Annotation of /trunk/kernel-alx/patches-4.19/0115-4.19.16-all-fixes.patch
Parent Directory | Revision Log
Revision 3394 -
(hide annotations)
(download)
Fri Aug 2 11:47:29 2019 UTC (5 years, 1 month ago) by niro
File size: 59485 byte(s)
Fri Aug 2 11:47:29 2019 UTC (5 years, 1 month ago) by niro
File size: 59485 byte(s)
-linux-4.19.16
1 | niro | 3394 | diff --git a/Makefile b/Makefile |
2 | index 0e30d48274fa..e8cb4875b86d 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,7 +1,7 @@ | ||
6 | # SPDX-License-Identifier: GPL-2.0 | ||
7 | VERSION = 4 | ||
8 | PATCHLEVEL = 19 | ||
9 | -SUBLEVEL = 15 | ||
10 | +SUBLEVEL = 16 | ||
11 | EXTRAVERSION = | ||
12 | NAME = "People's Front" | ||
13 | |||
14 | diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c | ||
15 | index 7be666062c7c..010212d35700 100644 | ||
16 | --- a/arch/arm64/kernel/sys_compat.c | ||
17 | +++ b/arch/arm64/kernel/sys_compat.c | ||
18 | @@ -66,12 +66,11 @@ do_compat_cache_op(unsigned long start, unsigned long end, int flags) | ||
19 | /* | ||
20 | * Handle all unrecognised system calls. | ||
21 | */ | ||
22 | -long compat_arm_syscall(struct pt_regs *regs) | ||
23 | +long compat_arm_syscall(struct pt_regs *regs, int scno) | ||
24 | { | ||
25 | siginfo_t info; | ||
26 | - unsigned int no = regs->regs[7]; | ||
27 | |||
28 | - switch (no) { | ||
29 | + switch (scno) { | ||
30 | /* | ||
31 | * Flush a region from virtual address 'r0' to virtual address 'r1' | ||
32 | * _exclusive_. There is no alignment requirement on either address; | ||
33 | @@ -107,7 +106,7 @@ long compat_arm_syscall(struct pt_regs *regs) | ||
34 | * way the calling program can gracefully determine whether | ||
35 | * a feature is supported. | ||
36 | */ | ||
37 | - if (no < __ARM_NR_COMPAT_END) | ||
38 | + if (scno < __ARM_NR_COMPAT_END) | ||
39 | return -ENOSYS; | ||
40 | break; | ||
41 | } | ||
42 | @@ -119,6 +118,6 @@ long compat_arm_syscall(struct pt_regs *regs) | ||
43 | info.si_addr = (void __user *)instruction_pointer(regs) - | ||
44 | (compat_thumb_mode(regs) ? 2 : 4); | ||
45 | |||
46 | - arm64_notify_die("Oops - bad compat syscall(2)", regs, &info, no); | ||
47 | + arm64_notify_die("Oops - bad compat syscall(2)", regs, &info, scno); | ||
48 | return 0; | ||
49 | } | ||
50 | diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c | ||
51 | index 032d22312881..5610ac01c1ec 100644 | ||
52 | --- a/arch/arm64/kernel/syscall.c | ||
53 | +++ b/arch/arm64/kernel/syscall.c | ||
54 | @@ -13,16 +13,15 @@ | ||
55 | #include <asm/thread_info.h> | ||
56 | #include <asm/unistd.h> | ||
57 | |||
58 | -long compat_arm_syscall(struct pt_regs *regs); | ||
59 | - | ||
60 | +long compat_arm_syscall(struct pt_regs *regs, int scno); | ||
61 | long sys_ni_syscall(void); | ||
62 | |||
63 | -asmlinkage long do_ni_syscall(struct pt_regs *regs) | ||
64 | +static long do_ni_syscall(struct pt_regs *regs, int scno) | ||
65 | { | ||
66 | #ifdef CONFIG_COMPAT | ||
67 | long ret; | ||
68 | if (is_compat_task()) { | ||
69 | - ret = compat_arm_syscall(regs); | ||
70 | + ret = compat_arm_syscall(regs, scno); | ||
71 | if (ret != -ENOSYS) | ||
72 | return ret; | ||
73 | } | ||
74 | @@ -47,7 +46,7 @@ static void invoke_syscall(struct pt_regs *regs, unsigned int scno, | ||
75 | syscall_fn = syscall_table[array_index_nospec(scno, sc_nr)]; | ||
76 | ret = __invoke_syscall(regs, syscall_fn); | ||
77 | } else { | ||
78 | - ret = do_ni_syscall(regs); | ||
79 | + ret = do_ni_syscall(regs, scno); | ||
80 | } | ||
81 | |||
82 | regs->regs[0] = ret; | ||
83 | diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c | ||
84 | index abb92c341693..807d06a7acac 100644 | ||
85 | --- a/arch/x86/kernel/cpu/bugs.c | ||
86 | +++ b/arch/x86/kernel/cpu/bugs.c | ||
87 | @@ -213,7 +213,7 @@ static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init = | ||
88 | static enum spectre_v2_user_mitigation spectre_v2_user __ro_after_init = | ||
89 | SPECTRE_V2_USER_NONE; | ||
90 | |||
91 | -#ifdef RETPOLINE | ||
92 | +#ifdef CONFIG_RETPOLINE | ||
93 | static bool spectre_v2_bad_module; | ||
94 | |||
95 | bool retpoline_module_ok(bool has_retpoline) | ||
96 | diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c | ||
97 | index e938576e58cb..e48eebc27b81 100644 | ||
98 | --- a/drivers/acpi/arm64/iort.c | ||
99 | +++ b/drivers/acpi/arm64/iort.c | ||
100 | @@ -951,9 +951,10 @@ static int rc_dma_get_range(struct device *dev, u64 *size) | ||
101 | { | ||
102 | struct acpi_iort_node *node; | ||
103 | struct acpi_iort_root_complex *rc; | ||
104 | + struct pci_bus *pbus = to_pci_dev(dev)->bus; | ||
105 | |||
106 | node = iort_scan_node(ACPI_IORT_NODE_PCI_ROOT_COMPLEX, | ||
107 | - iort_match_node_callback, dev); | ||
108 | + iort_match_node_callback, &pbus->dev); | ||
109 | if (!node || node->revision < 1) | ||
110 | return -ENODEV; | ||
111 | |||
112 | diff --git a/drivers/acpi/pmic/intel_pmic_xpower.c b/drivers/acpi/pmic/intel_pmic_xpower.c | ||
113 | index 316e55174aa9..bb5391f59b8b 100644 | ||
114 | --- a/drivers/acpi/pmic/intel_pmic_xpower.c | ||
115 | +++ b/drivers/acpi/pmic/intel_pmic_xpower.c | ||
116 | @@ -27,8 +27,11 @@ | ||
117 | #define GPI1_LDO_ON (3 << 0) | ||
118 | #define GPI1_LDO_OFF (4 << 0) | ||
119 | |||
120 | -#define AXP288_ADC_TS_PIN_GPADC 0xf2 | ||
121 | -#define AXP288_ADC_TS_PIN_ON 0xf3 | ||
122 | +#define AXP288_ADC_TS_CURRENT_ON_OFF_MASK GENMASK(1, 0) | ||
123 | +#define AXP288_ADC_TS_CURRENT_OFF (0 << 0) | ||
124 | +#define AXP288_ADC_TS_CURRENT_ON_WHEN_CHARGING (1 << 0) | ||
125 | +#define AXP288_ADC_TS_CURRENT_ON_ONDEMAND (2 << 0) | ||
126 | +#define AXP288_ADC_TS_CURRENT_ON (3 << 0) | ||
127 | |||
128 | static struct pmic_table power_table[] = { | ||
129 | { | ||
130 | @@ -211,22 +214,44 @@ static int intel_xpower_pmic_update_power(struct regmap *regmap, int reg, | ||
131 | */ | ||
132 | static int intel_xpower_pmic_get_raw_temp(struct regmap *regmap, int reg) | ||
133 | { | ||
134 | + int ret, adc_ts_pin_ctrl; | ||
135 | u8 buf[2]; | ||
136 | - int ret; | ||
137 | |||
138 | - ret = regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, | ||
139 | - AXP288_ADC_TS_PIN_GPADC); | ||
140 | + /* | ||
141 | + * The current-source used for the battery temp-sensor (TS) is shared | ||
142 | + * with the GPADC. For proper fuel-gauge and charger operation the TS | ||
143 | + * current-source needs to be permanently on. But to read the GPADC we | ||
144 | + * need to temporary switch the TS current-source to ondemand, so that | ||
145 | + * the GPADC can use it, otherwise we will always read an all 0 value. | ||
146 | + * | ||
147 | + * Note that the switching from on to on-ondemand is not necessary | ||
148 | + * when the TS current-source is off (this happens on devices which | ||
149 | + * do not use the TS-pin). | ||
150 | + */ | ||
151 | + ret = regmap_read(regmap, AXP288_ADC_TS_PIN_CTRL, &adc_ts_pin_ctrl); | ||
152 | if (ret) | ||
153 | return ret; | ||
154 | |||
155 | - /* After switching to the GPADC pin give things some time to settle */ | ||
156 | - usleep_range(6000, 10000); | ||
157 | + if (adc_ts_pin_ctrl & AXP288_ADC_TS_CURRENT_ON_OFF_MASK) { | ||
158 | + ret = regmap_update_bits(regmap, AXP288_ADC_TS_PIN_CTRL, | ||
159 | + AXP288_ADC_TS_CURRENT_ON_OFF_MASK, | ||
160 | + AXP288_ADC_TS_CURRENT_ON_ONDEMAND); | ||
161 | + if (ret) | ||
162 | + return ret; | ||
163 | + | ||
164 | + /* Wait a bit after switching the current-source */ | ||
165 | + usleep_range(6000, 10000); | ||
166 | + } | ||
167 | |||
168 | ret = regmap_bulk_read(regmap, AXP288_GP_ADC_H, buf, 2); | ||
169 | if (ret == 0) | ||
170 | ret = (buf[0] << 4) + ((buf[1] >> 4) & 0x0f); | ||
171 | |||
172 | - regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON); | ||
173 | + if (adc_ts_pin_ctrl & AXP288_ADC_TS_CURRENT_ON_OFF_MASK) { | ||
174 | + regmap_update_bits(regmap, AXP288_ADC_TS_PIN_CTRL, | ||
175 | + AXP288_ADC_TS_CURRENT_ON_OFF_MASK, | ||
176 | + AXP288_ADC_TS_CURRENT_ON); | ||
177 | + } | ||
178 | |||
179 | return ret; | ||
180 | } | ||
181 | diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c | ||
182 | index 1b475bc1ae16..665e93ca0b40 100644 | ||
183 | --- a/drivers/acpi/power.c | ||
184 | +++ b/drivers/acpi/power.c | ||
185 | @@ -131,6 +131,23 @@ void acpi_power_resources_list_free(struct list_head *list) | ||
186 | } | ||
187 | } | ||
188 | |||
189 | +static bool acpi_power_resource_is_dup(union acpi_object *package, | ||
190 | + unsigned int start, unsigned int i) | ||
191 | +{ | ||
192 | + acpi_handle rhandle, dup; | ||
193 | + unsigned int j; | ||
194 | + | ||
195 | + /* The caller is expected to check the package element types */ | ||
196 | + rhandle = package->package.elements[i].reference.handle; | ||
197 | + for (j = start; j < i; j++) { | ||
198 | + dup = package->package.elements[j].reference.handle; | ||
199 | + if (dup == rhandle) | ||
200 | + return true; | ||
201 | + } | ||
202 | + | ||
203 | + return false; | ||
204 | +} | ||
205 | + | ||
206 | int acpi_extract_power_resources(union acpi_object *package, unsigned int start, | ||
207 | struct list_head *list) | ||
208 | { | ||
209 | @@ -150,6 +167,11 @@ int acpi_extract_power_resources(union acpi_object *package, unsigned int start, | ||
210 | err = -ENODEV; | ||
211 | break; | ||
212 | } | ||
213 | + | ||
214 | + /* Some ACPI tables contain duplicate power resource references */ | ||
215 | + if (acpi_power_resource_is_dup(package, start, i)) | ||
216 | + continue; | ||
217 | + | ||
218 | err = acpi_add_power_resource(rhandle); | ||
219 | if (err) | ||
220 | break; | ||
221 | diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c | ||
222 | index 73ed5f3a862d..585378bc988c 100644 | ||
223 | --- a/drivers/block/rbd.c | ||
224 | +++ b/drivers/block/rbd.c | ||
225 | @@ -5982,7 +5982,6 @@ static ssize_t do_rbd_remove(struct bus_type *bus, | ||
226 | struct list_head *tmp; | ||
227 | int dev_id; | ||
228 | char opt_buf[6]; | ||
229 | - bool already = false; | ||
230 | bool force = false; | ||
231 | int ret; | ||
232 | |||
233 | @@ -6015,13 +6014,13 @@ static ssize_t do_rbd_remove(struct bus_type *bus, | ||
234 | spin_lock_irq(&rbd_dev->lock); | ||
235 | if (rbd_dev->open_count && !force) | ||
236 | ret = -EBUSY; | ||
237 | - else | ||
238 | - already = test_and_set_bit(RBD_DEV_FLAG_REMOVING, | ||
239 | - &rbd_dev->flags); | ||
240 | + else if (test_and_set_bit(RBD_DEV_FLAG_REMOVING, | ||
241 | + &rbd_dev->flags)) | ||
242 | + ret = -EINPROGRESS; | ||
243 | spin_unlock_irq(&rbd_dev->lock); | ||
244 | } | ||
245 | spin_unlock(&rbd_dev_list_lock); | ||
246 | - if (ret < 0 || already) | ||
247 | + if (ret) | ||
248 | return ret; | ||
249 | |||
250 | if (force) { | ||
251 | diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c | ||
252 | index 50b1551ba894..3f0693439486 100644 | ||
253 | --- a/drivers/cpufreq/scmi-cpufreq.c | ||
254 | +++ b/drivers/cpufreq/scmi-cpufreq.c | ||
255 | @@ -52,9 +52,9 @@ scmi_cpufreq_set_target(struct cpufreq_policy *policy, unsigned int index) | ||
256 | int ret; | ||
257 | struct scmi_data *priv = policy->driver_data; | ||
258 | struct scmi_perf_ops *perf_ops = handle->perf_ops; | ||
259 | - u64 freq = policy->freq_table[index].frequency * 1000; | ||
260 | + u64 freq = policy->freq_table[index].frequency; | ||
261 | |||
262 | - ret = perf_ops->freq_set(handle, priv->domain_id, freq, false); | ||
263 | + ret = perf_ops->freq_set(handle, priv->domain_id, freq * 1000, false); | ||
264 | if (!ret) | ||
265 | arch_set_freq_scale(policy->related_cpus, freq, | ||
266 | policy->cpuinfo.max_freq); | ||
267 | diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig | ||
268 | index cb88528e7b10..e44e567bd789 100644 | ||
269 | --- a/drivers/gpu/drm/Kconfig | ||
270 | +++ b/drivers/gpu/drm/Kconfig | ||
271 | @@ -110,6 +110,26 @@ config DRM_FBDEV_OVERALLOC | ||
272 | is 100. Typical values for double buffering will be 200, | ||
273 | triple buffering 300. | ||
274 | |||
275 | +config DRM_FBDEV_LEAK_PHYS_SMEM | ||
276 | + bool "Shamelessly allow leaking of fbdev physical address (DANGEROUS)" | ||
277 | + depends on DRM_FBDEV_EMULATION && EXPERT | ||
278 | + default n | ||
279 | + help | ||
280 | + In order to keep user-space compatibility, we want in certain | ||
281 | + use-cases to keep leaking the fbdev physical address to the | ||
282 | + user-space program handling the fbdev buffer. | ||
283 | + This affects, not only, Amlogic, Allwinner or Rockchip devices | ||
284 | + with ARM Mali GPUs using an userspace Blob. | ||
285 | + This option is not supported by upstream developers and should be | ||
286 | + removed as soon as possible and be considered as a broken and | ||
287 | + legacy behaviour from a modern fbdev device driver. | ||
288 | + | ||
289 | + Please send any bug reports when using this to your proprietary | ||
290 | + software vendor that requires this. | ||
291 | + | ||
292 | + If in doubt, say "N" or spread the word to your closed source | ||
293 | + library vendor. | ||
294 | + | ||
295 | config DRM_LOAD_EDID_FIRMWARE | ||
296 | bool "Allow to specify an EDID data set instead of probing for it" | ||
297 | depends on DRM | ||
298 | diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | ||
299 | index 8e26e1ca14c6..b40e9c76af0c 100644 | ||
300 | --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | ||
301 | +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | ||
302 | @@ -753,6 +753,7 @@ static const struct pci_device_id pciidlist[] = { | ||
303 | /* VEGAM */ | ||
304 | {0x1002, 0x694C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGAM}, | ||
305 | {0x1002, 0x694E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGAM}, | ||
306 | + {0x1002, 0x694F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGAM}, | ||
307 | /* Vega 10 */ | ||
308 | {0x1002, 0x6860, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10}, | ||
309 | {0x1002, 0x6861, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10}, | ||
310 | diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | ||
311 | index d792735f1365..a851bb07443f 100644 | ||
312 | --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | ||
313 | +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | ||
314 | @@ -565,22 +565,36 @@ static void s3_handle_mst(struct drm_device *dev, bool suspend) | ||
315 | { | ||
316 | struct amdgpu_dm_connector *aconnector; | ||
317 | struct drm_connector *connector; | ||
318 | + struct drm_dp_mst_topology_mgr *mgr; | ||
319 | + int ret; | ||
320 | + bool need_hotplug = false; | ||
321 | |||
322 | drm_modeset_lock(&dev->mode_config.connection_mutex, NULL); | ||
323 | |||
324 | - list_for_each_entry(connector, &dev->mode_config.connector_list, head) { | ||
325 | - aconnector = to_amdgpu_dm_connector(connector); | ||
326 | - if (aconnector->dc_link->type == dc_connection_mst_branch && | ||
327 | - !aconnector->mst_port) { | ||
328 | + list_for_each_entry(connector, &dev->mode_config.connector_list, | ||
329 | + head) { | ||
330 | + aconnector = to_amdgpu_dm_connector(connector); | ||
331 | + if (aconnector->dc_link->type != dc_connection_mst_branch || | ||
332 | + aconnector->mst_port) | ||
333 | + continue; | ||
334 | |||
335 | - if (suspend) | ||
336 | - drm_dp_mst_topology_mgr_suspend(&aconnector->mst_mgr); | ||
337 | - else | ||
338 | - drm_dp_mst_topology_mgr_resume(&aconnector->mst_mgr); | ||
339 | - } | ||
340 | + mgr = &aconnector->mst_mgr; | ||
341 | + | ||
342 | + if (suspend) { | ||
343 | + drm_dp_mst_topology_mgr_suspend(mgr); | ||
344 | + } else { | ||
345 | + ret = drm_dp_mst_topology_mgr_resume(mgr); | ||
346 | + if (ret < 0) { | ||
347 | + drm_dp_mst_topology_mgr_set_mst(mgr, false); | ||
348 | + need_hotplug = true; | ||
349 | + } | ||
350 | + } | ||
351 | } | ||
352 | |||
353 | drm_modeset_unlock(&dev->mode_config.connection_mutex); | ||
354 | + | ||
355 | + if (need_hotplug) | ||
356 | + drm_kms_helper_hotplug_event(dev); | ||
357 | } | ||
358 | |||
359 | static int dm_hw_init(void *handle) | ||
360 | @@ -736,7 +750,6 @@ static int dm_resume(void *handle) | ||
361 | struct drm_plane_state *new_plane_state; | ||
362 | struct dm_plane_state *dm_new_plane_state; | ||
363 | enum dc_connection_type new_connection_type = dc_connection_none; | ||
364 | - int ret; | ||
365 | int i; | ||
366 | |||
367 | /* power on hardware */ | ||
368 | @@ -809,13 +822,13 @@ static int dm_resume(void *handle) | ||
369 | } | ||
370 | } | ||
371 | |||
372 | - ret = drm_atomic_helper_resume(ddev, dm->cached_state); | ||
373 | + drm_atomic_helper_resume(ddev, dm->cached_state); | ||
374 | |||
375 | dm->cached_state = NULL; | ||
376 | |||
377 | amdgpu_dm_irq_resume_late(adev); | ||
378 | |||
379 | - return ret; | ||
380 | + return 0; | ||
381 | } | ||
382 | |||
383 | static const struct amd_ip_funcs amdgpu_dm_funcs = { | ||
384 | diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c | ||
385 | index fced3c1c2ef5..7c89785fd731 100644 | ||
386 | --- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c | ||
387 | +++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c | ||
388 | @@ -2457,11 +2457,11 @@ void core_link_disable_stream(struct pipe_ctx *pipe_ctx, int option) | ||
389 | { | ||
390 | struct dc *core_dc = pipe_ctx->stream->ctx->dc; | ||
391 | |||
392 | + core_dc->hwss.blank_stream(pipe_ctx); | ||
393 | + | ||
394 | if (pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST) | ||
395 | deallocate_mst_payload(pipe_ctx); | ||
396 | |||
397 | - core_dc->hwss.blank_stream(pipe_ctx); | ||
398 | - | ||
399 | core_dc->hwss.disable_stream(pipe_ctx, option); | ||
400 | |||
401 | disable_link(pipe_ctx->stream->sink->link, pipe_ctx->stream->signal); | ||
402 | diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c | ||
403 | index 9214c8b02484..b5b9f15549c2 100644 | ||
404 | --- a/drivers/gpu/drm/drm_fb_helper.c | ||
405 | +++ b/drivers/gpu/drm/drm_fb_helper.c | ||
406 | @@ -56,6 +56,25 @@ MODULE_PARM_DESC(drm_fbdev_overalloc, | ||
407 | "Overallocation of the fbdev buffer (%) [default=" | ||
408 | __MODULE_STRING(CONFIG_DRM_FBDEV_OVERALLOC) "]"); | ||
409 | |||
410 | +/* | ||
411 | + * In order to keep user-space compatibility, we want in certain use-cases | ||
412 | + * to keep leaking the fbdev physical address to the user-space program | ||
413 | + * handling the fbdev buffer. | ||
414 | + * This is a bad habit essentially kept into closed source opengl driver | ||
415 | + * that should really be moved into open-source upstream projects instead | ||
416 | + * of using legacy physical addresses in user space to communicate with | ||
417 | + * other out-of-tree kernel modules. | ||
418 | + * | ||
419 | + * This module_param *should* be removed as soon as possible and be | ||
420 | + * considered as a broken and legacy behaviour from a modern fbdev device. | ||
421 | + */ | ||
422 | +#if IS_ENABLED(CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM) | ||
423 | +static bool drm_leak_fbdev_smem = false; | ||
424 | +module_param_unsafe(drm_leak_fbdev_smem, bool, 0600); | ||
425 | +MODULE_PARM_DESC(fbdev_emulation, | ||
426 | + "Allow unsafe leaking fbdev physical smem address [default=false]"); | ||
427 | +#endif | ||
428 | + | ||
429 | static LIST_HEAD(kernel_fb_helper_list); | ||
430 | static DEFINE_MUTEX(kernel_fb_helper_lock); | ||
431 | |||
432 | @@ -1602,6 +1621,64 @@ static bool drm_fb_pixel_format_equal(const struct fb_var_screeninfo *var_1, | ||
433 | var_1->transp.msb_right == var_2->transp.msb_right; | ||
434 | } | ||
435 | |||
436 | +static void drm_fb_helper_fill_pixel_fmt(struct fb_var_screeninfo *var, | ||
437 | + u8 depth) | ||
438 | +{ | ||
439 | + switch (depth) { | ||
440 | + case 8: | ||
441 | + var->red.offset = 0; | ||
442 | + var->green.offset = 0; | ||
443 | + var->blue.offset = 0; | ||
444 | + var->red.length = 8; /* 8bit DAC */ | ||
445 | + var->green.length = 8; | ||
446 | + var->blue.length = 8; | ||
447 | + var->transp.offset = 0; | ||
448 | + var->transp.length = 0; | ||
449 | + break; | ||
450 | + case 15: | ||
451 | + var->red.offset = 10; | ||
452 | + var->green.offset = 5; | ||
453 | + var->blue.offset = 0; | ||
454 | + var->red.length = 5; | ||
455 | + var->green.length = 5; | ||
456 | + var->blue.length = 5; | ||
457 | + var->transp.offset = 15; | ||
458 | + var->transp.length = 1; | ||
459 | + break; | ||
460 | + case 16: | ||
461 | + var->red.offset = 11; | ||
462 | + var->green.offset = 5; | ||
463 | + var->blue.offset = 0; | ||
464 | + var->red.length = 5; | ||
465 | + var->green.length = 6; | ||
466 | + var->blue.length = 5; | ||
467 | + var->transp.offset = 0; | ||
468 | + break; | ||
469 | + case 24: | ||
470 | + var->red.offset = 16; | ||
471 | + var->green.offset = 8; | ||
472 | + var->blue.offset = 0; | ||
473 | + var->red.length = 8; | ||
474 | + var->green.length = 8; | ||
475 | + var->blue.length = 8; | ||
476 | + var->transp.offset = 0; | ||
477 | + var->transp.length = 0; | ||
478 | + break; | ||
479 | + case 32: | ||
480 | + var->red.offset = 16; | ||
481 | + var->green.offset = 8; | ||
482 | + var->blue.offset = 0; | ||
483 | + var->red.length = 8; | ||
484 | + var->green.length = 8; | ||
485 | + var->blue.length = 8; | ||
486 | + var->transp.offset = 24; | ||
487 | + var->transp.length = 8; | ||
488 | + break; | ||
489 | + default: | ||
490 | + break; | ||
491 | + } | ||
492 | +} | ||
493 | + | ||
494 | /** | ||
495 | * drm_fb_helper_check_var - implementation for &fb_ops.fb_check_var | ||
496 | * @var: screeninfo to check | ||
497 | @@ -1631,6 +1708,20 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var, | ||
498 | return -EINVAL; | ||
499 | } | ||
500 | |||
501 | + /* | ||
502 | + * Workaround for SDL 1.2, which is known to be setting all pixel format | ||
503 | + * fields values to zero in some cases. We treat this situation as a | ||
504 | + * kind of "use some reasonable autodetected values". | ||
505 | + */ | ||
506 | + if (!var->red.offset && !var->green.offset && | ||
507 | + !var->blue.offset && !var->transp.offset && | ||
508 | + !var->red.length && !var->green.length && | ||
509 | + !var->blue.length && !var->transp.length && | ||
510 | + !var->red.msb_right && !var->green.msb_right && | ||
511 | + !var->blue.msb_right && !var->transp.msb_right) { | ||
512 | + drm_fb_helper_fill_pixel_fmt(var, fb->format->depth); | ||
513 | + } | ||
514 | + | ||
515 | /* | ||
516 | * drm fbdev emulation doesn't support changing the pixel format at all, | ||
517 | * so reject all pixel format changing requests. | ||
518 | @@ -1942,59 +2033,7 @@ void drm_fb_helper_fill_var(struct fb_info *info, struct drm_fb_helper *fb_helpe | ||
519 | info->var.yoffset = 0; | ||
520 | info->var.activate = FB_ACTIVATE_NOW; | ||
521 | |||
522 | - switch (fb->format->depth) { | ||
523 | - case 8: | ||
524 | - info->var.red.offset = 0; | ||
525 | - info->var.green.offset = 0; | ||
526 | - info->var.blue.offset = 0; | ||
527 | - info->var.red.length = 8; /* 8bit DAC */ | ||
528 | - info->var.green.length = 8; | ||
529 | - info->var.blue.length = 8; | ||
530 | - info->var.transp.offset = 0; | ||
531 | - info->var.transp.length = 0; | ||
532 | - break; | ||
533 | - case 15: | ||
534 | - info->var.red.offset = 10; | ||
535 | - info->var.green.offset = 5; | ||
536 | - info->var.blue.offset = 0; | ||
537 | - info->var.red.length = 5; | ||
538 | - info->var.green.length = 5; | ||
539 | - info->var.blue.length = 5; | ||
540 | - info->var.transp.offset = 15; | ||
541 | - info->var.transp.length = 1; | ||
542 | - break; | ||
543 | - case 16: | ||
544 | - info->var.red.offset = 11; | ||
545 | - info->var.green.offset = 5; | ||
546 | - info->var.blue.offset = 0; | ||
547 | - info->var.red.length = 5; | ||
548 | - info->var.green.length = 6; | ||
549 | - info->var.blue.length = 5; | ||
550 | - info->var.transp.offset = 0; | ||
551 | - break; | ||
552 | - case 24: | ||
553 | - info->var.red.offset = 16; | ||
554 | - info->var.green.offset = 8; | ||
555 | - info->var.blue.offset = 0; | ||
556 | - info->var.red.length = 8; | ||
557 | - info->var.green.length = 8; | ||
558 | - info->var.blue.length = 8; | ||
559 | - info->var.transp.offset = 0; | ||
560 | - info->var.transp.length = 0; | ||
561 | - break; | ||
562 | - case 32: | ||
563 | - info->var.red.offset = 16; | ||
564 | - info->var.green.offset = 8; | ||
565 | - info->var.blue.offset = 0; | ||
566 | - info->var.red.length = 8; | ||
567 | - info->var.green.length = 8; | ||
568 | - info->var.blue.length = 8; | ||
569 | - info->var.transp.offset = 24; | ||
570 | - info->var.transp.length = 8; | ||
571 | - break; | ||
572 | - default: | ||
573 | - break; | ||
574 | - } | ||
575 | + drm_fb_helper_fill_pixel_fmt(&info->var, fb->format->depth); | ||
576 | |||
577 | info->var.xres = fb_width; | ||
578 | info->var.yres = fb_height; | ||
579 | @@ -3041,6 +3080,12 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper, | ||
580 | fbi->screen_size = fb->height * fb->pitches[0]; | ||
581 | fbi->fix.smem_len = fbi->screen_size; | ||
582 | fbi->screen_buffer = buffer->vaddr; | ||
583 | + /* Shamelessly leak the physical address to user-space */ | ||
584 | +#if IS_ENABLED(CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM) | ||
585 | + if (drm_leak_fbdev_smem && fbi->fix.smem_start == 0) | ||
586 | + fbi->fix.smem_start = | ||
587 | + page_to_phys(virt_to_page(fbi->screen_buffer)); | ||
588 | +#endif | ||
589 | strcpy(fbi->fix.id, "DRM emulated"); | ||
590 | |||
591 | drm_fb_helper_fill_fix(fbi, fb->pitches[0], fb->format->depth); | ||
592 | diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c | ||
593 | index 5f57f4e1fbc8..87411a5aba77 100644 | ||
594 | --- a/drivers/gpu/drm/i915/i915_gem_gtt.c | ||
595 | +++ b/drivers/gpu/drm/i915/i915_gem_gtt.c | ||
596 | @@ -2128,6 +2128,7 @@ static struct i915_vma *pd_vma_create(struct gen6_hw_ppgtt *ppgtt, int size) | ||
597 | int gen6_ppgtt_pin(struct i915_hw_ppgtt *base) | ||
598 | { | ||
599 | struct gen6_hw_ppgtt *ppgtt = to_gen6_ppgtt(base); | ||
600 | + int err; | ||
601 | |||
602 | /* | ||
603 | * Workaround the limited maximum vma->pin_count and the aliasing_ppgtt | ||
604 | @@ -2143,9 +2144,17 @@ int gen6_ppgtt_pin(struct i915_hw_ppgtt *base) | ||
605 | * allocator works in address space sizes, so it's multiplied by page | ||
606 | * size. We allocate at the top of the GTT to avoid fragmentation. | ||
607 | */ | ||
608 | - return i915_vma_pin(ppgtt->vma, | ||
609 | - 0, GEN6_PD_ALIGN, | ||
610 | - PIN_GLOBAL | PIN_HIGH); | ||
611 | + err = i915_vma_pin(ppgtt->vma, | ||
612 | + 0, GEN6_PD_ALIGN, | ||
613 | + PIN_GLOBAL | PIN_HIGH); | ||
614 | + if (err) | ||
615 | + goto unpin; | ||
616 | + | ||
617 | + return 0; | ||
618 | + | ||
619 | +unpin: | ||
620 | + ppgtt->pin_count = 0; | ||
621 | + return err; | ||
622 | } | ||
623 | |||
624 | void gen6_ppgtt_unpin(struct i915_hw_ppgtt *base) | ||
625 | diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c | ||
626 | index 1aca742fde4a..ccd76c71af09 100644 | ||
627 | --- a/drivers/i2c/i2c-dev.c | ||
628 | +++ b/drivers/i2c/i2c-dev.c | ||
629 | @@ -470,9 +470,15 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) | ||
630 | data_arg.data); | ||
631 | } | ||
632 | case I2C_RETRIES: | ||
633 | + if (arg > INT_MAX) | ||
634 | + return -EINVAL; | ||
635 | + | ||
636 | client->adapter->retries = arg; | ||
637 | break; | ||
638 | case I2C_TIMEOUT: | ||
639 | + if (arg > INT_MAX) | ||
640 | + return -EINVAL; | ||
641 | + | ||
642 | /* For historical reasons, user-space sets the timeout | ||
643 | * value in units of 10 ms. | ||
644 | */ | ||
645 | diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c | ||
646 | index 8815f3e2b718..880e75f63a19 100644 | ||
647 | --- a/drivers/mtd/nand/raw/qcom_nandc.c | ||
648 | +++ b/drivers/mtd/nand/raw/qcom_nandc.c | ||
649 | @@ -2839,6 +2839,16 @@ static int qcom_nand_host_init_and_register(struct qcom_nand_controller *nandc, | ||
650 | if (ret) | ||
651 | return ret; | ||
652 | |||
653 | + if (nandc->props->is_bam) { | ||
654 | + free_bam_transaction(nandc); | ||
655 | + nandc->bam_txn = alloc_bam_transaction(nandc); | ||
656 | + if (!nandc->bam_txn) { | ||
657 | + dev_err(nandc->dev, | ||
658 | + "failed to allocate bam transaction\n"); | ||
659 | + return -ENOMEM; | ||
660 | + } | ||
661 | + } | ||
662 | + | ||
663 | ret = mtd_device_register(mtd, NULL, 0); | ||
664 | if (ret) | ||
665 | nand_cleanup(chip); | ||
666 | @@ -2853,16 +2863,6 @@ static int qcom_probe_nand_devices(struct qcom_nand_controller *nandc) | ||
667 | struct qcom_nand_host *host; | ||
668 | int ret; | ||
669 | |||
670 | - if (nandc->props->is_bam) { | ||
671 | - free_bam_transaction(nandc); | ||
672 | - nandc->bam_txn = alloc_bam_transaction(nandc); | ||
673 | - if (!nandc->bam_txn) { | ||
674 | - dev_err(nandc->dev, | ||
675 | - "failed to allocate bam transaction\n"); | ||
676 | - return -ENOMEM; | ||
677 | - } | ||
678 | - } | ||
679 | - | ||
680 | for_each_available_child_of_node(dn, child) { | ||
681 | host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL); | ||
682 | if (!host) { | ||
683 | diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c | ||
684 | index 29a05759a294..0fa9e8fdce66 100644 | ||
685 | --- a/drivers/pci/controller/dwc/pcie-designware-host.c | ||
686 | +++ b/drivers/pci/controller/dwc/pcie-designware-host.c | ||
687 | @@ -99,9 +99,6 @@ irqreturn_t dw_handle_msi_irq(struct pcie_port *pp) | ||
688 | (i * MAX_MSI_IRQS_PER_CTRL) + | ||
689 | pos); | ||
690 | generic_handle_irq(irq); | ||
691 | - dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_STATUS + | ||
692 | - (i * MSI_REG_CTRL_BLOCK_SIZE), | ||
693 | - 4, 1 << pos); | ||
694 | pos++; | ||
695 | } | ||
696 | } | ||
697 | @@ -168,8 +165,8 @@ static void dw_pci_bottom_mask(struct irq_data *data) | ||
698 | bit = data->hwirq % MAX_MSI_IRQS_PER_CTRL; | ||
699 | |||
700 | pp->irq_status[ctrl] &= ~(1 << bit); | ||
701 | - dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_ENABLE + res, 4, | ||
702 | - pp->irq_status[ctrl]); | ||
703 | + dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_MASK + res, 4, | ||
704 | + ~pp->irq_status[ctrl]); | ||
705 | } | ||
706 | |||
707 | raw_spin_unlock_irqrestore(&pp->lock, flags); | ||
708 | @@ -191,8 +188,8 @@ static void dw_pci_bottom_unmask(struct irq_data *data) | ||
709 | bit = data->hwirq % MAX_MSI_IRQS_PER_CTRL; | ||
710 | |||
711 | pp->irq_status[ctrl] |= 1 << bit; | ||
712 | - dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_ENABLE + res, 4, | ||
713 | - pp->irq_status[ctrl]); | ||
714 | + dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_MASK + res, 4, | ||
715 | + ~pp->irq_status[ctrl]); | ||
716 | } | ||
717 | |||
718 | raw_spin_unlock_irqrestore(&pp->lock, flags); | ||
719 | @@ -200,13 +197,22 @@ static void dw_pci_bottom_unmask(struct irq_data *data) | ||
720 | |||
721 | static void dw_pci_bottom_ack(struct irq_data *d) | ||
722 | { | ||
723 | - struct msi_desc *msi = irq_data_get_msi_desc(d); | ||
724 | - struct pcie_port *pp; | ||
725 | + struct pcie_port *pp = irq_data_get_irq_chip_data(d); | ||
726 | + unsigned int res, bit, ctrl; | ||
727 | + unsigned long flags; | ||
728 | + | ||
729 | + ctrl = d->hwirq / MAX_MSI_IRQS_PER_CTRL; | ||
730 | + res = ctrl * MSI_REG_CTRL_BLOCK_SIZE; | ||
731 | + bit = d->hwirq % MAX_MSI_IRQS_PER_CTRL; | ||
732 | + | ||
733 | + raw_spin_lock_irqsave(&pp->lock, flags); | ||
734 | |||
735 | - pp = msi_desc_to_pci_sysdata(msi); | ||
736 | + dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_STATUS + res, 4, 1 << bit); | ||
737 | |||
738 | if (pp->ops->msi_irq_ack) | ||
739 | pp->ops->msi_irq_ack(d->hwirq, pp); | ||
740 | + | ||
741 | + raw_spin_unlock_irqrestore(&pp->lock, flags); | ||
742 | } | ||
743 | |||
744 | static struct irq_chip dw_pci_msi_bottom_irq_chip = { | ||
745 | @@ -658,10 +664,15 @@ void dw_pcie_setup_rc(struct pcie_port *pp) | ||
746 | num_ctrls = pp->num_vectors / MAX_MSI_IRQS_PER_CTRL; | ||
747 | |||
748 | /* Initialize IRQ Status array */ | ||
749 | - for (ctrl = 0; ctrl < num_ctrls; ctrl++) | ||
750 | - dw_pcie_rd_own_conf(pp, PCIE_MSI_INTR0_ENABLE + | ||
751 | + for (ctrl = 0; ctrl < num_ctrls; ctrl++) { | ||
752 | + dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_MASK + | ||
753 | (ctrl * MSI_REG_CTRL_BLOCK_SIZE), | ||
754 | - 4, &pp->irq_status[ctrl]); | ||
755 | + 4, ~0); | ||
756 | + dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_ENABLE + | ||
757 | + (ctrl * MSI_REG_CTRL_BLOCK_SIZE), | ||
758 | + 4, ~0); | ||
759 | + pp->irq_status[ctrl] = 0; | ||
760 | + } | ||
761 | |||
762 | /* Setup RC BARs */ | ||
763 | dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, 0x00000004); | ||
764 | diff --git a/drivers/staging/rtl8188eu/core/rtw_security.c b/drivers/staging/rtl8188eu/core/rtw_security.c | ||
765 | index 2a48b09ea9ae..470ea2c0c433 100644 | ||
766 | --- a/drivers/staging/rtl8188eu/core/rtw_security.c | ||
767 | +++ b/drivers/staging/rtl8188eu/core/rtw_security.c | ||
768 | @@ -154,7 +154,7 @@ void rtw_wep_encrypt(struct adapter *padapter, u8 *pxmitframe) | ||
769 | |||
770 | pframe = ((struct xmit_frame *)pxmitframe)->buf_addr + hw_hdr_offset; | ||
771 | |||
772 | - crypto_ops = try_then_request_module(lib80211_get_crypto_ops("WEP"), "lib80211_crypt_wep"); | ||
773 | + crypto_ops = lib80211_get_crypto_ops("WEP"); | ||
774 | |||
775 | if (!crypto_ops) | ||
776 | return; | ||
777 | @@ -210,7 +210,7 @@ int rtw_wep_decrypt(struct adapter *padapter, u8 *precvframe) | ||
778 | void *crypto_private = NULL; | ||
779 | int status = _SUCCESS; | ||
780 | const int keyindex = prxattrib->key_index; | ||
781 | - struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("WEP"), "lib80211_crypt_wep"); | ||
782 | + struct lib80211_crypto_ops *crypto_ops = lib80211_get_crypto_ops("WEP"); | ||
783 | char iv[4], icv[4]; | ||
784 | |||
785 | if (!crypto_ops) { | ||
786 | @@ -1292,7 +1292,7 @@ u32 rtw_aes_decrypt(struct adapter *padapter, u8 *precvframe) | ||
787 | struct sk_buff *skb = ((struct recv_frame *)precvframe)->pkt; | ||
788 | void *crypto_private = NULL; | ||
789 | u8 *key, *pframe = skb->data; | ||
790 | - struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("CCMP"), "lib80211_crypt_ccmp"); | ||
791 | + struct lib80211_crypto_ops *crypto_ops = lib80211_get_crypto_ops("CCMP"); | ||
792 | struct security_priv *psecuritypriv = &padapter->securitypriv; | ||
793 | char iv[8], icv[8]; | ||
794 | |||
795 | diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c | ||
796 | index 2886b7b477c7..08b8aa5299b5 100644 | ||
797 | --- a/drivers/usb/class/cdc-acm.c | ||
798 | +++ b/drivers/usb/class/cdc-acm.c | ||
799 | @@ -1880,6 +1880,13 @@ static const struct usb_device_id acm_ids[] = { | ||
800 | .driver_info = IGNORE_DEVICE, | ||
801 | }, | ||
802 | |||
803 | + { USB_DEVICE(0x1bc7, 0x0021), /* Telit 3G ACM only composition */ | ||
804 | + .driver_info = SEND_ZERO_PACKET, | ||
805 | + }, | ||
806 | + { USB_DEVICE(0x1bc7, 0x0023), /* Telit 3G ACM + ECM composition */ | ||
807 | + .driver_info = SEND_ZERO_PACKET, | ||
808 | + }, | ||
809 | + | ||
810 | /* control interfaces without any protocol set */ | ||
811 | { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, | ||
812 | USB_CDC_PROTO_NONE) }, | ||
813 | diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c | ||
814 | index 514c5214ddb2..8bc35d53408b 100644 | ||
815 | --- a/drivers/usb/core/quirks.c | ||
816 | +++ b/drivers/usb/core/quirks.c | ||
817 | @@ -394,7 +394,8 @@ static const struct usb_device_id usb_quirk_list[] = { | ||
818 | { USB_DEVICE(0x1a40, 0x0101), .driver_info = USB_QUIRK_HUB_SLOW_RESET }, | ||
819 | |||
820 | /* Corsair K70 RGB */ | ||
821 | - { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT }, | ||
822 | + { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT | | ||
823 | + USB_QUIRK_DELAY_CTRL_MSG }, | ||
824 | |||
825 | /* Corsair Strafe */ | ||
826 | { USB_DEVICE(0x1b1c, 0x1b15), .driver_info = USB_QUIRK_DELAY_INIT | | ||
827 | diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c | ||
828 | index e227bb5b794f..101ebac43c87 100644 | ||
829 | --- a/drivers/usb/storage/scsiglue.c | ||
830 | +++ b/drivers/usb/storage/scsiglue.c | ||
831 | @@ -235,8 +235,12 @@ static int slave_configure(struct scsi_device *sdev) | ||
832 | if (!(us->fflags & US_FL_NEEDS_CAP16)) | ||
833 | sdev->try_rc_10_first = 1; | ||
834 | |||
835 | - /* assume SPC3 or latter devices support sense size > 18 */ | ||
836 | - if (sdev->scsi_level > SCSI_SPC_2) | ||
837 | + /* | ||
838 | + * assume SPC3 or latter devices support sense size > 18 | ||
839 | + * unless US_FL_BAD_SENSE quirk is specified. | ||
840 | + */ | ||
841 | + if (sdev->scsi_level > SCSI_SPC_2 && | ||
842 | + !(us->fflags & US_FL_BAD_SENSE)) | ||
843 | us->fflags |= US_FL_SANE_SENSE; | ||
844 | |||
845 | /* | ||
846 | diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h | ||
847 | index f7f83b21dc74..ea0d27a94afe 100644 | ||
848 | --- a/drivers/usb/storage/unusual_devs.h | ||
849 | +++ b/drivers/usb/storage/unusual_devs.h | ||
850 | @@ -1265,6 +1265,18 @@ UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff, | ||
851 | USB_SC_DEVICE, USB_PR_DEVICE, NULL, | ||
852 | US_FL_FIX_CAPACITY ), | ||
853 | |||
854 | +/* | ||
855 | + * Reported by Icenowy Zheng <icenowy@aosc.io> | ||
856 | + * The SMI SM3350 USB-UFS bridge controller will enter a wrong state | ||
857 | + * that do not process read/write command if a long sense is requested, | ||
858 | + * so force to use 18-byte sense. | ||
859 | + */ | ||
860 | +UNUSUAL_DEV( 0x090c, 0x3350, 0x0000, 0xffff, | ||
861 | + "SMI", | ||
862 | + "SM3350 UFS-to-USB-Mass-Storage bridge", | ||
863 | + USB_SC_DEVICE, USB_PR_DEVICE, NULL, | ||
864 | + US_FL_BAD_SENSE ), | ||
865 | + | ||
866 | /* | ||
867 | * Reported by Paul Hartman <paul.hartman+linux@gmail.com> | ||
868 | * This card reader returns "Illegal Request, Logical Block Address | ||
869 | diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c | ||
870 | index d9fd3188615d..64cbc2d007c9 100644 | ||
871 | --- a/drivers/vfio/vfio_iommu_type1.c | ||
872 | +++ b/drivers/vfio/vfio_iommu_type1.c | ||
873 | @@ -878,7 +878,7 @@ static int vfio_dma_do_unmap(struct vfio_iommu *iommu, | ||
874 | return -EINVAL; | ||
875 | if (!unmap->size || unmap->size & mask) | ||
876 | return -EINVAL; | ||
877 | - if (unmap->iova + unmap->size < unmap->iova || | ||
878 | + if (unmap->iova + unmap->size - 1 < unmap->iova || | ||
879 | unmap->size > SIZE_MAX) | ||
880 | return -EINVAL; | ||
881 | |||
882 | diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c | ||
883 | index fa18520529f3..7ad6f2eec711 100644 | ||
884 | --- a/fs/btrfs/ctree.c | ||
885 | +++ b/fs/btrfs/ctree.c | ||
886 | @@ -1051,19 +1051,21 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans, | ||
887 | parent_start = parent->start; | ||
888 | |||
889 | /* | ||
890 | - * If we are COWing a node/leaf from the extent, chunk or device trees, | ||
891 | - * make sure that we do not finish block group creation of pending block | ||
892 | - * groups. We do this to avoid a deadlock. | ||
893 | + * If we are COWing a node/leaf from the extent, chunk, device or free | ||
894 | + * space trees, make sure that we do not finish block group creation of | ||
895 | + * pending block groups. We do this to avoid a deadlock. | ||
896 | * COWing can result in allocation of a new chunk, and flushing pending | ||
897 | * block groups (btrfs_create_pending_block_groups()) can be triggered | ||
898 | * when finishing allocation of a new chunk. Creation of a pending block | ||
899 | - * group modifies the extent, chunk and device trees, therefore we could | ||
900 | - * deadlock with ourselves since we are holding a lock on an extent | ||
901 | - * buffer that btrfs_create_pending_block_groups() may try to COW later. | ||
902 | + * group modifies the extent, chunk, device and free space trees, | ||
903 | + * therefore we could deadlock with ourselves since we are holding a | ||
904 | + * lock on an extent buffer that btrfs_create_pending_block_groups() may | ||
905 | + * try to COW later. | ||
906 | */ | ||
907 | if (root == fs_info->extent_root || | ||
908 | root == fs_info->chunk_root || | ||
909 | - root == fs_info->dev_root) | ||
910 | + root == fs_info->dev_root || | ||
911 | + root == fs_info->free_space_root) | ||
912 | trans->can_flush_pending_bgs = false; | ||
913 | |||
914 | cow = btrfs_alloc_tree_block(trans, root, parent_start, | ||
915 | diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c | ||
916 | index ff434663d65b..e1fcb28ad4cc 100644 | ||
917 | --- a/fs/btrfs/qgroup.c | ||
918 | +++ b/fs/btrfs/qgroup.c | ||
919 | @@ -1013,16 +1013,22 @@ out_add_root: | ||
920 | btrfs_abort_transaction(trans, ret); | ||
921 | goto out_free_path; | ||
922 | } | ||
923 | - spin_lock(&fs_info->qgroup_lock); | ||
924 | - fs_info->quota_root = quota_root; | ||
925 | - set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags); | ||
926 | - spin_unlock(&fs_info->qgroup_lock); | ||
927 | |||
928 | ret = btrfs_commit_transaction(trans); | ||
929 | trans = NULL; | ||
930 | if (ret) | ||
931 | goto out_free_path; | ||
932 | |||
933 | + /* | ||
934 | + * Set quota enabled flag after committing the transaction, to avoid | ||
935 | + * deadlocks on fs_info->qgroup_ioctl_lock with concurrent snapshot | ||
936 | + * creation. | ||
937 | + */ | ||
938 | + spin_lock(&fs_info->qgroup_lock); | ||
939 | + fs_info->quota_root = quota_root; | ||
940 | + set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags); | ||
941 | + spin_unlock(&fs_info->qgroup_lock); | ||
942 | + | ||
943 | ret = qgroup_rescan_init(fs_info, 0, 1); | ||
944 | if (!ret) { | ||
945 | qgroup_rescan_zero_tracking(fs_info); | ||
946 | diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c | ||
947 | index f4405e430da6..223334f08530 100644 | ||
948 | --- a/fs/btrfs/volumes.c | ||
949 | +++ b/fs/btrfs/volumes.c | ||
950 | @@ -3712,6 +3712,7 @@ int btrfs_balance(struct btrfs_fs_info *fs_info, | ||
951 | int ret; | ||
952 | u64 num_devices; | ||
953 | unsigned seq; | ||
954 | + bool reducing_integrity; | ||
955 | |||
956 | if (btrfs_fs_closing(fs_info) || | ||
957 | atomic_read(&fs_info->balance_pause_req) || | ||
958 | @@ -3796,24 +3797,30 @@ int btrfs_balance(struct btrfs_fs_info *fs_info, | ||
959 | !(bctl->sys.target & allowed)) || | ||
960 | ((bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) && | ||
961 | (fs_info->avail_metadata_alloc_bits & allowed) && | ||
962 | - !(bctl->meta.target & allowed))) { | ||
963 | - if (bctl->flags & BTRFS_BALANCE_FORCE) { | ||
964 | - btrfs_info(fs_info, | ||
965 | - "balance: force reducing metadata integrity"); | ||
966 | - } else { | ||
967 | - btrfs_err(fs_info, | ||
968 | - "balance: reduces metadata integrity, use --force if you want this"); | ||
969 | - ret = -EINVAL; | ||
970 | - goto out; | ||
971 | - } | ||
972 | - } | ||
973 | + !(bctl->meta.target & allowed))) | ||
974 | + reducing_integrity = true; | ||
975 | + else | ||
976 | + reducing_integrity = false; | ||
977 | + | ||
978 | + /* if we're not converting, the target field is uninitialized */ | ||
979 | + meta_target = (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) ? | ||
980 | + bctl->meta.target : fs_info->avail_metadata_alloc_bits; | ||
981 | + data_target = (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) ? | ||
982 | + bctl->data.target : fs_info->avail_data_alloc_bits; | ||
983 | } while (read_seqretry(&fs_info->profiles_lock, seq)); | ||
984 | |||
985 | - /* if we're not converting, the target field is uninitialized */ | ||
986 | - meta_target = (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) ? | ||
987 | - bctl->meta.target : fs_info->avail_metadata_alloc_bits; | ||
988 | - data_target = (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) ? | ||
989 | - bctl->data.target : fs_info->avail_data_alloc_bits; | ||
990 | + if (reducing_integrity) { | ||
991 | + if (bctl->flags & BTRFS_BALANCE_FORCE) { | ||
992 | + btrfs_info(fs_info, | ||
993 | + "balance: force reducing metadata integrity"); | ||
994 | + } else { | ||
995 | + btrfs_err(fs_info, | ||
996 | + "balance: reduces metadata integrity, use --force if you want this"); | ||
997 | + ret = -EINVAL; | ||
998 | + goto out; | ||
999 | + } | ||
1000 | + } | ||
1001 | + | ||
1002 | if (btrfs_get_num_tolerated_disk_barrier_failures(meta_target) < | ||
1003 | btrfs_get_num_tolerated_disk_barrier_failures(data_target)) { | ||
1004 | int meta_index = btrfs_bg_flags_to_raid_index(meta_target); | ||
1005 | diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c | ||
1006 | index ea78c3d6dcfc..f141b45ce349 100644 | ||
1007 | --- a/fs/btrfs/xattr.c | ||
1008 | +++ b/fs/btrfs/xattr.c | ||
1009 | @@ -11,6 +11,7 @@ | ||
1010 | #include <linux/security.h> | ||
1011 | #include <linux/posix_acl_xattr.h> | ||
1012 | #include <linux/iversion.h> | ||
1013 | +#include <linux/sched/mm.h> | ||
1014 | #include "ctree.h" | ||
1015 | #include "btrfs_inode.h" | ||
1016 | #include "transaction.h" | ||
1017 | @@ -422,9 +423,15 @@ static int btrfs_initxattrs(struct inode *inode, | ||
1018 | { | ||
1019 | const struct xattr *xattr; | ||
1020 | struct btrfs_trans_handle *trans = fs_info; | ||
1021 | + unsigned int nofs_flag; | ||
1022 | char *name; | ||
1023 | int err = 0; | ||
1024 | |||
1025 | + /* | ||
1026 | + * We're holding a transaction handle, so use a NOFS memory allocation | ||
1027 | + * context to avoid deadlock if reclaim happens. | ||
1028 | + */ | ||
1029 | + nofs_flag = memalloc_nofs_save(); | ||
1030 | for (xattr = xattr_array; xattr->name != NULL; xattr++) { | ||
1031 | name = kmalloc(XATTR_SECURITY_PREFIX_LEN + | ||
1032 | strlen(xattr->name) + 1, GFP_KERNEL); | ||
1033 | @@ -440,6 +447,7 @@ static int btrfs_initxattrs(struct inode *inode, | ||
1034 | if (err < 0) | ||
1035 | break; | ||
1036 | } | ||
1037 | + memalloc_nofs_restore(nofs_flag); | ||
1038 | return err; | ||
1039 | } | ||
1040 | |||
1041 | diff --git a/fs/cifs/file.c b/fs/cifs/file.c | ||
1042 | index 8d41ca7bfcf1..7b637fc27990 100644 | ||
1043 | --- a/fs/cifs/file.c | ||
1044 | +++ b/fs/cifs/file.c | ||
1045 | @@ -1120,10 +1120,10 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile) | ||
1046 | |||
1047 | /* | ||
1048 | * Accessing maxBuf is racy with cifs_reconnect - need to store value | ||
1049 | - * and check it for zero before using. | ||
1050 | + * and check it before using. | ||
1051 | */ | ||
1052 | max_buf = tcon->ses->server->maxBuf; | ||
1053 | - if (!max_buf) { | ||
1054 | + if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE))) { | ||
1055 | free_xid(xid); | ||
1056 | return -EINVAL; | ||
1057 | } | ||
1058 | @@ -1460,10 +1460,10 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, | ||
1059 | |||
1060 | /* | ||
1061 | * Accessing maxBuf is racy with cifs_reconnect - need to store value | ||
1062 | - * and check it for zero before using. | ||
1063 | + * and check it before using. | ||
1064 | */ | ||
1065 | max_buf = tcon->ses->server->maxBuf; | ||
1066 | - if (!max_buf) | ||
1067 | + if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE))) | ||
1068 | return -EINVAL; | ||
1069 | |||
1070 | max_num = (max_buf - sizeof(struct smb_hdr)) / | ||
1071 | diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c | ||
1072 | index 4ed10dd086e6..2fc3d31967ee 100644 | ||
1073 | --- a/fs/cifs/smb2file.c | ||
1074 | +++ b/fs/cifs/smb2file.c | ||
1075 | @@ -122,10 +122,10 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, | ||
1076 | |||
1077 | /* | ||
1078 | * Accessing maxBuf is racy with cifs_reconnect - need to store value | ||
1079 | - * and check it for zero before using. | ||
1080 | + * and check it before using. | ||
1081 | */ | ||
1082 | max_buf = tcon->ses->server->maxBuf; | ||
1083 | - if (!max_buf) | ||
1084 | + if (max_buf < sizeof(struct smb2_lock_element)) | ||
1085 | return -EINVAL; | ||
1086 | |||
1087 | max_num = max_buf / sizeof(struct smb2_lock_element); | ||
1088 | diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c | ||
1089 | index f54d07bda067..dba986524917 100644 | ||
1090 | --- a/fs/cifs/smb2pdu.c | ||
1091 | +++ b/fs/cifs/smb2pdu.c | ||
1092 | @@ -3185,12 +3185,14 @@ smb2_async_readv(struct cifs_readdata *rdata) | ||
1093 | if (rdata->credits) { | ||
1094 | shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes, | ||
1095 | SMB2_MAX_BUFFER_SIZE)); | ||
1096 | - shdr->CreditRequest = shdr->CreditCharge; | ||
1097 | + shdr->CreditRequest = | ||
1098 | + cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1); | ||
1099 | spin_lock(&server->req_lock); | ||
1100 | server->credits += rdata->credits - | ||
1101 | le16_to_cpu(shdr->CreditCharge); | ||
1102 | spin_unlock(&server->req_lock); | ||
1103 | wake_up(&server->request_q); | ||
1104 | + rdata->credits = le16_to_cpu(shdr->CreditCharge); | ||
1105 | flags |= CIFS_HAS_CREDITS; | ||
1106 | } | ||
1107 | |||
1108 | @@ -3462,12 +3464,14 @@ smb2_async_writev(struct cifs_writedata *wdata, | ||
1109 | if (wdata->credits) { | ||
1110 | shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes, | ||
1111 | SMB2_MAX_BUFFER_SIZE)); | ||
1112 | - shdr->CreditRequest = shdr->CreditCharge; | ||
1113 | + shdr->CreditRequest = | ||
1114 | + cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1); | ||
1115 | spin_lock(&server->req_lock); | ||
1116 | server->credits += wdata->credits - | ||
1117 | le16_to_cpu(shdr->CreditCharge); | ||
1118 | spin_unlock(&server->req_lock); | ||
1119 | wake_up(&server->request_q); | ||
1120 | + wdata->credits = le16_to_cpu(shdr->CreditCharge); | ||
1121 | flags |= CIFS_HAS_CREDITS; | ||
1122 | } | ||
1123 | |||
1124 | diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c | ||
1125 | index 333729cf46cd..66348b3d28e6 100644 | ||
1126 | --- a/fs/cifs/transport.c | ||
1127 | +++ b/fs/cifs/transport.c | ||
1128 | @@ -378,7 +378,7 @@ smbd_done: | ||
1129 | if (rc < 0 && rc != -EINTR) | ||
1130 | cifs_dbg(VFS, "Error %d sending data on socket to server\n", | ||
1131 | rc); | ||
1132 | - else | ||
1133 | + else if (rc > 0) | ||
1134 | rc = 0; | ||
1135 | |||
1136 | return rc; | ||
1137 | @@ -786,7 +786,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, | ||
1138 | int i, j, rc = 0; | ||
1139 | int timeout, optype; | ||
1140 | struct mid_q_entry *midQ[MAX_COMPOUND]; | ||
1141 | - unsigned int credits = 0; | ||
1142 | + bool cancelled_mid[MAX_COMPOUND] = {false}; | ||
1143 | + unsigned int credits[MAX_COMPOUND] = {0}; | ||
1144 | char *buf; | ||
1145 | |||
1146 | timeout = flags & CIFS_TIMEOUT_MASK; | ||
1147 | @@ -804,13 +805,31 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, | ||
1148 | return -ENOENT; | ||
1149 | |||
1150 | /* | ||
1151 | - * Ensure that we do not send more than 50 overlapping requests | ||
1152 | - * to the same server. We may make this configurable later or | ||
1153 | - * use ses->maxReq. | ||
1154 | + * Ensure we obtain 1 credit per request in the compound chain. | ||
1155 | + * It can be optimized further by waiting for all the credits | ||
1156 | + * at once but this can wait long enough if we don't have enough | ||
1157 | + * credits due to some heavy operations in progress or the server | ||
1158 | + * not granting us much, so a fallback to the current approach is | ||
1159 | + * needed anyway. | ||
1160 | */ | ||
1161 | - rc = wait_for_free_request(ses->server, timeout, optype); | ||
1162 | - if (rc) | ||
1163 | - return rc; | ||
1164 | + for (i = 0; i < num_rqst; i++) { | ||
1165 | + rc = wait_for_free_request(ses->server, timeout, optype); | ||
1166 | + if (rc) { | ||
1167 | + /* | ||
1168 | + * We haven't sent an SMB packet to the server yet but | ||
1169 | + * we already obtained credits for i requests in the | ||
1170 | + * compound chain - need to return those credits back | ||
1171 | + * for future use. Note that we need to call add_credits | ||
1172 | + * multiple times to match the way we obtained credits | ||
1173 | + * in the first place and to account for in flight | ||
1174 | + * requests correctly. | ||
1175 | + */ | ||
1176 | + for (j = 0; j < i; j++) | ||
1177 | + add_credits(ses->server, 1, optype); | ||
1178 | + return rc; | ||
1179 | + } | ||
1180 | + credits[i] = 1; | ||
1181 | + } | ||
1182 | |||
1183 | /* | ||
1184 | * Make sure that we sign in the same order that we send on this socket | ||
1185 | @@ -826,8 +845,10 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, | ||
1186 | for (j = 0; j < i; j++) | ||
1187 | cifs_delete_mid(midQ[j]); | ||
1188 | mutex_unlock(&ses->server->srv_mutex); | ||
1189 | + | ||
1190 | /* Update # of requests on wire to server */ | ||
1191 | - add_credits(ses->server, 1, optype); | ||
1192 | + for (j = 0; j < num_rqst; j++) | ||
1193 | + add_credits(ses->server, credits[j], optype); | ||
1194 | return PTR_ERR(midQ[i]); | ||
1195 | } | ||
1196 | |||
1197 | @@ -874,19 +895,16 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, | ||
1198 | if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { | ||
1199 | midQ[i]->mid_flags |= MID_WAIT_CANCELLED; | ||
1200 | midQ[i]->callback = DeleteMidQEntry; | ||
1201 | - spin_unlock(&GlobalMid_Lock); | ||
1202 | - add_credits(ses->server, 1, optype); | ||
1203 | - return rc; | ||
1204 | + cancelled_mid[i] = true; | ||
1205 | } | ||
1206 | spin_unlock(&GlobalMid_Lock); | ||
1207 | } | ||
1208 | } | ||
1209 | |||
1210 | for (i = 0; i < num_rqst; i++) | ||
1211 | - if (midQ[i]->resp_buf) | ||
1212 | - credits += ses->server->ops->get_credits(midQ[i]); | ||
1213 | - if (!credits) | ||
1214 | - credits = 1; | ||
1215 | + if (!cancelled_mid[i] && midQ[i]->resp_buf | ||
1216 | + && (midQ[i]->mid_state == MID_RESPONSE_RECEIVED)) | ||
1217 | + credits[i] = ses->server->ops->get_credits(midQ[i]); | ||
1218 | |||
1219 | for (i = 0; i < num_rqst; i++) { | ||
1220 | if (rc < 0) | ||
1221 | @@ -894,8 +912,9 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, | ||
1222 | |||
1223 | rc = cifs_sync_mid_result(midQ[i], ses->server); | ||
1224 | if (rc != 0) { | ||
1225 | - add_credits(ses->server, credits, optype); | ||
1226 | - return rc; | ||
1227 | + /* mark this mid as cancelled to not free it below */ | ||
1228 | + cancelled_mid[i] = true; | ||
1229 | + goto out; | ||
1230 | } | ||
1231 | |||
1232 | if (!midQ[i]->resp_buf || | ||
1233 | @@ -942,9 +961,11 @@ out: | ||
1234 | * This is prevented above by using a noop callback that will not | ||
1235 | * wake this thread except for the very last PDU. | ||
1236 | */ | ||
1237 | - for (i = 0; i < num_rqst; i++) | ||
1238 | - cifs_delete_mid(midQ[i]); | ||
1239 | - add_credits(ses->server, credits, optype); | ||
1240 | + for (i = 0; i < num_rqst; i++) { | ||
1241 | + if (!cancelled_mid[i]) | ||
1242 | + cifs_delete_mid(midQ[i]); | ||
1243 | + add_credits(ses->server, credits[i], optype); | ||
1244 | + } | ||
1245 | |||
1246 | return rc; | ||
1247 | } | ||
1248 | diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c | ||
1249 | index 26a7fe5c4fd3..712f00995390 100644 | ||
1250 | --- a/fs/ext4/fsync.c | ||
1251 | +++ b/fs/ext4/fsync.c | ||
1252 | @@ -116,8 +116,16 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync) | ||
1253 | goto out; | ||
1254 | } | ||
1255 | |||
1256 | + ret = file_write_and_wait_range(file, start, end); | ||
1257 | + if (ret) | ||
1258 | + return ret; | ||
1259 | + | ||
1260 | if (!journal) { | ||
1261 | - ret = __generic_file_fsync(file, start, end, datasync); | ||
1262 | + struct writeback_control wbc = { | ||
1263 | + .sync_mode = WB_SYNC_ALL | ||
1264 | + }; | ||
1265 | + | ||
1266 | + ret = ext4_write_inode(inode, &wbc); | ||
1267 | if (!ret) | ||
1268 | ret = ext4_sync_parent(inode); | ||
1269 | if (test_opt(inode->i_sb, BARRIER)) | ||
1270 | @@ -125,9 +133,6 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync) | ||
1271 | goto out; | ||
1272 | } | ||
1273 | |||
1274 | - ret = file_write_and_wait_range(file, start, end); | ||
1275 | - if (ret) | ||
1276 | - return ret; | ||
1277 | /* | ||
1278 | * data=writeback,ordered: | ||
1279 | * The caller's filemap_fdatawrite()/wait will sync the data. | ||
1280 | @@ -159,6 +164,9 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync) | ||
1281 | ret = err; | ||
1282 | } | ||
1283 | out: | ||
1284 | + err = file_check_and_advance_wb_err(file); | ||
1285 | + if (ret == 0) | ||
1286 | + ret = err; | ||
1287 | trace_ext4_sync_file_exit(inode, ret); | ||
1288 | return ret; | ||
1289 | } | ||
1290 | diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c | ||
1291 | index 27373d88b5f0..56f6e1782d5f 100644 | ||
1292 | --- a/fs/ext4/inline.c | ||
1293 | +++ b/fs/ext4/inline.c | ||
1294 | @@ -1890,12 +1890,12 @@ int ext4_inline_data_fiemap(struct inode *inode, | ||
1295 | physical += (char *)ext4_raw_inode(&iloc) - iloc.bh->b_data; | ||
1296 | physical += offsetof(struct ext4_inode, i_block); | ||
1297 | |||
1298 | - if (physical) | ||
1299 | - error = fiemap_fill_next_extent(fieinfo, start, physical, | ||
1300 | - inline_len, flags); | ||
1301 | brelse(iloc.bh); | ||
1302 | out: | ||
1303 | up_read(&EXT4_I(inode)->xattr_sem); | ||
1304 | + if (physical) | ||
1305 | + error = fiemap_fill_next_extent(fieinfo, start, physical, | ||
1306 | + inline_len, flags); | ||
1307 | return (error < 0 ? error : 0); | ||
1308 | } | ||
1309 | |||
1310 | diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c | ||
1311 | index 36abbdafb26e..2c43c5b92229 100644 | ||
1312 | --- a/fs/ext4/inode.c | ||
1313 | +++ b/fs/ext4/inode.c | ||
1314 | @@ -2748,7 +2748,8 @@ static int ext4_writepages(struct address_space *mapping, | ||
1315 | * We may need to convert up to one extent per block in | ||
1316 | * the page and we may dirty the inode. | ||
1317 | */ | ||
1318 | - rsv_blocks = 1 + (PAGE_SIZE >> inode->i_blkbits); | ||
1319 | + rsv_blocks = 1 + ext4_chunk_trans_blocks(inode, | ||
1320 | + PAGE_SIZE >> inode->i_blkbits); | ||
1321 | } | ||
1322 | |||
1323 | /* | ||
1324 | @@ -4802,7 +4803,7 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, | ||
1325 | gid_t i_gid; | ||
1326 | projid_t i_projid; | ||
1327 | |||
1328 | - if (((flags & EXT4_IGET_NORMAL) && | ||
1329 | + if ((!(flags & EXT4_IGET_SPECIAL) && | ||
1330 | (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)) || | ||
1331 | (ino < EXT4_ROOT_INO) || | ||
1332 | (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))) { | ||
1333 | diff --git a/fs/ext4/super.c b/fs/ext4/super.c | ||
1334 | index ee0f30852835..a1cf7d68b4f0 100644 | ||
1335 | --- a/fs/ext4/super.c | ||
1336 | +++ b/fs/ext4/super.c | ||
1337 | @@ -4904,7 +4904,7 @@ static int ext4_commit_super(struct super_block *sb, int sync) | ||
1338 | ext4_superblock_csum_set(sb); | ||
1339 | if (sync) | ||
1340 | lock_buffer(sbh); | ||
1341 | - if (buffer_write_io_error(sbh)) { | ||
1342 | + if (buffer_write_io_error(sbh) || !buffer_uptodate(sbh)) { | ||
1343 | /* | ||
1344 | * Oh, dear. A previous attempt to write the | ||
1345 | * superblock failed. This could happen because the | ||
1346 | diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h | ||
1347 | index 4d36b27214fd..0242f6eec4ea 100644 | ||
1348 | --- a/include/linux/compiler-gcc.h | ||
1349 | +++ b/include/linux/compiler-gcc.h | ||
1350 | @@ -75,7 +75,7 @@ | ||
1351 | #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0])) | ||
1352 | #endif | ||
1353 | |||
1354 | -#ifdef RETPOLINE | ||
1355 | +#ifdef CONFIG_RETPOLINE | ||
1356 | #define __noretpoline __attribute__((indirect_branch("keep"))) | ||
1357 | #endif | ||
1358 | |||
1359 | diff --git a/include/linux/module.h b/include/linux/module.h | ||
1360 | index e19ae08c7fb8..904f94628132 100644 | ||
1361 | --- a/include/linux/module.h | ||
1362 | +++ b/include/linux/module.h | ||
1363 | @@ -818,7 +818,7 @@ static inline void module_bug_finalize(const Elf_Ehdr *hdr, | ||
1364 | static inline void module_bug_cleanup(struct module *mod) {} | ||
1365 | #endif /* CONFIG_GENERIC_BUG */ | ||
1366 | |||
1367 | -#ifdef RETPOLINE | ||
1368 | +#ifdef CONFIG_RETPOLINE | ||
1369 | extern bool retpoline_module_ok(bool has_retpoline); | ||
1370 | #else | ||
1371 | static inline bool retpoline_module_ok(bool has_retpoline) | ||
1372 | diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h | ||
1373 | index 73e130a840ce..fdb6b317d974 100644 | ||
1374 | --- a/include/linux/sunrpc/svc.h | ||
1375 | +++ b/include/linux/sunrpc/svc.h | ||
1376 | @@ -295,9 +295,12 @@ struct svc_rqst { | ||
1377 | struct svc_cacherep * rq_cacherep; /* cache info */ | ||
1378 | struct task_struct *rq_task; /* service thread */ | ||
1379 | spinlock_t rq_lock; /* per-request lock */ | ||
1380 | + struct net *rq_bc_net; /* pointer to backchannel's | ||
1381 | + * net namespace | ||
1382 | + */ | ||
1383 | }; | ||
1384 | |||
1385 | -#define SVC_NET(svc_rqst) (svc_rqst->rq_xprt->xpt_net) | ||
1386 | +#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net) | ||
1387 | |||
1388 | /* | ||
1389 | * Rigorous type checking on sockaddr type conversions | ||
1390 | diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h | ||
1391 | index bbb08a3ef5cc..a2644c494a9c 100644 | ||
1392 | --- a/include/trace/events/sunrpc.h | ||
1393 | +++ b/include/trace/events/sunrpc.h | ||
1394 | @@ -582,7 +582,8 @@ TRACE_EVENT(svc_process, | ||
1395 | __field(u32, vers) | ||
1396 | __field(u32, proc) | ||
1397 | __string(service, name) | ||
1398 | - __string(addr, rqst->rq_xprt->xpt_remotebuf) | ||
1399 | + __string(addr, rqst->rq_xprt ? | ||
1400 | + rqst->rq_xprt->xpt_remotebuf : "(null)") | ||
1401 | ), | ||
1402 | |||
1403 | TP_fast_assign( | ||
1404 | @@ -590,7 +591,8 @@ TRACE_EVENT(svc_process, | ||
1405 | __entry->vers = rqst->rq_vers; | ||
1406 | __entry->proc = rqst->rq_proc; | ||
1407 | __assign_str(service, name); | ||
1408 | - __assign_str(addr, rqst->rq_xprt->xpt_remotebuf); | ||
1409 | + __assign_str(addr, rqst->rq_xprt ? | ||
1410 | + rqst->rq_xprt->xpt_remotebuf : "(null)"); | ||
1411 | ), | ||
1412 | |||
1413 | TP_printk("addr=%s xid=0x%08x service=%s vers=%u proc=%u", | ||
1414 | diff --git a/mm/memory.c b/mm/memory.c | ||
1415 | index 5c5df53dbdf9..281172540a9c 100644 | ||
1416 | --- a/mm/memory.c | ||
1417 | +++ b/mm/memory.c | ||
1418 | @@ -3237,6 +3237,29 @@ static vm_fault_t __do_fault(struct vm_fault *vmf) | ||
1419 | struct vm_area_struct *vma = vmf->vma; | ||
1420 | vm_fault_t ret; | ||
1421 | |||
1422 | + /* | ||
1423 | + * Preallocate pte before we take page_lock because this might lead to | ||
1424 | + * deadlocks for memcg reclaim which waits for pages under writeback: | ||
1425 | + * lock_page(A) | ||
1426 | + * SetPageWriteback(A) | ||
1427 | + * unlock_page(A) | ||
1428 | + * lock_page(B) | ||
1429 | + * lock_page(B) | ||
1430 | + * pte_alloc_pne | ||
1431 | + * shrink_page_list | ||
1432 | + * wait_on_page_writeback(A) | ||
1433 | + * SetPageWriteback(B) | ||
1434 | + * unlock_page(B) | ||
1435 | + * # flush A, B to clear the writeback | ||
1436 | + */ | ||
1437 | + if (pmd_none(*vmf->pmd) && !vmf->prealloc_pte) { | ||
1438 | + vmf->prealloc_pte = pte_alloc_one(vmf->vma->vm_mm, | ||
1439 | + vmf->address); | ||
1440 | + if (!vmf->prealloc_pte) | ||
1441 | + return VM_FAULT_OOM; | ||
1442 | + smp_wmb(); /* See comment in __pte_alloc() */ | ||
1443 | + } | ||
1444 | + | ||
1445 | ret = vma->vm_ops->fault(vmf); | ||
1446 | if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY | | ||
1447 | VM_FAULT_DONE_COW))) | ||
1448 | diff --git a/mm/slab.c b/mm/slab.c | ||
1449 | index d73c7a4820a4..fad6839e8eab 100644 | ||
1450 | --- a/mm/slab.c | ||
1451 | +++ b/mm/slab.c | ||
1452 | @@ -679,8 +679,10 @@ static struct alien_cache *__alloc_alien_cache(int node, int entries, | ||
1453 | struct alien_cache *alc = NULL; | ||
1454 | |||
1455 | alc = kmalloc_node(memsize, gfp, node); | ||
1456 | - init_arraycache(&alc->ac, entries, batch); | ||
1457 | - spin_lock_init(&alc->lock); | ||
1458 | + if (alc) { | ||
1459 | + init_arraycache(&alc->ac, entries, batch); | ||
1460 | + spin_lock_init(&alc->lock); | ||
1461 | + } | ||
1462 | return alc; | ||
1463 | } | ||
1464 | |||
1465 | diff --git a/mm/usercopy.c b/mm/usercopy.c | ||
1466 | index 852eb4e53f06..14faadcedd06 100644 | ||
1467 | --- a/mm/usercopy.c | ||
1468 | +++ b/mm/usercopy.c | ||
1469 | @@ -247,7 +247,8 @@ static DEFINE_STATIC_KEY_FALSE_RO(bypass_usercopy_checks); | ||
1470 | /* | ||
1471 | * Validates that the given object is: | ||
1472 | * - not bogus address | ||
1473 | - * - known-safe heap or stack object | ||
1474 | + * - fully contained by stack (or stack frame, when available) | ||
1475 | + * - fully within SLAB object (or object whitelist area, when available) | ||
1476 | * - not in kernel text | ||
1477 | */ | ||
1478 | void __check_object_size(const void *ptr, unsigned long n, bool to_user) | ||
1479 | @@ -262,9 +263,6 @@ void __check_object_size(const void *ptr, unsigned long n, bool to_user) | ||
1480 | /* Check for invalid addresses. */ | ||
1481 | check_bogus_address((const unsigned long)ptr, n, to_user); | ||
1482 | |||
1483 | - /* Check for bad heap object. */ | ||
1484 | - check_heap_object(ptr, n, to_user); | ||
1485 | - | ||
1486 | /* Check for bad stack object. */ | ||
1487 | switch (check_stack_object(ptr, n)) { | ||
1488 | case NOT_STACK: | ||
1489 | @@ -282,6 +280,9 @@ void __check_object_size(const void *ptr, unsigned long n, bool to_user) | ||
1490 | usercopy_abort("process stack", NULL, to_user, 0, n); | ||
1491 | } | ||
1492 | |||
1493 | + /* Check for bad heap object. */ | ||
1494 | + check_heap_object(ptr, n, to_user); | ||
1495 | + | ||
1496 | /* Check for object in kernel to avoid text exposure. */ | ||
1497 | check_kernel_text_object((const unsigned long)ptr, n, to_user); | ||
1498 | } | ||
1499 | diff --git a/mm/util.c b/mm/util.c | ||
1500 | index 9e3ebd2ef65f..6a24a1025d77 100644 | ||
1501 | --- a/mm/util.c | ||
1502 | +++ b/mm/util.c | ||
1503 | @@ -485,7 +485,7 @@ bool page_mapped(struct page *page) | ||
1504 | return true; | ||
1505 | if (PageHuge(page)) | ||
1506 | return false; | ||
1507 | - for (i = 0; i < hpage_nr_pages(page); i++) { | ||
1508 | + for (i = 0; i < (1 << compound_order(page)); i++) { | ||
1509 | if (atomic_read(&page[i]._mapcount) >= 0) | ||
1510 | return true; | ||
1511 | } | ||
1512 | diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c | ||
1513 | index d13e05f1a990..d65f8d35de87 100644 | ||
1514 | --- a/net/sunrpc/svc.c | ||
1515 | +++ b/net/sunrpc/svc.c | ||
1516 | @@ -1144,6 +1144,8 @@ void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...) | ||
1517 | static __printf(2,3) void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...) {} | ||
1518 | #endif | ||
1519 | |||
1520 | +extern void svc_tcp_prep_reply_hdr(struct svc_rqst *); | ||
1521 | + | ||
1522 | /* | ||
1523 | * Common routine for processing the RPC request. | ||
1524 | */ | ||
1525 | @@ -1172,7 +1174,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) | ||
1526 | clear_bit(RQ_DROPME, &rqstp->rq_flags); | ||
1527 | |||
1528 | /* Setup reply header */ | ||
1529 | - rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); | ||
1530 | + if (rqstp->rq_prot == IPPROTO_TCP) | ||
1531 | + svc_tcp_prep_reply_hdr(rqstp); | ||
1532 | |||
1533 | svc_putu32(resv, rqstp->rq_xid); | ||
1534 | |||
1535 | @@ -1244,7 +1247,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) | ||
1536 | * for lower versions. RPC_PROG_MISMATCH seems to be the closest | ||
1537 | * fit. | ||
1538 | */ | ||
1539 | - if (versp->vs_need_cong_ctrl && | ||
1540 | + if (versp->vs_need_cong_ctrl && rqstp->rq_xprt && | ||
1541 | !test_bit(XPT_CONG_CTRL, &rqstp->rq_xprt->xpt_flags)) | ||
1542 | goto err_bad_vers; | ||
1543 | |||
1544 | @@ -1336,7 +1339,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) | ||
1545 | return 0; | ||
1546 | |||
1547 | close: | ||
1548 | - if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags)) | ||
1549 | + if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags)) | ||
1550 | svc_close_xprt(rqstp->rq_xprt); | ||
1551 | dprintk("svc: svc_process close\n"); | ||
1552 | return 0; | ||
1553 | @@ -1459,10 +1462,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req, | ||
1554 | dprintk("svc: %s(%p)\n", __func__, req); | ||
1555 | |||
1556 | /* Build the svc_rqst used by the common processing routine */ | ||
1557 | - rqstp->rq_xprt = serv->sv_bc_xprt; | ||
1558 | rqstp->rq_xid = req->rq_xid; | ||
1559 | rqstp->rq_prot = req->rq_xprt->prot; | ||
1560 | rqstp->rq_server = serv; | ||
1561 | + rqstp->rq_bc_net = req->rq_xprt->xprt_net; | ||
1562 | |||
1563 | rqstp->rq_addrlen = sizeof(req->rq_xprt->addr); | ||
1564 | memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen); | ||
1565 | diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c | ||
1566 | index 83ccd0221c98..6cf0fd37cbf0 100644 | ||
1567 | --- a/net/sunrpc/svc_xprt.c | ||
1568 | +++ b/net/sunrpc/svc_xprt.c | ||
1569 | @@ -469,10 +469,11 @@ out: | ||
1570 | */ | ||
1571 | void svc_reserve(struct svc_rqst *rqstp, int space) | ||
1572 | { | ||
1573 | + struct svc_xprt *xprt = rqstp->rq_xprt; | ||
1574 | + | ||
1575 | space += rqstp->rq_res.head[0].iov_len; | ||
1576 | |||
1577 | - if (space < rqstp->rq_reserved) { | ||
1578 | - struct svc_xprt *xprt = rqstp->rq_xprt; | ||
1579 | + if (xprt && space < rqstp->rq_reserved) { | ||
1580 | atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved); | ||
1581 | rqstp->rq_reserved = space; | ||
1582 | |||
1583 | diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c | ||
1584 | index fc1c0d9ef57d..97a8282955a8 100644 | ||
1585 | --- a/net/sunrpc/svcsock.c | ||
1586 | +++ b/net/sunrpc/svcsock.c | ||
1587 | @@ -1198,7 +1198,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp) | ||
1588 | /* | ||
1589 | * Setup response header. TCP has a 4B record length field. | ||
1590 | */ | ||
1591 | -static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp) | ||
1592 | +void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp) | ||
1593 | { | ||
1594 | struct kvec *resv = &rqstp->rq_res.head[0]; | ||
1595 | |||
1596 | diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c | ||
1597 | index 0d998c54564d..5a5b3780456f 100644 | ||
1598 | --- a/scripts/mod/modpost.c | ||
1599 | +++ b/scripts/mod/modpost.c | ||
1600 | @@ -2157,7 +2157,7 @@ static void add_intree_flag(struct buffer *b, int is_intree) | ||
1601 | /* Cannot check for assembler */ | ||
1602 | static void add_retpoline(struct buffer *b) | ||
1603 | { | ||
1604 | - buf_printf(b, "\n#ifdef RETPOLINE\n"); | ||
1605 | + buf_printf(b, "\n#ifdef CONFIG_RETPOLINE\n"); | ||
1606 | buf_printf(b, "MODULE_INFO(retpoline, \"Y\");\n"); | ||
1607 | buf_printf(b, "#endif\n"); | ||
1608 | } | ||
1609 | diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c | ||
1610 | index 854d63c01dd2..8b9f2487969b 100644 | ||
1611 | --- a/sound/pci/hda/patch_realtek.c | ||
1612 | +++ b/sound/pci/hda/patch_realtek.c | ||
1613 | @@ -4102,6 +4102,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec) | ||
1614 | case 0x10ec0295: | ||
1615 | case 0x10ec0289: | ||
1616 | case 0x10ec0299: | ||
1617 | + alc_process_coef_fw(codec, alc225_pre_hsmode); | ||
1618 | alc_process_coef_fw(codec, coef0225); | ||
1619 | break; | ||
1620 | case 0x10ec0867: | ||
1621 | @@ -5380,6 +5381,13 @@ static void alc285_fixup_invalidate_dacs(struct hda_codec *codec, | ||
1622 | snd_hda_override_wcaps(codec, 0x03, 0); | ||
1623 | } | ||
1624 | |||
1625 | +static void alc_fixup_disable_mic_vref(struct hda_codec *codec, | ||
1626 | + const struct hda_fixup *fix, int action) | ||
1627 | +{ | ||
1628 | + if (action == HDA_FIXUP_ACT_PRE_PROBE) | ||
1629 | + snd_hda_codec_set_pin_target(codec, 0x19, PIN_VREFHIZ); | ||
1630 | +} | ||
1631 | + | ||
1632 | /* for hda_fixup_thinkpad_acpi() */ | ||
1633 | #include "thinkpad_helper.c" | ||
1634 | |||
1635 | @@ -5492,6 +5500,7 @@ enum { | ||
1636 | ALC293_FIXUP_LENOVO_SPK_NOISE, | ||
1637 | ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, | ||
1638 | ALC255_FIXUP_DELL_SPK_NOISE, | ||
1639 | + ALC225_FIXUP_DISABLE_MIC_VREF, | ||
1640 | ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, | ||
1641 | ALC295_FIXUP_DISABLE_DAC3, | ||
1642 | ALC280_FIXUP_HP_HEADSET_MIC, | ||
1643 | @@ -6191,6 +6200,12 @@ static const struct hda_fixup alc269_fixups[] = { | ||
1644 | .chained = true, | ||
1645 | .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE | ||
1646 | }, | ||
1647 | + [ALC225_FIXUP_DISABLE_MIC_VREF] = { | ||
1648 | + .type = HDA_FIXUP_FUNC, | ||
1649 | + .v.func = alc_fixup_disable_mic_vref, | ||
1650 | + .chained = true, | ||
1651 | + .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE | ||
1652 | + }, | ||
1653 | [ALC225_FIXUP_DELL1_MIC_NO_PRESENCE] = { | ||
1654 | .type = HDA_FIXUP_VERBS, | ||
1655 | .v.verbs = (const struct hda_verb[]) { | ||
1656 | @@ -6200,7 +6215,7 @@ static const struct hda_fixup alc269_fixups[] = { | ||
1657 | {} | ||
1658 | }, | ||
1659 | .chained = true, | ||
1660 | - .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE | ||
1661 | + .chain_id = ALC225_FIXUP_DISABLE_MIC_VREF | ||
1662 | }, | ||
1663 | [ALC280_FIXUP_HP_HEADSET_MIC] = { | ||
1664 | .type = HDA_FIXUP_FUNC, | ||
1665 | @@ -6503,6 +6518,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { | ||
1666 | SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), | ||
1667 | SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), | ||
1668 | SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB), | ||
1669 | + SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), | ||
1670 | SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), | ||
1671 | SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), | ||
1672 | SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2), | ||
1673 | diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c | ||
1674 | index 8fb31a7cc22c..91495045ad5a 100644 | ||
1675 | --- a/virt/kvm/arm/arm.c | ||
1676 | +++ b/virt/kvm/arm/arm.c | ||
1677 | @@ -66,7 +66,7 @@ static DEFINE_PER_CPU(struct kvm_vcpu *, kvm_arm_running_vcpu); | ||
1678 | static atomic64_t kvm_vmid_gen = ATOMIC64_INIT(1); | ||
1679 | static u32 kvm_next_vmid; | ||
1680 | static unsigned int kvm_vmid_bits __read_mostly; | ||
1681 | -static DEFINE_RWLOCK(kvm_vmid_lock); | ||
1682 | +static DEFINE_SPINLOCK(kvm_vmid_lock); | ||
1683 | |||
1684 | static bool vgic_present; | ||
1685 | |||
1686 | @@ -482,7 +482,9 @@ void force_vm_exit(const cpumask_t *mask) | ||
1687 | */ | ||
1688 | static bool need_new_vmid_gen(struct kvm *kvm) | ||
1689 | { | ||
1690 | - return unlikely(kvm->arch.vmid_gen != atomic64_read(&kvm_vmid_gen)); | ||
1691 | + u64 current_vmid_gen = atomic64_read(&kvm_vmid_gen); | ||
1692 | + smp_rmb(); /* Orders read of kvm_vmid_gen and kvm->arch.vmid */ | ||
1693 | + return unlikely(READ_ONCE(kvm->arch.vmid_gen) != current_vmid_gen); | ||
1694 | } | ||
1695 | |||
1696 | /** | ||
1697 | @@ -497,16 +499,11 @@ static void update_vttbr(struct kvm *kvm) | ||
1698 | { | ||
1699 | phys_addr_t pgd_phys; | ||
1700 | u64 vmid; | ||
1701 | - bool new_gen; | ||
1702 | |||
1703 | - read_lock(&kvm_vmid_lock); | ||
1704 | - new_gen = need_new_vmid_gen(kvm); | ||
1705 | - read_unlock(&kvm_vmid_lock); | ||
1706 | - | ||
1707 | - if (!new_gen) | ||
1708 | + if (!need_new_vmid_gen(kvm)) | ||
1709 | return; | ||
1710 | |||
1711 | - write_lock(&kvm_vmid_lock); | ||
1712 | + spin_lock(&kvm_vmid_lock); | ||
1713 | |||
1714 | /* | ||
1715 | * We need to re-check the vmid_gen here to ensure that if another vcpu | ||
1716 | @@ -514,7 +511,7 @@ static void update_vttbr(struct kvm *kvm) | ||
1717 | * use the same vmid. | ||
1718 | */ | ||
1719 | if (!need_new_vmid_gen(kvm)) { | ||
1720 | - write_unlock(&kvm_vmid_lock); | ||
1721 | + spin_unlock(&kvm_vmid_lock); | ||
1722 | return; | ||
1723 | } | ||
1724 | |||
1725 | @@ -537,7 +534,6 @@ static void update_vttbr(struct kvm *kvm) | ||
1726 | kvm_call_hyp(__kvm_flush_vm_context); | ||
1727 | } | ||
1728 | |||
1729 | - kvm->arch.vmid_gen = atomic64_read(&kvm_vmid_gen); | ||
1730 | kvm->arch.vmid = kvm_next_vmid; | ||
1731 | kvm_next_vmid++; | ||
1732 | kvm_next_vmid &= (1 << kvm_vmid_bits) - 1; | ||
1733 | @@ -548,7 +544,10 @@ static void update_vttbr(struct kvm *kvm) | ||
1734 | vmid = ((u64)(kvm->arch.vmid) << VTTBR_VMID_SHIFT) & VTTBR_VMID_MASK(kvm_vmid_bits); | ||
1735 | kvm->arch.vttbr = kvm_phys_to_vttbr(pgd_phys) | vmid; | ||
1736 | |||
1737 | - write_unlock(&kvm_vmid_lock); | ||
1738 | + smp_wmb(); | ||
1739 | + WRITE_ONCE(kvm->arch.vmid_gen, atomic64_read(&kvm_vmid_gen)); | ||
1740 | + | ||
1741 | + spin_unlock(&kvm_vmid_lock); | ||
1742 | } | ||
1743 | |||
1744 | static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu) |