Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

+1

.mailmap

··· 416 416 Kenneth Westfield <quic_kwestfie@quicinc.com> <kwestfie@codeaurora.org> 417 417 Kiran Gunda <quic_kgunda@quicinc.com> <kgunda@codeaurora.org> 418 418 Kirill Tkhai <tkhai@ya.ru> <ktkhai@virtuozzo.com> 419 + Kirill A. Shutemov <kas@kernel.org> <kirill.shutemov@linux.intel.com> 419 420 Kishon Vijay Abraham I <kishon@kernel.org> <kishon@ti.com> 420 421 Konrad Dybcio <konradybcio@kernel.org> <konrad.dybcio@linaro.org> 421 422 Konrad Dybcio <konradybcio@kernel.org> <konrad.dybcio@somainline.org>

-6

Documentation/admin-guide/cgroup-v2.rst

··· 1732 1732 numa_hint_faults (npn) 1733 1733 Number of NUMA hinting faults. 1734 1734 1735 - numa_task_migrated (npn) 1736 - Number of task migration by NUMA balancing. 1737 - 1738 - numa_task_swapped (npn) 1739 - Number of task swap by NUMA balancing. 1740 - 1741 1735 pgdemote_kswapd 1742 1736 Number of pages demoted by kswapd. 1743 1737

+3

Documentation/devicetree/bindings/clock/mediatek,mt8188-clock.yaml

··· 52 52 '#clock-cells': 53 53 const: 1 54 54 55 + '#reset-cells': 56 + const: 1 57 + 55 58 required: 56 59 - compatible 57 60 - reg

+147 -6

Documentation/netlink/specs/ovpn.yaml

··· 161 161 type: uint 162 162 doc: Number of packets transmitted at the transport level 163 163 - 164 + name: peer-new-input 165 + subset-of: peer 166 + attributes: 167 + - 168 + name: id 169 + - 170 + name: remote-ipv4 171 + - 172 + name: remote-ipv6 173 + - 174 + name: remote-ipv6-scope-id 175 + - 176 + name: remote-port 177 + - 178 + name: socket 179 + - 180 + name: vpn-ipv4 181 + - 182 + name: vpn-ipv6 183 + - 184 + name: local-ipv4 185 + - 186 + name: local-ipv6 187 + - 188 + name: keepalive-interval 189 + - 190 + name: keepalive-timeout 191 + - 192 + name: peer-set-input 193 + subset-of: peer 194 + attributes: 195 + - 196 + name: id 197 + - 198 + name: remote-ipv4 199 + - 200 + name: remote-ipv6 201 + - 202 + name: remote-ipv6-scope-id 203 + - 204 + name: remote-port 205 + - 206 + name: vpn-ipv4 207 + - 208 + name: vpn-ipv6 209 + - 210 + name: local-ipv4 211 + - 212 + name: local-ipv6 213 + - 214 + name: keepalive-interval 215 + - 216 + name: keepalive-timeout 217 + - 218 + name: peer-del-input 219 + subset-of: peer 220 + attributes: 221 + - 222 + name: id 223 + - 164 224 name: keyconf 165 225 attributes: 166 226 - ··· 276 216 obtain the actual cipher IV 277 217 checks: 278 218 exact-len: nonce-tail-size 219 + 220 + - 221 + name: keyconf-get 222 + subset-of: keyconf 223 + attributes: 224 + - 225 + name: peer-id 226 + - 227 + name: slot 228 + - 229 + name: key-id 230 + - 231 + name: cipher-alg 232 + - 233 + name: keyconf-swap-input 234 + subset-of: keyconf 235 + attributes: 236 + - 237 + name: peer-id 238 + - 239 + name: keyconf-del-input 240 + subset-of: keyconf 241 + attributes: 242 + - 243 + name: peer-id 244 + - 245 + name: slot 279 246 - 280 247 name: ovpn 281 248 attributes: ··· 322 235 type: nest 323 236 doc: Peer specific cipher configuration 324 237 nested-attributes: keyconf 238 + - 239 + name: ovpn-peer-new-input 240 + subset-of: ovpn 241 + attributes: 242 + - 243 + name: ifindex 244 + - 245 + name: peer 246 + nested-attributes: peer-new-input 247 + - 248 + name: ovpn-peer-set-input 249 + subset-of: ovpn 250 + attributes: 251 + - 252 + name: ifindex 253 + - 254 + name: peer 255 + nested-attributes: peer-set-input 256 + - 257 + name: ovpn-peer-del-input 258 + subset-of: ovpn 259 + attributes: 260 + - 261 + name: ifindex 262 + - 263 + name: peer 264 + nested-attributes: peer-del-input 265 + - 266 + name: ovpn-keyconf-get 267 + subset-of: ovpn 268 + attributes: 269 + - 270 + name: ifindex 271 + - 272 + name: keyconf 273 + nested-attributes: keyconf-get 274 + - 275 + name: ovpn-keyconf-swap-input 276 + subset-of: ovpn 277 + attributes: 278 + - 279 + name: ifindex 280 + - 281 + name: keyconf 282 + nested-attributes: keyconf-swap-input 283 + - 284 + name: ovpn-keyconf-del-input 285 + subset-of: ovpn 286 + attributes: 287 + - 288 + name: ifindex 289 + - 290 + name: keyconf 291 + nested-attributes: keyconf-del-input 325 292 326 293 operations: 327 294 list: 328 295 - 329 296 name: peer-new 330 - attribute-set: ovpn 297 + attribute-set: ovpn-peer-new-input 331 298 flags: [admin-perm] 332 299 doc: Add a remote peer 333 300 do: ··· 393 252 - peer 394 253 - 395 254 name: peer-set 396 - attribute-set: ovpn 255 + attribute-set: ovpn-peer-set-input 397 256 flags: [admin-perm] 398 257 doc: modify a remote peer 399 258 do: ··· 427 286 - peer 428 287 - 429 288 name: peer-del 430 - attribute-set: ovpn 289 + attribute-set: ovpn-peer-del-input 431 290 flags: [admin-perm] 432 291 doc: Delete existing remote peer 433 292 do: ··· 457 316 - keyconf 458 317 - 459 318 name: key-get 460 - attribute-set: ovpn 319 + attribute-set: ovpn-keyconf-get 461 320 flags: [admin-perm] 462 321 doc: Retrieve non-sensitive data about peer key and cipher 463 322 do: ··· 472 331 - keyconf 473 332 - 474 333 name: key-swap 475 - attribute-set: ovpn 334 + attribute-set: ovpn-keyconf-swap-input 476 335 flags: [admin-perm] 477 336 doc: Swap primary and secondary session keys for a specific peer 478 337 do: ··· 491 350 mcgrp: peers 492 351 - 493 352 name: key-del 494 - attribute-set: ovpn 353 + attribute-set: ovpn-keyconf-del-input 495 354 flags: [admin-perm] 496 355 doc: Delete cipher key for a specific peer 497 356 do:

+2 -2

MAINTAINERS

··· 10519 10519 F: block/partitions/efi.* 10520 10520 10521 10521 HABANALABS PCI DRIVER 10522 - M: Ofir Bitton <obitton@habana.ai> 10522 + M: Yaron Avizrat <yaron.avizrat@intel.com> 10523 10523 L: dri-devel@lists.freedesktop.org 10524 10524 S: Supported 10525 10525 C: irc://irc.oftc.net/dri-devel ··· 26961 26961 F: arch/x86/kernel/unwind_*.c 26962 26962 26963 26963 X86 TRUST DOMAIN EXTENSIONS (TDX) 26964 - M: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> 26964 + M: Kirill A. Shutemov <kas@kernel.org> 26965 26965 R: Dave Hansen <dave.hansen@linux.intel.com> 26966 26966 L: x86@kernel.org 26967 26967 L: linux-coco@lists.linux.dev

+1 -1

Makefile

··· 2 2 VERSION = 6 3 3 PATCHLEVEL = 16 4 4 SUBLEVEL = 0 5 - EXTRAVERSION = -rc5 5 + EXTRAVERSION = -rc6 6 6 NAME = Baby Opossum Posse 7 7 8 8 # *DOCUMENTATION*

+2 -1

arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi

··· 687 687 }; 688 688 689 689 wdog0: watchdog@2ad0000 { 690 - compatible = "fsl,imx21-wdt"; 690 + compatible = "fsl,ls1046a-wdt", "fsl,imx21-wdt"; 691 691 reg = <0x0 0x2ad0000 0x0 0x10000>; 692 692 interrupts = <GIC_SPI 83 IRQ_TYPE_LEVEL_HIGH>; 693 693 clocks = <&clockgen QORIQ_CLK_PLATFORM_PLL 694 694 QORIQ_CLK_PLL_DIV(2)>; 695 + big-endian; 695 696 }; 696 697 697 698 edma0: dma-controller@2c00000 {

+1

arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi

··· 464 464 }; 465 465 466 466 reg_nvcc_sd: LDO5 { 467 + regulator-always-on; 467 468 regulator-max-microvolt = <3300000>; 468 469 regulator-min-microvolt = <1800000>; 469 470 regulator-name = "On-module +V3.3_1.8_SD (LDO5)";

+1 -1

arch/arm64/boot/dts/freescale/imx8mp-venice-gw71xx.dtsi

··· 70 70 tpm@1 { 71 71 compatible = "atmel,attpm20p", "tcg,tpm_tis-spi"; 72 72 reg = <0x1>; 73 - spi-max-frequency = <36000000>; 73 + spi-max-frequency = <25000000>; 74 74 }; 75 75 }; 76 76

+1 -1

arch/arm64/boot/dts/freescale/imx8mp-venice-gw72xx.dtsi

··· 110 110 tpm@1 { 111 111 compatible = "atmel,attpm20p", "tcg,tpm_tis-spi"; 112 112 reg = <0x1>; 113 - spi-max-frequency = <36000000>; 113 + spi-max-frequency = <25000000>; 114 114 }; 115 115 }; 116 116

+1 -1

arch/arm64/boot/dts/freescale/imx8mp-venice-gw73xx.dtsi

··· 122 122 tpm@1 { 123 123 compatible = "atmel,attpm20p", "tcg,tpm_tis-spi"; 124 124 reg = <0x1>; 125 - spi-max-frequency = <36000000>; 125 + spi-max-frequency = <25000000>; 126 126 }; 127 127 }; 128 128

+1 -1

arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts

··· 201 201 tpm@0 { 202 202 compatible = "atmel,attpm20p", "tcg,tpm_tis-spi"; 203 203 reg = <0x0>; 204 - spi-max-frequency = <36000000>; 204 + spi-max-frequency = <25000000>; 205 205 }; 206 206 }; 207 207

+10 -10

arch/arm64/boot/dts/freescale/imx95-15x15-evk.dts

··· 574 574 &scmi_iomuxc { 575 575 pinctrl_emdio: emdiogrp { 576 576 fsl,pins = < 577 - IMX95_PAD_ENET2_MDC__NETCMIX_TOP_NETC_MDC 0x57e 578 - IMX95_PAD_ENET2_MDIO__NETCMIX_TOP_NETC_MDIO 0x97e 577 + IMX95_PAD_ENET2_MDC__NETCMIX_TOP_NETC_MDC 0x50e 578 + IMX95_PAD_ENET2_MDIO__NETCMIX_TOP_NETC_MDIO 0x90e 579 579 >; 580 580 }; 581 581 582 582 pinctrl_enetc0: enetc0grp { 583 583 fsl,pins = < 584 - IMX95_PAD_ENET1_TD3__NETCMIX_TOP_ETH0_RGMII_TD3 0x57e 585 - IMX95_PAD_ENET1_TD2__NETCMIX_TOP_ETH0_RGMII_TD2 0x57e 586 - IMX95_PAD_ENET1_TD1__NETCMIX_TOP_ETH0_RGMII_TD1 0x57e 587 - IMX95_PAD_ENET1_TD0__NETCMIX_TOP_ETH0_RGMII_TD0 0x57e 584 + IMX95_PAD_ENET1_TD3__NETCMIX_TOP_ETH0_RGMII_TD3 0x50e 585 + IMX95_PAD_ENET1_TD2__NETCMIX_TOP_ETH0_RGMII_TD2 0x50e 586 + IMX95_PAD_ENET1_TD1__NETCMIX_TOP_ETH0_RGMII_TD1 0x50e 587 + IMX95_PAD_ENET1_TD0__NETCMIX_TOP_ETH0_RGMII_TD0 0x50e 588 588 IMX95_PAD_ENET1_TX_CTL__NETCMIX_TOP_ETH0_RGMII_TX_CTL 0x57e 589 589 IMX95_PAD_ENET1_TXC__NETCMIX_TOP_ETH0_RGMII_TX_CLK 0x58e 590 590 IMX95_PAD_ENET1_RX_CTL__NETCMIX_TOP_ETH0_RGMII_RX_CTL 0x57e ··· 598 598 599 599 pinctrl_enetc1: enetc1grp { 600 600 fsl,pins = < 601 - IMX95_PAD_ENET2_TD3__NETCMIX_TOP_ETH1_RGMII_TD3 0x57e 602 - IMX95_PAD_ENET2_TD2__NETCMIX_TOP_ETH1_RGMII_TD2 0x57e 603 - IMX95_PAD_ENET2_TD1__NETCMIX_TOP_ETH1_RGMII_TD1 0x57e 604 - IMX95_PAD_ENET2_TD0__NETCMIX_TOP_ETH1_RGMII_TD0 0x57e 601 + IMX95_PAD_ENET2_TD3__NETCMIX_TOP_ETH1_RGMII_TD3 0x50e 602 + IMX95_PAD_ENET2_TD2__NETCMIX_TOP_ETH1_RGMII_TD2 0x50e 603 + IMX95_PAD_ENET2_TD1__NETCMIX_TOP_ETH1_RGMII_TD1 0x50e 604 + IMX95_PAD_ENET2_TD0__NETCMIX_TOP_ETH1_RGMII_TD0 0x50e 605 605 IMX95_PAD_ENET2_TX_CTL__NETCMIX_TOP_ETH1_RGMII_TX_CTL 0x57e 606 606 IMX95_PAD_ENET2_TXC__NETCMIX_TOP_ETH1_RGMII_TX_CLK 0x58e 607 607 IMX95_PAD_ENET2_RX_CTL__NETCMIX_TOP_ETH1_RGMII_RX_CTL 0x57e

+6 -6

arch/arm64/boot/dts/freescale/imx95-19x19-evk.dts

··· 566 566 &scmi_iomuxc { 567 567 pinctrl_emdio: emdiogrp{ 568 568 fsl,pins = < 569 - IMX95_PAD_ENET1_MDC__NETCMIX_TOP_NETC_MDC 0x57e 570 - IMX95_PAD_ENET1_MDIO__NETCMIX_TOP_NETC_MDIO 0x97e 569 + IMX95_PAD_ENET1_MDC__NETCMIX_TOP_NETC_MDC 0x50e 570 + IMX95_PAD_ENET1_MDIO__NETCMIX_TOP_NETC_MDIO 0x90e 571 571 >; 572 572 }; 573 573 574 574 pinctrl_enetc0: enetc0grp { 575 575 fsl,pins = < 576 - IMX95_PAD_ENET1_TD3__NETCMIX_TOP_ETH0_RGMII_TD3 0x57e 577 - IMX95_PAD_ENET1_TD2__NETCMIX_TOP_ETH0_RGMII_TD2 0x57e 578 - IMX95_PAD_ENET1_TD1__NETCMIX_TOP_ETH0_RGMII_TD1 0x57e 579 - IMX95_PAD_ENET1_TD0__NETCMIX_TOP_ETH0_RGMII_TD0 0x57e 576 + IMX95_PAD_ENET1_TD3__NETCMIX_TOP_ETH0_RGMII_TD3 0x50e 577 + IMX95_PAD_ENET1_TD2__NETCMIX_TOP_ETH0_RGMII_TD2 0x50e 578 + IMX95_PAD_ENET1_TD1__NETCMIX_TOP_ETH0_RGMII_TD1 0x50e 579 + IMX95_PAD_ENET1_TD0__NETCMIX_TOP_ETH0_RGMII_TD0 0x50e 580 580 IMX95_PAD_ENET1_TX_CTL__NETCMIX_TOP_ETH0_RGMII_TX_CTL 0x57e 581 581 IMX95_PAD_ENET1_TXC__NETCMIX_TOP_ETH0_RGMII_TX_CLK 0x58e 582 582 IMX95_PAD_ENET1_RX_CTL__NETCMIX_TOP_ETH0_RGMII_RX_CTL 0x57e

+1 -1

arch/arm64/boot/dts/freescale/imx95.dtsi

··· 1708 1708 <0x9 0 1 0>; 1709 1709 reg-names = "dbi","atu", "dbi2", "app", "dma", "addr_space"; 1710 1710 num-lanes = <1>; 1711 - interrupts = <GIC_SPI 317 IRQ_TYPE_LEVEL_HIGH>; 1711 + interrupts = <GIC_SPI 311 IRQ_TYPE_LEVEL_HIGH>; 1712 1712 interrupt-names = "dma"; 1713 1713 clocks = <&scmi_clk IMX95_CLK_HSIO>, 1714 1714 <&scmi_clk IMX95_CLK_HSIOPLL>,

+2

arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts

··· 1090 1090 }; 1091 1091 1092 1092 &pmk8280_rtc { 1093 + qcom,uefi-rtc-info; 1094 + 1093 1095 status = "okay"; 1094 1096 }; 1095 1097

+1

arch/arm64/boot/dts/qcom/x1e80100-pmics.dtsi

··· 224 224 reg-names = "rtc", "alarm"; 225 225 interrupts = <0x0 0x62 0x1 IRQ_TYPE_EDGE_RISING>; 226 226 qcom,no-alarm; /* alarm owned by ADSP */ 227 + qcom,uefi-rtc-info; 227 228 }; 228 229 229 230 pmk8550_sdam_2: nvram@7100 {

+23

arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi

··· 379 379 <0 RK_PA7 RK_FUNC_GPIO &pcfg_pull_up>; 380 380 }; 381 381 }; 382 + 383 + spi1 { 384 + spi1_csn0_gpio_pin: spi1-csn0-gpio-pin { 385 + rockchip,pins = 386 + <3 RK_PB1 RK_FUNC_GPIO &pcfg_pull_up_4ma>; 387 + }; 388 + 389 + spi1_csn1_gpio_pin: spi1-csn1-gpio-pin { 390 + rockchip,pins = 391 + <3 RK_PB2 RK_FUNC_GPIO &pcfg_pull_up_4ma>; 392 + }; 393 + }; 382 394 }; 383 395 384 396 &pmu_io_domains { ··· 406 394 407 395 &sdmmc { 408 396 vqmmc-supply = <&vccio_sd>; 397 + }; 398 + 399 + &spi1 { 400 + /* 401 + * Hardware CS has a very slow rise time of about 6us, 402 + * causing transmission errors. 403 + * With cs-gpios we have a rise time of about 20ns. 404 + */ 405 + cs-gpios = <&gpio3 RK_PB1 GPIO_ACTIVE_LOW>, <&gpio3 RK_PB2 GPIO_ACTIVE_LOW>; 406 + pinctrl-names = "default"; 407 + pinctrl-0 = <&spi1_clk &spi1_csn0_gpio_pin &spi1_csn1_gpio_pin &spi1_miso &spi1_mosi>; 409 408 }; 410 409 411 410 &tsadc {

+1

arch/arm64/boot/dts/rockchip/rk3566-quartz64-a.dts

··· 30 30 31 31 fan: gpio_fan { 32 32 compatible = "gpio-fan"; 33 + fan-supply = <&vcc12v_dcin>; 33 34 gpios = <&gpio0 RK_PD5 GPIO_ACTIVE_HIGH>; 34 35 gpio-fan,speed-map = 35 36 < 0 0>,

+28

arch/arm64/boot/dts/rockchip/rk3576-armsom-sige5.dts

··· 211 211 status = "okay"; 212 212 }; 213 213 214 + &cpu_b0 { 215 + cpu-supply = <&vdd_cpu_big_s0>; 216 + }; 217 + 218 + &cpu_b1 { 219 + cpu-supply = <&vdd_cpu_big_s0>; 220 + }; 221 + 222 + &cpu_b2 { 223 + cpu-supply = <&vdd_cpu_big_s0>; 224 + }; 225 + 226 + &cpu_b3 { 227 + cpu-supply = <&vdd_cpu_big_s0>; 228 + }; 229 + 214 230 &cpu_l0 { 231 + cpu-supply = <&vdd_cpu_lit_s0>; 232 + }; 233 + 234 + &cpu_l1 { 235 + cpu-supply = <&vdd_cpu_lit_s0>; 236 + }; 237 + 238 + &cpu_l2 { 239 + cpu-supply = <&vdd_cpu_lit_s0>; 240 + }; 241 + 242 + &cpu_l3 { 215 243 cpu-supply = <&vdd_cpu_lit_s0>; 216 244 }; 217 245

+1 -1

arch/arm64/boot/dts/rockchip/rk3576.dtsi

··· 615 615 <0 0 0 2 &pcie1_intc 1>, 616 616 <0 0 0 3 &pcie1_intc 2>, 617 617 <0 0 0 4 &pcie1_intc 3>; 618 - linux,pci-domain = <0>; 618 + linux,pci-domain = <1>; 619 619 max-link-speed = <2>; 620 620 num-ib-windows = <8>; 621 621 num-viewport = <8>;

+10 -10

arch/arm64/boot/dts/rockchip/rk3588-base-pinctrl.dtsi

··· 578 578 hdmim0_tx0_scl: hdmim0-tx0-scl { 579 579 rockchip,pins = 580 580 /* hdmim0_tx0_scl */ 581 - <4 RK_PB7 5 &pcfg_pull_none>; 581 + <4 RK_PB7 5 &pcfg_pull_none_drv_level_5_smt>; 582 582 }; 583 583 584 584 /omit-if-no-ref/ 585 585 hdmim0_tx0_sda: hdmim0-tx0-sda { 586 586 rockchip,pins = 587 587 /* hdmim0_tx0_sda */ 588 - <4 RK_PC0 5 &pcfg_pull_none>; 588 + <4 RK_PC0 5 &pcfg_pull_none_drv_level_1_smt>; 589 589 }; 590 590 591 591 /omit-if-no-ref/ ··· 640 640 hdmim1_tx0_scl: hdmim1-tx0-scl { 641 641 rockchip,pins = 642 642 /* hdmim1_tx0_scl */ 643 - <0 RK_PD5 11 &pcfg_pull_none>; 643 + <0 RK_PD5 11 &pcfg_pull_none_drv_level_5_smt>; 644 644 }; 645 645 646 646 /omit-if-no-ref/ 647 647 hdmim1_tx0_sda: hdmim1-tx0-sda { 648 648 rockchip,pins = 649 649 /* hdmim1_tx0_sda */ 650 - <0 RK_PD4 11 &pcfg_pull_none>; 650 + <0 RK_PD4 11 &pcfg_pull_none_drv_level_1_smt>; 651 651 }; 652 652 653 653 /omit-if-no-ref/ ··· 668 668 hdmim1_tx1_scl: hdmim1-tx1-scl { 669 669 rockchip,pins = 670 670 /* hdmim1_tx1_scl */ 671 - <3 RK_PC6 5 &pcfg_pull_none>; 671 + <3 RK_PC6 5 &pcfg_pull_none_drv_level_5_smt>; 672 672 }; 673 673 674 674 /omit-if-no-ref/ 675 675 hdmim1_tx1_sda: hdmim1-tx1-sda { 676 676 rockchip,pins = 677 677 /* hdmim1_tx1_sda */ 678 - <3 RK_PC5 5 &pcfg_pull_none>; 678 + <3 RK_PC5 5 &pcfg_pull_none_drv_level_1_smt>; 679 679 }; 680 680 /omit-if-no-ref/ 681 681 hdmim2_rx_cec: hdmim2-rx-cec { ··· 709 709 hdmim2_tx0_scl: hdmim2-tx0-scl { 710 710 rockchip,pins = 711 711 /* hdmim2_tx0_scl */ 712 - <3 RK_PC7 5 &pcfg_pull_none>; 712 + <3 RK_PC7 5 &pcfg_pull_none_drv_level_5_smt>; 713 713 }; 714 714 715 715 /omit-if-no-ref/ 716 716 hdmim2_tx0_sda: hdmim2-tx0-sda { 717 717 rockchip,pins = 718 718 /* hdmim2_tx0_sda */ 719 - <3 RK_PD0 5 &pcfg_pull_none>; 719 + <3 RK_PD0 5 &pcfg_pull_none_drv_level_1_smt>; 720 720 }; 721 721 722 722 /omit-if-no-ref/ ··· 730 730 hdmim2_tx1_scl: hdmim2-tx1-scl { 731 731 rockchip,pins = 732 732 /* hdmim2_tx1_scl */ 733 - <1 RK_PA4 5 &pcfg_pull_none>; 733 + <1 RK_PA4 5 &pcfg_pull_none_drv_level_5_smt>; 734 734 }; 735 735 736 736 /omit-if-no-ref/ 737 737 hdmim2_tx1_sda: hdmim2-tx1-sda { 738 738 rockchip,pins = 739 739 /* hdmim2_tx1_sda */ 740 - <1 RK_PA3 5 &pcfg_pull_none>; 740 + <1 RK_PA3 5 &pcfg_pull_none_drv_level_1_smt>; 741 741 }; 742 742 743 743 /omit-if-no-ref/

+1

arch/arm64/boot/dts/rockchip/rk3588-coolpi-cm5.dtsi

··· 321 321 bus-width = <4>; 322 322 cap-mmc-highspeed; 323 323 cap-sd-highspeed; 324 + cd-gpios = <&gpio0 RK_PA4 GPIO_ACTIVE_LOW>; 324 325 disable-wp; 325 326 max-frequency = <150000000>; 326 327 no-sdio;

+3 -2

arch/arm64/boot/dts/rockchip/rk3588-extra-pinctrl.dtsi

··· 160 160 hdmim0_tx1_scl: hdmim0-tx1-scl { 161 161 rockchip,pins = 162 162 /* hdmim0_tx1_scl */ 163 - <2 RK_PB5 4 &pcfg_pull_none>; 163 + <2 RK_PB5 4 &pcfg_pull_none_drv_level_3_smt>; 164 164 }; 165 165 166 166 /omit-if-no-ref/ 167 167 hdmim0_tx1_sda: hdmim0-tx1-sda { 168 168 rockchip,pins = 169 169 /* hdmim0_tx1_sda */ 170 - <2 RK_PB4 4 &pcfg_pull_none>; 170 + <2 RK_PB4 4 &pcfg_pull_none_drv_level_1_smt>; 171 + 171 172 }; 172 173 }; 173 174

+1

arch/arm64/boot/dts/rockchip/rk3588s-coolpi-4b.dts

··· 474 474 bus-width = <4>; 475 475 cap-mmc-highspeed; 476 476 cap-sd-highspeed; 477 + cd-gpios = <&gpio0 RK_PA4 GPIO_ACTIVE_LOW>; 477 478 disable-wp; 478 479 max-frequency = <150000000>; 479 480 no-sdio;

+35

arch/arm64/boot/dts/rockchip/rockchip-pinconf.dtsi

··· 333 333 }; 334 334 335 335 /omit-if-no-ref/ 336 + pcfg_pull_none_drv_level_1_smt: pcfg-pull-none-drv-level-1-smt { 337 + bias-disable; 338 + drive-strength = <1>; 339 + input-schmitt-enable; 340 + }; 341 + 342 + /omit-if-no-ref/ 343 + pcfg_pull_none_drv_level_2_smt: pcfg-pull-none-drv-level-2-smt { 344 + bias-disable; 345 + drive-strength = <2>; 346 + input-schmitt-enable; 347 + }; 348 + 349 + /omit-if-no-ref/ 350 + pcfg_pull_none_drv_level_3_smt: pcfg-pull-none-drv-level-3-smt { 351 + bias-disable; 352 + drive-strength = <3>; 353 + input-schmitt-enable; 354 + }; 355 + 356 + /omit-if-no-ref/ 357 + pcfg_pull_none_drv_level_4_smt: pcfg-pull-none-drv-level-4-smt { 358 + bias-disable; 359 + drive-strength = <4>; 360 + input-schmitt-enable; 361 + }; 362 + 363 + /omit-if-no-ref/ 364 + pcfg_pull_none_drv_level_5_smt: pcfg-pull-none-drv-level-5-smt { 365 + bias-disable; 366 + drive-strength = <5>; 367 + input-schmitt-enable; 368 + }; 369 + 370 + /omit-if-no-ref/ 336 371 pcfg_output_high: pcfg-output-high { 337 372 output-high; 338 373 };

+1

arch/arm64/configs/defconfig

··· 1444 1444 CONFIG_BCM2835_MBOX=y 1445 1445 CONFIG_QCOM_APCS_IPC=y 1446 1446 CONFIG_MTK_ADSP_MBOX=m 1447 + CONFIG_QCOM_CPUCP_MBOX=m 1447 1448 CONFIG_QCOM_IPCC=y 1448 1449 CONFIG_ROCKCHIP_IOMMU=y 1449 1450 CONFIG_TEGRA_IOMMU_SMMU=y

+1 -1

arch/x86/Kconfig

··· 147 147 select ARCH_WANTS_DYNAMIC_TASK_STRUCT 148 148 select ARCH_WANTS_NO_INSTR 149 149 select ARCH_WANT_GENERAL_HUGETLB 150 - select ARCH_WANT_HUGE_PMD_SHARE 150 + select ARCH_WANT_HUGE_PMD_SHARE if X86_64 151 151 select ARCH_WANT_LD_ORPHAN_WARN 152 152 select ARCH_WANT_OPTIMIZE_DAX_VMEMMAP if X86_64 153 153 select ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP if X86_64

+1

arch/x86/include/asm/msr-index.h

··· 628 628 #define MSR_AMD64_OSVW_STATUS 0xc0010141 629 629 #define MSR_AMD_PPIN_CTL 0xc00102f0 630 630 #define MSR_AMD_PPIN 0xc00102f1 631 + #define MSR_AMD64_CPUID_FN_7 0xc0011002 631 632 #define MSR_AMD64_CPUID_FN_1 0xc0011004 632 633 #define MSR_AMD64_LS_CFG 0xc0011020 633 634 #define MSR_AMD64_DC_CFG 0xc0011022

+10

arch/x86/kernel/cpu/amd.c

··· 974 974 init_spectral_chicken(c); 975 975 fix_erratum_1386(c); 976 976 zen2_zenbleed_check(c); 977 + 978 + /* Disable RDSEED on AMD Cyan Skillfish because of an error. */ 979 + if (c->x86_model == 0x47 && c->x86_stepping == 0x0) { 980 + clear_cpu_cap(c, X86_FEATURE_RDSEED); 981 + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); 982 + pr_emerg("RDSEED is not reliable on this platform; disabling.\n"); 983 + } 984 + 985 + /* Correct misconfigured CPUID on some clients. */ 986 + clear_cpu_cap(c, X86_FEATURE_INVLPGB); 977 987 } 978 988 979 989 static void init_amd_zen3(struct cpuinfo_x86 *c)

+19

drivers/base/power/main.c

··· 1280 1280 dpm_async_with_cleanup(dev->parent, func); 1281 1281 } 1282 1282 1283 + static void dpm_async_suspend_complete_all(struct list_head *device_list) 1284 + { 1285 + struct device *dev; 1286 + 1287 + guard(mutex)(&async_wip_mtx); 1288 + 1289 + list_for_each_entry_reverse(dev, device_list, power.entry) { 1290 + /* 1291 + * In case the device is being waited for and async processing 1292 + * has not started for it yet, let the waiters make progress. 1293 + */ 1294 + if (!dev->power.work_in_progress) 1295 + complete_all(&dev->power.completion); 1296 + } 1297 + } 1298 + 1283 1299 /** 1284 1300 * resume_event - Return a "resume" message for given "suspend" sleep state. 1285 1301 * @sleep_state: PM message representing a sleep state. ··· 1472 1456 mutex_lock(&dpm_list_mtx); 1473 1457 1474 1458 if (error || async_error) { 1459 + dpm_async_suspend_complete_all(&dpm_late_early_list); 1475 1460 /* 1476 1461 * Move all devices to the target list to resume them 1477 1462 * properly. ··· 1675 1658 mutex_lock(&dpm_list_mtx); 1676 1659 1677 1660 if (error || async_error) { 1661 + dpm_async_suspend_complete_all(&dpm_suspended_list); 1678 1662 /* 1679 1663 * Move all devices to the target list to resume them 1680 1664 * properly. ··· 1969 1951 mutex_lock(&dpm_list_mtx); 1970 1952 1971 1953 if (error || async_error) { 1954 + dpm_async_suspend_complete_all(&dpm_prepared_list); 1972 1955 /* 1973 1956 * Move all devices to the target list to resume them 1974 1957 * properly.

+3 -3

drivers/block/nbd.c

··· 2198 2198 goto out; 2199 2199 } 2200 2200 } 2201 - ret = nbd_start_device(nbd); 2202 - if (ret) 2203 - goto out; 2201 + 2204 2202 if (info->attrs[NBD_ATTR_BACKEND_IDENTIFIER]) { 2205 2203 nbd->backend = nla_strdup(info->attrs[NBD_ATTR_BACKEND_IDENTIFIER], 2206 2204 GFP_KERNEL); ··· 2214 2216 goto out; 2215 2217 } 2216 2218 set_bit(NBD_RT_HAS_BACKEND_FILE, &config->runtime_flags); 2219 + 2220 + ret = nbd_start_device(nbd); 2217 2221 out: 2218 2222 mutex_unlock(&nbd->config_lock); 2219 2223 if (!ret) {

+1 -1

drivers/bluetooth/bfusb.c

··· 670 670 hdev->flush = bfusb_flush; 671 671 hdev->send = bfusb_send_frame; 672 672 673 - set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks); 673 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LOCAL_COMMANDS); 674 674 675 675 if (hci_register_dev(hdev) < 0) { 676 676 BT_ERR("Can't register HCI device");

+1 -1

drivers/bluetooth/bpa10x.c

··· 398 398 hdev->send = bpa10x_send_frame; 399 399 hdev->set_diag = bpa10x_set_diag; 400 400 401 - set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 401 + hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE); 402 402 403 403 err = hci_register_dev(hdev); 404 404 if (err < 0) {

+4 -4

drivers/bluetooth/btbcm.c

··· 135 135 if (btbcm_set_bdaddr_from_efi(hdev) != 0) { 136 136 bt_dev_info(hdev, "BCM: Using default device address (%pMR)", 137 137 &bda->bdaddr); 138 - set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 138 + hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 139 139 } 140 140 } 141 141 ··· 467 467 468 468 /* Read DMI and disable broken Read LE Min/Max Tx Power */ 469 469 if (dmi_first_match(disable_broken_read_transmit_power)) 470 - set_bit(HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER, &hdev->quirks); 470 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER); 471 471 472 472 return 0; 473 473 } ··· 706 706 707 707 btbcm_check_bdaddr(hdev); 708 708 709 - set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 709 + hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER); 710 710 711 711 return 0; 712 712 } ··· 769 769 kfree_skb(skb); 770 770 } 771 771 772 - set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 772 + hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER); 773 773 774 774 return 0; 775 775 }

+15 -15

drivers/bluetooth/btintel.c

··· 88 88 if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) { 89 89 bt_dev_err(hdev, "Found Intel default device address (%pMR)", 90 90 &bda->bdaddr); 91 - set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 91 + hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 92 92 } 93 93 94 94 kfree_skb(skb); ··· 2027 2027 */ 2028 2028 if (!bacmp(&params->otp_bdaddr, BDADDR_ANY)) { 2029 2029 bt_dev_info(hdev, "No device address configured"); 2030 - set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 2030 + hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 2031 2031 } 2032 2032 2033 2033 download: ··· 2295 2295 */ 2296 2296 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) { 2297 2297 bt_dev_info(hdev, "No device address configured"); 2298 - set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 2298 + hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 2299 2299 } 2300 2300 } 2301 2301 ··· 2670 2670 * Distinguish ISO data packets form ACL data packets 2671 2671 * based on their connection handle value range. 2672 2672 */ 2673 - if (hci_skb_pkt_type(skb) == HCI_ACLDATA_PKT) { 2673 + if (iso_capable(hdev) && hci_skb_pkt_type(skb) == HCI_ACLDATA_PKT) { 2674 2674 __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle); 2675 2675 2676 2676 if (hci_handle(handle) >= BTINTEL_ISODATA_HANDLE_BASE) ··· 3435 3435 } 3436 3436 3437 3437 /* Apply the common HCI quirks for Intel device */ 3438 - set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 3439 - set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3440 - set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks); 3438 + hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER); 3439 + hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 3440 + hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_DIAG); 3441 3441 3442 3442 /* Set up the quality report callback for Intel devices */ 3443 3443 hdev->set_quality_report = btintel_set_quality_report; ··· 3475 3475 */ 3476 3476 if (!btintel_test_flag(hdev, 3477 3477 INTEL_ROM_LEGACY_NO_WBS_SUPPORT)) 3478 - set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 3479 - &hdev->quirks); 3478 + hci_set_quirk(hdev, 3479 + HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3480 3480 3481 3481 err = btintel_legacy_rom_setup(hdev, &ver); 3482 3482 break; ··· 3491 3491 * 3492 3492 * All Legacy bootloader devices support WBS 3493 3493 */ 3494 - set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 3495 - &hdev->quirks); 3494 + hci_set_quirk(hdev, 3495 + HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3496 3496 3497 3497 /* These variants don't seem to support LE Coded PHY */ 3498 - set_bit(HCI_QUIRK_BROKEN_LE_CODED, &hdev->quirks); 3498 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED); 3499 3499 3500 3500 /* Setup MSFT Extension support */ 3501 3501 btintel_set_msft_opcode(hdev, ver.hw_variant); ··· 3571 3571 * 3572 3572 * All Legacy bootloader devices support WBS 3573 3573 */ 3574 - set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); 3574 + hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3575 3575 3576 3576 /* These variants don't seem to support LE Coded PHY */ 3577 - set_bit(HCI_QUIRK_BROKEN_LE_CODED, &hdev->quirks); 3577 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED); 3578 3578 3579 3579 /* Setup MSFT Extension support */ 3580 3580 btintel_set_msft_opcode(hdev, ver.hw_variant); ··· 3600 3600 * 3601 3601 * All TLV based devices support WBS 3602 3602 */ 3603 - set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); 3603 + hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3604 3604 3605 3605 /* Setup MSFT Extension support */ 3606 3606 btintel_set_msft_opcode(hdev,

+4 -4

drivers/bluetooth/btintel_pcie.c

··· 2081 2081 } 2082 2082 2083 2083 /* Apply the common HCI quirks for Intel device */ 2084 - set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 2085 - set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 2086 - set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks); 2084 + hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER); 2085 + hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 2086 + hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_DIAG); 2087 2087 2088 2088 /* Set up the quality report callback for Intel devices */ 2089 2089 hdev->set_quality_report = btintel_set_quality_report; ··· 2123 2123 * 2124 2124 * All TLV based devices support WBS 2125 2125 */ 2126 - set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); 2126 + hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 2127 2127 2128 2128 /* Setup MSFT Extension support */ 2129 2129 btintel_set_msft_opcode(hdev,

+2 -2

drivers/bluetooth/btmtksdio.c

··· 1141 1141 } 1142 1142 1143 1143 /* Enable WBS with mSBC codec */ 1144 - set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); 1144 + hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 1145 1145 1146 1146 /* Enable GPIO reset mechanism */ 1147 1147 if (bdev->reset) { ··· 1384 1384 SET_HCIDEV_DEV(hdev, &func->dev); 1385 1385 1386 1386 hdev->manufacturer = 70; 1387 - set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks); 1387 + hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_SETUP); 1388 1388 1389 1389 sdio_set_drvdata(func, bdev); 1390 1390

+1 -1

drivers/bluetooth/btmtkuart.c

··· 872 872 SET_HCIDEV_DEV(hdev, &serdev->dev); 873 873 874 874 hdev->manufacturer = 70; 875 - set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks); 875 + hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_SETUP); 876 876 877 877 if (btmtkuart_is_standalone(bdev)) { 878 878 err = clk_prepare_enable(bdev->osc);

+1 -1

drivers/bluetooth/btnxpuart.c

··· 1807 1807 "local-bd-address", 1808 1808 (u8 *)&ba, sizeof(ba)); 1809 1809 if (bacmp(&ba, BDADDR_ANY)) 1810 - set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks); 1810 + hci_set_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY); 1811 1811 1812 1812 if (hci_register_dev(hdev) < 0) { 1813 1813 dev_err(&serdev->dev, "Can't register HCI device\n");

+1 -1

drivers/bluetooth/btqca.c

··· 739 739 740 740 bda = (struct hci_rp_read_bd_addr *)skb->data; 741 741 if (!bacmp(&bda->bdaddr, &config->bdaddr)) 742 - set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks); 742 + hci_set_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY); 743 743 744 744 kfree_skb(skb); 745 745

+1 -1

drivers/bluetooth/btqcomsmd.c

··· 117 117 /* Devices do not have persistent storage for BD address. Retrieve 118 118 * it from the firmware node property. 119 119 */ 120 - set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks); 120 + hci_set_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY); 121 121 122 122 return 0; 123 123 }

+5 -5

drivers/bluetooth/btrtl.c

··· 1287 1287 /* Enable controller to do both LE scan and BR/EDR inquiry 1288 1288 * simultaneously. 1289 1289 */ 1290 - set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 1290 + hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 1291 1291 1292 1292 /* Enable central-peripheral role (able to create new connections with 1293 1293 * an existing connection in slave role). ··· 1301 1301 case CHIP_ID_8851B: 1302 1302 case CHIP_ID_8922A: 1303 1303 case CHIP_ID_8852BT: 1304 - set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); 1304 + hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 1305 1305 1306 1306 /* RTL8852C needs to transmit mSBC data continuously without 1307 1307 * the zero length of USB packets for the ALT 6 supported chips ··· 1312 1312 if (btrtl_dev->project_id == CHIP_ID_8852A || 1313 1313 btrtl_dev->project_id == CHIP_ID_8852B || 1314 1314 btrtl_dev->project_id == CHIP_ID_8852C) 1315 - set_bit(HCI_QUIRK_USE_MSFT_EXT_ADDRESS_FILTER, &hdev->quirks); 1315 + hci_set_quirk(hdev, 1316 + HCI_QUIRK_USE_MSFT_EXT_ADDRESS_FILTER); 1316 1317 1317 1318 hci_set_aosp_capable(hdev); 1318 1319 break; ··· 1332 1331 * but it doesn't support any features from page 2 - 1333 1332 * it either responds with garbage or with error status 1334 1333 */ 1335 - set_bit(HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2, 1336 - &hdev->quirks); 1334 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2); 1337 1335 break; 1338 1336 default: 1339 1337 break;

+1 -1

drivers/bluetooth/btsdio.c

··· 327 327 hdev->send = btsdio_send_frame; 328 328 329 329 if (func->vendor == 0x0104 && func->device == 0x00c5) 330 - set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 330 + hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE); 331 331 332 332 err = hci_register_dev(hdev); 333 333 if (err < 0) {

+79 -69

drivers/bluetooth/btusb.c

··· 2472 2472 * Probably will need to be expanded in the future; 2473 2473 * without these the controller will lock up. 2474 2474 */ 2475 - set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks); 2476 - set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks); 2477 - set_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks); 2478 - set_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks); 2479 - set_bit(HCI_QUIRK_BROKEN_READ_VOICE_SETTING, &hdev->quirks); 2480 - set_bit(HCI_QUIRK_BROKEN_READ_PAGE_SCAN_TYPE, &hdev->quirks); 2475 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_STORED_LINK_KEY); 2476 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_ERR_DATA_REPORTING); 2477 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL); 2478 + hci_set_quirk(hdev, HCI_QUIRK_NO_SUSPEND_NOTIFIER); 2479 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_READ_VOICE_SETTING); 2480 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_READ_PAGE_SCAN_TYPE); 2481 2481 2482 2482 /* Clear the reset quirk since this is not an actual 2483 2483 * early Bluetooth 1.1 device from CSR. 2484 2484 */ 2485 - clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 2486 - clear_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 2485 + hci_clear_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE); 2486 + hci_clear_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 2487 2487 2488 2488 /* 2489 2489 * Special workaround for these BT 4.0 chip clones, and potentially more: ··· 3192 3192 { 0x00190200, 40, 4, 16 }, /* WCN785x 2.0 */ 3193 3193 }; 3194 3194 3195 + static u16 qca_extract_board_id(const struct qca_version *ver) 3196 + { 3197 + u16 flag = le16_to_cpu(ver->flag); 3198 + u16 board_id = 0; 3199 + 3200 + if (((flag >> 8) & 0xff) == QCA_FLAG_MULTI_NVM) { 3201 + /* The board_id should be split into two bytes 3202 + * The 1st byte is chip ID, and the 2nd byte is platform ID 3203 + * For example, board ID 0x010A, 0x01 is platform ID. 0x0A is chip ID 3204 + * we have several platforms, and platform IDs are continuously added 3205 + * Platform ID: 3206 + * 0x00 is for Mobile 3207 + * 0x01 is for X86 3208 + * 0x02 is for Automotive 3209 + * 0x03 is for Consumer electronic 3210 + */ 3211 + board_id = (ver->chip_id << 8) + ver->platform_id; 3212 + } 3213 + 3214 + /* Take 0xffff as invalid board ID */ 3215 + if (board_id == 0xffff) 3216 + board_id = 0; 3217 + 3218 + return board_id; 3219 + } 3220 + 3195 3221 static int btusb_qca_send_vendor_req(struct usb_device *udev, u8 request, 3196 3222 void *data, u16 size) 3197 3223 { ··· 3374 3348 const struct qca_version *ver) 3375 3349 { 3376 3350 u32 rom_version = le32_to_cpu(ver->rom_version); 3377 - u16 flag = le16_to_cpu(ver->flag); 3351 + const char *variant; 3352 + int len; 3353 + u16 board_id; 3378 3354 3379 - if (((flag >> 8) & 0xff) == QCA_FLAG_MULTI_NVM) { 3380 - /* The board_id should be split into two bytes 3381 - * The 1st byte is chip ID, and the 2nd byte is platform ID 3382 - * For example, board ID 0x010A, 0x01 is platform ID. 0x0A is chip ID 3383 - * we have several platforms, and platform IDs are continuously added 3384 - * Platform ID: 3385 - * 0x00 is for Mobile 3386 - * 0x01 is for X86 3387 - * 0x02 is for Automotive 3388 - * 0x03 is for Consumer electronic 3389 - */ 3390 - u16 board_id = (ver->chip_id << 8) + ver->platform_id; 3391 - const char *variant; 3355 + board_id = qca_extract_board_id(ver); 3392 3356 3393 - switch (le32_to_cpu(ver->ram_version)) { 3394 - case WCN6855_2_0_RAM_VERSION_GF: 3395 - case WCN6855_2_1_RAM_VERSION_GF: 3396 - variant = "_gf"; 3397 - break; 3398 - default: 3399 - variant = ""; 3400 - break; 3401 - } 3402 - 3403 - if (board_id == 0) { 3404 - snprintf(fwname, max_size, "qca/nvm_usb_%08x%s.bin", 3405 - rom_version, variant); 3406 - } else { 3407 - snprintf(fwname, max_size, "qca/nvm_usb_%08x%s_%04x.bin", 3408 - rom_version, variant, board_id); 3409 - } 3410 - } else { 3411 - snprintf(fwname, max_size, "qca/nvm_usb_%08x.bin", 3412 - rom_version); 3357 + switch (le32_to_cpu(ver->ram_version)) { 3358 + case WCN6855_2_0_RAM_VERSION_GF: 3359 + case WCN6855_2_1_RAM_VERSION_GF: 3360 + variant = "_gf"; 3361 + break; 3362 + default: 3363 + variant = NULL; 3364 + break; 3413 3365 } 3414 3366 3367 + len = snprintf(fwname, max_size, "qca/nvm_usb_%08x", rom_version); 3368 + if (variant) 3369 + len += snprintf(fwname + len, max_size - len, "%s", variant); 3370 + if (board_id) 3371 + len += snprintf(fwname + len, max_size - len, "_%04x", board_id); 3372 + len += snprintf(fwname + len, max_size - len, ".bin"); 3415 3373 } 3416 3374 3417 3375 static int btusb_setup_qca_load_nvm(struct hci_dev *hdev, ··· 3504 3494 /* Mark HCI_OP_ENHANCED_SETUP_SYNC_CONN as broken as it doesn't seem to 3505 3495 * work with the likes of HSP/HFP mSBC. 3506 3496 */ 3507 - set_bit(HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, &hdev->quirks); 3497 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN); 3508 3498 3509 3499 return 0; 3510 3500 } ··· 4018 4008 } 4019 4009 #endif 4020 4010 if (id->driver_info & BTUSB_CW6622) 4021 - set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks); 4011 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_STORED_LINK_KEY); 4022 4012 4023 4013 if (id->driver_info & BTUSB_BCM2045) 4024 - set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks); 4014 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_STORED_LINK_KEY); 4025 4015 4026 4016 if (id->driver_info & BTUSB_BCM92035) 4027 4017 hdev->setup = btusb_setup_bcm92035; ··· 4078 4068 hdev->reset = btmtk_reset_sync; 4079 4069 hdev->set_bdaddr = btmtk_set_bdaddr; 4080 4070 hdev->send = btusb_send_frame_mtk; 4081 - set_bit(HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, &hdev->quirks); 4082 - set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks); 4071 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN); 4072 + hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_SETUP); 4083 4073 data->recv_acl = btmtk_usb_recv_acl; 4084 4074 data->suspend = btmtk_usb_suspend; 4085 4075 data->resume = btmtk_usb_resume; ··· 4087 4077 } 4088 4078 4089 4079 if (id->driver_info & BTUSB_SWAVE) { 4090 - set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks); 4091 - set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks); 4080 + hci_set_quirk(hdev, HCI_QUIRK_FIXUP_INQUIRY_MODE); 4081 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LOCAL_COMMANDS); 4092 4082 } 4093 4083 4094 4084 if (id->driver_info & BTUSB_INTEL_BOOT) { 4095 4085 hdev->manufacturer = 2; 4096 - set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 4086 + hci_set_quirk(hdev, HCI_QUIRK_RAW_DEVICE); 4097 4087 } 4098 4088 4099 4089 if (id->driver_info & BTUSB_ATH3012) { 4100 4090 data->setup_on_usb = btusb_setup_qca; 4101 4091 hdev->set_bdaddr = btusb_set_bdaddr_ath3012; 4102 - set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 4103 - set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 4092 + hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 4093 + hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER); 4104 4094 } 4105 4095 4106 4096 if (id->driver_info & BTUSB_QCA_ROME) { ··· 4108 4098 hdev->shutdown = btusb_shutdown_qca; 4109 4099 hdev->set_bdaddr = btusb_set_bdaddr_ath3012; 4110 4100 hdev->reset = btusb_qca_reset; 4111 - set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 4101 + hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 4112 4102 btusb_check_needs_reset_resume(intf); 4113 4103 } 4114 4104 ··· 4122 4112 hdev->shutdown = btusb_shutdown_qca; 4123 4113 hdev->set_bdaddr = btusb_set_bdaddr_wcn6855; 4124 4114 hdev->reset = btusb_qca_reset; 4125 - set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 4115 + hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 4126 4116 hci_set_msft_opcode(hdev, 0xFD70); 4127 4117 } 4128 4118 ··· 4150 4140 4151 4141 if (id->driver_info & BTUSB_ACTIONS_SEMI) { 4152 4142 /* Support is advertised, but not implemented */ 4153 - set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks); 4154 - set_bit(HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER, &hdev->quirks); 4155 - set_bit(HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT, &hdev->quirks); 4156 - set_bit(HCI_QUIRK_BROKEN_EXT_SCAN, &hdev->quirks); 4157 - set_bit(HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE, &hdev->quirks); 4158 - set_bit(HCI_QUIRK_BROKEN_EXT_CREATE_CONN, &hdev->quirks); 4159 - set_bit(HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT, &hdev->quirks); 4143 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_ERR_DATA_REPORTING); 4144 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER); 4145 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT); 4146 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN); 4147 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE); 4148 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_CREATE_CONN); 4149 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT); 4160 4150 } 4161 4151 4162 4152 if (!reset) 4163 - set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 4153 + hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE); 4164 4154 4165 4155 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) { 4166 4156 if (!disable_scofix) 4167 - set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks); 4157 + hci_set_quirk(hdev, HCI_QUIRK_FIXUP_BUFFER_SIZE); 4168 4158 } 4169 4159 4170 4160 if (id->driver_info & BTUSB_BROKEN_ISOC) 4171 4161 data->isoc = NULL; 4172 4162 4173 4163 if (id->driver_info & BTUSB_WIDEBAND_SPEECH) 4174 - set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); 4164 + hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 4175 4165 4176 4166 if (id->driver_info & BTUSB_INVALID_LE_STATES) 4177 - set_bit(HCI_QUIRK_BROKEN_LE_STATES, &hdev->quirks); 4167 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_STATES); 4178 4168 4179 4169 if (id->driver_info & BTUSB_DIGIANSWER) { 4180 4170 data->cmdreq_type = USB_TYPE_VENDOR; 4181 - set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 4171 + hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE); 4182 4172 } 4183 4173 4184 4174 if (id->driver_info & BTUSB_CSR) { ··· 4187 4177 4188 4178 /* Old firmware would otherwise execute USB reset */ 4189 4179 if (bcdDevice < 0x117) 4190 - set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 4180 + hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE); 4191 4181 4192 4182 /* This must be set first in case we disable it for fakes */ 4193 - set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 4183 + hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 4194 4184 4195 4185 /* Fake CSR devices with broken commands */ 4196 4186 if (le16_to_cpu(udev->descriptor.idVendor) == 0x0a12 && ··· 4203 4193 4204 4194 /* New sniffer firmware has crippled HCI interface */ 4205 4195 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997) 4206 - set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 4196 + hci_set_quirk(hdev, HCI_QUIRK_RAW_DEVICE); 4207 4197 } 4208 4198 4209 4199 if (id->driver_info & BTUSB_INTEL_BOOT) {

+1 -1

drivers/bluetooth/hci_aml.c

··· 424 424 425 425 if (!bacmp(&paddr->bdaddr, AML_BDADDR_DEFAULT)) { 426 426 bt_dev_info(hdev, "amlbt using default bdaddr (%pM)", &paddr->bdaddr); 427 - set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 427 + hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 428 428 } 429 429 430 430 exit:

+2 -2

drivers/bluetooth/hci_bcm.c

··· 643 643 * Allow the bootloader to set a valid address through the 644 644 * device tree. 645 645 */ 646 - if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hu->hdev->quirks)) 647 - set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hu->hdev->quirks); 646 + if (hci_test_quirk(hu->hdev, HCI_QUIRK_INVALID_BDADDR)) 647 + hci_set_quirk(hu->hdev, HCI_QUIRK_USE_BDADDR_PROPERTY); 648 648 649 649 if (!bcm_request_irq(bcm)) 650 650 err = bcm_setup_sleep(hu);

+5 -5

drivers/bluetooth/hci_bcm4377.c

··· 1435 1435 1436 1436 bda = (struct hci_rp_read_bd_addr *)skb->data; 1437 1437 if (!bcm4377_is_valid_bdaddr(bcm4377, &bda->bdaddr)) 1438 - set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &bcm4377->hdev->quirks); 1438 + hci_set_quirk(bcm4377->hdev, HCI_QUIRK_USE_BDADDR_PROPERTY); 1439 1439 1440 1440 kfree_skb(skb); 1441 1441 return 0; ··· 2389 2389 hdev->setup = bcm4377_hci_setup; 2390 2390 2391 2391 if (bcm4377->hw->broken_mws_transport_config) 2392 - set_bit(HCI_QUIRK_BROKEN_MWS_TRANSPORT_CONFIG, &hdev->quirks); 2392 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_MWS_TRANSPORT_CONFIG); 2393 2393 if (bcm4377->hw->broken_ext_scan) 2394 - set_bit(HCI_QUIRK_BROKEN_EXT_SCAN, &hdev->quirks); 2394 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN); 2395 2395 if (bcm4377->hw->broken_le_coded) 2396 - set_bit(HCI_QUIRK_BROKEN_LE_CODED, &hdev->quirks); 2396 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED); 2397 2397 if (bcm4377->hw->broken_le_ext_adv_report_phy) 2398 - set_bit(HCI_QUIRK_FIXUP_LE_EXT_ADV_REPORT_PHY, &hdev->quirks); 2398 + hci_set_quirk(hdev, HCI_QUIRK_FIXUP_LE_EXT_ADV_REPORT_PHY); 2399 2399 2400 2400 pci_set_drvdata(pdev, bcm4377); 2401 2401 hci_set_drvdata(hdev, bcm4377);

+1 -1

drivers/bluetooth/hci_intel.c

··· 660 660 */ 661 661 if (!bacmp(&params.otp_bdaddr, BDADDR_ANY)) { 662 662 bt_dev_info(hdev, "No device address configured"); 663 - set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 663 + hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 664 664 } 665 665 666 666 /* With this Intel bootloader only the hardware variant and device

+3 -3

drivers/bluetooth/hci_ldisc.c

··· 667 667 SET_HCIDEV_DEV(hdev, hu->tty->dev); 668 668 669 669 if (test_bit(HCI_UART_RAW_DEVICE, &hu->hdev_flags)) 670 - set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 670 + hci_set_quirk(hdev, HCI_QUIRK_RAW_DEVICE); 671 671 672 672 if (test_bit(HCI_UART_EXT_CONFIG, &hu->hdev_flags)) 673 - set_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks); 673 + hci_set_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG); 674 674 675 675 if (!test_bit(HCI_UART_RESET_ON_INIT, &hu->hdev_flags)) 676 - set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 676 + hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE); 677 677 678 678 /* Only call open() for the protocol after hdev is fully initialized as 679 679 * open() (or a timer/workqueue it starts) may attempt to reference it.

+2 -2

drivers/bluetooth/hci_ll.c

··· 649 649 /* This means that there was an error getting the BD address 650 650 * during probe, so mark the device as having a bad address. 651 651 */ 652 - set_bit(HCI_QUIRK_INVALID_BDADDR, &hu->hdev->quirks); 652 + hci_set_quirk(hu->hdev, HCI_QUIRK_INVALID_BDADDR); 653 653 } else if (bacmp(&lldev->bdaddr, BDADDR_ANY)) { 654 654 err = ll_set_bdaddr(hu->hdev, &lldev->bdaddr); 655 655 if (err) 656 - set_bit(HCI_QUIRK_INVALID_BDADDR, &hu->hdev->quirks); 656 + hci_set_quirk(hu->hdev, HCI_QUIRK_INVALID_BDADDR); 657 657 } 658 658 659 659 /* Operational speed if any */

+1 -1

drivers/bluetooth/hci_nokia.c

··· 439 439 440 440 if (btdev->man_id == NOKIA_ID_BCM2048) { 441 441 hu->hdev->set_bdaddr = btbcm_set_bdaddr; 442 - set_bit(HCI_QUIRK_INVALID_BDADDR, &hu->hdev->quirks); 442 + hci_set_quirk(hu->hdev, HCI_QUIRK_INVALID_BDADDR); 443 443 dev_dbg(dev, "bcm2048 has invalid bluetooth address!"); 444 444 } 445 445

+7 -7

drivers/bluetooth/hci_qca.c

··· 1892 1892 /* Enable controller to do both LE scan and BR/EDR inquiry 1893 1893 * simultaneously. 1894 1894 */ 1895 - set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 1895 + hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 1896 1896 1897 1897 switch (soc_type) { 1898 1898 case QCA_QCA2066: ··· 1944 1944 case QCA_WCN7850: 1945 1945 qcadev = serdev_device_get_drvdata(hu->serdev); 1946 1946 if (qcadev->bdaddr_property_broken) 1947 - set_bit(HCI_QUIRK_BDADDR_PROPERTY_BROKEN, &hdev->quirks); 1947 + hci_set_quirk(hdev, HCI_QUIRK_BDADDR_PROPERTY_BROKEN); 1948 1948 1949 1949 hci_set_aosp_capable(hdev); 1950 1950 ··· 2487 2487 hdev = qcadev->serdev_hu.hdev; 2488 2488 2489 2489 if (power_ctrl_enabled) { 2490 - set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks); 2490 + hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_SETUP); 2491 2491 hdev->shutdown = qca_power_off; 2492 2492 } 2493 2493 ··· 2496 2496 * be queried via hci. Same with the valid le states quirk. 2497 2497 */ 2498 2498 if (data->capabilities & QCA_CAP_WIDEBAND_SPEECH) 2499 - set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 2500 - &hdev->quirks); 2499 + hci_set_quirk(hdev, 2500 + HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 2501 2501 2502 2502 if (!(data->capabilities & QCA_CAP_VALID_LE_STATES)) 2503 - set_bit(HCI_QUIRK_BROKEN_LE_STATES, &hdev->quirks); 2503 + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_STATES); 2504 2504 } 2505 2505 2506 2506 return 0; ··· 2550 2550 * invoked and the SOC is already in the initial state, so 2551 2551 * don't also need to send the VSC. 2552 2552 */ 2553 - if (test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks) || 2553 + if (hci_test_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_SETUP) || 2554 2554 hci_dev_test_flag(hdev, HCI_SETUP)) 2555 2555 return; 2556 2556

+4 -4

drivers/bluetooth/hci_serdev.c

··· 152 152 * BT SOC is completely powered OFF during BT OFF, holding port 153 153 * open may drain the battery. 154 154 */ 155 - if (test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks)) { 155 + if (hci_test_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_SETUP)) { 156 156 clear_bit(HCI_UART_PROTO_READY, &hu->flags); 157 157 serdev_device_close(hu->serdev); 158 158 } ··· 358 358 SET_HCIDEV_DEV(hdev, &hu->serdev->dev); 359 359 360 360 if (test_bit(HCI_UART_NO_SUSPEND_NOTIFIER, &hu->flags)) 361 - set_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks); 361 + hci_set_quirk(hdev, HCI_QUIRK_NO_SUSPEND_NOTIFIER); 362 362 363 363 if (test_bit(HCI_UART_RAW_DEVICE, &hu->hdev_flags)) 364 - set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 364 + hci_set_quirk(hdev, HCI_QUIRK_RAW_DEVICE); 365 365 366 366 if (test_bit(HCI_UART_EXT_CONFIG, &hu->hdev_flags)) 367 - set_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks); 367 + hci_set_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG); 368 368 369 369 if (test_bit(HCI_UART_INIT_PENDING, &hu->hdev_flags)) 370 370 return 0;

+4 -4

drivers/bluetooth/hci_vhci.c

··· 415 415 hdev->get_codec_config_data = vhci_get_codec_config_data; 416 416 hdev->wakeup = vhci_wakeup; 417 417 hdev->setup = vhci_setup; 418 - set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks); 419 - set_bit(HCI_QUIRK_SYNC_FLOWCTL_SUPPORTED, &hdev->quirks); 418 + hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_SETUP); 419 + hci_set_quirk(hdev, HCI_QUIRK_SYNC_FLOWCTL_SUPPORTED); 420 420 421 421 /* bit 6 is for external configuration */ 422 422 if (opcode & 0x40) 423 - set_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks); 423 + hci_set_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG); 424 424 425 425 /* bit 7 is for raw device */ 426 426 if (opcode & 0x80) 427 - set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 427 + hci_set_quirk(hdev, HCI_QUIRK_RAW_DEVICE); 428 428 429 429 if (hci_register_dev(hdev) < 0) { 430 430 BT_ERR("Can't register HCI device");

+5 -5

drivers/bluetooth/virtio_bt.c

··· 327 327 hdev->setup = virtbt_setup_intel; 328 328 hdev->shutdown = virtbt_shutdown_generic; 329 329 hdev->set_bdaddr = virtbt_set_bdaddr_intel; 330 - set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 331 - set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 332 - set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); 330 + hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER); 331 + hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 332 + hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 333 333 break; 334 334 335 335 case VIRTIO_BT_CONFIG_VENDOR_REALTEK: 336 336 hdev->manufacturer = 93; 337 337 hdev->setup = virtbt_setup_realtek; 338 338 hdev->shutdown = virtbt_shutdown_generic; 339 - set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 340 - set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); 339 + hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 340 + hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 341 341 break; 342 342 } 343 343 }

+8 -8

drivers/char/agp/amd64-agp.c

··· 720 720 721 721 MODULE_DEVICE_TABLE(pci, agp_amd64_pci_table); 722 722 723 - static const struct pci_device_id agp_amd64_pci_promisc_table[] = { 724 - { PCI_DEVICE_CLASS(0, 0) }, 725 - { } 726 - }; 727 - 728 723 static DEFINE_SIMPLE_DEV_PM_OPS(agp_amd64_pm_ops, NULL, agp_amd64_resume); 729 724 730 725 static struct pci_driver agp_amd64_pci_driver = { ··· 734 739 /* Not static due to IOMMU code calling it early. */ 735 740 int __init agp_amd64_init(void) 736 741 { 742 + struct pci_dev *pdev = NULL; 737 743 int err = 0; 738 744 739 745 if (agp_off) ··· 763 767 } 764 768 765 769 /* Look for any AGP bridge */ 766 - agp_amd64_pci_driver.id_table = agp_amd64_pci_promisc_table; 767 - err = driver_attach(&agp_amd64_pci_driver.driver); 768 - if (err == 0 && agp_bridges_found == 0) { 770 + for_each_pci_dev(pdev) 771 + if (pci_find_capability(pdev, PCI_CAP_ID_AGP)) 772 + pci_add_dynid(&agp_amd64_pci_driver, 773 + pdev->vendor, pdev->device, 774 + pdev->subsystem_vendor, 775 + pdev->subsystem_device, 0, 0, 0); 776 + if (agp_bridges_found == 0) { 769 777 pci_unregister_driver(&agp_amd64_pci_driver); 770 778 err = -ENODEV; 771 779 }

+11 -9

drivers/clk/clk-scmi.c

··· 404 404 const struct scmi_handle *handle = sdev->handle; 405 405 struct scmi_protocol_handle *ph; 406 406 const struct clk_ops *scmi_clk_ops_db[SCMI_MAX_CLK_OPS] = {}; 407 + struct scmi_clk *sclks; 407 408 408 409 if (!handle) 409 410 return -ENODEV; ··· 431 430 transport_is_atomic = handle->is_transport_atomic(handle, 432 431 &atomic_threshold_us); 433 432 434 - for (idx = 0; idx < count; idx++) { 435 - struct scmi_clk *sclk; 436 - const struct clk_ops *scmi_ops; 433 + sclks = devm_kcalloc(dev, count, sizeof(*sclks), GFP_KERNEL); 434 + if (!sclks) 435 + return -ENOMEM; 437 436 438 - sclk = devm_kzalloc(dev, sizeof(*sclk), GFP_KERNEL); 439 - if (!sclk) 440 - return -ENOMEM; 437 + for (idx = 0; idx < count; idx++) 438 + hws[idx] = &sclks[idx].hw; 439 + 440 + for (idx = 0; idx < count; idx++) { 441 + struct scmi_clk *sclk = &sclks[idx]; 442 + const struct clk_ops *scmi_ops; 441 443 442 444 sclk->info = scmi_proto_clk_ops->info_get(ph, idx); 443 445 if (!sclk->info) { 444 446 dev_dbg(dev, "invalid clock info for idx %d\n", idx); 445 - devm_kfree(dev, sclk); 447 + hws[idx] = NULL; 446 448 continue; 447 449 } 448 450 ··· 483 479 if (err) { 484 480 dev_err(dev, "failed to register clock %d\n", idx); 485 481 devm_kfree(dev, sclk->parent_data); 486 - devm_kfree(dev, sclk); 487 482 hws[idx] = NULL; 488 483 } else { 489 484 dev_dbg(dev, "Registered clock:%s%s\n", 490 485 sclk->info->name, 491 486 scmi_ops->enable ? " (atomic ops)" : ""); 492 - hws[idx] = &sclk->hw; 493 487 } 494 488 } 495 489

+8 -4

drivers/clk/imx/clk-imx95-blk-ctl.c

··· 219 219 .clk_reg_offset = 0, 220 220 }; 221 221 222 + static const char * const disp_engine_parents[] = { 223 + "videopll1", "dsi_pll", "ldb_pll_div7" 224 + }; 225 + 222 226 static const struct imx95_blk_ctl_clk_dev_data dispmix_csr_clk_dev_data[] = { 223 227 [IMX95_CLK_DISPMIX_ENG0_SEL] = { 224 228 .name = "disp_engine0_sel", 225 - .parent_names = (const char *[]){"videopll1", "dsi_pll", "ldb_pll_div7", }, 226 - .num_parents = 4, 229 + .parent_names = disp_engine_parents, 230 + .num_parents = ARRAY_SIZE(disp_engine_parents), 227 231 .reg = 0, 228 232 .bit_idx = 0, 229 233 .bit_width = 2, ··· 236 232 }, 237 233 [IMX95_CLK_DISPMIX_ENG1_SEL] = { 238 234 .name = "disp_engine1_sel", 239 - .parent_names = (const char *[]){"videopll1", "dsi_pll", "ldb_pll_div7", }, 240 - .num_parents = 4, 235 + .parent_names = disp_engine_parents, 236 + .num_parents = ARRAY_SIZE(disp_engine_parents), 241 237 .reg = 0, 242 238 .bit_idx = 2, 243 239 .bit_width = 2,

+29 -2

drivers/gpu/drm/drm_framebuffer.c

··· 862 862 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb, 863 863 const struct drm_framebuffer_funcs *funcs) 864 864 { 865 + unsigned int i; 865 866 int ret; 867 + bool exists; 866 868 867 869 if (WARN_ON_ONCE(fb->dev != dev || !fb->format)) 868 870 return -EINVAL; 871 + 872 + for (i = 0; i < fb->format->num_planes; i++) { 873 + if (drm_WARN_ON_ONCE(dev, fb->internal_flags & DRM_FRAMEBUFFER_HAS_HANDLE_REF(i))) 874 + fb->internal_flags &= ~DRM_FRAMEBUFFER_HAS_HANDLE_REF(i); 875 + if (fb->obj[i]) { 876 + exists = drm_gem_object_handle_get_if_exists_unlocked(fb->obj[i]); 877 + if (exists) 878 + fb->internal_flags |= DRM_FRAMEBUFFER_HAS_HANDLE_REF(i); 879 + } 880 + } 869 881 870 882 INIT_LIST_HEAD(&fb->filp_head); 871 883 ··· 887 875 ret = __drm_mode_object_add(dev, &fb->base, DRM_MODE_OBJECT_FB, 888 876 false, drm_framebuffer_free); 889 877 if (ret) 890 - goto out; 878 + goto err; 891 879 892 880 mutex_lock(&dev->mode_config.fb_lock); 893 881 dev->mode_config.num_fb++; ··· 895 883 mutex_unlock(&dev->mode_config.fb_lock); 896 884 897 885 drm_mode_object_register(dev, &fb->base); 898 - out: 886 + 887 + return 0; 888 + 889 + err: 890 + for (i = 0; i < fb->format->num_planes; i++) { 891 + if (fb->internal_flags & DRM_FRAMEBUFFER_HAS_HANDLE_REF(i)) { 892 + drm_gem_object_handle_put_unlocked(fb->obj[i]); 893 + fb->internal_flags &= ~DRM_FRAMEBUFFER_HAS_HANDLE_REF(i); 894 + } 895 + } 899 896 return ret; 900 897 } 901 898 EXPORT_SYMBOL(drm_framebuffer_init); ··· 981 960 void drm_framebuffer_cleanup(struct drm_framebuffer *fb) 982 961 { 983 962 struct drm_device *dev = fb->dev; 963 + unsigned int i; 964 + 965 + for (i = 0; i < fb->format->num_planes; i++) { 966 + if (fb->internal_flags & DRM_FRAMEBUFFER_HAS_HANDLE_REF(i)) 967 + drm_gem_object_handle_put_unlocked(fb->obj[i]); 968 + } 984 969 985 970 mutex_lock(&dev->mode_config.fb_lock); 986 971 list_del(&fb->head);

+33 -15

drivers/gpu/drm/drm_gem.c

··· 223 223 } 224 224 225 225 /** 226 - * drm_gem_object_handle_get_unlocked - acquire reference on user-space handles 226 + * drm_gem_object_handle_get_if_exists_unlocked - acquire reference on user-space handle, if any 227 227 * @obj: GEM object 228 228 * 229 - * Acquires a reference on the GEM buffer object's handle. Required 230 - * to keep the GEM object alive. Call drm_gem_object_handle_put_unlocked() 231 - * to release the reference. 229 + * Acquires a reference on the GEM buffer object's handle. Required to keep 230 + * the GEM object alive. Call drm_gem_object_handle_put_if_exists_unlocked() 231 + * to release the reference. Does nothing if the buffer object has no handle. 232 + * 233 + * Returns: 234 + * True if a handle exists, or false otherwise 232 235 */ 233 - void drm_gem_object_handle_get_unlocked(struct drm_gem_object *obj) 236 + bool drm_gem_object_handle_get_if_exists_unlocked(struct drm_gem_object *obj) 234 237 { 235 238 struct drm_device *dev = obj->dev; 236 239 237 240 guard(mutex)(&dev->object_name_lock); 238 241 239 - drm_WARN_ON(dev, !obj->handle_count); /* first ref taken in create-tail helper */ 242 + /* 243 + * First ref taken during GEM object creation, if any. Some 244 + * drivers set up internal framebuffers with GEM objects that 245 + * do not have a GEM handle. Hence, this counter can be zero. 246 + */ 247 + if (!obj->handle_count) 248 + return false; 249 + 240 250 drm_gem_object_handle_get(obj); 251 + 252 + return true; 241 253 } 242 - EXPORT_SYMBOL(drm_gem_object_handle_get_unlocked); 243 254 244 255 /** 245 256 * drm_gem_object_handle_free - release resources bound to userspace handles ··· 283 272 } 284 273 285 274 /** 286 - * drm_gem_object_handle_put_unlocked - releases reference on user-space handles 275 + * drm_gem_object_handle_put_unlocked - releases reference on user-space handle 287 276 * @obj: GEM object 288 277 * 289 278 * Releases a reference on the GEM buffer object's handle. Possibly releases ··· 294 283 struct drm_device *dev = obj->dev; 295 284 bool final = false; 296 285 297 - if (WARN_ON(READ_ONCE(obj->handle_count) == 0)) 286 + if (drm_WARN_ON(dev, READ_ONCE(obj->handle_count) == 0)) 298 287 return; 299 288 300 289 /* 301 - * Must bump handle count first as this may be the last 302 - * ref, in which case the object would disappear before we 303 - * checked for a name 304 - */ 290 + * Must bump handle count first as this may be the last 291 + * ref, in which case the object would disappear before 292 + * we checked for a name. 293 + */ 305 294 306 295 mutex_lock(&dev->object_name_lock); 307 296 if (--obj->handle_count == 0) { ··· 314 303 if (final) 315 304 drm_gem_object_put(obj); 316 305 } 317 - EXPORT_SYMBOL(drm_gem_object_handle_put_unlocked); 318 306 319 307 /* 320 308 * Called at device or object close to release the file's ··· 324 314 { 325 315 struct drm_file *file_priv = data; 326 316 struct drm_gem_object *obj = ptr; 317 + 318 + if (drm_WARN_ON(obj->dev, !data)) 319 + return 0; 327 320 328 321 if (obj->funcs->close) 329 322 obj->funcs->close(obj, file_priv); ··· 448 435 idr_preload(GFP_KERNEL); 449 436 spin_lock(&file_priv->table_lock); 450 437 451 - ret = idr_alloc(&file_priv->object_idr, obj, 1, 0, GFP_NOWAIT); 438 + ret = idr_alloc(&file_priv->object_idr, NULL, 1, 0, GFP_NOWAIT); 452 439 453 440 spin_unlock(&file_priv->table_lock); 454 441 idr_preload_end(); ··· 469 456 goto err_revoke; 470 457 } 471 458 459 + /* mirrors drm_gem_handle_delete to avoid races */ 460 + spin_lock(&file_priv->table_lock); 461 + obj = idr_replace(&file_priv->object_idr, obj, handle); 462 + WARN_ON(obj != NULL); 463 + spin_unlock(&file_priv->table_lock); 472 464 *handlep = handle; 473 465 return 0; 474 466

+7 -9

drivers/gpu/drm/drm_gem_framebuffer_helper.c

··· 99 99 unsigned int i; 100 100 101 101 for (i = 0; i < fb->format->num_planes; i++) 102 - drm_gem_object_handle_put_unlocked(fb->obj[i]); 102 + drm_gem_object_put(fb->obj[i]); 103 103 104 104 drm_framebuffer_cleanup(fb); 105 105 kfree(fb); ··· 182 182 if (!objs[i]) { 183 183 drm_dbg_kms(dev, "Failed to lookup GEM object\n"); 184 184 ret = -ENOENT; 185 - goto err_gem_object_handle_put_unlocked; 185 + goto err_gem_object_put; 186 186 } 187 - drm_gem_object_handle_get_unlocked(objs[i]); 188 - drm_gem_object_put(objs[i]); 189 187 190 188 min_size = (height - 1) * mode_cmd->pitches[i] 191 189 + drm_format_info_min_pitch(info, i, width) ··· 193 195 drm_dbg_kms(dev, 194 196 "GEM object size (%zu) smaller than minimum size (%u) for plane %d\n", 195 197 objs[i]->size, min_size, i); 196 - drm_gem_object_handle_put_unlocked(objs[i]); 198 + drm_gem_object_put(objs[i]); 197 199 ret = -EINVAL; 198 - goto err_gem_object_handle_put_unlocked; 200 + goto err_gem_object_put; 199 201 } 200 202 } 201 203 202 204 ret = drm_gem_fb_init(dev, fb, mode_cmd, objs, i, funcs); 203 205 if (ret) 204 - goto err_gem_object_handle_put_unlocked; 206 + goto err_gem_object_put; 205 207 206 208 return 0; 207 209 208 - err_gem_object_handle_put_unlocked: 210 + err_gem_object_put: 209 211 while (i > 0) { 210 212 --i; 211 - drm_gem_object_handle_put_unlocked(objs[i]); 213 + drm_gem_object_put(objs[i]); 212 214 } 213 215 return ret; 214 216 }

+1 -1

drivers/gpu/drm/drm_internal.h

··· 161 161 162 162 /* drm_gem.c */ 163 163 int drm_gem_init(struct drm_device *dev); 164 - void drm_gem_object_handle_get_unlocked(struct drm_gem_object *obj); 164 + bool drm_gem_object_handle_get_if_exists_unlocked(struct drm_gem_object *obj); 165 165 void drm_gem_object_handle_put_unlocked(struct drm_gem_object *obj); 166 166 int drm_gem_handle_create_tail(struct drm_file *file_priv, 167 167 struct drm_gem_object *obj,

+1 -1

drivers/gpu/drm/drm_panic_qr.rs

··· 27 27 //! * <https://github.com/erwanvivien/fast_qr> 28 28 //! * <https://github.com/bjguillot/qr> 29 29 30 - use kernel::{prelude::*, str::CStr}; 30 + use kernel::prelude::*; 31 31 32 32 #[derive(Debug, Clone, Copy, PartialEq, Eq, Ord, PartialOrd)] 33 33 struct Version(usize);

+4 -4

drivers/gpu/drm/i915/display/intel_bios.c

··· 1938 1938 int index, len; 1939 1939 1940 1940 if (drm_WARN_ON(display->drm, 1941 - !data || panel->vbt.dsi.seq_version != 1)) 1941 + !data || panel->vbt.dsi.seq_version >= 3)) 1942 1942 return 0; 1943 1943 1944 1944 /* index = 1 to skip sequence byte */ ··· 1961 1961 } 1962 1962 1963 1963 /* 1964 - * Some v1 VBT MIPI sequences do the deassert in the init OTP sequence. 1964 + * Some v1/v2 VBT MIPI sequences do the deassert in the init OTP sequence. 1965 1965 * The deassert must be done before calling intel_dsi_device_ready, so for 1966 1966 * these devices we split the init OTP sequence into a deassert sequence and 1967 1967 * the actual init OTP part. ··· 1972 1972 u8 *init_otp; 1973 1973 int len; 1974 1974 1975 - /* Limit this to v1 vid-mode sequences */ 1975 + /* Limit this to v1/v2 vid-mode sequences */ 1976 1976 if (panel->vbt.dsi.config->is_cmd_mode || 1977 - panel->vbt.dsi.seq_version != 1) 1977 + panel->vbt.dsi.seq_version >= 3) 1978 1978 return; 1979 1979 1980 1980 /* Only do this if there are otp and assert seqs and no deassert seq */

+2 -2

drivers/gpu/drm/imagination/pvr_power.c

··· 386 386 if (!err) { 387 387 if (hard_reset) { 388 388 pvr_dev->fw_dev.booted = false; 389 - WARN_ON(pm_runtime_force_suspend(from_pvr_device(pvr_dev)->dev)); 389 + WARN_ON(pvr_power_device_suspend(from_pvr_device(pvr_dev)->dev)); 390 390 391 391 err = pvr_fw_hard_reset(pvr_dev); 392 392 if (err) 393 393 goto err_device_lost; 394 394 395 - err = pm_runtime_force_resume(from_pvr_device(pvr_dev)->dev); 395 + err = pvr_power_device_resume(from_pvr_device(pvr_dev)->dev); 396 396 pvr_dev->fw_dev.booted = true; 397 397 if (err) 398 398 goto err_device_lost;

+1 -5

drivers/gpu/drm/nouveau/nouveau_debugfs.c

··· 314 314 drm->debugfs = NULL; 315 315 } 316 316 317 - int 317 + void 318 318 nouveau_module_debugfs_init(void) 319 319 { 320 320 nouveau_debugfs_root = debugfs_create_dir("nouveau", NULL); 321 - if (IS_ERR(nouveau_debugfs_root)) 322 - return PTR_ERR(nouveau_debugfs_root); 323 - 324 - return 0; 325 321 } 326 322 327 323 void

+2 -3

drivers/gpu/drm/nouveau/nouveau_debugfs.h

··· 24 24 25 25 extern struct dentry *nouveau_debugfs_root; 26 26 27 - int nouveau_module_debugfs_init(void); 27 + void nouveau_module_debugfs_init(void); 28 28 void nouveau_module_debugfs_fini(void); 29 29 #else 30 30 static inline void ··· 42 42 { 43 43 } 44 44 45 - static inline int 45 + static inline void 46 46 nouveau_module_debugfs_init(void) 47 47 { 48 - return 0; 49 48 } 50 49 51 50 static inline void

+1 -3

drivers/gpu/drm/nouveau/nouveau_drm.c

··· 1461 1461 if (!nouveau_modeset) 1462 1462 return 0; 1463 1463 1464 - ret = nouveau_module_debugfs_init(); 1465 - if (ret) 1466 - return ret; 1464 + nouveau_module_debugfs_init(); 1467 1465 1468 1466 #ifdef CONFIG_NOUVEAU_PLATFORM_DRIVER 1469 1467 platform_driver_register(&nouveau_platform_driver);

+21 -6

drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c

··· 719 719 union acpi_object argv4 = { 720 720 .buffer.type = ACPI_TYPE_BUFFER, 721 721 .buffer.length = 4, 722 - .buffer.pointer = kmalloc(argv4.buffer.length, GFP_KERNEL), 723 722 }, *obj; 724 723 725 724 caps->status = 0xffff; ··· 726 727 if (!acpi_check_dsm(handle, &NVOP_DSM_GUID, NVOP_DSM_REV, BIT_ULL(0x1a))) 727 728 return; 728 729 730 + argv4.buffer.pointer = kmalloc(argv4.buffer.length, GFP_KERNEL); 731 + if (!argv4.buffer.pointer) 732 + return; 733 + 729 734 obj = acpi_evaluate_dsm(handle, &NVOP_DSM_GUID, NVOP_DSM_REV, 0x1a, &argv4); 730 735 if (!obj) 731 - return; 736 + goto done; 732 737 733 738 if (WARN_ON(obj->type != ACPI_TYPE_BUFFER) || 734 739 WARN_ON(obj->buffer.length != 4)) 735 - return; 740 + goto done; 736 741 737 742 caps->status = 0; 738 743 caps->optimusCaps = *(u32 *)obj->buffer.pointer; 739 744 745 + done: 740 746 ACPI_FREE(obj); 741 747 742 748 kfree(argv4.buffer.pointer); ··· 758 754 union acpi_object argv4 = { 759 755 .buffer.type = ACPI_TYPE_BUFFER, 760 756 .buffer.length = sizeof(caps), 761 - .buffer.pointer = kmalloc(argv4.buffer.length, GFP_KERNEL), 762 757 }, *obj; 763 758 764 759 jt->status = 0xffff; 765 760 761 + argv4.buffer.pointer = kmalloc(argv4.buffer.length, GFP_KERNEL); 762 + if (!argv4.buffer.pointer) 763 + return; 764 + 766 765 obj = acpi_evaluate_dsm(handle, &JT_DSM_GUID, JT_DSM_REV, 0x1, &argv4); 767 766 if (!obj) 768 - return; 767 + goto done; 769 768 770 769 if (WARN_ON(obj->type != ACPI_TYPE_BUFFER) || 771 770 WARN_ON(obj->buffer.length != 4)) 772 - return; 771 + goto done; 773 772 774 773 jt->status = 0; 775 774 jt->jtCaps = *(u32 *)obj->buffer.pointer; 776 775 jt->jtRevId = (jt->jtCaps & 0xfff00000) >> 20; 777 776 jt->bSBIOSCaps = 0; 778 777 778 + done: 779 779 ACPI_FREE(obj); 780 780 781 781 kfree(argv4.buffer.pointer); ··· 1752 1744 nvkm_gsp_sg_free(gsp->subdev.device, &gsp->sr.sgt); 1753 1745 return ret; 1754 1746 } 1747 + 1748 + /* 1749 + * TODO: Debug the GSP firmware / RPC handling to find out why 1750 + * without this Turing (but none of the other architectures) 1751 + * ends up resetting all channels after resume. 1752 + */ 1753 + msleep(50); 1755 1754 } 1756 1755 1757 1756 ret = r535_gsp_rpc_unloading_guest_driver(gsp, suspend);

+2 -4

drivers/gpu/drm/tegra/nvdec.c

··· 261 261 262 262 if (!client->group) { 263 263 virt = dma_alloc_coherent(nvdec->dev, size, &iova, GFP_KERNEL); 264 - 265 - err = dma_mapping_error(nvdec->dev, iova); 266 - if (err < 0) 267 - return err; 264 + if (!virt) 265 + return -ENOMEM; 268 266 } else { 269 267 virt = tegra_drm_alloc(tegra, size, &iova); 270 268 if (IS_ERR(virt))

+28 -10

drivers/gpu/drm/xe/xe_devcoredump.c

··· 171 171 172 172 #define XE_DEVCOREDUMP_CHUNK_MAX (SZ_512M + SZ_1G) 173 173 174 + /** 175 + * xe_devcoredump_read() - Read data from the Xe device coredump snapshot 176 + * @buffer: Destination buffer to copy the coredump data into 177 + * @offset: Offset in the coredump data to start reading from 178 + * @count: Number of bytes to read 179 + * @data: Pointer to the xe_devcoredump structure 180 + * @datalen: Length of the data (unused) 181 + * 182 + * Reads a chunk of the coredump snapshot data into the provided buffer. 183 + * If the devcoredump is smaller than 1.5 GB (XE_DEVCOREDUMP_CHUNK_MAX), 184 + * it is read directly from a pre-written buffer. For larger devcoredumps, 185 + * the pre-written buffer must be periodically repopulated from the snapshot 186 + * state due to kmalloc size limitations. 187 + * 188 + * Return: Number of bytes copied on success, or a negative error code on failure. 189 + */ 174 190 static ssize_t xe_devcoredump_read(char *buffer, loff_t offset, 175 191 size_t count, void *data, size_t datalen) 176 192 { 177 193 struct xe_devcoredump *coredump = data; 178 194 struct xe_devcoredump_snapshot *ss; 179 - ssize_t byte_copied; 195 + ssize_t byte_copied = 0; 180 196 u32 chunk_offset; 181 197 ssize_t new_chunk_position; 198 + bool pm_needed = false; 199 + int ret = 0; 182 200 183 201 if (!coredump) 184 202 return -ENODEV; ··· 206 188 /* Ensure delayed work is captured before continuing */ 207 189 flush_work(&ss->work); 208 190 209 - if (ss->read.size > XE_DEVCOREDUMP_CHUNK_MAX) 191 + pm_needed = ss->read.size > XE_DEVCOREDUMP_CHUNK_MAX; 192 + if (pm_needed) 210 193 xe_pm_runtime_get(gt_to_xe(ss->gt)); 211 194 212 195 mutex_lock(&coredump->lock); 213 196 214 197 if (!ss->read.buffer) { 215 - mutex_unlock(&coredump->lock); 216 - return -ENODEV; 198 + ret = -ENODEV; 199 + goto unlock; 217 200 } 218 201 219 - if (offset >= ss->read.size) { 220 - mutex_unlock(&coredump->lock); 221 - return 0; 222 - } 202 + if (offset >= ss->read.size) 203 + goto unlock; 223 204 224 205 new_chunk_position = div_u64_rem(offset, 225 206 XE_DEVCOREDUMP_CHUNK_MAX, ··· 238 221 ss->read.size - offset; 239 222 memcpy(buffer, ss->read.buffer + chunk_offset, byte_copied); 240 223 224 + unlock: 241 225 mutex_unlock(&coredump->lock); 242 226 243 - if (ss->read.size > XE_DEVCOREDUMP_CHUNK_MAX) 227 + if (pm_needed) 244 228 xe_pm_runtime_put(gt_to_xe(ss->gt)); 245 229 246 - return byte_copied; 230 + return byte_copied ? byte_copied : ret; 247 231 } 248 232 249 233 static void xe_devcoredump_free(void *data)

+1

drivers/gpu/drm/xe/xe_gt_pagefault.c

··· 444 444 #define PF_MULTIPLIER 8 445 445 pf_queue->num_dw = 446 446 (num_eus + XE_NUM_HW_ENGINES) * PF_MSG_LEN_DW * PF_MULTIPLIER; 447 + pf_queue->num_dw = roundup_pow_of_two(pf_queue->num_dw); 447 448 #undef PF_MULTIPLIER 448 449 449 450 pf_queue->gt = gt;

+11

drivers/gpu/drm/xe/xe_lmtt.c

··· 78 78 } 79 79 80 80 lmtt_assert(lmtt, xe_bo_is_vram(bo)); 81 + lmtt_debug(lmtt, "level=%u addr=%#llx\n", level, (u64)xe_bo_main_addr(bo, XE_PAGE_SIZE)); 82 + 83 + xe_map_memset(lmtt_to_xe(lmtt), &bo->vmap, 0, 0, bo->size); 81 84 82 85 pt->level = level; 83 86 pt->bo = bo; ··· 94 91 95 92 static void lmtt_pt_free(struct xe_lmtt_pt *pt) 96 93 { 94 + lmtt_debug(&pt->bo->tile->sriov.pf.lmtt, "level=%u addr=%llx\n", 95 + pt->level, (u64)xe_bo_main_addr(pt->bo, XE_PAGE_SIZE)); 96 + 97 97 xe_bo_unpin_map_no_vm(pt->bo); 98 98 kfree(pt); 99 99 } ··· 232 226 233 227 switch (lmtt->ops->lmtt_pte_size(level)) { 234 228 case sizeof(u32): 229 + lmtt_assert(lmtt, !overflows_type(pte, u32)); 230 + lmtt_assert(lmtt, !pte || !iosys_map_rd(&pt->bo->vmap, idx * sizeof(u32), u32)); 231 + 235 232 xe_map_wr(lmtt_to_xe(lmtt), &pt->bo->vmap, idx * sizeof(u32), u32, pte); 236 233 break; 237 234 case sizeof(u64): 235 + lmtt_assert(lmtt, !pte || !iosys_map_rd(&pt->bo->vmap, idx * sizeof(u64), u64)); 236 + 238 237 xe_map_wr(lmtt_to_xe(lmtt), &pt->bo->vmap, idx * sizeof(u64), u64, pte); 239 238 break; 240 239 default:

+1 -1

drivers/gpu/drm/xe/xe_migrate.c

··· 863 863 if (src_is_vram && xe_migrate_allow_identity(src_L0, &src_it)) 864 864 xe_res_next(&src_it, src_L0); 865 865 else 866 - emit_pte(m, bb, src_L0_pt, src_is_vram, copy_system_ccs, 866 + emit_pte(m, bb, src_L0_pt, src_is_vram, copy_system_ccs || use_comp_pat, 867 867 &src_it, src_L0, src); 868 868 869 869 if (dst_is_vram && xe_migrate_allow_identity(src_L0, &dst_it))

+1 -1

drivers/gpu/drm/xe/xe_module.c

··· 20 20 21 21 struct xe_modparam xe_modparam = { 22 22 .probe_display = true, 23 - .guc_log_level = 3, 23 + .guc_log_level = IS_ENABLED(CONFIG_DRM_XE_DEBUG) ? 3 : 1, 24 24 .force_probe = CONFIG_DRM_XE_FORCE_PROBE, 25 25 .wedged_mode = 1, 26 26 .svm_notifier_size = 512,

-1

drivers/gpu/drm/xe/xe_pci.c

··· 140 140 .has_asid = 1, \ 141 141 .has_atomic_enable_pte_bit = 1, \ 142 142 .has_flat_ccs = 1, \ 143 - .has_indirect_ring_state = 1, \ 144 143 .has_range_tlb_invalidation = 1, \ 145 144 .has_usm = 1, \ 146 145 .has_64bit_timestamp = 1, \

+6 -5

drivers/gpu/drm/xe/xe_pm.c

··· 134 134 /* FIXME: Super racey... */ 135 135 err = xe_bo_evict_all(xe); 136 136 if (err) 137 - goto err_pxp; 137 + goto err_display; 138 138 139 139 for_each_gt(gt, xe, id) { 140 140 err = xe_gt_suspend(gt); ··· 151 151 152 152 err_display: 153 153 xe_display_pm_resume(xe); 154 - err_pxp: 155 154 xe_pxp_pm_resume(xe->pxp); 156 155 err: 157 156 drm_dbg(&xe->drm, "Device suspend failed %d\n", err); ··· 752 753 } 753 754 754 755 /** 755 - * xe_pm_set_vram_threshold - Set a vram threshold for allowing/blocking D3Cold 756 + * xe_pm_set_vram_threshold - Set a VRAM threshold for allowing/blocking D3Cold 756 757 * @xe: xe device instance 757 - * @threshold: VRAM size in bites for the D3cold threshold 758 + * @threshold: VRAM size in MiB for the D3cold threshold 758 759 * 759 - * Returns 0 for success, negative error code otherwise. 760 + * Return: 761 + * * 0 - success 762 + * * -EINVAL - invalid argument 760 763 */ 761 764 int xe_pm_set_vram_threshold(struct xe_device *xe, u32 threshold) 762 765 {

+3 -3

drivers/gpu/drm/xe/xe_uc_fw.c

··· 114 114 #define XE_GT_TYPE_ANY XE_GT_TYPE_UNINITIALIZED 115 115 116 116 #define XE_GUC_FIRMWARE_DEFS(fw_def, mmp_ver, major_ver) \ 117 - fw_def(BATTLEMAGE, GT_TYPE_ANY, major_ver(xe, guc, bmg, 70, 44, 1)) \ 118 - fw_def(LUNARLAKE, GT_TYPE_ANY, major_ver(xe, guc, lnl, 70, 44, 1)) \ 117 + fw_def(BATTLEMAGE, GT_TYPE_ANY, major_ver(xe, guc, bmg, 70, 45, 2)) \ 118 + fw_def(LUNARLAKE, GT_TYPE_ANY, major_ver(xe, guc, lnl, 70, 45, 2)) \ 119 119 fw_def(METEORLAKE, GT_TYPE_ANY, major_ver(i915, guc, mtl, 70, 44, 1)) \ 120 - fw_def(DG2, GT_TYPE_ANY, major_ver(i915, guc, dg2, 70, 44, 1)) \ 120 + fw_def(DG2, GT_TYPE_ANY, major_ver(i915, guc, dg2, 70, 45, 2)) \ 121 121 fw_def(DG1, GT_TYPE_ANY, major_ver(i915, guc, dg1, 70, 44, 1)) \ 122 122 fw_def(ALDERLAKE_N, GT_TYPE_ANY, major_ver(i915, guc, tgl, 70, 44, 1)) \ 123 123 fw_def(ALDERLAKE_P, GT_TYPE_ANY, major_ver(i915, guc, adlp, 70, 44, 1)) \

+2 -2

drivers/gpu/drm/xe/xe_wa_oob.rules

··· 38 38 GRAPHICS_VERSION(2004) 39 39 GRAPHICS_VERSION_RANGE(3000, 3001) 40 40 22019338487 MEDIA_VERSION(2000) 41 - GRAPHICS_VERSION(2001) 41 + GRAPHICS_VERSION(2001), FUNC(xe_rtp_match_not_sriov_vf) 42 42 MEDIA_VERSION(3000), MEDIA_STEP(A0, B0), FUNC(xe_rtp_match_not_sriov_vf) 43 43 22019338487_display PLATFORM(LUNARLAKE) 44 - 16023588340 GRAPHICS_VERSION(2001) 44 + 16023588340 GRAPHICS_VERSION(2001), FUNC(xe_rtp_match_not_sriov_vf) 45 45 14019789679 GRAPHICS_VERSION(1255) 46 46 GRAPHICS_VERSION_RANGE(1270, 2004) 47 47 no_media_l3 MEDIA_VERSION(3000)

+15 -6

drivers/hid/hid-core.c

··· 1883 1883 /* 1884 1884 * 7 extra bytes are necessary to achieve proper functionality 1885 1885 * of implement() working on 8 byte chunks 1886 + * 1 extra byte for the report ID if it is null (not used) so 1887 + * we can reserve that extra byte in the first position of the buffer 1888 + * when sending it to .raw_request() 1886 1889 */ 1887 1890 1888 - u32 len = hid_report_len(report) + 7; 1891 + u32 len = hid_report_len(report) + 7 + (report->id == 0); 1889 1892 1890 1893 return kzalloc(len, flags); 1891 1894 } ··· 1976 1973 int __hid_request(struct hid_device *hid, struct hid_report *report, 1977 1974 enum hid_class_request reqtype) 1978 1975 { 1979 - char *buf; 1976 + char *buf, *data_buf; 1980 1977 int ret; 1981 1978 u32 len; 1982 1979 ··· 1984 1981 if (!buf) 1985 1982 return -ENOMEM; 1986 1983 1984 + data_buf = buf; 1987 1985 len = hid_report_len(report); 1988 1986 1989 - if (reqtype == HID_REQ_SET_REPORT) 1990 - hid_output_report(report, buf); 1987 + if (report->id == 0) { 1988 + /* reserve the first byte for the report ID */ 1989 + data_buf++; 1990 + len++; 1991 + } 1991 1992 1992 - ret = hid->ll_driver->raw_request(hid, report->id, buf, len, 1993 - report->type, reqtype); 1993 + if (reqtype == HID_REQ_SET_REPORT) 1994 + hid_output_report(report, data_buf); 1995 + 1996 + ret = hid_hw_raw_request(hid, report->id, buf, len, report->type, reqtype); 1994 1997 if (ret < 0) { 1995 1998 dbg_hid("unable to complete request: %d\n", ret); 1996 1999 goto out;

+1 -1

drivers/hid/hid-debug.c

··· 3299 3299 [BTN_STYLUS2] = "Stylus2", [BTN_TOOL_DOUBLETAP] = "ToolDoubleTap", 3300 3300 [BTN_TOOL_TRIPLETAP] = "ToolTripleTap", [BTN_TOOL_QUADTAP] = "ToolQuadrupleTap", 3301 3301 [BTN_GEAR_DOWN] = "BtnGearDown", [BTN_GEAR_UP] = "BtnGearUp", 3302 - [BTN_WHEEL] = "BtnWheel", [KEY_OK] = "Ok", 3302 + [KEY_OK] = "Ok", 3303 3303 [KEY_SELECT] = "Select", [KEY_GOTO] = "Goto", 3304 3304 [KEY_CLEAR] = "Clear", [KEY_POWER2] = "Power2", 3305 3305 [KEY_OPTION] = "Option", [KEY_INFO] = "Info",

+5 -1

drivers/md/dm-bufio.c

··· 2742 2742 __make_buffer_clean(b); 2743 2743 __free_buffer_wake(b); 2744 2744 2745 - cond_resched(); 2745 + if (need_resched()) { 2746 + dm_bufio_unlock(c); 2747 + cond_resched(); 2748 + dm_bufio_lock(c); 2749 + } 2746 2750 } 2747 2751 2748 2752 dm_bufio_unlock(c);

+1 -2

drivers/md/md-bitmap.c

··· 2366 2366 2367 2367 if (!bitmap) 2368 2368 return -ENOENT; 2369 - if (!bitmap->mddev->bitmap_info.external && 2370 - !bitmap->storage.sb_page) 2369 + if (!bitmap->storage.sb_page) 2371 2370 return -EINVAL; 2372 2371 sb = kmap_local_page(bitmap->storage.sb_page); 2373 2372 stats->sync_size = le64_to_cpu(sb->sync_size);

+3 -1

drivers/md/raid1.c

··· 1399 1399 } 1400 1400 read_bio = bio_alloc_clone(mirror->rdev->bdev, bio, gfp, 1401 1401 &mddev->bio_set); 1402 - 1402 + read_bio->bi_opf &= ~REQ_NOWAIT; 1403 1403 r1_bio->bios[rdisk] = read_bio; 1404 1404 1405 1405 read_bio->bi_iter.bi_sector = r1_bio->sector + ··· 1649 1649 wait_for_serialization(rdev, r1_bio); 1650 1650 } 1651 1651 1652 + mbio->bi_opf &= ~REQ_NOWAIT; 1652 1653 r1_bio->bios[i] = mbio; 1653 1654 1654 1655 mbio->bi_iter.bi_sector = (r1_bio->sector + rdev->data_offset); ··· 3429 3428 /* ok, everything is stopped */ 3430 3429 oldpool = conf->r1bio_pool; 3431 3430 conf->r1bio_pool = newpool; 3431 + init_waitqueue_head(&conf->r1bio_pool.wait); 3432 3432 3433 3433 for (d = d2 = 0; d < conf->raid_disks; d++) { 3434 3434 struct md_rdev *rdev = conf->mirrors[d].rdev;

+10 -2

drivers/md/raid10.c

··· 1182 1182 } 1183 1183 } 1184 1184 1185 - if (!regular_request_wait(mddev, conf, bio, r10_bio->sectors)) 1185 + if (!regular_request_wait(mddev, conf, bio, r10_bio->sectors)) { 1186 + raid_end_bio_io(r10_bio); 1186 1187 return; 1188 + } 1189 + 1187 1190 rdev = read_balance(conf, r10_bio, &max_sectors); 1188 1191 if (!rdev) { 1189 1192 if (err_rdev) { ··· 1224 1221 r10_bio->master_bio = bio; 1225 1222 } 1226 1223 read_bio = bio_alloc_clone(rdev->bdev, bio, gfp, &mddev->bio_set); 1224 + read_bio->bi_opf &= ~REQ_NOWAIT; 1227 1225 1228 1226 r10_bio->devs[slot].bio = read_bio; 1229 1227 r10_bio->devs[slot].rdev = rdev; ··· 1260 1256 conf->mirrors[devnum].rdev; 1261 1257 1262 1258 mbio = bio_alloc_clone(rdev->bdev, bio, GFP_NOIO, &mddev->bio_set); 1259 + mbio->bi_opf &= ~REQ_NOWAIT; 1263 1260 if (replacement) 1264 1261 r10_bio->devs[n_copy].repl_bio = mbio; 1265 1262 else ··· 1375 1370 } 1376 1371 1377 1372 sectors = r10_bio->sectors; 1378 - if (!regular_request_wait(mddev, conf, bio, sectors)) 1373 + if (!regular_request_wait(mddev, conf, bio, sectors)) { 1374 + raid_end_bio_io(r10_bio); 1379 1375 return; 1376 + } 1377 + 1380 1378 if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) && 1381 1379 (mddev->reshape_backwards 1382 1380 ? (bio->bi_iter.bi_sector < conf->reshape_safe &&

+41 -20

drivers/net/can/m_can/tcan4x5x-core.c

··· 343 343 of_property_read_bool(cdev->dev->of_node, "ti,nwkrq-voltage-vio"); 344 344 } 345 345 346 - static int tcan4x5x_get_gpios(struct m_can_classdev *cdev, 347 - const struct tcan4x5x_version_info *version_info) 346 + static int tcan4x5x_get_gpios(struct m_can_classdev *cdev) 348 347 { 349 348 struct tcan4x5x_priv *tcan4x5x = cdev_to_priv(cdev); 350 349 int ret; 351 350 352 - if (version_info->has_wake_pin) { 353 - tcan4x5x->device_wake_gpio = devm_gpiod_get(cdev->dev, "device-wake", 354 - GPIOD_OUT_HIGH); 355 - if (IS_ERR(tcan4x5x->device_wake_gpio)) { 356 - if (PTR_ERR(tcan4x5x->device_wake_gpio) == -EPROBE_DEFER) 357 - return -EPROBE_DEFER; 351 + tcan4x5x->device_wake_gpio = devm_gpiod_get_optional(cdev->dev, 352 + "device-wake", 353 + GPIOD_OUT_HIGH); 354 + if (IS_ERR(tcan4x5x->device_wake_gpio)) { 355 + if (PTR_ERR(tcan4x5x->device_wake_gpio) == -EPROBE_DEFER) 356 + return -EPROBE_DEFER; 358 357 359 - tcan4x5x_disable_wake(cdev); 360 - } 358 + tcan4x5x->device_wake_gpio = NULL; 361 359 } 362 360 363 361 tcan4x5x->reset_gpio = devm_gpiod_get_optional(cdev->dev, "reset", ··· 367 369 if (ret) 368 370 return ret; 369 371 370 - if (version_info->has_state_pin) { 371 - tcan4x5x->device_state_gpio = devm_gpiod_get_optional(cdev->dev, 372 - "device-state", 373 - GPIOD_IN); 374 - if (IS_ERR(tcan4x5x->device_state_gpio)) { 375 - tcan4x5x->device_state_gpio = NULL; 376 - tcan4x5x_disable_state(cdev); 377 - } 372 + tcan4x5x->device_state_gpio = devm_gpiod_get_optional(cdev->dev, 373 + "device-state", 374 + GPIOD_IN); 375 + if (IS_ERR(tcan4x5x->device_state_gpio)) 376 + tcan4x5x->device_state_gpio = NULL; 377 + 378 + return 0; 379 + } 380 + 381 + static int tcan4x5x_check_gpios(struct m_can_classdev *cdev, 382 + const struct tcan4x5x_version_info *version_info) 383 + { 384 + struct tcan4x5x_priv *tcan4x5x = cdev_to_priv(cdev); 385 + int ret; 386 + 387 + if (version_info->has_wake_pin && !tcan4x5x->device_wake_gpio) { 388 + ret = tcan4x5x_disable_wake(cdev); 389 + if (ret) 390 + return ret; 391 + } 392 + 393 + if (version_info->has_state_pin && !tcan4x5x->device_state_gpio) { 394 + ret = tcan4x5x_disable_state(cdev); 395 + if (ret) 396 + return ret; 378 397 } 379 398 380 399 return 0; ··· 483 468 goto out_m_can_class_free_dev; 484 469 } 485 470 471 + ret = tcan4x5x_get_gpios(mcan_class); 472 + if (ret) { 473 + dev_err(&spi->dev, "Getting gpios failed %pe\n", ERR_PTR(ret)); 474 + goto out_power; 475 + } 476 + 486 477 version_info = tcan4x5x_find_version(priv); 487 478 if (IS_ERR(version_info)) { 488 479 ret = PTR_ERR(version_info); 489 480 goto out_power; 490 481 } 491 482 492 - ret = tcan4x5x_get_gpios(mcan_class, version_info); 483 + ret = tcan4x5x_check_gpios(mcan_class, version_info); 493 484 if (ret) { 494 - dev_err(&spi->dev, "Getting gpios failed %pe\n", ERR_PTR(ret)); 485 + dev_err(&spi->dev, "Checking gpios failed %pe\n", ERR_PTR(ret)); 495 486 goto out_power; 496 487 } 497 488

+2 -1

drivers/net/ethernet/airoha/airoha_npu.c

··· 401 401 return ERR_PTR(-ENODEV); 402 402 403 403 pdev = of_find_device_by_node(np); 404 - of_node_put(np); 405 404 406 405 if (!pdev) { 407 406 dev_err(dev, "cannot find device node %s\n", np->name); 407 + of_node_put(np); 408 408 return ERR_PTR(-ENODEV); 409 409 } 410 + of_node_put(np); 410 411 411 412 if (!try_module_get(THIS_MODULE)) { 412 413 dev_err(dev, "failed to get the device driver module\n");

+2 -1

drivers/net/ethernet/intel/fm10k/fm10k.h

··· 189 189 struct fm10k_ring_container rx, tx; 190 190 191 191 struct napi_struct napi; 192 + struct rcu_head rcu; /* to avoid race with update stats on free */ 193 + 192 194 cpumask_t affinity_mask; 193 195 char name[IFNAMSIZ + 9]; 194 196 195 197 #ifdef CONFIG_DEBUG_FS 196 198 struct dentry *dbg_q_vector; 197 199 #endif /* CONFIG_DEBUG_FS */ 198 - struct rcu_head rcu; /* to avoid race with update stats on free */ 199 200 200 201 /* for dynamic allocation of rings associated with this q_vector */ 201 202 struct fm10k_ring ring[] ____cacheline_internodealigned_in_smp;

+1 -1

drivers/net/ethernet/intel/i40e/i40e.h

··· 946 946 u16 reg_idx; /* register index of the interrupt */ 947 947 948 948 struct napi_struct napi; 949 + struct rcu_head rcu; /* to avoid race with update stats on free */ 949 950 950 951 struct i40e_ring_container rx; 951 952 struct i40e_ring_container tx; ··· 957 956 cpumask_t affinity_mask; 958 957 struct irq_affinity_notify affinity_notify; 959 958 960 - struct rcu_head rcu; /* to avoid race with update stats on free */ 961 959 char name[I40E_INT_NAME_STR_LEN]; 962 960 bool arm_wb_state; 963 961 bool in_busy_poll;

+1 -1

drivers/net/ethernet/intel/ice/ice_debugfs.c

··· 606 606 607 607 pf->ice_debugfs_pf_fwlog = debugfs_create_dir("fwlog", 608 608 pf->ice_debugfs_pf); 609 - if (IS_ERR(pf->ice_debugfs_pf)) 609 + if (IS_ERR(pf->ice_debugfs_pf_fwlog)) 610 610 goto err_create_module_files; 611 611 612 612 fw_modules_dir = debugfs_create_dir("modules",

+2 -1

drivers/net/ethernet/intel/ice/ice_lag.c

··· 2226 2226 struct ice_lag *lag = pf->lag; 2227 2227 struct net_device *tmp_nd; 2228 2228 2229 - if (!ice_is_feature_supported(pf, ICE_F_SRIOV_LAG) || !lag) 2229 + if (!ice_is_feature_supported(pf, ICE_F_SRIOV_LAG) || 2230 + !lag || !lag->upper_netdev) 2230 2231 return false; 2231 2232 2232 2233 rcu_read_lock();

+2 -1

drivers/net/ethernet/intel/ixgbe/ixgbe.h

··· 511 511 struct ixgbe_ring_container rx, tx; 512 512 513 513 struct napi_struct napi; 514 + struct rcu_head rcu; /* to avoid race with update stats on free */ 515 + 514 516 cpumask_t affinity_mask; 515 517 int numa_node; 516 - struct rcu_head rcu; /* to avoid race with update stats on free */ 517 518 char name[IFNAMSIZ + 9]; 518 519 519 520 /* for dynamic allocation of rings associated with this q_vector */

+8 -4

drivers/net/ethernet/mellanox/mlx5/core/en_rx.c

··· 1161 1161 } 1162 1162 } 1163 1163 1164 - static void mlx5e_lro_update_hdr(struct sk_buff *skb, struct mlx5_cqe64 *cqe, 1165 - u32 cqe_bcnt) 1164 + static unsigned int mlx5e_lro_update_hdr(struct sk_buff *skb, 1165 + struct mlx5_cqe64 *cqe, 1166 + u32 cqe_bcnt) 1166 1167 { 1167 1168 struct ethhdr *eth = (struct ethhdr *)(skb->data); 1168 1169 struct tcphdr *tcp; ··· 1213 1212 tcp->check = tcp_v6_check(payload_len, &ipv6->saddr, 1214 1213 &ipv6->daddr, check); 1215 1214 } 1215 + 1216 + return (unsigned int)((unsigned char *)tcp + tcp->doff * 4 - skb->data); 1216 1217 } 1217 1218 1218 1219 static void *mlx5e_shampo_get_packet_hd(struct mlx5e_rq *rq, u16 header_index) ··· 1571 1568 mlx5e_macsec_offload_handle_rx_skb(netdev, skb, cqe); 1572 1569 1573 1570 if (lro_num_seg > 1) { 1574 - mlx5e_lro_update_hdr(skb, cqe, cqe_bcnt); 1575 - skb_shinfo(skb)->gso_size = DIV_ROUND_UP(cqe_bcnt, lro_num_seg); 1571 + unsigned int hdrlen = mlx5e_lro_update_hdr(skb, cqe, cqe_bcnt); 1572 + 1573 + skb_shinfo(skb)->gso_size = DIV_ROUND_UP(cqe_bcnt - hdrlen, lro_num_seg); 1576 1574 /* Subtract one since we already counted this as one 1577 1575 * "regular" packet in mlx5e_complete_rx_cqe() 1578 1576 */

+1

drivers/net/ethernet/mellanox/mlx5/core/main.c

··· 2254 2254 { PCI_VDEVICE(MELLANOX, 0x1021) }, /* ConnectX-7 */ 2255 2255 { PCI_VDEVICE(MELLANOX, 0x1023) }, /* ConnectX-8 */ 2256 2256 { PCI_VDEVICE(MELLANOX, 0x1025) }, /* ConnectX-9 */ 2257 + { PCI_VDEVICE(MELLANOX, 0x1027) }, /* ConnectX-10 */ 2257 2258 { PCI_VDEVICE(MELLANOX, 0xa2d2) }, /* BlueField integrated ConnectX-5 network controller */ 2258 2259 { PCI_VDEVICE(MELLANOX, 0xa2d3), MLX5_PCI_DEV_IS_VF}, /* BlueField integrated ConnectX-5 network controller VF */ 2259 2260 { PCI_VDEVICE(MELLANOX, 0xa2d6) }, /* BlueField-2 integrated ConnectX-6 Dx network controller */

+7 -1

drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c

··· 433 433 return -ETIMEDOUT; 434 434 } 435 435 436 + *system = (struct system_counterval_t) { 437 + .cycles = 0, 438 + .cs_id = CSID_X86_ART, 439 + .use_nsecs = false, 440 + }; 441 + 436 442 num_snapshot = (readl(ioaddr + GMAC_TIMESTAMP_STATUS) & 437 443 GMAC_TIMESTAMP_ATSNS_MASK) >> 438 444 GMAC_TIMESTAMP_ATSNS_SHIFT; ··· 454 448 } 455 449 456 450 system->cycles *= intel_priv->crossts_adj; 457 - system->cs_id = CSID_X86_ART; 451 + 458 452 priv->plat->flags &= ~STMMAC_FLAG_INT_SNAPSHOT_EN; 459 453 460 454 return 0;

+5 -4

drivers/net/ethernet/wangxun/libwx/wx_hw.c

··· 1919 1919 struct wx_ring *ring) 1920 1920 { 1921 1921 u16 reg_idx = ring->reg_idx; 1922 - union wx_rx_desc *rx_desc; 1923 1922 u64 rdba = ring->dma; 1924 1923 u32 rxdctl; 1925 1924 ··· 1948 1949 memset(ring->rx_buffer_info, 0, 1949 1950 sizeof(struct wx_rx_buffer) * ring->count); 1950 1951 1951 - /* initialize Rx descriptor 0 */ 1952 - rx_desc = WX_RX_DESC(ring, 0); 1953 - rx_desc->wb.upper.length = 0; 1952 + /* reset ntu and ntc to place SW in sync with hardware */ 1953 + ring->next_to_clean = 0; 1954 + ring->next_to_use = 0; 1954 1955 1955 1956 /* enable receive descriptor ring */ 1956 1957 wr32m(wx, WX_PX_RR_CFG(reg_idx), ··· 2785 2786 hwstats->fdirmiss += rd32(wx, WX_RDB_FDIR_MISS); 2786 2787 } 2787 2788 2789 + /* qmprc is not cleared on read, manual reset it */ 2790 + hwstats->qmprc = 0; 2788 2791 for (i = wx->num_vfs * wx->num_rx_queues_per_pool; 2789 2792 i < wx->mac.max_rx_queues; i++) 2790 2793 hwstats->qmprc += rd32(wx, WX_PX_MPRC(i));

+7 -13

drivers/net/ethernet/wangxun/libwx/wx_lib.c

··· 174 174 skb_frag_off(frag), 175 175 skb_frag_size(frag), 176 176 DMA_FROM_DEVICE); 177 - 178 - /* If the page was released, just unmap it. */ 179 - if (unlikely(WX_CB(skb)->page_released)) 180 - page_pool_put_full_page(rx_ring->page_pool, rx_buffer->page, false); 181 177 } 182 178 183 179 static struct wx_rx_buffer *wx_get_rx_buffer(struct wx_ring *rx_ring, ··· 223 227 struct sk_buff *skb, 224 228 int rx_buffer_pgcnt) 225 229 { 226 - if (!IS_ERR(skb) && WX_CB(skb)->dma == rx_buffer->dma) 227 - /* the page has been released from the ring */ 228 - WX_CB(skb)->page_released = true; 229 - 230 230 /* clear contents of rx_buffer */ 231 231 rx_buffer->page = NULL; 232 232 rx_buffer->skb = NULL; ··· 307 315 return false; 308 316 dma = page_pool_get_dma_addr(page); 309 317 310 - bi->page_dma = dma; 318 + bi->dma = dma; 311 319 bi->page = page; 312 320 bi->page_offset = 0; 313 321 ··· 344 352 DMA_FROM_DEVICE); 345 353 346 354 rx_desc->read.pkt_addr = 347 - cpu_to_le64(bi->page_dma + bi->page_offset); 355 + cpu_to_le64(bi->dma + bi->page_offset); 348 356 349 357 rx_desc++; 350 358 bi++; ··· 357 365 358 366 /* clear the status bits for the next_to_use descriptor */ 359 367 rx_desc->wb.upper.status_error = 0; 368 + /* clear the length for the next_to_use descriptor */ 369 + rx_desc->wb.upper.length = 0; 360 370 361 371 cleaned_count--; 362 372 } while (cleaned_count); ··· 2422 2428 if (rx_buffer->skb) { 2423 2429 struct sk_buff *skb = rx_buffer->skb; 2424 2430 2425 - if (WX_CB(skb)->page_released) 2426 - page_pool_put_full_page(rx_ring->page_pool, rx_buffer->page, false); 2427 - 2428 2431 dev_kfree_skb(skb); 2429 2432 } 2430 2433 ··· 2444 2453 rx_buffer = rx_ring->rx_buffer_info; 2445 2454 } 2446 2455 } 2456 + 2457 + /* Zero out the descriptor ring */ 2458 + memset(rx_ring->desc, 0, rx_ring->size); 2447 2459 2448 2460 rx_ring->next_to_alloc = 0; 2449 2461 rx_ring->next_to_clean = 0;

-2

drivers/net/ethernet/wangxun/libwx/wx_type.h

··· 914 914 struct wx_cb { 915 915 dma_addr_t dma; 916 916 u16 append_cnt; /* number of skb's appended */ 917 - bool page_released; 918 917 bool dma_released; 919 918 }; 920 919 ··· 1002 1003 struct wx_rx_buffer { 1003 1004 struct sk_buff *skb; 1004 1005 dma_addr_t dma; 1005 - dma_addr_t page_dma; 1006 1006 struct page *page; 1007 1007 unsigned int page_offset; 1008 1008 };

+1 -1

drivers/net/ethernet/xilinx/xilinx_emaclite.c

··· 286 286 287 287 /* Read the remaining data */ 288 288 for (; length > 0; length--) 289 - *to_u8_ptr = *from_u8_ptr; 289 + *to_u8_ptr++ = *from_u8_ptr++; 290 290 } 291 291 } 292 292

+4 -1

drivers/net/hyperv/netvsc_drv.c

··· 2309 2309 if (!ndev) 2310 2310 return NOTIFY_DONE; 2311 2311 2312 - /* set slave flag before open to prevent IPv6 addrconf */ 2312 + /* Set slave flag and no addrconf flag before open 2313 + * to prevent IPv6 addrconf. 2314 + */ 2313 2315 vf_netdev->flags |= IFF_SLAVE; 2316 + vf_netdev->priv_flags |= IFF_NO_ADDRCONF; 2314 2317 return NOTIFY_DONE; 2315 2318 } 2316 2319

+7

drivers/net/ovpn/io.c

··· 62 62 unsigned int pkt_len; 63 63 int ret; 64 64 65 + /* 66 + * GSO state from the transport layer is not valid for the tunnel/data 67 + * path. Reset all GSO fields to prevent any further GSO processing 68 + * from entering an inconsistent state. 69 + */ 70 + skb_gso_reset(skb); 71 + 65 72 /* we can't guarantee the packet wasn't corrupted before entering the 66 73 * VPN, therefore we give other layers a chance to check that 67 74 */

+55 -6

drivers/net/ovpn/netlink-gen.c

··· 29 29 [OVPN_A_KEYCONF_DECRYPT_DIR] = NLA_POLICY_NESTED(ovpn_keydir_nl_policy), 30 30 }; 31 31 32 + const struct nla_policy ovpn_keyconf_del_input_nl_policy[OVPN_A_KEYCONF_SLOT + 1] = { 33 + [OVPN_A_KEYCONF_PEER_ID] = NLA_POLICY_FULL_RANGE(NLA_U32, &ovpn_a_keyconf_peer_id_range), 34 + [OVPN_A_KEYCONF_SLOT] = NLA_POLICY_MAX(NLA_U32, 1), 35 + }; 36 + 37 + const struct nla_policy ovpn_keyconf_get_nl_policy[OVPN_A_KEYCONF_CIPHER_ALG + 1] = { 38 + [OVPN_A_KEYCONF_PEER_ID] = NLA_POLICY_FULL_RANGE(NLA_U32, &ovpn_a_keyconf_peer_id_range), 39 + [OVPN_A_KEYCONF_SLOT] = NLA_POLICY_MAX(NLA_U32, 1), 40 + [OVPN_A_KEYCONF_KEY_ID] = NLA_POLICY_MAX(NLA_U32, 7), 41 + [OVPN_A_KEYCONF_CIPHER_ALG] = NLA_POLICY_MAX(NLA_U32, 2), 42 + }; 43 + 44 + const struct nla_policy ovpn_keyconf_swap_input_nl_policy[OVPN_A_KEYCONF_PEER_ID + 1] = { 45 + [OVPN_A_KEYCONF_PEER_ID] = NLA_POLICY_FULL_RANGE(NLA_U32, &ovpn_a_keyconf_peer_id_range), 46 + }; 47 + 32 48 const struct nla_policy ovpn_keydir_nl_policy[OVPN_A_KEYDIR_NONCE_TAIL + 1] = { 33 49 [OVPN_A_KEYDIR_CIPHER_KEY] = NLA_POLICY_MAX_LEN(256), 34 50 [OVPN_A_KEYDIR_NONCE_TAIL] = NLA_POLICY_EXACT_LEN(OVPN_NONCE_TAIL_SIZE), ··· 76 60 [OVPN_A_PEER_LINK_TX_PACKETS] = { .type = NLA_UINT, }, 77 61 }; 78 62 63 + const struct nla_policy ovpn_peer_del_input_nl_policy[OVPN_A_PEER_ID + 1] = { 64 + [OVPN_A_PEER_ID] = NLA_POLICY_FULL_RANGE(NLA_U32, &ovpn_a_peer_id_range), 65 + }; 66 + 67 + const struct nla_policy ovpn_peer_new_input_nl_policy[OVPN_A_PEER_KEEPALIVE_TIMEOUT + 1] = { 68 + [OVPN_A_PEER_ID] = NLA_POLICY_FULL_RANGE(NLA_U32, &ovpn_a_peer_id_range), 69 + [OVPN_A_PEER_REMOTE_IPV4] = { .type = NLA_BE32, }, 70 + [OVPN_A_PEER_REMOTE_IPV6] = NLA_POLICY_EXACT_LEN(16), 71 + [OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID] = { .type = NLA_U32, }, 72 + [OVPN_A_PEER_REMOTE_PORT] = NLA_POLICY_MIN(NLA_BE16, 1), 73 + [OVPN_A_PEER_SOCKET] = { .type = NLA_U32, }, 74 + [OVPN_A_PEER_VPN_IPV4] = { .type = NLA_BE32, }, 75 + [OVPN_A_PEER_VPN_IPV6] = NLA_POLICY_EXACT_LEN(16), 76 + [OVPN_A_PEER_LOCAL_IPV4] = { .type = NLA_BE32, }, 77 + [OVPN_A_PEER_LOCAL_IPV6] = NLA_POLICY_EXACT_LEN(16), 78 + [OVPN_A_PEER_KEEPALIVE_INTERVAL] = { .type = NLA_U32, }, 79 + [OVPN_A_PEER_KEEPALIVE_TIMEOUT] = { .type = NLA_U32, }, 80 + }; 81 + 82 + const struct nla_policy ovpn_peer_set_input_nl_policy[OVPN_A_PEER_KEEPALIVE_TIMEOUT + 1] = { 83 + [OVPN_A_PEER_ID] = NLA_POLICY_FULL_RANGE(NLA_U32, &ovpn_a_peer_id_range), 84 + [OVPN_A_PEER_REMOTE_IPV4] = { .type = NLA_BE32, }, 85 + [OVPN_A_PEER_REMOTE_IPV6] = NLA_POLICY_EXACT_LEN(16), 86 + [OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID] = { .type = NLA_U32, }, 87 + [OVPN_A_PEER_REMOTE_PORT] = NLA_POLICY_MIN(NLA_BE16, 1), 88 + [OVPN_A_PEER_VPN_IPV4] = { .type = NLA_BE32, }, 89 + [OVPN_A_PEER_VPN_IPV6] = NLA_POLICY_EXACT_LEN(16), 90 + [OVPN_A_PEER_LOCAL_IPV4] = { .type = NLA_BE32, }, 91 + [OVPN_A_PEER_LOCAL_IPV6] = NLA_POLICY_EXACT_LEN(16), 92 + [OVPN_A_PEER_KEEPALIVE_INTERVAL] = { .type = NLA_U32, }, 93 + [OVPN_A_PEER_KEEPALIVE_TIMEOUT] = { .type = NLA_U32, }, 94 + }; 95 + 79 96 /* OVPN_CMD_PEER_NEW - do */ 80 97 static const struct nla_policy ovpn_peer_new_nl_policy[OVPN_A_PEER + 1] = { 81 98 [OVPN_A_IFINDEX] = { .type = NLA_U32, }, 82 - [OVPN_A_PEER] = NLA_POLICY_NESTED(ovpn_peer_nl_policy), 99 + [OVPN_A_PEER] = NLA_POLICY_NESTED(ovpn_peer_new_input_nl_policy), 83 100 }; 84 101 85 102 /* OVPN_CMD_PEER_SET - do */ 86 103 static const struct nla_policy ovpn_peer_set_nl_policy[OVPN_A_PEER + 1] = { 87 104 [OVPN_A_IFINDEX] = { .type = NLA_U32, }, 88 - [OVPN_A_PEER] = NLA_POLICY_NESTED(ovpn_peer_nl_policy), 105 + [OVPN_A_PEER] = NLA_POLICY_NESTED(ovpn_peer_set_input_nl_policy), 89 106 }; 90 107 91 108 /* OVPN_CMD_PEER_GET - do */ ··· 135 86 /* OVPN_CMD_PEER_DEL - do */ 136 87 static const struct nla_policy ovpn_peer_del_nl_policy[OVPN_A_PEER + 1] = { 137 88 [OVPN_A_IFINDEX] = { .type = NLA_U32, }, 138 - [OVPN_A_PEER] = NLA_POLICY_NESTED(ovpn_peer_nl_policy), 89 + [OVPN_A_PEER] = NLA_POLICY_NESTED(ovpn_peer_del_input_nl_policy), 139 90 }; 140 91 141 92 /* OVPN_CMD_KEY_NEW - do */ ··· 147 98 /* OVPN_CMD_KEY_GET - do */ 148 99 static const struct nla_policy ovpn_key_get_nl_policy[OVPN_A_KEYCONF + 1] = { 149 100 [OVPN_A_IFINDEX] = { .type = NLA_U32, }, 150 - [OVPN_A_KEYCONF] = NLA_POLICY_NESTED(ovpn_keyconf_nl_policy), 101 + [OVPN_A_KEYCONF] = NLA_POLICY_NESTED(ovpn_keyconf_get_nl_policy), 151 102 }; 152 103 153 104 /* OVPN_CMD_KEY_SWAP - do */ 154 105 static const struct nla_policy ovpn_key_swap_nl_policy[OVPN_A_KEYCONF + 1] = { 155 106 [OVPN_A_IFINDEX] = { .type = NLA_U32, }, 156 - [OVPN_A_KEYCONF] = NLA_POLICY_NESTED(ovpn_keyconf_nl_policy), 107 + [OVPN_A_KEYCONF] = NLA_POLICY_NESTED(ovpn_keyconf_swap_input_nl_policy), 157 108 }; 158 109 159 110 /* OVPN_CMD_KEY_DEL - do */ 160 111 static const struct nla_policy ovpn_key_del_nl_policy[OVPN_A_KEYCONF + 1] = { 161 112 [OVPN_A_IFINDEX] = { .type = NLA_U32, }, 162 - [OVPN_A_KEYCONF] = NLA_POLICY_NESTED(ovpn_keyconf_nl_policy), 113 + [OVPN_A_KEYCONF] = NLA_POLICY_NESTED(ovpn_keyconf_del_input_nl_policy), 163 114 }; 164 115 165 116 /* Ops table for ovpn */

+6

drivers/net/ovpn/netlink-gen.h

··· 13 13 14 14 /* Common nested types */ 15 15 extern const struct nla_policy ovpn_keyconf_nl_policy[OVPN_A_KEYCONF_DECRYPT_DIR + 1]; 16 + extern const struct nla_policy ovpn_keyconf_del_input_nl_policy[OVPN_A_KEYCONF_SLOT + 1]; 17 + extern const struct nla_policy ovpn_keyconf_get_nl_policy[OVPN_A_KEYCONF_CIPHER_ALG + 1]; 18 + extern const struct nla_policy ovpn_keyconf_swap_input_nl_policy[OVPN_A_KEYCONF_PEER_ID + 1]; 16 19 extern const struct nla_policy ovpn_keydir_nl_policy[OVPN_A_KEYDIR_NONCE_TAIL + 1]; 17 20 extern const struct nla_policy ovpn_peer_nl_policy[OVPN_A_PEER_LINK_TX_PACKETS + 1]; 21 + extern const struct nla_policy ovpn_peer_del_input_nl_policy[OVPN_A_PEER_ID + 1]; 22 + extern const struct nla_policy ovpn_peer_new_input_nl_policy[OVPN_A_PEER_KEEPALIVE_TIMEOUT + 1]; 23 + extern const struct nla_policy ovpn_peer_set_input_nl_policy[OVPN_A_PEER_KEEPALIVE_TIMEOUT + 1]; 18 24 19 25 int ovpn_nl_pre_doit(const struct genl_split_ops *ops, struct sk_buff *skb, 20 26 struct genl_info *info);

+43 -8

drivers/net/ovpn/netlink.c

··· 352 352 return -EINVAL; 353 353 354 354 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER], 355 - ovpn_peer_nl_policy, info->extack); 355 + ovpn_peer_new_input_nl_policy, info->extack); 356 356 if (ret) 357 357 return ret; 358 358 ··· 476 476 return -EINVAL; 477 477 478 478 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER], 479 - ovpn_peer_nl_policy, info->extack); 479 + ovpn_peer_set_input_nl_policy, info->extack); 480 480 if (ret) 481 481 return ret; 482 482 ··· 654 654 struct ovpn_peer *peer; 655 655 struct sk_buff *msg; 656 656 u32 peer_id; 657 - int ret; 657 + int ret, i; 658 658 659 659 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER)) 660 660 return -EINVAL; ··· 667 667 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs, 668 668 OVPN_A_PEER_ID)) 669 669 return -EINVAL; 670 + 671 + /* OVPN_CMD_PEER_GET expects only the PEER_ID, therefore 672 + * ensure that the user hasn't specified any other attribute. 673 + * 674 + * Unfortunately this check cannot be performed via netlink 675 + * spec/policy and must be open-coded. 676 + */ 677 + for (i = 0; i < OVPN_A_PEER_MAX + 1; i++) { 678 + if (i == OVPN_A_PEER_ID) 679 + continue; 680 + 681 + if (attrs[i]) { 682 + NL_SET_ERR_MSG_FMT_MOD(info->extack, 683 + "unexpected attribute %u", i); 684 + return -EINVAL; 685 + } 686 + } 670 687 671 688 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]); 672 689 peer = ovpn_peer_get_by_id(ovpn, peer_id); ··· 785 768 return -EINVAL; 786 769 787 770 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER], 788 - ovpn_peer_nl_policy, info->extack); 771 + ovpn_peer_del_input_nl_policy, info->extack); 789 772 if (ret) 790 773 return ret; 791 774 ··· 986 969 struct ovpn_peer *peer; 987 970 struct sk_buff *msg; 988 971 u32 peer_id; 989 - int ret; 972 + int ret, i; 990 973 991 974 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF)) 992 975 return -EINVAL; 993 976 994 977 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX, 995 978 info->attrs[OVPN_A_KEYCONF], 996 - ovpn_keyconf_nl_policy, info->extack); 979 + ovpn_keyconf_get_nl_policy, info->extack); 997 980 if (ret) 998 981 return ret; 999 982 ··· 1004 987 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 1005 988 OVPN_A_KEYCONF_SLOT)) 1006 989 return -EINVAL; 990 + 991 + /* OVPN_CMD_KEY_GET expects only the PEER_ID and the SLOT, therefore 992 + * ensure that the user hasn't specified any other attribute. 993 + * 994 + * Unfortunately this check cannot be performed via netlink 995 + * spec/policy and must be open-coded. 996 + */ 997 + for (i = 0; i < OVPN_A_KEYCONF_MAX + 1; i++) { 998 + if (i == OVPN_A_KEYCONF_PEER_ID || 999 + i == OVPN_A_KEYCONF_SLOT) 1000 + continue; 1001 + 1002 + if (attrs[i]) { 1003 + NL_SET_ERR_MSG_FMT_MOD(info->extack, 1004 + "unexpected attribute %u", i); 1005 + return -EINVAL; 1006 + } 1007 + } 1007 1008 1008 1009 peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]); 1009 1010 peer = ovpn_peer_get_by_id(ovpn, peer_id); ··· 1072 1037 1073 1038 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX, 1074 1039 info->attrs[OVPN_A_KEYCONF], 1075 - ovpn_keyconf_nl_policy, info->extack); 1040 + ovpn_keyconf_swap_input_nl_policy, info->extack); 1076 1041 if (ret) 1077 1042 return ret; 1078 1043 ··· 1109 1074 1110 1075 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX, 1111 1076 info->attrs[OVPN_A_KEYCONF], 1112 - ovpn_keyconf_nl_policy, info->extack); 1077 + ovpn_keyconf_del_input_nl_policy, info->extack); 1113 1078 if (ret) 1114 1079 return ret; 1115 1080

+1

drivers/net/ovpn/udp.c

··· 344 344 int ret; 345 345 346 346 skb->dev = peer->ovpn->dev; 347 + skb->mark = READ_ONCE(sk->sk_mark); 347 348 /* no checksum performed at this layer */ 348 349 skb->ip_summed = CHECKSUM_NONE; 349 350

+4

drivers/net/usb/sierra_net.c

··· 689 689 status); 690 690 return -ENODEV; 691 691 } 692 + if (!dev->status) { 693 + dev_err(&dev->udev->dev, "No status endpoint found"); 694 + return -ENODEV; 695 + } 692 696 /* Initialize sierra private data */ 693 697 priv = kzalloc(sizeof *priv, GFP_KERNEL); 694 698 if (!priv)

+1 -1

drivers/net/virtio_net.c

··· 7109 7109 otherwise get link status from config. */ 7110 7110 netif_carrier_off(dev); 7111 7111 if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_STATUS)) { 7112 - virtnet_config_changed_work(&vi->config_work); 7112 + virtio_config_changed(vi->vdev); 7113 7113 } else { 7114 7114 vi->status = VIRTIO_NET_S_LINK_UP; 7115 7115 virtnet_update_settings(vi);

+2 -1

drivers/net/wireless/ath/ath12k/dp_rx.c

··· 1060 1060 } 1061 1061 1062 1062 rx_tid = &peer->rx_tid[tid]; 1063 - paddr_aligned = rx_tid->qbuf.paddr_aligned; 1064 1063 /* Update the tid queue if it is already setup */ 1065 1064 if (rx_tid->active) { 1066 1065 ret = ath12k_peer_rx_tid_reo_update(ar, peer, rx_tid, ··· 1071 1072 } 1072 1073 1073 1074 if (!ab->hw_params->reoq_lut_support) { 1075 + paddr_aligned = rx_tid->qbuf.paddr_aligned; 1074 1076 ret = ath12k_wmi_peer_rx_reorder_queue_setup(ar, vdev_id, 1075 1077 peer_mac, 1076 1078 paddr_aligned, tid, ··· 1098 1098 return ret; 1099 1099 } 1100 1100 1101 + paddr_aligned = rx_tid->qbuf.paddr_aligned; 1101 1102 if (ab->hw_params->reoq_lut_support) { 1102 1103 /* Update the REO queue LUT at the corresponding peer id 1103 1104 * and tid with qaddr.

+2 -2

drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h

··· 1 1 /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */ 2 2 /* 3 - * Copyright (C) 2012-2014, 2018-2024 Intel Corporation 3 + * Copyright (C) 2012-2014, 2018-2025 Intel Corporation 4 4 * Copyright (C) 2013-2015 Intel Mobile Communications GmbH 5 5 * Copyright (C) 2016-2017 Intel Deutschland GmbH 6 6 */ ··· 754 754 * according to the BIOS definitions. 755 755 * For LARI cmd version 11 - bits 0:4 are supported. 756 756 * For LARI cmd version 12 - bits 0:6 are supported and bits 7:31 are 757 - * reserved. No need to mask out the reserved bits. 757 + * reserved. 758 758 * @force_disable_channels_bitmap: Bitmap of disabled bands/channels. 759 759 * Each bit represents a set of channels in a specific band that should be 760 760 * disabled

+4 -2

drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/trans-gen2.c

··· 546 546 } 547 547 548 548 if (WARN_ON(trans->do_top_reset && 549 - trans->mac_cfg->device_family < IWL_DEVICE_FAMILY_SC)) 550 - return -EINVAL; 549 + trans->mac_cfg->device_family < IWL_DEVICE_FAMILY_SC)) { 550 + ret = -EINVAL; 551 + goto out; 552 + } 551 553 552 554 /* we need to wait later - set state */ 553 555 if (trans->do_top_reset)

+4 -4

drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/tx.c

··· 2100 2100 2101 2101 bc_ent = cpu_to_le16(len | (sta_id << 12)); 2102 2102 2103 - scd_bc_tbl[txq_id * BC_TABLE_SIZE + write_ptr].tfd_offset = bc_ent; 2103 + scd_bc_tbl[txq_id * TFD_QUEUE_BC_SIZE + write_ptr].tfd_offset = bc_ent; 2104 2104 2105 2105 if (write_ptr < TFD_QUEUE_SIZE_BC_DUP) 2106 - scd_bc_tbl[txq_id * BC_TABLE_SIZE + TFD_QUEUE_SIZE_MAX + write_ptr].tfd_offset = 2106 + scd_bc_tbl[txq_id * TFD_QUEUE_BC_SIZE + TFD_QUEUE_SIZE_MAX + write_ptr].tfd_offset = 2107 2107 bc_ent; 2108 2108 } 2109 2109 ··· 2327 2327 2328 2328 bc_ent = cpu_to_le16(1 | (sta_id << 12)); 2329 2329 2330 - scd_bc_tbl[txq_id * BC_TABLE_SIZE + read_ptr].tfd_offset = bc_ent; 2330 + scd_bc_tbl[txq_id * TFD_QUEUE_BC_SIZE + read_ptr].tfd_offset = bc_ent; 2331 2331 2332 2332 if (read_ptr < TFD_QUEUE_SIZE_BC_DUP) 2333 - scd_bc_tbl[txq_id * BC_TABLE_SIZE + TFD_QUEUE_SIZE_MAX + read_ptr].tfd_offset = 2333 + scd_bc_tbl[txq_id * TFD_QUEUE_BC_SIZE + TFD_QUEUE_SIZE_MAX + read_ptr].tfd_offset = 2334 2334 bc_ent; 2335 2335 } 2336 2336

+2 -2

drivers/pci/controller/pci-host-common.c

··· 64 64 65 65 of_pci_check_probe_only(); 66 66 67 + platform_set_drvdata(pdev, bridge); 68 + 67 69 /* Parse and map our Configuration Space windows */ 68 70 cfg = gen_pci_init(dev, bridge, ops); 69 71 if (IS_ERR(cfg)) 70 72 return PTR_ERR(cfg); 71 - 72 - platform_set_drvdata(pdev, bridge); 73 73 74 74 bridge->sysdata = cfg; 75 75 bridge->ops = (struct pci_ops *)&ops->pci_ops;

+49 -4

drivers/pci/controller/pcie-apple.c

··· 187 187 const struct hw_info *hw; 188 188 unsigned long *bitmap; 189 189 struct list_head ports; 190 + struct list_head entry; 190 191 struct completion event; 191 192 struct irq_fwspec fwspec; 192 193 u32 nvecs; ··· 205 204 int sid_map_sz; 206 205 int idx; 207 206 }; 207 + 208 + static LIST_HEAD(pcie_list); 209 + static DEFINE_MUTEX(pcie_list_lock); 208 210 209 211 static void rmw_set(u32 set, void __iomem *addr) 210 212 { ··· 724 720 return 0; 725 721 } 726 722 723 + static void apple_pcie_register(struct apple_pcie *pcie) 724 + { 725 + guard(mutex)(&pcie_list_lock); 726 + 727 + list_add_tail(&pcie->entry, &pcie_list); 728 + } 729 + 730 + static void apple_pcie_unregister(struct apple_pcie *pcie) 731 + { 732 + guard(mutex)(&pcie_list_lock); 733 + 734 + list_del(&pcie->entry); 735 + } 736 + 737 + static struct apple_pcie *apple_pcie_lookup(struct device *dev) 738 + { 739 + struct apple_pcie *pcie; 740 + 741 + guard(mutex)(&pcie_list_lock); 742 + 743 + list_for_each_entry(pcie, &pcie_list, entry) { 744 + if (pcie->dev == dev) 745 + return pcie; 746 + } 747 + 748 + return NULL; 749 + } 750 + 727 751 static struct apple_pcie_port *apple_pcie_get_port(struct pci_dev *pdev) 728 752 { 729 753 struct pci_config_window *cfg = pdev->sysdata; 730 - struct apple_pcie *pcie = cfg->priv; 754 + struct apple_pcie *pcie; 731 755 struct pci_dev *port_pdev; 732 756 struct apple_pcie_port *port; 757 + 758 + pcie = apple_pcie_lookup(cfg->parent); 759 + if (WARN_ON(!pcie)) 760 + return NULL; 733 761 734 762 /* Find the root port this device is on */ 735 763 port_pdev = pcie_find_root_port(pdev); ··· 842 806 843 807 static int apple_pcie_init(struct pci_config_window *cfg) 844 808 { 845 - struct apple_pcie *pcie = cfg->priv; 846 809 struct device *dev = cfg->parent; 810 + struct apple_pcie *pcie; 847 811 int ret; 812 + 813 + pcie = apple_pcie_lookup(dev); 814 + if (WARN_ON(!pcie)) 815 + return -ENOENT; 848 816 849 817 for_each_available_child_of_node_scoped(dev->of_node, of_port) { 850 818 ret = apple_pcie_setup_port(pcie, of_port); ··· 892 852 893 853 mutex_init(&pcie->lock); 894 854 INIT_LIST_HEAD(&pcie->ports); 895 - dev_set_drvdata(dev, pcie); 896 855 897 856 ret = apple_msi_init(pcie); 898 857 if (ret) 899 858 return ret; 900 859 901 - return pci_host_common_init(pdev, &apple_pcie_cfg_ecam_ops); 860 + apple_pcie_register(pcie); 861 + 862 + ret = pci_host_common_init(pdev, &apple_pcie_cfg_ecam_ops); 863 + if (ret) 864 + apple_pcie_unregister(pcie); 865 + 866 + return ret; 902 867 } 903 868 904 869 static const struct of_device_id apple_pcie_of_match[] = {

-2

drivers/pci/ecam.c

··· 84 84 goto err_exit_iomap; 85 85 } 86 86 87 - cfg->priv = dev_get_drvdata(dev); 88 - 89 87 if (ops->init) { 90 88 err = ops->init(cfg); 91 89 if (err)

+3 -1

drivers/pci/msi/msi.c

··· 934 934 if (!pdev->msix_enabled) 935 935 return -ENXIO; 936 936 937 - guard(msi_descs_lock)(&pdev->dev); 938 937 virq = msi_get_virq(&pdev->dev, index); 939 938 if (!virq) 940 939 return -ENXIO; 940 + 941 + guard(msi_descs_lock)(&pdev->dev); 942 + 941 943 /* 942 944 * This is a horrible hack, but short of implementing a PCI 943 945 * specific interrupt chip callback and a huge pile of

+12 -1

drivers/soc/aspeed/aspeed-lpc-snoop.c

··· 58 58 }; 59 59 60 60 struct aspeed_lpc_snoop_channel { 61 + bool enabled; 61 62 struct kfifo fifo; 62 63 wait_queue_head_t wq; 63 64 struct miscdevice miscdev; ··· 191 190 const struct aspeed_lpc_snoop_model_data *model_data = 192 191 of_device_get_match_data(dev); 193 192 193 + if (WARN_ON(lpc_snoop->chan[channel].enabled)) 194 + return -EBUSY; 195 + 194 196 init_waitqueue_head(&lpc_snoop->chan[channel].wq); 195 197 /* Create FIFO datastructure */ 196 198 rc = kfifo_alloc(&lpc_snoop->chan[channel].fifo, ··· 240 236 regmap_update_bits(lpc_snoop->regmap, HICRB, 241 237 hicrb_en, hicrb_en); 242 238 239 + lpc_snoop->chan[channel].enabled = true; 240 + 243 241 return 0; 244 242 245 243 err_misc_deregister: ··· 254 248 static void aspeed_lpc_disable_snoop(struct aspeed_lpc_snoop *lpc_snoop, 255 249 int channel) 256 250 { 251 + if (!lpc_snoop->chan[channel].enabled) 252 + return; 253 + 257 254 switch (channel) { 258 255 case 0: 259 256 regmap_update_bits(lpc_snoop->regmap, HICR5, ··· 272 263 return; 273 264 } 274 265 275 - kfifo_free(&lpc_snoop->chan[channel].fifo); 266 + lpc_snoop->chan[channel].enabled = false; 267 + /* Consider improving safety wrt concurrent reader(s) */ 276 268 misc_deregister(&lpc_snoop->chan[channel].miscdev); 269 + kfifo_free(&lpc_snoop->chan[channel].fifo); 277 270 } 278 271 279 272 static int aspeed_lpc_snoop_probe(struct platform_device *pdev)

+13 -13

fs/bcachefs/btree_cache.c

··· 85 85 six_unlock_intent(&b->c.lock); 86 86 } 87 87 88 - static void __btree_node_data_free(struct btree_cache *bc, struct btree *b) 88 + void __btree_node_data_free(struct btree *b) 89 89 { 90 90 BUG_ON(!list_empty(&b->list)); 91 91 BUG_ON(btree_node_hashed(b)); ··· 112 112 munmap(b->aux_data, btree_aux_data_bytes(b)); 113 113 #endif 114 114 b->aux_data = NULL; 115 - 116 - btree_node_to_freedlist(bc, b); 117 115 } 118 116 119 117 static void btree_node_data_free(struct btree_cache *bc, struct btree *b) 120 118 { 121 119 BUG_ON(list_empty(&b->list)); 122 120 list_del_init(&b->list); 121 + 122 + __btree_node_data_free(b); 123 + 123 124 --bc->nr_freeable; 124 - __btree_node_data_free(bc, b); 125 + btree_node_to_freedlist(bc, b); 125 126 } 126 127 127 128 static int bch2_btree_cache_cmp_fn(struct rhashtable_compare_arg *arg, ··· 186 185 187 186 struct btree *__bch2_btree_node_mem_alloc(struct bch_fs *c) 188 187 { 189 - struct btree_cache *bc = &c->btree_cache; 190 - struct btree *b; 191 - 192 - b = __btree_node_mem_alloc(c, GFP_KERNEL); 188 + struct btree *b = __btree_node_mem_alloc(c, GFP_KERNEL); 193 189 if (!b) 194 190 return NULL; 195 191 ··· 196 198 } 197 199 198 200 bch2_btree_lock_init(&b->c, 0, GFP_KERNEL); 199 - 200 - __bch2_btree_node_to_freelist(bc, b); 201 201 return b; 202 202 } 203 203 ··· 520 524 --touched;; 521 525 } else if (!btree_node_reclaim(c, b)) { 522 526 __bch2_btree_node_hash_remove(bc, b); 523 - __btree_node_data_free(bc, b); 527 + __btree_node_data_free(b); 528 + btree_node_to_freedlist(bc, b); 524 529 525 530 freed++; 526 531 bc->nr_freed++; ··· 649 652 650 653 bch2_recalc_btree_reserve(c); 651 654 652 - for (i = 0; i < bc->nr_reserve; i++) 653 - if (!__bch2_btree_node_mem_alloc(c)) 655 + for (i = 0; i < bc->nr_reserve; i++) { 656 + struct btree *b = __bch2_btree_node_mem_alloc(c); 657 + if (!b) 654 658 goto err; 659 + __bch2_btree_node_to_freelist(bc, b); 660 + } 655 661 656 662 list_splice_init(&bc->live[0].list, &bc->freeable); 657 663

+1

fs/bcachefs/btree_cache.h

··· 30 30 void bch2_btree_cache_cannibalize_unlock(struct btree_trans *); 31 31 int bch2_btree_cache_cannibalize_lock(struct btree_trans *, struct closure *); 32 32 33 + void __btree_node_data_free(struct btree *); 33 34 struct btree *__bch2_btree_node_mem_alloc(struct bch_fs *); 34 35 struct btree *bch2_btree_node_mem_alloc(struct btree_trans *, bool); 35 36

+3 -5

fs/bcachefs/btree_io.c

··· 568 568 bch2_mark_btree_validate_failure(failed, ca->dev_idx); 569 569 570 570 struct extent_ptr_decoded pick; 571 - have_retry = !bch2_bkey_pick_read_device(c, 571 + have_retry = bch2_bkey_pick_read_device(c, 572 572 bkey_i_to_s_c(&b->key), 573 - failed, &pick, -1); 573 + failed, &pick, -1) == 1; 574 574 } 575 575 576 576 if (!have_retry && ret == -BCH_ERR_btree_node_read_err_want_retry) ··· 615 615 goto out; 616 616 case -BCH_ERR_btree_node_read_err_bad_node: 617 617 prt_str(&out, ", "); 618 - ret = __bch2_topology_error(c, &out); 619 618 break; 620 619 } 621 620 ··· 643 644 goto out; 644 645 case -BCH_ERR_btree_node_read_err_bad_node: 645 646 prt_str(&out, ", "); 646 - ret = __bch2_topology_error(c, &out); 647 647 break; 648 648 } 649 649 print: ··· 1406 1408 ret = bch2_bkey_pick_read_device(c, 1407 1409 bkey_i_to_s_c(&b->key), 1408 1410 &failed, &rb->pick, -1); 1409 - if (ret) { 1411 + if (ret <= 0) { 1410 1412 set_btree_node_read_error(b); 1411 1413 break; 1412 1414 }

+41 -43

fs/bcachefs/btree_node_scan.c

··· 75 75 } 76 76 } 77 77 78 - static bool found_btree_node_is_readable(struct btree_trans *trans, 79 - struct found_btree_node *f) 80 - { 81 - struct { __BKEY_PADDED(k, BKEY_BTREE_PTR_VAL_U64s_MAX); } tmp; 82 - 83 - found_btree_node_to_key(&tmp.k, f); 84 - 85 - struct btree *b = bch2_btree_node_get_noiter(trans, &tmp.k, f->btree_id, f->level, false); 86 - bool ret = !IS_ERR_OR_NULL(b); 87 - if (!ret) 88 - return ret; 89 - 90 - f->sectors_written = b->written; 91 - f->journal_seq = le64_to_cpu(b->data->keys.journal_seq); 92 - 93 - struct bkey_s_c k; 94 - struct bkey unpacked; 95 - struct btree_node_iter iter; 96 - for_each_btree_node_key_unpack(b, k, &iter, &unpacked) 97 - f->journal_seq = max(f->journal_seq, bkey_journal_seq(k)); 98 - 99 - six_unlock_read(&b->c.lock); 100 - 101 - /* 102 - * We might update this node's range; if that happens, we need the node 103 - * to be re-read so the read path can trim keys that are no longer in 104 - * this node 105 - */ 106 - if (b != btree_node_root(trans->c, b)) 107 - bch2_btree_node_evict(trans, &tmp.k); 108 - return ret; 109 - } 110 - 111 78 static int found_btree_node_cmp_cookie(const void *_l, const void *_r) 112 79 { 113 80 const struct found_btree_node *l = _l; ··· 126 159 }; 127 160 128 161 static void try_read_btree_node(struct find_btree_nodes *f, struct bch_dev *ca, 129 - struct bio *bio, struct btree_node *bn, u64 offset) 162 + struct btree *b, struct bio *bio, u64 offset) 130 163 { 131 164 struct bch_fs *c = container_of(f, struct bch_fs, found_btree_nodes); 165 + struct btree_node *bn = b->data; 132 166 133 167 bio_reset(bio, ca->disk_sb.bdev, REQ_OP_READ); 134 168 bio->bi_iter.bi_sector = offset; 135 - bch2_bio_map(bio, bn, PAGE_SIZE); 169 + bch2_bio_map(bio, b->data, c->opts.block_size); 136 170 137 171 u64 submit_time = local_clock(); 138 172 submit_bio_wait(bio); 139 - 140 173 bch2_account_io_completion(ca, BCH_MEMBER_ERROR_read, submit_time, !bio->bi_status); 141 174 142 175 if (bio->bi_status) { ··· 168 201 if (BTREE_NODE_ID(bn) >= BTREE_ID_NR_MAX) 169 202 return; 170 203 204 + bio_reset(bio, ca->disk_sb.bdev, REQ_OP_READ); 205 + bio->bi_iter.bi_sector = offset; 206 + bch2_bio_map(bio, b->data, c->opts.btree_node_size); 207 + 208 + submit_time = local_clock(); 209 + submit_bio_wait(bio); 210 + bch2_account_io_completion(ca, BCH_MEMBER_ERROR_read, submit_time, !bio->bi_status); 211 + 171 212 rcu_read_lock(); 172 213 struct found_btree_node n = { 173 214 .btree_id = BTREE_NODE_ID(bn), ··· 192 217 }; 193 218 rcu_read_unlock(); 194 219 195 - if (bch2_trans_run(c, found_btree_node_is_readable(trans, &n))) { 220 + found_btree_node_to_key(&b->key, &n); 221 + 222 + CLASS(printbuf, buf)(); 223 + if (!bch2_btree_node_read_done(c, ca, b, NULL, &buf)) { 224 + /* read_done will swap out b->data for another buffer */ 225 + bn = b->data; 226 + /* 227 + * Grab journal_seq here because we want the max journal_seq of 228 + * any bset; read_done sorts down to a single set and picks the 229 + * max journal_seq 230 + */ 231 + n.journal_seq = le64_to_cpu(bn->keys.journal_seq), 232 + n.sectors_written = b->written; 233 + 196 234 mutex_lock(&f->lock); 197 235 if (BSET_BIG_ENDIAN(&bn->keys) != CPU_BIG_ENDIAN) { 198 236 bch_err(c, "try_read_btree_node() can't handle endian conversion"); ··· 225 237 struct find_btree_nodes_worker *w = p; 226 238 struct bch_fs *c = container_of(w->f, struct bch_fs, found_btree_nodes); 227 239 struct bch_dev *ca = w->ca; 228 - void *buf = (void *) __get_free_page(GFP_KERNEL); 229 - struct bio *bio = bio_alloc(NULL, 1, 0, GFP_KERNEL); 230 240 unsigned long last_print = jiffies; 241 + struct btree *b = NULL; 242 + struct bio *bio = NULL; 231 243 232 - if (!buf || !bio) { 233 - bch_err(c, "read_btree_nodes_worker: error allocating bio/buf"); 244 + b = __bch2_btree_node_mem_alloc(c); 245 + if (!b) { 246 + bch_err(c, "read_btree_nodes_worker: error allocating buf"); 247 + w->f->ret = -ENOMEM; 248 + goto err; 249 + } 250 + 251 + bio = bio_alloc(NULL, buf_pages(b->data, c->opts.btree_node_size), 0, GFP_KERNEL); 252 + if (!bio) { 253 + bch_err(c, "read_btree_nodes_worker: error allocating bio"); 234 254 w->f->ret = -ENOMEM; 235 255 goto err; 236 256 } ··· 262 266 !bch2_dev_btree_bitmap_marked_sectors(ca, sector, btree_sectors(c))) 263 267 continue; 264 268 265 - try_read_btree_node(w->f, ca, bio, buf, sector); 269 + try_read_btree_node(w->f, ca, b, bio, sector); 266 270 } 267 271 err: 272 + if (b) 273 + __btree_node_data_free(b); 274 + kfree(b); 268 275 bio_put(bio); 269 - free_page((unsigned long) buf); 270 276 enumerated_ref_put(&ca->io_ref[READ], BCH_DEV_READ_REF_btree_node_scan); 271 277 closure_put(w->cl); 272 278 kfree(w);

+9 -2

fs/bcachefs/debug.c

··· 153 153 c->verify_data = __bch2_btree_node_mem_alloc(c); 154 154 if (!c->verify_data) 155 155 goto out; 156 - 157 - list_del_init(&c->verify_data->list); 158 156 } 159 157 160 158 BUG_ON(b->nsets != 1); ··· 584 586 i->ubuf = buf; 585 587 i->size = size; 586 588 i->ret = 0; 589 + 590 + int srcu_idx = srcu_read_lock(&c->btree_trans_barrier); 587 591 restart: 588 592 seqmutex_lock(&c->btree_trans_lock); 589 593 list_sort(&c->btree_trans_list, list_ptr_order_cmp); ··· 598 598 599 599 if (!closure_get_not_zero(&trans->ref)) 600 600 continue; 601 + 602 + if (!trans->srcu_held) { 603 + closure_put(&trans->ref); 604 + continue; 605 + } 601 606 602 607 u32 seq = seqmutex_unlock(&c->btree_trans_lock); 603 608 ··· 625 620 } 626 621 seqmutex_unlock(&c->btree_trans_lock); 627 622 unlocked: 623 + srcu_read_unlock(&c->btree_trans_barrier, srcu_idx); 624 + 628 625 if (i->buf.allocation_failure) 629 626 ret = -ENOMEM; 630 627

-1

fs/bcachefs/errcode.h

··· 282 282 x(EIO, sb_not_downgraded) \ 283 283 x(EIO, btree_node_write_all_failed) \ 284 284 x(EIO, btree_node_read_error) \ 285 - x(EIO, btree_node_read_validate_error) \ 286 285 x(EIO, btree_need_topology_repair) \ 287 286 x(EIO, bucket_ref_update) \ 288 287 x(EIO, trigger_alloc) \

+4 -2

fs/bcachefs/error.c

··· 103 103 return bch_err_throw(c, btree_need_topology_repair); 104 104 } else { 105 105 return bch2_run_explicit_recovery_pass(c, out, BCH_RECOVERY_PASS_check_topology, 0) ?: 106 - bch_err_throw(c, btree_node_read_validate_error); 106 + bch_err_throw(c, btree_need_topology_repair); 107 107 } 108 108 } 109 109 ··· 633 633 * log_fsck_err()s: that would require us to track for every error type 634 634 * which recovery pass corrects it, to get the fsck exit status correct: 635 635 */ 636 - if (bch2_err_matches(ret, BCH_ERR_fsck_fix)) { 636 + if (bch2_err_matches(ret, BCH_ERR_transaction_restart)) { 637 + /* nothing */ 638 + } else if (bch2_err_matches(ret, BCH_ERR_fsck_fix)) { 637 639 set_bit(BCH_FS_errors_fixed, &c->flags); 638 640 } else { 639 641 set_bit(BCH_FS_errors_not_fixed, &c->flags);

+8 -8

fs/bcachefs/extents.c

··· 50 50 struct bch_io_failures *failed) 51 51 { 52 52 static const char * const error_types[] = { 53 - "io", "checksum", "ec reconstruct", NULL 53 + "btree validate", "io", "checksum", "ec reconstruct", NULL 54 54 }; 55 55 56 56 for (struct bch_dev_io_failures *f = failed->devs; 57 57 f < failed->devs + failed->nr; 58 58 f++) { 59 59 unsigned errflags = 60 - ((!!f->failed_io) << 0) | 61 - ((!!f->failed_csum_nr) << 1) | 62 - ((!!f->failed_ec) << 2); 63 - 64 - if (!errflags) 65 - continue; 60 + ((!!f->failed_btree_validate) << 0) | 61 + ((!!f->failed_io) << 1) | 62 + ((!!f->failed_csum_nr) << 2) | 63 + ((!!f->failed_ec) << 3); 66 64 67 65 bch2_printbuf_make_room(out, 1024); 68 66 out->atomic++; ··· 75 77 76 78 prt_char(out, ' '); 77 79 78 - if (is_power_of_2(errflags)) { 80 + if (!errflags) { 81 + prt_str(out, "no error - confused"); 82 + } else if (is_power_of_2(errflags)) { 79 83 prt_bitflags(out, error_types, errflags); 80 84 prt_str(out, " error"); 81 85 } else {

+6 -27

fs/bcachefs/fsck.c

··· 12 12 #include "fs.h" 13 13 #include "fsck.h" 14 14 #include "inode.h" 15 + #include "io_misc.h" 15 16 #include "keylist.h" 16 17 #include "namei.h" 17 18 #include "recovery_passes.h" ··· 1920 1919 "extent type past end of inode %llu:%u, i_size %llu\n%s", 1921 1920 i->inode.bi_inum, i->inode.bi_snapshot, i->inode.bi_size, 1922 1921 (bch2_bkey_val_to_text(&buf, c, k), buf.buf))) { 1923 - struct bkey_i *whiteout = bch2_trans_kmalloc(trans, sizeof(*whiteout)); 1924 - ret = PTR_ERR_OR_ZERO(whiteout); 1925 - if (ret) 1926 - goto err; 1927 - 1928 - bkey_init(&whiteout->k); 1929 - whiteout->k.p = SPOS(k.k->p.inode, 1930 - last_block, 1931 - i->inode.bi_snapshot); 1932 - bch2_key_resize(&whiteout->k, 1933 - min(KEY_SIZE_MAX & (~0 << c->block_bits), 1934 - U64_MAX - whiteout->k.p.offset)); 1935 - 1936 - 1937 - /* 1938 - * Need a normal (not BTREE_ITER_all_snapshots) 1939 - * iterator, if we're deleting in a different 1940 - * snapshot and need to emit a whiteout 1941 - */ 1942 - struct btree_iter iter2; 1943 - bch2_trans_iter_init(trans, &iter2, BTREE_ID_extents, 1944 - bkey_start_pos(&whiteout->k), 1945 - BTREE_ITER_intent); 1946 - ret = bch2_btree_iter_traverse(trans, &iter2) ?: 1947 - bch2_trans_update(trans, &iter2, whiteout, 1948 - BTREE_UPDATE_internal_snapshot_node); 1949 - bch2_trans_iter_exit(trans, &iter2); 1922 + ret = bch2_fpunch_snapshot(trans, 1923 + SPOS(i->inode.bi_inum, 1924 + last_block, 1925 + i->inode.bi_snapshot), 1926 + POS(i->inode.bi_inum, U64_MAX)); 1950 1927 if (ret) 1951 1928 goto err; 1952 1929

+27

fs/bcachefs/io_misc.c

··· 135 135 return ret; 136 136 } 137 137 138 + /* For fsck */ 139 + int bch2_fpunch_snapshot(struct btree_trans *trans, struct bpos start, struct bpos end) 140 + { 141 + u32 restart_count = trans->restart_count; 142 + struct bch_fs *c = trans->c; 143 + struct disk_reservation disk_res = bch2_disk_reservation_init(c, 0); 144 + unsigned max_sectors = KEY_SIZE_MAX & (~0 << c->block_bits); 145 + struct bkey_i delete; 146 + 147 + int ret = for_each_btree_key_max_commit(trans, iter, BTREE_ID_extents, 148 + start, end, 0, k, 149 + &disk_res, NULL, BCH_TRANS_COMMIT_no_enospc, ({ 150 + bkey_init(&delete.k); 151 + delete.k.p = iter.pos; 152 + 153 + /* create the biggest key we can */ 154 + bch2_key_resize(&delete.k, max_sectors); 155 + bch2_cut_back(end, &delete); 156 + 157 + bch2_extent_trim_atomic(trans, &iter, &delete) ?: 158 + bch2_trans_update(trans, &iter, &delete, 0); 159 + })); 160 + 161 + bch2_disk_reservation_put(c, &disk_res); 162 + return ret ?: trans_was_restarted(trans, restart_count); 163 + } 164 + 138 165 /* 139 166 * Returns -BCH_ERR_transacton_restart if we had to drop locks: 140 167 */

+2

fs/bcachefs/io_misc.h

··· 5 5 int bch2_extent_fallocate(struct btree_trans *, subvol_inum, struct btree_iter *, 6 6 u64, struct bch_io_opts, s64 *, 7 7 struct write_point_specifier); 8 + 9 + int bch2_fpunch_snapshot(struct btree_trans *, struct bpos, struct bpos); 8 10 int bch2_fpunch_at(struct btree_trans *, struct btree_iter *, 9 11 subvol_inum, u64, s64 *); 10 12 int bch2_fpunch(struct bch_fs *c, subvol_inum, u64, u64, s64 *);

+6

fs/bcachefs/journal_reclaim.c

··· 170 170 return (struct journal_space) { 0, 0 }; 171 171 172 172 /* 173 + * It's possible for bucket size to be misaligned w.r.t. the filesystem 174 + * block size: 175 + */ 176 + min_bucket_size = round_down(min_bucket_size, block_sectors(c)); 177 + 178 + /* 173 179 * We sorted largest to smallest, and we want the smallest out of the 174 180 * @nr_devs_want largest devices: 175 181 */

+17 -6

fs/bcachefs/recovery.c

··· 273 273 goto out; 274 274 275 275 struct btree_path *path = btree_iter_path(trans, &iter); 276 - if (unlikely(!btree_path_node(path, k->level) && 277 - !k->allocated)) { 276 + if (unlikely(!btree_path_node(path, k->level))) { 278 277 struct bch_fs *c = trans->c; 278 + 279 + CLASS(printbuf, buf)(); 280 + prt_str(&buf, "btree="); 281 + bch2_btree_id_to_text(&buf, k->btree_id); 282 + prt_printf(&buf, " level=%u ", k->level); 283 + bch2_bkey_val_to_text(&buf, c, bkey_i_to_s_c(k->k)); 279 284 280 285 if (!(c->recovery.passes_complete & (BIT_ULL(BCH_RECOVERY_PASS_scan_for_btree_nodes)| 281 286 BIT_ULL(BCH_RECOVERY_PASS_check_topology)))) { 282 - bch_err(c, "have key in journal replay for btree depth that does not exist, confused"); 287 + bch_err(c, "have key in journal replay for btree depth that does not exist, confused\n%s", 288 + buf.buf); 283 289 ret = -EINVAL; 284 290 } 285 - #if 0 291 + 292 + if (!k->allocated) { 293 + bch_notice(c, "dropping key in journal replay for depth that does not exist because we're recovering from scan\n%s", 294 + buf.buf); 295 + k->overwritten = true; 296 + goto out; 297 + } 298 + 286 299 bch2_trans_iter_exit(trans, &iter); 287 300 bch2_trans_node_iter_init(trans, &iter, k->btree_id, k->k->k.p, 288 301 BTREE_MAX_DEPTH, 0, iter_flags); 289 302 ret = bch2_btree_iter_traverse(trans, &iter) ?: 290 303 bch2_btree_increase_depth(trans, iter.path, 0) ?: 291 304 -BCH_ERR_transaction_restart_nested; 292 - #endif 293 - k->overwritten = true; 294 305 goto out; 295 306 } 296 307

+1 -1

fs/bcachefs/recovery_passes.c

··· 360 360 !(r->passes_complete & BIT_ULL(pass)); 361 361 bool ratelimit = flags & RUN_RECOVERY_PASS_ratelimit; 362 362 363 - if (!(in_recovery && (flags & RUN_RECOVERY_PASS_nopersistent))) { 363 + if (!(flags & RUN_RECOVERY_PASS_nopersistent)) { 364 364 struct bch_sb_field_ext *ext = bch2_sb_field_get(c->disk_sb.sb, ext); 365 365 __set_bit_le64(bch2_recovery_pass_to_stable(pass), ext->recovery_passes_required); 366 366 }

+16 -5

fs/erofs/data.c

··· 214 214 215 215 /* 216 216 * bit 30: I/O error occurred on this folio 217 + * bit 29: CPU has dirty data in D-cache (needs aliasing handling); 217 218 * bit 0 - 29: remaining parts to complete this folio 218 219 */ 219 - #define EROFS_ONLINEFOLIO_EIO (1 << 30) 220 + #define EROFS_ONLINEFOLIO_EIO 30 221 + #define EROFS_ONLINEFOLIO_DIRTY 29 220 222 221 223 void erofs_onlinefolio_init(struct folio *folio) 222 224 { ··· 235 233 atomic_inc((atomic_t *)&folio->private); 236 234 } 237 235 238 - void erofs_onlinefolio_end(struct folio *folio, int err) 236 + void erofs_onlinefolio_end(struct folio *folio, int err, bool dirty) 239 237 { 240 238 int orig, v; 241 239 242 240 do { 243 241 orig = atomic_read((atomic_t *)&folio->private); 244 - v = (orig - 1) | (err ? EROFS_ONLINEFOLIO_EIO : 0); 242 + DBG_BUGON(orig <= 0); 243 + v = dirty << EROFS_ONLINEFOLIO_DIRTY; 244 + v |= (orig - 1) | (!!err << EROFS_ONLINEFOLIO_EIO); 245 245 } while (atomic_cmpxchg((atomic_t *)&folio->private, orig, v) != orig); 246 246 247 - if (v & ~EROFS_ONLINEFOLIO_EIO) 247 + if (v & (BIT(EROFS_ONLINEFOLIO_DIRTY) - 1)) 248 248 return; 249 249 folio->private = 0; 250 - folio_end_read(folio, !(v & EROFS_ONLINEFOLIO_EIO)); 250 + if (v & BIT(EROFS_ONLINEFOLIO_DIRTY)) 251 + flush_dcache_folio(folio); 252 + folio_end_read(folio, !(v & BIT(EROFS_ONLINEFOLIO_EIO))); 251 253 } 252 254 253 255 static int erofs_iomap_begin(struct inode *inode, loff_t offset, loff_t length, ··· 357 351 */ 358 352 static int erofs_read_folio(struct file *file, struct folio *folio) 359 353 { 354 + trace_erofs_read_folio(folio, true); 355 + 360 356 return iomap_read_folio(folio, &erofs_iomap_ops); 361 357 } 362 358 363 359 static void erofs_readahead(struct readahead_control *rac) 364 360 { 361 + trace_erofs_readahead(rac->mapping->host, readahead_index(rac), 362 + readahead_count(rac), true); 363 + 365 364 return iomap_readahead(rac, &erofs_iomap_ops); 366 365 } 367 366

+4 -8

fs/erofs/decompressor.c

··· 301 301 cur = min(cur, rq->outputsize); 302 302 if (cur && rq->out[0]) { 303 303 kin = kmap_local_page(rq->in[nrpages_in - 1]); 304 - if (rq->out[0] == rq->in[nrpages_in - 1]) { 304 + if (rq->out[0] == rq->in[nrpages_in - 1]) 305 305 memmove(kin + rq->pageofs_out, kin + pi, cur); 306 - flush_dcache_page(rq->out[0]); 307 - } else { 306 + else 308 307 memcpy_to_page(rq->out[0], rq->pageofs_out, 309 308 kin + pi, cur); 310 - } 311 309 kunmap_local(kin); 312 310 } 313 311 rq->outputsize -= cur; ··· 323 325 po = (rq->pageofs_out + cur + pi) & ~PAGE_MASK; 324 326 DBG_BUGON(no >= nrpages_out); 325 327 cnt = min(insz - pi, PAGE_SIZE - po); 326 - if (rq->out[no] == rq->in[ni]) { 328 + if (rq->out[no] == rq->in[ni]) 327 329 memmove(kin + po, 328 330 kin + rq->pageofs_in + pi, cnt); 329 - flush_dcache_page(rq->out[no]); 330 - } else if (rq->out[no]) { 331 + else if (rq->out[no]) 331 332 memcpy_to_page(rq->out[no], po, 332 333 kin + rq->pageofs_in + pi, cnt); 333 - } 334 334 pi += cnt; 335 335 } while (pi < insz); 336 336 kunmap_local(kin);

+6

fs/erofs/dir.c

··· 58 58 struct erofs_dirent *de; 59 59 unsigned int nameoff, maxsize; 60 60 61 + if (fatal_signal_pending(current)) { 62 + err = -ERESTARTSYS; 63 + break; 64 + } 65 + 61 66 de = erofs_bread(&buf, dbstart, true); 62 67 if (IS_ERR(de)) { 63 68 erofs_err(sb, "failed to readdir of logical block %llu of nid %llu", ··· 93 88 break; 94 89 ctx->pos = dbstart + maxsize; 95 90 ofs = 0; 91 + cond_resched(); 96 92 } 97 93 erofs_put_metabuf(&buf); 98 94 if (EROFS_I(dir)->dot_omitted && ctx->pos == dir->i_size) {

+3 -11

fs/erofs/fileio.c

··· 38 38 } else { 39 39 bio_for_each_folio_all(fi, &rq->bio) { 40 40 DBG_BUGON(folio_test_uptodate(fi.folio)); 41 - erofs_onlinefolio_end(fi.folio, ret); 41 + erofs_onlinefolio_end(fi.folio, ret, false); 42 42 } 43 43 } 44 44 bio_uninit(&rq->bio); ··· 96 96 struct erofs_map_blocks *map = &io->map; 97 97 unsigned int cur = 0, end = folio_size(folio), len, attached = 0; 98 98 loff_t pos = folio_pos(folio), ofs; 99 - struct iov_iter iter; 100 - struct bio_vec bv; 101 99 int err = 0; 102 100 103 101 erofs_onlinefolio_init(folio); ··· 120 122 err = PTR_ERR(src); 121 123 break; 122 124 } 123 - bvec_set_folio(&bv, folio, len, cur); 124 - iov_iter_bvec(&iter, ITER_DEST, &bv, 1, len); 125 - if (copy_to_iter(src, len, &iter) != len) { 126 - erofs_put_metabuf(&buf); 127 - err = -EIO; 128 - break; 129 - } 125 + memcpy_to_folio(folio, cur, src, len); 130 126 erofs_put_metabuf(&buf); 131 127 } else if (!(map->m_flags & EROFS_MAP_MAPPED)) { 132 128 folio_zero_segment(folio, cur, cur + len); ··· 154 162 } 155 163 cur += len; 156 164 } 157 - erofs_onlinefolio_end(folio, err); 165 + erofs_onlinefolio_end(folio, err, false); 158 166 return err; 159 167 } 160 168

+4 -2

fs/erofs/internal.h

··· 315 315 /* The length of extent is full */ 316 316 #define EROFS_MAP_FULL_MAPPED 0x0008 317 317 /* Located in the special packed inode */ 318 - #define EROFS_MAP_FRAGMENT 0x0010 318 + #define __EROFS_MAP_FRAGMENT 0x0010 319 319 /* The extent refers to partial decompressed data */ 320 320 #define EROFS_MAP_PARTIAL_REF 0x0020 321 + 322 + #define EROFS_MAP_FRAGMENT (EROFS_MAP_MAPPED | __EROFS_MAP_FRAGMENT) 321 323 322 324 struct erofs_map_blocks { 323 325 struct erofs_buf buf; ··· 392 390 int erofs_map_blocks(struct inode *inode, struct erofs_map_blocks *map); 393 391 void erofs_onlinefolio_init(struct folio *folio); 394 392 void erofs_onlinefolio_split(struct folio *folio); 395 - void erofs_onlinefolio_end(struct folio *folio, int err); 393 + void erofs_onlinefolio_end(struct folio *folio, int err, bool dirty); 396 394 struct inode *erofs_iget(struct super_block *sb, erofs_nid_t nid); 397 395 int erofs_getattr(struct mnt_idmap *idmap, const struct path *path, 398 396 struct kstat *stat, u32 request_mask,

+4 -4

fs/erofs/zdata.c

··· 1034 1034 if (!(map->m_flags & EROFS_MAP_MAPPED)) { 1035 1035 folio_zero_segment(folio, cur, end); 1036 1036 tight = false; 1037 - } else if (map->m_flags & EROFS_MAP_FRAGMENT) { 1037 + } else if (map->m_flags & __EROFS_MAP_FRAGMENT) { 1038 1038 erofs_off_t fpos = offset + cur - map->m_la; 1039 1039 1040 1040 err = z_erofs_read_fragment(inode->i_sb, folio, cur, ··· 1091 1091 tight = (bs == PAGE_SIZE); 1092 1092 } 1093 1093 } while ((end = cur) > 0); 1094 - erofs_onlinefolio_end(folio, err); 1094 + erofs_onlinefolio_end(folio, err, false); 1095 1095 return err; 1096 1096 } 1097 1097 ··· 1196 1196 cur += len; 1197 1197 } 1198 1198 kunmap_local(dst); 1199 - erofs_onlinefolio_end(page_folio(bvi->bvec.page), err); 1199 + erofs_onlinefolio_end(page_folio(bvi->bvec.page), err, true); 1200 1200 list_del(p); 1201 1201 kfree(bvi); 1202 1202 } ··· 1355 1355 1356 1356 DBG_BUGON(z_erofs_page_is_invalidated(page)); 1357 1357 if (!z_erofs_is_shortlived_page(page)) { 1358 - erofs_onlinefolio_end(page_folio(page), err); 1358 + erofs_onlinefolio_end(page_folio(page), err, true); 1359 1359 continue; 1360 1360 } 1361 1361 if (pcl->algorithmformat != Z_EROFS_COMPRESSION_LZ4) {

+4 -5

fs/erofs/zmap.c

··· 413 413 !vi->z_tailextent_headlcn) { 414 414 map->m_la = 0; 415 415 map->m_llen = inode->i_size; 416 - map->m_flags = EROFS_MAP_MAPPED | 417 - EROFS_MAP_FULL_MAPPED | EROFS_MAP_FRAGMENT; 416 + map->m_flags = EROFS_MAP_FRAGMENT; 418 417 return 0; 419 418 } 420 419 initial_lcn = ofs >> lclusterbits; ··· 488 489 goto unmap_out; 489 490 } 490 491 } else if (fragment && m.lcn == vi->z_tailextent_headlcn) { 491 - map->m_flags |= EROFS_MAP_FRAGMENT; 492 + map->m_flags = EROFS_MAP_FRAGMENT; 492 493 } else { 493 494 map->m_pa = erofs_pos(sb, m.pblk); 494 495 err = z_erofs_get_extent_compressedlen(&m, initial_lcn); ··· 616 617 if (lstart < lend) { 617 618 map->m_la = lstart; 618 619 if (last && (vi->z_advise & Z_EROFS_ADVISE_FRAGMENT_PCLUSTER)) { 619 - map->m_flags |= EROFS_MAP_MAPPED | EROFS_MAP_FRAGMENT; 620 + map->m_flags = EROFS_MAP_FRAGMENT; 620 621 vi->z_fragmentoff = map->m_plen; 621 622 if (recsz > offsetof(struct z_erofs_extent, pstart_lo)) 622 623 vi->z_fragmentoff |= map->m_pa << 32; ··· 796 797 iomap->length = map.m_llen; 797 798 if (map.m_flags & EROFS_MAP_MAPPED) { 798 799 iomap->type = IOMAP_MAPPED; 799 - iomap->addr = map.m_flags & EROFS_MAP_FRAGMENT ? 800 + iomap->addr = map.m_flags & __EROFS_MAP_FRAGMENT ? 800 801 IOMAP_NULL_ADDR : map.m_pa; 801 802 } else { 802 803 iomap->type = IOMAP_HOLE;

+324 -134

fs/eventpoll.c

··· 137 137 }; 138 138 139 139 /* List header used to link this structure to the eventpoll ready list */ 140 - struct llist_node rdllink; 140 + struct list_head rdllink; 141 + 142 + /* 143 + * Works together "struct eventpoll"->ovflist in keeping the 144 + * single linked chain of items. 145 + */ 146 + struct epitem *next; 141 147 142 148 /* The file descriptor information this item refers to */ 143 149 struct epoll_filefd ffd; ··· 191 185 /* Wait queue used by file->poll() */ 192 186 wait_queue_head_t poll_wait; 193 187 194 - /* 195 - * List of ready file descriptors. Adding to this list is lockless. Items can be removed 196 - * only with eventpoll::mtx 197 - */ 198 - struct llist_head rdllist; 188 + /* List of ready file descriptors */ 189 + struct list_head rdllist; 190 + 191 + /* Lock which protects rdllist and ovflist */ 192 + rwlock_t lock; 199 193 200 194 /* RB tree root used to store monitored fd structs */ 201 195 struct rb_root_cached rbr; 196 + 197 + /* 198 + * This is a single linked list that chains all the "struct epitem" that 199 + * happened while transferring ready events to userspace w/out 200 + * holding ->lock. 201 + */ 202 + struct epitem *ovflist; 202 203 203 204 /* wakeup_source used when ep_send_events or __ep_eventpoll_poll is running */ 204 205 struct wakeup_source *ws; ··· 361 348 (p1->file < p2->file ? -1 : p1->fd - p2->fd)); 362 349 } 363 350 364 - /* 365 - * Add the item to its container eventpoll's rdllist; do nothing if the item is already on rdllist. 366 - */ 367 - static void epitem_ready(struct epitem *epi) 351 + /* Tells us if the item is currently linked */ 352 + static inline int ep_is_linked(struct epitem *epi) 368 353 { 369 - if (&epi->rdllink == cmpxchg(&epi->rdllink.next, &epi->rdllink, NULL)) 370 - llist_add(&epi->rdllink, &epi->ep->rdllist); 371 - 354 + return !list_empty(&epi->rdllink); 372 355 } 373 356 374 357 static inline struct eppoll_entry *ep_pwq_from_wait(wait_queue_entry_t *p) ··· 383 374 * 384 375 * @ep: Pointer to the eventpoll context. 385 376 * 386 - * Return: true if ready events might be available, false otherwise. 377 + * Return: a value different than %zero if ready events are available, 378 + * or %zero otherwise. 387 379 */ 388 - static inline bool ep_events_available(struct eventpoll *ep) 380 + static inline int ep_events_available(struct eventpoll *ep) 389 381 { 390 - bool available; 391 - int locked; 392 - 393 - locked = mutex_trylock(&ep->mtx); 394 - if (!locked) { 395 - /* 396 - * The lock held and someone might have removed all items while inspecting it. The 397 - * llist_empty() check in this case is futile. Assume that something is enqueued and 398 - * let ep_try_send_events() figure it out. 399 - */ 400 - return true; 401 - } 402 - 403 - available = !llist_empty(&ep->rdllist); 404 - mutex_unlock(&ep->mtx); 405 - return available; 382 + return !list_empty_careful(&ep->rdllist) || 383 + READ_ONCE(ep->ovflist) != EP_UNACTIVE_PTR; 406 384 } 407 385 408 386 #ifdef CONFIG_NET_RX_BUSY_POLL ··· 724 728 rcu_read_unlock(); 725 729 } 726 730 731 + 732 + /* 733 + * ep->mutex needs to be held because we could be hit by 734 + * eventpoll_release_file() and epoll_ctl(). 735 + */ 736 + static void ep_start_scan(struct eventpoll *ep, struct list_head *txlist) 737 + { 738 + /* 739 + * Steal the ready list, and re-init the original one to the 740 + * empty list. Also, set ep->ovflist to NULL so that events 741 + * happening while looping w/out locks, are not lost. We cannot 742 + * have the poll callback to queue directly on ep->rdllist, 743 + * because we want the "sproc" callback to be able to do it 744 + * in a lockless way. 745 + */ 746 + lockdep_assert_irqs_enabled(); 747 + write_lock_irq(&ep->lock); 748 + list_splice_init(&ep->rdllist, txlist); 749 + WRITE_ONCE(ep->ovflist, NULL); 750 + write_unlock_irq(&ep->lock); 751 + } 752 + 753 + static void ep_done_scan(struct eventpoll *ep, 754 + struct list_head *txlist) 755 + { 756 + struct epitem *epi, *nepi; 757 + 758 + write_lock_irq(&ep->lock); 759 + /* 760 + * During the time we spent inside the "sproc" callback, some 761 + * other events might have been queued by the poll callback. 762 + * We re-insert them inside the main ready-list here. 763 + */ 764 + for (nepi = READ_ONCE(ep->ovflist); (epi = nepi) != NULL; 765 + nepi = epi->next, epi->next = EP_UNACTIVE_PTR) { 766 + /* 767 + * We need to check if the item is already in the list. 768 + * During the "sproc" callback execution time, items are 769 + * queued into ->ovflist but the "txlist" might already 770 + * contain them, and the list_splice() below takes care of them. 771 + */ 772 + if (!ep_is_linked(epi)) { 773 + /* 774 + * ->ovflist is LIFO, so we have to reverse it in order 775 + * to keep in FIFO. 776 + */ 777 + list_add(&epi->rdllink, &ep->rdllist); 778 + ep_pm_stay_awake(epi); 779 + } 780 + } 781 + /* 782 + * We need to set back ep->ovflist to EP_UNACTIVE_PTR, so that after 783 + * releasing the lock, events will be queued in the normal way inside 784 + * ep->rdllist. 785 + */ 786 + WRITE_ONCE(ep->ovflist, EP_UNACTIVE_PTR); 787 + 788 + /* 789 + * Quickly re-inject items left on "txlist". 790 + */ 791 + list_splice(txlist, &ep->rdllist); 792 + __pm_relax(ep->ws); 793 + 794 + if (!list_empty(&ep->rdllist)) { 795 + if (waitqueue_active(&ep->wq)) 796 + wake_up(&ep->wq); 797 + } 798 + 799 + write_unlock_irq(&ep->lock); 800 + } 801 + 727 802 static void ep_get(struct eventpoll *ep) 728 803 { 729 804 refcount_inc(&ep->refcount); ··· 832 765 static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) 833 766 { 834 767 struct file *file = epi->ffd.file; 835 - struct llist_node *put_back_last; 836 768 struct epitems_head *to_free; 837 769 struct hlist_head *head; 838 - LLIST_HEAD(put_back); 839 770 840 - lockdep_assert_held(&ep->mtx); 771 + lockdep_assert_irqs_enabled(); 841 772 842 773 /* 843 774 * Removes poll wait queue hooks. ··· 867 802 868 803 rb_erase_cached(&epi->rbn, &ep->rbr); 869 804 870 - if (llist_on_list(&epi->rdllink)) { 871 - put_back_last = NULL; 872 - while (true) { 873 - struct llist_node *n = llist_del_first(&ep->rdllist); 874 - 875 - if (&epi->rdllink == n || WARN_ON(!n)) 876 - break; 877 - if (!put_back_last) 878 - put_back_last = n; 879 - __llist_add(n, &put_back); 880 - } 881 - if (put_back_last) 882 - llist_add_batch(put_back.first, put_back_last, &ep->rdllist); 883 - } 805 + write_lock_irq(&ep->lock); 806 + if (ep_is_linked(epi)) 807 + list_del_init(&epi->rdllink); 808 + write_unlock_irq(&ep->lock); 884 809 885 810 wakeup_source_unregister(ep_wakeup_source(epi)); 886 811 /* ··· 972 917 static __poll_t __ep_eventpoll_poll(struct file *file, poll_table *wait, int depth) 973 918 { 974 919 struct eventpoll *ep = file->private_data; 975 - struct wakeup_source *ws; 976 - struct llist_node *n; 977 - struct epitem *epi; 920 + LIST_HEAD(txlist); 921 + struct epitem *epi, *tmp; 978 922 poll_table pt; 979 923 __poll_t res = 0; 980 924 ··· 987 933 * the ready list. 988 934 */ 989 935 mutex_lock_nested(&ep->mtx, depth); 990 - while (true) { 991 - n = llist_del_first_init(&ep->rdllist); 992 - if (!n) 993 - break; 994 - 995 - epi = llist_entry(n, struct epitem, rdllink); 996 - 936 + ep_start_scan(ep, &txlist); 937 + list_for_each_entry_safe(epi, tmp, &txlist, rdllink) { 997 938 if (ep_item_poll(epi, &pt, depth + 1)) { 998 939 res = EPOLLIN | EPOLLRDNORM; 999 - epitem_ready(epi); 1000 940 break; 1001 941 } else { 1002 942 /* 1003 - * We need to activate ep before deactivating epi, to prevent autosuspend 1004 - * just in case epi becomes active after ep_item_poll() above. 1005 - * 1006 - * This is similar to ep_send_events(). 943 + * Item has been dropped into the ready list by the poll 944 + * callback, but it's not actually ready, as far as 945 + * caller requested events goes. We can remove it here. 1007 946 */ 1008 - ws = ep_wakeup_source(epi); 1009 - if (ws) { 1010 - if (ws->active) 1011 - __pm_stay_awake(ep->ws); 1012 - __pm_relax(ws); 1013 - } 1014 947 __pm_relax(ep_wakeup_source(epi)); 1015 - 1016 - /* Just in case epi becomes active right before __pm_relax() */ 1017 - if (unlikely(ep_item_poll(epi, &pt, depth + 1))) 1018 - ep_pm_stay_awake(epi); 1019 - 1020 - __pm_relax(ep->ws); 948 + list_del_init(&epi->rdllink); 1021 949 } 1022 950 } 951 + ep_done_scan(ep, &txlist); 1023 952 mutex_unlock(&ep->mtx); 1024 953 return res; 1025 954 } ··· 1151 1114 return -ENOMEM; 1152 1115 1153 1116 mutex_init(&ep->mtx); 1117 + rwlock_init(&ep->lock); 1154 1118 init_waitqueue_head(&ep->wq); 1155 1119 init_waitqueue_head(&ep->poll_wait); 1156 - init_llist_head(&ep->rdllist); 1120 + INIT_LIST_HEAD(&ep->rdllist); 1157 1121 ep->rbr = RB_ROOT_CACHED; 1122 + ep->ovflist = EP_UNACTIVE_PTR; 1158 1123 ep->user = get_current_user(); 1159 1124 refcount_set(&ep->refcount, 1); 1160 1125 ··· 1239 1200 #endif /* CONFIG_KCMP */ 1240 1201 1241 1202 /* 1203 + * Adds a new entry to the tail of the list in a lockless way, i.e. 1204 + * multiple CPUs are allowed to call this function concurrently. 1205 + * 1206 + * Beware: it is necessary to prevent any other modifications of the 1207 + * existing list until all changes are completed, in other words 1208 + * concurrent list_add_tail_lockless() calls should be protected 1209 + * with a read lock, where write lock acts as a barrier which 1210 + * makes sure all list_add_tail_lockless() calls are fully 1211 + * completed. 1212 + * 1213 + * Also an element can be locklessly added to the list only in one 1214 + * direction i.e. either to the tail or to the head, otherwise 1215 + * concurrent access will corrupt the list. 1216 + * 1217 + * Return: %false if element has been already added to the list, %true 1218 + * otherwise. 1219 + */ 1220 + static inline bool list_add_tail_lockless(struct list_head *new, 1221 + struct list_head *head) 1222 + { 1223 + struct list_head *prev; 1224 + 1225 + /* 1226 + * This is simple 'new->next = head' operation, but cmpxchg() 1227 + * is used in order to detect that same element has been just 1228 + * added to the list from another CPU: the winner observes 1229 + * new->next == new. 1230 + */ 1231 + if (!try_cmpxchg(&new->next, &new, head)) 1232 + return false; 1233 + 1234 + /* 1235 + * Initially ->next of a new element must be updated with the head 1236 + * (we are inserting to the tail) and only then pointers are atomically 1237 + * exchanged. XCHG guarantees memory ordering, thus ->next should be 1238 + * updated before pointers are actually swapped and pointers are 1239 + * swapped before prev->next is updated. 1240 + */ 1241 + 1242 + prev = xchg(&head->prev, new); 1243 + 1244 + /* 1245 + * It is safe to modify prev->next and new->prev, because a new element 1246 + * is added only to the tail and new->next is updated before XCHG. 1247 + */ 1248 + 1249 + prev->next = new; 1250 + new->prev = prev; 1251 + 1252 + return true; 1253 + } 1254 + 1255 + /* 1256 + * Chains a new epi entry to the tail of the ep->ovflist in a lockless way, 1257 + * i.e. multiple CPUs are allowed to call this function concurrently. 1258 + * 1259 + * Return: %false if epi element has been already chained, %true otherwise. 1260 + */ 1261 + static inline bool chain_epi_lockless(struct epitem *epi) 1262 + { 1263 + struct eventpoll *ep = epi->ep; 1264 + 1265 + /* Fast preliminary check */ 1266 + if (epi->next != EP_UNACTIVE_PTR) 1267 + return false; 1268 + 1269 + /* Check that the same epi has not been just chained from another CPU */ 1270 + if (cmpxchg(&epi->next, EP_UNACTIVE_PTR, NULL) != EP_UNACTIVE_PTR) 1271 + return false; 1272 + 1273 + /* Atomically exchange tail */ 1274 + epi->next = xchg(&ep->ovflist, epi); 1275 + 1276 + return true; 1277 + } 1278 + 1279 + /* 1242 1280 * This is the callback that is passed to the wait queue wakeup 1243 1281 * mechanism. It is called by the stored file descriptors when they 1244 1282 * have events to report. 1283 + * 1284 + * This callback takes a read lock in order not to contend with concurrent 1285 + * events from another file descriptor, thus all modifications to ->rdllist 1286 + * or ->ovflist are lockless. Read lock is paired with the write lock from 1287 + * ep_start/done_scan(), which stops all list modifications and guarantees 1288 + * that lists state is seen correctly. 1245 1289 * 1246 1290 * Another thing worth to mention is that ep_poll_callback() can be called 1247 1291 * concurrently for the same @epi from different CPUs if poll table was inited ··· 1335 1213 */ 1336 1214 static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, void *key) 1337 1215 { 1216 + int pwake = 0; 1338 1217 struct epitem *epi = ep_item_from_wait(wait); 1339 1218 struct eventpoll *ep = epi->ep; 1340 1219 __poll_t pollflags = key_to_poll(key); 1220 + unsigned long flags; 1341 1221 int ewake = 0; 1222 + 1223 + read_lock_irqsave(&ep->lock, flags); 1342 1224 1343 1225 ep_set_busy_poll_napi_id(epi); 1344 1226 ··· 1353 1227 * until the next EPOLL_CTL_MOD will be issued. 1354 1228 */ 1355 1229 if (!(epi->event.events & ~EP_PRIVATE_BITS)) 1356 - goto out; 1230 + goto out_unlock; 1357 1231 1358 1232 /* 1359 1233 * Check the events coming with the callback. At this stage, not ··· 1362 1236 * test for "key" != NULL before the event match test. 1363 1237 */ 1364 1238 if (pollflags && !(pollflags & epi->event.events)) 1365 - goto out; 1239 + goto out_unlock; 1366 1240 1367 - ep_pm_stay_awake_rcu(epi); 1368 - epitem_ready(epi); 1241 + /* 1242 + * If we are transferring events to userspace, we can hold no locks 1243 + * (because we're accessing user memory, and because of linux f_op->poll() 1244 + * semantics). All the events that happen during that period of time are 1245 + * chained in ep->ovflist and requeued later on. 1246 + */ 1247 + if (READ_ONCE(ep->ovflist) != EP_UNACTIVE_PTR) { 1248 + if (chain_epi_lockless(epi)) 1249 + ep_pm_stay_awake_rcu(epi); 1250 + } else if (!ep_is_linked(epi)) { 1251 + /* In the usual case, add event to ready list. */ 1252 + if (list_add_tail_lockless(&epi->rdllink, &ep->rdllist)) 1253 + ep_pm_stay_awake_rcu(epi); 1254 + } 1369 1255 1370 1256 /* 1371 1257 * Wake up ( if active ) both the eventpoll wait list and the ->poll() ··· 1406 1268 wake_up(&ep->wq); 1407 1269 } 1408 1270 if (waitqueue_active(&ep->poll_wait)) 1271 + pwake++; 1272 + 1273 + out_unlock: 1274 + read_unlock_irqrestore(&ep->lock, flags); 1275 + 1276 + /* We have to call this outside the lock */ 1277 + if (pwake) 1409 1278 ep_poll_safewake(ep, epi, pollflags & EPOLL_URING_WAKE); 1410 1279 1411 - out: 1412 1280 if (!(epi->event.events & EPOLLEXCLUSIVE)) 1413 1281 ewake = 1; 1414 1282 ··· 1659 1515 if (is_file_epoll(tfile)) 1660 1516 tep = tfile->private_data; 1661 1517 1518 + lockdep_assert_irqs_enabled(); 1519 + 1662 1520 if (unlikely(percpu_counter_compare(&ep->user->epoll_watches, 1663 1521 max_user_watches) >= 0)) 1664 1522 return -ENOSPC; ··· 1672 1526 } 1673 1527 1674 1528 /* Item initialization follow here ... */ 1675 - init_llist_node(&epi->rdllink); 1529 + INIT_LIST_HEAD(&epi->rdllink); 1676 1530 epi->ep = ep; 1677 1531 ep_set_ffd(&epi->ffd, tfile, fd); 1678 1532 epi->event = *event; 1533 + epi->next = EP_UNACTIVE_PTR; 1679 1534 1680 1535 if (tep) 1681 1536 mutex_lock_nested(&tep->mtx, 1); ··· 1743 1596 return -ENOMEM; 1744 1597 } 1745 1598 1599 + /* We have to drop the new item inside our item list to keep track of it */ 1600 + write_lock_irq(&ep->lock); 1601 + 1746 1602 /* record NAPI ID of new item if present */ 1747 1603 ep_set_busy_poll_napi_id(epi); 1748 1604 1749 1605 /* If the file is already "ready" we drop it inside the ready list */ 1750 - if (revents) { 1606 + if (revents && !ep_is_linked(epi)) { 1607 + list_add_tail(&epi->rdllink, &ep->rdllist); 1751 1608 ep_pm_stay_awake(epi); 1752 - epitem_ready(epi); 1753 1609 1754 1610 /* Notify waiting tasks that events are available */ 1755 1611 if (waitqueue_active(&ep->wq)) ··· 1760 1610 if (waitqueue_active(&ep->poll_wait)) 1761 1611 pwake++; 1762 1612 } 1613 + 1614 + write_unlock_irq(&ep->lock); 1763 1615 1764 1616 /* We have to call this outside the lock */ 1765 1617 if (pwake) ··· 1777 1625 static int ep_modify(struct eventpoll *ep, struct epitem *epi, 1778 1626 const struct epoll_event *event) 1779 1627 { 1628 + int pwake = 0; 1780 1629 poll_table pt; 1630 + 1631 + lockdep_assert_irqs_enabled(); 1781 1632 1782 1633 init_poll_funcptr(&pt, NULL); 1783 1634 ··· 1825 1670 * list, push it inside. 1826 1671 */ 1827 1672 if (ep_item_poll(epi, &pt, 1)) { 1828 - ep_pm_stay_awake(epi); 1829 - epitem_ready(epi); 1673 + write_lock_irq(&ep->lock); 1674 + if (!ep_is_linked(epi)) { 1675 + list_add_tail(&epi->rdllink, &ep->rdllist); 1676 + ep_pm_stay_awake(epi); 1830 1677 1831 - /* Notify waiting tasks that events are available */ 1832 - if (waitqueue_active(&ep->wq)) 1833 - wake_up(&ep->wq); 1834 - if (waitqueue_active(&ep->poll_wait)) 1835 - ep_poll_safewake(ep, NULL, 0); 1678 + /* Notify waiting tasks that events are available */ 1679 + if (waitqueue_active(&ep->wq)) 1680 + wake_up(&ep->wq); 1681 + if (waitqueue_active(&ep->poll_wait)) 1682 + pwake++; 1683 + } 1684 + write_unlock_irq(&ep->lock); 1836 1685 } 1686 + 1687 + /* We have to call this outside the lock */ 1688 + if (pwake) 1689 + ep_poll_safewake(ep, NULL, 0); 1837 1690 1838 1691 return 0; 1839 1692 } ··· 1850 1687 struct epoll_event __user *events, int maxevents) 1851 1688 { 1852 1689 struct epitem *epi, *tmp; 1853 - LLIST_HEAD(txlist); 1690 + LIST_HEAD(txlist); 1854 1691 poll_table pt; 1855 1692 int res = 0; 1856 1693 ··· 1865 1702 init_poll_funcptr(&pt, NULL); 1866 1703 1867 1704 mutex_lock(&ep->mtx); 1705 + ep_start_scan(ep, &txlist); 1868 1706 1869 - while (res < maxevents) { 1707 + /* 1708 + * We can loop without lock because we are passed a task private list. 1709 + * Items cannot vanish during the loop we are holding ep->mtx. 1710 + */ 1711 + list_for_each_entry_safe(epi, tmp, &txlist, rdllink) { 1870 1712 struct wakeup_source *ws; 1871 - struct llist_node *n; 1872 1713 __poll_t revents; 1873 1714 1874 - n = llist_del_first(&ep->rdllist); 1875 - if (!n) 1715 + if (res >= maxevents) 1876 1716 break; 1877 - 1878 - epi = llist_entry(n, struct epitem, rdllink); 1879 1717 1880 1718 /* 1881 1719 * Activate ep->ws before deactivating epi->ws to prevent ··· 1894 1730 __pm_relax(ws); 1895 1731 } 1896 1732 1733 + list_del_init(&epi->rdllink); 1734 + 1897 1735 /* 1898 1736 * If the event mask intersect the caller-requested one, 1899 1737 * deliver the event to userspace. Again, we are holding ep->mtx, 1900 1738 * so no operations coming from userspace can change the item. 1901 1739 */ 1902 1740 revents = ep_item_poll(epi, &pt, 1); 1903 - if (!revents) { 1904 - init_llist_node(n); 1905 - 1906 - /* 1907 - * Just in case epi becomes ready after ep_item_poll() above, but before 1908 - * init_llist_node(). Make sure to add it to the ready list, otherwise an 1909 - * event may be lost. 1910 - */ 1911 - if (unlikely(ep_item_poll(epi, &pt, 1))) { 1912 - ep_pm_stay_awake(epi); 1913 - epitem_ready(epi); 1914 - } 1741 + if (!revents) 1915 1742 continue; 1916 - } 1917 1743 1918 1744 events = epoll_put_uevent(revents, epi->event.data, events); 1919 1745 if (!events) { 1920 - llist_add(&epi->rdllink, &ep->rdllist); 1746 + list_add(&epi->rdllink, &txlist); 1747 + ep_pm_stay_awake(epi); 1921 1748 if (!res) 1922 1749 res = -EFAULT; 1923 1750 break; ··· 1916 1761 res++; 1917 1762 if (epi->event.events & EPOLLONESHOT) 1918 1763 epi->event.events &= EP_PRIVATE_BITS; 1919 - __llist_add(n, &txlist); 1920 - } 1921 - 1922 - llist_for_each_entry_safe(epi, tmp, txlist.first, rdllink) { 1923 - init_llist_node(&epi->rdllink); 1924 - 1925 - if (!(epi->event.events & EPOLLET)) { 1764 + else if (!(epi->event.events & EPOLLET)) { 1926 1765 /* 1927 - * If this file has been added with Level Trigger mode, we need to insert 1928 - * back inside the ready list, so that the next call to epoll_wait() will 1929 - * check again the events availability. 1766 + * If this file has been added with Level 1767 + * Trigger mode, we need to insert back inside 1768 + * the ready list, so that the next call to 1769 + * epoll_wait() will check again the events 1770 + * availability. At this point, no one can insert 1771 + * into ep->rdllist besides us. The epoll_ctl() 1772 + * callers are locked out by 1773 + * ep_send_events() holding "mtx" and the 1774 + * poll callback will queue them in ep->ovflist. 1930 1775 */ 1776 + list_add_tail(&epi->rdllink, &ep->rdllist); 1931 1777 ep_pm_stay_awake(epi); 1932 - epitem_ready(epi); 1933 1778 } 1934 1779 } 1935 - 1936 - __pm_relax(ep->ws); 1780 + ep_done_scan(ep, &txlist); 1937 1781 mutex_unlock(&ep->mtx); 1938 - 1939 - if (!llist_empty(&ep->rdllist)) { 1940 - if (waitqueue_active(&ep->wq)) 1941 - wake_up(&ep->wq); 1942 - } 1943 1782 1944 1783 return res; 1945 1784 } ··· 2027 1878 wait_queue_entry_t wait; 2028 1879 ktime_t expires, *to = NULL; 2029 1880 1881 + lockdep_assert_irqs_enabled(); 1882 + 2030 1883 if (timeout && (timeout->tv_sec | timeout->tv_nsec)) { 2031 1884 slack = select_estimate_accuracy(timeout); 2032 1885 to = &expires; ··· 2088 1937 init_wait(&wait); 2089 1938 wait.func = ep_autoremove_wake_function; 2090 1939 2091 - prepare_to_wait_exclusive(&ep->wq, &wait, TASK_INTERRUPTIBLE); 1940 + write_lock_irq(&ep->lock); 1941 + /* 1942 + * Barrierless variant, waitqueue_active() is called under 1943 + * the same lock on wakeup ep_poll_callback() side, so it 1944 + * is safe to avoid an explicit barrier. 1945 + */ 1946 + __set_current_state(TASK_INTERRUPTIBLE); 2092 1947 2093 - if (!ep_events_available(ep)) 1948 + /* 1949 + * Do the final check under the lock. ep_start/done_scan() 1950 + * plays with two lists (->rdllist and ->ovflist) and there 1951 + * is always a race when both lists are empty for short 1952 + * period of time although events are pending, so lock is 1953 + * important. 1954 + */ 1955 + eavail = ep_events_available(ep); 1956 + if (!eavail) 1957 + __add_wait_queue_exclusive(&ep->wq, &wait); 1958 + 1959 + write_unlock_irq(&ep->lock); 1960 + 1961 + if (!eavail) 2094 1962 timed_out = !ep_schedule_timeout(to) || 2095 1963 !schedule_hrtimeout_range(to, slack, 2096 1964 HRTIMER_MODE_ABS); 1965 + __set_current_state(TASK_RUNNING); 2097 1966 2098 - finish_wait(&ep->wq, &wait); 2099 - eavail = ep_events_available(ep); 1967 + /* 1968 + * We were woken up, thus go and try to harvest some events. 1969 + * If timed out and still on the wait queue, recheck eavail 1970 + * carefully under lock, below. 1971 + */ 1972 + eavail = 1; 1973 + 1974 + if (!list_empty_careful(&wait.entry)) { 1975 + write_lock_irq(&ep->lock); 1976 + /* 1977 + * If the thread timed out and is not on the wait queue, 1978 + * it means that the thread was woken up after its 1979 + * timeout expired before it could reacquire the lock. 1980 + * Thus, when wait.entry is empty, it needs to harvest 1981 + * events. 1982 + */ 1983 + if (timed_out) 1984 + eavail = list_empty(&wait.entry); 1985 + __remove_wait_queue(&ep->wq, &wait); 1986 + write_unlock_irq(&ep->lock); 1987 + } 2100 1988 } 2101 1989 } 2102 1990

+7 -7

fs/proc/task_mmu.c

··· 36 36 unsigned long text, lib, swap, anon, file, shmem; 37 37 unsigned long hiwater_vm, total_vm, hiwater_rss, total_rss; 38 38 39 - anon = get_mm_counter(mm, MM_ANONPAGES); 40 - file = get_mm_counter(mm, MM_FILEPAGES); 41 - shmem = get_mm_counter(mm, MM_SHMEMPAGES); 39 + anon = get_mm_counter_sum(mm, MM_ANONPAGES); 40 + file = get_mm_counter_sum(mm, MM_FILEPAGES); 41 + shmem = get_mm_counter_sum(mm, MM_SHMEMPAGES); 42 42 43 43 /* 44 44 * Note: to minimize their overhead, mm maintains hiwater_vm and ··· 59 59 text = min(text, mm->exec_vm << PAGE_SHIFT); 60 60 lib = (mm->exec_vm << PAGE_SHIFT) - text; 61 61 62 - swap = get_mm_counter(mm, MM_SWAPENTS); 62 + swap = get_mm_counter_sum(mm, MM_SWAPENTS); 63 63 SEQ_PUT_DEC("VmPeak:\t", hiwater_vm); 64 64 SEQ_PUT_DEC(" kB\nVmSize:\t", total_vm); 65 65 SEQ_PUT_DEC(" kB\nVmLck:\t", mm->locked_vm); ··· 92 92 unsigned long *shared, unsigned long *text, 93 93 unsigned long *data, unsigned long *resident) 94 94 { 95 - *shared = get_mm_counter(mm, MM_FILEPAGES) + 96 - get_mm_counter(mm, MM_SHMEMPAGES); 95 + *shared = get_mm_counter_sum(mm, MM_FILEPAGES) + 96 + get_mm_counter_sum(mm, MM_SHMEMPAGES); 97 97 *text = (PAGE_ALIGN(mm->end_code) - (mm->start_code & PAGE_MASK)) 98 98 >> PAGE_SHIFT; 99 99 *data = mm->data_vm + mm->stack_vm; 100 - *resident = *shared + get_mm_counter(mm, MM_ANONPAGES); 100 + *resident = *shared + get_mm_counter_sum(mm, MM_ANONPAGES); 101 101 return mm->total_vm; 102 102 } 103 103

+9 -20

fs/smb/server/smb2pdu.c

··· 8573 8573 goto err_out; 8574 8574 } 8575 8575 8576 - opinfo->op_state = OPLOCK_STATE_NONE; 8577 - wake_up_interruptible_all(&opinfo->oplock_q); 8578 - opinfo_put(opinfo); 8579 - ksmbd_fd_put(work, fp); 8580 - 8581 8576 rsp->StructureSize = cpu_to_le16(24); 8582 8577 rsp->OplockLevel = rsp_oplevel; 8583 8578 rsp->Reserved = 0; ··· 8580 8585 rsp->VolatileFid = volatile_id; 8581 8586 rsp->PersistentFid = persistent_id; 8582 8587 ret = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_oplock_break)); 8583 - if (!ret) 8584 - return; 8585 - 8588 + if (ret) { 8586 8589 err_out: 8590 + smb2_set_err_rsp(work); 8591 + } 8592 + 8587 8593 opinfo->op_state = OPLOCK_STATE_NONE; 8588 8594 wake_up_interruptible_all(&opinfo->oplock_q); 8589 - 8590 8595 opinfo_put(opinfo); 8591 8596 ksmbd_fd_put(work, fp); 8592 - smb2_set_err_rsp(work); 8593 8597 } 8594 8598 8595 8599 static int check_lease_state(struct lease *lease, __le32 req_state) ··· 8718 8724 } 8719 8725 8720 8726 lease_state = lease->state; 8721 - opinfo->op_state = OPLOCK_STATE_NONE; 8722 - wake_up_interruptible_all(&opinfo->oplock_q); 8723 - atomic_dec(&opinfo->breaking_cnt); 8724 - wake_up_interruptible_all(&opinfo->oplock_brk); 8725 - opinfo_put(opinfo); 8726 8727 8727 8728 rsp->StructureSize = cpu_to_le16(36); 8728 8729 rsp->Reserved = 0; ··· 8726 8737 rsp->LeaseState = lease_state; 8727 8738 rsp->LeaseDuration = 0; 8728 8739 ret = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_lease_ack)); 8729 - if (!ret) 8730 - return; 8731 - 8740 + if (ret) { 8732 8741 err_out: 8742 + smb2_set_err_rsp(work); 8743 + } 8744 + 8745 + opinfo->op_state = OPLOCK_STATE_NONE; 8733 8746 wake_up_interruptible_all(&opinfo->oplock_q); 8734 8747 atomic_dec(&opinfo->breaking_cnt); 8735 8748 wake_up_interruptible_all(&opinfo->oplock_brk); 8736 - 8737 8749 opinfo_put(opinfo); 8738 - smb2_set_err_rsp(work); 8739 8750 } 8740 8751 8741 8752 /**

+3 -2

fs/smb/server/transport_rdma.c

··· 433 433 if (t->qp) { 434 434 ib_drain_qp(t->qp); 435 435 ib_mr_pool_destroy(t->qp, &t->qp->rdma_mrs); 436 - ib_destroy_qp(t->qp); 436 + t->qp = NULL; 437 + rdma_destroy_qp(t->cm_id); 437 438 } 438 439 439 440 ksmbd_debug(RDMA, "drain the reassembly queue\n"); ··· 1941 1940 return 0; 1942 1941 err: 1943 1942 if (t->qp) { 1944 - ib_destroy_qp(t->qp); 1945 1943 t->qp = NULL; 1944 + rdma_destroy_qp(t->cm_id); 1946 1945 } 1947 1946 if (t->recv_cq) { 1948 1947 ib_destroy_cq(t->recv_cq);

+1

fs/smb/server/vfs.c

··· 1282 1282 1283 1283 err = ksmbd_vfs_lock_parent(parent_path->dentry, path->dentry); 1284 1284 if (err) { 1285 + mnt_drop_write(parent_path->mnt); 1285 1286 path_put(path); 1286 1287 path_put(parent_path); 1287 1288 }

+3

include/drm/drm_file.h

··· 300 300 * 301 301 * Mapping of mm object handles to object pointers. Used by the GEM 302 302 * subsystem. Protected by @table_lock. 303 + * 304 + * Note that allocated entries might be NULL as a transient state when 305 + * creating or deleting a handle. 303 306 */ 304 307 struct idr object_idr; 305 308

+7

include/drm/drm_framebuffer.h

··· 23 23 #ifndef __DRM_FRAMEBUFFER_H__ 24 24 #define __DRM_FRAMEBUFFER_H__ 25 25 26 + #include <linux/bits.h> 26 27 #include <linux/ctype.h> 27 28 #include <linux/list.h> 28 29 #include <linux/sched.h> ··· 100 99 unsigned color, struct drm_clip_rect *clips, 101 100 unsigned num_clips); 102 101 }; 102 + 103 + #define DRM_FRAMEBUFFER_HAS_HANDLE_REF(_i) BIT(0u + (_i)) 103 104 104 105 /** 105 106 * struct drm_framebuffer - frame buffer object ··· 191 188 * DRM_MODE_FB_MODIFIERS. 192 189 */ 193 190 int flags; 191 + /** 192 + * @internal_flags: Framebuffer flags like DRM_FRAMEBUFFER_HAS_HANDLE_REF. 193 + */ 194 + unsigned int internal_flags; 194 195 /** 195 196 * @filp_head: Placed on &drm_file.fbs, protected by &drm_file.fbs_lock. 196 197 */

+5

include/linux/blkdev.h

··· 269 269 return MKDEV(disk->major, disk->first_minor); 270 270 } 271 271 272 + #ifdef CONFIG_TRANSPARENT_HUGEPAGE 272 273 /* 273 274 * We should strive for 1 << (PAGE_SHIFT + MAX_PAGECACHE_ORDER) 274 275 * however we constrain this to what we can validate and test. 275 276 */ 276 277 #define BLK_MAX_BLOCK_SIZE SZ_64K 278 + #else 279 + #define BLK_MAX_BLOCK_SIZE PAGE_SIZE 280 + #endif 281 + 277 282 278 283 /* blk_validate_limits() validates bsize, so drivers don't usually need to */ 279 284 static inline int blk_validate_block_size(unsigned long bsize)

+2

include/linux/io_uring_types.h

··· 698 698 struct hlist_node hash_node; 699 699 /* For IOPOLL setup queues, with hybrid polling */ 700 700 u64 iopoll_start; 701 + /* for private io_kiocb freeing */ 702 + struct rcu_head rcu_head; 701 703 }; 702 704 /* internal polling, see IORING_FEAT_FAST_POLL */ 703 705 struct async_poll *apoll;

+1

include/linux/irqchip/irq-msi-lib.h

··· 17 17 18 18 #define MATCH_PLATFORM_MSI BIT(DOMAIN_BUS_PLATFORM_MSI) 19 19 20 + struct msi_domain_info; 20 21 int msi_lib_irq_domain_select(struct irq_domain *d, struct irq_fwspec *fwspec, 21 22 enum irq_domain_bus_token bus_token); 22 23

+5

include/linux/mm.h

··· 2568 2568 return percpu_counter_read_positive(&mm->rss_stat[member]); 2569 2569 } 2570 2570 2571 + static inline unsigned long get_mm_counter_sum(struct mm_struct *mm, int member) 2572 + { 2573 + return percpu_counter_sum_positive(&mm->rss_stat[member]); 2574 + } 2575 + 2571 2576 void mm_trace_rss_stat(struct mm_struct *mm, int member); 2572 2577 2573 2578 static inline void add_mm_counter(struct mm_struct *mm, int member, long value)

-4

include/linux/sched.h

··· 548 548 u64 nr_failed_migrations_running; 549 549 u64 nr_failed_migrations_hot; 550 550 u64 nr_forced_migrations; 551 - #ifdef CONFIG_NUMA_BALANCING 552 - u64 numa_task_migrated; 553 - u64 numa_task_swapped; 554 - #endif 555 551 556 552 u64 nr_wakeups; 557 553 u64 nr_wakeups_sync;

-2

include/linux/vm_event_item.h

··· 66 66 NUMA_HINT_FAULTS, 67 67 NUMA_HINT_FAULTS_LOCAL, 68 68 NUMA_PAGE_MIGRATE, 69 - NUMA_TASK_MIGRATE, 70 - NUMA_TASK_SWAP, 71 69 #endif 72 70 #ifdef CONFIG_MIGRATION 73 71 PGMIGRATE_SUCCESS, PGMIGRATE_FAIL,

+2

include/net/bluetooth/hci.h

··· 377 377 * This quirk must be set before hci_register_dev is called. 378 378 */ 379 379 HCI_QUIRK_BROKEN_READ_PAGE_SCAN_TYPE, 380 + 381 + __HCI_NUM_QUIRKS, 380 382 }; 381 383 382 384 /* HCI device flags */

+27 -23

include/net/bluetooth/hci_core.h

··· 464 464 465 465 unsigned int auto_accept_delay; 466 466 467 - unsigned long quirks; 467 + DECLARE_BITMAP(quirk_flags, __HCI_NUM_QUIRKS); 468 468 469 469 atomic_t cmd_cnt; 470 470 unsigned int acl_cnt; ··· 656 656 u8 (*classify_pkt_type)(struct hci_dev *hdev, struct sk_buff *skb); 657 657 }; 658 658 659 + #define hci_set_quirk(hdev, nr) set_bit((nr), (hdev)->quirk_flags) 660 + #define hci_clear_quirk(hdev, nr) clear_bit((nr), (hdev)->quirk_flags) 661 + #define hci_test_quirk(hdev, nr) test_bit((nr), (hdev)->quirk_flags) 662 + 659 663 #define HCI_PHY_HANDLE(handle) (handle & 0xff) 660 664 661 665 enum conn_reasons { ··· 833 829 #define hci_dev_test_and_clear_flag(hdev, nr) test_and_clear_bit((nr), (hdev)->dev_flags) 834 830 #define hci_dev_test_and_change_flag(hdev, nr) test_and_change_bit((nr), (hdev)->dev_flags) 835 831 836 - #define hci_dev_clear_volatile_flags(hdev) \ 837 - do { \ 838 - hci_dev_clear_flag(hdev, HCI_LE_SCAN); \ 839 - hci_dev_clear_flag(hdev, HCI_LE_ADV); \ 840 - hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);\ 841 - hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ); \ 842 - hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); \ 832 + #define hci_dev_clear_volatile_flags(hdev) \ 833 + do { \ 834 + hci_dev_clear_flag((hdev), HCI_LE_SCAN); \ 835 + hci_dev_clear_flag((hdev), HCI_LE_ADV); \ 836 + hci_dev_clear_flag((hdev), HCI_LL_RPA_RESOLUTION); \ 837 + hci_dev_clear_flag((hdev), HCI_PERIODIC_INQ); \ 838 + hci_dev_clear_flag((hdev), HCI_QUALITY_REPORT); \ 843 839 } while (0) 844 840 845 841 #define hci_dev_le_state_simultaneous(hdev) \ 846 - (!test_bit(HCI_QUIRK_BROKEN_LE_STATES, &hdev->quirks) && \ 847 - (hdev->le_states[4] & 0x08) && /* Central */ \ 848 - (hdev->le_states[4] & 0x40) && /* Peripheral */ \ 849 - (hdev->le_states[3] & 0x10)) /* Simultaneous */ 842 + (!hci_test_quirk((hdev), HCI_QUIRK_BROKEN_LE_STATES) && \ 843 + ((hdev)->le_states[4] & 0x08) && /* Central */ \ 844 + ((hdev)->le_states[4] & 0x40) && /* Peripheral */ \ 845 + ((hdev)->le_states[3] & 0x10)) /* Simultaneous */ 850 846 851 847 /* ----- HCI interface to upper protocols ----- */ 852 848 int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr); ··· 1935 1931 ((dev)->le_rx_def_phys & HCI_LE_SET_PHY_2M)) 1936 1932 1937 1933 #define le_coded_capable(dev) (((dev)->le_features[1] & HCI_LE_PHY_CODED) && \ 1938 - !test_bit(HCI_QUIRK_BROKEN_LE_CODED, \ 1939 - &(dev)->quirks)) 1934 + !hci_test_quirk((dev), \ 1935 + HCI_QUIRK_BROKEN_LE_CODED)) 1940 1936 1941 1937 #define scan_coded(dev) (((dev)->le_tx_def_phys & HCI_LE_SET_PHY_CODED) || \ 1942 1938 ((dev)->le_rx_def_phys & HCI_LE_SET_PHY_CODED)) ··· 1944 1940 #define ll_privacy_capable(dev) ((dev)->le_features[0] & HCI_LE_LL_PRIVACY) 1945 1941 1946 1942 #define privacy_mode_capable(dev) (ll_privacy_capable(dev) && \ 1947 - (hdev->commands[39] & 0x04)) 1943 + ((dev)->commands[39] & 0x04)) 1948 1944 1949 1945 #define read_key_size_capable(dev) \ 1950 1946 ((dev)->commands[20] & 0x10 && \ 1951 - !test_bit(HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE, &hdev->quirks)) 1947 + !hci_test_quirk((dev), HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE)) 1952 1948 1953 1949 #define read_voice_setting_capable(dev) \ 1954 1950 ((dev)->commands[9] & 0x04 && \ 1955 - !test_bit(HCI_QUIRK_BROKEN_READ_VOICE_SETTING, &(dev)->quirks)) 1951 + !hci_test_quirk((dev), HCI_QUIRK_BROKEN_READ_VOICE_SETTING)) 1956 1952 1957 1953 /* Use enhanced synchronous connection if command is supported and its quirk 1958 1954 * has not been set. 1959 1955 */ 1960 1956 #define enhanced_sync_conn_capable(dev) \ 1961 1957 (((dev)->commands[29] & 0x08) && \ 1962 - !test_bit(HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, &(dev)->quirks)) 1958 + !hci_test_quirk((dev), HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN)) 1963 1959 1964 1960 /* Use ext scanning if set ext scan param and ext scan enable is supported */ 1965 1961 #define use_ext_scan(dev) (((dev)->commands[37] & 0x20) && \ 1966 1962 ((dev)->commands[37] & 0x40) && \ 1967 - !test_bit(HCI_QUIRK_BROKEN_EXT_SCAN, &(dev)->quirks)) 1963 + !hci_test_quirk((dev), HCI_QUIRK_BROKEN_EXT_SCAN)) 1968 1964 1969 1965 /* Use ext create connection if command is supported */ 1970 1966 #define use_ext_conn(dev) (((dev)->commands[37] & 0x80) && \ 1971 - !test_bit(HCI_QUIRK_BROKEN_EXT_CREATE_CONN, &(dev)->quirks)) 1967 + !hci_test_quirk((dev), HCI_QUIRK_BROKEN_EXT_CREATE_CONN)) 1972 1968 /* Extended advertising support */ 1973 1969 #define ext_adv_capable(dev) (((dev)->le_features[1] & HCI_LE_EXT_ADV)) 1974 1970 ··· 1983 1979 */ 1984 1980 #define use_enhanced_conn_complete(dev) ((ll_privacy_capable(dev) || \ 1985 1981 ext_adv_capable(dev)) && \ 1986 - !test_bit(HCI_QUIRK_BROKEN_EXT_CREATE_CONN, \ 1987 - &(dev)->quirks)) 1982 + !hci_test_quirk((dev), \ 1983 + HCI_QUIRK_BROKEN_EXT_CREATE_CONN)) 1988 1984 1989 1985 /* Periodic advertising support */ 1990 1986 #define per_adv_capable(dev) (((dev)->le_features[1] & HCI_LE_PERIODIC_ADV)) ··· 2001 1997 #define sync_recv_capable(dev) ((dev)->le_features[3] & HCI_LE_ISO_SYNC_RECEIVER) 2002 1998 2003 1999 #define mws_transport_config_capable(dev) (((dev)->commands[30] & 0x08) && \ 2004 - (!test_bit(HCI_QUIRK_BROKEN_MWS_TRANSPORT_CONFIG, &(dev)->quirks))) 2000 + (!hci_test_quirk((dev), HCI_QUIRK_BROKEN_MWS_TRANSPORT_CONFIG))) 2005 2001 2006 2002 /* ----- HCI protocols ----- */ 2007 2003 #define HCI_PROTO_DEFER 0x01

+1 -1

include/net/cfg80211.h

··· 2795 2795 s8 tsf_report_link_id; 2796 2796 2797 2797 /* keep last */ 2798 - struct ieee80211_channel *channels[] __counted_by(n_channels); 2798 + struct ieee80211_channel *channels[]; 2799 2799 }; 2800 2800 2801 2801 static inline void get_random_mask_addr(u8 *buf, const u8 *addr, const u8 *mask)

+13 -2

include/net/netfilter/nf_conntrack.h

··· 304 304 /* use after obtaining a reference count */ 305 305 static inline bool nf_ct_should_gc(const struct nf_conn *ct) 306 306 { 307 - return nf_ct_is_expired(ct) && nf_ct_is_confirmed(ct) && 308 - !nf_ct_is_dying(ct); 307 + if (!nf_ct_is_confirmed(ct)) 308 + return false; 309 + 310 + /* load ct->timeout after is_confirmed() test. 311 + * Pairs with __nf_conntrack_confirm() which: 312 + * 1. Increases ct->timeout value 313 + * 2. Inserts ct into rcu hlist 314 + * 3. Sets the confirmed bit 315 + * 4. Unlocks the hlist lock 316 + */ 317 + smp_acquire__after_ctrl_dep(); 318 + 319 + return nf_ct_is_expired(ct) && !nf_ct_is_dying(ct); 309 320 } 310 321 311 322 #define NF_CT_DAY (86400 * HZ)

-5

include/net/netfilter/nf_tables.h

··· 1142 1142 int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain); 1143 1143 void nf_tables_unbind_chain(const struct nft_ctx *ctx, struct nft_chain *chain); 1144 1144 1145 - struct nft_hook; 1146 - void nf_tables_chain_device_notify(const struct nft_chain *chain, 1147 - const struct nft_hook *hook, 1148 - const struct net_device *dev, int event); 1149 - 1150 1145 enum nft_chain_types { 1151 1146 NFT_CHAIN_T_DEFAULT = 0, 1152 1147 NFT_CHAIN_T_ROUTE,

+5 -1

include/trace/events/rxrpc.h

··· 322 322 EM(rxrpc_call_put_kernel, "PUT kernel ") \ 323 323 EM(rxrpc_call_put_poke, "PUT poke ") \ 324 324 EM(rxrpc_call_put_recvmsg, "PUT recvmsg ") \ 325 + EM(rxrpc_call_put_release_recvmsg_q, "PUT rls-rcmq") \ 325 326 EM(rxrpc_call_put_release_sock, "PUT rls-sock") \ 326 327 EM(rxrpc_call_put_release_sock_tba, "PUT rls-sk-a") \ 327 328 EM(rxrpc_call_put_sendmsg, "PUT sendmsg ") \ 328 - EM(rxrpc_call_put_unnotify, "PUT unnotify") \ 329 329 EM(rxrpc_call_put_userid_exists, "PUT u-exists") \ 330 330 EM(rxrpc_call_put_userid, "PUT user-id ") \ 331 331 EM(rxrpc_call_see_accept, "SEE accept ") \ 332 332 EM(rxrpc_call_see_activate_client, "SEE act-clnt") \ 333 + EM(rxrpc_call_see_already_released, "SEE alrdy-rl") \ 333 334 EM(rxrpc_call_see_connect_failed, "SEE con-fail") \ 334 335 EM(rxrpc_call_see_connected, "SEE connect ") \ 335 336 EM(rxrpc_call_see_conn_abort, "SEE conn-abt") \ 337 + EM(rxrpc_call_see_discard, "SEE discard ") \ 336 338 EM(rxrpc_call_see_disconnected, "SEE disconn ") \ 337 339 EM(rxrpc_call_see_distribute_error, "SEE dist-err") \ 338 340 EM(rxrpc_call_see_input, "SEE input ") \ 341 + EM(rxrpc_call_see_notify_released, "SEE nfy-rlsd") \ 342 + EM(rxrpc_call_see_recvmsg, "SEE recvmsg ") \ 339 343 EM(rxrpc_call_see_release, "SEE release ") \ 340 344 EM(rxrpc_call_see_userid_exists, "SEE u-exists") \ 341 345 EM(rxrpc_call_see_waiting_call, "SEE q-conn ") \

-10

include/uapi/linux/netfilter/nf_tables.h

··· 142 142 NFT_MSG_DESTROYOBJ, 143 143 NFT_MSG_DESTROYFLOWTABLE, 144 144 NFT_MSG_GETSETELEM_RESET, 145 - NFT_MSG_NEWDEV, 146 - NFT_MSG_DELDEV, 147 145 NFT_MSG_MAX, 148 146 }; 149 147 ··· 1784 1786 * enum nft_device_attributes - nf_tables device netlink attributes 1785 1787 * 1786 1788 * @NFTA_DEVICE_NAME: name of this device (NLA_STRING) 1787 - * @NFTA_DEVICE_TABLE: table containing the flowtable or chain hooking into the device (NLA_STRING) 1788 - * @NFTA_DEVICE_FLOWTABLE: flowtable hooking into the device (NLA_STRING) 1789 - * @NFTA_DEVICE_CHAIN: chain hooking into the device (NLA_STRING) 1790 - * @NFTA_DEVICE_SPEC: hook spec matching the device (NLA_STRING) 1791 1789 */ 1792 1790 enum nft_devices_attributes { 1793 1791 NFTA_DEVICE_UNSPEC, 1794 1792 NFTA_DEVICE_NAME, 1795 - NFTA_DEVICE_TABLE, 1796 - NFTA_DEVICE_FLOWTABLE, 1797 - NFTA_DEVICE_CHAIN, 1798 - NFTA_DEVICE_SPEC, 1799 1793 __NFTA_DEVICE_MAX 1800 1794 }; 1801 1795 #define NFTA_DEVICE_MAX (__NFTA_DEVICE_MAX - 1)

-2

include/uapi/linux/netfilter/nfnetlink.h

··· 25 25 #define NFNLGRP_ACCT_QUOTA NFNLGRP_ACCT_QUOTA 26 26 NFNLGRP_NFTRACE, 27 27 #define NFNLGRP_NFTRACE NFNLGRP_NFTRACE 28 - NFNLGRP_NFT_DEV, 29 - #define NFNLGRP_NFT_DEV NFNLGRP_NFT_DEV 30 28 __NFNLGRP_MAX, 31 29 }; 32 30 #define NFNLGRP_MAX (__NFNLGRP_MAX - 1)

+1 -2

io_uring/io_uring.c

··· 1666 1666 1667 1667 io_req_flags_t io_file_get_flags(struct file *file) 1668 1668 { 1669 - struct inode *inode = file_inode(file); 1670 1669 io_req_flags_t res = 0; 1671 1670 1672 1671 BUILD_BUG_ON(REQ_F_ISREG_BIT != REQ_F_SUPPORT_NOWAIT_BIT + 1); 1673 1672 1674 - if (S_ISREG(inode->i_mode) && !(inode->i_flags & S_ANON_INODE)) 1673 + if (S_ISREG(file_inode(file)->i_mode)) 1675 1674 res |= REQ_F_ISREG; 1676 1675 if ((file->f_flags & O_NONBLOCK) || (file->f_mode & FMODE_NOWAIT)) 1677 1676 res |= REQ_F_SUPPORT_NOWAIT;

+2 -2

io_uring/msg_ring.c

··· 82 82 spin_unlock(&ctx->msg_lock); 83 83 } 84 84 if (req) 85 - kmem_cache_free(req_cachep, req); 85 + kfree_rcu(req, rcu_head); 86 86 percpu_ref_put(&ctx->refs); 87 87 } 88 88 ··· 90 90 int res, u32 cflags, u64 user_data) 91 91 { 92 92 if (!READ_ONCE(ctx->submitter_task)) { 93 - kmem_cache_free(req_cachep, req); 93 + kfree_rcu(req, rcu_head); 94 94 return -EOWNERDEAD; 95 95 } 96 96 req->opcode = IORING_OP_NOP;

-3

io_uring/zcrx.c

··· 863 863 static void io_pp_zc_destroy(struct page_pool *pp) 864 864 { 865 865 struct io_zcrx_ifq *ifq = io_pp_to_ifq(pp); 866 - struct io_zcrx_area *area = ifq->area; 867 866 868 - if (WARN_ON_ONCE(area->free_count != area->nia.num_niovs)) 869 - return; 870 867 percpu_ref_put(&ifq->ctx->refs); 871 868 } 872 869

+7 -7

kernel/events/core.c

··· 7204 7204 static void perf_sigtrap(struct perf_event *event) 7205 7205 { 7206 7206 /* 7207 + * Both perf_pending_task() and perf_pending_irq() can race with the 7208 + * task exiting. 7209 + */ 7210 + if (current->flags & PF_EXITING) 7211 + return; 7212 + 7213 + /* 7207 7214 * We'd expect this to only occur if the irq_work is delayed and either 7208 7215 * ctx->task or current has changed in the meantime. This can be the 7209 7216 * case on architectures that do not implement arch_irq_work_raise(). 7210 7217 */ 7211 7218 if (WARN_ON_ONCE(event->ctx->task != current)) 7212 - return; 7213 - 7214 - /* 7215 - * Both perf_pending_task() and perf_pending_irq() can race with the 7216 - * task exiting. 7217 - */ 7218 - if (current->flags & PF_EXITING) 7219 7219 return; 7220 7220 7221 7221 send_sig_perf((void __user *)event->pending_addr,

+1 -4

kernel/power/suspend.c

··· 384 384 return 0; 385 385 386 386 dpm_save_failed_step(SUSPEND_FREEZE); 387 + filesystems_thaw(); 387 388 pm_notifier_call_chain(PM_POST_SUSPEND); 388 389 Restore: 389 390 pm_restore_console(); ··· 541 540 return error; 542 541 543 542 Recover_platform: 544 - pm_restore_gfp_mask(); 545 543 platform_recover(state); 546 544 goto Resume_devices; 547 545 } ··· 593 593 ksys_sync_helper(); 594 594 trace_suspend_resume(TPS("sync_filesystems"), 0, false); 595 595 } 596 - if (filesystem_freeze_enabled) 597 - filesystems_freeze(); 598 596 599 597 pm_pr_dbg("Preparing system for sleep (%s)\n", mem_sleep_labels[state]); 600 598 pm_suspend_clear_flags(); ··· 612 614 pm_pr_dbg("Finishing wakeup.\n"); 613 615 suspend_finish(); 614 616 Unlock: 615 - filesystems_thaw(); 616 617 mutex_unlock(&system_transition_mutex); 617 618 return error; 618 619 }

+2 -7

kernel/sched/core.c

··· 3362 3362 #ifdef CONFIG_NUMA_BALANCING 3363 3363 static void __migrate_swap_task(struct task_struct *p, int cpu) 3364 3364 { 3365 - __schedstat_inc(p->stats.numa_task_swapped); 3366 - count_vm_numa_event(NUMA_TASK_SWAP); 3367 - count_memcg_event_mm(p->mm, NUMA_TASK_SWAP); 3368 - 3369 3365 if (task_on_rq_queued(p)) { 3370 3366 struct rq *src_rq, *dst_rq; 3371 3367 struct rq_flags srf, drf; ··· 7935 7939 if (!cpumask_test_cpu(target_cpu, p->cpus_ptr)) 7936 7940 return -EINVAL; 7937 7941 7938 - __schedstat_inc(p->stats.numa_task_migrated); 7939 - count_vm_numa_event(NUMA_TASK_MIGRATE); 7940 - count_memcg_event_mm(p->mm, NUMA_TASK_MIGRATE); 7942 + /* TODO: This is not properly updating schedstats */ 7943 + 7941 7944 trace_sched_move_numa(p, curr_cpu, target_cpu); 7942 7945 return stop_one_cpu(curr_cpu, migration_cpu_stop, &arg); 7943 7946 }

-4

kernel/sched/debug.c

··· 1210 1210 P_SCHEDSTAT(nr_failed_migrations_running); 1211 1211 P_SCHEDSTAT(nr_failed_migrations_hot); 1212 1212 P_SCHEDSTAT(nr_forced_migrations); 1213 - #ifdef CONFIG_NUMA_BALANCING 1214 - P_SCHEDSTAT(numa_task_migrated); 1215 - P_SCHEDSTAT(numa_task_swapped); 1216 - #endif 1217 1213 P_SCHEDSTAT(nr_wakeups); 1218 1214 P_SCHEDSTAT(nr_wakeups_sync); 1219 1215 P_SCHEDSTAT(nr_wakeups_migrate);

+1 -1

kernel/trace/trace_probe.c

··· 657 657 ret = query_btf_context(ctx); 658 658 if (ret < 0 || ctx->nr_params == 0) { 659 659 trace_probe_log_err(ctx->offset, NO_BTF_ENTRY); 660 - return PTR_ERR(params); 660 + return -ENOENT; 661 661 } 662 662 } 663 663 params = ctx->params;

+3

lib/alloc_tag.c

··· 135 135 struct codetag_bytes n; 136 136 unsigned int i, nr = 0; 137 137 138 + if (IS_ERR_OR_NULL(alloc_tag_cttype)) 139 + return 0; 140 + 138 141 if (can_sleep) 139 142 codetag_lock_module_list(alloc_tag_cttype, true); 140 143 else if (!codetag_trylock_module_list(alloc_tag_cttype))

+1

lib/maple_tree.c

··· 5319 5319 struct maple_enode *start; 5320 5320 5321 5321 if (mte_is_leaf(enode)) { 5322 + mte_set_node_dead(enode); 5322 5323 node->type = mte_node_type(enode); 5323 5324 goto free_leaf; 5324 5325 }

+4 -4

mm/damon/core.c

··· 1449 1449 } 1450 1450 } 1451 1451 target_access_events = max_access_events * goal_bp / 10000; 1452 + target_access_events = target_access_events ? : 1; 1452 1453 return access_events * 10000 / target_access_events; 1453 1454 } 1454 1455 ··· 2356 2355 * 2357 2356 * If there is a &struct damon_call_control request that registered via 2358 2357 * &damon_call() on @ctx, do or cancel the invocation of the function depending 2359 - * on @cancel. @cancel is set when the kdamond is deactivated by DAMOS 2360 - * watermarks, or the kdamond is already out of the main loop and therefore 2361 - * will be terminated. 2358 + * on @cancel. @cancel is set when the kdamond is already out of the main loop 2359 + * and therefore will be terminated. 2362 2360 */ 2363 2361 static void kdamond_call(struct damon_ctx *ctx, bool cancel) 2364 2362 { ··· 2405 2405 if (ctx->callback.after_wmarks_check && 2406 2406 ctx->callback.after_wmarks_check(ctx)) 2407 2407 break; 2408 - kdamond_call(ctx, true); 2408 + kdamond_call(ctx, false); 2409 2409 damos_walk_cancel(ctx); 2410 2410 } 2411 2411 return -EBUSY;

+6 -3

mm/hugetlb.c

··· 2340 2340 struct folio *folio; 2341 2341 2342 2342 spin_lock_irq(&hugetlb_lock); 2343 + if (!h->resv_huge_pages) { 2344 + spin_unlock_irq(&hugetlb_lock); 2345 + return NULL; 2346 + } 2347 + 2343 2348 folio = dequeue_hugetlb_folio_nodemask(h, gfp_mask, preferred_nid, 2344 2349 nmask); 2345 - if (folio) { 2346 - VM_BUG_ON(!h->resv_huge_pages); 2350 + if (folio) 2347 2351 h->resv_huge_pages--; 2348 - } 2349 2352 2350 2353 spin_unlock_irq(&hugetlb_lock); 2351 2354 return folio;

+2 -43

mm/kasan/report.c

··· 370 370 sizeof(init_thread_union.stack)); 371 371 } 372 372 373 - /* 374 - * This function is invoked with report_lock (a raw_spinlock) held. A 375 - * PREEMPT_RT kernel cannot call find_vm_area() as it will acquire a sleeping 376 - * rt_spinlock. 377 - * 378 - * For !RT kernel, the PROVE_RAW_LOCK_NESTING config option will print a 379 - * lockdep warning for this raw_spinlock -> spinlock dependency. This config 380 - * option is enabled by default to ensure better test coverage to expose this 381 - * kind of RT kernel problem. This lockdep splat, however, can be suppressed 382 - * by using DEFINE_WAIT_OVERRIDE_MAP() if it serves a useful purpose and the 383 - * invalid PREEMPT_RT case has been taken care of. 384 - */ 385 - static inline struct vm_struct *kasan_find_vm_area(void *addr) 386 - { 387 - static DEFINE_WAIT_OVERRIDE_MAP(vmalloc_map, LD_WAIT_SLEEP); 388 - struct vm_struct *va; 389 - 390 - if (IS_ENABLED(CONFIG_PREEMPT_RT)) 391 - return NULL; 392 - 393 - /* 394 - * Suppress lockdep warning and fetch vmalloc area of the 395 - * offending address. 396 - */ 397 - lock_map_acquire_try(&vmalloc_map); 398 - va = find_vm_area(addr); 399 - lock_map_release(&vmalloc_map); 400 - return va; 401 - } 402 - 403 373 static void print_address_description(void *addr, u8 tag, 404 374 struct kasan_report_info *info) 405 375 { ··· 399 429 } 400 430 401 431 if (is_vmalloc_addr(addr)) { 402 - struct vm_struct *va = kasan_find_vm_area(addr); 403 - 404 - if (va) { 405 - pr_err("The buggy address belongs to the virtual mapping at\n" 406 - " [%px, %px) created by:\n" 407 - " %pS\n", 408 - va->addr, va->addr + va->size, va->caller); 409 - pr_err("\n"); 410 - 411 - page = vmalloc_to_page(addr); 412 - } else { 413 - pr_err("The buggy address %px belongs to a vmalloc virtual mapping\n", addr); 414 - } 432 + pr_err("The buggy address %px belongs to a vmalloc virtual mapping\n", addr); 433 + page = vmalloc_to_page(addr); 415 434 } 416 435 417 436 if (page) {

-2

mm/memcontrol.c

··· 474 474 NUMA_PAGE_MIGRATE, 475 475 NUMA_PTE_UPDATES, 476 476 NUMA_HINT_FAULTS, 477 - NUMA_TASK_MIGRATE, 478 - NUMA_TASK_SWAP, 479 477 #endif 480 478 }; 481 479

+8 -6

mm/migrate.c

··· 2399 2399 2400 2400 static int get_compat_pages_array(const void __user *chunk_pages[], 2401 2401 const void __user * __user *pages, 2402 + unsigned long chunk_offset, 2402 2403 unsigned long chunk_nr) 2403 2404 { 2404 2405 compat_uptr_t __user *pages32 = (compat_uptr_t __user *)pages; ··· 2407 2406 int i; 2408 2407 2409 2408 for (i = 0; i < chunk_nr; i++) { 2410 - if (get_user(p, pages32 + i)) 2409 + if (get_user(p, pages32 + chunk_offset + i)) 2411 2410 return -EFAULT; 2412 2411 chunk_pages[i] = compat_ptr(p); 2413 2412 } ··· 2426 2425 #define DO_PAGES_STAT_CHUNK_NR 16UL 2427 2426 const void __user *chunk_pages[DO_PAGES_STAT_CHUNK_NR]; 2428 2427 int chunk_status[DO_PAGES_STAT_CHUNK_NR]; 2428 + unsigned long chunk_offset = 0; 2429 2429 2430 2430 while (nr_pages) { 2431 2431 unsigned long chunk_nr = min(nr_pages, DO_PAGES_STAT_CHUNK_NR); 2432 2432 2433 2433 if (in_compat_syscall()) { 2434 2434 if (get_compat_pages_array(chunk_pages, pages, 2435 - chunk_nr)) 2435 + chunk_offset, chunk_nr)) 2436 2436 break; 2437 2437 } else { 2438 - if (copy_from_user(chunk_pages, pages, 2438 + if (copy_from_user(chunk_pages, pages + chunk_offset, 2439 2439 chunk_nr * sizeof(*chunk_pages))) 2440 2440 break; 2441 2441 } 2442 2442 2443 2443 do_pages_stat_array(mm, chunk_nr, chunk_pages, chunk_status); 2444 2444 2445 - if (copy_to_user(status, chunk_status, chunk_nr * sizeof(*status))) 2445 + if (copy_to_user(status + chunk_offset, chunk_status, 2446 + chunk_nr * sizeof(*status))) 2446 2447 break; 2447 2448 2448 - pages += chunk_nr; 2449 - status += chunk_nr; 2449 + chunk_offset += chunk_nr; 2450 2450 nr_pages -= chunk_nr; 2451 2451 } 2452 2452 return nr_pages ? -EFAULT : 0;

+28 -18

mm/rmap.c

··· 1845 1845 #endif 1846 1846 } 1847 1847 1848 - /* We support batch unmapping of PTEs for lazyfree large folios */ 1849 - static inline bool can_batch_unmap_folio_ptes(unsigned long addr, 1850 - struct folio *folio, pte_t *ptep) 1848 + static inline unsigned int folio_unmap_pte_batch(struct folio *folio, 1849 + struct page_vma_mapped_walk *pvmw, 1850 + enum ttu_flags flags, pte_t pte) 1851 1851 { 1852 1852 const fpb_t fpb_flags = FPB_IGNORE_DIRTY | FPB_IGNORE_SOFT_DIRTY; 1853 - int max_nr = folio_nr_pages(folio); 1854 - pte_t pte = ptep_get(ptep); 1853 + unsigned long end_addr, addr = pvmw->address; 1854 + struct vm_area_struct *vma = pvmw->vma; 1855 + unsigned int max_nr; 1855 1856 1857 + if (flags & TTU_HWPOISON) 1858 + return 1; 1859 + if (!folio_test_large(folio)) 1860 + return 1; 1861 + 1862 + /* We may only batch within a single VMA and a single page table. */ 1863 + end_addr = pmd_addr_end(addr, vma->vm_end); 1864 + max_nr = (end_addr - addr) >> PAGE_SHIFT; 1865 + 1866 + /* We only support lazyfree batching for now ... */ 1856 1867 if (!folio_test_anon(folio) || folio_test_swapbacked(folio)) 1857 - return false; 1868 + return 1; 1858 1869 if (pte_unused(pte)) 1859 - return false; 1860 - if (pte_pfn(pte) != folio_pfn(folio)) 1861 - return false; 1870 + return 1; 1862 1871 1863 - return folio_pte_batch(folio, addr, ptep, pte, max_nr, fpb_flags, NULL, 1864 - NULL, NULL) == max_nr; 1872 + return folio_pte_batch(folio, addr, pvmw->pte, pte, max_nr, fpb_flags, 1873 + NULL, NULL, NULL); 1865 1874 } 1866 1875 1867 1876 /* ··· 2033 2024 if (pte_dirty(pteval)) 2034 2025 folio_mark_dirty(folio); 2035 2026 } else if (likely(pte_present(pteval))) { 2036 - if (folio_test_large(folio) && !(flags & TTU_HWPOISON) && 2037 - can_batch_unmap_folio_ptes(address, folio, pvmw.pte)) 2038 - nr_pages = folio_nr_pages(folio); 2027 + nr_pages = folio_unmap_pte_batch(folio, &pvmw, flags, pteval); 2039 2028 end_addr = address + nr_pages * PAGE_SIZE; 2040 2029 flush_cache_range(vma, address, end_addr); 2041 2030 ··· 2213 2206 hugetlb_remove_rmap(folio); 2214 2207 } else { 2215 2208 folio_remove_rmap_ptes(folio, subpage, nr_pages, vma); 2216 - folio_ref_sub(folio, nr_pages - 1); 2217 2209 } 2218 2210 if (vma->vm_flags & VM_LOCKED) 2219 2211 mlock_drain_local(); 2220 - folio_put(folio); 2221 - /* We have already batched the entire folio */ 2222 - if (nr_pages > 1) 2212 + folio_put_refs(folio, nr_pages); 2213 + 2214 + /* 2215 + * If we are sure that we batched the entire folio and cleared 2216 + * all PTEs, we can just optimize and stop right here. 2217 + */ 2218 + if (nr_pages == folio_nr_pages(folio)) 2223 2219 goto walk_done; 2224 2220 continue; 2225 2221 walk_abort:

+15 -7

mm/vmalloc.c

··· 514 514 unsigned long end, pgprot_t prot, struct page **pages, int *nr, 515 515 pgtbl_mod_mask *mask) 516 516 { 517 + int err = 0; 517 518 pte_t *pte; 518 519 519 520 /* ··· 531 530 do { 532 531 struct page *page = pages[*nr]; 533 532 534 - if (WARN_ON(!pte_none(ptep_get(pte)))) 535 - return -EBUSY; 536 - if (WARN_ON(!page)) 537 - return -ENOMEM; 538 - if (WARN_ON(!pfn_valid(page_to_pfn(page)))) 539 - return -EINVAL; 533 + if (WARN_ON(!pte_none(ptep_get(pte)))) { 534 + err = -EBUSY; 535 + break; 536 + } 537 + if (WARN_ON(!page)) { 538 + err = -ENOMEM; 539 + break; 540 + } 541 + if (WARN_ON(!pfn_valid(page_to_pfn(page)))) { 542 + err = -EINVAL; 543 + break; 544 + } 540 545 541 546 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot)); 542 547 (*nr)++; ··· 550 543 551 544 arch_leave_lazy_mmu_mode(); 552 545 *mask |= PGTBL_PTE_MODIFIED; 553 - return 0; 546 + 547 + return err; 554 548 } 555 549 556 550 static int vmap_pages_pmd_range(pud_t *pud, unsigned long addr,

-2

mm/vmstat.c

··· 1346 1346 "numa_hint_faults", 1347 1347 "numa_hint_faults_local", 1348 1348 "numa_pages_migrated", 1349 - "numa_task_migrated", 1350 - "numa_task_swapped", 1351 1349 #endif 1352 1350 #ifdef CONFIG_MIGRATION 1353 1351 "pgmigrate_success",

+33 -9

net/8021q/vlan.c

··· 357 357 return err; 358 358 } 359 359 360 + static void vlan_vid0_add(struct net_device *dev) 361 + { 362 + struct vlan_info *vlan_info; 363 + int err; 364 + 365 + if (!(dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)) 366 + return; 367 + 368 + pr_info("adding VLAN 0 to HW filter on device %s\n", dev->name); 369 + 370 + err = vlan_vid_add(dev, htons(ETH_P_8021Q), 0); 371 + if (err) 372 + return; 373 + 374 + vlan_info = rtnl_dereference(dev->vlan_info); 375 + vlan_info->auto_vid0 = true; 376 + } 377 + 378 + static void vlan_vid0_del(struct net_device *dev) 379 + { 380 + struct vlan_info *vlan_info = rtnl_dereference(dev->vlan_info); 381 + 382 + if (!vlan_info || !vlan_info->auto_vid0) 383 + return; 384 + 385 + vlan_info->auto_vid0 = false; 386 + vlan_vid_del(dev, htons(ETH_P_8021Q), 0); 387 + } 388 + 360 389 static int vlan_device_event(struct notifier_block *unused, unsigned long event, 361 390 void *ptr) 362 391 { ··· 407 378 return notifier_from_errno(err); 408 379 } 409 380 410 - if ((event == NETDEV_UP) && 411 - (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)) { 412 - pr_info("adding VLAN 0 to HW filter on device %s\n", 413 - dev->name); 414 - vlan_vid_add(dev, htons(ETH_P_8021Q), 0); 415 - } 416 - if (event == NETDEV_DOWN && 417 - (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)) 418 - vlan_vid_del(dev, htons(ETH_P_8021Q), 0); 381 + if (event == NETDEV_UP) 382 + vlan_vid0_add(dev); 383 + else if (event == NETDEV_DOWN) 384 + vlan_vid0_del(dev); 419 385 420 386 vlan_info = rtnl_dereference(dev->vlan_info); 421 387 if (!vlan_info)

+1

net/8021q/vlan.h

··· 33 33 struct vlan_group grp; 34 34 struct list_head vid_list; 35 35 unsigned int nr_vids; 36 + bool auto_vid0; 36 37 struct rcu_head rcu; 37 38 }; 38 39

+2 -2

net/bluetooth/hci_core.c

··· 2654 2654 /* Devices that are marked for raw-only usage are unconfigured 2655 2655 * and should not be included in normal operation. 2656 2656 */ 2657 - if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 2657 + if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 2658 2658 hci_dev_set_flag(hdev, HCI_UNCONFIGURED); 2659 2659 2660 2660 /* Mark Remote Wakeup connection flag as supported if driver has wakeup ··· 2784 2784 int ret = 0; 2785 2785 2786 2786 if (!hdev->suspend_notifier.notifier_call && 2787 - !test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) { 2787 + !hci_test_quirk(hdev, HCI_QUIRK_NO_SUSPEND_NOTIFIER)) { 2788 2788 hdev->suspend_notifier.notifier_call = hci_suspend_notifier; 2789 2789 ret = register_pm_notifier(&hdev->suspend_notifier); 2790 2790 }

+4 -4

net/bluetooth/hci_debugfs.c

··· 38 38 struct hci_dev *hdev = file->private_data; \ 39 39 char buf[3]; \ 40 40 \ 41 - buf[0] = test_bit(__quirk, &hdev->quirks) ? 'Y' : 'N'; \ 41 + buf[0] = test_bit(__quirk, hdev->quirk_flags) ? 'Y' : 'N'; \ 42 42 buf[1] = '\n'; \ 43 43 buf[2] = '\0'; \ 44 44 return simple_read_from_buffer(user_buf, count, ppos, buf, 2); \ ··· 59 59 if (err) \ 60 60 return err; \ 61 61 \ 62 - if (enable == test_bit(__quirk, &hdev->quirks)) \ 62 + if (enable == test_bit(__quirk, hdev->quirk_flags)) \ 63 63 return -EALREADY; \ 64 64 \ 65 - change_bit(__quirk, &hdev->quirks); \ 65 + change_bit(__quirk, hdev->quirk_flags); \ 66 66 \ 67 67 return count; \ 68 68 } \ ··· 1356 1356 * for the vendor callback. Instead just store the desired value and 1357 1357 * the setting will be programmed when the controller gets powered on. 1358 1358 */ 1359 - if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) && 1359 + if (hci_test_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_DIAG) && 1360 1360 (!test_bit(HCI_RUNNING, &hdev->flags) || 1361 1361 hci_dev_test_flag(hdev, HCI_USER_CHANNEL))) 1362 1362 goto done;

+9 -10

net/bluetooth/hci_event.c

··· 908 908 return rp->status; 909 909 910 910 if (hdev->max_page < rp->max_page) { 911 - if (test_bit(HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2, 912 - &hdev->quirks)) 911 + if (hci_test_quirk(hdev, 912 + HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2)) 913 913 bt_dev_warn(hdev, "broken local ext features page 2"); 914 914 else 915 915 hdev->max_page = rp->max_page; ··· 936 936 hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt); 937 937 hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt); 938 938 939 - if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) { 939 + if (hci_test_quirk(hdev, HCI_QUIRK_FIXUP_BUFFER_SIZE)) { 940 940 hdev->sco_mtu = 64; 941 941 hdev->sco_pkts = 8; 942 942 } ··· 2971 2971 * state to indicate completion. 2972 2972 */ 2973 2973 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) || 2974 - !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks)) 2974 + !hci_test_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY)) 2975 2975 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 2976 2976 goto unlock; 2977 2977 } ··· 2990 2990 * state to indicate completion. 2991 2991 */ 2992 2992 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) || 2993 - !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks)) 2993 + !hci_test_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY)) 2994 2994 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 2995 2995 } 2996 2996 ··· 3614 3614 /* We skip the WRITE_AUTH_PAYLOAD_TIMEOUT for ATS2851 based controllers 3615 3615 * to avoid unexpected SMP command errors when pairing. 3616 3616 */ 3617 - if (test_bit(HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT, 3618 - &hdev->quirks)) 3617 + if (hci_test_quirk(hdev, HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT)) 3619 3618 goto notify; 3620 3619 3621 3620 /* Set the default Authenticated Payload Timeout after ··· 5913 5914 * while we have an existing one in peripheral role. 5914 5915 */ 5915 5916 if (hdev->conn_hash.le_num_peripheral > 0 && 5916 - (test_bit(HCI_QUIRK_BROKEN_LE_STATES, &hdev->quirks) || 5917 + (hci_test_quirk(hdev, HCI_QUIRK_BROKEN_LE_STATES) || 5917 5918 !(hdev->le_states[3] & 0x10))) 5918 5919 return NULL; 5919 5920 ··· 6309 6310 evt_type = __le16_to_cpu(info->type) & LE_EXT_ADV_EVT_TYPE_MASK; 6310 6311 legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type); 6311 6312 6312 - if (test_bit(HCI_QUIRK_FIXUP_LE_EXT_ADV_REPORT_PHY, 6313 - &hdev->quirks)) { 6313 + if (hci_test_quirk(hdev, 6314 + HCI_QUIRK_FIXUP_LE_EXT_ADV_REPORT_PHY)) { 6314 6315 info->primary_phy &= 0x1f; 6315 6316 info->secondary_phy &= 0x1f; 6316 6317 }

+31 -32

net/bluetooth/hci_sync.c

··· 393 393 if (hdev->discovery.type != DISCOV_TYPE_INTERLEAVED) 394 394 goto _return; 395 395 396 - if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks)) { 396 + if (hci_test_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY)) { 397 397 if (!test_bit(HCI_INQUIRY, &hdev->flags) && 398 398 hdev->discovery.state != DISCOVERY_RESOLVING) 399 399 goto discov_stopped; ··· 3587 3587 if (ret < 0 || !bacmp(&ba, BDADDR_ANY)) 3588 3588 return; 3589 3589 3590 - if (test_bit(HCI_QUIRK_BDADDR_PROPERTY_BROKEN, &hdev->quirks)) 3590 + if (hci_test_quirk(hdev, HCI_QUIRK_BDADDR_PROPERTY_BROKEN)) 3591 3591 baswap(&hdev->public_addr, &ba); 3592 3592 else 3593 3593 bacpy(&hdev->public_addr, &ba); ··· 3662 3662 bt_dev_dbg(hdev, ""); 3663 3663 3664 3664 /* Reset */ 3665 - if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) { 3665 + if (!hci_test_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE)) { 3666 3666 err = hci_reset_sync(hdev); 3667 3667 if (err) 3668 3668 return err; ··· 3675 3675 { 3676 3676 int err; 3677 3677 3678 - if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 3678 + if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 3679 3679 return 0; 3680 3680 3681 3681 err = hci_init0_sync(hdev); ··· 3718 3718 * supported commands. 3719 3719 */ 3720 3720 if (hdev->hci_ver > BLUETOOTH_VER_1_1 && 3721 - !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks)) 3721 + !hci_test_quirk(hdev, HCI_QUIRK_BROKEN_LOCAL_COMMANDS)) 3722 3722 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_COMMANDS, 3723 3723 0, NULL, HCI_CMD_TIMEOUT); 3724 3724 ··· 3732 3732 bt_dev_dbg(hdev, ""); 3733 3733 3734 3734 /* Reset */ 3735 - if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) { 3735 + if (!hci_test_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE)) { 3736 3736 err = hci_reset_sync(hdev); 3737 3737 if (err) 3738 3738 return err; ··· 3795 3795 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 3796 3796 return 0; 3797 3797 3798 - if (test_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks)) 3798 + if (hci_test_quirk(hdev, HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL)) 3799 3799 return 0; 3800 3800 3801 3801 memset(&cp, 0, sizeof(cp)); ··· 3822 3822 * a hci_set_event_filter_sync() call succeeds, but we do 3823 3823 * the check both for parity and as a future reminder. 3824 3824 */ 3825 - if (test_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks)) 3825 + if (hci_test_quirk(hdev, HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL)) 3826 3826 return 0; 3827 3827 3828 3828 return hci_set_event_filter_sync(hdev, HCI_FLT_CLEAR_ALL, 0x00, ··· 3846 3846 3847 3847 /* Check if the controller supports SCO and HCI_OP_WRITE_SYNC_FLOWCTL */ 3848 3848 if (!lmp_sco_capable(hdev) || !(hdev->commands[10] & BIT(4)) || 3849 - !test_bit(HCI_QUIRK_SYNC_FLOWCTL_SUPPORTED, &hdev->quirks)) 3849 + !hci_test_quirk(hdev, HCI_QUIRK_SYNC_FLOWCTL_SUPPORTED)) 3850 3850 return 0; 3851 3851 3852 3852 memset(&cp, 0, sizeof(cp)); ··· 3921 3921 u8 mode; 3922 3922 3923 3923 if (!lmp_inq_rssi_capable(hdev) && 3924 - !test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) 3924 + !hci_test_quirk(hdev, HCI_QUIRK_FIXUP_INQUIRY_MODE)) 3925 3925 return 0; 3926 3926 3927 3927 /* If Extended Inquiry Result events are supported, then ··· 4111 4111 } 4112 4112 4113 4113 if (lmp_inq_rssi_capable(hdev) || 4114 - test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) 4114 + hci_test_quirk(hdev, HCI_QUIRK_FIXUP_INQUIRY_MODE)) 4115 4115 events[4] |= 0x02; /* Inquiry Result with RSSI */ 4116 4116 4117 4117 if (lmp_ext_feat_capable(hdev)) ··· 4163 4163 struct hci_cp_read_stored_link_key cp; 4164 4164 4165 4165 if (!(hdev->commands[6] & 0x20) || 4166 - test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) 4166 + hci_test_quirk(hdev, HCI_QUIRK_BROKEN_STORED_LINK_KEY)) 4167 4167 return 0; 4168 4168 4169 4169 memset(&cp, 0, sizeof(cp)); ··· 4212 4212 { 4213 4213 if (!(hdev->commands[18] & 0x04) || 4214 4214 !(hdev->features[0][6] & LMP_ERR_DATA_REPORTING) || 4215 - test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks)) 4215 + hci_test_quirk(hdev, HCI_QUIRK_BROKEN_ERR_DATA_REPORTING)) 4216 4216 return 0; 4217 4217 4218 4218 return __hci_cmd_sync_status(hdev, HCI_OP_READ_DEF_ERR_DATA_REPORTING, ··· 4226 4226 * this command in the bit mask of supported commands. 4227 4227 */ 4228 4228 if (!(hdev->commands[13] & 0x01) || 4229 - test_bit(HCI_QUIRK_BROKEN_READ_PAGE_SCAN_TYPE, &hdev->quirks)) 4229 + hci_test_quirk(hdev, HCI_QUIRK_BROKEN_READ_PAGE_SCAN_TYPE)) 4230 4230 return 0; 4231 4231 4232 4232 return __hci_cmd_sync_status(hdev, HCI_OP_READ_PAGE_SCAN_TYPE, ··· 4421 4421 static int hci_le_read_tx_power_sync(struct hci_dev *hdev) 4422 4422 { 4423 4423 if (!(hdev->commands[38] & 0x80) || 4424 - test_bit(HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER, &hdev->quirks)) 4424 + hci_test_quirk(hdev, HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER)) 4425 4425 return 0; 4426 4426 4427 4427 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_TRANSMIT_POWER, ··· 4464 4464 __le16 timeout = cpu_to_le16(hdev->rpa_timeout); 4465 4465 4466 4466 if (!(hdev->commands[35] & 0x04) || 4467 - test_bit(HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT, &hdev->quirks)) 4467 + hci_test_quirk(hdev, HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT)) 4468 4468 return 0; 4469 4469 4470 4470 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_RPA_TIMEOUT, ··· 4609 4609 * just disable this command. 4610 4610 */ 4611 4611 if (!(hdev->commands[6] & 0x80) || 4612 - test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) 4612 + hci_test_quirk(hdev, HCI_QUIRK_BROKEN_STORED_LINK_KEY)) 4613 4613 return 0; 4614 4614 4615 4615 memset(&cp, 0, sizeof(cp)); ··· 4735 4735 4736 4736 if (!(hdev->commands[18] & 0x08) || 4737 4737 !(hdev->features[0][6] & LMP_ERR_DATA_REPORTING) || 4738 - test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks)) 4738 + hci_test_quirk(hdev, HCI_QUIRK_BROKEN_ERR_DATA_REPORTING)) 4739 4739 return 0; 4740 4740 4741 4741 if (enabled == hdev->err_data_reporting) ··· 4948 4948 size_t i; 4949 4949 4950 4950 if (!hci_dev_test_flag(hdev, HCI_SETUP) && 4951 - !test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks)) 4951 + !hci_test_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_SETUP)) 4952 4952 return 0; 4953 4953 4954 4954 bt_dev_dbg(hdev, ""); ··· 4959 4959 ret = hdev->setup(hdev); 4960 4960 4961 4961 for (i = 0; i < ARRAY_SIZE(hci_broken_table); i++) { 4962 - if (test_bit(hci_broken_table[i].quirk, &hdev->quirks)) 4962 + if (hci_test_quirk(hdev, hci_broken_table[i].quirk)) 4963 4963 bt_dev_warn(hdev, "%s", hci_broken_table[i].desc); 4964 4964 } 4965 4965 ··· 4967 4967 * BD_ADDR invalid before creating the HCI device or in 4968 4968 * its setup callback. 4969 4969 */ 4970 - invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 4971 - test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks); 4970 + invalid_bdaddr = hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 4971 + hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY); 4972 4972 if (!ret) { 4973 - if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks) && 4973 + if (hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY) && 4974 4974 !bacmp(&hdev->public_addr, BDADDR_ANY)) 4975 4975 hci_dev_get_bd_addr_from_property(hdev); 4976 4976 ··· 4992 4992 * In case any of them is set, the controller has to 4993 4993 * start up as unconfigured. 4994 4994 */ 4995 - if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 4995 + if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) || 4996 4996 invalid_bdaddr) 4997 4997 hci_dev_set_flag(hdev, HCI_UNCONFIGURED); 4998 4998 ··· 5052 5052 * then they need to be reprogrammed after the init procedure 5053 5053 * completed. 5054 5054 */ 5055 - if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) && 5055 + if (hci_test_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_DIAG) && 5056 5056 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && 5057 5057 hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag) 5058 5058 ret = hdev->set_diag(hdev, true); ··· 5309 5309 /* Reset device */ 5310 5310 skb_queue_purge(&hdev->cmd_q); 5311 5311 atomic_set(&hdev->cmd_cnt, 1); 5312 - if (test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks) && 5312 + if (hci_test_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE) && 5313 5313 !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 5314 5314 set_bit(HCI_INIT, &hdev->flags); 5315 5315 hci_reset_sync(hdev); ··· 5959 5959 own_addr_type = ADDR_LE_DEV_PUBLIC; 5960 5960 5961 5961 if (hci_is_adv_monitoring(hdev) || 5962 - (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) && 5962 + (hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER) && 5963 5963 hdev->discovery.result_filtering)) { 5964 5964 /* Duplicate filter should be disabled when some advertisement 5965 5965 * monitor is activated, otherwise AdvMon can only receive one ··· 6022 6022 * and LE scanning are done sequentially with separate 6023 6023 * timeouts. 6024 6024 */ 6025 - if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, 6026 - &hdev->quirks)) { 6025 + if (hci_test_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY)) { 6027 6026 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT); 6028 6027 /* During simultaneous discovery, we double LE scan 6029 6028 * interval. We must leave some time for the controller ··· 6099 6100 /* Some fake CSR controllers lock up after setting this type of 6100 6101 * filter, so avoid sending the request altogether. 6101 6102 */ 6102 - if (test_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks)) 6103 + if (hci_test_quirk(hdev, HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL)) 6103 6104 return 0; 6104 6105 6105 6106 /* Always clear event filter when starting */ ··· 6814 6815 return 0; 6815 6816 } 6816 6817 6817 - /* No privacy so use a public address. */ 6818 - *own_addr_type = ADDR_LE_DEV_PUBLIC; 6818 + /* No privacy, use the current address */ 6819 + hci_copy_identity_address(hdev, rand_addr, own_addr_type); 6819 6820 6820 6821 return 0; 6821 6822 }

+21 -5

net/bluetooth/l2cap_core.c

··· 3520 3520 /* Configure output options and let the other side know 3521 3521 * which ones we don't like. */ 3522 3522 3523 - /* If MTU is not provided in configure request, use the most recently 3524 - * explicitly or implicitly accepted value for the other direction, 3525 - * or the default value. 3523 + /* If MTU is not provided in configure request, try adjusting it 3524 + * to the current output MTU if it has been set 3525 + * 3526 + * Bluetooth Core 6.1, Vol 3, Part A, Section 4.5 3527 + * 3528 + * Each configuration parameter value (if any is present) in an 3529 + * L2CAP_CONFIGURATION_RSP packet reflects an ‘adjustment’ to a 3530 + * configuration parameter value that has been sent (or, in case 3531 + * of default values, implied) in the corresponding 3532 + * L2CAP_CONFIGURATION_REQ packet. 3526 3533 */ 3527 - if (mtu == 0) 3528 - mtu = chan->imtu ? chan->imtu : L2CAP_DEFAULT_MTU; 3534 + if (!mtu) { 3535 + /* Only adjust for ERTM channels as for older modes the 3536 + * remote stack may not be able to detect that the 3537 + * adjustment causing it to silently drop packets. 3538 + */ 3539 + if (chan->mode == L2CAP_MODE_ERTM && 3540 + chan->omtu && chan->omtu != L2CAP_DEFAULT_MTU) 3541 + mtu = chan->omtu; 3542 + else 3543 + mtu = L2CAP_DEFAULT_MTU; 3544 + } 3529 3545 3530 3546 if (mtu < L2CAP_DEFAULT_MIN_MTU) 3531 3547 result = L2CAP_CONF_UNACCEPT;

+3

net/bluetooth/l2cap_sock.c

··· 1703 1703 { 1704 1704 struct sock *sk = chan->data; 1705 1705 1706 + if (!sk) 1707 + return; 1708 + 1706 1709 if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) { 1707 1710 sk->sk_state = BT_CONNECTED; 1708 1711 chan->state = BT_CONNECTED;

+18 -20

net/bluetooth/mgmt.c

··· 464 464 /* Devices marked as raw-only are neither configured 465 465 * nor unconfigured controllers. 466 466 */ 467 - if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 467 + if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 468 468 continue; 469 469 470 470 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) { ··· 522 522 /* Devices marked as raw-only are neither configured 523 523 * nor unconfigured controllers. 524 524 */ 525 - if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 525 + if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 526 526 continue; 527 527 528 528 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) { ··· 576 576 /* Devices marked as raw-only are neither configured 577 577 * nor unconfigured controllers. 578 578 */ 579 - if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 579 + if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 580 580 continue; 581 581 582 582 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) ··· 612 612 613 613 static bool is_configured(struct hci_dev *hdev) 614 614 { 615 - if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 615 + if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 616 616 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 617 617 return false; 618 618 619 - if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 620 - test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 619 + if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 620 + hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 621 621 !bacmp(&hdev->public_addr, BDADDR_ANY)) 622 622 return false; 623 623 ··· 628 628 { 629 629 u32 options = 0; 630 630 631 - if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 631 + if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 632 632 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 633 633 options |= MGMT_OPTION_EXTERNAL_CONFIG; 634 634 635 - if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 636 - test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 635 + if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 636 + hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 637 637 !bacmp(&hdev->public_addr, BDADDR_ANY)) 638 638 options |= MGMT_OPTION_PUBLIC_ADDRESS; 639 639 ··· 669 669 memset(&rp, 0, sizeof(rp)); 670 670 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 671 671 672 - if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 672 + if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 673 673 options |= MGMT_OPTION_EXTERNAL_CONFIG; 674 674 675 675 if (hdev->set_bdaddr) ··· 828 828 if (lmp_sc_capable(hdev)) 829 829 settings |= MGMT_SETTING_SECURE_CONN; 830 830 831 - if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 832 - &hdev->quirks)) 831 + if (hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 833 832 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 834 833 } 835 834 ··· 840 841 settings |= MGMT_SETTING_ADVERTISING; 841 842 } 842 843 843 - if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 844 - hdev->set_bdaddr) 844 + if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) || hdev->set_bdaddr) 845 845 settings |= MGMT_SETTING_CONFIGURATION; 846 846 847 847 if (cis_central_capable(hdev)) ··· 4305 4307 4306 4308 bt_dev_dbg(hdev, "sock %p", sk); 4307 4309 4308 - if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks)) 4310 + if (!hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 4309 4311 return mgmt_cmd_status(sk, hdev->id, 4310 4312 MGMT_OP_SET_WIDEBAND_SPEECH, 4311 4313 MGMT_STATUS_NOT_SUPPORTED); ··· 7933 7935 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7934 7936 MGMT_STATUS_INVALID_PARAMS); 7935 7937 7936 - if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 7938 + if (!hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 7937 7939 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7938 7940 MGMT_STATUS_NOT_SUPPORTED); 7939 7941 ··· 9336 9338 { 9337 9339 struct mgmt_ev_ext_index ev; 9338 9340 9339 - if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 9341 + if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9340 9342 return; 9341 9343 9342 9344 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { ··· 9360 9362 struct mgmt_ev_ext_index ev; 9361 9363 struct cmd_lookup match = { NULL, hdev, MGMT_STATUS_INVALID_INDEX }; 9362 9364 9363 - if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 9365 + if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9364 9366 return; 9365 9367 9366 9368 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); ··· 10087 10089 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10088 10090 (rssi == HCI_RSSI_INVALID || 10089 10091 (rssi < hdev->discovery.rssi && 10090 - !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)))) 10092 + !hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)))) 10091 10093 return false; 10092 10094 10093 10095 if (hdev->discovery.uuid_count != 0) { ··· 10105 10107 /* If duplicate filtering does not report RSSI changes, then restart 10106 10108 * scanning to ensure updated result with updated RSSI values. 10107 10109 */ 10108 - if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) { 10110 + if (hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)) { 10109 10111 /* Validate RSSI value against the RSSI threshold once more. */ 10110 10112 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10111 10113 rssi < hdev->discovery.rssi)

+1 -1

net/bluetooth/msft.c

··· 989 989 990 990 handle_data = msft_find_handle_data(hdev, ev->monitor_handle, false); 991 991 992 - if (!test_bit(HCI_QUIRK_USE_MSFT_EXT_ADDRESS_FILTER, &hdev->quirks)) { 992 + if (!hci_test_quirk(hdev, HCI_QUIRK_USE_MSFT_EXT_ADDRESS_FILTER)) { 993 993 if (!handle_data) 994 994 return; 995 995 mgmt_handle = handle_data->mgmt_handle;

+19 -2

net/bluetooth/smp.c

··· 1379 1379 1380 1380 bt_dev_dbg(conn->hcon->hdev, "conn %p", conn); 1381 1381 1382 - hci_disconnect(conn->hcon, HCI_ERROR_REMOTE_USER_TERM); 1382 + hci_disconnect(conn->hcon, HCI_ERROR_AUTH_FAILURE); 1383 1383 } 1384 1384 1385 1385 static struct smp_chan *smp_chan_create(struct l2cap_conn *conn) ··· 2977 2977 if (code > SMP_CMD_MAX) 2978 2978 goto drop; 2979 2979 2980 - if (smp && !test_and_clear_bit(code, &smp->allow_cmd)) 2980 + if (smp && !test_and_clear_bit(code, &smp->allow_cmd)) { 2981 + /* If there is a context and the command is not allowed consider 2982 + * it a failure so the session is cleanup properly. 2983 + */ 2984 + switch (code) { 2985 + case SMP_CMD_IDENT_INFO: 2986 + case SMP_CMD_IDENT_ADDR_INFO: 2987 + case SMP_CMD_SIGN_INFO: 2988 + /* 3.6.1. Key distribution and generation 2989 + * 2990 + * A device may reject a distributed key by sending the 2991 + * Pairing Failed command with the reason set to 2992 + * "Key Rejected". 2993 + */ 2994 + smp_failure(conn, SMP_KEY_REJECTED); 2995 + break; 2996 + } 2981 2997 goto drop; 2998 + } 2982 2999 2983 3000 /* If we don't have a context the only allowed commands are 2984 3001 * pairing request and security request.

+1

net/bluetooth/smp.h

··· 138 138 #define SMP_NUMERIC_COMP_FAILED 0x0c 139 139 #define SMP_BREDR_PAIRING_IN_PROGRESS 0x0d 140 140 #define SMP_CROSS_TRANSP_NOT_ALLOWED 0x0e 141 + #define SMP_KEY_REJECTED 0x0f 141 142 142 143 #define SMP_MIN_ENC_KEY_SIZE 7 143 144 #define SMP_MAX_ENC_KEY_SIZE 16

+3

net/bridge/br_switchdev.c

··· 17 17 if (!static_branch_unlikely(&br_switchdev_tx_fwd_offload)) 18 18 return false; 19 19 20 + if (br_multicast_igmp_type(skb)) 21 + return false; 22 + 20 23 return (p->flags & BR_TX_FWD_OFFLOAD) && 21 24 (p->hwdom != BR_INPUT_SKB_CB(skb)->src_hwdom); 22 25 }

+1

net/ipv4/tcp_offload.c

··· 359 359 flush |= skb->ip_summed != p->ip_summed; 360 360 flush |= skb->csum_level != p->csum_level; 361 361 flush |= NAPI_GRO_CB(p)->count >= 64; 362 + skb_set_network_header(skb, skb_gro_receive_network_offset(skb)); 362 363 363 364 if (flush || skb_gro_receive_list(p, skb)) 364 365 mss = 1;

+1

net/ipv4/udp_offload.c

··· 760 760 NAPI_GRO_CB(skb)->flush = 1; 761 761 return NULL; 762 762 } 763 + skb_set_network_header(skb, skb_gro_receive_network_offset(skb)); 763 764 ret = skb_gro_receive_list(p, skb); 764 765 } else { 765 766 skb_gro_postpull_rcsum(skb, uh,

+1 -1

net/ipv6/mcast.c

··· 809 809 } else { 810 810 im->mca_crcount = idev->mc_qrv; 811 811 } 812 - in6_dev_put(pmc->idev); 813 812 ip6_mc_clear_src(pmc); 813 + in6_dev_put(pmc->idev); 814 814 kfree_rcu(pmc, rcu); 815 815 } 816 816

+4 -4

net/ipv6/rpl_iptunnel.c

··· 129 129 struct dst_entry *cache_dst) 130 130 { 131 131 struct ipv6_rpl_sr_hdr *isrh, *csrh; 132 - const struct ipv6hdr *oldhdr; 132 + struct ipv6hdr oldhdr; 133 133 struct ipv6hdr *hdr; 134 134 unsigned char *buf; 135 135 size_t hdrlen; 136 136 int err; 137 137 138 - oldhdr = ipv6_hdr(skb); 138 + memcpy(&oldhdr, ipv6_hdr(skb), sizeof(oldhdr)); 139 139 140 140 buf = kcalloc(struct_size(srh, segments.addr, srh->segments_left), 2, GFP_ATOMIC); 141 141 if (!buf) ··· 147 147 memcpy(isrh, srh, sizeof(*isrh)); 148 148 memcpy(isrh->rpl_segaddr, &srh->rpl_segaddr[1], 149 149 (srh->segments_left - 1) * 16); 150 - isrh->rpl_segaddr[srh->segments_left - 1] = oldhdr->daddr; 150 + isrh->rpl_segaddr[srh->segments_left - 1] = oldhdr.daddr; 151 151 152 152 ipv6_rpl_srh_compress(csrh, isrh, &srh->rpl_segaddr[0], 153 153 isrh->segments_left - 1); ··· 169 169 skb_mac_header_rebuild(skb); 170 170 171 171 hdr = ipv6_hdr(skb); 172 - memmove(hdr, oldhdr, sizeof(*hdr)); 172 + memmove(hdr, &oldhdr, sizeof(*hdr)); 173 173 isrh = (void *)hdr + sizeof(*hdr); 174 174 memcpy(isrh, csrh, hdrlen); 175 175

+2 -1

net/mptcp/options.c

··· 978 978 if (subflow->mp_join) 979 979 goto reset; 980 980 subflow->mp_capable = 0; 981 + if (!mptcp_try_fallback(ssk)) 982 + goto reset; 981 983 pr_fallback(msk); 982 - mptcp_do_fallback(ssk); 983 984 return false; 984 985 } 985 986

+7 -1

net/mptcp/pm.c

··· 765 765 766 766 pr_debug("fail_seq=%llu\n", fail_seq); 767 767 768 - if (!READ_ONCE(msk->allow_infinite_fallback)) 768 + /* After accepting the fail, we can't create any other subflows */ 769 + spin_lock_bh(&msk->fallback_lock); 770 + if (!msk->allow_infinite_fallback) { 771 + spin_unlock_bh(&msk->fallback_lock); 769 772 return; 773 + } 774 + msk->allow_subflows = false; 775 + spin_unlock_bh(&msk->fallback_lock); 770 776 771 777 if (!subflow->fail_tout) { 772 778 pr_debug("send MP_FAIL response and infinite map\n");

+48 -8

net/mptcp/protocol.c

··· 561 561 562 562 static void mptcp_dss_corruption(struct mptcp_sock *msk, struct sock *ssk) 563 563 { 564 - if (READ_ONCE(msk->allow_infinite_fallback)) { 564 + if (mptcp_try_fallback(ssk)) { 565 565 MPTCP_INC_STATS(sock_net(ssk), 566 566 MPTCP_MIB_DSSCORRUPTIONFALLBACK); 567 - mptcp_do_fallback(ssk); 568 567 } else { 569 568 MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DSSCORRUPTIONRESET); 570 569 mptcp_subflow_reset(ssk); ··· 792 793 static void mptcp_subflow_joined(struct mptcp_sock *msk, struct sock *ssk) 793 794 { 794 795 mptcp_subflow_ctx(ssk)->map_seq = READ_ONCE(msk->ack_seq); 795 - WRITE_ONCE(msk->allow_infinite_fallback, false); 796 + msk->allow_infinite_fallback = false; 796 797 mptcp_event(MPTCP_EVENT_SUB_ESTABLISHED, msk, ssk, GFP_ATOMIC); 797 798 } 798 799 ··· 803 804 if (sk->sk_state != TCP_ESTABLISHED) 804 805 return false; 805 806 807 + spin_lock_bh(&msk->fallback_lock); 808 + if (!msk->allow_subflows) { 809 + spin_unlock_bh(&msk->fallback_lock); 810 + return false; 811 + } 812 + mptcp_subflow_joined(msk, ssk); 813 + spin_unlock_bh(&msk->fallback_lock); 814 + 806 815 /* attach to msk socket only after we are sure we will deal with it 807 816 * at close time 808 817 */ ··· 819 812 820 813 mptcp_subflow_ctx(ssk)->subflow_id = msk->subflow_id++; 821 814 mptcp_sockopt_sync_locked(msk, ssk); 822 - mptcp_subflow_joined(msk, ssk); 823 815 mptcp_stop_tout_timer(sk); 824 816 __mptcp_propagate_sndbuf(sk, ssk); 825 817 return true; ··· 1143 1137 mpext->infinite_map = 1; 1144 1138 mpext->data_len = 0; 1145 1139 1140 + if (!mptcp_try_fallback(ssk)) { 1141 + mptcp_subflow_reset(ssk); 1142 + return; 1143 + } 1144 + 1146 1145 MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_INFINITEMAPTX); 1147 1146 mptcp_subflow_ctx(ssk)->send_infinite_map = 0; 1148 1147 pr_fallback(msk); 1149 - mptcp_do_fallback(ssk); 1150 1148 } 1151 1149 1152 1150 #define MPTCP_MAX_GSO_SIZE (GSO_LEGACY_MAX_SIZE - (MAX_TCP_HEADER + 1)) ··· 2554 2544 2555 2545 static void __mptcp_retrans(struct sock *sk) 2556 2546 { 2547 + struct mptcp_sendmsg_info info = { .data_lock_held = true, }; 2557 2548 struct mptcp_sock *msk = mptcp_sk(sk); 2558 2549 struct mptcp_subflow_context *subflow; 2559 - struct mptcp_sendmsg_info info = {}; 2560 2550 struct mptcp_data_frag *dfrag; 2561 2551 struct sock *ssk; 2562 2552 int ret, err; ··· 2601 2591 info.sent = 0; 2602 2592 info.limit = READ_ONCE(msk->csum_enabled) ? dfrag->data_len : 2603 2593 dfrag->already_sent; 2594 + 2595 + /* 2596 + * make the whole retrans decision, xmit, disallow 2597 + * fallback atomic 2598 + */ 2599 + spin_lock_bh(&msk->fallback_lock); 2600 + if (__mptcp_check_fallback(msk)) { 2601 + spin_unlock_bh(&msk->fallback_lock); 2602 + release_sock(ssk); 2603 + return; 2604 + } 2605 + 2604 2606 while (info.sent < info.limit) { 2605 2607 ret = mptcp_sendmsg_frag(sk, ssk, dfrag, &info); 2606 2608 if (ret <= 0) ··· 2626 2604 len = max(copied, len); 2627 2605 tcp_push(ssk, 0, info.mss_now, tcp_sk(ssk)->nonagle, 2628 2606 info.size_goal); 2629 - WRITE_ONCE(msk->allow_infinite_fallback, false); 2607 + msk->allow_infinite_fallback = false; 2630 2608 } 2609 + spin_unlock_bh(&msk->fallback_lock); 2631 2610 2632 2611 release_sock(ssk); 2633 2612 } ··· 2754 2731 WRITE_ONCE(msk->first, NULL); 2755 2732 inet_csk(sk)->icsk_sync_mss = mptcp_sync_mss; 2756 2733 WRITE_ONCE(msk->csum_enabled, mptcp_is_checksum_enabled(sock_net(sk))); 2757 - WRITE_ONCE(msk->allow_infinite_fallback, true); 2734 + msk->allow_infinite_fallback = true; 2735 + msk->allow_subflows = true; 2758 2736 msk->recovery = false; 2759 2737 msk->subflow_id = 1; 2760 2738 msk->last_data_sent = tcp_jiffies32; ··· 2763 2739 msk->last_ack_recv = tcp_jiffies32; 2764 2740 2765 2741 mptcp_pm_data_init(msk); 2742 + spin_lock_init(&msk->fallback_lock); 2766 2743 2767 2744 /* re-use the csk retrans timer for MPTCP-level retrans */ 2768 2745 timer_setup(&msk->sk.icsk_retransmit_timer, mptcp_retransmit_timer, 0); ··· 3143 3118 * subflow 3144 3119 */ 3145 3120 mptcp_destroy_common(msk, MPTCP_CF_FASTCLOSE); 3121 + 3122 + /* The first subflow is already in TCP_CLOSE status, the following 3123 + * can't overlap with a fallback anymore 3124 + */ 3125 + spin_lock_bh(&msk->fallback_lock); 3126 + msk->allow_subflows = true; 3127 + msk->allow_infinite_fallback = true; 3146 3128 WRITE_ONCE(msk->flags, 0); 3129 + spin_unlock_bh(&msk->fallback_lock); 3130 + 3147 3131 msk->cb_flags = 0; 3148 3132 msk->recovery = false; 3149 3133 WRITE_ONCE(msk->can_ack, false); ··· 3559 3525 3560 3526 /* active subflow, already present inside the conn_list */ 3561 3527 if (!list_empty(&subflow->node)) { 3528 + spin_lock_bh(&msk->fallback_lock); 3529 + if (!msk->allow_subflows) { 3530 + spin_unlock_bh(&msk->fallback_lock); 3531 + return false; 3532 + } 3562 3533 mptcp_subflow_joined(msk, ssk); 3534 + spin_unlock_bh(&msk->fallback_lock); 3563 3535 mptcp_propagate_sndbuf(parent, ssk); 3564 3536 return true; 3565 3537 }

+22 -7

net/mptcp/protocol.h

··· 346 346 u64 rtt_us; /* last maximum rtt of subflows */ 347 347 } rcvq_space; 348 348 u8 scaling_ratio; 349 + bool allow_subflows; 349 350 350 351 u32 subflow_id; 351 352 u32 setsockopt_seq; 352 353 char ca_name[TCP_CA_NAME_MAX]; 354 + 355 + spinlock_t fallback_lock; /* protects fallback, 356 + * allow_infinite_fallback and 357 + * allow_join 358 + */ 353 359 }; 354 360 355 361 #define mptcp_data_lock(sk) spin_lock_bh(&(sk)->sk_lock.slock) ··· 1222 1216 return __mptcp_check_fallback(msk); 1223 1217 } 1224 1218 1225 - static inline void __mptcp_do_fallback(struct mptcp_sock *msk) 1219 + static inline bool __mptcp_try_fallback(struct mptcp_sock *msk) 1226 1220 { 1227 1221 if (__mptcp_check_fallback(msk)) { 1228 1222 pr_debug("TCP fallback already done (msk=%p)\n", msk); 1229 - return; 1223 + return true; 1230 1224 } 1231 - if (WARN_ON_ONCE(!READ_ONCE(msk->allow_infinite_fallback))) 1232 - return; 1225 + spin_lock_bh(&msk->fallback_lock); 1226 + if (!msk->allow_infinite_fallback) { 1227 + spin_unlock_bh(&msk->fallback_lock); 1228 + return false; 1229 + } 1230 + 1231 + msk->allow_subflows = false; 1233 1232 set_bit(MPTCP_FALLBACK_DONE, &msk->flags); 1233 + spin_unlock_bh(&msk->fallback_lock); 1234 + return true; 1234 1235 } 1235 1236 1236 1237 static inline bool __mptcp_has_initial_subflow(const struct mptcp_sock *msk) ··· 1249 1236 TCPF_SYN_RECV | TCPF_LISTEN)); 1250 1237 } 1251 1238 1252 - static inline void mptcp_do_fallback(struct sock *ssk) 1239 + static inline bool mptcp_try_fallback(struct sock *ssk) 1253 1240 { 1254 1241 struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk); 1255 1242 struct sock *sk = subflow->conn; 1256 1243 struct mptcp_sock *msk; 1257 1244 1258 1245 msk = mptcp_sk(sk); 1259 - __mptcp_do_fallback(msk); 1246 + if (!__mptcp_try_fallback(msk)) 1247 + return false; 1260 1248 if (READ_ONCE(msk->snd_data_fin_enable) && !(ssk->sk_shutdown & SEND_SHUTDOWN)) { 1261 1249 gfp_t saved_allocation = ssk->sk_allocation; 1262 1250 ··· 1269 1255 tcp_shutdown(ssk, SEND_SHUTDOWN); 1270 1256 ssk->sk_allocation = saved_allocation; 1271 1257 } 1258 + return true; 1272 1259 } 1273 1260 1274 1261 #define pr_fallback(a) pr_debug("%s:fallback to TCP (msk=%p)\n", __func__, a) ··· 1279 1264 { 1280 1265 pr_fallback(msk); 1281 1266 subflow->request_mptcp = 0; 1282 - __mptcp_do_fallback(msk); 1267 + WARN_ON_ONCE(!__mptcp_try_fallback(msk)); 1283 1268 } 1284 1269 1285 1270 static inline bool mptcp_check_infinite_map(struct sk_buff *skb)

+19 -11

net/mptcp/subflow.c

··· 544 544 mptcp_get_options(skb, &mp_opt); 545 545 if (subflow->request_mptcp) { 546 546 if (!(mp_opt.suboptions & OPTION_MPTCP_MPC_SYNACK)) { 547 + if (!mptcp_try_fallback(sk)) 548 + goto do_reset; 549 + 547 550 MPTCP_INC_STATS(sock_net(sk), 548 551 MPTCP_MIB_MPCAPABLEACTIVEFALLBACK); 549 - mptcp_do_fallback(sk); 550 552 pr_fallback(msk); 551 553 goto fallback; 552 554 } ··· 1302 1300 mptcp_schedule_work(sk); 1303 1301 } 1304 1302 1305 - static void mptcp_subflow_fail(struct mptcp_sock *msk, struct sock *ssk) 1303 + static bool mptcp_subflow_fail(struct mptcp_sock *msk, struct sock *ssk) 1306 1304 { 1307 1305 struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk); 1308 1306 unsigned long fail_tout; 1309 1307 1308 + /* we are really failing, prevent any later subflow join */ 1309 + spin_lock_bh(&msk->fallback_lock); 1310 + if (!msk->allow_infinite_fallback) { 1311 + spin_unlock_bh(&msk->fallback_lock); 1312 + return false; 1313 + } 1314 + msk->allow_subflows = false; 1315 + spin_unlock_bh(&msk->fallback_lock); 1316 + 1310 1317 /* graceful failure can happen only on the MPC subflow */ 1311 1318 if (WARN_ON_ONCE(ssk != READ_ONCE(msk->first))) 1312 - return; 1319 + return false; 1313 1320 1314 1321 /* since the close timeout take precedence on the fail one, 1315 1322 * no need to start the latter when the first is already set 1316 1323 */ 1317 1324 if (sock_flag((struct sock *)msk, SOCK_DEAD)) 1318 - return; 1325 + return true; 1319 1326 1320 1327 /* we don't need extreme accuracy here, use a zero fail_tout as special 1321 1328 * value meaning no fail timeout at all; ··· 1336 1325 tcp_send_ack(ssk); 1337 1326 1338 1327 mptcp_reset_tout_timer(msk, subflow->fail_tout); 1328 + return true; 1339 1329 } 1340 1330 1341 1331 static bool subflow_check_data_avail(struct sock *ssk) ··· 1397 1385 (subflow->mp_join || subflow->valid_csum_seen)) { 1398 1386 subflow->send_mp_fail = 1; 1399 1387 1400 - if (!READ_ONCE(msk->allow_infinite_fallback)) { 1388 + if (!mptcp_subflow_fail(msk, ssk)) { 1401 1389 subflow->reset_transient = 0; 1402 1390 subflow->reset_reason = MPTCP_RST_EMIDDLEBOX; 1403 1391 goto reset; 1404 1392 } 1405 - mptcp_subflow_fail(msk, ssk); 1406 1393 WRITE_ONCE(subflow->data_avail, true); 1407 1394 return true; 1408 1395 } 1409 1396 1410 - if (!READ_ONCE(msk->allow_infinite_fallback)) { 1397 + if (!mptcp_try_fallback(ssk)) { 1411 1398 /* fatal protocol error, close the socket. 1412 1399 * subflow_error_report() will introduce the appropriate barriers 1413 1400 */ ··· 1424 1413 WRITE_ONCE(subflow->data_avail, false); 1425 1414 return false; 1426 1415 } 1427 - 1428 - mptcp_do_fallback(ssk); 1429 1416 } 1430 1417 1431 1418 skb = skb_peek(&ssk->sk_receive_queue); ··· 1688 1679 /* discard the subflow socket */ 1689 1680 mptcp_sock_graft(ssk, sk->sk_socket); 1690 1681 iput(SOCK_INODE(sf)); 1691 - WRITE_ONCE(msk->allow_infinite_fallback, false); 1692 1682 mptcp_stop_tout_timer(sk); 1693 1683 return 0; 1694 1684 ··· 1859 1851 1860 1852 msk = mptcp_sk(parent); 1861 1853 if (subflow_simultaneous_connect(sk)) { 1862 - mptcp_do_fallback(sk); 1854 + WARN_ON_ONCE(!mptcp_try_fallback(sk)); 1863 1855 pr_fallback(msk); 1864 1856 subflow->conn_finished = 1; 1865 1857 mptcp_propagate_state(parent, sk, subflow, NULL);

+20 -6

net/netfilter/nf_conntrack_core.c

··· 1121 1121 1122 1122 hlist_nulls_add_head_rcu(&loser_ct->tuplehash[IP_CT_DIR_REPLY].hnnode, 1123 1123 &nf_conntrack_hash[repl_idx]); 1124 + /* confirmed bit must be set after hlist add, not before: 1125 + * loser_ct can still be visible to other cpu due to 1126 + * SLAB_TYPESAFE_BY_RCU. 1127 + */ 1128 + smp_mb__before_atomic(); 1129 + set_bit(IPS_CONFIRMED_BIT, &loser_ct->status); 1124 1130 1125 1131 NF_CT_STAT_INC(net, clash_resolve); 1126 1132 return NF_ACCEPT; ··· 1263 1257 * user context, else we insert an already 'dead' hash, blocking 1264 1258 * further use of that particular connection -JM. 1265 1259 */ 1266 - ct->status |= IPS_CONFIRMED; 1267 - 1268 1260 if (unlikely(nf_ct_is_dying(ct))) { 1269 1261 NF_CT_STAT_INC(net, insert_failed); 1270 1262 goto dying; ··· 1294 1290 } 1295 1291 } 1296 1292 1297 - /* Timer relative to confirmation time, not original 1293 + /* Timeout is relative to confirmation time, not original 1298 1294 setting time, otherwise we'd get timer wrap in 1299 1295 weird delay cases. */ 1300 1296 ct->timeout += nfct_time_stamp; ··· 1302 1298 __nf_conntrack_insert_prepare(ct); 1303 1299 1304 1300 /* Since the lookup is lockless, hash insertion must be done after 1305 - * starting the timer and setting the CONFIRMED bit. The RCU barriers 1306 - * guarantee that no other CPU can find the conntrack before the above 1307 - * stores are visible. 1301 + * setting ct->timeout. The RCU barriers guarantee that no other CPU 1302 + * can find the conntrack before the above stores are visible. 1308 1303 */ 1309 1304 __nf_conntrack_hash_insert(ct, hash, reply_hash); 1305 + 1306 + /* IPS_CONFIRMED unset means 'ct not (yet) in hash', conntrack lookups 1307 + * skip entries that lack this bit. This happens when a CPU is looking 1308 + * at a stale entry that is being recycled due to SLAB_TYPESAFE_BY_RCU 1309 + * or when another CPU encounters this entry right after the insertion 1310 + * but before the set-confirm-bit below. This bit must not be set until 1311 + * after __nf_conntrack_hash_insert(). 1312 + */ 1313 + smp_mb__before_atomic(); 1314 + set_bit(IPS_CONFIRMED_BIT, &ct->status); 1315 + 1310 1316 nf_conntrack_double_unlock(hash, reply_hash); 1311 1317 local_bh_enable(); 1312 1318

-59

net/netfilter/nf_tables_api.c

··· 9694 9694 } 9695 9695 EXPORT_SYMBOL_GPL(nft_hook_find_ops_rcu); 9696 9696 9697 - static void 9698 - nf_tables_device_notify(const struct nft_table *table, int attr, 9699 - const char *name, const struct nft_hook *hook, 9700 - const struct net_device *dev, int event) 9701 - { 9702 - struct net *net = dev_net(dev); 9703 - struct nlmsghdr *nlh; 9704 - struct sk_buff *skb; 9705 - u16 flags = 0; 9706 - 9707 - if (!nfnetlink_has_listeners(net, NFNLGRP_NFT_DEV)) 9708 - return; 9709 - 9710 - skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 9711 - if (!skb) 9712 - goto err; 9713 - 9714 - event = event == NETDEV_REGISTER ? NFT_MSG_NEWDEV : NFT_MSG_DELDEV; 9715 - event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 9716 - nlh = nfnl_msg_put(skb, 0, 0, event, flags, table->family, 9717 - NFNETLINK_V0, nft_base_seq(net)); 9718 - if (!nlh) 9719 - goto err; 9720 - 9721 - if (nla_put_string(skb, NFTA_DEVICE_TABLE, table->name) || 9722 - nla_put_string(skb, attr, name) || 9723 - nla_put(skb, NFTA_DEVICE_SPEC, hook->ifnamelen, hook->ifname) || 9724 - nla_put_string(skb, NFTA_DEVICE_NAME, dev->name)) 9725 - goto err; 9726 - 9727 - nlmsg_end(skb, nlh); 9728 - nfnetlink_send(skb, net, 0, NFNLGRP_NFT_DEV, 9729 - nlmsg_report(nlh), GFP_KERNEL); 9730 - return; 9731 - err: 9732 - if (skb) 9733 - kfree_skb(skb); 9734 - nfnetlink_set_err(net, 0, NFNLGRP_NFT_DEV, -ENOBUFS); 9735 - } 9736 - 9737 - void 9738 - nf_tables_chain_device_notify(const struct nft_chain *chain, 9739 - const struct nft_hook *hook, 9740 - const struct net_device *dev, int event) 9741 - { 9742 - nf_tables_device_notify(chain->table, NFTA_DEVICE_CHAIN, 9743 - chain->name, hook, dev, event); 9744 - } 9745 - 9746 - static void 9747 - nf_tables_flowtable_device_notify(const struct nft_flowtable *ft, 9748 - const struct nft_hook *hook, 9749 - const struct net_device *dev, int event) 9750 - { 9751 - nf_tables_device_notify(ft->table, NFTA_DEVICE_FLOWTABLE, 9752 - ft->name, hook, dev, event); 9753 - } 9754 - 9755 9697 static int nft_flowtable_event(unsigned long event, struct net_device *dev, 9756 9698 struct nft_flowtable *flowtable, bool changename) 9757 9699 { ··· 9741 9799 list_add_tail_rcu(&ops->list, &hook->ops_list); 9742 9800 break; 9743 9801 } 9744 - nf_tables_flowtable_device_notify(flowtable, hook, dev, event); 9745 9802 break; 9746 9803 } 9747 9804 return 0;

+3

net/netfilter/nf_tables_trace.c

··· 127 127 if (nla_put_be32(nlskb, NFTA_TRACE_CT_ID, (__force __be32)id)) 128 128 return -1; 129 129 130 + /* Kernel implementation detail, withhold this from userspace for now */ 131 + status &= ~IPS_NAT_CLASH; 132 + 130 133 if (status && nla_put_be32(nlskb, NFTA_TRACE_CT_STATUS, htonl(status))) 131 134 return -1; 132 135 }

-1

net/netfilter/nfnetlink.c

··· 86 86 [NFNLGRP_NFTABLES] = NFNL_SUBSYS_NFTABLES, 87 87 [NFNLGRP_ACCT_QUOTA] = NFNL_SUBSYS_ACCT, 88 88 [NFNLGRP_NFTRACE] = NFNL_SUBSYS_NFTABLES, 89 - [NFNLGRP_NFT_DEV] = NFNL_SUBSYS_NFTABLES, 90 89 }; 91 90 92 91 static struct nfnl_net *nfnl_pernet(struct net *net)

-2

net/netfilter/nft_chain_filter.c

··· 363 363 list_add_tail_rcu(&ops->list, &hook->ops_list); 364 364 break; 365 365 } 366 - nf_tables_chain_device_notify(&basechain->chain, 367 - hook, dev, event); 368 366 break; 369 367 } 370 368 return 0;

+13 -14

net/packet/af_packet.c

··· 2785 2785 int len_sum = 0; 2786 2786 int status = TP_STATUS_AVAILABLE; 2787 2787 int hlen, tlen, copylen = 0; 2788 - long timeo = 0; 2788 + long timeo; 2789 2789 2790 2790 mutex_lock(&po->pg_vec_lock); 2791 2791 ··· 2839 2839 if ((size_max > dev->mtu + reserve + VLAN_HLEN) && !vnet_hdr_sz) 2840 2840 size_max = dev->mtu + reserve + VLAN_HLEN; 2841 2841 2842 + timeo = sock_sndtimeo(&po->sk, msg->msg_flags & MSG_DONTWAIT); 2842 2843 reinit_completion(&po->skb_completion); 2843 2844 2844 2845 do { 2845 2846 ph = packet_current_frame(po, &po->tx_ring, 2846 2847 TP_STATUS_SEND_REQUEST); 2847 2848 if (unlikely(ph == NULL)) { 2848 - if (need_wait && skb) { 2849 - timeo = sock_sndtimeo(&po->sk, msg->msg_flags & MSG_DONTWAIT); 2849 + /* Note: packet_read_pending() might be slow if we 2850 + * have to call it as it's per_cpu variable, but in 2851 + * fast-path we don't have to call it, only when ph 2852 + * is NULL, we need to check the pending_refcnt. 2853 + */ 2854 + if (need_wait && packet_read_pending(&po->tx_ring)) { 2850 2855 timeo = wait_for_completion_interruptible_timeout(&po->skb_completion, timeo); 2851 2856 if (timeo <= 0) { 2852 2857 err = !timeo ? -ETIMEDOUT : -ERESTARTSYS; 2853 2858 goto out_put; 2854 2859 } 2855 - } 2856 - /* check for additional frames */ 2857 - continue; 2860 + /* check for additional frames */ 2861 + continue; 2862 + } else 2863 + break; 2858 2864 } 2859 2865 2860 2866 skb = NULL; ··· 2949 2943 } 2950 2944 packet_increment_head(&po->tx_ring); 2951 2945 len_sum += tp_len; 2952 - } while (likely((ph != NULL) || 2953 - /* Note: packet_read_pending() might be slow if we have 2954 - * to call it as it's per_cpu variable, but in fast-path 2955 - * we already short-circuit the loop with the first 2956 - * condition, and luckily don't have to go that path 2957 - * anyway. 2958 - */ 2959 - (need_wait && packet_read_pending(&po->tx_ring)))); 2946 + } while (1); 2960 2947 2961 2948 err = len_sum; 2962 2949 goto out_put;

+1 -1

net/phonet/pep.c

··· 826 826 } 827 827 828 828 /* Check for duplicate pipe handle */ 829 + pn_skb_get_dst_sockaddr(skb, &dst); 829 830 newsk = pep_find_pipe(&pn->hlist, &dst, pipe_handle); 830 831 if (unlikely(newsk)) { 831 832 __sock_put(newsk); ··· 851 850 newsk->sk_destruct = pipe_destruct; 852 851 853 852 newpn = pep_sk(newsk); 854 - pn_skb_get_dst_sockaddr(skb, &dst); 855 853 pn_skb_get_src_sockaddr(skb, &src); 856 854 newpn->pn_sk.sobject = pn_sockaddr_get_object(&dst); 857 855 newpn->pn_sk.dobject = pn_sockaddr_get_object(&src);

+4

net/rxrpc/ar-internal.h

··· 44 44 RXRPC_SKB_MARK_SERVICE_CONN_SECURED, /* Service connection response has been verified */ 45 45 RXRPC_SKB_MARK_REJECT_BUSY, /* Reject with BUSY */ 46 46 RXRPC_SKB_MARK_REJECT_ABORT, /* Reject with ABORT (code in skb->priority) */ 47 + RXRPC_SKB_MARK_REJECT_CONN_ABORT, /* Reject with connection ABORT (code in skb->priority) */ 47 48 }; 48 49 49 50 /* ··· 1254 1253 void rxrpc_error_report(struct sock *); 1255 1254 bool rxrpc_direct_abort(struct sk_buff *skb, enum rxrpc_abort_reason why, 1256 1255 s32 abort_code, int err); 1256 + bool rxrpc_direct_conn_abort(struct sk_buff *skb, enum rxrpc_abort_reason why, 1257 + s32 abort_code, int err); 1257 1258 int rxrpc_io_thread(void *data); 1258 1259 void rxrpc_post_response(struct rxrpc_connection *conn, struct sk_buff *skb); 1259 1260 static inline void rxrpc_wake_up_io_thread(struct rxrpc_local *local) ··· 1386 1383 const struct sockaddr_rxrpc *); 1387 1384 struct rxrpc_peer *rxrpc_lookup_peer(struct rxrpc_local *local, 1388 1385 struct sockaddr_rxrpc *srx, gfp_t gfp); 1386 + void rxrpc_assess_MTU_size(struct rxrpc_local *local, struct rxrpc_peer *peer); 1389 1387 struct rxrpc_peer *rxrpc_alloc_peer(struct rxrpc_local *, gfp_t, 1390 1388 enum rxrpc_peer_trace); 1391 1389 void rxrpc_new_incoming_peer(struct rxrpc_local *local, struct rxrpc_peer *peer);

+8 -6

net/rxrpc/call_accept.c

··· 219 219 tail = b->call_backlog_tail; 220 220 while (CIRC_CNT(head, tail, size) > 0) { 221 221 struct rxrpc_call *call = b->call_backlog[tail]; 222 + rxrpc_see_call(call, rxrpc_call_see_discard); 222 223 rcu_assign_pointer(call->socket, rx); 223 224 if (rx->app_ops && 224 225 rx->app_ops->discard_new_call) { ··· 374 373 spin_lock(&rx->incoming_lock); 375 374 if (rx->sk.sk_state == RXRPC_SERVER_LISTEN_DISABLED || 376 375 rx->sk.sk_state == RXRPC_CLOSE) { 377 - rxrpc_direct_abort(skb, rxrpc_abort_shut_down, 378 - RX_INVALID_OPERATION, -ESHUTDOWN); 376 + rxrpc_direct_conn_abort(skb, rxrpc_abort_shut_down, 377 + RX_INVALID_OPERATION, -ESHUTDOWN); 379 378 goto no_call; 380 379 } 381 380 ··· 407 406 408 407 spin_unlock(&rx->incoming_lock); 409 408 read_unlock_irq(&local->services_lock); 409 + rxrpc_assess_MTU_size(local, call->peer); 410 410 411 411 if (hlist_unhashed(&call->error_link)) { 412 412 spin_lock_irq(&call->peer->lock); ··· 422 420 423 421 unsupported_service: 424 422 read_unlock_irq(&local->services_lock); 425 - return rxrpc_direct_abort(skb, rxrpc_abort_service_not_offered, 426 - RX_INVALID_OPERATION, -EOPNOTSUPP); 423 + return rxrpc_direct_conn_abort(skb, rxrpc_abort_service_not_offered, 424 + RX_INVALID_OPERATION, -EOPNOTSUPP); 427 425 unsupported_security: 428 426 read_unlock_irq(&local->services_lock); 429 - return rxrpc_direct_abort(skb, rxrpc_abort_service_not_offered, 430 - RX_INVALID_OPERATION, -EKEYREJECTED); 427 + return rxrpc_direct_conn_abort(skb, rxrpc_abort_service_not_offered, 428 + RX_INVALID_OPERATION, -EKEYREJECTED); 431 429 no_call: 432 430 spin_unlock(&rx->incoming_lock); 433 431 read_unlock_irq(&local->services_lock);

+12 -16

net/rxrpc/call_object.c

··· 561 561 void rxrpc_release_call(struct rxrpc_sock *rx, struct rxrpc_call *call) 562 562 { 563 563 struct rxrpc_connection *conn = call->conn; 564 - bool put = false, putu = false; 564 + bool putu = false; 565 565 566 566 _enter("{%d,%d}", call->debug_id, refcount_read(&call->ref)); 567 567 ··· 573 573 574 574 rxrpc_put_call_slot(call); 575 575 576 - /* Make sure we don't get any more notifications */ 576 + /* Note that at this point, the call may still be on or may have been 577 + * added back on to the socket receive queue. recvmsg() must discard 578 + * released calls. The CALL_RELEASED flag should prevent further 579 + * notifications. 580 + */ 577 581 spin_lock_irq(&rx->recvmsg_lock); 578 - 579 - if (!list_empty(&call->recvmsg_link)) { 580 - _debug("unlinking once-pending call %p { e=%lx f=%lx }", 581 - call, call->events, call->flags); 582 - list_del(&call->recvmsg_link); 583 - put = true; 584 - } 585 - 586 - /* list_empty() must return false in rxrpc_notify_socket() */ 587 - call->recvmsg_link.next = NULL; 588 - call->recvmsg_link.prev = NULL; 589 - 590 582 spin_unlock_irq(&rx->recvmsg_lock); 591 - if (put) 592 - rxrpc_put_call(call, rxrpc_call_put_unnotify); 593 583 594 584 write_lock(&rx->call_lock); 595 585 ··· 626 636 rxrpc_abort_call_sock_release); 627 637 rxrpc_release_call(rx, call); 628 638 rxrpc_put_call(call, rxrpc_call_put_release_sock); 639 + } 640 + 641 + while ((call = list_first_entry_or_null(&rx->recvmsg_q, 642 + struct rxrpc_call, recvmsg_link))) { 643 + list_del_init(&call->recvmsg_link); 644 + rxrpc_put_call(call, rxrpc_call_put_release_recvmsg_q); 629 645 } 630 646 631 647 _leave("");

+14

net/rxrpc/io_thread.c

··· 97 97 return false; 98 98 } 99 99 100 + /* 101 + * Directly produce a connection abort from a packet. 102 + */ 103 + bool rxrpc_direct_conn_abort(struct sk_buff *skb, enum rxrpc_abort_reason why, 104 + s32 abort_code, int err) 105 + { 106 + struct rxrpc_skb_priv *sp = rxrpc_skb(skb); 107 + 108 + trace_rxrpc_abort(0, why, sp->hdr.cid, 0, sp->hdr.seq, abort_code, err); 109 + skb->mark = RXRPC_SKB_MARK_REJECT_CONN_ABORT; 110 + skb->priority = abort_code; 111 + return false; 112 + } 113 + 100 114 static bool rxrpc_bad_message(struct sk_buff *skb, enum rxrpc_abort_reason why) 101 115 { 102 116 return rxrpc_direct_abort(skb, why, RX_PROTOCOL_ERROR, -EBADMSG);

+13 -9

net/rxrpc/output.c

··· 814 814 __be32 code; 815 815 int ret, ioc; 816 816 817 + if (sp->hdr.type == RXRPC_PACKET_TYPE_ABORT) 818 + return; /* Never abort an abort. */ 819 + 817 820 rxrpc_see_skb(skb, rxrpc_skb_see_reject); 818 821 819 822 iov[0].iov_base = &whdr; ··· 829 826 msg.msg_controllen = 0; 830 827 msg.msg_flags = 0; 831 828 832 - memset(&whdr, 0, sizeof(whdr)); 829 + whdr = (struct rxrpc_wire_header) { 830 + .epoch = htonl(sp->hdr.epoch), 831 + .cid = htonl(sp->hdr.cid), 832 + .callNumber = htonl(sp->hdr.callNumber), 833 + .serviceId = htons(sp->hdr.serviceId), 834 + .flags = ~sp->hdr.flags & RXRPC_CLIENT_INITIATED, 835 + }; 833 836 834 837 switch (skb->mark) { 835 838 case RXRPC_SKB_MARK_REJECT_BUSY: ··· 843 834 size = sizeof(whdr); 844 835 ioc = 1; 845 836 break; 837 + case RXRPC_SKB_MARK_REJECT_CONN_ABORT: 838 + whdr.callNumber = 0; 839 + fallthrough; 846 840 case RXRPC_SKB_MARK_REJECT_ABORT: 847 841 whdr.type = RXRPC_PACKET_TYPE_ABORT; 848 842 code = htonl(skb->priority); ··· 858 846 859 847 if (rxrpc_extract_addr_from_skb(&srx, skb) == 0) { 860 848 msg.msg_namelen = srx.transport_len; 861 - 862 - whdr.epoch = htonl(sp->hdr.epoch); 863 - whdr.cid = htonl(sp->hdr.cid); 864 - whdr.callNumber = htonl(sp->hdr.callNumber); 865 - whdr.serviceId = htons(sp->hdr.serviceId); 866 - whdr.flags = sp->hdr.flags; 867 - whdr.flags ^= RXRPC_CLIENT_INITIATED; 868 - whdr.flags &= RXRPC_CLIENT_INITIATED; 869 849 870 850 iov_iter_kvec(&msg.msg_iter, WRITE, iov, ioc, size); 871 851 ret = do_udp_sendmsg(local->socket, &msg, size);

+2 -4

net/rxrpc/peer_object.c

··· 149 149 * assess the MTU size for the network interface through which this peer is 150 150 * reached 151 151 */ 152 - static void rxrpc_assess_MTU_size(struct rxrpc_local *local, 153 - struct rxrpc_peer *peer) 152 + void rxrpc_assess_MTU_size(struct rxrpc_local *local, struct rxrpc_peer *peer) 154 153 { 155 154 struct net *net = local->net; 156 155 struct dst_entry *dst; ··· 276 277 277 278 peer->hdrsize += sizeof(struct rxrpc_wire_header); 278 279 peer->max_data = peer->if_mtu - peer->hdrsize; 279 - 280 - rxrpc_assess_MTU_size(local, peer); 281 280 } 282 281 283 282 /* ··· 294 297 if (peer) { 295 298 memcpy(&peer->srx, srx, sizeof(*srx)); 296 299 rxrpc_init_peer(local, peer, hash_key); 300 + rxrpc_assess_MTU_size(local, peer); 297 301 } 298 302 299 303 _leave(" = %p", peer);

+21 -2

net/rxrpc/recvmsg.c

··· 29 29 30 30 if (!list_empty(&call->recvmsg_link)) 31 31 return; 32 + if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) { 33 + rxrpc_see_call(call, rxrpc_call_see_notify_released); 34 + return; 35 + } 32 36 33 37 rcu_read_lock(); 34 38 ··· 451 447 goto try_again; 452 448 } 453 449 450 + rxrpc_see_call(call, rxrpc_call_see_recvmsg); 451 + if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) { 452 + rxrpc_see_call(call, rxrpc_call_see_already_released); 453 + list_del_init(&call->recvmsg_link); 454 + spin_unlock_irq(&rx->recvmsg_lock); 455 + release_sock(&rx->sk); 456 + trace_rxrpc_recvmsg(call->debug_id, rxrpc_recvmsg_unqueue, 0); 457 + rxrpc_put_call(call, rxrpc_call_put_recvmsg); 458 + goto try_again; 459 + } 454 460 if (!(flags & MSG_PEEK)) 455 461 list_del_init(&call->recvmsg_link); 456 462 else ··· 484 470 485 471 release_sock(&rx->sk); 486 472 487 - if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) 488 - BUG(); 473 + if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) { 474 + rxrpc_see_call(call, rxrpc_call_see_already_released); 475 + mutex_unlock(&call->user_mutex); 476 + if (!(flags & MSG_PEEK)) 477 + rxrpc_put_call(call, rxrpc_call_put_recvmsg); 478 + goto try_again; 479 + } 489 480 490 481 ret = rxrpc_recvmsg_user_id(call, msg, flags); 491 482 if (ret < 0)

+4 -4

net/rxrpc/security.c

··· 140 140 141 141 sec = rxrpc_security_lookup(sp->hdr.securityIndex); 142 142 if (!sec) { 143 - rxrpc_direct_abort(skb, rxrpc_abort_unsupported_security, 144 - RX_INVALID_OPERATION, -EKEYREJECTED); 143 + rxrpc_direct_conn_abort(skb, rxrpc_abort_unsupported_security, 144 + RX_INVALID_OPERATION, -EKEYREJECTED); 145 145 return NULL; 146 146 } 147 147 148 148 if (sp->hdr.securityIndex != RXRPC_SECURITY_NONE && 149 149 !rx->securities) { 150 - rxrpc_direct_abort(skb, rxrpc_abort_no_service_key, 151 - sec->no_key_abort, -EKEYREJECTED); 150 + rxrpc_direct_conn_abort(skb, rxrpc_abort_no_service_key, 151 + sec->no_key_abort, -EKEYREJECTED); 152 152 return NULL; 153 153 } 154 154

+3 -1

net/sched/sch_htb.c

··· 821 821 u32 *pid; 822 822 } stk[TC_HTB_MAXDEPTH], *sp = stk; 823 823 824 - BUG_ON(!hprio->row.rb_node); 824 + if (unlikely(!hprio->row.rb_node)) 825 + return NULL; 826 + 825 827 sp->root = hprio->row.rb_node; 826 828 sp->pptr = &hprio->ptr; 827 829 sp->pid = &hprio->last_ptr_id;

+21 -9

net/sched/sch_qfq.c

··· 412 412 bool existing = false; 413 413 struct nlattr *tb[TCA_QFQ_MAX + 1]; 414 414 struct qfq_aggregate *new_agg = NULL; 415 - u32 weight, lmax, inv_w; 415 + u32 weight, lmax, inv_w, old_weight, old_lmax; 416 416 int err; 417 417 int delta_w; 418 418 ··· 443 443 inv_w = ONE_FP / weight; 444 444 weight = ONE_FP / inv_w; 445 445 446 - if (cl != NULL && 447 - lmax == cl->agg->lmax && 448 - weight == cl->agg->class_weight) 449 - return 0; /* nothing to change */ 446 + if (cl != NULL) { 447 + sch_tree_lock(sch); 448 + old_weight = cl->agg->class_weight; 449 + old_lmax = cl->agg->lmax; 450 + sch_tree_unlock(sch); 451 + if (lmax == old_lmax && weight == old_weight) 452 + return 0; /* nothing to change */ 453 + } 450 454 451 - delta_w = weight - (cl ? cl->agg->class_weight : 0); 455 + delta_w = weight - (cl ? old_weight : 0); 452 456 453 457 if (q->wsum + delta_w > QFQ_MAX_WSUM) { 454 458 NL_SET_ERR_MSG_FMT_MOD(extack, ··· 559 555 560 556 qdisc_purge_queue(cl->qdisc); 561 557 qdisc_class_hash_remove(&q->clhash, &cl->common); 558 + qfq_destroy_class(sch, cl); 562 559 563 560 sch_tree_unlock(sch); 564 561 565 - qfq_destroy_class(sch, cl); 566 562 return 0; 567 563 } 568 564 ··· 629 625 { 630 626 struct qfq_class *cl = (struct qfq_class *)arg; 631 627 struct nlattr *nest; 628 + u32 class_weight, lmax; 632 629 633 630 tcm->tcm_parent = TC_H_ROOT; 634 631 tcm->tcm_handle = cl->common.classid; ··· 638 633 nest = nla_nest_start_noflag(skb, TCA_OPTIONS); 639 634 if (nest == NULL) 640 635 goto nla_put_failure; 641 - if (nla_put_u32(skb, TCA_QFQ_WEIGHT, cl->agg->class_weight) || 642 - nla_put_u32(skb, TCA_QFQ_LMAX, cl->agg->lmax)) 636 + 637 + sch_tree_lock(sch); 638 + class_weight = cl->agg->class_weight; 639 + lmax = cl->agg->lmax; 640 + sch_tree_unlock(sch); 641 + if (nla_put_u32(skb, TCA_QFQ_WEIGHT, class_weight) || 642 + nla_put_u32(skb, TCA_QFQ_LMAX, lmax)) 643 643 goto nla_put_failure; 644 644 return nla_nest_end(skb, nest); 645 645 ··· 661 651 662 652 memset(&xstats, 0, sizeof(xstats)); 663 653 654 + sch_tree_lock(sch); 664 655 xstats.weight = cl->agg->class_weight; 665 656 xstats.lmax = cl->agg->lmax; 657 + sch_tree_unlock(sch); 666 658 667 659 if (gnet_stats_copy_basic(d, NULL, &cl->bstats, true) < 0 || 668 660 gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||

+14

net/smc/af_smc.c

··· 30 30 #include <linux/splice.h> 31 31 32 32 #include <net/sock.h> 33 + #include <net/inet_common.h> 34 + #if IS_ENABLED(CONFIG_IPV6) 35 + #include <net/ipv6.h> 36 + #endif 33 37 #include <net/tcp.h> 34 38 #include <net/smc.h> 35 39 #include <asm/ioctls.h> ··· 364 360 return; 365 361 if (!sock_flag(sk, SOCK_DEAD)) 366 362 return; 363 + switch (sk->sk_family) { 364 + case AF_INET: 365 + inet_sock_destruct(sk); 366 + break; 367 + #if IS_ENABLED(CONFIG_IPV6) 368 + case AF_INET6: 369 + inet6_sock_destruct(sk); 370 + break; 371 + #endif 372 + } 367 373 } 368 374 369 375 static struct lock_class_key smc_key;

+4 -4

net/smc/smc.h

··· 283 283 }; 284 284 285 285 struct smc_sock { /* smc sock container */ 286 - struct sock sk; 287 - #if IS_ENABLED(CONFIG_IPV6) 288 - struct ipv6_pinfo *pinet6; 289 - #endif 286 + union { 287 + struct sock sk; 288 + struct inet_sock icsk_inet; 289 + }; 290 290 struct socket *clcsock; /* internal tcp socket */ 291 291 void (*clcsk_state_change)(struct sock *sk); 292 292 /* original stat_change fct. */

+1 -2

net/tls/tls_strp.c

··· 512 512 if (inq < strp->stm.full_len) 513 513 return tls_strp_read_copy(strp, true); 514 514 515 + tls_strp_load_anchor_with_queue(strp, inq); 515 516 if (!strp->stm.full_len) { 516 - tls_strp_load_anchor_with_queue(strp, inq); 517 - 518 517 sz = tls_rx_msg_size(strp, strp->anchor); 519 518 if (sz < 0) { 520 519 tls_strp_abort_strp(strp, sz);

+11 -1

rust/kernel/drm/device.rs

··· 66 66 open: Some(drm::File::<T::File>::open_callback), 67 67 postclose: Some(drm::File::<T::File>::postclose_callback), 68 68 unload: None, 69 - release: None, 69 + release: Some(Self::release), 70 70 master_set: None, 71 71 master_drop: None, 72 72 debugfs_init: None, ··· 161 161 162 162 // SAFETY: `ptr` is valid by the safety requirements of this function. 163 163 unsafe { &*ptr.cast() } 164 + } 165 + 166 + extern "C" fn release(ptr: *mut bindings::drm_device) { 167 + // SAFETY: `ptr` is a valid pointer to a `struct drm_device` and embedded in `Self`. 168 + let this = unsafe { Self::from_drm_device(ptr) }; 169 + 170 + // SAFETY: 171 + // - When `release` runs it is guaranteed that there is no further access to `this`. 172 + // - `this` is valid for dropping. 173 + unsafe { core::ptr::drop_in_place(this) }; 164 174 } 165 175 } 166 176

-1

rust/kernel/drm/driver.rs

··· 10 10 drm, 11 11 error::{to_result, Result}, 12 12 prelude::*, 13 - str::CStr, 14 13 types::ARef, 15 14 }; 16 15 use macros::vtable;

+6 -2

samples/damon/mtier.c

··· 164 164 if (enable == enabled) 165 165 return 0; 166 166 167 - if (enable) 168 - return damon_sample_mtier_start(); 167 + if (enable) { 168 + err = damon_sample_mtier_start(); 169 + if (err) 170 + enable = false; 171 + return err; 172 + } 169 173 damon_sample_mtier_stop(); 170 174 return 0; 171 175 }

+6 -2

samples/damon/prcl.c

··· 122 122 if (enable == enabled) 123 123 return 0; 124 124 125 - if (enable) 126 - return damon_sample_prcl_start(); 125 + if (enable) { 126 + err = damon_sample_prcl_start(); 127 + if (err) 128 + enable = false; 129 + return err; 130 + } 127 131 damon_sample_prcl_stop(); 128 132 return 0; 129 133 }

+6 -2

samples/damon/wsse.c

··· 102 102 if (enable == enabled) 103 103 return 0; 104 104 105 - if (enable) 106 - return damon_sample_wsse_start(); 105 + if (enable) { 106 + err = damon_sample_wsse_start(); 107 + if (err) 108 + enable = false; 109 + return err; 110 + } 107 111 damon_sample_wsse_stop(); 108 112 return 0; 109 113 }

+7

scripts/gdb/linux/constants.py.in

··· 20 20 #include <linux/of_fdt.h> 21 21 #include <linux/page_ext.h> 22 22 #include <linux/radix-tree.h> 23 + #include <linux/maple_tree.h> 23 24 #include <linux/slab.h> 24 25 #include <linux/threads.h> 25 26 #include <linux/vmalloc.h> ··· 93 92 LX_GDBPARSED(RADIX_TREE_MAP_SIZE) 94 93 LX_GDBPARSED(RADIX_TREE_MAP_SHIFT) 95 94 LX_GDBPARSED(RADIX_TREE_MAP_MASK) 95 + 96 + /* linux/maple_tree.h */ 97 + LX_VALUE(MAPLE_NODE_SLOTS) 98 + LX_VALUE(MAPLE_RANGE64_SLOTS) 99 + LX_VALUE(MAPLE_ARANGE64_SLOTS) 100 + LX_GDBPARSED(MAPLE_NODE_MASK) 96 101 97 102 /* linux/vmalloc.h */ 98 103 LX_VALUE(VM_IOREMAP)

+8 -8

scripts/gdb/linux/interrupts.py

··· 7 7 from linux import constants 8 8 from linux import cpus 9 9 from linux import utils 10 - from linux import radixtree 10 + from linux import mapletree 11 11 12 12 irq_desc_type = utils.CachedType("struct irq_desc") 13 13 ··· 23 23 def show_irq_desc(prec, irq): 24 24 text = "" 25 25 26 - desc = radixtree.lookup(gdb.parse_and_eval("&irq_desc_tree"), irq) 26 + desc = mapletree.mtree_load(gdb.parse_and_eval("&sparse_irqs"), irq) 27 27 if desc is None: 28 28 return text 29 29 30 - desc = desc.cast(irq_desc_type.get_type()) 31 - if desc is None: 30 + desc = desc.cast(irq_desc_type.get_type().pointer()) 31 + if desc == 0: 32 32 return text 33 33 34 34 if irq_settings_is_hidden(desc): ··· 110 110 pvar = gdb.parse_and_eval(var) 111 111 text = "%*s: " % (prec, pfx) 112 112 for cpu in cpus.each_online_cpu(): 113 - text += "%10u " % (cpus.per_cpu(pvar, cpu)) 113 + text += "%10u " % (cpus.per_cpu(pvar, cpu).dereference()) 114 114 text += " %s\n" % (desc) 115 115 return text 116 116 ··· 142 142 143 143 if constants.LX_CONFIG_X86_MCE: 144 144 text += x86_show_mce(prec, "&mce_exception_count", "MCE", "Machine check exceptions") 145 - text == x86_show_mce(prec, "&mce_poll_count", "MCP", "Machine check polls") 145 + text += x86_show_mce(prec, "&mce_poll_count", "MCP", "Machine check polls") 146 146 147 147 text += show_irq_err_count(prec) 148 148 ··· 221 221 gdb.write("CPU%-8d" % cpu) 222 222 gdb.write("\n") 223 223 224 - if utils.gdb_eval_or_none("&irq_desc_tree") is None: 225 - return 224 + if utils.gdb_eval_or_none("&sparse_irqs") is None: 225 + raise gdb.GdbError("Unable to find the sparse IRQ tree, is CONFIG_SPARSE_IRQ enabled?") 226 226 227 227 for irq in range(nr_irqs): 228 228 gdb.write(show_irq_desc(prec, irq))

+252

scripts/gdb/linux/mapletree.py

··· 1 + # SPDX-License-Identifier: GPL-2.0 2 + # 3 + # Maple tree helpers 4 + # 5 + # Copyright (c) 2025 Broadcom 6 + # 7 + # Authors: 8 + # Florian Fainelli <florian.fainelli@broadcom.com> 9 + 10 + import gdb 11 + 12 + from linux import utils 13 + from linux import constants 14 + from linux import xarray 15 + 16 + maple_tree_root_type = utils.CachedType("struct maple_tree") 17 + maple_node_type = utils.CachedType("struct maple_node") 18 + maple_enode_type = utils.CachedType("void") 19 + 20 + maple_dense = 0 21 + maple_leaf_64 = 1 22 + maple_range_64 = 2 23 + maple_arange_64 = 3 24 + 25 + class Mas(object): 26 + ma_active = 0 27 + ma_start = 1 28 + ma_root = 2 29 + ma_none = 3 30 + ma_pause = 4 31 + ma_overflow = 5 32 + ma_underflow = 6 33 + ma_error = 7 34 + 35 + def __init__(self, mt, first, end): 36 + if mt.type == maple_tree_root_type.get_type().pointer(): 37 + self.tree = mt.dereference() 38 + elif mt.type != maple_tree_root_type.get_type(): 39 + raise gdb.GdbError("must be {} not {}" 40 + .format(maple_tree_root_type.get_type().pointer(), mt.type)) 41 + self.tree = mt 42 + self.index = first 43 + self.last = end 44 + self.node = None 45 + self.status = self.ma_start 46 + self.min = 0 47 + self.max = -1 48 + 49 + def is_start(self): 50 + # mas_is_start() 51 + return self.status == self.ma_start 52 + 53 + def is_ptr(self): 54 + # mas_is_ptr() 55 + return self.status == self.ma_root 56 + 57 + def is_none(self): 58 + # mas_is_none() 59 + return self.status == self.ma_none 60 + 61 + def root(self): 62 + # mas_root() 63 + return self.tree['ma_root'].cast(maple_enode_type.get_type().pointer()) 64 + 65 + def start(self): 66 + # mas_start() 67 + if self.is_start() is False: 68 + return None 69 + 70 + self.min = 0 71 + self.max = ~0 72 + 73 + while True: 74 + self.depth = 0 75 + root = self.root() 76 + if xarray.xa_is_node(root): 77 + self.depth = 0 78 + self.status = self.ma_active 79 + self.node = mte_safe_root(root) 80 + self.offset = 0 81 + if mte_dead_node(self.node) is True: 82 + continue 83 + 84 + return None 85 + 86 + self.node = None 87 + # Empty tree 88 + if root is None: 89 + self.status = self.ma_none 90 + self.offset = constants.LX_MAPLE_NODE_SLOTS 91 + return None 92 + 93 + # Single entry tree 94 + self.status = self.ma_root 95 + self.offset = constants.LX_MAPLE_NODE_SLOTS 96 + 97 + if self.index != 0: 98 + return None 99 + 100 + return root 101 + 102 + return None 103 + 104 + def reset(self): 105 + # mas_reset() 106 + self.status = self.ma_start 107 + self.node = None 108 + 109 + def mte_safe_root(node): 110 + if node.type != maple_enode_type.get_type().pointer(): 111 + raise gdb.GdbError("{} must be {} not {}" 112 + .format(mte_safe_root.__name__, maple_enode_type.get_type().pointer(), node.type)) 113 + ulong_type = utils.get_ulong_type() 114 + indirect_ptr = node.cast(ulong_type) & ~0x2 115 + val = indirect_ptr.cast(maple_enode_type.get_type().pointer()) 116 + return val 117 + 118 + def mte_node_type(entry): 119 + ulong_type = utils.get_ulong_type() 120 + val = None 121 + if entry.type == maple_enode_type.get_type().pointer(): 122 + val = entry.cast(ulong_type) 123 + elif entry.type == ulong_type: 124 + val = entry 125 + else: 126 + raise gdb.GdbError("{} must be {} not {}" 127 + .format(mte_node_type.__name__, maple_enode_type.get_type().pointer(), entry.type)) 128 + return (val >> 0x3) & 0xf 129 + 130 + def ma_dead_node(node): 131 + if node.type != maple_node_type.get_type().pointer(): 132 + raise gdb.GdbError("{} must be {} not {}" 133 + .format(ma_dead_node.__name__, maple_node_type.get_type().pointer(), node.type)) 134 + ulong_type = utils.get_ulong_type() 135 + parent = node['parent'] 136 + indirect_ptr = node['parent'].cast(ulong_type) & ~constants.LX_MAPLE_NODE_MASK 137 + return indirect_ptr == node 138 + 139 + def mte_to_node(enode): 140 + ulong_type = utils.get_ulong_type() 141 + if enode.type == maple_enode_type.get_type().pointer(): 142 + indirect_ptr = enode.cast(ulong_type) 143 + elif enode.type == ulong_type: 144 + indirect_ptr = enode 145 + else: 146 + raise gdb.GdbError("{} must be {} not {}" 147 + .format(mte_to_node.__name__, maple_enode_type.get_type().pointer(), enode.type)) 148 + indirect_ptr = indirect_ptr & ~constants.LX_MAPLE_NODE_MASK 149 + return indirect_ptr.cast(maple_node_type.get_type().pointer()) 150 + 151 + def mte_dead_node(enode): 152 + if enode.type != maple_enode_type.get_type().pointer(): 153 + raise gdb.GdbError("{} must be {} not {}" 154 + .format(mte_dead_node.__name__, maple_enode_type.get_type().pointer(), enode.type)) 155 + node = mte_to_node(enode) 156 + return ma_dead_node(node) 157 + 158 + def ma_is_leaf(tp): 159 + result = tp < maple_range_64 160 + return tp < maple_range_64 161 + 162 + def mt_pivots(t): 163 + if t == maple_dense: 164 + return 0 165 + elif t == maple_leaf_64 or t == maple_range_64: 166 + return constants.LX_MAPLE_RANGE64_SLOTS - 1 167 + elif t == maple_arange_64: 168 + return constants.LX_MAPLE_ARANGE64_SLOTS - 1 169 + 170 + def ma_pivots(node, t): 171 + if node.type != maple_node_type.get_type().pointer(): 172 + raise gdb.GdbError("{}: must be {} not {}" 173 + .format(ma_pivots.__name__, maple_node_type.get_type().pointer(), node.type)) 174 + if t == maple_arange_64: 175 + return node['ma64']['pivot'] 176 + elif t == maple_leaf_64 or t == maple_range_64: 177 + return node['mr64']['pivot'] 178 + else: 179 + return None 180 + 181 + def ma_slots(node, tp): 182 + if node.type != maple_node_type.get_type().pointer(): 183 + raise gdb.GdbError("{}: must be {} not {}" 184 + .format(ma_slots.__name__, maple_node_type.get_type().pointer(), node.type)) 185 + if tp == maple_arange_64: 186 + return node['ma64']['slot'] 187 + elif tp == maple_range_64 or tp == maple_leaf_64: 188 + return node['mr64']['slot'] 189 + elif tp == maple_dense: 190 + return node['slot'] 191 + else: 192 + return None 193 + 194 + def mt_slot(mt, slots, offset): 195 + ulong_type = utils.get_ulong_type() 196 + return slots[offset].cast(ulong_type) 197 + 198 + def mtree_lookup_walk(mas): 199 + ulong_type = utils.get_ulong_type() 200 + n = mas.node 201 + 202 + while True: 203 + node = mte_to_node(n) 204 + tp = mte_node_type(n) 205 + pivots = ma_pivots(node, tp) 206 + end = mt_pivots(tp) 207 + offset = 0 208 + while True: 209 + if pivots[offset] >= mas.index: 210 + break 211 + if offset >= end: 212 + break 213 + offset += 1 214 + 215 + slots = ma_slots(node, tp) 216 + n = mt_slot(mas.tree, slots, offset) 217 + if ma_dead_node(node) is True: 218 + mas.reset() 219 + return None 220 + break 221 + 222 + if ma_is_leaf(tp) is True: 223 + break 224 + 225 + return n 226 + 227 + def mtree_load(mt, index): 228 + ulong_type = utils.get_ulong_type() 229 + # MT_STATE(...) 230 + mas = Mas(mt, index, index) 231 + entry = None 232 + 233 + while True: 234 + entry = mas.start() 235 + if mas.is_none(): 236 + return None 237 + 238 + if mas.is_ptr(): 239 + if index != 0: 240 + entry = None 241 + return entry 242 + 243 + entry = mtree_lookup_walk(mas) 244 + if entry is None and mas.is_start(): 245 + continue 246 + else: 247 + break 248 + 249 + if xarray.xa_is_zero(entry): 250 + return None 251 + 252 + return entry

+1 -1

scripts/gdb/linux/vfs.py

··· 22 22 if parent == d or parent == 0: 23 23 return "" 24 24 p = dentry_name(d['d_parent']) + "/" 25 - return p + d['d_shortname']['string'].string() 25 + return p + d['d_name']['name'].string() 26 26 27 27 class DentryName(gdb.Function): 28 28 """Return string of the full path of a dentry.

+28

scripts/gdb/linux/xarray.py

··· 1 + # SPDX-License-Identifier: GPL-2.0 2 + # 3 + # Xarray helpers 4 + # 5 + # Copyright (c) 2025 Broadcom 6 + # 7 + # Authors: 8 + # Florian Fainelli <florian.fainelli@broadcom.com> 9 + 10 + import gdb 11 + 12 + from linux import utils 13 + from linux import constants 14 + 15 + def xa_is_internal(entry): 16 + ulong_type = utils.get_ulong_type() 17 + return ((entry.cast(ulong_type) & 3) == 2) 18 + 19 + def xa_mk_internal(v): 20 + return ((v << 2) | 2) 21 + 22 + def xa_is_zero(entry): 23 + ulong_type = utils.get_ulong_type() 24 + return entry.cast(ulong_type) == xa_mk_internal(257) 25 + 26 + def xa_is_node(entry): 27 + ulong_type = utils.get_ulong_type() 28 + return xa_is_internal(entry) and (entry.cast(ulong_type) > 4096)

+1

tools/arch/x86/include/asm/msr-index.h

··· 628 628 #define MSR_AMD64_OSVW_STATUS 0xc0010141 629 629 #define MSR_AMD_PPIN_CTL 0xc00102f0 630 630 #define MSR_AMD_PPIN 0xc00102f1 631 + #define MSR_AMD64_CPUID_FN_7 0xc0011002 631 632 #define MSR_AMD64_CPUID_FN_1 0xc0011004 632 633 #define MSR_AMD64_LS_CFG 0xc0011020 633 634 #define MSR_AMD64_DC_CFG 0xc0011022

+4

tools/include/linux/kallsyms.h

··· 18 18 return NULL; 19 19 } 20 20 21 + #ifdef HAVE_BACKTRACE_SUPPORT 21 22 #include <execinfo.h> 22 23 #include <stdlib.h> 23 24 static inline void print_ip_sym(const char *loglvl, unsigned long ip) ··· 31 30 32 31 free(name); 33 32 } 33 + #else 34 + static inline void print_ip_sym(const char *loglvl, unsigned long ip) {} 35 + #endif 34 36 35 37 #endif

+70

tools/testing/selftests/hid/tests/test_mouse.py

··· 439 439 return 32 # EPIPE 440 440 441 441 442 + class BadReportDescriptorMouse(BaseMouse): 443 + """ 444 + This "device" was one autogenerated by syzbot. There are a lot of issues in 445 + it, and the most problematic is that it declares features that have no 446 + size. 447 + 448 + This leads to report->size being set to 0 and can mess up with usbhid 449 + internals. Fortunately, uhid merely passes the incoming buffer, without 450 + touching it so a buffer of size 0 will be translated to [] without 451 + triggering a kernel oops. 452 + 453 + Because the report descriptor is wrong, no input are created, and we need 454 + to tweak a little bit the parameters to make it look correct. 455 + """ 456 + 457 + # fmt: off 458 + report_descriptor = [ 459 + 0x96, 0x01, 0x00, # Report Count (1) 0 460 + 0x06, 0x01, 0x00, # Usage Page (Generic Desktop) 3 461 + # 0x03, 0x00, 0x00, 0x00, 0x00, # Ignored by the kernel somehow 462 + 0x2a, 0x90, 0xa0, # Usage Maximum (41104) 6 463 + 0x27, 0x00, 0x00, 0x00, 0x00, # Logical Maximum (0) 9 464 + 0xb3, 0x81, 0x3e, 0x25, 0x03, # Feature (Cnst,Arr,Abs,Vol) 14 465 + 0x1b, 0xdd, 0xe8, 0x40, 0x50, # Usage Minimum (1346431197) 19 466 + 0x3b, 0x5d, 0x8c, 0x3d, 0xda, # Designator Index 24 467 + ] 468 + # fmt: on 469 + 470 + def __init__( 471 + self, rdesc=report_descriptor, name=None, input_info=(3, 0x045E, 0x07DA) 472 + ): 473 + super().__init__(rdesc, name, input_info) 474 + self.high_resolution_report_called = False 475 + 476 + def get_evdev(self, application=None): 477 + assert self._input_nodes is None 478 + return ( 479 + "Ok" # should be a list or None, but both would fail, so abusing the system 480 + ) 481 + 482 + def next_sync_events(self, application=None): 483 + # there are no evdev nodes, so no events 484 + return [] 485 + 486 + def is_ready(self): 487 + # we wait for the SET_REPORT command to come 488 + return self.high_resolution_report_called 489 + 490 + def set_report(self, req, rnum, rtype, data): 491 + if rtype != self.UHID_FEATURE_REPORT: 492 + raise InvalidHIDCommunication(f"Unexpected report type: {rtype}") 493 + if rnum != 0x0: 494 + raise InvalidHIDCommunication(f"Unexpected report number: {rnum}") 495 + 496 + if len(data) != 1: 497 + raise InvalidHIDCommunication(f"Unexpected data: {data}, expected '[0]'") 498 + 499 + self.high_resolution_report_called = True 500 + 501 + return 0 502 + 503 + 442 504 class ResolutionMultiplierHWheelMouse(TwoWheelMouse): 443 505 # fmt: off 444 506 report_descriptor = [ ··· 1037 975 # assert below print out the real error 1038 976 pass 1039 977 assert remaining == [] 978 + 979 + 980 + class TestBadReportDescriptorMouse(base.BaseTestCase.TestUhid): 981 + def create_device(self): 982 + return BadReportDescriptorMouse() 983 + 984 + def assertName(self, uhdev): 985 + pass

+1

tools/testing/selftests/net/netfilter/.gitignore

··· 5 5 conntrack_reverse_clash 6 6 sctp_collision 7 7 nf_queue 8 + udpclash

+3

tools/testing/selftests/net/netfilter/Makefile

··· 15 15 TEST_PROGS += conntrack_resize.sh 16 16 TEST_PROGS += conntrack_sctp_collision.sh 17 17 TEST_PROGS += conntrack_vrf.sh 18 + TEST_PROGS += conntrack_clash.sh 18 19 TEST_PROGS += conntrack_reverse_clash.sh 19 20 TEST_PROGS += ipvs.sh 20 21 TEST_PROGS += nf_conntrack_packetdrill.sh ··· 45 44 TEST_GEN_FILES += conntrack_dump_flush 46 45 TEST_GEN_FILES += conntrack_reverse_clash 47 46 TEST_GEN_FILES += sctp_collision 47 + TEST_GEN_FILES += udpclash 48 48 49 49 include ../../lib.mk 50 50 ··· 54 52 55 53 $(OUTPUT)/conntrack_dump_flush: CFLAGS += $(MNL_CFLAGS) 56 54 $(OUTPUT)/conntrack_dump_flush: LDLIBS += $(MNL_LDLIBS) 55 + $(OUTPUT)/udpclash: LDLIBS += -lpthread 57 56 58 57 TEST_FILES := lib.sh 59 58 TEST_FILES += packetdrill

+175

tools/testing/selftests/net/netfilter/conntrack_clash.sh

··· 1 + #!/bin/bash 2 + # SPDX-License-Identifier: GPL-2.0 3 + 4 + source lib.sh 5 + 6 + clash_resolution_active=0 7 + dport=22111 8 + ret=0 9 + 10 + cleanup() 11 + { 12 + # netns cleanup also zaps any remaining socat echo server. 13 + cleanup_all_ns 14 + } 15 + 16 + checktool "nft --version" "run test without nft" 17 + checktool "conntrack --version" "run test without conntrack" 18 + checktool "socat -h" "run test without socat" 19 + 20 + trap cleanup EXIT 21 + 22 + setup_ns nsclient1 nsclient2 nsrouter 23 + 24 + ip netns exec "$nsrouter" nft -f -<<EOF 25 + table ip t { 26 + chain lb { 27 + meta l4proto udp dnat to numgen random mod 3 map { 0 : 10.0.2.1 . 9000, 1 : 10.0.2.1 . 9001, 2 : 10.0.2.1 . 9002 } 28 + } 29 + 30 + chain prerouting { 31 + type nat hook prerouting priority dstnat 32 + 33 + udp dport $dport counter jump lb 34 + } 35 + 36 + chain output { 37 + type nat hook output priority dstnat 38 + 39 + udp dport $dport counter jump lb 40 + } 41 + } 42 + EOF 43 + 44 + load_simple_ruleset() 45 + { 46 + ip netns exec "$1" nft -f -<<EOF 47 + table ip t { 48 + chain forward { 49 + type filter hook forward priority 0 50 + 51 + ct state new counter 52 + } 53 + } 54 + EOF 55 + } 56 + 57 + spawn_servers() 58 + { 59 + local ns="$1" 60 + local ports="9000 9001 9002" 61 + 62 + for port in $ports; do 63 + ip netns exec "$ns" socat UDP-RECVFROM:$port,fork PIPE 2>/dev/null & 64 + done 65 + 66 + for port in $ports; do 67 + wait_local_port_listen "$ns" $port udp 68 + done 69 + } 70 + 71 + add_addr() 72 + { 73 + local ns="$1" 74 + local dev="$2" 75 + local i="$3" 76 + local j="$4" 77 + 78 + ip -net "$ns" link set "$dev" up 79 + ip -net "$ns" addr add "10.0.$i.$j/24" dev "$dev" 80 + } 81 + 82 + ping_test() 83 + { 84 + local ns="$1" 85 + local daddr="$2" 86 + 87 + if ! ip netns exec "$ns" ping -q -c 1 $daddr > /dev/null;then 88 + echo "FAIL: ping from $ns to $daddr" 89 + exit 1 90 + fi 91 + } 92 + 93 + run_one_clash_test() 94 + { 95 + local ns="$1" 96 + local daddr="$2" 97 + local dport="$3" 98 + local entries 99 + local cre 100 + 101 + if ! ip netns exec "$ns" ./udpclash $daddr $dport;then 102 + echo "FAIL: did not receive expected number of replies for $daddr:$dport" 103 + ret=1 104 + return 1 105 + fi 106 + 107 + entries=$(conntrack -S | wc -l) 108 + cre=$(conntrack -S | grep -v "clash_resolve=0" | wc -l) 109 + 110 + if [ "$cre" -ne "$entries" ] ;then 111 + clash_resolution_active=1 112 + return 0 113 + fi 114 + 115 + # 1 cpu -> parallel insertion impossible 116 + if [ "$entries" -eq 1 ]; then 117 + return 0 118 + fi 119 + 120 + # not a failure: clash resolution logic did not trigger, but all replies 121 + # were received. With right timing, xmit completed sequentially and 122 + # no parallel insertion occurs. 123 + return $ksft_skip 124 + } 125 + 126 + run_clash_test() 127 + { 128 + local ns="$1" 129 + local daddr="$2" 130 + local dport="$3" 131 + 132 + for i in $(seq 1 10);do 133 + run_one_clash_test "$ns" "$daddr" "$dport" 134 + local rv=$? 135 + if [ $rv -eq 0 ];then 136 + echo "PASS: clash resolution test for $daddr:$dport on attempt $i" 137 + return 0 138 + elif [ $rv -eq 1 ];then 139 + echo "FAIL: clash resolution test for $daddr:$dport on attempt $i" 140 + return 1 141 + fi 142 + done 143 + } 144 + 145 + ip link add veth0 netns "$nsclient1" type veth peer name veth0 netns "$nsrouter" 146 + ip link add veth0 netns "$nsclient2" type veth peer name veth1 netns "$nsrouter" 147 + add_addr "$nsclient1" veth0 1 1 148 + add_addr "$nsclient2" veth0 2 1 149 + add_addr "$nsrouter" veth0 1 99 150 + add_addr "$nsrouter" veth1 2 99 151 + 152 + ip -net "$nsclient1" route add default via 10.0.1.99 153 + ip -net "$nsclient2" route add default via 10.0.2.99 154 + ip netns exec "$nsrouter" sysctl -q net.ipv4.ip_forward=1 155 + 156 + ping_test "$nsclient1" 10.0.1.99 157 + ping_test "$nsclient1" 10.0.2.1 158 + ping_test "$nsclient2" 10.0.1.1 159 + 160 + spawn_servers "$nsclient2" 161 + 162 + # exercise clash resolution with nat: 163 + # nsrouter is supposed to dnat to 10.0.2.1:900{0,1,2,3}. 164 + run_clash_test "$nsclient1" 10.0.1.99 "$dport" 165 + 166 + # exercise clash resolution without nat. 167 + load_simple_ruleset "$nsclient2" 168 + run_clash_test "$nsclient2" 127.0.0.1 9001 169 + 170 + if [ $clash_resolution_active -eq 0 ];then 171 + [ "$ret" -eq 0 ] && ret=$ksft_skip 172 + echo "SKIP: Clash resolution did not trigger" 173 + fi 174 + 175 + exit $ret

+92 -5

tools/testing/selftests/net/netfilter/conntrack_resize.sh

··· 12 12 tmpfile_proc="" 13 13 tmpfile_uniq="" 14 14 ret=0 15 + have_socat=0 16 + 17 + socat -h > /dev/null && have_socat=1 15 18 16 19 insert_count=2000 17 20 [ "$KSFT_MACHINE_SLOW" = "yes" ] && insert_count=400 ··· 126 123 done 127 124 } 128 125 129 - ctflood() 126 + ct_pingflood() 130 127 { 131 128 local ns="$1" 132 129 local duration="$2" ··· 155 152 wait 156 153 } 157 154 155 + ct_udpflood() 156 + { 157 + local ns="$1" 158 + local duration="$2" 159 + local now=$(date +%s) 160 + local end=$((now + duration)) 161 + 162 + [ $have_socat -ne "1" ] && return 163 + 164 + while [ $now -lt $end ]; do 165 + ip netns exec "$ns" bash<<"EOF" 166 + for i in $(seq 1 100);do 167 + dport=$(((RANDOM%65536)+1)) 168 + 169 + echo bar | socat -u STDIN UDP:"127.0.0.1:$dport" & 170 + done > /dev/null 2>&1 171 + wait 172 + EOF 173 + now=$(date +%s) 174 + done 175 + } 176 + 177 + ct_udpclash() 178 + { 179 + local ns="$1" 180 + local duration="$2" 181 + local now=$(date +%s) 182 + local end=$((now + duration)) 183 + 184 + [ -x udpclash ] || return 185 + 186 + while [ $now -lt $end ]; do 187 + ip netns exec "$ns" ./udpclash 127.0.0.1 $((RANDOM%65536)) > /dev/null 2>&1 188 + 189 + now=$(date +%s) 190 + done 191 + } 192 + 158 193 # dump to /dev/null. We don't want dumps to cause infinite loops 159 194 # or use-after-free even when conntrack table is altered while dumps 160 195 # are in progress. ··· 208 167 fi 209 168 210 169 wait 170 + } 171 + 172 + ct_nulldump_loop() 173 + { 174 + local ns="$1" 175 + local duration="$2" 176 + local now=$(date +%s) 177 + local end=$((now + duration)) 178 + 179 + while [ $now -lt $end ]; do 180 + ct_nulldump "$ns" 181 + sleep $((RANDOM%2)) 182 + now=$(date +%s) 183 + done 184 + } 185 + 186 + change_timeouts() 187 + { 188 + local ns="$1" 189 + local r1=$((RANDOM%2)) 190 + local r2=$((RANDOM%2)) 191 + 192 + [ "$r1" -eq 1 ] && ip netns exec "$ns" sysctl -q net.netfilter.nf_conntrack_icmp_timeout=$((RANDOM%5)) 193 + [ "$r2" -eq 1 ] && ip netns exec "$ns" sysctl -q net.netfilter.nf_conntrack_udp_timeout=$((RANDOM%5)) 194 + } 195 + 196 + ct_change_timeouts_loop() 197 + { 198 + local ns="$1" 199 + local duration="$2" 200 + local now=$(date +%s) 201 + local end=$((now + duration)) 202 + 203 + while [ $now -lt $end ]; do 204 + change_timeouts "$ns" 205 + sleep $((RANDOM%2)) 206 + now=$(date +%s) 207 + done 208 + 209 + # restore defaults 210 + ip netns exec "$ns" sysctl -q net.netfilter.nf_conntrack_icmp_timeout=30 211 + ip netns exec "$ns" sysctl -q net.netfilter.nf_conntrack_udp_timeout=30 211 212 } 212 213 213 214 check_taint() ··· 281 198 282 199 r=$((RANDOM%$insert_count)) 283 200 284 - ctflood "$n" "$timeout" "floodresize" & 201 + ct_pingflood "$n" "$timeout" "floodresize" & 202 + ct_udpflood "$n" "$timeout" & 203 + ct_udpclash "$n" "$timeout" & 204 + 285 205 insert_ctnetlink "$n" "$r" & 286 206 ctflush "$n" "$timeout" & 287 - ct_nulldump "$n" & 207 + ct_nulldump_loop "$n" "$timeout" & 208 + ct_change_timeouts_loop "$n" "$timeout" & 288 209 289 210 wait 290 211 } ··· 393 306 394 307 ip netns exec "$nsclient1" sysctl -q net.netfilter.nf_conntrack_icmp_timeout=3600 395 308 396 - ctflood "$nsclient1" $timeout "dumpall" & 309 + ct_pingflood "$nsclient1" $timeout "dumpall" & 397 310 insert_ctnetlink "$nsclient2" $insert_count 398 311 399 312 wait ··· 455 368 ct_flush_once "$nsclient1" 456 369 ct_flush_once "$nsclient2" 457 370 458 - ctflood "$nsclient1" "$timeout" "conntrack disable" 371 + ct_pingflood "$nsclient1" "$timeout" "conntrack disable" 459 372 ip netns exec "$nsclient2" ping -q -c 1 127.0.0.1 >/dev/null 2>&1 460 373 461 374 # Disabled, should not have picked up any connection.

+3

tools/testing/selftests/net/netfilter/nft_concat_range.sh

··· 1311 1311 # - remove some elements, check that packets don't match anymore 1312 1312 test_correctness_main() { 1313 1313 range_size=1 1314 + 1315 + send_nomatch $((end + 1)) $((end + 1 + src_delta)) || return 1 1316 + 1314 1317 for i in $(seq "${start}" $((start + count))); do 1315 1318 local elem="" 1316 1319

+158

tools/testing/selftests/net/netfilter/udpclash.c

··· 1 + // SPDX-License-Identifier: GPL-2.0 2 + 3 + /* Usage: ./udpclash <IP> <PORT> 4 + * 5 + * Emit THREAD_COUNT UDP packets sharing the same saddr:daddr pair. 6 + * 7 + * This mimics DNS resolver libraries that emit A and AAAA requests 8 + * in parallel. 9 + * 10 + * This exercises conntrack clash resolution logic added and later 11 + * refined in 12 + * 13 + * 71d8c47fc653 ("netfilter: conntrack: introduce clash resolution on insertion race") 14 + * ed07d9a021df ("netfilter: nf_conntrack: resolve clash for matching conntracks") 15 + * 6a757c07e51f ("netfilter: conntrack: allow insertion of clashing entries") 16 + */ 17 + #include <stdio.h> 18 + #include <string.h> 19 + #include <stdlib.h> 20 + #include <unistd.h> 21 + #include <arpa/inet.h> 22 + #include <sys/socket.h> 23 + #include <pthread.h> 24 + 25 + #define THREAD_COUNT 128 26 + 27 + struct thread_args { 28 + const struct sockaddr_in *si_remote; 29 + int sockfd; 30 + }; 31 + 32 + static int wait = 1; 33 + 34 + static void *thread_main(void *varg) 35 + { 36 + const struct sockaddr_in *si_remote; 37 + const struct thread_args *args = varg; 38 + static const char msg[] = "foo"; 39 + 40 + si_remote = args->si_remote; 41 + 42 + while (wait == 1) 43 + ; 44 + 45 + if (sendto(args->sockfd, msg, strlen(msg), MSG_NOSIGNAL, 46 + (struct sockaddr *)si_remote, sizeof(*si_remote)) < 0) 47 + exit(111); 48 + 49 + return varg; 50 + } 51 + 52 + static int run_test(int fd, const struct sockaddr_in *si_remote) 53 + { 54 + struct thread_args thread_args = { 55 + .si_remote = si_remote, 56 + .sockfd = fd, 57 + }; 58 + pthread_t *tid = calloc(THREAD_COUNT, sizeof(pthread_t)); 59 + unsigned int repl_count = 0, timeout = 0; 60 + int i; 61 + 62 + if (!tid) { 63 + perror("calloc"); 64 + return 1; 65 + } 66 + 67 + for (i = 0; i < THREAD_COUNT; i++) { 68 + int err = pthread_create(&tid[i], NULL, &thread_main, &thread_args); 69 + 70 + if (err != 0) { 71 + perror("pthread_create"); 72 + exit(1); 73 + } 74 + } 75 + 76 + wait = 0; 77 + 78 + for (i = 0; i < THREAD_COUNT; i++) 79 + pthread_join(tid[i], NULL); 80 + 81 + while (repl_count < THREAD_COUNT) { 82 + struct sockaddr_in si_repl; 83 + socklen_t si_repl_len = sizeof(si_repl); 84 + char repl[512]; 85 + ssize_t ret; 86 + 87 + ret = recvfrom(fd, repl, sizeof(repl), MSG_NOSIGNAL, 88 + (struct sockaddr *) &si_repl, &si_repl_len); 89 + if (ret < 0) { 90 + if (timeout++ > 5000) { 91 + fputs("timed out while waiting for reply from thread\n", stderr); 92 + break; 93 + } 94 + 95 + /* give reply time to pass though the stack */ 96 + usleep(1000); 97 + continue; 98 + } 99 + 100 + if (si_repl_len != sizeof(*si_remote)) { 101 + fprintf(stderr, "warning: reply has unexpected repl_len %d vs %d\n", 102 + (int)si_repl_len, (int)sizeof(si_repl)); 103 + } else if (si_remote->sin_addr.s_addr != si_repl.sin_addr.s_addr || 104 + si_remote->sin_port != si_repl.sin_port) { 105 + char a[64], b[64]; 106 + 107 + inet_ntop(AF_INET, &si_remote->sin_addr, a, sizeof(a)); 108 + inet_ntop(AF_INET, &si_repl.sin_addr, b, sizeof(b)); 109 + 110 + fprintf(stderr, "reply from wrong source: want %s:%d got %s:%d\n", 111 + a, ntohs(si_remote->sin_port), b, ntohs(si_repl.sin_port)); 112 + } 113 + 114 + repl_count++; 115 + } 116 + 117 + printf("got %d of %d replies\n", repl_count, THREAD_COUNT); 118 + 119 + free(tid); 120 + 121 + return repl_count == THREAD_COUNT ? 0 : 1; 122 + } 123 + 124 + int main(int argc, char *argv[]) 125 + { 126 + struct sockaddr_in si_local = { 127 + .sin_family = AF_INET, 128 + }; 129 + struct sockaddr_in si_remote = { 130 + .sin_family = AF_INET, 131 + }; 132 + int fd, ret; 133 + 134 + if (argc < 3) { 135 + fputs("Usage: send_udp <daddr> <dport>\n", stderr); 136 + return 1; 137 + } 138 + 139 + si_remote.sin_port = htons(atoi(argv[2])); 140 + si_remote.sin_addr.s_addr = inet_addr(argv[1]); 141 + 142 + fd = socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_UDP); 143 + if (fd < 0) { 144 + perror("socket"); 145 + return 1; 146 + } 147 + 148 + if (bind(fd, (struct sockaddr *)&si_local, sizeof(si_local)) < 0) { 149 + perror("bind"); 150 + return 1; 151 + } 152 + 153 + ret = run_test(fd, &si_remote); 154 + 155 + close(fd); 156 + 157 + return ret; 158 + }

+4 -4

tools/testing/selftests/net/udpgro.sh

··· 48 48 49 49 cfg_veth 50 50 51 - ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 10 ${rx_args} & 51 + ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 100 ${rx_args} & 52 52 local PID1=$! 53 53 54 54 wait_local_port_listen ${PEER_NS} 8000 udp ··· 95 95 # will land on the 'plain' one 96 96 ip netns exec "${PEER_NS}" ./udpgso_bench_rx -G ${family} -b ${addr1} -n 0 & 97 97 local PID1=$! 98 - ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 10 ${family} -b ${addr2%/*} ${rx_args} & 98 + ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 100 ${family} -b ${addr2%/*} ${rx_args} & 99 99 local PID2=$! 100 100 101 101 wait_local_port_listen "${PEER_NS}" 8000 udp ··· 117 117 118 118 cfg_veth 119 119 120 - ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 10 ${rx_args} -p 12345 & 120 + ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 1000 -R 100 ${rx_args} -p 12345 & 121 121 local PID1=$! 122 - ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 2000 -R 10 ${rx_args} & 122 + ip netns exec "${PEER_NS}" ./udpgso_bench_rx -C 2000 -R 100 ${rx_args} & 123 123 local PID2=$! 124 124 125 125 wait_local_port_listen "${PEER_NS}" 12345 udp

+86 -12

tools/testing/selftests/net/vlan_hw_filter.sh

··· 3 3 4 4 readonly NETNS="ns-$(mktemp -u XXXXXX)" 5 5 6 + ALL_TESTS=" 7 + test_vlan_filter_check 8 + test_vlan0_del_crash_01 9 + test_vlan0_del_crash_02 10 + test_vlan0_del_crash_03 11 + test_vid0_memleak 12 + " 13 + 6 14 ret=0 7 15 16 + setup() { 17 + ip netns add ${NETNS} 18 + } 19 + 8 20 cleanup() { 9 - ip netns del $NETNS 21 + ip netns del $NETNS 2>/dev/null 10 22 } 11 23 12 24 trap cleanup EXIT 13 25 14 26 fail() { 15 - echo "ERROR: ${1:-unexpected return code} (ret: $_)" >&2 16 - ret=1 27 + echo "ERROR: ${1:-unexpected return code} (ret: $_)" >&2 28 + ret=1 17 29 } 18 30 19 - ip netns add ${NETNS} 20 - ip netns exec ${NETNS} ip link add bond0 type bond mode 0 21 - ip netns exec ${NETNS} ip link add bond_slave_1 type veth peer veth2 22 - ip netns exec ${NETNS} ip link set bond_slave_1 master bond0 23 - ip netns exec ${NETNS} ethtool -K bond0 rx-vlan-filter off 24 - ip netns exec ${NETNS} ip link add link bond_slave_1 name bond_slave_1.0 type vlan id 0 25 - ip netns exec ${NETNS} ip link add link bond0 name bond0.0 type vlan id 0 26 - ip netns exec ${NETNS} ip link set bond_slave_1 nomaster 27 - ip netns exec ${NETNS} ip link del veth2 || fail "Please check vlan HW filter function" 31 + tests_run() 32 + { 33 + local current_test 34 + for current_test in ${TESTS:-$ALL_TESTS}; do 35 + $current_test 36 + done 37 + } 28 38 39 + test_vlan_filter_check() { 40 + setup 41 + ip netns exec ${NETNS} ip link add bond0 type bond mode 0 42 + ip netns exec ${NETNS} ip link add bond_slave_1 type veth peer veth2 43 + ip netns exec ${NETNS} ip link set bond_slave_1 master bond0 44 + ip netns exec ${NETNS} ethtool -K bond0 rx-vlan-filter off 45 + ip netns exec ${NETNS} ip link add link bond_slave_1 name bond_slave_1.0 type vlan id 0 46 + ip netns exec ${NETNS} ip link add link bond0 name bond0.0 type vlan id 0 47 + ip netns exec ${NETNS} ip link set bond_slave_1 nomaster 48 + ip netns exec ${NETNS} ip link del veth2 || fail "Please check vlan HW filter function" 49 + cleanup 50 + } 51 + 52 + #enable vlan_filter feature of real_dev with vlan0 during running time 53 + test_vlan0_del_crash_01() { 54 + setup 55 + ip netns exec ${NETNS} ip link add bond0 type bond mode 0 56 + ip netns exec ${NETNS} ip link add link bond0 name vlan0 type vlan id 0 protocol 802.1q 57 + ip netns exec ${NETNS} ethtool -K bond0 rx-vlan-filter off 58 + ip netns exec ${NETNS} ifconfig bond0 up 59 + ip netns exec ${NETNS} ethtool -K bond0 rx-vlan-filter on 60 + ip netns exec ${NETNS} ifconfig bond0 down 61 + ip netns exec ${NETNS} ifconfig bond0 up 62 + ip netns exec ${NETNS} ip link del vlan0 || fail "Please check vlan HW filter function" 63 + cleanup 64 + } 65 + 66 + #enable vlan_filter feature and add vlan0 for real_dev during running time 67 + test_vlan0_del_crash_02() { 68 + setup 69 + ip netns exec ${NETNS} ip link add bond0 type bond mode 0 70 + ip netns exec ${NETNS} ethtool -K bond0 rx-vlan-filter off 71 + ip netns exec ${NETNS} ifconfig bond0 up 72 + ip netns exec ${NETNS} ethtool -K bond0 rx-vlan-filter on 73 + ip netns exec ${NETNS} ip link add link bond0 name vlan0 type vlan id 0 protocol 802.1q 74 + ip netns exec ${NETNS} ifconfig bond0 down 75 + ip netns exec ${NETNS} ifconfig bond0 up 76 + ip netns exec ${NETNS} ip link del vlan0 || fail "Please check vlan HW filter function" 77 + cleanup 78 + } 79 + 80 + #enable vlan_filter feature of real_dev during running time 81 + #test kernel_bug of vlan unregister 82 + test_vlan0_del_crash_03() { 83 + setup 84 + ip netns exec ${NETNS} ip link add bond0 type bond mode 0 85 + ip netns exec ${NETNS} ip link add link bond0 name vlan0 type vlan id 0 protocol 802.1q 86 + ip netns exec ${NETNS} ethtool -K bond0 rx-vlan-filter off 87 + ip netns exec ${NETNS} ifconfig bond0 up 88 + ip netns exec ${NETNS} ethtool -K bond0 rx-vlan-filter on 89 + ip netns exec ${NETNS} ifconfig bond0 down 90 + ip netns exec ${NETNS} ip link del vlan0 || fail "Please check vlan HW filter function" 91 + cleanup 92 + } 93 + 94 + test_vid0_memleak() { 95 + setup 96 + ip netns exec ${NETNS} ip link add bond0 up type bond mode 0 97 + ip netns exec ${NETNS} ethtool -K bond0 rx-vlan-filter off 98 + ip netns exec ${NETNS} ip link del dev bond0 || fail "Please check vlan HW filter function" 99 + cleanup 100 + } 101 + 102 + tests_run 29 103 exit $ret

+92

tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json

··· 128 128 ] 129 129 }, 130 130 { 131 + "id": "5456", 132 + "name": "Test htb_dequeue_tree with deactivation and row emptying", 133 + "category": [ 134 + "qdisc", 135 + "htb" 136 + ], 137 + "plugins": { 138 + "requires": "nsPlugin" 139 + }, 140 + "setup": [ 141 + "$IP link set dev $DUMMY up || true", 142 + "$IP addr add 10.10.11.10/24 dev $DUMMY || true", 143 + "$TC qdisc add dev $DUMMY root handle 1: htb default 1", 144 + "$TC class add dev $DUMMY parent 1: classid 1:1 htb rate 64bit ", 145 + "$TC qdisc add dev $DUMMY parent 1:1 handle 2: netem", 146 + "$TC qdisc add dev $DUMMY parent 2:1 handle 3: blackhole" 147 + ], 148 + "cmdUnderTest": "ping -c1 -W0.01 -I $DUMMY 10.10.11.11", 149 + "expExitCode": "1", 150 + "verifyCmd": "$TC -j qdisc show dev $DUMMY", 151 + "matchJSON": [], 152 + "teardown": [ 153 + "$TC qdisc del dev $DUMMY root" 154 + ] 155 + }, 156 + { 131 157 "id": "c024", 132 158 "name": "Test TBF with SKBPRIO - catch qlen corner cases", 133 159 "category": [ ··· 696 670 "matchJSON": [], 697 671 "teardown": [ 698 672 "$TC qdisc del dev $DUMMY root handle 1: drr" 673 + ] 674 + }, 675 + { 676 + "id": "be28", 677 + "name": "Try to add fq_codel qdisc as a child of an hhf qdisc", 678 + "category": [ 679 + "qdisc", 680 + "fq_codel", 681 + "hhf" 682 + ], 683 + "plugins": { 684 + "requires": "nsPlugin" 685 + }, 686 + "setup": [ 687 + "$TC qdisc add dev $DUMMY root handle a: hhf" 688 + ], 689 + "cmdUnderTest": "$TC qdisc add dev $DUMMY parent a: handle b: fq_codel", 690 + "expExitCode": "2", 691 + "verifyCmd": "$TC -j qdisc ls dev $DUMMY handle b:", 692 + "matchJSON": [], 693 + "teardown": [ 694 + "$TC qdisc del dev $DUMMY root" 695 + ] 696 + }, 697 + { 698 + "id": "fcb5", 699 + "name": "Try to add pie qdisc as a child of a drr qdisc", 700 + "category": [ 701 + "qdisc", 702 + "pie", 703 + "drr" 704 + ], 705 + "plugins": { 706 + "requires": "nsPlugin" 707 + }, 708 + "setup": [ 709 + "$TC qdisc add dev $DUMMY root handle a: drr" 710 + ], 711 + "cmdUnderTest": "$TC qdisc add dev $DUMMY parent a: handle b: pie", 712 + "expExitCode": "2", 713 + "verifyCmd": "$TC -j qdisc ls dev $DUMMY handle b:", 714 + "matchJSON": [], 715 + "teardown": [ 716 + "$TC qdisc del dev $DUMMY root" 717 + ] 718 + }, 719 + { 720 + "id": "7801", 721 + "name": "Try to add fq qdisc as a child of an inexistent hfsc class", 722 + "category": [ 723 + "qdisc", 724 + "sfq", 725 + "hfsc" 726 + ], 727 + "plugins": { 728 + "requires": "nsPlugin" 729 + }, 730 + "setup": [ 731 + "$TC qdisc add dev $DUMMY root handle a: hfsc" 732 + ], 733 + "cmdUnderTest": "$TC qdisc add dev $DUMMY parent a:fff2 sfq limit 4", 734 + "expExitCode": "2", 735 + "verifyCmd": "$TC -j qdisc ls dev $DUMMY handle b:", 736 + "matchJSON": [], 737 + "teardown": [ 738 + "$TC qdisc del dev $DUMMY root" 699 739 ] 700 740 } 701 741 ]

Configure Feed

Configure Feed