lael-labs/linux

Documentation/devicetree/bindings/dma/qcom,bam-dma.yaml+4−0

 anyOf:
   - required:
       - qcom,powered-remotely
+      - num-channels
+      - qcom,num-ees
   - required:
       - qcom,controlled-remotely
+      - num-channels
+      - qcom,num-ees
   - required:
       - clocks
       - clock-names

Documentation/devicetree/bindings/phy/marvell,comphy-cp110.yaml+21−8

     const: 0
   clocks:
+    minItems: 1
     maxItems: 3
-    description: Reference clocks for CP110; MG clock, MG Core clock, AXI clock
   clock-names:
-    items:
+    minItems: 1
-      - const: mg_clk
+    maxItems: 3
-      - const: mg_core_clk
-      - const: axi_clk
   marvell,system-controller:
     description: Phandle to the Marvell system controller (CP110 only)
     $ref: /schemas/types.yaml#/definitions/phandle
 patternProperties:
-  '^phy@[0-2]$':
+  '^phy@[0-5]$':
     description: A COMPHY lane child node
     type: object
     additionalProperties: false
     properties:
       reg:
         description: COMPHY lane number
+        maximum: 5
       '#phy-cells':
         const: 1
+      connector:
+        type: object
     required:
       - reg
       - '#phy-cells'
     then:
       properties:
-        clocks: false
+        clocks:
-        clock-names: false
+          maxItems: 1
+        clock-names:
+          const: xtal
       required:
         - reg-names
     else:
+      properties:
+        clocks:
+          minItems: 3
+        clock-names:
+          items:
+            - const: mg_clk
+            - const: mg_core_clk
+            - const: axi_clk
       required:
         - marvell,system-controller

Documentation/devicetree/bindings/phy/qcom,sc8280xp-qmp-pcie-phy.yaml+2−2

         compatible:
           contains:
             enum:
+              - qcom,sa8775p-qmp-gen4x2-pcie-phy
+              - qcom,sa8775p-qmp-gen4x4-pcie-phy
               - qcom,sc8280xp-qmp-gen3x1-pcie-phy
               - qcom,sc8280xp-qmp-gen3x2-pcie-phy
               - qcom,sc8280xp-qmp-gen3x4-pcie-phy
           contains:
             enum:
               - qcom,qcs8300-qmp-gen4x2-pcie-phy
-              - qcom,sa8775p-qmp-gen4x2-pcie-phy
-              - qcom,sa8775p-qmp-gen4x4-pcie-phy
     then:
       properties:
         clocks:

Documentation/devicetree/bindings/serial/8250.yaml+31−25

       oneOf:
         - required: [ clock-frequency ]
         - required: [ clocks ]
   - if:
       properties:
         compatible:
           items:
             - const: uartclk
             - const: reg
-    else:
+  - if:
+      properties:
+        compatible:
+          contains:
+            const: spacemit,k1-uart
+    then:
       properties:
         clock-names:
           items:
             - const: core
             - const: bus
+  - if:
+      properties:
+        compatible:
+          contains:
+            enum:
+              - spacemit,k1-uart
+              - nxp,lpc1850-uart
+    then:
+      required:
+        - clocks
+        - clock-names
+      properties:
+        clocks:
+          minItems: 2
+        clock-names:
+          minItems: 2
+    else:
+      properties:
+        clocks:
+          maxItems: 1
+        clock-names:
+          maxItems: 1
 properties:
   compatible:
     minItems: 1
     maxItems: 2
     oneOf:
+      - enum:
+          - main
+          - uart
       - items:
           - const: core
           - const: bus
   - reg
   - interrupts
-if:
-  properties:
-    compatible:
-      contains:
-        enum:
-          - spacemit,k1-uart
-          - nxp,lpc1850-uart
-then:
-  required:
-    - clocks
-    - clock-names
-  properties:
-    clocks:
-      minItems: 2
-    clock-names:
-      minItems: 2
-else:
-  properties:
-    clocks:
-      maxItems: 1
-    clock-names:
-      maxItems: 1
 unevaluatedProperties: false
 examples:

Documentation/devicetree/bindings/serial/brcm,bcm7271-uart.yaml+1−1

@@ -41,7 +41,7 @@ properties: · 40 unmodified lines
41	- const: dma_intr2	41	- const: dma_intr2
42		42
43	clocks:	43	clocks:
44	minItems: 1	44	maxItems: 1
45		45
46	clock-names:	46	clock-names:
47	const: sw_baud	47	const: sw_baud

Documentation/netlink/specs/conntrack.yaml+4−5

             - nat-dst
             - timeout
             - mark
-            - counter-orig
+            - counters-orig
-            - counter-reply
+            - counters-reply
             - use
             - id
             - nat-dst
         request:
           value: 0x101
           attributes:
-            - nfgen-family
             - mark
             - filter
             - status
             - nat-dst
             - timeout
             - mark
-            - counter-orig
+            - counters-orig
-            - counter-reply
+            - counters-reply
             - use
             - id
             - nat-dst

Documentation/netlink/specs/mptcp_pm.yaml+2−2

@@ -28,13 +28,13 @@ definitions: · 27 unmodified lines
28	traffic-patterns it can take a long time until the	28	traffic-patterns it can take a long time until the
29	MPTCP_EVENT_ESTABLISHED is sent.	29	MPTCP_EVENT_ESTABLISHED is sent.
30	Attributes: token, family, saddr4 \| saddr6, daddr4 \| daddr6, sport,	30	Attributes: token, family, saddr4 \| saddr6, daddr4 \| daddr6, sport,
31	dport, server-side.	31	dport, server-side, [flags].
32	-	32	-
33	name: established	33	name: established
34	doc: >-	34	doc: >-
35	A MPTCP connection is established (can start new subflows).	35	A MPTCP connection is established (can start new subflows).
36	Attributes: token, family, saddr4 \| saddr6, daddr4 \| daddr6, sport,	36	Attributes: token, family, saddr4 \| saddr6, daddr4 \| daddr6, sport,
37	dport, server-side.	37	dport, server-side, [flags].
38	-	38	-
39	name: closed	39	name: closed
40	doc: >-	40	doc: >-

MAINTAINERS+17−13

 F:	kernel/dma/
 DMA MAPPING HELPERS DEVICE DRIVER API [RUST]
-M:	Abdiel Janulgue <abdiel.janulgue@gmail.com>
 M:	Danilo Krummrich <dakr@kernel.org>
+R:	Abdiel Janulgue <abdiel.janulgue@gmail.com>
 R:	Daniel Almeida <daniel.almeida@collabora.com>
 R:	Robin Murphy <robin.murphy@arm.com>
 R:	Andreas Hindborg <a.hindborg@kernel.org>
 L:	rust-for-linux@vger.kernel.org
 S:	Supported
 W:	https://rust-for-linux.com
-T:	git https://github.com/Rust-for-Linux/linux.git alloc-next
+T:	git git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core.git
 F:	rust/helpers/dma.c
 F:	rust/kernel/dma.rs
 F:	samples/rust/rust_dma.rs
 F:	Documentation/devicetree/bindings/dpll/dpll-device.yaml
 F:	Documentation/devicetree/bindings/dpll/dpll-pin.yaml
 F:	Documentation/driver-api/dpll.rst
-F:	drivers/dpll/*
+F:	drivers/dpll/
 F:	include/linux/dpll.h
 F:	include/uapi/linux/dpll.h
 F:	Documentation/gpu/
 F:	drivers/gpu/drm/
 F:	drivers/gpu/vga/
-F:	rust/kernel/drm/
 F:	include/drm/drm
 F:	include/linux/vga*
 F:	include/uapi/drm/
 X:	drivers/gpu/drm/kmb/
 X:	drivers/gpu/drm/mediatek/
 X:	drivers/gpu/drm/msm/
-X:	drivers/gpu/drm/nouveau/
+X:	drivers/gpu/drm/nova/
 X:	drivers/gpu/drm/radeon/
 X:	drivers/gpu/drm/tegra/
 X:	drivers/gpu/drm/xe/
+DRM DRIVERS AND COMMON INFRASTRUCTURE [RUST]
+M:	Danilo Krummrich <dakr@kernel.org>
+M:	Alice Ryhl <aliceryhl@google.com>
+S:	Supported
+W:	https://drm.pages.freedesktop.org/maintainer-tools/drm-rust.html
+T:	git https://gitlab.freedesktop.org/drm/rust/kernel.git
+F:	drivers/gpu/drm/nova/
+F:	drivers/gpu/nova-core/
+F:	rust/kernel/drm/
 DRM DRIVERS FOR ALLWINNER A10
 M:	Maxime Ripard <mripard@kernel.org>
 M:	Chen-Yu Tsai <wens@csie.org>
 W:	http://www.melexis.com
 F:	drivers/iio/temperature/mlx90635.c
-MELFAS MIP4 TOUCHSCREEN DRIVER
-M:	Sangwon Jee <jeesw@melfas.com>
-S:	Supported
-W:	http://www.melfas.com
-F:	Documentation/devicetree/bindings/input/touchscreen/melfas_mip4.txt
-F:	drivers/input/touchscreen/melfas_mip4.c
 MELLANOX BLUEFIELD I2C DRIVER
 M:	Khalil Blaiech <kblaiech@nvidia.com>
 M:	Asmaa Mnebhi <asmaa@nvidia.com>
 R:	Liam R. Howlett <Liam.Howlett@oracle.com>
 R:	Vlastimil Babka <vbabka@suse.cz>
 R:	Harry Yoo <harry.yoo@oracle.com>
+R:	Jann Horn <jannh@google.com>
 L:	linux-mm@kvack.org
 S:	Maintained
 F:	include/linux/rmap.h
 R:	Ryan Roberts <ryan.roberts@arm.com>
 R:	Dev Jain <dev.jain@arm.com>
 R:	Barry Song <baohua@kernel.org>
+R:	Lance Yang <lance.yang@linux.dev>
 L:	linux-mm@kvack.org
 S:	Maintained
 W:	http://www.linux-mm.org
 F:	drivers/input/keyboard/sun4i-lradc-keys.c
 SUNDANCE NETWORK DRIVER
-M:	Denis Kirjanov <dkirjanov@suse.de>
+M:	Denis Kirjanov <kirjanov@gmail.com>
 L:	netdev@vger.kernel.org
 S:	Maintained
 F:	drivers/net/ethernet/dlink/sundance.c

Makefile+1−1

@@ -2,7 +2,7 @@ · 1 unmodified line
2	VERSION = 6	2	VERSION = 6
3	PATCHLEVEL = 17	3	PATCHLEVEL = 17
4	SUBLEVEL = 0	4	SUBLEVEL = 0
5	EXTRAVERSION = -rc5	5	EXTRAVERSION = -rc6
6	NAME = Baby Opossum Posse	6	NAME = Baby Opossum Posse
7		7
8	# DOCUMENTATION	8	# DOCUMENTATION

arch/arm64/include/asm/kvm_host.h+1−0

@@ -1369,6 +1369,7 @@ static inline bool kvm_system_needs_idmapped_vectors(void) · 1368 unmodified lines
1369	}	1369	}
1370		1370
1371	void kvm_init_host_debug_data(void);	1371	void kvm_init_host_debug_data(void);
		1372	void kvm_debug_init_vhe(void);
1372	void kvm_vcpu_load_debug(struct kvm_vcpu *vcpu);	1373	void kvm_vcpu_load_debug(struct kvm_vcpu *vcpu);
1373	void kvm_vcpu_put_debug(struct kvm_vcpu *vcpu);	1374	void kvm_vcpu_put_debug(struct kvm_vcpu *vcpu);
1374	void kvm_debug_set_guest_ownership(struct kvm_vcpu *vcpu);	1375	void kvm_debug_set_guest_ownership(struct kvm_vcpu *vcpu);

arch/arm64/include/asm/kvm_pgtable.h+0−30

@@ -355,11 +355,6 @@ static inline kvm_pte_t kvm_dereference_pteref(struct kvm_pgtable_walker walke · 354 unmodified lines
355	return pteref;	355	return pteref;
356	}	356	}
357		357
358	static inline kvm_pte_t *kvm_dereference_pteref_raw(kvm_pteref_t pteref)
359	{
360	return pteref;
361	}
362
363	static inline int kvm_pgtable_walk_begin(struct kvm_pgtable_walker *walker)	358	static inline int kvm_pgtable_walk_begin(struct kvm_pgtable_walker *walker)
364	{	359	{
365	/*	360	/*
@@ -389,11 +384,6 @@ static inline kvm_pte_t kvm_dereference_pteref(struct kvm_pgtable_walker walke · 23 unmodified lines
389	return rcu_dereference_check(pteref, !(walker->flags & KVM_PGTABLE_WALK_SHARED));	384	return rcu_dereference_check(pteref, !(walker->flags & KVM_PGTABLE_WALK_SHARED));
390	}	385	}
391		386
392	static inline kvm_pte_t *kvm_dereference_pteref_raw(kvm_pteref_t pteref)
393	{
394	return rcu_dereference_raw(pteref);
395	}
396
397	static inline int kvm_pgtable_walk_begin(struct kvm_pgtable_walker *walker)	387	static inline int kvm_pgtable_walk_begin(struct kvm_pgtable_walker *walker)
398	{	388	{
399	if (walker->flags & KVM_PGTABLE_WALK_SHARED)	389	if (walker->flags & KVM_PGTABLE_WALK_SHARED)
@@ -561,26 +551,6 @@ static inline int kvm_pgtable_stage2_init(struct kvm_pgtable *pgt, struct kvm_s2 · 161 unmodified lines
561	*/	551	*/
562	void kvm_pgtable_stage2_destroy(struct kvm_pgtable *pgt);	552	void kvm_pgtable_stage2_destroy(struct kvm_pgtable *pgt);
563		553
564	/**
565	* kvm_pgtable_stage2_destroy_range() - Destroy the unlinked range of addresses.
566	* @pgt: Page-table structure initialised by kvm_pgtable_stage2_init*().
567	* @addr: Intermediate physical address at which to place the mapping.
568	* @size: Size of the mapping.
569	*
570	* The page-table is assumed to be unreachable by any hardware walkers prior
571	* to freeing and therefore no TLB invalidation is performed.
572	*/
573	void kvm_pgtable_stage2_destroy_range(struct kvm_pgtable *pgt,
574	u64 addr, u64 size);
575
576	/**
577	* kvm_pgtable_stage2_destroy_pgd() - Destroy the PGD of guest stage-2 page-table.
578	* @pgt: Page-table structure initialised by kvm_pgtable_stage2_init*().
579	*
580	* It is assumed that the rest of the page-table is freed before this operation.
581	*/
582	void kvm_pgtable_stage2_destroy_pgd(struct kvm_pgtable *pgt);
583
584	/**	554	/**
585	* kvm_pgtable_stage2_free_unlinked() - Free an unlinked stage-2 paging structure.	555	* kvm_pgtable_stage2_free_unlinked() - Free an unlinked stage-2 paging structure.
586	* @mm_ops: Memory management callbacks.	556	* @mm_ops: Memory management callbacks.

arch/arm64/include/asm/kvm_pkvm.h+1−3

 int pkvm_pgtable_stage2_init(struct kvm_pgtable *pgt, struct kvm_s2_mmu *mmu,
 			     struct kvm_pgtable_mm_ops *mm_ops);
-void pkvm_pgtable_stage2_destroy_range(struct kvm_pgtable *pgt,
+void pkvm_pgtable_stage2_destroy(struct kvm_pgtable *pgt);
-					u64 addr, u64 size);
-void pkvm_pgtable_stage2_destroy_pgd(struct kvm_pgtable *pgt);
 int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size, u64 phys,
 			    enum kvm_pgtable_prot prot, void *mc,
 			    enum kvm_pgtable_walk_flags flags);

arch/arm64/kvm/arm.c+3−1

 {
 	cpu_set_hyp_vector();
-	if (is_kernel_in_hyp_mode())
+	if (is_kernel_in_hyp_mode()) {
 		kvm_timer_init_vhe();
+		kvm_debug_init_vhe();
+	}
 	if (vgic_present)
 		kvm_vgic_init_cpu_hardware();

arch/arm64/kvm/debug.c+13−0

 	}
 }
+void kvm_debug_init_vhe(void)
+{
+	/* Clear PMSCR_EL1.E{0,1}SPE which reset to UNKNOWN values. */
+	if (SYS_FIELD_GET(ID_AA64DFR0_EL1, PMSVer, read_sysreg(id_aa64dfr0_el1)))
+		write_sysreg_el1(0, SYS_PMSCR);
+}
 /*
  * Configures the 'external' MDSCR_EL1 value for the guest, i.e. when the host
  * has taken over MDSCR_EL1.
 	/* Must be called before kvm_vcpu_load_vhe() */
 	KVM_BUG_ON(vcpu_get_flag(vcpu, SYSREGS_ON_CPU), vcpu->kvm);
+	if (has_vhe())
+		*host_data_ptr(host_debug_state.mdcr_el2) = read_sysreg(mdcr_el2);
 	/*
 	 * Determine which of the possible debug states we're in:
 	 *
 void kvm_vcpu_put_debug(struct kvm_vcpu *vcpu)
 {
+	if (has_vhe())
+		write_sysreg(*host_data_ptr(host_debug_state.mdcr_el2), mdcr_el2);
 	if (likely(!(vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)))
 		return;

arch/arm64/kvm/hyp/include/hyp/switch.h+0−5

 		vcpu_set_flag(vcpu, PMUSERENR_ON_CPU);
 	}
-	*host_data_ptr(host_debug_state.mdcr_el2) = read_sysreg(mdcr_el2);
-	write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2);
 	if (cpus_have_final_cap(ARM64_HAS_HCX)) {
 		u64 hcrx = vcpu->arch.hcrx_el2;
 		if (is_nested_ctxt(vcpu)) {
 {
 	struct kvm_cpu_context *hctxt = host_data_ptr(host_ctxt);
-	write_sysreg(*host_data_ptr(host_debug_state.mdcr_el2), mdcr_el2);
 	write_sysreg(0, hstr_el2);
 	if (system_supports_pmuv3()) {
 		write_sysreg(ctxt_sys_reg(hctxt, PMUSERENR_EL0), pmuserenr_el0);

arch/arm64/kvm/hyp/nvhe/switch.c+6−0

 static void __activate_traps(struct kvm_vcpu *vcpu)
 {
 	___activate_traps(vcpu, vcpu->arch.hcr_el2);
+	*host_data_ptr(host_debug_state.mdcr_el2) = read_sysreg(mdcr_el2);
+	write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2);
 	__activate_traps_common(vcpu);
 	__activate_cptr_traps(vcpu);
 		isb();
 	}
+	write_sysreg(*host_data_ptr(host_debug_state.mdcr_el2), mdcr_el2);
 	__deactivate_traps_common(vcpu);
 	write_sysreg_hcr(this_cpu_ptr(&kvm_init_params)->hcr_el2);

arch/arm64/kvm/hyp/nvhe/sys_regs.c+1−1

@@ -253,7 +253,7 @@ static void inject_undef64(struct kvm_vcpu *vcpu) · 252 unmodified lines
253		253
254	*vcpu_pc(vcpu) = read_sysreg_el2(SYS_ELR);	254	*vcpu_pc(vcpu) = read_sysreg_el2(SYS_ELR);
255	*vcpu_cpsr(vcpu) = read_sysreg_el2(SYS_SPSR);	255	*vcpu_cpsr(vcpu) = read_sysreg_el2(SYS_SPSR);
256	__vcpu_assign_sys_reg(vcpu, read_sysreg_el1(SYS_VBAR), VBAR_EL1);	256	__vcpu_assign_sys_reg(vcpu, VBAR_EL1, read_sysreg_el1(SYS_VBAR));
257		257
258	kvm_pend_exception(vcpu, EXCEPT_AA64_EL1_SYNC);	258	kvm_pend_exception(vcpu, EXCEPT_AA64_EL1_SYNC);
259		259

arch/arm64/kvm/hyp/pgtable.c+4−21

@@ -1551,38 +1551,21 @@ static int stage2_free_walker(const struct kvm_pgtable_visit_ctx *ctx, · 1550 unmodified lines
1551	return 0;	1551	return 0;
1552	}	1552	}
1553		1553
1554	void kvm_pgtable_stage2_destroy_range(struct kvm_pgtable *pgt,	1554	void kvm_pgtable_stage2_destroy(struct kvm_pgtable *pgt)
1555	u64 addr, u64 size)
1556	{	1555	{
		1556	size_t pgd_sz;
1557	struct kvm_pgtable_walker walker = {	1557	struct kvm_pgtable_walker walker = {
1558	.cb = stage2_free_walker,	1558	.cb = stage2_free_walker,
1559	.flags = KVM_PGTABLE_WALK_LEAF \|	1559	.flags = KVM_PGTABLE_WALK_LEAF \|
1560	KVM_PGTABLE_WALK_TABLE_POST,	1560	KVM_PGTABLE_WALK_TABLE_POST,
1561	};	1561	};
1562		1562
1563	WARN_ON(kvm_pgtable_walk(pgt, addr, size, &walker));	1563	WARN_ON(kvm_pgtable_walk(pgt, 0, BIT(pgt->ia_bits), &walker));
1564	}
1565
1566	void kvm_pgtable_stage2_destroy_pgd(struct kvm_pgtable *pgt)
1567	{
1568	size_t pgd_sz;
1569
1570	pgd_sz = kvm_pgd_pages(pgt->ia_bits, pgt->start_level) * PAGE_SIZE;	1564	pgd_sz = kvm_pgd_pages(pgt->ia_bits, pgt->start_level) * PAGE_SIZE;
1571		1565	pgt->mm_ops->free_pages_exact(kvm_dereference_pteref(&walker, pgt->pgd), pgd_sz);
1572	/*
1573	* Since the pgtable is unlinked at this point, and not shared with
1574	* other walkers, safely deference pgd with kvm_dereference_pteref_raw()
1575	*/
1576	pgt->mm_ops->free_pages_exact(kvm_dereference_pteref_raw(pgt->pgd), pgd_sz);
1577	pgt->pgd = NULL;	1566	pgt->pgd = NULL;
1578	}	1567	}
1579		1568
1580	void kvm_pgtable_stage2_destroy(struct kvm_pgtable *pgt)
1581	{
1582	kvm_pgtable_stage2_destroy_range(pgt, 0, BIT(pgt->ia_bits));
1583	kvm_pgtable_stage2_destroy_pgd(pgt);
1584	}
1585
1586	void kvm_pgtable_stage2_free_unlinked(struct kvm_pgtable_mm_ops mm_ops, void pgtable, s8 level)	1569	void kvm_pgtable_stage2_free_unlinked(struct kvm_pgtable_mm_ops mm_ops, void pgtable, s8 level)
1587	{	1570	{
1588	kvm_pteref_t ptep = (kvm_pteref_t)pgtable;	1571	kvm_pteref_t ptep = (kvm_pteref_t)pgtable;

arch/arm64/kvm/mmu.c+6−39

@@ -904,38 +904,6 @@ static int kvm_init_ipa_range(struct kvm_s2_mmu *mmu, unsigned long type) · 903 unmodified lines
904	return 0;	904	return 0;
905	}	905	}
906		906
907	/*
908	* Assume that @pgt is valid and unlinked from the KVM MMU to free the
909	* page-table without taking the kvm_mmu_lock and without performing any
910	* TLB invalidations.
911	*
912	* Also, the range of addresses can be large enough to cause need_resched
913	* warnings, for instance on CONFIG_PREEMPT_NONE kernels. Hence, invoke
914	* cond_resched() periodically to prevent hogging the CPU for a long time
915	* and schedule something else, if required.
916	*/
917	static void stage2_destroy_range(struct kvm_pgtable *pgt, phys_addr_t addr,
918	phys_addr_t end)
919	{
920	u64 next;
921
922	do {
923	next = stage2_range_addr_end(addr, end);
924	KVM_PGT_FN(kvm_pgtable_stage2_destroy_range)(pgt, addr,
925	next - addr);
926	if (next != end)
927	cond_resched();
928	} while (addr = next, addr != end);
929	}
930
931	static void kvm_stage2_destroy(struct kvm_pgtable *pgt)
932	{
933	unsigned int ia_bits = VTCR_EL2_IPA(pgt->mmu->vtcr);
934
935	stage2_destroy_range(pgt, 0, BIT(ia_bits));
936	KVM_PGT_FN(kvm_pgtable_stage2_destroy_pgd)(pgt);
937	}
938
939	/**	907	/**
940	* kvm_init_stage2_mmu - Initialise a S2 MMU structure	908	* kvm_init_stage2_mmu - Initialise a S2 MMU structure
941	* @kvm: The pointer to the KVM structure	909	* @kvm: The pointer to the KVM structure
@@ -1012,7 +980,7 @@ int kvm_init_stage2_mmu(struct kvm kvm, struct kvm_s2_mmu mmu, unsigned long t · 70 unmodified lines
1012	return 0;	980	return 0;
1013		981
1014	out_destroy_pgtable:	982	out_destroy_pgtable:
1015	kvm_stage2_destroy(pgt);	983	KVM_PGT_FN(kvm_pgtable_stage2_destroy)(pgt);
1016	out_free_pgtable:	984	out_free_pgtable:
1017	kfree(pgt);	985	kfree(pgt);
1018	return err;	986	return err;
@@ -1106,10 +1074,14 @@ void kvm_free_stage2_pgd(struct kvm_s2_mmu *mmu) · 87 unmodified lines
1106	mmu->pgt = NULL;	1074	mmu->pgt = NULL;
1107	free_percpu(mmu->last_vcpu_ran);	1075	free_percpu(mmu->last_vcpu_ran);
1108	}	1076	}
		1077
		1078	if (kvm_is_nested_s2_mmu(kvm, mmu))
		1079	kvm_init_nested_s2_mmu(mmu);
		1080
1109	write_unlock(&kvm->mmu_lock);	1081	write_unlock(&kvm->mmu_lock);
1110		1082
1111	if (pgt) {	1083	if (pgt) {
1112	kvm_stage2_destroy(pgt);	1084	KVM_PGT_FN(kvm_pgtable_stage2_destroy)(pgt);
1113	kfree(pgt);	1085	kfree(pgt);
1114	}	1086	}
1115	}	1087	}
@@ -1541,11 +1513,6 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, · 425 unmodified lines
1541	exec_fault = kvm_vcpu_trap_is_exec_fault(vcpu);	1513	exec_fault = kvm_vcpu_trap_is_exec_fault(vcpu);
1542	VM_BUG_ON(write_fault && exec_fault);	1514	VM_BUG_ON(write_fault && exec_fault);
1543		1515
1544	if (fault_is_perm && !write_fault && !exec_fault) {
1545	kvm_err("Unexpected L2 read permission error\n");
1546	return -EFAULT;
1547	}
1548
1549	if (!is_protected_kvm_enabled())	1516	if (!is_protected_kvm_enabled())
1550	memcache = &vcpu->arch.mmu_page_cache;	1517	memcache = &vcpu->arch.mmu_page_cache;
1551	else	1518	else

arch/arm64/kvm/nested.c+3−3

@@ -847,7 +847,7 @@ static void kvm_invalidate_vncr_ipa(struct kvm *kvm, u64 start, u64 end) · 846 unmodified lines
847		847
848	ipa_size = ttl_to_size(pgshift_level_to_ttl(vt->wi.pgshift,	848	ipa_size = ttl_to_size(pgshift_level_to_ttl(vt->wi.pgshift,
849	vt->wr.level));	849	vt->wr.level));
850	ipa_start = vt->wr.pa & (ipa_size - 1);	850	ipa_start = vt->wr.pa & ~(ipa_size - 1);
851	ipa_end = ipa_start + ipa_size;	851	ipa_end = ipa_start + ipa_size;
852		852
853	if (ipa_end <= start \|\| ipa_start >= end)	853	if (ipa_end <= start \|\| ipa_start >= end)
@@ -887,7 +887,7 @@ static void invalidate_vncr_va(struct kvm *kvm, · 33 unmodified lines
887		887
888	va_size = ttl_to_size(pgshift_level_to_ttl(vt->wi.pgshift,	888	va_size = ttl_to_size(pgshift_level_to_ttl(vt->wi.pgshift,
889	vt->wr.level));	889	vt->wr.level));
890	va_start = vt->gva & (va_size - 1);	890	va_start = vt->gva & ~(va_size - 1);
891	va_end = va_start + va_size;	891	va_end = va_start + va_size;
892		892
893	switch (scope->type) {	893	switch (scope->type) {
@@ -1276,7 +1276,7 @@ static bool kvm_vncr_tlb_lookup(struct kvm_vcpu *vcpu) · 382 unmodified lines
1276	!(tcr & TCR_ASID16))	1276	!(tcr & TCR_ASID16))
1277	asid &= GENMASK(7, 0);	1277	asid &= GENMASK(7, 0);
1278		1278
1279	return asid != vt->wr.asid;	1279	return asid == vt->wr.asid;
1280	}	1280	}
1281		1281
1282	return true;	1282	return true;

arch/arm64/kvm/pkvm.c+2−9

 	return 0;
 }
-void pkvm_pgtable_stage2_destroy_range(struct kvm_pgtable *pgt,
+void pkvm_pgtable_stage2_destroy(struct kvm_pgtable *pgt)
-					u64 addr, u64 size)
 {
-	__pkvm_pgtable_stage2_unmap(pgt, addr, addr + size);
+	__pkvm_pgtable_stage2_unmap(pgt, 0, ~(0ULL));
-}
-void pkvm_pgtable_stage2_destroy_pgd(struct kvm_pgtable *pgt)
-{
-	/* Expected to be called after all pKVM mappings have been released. */
-	WARN_ON_ONCE(!RB_EMPTY_ROOT(&pgt->pkvm_mappings.rb_root));
 }
 int pkvm_pgtable_stage2_map(struct kvm_pgtable *pgt, u64 addr, u64 size,

arch/arm64/kvm/vgic/vgic-debug.c+1−1

@@ -69,7 +69,7 @@ static int iter_mark_lpis(struct kvm *kvm) · 68 unmodified lines
69	int nr_lpis = 0;	69	int nr_lpis = 0;
70		70
71	xa_for_each(&dist->lpi_xa, intid, irq) {	71	xa_for_each(&dist->lpi_xa, intid, irq) {
72	if (!vgic_try_get_irq_kref(irq))	72	if (!vgic_try_get_irq_ref(irq))
73	continue;	73	continue;
74		74
75	xa_set_mark(&dist->lpi_xa, intid, LPI_XA_MARK_DEBUG_ITER);	75	xa_set_mark(&dist->lpi_xa, intid, LPI_XA_MARK_DEBUG_ITER);

arch/arm64/kvm/vgic/vgic-init.c+3−3

@@ -53,7 +53,7 @@ void kvm_vgic_early_init(struct kvm *kvm) · 52 unmodified lines
53	{	53	{
54	struct vgic_dist *dist = &kvm->arch.vgic;	54	struct vgic_dist *dist = &kvm->arch.vgic;
55		55
56	xa_init_flags(&dist->lpi_xa, XA_FLAGS_LOCK_IRQ);	56	xa_init(&dist->lpi_xa);
57	}	57	}
58		58
59	/* CREATION */	59	/* CREATION */
@@ -208,7 +208,7 @@ static int kvm_vgic_dist_init(struct kvm *kvm, unsigned int nr_spis) · 148 unmodified lines
208	raw_spin_lock_init(&irq->irq_lock);	208	raw_spin_lock_init(&irq->irq_lock);
209	irq->vcpu = NULL;	209	irq->vcpu = NULL;
210	irq->target_vcpu = vcpu0;	210	irq->target_vcpu = vcpu0;
211	kref_init(&irq->refcount);	211	refcount_set(&irq->refcount, 0);
212	switch (dist->vgic_model) {	212	switch (dist->vgic_model) {
213	case KVM_DEV_TYPE_ARM_VGIC_V2:	213	case KVM_DEV_TYPE_ARM_VGIC_V2:
214	irq->targets = 0;	214	irq->targets = 0;
@@ -277,7 +277,7 @@ static int vgic_allocate_private_irqs_locked(struct kvm_vcpu *vcpu, u32 type) · 62 unmodified lines
277	irq->intid = i;	277	irq->intid = i;
278	irq->vcpu = NULL;	278	irq->vcpu = NULL;
279	irq->target_vcpu = vcpu;	279	irq->target_vcpu = vcpu;
280	kref_init(&irq->refcount);	280	refcount_set(&irq->refcount, 0);
281	if (vgic_irq_is_sgi(i)) {	281	if (vgic_irq_is_sgi(i)) {
282	/* SGIs */	282	/* SGIs */
283	irq->enabled = 1;	283	irq->enabled = 1;

arch/arm64/kvm/vgic/vgic-its.c+7−8

 {
 	struct vgic_dist *dist = &kvm->arch.vgic;
 	struct vgic_irq *irq = vgic_get_irq(kvm, intid), *oldirq;
-	unsigned long flags;
 	int ret;
 	/* In this case there is no put, since we keep the reference. */
 	if (!irq)
 		return ERR_PTR(-ENOMEM);
-	ret = xa_reserve_irq(&dist->lpi_xa, intid, GFP_KERNEL_ACCOUNT);
+	ret = xa_reserve(&dist->lpi_xa, intid, GFP_KERNEL_ACCOUNT);
 	if (ret) {
 		kfree(irq);
 		return ERR_PTR(ret);
 	raw_spin_lock_init(&irq->irq_lock);
 	irq->config = VGIC_CONFIG_EDGE;
-	kref_init(&irq->refcount);
+	refcount_set(&irq->refcount, 1);
 	irq->intid = intid;
 	irq->target_vcpu = vcpu;
 	irq->group = 1;
-	xa_lock_irqsave(&dist->lpi_xa, flags);
+	xa_lock(&dist->lpi_xa);
 	/*
 	 * There could be a race with another vgic_add_lpi(), so we need to
 	 * check that we don't add a second list entry with the same LPI.
 	 */
 	oldirq = xa_load(&dist->lpi_xa, intid);
-	if (vgic_try_get_irq_kref(oldirq)) {
+	if (vgic_try_get_irq_ref(oldirq)) {
 		/* Someone was faster with adding this LPI, lets use that. */
 		kfree(irq);
 		irq = oldirq;
 	}
 out_unlock:
-	xa_unlock_irqrestore(&dist->lpi_xa, flags);
+	xa_unlock(&dist->lpi_xa);
 	if (ret)
 		return ERR_PTR(ret);
 	rcu_read_lock();
 	irq = xa_load(&its->translation_cache, cache_key);
-	if (!vgic_try_get_irq_kref(irq))
+	if (!vgic_try_get_irq_ref(irq))
 		irq = NULL;
 	rcu_read_unlock();
 	 * its_lock, as the ITE (and the reference it holds) cannot be freed.
 	 */
 	lockdep_assert_held(&its->its_lock);
-	vgic_get_irq_kref(irq);
+	vgic_get_irq_ref(irq);
 	old = xa_store(&its->translation_cache, cache_key, irq, GFP_KERNEL_ACCOUNT);

arch/arm64/kvm/vgic/vgic-v4.c+1−1

@@ -518,7 +518,7 @@ static struct vgic_irq __vgic_host_irq_get_vlpi(struct kvm kvm, int host_irq) · 517 unmodified lines
518	if (!irq->hw \|\| irq->host_irq != host_irq)	518	if (!irq->hw \|\| irq->host_irq != host_irq)
519	continue;	519	continue;
520		520
521	if (!vgic_try_get_irq_kref(irq))	521	if (!vgic_try_get_irq_ref(irq))
522	return NULL;	522	return NULL;
523		523
524	return irq;	524	return irq;

arch/arm64/kvm/vgic/vgic.c+58−22

  *     kvm->arch.config_lock (mutex)
  *       its->cmd_lock (mutex)
  *         its->its_lock (mutex)
- *           vgic_cpu->ap_list_lock		must be taken with IRQs disabled
+ *           vgic_dist->lpi_xa.xa_lock
- *             vgic_dist->lpi_xa.xa_lock	must be taken with IRQs disabled
+ *             vgic_cpu->ap_list_lock		must be taken with IRQs disabled
  *               vgic_irq->irq_lock		must be taken with IRQs disabled
  *
  * As the ap_list_lock might be taken from the timer interrupt handler,
 	rcu_read_lock();
 	irq = xa_load(&dist->lpi_xa, intid);
-	if (!vgic_try_get_irq_kref(irq))
+	if (!vgic_try_get_irq_ref(irq))
 		irq = NULL;
 	rcu_read_unlock();
 	return vgic_get_irq(vcpu->kvm, intid);
 }
-/*
+static void vgic_release_lpi_locked(struct vgic_dist *dist, struct vgic_irq *irq)
- * We can't do anything in here, because we lack the kvm pointer to
+{
- * lock and remove the item from the lpi_list. So we keep this function
+	lockdep_assert_held(&dist->lpi_xa.xa_lock);
- * empty and use the return value of kref_put() to trigger the freeing.
+	__xa_erase(&dist->lpi_xa, irq->intid);
- */
+	kfree_rcu(irq, rcu);
-static void vgic_irq_release(struct kref *ref)
+}
+static __must_check bool __vgic_put_irq(struct kvm *kvm, struct vgic_irq *irq)
+{
+	if (irq->intid < VGIC_MIN_LPI)
+		return false;
+	return refcount_dec_and_test(&irq->refcount);
+}
+static __must_check bool vgic_put_irq_norelease(struct kvm *kvm, struct vgic_irq *irq)
 {
+	if (!__vgic_put_irq(kvm, irq))
+		return false;
+	irq->pending_release = true;
+	return true;
 }
 void vgic_put_irq(struct kvm *kvm, struct vgic_irq *irq)
 {
 	struct vgic_dist *dist = &kvm->arch.vgic;
-	unsigned long flags;
-	if (irq->intid < VGIC_MIN_LPI)
+	if (irq->intid >= VGIC_MIN_LPI)
-		return;
+		might_lock(&dist->lpi_xa.xa_lock);
-	if (!kref_put(&irq->refcount, vgic_irq_release))
+	if (!__vgic_put_irq(kvm, irq))
 		return;
-	xa_lock_irqsave(&dist->lpi_xa, flags);
+	xa_lock(&dist->lpi_xa);
-	__xa_erase(&dist->lpi_xa, irq->intid);
+	vgic_release_lpi_locked(dist, irq);
-	xa_unlock_irqrestore(&dist->lpi_xa, flags);
+	xa_unlock(&dist->lpi_xa);
+}
-	kfree_rcu(irq, rcu);
+static void vgic_release_deleted_lpis(struct kvm *kvm)
+{
+	struct vgic_dist *dist = &kvm->arch.vgic;
+	unsigned long intid;
+	struct vgic_irq *irq;
+	xa_lock(&dist->lpi_xa);
+	xa_for_each(&dist->lpi_xa, intid, irq) {
+		if (irq->pending_release)
+			vgic_release_lpi_locked(dist, irq);
+	}
+	xa_unlock(&dist->lpi_xa);
 }
 void vgic_flush_pending_lpis(struct kvm_vcpu *vcpu)
 {
 	struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
 	struct vgic_irq *irq, *tmp;
+	bool deleted = false;
 	unsigned long flags;
 	raw_spin_lock_irqsave(&vgic_cpu->ap_list_lock, flags);
 			list_del(&irq->ap_list);
 			irq->vcpu = NULL;
 			raw_spin_unlock(&irq->irq_lock);
-			vgic_put_irq(vcpu->kvm, irq);
+			deleted |= vgic_put_irq_norelease(vcpu->kvm, irq);
 		}
 	}
 	raw_spin_unlock_irqrestore(&vgic_cpu->ap_list_lock, flags);
+	if (deleted)
+		vgic_release_deleted_lpis(vcpu->kvm);
 }
 void vgic_irq_set_phys_pending(struct vgic_irq *irq, bool pending)
 	 * now in the ap_list. This is safe as the caller must already hold a
 	 * reference on the irq.
 	 */
-	vgic_get_irq_kref(irq);
+	vgic_get_irq_ref(irq);
 	list_add_tail(&irq->ap_list, &vcpu->arch.vgic_cpu.ap_list_head);
 	irq->vcpu = vcpu;
 {
 	struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
 	struct vgic_irq *irq, *tmp;
+	bool deleted_lpis = false;
 	DEBUG_SPINLOCK_BUG_ON(!irqs_disabled());
 			/*
 			 * This vgic_put_irq call matches the
-			 * vgic_get_irq_kref in vgic_queue_irq_unlock,
+			 * vgic_get_irq_ref in vgic_queue_irq_unlock,
 			 * where we added the LPI to the ap_list. As
 			 * we remove the irq from the list, we drop
 			 * also drop the refcount.
 			 */
-			vgic_put_irq(vcpu->kvm, irq);
+			deleted_lpis |= vgic_put_irq_norelease(vcpu->kvm, irq);
 			continue;
 		}
 	}
 	raw_spin_unlock(&vgic_cpu->ap_list_lock);
+	if (unlikely(deleted_lpis))
+		vgic_release_deleted_lpis(vcpu->kvm);
 }
 static inline void vgic_fold_lr_state(struct kvm_vcpu *vcpu)
 		 * the AP list has been sorted already.
 		 */
 		if (multi_sgi && irq->priority > prio) {
-			_raw_spin_unlock(&irq->irq_lock);
+			raw_spin_unlock(&irq->irq_lock);
 			break;
 		}

arch/arm64/kvm/vgic/vgic.h+4−4

@@ -267,7 +267,7 @@ void vgic_v2_put(struct kvm_vcpu *vcpu); · 266 unmodified lines
267	void vgic_v2_save_state(struct kvm_vcpu *vcpu);	267	void vgic_v2_save_state(struct kvm_vcpu *vcpu);
268	void vgic_v2_restore_state(struct kvm_vcpu *vcpu);	268	void vgic_v2_restore_state(struct kvm_vcpu *vcpu);
269		269
270	static inline bool vgic_try_get_irq_kref(struct vgic_irq *irq)	270	static inline bool vgic_try_get_irq_ref(struct vgic_irq *irq)
271	{	271	{
272	if (!irq)	272	if (!irq)
273	return false;	273	return false;
@@ -275,12 +275,12 @@ static inline bool vgic_try_get_irq_kref(struct vgic_irq *irq) · 1 unmodified line
275	if (irq->intid < VGIC_MIN_LPI)	275	if (irq->intid < VGIC_MIN_LPI)
276	return true;	276	return true;
277		277
278	return kref_get_unless_zero(&irq->refcount);	278	return refcount_inc_not_zero(&irq->refcount);
279	}	279	}
280		280
281	static inline void vgic_get_irq_kref(struct vgic_irq *irq)	281	static inline void vgic_get_irq_ref(struct vgic_irq *irq)
282	{	282	{
283	WARN_ON_ONCE(!vgic_try_get_irq_kref(irq));	283	WARN_ON_ONCE(!vgic_try_get_irq_ref(irq));
284	}	284	}
285		285
286	void vgic_v3_fold_lr_state(struct kvm_vcpu *vcpu);	286	void vgic_v3_fold_lr_state(struct kvm_vcpu *vcpu);

arch/s390/kvm/interrupt.c+11−4

 static struct page *get_map_page(struct kvm *kvm, u64 uaddr)
 {
+	struct mm_struct *mm = kvm->mm;
 	struct page *page = NULL;
+	int locked = 1;
+	if (mmget_not_zero(mm)) {
+		mmap_read_lock(mm);
+		get_user_pages_remote(mm, uaddr, 1, FOLL_WRITE,
+				      &page, &locked);
+		if (locked)
+			mmap_read_unlock(mm);
+		mmput(mm);
+	}
-	mmap_read_lock(kvm->mm);
-	get_user_pages_remote(kvm->mm, uaddr, 1, FOLL_WRITE,
-			      &page, NULL);
-	mmap_read_unlock(kvm->mm);
 	return page;
 }

arch/s390/kvm/kvm-s390.c+12−12

@@ -4864,12 +4864,12 @@ static void kvm_s390_assert_primary_as(struct kvm_vcpu *vcpu) · 4863 unmodified lines
4864	* @vcpu: the vCPU whose gmap is to be fixed up	4864	* @vcpu: the vCPU whose gmap is to be fixed up
4865	* @gfn: the guest frame number used for memslots (including fake memslots)	4865	* @gfn: the guest frame number used for memslots (including fake memslots)
4866	* @gaddr: the gmap address, does not have to match @gfn for ucontrol gmaps	4866	* @gaddr: the gmap address, does not have to match @gfn for ucontrol gmaps
4867	* @flags: FOLL_* flags	4867	* @foll: FOLL_* flags
4868	*	4868	*
4869	* Return: 0 on success, < 0 in case of error.	4869	* Return: 0 on success, < 0 in case of error.
4870	* Context: The mm lock must not be held before calling. May sleep.	4870	* Context: The mm lock must not be held before calling. May sleep.
4871	*/	4871	*/
4872	int __kvm_s390_handle_dat_fault(struct kvm_vcpu *vcpu, gfn_t gfn, gpa_t gaddr, unsigned int flags)	4872	int __kvm_s390_handle_dat_fault(struct kvm_vcpu *vcpu, gfn_t gfn, gpa_t gaddr, unsigned int foll)
4873	{	4873	{
4874	struct kvm_memory_slot *slot;	4874	struct kvm_memory_slot *slot;
4875	unsigned int fault_flags;	4875	unsigned int fault_flags;
@@ -4883,13 +4883,13 @@ int __kvm_s390_handle_dat_fault(struct kvm_vcpu *vcpu, gfn_t gfn, gpa_t gaddr, u · 7 unmodified lines
4883	if (!slot \|\| slot->flags & KVM_MEMSLOT_INVALID)	4883	if (!slot \|\| slot->flags & KVM_MEMSLOT_INVALID)
4884	return vcpu_post_run_addressing_exception(vcpu);	4884	return vcpu_post_run_addressing_exception(vcpu);
4885		4885
4886	fault_flags = flags & FOLL_WRITE ? FAULT_FLAG_WRITE : 0;	4886	fault_flags = foll & FOLL_WRITE ? FAULT_FLAG_WRITE : 0;
4887	if (vcpu->arch.gmap->pfault_enabled)	4887	if (vcpu->arch.gmap->pfault_enabled)
4888	flags \|= FOLL_NOWAIT;	4888	foll \|= FOLL_NOWAIT;
4889	vmaddr = __gfn_to_hva_memslot(slot, gfn);	4889	vmaddr = __gfn_to_hva_memslot(slot, gfn);
4890		4890
4891	try_again:	4891	try_again:
4892	pfn = __kvm_faultin_pfn(slot, gfn, flags, &writable, &page);	4892	pfn = __kvm_faultin_pfn(slot, gfn, foll, &writable, &page);
4893		4893
4894	/* Access outside memory, inject addressing exception */	4894	/* Access outside memory, inject addressing exception */
4895	if (is_noslot_pfn(pfn))	4895	if (is_noslot_pfn(pfn))
@@ -4905,7 +4905,7 @@ try_again: · 9 unmodified lines
4905	return 0;	4905	return 0;
4906	vcpu->stat.pfault_sync++;	4906	vcpu->stat.pfault_sync++;
4907	/* Could not setup async pfault, try again synchronously */	4907	/* Could not setup async pfault, try again synchronously */
4908	flags &= ~FOLL_NOWAIT;	4908	foll &= ~FOLL_NOWAIT;
4909	goto try_again;	4909	goto try_again;
4910	}	4910	}
4911	/* Any other error */	4911	/* Any other error */
@@ -4925,7 +4925,7 @@ try_again: · 13 unmodified lines
4925	return rc;	4925	return rc;
4926	}	4926	}
4927		4927
4928	static int vcpu_dat_fault_handler(struct kvm_vcpu *vcpu, unsigned long gaddr, unsigned int flags)	4928	static int vcpu_dat_fault_handler(struct kvm_vcpu *vcpu, unsigned long gaddr, unsigned int foll)
4929	{	4929	{
4930	unsigned long gaddr_tmp;	4930	unsigned long gaddr_tmp;
4931	gfn_t gfn;	4931	gfn_t gfn;
@@ -4950,18 +4950,18 @@ static int vcpu_dat_fault_handler(struct kvm_vcpu *vcpu, unsigned long gaddr, un · 18 unmodified lines
4950	}	4950	}
4951	gfn = gpa_to_gfn(gaddr_tmp);	4951	gfn = gpa_to_gfn(gaddr_tmp);
4952	}	4952	}
4953	return __kvm_s390_handle_dat_fault(vcpu, gfn, gaddr, flags);	4953	return __kvm_s390_handle_dat_fault(vcpu, gfn, gaddr, foll);
4954	}	4954	}
4955		4955
4956	static int vcpu_post_run_handle_fault(struct kvm_vcpu *vcpu)	4956	static int vcpu_post_run_handle_fault(struct kvm_vcpu *vcpu)
4957	{	4957	{
4958	unsigned int flags = 0;	4958	unsigned int foll = 0;
4959	unsigned long gaddr;	4959	unsigned long gaddr;
4960	int rc;	4960	int rc;
4961		4961
4962	gaddr = current->thread.gmap_teid.addr * PAGE_SIZE;	4962	gaddr = current->thread.gmap_teid.addr * PAGE_SIZE;
4963	if (kvm_s390_cur_gmap_fault_is_write())	4963	if (kvm_s390_cur_gmap_fault_is_write())
4964	flags = FAULT_FLAG_WRITE;	4964	foll = FOLL_WRITE;
4965		4965
4966	switch (current->thread.gmap_int_code & PGM_INT_CODE_MASK) {	4966	switch (current->thread.gmap_int_code & PGM_INT_CODE_MASK) {
4967	case 0:	4967	case 0:
@@ -5003,7 +5003,7 @@ static int vcpu_post_run_handle_fault(struct kvm_vcpu *vcpu) · 35 unmodified lines
5003	send_sig(SIGSEGV, current, 0);	5003	send_sig(SIGSEGV, current, 0);
5004	if (rc != -ENXIO)	5004	if (rc != -ENXIO)
5005	break;	5005	break;
5006	flags = FAULT_FLAG_WRITE;	5006	foll = FOLL_WRITE;
5007	fallthrough;	5007	fallthrough;
5008	case PGM_PROTECTION:	5008	case PGM_PROTECTION:
5009	case PGM_SEGMENT_TRANSLATION:	5009	case PGM_SEGMENT_TRANSLATION:
@@ -5013,7 +5013,7 @@ static int vcpu_post_run_handle_fault(struct kvm_vcpu *vcpu) · 3 unmodified lines
5013	case PGM_REGION_SECOND_TRANS:	5013	case PGM_REGION_SECOND_TRANS:
5014	case PGM_REGION_THIRD_TRANS:	5014	case PGM_REGION_THIRD_TRANS:
5015	kvm_s390_assert_primary_as(vcpu);	5015	kvm_s390_assert_primary_as(vcpu);
5016	return vcpu_dat_fault_handler(vcpu, gaddr, flags);	5016	return vcpu_dat_fault_handler(vcpu, gaddr, foll);
5017	default:	5017	default:
5018	KVM_BUG(1, vcpu->kvm, "Unexpected program interrupt 0x%x, TEID 0x%016lx",	5018	KVM_BUG(1, vcpu->kvm, "Unexpected program interrupt 0x%x, TEID 0x%016lx",
5019	current->thread.gmap_int_code, current->thread.gmap_teid.val);	5019	current->thread.gmap_int_code, current->thread.gmap_teid.val);

arch/s390/kvm/pv.c+11−5

 	int cc, ret;
 	u16 dummy;
+	/* Add the notifier only once. No races because we hold kvm->lock */
+	if (kvm->arch.pv.mmu_notifier.ops != &kvm_s390_pv_mmu_notifier_ops) {
+		/* The notifier will be unregistered when the VM is destroyed */
+		kvm->arch.pv.mmu_notifier.ops = &kvm_s390_pv_mmu_notifier_ops;
+		ret = mmu_notifier_register(&kvm->arch.pv.mmu_notifier, kvm->mm);
+		if (ret) {
+			kvm->arch.pv.mmu_notifier.ops = NULL;
+			return ret;
+		}
+	}
 	ret = kvm_s390_pv_alloc_vm(kvm);
 	if (ret)
 		return ret;
 		return -EIO;
 	}
 	kvm->arch.gmap->guest_handle = uvcb.guest_handle;
-	/* Add the notifier only once. No races because we hold kvm->lock */
-	if (kvm->arch.pv.mmu_notifier.ops != &kvm_s390_pv_mmu_notifier_ops) {
-		kvm->arch.pv.mmu_notifier.ops = &kvm_s390_pv_mmu_notifier_ops;
-		mmu_notifier_register(&kvm->arch.pv.mmu_notifier, kvm->mm);
-	}
 	return 0;
 }

arch/um/drivers/virtio_uml.c+4−2

 	device_set_wakeup_capable(&vu_dev->vdev.dev, true);
 	rc = register_virtio_device(&vu_dev->vdev);
-	if (rc)
+	if (rc) {
 		put_device(&vu_dev->vdev.dev);
+		return rc;
+	}
 	vu_dev->registered = 1;
-	return rc;
+	return 0;
 error_init:
 	os_close_file(vu_dev->sock);

arch/um/os-Linux/file.c+1−1

@@ -535,7 +535,7 @@ ssize_t os_rcv_fd_msg(int fd, int *fds, unsigned int n_fds, · 534 unmodified lines
535	cmsg->cmsg_type != SCM_RIGHTS)	535	cmsg->cmsg_type != SCM_RIGHTS)
536	return n;	536	return n;
537		537
538	memcpy(fds, CMSG_DATA(cmsg), cmsg->cmsg_len);	538	memcpy(fds, CMSG_DATA(cmsg), cmsg->cmsg_len - CMSG_LEN(0));
539	return n;	539	return n;
540	}	540	}
541		541

arch/um/os-Linux/util.c+1−2

@@ -20,8 +20,7 @@ · 19 unmodified lines
20		20
21	void stack_protections(unsigned long address)	21	void stack_protections(unsigned long address)
22	{	22	{
23	if (mprotect((void *) address, UM_THREAD_SIZE,	23	if (mprotect((void *) address, UM_THREAD_SIZE, PROT_READ \| PROT_WRITE) < 0)
24	PROT_READ \| PROT_WRITE \| PROT_EXEC) < 0)
25	panic("protecting stack failed, errno = %d", errno);	24	panic("protecting stack failed, errno = %d", errno);
26	}	25	}
27		26

arch/x86/kernel/cpu/topology_amd.c+14−11

 static void parse_topology_amd(struct topo_scan *tscan)
 {
-	bool has_topoext = false;
 	/*
-	 * If the extended topology leaf 0x8000_001e is available
+	 * Try to get SMT, CORE, TILE, and DIE shifts from extended
-	 * try to get SMT, CORE, TILE, and DIE shifts from extended
 	 * CPUID leaf 0x8000_0026 on supported processors first. If
 	 * extended CPUID leaf 0x8000_0026 is not supported, try to
-	 * get SMT and CORE shift from leaf 0xb first, then try to
+	 * get SMT and CORE shift from leaf 0xb. If either leaf is
-	 * get the CORE shift from leaf 0x8000_0008.
+	 * available, cpu_parse_topology_ext() will return true.
 	 */
-	if (cpu_feature_enabled(X86_FEATURE_TOPOEXT))
+	bool has_xtopology = cpu_parse_topology_ext(tscan);
-		has_topoext = cpu_parse_topology_ext(tscan);
 	if (cpu_feature_enabled(X86_FEATURE_AMD_HTR_CORES))
 		tscan->c->topo.cpu_type = cpuid_ebx(0x80000026);
-	if (!has_topoext && !parse_8000_0008(tscan))
+	/*
+	 * If XTOPOLOGY leaves (0x26/0xb) are not available, try to
+	 * get the CORE shift from leaf 0x8000_0008 first.
+	 */
+	if (!has_xtopology && !parse_8000_0008(tscan))
 		return;
-	/* Prefer leaf 0x8000001e if available */
+	/*
-	if (parse_8000_001e(tscan, has_topoext))
+	 * Prefer leaf 0x8000001e if available to get the SMT shift and
+	 * the initial APIC ID if XTOPOLOGY leaves are not available.
+	 */
+	if (parse_8000_001e(tscan, has_xtopology))
 		return;
 	/* Try the NODEID MSR */

arch/x86/kvm/svm/svm.c+1−2

@@ -4046,8 +4046,7 @@ static inline void sync_lapic_to_cr8(struct kvm_vcpu *vcpu) · 4045 unmodified lines
4046	struct vcpu_svm *svm = to_svm(vcpu);	4046	struct vcpu_svm *svm = to_svm(vcpu);
4047	u64 cr8;	4047	u64 cr8;
4048		4048
4049	if (nested_svm_virtualize_tpr(vcpu) \|\|	4049	if (nested_svm_virtualize_tpr(vcpu))
4050	kvm_vcpu_apicv_active(vcpu))
4051	return;	4050	return;
4052		4051
4053	cr8 = kvm_get_cr8(vcpu);	4052	cr8 = kvm_get_cr8(vcpu);

drivers/block/zram/zram_drv.c+3−5

 				  u32 index)
 {
 	zram_slot_lock(zram, index);
+	zram_free_page(zram, index);
 	zram_set_flag(zram, index, ZRAM_SAME);
 	zram_set_handle(zram, index, fill);
 	zram_slot_unlock(zram, index);
 	kunmap_local(src);
 	zram_slot_lock(zram, index);
+	zram_free_page(zram, index);
 	zram_set_flag(zram, index, ZRAM_HUGE);
 	zram_set_handle(zram, index, handle);
 	zram_set_obj_size(zram, index, PAGE_SIZE);
 	unsigned long element;
 	bool same_filled;
-	/* First, free memory allocated to this slot (if any) */
-	zram_slot_lock(zram, index);
-	zram_free_page(zram, index);
-	zram_slot_unlock(zram, index);
 	mem = kmap_local_page(page);
 	same_filled = page_same_filled(mem, &element);
 	kunmap_local(mem);
 	zcomp_stream_put(zstrm);
 	zram_slot_lock(zram, index);
+	zram_free_page(zram, index);
 	zram_set_handle(zram, index, handle);
 	zram_set_obj_size(zram, index, comp_len);
 	zram_slot_unlock(zram, index);

drivers/dma/dw/rzn1-dmamux.c+11−4

 	u32 mask;
 	int ret;
-	if (dma_spec->args_count != RNZ1_DMAMUX_NCELLS)
+	if (dma_spec->args_count != RNZ1_DMAMUX_NCELLS) {
-		return ERR_PTR(-EINVAL);
+		ret = -EINVAL;
+		goto put_device;
+	}
 	map = kzalloc(sizeof(*map), GFP_KERNEL);
-	if (!map)
+	if (!map) {
-		return ERR_PTR(-ENOMEM);
+		ret = -ENOMEM;
+		goto put_device;
+	}
 	chan = dma_spec->args[0];
 	map->req_idx = dma_spec->args[4];
 	if (ret)
 		goto clear_bitmap;
+	put_device(&pdev->dev);
 	return map;
 clear_bitmap:
 	clear_bit(map->req_idx, dmamux->used_chans);
 free_map:
 	kfree(map);
+put_device:
+	put_device(&pdev->dev);
 	return ERR_PTR(ret);
 }

drivers/dma/idxd/init.c+21−18

 	idxd->wq_enable_map = bitmap_zalloc_node(idxd->max_wqs, GFP_KERNEL, dev_to_node(dev));
 	if (!idxd->wq_enable_map) {
 		rc = -ENOMEM;
-		goto err_bitmap;
+		goto err_free_wqs;
 	}
 	for (i = 0; i < idxd->max_wqs; i++) {
 		wq = kzalloc_node(sizeof(*wq), GFP_KERNEL, dev_to_node(dev));
 		if (!wq) {
 			rc = -ENOMEM;
-			goto err;
+			goto err_unwind;
 		}
 		idxd_dev_set_type(&wq->idxd_dev, IDXD_DEV_WQ);
 		conf_dev = wq_confdev(wq);
 		wq->id = i;
 		wq->idxd = idxd;
-		device_initialize(wq_confdev(wq));
+		device_initialize(conf_dev);
 		conf_dev->parent = idxd_confdev(idxd);
 		conf_dev->bus = &dsa_bus_type;
 		conf_dev->type = &idxd_wq_device_type;
 		rc = dev_set_name(conf_dev, "wq%d.%d", idxd->id, wq->id);
-		if (rc < 0)
+		if (rc < 0) {
-			goto err;
+			put_device(conf_dev);
+			kfree(wq);
+			goto err_unwind;
+		}
 		mutex_init(&wq->wq_lock);
 		init_waitqueue_head(&wq->err_queue);
 		wq->enqcmds_retries = IDXD_ENQCMDS_RETRIES;
 		wq->wqcfg = kzalloc_node(idxd->wqcfg_size, GFP_KERNEL, dev_to_node(dev));
 		if (!wq->wqcfg) {
+			put_device(conf_dev);
+			kfree(wq);
 			rc = -ENOMEM;
-			goto err;
+			goto err_unwind;
 		}
 		if (idxd->hw.wq_cap.op_config) {
 			wq->opcap_bmap = bitmap_zalloc(IDXD_MAX_OPCAP_BITS, GFP_KERNEL);
 			if (!wq->opcap_bmap) {
+				kfree(wq->wqcfg);
+				put_device(conf_dev);
+				kfree(wq);
 				rc = -ENOMEM;
-				goto err_opcap_bmap;
+				goto err_unwind;
 			}
 			bitmap_copy(wq->opcap_bmap, idxd->opcap_bmap, IDXD_MAX_OPCAP_BITS);
 		}
 	return 0;
-err_opcap_bmap:
+err_unwind:
-	kfree(wq->wqcfg);
-err:
-	put_device(conf_dev);
-	kfree(wq);
 	while (--i >= 0) {
 		wq = idxd->wqs[i];
 		if (idxd->hw.wq_cap.op_config)
 		conf_dev = wq_confdev(wq);
 		put_device(conf_dev);
 		kfree(wq);
 	}
 	bitmap_free(idxd->wq_enable_map);
-err_bitmap:
+err_free_wqs:
 	kfree(idxd->wqs);
 	return rc;
 	device_unregister(idxd_confdev(idxd));
 	idxd_shutdown(pdev);
 	idxd_device_remove_debugfs(idxd);
-	idxd_cleanup(idxd);
+	perfmon_pmu_remove(idxd);
+	idxd_cleanup_interrupts(idxd);
+	if (device_pasid_enabled(idxd))
+		idxd_disable_system_pasid(idxd);
 	pci_iounmap(pdev, idxd->reg_base);
 	put_device(idxd_confdev(idxd));
-	idxd_free(idxd);
 	pci_disable_device(pdev);
 }

drivers/dma/qcom/bam_dma.c+6−2

 	if (!bdev->bamclk) {
 		ret = of_property_read_u32(pdev->dev.of_node, "num-channels",
 					   &bdev->num_channels);
-		if (ret)
+		if (ret) {
 			dev_err(bdev->dev, "num-channels unspecified in dt\n");
+			return ret;
+		}
 		ret = of_property_read_u32(pdev->dev.of_node, "qcom,num-ees",
 					   &bdev->num_ees);
-		if (ret)
+		if (ret) {
 			dev_err(bdev->dev, "num-ees unspecified in dt\n");
+			return ret;
+		}
 	}
 	ret = clk_prepare_enable(bdev->bamclk);

drivers/dma/ti/edma.c+2−2

@@ -2064,8 +2064,8 @@ static int edma_setup_from_hw(struct device dev, struct edma_soc_info pdata, · 2063 unmodified lines
2064	* priority. So Q0 is the highest priority queue and the last queue has	2064	* priority. So Q0 is the highest priority queue and the last queue has
2065	* the lowest priority.	2065	* the lowest priority.
2066	*/	2066	*/
2067	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8),	2067	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1,
2068	GFP_KERNEL);	2068	sizeof(*queue_priority_map), GFP_KERNEL);
2069	if (!queue_priority_map)	2069	if (!queue_priority_map)
2070	return -ENOMEM;	2070	return -ENOMEM;
2071		2071

drivers/dpll/dpll_netlink.c+2−2

 dpll_msg_add_clock_quality_level(struct sk_buff *msg, struct dpll_device *dpll,
 				 struct netlink_ext_ack *extack)
 {
+	DECLARE_BITMAP(qls, DPLL_CLOCK_QUALITY_LEVEL_MAX + 1) = { 0 };
 	const struct dpll_device_ops *ops = dpll_device_ops(dpll);
-	DECLARE_BITMAP(qls, DPLL_CLOCK_QUALITY_LEVEL_MAX) = { 0 };
 	enum dpll_clock_quality_level ql;
 	int ret;
 	ret = ops->clock_quality_level_get(dpll, dpll_priv(dpll), qls, extack);
 	if (ret)
 		return ret;
-	for_each_set_bit(ql, qls, DPLL_CLOCK_QUALITY_LEVEL_MAX)
+	for_each_set_bit(ql, qls, DPLL_CLOCK_QUALITY_LEVEL_MAX + 1)
 		if (nla_put_u32(msg, DPLL_A_CLOCK_QUALITY_LEVEL, ql))
 			return -EMSGSIZE;

drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c+32−12

 	spin_lock(&kfd_mem_limit.mem_limit_lock);
 	if (kfd_mem_limit.system_mem_used + system_mem_needed >
-	    kfd_mem_limit.max_system_mem_limit)
+	    kfd_mem_limit.max_system_mem_limit) {
 		pr_debug("Set no_system_mem_limit=1 if using shared memory\n");
+		if (!no_system_mem_limit) {
+			ret = -ENOMEM;
+			goto release;
+		}
+	}
-	if ((kfd_mem_limit.system_mem_used + system_mem_needed >
+	if (kfd_mem_limit.ttm_mem_used + ttm_mem_needed >
-	     kfd_mem_limit.max_system_mem_limit && !no_system_mem_limit) ||
+		kfd_mem_limit.max_ttm_mem_limit) {
-	    (kfd_mem_limit.ttm_mem_used + ttm_mem_needed >
-	     kfd_mem_limit.max_ttm_mem_limit) ||
-	    (adev && xcp_id >= 0 && adev->kfd.vram_used[xcp_id] + vram_needed >
-	     vram_size - reserved_for_pt - reserved_for_ras - atomic64_read(&adev->vram_pin_size))) {
 		ret = -ENOMEM;
 		goto release;
 	}
+	/*if is_app_apu is false and apu_prefer_gtt is true, it is an APU with
+	 * carve out < gtt. In that case, VRAM allocation will go to gtt domain, skip
+	 * VRAM check since ttm_mem_limit check already cover this allocation
+	 */
+	if (adev && xcp_id >= 0 && (!adev->apu_prefer_gtt || adev->gmc.is_app_apu)) {
+		uint64_t vram_available =
+			vram_size - reserved_for_pt - reserved_for_ras -
+			atomic64_read(&adev->vram_pin_size);
+		if (adev->kfd.vram_used[xcp_id] + vram_needed > vram_available) {
+			ret = -ENOMEM;
+			goto release;
+		}
+	}
 	/* Update memory accounting by decreasing available system
 	 * memory, TTM memory and GPU memory as computed above
 	 */
 	uint64_t vram_available, system_mem_available, ttm_mem_available;
 	spin_lock(&kfd_mem_limit.mem_limit_lock);
-	vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)
+	if (adev->apu_prefer_gtt && !adev->gmc.is_app_apu)
-		- adev->kfd.vram_used_aligned[xcp_id]
+		vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)
-		- atomic64_read(&adev->vram_pin_size)
+			- adev->kfd.vram_used_aligned[xcp_id];
-		- reserved_for_pt
+	else
-		- reserved_for_ras;
+		vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)
+			- adev->kfd.vram_used_aligned[xcp_id]
+			- atomic64_read(&adev->vram_pin_size)
+			- reserved_for_pt
+			- reserved_for_ras;
 	if (adev->apu_prefer_gtt) {
 		system_mem_available = no_system_mem_limit ?

drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c+0−2

@@ -421,8 +421,6 @@ void amdgpu_ring_fini(struct amdgpu_ring *ring) · 420 unmodified lines
421	dma_fence_put(ring->vmid_wait);	421	dma_fence_put(ring->vmid_wait);
422	ring->vmid_wait = NULL;	422	ring->vmid_wait = NULL;
423	ring->me = 0;	423	ring->me = 0;
424
425	ring->adev->rings[ring->idx] = NULL;
426	}	424	}
427		425
428	/**	426	/**

drivers/gpu/drm/amd/amdgpu/isp_v4_1_1.c+2−0

@@ -29,6 +29,8 @@ · 28 unmodified lines
29	#include "amdgpu.h"	29	#include "amdgpu.h"
30	#include "isp_v4_1_1.h"	30	#include "isp_v4_1_1.h"
31		31
		32	MODULE_FIRMWARE("amdgpu/isp_4_1_1.bin");
		33
32	#define ISP_PERFORMANCE_STATE_LOW 0	34	#define ISP_PERFORMANCE_STATE_LOW 0
33	#define ISP_PERFORMANCE_STATE_HIGH 1	35	#define ISP_PERFORMANCE_STATE_HIGH 1
34		36

drivers/gpu/drm/amd/amdgpu/psp_v11_0.c+4−15

 	int ret;
 	int retry_loop;
-	for (retry_loop = 0; retry_loop < 10; retry_loop++) {
+	for (retry_loop = 0; retry_loop < 20; retry_loop++) {
 		/* Wait for bootloader to signify that is
 		    ready having bit 31 of C2PMSG_35 set to 1 */
 		ret = psp_wait_for(
 			psp, SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_35),
-			0x80000000, 0x80000000, PSP_WAITREG_NOVERBOSE);
+			0x80000000, 0x8000FFFF, PSP_WAITREG_NOVERBOSE);
 		if (ret == 0)
 			return 0;
 	msleep(500);
-	offset = SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_33);
-	ret = psp_wait_for(psp, offset, MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK,
-			   0);
-	if (ret) {
-		DRM_INFO("psp mode 1 reset failed!\n");
-		return -EINVAL;
-	}
-	DRM_INFO("psp mode1 reset succeed \n");
 	return 0;
 }
 	.ring_get_wptr = psp_v11_0_ring_get_wptr,
 	.ring_set_wptr = psp_v11_0_ring_set_wptr,
 	.load_usbc_pd_fw = psp_v11_0_load_usbc_pd_fw,
-	.read_usbc_pd_fw = psp_v11_0_read_usbc_pd_fw
+	.read_usbc_pd_fw = psp_v11_0_read_usbc_pd_fw,
+	.wait_for_bootloader = psp_v11_0_wait_for_bootloader
 };
 void psp_v11_0_set_psp_funcs(struct psp_context *psp)

drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c+8−4

@@ -1888,15 +1888,19 @@ static int vcn_v3_0_limit_sched(struct amdgpu_cs_parser *p, · 1887 unmodified lines
1888	struct amdgpu_job *job)	1888	struct amdgpu_job *job)
1889	{	1889	{
1890	struct drm_gpu_scheduler **scheds;	1890	struct drm_gpu_scheduler **scheds;
1891		1891	struct dma_fence *fence;
1892	/* The create msg must be in the first IB submitted */
1893	if (atomic_read(&job->base.entity->fence_seq))
1894	return -EINVAL;
1895		1892
1896	/* if VCN0 is harvested, we can't support AV1 */	1893	/* if VCN0 is harvested, we can't support AV1 */
1897	if (p->adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0)	1894	if (p->adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0)
1898	return -EINVAL;	1895	return -EINVAL;
1899		1896
		1897	/* wait for all jobs to finish before switching to instance 0 */
		1898	fence = amdgpu_ctx_get_fence(p->ctx, job->base.entity, ~0ull);
		1899	if (fence) {
		1900	dma_fence_wait(fence, false);
		1901	dma_fence_put(fence);
		1902	}
		1903
1900	scheds = p->adev->gpu_sched[AMDGPU_HW_IP_VCN_DEC]	1904	scheds = p->adev->gpu_sched[AMDGPU_HW_IP_VCN_DEC]
1901	[AMDGPU_RING_PRIO_DEFAULT].sched;	1905	[AMDGPU_RING_PRIO_DEFAULT].sched;
1902	drm_sched_entity_modify_sched(job->base.entity, scheds, 1);	1906	drm_sched_entity_modify_sched(job->base.entity, scheds, 1);

drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c+29−35

@@ -1808,15 +1808,19 @@ static int vcn_v4_0_limit_sched(struct amdgpu_cs_parser *p, · 1807 unmodified lines
1808	struct amdgpu_job *job)	1808	struct amdgpu_job *job)
1809	{	1809	{
1810	struct drm_gpu_scheduler **scheds;	1810	struct drm_gpu_scheduler **scheds;
1811		1811	struct dma_fence *fence;
1812	/* The create msg must be in the first IB submitted */
1813	if (atomic_read(&job->base.entity->fence_seq))
1814	return -EINVAL;
1815		1812
1816	/* if VCN0 is harvested, we can't support AV1 */	1813	/* if VCN0 is harvested, we can't support AV1 */
1817	if (p->adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0)	1814	if (p->adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0)
1818	return -EINVAL;	1815	return -EINVAL;
1819		1816
		1817	/* wait for all jobs to finish before switching to instance 0 */
		1818	fence = amdgpu_ctx_get_fence(p->ctx, job->base.entity, ~0ull);
		1819	if (fence) {
		1820	dma_fence_wait(fence, false);
		1821	dma_fence_put(fence);
		1822	}
		1823
1820	scheds = p->adev->gpu_sched[AMDGPU_HW_IP_VCN_ENC]	1824	scheds = p->adev->gpu_sched[AMDGPU_HW_IP_VCN_ENC]
1821	[AMDGPU_RING_PRIO_0].sched;	1825	[AMDGPU_RING_PRIO_0].sched;
1822	drm_sched_entity_modify_sched(job->base.entity, scheds, 1);	1826	drm_sched_entity_modify_sched(job->base.entity, scheds, 1);
@@ -1907,22 +1911,16 @@ out: · 84 unmodified lines
1907		1911
1908	#define RADEON_VCN_ENGINE_TYPE_ENCODE (0x00000002)	1912	#define RADEON_VCN_ENGINE_TYPE_ENCODE (0x00000002)
1909	#define RADEON_VCN_ENGINE_TYPE_DECODE (0x00000003)	1913	#define RADEON_VCN_ENGINE_TYPE_DECODE (0x00000003)
1910
1911	#define RADEON_VCN_ENGINE_INFO (0x30000001)	1914	#define RADEON_VCN_ENGINE_INFO (0x30000001)
1912	#define RADEON_VCN_ENGINE_INFO_MAX_OFFSET 16
1913
1914	#define RENCODE_ENCODE_STANDARD_AV1 2	1915	#define RENCODE_ENCODE_STANDARD_AV1 2
1915	#define RENCODE_IB_PARAM_SESSION_INIT 0x00000003	1916	#define RENCODE_IB_PARAM_SESSION_INIT 0x00000003
1916	#define RENCODE_IB_PARAM_SESSION_INIT_MAX_OFFSET 64
1917		1917
1918	/* return the offset in ib if id is found, -1 otherwise	1918	/* return the offset in ib if id is found, -1 otherwise */
1919	* to speed up the searching we only search upto max_offset	1919	static int vcn_v4_0_enc_find_ib_param(struct amdgpu_ib *ib, uint32_t id, int start)
1920	*/
1921	static int vcn_v4_0_enc_find_ib_param(struct amdgpu_ib *ib, uint32_t id, int max_offset)
1922	{	1920	{
1923	int i;	1921	int i;
1924		1922
1925	for (i = 0; i < ib->length_dw && i < max_offset && ib->ptr[i] >= 8; i += ib->ptr[i]/4) {	1923	for (i = start; i < ib->length_dw && ib->ptr[i] >= 8; i += ib->ptr[i] / 4) {
1926	if (ib->ptr[i + 1] == id)	1924	if (ib->ptr[i + 1] == id)
1927	return i;	1925	return i;
1928	}	1926	}
@@ -1937,33 +1935,29 @@ static int vcn_v4_0_ring_patch_cs_in_place(struct amdgpu_cs_parser *p, · 8 unmodified lines
1937	struct amdgpu_vcn_decode_buffer *decode_buffer;	1935	struct amdgpu_vcn_decode_buffer *decode_buffer;
1938	uint64_t addr;	1936	uint64_t addr;
1939	uint32_t val;	1937	uint32_t val;
1940	int idx;	1938	int idx = 0, sidx;
1941		1939
1942	/* The first instance can decode anything */	1940	/* The first instance can decode anything */
1943	if (!ring->me)	1941	if (!ring->me)
1944	return 0;	1942	return 0;
1945		1943
1946	/* RADEON_VCN_ENGINE_INFO is at the top of ib block */	1944	while ((idx = vcn_v4_0_enc_find_ib_param(ib, RADEON_VCN_ENGINE_INFO, idx)) >= 0) {
1947	idx = vcn_v4_0_enc_find_ib_param(ib, RADEON_VCN_ENGINE_INFO,	1945	val = amdgpu_ib_get_value(ib, idx + 2); /* RADEON_VCN_ENGINE_TYPE */
1948	RADEON_VCN_ENGINE_INFO_MAX_OFFSET);	1946	if (val == RADEON_VCN_ENGINE_TYPE_DECODE) {
1949	if (idx < 0) /* engine info is missing */	1947	decode_buffer = (struct amdgpu_vcn_decode_buffer *)&ib->ptr[idx + 6];
1950	return 0;	1948
1951		1949	if (!(decode_buffer->valid_buf_flag & 0x1))
1952	val = amdgpu_ib_get_value(ib, idx + 2); /* RADEON_VCN_ENGINE_TYPE */	1950	return 0;
1953	if (val == RADEON_VCN_ENGINE_TYPE_DECODE) {	1951
1954	decode_buffer = (struct amdgpu_vcn_decode_buffer *)&ib->ptr[idx + 6];	1952	addr = ((u64)decode_buffer->msg_buffer_address_hi) << 32 \|
1955		1953	decode_buffer->msg_buffer_address_lo;
1956	if (!(decode_buffer->valid_buf_flag & 0x1))	1954	return vcn_v4_0_dec_msg(p, job, addr);
1957	return 0;	1955	} else if (val == RADEON_VCN_ENGINE_TYPE_ENCODE) {
1958		1956	sidx = vcn_v4_0_enc_find_ib_param(ib, RENCODE_IB_PARAM_SESSION_INIT, idx);
1959	addr = ((u64)decode_buffer->msg_buffer_address_hi) << 32 \|	1957	if (sidx >= 0 && ib->ptr[sidx + 2] == RENCODE_ENCODE_STANDARD_AV1)
1960	decode_buffer->msg_buffer_address_lo;	1958	return vcn_v4_0_limit_sched(p, job);
1961	return vcn_v4_0_dec_msg(p, job, addr);	1959	}
1962	} else if (val == RADEON_VCN_ENGINE_TYPE_ENCODE) {	1960	idx += ib->ptr[idx] / 4;
1963	idx = vcn_v4_0_enc_find_ib_param(ib, RENCODE_IB_PARAM_SESSION_INIT,
1964	RENCODE_IB_PARAM_SESSION_INIT_MAX_OFFSET);
1965	if (idx >= 0 && ib->ptr[idx + 2] == RENCODE_ENCODE_STANDARD_AV1)
1966	return vcn_v4_0_limit_sched(p, job);
1967	}	1961	}
1968	return 0;	1962	return 0;
1969	}	1963	}

drivers/gpu/drm/amd/amdkfd/kfd_topology.c+2−1

@@ -1587,7 +1587,8 @@ static int kfd_dev_create_p2p_links(void) · 1586 unmodified lines
1587	break;	1587	break;
1588	if (!dev->gpu \|\| !dev->gpu->adev \|\|	1588	if (!dev->gpu \|\| !dev->gpu->adev \|\|
1589	(dev->gpu->kfd->hive_id &&	1589	(dev->gpu->kfd->hive_id &&
1590	dev->gpu->kfd->hive_id == new_dev->gpu->kfd->hive_id))	1590	dev->gpu->kfd->hive_id == new_dev->gpu->kfd->hive_id &&
		1591	amdgpu_xgmi_get_is_sharing_enabled(dev->gpu->adev, new_dev->gpu->adev)))
1591	goto next;	1592	goto next;
1592		1593
1593	/* check if node(s) is/are peer accessible in one direction or bi-direction */	1594	/* check if node(s) is/are peer accessible in one direction or bi-direction */

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c+12−22

 	return 0;
 }
+static void dm_oem_i2c_hw_fini(struct amdgpu_device *adev)
+{
+	struct amdgpu_display_manager *dm = &adev->dm;
+	if (dm->oem_i2c) {
+		i2c_del_adapter(&dm->oem_i2c->base);
+		kfree(dm->oem_i2c);
+		dm->oem_i2c = NULL;
+	}
+}
 /**
  * dm_hw_init() - Initialize DC device
  * @ip_block: Pointer to the amdgpu_ip_block for this hw instance.
 {
 	struct amdgpu_device *adev = ip_block->adev;
-	kfree(adev->dm.oem_i2c);
+	dm_oem_i2c_hw_fini(adev);
 	amdgpu_dm_hpd_fini(adev);
 	dm->cached_state = NULL;
 }
-static void dm_complete(struct amdgpu_ip_block *ip_block)
-{
-	struct amdgpu_device *adev = ip_block->adev;
-	dm_destroy_cached_state(adev);
-}
-static int dm_prepare_suspend(struct amdgpu_ip_block *ip_block)
-{
-	struct amdgpu_device *adev = ip_block->adev;
-	if (amdgpu_in_reset(adev))
-		return 0;
-	WARN_ON(adev->dm.cached_state);
-	return dm_cache_state(adev);
-}
 static int dm_suspend(struct amdgpu_ip_block *ip_block)
 {
 	struct amdgpu_device *adev = ip_block->adev;
 	.early_fini = amdgpu_dm_early_fini,
 	.hw_init = dm_hw_init,
 	.hw_fini = dm_hw_fini,
-	.prepare_suspend = dm_prepare_suspend,
 	.suspend = dm_suspend,
 	.resume = dm_resume,
-	.complete = dm_complete,
 	.is_idle = dm_is_idle,
 	.wait_for_idle = dm_wait_for_idle,
 	.check_soft_reset = dm_check_soft_reset,

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c+1−0

@@ -809,6 +809,7 @@ void amdgpu_dm_initialize_dp_connector(struct amdgpu_display_manager *dm, · 808 unmodified lines
809	drm_dp_aux_init(&aconnector->dm_dp_aux.aux);	809	drm_dp_aux_init(&aconnector->dm_dp_aux.aux);
810	drm_dp_cec_register_connector(&aconnector->dm_dp_aux.aux,	810	drm_dp_cec_register_connector(&aconnector->dm_dp_aux.aux,
811	&aconnector->base);	811	&aconnector->base);
		812	drm_dp_dpcd_set_probe(&aconnector->dm_dp_aux.aux, false);
812		813
813	if (aconnector->base.connector_type == DRM_MODE_CONNECTOR_eDP)	814	if (aconnector->base.connector_type == DRM_MODE_CONNECTOR_eDP)
814	return;	815	return;

drivers/gpu/drm/amd/display/dc/dc.h+1−0

@@ -1145,6 +1145,7 @@ struct dc_debug_options { · 1144 unmodified lines
1145	bool enable_hblank_borrow;	1145	bool enable_hblank_borrow;
1146	bool force_subvp_df_throttle;	1146	bool force_subvp_df_throttle;
1147	uint32_t acpi_transition_bitmasks[MAX_PIPES];	1147	uint32_t acpi_transition_bitmasks[MAX_PIPES];
		1148	bool enable_pg_cntl_debug_logs;
1148	};	1149	};
1149		1150
1150		1151

drivers/gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c+39−35

@@ -133,30 +133,34 @@ enum dsc_clk_source { · 132 unmodified lines
133	};	133	};
134		134
135		135
136	static void dccg35_set_dsc_clk_rcg(struct dccg *dccg, int inst, bool enable)	136	static void dccg35_set_dsc_clk_rcg(struct dccg *dccg, int inst, bool allow_rcg)
137	{	137	{
138	struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg);	138	struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg);
139		139
140	if (!dccg->ctx->dc->debug.root_clock_optimization.bits.dsc && enable)	140	if (!dccg->ctx->dc->debug.root_clock_optimization.bits.dsc && allow_rcg)
141	return;	141	return;
142		142
143	switch (inst) {	143	switch (inst) {
144	case 0:	144	case 0:
145	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DSCCLK0_ROOT_GATE_DISABLE, enable ? 0 : 1);	145	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DSCCLK0_ROOT_GATE_DISABLE, allow_rcg ? 0 : 1);
146	break;	146	break;
147	case 1:	147	case 1:
148	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DSCCLK1_ROOT_GATE_DISABLE, enable ? 0 : 1);	148	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DSCCLK1_ROOT_GATE_DISABLE, allow_rcg ? 0 : 1);
149	break;	149	break;
150	case 2:	150	case 2:
151	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DSCCLK2_ROOT_GATE_DISABLE, enable ? 0 : 1);	151	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DSCCLK2_ROOT_GATE_DISABLE, allow_rcg ? 0 : 1);
152	break;	152	break;
153	case 3:	153	case 3:
154	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DSCCLK3_ROOT_GATE_DISABLE, enable ? 0 : 1);	154	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DSCCLK3_ROOT_GATE_DISABLE, allow_rcg ? 0 : 1);
155	break;	155	break;
156	default:	156	default:
157	BREAK_TO_DEBUGGER();	157	BREAK_TO_DEBUGGER();
158	return;	158	return;
159	}	159	}
		160
		161	/* Wait for clock to ramp */
		162	if (!allow_rcg)
		163	udelay(10);
160	}	164	}
161		165
162	static void dccg35_set_symclk32_se_rcg(	166	static void dccg35_set_symclk32_se_rcg(
@@ -385,35 +389,34 @@ static void dccg35_set_dtbclk_p_rcg(struct dccg *dccg, int inst, bool enable) · 222 unmodified lines
385	}	389	}
386	}	390	}
387		391
388	static void dccg35_set_dppclk_rcg(struct dccg *dccg,	392	static void dccg35_set_dppclk_rcg(struct dccg *dccg, int inst, bool allow_rcg)
389	int inst, bool enable)
390	{	393	{
391
392	struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg);	394	struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg);
393		395
394		396	if (!dccg->ctx->dc->debug.root_clock_optimization.bits.dpp && allow_rcg)
395	if (!dccg->ctx->dc->debug.root_clock_optimization.bits.dpp && enable)
396	return;	397	return;
397		398
398	switch (inst) {	399	switch (inst) {
399	case 0:	400	case 0:
400	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK0_ROOT_GATE_DISABLE, enable ? 0 : 1);	401	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK0_ROOT_GATE_DISABLE, allow_rcg ? 0 : 1);
401	break;	402	break;
402	case 1:	403	case 1:
403	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK1_ROOT_GATE_DISABLE, enable ? 0 : 1);	404	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK1_ROOT_GATE_DISABLE, allow_rcg ? 0 : 1);
404	break;	405	break;
405	case 2:	406	case 2:
406	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK2_ROOT_GATE_DISABLE, enable ? 0 : 1);	407	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK2_ROOT_GATE_DISABLE, allow_rcg ? 0 : 1);
407	break;	408	break;
408	case 3:	409	case 3:
409	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK3_ROOT_GATE_DISABLE, enable ? 0 : 1);	410	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK3_ROOT_GATE_DISABLE, allow_rcg ? 0 : 1);
410	break;	411	break;
411	default:	412	default:
412	BREAK_TO_DEBUGGER();	413	BREAK_TO_DEBUGGER();
413	break;	414	break;
414	}	415	}
415	//DC_LOG_DEBUG("%s: inst(%d) DPPCLK rcg_disable: %d\n", __func__, inst, enable ? 0 : 1);
416		416
		417	/* Wait for clock to ramp */
		418	if (!allow_rcg)
		419	udelay(10);
417	}	420	}
418		421
419	static void dccg35_set_dpstreamclk_rcg(	422	static void dccg35_set_dpstreamclk_rcg(
@@ -1177,32 +1180,34 @@ static void dccg35_update_dpp_dto(struct dccg *dccg, int dpp_inst, · 757 unmodified lines
1177	}	1180	}
1178		1181
1179	static void dccg35_set_dppclk_root_clock_gating(struct dccg *dccg,	1182	static void dccg35_set_dppclk_root_clock_gating(struct dccg *dccg,
1180	uint32_t dpp_inst, uint32_t enable)	1183	uint32_t dpp_inst, uint32_t disallow_rcg)
1181	{	1184	{
1182	struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg);	1185	struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg);
1183		1186
1184	if (!dccg->ctx->dc->debug.root_clock_optimization.bits.dpp)	1187	if (!dccg->ctx->dc->debug.root_clock_optimization.bits.dpp && !disallow_rcg)
1185	return;	1188	return;
1186		1189
1187		1190
1188	switch (dpp_inst) {	1191	switch (dpp_inst) {
1189	case 0:	1192	case 0:
1190	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK0_ROOT_GATE_DISABLE, enable);	1193	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK0_ROOT_GATE_DISABLE, disallow_rcg);
1191	break;	1194	break;
1192	case 1:	1195	case 1:
1193	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK1_ROOT_GATE_DISABLE, enable);	1196	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK1_ROOT_GATE_DISABLE, disallow_rcg);
1194	break;	1197	break;
1195	case 2:	1198	case 2:
1196	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK2_ROOT_GATE_DISABLE, enable);	1199	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK2_ROOT_GATE_DISABLE, disallow_rcg);
1197	break;	1200	break;
1198	case 3:	1201	case 3:
1199	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK3_ROOT_GATE_DISABLE, enable);	1202	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DPPCLK3_ROOT_GATE_DISABLE, disallow_rcg);
1200	break;	1203	break;
1201	default:	1204	default:
1202	break;	1205	break;
1203	}	1206	}
1204	//DC_LOG_DEBUG("%s: dpp_inst(%d) rcg: %d\n", __func__, dpp_inst, enable);
1205		1207
		1208	/* Wait for clock to ramp */
		1209	if (disallow_rcg)
		1210	udelay(10);
1206	}	1211	}
1207		1212
1208	static void dccg35_get_pixel_rate_div(	1213	static void dccg35_get_pixel_rate_div(
@@ -1782,8 +1787,7 @@ static void dccg35_enable_dscclk(struct dccg *dccg, int inst) · 573 unmodified lines
1782	//Disable DTO	1787	//Disable DTO
1783	switch (inst) {	1788	switch (inst) {
1784	case 0:	1789	case 0:
1785	if (dccg->ctx->dc->debug.root_clock_optimization.bits.dsc)	1790	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DSCCLK0_ROOT_GATE_DISABLE, 1);
1786	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DSCCLK0_ROOT_GATE_DISABLE, 1);
1787		1791
1788	REG_UPDATE_2(DSCCLK0_DTO_PARAM,	1792	REG_UPDATE_2(DSCCLK0_DTO_PARAM,
1789	DSCCLK0_DTO_PHASE, 0,	1793	DSCCLK0_DTO_PHASE, 0,
@@ -1791,8 +1795,7 @@ static void dccg35_enable_dscclk(struct dccg *dccg, int inst) · 1 unmodified line
1791	REG_UPDATE(DSCCLK_DTO_CTRL, DSCCLK0_EN, 1);	1795	REG_UPDATE(DSCCLK_DTO_CTRL, DSCCLK0_EN, 1);
1792	break;	1796	break;
1793	case 1:	1797	case 1:
1794	if (dccg->ctx->dc->debug.root_clock_optimization.bits.dsc)	1798	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DSCCLK1_ROOT_GATE_DISABLE, 1);
1795	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DSCCLK1_ROOT_GATE_DISABLE, 1);
1796		1799
1797	REG_UPDATE_2(DSCCLK1_DTO_PARAM,	1800	REG_UPDATE_2(DSCCLK1_DTO_PARAM,
1798	DSCCLK1_DTO_PHASE, 0,	1801	DSCCLK1_DTO_PHASE, 0,
@@ -1800,8 +1803,7 @@ static void dccg35_enable_dscclk(struct dccg *dccg, int inst) · 1 unmodified line
1800	REG_UPDATE(DSCCLK_DTO_CTRL, DSCCLK1_EN, 1);	1803	REG_UPDATE(DSCCLK_DTO_CTRL, DSCCLK1_EN, 1);
1801	break;	1804	break;
1802	case 2:	1805	case 2:
1803	if (dccg->ctx->dc->debug.root_clock_optimization.bits.dsc)	1806	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DSCCLK2_ROOT_GATE_DISABLE, 1);
1804	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DSCCLK2_ROOT_GATE_DISABLE, 1);
1805		1807
1806	REG_UPDATE_2(DSCCLK2_DTO_PARAM,	1808	REG_UPDATE_2(DSCCLK2_DTO_PARAM,
1807	DSCCLK2_DTO_PHASE, 0,	1809	DSCCLK2_DTO_PHASE, 0,
@@ -1809,8 +1811,7 @@ static void dccg35_enable_dscclk(struct dccg *dccg, int inst) · 1 unmodified line
1809	REG_UPDATE(DSCCLK_DTO_CTRL, DSCCLK2_EN, 1);	1811	REG_UPDATE(DSCCLK_DTO_CTRL, DSCCLK2_EN, 1);
1810	break;	1812	break;
1811	case 3:	1813	case 3:
1812	if (dccg->ctx->dc->debug.root_clock_optimization.bits.dsc)	1814	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DSCCLK3_ROOT_GATE_DISABLE, 1);
1813	REG_UPDATE(DCCG_GATE_DISABLE_CNTL6, DSCCLK3_ROOT_GATE_DISABLE, 1);
1814		1815
1815	REG_UPDATE_2(DSCCLK3_DTO_PARAM,	1816	REG_UPDATE_2(DSCCLK3_DTO_PARAM,
1816	DSCCLK3_DTO_PHASE, 0,	1817	DSCCLK3_DTO_PHASE, 0,
@@ -1821,6 +1822,9 @@ static void dccg35_enable_dscclk(struct dccg *dccg, int inst) · 4 unmodified lines
1821	BREAK_TO_DEBUGGER();	1822	BREAK_TO_DEBUGGER();
1822	return;	1823	return;
1823	}	1824	}
		1825
		1826	/* Wait for clock to ramp */
		1827	udelay(10);
1824	}	1828	}
1825		1829
1826	static void dccg35_disable_dscclk(struct dccg *dccg,	1830	static void dccg35_disable_dscclk(struct dccg *dccg,
@@ -1864,6 +1868,9 @@ static void dccg35_disable_dscclk(struct dccg *dccg, · 37 unmodified lines
1864	default:	1868	default:
1865	return;	1869	return;
1866	}	1870	}
		1871
		1872	/* Wait for clock ramp */
		1873	udelay(10);
1867	}	1874	}
1868		1875
1869	static void dccg35_enable_symclk_se(struct dccg *dccg, uint32_t stream_enc_inst, uint32_t link_enc_inst)	1876	static void dccg35_enable_symclk_se(struct dccg *dccg, uint32_t stream_enc_inst, uint32_t link_enc_inst)
@@ -2349,10 +2356,7 @@ static void dccg35_disable_symclk_se_cb( · 479 unmodified lines
2349		2356
2350	void dccg35_root_gate_disable_control(struct dccg *dccg, uint32_t pipe_idx, uint32_t disable_clock_gating)	2357	void dccg35_root_gate_disable_control(struct dccg *dccg, uint32_t pipe_idx, uint32_t disable_clock_gating)
2351	{	2358	{
2352		2359	dccg35_set_dppclk_root_clock_gating(dccg, pipe_idx, disable_clock_gating);
2353	if (dccg->ctx->dc->debug.root_clock_optimization.bits.dpp) {
2354	dccg35_set_dppclk_root_clock_gating(dccg, pipe_idx, disable_clock_gating);
2355	}
2356	}	2360	}
2357		2361
2358	static const struct dccg_funcs dccg35_funcs_new = {	2362	static const struct dccg_funcs dccg35_funcs_new = {

drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c+1−1

@@ -955,7 +955,7 @@ enum dc_status dcn20_enable_stream_timing( · 954 unmodified lines
955	return DC_ERROR_UNEXPECTED;	955	return DC_ERROR_UNEXPECTED;
956	}	956	}
957		957
958	fsleep(stream->timing.v_total * (stream->timing.h_total * 10000u / stream->timing.pix_clk_100hz));	958	udelay(stream->timing.v_total * (stream->timing.h_total * 10000u / stream->timing.pix_clk_100hz));
959		959
960	params.vertical_total_min = stream->adjust.v_total_min;	960	params.vertical_total_min = stream->adjust.v_total_min;
961	params.vertical_total_max = stream->adjust.v_total_max;	961	params.vertical_total_max = stream->adjust.v_total_max;

drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c+20−95

@@ -113,6 +113,14 @@ static void enable_memory_low_power(struct dc *dc) · 112 unmodified lines
113	}	113	}
114	#endif	114	#endif
115		115
		116	static void print_pg_status(struct dc dc, const char debug_func, const char *debug_log)
		117	{
		118	if (dc->debug.enable_pg_cntl_debug_logs && dc->res_pool->pg_cntl) {
		119	if (dc->res_pool->pg_cntl->funcs->print_pg_status)
		120	dc->res_pool->pg_cntl->funcs->print_pg_status(dc->res_pool->pg_cntl, debug_func, debug_log);
		121	}
		122	}
		123
116	void dcn35_set_dmu_fgcg(struct dce_hwseq *hws, bool enable)	124	void dcn35_set_dmu_fgcg(struct dce_hwseq *hws, bool enable)
117	{	125	{
118	REG_UPDATE_3(DMU_CLK_CNTL,	126	REG_UPDATE_3(DMU_CLK_CNTL,
@@ -137,6 +145,8 @@ void dcn35_init_hw(struct dc *dc) · 18 unmodified lines
137	uint32_t user_level = MAX_BACKLIGHT_LEVEL;	145	uint32_t user_level = MAX_BACKLIGHT_LEVEL;
138	int i;	146	int i;
139		147
		148	print_pg_status(dc, __func__, ": start");
		149
140	if (dc->clk_mgr && dc->clk_mgr->funcs->init_clocks)	150	if (dc->clk_mgr && dc->clk_mgr->funcs->init_clocks)
141	dc->clk_mgr->funcs->init_clocks(dc->clk_mgr);	151	dc->clk_mgr->funcs->init_clocks(dc->clk_mgr);
142		152
@@ -200,10 +210,7 @@ void dcn35_init_hw(struct dc *dc) · 57 unmodified lines
200		210
201	/* we want to turn off all dp displays before doing detection */	211	/* we want to turn off all dp displays before doing detection */
202	dc->link_srv->blank_all_dp_displays(dc);	212	dc->link_srv->blank_all_dp_displays(dc);
203	/*	213
204	if (hws->funcs.enable_power_gating_plane)
205	hws->funcs.enable_power_gating_plane(dc->hwseq, true);
206	*/
207	if (res_pool->hubbub && res_pool->hubbub->funcs->dchubbub_init)	214	if (res_pool->hubbub && res_pool->hubbub->funcs->dchubbub_init)
208	res_pool->hubbub->funcs->dchubbub_init(dc->res_pool->hubbub);	215	res_pool->hubbub->funcs->dchubbub_init(dc->res_pool->hubbub);
209	/* If taking control over from VBIOS, we may want to optimize our first	216	/* If taking control over from VBIOS, we may want to optimize our first
@@ -236,6 +243,8 @@ void dcn35_init_hw(struct dc *dc) · 26 unmodified lines
236	}	243	}
237		244
238	hws->funcs.init_pipes(dc, dc->current_state);	245	hws->funcs.init_pipes(dc, dc->current_state);
		246	print_pg_status(dc, __func__, ": after init_pipes");
		247
239	if (dc->res_pool->hubbub->funcs->allow_self_refresh_control &&	248	if (dc->res_pool->hubbub->funcs->allow_self_refresh_control &&
240	!dc->res_pool->hubbub->ctx->dc->debug.disable_stutter)	249	!dc->res_pool->hubbub->ctx->dc->debug.disable_stutter)
241	dc->res_pool->hubbub->funcs->allow_self_refresh_control(dc->res_pool->hubbub,	250	dc->res_pool->hubbub->funcs->allow_self_refresh_control(dc->res_pool->hubbub,
@@ -312,6 +321,7 @@ void dcn35_init_hw(struct dc *dc) · 70 unmodified lines
312	if (dc->res_pool->pg_cntl->funcs->init_pg_status)	321	if (dc->res_pool->pg_cntl->funcs->init_pg_status)
313	dc->res_pool->pg_cntl->funcs->init_pg_status(dc->res_pool->pg_cntl);	322	dc->res_pool->pg_cntl->funcs->init_pg_status(dc->res_pool->pg_cntl);
314	}	323	}
		324	print_pg_status(dc, __func__, ": after init_pg_status");
315	}	325	}
316		326
317	static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)	327	static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)
@@ -500,97 +510,6 @@ void dcn35_physymclk_root_clock_control(struct dce_hwseq *hws, unsigned int phy_ · 182 unmodified lines
500	}	510	}
501	}	511	}
502		512
503	void dcn35_dsc_pg_control(
504	struct dce_hwseq *hws,
505	unsigned int dsc_inst,
506	bool power_on)
507	{
508	uint32_t power_gate = power_on ? 0 : 1;
509	uint32_t pwr_status = power_on ? 0 : 2;
510	uint32_t org_ip_request_cntl = 0;
511
512	if (hws->ctx->dc->debug.disable_dsc_power_gate)
513	return;
514	if (hws->ctx->dc->debug.ignore_pg)
515	return;
516	REG_GET(DC_IP_REQUEST_CNTL, IP_REQUEST_EN, &org_ip_request_cntl);
517	if (org_ip_request_cntl == 0)
518	REG_SET(DC_IP_REQUEST_CNTL, 0, IP_REQUEST_EN, 1);
519
520	switch (dsc_inst) {
521	case 0: /* DSC0 */
522	REG_UPDATE(DOMAIN16_PG_CONFIG,
523	DOMAIN_POWER_GATE, power_gate);
524
525	REG_WAIT(DOMAIN16_PG_STATUS,
526	DOMAIN_PGFSM_PWR_STATUS, pwr_status,
527	1, 1000);
528	break;
529	case 1: /* DSC1 */
530	REG_UPDATE(DOMAIN17_PG_CONFIG,
531	DOMAIN_POWER_GATE, power_gate);
532
533	REG_WAIT(DOMAIN17_PG_STATUS,
534	DOMAIN_PGFSM_PWR_STATUS, pwr_status,
535	1, 1000);
536	break;
537	case 2: /* DSC2 */
538	REG_UPDATE(DOMAIN18_PG_CONFIG,
539	DOMAIN_POWER_GATE, power_gate);
540
541	REG_WAIT(DOMAIN18_PG_STATUS,
542	DOMAIN_PGFSM_PWR_STATUS, pwr_status,
543	1, 1000);
544	break;
545	case 3: /* DSC3 */
546	REG_UPDATE(DOMAIN19_PG_CONFIG,
547	DOMAIN_POWER_GATE, power_gate);
548
549	REG_WAIT(DOMAIN19_PG_STATUS,
550	DOMAIN_PGFSM_PWR_STATUS, pwr_status,
551	1, 1000);
552	break;
553	default:
554	BREAK_TO_DEBUGGER();
555	break;
556	}
557
558	if (org_ip_request_cntl == 0)
559	REG_SET(DC_IP_REQUEST_CNTL, 0, IP_REQUEST_EN, 0);
560	}
561
562	void dcn35_enable_power_gating_plane(struct dce_hwseq *hws, bool enable)
563	{
564	bool force_on = true; /* disable power gating */
565	uint32_t org_ip_request_cntl = 0;
566
567	if (hws->ctx->dc->debug.disable_hubp_power_gate)
568	return;
569	if (hws->ctx->dc->debug.ignore_pg)
570	return;
571	REG_GET(DC_IP_REQUEST_CNTL, IP_REQUEST_EN, &org_ip_request_cntl);
572	if (org_ip_request_cntl == 0)
573	REG_SET(DC_IP_REQUEST_CNTL, 0, IP_REQUEST_EN, 1);
574	/* DCHUBP0/1/2/3/4/5 */
575	REG_UPDATE(DOMAIN0_PG_CONFIG, DOMAIN_POWER_FORCEON, force_on);
576	REG_UPDATE(DOMAIN2_PG_CONFIG, DOMAIN_POWER_FORCEON, force_on);
577	/* DPP0/1/2/3/4/5 */
578	REG_UPDATE(DOMAIN1_PG_CONFIG, DOMAIN_POWER_FORCEON, force_on);
579	REG_UPDATE(DOMAIN3_PG_CONFIG, DOMAIN_POWER_FORCEON, force_on);
580
581	force_on = true; /* disable power gating */
582	if (enable && !hws->ctx->dc->debug.disable_dsc_power_gate)
583	force_on = false;
584
585	/* DCS0/1/2/3/4 */
586	REG_UPDATE(DOMAIN16_PG_CONFIG, DOMAIN_POWER_FORCEON, force_on);
587	REG_UPDATE(DOMAIN17_PG_CONFIG, DOMAIN_POWER_FORCEON, force_on);
588	REG_UPDATE(DOMAIN18_PG_CONFIG, DOMAIN_POWER_FORCEON, force_on);
589	REG_UPDATE(DOMAIN19_PG_CONFIG, DOMAIN_POWER_FORCEON, force_on);
590
591
592	}
593
594	/* In headless boot cases, DIG may be turned	513	/* In headless boot cases, DIG may be turned
595	* on which causes HW/SW discrepancies.	514	* on which causes HW/SW discrepancies.
596	* To avoid this, power down hardware on boot	515	* To avoid this, power down hardware on boot
@@ -1453,6 +1372,8 @@ void dcn35_prepare_bandwidth( · 856 unmodified lines
1453	}	1372	}
1454		1373
1455	dcn20_prepare_bandwidth(dc, context);	1374	dcn20_prepare_bandwidth(dc, context);
		1375
		1376	print_pg_status(dc, __func__, ": after rcg and power up");
1456	}	1377	}
1457		1378
1458	void dcn35_optimize_bandwidth(	1379	void dcn35_optimize_bandwidth(
@@ -1461,6 +1382,8 @@ void dcn35_optimize_bandwidth( · 2 unmodified lines
1461	{	1382	{
1462	struct pg_block_update pg_update_state;	1383	struct pg_block_update pg_update_state;
1463		1384
		1385	print_pg_status(dc, __func__, ": before rcg and power up");
		1386
1464	dcn20_optimize_bandwidth(dc, context);	1387	dcn20_optimize_bandwidth(dc, context);
1465		1388
1466	if (dc->hwss.calc_blocks_to_gate) {	1389	if (dc->hwss.calc_blocks_to_gate) {
@@ -1472,6 +1395,8 @@ void dcn35_optimize_bandwidth( · 5 unmodified lines
1472	if (dc->hwss.root_clock_control)	1395	if (dc->hwss.root_clock_control)
1473	dc->hwss.root_clock_control(dc, &pg_update_state, false);	1396	dc->hwss.root_clock_control(dc, &pg_update_state, false);
1474	}	1397	}
		1398
		1399	print_pg_status(dc, __func__, ": after rcg and power up");
1475	}	1400	}
1476		1401
1477	void dcn35_set_drr(struct pipe_ctx **pipe_ctx,	1402	void dcn35_set_drr(struct pipe_ctx **pipe_ctx,

drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c+0−3

 	.exit_optimized_pwr_state = dcn21_exit_optimized_pwr_state,
 	.update_visual_confirm_color = dcn10_update_visual_confirm_color,
 	.apply_idle_power_optimizations = dcn35_apply_idle_power_optimizations,
-	.update_dsc_pg = dcn32_update_dsc_pg,
 	.calc_blocks_to_gate = dcn35_calc_blocks_to_gate,
 	.calc_blocks_to_ungate = dcn35_calc_blocks_to_ungate,
 	.hw_block_power_up = dcn35_hw_block_power_up,
 	.plane_atomic_disable = dcn35_plane_atomic_disable,
 	//.plane_atomic_disable = dcn20_plane_atomic_disable,/*todo*/
 	//.hubp_pg_control = dcn35_hubp_pg_control,
-	.enable_power_gating_plane = dcn35_enable_power_gating_plane,
 	.dpp_root_clock_control = dcn35_dpp_root_clock_control,
 	.dpstream_root_clock_control = dcn35_dpstream_root_clock_control,
 	.physymclk_root_clock_control = dcn35_physymclk_root_clock_control,
 	.calculate_dccg_k1_k2_values = dcn32_calculate_dccg_k1_k2_values,
 	.resync_fifo_dccg_dio = dcn314_resync_fifo_dccg_dio,
 	.is_dp_dig_pixel_rate_div_policy = dcn35_is_dp_dig_pixel_rate_div_policy,
-	.dsc_pg_control = dcn35_dsc_pg_control,
 	.dsc_pg_status = dcn32_dsc_pg_status,
 	.enable_plane = dcn35_enable_plane,
 	.wait_for_pipe_update_if_needed = dcn10_wait_for_pipe_update_if_needed,

drivers/gpu/drm/amd/display/dc/hwss/dcn351/dcn351_init.c+0−3

 	.exit_optimized_pwr_state = dcn21_exit_optimized_pwr_state,
 	.update_visual_confirm_color = dcn10_update_visual_confirm_color,
 	.apply_idle_power_optimizations = dcn35_apply_idle_power_optimizations,
-	.update_dsc_pg = dcn32_update_dsc_pg,
 	.calc_blocks_to_gate = dcn351_calc_blocks_to_gate,
 	.calc_blocks_to_ungate = dcn351_calc_blocks_to_ungate,
 	.hw_block_power_up = dcn351_hw_block_power_up,
 	.plane_atomic_disable = dcn35_plane_atomic_disable,
 	//.plane_atomic_disable = dcn20_plane_atomic_disable,/*todo*/
 	//.hubp_pg_control = dcn35_hubp_pg_control,
-	.enable_power_gating_plane = dcn35_enable_power_gating_plane,
 	.dpp_root_clock_control = dcn35_dpp_root_clock_control,
 	.dpstream_root_clock_control = dcn35_dpstream_root_clock_control,
 	.physymclk_root_clock_control = dcn35_physymclk_root_clock_control,
 	.setup_hpo_hw_control = dcn35_setup_hpo_hw_control,
 	.calculate_dccg_k1_k2_values = dcn32_calculate_dccg_k1_k2_values,
 	.is_dp_dig_pixel_rate_div_policy = dcn35_is_dp_dig_pixel_rate_div_policy,
-	.dsc_pg_control = dcn35_dsc_pg_control,
 	.dsc_pg_status = dcn32_dsc_pg_status,
 	.enable_plane = dcn35_enable_plane,
 	.wait_for_pipe_update_if_needed = dcn10_wait_for_pipe_update_if_needed,

drivers/gpu/drm/amd/display/dc/inc/hw/pg_cntl.h+1−0

@@ -49,6 +49,7 @@ struct pg_cntl_funcs { · 48 unmodified lines
49	void (mem_pg_control)(struct pg_cntl pg_cntl, bool power_on);	49	void (mem_pg_control)(struct pg_cntl pg_cntl, bool power_on);
50	void (dio_pg_control)(struct pg_cntl pg_cntl, bool power_on);	50	void (dio_pg_control)(struct pg_cntl pg_cntl, bool power_on);
51	void (init_pg_status)(struct pg_cntl pg_cntl);	51	void (init_pg_status)(struct pg_cntl pg_cntl);
		52	void (print_pg_status)(struct pg_cntl pg_cntl, const char debug_func, const char debug_log);
52	};	53	};
53		54
54	#endif //__DC_PG_CNTL_H__	55	#endif //__DC_PG_CNTL_H__

drivers/gpu/drm/amd/display/dc/pg/dcn35/dcn35_pg_cntl.c+50−28

@@ -79,16 +79,12 @@ void pg_cntl35_dsc_pg_control(struct pg_cntl *pg_cntl, unsigned int dsc_inst, bo · 78 unmodified lines
79	uint32_t power_gate = power_on ? 0 : 1;	79	uint32_t power_gate = power_on ? 0 : 1;
80	uint32_t pwr_status = power_on ? 0 : 2;	80	uint32_t pwr_status = power_on ? 0 : 2;
81	uint32_t org_ip_request_cntl = 0;	81	uint32_t org_ip_request_cntl = 0;
82	bool block_enabled;	82	bool block_enabled = false;
83		83	bool skip_pg = pg_cntl->ctx->dc->debug.ignore_pg \|\|
84	/need to enable dscclk regardless DSC_PG/	84	pg_cntl->ctx->dc->debug.disable_dsc_power_gate \|\|
85	if (pg_cntl->ctx->dc->res_pool->dccg->funcs->enable_dsc && power_on)	85	pg_cntl->ctx->dc->idle_optimizations_allowed;
86	pg_cntl->ctx->dc->res_pool->dccg->funcs->enable_dsc(
87	pg_cntl->ctx->dc->res_pool->dccg, dsc_inst);
88		86
89	if (pg_cntl->ctx->dc->debug.ignore_pg \|\|	87	if (skip_pg && !power_on)
90	pg_cntl->ctx->dc->debug.disable_dsc_power_gate \|\|
91	pg_cntl->ctx->dc->idle_optimizations_allowed)
92	return;	88	return;
93		89
94	block_enabled = pg_cntl35_dsc_pg_status(pg_cntl, dsc_inst);	90	block_enabled = pg_cntl35_dsc_pg_status(pg_cntl, dsc_inst);
@@ -111,7 +107,7 @@ void pg_cntl35_dsc_pg_control(struct pg_cntl *pg_cntl, unsigned int dsc_inst, bo · 16 unmodified lines
111		107
112	REG_WAIT(DOMAIN16_PG_STATUS,	108	REG_WAIT(DOMAIN16_PG_STATUS,
113	DOMAIN_PGFSM_PWR_STATUS, pwr_status,	109	DOMAIN_PGFSM_PWR_STATUS, pwr_status,
114	1, 1000);	110	1, 10000);
115	break;	111	break;
116	case 1: /* DSC1 */	112	case 1: /* DSC1 */
117	REG_UPDATE(DOMAIN17_PG_CONFIG,	113	REG_UPDATE(DOMAIN17_PG_CONFIG,
@@ -119,7 +115,7 @@ void pg_cntl35_dsc_pg_control(struct pg_cntl *pg_cntl, unsigned int dsc_inst, bo · 1 unmodified line
119		115
120	REG_WAIT(DOMAIN17_PG_STATUS,	116	REG_WAIT(DOMAIN17_PG_STATUS,
121	DOMAIN_PGFSM_PWR_STATUS, pwr_status,	117	DOMAIN_PGFSM_PWR_STATUS, pwr_status,
122	1, 1000);	118	1, 10000);
123	break;	119	break;
124	case 2: /* DSC2 */	120	case 2: /* DSC2 */
125	REG_UPDATE(DOMAIN18_PG_CONFIG,	121	REG_UPDATE(DOMAIN18_PG_CONFIG,
@@ -127,7 +123,7 @@ void pg_cntl35_dsc_pg_control(struct pg_cntl *pg_cntl, unsigned int dsc_inst, bo · 1 unmodified line
127		123
128	REG_WAIT(DOMAIN18_PG_STATUS,	124	REG_WAIT(DOMAIN18_PG_STATUS,
129	DOMAIN_PGFSM_PWR_STATUS, pwr_status,	125	DOMAIN_PGFSM_PWR_STATUS, pwr_status,
130	1, 1000);	126	1, 10000);
131	break;	127	break;
132	case 3: /* DSC3 */	128	case 3: /* DSC3 */
133	REG_UPDATE(DOMAIN19_PG_CONFIG,	129	REG_UPDATE(DOMAIN19_PG_CONFIG,
@@ -135,7 +131,7 @@ void pg_cntl35_dsc_pg_control(struct pg_cntl *pg_cntl, unsigned int dsc_inst, bo · 1 unmodified line
135		131
136	REG_WAIT(DOMAIN19_PG_STATUS,	132	REG_WAIT(DOMAIN19_PG_STATUS,
137	DOMAIN_PGFSM_PWR_STATUS, pwr_status,	133	DOMAIN_PGFSM_PWR_STATUS, pwr_status,
138	1, 1000);	134	1, 10000);
139	break;	135	break;
140	default:	136	default:
141	BREAK_TO_DEBUGGER();	137	BREAK_TO_DEBUGGER();
@@ -144,12 +140,6 @@ void pg_cntl35_dsc_pg_control(struct pg_cntl *pg_cntl, unsigned int dsc_inst, bo · 2 unmodified lines
144		140
145	if (dsc_inst < MAX_PIPES)	141	if (dsc_inst < MAX_PIPES)
146	pg_cntl->pg_pipe_res_enable[PG_DSC][dsc_inst] = power_on;	142	pg_cntl->pg_pipe_res_enable[PG_DSC][dsc_inst] = power_on;
147
148	if (pg_cntl->ctx->dc->res_pool->dccg->funcs->disable_dsc && !power_on) {
149	/this is to disable dscclk/
150	pg_cntl->ctx->dc->res_pool->dccg->funcs->disable_dsc(
151	pg_cntl->ctx->dc->res_pool->dccg, dsc_inst);
152	}
153	}	143	}
154		144
155	static bool pg_cntl35_hubp_dpp_pg_status(struct pg_cntl *pg_cntl, unsigned int hubp_dpp_inst)	145	static bool pg_cntl35_hubp_dpp_pg_status(struct pg_cntl *pg_cntl, unsigned int hubp_dpp_inst)
@@ -189,11 +179,12 @@ void pg_cntl35_hubp_dpp_pg_control(struct pg_cntl *pg_cntl, unsigned int hubp_dp · 33 unmodified lines
189	uint32_t pwr_status = power_on ? 0 : 2;	179	uint32_t pwr_status = power_on ? 0 : 2;
190	uint32_t org_ip_request_cntl;	180	uint32_t org_ip_request_cntl;
191	bool block_enabled;	181	bool block_enabled;
		182	bool skip_pg = pg_cntl->ctx->dc->debug.ignore_pg \|\|
		183	pg_cntl->ctx->dc->debug.disable_hubp_power_gate \|\|
		184	pg_cntl->ctx->dc->debug.disable_dpp_power_gate \|\|
		185	pg_cntl->ctx->dc->idle_optimizations_allowed;
192		186
193	if (pg_cntl->ctx->dc->debug.ignore_pg \|\|	187	if (skip_pg && !power_on)
194	pg_cntl->ctx->dc->debug.disable_hubp_power_gate \|\|
195	pg_cntl->ctx->dc->debug.disable_dpp_power_gate \|\|
196	pg_cntl->ctx->dc->idle_optimizations_allowed)
197	return;	188	return;
198		189
199	block_enabled = pg_cntl35_hubp_dpp_pg_status(pg_cntl, hubp_dpp_inst);	190	block_enabled = pg_cntl35_hubp_dpp_pg_status(pg_cntl, hubp_dpp_inst);
@@ -213,22 +204,22 @@ void pg_cntl35_hubp_dpp_pg_control(struct pg_cntl *pg_cntl, unsigned int hubp_dp · 13 unmodified lines
213	case 0:	204	case 0:
214	/* DPP0 & HUBP0 */	205	/* DPP0 & HUBP0 */
215	REG_UPDATE(DOMAIN0_PG_CONFIG, DOMAIN_POWER_GATE, power_gate);	206	REG_UPDATE(DOMAIN0_PG_CONFIG, DOMAIN_POWER_GATE, power_gate);
216	REG_WAIT(DOMAIN0_PG_STATUS, DOMAIN_PGFSM_PWR_STATUS, pwr_status, 1, 1000);	207	REG_WAIT(DOMAIN0_PG_STATUS, DOMAIN_PGFSM_PWR_STATUS, pwr_status, 1, 10000);
217	break;	208	break;
218	case 1:	209	case 1:
219	/* DPP1 & HUBP1 */	210	/* DPP1 & HUBP1 */
220	REG_UPDATE(DOMAIN1_PG_CONFIG, DOMAIN_POWER_GATE, power_gate);	211	REG_UPDATE(DOMAIN1_PG_CONFIG, DOMAIN_POWER_GATE, power_gate);
221	REG_WAIT(DOMAIN1_PG_STATUS, DOMAIN_PGFSM_PWR_STATUS, pwr_status, 1, 1000);	212	REG_WAIT(DOMAIN1_PG_STATUS, DOMAIN_PGFSM_PWR_STATUS, pwr_status, 1, 10000);
222	break;	213	break;
223	case 2:	214	case 2:
224	/* DPP2 & HUBP2 */	215	/* DPP2 & HUBP2 */
225	REG_UPDATE(DOMAIN2_PG_CONFIG, DOMAIN_POWER_GATE, power_gate);	216	REG_UPDATE(DOMAIN2_PG_CONFIG, DOMAIN_POWER_GATE, power_gate);
226	REG_WAIT(DOMAIN2_PG_STATUS, DOMAIN_PGFSM_PWR_STATUS, pwr_status, 1, 1000);	217	REG_WAIT(DOMAIN2_PG_STATUS, DOMAIN_PGFSM_PWR_STATUS, pwr_status, 1, 10000);
227	break;	218	break;
228	case 3:	219	case 3:
229	/* DPP3 & HUBP3 */	220	/* DPP3 & HUBP3 */
230	REG_UPDATE(DOMAIN3_PG_CONFIG, DOMAIN_POWER_GATE, power_gate);	221	REG_UPDATE(DOMAIN3_PG_CONFIG, DOMAIN_POWER_GATE, power_gate);
231	REG_WAIT(DOMAIN3_PG_STATUS, DOMAIN_PGFSM_PWR_STATUS, pwr_status, 1, 1000);	222	REG_WAIT(DOMAIN3_PG_STATUS, DOMAIN_PGFSM_PWR_STATUS, pwr_status, 1, 10000);
232	break;	223	break;
233	default:	224	default:
234	BREAK_TO_DEBUGGER();	225	BREAK_TO_DEBUGGER();
@@ -501,6 +492,36 @@ void pg_cntl35_init_pg_status(struct pg_cntl *pg_cntl) · 266 unmodified lines
501	pg_cntl->pg_res_enable[PG_DWB] = block_enabled;	492	pg_cntl->pg_res_enable[PG_DWB] = block_enabled;
502	}	493	}
503		494
		495	static void pg_cntl35_print_pg_status(struct pg_cntl pg_cntl, const char debug_func, const char *debug_log)
		496	{
		497	int i = 0;
		498	bool block_enabled = false;
		499
		500	DC_LOG_DEBUG("%s: %s", debug_func, debug_log);
		501
		502	DC_LOG_DEBUG("PG_CNTL status:\n");
		503
		504	block_enabled = pg_cntl35_io_clk_status(pg_cntl);
		505	DC_LOG_DEBUG("ONO0=%d (DCCG, DIO, DCIO)\n", block_enabled ? 1 : 0);
		506
		507	block_enabled = pg_cntl35_mem_status(pg_cntl);
		508	DC_LOG_DEBUG("ONO1=%d (DCHUBBUB, DCHVM, DCHUBBUBMEM)\n", block_enabled ? 1 : 0);
		509
		510	block_enabled = pg_cntl35_plane_otg_status(pg_cntl);
		511	DC_LOG_DEBUG("ONO2=%d (MPC, OPP, OPTC, DWB)\n", block_enabled ? 1 : 0);
		512
		513	block_enabled = pg_cntl35_hpo_pg_status(pg_cntl);
		514	DC_LOG_DEBUG("ONO3=%d (HPO)\n", block_enabled ? 1 : 0);
		515
		516	for (i = 0; i < pg_cntl->ctx->dc->res_pool->pipe_count; i++) {
		517	block_enabled = pg_cntl35_hubp_dpp_pg_status(pg_cntl, i);
		518	DC_LOG_DEBUG("ONO%d=%d (DCHUBP%d, DPP%d)\n", 4 + i * 2, block_enabled ? 1 : 0, i, i);
		519
		520	block_enabled = pg_cntl35_dsc_pg_status(pg_cntl, i);
		521	DC_LOG_DEBUG("ONO%d=%d (DSC%d)\n", 5 + i * 2, block_enabled ? 1 : 0, i);
		522	}
		523	}
		524
504	static const struct pg_cntl_funcs pg_cntl35_funcs = {	525	static const struct pg_cntl_funcs pg_cntl35_funcs = {
505	.init_pg_status = pg_cntl35_init_pg_status,	526	.init_pg_status = pg_cntl35_init_pg_status,
506	.dsc_pg_control = pg_cntl35_dsc_pg_control,	527	.dsc_pg_control = pg_cntl35_dsc_pg_control,
@@ -511,7 +532,8 @@ static const struct pg_cntl_funcs pg_cntl35_funcs = { · 4 unmodified lines
511	.mpcc_pg_control = pg_cntl35_mpcc_pg_control,	532	.mpcc_pg_control = pg_cntl35_mpcc_pg_control,
512	.opp_pg_control = pg_cntl35_opp_pg_control,	533	.opp_pg_control = pg_cntl35_opp_pg_control,
513	.optc_pg_control = pg_cntl35_optc_pg_control,	534	.optc_pg_control = pg_cntl35_optc_pg_control,
514	.dwb_pg_control = pg_cntl35_dwb_pg_control	535	.dwb_pg_control = pg_cntl35_dwb_pg_control,
		536	.print_pg_status = pg_cntl35_print_pg_status
515	};	537	};
516		538
517	struct pg_cntl *pg_cntl35_create(	539	struct pg_cntl *pg_cntl35_create(

drivers/gpu/drm/i915/display/intel_display_power.c+3−3

@@ -1172,7 +1172,7 @@ static void icl_mbus_init(struct intel_display *display) · 1171 unmodified lines
1172	if (DISPLAY_VER(display) == 12)	1172	if (DISPLAY_VER(display) == 12)
1173	abox_regs \|= BIT(0);	1173	abox_regs \|= BIT(0);
1174		1174
1175	for_each_set_bit(i, &abox_regs, sizeof(abox_regs))	1175	for_each_set_bit(i, &abox_regs, BITS_PER_TYPE(abox_regs))
1176	intel_de_rmw(display, MBUS_ABOX_CTL(i), mask, val);	1176	intel_de_rmw(display, MBUS_ABOX_CTL(i), mask, val);
1177	}	1177	}
1178		1178
@@ -1629,11 +1629,11 @@ static void tgl_bw_buddy_init(struct intel_display *display) · 450 unmodified lines
1629	if (table[config].page_mask == 0) {	1629	if (table[config].page_mask == 0) {
1630	drm_dbg_kms(display->drm,	1630	drm_dbg_kms(display->drm,
1631	"Unknown memory configuration; disabling address buddy logic.\n");	1631	"Unknown memory configuration; disabling address buddy logic.\n");
1632	for_each_set_bit(i, &abox_mask, sizeof(abox_mask))	1632	for_each_set_bit(i, &abox_mask, BITS_PER_TYPE(abox_mask))
1633	intel_de_write(display, BW_BUDDY_CTL(i),	1633	intel_de_write(display, BW_BUDDY_CTL(i),
1634	BW_BUDDY_DISABLE);	1634	BW_BUDDY_DISABLE);
1635	} else {	1635	} else {
1636	for_each_set_bit(i, &abox_mask, sizeof(abox_mask)) {	1636	for_each_set_bit(i, &abox_mask, BITS_PER_TYPE(abox_mask)) {
1637	intel_de_write(display, BW_BUDDY_PAGE_MASK(i),	1637	intel_de_write(display, BW_BUDDY_PAGE_MASK(i),
1638	table[config].page_mask);	1638	table[config].page_mask);
1639		1639

drivers/gpu/drm/mediatek/mtk_drm_drv.c+9−14

 		of_id = of_match_node(mtk_drm_of_ids, node);
 		if (!of_id)
-			goto next_put_node;
+			continue;
 		pdev = of_find_device_by_node(node);
 		if (!pdev)
-			goto next_put_node;
+			continue;
 		drm_dev = device_find_child(&pdev->dev, NULL, mtk_drm_match);
+		put_device(&pdev->dev);
 		if (!drm_dev)
-			goto next_put_device_pdev_dev;
+			continue;
 		temp_drm_priv = dev_get_drvdata(drm_dev);
+		put_device(drm_dev);
 		if (!temp_drm_priv)
-			goto next_put_device_drm_dev;
+			continue;
 		if (temp_drm_priv->data->main_len)
 			all_drm_priv[CRTC_MAIN] = temp_drm_priv;
 		if (temp_drm_priv->mtk_drm_bound)
 			cnt++;
-next_put_device_drm_dev:
+		if (cnt == MAX_CRTC) {
-		put_device(drm_dev);
+			of_node_put(node);
-next_put_device_pdev_dev:
-		put_device(&pdev->dev);
-next_put_node:
-		of_node_put(node);
-		if (cnt == MAX_CRTC)
 			break;
+		}
 	}
 	if (drm_priv->data->mmsys_dev_num == cnt) {

drivers/gpu/drm/nouveau/nouveau_fence.c+0−15

@@ -240,21 +240,6 @@ nouveau_fence_emit(struct nouveau_fence *fence) · 239 unmodified lines
240	return ret;	240	return ret;
241	}	241	}
242		242
243	void
244	nouveau_fence_cancel(struct nouveau_fence *fence)
245	{
246	struct nouveau_fence_chan *fctx = nouveau_fctx(fence);
247	unsigned long flags;
248
249	spin_lock_irqsave(&fctx->lock, flags);
250	if (!dma_fence_is_signaled_locked(&fence->base)) {
251	dma_fence_set_error(&fence->base, -ECANCELED);
252	if (nouveau_fence_signal(fence))
253	nvif_event_block(&fctx->event);
254	}
255	spin_unlock_irqrestore(&fctx->lock, flags);
256	}
257
258	bool	243	bool
259	nouveau_fence_done(struct nouveau_fence *fence)	244	nouveau_fence_done(struct nouveau_fence *fence)
260	{	245	{

drivers/gpu/drm/nouveau/nouveau_fence.h+0−1

@@ -29,7 +29,6 @@ void nouveau_fence_unref(struct nouveau_fence **); · 28 unmodified lines
29		29
30	int nouveau_fence_emit(struct nouveau_fence *);	30	int nouveau_fence_emit(struct nouveau_fence *);
31	bool nouveau_fence_done(struct nouveau_fence *);	31	bool nouveau_fence_done(struct nouveau_fence *);
32	void nouveau_fence_cancel(struct nouveau_fence *fence);
33	int nouveau_fence_wait(struct nouveau_fence *, bool lazy, bool intr);	32	int nouveau_fence_wait(struct nouveau_fence *, bool lazy, bool intr);
34	int nouveau_fence_sync(struct nouveau_bo , struct nouveau_channel , bool exclusive, bool intr);	33	int nouveau_fence_sync(struct nouveau_bo , struct nouveau_channel , bool exclusive, bool intr);
35		34

drivers/gpu/drm/nouveau/nouveau_sched.c+14−21

 #include "nouveau_exec.h"
 #include "nouveau_abi16.h"
 #include "nouveau_sched.h"
-#include "nouveau_chan.h"
 #define NOUVEAU_SCHED_JOB_TIMEOUT_MS		10000
 {
 	struct nouveau_sched *sched = job->sched;
-	spin_lock(&sched->job_list.lock);
+	spin_lock(&sched->job.list.lock);
 	list_del(&job->entry);
-	spin_unlock(&sched->job_list.lock);
+	spin_unlock(&sched->job.list.lock);
+	wake_up(&sched->job.wq);
 }
 void
 	}
 	/* Submit was successful; add the job to the schedulers job list. */
-	spin_lock(&sched->job_list.lock);
+	spin_lock(&sched->job.list.lock);
-	list_add(&job->entry, &sched->job_list.head);
+	list_add(&job->entry, &sched->job.list.head);
-	spin_unlock(&sched->job_list.lock);
+	spin_unlock(&sched->job.list.lock);
 	drm_sched_job_arm(&job->base);
 	job->done_fence = dma_fence_get(&job->base.s_fence->finished);
 	nouveau_job_fini(job);
 }
-static void
-nouveau_sched_cancel_job(struct drm_sched_job *sched_job)
-{
-	struct nouveau_fence *fence;
-	struct nouveau_job *job;
-	job = to_nouveau_job(sched_job);
-	fence = to_nouveau_fence(job->done_fence);
-	nouveau_fence_cancel(fence);
-}
 static const struct drm_sched_backend_ops nouveau_sched_ops = {
 	.run_job = nouveau_sched_run_job,
 	.timedout_job = nouveau_sched_timedout_job,
 	.free_job = nouveau_sched_free_job,
-	.cancel_job = nouveau_sched_cancel_job,
 };
 static int
 		goto fail_sched;
 	mutex_init(&sched->mutex);
-	spin_lock_init(&sched->job_list.lock);
+	spin_lock_init(&sched->job.list.lock);
-	INIT_LIST_HEAD(&sched->job_list.head);
+	INIT_LIST_HEAD(&sched->job.list.head);
+	init_waitqueue_head(&sched->job.wq);
 	return 0;
 	return 0;
 }
 static void
 nouveau_sched_fini(struct nouveau_sched *sched)
 {
 	struct drm_gpu_scheduler *drm_sched = &sched->base;
 	struct drm_sched_entity *entity = &sched->entity;
+	rmb(); /* for list_empty to work without lock */
+	wait_event(sched->job.wq, list_empty(&sched->job.list.head));
 	drm_sched_entity_fini(entity);
 	drm_sched_fini(drm_sched);

drivers/gpu/drm/nouveau/nouveau_sched.h+6−3

 	struct mutex mutex;
 	struct {
-		struct list_head head;
+		struct {
-		spinlock_t lock;
+			struct list_head head;
-	} job_list;
+			spinlock_t lock;
+		} list;
+		struct wait_queue_head wq;
+	} job;
 };
 int nouveau_sched_create(struct nouveau_sched **psched, struct nouveau_drm *drm,

drivers/gpu/drm/nouveau/nouveau_uvmm.c+4−4

@@ -1019,8 +1019,8 @@ bind_validate_map_sparse(struct nouveau_job *job, u64 addr, u64 range) · 1018 unmodified lines
1019	u64 end = addr + range;	1019	u64 end = addr + range;
1020		1020
1021	again:	1021	again:
1022	spin_lock(&sched->job_list.lock);	1022	spin_lock(&sched->job.list.lock);
1023	list_for_each_entry(__job, &sched->job_list.head, entry) {	1023	list_for_each_entry(__job, &sched->job.list.head, entry) {
1024	struct nouveau_uvmm_bind_job *bind_job = to_uvmm_bind_job(__job);	1024	struct nouveau_uvmm_bind_job *bind_job = to_uvmm_bind_job(__job);
1025		1025
1026	list_for_each_op(op, &bind_job->ops) {	1026	list_for_each_op(op, &bind_job->ops) {
@@ -1030,7 +1030,7 @@ again: · 3 unmodified lines
1030		1030
1031	if (!(end <= op_addr \|\| addr >= op_end)) {	1031	if (!(end <= op_addr \|\| addr >= op_end)) {
1032	nouveau_uvmm_bind_job_get(bind_job);	1032	nouveau_uvmm_bind_job_get(bind_job);
1033	spin_unlock(&sched->job_list.lock);	1033	spin_unlock(&sched->job.list.lock);
1034	wait_for_completion(&bind_job->complete);	1034	wait_for_completion(&bind_job->complete);
1035	nouveau_uvmm_bind_job_put(bind_job);	1035	nouveau_uvmm_bind_job_put(bind_job);
1036	goto again;	1036	goto again;
@@ -1038,7 +1038,7 @@ again: · 1 unmodified line
1038	}	1038	}
1039	}	1039	}
1040	}	1040	}
1041	spin_unlock(&sched->job_list.lock);	1041	spin_unlock(&sched->job.list.lock);
1042	}	1042	}
1043		1043
1044	static int	1044	static int

drivers/gpu/drm/panthor/panthor_drv.c+1−1

@@ -1094,7 +1094,7 @@ static int panthor_ioctl_group_create(struct drm_device ddev, void data, · 1093 unmodified lines
1094	struct drm_panthor_queue_create *queue_args;	1094	struct drm_panthor_queue_create *queue_args;
1095	int ret;	1095	int ret;
1096		1096
1097	if (!args->queues.count)	1097	if (!args->queues.count \|\| args->queues.count > MAX_CS_PER_CSG)
1098	return -EINVAL;	1098	return -EINVAL;
1099		1099
1100	ret = PANTHOR_UOBJ_GET_ARRAY(queue_args, &args->queues);	1100	ret = PANTHOR_UOBJ_GET_ARRAY(queue_args, &args->queues);

drivers/gpu/drm/xe/tests/xe_bo.c+1−1

@@ -236,7 +236,7 @@ static int evict_test_run_tile(struct xe_device xe, struct xe_tile tile, struc · 235 unmodified lines
236	}	236	}
237		237
238	xe_bo_lock(external, false);	238	xe_bo_lock(external, false);
239	err = xe_bo_pin_external(external);	239	err = xe_bo_pin_external(external, false);
240	xe_bo_unlock(external);	240	xe_bo_unlock(external);
241	if (err) {	241	if (err) {
242	KUNIT_FAIL(test, "external bo pin err=%pe\n",	242	KUNIT_FAIL(test, "external bo pin err=%pe\n",

drivers/gpu/drm/xe/tests/xe_dma_buf.c+1−9

@@ -89,15 +89,7 @@ static void check_residency(struct kunit test, struct xe_bo exported, · 88 unmodified lines
89	return;	89	return;
90	}	90	}
91		91
92	/*	92	KUNIT_EXPECT_TRUE(test, xe_bo_is_mem_type(exported, mem_type));
93	* If on different devices, the exporter is kept in system if
94	* possible, saving a migration step as the transfer is just
95	* likely as fast from system memory.
96	*/
97	if (params->mem_mask & XE_BO_FLAG_SYSTEM)
98	KUNIT_EXPECT_TRUE(test, xe_bo_is_mem_type(exported, XE_PL_TT));
99	else
100	KUNIT_EXPECT_TRUE(test, xe_bo_is_mem_type(exported, mem_type));
101		93
102	if (params->force_different_devices)	94	if (params->force_different_devices)
103	KUNIT_EXPECT_TRUE(test, xe_bo_is_mem_type(imported, XE_PL_TT));	95	KUNIT_EXPECT_TRUE(test, xe_bo_is_mem_type(imported, XE_PL_TT));

drivers/gpu/drm/xe/xe_bo.c+12−4

 		bo->placements[*c] = (struct ttm_place) {
 			.mem_type = XE_PL_TT,
+			.flags = (bo_flags & XE_BO_FLAG_VRAM_MASK) ?
+			TTM_PL_FLAG_FALLBACK : 0,
 		};
 		*c += 1;
 	}
 /**
  * xe_bo_pin_external - pin an external BO
  * @bo: buffer object to be pinned
+ * @in_place: Pin in current placement, don't attempt to migrate.
  *
  * Pin an external (not tied to a VM, can be exported via dma-buf / prime FD)
  * BO. Unique call compared to xe_bo_pin as this function has it own set of
  *
  * Returns 0 for success, negative error code otherwise.
  */
-int xe_bo_pin_external(struct xe_bo *bo)
+int xe_bo_pin_external(struct xe_bo *bo, bool in_place)
 {
 	struct xe_device *xe = xe_bo_device(bo);
 	int err;
 	xe_assert(xe, xe_bo_is_user(bo));
 	if (!xe_bo_is_pinned(bo)) {
-		err = xe_bo_validate(bo, NULL, false);
+		if (!in_place) {
-		if (err)
+			err = xe_bo_validate(bo, NULL, false);
-			return err;
+			if (err)
+				return err;
+		}
 		spin_lock(&xe->pinned.lock);
 		list_add_tail(&bo->pinned_link, &xe->pinned.late.external);
 	};
 	int ret;
+	if (xe_bo_is_pinned(bo))
+		return 0;
 	if (vm) {
 		lockdep_assert_held(&vm->lock);
 		xe_vm_assert_held(vm);

drivers/gpu/drm/xe/xe_bo.h+1−1

@@ -198,7 +198,7 @@ static inline void xe_bo_unlock_vm_held(struct xe_bo *bo) · 197 unmodified lines
198	}	198	}
199	}	199	}
200		200
201	int xe_bo_pin_external(struct xe_bo *bo);	201	int xe_bo_pin_external(struct xe_bo *bo, bool in_place);
202	int xe_bo_pin(struct xe_bo *bo);	202	int xe_bo_pin(struct xe_bo *bo);
203	void xe_bo_unpin_external(struct xe_bo *bo);	203	void xe_bo_unpin_external(struct xe_bo *bo);
204	void xe_bo_unpin(struct xe_bo *bo);	204	void xe_bo_unpin(struct xe_bo *bo);

drivers/gpu/drm/xe/xe_device_types.h+6−0

 	/** @pm_notifier: Our PM notifier to perform actions in response to various PM events. */
 	struct notifier_block pm_notifier;
+	/** @pm_block: Completion to block validating tasks on suspend / hibernate prepare */
+	struct completion pm_block;
+	/** @rebind_resume_list: List of wq items to kick on resume. */
+	struct list_head rebind_resume_list;
+	/** @rebind_resume_lock: Lock to protect the rebind_resume_list */
+	struct mutex rebind_resume_lock;
 	/** @pmt: Support the PMT driver callback interface */
 	struct {

drivers/gpu/drm/xe/xe_dma_buf.c+1−1

@@ -72,7 +72,7 @@ static int xe_dma_buf_pin(struct dma_buf_attachment *attach) · 71 unmodified lines
72	return ret;	72	return ret;
73	}	73	}
74		74
75	ret = xe_bo_pin_external(bo);	75	ret = xe_bo_pin_external(bo, true);
76	xe_assert(xe, !ret);	76	xe_assert(xe, !ret);
77		77
78	return 0;	78	return 0;

drivers/gpu/drm/xe/xe_exec.c+9−0

@@ -237,6 +237,15 @@ retry: · 236 unmodified lines
237	goto err_unlock_list;	237	goto err_unlock_list;
238	}	238	}
239		239
		240	/*
		241	* It's OK to block interruptible here with the vm lock held, since
		242	* on task freezing during suspend / hibernate, the call will
		243	* return -ERESTARTSYS and the IOCTL will be rerun.
		244	*/
		245	err = wait_for_completion_interruptible(&xe->pm_block);
		246	if (err)
		247	goto err_unlock_list;
		248
240	vm_exec.vm = &vm->gpuvm;	249	vm_exec.vm = &vm->gpuvm;
241	vm_exec.flags = DRM_EXEC_INTERRUPTIBLE_WAIT;	250	vm_exec.flags = DRM_EXEC_INTERRUPTIBLE_WAIT;
242	if (xe_vm_in_lr_mode(vm)) {	251	if (xe_vm_in_lr_mode(vm)) {

drivers/gpu/drm/xe/xe_pm.c+32−10

 #include "xe_pcode.h"
 #include "xe_pxp.h"
 #include "xe_trace.h"
+#include "xe_vm.h"
 #include "xe_wa.h"
 /**
 	return DEFAULT_VRAM_THRESHOLD;
 }
+static void xe_pm_wake_rebind_workers(struct xe_device *xe)
+{
+	struct xe_vm *vm, *next;
+	mutex_lock(&xe->rebind_resume_lock);
+	list_for_each_entry_safe(vm, next, &xe->rebind_resume_list,
+				 preempt.pm_activate_link) {
+		list_del_init(&vm->preempt.pm_activate_link);
+		xe_vm_resume_rebind_worker(vm);
+	}
+	mutex_unlock(&xe->rebind_resume_lock);
+}
 static int xe_pm_notifier_callback(struct notifier_block *nb,
 				   unsigned long action, void *data)
 {
 	switch (action) {
 	case PM_HIBERNATION_PREPARE:
 	case PM_SUSPEND_PREPARE:
+		reinit_completion(&xe->pm_block);
 		xe_pm_runtime_get(xe);
 		err = xe_bo_evict_all_user(xe);
-		if (err) {
+		if (err)
 			drm_dbg(&xe->drm, "Notifier evict user failed (%d)\n", err);
-			xe_pm_runtime_put(xe);
-			break;
-		}
 		err = xe_bo_notifier_prepare_all_pinned(xe);
-		if (err) {
+		if (err)
 			drm_dbg(&xe->drm, "Notifier prepare pin failed (%d)\n", err);
-			xe_pm_runtime_put(xe);
+		/*
-		}
+		 * Keep the runtime pm reference until post hibernation / post suspend to
+		 * avoid a runtime suspend interfering with evicted objects or backup
+		 * allocations.
+		 */
 		break;
 	case PM_POST_HIBERNATION:
 	case PM_POST_SUSPEND:
+		complete_all(&xe->pm_block);
+		xe_pm_wake_rebind_workers(xe);
 		xe_bo_notifier_unprepare_all_pinned(xe);
 		xe_pm_runtime_put(xe);
 		break;
 	}
-	if (err)
-		return NOTIFY_BAD;
 	return NOTIFY_DONE;
 }
 	if (err)
 		return err;
+	err = drmm_mutex_init(&xe->drm, &xe->rebind_resume_lock);
+	if (err)
+		goto err_unregister;
+	init_completion(&xe->pm_block);
+	complete_all(&xe->pm_block);
+	INIT_LIST_HEAD(&xe->rebind_resume_list);
 	/* For now suspend/resume is only allowed with GuC */
 	if (!xe_device_uc_enabled(xe))
 		return 0;

drivers/gpu/drm/xe/xe_survivability_mode.c+2−1

  *
  *	# echo 1 > /sys/kernel/config/xe/0000:03:00.0/survivability_mode
  *
+ * It is the responsibility of the user to clear the mode once firmware flash is complete.
+ *
  * Refer :ref:`xe_configfs` for more details on how to use configfs
  *
  * Survivability mode is indicated by the below admin-only readable sysfs which provides additional
 	struct pci_dev *pdev = to_pci_dev(xe->drm.dev);
 	struct device *dev = &pdev->dev;
-	xe_configfs_clear_survivability_mode(pdev);
 	sysfs_remove_file(&dev->kobj, &dev_attr_survivability_mode.attr);
 }

drivers/gpu/drm/xe/xe_vm.c+41−1

@@ -393,6 +393,9 @@ static int xe_gpuvm_validate(struct drm_gpuvm_bo vm_bo, struct drm_exec exec) · 392 unmodified lines
393	list_move_tail(&gpuva_to_vma(gpuva)->combined_links.rebind,	393	list_move_tail(&gpuva_to_vma(gpuva)->combined_links.rebind,
394	&vm->rebind_list);	394	&vm->rebind_list);
395		395
		396	if (!try_wait_for_completion(&vm->xe->pm_block))
		397	return -EAGAIN;
		398
396	ret = xe_bo_validate(gem_to_xe_bo(vm_bo->obj), vm, false);	399	ret = xe_bo_validate(gem_to_xe_bo(vm_bo->obj), vm, false);
397	if (ret)	400	if (ret)
398	return ret;	401	return ret;
@@ -479,6 +482,33 @@ static int xe_preempt_work_begin(struct drm_exec exec, struct xe_vm vm, · 80 unmodified lines
479	return xe_vm_validate_rebind(vm, exec, vm->preempt.num_exec_queues);	482	return xe_vm_validate_rebind(vm, exec, vm->preempt.num_exec_queues);
480	}	483	}
481		484
		485	static bool vm_suspend_rebind_worker(struct xe_vm *vm)
		486	{
		487	struct xe_device *xe = vm->xe;
		488	bool ret = false;
		489
		490	mutex_lock(&xe->rebind_resume_lock);
		491	if (!try_wait_for_completion(&vm->xe->pm_block)) {
		492	ret = true;
		493	list_move_tail(&vm->preempt.pm_activate_link, &xe->rebind_resume_list);
		494	}
		495	mutex_unlock(&xe->rebind_resume_lock);
		496
		497	return ret;
		498	}
		499
		500	/**
		501	* xe_vm_resume_rebind_worker() - Resume the rebind worker.
		502	* @vm: The vm whose preempt worker to resume.
		503	*
		504	* Resume a preempt worker that was previously suspended by
		505	* vm_suspend_rebind_worker().
		506	*/
		507	void xe_vm_resume_rebind_worker(struct xe_vm *vm)
		508	{
		509	queue_work(vm->xe->ordered_wq, &vm->preempt.rebind_work);
		510	}
		511
482	static void preempt_rebind_work_func(struct work_struct *w)	512	static void preempt_rebind_work_func(struct work_struct *w)
483	{	513	{
484	struct xe_vm *vm = container_of(w, struct xe_vm, preempt.rebind_work);	514	struct xe_vm *vm = container_of(w, struct xe_vm, preempt.rebind_work);
@@ -502,6 +532,11 @@ static void preempt_rebind_work_func(struct work_struct *w) · 17 unmodified lines
502	}	532	}
503		533
504	retry:	534	retry:
		535	if (!try_wait_for_completion(&vm->xe->pm_block) && vm_suspend_rebind_worker(vm)) {
		536	up_write(&vm->lock);
		537	return;
		538	}
		539
505	if (xe_vm_userptr_check_repin(vm)) {	540	if (xe_vm_userptr_check_repin(vm)) {
506	err = xe_vm_userptr_pin(vm);	541	err = xe_vm_userptr_pin(vm);
507	if (err)	542	if (err)
@@ -1714,6 +1749,7 @@ struct xe_vm xe_vm_create(struct xe_device xe, u32 flags, struct xe_file *xef) · 1206 unmodified lines
1714	if (flags & XE_VM_FLAG_LR_MODE) {	1749	if (flags & XE_VM_FLAG_LR_MODE) {
1715	INIT_WORK(&vm->preempt.rebind_work, preempt_rebind_work_func);	1750	INIT_WORK(&vm->preempt.rebind_work, preempt_rebind_work_func);
1716	xe_pm_runtime_get_noresume(xe);	1751	xe_pm_runtime_get_noresume(xe);
		1752	INIT_LIST_HEAD(&vm->preempt.pm_activate_link);
1717	}	1753	}
1718		1754
1719	if (flags & XE_VM_FLAG_FAULT_MODE) {	1755	if (flags & XE_VM_FLAG_FAULT_MODE) {
@@ -1895,8 +1931,12 @@ void xe_vm_close_and_put(struct xe_vm *vm) · 175 unmodified lines
1895	xe_assert(xe, !vm->preempt.num_exec_queues);	1931	xe_assert(xe, !vm->preempt.num_exec_queues);
1896		1932
1897	xe_vm_close(vm);	1933	xe_vm_close(vm);
1898	if (xe_vm_in_preempt_fence_mode(vm))	1934	if (xe_vm_in_preempt_fence_mode(vm)) {
		1935	mutex_lock(&xe->rebind_resume_lock);
		1936	list_del_init(&vm->preempt.pm_activate_link);
		1937	mutex_unlock(&xe->rebind_resume_lock);
1899	flush_work(&vm->preempt.rebind_work);	1938	flush_work(&vm->preempt.rebind_work);
		1939	}
1900	if (xe_vm_in_fault_mode(vm))	1940	if (xe_vm_in_fault_mode(vm))
1901	xe_svm_close(vm);	1941	xe_svm_close(vm);
1902		1942

drivers/gpu/drm/xe/xe_vm.h+2−0

@@ -273,6 +273,8 @@ struct dma_fence xe_vm_bind_kernel_bo(struct xe_vm vm, struct xe_bo *bo, · 272 unmodified lines
273	struct xe_exec_queue *q, u64 addr,	273	struct xe_exec_queue *q, u64 addr,
274	enum xe_cache_level cache_lvl);	274	enum xe_cache_level cache_lvl);
275		275
		276	void xe_vm_resume_rebind_worker(struct xe_vm *vm);
		277
276	/**	278	/**
277	* xe_vm_resv() - Return's the vm's reservation object	279	* xe_vm_resv() - Return's the vm's reservation object
278	* @vm: The vm	280	* @vm: The vm

drivers/gpu/drm/xe/xe_vm_types.h+5−0

 		 * BOs
 		 */
 		struct work_struct rebind_work;
+		/**
+		 * @preempt.pm_activate_link: Link to list of rebind workers to be
+		 * kicked on resume.
+		 */
+		struct list_head pm_activate_link;
 	} preempt;
 	/** @um: unified memory state */

drivers/gpu/drm/xe/xe_wa_oob.rules+2−1

 16022287689	GRAPHICS_VERSION(2001)
 		GRAPHICS_VERSION(2004)
 13011645652	GRAPHICS_VERSION(2004)
-		GRAPHICS_VERSION(3001)
+		GRAPHICS_VERSION_RANGE(3000, 3001)
+		GRAPHICS_VERSION(3003)
 14022293748	GRAPHICS_VERSION_RANGE(2001, 2002)
 		GRAPHICS_VERSION(2004)
 		GRAPHICS_VERSION_RANGE(3000, 3001)

drivers/gpu/nova-core/Kconfig+1−0

@@ -1,5 +1,6 @@
1	config NOVA_CORE	1	config NOVA_CORE
2	tristate "Nova Core GPU driver"	2	tristate "Nova Core GPU driver"
		3	depends on 64BIT
3	depends on PCI	4	depends on PCI
4	depends on RUST	5	depends on RUST
5	depends on RUST_FW_LOADER_ABSTRACTIONS	6	depends on RUST_FW_LOADER_ABSTRACTIONS

drivers/input/joystick/xpad.c+2−0

 	{ 0x3537, 0x1010, "GameSir G7 SE", 0, XTYPE_XBOXONE },
 	{ 0x366c, 0x0005, "ByoWave Proteus Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE, FLAG_DELAY_INIT },
 	{ 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX },
+	{ 0x37d7, 0x2501, "Flydigi Apex 5", 0, XTYPE_XBOX360 },
 	{ 0x413d, 0x2104, "Black Shark Green Ghost Gamepad", 0, XTYPE_XBOX360 },
 	{ 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX },
 	{ 0x0000, 0x0000, "Generic X-Box pad", 0, XTYPE_UNKNOWN }
 	XPAD_XBOX360_VENDOR(0x3537),		/* GameSir Controllers */
 	XPAD_XBOXONE_VENDOR(0x3537),		/* GameSir Controllers */
 	XPAD_XBOXONE_VENDOR(0x366c),		/* ByoWave controllers */
+	XPAD_XBOX360_VENDOR(0x37d7),		/* Flydigi Controllers */
 	XPAD_XBOX360_VENDOR(0x413d),		/* Black Shark Green Ghost Controller */
 	{ }
 };

drivers/input/keyboard/mtk-pmic-keys.c+4−1

 	const struct mtk_pmic_keys_regs keys_regs[MTK_PMIC_MAX_KEY_COUNT];
 	u32 pmic_rst_reg;
 	u32 rst_lprst_mask; /* Long-press reset timeout bitmask */
+	bool key_release_irq;
 };
 static const struct mtk_pmic_regs mt6397_regs = {
 				   MTK_PMIC_HOMEKEY_RST),
 	.pmic_rst_reg = MT6358_TOP_RST_MISC,
 	.rst_lprst_mask = MTK_PMIC_RST_DU_MASK,
+	.key_release_irq = true,
 };
 static const struct mtk_pmic_regs mt6359_regs = {
 				   MTK_PMIC_HOMEKEY_RST),
 	.pmic_rst_reg = MT6359_TOP_RST_MISC,
 	.rst_lprst_mask = MTK_PMIC_RST_DU_MASK,
+	.key_release_irq = true,
 };
 struct mtk_pmic_keys_info {
 		if (keys->keys[index].irq < 0)
 			return keys->keys[index].irq;
-		if (of_device_is_compatible(node, "mediatek,mt6358-keys")) {
+		if (mtk_pmic_regs->key_release_irq) {
 			keys->keys[index].irq_r = platform_get_irq_byname(pdev,
 									  irqnames_r[index]);

drivers/input/misc/iqs7222.c+3−0

@@ -2427,6 +2427,9 @@ static int iqs7222_parse_chan(struct iqs7222_private *iqs7222, · 2426 unmodified lines
2427	if (error)	2427	if (error)
2428	return error;	2428	return error;
2429		2429
		2430	if (!iqs7222->kp_type[chan_index][i])
		2431	continue;
		2432
2430	if (!dev_desc->event_offset)	2433	if (!dev_desc->event_offset)
2431	continue;	2434	continue;
2432		2435

drivers/input/serio/i8042-acpipnpio.h+14−0

@@ -1155,6 +1155,20 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { · 1154 unmodified lines
1155	.driver_data = (void *)(SERIO_QUIRK_NOMUX \| SERIO_QUIRK_RESET_ALWAYS \|	1155	.driver_data = (void *)(SERIO_QUIRK_NOMUX \| SERIO_QUIRK_RESET_ALWAYS \|
1156	SERIO_QUIRK_NOLOOP \| SERIO_QUIRK_NOPNP)	1156	SERIO_QUIRK_NOLOOP \| SERIO_QUIRK_NOPNP)
1157	},	1157	},
		1158	{
		1159	.matches = {
		1160	DMI_MATCH(DMI_BOARD_NAME, "XxHP4NAx"),
		1161	},
		1162	.driver_data = (void *)(SERIO_QUIRK_NOMUX \| SERIO_QUIRK_RESET_ALWAYS \|
		1163	SERIO_QUIRK_NOLOOP \| SERIO_QUIRK_NOPNP)
		1164	},
		1165	{
		1166	.matches = {
		1167	DMI_MATCH(DMI_BOARD_NAME, "XxKK4NAx_XxSP4NAx"),
		1168	},
		1169	.driver_data = (void *)(SERIO_QUIRK_NOMUX \| SERIO_QUIRK_RESET_ALWAYS \|
		1170	SERIO_QUIRK_NOLOOP \| SERIO_QUIRK_NOPNP)
		1171	},
1158	/*	1172	/*
1159	* A lot of modern Clevo barebones have touchpad and/or keyboard issues	1173	* A lot of modern Clevo barebones have touchpad and/or keyboard issues
1160	* after suspend fixable with the forcenorestore quirk.	1174	* after suspend fixable with the forcenorestore quirk.

drivers/md/dm-integrity.c+1−1

@@ -133,7 +133,7 @@ struct journal_sector { · 132 unmodified lines
133	commit_id_t commit_id;	133	commit_id_t commit_id;
134	};	134	};
135		135
136	#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK]))	136	#define MAX_TAG_SIZE 255
137		137
138	#define METADATA_PADDING_SECTORS 8	138	#define METADATA_PADDING_SECTORS 8
139		139

drivers/md/dm-raid.c+4−2

 	struct raid_set *rs = ti->private;
 	unsigned int chunk_size_bytes = to_bytes(rs->md.chunk_sectors);
-	limits->io_min = chunk_size_bytes;
+	if (chunk_size_bytes) {
-	limits->io_opt = chunk_size_bytes * mddev_data_stripes(rs);
+		limits->io_min = chunk_size_bytes;
+		limits->io_opt = chunk_size_bytes * mddev_data_stripes(rs);
+	}
 }
 static void raid_presuspend(struct dm_target *ti)

drivers/md/dm-stripe.c+7−3

@@ -456,11 +456,15 @@ static void stripe_io_hints(struct dm_target *ti, · 455 unmodified lines
456	struct queue_limits *limits)	456	struct queue_limits *limits)
457	{	457	{
458	struct stripe_c *sc = ti->private;	458	struct stripe_c *sc = ti->private;
459	unsigned int chunk_size = sc->chunk_size << SECTOR_SHIFT;	459	unsigned int io_min, io_opt;
460		460
461	limits->chunk_sectors = sc->chunk_size;	461	limits->chunk_sectors = sc->chunk_size;
462	limits->io_min = chunk_size;	462
463	limits->io_opt = chunk_size * sc->stripes;	463	if (!check_shl_overflow(sc->chunk_size, SECTOR_SHIFT, &io_min) &&
		464	!check_mul_overflow(io_min, sc->stripes, &io_opt)) {
		465	limits->io_min = io_min;
		466	limits->io_opt = io_opt;
		467	}
464	}	468	}
465		469
466	static struct target_type stripe_target = {	470	static struct target_type stripe_target = {

drivers/mtd/devices/Kconfig+2−2

@@ -185,8 +185,8 @@ config MTD_POWERNV_FLASH · 184 unmodified lines
185		185
186	config MTD_INTEL_DG	186	config MTD_INTEL_DG
187	tristate "Intel Discrete Graphics non-volatile memory driver"	187	tristate "Intel Discrete Graphics non-volatile memory driver"
188	depends on AUXILIARY_BUS	188	depends on AUXILIARY_BUS && MTD
189	depends on MTD	189	depends on DRM_I915!=n \|\| DRM_XE!=n \|\| COMPILE_TEST
190	help	190	help
191	This provides an MTD device to access Intel Discrete Graphics	191	This provides an MTD device to access Intel Discrete Graphics
192	non-volatile memory.	192	non-volatile memory.

drivers/mtd/nand/raw/atmel/nand-controller.c+13−3

 	if (ret)
 		return ret;
+	/*
+	 * Read setup timing depends on the operation done on the NAND:
+	 *
+	 * NRD_SETUP = max(tAR, tCLR)
+	 */
+	timeps = max(conf->timings.sdr.tAR_min, conf->timings.sdr.tCLR_min);
+	ncycles = DIV_ROUND_UP(timeps, mckperiodps);
+	totalcycles += ncycles;
+	ret = atmel_smc_cs_conf_set_setup(smcconf, ATMEL_SMC_NRD_SHIFT, ncycles);
+	if (ret)
+		return ret;
 	/*
 	 * The read cycle timing is directly matching tRC, but is also
 	 * dependent on the setup and hold timings we calculated earlier,
 	 * which gives:
 	 *
-	 * NRD_CYCLE = max(tRC, NRD_PULSE + NRD_HOLD)
+	 * NRD_CYCLE = max(tRC, NRD_SETUP + NRD_PULSE + NRD_HOLD)
-	 *
-	 * NRD_SETUP is always 0.
 	 */
 	ncycles = DIV_ROUND_UP(conf->timings.sdr.tRC_min, mckperiodps);
 	ncycles = max(totalcycles, ncycles);

drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c+2−2

@@ -935,10 +935,10 @@ static void ma35_chips_cleanup(struct ma35_nand_info *nand) · 934 unmodified lines
935		935
936	static int ma35_nand_chips_init(struct device dev, struct ma35_nand_info nand)	936	static int ma35_nand_chips_init(struct device dev, struct ma35_nand_info nand)
937	{	937	{
938	struct device_node np = dev->of_node, nand_np;	938	struct device_node *np = dev->of_node;
939	int ret;	939	int ret;
940		940
941	for_each_child_of_node(np, nand_np) {	941	for_each_child_of_node_scoped(np, nand_np) {
942	ret = ma35_nand_chip_init(dev, nand, nand_np);	942	ret = ma35_nand_chip_init(dev, nand, nand_np);
943	if (ret) {	943	if (ret) {
944	ma35_chips_cleanup(nand);	944	ma35_chips_cleanup(nand);

drivers/mtd/nand/raw/stm32_fmc2_nand.c+24−22

 	struct sg_table dma_data_sg;
 	struct sg_table dma_ecc_sg;
 	u8 *ecc_buf;
+	dma_addr_t dma_ecc_addr;
 	int dma_ecc_len;
 	u32 tx_dma_max_burst;
 	u32 rx_dma_max_burst;
 	if (!write_data && !raw) {
 		/* Configure DMA ECC status */
-		p = nfc->ecc_buf;
 		for_each_sg(nfc->dma_ecc_sg.sgl, sg, eccsteps, s) {
-			sg_set_buf(sg, p, nfc->dma_ecc_len);
+			sg_dma_address(sg) = nfc->dma_ecc_addr +
-			p += nfc->dma_ecc_len;
+					     s * nfc->dma_ecc_len;
-		}
+			sg_dma_len(sg) = nfc->dma_ecc_len;
-		ret = dma_map_sg(nfc->dev, nfc->dma_ecc_sg.sgl,
-				 eccsteps, dma_data_dir);
-		if (!ret) {
-			ret = -EIO;
-			goto err_unmap_data;
 		}
 		desc_ecc = dmaengine_prep_slave_sg(nfc->dma_ecc_ch,
 						   DMA_PREP_INTERRUPT);
 		if (!desc_ecc) {
 			ret = -ENOMEM;
-			goto err_unmap_ecc;
+			goto err_unmap_data;
 		}
 		reinit_completion(&nfc->dma_ecc_complete);
 		desc_ecc->callback_param = &nfc->dma_ecc_complete;
 		ret = dma_submit_error(dmaengine_submit(desc_ecc));
 		if (ret)
-			goto err_unmap_ecc;
+			goto err_unmap_data;
 		dma_async_issue_pending(nfc->dma_ecc_ch);
 	}
 		if (!write_data && !raw)
 			dmaengine_terminate_all(nfc->dma_ecc_ch);
 		ret = -ETIMEDOUT;
-		goto err_unmap_ecc;
+		goto err_unmap_data;
 	}
 	/* Wait DMA data transfer completion */
 		}
 	}
-err_unmap_ecc:
-	if (!write_data && !raw)
-		dma_unmap_sg(nfc->dev, nfc->dma_ecc_sg.sgl,
-			     eccsteps, dma_data_dir);
 err_unmap_data:
 	dma_unmap_sg(nfc->dev, nfc->dma_data_sg.sgl, eccsteps, dma_data_dir);
 	/* Write oob */
 	if (oob_required) {
-		ret = nand_change_write_column_op(chip, mtd->writesize,
+		unsigned int offset_in_page = mtd->writesize;
-						  chip->oob_poi, mtd->oobsize,
+		const void *buf = chip->oob_poi;
-						  false);
+		unsigned int len = mtd->oobsize;
+		if (!raw) {
+			struct mtd_oob_region oob_free;
+			mtd_ooblayout_free(mtd, 0, &oob_free);
+			offset_in_page += oob_free.offset;
+			buf += oob_free.offset;
+			len = oob_free.length;
+		}
+		ret = nand_change_write_column_op(chip, offset_in_page,
+						  buf, len, false);
 		if (ret)
 			return ret;
 	}
 		return ret;
 	/* Allocate a buffer to store ECC status registers */
-	nfc->ecc_buf = devm_kzalloc(nfc->dev, FMC2_MAX_ECC_BUF_LEN, GFP_KERNEL);
+	nfc->ecc_buf = dmam_alloc_coherent(nfc->dev, FMC2_MAX_ECC_BUF_LEN,
+					   &nfc->dma_ecc_addr, GFP_KERNEL);
 	if (!nfc->ecc_buf)
 		return -ENOMEM;

drivers/mtd/nand/spi/winbond.c+36−1

@@ -176,6 +176,36 @@ static const struct mtd_ooblayout_ops w25n02kv_ooblayout = { · 175 unmodified lines
176	.free = w25n02kv_ooblayout_free,	176	.free = w25n02kv_ooblayout_free,
177	};	177	};
178		178
		179	static int w25n01jw_ooblayout_ecc(struct mtd_info *mtd, int section,
		180	struct mtd_oob_region *region)
		181	{
		182	if (section > 3)
		183	return -ERANGE;
		184
		185	region->offset = (16 * section) + 12;
		186	region->length = 4;
		187
		188	return 0;
		189	}
		190
		191	static int w25n01jw_ooblayout_free(struct mtd_info *mtd, int section,
		192	struct mtd_oob_region *region)
		193	{
		194	if (section > 3)
		195	return -ERANGE;
		196
		197	region->offset = (16 * section);
		198	region->length = 12;
		199
		200	/* Extract BBM */
		201	if (!section) {
		202	region->offset += 2;
		203	region->length -= 2;
		204	}
		205
		206	return 0;
		207	}
		208
179	static int w35n01jw_ooblayout_ecc(struct mtd_info *mtd, int section,	209	static int w35n01jw_ooblayout_ecc(struct mtd_info *mtd, int section,
180	struct mtd_oob_region *region)	210	struct mtd_oob_region *region)
181	{	211	{
@@ -206,6 +236,11 @@ static int w35n01jw_ooblayout_free(struct mtd_info *mtd, int section, · 24 unmodified lines
206	return 0;	236	return 0;
207	}	237	}
208		238
		239	static const struct mtd_ooblayout_ops w25n01jw_ooblayout = {
		240	.ecc = w25n01jw_ooblayout_ecc,
		241	.free = w25n01jw_ooblayout_free,
		242	};
		243
209	static const struct mtd_ooblayout_ops w35n01jw_ooblayout = {	244	static const struct mtd_ooblayout_ops w35n01jw_ooblayout = {
210	.ecc = w35n01jw_ooblayout_ecc,	245	.ecc = w35n01jw_ooblayout_ecc,
211	.free = w35n01jw_ooblayout_free,	246	.free = w35n01jw_ooblayout_free,
@@ -394,7 +429,7 @@ static const struct spinand_info winbond_spinand_table[] = { · 182 unmodified lines
394	&write_cache_variants,	429	&write_cache_variants,
395	&update_cache_variants),	430	&update_cache_variants),
396	0,	431	0,
397	SPINAND_ECCINFO(&w25m02gv_ooblayout, NULL),	432	SPINAND_ECCINFO(&w25n01jw_ooblayout, NULL),
398	SPINAND_CONFIGURE_CHIP(w25n0xjw_hs_cfg)),	433	SPINAND_CONFIGURE_CHIP(w25n0xjw_hs_cfg)),
399	SPINAND_INFO("W25N01KV", /* 3.3V */	434	SPINAND_INFO("W25N01KV", /* 3.3V */
400	SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xae, 0x21),	435	SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xae, 0x21),

drivers/net/bonding/bond_main.c+1−1

 		memcpy(ss.__data, bond_dev->dev_addr, bond_dev->addr_len);
 	} else if (bond->params.fail_over_mac == BOND_FOM_FOLLOW &&
 		   BOND_MODE(bond) == BOND_MODE_ACTIVEBACKUP &&
+		   bond_has_slaves(bond) &&
 		   memcmp(slave_dev->dev_addr, bond_dev->dev_addr, bond_dev->addr_len) == 0) {
 		/* Set slave to random address to avoid duplicate mac
 		 * address in later fail over.
 		/* Find out through which dev should the packet go */
 		memset(&fl6, 0, sizeof(struct flowi6));
 		fl6.daddr = targets[i];
-		fl6.flowi6_oif = bond->dev->ifindex;
 		dst = ip6_route_output(dev_net(bond->dev), NULL, &fl6);
 		if (dst->error) {

drivers/net/ethernet/broadcom/cnic.c+1−2

@@ -4230,8 +4230,7 @@ static void cnic_cm_stop_bnx2x_hw(struct cnic_dev *dev) · 4229 unmodified lines
4230		4230
4231	cnic_bnx2x_delete_wait(dev, 0);	4231	cnic_bnx2x_delete_wait(dev, 0);
4232		4232
4233	cancel_delayed_work(&cp->delete_task);	4233	cancel_delayed_work_sync(&cp->delete_task);
4234	flush_workqueue(cnic_wq);
4235		4234
4236	if (atomic_read(&cp->iscsi_conn) != 0)	4235	if (atomic_read(&cp->iscsi_conn) != 0)
4237	netdev_warn(dev->netdev, "%d iSCSI connections not destroyed\n",	4236	netdev_warn(dev->netdev, "%d iSCSI connections not destroyed\n",

drivers/net/ethernet/cavium/liquidio/request_manager.c+1−1

@@ -126,7 +126,7 @@ int octeon_init_instr_queue(struct octeon_device *oct, · 125 unmodified lines
126	oct->io_qmask.iq \|= BIT_ULL(iq_no);	126	oct->io_qmask.iq \|= BIT_ULL(iq_no);
127		127
128	/* Set the 32B/64B mode for each input queue */	128	/* Set the 32B/64B mode for each input queue */
129	oct->io_qmask.iq64B \|= ((conf->instr_type == 64) << iq_no);	129	oct->io_qmask.iq64B \|= ((u64)(conf->instr_type == 64) << iq_no);
130	iq->iqcmd_64B = (conf->instr_type == 64);	130	iq->iqcmd_64B = (conf->instr_type == 64);
131		131
132	oct->fn_list.setup_iq_regs(oct, iq_no);	132	oct->fn_list.setup_iq_regs(oct, iq_no);

drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c+1−1

@@ -2736,7 +2736,7 @@ static int dpaa2_switch_setup_dpbp(struct ethsw_core *ethsw) · 2735 unmodified lines
2736	dev_err(dev, "dpsw_ctrl_if_set_pools() failed\n");	2736	dev_err(dev, "dpsw_ctrl_if_set_pools() failed\n");
2737	goto err_get_attr;	2737	goto err_get_attr;
2738	}	2738	}
2739	ethsw->bpid = dpbp_attrs.id;	2739	ethsw->bpid = dpbp_attrs.bpid;
2740		2740
2741	return 0;	2741	return 0;
2742		2742

drivers/net/ethernet/intel/i40e/i40e_txrx.c+0−3

@@ -948,9 +948,6 @@ static bool i40e_clean_tx_irq(struct i40e_vsi *vsi, · 947 unmodified lines
948	if (!eop_desc)	948	if (!eop_desc)
949	break;	949	break;
950		950
951	/* prevent any other reads prior to eop_desc */
952	smp_rmb();
953
954	i40e_trace(clean_tx_irq, tx_ring, tx_desc, tx_buf);	951	i40e_trace(clean_tx_irq, tx_ring, tx_desc, tx_buf);
955	/* we have caught up to head, no work left to do */	952	/* we have caught up to head, no work left to do */
956	if (tx_head == tx_desc)	953	if (tx_head == tx_desc)

drivers/net/ethernet/intel/ice/ice_txrx.c+34−46

 	__skb_fill_page_desc_noacc(sinfo, sinfo->nr_frags++, rx_buf->page,
 				   rx_buf->page_offset, size);
 	sinfo->xdp_frags_size += size;
-	/* remember frag count before XDP prog execution; bpf_xdp_adjust_tail()
-	 * can pop off frags but driver has to handle it on its own
-	 */
-	rx_ring->nr_frags = sinfo->nr_frags;
 	if (page_is_pfmemalloc(rx_buf->page))
 		xdp_buff_set_frag_pfmemalloc(xdp);
 /**
  * ice_get_pgcnts - grab page_count() for gathered fragments
  * @rx_ring: Rx descriptor ring to store the page counts on
+ * @ntc: the next to clean element (not included in this frame!)
  *
  * This function is intended to be called right before running XDP
  * program so that the page recycling mechanism will be able to take
  * a correct decision regarding underlying pages; this is done in such
  * way as XDP program can change the refcount of page
  */
-static void ice_get_pgcnts(struct ice_rx_ring *rx_ring)
+static void ice_get_pgcnts(struct ice_rx_ring *rx_ring, unsigned int ntc)
 {
-	u32 nr_frags = rx_ring->nr_frags + 1;
 	u32 idx = rx_ring->first_desc;
 	struct ice_rx_buf *rx_buf;
 	u32 cnt = rx_ring->count;
-	for (int i = 0; i < nr_frags; i++) {
+	while (idx != ntc) {
 		rx_buf = &rx_ring->rx_buf[idx];
 		rx_buf->pgcnt = page_count(rx_buf->page);
 }
 /**
- * ice_put_rx_mbuf - ice_put_rx_buf() caller, for all frame frags
+ * ice_put_rx_mbuf - ice_put_rx_buf() caller, for all buffers in frame
  * @rx_ring: Rx ring with all the auxiliary data
  * @xdp: XDP buffer carrying linear + frags part
- * @xdp_xmit: XDP_TX/XDP_REDIRECT verdict storage
+ * @ntc: the next to clean element (not included in this frame!)
- * @ntc: a current next_to_clean value to be stored at rx_ring
  * @verdict: return code from XDP program execution
  *
- * Walk through gathered fragments and satisfy internal page
+ * Called after XDP program is completed, or on error with verdict set to
- * recycle mechanism; we take here an action related to verdict
+ * ICE_XDP_CONSUMED.
- * returned by XDP program;
+ *
+ * Walk through buffers from first_desc to the end of the frame, releasing
+ * buffers and satisfying internal page recycle mechanism. The action depends
+ * on verdict from XDP program.
  */
 static void ice_put_rx_mbuf(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp,
-			    u32 *xdp_xmit, u32 ntc, u32 verdict)
+			    u32 ntc, u32 verdict)
 {
-	u32 nr_frags = rx_ring->nr_frags + 1;
 	u32 idx = rx_ring->first_desc;
 	u32 cnt = rx_ring->count;
-	u32 post_xdp_frags = 1;
 	struct ice_rx_buf *buf;
-	int i;
+	u32 xdp_frags = 0;
+	int i = 0;
 	if (unlikely(xdp_buff_has_frags(xdp)))
-		post_xdp_frags += xdp_get_shared_info_from_buff(xdp)->nr_frags;
+		xdp_frags = xdp_get_shared_info_from_buff(xdp)->nr_frags;
-	for (i = 0; i < post_xdp_frags; i++) {
+	while (idx != ntc) {
 		buf = &rx_ring->rx_buf[idx];
+		if (++idx == cnt)
+			idx = 0;
-		if (verdict & (ICE_XDP_TX | ICE_XDP_REDIR)) {
+		/* An XDP program could release fragments from the end of the
+		 * buffer. For these, we need to keep the pagecnt_bias as-is.
+		 * To do this, only adjust pagecnt_bias for fragments up to
+		 * the total remaining after the XDP program has run.
+		 */
+		if (verdict != ICE_XDP_CONSUMED)
 			ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz);
-			*xdp_xmit |= verdict;
+		else if (i++ <= xdp_frags)
-		} else if (verdict & ICE_XDP_CONSUMED) {
 			buf->pagecnt_bias++;
-		} else if (verdict == ICE_XDP_PASS) {
-			ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz);
-		}
 		ice_put_rx_buf(rx_ring, buf);
-		if (++idx == cnt)
-			idx = 0;
-	}
-	/* handle buffers that represented frags released by XDP prog;
-	 * for these we keep pagecnt_bias as-is; refcount from struct page
-	 * has been decremented within XDP prog and we do not have to increase
-	 * the biased refcnt
-	 */
-	for (; i < nr_frags; i++) {
-		buf = &rx_ring->rx_buf[idx];
-		ice_put_rx_buf(rx_ring, buf);
-		if (++idx == cnt)
-			idx = 0;
 	}
 	xdp->data = NULL;
 	rx_ring->first_desc = ntc;
-	rx_ring->nr_frags = 0;
 }
 /**
 		/* retrieve a buffer from the ring */
 		rx_buf = ice_get_rx_buf(rx_ring, size, ntc);
+		/* Increment ntc before calls to ice_put_rx_mbuf() */
+		if (++ntc == cnt)
+			ntc = 0;
 		if (!xdp->data) {
 			void *hard_start;
 			xdp_prepare_buff(xdp, hard_start, offset, size, !!offset);
 			xdp_buff_clear_frags_flag(xdp);
 		} else if (ice_add_xdp_frag(rx_ring, xdp, rx_buf, size)) {
-			ice_put_rx_mbuf(rx_ring, xdp, NULL, ntc, ICE_XDP_CONSUMED);
+			ice_put_rx_mbuf(rx_ring, xdp, ntc, ICE_XDP_CONSUMED);
 			break;
 		}
-		if (++ntc == cnt)
-			ntc = 0;
 		/* skip if it is NOP desc */
 		if (ice_is_non_eop(rx_ring, rx_desc))
 			continue;
-		ice_get_pgcnts(rx_ring);
+		ice_get_pgcnts(rx_ring, ntc);
 		xdp_verdict = ice_run_xdp(rx_ring, xdp, xdp_prog, xdp_ring, rx_desc);
 		if (xdp_verdict == ICE_XDP_PASS)
 			goto construct_skb;
 		total_rx_bytes += xdp_get_buff_len(xdp);
 		total_rx_pkts++;
-		ice_put_rx_mbuf(rx_ring, xdp, &xdp_xmit, ntc, xdp_verdict);
+		ice_put_rx_mbuf(rx_ring, xdp, ntc, xdp_verdict);
+		xdp_xmit |= xdp_verdict & (ICE_XDP_TX | ICE_XDP_REDIR);
 		continue;
 construct_skb:
 			rx_ring->ring_stats->rx_stats.alloc_buf_failed++;
 			xdp_verdict = ICE_XDP_CONSUMED;
 		}
-		ice_put_rx_mbuf(rx_ring, xdp, &xdp_xmit, ntc, xdp_verdict);
+		ice_put_rx_mbuf(rx_ring, xdp, ntc, xdp_verdict);
 		if (!skb)
 			break;

drivers/net/ethernet/intel/ice/ice_txrx.h+0−1

@@ -358,7 +358,6 @@ struct ice_rx_ring { · 357 unmodified lines
358	struct ice_tx_ring *xdp_ring;	358	struct ice_tx_ring *xdp_ring;
359	struct ice_rx_ring next; / pointer to next ring in q_vector */	359	struct ice_rx_ring next; / pointer to next ring in q_vector */
360	struct xsk_buff_pool *xsk_pool;	360	struct xsk_buff_pool *xsk_pool;
361	u32 nr_frags;
362	u16 max_frame;	361	u16 max_frame;
363	u16 rx_buf_len;	362	u16 rx_buf_len;
364	dma_addr_t dma; /* physical address of ring */	363	dma_addr_t dma; /* physical address of ring */

drivers/net/ethernet/intel/igc/igc.h+1−0

@@ -345,6 +345,7 @@ struct igc_adapter { · 344 unmodified lines
345	/* LEDs */	345	/* LEDs */
346	struct mutex led_mutex;	346	struct mutex led_mutex;
347	struct igc_led_classdev *leds;	347	struct igc_led_classdev *leds;
		348	bool leds_available;
348	};	349	};
349		350
350	void igc_up(struct igc_adapter *adapter);	351	void igc_up(struct igc_adapter *adapter);

drivers/net/ethernet/intel/igc/igc_main.c+9−3

 	if (IS_ENABLED(CONFIG_IGC_LEDS)) {
 		err = igc_led_setup(adapter);
-		if (err)
+		if (err) {
-			goto err_register;
+			netdev_warn_once(netdev,
+					 "LED init failed (%d); continuing without LED support\n",
+					 err);
+			adapter->leds_available = false;
+		} else {
+			adapter->leds_available = true;
+		}
 	}
 	return 0;
 	cancel_work_sync(&adapter->watchdog_task);
 	hrtimer_cancel(&adapter->hrtimer);
-	if (IS_ENABLED(CONFIG_IGC_LEDS))
+	if (IS_ENABLED(CONFIG_IGC_LEDS) && adapter->leds_available)
 		igc_led_free(adapter);
 	/* Release control of h/w to f/w.  If f/w is AMT enabled, this

drivers/net/ethernet/intel/ixgbe/ixgbe_main.c+12−10

 		break;
 	}
+	/* Make sure the SWFW semaphore is in a valid state */
+	if (hw->mac.ops.init_swfw_sync)
+		hw->mac.ops.init_swfw_sync(hw);
+	if (hw->mac.type == ixgbe_mac_e610)
+		mutex_init(&hw->aci.lock);
 #ifdef IXGBE_FCOE
 	/* FCoE support exists, always init the FCoE lock */
 	spin_lock_init(&adapter->fcoe.lock);
 	if (err)
 		goto err_sw_init;
-	/* Make sure the SWFW semaphore is in a valid state */
-	if (hw->mac.ops.init_swfw_sync)
-		hw->mac.ops.init_swfw_sync(hw);
 	if (ixgbe_check_fw_error(adapter))
 		return ixgbe_recovery_probe(adapter);
 	ether_addr_copy(hw->mac.addr, hw->mac.perm_addr);
 	ixgbe_mac_set_default_filter(adapter);
-	if (hw->mac.type == ixgbe_mac_e610)
-		mutex_init(&hw->aci.lock);
 	timer_setup(&adapter->service_timer, ixgbe_service_timer, 0);
 	if (ixgbe_removed(hw->hw_addr)) {
 	devl_unlock(adapter->devlink);
 	ixgbe_release_hw_control(adapter);
 	ixgbe_clear_interrupt_scheme(adapter);
+err_sw_init:
 	if (hw->mac.type == ixgbe_mac_e610)
 		mutex_destroy(&adapter->hw.aci.lock);
-err_sw_init:
 	ixgbe_disable_sriov(adapter);
 	adapter->flags2 &= ~IXGBE_FLAG2_SEARCH_FOR_SFP;
 	iounmap(adapter->io_addr);
 	set_bit(__IXGBE_REMOVING, &adapter->state);
 	cancel_work_sync(&adapter->service_task);
-	if (adapter->hw.mac.type == ixgbe_mac_e610) {
+	if (adapter->hw.mac.type == ixgbe_mac_e610)
 		ixgbe_disable_link_status_events(adapter);
-		mutex_destroy(&adapter->hw.aci.lock);
-	}
 	if (adapter->mii_bus)
 		mdiobus_unregister(adapter->mii_bus);
 	disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter->state);
 	free_netdev(netdev);
+	if (adapter->hw.mac.type == ixgbe_mac_e610)
+		mutex_destroy(&adapter->hw.aci.lock);
 	if (disable_dev)
 		pci_disable_device(pdev);
 }

drivers/net/ethernet/marvell/octeon_ep/octep_main.c+16−0

 	return err;
 }
+static bool octep_is_vf_valid(struct octep_device *oct, int vf)
+{
+	if (vf >= CFG_GET_ACTIVE_VFS(oct->conf)) {
+		netdev_err(oct->netdev, "Invalid VF ID %d\n", vf);
+		return false;
+	}
+	return true;
+}
 static int octep_get_vf_config(struct net_device *dev, int vf,
 			       struct ifla_vf_info *ivi)
 {
 	struct octep_device *oct = netdev_priv(dev);
+	if (!octep_is_vf_valid(oct, vf))
+		return -EINVAL;
 	ivi->vf = vf;
 	ether_addr_copy(ivi->mac, oct->vf_info[vf].mac_addr);
 	ivi->spoofchk = true;
 	struct octep_device *oct = netdev_priv(dev);
 	int err;
+	if (!octep_is_vf_valid(oct, vf))
+		return -EINVAL;
 	if (!is_valid_ether_addr(mac)) {
 		dev_err(&oct->pdev->dev, "Invalid  MAC Address %pM\n", mac);
 		return -EADDRNOTAVAIL;

drivers/net/ethernet/marvell/octeon_ep/octep_pfvf_mbox.c+3−0

 			vf_id);
 		return;
 	}
+	ether_addr_copy(oct->vf_info[vf_id].mac_addr, rsp->s_set_mac.mac_addr);
 	rsp->s_set_mac.type = OCTEP_PFVF_MBOX_TYPE_RSP_ACK;
 }
 {
 	int err;
+	/* Reset VF-specific information maintained by the PF */
+	memset(&oct->vf_info[vf_id], 0, sizeof(struct octep_pfvf_info));
 	err = octep_ctrl_net_dev_remove(oct, vf_id);
 	if (err) {
 		rsp->s.type = OCTEP_PFVF_MBOX_TYPE_RSP_NACK;

drivers/net/ethernet/marvell/octeontx2/nic/otx2_ptp.c+1−1

@@ -491,7 +491,7 @@ void otx2_ptp_destroy(struct otx2_nic *pfvf) · 490 unmodified lines
491	if (!ptp)	491	if (!ptp)
492	return;	492	return;
493		493
494	cancel_delayed_work(&pfvf->ptp->synctstamp_work);	494	cancel_delayed_work_sync(&pfvf->ptp->synctstamp_work);
495		495
496	ptp_clock_unregister(ptp->ptp_clock);	496	ptp_clock_unregister(ptp->ptp_clock);
497	kfree(ptp);	497	kfree(ptp);

drivers/net/ethernet/mellanox/mlx5/core/en/fs.h+1−0

@@ -92,6 +92,7 @@ enum { · 91 unmodified lines
92	MLX5E_ACCEL_FS_ESP_FT_LEVEL = MLX5E_INNER_TTC_FT_LEVEL + 1,	92	MLX5E_ACCEL_FS_ESP_FT_LEVEL = MLX5E_INNER_TTC_FT_LEVEL + 1,
93	MLX5E_ACCEL_FS_ESP_FT_ERR_LEVEL,	93	MLX5E_ACCEL_FS_ESP_FT_ERR_LEVEL,
94	MLX5E_ACCEL_FS_POL_FT_LEVEL,	94	MLX5E_ACCEL_FS_POL_FT_LEVEL,
		95	MLX5E_ACCEL_FS_POL_MISS_FT_LEVEL,
95	MLX5E_ACCEL_FS_ESP_FT_ROCE_LEVEL,	96	MLX5E_ACCEL_FS_ESP_FT_ROCE_LEVEL,
96	#endif	97	#endif
97	};	98	};

drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h+1−0

@@ -185,6 +185,7 @@ struct mlx5e_ipsec_rx_create_attr { · 184 unmodified lines
185	u32 family;	185	u32 family;
186	int prio;	186	int prio;
187	int pol_level;	187	int pol_level;
		188	int pol_miss_level;
188	int sa_level;	189	int sa_level;
189	int status_level;	190	int status_level;
190	enum mlx5_flow_namespace_type chains_ns;	191	enum mlx5_flow_namespace_type chains_ns;

drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c+2−1

 	attr->family = family;
 	attr->prio = MLX5E_NIC_PRIO;
 	attr->pol_level = MLX5E_ACCEL_FS_POL_FT_LEVEL;
+	attr->pol_miss_level = MLX5E_ACCEL_FS_POL_MISS_FT_LEVEL;
 	attr->sa_level = MLX5E_ACCEL_FS_ESP_FT_LEVEL;
 	attr->status_level = MLX5E_ACCEL_FS_ESP_FT_ERR_LEVEL;
 	attr->chains_ns = MLX5_FLOW_NAMESPACE_KERNEL;
 	ft_attr.max_fte = 1;
 	ft_attr.autogroup.max_num_groups = 1;
-	ft_attr.level = attr->pol_level;
+	ft_attr.level = attr->pol_miss_level;
 	ft_attr.prio = attr->prio;
 	ft = mlx5_create_auto_grouped_flow_table(attr->ns, &ft_attr);

drivers/net/ethernet/mellanox/mlx5/core/en_main.c+0−2

 	if (up) {
 		netdev_info(priv->netdev, "Link up\n");
 		netif_carrier_on(priv->netdev);
-		mlx5e_port_manual_buffer_config(priv, 0, priv->netdev->mtu,
-						NULL, NULL, NULL);
 	} else {
 		netdev_info(priv->netdev, "Link down\n");
 		netif_carrier_off(priv->netdev);

drivers/net/ethernet/mellanox/mlx5/core/en_rep.c+22−5

 static int
 mlx5e_vport_uplink_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep)
 {
-	struct mlx5e_priv *priv = netdev_priv(mlx5_uplink_netdev_get(dev));
 	struct mlx5e_rep_priv *rpriv = mlx5e_rep_to_rep_priv(rep);
+	struct net_device *netdev;
+	struct mlx5e_priv *priv;
+	int err;
+	netdev = mlx5_uplink_netdev_get(dev);
+	if (!netdev)
+		return 0;
+	priv = netdev_priv(netdev);
 	rpriv->netdev = priv->netdev;
-	return mlx5e_netdev_change_profile(priv, &mlx5e_uplink_rep_profile,
+	err = mlx5e_netdev_change_profile(priv, &mlx5e_uplink_rep_profile,
-					   rpriv);
+					  rpriv);
+	mlx5_uplink_netdev_put(dev, netdev);
+	return err;
 }
 static void
 {
 	struct mlx5e_rep_priv *rpriv = mlx5e_rep_to_rep_priv(rep);
 	struct net_device *netdev = rpriv->netdev;
-	struct mlx5e_priv *priv = netdev_priv(netdev);
+	struct mlx5e_priv *priv;
-	void *ppriv = priv->ppriv;
+	void *ppriv;
+	if (!netdev) {
+		ppriv = rpriv;
+		goto free_ppriv;
+	}
+	priv = netdev_priv(netdev);
+	ppriv = priv->ppriv;
 	if (rep->vport == MLX5_VPORT_UPLINK) {
 		mlx5e_vport_uplink_rep_unload(rpriv);

drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c+1−0

@@ -1515,6 +1515,7 @@ static u32 mlx5_esw_qos_lag_link_speed_get_locked(struct mlx5_core_dev *mdev) · 1514 unmodified lines
1515	speed = lksettings.base.speed;	1515	speed = lksettings.base.speed;
1516		1516
1517	out:	1517	out:
		1518	mlx5_uplink_netdev_put(mdev, slave);
1518	return speed;	1519	return speed;
1519	}	1520	}
1520		1521

drivers/net/ethernet/mellanox/mlx5/core/fs_core.c+2−2

@@ -114,9 +114,9 @@ · 113 unmodified lines
114	#define ETHTOOL_NUM_PRIOS 11	114	#define ETHTOOL_NUM_PRIOS 11
115	#define ETHTOOL_MIN_LEVEL (KERNEL_MIN_LEVEL + ETHTOOL_NUM_PRIOS)	115	#define ETHTOOL_MIN_LEVEL (KERNEL_MIN_LEVEL + ETHTOOL_NUM_PRIOS)
116	/* Vlan, mac, ttc, inner ttc, {UDP/ANY/aRFS/accel/{esp, esp_err}}, IPsec policy,	116	/* Vlan, mac, ttc, inner ttc, {UDP/ANY/aRFS/accel/{esp, esp_err}}, IPsec policy,
117	* {IPsec RoCE MPV,Alias table},IPsec RoCE policy	117	* IPsec policy miss, {IPsec RoCE MPV,Alias table},IPsec RoCE policy
118	*/	118	*/
119	#define KERNEL_NIC_PRIO_NUM_LEVELS 10	119	#define KERNEL_NIC_PRIO_NUM_LEVELS 11
120	#define KERNEL_NIC_NUM_PRIOS 1	120	#define KERNEL_NIC_NUM_PRIOS 1
121	/* One more level for tc, and one more for promisc */	121	/* One more level for tc, and one more for promisc */
122	#define KERNEL_MIN_LEVEL (KERNEL_NIC_PRIO_NUM_LEVELS + 2)	122	#define KERNEL_MIN_LEVEL (KERNEL_NIC_PRIO_NUM_LEVELS + 2)

drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h+14−1

@@ -47,7 +47,20 @@ int mlx5_crdump_collect(struct mlx5_core_dev dev, u32 cr_data); · 46 unmodified lines
47		47
48	static inline struct net_device mlx5_uplink_netdev_get(struct mlx5_core_dev mdev)	48	static inline struct net_device mlx5_uplink_netdev_get(struct mlx5_core_dev mdev)
49	{	49	{
50	return mdev->mlx5e_res.uplink_netdev;	50	struct mlx5e_resources *mlx5e_res = &mdev->mlx5e_res;
		51	struct net_device *netdev;
		52
		53	mutex_lock(&mlx5e_res->uplink_netdev_lock);
		54	netdev = mlx5e_res->uplink_netdev;
		55	netdev_hold(netdev, &mlx5e_res->tracker, GFP_KERNEL);
		56	mutex_unlock(&mlx5e_res->uplink_netdev_lock);
		57	return netdev;
		58	}
		59
		60	static inline void mlx5_uplink_netdev_put(struct mlx5_core_dev *mdev,
		61	struct net_device *netdev)
		62	{
		63	netdev_put(netdev, &mdev->mlx5e_res.tracker);
51	}	64	}
52		65
53	struct mlx5_sd;	66	struct mlx5_sd;

drivers/net/ethernet/mellanox/mlx5/core/port.c+5−1

@@ -1170,7 +1170,11 @@ const struct mlx5_link_info mlx5_port_ptys2info(struct mlx5_core_dev mdev, · 1169 unmodified lines
1170	mlx5e_port_get_link_mode_info_arr(mdev, &table, &max_size,	1170	mlx5e_port_get_link_mode_info_arr(mdev, &table, &max_size,
1171	force_legacy);	1171	force_legacy);
1172	i = find_first_bit(&temp, max_size);	1172	i = find_first_bit(&temp, max_size);
1173	if (i < max_size)	1173
		1174	/* mlx5e_link_info has holes. Check speed
		1175	* is not zero as indication of one.
		1176	*/
		1177	if (i < max_size && table[i].speed)
1174	return &table[i];	1178	return &table[i];
1175		1179
1176	return NULL;	1180	return NULL;

drivers/net/ethernet/natsemi/ns83820.c+6−7

 	struct ns83820 *dev = PRIV(ndev);
 	struct rx_info *info = &dev->rx_info;
 	unsigned next_rx;
-	int rx_rc, len;
+	int len;
 	u32 cmdsts;
 	__le32 *desc;
 	unsigned long flags;
 		if (likely(CMDSTS_OK & cmdsts)) {
 #endif
 			skb_put(skb, len);
-			if (unlikely(!skb))
+			if (unlikely(!skb)) {
+				ndev->stats.rx_dropped++;
 				goto netdev_mangle_me_harder_failed;
+			}
 			if (cmdsts & CMDSTS_DEST_MULTI)
 				ndev->stats.multicast++;
 			ndev->stats.rx_packets++;
 				__vlan_hwaccel_put_tag(skb, htons(ETH_P_IPV6), tag);
 			}
 #endif
-			rx_rc = netif_rx(skb);
+			netif_rx(skb);
-			if (NET_RX_DROP == rx_rc) {
-netdev_mangle_me_harder_failed:
-				ndev->stats.rx_dropped++;
-			}
 		} else {
 			dev_kfree_skb_irq(skb);
 		}
+netdev_mangle_me_harder_failed:
 		nr++;
 		next_rx = info->next_rx;
 		desc = info->descs + (DESC_SIZE * next_rx);

drivers/net/ethernet/qlogic/qed/qed_debug.c+4−3

 		goto out;
 	}
-	/* Add override window info to buffer */
+	/* Add override window info to buffer, preventing buffer overflow */
 	override_window_dwords =
-		qed_rd(p_hwfn, p_ptt, GRC_REG_NUMBER_VALID_OVERRIDE_WINDOW) *
+		min(qed_rd(p_hwfn, p_ptt, GRC_REG_NUMBER_VALID_OVERRIDE_WINDOW) *
-		PROTECTION_OVERRIDE_ELEMENT_DWORDS;
+		PROTECTION_OVERRIDE_ELEMENT_DWORDS,
+		PROTECTION_OVERRIDE_DEPTH_DWORDS);
 	if (override_window_dwords) {
 		addr = BYTES_TO_DWORDS(GRC_REG_PROTECTION_OVERRIDE_WINDOW);
 		offset += qed_grc_dump_addr_range(p_hwfn,

drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/tx.c+1−1

@@ -2092,7 +2092,7 @@ static void iwl_txq_gen1_update_byte_cnt_tbl(struct iwl_trans *trans, · 2091 unmodified lines
2092	break;	2092	break;
2093	}	2093	}
2094		2094
2095	if (trans->mac_cfg->device_family >= IWL_DEVICE_FAMILY_9000 &&	2095	if (trans->mac_cfg->device_family >= IWL_DEVICE_FAMILY_7000 &&
2096	trans->mac_cfg->device_family < IWL_DEVICE_FAMILY_AX210)	2096	trans->mac_cfg->device_family < IWL_DEVICE_FAMILY_AX210)
2097	len = DIV_ROUND_UP(len, 4);	2097	len = DIV_ROUND_UP(len, 4);
2098		2098

drivers/pci/controller/pci-mvebu.c+4−17

 	return devm_ioremap_resource(&pdev->dev, &port->regs);
 }
-#define DT_FLAGS_TO_TYPE(flags)       (((flags) >> 24) & 0x03)
-#define    DT_TYPE_IO                 0x1
-#define    DT_TYPE_MEM32              0x2
-#define DT_CPUADDR_TO_TARGET(cpuaddr) (((cpuaddr) >> 56) & 0xFF)
-#define DT_CPUADDR_TO_ATTR(cpuaddr)   (((cpuaddr) >> 48) & 0xFF)
 static int mvebu_get_tgt_attr(struct device_node *np, int devfn,
 			      unsigned long type,
 			      unsigned int *tgt,
 		return -EINVAL;
 	for_each_of_range(&parser, &range) {
-		unsigned long rtype;
 		u32 slot = upper_32_bits(range.bus_addr);
-		if (DT_FLAGS_TO_TYPE(range.flags) == DT_TYPE_IO)
+		if (slot == PCI_SLOT(devfn) &&
-			rtype = IORESOURCE_IO;
+		    type == (range.flags & IORESOURCE_TYPE_BITS)) {
-		else if (DT_FLAGS_TO_TYPE(range.flags) == DT_TYPE_MEM32)
+			*tgt = (range.parent_bus_addr >> 56) & 0xFF;
-			rtype = IORESOURCE_MEM;
+			*attr = (range.parent_bus_addr >> 48) & 0xFF;
-		else
-			continue;
-		if (slot == PCI_SLOT(devfn) && type == rtype) {
-			*tgt = DT_CPUADDR_TO_TARGET(range.cpu_addr);
-			*attr = DT_CPUADDR_TO_ATTR(range.cpu_addr);
 			return 0;
 		}
 	}

drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c+2−2

@@ -127,13 +127,13 @@ static int eusb2_repeater_init(struct phy *phy) · 126 unmodified lines
127	rptr->cfg->init_tbl[i].value);	127	rptr->cfg->init_tbl[i].value);
128		128
129	/* Override registers from devicetree values */	129	/* Override registers from devicetree values */
130	if (!of_property_read_u8(np, "qcom,tune-usb2-amplitude", &val))	130	if (!of_property_read_u8(np, "qcom,tune-usb2-preem", &val))
131	regmap_write(regmap, base + EUSB2_TUNE_USB2_PREEM, val);	131	regmap_write(regmap, base + EUSB2_TUNE_USB2_PREEM, val);
132		132
133	if (!of_property_read_u8(np, "qcom,tune-usb2-disc-thres", &val))	133	if (!of_property_read_u8(np, "qcom,tune-usb2-disc-thres", &val))
134	regmap_write(regmap, base + EUSB2_TUNE_HSDISC, val);	134	regmap_write(regmap, base + EUSB2_TUNE_HSDISC, val);
135		135
136	if (!of_property_read_u8(np, "qcom,tune-usb2-preem", &val))	136	if (!of_property_read_u8(np, "qcom,tune-usb2-amplitude", &val))
137	regmap_write(regmap, base + EUSB2_TUNE_IUSB2, val);	137	regmap_write(regmap, base + EUSB2_TUNE_IUSB2, val);
138		138
139	/* Wait for status OK */	139	/* Wait for status OK */

drivers/phy/qualcomm/phy-qcom-qmp-pcie.c+19−6

 	struct clk_fixed_rate aux_clk_fixed;
 };
+static bool qphy_checkbits(const void __iomem *base, u32 offset, u32 val)
+{
+	u32 reg;
+	reg = readl(base + offset);
+	return (reg & val) == val;
+}
 static inline void qphy_setbits(void __iomem *base, u32 offset, u32 val)
 {
 	u32 reg;
 	struct qmp_pcie *qmp = phy_get_drvdata(phy);
 	const struct qmp_phy_cfg *cfg = qmp->cfg;
 	void __iomem *pcs = qmp->pcs;
-	bool phy_initialized = !!(readl(pcs + cfg->regs[QPHY_START_CTRL]));
 	int ret;
-	qmp->skip_init = qmp->nocsr_reset && phy_initialized;
 	/*
-	 * We need to check the existence of init sequences in two cases:
+	 * We can skip PHY initialization if all of the following conditions
-	 * 1. The PHY doesn't support no_csr reset.
+	 * are met:
-	 * 2. The PHY supports no_csr reset but isn't initialized by bootloader.
+	 *  1. The PHY supports the nocsr_reset that preserves the PHY config.
-	 * As we can't skip init in these two cases.
+	 *  2. The PHY was started (and not powered down again) by the
+	 *     bootloader, with all of the expected bits set correctly.
+	 * In this case, we can continue without having the init sequence
+	 * defined in the driver.
 	 */
+	qmp->skip_init = qmp->nocsr_reset &&
+		qphy_checkbits(pcs, cfg->regs[QPHY_START_CTRL], SERDES_START | PCS_START) &&
+		qphy_checkbits(pcs, cfg->regs[QPHY_PCS_POWER_DOWN_CONTROL], cfg->pwrdn_ctrl);
 	if (!qmp->skip_init && !cfg->tbls.serdes_num) {
 		dev_err(qmp->dev, "Init sequence not available\n");
 		return -ENODATA;

drivers/phy/tegra/xusb-tegra210.c+5−1

 	}
 	pdev = of_find_device_by_node(np);
+	of_node_put(np);
 	if (!pdev) {
 		dev_warn(dev, "PMC device is not available\n");
 		goto out;
 	}
-	if (!platform_get_drvdata(pdev))
+	if (!platform_get_drvdata(pdev)) {
+		put_device(&pdev->dev);
 		return ERR_PTR(-EPROBE_DEFER);
+	}
 	padctl->regmap = dev_get_regmap(&pdev->dev, "usb_sleepwalk");
 	if (!padctl->regmap)
 		dev_info(dev, "failed to find PMC regmap\n");
+	put_device(&pdev->dev);
 out:
 	return &padctl->base;
 }

drivers/phy/ti/phy-gmii-sel.c+39−8

 	PHY_GMII_SEL_PORT_MODE = 0,
 	PHY_GMII_SEL_RGMII_ID_MODE,
 	PHY_GMII_SEL_RMII_IO_CLK_EN,
+	PHY_GMII_SEL_FIXED_TX_DELAY,
 	PHY_GMII_SEL_LAST,
 };
 		goto unsupported;
 	}
+	/* With a fixed delay, some modes are not supported at all. */
+	if (soc_data->features & BIT(PHY_GMII_SEL_FIXED_TX_DELAY) &&
+	    rgmii_id != 0)
+		return -EINVAL;
 	if_phy->phy_if_mode = submode;
 	dev_dbg(dev, "%s id:%u mode:%u rgmii_id:%d rmii_clk_ext:%d\n",
 static const
 struct reg_field phy_gmii_sel_fields_am654[][PHY_GMII_SEL_LAST] = {
-	{ [PHY_GMII_SEL_PORT_MODE] = REG_FIELD(0x0, 0, 2), },
+	{
-	{ [PHY_GMII_SEL_PORT_MODE] = REG_FIELD(0x4, 0, 2), },
+		[PHY_GMII_SEL_PORT_MODE] = REG_FIELD(0x0, 0, 2),
-	{ [PHY_GMII_SEL_PORT_MODE] = REG_FIELD(0x8, 0, 2), },
+		[PHY_GMII_SEL_RGMII_ID_MODE] = REG_FIELD(0x0, 4, 4),
-	{ [PHY_GMII_SEL_PORT_MODE] = REG_FIELD(0xC, 0, 2), },
+	}, {
-	{ [PHY_GMII_SEL_PORT_MODE] = REG_FIELD(0x10, 0, 2), },
+		[PHY_GMII_SEL_PORT_MODE] = REG_FIELD(0x4, 0, 2),
-	{ [PHY_GMII_SEL_PORT_MODE] = REG_FIELD(0x14, 0, 2), },
+		[PHY_GMII_SEL_RGMII_ID_MODE] = REG_FIELD(0x4, 4, 4),
-	{ [PHY_GMII_SEL_PORT_MODE] = REG_FIELD(0x18, 0, 2), },
+	}, {
-	{ [PHY_GMII_SEL_PORT_MODE] = REG_FIELD(0x1C, 0, 2), },
+		[PHY_GMII_SEL_PORT_MODE] = REG_FIELD(0x8, 0, 2),
+		[PHY_GMII_SEL_RGMII_ID_MODE] = REG_FIELD(0x8, 4, 4),
+	}, {
+		[PHY_GMII_SEL_PORT_MODE] = REG_FIELD(0xC, 0, 2),
+		[PHY_GMII_SEL_RGMII_ID_MODE] = REG_FIELD(0xC, 4, 4),
+	}, {
+		[PHY_GMII_SEL_PORT_MODE] = REG_FIELD(0x10, 0, 2),
+		[PHY_GMII_SEL_RGMII_ID_MODE] = REG_FIELD(0x10, 4, 4),
+	}, {
+		[PHY_GMII_SEL_PORT_MODE] = REG_FIELD(0x14, 0, 2),
+		[PHY_GMII_SEL_RGMII_ID_MODE] = REG_FIELD(0x14, 4, 4),
+	}, {
+		[PHY_GMII_SEL_PORT_MODE] = REG_FIELD(0x18, 0, 2),
+		[PHY_GMII_SEL_RGMII_ID_MODE] = REG_FIELD(0x18, 4, 4),
+	}, {
+		[PHY_GMII_SEL_PORT_MODE] = REG_FIELD(0x1C, 0, 2),
+		[PHY_GMII_SEL_RGMII_ID_MODE] = REG_FIELD(0x1C, 4, 4),
+	},
 };
 static const
 struct phy_gmii_sel_soc_data phy_gmii_sel_soc_am654 = {
 	.use_of_data = true,
+	.features = BIT(PHY_GMII_SEL_RGMII_ID_MODE) |
+		    BIT(PHY_GMII_SEL_FIXED_TX_DELAY),
 	.regfields = phy_gmii_sel_fields_am654,
 };
 static const
 struct phy_gmii_sel_soc_data phy_gmii_sel_cpsw5g_soc_j7200 = {
 	.use_of_data = true,
+	.features = BIT(PHY_GMII_SEL_RGMII_ID_MODE) |
+		    BIT(PHY_GMII_SEL_FIXED_TX_DELAY),
 	.regfields = phy_gmii_sel_fields_am654,
 	.extra_modes = BIT(PHY_INTERFACE_MODE_QSGMII) | BIT(PHY_INTERFACE_MODE_SGMII) |
 		       BIT(PHY_INTERFACE_MODE_USXGMII),
 static const
 struct phy_gmii_sel_soc_data phy_gmii_sel_cpsw9g_soc_j721e = {
 	.use_of_data = true,
+	.features = BIT(PHY_GMII_SEL_RGMII_ID_MODE) |
+		    BIT(PHY_GMII_SEL_FIXED_TX_DELAY),
 	.regfields = phy_gmii_sel_fields_am654,
 	.extra_modes = BIT(PHY_INTERFACE_MODE_QSGMII) | BIT(PHY_INTERFACE_MODE_SGMII),
 	.num_ports = 8,
 static const
 struct phy_gmii_sel_soc_data phy_gmii_sel_cpsw9g_soc_j784s4 = {
 	.use_of_data = true,
+	.features = BIT(PHY_GMII_SEL_RGMII_ID_MODE) |
+		    BIT(PHY_GMII_SEL_FIXED_TX_DELAY),
 	.regfields = phy_gmii_sel_fields_am654,
 	.extra_modes = BIT(PHY_INTERFACE_MODE_QSGMII) | BIT(PHY_INTERFACE_MODE_SGMII) |
 		       BIT(PHY_INTERFACE_MODE_USXGMII),

drivers/phy/ti/phy-omap-usb2.c+13−0

 		phy->flags |= OMAP_USB2_DISABLE_CHRG_DET;
 }
+static void omap_usb2_put_device(void *_dev)
+{
+	struct device *dev = _dev;
+	put_device(dev);
+}
 static int omap_usb2_probe(struct platform_device *pdev)
 {
 	struct omap_usb	*phy;
 	struct device_node *control_node;
 	struct platform_device *control_pdev;
 	const struct usb_phy_data *phy_data;
+	int ret;
 	phy_data = device_get_match_data(&pdev->dev);
 	if (!phy_data)
 			return -EINVAL;
 		}
 		phy->control_dev = &control_pdev->dev;
+		ret = devm_add_action_or_reset(&pdev->dev, omap_usb2_put_device,
+					       phy->control_dev);
+		if (ret)
+			return ret;
 	} else {
 		if (of_property_read_u32_index(node,
 					       "syscon-phy-power", 1,

drivers/phy/ti/phy-ti-pipe3.c+13−0

 	return 0;
 }
+static void ti_pipe3_put_device(void *_dev)
+{
+	struct device *dev = _dev;
+	put_device(dev);
+}
 static int ti_pipe3_get_sysctrl(struct ti_pipe3 *phy)
 {
 	struct device *dev = phy->dev;
 	struct device_node *node = dev->of_node;
 	struct device_node *control_node;
 	struct platform_device *control_pdev;
+	int ret;
 	phy->phy_power_syscon = syscon_regmap_lookup_by_phandle(node,
 							"syscon-phy-power");
 		}
 		phy->control_dev = &control_pdev->dev;
+		ret = devm_add_action_or_reset(dev, ti_pipe3_put_device,
+					       phy->control_dev);
+		if (ret)
+			return ret;
 	}
 	if (phy->mode == PIPE3_MODE_PCIE) {

drivers/platform/x86/amd/pmc/pmc-quirks.c+8−0

@@ -239,6 +239,14 @@ static const struct dmi_system_id fwbug_list[] = { · 238 unmodified lines
239	DMI_MATCH(DMI_BOARD_NAME, "WUJIE14-GX4HRXL"),	239	DMI_MATCH(DMI_BOARD_NAME, "WUJIE14-GX4HRXL"),
240	}	240	}
241	},	241	},
		242	{
		243	.ident = "MECHREVO Yilong15Pro Series GM5HG7A",
		244	.driver_data = &quirk_spurious_8042,
		245	.matches = {
		246	DMI_MATCH(DMI_SYS_VENDOR, "MECHREVO"),
		247	DMI_MATCH(DMI_PRODUCT_NAME, "Yilong15Pro Series GM5HG7A"),
		248	}
		249	},
242	/* https://bugzilla.kernel.org/show_bug.cgi?id=220116 */	250	/* https://bugzilla.kernel.org/show_bug.cgi?id=220116 */
243	{	251	{
244	.ident = "PCSpecialist Lafite Pro V 14M",	252	.ident = "PCSpecialist Lafite Pro V 14M",

drivers/platform/x86/amd/pmf/core.c+1−0

@@ -403,6 +403,7 @@ static const struct acpi_device_id amd_pmf_acpi_ids[] = { · 402 unmodified lines
403	{"AMDI0103", 0},	403	{"AMDI0103", 0},
404	{"AMDI0105", 0},	404	{"AMDI0105", 0},
405	{"AMDI0107", 0},	405	{"AMDI0107", 0},
		406	{"AMDI0108", 0},
406	{ }	407	{ }
407	};	408	};
408	MODULE_DEVICE_TABLE(acpi, amd_pmf_acpi_ids);	409	MODULE_DEVICE_TABLE(acpi, amd_pmf_acpi_ids);

drivers/platform/x86/asus-nb-wmi.c+2−0

 		if (atkbd_reports_vol_keys)
 			*code = ASUS_WMI_KEY_IGNORE;
 		break;
+	case 0x5D: /* Wireless console Toggle */
+	case 0x5E: /* Wireless console Enable / Keyboard Attach, Detach */
 	case 0x5F: /* Wireless console Disable / Special Key */
 		if (quirks->key_wlan_event)
 			*code = quirks->key_wlan_event;

drivers/platform/x86/oxpec.c+14−0

@@ -124,6 +124,13 @@ static const struct dmi_system_id dmi_table[] = { · 123 unmodified lines
124	},	124	},
125	.driver_data = (void *)aok_zoe_a1,	125	.driver_data = (void *)aok_zoe_a1,
126	},	126	},
		127	{
		128	.matches = {
		129	DMI_MATCH(DMI_BOARD_VENDOR, "AOKZOE"),
		130	DMI_EXACT_MATCH(DMI_BOARD_NAME, "AOKZOE A1X"),
		131	},
		132	.driver_data = (void *)oxp_fly,
		133	},
127	{	134	{
128	.matches = {	135	.matches = {
129	DMI_MATCH(DMI_BOARD_VENDOR, "AYANEO"),	136	DMI_MATCH(DMI_BOARD_VENDOR, "AYANEO"),
@@ -306,6 +313,13 @@ static const struct dmi_system_id dmi_table[] = { · 176 unmodified lines
306	},	313	},
307	.driver_data = (void *)oxp_x1,	314	.driver_data = (void *)oxp_x1,
308	},	315	},
		316	{
		317	.matches = {
		318	DMI_MATCH(DMI_BOARD_VENDOR, "ONE-NETBOOK"),
		319	DMI_EXACT_MATCH(DMI_BOARD_NAME, "ONEXPLAYER X1Pro EVA-02"),
		320	},
		321	.driver_data = (void *)oxp_x1,
		322	},
309	{},	323	{},
310	};	324	};
311		325

drivers/power/supply/bq27xxx_battery.c+2−2

@@ -1919,8 +1919,8 @@ static void bq27xxx_battery_update_unlocked(struct bq27xxx_device_info *di) · 1918 unmodified lines
1919	bool has_singe_flag = di->opts & BQ27XXX_O_ZERO;	1919	bool has_singe_flag = di->opts & BQ27XXX_O_ZERO;
1920		1920
1921	cache.flags = bq27xxx_read(di, BQ27XXX_REG_FLAGS, has_singe_flag);	1921	cache.flags = bq27xxx_read(di, BQ27XXX_REG_FLAGS, has_singe_flag);
1922	if ((cache.flags & 0xff) == 0xff)	1922	if (di->chip == BQ27000 && (cache.flags & 0xff) == 0xff)
1923	cache.flags = -1; /* read error */	1923	cache.flags = -ENODEV; /* bq27000 hdq read error */
1924	if (cache.flags >= 0) {	1924	if (cache.flags >= 0) {
1925	cache.capacity = bq27xxx_battery_read_soc(di);	1925	cache.capacity = bq27xxx_battery_read_soc(di);
1926		1926

drivers/regulator/sy7636a-regulator.c+4−3

 	if (!regmap)
 		return -EPROBE_DEFER;
-	gdp = devm_gpiod_get(pdev->dev.parent, "epd-pwr-good", GPIOD_IN);
+	device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent);
+	gdp = devm_gpiod_get(&pdev->dev, "epd-pwr-good", GPIOD_IN);
 	if (IS_ERR(gdp)) {
-		dev_err(pdev->dev.parent, "Power good GPIO fault %ld\n", PTR_ERR(gdp));
+		dev_err(&pdev->dev, "Power good GPIO fault %ld\n", PTR_ERR(gdp));
 		return PTR_ERR(gdp);
 	}
 	}
 	config.dev = &pdev->dev;
-	config.dev->of_node = pdev->dev.parent->of_node;
 	config.regmap = regmap;
 	rdev = devm_regulator_register(&pdev->dev, &desc, &config);

drivers/tty/hvc/hvc_console.c+3−3

 	}
 	/*
-	 * Racy, but harmless, kick thread if there is still pending data.
+	 * Kick thread to flush if there's still pending data
+	 * or to wakeup the write queue.
 	 */
-	if (hp->n_outbuf)
+	hvc_kick();
-		hvc_kick();
 	return written;
 }

drivers/tty/serial/sc16is7xx.c+2−12

 	sc16is7xx_port_write(port, SC16IS7XX_FCR_REG,
 			     SC16IS7XX_FCR_FIFO_BIT);
-	/* Enable EFR */
-	sc16is7xx_port_write(port, SC16IS7XX_LCR_REG,
-			     SC16IS7XX_LCR_CONF_MODE_B);
-	regcache_cache_bypass(one->regmap, true);
-	/* Enable write access to enhanced features and internal clock div */
-	sc16is7xx_port_update(port, SC16IS7XX_EFR_REG,
-			      SC16IS7XX_EFR_ENABLE_BIT,
-			      SC16IS7XX_EFR_ENABLE_BIT);
 	/* Enable TCR/TLR */
 	sc16is7xx_port_update(port, SC16IS7XX_MCR_REG,
 			      SC16IS7XX_MCR_TCRTLR_BIT,
 			     SC16IS7XX_TCR_RX_RESUME(24) |
 			     SC16IS7XX_TCR_RX_HALT(48));
-	regcache_cache_bypass(one->regmap, false);
+	/* Disable TCR/TLR access */
+	sc16is7xx_port_update(port, SC16IS7XX_MCR_REG, SC16IS7XX_MCR_TCRTLR_BIT, 0);
 	/* Now, initialize the UART */
 	sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, SC16IS7XX_LCR_WORD_LEN_8);

drivers/tty/serial/xilinx_uartps.c+5−5

 #define CDNS_UART_MINOR		0	/* works best with devtmpfs */
 #define CDNS_UART_NR_PORTS	16
 #define CDNS_UART_FIFO_SIZE	64	/* FIFO size */
-#define CDNS_UART_REGISTER_SPACE	0x1000
 #define TX_TIMEOUT		500000
 /* Rx Trigger level */
  */
 static int cdns_uart_request_port(struct uart_port *port)
 {
-	if (!request_mem_region(port->mapbase, CDNS_UART_REGISTER_SPACE,
+	if (!request_mem_region(port->mapbase, port->mapsize,
 					 CDNS_UART_NAME)) {
 		return -ENOMEM;
 	}
-	port->membase = ioremap(port->mapbase, CDNS_UART_REGISTER_SPACE);
+	port->membase = ioremap(port->mapbase, port->mapsize);
 	if (!port->membase) {
 		dev_err(port->dev, "Unable to map registers\n");
-		release_mem_region(port->mapbase, CDNS_UART_REGISTER_SPACE);
+		release_mem_region(port->mapbase, port->mapsize);
 		return -ENOMEM;
 	}
 	return 0;
  */
 static void cdns_uart_release_port(struct uart_port *port)
 {
-	release_mem_region(port->mapbase, CDNS_UART_REGISTER_SPACE);
+	release_mem_region(port->mapbase, port->mapsize);
 	iounmap(port->membase);
 	port->membase = NULL;
 }
 	 * and triggers invocation of the config_port() entry point.
 	 */
 	port->mapbase = res->start;
+	port->mapsize = resource_size(res);
 	port->irq = irq;
 	port->dev = &pdev->dev;
 	port->uartclk = clk_get_rate(cdns_uart_data->uartclk);

drivers/usb/core/driver.c+2−2

@@ -119,11 +119,11 @@ ssize_t usb_show_dynids(struct usb_dynids dynids, char buf) · 118 unmodified lines
119	guard(mutex)(&usb_dynids_lock);	119	guard(mutex)(&usb_dynids_lock);
120	list_for_each_entry(dynid, &dynids->list, node)	120	list_for_each_entry(dynid, &dynids->list, node)
121	if (dynid->id.bInterfaceClass != 0)	121	if (dynid->id.bInterfaceClass != 0)
122	count += sysfs_emit_at(&buf[count], count, "%04x %04x %02x\n",	122	count += sysfs_emit_at(buf, count, "%04x %04x %02x\n",
123	dynid->id.idVendor, dynid->id.idProduct,	123	dynid->id.idVendor, dynid->id.idProduct,
124	dynid->id.bInterfaceClass);	124	dynid->id.bInterfaceClass);
125	else	125	else
126	count += sysfs_emit_at(&buf[count], count, "%04x %04x\n",	126	count += sysfs_emit_at(buf, count, "%04x %04x\n",
127	dynid->id.idVendor, dynid->id.idProduct);	127	dynid->id.idVendor, dynid->id.idProduct);
128	return count;	128	return count;
129	}	129	}

drivers/usb/gadget/function/f_midi2.c+9−2

 			strscpy(fb->info.name, ump_fb_name(b),
 				sizeof(fb->info.name));
 		}
+		snd_ump_update_group_attrs(ump);
 	}
 	for (i = 0; i < midi2->num_eps; i++) {
 	case USB_SPEED_HIGH:
 		midi2_midi1_ep_out_desc.wMaxPacketSize = cpu_to_le16(512);
 		midi2_midi1_ep_in_desc.wMaxPacketSize = cpu_to_le16(512);
-		for (i = 0; i < midi2->num_eps; i++)
+		for (i = 0; i < midi2->num_eps; i++) {
 			midi2_midi2_ep_out_desc[i].wMaxPacketSize =
 				cpu_to_le16(512);
+			midi2_midi2_ep_in_desc[i].wMaxPacketSize =
+				cpu_to_le16(512);
+		}
 		fallthrough;
 	case USB_SPEED_FULL:
 		midi1_in_eps = midi2_midi1_ep_in_descs;
 	case USB_SPEED_SUPER:
 		midi2_midi1_ep_out_desc.wMaxPacketSize = cpu_to_le16(1024);
 		midi2_midi1_ep_in_desc.wMaxPacketSize = cpu_to_le16(1024);
-		for (i = 0; i < midi2->num_eps; i++)
+		for (i = 0; i < midi2->num_eps; i++) {
 			midi2_midi2_ep_out_desc[i].wMaxPacketSize =
 				cpu_to_le16(1024);
+			midi2_midi2_ep_in_desc[i].wMaxPacketSize =
+				cpu_to_le16(1024);
+		}
 		midi1_in_eps = midi2_midi1_ep_in_ss_descs;
 		midi1_out_eps = midi2_midi1_ep_out_ss_descs;
 		break;

drivers/usb/gadget/udc/dummy_hcd.c+4−4

 	if (!dum->driver)
 		return -ESHUTDOWN;
-	local_irq_save(flags);
+	spin_lock_irqsave(&dum->lock, flags);
-	spin_lock(&dum->lock);
 	list_for_each_entry(iter, &ep->queue, queue) {
 		if (&iter->req != _req)
 			continue;
 		retval = 0;
 		break;
 	}
-	spin_unlock(&dum->lock);
 	if (retval == 0) {
 		dev_dbg(udc_dev(dum),
 				"dequeued req %p from %s, len %d buf %p\n",
 				req, _ep->name, _req->length, _req->buf);
+		spin_unlock(&dum->lock);
 		usb_gadget_giveback_request(_ep, _req);
+		spin_lock(&dum->lock);
 	}
-	local_irq_restore(flags);
+	spin_unlock_irqrestore(&dum->lock, flags);
 	return retval;
 }

drivers/usb/host/xhci-dbgcap.c+67−27

@@ -101,13 +101,34 @@ static u32 xhci_dbc_populate_strings(struct dbc_str_descs *strings) · 100 unmodified lines
101	return string_length;	101	return string_length;
102	}	102	}
103		103
		104	static void xhci_dbc_init_ep_contexts(struct xhci_dbc *dbc)
		105	{
		106	struct xhci_ep_ctx *ep_ctx;
		107	unsigned int max_burst;
		108	dma_addr_t deq;
		109
		110	max_burst = DBC_CTRL_MAXBURST(readl(&dbc->regs->control));
		111
		112	/* Populate bulk out endpoint context: */
		113	ep_ctx = dbc_bulkout_ctx(dbc);
		114	deq = dbc_bulkout_enq(dbc);
		115	ep_ctx->ep_info = 0;
		116	ep_ctx->ep_info2 = dbc_epctx_info2(BULK_OUT_EP, 1024, max_burst);
		117	ep_ctx->deq = cpu_to_le64(deq \| dbc->ring_out->cycle_state);
		118
		119	/* Populate bulk in endpoint context: */
		120	ep_ctx = dbc_bulkin_ctx(dbc);
		121	deq = dbc_bulkin_enq(dbc);
		122	ep_ctx->ep_info = 0;
		123	ep_ctx->ep_info2 = dbc_epctx_info2(BULK_IN_EP, 1024, max_burst);
		124	ep_ctx->deq = cpu_to_le64(deq \| dbc->ring_in->cycle_state);
		125	}
		126
104	static void xhci_dbc_init_contexts(struct xhci_dbc *dbc, u32 string_length)	127	static void xhci_dbc_init_contexts(struct xhci_dbc *dbc, u32 string_length)
105	{	128	{
106	struct dbc_info_context *info;	129	struct dbc_info_context *info;
107	struct xhci_ep_ctx *ep_ctx;
108	u32 dev_info;	130	u32 dev_info;
109	dma_addr_t deq, dma;	131	dma_addr_t dma;
110	unsigned int max_burst;
111		132
112	if (!dbc)	133	if (!dbc)
113	return;	134	return;
@@ -121,20 +142,8 @@ static void xhci_dbc_init_contexts(struct xhci_dbc *dbc, u32 string_length) · 7 unmodified lines
121	info->serial = cpu_to_le64(dma + DBC_MAX_STRING_LENGTH * 3);	142	info->serial = cpu_to_le64(dma + DBC_MAX_STRING_LENGTH * 3);
122	info->length = cpu_to_le32(string_length);	143	info->length = cpu_to_le32(string_length);
123		144
124	/* Populate bulk out endpoint context: */	145	/* Populate bulk in and out endpoint contexts: */
125	ep_ctx = dbc_bulkout_ctx(dbc);	146	xhci_dbc_init_ep_contexts(dbc);
126	max_burst = DBC_CTRL_MAXBURST(readl(&dbc->regs->control));
127	deq = dbc_bulkout_enq(dbc);
128	ep_ctx->ep_info = 0;
129	ep_ctx->ep_info2 = dbc_epctx_info2(BULK_OUT_EP, 1024, max_burst);
130	ep_ctx->deq = cpu_to_le64(deq \| dbc->ring_out->cycle_state);
131
132	/* Populate bulk in endpoint context: */
133	ep_ctx = dbc_bulkin_ctx(dbc);
134	deq = dbc_bulkin_enq(dbc);
135	ep_ctx->ep_info = 0;
136	ep_ctx->ep_info2 = dbc_epctx_info2(BULK_IN_EP, 1024, max_burst);
137	ep_ctx->deq = cpu_to_le64(deq \| dbc->ring_in->cycle_state);
138		147
139	/* Set DbC context and info registers: */	148	/* Set DbC context and info registers: */
140	lo_hi_writeq(dbc->ctx->dma, &dbc->regs->dccp);	149	lo_hi_writeq(dbc->ctx->dma, &dbc->regs->dccp);
@@ -436,6 +445,42 @@ dbc_alloc_ctx(struct device *dev, gfp_t flags) · 295 unmodified lines
436	return ctx;	445	return ctx;
437	}	446	}
438		447
		448	static void xhci_dbc_ring_init(struct xhci_ring *ring)
		449	{
		450	struct xhci_segment *seg = ring->first_seg;
		451
		452	/* clear all trbs on ring in case of old ring */
		453	memset(seg->trbs, 0, TRB_SEGMENT_SIZE);
		454
		455	/* Only event ring does not use link TRB */
		456	if (ring->type != TYPE_EVENT) {
		457	union xhci_trb *trb = &seg->trbs[TRBS_PER_SEGMENT - 1];
		458
		459	trb->link.segment_ptr = cpu_to_le64(ring->first_seg->dma);
		460	trb->link.control = cpu_to_le32(LINK_TOGGLE \| TRB_TYPE(TRB_LINK));
		461	}
		462	xhci_initialize_ring_info(ring);
		463	}
		464
		465	static int xhci_dbc_reinit_ep_rings(struct xhci_dbc *dbc)
		466	{
		467	struct xhci_ring *in_ring = dbc->eps[BULK_IN].ring;
		468	struct xhci_ring *out_ring = dbc->eps[BULK_OUT].ring;
		469
		470	if (!in_ring \|\| !out_ring \|\| !dbc->ctx) {
		471	dev_warn(dbc->dev, "Can't re-init unallocated endpoints\n");
		472	return -ENODEV;
		473	}
		474
		475	xhci_dbc_ring_init(in_ring);
		476	xhci_dbc_ring_init(out_ring);
		477
		478	/* set ep context enqueue, dequeue, and cycle to initial values */
		479	xhci_dbc_init_ep_contexts(dbc);
		480
		481	return 0;
		482	}
		483
439	static struct xhci_ring *	484	static struct xhci_ring *
440	xhci_dbc_ring_alloc(struct device *dev, enum xhci_ring_type type, gfp_t flags)	485	xhci_dbc_ring_alloc(struct device *dev, enum xhci_ring_type type, gfp_t flags)
441	{	486	{
@@ -464,15 +509,10 @@ xhci_dbc_ring_alloc(struct device *dev, enum xhci_ring_type type, gfp_t flags) · 22 unmodified lines
464		509
465	seg->dma = dma;	510	seg->dma = dma;
466		511
467	/* Only event ring does not use link TRB */
468	if (type != TYPE_EVENT) {
469	union xhci_trb *trb = &seg->trbs[TRBS_PER_SEGMENT - 1];
470
471	trb->link.segment_ptr = cpu_to_le64(dma);
472	trb->link.control = cpu_to_le32(LINK_TOGGLE \| TRB_TYPE(TRB_LINK));
473	}
474	INIT_LIST_HEAD(&ring->td_list);	512	INIT_LIST_HEAD(&ring->td_list);
475	xhci_initialize_ring_info(ring);	513
		514	xhci_dbc_ring_init(ring);
		515
476	return ring;	516	return ring;
477	dma_fail:	517	dma_fail:
478	kfree(seg);	518	kfree(seg);
@@ -864,7 +904,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc) · 385 unmodified lines
864	dev_info(dbc->dev, "DbC cable unplugged\n");	904	dev_info(dbc->dev, "DbC cable unplugged\n");
865	dbc->state = DS_ENABLED;	905	dbc->state = DS_ENABLED;
866	xhci_dbc_flush_requests(dbc);	906	xhci_dbc_flush_requests(dbc);
867		907	xhci_dbc_reinit_ep_rings(dbc);
868	return EVT_DISC;	908	return EVT_DISC;
869	}	909	}
870		910
@@ -874,7 +914,7 @@ static enum evtreturn xhci_dbc_do_handle_events(struct xhci_dbc *dbc) · 3 unmodified lines
874	writel(portsc, &dbc->regs->portsc);	914	writel(portsc, &dbc->regs->portsc);
875	dbc->state = DS_ENABLED;	915	dbc->state = DS_ENABLED;
876	xhci_dbc_flush_requests(dbc);	916	xhci_dbc_flush_requests(dbc);
877		917	xhci_dbc_reinit_ep_rings(dbc);
878	return EVT_DISC;	918	return EVT_DISC;
879	}	919	}
880		920

drivers/usb/host/xhci-mem.c+1−1

@@ -962,7 +962,7 @@ static void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_i · 961 unmodified lines
962	out:	962	out:
963	/* we are now at a leaf device */	963	/* we are now at a leaf device */
964	xhci_debugfs_remove_slot(xhci, slot_id);	964	xhci_debugfs_remove_slot(xhci, slot_id);
965	xhci_free_virt_device(xhci, vdev, slot_id);	965	xhci_free_virt_device(xhci, xhci->devs[slot_id], slot_id);
966	}	966	}
967		967
968	int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,	968	int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,

drivers/usb/serial/option.c+17−0

@@ -1322,7 +1322,18 @@ static const struct usb_device_id option_ids[] = { · 1321 unmodified lines
1322	.driver_info = NCTRL(0) \| RSVD(3) },	1322	.driver_info = NCTRL(0) \| RSVD(3) },
1323	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1033, 0xff), /* Telit LE910C1-EUX (ECM) */	1323	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1033, 0xff), /* Telit LE910C1-EUX (ECM) */
1324	.driver_info = NCTRL(0) },	1324	.driver_info = NCTRL(0) },
		1325	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1034, 0xff), /* Telit LE910C4-WWX (rmnet) */
		1326	.driver_info = RSVD(2) },
1325	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1035, 0xff) }, /* Telit LE910C4-WWX (ECM) */	1327	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1035, 0xff) }, /* Telit LE910C4-WWX (ECM) */
		1328	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1036, 0xff) }, /* Telit LE910C4-WWX */
		1329	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1037, 0xff), /* Telit LE910C4-WWX (rmnet) */
		1330	.driver_info = NCTRL(0) \| NCTRL(1) \| RSVD(4) },
		1331	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1038, 0xff), /* Telit LE910C4-WWX (rmnet) */
		1332	.driver_info = NCTRL(0) \| RSVD(3) },
		1333	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x103b, 0xff), /* Telit LE910C4-WWX */
		1334	.driver_info = NCTRL(0) \| NCTRL(1) },
		1335	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x103c, 0xff), /* Telit LE910C4-WWX */
		1336	.driver_info = NCTRL(0) },
1326	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0),	1337	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0),
1327	.driver_info = RSVD(0) \| RSVD(1) \| NCTRL(2) \| RSVD(3) },	1338	.driver_info = RSVD(0) \| RSVD(1) \| NCTRL(2) \| RSVD(3) },
1328	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG1),	1339	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG1),
@@ -1369,6 +1380,12 @@ static const struct usb_device_id option_ids[] = { · 40 unmodified lines
1369	.driver_info = NCTRL(0) \| RSVD(1) },	1380	.driver_info = NCTRL(0) \| RSVD(1) },
1370	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990A (PCIe) */	1381	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990A (PCIe) */
1371	.driver_info = RSVD(0) },	1382	.driver_info = RSVD(0) },
		1383	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1077, 0xff), /* Telit FN990A (rmnet + audio) */
		1384	.driver_info = NCTRL(0) \| RSVD(1) \| RSVD(2) },
		1385	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1078, 0xff), /* Telit FN990A (MBIM + audio) */
		1386	.driver_info = NCTRL(0) \| RSVD(1) },
		1387	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1079, 0xff), /* Telit FN990A (RNDIS + audio) */
		1388	.driver_info = NCTRL(2) \| RSVD(3) },
1372	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990A (rmnet) */	1389	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990A (rmnet) */
1373	.driver_info = NCTRL(0) \| RSVD(1) \| RSVD(2) },	1390	.driver_info = NCTRL(0) \| RSVD(1) \| RSVD(2) },
1374	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1081, 0xff), /* Telit FE990A (MBIM) */	1391	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1081, 0xff), /* Telit FE990A (MBIM) */

drivers/usb/typec/tcpm/tcpm.c+8−4

 		case ADEV_NONE:
 			break;
 		case ADEV_NOTIFY_USB_AND_QUEUE_VDM:
-			WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB, NULL));
+			if (rx_sop_type == TCPC_TX_SOP_PRIME) {
-			typec_altmode_vdm(adev, p[0], &p[1], cnt);
+				typec_cable_altmode_vdm(adev, TYPEC_PLUG_SOP_P, p[0], &p[1], cnt);
+			} else {
+				WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB, NULL));
+				typec_altmode_vdm(adev, p[0], &p[1], cnt);
+			}
 			break;
 		case ADEV_QUEUE_VDM:
-			if (response_tx_sop_type == TCPC_TX_SOP_PRIME)
+			if (rx_sop_type == TCPC_TX_SOP_PRIME)
 				typec_cable_altmode_vdm(adev, TYPEC_PLUG_SOP_P, p[0], &p[1], cnt);
 			else
 				typec_altmode_vdm(adev, p[0], &p[1], cnt);
 			break;
 		case ADEV_QUEUE_VDM_SEND_EXIT_MODE_ON_FAIL:
-			if (response_tx_sop_type == TCPC_TX_SOP_PRIME) {
+			if (rx_sop_type == TCPC_TX_SOP_PRIME) {
 				if (typec_cable_altmode_vdm(adev, TYPEC_PLUG_SOP_P,
 							    p[0], &p[1], cnt)) {
 					int svdm_version = typec_get_cable_svdm_version(

fs/btrfs/block-group.c+8−1

 	bg1 = list_entry(a, struct btrfs_block_group, bg_list);
 	bg2 = list_entry(b, struct btrfs_block_group, bg_list);
-	return bg1->used > bg2->used;
+	/*
+	 * Some other task may be updating the ->used field concurrently, but it
+	 * is not serious if we get a stale value or load/store tearing issues,
+	 * as sorting the list of block groups to reclaim is not critical and an
+	 * occasional imperfect order is ok. So silence KCSAN and avoid the
+	 * overhead of locking or any other synchronization.
+	 */
+	return data_race(bg1->used > bg2->used);
 }
 static inline bool btrfs_should_reclaim(const struct btrfs_fs_info *fs_info)

fs/btrfs/delayed-inode.c+0−3

 int btrfs_fill_inode(struct btrfs_inode *inode, u32 *rdev)
 {
-	struct btrfs_fs_info *fs_info = inode->root->fs_info;
 	struct btrfs_delayed_node *delayed_node;
 	struct btrfs_inode_item *inode_item;
 	struct inode *vfs_inode = &inode->vfs_inode;
 	i_uid_write(vfs_inode, btrfs_stack_inode_uid(inode_item));
 	i_gid_write(vfs_inode, btrfs_stack_inode_gid(inode_item));
 	btrfs_i_size_write(inode, btrfs_stack_inode_size(inode_item));
-	btrfs_inode_set_file_extent_range(inode, 0,
-			round_up(i_size_read(vfs_inode), fs_info->sectorsize));
 	vfs_inode->i_mode = btrfs_stack_inode_mode(inode_item);
 	set_nlink(vfs_inode, btrfs_stack_inode_nlink(inode_item));
 	inode_set_bytes(vfs_inode, btrfs_stack_inode_nbytes(inode_item));

fs/btrfs/inode.c+5−6

 	bool filled = false;
 	int first_xattr_slot;
-	ret = btrfs_init_file_extent_tree(inode);
-	if (ret)
-		goto out;
 	ret = btrfs_fill_inode(inode, &rdev);
 	if (!ret)
 		filled = true;
 	i_uid_write(vfs_inode, btrfs_inode_uid(leaf, inode_item));
 	i_gid_write(vfs_inode, btrfs_inode_gid(leaf, inode_item));
 	btrfs_i_size_write(inode, btrfs_inode_size(leaf, inode_item));
-	btrfs_inode_set_file_extent_range(inode, 0,
-			round_up(i_size_read(vfs_inode), fs_info->sectorsize));
 	inode_set_atime(vfs_inode, btrfs_timespec_sec(leaf, &inode_item->atime),
 			btrfs_timespec_nsec(leaf, &inode_item->atime));
 	btrfs_set_inode_mapping_order(inode);
 cache_index:
+	ret = btrfs_init_file_extent_tree(inode);
+	if (ret)
+		goto out;
+	btrfs_inode_set_file_extent_range(inode, 0,
+			round_up(i_size_read(vfs_inode), fs_info->sectorsize));
 	/*
 	 * If we were modified in the current generation and evicted from memory
 	 * and then re-read we need to do a full sync since we don't have any

fs/btrfs/tree-log.c+1−1

@@ -1964,7 +1964,7 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans, · 1963 unmodified lines
1964		1964
1965	search_key.objectid = log_key.objectid;	1965	search_key.objectid = log_key.objectid;
1966	search_key.type = BTRFS_INODE_EXTREF_KEY;	1966	search_key.type = BTRFS_INODE_EXTREF_KEY;
1967	search_key.offset = key->objectid;	1967	search_key.offset = btrfs_extref_hash(key->objectid, name.name, name.len);
1968	ret = backref_in_log(root->log_root, &search_key, key->objectid, &name);	1968	ret = backref_in_log(root->log_root, &search_key, key->objectid, &name);
1969	if (ret < 0) {	1969	if (ret < 0) {
1970	goto out;	1970	goto out;

fs/btrfs/zoned.c+1−1

 			spin_lock(&space_info->lock);
 			space_info->total_bytes -= bg->length;
 			space_info->disk_total -= bg->length * factor;
+			space_info->disk_total -= bg->zone_unusable;
 			/* There is no allocation ever happened. */
 			ASSERT(bg->used == 0);
-			ASSERT(bg->zone_unusable == 0);
 			/* No super block in a block group on the zoned setup. */
 			ASSERT(bg->bytes_super == 0);
 			spin_unlock(&space_info->lock);

fs/ceph/addr.c+5−4

 								0,
 								gfp_flags);
 		if (IS_ERR(pages[index])) {
-			if (PTR_ERR(pages[index]) == -EINVAL) {
+			int err = PTR_ERR(pages[index]);
+			if (err == -EINVAL) {
 				pr_err_client(cl, "inode->i_blkbits=%hhu\n",
 						inode->i_blkbits);
 			}
 			BUG_ON(ceph_wbc->locked_pages == 0);
 			pages[index] = NULL;
-			return PTR_ERR(pages[index]);
+			return err;
 		}
 	} else {
 		pages[index] = &folio->page;
 process_folio_batch:
 		rc = ceph_process_folio_batch(mapping, wbc, &ceph_wbc);
+		ceph_shift_unused_folios_left(&ceph_wbc.fbatch);
 		if (rc)
 			goto release_folios;
 			goto release_folios;
 		if (ceph_wbc.processed_in_fbatch) {
-			ceph_shift_unused_folios_left(&ceph_wbc.fbatch);
 			if (folio_batch_count(&ceph_wbc.fbatch) == 0 &&
 			    ceph_wbc.locked_pages < ceph_wbc.max_pages) {
 				doutc(cl, "reached end fbatch, trying for more\n");

fs/ceph/debugfs.c+6−8

 	struct ceph_mds_client *mdsc = fsc->mdsc;
 	struct ceph_mds_request *req;
 	struct rb_node *rp;
-	int pathlen = 0;
-	u64 pathbase;
 	char *path;
 	mutex_lock(&mdsc->mutex);
 		if (req->r_inode) {
 			seq_printf(s, " #%llx", ceph_ino(req->r_inode));
 		} else if (req->r_dentry) {
-			path = ceph_mdsc_build_path(mdsc, req->r_dentry, &pathlen,
+			struct ceph_path_info path_info;
-						    &pathbase, 0);
+			path = ceph_mdsc_build_path(mdsc, req->r_dentry, &path_info, 0);
 			if (IS_ERR(path))
 				path = NULL;
 			spin_lock(&req->r_dentry->d_lock);
 				   req->r_dentry,
 				   path ? path : "");
 			spin_unlock(&req->r_dentry->d_lock);
-			ceph_mdsc_free_path(path, pathlen);
+			ceph_mdsc_free_path_info(&path_info);
 		} else if (req->r_path1) {
 			seq_printf(s, " #%llx/%s", req->r_ino1.ino,
 				   req->r_path1);
 		}
 		if (req->r_old_dentry) {
-			path = ceph_mdsc_build_path(mdsc, req->r_old_dentry, &pathlen,
+			struct ceph_path_info path_info;
-						    &pathbase, 0);
+			path = ceph_mdsc_build_path(mdsc, req->r_old_dentry, &path_info, 0);
 			if (IS_ERR(path))
 				path = NULL;
 			spin_lock(&req->r_old_dentry->d_lock);
 				   req->r_old_dentry,
 				   path ? path : "");
 			spin_unlock(&req->r_old_dentry->d_lock);
-			ceph_mdsc_free_path(path, pathlen);
+			ceph_mdsc_free_path_info(&path_info);
 		} else if (req->r_path2 && req->r_op != CEPH_MDS_OP_SYMLINK) {
 			if (req->r_ino2.ino)
 				seq_printf(s, " #%llx/%s", req->r_ino2.ino,

fs/ceph/dir.c+7−10

 	/* If op failed, mark everyone involved for errors */
 	if (result) {
-		int pathlen = 0;
+		struct ceph_path_info path_info = {0};
-		u64 base = 0;
+		char *path = ceph_mdsc_build_path(mdsc, dentry, &path_info, 0);
-		char *path = ceph_mdsc_build_path(mdsc, dentry, &pathlen,
-						  &base, 0);
 		/* mark error on parent + clear complete */
 		mapping_set_error(req->r_parent->i_mapping, result);
 		mapping_set_error(req->r_old_inode->i_mapping, result);
 		pr_warn_client(cl, "failure path=(%llx)%s result=%d!\n",
-			       base, IS_ERR(path) ? "<<bad>>" : path, result);
+			       path_info.vino.ino, IS_ERR(path) ? "<<bad>>" : path, result);
-		ceph_mdsc_free_path(path, pathlen);
+		ceph_mdsc_free_path_info(&path_info);
 	}
 out:
 	iput(req->r_old_inode);
 	int err = -EROFS;
 	int op;
 	char *path;
-	int pathlen;
-	u64 pathbase;
 	if (ceph_snap(dir) == CEPH_SNAPDIR) {
 		/* rmdir .snap/foo is RMSNAP */
 	if (!dn) {
 		try_async = false;
 	} else {
-		path = ceph_mdsc_build_path(mdsc, dn, &pathlen, &pathbase, 0);
+		struct ceph_path_info path_info;
+		path = ceph_mdsc_build_path(mdsc, dn, &path_info, 0);
 		if (IS_ERR(path)) {
 			try_async = false;
 			err = 0;
 		} else {
 			err = ceph_mds_check_access(mdsc, path, MAY_WRITE);
 		}
-		ceph_mdsc_free_path(path, pathlen);
+		ceph_mdsc_free_path_info(&path_info);
 		dput(dn);
 		/* For none EACCES cases will let the MDS do the mds auth check */

fs/ceph/file.c+10−14

 	int flags, fmode, wanted;
 	struct dentry *dentry;
 	char *path;
-	int pathlen;
-	u64 pathbase;
 	bool do_sync = false;
 	int mask = MAY_READ;
 	if (!dentry) {
 		do_sync = true;
 	} else {
-		path = ceph_mdsc_build_path(mdsc, dentry, &pathlen, &pathbase, 0);
+		struct ceph_path_info path_info;
+		path = ceph_mdsc_build_path(mdsc, dentry, &path_info, 0);
 		if (IS_ERR(path)) {
 			do_sync = true;
 			err = 0;
 		} else {
 			err = ceph_mds_check_access(mdsc, path, mask);
 		}
-		ceph_mdsc_free_path(path, pathlen);
+		ceph_mdsc_free_path_info(&path_info);
 		dput(dentry);
 		/* For none EACCES cases will let the MDS do the mds auth check */
 	mapping_set_error(req->r_parent->i_mapping, result);
 	if (result) {
-		int pathlen = 0;
+		struct ceph_path_info path_info = {0};
-		u64 base = 0;
+		char *path = ceph_mdsc_build_path(mdsc, req->r_dentry, &path_info, 0);
-		char *path = ceph_mdsc_build_path(mdsc, req->r_dentry, &pathlen,
-						  &base, 0);
 		pr_warn_client(cl,
 			"async create failure path=(%llx)%s result=%d!\n",
-			base, IS_ERR(path) ? "<<bad>>" : path, result);
+			path_info.vino.ino, IS_ERR(path) ? "<<bad>>" : path, result);
-		ceph_mdsc_free_path(path, pathlen);
+		ceph_mdsc_free_path_info(&path_info);
 		ceph_dir_clear_complete(req->r_parent);
 		if (!d_unhashed(dentry))
 	int mask;
 	int err;
 	char *path;
-	int pathlen;
-	u64 pathbase;
 	doutc(cl, "%p %llx.%llx dentry %p '%pd' %s flags %d mode 0%o\n",
 	      dir, ceph_vinop(dir), dentry, dentry,
 	if (!dn) {
 		try_async = false;
 	} else {
-		path = ceph_mdsc_build_path(mdsc, dn, &pathlen, &pathbase, 0);
+		struct ceph_path_info path_info;
+		path = ceph_mdsc_build_path(mdsc, dn, &path_info, 0);
 		if (IS_ERR(path)) {
 			try_async = false;
 			err = 0;
 				mask |= MAY_WRITE;
 			err = ceph_mds_check_access(mdsc, path, mask);
 		}
-		ceph_mdsc_free_path(path, pathlen);
+		ceph_mdsc_free_path_info(&path_info);
 		dput(dn);
 		/* For none EACCES cases will let the MDS do the mds auth check */

fs/ceph/inode.c+72−16

@@ -55,6 +55,52 @@ static int ceph_set_ino_cb(struct inode inode, void data) · 54 unmodified lines
55	return 0;	55	return 0;
56	}	56	}
57		57
		58	/*
		59	* Check if the parent inode matches the vino from directory reply info
		60	*/
		61	static inline bool ceph_vino_matches_parent(struct inode *parent,
		62	struct ceph_vino vino)
		63	{
		64	return ceph_ino(parent) == vino.ino && ceph_snap(parent) == vino.snap;
		65	}
		66
		67	/*
		68	* Validate that the directory inode referenced by @req->r_parent matches the
		69	* inode number and snapshot id contained in the reply's directory record. If
		70	* they do not match – which can theoretically happen if the parent dentry was
		71	* moved between the time the request was issued and the reply arrived – fall
		72	* back to looking up the correct inode in the inode cache.
		73	*
		74	* A reference is always returned. Callers that receive a different inode
		75	* than the original @parent are responsible for dropping the extra reference
		76	* once the reply has been processed.
		77	*/
		78	static struct inode ceph_get_reply_dir(struct super_block sb,
		79	struct inode *parent,
		80	struct ceph_mds_reply_info_parsed *rinfo)
		81	{
		82	struct ceph_vino vino;
		83
		84	if (unlikely(!rinfo->diri.in))
		85	return parent; /* nothing to compare against */
		86
		87	/* If we didn't have a cached parent inode to begin with, just bail out. */
		88	if (!parent)
		89	return NULL;
		90
		91	vino.ino = le64_to_cpu(rinfo->diri.in->ino);
		92	vino.snap = le64_to_cpu(rinfo->diri.in->snapid);
		93
		94	if (likely(ceph_vino_matches_parent(parent, vino)))
		95	return parent; /* matches – use the original reference */
		96
		97	/* Mismatch – this should be rare. Emit a WARN and obtain the correct inode. */
		98	WARN_ONCE(1, "ceph: reply dir mismatch (parent valid %llx.%llx reply %llx.%llx)\n",
		99	ceph_ino(parent), ceph_snap(parent), vino.ino, vino.snap);
		100
		101	return ceph_get_inode(sb, vino, NULL);
		102	}
		103
58	/**	104	/**
59	* ceph_new_inode - allocate a new inode in advance of an expected create	105	* ceph_new_inode - allocate a new inode in advance of an expected create
60	* @dir: parent directory for new inode	106	* @dir: parent directory for new inode
@@ -1523,6 +1569,7 @@ int ceph_fill_trace(struct super_block sb, struct ceph_mds_request req) · 1462 unmodified lines
1523	struct ceph_vino tvino, dvino;	1569	struct ceph_vino tvino, dvino;
1524	struct ceph_fs_client *fsc = ceph_sb_to_fs_client(sb);	1570	struct ceph_fs_client *fsc = ceph_sb_to_fs_client(sb);
1525	struct ceph_client *cl = fsc->client;	1571	struct ceph_client *cl = fsc->client;
		1572	struct inode *parent_dir = NULL;
1526	int err = 0;	1573	int err = 0;
1527		1574
1528	doutc(cl, "%p is_dentry %d is_target %d\n", req,	1575	doutc(cl, "%p is_dentry %d is_target %d\n", req,
@@ -1536,10 +1583,17 @@ int ceph_fill_trace(struct super_block sb, struct ceph_mds_request req) · 7 unmodified lines
1536	}	1583	}
1537		1584
1538	if (rinfo->head->is_dentry) {	1585	if (rinfo->head->is_dentry) {
1539	struct inode *dir = req->r_parent;	1586	/*
1540		1587	* r_parent may be stale, in cases when R_PARENT_LOCKED is not set,
1541	if (dir) {	1588	* so we need to get the correct inode
1542	err = ceph_fill_inode(dir, NULL, &rinfo->diri,	1589	*/
		1590	parent_dir = ceph_get_reply_dir(sb, req->r_parent, rinfo);
		1591	if (unlikely(IS_ERR(parent_dir))) {
		1592	err = PTR_ERR(parent_dir);
		1593	goto done;
		1594	}
		1595	if (parent_dir) {
		1596	err = ceph_fill_inode(parent_dir, NULL, &rinfo->diri,
1543	rinfo->dirfrag, session, -1,	1597	rinfo->dirfrag, session, -1,
1544	&req->r_caps_reservation);	1598	&req->r_caps_reservation);
1545	if (err < 0)	1599	if (err < 0)
@@ -1548,14 +1602,14 @@ int ceph_fill_trace(struct super_block sb, struct ceph_mds_request req) · 2 unmodified lines
1548	WARN_ON_ONCE(1);	1602	WARN_ON_ONCE(1);
1549	}	1603	}
1550		1604
1551	if (dir && req->r_op == CEPH_MDS_OP_LOOKUPNAME &&	1605	if (parent_dir && req->r_op == CEPH_MDS_OP_LOOKUPNAME &&
1552	test_bit(CEPH_MDS_R_PARENT_LOCKED, &req->r_req_flags) &&	1606	test_bit(CEPH_MDS_R_PARENT_LOCKED, &req->r_req_flags) &&
1553	!test_bit(CEPH_MDS_R_ABORTED, &req->r_req_flags)) {	1607	!test_bit(CEPH_MDS_R_ABORTED, &req->r_req_flags)) {
1554	bool is_nokey = false;	1608	bool is_nokey = false;
1555	struct qstr dname;	1609	struct qstr dname;
1556	struct dentry dn, parent;	1610	struct dentry dn, parent;
1557	struct fscrypt_str oname = FSTR_INIT(NULL, 0);	1611	struct fscrypt_str oname = FSTR_INIT(NULL, 0);
1558	struct ceph_fname fname = { .dir = dir,	1612	struct ceph_fname fname = { .dir = parent_dir,
1559	.name = rinfo->dname,	1613	.name = rinfo->dname,
1560	.ctext = rinfo->altname,	1614	.ctext = rinfo->altname,
1561	.name_len = rinfo->dname_len,	1615	.name_len = rinfo->dname_len,
@@ -1564,10 +1618,10 @@ int ceph_fill_trace(struct super_block sb, struct ceph_mds_request req) · 2 unmodified lines
1564	BUG_ON(!rinfo->head->is_target);	1618	BUG_ON(!rinfo->head->is_target);
1565	BUG_ON(req->r_dentry);	1619	BUG_ON(req->r_dentry);
1566		1620
1567	parent = d_find_any_alias(dir);	1621	parent = d_find_any_alias(parent_dir);
1568	BUG_ON(!parent);	1622	BUG_ON(!parent);
1569		1623
1570	err = ceph_fname_alloc_buffer(dir, &oname);	1624	err = ceph_fname_alloc_buffer(parent_dir, &oname);
1571	if (err < 0) {	1625	if (err < 0) {
1572	dput(parent);	1626	dput(parent);
1573	goto done;	1627	goto done;
@@ -1576,7 +1630,7 @@ int ceph_fill_trace(struct super_block sb, struct ceph_mds_request req) · 2 unmodified lines
1576	err = ceph_fname_to_usr(&fname, NULL, &oname, &is_nokey);	1630	err = ceph_fname_to_usr(&fname, NULL, &oname, &is_nokey);
1577	if (err < 0) {	1631	if (err < 0) {
1578	dput(parent);	1632	dput(parent);
1579	ceph_fname_free_buffer(dir, &oname);	1633	ceph_fname_free_buffer(parent_dir, &oname);
1580	goto done;	1634	goto done;
1581	}	1635	}
1582	dname.name = oname.name;	1636	dname.name = oname.name;
@@ -1595,7 +1649,7 @@ retry_lookup: · 12 unmodified lines
1595	dname.len, dname.name, dn);	1649	dname.len, dname.name, dn);
1596	if (!dn) {	1650	if (!dn) {
1597	dput(parent);	1651	dput(parent);
1598	ceph_fname_free_buffer(dir, &oname);	1652	ceph_fname_free_buffer(parent_dir, &oname);
1599	err = -ENOMEM;	1653	err = -ENOMEM;
1600	goto done;	1654	goto done;
1601	}	1655	}
@@ -1610,12 +1664,12 @@ retry_lookup: · 8 unmodified lines
1610	ceph_snap(d_inode(dn)) != tvino.snap)) {	1664	ceph_snap(d_inode(dn)) != tvino.snap)) {
1611	doutc(cl, " dn %p points to wrong inode %p\n",	1665	doutc(cl, " dn %p points to wrong inode %p\n",
1612	dn, d_inode(dn));	1666	dn, d_inode(dn));
1613	ceph_dir_clear_ordered(dir);	1667	ceph_dir_clear_ordered(parent_dir);
1614	d_delete(dn);	1668	d_delete(dn);
1615	dput(dn);	1669	dput(dn);
1616	goto retry_lookup;	1670	goto retry_lookup;
1617	}	1671	}
1618	ceph_fname_free_buffer(dir, &oname);	1672	ceph_fname_free_buffer(parent_dir, &oname);
1619		1673
1620	req->r_dentry = dn;	1674	req->r_dentry = dn;
1621	dput(parent);	1675	dput(parent);
@@ -1794,6 +1848,9 @@ retry_lookup: · 172 unmodified lines
1794	&dvino, ptvino);	1848	&dvino, ptvino);
1795	}	1849	}
1796	done:	1850	done:
		1851	/* Drop extra ref from ceph_get_reply_dir() if it returned a new inode */
		1852	if (unlikely(!IS_ERR_OR_NULL(parent_dir) && parent_dir != req->r_parent))
		1853	iput(parent_dir);
1797	doutc(cl, "done err=%d\n", err);	1854	doutc(cl, "done err=%d\n", err);
1798	return err;	1855	return err;
1799	}	1856	}
@@ -2487,22 +2544,21 @@ int __ceph_setattr(struct mnt_idmap idmap, struct inode inode, · 687 unmodified lines
2487	int truncate_retry = 20; /* The RMW will take around 50ms */	2544	int truncate_retry = 20; /* The RMW will take around 50ms */
2488	struct dentry *dentry;	2545	struct dentry *dentry;
2489	char *path;	2546	char *path;
2490	int pathlen;
2491	u64 pathbase;
2492	bool do_sync = false;	2547	bool do_sync = false;
2493		2548
2494	dentry = d_find_alias(inode);	2549	dentry = d_find_alias(inode);
2495	if (!dentry) {	2550	if (!dentry) {
2496	do_sync = true;	2551	do_sync = true;
2497	} else {	2552	} else {
2498	path = ceph_mdsc_build_path(mdsc, dentry, &pathlen, &pathbase, 0);	2553	struct ceph_path_info path_info;
		2554	path = ceph_mdsc_build_path(mdsc, dentry, &path_info, 0);
2499	if (IS_ERR(path)) {	2555	if (IS_ERR(path)) {
2500	do_sync = true;	2556	do_sync = true;
2501	err = 0;	2557	err = 0;
2502	} else {	2558	} else {
2503	err = ceph_mds_check_access(mdsc, path, MAY_WRITE);	2559	err = ceph_mds_check_access(mdsc, path, MAY_WRITE);
2504	}	2560	}
2505	ceph_mdsc_free_path(path, pathlen);	2561	ceph_mdsc_free_path_info(&path_info);
2506	dput(dentry);	2562	dput(dentry);
2507		2563
2508	/* For none EACCES cases will let the MDS do the mds auth check */	2564	/* For none EACCES cases will let the MDS do the mds auth check */

fs/ceph/mds_client.c+105−67

  * ceph_mdsc_build_path - build a path string to a given dentry
  * @mdsc: mds client
  * @dentry: dentry to which path should be built
- * @plen: returned length of string
+ * @path_info: output path, length, base ino+snap, and freepath ownership flag
- * @pbase: returned base inode number
  * @for_wire: is this path going to be sent to the MDS?
  *
  * Build a string that represents the path to the dentry. This is mostly called
  *   foo/.snap/bar -> foo//bar
  */
 char *ceph_mdsc_build_path(struct ceph_mds_client *mdsc, struct dentry *dentry,
-			   int *plen, u64 *pbase, int for_wire)
+			   struct ceph_path_info *path_info, int for_wire)
 {
 	struct ceph_client *cl = mdsc->fsc->client;
 	struct dentry *cur;
 		return ERR_PTR(-ENAMETOOLONG);
 	}
-	*pbase = base;
+	/* Initialize the output structure */
-	*plen = PATH_MAX - 1 - pos;
+	memset(path_info, 0, sizeof(*path_info));
+	path_info->vino.ino = base;
+	path_info->pathlen = PATH_MAX - 1 - pos;
+	path_info->path = path + pos;
+	path_info->freepath = true;
+	/* Set snap from dentry if available */
+	if (d_inode(dentry))
+		path_info->vino.snap = ceph_snap(d_inode(dentry));
+	else
+		path_info->vino.snap = CEPH_NOSNAP;
 	doutc(cl, "on %p %d built %llx '%.*s'\n", dentry, d_count(dentry),
-	      base, *plen, path + pos);
+	      base, PATH_MAX - 1 - pos, path + pos);
 	return path + pos;
 }
 static int build_dentry_path(struct ceph_mds_client *mdsc, struct dentry *dentry,
-			     struct inode *dir, const char **ppath, int *ppathlen,
+			     struct inode *dir, struct ceph_path_info *path_info,
-			     u64 *pino, bool *pfreepath, bool parent_locked)
+			     bool parent_locked)
 {
 	char *path;
 		dir = d_inode_rcu(dentry->d_parent);
 	if (dir && parent_locked && ceph_snap(dir) == CEPH_NOSNAP &&
 	    !IS_ENCRYPTED(dir)) {
-		*pino = ceph_ino(dir);
+		path_info->vino.ino = ceph_ino(dir);
+		path_info->vino.snap = ceph_snap(dir);
 		rcu_read_unlock();
-		*ppath = dentry->d_name.name;
+		path_info->path = dentry->d_name.name;
-		*ppathlen = dentry->d_name.len;
+		path_info->pathlen = dentry->d_name.len;
+		path_info->freepath = false;
 		return 0;
 	}
 	rcu_read_unlock();
-	path = ceph_mdsc_build_path(mdsc, dentry, ppathlen, pino, 1);
+	path = ceph_mdsc_build_path(mdsc, dentry, path_info, 1);
 	if (IS_ERR(path))
 		return PTR_ERR(path);
-	*ppath = path;
+	/*
-	*pfreepath = true;
+	 * ceph_mdsc_build_path already fills path_info, including snap handling.
+	 */
 	return 0;
 }
-static int build_inode_path(struct inode *inode,
+static int build_inode_path(struct inode *inode, struct ceph_path_info *path_info)
-			    const char **ppath, int *ppathlen, u64 *pino,
-			    bool *pfreepath)
 {
 	struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(inode->i_sb);
 	struct dentry *dentry;
 	char *path;
 	if (ceph_snap(inode) == CEPH_NOSNAP) {
-		*pino = ceph_ino(inode);
+		path_info->vino.ino = ceph_ino(inode);
-		*ppathlen = 0;
+		path_info->vino.snap = ceph_snap(inode);
+		path_info->pathlen = 0;
+		path_info->freepath = false;
 		return 0;
 	}
 	dentry = d_find_alias(inode);
-	path = ceph_mdsc_build_path(mdsc, dentry, ppathlen, pino, 1);
+	path = ceph_mdsc_build_path(mdsc, dentry, path_info, 1);
 	dput(dentry);
 	if (IS_ERR(path))
 		return PTR_ERR(path);
-	*ppath = path;
+	/*
-	*pfreepath = true;
+	 * ceph_mdsc_build_path already fills path_info, including snap from dentry.
+	 * Override with inode's snap since that's what this function is for.
+	 */
+	path_info->vino.snap = ceph_snap(inode);
 	return 0;
 }
  */
 static int set_request_path_attr(struct ceph_mds_client *mdsc, struct inode *rinode,
 				 struct dentry *rdentry, struct inode *rdiri,
-				 const char *rpath, u64 rino, const char **ppath,
+				 const char *rpath, u64 rino,
-				 int *pathlen, u64 *ino, bool *freepath,
+				 struct ceph_path_info *path_info,
 				 bool parent_locked)
 {
 	struct ceph_client *cl = mdsc->fsc->client;
 	int r = 0;
+	/* Initialize the output structure */
+	memset(path_info, 0, sizeof(*path_info));
 	if (rinode) {
-		r = build_inode_path(rinode, ppath, pathlen, ino, freepath);
+		r = build_inode_path(rinode, path_info);
 		doutc(cl, " inode %p %llx.%llx\n", rinode, ceph_ino(rinode),
 		      ceph_snap(rinode));
 	} else if (rdentry) {
-		r = build_dentry_path(mdsc, rdentry, rdiri, ppath, pathlen, ino,
+		r = build_dentry_path(mdsc, rdentry, rdiri, path_info, parent_locked);
-					freepath, parent_locked);
+		doutc(cl, " dentry %p %llx/%.*s\n", rdentry, path_info->vino.ino,
-		doutc(cl, " dentry %p %llx/%.*s\n", rdentry, *ino, *pathlen, *ppath);
+		      path_info->pathlen, path_info->path);
 	} else if (rpath || rino) {
-		*ino = rino;
+		path_info->vino.ino = rino;
-		*ppath = rpath;
+		path_info->vino.snap = CEPH_NOSNAP;
-		*pathlen = rpath ? strlen(rpath) : 0;
+		path_info->path = rpath;
-		doutc(cl, " path %.*s\n", *pathlen, rpath);
+		path_info->pathlen = rpath ? strlen(rpath) : 0;
+		path_info->freepath = false;
+		doutc(cl, " path %.*s\n", path_info->pathlen, rpath);
 	}
 	return r;
 	struct ceph_client *cl = mdsc->fsc->client;
 	struct ceph_msg *msg;
 	struct ceph_mds_request_head_legacy *lhead;
-	const char *path1 = NULL;
+	struct ceph_path_info path_info1 = {0};
-	const char *path2 = NULL;
+	struct ceph_path_info path_info2 = {0};
-	u64 ino1 = 0, ino2 = 0;
-	int pathlen1 = 0, pathlen2 = 0;
-	bool freepath1 = false, freepath2 = false;
 	struct dentry *old_dentry = NULL;
 	int len;
 	u16 releases;
 	u16 request_head_version = mds_supported_head_version(session);
 	kuid_t caller_fsuid = req->r_cred->fsuid;
 	kgid_t caller_fsgid = req->r_cred->fsgid;
+	bool parent_locked = test_bit(CEPH_MDS_R_PARENT_LOCKED, &req->r_req_flags);
 	ret = set_request_path_attr(mdsc, req->r_inode, req->r_dentry,
-			      req->r_parent, req->r_path1, req->r_ino1.ino,
+				    req->r_parent, req->r_path1, req->r_ino1.ino,
-			      &path1, &pathlen1, &ino1, &freepath1,
+				    &path_info1, parent_locked);
-			      test_bit(CEPH_MDS_R_PARENT_LOCKED,
-					&req->r_req_flags));
 	if (ret < 0) {
 		msg = ERR_PTR(ret);
 		goto out;
 	}
+	/*
+	 * When the parent directory's i_rwsem is *not* locked, req->r_parent may
+	 * have become stale (e.g. after a concurrent rename) between the time the
+	 * dentry was looked up and now.  If we detect that the stored r_parent
+	 * does not match the inode number we just encoded for the request, switch
+	 * to the correct inode so that the MDS receives a valid parent reference.
+	 */
+	if (!parent_locked && req->r_parent && path_info1.vino.ino &&
+	    ceph_ino(req->r_parent) != path_info1.vino.ino) {
+		struct inode *old_parent = req->r_parent;
+		struct inode *correct_dir = ceph_get_inode(mdsc->fsc->sb, path_info1.vino, NULL);
+		if (!IS_ERR(correct_dir)) {
+			WARN_ONCE(1, "ceph: r_parent mismatch (had %llx wanted %llx) - updating\n",
+			          ceph_ino(old_parent), path_info1.vino.ino);
+			/*
+			 * Transfer CEPH_CAP_PIN from the old parent to the new one.
+			 * The pin was taken earlier in ceph_mdsc_submit_request().
+			 */
+			ceph_put_cap_refs(ceph_inode(old_parent), CEPH_CAP_PIN);
+			iput(old_parent);
+			req->r_parent = correct_dir;
+			ceph_get_cap_refs(ceph_inode(req->r_parent), CEPH_CAP_PIN);
+		}
+	}
 	/* If r_old_dentry is set, then assume that its parent is locked */
 	if (req->r_old_dentry &&
 	    !(req->r_old_dentry->d_flags & DCACHE_DISCONNECTED))
 		old_dentry = req->r_old_dentry;
 	ret = set_request_path_attr(mdsc, NULL, old_dentry,
-			      req->r_old_dentry_dir,
+				    req->r_old_dentry_dir,
-			      req->r_path2, req->r_ino2.ino,
+				    req->r_path2, req->r_ino2.ino,
-			      &path2, &pathlen2, &ino2, &freepath2, true);
+				    &path_info2, true);
 	if (ret < 0) {
 		msg = ERR_PTR(ret);
 		goto out_free1;
 	/* filepaths */
 	len += 2 * (1 + sizeof(u32) + sizeof(u64));
-	len += pathlen1 + pathlen2;
+	len += path_info1.pathlen + path_info2.pathlen;
 	/* cap releases */
 	len += sizeof(struct ceph_mds_request_release) *
 		 !!req->r_old_inode_drop + !!req->r_old_dentry_drop);
 	if (req->r_dentry_drop)
-		len += pathlen1;
+		len += path_info1.pathlen;
 	if (req->r_old_dentry_drop)
-		len += pathlen2;
+		len += path_info2.pathlen;
 	/* MClientRequest tail */
 	lhead->ino = cpu_to_le64(req->r_deleg_ino);
 	lhead->args = req->r_args;
-	ceph_encode_filepath(&p, end, ino1, path1);
+	ceph_encode_filepath(&p, end, path_info1.vino.ino, path_info1.path);
-	ceph_encode_filepath(&p, end, ino2, path2);
+	ceph_encode_filepath(&p, end, path_info2.vino.ino, path_info2.path);
 	/* make note of release offset, in case we need to replay */
 	req->r_request_release_offset = p - msg->front.iov_base;
 	msg->hdr.data_off = cpu_to_le16(0);
 out_free2:
-	if (freepath2)
+	ceph_mdsc_free_path_info(&path_info2);
-		ceph_mdsc_free_path((char *)path2, pathlen2);
 out_free1:
-	if (freepath1)
+	ceph_mdsc_free_path_info(&path_info1);
-		ceph_mdsc_free_path((char *)path1, pathlen1);
 out:
 	return msg;
 out_err:
 	struct ceph_pagelist *pagelist = recon_state->pagelist;
 	struct dentry *dentry;
 	struct ceph_cap *cap;
-	char *path;
+	struct ceph_path_info path_info = {0};
-	int pathlen = 0, err;
+	int err;
-	u64 pathbase;
 	u64 snap_follows;
 	dentry = d_find_primary(inode);
 	if (dentry) {
 		/* set pathbase to parent dir when msg_version >= 2 */
-		path = ceph_mdsc_build_path(mdsc, dentry, &pathlen, &pathbase,
+		char *path = ceph_mdsc_build_path(mdsc, dentry, &path_info,
 					    recon_state->msg_version >= 2);
 		dput(dentry);
 		if (IS_ERR(path)) {
 			err = PTR_ERR(path);
 			goto out_err;
 		}
-	} else {
-		path = NULL;
-		pathbase = 0;
 	}
 	spin_lock(&ci->i_ceph_lock);
 		rec.v2.wanted = cpu_to_le32(__ceph_caps_wanted(ci));
 		rec.v2.issued = cpu_to_le32(cap->issued);
 		rec.v2.snaprealm = cpu_to_le64(ci->i_snap_realm->ino);
-		rec.v2.pathbase = cpu_to_le64(pathbase);
+		rec.v2.pathbase = cpu_to_le64(path_info.vino.ino);
 		rec.v2.flock_len = (__force __le32)
 			((ci->i_ceph_flags & CEPH_I_ERROR_FILELOCK) ? 0 : 1);
 	} else {
 		ts = inode_get_atime(inode);
 		ceph_encode_timespec64(&rec.v1.atime, &ts);
 		rec.v1.snaprealm = cpu_to_le64(ci->i_snap_realm->ino);
-		rec.v1.pathbase = cpu_to_le64(pathbase);
+		rec.v1.pathbase = cpu_to_le64(path_info.vino.ino);
 	}
 	if (list_empty(&ci->i_cap_snaps)) {
 			    sizeof(struct ceph_filelock);
 		rec.v2.flock_len = cpu_to_le32(struct_len);
-		struct_len += sizeof(u32) + pathlen + sizeof(rec.v2);
+		struct_len += sizeof(u32) + path_info.pathlen + sizeof(rec.v2);
 		if (struct_v >= 2)
 			struct_len += sizeof(u64); /* snap_follows */
 			ceph_pagelist_encode_8(pagelist, 1);
 			ceph_pagelist_encode_32(pagelist, struct_len);
 		}
-		ceph_pagelist_encode_string(pagelist, path, pathlen);
+		ceph_pagelist_encode_string(pagelist, (char *)path_info.path, path_info.pathlen);
 		ceph_pagelist_append(pagelist, &rec, sizeof(rec.v2));
 		ceph_locks_to_pagelist(flocks, pagelist,
 				       num_fcntl_locks, num_flock_locks);
 	} else {
 		err = ceph_pagelist_reserve(pagelist,
 					    sizeof(u64) + sizeof(u32) +
-					    pathlen + sizeof(rec.v1));
+					    path_info.pathlen + sizeof(rec.v1));
 		if (err)
 			goto out_err;
 		ceph_pagelist_encode_64(pagelist, ceph_ino(inode));
-		ceph_pagelist_encode_string(pagelist, path, pathlen);
+		ceph_pagelist_encode_string(pagelist, (char *)path_info.path, path_info.pathlen);
 		ceph_pagelist_append(pagelist, &rec, sizeof(rec.v1));
 	}
 out_err:
-	ceph_mdsc_free_path(path, pathlen);
+	ceph_mdsc_free_path_info(&path_info);
 	if (!err)
 		recon_state->nr_caps++;
 	return err;

fs/ceph/mds_client.h+14−4

 extern void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc);
-static inline void ceph_mdsc_free_path(char *path, int len)
+/*
+ * Structure to group path-related output parameters for build_*_path functions
+ */
+struct ceph_path_info {
+	const char *path;
+	int pathlen;
+	struct ceph_vino vino;
+	bool freepath;
+};
+static inline void ceph_mdsc_free_path_info(const struct ceph_path_info *path_info)
 {
-	if (!IS_ERR_OR_NULL(path))
+	if (path_info && path_info->freepath && !IS_ERR_OR_NULL(path_info->path))
-		__putname(path - (PATH_MAX - 1 - len));
+		__putname((char *)path_info->path - (PATH_MAX - 1 - path_info->pathlen));
 }
 extern char *ceph_mdsc_build_path(struct ceph_mds_client *mdsc,
-				  struct dentry *dentry, int *plen, u64 *base,
+				  struct dentry *dentry, struct ceph_path_info *path_info,
 				  int for_wire);
 extern void __ceph_mdsc_drop_dentry_lease(struct dentry *dentry);

fs/erofs/erofs_fs.h+5−3

 /* to allow for x86 boot sectors and other oddities. */
 #define EROFS_SUPER_OFFSET      1024
-#define EROFS_FEATURE_COMPAT_SB_CHKSUM          0x00000001
+#define EROFS_FEATURE_COMPAT_SB_CHKSUM			0x00000001
-#define EROFS_FEATURE_COMPAT_MTIME              0x00000002
+#define EROFS_FEATURE_COMPAT_MTIME			0x00000002
-#define EROFS_FEATURE_COMPAT_XATTR_FILTER	0x00000004
+#define EROFS_FEATURE_COMPAT_XATTR_FILTER		0x00000004
 #define EROFS_FEATURE_COMPAT_SHARED_EA_IN_METABOX	0x00000008
+#define EROFS_FEATURE_COMPAT_PLAIN_XATTR_PFX		0x00000010
 /*
  * Any bits that aren't in EROFS_ALL_FEATURE_INCOMPAT should

fs/erofs/internal.h+1−0

@@ -234,6 +234,7 @@ EROFS_FEATURE_FUNCS(metabox, incompat, INCOMPAT_METABOX) · 233 unmodified lines
234	EROFS_FEATURE_FUNCS(sb_chksum, compat, COMPAT_SB_CHKSUM)	234	EROFS_FEATURE_FUNCS(sb_chksum, compat, COMPAT_SB_CHKSUM)
235	EROFS_FEATURE_FUNCS(xattr_filter, compat, COMPAT_XATTR_FILTER)	235	EROFS_FEATURE_FUNCS(xattr_filter, compat, COMPAT_XATTR_FILTER)
236	EROFS_FEATURE_FUNCS(shared_ea_in_metabox, compat, COMPAT_SHARED_EA_IN_METABOX)	236	EROFS_FEATURE_FUNCS(shared_ea_in_metabox, compat, COMPAT_SHARED_EA_IN_METABOX)
		237	EROFS_FEATURE_FUNCS(plain_xattr_pfx, compat, COMPAT_PLAIN_XATTR_PFX)
237		238
238	static inline u64 erofs_nid_to_ino64(struct erofs_sb_info *sbi, erofs_nid_t nid)	239	static inline u64 erofs_nid_to_ino64(struct erofs_sb_info *sbi, erofs_nid_t nid)
239	{	240	{

fs/erofs/super.c+12−0

@@ -1018,10 +1018,22 @@ static int erofs_show_options(struct seq_file seq, struct dentry root) · 1017 unmodified lines
1018	return 0;	1018	return 0;
1019	}	1019	}
1020		1020
		1021	static void erofs_evict_inode(struct inode *inode)
		1022	{
		1023	#ifdef CONFIG_FS_DAX
		1024	if (IS_DAX(inode))
		1025	dax_break_layout_final(inode);
		1026	#endif
		1027
		1028	truncate_inode_pages_final(&inode->i_data);
		1029	clear_inode(inode);
		1030	}
		1031
1021	const struct super_operations erofs_sops = {	1032	const struct super_operations erofs_sops = {
1022	.put_super = erofs_put_super,	1033	.put_super = erofs_put_super,
1023	.alloc_inode = erofs_alloc_inode,	1034	.alloc_inode = erofs_alloc_inode,
1024	.free_inode = erofs_free_inode,	1035	.free_inode = erofs_free_inode,
		1036	.evict_inode = erofs_evict_inode,
1025	.statfs = erofs_statfs,	1037	.statfs = erofs_statfs,
1026	.show_options = erofs_show_options,	1038	.show_options = erofs_show_options,
1027	};	1039	};

fs/erofs/xattr.c+10−3

 	erofs_off_t pos = (erofs_off_t)sbi->xattr_prefix_start << 2;
 	struct erofs_xattr_prefix_item *pfs;
 	int ret = 0, i, len;
+	bool plain = erofs_sb_has_plain_xattr_pfx(sbi);
 	if (!sbi->xattr_prefix_count)
 		return 0;
 	if (!pfs)
 		return -ENOMEM;
-	if (sbi->packed_inode)
+	if (!plain) {
-		buf.mapping = sbi->packed_inode->i_mapping;
+		if (erofs_sb_has_metabox(sbi))
-	else
+			(void)erofs_init_metabuf(&buf, sb, true);
+		else if (sbi->packed_inode)
+			buf.mapping = sbi->packed_inode->i_mapping;
+		else
+			plain = true;
+	}
+	if (plain)
 		(void)erofs_init_metabuf(&buf, sb, false);
 	for (i = 0; i < sbi->xattr_prefix_count; i++) {

fs/erofs/zmap.c+37−30

 		.map = map,
 		.in_mbox = erofs_inode_in_metabox(inode),
 	};
-	int err = 0;
+	unsigned int endoff;
-	unsigned int endoff, afmt;
 	unsigned long initial_lcn;
 	unsigned long long ofs, end;
+	int err;
 	ofs = flags & EROFS_GET_BLOCKS_FINDTAIL ? inode->i_size - 1 : map->m_la;
 	if (fragment && !(flags & EROFS_GET_BLOCKS_FINDTAIL) &&
 			err = -EFSCORRUPTED;
 			goto unmap_out;
 		}
-		afmt = vi->z_advise & Z_EROFS_ADVISE_INTERLACED_PCLUSTER ?
+		if (vi->z_advise & Z_EROFS_ADVISE_INTERLACED_PCLUSTER)
-			Z_EROFS_COMPRESSION_INTERLACED :
+			map->m_algorithmformat = Z_EROFS_COMPRESSION_INTERLACED;
-			Z_EROFS_COMPRESSION_SHIFTED;
+		else
+			map->m_algorithmformat = Z_EROFS_COMPRESSION_SHIFTED;
+	} else if (m.headtype == Z_EROFS_LCLUSTER_TYPE_HEAD2) {
+		map->m_algorithmformat = vi->z_algorithmtype[1];
 	} else {
-		afmt = m.headtype == Z_EROFS_LCLUSTER_TYPE_HEAD2 ?
+		map->m_algorithmformat = vi->z_algorithmtype[0];
-			vi->z_algorithmtype[1] : vi->z_algorithmtype[0];
-		if (!(EROFS_I_SB(inode)->available_compr_algs & (1 << afmt))) {
-			erofs_err(sb, "inconsistent algorithmtype %u for nid %llu",
-				  afmt, vi->nid);
-			err = -EFSCORRUPTED;
-			goto unmap_out;
-		}
 	}
-	map->m_algorithmformat = afmt;
 	if ((flags & EROFS_GET_BLOCKS_FIEMAP) ||
 	    ((flags & EROFS_GET_BLOCKS_READMORE) &&
 {
 	struct erofs_inode *const vi = EROFS_I(inode);
 	struct super_block *const sb = inode->i_sb;
-	int err, headnr;
-	erofs_off_t pos;
 	struct z_erofs_map_header *h;
+	erofs_off_t pos;
+	int err = 0;
 	if (test_bit(EROFS_I_Z_INITED_BIT, &vi->flags)) {
 		/*
 	if (wait_on_bit_lock(&vi->flags, EROFS_I_BL_Z_BIT, TASK_KILLABLE))
 		return -ERESTARTSYS;
-	err = 0;
 	if (test_bit(EROFS_I_Z_INITED_BIT, &vi->flags))
 		goto out_unlock;
 	else if (vi->z_advise & Z_EROFS_ADVISE_INLINE_PCLUSTER)
 		vi->z_idata_size = le16_to_cpu(h->h_idata_size);
-	headnr = 0;
-	if (vi->z_algorithmtype[0] >= Z_EROFS_COMPRESSION_MAX ||
-	    vi->z_algorithmtype[++headnr] >= Z_EROFS_COMPRESSION_MAX) {
-		erofs_err(sb, "unknown HEAD%u format %u for nid %llu, please upgrade kernel",
-			  headnr + 1, vi->z_algorithmtype[headnr], vi->nid);
-		err = -EOPNOTSUPP;
-		goto out_unlock;
-	}
 	if (!erofs_sb_has_big_pcluster(EROFS_SB(sb)) &&
 	    vi->z_advise & (Z_EROFS_ADVISE_BIG_PCLUSTER_1 |
 			    Z_EROFS_ADVISE_BIG_PCLUSTER_2)) {
 	return err;
 }
+static int z_erofs_map_sanity_check(struct inode *inode,
+				    struct erofs_map_blocks *map)
+{
+	struct erofs_sb_info *sbi = EROFS_I_SB(inode);
+	if (!(map->m_flags & EROFS_MAP_ENCODED))
+		return 0;
+	if (unlikely(map->m_algorithmformat >= Z_EROFS_COMPRESSION_RUNTIME_MAX)) {
+		erofs_err(inode->i_sb, "unknown algorithm %d @ pos %llu for nid %llu, please upgrade kernel",
+			  map->m_algorithmformat, map->m_la, EROFS_I(inode)->nid);
+		return -EOPNOTSUPP;
+	}
+	if (unlikely(map->m_algorithmformat < Z_EROFS_COMPRESSION_MAX &&
+		     !(sbi->available_compr_algs & (1 << map->m_algorithmformat)))) {
+		erofs_err(inode->i_sb, "inconsistent algorithmtype %u for nid %llu",
+			  map->m_algorithmformat, EROFS_I(inode)->nid);
+		return -EFSCORRUPTED;
+	}
+	if (unlikely(map->m_plen > Z_EROFS_PCLUSTER_MAX_SIZE ||
+		     map->m_llen > Z_EROFS_PCLUSTER_MAX_DSIZE))
+		return -EOPNOTSUPP;
+	return 0;
+}
 int z_erofs_map_blocks_iter(struct inode *inode, struct erofs_map_blocks *map,
 			    int flags)
 {
 			else
 				err = z_erofs_map_blocks_fo(inode, map, flags);
 		}
-		if (!err && (map->m_flags & EROFS_MAP_ENCODED) &&
+		if (!err)
-		    unlikely(map->m_plen > Z_EROFS_PCLUSTER_MAX_SIZE ||
+			err = z_erofs_map_sanity_check(inode, map);
-			     map->m_llen > Z_EROFS_PCLUSTER_MAX_DSIZE))
-			err = -EOPNOTSUPP;
 		if (err)
 			map->m_llen = 0;
 	}

fs/kernfs/file.c+38−20

 					 !list_empty(&of->list));
 }
+/* Get active reference to kernfs node for an open file */
+static struct kernfs_open_file *kernfs_get_active_of(struct kernfs_open_file *of)
+{
+	/* Skip if file was already released */
+	if (unlikely(of->released))
+		return NULL;
+	if (!kernfs_get_active(of->kn))
+		return NULL;
+	return of;
+}
+static void kernfs_put_active_of(struct kernfs_open_file *of)
+{
+	return kernfs_put_active(of->kn);
+}
 /**
  * kernfs_deref_open_node_locked - Get kernfs_open_node corresponding to @kn
  *
 	if (ops->seq_stop)
 		ops->seq_stop(sf, v);
-	kernfs_put_active(of->kn);
+	kernfs_put_active_of(of);
 }
 static void *kernfs_seq_start(struct seq_file *sf, loff_t *ppos)
 	 * the ops aren't called concurrently for the same open file.
 	 */
 	mutex_lock(&of->mutex);
-	if (!kernfs_get_active(of->kn))
+	if (!kernfs_get_active_of(of))
 		return ERR_PTR(-ENODEV);
 	ops = kernfs_ops(of->kn);
 	 * the ops aren't called concurrently for the same open file.
 	 */
 	mutex_lock(&of->mutex);
-	if (!kernfs_get_active(of->kn)) {
+	if (!kernfs_get_active_of(of)) {
 		len = -ENODEV;
 		mutex_unlock(&of->mutex);
 		goto out_free;
 	else
 		len = -EINVAL;
-	kernfs_put_active(of->kn);
+	kernfs_put_active_of(of);
 	mutex_unlock(&of->mutex);
 	if (len < 0)
 	 * the ops aren't called concurrently for the same open file.
 	 */
 	mutex_lock(&of->mutex);
-	if (!kernfs_get_active(of->kn)) {
+	if (!kernfs_get_active_of(of)) {
 		mutex_unlock(&of->mutex);
 		len = -ENODEV;
 		goto out_free;
 	else
 		len = -EINVAL;
-	kernfs_put_active(of->kn);
+	kernfs_put_active_of(of);
 	mutex_unlock(&of->mutex);
 	if (len > 0)
 	if (!of->vm_ops)
 		return;
-	if (!kernfs_get_active(of->kn))
+	if (!kernfs_get_active_of(of))
 		return;
 	if (of->vm_ops->open)
 		of->vm_ops->open(vma);
-	kernfs_put_active(of->kn);
+	kernfs_put_active_of(of);
 }
 static vm_fault_t kernfs_vma_fault(struct vm_fault *vmf)
 	if (!of->vm_ops)
 		return VM_FAULT_SIGBUS;
-	if (!kernfs_get_active(of->kn))
+	if (!kernfs_get_active_of(of))
 		return VM_FAULT_SIGBUS;
 	ret = VM_FAULT_SIGBUS;
 	if (of->vm_ops->fault)
 		ret = of->vm_ops->fault(vmf);
-	kernfs_put_active(of->kn);
+	kernfs_put_active_of(of);
 	return ret;
 }
 	if (!of->vm_ops)
 		return VM_FAULT_SIGBUS;
-	if (!kernfs_get_active(of->kn))
+	if (!kernfs_get_active_of(of))
 		return VM_FAULT_SIGBUS;
 	ret = 0;
 	else
 		file_update_time(file);
-	kernfs_put_active(of->kn);
+	kernfs_put_active_of(of);
 	return ret;
 }
 	if (!of->vm_ops)
 		return -EINVAL;
-	if (!kernfs_get_active(of->kn))
+	if (!kernfs_get_active_of(of))
 		return -EINVAL;
 	ret = -EINVAL;
 	if (of->vm_ops->access)
 		ret = of->vm_ops->access(vma, addr, buf, len, write);
-	kernfs_put_active(of->kn);
+	kernfs_put_active_of(of);
 	return ret;
 }
 	mutex_lock(&of->mutex);
 	rc = -ENODEV;
-	if (!kernfs_get_active(of->kn))
+	if (!kernfs_get_active_of(of))
 		goto out_unlock;
 	ops = kernfs_ops(of->kn);
 	}
 	vma->vm_ops = &kernfs_vm_ops;
 out_put:
-	kernfs_put_active(of->kn);
+	kernfs_put_active_of(of);
 out_unlock:
 	mutex_unlock(&of->mutex);
 	struct kernfs_node *kn = kernfs_dentry_node(filp->f_path.dentry);
 	__poll_t ret;
-	if (!kernfs_get_active(kn))
+	if (!kernfs_get_active_of(of))
 		return DEFAULT_POLLMASK|EPOLLERR|EPOLLPRI;
 	if (kn->attr.ops->poll)
 	else
 		ret = kernfs_generic_poll(of, wait);
-	kernfs_put_active(kn);
+	kernfs_put_active_of(of);
 	return ret;
 }
 	 * the ops aren't called concurrently for the same open file.
 	 */
 	mutex_lock(&of->mutex);
-	if (!kernfs_get_active(of->kn)) {
+	if (!kernfs_get_active_of(of)) {
 		mutex_unlock(&of->mutex);
 		return -ENODEV;
 	}
 	else
 		ret = generic_file_llseek(file, offset, whence);
-	kernfs_put_active(of->kn);
+	kernfs_put_active_of(of);
 	mutex_unlock(&of->mutex);
 	return ret;
 }

fs/nilfs2/sysfs.c+2−2

@@ -1075,7 +1075,7 @@ void nilfs_sysfs_delete_device_group(struct the_nilfs *nilfs) · 1074 unmodified lines
1075	************************************************************************/	1075	************************************************************************/
1076		1076
1077	static ssize_t nilfs_feature_revision_show(struct kobject *kobj,	1077	static ssize_t nilfs_feature_revision_show(struct kobject *kobj,
1078	struct attribute attr, char buf)	1078	struct kobj_attribute attr, char buf)
1079	{	1079	{
1080	return sysfs_emit(buf, "%d.%d\n",	1080	return sysfs_emit(buf, "%d.%d\n",
1081	NILFS_CURRENT_REV, NILFS_MINOR_REV);	1081	NILFS_CURRENT_REV, NILFS_MINOR_REV);
@@ -1087,7 +1087,7 @@ static const char features_readme_str[] = · 5 unmodified lines
1087	"(1) revision\n\tshow current revision of NILFS file system driver.\n";	1087	"(1) revision\n\tshow current revision of NILFS file system driver.\n";
1088		1088
1089	static ssize_t nilfs_feature_README_show(struct kobject *kobj,	1089	static ssize_t nilfs_feature_README_show(struct kobject *kobj,
1090	struct attribute *attr,	1090	struct kobj_attribute *attr,
1091	char *buf)	1091	char *buf)
1092	{	1092	{
1093	return sysfs_emit(buf, features_readme_str);	1093	return sysfs_emit(buf, features_readme_str);

fs/nilfs2/sysfs.h+4−4

@@ -50,16 +50,16 @@ struct nilfs_sysfs_dev_subgroups { · 49 unmodified lines
50	struct completion sg_segments_kobj_unregister;	50	struct completion sg_segments_kobj_unregister;
51	};	51	};
52		52
53	#define NILFS_COMMON_ATTR_STRUCT(name) \	53	#define NILFS_KOBJ_ATTR_STRUCT(name) \
54	struct nilfs_##name##_attr { \	54	struct nilfs_##name##_attr { \
55	struct attribute attr; \	55	struct attribute attr; \
56	ssize_t (show)(struct kobject , struct attribute *, \	56	ssize_t (show)(struct kobject , struct kobj_attribute *, \
57	char *); \	57	char *); \
58	ssize_t (store)(struct kobject , struct attribute *, \	58	ssize_t (store)(struct kobject , struct kobj_attribute *, \
59	const char *, size_t); \	59	const char *, size_t); \
60	}	60	}
61		61
62	NILFS_COMMON_ATTR_STRUCT(feature);	62	NILFS_KOBJ_ATTR_STRUCT(feature);
63		63
64	#define NILFS_DEV_ATTR_STRUCT(name) \	64	#define NILFS_DEV_ATTR_STRUCT(name) \
65	struct nilfs_##name##_attr { \	65	struct nilfs_##name##_attr { \

fs/resctrl/ctrlmondata.c+1−1

 		 */
 		list_for_each_entry(d, &r->mon_domains, hdr.list) {
 			if (d->ci_id == domid) {
-				rr.ci_id = d->ci_id;
 				cpu = cpumask_any(&d->hdr.cpu_mask);
 				ci = get_cpu_cacheinfo_level(cpu, RESCTRL_L3_CACHE);
 				if (!ci)
 					continue;
+				rr.ci = ci;
 				mon_event_read(&rr, r, NULL, rdtgrp,
 					       &ci->shared_cpu_map, evtid, false);
 				goto checkresult;

fs/resctrl/internal.h+2−2

@@ -98,7 +98,7 @@ struct mon_data { · 97 unmodified lines
98	* domains in @r sharing L3 @ci.id	98	* domains in @r sharing L3 @ci.id
99	* @evtid: Which monitor event to read.	99	* @evtid: Which monitor event to read.
100	* @first: Initialize MBM counter when true.	100	* @first: Initialize MBM counter when true.
101	* @ci_id: Cacheinfo id for L3. Only set when @d is NULL. Used when summing domains.	101	* @ci: Cacheinfo for L3. Only set when @d is NULL. Used when summing domains.
102	* @err: Error encountered when reading counter.	102	* @err: Error encountered when reading counter.
103	* @val: Returned value of event counter. If @rgrp is a parent resource group,	103	* @val: Returned value of event counter. If @rgrp is a parent resource group,
104	* @val includes the sum of event counts from its child resource groups.	104	* @val includes the sum of event counts from its child resource groups.
@@ -112,7 +112,7 @@ struct rmid_read { · 7 unmodified lines
112	struct rdt_mon_domain *d;	112	struct rdt_mon_domain *d;
113	enum resctrl_event_id evtid;	113	enum resctrl_event_id evtid;
114	bool first;	114	bool first;
115	unsigned int ci_id;	115	struct cacheinfo *ci;
116	int err;	116	int err;
117	u64 val;	117	u64 val;
118	void *arch_mon_ctx;	118	void *arch_mon_ctx;

fs/resctrl/monitor.c+2−4

 {
 	int cpu = smp_processor_id();
 	struct rdt_mon_domain *d;
-	struct cacheinfo *ci;
 	struct mbm_state *m;
 	int err, ret;
 	u64 tval = 0;
 	}
 	/* Summing domains that share a cache, must be on a CPU for that cache. */
-	ci = get_cpu_cacheinfo_level(cpu, RESCTRL_L3_CACHE);
+	if (!cpumask_test_cpu(cpu, &rr->ci->shared_cpu_map))
-	if (!ci || ci->id != rr->ci_id)
 		return -EINVAL;
 	/*
 	 */
 	ret = -EINVAL;
 	list_for_each_entry(d, &rr->r->mon_domains, hdr.list) {
-		if (d->ci_id != rr->ci_id)
+		if (d->ci_id != rr->ci->id)
 			continue;
 		err = resctrl_arch_rmid_read(rr->r, d, closid, rmid,
 					     rr->evtid, &tval, rr->arch_mon_ctx);

fs/smb/client/cifsglob.h+9−4

 #define SMB_INTERFACE_POLL_INTERVAL	600
 /* maximum number of PDUs in one compound */
-#define MAX_COMPOUND 7
+#define MAX_COMPOUND 10
 /*
  * Default number of credits to keep available for SMB3.
 /* cifs_get_writable_file() flags */
-#define FIND_WR_ANY         0
+enum cifs_writable_file_flags {
-#define FIND_WR_FSUID_ONLY  1
+	FIND_WR_ANY			= 0U,
-#define FIND_WR_WITH_DELETE 2
+	FIND_WR_FSUID_ONLY		= (1U << 0),
+	FIND_WR_WITH_DELETE		= (1U << 1),
+	FIND_WR_NO_PENDING_DELETE	= (1U << 2),
+};
 #define   MID_FREE 0
 #define   MID_REQUEST_ALLOCATED 1
 	struct kvec qi_iov;
 	struct kvec io_iov[SMB2_IOCTL_IOV_SIZE];
 	struct kvec si_iov[SMB2_SET_INFO_IOV_SIZE];
+	struct kvec unlink_iov[SMB2_SET_INFO_IOV_SIZE];
+	struct kvec rename_iov[SMB2_SET_INFO_IOV_SIZE];
 	struct kvec close_iov;
 	struct smb2_file_rename_info_hdr rename_info;
 	struct smb2_file_link_info_hdr link_info;

fs/smb/client/file.c+17−1

 	/* Get the cached handle as SMB2 close is deferred */
 	if (OPEN_FMODE(file->f_flags) & FMODE_WRITE) {
-		rc = cifs_get_writable_path(tcon, full_path, FIND_WR_FSUID_ONLY, &cfile);
+		rc = cifs_get_writable_path(tcon, full_path,
+					    FIND_WR_FSUID_ONLY |
+					    FIND_WR_NO_PENDING_DELETE,
+					    &cfile);
 	} else {
 		rc = cifs_get_readable_path(tcon, full_path, &cfile);
 	}
 			continue;
 		if (with_delete && !(open_file->fid.access & DELETE))
 			continue;
+		if ((flags & FIND_WR_NO_PENDING_DELETE) &&
+		    open_file->status_file_deleted)
+			continue;
 		if (OPEN_FMODE(open_file->f_flags) & FMODE_WRITE) {
 			if (!open_file->invalidHandle) {
 				/* found a good writable file */
 		spin_unlock(&tcon->open_file_lock);
 		free_dentry_path(page);
 		*ret_file = find_readable_file(cinode, 0);
+		if (*ret_file) {
+			spin_lock(&cinode->open_file_lock);
+			if ((*ret_file)->status_file_deleted) {
+				spin_unlock(&cinode->open_file_lock);
+				cifsFileInfo_put(*ret_file);
+				*ret_file = NULL;
+			} else {
+				spin_unlock(&cinode->open_file_lock);
+			}
+		}
 		return *ret_file ? 0 : -ENOENT;
 	}

fs/smb/client/inode.c+69−17

@@ -1931,7 +1931,7 @@ cifs_drop_nlink(struct inode *inode) · 1930 unmodified lines
1931	* but will return the EACCES to the caller. Note that the VFS does not call	1931	* but will return the EACCES to the caller. Note that the VFS does not call
1932	* unlink on negative dentries currently.	1932	* unlink on negative dentries currently.
1933	*/	1933	*/
1934	int cifs_unlink(struct inode dir, struct dentry dentry)	1934	static int __cifs_unlink(struct inode dir, struct dentry dentry, bool sillyrename)
1935	{	1935	{
1936	int rc = 0;	1936	int rc = 0;
1937	unsigned int xid;	1937	unsigned int xid;
@@ -2003,7 +2003,11 @@ retry_std_delete: · 65 unmodified lines
2003	goto psx_del_no_retry;	2003	goto psx_del_no_retry;
2004	}	2004	}
2005		2005
2006	rc = server->ops->unlink(xid, tcon, full_path, cifs_sb, dentry);	2006	if (sillyrename \|\| (server->vals->protocol_id > SMB10_PROT_ID &&
		2007	d_is_positive(dentry) && d_count(dentry) > 2))
		2008	rc = -EBUSY;
		2009	else
		2010	rc = server->ops->unlink(xid, tcon, full_path, cifs_sb, dentry);
2007		2011
2008	psx_del_no_retry:	2012	psx_del_no_retry:
2009	if (!rc) {	2013	if (!rc) {
@@ -2071,6 +2075,11 @@ unlink_out: · 61 unmodified lines
2071	return rc;	2075	return rc;
2072	}	2076	}
2073		2077
		2078	int cifs_unlink(struct inode dir, struct dentry dentry)
		2079	{
		2080	return __cifs_unlink(dir, dentry, false);
		2081	}
		2082
2074	static int	2083	static int
2075	cifs_mkdir_qinfo(struct inode parent, struct dentry dentry, umode_t mode,	2084	cifs_mkdir_qinfo(struct inode parent, struct dentry dentry, umode_t mode,
2076	const char full_path, struct cifs_sb_info cifs_sb,	2085	const char full_path, struct cifs_sb_info cifs_sb,
@@ -2358,14 +2367,16 @@ int cifs_rmdir(struct inode inode, struct dentry direntry) · 281 unmodified lines
2358	rc = server->ops->rmdir(xid, tcon, full_path, cifs_sb);	2367	rc = server->ops->rmdir(xid, tcon, full_path, cifs_sb);
2359	cifs_put_tlink(tlink);	2368	cifs_put_tlink(tlink);
2360		2369
		2370	cifsInode = CIFS_I(d_inode(direntry));
		2371
2361	if (!rc) {	2372	if (!rc) {
		2373	set_bit(CIFS_INO_DELETE_PENDING, &cifsInode->flags);
2362	spin_lock(&d_inode(direntry)->i_lock);	2374	spin_lock(&d_inode(direntry)->i_lock);
2363	i_size_write(d_inode(direntry), 0);	2375	i_size_write(d_inode(direntry), 0);
2364	clear_nlink(d_inode(direntry));	2376	clear_nlink(d_inode(direntry));
2365	spin_unlock(&d_inode(direntry)->i_lock);	2377	spin_unlock(&d_inode(direntry)->i_lock);
2366	}	2378	}
2367		2379
2368	cifsInode = CIFS_I(d_inode(direntry));
2369	/* force revalidate to go get info when needed */	2380	/* force revalidate to go get info when needed */
2370	cifsInode->time = 0;	2381	cifsInode->time = 0;
2371		2382
@@ -2458,8 +2469,11 @@ cifs_do_rename(const unsigned int xid, struct dentry *from_dentry, · 86 unmodified lines
2458	}	2469	}
2459	#endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */	2470	#endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
2460	do_rename_exit:	2471	do_rename_exit:
2461	if (rc == 0)	2472	if (rc == 0) {
2462	d_move(from_dentry, to_dentry);	2473	d_move(from_dentry, to_dentry);
		2474	/* Force a new lookup */
		2475	d_drop(from_dentry);
		2476	}
2463	cifs_put_tlink(tlink);	2477	cifs_put_tlink(tlink);
2464	return rc;	2478	return rc;
2465	}	2479	}
@@ -2470,6 +2484,7 @@ cifs_rename2(struct mnt_idmap idmap, struct inode source_dir, · 4 unmodified lines
2470	struct dentry *target_dentry, unsigned int flags)	2484	struct dentry *target_dentry, unsigned int flags)
2471	{	2485	{
2472	const char from_name, to_name;	2486	const char from_name, to_name;
		2487	struct TCP_Server_Info *server;
2473	void page1, page2;	2488	void page1, page2;
2474	struct cifs_sb_info *cifs_sb;	2489	struct cifs_sb_info *cifs_sb;
2475	struct tcon_link *tlink;	2490	struct tcon_link *tlink;
@@ -2505,6 +2520,7 @@ cifs_rename2(struct mnt_idmap idmap, struct inode source_dir, · 29 unmodified lines
2505	if (IS_ERR(tlink))	2520	if (IS_ERR(tlink))
2506	return PTR_ERR(tlink);	2521	return PTR_ERR(tlink);
2507	tcon = tlink_tcon(tlink);	2522	tcon = tlink_tcon(tlink);
		2523	server = tcon->ses->server;
2508		2524
2509	page1 = alloc_dentry_path();	2525	page1 = alloc_dentry_path();
2510	page2 = alloc_dentry_path();	2526	page2 = alloc_dentry_path();
@@ -2591,19 +2607,53 @@ cifs_rename2(struct mnt_idmap idmap, struct inode source_dir, · 80 unmodified lines
2591		2607
2592	unlink_target:	2608	unlink_target:
2593	#endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */	2609	#endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
2594		2610	if (d_really_is_positive(target_dentry)) {
2595	/* Try unlinking the target dentry if it's not negative */	2611	if (!rc) {
2596	if (d_really_is_positive(target_dentry) && (rc == -EACCES \|\| rc == -EEXIST)) {	2612	struct inode *inode = d_inode(target_dentry);
2597	if (d_is_dir(target_dentry))	2613	/*
2598	tmprc = cifs_rmdir(target_dir, target_dentry);	2614	* Samba and ksmbd servers allow renaming a target
2599	else	2615	* directory that is open, so make sure to update
2600	tmprc = cifs_unlink(target_dir, target_dentry);	2616	* ->i_nlink and then mark it as delete pending.
2601	if (tmprc)	2617	*/
2602	goto cifs_rename_exit;	2618	if (S_ISDIR(inode->i_mode)) {
2603	rc = cifs_do_rename(xid, source_dentry, from_name,	2619	drop_cached_dir_by_name(xid, tcon, to_name, cifs_sb);
2604	target_dentry, to_name);	2620	spin_lock(&inode->i_lock);
2605	if (!rc)	2621	i_size_write(inode, 0);
2606	rehash = false;	2622	clear_nlink(inode);
		2623	spin_unlock(&inode->i_lock);
		2624	set_bit(CIFS_INO_DELETE_PENDING, &CIFS_I(inode)->flags);
		2625	CIFS_I(inode)->time = 0; /* force reval */
		2626	inode_set_ctime_current(inode);
		2627	inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
		2628	}
		2629	} else if (rc == -EACCES \|\| rc == -EEXIST) {
		2630	/*
		2631	* Rename failed, possibly due to a busy target.
		2632	* Retry it by unliking the target first.
		2633	*/
		2634	if (d_is_dir(target_dentry)) {
		2635	tmprc = cifs_rmdir(target_dir, target_dentry);
		2636	} else {
		2637	tmprc = __cifs_unlink(target_dir, target_dentry,
		2638	server->vals->protocol_id > SMB10_PROT_ID);
		2639	}
		2640	if (tmprc) {
		2641	/*
		2642	* Some servers will return STATUS_ACCESS_DENIED
		2643	* or STATUS_DIRECTORY_NOT_EMPTY when failing to
		2644	* rename a non-empty directory. Make sure to
		2645	* propagate the appropriate error back to
		2646	* userspace.
		2647	*/
		2648	if (tmprc == -EEXIST \|\| tmprc == -ENOTEMPTY)
		2649	rc = tmprc;
		2650	goto cifs_rename_exit;
		2651	}
		2652	rc = cifs_do_rename(xid, source_dentry, from_name,
		2653	target_dentry, to_name);
		2654	if (!rc)
		2655	rehash = false;
		2656	}
2607	}	2657	}
2608		2658
2609	/* force revalidate to go get info when needed */	2659	/* force revalidate to go get info when needed */
@@ -2629,6 +2679,8 @@ cifs_dentry_needs_reval(struct dentry *dentry) · 19 unmodified lines
2629	struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);	2679	struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
2630	struct cached_fid *cfid = NULL;	2680	struct cached_fid *cfid = NULL;
2631		2681
		2682	if (test_bit(CIFS_INO_DELETE_PENDING, &cifs_i->flags))
		2683	return false;
2632	if (cifs_i->time == 0)	2684	if (cifs_i->time == 0)
2633	return true;	2685	return true;
2634		2686

fs/smb/client/smb2glob.h+1−2

 	SMB2_OP_QUERY_DIR,
 	SMB2_OP_MKDIR,
 	SMB2_OP_RENAME,
-	SMB2_OP_DELETE,
 	SMB2_OP_HARDLINK,
 	SMB2_OP_SET_EOF,
-	SMB2_OP_RMDIR,
+	SMB2_OP_UNLINK,
 	SMB2_OP_POSIX_QUERY_INFO,
 	SMB2_OP_SET_REPARSE,
 	SMB2_OP_GET_REPARSE,

fs/smb/client/smb2inode.c+162−42

@@ -346,9 +346,6 @@ replay_again: · 345 unmodified lines
346	trace_smb3_posix_query_info_compound_enter(xid, tcon->tid,	346	trace_smb3_posix_query_info_compound_enter(xid, tcon->tid,
347	ses->Suid, full_path);	347	ses->Suid, full_path);
348	break;	348	break;
349	case SMB2_OP_DELETE:
350	trace_smb3_delete_enter(xid, tcon->tid, ses->Suid, full_path);
351	break;
352	case SMB2_OP_MKDIR:	349	case SMB2_OP_MKDIR:
353	/*	350	/*
354	* Directories are created through parameters in the	351	* Directories are created through parameters in the
@@ -356,23 +353,40 @@ replay_again: · 1 unmodified line
356	*/	353	*/
357	trace_smb3_mkdir_enter(xid, tcon->tid, ses->Suid, full_path);	354	trace_smb3_mkdir_enter(xid, tcon->tid, ses->Suid, full_path);
358	break;	355	break;
359	case SMB2_OP_RMDIR:	356	case SMB2_OP_UNLINK:
360	rqst[num_rqst].rq_iov = &vars->si_iov[0];	357	rqst[num_rqst].rq_iov = vars->unlink_iov;
361	rqst[num_rqst].rq_nvec = 1;	358	rqst[num_rqst].rq_nvec = 1;
362		359
363	size[0] = 1; /* sizeof __u8 See MS-FSCC section 2.4.11 */	360	size[0] = 1; /* sizeof __u8 See MS-FSCC section 2.4.11 */
364	data[0] = &delete_pending[0];	361	data[0] = &delete_pending[0];
365		362
366	rc = SMB2_set_info_init(tcon, server,	363	if (cfile) {
367	&rqst[num_rqst], COMPOUND_FID,	364	rc = SMB2_set_info_init(tcon, server,
368	COMPOUND_FID, current->tgid,	365	&rqst[num_rqst],
369	FILE_DISPOSITION_INFORMATION,	366	cfile->fid.persistent_fid,
370	SMB2_O_INFO_FILE, 0, data, size);	367	cfile->fid.volatile_fid,
371	if (rc)	368	current->tgid,
		369	FILE_DISPOSITION_INFORMATION,
		370	SMB2_O_INFO_FILE, 0,
		371	data, size);
		372	} else {
		373	rc = SMB2_set_info_init(tcon, server,
		374	&rqst[num_rqst],
		375	COMPOUND_FID,
		376	COMPOUND_FID,
		377	current->tgid,
		378	FILE_DISPOSITION_INFORMATION,
		379	SMB2_O_INFO_FILE, 0,
		380	data, size);
		381	}
		382	if (!rc && (!cfile \|\| num_rqst > 1)) {
		383	smb2_set_next_command(tcon, &rqst[num_rqst]);
		384	smb2_set_related(&rqst[num_rqst]);
		385	} else if (rc) {
372	goto finished;	386	goto finished;
373	smb2_set_next_command(tcon, &rqst[num_rqst]);	387	}
374	smb2_set_related(&rqst[num_rqst++]);	388	num_rqst++;
375	trace_smb3_rmdir_enter(xid, tcon->tid, ses->Suid, full_path);	389	trace_smb3_unlink_enter(xid, tcon->tid, ses->Suid, full_path);
376	break;	390	break;
377	case SMB2_OP_SET_EOF:	391	case SMB2_OP_SET_EOF:
378	rqst[num_rqst].rq_iov = &vars->si_iov[0];	392	rqst[num_rqst].rq_iov = &vars->si_iov[0];
@@ -442,7 +456,7 @@ replay_again: · 63 unmodified lines
442	ses->Suid, full_path);	456	ses->Suid, full_path);
443	break;	457	break;
444	case SMB2_OP_RENAME:	458	case SMB2_OP_RENAME:
445	rqst[num_rqst].rq_iov = &vars->si_iov[0];	459	rqst[num_rqst].rq_iov = vars->rename_iov;
446	rqst[num_rqst].rq_nvec = 2;	460	rqst[num_rqst].rq_nvec = 2;
447		461
448	len = in_iov[i].iov_len;	462	len = in_iov[i].iov_len;
@@ -732,19 +746,6 @@ finished: · 283 unmodified lines
732	trace_smb3_posix_query_info_compound_done(xid, tcon->tid,	746	trace_smb3_posix_query_info_compound_done(xid, tcon->tid,
733	ses->Suid);	747	ses->Suid);
734	break;	748	break;
735	case SMB2_OP_DELETE:
736	if (rc)
737	trace_smb3_delete_err(xid, tcon->tid, ses->Suid, rc);
738	else {
739	/*
740	* If dentry (hence, inode) is NULL, lease break is going to
741	* take care of degrading leases on handles for deleted files.
742	*/
743	if (inode)
744	cifs_mark_open_handles_for_deleted_file(inode, full_path);
745	trace_smb3_delete_done(xid, tcon->tid, ses->Suid);
746	}
747	break;
748	case SMB2_OP_MKDIR:	749	case SMB2_OP_MKDIR:
749	if (rc)	750	if (rc)
750	trace_smb3_mkdir_err(xid, tcon->tid, ses->Suid, rc);	751	trace_smb3_mkdir_err(xid, tcon->tid, ses->Suid, rc);
@@ -765,11 +766,11 @@ finished: · 14 unmodified lines
765	trace_smb3_rename_done(xid, tcon->tid, ses->Suid);	766	trace_smb3_rename_done(xid, tcon->tid, ses->Suid);
766	SMB2_set_info_free(&rqst[num_rqst++]);	767	SMB2_set_info_free(&rqst[num_rqst++]);
767	break;	768	break;
768	case SMB2_OP_RMDIR:	769	case SMB2_OP_UNLINK:
769	if (rc)	770	if (!rc)
770	trace_smb3_rmdir_err(xid, tcon->tid, ses->Suid, rc);	771	trace_smb3_unlink_done(xid, tcon->tid, ses->Suid);
771	else	772	else
772	trace_smb3_rmdir_done(xid, tcon->tid, ses->Suid);	773	trace_smb3_unlink_err(xid, tcon->tid, ses->Suid, rc);
773	SMB2_set_info_free(&rqst[num_rqst++]);	774	SMB2_set_info_free(&rqst[num_rqst++]);
774	break;	775	break;
775	case SMB2_OP_SET_EOF:	776	case SMB2_OP_SET_EOF:
@@ -1166,7 +1167,7 @@ smb2_rmdir(const unsigned int xid, struct cifs_tcon tcon, const char name, · 390 unmodified lines
1166	FILE_OPEN, CREATE_NOT_FILE, ACL_NO_MODE);	1167	FILE_OPEN, CREATE_NOT_FILE, ACL_NO_MODE);
1167	return smb2_compound_op(xid, tcon, cifs_sb,	1168	return smb2_compound_op(xid, tcon, cifs_sb,
1168	name, &oparms, NULL,	1169	name, &oparms, NULL,
1169	&(int){SMB2_OP_RMDIR}, 1,	1170	&(int){SMB2_OP_UNLINK}, 1,
1170	NULL, NULL, NULL, NULL);	1171	NULL, NULL, NULL, NULL);
1171	}	1172	}
1172		1173
@@ -1175,20 +1176,29 @@ smb2_unlink(const unsigned int xid, struct cifs_tcon tcon, const char name, · 2 unmodified lines
1175	struct cifs_sb_info cifs_sb, struct dentry dentry)	1176	struct cifs_sb_info cifs_sb, struct dentry dentry)
1176	{	1177	{
1177	struct cifs_open_parms oparms;	1178	struct cifs_open_parms oparms;
		1179	struct inode *inode = NULL;
		1180	int rc;
1178		1181
1179	oparms = CIFS_OPARMS(cifs_sb, tcon, name,	1182	if (dentry)
1180	DELETE, FILE_OPEN,	1183	inode = d_inode(dentry);
1181	CREATE_DELETE_ON_CLOSE \| OPEN_REPARSE_POINT,	1184
1182	ACL_NO_MODE);	1185	oparms = CIFS_OPARMS(cifs_sb, tcon, name, DELETE,
1183	int rc = smb2_compound_op(xid, tcon, cifs_sb, name, &oparms,	1186	FILE_OPEN, OPEN_REPARSE_POINT, ACL_NO_MODE);
1184	NULL, &(int){SMB2_OP_DELETE}, 1,	1187	rc = smb2_compound_op(xid, tcon, cifs_sb, name, &oparms,
1185	NULL, NULL, NULL, dentry);	1188	NULL, &(int){SMB2_OP_UNLINK},
		1189	1, NULL, NULL, NULL, dentry);
1186	if (rc == -EINVAL) {	1190	if (rc == -EINVAL) {
1187	cifs_dbg(FYI, "invalid lease key, resending request without lease");	1191	cifs_dbg(FYI, "invalid lease key, resending request without lease");
1188	rc = smb2_compound_op(xid, tcon, cifs_sb, name, &oparms,	1192	rc = smb2_compound_op(xid, tcon, cifs_sb, name, &oparms,
1189	NULL, &(int){SMB2_OP_DELETE}, 1,	1193	NULL, &(int){SMB2_OP_UNLINK},
1190	NULL, NULL, NULL, NULL);	1194	1, NULL, NULL, NULL, NULL);
1191	}	1195	}
		1196	/*
		1197	* If dentry (hence, inode) is NULL, lease break is going to
		1198	* take care of degrading leases on handles for deleted files.
		1199	*/
		1200	if (!rc && inode)
		1201	cifs_mark_open_handles_for_deleted_file(inode, name);
1192	return rc;	1202	return rc;
1193	}	1203	}
1194		1204
@@ -1441,3 +1451,113 @@ out: · 246 unmodified lines
1441	cifs_free_open_info(&data);	1451	cifs_free_open_info(&data);
1442	return rc;	1452	return rc;
1443	}	1453	}
		1454
		1455	static inline __le16 utf16_smb2_path(struct cifs_sb_info cifs_sb,
		1456	const char *name, size_t namelen)
		1457	{
		1458	int len;
		1459
		1460	if (*name == '\\' \|\|
		1461	(cifs_sb_master_tlink(cifs_sb) &&
		1462	cifs_sb_master_tcon(cifs_sb)->posix_extensions && *name == '/'))
		1463	name++;
		1464	return cifs_strndup_to_utf16(name, namelen, &len,
		1465	cifs_sb->local_nls,
		1466	cifs_remap(cifs_sb));
		1467	}
		1468
		1469	int smb2_rename_pending_delete(const char *full_path,
		1470	struct dentry *dentry,
		1471	const unsigned int xid)
		1472	{
		1473	struct cifs_sb_info *cifs_sb = CIFS_SB(d_inode(dentry)->i_sb);
		1474	struct cifsInodeInfo *cinode = CIFS_I(d_inode(dentry));
		1475	__le16 *utf16_path __free(kfree) = NULL;
		1476	__u32 co = file_create_options(dentry);
		1477	int cmds[] = {
		1478	SMB2_OP_SET_INFO,
		1479	SMB2_OP_RENAME,
		1480	SMB2_OP_UNLINK,
		1481	};
		1482	const int num_cmds = ARRAY_SIZE(cmds);
		1483	char *to_name __free(kfree) = NULL;
		1484	__u32 attrs = cinode->cifsAttrs;
		1485	struct cifs_open_parms oparms;
		1486	static atomic_t sillycounter;
		1487	struct cifsFileInfo *cfile;
		1488	struct tcon_link *tlink;
		1489	struct cifs_tcon *tcon;
		1490	struct kvec iov[2];
		1491	const char *ppath;
		1492	void *page;
		1493	size_t len;
		1494	int rc;
		1495
		1496	tlink = cifs_sb_tlink(cifs_sb);
		1497	if (IS_ERR(tlink))
		1498	return PTR_ERR(tlink);
		1499	tcon = tlink_tcon(tlink);
		1500
		1501	page = alloc_dentry_path();
		1502
		1503	ppath = build_path_from_dentry(dentry->d_parent, page);
		1504	if (IS_ERR(ppath)) {
		1505	rc = PTR_ERR(ppath);
		1506	goto out;
		1507	}
		1508
		1509	len = strlen(ppath) + strlen("/.__smb1234") + 1;
		1510	to_name = kmalloc(len, GFP_KERNEL);
		1511	if (!to_name) {
		1512	rc = -ENOMEM;
		1513	goto out;
		1514	}
		1515
		1516	scnprintf(to_name, len, "%s%c.__smb%04X", ppath, CIFS_DIR_SEP(cifs_sb),
		1517	atomic_inc_return(&sillycounter) & 0xffff);
		1518
		1519	utf16_path = utf16_smb2_path(cifs_sb, to_name, len);
		1520	if (!utf16_path) {
		1521	rc = -ENOMEM;
		1522	goto out;
		1523	}
		1524
		1525	drop_cached_dir_by_name(xid, tcon, full_path, cifs_sb);
		1526	oparms = CIFS_OPARMS(cifs_sb, tcon, full_path,
		1527	DELETE \| FILE_WRITE_ATTRIBUTES,
		1528	FILE_OPEN, co, ACL_NO_MODE);
		1529
		1530	attrs &= ~ATTR_READONLY;
		1531	if (!attrs)
		1532	attrs = ATTR_NORMAL;
		1533	if (d_inode(dentry)->i_nlink <= 1)
		1534	attrs \|= ATTR_HIDDEN;
		1535	iov[0].iov_base = &(FILE_BASIC_INFO) {
		1536	.Attributes = cpu_to_le32(attrs),
		1537	};
		1538	iov[0].iov_len = sizeof(FILE_BASIC_INFO);
		1539	iov[1].iov_base = utf16_path;
		1540	iov[1].iov_len = sizeof(utf16_path) UniStrlen((wchar_t *)utf16_path);
		1541
		1542	cifs_get_writable_path(tcon, full_path, FIND_WR_WITH_DELETE, &cfile);
		1543	rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, &oparms, iov,
		1544	cmds, num_cmds, cfile, NULL, NULL, dentry);
		1545	if (rc == -EINVAL) {
		1546	cifs_dbg(FYI, "invalid lease key, resending request without lease\n");
		1547	cifs_get_writable_path(tcon, full_path,
		1548	FIND_WR_WITH_DELETE, &cfile);
		1549	rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, &oparms, iov,
		1550	cmds, num_cmds, cfile, NULL, NULL, NULL);
		1551	}
		1552	if (!rc) {
		1553	set_bit(CIFS_INO_DELETE_PENDING, &cinode->flags);
		1554	} else {
		1555	cifs_tcon_dbg(FYI, "%s: failed to rename '%s' to '%s': %d\n",
		1556	__func__, full_path, to_name, rc);
		1557	rc = -EIO;
		1558	}
		1559	out:
		1560	cifs_put_tlink(tlink);
		1561	free_dentry_path(page);
		1562	return rc;
		1563	}

fs/smb/client/smb2ops.c+29−3

 	}
 	/* SMB headers in a compound are 8 byte aligned. */
-	if (!IS_ALIGNED(len, 8)) {
+	if (IS_ALIGNED(len, 8))
-		num_padding = 8 - (len & 7);
+		goto out;
+	num_padding = 8 - (len & 7);
+	if (smb3_encryption_required(tcon)) {
+		int i;
+		/*
+		 * Flatten request into a single buffer with required padding as
+		 * the encryption layer can't handle the padding iovs.
+		 */
+		for (i = 1; i < rqst->rq_nvec; i++) {
+			memcpy(rqst->rq_iov[0].iov_base +
+			       rqst->rq_iov[0].iov_len,
+			       rqst->rq_iov[i].iov_base,
+			       rqst->rq_iov[i].iov_len);
+			rqst->rq_iov[0].iov_len += rqst->rq_iov[i].iov_len;
+		}
+		memset(rqst->rq_iov[0].iov_base + rqst->rq_iov[0].iov_len,
+		       0, num_padding);
+		rqst->rq_iov[0].iov_len += num_padding;
+		rqst->rq_nvec = 1;
+	} else {
 		rqst->rq_iov[rqst->rq_nvec].iov_base = smb2_padding;
 		rqst->rq_iov[rqst->rq_nvec].iov_len = num_padding;
 		rqst->rq_nvec++;
-		len += num_padding;
 	}
+	len += num_padding;
+out:
 	shdr->NextCommand = cpu_to_le32(len);
 }
 	.llseek = smb3_llseek,
 	.is_status_io_timeout = smb2_is_status_io_timeout,
 	.is_network_name_deleted = smb2_is_network_name_deleted,
+	.rename_pending_delete = smb2_rename_pending_delete,
 };
 #endif /* CIFS_ALLOW_INSECURE_LEGACY */
 	.llseek = smb3_llseek,
 	.is_status_io_timeout = smb2_is_status_io_timeout,
 	.is_network_name_deleted = smb2_is_network_name_deleted,
+	.rename_pending_delete = smb2_rename_pending_delete,
 };
 struct smb_version_operations smb30_operations = {
 	.llseek = smb3_llseek,
 	.is_status_io_timeout = smb2_is_status_io_timeout,
 	.is_network_name_deleted = smb2_is_network_name_deleted,
+	.rename_pending_delete = smb2_rename_pending_delete,
 };
 struct smb_version_operations smb311_operations = {
 	.llseek = smb3_llseek,
 	.is_status_io_timeout = smb2_is_status_io_timeout,
 	.is_network_name_deleted = smb2_is_network_name_deleted,
+	.rename_pending_delete = smb2_rename_pending_delete,
 };
 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY

fs/smb/client/smb2proto.h+3−0

@@ -317,5 +317,8 @@ int posix_info_sid_size(const void beg, const void end); · 316 unmodified lines
317	int smb2_make_nfs_node(unsigned int xid, struct inode *inode,	317	int smb2_make_nfs_node(unsigned int xid, struct inode *inode,
318	struct dentry dentry, struct cifs_tcon tcon,	318	struct dentry dentry, struct cifs_tcon tcon,
319	const char *full_path, umode_t mode, dev_t dev);	319	const char *full_path, umode_t mode, dev_t dev);
		320	int smb2_rename_pending_delete(const char *full_path,
		321	struct dentry *dentry,
		322	const unsigned int xid);
320		323
321	#endif /* _SMB2PROTO_H */	324	#endif /* _SMB2PROTO_H */

fs/smb/client/trace.h+3−6

 DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(posix_query_info_compound_enter);
 DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(hardlink_enter);
 DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(rename_enter);
-DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(rmdir_enter);
+DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(unlink_enter);
 DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(set_eof_enter);
 DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(set_info_compound_enter);
 DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(set_reparse_compound_enter);
 DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(get_reparse_compound_enter);
 DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(query_wsl_ea_compound_enter);
-DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(delete_enter);
 DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(mkdir_enter);
 DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(tdis_enter);
 DEFINE_SMB3_INF_COMPOUND_ENTER_EVENT(mknod_enter);
 DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(posix_query_info_compound_done);
 DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(hardlink_done);
 DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(rename_done);
-DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(rmdir_done);
+DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(unlink_done);
 DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(set_eof_done);
 DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(set_info_compound_done);
 DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(set_reparse_compound_done);
 DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(get_reparse_compound_done);
 DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(query_wsl_ea_compound_done);
-DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(delete_done);
 DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(mkdir_done);
 DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(tdis_done);
 DEFINE_SMB3_INF_COMPOUND_DONE_EVENT(mknod_done);
 DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(posix_query_info_compound_err);
 DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(hardlink_err);
 DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(rename_err);
-DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(rmdir_err);
+DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(unlink_err);
 DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(set_eof_err);
 DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(set_info_compound_err);
 DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(set_reparse_compound_err);
 DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(get_reparse_compound_err);
 DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(query_wsl_ea_compound_err);
 DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(mkdir_err);
-DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(delete_err);
 DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(tdis_err);
 DEFINE_SMB3_INF_COMPOUND_ERR_EVENT(mknod_err);

fs/smb/server/transport_rdma.c+125−58

@@ -554,7 +554,7 @@ static void recv_done(struct ib_cq cq, struct ib_wc wc) · 553 unmodified lines
554	case SMB_DIRECT_MSG_DATA_TRANSFER: {	554	case SMB_DIRECT_MSG_DATA_TRANSFER: {
555	struct smb_direct_data_transfer *data_transfer =	555	struct smb_direct_data_transfer *data_transfer =
556	(struct smb_direct_data_transfer *)recvmsg->packet;	556	(struct smb_direct_data_transfer *)recvmsg->packet;
557	unsigned int data_length;	557	u32 remaining_data_length, data_offset, data_length;
558	int avail_recvmsg_count, receive_credits;	558	int avail_recvmsg_count, receive_credits;
559		559
560	if (wc->byte_len <	560	if (wc->byte_len <
@@ -564,15 +564,25 @@ static void recv_done(struct ib_cq cq, struct ib_wc wc) · 3 unmodified lines
564	return;	564	return;
565	}	565	}
566		566
		567	remaining_data_length = le32_to_cpu(data_transfer->remaining_data_length);
567	data_length = le32_to_cpu(data_transfer->data_length);	568	data_length = le32_to_cpu(data_transfer->data_length);
568	if (data_length) {	569	data_offset = le32_to_cpu(data_transfer->data_offset);
569	if (wc->byte_len < sizeof(struct smb_direct_data_transfer) +	570	if (wc->byte_len < data_offset \|\|
570	(u64)data_length) {	571	wc->byte_len < (u64)data_offset + data_length) {
571	put_recvmsg(t, recvmsg);	572	put_recvmsg(t, recvmsg);
572	smb_direct_disconnect_rdma_connection(t);	573	smb_direct_disconnect_rdma_connection(t);
573	return;	574	return;
574	}	575	}
		576	if (remaining_data_length > t->max_fragmented_recv_size \|\|
		577	data_length > t->max_fragmented_recv_size \|\|
		578	(u64)remaining_data_length + (u64)data_length >
		579	(u64)t->max_fragmented_recv_size) {
		580	put_recvmsg(t, recvmsg);
		581	smb_direct_disconnect_rdma_connection(t);
		582	return;
		583	}
575		584
		585	if (data_length) {
576	if (t->full_packet_received)	586	if (t->full_packet_received)
577	recvmsg->first_segment = true;	587	recvmsg->first_segment = true;
578		588
@@ -1209,78 +1219,130 @@ static int smb_direct_writev(struct ksmbd_transport *t, · 630 unmodified lines
1209	bool need_invalidate, unsigned int remote_key)	1219	bool need_invalidate, unsigned int remote_key)
1210	{	1220	{
1211	struct smb_direct_transport *st = smb_trans_direct_transfort(t);	1221	struct smb_direct_transport *st = smb_trans_direct_transfort(t);
1212	int remaining_data_length;	1222	size_t remaining_data_length;
1213	int start, i, j;	1223	size_t iov_idx;
1214	int max_iov_size = st->max_send_size -	1224	size_t iov_ofs;
		1225	size_t max_iov_size = st->max_send_size -
1215	sizeof(struct smb_direct_data_transfer);	1226	sizeof(struct smb_direct_data_transfer);
1216	int ret;	1227	int ret;
1217	struct kvec vec;
1218	struct smb_direct_send_ctx send_ctx;	1228	struct smb_direct_send_ctx send_ctx;
		1229	int error = 0;
1219		1230
1220	if (st->status != SMB_DIRECT_CS_CONNECTED)	1231	if (st->status != SMB_DIRECT_CS_CONNECTED)
1221	return -ENOTCONN;	1232	return -ENOTCONN;
1222		1233
1223	//FIXME: skip RFC1002 header..	1234	//FIXME: skip RFC1002 header..
		1235	if (WARN_ON_ONCE(niovs <= 1 \|\| iov[0].iov_len != 4))
		1236	return -EINVAL;
1224	buflen -= 4;	1237	buflen -= 4;
		1238	iov_idx = 1;
		1239	iov_ofs = 0;
1225		1240
1226	remaining_data_length = buflen;	1241	remaining_data_length = buflen;
1227	ksmbd_debug(RDMA, "Sending smb (RDMA): smb_len=%u\n", buflen);	1242	ksmbd_debug(RDMA, "Sending smb (RDMA): smb_len=%u\n", buflen);
1228		1243
1229	smb_direct_send_ctx_init(st, &send_ctx, need_invalidate, remote_key);	1244	smb_direct_send_ctx_init(st, &send_ctx, need_invalidate, remote_key);
1230	start = i = 1;	1245	while (remaining_data_length) {
1231	buflen = 0;	1246	struct kvec vecs[SMB_DIRECT_MAX_SEND_SGES - 1]; /* minus smbdirect hdr */
1232	while (true) {	1247	size_t possible_bytes = max_iov_size;
1233	buflen += iov[i].iov_len;	1248	size_t possible_vecs;
1234	if (buflen > max_iov_size) {	1249	size_t bytes = 0;
1235	if (i > start) {	1250	size_t nvecs = 0;
1236	remaining_data_length -=	1251
1237	(buflen - iov[i].iov_len);	1252	/*
1238	ret = smb_direct_post_send_data(st, &send_ctx,	1253	* For the last message remaining_data_length should be
1239	&iov[start], i - start,	1254	* have been 0 already!
1240	remaining_data_length);	1255	*/
1241	if (ret)	1256	if (WARN_ON_ONCE(iov_idx >= niovs)) {
		1257	error = -EINVAL;
		1258	goto done;
		1259	}
		1260
		1261	/*
		1262	* We have 2 factors which limit the arguments we pass
		1263	* to smb_direct_post_send_data():
		1264	*
		1265	* 1. The number of supported sges for the send,
		1266	* while one is reserved for the smbdirect header.
		1267	* And we currently need one SGE per page.
		1268	* 2. The number of negotiated payload bytes per send.
		1269	*/
		1270	possible_vecs = min_t(size_t, ARRAY_SIZE(vecs), niovs - iov_idx);
		1271
		1272	while (iov_idx < niovs && possible_vecs && possible_bytes) {
		1273	struct kvec *v = &vecs[nvecs];
		1274	int page_count;
		1275
		1276	v->iov_base = ((u8 *)iov[iov_idx].iov_base) + iov_ofs;
		1277	v->iov_len = min_t(size_t,
		1278	iov[iov_idx].iov_len - iov_ofs,
		1279	possible_bytes);
		1280	page_count = get_buf_page_count(v->iov_base, v->iov_len);
		1281	if (page_count > possible_vecs) {
		1282	/*
		1283	* If the number of pages in the buffer
		1284	* is to much (because we currently require
		1285	* one SGE per page), we need to limit the
		1286	* length.
		1287	*
		1288	* We know possible_vecs is at least 1,
		1289	* so we always keep the first page.
		1290	*
		1291	* We need to calculate the number extra
		1292	* pages (epages) we can also keep.
		1293	*
		1294	* We calculate the number of bytes in the
		1295	* first page (fplen), this should never be
		1296	* larger than v->iov_len because page_count is
		1297	* at least 2, but adding a limitation feels
		1298	* better.
		1299	*
		1300	* Then we calculate the number of bytes (elen)
		1301	* we can keep for the extra pages.
		1302	*/
		1303	size_t epages = possible_vecs - 1;
		1304	size_t fpofs = offset_in_page(v->iov_base);
		1305	size_t fplen = min_t(size_t, PAGE_SIZE - fpofs, v->iov_len);
		1306	size_t elen = min_t(size_t, v->iov_len - fplen, epages*PAGE_SIZE);
		1307
		1308	v->iov_len = fplen + elen;
		1309	page_count = get_buf_page_count(v->iov_base, v->iov_len);
		1310	if (WARN_ON_ONCE(page_count > possible_vecs)) {
		1311	/*
		1312	* Something went wrong in the above
		1313	* logic...
		1314	*/
		1315	error = -EINVAL;
1242	goto done;	1316	goto done;
1243	} else {
1244	/* iov[start] is too big, break it */
1245	int nvec = (buflen + max_iov_size - 1) /
1246	max_iov_size;
1247
1248	for (j = 0; j < nvec; j++) {
1249	vec.iov_base =
1250	(char *)iov[start].iov_base +
1251	j * max_iov_size;
1252	vec.iov_len =
1253	min_t(int, max_iov_size,
1254	buflen - max_iov_size * j);
1255	remaining_data_length -= vec.iov_len;
1256	ret = smb_direct_post_send_data(st, &send_ctx, &vec, 1,
1257	remaining_data_length);
1258	if (ret)
1259	goto done;
1260	}	1317	}
1261	i++;
1262	if (i == niovs)
1263	break;
1264	}	1318	}
1265	start = i;	1319	possible_vecs -= page_count;
1266	buflen = 0;	1320	nvecs += 1;
1267	} else {	1321	possible_bytes -= v->iov_len;
1268	i++;	1322	bytes += v->iov_len;
1269	if (i == niovs) {	1323
1270	/* send out all remaining vecs */	1324	iov_ofs += v->iov_len;
1271	remaining_data_length -= buflen;	1325	if (iov_ofs >= iov[iov_idx].iov_len) {
1272	ret = smb_direct_post_send_data(st, &send_ctx,	1326	iov_idx += 1;
1273	&iov[start], i - start,	1327	iov_ofs = 0;
1274	remaining_data_length);
1275	if (ret)
1276	goto done;
1277	break;
1278	}	1328	}
1279	}	1329	}
		1330
		1331	remaining_data_length -= bytes;
		1332
		1333	ret = smb_direct_post_send_data(st, &send_ctx,
		1334	vecs, nvecs,
		1335	remaining_data_length);
		1336	if (unlikely(ret)) {
		1337	error = ret;
		1338	goto done;
		1339	}
1280	}	1340	}
1281		1341
1282	done:	1342	done:
1283	ret = smb_direct_flush_send_list(st, &send_ctx, true);	1343	ret = smb_direct_flush_send_list(st, &send_ctx, true);
		1344	if (unlikely(!ret && error))
		1345	ret = error;
1284		1346
1285	/*	1347	/*
1286	* As an optimization, we don't wait for individual I/O to finish	1348	* As an optimization, we don't wait for individual I/O to finish
@@ -1744,6 +1806,11 @@ static int smb_direct_init_params(struct smb_direct_transport *t, · 457 unmodified lines
1744	return -EINVAL;	1806	return -EINVAL;
1745	}	1807	}
1746		1808
		1809	if (device->attrs.max_send_sge < SMB_DIRECT_MAX_SEND_SGES) {
		1810	pr_err("warning: device max_send_sge = %d too small\n",
		1811	device->attrs.max_send_sge);
		1812	return -EINVAL;
		1813	}
1747	if (device->attrs.max_recv_sge < SMB_DIRECT_MAX_RECV_SGES) {	1814	if (device->attrs.max_recv_sge < SMB_DIRECT_MAX_RECV_SGES) {
1748	pr_err("warning: device max_recv_sge = %d too small\n",	1815	pr_err("warning: device max_recv_sge = %d too small\n",
1749	device->attrs.max_recv_sge);	1816	device->attrs.max_recv_sge);
@@ -1767,7 +1834,7 @@ static int smb_direct_init_params(struct smb_direct_transport *t, · 17 unmodified lines
1767		1834
1768	cap->max_send_wr = max_send_wrs;	1835	cap->max_send_wr = max_send_wrs;
1769	cap->max_recv_wr = t->recv_credit_max;	1836	cap->max_recv_wr = t->recv_credit_max;
1770	cap->max_send_sge = max_sge_per_wr;	1837	cap->max_send_sge = SMB_DIRECT_MAX_SEND_SGES;
1771	cap->max_recv_sge = SMB_DIRECT_MAX_RECV_SGES;	1838	cap->max_recv_sge = SMB_DIRECT_MAX_RECV_SGES;
1772	cap->max_inline_data = 0;	1839	cap->max_inline_data = 0;
1773	cap->max_rdma_ctxs = t->max_rw_credits;	1840	cap->max_rdma_ctxs = t->max_rw_credits;

include/kvm/arm_vgic.h+6−3

 #include <linux/bits.h>
 #include <linux/kvm.h>
 #include <linux/irqreturn.h>
-#include <linux/kref.h>
 #include <linux/mutex.h>
+#include <linux/refcount.h>
 #include <linux/spinlock.h>
 #include <linux/static_key.h>
 #include <linux/types.h>
 	bool pending_latch;		/* The pending latch state used to calculate
 					 * the pending state for both level
 					 * and edge triggered IRQs. */
-	bool active;			/* not used for LPIs */
+	bool active;
+	bool pending_release;		/* Used for LPIs only, unreferenced IRQ
+					 * pending a release */
 	bool enabled;
 	bool hw;			/* Tied to HW IRQ */
-	struct kref refcount;		/* Used for LPIs */
+	refcount_t refcount;		/* Used for LPIs */
 	u32 hwintid;			/* HW INTID number */
 	unsigned int host_irq;		/* linux irq corresponding to hwintid */
 	union {

include/linux/damon.h+2−0

  * @data:		Data that will be passed to @fn.
  * @repeat:		Repeat invocations.
  * @return_code:	Return code from @fn invocation.
+ * @dealloc_on_cancel:	De-allocate when canceled.
  *
  * Control damon_call(), which requests specific kdamond to invoke a given
  * function.  Refer to damon_call() for more details.
 	void *data;
 	bool repeat;
 	int return_code;
+	bool dealloc_on_cancel;
 /* private: internal use only */
 	/* informs if the kdamond finished handling of the request */
 	struct completion completion;

include/linux/mlx5/driver.h+1−0

@@ -665,6 +665,7 @@ struct mlx5e_resources { · 664 unmodified lines
665	bool tisn_valid;	665	bool tisn_valid;
666	} hw_objs;	666	} hw_objs;
667	struct net_device *uplink_netdev;	667	struct net_device *uplink_netdev;
		668	netdevice_tracker tracker;
668	struct mutex uplink_netdev_lock;	669	struct mutex uplink_netdev_lock;
669	struct mlx5_crypto_dek_priv *dek_priv;	670	struct mlx5_crypto_dek_priv *dek_priv;
670	};	671	};

include/linux/swap.h+10−0

@@ -385,6 +385,16 @@ void folio_add_lru_vma(struct folio , struct vm_area_struct ); · 384 unmodified lines
385	void mark_page_accessed(struct page *);	385	void mark_page_accessed(struct page *);
386	void folio_mark_accessed(struct folio *);	386	void folio_mark_accessed(struct folio *);
387		387
		388	static inline bool folio_may_be_lru_cached(struct folio *folio)
		389	{
		390	/*
		391	* Holding PMD-sized folios in per-CPU LRU cache unbalances accounting.
		392	* Holding small numbers of low-order mTHP folios in per-CPU LRU cache
		393	* will be sensible, but nobody has implemented and tested that yet.
		394	*/
		395	return !folio_test_large(folio);
		396	}
		397
388	extern atomic_t lru_disable_count;	398	extern atomic_t lru_disable_count;
389		399
390	static inline bool lru_cache_disabled(void)	400	static inline bool lru_cache_disabled(void)

include/net/dst_metadata.h+9−2

 #define __NET_DST_METADATA_H 1
 #include <linux/skbuff.h>
+#include <net/ip.h>
 #include <net/ip_tunnels.h>
 #include <net/macsec.h>
 #include <net/dst.h>
 						 int md_size)
 {
 	const struct iphdr *iph = ip_hdr(skb);
+	struct metadata_dst *tun_dst;
+	tun_dst = __ip_tun_set_dst(iph->saddr, iph->daddr, iph->tos, iph->ttl,
+				   0, flags, tunnel_id, md_size);
-	return __ip_tun_set_dst(iph->saddr, iph->daddr, iph->tos, iph->ttl,
+	if (tun_dst && (iph->frag_off & htons(IP_DF)))
-				0, flags, tunnel_id, md_size);
+		__set_bit(IP_TUNNEL_DONT_FRAGMENT_BIT,
+			  tun_dst->u.tun_info.key.tun_flags);
+	return tun_dst;
 }
 static inline struct metadata_dst *__ipv6_tun_set_dst(const struct in6_addr *saddr,

include/net/sock.h+3−2

 	if (sock) {
 		WRITE_ONCE(sk->sk_uid, SOCK_INODE(sock)->i_uid);
 		WRITE_ONCE(sk->sk_ino, SOCK_INODE(sock)->i_ino);
+	} else {
+		/* Note: sk_uid is unchanged. */
+		WRITE_ONCE(sk->sk_ino, 0);
 	}
 }
 	sock_set_flag(sk, SOCK_DEAD);
 	sk_set_socket(sk, NULL);
 	sk->sk_wq  = NULL;
-	/* Note: sk_uid is unchanged. */
-	WRITE_ONCE(sk->sk_ino, 0);
 	write_unlock_bh(&sk->sk_callback_lock);
 }

include/uapi/linux/mptcp.h+2−0

@@ -31,6 +31,8 @@ · 30 unmodified lines
31	#define MPTCP_INFO_FLAG_FALLBACK _BITUL(0)	31	#define MPTCP_INFO_FLAG_FALLBACK _BITUL(0)
32	#define MPTCP_INFO_FLAG_REMOTE_KEY_RECEIVED _BITUL(1)	32	#define MPTCP_INFO_FLAG_REMOTE_KEY_RECEIVED _BITUL(1)
33		33
		34	#define MPTCP_PM_EV_FLAG_DENY_JOIN_ID0 _BITUL(0)
		35
34	#define MPTCP_PM_ADDR_FLAG_SIGNAL (1 << 0)	36	#define MPTCP_PM_ADDR_FLAG_SIGNAL (1 << 0)
35	#define MPTCP_PM_ADDR_FLAG_SUBFLOW (1 << 1)	37	#define MPTCP_PM_ADDR_FLAG_SUBFLOW (1 << 1)
36	#define MPTCP_PM_ADDR_FLAG_BACKUP (1 << 2)	38	#define MPTCP_PM_ADDR_FLAG_BACKUP (1 << 2)

include/uapi/linux/mptcp_pm.h+2−2

@@ -16,10 +16,10 @@ · 15 unmodified lines
16	* good time to allocate memory and send ADD_ADDR if needed. Depending on the	16	* good time to allocate memory and send ADD_ADDR if needed. Depending on the
17	* traffic-patterns it can take a long time until the MPTCP_EVENT_ESTABLISHED	17	* traffic-patterns it can take a long time until the MPTCP_EVENT_ESTABLISHED
18	* is sent. Attributes: token, family, saddr4 \| saddr6, daddr4 \| daddr6,	18	* is sent. Attributes: token, family, saddr4 \| saddr6, daddr4 \| daddr6,
19	* sport, dport, server-side.	19	* sport, dport, server-side, [flags].
20	* @MPTCP_EVENT_ESTABLISHED: A MPTCP connection is established (can start new	20	* @MPTCP_EVENT_ESTABLISHED: A MPTCP connection is established (can start new
21	* subflows). Attributes: token, family, saddr4 \| saddr6, daddr4 \| daddr6,	21	* subflows). Attributes: token, family, saddr4 \| saddr6, daddr4 \| daddr6,
22	* sport, dport, server-side.	22	* sport, dport, server-side, [flags].
23	* @MPTCP_EVENT_CLOSED: A MPTCP connection has stopped. Attribute: token.	23	* @MPTCP_EVENT_CLOSED: A MPTCP connection has stopped. Attribute: token.
24	* @MPTCP_EVENT_ANNOUNCED: A new address has been announced by the peer.	24	* @MPTCP_EVENT_ANNOUNCED: A new address has been announced by the peer.
25	* Attributes: token, rem_id, family, daddr4 \| daddr6 [, dport].	25	* Attributes: token, rem_id, family, daddr4 \| daddr6 [, dport].

kernel/cgroup/cgroup.c+37−7

  * of concurrent destructions.  Use a separate workqueue so that cgroup
  * destruction work items don't end up filling up max_active of system_wq
  * which may lead to deadlock.
+ *
+ * A cgroup destruction should enqueue work sequentially to:
+ * cgroup_offline_wq: use for css offline work
+ * cgroup_release_wq: use for css release work
+ * cgroup_free_wq: use for free work
+ *
+ * Rationale for using separate workqueues:
+ * The cgroup root free work may depend on completion of other css offline
+ * operations. If all tasks were enqueued to a single workqueue, this could
+ * create a deadlock scenario where:
+ * - Free work waits for other css offline work to complete.
+ * - But other css offline work is queued after free work in the same queue.
+ *
+ * Example deadlock scenario with single workqueue (cgroup_destroy_wq):
+ * 1. umount net_prio
+ * 2. net_prio root destruction enqueues work to cgroup_destroy_wq (CPUx)
+ * 3. perf_event CSS A offline enqueues work to same cgroup_destroy_wq (CPUx)
+ * 4. net_prio cgroup_destroy_root->cgroup_lock_and_drain_offline.
+ * 5. net_prio root destruction blocks waiting for perf_event CSS A offline,
+ *    which can never complete as it's behind in the same queue and
+ *    workqueue's max_active is 1.
  */
-static struct workqueue_struct *cgroup_destroy_wq;
+static struct workqueue_struct *cgroup_offline_wq;
+static struct workqueue_struct *cgroup_release_wq;
+static struct workqueue_struct *cgroup_free_wq;
 /* generate an array of cgroup subsystem pointers */
 #define SUBSYS(_x) [_x ## _cgrp_id] = &_x ## _cgrp_subsys,
 		cft->release(of);
 	put_cgroup_ns(ctx->ns);
 	kfree(ctx);
+	of->priv = NULL;
 }
 static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf,
 	cgroup_unlock();
 	INIT_RCU_WORK(&css->destroy_rwork, css_free_rwork_fn);
-	queue_rcu_work(cgroup_destroy_wq, &css->destroy_rwork);
+	queue_rcu_work(cgroup_free_wq, &css->destroy_rwork);
 }
 static void css_release(struct percpu_ref *ref)
 		container_of(ref, struct cgroup_subsys_state, refcnt);
 	INIT_WORK(&css->destroy_work, css_release_work_fn);
-	queue_work(cgroup_destroy_wq, &css->destroy_work);
+	queue_work(cgroup_release_wq, &css->destroy_work);
 }
 static void init_and_link_css(struct cgroup_subsys_state *css,
 	list_del_rcu(&css->sibling);
 err_free_css:
 	INIT_RCU_WORK(&css->destroy_rwork, css_free_rwork_fn);
-	queue_rcu_work(cgroup_destroy_wq, &css->destroy_rwork);
+	queue_rcu_work(cgroup_free_wq, &css->destroy_rwork);
 	return ERR_PTR(err);
 }
 	if (atomic_dec_and_test(&css->online_cnt)) {
 		INIT_WORK(&css->destroy_work, css_killed_work_fn);
-		queue_work(cgroup_destroy_wq, &css->destroy_work);
+		queue_work(cgroup_offline_wq, &css->destroy_work);
 	}
 }
 	 * We would prefer to do this in cgroup_init() above, but that
 	 * is called before init_workqueues(): so leave this until after.
 	 */
-	cgroup_destroy_wq = alloc_workqueue("cgroup_destroy", 0, 1);
+	cgroup_offline_wq = alloc_workqueue("cgroup_offline", 0, 1);
-	BUG_ON(!cgroup_destroy_wq);
+	BUG_ON(!cgroup_offline_wq);
+	cgroup_release_wq = alloc_workqueue("cgroup_release", 0, 1);
+	BUG_ON(!cgroup_release_wq);
+	cgroup_free_wq = alloc_workqueue("cgroup_free", 0, 1);
+	BUG_ON(!cgroup_free_wq);
 	return 0;
 }
 core_initcall(cgroup_wq_init);

kernel/sched/core.c+1−1

@@ -9551,7 +9551,7 @@ static unsigned long tg_weight(struct task_group *tg) · 9550 unmodified lines
9551	#ifdef CONFIG_FAIR_GROUP_SCHED	9551	#ifdef CONFIG_FAIR_GROUP_SCHED
9552	return scale_load_down(tg->shares);	9552	return scale_load_down(tg->shares);
9553	#else	9553	#else
9554	return sched_weight_from_cgroup(tg->scx_weight);	9554	return sched_weight_from_cgroup(tg->scx.weight);
9555	#endif	9555	#endif
9556	}	9556	}
9557		9557

kernel/sched/ext.c+1−5

 		 * CPUs disagree, they use %ENQUEUE_RESTORE which is bypassed to
 		 * the current local DSQ for running tasks and thus are not
 		 * visible to the BPF scheduler.
-		 *
-		 * Also skip re-enqueueing tasks that can only run on this
-		 * CPU, as they would just be re-added to the same local
-		 * DSQ without any benefit.
 		 */
-		if (p->migration_pending || is_migration_disabled(p) || p->nr_cpus_allowed == 1)
+		if (p->migration_pending)
 			continue;
 		dispatch_dequeue(rq, p);

kernel/time/hrtimer.c+3−8

 	 * of the next expiring timer is enough. The return from the SMP
 	 * function call will take care of the reprogramming in case the
 	 * CPU was in a NOHZ idle sleep.
+	 *
+	 * In periodic low resolution mode, the next softirq expiration
+	 * must also be updated.
 	 */
-	if (!hrtimer_hres_active(base) && !tick_nohz_active)
-		return;
 	raw_spin_lock(&base->lock);
 	hrtimer_update_base(base);
 	if (hrtimer_hres_active(base))
 				     &new_base->clock_base[i]);
 	}
-	/*
-	 * The migration might have changed the first expiring softirq
-	 * timer on this CPU. Update it.
-	 */
-	__hrtimer_get_next_event(new_base, HRTIMER_ACTIVE_SOFT);
 	/* Tell the other CPU to retrigger the next event */
 	smp_call_function_single(ncpu, retrigger_next_event, NULL, 0);

kernel/trace/trace_kprobe.c+2−0

 			return -EINVAL;
 		}
 		buf = kmemdup(&argv[0][1], len + 1, GFP_KERNEL);
+		if (!buf)
+			return -ENOMEM;
 		buf[len] = '\0';
 		ret = kstrtouint(buf, 0, &maxactive);
 		if (ret || !maxactive) {

mm/damon/core.c+6−2

 		mutex_lock(&ctx->call_controls_lock);
 		list_del(&control->list);
 		mutex_unlock(&ctx->call_controls_lock);
-		if (!control->repeat)
+		if (!control->repeat) {
 			complete(&control->completion);
-		else
+		} else if (control->canceled && control->dealloc_on_cancel) {
+			kfree(control);
+			continue;
+		} else {
 			list_add(&control->list, &repeat_controls);
+		}
 	}
 	control = list_first_entry_or_null(&repeat_controls,
 			struct damon_call_control, list);

mm/damon/sysfs.c+15−8

 	return 0;
 }
-static struct damon_call_control damon_sysfs_repeat_call_control = {
-	.fn = damon_sysfs_repeat_call_fn,
-	.repeat = true,
-};
 static int damon_sysfs_turn_damon_on(struct damon_sysfs_kdamond *kdamond)
 {
 	struct damon_ctx *ctx;
+	struct damon_call_control *repeat_call_control;
 	int err;
 	if (damon_sysfs_kdamond_running(kdamond))
 		damon_destroy_ctx(kdamond->damon_ctx);
 	kdamond->damon_ctx = NULL;
+	repeat_call_control = kmalloc(sizeof(*repeat_call_control),
+			GFP_KERNEL);
+	if (!repeat_call_control)
+		return -ENOMEM;
 	ctx = damon_sysfs_build_ctx(kdamond->contexts->contexts_arr[0]);
-	if (IS_ERR(ctx))
+	if (IS_ERR(ctx)) {
+		kfree(repeat_call_control);
 		return PTR_ERR(ctx);
+	}
 	err = damon_start(&ctx, 1, false);
 	if (err) {
+		kfree(repeat_call_control);
 		damon_destroy_ctx(ctx);
 		return err;
 	}
 	kdamond->damon_ctx = ctx;
-	damon_sysfs_repeat_call_control.data = kdamond;
+	repeat_call_control->fn = damon_sysfs_repeat_call_fn;
-	damon_call(ctx, &damon_sysfs_repeat_call_control);
+	repeat_call_control->data = kdamond;
+	repeat_call_control->repeat = true;
+	repeat_call_control->dealloc_on_cancel = true;
+	damon_call(ctx, repeat_call_control);
 	return err;
 }

mm/gup.c+11−3

 		struct pages_or_folios *pofs)
 {
 	unsigned long collected = 0;
-	bool drain_allow = true;
 	struct folio *folio;
+	int drained = 0;
 	long i = 0;
 	for (folio = pofs_get_folio(pofs, i); folio;
 			continue;
 		}
-		if (!folio_test_lru(folio) && drain_allow) {
+		if (drained == 0 && folio_may_be_lru_cached(folio) &&
+				folio_ref_count(folio) !=
+				folio_expected_ref_count(folio) + 1) {
+			lru_add_drain();
+			drained = 1;
+		}
+		if (drained == 1 && folio_may_be_lru_cached(folio) &&
+				folio_ref_count(folio) !=
+				folio_expected_ref_count(folio) + 1) {
 			lru_add_drain_all();
-			drain_allow = false;
+			drained = 2;
 		}
 		if (!folio_isolate_lru(folio))

mm/mlock.c+3−3

@@ -255,7 +255,7 @@ void mlock_folio(struct folio *folio) · 254 unmodified lines
255		255
256	folio_get(folio);	256	folio_get(folio);
257	if (!folio_batch_add(fbatch, mlock_lru(folio)) \|\|	257	if (!folio_batch_add(fbatch, mlock_lru(folio)) \|\|
258	folio_test_large(folio) \|\| lru_cache_disabled())	258	!folio_may_be_lru_cached(folio) \|\| lru_cache_disabled())
259	mlock_folio_batch(fbatch);	259	mlock_folio_batch(fbatch);
260	local_unlock(&mlock_fbatch.lock);	260	local_unlock(&mlock_fbatch.lock);
261	}	261	}
@@ -278,7 +278,7 @@ void mlock_new_folio(struct folio *folio) · 16 unmodified lines
278		278
279	folio_get(folio);	279	folio_get(folio);
280	if (!folio_batch_add(fbatch, mlock_new(folio)) \|\|	280	if (!folio_batch_add(fbatch, mlock_new(folio)) \|\|
281	folio_test_large(folio) \|\| lru_cache_disabled())	281	!folio_may_be_lru_cached(folio) \|\| lru_cache_disabled())
282	mlock_folio_batch(fbatch);	282	mlock_folio_batch(fbatch);
283	local_unlock(&mlock_fbatch.lock);	283	local_unlock(&mlock_fbatch.lock);
284	}	284	}
@@ -299,7 +299,7 @@ void munlock_folio(struct folio *folio) · 14 unmodified lines
299	*/	299	*/
300	folio_get(folio);	300	folio_get(folio);
301	if (!folio_batch_add(fbatch, folio) \|\|	301	if (!folio_batch_add(fbatch, folio) \|\|
302	folio_test_large(folio) \|\| lru_cache_disabled())	302	!folio_may_be_lru_cached(folio) \|\| lru_cache_disabled())
303	mlock_folio_batch(fbatch);	303	mlock_folio_batch(fbatch);
304	local_unlock(&mlock_fbatch.lock);	304	local_unlock(&mlock_fbatch.lock);
305	}	305	}

mm/swap.c+26−24

 	for (i = 0; i < folio_batch_count(fbatch); i++) {
 		struct folio *folio = fbatch->folios[i];
+		/* block memcg migration while the folio moves between lru */
+		if (move_fn != lru_add && !folio_test_clear_lru(folio))
+			continue;
 		folio_lruvec_relock_irqsave(folio, &lruvec, &flags);
 		move_fn(lruvec, folio);
 }
 static void __folio_batch_add_and_move(struct folio_batch __percpu *fbatch,
-		struct folio *folio, move_fn_t move_fn,
+		struct folio *folio, move_fn_t move_fn, bool disable_irq)
-		bool on_lru, bool disable_irq)
 {
 	unsigned long flags;
-	if (on_lru && !folio_test_clear_lru(folio))
-		return;
 	folio_get(folio);
 	if (disable_irq)
 	else
 		local_lock(&cpu_fbatches.lock);
-	if (!folio_batch_add(this_cpu_ptr(fbatch), folio) || folio_test_large(folio) ||
+	if (!folio_batch_add(this_cpu_ptr(fbatch), folio) ||
-	    lru_cache_disabled())
+			!folio_may_be_lru_cached(folio) || lru_cache_disabled())
 		folio_batch_move_lru(this_cpu_ptr(fbatch), move_fn);
 	if (disable_irq)
 		local_unlock(&cpu_fbatches.lock);
 }
-#define folio_batch_add_and_move(folio, op, on_lru)						\
+#define folio_batch_add_and_move(folio, op)		\
-	__folio_batch_add_and_move(								\
+	__folio_batch_add_and_move(			\
-		&cpu_fbatches.op,								\
+		&cpu_fbatches.op,			\
-		folio,										\
+		folio,					\
-		op,										\
+		op,					\
-		on_lru,										\
+		offsetof(struct cpu_fbatches, op) >=	\
-		offsetof(struct cpu_fbatches, op) >= offsetof(struct cpu_fbatches, lock_irq)	\
+		offsetof(struct cpu_fbatches, lock_irq)	\
 	)
 static void lru_move_tail(struct lruvec *lruvec, struct folio *folio)
 void folio_rotate_reclaimable(struct folio *folio)
 {
 	if (folio_test_locked(folio) || folio_test_dirty(folio) ||
-	    folio_test_unevictable(folio))
+	    folio_test_unevictable(folio) || !folio_test_lru(folio))
 		return;
-	folio_batch_add_and_move(folio, lru_move_tail, true);
+	folio_batch_add_and_move(folio, lru_move_tail);
 }
 void lru_note_cost_unlock_irq(struct lruvec *lruvec, bool file,
 void folio_activate(struct folio *folio)
 {
-	if (folio_test_active(folio) || folio_test_unevictable(folio))
+	if (folio_test_active(folio) || folio_test_unevictable(folio) ||
+	    !folio_test_lru(folio))
 		return;
-	folio_batch_add_and_move(folio, lru_activate, true);
+	folio_batch_add_and_move(folio, lru_activate);
 }
 #else
 	    lru_gen_in_fault() && !(current->flags & PF_MEMALLOC))
 		folio_set_active(folio);
-	folio_batch_add_and_move(folio, lru_add, false);
+	folio_batch_add_and_move(folio, lru_add);
 }
 EXPORT_SYMBOL(folio_add_lru);
 void deactivate_file_folio(struct folio *folio)
 {
 	/* Deactivating an unevictable folio will not accelerate reclaim */
-	if (folio_test_unevictable(folio))
+	if (folio_test_unevictable(folio) || !folio_test_lru(folio))
 		return;
 	if (lru_gen_enabled() && lru_gen_clear_refs(folio))
 		return;
-	folio_batch_add_and_move(folio, lru_deactivate_file, true);
+	folio_batch_add_and_move(folio, lru_deactivate_file);
 }
 /*
  */
 void folio_deactivate(struct folio *folio)
 {
-	if (folio_test_unevictable(folio))
+	if (folio_test_unevictable(folio) || !folio_test_lru(folio))
 		return;
 	if (lru_gen_enabled() ? lru_gen_clear_refs(folio) : !folio_test_active(folio))
 		return;
-	folio_batch_add_and_move(folio, lru_deactivate, true);
+	folio_batch_add_and_move(folio, lru_deactivate);
 }
 /**
 void folio_mark_lazyfree(struct folio *folio)
 {
 	if (!folio_test_anon(folio) || !folio_test_swapbacked(folio) ||
+	    !folio_test_lru(folio) ||
 	    folio_test_swapcache(folio) || folio_test_unevictable(folio))
 		return;
-	folio_batch_add_and_move(folio, lru_lazyfree, true);
+	folio_batch_add_and_move(folio, lru_lazyfree);
 }
 void lru_add_drain(void)

mm/vmscan.c+1−1

@@ -4507,7 +4507,7 @@ static bool sort_folio(struct lruvec lruvec, struct folio folio, struct scan_c · 4506 unmodified lines
4507	}	4507	}
4508		4508
4509	/* ineligible */	4509	/* ineligible */
4510	if (!folio_test_lru(folio) \|\| zone > sc->reclaim_idx) {	4510	if (zone > sc->reclaim_idx) {
4511	gen = folio_inc_gen(lruvec, folio, false);	4511	gen = folio_inc_gen(lruvec, folio, false);
4512	list_move_tail(&folio->lru, &lrugen->folios[gen][type][zone]);	4512	list_move_tail(&folio->lru, &lrugen->folios[gen][type][zone]);
4513	return true;	4513	return true;

net/ceph/messenger.c+4−3

 	 * in case we faulted due to authentication, invalidate our
 	 * current tickets so that we can get new ones.
 	 */
-	if (con->v1.auth_retry) {
+	if (!ceph_msgr2(from_msgr(con->msgr)) && con->v1.auth_retry) {
 		dout("auth_retry %d, invalidating\n", con->v1.auth_retry);
 		if (con->ops->invalidate_authorizer)
 			con->ops->invalidate_authorizer(con);
 {
 	/* come back from STANDBY? */
 	if (con->state == CEPH_CON_S_STANDBY) {
-		dout("clear_standby %p and ++connect_seq\n", con);
+		dout("clear_standby %p\n", con);
 		con->state = CEPH_CON_S_PREOPEN;
-		con->v1.connect_seq++;
+		if (!ceph_msgr2(from_msgr(con->msgr)))
+			con->v1.connect_seq++;
 		WARN_ON(ceph_con_flag_test(con, CEPH_CON_F_WRITE_PENDING));
 		WARN_ON(ceph_con_flag_test(con, CEPH_CON_F_KEEPALIVE_PENDING));
 	}

net/core/dev.c+1−1

@@ -7046,7 +7046,7 @@ static void napi_stop_kthread(struct napi_struct *napi) · 7045 unmodified lines
7046	* the kthread.	7046	* the kthread.
7047	*/	7047	*/
7048	while (true) {	7048	while (true) {
7049	if (!test_bit(NAPIF_STATE_SCHED_THREADED, &napi->state))	7049	if (!test_bit(NAPI_STATE_SCHED_THREADED, &napi->state))
7050	break;	7050	break;
7051		7051
7052	msleep(20);	7052	msleep(20);

net/devlink/rate.c+2−2

 static struct devlink_rate *
 devlink_rate_node_get_by_name(struct devlink *devlink, const char *node_name)
 {
-	static struct devlink_rate *devlink_rate;
+	struct devlink_rate *devlink_rate;
 	list_for_each_entry(devlink_rate, &devlink->rate_list, list) {
 		if (devlink_rate_is_node(devlink_rate) &&
  */
 void devl_rate_nodes_destroy(struct devlink *devlink)
 {
-	static struct devlink_rate *devlink_rate, *tmp;
 	const struct devlink_ops *ops = devlink->ops;
+	struct devlink_rate *devlink_rate, *tmp;
 	devl_assert_locked(devlink);

net/ethtool/common.c+2−2

@@ -925,7 +925,7 @@ int ethtool_net_get_ts_info_by_phc(struct net_device *dev, · 924 unmodified lines
925	int err;	925	int err;
926		926
927	if (!ops->get_ts_info)	927	if (!ops->get_ts_info)
928	return -ENODEV;	928	return -EOPNOTSUPP;
929		929
930	/* Does ptp comes from netdev */	930	/* Does ptp comes from netdev */
931	ethtool_init_tsinfo(info);	931	ethtool_init_tsinfo(info);
@@ -993,7 +993,7 @@ int ethtool_get_ts_info_by_phc(struct net_device *dev, · 61 unmodified lines
993	int err;	993	int err;
994		994
995	err = ethtool_net_get_ts_info_by_phc(dev, info, hwprov_desc);	995	err = ethtool_net_get_ts_info_by_phc(dev, info, hwprov_desc);
996	if (err == -ENODEV) {	996	if (err == -ENODEV \|\| err == -EOPNOTSUPP) {
997	struct phy_device *phy;	997	struct phy_device *phy;
998		998
999	phy = ethtool_phy_get_ts_info_by_phc(dev, info, hwprov_desc);	999	phy = ethtool_phy_get_ts_info_by_phc(dev, info, hwprov_desc);

net/ipv4/tcp.c+5−0

 	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	int old_state = sk->sk_state;
+	struct request_sock *req;
 	u32 seq;
 	if (old_state != TCP_CLOSE)
 	/* Clean up fastopen related fields */
+	req = rcu_dereference_protected(tp->fastopen_rsk,
+					lockdep_sock_is_held(sk));
+	if (req)
+		reqsk_fastopen_remove(sk, req, false);
 	tcp_free_fastopen_req(tp);
 	inet_clear_bit(DEFER_CONNECT, sk);
 	tp->fastopen_client_fail = 0;

net/ipv4/tcp_ao.c+3−1

@@ -1177,7 +1177,9 @@ void tcp_ao_finish_connect(struct sock sk, struct sk_buff skb) · 1176 unmodified lines
1177	if (!ao)	1177	if (!ao)
1178	return;	1178	return;
1179		1179
1180	WRITE_ONCE(ao->risn, tcp_hdr(skb)->seq);	1180	/* sk with TCP_REPAIR_ON does not have skb in tcp_finish_connect */
		1181	if (skb)
		1182	WRITE_ONCE(ao->risn, tcp_hdr(skb)->seq);
1181	ao->rcv_sne = 0;	1183	ao->rcv_sne = 0;
1182		1184
1183	hlist_for_each_entry_rcu(key, &ao->head, node, lockdep_sock_is_held(sk))	1185	hlist_for_each_entry_rcu(key, &ao->head, node, lockdep_sock_is_held(sk))

net/mptcp/options.c+3−3

 		return false;
 	}
-	if (mp_opt->deny_join_id0)
-		WRITE_ONCE(msk->pm.remote_deny_join_id0, true);
 	if (unlikely(!READ_ONCE(msk->pm.server_side)))
 		pr_warn_once("bogus mpc option on established client sk");
 set_fully_established:
+	if (mp_opt->deny_join_id0)
+		WRITE_ONCE(msk->pm.remote_deny_join_id0, true);
 	mptcp_data_lock((struct sock *)msk);
 	__mptcp_subflow_fully_established(msk, subflow, mp_opt);
 	mptcp_data_unlock((struct sock *)msk);

net/mptcp/pm_netlink.c+7−0

 			       const struct sock *ssk)
 {
 	int err = nla_put_u32(skb, MPTCP_ATTR_TOKEN, READ_ONCE(msk->token));
+	u16 flags = 0;
 	if (err)
 		return err;
 	if (nla_put_u8(skb, MPTCP_ATTR_SERVER_SIDE, READ_ONCE(msk->pm.server_side)))
 		return -EMSGSIZE;
+	if (READ_ONCE(msk->pm.remote_deny_join_id0))
+		flags |= MPTCP_PM_EV_FLAG_DENY_JOIN_ID0;
+	if (flags && nla_put_u16(skb, MPTCP_ATTR_FLAGS, flags))
+		return -EMSGSIZE;
 	return mptcp_event_add_subflow(skb, ssk);
 }

net/mptcp/protocol.c+16−0

 		sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
 }
+static void mptcp_shutdown_subflows(struct mptcp_sock *msk)
+{
+	struct mptcp_subflow_context *subflow;
+	mptcp_for_each_subflow(msk, subflow) {
+		struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
+		bool slow;
+		slow = lock_sock_fast(ssk);
+		tcp_shutdown(ssk, SEND_SHUTDOWN);
+		unlock_sock_fast(ssk, slow);
+	}
+}
 /* called under the msk socket lock */
 static bool mptcp_pending_data_fin_ack(struct sock *sk)
 {
 			break;
 		case TCP_CLOSING:
 		case TCP_LAST_ACK:
+			mptcp_shutdown_subflows(msk);
 			mptcp_set_state(sk, TCP_CLOSE);
 			break;
 		}
 			mptcp_set_state(sk, TCP_CLOSING);
 			break;
 		case TCP_FIN_WAIT2:
+			mptcp_shutdown_subflows(msk);
 			mptcp_set_state(sk, TCP_CLOSE);
 			break;
 		default:

net/mptcp/subflow.c+4−0

@@ -883,6 +883,10 @@ create_child: · 882 unmodified lines
883		883
884	ctx->subflow_id = 1;	884	ctx->subflow_id = 1;
885	owner = mptcp_sk(ctx->conn);	885	owner = mptcp_sk(ctx->conn);
		886
		887	if (mp_opt.deny_join_id0)
		888	WRITE_ONCE(owner->pm.remote_deny_join_id0, true);
		889
886	mptcp_pm_new_connection(owner, child, 1);	890	mptcp_pm_new_connection(owner, child, 1);
887		891
888	/* with OoO packets we can reach here without ingress	892	/* with OoO packets we can reach here without ingress

net/rds/ib_frmr.c+12−8

 	ret = ib_map_mr_sg_zbva(frmr->mr, ibmr->sg, ibmr->sg_dma_len,
 				&off, PAGE_SIZE);
-	if (unlikely(ret != ibmr->sg_dma_len))
+	if (unlikely(ret != ibmr->sg_dma_len)) {
-		return ret < 0 ? ret : -EINVAL;
+		ret = ret < 0 ? ret : -EINVAL;
+		goto out_inc;
+	}
-	if (cmpxchg(&frmr->fr_state,
+	if (cmpxchg(&frmr->fr_state, FRMR_IS_FREE, FRMR_IS_INUSE) != FRMR_IS_FREE) {
-		    FRMR_IS_FREE, FRMR_IS_INUSE) != FRMR_IS_FREE)
+		ret = -EBUSY;
-		return -EBUSY;
+		goto out_inc;
+	}
 	atomic_inc(&ibmr->ic->i_fastreg_inuse_count);
 		/* Failure here can be because of -ENOMEM as well */
 		rds_transition_frwr_state(ibmr, FRMR_IS_INUSE, FRMR_IS_STALE);
-		atomic_inc(&ibmr->ic->i_fastreg_wrs);
 		if (printk_ratelimit())
 			pr_warn("RDS/IB: %s returned error(%d)\n",
 				__func__, ret);
-		goto out;
+		goto out_inc;
 	}
 	/* Wait for the registration to complete in order to prevent an invalid
 	 */
 	wait_event(frmr->fr_reg_done, !frmr->fr_reg);
-out:
+	return ret;
+out_inc:
+	atomic_inc(&ibmr->ic->i_fastreg_wrs);
 	return ret;
 }

net/rfkill/rfkill-gpio.c+2−2

@@ -94,10 +94,10 @@ static const struct dmi_system_id rfkill_gpio_deny_table[] = { · 93 unmodified lines
94	static int rfkill_gpio_probe(struct platform_device *pdev)	94	static int rfkill_gpio_probe(struct platform_device *pdev)
95	{	95	{
96	struct rfkill_gpio_data *rfkill;	96	struct rfkill_gpio_data *rfkill;
97	struct gpio_desc *gpio;	97	const char *type_name = NULL;
98	const char *name_property;	98	const char *name_property;
99	const char *type_property;	99	const char *type_property;
100	const char *type_name;	100	struct gpio_desc *gpio;
101	int ret;	101	int ret;
102		102
103	if (dmi_check_system(rfkill_gpio_deny_table))	103	if (dmi_check_system(rfkill_gpio_deny_table))

net/rxrpc/rxgk.c+10−8

 	struct krb5_buffer metadata;
 	unsigned int offset = sp->offset, len = sp->len;
 	size_t data_offset = 0, data_len = len;
-	u32 ac;
+	u32 ac = 0;
 	int ret = -ENOMEM;
 	_enter("");
 	ret = rxgk_verify_mic_skb(gk->krb5, gk->rx_Kc, &metadata,
 				  skb, &offset, &len, &ac);
 	kfree(hdr);
-	if (ret == -EPROTO) {
+	if (ret < 0) {
-		rxrpc_abort_eproto(call, skb, ac,
+		if (ret != -ENOMEM)
-				   rxgk_abort_1_verify_mic_eproto);
+			rxrpc_abort_eproto(call, skb, ac,
+					   rxgk_abort_1_verify_mic_eproto);
 	} else {
 		sp->offset = offset;
 		sp->len = len;
 	struct rxgk_header hdr;
 	unsigned int offset = sp->offset, len = sp->len;
 	int ret;
-	u32 ac;
+	u32 ac = 0;
 	_enter("");
 	ret = rxgk_decrypt_skb(gk->krb5, gk->rx_enc, skb, &offset, &len, &ac);
-	if (ret == -EPROTO)
+	if (ret < 0) {
-		rxrpc_abort_eproto(call, skb, ac, rxgk_abort_2_decrypt_eproto);
+		if (ret != -ENOMEM)
-	if (ret < 0)
+			rxrpc_abort_eproto(call, skb, ac, rxgk_abort_2_decrypt_eproto);
 		goto error;
+	}
 	if (len < sizeof(hdr)) {
 		ret = rxrpc_abort_eproto(call, skb, RXGK_PACKETSHORT,

net/rxrpc/rxgk_app.c+20−9

 	_enter("");
+	if (ticket_len < 10 * sizeof(__be32))
+		return rxrpc_abort_conn(conn, skb, RXGK_INCONSISTENCY, -EPROTO,
+					rxgk_abort_resp_short_yfs_tkt);
 	/* Get the session key length */
 	ret = skb_copy_bits(skb, ticket_offset, tmp, sizeof(tmp));
 	if (ret < 0)
 	struct key *server_key;
 	unsigned int ticket_offset, ticket_len;
 	u32 kvno, enctype;
-	int ret, ec;
+	int ret, ec = 0;
 	struct {
 		__be32 kvno;
 		__be32 token_len;
 	} container;
+	if (token_len < sizeof(container))
+		goto short_packet;
 	/* Decode the RXGK_TokenContainer object.  This tells us which server
 	 * key we should be using.  We can then fetch the key, get the secret
 	 * and set up the crypto to extract the token.
 	 */
 	if (skb_copy_bits(skb, token_offset, &container, sizeof(container)) < 0)
-		return rxrpc_abort_conn(conn, skb, RXGK_PACKETSHORT, -EPROTO,
+		goto short_packet;
-					rxgk_abort_resp_tok_short);
 	kvno		= ntohl(container.kvno);
 	enctype		= ntohl(container.enctype);
 	ticket_len	= ntohl(container.token_len);
 	ticket_offset	= token_offset + sizeof(container);
-	if (xdr_round_up(ticket_len) > token_len - 3 * 4)
+	if (xdr_round_up(ticket_len) > token_len - sizeof(container))
-		return rxrpc_abort_conn(conn, skb, RXGK_PACKETSHORT, -EPROTO,
+		goto short_packet;
-					rxgk_abort_resp_tok_short);
 	_debug("KVNO %u", kvno);
 	_debug("ENC  %u", enctype);
 			       &ticket_offset, &ticket_len, &ec);
 	crypto_free_aead(token_enc);
 	token_enc = NULL;
-	if (ret < 0)
+	if (ret < 0) {
-		return rxrpc_abort_conn(conn, skb, ec, ret,
+		if (ret != -ENOMEM)
-					rxgk_abort_resp_tok_dec);
+			return rxrpc_abort_conn(conn, skb, ec, ret,
+						rxgk_abort_resp_tok_dec);
+	}
 	ret = conn->security->default_decode_ticket(conn, skb, ticket_offset,
 						    ticket_len, _key);
 	 * also come out this way if the ticket decryption fails.
 	 */
 	return ret;
+short_packet:
+	return rxrpc_abort_conn(conn, skb, RXGK_PACKETSHORT, -EPROTO,
+				rxgk_abort_resp_tok_short);
 }

net/rxrpc/rxgk_common.h+12−2

 		*_offset += offset;
 		*_len = len;
 		break;
+	case -EBADMSG: /* Checksum mismatch. */
 	case -EPROTO:
-	case -EBADMSG:
 		*_error_code = RXGK_SEALEDINCON;
 		break;
+	case -EMSGSIZE:
+		*_error_code = RXGK_PACKETSHORT;
+		break;
+	case -ENOPKG: /* Would prefer RXGK_BADETYPE, but not available for YFS. */
 	default:
+		*_error_code = RXGK_INCONSISTENCY;
 		break;
 	}
 		*_offset += offset;
 		*_len = len;
 		break;
+	case -EBADMSG: /* Checksum mismatch */
 	case -EPROTO:
-	case -EBADMSG:
 		*_error_code = RXGK_SEALEDINCON;
 		break;
+	case -EMSGSIZE:
+		*_error_code = RXGK_PACKETSHORT;
+		break;
+	case -ENOPKG: /* Would prefer RXGK_BADETYPE, but not available for YFS. */
 	default:
+		*_error_code = RXGK_INCONSISTENCY;
 		break;
 	}

net/tls/tls.h+1−0

@@ -141,6 +141,7 @@ void update_sk_prot(struct sock sk, struct tls_context ctx); · 140 unmodified lines
141		141
142	int wait_on_pending_writer(struct sock sk, long timeo);	142	int wait_on_pending_writer(struct sock sk, long timeo);
143	void tls_err_abort(struct sock *sk, int err);	143	void tls_err_abort(struct sock *sk, int err);
		144	void tls_strp_abort_strp(struct tls_strparser *strp, int err);
144		145
145	int init_prot_info(struct tls_prot_info *prot,	146	int init_prot_info(struct tls_prot_info *prot,
146	const struct tls_crypto_info *crypto_info,	147	const struct tls_crypto_info *crypto_info,

net/tls/tls_strp.c+9−5

 static struct workqueue_struct *tls_strp_wq;
-static void tls_strp_abort_strp(struct tls_strparser *strp, int err)
+void tls_strp_abort_strp(struct tls_strparser *strp, int err)
 {
 	if (strp->stopped)
 		return;
 				struct sk_buff *in_skb, unsigned int offset,
 				size_t in_len)
 {
+	unsigned int nfrag = skb->len / PAGE_SIZE;
 	size_t len, chunk;
 	skb_frag_t *frag;
 	int sz;
-	frag = &skb_shinfo(skb)->frags[skb->len / PAGE_SIZE];
+	if (unlikely(nfrag >= skb_shinfo(skb)->nr_frags)) {
+		DEBUG_NET_WARN_ON_ONCE(1);
+		return -EMSGSIZE;
+	}
+	frag = &skb_shinfo(skb)->frags[nfrag];
 	len = in_len;
 	/* First make sure we got the header */
 	tls_strp_load_anchor_with_queue(strp, inq);
 	if (!strp->stm.full_len) {
 		sz = tls_rx_msg_size(strp, strp->anchor);
-		if (sz < 0) {
+		if (sz < 0)
-			tls_strp_abort_strp(strp, sz);
 			return sz;
-		}
 		strp->stm.full_len = sz;

net/tls/tls_sw.c+1−2

@@ -2474,8 +2474,7 @@ int tls_rx_msg_size(struct tls_strparser strp, struct sk_buff skb) · 2473 unmodified lines
2474	return data_len + TLS_HEADER_SIZE;	2474	return data_len + TLS_HEADER_SIZE;
2475		2475
2476	read_failure:	2476	read_failure:
2477	tls_err_abort(strp->sk, ret);	2477	tls_strp_abort_strp(strp, ret);
2478
2479	return ret;	2478	return ret;
2480	}	2479	}
2481		2480

rust/kernel/device.rs+3−2

@@ -138,7 +138,9 @@ pub mod property; · 137 unmodified lines
138	/// }	138	/// }
139	/// ```	139	/// ```
140	///	140	///
141	/// An example for a class device implementation is [`drm::Device`].	141	/// An example for a class device implementation is
		142	#[cfg_attr(CONFIG_DRM = "y", doc = "[`drm::Device`](kernel::drm::Device).")]
		143	#[cfg_attr(not(CONFIG_DRM = "y"), doc = "`drm::Device`.")]
142	///	144	///
143	/// # Invariants	145	/// # Invariants
144	///	146	///
@@ -151,7 +153,6 @@ pub mod property; · 6 unmodified lines
151	/// dropped from any thread.	153	/// dropped from any thread.
152	///	154	///
153	/// [`AlwaysRefCounted`]: kernel::types::AlwaysRefCounted	155	/// [`AlwaysRefCounted`]: kernel::types::AlwaysRefCounted
154	/// [`drm::Device`]: kernel::drm::Device
155	/// [`impl_device_context_deref`]: kernel::impl_device_context_deref	156	/// [`impl_device_context_deref`]: kernel::impl_device_context_deref
156	/// [`pci::Device`]: kernel::pci::Device	157	/// [`pci::Device`]: kernel::pci::Device
157	/// [`platform::Device`]: kernel::platform::Device	158	/// [`platform::Device`]: kernel::platform::Device

samples/damon/mtier.c+3−0

@@ -208,6 +208,9 @@ static int damon_sample_mtier_enable_store( · 207 unmodified lines
208	if (enabled == is_enabled)	208	if (enabled == is_enabled)
209	return 0;	209	return 0;
210		210
		211	if (!init_called)
		212	return 0;
		213
211	if (enabled) {	214	if (enabled) {
212	err = damon_sample_mtier_start();	215	err = damon_sample_mtier_start();
213	if (err)	216	if (err)

samples/damon/prcl.c+3−0

@@ -137,6 +137,9 @@ static int damon_sample_prcl_enable_store( · 136 unmodified lines
137	if (enabled == is_enabled)	137	if (enabled == is_enabled)
138	return 0;	138	return 0;
139		139
		140	if (!init_called)
		141	return 0;
		142
140	if (enabled) {	143	if (enabled) {
141	err = damon_sample_prcl_start();	144	err = damon_sample_prcl_start();
142	if (err)	145	if (err)

samples/damon/wsse.c+3−0

@@ -118,6 +118,9 @@ static int damon_sample_wsse_enable_store( · 117 unmodified lines
118	return 0;	118	return 0;
119		119
120	if (enabled) {	120	if (enabled) {
		121	if (!init_called)
		122	return 0;
		123
121	err = damon_sample_wsse_start();	124	err = damon_sample_wsse_start();
122	if (err)	125	if (err)
123	enabled = false;	126	enabled = false;

tools/lib/subcmd/help.c+3−0

@@ -75,6 +75,9 @@ void exclude_cmds(struct cmdnames cmds, struct cmdnames excludes) · 74 unmodified lines
75	size_t ci, cj, ei;	75	size_t ci, cj, ei;
76	int cmp;	76	int cmp;
77		77
		78	if (!excludes->cnt)
		79	return;
		80
78	ci = cj = ei = 0;	81	ci = cj = ei = 0;
79	while (ci < cmds->cnt && ei < excludes->cnt) {	82	while (ci < cmds->cnt && ei < excludes->cnt) {
80	cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name);	83	cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name);

tools/perf/builtin-lock.c+6−1

 		.owner = show_lock_owner,
 		.cgroups = RB_ROOT,
 	};
+	struct perf_env host_env;
 	lockhash_table = calloc(LOCKHASH_SIZE, sizeof(*lockhash_table));
 	if (!lockhash_table)
 	eops.mmap		 = perf_event__process_mmap;
 	eops.tracing_data	 = perf_event__process_tracing_data;
-	session = perf_session__new(use_bpf ? NULL : &data, &eops);
+	perf_env__init(&host_env);
+	session = __perf_session__new(use_bpf ? NULL : &data, &eops,
+				/*trace_event_repipe=*/false, &host_env);
 	if (IS_ERR(session)) {
 		pr_err("Initializing perf session failed\n");
 		err = PTR_ERR(session);
 	evlist__delete(con.evlist);
 	lock_contention_finish(&con);
 	perf_session__delete(session);
+	perf_env__exit(&host_env);
 	zfree(&lockhash_table);
 	return err;
 }

tools/perf/util/maps.c+5−4

 	}
 	/* Insert the value at the end. */
 	maps_by_address[nr_maps] = map__get(new);
+	map__set_kmap_maps(new, maps);
 	if (maps_by_name)
 		maps_by_name[nr_maps] = map__get(new);
 	if (map__end(new) < map__start(new))
 		RC_CHK_ACCESS(maps)->ends_broken = true;
-	map__set_kmap_maps(new, maps);
 	return 0;
 }
 		if (before) {
 			map__put(maps_by_address[i]);
 			maps_by_address[i] = before;
+			map__set_kmap_maps(before, maps);
 			if (maps_by_name) {
 				map__put(maps_by_name[ni]);
 			 */
 			map__put(maps_by_address[i]);
 			maps_by_address[i] = map__get(new);
+			map__set_kmap_maps(new, maps);
 			if (maps_by_name) {
 				map__put(maps_by_name[ni]);
 				 */
 				map__put(maps_by_address[i]);
 				maps_by_address[i] = map__get(new);
+				map__set_kmap_maps(new, maps);
 				if (maps_by_name) {
 					map__put(maps_by_name[ni]);
 					maps_by_name[ni] = map__get(new);
 				}
-				map__set_kmap_maps(new, maps);
 				check_invariants(maps);
 				return err;
 			}
 				err = unwind__prepare_access(dest, new, NULL);
 				if (!err) {
 					dest_maps_by_address[i] = new;
+					map__set_kmap_maps(new, dest);
 					if (dest_maps_by_name)
 						dest_maps_by_name[i] = map__get(new);
 					RC_CHK_ACCESS(dest)->nr_maps = i + 1;

tools/testing/selftests/drivers/net/bonding/bond_options.sh+195−2

@@ -7,6 +7,8 @@ ALL_TESTS=" · 6 unmodified lines
7	prio	7	prio
8	arp_validate	8	arp_validate
9	num_grat_arp	9	num_grat_arp
		10	fail_over_mac
		11	vlan_over_bond
10	"	12	"
11		13
12	lib_dir=$(dirname "$0")	14	lib_dir=$(dirname "$0")
@@ -352,8 +354,8 @@ garp_test() · 339 unmodified lines
352		354
353	exp_num=$(echo "${param}" \| cut -f6 -d ' ')	355	exp_num=$(echo "${param}" \| cut -f6 -d ' ')
354	active_slave=$(cmd_jq "ip -n ${s_ns} -d -j link show bond0" ".[].linkinfo.info_data.active_slave")	356	active_slave=$(cmd_jq "ip -n ${s_ns} -d -j link show bond0" ".[].linkinfo.info_data.active_slave")
355	slowwait_for_counter $((exp_num + 5)) $exp_num \	357	slowwait_for_counter $((exp_num + 5)) $exp_num tc_rule_handle_stats_get \
356	tc_rule_handle_stats_get "dev s${active_slave#eth} ingress" 101 ".packets" "-n ${g_ns}"	358	"dev s${active_slave#eth} ingress" 101 ".packets" "-n ${g_ns}" &> /dev/null
357		359
358	# check result	360	# check result
359	real_num=$(tc_rule_handle_stats_get "dev s${active_slave#eth} ingress" 101 ".packets" "-n ${g_ns}")	361	real_num=$(tc_rule_handle_stats_get "dev s${active_slave#eth} ingress" 101 ".packets" "-n ${g_ns}")
@@ -376,6 +378,197 @@ num_grat_arp() · 16 unmodified lines
376	done	378	done
377	}	379	}
378		380
		381	check_all_mac_same()
		382	{
		383	RET=0
		384	# all slaves should have same mac address (with the first port's mac)
		385	local bond_mac=$(ip -n "$s_ns" -j link show bond0 \| jq -r '.[]["address"]')
		386	local eth0_mac=$(ip -n "$s_ns" -j link show eth0 \| jq -r '.[]["address"]')
		387	local eth1_mac=$(ip -n "$s_ns" -j link show eth1 \| jq -r '.[]["address"]')
		388	local eth2_mac=$(ip -n "$s_ns" -j link show eth2 \| jq -r '.[]["address"]')
		389	if [ "$bond_mac" != "${mac[0]}" ] \|\| [ "$eth0_mac" != "$bond_mac" ] \|\| \
		390	[ "$eth1_mac" != "$bond_mac" ] \|\| [ "$eth2_mac" != "$bond_mac" ]; then
		391	RET=1
		392	fi
		393	}
		394
		395	check_bond_mac_same_with_first()
		396	{
		397	RET=0
		398	# bond mac address should be same with the first added slave
		399	local bond_mac=$(ip -n "$s_ns" -j link show bond0 \| jq -r '.[]["address"]')
		400	if [ "$bond_mac" != "${mac[0]}" ]; then
		401	RET=1
		402	fi
		403	}
		404
		405	check_bond_mac_same_with_active()
		406	{
		407	RET=0
		408	# bond mac address should be same with active slave
		409	local bond_mac=$(ip -n "$s_ns" -j link show bond0 \| jq -r '.[]["address"]')
		410	local active_slave=$(cmd_jq "ip -n ${s_ns} -d -j link show bond0" ".[].linkinfo.info_data.active_slave")
		411	local active_slave_mac=$(ip -n "$s_ns" -j link show "$active_slave" \| jq -r '.[]["address"]')
		412	if [ "$bond_mac" != "$active_slave_mac" ]; then
		413	RET=1
		414	fi
		415	}
		416
		417	check_backup_slave_mac_not_change()
		418	{
		419	RET=0
		420	# backup slave's mac address is not changed
		421	if ip -n "$s_ns" -d -j link show type bond_slave \| jq -e '.[]
		422	\| select(.linkinfo.info_slave_data.state=="BACKUP")
		423	\| select(.address != .linkinfo.info_slave_data.perm_hwaddr)' &> /dev/null; then
		424	RET=1
		425	fi
		426	}
		427
		428	check_backup_slave_mac_inherit()
		429	{
		430	local backup_mac
		431	RET=0
		432
		433	# backup slaves should use mac[1] or mac[2]
		434	local backup_macs=$(ip -n "$s_ns" -d -j link show type bond_slave \| \
		435	jq -r '.[] \| select(.linkinfo.info_slave_data.state=="BACKUP") \| .address')
		436	for backup_mac in $backup_macs; do
		437	if [ "$backup_mac" != "${mac[1]}" ] && [ "$backup_mac" != "${mac[2]}" ]; then
		438	RET=1
		439	fi
		440	done
		441	}
		442
		443	check_first_slave_random_mac()
		444	{
		445	RET=0
		446	# remove the first added slave and added it back
		447	ip -n "$s_ns" link set eth0 nomaster
		448	ip -n "$s_ns" link set eth0 master bond0
		449
		450	# the first slave should use random mac address
		451	eth0_mac=$(ip -n "$s_ns" -j link show eth0 \| jq -r '.[]["address"]')
		452	[ "$eth0_mac" = "${mac[0]}" ] && RET=1
		453	log_test "bond fail_over_mac follow" "random first slave mac"
		454
		455	# remove the first slave, the permanent MAC address should be restored back
		456	ip -n "$s_ns" link set eth0 nomaster
		457	eth0_mac=$(ip -n "$s_ns" -j link show eth0 \| jq -r '.[]["address"]')
		458	[ "$eth0_mac" != "${mac[0]}" ] && RET=1
		459	}
		460
		461	do_active_backup_failover()
		462	{
		463	local active_slave=$(cmd_jq "ip -n ${s_ns} -d -j link show bond0" ".[].linkinfo.info_data.active_slave")
		464	ip -n ${s_ns} link set ${active_slave} down
		465	slowwait 2 active_slave_changed $active_slave
		466	ip -n ${s_ns} link set ${active_slave} up
		467	}
		468
		469	fail_over_mac()
		470	{
		471	# Bring down the first interface on the switch to force the bond to
		472	# select another active interface instead of the first one that joined.
		473	ip -n "$g_ns" link set s0 down
		474
		475	# fail_over_mac none
		476	bond_reset "mode active-backup miimon 100 fail_over_mac 0"
		477	check_all_mac_same
		478	log_test "fail_over_mac 0" "all slaves have same mac"
		479	do_active_backup_failover
		480	check_all_mac_same
		481	log_test "fail_over_mac 0" "failover: all slaves have same mac"
		482
		483	# fail_over_mac active
		484	bond_reset "mode active-backup miimon 100 fail_over_mac 1"
		485	check_bond_mac_same_with_active
		486	log_test "fail_over_mac 1" "bond mac is same with active slave mac"
		487	check_backup_slave_mac_not_change
		488	log_test "fail_over_mac 1" "backup slave mac is not changed"
		489	do_active_backup_failover
		490	check_bond_mac_same_with_active
		491	log_test "fail_over_mac 1" "failover: bond mac is same with active slave mac"
		492	check_backup_slave_mac_not_change
		493	log_test "fail_over_mac 1" "failover: backup slave mac is not changed"
		494
		495	# fail_over_mac follow
		496	bond_reset "mode active-backup miimon 100 fail_over_mac 2"
		497	check_bond_mac_same_with_first
		498	log_test "fail_over_mac 2" "bond mac is same with first slave mac"
		499	check_bond_mac_same_with_active
		500	log_test "fail_over_mac 2" "bond mac is same with active slave mac"
		501	check_backup_slave_mac_inherit
		502	log_test "fail_over_mac 2" "backup slave mac inherit"
		503	do_active_backup_failover
		504	check_bond_mac_same_with_first
		505	log_test "fail_over_mac 2" "failover: bond mac is same with first slave mac"
		506	check_bond_mac_same_with_active
		507	log_test "fail_over_mac 2" "failover: bond mac is same with active slave mac"
		508	check_backup_slave_mac_inherit
		509	log_test "fail_over_mac 2" "failover: backup slave mac inherit"
		510	check_first_slave_random_mac
		511	log_test "fail_over_mac 2" "first slave mac random"
		512	}
		513
		514	vlan_over_bond_arp()
		515	{
		516	local mode="$1"
		517	RET=0
		518
		519	bond_reset "mode $mode arp_interval 100 arp_ip_target 192.0.3.10"
		520	ip -n "${s_ns}" link add bond0.3 link bond0 type vlan id 3
		521	ip -n "${s_ns}" link set bond0.3 up
		522	ip -n "${s_ns}" addr add 192.0.3.1/24 dev bond0.3
		523	ip -n "${s_ns}" addr add 2001:db8::3:1/64 dev bond0.3
		524
		525	slowwait_for_counter 5 5 tc_rule_handle_stats_get \
		526	"dev eth0.3 ingress" 101 ".packets" "-n ${c_ns}" &> /dev/null \|\| RET=1
		527	log_test "vlan over bond arp" "$mode"
		528	}
		529
		530	vlan_over_bond_ns()
		531	{
		532	local mode="$1"
		533	RET=0
		534
		535	if skip_ns; then
		536	log_test_skip "vlan_over_bond ns" "$mode"
		537	return 0
		538	fi
		539
		540	bond_reset "mode $mode arp_interval 100 ns_ip6_target 2001:db8::3:10"
		541	ip -n "${s_ns}" link add bond0.3 link bond0 type vlan id 3
		542	ip -n "${s_ns}" link set bond0.3 up
		543	ip -n "${s_ns}" addr add 192.0.3.1/24 dev bond0.3
		544	ip -n "${s_ns}" addr add 2001:db8::3:1/64 dev bond0.3
		545
		546	slowwait_for_counter 5 5 tc_rule_handle_stats_get \
		547	"dev eth0.3 ingress" 102 ".packets" "-n ${c_ns}" &> /dev/null \|\| RET=1
		548	log_test "vlan over bond ns" "$mode"
		549	}
		550
		551	vlan_over_bond()
		552	{
		553	# add vlan 3 for client
		554	ip -n "${c_ns}" link add eth0.3 link eth0 type vlan id 3
		555	ip -n "${c_ns}" link set eth0.3 up
		556	ip -n "${c_ns}" addr add 192.0.3.10/24 dev eth0.3
		557	ip -n "${c_ns}" addr add 2001:db8::3:10/64 dev eth0.3
		558
		559	# Add tc rule to check the vlan pkts
		560	tc -n "${c_ns}" qdisc add dev eth0.3 clsact
		561	tc -n "${c_ns}" filter add dev eth0.3 ingress protocol arp \
		562	handle 101 flower skip_hw arp_op request \
		563	arp_sip 192.0.3.1 arp_tip 192.0.3.10 action pass
		564	tc -n "${c_ns}" filter add dev eth0.3 ingress protocol ipv6 \
		565	handle 102 flower skip_hw ip_proto icmpv6 \
		566	type 135 src_ip 2001:db8::3:1 action pass
		567
		568	vlan_over_bond_arp "active-backup"
		569	vlan_over_bond_ns "active-backup"
		570	}
		571
379	trap cleanup EXIT	572	trap cleanup EXIT
380		573
381	setup_prepare	574	setup_prepare

tools/testing/selftests/drivers/net/bonding/bond_topo_2d1c.sh+3−0

 s_ip6="2001:db8::1"
 c_ip6="2001:db8::10"
 g_ip6="2001:db8::254"
+mac[0]="00:0a:0b:0c:0d:01"
+mac[1]="00:0a:0b:0c:0d:02"
 gateway_create()
 {
 	for i in $(seq 0 1); do
 		ip -n ${s_ns} link add eth${i} type veth peer name s${i} netns ${g_ns}
+		ip -n "${s_ns}" link set "eth${i}" addr "${mac[$i]}"
 		ip -n ${g_ns} link set s${i} up
 		ip -n ${g_ns} link set s${i} master br0

tools/testing/selftests/drivers/net/bonding/bond_topo_3d1c.sh+2−0

 #  +-------------------------------------+
 source bond_topo_2d1c.sh
+mac[2]="00:0a:0b:0c:0d:03"
 setup_prepare()
 {
 	# Add the extra device as we use 3 down links for bond0
 	local i=2
 	ip -n ${s_ns} link add eth${i} type veth peer name s${i} netns ${g_ns}
+	ip -n "${s_ns}" link set "eth${i}" addr "${mac[$i]}"
 	ip -n ${g_ns} link set s${i} up
 	ip -n ${g_ns} link set s${i} master br0
 	ip -n ${s_ns} link set eth${i} master bond0

tools/testing/selftests/drivers/net/bonding/config+1−0

@@ -10,3 +10,4 @@ CONFIG_NET_CLS_MATCHALL=m · 9 unmodified lines
10	CONFIG_NET_SCH_INGRESS=y	10	CONFIG_NET_SCH_INGRESS=y
11	CONFIG_NLMON=y	11	CONFIG_NLMON=y
12	CONFIG_VETH=y	12	CONFIG_VETH=y
		13	CONFIG_VLAN_8021Q=m

tools/testing/selftests/net/mptcp/mptcp_connect.c+6−5

 	struct pollfd polls;
 	socklen_t salen;
 	int remotesock;
+	int err = 0;
 	int fd = 0;
 again:
 		SOCK_TEST_TCPULP(remotesock, 0);
 		memset(&winfo, 0, sizeof(winfo));
-		copyfd_io(fd, remotesock, 1, true, &winfo);
+		err = copyfd_io(fd, remotesock, 1, true, &winfo);
 	} else {
 		perror("accept");
 		return 1;
 	if (cfg_input)
 		close(fd);
-	if (--cfg_repeat > 0)
+	if (!err && --cfg_repeat > 0)
 		goto again;
-	return 0;
+	return err;
 }
 static void init_rng(void)
 	else
 		xerror("bad family");
-	strcpy(cmd, "ss -M | grep -q ");
+	strcpy(cmd, "ss -Mnt | grep -q ");
 	cmdlen = strlen(cmd);
 	if (!inet_ntop(addr.ss_family, raw_addr, &cmd[cmdlen],
 		       sizeof(cmd) - cmdlen))
 	/*
 	 * wait until the pending data is completely flushed and all
-	 * the MPTCP sockets reached the closed status.
+	 * the sockets reached the closed status.
 	 * disconnect will bypass/ignore/drop any pending data.
 	 */
 	for (i = 0; ; i += msec_sleep) {

tools/testing/selftests/net/mptcp/mptcp_connect.sh+5−1

 	done
 fi
+if $capture; then
+	rndh="${ns1:4}"
+	mptcp_lib_pr_info "Packet capture files will have this prefix: ${rndh}-"
+fi
 set_ethtool_flags() {
 	local ns="$1"
 	local dev="$2"
 	if $capture; then
 		local capuser
-		local rndh="${connector_ns:4}"
 		if [ -z $SUDO_USER ] ; then
 			capuser=""
 		else

tools/testing/selftests/net/mptcp/mptcp_lib.sh+1−1

@@ -384,7 +384,7 @@ mptcp_lib_make_file() { · 383 unmodified lines
384	mptcp_lib_print_file_err() {	384	mptcp_lib_print_file_err() {
385	ls -l "${1}" 1>&2	385	ls -l "${1}" 1>&2
386	echo "Trailing bytes are: "	386	echo "Trailing bytes are: "
387	tail -c 27 "${1}"	387	tail -c 32 "${1}" \| od -x \| head -n2
388	}	388	}
389		389
390	# $1: input file ; $2: output file ; $3: what kind of file	390	# $1: input file ; $2: output file ; $3: what kind of file

tools/testing/selftests/net/mptcp/mptcp_sockopt.c+10−6

 	do_getsockopts(&s, fd, ret, ret2);
 	if (s.mptcpi_rcv_delta != (uint64_t)ret + 1)
-		xerror("mptcpi_rcv_delta %" PRIu64 ", expect %" PRIu64, s.mptcpi_rcv_delta, ret + 1, s.mptcpi_rcv_delta - ret);
+		xerror("mptcpi_rcv_delta %" PRIu64 ", expect %" PRIu64 ", diff %" PRId64,
+		       s.mptcpi_rcv_delta, ret + 1, s.mptcpi_rcv_delta - (ret + 1));
 	/* be nice when running on top of older kernel */
 	if (s.pkt_stats_avail) {
 		if (s.last_sample.mptcpi_bytes_sent != ret2)
-			xerror("mptcpi_bytes_sent %" PRIu64 ", expect %" PRIu64,
+			xerror("mptcpi_bytes_sent %" PRIu64 ", expect %" PRIu64
+			       ", diff %" PRId64,
 			       s.last_sample.mptcpi_bytes_sent, ret2,
 			       s.last_sample.mptcpi_bytes_sent - ret2);
 		if (s.last_sample.mptcpi_bytes_received != ret)
-			xerror("mptcpi_bytes_received %" PRIu64 ", expect %" PRIu64,
+			xerror("mptcpi_bytes_received %" PRIu64 ", expect %" PRIu64
+			       ", diff %" PRId64,
 			       s.last_sample.mptcpi_bytes_received, ret,
 			       s.last_sample.mptcpi_bytes_received - ret);
 		if (s.last_sample.mptcpi_bytes_acked != ret)
-			xerror("mptcpi_bytes_acked %" PRIu64 ", expect %" PRIu64,
+			xerror("mptcpi_bytes_acked %" PRIu64 ", expect %" PRIu64
-			       s.last_sample.mptcpi_bytes_acked, ret2,
+			       ", diff %" PRId64,
-			       s.last_sample.mptcpi_bytes_acked - ret2);
+			       s.last_sample.mptcpi_bytes_acked, ret,
+			       s.last_sample.mptcpi_bytes_acked - ret);
 	}
 	close(fd);

tools/testing/selftests/net/mptcp/pm_nl_ctl.c+7−0

@@ -188,6 +188,13 @@ static int capture_events(int fd, int event_group) · 187 unmodified lines
188	fprintf(stderr, ",error:%u", (__u8 )RTA_DATA(attrs));	188	fprintf(stderr, ",error:%u", (__u8 )RTA_DATA(attrs));
189	else if (attrs->rta_type == MPTCP_ATTR_SERVER_SIDE)	189	else if (attrs->rta_type == MPTCP_ATTR_SERVER_SIDE)
190	fprintf(stderr, ",server_side:%u", (__u8 )RTA_DATA(attrs));	190	fprintf(stderr, ",server_side:%u", (__u8 )RTA_DATA(attrs));
		191	else if (attrs->rta_type == MPTCP_ATTR_FLAGS) {
		192	__u16 flags = (__u16 )RTA_DATA(attrs);
		193
		194	/* only print when present, easier */
		195	if (flags & MPTCP_PM_EV_FLAG_DENY_JOIN_ID0)
		196	fprintf(stderr, ",deny_join_id0:1");
		197	}
191		198
192	attrs = RTA_NEXT(attrs, msg_len);	199	attrs = RTA_NEXT(attrs, msg_len);
193	}	200	}

tools/testing/selftests/net/mptcp/userspace_pm.sh+11−3

 		is_v6="v4"
 	fi
+	# set this on the client side only: will not affect the rest
+	ip netns exec "$ns2" sysctl -q net.mptcp.allow_join_initial_addr_port=0
 	:>"$client_evts"
 	:>"$server_evts"
 	local client_token
 	local client_port
 	local client_serverside
+	local client_nojoin
 	local server_token
 	local server_serverside
+	local server_nojoin
 	client_token=$(mptcp_lib_evts_get_info token "$client_evts")
 	client_port=$(mptcp_lib_evts_get_info sport "$client_evts")
 	client_serverside=$(mptcp_lib_evts_get_info server_side "$client_evts")
+	client_nojoin=$(mptcp_lib_evts_get_info deny_join_id0 "$client_evts")
 	server_token=$(mptcp_lib_evts_get_info token "$server_evts")
 	server_serverside=$(mptcp_lib_evts_get_info server_side "$server_evts")
+	server_nojoin=$(mptcp_lib_evts_get_info deny_join_id0 "$server_evts")
 	print_test "Established IP${is_v6} MPTCP Connection ns2 => ns1"
-	if [ "$client_token" != "" ] && [ "$server_token" != "" ] && [ "$client_serverside" = 0 ] &&
+	if [ "${client_token}" != "" ] && [ "${server_token}" != "" ] &&
-		   [ "$server_serverside" = 1 ]
+	   [ "${client_serverside}" = 0 ] && [ "${server_serverside}" = 1 ] &&
+	   [ "${client_nojoin:-0}" = 0 ] && [ "${server_nojoin:-0}" = 1 ]
 	then
 		test_pass
 		print_title "Connection info: ${client_addr}:${client_port} -> ${connect_addr}:${app_port}"
 	else
-		test_fail "Expected tokens (c:${client_token} - s:${server_token}) and server (c:${client_serverside} - s:${server_serverside})"
+		test_fail "Expected tokens (c:${client_token} - s:${server_token}), server (c:${client_serverside} - s:${server_serverside}), nojoin (c:${client_nojoin} - s:${server_nojoin})"
 		mptcp_lib_result_print_all_tap
 		exit ${KSFT_FAIL}
 	fi

tools/testing/selftests/net/openvswitch/openvswitch.sh+81−7

@@ -25,6 +25,7 @@ tests=" · 24 unmodified lines
25	nat_related_v4 ip4-nat-related: ICMP related matches work with SNAT	25	nat_related_v4 ip4-nat-related: ICMP related matches work with SNAT
26	netlink_checks ovsnl: validate netlink attrs and settings	26	netlink_checks ovsnl: validate netlink attrs and settings
27	upcall_interfaces ovs: test the upcall interfaces	27	upcall_interfaces ovs: test the upcall interfaces
		28	tunnel_metadata ovs: test extraction of tunnel metadata
28	drop_reason drop: test drop reasons are emitted	29	drop_reason drop: test drop reasons are emitted
29	psample psample: Sampling packets with psample"	30	psample psample: Sampling packets with psample"
30		31
@@ -113,13 +114,13 @@ ovs_add_dp () { · 82 unmodified lines
113	}	114	}
114		115
115	ovs_add_if () {	116	ovs_add_if () {
116	info "Adding IF to DP: br:$2 if:$3"	117	info "Adding IF to DP: br:$3 if:$4 ($2)"
117	if [ "$4" != "-u" ]; then	118	if [ "$5" != "-u" ]; then
118	ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-if "$2" "$3" \	119	ovs_sbx "$1" python3 $ovs_base/ovs-dpctl.py add-if \
119	\|\| return 1	120	-t "$2" "$3" "$4" \|\| return 1
120	else	121	else
121	python3 $ovs_base/ovs-dpctl.py add-if \	122	python3 $ovs_base/ovs-dpctl.py add-if \
122	-u "$2" "$3" >$ovs_dir/$3.out 2>$ovs_dir/$3.err &	123	-u -t "$2" "$3" "$4" >$ovs_dir/$4.out 2>$ovs_dir/$4.err &
123	pid=$!	124	pid=$!
124	on_exit "ovs_sbx $1 kill -TERM $pid 2>/dev/null"	125	on_exit "ovs_sbx $1 kill -TERM $pid 2>/dev/null"
125	fi	126	fi
@@ -166,9 +167,9 @@ ovs_add_netns_and_veths () { · 40 unmodified lines
166	fi	167	fi
167		168
168	if [ "$7" != "-u" ]; then	169	if [ "$7" != "-u" ]; then
169	ovs_add_if "$1" "$2" "$4" \|\| return 1	170	ovs_add_if "$1" "netdev" "$2" "$4" \|\| return 1
170	else	171	else
171	ovs_add_if "$1" "$2" "$4" -u \|\| return 1	172	ovs_add_if "$1" "netdev" "$2" "$4" -u \|\| return 1
172	fi	173	fi
173		174
174	if [ $TRACING -eq 1 ]; then	175	if [ $TRACING -eq 1 ]; then
@@ -756,6 +757,79 @@ test_upcall_interfaces() { · 581 unmodified lines
756	return 0	757	return 0
757	}	758	}
758		759
		760	ovs_add_kernel_tunnel() {
		761	local sbxname=$1; shift
		762	local ns=$1; shift
		763	local tnl_type=$1; shift
		764	local name=$1; shift
		765	local addr=$1; shift
		766
		767	info "setting up kernel ${tnl_type} tunnel ${name}"
		768	ovs_sbx "${sbxname}" ip -netns ${ns} link add dev ${name} type ${tnl_type} $* \|\| return 1
		769	on_exit "ovs_sbx ${sbxname} ip -netns ${ns} link del ${name} >/dev/null 2>&1"
		770	ovs_sbx "${sbxname}" ip -netns ${ns} addr add dev ${name} ${addr} \|\| return 1
		771	ovs_sbx "${sbxname}" ip -netns ${ns} link set dev ${name} mtu 1450 up \|\| return 1
		772	}
		773
		774	test_tunnel_metadata() {
		775	which arping >/dev/null 2>&1 \|\| return $ksft_skip
		776
		777	sbxname="test_tunnel_metadata"
		778	sbx_add "${sbxname}" \|\| return 1
		779
		780	info "setting up new DP"
		781	ovs_add_dp "${sbxname}" tdp0 -V 2:1 \|\| return 1
		782
		783	ovs_add_netns_and_veths "${sbxname}" tdp0 tns left0 l0 \
		784	172.31.110.1/24 \|\| return 1
		785
		786	info "removing veth interface from openvswitch and setting IP"
		787	ovs_del_if "${sbxname}" tdp0 left0 \|\| return 1
		788	ovs_sbx "${sbxname}" ip addr add 172.31.110.2/24 dev left0 \|\| return 1
		789	ovs_sbx "${sbxname}" ip link set left0 up \|\| return 1
		790
		791	info "setting up tunnel port in openvswitch"
		792	ovs_add_if "${sbxname}" "vxlan" tdp0 ovs-vxlan0 -u \|\| return 1
		793	on_exit "ovs_sbx ${sbxname} ip link del ovs-vxlan0"
		794	ovs_wait ip link show ovs-vxlan0 &>/dev/null \|\| return 1
		795	ovs_sbx "${sbxname}" ip link set ovs-vxlan0 up \|\| return 1
		796
		797	configs=$(echo '
		798	1 172.31.221.1/24 1155332 32 set udpcsum flags$df\\|csum$
		799	2 172.31.222.1/24 1234567 45 set noudpcsum flags$df$
		800	3 172.31.223.1/24 1020304 23 unset udpcsum flags$csum$
		801	4 172.31.224.1/24 1357986 15 unset noudpcsum' \| sed '/^$/d')
		802
		803	while read -r i addr id ttl df csum flags; do
		804	ovs_add_kernel_tunnel "${sbxname}" tns vxlan vxlan${i} ${addr} \
		805	remote 172.31.110.2 id ${id} dstport 4789 \
		806	ttl ${ttl} df ${df} ${csum} \|\| return 1
		807	done <<< "${configs}"
		808
		809	ovs_wait grep -q 'listening on upcall packet handler' \
		810	${ovs_dir}/ovs-vxlan0.out \|\| return 1
		811
		812	info "sending arping"
		813	for i in 1 2 3 4; do
		814	ovs_sbx "${sbxname}" ip netns exec tns \
		815	arping -I vxlan${i} 172.31.22${i}.2 -c 1 \
		816	>${ovs_dir}/arping.stdout 2>${ovs_dir}/arping.stderr
		817	done
		818
		819	info "checking that received decapsulated packets carry correct metadata"
		820	while read -r i addr id ttl df csum flags; do
		821	arp_hdr="arp\\(sip=172.31.22${i}.1,tip=172.31.22${i}.2,op=1,sha="
		822	addrs="src=172.31.110.1,dst=172.31.110.2"
		823	ports="tp_src=[0-9]*,tp_dst=4789"
		824	tnl_md="tunnel\$tun_id=${id},${addrs},ttl=${ttl},${ports},${flags}\$"
		825
		826	ovs_sbx "${sbxname}" grep -qE "MISS upcall.${tnl_md}.${arp_hdr}" \
		827	${ovs_dir}/ovs-vxlan0.out \|\| return 1
		828	done <<< "${configs}"
		829
		830	return 0
		831	}
		832
759	run_test() {	833	run_test() {
760	(	834	(
761	tname="$1"	835	tname="$1"

tools/testing/selftests/net/packetdrill/tcp_fastopen_server_reset-after-disconnect.pkt+26−0

@@ -0,0 +1,26 @@
	1	// SPDX-License-Identifier: GPL-2.0
	2	`./defaults.sh
	3	./set_sysctls.py /proc/sys/net/ipv4/tcp_fastopen=0x602 /proc/sys/net/ipv4/tcp_timestamps=0`
	4
	5	0 socket(..., SOCK_STREAM\|SOCK_NONBLOCK, IPPROTO_TCP) = 3
	6	+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
	7	+0 bind(3, ..., ...) = 0
	8	+0 listen(3, 1) = 0
	9
	10	+0 < S 0:10(10) win 32792 <mss 1460,nop,nop,sackOK>
	11	+0 > S. 0:0(0) ack 11 win 65535 <mss 1460,nop,nop,sackOK>
	12
	13	// sk->sk_state is TCP_SYN_RECV
	14	+.1 accept(3, ..., ...) = 4
	15
	16	// tcp_disconnect() sets sk->sk_state to TCP_CLOSE
	17	+0 connect(4, AF_UNSPEC, ...) = 0
	18	+0 > R. 1:1(0) ack 11 win 65535
	19
	20	// connect() sets sk->sk_state to TCP_SYN_SENT
	21	+0 fcntl(4, F_SETFL, O_RDWR\|O_NONBLOCK) = 0
	22	+0 connect(4, ..., ...) = -1 EINPROGRESS (Operation is now in progress)
	23	+0 > S 0:0(0) win 65535 <mss 1460,nop,nop,sackOK,nop,wscale 8>
	24
	25	// tp->fastopen_rsk must be NULL
	26	+1 > S 0:0(0) win 65535 <mss 1460,nop,nop,sackOK,nop,wscale 8>

tools/testing/selftests/net/tls.c+16−0

@@ -2775,6 +2775,22 @@ TEST_F(tls_err, poll_partial_rec_async) · 2774 unmodified lines
2775	}	2775	}
2776	}	2776	}
2777		2777
		2778	/* Use OOB+large send to trigger copy mode due to memory pressure.
		2779	* OOB causes a short read.
		2780	*/
		2781	TEST_F(tls_err, oob_pressure)
		2782	{
		2783	char buf[1<<16];
		2784	int i;
		2785
		2786	memrnd(buf, sizeof(buf));
		2787
		2788	EXPECT_EQ(send(self->fd2, buf, 5, MSG_OOB), 5);
		2789	EXPECT_EQ(send(self->fd2, buf, sizeof(buf), 0), sizeof(buf));
		2790	for (i = 0; i < 64; i++)
		2791	EXPECT_EQ(send(self->fd2, buf, 5, MSG_OOB), 5);
		2792	}
		2793
2778	TEST(non_established) {	2794	TEST(non_established) {
2779	struct tls12_crypto_info_aes_gcm_256 tls12;	2795	struct tls12_crypto_info_aes_gcm_256 tls12;
2780	struct sockaddr_in addr;	2796	struct sockaddr_in addr;