Annotation of /trunk/kernel-alx/patches-5.4/0232-5.4.133-all-fixes.patch
Parent Directory
|
Revision Log
Revision 3635 -
(hide annotations)
(download)
Mon Oct 24 12:34:12 2022 UTC (20 months ago) by niro
File size: 135110 byte(s)
Mon Oct 24 12:34:12 2022 UTC (20 months ago) by niro
File size: 135110 byte(s)
-sync kernel patches
1 | niro | 3635 | diff --git a/Makefile b/Makefile |
2 | index 58ea876fa1834..c0a064eea2b77 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,7 +1,7 @@ | ||
6 | # SPDX-License-Identifier: GPL-2.0 | ||
7 | VERSION = 5 | ||
8 | PATCHLEVEL = 4 | ||
9 | -SUBLEVEL = 132 | ||
10 | +SUBLEVEL = 133 | ||
11 | EXTRAVERSION = | ||
12 | NAME = Kleptomaniac Octopus | ||
13 | |||
14 | diff --git a/arch/mips/boot/compressed/string.c b/arch/mips/boot/compressed/string.c | ||
15 | index 43beecc3587cd..0b593b7092286 100644 | ||
16 | --- a/arch/mips/boot/compressed/string.c | ||
17 | +++ b/arch/mips/boot/compressed/string.c | ||
18 | @@ -5,6 +5,7 @@ | ||
19 | * Very small subset of simple string routines | ||
20 | */ | ||
21 | |||
22 | +#include <linux/compiler_attributes.h> | ||
23 | #include <linux/types.h> | ||
24 | |||
25 | void *memcpy(void *dest, const void *src, size_t n) | ||
26 | @@ -27,3 +28,19 @@ void *memset(void *s, int c, size_t n) | ||
27 | ss[i] = c; | ||
28 | return s; | ||
29 | } | ||
30 | + | ||
31 | +void * __weak memmove(void *dest, const void *src, size_t n) | ||
32 | +{ | ||
33 | + unsigned int i; | ||
34 | + const char *s = src; | ||
35 | + char *d = dest; | ||
36 | + | ||
37 | + if ((uintptr_t)dest < (uintptr_t)src) { | ||
38 | + for (i = 0; i < n; i++) | ||
39 | + d[i] = s[i]; | ||
40 | + } else { | ||
41 | + for (i = n; i > 0; i--) | ||
42 | + d[i - 1] = s[i - 1]; | ||
43 | + } | ||
44 | + return dest; | ||
45 | +} | ||
46 | diff --git a/arch/mips/include/asm/hugetlb.h b/arch/mips/include/asm/hugetlb.h | ||
47 | index 425bb6fc3bdaa..bf1bf8c7c332b 100644 | ||
48 | --- a/arch/mips/include/asm/hugetlb.h | ||
49 | +++ b/arch/mips/include/asm/hugetlb.h | ||
50 | @@ -53,7 +53,13 @@ static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm, | ||
51 | static inline void huge_ptep_clear_flush(struct vm_area_struct *vma, | ||
52 | unsigned long addr, pte_t *ptep) | ||
53 | { | ||
54 | - flush_tlb_page(vma, addr & huge_page_mask(hstate_vma(vma))); | ||
55 | + /* | ||
56 | + * clear the huge pte entry firstly, so that the other smp threads will | ||
57 | + * not get old pte entry after finishing flush_tlb_page and before | ||
58 | + * setting new huge pte entry | ||
59 | + */ | ||
60 | + huge_ptep_get_and_clear(vma->vm_mm, addr, ptep); | ||
61 | + flush_tlb_page(vma, addr); | ||
62 | } | ||
63 | |||
64 | #define __HAVE_ARCH_HUGE_PTE_NONE | ||
65 | diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h | ||
66 | index 3afdb39d092a5..c28b892937fe1 100644 | ||
67 | --- a/arch/mips/include/asm/mipsregs.h | ||
68 | +++ b/arch/mips/include/asm/mipsregs.h | ||
69 | @@ -2007,7 +2007,7 @@ _ASM_MACRO_0(tlbginvf, _ASM_INSN_IF_MIPS(0x4200000c) | ||
70 | ({ int __res; \ | ||
71 | __asm__ __volatile__( \ | ||
72 | ".set\tpush\n\t" \ | ||
73 | - ".set\tmips32r2\n\t" \ | ||
74 | + ".set\tmips32r5\n\t" \ | ||
75 | _ASM_SET_VIRT \ | ||
76 | "mfgc0\t%0, " #source ", %1\n\t" \ | ||
77 | ".set\tpop" \ | ||
78 | @@ -2020,7 +2020,7 @@ _ASM_MACRO_0(tlbginvf, _ASM_INSN_IF_MIPS(0x4200000c) | ||
79 | ({ unsigned long long __res; \ | ||
80 | __asm__ __volatile__( \ | ||
81 | ".set\tpush\n\t" \ | ||
82 | - ".set\tmips64r2\n\t" \ | ||
83 | + ".set\tmips64r5\n\t" \ | ||
84 | _ASM_SET_VIRT \ | ||
85 | "dmfgc0\t%0, " #source ", %1\n\t" \ | ||
86 | ".set\tpop" \ | ||
87 | @@ -2033,7 +2033,7 @@ _ASM_MACRO_0(tlbginvf, _ASM_INSN_IF_MIPS(0x4200000c) | ||
88 | do { \ | ||
89 | __asm__ __volatile__( \ | ||
90 | ".set\tpush\n\t" \ | ||
91 | - ".set\tmips32r2\n\t" \ | ||
92 | + ".set\tmips32r5\n\t" \ | ||
93 | _ASM_SET_VIRT \ | ||
94 | "mtgc0\t%z0, " #register ", %1\n\t" \ | ||
95 | ".set\tpop" \ | ||
96 | @@ -2045,7 +2045,7 @@ do { \ | ||
97 | do { \ | ||
98 | __asm__ __volatile__( \ | ||
99 | ".set\tpush\n\t" \ | ||
100 | - ".set\tmips64r2\n\t" \ | ||
101 | + ".set\tmips64r5\n\t" \ | ||
102 | _ASM_SET_VIRT \ | ||
103 | "dmtgc0\t%z0, " #register ", %1\n\t" \ | ||
104 | ".set\tpop" \ | ||
105 | diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h | ||
106 | index 166842337eb2c..dd10854321cac 100644 | ||
107 | --- a/arch/mips/include/asm/pgalloc.h | ||
108 | +++ b/arch/mips/include/asm/pgalloc.h | ||
109 | @@ -62,11 +62,15 @@ do { \ | ||
110 | |||
111 | static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address) | ||
112 | { | ||
113 | - pmd_t *pmd; | ||
114 | + pmd_t *pmd = NULL; | ||
115 | + struct page *pg; | ||
116 | |||
117 | - pmd = (pmd_t *) __get_free_pages(GFP_KERNEL, PMD_ORDER); | ||
118 | - if (pmd) | ||
119 | + pg = alloc_pages(GFP_KERNEL | __GFP_ACCOUNT, PMD_ORDER); | ||
120 | + if (pg) { | ||
121 | + pgtable_pmd_page_ctor(pg); | ||
122 | + pmd = (pmd_t *)page_address(pg); | ||
123 | pmd_init((unsigned long)pmd, (unsigned long)invalid_pte_table); | ||
124 | + } | ||
125 | return pmd; | ||
126 | } | ||
127 | |||
128 | diff --git a/arch/mips/loongson64/loongson-3/numa.c b/arch/mips/loongson64/loongson-3/numa.c | ||
129 | index 8f20d2cb37672..7e7376cc94b16 100644 | ||
130 | --- a/arch/mips/loongson64/loongson-3/numa.c | ||
131 | +++ b/arch/mips/loongson64/loongson-3/numa.c | ||
132 | @@ -200,6 +200,9 @@ static void __init node_mem_init(unsigned int node) | ||
133 | if (node_end_pfn(0) >= (0xffffffff >> PAGE_SHIFT)) | ||
134 | memblock_reserve((node_addrspace_offset | 0xfe000000), | ||
135 | 32 << 20); | ||
136 | + | ||
137 | + /* Reserve pfn range 0~node[0]->node_start_pfn */ | ||
138 | + memblock_reserve(0, PAGE_SIZE * start_pfn); | ||
139 | } | ||
140 | } | ||
141 | |||
142 | diff --git a/arch/powerpc/include/asm/barrier.h b/arch/powerpc/include/asm/barrier.h | ||
143 | index fbe8df4330190..dc953d22e3c68 100644 | ||
144 | --- a/arch/powerpc/include/asm/barrier.h | ||
145 | +++ b/arch/powerpc/include/asm/barrier.h | ||
146 | @@ -44,6 +44,8 @@ | ||
147 | # define SMPWMB eieio | ||
148 | #endif | ||
149 | |||
150 | +/* clang defines this macro for a builtin, which will not work with runtime patching */ | ||
151 | +#undef __lwsync | ||
152 | #define __lwsync() __asm__ __volatile__ (stringify_in_c(LWSYNC) : : :"memory") | ||
153 | #define dma_rmb() __lwsync() | ||
154 | #define dma_wmb() __asm__ __volatile__ (stringify_in_c(SMPWMB) : : :"memory") | ||
155 | diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c | ||
156 | index bb01a862aaf8d..9f4a78e3cde9e 100644 | ||
157 | --- a/arch/powerpc/mm/fault.c | ||
158 | +++ b/arch/powerpc/mm/fault.c | ||
159 | @@ -204,9 +204,7 @@ static bool bad_kernel_fault(struct pt_regs *regs, unsigned long error_code, | ||
160 | { | ||
161 | int is_exec = TRAP(regs) == 0x400; | ||
162 | |||
163 | - /* NX faults set DSISR_PROTFAULT on the 8xx, DSISR_NOEXEC_OR_G on others */ | ||
164 | - if (is_exec && (error_code & (DSISR_NOEXEC_OR_G | DSISR_KEYFAULT | | ||
165 | - DSISR_PROTFAULT))) { | ||
166 | + if (is_exec) { | ||
167 | pr_crit_ratelimited("kernel tried to execute %s page (%lx) - exploit attempt? (uid: %d)\n", | ||
168 | address >= TASK_SIZE ? "exec-protected" : "user", | ||
169 | address, | ||
170 | diff --git a/block/blk-rq-qos.c b/block/blk-rq-qos.c | ||
171 | index 656460636ad34..e83af7bc75919 100644 | ||
172 | --- a/block/blk-rq-qos.c | ||
173 | +++ b/block/blk-rq-qos.c | ||
174 | @@ -266,8 +266,8 @@ void rq_qos_wait(struct rq_wait *rqw, void *private_data, | ||
175 | if (!has_sleeper && acquire_inflight_cb(rqw, private_data)) | ||
176 | return; | ||
177 | |||
178 | - prepare_to_wait_exclusive(&rqw->wait, &data.wq, TASK_UNINTERRUPTIBLE); | ||
179 | - has_sleeper = !wq_has_single_sleeper(&rqw->wait); | ||
180 | + has_sleeper = !prepare_to_wait_exclusive(&rqw->wait, &data.wq, | ||
181 | + TASK_UNINTERRUPTIBLE); | ||
182 | do { | ||
183 | /* The memory barrier in set_task_state saves us here. */ | ||
184 | if (data.got_token) | ||
185 | diff --git a/drivers/ata/ahci_sunxi.c b/drivers/ata/ahci_sunxi.c | ||
186 | index cb69b737cb499..56b695136977a 100644 | ||
187 | --- a/drivers/ata/ahci_sunxi.c | ||
188 | +++ b/drivers/ata/ahci_sunxi.c | ||
189 | @@ -200,7 +200,7 @@ static void ahci_sunxi_start_engine(struct ata_port *ap) | ||
190 | } | ||
191 | |||
192 | static const struct ata_port_info ahci_sunxi_port_info = { | ||
193 | - .flags = AHCI_FLAG_COMMON | ATA_FLAG_NCQ, | ||
194 | + .flags = AHCI_FLAG_COMMON | ATA_FLAG_NCQ | ATA_FLAG_NO_DIPM, | ||
195 | .pio_mask = ATA_PIO4, | ||
196 | .udma_mask = ATA_UDMA6, | ||
197 | .port_ops = &ahci_platform_ops, | ||
198 | diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c | ||
199 | index 8c7a996d1f16c..46990352b5d3f 100644 | ||
200 | --- a/drivers/atm/iphase.c | ||
201 | +++ b/drivers/atm/iphase.c | ||
202 | @@ -3295,7 +3295,7 @@ static void __exit ia_module_exit(void) | ||
203 | { | ||
204 | pci_unregister_driver(&ia_driver); | ||
205 | |||
206 | - del_timer(&ia_timer); | ||
207 | + del_timer_sync(&ia_timer); | ||
208 | } | ||
209 | |||
210 | module_init(ia_module_init); | ||
211 | diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c | ||
212 | index bb9835c626415..f9d29de537b67 100644 | ||
213 | --- a/drivers/atm/nicstar.c | ||
214 | +++ b/drivers/atm/nicstar.c | ||
215 | @@ -297,7 +297,7 @@ static void __exit nicstar_cleanup(void) | ||
216 | { | ||
217 | XPRINTK("nicstar: nicstar_cleanup() called.\n"); | ||
218 | |||
219 | - del_timer(&ns_timer); | ||
220 | + del_timer_sync(&ns_timer); | ||
221 | |||
222 | pci_unregister_driver(&nicstar_driver); | ||
223 | |||
224 | @@ -525,6 +525,15 @@ static int ns_init_card(int i, struct pci_dev *pcidev) | ||
225 | /* Set the VPI/VCI MSb mask to zero so we can receive OAM cells */ | ||
226 | writel(0x00000000, card->membase + VPM); | ||
227 | |||
228 | + card->intcnt = 0; | ||
229 | + if (request_irq | ||
230 | + (pcidev->irq, &ns_irq_handler, IRQF_SHARED, "nicstar", card) != 0) { | ||
231 | + pr_err("nicstar%d: can't allocate IRQ %d.\n", i, pcidev->irq); | ||
232 | + error = 9; | ||
233 | + ns_init_card_error(card, error); | ||
234 | + return error; | ||
235 | + } | ||
236 | + | ||
237 | /* Initialize TSQ */ | ||
238 | card->tsq.org = dma_alloc_coherent(&card->pcidev->dev, | ||
239 | NS_TSQSIZE + NS_TSQ_ALIGNMENT, | ||
240 | @@ -751,15 +760,6 @@ static int ns_init_card(int i, struct pci_dev *pcidev) | ||
241 | |||
242 | card->efbie = 1; | ||
243 | |||
244 | - card->intcnt = 0; | ||
245 | - if (request_irq | ||
246 | - (pcidev->irq, &ns_irq_handler, IRQF_SHARED, "nicstar", card) != 0) { | ||
247 | - printk("nicstar%d: can't allocate IRQ %d.\n", i, pcidev->irq); | ||
248 | - error = 9; | ||
249 | - ns_init_card_error(card, error); | ||
250 | - return error; | ||
251 | - } | ||
252 | - | ||
253 | /* Register device */ | ||
254 | card->atmdev = atm_dev_register("nicstar", &card->pcidev->dev, &atm_ops, | ||
255 | -1, NULL); | ||
256 | @@ -837,10 +837,12 @@ static void ns_init_card_error(ns_dev *card, int error) | ||
257 | dev_kfree_skb_any(hb); | ||
258 | } | ||
259 | if (error >= 12) { | ||
260 | - kfree(card->rsq.org); | ||
261 | + dma_free_coherent(&card->pcidev->dev, NS_RSQSIZE + NS_RSQ_ALIGNMENT, | ||
262 | + card->rsq.org, card->rsq.dma); | ||
263 | } | ||
264 | if (error >= 11) { | ||
265 | - kfree(card->tsq.org); | ||
266 | + dma_free_coherent(&card->pcidev->dev, NS_TSQSIZE + NS_TSQ_ALIGNMENT, | ||
267 | + card->tsq.org, card->tsq.dma); | ||
268 | } | ||
269 | if (error >= 10) { | ||
270 | free_irq(card->pcidev->irq, card); | ||
271 | diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c | ||
272 | index b467fd05c5e82..6d643651d69f7 100644 | ||
273 | --- a/drivers/bluetooth/btusb.c | ||
274 | +++ b/drivers/bluetooth/btusb.c | ||
275 | @@ -2700,11 +2700,6 @@ static int btusb_mtk_hci_wmt_sync(struct hci_dev *hdev, | ||
276 | struct btmtk_wmt_hdr *hdr; | ||
277 | int err; | ||
278 | |||
279 | - /* Submit control IN URB on demand to process the WMT event */ | ||
280 | - err = btusb_mtk_submit_wmt_recv_urb(hdev); | ||
281 | - if (err < 0) | ||
282 | - return err; | ||
283 | - | ||
284 | /* Send the WMT command and wait until the WMT event returns */ | ||
285 | hlen = sizeof(*hdr) + wmt_params->dlen; | ||
286 | if (hlen > 255) | ||
287 | @@ -2726,6 +2721,11 @@ static int btusb_mtk_hci_wmt_sync(struct hci_dev *hdev, | ||
288 | return err; | ||
289 | } | ||
290 | |||
291 | + /* Submit control IN URB on demand to process the WMT event */ | ||
292 | + err = btusb_mtk_submit_wmt_recv_urb(hdev); | ||
293 | + if (err < 0) | ||
294 | + return err; | ||
295 | + | ||
296 | /* The vendor specific WMT commands are all answered by a vendor | ||
297 | * specific event and will have the Command Status or Command | ||
298 | * Complete as with usual HCI command flow control. | ||
299 | @@ -3263,6 +3263,11 @@ static int btusb_setup_qca_download_fw(struct hci_dev *hdev, | ||
300 | sent += size; | ||
301 | count -= size; | ||
302 | |||
303 | + /* ep2 need time to switch from function acl to function dfu, | ||
304 | + * so we add 20ms delay here. | ||
305 | + */ | ||
306 | + msleep(20); | ||
307 | + | ||
308 | while (count) { | ||
309 | size = min_t(size_t, count, QCA_DFU_PACKET_LEN); | ||
310 | |||
311 | diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c | ||
312 | index 74c6d1f341328..ae06e5402e9d5 100644 | ||
313 | --- a/drivers/char/ipmi/ipmi_watchdog.c | ||
314 | +++ b/drivers/char/ipmi/ipmi_watchdog.c | ||
315 | @@ -366,16 +366,18 @@ static int __ipmi_set_timeout(struct ipmi_smi_msg *smi_msg, | ||
316 | data[0] = 0; | ||
317 | WDOG_SET_TIMER_USE(data[0], WDOG_TIMER_USE_SMS_OS); | ||
318 | |||
319 | - if ((ipmi_version_major > 1) | ||
320 | - || ((ipmi_version_major == 1) && (ipmi_version_minor >= 5))) { | ||
321 | - /* This is an IPMI 1.5-only feature. */ | ||
322 | - data[0] |= WDOG_DONT_STOP_ON_SET; | ||
323 | - } else if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) { | ||
324 | - /* | ||
325 | - * In ipmi 1.0, setting the timer stops the watchdog, we | ||
326 | - * need to start it back up again. | ||
327 | - */ | ||
328 | - hbnow = 1; | ||
329 | + if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) { | ||
330 | + if ((ipmi_version_major > 1) || | ||
331 | + ((ipmi_version_major == 1) && (ipmi_version_minor >= 5))) { | ||
332 | + /* This is an IPMI 1.5-only feature. */ | ||
333 | + data[0] |= WDOG_DONT_STOP_ON_SET; | ||
334 | + } else { | ||
335 | + /* | ||
336 | + * In ipmi 1.0, setting the timer stops the watchdog, we | ||
337 | + * need to start it back up again. | ||
338 | + */ | ||
339 | + hbnow = 1; | ||
340 | + } | ||
341 | } | ||
342 | |||
343 | data[1] = 0; | ||
344 | diff --git a/drivers/clk/renesas/r8a77995-cpg-mssr.c b/drivers/clk/renesas/r8a77995-cpg-mssr.c | ||
345 | index 962bb337f2e7c..315f0d4bc420b 100644 | ||
346 | --- a/drivers/clk/renesas/r8a77995-cpg-mssr.c | ||
347 | +++ b/drivers/clk/renesas/r8a77995-cpg-mssr.c | ||
348 | @@ -75,6 +75,7 @@ static const struct cpg_core_clk r8a77995_core_clks[] __initconst = { | ||
349 | DEF_RATE(".oco", CLK_OCO, 8 * 1000 * 1000), | ||
350 | |||
351 | /* Core Clock Outputs */ | ||
352 | + DEF_FIXED("za2", R8A77995_CLK_ZA2, CLK_PLL0D3, 2, 1), | ||
353 | DEF_FIXED("z2", R8A77995_CLK_Z2, CLK_PLL0D3, 1, 1), | ||
354 | DEF_FIXED("ztr", R8A77995_CLK_ZTR, CLK_PLL1, 6, 1), | ||
355 | DEF_FIXED("zt", R8A77995_CLK_ZT, CLK_PLL1, 4, 1), | ||
356 | diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c | ||
357 | index 80f640d9ea71c..24ecfc114d41d 100644 | ||
358 | --- a/drivers/clk/tegra/clk-pll.c | ||
359 | +++ b/drivers/clk/tegra/clk-pll.c | ||
360 | @@ -1089,7 +1089,8 @@ static int clk_pllu_enable(struct clk_hw *hw) | ||
361 | if (pll->lock) | ||
362 | spin_lock_irqsave(pll->lock, flags); | ||
363 | |||
364 | - _clk_pll_enable(hw); | ||
365 | + if (!clk_pll_is_enabled(hw)) | ||
366 | + _clk_pll_enable(hw); | ||
367 | |||
368 | ret = clk_pll_wait_for_lock(pll); | ||
369 | if (ret < 0) | ||
370 | @@ -1706,15 +1707,13 @@ static int clk_pllu_tegra114_enable(struct clk_hw *hw) | ||
371 | return -EINVAL; | ||
372 | } | ||
373 | |||
374 | - if (clk_pll_is_enabled(hw)) | ||
375 | - return 0; | ||
376 | - | ||
377 | input_rate = clk_hw_get_rate(__clk_get_hw(osc)); | ||
378 | |||
379 | if (pll->lock) | ||
380 | spin_lock_irqsave(pll->lock, flags); | ||
381 | |||
382 | - _clk_pll_enable(hw); | ||
383 | + if (!clk_pll_is_enabled(hw)) | ||
384 | + _clk_pll_enable(hw); | ||
385 | |||
386 | ret = clk_pll_wait_for_lock(pll); | ||
387 | if (ret < 0) | ||
388 | diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c | ||
389 | index 39cdda2c9a98b..ec6f28ed21e27 100644 | ||
390 | --- a/drivers/clocksource/arm_arch_timer.c | ||
391 | +++ b/drivers/clocksource/arm_arch_timer.c | ||
392 | @@ -348,7 +348,7 @@ static u64 notrace arm64_858921_read_cntvct_el0(void) | ||
393 | do { \ | ||
394 | _val = read_sysreg(reg); \ | ||
395 | _retries--; \ | ||
396 | - } while (((_val + 1) & GENMASK(9, 0)) <= 1 && _retries); \ | ||
397 | + } while (((_val + 1) & GENMASK(8, 0)) <= 1 && _retries); \ | ||
398 | \ | ||
399 | WARN_ON_ONCE(!_retries); \ | ||
400 | _val; \ | ||
401 | diff --git a/drivers/crypto/ccp/psp-dev.c b/drivers/crypto/ccp/psp-dev.c | ||
402 | index 6b17d179ef8a0..5acf6ae5af667 100644 | ||
403 | --- a/drivers/crypto/ccp/psp-dev.c | ||
404 | +++ b/drivers/crypto/ccp/psp-dev.c | ||
405 | @@ -40,6 +40,10 @@ static int psp_probe_timeout = 5; | ||
406 | module_param(psp_probe_timeout, int, 0644); | ||
407 | MODULE_PARM_DESC(psp_probe_timeout, " default timeout value, in seconds, during PSP device probe"); | ||
408 | |||
409 | +MODULE_FIRMWARE("amd/amd_sev_fam17h_model0xh.sbin"); /* 1st gen EPYC */ | ||
410 | +MODULE_FIRMWARE("amd/amd_sev_fam17h_model3xh.sbin"); /* 2nd gen EPYC */ | ||
411 | +MODULE_FIRMWARE("amd/amd_sev_fam19h_model0xh.sbin"); /* 3rd gen EPYC */ | ||
412 | + | ||
413 | static bool psp_dead; | ||
414 | static int psp_timeout; | ||
415 | |||
416 | diff --git a/drivers/extcon/extcon-intel-mrfld.c b/drivers/extcon/extcon-intel-mrfld.c | ||
417 | index f47016fb28a84..cd1a5f230077c 100644 | ||
418 | --- a/drivers/extcon/extcon-intel-mrfld.c | ||
419 | +++ b/drivers/extcon/extcon-intel-mrfld.c | ||
420 | @@ -197,6 +197,7 @@ static int mrfld_extcon_probe(struct platform_device *pdev) | ||
421 | struct intel_soc_pmic *pmic = dev_get_drvdata(dev->parent); | ||
422 | struct regmap *regmap = pmic->regmap; | ||
423 | struct mrfld_extcon_data *data; | ||
424 | + unsigned int status; | ||
425 | unsigned int id; | ||
426 | int irq, ret; | ||
427 | |||
428 | @@ -244,6 +245,14 @@ static int mrfld_extcon_probe(struct platform_device *pdev) | ||
429 | /* Get initial state */ | ||
430 | mrfld_extcon_role_detect(data); | ||
431 | |||
432 | + /* | ||
433 | + * Cached status value is used for cable detection, see comments | ||
434 | + * in mrfld_extcon_cable_detect(), we need to sync cached value | ||
435 | + * with a real state of the hardware. | ||
436 | + */ | ||
437 | + regmap_read(regmap, BCOVE_SCHGRIRQ1, &status); | ||
438 | + data->status = status; | ||
439 | + | ||
440 | mrfld_extcon_clear(data, BCOVE_MIRQLVL1, BCOVE_LVL1_CHGR); | ||
441 | mrfld_extcon_clear(data, BCOVE_MCHGRIRQ1, BCOVE_CHGRIRQ_ALL); | ||
442 | |||
443 | diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c | ||
444 | index 6945c3c966375..59db70fb45614 100644 | ||
445 | --- a/drivers/firmware/qemu_fw_cfg.c | ||
446 | +++ b/drivers/firmware/qemu_fw_cfg.c | ||
447 | @@ -296,15 +296,13 @@ static int fw_cfg_do_platform_probe(struct platform_device *pdev) | ||
448 | return 0; | ||
449 | } | ||
450 | |||
451 | -static ssize_t fw_cfg_showrev(struct kobject *k, struct attribute *a, char *buf) | ||
452 | +static ssize_t fw_cfg_showrev(struct kobject *k, struct kobj_attribute *a, | ||
453 | + char *buf) | ||
454 | { | ||
455 | return sprintf(buf, "%u\n", fw_cfg_rev); | ||
456 | } | ||
457 | |||
458 | -static const struct { | ||
459 | - struct attribute attr; | ||
460 | - ssize_t (*show)(struct kobject *k, struct attribute *a, char *buf); | ||
461 | -} fw_cfg_rev_attr = { | ||
462 | +static const struct kobj_attribute fw_cfg_rev_attr = { | ||
463 | .attr = { .name = "rev", .mode = S_IRUSR }, | ||
464 | .show = fw_cfg_showrev, | ||
465 | }; | ||
466 | diff --git a/drivers/fpga/stratix10-soc.c b/drivers/fpga/stratix10-soc.c | ||
467 | index 215d33789c747..559839a960b60 100644 | ||
468 | --- a/drivers/fpga/stratix10-soc.c | ||
469 | +++ b/drivers/fpga/stratix10-soc.c | ||
470 | @@ -476,6 +476,7 @@ static int s10_remove(struct platform_device *pdev) | ||
471 | struct s10_priv *priv = mgr->priv; | ||
472 | |||
473 | fpga_mgr_unregister(mgr); | ||
474 | + fpga_mgr_free(mgr); | ||
475 | stratix10_svc_free_channel(priv->chan); | ||
476 | |||
477 | return 0; | ||
478 | diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | ||
479 | index f3fa271e3394c..25af45adc03e7 100644 | ||
480 | --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | ||
481 | +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | ||
482 | @@ -55,12 +55,6 @@ static struct { | ||
483 | spinlock_t mem_limit_lock; | ||
484 | } kfd_mem_limit; | ||
485 | |||
486 | -/* Struct used for amdgpu_amdkfd_bo_validate */ | ||
487 | -struct amdgpu_vm_parser { | ||
488 | - uint32_t domain; | ||
489 | - bool wait; | ||
490 | -}; | ||
491 | - | ||
492 | static const char * const domain_bit_to_string[] = { | ||
493 | "CPU", | ||
494 | "GTT", | ||
495 | @@ -293,11 +287,9 @@ validate_fail: | ||
496 | return ret; | ||
497 | } | ||
498 | |||
499 | -static int amdgpu_amdkfd_validate(void *param, struct amdgpu_bo *bo) | ||
500 | +static int amdgpu_amdkfd_validate_vm_bo(void *_unused, struct amdgpu_bo *bo) | ||
501 | { | ||
502 | - struct amdgpu_vm_parser *p = param; | ||
503 | - | ||
504 | - return amdgpu_amdkfd_bo_validate(bo, p->domain, p->wait); | ||
505 | + return amdgpu_amdkfd_bo_validate(bo, bo->allowed_domains, false); | ||
506 | } | ||
507 | |||
508 | /* vm_validate_pt_pd_bos - Validate page table and directory BOs | ||
509 | @@ -311,20 +303,15 @@ static int vm_validate_pt_pd_bos(struct amdgpu_vm *vm) | ||
510 | { | ||
511 | struct amdgpu_bo *pd = vm->root.base.bo; | ||
512 | struct amdgpu_device *adev = amdgpu_ttm_adev(pd->tbo.bdev); | ||
513 | - struct amdgpu_vm_parser param; | ||
514 | int ret; | ||
515 | |||
516 | - param.domain = AMDGPU_GEM_DOMAIN_VRAM; | ||
517 | - param.wait = false; | ||
518 | - | ||
519 | - ret = amdgpu_vm_validate_pt_bos(adev, vm, amdgpu_amdkfd_validate, | ||
520 | - ¶m); | ||
521 | + ret = amdgpu_vm_validate_pt_bos(adev, vm, amdgpu_amdkfd_validate_vm_bo, NULL); | ||
522 | if (ret) { | ||
523 | pr_err("amdgpu: failed to validate PT BOs\n"); | ||
524 | return ret; | ||
525 | } | ||
526 | |||
527 | - ret = amdgpu_amdkfd_validate(¶m, pd); | ||
528 | + ret = amdgpu_amdkfd_validate_vm_bo(NULL, pd); | ||
529 | if (ret) { | ||
530 | pr_err("amdgpu: failed to validate PD\n"); | ||
531 | return ret; | ||
532 | diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | ||
533 | index 765f9a6c46401..d0e1fd011de54 100644 | ||
534 | --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | ||
535 | +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | ||
536 | @@ -2291,7 +2291,7 @@ static int amdgpu_device_ip_reinit_early_sriov(struct amdgpu_device *adev) | ||
537 | AMD_IP_BLOCK_TYPE_IH, | ||
538 | }; | ||
539 | |||
540 | - for (i = 0; i < ARRAY_SIZE(ip_order); i++) { | ||
541 | + for (i = 0; i < adev->num_ip_blocks; i++) { | ||
542 | int j; | ||
543 | struct amdgpu_ip_block *block; | ||
544 | |||
545 | diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | ||
546 | index ab69898c9cb72..723ec6c2830df 100644 | ||
547 | --- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | ||
548 | +++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | ||
549 | @@ -1584,7 +1584,7 @@ static int process_termination_cpsch(struct device_queue_manager *dqm, | ||
550 | struct qcm_process_device *qpd) | ||
551 | { | ||
552 | int retval; | ||
553 | - struct queue *q, *next; | ||
554 | + struct queue *q; | ||
555 | struct kernel_queue *kq, *kq_next; | ||
556 | struct mqd_manager *mqd_mgr; | ||
557 | struct device_process_node *cur, *next_dpn; | ||
558 | @@ -1639,24 +1639,26 @@ static int process_termination_cpsch(struct device_queue_manager *dqm, | ||
559 | qpd->reset_wavefronts = false; | ||
560 | } | ||
561 | |||
562 | - dqm_unlock(dqm); | ||
563 | - | ||
564 | - /* Outside the DQM lock because under the DQM lock we can't do | ||
565 | - * reclaim or take other locks that others hold while reclaiming. | ||
566 | - */ | ||
567 | - if (found) | ||
568 | - kfd_dec_compute_active(dqm->dev); | ||
569 | - | ||
570 | /* Lastly, free mqd resources. | ||
571 | * Do free_mqd() after dqm_unlock to avoid circular locking. | ||
572 | */ | ||
573 | - list_for_each_entry_safe(q, next, &qpd->queues_list, list) { | ||
574 | + while (!list_empty(&qpd->queues_list)) { | ||
575 | + q = list_first_entry(&qpd->queues_list, struct queue, list); | ||
576 | mqd_mgr = dqm->mqd_mgrs[get_mqd_type_from_queue_type( | ||
577 | q->properties.type)]; | ||
578 | list_del(&q->list); | ||
579 | qpd->queue_count--; | ||
580 | + dqm_unlock(dqm); | ||
581 | mqd_mgr->free_mqd(mqd_mgr, q->mqd, q->mqd_mem_obj); | ||
582 | + dqm_lock(dqm); | ||
583 | } | ||
584 | + dqm_unlock(dqm); | ||
585 | + | ||
586 | + /* Outside the DQM lock because under the DQM lock we can't do | ||
587 | + * reclaim or take other locks that others hold while reclaiming. | ||
588 | + */ | ||
589 | + if (found) | ||
590 | + kfd_dec_compute_active(dqm->dev); | ||
591 | |||
592 | return retval; | ||
593 | } | ||
594 | diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | ||
595 | index 6e31e899192c5..0dc60fe22aefc 100644 | ||
596 | --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | ||
597 | +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | ||
598 | @@ -2632,6 +2632,23 @@ static int fill_dc_scaling_info(const struct drm_plane_state *state, | ||
599 | scaling_info->src_rect.x = state->src_x >> 16; | ||
600 | scaling_info->src_rect.y = state->src_y >> 16; | ||
601 | |||
602 | + /* | ||
603 | + * For reasons we don't (yet) fully understand a non-zero | ||
604 | + * src_y coordinate into an NV12 buffer can cause a | ||
605 | + * system hang. To avoid hangs (and maybe be overly cautious) | ||
606 | + * let's reject both non-zero src_x and src_y. | ||
607 | + * | ||
608 | + * We currently know of only one use-case to reproduce a | ||
609 | + * scenario with non-zero src_x and src_y for NV12, which | ||
610 | + * is to gesture the YouTube Android app into full screen | ||
611 | + * on ChromeOS. | ||
612 | + */ | ||
613 | + if (state->fb && | ||
614 | + state->fb->format->format == DRM_FORMAT_NV12 && | ||
615 | + (scaling_info->src_rect.x != 0 || | ||
616 | + scaling_info->src_rect.y != 0)) | ||
617 | + return -EINVAL; | ||
618 | + | ||
619 | /* | ||
620 | * For reasons we don't (yet) fully understand a non-zero | ||
621 | * src_y coordinate into an NV12 buffer can cause a | ||
622 | @@ -6832,7 +6849,8 @@ skip_modeset: | ||
623 | BUG_ON(dm_new_crtc_state->stream == NULL); | ||
624 | |||
625 | /* Scaling or underscan settings */ | ||
626 | - if (is_scaling_state_different(dm_old_conn_state, dm_new_conn_state)) | ||
627 | + if (is_scaling_state_different(dm_old_conn_state, dm_new_conn_state) || | ||
628 | + drm_atomic_crtc_needs_modeset(new_crtc_state)) | ||
629 | update_stream_scaling_settings( | ||
630 | &new_crtc_state->mode, dm_new_conn_state, dm_new_crtc_state->stream); | ||
631 | |||
632 | @@ -7406,6 +7424,10 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev, | ||
633 | old_crtc_state->vrr_enabled == new_crtc_state->vrr_enabled) | ||
634 | continue; | ||
635 | |||
636 | + ret = amdgpu_dm_verify_lut_sizes(new_crtc_state); | ||
637 | + if (ret) | ||
638 | + goto fail; | ||
639 | + | ||
640 | if (!new_crtc_state->enable) | ||
641 | continue; | ||
642 | |||
643 | diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | ||
644 | index c8c525a2b5052..54163c970e7a5 100644 | ||
645 | --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | ||
646 | +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | ||
647 | @@ -387,6 +387,7 @@ void amdgpu_dm_update_freesync_caps(struct drm_connector *connector, | ||
648 | #define MAX_COLOR_LEGACY_LUT_ENTRIES 256 | ||
649 | |||
650 | void amdgpu_dm_init_color_mod(void); | ||
651 | +int amdgpu_dm_verify_lut_sizes(const struct drm_crtc_state *crtc_state); | ||
652 | int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc); | ||
653 | int amdgpu_dm_update_plane_color_mgmt(struct dm_crtc_state *crtc, | ||
654 | struct dc_plane_state *dc_plane_state); | ||
655 | diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | ||
656 | index 2233d293a707a..6acc460a3e982 100644 | ||
657 | --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | ||
658 | +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | ||
659 | @@ -277,6 +277,37 @@ static int __set_input_tf(struct dc_transfer_func *func, | ||
660 | return res ? 0 : -ENOMEM; | ||
661 | } | ||
662 | |||
663 | +/** | ||
664 | + * Verifies that the Degamma and Gamma LUTs attached to the |crtc_state| are of | ||
665 | + * the expected size. | ||
666 | + * Returns 0 on success. | ||
667 | + */ | ||
668 | +int amdgpu_dm_verify_lut_sizes(const struct drm_crtc_state *crtc_state) | ||
669 | +{ | ||
670 | + const struct drm_color_lut *lut = NULL; | ||
671 | + uint32_t size = 0; | ||
672 | + | ||
673 | + lut = __extract_blob_lut(crtc_state->degamma_lut, &size); | ||
674 | + if (lut && size != MAX_COLOR_LUT_ENTRIES) { | ||
675 | + DRM_DEBUG_DRIVER( | ||
676 | + "Invalid Degamma LUT size. Should be %u but got %u.\n", | ||
677 | + MAX_COLOR_LUT_ENTRIES, size); | ||
678 | + return -EINVAL; | ||
679 | + } | ||
680 | + | ||
681 | + lut = __extract_blob_lut(crtc_state->gamma_lut, &size); | ||
682 | + if (lut && size != MAX_COLOR_LUT_ENTRIES && | ||
683 | + size != MAX_COLOR_LEGACY_LUT_ENTRIES) { | ||
684 | + DRM_DEBUG_DRIVER( | ||
685 | + "Invalid Gamma LUT size. Should be %u (or %u for legacy) but got %u.\n", | ||
686 | + MAX_COLOR_LUT_ENTRIES, MAX_COLOR_LEGACY_LUT_ENTRIES, | ||
687 | + size); | ||
688 | + return -EINVAL; | ||
689 | + } | ||
690 | + | ||
691 | + return 0; | ||
692 | +} | ||
693 | + | ||
694 | /** | ||
695 | * amdgpu_dm_update_crtc_color_mgmt: Maps DRM color management to DC stream. | ||
696 | * @crtc: amdgpu_dm crtc state | ||
697 | @@ -311,14 +342,12 @@ int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc) | ||
698 | bool is_legacy; | ||
699 | int r; | ||
700 | |||
701 | - degamma_lut = __extract_blob_lut(crtc->base.degamma_lut, °amma_size); | ||
702 | - if (degamma_lut && degamma_size != MAX_COLOR_LUT_ENTRIES) | ||
703 | - return -EINVAL; | ||
704 | + r = amdgpu_dm_verify_lut_sizes(&crtc->base); | ||
705 | + if (r) | ||
706 | + return r; | ||
707 | |||
708 | + degamma_lut = __extract_blob_lut(crtc->base.degamma_lut, °amma_size); | ||
709 | regamma_lut = __extract_blob_lut(crtc->base.gamma_lut, ®amma_size); | ||
710 | - if (regamma_lut && regamma_size != MAX_COLOR_LUT_ENTRIES && | ||
711 | - regamma_size != MAX_COLOR_LEGACY_LUT_ENTRIES) | ||
712 | - return -EINVAL; | ||
713 | |||
714 | has_degamma = | ||
715 | degamma_lut && !__is_lut_linear(degamma_lut, degamma_size); | ||
716 | diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | ||
717 | index c18f39271b034..4bc95e9075e97 100644 | ||
718 | --- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | ||
719 | +++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | ||
720 | @@ -1284,6 +1284,8 @@ static void set_dp_mst_mode(struct dc_link *link, bool mst_enable) | ||
721 | link->type = dc_connection_single; | ||
722 | link->local_sink = link->remote_sinks[0]; | ||
723 | link->local_sink->sink_signal = SIGNAL_TYPE_DISPLAY_PORT; | ||
724 | + dc_sink_retain(link->local_sink); | ||
725 | + dm_helpers_dp_mst_stop_top_mgr(link->ctx, link); | ||
726 | } else if (mst_enable == true && | ||
727 | link->type == dc_connection_single && | ||
728 | link->remote_sinks[0] != NULL) { | ||
729 | diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c | ||
730 | index d67e0abeee938..11a89d8733842 100644 | ||
731 | --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c | ||
732 | +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp_dscl.c | ||
733 | @@ -484,10 +484,13 @@ static enum lb_memory_config dpp1_dscl_find_lb_memory_config(struct dcn10_dpp *d | ||
734 | int vtaps_c = scl_data->taps.v_taps_c; | ||
735 | int ceil_vratio = dc_fixpt_ceil(scl_data->ratios.vert); | ||
736 | int ceil_vratio_c = dc_fixpt_ceil(scl_data->ratios.vert_c); | ||
737 | - enum lb_memory_config mem_cfg = LB_MEMORY_CONFIG_0; | ||
738 | |||
739 | - if (dpp->base.ctx->dc->debug.use_max_lb) | ||
740 | - return mem_cfg; | ||
741 | + if (dpp->base.ctx->dc->debug.use_max_lb) { | ||
742 | + if (scl_data->format == PIXEL_FORMAT_420BPP8 | ||
743 | + || scl_data->format == PIXEL_FORMAT_420BPP10) | ||
744 | + return LB_MEMORY_CONFIG_3; | ||
745 | + return LB_MEMORY_CONFIG_0; | ||
746 | + } | ||
747 | |||
748 | dpp->base.caps->dscl_calc_lb_num_partitions( | ||
749 | scl_data, LB_MEMORY_CONFIG_1, &num_part_y, &num_part_c); | ||
750 | diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | ||
751 | index 083c42e521f5c..03a2e1d7f0673 100644 | ||
752 | --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | ||
753 | +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | ||
754 | @@ -126,7 +126,7 @@ void dcn20_dccg_init(struct dce_hwseq *hws) | ||
755 | REG_WRITE(MILLISECOND_TIME_BASE_DIV, 0x1186a0); | ||
756 | |||
757 | /* This value is dependent on the hardware pipeline delay so set once per SOC */ | ||
758 | - REG_WRITE(DISPCLK_FREQ_CHANGE_CNTL, 0x801003c); | ||
759 | + REG_WRITE(DISPCLK_FREQ_CHANGE_CNTL, 0xe01003c); | ||
760 | } | ||
761 | void dcn20_display_init(struct dc *dc) | ||
762 | { | ||
763 | diff --git a/drivers/gpu/drm/amd/display/dc/irq_types.h b/drivers/gpu/drm/amd/display/dc/irq_types.h | ||
764 | index d0ccd81ad5b4d..ad3e5621a1744 100644 | ||
765 | --- a/drivers/gpu/drm/amd/display/dc/irq_types.h | ||
766 | +++ b/drivers/gpu/drm/amd/display/dc/irq_types.h | ||
767 | @@ -163,7 +163,7 @@ enum irq_type | ||
768 | }; | ||
769 | |||
770 | #define DAL_VALID_IRQ_SRC_NUM(src) \ | ||
771 | - ((src) <= DAL_IRQ_SOURCES_NUMBER && (src) > DC_IRQ_SOURCE_INVALID) | ||
772 | + ((src) < DAL_IRQ_SOURCES_NUMBER && (src) > DC_IRQ_SOURCE_INVALID) | ||
773 | |||
774 | /* Number of Page Flip IRQ Sources. */ | ||
775 | #define DAL_PFLIP_IRQ_SRC_NUM \ | ||
776 | diff --git a/drivers/gpu/drm/amd/include/navi10_enum.h b/drivers/gpu/drm/amd/include/navi10_enum.h | ||
777 | index d5ead9680c6ed..84bcb96f76ea4 100644 | ||
778 | --- a/drivers/gpu/drm/amd/include/navi10_enum.h | ||
779 | +++ b/drivers/gpu/drm/amd/include/navi10_enum.h | ||
780 | @@ -430,7 +430,7 @@ ARRAY_2D_DEPTH = 0x00000001, | ||
781 | */ | ||
782 | |||
783 | typedef enum ENUM_NUM_SIMD_PER_CU { | ||
784 | -NUM_SIMD_PER_CU = 0x00000004, | ||
785 | +NUM_SIMD_PER_CU = 0x00000002, | ||
786 | } ENUM_NUM_SIMD_PER_CU; | ||
787 | |||
788 | /* | ||
789 | diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c | ||
790 | index 0b2bb485d9be3..7bf348d28fbf1 100644 | ||
791 | --- a/drivers/gpu/drm/arm/malidp_planes.c | ||
792 | +++ b/drivers/gpu/drm/arm/malidp_planes.c | ||
793 | @@ -922,6 +922,11 @@ static const struct drm_plane_helper_funcs malidp_de_plane_helper_funcs = { | ||
794 | .atomic_disable = malidp_de_plane_disable, | ||
795 | }; | ||
796 | |||
797 | +static const uint64_t linear_only_modifiers[] = { | ||
798 | + DRM_FORMAT_MOD_LINEAR, | ||
799 | + DRM_FORMAT_MOD_INVALID | ||
800 | +}; | ||
801 | + | ||
802 | int malidp_de_planes_init(struct drm_device *drm) | ||
803 | { | ||
804 | struct malidp_drm *malidp = drm->dev_private; | ||
805 | @@ -985,8 +990,8 @@ int malidp_de_planes_init(struct drm_device *drm) | ||
806 | */ | ||
807 | ret = drm_universal_plane_init(drm, &plane->base, crtcs, | ||
808 | &malidp_de_plane_funcs, formats, n, | ||
809 | - (id == DE_SMART) ? NULL : modifiers, plane_type, | ||
810 | - NULL); | ||
811 | + (id == DE_SMART) ? linear_only_modifiers : modifiers, | ||
812 | + plane_type, NULL); | ||
813 | |||
814 | if (ret < 0) | ||
815 | goto cleanup; | ||
816 | diff --git a/drivers/gpu/drm/bridge/cdns-dsi.c b/drivers/gpu/drm/bridge/cdns-dsi.c | ||
817 | index 6166dca6be813..0cb9dd6986ec3 100644 | ||
818 | --- a/drivers/gpu/drm/bridge/cdns-dsi.c | ||
819 | +++ b/drivers/gpu/drm/bridge/cdns-dsi.c | ||
820 | @@ -1026,7 +1026,7 @@ static ssize_t cdns_dsi_transfer(struct mipi_dsi_host *host, | ||
821 | struct mipi_dsi_packet packet; | ||
822 | int ret, i, tx_len, rx_len; | ||
823 | |||
824 | - ret = pm_runtime_get_sync(host->dev); | ||
825 | + ret = pm_runtime_resume_and_get(host->dev); | ||
826 | if (ret < 0) | ||
827 | return ret; | ||
828 | |||
829 | diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c | ||
830 | index f9455f2724d23..f370d41b3d041 100644 | ||
831 | --- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c | ||
832 | +++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c | ||
833 | @@ -240,7 +240,7 @@ static int mtk_crtc_ddp_hw_init(struct mtk_drm_crtc *mtk_crtc) | ||
834 | drm_connector_list_iter_end(&conn_iter); | ||
835 | } | ||
836 | |||
837 | - ret = pm_runtime_get_sync(crtc->dev->dev); | ||
838 | + ret = pm_runtime_resume_and_get(crtc->dev->dev); | ||
839 | if (ret < 0) { | ||
840 | DRM_ERROR("Failed to enable power domain: %d\n", ret); | ||
841 | return ret; | ||
842 | diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | ||
843 | index 50711ccc86914..20194d86d0339 100644 | ||
844 | --- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | ||
845 | +++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | ||
846 | @@ -88,8 +88,6 @@ static int mdp4_hw_init(struct msm_kms *kms) | ||
847 | if (mdp4_kms->rev > 1) | ||
848 | mdp4_write(mdp4_kms, REG_MDP4_RESET_STATUS, 1); | ||
849 | |||
850 | - dev->mode_config.allow_fb_modifiers = true; | ||
851 | - | ||
852 | out: | ||
853 | pm_runtime_put_sync(dev->dev); | ||
854 | |||
855 | diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c | ||
856 | index da3cc1d8c3312..ee1dbb2b84af4 100644 | ||
857 | --- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c | ||
858 | +++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_plane.c | ||
859 | @@ -347,6 +347,12 @@ enum mdp4_pipe mdp4_plane_pipe(struct drm_plane *plane) | ||
860 | return mdp4_plane->pipe; | ||
861 | } | ||
862 | |||
863 | +static const uint64_t supported_format_modifiers[] = { | ||
864 | + DRM_FORMAT_MOD_SAMSUNG_64_32_TILE, | ||
865 | + DRM_FORMAT_MOD_LINEAR, | ||
866 | + DRM_FORMAT_MOD_INVALID | ||
867 | +}; | ||
868 | + | ||
869 | /* initialize plane */ | ||
870 | struct drm_plane *mdp4_plane_init(struct drm_device *dev, | ||
871 | enum mdp4_pipe pipe_id, bool private_plane) | ||
872 | @@ -375,7 +381,7 @@ struct drm_plane *mdp4_plane_init(struct drm_device *dev, | ||
873 | type = private_plane ? DRM_PLANE_TYPE_PRIMARY : DRM_PLANE_TYPE_OVERLAY; | ||
874 | ret = drm_universal_plane_init(dev, plane, 0xff, &mdp4_plane_funcs, | ||
875 | mdp4_plane->formats, mdp4_plane->nformats, | ||
876 | - NULL, type, NULL); | ||
877 | + supported_format_modifiers, type, NULL); | ||
878 | if (ret) | ||
879 | goto fail; | ||
880 | |||
881 | diff --git a/drivers/gpu/drm/mxsfb/Kconfig b/drivers/gpu/drm/mxsfb/Kconfig | ||
882 | index 0dca8f27169e9..33916b7b2c501 100644 | ||
883 | --- a/drivers/gpu/drm/mxsfb/Kconfig | ||
884 | +++ b/drivers/gpu/drm/mxsfb/Kconfig | ||
885 | @@ -10,7 +10,6 @@ config DRM_MXSFB | ||
886 | depends on COMMON_CLK | ||
887 | select DRM_MXS | ||
888 | select DRM_KMS_HELPER | ||
889 | - select DRM_KMS_FB_HELPER | ||
890 | select DRM_KMS_CMA_HELPER | ||
891 | select DRM_PANEL | ||
892 | help | ||
893 | diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c | ||
894 | index f9f74150d0d73..27b168936b2af 100644 | ||
895 | --- a/drivers/gpu/drm/radeon/radeon_display.c | ||
896 | +++ b/drivers/gpu/drm/radeon/radeon_display.c | ||
897 | @@ -1333,6 +1333,7 @@ radeon_user_framebuffer_create(struct drm_device *dev, | ||
898 | /* Handle is imported dma-buf, so cannot be migrated to VRAM for scanout */ | ||
899 | if (obj->import_attach) { | ||
900 | DRM_DEBUG_KMS("Cannot create framebuffer from imported dma_buf\n"); | ||
901 | + drm_gem_object_put(obj); | ||
902 | return ERR_PTR(-EINVAL); | ||
903 | } | ||
904 | |||
905 | diff --git a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | ||
906 | index ecb59dc6c8b8b..8dc91c2d916a8 100644 | ||
907 | --- a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | ||
908 | +++ b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | ||
909 | @@ -231,7 +231,6 @@ struct dw_mipi_dsi_rockchip { | ||
910 | struct dw_mipi_dsi *dmd; | ||
911 | const struct rockchip_dw_dsi_chip_data *cdata; | ||
912 | struct dw_mipi_dsi_plat_data pdata; | ||
913 | - int devcnt; | ||
914 | }; | ||
915 | |||
916 | struct dphy_pll_parameter_map { | ||
917 | @@ -1001,9 +1000,6 @@ static int dw_mipi_dsi_rockchip_remove(struct platform_device *pdev) | ||
918 | { | ||
919 | struct dw_mipi_dsi_rockchip *dsi = platform_get_drvdata(pdev); | ||
920 | |||
921 | - if (dsi->devcnt == 0) | ||
922 | - component_del(dsi->dev, &dw_mipi_dsi_rockchip_ops); | ||
923 | - | ||
924 | dw_mipi_dsi_remove(dsi->dmd); | ||
925 | |||
926 | return 0; | ||
927 | diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c | ||
928 | index 1a5153197fe97..57f9baad9e36f 100644 | ||
929 | --- a/drivers/gpu/drm/scheduler/sched_entity.c | ||
930 | +++ b/drivers/gpu/drm/scheduler/sched_entity.c | ||
931 | @@ -235,11 +235,16 @@ static void drm_sched_entity_kill_jobs_cb(struct dma_fence *f, | ||
932 | static void drm_sched_entity_kill_jobs(struct drm_sched_entity *entity) | ||
933 | { | ||
934 | struct drm_sched_job *job; | ||
935 | + struct dma_fence *f; | ||
936 | int r; | ||
937 | |||
938 | while ((job = to_drm_sched_job(spsc_queue_pop(&entity->job_queue)))) { | ||
939 | struct drm_sched_fence *s_fence = job->s_fence; | ||
940 | |||
941 | + /* Wait for all dependencies to avoid data corruptions */ | ||
942 | + while ((f = job->sched->ops->dependency(job, entity))) | ||
943 | + dma_fence_wait(f, false); | ||
944 | + | ||
945 | drm_sched_fence_scheduled(s_fence); | ||
946 | dma_fence_set_error(&s_fence->finished, -ESRCH); | ||
947 | |||
948 | diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c | ||
949 | index 617cbe468aec4..c410221824c1b 100644 | ||
950 | --- a/drivers/gpu/drm/tegra/dc.c | ||
951 | +++ b/drivers/gpu/drm/tegra/dc.c | ||
952 | @@ -919,6 +919,11 @@ static const struct drm_plane_helper_funcs tegra_cursor_plane_helper_funcs = { | ||
953 | .atomic_disable = tegra_cursor_atomic_disable, | ||
954 | }; | ||
955 | |||
956 | +static const uint64_t linear_modifiers[] = { | ||
957 | + DRM_FORMAT_MOD_LINEAR, | ||
958 | + DRM_FORMAT_MOD_INVALID | ||
959 | +}; | ||
960 | + | ||
961 | static struct drm_plane *tegra_dc_cursor_plane_create(struct drm_device *drm, | ||
962 | struct tegra_dc *dc) | ||
963 | { | ||
964 | @@ -947,7 +952,7 @@ static struct drm_plane *tegra_dc_cursor_plane_create(struct drm_device *drm, | ||
965 | |||
966 | err = drm_universal_plane_init(drm, &plane->base, possible_crtcs, | ||
967 | &tegra_plane_funcs, formats, | ||
968 | - num_formats, NULL, | ||
969 | + num_formats, linear_modifiers, | ||
970 | DRM_PLANE_TYPE_CURSOR, NULL); | ||
971 | if (err < 0) { | ||
972 | kfree(plane); | ||
973 | @@ -1065,7 +1070,8 @@ static struct drm_plane *tegra_dc_overlay_plane_create(struct drm_device *drm, | ||
974 | |||
975 | err = drm_universal_plane_init(drm, &plane->base, possible_crtcs, | ||
976 | &tegra_plane_funcs, formats, | ||
977 | - num_formats, NULL, type, NULL); | ||
978 | + num_formats, linear_modifiers, | ||
979 | + type, NULL); | ||
980 | if (err < 0) { | ||
981 | kfree(plane); | ||
982 | return ERR_PTR(err); | ||
983 | diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c | ||
984 | index 6833dfad7241b..c2ab7cfaaf2fb 100644 | ||
985 | --- a/drivers/gpu/drm/tegra/drm.c | ||
986 | +++ b/drivers/gpu/drm/tegra/drm.c | ||
987 | @@ -122,8 +122,6 @@ static int tegra_drm_load(struct drm_device *drm, unsigned long flags) | ||
988 | drm->mode_config.max_width = 4096; | ||
989 | drm->mode_config.max_height = 4096; | ||
990 | |||
991 | - drm->mode_config.allow_fb_modifiers = true; | ||
992 | - | ||
993 | drm->mode_config.normalize_zpos = true; | ||
994 | |||
995 | drm->mode_config.funcs = &tegra_drm_mode_config_funcs; | ||
996 | diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h | ||
997 | index 6627b20c99e9c..3ddaa817850d0 100644 | ||
998 | --- a/drivers/gpu/drm/vc4/vc4_drv.h | ||
999 | +++ b/drivers/gpu/drm/vc4/vc4_drv.h | ||
1000 | @@ -750,7 +750,7 @@ bool vc4_crtc_get_scanoutpos(struct drm_device *dev, unsigned int crtc_id, | ||
1001 | void vc4_crtc_handle_vblank(struct vc4_crtc *crtc); | ||
1002 | void vc4_crtc_txp_armed(struct drm_crtc_state *state); | ||
1003 | void vc4_crtc_get_margins(struct drm_crtc_state *state, | ||
1004 | - unsigned int *right, unsigned int *left, | ||
1005 | + unsigned int *left, unsigned int *right, | ||
1006 | unsigned int *top, unsigned int *bottom); | ||
1007 | |||
1008 | /* vc4_debugfs.c */ | ||
1009 | diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c | ||
1010 | index 6dcc05ab31eba..4f855b242dfdf 100644 | ||
1011 | --- a/drivers/gpu/drm/virtio/virtgpu_kms.c | ||
1012 | +++ b/drivers/gpu/drm/virtio/virtgpu_kms.c | ||
1013 | @@ -218,6 +218,7 @@ err_ttm: | ||
1014 | err_vbufs: | ||
1015 | vgdev->vdev->config->del_vqs(vgdev->vdev); | ||
1016 | err_vqs: | ||
1017 | + dev->dev_private = NULL; | ||
1018 | kfree(vgdev); | ||
1019 | return ret; | ||
1020 | } | ||
1021 | diff --git a/drivers/gpu/drm/zte/Kconfig b/drivers/gpu/drm/zte/Kconfig | ||
1022 | index 90ebaedc11fdf..aa8594190b509 100644 | ||
1023 | --- a/drivers/gpu/drm/zte/Kconfig | ||
1024 | +++ b/drivers/gpu/drm/zte/Kconfig | ||
1025 | @@ -3,7 +3,6 @@ config DRM_ZTE | ||
1026 | tristate "DRM Support for ZTE SoCs" | ||
1027 | depends on DRM && ARCH_ZX | ||
1028 | select DRM_KMS_CMA_HELPER | ||
1029 | - select DRM_KMS_FB_HELPER | ||
1030 | select DRM_KMS_HELPER | ||
1031 | select SND_SOC_HDMI_CODEC if SND_SOC | ||
1032 | select VIDEOMODE_HELPERS | ||
1033 | diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c | ||
1034 | index a5d70d09d2bd1..75dfa1e2f3f2c 100644 | ||
1035 | --- a/drivers/hwtracing/coresight/coresight-tmc-etf.c | ||
1036 | +++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c | ||
1037 | @@ -528,7 +528,7 @@ static unsigned long tmc_update_etf_buffer(struct coresight_device *csdev, | ||
1038 | buf_ptr = buf->data_pages[cur] + offset; | ||
1039 | *buf_ptr = readl_relaxed(drvdata->base + TMC_RRD); | ||
1040 | |||
1041 | - if (lost && *barrier) { | ||
1042 | + if (lost && i < CORESIGHT_BARRIER_PKT_SIZE) { | ||
1043 | *buf_ptr = *barrier; | ||
1044 | barrier++; | ||
1045 | } | ||
1046 | diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c | ||
1047 | index 92428990f0ccc..ec9e9598894f6 100644 | ||
1048 | --- a/drivers/infiniband/core/cma.c | ||
1049 | +++ b/drivers/infiniband/core/cma.c | ||
1050 | @@ -2719,7 +2719,8 @@ static int cma_resolve_ib_route(struct rdma_id_private *id_priv, | ||
1051 | |||
1052 | cma_init_resolve_route_work(work, id_priv); | ||
1053 | |||
1054 | - route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); | ||
1055 | + if (!route->path_rec) | ||
1056 | + route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); | ||
1057 | if (!route->path_rec) { | ||
1058 | ret = -ENOMEM; | ||
1059 | goto err1; | ||
1060 | diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c | ||
1061 | index e7472f0da59d2..3ac08f47a8ce4 100644 | ||
1062 | --- a/drivers/infiniband/hw/cxgb4/qp.c | ||
1063 | +++ b/drivers/infiniband/hw/cxgb4/qp.c | ||
1064 | @@ -295,6 +295,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq, | ||
1065 | if (user && (!wq->sq.bar2_pa || (need_rq && !wq->rq.bar2_pa))) { | ||
1066 | pr_warn("%s: sqid %u or rqid %u not in BAR2 range\n", | ||
1067 | pci_name(rdev->lldi.pdev), wq->sq.qid, wq->rq.qid); | ||
1068 | + ret = -EINVAL; | ||
1069 | goto free_dma; | ||
1070 | } | ||
1071 | |||
1072 | diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c | ||
1073 | index ffbc50341a55a..f885e245699be 100644 | ||
1074 | --- a/drivers/infiniband/sw/rxe/rxe_mr.c | ||
1075 | +++ b/drivers/infiniband/sw/rxe/rxe_mr.c | ||
1076 | @@ -173,7 +173,7 @@ int rxe_mem_init_user(struct rxe_pd *pd, u64 start, | ||
1077 | if (IS_ERR(umem)) { | ||
1078 | pr_warn("err %d from rxe_umem_get\n", | ||
1079 | (int)PTR_ERR(umem)); | ||
1080 | - err = -EINVAL; | ||
1081 | + err = PTR_ERR(umem); | ||
1082 | goto err1; | ||
1083 | } | ||
1084 | |||
1085 | diff --git a/drivers/ipack/carriers/tpci200.c b/drivers/ipack/carriers/tpci200.c | ||
1086 | index fdcf2bcae164e..b05d6125c787a 100644 | ||
1087 | --- a/drivers/ipack/carriers/tpci200.c | ||
1088 | +++ b/drivers/ipack/carriers/tpci200.c | ||
1089 | @@ -596,8 +596,11 @@ static int tpci200_pci_probe(struct pci_dev *pdev, | ||
1090 | |||
1091 | out_err_bus_register: | ||
1092 | tpci200_uninstall(tpci200); | ||
1093 | + /* tpci200->info->cfg_regs is unmapped in tpci200_uninstall */ | ||
1094 | + tpci200->info->cfg_regs = NULL; | ||
1095 | out_err_install: | ||
1096 | - iounmap(tpci200->info->cfg_regs); | ||
1097 | + if (tpci200->info->cfg_regs) | ||
1098 | + iounmap(tpci200->info->cfg_regs); | ||
1099 | out_err_ioremap: | ||
1100 | pci_release_region(pdev, TPCI200_CFG_MEM_BAR); | ||
1101 | out_err_pci_request: | ||
1102 | diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c | ||
1103 | index 2330a7d242679..a2b2ce1dfec81 100644 | ||
1104 | --- a/drivers/isdn/hardware/mISDN/hfcpci.c | ||
1105 | +++ b/drivers/isdn/hardware/mISDN/hfcpci.c | ||
1106 | @@ -2341,7 +2341,7 @@ static void __exit | ||
1107 | HFC_cleanup(void) | ||
1108 | { | ||
1109 | if (timer_pending(&hfc_tl)) | ||
1110 | - del_timer(&hfc_tl); | ||
1111 | + del_timer_sync(&hfc_tl); | ||
1112 | |||
1113 | pci_unregister_driver(&hfc_driver); | ||
1114 | } | ||
1115 | diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c | ||
1116 | index eff04fa23dfad..9e4d1212f4c16 100644 | ||
1117 | --- a/drivers/md/persistent-data/dm-btree-remove.c | ||
1118 | +++ b/drivers/md/persistent-data/dm-btree-remove.c | ||
1119 | @@ -549,7 +549,8 @@ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root, | ||
1120 | delete_at(n, index); | ||
1121 | } | ||
1122 | |||
1123 | - *new_root = shadow_root(&spine); | ||
1124 | + if (!r) | ||
1125 | + *new_root = shadow_root(&spine); | ||
1126 | exit_shadow_spine(&spine); | ||
1127 | |||
1128 | return r; | ||
1129 | diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c | ||
1130 | index bf4c5e2ccb6ff..e0acae7a3815d 100644 | ||
1131 | --- a/drivers/md/persistent-data/dm-space-map-disk.c | ||
1132 | +++ b/drivers/md/persistent-data/dm-space-map-disk.c | ||
1133 | @@ -171,6 +171,14 @@ static int sm_disk_new_block(struct dm_space_map *sm, dm_block_t *b) | ||
1134 | * Any block we allocate has to be free in both the old and current ll. | ||
1135 | */ | ||
1136 | r = sm_ll_find_common_free_block(&smd->old_ll, &smd->ll, smd->begin, smd->ll.nr_blocks, b); | ||
1137 | + if (r == -ENOSPC) { | ||
1138 | + /* | ||
1139 | + * There's no free block between smd->begin and the end of the metadata device. | ||
1140 | + * We search before smd->begin in case something has been freed. | ||
1141 | + */ | ||
1142 | + r = sm_ll_find_common_free_block(&smd->old_ll, &smd->ll, 0, smd->begin, b); | ||
1143 | + } | ||
1144 | + | ||
1145 | if (r) | ||
1146 | return r; | ||
1147 | |||
1148 | @@ -199,7 +207,6 @@ static int sm_disk_commit(struct dm_space_map *sm) | ||
1149 | return r; | ||
1150 | |||
1151 | memcpy(&smd->old_ll, &smd->ll, sizeof(smd->old_ll)); | ||
1152 | - smd->begin = 0; | ||
1153 | smd->nr_allocated_this_transaction = 0; | ||
1154 | |||
1155 | r = sm_disk_get_nr_free(sm, &nr_free); | ||
1156 | diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c | ||
1157 | index 9e3c64ec2026f..da439ac857963 100644 | ||
1158 | --- a/drivers/md/persistent-data/dm-space-map-metadata.c | ||
1159 | +++ b/drivers/md/persistent-data/dm-space-map-metadata.c | ||
1160 | @@ -452,6 +452,14 @@ static int sm_metadata_new_block_(struct dm_space_map *sm, dm_block_t *b) | ||
1161 | * Any block we allocate has to be free in both the old and current ll. | ||
1162 | */ | ||
1163 | r = sm_ll_find_common_free_block(&smm->old_ll, &smm->ll, smm->begin, smm->ll.nr_blocks, b); | ||
1164 | + if (r == -ENOSPC) { | ||
1165 | + /* | ||
1166 | + * There's no free block between smm->begin and the end of the metadata device. | ||
1167 | + * We search before smm->begin in case something has been freed. | ||
1168 | + */ | ||
1169 | + r = sm_ll_find_common_free_block(&smm->old_ll, &smm->ll, 0, smm->begin, b); | ||
1170 | + } | ||
1171 | + | ||
1172 | if (r) | ||
1173 | return r; | ||
1174 | |||
1175 | @@ -503,7 +511,6 @@ static int sm_metadata_commit(struct dm_space_map *sm) | ||
1176 | return r; | ||
1177 | |||
1178 | memcpy(&smm->old_ll, &smm->ll, sizeof(smm->old_ll)); | ||
1179 | - smm->begin = 0; | ||
1180 | smm->allocated_this_transaction = 0; | ||
1181 | |||
1182 | return 0; | ||
1183 | diff --git a/drivers/media/i2c/saa6588.c b/drivers/media/i2c/saa6588.c | ||
1184 | index ecb491d5f2ab8..d1e0716bdfffd 100644 | ||
1185 | --- a/drivers/media/i2c/saa6588.c | ||
1186 | +++ b/drivers/media/i2c/saa6588.c | ||
1187 | @@ -380,7 +380,7 @@ static void saa6588_configure(struct saa6588 *s) | ||
1188 | |||
1189 | /* ---------------------------------------------------------------------- */ | ||
1190 | |||
1191 | -static long saa6588_ioctl(struct v4l2_subdev *sd, unsigned int cmd, void *arg) | ||
1192 | +static long saa6588_command(struct v4l2_subdev *sd, unsigned int cmd, void *arg) | ||
1193 | { | ||
1194 | struct saa6588 *s = to_saa6588(sd); | ||
1195 | struct saa6588_command *a = arg; | ||
1196 | @@ -433,7 +433,7 @@ static int saa6588_s_tuner(struct v4l2_subdev *sd, const struct v4l2_tuner *vt) | ||
1197 | /* ----------------------------------------------------------------------- */ | ||
1198 | |||
1199 | static const struct v4l2_subdev_core_ops saa6588_core_ops = { | ||
1200 | - .ioctl = saa6588_ioctl, | ||
1201 | + .command = saa6588_command, | ||
1202 | }; | ||
1203 | |||
1204 | static const struct v4l2_subdev_tuner_ops saa6588_tuner_ops = { | ||
1205 | diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c | ||
1206 | index ff2962cea6164..570530d976d21 100644 | ||
1207 | --- a/drivers/media/pci/bt8xx/bttv-driver.c | ||
1208 | +++ b/drivers/media/pci/bt8xx/bttv-driver.c | ||
1209 | @@ -3187,7 +3187,7 @@ static int radio_release(struct file *file) | ||
1210 | |||
1211 | btv->radio_user--; | ||
1212 | |||
1213 | - bttv_call_all(btv, core, ioctl, SAA6588_CMD_CLOSE, &cmd); | ||
1214 | + bttv_call_all(btv, core, command, SAA6588_CMD_CLOSE, &cmd); | ||
1215 | |||
1216 | if (btv->radio_user == 0) | ||
1217 | btv->has_radio_tuner = 0; | ||
1218 | @@ -3268,7 +3268,7 @@ static ssize_t radio_read(struct file *file, char __user *data, | ||
1219 | cmd.result = -ENODEV; | ||
1220 | radio_enable(btv); | ||
1221 | |||
1222 | - bttv_call_all(btv, core, ioctl, SAA6588_CMD_READ, &cmd); | ||
1223 | + bttv_call_all(btv, core, command, SAA6588_CMD_READ, &cmd); | ||
1224 | |||
1225 | return cmd.result; | ||
1226 | } | ||
1227 | @@ -3289,7 +3289,7 @@ static __poll_t radio_poll(struct file *file, poll_table *wait) | ||
1228 | cmd.instance = file; | ||
1229 | cmd.event_list = wait; | ||
1230 | cmd.poll_mask = res; | ||
1231 | - bttv_call_all(btv, core, ioctl, SAA6588_CMD_POLL, &cmd); | ||
1232 | + bttv_call_all(btv, core, command, SAA6588_CMD_POLL, &cmd); | ||
1233 | |||
1234 | return cmd.poll_mask; | ||
1235 | } | ||
1236 | diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c | ||
1237 | index 342cabf480646..e454a288229b8 100644 | ||
1238 | --- a/drivers/media/pci/saa7134/saa7134-video.c | ||
1239 | +++ b/drivers/media/pci/saa7134/saa7134-video.c | ||
1240 | @@ -1179,7 +1179,7 @@ static int video_release(struct file *file) | ||
1241 | |||
1242 | saa_call_all(dev, tuner, standby); | ||
1243 | if (vdev->vfl_type == VFL_TYPE_RADIO) | ||
1244 | - saa_call_all(dev, core, ioctl, SAA6588_CMD_CLOSE, &cmd); | ||
1245 | + saa_call_all(dev, core, command, SAA6588_CMD_CLOSE, &cmd); | ||
1246 | mutex_unlock(&dev->lock); | ||
1247 | |||
1248 | return 0; | ||
1249 | @@ -1198,7 +1198,7 @@ static ssize_t radio_read(struct file *file, char __user *data, | ||
1250 | cmd.result = -ENODEV; | ||
1251 | |||
1252 | mutex_lock(&dev->lock); | ||
1253 | - saa_call_all(dev, core, ioctl, SAA6588_CMD_READ, &cmd); | ||
1254 | + saa_call_all(dev, core, command, SAA6588_CMD_READ, &cmd); | ||
1255 | mutex_unlock(&dev->lock); | ||
1256 | |||
1257 | return cmd.result; | ||
1258 | @@ -1214,7 +1214,7 @@ static __poll_t radio_poll(struct file *file, poll_table *wait) | ||
1259 | cmd.event_list = wait; | ||
1260 | cmd.poll_mask = 0; | ||
1261 | mutex_lock(&dev->lock); | ||
1262 | - saa_call_all(dev, core, ioctl, SAA6588_CMD_POLL, &cmd); | ||
1263 | + saa_call_all(dev, core, command, SAA6588_CMD_POLL, &cmd); | ||
1264 | mutex_unlock(&dev->lock); | ||
1265 | |||
1266 | return rc | cmd.poll_mask; | ||
1267 | diff --git a/drivers/media/platform/davinci/vpbe_display.c b/drivers/media/platform/davinci/vpbe_display.c | ||
1268 | index ae419958e4204..7fbd22d588efb 100644 | ||
1269 | --- a/drivers/media/platform/davinci/vpbe_display.c | ||
1270 | +++ b/drivers/media/platform/davinci/vpbe_display.c | ||
1271 | @@ -48,7 +48,7 @@ static int venc_is_second_field(struct vpbe_display *disp_dev) | ||
1272 | |||
1273 | ret = v4l2_subdev_call(vpbe_dev->venc, | ||
1274 | core, | ||
1275 | - ioctl, | ||
1276 | + command, | ||
1277 | VENC_GET_FLD, | ||
1278 | &val); | ||
1279 | if (ret < 0) { | ||
1280 | diff --git a/drivers/media/platform/davinci/vpbe_venc.c b/drivers/media/platform/davinci/vpbe_venc.c | ||
1281 | index 8caa084e57046..bde241c26d795 100644 | ||
1282 | --- a/drivers/media/platform/davinci/vpbe_venc.c | ||
1283 | +++ b/drivers/media/platform/davinci/vpbe_venc.c | ||
1284 | @@ -521,9 +521,7 @@ static int venc_s_routing(struct v4l2_subdev *sd, u32 input, u32 output, | ||
1285 | return ret; | ||
1286 | } | ||
1287 | |||
1288 | -static long venc_ioctl(struct v4l2_subdev *sd, | ||
1289 | - unsigned int cmd, | ||
1290 | - void *arg) | ||
1291 | +static long venc_command(struct v4l2_subdev *sd, unsigned int cmd, void *arg) | ||
1292 | { | ||
1293 | u32 val; | ||
1294 | |||
1295 | @@ -542,7 +540,7 @@ static long venc_ioctl(struct v4l2_subdev *sd, | ||
1296 | } | ||
1297 | |||
1298 | static const struct v4l2_subdev_core_ops venc_core_ops = { | ||
1299 | - .ioctl = venc_ioctl, | ||
1300 | + .command = venc_command, | ||
1301 | }; | ||
1302 | |||
1303 | static const struct v4l2_subdev_video_ops venc_video_ops = { | ||
1304 | diff --git a/drivers/media/rc/bpf-lirc.c b/drivers/media/rc/bpf-lirc.c | ||
1305 | index 0a0ce620e4a29..d5f839fdcde7d 100644 | ||
1306 | --- a/drivers/media/rc/bpf-lirc.c | ||
1307 | +++ b/drivers/media/rc/bpf-lirc.c | ||
1308 | @@ -329,7 +329,8 @@ int lirc_prog_query(const union bpf_attr *attr, union bpf_attr __user *uattr) | ||
1309 | } | ||
1310 | |||
1311 | if (attr->query.prog_cnt != 0 && prog_ids && cnt) | ||
1312 | - ret = bpf_prog_array_copy_to_user(progs, prog_ids, cnt); | ||
1313 | + ret = bpf_prog_array_copy_to_user(progs, prog_ids, | ||
1314 | + attr->query.prog_cnt); | ||
1315 | |||
1316 | unlock: | ||
1317 | mutex_unlock(&ir_raw_handler_lock); | ||
1318 | diff --git a/drivers/media/usb/dvb-usb/dtv5100.c b/drivers/media/usb/dvb-usb/dtv5100.c | ||
1319 | index fba06932a9e0e..1c13e493322cc 100644 | ||
1320 | --- a/drivers/media/usb/dvb-usb/dtv5100.c | ||
1321 | +++ b/drivers/media/usb/dvb-usb/dtv5100.c | ||
1322 | @@ -26,6 +26,7 @@ static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr, | ||
1323 | u8 *wbuf, u16 wlen, u8 *rbuf, u16 rlen) | ||
1324 | { | ||
1325 | struct dtv5100_state *st = d->priv; | ||
1326 | + unsigned int pipe; | ||
1327 | u8 request; | ||
1328 | u8 type; | ||
1329 | u16 value; | ||
1330 | @@ -34,6 +35,7 @@ static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr, | ||
1331 | switch (wlen) { | ||
1332 | case 1: | ||
1333 | /* write { reg }, read { value } */ | ||
1334 | + pipe = usb_rcvctrlpipe(d->udev, 0); | ||
1335 | request = (addr == DTV5100_DEMOD_ADDR ? DTV5100_DEMOD_READ : | ||
1336 | DTV5100_TUNER_READ); | ||
1337 | type = USB_TYPE_VENDOR | USB_DIR_IN; | ||
1338 | @@ -41,6 +43,7 @@ static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr, | ||
1339 | break; | ||
1340 | case 2: | ||
1341 | /* write { reg, value } */ | ||
1342 | + pipe = usb_sndctrlpipe(d->udev, 0); | ||
1343 | request = (addr == DTV5100_DEMOD_ADDR ? DTV5100_DEMOD_WRITE : | ||
1344 | DTV5100_TUNER_WRITE); | ||
1345 | type = USB_TYPE_VENDOR | USB_DIR_OUT; | ||
1346 | @@ -54,7 +57,7 @@ static int dtv5100_i2c_msg(struct dvb_usb_device *d, u8 addr, | ||
1347 | |||
1348 | memcpy(st->data, rbuf, rlen); | ||
1349 | msleep(1); /* avoid I2C errors */ | ||
1350 | - return usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), request, | ||
1351 | + return usb_control_msg(d->udev, pipe, request, | ||
1352 | type, value, index, st->data, rlen, | ||
1353 | DTV5100_USB_TIMEOUT); | ||
1354 | } | ||
1355 | @@ -141,7 +144,7 @@ static int dtv5100_probe(struct usb_interface *intf, | ||
1356 | |||
1357 | /* initialize non qt1010/zl10353 part? */ | ||
1358 | for (i = 0; dtv5100_init[i].request; i++) { | ||
1359 | - ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), | ||
1360 | + ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), | ||
1361 | dtv5100_init[i].request, | ||
1362 | USB_TYPE_VENDOR | USB_DIR_OUT, | ||
1363 | dtv5100_init[i].value, | ||
1364 | diff --git a/drivers/media/usb/gspca/sq905.c b/drivers/media/usb/gspca/sq905.c | ||
1365 | index 65a74060986a7..ffb0299fea22f 100644 | ||
1366 | --- a/drivers/media/usb/gspca/sq905.c | ||
1367 | +++ b/drivers/media/usb/gspca/sq905.c | ||
1368 | @@ -116,7 +116,7 @@ static int sq905_command(struct gspca_dev *gspca_dev, u16 index) | ||
1369 | } | ||
1370 | |||
1371 | ret = usb_control_msg(gspca_dev->dev, | ||
1372 | - usb_sndctrlpipe(gspca_dev->dev, 0), | ||
1373 | + usb_rcvctrlpipe(gspca_dev->dev, 0), | ||
1374 | USB_REQ_SYNCH_FRAME, /* request */ | ||
1375 | USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, | ||
1376 | SQ905_PING, 0, gspca_dev->usb_buf, 1, | ||
1377 | diff --git a/drivers/media/usb/gspca/sunplus.c b/drivers/media/usb/gspca/sunplus.c | ||
1378 | index f4a4222f0d2e4..bfac15d6c9583 100644 | ||
1379 | --- a/drivers/media/usb/gspca/sunplus.c | ||
1380 | +++ b/drivers/media/usb/gspca/sunplus.c | ||
1381 | @@ -242,6 +242,10 @@ static void reg_r(struct gspca_dev *gspca_dev, | ||
1382 | gspca_err(gspca_dev, "reg_r: buffer overflow\n"); | ||
1383 | return; | ||
1384 | } | ||
1385 | + if (len == 0) { | ||
1386 | + gspca_err(gspca_dev, "reg_r: zero-length read\n"); | ||
1387 | + return; | ||
1388 | + } | ||
1389 | if (gspca_dev->usb_err < 0) | ||
1390 | return; | ||
1391 | ret = usb_control_msg(gspca_dev->dev, | ||
1392 | @@ -250,7 +254,7 @@ static void reg_r(struct gspca_dev *gspca_dev, | ||
1393 | USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, | ||
1394 | 0, /* value */ | ||
1395 | index, | ||
1396 | - len ? gspca_dev->usb_buf : NULL, len, | ||
1397 | + gspca_dev->usb_buf, len, | ||
1398 | 500); | ||
1399 | if (ret < 0) { | ||
1400 | pr_err("reg_r err %d\n", ret); | ||
1401 | @@ -727,7 +731,7 @@ static int sd_start(struct gspca_dev *gspca_dev) | ||
1402 | case MegaImageVI: | ||
1403 | reg_w_riv(gspca_dev, 0xf0, 0, 0); | ||
1404 | spca504B_WaitCmdStatus(gspca_dev); | ||
1405 | - reg_r(gspca_dev, 0xf0, 4, 0); | ||
1406 | + reg_w_riv(gspca_dev, 0xf0, 4, 0); | ||
1407 | spca504B_WaitCmdStatus(gspca_dev); | ||
1408 | break; | ||
1409 | default: | ||
1410 | diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c | ||
1411 | index 8fa77a81dd7f2..5d095b2a03464 100644 | ||
1412 | --- a/drivers/media/usb/uvc/uvc_video.c | ||
1413 | +++ b/drivers/media/usb/uvc/uvc_video.c | ||
1414 | @@ -124,10 +124,37 @@ int uvc_query_ctrl(struct uvc_device *dev, u8 query, u8 unit, | ||
1415 | static void uvc_fixup_video_ctrl(struct uvc_streaming *stream, | ||
1416 | struct uvc_streaming_control *ctrl) | ||
1417 | { | ||
1418 | + static const struct usb_device_id elgato_cam_link_4k = { | ||
1419 | + USB_DEVICE(0x0fd9, 0x0066) | ||
1420 | + }; | ||
1421 | struct uvc_format *format = NULL; | ||
1422 | struct uvc_frame *frame = NULL; | ||
1423 | unsigned int i; | ||
1424 | |||
1425 | + /* | ||
1426 | + * The response of the Elgato Cam Link 4K is incorrect: The second byte | ||
1427 | + * contains bFormatIndex (instead of being the second byte of bmHint). | ||
1428 | + * The first byte is always zero. The third byte is always 1. | ||
1429 | + * | ||
1430 | + * The UVC 1.5 class specification defines the first five bits in the | ||
1431 | + * bmHint bitfield. The remaining bits are reserved and should be zero. | ||
1432 | + * Therefore a valid bmHint will be less than 32. | ||
1433 | + * | ||
1434 | + * Latest Elgato Cam Link 4K firmware as of 2021-03-23 needs this fix. | ||
1435 | + * MCU: 20.02.19, FPGA: 67 | ||
1436 | + */ | ||
1437 | + if (usb_match_one_id(stream->dev->intf, &elgato_cam_link_4k) && | ||
1438 | + ctrl->bmHint > 255) { | ||
1439 | + u8 corrected_format_index = ctrl->bmHint >> 8; | ||
1440 | + | ||
1441 | + /* uvc_dbg(stream->dev, VIDEO, | ||
1442 | + "Correct USB video probe response from {bmHint: 0x%04x, bFormatIndex: %u} to {bmHint: 0x%04x, bFormatIndex: %u}\n", | ||
1443 | + ctrl->bmHint, ctrl->bFormatIndex, | ||
1444 | + 1, corrected_format_index); */ | ||
1445 | + ctrl->bmHint = 1; | ||
1446 | + ctrl->bFormatIndex = corrected_format_index; | ||
1447 | + } | ||
1448 | + | ||
1449 | for (i = 0; i < stream->nformats; ++i) { | ||
1450 | if (stream->format[i].index == ctrl->bFormatIndex) { | ||
1451 | format = &stream->format[i]; | ||
1452 | diff --git a/drivers/media/usb/zr364xx/zr364xx.c b/drivers/media/usb/zr364xx/zr364xx.c | ||
1453 | index 637962825d7a8..02458c9cb5dc0 100644 | ||
1454 | --- a/drivers/media/usb/zr364xx/zr364xx.c | ||
1455 | +++ b/drivers/media/usb/zr364xx/zr364xx.c | ||
1456 | @@ -1037,6 +1037,7 @@ static int zr364xx_start_readpipe(struct zr364xx_camera *cam) | ||
1457 | DBG("submitting URB %p\n", pipe_info->stream_urb); | ||
1458 | retval = usb_submit_urb(pipe_info->stream_urb, GFP_KERNEL); | ||
1459 | if (retval) { | ||
1460 | + usb_free_urb(pipe_info->stream_urb); | ||
1461 | printk(KERN_ERR KBUILD_MODNAME ": start read pipe failed\n"); | ||
1462 | return retval; | ||
1463 | } | ||
1464 | diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c | ||
1465 | index 460a456bcdd20..8f94c25395080 100644 | ||
1466 | --- a/drivers/mmc/core/core.c | ||
1467 | +++ b/drivers/mmc/core/core.c | ||
1468 | @@ -953,11 +953,14 @@ int mmc_execute_tuning(struct mmc_card *card) | ||
1469 | |||
1470 | err = host->ops->execute_tuning(host, opcode); | ||
1471 | |||
1472 | - if (err) | ||
1473 | + if (err) { | ||
1474 | pr_err("%s: tuning execution failed: %d\n", | ||
1475 | mmc_hostname(host), err); | ||
1476 | - else | ||
1477 | + } else { | ||
1478 | + host->retune_now = 0; | ||
1479 | + host->need_retune = 0; | ||
1480 | mmc_retune_enable(host); | ||
1481 | + } | ||
1482 | |||
1483 | return err; | ||
1484 | } | ||
1485 | diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c | ||
1486 | index 4f7c08e68f8cb..c6d7a0adde0db 100644 | ||
1487 | --- a/drivers/mmc/core/sd.c | ||
1488 | +++ b/drivers/mmc/core/sd.c | ||
1489 | @@ -793,11 +793,13 @@ try_again: | ||
1490 | return err; | ||
1491 | |||
1492 | /* | ||
1493 | - * In case CCS and S18A in the response is set, start Signal Voltage | ||
1494 | - * Switch procedure. SPI mode doesn't support CMD11. | ||
1495 | + * In case the S18A bit is set in the response, let's start the signal | ||
1496 | + * voltage switch procedure. SPI mode doesn't support CMD11. | ||
1497 | + * Note that, according to the spec, the S18A bit is not valid unless | ||
1498 | + * the CCS bit is set as well. We deliberately deviate from the spec in | ||
1499 | + * regards to this, which allows UHS-I to be supported for SDSC cards. | ||
1500 | */ | ||
1501 | - if (!mmc_host_is_spi(host) && rocr && | ||
1502 | - ((*rocr & 0x41000000) == 0x41000000)) { | ||
1503 | + if (!mmc_host_is_spi(host) && rocr && (*rocr & 0x01000000)) { | ||
1504 | err = mmc_set_uhs_voltage(host, pocr); | ||
1505 | if (err == -EAGAIN) { | ||
1506 | retries--; | ||
1507 | diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c | ||
1508 | index 92709232529a6..2ecd9acebb2f0 100644 | ||
1509 | --- a/drivers/mmc/host/sdhci.c | ||
1510 | +++ b/drivers/mmc/host/sdhci.c | ||
1511 | @@ -1511,6 +1511,10 @@ static u16 sdhci_get_preset_value(struct sdhci_host *host) | ||
1512 | u16 preset = 0; | ||
1513 | |||
1514 | switch (host->timing) { | ||
1515 | + case MMC_TIMING_MMC_HS: | ||
1516 | + case MMC_TIMING_SD_HS: | ||
1517 | + preset = sdhci_readw(host, SDHCI_PRESET_FOR_HIGH_SPEED); | ||
1518 | + break; | ||
1519 | case MMC_TIMING_UHS_SDR12: | ||
1520 | preset = sdhci_readw(host, SDHCI_PRESET_FOR_SDR12); | ||
1521 | break; | ||
1522 | diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h | ||
1523 | index 76e69288632db..96a0a8f97f559 100644 | ||
1524 | --- a/drivers/mmc/host/sdhci.h | ||
1525 | +++ b/drivers/mmc/host/sdhci.h | ||
1526 | @@ -261,6 +261,7 @@ | ||
1527 | |||
1528 | /* 60-FB reserved */ | ||
1529 | |||
1530 | +#define SDHCI_PRESET_FOR_HIGH_SPEED 0x64 | ||
1531 | #define SDHCI_PRESET_FOR_SDR12 0x66 | ||
1532 | #define SDHCI_PRESET_FOR_SDR25 0x68 | ||
1533 | #define SDHCI_PRESET_FOR_SDR50 0x6A | ||
1534 | diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c | ||
1535 | index dbe18cdf6c1b8..ce569b7d3b353 100644 | ||
1536 | --- a/drivers/net/ethernet/broadcom/genet/bcmmii.c | ||
1537 | +++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c | ||
1538 | @@ -426,6 +426,10 @@ static int bcmgenet_mii_register(struct bcmgenet_priv *priv) | ||
1539 | int id, ret; | ||
1540 | |||
1541 | pres = platform_get_resource(pdev, IORESOURCE_MEM, 0); | ||
1542 | + if (!pres) { | ||
1543 | + dev_err(&pdev->dev, "Invalid resource\n"); | ||
1544 | + return -EINVAL; | ||
1545 | + } | ||
1546 | memset(&res, 0, sizeof(res)); | ||
1547 | memset(&ppd, 0, sizeof(ppd)); | ||
1548 | |||
1549 | diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c | ||
1550 | index a65d5a9ba7db3..911b3d2a94e1c 100644 | ||
1551 | --- a/drivers/net/ethernet/intel/e100.c | ||
1552 | +++ b/drivers/net/ethernet/intel/e100.c | ||
1553 | @@ -1398,7 +1398,7 @@ static int e100_phy_check_without_mii(struct nic *nic) | ||
1554 | u8 phy_type; | ||
1555 | int without_mii; | ||
1556 | |||
1557 | - phy_type = (nic->eeprom[eeprom_phy_iface] >> 8) & 0x0f; | ||
1558 | + phy_type = (le16_to_cpu(nic->eeprom[eeprom_phy_iface]) >> 8) & 0x0f; | ||
1559 | |||
1560 | switch (phy_type) { | ||
1561 | case NoSuchPhy: /* Non-MII PHY; UNTESTED! */ | ||
1562 | @@ -1518,7 +1518,7 @@ static int e100_phy_init(struct nic *nic) | ||
1563 | mdio_write(netdev, nic->mii.phy_id, MII_BMCR, bmcr); | ||
1564 | } else if ((nic->mac >= mac_82550_D102) || ((nic->flags & ich) && | ||
1565 | (mdio_read(netdev, nic->mii.phy_id, MII_TPISTATUS) & 0x8000) && | ||
1566 | - (nic->eeprom[eeprom_cnfg_mdix] & eeprom_mdix_enabled))) { | ||
1567 | + (le16_to_cpu(nic->eeprom[eeprom_cnfg_mdix]) & eeprom_mdix_enabled))) { | ||
1568 | /* enable/disable MDI/MDI-X auto-switching. */ | ||
1569 | mdio_write(netdev, nic->mii.phy_id, MII_NCONFIG, | ||
1570 | nic->mii.force_media ? 0 : NCONFIG_AUTO_SWITCH); | ||
1571 | @@ -2266,9 +2266,9 @@ static int e100_asf(struct nic *nic) | ||
1572 | { | ||
1573 | /* ASF can be enabled from eeprom */ | ||
1574 | return (nic->pdev->device >= 0x1050) && (nic->pdev->device <= 0x1057) && | ||
1575 | - (nic->eeprom[eeprom_config_asf] & eeprom_asf) && | ||
1576 | - !(nic->eeprom[eeprom_config_asf] & eeprom_gcl) && | ||
1577 | - ((nic->eeprom[eeprom_smbus_addr] & 0xFF) != 0xFE); | ||
1578 | + (le16_to_cpu(nic->eeprom[eeprom_config_asf]) & eeprom_asf) && | ||
1579 | + !(le16_to_cpu(nic->eeprom[eeprom_config_asf]) & eeprom_gcl) && | ||
1580 | + ((le16_to_cpu(nic->eeprom[eeprom_smbus_addr]) & 0xFF) != 0xFE); | ||
1581 | } | ||
1582 | |||
1583 | static int e100_up(struct nic *nic) | ||
1584 | @@ -2924,7 +2924,7 @@ static int e100_probe(struct pci_dev *pdev, const struct pci_device_id *ent) | ||
1585 | |||
1586 | /* Wol magic packet can be enabled from eeprom */ | ||
1587 | if ((nic->mac >= mac_82558_D101_A4) && | ||
1588 | - (nic->eeprom[eeprom_id] & eeprom_id_wol)) { | ||
1589 | + (le16_to_cpu(nic->eeprom[eeprom_id]) & eeprom_id_wol)) { | ||
1590 | nic->flags |= wol_magic; | ||
1591 | device_set_wakeup_enable(&pdev->dev, true); | ||
1592 | } | ||
1593 | diff --git a/drivers/net/ethernet/intel/ice/ice_type.h b/drivers/net/ethernet/intel/ice/ice_type.h | ||
1594 | index 6667d17a42061..0b2e657b96eb7 100644 | ||
1595 | --- a/drivers/net/ethernet/intel/ice/ice_type.h | ||
1596 | +++ b/drivers/net/ethernet/intel/ice/ice_type.h | ||
1597 | @@ -48,7 +48,7 @@ enum ice_aq_res_ids { | ||
1598 | /* FW update timeout definitions are in milliseconds */ | ||
1599 | #define ICE_NVM_TIMEOUT 180000 | ||
1600 | #define ICE_CHANGE_LOCK_TIMEOUT 1000 | ||
1601 | -#define ICE_GLOBAL_CFG_LOCK_TIMEOUT 3000 | ||
1602 | +#define ICE_GLOBAL_CFG_LOCK_TIMEOUT 5000 | ||
1603 | |||
1604 | enum ice_aq_res_access_type { | ||
1605 | ICE_RES_READ = 1, | ||
1606 | diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c | ||
1607 | index 7a4e2b014dd66..c37f0590b3a4d 100644 | ||
1608 | --- a/drivers/net/ethernet/intel/igb/igb_main.c | ||
1609 | +++ b/drivers/net/ethernet/intel/igb/igb_main.c | ||
1610 | @@ -2651,7 +2651,8 @@ static int igb_parse_cls_flower(struct igb_adapter *adapter, | ||
1611 | } | ||
1612 | |||
1613 | input->filter.match_flags |= IGB_FILTER_FLAG_VLAN_TCI; | ||
1614 | - input->filter.vlan_tci = match.key->vlan_priority; | ||
1615 | + input->filter.vlan_tci = | ||
1616 | + (__force __be16)match.key->vlan_priority; | ||
1617 | } | ||
1618 | } | ||
1619 | |||
1620 | @@ -8255,7 +8256,7 @@ static void igb_process_skb_fields(struct igb_ring *rx_ring, | ||
1621 | |||
1622 | if (igb_test_staterr(rx_desc, E1000_RXDEXT_STATERR_LB) && | ||
1623 | test_bit(IGB_RING_FLAG_RX_LB_VLAN_BSWAP, &rx_ring->flags)) | ||
1624 | - vid = be16_to_cpu(rx_desc->wb.upper.vlan); | ||
1625 | + vid = be16_to_cpu((__force __be16)rx_desc->wb.upper.vlan); | ||
1626 | else | ||
1627 | vid = le16_to_cpu(rx_desc->wb.upper.vlan); | ||
1628 | |||
1629 | diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c | ||
1630 | index 0f2b68f4bb0fe..77cb2ab7dab40 100644 | ||
1631 | --- a/drivers/net/ethernet/intel/igbvf/netdev.c | ||
1632 | +++ b/drivers/net/ethernet/intel/igbvf/netdev.c | ||
1633 | @@ -83,14 +83,14 @@ static int igbvf_desc_unused(struct igbvf_ring *ring) | ||
1634 | static void igbvf_receive_skb(struct igbvf_adapter *adapter, | ||
1635 | struct net_device *netdev, | ||
1636 | struct sk_buff *skb, | ||
1637 | - u32 status, u16 vlan) | ||
1638 | + u32 status, __le16 vlan) | ||
1639 | { | ||
1640 | u16 vid; | ||
1641 | |||
1642 | if (status & E1000_RXD_STAT_VP) { | ||
1643 | if ((adapter->flags & IGBVF_FLAG_RX_LB_VLAN_BSWAP) && | ||
1644 | (status & E1000_RXDEXT_STATERR_LB)) | ||
1645 | - vid = be16_to_cpu(vlan) & E1000_RXD_SPC_VLAN_MASK; | ||
1646 | + vid = be16_to_cpu((__force __be16)vlan) & E1000_RXD_SPC_VLAN_MASK; | ||
1647 | else | ||
1648 | vid = le16_to_cpu(vlan) & E1000_RXD_SPC_VLAN_MASK; | ||
1649 | if (test_bit(vid, adapter->active_vlans)) | ||
1650 | diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | ||
1651 | index 7857ebff92e82..dac0e51e6aafd 100644 | ||
1652 | --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | ||
1653 | +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | ||
1654 | @@ -5740,6 +5740,10 @@ static int mvpp2_probe(struct platform_device *pdev) | ||
1655 | return PTR_ERR(priv->lms_base); | ||
1656 | } else { | ||
1657 | res = platform_get_resource(pdev, IORESOURCE_MEM, 1); | ||
1658 | + if (!res) { | ||
1659 | + dev_err(&pdev->dev, "Invalid resource\n"); | ||
1660 | + return -EINVAL; | ||
1661 | + } | ||
1662 | if (has_acpi_companion(&pdev->dev)) { | ||
1663 | /* In case the MDIO memory region is declared in | ||
1664 | * the ACPI, it can already appear as 'in-use' | ||
1665 | diff --git a/drivers/net/ethernet/micrel/ks8842.c b/drivers/net/ethernet/micrel/ks8842.c | ||
1666 | index da329ca115cc7..fb838e29d52df 100644 | ||
1667 | --- a/drivers/net/ethernet/micrel/ks8842.c | ||
1668 | +++ b/drivers/net/ethernet/micrel/ks8842.c | ||
1669 | @@ -1136,6 +1136,10 @@ static int ks8842_probe(struct platform_device *pdev) | ||
1670 | unsigned i; | ||
1671 | |||
1672 | iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0); | ||
1673 | + if (!iomem) { | ||
1674 | + dev_err(&pdev->dev, "Invalid resource\n"); | ||
1675 | + return -EINVAL; | ||
1676 | + } | ||
1677 | if (!request_mem_region(iomem->start, resource_size(iomem), DRV_NAME)) | ||
1678 | goto err_mem_region; | ||
1679 | |||
1680 | diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c | ||
1681 | index f1269fe4ac721..8ff4c616f0ada 100644 | ||
1682 | --- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c | ||
1683 | +++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c | ||
1684 | @@ -107,7 +107,7 @@ static int pch_ptp_match(struct sk_buff *skb, u16 uid_hi, u32 uid_lo, u16 seqid) | ||
1685 | { | ||
1686 | u8 *data = skb->data; | ||
1687 | unsigned int offset; | ||
1688 | - u16 *hi, *id; | ||
1689 | + u16 hi, id; | ||
1690 | u32 lo; | ||
1691 | |||
1692 | if (ptp_classify_raw(skb) == PTP_CLASS_NONE) | ||
1693 | @@ -118,14 +118,11 @@ static int pch_ptp_match(struct sk_buff *skb, u16 uid_hi, u32 uid_lo, u16 seqid) | ||
1694 | if (skb->len < offset + OFF_PTP_SEQUENCE_ID + sizeof(seqid)) | ||
1695 | return 0; | ||
1696 | |||
1697 | - hi = (u16 *)(data + offset + OFF_PTP_SOURCE_UUID); | ||
1698 | - id = (u16 *)(data + offset + OFF_PTP_SEQUENCE_ID); | ||
1699 | + hi = get_unaligned_be16(data + offset + OFF_PTP_SOURCE_UUID + 0); | ||
1700 | + lo = get_unaligned_be32(data + offset + OFF_PTP_SOURCE_UUID + 2); | ||
1701 | + id = get_unaligned_be16(data + offset + OFF_PTP_SEQUENCE_ID); | ||
1702 | |||
1703 | - memcpy(&lo, &hi[1], sizeof(lo)); | ||
1704 | - | ||
1705 | - return (uid_hi == *hi && | ||
1706 | - uid_lo == lo && | ||
1707 | - seqid == *id); | ||
1708 | + return (uid_hi == hi && uid_lo == lo && seqid == id); | ||
1709 | } | ||
1710 | |||
1711 | static void | ||
1712 | @@ -135,7 +132,6 @@ pch_rx_timestamp(struct pch_gbe_adapter *adapter, struct sk_buff *skb) | ||
1713 | struct pci_dev *pdev; | ||
1714 | u64 ns; | ||
1715 | u32 hi, lo, val; | ||
1716 | - u16 uid, seq; | ||
1717 | |||
1718 | if (!adapter->hwts_rx_en) | ||
1719 | return; | ||
1720 | @@ -151,10 +147,7 @@ pch_rx_timestamp(struct pch_gbe_adapter *adapter, struct sk_buff *skb) | ||
1721 | lo = pch_src_uuid_lo_read(pdev); | ||
1722 | hi = pch_src_uuid_hi_read(pdev); | ||
1723 | |||
1724 | - uid = hi & 0xffff; | ||
1725 | - seq = (hi >> 16) & 0xffff; | ||
1726 | - | ||
1727 | - if (!pch_ptp_match(skb, htons(uid), htonl(lo), htons(seq))) | ||
1728 | + if (!pch_ptp_match(skb, hi, lo, hi >> 16)) | ||
1729 | goto out; | ||
1730 | |||
1731 | ns = pch_rx_snap_read(pdev); | ||
1732 | diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c | ||
1733 | index 661202e854121..5969f64169e53 100644 | ||
1734 | --- a/drivers/net/ethernet/realtek/r8169_main.c | ||
1735 | +++ b/drivers/net/ethernet/realtek/r8169_main.c | ||
1736 | @@ -5190,7 +5190,6 @@ static void rtl_hw_start_8106(struct rtl8169_private *tp) | ||
1737 | RTL_W8(tp, DLLPR, RTL_R8(tp, DLLPR) & ~PFM_EN); | ||
1738 | |||
1739 | rtl_pcie_state_l2l3_disable(tp); | ||
1740 | - rtl_hw_aspm_clkreq_enable(tp, true); | ||
1741 | } | ||
1742 | |||
1743 | DECLARE_RTL_COND(rtl_mac_ocp_e00e_cond) | ||
1744 | diff --git a/drivers/net/ethernet/sfc/ef10_sriov.c b/drivers/net/ethernet/sfc/ef10_sriov.c | ||
1745 | index 52bd43f45761a..e7c6aa29d3232 100644 | ||
1746 | --- a/drivers/net/ethernet/sfc/ef10_sriov.c | ||
1747 | +++ b/drivers/net/ethernet/sfc/ef10_sriov.c | ||
1748 | @@ -403,12 +403,17 @@ fail1: | ||
1749 | return rc; | ||
1750 | } | ||
1751 | |||
1752 | +/* Disable SRIOV and remove VFs | ||
1753 | + * If some VFs are attached to a guest (using Xen, only) nothing is | ||
1754 | + * done if force=false, and vports are freed if force=true (for the non | ||
1755 | + * attachedc ones, only) but SRIOV is not disabled and VFs are not | ||
1756 | + * removed in either case. | ||
1757 | + */ | ||
1758 | static int efx_ef10_pci_sriov_disable(struct efx_nic *efx, bool force) | ||
1759 | { | ||
1760 | struct pci_dev *dev = efx->pci_dev; | ||
1761 | - unsigned int vfs_assigned = 0; | ||
1762 | - | ||
1763 | - vfs_assigned = pci_vfs_assigned(dev); | ||
1764 | + unsigned int vfs_assigned = pci_vfs_assigned(dev); | ||
1765 | + int rc = 0; | ||
1766 | |||
1767 | if (vfs_assigned && !force) { | ||
1768 | netif_info(efx, drv, efx->net_dev, "VFs are assigned to guests; " | ||
1769 | @@ -418,10 +423,12 @@ static int efx_ef10_pci_sriov_disable(struct efx_nic *efx, bool force) | ||
1770 | |||
1771 | if (!vfs_assigned) | ||
1772 | pci_disable_sriov(dev); | ||
1773 | + else | ||
1774 | + rc = -EBUSY; | ||
1775 | |||
1776 | efx_ef10_sriov_free_vf_vswitching(efx); | ||
1777 | efx->vf_count = 0; | ||
1778 | - return 0; | ||
1779 | + return rc; | ||
1780 | } | ||
1781 | |||
1782 | int efx_ef10_sriov_configure(struct efx_nic *efx, int num_vfs) | ||
1783 | @@ -440,7 +447,6 @@ int efx_ef10_sriov_init(struct efx_nic *efx) | ||
1784 | void efx_ef10_sriov_fini(struct efx_nic *efx) | ||
1785 | { | ||
1786 | struct efx_ef10_nic_data *nic_data = efx->nic_data; | ||
1787 | - unsigned int i; | ||
1788 | int rc; | ||
1789 | |||
1790 | if (!nic_data->vf) { | ||
1791 | @@ -450,14 +456,7 @@ void efx_ef10_sriov_fini(struct efx_nic *efx) | ||
1792 | return; | ||
1793 | } | ||
1794 | |||
1795 | - /* Remove any VFs in the host */ | ||
1796 | - for (i = 0; i < efx->vf_count; ++i) { | ||
1797 | - struct efx_nic *vf_efx = nic_data->vf[i].efx; | ||
1798 | - | ||
1799 | - if (vf_efx) | ||
1800 | - vf_efx->pci_dev->driver->remove(vf_efx->pci_dev); | ||
1801 | - } | ||
1802 | - | ||
1803 | + /* Disable SRIOV and remove any VFs in the host */ | ||
1804 | rc = efx_ef10_pci_sriov_disable(efx, true); | ||
1805 | if (rc) | ||
1806 | netif_dbg(efx, drv, efx->net_dev, | ||
1807 | diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c | ||
1808 | index 91a1059517f55..b89b4a3800a4d 100644 | ||
1809 | --- a/drivers/net/fjes/fjes_main.c | ||
1810 | +++ b/drivers/net/fjes/fjes_main.c | ||
1811 | @@ -1262,6 +1262,10 @@ static int fjes_probe(struct platform_device *plat_dev) | ||
1812 | adapter->interrupt_watch_enable = false; | ||
1813 | |||
1814 | res = platform_get_resource(plat_dev, IORESOURCE_MEM, 0); | ||
1815 | + if (!res) { | ||
1816 | + err = -EINVAL; | ||
1817 | + goto err_free_control_wq; | ||
1818 | + } | ||
1819 | hw->hw_res.start = res->start; | ||
1820 | hw->hw_res.size = resource_size(res); | ||
1821 | hw->hw_res.irq = platform_get_irq(plat_dev, 0); | ||
1822 | diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c | ||
1823 | index d8ee001d8e8eb..5cd55f950032a 100644 | ||
1824 | --- a/drivers/net/virtio_net.c | ||
1825 | +++ b/drivers/net/virtio_net.c | ||
1826 | @@ -1548,7 +1548,7 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb) | ||
1827 | if (virtio_net_hdr_from_skb(skb, &hdr->hdr, | ||
1828 | virtio_is_little_endian(vi->vdev), false, | ||
1829 | 0)) | ||
1830 | - BUG(); | ||
1831 | + return -EPROTO; | ||
1832 | |||
1833 | if (vi->mergeable_rx_bufs) | ||
1834 | hdr->num_buffers = 0; | ||
1835 | diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | ||
1836 | index fc6430edd1107..09b1a6beee77c 100644 | ||
1837 | --- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | ||
1838 | +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | ||
1839 | @@ -3725,6 +3725,7 @@ static int iwl_mvm_roc(struct ieee80211_hw *hw, | ||
1840 | struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif); | ||
1841 | struct cfg80211_chan_def chandef; | ||
1842 | struct iwl_mvm_phy_ctxt *phy_ctxt; | ||
1843 | + bool band_change_removal; | ||
1844 | int ret, i; | ||
1845 | |||
1846 | IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value, | ||
1847 | @@ -3794,19 +3795,30 @@ static int iwl_mvm_roc(struct ieee80211_hw *hw, | ||
1848 | cfg80211_chandef_create(&chandef, channel, NL80211_CHAN_NO_HT); | ||
1849 | |||
1850 | /* | ||
1851 | - * Change the PHY context configuration as it is currently referenced | ||
1852 | - * only by the P2P Device MAC | ||
1853 | + * Check if the remain-on-channel is on a different band and that | ||
1854 | + * requires context removal, see iwl_mvm_phy_ctxt_changed(). If | ||
1855 | + * so, we'll need to release and then re-configure here, since we | ||
1856 | + * must not remove a PHY context that's part of a binding. | ||
1857 | */ | ||
1858 | - if (mvmvif->phy_ctxt->ref == 1) { | ||
1859 | + band_change_removal = | ||
1860 | + fw_has_capa(&mvm->fw->ucode_capa, | ||
1861 | + IWL_UCODE_TLV_CAPA_BINDING_CDB_SUPPORT) && | ||
1862 | + mvmvif->phy_ctxt->channel->band != chandef.chan->band; | ||
1863 | + | ||
1864 | + if (mvmvif->phy_ctxt->ref == 1 && !band_change_removal) { | ||
1865 | + /* | ||
1866 | + * Change the PHY context configuration as it is currently | ||
1867 | + * referenced only by the P2P Device MAC (and we can modify it) | ||
1868 | + */ | ||
1869 | ret = iwl_mvm_phy_ctxt_changed(mvm, mvmvif->phy_ctxt, | ||
1870 | &chandef, 1, 1); | ||
1871 | if (ret) | ||
1872 | goto out_unlock; | ||
1873 | } else { | ||
1874 | /* | ||
1875 | - * The PHY context is shared with other MACs. Need to remove the | ||
1876 | - * P2P Device from the binding, allocate an new PHY context and | ||
1877 | - * create a new binding | ||
1878 | + * The PHY context is shared with other MACs (or we're trying to | ||
1879 | + * switch bands), so remove the P2P Device from the binding, | ||
1880 | + * allocate an new PHY context and create a new binding. | ||
1881 | */ | ||
1882 | phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm); | ||
1883 | if (!phy_ctxt) { | ||
1884 | diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c | ||
1885 | index eab159205e48b..f6b43cd87d5de 100644 | ||
1886 | --- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c | ||
1887 | +++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c | ||
1888 | @@ -63,7 +63,6 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans, | ||
1889 | struct iwl_prph_scratch *prph_scratch; | ||
1890 | struct iwl_prph_scratch_ctrl_cfg *prph_sc_ctrl; | ||
1891 | struct iwl_prph_info *prph_info; | ||
1892 | - void *iml_img; | ||
1893 | u32 control_flags = 0; | ||
1894 | int ret; | ||
1895 | int cmdq_size = max_t(u32, IWL_CMD_QUEUE_SIZE, | ||
1896 | @@ -162,14 +161,15 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans, | ||
1897 | trans_pcie->prph_scratch = prph_scratch; | ||
1898 | |||
1899 | /* Allocate IML */ | ||
1900 | - iml_img = dma_alloc_coherent(trans->dev, trans->iml_len, | ||
1901 | - &trans_pcie->iml_dma_addr, GFP_KERNEL); | ||
1902 | - if (!iml_img) { | ||
1903 | + trans_pcie->iml = dma_alloc_coherent(trans->dev, trans->iml_len, | ||
1904 | + &trans_pcie->iml_dma_addr, | ||
1905 | + GFP_KERNEL); | ||
1906 | + if (!trans_pcie->iml) { | ||
1907 | ret = -ENOMEM; | ||
1908 | goto err_free_ctxt_info; | ||
1909 | } | ||
1910 | |||
1911 | - memcpy(iml_img, trans->iml, trans->iml_len); | ||
1912 | + memcpy(trans_pcie->iml, trans->iml, trans->iml_len); | ||
1913 | |||
1914 | iwl_enable_fw_load_int_ctx_info(trans); | ||
1915 | |||
1916 | @@ -242,6 +242,11 @@ void iwl_pcie_ctxt_info_gen3_free(struct iwl_trans *trans) | ||
1917 | trans_pcie->ctxt_info_dma_addr = 0; | ||
1918 | trans_pcie->ctxt_info_gen3 = NULL; | ||
1919 | |||
1920 | + dma_free_coherent(trans->dev, trans->iml_len, trans_pcie->iml, | ||
1921 | + trans_pcie->iml_dma_addr); | ||
1922 | + trans_pcie->iml_dma_addr = 0; | ||
1923 | + trans_pcie->iml = NULL; | ||
1924 | + | ||
1925 | iwl_pcie_ctxt_info_free_fw_img(trans); | ||
1926 | |||
1927 | dma_free_coherent(trans->dev, sizeof(*trans_pcie->prph_scratch), | ||
1928 | diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h | ||
1929 | index 9b5b96e34456f..553164f06a6b7 100644 | ||
1930 | --- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h | ||
1931 | +++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h | ||
1932 | @@ -475,6 +475,8 @@ struct cont_rec { | ||
1933 | * Context information addresses will be taken from here. | ||
1934 | * This is driver's local copy for keeping track of size and | ||
1935 | * count for allocating and freeing the memory. | ||
1936 | + * @iml: image loader image virtual address | ||
1937 | + * @iml_dma_addr: image loader image DMA address | ||
1938 | * @trans: pointer to the generic transport area | ||
1939 | * @scd_base_addr: scheduler sram base address in SRAM | ||
1940 | * @scd_bc_tbls: pointer to the byte count table of the scheduler | ||
1941 | @@ -522,6 +524,7 @@ struct iwl_trans_pcie { | ||
1942 | }; | ||
1943 | struct iwl_prph_info *prph_info; | ||
1944 | struct iwl_prph_scratch *prph_scratch; | ||
1945 | + void *iml; | ||
1946 | dma_addr_t ctxt_info_dma_addr; | ||
1947 | dma_addr_t prph_info_dma_addr; | ||
1948 | dma_addr_t prph_scratch_dma_addr; | ||
1949 | diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c | ||
1950 | index df8455f14e4d8..ee45e475405a1 100644 | ||
1951 | --- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c | ||
1952 | +++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c | ||
1953 | @@ -269,7 +269,8 @@ void iwl_trans_pcie_gen2_fw_alive(struct iwl_trans *trans, u32 scd_addr) | ||
1954 | /* now that we got alive we can free the fw image & the context info. | ||
1955 | * paging memory cannot be freed included since FW will still use it | ||
1956 | */ | ||
1957 | - iwl_pcie_ctxt_info_free(trans); | ||
1958 | + if (trans->trans_cfg->device_family < IWL_DEVICE_FAMILY_AX210) | ||
1959 | + iwl_pcie_ctxt_info_free(trans); | ||
1960 | |||
1961 | /* | ||
1962 | * Re-enable all the interrupts, including the RF-Kill one, now that | ||
1963 | diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c | ||
1964 | index 111e38ff954a2..a6c530b9ceee0 100644 | ||
1965 | --- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c | ||
1966 | +++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c | ||
1967 | @@ -840,22 +840,20 @@ static bool mt7615_fill_txs(struct mt7615_dev *dev, struct mt7615_sta *sta, | ||
1968 | int first_idx = 0, last_idx; | ||
1969 | int i, idx, count; | ||
1970 | bool fixed_rate, ack_timeout; | ||
1971 | - bool probe, ampdu, cck = false; | ||
1972 | + bool ampdu, cck = false; | ||
1973 | bool rs_idx; | ||
1974 | u32 rate_set_tsf; | ||
1975 | u32 final_rate, final_rate_flags, final_nss, txs; | ||
1976 | |||
1977 | - fixed_rate = info->status.rates[0].count; | ||
1978 | - probe = !!(info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE); | ||
1979 | - | ||
1980 | txs = le32_to_cpu(txs_data[1]); | ||
1981 | - ampdu = !fixed_rate && (txs & MT_TXS1_AMPDU); | ||
1982 | + ampdu = txs & MT_TXS1_AMPDU; | ||
1983 | |||
1984 | txs = le32_to_cpu(txs_data[3]); | ||
1985 | count = FIELD_GET(MT_TXS3_TX_COUNT, txs); | ||
1986 | last_idx = FIELD_GET(MT_TXS3_LAST_TX_RATE, txs); | ||
1987 | |||
1988 | txs = le32_to_cpu(txs_data[0]); | ||
1989 | + fixed_rate = txs & MT_TXS0_FIXED_RATE; | ||
1990 | final_rate = FIELD_GET(MT_TXS0_TX_RATE, txs); | ||
1991 | ack_timeout = txs & MT_TXS0_ACK_TIMEOUT; | ||
1992 | |||
1993 | @@ -877,7 +875,7 @@ static bool mt7615_fill_txs(struct mt7615_dev *dev, struct mt7615_sta *sta, | ||
1994 | |||
1995 | first_idx = max_t(int, 0, last_idx - (count + 1) / MT7615_RATE_RETRY); | ||
1996 | |||
1997 | - if (fixed_rate && !probe) { | ||
1998 | + if (fixed_rate) { | ||
1999 | info->status.rates[0].count = count; | ||
2000 | i = 0; | ||
2001 | goto out; | ||
2002 | diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | ||
2003 | index 5e9ce03067de2..6858f7de0915b 100644 | ||
2004 | --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | ||
2005 | +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | ||
2006 | @@ -853,15 +853,10 @@ struct rtl8192eu_efuse { | ||
2007 | u8 usb_optional_function; | ||
2008 | u8 res9[2]; | ||
2009 | u8 mac_addr[ETH_ALEN]; /* 0xd7 */ | ||
2010 | - u8 res10[2]; | ||
2011 | - u8 vendor_name[7]; | ||
2012 | - u8 res11[2]; | ||
2013 | - u8 device_name[0x0b]; /* 0xe8 */ | ||
2014 | - u8 res12[2]; | ||
2015 | - u8 serial[0x0b]; /* 0xf5 */ | ||
2016 | - u8 res13[0x30]; | ||
2017 | + u8 device_info[80]; | ||
2018 | + u8 res11[3]; | ||
2019 | u8 unknown[0x0d]; /* 0x130 */ | ||
2020 | - u8 res14[0xc3]; | ||
2021 | + u8 res12[0xc3]; | ||
2022 | }; | ||
2023 | |||
2024 | struct rtl8xxxu_reg8val { | ||
2025 | diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | ||
2026 | index c747f6a1922d6..02ca80501c3af 100644 | ||
2027 | --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | ||
2028 | +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | ||
2029 | @@ -554,9 +554,43 @@ rtl8192e_set_tx_power(struct rtl8xxxu_priv *priv, int channel, bool ht40) | ||
2030 | } | ||
2031 | } | ||
2032 | |||
2033 | +static void rtl8192eu_log_next_device_info(struct rtl8xxxu_priv *priv, | ||
2034 | + char *record_name, | ||
2035 | + char *device_info, | ||
2036 | + unsigned int *record_offset) | ||
2037 | +{ | ||
2038 | + char *record = device_info + *record_offset; | ||
2039 | + | ||
2040 | + /* A record is [ total length | 0x03 | value ] */ | ||
2041 | + unsigned char l = record[0]; | ||
2042 | + | ||
2043 | + /* | ||
2044 | + * The whole device info section seems to be 80 characters, make sure | ||
2045 | + * we don't read further. | ||
2046 | + */ | ||
2047 | + if (*record_offset + l > 80) { | ||
2048 | + dev_warn(&priv->udev->dev, | ||
2049 | + "invalid record length %d while parsing \"%s\" at offset %u.\n", | ||
2050 | + l, record_name, *record_offset); | ||
2051 | + return; | ||
2052 | + } | ||
2053 | + | ||
2054 | + if (l >= 2) { | ||
2055 | + char value[80]; | ||
2056 | + | ||
2057 | + memcpy(value, &record[2], l - 2); | ||
2058 | + value[l - 2] = '\0'; | ||
2059 | + dev_info(&priv->udev->dev, "%s: %s\n", record_name, value); | ||
2060 | + *record_offset = *record_offset + l; | ||
2061 | + } else { | ||
2062 | + dev_info(&priv->udev->dev, "%s not available.\n", record_name); | ||
2063 | + } | ||
2064 | +} | ||
2065 | + | ||
2066 | static int rtl8192eu_parse_efuse(struct rtl8xxxu_priv *priv) | ||
2067 | { | ||
2068 | struct rtl8192eu_efuse *efuse = &priv->efuse_wifi.efuse8192eu; | ||
2069 | + unsigned int record_offset; | ||
2070 | int i; | ||
2071 | |||
2072 | if (efuse->rtl_id != cpu_to_le16(0x8129)) | ||
2073 | @@ -604,12 +638,25 @@ static int rtl8192eu_parse_efuse(struct rtl8xxxu_priv *priv) | ||
2074 | priv->has_xtalk = 1; | ||
2075 | priv->xtalk = priv->efuse_wifi.efuse8192eu.xtal_k & 0x3f; | ||
2076 | |||
2077 | - dev_info(&priv->udev->dev, "Vendor: %.7s\n", efuse->vendor_name); | ||
2078 | - dev_info(&priv->udev->dev, "Product: %.11s\n", efuse->device_name); | ||
2079 | - if (memchr_inv(efuse->serial, 0xff, 11)) | ||
2080 | - dev_info(&priv->udev->dev, "Serial: %.11s\n", efuse->serial); | ||
2081 | - else | ||
2082 | - dev_info(&priv->udev->dev, "Serial not available.\n"); | ||
2083 | + /* | ||
2084 | + * device_info section seems to be laid out as records | ||
2085 | + * [ total length | 0x03 | value ] so: | ||
2086 | + * - vendor length + 2 | ||
2087 | + * - 0x03 | ||
2088 | + * - vendor string (not null terminated) | ||
2089 | + * - product length + 2 | ||
2090 | + * - 0x03 | ||
2091 | + * - product string (not null terminated) | ||
2092 | + * Then there is one or 2 0x00 on all the 4 devices I own or found | ||
2093 | + * dumped online. | ||
2094 | + * As previous version of the code handled an optional serial | ||
2095 | + * string, I now assume there may be a third record if the | ||
2096 | + * length is not 0. | ||
2097 | + */ | ||
2098 | + record_offset = 0; | ||
2099 | + rtl8192eu_log_next_device_info(priv, "Vendor", efuse->device_info, &record_offset); | ||
2100 | + rtl8192eu_log_next_device_info(priv, "Product", efuse->device_info, &record_offset); | ||
2101 | + rtl8192eu_log_next_device_info(priv, "Serial", efuse->device_info, &record_offset); | ||
2102 | |||
2103 | if (rtl8xxxu_debug & RTL8XXXU_DEBUG_EFUSE) { | ||
2104 | unsigned char *raw = priv->efuse_wifi.raw; | ||
2105 | diff --git a/drivers/net/wireless/st/cw1200/cw1200_sdio.c b/drivers/net/wireless/st/cw1200/cw1200_sdio.c | ||
2106 | index 43e012073dbf7..5ac06d672fc6e 100644 | ||
2107 | --- a/drivers/net/wireless/st/cw1200/cw1200_sdio.c | ||
2108 | +++ b/drivers/net/wireless/st/cw1200/cw1200_sdio.c | ||
2109 | @@ -60,6 +60,7 @@ static const struct sdio_device_id cw1200_sdio_ids[] = { | ||
2110 | { SDIO_DEVICE(SDIO_VENDOR_ID_STE, SDIO_DEVICE_ID_STE_CW1200) }, | ||
2111 | { /* end: all zeroes */ }, | ||
2112 | }; | ||
2113 | +MODULE_DEVICE_TABLE(sdio, cw1200_sdio_ids); | ||
2114 | |||
2115 | /* hwbus_ops implemetation */ | ||
2116 | |||
2117 | diff --git a/drivers/net/wireless/ti/wl1251/cmd.c b/drivers/net/wireless/ti/wl1251/cmd.c | ||
2118 | index 9547aea01b0fb..ea0215246c5c8 100644 | ||
2119 | --- a/drivers/net/wireless/ti/wl1251/cmd.c | ||
2120 | +++ b/drivers/net/wireless/ti/wl1251/cmd.c | ||
2121 | @@ -466,9 +466,12 @@ int wl1251_cmd_scan(struct wl1251 *wl, u8 *ssid, size_t ssid_len, | ||
2122 | cmd->channels[i].channel = channels[i]->hw_value; | ||
2123 | } | ||
2124 | |||
2125 | - cmd->params.ssid_len = ssid_len; | ||
2126 | - if (ssid) | ||
2127 | - memcpy(cmd->params.ssid, ssid, ssid_len); | ||
2128 | + if (ssid) { | ||
2129 | + int len = clamp_val(ssid_len, 0, IEEE80211_MAX_SSID_LEN); | ||
2130 | + | ||
2131 | + cmd->params.ssid_len = len; | ||
2132 | + memcpy(cmd->params.ssid, ssid, len); | ||
2133 | + } | ||
2134 | |||
2135 | ret = wl1251_cmd_send(wl, CMD_SCAN, cmd, sizeof(*cmd)); | ||
2136 | if (ret < 0) { | ||
2137 | diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c | ||
2138 | index 9d7dbfe7fe0c3..c6da0cfb4afbe 100644 | ||
2139 | --- a/drivers/net/wireless/ti/wl12xx/main.c | ||
2140 | +++ b/drivers/net/wireless/ti/wl12xx/main.c | ||
2141 | @@ -1503,6 +1503,13 @@ static int wl12xx_get_fuse_mac(struct wl1271 *wl) | ||
2142 | u32 mac1, mac2; | ||
2143 | int ret; | ||
2144 | |||
2145 | + /* Device may be in ELP from the bootloader or kexec */ | ||
2146 | + ret = wlcore_write32(wl, WL12XX_WELP_ARM_COMMAND, WELP_ARM_COMMAND_VAL); | ||
2147 | + if (ret < 0) | ||
2148 | + goto out; | ||
2149 | + | ||
2150 | + usleep_range(500000, 700000); | ||
2151 | + | ||
2152 | ret = wlcore_set_partition(wl, &wl->ptable[PART_DRPW]); | ||
2153 | if (ret < 0) | ||
2154 | goto out; | ||
2155 | diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c | ||
2156 | index 3ba68baeed1db..6da270e8c6746 100644 | ||
2157 | --- a/drivers/nvmem/core.c | ||
2158 | +++ b/drivers/nvmem/core.c | ||
2159 | @@ -318,15 +318,17 @@ static int nvmem_add_cells_from_of(struct nvmem_device *nvmem) | ||
2160 | continue; | ||
2161 | if (len < 2 * sizeof(u32)) { | ||
2162 | dev_err(dev, "nvmem: invalid reg on %pOF\n", child); | ||
2163 | + of_node_put(child); | ||
2164 | return -EINVAL; | ||
2165 | } | ||
2166 | |||
2167 | cell = kzalloc(sizeof(*cell), GFP_KERNEL); | ||
2168 | - if (!cell) | ||
2169 | + if (!cell) { | ||
2170 | + of_node_put(child); | ||
2171 | return -ENOMEM; | ||
2172 | + } | ||
2173 | |||
2174 | cell->nvmem = nvmem; | ||
2175 | - cell->np = of_node_get(child); | ||
2176 | cell->offset = be32_to_cpup(addr++); | ||
2177 | cell->bytes = be32_to_cpup(addr); | ||
2178 | cell->name = kasprintf(GFP_KERNEL, "%pOFn", child); | ||
2179 | @@ -347,11 +349,12 @@ static int nvmem_add_cells_from_of(struct nvmem_device *nvmem) | ||
2180 | cell->name, nvmem->stride); | ||
2181 | /* Cells already added will be freed later. */ | ||
2182 | kfree_const(cell->name); | ||
2183 | - of_node_put(cell->np); | ||
2184 | kfree(cell); | ||
2185 | + of_node_put(child); | ||
2186 | return -EINVAL; | ||
2187 | } | ||
2188 | |||
2189 | + cell->np = of_node_get(child); | ||
2190 | nvmem_cell_add(cell); | ||
2191 | } | ||
2192 | |||
2193 | diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c | ||
2194 | index 89cc6980b5964..0a2902569f140 100644 | ||
2195 | --- a/drivers/pci/controller/pci-aardvark.c | ||
2196 | +++ b/drivers/pci/controller/pci-aardvark.c | ||
2197 | @@ -61,7 +61,7 @@ | ||
2198 | #define PIO_COMPLETION_STATUS_UR 1 | ||
2199 | #define PIO_COMPLETION_STATUS_CRS 2 | ||
2200 | #define PIO_COMPLETION_STATUS_CA 4 | ||
2201 | -#define PIO_NON_POSTED_REQ BIT(0) | ||
2202 | +#define PIO_NON_POSTED_REQ BIT(10) | ||
2203 | #define PIO_ADDR_LS (PIO_BASE_ADDR + 0x8) | ||
2204 | #define PIO_ADDR_MS (PIO_BASE_ADDR + 0xc) | ||
2205 | #define PIO_WR_DATA (PIO_BASE_ADDR + 0x10) | ||
2206 | @@ -127,6 +127,7 @@ | ||
2207 | #define LTSSM_MASK 0x3f | ||
2208 | #define LTSSM_L0 0x10 | ||
2209 | #define RC_BAR_CONFIG 0x300 | ||
2210 | +#define VENDOR_ID_REG (LMI_BASE_ADDR + 0x44) | ||
2211 | |||
2212 | /* PCIe core controller registers */ | ||
2213 | #define CTRL_CORE_BASE_ADDR 0x18000 | ||
2214 | @@ -268,6 +269,16 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie) | ||
2215 | reg |= (IS_RC_MSK << IS_RC_SHIFT); | ||
2216 | advk_writel(pcie, reg, PCIE_CORE_CTRL0_REG); | ||
2217 | |||
2218 | + /* | ||
2219 | + * Replace incorrect PCI vendor id value 0x1b4b by correct value 0x11ab. | ||
2220 | + * VENDOR_ID_REG contains vendor id in low 16 bits and subsystem vendor | ||
2221 | + * id in high 16 bits. Updating this register changes readback value of | ||
2222 | + * read-only vendor id bits in PCIE_CORE_DEV_ID_REG register. Workaround | ||
2223 | + * for erratum 4.1: "The value of device and vendor ID is incorrect". | ||
2224 | + */ | ||
2225 | + reg = (PCI_VENDOR_ID_MARVELL << 16) | PCI_VENDOR_ID_MARVELL; | ||
2226 | + advk_writel(pcie, reg, VENDOR_ID_REG); | ||
2227 | + | ||
2228 | /* Set Advanced Error Capabilities and Control PF0 register */ | ||
2229 | reg = PCIE_CORE_ERR_CAPCTL_ECRC_CHK_TX | | ||
2230 | PCIE_CORE_ERR_CAPCTL_ECRC_CHK_TX_EN | | ||
2231 | diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c | ||
2232 | index cd0b13ddd000d..3fe9a6f61f85c 100644 | ||
2233 | --- a/drivers/pci/quirks.c | ||
2234 | +++ b/drivers/pci/quirks.c | ||
2235 | @@ -27,6 +27,7 @@ | ||
2236 | #include <linux/nvme.h> | ||
2237 | #include <linux/platform_data/x86/apple.h> | ||
2238 | #include <linux/pm_runtime.h> | ||
2239 | +#include <linux/suspend.h> | ||
2240 | #include <linux/switchtec.h> | ||
2241 | #include <asm/dma.h> /* isa_dma_bridge_buggy */ | ||
2242 | #include "pci.h" | ||
2243 | @@ -3667,6 +3668,16 @@ static void quirk_apple_poweroff_thunderbolt(struct pci_dev *dev) | ||
2244 | return; | ||
2245 | if (pci_pcie_type(dev) != PCI_EXP_TYPE_UPSTREAM) | ||
2246 | return; | ||
2247 | + | ||
2248 | + /* | ||
2249 | + * SXIO/SXFP/SXLF turns off power to the Thunderbolt controller. | ||
2250 | + * We don't know how to turn it back on again, but firmware does, | ||
2251 | + * so we can only use SXIO/SXFP/SXLF if we're suspending via | ||
2252 | + * firmware. | ||
2253 | + */ | ||
2254 | + if (!pm_suspend_via_firmware()) | ||
2255 | + return; | ||
2256 | + | ||
2257 | bridge = ACPI_HANDLE(&dev->dev); | ||
2258 | if (!bridge) | ||
2259 | return; | ||
2260 | diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c | ||
2261 | index a85c679b6276c..4c02439d3776d 100644 | ||
2262 | --- a/drivers/pinctrl/pinctrl-amd.c | ||
2263 | +++ b/drivers/pinctrl/pinctrl-amd.c | ||
2264 | @@ -958,6 +958,7 @@ static int amd_gpio_remove(struct platform_device *pdev) | ||
2265 | static const struct acpi_device_id amd_gpio_acpi_match[] = { | ||
2266 | { "AMD0030", 0 }, | ||
2267 | { "AMDI0030", 0}, | ||
2268 | + { "AMDI0031", 0}, | ||
2269 | { }, | ||
2270 | }; | ||
2271 | MODULE_DEVICE_TABLE(acpi, amd_gpio_acpi_match); | ||
2272 | diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c | ||
2273 | index d8bcbefcba890..70fe9476d0cf1 100644 | ||
2274 | --- a/drivers/pinctrl/pinctrl-mcp23s08.c | ||
2275 | +++ b/drivers/pinctrl/pinctrl-mcp23s08.c | ||
2276 | @@ -459,6 +459,11 @@ static irqreturn_t mcp23s08_irq(int irq, void *data) | ||
2277 | if (mcp_read(mcp, MCP_INTF, &intf)) | ||
2278 | goto unlock; | ||
2279 | |||
2280 | + if (intf == 0) { | ||
2281 | + /* There is no interrupt pending */ | ||
2282 | + goto unlock; | ||
2283 | + } | ||
2284 | + | ||
2285 | if (mcp_read(mcp, MCP_INTCAP, &intcap)) | ||
2286 | goto unlock; | ||
2287 | |||
2288 | @@ -476,11 +481,6 @@ static irqreturn_t mcp23s08_irq(int irq, void *data) | ||
2289 | mcp->cached_gpio = gpio; | ||
2290 | mutex_unlock(&mcp->lock); | ||
2291 | |||
2292 | - if (intf == 0) { | ||
2293 | - /* There is no interrupt pending */ | ||
2294 | - return IRQ_HANDLED; | ||
2295 | - } | ||
2296 | - | ||
2297 | dev_dbg(mcp->chip.parent, | ||
2298 | "intcap 0x%04X intf 0x%04X gpio_orig 0x%04X gpio 0x%04X\n", | ||
2299 | intcap, intf, gpio_orig, gpio); | ||
2300 | diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c | ||
2301 | index 89a015387283b..576523d0326c8 100644 | ||
2302 | --- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c | ||
2303 | +++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c | ||
2304 | @@ -150,24 +150,27 @@ static ssize_t tcc_offset_degree_celsius_show(struct device *dev, | ||
2305 | if (err) | ||
2306 | return err; | ||
2307 | |||
2308 | - val = (val >> 24) & 0xff; | ||
2309 | + val = (val >> 24) & 0x3f; | ||
2310 | return sprintf(buf, "%d\n", (int)val); | ||
2311 | } | ||
2312 | |||
2313 | -static int tcc_offset_update(int tcc) | ||
2314 | +static int tcc_offset_update(unsigned int tcc) | ||
2315 | { | ||
2316 | u64 val; | ||
2317 | int err; | ||
2318 | |||
2319 | - if (!tcc) | ||
2320 | + if (tcc > 63) | ||
2321 | return -EINVAL; | ||
2322 | |||
2323 | err = rdmsrl_safe(MSR_IA32_TEMPERATURE_TARGET, &val); | ||
2324 | if (err) | ||
2325 | return err; | ||
2326 | |||
2327 | - val &= ~GENMASK_ULL(31, 24); | ||
2328 | - val |= (tcc & 0xff) << 24; | ||
2329 | + if (val & BIT(31)) | ||
2330 | + return -EPERM; | ||
2331 | + | ||
2332 | + val &= ~GENMASK_ULL(29, 24); | ||
2333 | + val |= (tcc & 0x3f) << 24; | ||
2334 | |||
2335 | err = wrmsrl_safe(MSR_IA32_TEMPERATURE_TARGET, val); | ||
2336 | if (err) | ||
2337 | @@ -176,14 +179,15 @@ static int tcc_offset_update(int tcc) | ||
2338 | return 0; | ||
2339 | } | ||
2340 | |||
2341 | -static int tcc_offset_save; | ||
2342 | +static unsigned int tcc_offset_save; | ||
2343 | |||
2344 | static ssize_t tcc_offset_degree_celsius_store(struct device *dev, | ||
2345 | struct device_attribute *attr, const char *buf, | ||
2346 | size_t count) | ||
2347 | { | ||
2348 | + unsigned int tcc; | ||
2349 | u64 val; | ||
2350 | - int tcc, err; | ||
2351 | + int err; | ||
2352 | |||
2353 | err = rdmsrl_safe(MSR_PLATFORM_INFO, &val); | ||
2354 | if (err) | ||
2355 | @@ -192,7 +196,7 @@ static ssize_t tcc_offset_degree_celsius_store(struct device *dev, | ||
2356 | if (!(val & BIT(30))) | ||
2357 | return -EACCES; | ||
2358 | |||
2359 | - if (kstrtoint(buf, 0, &tcc)) | ||
2360 | + if (kstrtouint(buf, 0, &tcc)) | ||
2361 | return -EINVAL; | ||
2362 | |||
2363 | err = tcc_offset_update(tcc); | ||
2364 | diff --git a/fs/crypto/fname.c b/fs/crypto/fname.c | ||
2365 | index 3da3707c10e33..891328f09b3c8 100644 | ||
2366 | --- a/fs/crypto/fname.c | ||
2367 | +++ b/fs/crypto/fname.c | ||
2368 | @@ -273,13 +273,8 @@ int fscrypt_fname_disk_to_usr(struct inode *inode, | ||
2369 | oname->name); | ||
2370 | return 0; | ||
2371 | } | ||
2372 | - if (hash) { | ||
2373 | - digested_name.hash = hash; | ||
2374 | - digested_name.minor_hash = minor_hash; | ||
2375 | - } else { | ||
2376 | - digested_name.hash = 0; | ||
2377 | - digested_name.minor_hash = 0; | ||
2378 | - } | ||
2379 | + digested_name.hash = hash; | ||
2380 | + digested_name.minor_hash = minor_hash; | ||
2381 | memcpy(digested_name.digest, | ||
2382 | FSCRYPT_FNAME_DIGEST(iname->name, iname->len), | ||
2383 | FSCRYPT_FNAME_DIGEST_SIZE); | ||
2384 | diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c | ||
2385 | index 9486afcdac76f..d862cfc3d3a83 100644 | ||
2386 | --- a/fs/jfs/inode.c | ||
2387 | +++ b/fs/jfs/inode.c | ||
2388 | @@ -151,7 +151,8 @@ void jfs_evict_inode(struct inode *inode) | ||
2389 | if (test_cflag(COMMIT_Freewmap, inode)) | ||
2390 | jfs_free_zero_link(inode); | ||
2391 | |||
2392 | - diFree(inode); | ||
2393 | + if (JFS_SBI(inode->i_sb)->ipimap) | ||
2394 | + diFree(inode); | ||
2395 | |||
2396 | /* | ||
2397 | * Free the inode from the quota allocation. | ||
2398 | diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c | ||
2399 | index 4b3e3e73b5128..09ad022a78a55 100644 | ||
2400 | --- a/fs/reiserfs/journal.c | ||
2401 | +++ b/fs/reiserfs/journal.c | ||
2402 | @@ -2763,6 +2763,20 @@ int journal_init(struct super_block *sb, const char *j_dev_name, | ||
2403 | goto free_and_return; | ||
2404 | } | ||
2405 | |||
2406 | + /* | ||
2407 | + * Sanity check to see if journal first block is correct. | ||
2408 | + * If journal first block is invalid it can cause | ||
2409 | + * zeroing important superblock members. | ||
2410 | + */ | ||
2411 | + if (!SB_ONDISK_JOURNAL_DEVICE(sb) && | ||
2412 | + SB_ONDISK_JOURNAL_1st_BLOCK(sb) < SB_JOURNAL_1st_RESERVED_BLOCK(sb)) { | ||
2413 | + reiserfs_warning(sb, "journal-1393", | ||
2414 | + "journal 1st super block is invalid: 1st reserved block %d, but actual 1st block is %d", | ||
2415 | + SB_JOURNAL_1st_RESERVED_BLOCK(sb), | ||
2416 | + SB_ONDISK_JOURNAL_1st_BLOCK(sb)); | ||
2417 | + goto free_and_return; | ||
2418 | + } | ||
2419 | + | ||
2420 | if (journal_init_dev(sb, journal, j_dev_name) != 0) { | ||
2421 | reiserfs_warning(sb, "sh-462", | ||
2422 | "unable to initialize journal device"); | ||
2423 | diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c | ||
2424 | index 701f15ba61352..2cbc3c36f3a8c 100644 | ||
2425 | --- a/fs/ubifs/super.c | ||
2426 | +++ b/fs/ubifs/super.c | ||
2427 | @@ -257,6 +257,7 @@ static struct inode *ubifs_alloc_inode(struct super_block *sb) | ||
2428 | memset((void *)ui + sizeof(struct inode), 0, | ||
2429 | sizeof(struct ubifs_inode) - sizeof(struct inode)); | ||
2430 | mutex_init(&ui->ui_mutex); | ||
2431 | + init_rwsem(&ui->xattr_sem); | ||
2432 | spin_lock_init(&ui->ui_lock); | ||
2433 | return &ui->vfs_inode; | ||
2434 | }; | ||
2435 | diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h | ||
2436 | index c55f212dcb759..b3b7e3576e980 100644 | ||
2437 | --- a/fs/ubifs/ubifs.h | ||
2438 | +++ b/fs/ubifs/ubifs.h | ||
2439 | @@ -356,6 +356,7 @@ struct ubifs_gced_idx_leb { | ||
2440 | * @ui_mutex: serializes inode write-back with the rest of VFS operations, | ||
2441 | * serializes "clean <-> dirty" state changes, serializes bulk-read, | ||
2442 | * protects @dirty, @bulk_read, @ui_size, and @xattr_size | ||
2443 | + * @xattr_sem: serilizes write operations (remove|set|create) on xattr | ||
2444 | * @ui_lock: protects @synced_i_size | ||
2445 | * @synced_i_size: synchronized size of inode, i.e. the value of inode size | ||
2446 | * currently stored on the flash; used only for regular file | ||
2447 | @@ -409,6 +410,7 @@ struct ubifs_inode { | ||
2448 | unsigned int bulk_read:1; | ||
2449 | unsigned int compr_type:2; | ||
2450 | struct mutex ui_mutex; | ||
2451 | + struct rw_semaphore xattr_sem; | ||
2452 | spinlock_t ui_lock; | ||
2453 | loff_t synced_i_size; | ||
2454 | loff_t ui_size; | ||
2455 | diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c | ||
2456 | index a0b9b349efe65..09280796fc610 100644 | ||
2457 | --- a/fs/ubifs/xattr.c | ||
2458 | +++ b/fs/ubifs/xattr.c | ||
2459 | @@ -285,6 +285,7 @@ int ubifs_xattr_set(struct inode *host, const char *name, const void *value, | ||
2460 | if (!xent) | ||
2461 | return -ENOMEM; | ||
2462 | |||
2463 | + down_write(&ubifs_inode(host)->xattr_sem); | ||
2464 | /* | ||
2465 | * The extended attribute entries are stored in LNC, so multiple | ||
2466 | * look-ups do not involve reading the flash. | ||
2467 | @@ -319,6 +320,7 @@ int ubifs_xattr_set(struct inode *host, const char *name, const void *value, | ||
2468 | iput(inode); | ||
2469 | |||
2470 | out_free: | ||
2471 | + up_write(&ubifs_inode(host)->xattr_sem); | ||
2472 | kfree(xent); | ||
2473 | return err; | ||
2474 | } | ||
2475 | @@ -341,18 +343,19 @@ ssize_t ubifs_xattr_get(struct inode *host, const char *name, void *buf, | ||
2476 | if (!xent) | ||
2477 | return -ENOMEM; | ||
2478 | |||
2479 | + down_read(&ubifs_inode(host)->xattr_sem); | ||
2480 | xent_key_init(c, &key, host->i_ino, &nm); | ||
2481 | err = ubifs_tnc_lookup_nm(c, &key, xent, &nm); | ||
2482 | if (err) { | ||
2483 | if (err == -ENOENT) | ||
2484 | err = -ENODATA; | ||
2485 | - goto out_unlock; | ||
2486 | + goto out_cleanup; | ||
2487 | } | ||
2488 | |||
2489 | inode = iget_xattr(c, le64_to_cpu(xent->inum)); | ||
2490 | if (IS_ERR(inode)) { | ||
2491 | err = PTR_ERR(inode); | ||
2492 | - goto out_unlock; | ||
2493 | + goto out_cleanup; | ||
2494 | } | ||
2495 | |||
2496 | ui = ubifs_inode(inode); | ||
2497 | @@ -374,7 +377,8 @@ ssize_t ubifs_xattr_get(struct inode *host, const char *name, void *buf, | ||
2498 | out_iput: | ||
2499 | mutex_unlock(&ui->ui_mutex); | ||
2500 | iput(inode); | ||
2501 | -out_unlock: | ||
2502 | +out_cleanup: | ||
2503 | + up_read(&ubifs_inode(host)->xattr_sem); | ||
2504 | kfree(xent); | ||
2505 | return err; | ||
2506 | } | ||
2507 | @@ -406,16 +410,21 @@ ssize_t ubifs_listxattr(struct dentry *dentry, char *buffer, size_t size) | ||
2508 | dbg_gen("ino %lu ('%pd'), buffer size %zd", host->i_ino, | ||
2509 | dentry, size); | ||
2510 | |||
2511 | + down_read(&host_ui->xattr_sem); | ||
2512 | len = host_ui->xattr_names + host_ui->xattr_cnt; | ||
2513 | - if (!buffer) | ||
2514 | + if (!buffer) { | ||
2515 | /* | ||
2516 | * We should return the minimum buffer size which will fit a | ||
2517 | * null-terminated list of all the extended attribute names. | ||
2518 | */ | ||
2519 | - return len; | ||
2520 | + err = len; | ||
2521 | + goto out_err; | ||
2522 | + } | ||
2523 | |||
2524 | - if (len > size) | ||
2525 | - return -ERANGE; | ||
2526 | + if (len > size) { | ||
2527 | + err = -ERANGE; | ||
2528 | + goto out_err; | ||
2529 | + } | ||
2530 | |||
2531 | lowest_xent_key(c, &key, host->i_ino); | ||
2532 | while (1) { | ||
2533 | @@ -437,8 +446,9 @@ ssize_t ubifs_listxattr(struct dentry *dentry, char *buffer, size_t size) | ||
2534 | pxent = xent; | ||
2535 | key_read(c, &xent->key, &key); | ||
2536 | } | ||
2537 | - | ||
2538 | kfree(pxent); | ||
2539 | + up_read(&host_ui->xattr_sem); | ||
2540 | + | ||
2541 | if (err != -ENOENT) { | ||
2542 | ubifs_err(c, "cannot find next direntry, error %d", err); | ||
2543 | return err; | ||
2544 | @@ -446,6 +456,10 @@ ssize_t ubifs_listxattr(struct dentry *dentry, char *buffer, size_t size) | ||
2545 | |||
2546 | ubifs_assert(c, written <= size); | ||
2547 | return written; | ||
2548 | + | ||
2549 | +out_err: | ||
2550 | + up_read(&host_ui->xattr_sem); | ||
2551 | + return err; | ||
2552 | } | ||
2553 | |||
2554 | static int remove_xattr(struct ubifs_info *c, struct inode *host, | ||
2555 | @@ -504,6 +518,7 @@ int ubifs_purge_xattrs(struct inode *host) | ||
2556 | ubifs_warn(c, "inode %lu has too many xattrs, doing a non-atomic deletion", | ||
2557 | host->i_ino); | ||
2558 | |||
2559 | + down_write(&ubifs_inode(host)->xattr_sem); | ||
2560 | lowest_xent_key(c, &key, host->i_ino); | ||
2561 | while (1) { | ||
2562 | xent = ubifs_tnc_next_ent(c, &key, &nm); | ||
2563 | @@ -523,7 +538,7 @@ int ubifs_purge_xattrs(struct inode *host) | ||
2564 | ubifs_ro_mode(c, err); | ||
2565 | kfree(pxent); | ||
2566 | kfree(xent); | ||
2567 | - return err; | ||
2568 | + goto out_err; | ||
2569 | } | ||
2570 | |||
2571 | ubifs_assert(c, ubifs_inode(xino)->xattr); | ||
2572 | @@ -535,7 +550,7 @@ int ubifs_purge_xattrs(struct inode *host) | ||
2573 | kfree(xent); | ||
2574 | iput(xino); | ||
2575 | ubifs_err(c, "cannot remove xattr, error %d", err); | ||
2576 | - return err; | ||
2577 | + goto out_err; | ||
2578 | } | ||
2579 | |||
2580 | iput(xino); | ||
2581 | @@ -544,14 +559,19 @@ int ubifs_purge_xattrs(struct inode *host) | ||
2582 | pxent = xent; | ||
2583 | key_read(c, &xent->key, &key); | ||
2584 | } | ||
2585 | - | ||
2586 | kfree(pxent); | ||
2587 | + up_write(&ubifs_inode(host)->xattr_sem); | ||
2588 | + | ||
2589 | if (err != -ENOENT) { | ||
2590 | ubifs_err(c, "cannot find next direntry, error %d", err); | ||
2591 | return err; | ||
2592 | } | ||
2593 | |||
2594 | return 0; | ||
2595 | + | ||
2596 | +out_err: | ||
2597 | + up_write(&ubifs_inode(host)->xattr_sem); | ||
2598 | + return err; | ||
2599 | } | ||
2600 | |||
2601 | /** | ||
2602 | @@ -594,6 +614,7 @@ static int ubifs_xattr_remove(struct inode *host, const char *name) | ||
2603 | if (!xent) | ||
2604 | return -ENOMEM; | ||
2605 | |||
2606 | + down_write(&ubifs_inode(host)->xattr_sem); | ||
2607 | xent_key_init(c, &key, host->i_ino, &nm); | ||
2608 | err = ubifs_tnc_lookup_nm(c, &key, xent, &nm); | ||
2609 | if (err) { | ||
2610 | @@ -618,6 +639,7 @@ static int ubifs_xattr_remove(struct inode *host, const char *name) | ||
2611 | iput(inode); | ||
2612 | |||
2613 | out_free: | ||
2614 | + up_write(&ubifs_inode(host)->xattr_sem); | ||
2615 | kfree(xent); | ||
2616 | return err; | ||
2617 | } | ||
2618 | diff --git a/fs/udf/namei.c b/fs/udf/namei.c | ||
2619 | index 77b6d89b9bcdd..3c3d3b20889c8 100644 | ||
2620 | --- a/fs/udf/namei.c | ||
2621 | +++ b/fs/udf/namei.c | ||
2622 | @@ -933,6 +933,10 @@ static int udf_symlink(struct inode *dir, struct dentry *dentry, | ||
2623 | iinfo->i_location.partitionReferenceNum, | ||
2624 | 0); | ||
2625 | epos.bh = udf_tgetblk(sb, block); | ||
2626 | + if (unlikely(!epos.bh)) { | ||
2627 | + err = -ENOMEM; | ||
2628 | + goto out_no_entry; | ||
2629 | + } | ||
2630 | lock_buffer(epos.bh); | ||
2631 | memset(epos.bh->b_data, 0x00, bsize); | ||
2632 | set_buffer_uptodate(epos.bh); | ||
2633 | diff --git a/include/linux/mfd/abx500/ux500_chargalg.h b/include/linux/mfd/abx500/ux500_chargalg.h | ||
2634 | index 9b97d284d0ce8..bc3819dc33e12 100644 | ||
2635 | --- a/include/linux/mfd/abx500/ux500_chargalg.h | ||
2636 | +++ b/include/linux/mfd/abx500/ux500_chargalg.h | ||
2637 | @@ -15,7 +15,7 @@ | ||
2638 | * - POWER_SUPPLY_TYPE_USB, | ||
2639 | * because only them store as drv_data pointer to struct ux500_charger. | ||
2640 | */ | ||
2641 | -#define psy_to_ux500_charger(x) power_supply_get_drvdata(psy) | ||
2642 | +#define psy_to_ux500_charger(x) power_supply_get_drvdata(x) | ||
2643 | |||
2644 | /* Forward declaration */ | ||
2645 | struct ux500_charger; | ||
2646 | diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h | ||
2647 | index 4b19c544c59a4..640e7279f1617 100644 | ||
2648 | --- a/include/linux/netdev_features.h | ||
2649 | +++ b/include/linux/netdev_features.h | ||
2650 | @@ -83,7 +83,7 @@ enum { | ||
2651 | |||
2652 | /* | ||
2653 | * Add your fresh new feature above and remember to update | ||
2654 | - * netdev_features_strings[] in net/core/ethtool.c and maybe | ||
2655 | + * netdev_features_strings[] in net/ethtool/common.c and maybe | ||
2656 | * some feature mask #defines below. Please also describe it | ||
2657 | * in Documentation/networking/netdev-features.txt. | ||
2658 | */ | ||
2659 | diff --git a/include/linux/wait.h b/include/linux/wait.h | ||
2660 | index 3eb7cae8206c3..032ae61c22a2b 100644 | ||
2661 | --- a/include/linux/wait.h | ||
2662 | +++ b/include/linux/wait.h | ||
2663 | @@ -1121,7 +1121,7 @@ do { \ | ||
2664 | * Waitqueues which are removed from the waitqueue_head at wakeup time | ||
2665 | */ | ||
2666 | void prepare_to_wait(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state); | ||
2667 | -void prepare_to_wait_exclusive(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state); | ||
2668 | +bool prepare_to_wait_exclusive(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state); | ||
2669 | long prepare_to_wait_event(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state); | ||
2670 | void finish_wait(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry); | ||
2671 | long wait_woken(struct wait_queue_entry *wq_entry, unsigned mode, long timeout); | ||
2672 | diff --git a/include/media/v4l2-subdev.h b/include/media/v4l2-subdev.h | ||
2673 | index 71f1f2f0da536..d4ac251b34fe4 100644 | ||
2674 | --- a/include/media/v4l2-subdev.h | ||
2675 | +++ b/include/media/v4l2-subdev.h | ||
2676 | @@ -162,6 +162,9 @@ struct v4l2_subdev_io_pin_config { | ||
2677 | * @s_gpio: set GPIO pins. Very simple right now, might need to be extended with | ||
2678 | * a direction argument if needed. | ||
2679 | * | ||
2680 | + * @command: called by in-kernel drivers in order to call functions internal | ||
2681 | + * to subdev drivers driver that have a separate callback. | ||
2682 | + * | ||
2683 | * @ioctl: called at the end of ioctl() syscall handler at the V4L2 core. | ||
2684 | * used to provide support for private ioctls used on the driver. | ||
2685 | * | ||
2686 | @@ -193,6 +196,7 @@ struct v4l2_subdev_core_ops { | ||
2687 | int (*load_fw)(struct v4l2_subdev *sd); | ||
2688 | int (*reset)(struct v4l2_subdev *sd, u32 val); | ||
2689 | int (*s_gpio)(struct v4l2_subdev *sd, u32 val); | ||
2690 | + long (*command)(struct v4l2_subdev *sd, unsigned int cmd, void *arg); | ||
2691 | long (*ioctl)(struct v4l2_subdev *sd, unsigned int cmd, void *arg); | ||
2692 | #ifdef CONFIG_COMPAT | ||
2693 | long (*compat_ioctl32)(struct v4l2_subdev *sd, unsigned int cmd, | ||
2694 | diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h | ||
2695 | index 3e8f87a3c52fa..fd7c3f76040c3 100644 | ||
2696 | --- a/include/net/sctp/structs.h | ||
2697 | +++ b/include/net/sctp/structs.h | ||
2698 | @@ -466,7 +466,7 @@ struct sctp_af { | ||
2699 | int saddr); | ||
2700 | void (*from_sk) (union sctp_addr *, | ||
2701 | struct sock *sk); | ||
2702 | - void (*from_addr_param) (union sctp_addr *, | ||
2703 | + bool (*from_addr_param) (union sctp_addr *, | ||
2704 | union sctp_addr_param *, | ||
2705 | __be16 port, int iif); | ||
2706 | int (*to_addr_param) (const union sctp_addr *, | ||
2707 | diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h | ||
2708 | index 7857aa4136276..8d465e5322e71 100644 | ||
2709 | --- a/include/uapi/linux/ethtool.h | ||
2710 | +++ b/include/uapi/linux/ethtool.h | ||
2711 | @@ -223,7 +223,7 @@ enum tunable_id { | ||
2712 | ETHTOOL_PFC_PREVENTION_TOUT, /* timeout in msecs */ | ||
2713 | /* | ||
2714 | * Add your fresh new tunable attribute above and remember to update | ||
2715 | - * tunable_strings[] in net/core/ethtool.c | ||
2716 | + * tunable_strings[] in net/ethtool/common.c | ||
2717 | */ | ||
2718 | __ETHTOOL_TUNABLE_COUNT, | ||
2719 | }; | ||
2720 | @@ -287,7 +287,7 @@ enum phy_tunable_id { | ||
2721 | ETHTOOL_PHY_EDPD, | ||
2722 | /* | ||
2723 | * Add your fresh new phy tunable attribute above and remember to update | ||
2724 | - * phy_tunable_strings[] in net/core/ethtool.c | ||
2725 | + * phy_tunable_strings[] in net/ethtool/common.c | ||
2726 | */ | ||
2727 | __ETHTOOL_PHY_TUNABLE_COUNT, | ||
2728 | }; | ||
2729 | diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c | ||
2730 | index 56bc96f5ad208..323913ba13b38 100644 | ||
2731 | --- a/kernel/bpf/core.c | ||
2732 | +++ b/kernel/bpf/core.c | ||
2733 | @@ -1321,29 +1321,54 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, u64 *stack) | ||
2734 | select_insn: | ||
2735 | goto *jumptable[insn->code]; | ||
2736 | |||
2737 | - /* ALU */ | ||
2738 | -#define ALU(OPCODE, OP) \ | ||
2739 | - ALU64_##OPCODE##_X: \ | ||
2740 | - DST = DST OP SRC; \ | ||
2741 | - CONT; \ | ||
2742 | - ALU_##OPCODE##_X: \ | ||
2743 | - DST = (u32) DST OP (u32) SRC; \ | ||
2744 | - CONT; \ | ||
2745 | - ALU64_##OPCODE##_K: \ | ||
2746 | - DST = DST OP IMM; \ | ||
2747 | - CONT; \ | ||
2748 | - ALU_##OPCODE##_K: \ | ||
2749 | - DST = (u32) DST OP (u32) IMM; \ | ||
2750 | + /* Explicitly mask the register-based shift amounts with 63 or 31 | ||
2751 | + * to avoid undefined behavior. Normally this won't affect the | ||
2752 | + * generated code, for example, in case of native 64 bit archs such | ||
2753 | + * as x86-64 or arm64, the compiler is optimizing the AND away for | ||
2754 | + * the interpreter. In case of JITs, each of the JIT backends compiles | ||
2755 | + * the BPF shift operations to machine instructions which produce | ||
2756 | + * implementation-defined results in such a case; the resulting | ||
2757 | + * contents of the register may be arbitrary, but program behaviour | ||
2758 | + * as a whole remains defined. In other words, in case of JIT backends, | ||
2759 | + * the AND must /not/ be added to the emitted LSH/RSH/ARSH translation. | ||
2760 | + */ | ||
2761 | + /* ALU (shifts) */ | ||
2762 | +#define SHT(OPCODE, OP) \ | ||
2763 | + ALU64_##OPCODE##_X: \ | ||
2764 | + DST = DST OP (SRC & 63); \ | ||
2765 | + CONT; \ | ||
2766 | + ALU_##OPCODE##_X: \ | ||
2767 | + DST = (u32) DST OP ((u32) SRC & 31); \ | ||
2768 | + CONT; \ | ||
2769 | + ALU64_##OPCODE##_K: \ | ||
2770 | + DST = DST OP IMM; \ | ||
2771 | + CONT; \ | ||
2772 | + ALU_##OPCODE##_K: \ | ||
2773 | + DST = (u32) DST OP (u32) IMM; \ | ||
2774 | + CONT; | ||
2775 | + /* ALU (rest) */ | ||
2776 | +#define ALU(OPCODE, OP) \ | ||
2777 | + ALU64_##OPCODE##_X: \ | ||
2778 | + DST = DST OP SRC; \ | ||
2779 | + CONT; \ | ||
2780 | + ALU_##OPCODE##_X: \ | ||
2781 | + DST = (u32) DST OP (u32) SRC; \ | ||
2782 | + CONT; \ | ||
2783 | + ALU64_##OPCODE##_K: \ | ||
2784 | + DST = DST OP IMM; \ | ||
2785 | + CONT; \ | ||
2786 | + ALU_##OPCODE##_K: \ | ||
2787 | + DST = (u32) DST OP (u32) IMM; \ | ||
2788 | CONT; | ||
2789 | - | ||
2790 | ALU(ADD, +) | ||
2791 | ALU(SUB, -) | ||
2792 | ALU(AND, &) | ||
2793 | ALU(OR, |) | ||
2794 | - ALU(LSH, <<) | ||
2795 | - ALU(RSH, >>) | ||
2796 | ALU(XOR, ^) | ||
2797 | ALU(MUL, *) | ||
2798 | + SHT(LSH, <<) | ||
2799 | + SHT(RSH, >>) | ||
2800 | +#undef SHT | ||
2801 | #undef ALU | ||
2802 | ALU_NEG: | ||
2803 | DST = (u32) -DST; | ||
2804 | @@ -1368,13 +1393,13 @@ select_insn: | ||
2805 | insn++; | ||
2806 | CONT; | ||
2807 | ALU_ARSH_X: | ||
2808 | - DST = (u64) (u32) (((s32) DST) >> SRC); | ||
2809 | + DST = (u64) (u32) (((s32) DST) >> (SRC & 31)); | ||
2810 | CONT; | ||
2811 | ALU_ARSH_K: | ||
2812 | DST = (u64) (u32) (((s32) DST) >> IMM); | ||
2813 | CONT; | ||
2814 | ALU64_ARSH_X: | ||
2815 | - (*(s64 *) &DST) >>= SRC; | ||
2816 | + (*(s64 *) &DST) >>= (SRC & 63); | ||
2817 | CONT; | ||
2818 | ALU64_ARSH_K: | ||
2819 | (*(s64 *) &DST) >>= IMM; | ||
2820 | diff --git a/kernel/cpu.c b/kernel/cpu.c | ||
2821 | index fa0e5727b4d9c..06c009489892f 100644 | ||
2822 | --- a/kernel/cpu.c | ||
2823 | +++ b/kernel/cpu.c | ||
2824 | @@ -32,6 +32,7 @@ | ||
2825 | #include <linux/relay.h> | ||
2826 | #include <linux/slab.h> | ||
2827 | #include <linux/percpu-rwsem.h> | ||
2828 | +#include <linux/cpuset.h> | ||
2829 | |||
2830 | #include <trace/events/power.h> | ||
2831 | #define CREATE_TRACE_POINTS | ||
2832 | @@ -814,6 +815,52 @@ void __init cpuhp_threads_init(void) | ||
2833 | kthread_unpark(this_cpu_read(cpuhp_state.thread)); | ||
2834 | } | ||
2835 | |||
2836 | +/* | ||
2837 | + * | ||
2838 | + * Serialize hotplug trainwrecks outside of the cpu_hotplug_lock | ||
2839 | + * protected region. | ||
2840 | + * | ||
2841 | + * The operation is still serialized against concurrent CPU hotplug via | ||
2842 | + * cpu_add_remove_lock, i.e. CPU map protection. But it is _not_ | ||
2843 | + * serialized against other hotplug related activity like adding or | ||
2844 | + * removing of state callbacks and state instances, which invoke either the | ||
2845 | + * startup or the teardown callback of the affected state. | ||
2846 | + * | ||
2847 | + * This is required for subsystems which are unfixable vs. CPU hotplug and | ||
2848 | + * evade lock inversion problems by scheduling work which has to be | ||
2849 | + * completed _before_ cpu_up()/_cpu_down() returns. | ||
2850 | + * | ||
2851 | + * Don't even think about adding anything to this for any new code or even | ||
2852 | + * drivers. It's only purpose is to keep existing lock order trainwrecks | ||
2853 | + * working. | ||
2854 | + * | ||
2855 | + * For cpu_down() there might be valid reasons to finish cleanups which are | ||
2856 | + * not required to be done under cpu_hotplug_lock, but that's a different | ||
2857 | + * story and would be not invoked via this. | ||
2858 | + */ | ||
2859 | +static void cpu_up_down_serialize_trainwrecks(bool tasks_frozen) | ||
2860 | +{ | ||
2861 | + /* | ||
2862 | + * cpusets delegate hotplug operations to a worker to "solve" the | ||
2863 | + * lock order problems. Wait for the worker, but only if tasks are | ||
2864 | + * _not_ frozen (suspend, hibernate) as that would wait forever. | ||
2865 | + * | ||
2866 | + * The wait is required because otherwise the hotplug operation | ||
2867 | + * returns with inconsistent state, which could even be observed in | ||
2868 | + * user space when a new CPU is brought up. The CPU plug uevent | ||
2869 | + * would be delivered and user space reacting on it would fail to | ||
2870 | + * move tasks to the newly plugged CPU up to the point where the | ||
2871 | + * work has finished because up to that point the newly plugged CPU | ||
2872 | + * is not assignable in cpusets/cgroups. On unplug that's not | ||
2873 | + * necessarily a visible issue, but it is still inconsistent state, | ||
2874 | + * which is the real problem which needs to be "fixed". This can't | ||
2875 | + * prevent the transient state between scheduling the work and | ||
2876 | + * returning from waiting for it. | ||
2877 | + */ | ||
2878 | + if (!tasks_frozen) | ||
2879 | + cpuset_wait_for_hotplug(); | ||
2880 | +} | ||
2881 | + | ||
2882 | #ifdef CONFIG_HOTPLUG_CPU | ||
2883 | #ifndef arch_clear_mm_cpumask_cpu | ||
2884 | #define arch_clear_mm_cpumask_cpu(cpu, mm) cpumask_clear_cpu(cpu, mm_cpumask(mm)) | ||
2885 | @@ -1051,6 +1098,7 @@ out: | ||
2886 | */ | ||
2887 | lockup_detector_cleanup(); | ||
2888 | arch_smt_update(); | ||
2889 | + cpu_up_down_serialize_trainwrecks(tasks_frozen); | ||
2890 | return ret; | ||
2891 | } | ||
2892 | |||
2893 | @@ -1186,6 +1234,7 @@ static int _cpu_up(unsigned int cpu, int tasks_frozen, enum cpuhp_state target) | ||
2894 | out: | ||
2895 | cpus_write_unlock(); | ||
2896 | arch_smt_update(); | ||
2897 | + cpu_up_down_serialize_trainwrecks(tasks_frozen); | ||
2898 | return ret; | ||
2899 | } | ||
2900 | |||
2901 | diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c | ||
2902 | index c1e566a114ca6..84bd05117dc22 100644 | ||
2903 | --- a/kernel/sched/wait.c | ||
2904 | +++ b/kernel/sched/wait.c | ||
2905 | @@ -232,17 +232,22 @@ prepare_to_wait(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_ent | ||
2906 | } | ||
2907 | EXPORT_SYMBOL(prepare_to_wait); | ||
2908 | |||
2909 | -void | ||
2910 | +/* Returns true if we are the first waiter in the queue, false otherwise. */ | ||
2911 | +bool | ||
2912 | prepare_to_wait_exclusive(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state) | ||
2913 | { | ||
2914 | unsigned long flags; | ||
2915 | + bool was_empty = false; | ||
2916 | |||
2917 | wq_entry->flags |= WQ_FLAG_EXCLUSIVE; | ||
2918 | spin_lock_irqsave(&wq_head->lock, flags); | ||
2919 | - if (list_empty(&wq_entry->entry)) | ||
2920 | + if (list_empty(&wq_entry->entry)) { | ||
2921 | + was_empty = list_empty(&wq_head->head); | ||
2922 | __add_wait_queue_entry_tail(wq_head, wq_entry); | ||
2923 | + } | ||
2924 | set_current_state(state); | ||
2925 | spin_unlock_irqrestore(&wq_head->lock, flags); | ||
2926 | + return was_empty; | ||
2927 | } | ||
2928 | EXPORT_SYMBOL(prepare_to_wait_exclusive); | ||
2929 | |||
2930 | diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c | ||
2931 | index 37eacfe0d6733..002412a1abf91 100644 | ||
2932 | --- a/kernel/trace/trace.c | ||
2933 | +++ b/kernel/trace/trace.c | ||
2934 | @@ -1934,8 +1934,15 @@ void tracing_reset_all_online_cpus(void) | ||
2935 | } | ||
2936 | } | ||
2937 | |||
2938 | +/* | ||
2939 | + * The tgid_map array maps from pid to tgid; i.e. the value stored at index i | ||
2940 | + * is the tgid last observed corresponding to pid=i. | ||
2941 | + */ | ||
2942 | static int *tgid_map; | ||
2943 | |||
2944 | +/* The maximum valid index into tgid_map. */ | ||
2945 | +static size_t tgid_map_max; | ||
2946 | + | ||
2947 | #define SAVED_CMDLINES_DEFAULT 128 | ||
2948 | #define NO_CMDLINE_MAP UINT_MAX | ||
2949 | static arch_spinlock_t trace_cmdline_lock = __ARCH_SPIN_LOCK_UNLOCKED; | ||
2950 | @@ -2208,24 +2215,41 @@ void trace_find_cmdline(int pid, char comm[]) | ||
2951 | preempt_enable(); | ||
2952 | } | ||
2953 | |||
2954 | +static int *trace_find_tgid_ptr(int pid) | ||
2955 | +{ | ||
2956 | + /* | ||
2957 | + * Pairs with the smp_store_release in set_tracer_flag() to ensure that | ||
2958 | + * if we observe a non-NULL tgid_map then we also observe the correct | ||
2959 | + * tgid_map_max. | ||
2960 | + */ | ||
2961 | + int *map = smp_load_acquire(&tgid_map); | ||
2962 | + | ||
2963 | + if (unlikely(!map || pid > tgid_map_max)) | ||
2964 | + return NULL; | ||
2965 | + | ||
2966 | + return &map[pid]; | ||
2967 | +} | ||
2968 | + | ||
2969 | int trace_find_tgid(int pid) | ||
2970 | { | ||
2971 | - if (unlikely(!tgid_map || !pid || pid > PID_MAX_DEFAULT)) | ||
2972 | - return 0; | ||
2973 | + int *ptr = trace_find_tgid_ptr(pid); | ||
2974 | |||
2975 | - return tgid_map[pid]; | ||
2976 | + return ptr ? *ptr : 0; | ||
2977 | } | ||
2978 | |||
2979 | static int trace_save_tgid(struct task_struct *tsk) | ||
2980 | { | ||
2981 | + int *ptr; | ||
2982 | + | ||
2983 | /* treat recording of idle task as a success */ | ||
2984 | if (!tsk->pid) | ||
2985 | return 1; | ||
2986 | |||
2987 | - if (unlikely(!tgid_map || tsk->pid > PID_MAX_DEFAULT)) | ||
2988 | + ptr = trace_find_tgid_ptr(tsk->pid); | ||
2989 | + if (!ptr) | ||
2990 | return 0; | ||
2991 | |||
2992 | - tgid_map[tsk->pid] = tsk->tgid; | ||
2993 | + *ptr = tsk->tgid; | ||
2994 | return 1; | ||
2995 | } | ||
2996 | |||
2997 | @@ -4583,6 +4607,8 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set) | ||
2998 | |||
2999 | int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled) | ||
3000 | { | ||
3001 | + int *map; | ||
3002 | + | ||
3003 | if ((mask == TRACE_ITER_RECORD_TGID) || | ||
3004 | (mask == TRACE_ITER_RECORD_CMD)) | ||
3005 | lockdep_assert_held(&event_mutex); | ||
3006 | @@ -4605,10 +4631,19 @@ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled) | ||
3007 | trace_event_enable_cmd_record(enabled); | ||
3008 | |||
3009 | if (mask == TRACE_ITER_RECORD_TGID) { | ||
3010 | - if (!tgid_map) | ||
3011 | - tgid_map = kvcalloc(PID_MAX_DEFAULT + 1, | ||
3012 | - sizeof(*tgid_map), | ||
3013 | - GFP_KERNEL); | ||
3014 | + if (!tgid_map) { | ||
3015 | + tgid_map_max = pid_max; | ||
3016 | + map = kvcalloc(tgid_map_max + 1, sizeof(*tgid_map), | ||
3017 | + GFP_KERNEL); | ||
3018 | + | ||
3019 | + /* | ||
3020 | + * Pairs with smp_load_acquire() in | ||
3021 | + * trace_find_tgid_ptr() to ensure that if it observes | ||
3022 | + * the tgid_map we just allocated then it also observes | ||
3023 | + * the corresponding tgid_map_max value. | ||
3024 | + */ | ||
3025 | + smp_store_release(&tgid_map, map); | ||
3026 | + } | ||
3027 | if (!tgid_map) { | ||
3028 | tr->trace_flags &= ~TRACE_ITER_RECORD_TGID; | ||
3029 | return -ENOMEM; | ||
3030 | @@ -5013,37 +5048,16 @@ static const struct file_operations tracing_readme_fops = { | ||
3031 | |||
3032 | static void *saved_tgids_next(struct seq_file *m, void *v, loff_t *pos) | ||
3033 | { | ||
3034 | - int *ptr = v; | ||
3035 | + int pid = ++(*pos); | ||
3036 | |||
3037 | - if (*pos || m->count) | ||
3038 | - ptr++; | ||
3039 | - | ||
3040 | - (*pos)++; | ||
3041 | - | ||
3042 | - for (; ptr <= &tgid_map[PID_MAX_DEFAULT]; ptr++) { | ||
3043 | - if (trace_find_tgid(*ptr)) | ||
3044 | - return ptr; | ||
3045 | - } | ||
3046 | - | ||
3047 | - return NULL; | ||
3048 | + return trace_find_tgid_ptr(pid); | ||
3049 | } | ||
3050 | |||
3051 | static void *saved_tgids_start(struct seq_file *m, loff_t *pos) | ||
3052 | { | ||
3053 | - void *v; | ||
3054 | - loff_t l = 0; | ||
3055 | + int pid = *pos; | ||
3056 | |||
3057 | - if (!tgid_map) | ||
3058 | - return NULL; | ||
3059 | - | ||
3060 | - v = &tgid_map[0]; | ||
3061 | - while (l <= *pos) { | ||
3062 | - v = saved_tgids_next(m, v, &l); | ||
3063 | - if (!v) | ||
3064 | - return NULL; | ||
3065 | - } | ||
3066 | - | ||
3067 | - return v; | ||
3068 | + return trace_find_tgid_ptr(pid); | ||
3069 | } | ||
3070 | |||
3071 | static void saved_tgids_stop(struct seq_file *m, void *v) | ||
3072 | @@ -5052,9 +5066,14 @@ static void saved_tgids_stop(struct seq_file *m, void *v) | ||
3073 | |||
3074 | static int saved_tgids_show(struct seq_file *m, void *v) | ||
3075 | { | ||
3076 | - int pid = (int *)v - tgid_map; | ||
3077 | + int *entry = (int *)v; | ||
3078 | + int pid = entry - tgid_map; | ||
3079 | + int tgid = *entry; | ||
3080 | + | ||
3081 | + if (tgid == 0) | ||
3082 | + return SEQ_SKIP; | ||
3083 | |||
3084 | - seq_printf(m, "%d %d\n", pid, trace_find_tgid(pid)); | ||
3085 | + seq_printf(m, "%d %d\n", pid, tgid); | ||
3086 | return 0; | ||
3087 | } | ||
3088 | |||
3089 | diff --git a/lib/seq_buf.c b/lib/seq_buf.c | ||
3090 | index b15dbb6f061a5..5dd4d1d02a175 100644 | ||
3091 | --- a/lib/seq_buf.c | ||
3092 | +++ b/lib/seq_buf.c | ||
3093 | @@ -228,8 +228,10 @@ int seq_buf_putmem_hex(struct seq_buf *s, const void *mem, | ||
3094 | |||
3095 | WARN_ON(s->size == 0); | ||
3096 | |||
3097 | + BUILD_BUG_ON(MAX_MEMHEX_BYTES * 2 >= HEX_CHARS); | ||
3098 | + | ||
3099 | while (len) { | ||
3100 | - start_len = min(len, HEX_CHARS - 1); | ||
3101 | + start_len = min(len, MAX_MEMHEX_BYTES); | ||
3102 | #ifdef __BIG_ENDIAN | ||
3103 | for (i = 0, j = 0; i < start_len; i++) { | ||
3104 | #else | ||
3105 | diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c | ||
3106 | index 21a7ea9b70c8a..37b585c9e857f 100644 | ||
3107 | --- a/net/bluetooth/hci_core.c | ||
3108 | +++ b/net/bluetooth/hci_core.c | ||
3109 | @@ -1672,14 +1672,6 @@ int hci_dev_do_close(struct hci_dev *hdev) | ||
3110 | |||
3111 | BT_DBG("%s %p", hdev->name, hdev); | ||
3112 | |||
3113 | - if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) && | ||
3114 | - !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && | ||
3115 | - test_bit(HCI_UP, &hdev->flags)) { | ||
3116 | - /* Execute vendor specific shutdown routine */ | ||
3117 | - if (hdev->shutdown) | ||
3118 | - hdev->shutdown(hdev); | ||
3119 | - } | ||
3120 | - | ||
3121 | cancel_delayed_work(&hdev->power_off); | ||
3122 | |||
3123 | hci_request_cancel_all(hdev); | ||
3124 | @@ -1753,6 +1745,14 @@ int hci_dev_do_close(struct hci_dev *hdev) | ||
3125 | clear_bit(HCI_INIT, &hdev->flags); | ||
3126 | } | ||
3127 | |||
3128 | + if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) && | ||
3129 | + !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && | ||
3130 | + test_bit(HCI_UP, &hdev->flags)) { | ||
3131 | + /* Execute vendor specific shutdown routine */ | ||
3132 | + if (hdev->shutdown) | ||
3133 | + hdev->shutdown(hdev); | ||
3134 | + } | ||
3135 | + | ||
3136 | /* flush cmd work */ | ||
3137 | flush_work(&hdev->cmd_work); | ||
3138 | |||
3139 | diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c | ||
3140 | index db525321da1f8..0ae5d3cab4dc2 100644 | ||
3141 | --- a/net/bluetooth/mgmt.c | ||
3142 | +++ b/net/bluetooth/mgmt.c | ||
3143 | @@ -219,12 +219,15 @@ static u8 mgmt_status_table[] = { | ||
3144 | MGMT_STATUS_TIMEOUT, /* Instant Passed */ | ||
3145 | MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ | ||
3146 | MGMT_STATUS_FAILED, /* Transaction Collision */ | ||
3147 | + MGMT_STATUS_FAILED, /* Reserved for future use */ | ||
3148 | MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ | ||
3149 | MGMT_STATUS_REJECTED, /* QoS Rejected */ | ||
3150 | MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ | ||
3151 | MGMT_STATUS_REJECTED, /* Insufficient Security */ | ||
3152 | MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ | ||
3153 | + MGMT_STATUS_FAILED, /* Reserved for future use */ | ||
3154 | MGMT_STATUS_BUSY, /* Role Switch Pending */ | ||
3155 | + MGMT_STATUS_FAILED, /* Reserved for future use */ | ||
3156 | MGMT_STATUS_FAILED, /* Slot Violation */ | ||
3157 | MGMT_STATUS_FAILED, /* Role Switch Failed */ | ||
3158 | MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ | ||
3159 | diff --git a/net/core/dev.c b/net/core/dev.c | ||
3160 | index e226f266da9e0..3810eaf89b266 100644 | ||
3161 | --- a/net/core/dev.c | ||
3162 | +++ b/net/core/dev.c | ||
3163 | @@ -5972,11 +5972,18 @@ EXPORT_SYMBOL(napi_schedule_prep); | ||
3164 | * __napi_schedule_irqoff - schedule for receive | ||
3165 | * @n: entry to schedule | ||
3166 | * | ||
3167 | - * Variant of __napi_schedule() assuming hard irqs are masked | ||
3168 | + * Variant of __napi_schedule() assuming hard irqs are masked. | ||
3169 | + * | ||
3170 | + * On PREEMPT_RT enabled kernels this maps to __napi_schedule() | ||
3171 | + * because the interrupt disabled assumption might not be true | ||
3172 | + * due to force-threaded interrupts and spinlock substitution. | ||
3173 | */ | ||
3174 | void __napi_schedule_irqoff(struct napi_struct *n) | ||
3175 | { | ||
3176 | - ____napi_schedule(this_cpu_ptr(&softnet_data), n); | ||
3177 | + if (!IS_ENABLED(CONFIG_PREEMPT_RT)) | ||
3178 | + ____napi_schedule(this_cpu_ptr(&softnet_data), n); | ||
3179 | + else | ||
3180 | + __napi_schedule(n); | ||
3181 | } | ||
3182 | EXPORT_SYMBOL(__napi_schedule_irqoff); | ||
3183 | |||
3184 | diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c | ||
3185 | index 7a394479dd56c..f52bc9c22e5b8 100644 | ||
3186 | --- a/net/ipv4/ip_output.c | ||
3187 | +++ b/net/ipv4/ip_output.c | ||
3188 | @@ -1048,7 +1048,7 @@ static int __ip_append_data(struct sock *sk, | ||
3189 | unsigned int datalen; | ||
3190 | unsigned int fraglen; | ||
3191 | unsigned int fraggap; | ||
3192 | - unsigned int alloclen; | ||
3193 | + unsigned int alloclen, alloc_extra; | ||
3194 | unsigned int pagedlen; | ||
3195 | struct sk_buff *skb_prev; | ||
3196 | alloc_new_skb: | ||
3197 | @@ -1068,35 +1068,39 @@ alloc_new_skb: | ||
3198 | fraglen = datalen + fragheaderlen; | ||
3199 | pagedlen = 0; | ||
3200 | |||
3201 | + alloc_extra = hh_len + 15; | ||
3202 | + alloc_extra += exthdrlen; | ||
3203 | + | ||
3204 | + /* The last fragment gets additional space at tail. | ||
3205 | + * Note, with MSG_MORE we overallocate on fragments, | ||
3206 | + * because we have no idea what fragment will be | ||
3207 | + * the last. | ||
3208 | + */ | ||
3209 | + if (datalen == length + fraggap) | ||
3210 | + alloc_extra += rt->dst.trailer_len; | ||
3211 | + | ||
3212 | if ((flags & MSG_MORE) && | ||
3213 | !(rt->dst.dev->features&NETIF_F_SG)) | ||
3214 | alloclen = mtu; | ||
3215 | - else if (!paged) | ||
3216 | + else if (!paged && | ||
3217 | + (fraglen + alloc_extra < SKB_MAX_ALLOC || | ||
3218 | + !(rt->dst.dev->features & NETIF_F_SG))) | ||
3219 | alloclen = fraglen; | ||
3220 | else { | ||
3221 | alloclen = min_t(int, fraglen, MAX_HEADER); | ||
3222 | pagedlen = fraglen - alloclen; | ||
3223 | } | ||
3224 | |||
3225 | - alloclen += exthdrlen; | ||
3226 | - | ||
3227 | - /* The last fragment gets additional space at tail. | ||
3228 | - * Note, with MSG_MORE we overallocate on fragments, | ||
3229 | - * because we have no idea what fragment will be | ||
3230 | - * the last. | ||
3231 | - */ | ||
3232 | - if (datalen == length + fraggap) | ||
3233 | - alloclen += rt->dst.trailer_len; | ||
3234 | + alloclen += alloc_extra; | ||
3235 | |||
3236 | if (transhdrlen) { | ||
3237 | - skb = sock_alloc_send_skb(sk, | ||
3238 | - alloclen + hh_len + 15, | ||
3239 | + skb = sock_alloc_send_skb(sk, alloclen, | ||
3240 | (flags & MSG_DONTWAIT), &err); | ||
3241 | } else { | ||
3242 | skb = NULL; | ||
3243 | if (refcount_read(&sk->sk_wmem_alloc) + wmem_alloc_delta <= | ||
3244 | 2 * sk->sk_sndbuf) | ||
3245 | - skb = alloc_skb(alloclen + hh_len + 15, | ||
3246 | + skb = alloc_skb(alloclen, | ||
3247 | sk->sk_allocation); | ||
3248 | if (unlikely(!skb)) | ||
3249 | err = -ENOBUFS; | ||
3250 | diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c | ||
3251 | index 7a80c42fcce2f..4dcbb1ccab25f 100644 | ||
3252 | --- a/net/ipv6/ip6_output.c | ||
3253 | +++ b/net/ipv6/ip6_output.c | ||
3254 | @@ -1484,7 +1484,7 @@ emsgsize: | ||
3255 | unsigned int datalen; | ||
3256 | unsigned int fraglen; | ||
3257 | unsigned int fraggap; | ||
3258 | - unsigned int alloclen; | ||
3259 | + unsigned int alloclen, alloc_extra; | ||
3260 | unsigned int pagedlen; | ||
3261 | alloc_new_skb: | ||
3262 | /* There's no room in the current skb */ | ||
3263 | @@ -1511,17 +1511,28 @@ alloc_new_skb: | ||
3264 | fraglen = datalen + fragheaderlen; | ||
3265 | pagedlen = 0; | ||
3266 | |||
3267 | + alloc_extra = hh_len; | ||
3268 | + alloc_extra += dst_exthdrlen; | ||
3269 | + alloc_extra += rt->dst.trailer_len; | ||
3270 | + | ||
3271 | + /* We just reserve space for fragment header. | ||
3272 | + * Note: this may be overallocation if the message | ||
3273 | + * (without MSG_MORE) fits into the MTU. | ||
3274 | + */ | ||
3275 | + alloc_extra += sizeof(struct frag_hdr); | ||
3276 | + | ||
3277 | if ((flags & MSG_MORE) && | ||
3278 | !(rt->dst.dev->features&NETIF_F_SG)) | ||
3279 | alloclen = mtu; | ||
3280 | - else if (!paged) | ||
3281 | + else if (!paged && | ||
3282 | + (fraglen + alloc_extra < SKB_MAX_ALLOC || | ||
3283 | + !(rt->dst.dev->features & NETIF_F_SG))) | ||
3284 | alloclen = fraglen; | ||
3285 | else { | ||
3286 | alloclen = min_t(int, fraglen, MAX_HEADER); | ||
3287 | pagedlen = fraglen - alloclen; | ||
3288 | } | ||
3289 | - | ||
3290 | - alloclen += dst_exthdrlen; | ||
3291 | + alloclen += alloc_extra; | ||
3292 | |||
3293 | if (datalen != length + fraggap) { | ||
3294 | /* | ||
3295 | @@ -1531,30 +1542,21 @@ alloc_new_skb: | ||
3296 | datalen += rt->dst.trailer_len; | ||
3297 | } | ||
3298 | |||
3299 | - alloclen += rt->dst.trailer_len; | ||
3300 | fraglen = datalen + fragheaderlen; | ||
3301 | |||
3302 | - /* | ||
3303 | - * We just reserve space for fragment header. | ||
3304 | - * Note: this may be overallocation if the message | ||
3305 | - * (without MSG_MORE) fits into the MTU. | ||
3306 | - */ | ||
3307 | - alloclen += sizeof(struct frag_hdr); | ||
3308 | - | ||
3309 | copy = datalen - transhdrlen - fraggap - pagedlen; | ||
3310 | if (copy < 0) { | ||
3311 | err = -EINVAL; | ||
3312 | goto error; | ||
3313 | } | ||
3314 | if (transhdrlen) { | ||
3315 | - skb = sock_alloc_send_skb(sk, | ||
3316 | - alloclen + hh_len, | ||
3317 | + skb = sock_alloc_send_skb(sk, alloclen, | ||
3318 | (flags & MSG_DONTWAIT), &err); | ||
3319 | } else { | ||
3320 | skb = NULL; | ||
3321 | if (refcount_read(&sk->sk_wmem_alloc) + wmem_alloc_delta <= | ||
3322 | 2 * sk->sk_sndbuf) | ||
3323 | - skb = alloc_skb(alloclen + hh_len, | ||
3324 | + skb = alloc_skb(alloclen, | ||
3325 | sk->sk_allocation); | ||
3326 | if (unlikely(!skb)) | ||
3327 | err = -ENOBUFS; | ||
3328 | diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c | ||
3329 | index af36acc1a6448..2880dc7d9a491 100644 | ||
3330 | --- a/net/ipv6/output_core.c | ||
3331 | +++ b/net/ipv6/output_core.c | ||
3332 | @@ -15,29 +15,11 @@ static u32 __ipv6_select_ident(struct net *net, | ||
3333 | const struct in6_addr *dst, | ||
3334 | const struct in6_addr *src) | ||
3335 | { | ||
3336 | - const struct { | ||
3337 | - struct in6_addr dst; | ||
3338 | - struct in6_addr src; | ||
3339 | - } __aligned(SIPHASH_ALIGNMENT) combined = { | ||
3340 | - .dst = *dst, | ||
3341 | - .src = *src, | ||
3342 | - }; | ||
3343 | - u32 hash, id; | ||
3344 | - | ||
3345 | - /* Note the following code is not safe, but this is okay. */ | ||
3346 | - if (unlikely(siphash_key_is_zero(&net->ipv4.ip_id_key))) | ||
3347 | - get_random_bytes(&net->ipv4.ip_id_key, | ||
3348 | - sizeof(net->ipv4.ip_id_key)); | ||
3349 | - | ||
3350 | - hash = siphash(&combined, sizeof(combined), &net->ipv4.ip_id_key); | ||
3351 | - | ||
3352 | - /* Treat id of 0 as unset and if we get 0 back from ip_idents_reserve, | ||
3353 | - * set the hight order instead thus minimizing possible future | ||
3354 | - * collisions. | ||
3355 | - */ | ||
3356 | - id = ip_idents_reserve(hash, 1); | ||
3357 | - if (unlikely(!id)) | ||
3358 | - id = 1 << 31; | ||
3359 | + u32 id; | ||
3360 | + | ||
3361 | + do { | ||
3362 | + id = prandom_u32(); | ||
3363 | + } while (!id); | ||
3364 | |||
3365 | return id; | ||
3366 | } | ||
3367 | diff --git a/net/sched/act_api.c b/net/sched/act_api.c | ||
3368 | index 716cad6773184..17e5cd9ebd89f 100644 | ||
3369 | --- a/net/sched/act_api.c | ||
3370 | +++ b/net/sched/act_api.c | ||
3371 | @@ -316,7 +316,8 @@ static int tcf_del_walker(struct tcf_idrinfo *idrinfo, struct sk_buff *skb, | ||
3372 | } | ||
3373 | mutex_unlock(&idrinfo->lock); | ||
3374 | |||
3375 | - if (nla_put_u32(skb, TCA_FCNT, n_i)) | ||
3376 | + ret = nla_put_u32(skb, TCA_FCNT, n_i); | ||
3377 | + if (ret) | ||
3378 | goto nla_put_failure; | ||
3379 | nla_nest_end(skb, nest); | ||
3380 | |||
3381 | diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c | ||
3382 | index 701c5a4e441d9..a825e74d01fca 100644 | ||
3383 | --- a/net/sctp/bind_addr.c | ||
3384 | +++ b/net/sctp/bind_addr.c | ||
3385 | @@ -270,22 +270,19 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list, | ||
3386 | rawaddr = (union sctp_addr_param *)raw_addr_list; | ||
3387 | |||
3388 | af = sctp_get_af_specific(param_type2af(param->type)); | ||
3389 | - if (unlikely(!af)) { | ||
3390 | + if (unlikely(!af) || | ||
3391 | + !af->from_addr_param(&addr, rawaddr, htons(port), 0)) { | ||
3392 | retval = -EINVAL; | ||
3393 | - sctp_bind_addr_clean(bp); | ||
3394 | - break; | ||
3395 | + goto out_err; | ||
3396 | } | ||
3397 | |||
3398 | - af->from_addr_param(&addr, rawaddr, htons(port), 0); | ||
3399 | if (sctp_bind_addr_state(bp, &addr) != -1) | ||
3400 | goto next; | ||
3401 | retval = sctp_add_bind_addr(bp, &addr, sizeof(addr), | ||
3402 | SCTP_ADDR_SRC, gfp); | ||
3403 | - if (retval) { | ||
3404 | + if (retval) | ||
3405 | /* Can't finish building the list, clean up. */ | ||
3406 | - sctp_bind_addr_clean(bp); | ||
3407 | - break; | ||
3408 | - } | ||
3409 | + goto out_err; | ||
3410 | |||
3411 | next: | ||
3412 | len = ntohs(param->length); | ||
3413 | @@ -294,6 +291,12 @@ next: | ||
3414 | } | ||
3415 | |||
3416 | return retval; | ||
3417 | + | ||
3418 | +out_err: | ||
3419 | + if (retval) | ||
3420 | + sctp_bind_addr_clean(bp); | ||
3421 | + | ||
3422 | + return retval; | ||
3423 | } | ||
3424 | |||
3425 | /******************************************************************** | ||
3426 | diff --git a/net/sctp/input.c b/net/sctp/input.c | ||
3427 | index 7807754f69c56..ab84ebf1af4a6 100644 | ||
3428 | --- a/net/sctp/input.c | ||
3429 | +++ b/net/sctp/input.c | ||
3430 | @@ -1131,7 +1131,8 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct net *net, | ||
3431 | if (!af) | ||
3432 | continue; | ||
3433 | |||
3434 | - af->from_addr_param(paddr, params.addr, sh->source, 0); | ||
3435 | + if (!af->from_addr_param(paddr, params.addr, sh->source, 0)) | ||
3436 | + continue; | ||
3437 | |||
3438 | asoc = __sctp_lookup_association(net, laddr, paddr, transportp); | ||
3439 | if (asoc) | ||
3440 | @@ -1174,7 +1175,8 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( | ||
3441 | if (unlikely(!af)) | ||
3442 | return NULL; | ||
3443 | |||
3444 | - af->from_addr_param(&paddr, param, peer_port, 0); | ||
3445 | + if (af->from_addr_param(&paddr, param, peer_port, 0)) | ||
3446 | + return NULL; | ||
3447 | |||
3448 | return __sctp_lookup_association(net, laddr, &paddr, transportp); | ||
3449 | } | ||
3450 | @@ -1245,7 +1247,7 @@ static struct sctp_association *__sctp_rcv_walk_lookup(struct net *net, | ||
3451 | |||
3452 | ch = (struct sctp_chunkhdr *)ch_end; | ||
3453 | chunk_num++; | ||
3454 | - } while (ch_end < skb_tail_pointer(skb)); | ||
3455 | + } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb)); | ||
3456 | |||
3457 | return asoc; | ||
3458 | } | ||
3459 | diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c | ||
3460 | index 52c92b8d827fd..fae6157e837aa 100644 | ||
3461 | --- a/net/sctp/ipv6.c | ||
3462 | +++ b/net/sctp/ipv6.c | ||
3463 | @@ -530,15 +530,20 @@ static void sctp_v6_to_sk_daddr(union sctp_addr *addr, struct sock *sk) | ||
3464 | } | ||
3465 | |||
3466 | /* Initialize a sctp_addr from an address parameter. */ | ||
3467 | -static void sctp_v6_from_addr_param(union sctp_addr *addr, | ||
3468 | +static bool sctp_v6_from_addr_param(union sctp_addr *addr, | ||
3469 | union sctp_addr_param *param, | ||
3470 | __be16 port, int iif) | ||
3471 | { | ||
3472 | + if (ntohs(param->v6.param_hdr.length) < sizeof(struct sctp_ipv6addr_param)) | ||
3473 | + return false; | ||
3474 | + | ||
3475 | addr->v6.sin6_family = AF_INET6; | ||
3476 | addr->v6.sin6_port = port; | ||
3477 | addr->v6.sin6_flowinfo = 0; /* BUG */ | ||
3478 | addr->v6.sin6_addr = param->v6.addr; | ||
3479 | addr->v6.sin6_scope_id = iif; | ||
3480 | + | ||
3481 | + return true; | ||
3482 | } | ||
3483 | |||
3484 | /* Initialize an address parameter from a sctp_addr and return the length | ||
3485 | diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c | ||
3486 | index 981c7cbca46ad..7f8702abc7bfe 100644 | ||
3487 | --- a/net/sctp/protocol.c | ||
3488 | +++ b/net/sctp/protocol.c | ||
3489 | @@ -253,14 +253,19 @@ static void sctp_v4_to_sk_daddr(union sctp_addr *addr, struct sock *sk) | ||
3490 | } | ||
3491 | |||
3492 | /* Initialize a sctp_addr from an address parameter. */ | ||
3493 | -static void sctp_v4_from_addr_param(union sctp_addr *addr, | ||
3494 | +static bool sctp_v4_from_addr_param(union sctp_addr *addr, | ||
3495 | union sctp_addr_param *param, | ||
3496 | __be16 port, int iif) | ||
3497 | { | ||
3498 | + if (ntohs(param->v4.param_hdr.length) < sizeof(struct sctp_ipv4addr_param)) | ||
3499 | + return false; | ||
3500 | + | ||
3501 | addr->v4.sin_family = AF_INET; | ||
3502 | addr->v4.sin_port = port; | ||
3503 | addr->v4.sin_addr.s_addr = param->v4.addr.s_addr; | ||
3504 | memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); | ||
3505 | + | ||
3506 | + return true; | ||
3507 | } | ||
3508 | |||
3509 | /* Initialize an address parameter from a sctp_addr and return the length | ||
3510 | diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c | ||
3511 | index 4ffb9116b6f27..38ca7ce8a44ed 100644 | ||
3512 | --- a/net/sctp/sm_make_chunk.c | ||
3513 | +++ b/net/sctp/sm_make_chunk.c | ||
3514 | @@ -2337,11 +2337,13 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk, | ||
3515 | |||
3516 | /* Process the initialization parameters. */ | ||
3517 | sctp_walk_params(param, peer_init, init_hdr.params) { | ||
3518 | - if (!src_match && (param.p->type == SCTP_PARAM_IPV4_ADDRESS || | ||
3519 | - param.p->type == SCTP_PARAM_IPV6_ADDRESS)) { | ||
3520 | + if (!src_match && | ||
3521 | + (param.p->type == SCTP_PARAM_IPV4_ADDRESS || | ||
3522 | + param.p->type == SCTP_PARAM_IPV6_ADDRESS)) { | ||
3523 | af = sctp_get_af_specific(param_type2af(param.p->type)); | ||
3524 | - af->from_addr_param(&addr, param.addr, | ||
3525 | - chunk->sctp_hdr->source, 0); | ||
3526 | + if (!af->from_addr_param(&addr, param.addr, | ||
3527 | + chunk->sctp_hdr->source, 0)) | ||
3528 | + continue; | ||
3529 | if (sctp_cmp_addr_exact(sctp_source(chunk), &addr)) | ||
3530 | src_match = 1; | ||
3531 | } | ||
3532 | @@ -2522,7 +2524,8 @@ static int sctp_process_param(struct sctp_association *asoc, | ||
3533 | break; | ||
3534 | do_addr_param: | ||
3535 | af = sctp_get_af_specific(param_type2af(param.p->type)); | ||
3536 | - af->from_addr_param(&addr, param.addr, htons(asoc->peer.port), 0); | ||
3537 | + if (!af->from_addr_param(&addr, param.addr, htons(asoc->peer.port), 0)) | ||
3538 | + break; | ||
3539 | scope = sctp_scope(peer_addr); | ||
3540 | if (sctp_in_scope(net, &addr, scope)) | ||
3541 | if (!sctp_assoc_add_peer(asoc, &addr, gfp, SCTP_UNCONFIRMED)) | ||
3542 | @@ -2623,15 +2626,13 @@ do_addr_param: | ||
3543 | addr_param = param.v + sizeof(struct sctp_addip_param); | ||
3544 | |||
3545 | af = sctp_get_af_specific(param_type2af(addr_param->p.type)); | ||
3546 | - if (af == NULL) | ||
3547 | + if (!af) | ||
3548 | break; | ||
3549 | |||
3550 | - af->from_addr_param(&addr, addr_param, | ||
3551 | - htons(asoc->peer.port), 0); | ||
3552 | + if (!af->from_addr_param(&addr, addr_param, | ||
3553 | + htons(asoc->peer.port), 0)) | ||
3554 | + break; | ||
3555 | |||
3556 | - /* if the address is invalid, we can't process it. | ||
3557 | - * XXX: see spec for what to do. | ||
3558 | - */ | ||
3559 | if (!af->addr_valid(&addr, NULL, NULL)) | ||
3560 | break; | ||
3561 | |||
3562 | @@ -3045,7 +3046,8 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc, | ||
3563 | if (unlikely(!af)) | ||
3564 | return SCTP_ERROR_DNS_FAILED; | ||
3565 | |||
3566 | - af->from_addr_param(&addr, addr_param, htons(asoc->peer.port), 0); | ||
3567 | + if (!af->from_addr_param(&addr, addr_param, htons(asoc->peer.port), 0)) | ||
3568 | + return SCTP_ERROR_DNS_FAILED; | ||
3569 | |||
3570 | /* ADDIP 4.2.1 This parameter MUST NOT contain a broadcast | ||
3571 | * or multicast address. | ||
3572 | @@ -3322,7 +3324,8 @@ static void sctp_asconf_param_success(struct sctp_association *asoc, | ||
3573 | |||
3574 | /* We have checked the packet before, so we do not check again. */ | ||
3575 | af = sctp_get_af_specific(param_type2af(addr_param->p.type)); | ||
3576 | - af->from_addr_param(&addr, addr_param, htons(bp->port), 0); | ||
3577 | + if (!af->from_addr_param(&addr, addr_param, htons(bp->port), 0)) | ||
3578 | + return; | ||
3579 | |||
3580 | switch (asconf_param->param_hdr.type) { | ||
3581 | case SCTP_PARAM_ADD_IP: | ||
3582 | diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c | ||
3583 | index c82e7b52ab1f8..d4104144bab1b 100644 | ||
3584 | --- a/net/vmw_vsock/af_vsock.c | ||
3585 | +++ b/net/vmw_vsock/af_vsock.c | ||
3586 | @@ -1217,7 +1217,7 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr, | ||
3587 | |||
3588 | if (signal_pending(current)) { | ||
3589 | err = sock_intr_errno(timeout); | ||
3590 | - sk->sk_state = TCP_CLOSE; | ||
3591 | + sk->sk_state = sk->sk_state == TCP_ESTABLISHED ? TCP_CLOSING : TCP_CLOSE; | ||
3592 | sock->state = SS_UNCONNECTED; | ||
3593 | vsock_transport_cancel_pkt(vsk); | ||
3594 | goto out_wait; | ||
3595 | diff --git a/net/wireless/wext-spy.c b/net/wireless/wext-spy.c | ||
3596 | index 33bef22e44e95..b379a03716539 100644 | ||
3597 | --- a/net/wireless/wext-spy.c | ||
3598 | +++ b/net/wireless/wext-spy.c | ||
3599 | @@ -120,8 +120,8 @@ int iw_handler_set_thrspy(struct net_device * dev, | ||
3600 | return -EOPNOTSUPP; | ||
3601 | |||
3602 | /* Just do it */ | ||
3603 | - memcpy(&(spydata->spy_thr_low), &(threshold->low), | ||
3604 | - 2 * sizeof(struct iw_quality)); | ||
3605 | + spydata->spy_thr_low = threshold->low; | ||
3606 | + spydata->spy_thr_high = threshold->high; | ||
3607 | |||
3608 | /* Clear flag */ | ||
3609 | memset(spydata->spy_thr_under, '\0', sizeof(spydata->spy_thr_under)); | ||
3610 | @@ -147,8 +147,8 @@ int iw_handler_get_thrspy(struct net_device * dev, | ||
3611 | return -EOPNOTSUPP; | ||
3612 | |||
3613 | /* Just do it */ | ||
3614 | - memcpy(&(threshold->low), &(spydata->spy_thr_low), | ||
3615 | - 2 * sizeof(struct iw_quality)); | ||
3616 | + threshold->low = spydata->spy_thr_low; | ||
3617 | + threshold->high = spydata->spy_thr_high; | ||
3618 | |||
3619 | return 0; | ||
3620 | } | ||
3621 | @@ -173,10 +173,10 @@ static void iw_send_thrspy_event(struct net_device * dev, | ||
3622 | memcpy(threshold.addr.sa_data, address, ETH_ALEN); | ||
3623 | threshold.addr.sa_family = ARPHRD_ETHER; | ||
3624 | /* Copy stats */ | ||
3625 | - memcpy(&(threshold.qual), wstats, sizeof(struct iw_quality)); | ||
3626 | + threshold.qual = *wstats; | ||
3627 | /* Copy also thresholds */ | ||
3628 | - memcpy(&(threshold.low), &(spydata->spy_thr_low), | ||
3629 | - 2 * sizeof(struct iw_quality)); | ||
3630 | + threshold.low = spydata->spy_thr_low; | ||
3631 | + threshold.high = spydata->spy_thr_high; | ||
3632 | |||
3633 | /* Send event to user space */ | ||
3634 | wireless_send_event(dev, SIOCGIWTHRSPY, &wrqu, (char *) &threshold); | ||
3635 | diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c | ||
3636 | index fbb7d9d064787..0cee2d3c6e452 100644 | ||
3637 | --- a/net/xfrm/xfrm_user.c | ||
3638 | +++ b/net/xfrm/xfrm_user.c | ||
3639 | @@ -580,6 +580,20 @@ static struct xfrm_state *xfrm_state_construct(struct net *net, | ||
3640 | |||
3641 | copy_from_user_state(x, p); | ||
3642 | |||
3643 | + if (attrs[XFRMA_ENCAP]) { | ||
3644 | + x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]), | ||
3645 | + sizeof(*x->encap), GFP_KERNEL); | ||
3646 | + if (x->encap == NULL) | ||
3647 | + goto error; | ||
3648 | + } | ||
3649 | + | ||
3650 | + if (attrs[XFRMA_COADDR]) { | ||
3651 | + x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]), | ||
3652 | + sizeof(*x->coaddr), GFP_KERNEL); | ||
3653 | + if (x->coaddr == NULL) | ||
3654 | + goto error; | ||
3655 | + } | ||
3656 | + | ||
3657 | if (attrs[XFRMA_SA_EXTRA_FLAGS]) | ||
3658 | x->props.extra_flags = nla_get_u32(attrs[XFRMA_SA_EXTRA_FLAGS]); | ||
3659 | |||
3660 | @@ -600,23 +614,9 @@ static struct xfrm_state *xfrm_state_construct(struct net *net, | ||
3661 | attrs[XFRMA_ALG_COMP]))) | ||
3662 | goto error; | ||
3663 | |||
3664 | - if (attrs[XFRMA_ENCAP]) { | ||
3665 | - x->encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]), | ||
3666 | - sizeof(*x->encap), GFP_KERNEL); | ||
3667 | - if (x->encap == NULL) | ||
3668 | - goto error; | ||
3669 | - } | ||
3670 | - | ||
3671 | if (attrs[XFRMA_TFCPAD]) | ||
3672 | x->tfcpad = nla_get_u32(attrs[XFRMA_TFCPAD]); | ||
3673 | |||
3674 | - if (attrs[XFRMA_COADDR]) { | ||
3675 | - x->coaddr = kmemdup(nla_data(attrs[XFRMA_COADDR]), | ||
3676 | - sizeof(*x->coaddr), GFP_KERNEL); | ||
3677 | - if (x->coaddr == NULL) | ||
3678 | - goto error; | ||
3679 | - } | ||
3680 | - | ||
3681 | xfrm_mark_get(attrs, &x->mark); | ||
3682 | |||
3683 | xfrm_smark_init(attrs, &x->props.smark); | ||
3684 | diff --git a/security/selinux/avc.c b/security/selinux/avc.c | ||
3685 | index d18cb32a242ae..4a744b1cebc8d 100644 | ||
3686 | --- a/security/selinux/avc.c | ||
3687 | +++ b/security/selinux/avc.c | ||
3688 | @@ -294,26 +294,27 @@ static struct avc_xperms_decision_node | ||
3689 | struct avc_xperms_decision_node *xpd_node; | ||
3690 | struct extended_perms_decision *xpd; | ||
3691 | |||
3692 | - xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, GFP_NOWAIT); | ||
3693 | + xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, | ||
3694 | + GFP_NOWAIT | __GFP_NOWARN); | ||
3695 | if (!xpd_node) | ||
3696 | return NULL; | ||
3697 | |||
3698 | xpd = &xpd_node->xpd; | ||
3699 | if (which & XPERMS_ALLOWED) { | ||
3700 | xpd->allowed = kmem_cache_zalloc(avc_xperms_data_cachep, | ||
3701 | - GFP_NOWAIT); | ||
3702 | + GFP_NOWAIT | __GFP_NOWARN); | ||
3703 | if (!xpd->allowed) | ||
3704 | goto error; | ||
3705 | } | ||
3706 | if (which & XPERMS_AUDITALLOW) { | ||
3707 | xpd->auditallow = kmem_cache_zalloc(avc_xperms_data_cachep, | ||
3708 | - GFP_NOWAIT); | ||
3709 | + GFP_NOWAIT | __GFP_NOWARN); | ||
3710 | if (!xpd->auditallow) | ||
3711 | goto error; | ||
3712 | } | ||
3713 | if (which & XPERMS_DONTAUDIT) { | ||
3714 | xpd->dontaudit = kmem_cache_zalloc(avc_xperms_data_cachep, | ||
3715 | - GFP_NOWAIT); | ||
3716 | + GFP_NOWAIT | __GFP_NOWARN); | ||
3717 | if (!xpd->dontaudit) | ||
3718 | goto error; | ||
3719 | } | ||
3720 | @@ -341,7 +342,7 @@ static struct avc_xperms_node *avc_xperms_alloc(void) | ||
3721 | { | ||
3722 | struct avc_xperms_node *xp_node; | ||
3723 | |||
3724 | - xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT); | ||
3725 | + xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT | __GFP_NOWARN); | ||
3726 | if (!xp_node) | ||
3727 | return xp_node; | ||
3728 | INIT_LIST_HEAD(&xp_node->xpd_head); | ||
3729 | @@ -497,7 +498,7 @@ static struct avc_node *avc_alloc_node(struct selinux_avc *avc) | ||
3730 | { | ||
3731 | struct avc_node *node; | ||
3732 | |||
3733 | - node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT); | ||
3734 | + node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT | __GFP_NOWARN); | ||
3735 | if (!node) | ||
3736 | goto out; | ||
3737 | |||
3738 | diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c | ||
3739 | index 5e75ff2e1b14f..3823ab2c4e4be 100644 | ||
3740 | --- a/security/smack/smackfs.c | ||
3741 | +++ b/security/smack/smackfs.c | ||
3742 | @@ -855,6 +855,8 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, | ||
3743 | if (format == SMK_FIXED24_FMT && | ||
3744 | (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX)) | ||
3745 | return -EINVAL; | ||
3746 | + if (count > PAGE_SIZE) | ||
3747 | + return -EINVAL; | ||
3748 | |||
3749 | data = memdup_user_nul(buf, count); | ||
3750 | if (IS_ERR(data)) | ||
3751 | diff --git a/sound/soc/tegra/tegra_alc5632.c b/sound/soc/tegra/tegra_alc5632.c | ||
3752 | index 9e8b1497efd3e..a281ceb3c67e7 100644 | ||
3753 | --- a/sound/soc/tegra/tegra_alc5632.c | ||
3754 | +++ b/sound/soc/tegra/tegra_alc5632.c | ||
3755 | @@ -139,6 +139,7 @@ static struct snd_soc_dai_link tegra_alc5632_dai = { | ||
3756 | |||
3757 | static struct snd_soc_card snd_soc_tegra_alc5632 = { | ||
3758 | .name = "tegra-alc5632", | ||
3759 | + .driver_name = "tegra", | ||
3760 | .owner = THIS_MODULE, | ||
3761 | .dai_link = &tegra_alc5632_dai, | ||
3762 | .num_links = 1, | ||
3763 | diff --git a/sound/soc/tegra/tegra_max98090.c b/sound/soc/tegra/tegra_max98090.c | ||
3764 | index 4954a33ff46bc..30edd70e81834 100644 | ||
3765 | --- a/sound/soc/tegra/tegra_max98090.c | ||
3766 | +++ b/sound/soc/tegra/tegra_max98090.c | ||
3767 | @@ -182,6 +182,7 @@ static struct snd_soc_dai_link tegra_max98090_dai = { | ||
3768 | |||
3769 | static struct snd_soc_card snd_soc_tegra_max98090 = { | ||
3770 | .name = "tegra-max98090", | ||
3771 | + .driver_name = "tegra", | ||
3772 | .owner = THIS_MODULE, | ||
3773 | .dai_link = &tegra_max98090_dai, | ||
3774 | .num_links = 1, | ||
3775 | diff --git a/sound/soc/tegra/tegra_rt5640.c b/sound/soc/tegra/tegra_rt5640.c | ||
3776 | index d46915a3ec4cb..3d68a41040ed4 100644 | ||
3777 | --- a/sound/soc/tegra/tegra_rt5640.c | ||
3778 | +++ b/sound/soc/tegra/tegra_rt5640.c | ||
3779 | @@ -132,6 +132,7 @@ static struct snd_soc_dai_link tegra_rt5640_dai = { | ||
3780 | |||
3781 | static struct snd_soc_card snd_soc_tegra_rt5640 = { | ||
3782 | .name = "tegra-rt5640", | ||
3783 | + .driver_name = "tegra", | ||
3784 | .owner = THIS_MODULE, | ||
3785 | .dai_link = &tegra_rt5640_dai, | ||
3786 | .num_links = 1, | ||
3787 | diff --git a/sound/soc/tegra/tegra_rt5677.c b/sound/soc/tegra/tegra_rt5677.c | ||
3788 | index 81cb6cc6236e4..ae150ade94410 100644 | ||
3789 | --- a/sound/soc/tegra/tegra_rt5677.c | ||
3790 | +++ b/sound/soc/tegra/tegra_rt5677.c | ||
3791 | @@ -175,6 +175,7 @@ static struct snd_soc_dai_link tegra_rt5677_dai = { | ||
3792 | |||
3793 | static struct snd_soc_card snd_soc_tegra_rt5677 = { | ||
3794 | .name = "tegra-rt5677", | ||
3795 | + .driver_name = "tegra", | ||
3796 | .owner = THIS_MODULE, | ||
3797 | .dai_link = &tegra_rt5677_dai, | ||
3798 | .num_links = 1, | ||
3799 | diff --git a/sound/soc/tegra/tegra_sgtl5000.c b/sound/soc/tegra/tegra_sgtl5000.c | ||
3800 | index e13b81d29cf35..fe21d9eff8c05 100644 | ||
3801 | --- a/sound/soc/tegra/tegra_sgtl5000.c | ||
3802 | +++ b/sound/soc/tegra/tegra_sgtl5000.c | ||
3803 | @@ -97,6 +97,7 @@ static struct snd_soc_dai_link tegra_sgtl5000_dai = { | ||
3804 | |||
3805 | static struct snd_soc_card snd_soc_tegra_sgtl5000 = { | ||
3806 | .name = "tegra-sgtl5000", | ||
3807 | + .driver_name = "tegra", | ||
3808 | .owner = THIS_MODULE, | ||
3809 | .dai_link = &tegra_sgtl5000_dai, | ||
3810 | .num_links = 1, | ||
3811 | diff --git a/sound/soc/tegra/tegra_wm8753.c b/sound/soc/tegra/tegra_wm8753.c | ||
3812 | index f6dd790dad71c..a2362a2189dce 100644 | ||
3813 | --- a/sound/soc/tegra/tegra_wm8753.c | ||
3814 | +++ b/sound/soc/tegra/tegra_wm8753.c | ||
3815 | @@ -101,6 +101,7 @@ static struct snd_soc_dai_link tegra_wm8753_dai = { | ||
3816 | |||
3817 | static struct snd_soc_card snd_soc_tegra_wm8753 = { | ||
3818 | .name = "tegra-wm8753", | ||
3819 | + .driver_name = "tegra", | ||
3820 | .owner = THIS_MODULE, | ||
3821 | .dai_link = &tegra_wm8753_dai, | ||
3822 | .num_links = 1, | ||
3823 | diff --git a/sound/soc/tegra/tegra_wm8903.c b/sound/soc/tegra/tegra_wm8903.c | ||
3824 | index 0fa01cacfec9a..08bcc94dcff89 100644 | ||
3825 | --- a/sound/soc/tegra/tegra_wm8903.c | ||
3826 | +++ b/sound/soc/tegra/tegra_wm8903.c | ||
3827 | @@ -217,6 +217,7 @@ static struct snd_soc_dai_link tegra_wm8903_dai = { | ||
3828 | |||
3829 | static struct snd_soc_card snd_soc_tegra_wm8903 = { | ||
3830 | .name = "tegra-wm8903", | ||
3831 | + .driver_name = "tegra", | ||
3832 | .owner = THIS_MODULE, | ||
3833 | .dai_link = &tegra_wm8903_dai, | ||
3834 | .num_links = 1, | ||
3835 | diff --git a/sound/soc/tegra/tegra_wm9712.c b/sound/soc/tegra/tegra_wm9712.c | ||
3836 | index b85bd9f890737..232eac58373aa 100644 | ||
3837 | --- a/sound/soc/tegra/tegra_wm9712.c | ||
3838 | +++ b/sound/soc/tegra/tegra_wm9712.c | ||
3839 | @@ -54,6 +54,7 @@ static struct snd_soc_dai_link tegra_wm9712_dai = { | ||
3840 | |||
3841 | static struct snd_soc_card snd_soc_tegra_wm9712 = { | ||
3842 | .name = "tegra-wm9712", | ||
3843 | + .driver_name = "tegra", | ||
3844 | .owner = THIS_MODULE, | ||
3845 | .dai_link = &tegra_wm9712_dai, | ||
3846 | .num_links = 1, | ||
3847 | diff --git a/sound/soc/tegra/trimslice.c b/sound/soc/tegra/trimslice.c | ||
3848 | index 3f67ddd13674e..5086bc2446d23 100644 | ||
3849 | --- a/sound/soc/tegra/trimslice.c | ||
3850 | +++ b/sound/soc/tegra/trimslice.c | ||
3851 | @@ -94,6 +94,7 @@ static struct snd_soc_dai_link trimslice_tlv320aic23_dai = { | ||
3852 | |||
3853 | static struct snd_soc_card snd_soc_trimslice = { | ||
3854 | .name = "tegra-trimslice", | ||
3855 | + .driver_name = "tegra", | ||
3856 | .owner = THIS_MODULE, | ||
3857 | .dai_link = &trimslice_tlv320aic23_dai, | ||
3858 | .num_links = 1, | ||
3859 | diff --git a/tools/perf/bench/sched-messaging.c b/tools/perf/bench/sched-messaging.c | ||
3860 | index 97e4a4fb33624..b142d87337be8 100644 | ||
3861 | --- a/tools/perf/bench/sched-messaging.c | ||
3862 | +++ b/tools/perf/bench/sched-messaging.c | ||
3863 | @@ -66,11 +66,10 @@ static void fdpair(int fds[2]) | ||
3864 | /* Block until we're ready to go */ | ||
3865 | static void ready(int ready_out, int wakefd) | ||
3866 | { | ||
3867 | - char dummy; | ||
3868 | struct pollfd pollfd = { .fd = wakefd, .events = POLLIN }; | ||
3869 | |||
3870 | /* Tell them we're ready. */ | ||
3871 | - if (write(ready_out, &dummy, 1) != 1) | ||
3872 | + if (write(ready_out, "R", 1) != 1) | ||
3873 | err(EXIT_FAILURE, "CLIENT: ready write"); | ||
3874 | |||
3875 | /* Wait for "GO" signal */ | ||
3876 | @@ -85,6 +84,7 @@ static void *sender(struct sender_context *ctx) | ||
3877 | unsigned int i, j; | ||
3878 | |||
3879 | ready(ctx->ready_out, ctx->wakefd); | ||
3880 | + memset(data, 'S', sizeof(data)); | ||
3881 | |||
3882 | /* Now pump to every receiver. */ | ||
3883 | for (i = 0; i < nr_loops; i++) { |