commit: 5d7cccc1dc9c15cd82804ef6615b4a6632d20205 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Sep 28 09:26:43 2022 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Sep 28 09:26:43 2022 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=5d7cccc1
Linux patch 5.4.215 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1214_linux-5.4.215.patch | 4028 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 4032 insertions(+) diff --git a/0000_README b/0000_README index 4de883be..a97a10dc 100644 --- a/0000_README +++ b/0000_README @@ -899,6 +899,10 @@ Patch: 1213_linux-5.4.214.patch From: http://www.kernel.org Desc: Linux 5.4.214 +Patch: 1214_linux-5.4.215.patch +From: http://www.kernel.org +Desc: Linux 5.4.215 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1214_linux-5.4.215.patch b/1214_linux-5.4.215.patch new file mode 100644 index 00000000..4036c8a4 --- /dev/null +++ b/1214_linux-5.4.215.patch @@ -0,0 +1,4028 @@ +diff --git a/MAINTAINERS b/MAINTAINERS +index f45d6548a4aa8..973fcc9143d1e 100644 +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -17864,7 +17864,8 @@ S: Supported + F: sound/xen/* + + XFS FILESYSTEM +-M: Darrick J. Wong <[email protected]> ++M: Chandan Babu R <[email protected]> ++M: Darrick J. Wong <[email protected]> + M: [email protected] + L: [email protected] + W: http://xfs.org/ +diff --git a/Makefile b/Makefile +index 59f34d7f6f3b2..0c501d2c6a3b0 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 214 ++SUBLEVEL = 215 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts b/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts +index a9f4d6d7d2b75..586351340da66 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts +@@ -77,3 +77,8 @@ + }; + }; + }; ++ ++&wlan_host_wake_l { ++ /* Kevin has an external pull up, but Bob does not. */ ++ rockchip,pins = <0 RK_PB0 RK_FUNC_GPIO &pcfg_pull_up>; ++}; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi +index 7cd6d470c1cbd..7416db3d27a77 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi +@@ -237,6 +237,14 @@ + &edp { + status = "okay"; + ++ /* ++ * eDP PHY/clk don't sync reliably at anything other than 24 MHz. Only ++ * set this here, because rk3399-gru.dtsi ensures we can generate this ++ * off GPLL=600MHz, whereas some other RK3399 boards may not. ++ */ ++ assigned-clocks = <&cru PCLK_EDP>; ++ assigned-clock-rates = <24000000>; ++ + ports { + edp_out: port@1 { + reg = <1>; +@@ -397,6 +405,7 @@ ap_i2c_tp: &i2c5 { + }; + + wlan_host_wake_l: wlan-host-wake-l { ++ /* Kevin has an external pull up, but Bob does not */ + rockchip,pins = <0 RK_PB0 RK_FUNC_GPIO &pcfg_pull_none>; + }; + }; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +index 390b86ec65389..365fa9a3c5bfb 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +@@ -102,7 +102,6 @@ + vcc5v0_host: vcc5v0-host-regulator { + compatible = "regulator-fixed"; + gpio = <&gpio4 RK_PA3 GPIO_ACTIVE_LOW>; +- enable-active-low; + pinctrl-names = "default"; + pinctrl-0 = <&vcc5v0_host_en>; + regulator-name = "vcc5v0_host"; +diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c +index 3ad1f76c063a9..2d5e7b21d9600 100644 +--- a/arch/mips/cavium-octeon/octeon-irq.c ++++ b/arch/mips/cavium-octeon/octeon-irq.c +@@ -127,6 +127,16 @@ static void octeon_irq_free_cd(struct irq_domain *d, unsigned int irq) + static int octeon_irq_force_ciu_mapping(struct irq_domain *domain, + int irq, int line, int bit) + { ++ struct device_node *of_node; ++ int ret; ++ ++ of_node = irq_domain_get_of_node(domain); ++ if (!of_node) ++ return -EINVAL; ++ ret = irq_alloc_desc_at(irq, of_node_to_nid(of_node)); ++ if (ret < 0) ++ return ret; ++ + return irq_domain_associate(domain, irq, line << 6 | bit); + } + +diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c +index 7a623684d9b5e..2d5a0bcb0cec1 100644 +--- a/arch/mips/lantiq/clk.c ++++ b/arch/mips/lantiq/clk.c +@@ -50,6 +50,7 @@ struct clk *clk_get_io(void) + { + return &cpu_clk_generic[2]; + } ++EXPORT_SYMBOL_GPL(clk_get_io); + + struct clk *clk_get_ppe(void) + { +diff --git a/arch/mips/loongson32/common/platform.c b/arch/mips/loongson32/common/platform.c +index 794c96c2a4cdd..311dc1580bbde 100644 +--- a/arch/mips/loongson32/common/platform.c ++++ b/arch/mips/loongson32/common/platform.c +@@ -98,7 +98,7 @@ int ls1x_eth_mux_init(struct platform_device *pdev, void *priv) + if (plat_dat->bus_id) { + __raw_writel(__raw_readl(LS1X_MUX_CTRL0) | GMAC1_USE_UART1 | + GMAC1_USE_UART0, LS1X_MUX_CTRL0); +- switch (plat_dat->interface) { ++ switch (plat_dat->phy_interface) { + case PHY_INTERFACE_MODE_RGMII: + val &= ~(GMAC1_USE_TXCLK | GMAC1_USE_PWM23); + break; +@@ -107,12 +107,12 @@ int ls1x_eth_mux_init(struct platform_device *pdev, void *priv) + break; + default: + pr_err("unsupported mii mode %d\n", +- plat_dat->interface); ++ plat_dat->phy_interface); + return -ENOTSUPP; + } + val &= ~GMAC1_SHUT; + } else { +- switch (plat_dat->interface) { ++ switch (plat_dat->phy_interface) { + case PHY_INTERFACE_MODE_RGMII: + val &= ~(GMAC0_USE_TXCLK | GMAC0_USE_PWM01); + break; +@@ -121,7 +121,7 @@ int ls1x_eth_mux_init(struct platform_device *pdev, void *priv) + break; + default: + pr_err("unsupported mii mode %d\n", +- plat_dat->interface); ++ plat_dat->phy_interface); + return -ENOTSUPP; + } + val &= ~GMAC0_SHUT; +@@ -131,7 +131,7 @@ int ls1x_eth_mux_init(struct platform_device *pdev, void *priv) + plat_dat = dev_get_platdata(&pdev->dev); + + val &= ~PHY_INTF_SELI; +- if (plat_dat->interface == PHY_INTERFACE_MODE_RMII) ++ if (plat_dat->phy_interface == PHY_INTERFACE_MODE_RMII) + val |= 0x4 << PHY_INTF_SELI_SHIFT; + __raw_writel(val, LS1X_MUX_CTRL1); + +@@ -146,9 +146,9 @@ static struct plat_stmmacenet_data ls1x_eth0_pdata = { + .bus_id = 0, + .phy_addr = -1, + #if defined(CONFIG_LOONGSON1_LS1B) +- .interface = PHY_INTERFACE_MODE_MII, ++ .phy_interface = PHY_INTERFACE_MODE_MII, + #elif defined(CONFIG_LOONGSON1_LS1C) +- .interface = PHY_INTERFACE_MODE_RMII, ++ .phy_interface = PHY_INTERFACE_MODE_RMII, + #endif + .mdio_bus_data = &ls1x_mdio_bus_data, + .dma_cfg = &ls1x_eth_dma_cfg, +@@ -186,7 +186,7 @@ struct platform_device ls1x_eth0_pdev = { + static struct plat_stmmacenet_data ls1x_eth1_pdata = { + .bus_id = 1, + .phy_addr = -1, +- .interface = PHY_INTERFACE_MODE_MII, ++ .phy_interface = PHY_INTERFACE_MODE_MII, + .mdio_bus_data = &ls1x_mdio_bus_data, + .dma_cfg = &ls1x_eth_dma_cfg, + .has_gmac = 1, +diff --git a/arch/x86/include/asm/cpu_entry_area.h b/arch/x86/include/asm/cpu_entry_area.h +index ea866c7bf31d3..0d1d37d8b279f 100644 +--- a/arch/x86/include/asm/cpu_entry_area.h ++++ b/arch/x86/include/asm/cpu_entry_area.h +@@ -133,7 +133,7 @@ extern void cea_set_pte(void *cea_vaddr, phys_addr_t pa, pgprot_t flags); + + extern struct cpu_entry_area *get_cpu_entry_area(int cpu); + +-static inline struct entry_stack *cpu_entry_stack(int cpu) ++static __always_inline struct entry_stack *cpu_entry_stack(int cpu) + { + return &get_cpu_entry_area(cpu)->entry_stack_page.stack; + } +diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c +index edba5e7a37437..c8a1ef872e0d9 100644 +--- a/drivers/firmware/efi/libstub/secureboot.c ++++ b/drivers/firmware/efi/libstub/secureboot.c +@@ -19,7 +19,7 @@ static const efi_char16_t efi_SetupMode_name[] = L"SetupMode"; + + /* SHIM variables */ + static const efi_guid_t shim_guid = EFI_SHIM_LOCK_GUID; +-static const efi_char16_t shim_MokSBState_name[] = L"MokSBState"; ++static const efi_char16_t shim_MokSBState_name[] = L"MokSBStateRT"; + + #define get_efi_var(name, vendor, ...) \ + efi_call_runtime(get_variable, \ +@@ -58,8 +58,8 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg) + + /* + * See if a user has put the shim into insecure mode. If so, and if the +- * variable doesn't have the runtime attribute set, we might as well +- * honor that. ++ * variable doesn't have the non-volatile attribute set, we might as ++ * well honor that. + */ + size = sizeof(moksbstate); + status = get_efi_var(shim_MokSBState_name, &shim_guid, +@@ -68,7 +68,7 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg) + /* If it fails, we don't care why. Default to secure */ + if (status != EFI_SUCCESS) + goto secure_boot_enabled; +- if (!(attr & EFI_VARIABLE_RUNTIME_ACCESS) && moksbstate == 1) ++ if (!(attr & EFI_VARIABLE_NON_VOLATILE) && moksbstate == 1) + return efi_secureboot_mode_disabled; + + secure_boot_enabled: +diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c +index d72a3a5507b01..f3bf82efea8e3 100644 +--- a/drivers/gpio/gpio-mpc8xxx.c ++++ b/drivers/gpio/gpio-mpc8xxx.c +@@ -190,6 +190,7 @@ static int mpc8xxx_irq_set_type(struct irq_data *d, unsigned int flow_type) + + switch (flow_type) { + case IRQ_TYPE_EDGE_FALLING: ++ case IRQ_TYPE_LEVEL_LOW: + raw_spin_lock_irqsave(&mpc8xxx_gc->lock, flags); + gc->write_reg(mpc8xxx_gc->regs + GPIO_ICR, + gc->read_reg(mpc8xxx_gc->regs + GPIO_ICR) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +index b588e0e409e72..d8687868407de 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +@@ -35,6 +35,7 @@ + #include <linux/pci.h> + #include <linux/pm_runtime.h> + #include <drm/drm_crtc_helper.h> ++#include <drm/drm_damage_helper.h> + #include <drm/drm_edid.h> + #include <drm/drm_gem_framebuffer_helper.h> + #include <drm/drm_fb_helper.h> +@@ -495,6 +496,7 @@ bool amdgpu_display_ddc_probe(struct amdgpu_connector *amdgpu_connector, + static const struct drm_framebuffer_funcs amdgpu_fb_funcs = { + .destroy = drm_gem_fb_destroy, + .create_handle = drm_gem_fb_create_handle, ++ .dirty = drm_atomic_helper_dirtyfb, + }; + + uint32_t amdgpu_display_supported_domains(struct amdgpu_device *adev, +diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c +index e042d8ce05b4a..22d105635e338 100644 +--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c ++++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c +@@ -1486,6 +1486,7 @@ static void interpolate_user_regamma(uint32_t hw_points_num, + struct fixed31_32 lut2; + struct fixed31_32 delta_lut; + struct fixed31_32 delta_index; ++ const struct fixed31_32 one = dc_fixpt_from_int(1); + + i = 0; + /* fixed_pt library has problems handling too small values */ +@@ -1514,6 +1515,9 @@ static void interpolate_user_regamma(uint32_t hw_points_num, + } else + hw_x = coordinates_x[i].x; + ++ if (dc_fixpt_le(one, hw_x)) ++ hw_x = one; ++ + norm_x = dc_fixpt_mul(norm_factor, hw_x); + index = dc_fixpt_floor(norm_x); + if (index < 0 || index > 255) +diff --git a/drivers/gpu/drm/meson/meson_plane.c b/drivers/gpu/drm/meson/meson_plane.c +index ed543227b00dd..53f5d0581c355 100644 +--- a/drivers/gpu/drm/meson/meson_plane.c ++++ b/drivers/gpu/drm/meson/meson_plane.c +@@ -128,7 +128,7 @@ static void meson_plane_atomic_update(struct drm_plane *plane, + + /* Enable OSD and BLK0, set max global alpha */ + priv->viu.osd1_ctrl_stat = OSD_ENABLE | +- (0xFF << OSD_GLOBAL_ALPHA_SHIFT) | ++ (0x100 << OSD_GLOBAL_ALPHA_SHIFT) | + OSD_BLK0_ENABLE; + + canvas_id_osd1 = priv->canvas_id_osd1; +diff --git a/drivers/gpu/drm/meson/meson_viu.c b/drivers/gpu/drm/meson/meson_viu.c +index 9991f0a43b1ab..8d09385259780 100644 +--- a/drivers/gpu/drm/meson/meson_viu.c ++++ b/drivers/gpu/drm/meson/meson_viu.c +@@ -91,7 +91,7 @@ static void meson_viu_set_g12a_osd1_matrix(struct meson_drm *priv, + priv->io_base + _REG(VPP_WRAP_OSD1_MATRIX_COEF11_12)); + writel(((m[9] & 0x1fff) << 16) | (m[10] & 0x1fff), + priv->io_base + _REG(VPP_WRAP_OSD1_MATRIX_COEF20_21)); +- writel((m[11] & 0x1fff) << 16, ++ writel((m[11] & 0x1fff), + priv->io_base + _REG(VPP_WRAP_OSD1_MATRIX_COEF22)); + + writel(((m[18] & 0xfff) << 16) | (m[19] & 0xfff), +diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c +index 8f299d76b69b8..67dae1354aa65 100644 +--- a/drivers/gpu/drm/rockchip/cdn-dp-core.c ++++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c +@@ -275,8 +275,9 @@ static int cdn_dp_connector_get_modes(struct drm_connector *connector) + return ret; + } + +-static int cdn_dp_connector_mode_valid(struct drm_connector *connector, +- struct drm_display_mode *mode) ++static enum drm_mode_status ++cdn_dp_connector_mode_valid(struct drm_connector *connector, ++ struct drm_display_mode *mode) + { + struct cdn_dp_device *dp = connector_to_dp(connector); + struct drm_display_info *display_info = &dp->connector.display_info; +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index 56918274c48cf..d4c5efc6e157b 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -2075,7 +2075,7 @@ int vmbus_allocate_mmio(struct resource **new, struct hv_device *device_obj, + bool fb_overlap_ok) + { + struct resource *iter, *shadow; +- resource_size_t range_min, range_max, start; ++ resource_size_t range_min, range_max, start, end; + const char *dev_n = dev_name(&device_obj->device); + int retval; + +@@ -2110,6 +2110,14 @@ int vmbus_allocate_mmio(struct resource **new, struct hv_device *device_obj, + range_max = iter->end; + start = (range_min + align - 1) & ~(align - 1); + for (; start + size - 1 <= range_max; start += align) { ++ end = start + size - 1; ++ ++ /* Skip the whole fb_mmio region if not fb_overlap_ok */ ++ if (!fb_overlap_ok && fb_mmio && ++ (((start >= fb_mmio->start) && (start <= fb_mmio->end)) || ++ ((end >= fb_mmio->start) && (end <= fb_mmio->end)))) ++ continue; ++ + shadow = __request_region(iter, start, size, NULL, + IORESOURCE_BUSY); + if (!shadow) +diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c +index bf4ab30186aff..abd2a57b18cbb 100644 +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -678,6 +678,7 @@ static int gs_can_open(struct net_device *netdev) + flags |= GS_CAN_MODE_TRIPLE_SAMPLE; + + /* finally start device */ ++ dev->can.state = CAN_STATE_ERROR_ACTIVE; + dm->mode = cpu_to_le32(GS_CAN_MODE_START); + dm->flags = cpu_to_le32(flags); + rc = usb_control_msg(interface_to_usbdev(dev->iface), +@@ -694,13 +695,12 @@ static int gs_can_open(struct net_device *netdev) + if (rc < 0) { + netdev_err(netdev, "Couldn't start device (err=%d)\n", rc); + kfree(dm); ++ dev->can.state = CAN_STATE_STOPPED; + return rc; + } + + kfree(dm); + +- dev->can.state = CAN_STATE_ERROR_ACTIVE; +- + parent->active_channels++; + if (!(dev->can.ctrlmode & CAN_CTRLMODE_LISTENONLY)) + netif_start_queue(netdev); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 2d01eaeb703af..15f177185d71d 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -5638,6 +5638,26 @@ static int i40e_get_link_speed(struct i40e_vsi *vsi) + } + } + ++/** ++ * i40e_bw_bytes_to_mbits - Convert max_tx_rate from bytes to mbits ++ * @vsi: Pointer to vsi structure ++ * @max_tx_rate: max TX rate in bytes to be converted into Mbits ++ * ++ * Helper function to convert units before send to set BW limit ++ **/ ++static u64 i40e_bw_bytes_to_mbits(struct i40e_vsi *vsi, u64 max_tx_rate) ++{ ++ if (max_tx_rate < I40E_BW_MBPS_DIVISOR) { ++ dev_warn(&vsi->back->pdev->dev, ++ "Setting max tx rate to minimum usable value of 50Mbps.\n"); ++ max_tx_rate = I40E_BW_CREDIT_DIVISOR; ++ } else { ++ do_div(max_tx_rate, I40E_BW_MBPS_DIVISOR); ++ } ++ ++ return max_tx_rate; ++} ++ + /** + * i40e_set_bw_limit - setup BW limit for Tx traffic based on max_tx_rate + * @vsi: VSI to be configured +@@ -5660,10 +5680,10 @@ int i40e_set_bw_limit(struct i40e_vsi *vsi, u16 seid, u64 max_tx_rate) + max_tx_rate, seid); + return -EINVAL; + } +- if (max_tx_rate && max_tx_rate < 50) { ++ if (max_tx_rate && max_tx_rate < I40E_BW_CREDIT_DIVISOR) { + dev_warn(&pf->pdev->dev, + "Setting max tx rate to minimum usable value of 50Mbps.\n"); +- max_tx_rate = 50; ++ max_tx_rate = I40E_BW_CREDIT_DIVISOR; + } + + /* Tx rate credits are in values of 50Mbps, 0 is disabled */ +@@ -7591,9 +7611,9 @@ config_tc: + + if (pf->flags & I40E_FLAG_TC_MQPRIO) { + if (vsi->mqprio_qopt.max_rate[0]) { +- u64 max_tx_rate = vsi->mqprio_qopt.max_rate[0]; ++ u64 max_tx_rate = i40e_bw_bytes_to_mbits(vsi, ++ vsi->mqprio_qopt.max_rate[0]); + +- do_div(max_tx_rate, I40E_BW_MBPS_DIVISOR); + ret = i40e_set_bw_limit(vsi, vsi->seid, max_tx_rate); + if (!ret) { + u64 credits = max_tx_rate; +@@ -10247,10 +10267,10 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired) + } + + if (vsi->mqprio_qopt.max_rate[0]) { +- u64 max_tx_rate = vsi->mqprio_qopt.max_rate[0]; ++ u64 max_tx_rate = i40e_bw_bytes_to_mbits(vsi, ++ vsi->mqprio_qopt.max_rate[0]); + u64 credits = 0; + +- do_div(max_tx_rate, I40E_BW_MBPS_DIVISOR); + ret = i40e_set_bw_limit(vsi, vsi->seid, max_tx_rate); + if (ret) + goto end_unlock; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 4080fdacca4cc..16f5baafbbd52 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1873,6 +1873,25 @@ static void i40e_del_qch(struct i40e_vf *vf) + } + } + ++/** ++ * i40e_vc_get_max_frame_size ++ * @vf: pointer to the VF ++ * ++ * Max frame size is determined based on the current port's max frame size and ++ * whether a port VLAN is configured on this VF. The VF is not aware whether ++ * it's in a port VLAN so the PF needs to account for this in max frame size ++ * checks and sending the max frame size to the VF. ++ **/ ++static u16 i40e_vc_get_max_frame_size(struct i40e_vf *vf) ++{ ++ u16 max_frame_size = vf->pf->hw.phy.link_info.max_frame_size; ++ ++ if (vf->port_vlan_id) ++ max_frame_size -= VLAN_HLEN; ++ ++ return max_frame_size; ++} ++ + /** + * i40e_vc_get_vf_resources_msg + * @vf: pointer to the VF info +@@ -1973,6 +1992,7 @@ static int i40e_vc_get_vf_resources_msg(struct i40e_vf *vf, u8 *msg) + vfres->max_vectors = pf->hw.func_caps.num_msix_vectors_vf; + vfres->rss_key_size = I40E_HKEY_ARRAY_SIZE; + vfres->rss_lut_size = I40E_VF_HLUT_ARRAY_SIZE; ++ vfres->max_mtu = i40e_vc_get_max_frame_size(vf); + + if (vf->lan_vsi_idx) { + vfres->vsi_res[0].vsi_id = vf->lan_vsi_id; +diff --git a/drivers/net/ethernet/intel/iavf/iavf_txrx.c b/drivers/net/ethernet/intel/iavf/iavf_txrx.c +index c6905d1b6182c..1f7b842c67638 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_txrx.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_txrx.c +@@ -114,8 +114,11 @@ u32 iavf_get_tx_pending(struct iavf_ring *ring, bool in_sw) + { + u32 head, tail; + ++ /* underlying hardware might not allow access and/or always return ++ * 0 for the head/tail registers so just use the cached values ++ */ + head = ring->next_to_clean; +- tail = readl(ring->tail); ++ tail = ring->next_to_use; + + if (head != tail) + return (head < tail) ? +@@ -1371,7 +1374,7 @@ static struct sk_buff *iavf_build_skb(struct iavf_ring *rx_ring, + #endif + struct sk_buff *skb; + +- if (!rx_buffer) ++ if (!rx_buffer || !size) + return NULL; + /* prefetch first cache line of first page */ + va = page_address(rx_buffer->page) + rx_buffer->page_offset; +@@ -1531,7 +1534,7 @@ static int iavf_clean_rx_irq(struct iavf_ring *rx_ring, int budget) + /* exit if we failed to retrieve a buffer */ + if (!skb) { + rx_ring->rx_stats.alloc_buff_failed++; +- if (rx_buffer) ++ if (rx_buffer && size) + rx_buffer->pagecnt_bias++; + break; + } +diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +index 4d471a6f2946f..7a17694b6a0b1 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +@@ -241,11 +241,14 @@ out: + void iavf_configure_queues(struct iavf_adapter *adapter) + { + struct virtchnl_vsi_queue_config_info *vqci; +- struct virtchnl_queue_pair_info *vqpi; ++ int i, max_frame = adapter->vf_res->max_mtu; + int pairs = adapter->num_active_queues; +- int i, max_frame = IAVF_MAX_RXBUFFER; ++ struct virtchnl_queue_pair_info *vqpi; + size_t len; + ++ if (max_frame > IAVF_MAX_RXBUFFER || !max_frame) ++ max_frame = IAVF_MAX_RXBUFFER; ++ + if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) { + /* bail because we already have a command pending */ + dev_err(&adapter->pdev->dev, "Cannot configure queues, command %d pending\n", +diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c +index 3133f903279ce..dbbbb6ea9f2b6 100644 +--- a/drivers/net/ethernet/sun/sunhme.c ++++ b/drivers/net/ethernet/sun/sunhme.c +@@ -2064,9 +2064,9 @@ static void happy_meal_rx(struct happy_meal *hp, struct net_device *dev) + + skb_reserve(copy_skb, 2); + skb_put(copy_skb, len); +- dma_sync_single_for_cpu(hp->dma_dev, dma_addr, len, DMA_FROM_DEVICE); ++ dma_sync_single_for_cpu(hp->dma_dev, dma_addr, len + 2, DMA_FROM_DEVICE); + skb_copy_from_linear_data(skb, copy_skb->data, len); +- dma_sync_single_for_device(hp->dma_dev, dma_addr, len, DMA_FROM_DEVICE); ++ dma_sync_single_for_device(hp->dma_dev, dma_addr, len + 2, DMA_FROM_DEVICE); + /* Reuse original ring buffer. */ + hme_write_rxd(hp, this, + (RXFLAG_OWN|((RX_BUF_ALLOC_SIZE-RX_OFFSET)<<16)), +diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c +index 8801d093135c3..a33149ee0ddcf 100644 +--- a/drivers/net/ipvlan/ipvlan_core.c ++++ b/drivers/net/ipvlan/ipvlan_core.c +@@ -496,7 +496,6 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb) + + static int ipvlan_process_outbound(struct sk_buff *skb) + { +- struct ethhdr *ethh = eth_hdr(skb); + int ret = NET_XMIT_DROP; + + /* The ipvlan is a pseudo-L2 device, so the packets that we receive +@@ -506,6 +505,8 @@ static int ipvlan_process_outbound(struct sk_buff *skb) + if (skb_mac_header_was_set(skb)) { + /* In this mode we dont care about + * multicast and broadcast traffic */ ++ struct ethhdr *ethh = eth_hdr(skb); ++ + if (is_multicast_ether_addr(ethh->h_dest)) { + pr_debug_ratelimited( + "Dropped {multi|broad}cast of type=[%x]\n", +@@ -590,7 +591,7 @@ out: + static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev) + { + const struct ipvl_dev *ipvlan = netdev_priv(dev); +- struct ethhdr *eth = eth_hdr(skb); ++ struct ethhdr *eth = skb_eth_hdr(skb); + struct ipvl_addr *addr; + void *lyr3h; + int addr_type; +@@ -620,6 +621,7 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev) + return dev_forward_skb(ipvlan->phy_dev, skb); + + } else if (is_multicast_ether_addr(eth->h_dest)) { ++ skb_reset_mac_header(skb); + ipvlan_skb_crossing_ns(skb, NULL); + ipvlan_multicast_enqueue(ipvlan->port, skb, true); + return NET_XMIT_SUCCESS; +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 0eb894b7c0bda..da74ec778b6e7 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -1270,10 +1270,12 @@ static int team_port_add(struct team *team, struct net_device *port_dev, + } + } + +- netif_addr_lock_bh(dev); +- dev_uc_sync_multiple(port_dev, dev); +- dev_mc_sync_multiple(port_dev, dev); +- netif_addr_unlock_bh(dev); ++ if (dev->flags & IFF_UP) { ++ netif_addr_lock_bh(dev); ++ dev_uc_sync_multiple(port_dev, dev); ++ dev_mc_sync_multiple(port_dev, dev); ++ netif_addr_unlock_bh(dev); ++ } + + port->index = -1; + list_add_tail_rcu(&port->list, &team->port_list); +@@ -1344,8 +1346,10 @@ static int team_port_del(struct team *team, struct net_device *port_dev) + netdev_rx_handler_unregister(port_dev); + team_port_disable_netpoll(port); + vlan_vids_del_by_dev(port_dev, dev); +- dev_uc_unsync(port_dev, dev); +- dev_mc_unsync(port_dev, dev); ++ if (dev->flags & IFF_UP) { ++ dev_uc_unsync(port_dev, dev); ++ dev_mc_unsync(port_dev, dev); ++ } + dev_close(port_dev); + team_port_leave(team, port); + +@@ -1694,6 +1698,14 @@ static int team_open(struct net_device *dev) + + static int team_close(struct net_device *dev) + { ++ struct team *team = netdev_priv(dev); ++ struct team_port *port; ++ ++ list_for_each_entry(port, &team->port_list, list) { ++ dev_uc_unsync(port->dev, dev); ++ dev_mc_unsync(port->dev, dev); ++ } ++ + return 0; + } + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 8ef0a013874c5..cee90e505d175 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1046,6 +1046,7 @@ static const struct usb_device_id products[] = { + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */ + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0620)}, /* Quectel EM160R-GL */ + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL */ ++ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0801)}, /* Quectel RM520N */ + + /* 3. Combined interface devices matching on interface number */ + {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */ +diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c +index 943d2a60bfdf9..6d519ef3c5da4 100644 +--- a/drivers/of/fdt.c ++++ b/drivers/of/fdt.c +@@ -315,7 +315,7 @@ static int unflatten_dt_nodes(const void *blob, + for (offset = 0; + offset >= 0 && depth >= initial_depth; + offset = fdt_next_node(blob, offset, &depth)) { +- if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH)) ++ if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH - 1)) + continue; + + if (!IS_ENABLED(CONFIG_OF_KOBJ) && +diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c +index 26ddb4cc675a9..7a3de2b5de0cd 100644 +--- a/drivers/of/of_mdio.c ++++ b/drivers/of/of_mdio.c +@@ -281,6 +281,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np) + return 0; + + unregister: ++ of_node_put(child); + mdiobus_unregister(mdio); + return rc; + } +diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c +index 6209d58e9492a..fdd302d0a1c90 100644 +--- a/drivers/parisc/ccio-dma.c ++++ b/drivers/parisc/ccio-dma.c +@@ -1544,6 +1544,7 @@ static int __init ccio_probe(struct parisc_device *dev) + } + ccio_ioc_init(ioc); + if (ccio_init_resources(ioc)) { ++ iounmap(ioc->ioc_regs); + kfree(ioc); + return -ENOMEM; + } +diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c +index f873d97100e28..13609942d45c0 100644 +--- a/drivers/regulator/pfuze100-regulator.c ++++ b/drivers/regulator/pfuze100-regulator.c +@@ -788,7 +788,7 @@ static int pfuze100_regulator_probe(struct i2c_client *client, + ((pfuze_chip->chip_id == PFUZE3000) ? "3000" : "3001")))); + + memcpy(pfuze_chip->regulator_descs, pfuze_chip->pfuze_regulators, +- sizeof(pfuze_chip->regulator_descs)); ++ regulator_num * sizeof(struct pfuze_regulator)); + + ret = pfuze_parse_regulators_dt(pfuze_chip); + if (ret) +diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c +index dc78a523a69f2..b6b938aa66158 100644 +--- a/drivers/s390/block/dasd_alias.c ++++ b/drivers/s390/block/dasd_alias.c +@@ -675,12 +675,12 @@ int dasd_alias_remove_device(struct dasd_device *device) + struct dasd_device *dasd_alias_get_start_dev(struct dasd_device *base_device) + { + struct dasd_eckd_private *alias_priv, *private = base_device->private; +- struct alias_pav_group *group = private->pavgroup; + struct alias_lcu *lcu = private->lcu; + struct dasd_device *alias_device; ++ struct alias_pav_group *group; + unsigned long flags; + +- if (!group || !lcu) ++ if (!lcu) + return NULL; + if (lcu->pav == NO_PAV || + lcu->flags & (NEED_UAC_UPDATE | UPDATE_PENDING)) +@@ -697,6 +697,11 @@ struct dasd_device *dasd_alias_get_start_dev(struct dasd_device *base_device) + } + + spin_lock_irqsave(&lcu->lock, flags); ++ group = private->pavgroup; ++ if (!group) { ++ spin_unlock_irqrestore(&lcu->lock, flags); ++ return NULL; ++ } + alias_device = group->next; + if (!alias_device) { + if (list_empty(&group->aliaslist)) { +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index 3b2c25bd2e06b..3bd93558b4435 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -306,16 +306,16 @@ static int atmel_config_rs485(struct uart_port *port, + + mode = atmel_uart_readl(port, ATMEL_US_MR); + +- /* Resetting serial mode to RS232 (0x0) */ +- mode &= ~ATMEL_US_USMODE; +- +- port->rs485 = *rs485conf; +- + if (rs485conf->flags & SER_RS485_ENABLED) { + dev_dbg(port->dev, "Setting UART to RS485\n"); +- atmel_port->tx_done_mask = ATMEL_US_TXEMPTY; ++ if (rs485conf->flags & SER_RS485_RX_DURING_TX) ++ atmel_port->tx_done_mask = ATMEL_US_TXRDY; ++ else ++ atmel_port->tx_done_mask = ATMEL_US_TXEMPTY; ++ + atmel_uart_writel(port, ATMEL_US_TTGR, + rs485conf->delay_rts_after_send); ++ mode &= ~ATMEL_US_USMODE; + mode |= ATMEL_US_USMODE_RS485; + } else { + dev_dbg(port->dev, "Setting UART to RS232\n"); +@@ -832,7 +832,7 @@ static void atmel_tx_chars(struct uart_port *port) + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); + + if (port->x_char && +- (atmel_uart_readl(port, ATMEL_US_CSR) & atmel_port->tx_done_mask)) { ++ (atmel_uart_readl(port, ATMEL_US_CSR) & ATMEL_US_TXRDY)) { + atmel_uart_write_char(port, port->x_char); + port->icount.tx++; + port->x_char = 0; +@@ -840,8 +840,7 @@ static void atmel_tx_chars(struct uart_port *port) + if (uart_circ_empty(xmit) || uart_tx_stopped(port)) + return; + +- while (atmel_uart_readl(port, ATMEL_US_CSR) & +- atmel_port->tx_done_mask) { ++ while (atmel_uart_readl(port, ATMEL_US_CSR) & ATMEL_US_TXRDY) { + atmel_uart_write_char(port, xmit->buf[xmit->tail]); + xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1); + port->icount.tx++; +@@ -852,10 +851,20 @@ static void atmel_tx_chars(struct uart_port *port) + if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) + uart_write_wakeup(port); + +- if (!uart_circ_empty(xmit)) ++ if (!uart_circ_empty(xmit)) { ++ /* we still have characters to transmit, so we should continue ++ * transmitting them when TX is ready, regardless of ++ * mode or duplexity ++ */ ++ atmel_port->tx_done_mask |= ATMEL_US_TXRDY; ++ + /* Enable interrupts */ + atmel_uart_writel(port, ATMEL_US_IER, + atmel_port->tx_done_mask); ++ } else { ++ if (atmel_uart_is_half_duplex(port)) ++ atmel_port->tx_done_mask &= ~ATMEL_US_TXRDY; ++ } + } + + static void atmel_complete_tx_dma(void *arg) +@@ -2541,8 +2550,7 @@ static int atmel_init_port(struct atmel_uart_port *atmel_port, + * Use TXEMPTY for interrupt when rs485 or ISO7816 else TXRDY or + * ENDTX|TXBUFE + */ +- if (port->rs485.flags & SER_RS485_ENABLED || +- port->iso7816.flags & SER_ISO7816_ENABLED) ++ if (atmel_uart_is_half_duplex(port)) + atmel_port->tx_done_mask = ATMEL_US_TXEMPTY; + else if (atmel_use_pdc_tx(port)) { + port->fifosize = PDC_BUFFER_SIZE; +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index 74c21152367ae..c5f43cd39664a 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -519,7 +519,7 @@ static void tegra_uart_tx_dma_complete(void *args) + count = tup->tx_bytes_requested - state.residue; + async_tx_ack(tup->tx_dma_desc); + spin_lock_irqsave(&tup->uport.lock, flags); +- xmit->tail = (xmit->tail + count) & (UART_XMIT_SIZE - 1); ++ uart_xmit_advance(&tup->uport, count); + tup->tx_in_progress = 0; + if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) + uart_write_wakeup(&tup->uport); +@@ -606,7 +606,6 @@ static unsigned int tegra_uart_tx_empty(struct uart_port *u) + static void tegra_uart_stop_tx(struct uart_port *u) + { + struct tegra_uart_port *tup = to_tegra_uport(u); +- struct circ_buf *xmit = &tup->uport.state->xmit; + struct dma_tx_state state; + unsigned int count; + +@@ -617,7 +616,7 @@ static void tegra_uart_stop_tx(struct uart_port *u) + dmaengine_tx_status(tup->tx_dma_chan, tup->tx_cookie, &state); + count = tup->tx_bytes_requested - state.residue; + async_tx_ack(tup->tx_dma_desc); +- xmit->tail = (xmit->tail + count) & (UART_XMIT_SIZE - 1); ++ uart_xmit_advance(&tup->uport, count); + tup->tx_in_progress = 0; + } + +diff --git a/drivers/tty/serial/tegra-tcu.c b/drivers/tty/serial/tegra-tcu.c +index aaf8748a61479..31ae705aa38b7 100644 +--- a/drivers/tty/serial/tegra-tcu.c ++++ b/drivers/tty/serial/tegra-tcu.c +@@ -101,7 +101,7 @@ static void tegra_tcu_uart_start_tx(struct uart_port *port) + break; + + tegra_tcu_write(tcu, &xmit->buf[xmit->tail], count); +- xmit->tail = (xmit->tail + count) & (UART_XMIT_SIZE - 1); ++ uart_xmit_advance(port, count); + } + + uart_write_wakeup(port); +diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c +index 8bedf0504e92f..d111cf81cecef 100644 +--- a/drivers/usb/cdns3/gadget.c ++++ b/drivers/usb/cdns3/gadget.c +@@ -1259,6 +1259,7 @@ static int cdns3_check_ep_interrupt_proceed(struct cdns3_endpoint *priv_ep) + ep_cfg &= ~EP_CFG_ENABLE; + writel(ep_cfg, &priv_dev->regs->ep_cfg); + priv_ep->flags &= ~EP_QUIRK_ISO_OUT_EN; ++ priv_ep->flags |= EP_UPDATE_EP_TRBADDR; + } + cdns3_transfer_completed(priv_dev, priv_ep); + } else if (!(priv_ep->flags & EP_STALLED) && +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 68d860a3fd617..50c7df59f7e87 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -5924,7 +5924,7 @@ re_enumerate_no_bos: + * + * Return: The same as for usb_reset_and_verify_device(). + * However, if a reset is already in progress (for instance, if a +- * driver doesn't have pre_ or post_reset() callbacks, and while ++ * driver doesn't have pre_reset() or post_reset() callbacks, and while + * being unbound or re-bound during the ongoing reset its disconnect() + * or probe() routine tries to perform a second, nested reset), the + * routine returns -EINPROGRESS. +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index f4655665a1b5c..a9c49b2ce511b 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -227,7 +227,7 @@ u32 dwc3_core_fifo_space(struct dwc3_ep *dep, u8 type) + * dwc3_core_soft_reset - Issues core soft reset and PHY reset + * @dwc: pointer to our context structure + */ +-static int dwc3_core_soft_reset(struct dwc3 *dwc) ++int dwc3_core_soft_reset(struct dwc3 *dwc) + { + u32 reg; + int retries = 1000; +diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h +index da296f888f45d..f320b989abd21 100644 +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -994,6 +994,7 @@ struct dwc3_scratchpad_array { + * @tx_max_burst_prd: max periodic ESS transmit burst size + * @hsphy_interface: "utmi" or "ulpi" + * @connected: true when we're connected to a host, false otherwise ++ * @softconnect: true when gadget connect is called, false when disconnect runs + * @delayed_status: true when gadget driver asks for delayed status + * @ep0_bounced: true when we used bounce buffer + * @ep0_expect_in: true when we expect a DATA IN transfer +@@ -1196,6 +1197,7 @@ struct dwc3 { + const char *hsphy_interface; + + unsigned connected:1; ++ unsigned softconnect:1; + unsigned delayed_status:1; + unsigned ep0_bounced:1; + unsigned ep0_expect_in:1; +@@ -1420,6 +1422,8 @@ bool dwc3_has_imod(struct dwc3 *dwc); + int dwc3_event_buffers_setup(struct dwc3 *dwc); + void dwc3_event_buffers_cleanup(struct dwc3 *dwc); + ++int dwc3_core_soft_reset(struct dwc3 *dwc); ++ + #if IS_ENABLED(CONFIG_USB_DWC3_HOST) || IS_ENABLED(CONFIG_USB_DWC3_DUAL_ROLE) + int dwc3_host_init(struct dwc3 *dwc); + void dwc3_host_exit(struct dwc3 *dwc); +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 80fee7ea83ca4..a40935f3592bc 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2008,14 +2008,42 @@ static void dwc3_gadget_disable_irq(struct dwc3 *dwc); + static void __dwc3_gadget_stop(struct dwc3 *dwc); + static int __dwc3_gadget_start(struct dwc3 *dwc); + ++static int dwc3_gadget_soft_disconnect(struct dwc3 *dwc) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&dwc->lock, flags); ++ dwc->connected = false; ++ ++ /* ++ * In the Synopsys DesignWare Cores USB3 Databook Rev. 3.30a ++ * Section 4.1.8 Table 4-7, it states that for a device-initiated ++ * disconnect, the SW needs to ensure that it sends "a DEPENDXFER ++ * command for any active transfers" before clearing the RunStop ++ * bit. ++ */ ++ dwc3_stop_active_transfers(dwc); ++ __dwc3_gadget_stop(dwc); ++ spin_unlock_irqrestore(&dwc->lock, flags); ++ ++ /* ++ * Note: if the GEVNTCOUNT indicates events in the event buffer, the ++ * driver needs to acknowledge them before the controller can halt. ++ * Simply let the interrupt handler acknowledges and handle the ++ * remaining event generated by the controller while polling for ++ * DSTS.DEVCTLHLT. ++ */ ++ return dwc3_gadget_run_stop(dwc, false, false); ++} ++ + static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) + { + struct dwc3 *dwc = gadget_to_dwc(g); +- unsigned long flags; + int ret; + + is_on = !!is_on; + ++ dwc->softconnect = is_on; + /* + * Per databook, when we want to stop the gadget, if a control transfer + * is still in process, complete it and get the core into setup phase. +@@ -2051,50 +2079,27 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) + return 0; + } + +- /* +- * Synchronize and disable any further event handling while controller +- * is being enabled/disabled. +- */ +- disable_irq(dwc->irq_gadget); +- +- spin_lock_irqsave(&dwc->lock, flags); ++ if (dwc->pullups_connected == is_on) { ++ pm_runtime_put(dwc->dev); ++ return 0; ++ } + + if (!is_on) { +- u32 count; +- +- dwc->connected = false; ++ ret = dwc3_gadget_soft_disconnect(dwc); ++ } else { + /* +- * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a +- * Section 4.1.8 Table 4-7, it states that for a device-initiated +- * disconnect, the SW needs to ensure that it sends "a DEPENDXFER +- * command for any active transfers" before clearing the RunStop +- * bit. ++ * In the Synopsys DWC_usb31 1.90a programming guide section ++ * 4.1.9, it specifies that for a reconnect after a ++ * device-initiated disconnect requires a core soft reset ++ * (DCTL.CSftRst) before enabling the run/stop bit. + */ +- dwc3_stop_active_transfers(dwc); +- __dwc3_gadget_stop(dwc); ++ dwc3_core_soft_reset(dwc); + +- /* +- * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a +- * Section 1.3.4, it mentions that for the DEVCTRLHLT bit, the +- * "software needs to acknowledge the events that are generated +- * (by writing to GEVNTCOUNTn) while it is waiting for this bit +- * to be set to '1'." +- */ +- count = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0)); +- count &= DWC3_GEVNTCOUNT_MASK; +- if (count > 0) { +- dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), count); +- dwc->ev_buf->lpos = (dwc->ev_buf->lpos + count) % +- dwc->ev_buf->length; +- } +- } else { ++ dwc3_event_buffers_setup(dwc); + __dwc3_gadget_start(dwc); ++ ret = dwc3_gadget_run_stop(dwc, true, false); + } + +- ret = dwc3_gadget_run_stop(dwc, is_on, false); +- spin_unlock_irqrestore(&dwc->lock, flags); +- enable_irq(dwc->irq_gadget); +- + pm_runtime_put(dwc->dev); + + return ret; +@@ -3791,7 +3796,7 @@ int dwc3_gadget_resume(struct dwc3 *dwc) + { + int ret; + +- if (!dwc->gadget_driver) ++ if (!dwc->gadget_driver || !dwc->softconnect) + return 0; + + ret = __dwc3_gadget_start(dwc); +diff --git a/drivers/usb/host/xhci-mtk-sch.c b/drivers/usb/host/xhci-mtk-sch.c +index 8950d1f10a7fb..86c4bc9df3b80 100644 +--- a/drivers/usb/host/xhci-mtk-sch.c ++++ b/drivers/usb/host/xhci-mtk-sch.c +@@ -25,6 +25,13 @@ + */ + #define TT_MICROFRAMES_MAX 9 + ++/* schedule error type */ ++#define ESCH_SS_Y6 1001 ++#define ESCH_SS_OVERLAP 1002 ++#define ESCH_CS_OVERFLOW 1003 ++#define ESCH_BW_OVERFLOW 1004 ++#define ESCH_FIXME 1005 ++ + /* mtk scheduler bitmasks */ + #define EP_BPKTS(p) ((p) & 0x7f) + #define EP_BCSCOUNT(p) (((p) & 0x7) << 8) +@@ -32,6 +39,24 @@ + #define EP_BOFFSET(p) ((p) & 0x3fff) + #define EP_BREPEAT(p) (((p) & 0x7fff) << 16) + ++static char *sch_error_string(int err_num) ++{ ++ switch (err_num) { ++ case ESCH_SS_Y6: ++ return "Can't schedule Start-Split in Y6"; ++ case ESCH_SS_OVERLAP: ++ return "Can't find a suitable Start-Split location"; ++ case ESCH_CS_OVERFLOW: ++ return "The last Complete-Split is greater than 7"; ++ case ESCH_BW_OVERFLOW: ++ return "Bandwidth exceeds the maximum limit"; ++ case ESCH_FIXME: ++ return "FIXME, to be resolved"; ++ default: ++ return "Unknown"; ++ } ++} ++ + static int is_fs_or_ls(enum usb_device_speed speed) + { + return speed == USB_SPEED_FULL || speed == USB_SPEED_LOW; +@@ -375,7 +400,6 @@ static void update_bus_bw(struct mu3h_sch_bw_info *sch_bw, + sch_ep->bw_budget_table[j]; + } + } +- sch_ep->allocated = used; + } + + static int check_fs_bus_bw(struct mu3h_sch_ep_info *sch_ep, int offset) +@@ -384,19 +408,20 @@ static int check_fs_bus_bw(struct mu3h_sch_ep_info *sch_ep, int offset) + u32 num_esit, tmp; + int base; + int i, j; ++ u8 uframes = DIV_ROUND_UP(sch_ep->maxpkt, FS_PAYLOAD_MAX); + + num_esit = XHCI_MTK_MAX_ESIT / sch_ep->esit; ++ ++ if (sch_ep->ep_type == INT_IN_EP || sch_ep->ep_type == ISOC_IN_EP) ++ offset++; ++ + for (i = 0; i < num_esit; i++) { + base = offset + i * sch_ep->esit; + +- /* +- * Compared with hs bus, no matter what ep type, +- * the hub will always delay one uframe to send data +- */ +- for (j = 0; j < sch_ep->cs_count; j++) { ++ for (j = 0; j < uframes; j++) { + tmp = tt->fs_bus_bw[base + j] + sch_ep->bw_cost_per_microframe; + if (tmp > FS_PAYLOAD_MAX) +- return -ERANGE; ++ return -ESCH_BW_OVERFLOW; + } + } + +@@ -406,15 +431,11 @@ static int check_fs_bus_bw(struct mu3h_sch_ep_info *sch_ep, int offset) + static int check_sch_tt(struct usb_device *udev, + struct mu3h_sch_ep_info *sch_ep, u32 offset) + { +- struct mu3h_sch_tt *tt = sch_ep->sch_tt; + u32 extra_cs_count; +- u32 fs_budget_start; + u32 start_ss, last_ss; + u32 start_cs, last_cs; +- int i; + + start_ss = offset % 8; +- fs_budget_start = (start_ss + 1) % 8; + + if (sch_ep->ep_type == ISOC_OUT_EP) { + last_ss = start_ss + sch_ep->cs_count - 1; +@@ -424,11 +445,7 @@ static int check_sch_tt(struct usb_device *udev, + * must never schedule Start-Split in Y6 + */ + if (!(start_ss == 7 || last_ss < 6)) +- return -ERANGE; +- +- for (i = 0; i < sch_ep->cs_count; i++) +- if (test_bit(offset + i, tt->ss_bit_map)) +- return -ERANGE; ++ return -ESCH_SS_Y6; + + } else { + u32 cs_count = DIV_ROUND_UP(sch_ep->maxpkt, FS_PAYLOAD_MAX); +@@ -438,29 +455,24 @@ static int check_sch_tt(struct usb_device *udev, + * must never schedule Start-Split in Y6 + */ + if (start_ss == 6) +- return -ERANGE; ++ return -ESCH_SS_Y6; + + /* one uframe for ss + one uframe for idle */ + start_cs = (start_ss + 2) % 8; + last_cs = start_cs + cs_count - 1; + + if (last_cs > 7) +- return -ERANGE; ++ return -ESCH_CS_OVERFLOW; + + if (sch_ep->ep_type == ISOC_IN_EP) + extra_cs_count = (last_cs == 7) ? 1 : 2; + else /* ep_type : INTR IN / INTR OUT */ +- extra_cs_count = (fs_budget_start == 6) ? 1 : 2; ++ extra_cs_count = 1; + + cs_count += extra_cs_count; + if (cs_count > 7) + cs_count = 7; /* HW limit */ + +- for (i = 0; i < cs_count + 2; i++) { +- if (test_bit(offset + i, tt->ss_bit_map)) +- return -ERANGE; +- } +- + sch_ep->cs_count = cs_count; + /* one for ss, the other for idle */ + sch_ep->num_budget_microframes = cs_count + 2; +@@ -482,28 +494,24 @@ static void update_sch_tt(struct usb_device *udev, + struct mu3h_sch_tt *tt = sch_ep->sch_tt; + u32 base, num_esit; + int bw_updated; +- int bits; + int i, j; ++ int offset = sch_ep->offset; ++ u8 uframes = DIV_ROUND_UP(sch_ep->maxpkt, FS_PAYLOAD_MAX); + + num_esit = XHCI_MTK_MAX_ESIT / sch_ep->esit; +- bits = (sch_ep->ep_type == ISOC_OUT_EP) ? sch_ep->cs_count : 1; + + if (used) + bw_updated = sch_ep->bw_cost_per_microframe; + else + bw_updated = -sch_ep->bw_cost_per_microframe; + +- for (i = 0; i < num_esit; i++) { +- base = sch_ep->offset + i * sch_ep->esit; ++ if (sch_ep->ep_type == INT_IN_EP || sch_ep->ep_type == ISOC_IN_EP) ++ offset++; + +- for (j = 0; j < bits; j++) { +- if (used) +- set_bit(base + j, tt->ss_bit_map); +- else +- clear_bit(base + j, tt->ss_bit_map); +- } ++ for (i = 0; i < num_esit; i++) { ++ base = offset + i * sch_ep->esit; + +- for (j = 0; j < sch_ep->cs_count; j++) ++ for (j = 0; j < uframes; j++) + tt->fs_bus_bw[base + j] += bw_updated; + } + +@@ -513,21 +521,48 @@ static void update_sch_tt(struct usb_device *udev, + list_del(&sch_ep->tt_endpoint); + } + ++static int load_ep_bw(struct usb_device *udev, struct mu3h_sch_bw_info *sch_bw, ++ struct mu3h_sch_ep_info *sch_ep, bool loaded) ++{ ++ if (sch_ep->sch_tt) ++ update_sch_tt(udev, sch_ep, loaded); ++ ++ /* update bus bandwidth info */ ++ update_bus_bw(sch_bw, sch_ep, loaded); ++ sch_ep->allocated = loaded; ++ ++ return 0; ++} ++ ++static u32 get_esit_boundary(struct mu3h_sch_ep_info *sch_ep) ++{ ++ u32 boundary = sch_ep->esit; ++ ++ if (sch_ep->sch_tt) { /* LS/FS with TT */ ++ /* ++ * tune for CS, normally esit >= 8 for FS/LS, ++ * not add one for other types to avoid access array ++ * out of boundary ++ */ ++ if (sch_ep->ep_type == ISOC_OUT_EP && boundary > 1) ++ boundary--; ++ } ++ ++ return boundary; ++} ++ + static int check_sch_bw(struct usb_device *udev, + struct mu3h_sch_bw_info *sch_bw, struct mu3h_sch_ep_info *sch_ep) + { + u32 offset; +- u32 esit; + u32 min_bw; + u32 min_index; + u32 worst_bw; + u32 bw_boundary; ++ u32 esit_boundary; + u32 min_num_budget; + u32 min_cs_count; +- bool tt_offset_ok = false; +- int ret; +- +- esit = sch_ep->esit; ++ int ret = 0; + + /* + * Search through all possible schedule microframes. +@@ -537,16 +572,15 @@ static int check_sch_bw(struct usb_device *udev, + min_index = 0; + min_cs_count = sch_ep->cs_count; + min_num_budget = sch_ep->num_budget_microframes; +- for (offset = 0; offset < esit; offset++) { +- if (is_fs_or_ls(udev->speed)) { ++ esit_boundary = get_esit_boundary(sch_ep); ++ for (offset = 0; offset < sch_ep->esit; offset++) { ++ if (sch_ep->sch_tt) { + ret = check_sch_tt(udev, sch_ep, offset); + if (ret) + continue; +- else +- tt_offset_ok = true; + } + +- if ((offset + sch_ep->num_budget_microframes) > sch_ep->esit) ++ if ((offset + sch_ep->num_budget_microframes) > esit_boundary) + break; + + worst_bw = get_max_bw(sch_bw, sch_ep, offset); +@@ -569,35 +603,21 @@ static int check_sch_bw(struct usb_device *udev, + + /* check bandwidth */ + if (min_bw > bw_boundary) +- return -ERANGE; ++ return ret ? ret : -ESCH_BW_OVERFLOW; + + sch_ep->offset = min_index; + sch_ep->cs_count = min_cs_count; + sch_ep->num_budget_microframes = min_num_budget; + +- if (is_fs_or_ls(udev->speed)) { +- /* all offset for tt is not ok*/ +- if (!tt_offset_ok) +- return -ERANGE; +- +- update_sch_tt(udev, sch_ep, 1); +- } +- +- /* update bus bandwidth info */ +- update_bus_bw(sch_bw, sch_ep, 1); +- +- return 0; ++ return load_ep_bw(udev, sch_bw, sch_ep, true); + } + + static void destroy_sch_ep(struct usb_device *udev, + struct mu3h_sch_bw_info *sch_bw, struct mu3h_sch_ep_info *sch_ep) + { + /* only release ep bw check passed by check_sch_bw() */ +- if (sch_ep->allocated) { +- update_bus_bw(sch_bw, sch_ep, 0); +- if (sch_ep->sch_tt) +- update_sch_tt(udev, sch_ep, 0); +- } ++ if (sch_ep->allocated) ++ load_ep_bw(udev, sch_bw, sch_ep, false); + + if (sch_ep->sch_tt) + drop_tt(udev); +@@ -760,7 +780,8 @@ int xhci_mtk_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev) + + ret = check_sch_bw(udev, sch_bw, sch_ep); + if (ret) { +- xhci_err(xhci, "Not enough bandwidth!\n"); ++ xhci_err(xhci, "Not enough bandwidth! (%s)\n", ++ sch_error_string(-ret)); + return -ENOSPC; + } + } +diff --git a/drivers/usb/host/xhci-mtk.h b/drivers/usb/host/xhci-mtk.h +index 985e7a19f6f6c..2f702342de666 100644 +--- a/drivers/usb/host/xhci-mtk.h ++++ b/drivers/usb/host/xhci-mtk.h +@@ -20,14 +20,12 @@ + #define XHCI_MTK_MAX_ESIT 64 + + /** +- * @ss_bit_map: used to avoid start split microframes overlay + * @fs_bus_bw: array to keep track of bandwidth already used for FS + * @ep_list: Endpoints using this TT + * @usb_tt: usb TT related + * @tt_port: TT port number + */ + struct mu3h_sch_tt { +- DECLARE_BITMAP(ss_bit_map, XHCI_MTK_MAX_ESIT); + u32 fs_bus_bw[XHCI_MTK_MAX_ESIT]; + struct list_head ep_list; + struct usb_tt *usb_tt; +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index cbe8ad3cd61fd..14aa8500221b8 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -256,6 +256,7 @@ static void option_instat_callback(struct urb *urb); + #define QUECTEL_PRODUCT_EM060K 0x030b + #define QUECTEL_PRODUCT_EM12 0x0512 + #define QUECTEL_PRODUCT_RM500Q 0x0800 ++#define QUECTEL_PRODUCT_RM520N 0x0801 + #define QUECTEL_PRODUCT_EC200S_CN 0x6002 + #define QUECTEL_PRODUCT_EC200T 0x6026 + #define QUECTEL_PRODUCT_RM500K 0x7001 +@@ -1138,6 +1139,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0xff, 0xff), + .driver_info = NUMEP2 }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0, 0) }, ++ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, 0x0203, 0xff), /* BG95-M3 */ ++ .driver_info = ZLP }, + { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), + .driver_info = RSVD(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff), +@@ -1159,6 +1162,9 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10), + .driver_info = ZLP }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) }, +diff --git a/drivers/video/fbdev/pxa3xx-gcu.c b/drivers/video/fbdev/pxa3xx-gcu.c +index 7c4694d70dac1..15162b37f302f 100644 +--- a/drivers/video/fbdev/pxa3xx-gcu.c ++++ b/drivers/video/fbdev/pxa3xx-gcu.c +@@ -382,7 +382,7 @@ pxa3xx_gcu_write(struct file *file, const char *buff, + struct pxa3xx_gcu_batch *buffer; + struct pxa3xx_gcu_priv *priv = to_pxa3xx_gcu_priv(file); + +- int words = count / 4; ++ size_t words = count / 4; + + /* Does not need to be atomic. There's a lock in user space, + * but anyhow, this is just for statistics. */ +diff --git a/fs/afs/misc.c b/fs/afs/misc.c +index 5334f1bd2bca7..5171d6d990315 100644 +--- a/fs/afs/misc.c ++++ b/fs/afs/misc.c +@@ -69,6 +69,7 @@ int afs_abort_to_error(u32 abort_code) + /* Unified AFS error table */ + case UAEPERM: return -EPERM; + case UAENOENT: return -ENOENT; ++ case UAEAGAIN: return -EAGAIN; + case UAEACCES: return -EACCES; + case UAEBUSY: return -EBUSY; + case UAEEXIST: return -EEXIST; +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 86bdebd2ece65..f8127edb89730 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -791,9 +791,6 @@ cifs_readv_from_socket(struct TCP_Server_Info *server, struct msghdr *smb_msg) + int length = 0; + int total_read; + +- smb_msg->msg_control = NULL; +- smb_msg->msg_controllen = 0; +- + for (total_read = 0; msg_data_left(smb_msg); total_read += length) { + try_to_freeze(); + +@@ -844,7 +841,7 @@ int + cifs_read_from_socket(struct TCP_Server_Info *server, char *buf, + unsigned int to_read) + { +- struct msghdr smb_msg; ++ struct msghdr smb_msg = {}; + struct kvec iov = {.iov_base = buf, .iov_len = to_read}; + iov_iter_kvec(&smb_msg.msg_iter, READ, &iov, 1, to_read); + +@@ -855,7 +852,7 @@ int + cifs_read_page_from_socket(struct TCP_Server_Info *server, struct page *page, + unsigned int page_offset, unsigned int to_read) + { +- struct msghdr smb_msg; ++ struct msghdr smb_msg = {}; + struct bio_vec bv = { + .bv_page = page, .bv_len = to_read, .bv_offset = page_offset}; + iov_iter_bvec(&smb_msg.msg_iter, READ, &bv, 1, to_read); +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 03c85beecec10..eb61cecf42d66 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -3194,6 +3194,9 @@ static ssize_t __cifs_writev( + + ssize_t cifs_direct_writev(struct kiocb *iocb, struct iov_iter *from) + { ++ struct file *file = iocb->ki_filp; ++ ++ cifs_revalidate_mapping(file->f_inode); + return __cifs_writev(iocb, from, true); + } + +diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c +index 61e7df4d9cb11..b98ae69edb8fe 100644 +--- a/fs/cifs/transport.c ++++ b/fs/cifs/transport.c +@@ -209,10 +209,6 @@ smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg, + + *sent = 0; + +- smb_msg->msg_name = (struct sockaddr *) &server->dstaddr; +- smb_msg->msg_namelen = sizeof(struct sockaddr); +- smb_msg->msg_control = NULL; +- smb_msg->msg_controllen = 0; + if (server->noblocksnd) + smb_msg->msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL; + else +@@ -324,7 +320,7 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, + sigset_t mask, oldmask; + size_t total_len = 0, sent, size; + struct socket *ssocket = server->ssocket; +- struct msghdr smb_msg; ++ struct msghdr smb_msg = {}; + int val = 1; + __be32 rfc1002_marker; + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index d5e649e578cb1..ace8d6145253f 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -500,6 +500,10 @@ static int __ext4_ext_check(const char *function, unsigned int line, + error_msg = "invalid eh_entries"; + goto corrupted; + } ++ if (unlikely((eh->eh_entries == 0) && (depth > 0))) { ++ error_msg = "eh_entries is 0 but eh_depth is > 0"; ++ goto corrupted; ++ } + if (!ext4_valid_extent_entries(inode, eh, lblk, &pblk, depth)) { + error_msg = "invalid extent entries"; + goto corrupted; +diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c +index 83846cc814850..cbde5a096c7bf 100644 +--- a/fs/ext4/ialloc.c ++++ b/fs/ext4/ialloc.c +@@ -500,7 +500,7 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent, + goto fallback; + } + +- max_dirs = ndirs / ngroups + inodes_per_group / 16; ++ max_dirs = ndirs / ngroups + inodes_per_group*flex_size / 16; + min_inodes = avefreei - inodes_per_group*flex_size / 4; + if (min_inodes < 1) + min_inodes = 1; +diff --git a/fs/nfs/super.c b/fs/nfs/super.c +index a84df7d634032..ecc7277b3eda4 100644 +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -2375,22 +2375,31 @@ void nfs_fill_super(struct super_block *sb, struct nfs_mount_info *mount_info) + if (data && data->bsize) + sb->s_blocksize = nfs_block_size(data->bsize, &sb->s_blocksize_bits); + +- if (server->nfs_client->rpc_ops->version != 2) { +- /* The VFS shouldn't apply the umask to mode bits. We will do +- * so ourselves when necessary. ++ switch (server->nfs_client->rpc_ops->version) { ++ case 2: ++ sb->s_time_gran = 1000; ++ sb->s_time_min = 0; ++ sb->s_time_max = U32_MAX; ++ break; ++ case 3: ++ /* ++ * The VFS shouldn't apply the umask to mode bits. ++ * We will do so ourselves when necessary. + */ + sb->s_flags |= SB_POSIXACL; + sb->s_time_gran = 1; +- sb->s_export_op = &nfs_export_ops; +- } else +- sb->s_time_gran = 1000; +- +- if (server->nfs_client->rpc_ops->version != 4) { + sb->s_time_min = 0; + sb->s_time_max = U32_MAX; +- } else { ++ sb->s_export_op = &nfs_export_ops; ++ break; ++ case 4: ++ sb->s_flags |= SB_POSIXACL; ++ sb->s_time_gran = 1; + sb->s_time_min = S64_MIN; + sb->s_time_max = S64_MAX; ++ if (server->caps & NFS_CAP_ATOMIC_OPEN_V1) ++ sb->s_export_op = &nfs_export_ops; ++ break; + } + + nfs_initialise_sb(sb); +diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c +index 436f686a98918..084d39d8856bd 100644 +--- a/fs/xfs/libxfs/xfs_alloc.c ++++ b/fs/xfs/libxfs/xfs_alloc.c +@@ -684,8 +684,10 @@ xfs_alloc_update_counters( + + xfs_trans_agblocks_delta(tp, len); + if (unlikely(be32_to_cpu(agf->agf_freeblks) > +- be32_to_cpu(agf->agf_length))) ++ be32_to_cpu(agf->agf_length))) { ++ xfs_buf_corruption_error(agbp); + return -EFSCORRUPTED; ++ } + + xfs_alloc_log_agf(tp, agbp, XFS_AGF_FREEBLKS); + return 0; +@@ -751,6 +753,7 @@ xfs_alloc_ag_vextent_small( + + bp = xfs_btree_get_bufs(args->mp, args->tp, args->agno, fbno); + if (!bp) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, args->mp); + error = -EFSCORRUPTED; + goto error; + } +@@ -1995,24 +1998,32 @@ xfs_alloc_longest_free_extent( + return pag->pagf_flcount > 0 || pag->pagf_longest > 0; + } + ++/* ++ * Compute the minimum length of the AGFL in the given AG. If @pag is NULL, ++ * return the largest possible minimum length. ++ */ + unsigned int + xfs_alloc_min_freelist( + struct xfs_mount *mp, + struct xfs_perag *pag) + { ++ /* AG btrees have at least 1 level. */ ++ static const uint8_t fake_levels[XFS_BTNUM_AGF] = {1, 1, 1}; ++ const uint8_t *levels = pag ? pag->pagf_levels : fake_levels; + unsigned int min_free; + ++ ASSERT(mp->m_ag_maxlevels > 0); ++ + /* space needed by-bno freespace btree */ +- min_free = min_t(unsigned int, pag->pagf_levels[XFS_BTNUM_BNOi] + 1, ++ min_free = min_t(unsigned int, levels[XFS_BTNUM_BNOi] + 1, + mp->m_ag_maxlevels); + /* space needed by-size freespace btree */ +- min_free += min_t(unsigned int, pag->pagf_levels[XFS_BTNUM_CNTi] + 1, ++ min_free += min_t(unsigned int, levels[XFS_BTNUM_CNTi] + 1, + mp->m_ag_maxlevels); + /* space needed reverse mapping used space btree */ + if (xfs_sb_version_hasrmapbt(&mp->m_sb)) +- min_free += min_t(unsigned int, +- pag->pagf_levels[XFS_BTNUM_RMAPi] + 1, +- mp->m_rmap_maxlevels); ++ min_free += min_t(unsigned int, levels[XFS_BTNUM_RMAPi] + 1, ++ mp->m_rmap_maxlevels); + + return min_free; + } +@@ -2087,8 +2098,10 @@ xfs_free_agfl_block( + return error; + + bp = xfs_btree_get_bufs(tp->t_mountp, tp, agno, agbno); +- if (!bp) ++ if (!bp) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, tp->t_mountp); + return -EFSCORRUPTED; ++ } + xfs_trans_binval(tp, bp); + + return 0; +diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c +index de33efc9b4f94..0c23127347aca 100644 +--- a/fs/xfs/libxfs/xfs_attr_leaf.c ++++ b/fs/xfs/libxfs/xfs_attr_leaf.c +@@ -2287,8 +2287,10 @@ xfs_attr3_leaf_lookup_int( + leaf = bp->b_addr; + xfs_attr3_leaf_hdr_from_disk(args->geo, &ichdr, leaf); + entries = xfs_attr3_leaf_entryp(leaf); +- if (ichdr.count >= args->geo->blksize / 8) ++ if (ichdr.count >= args->geo->blksize / 8) { ++ xfs_buf_corruption_error(bp); + return -EFSCORRUPTED; ++ } + + /* + * Binary search. (note: small blocks will skip this loop) +@@ -2304,10 +2306,14 @@ xfs_attr3_leaf_lookup_int( + else + break; + } +- if (!(probe >= 0 && (!ichdr.count || probe < ichdr.count))) ++ if (!(probe >= 0 && (!ichdr.count || probe < ichdr.count))) { ++ xfs_buf_corruption_error(bp); + return -EFSCORRUPTED; +- if (!(span <= 4 || be32_to_cpu(entry->hashval) == hashval)) ++ } ++ if (!(span <= 4 || be32_to_cpu(entry->hashval) == hashval)) { ++ xfs_buf_corruption_error(bp); + return -EFSCORRUPTED; ++ } + + /* + * Since we may have duplicate hashval's, find the first matching +diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c +index c114d24be6193..8d035842fe51d 100644 +--- a/fs/xfs/libxfs/xfs_bmap.c ++++ b/fs/xfs/libxfs/xfs_bmap.c +@@ -729,6 +729,7 @@ xfs_bmap_extents_to_btree( + xfs_trans_mod_dquot_byino(tp, ip, XFS_TRANS_DQ_BCOUNT, 1L); + abp = xfs_btree_get_bufl(mp, tp, args.fsbno); + if (!abp) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, mp); + error = -EFSCORRUPTED; + goto out_unreserve_dquot; + } +@@ -1084,6 +1085,7 @@ xfs_bmap_add_attrfork( + if (XFS_IFORK_Q(ip)) + goto trans_cancel; + if (ip->i_d.di_anextents != 0) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, mp); + error = -EFSCORRUPTED; + goto trans_cancel; + } +@@ -1374,7 +1376,8 @@ xfs_bmap_last_before( + case XFS_DINODE_FMT_EXTENTS: + break; + default: +- return -EIO; ++ ASSERT(0); ++ return -EFSCORRUPTED; + } + + if (!(ifp->if_flags & XFS_IFEXTENTS)) { +@@ -1474,8 +1477,10 @@ xfs_bmap_last_offset( + return 0; + + if (XFS_IFORK_FORMAT(ip, whichfork) != XFS_DINODE_FMT_BTREE && +- XFS_IFORK_FORMAT(ip, whichfork) != XFS_DINODE_FMT_EXTENTS) +- return -EIO; ++ XFS_IFORK_FORMAT(ip, whichfork) != XFS_DINODE_FMT_EXTENTS) { ++ ASSERT(0); ++ return -EFSCORRUPTED; ++ } + + error = xfs_bmap_last_extent(NULL, ip, whichfork, &rec, &is_empty); + if (error || is_empty) +@@ -5871,8 +5876,9 @@ xfs_bmap_insert_extents( + XFS_WANT_CORRUPTED_GOTO(mp, !isnullstartblock(got.br_startblock), + del_cursor); + +- if (stop_fsb >= got.br_startoff + got.br_blockcount) { +- error = -EIO; ++ if (stop_fsb > got.br_startoff) { ++ ASSERT(0); ++ error = -EFSCORRUPTED; + goto del_cursor; + } + +diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c +index 71de937f9e64d..a13a25e922ec6 100644 +--- a/fs/xfs/libxfs/xfs_btree.c ++++ b/fs/xfs/libxfs/xfs_btree.c +@@ -1820,6 +1820,7 @@ xfs_btree_lookup_get_block( + + out_bad: + *blkp = NULL; ++ xfs_buf_corruption_error(bp); + xfs_trans_brelse(cur->bc_tp, bp); + return -EFSCORRUPTED; + } +@@ -1867,8 +1868,10 @@ xfs_btree_lookup( + XFS_BTREE_STATS_INC(cur, lookup); + + /* No such thing as a zero-level tree. */ +- if (cur->bc_nlevels == 0) ++ if (cur->bc_nlevels == 0) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, cur->bc_mp); + return -EFSCORRUPTED; ++ } + + block = NULL; + keyno = 0; +diff --git a/fs/xfs/libxfs/xfs_da_btree.c b/fs/xfs/libxfs/xfs_da_btree.c +index 4fd1223c1bd5d..1e2dc65adeb85 100644 +--- a/fs/xfs/libxfs/xfs_da_btree.c ++++ b/fs/xfs/libxfs/xfs_da_btree.c +@@ -504,6 +504,7 @@ xfs_da3_split( + node = oldblk->bp->b_addr; + if (node->hdr.info.forw) { + if (be32_to_cpu(node->hdr.info.forw) != addblk->blkno) { ++ xfs_buf_corruption_error(oldblk->bp); + error = -EFSCORRUPTED; + goto out; + } +@@ -516,6 +517,7 @@ xfs_da3_split( + node = oldblk->bp->b_addr; + if (node->hdr.info.back) { + if (be32_to_cpu(node->hdr.info.back) != addblk->blkno) { ++ xfs_buf_corruption_error(oldblk->bp); + error = -EFSCORRUPTED; + goto out; + } +@@ -1541,8 +1543,10 @@ xfs_da3_node_lookup_int( + break; + } + +- if (magic != XFS_DA_NODE_MAGIC && magic != XFS_DA3_NODE_MAGIC) ++ if (magic != XFS_DA_NODE_MAGIC && magic != XFS_DA3_NODE_MAGIC) { ++ xfs_buf_corruption_error(blk->bp); + return -EFSCORRUPTED; ++ } + + blk->magic = XFS_DA_NODE_MAGIC; + +@@ -1554,15 +1558,18 @@ xfs_da3_node_lookup_int( + btree = dp->d_ops->node_tree_p(node); + + /* Tree taller than we can handle; bail out! */ +- if (nodehdr.level >= XFS_DA_NODE_MAXDEPTH) ++ if (nodehdr.level >= XFS_DA_NODE_MAXDEPTH) { ++ xfs_buf_corruption_error(blk->bp); + return -EFSCORRUPTED; ++ } + + /* Check the level from the root. */ + if (blkno == args->geo->leafblk) + expected_level = nodehdr.level - 1; +- else if (expected_level != nodehdr.level) ++ else if (expected_level != nodehdr.level) { ++ xfs_buf_corruption_error(blk->bp); + return -EFSCORRUPTED; +- else ++ } else + expected_level--; + + max = nodehdr.count; +@@ -1612,12 +1619,17 @@ xfs_da3_node_lookup_int( + } + + /* We can't point back to the root. */ +- if (blkno == args->geo->leafblk) ++ if (blkno == args->geo->leafblk) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, ++ dp->i_mount); + return -EFSCORRUPTED; ++ } + } + +- if (expected_level != 0) ++ if (expected_level != 0) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, dp->i_mount); + return -EFSCORRUPTED; ++ } + + /* + * A leaf block that ends in the hashval that we are interested in +diff --git a/fs/xfs/libxfs/xfs_dir2.c b/fs/xfs/libxfs/xfs_dir2.c +index 867c5dee07518..452d04ae10ceb 100644 +--- a/fs/xfs/libxfs/xfs_dir2.c ++++ b/fs/xfs/libxfs/xfs_dir2.c +@@ -600,8 +600,10 @@ xfs_dir2_isblock( + if ((rval = xfs_bmap_last_offset(args->dp, &last, XFS_DATA_FORK))) + return rval; + rval = XFS_FSB_TO_B(args->dp->i_mount, last) == args->geo->blksize; +- if (rval != 0 && args->dp->i_d.di_size != args->geo->blksize) ++ if (rval != 0 && args->dp->i_d.di_size != args->geo->blksize) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, args->dp->i_mount); + return -EFSCORRUPTED; ++ } + *vp = rval; + return 0; + } +diff --git a/fs/xfs/libxfs/xfs_dir2_leaf.c b/fs/xfs/libxfs/xfs_dir2_leaf.c +index a53e4585a2f3a..388b5da122287 100644 +--- a/fs/xfs/libxfs/xfs_dir2_leaf.c ++++ b/fs/xfs/libxfs/xfs_dir2_leaf.c +@@ -1343,8 +1343,10 @@ xfs_dir2_leaf_removename( + oldbest = be16_to_cpu(bf[0].length); + ltp = xfs_dir2_leaf_tail_p(args->geo, leaf); + bestsp = xfs_dir2_leaf_bests_p(ltp); +- if (be16_to_cpu(bestsp[db]) != oldbest) ++ if (be16_to_cpu(bestsp[db]) != oldbest) { ++ xfs_buf_corruption_error(lbp); + return -EFSCORRUPTED; ++ } + /* + * Mark the former data entry unused. + */ +diff --git a/fs/xfs/libxfs/xfs_dir2_node.c b/fs/xfs/libxfs/xfs_dir2_node.c +index 99d5b2ed67f2e..35e698fa85fd7 100644 +--- a/fs/xfs/libxfs/xfs_dir2_node.c ++++ b/fs/xfs/libxfs/xfs_dir2_node.c +@@ -374,8 +374,10 @@ xfs_dir2_leaf_to_node( + leaf = lbp->b_addr; + ltp = xfs_dir2_leaf_tail_p(args->geo, leaf); + if (be32_to_cpu(ltp->bestcount) > +- (uint)dp->i_d.di_size / args->geo->blksize) ++ (uint)dp->i_d.di_size / args->geo->blksize) { ++ xfs_buf_corruption_error(lbp); + return -EFSCORRUPTED; ++ } + + /* + * Copy freespace entries from the leaf block to the new block. +@@ -446,8 +448,10 @@ xfs_dir2_leafn_add( + * Quick check just to make sure we are not going to index + * into other peoples memory + */ +- if (index < 0) ++ if (index < 0) { ++ xfs_buf_corruption_error(bp); + return -EFSCORRUPTED; ++ } + + /* + * If there are already the maximum number of leaf entries in +@@ -740,8 +744,10 @@ xfs_dir2_leafn_lookup_for_entry( + ents = dp->d_ops->leaf_ents_p(leaf); + + xfs_dir3_leaf_check(dp, bp); +- if (leafhdr.count <= 0) ++ if (leafhdr.count <= 0) { ++ xfs_buf_corruption_error(bp); + return -EFSCORRUPTED; ++ } + + /* + * Look up the hash value in the leaf entries. +diff --git a/fs/xfs/libxfs/xfs_dir2_sf.c b/fs/xfs/libxfs/xfs_dir2_sf.c +index ae16ca7c422a9..f980c3f3d2f66 100644 +--- a/fs/xfs/libxfs/xfs_dir2_sf.c ++++ b/fs/xfs/libxfs/xfs_dir2_sf.c +@@ -944,6 +944,27 @@ xfs_dir2_sf_removename( + return 0; + } + ++/* ++ * Check whether the sf dir replace operation need more blocks. ++ */ ++static bool ++xfs_dir2_sf_replace_needblock( ++ struct xfs_inode *dp, ++ xfs_ino_t inum) ++{ ++ int newsize; ++ struct xfs_dir2_sf_hdr *sfp; ++ ++ if (dp->i_d.di_format != XFS_DINODE_FMT_LOCAL) ++ return false; ++ ++ sfp = (struct xfs_dir2_sf_hdr *)dp->i_df.if_u1.if_data; ++ newsize = dp->i_df.if_bytes + (sfp->count + 1) * XFS_INO64_DIFF; ++ ++ return inum > XFS_DIR2_MAX_SHORT_INUM && ++ sfp->i8count == 0 && newsize > XFS_IFORK_DSIZE(dp); ++} ++ + /* + * Replace the inode number of an entry in a shortform directory. + */ +@@ -980,17 +1001,14 @@ xfs_dir2_sf_replace( + */ + if (args->inumber > XFS_DIR2_MAX_SHORT_INUM && sfp->i8count == 0) { + int error; /* error return value */ +- int newsize; /* new inode size */ + +- newsize = dp->i_df.if_bytes + (sfp->count + 1) * XFS_INO64_DIFF; + /* + * Won't fit as shortform, convert to block then do replace. + */ +- if (newsize > XFS_IFORK_DSIZE(dp)) { ++ if (xfs_dir2_sf_replace_needblock(dp, args->inumber)) { + error = xfs_dir2_sf_to_block(args); +- if (error) { ++ if (error) + return error; +- } + return xfs_dir2_block_replace(args); + } + /* +diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c +index 443cf33f66668..c3e0c2f61be4d 100644 +--- a/fs/xfs/libxfs/xfs_ialloc.c ++++ b/fs/xfs/libxfs/xfs_ialloc.c +@@ -2854,3 +2854,67 @@ xfs_ialloc_setup_geometry( + else + igeo->ialloc_align = 0; + } ++ ++/* Compute the location of the root directory inode that is laid out by mkfs. */ ++xfs_ino_t ++xfs_ialloc_calc_rootino( ++ struct xfs_mount *mp, ++ int sunit) ++{ ++ struct xfs_ino_geometry *igeo = M_IGEO(mp); ++ xfs_agblock_t first_bno; ++ ++ /* ++ * Pre-calculate the geometry of AG 0. We know what it looks like ++ * because libxfs knows how to create allocation groups now. ++ * ++ * first_bno is the first block in which mkfs could possibly have ++ * allocated the root directory inode, once we factor in the metadata ++ * that mkfs formats before it. Namely, the four AG headers... ++ */ ++ first_bno = howmany(4 * mp->m_sb.sb_sectsize, mp->m_sb.sb_blocksize); ++ ++ /* ...the two free space btree roots... */ ++ first_bno += 2; ++ ++ /* ...the inode btree root... */ ++ first_bno += 1; ++ ++ /* ...the initial AGFL... */ ++ first_bno += xfs_alloc_min_freelist(mp, NULL); ++ ++ /* ...the free inode btree root... */ ++ if (xfs_sb_version_hasfinobt(&mp->m_sb)) ++ first_bno++; ++ ++ /* ...the reverse mapping btree root... */ ++ if (xfs_sb_version_hasrmapbt(&mp->m_sb)) ++ first_bno++; ++ ++ /* ...the reference count btree... */ ++ if (xfs_sb_version_hasreflink(&mp->m_sb)) ++ first_bno++; ++ ++ /* ++ * ...and the log, if it is allocated in the first allocation group. ++ * ++ * This can happen with filesystems that only have a single ++ * allocation group, or very odd geometries created by old mkfs ++ * versions on very small filesystems. ++ */ ++ if (mp->m_sb.sb_logstart && ++ XFS_FSB_TO_AGNO(mp, mp->m_sb.sb_logstart) == 0) ++ first_bno += mp->m_sb.sb_logblocks; ++ ++ /* ++ * Now round first_bno up to whatever allocation alignment is given ++ * by the filesystem or was passed in. ++ */ ++ if (xfs_sb_version_hasdalign(&mp->m_sb) && igeo->ialloc_align > 0) ++ first_bno = roundup(first_bno, sunit); ++ else if (xfs_sb_version_hasalign(&mp->m_sb) && ++ mp->m_sb.sb_inoalignmt > 1) ++ first_bno = roundup(first_bno, mp->m_sb.sb_inoalignmt); ++ ++ return XFS_AGINO_TO_INO(mp, 0, XFS_AGB_TO_AGINO(mp, first_bno)); ++} +diff --git a/fs/xfs/libxfs/xfs_ialloc.h b/fs/xfs/libxfs/xfs_ialloc.h +index 323592d563d52..72b3468b97b15 100644 +--- a/fs/xfs/libxfs/xfs_ialloc.h ++++ b/fs/xfs/libxfs/xfs_ialloc.h +@@ -152,5 +152,6 @@ int xfs_inobt_insert_rec(struct xfs_btree_cur *cur, uint16_t holemask, + + int xfs_ialloc_cluster_alignment(struct xfs_mount *mp); + void xfs_ialloc_setup_geometry(struct xfs_mount *mp); ++xfs_ino_t xfs_ialloc_calc_rootino(struct xfs_mount *mp, int sunit); + + #endif /* __XFS_IALLOC_H__ */ +diff --git a/fs/xfs/libxfs/xfs_inode_fork.c b/fs/xfs/libxfs/xfs_inode_fork.c +index 8fdd0424070e0..15d6f947620ff 100644 +--- a/fs/xfs/libxfs/xfs_inode_fork.c ++++ b/fs/xfs/libxfs/xfs_inode_fork.c +@@ -75,11 +75,15 @@ xfs_iformat_fork( + error = xfs_iformat_btree(ip, dip, XFS_DATA_FORK); + break; + default: ++ xfs_inode_verifier_error(ip, -EFSCORRUPTED, __func__, ++ dip, sizeof(*dip), __this_address); + return -EFSCORRUPTED; + } + break; + + default: ++ xfs_inode_verifier_error(ip, -EFSCORRUPTED, __func__, dip, ++ sizeof(*dip), __this_address); + return -EFSCORRUPTED; + } + if (error) +@@ -110,6 +114,8 @@ xfs_iformat_fork( + error = xfs_iformat_btree(ip, dip, XFS_ATTR_FORK); + break; + default: ++ xfs_inode_verifier_error(ip, error, __func__, dip, ++ sizeof(*dip), __this_address); + error = -EFSCORRUPTED; + break; + } +diff --git a/fs/xfs/libxfs/xfs_refcount.c b/fs/xfs/libxfs/xfs_refcount.c +index 9a7fadb1361cb..78236bd6c64f0 100644 +--- a/fs/xfs/libxfs/xfs_refcount.c ++++ b/fs/xfs/libxfs/xfs_refcount.c +@@ -1591,8 +1591,10 @@ xfs_refcount_recover_extent( + struct list_head *debris = priv; + struct xfs_refcount_recovery *rr; + +- if (be32_to_cpu(rec->refc.rc_refcount) != 1) ++ if (be32_to_cpu(rec->refc.rc_refcount) != 1) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, cur->bc_mp); + return -EFSCORRUPTED; ++ } + + rr = kmem_alloc(sizeof(struct xfs_refcount_recovery), 0); + xfs_refcount_btrec_to_irec(rec, &rr->rr_rrec); +diff --git a/fs/xfs/libxfs/xfs_rtbitmap.c b/fs/xfs/libxfs/xfs_rtbitmap.c +index 42085e70c01ac..85f123b3dfcc1 100644 +--- a/fs/xfs/libxfs/xfs_rtbitmap.c ++++ b/fs/xfs/libxfs/xfs_rtbitmap.c +@@ -15,7 +15,7 @@ + #include "xfs_bmap.h" + #include "xfs_trans.h" + #include "xfs_rtalloc.h" +- ++#include "xfs_error.h" + + /* + * Realtime allocator bitmap functions shared with userspace. +@@ -70,8 +70,10 @@ xfs_rtbuf_get( + if (error) + return error; + +- if (nmap == 0 || !xfs_bmap_is_real_extent(&map)) ++ if (nmap == 0 || !xfs_bmap_is_real_extent(&map)) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, mp); + return -EFSCORRUPTED; ++ } + + ASSERT(map.br_startblock != NULLFSBLOCK); + error = xfs_trans_read_buf(mp, tp, mp->m_ddev_targp, +diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c +index 96d7071cfa468..3f2292c7835ca 100644 +--- a/fs/xfs/xfs_acl.c ++++ b/fs/xfs/xfs_acl.c +@@ -12,6 +12,7 @@ + #include "xfs_inode.h" + #include "xfs_attr.h" + #include "xfs_trace.h" ++#include "xfs_error.h" + #include <linux/posix_acl_xattr.h> + + +@@ -23,6 +24,7 @@ + + STATIC struct posix_acl * + xfs_acl_from_disk( ++ struct xfs_mount *mp, + const struct xfs_acl *aclp, + int len, + int max_entries) +@@ -32,11 +34,18 @@ xfs_acl_from_disk( + const struct xfs_acl_entry *ace; + unsigned int count, i; + +- if (len < sizeof(*aclp)) ++ if (len < sizeof(*aclp)) { ++ XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, aclp, ++ len); + return ERR_PTR(-EFSCORRUPTED); ++ } ++ + count = be32_to_cpu(aclp->acl_cnt); +- if (count > max_entries || XFS_ACL_SIZE(count) != len) ++ if (count > max_entries || XFS_ACL_SIZE(count) != len) { ++ XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, aclp, ++ len); + return ERR_PTR(-EFSCORRUPTED); ++ } + + acl = posix_acl_alloc(count, GFP_KERNEL); + if (!acl) +@@ -145,7 +154,7 @@ xfs_get_acl(struct inode *inode, int type) + if (error != -ENOATTR) + acl = ERR_PTR(error); + } else { +- acl = xfs_acl_from_disk(xfs_acl, len, ++ acl = xfs_acl_from_disk(ip->i_mount, xfs_acl, len, + XFS_ACL_MAX_ENTRIES(ip->i_mount)); + kmem_free(xfs_acl); + } +diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c +index a640a285cc521..766b1386402a0 100644 +--- a/fs/xfs/xfs_attr_inactive.c ++++ b/fs/xfs/xfs_attr_inactive.c +@@ -22,6 +22,7 @@ + #include "xfs_attr_leaf.h" + #include "xfs_quota.h" + #include "xfs_dir2.h" ++#include "xfs_error.h" + + /* + * Look at all the extents for this logical region, +@@ -208,8 +209,9 @@ xfs_attr3_node_inactive( + * Since this code is recursive (gasp!) we must protect ourselves. + */ + if (level > XFS_DA_NODE_MAXDEPTH) { ++ xfs_buf_corruption_error(bp); + xfs_trans_brelse(*trans, bp); /* no locks for later trans */ +- return -EIO; ++ return -EFSCORRUPTED; + } + + node = bp->b_addr; +@@ -258,8 +260,9 @@ xfs_attr3_node_inactive( + error = xfs_attr3_leaf_inactive(trans, dp, child_bp); + break; + default: +- error = -EIO; ++ xfs_buf_corruption_error(child_bp); + xfs_trans_brelse(*trans, child_bp); ++ error = -EFSCORRUPTED; + break; + } + if (error) +@@ -341,7 +344,8 @@ xfs_attr3_root_inactive( + error = xfs_attr3_leaf_inactive(trans, dp, bp); + break; + default: +- error = -EIO; ++ error = -EFSCORRUPTED; ++ xfs_buf_corruption_error(bp); + xfs_trans_brelse(*trans, bp); + break; + } +diff --git a/fs/xfs/xfs_attr_list.c b/fs/xfs/xfs_attr_list.c +index 00758fdc2fecf..8b9b500e75e81 100644 +--- a/fs/xfs/xfs_attr_list.c ++++ b/fs/xfs/xfs_attr_list.c +@@ -258,8 +258,10 @@ xfs_attr_node_list_lookup( + return 0; + + /* We can't point back to the root. */ +- if (cursor->blkno == 0) ++ if (cursor->blkno == 0) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, mp); + return -EFSCORRUPTED; ++ } + } + + if (expected_level != 0) +@@ -269,6 +271,7 @@ xfs_attr_node_list_lookup( + return 0; + + out_corruptbuf: ++ xfs_buf_corruption_error(bp); + xfs_trans_brelse(tp, bp); + return -EFSCORRUPTED; + } +diff --git a/fs/xfs/xfs_bmap_item.c b/fs/xfs/xfs_bmap_item.c +index 83d24e983d4c2..243e5e0f82a30 100644 +--- a/fs/xfs/xfs_bmap_item.c ++++ b/fs/xfs/xfs_bmap_item.c +@@ -21,7 +21,7 @@ + #include "xfs_icache.h" + #include "xfs_bmap_btree.h" + #include "xfs_trans_space.h" +- ++#include "xfs_error.h" + + kmem_zone_t *xfs_bui_zone; + kmem_zone_t *xfs_bud_zone; +@@ -456,7 +456,7 @@ xfs_bui_recover( + if (buip->bui_format.bui_nextents != XFS_BUI_MAX_FAST_EXTENTS) { + set_bit(XFS_BUI_RECOVERED, &buip->bui_flags); + xfs_bui_release(buip); +- return -EIO; ++ return -EFSCORRUPTED; + } + + /* +@@ -490,7 +490,7 @@ xfs_bui_recover( + */ + set_bit(XFS_BUI_RECOVERED, &buip->bui_flags); + xfs_bui_release(buip); +- return -EIO; ++ return -EFSCORRUPTED; + } + + error = xfs_trans_alloc(mp, &M_RES(mp)->tr_itruncate, +@@ -525,6 +525,7 @@ xfs_bui_recover( + type = bui_type; + break; + default: ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, mp); + error = -EFSCORRUPTED; + goto err_inode; + } +diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c +index d6d78e1276254..113bed28bc310 100644 +--- a/fs/xfs/xfs_bmap_util.c ++++ b/fs/xfs/xfs_bmap_util.c +@@ -1167,6 +1167,7 @@ xfs_prepare_shift( + struct xfs_inode *ip, + loff_t offset) + { ++ struct xfs_mount *mp = ip->i_mount; + int error; + + /* +@@ -1179,6 +1180,17 @@ xfs_prepare_shift( + return error; + } + ++ /* ++ * Shift operations must stabilize the start block offset boundary along ++ * with the full range of the operation. If we don't, a COW writeback ++ * completion could race with an insert, front merge with the start ++ * extent (after split) during the shift and corrupt the file. Start ++ * with the block just prior to the start to stabilize the boundary. ++ */ ++ offset = round_down(offset, 1 << mp->m_sb.sb_blocklog); ++ if (offset) ++ offset -= (1 << mp->m_sb.sb_blocklog); ++ + /* + * Writeback and invalidate cache for the remainder of the file as we're + * about to shift down every extent from offset to EOF. +diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c +index d74fbd1e9d3ea..b1452117e4429 100644 +--- a/fs/xfs/xfs_buf_item.c ++++ b/fs/xfs/xfs_buf_item.c +@@ -956,7 +956,7 @@ xfs_buf_item_relse( + struct xfs_buf_log_item *bip = bp->b_log_item; + + trace_xfs_buf_item_relse(bp, _RET_IP_); +- ASSERT(!(bip->bli_item.li_flags & XFS_LI_IN_AIL)); ++ ASSERT(!test_bit(XFS_LI_IN_AIL, &bip->bli_item.li_flags)); + + bp->b_log_item = NULL; + if (list_empty(&bp->b_li_list)) +diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c +index 3cbf248af51ff..aa50841802703 100644 +--- a/fs/xfs/xfs_dquot.c ++++ b/fs/xfs/xfs_dquot.c +@@ -1125,7 +1125,7 @@ xfs_qm_dqflush( + xfs_buf_relse(bp); + xfs_dqfunlock(dqp); + xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE); +- return -EIO; ++ return -EFSCORRUPTED; + } + + /* This is the only portion of data that needs to persist */ +diff --git a/fs/xfs/xfs_error.c b/fs/xfs/xfs_error.c +index 849fd4476950a..d8cdb27fe6ed3 100644 +--- a/fs/xfs/xfs_error.c ++++ b/fs/xfs/xfs_error.c +@@ -329,7 +329,7 @@ xfs_corruption_error( + const char *tag, + int level, + struct xfs_mount *mp, +- void *buf, ++ const void *buf, + size_t bufsize, + const char *filename, + int linenum, +@@ -341,6 +341,27 @@ xfs_corruption_error( + xfs_alert(mp, "Corruption detected. Unmount and run xfs_repair"); + } + ++/* ++ * Complain about the kinds of metadata corruption that we can't detect from a ++ * verifier, such as incorrect inter-block relationship data. Does not set ++ * bp->b_error. ++ */ ++void ++xfs_buf_corruption_error( ++ struct xfs_buf *bp) ++{ ++ struct xfs_mount *mp = bp->b_mount; ++ ++ xfs_alert_tag(mp, XFS_PTAG_VERIFIER_ERROR, ++ "Metadata corruption detected at %pS, %s block 0x%llx", ++ __return_address, bp->b_ops->name, bp->b_bn); ++ ++ xfs_alert(mp, "Unmount and run xfs_repair"); ++ ++ if (xfs_error_level >= XFS_ERRLEVEL_HIGH) ++ xfs_stack_trace(); ++} ++ + /* + * Warnings specifically for verifier errors. Differentiate CRC vs. invalid + * values, and omit the stack trace unless the error level is tuned high. +@@ -350,7 +371,7 @@ xfs_buf_verifier_error( + struct xfs_buf *bp, + int error, + const char *name, +- void *buf, ++ const void *buf, + size_t bufsz, + xfs_failaddr_t failaddr) + { +@@ -402,7 +423,7 @@ xfs_inode_verifier_error( + struct xfs_inode *ip, + int error, + const char *name, +- void *buf, ++ const void *buf, + size_t bufsz, + xfs_failaddr_t failaddr) + { +diff --git a/fs/xfs/xfs_error.h b/fs/xfs/xfs_error.h +index 602aa7d62b66e..c319379f7d1a3 100644 +--- a/fs/xfs/xfs_error.h ++++ b/fs/xfs/xfs_error.h +@@ -12,16 +12,17 @@ extern void xfs_error_report(const char *tag, int level, struct xfs_mount *mp, + const char *filename, int linenum, + xfs_failaddr_t failaddr); + extern void xfs_corruption_error(const char *tag, int level, +- struct xfs_mount *mp, void *buf, size_t bufsize, ++ struct xfs_mount *mp, const void *buf, size_t bufsize, + const char *filename, int linenum, + xfs_failaddr_t failaddr); ++void xfs_buf_corruption_error(struct xfs_buf *bp); + extern void xfs_buf_verifier_error(struct xfs_buf *bp, int error, +- const char *name, void *buf, size_t bufsz, ++ const char *name, const void *buf, size_t bufsz, + xfs_failaddr_t failaddr); + extern void xfs_verifier_error(struct xfs_buf *bp, int error, + xfs_failaddr_t failaddr); + extern void xfs_inode_verifier_error(struct xfs_inode *ip, int error, +- const char *name, void *buf, size_t bufsz, ++ const char *name, const void *buf, size_t bufsz, + xfs_failaddr_t failaddr); + + #define XFS_ERROR_REPORT(e, lvl, mp) \ +diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c +index e44efc41a0412..a05a1074e8f81 100644 +--- a/fs/xfs/xfs_extfree_item.c ++++ b/fs/xfs/xfs_extfree_item.c +@@ -21,7 +21,7 @@ + #include "xfs_alloc.h" + #include "xfs_bmap.h" + #include "xfs_trace.h" +- ++#include "xfs_error.h" + + kmem_zone_t *xfs_efi_zone; + kmem_zone_t *xfs_efd_zone; +@@ -228,6 +228,7 @@ xfs_efi_copy_format(xfs_log_iovec_t *buf, xfs_efi_log_format_t *dst_efi_fmt) + } + return 0; + } ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, NULL); + return -EFSCORRUPTED; + } + +@@ -624,7 +625,7 @@ xfs_efi_recover( + */ + set_bit(XFS_EFI_RECOVERED, &efip->efi_flags); + xfs_efi_release(efip); +- return -EIO; ++ return -EFSCORRUPTED; + } + } + +diff --git a/fs/xfs/xfs_fsmap.c b/fs/xfs/xfs_fsmap.c +index 01c0933a4d10d..79e8af8f4669c 100644 +--- a/fs/xfs/xfs_fsmap.c ++++ b/fs/xfs/xfs_fsmap.c +@@ -146,6 +146,7 @@ xfs_fsmap_owner_from_rmap( + dest->fmr_owner = XFS_FMR_OWN_FREE; + break; + default: ++ ASSERT(0); + return -EFSCORRUPTED; + } + return 0; +diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c +index 7a9048c4c2f95..7b72c189cff0b 100644 +--- a/fs/xfs/xfs_inode.c ++++ b/fs/xfs/xfs_inode.c +@@ -2149,8 +2149,10 @@ xfs_iunlink_update_bucket( + * passed in because either we're adding or removing ourselves from the + * head of the list. + */ +- if (old_value == new_agino) ++ if (old_value == new_agino) { ++ xfs_buf_corruption_error(agibp); + return -EFSCORRUPTED; ++ } + + agi->agi_unlinked[bucket_index] = cpu_to_be32(new_agino); + offset = offsetof(struct xfs_agi, agi_unlinked) + +@@ -2213,6 +2215,8 @@ xfs_iunlink_update_inode( + /* Make sure the old pointer isn't garbage. */ + old_value = be32_to_cpu(dip->di_next_unlinked); + if (!xfs_verify_agino_or_null(mp, agno, old_value)) { ++ xfs_inode_verifier_error(ip, -EFSCORRUPTED, __func__, dip, ++ sizeof(*dip), __this_address); + error = -EFSCORRUPTED; + goto out; + } +@@ -2224,8 +2228,11 @@ xfs_iunlink_update_inode( + */ + *old_next_agino = old_value; + if (old_value == next_agino) { +- if (next_agino != NULLAGINO) ++ if (next_agino != NULLAGINO) { ++ xfs_inode_verifier_error(ip, -EFSCORRUPTED, __func__, ++ dip, sizeof(*dip), __this_address); + error = -EFSCORRUPTED; ++ } + goto out; + } + +@@ -2276,8 +2283,10 @@ xfs_iunlink( + */ + next_agino = be32_to_cpu(agi->agi_unlinked[bucket_index]); + if (next_agino == agino || +- !xfs_verify_agino_or_null(mp, agno, next_agino)) ++ !xfs_verify_agino_or_null(mp, agno, next_agino)) { ++ xfs_buf_corruption_error(agibp); + return -EFSCORRUPTED; ++ } + + if (next_agino != NULLAGINO) { + struct xfs_perag *pag; +@@ -3215,6 +3224,7 @@ xfs_rename( + struct xfs_trans *tp; + struct xfs_inode *wip = NULL; /* whiteout inode */ + struct xfs_inode *inodes[__XFS_SORT_INODES]; ++ int i; + int num_inodes = __XFS_SORT_INODES; + bool new_parent = (src_dp != target_dp); + bool src_is_directory = S_ISDIR(VFS_I(src_ip)->i_mode); +@@ -3326,6 +3336,30 @@ xfs_rename( + } + } + ++ /* ++ * Lock the AGI buffers we need to handle bumping the nlink of the ++ * whiteout inode off the unlinked list and to handle dropping the ++ * nlink of the target inode. Per locking order rules, do this in ++ * increasing AG order and before directory block allocation tries to ++ * grab AGFs because we grab AGIs before AGFs. ++ * ++ * The (vfs) caller must ensure that if src is a directory then ++ * target_ip is either null or an empty directory. ++ */ ++ for (i = 0; i < num_inodes && inodes[i] != NULL; i++) { ++ if (inodes[i] == wip || ++ (inodes[i] == target_ip && ++ (VFS_I(target_ip)->i_nlink == 1 || src_is_directory))) { ++ struct xfs_buf *bp; ++ xfs_agnumber_t agno; ++ ++ agno = XFS_INO_TO_AGNO(mp, inodes[i]->i_ino); ++ error = xfs_read_agi(mp, tp, agno, &bp); ++ if (error) ++ goto out_trans_cancel; ++ } ++ } ++ + /* + * Directory entry creation below may acquire the AGF. Remove + * the whiteout from the unlinked list first to preserve correct +diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c +index bb8f076805b9e..726aa3bfd6e84 100644 +--- a/fs/xfs/xfs_inode_item.c ++++ b/fs/xfs/xfs_inode_item.c +@@ -17,6 +17,7 @@ + #include "xfs_trans_priv.h" + #include "xfs_buf_item.h" + #include "xfs_log.h" ++#include "xfs_error.h" + + #include <linux/iversion.h> + +@@ -828,8 +829,10 @@ xfs_inode_item_format_convert( + { + struct xfs_inode_log_format_32 *in_f32 = buf->i_addr; + +- if (buf->i_len != sizeof(*in_f32)) ++ if (buf->i_len != sizeof(*in_f32)) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, NULL); + return -EFSCORRUPTED; ++ } + + in_f->ilf_type = in_f32->ilf_type; + in_f->ilf_size = in_f32->ilf_size; +diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c +index 239c9548b1568..b6f85e488d5c1 100644 +--- a/fs/xfs/xfs_iomap.c ++++ b/fs/xfs/xfs_iomap.c +@@ -765,6 +765,11 @@ xfs_iomap_write_unwritten( + */ + resblks = XFS_DIOSTRAT_SPACE_RES(mp, 0) << 1; + ++ /* Attach dquots so that bmbt splits are accounted correctly. */ ++ error = xfs_qm_dqattach(ip); ++ if (error) ++ return error; ++ + do { + /* + * Set up a transaction to convert the range of extents +@@ -783,6 +788,11 @@ xfs_iomap_write_unwritten( + xfs_ilock(ip, XFS_ILOCK_EXCL); + xfs_trans_ijoin(tp, ip, 0); + ++ error = xfs_trans_reserve_quota_nblks(tp, ip, resblks, 0, ++ XFS_QMOPT_RES_REGBLKS); ++ if (error) ++ goto error_on_bmapi_transaction; ++ + /* + * Modify the unwritten extent state of the buffer. + */ +@@ -1055,6 +1065,13 @@ xfs_file_iomap_begin( + trace_xfs_iomap_alloc(ip, offset, length, XFS_DATA_FORK, &imap); + + out_finish: ++ /* ++ * Writes that span EOF might trigger an IO size update on completion, ++ * so consider them to be dirty for the purposes of O_DSYNC even if ++ * there is no other metadata changes pending or have been made here. ++ */ ++ if ((flags & IOMAP_WRITE) && offset + length > i_size_read(inode)) ++ iomap->flags |= IOMAP_F_DIRTY; + return xfs_bmbt_to_iomap(ip, iomap, &imap, shared); + + out_found: +diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c +index ca8c763902b96..80dd05f8f1afc 100644 +--- a/fs/xfs/xfs_iops.c ++++ b/fs/xfs/xfs_iops.c +@@ -20,6 +20,7 @@ + #include "xfs_symlink.h" + #include "xfs_dir2.h" + #include "xfs_iomap.h" ++#include "xfs_error.h" + + #include <linux/xattr.h> + #include <linux/posix_acl.h> +@@ -470,17 +471,20 @@ xfs_vn_get_link_inline( + struct inode *inode, + struct delayed_call *done) + { ++ struct xfs_inode *ip = XFS_I(inode); + char *link; + +- ASSERT(XFS_I(inode)->i_df.if_flags & XFS_IFINLINE); ++ ASSERT(ip->i_df.if_flags & XFS_IFINLINE); + + /* + * The VFS crashes on a NULL pointer, so return -EFSCORRUPTED if + * if_data is junk. + */ +- link = XFS_I(inode)->i_df.if_u1.if_data; +- if (!link) ++ link = ip->i_df.if_u1.if_data; ++ if (!link) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, ip->i_mount); + return ERR_PTR(-EFSCORRUPTED); ++ } + return link; + } + +diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c +index c1a514ffff555..248101876e1ec 100644 +--- a/fs/xfs/xfs_log_recover.c ++++ b/fs/xfs/xfs_log_recover.c +@@ -471,7 +471,7 @@ xlog_find_verify_log_record( + xfs_warn(log->l_mp, + "Log inconsistent (didn't find previous header)"); + ASSERT(0); +- error = -EIO; ++ error = -EFSCORRUPTED; + goto out; + } + +@@ -1347,10 +1347,11 @@ xlog_find_tail( + error = xlog_rseek_logrec_hdr(log, *head_blk, *head_blk, 1, buffer, + &rhead_blk, &rhead, &wrapped); + if (error < 0) +- return error; ++ goto done; + if (!error) { + xfs_warn(log->l_mp, "%s: couldn't find sync record", __func__); +- return -EIO; ++ error = -EFSCORRUPTED; ++ goto done; + } + *tail_blk = BLOCK_LSN(be64_to_cpu(rhead->h_tail_lsn)); + +@@ -3166,7 +3167,7 @@ xlog_recover_inode_pass2( + default: + xfs_warn(log->l_mp, "%s: Invalid flag", __func__); + ASSERT(0); +- error = -EIO; ++ error = -EFSCORRUPTED; + goto out_release; + } + } +@@ -3247,12 +3248,12 @@ xlog_recover_dquot_pass2( + recddq = item->ri_buf[1].i_addr; + if (recddq == NULL) { + xfs_alert(log->l_mp, "NULL dquot in %s.", __func__); +- return -EIO; ++ return -EFSCORRUPTED; + } + if (item->ri_buf[1].i_len < sizeof(xfs_disk_dquot_t)) { + xfs_alert(log->l_mp, "dquot too small (%d) in %s.", + item->ri_buf[1].i_len, __func__); +- return -EIO; ++ return -EFSCORRUPTED; + } + + /* +@@ -3279,7 +3280,7 @@ xlog_recover_dquot_pass2( + if (fa) { + xfs_alert(mp, "corrupt dquot ID 0x%x in log at %pS", + dq_f->qlf_id, fa); +- return -EIO; ++ return -EFSCORRUPTED; + } + ASSERT(dq_f->qlf_len == 1); + +@@ -3537,6 +3538,7 @@ xfs_cui_copy_format( + memcpy(dst_cui_fmt, src_cui_fmt, len); + return 0; + } ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, NULL); + return -EFSCORRUPTED; + } + +@@ -3601,8 +3603,10 @@ xlog_recover_cud_pass2( + struct xfs_ail *ailp = log->l_ailp; + + cud_formatp = item->ri_buf[0].i_addr; +- if (item->ri_buf[0].i_len != sizeof(struct xfs_cud_log_format)) ++ if (item->ri_buf[0].i_len != sizeof(struct xfs_cud_log_format)) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, log->l_mp); + return -EFSCORRUPTED; ++ } + cui_id = cud_formatp->cud_cui_id; + + /* +@@ -3654,6 +3658,7 @@ xfs_bui_copy_format( + memcpy(dst_bui_fmt, src_bui_fmt, len); + return 0; + } ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, NULL); + return -EFSCORRUPTED; + } + +@@ -3677,8 +3682,10 @@ xlog_recover_bui_pass2( + + bui_formatp = item->ri_buf[0].i_addr; + +- if (bui_formatp->bui_nextents != XFS_BUI_MAX_FAST_EXTENTS) ++ if (bui_formatp->bui_nextents != XFS_BUI_MAX_FAST_EXTENTS) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, log->l_mp); + return -EFSCORRUPTED; ++ } + buip = xfs_bui_init(mp); + error = xfs_bui_copy_format(&item->ri_buf[0], &buip->bui_format); + if (error) { +@@ -3720,8 +3727,10 @@ xlog_recover_bud_pass2( + struct xfs_ail *ailp = log->l_ailp; + + bud_formatp = item->ri_buf[0].i_addr; +- if (item->ri_buf[0].i_len != sizeof(struct xfs_bud_log_format)) ++ if (item->ri_buf[0].i_len != sizeof(struct xfs_bud_log_format)) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, log->l_mp); + return -EFSCORRUPTED; ++ } + bui_id = bud_formatp->bud_bui_id; + + /* +@@ -4018,7 +4027,7 @@ xlog_recover_commit_pass1( + xfs_warn(log->l_mp, "%s: invalid item type (%d)", + __func__, ITEM_TYPE(item)); + ASSERT(0); +- return -EIO; ++ return -EFSCORRUPTED; + } + } + +@@ -4066,7 +4075,7 @@ xlog_recover_commit_pass2( + xfs_warn(log->l_mp, "%s: invalid item type (%d)", + __func__, ITEM_TYPE(item)); + ASSERT(0); +- return -EIO; ++ return -EFSCORRUPTED; + } + } + +@@ -4187,7 +4196,7 @@ xlog_recover_add_to_cont_trans( + ASSERT(len <= sizeof(struct xfs_trans_header)); + if (len > sizeof(struct xfs_trans_header)) { + xfs_warn(log->l_mp, "%s: bad header length", __func__); +- return -EIO; ++ return -EFSCORRUPTED; + } + + xlog_recover_add_item(&trans->r_itemq); +@@ -4243,13 +4252,13 @@ xlog_recover_add_to_trans( + xfs_warn(log->l_mp, "%s: bad header magic number", + __func__); + ASSERT(0); +- return -EIO; ++ return -EFSCORRUPTED; + } + + if (len > sizeof(struct xfs_trans_header)) { + xfs_warn(log->l_mp, "%s: bad header length", __func__); + ASSERT(0); +- return -EIO; ++ return -EFSCORRUPTED; + } + + /* +@@ -4285,7 +4294,7 @@ xlog_recover_add_to_trans( + in_f->ilf_size); + ASSERT(0); + kmem_free(ptr); +- return -EIO; ++ return -EFSCORRUPTED; + } + + item->ri_total = in_f->ilf_size; +@@ -4293,7 +4302,16 @@ xlog_recover_add_to_trans( + kmem_zalloc(item->ri_total * sizeof(xfs_log_iovec_t), + 0); + } +- ASSERT(item->ri_total > item->ri_cnt); ++ ++ if (item->ri_total <= item->ri_cnt) { ++ xfs_warn(log->l_mp, ++ "log item region count (%d) overflowed size (%d)", ++ item->ri_cnt, item->ri_total); ++ ASSERT(0); ++ kmem_free(ptr); ++ return -EFSCORRUPTED; ++ } ++ + /* Description region is ri_buf[0] */ + item->ri_buf[item->ri_cnt].i_addr = ptr; + item->ri_buf[item->ri_cnt].i_len = len; +@@ -4380,7 +4398,7 @@ xlog_recovery_process_trans( + default: + xfs_warn(log->l_mp, "%s: bad flag 0x%x", __func__, flags); + ASSERT(0); +- error = -EIO; ++ error = -EFSCORRUPTED; + break; + } + if (error || freeit) +@@ -4460,7 +4478,7 @@ xlog_recover_process_ophdr( + xfs_warn(log->l_mp, "%s: bad clientid 0x%x", + __func__, ohead->oh_clientid); + ASSERT(0); +- return -EIO; ++ return -EFSCORRUPTED; + } + + /* +@@ -4470,7 +4488,7 @@ xlog_recover_process_ophdr( + if (dp + len > end) { + xfs_warn(log->l_mp, "%s: bad length 0x%x", __func__, len); + WARN_ON(1); +- return -EIO; ++ return -EFSCORRUPTED; + } + + trans = xlog_recover_ophdr_to_trans(rhash, rhead, ohead); +@@ -5172,8 +5190,10 @@ xlog_recover_process( + * If the filesystem is CRC enabled, this mismatch becomes a + * fatal log corruption failure. + */ +- if (xfs_sb_version_hascrc(&log->l_mp->m_sb)) ++ if (xfs_sb_version_hascrc(&log->l_mp->m_sb)) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, log->l_mp); + return -EFSCORRUPTED; ++ } + } + + xlog_unpack_data(rhead, dp, log); +@@ -5200,7 +5220,7 @@ xlog_valid_rec_header( + (be32_to_cpu(rhead->h_version) & (~XLOG_VERSION_OKBITS))))) { + xfs_warn(log->l_mp, "%s: unrecognised log version (%d).", + __func__, be32_to_cpu(rhead->h_version)); +- return -EIO; ++ return -EFSCORRUPTED; + } + + /* LR body must have data or it wouldn't have been written */ +@@ -5296,8 +5316,12 @@ xlog_do_recovery_pass( + "invalid iclog size (%d bytes), using lsunit (%d bytes)", + h_size, log->l_mp->m_logbsize); + h_size = log->l_mp->m_logbsize; +- } else +- return -EFSCORRUPTED; ++ } else { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, ++ log->l_mp); ++ error = -EFSCORRUPTED; ++ goto bread_err1; ++ } + } + + if ((be32_to_cpu(rhead->h_version) & XLOG_VERSION_2) && +diff --git a/fs/xfs/xfs_message.c b/fs/xfs/xfs_message.c +index 9804efe525a93..c57e8ad397125 100644 +--- a/fs/xfs/xfs_message.c ++++ b/fs/xfs/xfs_message.c +@@ -105,7 +105,7 @@ assfail(char *expr, char *file, int line) + } + + void +-xfs_hex_dump(void *p, int length) ++xfs_hex_dump(const void *p, int length) + { + print_hex_dump(KERN_ALERT, "", DUMP_PREFIX_OFFSET, 16, 1, p, length, 1); + } +diff --git a/fs/xfs/xfs_message.h b/fs/xfs/xfs_message.h +index 34447dca97d13..7f040b04b7393 100644 +--- a/fs/xfs/xfs_message.h ++++ b/fs/xfs/xfs_message.h +@@ -60,6 +60,6 @@ do { \ + extern void assfail(char *expr, char *f, int l); + extern void asswarn(char *expr, char *f, int l); + +-extern void xfs_hex_dump(void *p, int length); ++extern void xfs_hex_dump(const void *p, int length); + + #endif /* __XFS_MESSAGE_H */ +diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c +index 5a0ce0c2c4bbd..bbcf48a625b2a 100644 +--- a/fs/xfs/xfs_mount.c ++++ b/fs/xfs/xfs_mount.c +@@ -31,7 +31,7 @@ + #include "xfs_reflink.h" + #include "xfs_extent_busy.h" + #include "xfs_health.h" +- ++#include "xfs_trace.h" + + static DEFINE_MUTEX(xfs_uuid_table_mutex); + static int xfs_uuid_table_size; +@@ -365,66 +365,119 @@ release_buf: + } + + /* +- * Update alignment values based on mount options and sb values ++ * If the sunit/swidth change would move the precomputed root inode value, we ++ * must reject the ondisk change because repair will stumble over that. ++ * However, we allow the mount to proceed because we never rejected this ++ * combination before. Returns true to update the sb, false otherwise. ++ */ ++static inline int ++xfs_check_new_dalign( ++ struct xfs_mount *mp, ++ int new_dalign, ++ bool *update_sb) ++{ ++ struct xfs_sb *sbp = &mp->m_sb; ++ xfs_ino_t calc_ino; ++ ++ calc_ino = xfs_ialloc_calc_rootino(mp, new_dalign); ++ trace_xfs_check_new_dalign(mp, new_dalign, calc_ino); ++ ++ if (sbp->sb_rootino == calc_ino) { ++ *update_sb = true; ++ return 0; ++ } ++ ++ xfs_warn(mp, ++"Cannot change stripe alignment; would require moving root inode."); ++ ++ /* ++ * XXX: Next time we add a new incompat feature, this should start ++ * returning -EINVAL to fail the mount. Until then, spit out a warning ++ * that we're ignoring the administrator's instructions. ++ */ ++ xfs_warn(mp, "Skipping superblock stripe alignment update."); ++ *update_sb = false; ++ return 0; ++} ++ ++/* ++ * If we were provided with new sunit/swidth values as mount options, make sure ++ * that they pass basic alignment and superblock feature checks, and convert ++ * them into the same units (FSB) that everything else expects. This step ++ * /must/ be done before computing the inode geometry. + */ + STATIC int +-xfs_update_alignment(xfs_mount_t *mp) ++xfs_validate_new_dalign( ++ struct xfs_mount *mp) + { +- xfs_sb_t *sbp = &(mp->m_sb); ++ if (mp->m_dalign == 0) ++ return 0; + +- if (mp->m_dalign) { ++ /* ++ * If stripe unit and stripe width are not multiples ++ * of the fs blocksize turn off alignment. ++ */ ++ if ((BBTOB(mp->m_dalign) & mp->m_blockmask) || ++ (BBTOB(mp->m_swidth) & mp->m_blockmask)) { ++ xfs_warn(mp, ++ "alignment check failed: sunit/swidth vs. blocksize(%d)", ++ mp->m_sb.sb_blocksize); ++ return -EINVAL; ++ } else { + /* +- * If stripe unit and stripe width are not multiples +- * of the fs blocksize turn off alignment. ++ * Convert the stripe unit and width to FSBs. + */ +- if ((BBTOB(mp->m_dalign) & mp->m_blockmask) || +- (BBTOB(mp->m_swidth) & mp->m_blockmask)) { ++ mp->m_dalign = XFS_BB_TO_FSBT(mp, mp->m_dalign); ++ if (mp->m_dalign && (mp->m_sb.sb_agblocks % mp->m_dalign)) { + xfs_warn(mp, +- "alignment check failed: sunit/swidth vs. blocksize(%d)", +- sbp->sb_blocksize); ++ "alignment check failed: sunit/swidth vs. agsize(%d)", ++ mp->m_sb.sb_agblocks); + return -EINVAL; +- } else { +- /* +- * Convert the stripe unit and width to FSBs. +- */ +- mp->m_dalign = XFS_BB_TO_FSBT(mp, mp->m_dalign); +- if (mp->m_dalign && (sbp->sb_agblocks % mp->m_dalign)) { +- xfs_warn(mp, +- "alignment check failed: sunit/swidth vs. agsize(%d)", +- sbp->sb_agblocks); +- return -EINVAL; +- } else if (mp->m_dalign) { +- mp->m_swidth = XFS_BB_TO_FSBT(mp, mp->m_swidth); +- } else { +- xfs_warn(mp, +- "alignment check failed: sunit(%d) less than bsize(%d)", +- mp->m_dalign, sbp->sb_blocksize); +- return -EINVAL; +- } +- } +- +- /* +- * Update superblock with new values +- * and log changes +- */ +- if (xfs_sb_version_hasdalign(sbp)) { +- if (sbp->sb_unit != mp->m_dalign) { +- sbp->sb_unit = mp->m_dalign; +- mp->m_update_sb = true; +- } +- if (sbp->sb_width != mp->m_swidth) { +- sbp->sb_width = mp->m_swidth; +- mp->m_update_sb = true; +- } ++ } else if (mp->m_dalign) { ++ mp->m_swidth = XFS_BB_TO_FSBT(mp, mp->m_swidth); + } else { + xfs_warn(mp, +- "cannot change alignment: superblock does not support data alignment"); ++ "alignment check failed: sunit(%d) less than bsize(%d)", ++ mp->m_dalign, mp->m_sb.sb_blocksize); + return -EINVAL; + } ++ } ++ ++ if (!xfs_sb_version_hasdalign(&mp->m_sb)) { ++ xfs_warn(mp, ++"cannot change alignment: superblock does not support data alignment"); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ ++/* Update alignment values based on mount options and sb values. */ ++STATIC int ++xfs_update_alignment( ++ struct xfs_mount *mp) ++{ ++ struct xfs_sb *sbp = &mp->m_sb; ++ ++ if (mp->m_dalign) { ++ bool update_sb; ++ int error; ++ ++ if (sbp->sb_unit == mp->m_dalign && ++ sbp->sb_width == mp->m_swidth) ++ return 0; ++ ++ error = xfs_check_new_dalign(mp, mp->m_dalign, &update_sb); ++ if (error || !update_sb) ++ return error; ++ ++ sbp->sb_unit = mp->m_dalign; ++ sbp->sb_width = mp->m_swidth; ++ mp->m_update_sb = true; + } else if ((mp->m_flags & XFS_MOUNT_NOALIGN) != XFS_MOUNT_NOALIGN && + xfs_sb_version_hasdalign(&mp->m_sb)) { +- mp->m_dalign = sbp->sb_unit; +- mp->m_swidth = sbp->sb_width; ++ mp->m_dalign = sbp->sb_unit; ++ mp->m_swidth = sbp->sb_width; + } + + return 0; +@@ -692,12 +745,12 @@ xfs_mountfs( + } + + /* +- * Check if sb_agblocks is aligned at stripe boundary +- * If sb_agblocks is NOT aligned turn off m_dalign since +- * allocator alignment is within an ag, therefore ag has +- * to be aligned at stripe boundary. ++ * If we were given new sunit/swidth options, do some basic validation ++ * checks and convert the incore dalign and swidth values to the ++ * same units (FSB) that everything else uses. This /must/ happen ++ * before computing the inode geometry. + */ +- error = xfs_update_alignment(mp); ++ error = xfs_validate_new_dalign(mp); + if (error) + goto out; + +@@ -708,6 +761,17 @@ xfs_mountfs( + xfs_rmapbt_compute_maxlevels(mp); + xfs_refcountbt_compute_maxlevels(mp); + ++ /* ++ * Check if sb_agblocks is aligned at stripe boundary. If sb_agblocks ++ * is NOT aligned turn off m_dalign since allocator alignment is within ++ * an ag, therefore ag has to be aligned at stripe boundary. Note that ++ * we must compute the free space and rmap btree geometry before doing ++ * this. ++ */ ++ error = xfs_update_alignment(mp); ++ if (error) ++ goto out; ++ + /* enable fail_at_unmount as default */ + mp->m_fail_unmount = true; + +diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c +index f63fe8d924a36..058af699e046c 100644 +--- a/fs/xfs/xfs_pnfs.c ++++ b/fs/xfs/xfs_pnfs.c +@@ -147,11 +147,11 @@ xfs_fs_map_blocks( + if (error) + goto out_unlock; + ++ ASSERT(!nimaps || imap.br_startblock != DELAYSTARTBLOCK); ++ + if (write) { + enum xfs_prealloc_flags flags = 0; + +- ASSERT(imap.br_startblock != DELAYSTARTBLOCK); +- + if (!nimaps || imap.br_startblock == HOLESTARTBLOCK) { + /* + * xfs_iomap_write_direct() expects to take ownership of +diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c +index ecd8ce152ab1f..66ea8e4fca86c 100644 +--- a/fs/xfs/xfs_qm.c ++++ b/fs/xfs/xfs_qm.c +@@ -22,6 +22,7 @@ + #include "xfs_qm.h" + #include "xfs_trace.h" + #include "xfs_icache.h" ++#include "xfs_error.h" + + /* + * The global quota manager. There is only one of these for the entire +@@ -754,11 +755,19 @@ xfs_qm_qino_alloc( + if ((flags & XFS_QMOPT_PQUOTA) && + (mp->m_sb.sb_gquotino != NULLFSINO)) { + ino = mp->m_sb.sb_gquotino; +- ASSERT(mp->m_sb.sb_pquotino == NULLFSINO); ++ if (mp->m_sb.sb_pquotino != NULLFSINO) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, ++ mp); ++ return -EFSCORRUPTED; ++ } + } else if ((flags & XFS_QMOPT_GQUOTA) && + (mp->m_sb.sb_pquotino != NULLFSINO)) { + ino = mp->m_sb.sb_pquotino; +- ASSERT(mp->m_sb.sb_gquotino == NULLFSINO); ++ if (mp->m_sb.sb_gquotino != NULLFSINO) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, ++ mp); ++ return -EFSCORRUPTED; ++ } + } + if (ino != NULLFSINO) { + error = xfs_iget(mp, NULL, ino, 0, 0, ip); +diff --git a/fs/xfs/xfs_refcount_item.c b/fs/xfs/xfs_refcount_item.c +index 2328268e62459..d5708d40ad877 100644 +--- a/fs/xfs/xfs_refcount_item.c ++++ b/fs/xfs/xfs_refcount_item.c +@@ -17,7 +17,7 @@ + #include "xfs_refcount_item.h" + #include "xfs_log.h" + #include "xfs_refcount.h" +- ++#include "xfs_error.h" + + kmem_zone_t *xfs_cui_zone; + kmem_zone_t *xfs_cud_zone; +@@ -497,7 +497,7 @@ xfs_cui_recover( + */ + set_bit(XFS_CUI_RECOVERED, &cuip->cui_flags); + xfs_cui_release(cuip); +- return -EIO; ++ return -EFSCORRUPTED; + } + } + +@@ -536,6 +536,7 @@ xfs_cui_recover( + type = refc_type; + break; + default: ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, mp); + error = -EFSCORRUPTED; + goto abort_error; + } +diff --git a/fs/xfs/xfs_rmap_item.c b/fs/xfs/xfs_rmap_item.c +index 8939e0ea09cd5..02f84d9a511c3 100644 +--- a/fs/xfs/xfs_rmap_item.c ++++ b/fs/xfs/xfs_rmap_item.c +@@ -17,7 +17,7 @@ + #include "xfs_rmap_item.h" + #include "xfs_log.h" + #include "xfs_rmap.h" +- ++#include "xfs_error.h" + + kmem_zone_t *xfs_rui_zone; + kmem_zone_t *xfs_rud_zone; +@@ -171,8 +171,10 @@ xfs_rui_copy_format( + src_rui_fmt = buf->i_addr; + len = xfs_rui_log_format_sizeof(src_rui_fmt->rui_nextents); + +- if (buf->i_len != len) ++ if (buf->i_len != len) { ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, NULL); + return -EFSCORRUPTED; ++ } + + memcpy(dst_rui_fmt, src_rui_fmt, len); + return 0; +@@ -539,7 +541,7 @@ xfs_rui_recover( + */ + set_bit(XFS_RUI_RECOVERED, &ruip->rui_flags); + xfs_rui_release(ruip); +- return -EIO; ++ return -EFSCORRUPTED; + } + } + +@@ -581,6 +583,7 @@ xfs_rui_recover( + type = XFS_RMAP_FREE; + break; + default: ++ XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, NULL); + error = -EFSCORRUPTED; + goto abort_error; + } +diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h +index eaae275ed4308..ffb398c1de698 100644 +--- a/fs/xfs/xfs_trace.h ++++ b/fs/xfs/xfs_trace.h +@@ -3609,6 +3609,27 @@ DEFINE_KMEM_EVENT(kmem_alloc_large); + DEFINE_KMEM_EVENT(kmem_realloc); + DEFINE_KMEM_EVENT(kmem_zone_alloc); + ++TRACE_EVENT(xfs_check_new_dalign, ++ TP_PROTO(struct xfs_mount *mp, int new_dalign, xfs_ino_t calc_rootino), ++ TP_ARGS(mp, new_dalign, calc_rootino), ++ TP_STRUCT__entry( ++ __field(dev_t, dev) ++ __field(int, new_dalign) ++ __field(xfs_ino_t, sb_rootino) ++ __field(xfs_ino_t, calc_rootino) ++ ), ++ TP_fast_assign( ++ __entry->dev = mp->m_super->s_dev; ++ __entry->new_dalign = new_dalign; ++ __entry->sb_rootino = mp->m_sb.sb_rootino; ++ __entry->calc_rootino = calc_rootino; ++ ), ++ TP_printk("dev %d:%d new_dalign %d sb_rootino %llu calc_rootino %llu", ++ MAJOR(__entry->dev), MINOR(__entry->dev), ++ __entry->new_dalign, __entry->sb_rootino, ++ __entry->calc_rootino) ++) ++ + #endif /* _TRACE_XFS_H */ + + #undef TRACE_INCLUDE_PATH +diff --git a/include/linux/iomap.h b/include/linux/iomap.h +index 53b16f104081b..74e05e7b67f50 100644 +--- a/include/linux/iomap.h ++++ b/include/linux/iomap.h +@@ -32,6 +32,8 @@ struct vm_fault; + * + * IOMAP_F_DIRTY indicates the inode has uncommitted metadata needed to access + * written data and requires fdatasync to commit them to persistent storage. ++ * This needs to take into account metadata changes that *may* be made at IO ++ * completion, such as file size updates from direct IO. + */ + #define IOMAP_F_NEW 0x01 /* blocks have been newly allocated */ + #define IOMAP_F_DIRTY 0x02 /* uncommitted metadata */ +diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h +index d10150587d819..1009b6b5ce403 100644 +--- a/include/linux/sched/task_stack.h ++++ b/include/linux/sched/task_stack.h +@@ -16,7 +16,7 @@ + * try_get_task_stack() instead. task_stack_page will return a pointer + * that could get freed out from under you. + */ +-static inline void *task_stack_page(const struct task_struct *task) ++static __always_inline void *task_stack_page(const struct task_struct *task) + { + return task->stack; + } +diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h +index 2b78cc734719a..10f209d54f18a 100644 +--- a/include/linux/serial_core.h ++++ b/include/linux/serial_core.h +@@ -297,6 +297,23 @@ struct uart_state { + /* number of characters left in xmit buffer before we ask for more */ + #define WAKEUP_CHARS 256 + ++/** ++ * uart_xmit_advance - Advance xmit buffer and account Tx'ed chars ++ * @up: uart_port structure describing the port ++ * @chars: number of characters sent ++ * ++ * This function advances the tail of circular xmit buffer by the number of ++ * @chars transmitted and handles accounting of transmitted bytes (into ++ * @up's icount.tx). ++ */ ++static inline void uart_xmit_advance(struct uart_port *up, unsigned int chars) ++{ ++ struct circ_buf *xmit = &up->state->xmit; ++ ++ xmit->tail = (xmit->tail + chars) & (UART_XMIT_SIZE - 1); ++ up->icount.tx += chars; ++} ++ + struct module; + struct tty_driver; + +diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c +index aa7577b189e92..9e847e71ceddf 100644 +--- a/kernel/cgroup/cgroup-v1.c ++++ b/kernel/cgroup/cgroup-v1.c +@@ -15,6 +15,7 @@ + #include <linux/pid_namespace.h> + #include <linux/cgroupstats.h> + #include <linux/fs_parser.h> ++#include <linux/cpu.h> + + #include <trace/events/cgroup.h> + +@@ -62,6 +63,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk) + int retval = 0; + + mutex_lock(&cgroup_mutex); ++ cpus_read_lock(); + percpu_down_write(&cgroup_threadgroup_rwsem); + for_each_root(root) { + struct cgroup *from_cgrp; +@@ -78,6 +80,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk) + break; + } + percpu_up_write(&cgroup_threadgroup_rwsem); ++ cpus_read_unlock(); + mutex_unlock(&cgroup_mutex); + + return retval; +diff --git a/kernel/trace/trace_preemptirq.c b/kernel/trace/trace_preemptirq.c +index 26b06b09c9f68..e9645f829b94c 100644 +--- a/kernel/trace/trace_preemptirq.c ++++ b/kernel/trace/trace_preemptirq.c +@@ -56,14 +56,14 @@ __visible void trace_hardirqs_on_caller(unsigned long caller_addr) + this_cpu_write(tracing_irq_cpu, 0); + } + +- lockdep_hardirqs_on(CALLER_ADDR0); ++ lockdep_hardirqs_on(caller_addr); + } + EXPORT_SYMBOL(trace_hardirqs_on_caller); + NOKPROBE_SYMBOL(trace_hardirqs_on_caller); + + __visible void trace_hardirqs_off_caller(unsigned long caller_addr) + { +- lockdep_hardirqs_off(CALLER_ADDR0); ++ lockdep_hardirqs_off(caller_addr); + + if (!this_cpu_read(tracing_irq_cpu)) { + this_cpu_write(tracing_irq_cpu, 1); +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index e90f37e22202a..dd96391b44de0 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -3049,10 +3049,8 @@ static bool __flush_work(struct work_struct *work, bool from_cancel) + if (WARN_ON(!work->func)) + return false; + +- if (!from_cancel) { +- lock_map_acquire(&work->lockdep_map); +- lock_map_release(&work->lockdep_map); +- } ++ lock_map_acquire(&work->lockdep_map); ++ lock_map_release(&work->lockdep_map); + + if (start_flush_work(work, &barr, from_cancel)) { + wait_for_completion(&barr.done); +diff --git a/mm/slub.c b/mm/slub.c +index 5211496f6d24f..17e663cf38f69 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -5743,7 +5743,8 @@ static char *create_unique_id(struct kmem_cache *s) + char *name = kmalloc(ID_STR_LENGTH, GFP_KERNEL); + char *p = name; + +- BUG_ON(!name); ++ if (!name) ++ return ERR_PTR(-ENOMEM); + + *p++ = ':'; + /* +@@ -5825,6 +5826,8 @@ static int sysfs_slab_add(struct kmem_cache *s) + * for the symlinks. + */ + name = create_unique_id(s); ++ if (IS_ERR(name)) ++ return PTR_ERR(name); + } + + s->kobj.kset = kset; +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index ddb988c339c17..f6853fc0fcc00 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -999,8 +999,10 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl, + goto free_iterate; + } + +- if (repl->valid_hooks != t->valid_hooks) ++ if (repl->valid_hooks != t->valid_hooks) { ++ ret = -EINVAL; + goto free_unlock; ++ } + + if (repl->num_counters && repl->num_counters != t->private->nentries) { + ret = -EINVAL; +diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c +index 344b2c22e75b5..c353162e81aea 100644 +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -431,10 +431,6 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted) + scan_req = rcu_dereference_protected(local->scan_req, + lockdep_is_held(&local->mtx)); + +- if (scan_req != local->int_scan_req) { +- local->scan_info.aborted = aborted; +- cfg80211_scan_done(scan_req, &local->scan_info); +- } + RCU_INIT_POINTER(local->scan_req, NULL); + + scan_sdata = rcu_dereference_protected(local->scan_sdata, +@@ -444,6 +440,13 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted) + local->scanning = 0; + local->scan_chandef.chan = NULL; + ++ synchronize_rcu(); ++ ++ if (scan_req != local->int_scan_req) { ++ local->scan_info.aborted = aborted; ++ cfg80211_scan_done(scan_req, &local->scan_info); ++ } ++ + /* Set power back to normal operating levels. */ + ieee80211_hw_config(local, 0); + +diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c +index 26245419ef4a9..65b5b05fe38d3 100644 +--- a/net/netfilter/nf_conntrack_irc.c ++++ b/net/netfilter/nf_conntrack_irc.c +@@ -148,15 +148,37 @@ static int help(struct sk_buff *skb, unsigned int protoff, + data = ib_ptr; + data_limit = ib_ptr + skb->len - dataoff; + +- /* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24 +- * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */ +- while (data < data_limit - (19 + MINMATCHLEN)) { +- if (memcmp(data, "\1DCC ", 5)) { ++ /* Skip any whitespace */ ++ while (data < data_limit - 10) { ++ if (*data == ' ' || *data == '\r' || *data == '\n') ++ data++; ++ else ++ break; ++ } ++ ++ /* strlen("PRIVMSG x ")=10 */ ++ if (data < data_limit - 10) { ++ if (strncasecmp("PRIVMSG ", data, 8)) ++ goto out; ++ data += 8; ++ } ++ ++ /* strlen(" :\1DCC SENT t AAAAAAAA P\1\n")=26 ++ * 7+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=26 ++ */ ++ while (data < data_limit - (21 + MINMATCHLEN)) { ++ /* Find first " :", the start of message */ ++ if (memcmp(data, " :", 2)) { + data++; + continue; + } ++ data += 2; ++ ++ /* then check that place only for the DCC command */ ++ if (memcmp(data, "\1DCC ", 5)) ++ goto out; + data += 5; +- /* we have at least (19+MINMATCHLEN)-5 bytes valid data left */ ++ /* we have at least (21+MINMATCHLEN)-(2+5) bytes valid data left */ + + iph = ip_hdr(skb); + pr_debug("DCC found in master %pI4:%u %pI4:%u\n", +@@ -172,7 +194,7 @@ static int help(struct sk_buff *skb, unsigned int protoff, + pr_debug("DCC %s detected\n", dccprotos[i]); + + /* we have at least +- * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid ++ * (21+MINMATCHLEN)-7-dccprotos[i].matchlen bytes valid + * data left (== 14/13 bytes) */ + if (parse_dcc(data, data_limit, &dcc_ip, + &dcc_port, &addr_beg_p, &addr_end_p)) { +diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c +index b83dc9bf0a5dd..78fd9122b70c7 100644 +--- a/net/netfilter/nf_conntrack_sip.c ++++ b/net/netfilter/nf_conntrack_sip.c +@@ -477,7 +477,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr, + return ret; + if (ret == 0) + break; +- dataoff += *matchoff; ++ dataoff = *matchoff; + } + *in_header = 0; + } +@@ -489,7 +489,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr, + break; + if (ret == 0) + return ret; +- dataoff += *matchoff; ++ dataoff = *matchoff; + } + + if (in_header) +diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c +index 79fbf37291f38..51e3953b414c0 100644 +--- a/net/netfilter/nfnetlink_osf.c ++++ b/net/netfilter/nfnetlink_osf.c +@@ -269,6 +269,7 @@ bool nf_osf_find(const struct sk_buff *skb, + struct nf_osf_hdr_ctx ctx; + const struct tcphdr *tcp; + struct tcphdr _tcph; ++ bool found = false; + + memset(&ctx, 0, sizeof(ctx)); + +@@ -283,10 +284,11 @@ bool nf_osf_find(const struct sk_buff *skb, + + data->genre = f->genre; + data->version = f->version; ++ found = true; + break; + } + +- return true; ++ return found; + } + EXPORT_SYMBOL_GPL(nf_osf_find); + +diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c +index 8574e7066d94c..b5f173960725b 100644 +--- a/net/rxrpc/call_event.c ++++ b/net/rxrpc/call_event.c +@@ -166,7 +166,7 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j) + _enter("{%d,%d}", call->tx_hard_ack, call->tx_top); + + now = ktime_get_real(); +- max_age = ktime_sub(now, jiffies_to_usecs(call->peer->rto_j)); ++ max_age = ktime_sub_us(now, jiffies_to_usecs(call->peer->rto_j)); + + spin_lock_bh(&call->lock); + +diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c +index 01135e54d95d2..fc784fcc3a947 100644 +--- a/net/rxrpc/local_object.c ++++ b/net/rxrpc/local_object.c +@@ -448,6 +448,9 @@ static void rxrpc_local_processor(struct work_struct *work) + container_of(work, struct rxrpc_local, processor); + bool again; + ++ if (local->dead) ++ return; ++ + trace_rxrpc_local(local->debug_id, rxrpc_local_processing, + atomic_read(&local->usage), NULL); + +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index 919c7fa5f02d6..48a8c7daa635e 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -2098,6 +2098,7 @@ replay: + } + + if (chain->tmplt_ops && chain->tmplt_ops != tp->ops) { ++ tfilter_put(tp, fh); + NL_SET_ERR_MSG(extack, "Chain template is set to a different filter kind"); + err = -EINVAL; + goto errout; +diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c +index 4c26f7fb32b34..506ebae1f72cf 100644 +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -65,6 +65,7 @@ struct taprio_sched { + u32 flags; + enum tk_offsets tk_offset; + int clockid; ++ bool offloaded; + atomic64_t picos_per_byte; /* Using picoseconds because for 10Gbps+ + * speeds it's sub-nanoseconds per byte + */ +@@ -1268,6 +1269,8 @@ static int taprio_enable_offload(struct net_device *dev, + goto done; + } + ++ q->offloaded = true; ++ + done: + taprio_offload_free(offload); + +@@ -1282,12 +1285,9 @@ static int taprio_disable_offload(struct net_device *dev, + struct tc_taprio_qopt_offload *offload; + int err; + +- if (!FULL_OFFLOAD_IS_ENABLED(q->flags)) ++ if (!q->offloaded) + return 0; + +- if (!ops->ndo_setup_tc) +- return -EOPNOTSUPP; +- + offload = taprio_offload_alloc(0); + if (!offload) { + NL_SET_ERR_MSG(extack, +@@ -1303,6 +1303,8 @@ static int taprio_disable_offload(struct net_device *dev, + goto out; + } + ++ q->offloaded = false; ++ + out: + taprio_offload_free(offload); + +@@ -1904,12 +1906,14 @@ start_error: + + static struct Qdisc *taprio_leaf(struct Qdisc *sch, unsigned long cl) + { +- struct netdev_queue *dev_queue = taprio_queue_get(sch, cl); ++ struct taprio_sched *q = qdisc_priv(sch); ++ struct net_device *dev = qdisc_dev(sch); ++ unsigned int ntx = cl - 1; + +- if (!dev_queue) ++ if (ntx >= dev->num_tx_queues) + return NULL; + +- return dev_queue->qdisc_sleeping; ++ return q->qdiscs[ntx]; + } + + static unsigned long taprio_find(struct Qdisc *sch, u32 classid) +diff --git a/scripts/mksysmap b/scripts/mksysmap +index 9aa23d15862a0..ad8bbc52267d0 100755 +--- a/scripts/mksysmap ++++ b/scripts/mksysmap +@@ -41,4 +41,4 @@ + # so we just ignore them to let readprofile continue to work. + # (At least sparc64 has __crc_ in the middle). + +-$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( \.L\)' > $2 ++$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( \.L\)\|\( L0\)' > $2 +diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c +index ad4e0af2d0d03..51d2911366e93 100644 +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -1661,13 +1661,14 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file) + runtime = substream->runtime; + if (atomic_read(&substream->mmap_count)) + goto __direct; +- if ((err = snd_pcm_oss_make_ready(substream)) < 0) +- return err; + atomic_inc(&runtime->oss.rw_ref); + if (mutex_lock_interruptible(&runtime->oss.params_lock)) { + atomic_dec(&runtime->oss.rw_ref); + return -ERESTARTSYS; + } ++ err = snd_pcm_oss_make_ready_locked(substream); ++ if (err < 0) ++ goto unlock; + format = snd_pcm_oss_format_from(runtime->oss.format); + width = snd_pcm_format_physical_width(format); + if (runtime->oss.buffer_used > 0) { +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index b8fe0ec5d6247..5b892e7090ddc 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2528,6 +2528,8 @@ static const struct pci_device_id azx_ids[] = { + /* 5 Series/3400 */ + { PCI_DEVICE(0x8086, 0x3b56), + .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM }, ++ { PCI_DEVICE(0x8086, 0x3b57), ++ .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM }, + /* Poulsbo */ + { PCI_DEVICE(0x8086, 0x811b), + .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE }, +diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c +index 2971b34c87c1a..e235c3ec634db 100644 +--- a/sound/pci/hda/hda_tegra.c ++++ b/sound/pci/hda/hda_tegra.c +@@ -428,7 +428,8 @@ MODULE_DEVICE_TABLE(of, hda_tegra_match); + static int hda_tegra_probe(struct platform_device *pdev) + { + const unsigned int driver_flags = AZX_DCAPS_CORBRP_SELF_CLEAR | +- AZX_DCAPS_PM_RUNTIME; ++ AZX_DCAPS_PM_RUNTIME | ++ AZX_DCAPS_4K_BDLE_BOUNDARY; + struct snd_card *card; + struct azx *chip; + struct hda_tegra *hda; +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index 5128a5df16fd3..169e742999873 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -3703,6 +3703,7 @@ static int patch_tegra_hdmi(struct hda_codec *codec) + if (err) + return err; + ++ codec->depop_delay = 10; + codec->patch_ops.build_pcms = tegra_hdmi_build_pcms; + spec = codec->spec; + spec->chmap.ops.chmap_cea_alloc_validate_get_type = +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index d925ae7f1b027..930bb040b403e 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6484,6 +6484,8 @@ enum { + ALC294_FIXUP_ASUS_GU502_HP, + ALC294_FIXUP_ASUS_GU502_PINS, + ALC294_FIXUP_ASUS_GU502_VERBS, ++ ALC294_FIXUP_ASUS_G513_PINS, ++ ALC285_FIXUP_ASUS_G533Z_PINS, + ALC285_FIXUP_HP_GPIO_LED, + ALC285_FIXUP_HP_MUTE_LED, + ALC236_FIXUP_HP_GPIO_LED, +@@ -7760,6 +7762,24 @@ static const struct hda_fixup alc269_fixups[] = { + [ALC294_FIXUP_ASUS_GU502_HP] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc294_fixup_gu502_hp, ++ }, ++ [ALC294_FIXUP_ASUS_G513_PINS] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x03a11050 }, /* front HP mic */ ++ { 0x1a, 0x03a11c30 }, /* rear external mic */ ++ { 0x21, 0x03211420 }, /* front HP out */ ++ { } ++ }, ++ }, ++ [ALC285_FIXUP_ASUS_G533Z_PINS] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x14, 0x90170120 }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC294_FIXUP_ASUS_G513_PINS, + }, + [ALC294_FIXUP_ASUS_COEF_1B] = { + .type = HDA_FIXUP_VERBS, +@@ -8118,6 +8138,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB), ++ SND_PCI_QUIRK(0x1028, 0x087d, "Dell Precision 5530", ALC289_FIXUP_DUAL_SPK), + SND_PCI_QUIRK(0x1028, 0x08ad, "Dell WYSE AIO", ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x08ae, "Dell WYSE NB", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), +@@ -8229,10 +8250,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK), + SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), ++ SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK), ++ SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x1740, "ASUS UX430UA", ALC295_FIXUP_ASUS_DACS), + SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK), +- SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK), + SND_PCI_QUIRK(0x1043, 0x1881, "ASUS Zephyrus S/M", ALC294_FIXUP_ASUS_GX502_PINS), + SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x18f1, "Asus FX505DT", ALC256_FIXUP_ASUS_HEADSET_MIC), +@@ -8247,14 +8269,16 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), ++ SND_PCI_QUIRK(0x1043, 0x1c92, "ASUS ROG Strix G15", ALC285_FIXUP_ASUS_G533Z_PINS), + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), ++ SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE), + SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), + SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS), ++ SND_PCI_QUIRK(0x1043, 0x1e5e, "ASUS ROG Strix G513", ALC294_FIXUP_ASUS_G513_PINS), + SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401), ++ SND_PCI_QUIRK(0x1043, 0x1c52, "ASUS Zephyrus G15 2022", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), +- SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401), +- SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), + SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC), +@@ -8425,6 +8449,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD), + SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS), ++ SND_PCI_QUIRK(0x19e5, 0x320f, "Huawei WRT-WX9 ", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1b35, 0x1235, "CZC B20", ALC269_FIXUP_CZC_B20), + SND_PCI_QUIRK(0x1b35, 0x1236, "CZC TMI", ALC269_FIXUP_CZC_TMI), + SND_PCI_QUIRK(0x1b35, 0x1237, "CZC L101", ALC269_FIXUP_CZC_L101), +diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c +index bfd3fe5eff31c..04a89171327dc 100644 +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -209,6 +209,7 @@ struct sigmatel_spec { + + /* beep widgets */ + hda_nid_t anabeep_nid; ++ bool beep_power_on; + + /* SPDIF-out mux */ + const char * const *spdif_labels; +@@ -4441,6 +4442,28 @@ static int stac_suspend(struct hda_codec *codec) + stac_shutup(codec); + return 0; + } ++ ++static int stac_check_power_status(struct hda_codec *codec, hda_nid_t nid) ++{ ++#ifdef CONFIG_SND_HDA_INPUT_BEEP ++ struct sigmatel_spec *spec = codec->spec; ++#endif ++ int ret = snd_hda_gen_check_power_status(codec, nid); ++ ++#ifdef CONFIG_SND_HDA_INPUT_BEEP ++ if (nid == spec->gen.beep_nid && codec->beep) { ++ if (codec->beep->enabled != spec->beep_power_on) { ++ spec->beep_power_on = codec->beep->enabled; ++ if (spec->beep_power_on) ++ snd_hda_power_up_pm(codec); ++ else ++ snd_hda_power_down_pm(codec); ++ } ++ ret |= spec->beep_power_on; ++ } ++#endif ++ return ret; ++} + #else + #define stac_suspend NULL + #endif /* CONFIG_PM */ +@@ -4453,6 +4476,7 @@ static const struct hda_codec_ops stac_patch_ops = { + .unsol_event = snd_hda_jack_unsol_event, + #ifdef CONFIG_PM + .suspend = stac_suspend, ++ .check_power_status = stac_check_power_status, + #endif + .reboot_notify = stac_shutup, + }; +diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c +index c8ccfa2fff848..a95fe3fff1db8 100644 +--- a/sound/soc/codecs/nau8824.c ++++ b/sound/soc/codecs/nau8824.c +@@ -1072,6 +1072,7 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream, + struct snd_soc_component *component = dai->component; + struct nau8824 *nau8824 = snd_soc_component_get_drvdata(component); + unsigned int val_len = 0, osr, ctrl_val, bclk_fs, bclk_div; ++ int err = -EINVAL; + + nau8824_sema_acquire(nau8824, HZ); + +@@ -1088,7 +1089,7 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream, + osr &= NAU8824_DAC_OVERSAMPLE_MASK; + if (nau8824_clock_check(nau8824, substream->stream, + nau8824->fs, osr)) +- return -EINVAL; ++ goto error; + regmap_update_bits(nau8824->regmap, NAU8824_REG_CLK_DIVIDER, + NAU8824_CLK_DAC_SRC_MASK, + osr_dac_sel[osr].clk_src << NAU8824_CLK_DAC_SRC_SFT); +@@ -1098,7 +1099,7 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream, + osr &= NAU8824_ADC_SYNC_DOWN_MASK; + if (nau8824_clock_check(nau8824, substream->stream, + nau8824->fs, osr)) +- return -EINVAL; ++ goto error; + regmap_update_bits(nau8824->regmap, NAU8824_REG_CLK_DIVIDER, + NAU8824_CLK_ADC_SRC_MASK, + osr_adc_sel[osr].clk_src << NAU8824_CLK_ADC_SRC_SFT); +@@ -1119,7 +1120,7 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream, + else if (bclk_fs <= 256) + bclk_div = 0; + else +- return -EINVAL; ++ goto error; + regmap_update_bits(nau8824->regmap, + NAU8824_REG_PORT0_I2S_PCM_CTRL_2, + NAU8824_I2S_LRC_DIV_MASK | NAU8824_I2S_BLK_DIV_MASK, +@@ -1140,15 +1141,17 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream, + val_len |= NAU8824_I2S_DL_32; + break; + default: +- return -EINVAL; ++ goto error; + } + + regmap_update_bits(nau8824->regmap, NAU8824_REG_PORT0_I2S_PCM_CTRL_1, + NAU8824_I2S_DL_MASK, val_len); ++ err = 0; + ++ error: + nau8824_sema_release(nau8824); + +- return 0; ++ return err; + } + + static int nau8824_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) +@@ -1157,8 +1160,6 @@ static int nau8824_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + struct nau8824 *nau8824 = snd_soc_component_get_drvdata(component); + unsigned int ctrl1_val = 0, ctrl2_val = 0; + +- nau8824_sema_acquire(nau8824, HZ); +- + switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) { + case SND_SOC_DAIFMT_CBM_CFM: + ctrl2_val |= NAU8824_I2S_MS_MASTER; +@@ -1200,6 +1201,8 @@ static int nau8824_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + return -EINVAL; + } + ++ nau8824_sema_acquire(nau8824, HZ); ++ + regmap_update_bits(nau8824->regmap, NAU8824_REG_PORT0_I2S_PCM_CTRL_1, + NAU8824_I2S_DF_MASK | NAU8824_I2S_BP_MASK | + NAU8824_I2S_PCMB_EN, ctrl1_val); +diff --git a/tools/perf/util/genelf.c b/tools/perf/util/genelf.c +index 17b74aba8b9a2..69744fd5db395 100644 +--- a/tools/perf/util/genelf.c ++++ b/tools/perf/util/genelf.c +@@ -256,6 +256,7 @@ jit_write_elf(int fd, uint64_t load_addr, const char *sym, + Elf_Data *d; + Elf_Scn *scn; + Elf_Ehdr *ehdr; ++ Elf_Phdr *phdr; + Elf_Shdr *shdr; + uint64_t eh_frame_base_offset; + char *strsym = NULL; +@@ -290,6 +291,19 @@ jit_write_elf(int fd, uint64_t load_addr, const char *sym, + ehdr->e_version = EV_CURRENT; + ehdr->e_shstrndx= unwinding ? 4 : 2; /* shdr index for section name */ + ++ /* ++ * setup program header ++ */ ++ phdr = elf_newphdr(e, 1); ++ phdr[0].p_type = PT_LOAD; ++ phdr[0].p_offset = 0; ++ phdr[0].p_vaddr = 0; ++ phdr[0].p_paddr = 0; ++ phdr[0].p_filesz = csize; ++ phdr[0].p_memsz = csize; ++ phdr[0].p_flags = PF_X | PF_R; ++ phdr[0].p_align = 8; ++ + /* + * setup text section + */ +diff --git a/tools/perf/util/genelf.h b/tools/perf/util/genelf.h +index d4137559be053..ac638945b4cb0 100644 +--- a/tools/perf/util/genelf.h ++++ b/tools/perf/util/genelf.h +@@ -50,8 +50,10 @@ int jit_add_debug_info(Elf *e, uint64_t code_addr, void *debug, int nr_debug_ent + + #if GEN_ELF_CLASS == ELFCLASS64 + #define elf_newehdr elf64_newehdr ++#define elf_newphdr elf64_newphdr + #define elf_getshdr elf64_getshdr + #define Elf_Ehdr Elf64_Ehdr ++#define Elf_Phdr Elf64_Phdr + #define Elf_Shdr Elf64_Shdr + #define Elf_Sym Elf64_Sym + #define ELF_ST_TYPE(a) ELF64_ST_TYPE(a) +@@ -59,8 +61,10 @@ int jit_add_debug_info(Elf *e, uint64_t code_addr, void *debug, int nr_debug_ent + #define ELF_ST_VIS(a) ELF64_ST_VISIBILITY(a) + #else + #define elf_newehdr elf32_newehdr ++#define elf_newphdr elf32_newphdr + #define elf_getshdr elf32_getshdr + #define Elf_Ehdr Elf32_Ehdr ++#define Elf_Phdr Elf32_Phdr + #define Elf_Shdr Elf32_Shdr + #define Elf_Sym Elf32_Sym + #define ELF_ST_TYPE(a) ELF32_ST_TYPE(a) +diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c +index a04a7dfb8ec09..f15258fbe9dbf 100644 +--- a/tools/perf/util/symbol-elf.c ++++ b/tools/perf/util/symbol-elf.c +@@ -1912,8 +1912,8 @@ static int kcore_copy__compare_file(const char *from_dir, const char *to_dir, + * unusual. One significant peculiarity is that the mapping (start -> pgoff) + * is not the same for the kernel map and the modules map. That happens because + * the data is copied adjacently whereas the original kcore has gaps. Finally, +- * kallsyms and modules files are compared with their copies to check that +- * modules have not been loaded or unloaded while the copies were taking place. ++ * kallsyms file is compared with its copy to check that modules have not been ++ * loaded or unloaded while the copies were taking place. + * + * Return: %0 on success, %-1 on failure. + */ +@@ -1976,9 +1976,6 @@ int kcore_copy(const char *from_dir, const char *to_dir) + goto out_extract_close; + } + +- if (kcore_copy__compare_file(from_dir, to_dir, "modules")) +- goto out_extract_close; +- + if (kcore_copy__compare_file(from_dir, to_dir, "kallsyms")) + goto out_extract_close; +
