···586586 /sys/devices/system/cpu/vulnerabilities/srbds587587 /sys/devices/system/cpu/vulnerabilities/tsa588588 /sys/devices/system/cpu/vulnerabilities/tsx_async_abort589589+ /sys/devices/system/cpu/vulnerabilities/vmscape589590Date: January 2018590591Contact: Linux kernel mailing list <linux-kernel@vger.kernel.org>591592Description: Information about CPU vulnerabilities
···11+.. SPDX-License-Identifier: GPL-2.022+33+VMSCAPE44+=======55+66+VMSCAPE is a vulnerability that may allow a guest to influence the branch77+prediction in host userspace. It particularly affects hypervisors like QEMU.88+99+Even if a hypervisor may not have any sensitive data like disk encryption keys,1010+guest-userspace may be able to attack the guest-kernel using the hypervisor as1111+a confused deputy.1212+1313+Affected processors1414+-------------------1515+1616+The following CPU families are affected by VMSCAPE:1717+1818+**Intel processors:**1919+ - Skylake generation (Parts without Enhanced-IBRS)2020+ - Cascade Lake generation - (Parts affected by ITS guest/host separation)2121+ - Alder Lake and newer (Parts affected by BHI)2222+2323+Note that, BHI affected parts that use BHB clearing software mitigation e.g.2424+Icelake are not vulnerable to VMSCAPE.2525+2626+**AMD processors:**2727+ - Zen series (families 0x17, 0x19, 0x1a)2828+2929+** Hygon processors:**3030+ - Family 0x183131+3232+Mitigation3333+----------3434+3535+Conditional IBPB3636+----------------3737+3838+Kernel tracks when a CPU has run a potentially malicious guest and issues an3939+IBPB before the first exit to userspace after VM-exit. If userspace did not run4040+between VM-exit and the next VM-entry, no IBPB is issued.4141+4242+Note that the existing userspace mitigation against Spectre-v2 is effective in4343+protecting the userspace. They are insufficient to protect the userspace VMMs4444+from a malicious guest. This is because Spectre-v2 mitigations are applied at4545+context switch time, while the userspace VMM can run after a VM-exit without a4646+context switch.4747+4848+Vulnerability enumeration and mitigation is not applied inside a guest. This is4949+because nested hypervisors should already be deploying IBPB to isolate5050+themselves from nested guests.5151+5252+SMT considerations5353+------------------5454+5555+When Simultaneous Multi-Threading (SMT) is enabled, hypervisors can be5656+vulnerable to cross-thread attacks. For complete protection against VMSCAPE5757+attacks in SMT environments, STIBP should be enabled.5858+5959+The kernel will issue a warning if SMT is enabled without adequate STIBP6060+protection. Warning is not issued when:6161+6262+- SMT is disabled6363+- STIBP is enabled system-wide6464+- Intel eIBRS is enabled (which implies STIBP protection)6565+6666+System information and options6767+------------------------------6868+6969+The sysfs file showing VMSCAPE mitigation status is:7070+7171+ /sys/devices/system/cpu/vulnerabilities/vmscape7272+7373+The possible values in this file are:7474+7575+ * 'Not affected':7676+7777+ The processor is not vulnerable to VMSCAPE attacks.7878+7979+ * 'Vulnerable':8080+8181+ The processor is vulnerable and no mitigation has been applied.8282+8383+ * 'Mitigation: IBPB before exit to userspace':8484+8585+ Conditional IBPB mitigation is enabled. The kernel tracks when a CPU has8686+ run a potentially malicious guest and issues an IBPB before the first8787+ exit to userspace after VM-exit.8888+8989+ * 'Mitigation: IBPB on VMEXIT':9090+9191+ IBPB is issued on every VM-exit. This occurs when other mitigations like9292+ RETBLEED or SRSO are already issuing IBPB on VM-exit.9393+9494+Mitigation control on the kernel command line9595+----------------------------------------------9696+9797+The mitigation can be controlled via the ``vmscape=`` command line parameter:9898+9999+ * ``vmscape=off``:100100+101101+ Disable the VMSCAPE mitigation.102102+103103+ * ``vmscape=ibpb``:104104+105105+ Enable conditional IBPB mitigation (default when CONFIG_MITIGATION_VMSCAPE=y).106106+107107+ * ``vmscape=force``:108108+109109+ Force vulnerability detection and mitigation even on processors that are110110+ not known to be affected.
+11
Documentation/admin-guide/kernel-parameters.txt
···38293829 srbds=off [X86,INTEL]38303830 ssbd=force-off [ARM64]38313831 tsx_async_abort=off [X86]38323832+ vmscape=off [X86]3832383338333834 Exceptions:38343835 This does not have any effect on···8041804080428041 vmpoff= [KNL,S390] Perform z/VM CP command after power off.80438042 Format: <command>80438043+80448044+ vmscape= [X86] Controls mitigation for VMscape attacks.80458045+ VMscape attacks can leak information from a userspace80468046+ hypervisor to a guest via speculative side-channels.80478047+80488048+ off - disable the mitigation80498049+ ibpb - use Indirect Branch Prediction Barrier80508050+ (IBPB) mitigation (default)80518051+ force - force vulnerability detection even on80528052+ unaffected processors8044805380458054 vsyscall= [X86-64,EARLY]80468055 Controls the behavior of vsyscalls (i.e. calls to
···742742 struct timeval ival1, ival2; /* count and subsequent interval */743743 canid_t can_id; /* unique can_id for task */744744 __u32 nframes; /* number of can_frames following */745745- struct can_frame frames[0];745745+ struct can_frame frames[];746746 };747747748748The aligned payload 'frames' uses the same basic CAN frame structure defined
+4-4
Documentation/networking/mptcp.rst
···6060and the server side that announces additional addresses via the ``ADD_ADDR`` and6161``REMOVE_ADDR`` options.62626363-Path managers are controlled by the ``net.mptcp.pm_type`` sysctl knob -- see6464-mptcp-sysctl.rst. There are two types: the in-kernel one (type ``0``) where the6565-same rules are applied for all the connections (see: ``ip mptcp``) ; and the6666-userspace one (type ``1``), controlled by a userspace daemon (i.e. `mptcpd6363+Path managers are controlled by the ``net.mptcp.path_manager`` sysctl knob --6464+see mptcp-sysctl.rst. There are two types: the in-kernel one (``kernel``) where6565+the same rules are applied for all the connections (see: ``ip mptcp``) ; and the6666+userspace one (``userspace``), controlled by a userspace daemon (i.e. `mptcpd6767<https://mptcpd.mptcp.dev/>`_) where different rules can be applied for each6868connection. The path managers can be controlled via a Netlink API; see6969netlink_spec/mptcp_pm.rst.
+15-13
MAINTAINERS
···46934693BPF [SELFTESTS] (Test Runners & Infrastructure)46944694M: Andrii Nakryiko <andrii@kernel.org>46954695M: Eduard Zingerman <eddyz87@gmail.com>46964696-R: Mykola Lysenko <mykolal@fb.com>46974696L: bpf@vger.kernel.org46984697S: Maintained46994698F: tools/testing/selftests/bpf/···5268526952695270BTRFS FILE SYSTEM52705271M: Chris Mason <clm@fb.com>52715271-M: Josef Bacik <josef@toxicpanda.com>52725272M: David Sterba <dsterba@suse.com>52735273L: linux-btrfs@vger.kernel.org52745274S: Maintained···72487250F: kernel/dma/7249725172507252DMA MAPPING HELPERS DEVICE DRIVER API [RUST]72517251-M: Abdiel Janulgue <abdiel.janulgue@gmail.com>72527253M: Danilo Krummrich <dakr@kernel.org>72547254+R: Abdiel Janulgue <abdiel.janulgue@gmail.com>72537255R: Daniel Almeida <daniel.almeida@collabora.com>72547256R: Robin Murphy <robin.murphy@arm.com>72557257R: Andreas Hindborg <a.hindborg@kernel.org>72567258L: rust-for-linux@vger.kernel.org72577259S: Supported72587260W: https://rust-for-linux.com72597259-T: git https://github.com/Rust-for-Linux/linux.git alloc-next72617261+T: git git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core.git72607262F: rust/helpers/dma.c72617263F: rust/kernel/dma.rs72627264F: samples/rust/rust_dma.rs···80888090F: Documentation/gpu/80898091F: drivers/gpu/drm/80908092F: drivers/gpu/vga/80918091-F: rust/kernel/drm/80928093F: include/drm/drm80938094F: include/linux/vga*80948095F: include/uapi/drm/···80998102X: drivers/gpu/drm/kmb/81008103X: drivers/gpu/drm/mediatek/81018104X: drivers/gpu/drm/msm/81028102-X: drivers/gpu/drm/nouveau/81058105+X: drivers/gpu/drm/nova/81038106X: drivers/gpu/drm/radeon/81048107X: drivers/gpu/drm/tegra/81058108X: drivers/gpu/drm/xe/81098109+81108110+DRM DRIVERS AND COMMON INFRASTRUCTURE [RUST]81118111+M: Danilo Krummrich <dakr@kernel.org>81128112+M: Alice Ryhl <aliceryhl@google.com>81138113+S: Supported81148114+W: https://drm.pages.freedesktop.org/maintainer-tools/drm-rust.html81158115+T: git https://gitlab.freedesktop.org/drm/rust/kernel.git81168116+F: drivers/gpu/drm/nova/81178117+F: drivers/gpu/nova-core/81188118+F: rust/kernel/drm/8106811981078120DRM DRIVERS FOR ALLWINNER A1081088121M: Maxime Ripard <mripard@kernel.org>···1575815751W: http://www.melexis.com1575915752F: drivers/iio/temperature/mlx90635.c15760157531576115761-MELFAS MIP4 TOUCHSCREEN DRIVER1576215762-M: Sangwon Jee <jeesw@melfas.com>1576315763-S: Supported1576415764-W: http://www.melfas.com1576515765-F: Documentation/devicetree/bindings/input/touchscreen/melfas_mip4.txt1576615766-F: drivers/input/touchscreen/melfas_mip4.c1576715767-1576815754MELLANOX BLUEFIELD I2C DRIVER1576915755M: Khalil Blaiech <kblaiech@nvidia.com>1577015756M: Asmaa Mnebhi <asmaa@nvidia.com>···1613816138M: Mike Rapoport <rppt@kernel.org>1613916139L: linux-mm@kvack.org1614016140S: Maintained1614116141+T: git git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock.git1614116142F: include/linux/numa_memblks.h1614216143F: mm/numa.c1614316144F: mm/numa_emulation.c···1749117490M: Pablo Neira Ayuso <pablo@netfilter.org>1749217491M: Jozsef Kadlecsik <kadlec@netfilter.org>1749317492M: Florian Westphal <fw@strlen.de>1749317493+R: Phil Sutter <phil@nwl.cc>1749417494L: netfilter-devel@vger.kernel.org1749517495L: coreteam@netfilter.org1749617496S: Maintained
···129129static int kexec_file_add_purgatory(struct kimage *image,130130 struct s390_load_data *data)131131{132132- struct kexec_buf buf;132132+ struct kexec_buf buf = {};133133 int ret;134134135135 buf.image = image;···152152static int kexec_file_add_initrd(struct kimage *image,153153 struct s390_load_data *data)154154{155155- struct kexec_buf buf;155155+ struct kexec_buf buf = {};156156 int ret;157157158158 buf.image = image;···184184{185185 __u32 *lc_ipl_parmblock_ptr;186186 unsigned int len, ncerts;187187- struct kexec_buf buf;187187+ struct kexec_buf buf = {};188188 unsigned long addr;189189 void *ptr, *end;190190 int ret;
+2-2
arch/s390/kernel/perf_cpum_cf.c
···760760 break;761761762762 case PERF_TYPE_HARDWARE:763763- if (is_sampling_event(event)) /* No sampling support */764764- return -ENOENT;765763 ev = attr->config;766764 if (!attr->exclude_user && attr->exclude_kernel) {767765 /*···857859 unsigned int type = event->attr.type;858860 int err = -ENOENT;859861862862+ if (is_sampling_event(event)) /* No sampling support */863863+ return err;860864 if (type == PERF_TYPE_HARDWARE || type == PERF_TYPE_RAW)861865 err = __hw_perf_event_init(event, type);862866 else if (event->pmu->type == type)
+2-2
arch/s390/kernel/perf_pai_crypto.c
···285285 /* PAI crypto PMU registered as PERF_TYPE_RAW, check event type */286286 if (a->type != PERF_TYPE_RAW && event->pmu->type != a->type)287287 return -ENOENT;288288- /* PAI crypto event must be in valid range */288288+ /* PAI crypto event must be in valid range, try others if not */289289 if (a->config < PAI_CRYPTO_BASE ||290290 a->config > PAI_CRYPTO_BASE + paicrypt_cnt)291291- return -EINVAL;291291+ return -ENOENT;292292 /* Allow only CRYPTO_ALL for sampling */293293 if (a->sample_period && a->config != PAI_CRYPTO_BASE)294294 return -EINVAL;
+1-1
arch/s390/kernel/perf_pai_ext.c
···265265 event->hw.config_base = offsetof(struct paiext_cb, acc);266266 return 0;267267 }268268- return -EINVAL;268268+ return -ENOENT;269269}270270271271/* Might be called on different CPU than the one the event is intended for. */
···27012701 security vulnerability on AMD CPUs which can lead to forwarding of27022702 invalid info to subsequent instructions and thus can affect their27032703 timing and thereby cause a leakage.27042704+27052705+config MITIGATION_VMSCAPE27062706+ bool "Mitigate VMSCAPE"27072707+ depends on KVM27082708+ default y27092709+ help27102710+ Enable mitigation for VMSCAPE attacks. VMSCAPE is a hardware security27112711+ vulnerability on Intel and AMD CPUs that may allow a guest to do27122712+ Spectre v2 style attacks on userspace hypervisor.27042713endif2705271427062715config ARCH_HAS_ADD_PAGES
+2
arch/x86/include/asm/cpufeatures.h
···495495#define X86_FEATURE_TSA_SQ_NO (21*32+11) /* AMD CPU not vulnerable to TSA-SQ */496496#define X86_FEATURE_TSA_L1_NO (21*32+12) /* AMD CPU not vulnerable to TSA-L1 */497497#define X86_FEATURE_CLEAR_CPU_BUF_VM (21*32+13) /* Clear CPU buffers using VERW before VMRUN */498498+#define X86_FEATURE_IBPB_EXIT_TO_USER (21*32+14) /* Use IBPB on exit-to-userspace, see VMSCAPE bug */498499499500/*500501 * BUG word(s)···552551#define X86_BUG_ITS X86_BUG( 1*32+ 7) /* "its" CPU is affected by Indirect Target Selection */553552#define X86_BUG_ITS_NATIVE_ONLY X86_BUG( 1*32+ 8) /* "its_native_only" CPU is affected by ITS, VMX is not affected */554553#define X86_BUG_TSA X86_BUG( 1*32+ 9) /* "tsa" CPU is affected by Transient Scheduler Attacks */554554+#define X86_BUG_VMSCAPE X86_BUG( 1*32+10) /* "vmscape" CPU is affected by VMSCAPE attacks from guests */555555#endif /* _ASM_X86_CPUFEATURES_H */
···9696static void __init its_apply_mitigation(void);9797static void __init tsa_select_mitigation(void);9898static void __init tsa_apply_mitigation(void);9999+static void __init vmscape_select_mitigation(void);100100+static void __init vmscape_update_mitigation(void);101101+static void __init vmscape_apply_mitigation(void);99102100103/* The base value of the SPEC_CTRL MSR without task-specific bits set */101104u64 x86_spec_ctrl_base;···107104/* The current value of the SPEC_CTRL MSR with task-specific bits set */108105DEFINE_PER_CPU(u64, x86_spec_ctrl_current);109106EXPORT_PER_CPU_SYMBOL_GPL(x86_spec_ctrl_current);107107+108108+/*109109+ * Set when the CPU has run a potentially malicious guest. An IBPB will110110+ * be needed to before running userspace. That IBPB will flush the branch111111+ * predictor content.112112+ */113113+DEFINE_PER_CPU(bool, x86_ibpb_exit_to_user);114114+EXPORT_PER_CPU_SYMBOL_GPL(x86_ibpb_exit_to_user);110115111116u64 x86_pred_cmd __ro_after_init = PRED_CMD_IBPB;112117···273262 its_select_mitigation();274263 bhi_select_mitigation();275264 tsa_select_mitigation();265265+ vmscape_select_mitigation();276266277267 /*278268 * After mitigations are selected, some may need to update their···305293 bhi_update_mitigation();306294 /* srso_update_mitigation() depends on retbleed_update_mitigation(). */307295 srso_update_mitigation();296296+ vmscape_update_mitigation();308297309298 spectre_v1_apply_mitigation();310299 spectre_v2_apply_mitigation();···323310 its_apply_mitigation();324311 bhi_apply_mitigation();325312 tsa_apply_mitigation();313313+ vmscape_apply_mitigation();326314}327315328316/*···25522538 }25532539}2554254025552555-#define MDS_MSG_SMT "MDS CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details.\n"25562556-#define TAA_MSG_SMT "TAA CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html for more details.\n"25572557-#define MMIO_MSG_SMT "MMIO Stale Data CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html for more details.\n"25582558-25592559-void cpu_bugs_smt_update(void)25602560-{25612561- mutex_lock(&spec_ctrl_mutex);25622562-25632563- if (sched_smt_active() && unprivileged_ebpf_enabled() &&25642564- spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE)25652565- pr_warn_once(SPECTRE_V2_EIBRS_LFENCE_EBPF_SMT_MSG);25662566-25672567- switch (spectre_v2_user_stibp) {25682568- case SPECTRE_V2_USER_NONE:25692569- break;25702570- case SPECTRE_V2_USER_STRICT:25712571- case SPECTRE_V2_USER_STRICT_PREFERRED:25722572- update_stibp_strict();25732573- break;25742574- case SPECTRE_V2_USER_PRCTL:25752575- case SPECTRE_V2_USER_SECCOMP:25762576- update_indir_branch_cond();25772577- break;25782578- }25792579-25802580- switch (mds_mitigation) {25812581- case MDS_MITIGATION_FULL:25822582- case MDS_MITIGATION_AUTO:25832583- case MDS_MITIGATION_VMWERV:25842584- if (sched_smt_active() && !boot_cpu_has(X86_BUG_MSBDS_ONLY))25852585- pr_warn_once(MDS_MSG_SMT);25862586- update_mds_branch_idle();25872587- break;25882588- case MDS_MITIGATION_OFF:25892589- break;25902590- }25912591-25922592- switch (taa_mitigation) {25932593- case TAA_MITIGATION_VERW:25942594- case TAA_MITIGATION_AUTO:25952595- case TAA_MITIGATION_UCODE_NEEDED:25962596- if (sched_smt_active())25972597- pr_warn_once(TAA_MSG_SMT);25982598- break;25992599- case TAA_MITIGATION_TSX_DISABLED:26002600- case TAA_MITIGATION_OFF:26012601- break;26022602- }26032603-26042604- switch (mmio_mitigation) {26052605- case MMIO_MITIGATION_VERW:26062606- case MMIO_MITIGATION_AUTO:26072607- case MMIO_MITIGATION_UCODE_NEEDED:26082608- if (sched_smt_active())26092609- pr_warn_once(MMIO_MSG_SMT);26102610- break;26112611- case MMIO_MITIGATION_OFF:26122612- break;26132613- }26142614-26152615- switch (tsa_mitigation) {26162616- case TSA_MITIGATION_USER_KERNEL:26172617- case TSA_MITIGATION_VM:26182618- case TSA_MITIGATION_AUTO:26192619- case TSA_MITIGATION_FULL:26202620- /*26212621- * TSA-SQ can potentially lead to info leakage between26222622- * SMT threads.26232623- */26242624- if (sched_smt_active())26252625- static_branch_enable(&cpu_buf_idle_clear);26262626- else26272627- static_branch_disable(&cpu_buf_idle_clear);26282628- break;26292629- case TSA_MITIGATION_NONE:26302630- case TSA_MITIGATION_UCODE_NEEDED:26312631- break;26322632- }26332633-26342634- mutex_unlock(&spec_ctrl_mutex);26352635-}26362636-26372541#undef pr_fmt26382542#define pr_fmt(fmt) "Speculative Store Bypass: " fmt26392543···32633331}3264333232653333#undef pr_fmt33343334+#define pr_fmt(fmt) "VMSCAPE: " fmt33353335+33363336+enum vmscape_mitigations {33373337+ VMSCAPE_MITIGATION_NONE,33383338+ VMSCAPE_MITIGATION_AUTO,33393339+ VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER,33403340+ VMSCAPE_MITIGATION_IBPB_ON_VMEXIT,33413341+};33423342+33433343+static const char * const vmscape_strings[] = {33443344+ [VMSCAPE_MITIGATION_NONE] = "Vulnerable",33453345+ /* [VMSCAPE_MITIGATION_AUTO] */33463346+ [VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER] = "Mitigation: IBPB before exit to userspace",33473347+ [VMSCAPE_MITIGATION_IBPB_ON_VMEXIT] = "Mitigation: IBPB on VMEXIT",33483348+};33493349+33503350+static enum vmscape_mitigations vmscape_mitigation __ro_after_init =33513351+ IS_ENABLED(CONFIG_MITIGATION_VMSCAPE) ? VMSCAPE_MITIGATION_AUTO : VMSCAPE_MITIGATION_NONE;33523352+33533353+static int __init vmscape_parse_cmdline(char *str)33543354+{33553355+ if (!str)33563356+ return -EINVAL;33573357+33583358+ if (!strcmp(str, "off")) {33593359+ vmscape_mitigation = VMSCAPE_MITIGATION_NONE;33603360+ } else if (!strcmp(str, "ibpb")) {33613361+ vmscape_mitigation = VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER;33623362+ } else if (!strcmp(str, "force")) {33633363+ setup_force_cpu_bug(X86_BUG_VMSCAPE);33643364+ vmscape_mitigation = VMSCAPE_MITIGATION_AUTO;33653365+ } else {33663366+ pr_err("Ignoring unknown vmscape=%s option.\n", str);33673367+ }33683368+33693369+ return 0;33703370+}33713371+early_param("vmscape", vmscape_parse_cmdline);33723372+33733373+static void __init vmscape_select_mitigation(void)33743374+{33753375+ if (cpu_mitigations_off() ||33763376+ !boot_cpu_has_bug(X86_BUG_VMSCAPE) ||33773377+ !boot_cpu_has(X86_FEATURE_IBPB)) {33783378+ vmscape_mitigation = VMSCAPE_MITIGATION_NONE;33793379+ return;33803380+ }33813381+33823382+ if (vmscape_mitigation == VMSCAPE_MITIGATION_AUTO)33833383+ vmscape_mitigation = VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER;33843384+}33853385+33863386+static void __init vmscape_update_mitigation(void)33873387+{33883388+ if (!boot_cpu_has_bug(X86_BUG_VMSCAPE))33893389+ return;33903390+33913391+ if (retbleed_mitigation == RETBLEED_MITIGATION_IBPB ||33923392+ srso_mitigation == SRSO_MITIGATION_IBPB_ON_VMEXIT)33933393+ vmscape_mitigation = VMSCAPE_MITIGATION_IBPB_ON_VMEXIT;33943394+33953395+ pr_info("%s\n", vmscape_strings[vmscape_mitigation]);33963396+}33973397+33983398+static void __init vmscape_apply_mitigation(void)33993399+{34003400+ if (vmscape_mitigation == VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER)34013401+ setup_force_cpu_cap(X86_FEATURE_IBPB_EXIT_TO_USER);34023402+}34033403+34043404+#undef pr_fmt32663405#define pr_fmt(fmt) fmt34063406+34073407+#define MDS_MSG_SMT "MDS CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more details.\n"34083408+#define TAA_MSG_SMT "TAA CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html for more details.\n"34093409+#define MMIO_MSG_SMT "MMIO Stale Data CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html for more details.\n"34103410+#define VMSCAPE_MSG_SMT "VMSCAPE: SMT on, STIBP is required for full protection. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/vmscape.html for more details.\n"34113411+34123412+void cpu_bugs_smt_update(void)34133413+{34143414+ mutex_lock(&spec_ctrl_mutex);34153415+34163416+ if (sched_smt_active() && unprivileged_ebpf_enabled() &&34173417+ spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE)34183418+ pr_warn_once(SPECTRE_V2_EIBRS_LFENCE_EBPF_SMT_MSG);34193419+34203420+ switch (spectre_v2_user_stibp) {34213421+ case SPECTRE_V2_USER_NONE:34223422+ break;34233423+ case SPECTRE_V2_USER_STRICT:34243424+ case SPECTRE_V2_USER_STRICT_PREFERRED:34253425+ update_stibp_strict();34263426+ break;34273427+ case SPECTRE_V2_USER_PRCTL:34283428+ case SPECTRE_V2_USER_SECCOMP:34293429+ update_indir_branch_cond();34303430+ break;34313431+ }34323432+34333433+ switch (mds_mitigation) {34343434+ case MDS_MITIGATION_FULL:34353435+ case MDS_MITIGATION_AUTO:34363436+ case MDS_MITIGATION_VMWERV:34373437+ if (sched_smt_active() && !boot_cpu_has(X86_BUG_MSBDS_ONLY))34383438+ pr_warn_once(MDS_MSG_SMT);34393439+ update_mds_branch_idle();34403440+ break;34413441+ case MDS_MITIGATION_OFF:34423442+ break;34433443+ }34443444+34453445+ switch (taa_mitigation) {34463446+ case TAA_MITIGATION_VERW:34473447+ case TAA_MITIGATION_AUTO:34483448+ case TAA_MITIGATION_UCODE_NEEDED:34493449+ if (sched_smt_active())34503450+ pr_warn_once(TAA_MSG_SMT);34513451+ break;34523452+ case TAA_MITIGATION_TSX_DISABLED:34533453+ case TAA_MITIGATION_OFF:34543454+ break;34553455+ }34563456+34573457+ switch (mmio_mitigation) {34583458+ case MMIO_MITIGATION_VERW:34593459+ case MMIO_MITIGATION_AUTO:34603460+ case MMIO_MITIGATION_UCODE_NEEDED:34613461+ if (sched_smt_active())34623462+ pr_warn_once(MMIO_MSG_SMT);34633463+ break;34643464+ case MMIO_MITIGATION_OFF:34653465+ break;34663466+ }34673467+34683468+ switch (tsa_mitigation) {34693469+ case TSA_MITIGATION_USER_KERNEL:34703470+ case TSA_MITIGATION_VM:34713471+ case TSA_MITIGATION_AUTO:34723472+ case TSA_MITIGATION_FULL:34733473+ /*34743474+ * TSA-SQ can potentially lead to info leakage between34753475+ * SMT threads.34763476+ */34773477+ if (sched_smt_active())34783478+ static_branch_enable(&cpu_buf_idle_clear);34793479+ else34803480+ static_branch_disable(&cpu_buf_idle_clear);34813481+ break;34823482+ case TSA_MITIGATION_NONE:34833483+ case TSA_MITIGATION_UCODE_NEEDED:34843484+ break;34853485+ }34863486+34873487+ switch (vmscape_mitigation) {34883488+ case VMSCAPE_MITIGATION_NONE:34893489+ case VMSCAPE_MITIGATION_AUTO:34903490+ break;34913491+ case VMSCAPE_MITIGATION_IBPB_ON_VMEXIT:34923492+ case VMSCAPE_MITIGATION_IBPB_EXIT_TO_USER:34933493+ /*34943494+ * Hypervisors can be attacked across-threads, warn for SMT when34953495+ * STIBP is not already enabled system-wide.34963496+ *34973497+ * Intel eIBRS (!AUTOIBRS) implies STIBP on.34983498+ */34993499+ if (!sched_smt_active() ||35003500+ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT ||35013501+ spectre_v2_user_stibp == SPECTRE_V2_USER_STRICT_PREFERRED ||35023502+ (spectre_v2_in_eibrs_mode(spectre_v2_enabled) &&35033503+ !boot_cpu_has(X86_FEATURE_AUTOIBRS)))35043504+ break;35053505+ pr_warn_once(VMSCAPE_MSG_SMT);35063506+ break;35073507+ }35083508+35093509+ mutex_unlock(&spec_ctrl_mutex);35103510+}3267351132683512#ifdef CONFIG_SYSFS32693513···36863578 return sysfs_emit(buf, "%s\n", tsa_strings[tsa_mitigation]);36873579}3688358035813581+static ssize_t vmscape_show_state(char *buf)35823582+{35833583+ return sysfs_emit(buf, "%s\n", vmscape_strings[vmscape_mitigation]);35843584+}35853585+36893586static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,36903587 char *buf, unsigned int bug)36913588{···3756364337573644 case X86_BUG_TSA:37583645 return tsa_show_state(buf);36463646+36473647+ case X86_BUG_VMSCAPE:36483648+ return vmscape_show_state(buf);3759364937603650 default:37613651 break;···38503734ssize_t cpu_show_tsa(struct device *dev, struct device_attribute *attr, char *buf)38513735{38523736 return cpu_show_common(dev, attr, buf, X86_BUG_TSA);37373737+}37383738+37393739+ssize_t cpu_show_vmscape(struct device *dev, struct device_attribute *attr, char *buf)37403740+{37413741+ return cpu_show_common(dev, attr, buf, X86_BUG_VMSCAPE);38533742}38543743#endif38553744
···175175176176static void parse_topology_amd(struct topo_scan *tscan)177177{178178- bool has_topoext = false;179179-180178 /*181181- * If the extended topology leaf 0x8000_001e is available182182- * try to get SMT, CORE, TILE, and DIE shifts from extended179179+ * Try to get SMT, CORE, TILE, and DIE shifts from extended183180 * CPUID leaf 0x8000_0026 on supported processors first. If184181 * extended CPUID leaf 0x8000_0026 is not supported, try to185185- * get SMT and CORE shift from leaf 0xb first, then try to186186- * get the CORE shift from leaf 0x8000_0008.182182+ * get SMT and CORE shift from leaf 0xb. If either leaf is183183+ * available, cpu_parse_topology_ext() will return true.187184 */188188- if (cpu_feature_enabled(X86_FEATURE_TOPOEXT))189189- has_topoext = cpu_parse_topology_ext(tscan);185185+ bool has_xtopology = cpu_parse_topology_ext(tscan);190186191187 if (cpu_feature_enabled(X86_FEATURE_AMD_HTR_CORES))192188 tscan->c->topo.cpu_type = cpuid_ebx(0x80000026);193189194194- if (!has_topoext && !parse_8000_0008(tscan))190190+ /*191191+ * If XTOPOLOGY leaves (0x26/0xb) are not available, try to192192+ * get the CORE shift from leaf 0x8000_0008 first.193193+ */194194+ if (!has_xtopology && !parse_8000_0008(tscan))195195 return;196196197197- /* Prefer leaf 0x8000001e if available */198198- if (parse_8000_001e(tscan, has_topoext))197197+ /*198198+ * Prefer leaf 0x8000001e if available to get the SMT shift and199199+ * the initial APIC ID if XTOPOLOGY leaves are not available.200200+ */201201+ if (parse_8000_001e(tscan, has_xtopology))199202 return;200203201204 /* Try the NODEID MSR */
+9
arch/x86/kvm/x86.c
···1101111011 wrmsrq(MSR_IA32_XFD_ERR, 0);11012110121101311013 /*1101411014+ * Mark this CPU as needing a branch predictor flush before running1101511015+ * userspace. Must be done before enabling preemption to ensure it gets1101611016+ * set for the CPU that actually ran the guest, and not the CPU that it1101711017+ * may migrate to.1101811018+ */1101911019+ if (cpu_feature_enabled(X86_FEATURE_IBPB_EXIT_TO_USER))1102011020+ this_cpu_write(x86_ibpb_exit_to_user, true);1102111021+1102211022+ /*1101411023 * Consume any pending interrupts, including the possible source of1101511024 * VM-Exit on SVM and any ticks that occur between VM-Exit and now.1101611025 * An instruction is required after local_irq_enable() to fully unblock
+8-5
block/fops.c
···77#include <linux/init.h>88#include <linux/mm.h>99#include <linux/blkdev.h>1010+#include <linux/blk-integrity.h>1011#include <linux/buffer_head.h>1112#include <linux/mpage.h>1213#include <linux/uio.h>···5554 struct bio bio;5655 ssize_t ret;57565858- WARN_ON_ONCE(iocb->ki_flags & IOCB_HAS_METADATA);5957 if (nr_pages <= DIO_INLINE_BIO_VECS)6058 vecs = inline_vecs;6159 else {···131131 if (bio->bi_status && !dio->bio.bi_status)132132 dio->bio.bi_status = bio->bi_status;133133134134- if (!is_sync && (dio->iocb->ki_flags & IOCB_HAS_METADATA))134134+ if (bio_integrity(bio))135135 bio_integrity_unmap_user(bio);136136137137 if (atomic_dec_and_test(&dio->ref)) {···233233 }234234 bio->bi_opf |= REQ_NOWAIT;235235 }236236- if (!is_sync && (iocb->ki_flags & IOCB_HAS_METADATA)) {236236+ if (iocb->ki_flags & IOCB_HAS_METADATA) {237237 ret = bio_integrity_map_iter(bio, iocb->private);238238 if (unlikely(ret))239239 goto fail;···301301 ret = blk_status_to_errno(bio->bi_status);302302 }303303304304- if (iocb->ki_flags & IOCB_HAS_METADATA)304304+ if (bio_integrity(bio))305305 bio_integrity_unmap_user(bio);306306307307 iocb->ki_complete(iocb, ret);···422422 }423423424424 nr_pages = bio_iov_vecs_to_alloc(iter, BIO_MAX_VECS + 1);425425- if (likely(nr_pages <= BIO_MAX_VECS)) {425425+ if (likely(nr_pages <= BIO_MAX_VECS &&426426+ !(iocb->ki_flags & IOCB_HAS_METADATA))) {426427 if (is_sync_kiocb(iocb))427428 return __blkdev_direct_IO_simple(iocb, iter, bdev,428429 nr_pages);···688687689688 if (bdev_can_atomic_write(bdev))690689 filp->f_mode |= FMODE_CAN_ATOMIC_WRITE;690690+ if (blk_get_integrity(bdev->bd_disk))691691+ filp->f_mode |= FMODE_HAS_METADATA;691692692693 ret = bdev_open(bdev, mode, filp->private_data, NULL, filp);693694 if (ret)
···15541554 pr_debug("CPU %d exiting\n", policy->cpu);15551555}1556155615571557-static int amd_pstate_epp_update_limit(struct cpufreq_policy *policy)15571557+static int amd_pstate_epp_update_limit(struct cpufreq_policy *policy, bool policy_change)15581558{15591559 struct amd_cpudata *cpudata = policy->driver_data;15601560 union perf_cached perf;15611561 u8 epp;1562156215631563- if (policy->min != cpudata->min_limit_freq || policy->max != cpudata->max_limit_freq)15631563+ if (policy_change ||15641564+ policy->min != cpudata->min_limit_freq ||15651565+ policy->max != cpudata->max_limit_freq)15641566 amd_pstate_update_min_max_limit(policy);1565156715661568 if (cpudata->policy == CPUFREQ_POLICY_PERFORMANCE)···1586158415871585 cpudata->policy = policy->policy;1588158615891589- ret = amd_pstate_epp_update_limit(policy);15871587+ ret = amd_pstate_epp_update_limit(policy, true);15901588 if (ret)15911589 return ret;15921590···16281626 * min_perf value across kexec reboots. If this CPU is just resumed back without kexec,16291627 * the limits, epp and desired perf will get reset to the cached values in cpudata struct16301628 */16311631- ret = amd_pstate_update_perf(policy, perf.bios_min_perf, 0U, 0U, 0U, false);16291629+ ret = amd_pstate_update_perf(policy, perf.bios_min_perf,16301630+ FIELD_GET(AMD_CPPC_DES_PERF_MASK, cpudata->cppc_req_cached),16311631+ FIELD_GET(AMD_CPPC_MAX_PERF_MASK, cpudata->cppc_req_cached),16321632+ FIELD_GET(AMD_CPPC_EPP_PERF_MASK, cpudata->cppc_req_cached),16331633+ false);16321634 if (ret)16331635 return ret;16341634-16351635- /* invalidate to ensure it's rewritten during resume */16361636- cpudata->cppc_req_cached = 0;1637163616381637 /* set this flag to avoid setting core offline*/16391638 cpudata->suspended = true;···16611658 int ret;1662165916631660 /* enable amd pstate from suspend state*/16641664- ret = amd_pstate_epp_update_limit(policy);16611661+ ret = amd_pstate_epp_update_limit(policy, false);16651662 if (ret)16661663 return ret;16671664
+2-2
drivers/cpufreq/intel_pstate.c
···10341034 if (!cpu_dev)10351035 return false;1036103610371037- if (em_dev_register_perf_domain(cpu_dev, HYBRID_EM_STATE_COUNT, &cb,10381038- cpumask_of(cpu), false))10371037+ if (em_dev_register_pd_no_update(cpu_dev, HYBRID_EM_STATE_COUNT, &cb,10381038+ cpumask_of(cpu), false))10391039 return false;1040104010411041 cpudata->pd_registered = true;
+11-4
drivers/dma/dw/rzn1-dmamux.c
···4848 u32 mask;4949 int ret;50505151- if (dma_spec->args_count != RNZ1_DMAMUX_NCELLS)5252- return ERR_PTR(-EINVAL);5151+ if (dma_spec->args_count != RNZ1_DMAMUX_NCELLS) {5252+ ret = -EINVAL;5353+ goto put_device;5454+ }53555456 map = kzalloc(sizeof(*map), GFP_KERNEL);5555- if (!map)5656- return ERR_PTR(-ENOMEM);5757+ if (!map) {5858+ ret = -ENOMEM;5959+ goto put_device;6060+ }57615862 chan = dma_spec->args[0];5963 map->req_idx = dma_spec->args[4];···9894 if (ret)9995 goto clear_bitmap;100969797+ put_device(&pdev->dev);10198 return map;10299103100clear_bitmap:104101 clear_bit(map->req_idx, dmamux->used_chans);105102free_map:106103 kfree(map);104104+put_device:105105+ put_device(&pdev->dev);107106108107 return ERR_PTR(ret);109108}
···12831283 if (!bdev->bamclk) {12841284 ret = of_property_read_u32(pdev->dev.of_node, "num-channels",12851285 &bdev->num_channels);12861286- if (ret)12861286+ if (ret) {12871287 dev_err(bdev->dev, "num-channels unspecified in dt\n");12881288+ return ret;12891289+ }1288129012891291 ret = of_property_read_u32(pdev->dev.of_node, "qcom,num-ees",12901292 &bdev->num_ees);12911291- if (ret)12931293+ if (ret) {12921294 dev_err(bdev->dev, "num-ees unspecified in dt\n");12951295+ return ret;12961296+ }12931297 }1294129812951299 ret = clk_prepare_enable(bdev->bamclk);
+2-2
drivers/dma/ti/edma.c
···20642064 * priority. So Q0 is the highest priority queue and the last queue has20652065 * the lowest priority.20662066 */20672067- queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8),20682068- GFP_KERNEL);20672067+ queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1,20682068+ sizeof(*queue_priority_map), GFP_KERNEL);20692069 if (!queue_priority_map)20702070 return -ENOMEM;20712071
+32-12
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
···213213 spin_lock(&kfd_mem_limit.mem_limit_lock);214214215215 if (kfd_mem_limit.system_mem_used + system_mem_needed >216216- kfd_mem_limit.max_system_mem_limit)216216+ kfd_mem_limit.max_system_mem_limit) {217217 pr_debug("Set no_system_mem_limit=1 if using shared memory\n");218218+ if (!no_system_mem_limit) {219219+ ret = -ENOMEM;220220+ goto release;221221+ }222222+ }218223219219- if ((kfd_mem_limit.system_mem_used + system_mem_needed >220220- kfd_mem_limit.max_system_mem_limit && !no_system_mem_limit) ||221221- (kfd_mem_limit.ttm_mem_used + ttm_mem_needed >222222- kfd_mem_limit.max_ttm_mem_limit) ||223223- (adev && xcp_id >= 0 && adev->kfd.vram_used[xcp_id] + vram_needed >224224- vram_size - reserved_for_pt - reserved_for_ras - atomic64_read(&adev->vram_pin_size))) {224224+ if (kfd_mem_limit.ttm_mem_used + ttm_mem_needed >225225+ kfd_mem_limit.max_ttm_mem_limit) {225226 ret = -ENOMEM;226227 goto release;228228+ }229229+230230+ /*if is_app_apu is false and apu_prefer_gtt is true, it is an APU with231231+ * carve out < gtt. In that case, VRAM allocation will go to gtt domain, skip232232+ * VRAM check since ttm_mem_limit check already cover this allocation233233+ */234234+235235+ if (adev && xcp_id >= 0 && (!adev->apu_prefer_gtt || adev->gmc.is_app_apu)) {236236+ uint64_t vram_available =237237+ vram_size - reserved_for_pt - reserved_for_ras -238238+ atomic64_read(&adev->vram_pin_size);239239+ if (adev->kfd.vram_used[xcp_id] + vram_needed > vram_available) {240240+ ret = -ENOMEM;241241+ goto release;242242+ }227243 }228244229245 /* Update memory accounting by decreasing available system···16421626 uint64_t vram_available, system_mem_available, ttm_mem_available;1643162716441628 spin_lock(&kfd_mem_limit.mem_limit_lock);16451645- vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)16461646- - adev->kfd.vram_used_aligned[xcp_id]16471647- - atomic64_read(&adev->vram_pin_size)16481648- - reserved_for_pt16491649- - reserved_for_ras;16291629+ if (adev->apu_prefer_gtt && !adev->gmc.is_app_apu)16301630+ vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)16311631+ - adev->kfd.vram_used_aligned[xcp_id];16321632+ else16331633+ vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)16341634+ - adev->kfd.vram_used_aligned[xcp_id]16351635+ - atomic64_read(&adev->vram_pin_size)16361636+ - reserved_for_pt16371637+ - reserved_for_ras;1650163816511639 if (adev->apu_prefer_gtt) {16521640 system_mem_available = no_system_mem_limit ?
···149149 int ret;150150 int retry_loop;151151152152- for (retry_loop = 0; retry_loop < 10; retry_loop++) {152152+ for (retry_loop = 0; retry_loop < 20; retry_loop++) {153153 /* Wait for bootloader to signify that is154154 ready having bit 31 of C2PMSG_35 set to 1 */155155 ret = psp_wait_for(156156 psp, SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_35),157157- 0x80000000, 0x80000000, PSP_WAITREG_NOVERBOSE);157157+ 0x80000000, 0x8000FFFF, PSP_WAITREG_NOVERBOSE);158158159159 if (ret == 0)160160 return 0;···396396 WREG32(offset, GFX_CTRL_CMD_ID_MODE1_RST);397397398398 msleep(500);399399-400400- offset = SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_33);401401-402402- ret = psp_wait_for(psp, offset, MBOX_TOS_RESP_FLAG, MBOX_TOS_RESP_MASK,403403- 0);404404-405405- if (ret) {406406- DRM_INFO("psp mode 1 reset failed!\n");407407- return -EINVAL;408408- }409409-410410- DRM_INFO("psp mode1 reset succeed \n");411399412400 return 0;413401}···653665 .ring_get_wptr = psp_v11_0_ring_get_wptr,654666 .ring_set_wptr = psp_v11_0_ring_set_wptr,655667 .load_usbc_pd_fw = psp_v11_0_load_usbc_pd_fw,656656- .read_usbc_pd_fw = psp_v11_0_read_usbc_pd_fw668668+ .read_usbc_pd_fw = psp_v11_0_read_usbc_pd_fw,669669+ .wait_for_bootloader = psp_v11_0_wait_for_bootloader657670};658671659672void psp_v11_0_set_psp_funcs(struct psp_context *psp)
+8-4
drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
···18881888 struct amdgpu_job *job)18891889{18901890 struct drm_gpu_scheduler **scheds;18911891-18921892- /* The create msg must be in the first IB submitted */18931893- if (atomic_read(&job->base.entity->fence_seq))18941894- return -EINVAL;18911891+ struct dma_fence *fence;1895189218961893 /* if VCN0 is harvested, we can't support AV1 */18971894 if (p->adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0)18981895 return -EINVAL;18961896+18971897+ /* wait for all jobs to finish before switching to instance 0 */18981898+ fence = amdgpu_ctx_get_fence(p->ctx, job->base.entity, ~0ull);18991899+ if (fence) {19001900+ dma_fence_wait(fence, false);19011901+ dma_fence_put(fence);19021902+ }1899190319001904 scheds = p->adev->gpu_sched[AMDGPU_HW_IP_VCN_DEC]19011905 [AMDGPU_RING_PRIO_DEFAULT].sched;
+27-33
drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
···18081808 struct amdgpu_job *job)18091809{18101810 struct drm_gpu_scheduler **scheds;18111811-18121812- /* The create msg must be in the first IB submitted */18131813- if (atomic_read(&job->base.entity->fence_seq))18141814- return -EINVAL;18111811+ struct dma_fence *fence;1815181218161813 /* if VCN0 is harvested, we can't support AV1 */18171814 if (p->adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0)18181815 return -EINVAL;18161816+18171817+ /* wait for all jobs to finish before switching to instance 0 */18181818+ fence = amdgpu_ctx_get_fence(p->ctx, job->base.entity, ~0ull);18191819+ if (fence) {18201820+ dma_fence_wait(fence, false);18211821+ dma_fence_put(fence);18221822+ }1819182318201824 scheds = p->adev->gpu_sched[AMDGPU_HW_IP_VCN_ENC]18211825 [AMDGPU_RING_PRIO_0].sched;···1911190719121908#define RADEON_VCN_ENGINE_TYPE_ENCODE (0x00000002)19131909#define RADEON_VCN_ENGINE_TYPE_DECODE (0x00000003)19141914-19151910#define RADEON_VCN_ENGINE_INFO (0x30000001)19161916-#define RADEON_VCN_ENGINE_INFO_MAX_OFFSET 1619171917-19181911#define RENCODE_ENCODE_STANDARD_AV1 219191912#define RENCODE_IB_PARAM_SESSION_INIT 0x0000000319201920-#define RENCODE_IB_PARAM_SESSION_INIT_MAX_OFFSET 641921191319221922-/* return the offset in ib if id is found, -1 otherwise19231923- * to speed up the searching we only search upto max_offset19241924- */19251925-static int vcn_v4_0_enc_find_ib_param(struct amdgpu_ib *ib, uint32_t id, int max_offset)19141914+/* return the offset in ib if id is found, -1 otherwise */19151915+static int vcn_v4_0_enc_find_ib_param(struct amdgpu_ib *ib, uint32_t id, int start)19261916{19271917 int i;1928191819291929- for (i = 0; i < ib->length_dw && i < max_offset && ib->ptr[i] >= 8; i += ib->ptr[i]/4) {19191919+ for (i = start; i < ib->length_dw && ib->ptr[i] >= 8; i += ib->ptr[i] / 4) {19301920 if (ib->ptr[i + 1] == id)19311921 return i;19321922 }···19351937 struct amdgpu_vcn_decode_buffer *decode_buffer;19361938 uint64_t addr;19371939 uint32_t val;19381938- int idx;19401940+ int idx = 0, sidx;1939194119401942 /* The first instance can decode anything */19411943 if (!ring->me)19421944 return 0;1943194519441944- /* RADEON_VCN_ENGINE_INFO is at the top of ib block */19451945- idx = vcn_v4_0_enc_find_ib_param(ib, RADEON_VCN_ENGINE_INFO,19461946- RADEON_VCN_ENGINE_INFO_MAX_OFFSET);19471947- if (idx < 0) /* engine info is missing */19481948- return 0;19461946+ while ((idx = vcn_v4_0_enc_find_ib_param(ib, RADEON_VCN_ENGINE_INFO, idx)) >= 0) {19471947+ val = amdgpu_ib_get_value(ib, idx + 2); /* RADEON_VCN_ENGINE_TYPE */19481948+ if (val == RADEON_VCN_ENGINE_TYPE_DECODE) {19491949+ decode_buffer = (struct amdgpu_vcn_decode_buffer *)&ib->ptr[idx + 6];1949195019501950- val = amdgpu_ib_get_value(ib, idx + 2); /* RADEON_VCN_ENGINE_TYPE */19511951- if (val == RADEON_VCN_ENGINE_TYPE_DECODE) {19521952- decode_buffer = (struct amdgpu_vcn_decode_buffer *)&ib->ptr[idx + 6];19511951+ if (!(decode_buffer->valid_buf_flag & 0x1))19521952+ return 0;1953195319541954- if (!(decode_buffer->valid_buf_flag & 0x1))19551955- return 0;19561956-19571957- addr = ((u64)decode_buffer->msg_buffer_address_hi) << 32 |19581958- decode_buffer->msg_buffer_address_lo;19591959- return vcn_v4_0_dec_msg(p, job, addr);19601960- } else if (val == RADEON_VCN_ENGINE_TYPE_ENCODE) {19611961- idx = vcn_v4_0_enc_find_ib_param(ib, RENCODE_IB_PARAM_SESSION_INIT,19621962- RENCODE_IB_PARAM_SESSION_INIT_MAX_OFFSET);19631963- if (idx >= 0 && ib->ptr[idx + 2] == RENCODE_ENCODE_STANDARD_AV1)19641964- return vcn_v4_0_limit_sched(p, job);19541954+ addr = ((u64)decode_buffer->msg_buffer_address_hi) << 32 |19551955+ decode_buffer->msg_buffer_address_lo;19561956+ return vcn_v4_0_dec_msg(p, job, addr);19571957+ } else if (val == RADEON_VCN_ENGINE_TYPE_ENCODE) {19581958+ sidx = vcn_v4_0_enc_find_ib_param(ib, RENCODE_IB_PARAM_SESSION_INIT, idx);19591959+ if (sidx >= 0 && ib->ptr[sidx + 2] == RENCODE_ENCODE_STANDARD_AV1)19601960+ return vcn_v4_0_limit_sched(p, job);19611961+ }19621962+ idx += ib->ptr[idx] / 4;19651963 }19661964 return 0;19671965}
+2-1
drivers/gpu/drm/amd/amdkfd/kfd_topology.c
···15871587 break;15881588 if (!dev->gpu || !dev->gpu->adev ||15891589 (dev->gpu->kfd->hive_id &&15901590- dev->gpu->kfd->hive_id == new_dev->gpu->kfd->hive_id))15901590+ dev->gpu->kfd->hive_id == new_dev->gpu->kfd->hive_id &&15911591+ amdgpu_xgmi_get_is_sharing_enabled(dev->gpu->adev, new_dev->gpu->adev)))15911592 goto next;1592159315931594 /* check if node(s) is/are peer accessible in one direction or bi-direction */
···10941094 struct drm_panthor_queue_create *queue_args;10951095 int ret;1096109610971097- if (!args->queues.count)10971097+ if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG)10981098 return -EINVAL;1099109911001100 ret = PANTHOR_UOBJ_GET_ARRAY(queue_args, &args->queues);
+1-1
drivers/gpu/drm/xe/tests/xe_bo.c
···236236 }237237238238 xe_bo_lock(external, false);239239- err = xe_bo_pin_external(external);239239+ err = xe_bo_pin_external(external, false);240240 xe_bo_unlock(external);241241 if (err) {242242 KUNIT_FAIL(test, "external bo pin err=%pe\n",
+1-9
drivers/gpu/drm/xe/tests/xe_dma_buf.c
···8989 return;9090 }91919292- /*9393- * If on different devices, the exporter is kept in system if9494- * possible, saving a migration step as the transfer is just9595- * likely as fast from system memory.9696- */9797- if (params->mem_mask & XE_BO_FLAG_SYSTEM)9898- KUNIT_EXPECT_TRUE(test, xe_bo_is_mem_type(exported, XE_PL_TT));9999- else100100- KUNIT_EXPECT_TRUE(test, xe_bo_is_mem_type(exported, mem_type));9292+ KUNIT_EXPECT_TRUE(test, xe_bo_is_mem_type(exported, mem_type));1019310294 if (params->force_different_devices)10395 KUNIT_EXPECT_TRUE(test, xe_bo_is_mem_type(imported, XE_PL_TT));
+12-4
drivers/gpu/drm/xe/xe_bo.c
···186186187187 bo->placements[*c] = (struct ttm_place) {188188 .mem_type = XE_PL_TT,189189+ .flags = (bo_flags & XE_BO_FLAG_VRAM_MASK) ?190190+ TTM_PL_FLAG_FALLBACK : 0,189191 };190192 *c += 1;191193 }···22712269/**22722270 * xe_bo_pin_external - pin an external BO22732271 * @bo: buffer object to be pinned22722272+ * @in_place: Pin in current placement, don't attempt to migrate.22742273 *22752274 * Pin an external (not tied to a VM, can be exported via dma-buf / prime FD)22762275 * BO. Unique call compared to xe_bo_pin as this function has it own set of···22792276 *22802277 * Returns 0 for success, negative error code otherwise.22812278 */22822282-int xe_bo_pin_external(struct xe_bo *bo)22792279+int xe_bo_pin_external(struct xe_bo *bo, bool in_place)22832280{22842281 struct xe_device *xe = xe_bo_device(bo);22852282 int err;···22882285 xe_assert(xe, xe_bo_is_user(bo));2289228622902287 if (!xe_bo_is_pinned(bo)) {22912291- err = xe_bo_validate(bo, NULL, false);22922292- if (err)22932293- return err;22882288+ if (!in_place) {22892289+ err = xe_bo_validate(bo, NULL, false);22902290+ if (err)22912291+ return err;22922292+ }2294229322952294 spin_lock(&xe->pinned.lock);22962295 list_add_tail(&bo->pinned_link, &xe->pinned.late.external);···24442439 .gfp_retry_mayfail = true,24452440 };24462441 int ret;24422442+24432443+ if (xe_bo_is_pinned(bo))24442444+ return 0;2447244524482446 if (vm) {24492447 lockdep_assert_held(&vm->lock);
···553553554554 /** @pm_notifier: Our PM notifier to perform actions in response to various PM events. */555555 struct notifier_block pm_notifier;556556+ /** @pm_block: Completion to block validating tasks on suspend / hibernate prepare */557557+ struct completion pm_block;558558+ /** @rebind_resume_list: List of wq items to kick on resume. */559559+ struct list_head rebind_resume_list;560560+ /** @rebind_resume_lock: Lock to protect the rebind_resume_list */561561+ struct mutex rebind_resume_lock;556562557563 /** @pmt: Support the PMT driver callback interface */558564 struct {
+1-1
drivers/gpu/drm/xe/xe_dma_buf.c
···7272 return ret;7373 }74747575- ret = xe_bo_pin_external(bo);7575+ ret = xe_bo_pin_external(bo, true);7676 xe_assert(xe, !ret);77777878 return 0;
+9
drivers/gpu/drm/xe/xe_exec.c
···237237 goto err_unlock_list;238238 }239239240240+ /*241241+ * It's OK to block interruptible here with the vm lock held, since242242+ * on task freezing during suspend / hibernate, the call will243243+ * return -ERESTARTSYS and the IOCTL will be rerun.244244+ */245245+ err = wait_for_completion_interruptible(&xe->pm_block);246246+ if (err)247247+ goto err_unlock_list;248248+240249 vm_exec.vm = &vm->gpuvm;241250 vm_exec.flags = DRM_EXEC_INTERRUPTIBLE_WAIT;242251 if (xe_vm_in_lr_mode(vm)) {
+32-10
drivers/gpu/drm/xe/xe_pm.c
···2424#include "xe_pcode.h"2525#include "xe_pxp.h"2626#include "xe_trace.h"2727+#include "xe_vm.h"2728#include "xe_wa.h"28292930/**···291290 return DEFAULT_VRAM_THRESHOLD;292291}293292293293+static void xe_pm_wake_rebind_workers(struct xe_device *xe)294294+{295295+ struct xe_vm *vm, *next;296296+297297+ mutex_lock(&xe->rebind_resume_lock);298298+ list_for_each_entry_safe(vm, next, &xe->rebind_resume_list,299299+ preempt.pm_activate_link) {300300+ list_del_init(&vm->preempt.pm_activate_link);301301+ xe_vm_resume_rebind_worker(vm);302302+ }303303+ mutex_unlock(&xe->rebind_resume_lock);304304+}305305+294306static int xe_pm_notifier_callback(struct notifier_block *nb,295307 unsigned long action, void *data)296308{···313299 switch (action) {314300 case PM_HIBERNATION_PREPARE:315301 case PM_SUSPEND_PREPARE:302302+ reinit_completion(&xe->pm_block);316303 xe_pm_runtime_get(xe);317304 err = xe_bo_evict_all_user(xe);318318- if (err) {305305+ if (err)319306 drm_dbg(&xe->drm, "Notifier evict user failed (%d)\n", err);320320- xe_pm_runtime_put(xe);321321- break;322322- }323307324308 err = xe_bo_notifier_prepare_all_pinned(xe);325325- if (err) {309309+ if (err)326310 drm_dbg(&xe->drm, "Notifier prepare pin failed (%d)\n", err);327327- xe_pm_runtime_put(xe);328328- }311311+ /*312312+ * Keep the runtime pm reference until post hibernation / post suspend to313313+ * avoid a runtime suspend interfering with evicted objects or backup314314+ * allocations.315315+ */329316 break;330317 case PM_POST_HIBERNATION:331318 case PM_POST_SUSPEND:319319+ complete_all(&xe->pm_block);320320+ xe_pm_wake_rebind_workers(xe);332321 xe_bo_notifier_unprepare_all_pinned(xe);333322 xe_pm_runtime_put(xe);334323 break;335324 }336336-337337- if (err)338338- return NOTIFY_BAD;339325340326 return NOTIFY_DONE;341327}···357343 err = register_pm_notifier(&xe->pm_notifier);358344 if (err)359345 return err;346346+347347+ err = drmm_mutex_init(&xe->drm, &xe->rebind_resume_lock);348348+ if (err)349349+ goto err_unregister;350350+351351+ init_completion(&xe->pm_block);352352+ complete_all(&xe->pm_block);353353+ INIT_LIST_HEAD(&xe->rebind_resume_list);360354361355 /* For now suspend/resume is only allowed with GuC */362356 if (!xe_device_uc_enabled(xe))
+2-1
drivers/gpu/drm/xe/xe_survivability_mode.c
···4141 *4242 * # echo 1 > /sys/kernel/config/xe/0000:03:00.0/survivability_mode4343 *4444+ * It is the responsibility of the user to clear the mode once firmware flash is complete.4545+ *4446 * Refer :ref:`xe_configfs` for more details on how to use configfs4547 *4648 * Survivability mode is indicated by the below admin-only readable sysfs which provides additional···149147 struct pci_dev *pdev = to_pci_dev(xe->drm.dev);150148 struct device *dev = &pdev->dev;151149152152- xe_configfs_clear_survivability_mode(pdev);153150 sysfs_remove_file(&dev->kobj, &dev_attr_survivability_mode.attr);154151}155152
+41-1
drivers/gpu/drm/xe/xe_vm.c
···393393 list_move_tail(&gpuva_to_vma(gpuva)->combined_links.rebind,394394 &vm->rebind_list);395395396396+ if (!try_wait_for_completion(&vm->xe->pm_block))397397+ return -EAGAIN;398398+396399 ret = xe_bo_validate(gem_to_xe_bo(vm_bo->obj), vm, false);397400 if (ret)398401 return ret;···482479 return xe_vm_validate_rebind(vm, exec, vm->preempt.num_exec_queues);483480}484481482482+static bool vm_suspend_rebind_worker(struct xe_vm *vm)483483+{484484+ struct xe_device *xe = vm->xe;485485+ bool ret = false;486486+487487+ mutex_lock(&xe->rebind_resume_lock);488488+ if (!try_wait_for_completion(&vm->xe->pm_block)) {489489+ ret = true;490490+ list_move_tail(&vm->preempt.pm_activate_link, &xe->rebind_resume_list);491491+ }492492+ mutex_unlock(&xe->rebind_resume_lock);493493+494494+ return ret;495495+}496496+497497+/**498498+ * xe_vm_resume_rebind_worker() - Resume the rebind worker.499499+ * @vm: The vm whose preempt worker to resume.500500+ *501501+ * Resume a preempt worker that was previously suspended by502502+ * vm_suspend_rebind_worker().503503+ */504504+void xe_vm_resume_rebind_worker(struct xe_vm *vm)505505+{506506+ queue_work(vm->xe->ordered_wq, &vm->preempt.rebind_work);507507+}508508+485509static void preempt_rebind_work_func(struct work_struct *w)486510{487511 struct xe_vm *vm = container_of(w, struct xe_vm, preempt.rebind_work);···532502 }533503534504retry:505505+ if (!try_wait_for_completion(&vm->xe->pm_block) && vm_suspend_rebind_worker(vm)) {506506+ up_write(&vm->lock);507507+ return;508508+ }509509+535510 if (xe_vm_userptr_check_repin(vm)) {536511 err = xe_vm_userptr_pin(vm);537512 if (err)···17491714 if (flags & XE_VM_FLAG_LR_MODE) {17501715 INIT_WORK(&vm->preempt.rebind_work, preempt_rebind_work_func);17511716 xe_pm_runtime_get_noresume(xe);17171717+ INIT_LIST_HEAD(&vm->preempt.pm_activate_link);17521718 }1753171917541720 if (flags & XE_VM_FLAG_FAULT_MODE) {···19311895 xe_assert(xe, !vm->preempt.num_exec_queues);1932189619331897 xe_vm_close(vm);19341934- if (xe_vm_in_preempt_fence_mode(vm))18981898+ if (xe_vm_in_preempt_fence_mode(vm)) {18991899+ mutex_lock(&xe->rebind_resume_lock);19001900+ list_del_init(&vm->preempt.pm_activate_link);19011901+ mutex_unlock(&xe->rebind_resume_lock);19351902 flush_work(&vm->preempt.rebind_work);19031903+ }19361904 if (xe_vm_in_fault_mode(vm))19371905 xe_svm_close(vm);19381906
+2
drivers/gpu/drm/xe/xe_vm.h
···273273 struct xe_exec_queue *q, u64 addr,274274 enum xe_cache_level cache_lvl);275275276276+void xe_vm_resume_rebind_worker(struct xe_vm *vm);277277+276278/**277279 * xe_vm_resv() - Return's the vm's reservation object278280 * @vm: The vm
+5
drivers/gpu/drm/xe/xe_vm_types.h
···293293 * BOs294294 */295295 struct work_struct rebind_work;296296+ /**297297+ * @preempt.pm_activate_link: Link to list of rebind workers to be298298+ * kicked on resume.299299+ */300300+ struct list_head pm_activate_link;296301 } preempt;297302298303 /** @um: unified memory state */
···11config NOVA_CORE22 tristate "Nova Core GPU driver"33+ depends on 64BIT34 depends on PCI45 depends on RUST56 depends on RUST_FW_LOADER_ABSTRACTIONS
···11901190}1191119111921192/**11931193+ * i40e_aq_set_mac_config - Configure MAC settings11941194+ * @hw: pointer to the hw struct11951195+ * @max_frame_size: Maximum Frame Size to be supported by the port11961196+ * @cmd_details: pointer to command details structure or NULL11971197+ *11981198+ * Set MAC configuration (0x0603). Note that max_frame_size must be greater11991199+ * than zero.12001200+ *12011201+ * Return: 0 on success, or a negative error code on failure.12021202+ */12031203+int i40e_aq_set_mac_config(struct i40e_hw *hw, u16 max_frame_size,12041204+ struct i40e_asq_cmd_details *cmd_details)12051205+{12061206+ struct i40e_aq_set_mac_config *cmd;12071207+ struct libie_aq_desc desc;12081208+12091209+ cmd = libie_aq_raw(&desc);12101210+12111211+ if (max_frame_size == 0)12121212+ return -EINVAL;12131213+12141214+ i40e_fill_default_direct_cmd_desc(&desc, i40e_aqc_opc_set_mac_config);12151215+12161216+ cmd->max_frame_size = cpu_to_le16(max_frame_size);12171217+ cmd->params = I40E_AQ_SET_MAC_CONFIG_CRC_EN;12181218+12191219+#define I40E_AQ_SET_MAC_CONFIG_FC_DEFAULT_THRESHOLD 0x7FFF12201220+ cmd->fc_refresh_threshold =12211221+ cpu_to_le16(I40E_AQ_SET_MAC_CONFIG_FC_DEFAULT_THRESHOLD);12221222+12231223+ return i40e_asq_send_command(hw, &desc, NULL, 0, cmd_details);12241224+}12251225+12261226+/**11931227 * i40e_aq_clear_pxe_mode11941228 * @hw: pointer to the hw struct11951229 * @cmd_details: pointer to command details structure or NULL
+11-7
drivers/net/ethernet/intel/i40e/i40e_main.c
···41564156 irq_num = pf->msix_entries[base + vector].vector;41574157 irq_set_affinity_notifier(irq_num, NULL);41584158 irq_update_affinity_hint(irq_num, NULL);41594159- free_irq(irq_num, &vsi->q_vectors[vector]);41594159+ free_irq(irq_num, vsi->q_vectors[vector]);41604160 }41614161 return err;41624162}···1604516045 dev_dbg(&pf->pdev->dev, "get supported phy types ret = %pe last_status = %s\n",1604616046 ERR_PTR(err), libie_aq_str(pf->hw.aq.asq_last_status));16047160471604816048- /* make sure the MFS hasn't been set lower than the default */1604916048#define MAX_FRAME_SIZE_DEFAULT 0x26001605016050- val = FIELD_GET(I40E_PRTGL_SAH_MFS_MASK,1605116051- rd32(&pf->hw, I40E_PRTGL_SAH));1605216052- if (val < MAX_FRAME_SIZE_DEFAULT)1605316053- dev_warn(&pdev->dev, "MFS for port %x (%d) has been set below the default (%d)\n",1605416054- pf->hw.port, val, MAX_FRAME_SIZE_DEFAULT);1604916049+1605016050+ err = i40e_aq_set_mac_config(hw, MAX_FRAME_SIZE_DEFAULT, NULL);1605116051+ if (err)1605216052+ dev_warn(&pdev->dev, "set mac config ret = %pe last_status = %s\n",1605316053+ ERR_PTR(err), libie_aq_str(pf->hw.aq.asq_last_status));1605416054+1605516055+ /* Make sure the MFS is set to the expected value */1605616056+ val = rd32(hw, I40E_PRTGL_SAH);1605716057+ FIELD_MODIFY(I40E_PRTGL_SAH_MFS_MASK, &val, MAX_FRAME_SIZE_DEFAULT);1605816058+ wr32(hw, I40E_PRTGL_SAH, val);16055160591605616060 /* Add a filter to drop all Flow control frames from any VSI from being1605716061 * transmitted. By doing so we stop a malicious VF from sending out
···20812081 } else {20822082 dev_info(&adapter->pdev->dev, "online testing starting\n");2083208320842084- /* PHY is powered down when interface is down */20852085- if (if_running && igb_link_test(adapter, &data[TEST_LINK]))20842084+ if (igb_link_test(adapter, &data[TEST_LINK]))20862085 eth_test->flags |= ETH_TEST_FL_FAILED;20872087- else20882088- data[TEST_LINK] = 0;2089208620902087 /* Online tests aren't run; pass by default */20912088 data[TEST_REG] = 0;
+1-2
drivers/net/ethernet/intel/igb/igb_main.c
···44534453 if (xdp_rxq_info_is_reg(&rx_ring->xdp_rxq))44544454 xdp_rxq_info_unreg(&rx_ring->xdp_rxq);44554455 res = xdp_rxq_info_reg(&rx_ring->xdp_rxq, rx_ring->netdev,44564456- rx_ring->queue_index,44574457- rx_ring->q_vector->napi.napi_id);44564456+ rx_ring->queue_index, 0);44584457 if (res < 0) {44594458 dev_err(dev, "Failed to register xdp_rxq index %u\n",44604459 rx_ring->queue_index);
+14-6
drivers/net/ethernet/ti/icssg/icssg_prueth.c
···654654655655static int icssg_prueth_hsr_add_mcast(struct net_device *ndev, const u8 *addr)656656{657657- struct net_device *real_dev;657657+ struct net_device *real_dev, *port_dev;658658 struct prueth_emac *emac;659659 u8 vlan_id, i;660660···663663664664 if (is_hsr_master(real_dev)) {665665 for (i = HSR_PT_SLAVE_A; i < HSR_PT_INTERLINK; i++) {666666- emac = netdev_priv(hsr_get_port_ndev(real_dev, i));667667- if (!emac)666666+ port_dev = hsr_get_port_ndev(real_dev, i);667667+ emac = netdev_priv(port_dev);668668+ if (!emac) {669669+ dev_put(port_dev);668670 return -EINVAL;671671+ }669672 icssg_prueth_hsr_fdb_add_del(emac, addr, vlan_id,670673 true);674674+ dev_put(port_dev);671675 }672676 } else {673677 emac = netdev_priv(real_dev);···683679684680static int icssg_prueth_hsr_del_mcast(struct net_device *ndev, const u8 *addr)685681{686686- struct net_device *real_dev;682682+ struct net_device *real_dev, *port_dev;687683 struct prueth_emac *emac;688684 u8 vlan_id, i;689685···692688693689 if (is_hsr_master(real_dev)) {694690 for (i = HSR_PT_SLAVE_A; i < HSR_PT_INTERLINK; i++) {695695- emac = netdev_priv(hsr_get_port_ndev(real_dev, i));696696- if (!emac)691691+ port_dev = hsr_get_port_ndev(real_dev, i);692692+ emac = netdev_priv(port_dev);693693+ if (!emac) {694694+ dev_put(port_dev);697695 return -EINVAL;696696+ }698697 icssg_prueth_hsr_fdb_add_del(emac, addr, vlan_id,699698 false);699699+ dev_put(port_dev);700700 }701701 } else {702702 emac = netdev_priv(real_dev);
-4
drivers/net/ethernet/wangxun/libwx/wx_hw.c
···20782078{20792079 u32 rss_field = 0;2080208020812081- /* VT, and RSS do not coexist at the same time */20822082- if (test_bit(WX_FLAG_VMDQ_ENABLED, wx->flags))20832083- return;20842084-20852081 /* Disable indicating checksum in descriptor, enables RSS hash */20862082 wr32m(wx, WX_PSR_CTL, WX_PSR_CTL_PCSD, WX_PSR_CTL_PCSD);20872083
···361361 tristate "NXP TJA11xx PHYs support"362362 depends on HWMON363363 help364364- Currently supports the NXP TJA1100 and TJA1101 PHY.364364+ Currently supports the NXP TJA1100, TJA1101 and TJA1102 PHYs.365365366366config NCN26000_PHY367367 tristate "Onsemi 10BASE-T1S Ethernet PHY"
···127127 rptr->cfg->init_tbl[i].value);128128129129 /* Override registers from devicetree values */130130- if (!of_property_read_u8(np, "qcom,tune-usb2-amplitude", &val))130130+ if (!of_property_read_u8(np, "qcom,tune-usb2-preem", &val))131131 regmap_write(regmap, base + EUSB2_TUNE_USB2_PREEM, val);132132133133 if (!of_property_read_u8(np, "qcom,tune-usb2-disc-thres", &val))134134 regmap_write(regmap, base + EUSB2_TUNE_HSDISC, val);135135136136- if (!of_property_read_u8(np, "qcom,tune-usb2-preem", &val))136136+ if (!of_property_read_u8(np, "qcom,tune-usb2-amplitude", &val))137137 regmap_write(regmap, base + EUSB2_TUNE_IUSB2, val);138138139139 /* Wait for status OK */
+19-6
drivers/phy/qualcomm/phy-qcom-qmp-pcie.c
···30673067 struct clk_fixed_rate aux_clk_fixed;30683068};3069306930703070+static bool qphy_checkbits(const void __iomem *base, u32 offset, u32 val)30713071+{30723072+ u32 reg;30733073+30743074+ reg = readl(base + offset);30753075+ return (reg & val) == val;30763076+}30773077+30703078static inline void qphy_setbits(void __iomem *base, u32 offset, u32 val)30713079{30723080 u32 reg;···43474339 struct qmp_pcie *qmp = phy_get_drvdata(phy);43484340 const struct qmp_phy_cfg *cfg = qmp->cfg;43494341 void __iomem *pcs = qmp->pcs;43504350- bool phy_initialized = !!(readl(pcs + cfg->regs[QPHY_START_CTRL]));43514342 int ret;4352434343534353- qmp->skip_init = qmp->nocsr_reset && phy_initialized;43544344 /*43554355- * We need to check the existence of init sequences in two cases:43564356- * 1. The PHY doesn't support no_csr reset.43574357- * 2. The PHY supports no_csr reset but isn't initialized by bootloader.43584358- * As we can't skip init in these two cases.43454345+ * We can skip PHY initialization if all of the following conditions43464346+ * are met:43474347+ * 1. The PHY supports the nocsr_reset that preserves the PHY config.43484348+ * 2. The PHY was started (and not powered down again) by the43494349+ * bootloader, with all of the expected bits set correctly.43504350+ * In this case, we can continue without having the init sequence43514351+ * defined in the driver.43594352 */43534353+ qmp->skip_init = qmp->nocsr_reset &&43544354+ qphy_checkbits(pcs, cfg->regs[QPHY_START_CTRL], SERDES_START | PCS_START) &&43554355+ qphy_checkbits(pcs, cfg->regs[QPHY_PCS_POWER_DOWN_CONTROL], cfg->pwrdn_ctrl);43564356+43604357 if (!qmp->skip_init && !cfg->tbls.serdes_num) {43614358 dev_err(qmp->dev, "Init sequence not available\n");43624359 return -ENODATA;
···8383 if (!regmap)8484 return -EPROBE_DEFER;85858686- gdp = devm_gpiod_get(pdev->dev.parent, "epd-pwr-good", GPIOD_IN);8686+ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent);8787+8888+ gdp = devm_gpiod_get(&pdev->dev, "epd-pwr-good", GPIOD_IN);8789 if (IS_ERR(gdp)) {8888- dev_err(pdev->dev.parent, "Power good GPIO fault %ld\n", PTR_ERR(gdp));9090+ dev_err(&pdev->dev, "Power good GPIO fault %ld\n", PTR_ERR(gdp));8991 return PTR_ERR(gdp);9092 }9193···107105 }108106109107 config.dev = &pdev->dev;110110- config.dev->of_node = pdev->dev.parent->of_node;111108 config.regmap = regmap;112109113110 rdev = devm_regulator_register(&pdev->dev, &desc, &config);
+102-32
drivers/spi/atmel-quadspi.c
···63636464#define SAMA7G5_QSPI0_MAX_SPEED_HZ 2000000006565#define SAMA7G5_QSPI1_SDR_MAX_SPEED_HZ 1330000006666+#define SAM9X7_QSPI_MAX_SPEED_HZ 10000000066676768/* Bitfields in QSPI_CR (Control Register) */6869#define QSPI_CR_QSPIEN BIT(0)···263262 bool has_ricr;264263 bool octal;265264 bool has_dma;265265+ bool has_2xgclk;266266+ bool has_padcalib;267267+ bool has_dllon;266268};267269268270struct atmel_qspi_ops;···10311027 aq, QSPI_PCALCFG);1032102810331029 /* DLL On + start calibration. */10341034- atmel_qspi_write(QSPI_CR_DLLON | QSPI_CR_STPCAL, aq, QSPI_CR);10301030+ if (aq->caps->has_dllon)10311031+ atmel_qspi_write(QSPI_CR_DLLON | QSPI_CR_STPCAL, aq, QSPI_CR);10321032+ /* If there is no DLL support only start calibration. */10331033+ else10341034+ atmel_qspi_write(QSPI_CR_STPCAL, aq, QSPI_CR);1035103510361036- /* Check synchronization status before updating configuration. */10371037- ret = readl_poll_timeout(aq->regs + QSPI_SR2, val,10381038- (val & QSPI_SR2_DLOCK) &&10391039- !(val & QSPI_SR2_CALBSY), 40,10401040- ATMEL_QSPI_TIMEOUT);10361036+ /*10371037+ * Check DLL clock lock and synchronization status before updating10381038+ * configuration.10391039+ */10401040+ if (aq->caps->has_dllon)10411041+ ret = readl_poll_timeout(aq->regs + QSPI_SR2, val,10421042+ (val & QSPI_SR2_DLOCK) &&10431043+ !(val & QSPI_SR2_CALBSY), 40,10441044+ ATMEL_QSPI_TIMEOUT);10451045+ else10461046+ ret = readl_poll_timeout(aq->regs + QSPI_SR2, val,10471047+ !(val & QSPI_SR2_CALBSY), 40,10481048+ ATMEL_QSPI_TIMEOUT);1041104910421050 /* Refresh analogic blocks every 1 ms.*/10431051 atmel_qspi_write(FIELD_PREP(QSPI_REFRESH_DELAY_COUNTER,···10651049 int ret;1066105010671051 /* Disable DLL before setting GCLK */10681068- status = atmel_qspi_read(aq, QSPI_SR2);10691069- if (status & QSPI_SR2_DLOCK) {10701070- atmel_qspi_write(QSPI_CR_DLLOFF, aq, QSPI_CR);10521052+ if (aq->caps->has_dllon) {10531053+ status = atmel_qspi_read(aq, QSPI_SR2);10541054+ if (status & QSPI_SR2_DLOCK) {10551055+ atmel_qspi_write(QSPI_CR_DLLOFF, aq, QSPI_CR);10561056+ ret = readl_poll_timeout(aq->regs + QSPI_SR2, val,10571057+ !(val & QSPI_SR2_DLOCK), 40,10581058+ ATMEL_QSPI_TIMEOUT);10591059+ if (ret)10601060+ return ret;10611061+ }1071106210721072- ret = readl_poll_timeout(aq->regs + QSPI_SR2, val,10731073- !(val & QSPI_SR2_DLOCK), 40,10741074- ATMEL_QSPI_TIMEOUT);10751075- if (ret)10761076- return ret;10631063+ if (aq->target_max_speed_hz > QSPI_DLLCFG_THRESHOLD_FREQ)10641064+ atmel_qspi_write(QSPI_DLLCFG_RANGE, aq, QSPI_DLLCFG);10651065+ else10661066+ atmel_qspi_write(0, aq, QSPI_DLLCFG);10771067 }1078106810791079- if (aq->target_max_speed_hz > QSPI_DLLCFG_THRESHOLD_FREQ)10801080- atmel_qspi_write(QSPI_DLLCFG_RANGE, aq, QSPI_DLLCFG);10691069+ if (aq->caps->has_2xgclk)10701070+ ret = clk_set_rate(aq->gclk, 2 * aq->target_max_speed_hz);10811071 else10821082- atmel_qspi_write(0, aq, QSPI_DLLCFG);10721072+ ret = clk_set_rate(aq->gclk, aq->target_max_speed_hz);1083107310841084- ret = clk_set_rate(aq->gclk, aq->target_max_speed_hz);10851074 if (ret) {10861075 dev_err(&aq->pdev->dev, "Failed to set generic clock rate.\n");10871076 return ret;···11091088 if (ret)11101089 return ret;1111109011121112- if (aq->caps->octal) {10911091+ /*10921092+ * Check if the SoC supports pad calibration in Octal SPI mode.10931093+ * Proceed only if both the capabilities are true.10941094+ */10951095+ if (aq->caps->octal && aq->caps->has_padcalib) {11131096 ret = atmel_qspi_set_pad_calibration(aq);11141097 if (ret)11151098 return ret;11161116- } else {10991099+ /* Start DLL on only if the SoC supports the same */11001100+ } else if (aq->caps->has_dllon) {11171101 atmel_qspi_write(QSPI_CR_DLLON, aq, QSPI_CR);11181102 ret = readl_poll_timeout(aq->regs + QSPI_SR2, val,11191103 (val & QSPI_SR2_DLOCK), 40,···1484145814851459 clk_disable_unprepare(aq->gclk);1486146014871487- atmel_qspi_write(QSPI_CR_DLLOFF, aq, QSPI_CR);14881488- ret = readl_poll_timeout(aq->regs + QSPI_SR2, val,14891489- !(val & QSPI_SR2_DLOCK), 40,14901490- ATMEL_QSPI_TIMEOUT);14911491- if (ret)14921492- return ret;14611461+ if (aq->caps->has_dllon) {14621462+ atmel_qspi_write(QSPI_CR_DLLOFF, aq, QSPI_CR);14631463+ ret = readl_poll_timeout(aq->regs + QSPI_SR2, val,14641464+ !(val & QSPI_SR2_DLOCK), 40,14651465+ ATMEL_QSPI_TIMEOUT);14661466+ if (ret)14671467+ return ret;14681468+ }1493146914941494- ret = readl_poll_timeout(aq->regs + QSPI_SR2, val,14951495- !(val & QSPI_SR2_CALBSY), 40,14961496- ATMEL_QSPI_TIMEOUT);14971497- if (ret)14981498- return ret;14991499-14701470+ if (aq->caps->has_padcalib)14711471+ return readl_poll_timeout(aq->regs + QSPI_SR2, val,14721472+ !(val & QSPI_SR2_CALBSY), 40,14731473+ ATMEL_QSPI_TIMEOUT);15001474 return 0;15011475}15021476···16281602 .has_ricr = true,16291603};1630160416051605+static const struct atmel_qspi_caps atmel_sam9x7_ospi_caps = {16061606+ .max_speed_hz = SAM9X7_QSPI_MAX_SPEED_HZ,16071607+ .has_gclk = true,16081608+ .octal = true,16091609+ .has_dma = true,16101610+ .has_2xgclk = true,16111611+ .has_padcalib = false,16121612+ .has_dllon = false,16131613+};16141614+16151615+static const struct atmel_qspi_caps atmel_sama7d65_ospi_caps = {16161616+ .max_speed_hz = SAMA7G5_QSPI0_MAX_SPEED_HZ,16171617+ .has_gclk = true,16181618+ .octal = true,16191619+ .has_dma = true,16201620+ .has_2xgclk = true,16211621+ .has_padcalib = true,16221622+ .has_dllon = false,16231623+};16241624+16251625+static const struct atmel_qspi_caps atmel_sama7d65_qspi_caps = {16261626+ .max_speed_hz = SAMA7G5_QSPI1_SDR_MAX_SPEED_HZ,16271627+ .has_gclk = true,16281628+ .has_dma = true,16291629+ .has_2xgclk = true,16301630+ .has_dllon = false,16311631+};16321632+16311633static const struct atmel_qspi_caps atmel_sama7g5_ospi_caps = {16321634 .max_speed_hz = SAMA7G5_QSPI0_MAX_SPEED_HZ,16331635 .has_gclk = true,16341636 .octal = true,16351637 .has_dma = true,16381638+ .has_padcalib = true,16391639+ .has_dllon = true,16361640};1637164116381642static const struct atmel_qspi_caps atmel_sama7g5_qspi_caps = {16391643 .max_speed_hz = SAMA7G5_QSPI1_SDR_MAX_SPEED_HZ,16401644 .has_gclk = true,16411645 .has_dma = true,16461646+ .has_dllon = true,16421647};1643164816441649static const struct of_device_id atmel_qspi_dt_ids[] = {···16891632 .compatible = "microchip,sama7g5-qspi",16901633 .data = &atmel_sama7g5_qspi_caps,16911634 },16351635+ {16361636+ .compatible = "microchip,sam9x7-ospi",16371637+ .data = &atmel_sam9x7_ospi_caps,16381638+ },16391639+ {16401640+ .compatible = "microchip,sama7d65-ospi",16411641+ .data = &atmel_sama7d65_ospi_caps,16421642+ },16431643+ {16441644+ .compatible = "microchip,sama7d65-qspi",16451645+ .data = &atmel_sama7d65_qspi_caps,16461646+ },16471647+1692164816931649 { /* sentinel */ }16941650};
+3-3
drivers/tty/hvc/hvc_console.c
···543543 }544544545545 /*546546- * Racy, but harmless, kick thread if there is still pending data.546546+ * Kick thread to flush if there's still pending data547547+ * or to wakeup the write queue.547548 */548548- if (hp->n_outbuf)549549- hvc_kick();549549+ hvc_kick();550550551551 return written;552552}
···101101 return string_length;102102}103103104104+static void xhci_dbc_init_ep_contexts(struct xhci_dbc *dbc)105105+{106106+ struct xhci_ep_ctx *ep_ctx;107107+ unsigned int max_burst;108108+ dma_addr_t deq;109109+110110+ max_burst = DBC_CTRL_MAXBURST(readl(&dbc->regs->control));111111+112112+ /* Populate bulk out endpoint context: */113113+ ep_ctx = dbc_bulkout_ctx(dbc);114114+ deq = dbc_bulkout_enq(dbc);115115+ ep_ctx->ep_info = 0;116116+ ep_ctx->ep_info2 = dbc_epctx_info2(BULK_OUT_EP, 1024, max_burst);117117+ ep_ctx->deq = cpu_to_le64(deq | dbc->ring_out->cycle_state);118118+119119+ /* Populate bulk in endpoint context: */120120+ ep_ctx = dbc_bulkin_ctx(dbc);121121+ deq = dbc_bulkin_enq(dbc);122122+ ep_ctx->ep_info = 0;123123+ ep_ctx->ep_info2 = dbc_epctx_info2(BULK_IN_EP, 1024, max_burst);124124+ ep_ctx->deq = cpu_to_le64(deq | dbc->ring_in->cycle_state);125125+}126126+104127static void xhci_dbc_init_contexts(struct xhci_dbc *dbc, u32 string_length)105128{106129 struct dbc_info_context *info;107107- struct xhci_ep_ctx *ep_ctx;108130 u32 dev_info;109109- dma_addr_t deq, dma;110110- unsigned int max_burst;131131+ dma_addr_t dma;111132112133 if (!dbc)113134 return;···142121 info->serial = cpu_to_le64(dma + DBC_MAX_STRING_LENGTH * 3);143122 info->length = cpu_to_le32(string_length);144123145145- /* Populate bulk out endpoint context: */146146- ep_ctx = dbc_bulkout_ctx(dbc);147147- max_burst = DBC_CTRL_MAXBURST(readl(&dbc->regs->control));148148- deq = dbc_bulkout_enq(dbc);149149- ep_ctx->ep_info = 0;150150- ep_ctx->ep_info2 = dbc_epctx_info2(BULK_OUT_EP, 1024, max_burst);151151- ep_ctx->deq = cpu_to_le64(deq | dbc->ring_out->cycle_state);152152-153153- /* Populate bulk in endpoint context: */154154- ep_ctx = dbc_bulkin_ctx(dbc);155155- deq = dbc_bulkin_enq(dbc);156156- ep_ctx->ep_info = 0;157157- ep_ctx->ep_info2 = dbc_epctx_info2(BULK_IN_EP, 1024, max_burst);158158- ep_ctx->deq = cpu_to_le64(deq | dbc->ring_in->cycle_state);124124+ /* Populate bulk in and out endpoint contexts: */125125+ xhci_dbc_init_ep_contexts(dbc);159126160127 /* Set DbC context and info registers: */161128 lo_hi_writeq(dbc->ctx->dma, &dbc->regs->dccp);···445436 return ctx;446437}447438439439+static void xhci_dbc_ring_init(struct xhci_ring *ring)440440+{441441+ struct xhci_segment *seg = ring->first_seg;442442+443443+ /* clear all trbs on ring in case of old ring */444444+ memset(seg->trbs, 0, TRB_SEGMENT_SIZE);445445+446446+ /* Only event ring does not use link TRB */447447+ if (ring->type != TYPE_EVENT) {448448+ union xhci_trb *trb = &seg->trbs[TRBS_PER_SEGMENT - 1];449449+450450+ trb->link.segment_ptr = cpu_to_le64(ring->first_seg->dma);451451+ trb->link.control = cpu_to_le32(LINK_TOGGLE | TRB_TYPE(TRB_LINK));452452+ }453453+ xhci_initialize_ring_info(ring);454454+}455455+456456+static int xhci_dbc_reinit_ep_rings(struct xhci_dbc *dbc)457457+{458458+ struct xhci_ring *in_ring = dbc->eps[BULK_IN].ring;459459+ struct xhci_ring *out_ring = dbc->eps[BULK_OUT].ring;460460+461461+ if (!in_ring || !out_ring || !dbc->ctx) {462462+ dev_warn(dbc->dev, "Can't re-init unallocated endpoints\n");463463+ return -ENODEV;464464+ }465465+466466+ xhci_dbc_ring_init(in_ring);467467+ xhci_dbc_ring_init(out_ring);468468+469469+ /* set ep context enqueue, dequeue, and cycle to initial values */470470+ xhci_dbc_init_ep_contexts(dbc);471471+472472+ return 0;473473+}474474+448475static struct xhci_ring *449476xhci_dbc_ring_alloc(struct device *dev, enum xhci_ring_type type, gfp_t flags)450477{···509464510465 seg->dma = dma;511466512512- /* Only event ring does not use link TRB */513513- if (type != TYPE_EVENT) {514514- union xhci_trb *trb = &seg->trbs[TRBS_PER_SEGMENT - 1];515515-516516- trb->link.segment_ptr = cpu_to_le64(dma);517517- trb->link.control = cpu_to_le32(LINK_TOGGLE | TRB_TYPE(TRB_LINK));518518- }519467 INIT_LIST_HEAD(&ring->td_list);520520- xhci_initialize_ring_info(ring);468468+469469+ xhci_dbc_ring_init(ring);470470+521471 return ring;522472dma_fail:523473 kfree(seg);···904864 dev_info(dbc->dev, "DbC cable unplugged\n");905865 dbc->state = DS_ENABLED;906866 xhci_dbc_flush_requests(dbc);907907-867867+ xhci_dbc_reinit_ep_rings(dbc);908868 return EVT_DISC;909869 }910870···914874 writel(portsc, &dbc->regs->portsc);915875 dbc->state = DS_ENABLED;916876 xhci_dbc_flush_requests(dbc);917917-877877+ xhci_dbc_reinit_ep_rings(dbc);918878 return EVT_DISC;919879 }920880
+1-1
drivers/usb/host/xhci-mem.c
···962962out:963963 /* we are now at a leaf device */964964 xhci_debugfs_remove_slot(xhci, slot_id);965965- xhci_free_virt_device(xhci, vdev, slot_id);965965+ xhci_free_virt_device(xhci, xhci->devs[slot_id], slot_id);966966}967967968968int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
···24262426 case ADEV_NONE:24272427 break;24282428 case ADEV_NOTIFY_USB_AND_QUEUE_VDM:24292429- WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB, NULL));24302430- typec_altmode_vdm(adev, p[0], &p[1], cnt);24292429+ if (rx_sop_type == TCPC_TX_SOP_PRIME) {24302430+ typec_cable_altmode_vdm(adev, TYPEC_PLUG_SOP_P, p[0], &p[1], cnt);24312431+ } else {24322432+ WARN_ON(typec_altmode_notify(adev, TYPEC_STATE_USB, NULL));24332433+ typec_altmode_vdm(adev, p[0], &p[1], cnt);24342434+ }24312435 break;24322436 case ADEV_QUEUE_VDM:24332433- if (response_tx_sop_type == TCPC_TX_SOP_PRIME)24372437+ if (rx_sop_type == TCPC_TX_SOP_PRIME)24342438 typec_cable_altmode_vdm(adev, TYPEC_PLUG_SOP_P, p[0], &p[1], cnt);24352439 else24362440 typec_altmode_vdm(adev, p[0], &p[1], cnt);24372441 break;24382442 case ADEV_QUEUE_VDM_SEND_EXIT_MODE_ON_FAIL:24392439- if (response_tx_sop_type == TCPC_TX_SOP_PRIME) {24432443+ if (rx_sop_type == TCPC_TX_SOP_PRIME) {24402444 if (typec_cable_altmode_vdm(adev, TYPEC_PLUG_SOP_P,24412445 p[0], &p[1], cnt)) {24422446 int svdm_version = typec_get_cable_svdm_version(
+30-10
fs/btrfs/extent_io.c
···111111 */112112 unsigned long submit_bitmap;113113 struct readahead_control *ractl;114114+115115+ /*116116+ * The start offset of the last used extent map by a read operation.117117+ *118118+ * This is for proper compressed read merge.119119+ * U64_MAX means we are starting the read and have made no progress yet.120120+ *121121+ * The current btrfs_bio_is_contig() only uses disk_bytenr as122122+ * the condition to check if the read can be merged with previous123123+ * bio, which is not correct. E.g. two file extents pointing to the124124+ * same extent but with different offset.125125+ *126126+ * So here we need to do extra checks to only merge reads that are127127+ * covered by the same extent map.128128+ * Just extent_map::start will be enough, as they are unique129129+ * inside the same inode.130130+ */131131+ u64 last_em_start;114132};115133116134static void submit_one_bio(struct btrfs_bio_ctrl *bio_ctrl)···927909 * return 0 on success, otherwise return error928910 */929911static int btrfs_do_readpage(struct folio *folio, struct extent_map **em_cached,930930- struct btrfs_bio_ctrl *bio_ctrl, u64 *prev_em_start)912912+ struct btrfs_bio_ctrl *bio_ctrl)931913{932914 struct inode *inode = folio->mapping->host;933915 struct btrfs_fs_info *fs_info = inode_to_fs_info(inode);···10371019 * non-optimal behavior (submitting 2 bios for the same extent).10381020 */10391021 if (compress_type != BTRFS_COMPRESS_NONE &&10401040- prev_em_start && *prev_em_start != (u64)-1 &&10411041- *prev_em_start != em->start)10221022+ bio_ctrl->last_em_start != U64_MAX &&10231023+ bio_ctrl->last_em_start != em->start)10421024 force_bio_submit = true;1043102510441044- if (prev_em_start)10451045- *prev_em_start = em->start;10261026+ bio_ctrl->last_em_start = em->start;1046102710471028 btrfs_free_extent_map(em);10481029 em = NULL;···12551238 const u64 start = folio_pos(folio);12561239 const u64 end = start + folio_size(folio) - 1;12571240 struct extent_state *cached_state = NULL;12581258- struct btrfs_bio_ctrl bio_ctrl = { .opf = REQ_OP_READ };12411241+ struct btrfs_bio_ctrl bio_ctrl = {12421242+ .opf = REQ_OP_READ,12431243+ .last_em_start = U64_MAX,12441244+ };12591245 struct extent_map *em_cached = NULL;12601246 int ret;1261124712621248 lock_extents_for_read(inode, start, end, &cached_state);12631263- ret = btrfs_do_readpage(folio, &em_cached, &bio_ctrl, NULL);12491249+ ret = btrfs_do_readpage(folio, &em_cached, &bio_ctrl);12641250 btrfs_unlock_extent(&inode->io_tree, start, end, &cached_state);1265125112661252 btrfs_free_extent_map(em_cached);···26032583{26042584 struct btrfs_bio_ctrl bio_ctrl = {26052585 .opf = REQ_OP_READ | REQ_RAHEAD,26062606- .ractl = rac25862586+ .ractl = rac,25872587+ .last_em_start = U64_MAX,26072588 };26082589 struct folio *folio;26092590 struct btrfs_inode *inode = BTRFS_I(rac->mapping->host);···26122591 const u64 end = start + readahead_length(rac) - 1;26132592 struct extent_state *cached_state = NULL;26142593 struct extent_map *em_cached = NULL;26152615- u64 prev_em_start = (u64)-1;2616259426172595 lock_extents_for_read(inode, start, end, &cached_state);2618259626192597 while ((folio = readahead_folio(rac)) != NULL)26202620- btrfs_do_readpage(folio, &em_cached, &bio_ctrl, &prev_em_start);25982598+ btrfs_do_readpage(folio, &em_cached, &bio_ctrl);2621259926222600 btrfs_unlock_extent(&inode->io_tree, start, end, &cached_state);26232601
+11-1
fs/btrfs/inode.c
···56965696 bool empty = false;5697569756985698 xa_lock(&root->inodes);56995699- entry = __xa_erase(&root->inodes, btrfs_ino(inode));56995699+ /*57005700+ * This btrfs_inode is being freed and has already been unhashed at this57015701+ * point. It's possible that another btrfs_inode has already been57025702+ * allocated for the same inode and inserted itself into the root, so57035703+ * don't delete it in that case.57045704+ *57055705+ * Note that this shouldn't need to allocate memory, so the gfp flags57065706+ * don't really matter.57075707+ */57085708+ entry = __xa_cmpxchg(&root->inodes, btrfs_ino(inode), inode, NULL,57095709+ GFP_ATOMIC);57005710 if (entry == inode)57015711 empty = xa_empty(&root->inodes);57025712 xa_unlock(&root->inodes);
···1271127112721272 /* If op failed, mark everyone involved for errors */12731273 if (result) {12741274- int pathlen = 0;12751275- u64 base = 0;12761276- char *path = ceph_mdsc_build_path(mdsc, dentry, &pathlen,12771277- &base, 0);12741274+ struct ceph_path_info path_info = {0};12751275+ char *path = ceph_mdsc_build_path(mdsc, dentry, &path_info, 0);1278127612791277 /* mark error on parent + clear complete */12801278 mapping_set_error(req->r_parent->i_mapping, result);···12861288 mapping_set_error(req->r_old_inode->i_mapping, result);1287128912881290 pr_warn_client(cl, "failure path=(%llx)%s result=%d!\n",12891289- base, IS_ERR(path) ? "<<bad>>" : path, result);12901290- ceph_mdsc_free_path(path, pathlen);12911291+ path_info.vino.ino, IS_ERR(path) ? "<<bad>>" : path, result);12921292+ ceph_mdsc_free_path_info(&path_info);12911293 }12921294out:12931295 iput(req->r_old_inode);···13451347 int err = -EROFS;13461348 int op;13471349 char *path;13481348- int pathlen;13491349- u64 pathbase;1350135013511351 if (ceph_snap(dir) == CEPH_SNAPDIR) {13521352 /* rmdir .snap/foo is RMSNAP */···13631367 if (!dn) {13641368 try_async = false;13651369 } else {13661366- path = ceph_mdsc_build_path(mdsc, dn, &pathlen, &pathbase, 0);13701370+ struct ceph_path_info path_info;13711371+ path = ceph_mdsc_build_path(mdsc, dn, &path_info, 0);13671372 if (IS_ERR(path)) {13681373 try_async = false;13691374 err = 0;13701375 } else {13711376 err = ceph_mds_check_access(mdsc, path, MAY_WRITE);13721377 }13731373- ceph_mdsc_free_path(path, pathlen);13781378+ ceph_mdsc_free_path_info(&path_info);13741379 dput(dn);1375138013761381 /* For none EACCES cases will let the MDS do the mds auth check */
+10-14
fs/ceph/file.c
···368368 int flags, fmode, wanted;369369 struct dentry *dentry;370370 char *path;371371- int pathlen;372372- u64 pathbase;373371 bool do_sync = false;374372 int mask = MAY_READ;375373···397399 if (!dentry) {398400 do_sync = true;399401 } else {400400- path = ceph_mdsc_build_path(mdsc, dentry, &pathlen, &pathbase, 0);402402+ struct ceph_path_info path_info;403403+ path = ceph_mdsc_build_path(mdsc, dentry, &path_info, 0);401404 if (IS_ERR(path)) {402405 do_sync = true;403406 err = 0;404407 } else {405408 err = ceph_mds_check_access(mdsc, path, mask);406409 }407407- ceph_mdsc_free_path(path, pathlen);410410+ ceph_mdsc_free_path_info(&path_info);408411 dput(dentry);409412410413 /* For none EACCES cases will let the MDS do the mds auth check */···613614 mapping_set_error(req->r_parent->i_mapping, result);614615615616 if (result) {616616- int pathlen = 0;617617- u64 base = 0;618618- char *path = ceph_mdsc_build_path(mdsc, req->r_dentry, &pathlen,619619- &base, 0);617617+ struct ceph_path_info path_info = {0};618618+ char *path = ceph_mdsc_build_path(mdsc, req->r_dentry, &path_info, 0);620619621620 pr_warn_client(cl,622621 "async create failure path=(%llx)%s result=%d!\n",623623- base, IS_ERR(path) ? "<<bad>>" : path, result);624624- ceph_mdsc_free_path(path, pathlen);622622+ path_info.vino.ino, IS_ERR(path) ? "<<bad>>" : path, result);623623+ ceph_mdsc_free_path_info(&path_info);625624626625 ceph_dir_clear_complete(req->r_parent);627626 if (!d_unhashed(dentry))···788791 int mask;789792 int err;790793 char *path;791791- int pathlen;792792- u64 pathbase;793794794795 doutc(cl, "%p %llx.%llx dentry %p '%pd' %s flags %d mode 0%o\n",795796 dir, ceph_vinop(dir), dentry, dentry,···809814 if (!dn) {810815 try_async = false;811816 } else {812812- path = ceph_mdsc_build_path(mdsc, dn, &pathlen, &pathbase, 0);817817+ struct ceph_path_info path_info;818818+ path = ceph_mdsc_build_path(mdsc, dn, &path_info, 0);813819 if (IS_ERR(path)) {814820 try_async = false;815821 err = 0;···822826 mask |= MAY_WRITE;823827 err = ceph_mds_check_access(mdsc, path, mask);824828 }825825- ceph_mdsc_free_path(path, pathlen);829829+ ceph_mdsc_free_path_info(&path_info);826830 dput(dn);827831828832 /* For none EACCES cases will let the MDS do the mds auth check */
+72-16
fs/ceph/inode.c
···5555 return 0;5656}57575858+/*5959+ * Check if the parent inode matches the vino from directory reply info6060+ */6161+static inline bool ceph_vino_matches_parent(struct inode *parent,6262+ struct ceph_vino vino)6363+{6464+ return ceph_ino(parent) == vino.ino && ceph_snap(parent) == vino.snap;6565+}6666+6767+/*6868+ * Validate that the directory inode referenced by @req->r_parent matches the6969+ * inode number and snapshot id contained in the reply's directory record. If7070+ * they do not match – which can theoretically happen if the parent dentry was7171+ * moved between the time the request was issued and the reply arrived – fall7272+ * back to looking up the correct inode in the inode cache.7373+ *7474+ * A reference is *always* returned. Callers that receive a different inode7575+ * than the original @parent are responsible for dropping the extra reference7676+ * once the reply has been processed.7777+ */7878+static struct inode *ceph_get_reply_dir(struct super_block *sb,7979+ struct inode *parent,8080+ struct ceph_mds_reply_info_parsed *rinfo)8181+{8282+ struct ceph_vino vino;8383+8484+ if (unlikely(!rinfo->diri.in))8585+ return parent; /* nothing to compare against */8686+8787+ /* If we didn't have a cached parent inode to begin with, just bail out. */8888+ if (!parent)8989+ return NULL;9090+9191+ vino.ino = le64_to_cpu(rinfo->diri.in->ino);9292+ vino.snap = le64_to_cpu(rinfo->diri.in->snapid);9393+9494+ if (likely(ceph_vino_matches_parent(parent, vino)))9595+ return parent; /* matches – use the original reference */9696+9797+ /* Mismatch – this should be rare. Emit a WARN and obtain the correct inode. */9898+ WARN_ONCE(1, "ceph: reply dir mismatch (parent valid %llx.%llx reply %llx.%llx)\n",9999+ ceph_ino(parent), ceph_snap(parent), vino.ino, vino.snap);100100+101101+ return ceph_get_inode(sb, vino, NULL);102102+}103103+58104/**59105 * ceph_new_inode - allocate a new inode in advance of an expected create60106 * @dir: parent directory for new inode···15691523 struct ceph_vino tvino, dvino;15701524 struct ceph_fs_client *fsc = ceph_sb_to_fs_client(sb);15711525 struct ceph_client *cl = fsc->client;15261526+ struct inode *parent_dir = NULL;15721527 int err = 0;1573152815741529 doutc(cl, "%p is_dentry %d is_target %d\n", req,···15831536 }1584153715851538 if (rinfo->head->is_dentry) {15861586- struct inode *dir = req->r_parent;15871587-15881588- if (dir) {15891589- err = ceph_fill_inode(dir, NULL, &rinfo->diri,15391539+ /*15401540+ * r_parent may be stale, in cases when R_PARENT_LOCKED is not set,15411541+ * so we need to get the correct inode15421542+ */15431543+ parent_dir = ceph_get_reply_dir(sb, req->r_parent, rinfo);15441544+ if (unlikely(IS_ERR(parent_dir))) {15451545+ err = PTR_ERR(parent_dir);15461546+ goto done;15471547+ }15481548+ if (parent_dir) {15491549+ err = ceph_fill_inode(parent_dir, NULL, &rinfo->diri,15901550 rinfo->dirfrag, session, -1,15911551 &req->r_caps_reservation);15921552 if (err < 0)···16021548 WARN_ON_ONCE(1);16031549 }1604155016051605- if (dir && req->r_op == CEPH_MDS_OP_LOOKUPNAME &&15511551+ if (parent_dir && req->r_op == CEPH_MDS_OP_LOOKUPNAME &&16061552 test_bit(CEPH_MDS_R_PARENT_LOCKED, &req->r_req_flags) &&16071553 !test_bit(CEPH_MDS_R_ABORTED, &req->r_req_flags)) {16081554 bool is_nokey = false;16091555 struct qstr dname;16101556 struct dentry *dn, *parent;16111557 struct fscrypt_str oname = FSTR_INIT(NULL, 0);16121612- struct ceph_fname fname = { .dir = dir,15581558+ struct ceph_fname fname = { .dir = parent_dir,16131559 .name = rinfo->dname,16141560 .ctext = rinfo->altname,16151561 .name_len = rinfo->dname_len,···16181564 BUG_ON(!rinfo->head->is_target);16191565 BUG_ON(req->r_dentry);1620156616211621- parent = d_find_any_alias(dir);15671567+ parent = d_find_any_alias(parent_dir);16221568 BUG_ON(!parent);1623156916241624- err = ceph_fname_alloc_buffer(dir, &oname);15701570+ err = ceph_fname_alloc_buffer(parent_dir, &oname);16251571 if (err < 0) {16261572 dput(parent);16271573 goto done;···16301576 err = ceph_fname_to_usr(&fname, NULL, &oname, &is_nokey);16311577 if (err < 0) {16321578 dput(parent);16331633- ceph_fname_free_buffer(dir, &oname);15791579+ ceph_fname_free_buffer(parent_dir, &oname);16341580 goto done;16351581 }16361582 dname.name = oname.name;···16491595 dname.len, dname.name, dn);16501596 if (!dn) {16511597 dput(parent);16521652- ceph_fname_free_buffer(dir, &oname);15981598+ ceph_fname_free_buffer(parent_dir, &oname);16531599 err = -ENOMEM;16541600 goto done;16551601 }···16641610 ceph_snap(d_inode(dn)) != tvino.snap)) {16651611 doutc(cl, " dn %p points to wrong inode %p\n",16661612 dn, d_inode(dn));16671667- ceph_dir_clear_ordered(dir);16131613+ ceph_dir_clear_ordered(parent_dir);16681614 d_delete(dn);16691615 dput(dn);16701616 goto retry_lookup;16711617 }16721672- ceph_fname_free_buffer(dir, &oname);16181618+ ceph_fname_free_buffer(parent_dir, &oname);1673161916741620 req->r_dentry = dn;16751621 dput(parent);···18481794 &dvino, ptvino);18491795 }18501796done:17971797+ /* Drop extra ref from ceph_get_reply_dir() if it returned a new inode */17981798+ if (unlikely(!IS_ERR_OR_NULL(parent_dir) && parent_dir != req->r_parent))17991799+ iput(parent_dir);18511800 doutc(cl, "done err=%d\n", err);18521801 return err;18531802}···25442487 int truncate_retry = 20; /* The RMW will take around 50ms */25452488 struct dentry *dentry;25462489 char *path;25472547- int pathlen;25482548- u64 pathbase;25492490 bool do_sync = false;2550249125512492 dentry = d_find_alias(inode);25522493 if (!dentry) {25532494 do_sync = true;25542495 } else {25552555- path = ceph_mdsc_build_path(mdsc, dentry, &pathlen, &pathbase, 0);24962496+ struct ceph_path_info path_info;24972497+ path = ceph_mdsc_build_path(mdsc, dentry, &path_info, 0);25562498 if (IS_ERR(path)) {25572499 do_sync = true;25582500 err = 0;25592501 } else {25602502 err = ceph_mds_check_access(mdsc, path, MAY_WRITE);25612503 }25622562- ceph_mdsc_free_path(path, pathlen);25042504+ ceph_mdsc_free_path_info(&path_info);25632505 dput(dentry);2564250625652507 /* For none EACCES cases will let the MDS do the mds auth check */
+105-67
fs/ceph/mds_client.c
···26812681 * ceph_mdsc_build_path - build a path string to a given dentry26822682 * @mdsc: mds client26832683 * @dentry: dentry to which path should be built26842684- * @plen: returned length of string26852685- * @pbase: returned base inode number26842684+ * @path_info: output path, length, base ino+snap, and freepath ownership flag26862685 * @for_wire: is this path going to be sent to the MDS?26872686 *26882687 * Build a string that represents the path to the dentry. This is mostly called···26992700 * foo/.snap/bar -> foo//bar27002701 */27012702char *ceph_mdsc_build_path(struct ceph_mds_client *mdsc, struct dentry *dentry,27022702- int *plen, u64 *pbase, int for_wire)27032703+ struct ceph_path_info *path_info, int for_wire)27032704{27042705 struct ceph_client *cl = mdsc->fsc->client;27052706 struct dentry *cur;···28092810 return ERR_PTR(-ENAMETOOLONG);28102811 }2811281228122812- *pbase = base;28132813- *plen = PATH_MAX - 1 - pos;28132813+ /* Initialize the output structure */28142814+ memset(path_info, 0, sizeof(*path_info));28152815+28162816+ path_info->vino.ino = base;28172817+ path_info->pathlen = PATH_MAX - 1 - pos;28182818+ path_info->path = path + pos;28192819+ path_info->freepath = true;28202820+28212821+ /* Set snap from dentry if available */28222822+ if (d_inode(dentry))28232823+ path_info->vino.snap = ceph_snap(d_inode(dentry));28242824+ else28252825+ path_info->vino.snap = CEPH_NOSNAP;28262826+28142827 doutc(cl, "on %p %d built %llx '%.*s'\n", dentry, d_count(dentry),28152815- base, *plen, path + pos);28282828+ base, PATH_MAX - 1 - pos, path + pos);28162829 return path + pos;28172830}2818283128192832static int build_dentry_path(struct ceph_mds_client *mdsc, struct dentry *dentry,28202820- struct inode *dir, const char **ppath, int *ppathlen,28212821- u64 *pino, bool *pfreepath, bool parent_locked)28332833+ struct inode *dir, struct ceph_path_info *path_info,28342834+ bool parent_locked)28222835{28232836 char *path;28242837···28392828 dir = d_inode_rcu(dentry->d_parent);28402829 if (dir && parent_locked && ceph_snap(dir) == CEPH_NOSNAP &&28412830 !IS_ENCRYPTED(dir)) {28422842- *pino = ceph_ino(dir);28312831+ path_info->vino.ino = ceph_ino(dir);28322832+ path_info->vino.snap = ceph_snap(dir);28432833 rcu_read_unlock();28442844- *ppath = dentry->d_name.name;28452845- *ppathlen = dentry->d_name.len;28342834+ path_info->path = dentry->d_name.name;28352835+ path_info->pathlen = dentry->d_name.len;28362836+ path_info->freepath = false;28462837 return 0;28472838 }28482839 rcu_read_unlock();28492849- path = ceph_mdsc_build_path(mdsc, dentry, ppathlen, pino, 1);28402840+ path = ceph_mdsc_build_path(mdsc, dentry, path_info, 1);28502841 if (IS_ERR(path))28512842 return PTR_ERR(path);28522852- *ppath = path;28532853- *pfreepath = true;28432843+ /*28442844+ * ceph_mdsc_build_path already fills path_info, including snap handling.28452845+ */28542846 return 0;28552847}2856284828572857-static int build_inode_path(struct inode *inode,28582858- const char **ppath, int *ppathlen, u64 *pino,28592859- bool *pfreepath)28492849+static int build_inode_path(struct inode *inode, struct ceph_path_info *path_info)28602850{28612851 struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(inode->i_sb);28622852 struct dentry *dentry;28632853 char *path;2864285428652855 if (ceph_snap(inode) == CEPH_NOSNAP) {28662866- *pino = ceph_ino(inode);28672867- *ppathlen = 0;28562856+ path_info->vino.ino = ceph_ino(inode);28572857+ path_info->vino.snap = ceph_snap(inode);28582858+ path_info->pathlen = 0;28592859+ path_info->freepath = false;28682860 return 0;28692861 }28702862 dentry = d_find_alias(inode);28712871- path = ceph_mdsc_build_path(mdsc, dentry, ppathlen, pino, 1);28632863+ path = ceph_mdsc_build_path(mdsc, dentry, path_info, 1);28722864 dput(dentry);28732865 if (IS_ERR(path))28742866 return PTR_ERR(path);28752875- *ppath = path;28762876- *pfreepath = true;28672867+ /*28682868+ * ceph_mdsc_build_path already fills path_info, including snap from dentry.28692869+ * Override with inode's snap since that's what this function is for.28702870+ */28712871+ path_info->vino.snap = ceph_snap(inode);28772872 return 0;28782873}28792874···28892872 */28902873static int set_request_path_attr(struct ceph_mds_client *mdsc, struct inode *rinode,28912874 struct dentry *rdentry, struct inode *rdiri,28922892- const char *rpath, u64 rino, const char **ppath,28932893- int *pathlen, u64 *ino, bool *freepath,28752875+ const char *rpath, u64 rino,28762876+ struct ceph_path_info *path_info,28942877 bool parent_locked)28952878{28962879 struct ceph_client *cl = mdsc->fsc->client;28972880 int r = 0;2898288128822882+ /* Initialize the output structure */28832883+ memset(path_info, 0, sizeof(*path_info));28842884+28992885 if (rinode) {29002900- r = build_inode_path(rinode, ppath, pathlen, ino, freepath);28862886+ r = build_inode_path(rinode, path_info);29012887 doutc(cl, " inode %p %llx.%llx\n", rinode, ceph_ino(rinode),29022888 ceph_snap(rinode));29032889 } else if (rdentry) {29042904- r = build_dentry_path(mdsc, rdentry, rdiri, ppath, pathlen, ino,29052905- freepath, parent_locked);29062906- doutc(cl, " dentry %p %llx/%.*s\n", rdentry, *ino, *pathlen, *ppath);28902890+ r = build_dentry_path(mdsc, rdentry, rdiri, path_info, parent_locked);28912891+ doutc(cl, " dentry %p %llx/%.*s\n", rdentry, path_info->vino.ino,28922892+ path_info->pathlen, path_info->path);29072893 } else if (rpath || rino) {29082908- *ino = rino;29092909- *ppath = rpath;29102910- *pathlen = rpath ? strlen(rpath) : 0;29112911- doutc(cl, " path %.*s\n", *pathlen, rpath);28942894+ path_info->vino.ino = rino;28952895+ path_info->vino.snap = CEPH_NOSNAP;28962896+ path_info->path = rpath;28972897+ path_info->pathlen = rpath ? strlen(rpath) : 0;28982898+ path_info->freepath = false;28992899+29002900+ doutc(cl, " path %.*s\n", path_info->pathlen, rpath);29122901 }2913290229142903 return r;···29912968 struct ceph_client *cl = mdsc->fsc->client;29922969 struct ceph_msg *msg;29932970 struct ceph_mds_request_head_legacy *lhead;29942994- const char *path1 = NULL;29952995- const char *path2 = NULL;29962996- u64 ino1 = 0, ino2 = 0;29972997- int pathlen1 = 0, pathlen2 = 0;29982998- bool freepath1 = false, freepath2 = false;29712971+ struct ceph_path_info path_info1 = {0};29722972+ struct ceph_path_info path_info2 = {0};29992973 struct dentry *old_dentry = NULL;30002974 int len;30012975 u16 releases;···30022982 u16 request_head_version = mds_supported_head_version(session);30032983 kuid_t caller_fsuid = req->r_cred->fsuid;30042984 kgid_t caller_fsgid = req->r_cred->fsgid;29852985+ bool parent_locked = test_bit(CEPH_MDS_R_PARENT_LOCKED, &req->r_req_flags);3005298630062987 ret = set_request_path_attr(mdsc, req->r_inode, req->r_dentry,30073007- req->r_parent, req->r_path1, req->r_ino1.ino,30083008- &path1, &pathlen1, &ino1, &freepath1,30093009- test_bit(CEPH_MDS_R_PARENT_LOCKED,30103010- &req->r_req_flags));29882988+ req->r_parent, req->r_path1, req->r_ino1.ino,29892989+ &path_info1, parent_locked);30112990 if (ret < 0) {30122991 msg = ERR_PTR(ret);30132992 goto out;29932993+ }29942994+29952995+ /*29962996+ * When the parent directory's i_rwsem is *not* locked, req->r_parent may29972997+ * have become stale (e.g. after a concurrent rename) between the time the29982998+ * dentry was looked up and now. If we detect that the stored r_parent29992999+ * does not match the inode number we just encoded for the request, switch30003000+ * to the correct inode so that the MDS receives a valid parent reference.30013001+ */30023002+ if (!parent_locked && req->r_parent && path_info1.vino.ino &&30033003+ ceph_ino(req->r_parent) != path_info1.vino.ino) {30043004+ struct inode *old_parent = req->r_parent;30053005+ struct inode *correct_dir = ceph_get_inode(mdsc->fsc->sb, path_info1.vino, NULL);30063006+ if (!IS_ERR(correct_dir)) {30073007+ WARN_ONCE(1, "ceph: r_parent mismatch (had %llx wanted %llx) - updating\n",30083008+ ceph_ino(old_parent), path_info1.vino.ino);30093009+ /*30103010+ * Transfer CEPH_CAP_PIN from the old parent to the new one.30113011+ * The pin was taken earlier in ceph_mdsc_submit_request().30123012+ */30133013+ ceph_put_cap_refs(ceph_inode(old_parent), CEPH_CAP_PIN);30143014+ iput(old_parent);30153015+ req->r_parent = correct_dir;30163016+ ceph_get_cap_refs(ceph_inode(req->r_parent), CEPH_CAP_PIN);30173017+ }30143018 }3015301930163020 /* If r_old_dentry is set, then assume that its parent is locked */···30422998 !(req->r_old_dentry->d_flags & DCACHE_DISCONNECTED))30432999 old_dentry = req->r_old_dentry;30443000 ret = set_request_path_attr(mdsc, NULL, old_dentry,30453045- req->r_old_dentry_dir,30463046- req->r_path2, req->r_ino2.ino,30473047- &path2, &pathlen2, &ino2, &freepath2, true);30013001+ req->r_old_dentry_dir,30023002+ req->r_path2, req->r_ino2.ino,30033003+ &path_info2, true);30483004 if (ret < 0) {30493005 msg = ERR_PTR(ret);30503006 goto out_free1;···3075303130763032 /* filepaths */30773033 len += 2 * (1 + sizeof(u32) + sizeof(u64));30783078- len += pathlen1 + pathlen2;30343034+ len += path_info1.pathlen + path_info2.pathlen;3079303530803036 /* cap releases */30813037 len += sizeof(struct ceph_mds_request_release) *···30833039 !!req->r_old_inode_drop + !!req->r_old_dentry_drop);3084304030853041 if (req->r_dentry_drop)30863086- len += pathlen1;30423042+ len += path_info1.pathlen;30873043 if (req->r_old_dentry_drop)30883088- len += pathlen2;30443044+ len += path_info2.pathlen;3089304530903046 /* MClientRequest tail */30913047···31983154 lhead->ino = cpu_to_le64(req->r_deleg_ino);31993155 lhead->args = req->r_args;3200315632013201- ceph_encode_filepath(&p, end, ino1, path1);32023202- ceph_encode_filepath(&p, end, ino2, path2);31573157+ ceph_encode_filepath(&p, end, path_info1.vino.ino, path_info1.path);31583158+ ceph_encode_filepath(&p, end, path_info2.vino.ino, path_info2.path);3203315932043160 /* make note of release offset, in case we need to replay */32053161 req->r_request_release_offset = p - msg->front.iov_base;···32623218 msg->hdr.data_off = cpu_to_le16(0);3263321932643220out_free2:32653265- if (freepath2)32663266- ceph_mdsc_free_path((char *)path2, pathlen2);32213221+ ceph_mdsc_free_path_info(&path_info2);32673222out_free1:32683268- if (freepath1)32693269- ceph_mdsc_free_path((char *)path1, pathlen1);32233223+ ceph_mdsc_free_path_info(&path_info1);32703224out:32713225 return msg;32723226out_err:···46214579 struct ceph_pagelist *pagelist = recon_state->pagelist;46224580 struct dentry *dentry;46234581 struct ceph_cap *cap;46244624- char *path;46254625- int pathlen = 0, err;46264626- u64 pathbase;45824582+ struct ceph_path_info path_info = {0};45834583+ int err;46274584 u64 snap_follows;4628458546294586 dentry = d_find_primary(inode);46304587 if (dentry) {46314588 /* set pathbase to parent dir when msg_version >= 2 */46324632- path = ceph_mdsc_build_path(mdsc, dentry, &pathlen, &pathbase,45894589+ char *path = ceph_mdsc_build_path(mdsc, dentry, &path_info,46334590 recon_state->msg_version >= 2);46344591 dput(dentry);46354592 if (IS_ERR(path)) {46364593 err = PTR_ERR(path);46374594 goto out_err;46384595 }46394639- } else {46404640- path = NULL;46414641- pathbase = 0;46424596 }4643459746444598 spin_lock(&ci->i_ceph_lock);···46674629 rec.v2.wanted = cpu_to_le32(__ceph_caps_wanted(ci));46684630 rec.v2.issued = cpu_to_le32(cap->issued);46694631 rec.v2.snaprealm = cpu_to_le64(ci->i_snap_realm->ino);46704670- rec.v2.pathbase = cpu_to_le64(pathbase);46324632+ rec.v2.pathbase = cpu_to_le64(path_info.vino.ino);46714633 rec.v2.flock_len = (__force __le32)46724634 ((ci->i_ceph_flags & CEPH_I_ERROR_FILELOCK) ? 0 : 1);46734635 } else {···46824644 ts = inode_get_atime(inode);46834645 ceph_encode_timespec64(&rec.v1.atime, &ts);46844646 rec.v1.snaprealm = cpu_to_le64(ci->i_snap_realm->ino);46854685- rec.v1.pathbase = cpu_to_le64(pathbase);46474647+ rec.v1.pathbase = cpu_to_le64(path_info.vino.ino);46864648 }4687464946884650 if (list_empty(&ci->i_cap_snaps)) {···47444706 sizeof(struct ceph_filelock);47454707 rec.v2.flock_len = cpu_to_le32(struct_len);4746470847474747- struct_len += sizeof(u32) + pathlen + sizeof(rec.v2);47094709+ struct_len += sizeof(u32) + path_info.pathlen + sizeof(rec.v2);4748471047494711 if (struct_v >= 2)47504712 struct_len += sizeof(u64); /* snap_follows */···47684730 ceph_pagelist_encode_8(pagelist, 1);47694731 ceph_pagelist_encode_32(pagelist, struct_len);47704732 }47714771- ceph_pagelist_encode_string(pagelist, path, pathlen);47334733+ ceph_pagelist_encode_string(pagelist, (char *)path_info.path, path_info.pathlen);47724734 ceph_pagelist_append(pagelist, &rec, sizeof(rec.v2));47734735 ceph_locks_to_pagelist(flocks, pagelist,47744736 num_fcntl_locks, num_flock_locks);···47794741 } else {47804742 err = ceph_pagelist_reserve(pagelist,47814743 sizeof(u64) + sizeof(u32) +47824782- pathlen + sizeof(rec.v1));47444744+ path_info.pathlen + sizeof(rec.v1));47834745 if (err)47844746 goto out_err;4785474747864748 ceph_pagelist_encode_64(pagelist, ceph_ino(inode));47874787- ceph_pagelist_encode_string(pagelist, path, pathlen);47494749+ ceph_pagelist_encode_string(pagelist, (char *)path_info.path, path_info.pathlen);47884750 ceph_pagelist_append(pagelist, &rec, sizeof(rec.v1));47894751 }4790475247914753out_err:47924792- ceph_mdsc_free_path(path, pathlen);47544754+ ceph_mdsc_free_path_info(&path_info);47934755 if (!err)47944756 recon_state->nr_caps++;47954757 return err;
+14-4
fs/ceph/mds_client.h
···617617618618extern void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc);619619620620-static inline void ceph_mdsc_free_path(char *path, int len)620620+/*621621+ * Structure to group path-related output parameters for build_*_path functions622622+ */623623+struct ceph_path_info {624624+ const char *path;625625+ int pathlen;626626+ struct ceph_vino vino;627627+ bool freepath;628628+};629629+630630+static inline void ceph_mdsc_free_path_info(const struct ceph_path_info *path_info)621631{622622- if (!IS_ERR_OR_NULL(path))623623- __putname(path - (PATH_MAX - 1 - len));632632+ if (path_info && path_info->freepath && !IS_ERR_OR_NULL(path_info->path))633633+ __putname((char *)path_info->path - (PATH_MAX - 1 - path_info->pathlen));624634}625635626636extern char *ceph_mdsc_build_path(struct ceph_mds_client *mdsc,627627- struct dentry *dentry, int *plen, u64 *base,637637+ struct dentry *dentry, struct ceph_path_info *path_info,628638 int for_wire);629639630640extern void __ceph_mdsc_drop_dentry_lease(struct dentry *dentry);
···1212/* to allow for x86 boot sectors and other oddities. */1313#define EROFS_SUPER_OFFSET 102414141515-#define EROFS_FEATURE_COMPAT_SB_CHKSUM 0x000000011616-#define EROFS_FEATURE_COMPAT_MTIME 0x000000021717-#define EROFS_FEATURE_COMPAT_XATTR_FILTER 0x000000041515+#define EROFS_FEATURE_COMPAT_SB_CHKSUM 0x000000011616+#define EROFS_FEATURE_COMPAT_MTIME 0x000000021717+#define EROFS_FEATURE_COMPAT_XATTR_FILTER 0x000000041818#define EROFS_FEATURE_COMPAT_SHARED_EA_IN_METABOX 0x000000081919+#define EROFS_FEATURE_COMPAT_PLAIN_XATTR_PFX 0x000000102020+19212022/*2123 * Any bits that aren't in EROFS_ALL_FEATURE_INCOMPAT should
···208208 return 1;209209210210 /*211211+ * Verify that the decoded dentry itself has a valid id mapping.212212+ * In case the decoded dentry is the mountfd root itself, this213213+ * verifies that the mountfd inode itself has a valid id mapping.214214+ */215215+ if (!privileged_wrt_inode_uidgid(user_ns, idmap, d_inode(dentry)))216216+ return 0;217217+218218+ /*211219 * It's racy as we're not taking rename_lock but we're able to ignore212220 * permissions and we just need an approximation whether we were able213221 * to follow a path to the file.
+1-1
fs/fuse/dev.c
···1893189318941894 index = outarg->offset >> PAGE_SHIFT;1895189518961896- while (num) {18961896+ while (num && ap->num_folios < num_pages) {18971897 struct folio *folio;18981898 unsigned int folio_offset;18991899 unsigned int nr_bytes;
···210210 /** Reference to backing file in passthrough mode */211211 struct fuse_backing *fb;212212#endif213213+214214+ /*215215+ * The underlying inode->i_blkbits value will not be modified,216216+ * so preserve the blocksize specified by the server.217217+ */218218+ u8 cached_i_blkbits;213219};214220215221/** FUSE inode state bits */···975969 /* Request timeout (in jiffies). 0 = no timeout */976970 unsigned int req_timeout;977971 } timeout;972972+973973+ /*974974+ * This is a workaround until fuse uses iomap for reads.975975+ * For fuseblk servers, this represents the blocksize passed in at976976+ * mount time and for regular fuse servers, this is equivalent to977977+ * inode->i_blkbits.978978+ */979979+ u8 blkbits;978980};979981980982/*
+16
fs/fuse/inode.c
···289289 }290290 }291291292292+ if (attr->blksize)293293+ fi->cached_i_blkbits = ilog2(attr->blksize);294294+ else295295+ fi->cached_i_blkbits = fc->blkbits;296296+292297 /*293298 * Don't set the sticky bit in i_mode, unless we want the VFS294299 * to check permissions. This prevents failures due to the···18101805 err = -EINVAL;18111806 if (!sb_set_blocksize(sb, ctx->blksize))18121807 goto err;18081808+ /*18091809+ * This is a workaround until fuse hooks into iomap for reads.18101810+ * Use PAGE_SIZE for the blocksize else if the writeback cache18111811+ * is enabled, buffered writes go through iomap and a read may18121812+ * overwrite partially written data if blocksize < PAGE_SIZE18131813+ */18141814+ fc->blkbits = sb->s_blocksize_bits;18151815+ if (ctx->blksize != PAGE_SIZE &&18161816+ !sb_set_blocksize(sb, PAGE_SIZE))18171817+ goto err;18131818#endif18141819 } else {18151820 sb->s_blocksize = PAGE_SIZE;18161821 sb->s_blocksize_bits = PAGE_SHIFT;18221822+ fc->blkbits = sb->s_blocksize_bits;18171823 }1818182418191825 sb->s_subtype = ctx->subtype;
+5
fs/fuse/passthrough.c
···237237 if (!file)238238 goto out;239239240240+ /* read/write/splice/mmap passthrough only relevant for regular files */241241+ res = d_is_dir(file->f_path.dentry) ? -EISDIR : -EINVAL;242242+ if (!d_is_reg(file->f_path.dentry))243243+ goto out_fput;244244+240245 backing_sb = file_inode(file)->i_sb;241246 res = -ELOOP;242247 if (backing_sb->s_stack_depth >= fc->max_stack_depth)
···7070 !list_empty(&of->list));7171}72727373+/* Get active reference to kernfs node for an open file */7474+static struct kernfs_open_file *kernfs_get_active_of(struct kernfs_open_file *of)7575+{7676+ /* Skip if file was already released */7777+ if (unlikely(of->released))7878+ return NULL;7979+8080+ if (!kernfs_get_active(of->kn))8181+ return NULL;8282+8383+ return of;8484+}8585+8686+static void kernfs_put_active_of(struct kernfs_open_file *of)8787+{8888+ return kernfs_put_active(of->kn);8989+}9090+7391/**7492 * kernfs_deref_open_node_locked - Get kernfs_open_node corresponding to @kn7593 *···157139158140 if (ops->seq_stop)159141 ops->seq_stop(sf, v);160160- kernfs_put_active(of->kn);142142+ kernfs_put_active_of(of);161143}162144163145static void *kernfs_seq_start(struct seq_file *sf, loff_t *ppos)···170152 * the ops aren't called concurrently for the same open file.171153 */172154 mutex_lock(&of->mutex);173173- if (!kernfs_get_active(of->kn))155155+ if (!kernfs_get_active_of(of))174156 return ERR_PTR(-ENODEV);175157176158 ops = kernfs_ops(of->kn);···256238 * the ops aren't called concurrently for the same open file.257239 */258240 mutex_lock(&of->mutex);259259- if (!kernfs_get_active(of->kn)) {241241+ if (!kernfs_get_active_of(of)) {260242 len = -ENODEV;261243 mutex_unlock(&of->mutex);262244 goto out_free;···270252 else271253 len = -EINVAL;272254273273- kernfs_put_active(of->kn);255255+ kernfs_put_active_of(of);274256 mutex_unlock(&of->mutex);275257276258 if (len < 0)···341323 * the ops aren't called concurrently for the same open file.342324 */343325 mutex_lock(&of->mutex);344344- if (!kernfs_get_active(of->kn)) {326326+ if (!kernfs_get_active_of(of)) {345327 mutex_unlock(&of->mutex);346328 len = -ENODEV;347329 goto out_free;···353335 else354336 len = -EINVAL;355337356356- kernfs_put_active(of->kn);338338+ kernfs_put_active_of(of);357339 mutex_unlock(&of->mutex);358340359341 if (len > 0)···375357 if (!of->vm_ops)376358 return;377359378378- if (!kernfs_get_active(of->kn))360360+ if (!kernfs_get_active_of(of))379361 return;380362381363 if (of->vm_ops->open)382364 of->vm_ops->open(vma);383365384384- kernfs_put_active(of->kn);366366+ kernfs_put_active_of(of);385367}386368387369static vm_fault_t kernfs_vma_fault(struct vm_fault *vmf)···393375 if (!of->vm_ops)394376 return VM_FAULT_SIGBUS;395377396396- if (!kernfs_get_active(of->kn))378378+ if (!kernfs_get_active_of(of))397379 return VM_FAULT_SIGBUS;398380399381 ret = VM_FAULT_SIGBUS;400382 if (of->vm_ops->fault)401383 ret = of->vm_ops->fault(vmf);402384403403- kernfs_put_active(of->kn);385385+ kernfs_put_active_of(of);404386 return ret;405387}406388···413395 if (!of->vm_ops)414396 return VM_FAULT_SIGBUS;415397416416- if (!kernfs_get_active(of->kn))398398+ if (!kernfs_get_active_of(of))417399 return VM_FAULT_SIGBUS;418400419401 ret = 0;···422404 else423405 file_update_time(file);424406425425- kernfs_put_active(of->kn);407407+ kernfs_put_active_of(of);426408 return ret;427409}428410···436418 if (!of->vm_ops)437419 return -EINVAL;438420439439- if (!kernfs_get_active(of->kn))421421+ if (!kernfs_get_active_of(of))440422 return -EINVAL;441423442424 ret = -EINVAL;443425 if (of->vm_ops->access)444426 ret = of->vm_ops->access(vma, addr, buf, len, write);445427446446- kernfs_put_active(of->kn);428428+ kernfs_put_active_of(of);447429 return ret;448430}449431···473455 mutex_lock(&of->mutex);474456475457 rc = -ENODEV;476476- if (!kernfs_get_active(of->kn))458458+ if (!kernfs_get_active_of(of))477459 goto out_unlock;478460479461 ops = kernfs_ops(of->kn);···508490 }509491 vma->vm_ops = &kernfs_vm_ops;510492out_put:511511- kernfs_put_active(of->kn);493493+ kernfs_put_active_of(of);512494out_unlock:513495 mutex_unlock(&of->mutex);514496···870852 struct kernfs_node *kn = kernfs_dentry_node(filp->f_path.dentry);871853 __poll_t ret;872854873873- if (!kernfs_get_active(kn))855855+ if (!kernfs_get_active_of(of))874856 return DEFAULT_POLLMASK|EPOLLERR|EPOLLPRI;875857876858 if (kn->attr.ops->poll)···878860 else879861 ret = kernfs_generic_poll(of, wait);880862881881- kernfs_put_active(kn);863863+ kernfs_put_active_of(of);882864 return ret;883865}884866···893875 * the ops aren't called concurrently for the same open file.894876 */895877 mutex_lock(&of->mutex);896896- if (!kernfs_get_active(of->kn)) {878878+ if (!kernfs_get_active_of(of)) {897879 mutex_unlock(&of->mutex);898880 return -ENODEV;899881 }···904886 else905887 ret = generic_file_llseek(file, offset, whence);906888907907- kernfs_put_active(of->kn);889889+ kernfs_put_active_of(of);908890 mutex_unlock(&of->mutex);909891 return ret;910892}
+1-1
fs/namespace.c
···24552455 return ERR_PTR(-EINVAL);24562456 }2457245724582458- if (!ns_capable(old_mnt->mnt_ns->user_ns, CAP_SYS_ADMIN))24582458+ if (!ns_capable(old_mnt->mnt_ns->user_ns, CAP_SYS_ADMIN))24592459 return ERR_PTR(-EPERM);2460246024612461 if (__has_locked_children(old_mnt, path->dentry))
···14141515#include "internal.h"16161717-/* Call with exclusively locked inode->i_rwsem */1818-static void nfs_block_o_direct(struct nfs_inode *nfsi, struct inode *inode)1919-{2020- if (test_bit(NFS_INO_ODIRECT, &nfsi->flags)) {2121- clear_bit(NFS_INO_ODIRECT, &nfsi->flags);2222- inode_dio_wait(inode);2323- }2424-}2525-2617/**2718 * nfs_start_io_read - declare the file is being used for buffered reads2819 * @inode: file inode···4857 err = down_write_killable(&inode->i_rwsem);4958 if (err)5059 return err;5151- nfs_block_o_direct(nfsi, inode);6060+ nfs_file_block_o_direct(nfsi);5261 downgrade_write(&inode->i_rwsem);53625463 return 0;···81908291 err = down_write_killable(&inode->i_rwsem);8392 if (!err)8484- nfs_block_o_direct(NFS_I(inode), inode);9393+ nfs_file_block_o_direct(NFS_I(inode));8594 return err;8695}8796
+11-10
fs/nfs/localio.c
···180180 return;181181 }182182183183- if (nfs_client_is_local(clp)) {184184- /* If already enabled, disable and re-enable */185185- nfs_localio_disable_client(clp);186186- }183183+ if (nfs_client_is_local(clp))184184+ return;187185188186 if (!nfs_uuid_begin(&clp->cl_uuid))189187 return;···242244 case -ENOMEM:243245 case -ENXIO:244246 case -ENOENT:245245- /* Revalidate localio, will disable if unsupported */247247+ /* Revalidate localio */248248+ nfs_localio_disable_client(clp);246249 nfs_local_probe(clp);247250 }248251 }···452453 nfs_local_iter_init(&iter, iocb, READ);453454454455 status = filp->f_op->read_iter(&iocb->kiocb, &iter);456456+457457+ revert_creds(save_cred);458458+455459 if (status != -EIOCBQUEUED) {456460 nfs_local_read_done(iocb, status);457461 nfs_local_pgio_release(iocb);458462 }459459-460460- revert_creds(save_cred);461463}462464463465static int···648648 file_start_write(filp);649649 status = filp->f_op->write_iter(&iocb->kiocb, &iter);650650 file_end_write(filp);651651+652652+ revert_creds(save_cred);653653+ current->flags = old_flags;654654+651655 if (status != -EIOCBQUEUED) {652656 nfs_local_write_done(iocb, status);653657 nfs_local_vfs_getattr(iocb);654658 nfs_local_pgio_release(iocb);655659 }656656-657657- revert_creds(save_cred);658658- current->flags = old_flags;659660}660661661662static int
+26-9
fs/nfs/nfs42proc.c
···114114 exception.inode = inode;115115 exception.state = lock->open_context->state;116116117117+ nfs_file_block_o_direct(NFS_I(inode));117118 err = nfs_sync_inode(inode);118119 if (err)119120 goto out;···138137 .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_ALLOCATE],139138 };140139 struct inode *inode = file_inode(filep);140140+ loff_t oldsize = i_size_read(inode);141141 int err;142142143143 if (!nfs_server_capable(inode, NFS_CAP_ALLOCATE))···147145 inode_lock(inode);148146149147 err = nfs42_proc_fallocate(&msg, filep, offset, len);150150- if (err == -EOPNOTSUPP)148148+149149+ if (err == 0)150150+ nfs_truncate_last_folio(inode->i_mapping, oldsize,151151+ offset + len);152152+ else if (err == -EOPNOTSUPP)151153 NFS_SERVER(inode)->caps &= ~(NFS_CAP_ALLOCATE |152154 NFS_CAP_ZERO_RANGE);153155···189183 .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_ZERO_RANGE],190184 };191185 struct inode *inode = file_inode(filep);186186+ loff_t oldsize = i_size_read(inode);192187 int err;193188194189 if (!nfs_server_capable(inode, NFS_CAP_ZERO_RANGE))···198191 inode_lock(inode);199192200193 err = nfs42_proc_fallocate(&msg, filep, offset, len);201201- if (err == 0)194194+ if (err == 0) {195195+ nfs_truncate_last_folio(inode->i_mapping, oldsize,196196+ offset + len);202197 truncate_pagecache_range(inode, offset, (offset + len) -1);203203- if (err == -EOPNOTSUPP)198198+ } else if (err == -EOPNOTSUPP)204199 NFS_SERVER(inode)->caps &= ~NFS_CAP_ZERO_RANGE;205200206201 inode_unlock(inode);···363354364355/**365356 * nfs42_copy_dest_done - perform inode cache updates after clone/copy offload366366- * @inode: pointer to destination inode357357+ * @file: pointer to destination file367358 * @pos: destination offset368359 * @len: copy length360360+ * @oldsize: length of the file prior to clone/copy369361 *370362 * Punch a hole in the inode page cache, so that the NFS client will371363 * know to retrieve new data.372364 * Update the file size if necessary, and then mark the inode as having373365 * invalid cached values for change attribute, ctime, mtime and space used.374366 */375375-static void nfs42_copy_dest_done(struct inode *inode, loff_t pos, loff_t len)367367+static void nfs42_copy_dest_done(struct file *file, loff_t pos, loff_t len,368368+ loff_t oldsize)376369{370370+ struct inode *inode = file_inode(file);371371+ struct address_space *mapping = file->f_mapping;377372 loff_t newsize = pos + len;378373 loff_t end = newsize - 1;379374380380- WARN_ON_ONCE(invalidate_inode_pages2_range(inode->i_mapping,381381- pos >> PAGE_SHIFT, end >> PAGE_SHIFT));375375+ nfs_truncate_last_folio(mapping, oldsize, pos);376376+ WARN_ON_ONCE(invalidate_inode_pages2_range(mapping, pos >> PAGE_SHIFT,377377+ end >> PAGE_SHIFT));382378383379 spin_lock(&inode->i_lock);384380 if (newsize > i_size_read(inode))···416402 struct nfs_server *src_server = NFS_SERVER(src_inode);417403 loff_t pos_src = args->src_pos;418404 loff_t pos_dst = args->dst_pos;405405+ loff_t oldsize_dst = i_size_read(dst_inode);419406 size_t count = args->count;420407 ssize_t status;421408···445430 return status;446431 }447432433433+ nfs_file_block_o_direct(NFS_I(dst_inode));448434 status = nfs_sync_inode(dst_inode);449435 if (status)450436 return status;···491475 goto out;492476 }493477494494- nfs42_copy_dest_done(dst_inode, pos_dst, res->write_res.count);478478+ nfs42_copy_dest_done(dst, pos_dst, res->write_res.count, oldsize_dst);495479 nfs_invalidate_atime(src_inode);496480 status = res->write_res.count;497481out:···12581242 struct nfs42_clone_res res = {12591243 .server = server,12601244 };12451245+ loff_t oldsize_dst = i_size_read(dst_inode);12611246 int status;1262124712631248 msg->rpc_argp = &args;···12931276 /* a zero-length count means clone to EOF in src */12941277 if (count == 0 && res.dst_fattr->valid & NFS_ATTR_FATTR_SIZE)12951278 count = nfs_size_to_loff_t(res.dst_fattr->size) - dst_offset;12961296- nfs42_copy_dest_done(dst_inode, dst_offset, count);12791279+ nfs42_copy_dest_done(dst_f, dst_offset, count, oldsize_dst);12971280 status = nfs_post_op_update_inode(dst_inode, res.dst_fattr);12981281 }12991282
+2
fs/nfs/nfs4file.c
···278278 lock_two_nondirectories(src_inode, dst_inode);279279 /* flush all pending writes on both src and dst so that server280280 * has the latest data */281281+ nfs_file_block_o_direct(NFS_I(src_inode));281282 ret = nfs_sync_inode(src_inode);282283 if (ret)283284 goto out_unlock;285285+ nfs_file_block_o_direct(NFS_I(dst_inode));284286 ret = nfs_sync_inode(dst_inode);285287 if (ret)286288 goto out_unlock;
···237237}238238239239/*240240- * nfs_page_group_search_locked241241- * @head - head request of page group242242- * @page_offset - offset into page240240+ * nfs_page_covers_folio241241+ * @req: struct nfs_page243242 *244244- * Search page group with head @head to find a request that contains the245245- * page offset @page_offset.246246- *247247- * Returns a pointer to the first matching nfs request, or NULL if no248248- * match is found.249249- *250250- * Must be called with the page group lock held251251- */252252-static struct nfs_page *253253-nfs_page_group_search_locked(struct nfs_page *head, unsigned int page_offset)254254-{255255- struct nfs_page *req;256256-257257- req = head;258258- do {259259- if (page_offset >= req->wb_pgbase &&260260- page_offset < (req->wb_pgbase + req->wb_bytes))261261- return req;262262-263263- req = req->wb_this_page;264264- } while (req != head);265265-266266- return NULL;267267-}268268-269269-/*270270- * nfs_page_group_covers_page271271- * @head - head request of page group272272- *273273- * Return true if the page group with head @head covers the whole page,274274- * returns false otherwise243243+ * Return true if the request covers the whole folio.244244+ * Note that the caller should ensure all subrequests have been joined275245 */276246static bool nfs_page_group_covers_page(struct nfs_page *req)277247{278248 unsigned int len = nfs_folio_length(nfs_page_to_folio(req));279279- struct nfs_page *tmp;280280- unsigned int pos = 0;281249282282- nfs_page_group_lock(req);283283-284284- for (;;) {285285- tmp = nfs_page_group_search_locked(req->wb_head, pos);286286- if (!tmp)287287- break;288288- pos = tmp->wb_pgbase + tmp->wb_bytes;289289- }290290-291291- nfs_page_group_unlock(req);292292- return pos >= len;250250+ return req->wb_pgbase == 0 && req->wb_bytes == len;293251}294252295253/* We can set the PG_uptodate flag if we see that a write request···20032045 * release it */20042046 nfs_inode_remove_request(req);20052047 nfs_unlock_and_release_request(req);20482048+ folio_cancel_dirty(folio);20062049 }2007205020082051 return ret;
+9-1
fs/ocfs2/extent_map.c
···706706 * it not only handles the fiemap for inlined files, but also deals707707 * with the fast symlink, cause they have no difference for extent708708 * mapping per se.709709+ *710710+ * Must be called with ip_alloc_sem semaphore held.709711 */710712static int ocfs2_fiemap_inline(struct inode *inode, struct buffer_head *di_bh,711713 struct fiemap_extent_info *fieinfo,···719717 u64 phys;720718 u32 flags = FIEMAP_EXTENT_DATA_INLINE|FIEMAP_EXTENT_LAST;721719 struct ocfs2_inode_info *oi = OCFS2_I(inode);720720+ lockdep_assert_held_read(&oi->ip_alloc_sem);722721723722 di = (struct ocfs2_dinode *)di_bh->b_data;724723 if (ocfs2_inode_is_fast_symlink(inode))···735732 phys += offsetof(struct ocfs2_dinode,736733 id2.i_data.id_data);737734735735+ /* Release the ip_alloc_sem to prevent deadlock on page fault */736736+ up_read(&OCFS2_I(inode)->ip_alloc_sem);738737 ret = fiemap_fill_next_extent(fieinfo, 0, phys, id_count,739738 flags);739739+ down_read(&OCFS2_I(inode)->ip_alloc_sem);740740 if (ret < 0)741741 return ret;742742 }···808802 len_bytes = (u64)le16_to_cpu(rec.e_leaf_clusters) << osb->s_clustersize_bits;809803 phys_bytes = le64_to_cpu(rec.e_blkno) << osb->sb->s_blocksize_bits;810804 virt_bytes = (u64)le32_to_cpu(rec.e_cpos) << osb->s_clustersize_bits;811811-805805+ /* Release the ip_alloc_sem to prevent deadlock on page fault */806806+ up_read(&OCFS2_I(inode)->ip_alloc_sem);812807 ret = fiemap_fill_next_extent(fieinfo, virt_bytes, phys_bytes,813808 len_bytes, fe_flags);809809+ down_read(&OCFS2_I(inode)->ip_alloc_sem);814810 if (ret)815811 break;816812
+2-1
fs/proc/generic.c
···393393 if (proc_alloc_inum(&dp->low_ino))394394 goto out_free_entry;395395396396- pde_set_flags(dp);396396+ if (!S_ISDIR(dp->mode))397397+ pde_set_flags(dp);397398398399 write_lock(&proc_subdir_lock);399400 dp->parent = dir;
+1-1
fs/resctrl/ctrlmondata.c
···625625 */626626 list_for_each_entry(d, &r->mon_domains, hdr.list) {627627 if (d->ci_id == domid) {628628- rr.ci_id = d->ci_id;629628 cpu = cpumask_any(&d->hdr.cpu_mask);630629 ci = get_cpu_cacheinfo_level(cpu, RESCTRL_L3_CACHE);631630 if (!ci)632631 continue;632632+ rr.ci = ci;633633 mon_event_read(&rr, r, NULL, rdtgrp,634634 &ci->shared_cpu_map, evtid, false);635635 goto checkresult;
+2-2
fs/resctrl/internal.h
···9898 * domains in @r sharing L3 @ci.id9999 * @evtid: Which monitor event to read.100100 * @first: Initialize MBM counter when true.101101- * @ci_id: Cacheinfo id for L3. Only set when @d is NULL. Used when summing domains.101101+ * @ci: Cacheinfo for L3. Only set when @d is NULL. Used when summing domains.102102 * @err: Error encountered when reading counter.103103 * @val: Returned value of event counter. If @rgrp is a parent resource group,104104 * @val includes the sum of event counts from its child resource groups.···112112 struct rdt_mon_domain *d;113113 enum resctrl_event_id evtid;114114 bool first;115115- unsigned int ci_id;115115+ struct cacheinfo *ci;116116 int err;117117 u64 val;118118 void *arch_mon_ctx;
+2-4
fs/resctrl/monitor.c
···361361{362362 int cpu = smp_processor_id();363363 struct rdt_mon_domain *d;364364- struct cacheinfo *ci;365364 struct mbm_state *m;366365 int err, ret;367366 u64 tval = 0;···388389 }389390390391 /* Summing domains that share a cache, must be on a CPU for that cache. */391391- ci = get_cpu_cacheinfo_level(cpu, RESCTRL_L3_CACHE);392392- if (!ci || ci->id != rr->ci_id)392392+ if (!cpumask_test_cpu(cpu, &rr->ci->shared_cpu_map))393393 return -EINVAL;394394395395 /*···400402 */401403 ret = -EINVAL;402404 list_for_each_entry(d, &rr->r->mon_domains, hdr.list) {403403- if (d->ci_id != rr->ci_id)405405+ if (d->ci_id != rr->ci->id)404406 continue;405407 err = resctrl_arch_rmid_read(rr->r, d, closid, rmid,406408 rr->evtid, &tval, rr->arch_mon_ctx);
+9-4
fs/smb/client/cifsglob.h
···8787#define SMB_INTERFACE_POLL_INTERVAL 60088888989/* maximum number of PDUs in one compound */9090-#define MAX_COMPOUND 79090+#define MAX_COMPOUND 1091919292/*9393 * Default number of credits to keep available for SMB3.···188218821883188318841884/* cifs_get_writable_file() flags */18851885-#define FIND_WR_ANY 018861886-#define FIND_WR_FSUID_ONLY 118871887-#define FIND_WR_WITH_DELETE 218851885+enum cifs_writable_file_flags {18861886+ FIND_WR_ANY = 0U,18871887+ FIND_WR_FSUID_ONLY = (1U << 0),18881888+ FIND_WR_WITH_DELETE = (1U << 1),18891889+ FIND_WR_NO_PENDING_DELETE = (1U << 2),18901890+};1888189118891892#define MID_FREE 018901893#define MID_REQUEST_ALLOCATED 1···23462343 struct kvec qi_iov;23472344 struct kvec io_iov[SMB2_IOCTL_IOV_SIZE];23482345 struct kvec si_iov[SMB2_SET_INFO_IOV_SIZE];23462346+ struct kvec unlink_iov[SMB2_SET_INFO_IOV_SIZE];23472347+ struct kvec rename_iov[SMB2_SET_INFO_IOV_SIZE];23492348 struct kvec close_iov;23502349 struct smb2_file_rename_info_hdr rename_info;23512350 struct smb2_file_link_info_hdr link_info;
+17-1
fs/smb/client/file.c
···998998999999 /* Get the cached handle as SMB2 close is deferred */10001000 if (OPEN_FMODE(file->f_flags) & FMODE_WRITE) {10011001- rc = cifs_get_writable_path(tcon, full_path, FIND_WR_FSUID_ONLY, &cfile);10011001+ rc = cifs_get_writable_path(tcon, full_path,10021002+ FIND_WR_FSUID_ONLY |10031003+ FIND_WR_NO_PENDING_DELETE,10041004+ &cfile);10021005 } else {10031006 rc = cifs_get_readable_path(tcon, full_path, &cfile);10041007 }···25332530 continue;25342531 if (with_delete && !(open_file->fid.access & DELETE))25352532 continue;25332533+ if ((flags & FIND_WR_NO_PENDING_DELETE) &&25342534+ open_file->status_file_deleted)25352535+ continue;25362536 if (OPEN_FMODE(open_file->f_flags) & FMODE_WRITE) {25372537 if (!open_file->invalidHandle) {25382538 /* found a good writable file */···26532647 spin_unlock(&tcon->open_file_lock);26542648 free_dentry_path(page);26552649 *ret_file = find_readable_file(cinode, 0);26502650+ if (*ret_file) {26512651+ spin_lock(&cinode->open_file_lock);26522652+ if ((*ret_file)->status_file_deleted) {26532653+ spin_unlock(&cinode->open_file_lock);26542654+ cifsFileInfo_put(*ret_file);26552655+ *ret_file = NULL;26562656+ } else {26572657+ spin_unlock(&cinode->open_file_lock);26582658+ }26592659+ }26562660 return *ret_file ? 0 : -ENOENT;26572661 }26582662
+69-17
fs/smb/client/inode.c
···19311931 * but will return the EACCES to the caller. Note that the VFS does not call19321932 * unlink on negative dentries currently.19331933 */19341934-int cifs_unlink(struct inode *dir, struct dentry *dentry)19341934+static int __cifs_unlink(struct inode *dir, struct dentry *dentry, bool sillyrename)19351935{19361936 int rc = 0;19371937 unsigned int xid;···20032003 goto psx_del_no_retry;20042004 }2005200520062006- rc = server->ops->unlink(xid, tcon, full_path, cifs_sb, dentry);20062006+ if (sillyrename || (server->vals->protocol_id > SMB10_PROT_ID &&20072007+ d_is_positive(dentry) && d_count(dentry) > 2))20082008+ rc = -EBUSY;20092009+ else20102010+ rc = server->ops->unlink(xid, tcon, full_path, cifs_sb, dentry);2007201120082012psx_del_no_retry:20092013 if (!rc) {···20732069 if (rehash)20742070 d_rehash(dentry);20752071 return rc;20722072+}20732073+20742074+int cifs_unlink(struct inode *dir, struct dentry *dentry)20752075+{20762076+ return __cifs_unlink(dir, dentry, false);20762077}2077207820782079static int···23672358 rc = server->ops->rmdir(xid, tcon, full_path, cifs_sb);23682359 cifs_put_tlink(tlink);2369236023612361+ cifsInode = CIFS_I(d_inode(direntry));23622362+23702363 if (!rc) {23642364+ set_bit(CIFS_INO_DELETE_PENDING, &cifsInode->flags);23712365 spin_lock(&d_inode(direntry)->i_lock);23722366 i_size_write(d_inode(direntry), 0);23732367 clear_nlink(d_inode(direntry));23742368 spin_unlock(&d_inode(direntry)->i_lock);23752369 }2376237023772377- cifsInode = CIFS_I(d_inode(direntry));23782371 /* force revalidate to go get info when needed */23792372 cifsInode->time = 0;23802373···24692458 }24702459#endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */24712460do_rename_exit:24722472- if (rc == 0)24612461+ if (rc == 0) {24732462 d_move(from_dentry, to_dentry);24632463+ /* Force a new lookup */24642464+ d_drop(from_dentry);24652465+ }24742466 cifs_put_tlink(tlink);24752467 return rc;24762468}···24842470 struct dentry *target_dentry, unsigned int flags)24852471{24862472 const char *from_name, *to_name;24732473+ struct TCP_Server_Info *server;24872474 void *page1, *page2;24882475 struct cifs_sb_info *cifs_sb;24892476 struct tcon_link *tlink;···25202505 if (IS_ERR(tlink))25212506 return PTR_ERR(tlink);25222507 tcon = tlink_tcon(tlink);25082508+ server = tcon->ses->server;2523250925242510 page1 = alloc_dentry_path();25252511 page2 = alloc_dentry_path();···2607259126082592unlink_target:26092593#endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */26102610-26112611- /* Try unlinking the target dentry if it's not negative */26122612- if (d_really_is_positive(target_dentry) && (rc == -EACCES || rc == -EEXIST)) {26132613- if (d_is_dir(target_dentry))26142614- tmprc = cifs_rmdir(target_dir, target_dentry);26152615- else26162616- tmprc = cifs_unlink(target_dir, target_dentry);26172617- if (tmprc)26182618- goto cifs_rename_exit;26192619- rc = cifs_do_rename(xid, source_dentry, from_name,26202620- target_dentry, to_name);26212621- if (!rc)26222622- rehash = false;25942594+ if (d_really_is_positive(target_dentry)) {25952595+ if (!rc) {25962596+ struct inode *inode = d_inode(target_dentry);25972597+ /*25982598+ * Samba and ksmbd servers allow renaming a target25992599+ * directory that is open, so make sure to update26002600+ * ->i_nlink and then mark it as delete pending.26012601+ */26022602+ if (S_ISDIR(inode->i_mode)) {26032603+ drop_cached_dir_by_name(xid, tcon, to_name, cifs_sb);26042604+ spin_lock(&inode->i_lock);26052605+ i_size_write(inode, 0);26062606+ clear_nlink(inode);26072607+ spin_unlock(&inode->i_lock);26082608+ set_bit(CIFS_INO_DELETE_PENDING, &CIFS_I(inode)->flags);26092609+ CIFS_I(inode)->time = 0; /* force reval */26102610+ inode_set_ctime_current(inode);26112611+ inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));26122612+ }26132613+ } else if (rc == -EACCES || rc == -EEXIST) {26142614+ /*26152615+ * Rename failed, possibly due to a busy target.26162616+ * Retry it by unliking the target first.26172617+ */26182618+ if (d_is_dir(target_dentry)) {26192619+ tmprc = cifs_rmdir(target_dir, target_dentry);26202620+ } else {26212621+ tmprc = __cifs_unlink(target_dir, target_dentry,26222622+ server->vals->protocol_id > SMB10_PROT_ID);26232623+ }26242624+ if (tmprc) {26252625+ /*26262626+ * Some servers will return STATUS_ACCESS_DENIED26272627+ * or STATUS_DIRECTORY_NOT_EMPTY when failing to26282628+ * rename a non-empty directory. Make sure to26292629+ * propagate the appropriate error back to26302630+ * userspace.26312631+ */26322632+ if (tmprc == -EEXIST || tmprc == -ENOTEMPTY)26332633+ rc = tmprc;26342634+ goto cifs_rename_exit;26352635+ }26362636+ rc = cifs_do_rename(xid, source_dentry, from_name,26372637+ target_dentry, to_name);26382638+ if (!rc)26392639+ rehash = false;26402640+ }26232641 }2624264226252643 /* force revalidate to go get info when needed */···26792629 struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);26802630 struct cached_fid *cfid = NULL;2681263126322632+ if (test_bit(CIFS_INO_DELETE_PENDING, &cifs_i->flags))26332633+ return false;26822634 if (cifs_i->time == 0)26832635 return true;26842636
···1818#define KASAN_ABI_VERSION 519192020/*2121+ * Clang 22 added preprocessor macros to match GCC, in hopes of eventually2222+ * dropping __has_feature support for sanitizers:2323+ * https://github.com/llvm/llvm-project/commit/568c23bbd3303518c5056d7f03444dae4fdc8a9c2424+ * Create these macros for older versions of clang so that it is easy to clean2525+ * up once the minimum supported version of LLVM for building the kernel always2626+ * creates these macros.2727+ *2128 * Note: Checking __has_feature(*_sanitizer) is only true if the feature is2229 * enabled. Therefore it is not required to additionally check defined(CONFIG_*)2330 * to avoid adding redundant attributes in other configurations.2431 */2525-2626-#if __has_feature(address_sanitizer) || __has_feature(hwaddress_sanitizer)2727-/* Emulate GCC's __SANITIZE_ADDRESS__ flag */3232+#if __has_feature(address_sanitizer) && !defined(__SANITIZE_ADDRESS__)2833#define __SANITIZE_ADDRESS__3434+#endif3535+#if __has_feature(hwaddress_sanitizer) && !defined(__SANITIZE_HWADDRESS__)3636+#define __SANITIZE_HWADDRESS__3737+#endif3838+#if __has_feature(thread_sanitizer) && !defined(__SANITIZE_THREAD__)3939+#define __SANITIZE_THREAD__4040+#endif4141+4242+/*4343+ * Treat __SANITIZE_HWADDRESS__ the same as __SANITIZE_ADDRESS__ in the kernel.4444+ */4545+#ifdef __SANITIZE_HWADDRESS__4646+#define __SANITIZE_ADDRESS__4747+#endif4848+4949+#ifdef __SANITIZE_ADDRESS__2950#define __no_sanitize_address \3051 __attribute__((no_sanitize("address", "hwaddress")))3152#else3253#define __no_sanitize_address3354#endif34553535-#if __has_feature(thread_sanitizer)3636-/* emulate gcc's __SANITIZE_THREAD__ flag */3737-#define __SANITIZE_THREAD__5656+#ifdef __SANITIZE_THREAD__3857#define __no_sanitize_thread \3958 __attribute__((no_sanitize("thread")))4059#else
···149149/* Expect random access pattern */150150#define FMODE_RANDOM ((__force fmode_t)(1 << 12))151151152152-/* FMODE_* bit 13 */152152+/* Supports IOCB_HAS_METADATA */153153+#define FMODE_HAS_METADATA ((__force fmode_t)(1 << 13))153154154155/* File is opened with O_PATH; almost nothing can be done with it */155156#define FMODE_PATH ((__force fmode_t)(1 << 14))
+3-3
include/linux/kasan.h
···562562#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)563563564564void kasan_populate_early_vm_area_shadow(void *start, unsigned long size);565565-int kasan_populate_vmalloc(unsigned long addr, unsigned long size);565565+int kasan_populate_vmalloc(unsigned long addr, unsigned long size, gfp_t gfp_mask);566566void kasan_release_vmalloc(unsigned long start, unsigned long end,567567 unsigned long free_region_start,568568 unsigned long free_region_end,···574574 unsigned long size)575575{ }576576static inline int kasan_populate_vmalloc(unsigned long start,577577- unsigned long size)577577+ unsigned long size, gfp_t gfp_mask)578578{579579 return 0;580580}···610610static inline void kasan_populate_early_vm_area_shadow(void *start,611611 unsigned long size) { }612612static inline int kasan_populate_vmalloc(unsigned long start,613613- unsigned long size)613613+ unsigned long size, gfp_t gfp_mask)614614{615615 return 0;616616}
-1
include/net/netfilter/nf_tables.h
···19121912 struct mutex commit_mutex;19131913 u64 table_handle;19141914 u64 tstamp;19151915- unsigned int base_seq;19161915 unsigned int gc_seq;19171916 u8 validate_state;19181917 struct work_struct destroy_work;
···33#define _NETNS_NFTABLES_H_4455struct netns_nftables {66+ unsigned int base_seq;67 u8 gencursor;78};89
+1-1
init/main.c
···956956 sort_main_extable();957957 trap_init();958958 mm_core_init();959959+ maple_tree_init();959960 poking_init();960961 ftrace_init();961962···974973 "Interrupts were enabled *very* early, fixing it\n"))975974 local_irq_disable();976975 radix_tree_init();977977- maple_tree_init();978976979977 /*980978 * Set up housekeeping before setting up workqueues to allow the unbound
+3
io_uring/rw.c
···886886 if (req->flags & REQ_F_HAS_METADATA) {887887 struct io_async_rw *io = req->async_data;888888889889+ if (!(file->f_mode & FMODE_HAS_METADATA))890890+ return -EINVAL;891891+889892 /*890893 * We have a union of meta fields with wpq used for buffered-io891894 * in io_async_rw, so fail it here.
···23662366 const struct bpf_insn *insn)23672367{23682368 /* If this handler ever gets executed, then BPF_JIT_ALWAYS_ON23692369- * is not working properly, or interpreter is being used when23702370- * prog->jit_requested is not 0, so warn about it!23692369+ * is not working properly, so warn about it!23712370 */23722371 WARN_ON_ONCE(1);23732372 return 0;···24672468 return ret;24682469}2469247024702470-static void bpf_prog_select_func(struct bpf_prog *fp)24712471+static bool bpf_prog_select_interpreter(struct bpf_prog *fp)24712472{24732473+ bool select_interpreter = false;24722474#ifndef CONFIG_BPF_JIT_ALWAYS_ON24732475 u32 stack_depth = max_t(u32, fp->aux->stack_depth, 1);24742476 u32 idx = (round_up(stack_depth, 32) / 32) - 1;···24782478 * But for non-JITed programs, we don't need bpf_func, so no bounds24792479 * check needed.24802480 */24812481- if (!fp->jit_requested &&24822482- !WARN_ON_ONCE(idx >= ARRAY_SIZE(interpreters))) {24812481+ if (idx < ARRAY_SIZE(interpreters)) {24832482 fp->bpf_func = interpreters[idx];24832483+ select_interpreter = true;24842484 } else {24852485 fp->bpf_func = __bpf_prog_ret0_warn;24862486 }24872487#else24882488 fp->bpf_func = __bpf_prog_ret0_warn;24892489#endif24902490+ return select_interpreter;24902491}2491249224922493/**···25062505 /* In case of BPF to BPF calls, verifier did all the prep25072506 * work with regards to JITing, etc.25082507 */25092509- bool jit_needed = fp->jit_requested;25082508+ bool jit_needed = false;2510250925112510 if (fp->bpf_func)25122511 goto finalize;···25152514 bpf_prog_has_kfunc_call(fp))25162515 jit_needed = true;2517251625182518- bpf_prog_select_func(fp);25172517+ if (!bpf_prog_select_interpreter(fp))25182518+ jit_needed = true;2519251925202520 /* eBPF JITs can rewrite the program in case constant25212521 * blinding is active. However, in case of error during···3026302430273025/* Always built-in helper functions. */30283026const struct bpf_func_proto bpf_tail_call_proto = {30293029- .func = NULL,30273027+ /* func is unused for tail_call, we set it to pass the30283028+ * get_helper_proto check30293029+ */30303030+ .func = BPF_PTR_POISON,30303031 .gpl_only = false,30313032 .ret_type = RET_VOID,30323033 .arg1_type = ARG_PTR_TO_CTX,
+2-2
kernel/bpf/cpumap.c
···186186 struct xdp_buff xdp;187187 int i, nframes = 0;188188189189- xdp_set_return_frame_no_direct();190189 xdp.rxq = &rxq;191190192191 for (i = 0; i < n; i++) {···230231 }231232 }232233233233- xdp_clear_return_frame_no_direct();234234 stats->pass += nframes;235235236236 return nframes;···253255254256 rcu_read_lock();255257 bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx);258258+ xdp_set_return_frame_no_direct();256259257260 ret->xdp_n = cpu_map_bpf_prog_run_xdp(rcpu, frames, ret->xdp_n, stats);258261 if (unlikely(ret->skb_n))···263264 if (stats->redirect)264265 xdp_do_flush();265266267267+ xdp_clear_return_frame_no_direct();266268 bpf_net_ctx_clear(bpf_net_ctx);267269 rcu_read_unlock();268270
···12741274 goto out;12751275 }1276127612771277- /* allocate hrtimer via map_kmalloc to use memcg accounting */12781278- cb = bpf_map_kmalloc_node(map, size, GFP_ATOMIC, map->numa_node);12771277+ /* Allocate via bpf_map_kmalloc_node() for memcg accounting. Until12781278+ * kmalloc_nolock() is available, avoid locking issues by using12791279+ * __GFP_HIGH (GFP_ATOMIC & ~__GFP_RECLAIM).12801280+ */12811281+ cb = bpf_map_kmalloc_node(map, size, __GFP_HIGH, map->numa_node);12791282 if (!cb) {12801283 ret = -ENOMEM;12811284 goto out;···3667366436683665 guard(pagefault)();36693666 for (i = 0; i < XATTR_SIZE_MAX; i++) {36703670- for (j = 0; i + j < len && j < XATTR_SIZE_MAX; j++) {36673667+ for (j = 0; i + j <= len && j < XATTR_SIZE_MAX; j++) {36713668 __get_kernel_nofault(&c2, s2__ign + j, char, err_out);36723669 if (c2 == '\0')36733670 return i;36713671+ /*36723672+ * We allow reading an extra byte from s2 (note the36733673+ * `i + j <= len` above) to cover the case when s2 is36743674+ * a suffix of the first len chars of s1.36753675+ */36763676+ if (i + j == len)36773677+ break;36743678 __get_kernel_nofault(&c1, s1__ign + j, char, err_out);36753679 if (c1 == '\0')36763680 return -ENOENT;
+1-1
kernel/bpf/rqspinlock.c
···471471 * any MCS node. This is not the most elegant solution, but is472472 * simple enough.473473 */474474- if (unlikely(idx >= _Q_MAX_NODES)) {474474+ if (unlikely(idx >= _Q_MAX_NODES || in_nmi())) {475475 lockevent_inc(lock_no_node);476476 RES_RESET_TIMEOUT(ts, RES_DEF_TIMEOUT);477477 while (!queued_spin_trylock(lock)) {
+5-1
kernel/bpf/verifier.c
···85478547 verifier_bug(env, "Two map pointers in a timer helper");85488548 return -EFAULT;85498549 }85508550+ if (IS_ENABLED(CONFIG_PREEMPT_RT)) {85518551+ verbose(env, "bpf_timer cannot be used for PREEMPT_RT.\n");85528552+ return -EOPNOTSUPP;85538553+ }85508554 meta->map_uid = reg->map_uid;85518555 meta->map_ptr = map;85528556 return 0;···1135811354 return -EINVAL;11359113551136011356 *ptr = env->ops->get_func_proto(func_id, env->prog);1136111361- return *ptr ? 0 : -EINVAL;1135711357+ return *ptr && (*ptr)->func ? 0 : -EINVAL;1136211358}11363113591136411360static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
···553553 const struct em_data_callback *cb,554554 const cpumask_t *cpus, bool microwatts)555555{556556+ int ret = em_dev_register_pd_no_update(dev, nr_states, cb, cpus, microwatts);557557+558558+ if (_is_cpu_device(dev))559559+ em_check_capacity_update();560560+561561+ return ret;562562+}563563+EXPORT_SYMBOL_GPL(em_dev_register_perf_domain);564564+565565+/**566566+ * em_dev_register_pd_no_update() - Register a perf domain for a device567567+ * @dev : Device to register the PD for568568+ * @nr_states : Number of performance states in the new PD569569+ * @cb : Callback functions for populating the energy model570570+ * @cpus : CPUs to include in the new PD (mandatory if @dev is a CPU device)571571+ * @microwatts : Whether or not the power values in the EM will be in uW572572+ *573573+ * Like em_dev_register_perf_domain(), but does not trigger a CPU capacity574574+ * update after registering the PD, even if @dev is a CPU device.575575+ */576576+int em_dev_register_pd_no_update(struct device *dev, unsigned int nr_states,577577+ const struct em_data_callback *cb,578578+ const cpumask_t *cpus, bool microwatts)579579+{556580 struct em_perf_table *em_table;557581 unsigned long cap, prev_cap = 0;558582 unsigned long flags = 0;···660636unlock:661637 mutex_unlock(&em_pd_mutex);662638663663- if (_is_cpu_device(dev))664664- em_check_capacity_update();665665-666639 return ret;667640}668668-EXPORT_SYMBOL_GPL(em_dev_register_perf_domain);641641+EXPORT_SYMBOL_GPL(em_dev_register_pd_no_update);669642670643/**671644 * em_dev_unregister_perf_domain() - Unregister Energy Model (EM) for a device
···787787 * of the next expiring timer is enough. The return from the SMP788788 * function call will take care of the reprogramming in case the789789 * CPU was in a NOHZ idle sleep.790790+ *791791+ * In periodic low resolution mode, the next softirq expiration792792+ * must also be updated.790793 */791791- if (!hrtimer_hres_active(base) && !tick_nohz_active)792792- return;793793-794794 raw_spin_lock(&base->lock);795795 hrtimer_update_base(base);796796 if (hrtimer_hres_active(base))···22952295 &new_base->clock_base[i]);22962296 }2297229722982298- /*22992299- * The migration might have changed the first expiring softirq23002300- * timer on this CPU. Update it.23012301- */23022302- __hrtimer_get_next_event(new_base, HRTIMER_ACTIVE_SOFT);23032298 /* Tell the other CPU to retrigger the next event */23042299 smp_call_function_single(ncpu, retrigger_next_event, NULL, 0);23052300
···58515851 spinlock_t *ptl;58525852 struct hstate *h = hstate_vma(vma);58535853 unsigned long sz = huge_page_size(h);58545854- bool adjust_reservation = false;58545854+ bool adjust_reservation;58555855 unsigned long last_addr_mask;58565856 bool force_flush = false;58575857···59445944 sz);59455945 hugetlb_count_sub(pages_per_huge_page(h), mm);59465946 hugetlb_remove_rmap(folio);59475947+ spin_unlock(ptl);5947594859485949 /*59495950 * Restore the reservation for anonymous page, otherwise the···59525951 * If there we are freeing a surplus, do not set the restore59535952 * reservation bit.59545953 */59545954+ adjust_reservation = false;59555955+59565956+ spin_lock_irq(&hugetlb_lock);59555957 if (!h->surplus_huge_pages && __vma_private_lock(vma) &&59565958 folio_test_anon(folio)) {59575959 folio_set_hugetlb_restore_reserve(folio);59585960 /* Reservation to be adjusted after the spin lock */59595961 adjust_reservation = true;59605962 }59615961-59625962- spin_unlock(ptl);59635963+ spin_unlock_irq(&hugetlb_lock);5963596459645965 /*59655966 * Adjust the reservation for the region that will have the
+24-7
mm/kasan/shadow.c
···336336 }337337}338338339339-static int ___alloc_pages_bulk(struct page **pages, int nr_pages)339339+static int ___alloc_pages_bulk(struct page **pages, int nr_pages, gfp_t gfp_mask)340340{341341 unsigned long nr_populated, nr_total = nr_pages;342342 struct page **page_array = pages;343343344344 while (nr_pages) {345345- nr_populated = alloc_pages_bulk(GFP_KERNEL, nr_pages, pages);345345+ nr_populated = alloc_pages_bulk(gfp_mask, nr_pages, pages);346346 if (!nr_populated) {347347 ___free_pages_bulk(page_array, nr_total - nr_pages);348348 return -ENOMEM;···354354 return 0;355355}356356357357-static int __kasan_populate_vmalloc(unsigned long start, unsigned long end)357357+static int __kasan_populate_vmalloc(unsigned long start, unsigned long end, gfp_t gfp_mask)358358{359359 unsigned long nr_pages, nr_total = PFN_UP(end - start);360360 struct vmalloc_populate_data data;361361+ unsigned int flags;361362 int ret = 0;362363363363- data.pages = (struct page **)__get_free_page(GFP_KERNEL | __GFP_ZERO);364364+ data.pages = (struct page **)__get_free_page(gfp_mask | __GFP_ZERO);364365 if (!data.pages)365366 return -ENOMEM;366367367368 while (nr_total) {368369 nr_pages = min(nr_total, PAGE_SIZE / sizeof(data.pages[0]));369369- ret = ___alloc_pages_bulk(data.pages, nr_pages);370370+ ret = ___alloc_pages_bulk(data.pages, nr_pages, gfp_mask);370371 if (ret)371372 break;372373373374 data.start = start;375375+376376+ /*377377+ * page tables allocations ignore external gfp mask, enforce it378378+ * by the scope API379379+ */380380+ if ((gfp_mask & (__GFP_FS | __GFP_IO)) == __GFP_IO)381381+ flags = memalloc_nofs_save();382382+ else if ((gfp_mask & (__GFP_FS | __GFP_IO)) == 0)383383+ flags = memalloc_noio_save();384384+374385 ret = apply_to_page_range(&init_mm, start, nr_pages * PAGE_SIZE,375386 kasan_populate_vmalloc_pte, &data);387387+388388+ if ((gfp_mask & (__GFP_FS | __GFP_IO)) == __GFP_IO)389389+ memalloc_nofs_restore(flags);390390+ else if ((gfp_mask & (__GFP_FS | __GFP_IO)) == 0)391391+ memalloc_noio_restore(flags);392392+376393 ___free_pages_bulk(data.pages, nr_pages);377394 if (ret)378395 break;···403386 return ret;404387}405388406406-int kasan_populate_vmalloc(unsigned long addr, unsigned long size)389389+int kasan_populate_vmalloc(unsigned long addr, unsigned long size, gfp_t gfp_mask)407390{408391 unsigned long shadow_start, shadow_end;409392 int ret;···432415 shadow_start = PAGE_ALIGN_DOWN(shadow_start);433416 shadow_end = PAGE_ALIGN(shadow_end);434417435435- ret = __kasan_populate_vmalloc(shadow_start, shadow_end);418418+ ret = __kasan_populate_vmalloc(shadow_start, shadow_end, gfp_mask);436419 if (ret)437420 return ret;438421
···956956 [MF_MSG_BUDDY] = "free buddy page",957957 [MF_MSG_DAX] = "dax page",958958 [MF_MSG_UNSPLIT_THP] = "unsplit thp",959959- [MF_MSG_ALREADY_POISONED] = "already poisoned",959959+ [MF_MSG_ALREADY_POISONED] = "already poisoned page",960960 [MF_MSG_UNKNOWN] = "unknown page",961961};962962···13491349{13501350 trace_memory_failure_event(pfn, type, result);1351135113521352- num_poisoned_pages_inc(pfn);13531353-13541354- update_per_node_mf_stats(pfn, result);13521352+ if (type != MF_MSG_ALREADY_POISONED) {13531353+ num_poisoned_pages_inc(pfn);13541354+ update_per_node_mf_stats(pfn, result);13551355+ }1355135613561357 pr_err("%#lx: recovery action for %s: %s\n",13571358 pfn, action_page_types[type], action_name[result]);···20952094 *hugetlb = 0;20962095 return 0;20972096 } else if (res == -EHWPOISON) {20982098- pr_err("%#lx: already hardware poisoned\n", pfn);20992097 if (flags & MF_ACTION_REQUIRED) {21002098 folio = page_folio(p);21012099 res = kill_accessing_process(current, folio_pfn(folio), flags);21022102- action_result(pfn, MF_MSG_ALREADY_POISONED, MF_FAILED);21032100 }21012101+ action_result(pfn, MF_MSG_ALREADY_POISONED, MF_FAILED);21042102 return res;21052103 } else if (res == -EBUSY) {21062104 if (!(flags & MF_NO_RETRY)) {···22852285 goto unlock_mutex;2286228622872287 if (TestSetPageHWPoison(p)) {22882288- pr_err("%#lx: already hardware poisoned\n", pfn);22892288 res = -EHWPOISON;22902289 if (flags & MF_ACTION_REQUIRED)22912290 res = kill_accessing_process(current, pfn, flags);···25682569 static DEFINE_RATELIMIT_STATE(unpoison_rs, DEFAULT_RATELIMIT_INTERVAL,25692570 DEFAULT_RATELIMIT_BURST);2570257125712571- if (!pfn_valid(pfn))25722572- return -ENXIO;25732573-25742574- p = pfn_to_page(pfn);25722572+ p = pfn_to_online_page(pfn);25732573+ if (!p)25742574+ return -EIO;25752575 folio = page_folio(p);2576257625772577 mutex_lock(&mf_mutex);
+8-2
mm/memory_hotplug.c
···18151815 pfn = folio_pfn(folio) + folio_nr_pages(folio) - 1;1816181618171817 if (folio_contain_hwpoisoned_page(folio)) {18181818- if (WARN_ON(folio_test_lru(folio)))18191819- folio_isolate_lru(folio);18181818+ /*18191819+ * unmap_poisoned_folio() cannot handle large folios18201820+ * in all cases yet.18211821+ */18221822+ if (folio_test_large(folio) && !folio_test_hugetlb(folio))18231823+ goto put_folio;18241824+ if (folio_test_lru(folio) && !folio_isolate_lru(folio))18251825+ goto put_folio;18201826 if (folio_mapped(folio)) {18211827 folio_lock(folio);18221828 unmap_poisoned_folio(folio, pfn, false);
+6-3
mm/mremap.c
···17741774 if (!vrm->new_len)17751775 return -EINVAL;1776177617771777- /* Is the new length or address silly? */17781778- if (vrm->new_len > TASK_SIZE ||17791779- vrm->new_addr > TASK_SIZE - vrm->new_len)17771777+ /* Is the new length silly? */17781778+ if (vrm->new_len > TASK_SIZE)17801779 return -EINVAL;1781178017821781 /* Remainder of checks are for cases with specific new_addr. */17831782 if (!vrm_implies_new_addr(vrm))17841783 return 0;17841784+17851785+ /* Is the new address silly? */17861786+ if (vrm->new_addr > TASK_SIZE - vrm->new_len)17871787+ return -EINVAL;1785178817861789 /* The new address must be page-aligned. */17871790 if (offset_in_page(vrm->new_addr))
+12-8
mm/percpu.c
···17341734 bool is_atomic;17351735 bool do_warn;17361736 struct obj_cgroup *objcg = NULL;17371737- static int warn_limit = 10;17371737+ static atomic_t warn_limit = ATOMIC_INIT(10);17381738 struct pcpu_chunk *chunk, *next;17391739 const char *err;17401740 int slot, off, cpu, ret;···19041904fail:19051905 trace_percpu_alloc_percpu_fail(reserved, is_atomic, size, align);1906190619071907- if (do_warn && warn_limit) {19081908- pr_warn("allocation failed, size=%zu align=%zu atomic=%d, %s\n",19091909- size, align, is_atomic, err);19101910- if (!is_atomic)19111911- dump_stack();19121912- if (!--warn_limit)19131913- pr_info("limit reached, disable warning\n");19071907+ if (do_warn) {19081908+ int remaining = atomic_dec_if_positive(&warn_limit);19091909+19101910+ if (remaining >= 0) {19111911+ pr_warn("allocation failed, size=%zu align=%zu atomic=%d, %s\n",19121912+ size, align, is_atomic, err);19131913+ if (!is_atomic)19141914+ dump_stack();19151915+ if (remaining == 0)19161916+ pr_info("limit reached, disable warning\n");19171917+ }19141918 }1915191919161920 if (is_atomic) {
+4-4
mm/vmalloc.c
···20262026 if (unlikely(!vmap_initialized))20272027 return ERR_PTR(-EBUSY);2028202820292029+ /* Only reclaim behaviour flags are relevant. */20302030+ gfp_mask = gfp_mask & GFP_RECLAIM_MASK;20292031 might_sleep();2030203220312033 /*···20402038 */20412039 va = node_alloc(size, align, vstart, vend, &addr, &vn_id);20422040 if (!va) {20432043- gfp_mask = gfp_mask & GFP_RECLAIM_MASK;20442044-20452041 va = kmem_cache_alloc_node(vmap_area_cachep, gfp_mask, node);20462042 if (unlikely(!va))20472043 return ERR_PTR(-ENOMEM);···20892089 BUG_ON(va->va_start < vstart);20902090 BUG_ON(va->va_end > vend);2091209120922092- ret = kasan_populate_vmalloc(addr, size);20922092+ ret = kasan_populate_vmalloc(addr, size, gfp_mask);20932093 if (ret) {20942094 free_vmap_area(va);20952095 return ERR_PTR(ret);···4826482648274827 /* populate the kasan shadow space */48284828 for (area = 0; area < nr_vms; area++) {48294829- if (kasan_populate_vmalloc(vas[area]->va_start, sizes[area]))48294829+ if (kasan_populate_vmalloc(vas[area]->va_start, sizes[area], GFP_KERNEL))48304830 goto err_free_shadow;48314831 }48324832
+7
net/bridge/br.c
···324324 int err = 0;325325 int opt_id;326326327327+ opt_id = find_next_bit(&bitmap, BITS_PER_LONG, BR_BOOLOPT_MAX);328328+ if (opt_id != BITS_PER_LONG) {329329+ NL_SET_ERR_MSG_FMT_MOD(extack, "Unknown boolean option %d",330330+ opt_id);331331+ return -EINVAL;332332+ }333333+327334 for_each_set_bit(opt_id, &bitmap, BR_BOOLOPT_MAX) {328335 bool on = !!(bm->optval & BIT(opt_id));329336
+4-1
net/can/j1939/bus.c
···290290 if (!ecu)291291 ecu = j1939_ecu_create_locked(priv, name);292292 err = PTR_ERR_OR_ZERO(ecu);293293- if (err)293293+ if (err) {294294+ if (j1939_address_is_unicast(sa))295295+ priv->ents[sa].nusers--;294296 goto done;297297+ }295298296299 ecu->nusers++;297300 /* TODO: do we care if ecu->addr != sa? */
···377377 j1939_sk_netdev_event_netdown(priv);378378 j1939_ecu_unmap_all(priv);379379 break;380380+ case NETDEV_UNREGISTER:381381+ j1939_sk_netdev_event_unregister(priv);382382+ break;380383 }381384382385 j1939_priv_put(priv);
+52
net/can/j1939/socket.c
···521521 ret = j1939_local_ecu_get(priv, jsk->addr.src_name, jsk->addr.sa);522522 if (ret) {523523 j1939_netdev_stop(priv);524524+ jsk->priv = NULL;525525+ synchronize_rcu();526526+ j1939_priv_put(priv);524527 goto out_release_sock;525528 }526529···13011298 j1939_sk_queue_drop_all(priv, jsk, error_code);13021299 }13031300 read_unlock_bh(&priv->j1939_socks_lock);13011301+}13021302+13031303+void j1939_sk_netdev_event_unregister(struct j1939_priv *priv)13041304+{13051305+ struct sock *sk;13061306+ struct j1939_sock *jsk;13071307+ bool wait_rcu = false;13081308+13091309+rescan: /* The caller is holding a ref on this "priv" via j1939_priv_get_by_ndev(). */13101310+ read_lock_bh(&priv->j1939_socks_lock);13111311+ list_for_each_entry(jsk, &priv->j1939_socks, list) {13121312+ /* Skip if j1939_jsk_add() is not called on this socket. */13131313+ if (!(jsk->state & J1939_SOCK_BOUND))13141314+ continue;13151315+ sk = &jsk->sk;13161316+ sock_hold(sk);13171317+ read_unlock_bh(&priv->j1939_socks_lock);13181318+ /* Check if j1939_jsk_del() is not yet called on this socket after holding13191319+ * socket's lock, for both j1939_sk_bind() and j1939_sk_release() call13201320+ * j1939_jsk_del() with socket's lock held.13211321+ */13221322+ lock_sock(sk);13231323+ if (jsk->state & J1939_SOCK_BOUND) {13241324+ /* Neither j1939_sk_bind() nor j1939_sk_release() called j1939_jsk_del().13251325+ * Make this socket no longer bound, by pretending as if j1939_sk_bind()13261326+ * dropped old references but did not get new references.13271327+ */13281328+ j1939_jsk_del(priv, jsk);13291329+ j1939_local_ecu_put(priv, jsk->addr.src_name, jsk->addr.sa);13301330+ j1939_netdev_stop(priv);13311331+ /* Call j1939_priv_put() now and prevent j1939_sk_sock_destruct() from13321332+ * calling the corresponding j1939_priv_put().13331333+ *13341334+ * j1939_sk_sock_destruct() is supposed to call j1939_priv_put() after13351335+ * an RCU grace period. But since the caller is holding a ref on this13361336+ * "priv", we can defer synchronize_rcu() until immediately before13371337+ * the caller calls j1939_priv_put().13381338+ */13391339+ j1939_priv_put(priv);13401340+ jsk->priv = NULL;13411341+ wait_rcu = true;13421342+ }13431343+ release_sock(sk);13441344+ sock_put(sk);13451345+ goto rescan;13461346+ }13471347+ read_unlock_bh(&priv->j1939_socks_lock);13481348+ if (wait_rcu)13491349+ synchronize_rcu();13041350}1305135113061352static int j1939_sk_no_ioctlcmd(struct socket *sock, unsigned int cmd,
+4-3
net/ceph/messenger.c
···15241524 * in case we faulted due to authentication, invalidate our15251525 * current tickets so that we can get new ones.15261526 */15271527- if (con->v1.auth_retry) {15271527+ if (!ceph_msgr2(from_msgr(con->msgr)) && con->v1.auth_retry) {15281528 dout("auth_retry %d, invalidating\n", con->v1.auth_retry);15291529 if (con->ops->invalidate_authorizer)15301530 con->ops->invalidate_authorizer(con);···17141714{17151715 /* come back from STANDBY? */17161716 if (con->state == CEPH_CON_S_STANDBY) {17171717- dout("clear_standby %p and ++connect_seq\n", con);17171717+ dout("clear_standby %p\n", con);17181718 con->state = CEPH_CON_S_PREOPEN;17191719- con->v1.connect_seq++;17191719+ if (!ceph_msgr2(from_msgr(con->msgr)))17201720+ con->v1.connect_seq++;17201721 WARN_ON(ceph_con_flag_test(con, CEPH_CON_F_WRITE_PENDING));17211722 WARN_ON(ceph_con_flag_test(con, CEPH_CON_F_KEEPALIVE_PENDING));17221723 }
+18-4
net/core/dev_ioctl.c
···464464 if (!netif_device_present(dev))465465 return -ENODEV;466466467467- if (ops->ndo_hwtstamp_get)468468- return dev_get_hwtstamp_phylib(dev, kernel_cfg);467467+ if (ops->ndo_hwtstamp_get) {468468+ int err;469469+470470+ netdev_lock_ops(dev);471471+ err = dev_get_hwtstamp_phylib(dev, kernel_cfg);472472+ netdev_unlock_ops(dev);473473+474474+ return err;475475+ }469476470477 /* Legacy path: unconverted lower driver */471478 return generic_hwtstamp_ioctl_lower(dev, SIOCGHWTSTAMP, kernel_cfg);···488481 if (!netif_device_present(dev))489482 return -ENODEV;490483491491- if (ops->ndo_hwtstamp_set)492492- return dev_set_hwtstamp_phylib(dev, kernel_cfg, extack);484484+ if (ops->ndo_hwtstamp_set) {485485+ int err;486486+487487+ netdev_lock_ops(dev);488488+ err = dev_set_hwtstamp_phylib(dev, kernel_cfg, extack);489489+ netdev_unlock_ops(dev);490490+491491+ return err;492492+ }493493494494 /* Legacy path: unconverted lower driver */495495 return generic_hwtstamp_ioctl_lower(dev, SIOCSHWTSTAMP, kernel_cfg);
···2424 struct nft_set_binding binding;2525};26262727-#ifdef CONFIG_MITIGATION_RETPOLINE2828-const struct nft_set_ext *2929-nft_set_do_lookup(const struct net *net, const struct nft_set *set,3030- const u32 *key)2727+static const struct nft_set_ext *2828+__nft_set_do_lookup(const struct net *net, const struct nft_set *set,2929+ const u32 *key)3130{3131+#ifdef CONFIG_MITIGATION_RETPOLINE3232 if (set->ops == &nft_set_hash_fast_type.ops)3333 return nft_hash_lookup_fast(net, set, key);3434 if (set->ops == &nft_set_hash_type.ops)···5151 return nft_rbtree_lookup(net, set, key);52525353 WARN_ON_ONCE(1);5454+#endif5455 return set->ops->lookup(net, set, key);5556}5757+5858+static unsigned int nft_base_seq(const struct net *net)5959+{6060+ /* pairs with smp_store_release() in nf_tables_commit() */6161+ return smp_load_acquire(&net->nft.base_seq);6262+}6363+6464+static bool nft_lookup_should_retry(const struct net *net, unsigned int seq)6565+{6666+ return unlikely(seq != nft_base_seq(net));6767+}6868+6969+const struct nft_set_ext *7070+nft_set_do_lookup(const struct net *net, const struct nft_set *set,7171+ const u32 *key)7272+{7373+ const struct nft_set_ext *ext;7474+ unsigned int base_seq;7575+7676+ do {7777+ base_seq = nft_base_seq(net);7878+7979+ ext = __nft_set_do_lookup(net, set, key);8080+ if (ext)8181+ break;8282+ /* No match? There is a small chance that lookup was8383+ * performed in the old generation, but nf_tables_commit()8484+ * already unlinked a (matching) element.8585+ *8686+ * We need to repeat the lookup to make sure that we didn't8787+ * miss a matching element in the new generation.8888+ */8989+ } while (nft_lookup_should_retry(net, base_seq));9090+9191+ return ext;9292+}5693EXPORT_SYMBOL_GPL(nft_set_do_lookup);5757-#endif58945995void nft_lookup_eval(const struct nft_expr *expr,6096 struct nft_regs *regs,
···510510 *511511 * This function is called from the data path. It will search for512512 * an element matching the given key in the current active copy.513513+ * Unlike other set types, this uses NFT_GENMASK_ANY instead of514514+ * nft_genmask_cur().515515+ *516516+ * This is because new (future) elements are not reachable from517517+ * priv->match, they get added to priv->clone instead.518518+ * When the commit phase flips the generation bitmask, the519519+ * 'now old' entries are skipped but without the 'now current'520520+ * elements becoming visible. Using nft_genmask_cur() thus creates521521+ * inconsistent state: matching old entries get skipped but thew522522+ * newly matching entries are unreachable.523523+ *524524+ * GENMASK will still find the 'now old' entries which ensures consistent525525+ * priv->match view.526526+ *527527+ * nft_pipapo_commit swaps ->clone and ->match shortly after the528528+ * genbit flip. As ->clone doesn't contain the old entries in the first529529+ * place, lookup will only find the now-current ones.513530 *514531 * Return: ntables API extension pointer or NULL if no match.515532 */···535518 const u32 *key)536519{537520 struct nft_pipapo *priv = nft_set_priv(set);538538- u8 genmask = nft_genmask_cur(net);539521 const struct nft_pipapo_match *m;540522 const struct nft_pipapo_elem *e;541523542524 m = rcu_dereference(priv->match);543543- e = pipapo_get(m, (const u8 *)key, genmask, get_jiffies_64());525525+ e = pipapo_get(m, (const u8 *)key, NFT_GENMASK_ANY, get_jiffies_64());544526545527 return e ? &e->ext : NULL;546528}
···276276277277static int rpc_wait_bit_killable(struct wait_bit_key *key, int mode)278278{279279- if (unlikely(current->flags & PF_EXITING))280280- return -EINTR;281279 schedule();282280 if (signal_pending_state(mode, current))283281 return -ERESTARTSYS;
+3-3
net/sunrpc/xprtsock.c
···407407 iov_iter_kvec(&msg.msg_iter, ITER_DEST, &alert_kvec, 1,408408 alert_kvec.iov_len);409409 ret = sock_recvmsg(sock, &msg, flags);410410- if (ret > 0 &&411411- tls_get_record_type(sock->sk, &u.cmsg) == TLS_RECORD_TYPE_ALERT) {412412- iov_iter_revert(&msg.msg_iter, ret);410410+ if (ret > 0) {411411+ if (tls_get_record_type(sock->sk, &u.cmsg) == TLS_RECORD_TYPE_ALERT)412412+ iov_iter_revert(&msg.msg_iter, ret);413413 ret = xs_sock_process_cmsg(sock, &msg, msg_flags, &u.cmsg,414414 -EAGAIN);415415 }
···138138/// }139139/// ```140140///141141-/// An example for a class device implementation is [`drm::Device`].141141+/// An example for a class device implementation is142142+#[cfg_attr(CONFIG_DRM = "y", doc = "[`drm::Device`](kernel::drm::Device).")]143143+#[cfg_attr(not(CONFIG_DRM = "y"), doc = "`drm::Device`.")]142144///143145/// # Invariants144146///···153151/// dropped from any thread.154152///155153/// [`AlwaysRefCounted`]: kernel::types::AlwaysRefCounted156156-/// [`drm::Device`]: kernel::drm::Device157154/// [`impl_device_context_deref`]: kernel::impl_device_context_deref158155/// [`pci::Device`]: kernel::pci::Device159156/// [`platform::Device`]: kernel::platform::Device
···302302 * barriers.303303 */304304 if (val & _Q_LOCKED_MASK)305305- smp_cond_load_acquire_label(&lock->locked, !VAL, release_err);305305+ (void)smp_cond_load_acquire_label(&lock->locked, !VAL, release_err);306306307307 /*308308 * take ownership and clear the pending bit.···380380 /* Link @node into the waitqueue. */381381 WRITE_ONCE(prev->next, node);382382383383- arch_mcs_spin_lock_contended_label(&node->locked, release_node_err);383383+ (void)arch_mcs_spin_lock_contended_label(&node->locked, release_node_err);384384385385 /*386386 * While waiting for the MCS lock, the next pointer may have
+32-14
tools/testing/selftests/bpf/progs/crypto_sanity.c
···1414u16 udp_test_port = 7777;1515u32 authsize, key_len;1616char algo[128] = {};1717-char dst[16] = {};1717+char dst[16] = {}, dst_bad[8] = {};1818int status;19192020static int skb_dynptr_validate(struct __sk_buff *skb, struct bpf_dynptr *psrc)···5959 .authsize = authsize,6060 };6161 struct bpf_crypto_ctx *cctx;6262- int err = 0;6262+ int err;63636464 status = 0;6565-6665 if (key_len > 256) {6766 status = -EINVAL;6867 return 0;···69707071 __builtin_memcpy(¶ms.algo, algo, sizeof(algo));7172 __builtin_memcpy(¶ms.key, key, sizeof(key));7272- cctx = bpf_crypto_ctx_create(¶ms, sizeof(params), &err);73737474+ cctx = bpf_crypto_ctx_create(¶ms, sizeof(params), &err);7475 if (!cctx) {7576 status = err;7677 return 0;···7980 err = crypto_ctx_insert(cctx);8081 if (err && err != -EEXIST)8182 status = err;8282-8383 return 0;8484}8585···9092 struct bpf_dynptr psrc, pdst;9193 int err;92949595+ status = 0;9396 err = skb_dynptr_validate(skb, &psrc);9497 if (err < 0) {9598 status = err;···109110 return TC_ACT_SHOT;110111 }111112112112- /* dst is a global variable to make testing part easier to check. In real113113- * production code, a percpu map should be used to store the result.113113+ /* Check also bad case where the dst buffer is smaller than the114114+ * skb's linear section.115115+ */116116+ bpf_dynptr_from_mem(dst_bad, sizeof(dst_bad), 0, &pdst);117117+ status = bpf_crypto_decrypt(ctx, &psrc, &pdst, NULL);118118+ if (!status)119119+ status = -EIO;120120+ if (status != -EINVAL)121121+ goto err;122122+123123+ /* dst is a global variable to make testing part easier to check.124124+ * In real production code, a percpu map should be used to store125125+ * the result.114126 */115127 bpf_dynptr_from_mem(dst, sizeof(dst), 0, &pdst);116116-117128 status = bpf_crypto_decrypt(ctx, &psrc, &pdst, NULL);118118-129129+err:119130 return TC_ACT_SHOT;120131}121132···138129 int err;139130140131 status = 0;141141-142132 err = skb_dynptr_validate(skb, &psrc);143133 if (err < 0) {144134 status = err;···156148 return TC_ACT_SHOT;157149 }158150159159- /* dst is a global variable to make testing part easier to check. In real160160- * production code, a percpu map should be used to store the result.151151+ /* Check also bad case where the dst buffer is smaller than the152152+ * skb's linear section.153153+ */154154+ bpf_dynptr_from_mem(dst_bad, sizeof(dst_bad), 0, &pdst);155155+ status = bpf_crypto_encrypt(ctx, &psrc, &pdst, NULL);156156+ if (!status)157157+ status = -EIO;158158+ if (status != -EINVAL)159159+ goto err;160160+161161+ /* dst is a global variable to make testing part easier to check.162162+ * In real production code, a percpu map should be used to store163163+ * the result.161164 */162165 bpf_dynptr_from_mem(dst, sizeof(dst), 0, &pdst);163163-164166 status = bpf_crypto_encrypt(ctx, &psrc, &pdst, NULL);165165-167167+err:166168 return TC_ACT_SHOT;167169}168170
···11+#!/bin/bash22+# SPDX-License-Identifier: GPL-2.033+#44+# Author: Brett A C Sheffield <bacs@librecast.net>55+# Author: Oscar Maes <oscmaes92@gmail.com>66+#77+# Ensure destination ethernet field is correctly set for88+# broadcast packets99+1010+source lib.sh1111+1212+CLIENT_IP4="192.168.0.1"1313+GW_IP4="192.168.0.2"1414+1515+setup() {1616+ setup_ns CLIENT_NS SERVER_NS1717+1818+ ip -net "${SERVER_NS}" link add link1 type veth \1919+ peer name link0 netns "${CLIENT_NS}"2020+2121+ ip -net "${CLIENT_NS}" link set link0 up2222+ ip -net "${CLIENT_NS}" addr add "${CLIENT_IP4}"/24 dev link02323+2424+ ip -net "${SERVER_NS}" link set link1 up2525+2626+ ip -net "${CLIENT_NS}" route add default via "${GW_IP4}"2727+ ip netns exec "${CLIENT_NS}" arp -s "${GW_IP4}" 00:11:22:33:44:552828+}2929+3030+cleanup() {3131+ rm -f "${CAPFILE}" "${OUTPUT}"3232+ ip -net "${SERVER_NS}" link del link13333+ cleanup_ns "${CLIENT_NS}" "${SERVER_NS}"3434+}3535+3636+test_broadcast_ether_dst() {3737+ local rc=03838+ CAPFILE=$(mktemp -u cap.XXXXXXXXXX)3939+ OUTPUT=$(mktemp -u out.XXXXXXXXXX)4040+4141+ echo "Testing ethernet broadcast destination"4242+4343+ # start tcpdump listening for icmp4444+ # tcpdump will exit after receiving a single packet4545+ # timeout will kill tcpdump if it is still running after 2s4646+ timeout 2s ip netns exec "${CLIENT_NS}" \4747+ tcpdump -i link0 -c 1 -w "${CAPFILE}" icmp &> "${OUTPUT}" &4848+ pid=$!4949+ slowwait 1 grep -qs "listening" "${OUTPUT}"5050+5151+ # send broadcast ping5252+ ip netns exec "${CLIENT_NS}" \5353+ ping -W0.01 -c1 -b 255.255.255.255 &> /dev/null5454+5555+ # wait for tcpdump for exit after receiving packet5656+ wait "${pid}"5757+5858+ # compare ethernet destination field to ff:ff:ff:ff:ff:ff5959+ ether_dst=$(tcpdump -r "${CAPFILE}" -tnne 2>/dev/null | \6060+ awk '{sub(/,/,"",$3); print $3}')6161+ if [[ "${ether_dst}" == "ff:ff:ff:ff:ff:ff" ]]; then6262+ echo "[ OK ]"6363+ rc="${ksft_pass}"6464+ else6565+ echo "[FAIL] expected dst ether addr to be ff:ff:ff:ff:ff:ff," \6666+ "got ${ether_dst}"6767+ rc="${ksft_fail}"6868+ fi6969+7070+ return "${rc}"7171+}7272+7373+if [ ! -x "$(command -v tcpdump)" ]; then7474+ echo "SKIP: Could not run test without tcpdump tool"7575+ exit "${ksft_skip}"7676+fi7777+7878+trap cleanup EXIT7979+8080+setup8181+test_broadcast_ether_dst8282+8383+exit $?
···2828}29293030# This function is used in the cleanup trap3131-#shellcheck disable=SC23173131+#shellcheck disable=SC2317,SC23293232cleanup()3333{3434 ip netns pids "${ns}" | xargs --no-run-if-empty kill -SIGKILL &>/dev/null
···134134TEST_GROUP=""135135136136# This function is used in the cleanup trap137137-#shellcheck disable=SC2317137137+#shellcheck disable=SC2317,SC2329138138cleanup()139139{140140 rm -f "$cin_disconnect"
+1-1
tools/testing/selftests/net/mptcp/mptcp_join.sh
···8899# ShellCheck incorrectly believes that most of the code here is unreachable1010# because it's invoked by variable name, see how the "tests" array is used1111-#shellcheck disable=SC23171111+#shellcheck disable=SC2317,SC232912121313. "$(dirname "${0}")/mptcp_lib.sh"1414
···9595}96969797# This function is used in the cleanup trap9898-#shellcheck disable=SC23179898+#shellcheck disable=SC2317,SC23299999cleanup()100100{101101 mptcp_lib_ns_exit "${ns1}" "${ns2}" "${ns_sbox}"
+3-2
tools/testing/selftests/net/mptcp/pm_netlink.sh
···3232err=$(mktemp)33333434# This function is used in the cleanup trap3535-#shellcheck disable=SC23173535+#shellcheck disable=SC2317,SC23293636cleanup()3737{3838 rm -f "${err}"···7070 mptcp_lib_pm_nl_format_endpoints "${@}"7171}72727373+# This function is invoked indirectly7474+#shellcheck disable=SC2317,SC23297375get_endpoint() {7474- # shellcheck disable=SC2317 # invoked indirectly7576 mptcp_lib_pm_nl_get_endpoint "${ns1}" "${@}"7677}7778
+1-1
tools/testing/selftests/net/mptcp/simult_flows.sh
···3535}36363737# This function is used in the cleanup trap3838-#shellcheck disable=SC23173838+#shellcheck disable=SC2317,SC23293939cleanup()4040{4141 rm -f "$cout" "$sout"
+1-1
tools/testing/selftests/net/mptcp/userspace_pm.sh
···9494}95959696# This function is used in the cleanup trap9797-#shellcheck disable=SC23179797+#shellcheck disable=SC2317,SC23299898cleanup()9999{100100 print_title "Cleanup"