

kernel/sched/idle.c+30−9

 	return cpuidle_enter(drv, dev, next_state);
 }
+static void idle_call_stop_or_retain_tick(bool stop_tick)
+{
+	if (stop_tick || tick_nohz_tick_stopped())
+		tick_nohz_idle_stop_tick();
+	else
+		tick_nohz_idle_retain_tick();
+}
 /**
  * cpuidle_idle_call - the main idle function
  *
  * set, and it returns with polling set.  If it ever stops polling, it
  * must clear the polling bit.
  */
-static void cpuidle_idle_call(void)
+static void cpuidle_idle_call(bool stop_tick)
 {
 	struct cpuidle_device *dev = cpuidle_get_device();
 	struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
 	}
 	if (cpuidle_not_available(drv, dev)) {
-		tick_nohz_idle_stop_tick();
+		idle_call_stop_or_retain_tick(stop_tick);
 		default_idle_call();
 		goto exit_idle;
 		next_state = cpuidle_find_deepest_state(drv, dev, max_latency_ns);
 		call_cpuidle(drv, dev, next_state);
-	} else {
+	} else if (drv->state_count > 1) {
-		bool stop_tick = true;
+		/*
+		 * stop_tick is expected to be true by default by cpuidle
+		 * governors, which allows them to select idle states with
+		 * target residency above the tick period length.
+		 */
+		stop_tick = true;
 		/*
 		 * Ask the cpuidle framework to choose a convenient idle state.
 		 */
 		next_state = cpuidle_select(drv, dev, &stop_tick);
-		if (stop_tick || tick_nohz_tick_stopped())
+		idle_call_stop_or_retain_tick(stop_tick);
-			tick_nohz_idle_stop_tick();
-		else
-			tick_nohz_idle_retain_tick();
 		entered_state = call_cpuidle(drv, dev, next_state);
 		/*
 		 * Give the governor an opportunity to reflect on the outcome
 		 */
 		cpuidle_reflect(dev, entered_state);
+	} else {
+		idle_call_stop_or_retain_tick(stop_tick);
+		/*
+		 * If there is only a single idle state (or none), there is
+		 * nothing meaningful for the governor to choose.  Skip the
+		 * governor and always use state 0.
+		 */
+		call_cpuidle(drv, dev, 0);
 	}
 exit_idle:
 static void do_idle(void)
 {
 	int cpu = smp_processor_id();
+	bool got_tick = false;
 	/*
 	 * Check if we need to update blocked load
 			tick_nohz_idle_restart_tick();
 			cpu_idle_poll();
 		} else {
-			cpuidle_idle_call();
+			cpuidle_idle_call(got_tick);
 		}
+		got_tick = tick_nohz_idle_got_tick();
 		arch_cpu_idle_exit();
 	}

kernel/time/time.c+1−1

@@ -697,7 +697,7 @@ EXPORT_SYMBOL(clock_t_to_jiffies); · 696 unmodified lines
697	*	697	*
698	* Return: jiffies_64 value converted to 64-bit "clock_t" (CLOCKS_PER_SEC)	698	* Return: jiffies_64 value converted to 64-bit "clock_t" (CLOCKS_PER_SEC)
699	*/	699	*/
700	u64 jiffies_64_to_clock_t(u64 x)	700	notrace u64 jiffies_64_to_clock_t(u64 x)
701	{	701	{
702	#if (TICK_NSEC % (NSEC_PER_SEC / USER_HZ)) == 0	702	#if (TICK_NSEC % (NSEC_PER_SEC / USER_HZ)) == 0
703	# if HZ < USER_HZ	703	# if HZ < USER_HZ

kernel/workqueue.c+28−27

 	int			id;		/* I: pool ID */
 	unsigned int		flags;		/* L: flags */
-	unsigned long		watchdog_ts;	/* L: watchdog timestamp */
+	unsigned long		last_progress_ts;	/* L: last forward progress timestamp */
 	bool			cpu_stall;	/* WD: stalled cpu bound pool */
 	/*
 	WARN_ON_ONCE(!(*wdb & WORK_STRUCT_INACTIVE));
 	trace_workqueue_activate_work(work);
 	if (list_empty(&pwq->pool->worklist))
-		pwq->pool->watchdog_ts = jiffies;
+		pwq->pool->last_progress_ts = jiffies;
 	move_linked_works(work, &pwq->pool->worklist, NULL);
 	__clear_bit(WORK_STRUCT_INACTIVE_BIT, wdb);
 }
 	 */
 	if (list_empty(&pwq->inactive_works) && pwq_tryinc_nr_active(pwq, false)) {
 		if (list_empty(&pool->worklist))
-			pool->watchdog_ts = jiffies;
+			pool->last_progress_ts = jiffies;
 		trace_workqueue_activate_work(work);
 		insert_work(pwq, work, &pool->worklist, work_flags);
 	worker->current_pwq = pwq;
 	if (worker->task)
 		worker->current_at = worker->task->se.sum_exec_runtime;
+	worker->current_start = jiffies;
 	work_data = *work_data_bits(work);
 	worker->current_color = get_work_color(work_data);
 	while ((work = list_first_entry_or_null(&worker->scheduled,
 						struct work_struct, entry))) {
 		if (first) {
-			worker->pool->watchdog_ts = jiffies;
+			worker->pool->last_progress_ts = jiffies;
 			first = false;
 		}
 		process_one_work(worker, work);
 	pool->cpu = -1;
 	pool->node = NUMA_NO_NODE;
 	pool->flags |= POOL_DISASSOCIATED;
-	pool->watchdog_ts = jiffies;
+	pool->last_progress_ts = jiffies;
 	INIT_LIST_HEAD(&pool->worklist);
 	INIT_LIST_HEAD(&pool->idle_list);
 	hash_init(pool->busy_hash);
 {
 	struct worker_pool *pool = worker->pool;
-	if (pool->flags & WQ_BH)
+	if (pool->flags & POOL_BH)
 		pr_cont("bh%s",
 			pool->attrs->nice == HIGHPRI_NICE_LEVEL ? "-hi" : "");
 	else
 			pr_cont(" %s", comma ? "," : "");
 			pr_cont_worker_id(worker);
 			pr_cont(":%ps", worker->current_func);
+			pr_cont(" for %us",
+				jiffies_to_msecs(jiffies - worker->current_start) / 1000);
 			list_for_each_entry(work, &worker->scheduled, entry)
 				pr_cont_work(false, work, &pcws);
 			pr_cont_work_flush(comma, (work_func_t)-1L, &pcws);
 	/* How long the first pending work is waiting for a worker. */
 	if (!list_empty(&pool->worklist))
-		hung = jiffies_to_msecs(jiffies - pool->watchdog_ts) / 1000;
+		hung = jiffies_to_msecs(jiffies - pool->last_progress_ts) / 1000;
 	/*
 	 * Defer printing to avoid deadlocks in console drivers that
 /*
  * Show workers that might prevent the processing of pending work items.
- * The only candidates are CPU-bound workers in the running state.
+ * A busy worker that is not running on the CPU (e.g. sleeping in
- * Pending work items should be handled by another idle worker
+ * wait_event_idle() with PF_WQ_WORKER cleared) can stall the pool just as
- * in all other situations.
+ * effectively as a CPU-bound one, so dump every in-flight worker.
  */
-static void show_cpu_pool_hog(struct worker_pool *pool)
+static void show_cpu_pool_busy_workers(struct worker_pool *pool)
 {
 	struct worker *worker;
 	unsigned long irq_flags;
 	raw_spin_lock_irqsave(&pool->lock, irq_flags);
 	hash_for_each(pool->busy_hash, bkt, worker, hentry) {
-		if (task_is_running(worker->task)) {
+		/*
-			/*
+		 * Defer printing to avoid deadlocks in console
-			 * Defer printing to avoid deadlocks in console
+		 * drivers that queue work while holding locks
-			 * drivers that queue work while holding locks
+		 * also taken in their write paths.
-			 * also taken in their write paths.
+		 */
-			 */
+		printk_deferred_enter();
-			printk_deferred_enter();
-			pr_info("pool %d:\n", pool->id);
+		pr_info("pool %d:\n", pool->id);
-			sched_show_task(worker->task);
+		sched_show_task(worker->task);
-			printk_deferred_exit();
+		printk_deferred_exit();
-		}
 	}
 	raw_spin_unlock_irqrestore(&pool->lock, irq_flags);
 }
-static void show_cpu_pools_hogs(void)
+static void show_cpu_pools_busy_workers(void)
 {
 	struct worker_pool *pool;
 	int pi;
-	pr_info("Showing backtraces of running workers in stalled CPU-bound worker pools:\n");
+	pr_info("Showing backtraces of busy workers in stalled worker pools:\n");
 	rcu_read_lock();
 	for_each_pool(pool, pi) {
 		if (pool->cpu_stall)
-			show_cpu_pool_hog(pool);
+			show_cpu_pool_busy_workers(pool);
 	}
 			touched = READ_ONCE(per_cpu(wq_watchdog_touched_cpu, pool->cpu));
 		else
 			touched = READ_ONCE(wq_watchdog_touched);
-		pool_ts = READ_ONCE(pool->watchdog_ts);
+		pool_ts = READ_ONCE(pool->last_progress_ts);
 		if (time_after(pool_ts, touched))
 			ts = pool_ts;
 		show_all_workqueues();
 	if (cpu_pool_stall)
-		show_cpu_pools_hogs();
+		show_cpu_pools_busy_workers();
 	if (lockup_detected)
 		panic_on_wq_watchdog(max_stall_time);

kernel/workqueue_internal.h+1−0

@@ -32,6 +32,7 @@ struct worker { · 31 unmodified lines
32	work_func_t current_func; /* K: function */	32	work_func_t current_func; /* K: function */
33	struct pool_workqueue current_pwq; / K: pwq */	33	struct pool_workqueue current_pwq; / K: pwq */
34	u64 current_at; /* K: runtime at start or last wakeup */	34	u64 current_at; /* K: runtime at start or last wakeup */
		35	unsigned long current_start; /* K: start time of current work item */
35	unsigned int current_color; /* K: color */	36	unsigned int current_color; /* K: color */
36		37
37	int sleeping; /* S: is worker sleeping? */	38	int sleeping; /* S: is worker sleeping? */

lib/bootconfig.c+3−3

 			       depth ? "." : "");
 		if (ret < 0)
 			return ret;
-		if (ret > size) {
+		if (ret >= size) {
 			size = 0;
 		} else {
 			size -= ret;
 static int __init __xbc_open_brace(char *p)
 {
 	/* Push the last key as open brace */
-	open_brace[brace_index++] = xbc_node_index(last_parent);
 	if (brace_index >= XBC_DEPTH_MAX)
 		return xbc_parse_error("Exceed max depth of braces", p);
+	open_brace[brace_index++] = xbc_node_index(last_parent);
 	return 0;
 }
 	/* Brace closing */
 	if (brace_index) {
-		n = &xbc_nodes[open_brace[brace_index]];
+		n = &xbc_nodes[open_brace[brace_index - 1]];
 		return xbc_parse_error("Brace is not closed",
 					xbc_node_get_data(n));
 	}

lib/crypto/Makefile+3−0

@@ -55,6 +55,9 @@ libaes-$(CONFIG_SPARC) += sparc/aes_asm.o · 54 unmodified lines
55	libaes-$(CONFIG_X86) += x86/aes-aesni.o	55	libaes-$(CONFIG_X86) += x86/aes-aesni.o
56	endif # CONFIG_CRYPTO_LIB_AES_ARCH	56	endif # CONFIG_CRYPTO_LIB_AES_ARCH
57		57
		58	# clean-files must be defined unconditionally
		59	clean-files += powerpc/aesp8-ppc.S
		60
58	################################################################################	61	################################################################################
59		62
60	obj-$(CONFIG_CRYPTO_LIB_AESCFB) += libaescfb.o	63	obj-$(CONFIG_CRYPTO_LIB_AESCFB) += libaescfb.o

mm/huge_memory.c+2−1

@@ -2797,7 +2797,8 @@ int move_pages_huge_pmd(struct mm_struct mm, pmd_t dst_pmd, pmd_t *src_pmd, pm · 2796 unmodified lines
2797	_dst_pmd = pmd_mkwrite(pmd_mkdirty(_dst_pmd), dst_vma);	2797	_dst_pmd = pmd_mkwrite(pmd_mkdirty(_dst_pmd), dst_vma);
2798	} else {	2798	} else {
2799	src_pmdval = pmdp_huge_clear_flush(src_vma, src_addr, src_pmd);	2799	src_pmdval = pmdp_huge_clear_flush(src_vma, src_addr, src_pmd);
2800	_dst_pmd = folio_mk_pmd(src_folio, dst_vma->vm_page_prot);	2800	_dst_pmd = move_soft_dirty_pmd(src_pmdval);
		2801	_dst_pmd = clear_uffd_wp_pmd(_dst_pmd);
2801	}	2802	}
2802	set_pmd_at(mm, dst_addr, dst_pmd, _dst_pmd);	2803	set_pmd_at(mm, dst_addr, dst_pmd, _dst_pmd);
2803		2804

mm/rmap.c+17−4

 	if (userfaultfd_wp(vma))
 		return 1;
-	return folio_pte_batch(folio, pvmw->pte, pte, max_nr);
+	/*
+	 * If unmap fails, we need to restore the ptes. To avoid accidentally
+	 * upgrading write permissions for ptes that were not originally
+	 * writable, and to avoid losing the soft-dirty bit, use the
+	 * appropriate FPB flags.
+	 */
+	return folio_pte_batch_flags(folio, vma, pvmw->pte, &pte, max_nr,
+				     FPB_RESPECT_WRITE | FPB_RESPECT_SOFT_DIRTY);
 }
 /*
 			__maybe_unused pmd_t pmdval;
 			if (flags & TTU_SPLIT_HUGE_PMD) {
+				/*
+				 * split_huge_pmd_locked() might leave the
+				 * folio mapped through PTEs. Retry the walk
+				 * so we can detect this scenario and properly
+				 * abort the walk.
+				 */
 				split_huge_pmd_locked(vma, pvmw.address,
 						      pvmw.pmd, true);
-				ret = false;
+				flags &= ~TTU_SPLIT_HUGE_PMD;
-				page_vma_mapped_walk_done(&pvmw);
+				page_vma_mapped_walk_restart(&pvmw);
-				break;
+				continue;
 			}
 #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION
 			pmdval = pmdp_get(pvmw.pmd);

mm/slub.c+4−7

 	size_t sz = sizeof(struct slabobj_ext) * slab->objects;
 	struct kmem_cache *obj_exts_cache;
-	/*
-	 * slabobj_ext array for KMALLOC_CGROUP allocations
-	 * are served from KMALLOC_NORMAL caches.
-	 */
-	if (!mem_alloc_profiling_enabled())
-		return sz;
 	if (sz > KMALLOC_MAX_CACHE_SIZE)
 		return sz;
 	if (s->flags & SLAB_KMALLOC)
 		mark_obj_codetag_empty(sheaf);
+	VM_WARN_ON_ONCE(sheaf->size > 0);
 	kfree(sheaf);
 	stat(s, SHEAF_FREE);
 	return 0;
 }
+static void sheaf_flush_unused(struct kmem_cache *s, struct slab_sheaf *sheaf);
 static struct slab_sheaf *alloc_full_sheaf(struct kmem_cache *s, gfp_t gfp)
 {
 		return NULL;
 	if (refill_sheaf(s, sheaf, gfp | __GFP_NOMEMALLOC | __GFP_NOWARN)) {
+		sheaf_flush_unused(s, sheaf);
 		free_empty_sheaf(s, sheaf);
 		return NULL;
 	}
 			 * we must be very low on memory so don't bother
 			 * with the barn
 			 */
+			sheaf_flush_unused(s, empty);
 			free_empty_sheaf(s, empty);
 		}
 	} else {

net/atm/lec.c+47−25

@@ -154,10 +154,19 @@ static void lec_handle_bridge(struct sk_buff skb, struct net_device dev) · 153 unmodified lines
154	/* 0x01 is topology change */	154	/* 0x01 is topology change */
155		155
156	priv = netdev_priv(dev);	156	priv = netdev_priv(dev);
157	atm_force_charge(priv->lecd, skb2->truesize);	157	struct atm_vcc *vcc;
158	sk = sk_atm(priv->lecd);	158
159	skb_queue_tail(&sk->sk_receive_queue, skb2);	159	rcu_read_lock();
160	sk->sk_data_ready(sk);	160	vcc = rcu_dereference(priv->lecd);
		161	if (vcc) {
		162	atm_force_charge(vcc, skb2->truesize);
		163	sk = sk_atm(vcc);
		164	skb_queue_tail(&sk->sk_receive_queue, skb2);
		165	sk->sk_data_ready(sk);
		166	} else {
		167	dev_kfree_skb(skb2);
		168	}
		169	rcu_read_unlock();
161	}	170	}
162	}	171	}
163	#endif /* IS_ENABLED(CONFIG_BRIDGE) */	172	#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -216,7 +225,7 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb, · 52 unmodified lines
216	int is_rdesc;	225	int is_rdesc;
217		226
218	pr_debug("called\n");	227	pr_debug("called\n");
219	if (!priv->lecd) {	228	if (!rcu_access_pointer(priv->lecd)) {
220	pr_info("%s:No lecd attached\n", dev->name);	229	pr_info("%s:No lecd attached\n", dev->name);
221	dev->stats.tx_errors++;	230	dev->stats.tx_errors++;
222	netif_stop_queue(dev);	231	netif_stop_queue(dev);
@@ -449,10 +458,19 @@ static int lec_atm_send(struct atm_vcc vcc, struct sk_buff skb) · 226 unmodified lines
449	break;	458	break;
450	skb2->len = sizeof(struct atmlec_msg);	459	skb2->len = sizeof(struct atmlec_msg);
451	skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg));	460	skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg));
452	atm_force_charge(priv->lecd, skb2->truesize);	461	struct atm_vcc *vcc;
453	sk = sk_atm(priv->lecd);	462
454	skb_queue_tail(&sk->sk_receive_queue, skb2);	463	rcu_read_lock();
455	sk->sk_data_ready(sk);	464	vcc = rcu_dereference(priv->lecd);
		465	if (vcc) {
		466	atm_force_charge(vcc, skb2->truesize);
		467	sk = sk_atm(vcc);
		468	skb_queue_tail(&sk->sk_receive_queue, skb2);
		469	sk->sk_data_ready(sk);
		470	} else {
		471	dev_kfree_skb(skb2);
		472	}
		473	rcu_read_unlock();
456	}	474	}
457	}	475	}
458	#endif /* IS_ENABLED(CONFIG_BRIDGE) */	476	#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -468,23 +486,16 @@ static int lec_atm_send(struct atm_vcc vcc, struct sk_buff skb) · 9 unmodified lines
468		486
469	static void lec_atm_close(struct atm_vcc *vcc)	487	static void lec_atm_close(struct atm_vcc *vcc)
470	{	488	{
471	struct sk_buff *skb;
472	struct net_device dev = (struct net_device )vcc->proto_data;	489	struct net_device dev = (struct net_device )vcc->proto_data;
473	struct lec_priv *priv = netdev_priv(dev);	490	struct lec_priv *priv = netdev_priv(dev);
474		491
475	priv->lecd = NULL;	492	rcu_assign_pointer(priv->lecd, NULL);
		493	synchronize_rcu();
476	/* Do something needful? */	494	/* Do something needful? */
477		495
478	netif_stop_queue(dev);	496	netif_stop_queue(dev);
479	lec_arp_destroy(priv);	497	lec_arp_destroy(priv);
480		498
481	if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
482	pr_info("%s closing with messages pending\n", dev->name);
483	while ((skb = skb_dequeue(&sk_atm(vcc)->sk_receive_queue))) {
484	atm_return(vcc, skb->truesize);
485	dev_kfree_skb(skb);
486	}
487
488	pr_info("%s: Shut down!\n", dev->name);	499	pr_info("%s: Shut down!\n", dev->name);
489	module_put(THIS_MODULE);	500	module_put(THIS_MODULE);
490	}	501	}
@@ -510,12 +521,14 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type, · 19 unmodified lines
510	const unsigned char mac_addr, const unsigned char atm_addr,	521	const unsigned char mac_addr, const unsigned char atm_addr,
511	struct sk_buff *data)	522	struct sk_buff *data)
512	{	523	{
		524	struct atm_vcc *vcc;
513	struct sock *sk;	525	struct sock *sk;
514	struct sk_buff *skb;	526	struct sk_buff *skb;
515	struct atmlec_msg *mesg;	527	struct atmlec_msg *mesg;
516		528
517	if (!priv \|\| !priv->lecd)	529	if (!priv \|\| !rcu_access_pointer(priv->lecd))
518	return -1;	530	return -1;
		531
519	skb = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);	532	skb = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
520	if (!skb)	533	if (!skb)
521	return -1;	534	return -1;
@@ -532,18 +545,27 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type, · 10 unmodified lines
532	if (atm_addr)	545	if (atm_addr)
533	memcpy(&mesg->content.normal.atm_addr, atm_addr, ATM_ESA_LEN);	546	memcpy(&mesg->content.normal.atm_addr, atm_addr, ATM_ESA_LEN);
534		547
535	atm_force_charge(priv->lecd, skb->truesize);	548	rcu_read_lock();
536	sk = sk_atm(priv->lecd);	549	vcc = rcu_dereference(priv->lecd);
		550	if (!vcc) {
		551	rcu_read_unlock();
		552	kfree_skb(skb);
		553	return -1;
		554	}
		555
		556	atm_force_charge(vcc, skb->truesize);
		557	sk = sk_atm(vcc);
537	skb_queue_tail(&sk->sk_receive_queue, skb);	558	skb_queue_tail(&sk->sk_receive_queue, skb);
538	sk->sk_data_ready(sk);	559	sk->sk_data_ready(sk);
539		560
540	if (data != NULL) {	561	if (data != NULL) {
541	pr_debug("about to send %d bytes of data\n", data->len);	562	pr_debug("about to send %d bytes of data\n", data->len);
542	atm_force_charge(priv->lecd, data->truesize);	563	atm_force_charge(vcc, data->truesize);
543	skb_queue_tail(&sk->sk_receive_queue, data);	564	skb_queue_tail(&sk->sk_receive_queue, data);
544	sk->sk_data_ready(sk);	565	sk->sk_data_ready(sk);
545	}	566	}
546		567
		568	rcu_read_unlock();
547	return 0;	569	return 0;
548	}	570	}
549		571
@@ -618,7 +640,7 @@ static void lec_push(struct atm_vcc vcc, struct sk_buff skb) · 68 unmodified lines
618		640
619	atm_return(vcc, skb->truesize);	641	atm_return(vcc, skb->truesize);
620	if ((__be16 ) skb->data == htons(priv->lecid) \|\|	642	if ((__be16 ) skb->data == htons(priv->lecid) \|\|
621	!priv->lecd \|\| !(dev->flags & IFF_UP)) {	643	!rcu_access_pointer(priv->lecd) \|\| !(dev->flags & IFF_UP)) {
622	/*	644	/*
623	* Probably looping back, or if lecd is missing,	645	* Probably looping back, or if lecd is missing,
624	* lecd has gone down	646	* lecd has gone down
@@ -753,12 +775,12 @@ static int lecd_attach(struct atm_vcc *vcc, int arg) · 128 unmodified lines
753	priv = netdev_priv(dev_lec[i]);	775	priv = netdev_priv(dev_lec[i]);
754	} else {	776	} else {
755	priv = netdev_priv(dev_lec[i]);	777	priv = netdev_priv(dev_lec[i]);
756	if (priv->lecd)	778	if (rcu_access_pointer(priv->lecd))
757	return -EADDRINUSE;	779	return -EADDRINUSE;
758	}	780	}
759	lec_arp_init(priv);	781	lec_arp_init(priv);
760	priv->itfnum = i; /* LANE2 addition */	782	priv->itfnum = i; /* LANE2 addition */
761	priv->lecd = vcc;	783	rcu_assign_pointer(priv->lecd, vcc);
762	vcc->dev = &lecatm_dev;	784	vcc->dev = &lecatm_dev;
763	vcc_insert_socket(sk_atm(vcc));	785	vcc_insert_socket(sk_atm(vcc));
764		786

net/atm/lec.h+1−1

@@ -91,7 +91,7 @@ struct lec_priv { · 90 unmodified lines
91	*/	91	*/
92	spinlock_t lec_arp_lock;	92	spinlock_t lec_arp_lock;
93	struct atm_vcc mcast_vcc; / Default Multicast Send VCC */	93	struct atm_vcc mcast_vcc; / Default Multicast Send VCC */
94	struct atm_vcc *lecd;	94	struct atm_vcc __rcu *lecd;
95	struct delayed_work lec_arp_work; /* C10 */	95	struct delayed_work lec_arp_work; /* C10 */
96	unsigned int maximum_unknown_frame_count;	96	unsigned int maximum_unknown_frame_count;
97	/*	97	/*

net/batman-adv/bat_iv_ogm.c+3−0

@@ -473,6 +473,9 @@ batadv_iv_ogm_can_aggregate(const struct batadv_ogm_packet *new_bat_ogm_packet, · 472 unmodified lines
473	if (aggregated_bytes > max_bytes)	473	if (aggregated_bytes > max_bytes)
474	return false;	474	return false;
475		475
		476	if (skb_tailroom(forw_packet->skb) < packet_len)
		477	return false;
		478
476	if (packet_num >= BATADV_MAX_AGGREGATION_PACKETS)	479	if (packet_num >= BATADV_MAX_AGGREGATION_PACKETS)
477	return false;	480	return false;
478		481

net/bluetooth/hci_conn.c+2−2

 		return false;
 done:
+	conn->iso_qos = *qos;
 	if (hci_cmd_sync_queue(hdev, set_cig_params_sync,
 			       UINT_PTR(qos->ucast.cig), NULL) < 0)
 		return false;
 	}
 	hci_conn_hold(cis);
-	cis->iso_qos = *qos;
 	cis->state = BT_BOUND;
 	return cis;

net/bluetooth/hci_sync.c+1−1

 	 * state.
 	 */
 	if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
-		hci_scan_disable_sync(hdev);
 		hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED);
+		hci_scan_disable_sync(hdev);
 	}
 	/* Update random address, but set require_privacy to false so

net/bluetooth/hidp/core.c+14−2

 	skb_queue_purge(&session->intr_transmit);
 	fput(session->intr_sock->file);
 	fput(session->ctrl_sock->file);
-	l2cap_conn_put(session->conn);
+	if (session->conn)
+		l2cap_conn_put(session->conn);
 	kfree(session);
 }
 	down_write(&hidp_session_sem);
+	/* Drop L2CAP reference immediately to indicate that
+	 * l2cap_unregister_user() shall not be called as it is already
+	 * considered removed.
+	 */
+	if (session->conn) {
+		l2cap_conn_put(session->conn);
+		session->conn = NULL;
+	}
 	hidp_session_terminate(session);
 	cancel_work_sync(&session->dev_init);
 	 * Instead, this call has the same semantics as if user-space tried to
 	 * delete the session.
 	 */
-	l2cap_unregister_user(session->conn, &session->user);
+	if (session->conn)
+		l2cap_unregister_user(session->conn, &session->user);
 	hidp_session_put(session);
 	module_put_and_kthread_exit(0);

net/bluetooth/l2cap_core.c+31−20

 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
 {
-	struct hci_dev *hdev = conn->hcon->hdev;
 	int ret;
 	/* We need to check whether l2cap_conn is registered. If it is not, we
-	 * must not register the l2cap_user. l2cap_conn_del() is unregisters
+	 * must not register the l2cap_user. l2cap_conn_del() unregisters
-	 * l2cap_conn objects, but doesn't provide its own locking. Instead, it
+	 * l2cap_conn objects under conn->lock, and we use the same lock here
-	 * relies on the parent hci_conn object to be locked. This itself relies
+	 * to protect access to conn->users and conn->hchan.
-	 * on the hci_dev object to be locked. So we must lock the hci device
+	 */
-	 * here, too. */
-	hci_dev_lock(hdev);
+	mutex_lock(&conn->lock);
 	if (!list_empty(&user->list)) {
 		ret = -EINVAL;
 	ret = 0;
 out_unlock:
-	hci_dev_unlock(hdev);
+	mutex_unlock(&conn->lock);
 	return ret;
 }
 EXPORT_SYMBOL(l2cap_register_user);
 void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
 {
-	struct hci_dev *hdev = conn->hcon->hdev;
+	mutex_lock(&conn->lock);
-	hci_dev_lock(hdev);
 	if (list_empty(&user->list))
 		goto out_unlock;
 	user->remove(conn, user);
 out_unlock:
-	hci_dev_unlock(hdev);
+	mutex_unlock(&conn->lock);
 }
 EXPORT_SYMBOL(l2cap_unregister_user);
 	switch (type) {
 	case L2CAP_IT_FEAT_MASK:
-		conn->feat_mask = get_unaligned_le32(rsp->data);
+		if (cmd_len >= sizeof(*rsp) + sizeof(u32))
+			conn->feat_mask = get_unaligned_le32(rsp->data);
 		if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
 			struct l2cap_info_req req;
 		break;
 	case L2CAP_IT_FIXED_CHAN:
-		conn->remote_fixed_chan = rsp->data[0];
+		if (cmd_len >= sizeof(*rsp) + sizeof(rsp->data[0]))
+			conn->remote_fixed_chan = rsp->data[0];
 		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
 		conn->info_ident = 0;
 	u16 mtu, mps;
 	__le16 psm;
 	u8 result, rsp_len = 0;
-	int i, num_scid;
+	int i, num_scid = 0;
 	bool defer = false;
 	if (!enable_ecred)
 		goto response;
 	}
+	/* Check if there are no pending channels with the same ident */
+	__l2cap_chan_list_id(conn, cmd->ident, l2cap_ecred_list_defer,
+			     &num_scid);
+	if (num_scid) {
+		result = L2CAP_CR_LE_INVALID_PARAMS;
+		goto response;
+	}
 	cmd_len -= sizeof(*req);
 	num_scid = cmd_len / sizeof(u16);
 					 u8 *data)
 {
 	struct l2cap_chan *chan, *tmp;
-	struct l2cap_ecred_conn_rsp *rsp = (void *) data;
+	struct l2cap_ecred_reconf_rsp *rsp = (void *)data;
 	u16 result;
 	if (cmd_len < sizeof(*rsp))
 	result = __le16_to_cpu(rsp->result);
-	BT_DBG("result 0x%4.4x", rsp->result);
+	BT_DBG("result 0x%4.4x", result);
 	if (!result)
 		return 0;
 		return -ENOBUFS;
 	}
-	if (chan->imtu < skb->len) {
+	if (skb->len > chan->imtu) {
-		BT_ERR("Too big LE L2CAP PDU");
+		BT_ERR("Too big LE L2CAP PDU: len %u > %u", skb->len,
+		       chan->imtu);
+		l2cap_send_disconn_req(chan, ECONNRESET);
 		return -ENOBUFS;
 	}
 		       sdu_len, skb->len, chan->imtu);
 		if (sdu_len > chan->imtu) {
-			BT_ERR("Too big LE L2CAP SDU length received");
+			BT_ERR("Too big LE L2CAP SDU length: len %u > %u",
+			       skb->len, sdu_len);
+			l2cap_send_disconn_req(chan, ECONNRESET);
 			err = -EMSGSIZE;
 			goto failed;
 		}
 	if (chan->sdu->len + skb->len > chan->sdu_len) {
 		BT_ERR("Too much LE L2CAP data received");
+		l2cap_send_disconn_req(chan, ECONNRESET);
 		err = -EINVAL;
 		goto failed;
 	}

net/bluetooth/mgmt.c+2−5

 	sk = cmd->sk;
 	if (status) {
-		mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
+		mgmt_cmd_status(cmd->sk, hdev->id, cmd->opcode, status);
-				status);
-		mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev, true,
-				     cmd_status_rsp, &status);
 		goto done;
 	}
 	mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
 			  mgmt_status(status), &rp, sizeof(rp));
-	mgmt_pending_remove(cmd);
+	mgmt_pending_free(cmd);
 	hci_dev_unlock(hdev);
 	bt_dev_dbg(hdev, "add monitor %d complete, status %d",

net/bluetooth/smp.c+1−1

@@ -2743,7 +2743,7 @@ static int smp_cmd_public_key(struct l2cap_conn conn, struct sk_buff skb) · 2742 unmodified lines
2743	if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) &&	2743	if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) &&
2744	!crypto_memneq(key, smp->local_pk, 64)) {	2744	!crypto_memneq(key, smp->local_pk, 64)) {
2745	bt_dev_err(hdev, "Remote and local public keys are identical");	2745	bt_dev_err(hdev, "Remote and local public keys are identical");
2746	return SMP_UNSPECIFIED;	2746	return SMP_DHKEY_CHECK_FAILED;
2747	}	2747	}
2748		2748
2749	memcpy(smp->remote_pk, key, 64);	2749	memcpy(smp->remote_pk, key, 64);

net/bridge/br_cfm.c+2−2

@@ -576,7 +576,7 @@ static void mep_delete_implementation(struct net_bridge *br, · 575 unmodified lines
576		576
577	/* Empty and free peer MEP list */	577	/* Empty and free peer MEP list */
578	hlist_for_each_entry_safe(peer_mep, n_store, &mep->peer_mep_list, head) {	578	hlist_for_each_entry_safe(peer_mep, n_store, &mep->peer_mep_list, head) {
579	cancel_delayed_work_sync(&peer_mep->ccm_rx_dwork);	579	disable_delayed_work_sync(&peer_mep->ccm_rx_dwork);
580	hlist_del_rcu(&peer_mep->head);	580	hlist_del_rcu(&peer_mep->head);
581	kfree_rcu(peer_mep, rcu);	581	kfree_rcu(peer_mep, rcu);
582	}	582	}
@@ -732,7 +732,7 @@ int br_cfm_cc_peer_mep_remove(struct net_bridge *br, const u32 instance, · 149 unmodified lines
732	return -ENOENT;	732	return -ENOENT;
733	}	733	}
734		734
735	cc_peer_disable(peer_mep);	735	disable_delayed_work_sync(&peer_mep->ccm_rx_dwork);
736		736
737	hlist_del_rcu(&peer_mep->head);	737	hlist_del_rcu(&peer_mep->head);
738	kfree_rcu(peer_mep, rcu);	738	kfree_rcu(peer_mep, rcu);

net/ceph/auth.c+4−2

 	s32 result;
 	u64 global_id;
 	void *payload, *payload_end;
-	int payload_len;
+	u32 payload_len;
 	char *result_msg;
-	int result_msg_len;
+	u32 result_msg_len;
 	int ret = -EINVAL;
 	mutex_lock(&ac->mutex);
 	result = ceph_decode_32(&p);
 	global_id = ceph_decode_64(&p);
 	payload_len = ceph_decode_32(&p);
+	ceph_decode_need(&p, end, payload_len, bad);
 	payload = p;
 	p += payload_len;
 	ceph_decode_need(&p, end, sizeof(u32), bad);
 	result_msg_len = ceph_decode_32(&p);
+	ceph_decode_need(&p, end, result_msg_len, bad);
 	result_msg = p;
 	p += result_msg_len;
 	if (p != end)

net/ceph/messenger_v2.c+21−10

 	int head_len;
 	int rem_len;
-	BUG_ON(ctrl_len < 0 || ctrl_len > CEPH_MSG_MAX_CONTROL_LEN);
+	BUG_ON(ctrl_len < 1 || ctrl_len > CEPH_MSG_MAX_CONTROL_LEN);
 	if (secure) {
 		head_len = CEPH_PREAMBLE_SECURE_LEN;
 			head_len += padded_len(rem_len) + CEPH_GCM_TAG_LEN;
 		}
 	} else {
-		head_len = CEPH_PREAMBLE_PLAIN_LEN;
+		head_len = CEPH_PREAMBLE_PLAIN_LEN + ctrl_len + CEPH_CRC_LEN;
-		if (ctrl_len)
-			head_len += ctrl_len + CEPH_CRC_LEN;
 	}
 	return head_len;
 }
 		desc->fd_aligns[i] = ceph_decode_16(&p);
 	}
-	if (desc->fd_lens[0] < 0 ||
+	/*
+	 * This would fire for FRAME_TAG_WAIT (it has one empty
+	 * segment), but we should never get it as client.
+	 */
+	if (desc->fd_lens[0] < 1 ||
 	    desc->fd_lens[0] > CEPH_MSG_MAX_CONTROL_LEN) {
 		pr_err("bad control segment length %d\n", desc->fd_lens[0]);
 		return -EINVAL;
 	}
 	if (desc->fd_lens[1] < 0 ||
 	    desc->fd_lens[1] > CEPH_MSG_MAX_FRONT_LEN) {
 		pr_err("bad front segment length %d\n", desc->fd_lens[1]);
 		return -EINVAL;
 	}
-	/*
-	 * This would fire for FRAME_TAG_WAIT (it has one empty
-	 * segment), but we should never get it as client.
-	 */
 	if (!desc->fd_lens[desc->fd_seg_cnt - 1]) {
 		pr_err("last segment empty, segment count %d\n",
 		       desc->fd_seg_cnt);
 				  void *p, void *end)
 {
 	struct ceph_frame_desc *desc = &con->v2.in_desc;
-	struct ceph_msg_header2 *hdr2 = p;
+	struct ceph_msg_header2 *hdr2;
 	struct ceph_msg_header hdr;
 	int skip;
 	int ret;
 	u64 seq;
+	ceph_decode_need(&p, end, sizeof(*hdr2), bad);
+	hdr2 = p;
 	/* verify seq# */
 	seq = le64_to_cpu(hdr2->seq);
 	if ((s64)seq - (s64)con->in_seq < 1) {
 	WARN_ON(!con->in_msg);
 	WARN_ON(con->in_msg->con != con);
 	return 1;
+bad:
+	pr_err("failed to decode message header\n");
+	return -EINVAL;
 }
 static int process_message(struct ceph_connection *con)
 	if (con->v2.in_desc.fd_tag != FRAME_TAG_MESSAGE)
 		return process_control(con, p, end);
+	if (con->state != CEPH_CON_S_OPEN) {
+		con->error_msg = "protocol error, unexpected message";
+		return -EINVAL;
+	}
 	ret = process_message_header(con, p, end);
 	if (ret < 0)
 		return ret;

net/ceph/mon_client.c+3−3

@@ -72,8 +72,8 @@ static struct ceph_monmap ceph_monmap_decode(void p, void end, bool msgr2) · 71 unmodified lines
72	struct ceph_monmap *monmap = NULL;	72	struct ceph_monmap *monmap = NULL;
73	struct ceph_fsid fsid;	73	struct ceph_fsid fsid;
74	u32 struct_len;	74	u32 struct_len;
75	int blob_len;	75	u32 blob_len;
76	int num_mon;	76	u32 num_mon;
77	u8 struct_v;	77	u8 struct_v;
78	u32 epoch;	78	u32 epoch;
79	int ret;	79	int ret;
@@ -112,7 +112,7 @@ static struct ceph_monmap ceph_monmap_decode(void p, void end, bool msgr2) · 32 unmodified lines
112	}	112	}
113	ceph_decode_32_safe(p, end, num_mon, e_inval);	113	ceph_decode_32_safe(p, end, num_mon, e_inval);
114		114
115	dout("%s fsid %pU epoch %u num_mon %d\n", __func__, &fsid, epoch,	115	dout("%s fsid %pU epoch %u num_mon %u\n", __func__, &fsid, epoch,
116	num_mon);	116	num_mon);
117	if (num_mon > CEPH_MAX_MON)	117	if (num_mon > CEPH_MAX_MON)
118	goto e_inval;	118	goto e_inval;

net/ethernet/eth.c+3−6

 }
 EXPORT_SYMBOL(eth_type_trans);
-/**
+int eth_header_parse(const struct sk_buff *skb, const struct net_device *dev,
- * eth_header_parse - extract hardware address from packet
+		     unsigned char *haddr)
- * @skb: packet to extract header from
- * @haddr: destination buffer
- */
-int eth_header_parse(const struct sk_buff *skb, unsigned char *haddr)
 {
 	const struct ethhdr *eth = eth_hdr(skb);
 	memcpy(haddr, eth->h_source, ETH_ALEN);
 	return ETH_ALEN;
 }

net/ipv4/icmp.c+3−1

 static bool icmp_tag_validation(int proto)
 {
+	const struct net_protocol *ipprot;
 	bool ok;
 	rcu_read_lock();
-	ok = rcu_dereference(inet_protos[proto])->icmp_strict_tag_validation;
+	ipprot = rcu_dereference(inet_protos[proto]);
+	ok = ipprot ? ipprot->icmp_strict_tag_validation : false;
 	rcu_read_unlock();
 	return ok;
 }

net/ipv4/ip_gre.c+2−1

@@ -919,7 +919,8 @@ static int ipgre_header(struct sk_buff skb, struct net_device dev, · 918 unmodified lines
919	return -(t->hlen + sizeof(*iph));	919	return -(t->hlen + sizeof(*iph));
920	}	920	}
921		921
922	static int ipgre_header_parse(const struct sk_buff skb, unsigned char haddr)	922	static int ipgre_header_parse(const struct sk_buff skb, const struct net_device dev,
		923	unsigned char *haddr)
923	{	924	{
924	const struct iphdr iph = (const struct iphdr ) skb_mac_header(skb);	925	const struct iphdr iph = (const struct iphdr ) skb_mac_header(skb);
925	memcpy(haddr, &iph->saddr, 4);	926	memcpy(haddr, &iph->saddr, 4);

net/ipv6/exthdrs.c+4−0

 	hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 	idev = __in6_dev_get(skb->dev);
+	if (!idev) {
+		kfree_skb(skb);
+		return -1;
+	}
 	accept_seg6 = min(READ_ONCE(net->ipv6.devconf_all->seg6_enabled),
 			  READ_ONCE(idev->cnf.seg6_enabled));

net/ipv6/seg6_hmac.c+2−0

@@ -184,6 +184,8 @@ bool seg6_hmac_validate_skb(struct sk_buff *skb) · 183 unmodified lines
184	int require_hmac;	184	int require_hmac;
185		185
186	idev = __in6_dev_get(skb->dev);	186	idev = __in6_dev_get(skb->dev);
		187	if (!idev)
		188	return false;
187		189
188	srh = (struct ipv6_sr_hdr *)skb_transport_header(skb);	190	srh = (struct ipv6_sr_hdr *)skb_transport_header(skb);
189		191

net/mac80211/cfg.c+6−6

 	__sta_info_flush(sdata, true, link_id, NULL);
-	ieee80211_remove_link_keys(link, &keys);
-	if (!list_empty(&keys)) {
-		synchronize_net();
-		ieee80211_free_key_list(local, &keys);
-	}
 	ieee80211_stop_mbssid(sdata);
 	RCU_INIT_POINTER(link_conf->tx_bss_conf, NULL);
 	ieee80211_link_info_change_notify(sdata, link,
 					  BSS_CHANGED_BEACON_ENABLED);
+	ieee80211_remove_link_keys(link, &keys);
+	if (!list_empty(&keys)) {
+		synchronize_net();
+		ieee80211_free_key_list(local, &keys);
+	}
 	if (sdata->wdev.links[link_id].cac_started) {
 		chandef = link_conf->chanreq.oper;
 		wiphy_hrtimer_work_cancel(wiphy, &link->dfs_cac_timer_work);

net/mac80211/chan.c+4−2

 	rcu_read_lock();
 	list_for_each_entry_rcu(sta, &local->sta_list,
 				list) {
-		struct ieee80211_sub_if_data *sdata = sta->sdata;
+		struct ieee80211_sub_if_data *sdata;
 		enum ieee80211_sta_rx_bandwidth new_sta_bw;
 		unsigned int link_id;
 		if (!ieee80211_sdata_running(sta->sdata))
 			continue;
-		for (link_id = 0; link_id < ARRAY_SIZE(sta->sdata->link); link_id++) {
+		sdata = get_bss_sdata(sta->sdata);
+		for (link_id = 0; link_id < ARRAY_SIZE(sdata->link); link_id++) {
 			struct ieee80211_link_data *link =
 				rcu_dereference(sdata->link[link_id]);
 			struct ieee80211_bss_conf *link_conf;

net/mac80211/debugfs.c+5−9

 static ssize_t aql_enable_write(struct file *file, const char __user *user_buf,
 				size_t count, loff_t *ppos)
 {
-	bool aql_disabled = static_key_false(&aql_disable.key);
 	char buf[3];
 	size_t len;
 	if (len > 0 && buf[len - 1] == '\n')
 		buf[len - 1] = 0;
-	if (buf[0] == '0' && buf[1] == '\0') {
+	if (buf[0] == '0' && buf[1] == '\0')
-		if (!aql_disabled)
+		static_branch_enable(&aql_disable);
-			static_branch_inc(&aql_disable);
+	else if (buf[0] == '1' && buf[1] == '\0')
-	} else if (buf[0] == '1' && buf[1] == '\0') {
+		static_branch_disable(&aql_disable);
-		if (aql_disabled)
+	else
-			static_branch_dec(&aql_disable);
-	} else {
 		return -EINVAL;
-	}
 	return count;
 }

net/mac80211/mesh.c+3−0

 	 *   - MDA enabled
 	 * - Power management control on fc
 	 */
+	if (!ie->mesh_config)
+		return false;
 	if (!(ifmsh->mesh_id_len == ie->mesh_id_len &&
 	     memcmp(ifmsh->mesh_id, ie->mesh_id, ie->mesh_id_len) == 0 &&
 	     (ifmsh->mesh_pp_id == ie->mesh_config->meshconf_psel) &&

net/mac80211/sta_info.c+5−2

 	}
 	link_sinfo->inactive_time =
-		jiffies_to_msecs(jiffies - ieee80211_sta_last_active(sta, link_id));
+		jiffies_delta_to_msecs(jiffies -
+				       ieee80211_sta_last_active(sta,
+								 link_id));
 	if (!(link_sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES64) |
 				    BIT_ULL(NL80211_STA_INFO_TX_BYTES)))) {
 	sinfo->connected_time = ktime_get_seconds() - sta->last_connected;
 	sinfo->assoc_at = sta->assoc_at;
 	sinfo->inactive_time =
-		jiffies_to_msecs(jiffies - ieee80211_sta_last_active(sta, -1));
+		jiffies_delta_to_msecs(jiffies -
+				       ieee80211_sta_last_active(sta, -1));
 	if (!(sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES64) |
 			       BIT_ULL(NL80211_STA_INFO_TX_BYTES)))) {

net/mac80211/tdls.c+1−1

@@ -1444,7 +1444,7 @@ int ieee80211_tdls_oper(struct wiphy wiphy, struct net_device dev, · 1443 unmodified lines
1444	}	1444	}
1445		1445
1446	sta = sta_info_get(sdata, peer);	1446	sta = sta_info_get(sdata, peer);
1447	if (!sta)	1447	if (!sta \|\| !sta->sta.tdls)
1448	return -ENOLINK;	1448	return -ENOLINK;
1449		1449
1450	iee80211_tdls_recalc_chanctx(sdata, sta);	1450	iee80211_tdls_recalc_chanctx(sdata, sta);

net/mac80211/tx.c+3−1

 	struct ieee80211_tx_data tx;
 	struct sk_buff *skb2;
-	if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP)
+	if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP) {
+		kfree_skb(skb);
 		return false;
+	}
 	info->band = band;
 	info->control.vif = vif;

net/mac802154/iface.c+3−1

@@ -469,7 +469,9 @@ static int mac802154_header_create(struct sk_buff *skb, · 468 unmodified lines
469	}	469	}
470		470
471	static int	471	static int
472	mac802154_header_parse(const struct sk_buff skb, unsigned char haddr)	472	mac802154_header_parse(const struct sk_buff *skb,
		473	const struct net_device *dev,
		474	unsigned char *haddr)
473	{	475	{
474	struct ieee802154_hdr hdr;	476	struct ieee802154_hdr hdr;
475		477

net/mpls/af_mpls.c+1−0

@@ -2851,6 +2851,7 @@ out_unregister_rtnl_af: · 2850 unmodified lines
2851	rtnl_af_unregister(&mpls_af_ops);	2851	rtnl_af_unregister(&mpls_af_ops);
2852	out_unregister_dev_type:	2852	out_unregister_dev_type:
2853	dev_remove_pack(&mpls_packet_type);	2853	dev_remove_pack(&mpls_packet_type);
		2854	unregister_netdevice_notifier(&mpls_dev_notifier);
2854	out_unregister_pernet:	2855	out_unregister_pernet:
2855	unregister_pernet_subsys(&mpls_net_ops);	2856	unregister_pernet_subsys(&mpls_net_ops);
2856	goto out;	2857	goto out;

net/mptcp/pm_kernel.c+1−1

@@ -838,7 +838,7 @@ static struct lock_class_key mptcp_keys[2]; · 837 unmodified lines
838	static int mptcp_pm_nl_create_listen_socket(struct sock *sk,	838	static int mptcp_pm_nl_create_listen_socket(struct sock *sk,
839	struct mptcp_pm_addr_entry *entry)	839	struct mptcp_pm_addr_entry *entry)
840	{	840	{
841	bool is_ipv6 = sk->sk_family == AF_INET6;	841	bool is_ipv6 = entry->addr.family == AF_INET6;
842	int addrlen = sizeof(struct sockaddr_in);	842	int addrlen = sizeof(struct sockaddr_in);
843	struct sockaddr_storage addr;	843	struct sockaddr_storage addr;
844	struct sock newsk, ssk;	844	struct sock newsk, ssk;

net/netfilter/nf_bpf_link.c+1−1

@@ -170,7 +170,7 @@ static int bpf_nf_link_update(struct bpf_link link, struct bpf_prog new_prog, · 169 unmodified lines
170		170
171	static const struct bpf_link_ops bpf_nf_link_lops = {	171	static const struct bpf_link_ops bpf_nf_link_lops = {
172	.release = bpf_nf_link_release,	172	.release = bpf_nf_link_release,
173	.dealloc = bpf_nf_link_dealloc,	173	.dealloc_deferred = bpf_nf_link_dealloc,
174	.detach = bpf_nf_link_detach,	174	.detach = bpf_nf_link_detach,
175	.show_fdinfo = bpf_nf_link_show_info,	175	.show_fdinfo = bpf_nf_link_show_info,
176	.fill_link_info = bpf_nf_link_fill_link_info,	176	.fill_link_info = bpf_nf_link_fill_link_info,

net/netfilter/nf_conntrack_h323_asn1.c+4−0

 		if (nf_h323_error_boundary(bs, 0, 2))
 			return H323_ERROR_BOUND;
 		len = get_bits(bs, 2) + 1;
+		if (nf_h323_error_boundary(bs, len, 0))
+			return H323_ERROR_BOUND;
 		BYTE_ALIGN(bs);
 		if (base && (f->attr & DECODE)) {	/* timeToLive */
 			unsigned int v = get_uint(bs, len) + f->lb;
 				break;
 			p++;
 			len--;
+			if (len <= 0)
+				break;
 			return DecodeH323_UserInformation(buf, p, len,
 							  &q931->UUIE);
 		}

net/netfilter/nf_conntrack_netlink.c+26−2

 {
 	struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
 	struct nf_conn *ct = cb->data;
-	struct nf_conn_help *help = nfct_help(ct);
+	struct nf_conn_help *help;
 	u_int8_t l3proto = nfmsg->nfgen_family;
 	unsigned long last_id = cb->args[1];
 	struct nf_conntrack_expect *exp;
 	if (cb->args[0])
 		return 0;
+	help = nfct_help(ct);
+	if (!help)
+		return 0;
 	rcu_read_lock();
 restart:
 	return skb->len;
 }
+static int ctnetlink_dump_exp_ct_start(struct netlink_callback *cb)
+{
+	struct nf_conn *ct = cb->data;
+	if (!refcount_inc_not_zero(&ct->ct_general.use))
+		return -ENOENT;
+	return 0;
+}
+static int ctnetlink_dump_exp_ct_done(struct netlink_callback *cb)
+{
+	struct nf_conn *ct = cb->data;
+	if (ct)
+		nf_ct_put(ct);
+	return 0;
+}
 static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl,
 				 struct sk_buff *skb,
 				 const struct nlmsghdr *nlh,
 	struct nf_conntrack_zone zone;
 	struct netlink_dump_control c = {
 		.dump = ctnetlink_exp_ct_dump_table,
+		.start = ctnetlink_dump_exp_ct_start,
+		.done = ctnetlink_dump_exp_ct_done,
 	};
 	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER,
 #if IS_ENABLED(CONFIG_NF_NAT)
 static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = {
-	[CTA_EXPECT_NAT_DIR]	= { .type = NLA_U32 },
+	[CTA_EXPECT_NAT_DIR]	= NLA_POLICY_MAX(NLA_BE32, IP_CT_DIR_REPLY),
 	[CTA_EXPECT_NAT_TUPLE]	= { .type = NLA_NESTED },
 };
 #endif

net/netfilter/nf_conntrack_proto_sctp.c+2−1

@@ -582,7 +582,8 @@ nla_put_failure: · 581 unmodified lines
582	}	582	}
583		583
584	static const struct nla_policy sctp_nla_policy[CTA_PROTOINFO_SCTP_MAX+1] = {	584	static const struct nla_policy sctp_nla_policy[CTA_PROTOINFO_SCTP_MAX+1] = {
585	[CTA_PROTOINFO_SCTP_STATE] = { .type = NLA_U8 },	585	[CTA_PROTOINFO_SCTP_STATE] = NLA_POLICY_MAX(NLA_U8,
		586	SCTP_CONNTRACK_HEARTBEAT_SENT),
586	[CTA_PROTOINFO_SCTP_VTAG_ORIGINAL] = { .type = NLA_U32 },	587	[CTA_PROTOINFO_SCTP_VTAG_ORIGINAL] = { .type = NLA_U32 },
587	[CTA_PROTOINFO_SCTP_VTAG_REPLY] = { .type = NLA_U32 },	588	[CTA_PROTOINFO_SCTP_VTAG_REPLY] = { .type = NLA_U32 },
588	};	589	};

net/netfilter/nf_conntrack_sip.c+5−1

 {
 	struct tcphdr *th, _tcph;
 	unsigned int dataoff, datalen;
-	unsigned int matchoff, matchlen, clen;
+	unsigned int matchoff, matchlen;
 	unsigned int msglen, origlen;
 	const char *dptr, *end;
 	s16 diff, tdiff = 0;
 	int ret = NF_ACCEPT;
+	unsigned long clen;
 	bool term;
 	if (ctinfo != IP_CT_ESTABLISHED &&
 		if (dptr + matchoff == end)
 			break;
+		if (clen > datalen)
+			break;
 		term = false;
 		for (; end + strlen("\r\n\r\n") <= dptr + datalen; end++) {
 			if (end[0] == '\r' && end[1] == '\n' &&

net/netfilter/nf_flow_table_ip.c+1−0

@@ -738,6 +738,7 @@ static int nf_flow_encap_push(struct sk_buff *skb, · 737 unmodified lines
738	switch (tuple->encap[i].proto) {	738	switch (tuple->encap[i].proto) {
739	case htons(ETH_P_8021Q):	739	case htons(ETH_P_8021Q):
740	case htons(ETH_P_8021AD):	740	case htons(ETH_P_8021AD):
		741	skb_reset_mac_header(skb);
741	if (skb_vlan_push(skb, tuple->encap[i].proto,	742	if (skb_vlan_push(skb, tuple->encap[i].proto,
742	tuple->encap[i].id) < 0)	743	tuple->encap[i].id) < 0)
743	return -1;	744	return -1;

net/netfilter/nf_tables_api.c+7−19

 	}
 }
-static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
+void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
-				      struct nft_set_elem_expr *elem_expr)
+			       struct nft_set_elem_expr *elem_expr)
 {
 	struct nft_expr *expr;
 	u32 size;
 }
 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
-			    const struct nlattr *attr, u32 nlmsg_flags,
+			    const struct nlattr *attr, u32 nlmsg_flags)
-			    bool last)
 {
 	struct nft_expr *expr_array[NFT_SET_EXPR_MAX] = {};
 	struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
 	if (flags)
 		*nft_set_ext_flags(ext) = flags;
-	if (last)
-		elem.flags = NFT_SET_ELEM_INTERNAL_LAST;
-	else
-		elem.flags = 0;
 	if (obj)
 		*nft_set_ext_obj(ext) = obj;
 	nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
 	nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
-		err = nft_add_set_elem(&ctx, set, attr, info->nlh->nlmsg_flags,
+		err = nft_add_set_elem(&ctx, set, attr, info->nlh->nlmsg_flags);
-				       nla_is_last(attr, rem));
 		if (err < 0) {
 			NL_SET_BAD_ATTR(extack, attr);
 			return err;
 }
 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
-			   const struct nlattr *attr, bool last)
+			   const struct nlattr *attr)
 {
 	struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
 	struct nft_set_ext_tmpl tmpl;
 	if (flags)
 		*nft_set_ext_flags(ext) = flags;
-	if (last)
-		elem.flags = NFT_SET_ELEM_INTERNAL_LAST;
-	else
-		elem.flags = 0;
 	trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
 	if (trans == NULL)
 		goto fail_trans;
 		return nft_set_flush(&ctx, set, genmask);
 	nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
-		err = nft_del_setelem(&ctx, set, attr,
+		err = nft_del_setelem(&ctx, set, attr);
-				      nla_is_last(attr, rem));
 		if (err == -ENOENT &&
 		    NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYSETELEM)
 			continue;
 	return 0;
 err_flowtable_hooks:
+	synchronize_rcu();
 	nft_trans_destroy(trans);
 err_flowtable_trans:
 	nft_hooks_destroy(&flowtable->hook_list);

net/netfilter/nfnetlink_osf.c+13−0

 {
 	struct nf_osf_user_finger *f;
 	struct nf_osf_finger *kf = NULL, *sf;
+	unsigned int tot_opt_len = 0;
 	int err = 0;
+	int i;
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
 	if (f->opt_num > ARRAY_SIZE(f->opt))
 		return -EINVAL;
+	for (i = 0; i < f->opt_num; i++) {
+		if (!f->opt[i].length || f->opt[i].length > MAX_IPOPTLEN)
+			return -EINVAL;
+		if (f->opt[i].kind == OSFOPT_MSS && f->opt[i].length < 4)
+			return -EINVAL;
+		tot_opt_len += f->opt[i].length;
+		if (tot_opt_len > MAX_IPOPTLEN)
+			return -EINVAL;
+	}
 	if (!memchr(f->genre, 0, MAXGENRELEN) ||
 	    !memchr(f->subtype, 0, MAXGENRELEN) ||
 	    !memchr(f->version, 0, MAXGENRELEN))

net/netfilter/nft_ct.c+4−0

 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_conntrack_seqadj.h>
+#include "nf_internals.h"
 struct nft_ct_helper_obj  {
 	struct nf_conntrack_helper *helper4;
 #endif
 #ifdef CONFIG_NF_CONNTRACK_ZONES
 	case NFT_CT_ZONE:
+		nf_queue_nf_hook_drop(ctx->net);
 		mutex_lock(&nft_ct_pcpu_mutex);
 		if (--nft_ct_pcpu_template_refcnt == 0)
 			nft_ct_tmpl_put_pcpu();
 	struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 	struct nf_ct_timeout *timeout = priv->timeout;
+	nf_queue_nf_hook_drop(ctx->net);
 	nf_ct_untimeout(ctx->net, timeout);
 	nf_ct_netns_put(ctx->net, ctx->family);
 	kfree(priv->timeout);
 {
 	struct nft_ct_helper_obj *priv = nft_obj_data(obj);
+	nf_queue_nf_hook_drop(ctx->net);
 	if (priv->helper4)
 		nf_conntrack_helper_put(priv->helper4);
 	if (priv->helper6)

net/netfilter/nft_dynset.c+9−1

 				 const struct nft_set_ext *ext)
 {
 	struct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext);
+	struct nft_ctx ctx = {
+		.net	= read_pnet(&priv->set->net),
+		.family	= priv->set->table->family,
+	};
 	struct nft_expr *expr;
 	int i;
 	for (i = 0; i < priv->num_exprs; i++) {
 		expr = nft_setelem_expr_at(elem_expr, elem_expr->size);
 		if (nft_expr_clone(expr, priv->expr_array[i], GFP_ATOMIC) < 0)
-			return -1;
+			goto err_out;
 		elem_expr->size += priv->expr_array[i]->ops->size;
 	}
 	return 0;
+err_out:
+	nft_set_elem_expr_destroy(&ctx, elem_expr);
+	return -1;
 }
 struct nft_elem_priv *nft_dynset_new(struct nft_set *set,

net/netfilter/nft_set_rbtree.c+10−61

@@ -304,19 +304,10 @@ static void nft_rbtree_set_start_cookie(struct nft_rbtree *priv, · 303 unmodified lines
304	priv->start_rbe_cookie = (unsigned long)rbe;	304	priv->start_rbe_cookie = (unsigned long)rbe;
305	}	305	}
306		306
307	static void nft_rbtree_set_start_cookie_open(struct nft_rbtree *priv,
308	const struct nft_rbtree_elem *rbe,
309	unsigned long open_interval)
310	{
311	priv->start_rbe_cookie = (unsigned long)rbe \| open_interval;
312	}
313
314	#define NFT_RBTREE_OPEN_INTERVAL 1UL
315
316	static bool nft_rbtree_cmp_start_cookie(struct nft_rbtree *priv,	307	static bool nft_rbtree_cmp_start_cookie(struct nft_rbtree *priv,
317	const struct nft_rbtree_elem *rbe)	308	const struct nft_rbtree_elem *rbe)
318	{	309	{
319	return (priv->start_rbe_cookie & ~NFT_RBTREE_OPEN_INTERVAL) == (unsigned long)rbe;	310	return priv->start_rbe_cookie == (unsigned long)rbe;
320	}	311	}
321		312
322	static bool nft_rbtree_insert_same_interval(const struct net *net,	313	static bool nft_rbtree_insert_same_interval(const struct net *net,
@@ -346,14 +337,13 @@ static bool nft_rbtree_insert_same_interval(const struct net *net, · 23 unmodified lines
346		337
347	static int __nft_rbtree_insert(const struct net net, const struct nft_set set,	338	static int __nft_rbtree_insert(const struct net net, const struct nft_set set,
348	struct nft_rbtree_elem *new,	339	struct nft_rbtree_elem *new,
349	struct nft_elem_priv **elem_priv, u64 tstamp, bool last)	340	struct nft_elem_priv **elem_priv, u64 tstamp)
350	{	341	{
351	struct nft_rbtree_elem rbe, rbe_le = NULL, rbe_ge = NULL, rbe_prev;	342	struct nft_rbtree_elem rbe, rbe_le = NULL, rbe_ge = NULL, rbe_prev;
352	struct rb_node node, next, parent, p, first = NULL;	343	struct rb_node node, next, parent, p, first = NULL;
353	struct nft_rbtree *priv = nft_set_priv(set);	344	struct nft_rbtree *priv = nft_set_priv(set);
354	u8 cur_genmask = nft_genmask_cur(net);	345	u8 cur_genmask = nft_genmask_cur(net);
355	u8 genmask = nft_genmask_next(net);	346	u8 genmask = nft_genmask_next(net);
356	unsigned long open_interval = 0;
357	int d;	347	int d;
358		348
359	/* Descend the tree to search for an existing element greater than the	349	/* Descend the tree to search for an existing element greater than the
@@ -459,18 +449,10 @@ static int __nft_rbtree_insert(const struct net net, const struct nft_set set, · 99 unmodified lines
459	}	449	}
460	}	450	}
461		451
462	if (nft_rbtree_interval_null(set, new)) {	452	if (nft_rbtree_interval_null(set, new))
		453	priv->start_rbe_cookie = 0;
		454	else if (nft_rbtree_interval_start(new) && priv->start_rbe_cookie)
463	priv->start_rbe_cookie = 0;	455	priv->start_rbe_cookie = 0;
464	} else if (nft_rbtree_interval_start(new) && priv->start_rbe_cookie) {
465	if (nft_set_is_anonymous(set)) {
466	priv->start_rbe_cookie = 0;
467	} else if (priv->start_rbe_cookie & NFT_RBTREE_OPEN_INTERVAL) {
468	/* Previous element is an open interval that partially
469	* overlaps with an existing non-open interval.
470	*/
471	return -ENOTEMPTY;
472	}
473	}
474		456
475	/* - new start element matching existing start element: full overlap	457	/* - new start element matching existing start element: full overlap
476	* reported as -EEXIST, cleared by caller if NLM_F_EXCL is not given.	458	* reported as -EEXIST, cleared by caller if NLM_F_EXCL is not given.
@@ -478,27 +460,7 @@ static int __nft_rbtree_insert(const struct net net, const struct nft_set set, · 1 unmodified line
478	if (rbe_ge && !nft_rbtree_cmp(set, new, rbe_ge) &&	460	if (rbe_ge && !nft_rbtree_cmp(set, new, rbe_ge) &&
479	nft_rbtree_interval_start(rbe_ge) == nft_rbtree_interval_start(new)) {	461	nft_rbtree_interval_start(rbe_ge) == nft_rbtree_interval_start(new)) {
480	*elem_priv = &rbe_ge->priv;	462	*elem_priv = &rbe_ge->priv;
481		463	nft_rbtree_set_start_cookie(priv, rbe_ge);
482	/* - Corner case: new start element of open interval (which
483	* comes as last element in the batch) overlaps the start of
484	* an existing interval with an end element: partial overlap.
485	*/
486	node = rb_first(&priv->root);
487	rbe = __nft_rbtree_next_active(node, genmask);
488	if (rbe && nft_rbtree_interval_end(rbe)) {
489	rbe = nft_rbtree_next_active(rbe, genmask);
490	if (rbe &&
491	nft_rbtree_interval_start(rbe) &&
492	!nft_rbtree_cmp(set, new, rbe)) {
493	if (last)
494	return -ENOTEMPTY;
495
496	/* Maybe open interval? */
497	open_interval = NFT_RBTREE_OPEN_INTERVAL;
498	}
499	}
500	nft_rbtree_set_start_cookie_open(priv, rbe_ge, open_interval);
501
502	return -EEXIST;	464	return -EEXIST;
503	}	465	}
504		466
@@ -553,12 +515,6 @@ static int __nft_rbtree_insert(const struct net net, const struct nft_set set, · 48 unmodified lines
553	nft_rbtree_interval_end(rbe_ge) && nft_rbtree_interval_end(new))	515	nft_rbtree_interval_end(rbe_ge) && nft_rbtree_interval_end(new))
554	return -ENOTEMPTY;	516	return -ENOTEMPTY;
555		517
556	/* - start element overlaps an open interval but end element is new:
557	* partial overlap, reported as -ENOEMPTY.
558	*/
559	if (!rbe_ge && priv->start_rbe_cookie && nft_rbtree_interval_end(new))
560	return -ENOTEMPTY;
561
562	/* Accepted element: pick insertion point depending on key value */	518	/* Accepted element: pick insertion point depending on key value */
563	parent = NULL;	519	parent = NULL;
564	p = &priv->root.rb_node;	520	p = &priv->root.rb_node;
@@ -668,7 +624,6 @@ static int nft_rbtree_insert(const struct net net, const struct nft_set set, · 103 unmodified lines
668	struct nft_elem_priv **elem_priv)	624	struct nft_elem_priv **elem_priv)
669	{	625	{
670	struct nft_rbtree_elem *rbe = nft_elem_priv_cast(elem->priv);	626	struct nft_rbtree_elem *rbe = nft_elem_priv_cast(elem->priv);
671	bool last = !!(elem->flags & NFT_SET_ELEM_INTERNAL_LAST);
672	struct nft_rbtree *priv = nft_set_priv(set);	627	struct nft_rbtree *priv = nft_set_priv(set);
673	u64 tstamp = nft_net_tstamp(net);	628	u64 tstamp = nft_net_tstamp(net);
674	int err;	629	int err;
@@ -685,12 +640,8 @@ static int nft_rbtree_insert(const struct net net, const struct nft_set set, · 10 unmodified lines
685	cond_resched();	640	cond_resched();
686		641
687	write_lock(&priv->lock);	642	write_lock(&priv->lock);
688	err = __nft_rbtree_insert(net, set, rbe, elem_priv, tstamp, last);	643	err = __nft_rbtree_insert(net, set, rbe, elem_priv, tstamp);
689	write_unlock(&priv->lock);	644	write_unlock(&priv->lock);
690
691	if (nft_rbtree_interval_end(rbe))
692	priv->start_rbe_cookie = 0;
693
694	} while (err == -EAGAIN);	645	} while (err == -EAGAIN);
695		646
696	return err;	647	return err;
@@ -773,7 +724,6 @@ nft_rbtree_deactivate(const struct net net, const struct nft_set set, · 76 unmodified lines
773	const struct nft_set_elem *elem)	724	const struct nft_set_elem *elem)
774	{	725	{
775	struct nft_rbtree_elem rbe, this = nft_elem_priv_cast(elem->priv);	726	struct nft_rbtree_elem rbe, this = nft_elem_priv_cast(elem->priv);
776	bool last = !!(elem->flags & NFT_SET_ELEM_INTERNAL_LAST);
777	struct nft_rbtree *priv = nft_set_priv(set);	727	struct nft_rbtree *priv = nft_set_priv(set);
778	const struct rb_node *parent = priv->root.rb_node;	728	const struct rb_node *parent = priv->root.rb_node;
779	u8 genmask = nft_genmask_next(net);	729	u8 genmask = nft_genmask_next(net);
@@ -814,10 +764,9 @@ nft_rbtree_deactivate(const struct net net, const struct nft_set set, · 34 unmodified lines
814	continue;	764	continue;
815	}	765	}
816		766
817	if (nft_rbtree_interval_start(rbe)) {	767	if (nft_rbtree_interval_start(rbe))
818	if (!last)	768	nft_rbtree_set_start_cookie(priv, rbe);
819	nft_rbtree_set_start_cookie(priv, rbe);	769	else if (!nft_rbtree_deactivate_same_interval(net, priv, rbe))
820	} else if (!nft_rbtree_deactivate_same_interval(net, priv, rbe))
821	return NULL;	770	return NULL;
822		771
823	nft_rbtree_flush(net, set, &rbe->priv);	772	nft_rbtree_flush(net, set, &rbe->priv);

net/netfilter/xt_CT.c+4−0

 #include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_conntrack_timeout.h>
 #include <net/netfilter/nf_conntrack_zones.h>
+#include "nf_internals.h"
 static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
 {
 	struct nf_conn_help *help;
 	if (ct) {
+		if (info->helper[0] || info->timeout[0])
+			nf_queue_nf_hook_drop(par->net);
 		help = nfct_help(ct);
 		xt_ct_put_helper(help);

net/netfilter/xt_time.c+2−2

@@ -222,13 +222,13 @@ time_mt(const struct sk_buff skb, struct xt_action_param par) · 221 unmodified lines
222		222
223	localtime_2(&current_time, stamp);	223	localtime_2(&current_time, stamp);
224		224
225	if (!(info->weekdays_match & (1 << current_time.weekday)))	225	if (!(info->weekdays_match & (1U << current_time.weekday)))
226	return false;	226	return false;
227		227
228	/* Do not spend time computing monthday if all days match anyway */	228	/* Do not spend time computing monthday if all days match anyway */
229	if (info->monthdays_match != XT_TIME_ALL_MONTHDAYS) {	229	if (info->monthdays_match != XT_TIME_ALL_MONTHDAYS) {
230	localtime_3(&current_time, stamp);	230	localtime_3(&current_time, stamp);
231	if (!(info->monthdays_match & (1 << current_time.monthday)))	231	if (!(info->monthdays_match & (1U << current_time.monthday)))
232	return false;	232	return false;
233	}	233	}
234		234

net/phonet/af_phonet.c+4−1

 	return 1;
 }
-static int pn_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+static int pn_header_parse(const struct sk_buff *skb,
+			   const struct net_device *dev,
+			   unsigned char *haddr)
 {
 	const u8 *media = skb_mac_header(skb);
 	*haddr = *media;
 	return 1;
 }

net/rose/af_rose.c+5−0

 		goto out_release;
 	}
+	if (sk->sk_state == TCP_SYN_SENT) {
+		err = -EALREADY;
+		goto out_release;
+	}
 	sk->sk_state   = TCP_CLOSE;
 	sock->state = SS_UNCONNECTED;

net/sched/sch_generic.c+0−27

@@ -1313,33 +1313,6 @@ static void dev_deactivate_queue(struct net_device *dev, · 1312 unmodified lines
1313	}	1313	}
1314	}	1314	}
1315		1315
1316	static void dev_reset_queue(struct net_device *dev,
1317	struct netdev_queue *dev_queue,
1318	void *_unused)
1319	{
1320	struct Qdisc *qdisc;
1321	bool nolock;
1322
1323	qdisc = rtnl_dereference(dev_queue->qdisc_sleeping);
1324	if (!qdisc)
1325	return;
1326
1327	nolock = qdisc->flags & TCQ_F_NOLOCK;
1328
1329	if (nolock)
1330	spin_lock_bh(&qdisc->seqlock);
1331	spin_lock_bh(qdisc_lock(qdisc));
1332
1333	qdisc_reset(qdisc);
1334
1335	spin_unlock_bh(qdisc_lock(qdisc));
1336	if (nolock) {
1337	clear_bit(__QDISC_STATE_MISSED, &qdisc->state);
1338	clear_bit(__QDISC_STATE_DRAINING, &qdisc->state);
1339	spin_unlock_bh(&qdisc->seqlock);
1340	}
1341	}
1342
1343	static bool some_qdisc_is_busy(struct net_device *dev)	1316	static bool some_qdisc_is_busy(struct net_device *dev)
1344	{	1317	{
1345	unsigned int i;	1318	unsigned int i;

net/sched/sch_ingress.c+8−6

 {
 	struct ingress_sched_data *q = qdisc_priv(sch);
 	struct net_device *dev = qdisc_dev(sch);
-	struct bpf_mprog_entry *entry = rtnl_dereference(dev->tcx_ingress);
+	struct bpf_mprog_entry *entry;
 	if (sch->parent != TC_H_INGRESS)
 		return;
 	tcf_block_put_ext(q->block, sch, &q->block_info);
-	if (entry) {
+	if (mini_qdisc_pair_inited(&q->miniqp)) {
+		entry = rtnl_dereference(dev->tcx_ingress);
 		tcx_miniq_dec(entry);
 		if (!tcx_entry_is_active(entry)) {
 			tcx_entry_update(dev, NULL, true);
 static void clsact_destroy(struct Qdisc *sch)
 {
+	struct bpf_mprog_entry *ingress_entry, *egress_entry;
 	struct clsact_sched_data *q = qdisc_priv(sch);
 	struct net_device *dev = qdisc_dev(sch);
-	struct bpf_mprog_entry *ingress_entry = rtnl_dereference(dev->tcx_ingress);
-	struct bpf_mprog_entry *egress_entry = rtnl_dereference(dev->tcx_egress);
 	if (sch->parent != TC_H_CLSACT)
 		return;
 	tcf_block_put_ext(q->ingress_block, sch, &q->ingress_block_info);
 	tcf_block_put_ext(q->egress_block, sch, &q->egress_block_info);
-	if (ingress_entry) {
+	if (mini_qdisc_pair_inited(&q->miniqp_ingress)) {
+		ingress_entry = rtnl_dereference(dev->tcx_ingress);
 		tcx_miniq_dec(ingress_entry);
 		if (!tcx_entry_is_active(ingress_entry)) {
 			tcx_entry_update(dev, NULL, true);
 		}
 	}
-	if (egress_entry) {
+	if (mini_qdisc_pair_inited(&q->miniqp_egress)) {
+		egress_entry = rtnl_dereference(dev->tcx_egress);
 		tcx_miniq_dec(egress_entry);
 		if (!tcx_entry_is_active(egress_entry)) {
 			tcx_entry_update(dev, NULL, false);

net/sched/sch_teql.c+2−5

 					master->slaves = NEXT_SLAVE(q);
 					if (q == master->slaves) {
 						struct netdev_queue *txq;
-						spinlock_t *root_lock;
 						txq = netdev_get_tx_queue(master->dev, 0);
 						master->slaves = NULL;
-						root_lock = qdisc_root_sleeping_lock(rtnl_dereference(txq->qdisc));
+						dev_reset_queue(master->dev,
-						spin_lock_bh(root_lock);
+								txq, NULL);
-						qdisc_reset(rtnl_dereference(txq->qdisc));
-						spin_unlock_bh(root_lock);
 					}
 				}
 				skb_queue_purge(&dat->q);

net/shaper/shaper.c+93−65

 	return &((struct net_shaper_nl_ctx *)ctx)->binding;
 }
-static void net_shaper_lock(struct net_shaper_binding *binding)
+static struct net_shaper_hierarchy *
+net_shaper_hierarchy(struct net_shaper_binding *binding)
 {
-	switch (binding->type) {
+	/* Pairs with WRITE_ONCE() in net_shaper_hierarchy_setup. */
-	case NET_SHAPER_BINDING_TYPE_NETDEV:
+	if (binding->type == NET_SHAPER_BINDING_TYPE_NETDEV)
-		netdev_lock(binding->netdev);
+		return READ_ONCE(binding->netdev->net_shaper_hierarchy);
-		break;
-	}
-}
-static void net_shaper_unlock(struct net_shaper_binding *binding)
+	/* No other type supported yet. */
-{
+	return NULL;
-	switch (binding->type) {
-	case NET_SHAPER_BINDING_TYPE_NETDEV:
-		netdev_unlock(binding->netdev);
-		break;
-	}
 }
 static struct net_shaper_hierarchy *
-net_shaper_hierarchy(struct net_shaper_binding *binding)
+net_shaper_hierarchy_rcu(struct net_shaper_binding *binding)
 {
-	/* Pairs with WRITE_ONCE() in net_shaper_hierarchy_setup. */
+	/* Readers look up the device and take a ref, then take RCU lock
-	if (binding->type == NET_SHAPER_BINDING_TYPE_NETDEV)
+	 * later at which point netdev may have been unregistered and flushed.
+	 * READ_ONCE() pairs with WRITE_ONCE() in net_shaper_hierarchy_setup.
+	 */
+	if (binding->type == NET_SHAPER_BINDING_TYPE_NETDEV &&
+	    READ_ONCE(binding->netdev->reg_state) <= NETREG_REGISTERED)
 		return READ_ONCE(binding->netdev->net_shaper_hierarchy);
 	/* No other type supported yet. */
 	return 0;
 }
+/* Like net_shaper_ctx_setup(), but for "write" handlers (never for dumps!)
+ * Acquires the lock protecting the hierarchy (instance lock for netdev).
+ */
+static int net_shaper_ctx_setup_lock(const struct genl_info *info, int type,
+				     struct net_shaper_nl_ctx *ctx)
+{
+	struct net *ns = genl_info_net(info);
+	struct net_device *dev;
+	int ifindex;
+	if (GENL_REQ_ATTR_CHECK(info, type))
+		return -EINVAL;
+	ifindex = nla_get_u32(info->attrs[type]);
+	dev = netdev_get_by_index_lock(ns, ifindex);
+	if (!dev) {
+		NL_SET_BAD_ATTR(info->extack, info->attrs[type]);
+		return -ENOENT;
+	}
+	if (!dev->netdev_ops->net_shaper_ops) {
+		NL_SET_BAD_ATTR(info->extack, info->attrs[type]);
+		netdev_unlock(dev);
+		return -EOPNOTSUPP;
+	}
+	ctx->binding.type = NET_SHAPER_BINDING_TYPE_NETDEV;
+	ctx->binding.netdev = dev;
+	return 0;
+}
 static void net_shaper_ctx_cleanup(struct net_shaper_nl_ctx *ctx)
 {
 	if (ctx->binding.type == NET_SHAPER_BINDING_TYPE_NETDEV)
 		netdev_put(ctx->binding.netdev, &ctx->dev_tracker);
 }
+static void net_shaper_ctx_cleanup_unlock(struct net_shaper_nl_ctx *ctx)
+{
+	if (ctx->binding.type == NET_SHAPER_BINDING_TYPE_NETDEV)
+		netdev_unlock(ctx->binding.netdev);
+}
 static u32 net_shaper_handle_to_index(const struct net_shaper_handle *handle)
 {
 	return FIELD_PREP(NET_SHAPER_SCOPE_MASK, handle->scope) |
 net_shaper_lookup(struct net_shaper_binding *binding,
 		  const struct net_shaper_handle *handle)
 {
-	struct net_shaper_hierarchy *hierarchy = net_shaper_hierarchy(binding);
 	u32 index = net_shaper_handle_to_index(handle);
+	struct net_shaper_hierarchy *hierarchy;
+	hierarchy = net_shaper_hierarchy_rcu(binding);
 	if (!hierarchy || xa_get_mark(&hierarchy->shapers, index,
 				      NET_SHAPER_NOT_VALID))
 		return NULL;
 }
 /* Allocate on demand the per device shaper's hierarchy container.
- * Called under the net shaper lock
+ * Called under the lock protecting the hierarchy (instance lock for netdev)
  */
 static struct net_shaper_hierarchy *
 net_shaper_hierarchy_setup(struct net_shaper_binding *binding)
 	net_shaper_generic_post(info);
 }
+int net_shaper_nl_pre_doit_write(const struct genl_split_ops *ops,
+				struct sk_buff *skb, struct genl_info *info)
+{
+	struct net_shaper_nl_ctx *ctx = (struct net_shaper_nl_ctx *)info->ctx;
+	BUILD_BUG_ON(sizeof(*ctx) > sizeof(info->ctx));
+	return net_shaper_ctx_setup_lock(info, NET_SHAPER_A_IFINDEX, ctx);
+}
+void net_shaper_nl_post_doit_write(const struct genl_split_ops *ops,
+				   struct sk_buff *skb, struct genl_info *info)
+{
+	net_shaper_ctx_cleanup_unlock((struct net_shaper_nl_ctx *)info->ctx);
+}
 int net_shaper_nl_pre_dumpit(struct netlink_callback *cb)
 {
 	struct net_shaper_nl_ctx *ctx = (struct net_shaper_nl_ctx *)cb->ctx;
 	/* Don't error out dumps performed before any set operation. */
 	binding = net_shaper_binding_from_ctx(ctx);
-	hierarchy = net_shaper_hierarchy(binding);
-	if (!hierarchy)
-		return 0;
 	rcu_read_lock();
+	hierarchy = net_shaper_hierarchy_rcu(binding);
+	if (!hierarchy)
+		goto out_unlock;
 	for (; (shaper = xa_find(&hierarchy->shapers, &ctx->start_index,
 				 U32_MAX, XA_PRESENT)); ctx->start_index++) {
 		ret = net_shaper_fill_one(skb, binding, shaper, info);
 		if (ret)
 			break;
 	}
+out_unlock:
 	rcu_read_unlock();
 	return ret;
 	binding = net_shaper_binding_from_ctx(info->ctx);
-	net_shaper_lock(binding);
 	ret = net_shaper_parse_info(binding, info->attrs, info, &shaper,
 				    &exists);
 	if (ret)
-		goto unlock;
+		return ret;
 	if (!exists)
 		net_shaper_default_parent(&shaper.handle, &shaper.parent);
 	hierarchy = net_shaper_hierarchy_setup(binding);
-	if (!hierarchy) {
+	if (!hierarchy)
-		ret = -ENOMEM;
+		return -ENOMEM;
-		goto unlock;
-	}
 	/* The 'set' operation can't create node-scope shapers. */
 	handle = shaper.handle;
 	if (handle.scope == NET_SHAPER_SCOPE_NODE &&
-	    !net_shaper_lookup(binding, &handle)) {
+	    !net_shaper_lookup(binding, &handle))
-		ret = -ENOENT;
+		return -ENOENT;
-		goto unlock;
-	}
 	ret = net_shaper_pre_insert(binding, &handle, info->extack);
 	if (ret)
-		goto unlock;
+		return ret;
 	ops = net_shaper_ops(binding);
 	ret = ops->set(binding, &shaper, info->extack);
 	if (ret) {
 		net_shaper_rollback(binding);
-		goto unlock;
+		return ret;
 	}
 	net_shaper_commit(binding, 1, &shaper);
-unlock:
+	return 0;
-	net_shaper_unlock(binding);
-	return ret;
 }
 static int __net_shaper_delete(struct net_shaper_binding *binding,
 	binding = net_shaper_binding_from_ctx(info->ctx);
-	net_shaper_lock(binding);
 	ret = net_shaper_parse_handle(info->attrs[NET_SHAPER_A_HANDLE], info,
 				      &handle);
 	if (ret)
-		goto unlock;
+		return ret;
 	hierarchy = net_shaper_hierarchy(binding);
-	if (!hierarchy) {
+	if (!hierarchy)
-		ret = -ENOENT;
+		return -ENOENT;
-		goto unlock;
-	}
 	shaper = net_shaper_lookup(binding, &handle);
-	if (!shaper) {
+	if (!shaper)
-		ret = -ENOENT;
+		return -ENOENT;
-		goto unlock;
-	}
 	if (handle.scope == NET_SHAPER_SCOPE_NODE) {
 		ret = net_shaper_pre_del_node(binding, shaper, info->extack);
 		if (ret)
-			goto unlock;
+			return ret;
 	}
-	ret = __net_shaper_delete(binding, shaper, info->extack);
+	return __net_shaper_delete(binding, shaper, info->extack);
-unlock:
-	net_shaper_unlock(binding);
-	return ret;
 }
 static int net_shaper_group_send_reply(struct net_shaper_binding *binding,
 	if (!net_shaper_ops(binding)->group)
 		return -EOPNOTSUPP;
-	net_shaper_lock(binding);
 	leaves_count = net_shaper_list_len(info, NET_SHAPER_A_LEAVES);
 	if (!leaves_count) {
 		NL_SET_BAD_ATTR(info->extack,
 				info->attrs[NET_SHAPER_A_LEAVES]);
-		ret = -EINVAL;
+		return -EINVAL;
-		goto unlock;
 	}
 	leaves = kcalloc(leaves_count, sizeof(struct net_shaper) +
 			 sizeof(struct net_shaper *), GFP_KERNEL);
-	if (!leaves) {
+	if (!leaves)
-		ret = -ENOMEM;
+		return -ENOMEM;
-		goto unlock;
-	}
 	old_nodes = (void *)&leaves[leaves_count];
 	ret = net_shaper_parse_node(binding, info->attrs, info, &node);
 free_leaves:
 	kfree(leaves);
-unlock:
-	net_shaper_unlock(binding);
 	return ret;
 free_msg:
 	if (!hierarchy)
 		return;
-	net_shaper_lock(binding);
 	xa_lock(&hierarchy->shapers);
 	xa_for_each(&hierarchy->shapers, index, cur) {
 		__xa_erase(&hierarchy->shapers, index);
 		kfree(cur);
 	}
 	xa_unlock(&hierarchy->shapers);
-	net_shaper_unlock(binding);
 	kfree(hierarchy);
 }

net/shaper/shaper_nl_gen.c+6−6

@@ -99,27 +99,27 @@ static const struct genl_split_ops net_shaper_nl_ops[] = { · 98 unmodified lines
99	},	99	},
100	{	100	{
101	.cmd = NET_SHAPER_CMD_SET,	101	.cmd = NET_SHAPER_CMD_SET,
102	.pre_doit = net_shaper_nl_pre_doit,	102	.pre_doit = net_shaper_nl_pre_doit_write,
103	.doit = net_shaper_nl_set_doit,	103	.doit = net_shaper_nl_set_doit,
104	.post_doit = net_shaper_nl_post_doit,	104	.post_doit = net_shaper_nl_post_doit_write,
105	.policy = net_shaper_set_nl_policy,	105	.policy = net_shaper_set_nl_policy,
106	.maxattr = NET_SHAPER_A_IFINDEX,	106	.maxattr = NET_SHAPER_A_IFINDEX,
107	.flags = GENL_ADMIN_PERM \| GENL_CMD_CAP_DO,	107	.flags = GENL_ADMIN_PERM \| GENL_CMD_CAP_DO,
108	},	108	},
109	{	109	{
110	.cmd = NET_SHAPER_CMD_DELETE,	110	.cmd = NET_SHAPER_CMD_DELETE,
111	.pre_doit = net_shaper_nl_pre_doit,	111	.pre_doit = net_shaper_nl_pre_doit_write,
112	.doit = net_shaper_nl_delete_doit,	112	.doit = net_shaper_nl_delete_doit,
113	.post_doit = net_shaper_nl_post_doit,	113	.post_doit = net_shaper_nl_post_doit_write,
114	.policy = net_shaper_delete_nl_policy,	114	.policy = net_shaper_delete_nl_policy,
115	.maxattr = NET_SHAPER_A_IFINDEX,	115	.maxattr = NET_SHAPER_A_IFINDEX,
116	.flags = GENL_ADMIN_PERM \| GENL_CMD_CAP_DO,	116	.flags = GENL_ADMIN_PERM \| GENL_CMD_CAP_DO,
117	},	117	},
118	{	118	{
119	.cmd = NET_SHAPER_CMD_GROUP,	119	.cmd = NET_SHAPER_CMD_GROUP,
120	.pre_doit = net_shaper_nl_pre_doit,	120	.pre_doit = net_shaper_nl_pre_doit_write,
121	.doit = net_shaper_nl_group_doit,	121	.doit = net_shaper_nl_group_doit,
122	.post_doit = net_shaper_nl_post_doit,	122	.post_doit = net_shaper_nl_post_doit_write,
123	.policy = net_shaper_group_nl_policy,	123	.policy = net_shaper_group_nl_policy,
124	.maxattr = NET_SHAPER_A_LEAVES,	124	.maxattr = NET_SHAPER_A_LEAVES,
125	.flags = GENL_ADMIN_PERM \| GENL_CMD_CAP_DO,	125	.flags = GENL_ADMIN_PERM \| GENL_CMD_CAP_DO,

net/shaper/shaper_nl_gen.h+5−0

 int net_shaper_nl_pre_doit(const struct genl_split_ops *ops,
 			   struct sk_buff *skb, struct genl_info *info);
+int net_shaper_nl_pre_doit_write(const struct genl_split_ops *ops,
+				 struct sk_buff *skb, struct genl_info *info);
 int net_shaper_nl_cap_pre_doit(const struct genl_split_ops *ops,
 			       struct sk_buff *skb, struct genl_info *info);
 void
 net_shaper_nl_post_doit(const struct genl_split_ops *ops, struct sk_buff *skb,
 			struct genl_info *info);
 void
+net_shaper_nl_post_doit_write(const struct genl_split_ops *ops,
+			      struct sk_buff *skb, struct genl_info *info);
+void
 net_shaper_nl_cap_post_doit(const struct genl_split_ops *ops,
 			    struct sk_buff *skb, struct genl_info *info);
 int net_shaper_nl_pre_dumpit(struct netlink_callback *cb);

net/smc/af_smc.c+17−6

 	struct smc_sock *smc;
 	struct sock *child;
-	smc = smc_clcsock_user_data(sk);
+	rcu_read_lock();
+	smc = smc_clcsock_user_data_rcu(sk);
+	if (!smc || !refcount_inc_not_zero(&smc->sk.sk_refcnt)) {
+		rcu_read_unlock();
+		smc = NULL;
+		goto drop;
+	}
+	rcu_read_unlock();
 	if (READ_ONCE(sk->sk_ack_backlog) + atomic_read(&smc->queued_smc_hs) >
 				sk->sk_max_ack_backlog)
 		if (inet_csk(child)->icsk_af_ops == inet_csk(sk)->icsk_af_ops)
 			inet_csk(child)->icsk_af_ops = smc->ori_af_ops;
 	}
+	sock_put(&smc->sk);
 	return child;
 drop:
 	dst_release(dst);
 	tcp_listendrop(sk);
+	if (smc)
+		sock_put(&smc->sk);
 	return NULL;
 }
 	struct sock *clcsk = smc->clcsock->sk;
 	write_lock_bh(&clcsk->sk_callback_lock);
-	clcsk->sk_user_data = NULL;
+	rcu_assign_sk_user_data(clcsk, NULL);
 	smc_clcsock_restore_cb(&clcsk->sk_state_change, &smc->clcsk_state_change);
 	smc_clcsock_restore_cb(&clcsk->sk_data_ready, &smc->clcsk_data_ready);
 	struct sock *clcsk = smc->clcsock->sk;
 	write_lock_bh(&clcsk->sk_callback_lock);
-	clcsk->sk_user_data = (void *)((uintptr_t)smc | SK_USER_DATA_NOCOPY);
+	__rcu_assign_sk_user_data_with_flags(clcsk, smc, SK_USER_DATA_NOCOPY);
 	smc_clcsock_replace_cb(&clcsk->sk_state_change, smc_fback_state_change,
 			       &smc->clcsk_state_change);
 	 * smc-specific sk_data_ready function
 	 */
 	write_lock_bh(&smc->clcsock->sk->sk_callback_lock);
-	smc->clcsock->sk->sk_user_data =
+	__rcu_assign_sk_user_data_with_flags(smc->clcsock->sk, smc,
-		(void *)((uintptr_t)smc | SK_USER_DATA_NOCOPY);
+					     SK_USER_DATA_NOCOPY);
 	smc_clcsock_replace_cb(&smc->clcsock->sk->sk_data_ready,
 			       smc_clcsock_data_ready, &smc->clcsk_data_ready);
 	write_unlock_bh(&smc->clcsock->sk->sk_callback_lock);
 		write_lock_bh(&smc->clcsock->sk->sk_callback_lock);
 		smc_clcsock_restore_cb(&smc->clcsock->sk->sk_data_ready,
 				       &smc->clcsk_data_ready);
-		smc->clcsock->sk->sk_user_data = NULL;
+		rcu_assign_sk_user_data(smc->clcsock->sk, NULL);
 		write_unlock_bh(&smc->clcsock->sk->sk_callback_lock);
 		goto out;
 	}
+	sock_set_flag(sk, SOCK_RCU_FREE);
 	sk->sk_max_ack_backlog = backlog;
 	sk->sk_ack_backlog = 0;
 	sk->sk_state = SMC_LISTEN;

net/smc/smc.h+5−0

 	       ((uintptr_t)clcsk->sk_user_data & ~SK_USER_DATA_NOCOPY);
 }
+static inline struct smc_sock *smc_clcsock_user_data_rcu(const struct sock *clcsk)
+{
+	return (struct smc_sock *)rcu_dereference_sk_user_data(clcsk);
+}
 /* save target_cb in saved_cb, and replace target_cb with new_cb */
 static inline void smc_clcsock_replace_cb(void (**target_cb)(struct sock *),
 					  void (*new_cb)(struct sock *),

net/smc/smc_close.c+1−1

@@ -218,7 +218,7 @@ again: · 217 unmodified lines
218	write_lock_bh(&smc->clcsock->sk->sk_callback_lock);	218	write_lock_bh(&smc->clcsock->sk->sk_callback_lock);
219	smc_clcsock_restore_cb(&smc->clcsock->sk->sk_data_ready,	219	smc_clcsock_restore_cb(&smc->clcsock->sk->sk_data_ready,
220	&smc->clcsk_data_ready);	220	&smc->clcsk_data_ready);
221	smc->clcsock->sk->sk_user_data = NULL;	221	rcu_assign_sk_user_data(smc->clcsock->sk, NULL);
222	write_unlock_bh(&smc->clcsock->sk->sk_callback_lock);	222	write_unlock_bh(&smc->clcsock->sk->sk_callback_lock);
223	rc = kernel_sock_shutdown(smc->clcsock, SHUT_RDWR);	223	rc = kernel_sock_shutdown(smc->clcsock, SHUT_RDWR);
224	}	224	}

net/sunrpc/cache.c+21−5

 	struct cache_reader *rp = filp->private_data;
 	if (rp) {
+		struct cache_request *rq = NULL;
 		spin_lock(&queue_lock);
 		if (rp->offset) {
 			struct cache_queue *cq;
-			for (cq= &rp->q; &cq->list != &cd->queue;
+			for (cq = &rp->q; &cq->list != &cd->queue;
-			     cq = list_entry(cq->list.next, struct cache_queue, list))
+			     cq = list_entry(cq->list.next,
+					     struct cache_queue, list))
 				if (!cq->reader) {
-					container_of(cq, struct cache_request, q)
+					struct cache_request *cr =
-						->readers--;
+						container_of(cq,
+						struct cache_request, q);
+					cr->readers--;
+					if (cr->readers == 0 &&
+					    !test_bit(CACHE_PENDING,
+						      &cr->item->flags)) {
+						list_del(&cr->q.list);
+						rq = cr;
+					}
 					break;
 				}
 			rp->offset = 0;
 		list_del(&rp->q.list);
 		spin_unlock(&queue_lock);
+		if (rq) {
+			cache_put(rq->item, cd);
+			kfree(rq->buf);
+			kfree(rq);
+		}
 		filp->private_data = NULL;
 		kfree(rp);
 	}
 	if (filp->f_mode & FMODE_WRITE) {
 		atomic_dec(&cd->writers);

net/sunrpc/xprtrdma/verbs.c+4−3

 	needed += RPCRDMA_MAX_RECV_BATCH;
 	if (atomic_inc_return(&ep->re_receiving) > 1)
-		goto out;
+		goto out_dec;
 	/* fast path: all needed reps can be found on the free list */
 	wr = NULL;
 		++count;
 	}
 	if (!wr)
-		goto out;
+		goto out_dec;
 	rc = ib_post_recv(ep->re_id->qp, wr,
 			  (const struct ib_recv_wr **)&bad_wr);
 			--count;
 		}
 	}
+out_dec:
 	if (atomic_dec_return(&ep->re_receiving) > 0)
 		complete(&ep->re_done);
 out:
 	trace_xprtrdma_post_recvs(r_xprt, count);
 	ep->re_receive_count += count;

net/unix/af_unix.c+2−0

@@ -1958,6 +1958,8 @@ static void unix_detach_fds(struct scm_cookie scm, struct sk_buff skb) · 1957 unmodified lines
1958	static void unix_peek_fds(struct scm_cookie scm, struct sk_buff skb)	1958	static void unix_peek_fds(struct scm_cookie scm, struct sk_buff skb)
1959	{	1959	{
1960	scm->fp = scm_fp_dup(UNIXCB(skb).fp);	1960	scm->fp = scm_fp_dup(UNIXCB(skb).fp);
		1961
		1962	unix_peek_fpl(scm->fp);
1961	}	1963	}
1962		1964
1963	static void unix_destruct_scm(struct sk_buff *skb)	1965	static void unix_destruct_scm(struct sk_buff *skb)

net/unix/af_unix.h+1−0

@@ -29,6 +29,7 @@ void unix_del_edges(struct scm_fp_list *fpl); · 28 unmodified lines
29	void unix_update_edges(struct unix_sock *receiver);	29	void unix_update_edges(struct unix_sock *receiver);
30	int unix_prepare_fpl(struct scm_fp_list *fpl);	30	int unix_prepare_fpl(struct scm_fp_list *fpl);
31	void unix_destroy_fpl(struct scm_fp_list *fpl);	31	void unix_destroy_fpl(struct scm_fp_list *fpl);
		32	void unix_peek_fpl(struct scm_fp_list *fpl);
32	void unix_schedule_gc(struct user_struct *user);	33	void unix_schedule_gc(struct user_struct *user);
33		34
34	/* SOCK_DIAG */	35	/* SOCK_DIAG */

net/unix/garbage.c+51−28

 	unix_free_vertices(fpl);
 }
+static bool gc_in_progress;
+static seqcount_t unix_peek_seq = SEQCNT_ZERO(unix_peek_seq);
+void unix_peek_fpl(struct scm_fp_list *fpl)
+{
+	static DEFINE_SPINLOCK(unix_peek_lock);
+	if (!fpl || !fpl->count_unix)
+		return;
+	if (!READ_ONCE(gc_in_progress))
+		return;
+	/* Invalidate the final refcnt check in unix_vertex_dead(). */
+	spin_lock(&unix_peek_lock);
+	raw_write_seqcount_barrier(&unix_peek_seq);
+	spin_unlock(&unix_peek_lock);
+}
 static bool unix_vertex_dead(struct unix_vertex *vertex)
 {
 	struct unix_edge *edge;
 	return true;
 }
+static LIST_HEAD(unix_visited_vertices);
+static unsigned long unix_vertex_grouped_index = UNIX_VERTEX_INDEX_MARK2;
+static bool unix_scc_dead(struct list_head *scc, bool fast)
+{
+	struct unix_vertex *vertex;
+	bool scc_dead = true;
+	unsigned int seq;
+	seq = read_seqcount_begin(&unix_peek_seq);
+	list_for_each_entry_reverse(vertex, scc, scc_entry) {
+		/* Don't restart DFS from this vertex. */
+		list_move_tail(&vertex->entry, &unix_visited_vertices);
+		/* Mark vertex as off-stack for __unix_walk_scc(). */
+		if (!fast)
+			vertex->index = unix_vertex_grouped_index;
+		if (scc_dead)
+			scc_dead = unix_vertex_dead(vertex);
+	}
+	/* If MSG_PEEK intervened, defer this SCC to the next round. */
+	if (read_seqcount_retry(&unix_peek_seq, seq))
+		return false;
+	return scc_dead;
+}
 static void unix_collect_skb(struct list_head *scc, struct sk_buff_head *hitlist)
 {
 	struct unix_vertex *vertex;
 	return false;
 }
-static LIST_HEAD(unix_visited_vertices);
-static unsigned long unix_vertex_grouped_index = UNIX_VERTEX_INDEX_MARK2;
 static unsigned long __unix_walk_scc(struct unix_vertex *vertex,
 				     unsigned long *last_index,
 				     struct sk_buff_head *hitlist)
 	}
 	if (vertex->index == vertex->scc_index) {
-		struct unix_vertex *v;
 		struct list_head scc;
-		bool scc_dead = true;
 		/* SCC finalised.
 		 *
 		 */
 		__list_cut_position(&scc, &vertex_stack, &vertex->scc_entry);
-		list_for_each_entry_reverse(v, &scc, scc_entry) {
+		if (unix_scc_dead(&scc, false)) {
-			/* Don't restart DFS from this vertex in unix_walk_scc(). */
-			list_move_tail(&v->entry, &unix_visited_vertices);
-			/* Mark vertex as off-stack. */
-			v->index = unix_vertex_grouped_index;
-			if (scc_dead)
-				scc_dead = unix_vertex_dead(v);
-		}
-		if (scc_dead) {
 			unix_collect_skb(&scc, hitlist);
 		} else {
 			if (unix_vertex_max_scc_index < vertex->scc_index)
 	while (!list_empty(&unix_unvisited_vertices)) {
 		struct unix_vertex *vertex;
 		struct list_head scc;
-		bool scc_dead = true;
 		vertex = list_first_entry(&unix_unvisited_vertices, typeof(*vertex), entry);
 		list_add(&scc, &vertex->scc_entry);
-		list_for_each_entry_reverse(vertex, &scc, scc_entry) {
+		if (unix_scc_dead(&scc, true)) {
-			list_move_tail(&vertex->entry, &unix_visited_vertices);
-			if (scc_dead)
-				scc_dead = unix_vertex_dead(vertex);
-		}
-		if (scc_dead) {
 			cyclic_sccs--;
 			unix_collect_skb(&scc, hitlist);
 		}
 		   cyclic_sccs ? UNIX_GRAPH_CYCLIC : UNIX_GRAPH_NOT_CYCLIC);
 }
-static bool gc_in_progress;
 static void unix_gc(struct work_struct *work)
 {
 	struct sk_buff_head hitlist;

net/wireless/pmsr.c+1−0

@@ -665,6 +665,7 @@ void cfg80211_pmsr_wdev_down(struct wireless_dev *wdev) · 664 unmodified lines
665	}	665	}
666	spin_unlock_bh(&wdev->pmsr_lock);	666	spin_unlock_bh(&wdev->pmsr_lock);
667		667
		668	cancel_work_sync(&wdev->pmsr_free_wk);
668	if (found)	669	if (found)
669	cfg80211_pmsr_process_abort(wdev);	670	cfg80211_pmsr_process_abort(wdev);
670		671

rust/Makefile+5−6

 quiet_cmd_rustdoc = RUSTDOC $(if $(rustdoc_host),H, ) $<
       cmd_rustdoc = \
 	OBJTREE=$(abspath $(objtree)) \
-	$(RUSTDOC) $(filter-out $(skip_flags) --remap-path-prefix=%,$(if $(rustdoc_host),$(rust_common_flags),$(rust_flags))) \
+	$(RUSTDOC) $(filter-out $(skip_flags) --remap-path-prefix=% --remap-path-scope=%, \
+			$(if $(rustdoc_host),$(rust_common_flags),$(rust_flags))) \
 		$(rustc_target_flags) -L$(objtree)/$(obj) \
 		-Zunstable-options --generate-link-to-definition \
 		--output $(rustdoc_output) \
 	rm -rf $(objtree)/$(obj)/test/doctests/kernel; \
 	mkdir -p $(objtree)/$(obj)/test/doctests/kernel; \
 	OBJTREE=$(abspath $(objtree)) \
-	$(RUSTDOC) --test $(filter-out --remap-path-prefix=%,$(rust_flags)) \
+	$(RUSTDOC) --test $(filter-out --remap-path-prefix=% --remap-path-scope=%,$(rust_flags)) \
 		-L$(objtree)/$(obj) --extern ffi --extern pin_init \
 		--extern kernel --extern build_error --extern macros \
 		--extern bindings --extern uapi \
       cmd_rustc_procmacrolibrary = \
 	$(if $(skip_clippy),$(RUSTC),$(RUSTC_OR_CLIPPY)) \
 		$(filter-out $(skip_flags),$(rust_common_flags) $(rustc_target_flags)) \
-		--emit=dep-info,link --crate-type rlib -O \
+		--emit=dep-info=$(depfile) --emit=link=$@ --crate-type rlib -O \
 		--out-dir $(objtree)/$(obj) -L$(objtree)/$(obj) \
-		--crate-name $(patsubst lib%.rlib,%,$(notdir $@)) $<; \
+		--crate-name $(patsubst lib%.rlib,%,$(notdir $@)) $<
-	mv $(objtree)/$(obj)/$(patsubst lib%.rlib,%,$(notdir $@)).d $(depfile); \
-	sed -i '/^\#/d' $(depfile)
 $(obj)/libproc_macro2.rlib: private skip_clippy = 1
 $(obj)/libproc_macro2.rlib: private rustc_target_flags = $(proc_macro2-flags)

rust/kernel/cpufreq.rs+1−0

@@ -401,6 +401,7 @@ impl TableBuilder { · 400 unmodified lines
401	/// ```	401	/// ```
402	/// use kernel::cpufreq::{DEFAULT_TRANSITION_LATENCY_NS, Policy};	402	/// use kernel::cpufreq::{DEFAULT_TRANSITION_LATENCY_NS, Policy};
403	///	403	///
		404	/// #[allow(clippy::double_parens, reason = "False positive before 1.92.0")]
404	/// fn update_policy(policy: &mut Policy) {	405	/// fn update_policy(policy: &mut Policy) {
405	/// policy	406	/// policy
406	/// .set_dvfs_possible_from_any_cpu(true)	407	/// .set_dvfs_possible_from_any_cpu(true)

rust/kernel/dma.rs+50−64

         self.count * core::mem::size_of::<T>()
     }
+    /// Returns the raw pointer to the allocated region in the CPU's virtual address space.
+    #[inline]
+    pub fn as_ptr(&self) -> *const [T] {
+        core::ptr::slice_from_raw_parts(self.cpu_addr.as_ptr(), self.count)
+    }
+    /// Returns the raw pointer to the allocated region in the CPU's virtual address space as
+    /// a mutable pointer.
+    #[inline]
+    pub fn as_mut_ptr(&self) -> *mut [T] {
+        core::ptr::slice_from_raw_parts_mut(self.cpu_addr.as_ptr(), self.count)
+    }
     /// Returns the base address to the allocated region in the CPU's virtual address space.
     pub fn start_ptr(&self) -> *const T {
         self.cpu_addr.as_ptr()
         Ok(())
     }
-    /// Returns a pointer to an element from the region with bounds checking. `offset` is in
-    /// units of `T`, not the number of bytes.
-    ///
-    /// Public but hidden since it should only be used from [`dma_read`] and [`dma_write`] macros.
-    #[doc(hidden)]
-    pub fn item_from_index(&self, offset: usize) -> Result<*mut T> {
-        if offset >= self.count {
-            return Err(EINVAL);
-        }
-        // SAFETY:
-        // - The pointer is valid due to type invariant on `CoherentAllocation`
-        // and we've just checked that the range and index is within bounds.
-        // - `offset` can't overflow since it is smaller than `self.count` and we've checked
-        // that `self.count` won't overflow early in the constructor.
-        Ok(unsafe { self.cpu_addr.as_ptr().add(offset) })
-    }
     /// Reads the value of `field` and ensures that its type is [`FromBytes`].
     ///
     /// # Safety
 /// Reads a field of an item from an allocated region of structs.
 ///
+/// The syntax is of the form `kernel::dma_read!(dma, proj)` where `dma` is an expression evaluating
+/// to a [`CoherentAllocation`] and `proj` is a [projection specification](kernel::ptr::project!).
+///
 /// # Examples
 ///
 /// ```
 /// unsafe impl kernel::transmute::AsBytes for MyStruct{};
 ///
 /// # fn test(alloc: &kernel::dma::CoherentAllocation<MyStruct>) -> Result {
-/// let whole = kernel::dma_read!(alloc[2]);
+/// let whole = kernel::dma_read!(alloc, [2]?);
-/// let field = kernel::dma_read!(alloc[1].field);
+/// let field = kernel::dma_read!(alloc, [1]?.field);
 /// # Ok::<(), Error>(()) }
 /// ```
 #[macro_export]
 macro_rules! dma_read {
-    ($dma:expr, $idx: expr, $($field:tt)*) => {{
+    ($dma:expr, $($proj:tt)*) => {{
-        (|| -> ::core::result::Result<_, $crate::error::Error> {
+        let dma = &$dma;
-            let item = $crate::dma::CoherentAllocation::item_from_index(&$dma, $idx)?;
+        let ptr = $crate::ptr::project!(
-            // SAFETY: `item_from_index` ensures that `item` is always a valid pointer and can be
+            $crate::dma::CoherentAllocation::as_ptr(dma), $($proj)*
-            // dereferenced. The compiler also further validates the expression on whether `field`
+        );
-            // is a member of `item` when expanded by the macro.
+        // SAFETY: The pointer created by the projection is within the DMA region.
-            unsafe {
+        unsafe { $crate::dma::CoherentAllocation::field_read(dma, ptr) }
-                let ptr_field = ::core::ptr::addr_of!((*item) $($field)*);
-                ::core::result::Result::Ok(
-                    $crate::dma::CoherentAllocation::field_read(&$dma, ptr_field)
-                )
-            }
-        })()
     }};
-    ($dma:ident [ $idx:expr ] $($field:tt)* ) => {
-        $crate::dma_read!($dma, $idx, $($field)*)
-    };
-    ($($dma:ident).* [ $idx:expr ] $($field:tt)* ) => {
-        $crate::dma_read!($($dma).*, $idx, $($field)*)
-    };
 }
 /// Writes to a field of an item from an allocated region of structs.
 ///
+/// The syntax is of the form `kernel::dma_write!(dma, proj, val)` where `dma` is an expression
+/// evaluating to a [`CoherentAllocation`], `proj` is a
+/// [projection specification](kernel::ptr::project!), and `val` is the value to be written to the
+/// projected location.
+///
 /// # Examples
 ///
 /// ```
 /// unsafe impl kernel::transmute::AsBytes for MyStruct{};
 ///
 /// # fn test(alloc: &kernel::dma::CoherentAllocation<MyStruct>) -> Result {
-/// kernel::dma_write!(alloc[2].member = 0xf);
+/// kernel::dma_write!(alloc, [2]?.member, 0xf);
-/// kernel::dma_write!(alloc[1] = MyStruct { member: 0xf });
+/// kernel::dma_write!(alloc, [1]?, MyStruct { member: 0xf });
 /// # Ok::<(), Error>(()) }
 /// ```
 #[macro_export]
 macro_rules! dma_write {
-    ($dma:ident [ $idx:expr ] $($field:tt)*) => {{
+    (@parse [$dma:expr] [$($proj:tt)*] [, $val:expr]) => {{
-        $crate::dma_write!($dma, $idx, $($field)*)
+        let dma = &$dma;
-    }};
+        let ptr = $crate::ptr::project!(
-    ($($dma:ident).* [ $idx:expr ] $($field:tt)* ) => {{
+            mut $crate::dma::CoherentAllocation::as_mut_ptr(dma), $($proj)*
-        $crate::dma_write!($($dma).*, $idx, $($field)*)
+        );
+        let val = $val;
+        // SAFETY: The pointer created by the projection is within the DMA region.
+        unsafe { $crate::dma::CoherentAllocation::field_write(dma, ptr, val) }
     }};
-    ($dma:expr, $idx: expr, = $val:expr) => {
+    (@parse [$dma:expr] [$($proj:tt)*] [.$field:tt $($rest:tt)*]) => {
-        (|| -> ::core::result::Result<_, $crate::error::Error> {
+        $crate::dma_write!(@parse [$dma] [$($proj)* .$field] [$($rest)*])
-            let item = $crate::dma::CoherentAllocation::item_from_index(&$dma, $idx)?;
+    };
-            // SAFETY: `item_from_index` ensures that `item` is always a valid item.
+    (@parse [$dma:expr] [$($proj:tt)*] [[$index:expr]? $($rest:tt)*]) => {
-            unsafe { $crate::dma::CoherentAllocation::field_write(&$dma, item, $val) }
+        $crate::dma_write!(@parse [$dma] [$($proj)* [$index]?] [$($rest)*])
-            ::core::result::Result::Ok(())
+    };
-        })()
+    (@parse [$dma:expr] [$($proj:tt)*] [[$index:expr] $($rest:tt)*]) => {
+        $crate::dma_write!(@parse [$dma] [$($proj)* [$index]] [$($rest)*])
     };
-    ($dma:expr, $idx: expr, $(.$field:ident)* = $val:expr) => {
+    ($dma:expr, $($rest:tt)*) => {
-        (|| -> ::core::result::Result<_, $crate::error::Error> {
+        $crate::dma_write!(@parse [$dma] [] [$($rest)*])
-            let item = $crate::dma::CoherentAllocation::item_from_index(&$dma, $idx)?;
-            // SAFETY: `item_from_index` ensures that `item` is always a valid pointer and can be
-            // dereferenced. The compiler also further validates the expression on whether `field`
-            // is a member of `item` when expanded by the macro.
-            unsafe {
-                let ptr_field = ::core::ptr::addr_of_mut!((*item) $(.$field)*);
-                $crate::dma::CoherentAllocation::field_write(&$dma, ptr_field, $val)
-            }
-            ::core::result::Result::Ok(())
-        })()
     };
 }

rust/kernel/lib.rs+4−0

 #![feature(generic_nonzero)]
 #![feature(inline_const)]
 #![feature(pointer_is_aligned)]
+#![feature(slice_ptr_len)]
 //
 // Stable since Rust 1.80.0.
 #![feature(slice_flatten)]
 #![feature(const_ptr_write)]
 #![feature(const_refs_to_cell)]
 //
+// Stable since Rust 1.84.0.
+#![feature(strict_provenance)]
+//
 // Expected to become stable.
 #![feature(arbitrary_self_types)]
 //

rust/kernel/ptr.rs+29−1

@@ -2,7 +2,13 @@ · 1 unmodified line
2		2
3	//! Types and functions to work with pointers and addresses.	3	//! Types and functions to work with pointers and addresses.
4		4
5	use core::mem::align_of;	5	pub mod projection;
		6	pub use crate::project_pointer as project;
		7
		8	use core::mem::{
		9	align_of,
		10	size_of, //
		11	};
6	use core::num::NonZero;	12	use core::num::NonZero;
7		13
8	/// Type representing an alignment, which is always a power of two.	14	/// Type representing an alignment, which is always a power of two.
@@ -225,3 +231,25 @@ macro_rules! impl_alignable_uint { · 216 unmodified lines
225	}	231	}
226		232
227	impl_alignable_uint!(u8, u16, u32, u64, usize);	233	impl_alignable_uint!(u8, u16, u32, u64, usize);
		234
		235	/// Trait to represent compile-time known size information.
		236	///
		237	/// This is a generalization of [`size_of`] that works for dynamically sized types.
		238	pub trait KnownSize {
		239	/// Get the size of an object of this type in bytes, with the metadata of the given pointer.
		240	fn size(p: *const Self) -> usize;
		241	}
		242
		243	impl<T> KnownSize for T {
		244	#[inline(always)]
		245	fn size(_: *const Self) -> usize {
		246	size_of::<T>()
		247	}
		248	}
		249
		250	impl<T> KnownSize for [T] {
		251	#[inline(always)]
		252	fn size(p: *const Self) -> usize {
		253	p.len() * size_of::<T>()
		254	}
		255	}

rust/kernel/ptr/projection.rs+305−0

@@ -0,0 +1,305 @@
	1	// SPDX-License-Identifier: GPL-2.0
	2
	3	//! Infrastructure for handling projections.
	4
	5	use core::{
	6	mem::MaybeUninit,
	7	ops::Deref, //
	8	};
	9
	10	use crate::prelude::*;
	11
	12	/// Error raised when a projection is attempted on an array or slice out of bounds.
	13	pub struct OutOfBound;
	14
	15	impl From<OutOfBound> for Error {
	16	#[inline(always)]
	17	fn from(_: OutOfBound) -> Self {
	18	ERANGE
	19	}
	20	}
	21
	22	/// A helper trait to perform index projection.
	23	///
	24	/// This is similar to [`core::slice::SliceIndex`], but operates on raw pointers safely and
	25	/// fallibly.
	26	///
	27	/// # Safety
	28	///
	29	/// The implementation of `index` and `get` (if [`Some`] is returned) must ensure that, if provided
	30	/// input pointer `slice` and returned pointer `output`, then:
	31	/// - `output` has the same provenance as `slice`;
	32	/// - `output.byte_offset_from(slice)` is between 0 to
	33	/// `KnownSize::size(slice) - KnownSize::size(output)`.
	34	///
	35	/// This means that if the input pointer is valid, then pointer returned by `get` or `index` is
	36	/// also valid.
	37	#[diagnostic::on_unimplemented(message = "`{Self}` cannot be used to index `{T}`")]
	38	#[doc(hidden)]
	39	pub unsafe trait ProjectIndex<T: ?Sized>: Sized {
	40	type Output: ?Sized;
	41
	42	/// Returns an index-projected pointer, if in bounds.
	43	fn get(self, slice: mut T) -> Option<mut Self::Output>;
	44
	45	/// Returns an index-projected pointer; fail the build if it cannot be proved to be in bounds.
	46	#[inline(always)]
	47	fn index(self, slice: mut T) -> mut Self::Output {
	48	Self::get(self, slice).unwrap_or_else(\|\| build_error!())
	49	}
	50	}
	51
	52	// Forward array impl to slice impl.
	53	//
	54	// SAFETY: Safety requirement guaranteed by the forwarded impl.
	55	unsafe impl<T, I, const N: usize> ProjectIndex<[T; N]> for I
	56	where
	57	I: ProjectIndex<[T]>,
	58	{
	59	type Output = <I as ProjectIndex<[T]>>::Output;
	60
	61	#[inline(always)]
	62	fn get(self, slice: mut [T; N]) -> Option<mut Self::Output> {
	63	<I as ProjectIndex<[T]>>::get(self, slice)
	64	}
	65
	66	#[inline(always)]
	67	fn index(self, slice: mut [T; N]) -> mut Self::Output {
	68	<I as ProjectIndex<[T]>>::index(self, slice)
	69	}
	70	}
	71
	72	// SAFETY: `get`-returned pointer has the same provenance as `slice` and the offset is checked to
	73	// not exceed the required bound.
	74	unsafe impl<T> ProjectIndex<[T]> for usize {
	75	type Output = T;
	76
	77	#[inline(always)]
	78	fn get(self, slice: mut [T]) -> Option<mut T> {
	79	if self >= slice.len() {
	80	None
	81	} else {
	82	Some(slice.cast::<T>().wrapping_add(self))
	83	}
	84	}
	85	}
	86
	87	// SAFETY: `get`-returned pointer has the same provenance as `slice` and the offset is checked to
	88	// not exceed the required bound.
	89	unsafe impl<T> ProjectIndex<[T]> for core::ops::Range<usize> {
	90	type Output = [T];
	91
	92	#[inline(always)]
	93	fn get(self, slice: mut [T]) -> Option<mut [T]> {
	94	let new_len = self.end.checked_sub(self.start)?;
	95	if self.end > slice.len() {
	96	return None;
	97	}
	98	Some(core::ptr::slice_from_raw_parts_mut(
	99	slice.cast::<T>().wrapping_add(self.start),
	100	new_len,
	101	))
	102	}
	103	}
	104
	105	// SAFETY: Safety requirement guaranteed by the forwarded impl.
	106	unsafe impl<T> ProjectIndex<[T]> for core::ops::RangeTo<usize> {
	107	type Output = [T];
	108
	109	#[inline(always)]
	110	fn get(self, slice: mut [T]) -> Option<mut [T]> {
	111	(0..self.end).get(slice)
	112	}
	113	}
	114
	115	// SAFETY: Safety requirement guaranteed by the forwarded impl.
	116	unsafe impl<T> ProjectIndex<[T]> for core::ops::RangeFrom<usize> {
	117	type Output = [T];
	118
	119	#[inline(always)]
	120	fn get(self, slice: mut [T]) -> Option<mut [T]> {
	121	(self.start..slice.len()).get(slice)
	122	}
	123	}
	124
	125	// SAFETY: `get` returned the pointer as is, so it always has the same provenance and offset of 0.
	126	unsafe impl<T> ProjectIndex<[T]> for core::ops::RangeFull {
	127	type Output = [T];
	128
	129	#[inline(always)]
	130	fn get(self, slice: mut [T]) -> Option<mut [T]> {
	131	Some(slice)
	132	}
	133	}
	134
	135	/// A helper trait to perform field projection.
	136	///
	137	/// This trait has a `DEREF` generic parameter so it can be implemented twice for types that
	138	/// implement [`Deref`]. This will cause an ambiguity error and thus block [`Deref`] types being
	139	/// used as base of projection, as they can inject unsoundness. Users therefore must not specify
	140	/// `DEREF` and should always leave it to be inferred.
	141	///
	142	/// # Safety
	143	///
	144	/// `proj` may only invoke `f` with a valid allocation, as the documentation of [`Self::proj`]
	145	/// describes.
	146	#[doc(hidden)]
	147	pub unsafe trait ProjectField<const DEREF: bool> {
	148	/// Project a pointer to a type to a pointer of a field.
	149	///
	150	/// `f` may only be invoked with a valid allocation so it can safely obtain raw pointers to
	151	/// fields using `&raw mut`.
	152	///
	153	/// This is needed because `base` might not point to a valid allocation, while `&raw mut`
	154	/// requires pointers to be in bounds of a valid allocation.
	155	///
	156	/// # Safety
	157	///
	158	/// `f` must return a pointer in bounds of the provided pointer.
	159	unsafe fn proj<F>(base: mut Self, f: impl FnOnce(mut Self) -> mut F) -> mut F;
	160	}
	161
	162	// NOTE: in theory, this API should work for `T: ?Sized` and `F: ?Sized`, too. However, we cannot
	163	// currently support that as we need to obtain a valid allocation that `&raw const` can operate on.
	164	//
	165	// SAFETY: `proj` invokes `f` with valid allocation.
	166	unsafe impl<T> ProjectField<false> for T {
	167	#[inline(always)]
	168	unsafe fn proj<F>(base: mut Self, f: impl FnOnce(mut Self) -> mut F) -> mut F {
	169	// Create a valid allocation to start projection, as `base` is not necessarily so. The
	170	// memory is never actually used so it will be optimized out, so it should work even for
	171	// very large `T` (`memoffset` crate also relies on this). To be extra certain, we also
	172	// annotate `f` closure with `#[inline(always)]` in the macro.
	173	let mut place = MaybeUninit::uninit();
	174	let place_base = place.as_mut_ptr();
	175	let field = f(place_base);
	176	// SAFETY: `field` is in bounds from `base` per safety requirement.
	177	let offset = unsafe { field.byte_offset_from(place_base) };
	178	// Use `wrapping_byte_offset` as `base` does not need to be of valid allocation.
	179	base.wrapping_byte_offset(offset).cast()
	180	}
	181	}
	182
	183	// SAFETY: Vacuously satisfied.
	184	unsafe impl<T: Deref> ProjectField<true> for T {
	185	#[inline(always)]
	186	unsafe fn proj<F>(_: mut Self, _: impl FnOnce(mut Self) -> mut F) -> mut F {
	187	build_error!("this function is a guard against `Deref` impl and is never invoked");
	188	}
	189	}
	190
	191	/// Create a projection from a raw pointer.
	192	///
	193	/// The projected pointer is within the memory region marked by the input pointer. There is no
	194	/// requirement that the input raw pointer needs to be valid, so this macro may be used for
	195	/// projecting pointers outside normal address space, e.g. I/O pointers. However, if the input
	196	/// pointer is valid, the projected pointer is also valid.
	197	///
	198	/// Supported projections include field projections and index projections.
	199	/// It is not allowed to project into types that implement custom [`Deref`] or
	200	/// [`Index`](core::ops::Index).
	201	///
	202	/// The macro has basic syntax of `kernel::ptr::project!(ptr, projection)`, where `ptr` is an
	203	/// expression that evaluates to a raw pointer which serves as the base of projection. `projection`
	204	/// can be a projection expression of form `.field` (normally identifier, or numeral in case of
	205	/// tuple structs) or of form `[index]`.
	206	///
	207	/// If a mutable pointer is needed, the macro input can be prefixed with the `mut` keyword, i.e.
	208	/// `kernel::ptr::project!(mut ptr, projection)`. By default, a const pointer is created.
	209	///
	210	/// `ptr::project!` macro can perform both fallible indexing and build-time checked indexing.
	211	/// `[index]` form performs build-time bounds checking; if compiler fails to prove `[index]` is in
	212	/// bounds, compilation will fail. `[index]?` can be used to perform runtime bounds checking;
	213	/// `OutOfBound` error is raised via `?` if the index is out of bounds.
	214	///
	215	/// # Examples
	216	///
	217	/// Field projections are performed with `.field_name`:
	218	///
	219	/// ```
	220	/// struct MyStruct { field: u32, }
	221	/// let ptr: *const MyStruct = core::ptr::dangling();
	222	/// let field_ptr: *const u32 = kernel::ptr::project!(ptr, .field);
	223	///
	224	/// struct MyTupleStruct(u32, u32);
	225	///
	226	/// fn proj(ptr: *const MyTupleStruct) {
	227	/// let field_ptr: *const u32 = kernel::ptr::project!(ptr, .1);
	228	/// }
	229	/// ```
	230	///
	231	/// Index projections are performed with `[index]`:
	232	///
	233	/// ```
	234	/// fn proj(ptr: *const [u8; 32]) -> Result {
	235	/// let field_ptr: *const u8 = kernel::ptr::project!(ptr, [1]);
	236	/// // The following invocation, if uncommented, would fail the build.
	237	/// //
	238	/// // kernel::ptr::project!(ptr, [128]);
	239	///
	240	/// // This will raise an `OutOfBound` error (which is convertible to `ERANGE`).
	241	/// kernel::ptr::project!(ptr, [128]?);
	242	/// Ok(())
	243	/// }
	244	/// ```
	245	///
	246	/// If you need to match on the error instead of propagate, put the invocation inside a closure:
	247	///
	248	/// ```
	249	/// let ptr: *const [u8; 32] = core::ptr::dangling();
	250	/// let field_ptr: Result<*const u8> = (\|\| -> Result<_> {
	251	/// Ok(kernel::ptr::project!(ptr, [128]?))
	252	/// })();
	253	/// assert!(field_ptr.is_err());
	254	/// ```
	255	///
	256	/// For mutable pointers, put `mut` as the first token in macro invocation.
	257	///
	258	/// ```
	259	/// let ptr: *mut [(u8, u16); 32] = core::ptr::dangling_mut();
	260	/// let field_ptr: *mut u16 = kernel::ptr::project!(mut ptr, [1].1);
	261	/// ```
	262	#[macro_export]
	263	macro_rules! project_pointer {
	264	(@gen $ptr:ident, ) => {};
	265	// Field projection. `$field` needs to be `tt` to support tuple index like `.0`.
	266	(@gen $ptr:ident, .$field:tt $($rest:tt)*) => {
	267	// SAFETY: The provided closure always returns an in-bounds pointer.
	268	let $ptr = unsafe {
	269	$crate::ptr::projection::ProjectField::proj($ptr, #[inline(always)] \|ptr\| {
	270	// Check unaligned field. Not all users (e.g. DMA) can handle unaligned
	271	// projections.
	272	if false {
	273	let _ = &(*ptr).$field;
	274	}
	275	// SAFETY: `$field` is in bounds, and no implicit `Deref` is possible (if the
	276	// type implements `Deref`, Rust cannot infer the generic parameter `DEREF`).
	277	&raw mut (*ptr).$field
	278	})
	279	};
	280	$crate::ptr::project!(@gen $ptr, $($rest)*)
	281	};
	282	// Fallible index projection.
	283	(@gen $ptr:ident, [$index:expr]? $($rest:tt)*) => {
	284	let $ptr = $crate::ptr::projection::ProjectIndex::get($index, $ptr)
	285	.ok_or($crate::ptr::projection::OutOfBound)?;
	286	$crate::ptr::project!(@gen $ptr, $($rest)*)
	287	};
	288	// Build-time checked index projection.
	289	(@gen $ptr:ident, [$index:expr] $($rest:tt)*) => {
	290	let $ptr = $crate::ptr::projection::ProjectIndex::index($index, $ptr);
	291	$crate::ptr::project!(@gen $ptr, $($rest)*)
	292	};
	293	(mut $ptr:expr, $($proj:tt)*) => {{
	294	let ptr: *mut _ = $ptr;
	295	$crate::ptr::project!(@gen ptr, $($proj)*);
	296	ptr
	297	}};
	298	($ptr:expr, $($proj:tt)*) => {{
	299	let ptr = <*const _>::cast_mut($ptr);
	300	// We currently always project using mutable pointer, as it is not decided whether `&raw
	301	// const` allows the resulting pointer to be mutated (see documentation of `addr_of!`).
	302	$crate::ptr::project!(@gen ptr, $($proj)*);
	303	ptr.cast_const()
	304	}};
	305	}

rust/kernel/str.rs+2−2

@@ -664,13 +664,13 @@ impl fmt::Write for Formatter<'_> { · 663 unmodified lines
664	///	664	///
665	/// * The first byte of `buffer` is always zero.	665	/// * The first byte of `buffer` is always zero.
666	/// * The length of `buffer` is at least 1.	666	/// * The length of `buffer` is at least 1.
667	pub(crate) struct NullTerminatedFormatter<'a> {	667	pub struct NullTerminatedFormatter<'a> {
668	buffer: &'a mut [u8],	668	buffer: &'a mut [u8],
669	}	669	}
670		670
671	impl<'a> NullTerminatedFormatter<'a> {	671	impl<'a> NullTerminatedFormatter<'a> {
672	/// Create a new [`Self`] instance.	672	/// Create a new [`Self`] instance.
673	pub(crate) fn new(buffer: &'a mut [u8]) -> Option<NullTerminatedFormatter<'a>> {	673	pub fn new(buffer: &'a mut [u8]) -> Option<NullTerminatedFormatter<'a>> {
674	*(buffer.first_mut()?) = 0;	674	*(buffer.first_mut()?) = 0;
675		675
676	// INVARIANT:	676	// INVARIANT:

rust/pin-init/internal/src/init.rs+23−46

 enum InitializerAttribute {
     DefaultError(DefaultErrorAttribute),
-    DisableInitializedFieldAccess,
 }
 struct DefaultErrorAttribute {
     let error = error.map_or_else(
         || {
             if let Some(default_error) = attrs.iter().fold(None, |acc, attr| {
+                #[expect(irrefutable_let_patterns)]
                 if let InitializerAttribute::DefaultError(DefaultErrorAttribute { ty }) = attr {
                     Some(ty.clone())
                 } else {
     };
     // `mixed_site` ensures that the data is not accessible to the user-controlled code.
     let data = Ident::new("__data", Span::mixed_site());
-    let init_fields = init_fields(
+    let init_fields = init_fields(&fields, pinned, &data, &slot);
-        &fields,
-        pinned,
-        !attrs
-            .iter()
-            .any(|attr| matches!(attr, InitializerAttribute::DisableInitializedFieldAccess)),
-        &data,
-        &slot,
-    );
     let field_check = make_field_check(&fields, init_kind, &path);
     Ok(quote! {{
-        // We do not want to allow arbitrary returns, so we declare this type as the `Ok` return
-        // type and shadow it later when we insert the arbitrary user code. That way there will be
-        // no possibility of returning without `unsafe`.
-        struct __InitOk;
         // Get the data about fields from the supplied type.
         // SAFETY: TODO
         let #data = unsafe {
             #path::#get_data()
         };
         // Ensure that `#data` really is of type `#data` and help with type inference:
-        let init = ::pin_init::__internal::#data_trait::make_closure::<_, __InitOk, #error>(
+        let init = ::pin_init::__internal::#data_trait::make_closure::<_, #error>(
             #data,
             move |slot| {
-                {
+                #zeroable_check
-                    // Shadow the structure so it cannot be used to return early.
+                #this
-                    struct __InitOk;
+                #init_fields
-                    #zeroable_check
+                #field_check
-                    #this
+                // SAFETY: we are the `init!` macro that is allowed to call this.
-                    #init_fields
+                Ok(unsafe { ::pin_init::__internal::InitOk::new() })
-                    #field_check
-                }
-                Ok(__InitOk)
             }
         );
         let init = move |slot| -> ::core::result::Result<(), #error> {
 fn init_fields(
     fields: &Punctuated<InitializerField, Token![,]>,
     pinned: bool,
-    generate_initialized_accessors: bool,
     data: &Ident,
     slot: &Ident,
 ) -> TokenStream {
                 });
                 // Again span for better diagnostics
                 let write = quote_spanned!(ident.span()=> ::core::ptr::write);
+                // NOTE: the field accessor ensures that the initialized field is properly aligned.
+                // Unaligned fields will cause the compiler to emit E0793. We do not support
+                // unaligned fields since `Init::__init` requires an aligned pointer; the call to
+                // `ptr::write` below has the same requirement.
                 let accessor = if pinned {
                     let project_ident = format_ident!("__project_{ident}");
                     quote! {
                         unsafe { &mut (*#slot).#ident }
                     }
                 };
-                let accessor = generate_initialized_accessors.then(|| {
-                    quote! {
-                        #(#cfgs)*
-                        #[allow(unused_variables)]
-                        let #ident = #accessor;
-                    }
-                });
                 quote! {
                     #(#attrs)*
                     {
                         // SAFETY: TODO
                         unsafe { #write(::core::ptr::addr_of_mut!((*#slot).#ident), #value_ident) };
                     }
-                    #accessor
+                    #(#cfgs)*
+                    #[allow(unused_variables)]
+                    let #ident = #accessor;
                 }
             }
             InitializerKind::Init { ident, value, .. } => {
                 // Again span for better diagnostics
                 let init = format_ident!("init", span = value.span());
+                // NOTE: the field accessor ensures that the initialized field is properly aligned.
+                // Unaligned fields will cause the compiler to emit E0793. We do not support
+                // unaligned fields since `Init::__init` requires an aligned pointer; the call to
+                // `ptr::write` below has the same requirement.
                 let (value_init, accessor) = if pinned {
                     let project_ident = format_ident!("__project_{ident}");
                     (
                         },
                     )
                 };
-                let accessor = generate_initialized_accessors.then(|| {
-                    quote! {
-                        #(#cfgs)*
-                        #[allow(unused_variables)]
-                        let #ident = #accessor;
-                    }
-                });
                 quote! {
                     #(#attrs)*
                     {
                         let #init = #value;
                         #value_init
                     }
-                    #accessor
+                    #(#cfgs)*
+                    #[allow(unused_variables)]
+                    let #ident = #accessor;
                 }
             }
             InitializerKind::Code { block: value, .. } => quote! {
                 if a.path().is_ident("default_error") {
                     a.parse_args::<DefaultErrorAttribute>()
                         .map(InitializerAttribute::DefaultError)
-                } else if a.path().is_ident("disable_initialized_field_access") {
-                    a.meta
-                        .require_path_only()
-                        .map(|_| InitializerAttribute::DisableInitializedFieldAccess)
                 } else {
                     Err(syn::Error::new_spanned(a, "unknown initializer attribute"))
                 }

rust/pin-init/src/__internal.rs+24−4

     }
 }
+/// Token type to signify successful initialization.
+///
+/// Can only be constructed via the unsafe [`Self::new`] function. The initializer macros use this
+/// token type to prevent returning `Ok` from an initializer without initializing all fields.
+pub struct InitOk(());
+impl InitOk {
+    /// Creates a new token.
+    ///
+    /// # Safety
+    ///
+    /// This function may only be called from the `init!` macro in `../internal/src/init.rs`.
+    #[inline(always)]
+    pub unsafe fn new() -> Self {
+        Self(())
+    }
+}
 /// This trait is only implemented via the `#[pin_data]` proc-macro. It is used to facilitate
 /// the pin projections within the initializers.
 ///
     type Datee: ?Sized + HasPinData;
     /// Type inference helper function.
-    fn make_closure<F, O, E>(self, f: F) -> F
+    #[inline(always)]
+    fn make_closure<F, E>(self, f: F) -> F
     where
-        F: FnOnce(*mut Self::Datee) -> Result<O, E>,
+        F: FnOnce(*mut Self::Datee) -> Result<InitOk, E>,
     {
         f
     }
     type Datee: ?Sized + HasInitData;
     /// Type inference helper function.
-    fn make_closure<F, O, E>(self, f: F) -> F
+    #[inline(always)]
+    fn make_closure<F, E>(self, f: F) -> F
     where
-        F: FnOnce(*mut Self::Datee) -> Result<O, E>,
+        F: FnOnce(*mut Self::Datee) -> Result<InitOk, E>,
     {
         f
     }

samples/rust/rust_dma.rs+16−14

                 CoherentAllocation::alloc_coherent(pdev.as_ref(), TEST_VALUES.len(), GFP_KERNEL)?;
             for (i, value) in TEST_VALUES.into_iter().enumerate() {
-                kernel::dma_write!(ca[i] = MyStruct::new(value.0, value.1))?;
+                kernel::dma_write!(ca, [i]?, MyStruct::new(value.0, value.1));
             }
             let size = 4 * page::PAGE_SIZE;
     }
 }
+impl DmaSampleDriver {
+    fn check_dma(&self) -> Result {
+        for (i, value) in TEST_VALUES.into_iter().enumerate() {
+            let val0 = kernel::dma_read!(self.ca, [i]?.h);
+            let val1 = kernel::dma_read!(self.ca, [i]?.b);
+            assert_eq!(val0, value.0);
+            assert_eq!(val1, value.1);
+        }
+        Ok(())
+    }
+}
 #[pinned_drop]
 impl PinnedDrop for DmaSampleDriver {
     fn drop(self: Pin<&mut Self>) {
         dev_info!(self.pdev, "Unload DMA test driver.\n");
-        for (i, value) in TEST_VALUES.into_iter().enumerate() {
+        assert!(self.check_dma().is_ok());
-            let val0 = kernel::dma_read!(self.ca[i].h);
-            let val1 = kernel::dma_read!(self.ca[i].b);
-            assert!(val0.is_ok());
-            assert!(val1.is_ok());
-            if let Ok(val0) = val0 {
-                assert_eq!(val0, value.0);
-            }
-            if let Ok(val1) = val1 {
-                assert_eq!(val1, value.1);
-            }
-        }
         for (i, entry) in self.sgt.iter().enumerate() {
             dev_info!(

samples/workqueue/stall_detector/Makefile+1−0

@@ -0,0 +1 @@
		1	obj-m += wq_stall.o

samples/workqueue/stall_detector/wq_stall.c+98−0

@@ -0,0 +1,98 @@
	1	// SPDX-License-Identifier: GPL-2.0
	2	/*
	3	* wq_stall - Test module for the workqueue stall detector.
	4	*
	5	* Deliberately creates a workqueue stall so the watchdog fires and
	6	* prints diagnostic output. Useful for verifying that the stall
	7	* detector correctly identifies stuck workers and produces useful
	8	* backtraces.
	9	*
	10	* The stall is triggered by clearing PF_WQ_WORKER before sleeping,
	11	* which hides the worker from the concurrency manager. A second
	12	* work item queued on the same pool then sits in the worklist with
	13	* no worker available to process it.
	14	*
	15	* After ~30s the workqueue watchdog fires:
	16	* BUG: workqueue lockup - pool cpus=N ...
	17	*
	18	* Build:
	19	* make -C <kernel tree> M=samples/workqueue/stall_detector modules
	20	*
	21	* Copyright (c) 2026 Meta Platforms, Inc. and affiliates.
	22	* Copyright (c) 2026 Breno Leitao <leitao@debian.org>
	23	*/
	24
	25	#include <linux/module.h>
	26	#include <linux/workqueue.h>
	27	#include <linux/wait.h>
	28	#include <linux/atomic.h>
	29	#include <linux/sched.h>
	30
	31	static DECLARE_WAIT_QUEUE_HEAD(stall_wq_head);
	32	static atomic_t wake_condition = ATOMIC_INIT(0);
	33	static struct work_struct stall_work1;
	34	static struct work_struct stall_work2;
	35
	36	static void stall_work2_fn(struct work_struct *work)
	37	{
	38	pr_info("wq_stall: second work item finally ran\n");
	39	}
	40
	41	static void stall_work1_fn(struct work_struct *work)
	42	{
	43	pr_info("wq_stall: first work item running on cpu %d\n",
	44	raw_smp_processor_id());
	45
	46	/*
	47	* Queue second item while we're still counted as running
	48	* (pool->nr_running > 0). Since schedule_work() on a per-CPU
	49	* workqueue targets raw_smp_processor_id(), item 2 lands on the
	50	* same pool. __queue_work -> kick_pool -> need_more_worker()
	51	* sees nr_running > 0 and does NOT wake a new worker.
	52	*/
	53	schedule_work(&stall_work2);
	54
	55	/*
	56	* Hide from the workqueue concurrency manager. Without
	57	* PF_WQ_WORKER, schedule() won't call wq_worker_sleeping(),
	58	* so nr_running is never decremented and no replacement
	59	* worker is created. Item 2 stays stuck in pool->worklist.
	60	*/
	61	current->flags &= ~PF_WQ_WORKER;
	62
	63	pr_info("wq_stall: entering wait_event_idle (PF_WQ_WORKER cleared)\n");
	64	pr_info("wq_stall: expect 'BUG: workqueue lockup' in ~30-60s\n");
	65	wait_event_idle(stall_wq_head, atomic_read(&wake_condition) != 0);
	66
	67	/* Restore so process_one_work() cleanup works correctly */
	68	current->flags \|= PF_WQ_WORKER;
	69	pr_info("wq_stall: woke up, PF_WQ_WORKER restored\n");
	70	}
	71
	72	static int __init wq_stall_init(void)
	73	{
	74	pr_info("wq_stall: loading\n");
	75
	76	INIT_WORK(&stall_work1, stall_work1_fn);
	77	INIT_WORK(&stall_work2, stall_work2_fn);
	78	schedule_work(&stall_work1);
	79
	80	return 0;
	81	}
	82
	83	static void __exit wq_stall_exit(void)
	84	{
	85	pr_info("wq_stall: unloading\n");
	86	atomic_set(&wake_condition, 1);
	87	wake_up(&stall_wq_head);
	88	flush_work(&stall_work1);
	89	flush_work(&stall_work2);
	90	pr_info("wq_stall: all work flushed, module unloaded\n");
	91	}
	92
	93	module_init(wq_stall_init);
	94	module_exit(wq_stall_exit);
	95
	96	MODULE_LICENSE("GPL");
	97	MODULE_DESCRIPTION("Reproduce workqueue stall caused by PF_WQ_WORKER misuse");
	98	MODULE_AUTHOR("Breno Leitao <leitao@debian.org>");

scripts/Makefile.build+3−1

 # The features in this list are the ones allowed for non-`rust/` code.
 #
+#   - Stable since Rust 1.79.0: `feature(slice_ptr_len)`.
 #   - Stable since Rust 1.81.0: `feature(lint_reasons)`.
 #   - Stable since Rust 1.82.0: `feature(asm_const)`,
 #     `feature(offset_of_nested)`, `feature(raw_ref_op)`.
+#   - Stable since Rust 1.84.0: `feature(strict_provenance)`.
 #   - Stable since Rust 1.87.0: `feature(asm_goto)`.
 #   - Expected to become stable: `feature(arbitrary_self_types)`.
 #   - To be determined: `feature(used_with_arg)`.
 #
 # Please see https://github.com/Rust-for-Linux/linux/issues/2 for details on
 # the unstable features in use.
-rust_allowed_features := asm_const,asm_goto,arbitrary_self_types,lint_reasons,offset_of_nested,raw_ref_op,used_with_arg
+rust_allowed_features := asm_const,asm_goto,arbitrary_self_types,lint_reasons,offset_of_nested,raw_ref_op,slice_ptr_len,strict_provenance,used_with_arg
 # `--out-dir` is required to avoid temporaries being created by `rustc` in the
 # current working directory, which may be not accessible in the out-of-tree

sound/core/pcm_native.c+16−3

 	for (;;) {
 		long tout;
 		struct snd_pcm_runtime *to_check;
+		unsigned int drain_rate;
+		snd_pcm_uframes_t drain_bufsz;
+		bool drain_no_period_wakeup;
 		if (signal_pending(current)) {
 			result = -ERESTARTSYS;
 			break;
 		snd_pcm_group_unref(group, substream);
 		if (!to_check)
 			break; /* all drained */
+		/*
+		 * Cache the runtime fields needed after unlock.
+		 * A concurrent close() on the linked stream may free
+		 * its runtime via snd_pcm_detach_substream() once we
+		 * release the stream lock below.
+		 */
+		drain_no_period_wakeup = to_check->no_period_wakeup;
+		drain_rate = to_check->rate;
+		drain_bufsz = to_check->buffer_size;
 		init_waitqueue_entry(&wait, current);
 		set_current_state(TASK_INTERRUPTIBLE);
 		add_wait_queue(&to_check->sleep, &wait);
 		snd_pcm_stream_unlock_irq(substream);
-		if (runtime->no_period_wakeup)
+		if (drain_no_period_wakeup)
 			tout = MAX_SCHEDULE_TIMEOUT;
 		else {
 			tout = 100;
-			if (runtime->rate) {
+			if (drain_rate) {
-				long t = runtime->buffer_size * 1100 / runtime->rate;
+				long t = drain_bufsz * 1100 / drain_rate;
 				tout = max(t, tout);
 			}
 			tout = msecs_to_jiffies(tout);

sound/hda/codecs/realtek/alc269.c+3−0

 	SND_PCI_QUIRK(0x103c, 0x89da, "HP Spectre x360 14t-ea100", ALC245_FIXUP_HP_SPECTRE_X360_EU0XXX),
 	SND_PCI_QUIRK(0x103c, 0x89e7, "HP Elite x2 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8a0f, "HP Pavilion 14-ec1xxx", ALC287_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8a1f, "HP Laptop 14s-dr5xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x8a20, "HP Laptop 15s-fq5xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
 	SND_PCI_QUIRK(0x103c, 0x8a25, "HP Victus 16-d1xxx (MB 8A25)", ALC245_FIXUP_HP_MUTE_LED_COEFBIT),
 	SND_PCI_QUIRK(0x103c, 0x8a26, "HP Victus 16-d1xxx (MB 8A26)", ALC245_FIXUP_HP_MUTE_LED_COEFBIT),
 	SND_PCI_QUIRK(0x1043, 0x1e93, "ASUS ExpertBook B9403CVAR", ALC294_FIXUP_ASUS_HPE),
 	SND_PCI_QUIRK(0x1043, 0x1eb3, "ASUS Ally RCLA72", ALC287_FIXUP_TAS2781_I2C),
 	SND_PCI_QUIRK(0x1043, 0x1ed3, "ASUS HN7306W", ALC287_FIXUP_CS35L41_I2C_2),
+	HDA_CODEC_QUIRK(0x1043, 0x1ee2, "ASUS UM6702RA/RC", ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1),
 	SND_PCI_QUIRK(0x1043, 0x1ee2, "ASUS UM6702RA/RC", ALC287_FIXUP_CS35L41_I2C_2),
 	SND_PCI_QUIRK(0x1043, 0x1c52, "ASUS Zephyrus G15 2022", ALC289_FIXUP_ASUS_GA401),
 	SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401),
 	SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+	SND_PCI_QUIRK(0x17aa, 0x2288, "Thinkpad X390", ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK),
 	SND_PCI_QUIRK(0x17aa, 0x2292, "Thinkpad X1 Carbon 7th", ALC285_FIXUP_THINKPAD_HEADSET_JACK),
 	SND_PCI_QUIRK(0x17aa, 0x22be, "Thinkpad X1 Carbon 8th", ALC285_FIXUP_THINKPAD_HEADSET_JACK),
 	SND_PCI_QUIRK(0x17aa, 0x22c1, "Thinkpad P1 Gen 3", ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK),

sound/hda/codecs/realtek/alc662.c+9−0

 	ALC897_FIXUP_HEADSET_MIC_PIN2,
 	ALC897_FIXUP_UNIS_H3C_X500S,
 	ALC897_FIXUP_HEADSET_MIC_PIN3,
+	ALC897_FIXUP_H610M_HP_PIN,
 };
 static const struct hda_fixup alc662_fixups[] = {
 			{ }
 		},
 	},
+	[ALC897_FIXUP_H610M_HP_PIN] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x19, 0x0321403f }, /* HP out */
+			{ }
+		},
+	},
 };
 static const struct hda_quirk alc662_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1043, 0x8469, "ASUS mobo", ALC662_FIXUP_NO_JACK_DETECT),
 	SND_PCI_QUIRK(0x105b, 0x0cd6, "Foxconn", ALC662_FIXUP_ASUS_MODE2),
 	SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
+	SND_PCI_QUIRK(0x1458, 0xa194, "H610M H V2 DDR4", ALC897_FIXUP_H610M_HP_PIN),
 	SND_PCI_QUIRK(0x14cd, 0x5003, "USI", ALC662_FIXUP_USI_HEADSET_MODE),
 	SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC662_FIXUP_LENOVO_MULTI_CODECS),
 	SND_PCI_QUIRK(0x17aa, 0x1057, "Lenovo P360", ALC897_FIXUP_HEADSET_MIC_PIN),

sound/soc/amd/acp/acp-mach-common.c+14−4

 	if (drvdata->hs_codec_id != RT5682)
 		return -EINVAL;
-	drvdata->wclk = clk_get(component->dev, "rt5682-dai-wclk");
+	drvdata->wclk = devm_clk_get(component->dev, "rt5682-dai-wclk");
-	drvdata->bclk = clk_get(component->dev, "rt5682-dai-bclk");
+	if (IS_ERR(drvdata->wclk))
+		return PTR_ERR(drvdata->wclk);
+	drvdata->bclk = devm_clk_get(component->dev, "rt5682-dai-bclk");
+	if (IS_ERR(drvdata->bclk))
+		return PTR_ERR(drvdata->bclk);
 	ret = snd_soc_dapm_new_controls(dapm, rt5682_widgets,
 					ARRAY_SIZE(rt5682_widgets));
 		return -EINVAL;
 	if (!drvdata->soc_mclk) {
-		drvdata->wclk = clk_get(component->dev, "rt5682-dai-wclk");
+		drvdata->wclk = devm_clk_get(component->dev, "rt5682-dai-wclk");
-		drvdata->bclk = clk_get(component->dev, "rt5682-dai-bclk");
+		if (IS_ERR(drvdata->wclk))
+			return PTR_ERR(drvdata->wclk);
+		drvdata->bclk = devm_clk_get(component->dev, "rt5682-dai-bclk");
+		if (IS_ERR(drvdata->bclk))
+			return PTR_ERR(drvdata->bclk);
 	}
 	ret = snd_soc_dapm_new_controls(dapm, rt5682s_widgets,

sound/soc/amd/acp3x-rt5682-max9836.c+7−2

 		return ret;
 	}
-	rt5682_dai_wclk = clk_get(component->dev, "rt5682-dai-wclk");
+	rt5682_dai_wclk = devm_clk_get(component->dev, "rt5682-dai-wclk");
-	rt5682_dai_bclk = clk_get(component->dev, "rt5682-dai-bclk");
+	if (IS_ERR(rt5682_dai_wclk))
+		return PTR_ERR(rt5682_dai_wclk);
+	rt5682_dai_bclk = devm_clk_get(component->dev, "rt5682-dai-bclk");
+	if (IS_ERR(rt5682_dai_bclk))
+		return PTR_ERR(rt5682_dai_bclk);
 	ret = snd_soc_card_jack_new_pins(card, "Headset Jack",
 					 SND_JACK_HEADSET |

sound/soc/codecs/rt1011.c+1−1

@@ -1047,7 +1047,7 @@ static int rt1011_recv_spk_mode_put(struct snd_kcontrol *kcontrol, · 1046 unmodified lines
1047	struct snd_ctl_elem_value *ucontrol)	1047	struct snd_ctl_elem_value *ucontrol)
1048	{	1048	{
1049	struct snd_soc_component *component = snd_kcontrol_chip(kcontrol);	1049	struct snd_soc_component *component = snd_kcontrol_chip(kcontrol);
1050	struct snd_soc_dapm_context *dapm = snd_soc_dapm_kcontrol_to_dapm(kcontrol);	1050	struct snd_soc_dapm_context *dapm = snd_soc_component_to_dapm(component);
1051	struct rt1011_priv *rt1011 =	1051	struct rt1011_priv *rt1011 =
1052	snd_soc_component_get_drvdata(component);	1052	snd_soc_component_get_drvdata(component);
1053		1053

sound/soc/generic/simple-card-utils.c+8−4

 	else
 		port = np;
-	struct device_node *ports  __free(device_node) = of_get_parent(port);
+	struct device_node *ports __free(device_node) = of_get_parent(port);
-	struct device_node *top    __free(device_node) = of_get_parent(ports);
+	const char *at = strchr(kbasename(ports->full_name), '@');
-	struct device_node *ports0 __free(device_node) = of_get_child_by_name(top, "ports");
-	return ports0 == ports;
+	/*
+	 * Since child iteration order may differ
+	 * between a base DT and DT overlays,
+	 * string match "ports" or "ports@0" in the node name instead.
+	 */
+	return !at || !strcmp(at, "@0");
 }
 EXPORT_SYMBOL_GPL(graph_util_is_ports0);

sound/soc/qcom/qdsp6/q6apm-dai.c+1−0

@@ -838,6 +838,7 @@ static const struct snd_soc_component_driver q6apm_fe_dai_component = { · 837 unmodified lines
838	.ack = q6apm_dai_ack,	838	.ack = q6apm_dai_ack,
839	.compress_ops = &q6apm_dai_compress_ops,	839	.compress_ops = &q6apm_dai_compress_ops,
840	.use_dai_pcm_id = true,	840	.use_dai_pcm_id = true,
		841	.remove_order = SND_SOC_COMP_ORDER_EARLY,
841	};	842	};
842		843
843	static int q6apm_dai_probe(struct platform_device *pdev)	844	static int q6apm_dai_probe(struct platform_device *pdev)

sound/soc/qcom/qdsp6/q6apm-lpass-dais.c+1−0

@@ -278,6 +278,7 @@ static const struct snd_soc_component_driver q6apm_lpass_dai_component = { · 277 unmodified lines
278	.of_xlate_dai_name = q6dsp_audio_ports_of_xlate_dai_name,	278	.of_xlate_dai_name = q6dsp_audio_ports_of_xlate_dai_name,
279	.be_pcm_base = AUDIOREACH_BE_PCM_BASE,	279	.be_pcm_base = AUDIOREACH_BE_PCM_BASE,
280	.use_dai_pcm_id = true,	280	.use_dai_pcm_id = true,
		281	.remove_order = SND_SOC_COMP_ORDER_FIRST,
281	};	282	};
282		283
283	static int q6apm_lpass_dai_dev_probe(struct platform_device *pdev)	284	static int q6apm_lpass_dai_dev_probe(struct platform_device *pdev)

sound/soc/qcom/qdsp6/q6apm.c+1−0

@@ -715,6 +715,7 @@ static const struct snd_soc_component_driver q6apm_audio_component = { · 714 unmodified lines
715	.name = APM_AUDIO_DRV_NAME,	715	.name = APM_AUDIO_DRV_NAME,
716	.probe = q6apm_audio_probe,	716	.probe = q6apm_audio_probe,
717	.remove = q6apm_audio_remove,	717	.remove = q6apm_audio_remove,
		718	.remove_order = SND_SOC_COMP_ORDER_LAST,
718	};	719	};
719		720
720	static int apm_probe(gpr_device_t *gdev)	721	static int apm_probe(gpr_device_t *gdev)

sound/soc/soc-core.c+8−3

 	list_del(&rtd->list);
-	if (delayed_work_pending(&rtd->delayed_work))
+	flush_delayed_work(&rtd->delayed_work);
-		flush_delayed_work(&rtd->delayed_work);
 	snd_soc_pcm_component_free(rtd);
 	/*
 /*
  * Check if a DMI field is valid, i.e. not containing any string
- * in the black list.
+ * in the black list and not the empty string.
  */
 static int is_dmi_valid(const char *field)
 {
 	int i = 0;
+	if (!field[0])
+		return 0;
 	while (dmi_blacklist[i]) {
 		if (strstr(field, dmi_blacklist[i]))
 			return 0;
 	for_each_card_rtds(card, rtd)
 		if (rtd->initialized)
 			snd_soc_link_exit(rtd);
+	/* flush delayed work before removing DAIs and DAPM widgets */
+	snd_soc_flush_all_delayed_work(card);
 	/* remove and free each DAI */
 	soc_remove_link_dais(card);
 	soc_remove_link_components(card);

sound/soc/tegra/tegra_audio_graph_card.c+11−0

 	.plla_out0_rates[x11_RATE] = 45158400,
 };
+static const struct tegra_audio_cdata tegra238_data = {
+	/* PLLA */
+	.plla_rates[x8_RATE] = 1277952000,
+	.plla_rates[x11_RATE] = 1264435200,
+	/* PLLA_OUT0 */
+	.plla_out0_rates[x8_RATE] = 49152000,
+	.plla_out0_rates[x11_RATE] = 45158400,
+};
 static const struct tegra_audio_cdata tegra264_data = {
 	/* PLLA1 */
 	.plla_rates[x8_RATE] = 983040000,
 	  .data = &tegra210_data },
 	{ .compatible = "nvidia,tegra186-audio-graph-card",
 	  .data = &tegra186_data },
+	{ .compatible = "nvidia,tegra238-audio-graph-card",
+	  .data = &tegra238_data },
 	{ .compatible = "nvidia,tegra264-audio-graph-card",
 	  .data = &tegra264_data },
 	{},

sound/usb/mixer_scarlett2.c+2−0

@@ -8251,6 +8251,8 @@ static int scarlett2_find_fc_interface(struct usb_device *dev, · 8250 unmodified lines
8251		8251
8252	if (desc->bInterfaceClass != 255)	8252	if (desc->bInterfaceClass != 255)
8253	continue;	8253	continue;
		8254	if (desc->bNumEndpoints < 1)
		8255	continue;
8254		8256
8255	epd = get_endpoint(intf->altsetting, 0);	8257	epd = get_endpoint(intf->altsetting, 0);
8256	private->bInterfaceNumber = desc->bInterfaceNumber;	8258	private->bInterfaceNumber = desc->bInterfaceNumber;

sound/usb/quirks.c+2−0

 		   QUIRK_FLAG_IFACE_DELAY | QUIRK_FLAG_FORCE_IFACE_RESET),
 	DEVICE_FLG(0x0661, 0x0883, /* iBasso DC04 Ultra */
 		   QUIRK_FLAG_DSD_RAW),
+	DEVICE_FLG(0x0666, 0x0880, /* SPACETOUCH USB Audio */
+		   QUIRK_FLAG_FORCE_IFACE_RESET | QUIRK_FLAG_IFACE_DELAY),
 	DEVICE_FLG(0x06f8, 0xb000, /* Hercules DJ Console (Windows Edition) */
 		   QUIRK_FLAG_IGNORE_CTL_ERROR),
 	DEVICE_FLG(0x06f8, 0xd002, /* Hercules DJ Console (Macintosh Edition) */

tools/arch/x86/include/asm/amd/ibs.h+1−1

@@ -110,7 +110,7 @@ union ibs_op_data3 { · 109 unmodified lines
110	__u64 ld_op:1, /* 0: load op */	110	__u64 ld_op:1, /* 0: load op */
111	st_op:1, /* 1: store op */	111	st_op:1, /* 1: store op */
112	dc_l1tlb_miss:1, /* 2: data cache L1TLB miss */	112	dc_l1tlb_miss:1, /* 2: data cache L1TLB miss */
113	dc_l2tlb_miss:1, /* 3: data cache L2TLB hit in 2M page */	113	dc_l2tlb_miss:1, /* 3: data cache L2TLB miss in 2M page */
114	dc_l1tlb_hit_2m:1, /* 4: data cache L1TLB hit in 2M page */	114	dc_l1tlb_hit_2m:1, /* 4: data cache L1TLB hit in 2M page */
115	dc_l1tlb_hit_1g:1, /* 5: data cache L1TLB hit in 1G page */	115	dc_l1tlb_hit_1g:1, /* 5: data cache L1TLB hit in 1G page */
116	dc_l2tlb_hit_2m:1, /* 6: data cache L2TLB hit in 2M page */	116	dc_l2tlb_hit_2m:1, /* 6: data cache L2TLB hit in 2M page */

tools/arch/x86/include/asm/cpufeatures.h+3−1

 #define X86_FEATURE_PEBS		( 3*32+12) /* "pebs" Precise-Event Based Sampling */
 #define X86_FEATURE_BTS			( 3*32+13) /* "bts" Branch Trace Store */
 #define X86_FEATURE_SYSCALL32		( 3*32+14) /* syscall in IA32 userspace */
-#define X86_FEATURE_SYSENTER32		( 3*32+15) /* sysenter in IA32 userspace */
+#define X86_FEATURE_SYSFAST32		( 3*32+15) /* sysenter/syscall in IA32 userspace */
 #define X86_FEATURE_REP_GOOD		( 3*32+16) /* "rep_good" REP microcode works well */
 #define X86_FEATURE_AMD_LBR_V2		( 3*32+17) /* "amd_lbr_v2" AMD Last Branch Record Extension Version 2 */
 #define X86_FEATURE_CLEAR_CPU_BUF	( 3*32+18) /* Clear CPU buffers using VERW */
 #define X86_FEATURE_AMX_FP16		(12*32+21) /* AMX fp16 Support */
 #define X86_FEATURE_AVX_IFMA            (12*32+23) /* Support for VPMADD52[H,L]UQ */
 #define X86_FEATURE_LAM			(12*32+26) /* "lam" Linear Address Masking */
+#define X86_FEATURE_MOVRS		(12*32+31) /* MOVRS instructions */
 /* AMD-defined CPU features, CPUID level 0x80000008 (EBX), word 13 */
 #define X86_FEATURE_CLZERO		(13*32+ 0) /* "clzero" CLZERO instruction */
 #define X86_FEATURE_GP_ON_USER_CPUID	(20*32+17) /* User CPUID faulting */
 #define X86_FEATURE_PREFETCHI		(20*32+20) /* Prefetch Data/Instruction to Cache Level */
+#define X86_FEATURE_ERAPS		(20*32+24) /* Enhanced Return Address Predictor Security */
 #define X86_FEATURE_SBPB		(20*32+27) /* Selective Branch Prediction Barrier */
 #define X86_FEATURE_IBPB_BRTYPE		(20*32+28) /* MSR_PRED_CMD[IBPB] flushes all branch type predictions */
 #define X86_FEATURE_SRSO_NO		(20*32+29) /* CPU is not affected by SRSO */

tools/arch/x86/include/asm/msr-index.h+6−0

 #define MSR_SNOOP_RSP_0			0x00001328
 #define MSR_SNOOP_RSP_1			0x00001329
+#define MSR_OMR_0			0x000003e0
+#define MSR_OMR_1			0x000003e1
+#define MSR_OMR_2			0x000003e2
+#define MSR_OMR_3			0x000003e3
 #define MSR_LBR_SELECT			0x000001c8
 #define MSR_LBR_TOS			0x000001c9
 #define MSR_CORE_PERF_GLOBAL_STATUS	0x0000038e
 #define MSR_CORE_PERF_GLOBAL_CTRL	0x0000038f
 #define MSR_CORE_PERF_GLOBAL_OVF_CTRL	0x00000390
+#define MSR_CORE_PERF_GLOBAL_STATUS_SET	0x00000391
 #define MSR_PERF_METRICS		0x00000329

tools/arch/x86/include/uapi/asm/kvm.h+6−2

 #define KVM_X86_GRP_SEV			1
 #  define KVM_X86_SEV_VMSA_FEATURES	0
 #  define KVM_X86_SNP_POLICY_BITS	1
+#  define KVM_X86_SEV_SNP_REQ_CERTS	2
 struct kvm_vmx_nested_state_data {
 	__u8 vmcs12[KVM_STATE_NESTED_VMX_VMCS_SIZE];
 	KVM_SEV_SNP_LAUNCH_START = 100,
 	KVM_SEV_SNP_LAUNCH_UPDATE,
 	KVM_SEV_SNP_LAUNCH_FINISH,
+	KVM_SEV_SNP_ENABLE_REQ_CERTS,
 	KVM_SEV_NR_MAX,
 };
 	__u64 pad1[4];
 };
-#define KVM_X2APIC_API_USE_32BIT_IDS            (1ULL << 0)
+#define KVM_X2APIC_API_USE_32BIT_IDS			_BITULL(0)
-#define KVM_X2APIC_API_DISABLE_BROADCAST_QUIRK  (1ULL << 1)
+#define KVM_X2APIC_API_DISABLE_BROADCAST_QUIRK		_BITULL(1)
+#define KVM_X2APIC_ENABLE_SUPPRESS_EOI_BROADCAST	_BITULL(2)
+#define KVM_X2APIC_DISABLE_SUPPRESS_EOI_BROADCAST	_BITULL(3)
 struct kvm_hyperv_eventfd {
 	__u32 conn_id;

tools/bootconfig/samples/bad-non-closed-brace.bconf+4−0

@@ -0,0 +1,4 @@
	1	foo {
	2	bar {
	3	buz
	4	}

tools/bootconfig/samples/bad-over-max-brace.bconf+19−0

@@ -0,0 +1,19 @@
	1	key1 {
	2	key2 {
	3	key3 {
	4	key4 {
	5	key5 {
	6	key6 {
	7	key7 {
	8	key8 {
	9	key9 {
	10	key10 {
	11	key11 {
	12	key12 {
	13	key13 {
	14	key14 {
	15	key15 {
	16	key16 {
	17	key17 {
	18	}}}}}}}}}}}}}}}}}
	19

tools/bootconfig/samples/exp-good-nested-brace.bconf+1−0

@@ -0,0 +1 @@
		1	key1.key2.key3.key4.key5.key6.key7.key8.key9.key10.key11.key12.key13.key14.key15.key16;

tools/bootconfig/samples/good-nested-brace.bconf+18−0

@@ -0,0 +1,18 @@
	1	key1 {
	2	key2 {
	3	key3 {
	4	key4 {
	5	key5 {
	6	key6 {
	7	key7 {
	8	key8 {
	9	key9 {
	10	key10 {
	11	key11 {
	12	key12 {
	13	key13 {
	14	key14 {
	15	key15 {
	16	key16 {
	17	}}}}}}}}}}}}}}}}
	18

tools/bootconfig/test-bootconfig.sh+9−0

@@ -171,6 +171,15 @@ $BOOTCONF $INITRD > $OUTFILE · 170 unmodified lines
171	xfail grep -q 'val[[:space:]]' $OUTFILE	171	xfail grep -q 'val[[:space:]]' $OUTFILE
172	xpass grep -q 'val2[[:space:]]' $OUTFILE	172	xpass grep -q 'val2[[:space:]]' $OUTFILE
173		173
		174	echo "Showing correct line:column of no closing brace"
		175	cat > $TEMPCONF << EOF
		176	foo {
		177	bar {
		178	}
		179	EOF
		180	$BOOTCONF -a $TEMPCONF $INITRD 2> $OUTFILE
		181	xpass grep -q "1:1" $OUTFILE
		182
174	echo "=== expected failure cases ==="	183	echo "=== expected failure cases ==="
175	for i in samples/bad-* ; do	184	for i in samples/bad-* ; do
176	xfail $BOOTCONF -a $i $INITRD	185	xfail $BOOTCONF -a $i $INITRD

tools/build/Build.include+9−0

@@ -98,6 +98,15 @@ c_flags_2 = $(filter-out $(CFLAGS_REMOVE_$(basetarget).o), $(c_flags_1)) · 97 unmodified lines
98	c_flags = $(filter-out $(CFLAGS_REMOVE_$(obj)), $(c_flags_2))	98	c_flags = $(filter-out $(CFLAGS_REMOVE_$(obj)), $(c_flags_2))
99	cxx_flags = -Wp,-MD,$(depfile) -Wp,-MT,$@ $(CXXFLAGS) -D"BUILD_STR(s)=\#s" $(CXXFLAGS_$(basetarget).o) $(CXXFLAGS_$(obj))	99	cxx_flags = -Wp,-MD,$(depfile) -Wp,-MT,$@ $(CXXFLAGS) -D"BUILD_STR(s)=\#s" $(CXXFLAGS_$(basetarget).o) $(CXXFLAGS_$(obj))
100		100
		101	###
		102	# Rust flags to be used on rule definition, includes:
		103	# - global $(RUST_FLAGS)
		104	# - per target Rust flags
		105	# - per object Rust flags
		106	rust_flags_1 = $(RUST_FLAGS) $(RUST_FLAGS_$(basetarget).o) $(RUST_FLAGS_$(obj))
		107	rust_flags_2 = $(filter-out $(RUST_FLAGS_REMOVE_$(basetarget).o), $(rust_flags_1))
		108	rust_flags = $(filter-out $(RUST_FLAGS_REMOVE_$(obj)), $(rust_flags_2))
		109
101	###	110	###
102	## HOSTCC C flags	111	## HOSTCC C flags
103		112

tools/build/Makefile.build+4−2

 # If there's nothing to link, create empty $@ object.
 quiet_cmd_ld_multi = LD      $@
       cmd_ld_multi = $(if $(strip $(obj-y)),\
-                     $(LD) -r -o $@  $(filter $(obj-y),$^),rm -f $@; $(AR) rcs $@)
+                     printf "$(objprefix)%s " $(patsubst $(objprefix)%,%,$(filter $(obj-y),$^)) | \
+                     xargs $(LD) -r -o $@,rm -f $@; $(AR) rcs $@)
 quiet_cmd_host_ld_multi = HOSTLD  $@
       cmd_host_ld_multi = $(if $(strip $(obj-y)),\
-                          $(HOSTLD) -r -o $@  $(filter $(obj-y),$^),rm -f $@; $(HOSTAR) rcs $@)
+                          printf "$(objprefix)%s " $(patsubst $(objprefix)%,%,$(filter $(obj-y),$^)) | \
+                          xargs $(HOSTLD) -r -o $@,rm -f $@; $(HOSTAR) rcs $@)
 rust_common_cmd = \
 	$(RUSTC) $(rust_flags) \

tools/include/linux/coresight-pmu.h+0−24

@@ -21,30 +21,6 @@ · 20 unmodified lines
21	*/	21	*/
22	#define CORESIGHT_LEGACY_CPU_TRACE_ID(cpu) (0x10 + (cpu * 2))	22	#define CORESIGHT_LEGACY_CPU_TRACE_ID(cpu) (0x10 + (cpu * 2))
23		23
24	/*
25	* Below are the definition of bit offsets for perf option, and works as
26	* arbitrary values for all ETM versions.
27	*
28	* Most of them are orignally from ETMv3.5/PTM's ETMCR config, therefore,
29	* ETMv3.5/PTM doesn't define ETMCR config bits with prefix "ETM3_" and
30	* directly use below macros as config bits.
31	*/
32	#define ETM_OPT_BRANCH_BROADCAST 8
33	#define ETM_OPT_CYCACC 12
34	#define ETM_OPT_CTXTID 14
35	#define ETM_OPT_CTXTID2 15
36	#define ETM_OPT_TS 28
37	#define ETM_OPT_RETSTK 29
38
39	/* ETMv4 CONFIGR programming bits for the ETM OPTs */
40	#define ETM4_CFG_BIT_BB 3
41	#define ETM4_CFG_BIT_CYCACC 4
42	#define ETM4_CFG_BIT_CTXTID 6
43	#define ETM4_CFG_BIT_VMID 7
44	#define ETM4_CFG_BIT_TS 11
45	#define ETM4_CFG_BIT_RETSTK 12
46	#define ETM4_CFG_BIT_VMID_OPT 15
47
48	/*	24	/*
49	* Interpretation of the PERF_RECORD_AUX_OUTPUT_HW_ID payload.	25	* Interpretation of the PERF_RECORD_AUX_OUTPUT_HW_ID payload.
50	* Used to associate a CPU with the CoreSight Trace ID.	26	* Used to associate a CPU with the CoreSight Trace ID.

tools/include/linux/gfp_types.h+7−2

  * %__GFP_ACCOUNT causes the allocation to be accounted to kmemcg.
  *
  * %__GFP_NO_OBJ_EXT causes slab allocation to have no object extension.
+ * mark_obj_codetag_empty() should be called upon freeing for objects allocated
+ * with this flag to indicate that their NULL tags are expected and normal.
  */
 #define __GFP_RECLAIMABLE ((__force gfp_t)___GFP_RECLAIMABLE)
 #define __GFP_WRITE	((__force gfp_t)___GFP_WRITE)
  *
  * %GFP_ATOMIC users can not sleep and need the allocation to succeed. A lower
  * watermark is applied to allow access to "atomic reserves".
- * The current implementation doesn't support NMI and few other strict
+ * The current implementation doesn't support NMI, nor contexts that disable
- * non-preemptive contexts (e.g. raw_spin_lock). The same applies to %GFP_NOWAIT.
+ * preemption under PREEMPT_RT. This includes raw_spin_lock() and plain
+ * preempt_disable() - see "Memory allocation" in
+ * Documentation/core-api/real-time/differences.rst for more info.
  *
  * %GFP_KERNEL is typical for kernel-internal allocations. The caller requires
  * %ZONE_NORMAL or a lower zone for direct access but can direct reclaim.
  * %GFP_NOWAIT is for kernel allocations that should not stall for direct
  * reclaim, start physical IO or use any filesystem callback.  It is very
  * likely to fail to allocate memory, even for very small allocations.
+ * The same restrictions on calling contexts apply as for %GFP_ATOMIC.
  *
  * %GFP_NOIO will use direct reclaim to discard clean pages or slab pages
  * that do not require the starting of any physical IO.

tools/include/uapi/asm-generic/unistd.h+4−1

 #define __NR_listns 470
 __SYSCALL(__NR_listns, sys_listns)
+#define __NR_rseq_slice_yield 471
+__SYSCALL(__NR_rseq_slice_yield, sys_rseq_slice_yield)
 #undef __NR_syscalls
-#define __NR_syscalls 471
+#define __NR_syscalls 472
 /*
  * 32 bit systems traditionally used different

tools/include/uapi/linux/kvm.h+23−1

 	} u;
 };
+struct kvm_exit_snp_req_certs {
+	__u64 gpa;
+	__u64 npages;
+	__u64 ret;
+};
 #define KVM_S390_GET_SKEYS_NONE   1
 #define KVM_S390_SKEYS_MAX        1048576
 #define KVM_EXIT_MEMORY_FAULT     39
 #define KVM_EXIT_TDX              40
 #define KVM_EXIT_ARM_SEA          41
+#define KVM_EXIT_ARM_LDST64B      42
+#define KVM_EXIT_SNP_REQ_CERTS    43
 /* For KVM_EXIT_INTERNAL_ERROR */
 /* Emulate instruction failed. */
 		} eoi;
 		/* KVM_EXIT_HYPERV */
 		struct kvm_hyperv_exit hyperv;
-		/* KVM_EXIT_ARM_NISV */
+		/* KVM_EXIT_ARM_NISV / KVM_EXIT_ARM_LDST64B */
 		struct {
 			__u64 esr_iss;
 			__u64 fault_ipa;
 			__u64 gva;
 			__u64 gpa;
 		} arm_sea;
+		/* KVM_EXIT_SNP_REQ_CERTS */
+		struct kvm_exit_snp_req_certs snp_req_certs;
 		/* Fix the size of the union. */
 		char padding[256];
 	};
 #define KVM_CAP_GUEST_MEMFD_FLAGS 244
 #define KVM_CAP_ARM_SEA_TO_USER 245
 #define KVM_CAP_S390_USER_OPEREXEC 246
+#define KVM_CAP_S390_KEYOP 247
 struct kvm_irq_routing_irqchip {
 	__u32 irqchip;
 	__s32	tablefd;
 };
+#define KVM_S390_KEYOP_ISKE 0x01
+#define KVM_S390_KEYOP_RRBE 0x02
+#define KVM_S390_KEYOP_SSKE 0x03
+struct kvm_s390_keyop {
+	__u64 guest_addr;
+	__u8  key;
+	__u8  operation;
+	__u8  pad[6];
+};
 /*
  * KVM_CREATE_VCPU receives as a parameter the vcpu slot, and returns
  * a vcpu fd.
 #define KVM_S390_UCAS_MAP        _IOW(KVMIO, 0x50, struct kvm_s390_ucas_mapping)
 #define KVM_S390_UCAS_UNMAP      _IOW(KVMIO, 0x51, struct kvm_s390_ucas_mapping)
 #define KVM_S390_VCPU_FAULT	 _IOW(KVMIO, 0x52, unsigned long)
+#define KVM_S390_KEYOP           _IOWR(KVMIO, 0x53, struct kvm_s390_keyop)
 /* Device model IOC */
 #define KVM_CREATE_IRQCHIP        _IO(KVMIO,   0x60)

tools/include/uapi/linux/perf_event.h+1−1

@@ -1396,7 +1396,7 @@ union perf_mem_data_src { · 1395 unmodified lines
1396	#define PERF_MEM_LVLNUM_L4 0x0004 /* L4 */	1396	#define PERF_MEM_LVLNUM_L4 0x0004 /* L4 */
1397	#define PERF_MEM_LVLNUM_L2_MHB 0x0005 /* L2 Miss Handling Buffer */	1397	#define PERF_MEM_LVLNUM_L2_MHB 0x0005 /* L2 Miss Handling Buffer */
1398	#define PERF_MEM_LVLNUM_MSC 0x0006 /* Memory-side Cache */	1398	#define PERF_MEM_LVLNUM_MSC 0x0006 /* Memory-side Cache */
1399	#define PERF_MEM_LVLNUM_L0 0x0007 /* L0 */	1399	#define PERF_MEM_LVLNUM_L0 0x0007 /* L0 */
1400	#define PERF_MEM_LVLNUM_UNC 0x0008 /* Uncached */	1400	#define PERF_MEM_LVLNUM_UNC 0x0008 /* Uncached */
1401	#define PERF_MEM_LVLNUM_CXL 0x0009 /* CXL */	1401	#define PERF_MEM_LVLNUM_CXL 0x0009 /* CXL */
1402	#define PERF_MEM_LVLNUM_IO 0x000a /* I/O */	1402	#define PERF_MEM_LVLNUM_IO 0x000a /* I/O */

tools/objtool/Makefile+1−1

@@ -13,7 +13,7 @@ endif · 12 unmodified lines
13		13
14	ifeq ($(ARCH_HAS_KLP),y)	14	ifeq ($(ARCH_HAS_KLP),y)
15	HAVE_XXHASH = $(shell printf "$(pound)include <xxhash.h>\nXXH3_state_t *state;int main() {}" \| \	15	HAVE_XXHASH = $(shell printf "$(pound)include <xxhash.h>\nXXH3_state_t *state;int main() {}" \| \
16	$(HOSTCC) -xc - -o /dev/null -lxxhash 2> /dev/null && echo y \|\| echo n)	16	$(HOSTCC) $(HOSTCFLAGS) -xc - -o /dev/null -lxxhash 2> /dev/null && echo y \|\| echo n)
17	ifeq ($(HAVE_XXHASH),y)	17	ifeq ($(HAVE_XXHASH),y)
18	BUILD_KLP := y	18	BUILD_KLP := y
19	LIBXXHASH_CFLAGS := $(shell $(HOSTPKG_CONFIG) libxxhash --cflags 2>/dev/null) \	19	LIBXXHASH_CFLAGS := $(shell $(HOSTPKG_CONFIG) libxxhash --cflags 2>/dev/null) \

tools/objtool/arch/x86/decode.c+23−39

@@ -395,52 +395,36 @@ int arch_decode_instruction(struct objtool_file file, const struct section sec · 394 unmodified lines
395	if (!rex_w)	395	if (!rex_w)
396	break;	396	break;
397		397
398	if (modrm_reg == CFI_SP) {	398	if (mod_is_reg()) {
399		399	/* mov reg, reg */
400	if (mod_is_reg()) {	400	ADD_OP(op) {
401	/* mov %rsp, reg */	401	op->src.type = OP_SRC_REG;
402	ADD_OP(op) {	402	op->src.reg = modrm_reg;
403	op->src.type = OP_SRC_REG;	403	op->dest.type = OP_DEST_REG;
404	op->src.reg = CFI_SP;	404	op->dest.reg = modrm_rm;
405	op->dest.type = OP_DEST_REG;
406	op->dest.reg = modrm_rm;
407	}
408	break;
409
410	} else {
411	/* skip RIP relative displacement */
412	if (is_RIP())
413	break;
414
415	/* skip nontrivial SIB */
416	if (have_SIB()) {
417	modrm_rm = sib_base;
418	if (sib_index != CFI_SP)
419	break;
420	}
421
422	/* mov %rsp, disp(%reg) */
423	ADD_OP(op) {
424	op->src.type = OP_SRC_REG;
425	op->src.reg = CFI_SP;
426	op->dest.type = OP_DEST_REG_INDIRECT;
427	op->dest.reg = modrm_rm;
428	op->dest.offset = ins.displacement.value;
429	}
430	break;
431	}	405	}
432
433	break;	406	break;
434	}	407	}
435		408
436	if (rm_is_reg(CFI_SP)) {	409	/* skip RIP relative displacement */
		410	if (is_RIP())
		411	break;
437		412
438	/* mov reg, %rsp */	413	/* skip nontrivial SIB */
		414	if (have_SIB()) {
		415	modrm_rm = sib_base;
		416	if (sib_index != CFI_SP)
		417	break;
		418	}
		419
		420	/* mov %rsp, disp(%reg) */
		421	if (modrm_reg == CFI_SP) {
439	ADD_OP(op) {	422	ADD_OP(op) {
440	op->src.type = OP_SRC_REG;	423	op->src.type = OP_SRC_REG;
441	op->src.reg = modrm_reg;	424	op->src.reg = CFI_SP;
442	op->dest.type = OP_DEST_REG;	425	op->dest.type = OP_DEST_REG_INDIRECT;
443	op->dest.reg = CFI_SP;	426	op->dest.reg = modrm_rm;
		427	op->dest.offset = ins.displacement.value;
444	}	428	}
445	break;	429	break;
446	}	430	}

tools/objtool/check.c+19−5

 				cfi->stack_size += 8;
 			}
+			else if (cfi->vals[op->src.reg].base == CFI_CFA) {
+				/*
+				 * Clang RSP musical chairs:
+				 *
+				 *   mov %rsp, %rdx [handled above]
+				 *   ...
+				 *   mov %rdx, %rbx [handled here]
+				 *   ...
+				 *   mov %rbx, %rsp [handled above]
+				 */
+				cfi->vals[op->dest.reg].base = CFI_CFA;
+				cfi->vals[op->dest.reg].offset = cfi->vals[op->src.reg].offset;
+			}
 			break;
 static int validate_branch(struct objtool_file *file, struct symbol *func,
 			   struct instruction *insn, struct insn_state state);
 static int do_validate_branch(struct objtool_file *file, struct symbol *func,
-			      struct instruction *insn, struct insn_state state);
+			      struct instruction *insn, struct insn_state *state);
 static int validate_insn(struct objtool_file *file, struct symbol *func,
 			 struct instruction *insn, struct insn_state *statep,
  * tools/objtool/Documentation/objtool.txt.
  */
 static int do_validate_branch(struct objtool_file *file, struct symbol *func,
-			      struct instruction *insn, struct insn_state state)
+			      struct instruction *insn, struct insn_state *state)
 {
 	struct instruction *next_insn, *prev_insn = NULL;
 	bool dead_end;
 			return 1;
 		}
-		ret = validate_insn(file, func, insn, &state, prev_insn, next_insn,
+		ret = validate_insn(file, func, insn, state, prev_insn, next_insn,
 				    &dead_end);
 		if (!insn->trace) {
 		}
 		if (!dead_end && !next_insn) {
-			if (state.cfi.cfa.base == CFI_UNDEFINED)
+			if (state->cfi.cfa.base == CFI_UNDEFINED)
 				return 0;
 			if (file->ignore_unreachables)
 				return 0;
 	int ret;
 	trace_depth_inc();
-	ret = do_validate_branch(file, func, insn, state);
+	ret = do_validate_branch(file, func, insn, &state);
 	trace_depth_dec();
 	return ret;

tools/objtool/elf.c+1−1

@@ -1375,7 +1375,7 @@ void elf_add_data(struct elf elf, struct section sec, const void data, size_ · 1374 unmodified lines
1375	memcpy(sec->data->d_buf, data, size);	1375	memcpy(sec->data->d_buf, data, size);
1376		1376
1377	sec->data->d_size = size;	1377	sec->data->d_size = size;
1378	sec->data->d_align = 1;	1378	sec->data->d_align = sec->sh.sh_addralign;
1379		1379
1380	offset = ALIGN(sec->sh.sh_size, sec->sh.sh_addralign);	1380	offset = ALIGN(sec->sh.sh_size, sec->sh.sh_addralign);
1381	sec->sh.sh_size = offset + size;	1381	sec->sh.sh_size = offset + size;

tools/objtool/include/objtool/warn.h+1−1

@@ -107,7 +107,7 @@ static inline char offstr(struct section sec, unsigned long offset) · 106 unmodified lines
107	#define ERROR_ELF(format, ...) __WARN_ELF(ERROR_STR, format, ##__VA_ARGS__)	107	#define ERROR_ELF(format, ...) __WARN_ELF(ERROR_STR, format, ##__VA_ARGS__)
108	#define ERROR_GLIBC(format, ...) __WARN_GLIBC(ERROR_STR, format, ##__VA_ARGS__)	108	#define ERROR_GLIBC(format, ...) __WARN_GLIBC(ERROR_STR, format, ##__VA_ARGS__)
109	#define ERROR_FUNC(sec, offset, format, ...) __WARN_FUNC(ERROR_STR, sec, offset, format, ##__VA_ARGS__)	109	#define ERROR_FUNC(sec, offset, format, ...) __WARN_FUNC(ERROR_STR, sec, offset, format, ##__VA_ARGS__)
110	#define ERROR_INSN(insn, format, ...) WARN_FUNC(insn->sec, insn->offset, format, ##__VA_ARGS__)	110	#define ERROR_INSN(insn, format, ...) ERROR_FUNC(insn->sec, insn->offset, format, ##__VA_ARGS__)
111		111
112	extern bool debug;	112	extern bool debug;
113	extern int indent;	113	extern int indent;

tools/objtool/klp-diff.c+26−13

  * be applied after static branch/call init, resulting in code corruption.
  *
  * Validate a special section entry to avoid that.  Note that an inert
- * tracepoint is harmless enough, in that case just skip the entry and print a
+ * tracepoint or pr_debug() is harmless enough, in that case just skip the
- * warning.  Otherwise, return an error.
+ * entry and print a warning.  Otherwise, return an error.
  *
- * This is only a temporary limitation which will be fixed when livepatch adds
+ * TODO: This is only a temporary limitation which will be fixed when livepatch
- * support for submodules: fully self-contained modules which are embedded in
+ * adds support for submodules: fully self-contained modules which are embedded
- * the top-level livepatch module's data and which can be loaded on demand when
+ * in the top-level livepatch module's data and which can be loaded on demand
- * their corresponding to-be-patched module gets loaded.  Then klp relocs can
+ * when their corresponding to-be-patched module gets loaded.  Then klp relocs
- * be retired.
+ * can be retired.
  *
  * Return:
  *   -1: error: validation failed
- *    1: warning: tracepoint skipped
+ *    1: warning: disabled tracepoint or pr_debug()
  *    0: success
  */
 static int validate_special_section_klp_reloc(struct elfs *e, struct symbol *sym)
 {
 	bool static_branch = !strcmp(sym->sec->name, "__jump_table");
 	bool static_call   = !strcmp(sym->sec->name, ".static_call_sites");
-	struct symbol *code_sym = NULL;
+	const char *code_sym = NULL;
 	unsigned long code_offset = 0;
 	struct reloc *reloc;
 	int ret = 0;
 		const char *sym_modname;
 		struct export *export;
+		if (convert_reloc_sym(e->patched, reloc))
+			continue;
 		/* Static branch/call keys are always STT_OBJECT */
 		if (reloc->sym->type != STT_OBJECT) {
 			/* Save code location which can be printed below */
 			if (reloc->sym->type == STT_FUNC && !code_sym) {
-				code_sym = reloc->sym;
+				code_sym = reloc->sym->name;
 				code_offset = reloc_addend(reloc);
 			}
 		if (!strcmp(sym_modname, "vmlinux"))
 			continue;
+		if (!code_sym)
+			code_sym = "<unknown>";
 		if (static_branch) {
 			if (strstarts(reloc->sym->name, "__tracepoint_")) {
 				WARN("%s: disabling unsupported tracepoint %s",
-				     code_sym->name, reloc->sym->name + 13);
+				     code_sym, reloc->sym->name + 13);
+				ret = 1;
+				continue;
+			}
+			if (strstr(reloc->sym->name, "__UNIQUE_ID_ddebug_")) {
+				WARN("%s: disabling unsupported pr_debug()",
+				     code_sym);
 				ret = 1;
 				continue;
 			}
 			ERROR("%s+0x%lx: unsupported static branch key %s.  Use static_key_enabled() instead",
-			      code_sym->name, code_offset, reloc->sym->name);
+			      code_sym, code_offset, reloc->sym->name);
 			return -1;
 		}
 		}
 		ERROR("%s()+0x%lx: unsupported static call key %s.  Use KLP_STATIC_CALL() instead",
-		      code_sym->name, code_offset, reloc->sym->name);
+		      code_sym, code_offset, reloc->sym->name);
 		return -1;
 	}

tools/perf/Makefile.config+18−0

@@ -1163,6 +1163,24 @@ ifndef NO_RUST · 1162 unmodified lines
1163	CFLAGS += -DHAVE_RUST_SUPPORT	1163	CFLAGS += -DHAVE_RUST_SUPPORT
1164	$(call detected,CONFIG_RUST_SUPPORT)	1164	$(call detected,CONFIG_RUST_SUPPORT)
1165	endif	1165	endif
		1166
		1167	ifneq ($(CROSS_COMPILE),)
		1168	RUST_TARGET_FLAGS_arm := arm-unknown-linux-gnueabi
		1169	RUST_TARGET_FLAGS_arm64 := aarch64-unknown-linux-gnu
		1170	RUST_TARGET_FLAGS_m68k := m68k-unknown-linux-gnu
		1171	RUST_TARGET_FLAGS_mips := mipsel-unknown-linux-gnu
		1172	RUST_TARGET_FLAGS_powerpc := powerpc64le-unknown-linux-gnu
		1173	RUST_TARGET_FLAGS_riscv := riscv64gc-unknown-linux-gnu
		1174	RUST_TARGET_FLAGS_s390 := s390x-unknown-linux-gnu
		1175	RUST_TARGET_FLAGS_x86 := x86_64-unknown-linux-gnu
		1176	RUST_TARGET_FLAGS_x86_64 := x86_64-unknown-linux-gnu
		1177
		1178	ifeq ($(RUST_TARGET_FLAGS_$(ARCH)),)
		1179	$(error Unknown rust cross compilation architecture $(ARCH))
		1180	endif
		1181
		1182	RUST_FLAGS += --target=$(RUST_TARGET_FLAGS_$(ARCH))
		1183	endif
1166	endif	1184	endif
1167		1185
1168	# Among the variables below, these:	1186	# Among the variables below, these:

tools/perf/Makefile.perf+1−1

@@ -274,7 +274,7 @@ ifeq ($(PYLINT),1) · 273 unmodified lines
274	PYLINT := $(shell which pylint 2> /dev/null)	274	PYLINT := $(shell which pylint 2> /dev/null)
275	endif	275	endif
276		276
277	export srctree OUTPUT RM CC CXX RUSTC LD AR CFLAGS CXXFLAGS V BISON FLEX AWK	277	export srctree OUTPUT RM CC CXX RUSTC LD AR CFLAGS CXXFLAGS RUST_FLAGS V BISON FLEX AWK
278	export HOSTCC HOSTLD HOSTAR HOSTCFLAGS SHELLCHECK MYPY PYLINT	278	export HOSTCC HOSTLD HOSTAR HOSTCFLAGS SHELLCHECK MYPY PYLINT
279		279
280	include $(srctree)/tools/build/Makefile.include	280	include $(srctree)/tools/build/Makefile.include

tools/perf/arch/arm/entry/syscalls/syscall.tbl+1−0

@@ -485,3 +485,4 @@ · 484 unmodified lines
485	468 common file_getattr sys_file_getattr	485	468 common file_getattr sys_file_getattr
486	469 common file_setattr sys_file_setattr	486	469 common file_setattr sys_file_setattr
487	470 common listns sys_listns	487	470 common listns sys_listns
		488	471 common rseq_slice_yield sys_rseq_slice_yield

tools/perf/arch/arm/util/cs-etm.c+0−14

@@ -68,20 +68,6 @@ static const char * const metadata_ete_ro[] = { · 67 unmodified lines
68		68
69	enum cs_etm_version { CS_NOT_PRESENT, CS_ETMV3, CS_ETMV4, CS_ETE };	69	enum cs_etm_version { CS_NOT_PRESENT, CS_ETMV3, CS_ETMV4, CS_ETE };
70		70
71	/* ETMv4 CONFIGR register bits */
72	#define TRCCONFIGR_BB BIT(3)
73	#define TRCCONFIGR_CCI BIT(4)
74	#define TRCCONFIGR_CID BIT(6)
75	#define TRCCONFIGR_VMID BIT(7)
76	#define TRCCONFIGR_TS BIT(11)
77	#define TRCCONFIGR_RS BIT(12)
78	#define TRCCONFIGR_VMIDOPT BIT(15)
79
80	/* ETMv3 ETMCR register bits */
81	#define ETMCR_CYC_ACC BIT(12)
82	#define ETMCR_TIMESTAMP_EN BIT(28)
83	#define ETMCR_RETURN_STACK BIT(29)
84
85	static bool cs_etm_is_ete(struct perf_pmu *cs_etm_pmu, struct perf_cpu cpu);	71	static bool cs_etm_is_ete(struct perf_pmu *cs_etm_pmu, struct perf_cpu cpu);
86	static int cs_etm_get_ro(struct perf_pmu pmu, struct perf_cpu cpu, const char path, __u64 *val);	72	static int cs_etm_get_ro(struct perf_pmu pmu, struct perf_cpu cpu, const char path, __u64 *val);
87	static bool cs_etm_pmu_path_exists(struct perf_pmu pmu, struct perf_cpu cpu, const char path);	73	static bool cs_etm_pmu_path_exists(struct perf_pmu pmu, struct perf_cpu cpu, const char path);

tools/perf/arch/mips/entry/syscalls/syscall_n64.tbl+1−0

@@ -385,3 +385,4 @@ · 384 unmodified lines
385	468 n64 file_getattr sys_file_getattr	385	468 n64 file_getattr sys_file_getattr
386	469 n64 file_setattr sys_file_setattr	386	469 n64 file_setattr sys_file_setattr
387	470 n64 listns sys_listns	387	470 n64 listns sys_listns
		388	471 n64 rseq_slice_yield sys_rseq_slice_yield

tools/perf/arch/powerpc/entry/syscalls/syscall.tbl+1−0

@@ -561,3 +561,4 @@ · 560 unmodified lines
561	468 common file_getattr sys_file_getattr	561	468 common file_getattr sys_file_getattr
562	469 common file_setattr sys_file_setattr	562	469 common file_setattr sys_file_setattr
563	470 common listns sys_listns	563	470 common listns sys_listns
		564	471 nospu rseq_slice_yield sys_rseq_slice_yield

tools/perf/arch/s390/entry/syscalls/syscall.tbl+392−467

@@ -3,473 +3,398 @@ · 2 unmodified lines
3	# System call table for s390	3	# System call table for s390
4	#	4	#
5	# Format:	5	# Format:
		6	# <nr> <abi> <syscall> <entry>
6	#	7	#
7	# <nr> <abi> <syscall> <entry-64bit> <compat-entry>	8	# <abi> is always common.
8	#
9	# where <abi> can be common, 64, or 32
10		9
11	1 common exit sys_exit sys_exit	10	1 common exit sys_exit
12	2 common fork sys_fork sys_fork	11	2 common fork sys_fork
13	3 common read sys_read compat_sys_s390_read	12	3 common read sys_read
14	4 common write sys_write compat_sys_s390_write	13	4 common write sys_write
15	5 common open sys_open compat_sys_open	14	5 common open sys_open
16	6 common close sys_close sys_close	15	6 common close sys_close
17	7 common restart_syscall sys_restart_syscall sys_restart_syscall	16	7 common restart_syscall sys_restart_syscall
18	8 common creat sys_creat sys_creat	17	8 common creat sys_creat
19	9 common link sys_link sys_link	18	9 common link sys_link
20	10 common unlink sys_unlink sys_unlink	19	10 common unlink sys_unlink
21	11 common execve sys_execve compat_sys_execve	20	11 common execve sys_execve
22	12 common chdir sys_chdir sys_chdir	21	12 common chdir sys_chdir
23	13 32 time - sys_time32	22	14 common mknod sys_mknod
24	14 common mknod sys_mknod sys_mknod	23	15 common chmod sys_chmod
25	15 common chmod sys_chmod sys_chmod	24	19 common lseek sys_lseek
26	16 32 lchown - sys_lchown16	25	20 common getpid sys_getpid
27	19 common lseek sys_lseek compat_sys_lseek	26	21 common mount sys_mount
28	20 common getpid sys_getpid sys_getpid	27	22 common umount sys_oldumount
29	21 common mount sys_mount sys_mount	28	26 common ptrace sys_ptrace
30	22 common umount sys_oldumount sys_oldumount	29	27 common alarm sys_alarm
31	23 32 setuid - sys_setuid16	30	29 common pause sys_pause
32	24 32 getuid - sys_getuid16	31	30 common utime sys_utime
33	25 32 stime - sys_stime32	32	33 common access sys_access
34	26 common ptrace sys_ptrace compat_sys_ptrace	33	34 common nice sys_nice
35	27 common alarm sys_alarm sys_alarm	34	36 common sync sys_sync
36	29 common pause sys_pause sys_pause	35	37 common kill sys_kill
37	30 common utime sys_utime sys_utime32	36	38 common rename sys_rename
38	33 common access sys_access sys_access	37	39 common mkdir sys_mkdir
39	34 common nice sys_nice sys_nice	38	40 common rmdir sys_rmdir
40	36 common sync sys_sync sys_sync	39	41 common dup sys_dup
41	37 common kill sys_kill sys_kill	40	42 common pipe sys_pipe
42	38 common rename sys_rename sys_rename	41	43 common times sys_times
43	39 common mkdir sys_mkdir sys_mkdir	42	45 common brk sys_brk
44	40 common rmdir sys_rmdir sys_rmdir	43	48 common signal sys_signal
45	41 common dup sys_dup sys_dup	44	51 common acct sys_acct
46	42 common pipe sys_pipe sys_pipe	45	52 common umount2 sys_umount
47	43 common times sys_times compat_sys_times	46	54 common ioctl sys_ioctl
48	45 common brk sys_brk sys_brk	47	55 common fcntl sys_fcntl
49	46 32 setgid - sys_setgid16	48	57 common setpgid sys_setpgid
50	47 32 getgid - sys_getgid16	49	60 common umask sys_umask
51	48 common signal sys_signal sys_signal	50	61 common chroot sys_chroot
52	49 32 geteuid - sys_geteuid16	51	62 common ustat sys_ustat
53	50 32 getegid - sys_getegid16	52	63 common dup2 sys_dup2
54	51 common acct sys_acct sys_acct	53	64 common getppid sys_getppid
55	52 common umount2 sys_umount sys_umount	54	65 common getpgrp sys_getpgrp
56	54 common ioctl sys_ioctl compat_sys_ioctl	55	66 common setsid sys_setsid
57	55 common fcntl sys_fcntl compat_sys_fcntl	56	67 common sigaction sys_sigaction
58	57 common setpgid sys_setpgid sys_setpgid	57	72 common sigsuspend sys_sigsuspend
59	60 common umask sys_umask sys_umask	58	73 common sigpending sys_sigpending
60	61 common chroot sys_chroot sys_chroot	59	74 common sethostname sys_sethostname
61	62 common ustat sys_ustat compat_sys_ustat	60	75 common setrlimit sys_setrlimit
62	63 common dup2 sys_dup2 sys_dup2	61	77 common getrusage sys_getrusage
63	64 common getppid sys_getppid sys_getppid	62	78 common gettimeofday sys_gettimeofday
64	65 common getpgrp sys_getpgrp sys_getpgrp	63	79 common settimeofday sys_settimeofday
65	66 common setsid sys_setsid sys_setsid	64	83 common symlink sys_symlink
66	67 common sigaction sys_sigaction compat_sys_sigaction	65	85 common readlink sys_readlink
67	70 32 setreuid - sys_setreuid16	66	86 common uselib sys_uselib
68	71 32 setregid - sys_setregid16	67	87 common swapon sys_swapon
69	72 common sigsuspend sys_sigsuspend sys_sigsuspend	68	88 common reboot sys_reboot
70	73 common sigpending sys_sigpending compat_sys_sigpending	69	89 common readdir sys_ni_syscall
71	74 common sethostname sys_sethostname sys_sethostname	70	90 common mmap sys_old_mmap
72	75 common setrlimit sys_setrlimit compat_sys_setrlimit	71	91 common munmap sys_munmap
73	76 32 getrlimit - compat_sys_old_getrlimit	72	92 common truncate sys_truncate
74	77 common getrusage sys_getrusage compat_sys_getrusage	73	93 common ftruncate sys_ftruncate
75	78 common gettimeofday sys_gettimeofday compat_sys_gettimeofday	74	94 common fchmod sys_fchmod
76	79 common settimeofday sys_settimeofday compat_sys_settimeofday	75	96 common getpriority sys_getpriority
77	80 32 getgroups - sys_getgroups16	76	97 common setpriority sys_setpriority
78	81 32 setgroups - sys_setgroups16	77	99 common statfs sys_statfs
79	83 common symlink sys_symlink sys_symlink	78	100 common fstatfs sys_fstatfs
80	85 common readlink sys_readlink sys_readlink	79	102 common socketcall sys_socketcall
81	86 common uselib sys_uselib sys_uselib	80	103 common syslog sys_syslog
82	87 common swapon sys_swapon sys_swapon	81	104 common setitimer sys_setitimer
83	88 common reboot sys_reboot sys_reboot	82	105 common getitimer sys_getitimer
84	89 common readdir - compat_sys_old_readdir	83	106 common stat sys_newstat
85	90 common mmap sys_old_mmap compat_sys_s390_old_mmap	84	107 common lstat sys_newlstat
86	91 common munmap sys_munmap sys_munmap	85	108 common fstat sys_newfstat
87	92 common truncate sys_truncate compat_sys_truncate	86	110 common lookup_dcookie sys_ni_syscall
88	93 common ftruncate sys_ftruncate compat_sys_ftruncate	87	111 common vhangup sys_vhangup
89	94 common fchmod sys_fchmod sys_fchmod	88	112 common idle sys_ni_syscall
90	95 32 fchown - sys_fchown16	89	114 common wait4 sys_wait4
91	96 common getpriority sys_getpriority sys_getpriority	90	115 common swapoff sys_swapoff
92	97 common setpriority sys_setpriority sys_setpriority	91	116 common sysinfo sys_sysinfo
93	99 common statfs sys_statfs compat_sys_statfs	92	117 common ipc sys_s390_ipc
94	100 common fstatfs sys_fstatfs compat_sys_fstatfs	93	118 common fsync sys_fsync
95	101 32 ioperm - -	94	119 common sigreturn sys_sigreturn
96	102 common socketcall sys_socketcall compat_sys_socketcall	95	120 common clone sys_clone
97	103 common syslog sys_syslog sys_syslog	96	121 common setdomainname sys_setdomainname
98	104 common setitimer sys_setitimer compat_sys_setitimer	97	122 common uname sys_newuname
99	105 common getitimer sys_getitimer compat_sys_getitimer	98	124 common adjtimex sys_adjtimex
100	106 common stat sys_newstat compat_sys_newstat	99	125 common mprotect sys_mprotect
101	107 common lstat sys_newlstat compat_sys_newlstat	100	126 common sigprocmask sys_sigprocmask
102	108 common fstat sys_newfstat compat_sys_newfstat	101	127 common create_module sys_ni_syscall
103	110 common lookup_dcookie - -	102	128 common init_module sys_init_module
104	111 common vhangup sys_vhangup sys_vhangup	103	129 common delete_module sys_delete_module
105	112 common idle - -	104	130 common get_kernel_syms sys_ni_syscall
106	114 common wait4 sys_wait4 compat_sys_wait4	105	131 common quotactl sys_quotactl
107	115 common swapoff sys_swapoff sys_swapoff	106	132 common getpgid sys_getpgid
108	116 common sysinfo sys_sysinfo compat_sys_sysinfo	107	133 common fchdir sys_fchdir
109	117 common ipc sys_s390_ipc compat_sys_s390_ipc	108	134 common bdflush sys_ni_syscall
110	118 common fsync sys_fsync sys_fsync	109	135 common sysfs sys_sysfs
111	119 common sigreturn sys_sigreturn compat_sys_sigreturn	110	136 common personality sys_s390_personality
112	120 common clone sys_clone sys_clone	111	137 common afs_syscall sys_ni_syscall
113	121 common setdomainname sys_setdomainname sys_setdomainname	112	141 common getdents sys_getdents
114	122 common uname sys_newuname sys_newuname	113	142 common select sys_select
115	124 common adjtimex sys_adjtimex sys_adjtimex_time32	114	143 common flock sys_flock
116	125 common mprotect sys_mprotect sys_mprotect	115	144 common msync sys_msync
117	126 common sigprocmask sys_sigprocmask compat_sys_sigprocmask	116	145 common readv sys_readv
118	127 common create_module - -	117	146 common writev sys_writev
119	128 common init_module sys_init_module sys_init_module	118	147 common getsid sys_getsid
120	129 common delete_module sys_delete_module sys_delete_module	119	148 common fdatasync sys_fdatasync
121	130 common get_kernel_syms - -	120	149 common _sysctl sys_ni_syscall
122	131 common quotactl sys_quotactl sys_quotactl	121	150 common mlock sys_mlock
123	132 common getpgid sys_getpgid sys_getpgid	122	151 common munlock sys_munlock
124	133 common fchdir sys_fchdir sys_fchdir	123	152 common mlockall sys_mlockall
125	134 common bdflush sys_ni_syscall sys_ni_syscall	124	153 common munlockall sys_munlockall
126	135 common sysfs sys_sysfs sys_sysfs	125	154 common sched_setparam sys_sched_setparam
127	136 common personality sys_s390_personality sys_s390_personality	126	155 common sched_getparam sys_sched_getparam
128	137 common afs_syscall - -	127	156 common sched_setscheduler sys_sched_setscheduler
129	138 32 setfsuid - sys_setfsuid16	128	157 common sched_getscheduler sys_sched_getscheduler
130	139 32 setfsgid - sys_setfsgid16	129	158 common sched_yield sys_sched_yield
131	140 32 _llseek - sys_llseek	130	159 common sched_get_priority_max sys_sched_get_priority_max
132	141 common getdents sys_getdents compat_sys_getdents	131	160 common sched_get_priority_min sys_sched_get_priority_min
133	142 32 _newselect - compat_sys_select	132	161 common sched_rr_get_interval sys_sched_rr_get_interval
134	142 64 select sys_select -	133	162 common nanosleep sys_nanosleep
135	143 common flock sys_flock sys_flock	134	163 common mremap sys_mremap
136	144 common msync sys_msync sys_msync	135	167 common query_module sys_ni_syscall
137	145 common readv sys_readv sys_readv	136	168 common poll sys_poll
138	146 common writev sys_writev sys_writev	137	169 common nfsservctl sys_ni_syscall
139	147 common getsid sys_getsid sys_getsid	138	172 common prctl sys_prctl
140	148 common fdatasync sys_fdatasync sys_fdatasync	139	173 common rt_sigreturn sys_rt_sigreturn
141	149 common _sysctl - -	140	174 common rt_sigaction sys_rt_sigaction
142	150 common mlock sys_mlock sys_mlock	141	175 common rt_sigprocmask sys_rt_sigprocmask
143	151 common munlock sys_munlock sys_munlock	142	176 common rt_sigpending sys_rt_sigpending
144	152 common mlockall sys_mlockall sys_mlockall	143	177 common rt_sigtimedwait sys_rt_sigtimedwait
145	153 common munlockall sys_munlockall sys_munlockall	144	178 common rt_sigqueueinfo sys_rt_sigqueueinfo
146	154 common sched_setparam sys_sched_setparam sys_sched_setparam	145	179 common rt_sigsuspend sys_rt_sigsuspend
147	155 common sched_getparam sys_sched_getparam sys_sched_getparam	146	180 common pread64 sys_pread64
148	156 common sched_setscheduler sys_sched_setscheduler sys_sched_setscheduler	147	181 common pwrite64 sys_pwrite64
149	157 common sched_getscheduler sys_sched_getscheduler sys_sched_getscheduler	148	183 common getcwd sys_getcwd
150	158 common sched_yield sys_sched_yield sys_sched_yield	149	184 common capget sys_capget
151	159 common sched_get_priority_max sys_sched_get_priority_max sys_sched_get_priority_max	150	185 common capset sys_capset
152	160 common sched_get_priority_min sys_sched_get_priority_min sys_sched_get_priority_min	151	186 common sigaltstack sys_sigaltstack
153	161 common sched_rr_get_interval sys_sched_rr_get_interval sys_sched_rr_get_interval_time32	152	187 common sendfile sys_sendfile64
154	162 common nanosleep sys_nanosleep sys_nanosleep_time32	153	188 common getpmsg sys_ni_syscall
155	163 common mremap sys_mremap sys_mremap	154	189 common putpmsg sys_ni_syscall
156	164 32 setresuid - sys_setresuid16	155	190 common vfork sys_vfork
157	165 32 getresuid - sys_getresuid16	156	191 common getrlimit sys_getrlimit
158	167 common query_module - -	157	198 common lchown sys_lchown
159	168 common poll sys_poll sys_poll	158	199 common getuid sys_getuid
160	169 common nfsservctl - -	159	200 common getgid sys_getgid
161	170 32 setresgid - sys_setresgid16	160	201 common geteuid sys_geteuid
162	171 32 getresgid - sys_getresgid16	161	202 common getegid sys_getegid
163	172 common prctl sys_prctl sys_prctl	162	203 common setreuid sys_setreuid
164	173 common rt_sigreturn sys_rt_sigreturn compat_sys_rt_sigreturn	163	204 common setregid sys_setregid
165	174 common rt_sigaction sys_rt_sigaction compat_sys_rt_sigaction	164	205 common getgroups sys_getgroups
166	175 common rt_sigprocmask sys_rt_sigprocmask compat_sys_rt_sigprocmask	165	206 common setgroups sys_setgroups
167	176 common rt_sigpending sys_rt_sigpending compat_sys_rt_sigpending	166	207 common fchown sys_fchown
168	177 common rt_sigtimedwait sys_rt_sigtimedwait compat_sys_rt_sigtimedwait_time32	167	208 common setresuid sys_setresuid
169	178 common rt_sigqueueinfo sys_rt_sigqueueinfo compat_sys_rt_sigqueueinfo	168	209 common getresuid sys_getresuid
170	179 common rt_sigsuspend sys_rt_sigsuspend compat_sys_rt_sigsuspend	169	210 common setresgid sys_setresgid
171	180 common pread64 sys_pread64 compat_sys_s390_pread64	170	211 common getresgid sys_getresgid
172	181 common pwrite64 sys_pwrite64 compat_sys_s390_pwrite64	171	212 common chown sys_chown
173	182 32 chown - sys_chown16	172	213 common setuid sys_setuid
174	183 common getcwd sys_getcwd sys_getcwd	173	214 common setgid sys_setgid
175	184 common capget sys_capget sys_capget	174	215 common setfsuid sys_setfsuid
176	185 common capset sys_capset sys_capset	175	216 common setfsgid sys_setfsgid
177	186 common sigaltstack sys_sigaltstack compat_sys_sigaltstack	176	217 common pivot_root sys_pivot_root
178	187 common sendfile sys_sendfile64 compat_sys_sendfile	177	218 common mincore sys_mincore
179	188 common getpmsg - -	178	219 common madvise sys_madvise
180	189 common putpmsg - -	179	220 common getdents64 sys_getdents64
181	190 common vfork sys_vfork sys_vfork	180	222 common readahead sys_readahead
182	191 32 ugetrlimit - compat_sys_getrlimit	181	224 common setxattr sys_setxattr
183	191 64 getrlimit sys_getrlimit -	182	225 common lsetxattr sys_lsetxattr
184	192 32 mmap2 - compat_sys_s390_mmap2	183	226 common fsetxattr sys_fsetxattr
185	193 32 truncate64 - compat_sys_s390_truncate64	184	227 common getxattr sys_getxattr
186	194 32 ftruncate64 - compat_sys_s390_ftruncate64	185	228 common lgetxattr sys_lgetxattr
187	195 32 stat64 - compat_sys_s390_stat64	186	229 common fgetxattr sys_fgetxattr
188	196 32 lstat64 - compat_sys_s390_lstat64	187	230 common listxattr sys_listxattr
189	197 32 fstat64 - compat_sys_s390_fstat64	188	231 common llistxattr sys_llistxattr
190	198 32 lchown32 - sys_lchown	189	232 common flistxattr sys_flistxattr
191	198 64 lchown sys_lchown -	190	233 common removexattr sys_removexattr
192	199 32 getuid32 - sys_getuid	191	234 common lremovexattr sys_lremovexattr
193	199 64 getuid sys_getuid -	192	235 common fremovexattr sys_fremovexattr
194	200 32 getgid32 - sys_getgid	193	236 common gettid sys_gettid
195	200 64 getgid sys_getgid -	194	237 common tkill sys_tkill
196	201 32 geteuid32 - sys_geteuid	195	238 common futex sys_futex
197	201 64 geteuid sys_geteuid -	196	239 common sched_setaffinity sys_sched_setaffinity
198	202 32 getegid32 - sys_getegid	197	240 common sched_getaffinity sys_sched_getaffinity
199	202 64 getegid sys_getegid -	198	241 common tgkill sys_tgkill
200	203 32 setreuid32 - sys_setreuid	199	243 common io_setup sys_io_setup
201	203 64 setreuid sys_setreuid -	200	244 common io_destroy sys_io_destroy
202	204 32 setregid32 - sys_setregid	201	245 common io_getevents sys_io_getevents
203	204 64 setregid sys_setregid -	202	246 common io_submit sys_io_submit
204	205 32 getgroups32 - sys_getgroups	203	247 common io_cancel sys_io_cancel
205	205 64 getgroups sys_getgroups -	204	248 common exit_group sys_exit_group
206	206 32 setgroups32 - sys_setgroups	205	249 common epoll_create sys_epoll_create
207	206 64 setgroups sys_setgroups -	206	250 common epoll_ctl sys_epoll_ctl
208	207 32 fchown32 - sys_fchown	207	251 common epoll_wait sys_epoll_wait
209	207 64 fchown sys_fchown -	208	252 common set_tid_address sys_set_tid_address
210	208 32 setresuid32 - sys_setresuid	209	253 common fadvise64 sys_fadvise64_64
211	208 64 setresuid sys_setresuid -	210	254 common timer_create sys_timer_create
212	209 32 getresuid32 - sys_getresuid	211	255 common timer_settime sys_timer_settime
213	209 64 getresuid sys_getresuid -	212	256 common timer_gettime sys_timer_gettime
214	210 32 setresgid32 - sys_setresgid	213	257 common timer_getoverrun sys_timer_getoverrun
215	210 64 setresgid sys_setresgid -	214	258 common timer_delete sys_timer_delete
216	211 32 getresgid32 - sys_getresgid	215	259 common clock_settime sys_clock_settime
217	211 64 getresgid sys_getresgid -	216	260 common clock_gettime sys_clock_gettime
218	212 32 chown32 - sys_chown	217	261 common clock_getres sys_clock_getres
219	212 64 chown sys_chown -	218	262 common clock_nanosleep sys_clock_nanosleep
220	213 32 setuid32 - sys_setuid	219	265 common statfs64 sys_statfs64
221	213 64 setuid sys_setuid -	220	266 common fstatfs64 sys_fstatfs64
222	214 32 setgid32 - sys_setgid	221	267 common remap_file_pages sys_remap_file_pages
223	214 64 setgid sys_setgid -	222	268 common mbind sys_mbind
224	215 32 setfsuid32 - sys_setfsuid	223	269 common get_mempolicy sys_get_mempolicy
225	215 64 setfsuid sys_setfsuid -	224	270 common set_mempolicy sys_set_mempolicy
226	216 32 setfsgid32 - sys_setfsgid	225	271 common mq_open sys_mq_open
227	216 64 setfsgid sys_setfsgid -	226	272 common mq_unlink sys_mq_unlink
228	217 common pivot_root sys_pivot_root sys_pivot_root	227	273 common mq_timedsend sys_mq_timedsend
229	218 common mincore sys_mincore sys_mincore	228	274 common mq_timedreceive sys_mq_timedreceive
230	219 common madvise sys_madvise sys_madvise	229	275 common mq_notify sys_mq_notify
231	220 common getdents64 sys_getdents64 sys_getdents64	230	276 common mq_getsetattr sys_mq_getsetattr
232	221 32 fcntl64 - compat_sys_fcntl64	231	277 common kexec_load sys_kexec_load
233	222 common readahead sys_readahead compat_sys_s390_readahead	232	278 common add_key sys_add_key
234	223 32 sendfile64 - compat_sys_sendfile64	233	279 common request_key sys_request_key
235	224 common setxattr sys_setxattr sys_setxattr	234	280 common keyctl sys_keyctl
236	225 common lsetxattr sys_lsetxattr sys_lsetxattr	235	281 common waitid sys_waitid
237	226 common fsetxattr sys_fsetxattr sys_fsetxattr	236	282 common ioprio_set sys_ioprio_set
238	227 common getxattr sys_getxattr sys_getxattr	237	283 common ioprio_get sys_ioprio_get
239	228 common lgetxattr sys_lgetxattr sys_lgetxattr	238	284 common inotify_init sys_inotify_init
240	229 common fgetxattr sys_fgetxattr sys_fgetxattr	239	285 common inotify_add_watch sys_inotify_add_watch
241	230 common listxattr sys_listxattr sys_listxattr	240	286 common inotify_rm_watch sys_inotify_rm_watch
242	231 common llistxattr sys_llistxattr sys_llistxattr	241	287 common migrate_pages sys_migrate_pages
243	232 common flistxattr sys_flistxattr sys_flistxattr	242	288 common openat sys_openat
244	233 common removexattr sys_removexattr sys_removexattr	243	289 common mkdirat sys_mkdirat
245	234 common lremovexattr sys_lremovexattr sys_lremovexattr	244	290 common mknodat sys_mknodat
246	235 common fremovexattr sys_fremovexattr sys_fremovexattr	245	291 common fchownat sys_fchownat
247	236 common gettid sys_gettid sys_gettid	246	292 common futimesat sys_futimesat
248	237 common tkill sys_tkill sys_tkill	247	293 common newfstatat sys_newfstatat
249	238 common futex sys_futex sys_futex_time32	248	294 common unlinkat sys_unlinkat
250	239 common sched_setaffinity sys_sched_setaffinity compat_sys_sched_setaffinity	249	295 common renameat sys_renameat
251	240 common sched_getaffinity sys_sched_getaffinity compat_sys_sched_getaffinity	250	296 common linkat sys_linkat
252	241 common tgkill sys_tgkill sys_tgkill	251	297 common symlinkat sys_symlinkat
253	243 common io_setup sys_io_setup compat_sys_io_setup	252	298 common readlinkat sys_readlinkat
254	244 common io_destroy sys_io_destroy sys_io_destroy	253	299 common fchmodat sys_fchmodat
255	245 common io_getevents sys_io_getevents sys_io_getevents_time32	254	300 common faccessat sys_faccessat
256	246 common io_submit sys_io_submit compat_sys_io_submit	255	301 common pselect6 sys_pselect6
257	247 common io_cancel sys_io_cancel sys_io_cancel	256	302 common ppoll sys_ppoll
258	248 common exit_group sys_exit_group sys_exit_group	257	303 common unshare sys_unshare
259	249 common epoll_create sys_epoll_create sys_epoll_create	258	304 common set_robust_list sys_set_robust_list
260	250 common epoll_ctl sys_epoll_ctl sys_epoll_ctl	259	305 common get_robust_list sys_get_robust_list
261	251 common epoll_wait sys_epoll_wait sys_epoll_wait	260	306 common splice sys_splice
262	252 common set_tid_address sys_set_tid_address sys_set_tid_address	261	307 common sync_file_range sys_sync_file_range
263	253 common fadvise64 sys_fadvise64_64 compat_sys_s390_fadvise64	262	308 common tee sys_tee
264	254 common timer_create sys_timer_create compat_sys_timer_create	263	309 common vmsplice sys_vmsplice
265	255 common timer_settime sys_timer_settime sys_timer_settime32	264	310 common move_pages sys_move_pages
266	256 common timer_gettime sys_timer_gettime sys_timer_gettime32	265	311 common getcpu sys_getcpu
267	257 common timer_getoverrun sys_timer_getoverrun sys_timer_getoverrun	266	312 common epoll_pwait sys_epoll_pwait
268	258 common timer_delete sys_timer_delete sys_timer_delete	267	313 common utimes sys_utimes
269	259 common clock_settime sys_clock_settime sys_clock_settime32	268	314 common fallocate sys_fallocate
270	260 common clock_gettime sys_clock_gettime sys_clock_gettime32	269	315 common utimensat sys_utimensat
271	261 common clock_getres sys_clock_getres sys_clock_getres_time32	270	316 common signalfd sys_signalfd
272	262 common clock_nanosleep sys_clock_nanosleep sys_clock_nanosleep_time32	271	317 common timerfd sys_ni_syscall
273	264 32 fadvise64_64 - compat_sys_s390_fadvise64_64	272	318 common eventfd sys_eventfd
274	265 common statfs64 sys_statfs64 compat_sys_statfs64	273	319 common timerfd_create sys_timerfd_create
275	266 common fstatfs64 sys_fstatfs64 compat_sys_fstatfs64	274	320 common timerfd_settime sys_timerfd_settime
276	267 common remap_file_pages sys_remap_file_pages sys_remap_file_pages	275	321 common timerfd_gettime sys_timerfd_gettime
277	268 common mbind sys_mbind sys_mbind	276	322 common signalfd4 sys_signalfd4
278	269 common get_mempolicy sys_get_mempolicy sys_get_mempolicy	277	323 common eventfd2 sys_eventfd2
279	270 common set_mempolicy sys_set_mempolicy sys_set_mempolicy	278	324 common inotify_init1 sys_inotify_init1
280	271 common mq_open sys_mq_open compat_sys_mq_open	279	325 common pipe2 sys_pipe2
281	272 common mq_unlink sys_mq_unlink sys_mq_unlink	280	326 common dup3 sys_dup3
282	273 common mq_timedsend sys_mq_timedsend sys_mq_timedsend_time32	281	327 common epoll_create1 sys_epoll_create1
283	274 common mq_timedreceive sys_mq_timedreceive sys_mq_timedreceive_time32	282	328 common preadv sys_preadv
284	275 common mq_notify sys_mq_notify compat_sys_mq_notify	283	329 common pwritev sys_pwritev
285	276 common mq_getsetattr sys_mq_getsetattr compat_sys_mq_getsetattr	284	330 common rt_tgsigqueueinfo sys_rt_tgsigqueueinfo
286	277 common kexec_load sys_kexec_load compat_sys_kexec_load	285	331 common perf_event_open sys_perf_event_open
287	278 common add_key sys_add_key sys_add_key	286	332 common fanotify_init sys_fanotify_init
288	279 common request_key sys_request_key sys_request_key	287	333 common fanotify_mark sys_fanotify_mark
289	280 common keyctl sys_keyctl compat_sys_keyctl	288	334 common prlimit64 sys_prlimit64
290	281 common waitid sys_waitid compat_sys_waitid	289	335 common name_to_handle_at sys_name_to_handle_at
291	282 common ioprio_set sys_ioprio_set sys_ioprio_set	290	336 common open_by_handle_at sys_open_by_handle_at
292	283 common ioprio_get sys_ioprio_get sys_ioprio_get	291	337 common clock_adjtime sys_clock_adjtime
293	284 common inotify_init sys_inotify_init sys_inotify_init	292	338 common syncfs sys_syncfs
294	285 common inotify_add_watch sys_inotify_add_watch sys_inotify_add_watch	293	339 common setns sys_setns
295	286 common inotify_rm_watch sys_inotify_rm_watch sys_inotify_rm_watch	294	340 common process_vm_readv sys_process_vm_readv
296	287 common migrate_pages sys_migrate_pages sys_migrate_pages	295	341 common process_vm_writev sys_process_vm_writev
297	288 common openat sys_openat compat_sys_openat	296	342 common s390_runtime_instr sys_s390_runtime_instr
298	289 common mkdirat sys_mkdirat sys_mkdirat	297	343 common kcmp sys_kcmp
299	290 common mknodat sys_mknodat sys_mknodat	298	344 common finit_module sys_finit_module
300	291 common fchownat sys_fchownat sys_fchownat	299	345 common sched_setattr sys_sched_setattr
301	292 common futimesat sys_futimesat sys_futimesat_time32	300	346 common sched_getattr sys_sched_getattr
302	293 32 fstatat64 - compat_sys_s390_fstatat64	301	347 common renameat2 sys_renameat2
303	293 64 newfstatat sys_newfstatat -	302	348 common seccomp sys_seccomp
304	294 common unlinkat sys_unlinkat sys_unlinkat	303	349 common getrandom sys_getrandom
305	295 common renameat sys_renameat sys_renameat	304	350 common memfd_create sys_memfd_create
306	296 common linkat sys_linkat sys_linkat	305	351 common bpf sys_bpf
307	297 common symlinkat sys_symlinkat sys_symlinkat	306	352 common s390_pci_mmio_write sys_s390_pci_mmio_write
308	298 common readlinkat sys_readlinkat sys_readlinkat	307	353 common s390_pci_mmio_read sys_s390_pci_mmio_read
309	299 common fchmodat sys_fchmodat sys_fchmodat	308	354 common execveat sys_execveat
310	300 common faccessat sys_faccessat sys_faccessat	309	355 common userfaultfd sys_userfaultfd
311	301 common pselect6 sys_pselect6 compat_sys_pselect6_time32	310	356 common membarrier sys_membarrier
312	302 common ppoll sys_ppoll compat_sys_ppoll_time32	311	357 common recvmmsg sys_recvmmsg
313	303 common unshare sys_unshare sys_unshare	312	358 common sendmmsg sys_sendmmsg
314	304 common set_robust_list sys_set_robust_list compat_sys_set_robust_list	313	359 common socket sys_socket
315	305 common get_robust_list sys_get_robust_list compat_sys_get_robust_list	314	360 common socketpair sys_socketpair
316	306 common splice sys_splice sys_splice	315	361 common bind sys_bind
317	307 common sync_file_range sys_sync_file_range compat_sys_s390_sync_file_range	316	362 common connect sys_connect
318	308 common tee sys_tee sys_tee	317	363 common listen sys_listen
319	309 common vmsplice sys_vmsplice sys_vmsplice	318	364 common accept4 sys_accept4
320	310 common move_pages sys_move_pages sys_move_pages	319	365 common getsockopt sys_getsockopt
321	311 common getcpu sys_getcpu sys_getcpu	320	366 common setsockopt sys_setsockopt
322	312 common epoll_pwait sys_epoll_pwait compat_sys_epoll_pwait	321	367 common getsockname sys_getsockname
323	313 common utimes sys_utimes sys_utimes_time32	322	368 common getpeername sys_getpeername
324	314 common fallocate sys_fallocate compat_sys_s390_fallocate	323	369 common sendto sys_sendto
325	315 common utimensat sys_utimensat sys_utimensat_time32	324	370 common sendmsg sys_sendmsg
326	316 common signalfd sys_signalfd compat_sys_signalfd	325	371 common recvfrom sys_recvfrom
327	317 common timerfd - -	326	372 common recvmsg sys_recvmsg
328	318 common eventfd sys_eventfd sys_eventfd	327	373 common shutdown sys_shutdown
329	319 common timerfd_create sys_timerfd_create sys_timerfd_create	328	374 common mlock2 sys_mlock2
330	320 common timerfd_settime sys_timerfd_settime sys_timerfd_settime32	329	375 common copy_file_range sys_copy_file_range
331	321 common timerfd_gettime sys_timerfd_gettime sys_timerfd_gettime32	330	376 common preadv2 sys_preadv2
332	322 common signalfd4 sys_signalfd4 compat_sys_signalfd4	331	377 common pwritev2 sys_pwritev2
333	323 common eventfd2 sys_eventfd2 sys_eventfd2	332	378 common s390_guarded_storage sys_s390_guarded_storage
334	324 common inotify_init1 sys_inotify_init1 sys_inotify_init1	333	379 common statx sys_statx
335	325 common pipe2 sys_pipe2 sys_pipe2	334	380 common s390_sthyi sys_s390_sthyi
336	326 common dup3 sys_dup3 sys_dup3	335	381 common kexec_file_load sys_kexec_file_load
337	327 common epoll_create1 sys_epoll_create1 sys_epoll_create1	336	382 common io_pgetevents sys_io_pgetevents
338	328 common preadv sys_preadv compat_sys_preadv	337	383 common rseq sys_rseq
339	329 common pwritev sys_pwritev compat_sys_pwritev	338	384 common pkey_mprotect sys_pkey_mprotect
340	330 common rt_tgsigqueueinfo sys_rt_tgsigqueueinfo compat_sys_rt_tgsigqueueinfo	339	385 common pkey_alloc sys_pkey_alloc
341	331 common perf_event_open sys_perf_event_open sys_perf_event_open	340	386 common pkey_free sys_pkey_free
342	332 common fanotify_init sys_fanotify_init sys_fanotify_init
343	333 common fanotify_mark sys_fanotify_mark compat_sys_fanotify_mark
344	334 common prlimit64 sys_prlimit64 sys_prlimit64
345	335 common name_to_handle_at sys_name_to_handle_at sys_name_to_handle_at
346	336 common open_by_handle_at sys_open_by_handle_at compat_sys_open_by_handle_at
347	337 common clock_adjtime sys_clock_adjtime sys_clock_adjtime32
348	338 common syncfs sys_syncfs sys_syncfs
349	339 common setns sys_setns sys_setns
350	340 common process_vm_readv sys_process_vm_readv sys_process_vm_readv
351	341 common process_vm_writev sys_process_vm_writev sys_process_vm_writev
352	342 common s390_runtime_instr sys_s390_runtime_instr sys_s390_runtime_instr
353	343 common kcmp sys_kcmp sys_kcmp
354	344 common finit_module sys_finit_module sys_finit_module
355	345 common sched_setattr sys_sched_setattr sys_sched_setattr
356	346 common sched_getattr sys_sched_getattr sys_sched_getattr
357	347 common renameat2 sys_renameat2 sys_renameat2
358	348 common seccomp sys_seccomp sys_seccomp
359	349 common getrandom sys_getrandom sys_getrandom
360	350 common memfd_create sys_memfd_create sys_memfd_create
361	351 common bpf sys_bpf sys_bpf
362	352 common s390_pci_mmio_write sys_s390_pci_mmio_write sys_s390_pci_mmio_write
363	353 common s390_pci_mmio_read sys_s390_pci_mmio_read sys_s390_pci_mmio_read
364	354 common execveat sys_execveat compat_sys_execveat
365	355 common userfaultfd sys_userfaultfd sys_userfaultfd
366	356 common membarrier sys_membarrier sys_membarrier
367	357 common recvmmsg sys_recvmmsg compat_sys_recvmmsg_time32
368	358 common sendmmsg sys_sendmmsg compat_sys_sendmmsg
369	359 common socket sys_socket sys_socket
370	360 common socketpair sys_socketpair sys_socketpair
371	361 common bind sys_bind sys_bind
372	362 common connect sys_connect sys_connect
373	363 common listen sys_listen sys_listen
374	364 common accept4 sys_accept4 sys_accept4
375	365 common getsockopt sys_getsockopt sys_getsockopt
376	366 common setsockopt sys_setsockopt sys_setsockopt
377	367 common getsockname sys_getsockname sys_getsockname
378	368 common getpeername sys_getpeername sys_getpeername
379	369 common sendto sys_sendto sys_sendto
380	370 common sendmsg sys_sendmsg compat_sys_sendmsg
381	371 common recvfrom sys_recvfrom compat_sys_recvfrom
382	372 common recvmsg sys_recvmsg compat_sys_recvmsg
383	373 common shutdown sys_shutdown sys_shutdown
384	374 common mlock2 sys_mlock2 sys_mlock2
385	375 common copy_file_range sys_copy_file_range sys_copy_file_range
386	376 common preadv2 sys_preadv2 compat_sys_preadv2
387	377 common pwritev2 sys_pwritev2 compat_sys_pwritev2
388	378 common s390_guarded_storage sys_s390_guarded_storage sys_s390_guarded_storage
389	379 common statx sys_statx sys_statx
390	380 common s390_sthyi sys_s390_sthyi sys_s390_sthyi
391	381 common kexec_file_load sys_kexec_file_load sys_kexec_file_load
392	382 common io_pgetevents sys_io_pgetevents compat_sys_io_pgetevents
393	383 common rseq sys_rseq sys_rseq
394	384 common pkey_mprotect sys_pkey_mprotect sys_pkey_mprotect
395	385 common pkey_alloc sys_pkey_alloc sys_pkey_alloc
396	386 common pkey_free sys_pkey_free sys_pkey_free
397	# room for arch specific syscalls	341	# room for arch specific syscalls
398	392 64 semtimedop sys_semtimedop -	342	392 common semtimedop sys_semtimedop
399	393 common semget sys_semget sys_semget	343	393 common semget sys_semget
400	394 common semctl sys_semctl compat_sys_semctl	344	394 common semctl sys_semctl
401	395 common shmget sys_shmget sys_shmget	345	395 common shmget sys_shmget
402	396 common shmctl sys_shmctl compat_sys_shmctl	346	396 common shmctl sys_shmctl
403	397 common shmat sys_shmat compat_sys_shmat	347	397 common shmat sys_shmat
404	398 common shmdt sys_shmdt sys_shmdt	348	398 common shmdt sys_shmdt
405	399 common msgget sys_msgget sys_msgget	349	399 common msgget sys_msgget
406	400 common msgsnd sys_msgsnd compat_sys_msgsnd	350	400 common msgsnd sys_msgsnd
407	401 common msgrcv sys_msgrcv compat_sys_msgrcv	351	401 common msgrcv sys_msgrcv
408	402 common msgctl sys_msgctl compat_sys_msgctl	352	402 common msgctl sys_msgctl
409	403 32 clock_gettime64 - sys_clock_gettime	353	424 common pidfd_send_signal sys_pidfd_send_signal
410	404 32 clock_settime64 - sys_clock_settime	354	425 common io_uring_setup sys_io_uring_setup
411	405 32 clock_adjtime64 - sys_clock_adjtime	355	426 common io_uring_enter sys_io_uring_enter
412	406 32 clock_getres_time64 - sys_clock_getres	356	427 common io_uring_register sys_io_uring_register
413	407 32 clock_nanosleep_time64 - sys_clock_nanosleep	357	428 common open_tree sys_open_tree
414	408 32 timer_gettime64 - sys_timer_gettime	358	429 common move_mount sys_move_mount
415	409 32 timer_settime64 - sys_timer_settime	359	430 common fsopen sys_fsopen
416	410 32 timerfd_gettime64 - sys_timerfd_gettime	360	431 common fsconfig sys_fsconfig
417	411 32 timerfd_settime64 - sys_timerfd_settime	361	432 common fsmount sys_fsmount
418	412 32 utimensat_time64 - sys_utimensat	362	433 common fspick sys_fspick
419	413 32 pselect6_time64 - compat_sys_pselect6_time64	363	434 common pidfd_open sys_pidfd_open
420	414 32 ppoll_time64 - compat_sys_ppoll_time64	364	435 common clone3 sys_clone3
421	416 32 io_pgetevents_time64 - compat_sys_io_pgetevents_time64	365	436 common close_range sys_close_range
422	417 32 recvmmsg_time64 - compat_sys_recvmmsg_time64	366	437 common openat2 sys_openat2
423	418 32 mq_timedsend_time64 - sys_mq_timedsend	367	438 common pidfd_getfd sys_pidfd_getfd
424	419 32 mq_timedreceive_time64 - sys_mq_timedreceive	368	439 common faccessat2 sys_faccessat2
425	420 32 semtimedop_time64 - sys_semtimedop	369	440 common process_madvise sys_process_madvise
426	421 32 rt_sigtimedwait_time64 - compat_sys_rt_sigtimedwait_time64	370	441 common epoll_pwait2 sys_epoll_pwait2
427	422 32 futex_time64 - sys_futex	371	442 common mount_setattr sys_mount_setattr
428	423 32 sched_rr_get_interval_time64 - sys_sched_rr_get_interval	372	443 common quotactl_fd sys_quotactl_fd
429	424 common pidfd_send_signal sys_pidfd_send_signal sys_pidfd_send_signal	373	444 common landlock_create_ruleset sys_landlock_create_ruleset
430	425 common io_uring_setup sys_io_uring_setup sys_io_uring_setup	374	445 common landlock_add_rule sys_landlock_add_rule
431	426 common io_uring_enter sys_io_uring_enter sys_io_uring_enter	375	446 common landlock_restrict_self sys_landlock_restrict_self
432	427 common io_uring_register sys_io_uring_register sys_io_uring_register	376	447 common memfd_secret sys_memfd_secret
433	428 common open_tree sys_open_tree sys_open_tree	377	448 common process_mrelease sys_process_mrelease
434	429 common move_mount sys_move_mount sys_move_mount	378	449 common futex_waitv sys_futex_waitv
435	430 common fsopen sys_fsopen sys_fsopen	379	450 common set_mempolicy_home_node sys_set_mempolicy_home_node
436	431 common fsconfig sys_fsconfig sys_fsconfig	380	451 common cachestat sys_cachestat
437	432 common fsmount sys_fsmount sys_fsmount	381	452 common fchmodat2 sys_fchmodat2
438	433 common fspick sys_fspick sys_fspick	382	453 common map_shadow_stack sys_map_shadow_stack
439	434 common pidfd_open sys_pidfd_open sys_pidfd_open	383	454 common futex_wake sys_futex_wake
440	435 common clone3 sys_clone3 sys_clone3	384	455 common futex_wait sys_futex_wait
441	436 common close_range sys_close_range sys_close_range	385	456 common futex_requeue sys_futex_requeue
442	437 common openat2 sys_openat2 sys_openat2	386	457 common statmount sys_statmount
443	438 common pidfd_getfd sys_pidfd_getfd sys_pidfd_getfd	387	458 common listmount sys_listmount
444	439 common faccessat2 sys_faccessat2 sys_faccessat2	388	459 common lsm_get_self_attr sys_lsm_get_self_attr
445	440 common process_madvise sys_process_madvise sys_process_madvise	389	460 common lsm_set_self_attr sys_lsm_set_self_attr
446	441 common epoll_pwait2 sys_epoll_pwait2 compat_sys_epoll_pwait2	390	461 common lsm_list_modules sys_lsm_list_modules
447	442 common mount_setattr sys_mount_setattr sys_mount_setattr	391	462 common mseal sys_mseal
448	443 common quotactl_fd sys_quotactl_fd sys_quotactl_fd	392	463 common setxattrat sys_setxattrat
449	444 common landlock_create_ruleset sys_landlock_create_ruleset sys_landlock_create_ruleset	393	464 common getxattrat sys_getxattrat
450	445 common landlock_add_rule sys_landlock_add_rule sys_landlock_add_rule	394	465 common listxattrat sys_listxattrat
451	446 common landlock_restrict_self sys_landlock_restrict_self sys_landlock_restrict_self	395	466 common removexattrat sys_removexattrat
452	447 common memfd_secret sys_memfd_secret sys_memfd_secret	396	467 common open_tree_attr sys_open_tree_attr
453	448 common process_mrelease sys_process_mrelease sys_process_mrelease	397	468 common file_getattr sys_file_getattr
454	449 common futex_waitv sys_futex_waitv sys_futex_waitv	398	469 common file_setattr sys_file_setattr
455	450 common set_mempolicy_home_node sys_set_mempolicy_home_node sys_set_mempolicy_home_node	399	470 common listns sys_listns
456	451 common cachestat sys_cachestat sys_cachestat	400	471 common rseq_slice_yield sys_rseq_slice_yield
457	452 common fchmodat2 sys_fchmodat2 sys_fchmodat2
458	453 common map_shadow_stack sys_map_shadow_stack sys_map_shadow_stack
459	454 common futex_wake sys_futex_wake sys_futex_wake
460	455 common futex_wait sys_futex_wait sys_futex_wait
461	456 common futex_requeue sys_futex_requeue sys_futex_requeue
462	457 common statmount sys_statmount sys_statmount
463	458 common listmount sys_listmount sys_listmount
464	459 common lsm_get_self_attr sys_lsm_get_self_attr sys_lsm_get_self_attr
465	460 common lsm_set_self_attr sys_lsm_set_self_attr sys_lsm_set_self_attr
466	461 common lsm_list_modules sys_lsm_list_modules sys_lsm_list_modules
467	462 common mseal sys_mseal sys_mseal
468	463 common setxattrat sys_setxattrat sys_setxattrat
469	464 common getxattrat sys_getxattrat sys_getxattrat
470	465 common listxattrat sys_listxattrat sys_listxattrat
471	466 common removexattrat sys_removexattrat sys_removexattrat
472	467 common open_tree_attr sys_open_tree_attr sys_open_tree_attr
473	468 common file_getattr sys_file_getattr sys_file_getattr
474	469 common file_setattr sys_file_setattr sys_file_setattr
475	470 common listns sys_listns sys_listns

tools/perf/arch/sh/entry/syscalls/syscall.tbl+1−0

@@ -474,3 +474,4 @@ · 473 unmodified lines
474	468 common file_getattr sys_file_getattr	474	468 common file_getattr sys_file_getattr
475	469 common file_setattr sys_file_setattr	475	469 common file_setattr sys_file_setattr
476	470 common listns sys_listns	476	470 common listns sys_listns
		477	471 common rseq_slice_yield sys_rseq_slice_yield

tools/perf/arch/sparc/entry/syscalls/syscall.tbl+2−1

 432	common	fsmount				sys_fsmount
 433	common	fspick				sys_fspick
 434	common	pidfd_open			sys_pidfd_open
-# 435 reserved for clone3
+435	common	clone3				__sys_clone3
 436	common	close_range			sys_close_range
 437	common	openat2			sys_openat2
 438	common	pidfd_getfd			sys_pidfd_getfd
 468	common	file_getattr			sys_file_getattr
 469	common	file_setattr			sys_file_setattr
 470	common	listns				sys_listns
+471	common	rseq_slice_yield		sys_rseq_slice_yield

tools/perf/arch/x86/entry/syscalls/syscall_32.tbl+1−0

@@ -476,3 +476,4 @@ · 475 unmodified lines
476	468 i386 file_getattr sys_file_getattr	476	468 i386 file_getattr sys_file_getattr
477	469 i386 file_setattr sys_file_setattr	477	469 i386 file_setattr sys_file_setattr
478	470 i386 listns sys_listns	478	470 i386 listns sys_listns
		479	471 i386 rseq_slice_yield sys_rseq_slice_yield

tools/perf/arch/x86/entry/syscalls/syscall_64.tbl+1−0

@@ -395,6 +395,7 @@ · 394 unmodified lines
395	468 common file_getattr sys_file_getattr	395	468 common file_getattr sys_file_getattr
396	469 common file_setattr sys_file_setattr	396	469 common file_setattr sys_file_setattr
397	470 common listns sys_listns	397	470 common listns sys_listns
		398	471 common rseq_slice_yield sys_rseq_slice_yield
398		399
399	#	400	#
400	# Due to a historical design error, certain syscalls are numbered differently	401	# Due to a historical design error, certain syscalls are numbered differently

tools/perf/arch/xtensa/entry/syscalls/syscall.tbl+1−0

@@ -441,3 +441,4 @@ · 440 unmodified lines
441	468 common file_getattr sys_file_getattr	441	468 common file_getattr sys_file_getattr
442	469 common file_setattr sys_file_setattr	442	469 common file_setattr sys_file_setattr
443	470 common listns sys_listns	443	470 common listns sys_listns
		444	471 common rseq_slice_yield sys_rseq_slice_yield

tools/perf/builtin-ftrace.c+7−2

 #include <poll.h>
 #include <ctype.h>
 #include <linux/capability.h>
+#include <linux/err.h>
 #include <linux/string.h>
 #include <sys/stat.h>
 	ftrace->graph_verbose = 0;
 	ftrace->profile_hash = hashmap__new(profile_hash, profile_equal, NULL);
-	if (ftrace->profile_hash == NULL)
+	if (IS_ERR(ftrace->profile_hash)) {
-		return -ENOMEM;
+		int err = PTR_ERR(ftrace->profile_hash);
+		ftrace->profile_hash = NULL;
+		return err;
+	}
 	return 0;
 }

tools/perf/pmu-events/Build+2−1

@@ -214,7 +214,8 @@ ifneq ($(strip $(ORPHAN_FILES)),) · 213 unmodified lines
214	quiet_cmd_rm = RM $^	214	quiet_cmd_rm = RM $^
215		215
216	prune_orphans: $(ORPHAN_FILES)	216	prune_orphans: $(ORPHAN_FILES)
217	$(Q)$(call echo-cmd,rm)rm -f $^	217	# The list of files can be long. Use xargs to prevent issues.
		218	$(Q)$(call echo-cmd,rm)echo "$^" \| xargs rm -f
218		219
219	JEVENTS_DEPS += prune_orphans	220	JEVENTS_DEPS += prune_orphans
220	endif	221	endif

tools/perf/trace/beauty/arch/x86/include/asm/irq_vectors.h+1−0

@@ -77,6 +77,7 @@ · 76 unmodified lines
77	*/	77	*/
78	#define IRQ_WORK_VECTOR 0xf6	78	#define IRQ_WORK_VECTOR 0xf6
79		79
		80	/* IRQ vector for PMIs when running a guest with a mediated PMU. */
80	#define PERF_GUEST_MEDIATED_PMI_VECTOR 0xf5	81	#define PERF_GUEST_MEDIATED_PMI_VECTOR 0xf5
81		82
82	#define DEFERRED_ERROR_VECTOR 0xf4	83	#define DEFERRED_ERROR_VECTOR 0xf4

tools/perf/trace/beauty/include/uapi/linux/fs.h+1−0

@@ -253,6 +253,7 @@ struct file_attr { · 252 unmodified lines
253	#define FS_XFLAG_FILESTREAM 0x00004000 /* use filestream allocator */	253	#define FS_XFLAG_FILESTREAM 0x00004000 /* use filestream allocator */
254	#define FS_XFLAG_DAX 0x00008000 /* use DAX for IO */	254	#define FS_XFLAG_DAX 0x00008000 /* use DAX for IO */
255	#define FS_XFLAG_COWEXTSIZE 0x00010000 /* CoW extent size allocator hint */	255	#define FS_XFLAG_COWEXTSIZE 0x00010000 /* CoW extent size allocator hint */
		256	#define FS_XFLAG_VERITY 0x00020000 /* fs-verity enabled */
256	#define FS_XFLAG_HASATTR 0x80000000 /* no DIFLAG for this */	257	#define FS_XFLAG_HASATTR 0x80000000 /* no DIFLAG for this */
257		258
258	/* the read-only stuff doesn't really belong here, but any other place is	259	/* the read-only stuff doesn't really belong here, but any other place is

tools/perf/trace/beauty/include/uapi/linux/mount.h+11−2

 /*
  * open_tree() flags.
  */
-#define OPEN_TREE_CLONE		1		/* Clone the target tree and attach the clone */
+#define OPEN_TREE_CLONE		(1 << 0)	/* Clone the target tree and attach the clone */
+#define OPEN_TREE_NAMESPACE	(1 << 1)	/* Clone the target tree into a new mount namespace */
 #define OPEN_TREE_CLOEXEC	O_CLOEXEC	/* Close the file on execve() */
 /*
  */
 struct mnt_id_req {
 	__u32 size;
-	__u32 mnt_ns_fd;
+	union {
+		__u32 mnt_ns_fd;
+		__u32 mnt_fd;
+	};
 	__u64 mnt_id;
 	__u64 param;
 	__u64 mnt_ns_id;
 #define LSMT_ROOT		0xffffffffffffffff	/* root mount */
 #define LISTMOUNT_REVERSE	(1 << 0) /* List later mounts first */
+/*
+ * @flag bits for statmount(2)
+ */
+#define STATMOUNT_BY_FD		0x00000001U	/* want mountinfo for given fd */
 #endif /* _UAPI_LINUX_MOUNT_H */

tools/perf/trace/beauty/include/uapi/linux/prctl.h+37−0

@@ -386,4 +386,41 @@ struct prctl_mm_map { · 385 unmodified lines
386	# define PR_FUTEX_HASH_SET_SLOTS 1	386	# define PR_FUTEX_HASH_SET_SLOTS 1
387	# define PR_FUTEX_HASH_GET_SLOTS 2	387	# define PR_FUTEX_HASH_GET_SLOTS 2
388		388
		389	/* RSEQ time slice extensions */
		390	#define PR_RSEQ_SLICE_EXTENSION 79
		391	# define PR_RSEQ_SLICE_EXTENSION_GET 1
		392	# define PR_RSEQ_SLICE_EXTENSION_SET 2
		393	/*
		394	* Bits for RSEQ_SLICE_EXTENSION_GET/SET
		395	* PR_RSEQ_SLICE_EXT_ENABLE: Enable
		396	*/
		397	# define PR_RSEQ_SLICE_EXT_ENABLE 0x01
		398
		399	/*
		400	* Get the current indirect branch tracking configuration for the current
		401	* thread, this will be the value configured via PR_SET_INDIR_BR_LP_STATUS.
		402	*/
		403	#define PR_GET_INDIR_BR_LP_STATUS 80
		404
		405	/*
		406	* Set the indirect branch tracking configuration. PR_INDIR_BR_LP_ENABLE will
		407	* enable cpu feature for user thread, to track all indirect branches and ensure
		408	* they land on arch defined landing pad instruction.
		409	* x86 - If enabled, an indirect branch must land on an ENDBRANCH instruction.
		410	* arch64 - If enabled, an indirect branch must land on a BTI instruction.
		411	* riscv - If enabled, an indirect branch must land on an lpad instruction.
		412	* PR_INDIR_BR_LP_DISABLE will disable feature for user thread and indirect
		413	* branches will no more be tracked by cpu to land on arch defined landing pad
		414	* instruction.
		415	*/
		416	#define PR_SET_INDIR_BR_LP_STATUS 81
		417	# define PR_INDIR_BR_LP_ENABLE (1UL << 0)
		418
		419	/*
		420	* Prevent further changes to the specified indirect branch tracking
		421	* configuration. All bits may be locked via this call, including
		422	* undefined bits.
		423	*/
		424	#define PR_LOCK_INDIR_BR_LP_STATUS 82
		425
389	#endif /* _LINUX_PRCTL_H */	426	#endif /* _LINUX_PRCTL_H */

tools/perf/util/annotate-arch/annotate-loongarch.c+1−1

@@ -93,7 +93,7 @@ static int loongarch_jump__parse(const struct arch arch, struct ins_operands o · 92 unmodified lines
93	start = map__unmap_ip(map, sym->start);	93	start = map__unmap_ip(map, sym->start);
94	end = map__unmap_ip(map, sym->end);	94	end = map__unmap_ip(map, sym->end);
95		95
96	ops->target.outside = target.addr < start \|\| target.addr > end;	96	ops->target.outside = target.addr < start \|\| target.addr >= end;
97		97
98	if (maps__find_ams(thread__maps(ms->thread), &target) == 0 &&	98	if (maps__find_ams(thread__maps(ms->thread), &target) == 0 &&
99	map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr)	99	map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr)

tools/perf/util/annotate.c+4−1

 #include "strbuf.h"
 #include <regex.h>
 #include <linux/bitops.h>
+#include <linux/err.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/zalloc.h>
 		return -1;
 	src->samples = hashmap__new(sym_hist_hash, sym_hist_equal, NULL);
-	if (src->samples == NULL)
+	if (IS_ERR(src->samples)) {
 		zfree(&src->histograms);
+		src->samples = NULL;
+	}
 	return src->histograms ? 0 : -1;
 }

tools/perf/util/cs-etm-decoder/cs-etm-decoder.c+1−1

@@ -549,7 +549,7 @@ cs_etm_decoder__set_tid(struct cs_etm_queue *etmq, · 548 unmodified lines
549	/*	549	/*
550	* Process the PE_CONTEXT packets if we have a valid contextID or VMID.	550	* Process the PE_CONTEXT packets if we have a valid contextID or VMID.
551	* If the kernel is running at EL2, the PID is traced in CONTEXTIDR_EL2	551	* If the kernel is running at EL2, the PID is traced in CONTEXTIDR_EL2
552	* as VMID, Bit ETM_OPT_CTXTID2 is set in this case.	552	* as VMID, Format attribute 'contextid2' is set in this case.
553	*/	553	*/
554	switch (cs_etm__get_pid_fmt(etmq)) {	554	switch (cs_etm__get_pid_fmt(etmq)) {
555	case CS_ETM_PIDFMT_CTXTID:	555	case CS_ETM_PIDFMT_CTXTID:

tools/perf/util/cs-etm.c+13−23

  *   CS_ETM_PIDFMT_CTXTID2: CONTEXTIDR_EL2 is traced.
  *   CS_ETM_PIDFMT_NONE: No context IDs
  *
- * It's possible that the two bits ETM_OPT_CTXTID and ETM_OPT_CTXTID2
+ * It's possible that the two format attributes 'contextid1' and 'contextid2'
  * are enabled at the same time when the session runs on an EL2 kernel.
  * This means the CONTEXTIDR_EL1 and CONTEXTIDR_EL2 both will be
  * recorded in the trace data, the tool will selectively use
 	if (metadata[CS_ETM_MAGIC] == __perf_cs_etmv3_magic) {
 		val = metadata[CS_ETM_ETMCR];
 		/* CONTEXTIDR is traced */
-		if (val & BIT(ETM_OPT_CTXTID))
+		if (val & ETMCR_CTXTID)
 			return CS_ETM_PIDFMT_CTXTID;
 	} else {
 		val = metadata[CS_ETMV4_TRCCONFIGR];
 		/* CONTEXTIDR_EL2 is traced */
-		if (val & (BIT(ETM4_CFG_BIT_VMID) | BIT(ETM4_CFG_BIT_VMID_OPT)))
+		if (val & (TRCCONFIGR_VMID | TRCCONFIGR_VMIDOPT))
 			return CS_ETM_PIDFMT_CTXTID2;
 		/* CONTEXTIDR_EL1 is traced */
-		else if (val & BIT(ETM4_CFG_BIT_CTXTID))
+		else if (val & TRCCONFIGR_CID)
 			return CS_ETM_PIDFMT_CTXTID;
 	}
 	return 0;
 }
-static int cs_etm__setup_timeless_decoding(struct cs_etm_auxtrace *etm)
+static void cs_etm__setup_timeless_decoding(struct cs_etm_auxtrace *etm)
 {
-	struct evsel *evsel;
+	/* Take first ETM as all options will be the same for all ETMs */
-	struct evlist *evlist = etm->session->evlist;
+	u64 *metadata = etm->metadata[0];
 	/* Override timeless mode with user input from --itrace=Z */
 	if (etm->synth_opts.timeless_decoding) {
 		etm->timeless_decoding = true;
-		return 0;
+		return;
 	}
-	/*
+	if (metadata[CS_ETM_MAGIC] == __perf_cs_etmv3_magic)
-	 * Find the cs_etm evsel and look at what its timestamp setting was
+		etm->timeless_decoding = !(metadata[CS_ETM_ETMCR] & ETMCR_TIMESTAMP_EN);
-	 */
+	else
-	evlist__for_each_entry(evlist, evsel)
+		etm->timeless_decoding = !(metadata[CS_ETMV4_TRCCONFIGR] & TRCCONFIGR_TS);
-		if (cs_etm__evsel_is_auxtrace(etm->session, evsel)) {
-			etm->timeless_decoding =
-				!(evsel->core.attr.config & BIT(ETM_OPT_TS));
-			return 0;
-		}
-	pr_err("CS ETM: Couldn't find ETM evsel\n");
-	return -EINVAL;
 }
 /*
 	etm->auxtrace.evsel_is_auxtrace = cs_etm__evsel_is_auxtrace;
 	session->auxtrace = &etm->auxtrace;
-	err = cs_etm__setup_timeless_decoding(etm);
+	cs_etm__setup_timeless_decoding(etm);
-	if (err)
-		return err;
 	etm->tc.time_shift = tc->time_shift;
 	etm->tc.time_mult = tc->time_mult;

tools/perf/util/cs-etm.h+15−0

@@ -230,6 +230,21 @@ struct cs_etm_packet_queue { · 229 unmodified lines
230	/* CoreSight trace ID is currently the bottom 7 bits of the value */	230	/* CoreSight trace ID is currently the bottom 7 bits of the value */
231	#define CORESIGHT_TRACE_ID_VAL_MASK GENMASK(6, 0)	231	#define CORESIGHT_TRACE_ID_VAL_MASK GENMASK(6, 0)
232		232
		233	/* ETMv4 CONFIGR register bits */
		234	#define TRCCONFIGR_BB BIT(3)
		235	#define TRCCONFIGR_CCI BIT(4)
		236	#define TRCCONFIGR_CID BIT(6)
		237	#define TRCCONFIGR_VMID BIT(7)
		238	#define TRCCONFIGR_TS BIT(11)
		239	#define TRCCONFIGR_RS BIT(12)
		240	#define TRCCONFIGR_VMIDOPT BIT(15)
		241
		242	/* ETMv3 ETMCR register bits */
		243	#define ETMCR_CYC_ACC BIT(12)
		244	#define ETMCR_CTXTID BIT(14)
		245	#define ETMCR_TIMESTAMP_EN BIT(28)
		246	#define ETMCR_RETURN_STACK BIT(29)
		247
233	int cs_etm__process_auxtrace_info(union perf_event *event,	248	int cs_etm__process_auxtrace_info(union perf_event *event,
234	struct perf_session *session);	249	struct perf_session *session);
235	void cs_etm_get_default_config(const struct perf_pmu pmu, struct perf_event_attr attr);	250	void cs_etm_get_default_config(const struct perf_pmu pmu, struct perf_event_attr attr);

tools/perf/util/disasm.c+1−1

@@ -384,7 +384,7 @@ static int jump__parse(const struct arch arch, struct ins_operands ops, struct · 383 unmodified lines
384	start = map__unmap_ip(map, sym->start);	384	start = map__unmap_ip(map, sym->start);
385	end = map__unmap_ip(map, sym->end);	385	end = map__unmap_ip(map, sym->end);
386		386
387	ops->target.outside = target.addr < start \|\| target.addr > end;	387	ops->target.outside = target.addr < start \|\| target.addr >= end;
388		388
389	/*	389	/*
390	* FIXME: things like this in _cpp_lex_token (gcc's cc1 program):	390	* FIXME: things like this in _cpp_lex_token (gcc's cc1 program):

tools/perf/util/synthetic-events.c+5−0

 		memcpy(event->mmap2.filename, dso__long_name(dso), dso__long_name_len(dso) + 1);
+		/* Clear stale build ID from previous module iteration */
+		event->mmap2.header.misc &= ~PERF_RECORD_MISC_MMAP_BUILD_ID;
+		memset(event->mmap2.build_id, 0, sizeof(event->mmap2.build_id));
+		event->mmap2.build_id_size = 0;
 		perf_record_mmap2__read_build_id(&event->mmap2, args->machine, false);
 	} else {
 		size = PERF_ALIGN(dso__long_name_len(dso) + 1, sizeof(u64));

tools/power/cpupower/cpupower-service.conf+5−0

@@ -30,3 +30,8 @@ · 29 unmodified lines
30	# its policy for the relative importance of performance versus energy savings to	30	# its policy for the relative importance of performance versus energy savings to
31	# the processor. See man CPUPOWER-SET(1) for additional details	31	# the processor. See man CPUPOWER-SET(1) for additional details
32	#PERF_BIAS=	32	#PERF_BIAS=
		33
		34	# Set the Energy Performance Preference
		35	# Available options can be read from
		36	# /sys/devices/system/cpu/cpufreq/policy0/energy_performance_available_preferences
		37	#EPP=

tools/power/cpupower/cpupower.sh+6−0

@@ -23,4 +23,10 @@ then · 22 unmodified lines
23	cpupower set -b "$PERF_BIAS" > /dev/null \|\| ESTATUS=1	23	cpupower set -b "$PERF_BIAS" > /dev/null \|\| ESTATUS=1
24	fi	24	fi
25		25
		26	# apply Energy Performance Preference
		27	if test -n "$EPP"
		28	then
		29	cpupower set -e "$EPP" > /dev/null \|\| ESTATUS=1
		30	fi
		31
26	exit $ESTATUS	32	exit $ESTATUS

tools/power/cpupower/utils/cpupower-set.c+5−1

 	}
 	if (params.turbo_boost) {
-		ret = cpupower_set_turbo_boost(turbo_boost);
+		if (cpupower_cpu_info.vendor == X86_VENDOR_INTEL)
+			ret = cpupower_set_intel_turbo_boost(turbo_boost);
+		else
+			ret = cpupower_set_generic_turbo_boost(turbo_boost);
 		if (ret)
 			fprintf(stderr, "Error setting turbo-boost\n");
 	}

tools/power/cpupower/utils/helpers/helpers.h+4−1

 /* cpuid and cpuinfo helpers  **************************/
 int cpufreq_has_generic_boost_support(bool *active);
-int cpupower_set_turbo_boost(int turbo_boost);
+int cpupower_set_generic_turbo_boost(int turbo_boost);
 /* X86 ONLY ****************************************/
 #if defined(__i386__) || defined(__x86_64__)
 int cpufreq_has_x86_boost_support(unsigned int cpu, int *support,
 				  int *active, int *states);
+int cpupower_set_intel_turbo_boost(int turbo_boost);
 /* AMD P-State stuff **************************/
 bool cpupower_amd_pstate_enabled(void);
 static inline int cpufreq_has_x86_boost_support(unsigned int cpu, int *support,
 						int *active, int *states)
 { return -1; }
+static inline int cpupower_set_intel_turbo_boost(int turbo_boost)
+{ return -1; }
 static inline bool cpupower_amd_pstate_enabled(void)
 { return false; }

tools/power/cpupower/utils/helpers/misc.c+39−2

@@ -19,6 +19,9 @@ int cpufreq_has_x86_boost_support(unsigned int cpu, int support, int active, · 18 unmodified lines
19	{	19	{
20	int ret;	20	int ret;
21	unsigned long long val;	21	unsigned long long val;
		22	char linebuf[MAX_LINE_LEN];
		23	char path[SYSFS_PATH_MAX];
		24	char *endp;
22		25
23	support = active = *states = 0;	26	support = active = *states = 0;
24		27
@@ -42,8 +45,42 @@ int cpufreq_has_x86_boost_support(unsigned int cpu, int support, int active, · 17 unmodified lines
42	}	45	}
43	} else if (cpupower_cpu_info.caps & CPUPOWER_CAP_AMD_PSTATE) {	46	} else if (cpupower_cpu_info.caps & CPUPOWER_CAP_AMD_PSTATE) {
44	amd_pstate_boost_init(cpu, support, active);	47	amd_pstate_boost_init(cpu, support, active);
45	} else if (cpupower_cpu_info.caps & CPUPOWER_CAP_INTEL_IDA)	48	} else if (cpupower_cpu_info.caps & CPUPOWER_CAP_INTEL_IDA) {
46	support = active = 1;	49	support = active = 1;
		50
		51	snprintf(path, sizeof(path), PATH_TO_CPU "intel_pstate/no_turbo");
		52
		53	if (!is_valid_path(path))
		54	return 0;
		55
		56	if (cpupower_read_sysfs(path, linebuf, MAX_LINE_LEN) == 0)
		57	return -1;
		58
		59	val = strtol(linebuf, &endp, 0);
		60	if (endp == linebuf \|\| errno == ERANGE)
		61	return -1;
		62
		63	*active = !val;
		64	}
		65	return 0;
		66	}
		67
		68	int cpupower_set_intel_turbo_boost(int turbo_boost)
		69	{
		70	char path[SYSFS_PATH_MAX];
		71	char linebuf[2] = {};
		72
		73	snprintf(path, sizeof(path), PATH_TO_CPU "intel_pstate/no_turbo");
		74
		75	/* Fallback to generic solution when intel_pstate driver not running */
		76	if (!is_valid_path(path))
		77	return cpupower_set_generic_turbo_boost(turbo_boost);
		78
		79	snprintf(linebuf, sizeof(linebuf), "%d", !turbo_boost);
		80
		81	if (cpupower_write_sysfs(path, linebuf, 2) <= 0)
		82	return -1;
		83
47	return 0;	84	return 0;
48	}	85	}
49		86
@@ -274,7 +311,7 @@ void print_speed(unsigned long speed, int no_rounding) · 224 unmodified lines
274	}	311	}
275	}	312	}
276		313
277	int cpupower_set_turbo_boost(int turbo_boost)	314	int cpupower_set_generic_turbo_boost(int turbo_boost)
278	{	315	{
279	char path[SYSFS_PATH_MAX];	316	char path[SYSFS_PATH_MAX];
280	char linebuf[2] = {};	317	char linebuf[2] = {};

tools/power/cpupower/utils/powercap-info.c+2−2

@@ -38,11 +38,11 @@ static int powercap_print_one_zone(struct powercap_zone *zone) · 37 unmodified lines
38	printf(" (%s)\n", mode ? "enabled" : "disabled");	38	printf(" (%s)\n", mode ? "enabled" : "disabled");
39		39
40	if (zone->has_power_uw)	40	if (zone->has_power_uw)
41	printf(_("%sPower can be monitored in micro Jules\n"),	41	printf(_("%sPower can be monitored in micro Watts\n"),
42	pr_prefix);	42	pr_prefix);
43		43
44	if (zone->has_energy_uj)	44	if (zone->has_energy_uj)
45	printf(_("%sPower can be monitored in micro Watts\n"),	45	printf(_("%sPower can be monitored in micro Jules\n"),
46	pr_prefix);	46	pr_prefix);
47		47
48	printf("\n");	48	printf("\n");

tools/scripts/syscall.tbl+1−0

@@ -411,3 +411,4 @@ · 410 unmodified lines
411	468 common file_getattr sys_file_getattr	411	468 common file_getattr sys_file_getattr
412	469 common file_setattr sys_file_setattr	412	469 common file_setattr sys_file_setattr
413	470 common listns sys_listns	413	470 common listns sys_listns
		414	471 common rseq_slice_yield sys_rseq_slice_yield

tools/testing/selftests/hid/progs/hid_bpf_helpers.h+12−0

 #define __HID_BPF_HELPERS_H
 /* "undefine" structs and enums in vmlinux.h, because we "override" them below */
+#define bpf_wq bpf_wq___not_used
 #define hid_bpf_ctx hid_bpf_ctx___not_used
 #define hid_bpf_ops hid_bpf_ops___not_used
+#define hid_device hid_device___not_used
 #define hid_report_type hid_report_type___not_used
 #define hid_class_request hid_class_request___not_used
 #define hid_bpf_attach_flags hid_bpf_attach_flags___not_used
 #include "vmlinux.h"
+#undef bpf_wq
 #undef hid_bpf_ctx
 #undef hid_bpf_ops
+#undef hid_device
 #undef hid_report_type
 #undef hid_class_request
 #undef hid_bpf_attach_flags
 	HID_REPORT_TYPES,
 };
+struct hid_device {
+	unsigned int id;
+} __attribute__((preserve_access_index));
+struct bpf_wq {
+	__u64 __opaque[2];
+};
 struct hid_bpf_ctx {
 	struct hid_device *hid;
 	__u32 allocated_size;

tools/testing/selftests/kvm/Makefile.kvm+1−0

@@ -71,6 +71,7 @@ TEST_GEN_PROGS_x86 += x86/cpuid_test · 70 unmodified lines
71	TEST_GEN_PROGS_x86 += x86/cr4_cpuid_sync_test	71	TEST_GEN_PROGS_x86 += x86/cr4_cpuid_sync_test
72	TEST_GEN_PROGS_x86 += x86/dirty_log_page_splitting_test	72	TEST_GEN_PROGS_x86 += x86/dirty_log_page_splitting_test
73	TEST_GEN_PROGS_x86 += x86/feature_msrs_test	73	TEST_GEN_PROGS_x86 += x86/feature_msrs_test
		74	TEST_GEN_PROGS_x86 += x86/evmcs_smm_controls_test
74	TEST_GEN_PROGS_x86 += x86/exit_on_emulation_failure_test	75	TEST_GEN_PROGS_x86 += x86/exit_on_emulation_failure_test
75	TEST_GEN_PROGS_x86 += x86/fastops_test	76	TEST_GEN_PROGS_x86 += x86/fastops_test
76	TEST_GEN_PROGS_x86 += x86/fix_hypercall_test	77	TEST_GEN_PROGS_x86 += x86/fix_hypercall_test

tools/testing/selftests/kvm/guest_memfd_test.c+1−1

@@ -80,7 +80,7 @@ static void test_mbind(int fd, size_t total_size) · 79 unmodified lines
80	{	80	{
81	const unsigned long nodemask_0 = 1; /* nid: 0 */	81	const unsigned long nodemask_0 = 1; /* nid: 0 */
82	unsigned long nodemask = 0;	82	unsigned long nodemask = 0;
83	unsigned long maxnode = 8;	83	unsigned long maxnode = BITS_PER_TYPE(nodemask);
84	int policy;	84	int policy;
85	char *mem;	85	char *mem;
86	int ret;	86	int ret;

tools/testing/selftests/kvm/include/x86/processor.h+23−0

@@ -557,6 +557,11 @@ static inline uint64_t get_cr0(void) · 556 unmodified lines
557	return cr0;	557	return cr0;
558	}	558	}
559		559
		560	static inline void set_cr0(uint64_t val)
		561	{
		562	__asm__ __volatile__("mov %0, %%cr0" : : "r" (val) : "memory");
		563	}
		564
560	static inline uint64_t get_cr3(void)	565	static inline uint64_t get_cr3(void)
561	{	566	{
562	uint64_t cr3;	567	uint64_t cr3;
@@ -566,6 +571,11 @@ static inline uint64_t get_cr3(void) · 3 unmodified lines
566	return cr3;	571	return cr3;
567	}	572	}
568		573
		574	static inline void set_cr3(uint64_t val)
		575	{
		576	__asm__ __volatile__("mov %0, %%cr3" : : "r" (val) : "memory");
		577	}
		578
569	static inline uint64_t get_cr4(void)	579	static inline uint64_t get_cr4(void)
570	{	580	{
571	uint64_t cr4;	581	uint64_t cr4;
@@ -580,6 +590,19 @@ static inline void set_cr4(uint64_t val) · 8 unmodified lines
580	__asm__ __volatile__("mov %0, %%cr4" : : "r" (val) : "memory");	590	__asm__ __volatile__("mov %0, %%cr4" : : "r" (val) : "memory");
581	}	591	}
582		592
		593	static inline uint64_t get_cr8(void)
		594	{
		595	uint64_t cr8;
		596
		597	__asm__ __volatile__("mov %%cr8, %[cr8]" : [cr8]"=r"(cr8));
		598	return cr8;
		599	}
		600
		601	static inline void set_cr8(uint64_t val)
		602	{
		603	__asm__ __volatile__("mov %0, %%cr8" : : "r" (val) : "memory");
		604	}
		605
583	static inline void set_idt(const struct desc_ptr *idt_desc)	606	static inline void set_idt(const struct desc_ptr *idt_desc)
584	{	607	{
585	__asm__ __volatile__("lidt %0"::"m"(*idt_desc));	608	__asm__ __volatile__("lidt %0"::"m"(*idt_desc));

tools/testing/selftests/kvm/include/x86/smm.h+17−0

@@ -0,0 +1,17 @@
	1	// SPDX-License-Identifier: GPL-2.0-only
	2	#ifndef SELFTEST_KVM_SMM_H
	3	#define SELFTEST_KVM_SMM_H
	4
	5	#include "kvm_util.h"
	6
	7	#define SMRAM_SIZE 65536
	8	#define SMRAM_MEMSLOT ((1 << 16) \| 1)
	9	#define SMRAM_PAGES (SMRAM_SIZE / PAGE_SIZE)
	10
	11	void setup_smram(struct kvm_vm vm, struct kvm_vcpu vcpu,
	12	uint64_t smram_gpa,
	13	const void *smi_handler, size_t handler_size);
	14
	15	void inject_smi(struct kvm_vcpu *vcpu);
	16
	17	#endif /* SELFTEST_KVM_SMM_H */

tools/testing/selftests/kvm/lib/x86/processor.c+26−0

@@ -8,6 +8,7 @@ · 7 unmodified lines
8	#include "kvm_util.h"	8	#include "kvm_util.h"
9	#include "pmu.h"	9	#include "pmu.h"
10	#include "processor.h"	10	#include "processor.h"
		11	#include "smm.h"
11	#include "svm_util.h"	12	#include "svm_util.h"
12	#include "sev.h"	13	#include "sev.h"
13	#include "vmx.h"	14	#include "vmx.h"
@@ -1444,3 +1445,28 @@ bool kvm_arch_has_default_irqchip(void) · 1430 unmodified lines
1444	{	1445	{
1445	return true;	1446	return true;
1446	}	1447	}
		1448
		1449	void setup_smram(struct kvm_vm vm, struct kvm_vcpu vcpu,
		1450	uint64_t smram_gpa,
		1451	const void *smi_handler, size_t handler_size)
		1452	{
		1453	vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS, smram_gpa,
		1454	SMRAM_MEMSLOT, SMRAM_PAGES, 0);
		1455	TEST_ASSERT(vm_phy_pages_alloc(vm, SMRAM_PAGES, smram_gpa,
		1456	SMRAM_MEMSLOT) == smram_gpa,
		1457	"Could not allocate guest physical addresses for SMRAM");
		1458
		1459	memset(addr_gpa2hva(vm, smram_gpa), 0x0, SMRAM_SIZE);
		1460	memcpy(addr_gpa2hva(vm, smram_gpa) + 0x8000, smi_handler, handler_size);
		1461	vcpu_set_msr(vcpu, MSR_IA32_SMBASE, smram_gpa);
		1462	}
		1463
		1464	void inject_smi(struct kvm_vcpu *vcpu)
		1465	{
		1466	struct kvm_vcpu_events events;
		1467
		1468	vcpu_events_get(vcpu, &events);
		1469	events.smi.pending = 1;
		1470	events.flags \|= KVM_VCPUEVENT_VALID_SMM;
		1471	vcpu_events_set(vcpu, &events);
		1472	}

tools/testing/selftests/kvm/x86/evmcs_smm_controls_test.c+150−0

@@ -0,0 +1,150 @@
	1	// SPDX-License-Identifier: GPL-2.0
	2	/*
	3	* Copyright (C) 2026, Red Hat, Inc.
	4	*
	5	* Test that vmx_leave_smm() validates vmcs12 controls before re-entering
	6	* nested guest mode on RSM.
	7	*/
	8	#include <fcntl.h>
	9	#include <stdio.h>
	10	#include <stdlib.h>
	11	#include <string.h>
	12	#include <sys/ioctl.h>
	13
	14	#include "test_util.h"
	15	#include "kvm_util.h"
	16	#include "smm.h"
	17	#include "hyperv.h"
	18	#include "vmx.h"
	19
	20	#define SMRAM_GPA 0x1000000
	21	#define SMRAM_STAGE 0xfe
	22
	23	#define SYNC_PORT 0xe
	24
	25	#define STR(x) #x
	26	#define XSTR(s) STR(s)
	27
	28	/*
	29	* SMI handler: runs in real-address mode.
	30	* Reports SMRAM_STAGE via port IO, then does RSM.
	31	*/
	32	static uint8_t smi_handler[] = {
	33	0xb0, SMRAM_STAGE, /* mov $SMRAM_STAGE, %al */
	34	0xe4, SYNC_PORT, /* in $SYNC_PORT, %al */
	35	0x0f, 0xaa, /* rsm */
	36	};
	37
	38	static inline void sync_with_host(uint64_t phase)
	39	{
	40	asm volatile("in $" XSTR(SYNC_PORT) ", %%al \n"
	41	: "+a" (phase));
	42	}
	43
	44	static void l2_guest_code(void)
	45	{
	46	sync_with_host(1);
	47
	48	/* After SMI+RSM with invalid controls, we should not reach here. */
	49	vmcall();
	50	}
	51
	52	static void guest_code(struct vmx_pages *vmx_pages,
	53	struct hyperv_test_pages *hv_pages)
	54	{
	55	#define L2_GUEST_STACK_SIZE 64
	56	unsigned long l2_guest_stack[L2_GUEST_STACK_SIZE];
	57
	58	/* Set up Hyper-V enlightenments and eVMCS */
	59	wrmsr(HV_X64_MSR_GUEST_OS_ID, HYPERV_LINUX_OS_ID);
	60	enable_vp_assist(hv_pages->vp_assist_gpa, hv_pages->vp_assist);
	61	evmcs_enable();
	62
	63	GUEST_ASSERT(prepare_for_vmx_operation(vmx_pages));
	64	GUEST_ASSERT(load_evmcs(hv_pages));
	65	prepare_vmcs(vmx_pages, l2_guest_code,
	66	&l2_guest_stack[L2_GUEST_STACK_SIZE]);
	67
	68	GUEST_ASSERT(!vmlaunch());
	69
	70	/* L2 exits via vmcall if test fails */
	71	sync_with_host(2);
	72	}
	73
	74	int main(int argc, char *argv[])
	75	{
	76	vm_vaddr_t vmx_pages_gva = 0, hv_pages_gva = 0;
	77	struct hyperv_test_pages *hv;
	78	struct hv_enlightened_vmcs *evmcs;
	79	struct kvm_vcpu *vcpu;
	80	struct kvm_vm *vm;
	81	struct kvm_regs regs;
	82	int stage_reported;
	83
	84	TEST_REQUIRE(kvm_cpu_has(X86_FEATURE_VMX));
	85	TEST_REQUIRE(kvm_has_cap(KVM_CAP_NESTED_STATE));
	86	TEST_REQUIRE(kvm_has_cap(KVM_CAP_HYPERV_ENLIGHTENED_VMCS));
	87	TEST_REQUIRE(kvm_has_cap(KVM_CAP_X86_SMM));
	88
	89	vm = vm_create_with_one_vcpu(&vcpu, guest_code);
	90
	91	setup_smram(vm, vcpu, SMRAM_GPA, smi_handler, sizeof(smi_handler));
	92
	93	vcpu_set_hv_cpuid(vcpu);
	94	vcpu_enable_evmcs(vcpu);
	95	vcpu_alloc_vmx(vm, &vmx_pages_gva);
	96	hv = vcpu_alloc_hyperv_test_pages(vm, &hv_pages_gva);
	97	vcpu_args_set(vcpu, 2, vmx_pages_gva, hv_pages_gva);
	98
	99	vcpu_run(vcpu);
	100
	101	/* L2 is running and syncs with host. */
	102	TEST_ASSERT_KVM_EXIT_REASON(vcpu, KVM_EXIT_IO);
	103	vcpu_regs_get(vcpu, &regs);
	104	stage_reported = regs.rax & 0xff;
	105	TEST_ASSERT(stage_reported == 1,
	106	"Expected stage 1, got %d", stage_reported);
	107
	108	/* Inject SMI while L2 is running. */
	109	inject_smi(vcpu);
	110	vcpu_run(vcpu);
	111	TEST_ASSERT_KVM_EXIT_REASON(vcpu, KVM_EXIT_IO);
	112	vcpu_regs_get(vcpu, &regs);
	113	stage_reported = regs.rax & 0xff;
	114	TEST_ASSERT(stage_reported == SMRAM_STAGE,
	115	"Expected SMM handler stage %#x, got %#x",
	116	SMRAM_STAGE, stage_reported);
	117
	118	/*
	119	* Guest is now paused in the SMI handler, about to execute RSM.
	120	* Hack the eVMCS page to set-up invalid pin-based execution
	121	* control (PIN_BASED_VIRTUAL_NMIS without PIN_BASED_NMI_EXITING).
	122	*/
	123	evmcs = hv->enlightened_vmcs_hva;
	124	evmcs->pin_based_vm_exec_control \|= PIN_BASED_VIRTUAL_NMIS;
	125	evmcs->hv_clean_fields = 0;
	126
	127	/*
	128	* Trigger copy_enlightened_to_vmcs12() via KVM_GET_NESTED_STATE,
	129	* copying the invalid pin_based_vm_exec_control into cached_vmcs12.
	130	*/
	131	union {
	132	struct kvm_nested_state state;
	133	char state_[16384];
	134	} nested_state_buf;
	135
	136	memset(&nested_state_buf, 0, sizeof(nested_state_buf));
	137	nested_state_buf.state.size = sizeof(nested_state_buf);
	138	vcpu_nested_state_get(vcpu, &nested_state_buf.state);
	139
	140	/*
	141	* Resume the guest. The SMI handler executes RSM, which calls
	142	* vmx_leave_smm(). nested_vmx_check_controls() should detect
	143	* VIRTUAL_NMIS without NMI_EXITING and cause a triple fault.
	144	*/
	145	vcpu_run(vcpu);
	146	TEST_ASSERT_KVM_EXIT_REASON(vcpu, KVM_EXIT_SHUTDOWN);
	147
	148	kvm_vm_free(vm);
	149	return 0;
	150	}

tools/testing/selftests/kvm/x86/sev_smoke_test.c+30−0

@@ -13,6 +13,30 @@ · 12 unmodified lines
13	#include "linux/psp-sev.h"	13	#include "linux/psp-sev.h"
14	#include "sev.h"	14	#include "sev.h"
15		15
		16	static void guest_sev_test_msr(uint32_t msr)
		17	{
		18	uint64_t val = rdmsr(msr);
		19
		20	wrmsr(msr, val);
		21	GUEST_ASSERT(val == rdmsr(msr));
		22	}
		23
		24	#define guest_sev_test_reg(reg) \
		25	do { \
		26	uint64_t val = get_##reg(); \
		27	\
		28	set_##reg(val); \
		29	GUEST_ASSERT(val == get_##reg()); \
		30	} while (0)
		31
		32	static void guest_sev_test_regs(void)
		33	{
		34	guest_sev_test_msr(MSR_EFER);
		35	guest_sev_test_reg(cr0);
		36	guest_sev_test_reg(cr3);
		37	guest_sev_test_reg(cr4);
		38	guest_sev_test_reg(cr8);
		39	}
16		40
17	#define XFEATURE_MASK_X87_AVX (XFEATURE_MASK_FP \| XFEATURE_MASK_SSE \| XFEATURE_MASK_YMM)	41	#define XFEATURE_MASK_X87_AVX (XFEATURE_MASK_FP \| XFEATURE_MASK_SSE \| XFEATURE_MASK_YMM)
18		42
@@ -24,6 +48,8 @@ static void guest_snp_code(void) · 5 unmodified lines
24	GUEST_ASSERT(sev_msr & MSR_AMD64_SEV_ES_ENABLED);	48	GUEST_ASSERT(sev_msr & MSR_AMD64_SEV_ES_ENABLED);
25	GUEST_ASSERT(sev_msr & MSR_AMD64_SEV_SNP_ENABLED);	49	GUEST_ASSERT(sev_msr & MSR_AMD64_SEV_SNP_ENABLED);
26		50
		51	guest_sev_test_regs();
		52
27	wrmsr(MSR_AMD64_SEV_ES_GHCB, GHCB_MSR_TERM_REQ);	53	wrmsr(MSR_AMD64_SEV_ES_GHCB, GHCB_MSR_TERM_REQ);
28	vmgexit();	54	vmgexit();
29	}	55	}
@@ -34,6 +60,8 @@ static void guest_sev_es_code(void) · 4 unmodified lines
34	GUEST_ASSERT(rdmsr(MSR_AMD64_SEV) & MSR_AMD64_SEV_ENABLED);	60	GUEST_ASSERT(rdmsr(MSR_AMD64_SEV) & MSR_AMD64_SEV_ENABLED);
35	GUEST_ASSERT(rdmsr(MSR_AMD64_SEV) & MSR_AMD64_SEV_ES_ENABLED);	61	GUEST_ASSERT(rdmsr(MSR_AMD64_SEV) & MSR_AMD64_SEV_ES_ENABLED);
36		62
		63	guest_sev_test_regs();
		64
37	/*	65	/*
38	* TODO: Add GHCB and ucall support for SEV-ES guests. For now, simply	66	* TODO: Add GHCB and ucall support for SEV-ES guests. For now, simply
39	* force "termination" to signal "done" via the GHCB MSR protocol.	67	* force "termination" to signal "done" via the GHCB MSR protocol.
@@ -47,6 +75,8 @@ static void guest_sev_code(void) · 7 unmodified lines
47	GUEST_ASSERT(this_cpu_has(X86_FEATURE_SEV));	75	GUEST_ASSERT(this_cpu_has(X86_FEATURE_SEV));
48	GUEST_ASSERT(rdmsr(MSR_AMD64_SEV) & MSR_AMD64_SEV_ENABLED);	76	GUEST_ASSERT(rdmsr(MSR_AMD64_SEV) & MSR_AMD64_SEV_ENABLED);
49		77
		78	guest_sev_test_regs();
		79
50	GUEST_DONE();	80	GUEST_DONE();
51	}	81	}
52		82

tools/testing/selftests/kvm/x86/smm_test.c+2−25

 #include "test_util.h"
 #include "kvm_util.h"
+#include "smm.h"
 #include "vmx.h"
 #include "svm_util.h"
-#define SMRAM_SIZE 65536
-#define SMRAM_MEMSLOT ((1 << 16) | 1)
-#define SMRAM_PAGES (SMRAM_SIZE / PAGE_SIZE)
 #define SMRAM_GPA 0x1000000
 #define SMRAM_STAGE 0xfe
 	sync_with_host(DONE);
 }
-void inject_smi(struct kvm_vcpu *vcpu)
-{
-	struct kvm_vcpu_events events;
-	vcpu_events_get(vcpu, &events);
-	events.smi.pending = 1;
-	events.flags |= KVM_VCPUEVENT_VALID_SMM;
-	vcpu_events_set(vcpu, &events);
-}
 int main(int argc, char *argv[])
 {
 	vm_vaddr_t nested_gva = 0;
 	/* Create VM */
 	vm = vm_create_with_one_vcpu(&vcpu, guest_code);
-	vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS, SMRAM_GPA,
+	setup_smram(vm, vcpu, SMRAM_GPA, smi_handler, sizeof(smi_handler));
-				    SMRAM_MEMSLOT, SMRAM_PAGES, 0);
-	TEST_ASSERT(vm_phy_pages_alloc(vm, SMRAM_PAGES, SMRAM_GPA, SMRAM_MEMSLOT)
-		    == SMRAM_GPA, "could not allocate guest physical addresses?");
-	memset(addr_gpa2hva(vm, SMRAM_GPA), 0x0, SMRAM_SIZE);
-	memcpy(addr_gpa2hva(vm, SMRAM_GPA) + 0x8000, smi_handler,
-	       sizeof(smi_handler));
-	vcpu_set_msr(vcpu, MSR_IA32_SMBASE, SMRAM_GPA);
 	if (kvm_has_cap(KVM_CAP_NESTED_STATE)) {
 		if (kvm_cpu_has(X86_FEATURE_SVM))

tools/testing/selftests/powerpc/copyloops/.gitignore+2−2

@@ -2,8 +2,8 @@ · 1 unmodified line
2	copyuser_64_t0	2	copyuser_64_t0
3	copyuser_64_t1	3	copyuser_64_t1
4	copyuser_64_t2	4	copyuser_64_t2
5	copyuser_p7_t0	5	copyuser_p7
6	copyuser_p7_t1	6	copyuser_p7_vmx
7	memcpy_64_t0	7	memcpy_64_t0
8	memcpy_64_t1	8	memcpy_64_t1
9	memcpy_64_t2	9	memcpy_64_t2

tools/testing/selftests/powerpc/copyloops/Makefile+8−3

 # SPDX-License-Identifier: GPL-2.0
 TEST_GEN_PROGS := copyuser_64_t0 copyuser_64_t1 copyuser_64_t2 \
-		copyuser_p7_t0 copyuser_p7_t1 \
+		copyuser_p7 copyuser_p7_vmx \
 		memcpy_64_t0 memcpy_64_t1 memcpy_64_t2 \
 		memcpy_p7_t0 memcpy_p7_t1 copy_mc_64 \
 		copyuser_64_exc_t0 copyuser_64_exc_t1 copyuser_64_exc_t2 \
 		-D SELFTEST_CASE=$(subst copyuser_64_t,,$(notdir $@)) \
 		-o $@ $^
-$(OUTPUT)/copyuser_p7_t%:	copyuser_power7.S $(EXTRA_SOURCES)
+$(OUTPUT)/copyuser_p7:	copyuser_power7.S $(EXTRA_SOURCES)
 	$(CC) $(CPPFLAGS) $(CFLAGS) \
 		-D COPY_LOOP=test___copy_tofrom_user_power7 \
-		-D SELFTEST_CASE=$(subst copyuser_p7_t,,$(notdir $@)) \
+		-o $@ $^
+$(OUTPUT)/copyuser_p7_vmx:       copyuser_power7.S $(EXTRA_SOURCES) ../utils.c
+	$(CC) $(CPPFLAGS) $(CFLAGS) \
+		-D COPY_LOOP=test___copy_tofrom_user_power7_vmx \
+		-D VMX_TEST \
 		-o $@ $^
 # Strictly speaking, we only need the memcpy_64 test cases for big-endian

tools/testing/selftests/powerpc/copyloops/stubs.S+0−8

@@ -1,13 +1,5 @@
1	#include <asm/ppc_asm.h>	1	#include <asm/ppc_asm.h>
2		2
3	FUNC_START(enter_vmx_usercopy)
4	li r3,1
5	blr
6
7	FUNC_START(exit_vmx_usercopy)
8	li r3,0
9	blr
10
11	FUNC_START(enter_vmx_ops)	3	FUNC_START(enter_vmx_ops)
12	li r3,1	4	li r3,1
13	blr	5	blr

tools/testing/selftests/powerpc/copyloops/validate.c+14−1

@@ -12,6 +12,10 @@ · 11 unmodified lines
12	#define BUFLEN (MAX_LEN+MAX_OFFSET+2*MIN_REDZONE)	12	#define BUFLEN (MAX_LEN+MAX_OFFSET+2*MIN_REDZONE)
13	#define POISON 0xa5	13	#define POISON 0xa5
14		14
		15	#ifdef VMX_TEST
		16	#define VMX_COPY_THRESHOLD 3328
		17	#endif
		18
15	unsigned long COPY_LOOP(void to, const void from, unsigned long size);	19	unsigned long COPY_LOOP(void to, const void from, unsigned long size);
16		20
17	static void do_one(char src, char dst, unsigned long src_off,	21	static void do_one(char src, char dst, unsigned long src_off,
@@ -81,8 +85,12 @@ int test_copy_loop(void) · 63 unmodified lines
81	/* Fill with sequential bytes */	85	/* Fill with sequential bytes */
82	for (i = 0; i < BUFLEN; i++)	86	for (i = 0; i < BUFLEN; i++)
83	fill[i] = i & 0xff;	87	fill[i] = i & 0xff;
84		88	#ifdef VMX_TEST
		89	/* Force sizes above kernel VMX threshold (3328) */
		90	for (len = VMX_COPY_THRESHOLD + 1; len < MAX_LEN; len++) {
		91	#else
85	for (len = 1; len < MAX_LEN; len++) {	92	for (len = 1; len < MAX_LEN; len++) {
		93	#endif
86	for (src_off = 0; src_off < MAX_OFFSET; src_off++) {	94	for (src_off = 0; src_off < MAX_OFFSET; src_off++) {
87	for (dst_off = 0; dst_off < MAX_OFFSET; dst_off++) {	95	for (dst_off = 0; dst_off < MAX_OFFSET; dst_off++) {
88	do_one(src, dst, src_off, dst_off, len,	96	do_one(src, dst, src_off, dst_off, len,
@@ -96,5 +104,10 @@ int test_copy_loop(void) · 7 unmodified lines
96		104
97	int main(void)	105	int main(void)
98	{	106	{
		107	#ifdef VMX_TEST
		108	/* Skip if Altivec not present */
		109	SKIP_IF_MSG(!have_hwcap(PPC_FEATURE_HAS_ALTIVEC), "ALTIVEC not supported");
		110	#endif
		111
99	return test_harness(test_copy_loop, str(COPY_LOOP));	112	return test_harness(test_copy_loop, str(COPY_LOOP));
100	}	113	}

tools/testing/selftests/sched_ext/util.c+2−2

@@ -60,11 +60,11 @@ int file_write_long(const char *path, long val) · 59 unmodified lines
60	char buf[64];	60	char buf[64];
61	int ret;	61	int ret;
62		62
63	ret = sprintf(buf, "%lu", val);	63	ret = sprintf(buf, "%ld", val);
64	if (ret < 0)	64	if (ret < 0)
65	return ret;	65	return ret;
66		66
67	if (write_text(path, buf, sizeof(buf)) <= 0)	67	if (write_text(path, buf, ret) <= 0)
68	return -1;	68	return -1;
69		69
70	return 0;	70	return 0;

virt/kvm/binary_stats.c+1−1

@@ -50,7 +50,7 @@ · 49 unmodified lines
50	* Return: the number of bytes that has been successfully read	50	* Return: the number of bytes that has been successfully read
51	*/	51	*/
52	ssize_t kvm_stats_read(char id, const struct kvm_stats_header header,	52	ssize_t kvm_stats_read(char id, const struct kvm_stats_header header,
53	const struct _kvm_stats_desc *desc,	53	const struct kvm_stats_desc *desc,
54	void *stats, size_t size_stats,	54	void *stats, size_t size_stats,
55	char __user user_buffer, size_t size, loff_t offset)	55	char __user user_buffer, size_t size, loff_t offset)
56	{	56	{

virt/kvm/kvm_main.c+10−10

@@ -973,9 +973,9 @@ static void kvm_free_memslots(struct kvm kvm, struct kvm_memslots slots) · 972 unmodified lines
973	kvm_free_memslot(kvm, memslot);	973	kvm_free_memslot(kvm, memslot);
974	}	974	}
975		975
976	static umode_t kvm_stats_debugfs_mode(const struct _kvm_stats_desc *pdesc)	976	static umode_t kvm_stats_debugfs_mode(const struct kvm_stats_desc *desc)
977	{	977	{
978	switch (pdesc->desc.flags & KVM_STATS_TYPE_MASK) {	978	switch (desc->flags & KVM_STATS_TYPE_MASK) {
979	case KVM_STATS_TYPE_INSTANT:	979	case KVM_STATS_TYPE_INSTANT:
980	return 0444;	980	return 0444;
981	case KVM_STATS_TYPE_CUMULATIVE:	981	case KVM_STATS_TYPE_CUMULATIVE:
@@ -1010,7 +1010,7 @@ static int kvm_create_vm_debugfs(struct kvm kvm, const char fdname) · 28 unmodified lines
1010	struct dentry *dent;	1010	struct dentry *dent;
1011	char dir_name[ITOA_MAX_LEN * 2];	1011	char dir_name[ITOA_MAX_LEN * 2];
1012	struct kvm_stat_data *stat_data;	1012	struct kvm_stat_data *stat_data;
1013	const struct _kvm_stats_desc *pdesc;	1013	const struct kvm_stats_desc *pdesc;
1014	int i, ret = -ENOMEM;	1014	int i, ret = -ENOMEM;
1015	int kvm_debugfs_num_entries = kvm_vm_stats_header.num_desc +	1015	int kvm_debugfs_num_entries = kvm_vm_stats_header.num_desc +
1016	kvm_vcpu_stats_header.num_desc;	1016	kvm_vcpu_stats_header.num_desc;
@@ -6171,11 +6171,11 @@ static int kvm_stat_data_get(void data, u64 val) · 5154 unmodified lines
6171	switch (stat_data->kind) {	6171	switch (stat_data->kind) {
6172	case KVM_STAT_VM:	6172	case KVM_STAT_VM:
6173	r = kvm_get_stat_per_vm(stat_data->kvm,	6173	r = kvm_get_stat_per_vm(stat_data->kvm,
6174	stat_data->desc->desc.offset, val);	6174	stat_data->desc->offset, val);
6175	break;	6175	break;
6176	case KVM_STAT_VCPU:	6176	case KVM_STAT_VCPU:
6177	r = kvm_get_stat_per_vcpu(stat_data->kvm,	6177	r = kvm_get_stat_per_vcpu(stat_data->kvm,
6178	stat_data->desc->desc.offset, val);	6178	stat_data->desc->offset, val);
6179	break;	6179	break;
6180	}	6180	}
6181		6181
@@ -6193,11 +6193,11 @@ static int kvm_stat_data_clear(void *data, u64 val) · 11 unmodified lines
6193	switch (stat_data->kind) {	6193	switch (stat_data->kind) {
6194	case KVM_STAT_VM:	6194	case KVM_STAT_VM:
6195	r = kvm_clear_stat_per_vm(stat_data->kvm,	6195	r = kvm_clear_stat_per_vm(stat_data->kvm,
6196	stat_data->desc->desc.offset);	6196	stat_data->desc->offset);
6197	break;	6197	break;
6198	case KVM_STAT_VCPU:	6198	case KVM_STAT_VCPU:
6199	r = kvm_clear_stat_per_vcpu(stat_data->kvm,	6199	r = kvm_clear_stat_per_vcpu(stat_data->kvm,
6200	stat_data->desc->desc.offset);	6200	stat_data->desc->offset);
6201	break;	6201	break;
6202	}	6202	}
6203		6203
@@ -6345,7 +6345,7 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm) · 141 unmodified lines
6345	static void kvm_init_debug(void)	6345	static void kvm_init_debug(void)
6346	{	6346	{
6347	const struct file_operations *fops;	6347	const struct file_operations *fops;
6348	const struct _kvm_stats_desc *pdesc;	6348	const struct kvm_stats_desc *pdesc;
6349	int i;	6349	int i;
6350		6350
6351	kvm_debugfs_dir = debugfs_create_dir("kvm", NULL);	6351	kvm_debugfs_dir = debugfs_create_dir("kvm", NULL);
@@ -6358,7 +6358,7 @@ static void kvm_init_debug(void) · 6 unmodified lines
6358	fops = &vm_stat_readonly_fops;	6358	fops = &vm_stat_readonly_fops;
6359	debugfs_create_file(pdesc->name, kvm_stats_debugfs_mode(pdesc),	6359	debugfs_create_file(pdesc->name, kvm_stats_debugfs_mode(pdesc),
6360	kvm_debugfs_dir,	6360	kvm_debugfs_dir,
6361	(void *)(long)pdesc->desc.offset, fops);	6361	(void *)(long)pdesc->offset, fops);
6362	}	6362	}
6363		6363
6364	for (i = 0; i < kvm_vcpu_stats_header.num_desc; ++i) {	6364	for (i = 0; i < kvm_vcpu_stats_header.num_desc; ++i) {
@@ -6369,7 +6369,7 @@ static void kvm_init_debug(void) · 4 unmodified lines
6369	fops = &vcpu_stat_readonly_fops;	6369	fops = &vcpu_stat_readonly_fops;
6370	debugfs_create_file(pdesc->name, kvm_stats_debugfs_mode(pdesc),	6370	debugfs_create_file(pdesc->name, kvm_stats_debugfs_mode(pdesc),
6371	kvm_debugfs_dir,	6371	kvm_debugfs_dir,
6372	(void *)(long)pdesc->desc.offset, fops);	6372	(void *)(long)pdesc->offset, fops);
6373	}	6373	}
6374	}	6374	}
6375		6375

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code

@@ -8435,115 +8435,123 @@ KVM_CHECK_EXTENSION. · 8434 unmodified lines
8435		8435
8436	The valid bits in cap.args[0] are:	8436	The valid bits in cap.args[0] are:
8437		8437
8438	=================================== ============================================	8438	======================================== ================================================
8439	KVM_X86_QUIRK_LINT0_REENABLED By default, the reset value for the LVT	8439	KVM_X86_QUIRK_LINT0_REENABLED By default, the reset value for the LVT
8440	LINT0 register is 0x700 (APIC_MODE_EXTINT).	8440	LINT0 register is 0x700 (APIC_MODE_EXTINT).
8441	When this quirk is disabled, the reset value	8441	When this quirk is disabled, the reset value
8442	is 0x10000 (APIC_LVT_MASKED).	8442	is 0x10000 (APIC_LVT_MASKED).
8443		8443
8444	KVM_X86_QUIRK_CD_NW_CLEARED By default, KVM clears CR0.CD and CR0.NW on	8444	KVM_X86_QUIRK_CD_NW_CLEARED By default, KVM clears CR0.CD and CR0.NW on
8445	AMD CPUs to workaround buggy guest firmware	8445	AMD CPUs to workaround buggy guest firmware
8446	that runs in perpetuity with CR0.CD, i.e.	8446	that runs in perpetuity with CR0.CD, i.e.
8447	with caches in "no fill" mode.	8447	with caches in "no fill" mode.
8448		8448
8449	When this quirk is disabled, KVM does not	8449	When this quirk is disabled, KVM does not
8450	change the value of CR0.CD and CR0.NW.	8450	change the value of CR0.CD and CR0.NW.
8451		8451
8452	KVM_X86_QUIRK_LAPIC_MMIO_HOLE By default, the MMIO LAPIC interface is	8452	KVM_X86_QUIRK_LAPIC_MMIO_HOLE By default, the MMIO LAPIC interface is
8453	available even when configured for x2APIC	8453	available even when configured for x2APIC
8454	mode. When this quirk is disabled, KVM	8454	mode. When this quirk is disabled, KVM
8455	disables the MMIO LAPIC interface if the	8455	disables the MMIO LAPIC interface if the
8456	LAPIC is in x2APIC mode.	8456	LAPIC is in x2APIC mode.
8457		8457
8458	KVM_X86_QUIRK_OUT_7E_INC_RIP By default, KVM pre-increments %rip before	8458	KVM_X86_QUIRK_OUT_7E_INC_RIP By default, KVM pre-increments %rip before
8459	exiting to userspace for an OUT instruction	8459	exiting to userspace for an OUT instruction
8460	to port 0x7e. When this quirk is disabled,	8460	to port 0x7e. When this quirk is disabled,
8461	KVM does not pre-increment %rip before	8461	KVM does not pre-increment %rip before
8462	exiting to userspace.	8462	exiting to userspace.
8463		8463
8464	KVM_X86_QUIRK_MISC_ENABLE_NO_MWAIT When this quirk is disabled, KVM sets	8464	KVM_X86_QUIRK_MISC_ENABLE_NO_MWAIT When this quirk is disabled, KVM sets
8465	CPUID.01H:ECX[bit 3] (MONITOR/MWAIT) if	8465	CPUID.01H:ECX[bit 3] (MONITOR/MWAIT) if
8466	IA32_MISC_ENABLE[bit 18] (MWAIT) is set.	8466	IA32_MISC_ENABLE[bit 18] (MWAIT) is set.
8467	Additionally, when this quirk is disabled,	8467	Additionally, when this quirk is disabled,
8468	KVM clears CPUID.01H:ECX[bit 3] if	8468	KVM clears CPUID.01H:ECX[bit 3] if
8469	IA32_MISC_ENABLE[bit 18] is cleared.	8469	IA32_MISC_ENABLE[bit 18] is cleared.
8470		8470
8471	KVM_X86_QUIRK_FIX_HYPERCALL_INSN By default, KVM rewrites guest	8471	KVM_X86_QUIRK_FIX_HYPERCALL_INSN By default, KVM rewrites guest
8472	VMMCALL/VMCALL instructions to match the	8472	VMMCALL/VMCALL instructions to match the
8473	vendor's hypercall instruction for the	8473	vendor's hypercall instruction for the
8474	system. When this quirk is disabled, KVM	8474	system. When this quirk is disabled, KVM
8475	will no longer rewrite invalid guest	8475	will no longer rewrite invalid guest
8476	hypercall instructions. Executing the	8476	hypercall instructions. Executing the
8477	incorrect hypercall instruction will	8477	incorrect hypercall instruction will
8478	generate a #UD within the guest.	8478	generate a #UD within the guest.
8479		8479
8480	KVM_X86_QUIRK_MWAIT_NEVER_UD_FAULTS By default, KVM emulates MONITOR/MWAIT (if	8480	KVM_X86_QUIRK_MWAIT_NEVER_UD_FAULTS By default, KVM emulates MONITOR/MWAIT (if
8481	they are intercepted) as NOPs regardless of	8481	they are intercepted) as NOPs regardless of
8482	whether or not MONITOR/MWAIT are supported	8482	whether or not MONITOR/MWAIT are supported
8483	according to guest CPUID. When this quirk	8483	according to guest CPUID. When this quirk
8484	is disabled and KVM_X86_DISABLE_EXITS_MWAIT	8484	is disabled and KVM_X86_DISABLE_EXITS_MWAIT
8485	is not set (MONITOR/MWAIT are intercepted),	8485	is not set (MONITOR/MWAIT are intercepted),
8486	KVM will inject a #UD on MONITOR/MWAIT if	8486	KVM will inject a #UD on MONITOR/MWAIT if
8487	they're unsupported per guest CPUID. Note,	8487	they're unsupported per guest CPUID. Note,
8488	KVM will modify MONITOR/MWAIT support in	8488	KVM will modify MONITOR/MWAIT support in
8489	guest CPUID on writes to MISC_ENABLE if	8489	guest CPUID on writes to MISC_ENABLE if
8490	KVM_X86_QUIRK_MISC_ENABLE_NO_MWAIT is	8490	KVM_X86_QUIRK_MISC_ENABLE_NO_MWAIT is
8491	disabled.	8491	disabled.
8492		8492
8493	KVM_X86_QUIRK_SLOT_ZAP_ALL By default, for KVM_X86_DEFAULT_VM VMs, KVM	8493	KVM_X86_QUIRK_SLOT_ZAP_ALL By default, for KVM_X86_DEFAULT_VM VMs, KVM
8494	invalidates all SPTEs in all memslots and	8494	invalidates all SPTEs in all memslots and
8495	address spaces when a memslot is deleted or	8495	address spaces when a memslot is deleted or
8496	moved. When this quirk is disabled (or the	8496	moved. When this quirk is disabled (or the
8497	VM type isn't KVM_X86_DEFAULT_VM), KVM only	8497	VM type isn't KVM_X86_DEFAULT_VM), KVM only
8498	ensures the backing memory of the deleted	8498	ensures the backing memory of the deleted
8499	or moved memslot isn't reachable, i.e KVM	8499	or moved memslot isn't reachable, i.e KVM
8500	_may_ invalidate only SPTEs related to the	8500	_may_ invalidate only SPTEs related to the
8501	memslot.	8501	memslot.
8502		8502
8503	KVM_X86_QUIRK_STUFF_FEATURE_MSRS By default, at vCPU creation, KVM sets the	8503	KVM_X86_QUIRK_STUFF_FEATURE_MSRS By default, at vCPU creation, KVM sets the
8504	vCPU's MSR_IA32_PERF_CAPABILITIES (0x345),	8504	vCPU's MSR_IA32_PERF_CAPABILITIES (0x345),
8505	MSR_IA32_ARCH_CAPABILITIES (0x10a),	8505	MSR_IA32_ARCH_CAPABILITIES (0x10a),
8506	MSR_PLATFORM_INFO (0xce), and all VMX MSRs	8506	MSR_PLATFORM_INFO (0xce), and all VMX MSRs
8507	(0x480..0x492) to the maximal capabilities	8507	(0x480..0x492) to the maximal capabilities
8508	supported by KVM. KVM also sets	8508	supported by KVM. KVM also sets
8509	MSR_IA32_UCODE_REV (0x8b) to an arbitrary	8509	MSR_IA32_UCODE_REV (0x8b) to an arbitrary
8510	value (which is different for Intel vs.	8510	value (which is different for Intel vs.
8511	AMD). Lastly, when guest CPUID is set (by	8511	AMD). Lastly, when guest CPUID is set (by
8512	userspace), KVM modifies select VMX MSR	8512	userspace), KVM modifies select VMX MSR
8513	fields to force consistency between guest	8513	fields to force consistency between guest
8514	CPUID and L2's effective ISA. When this	8514	CPUID and L2's effective ISA. When this
8515	quirk is disabled, KVM zeroes the vCPU's MSR	8515	quirk is disabled, KVM zeroes the vCPU's MSR
8516	values (with two exceptions, see below),	8516	values (with two exceptions, see below),
8517	i.e. treats the feature MSRs like CPUID	8517	i.e. treats the feature MSRs like CPUID
8518	leaves and gives userspace full control of	8518	leaves and gives userspace full control of
8519	the vCPU model definition. This quirk does	8519	the vCPU model definition. This quirk does
8520	not affect VMX MSRs CR0/CR4_FIXED1 (0x487	8520	not affect VMX MSRs CR0/CR4_FIXED1 (0x487
8521	and 0x489), as KVM does now allow them to	8521	and 0x489), as KVM does now allow them to
8522	be set by userspace (KVM sets them based on	8522	be set by userspace (KVM sets them based on
8523	guest CPUID, for safety purposes).	8523	guest CPUID, for safety purposes).
8524		8524
8525	KVM_X86_QUIRK_IGNORE_GUEST_PAT By default, on Intel platforms, KVM ignores	8525	KVM_X86_QUIRK_IGNORE_GUEST_PAT By default, on Intel platforms, KVM ignores
8526	guest PAT and forces the effective memory	8526	guest PAT and forces the effective memory
8527	type to WB in EPT. The quirk is not available	8527	type to WB in EPT. The quirk is not available
8528	on Intel platforms which are incapable of	8528	on Intel platforms which are incapable of
8529	safely honoring guest PAT (i.e., without CPU	8529	safely honoring guest PAT (i.e., without CPU
8530	self-snoop, KVM always ignores guest PAT and	8530	self-snoop, KVM always ignores guest PAT and
8531	forces effective memory type to WB). It is	8531	forces effective memory type to WB). It is
8532	also ignored on AMD platforms or, on Intel,	8532	also ignored on AMD platforms or, on Intel,
8533	when a VM has non-coherent DMA devices	8533	when a VM has non-coherent DMA devices
8534	assigned; KVM always honors guest PAT in	8534	assigned; KVM always honors guest PAT in
8535	such case. The quirk is needed to avoid	8535	such case. The quirk is needed to avoid
8536	slowdowns on certain Intel Xeon platforms	8536	slowdowns on certain Intel Xeon platforms
8537	(e.g. ICX, SPR) where self-snoop feature is	8537	(e.g. ICX, SPR) where self-snoop feature is
8538	supported but UC is slow enough to cause	8538	supported but UC is slow enough to cause
8539	issues with some older guests that use	8539	issues with some older guests that use
8540	UC instead of WC to map the video RAM.	8540	UC instead of WC to map the video RAM.
8541	Userspace can disable the quirk to honor	8541	Userspace can disable the quirk to honor
8542	guest PAT if it knows that there is no such	8542	guest PAT if it knows that there is no such
8543	guest software, for example if it does not	8543	guest software, for example if it does not
8544	expose a bochs graphics device (which is	8544	expose a bochs graphics device (which is
8545	known to have had a buggy driver).	8545	known to have had a buggy driver).
8546	=================================== ============================================	8546
		8547	KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM By default, KVM relaxes the consistency
		8548	check for GUEST_IA32_DEBUGCTL in vmcs12
		8549	to allow FREEZE_IN_SMM to be set. When
		8550	this quirk is disabled, KVM requires this
		8551	bit to be cleared. Note that the vmcs02
		8552	bit is still completely controlled by the
		8553	host, regardless of the quirk setting.
		8554	======================================== ================================================
8547		8555
8548	7.32 KVM_CAP_MAX_VCPU_ID	8556	7.32 KVM_CAP_MAX_VCPU_ID
8549	------------------------	8557	------------------------

@@ -368,15 +368,15 @@ struct amdgpu_mode_info { · 367 unmodified lines
368		368
369	struct drm_property *plane_ctm_property;	369	struct drm_property *plane_ctm_property;
370	/**	370	/**
371	* @shaper_lut_property: Plane property to set pre-blending shaper LUT	371	* @plane_shaper_lut_property: Plane property to set pre-blending
372	* that converts color content before 3D LUT. If	372	* shaper LUT that converts color content before 3D LUT.
373	* plane_shaper_tf_property != Identity TF, AMD color module will	373	* If plane_shaper_tf_property != Identity TF, AMD color module will
374	* combine the user LUT values with pre-defined TF into the LUT	374	* combine the user LUT values with pre-defined TF into the LUT
375	* parameters to be programmed.	375	* parameters to be programmed.
376	*/	376	*/
377	struct drm_property *plane_shaper_lut_property;	377	struct drm_property *plane_shaper_lut_property;
378	/**	378	/**
379	* @shaper_lut_size_property: Plane property for the size of	379	* @plane_shaper_lut_size_property: Plane property for the size of
380	* pre-blending shaper LUT as supported by the driver (read-only).	380	* pre-blending shaper LUT as supported by the driver (read-only).
381	*/	381	*/
382	struct drm_property *plane_shaper_lut_size_property;	382	struct drm_property *plane_shaper_lut_size_property;
@@ -400,10 +400,10 @@ struct amdgpu_mode_info { · 17 unmodified lines
400	*/	400	*/
401	struct drm_property *plane_lut3d_property;	401	struct drm_property *plane_lut3d_property;
402	/**	402	/**
403	* @plane_degamma_lut_size_property: Plane property to define the max	403	* @plane_lut3d_size_property: Plane property to define the max size
404	* size of 3D LUT as supported by the driver (read-only). The max size	404	* of 3D LUT as supported by the driver (read-only). The max size is
405	* is the max size of one dimension and, therefore, the max number of	405	* the max size of one dimension and, therefore, the max number of
406	* entries for 3D LUT array is the 3D LUT size cubed;	406	* entries for 3D LUT array is the 3D LUT size cubed.
407	*/	407	*/
408	struct drm_property *plane_lut3d_size_property;	408	struct drm_property *plane_lut3d_size_property;
409	/**	409	/**