Contents of /trunk/kernel-alx/patches-5.4/0240-5.4.141-all-fixes.patch
Parent Directory | Revision Log
Revision 3635 -
(show annotations)
(download)
Mon Oct 24 12:34:12 2022 UTC (19 months ago) by niro
File size: 47522 byte(s)
Mon Oct 24 12:34:12 2022 UTC (19 months ago) by niro
File size: 47522 byte(s)
-sync kernel patches
1 | diff --git a/Documentation/virt/kvm/mmu.txt b/Documentation/virt/kvm/mmu.txt |
2 | index ec072c6bc03f8..da1ac6a6398f6 100644 |
3 | --- a/Documentation/virt/kvm/mmu.txt |
4 | +++ b/Documentation/virt/kvm/mmu.txt |
5 | @@ -152,8 +152,8 @@ Shadow pages contain the following information: |
6 | shadow pages) so role.quadrant takes values in the range 0..3. Each |
7 | quadrant maps 1GB virtual address space. |
8 | role.access: |
9 | - Inherited guest access permissions in the form uwx. Note execute |
10 | - permission is positive, not negative. |
11 | + Inherited guest access permissions from the parent ptes in the form uwx. |
12 | + Note execute permission is positive, not negative. |
13 | role.invalid: |
14 | The page is invalid and should not be used. It is a root page that is |
15 | currently pinned (by a cpu hardware register pointing to it); once it is |
16 | diff --git a/Makefile b/Makefile |
17 | index 1cb8f72d4dcea..2bfa11d0aab36 100644 |
18 | --- a/Makefile |
19 | +++ b/Makefile |
20 | @@ -1,7 +1,7 @@ |
21 | # SPDX-License-Identifier: GPL-2.0 |
22 | VERSION = 5 |
23 | PATCHLEVEL = 4 |
24 | -SUBLEVEL = 140 |
25 | +SUBLEVEL = 141 |
26 | EXTRAVERSION = |
27 | NAME = Kleptomaniac Octopus |
28 | |
29 | diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h |
30 | index a20fc1ba607f3..d4a8ad6c6a4bb 100644 |
31 | --- a/arch/x86/kvm/paging_tmpl.h |
32 | +++ b/arch/x86/kvm/paging_tmpl.h |
33 | @@ -90,8 +90,8 @@ struct guest_walker { |
34 | gpa_t pte_gpa[PT_MAX_FULL_LEVELS]; |
35 | pt_element_t __user *ptep_user[PT_MAX_FULL_LEVELS]; |
36 | bool pte_writable[PT_MAX_FULL_LEVELS]; |
37 | - unsigned pt_access; |
38 | - unsigned pte_access; |
39 | + unsigned int pt_access[PT_MAX_FULL_LEVELS]; |
40 | + unsigned int pte_access; |
41 | gfn_t gfn; |
42 | struct x86_exception fault; |
43 | }; |
44 | @@ -406,13 +406,15 @@ retry_walk: |
45 | } |
46 | |
47 | walker->ptes[walker->level - 1] = pte; |
48 | + |
49 | + /* Convert to ACC_*_MASK flags for struct guest_walker. */ |
50 | + walker->pt_access[walker->level - 1] = FNAME(gpte_access)(pt_access ^ walk_nx_mask); |
51 | } while (!is_last_gpte(mmu, walker->level, pte)); |
52 | |
53 | pte_pkey = FNAME(gpte_pkeys)(vcpu, pte); |
54 | accessed_dirty = have_ad ? pte_access & PT_GUEST_ACCESSED_MASK : 0; |
55 | |
56 | /* Convert to ACC_*_MASK flags for struct guest_walker. */ |
57 | - walker->pt_access = FNAME(gpte_access)(pt_access ^ walk_nx_mask); |
58 | walker->pte_access = FNAME(gpte_access)(pte_access ^ walk_nx_mask); |
59 | errcode = permission_fault(vcpu, mmu, walker->pte_access, pte_pkey, access); |
60 | if (unlikely(errcode)) |
61 | @@ -451,7 +453,8 @@ retry_walk: |
62 | } |
63 | |
64 | pgprintk("%s: pte %llx pte_access %x pt_access %x\n", |
65 | - __func__, (u64)pte, walker->pte_access, walker->pt_access); |
66 | + __func__, (u64)pte, walker->pte_access, |
67 | + walker->pt_access[walker->level - 1]); |
68 | return 1; |
69 | |
70 | error: |
71 | @@ -620,7 +623,7 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gpa_t addr, |
72 | { |
73 | struct kvm_mmu_page *sp = NULL; |
74 | struct kvm_shadow_walk_iterator it; |
75 | - unsigned direct_access, access = gw->pt_access; |
76 | + unsigned int direct_access, access; |
77 | int top_level, ret; |
78 | gfn_t gfn, base_gfn; |
79 | |
80 | @@ -652,6 +655,7 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gpa_t addr, |
81 | sp = NULL; |
82 | if (!is_shadow_present_pte(*it.sptep)) { |
83 | table_gfn = gw->table_gfn[it.level - 2]; |
84 | + access = gw->pt_access[it.level - 2]; |
85 | sp = kvm_mmu_get_page(vcpu, table_gfn, addr, it.level-1, |
86 | false, access); |
87 | } |
88 | diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c |
89 | index 7341d22ed04f1..2a958dcc80f21 100644 |
90 | --- a/arch/x86/kvm/svm.c |
91 | +++ b/arch/x86/kvm/svm.c |
92 | @@ -1783,7 +1783,7 @@ static void __sev_asid_free(int asid) |
93 | |
94 | for_each_possible_cpu(cpu) { |
95 | sd = per_cpu(svm_data, cpu); |
96 | - sd->sev_vmcbs[pos] = NULL; |
97 | + sd->sev_vmcbs[asid] = NULL; |
98 | } |
99 | } |
100 | |
101 | diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c |
102 | index 3d6a6306cec77..639dc8d45e603 100644 |
103 | --- a/drivers/media/v4l2-core/v4l2-mem2mem.c |
104 | +++ b/drivers/media/v4l2-core/v4l2-mem2mem.c |
105 | @@ -635,10 +635,8 @@ static __poll_t v4l2_m2m_poll_for_data(struct file *file, |
106 | * If the last buffer was dequeued from the capture queue, |
107 | * return immediately. DQBUF will return -EPIPE. |
108 | */ |
109 | - if (dst_q->last_buffer_dequeued) { |
110 | - spin_unlock_irqrestore(&dst_q->done_lock, flags); |
111 | - return EPOLLIN | EPOLLRDNORM; |
112 | - } |
113 | + if (dst_q->last_buffer_dequeued) |
114 | + rc |= EPOLLIN | EPOLLRDNORM; |
115 | } |
116 | spin_unlock_irqrestore(&dst_q->done_lock, flags); |
117 | |
118 | diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c |
119 | index 0de52e70abcca..53dbf3e28f1ef 100644 |
120 | --- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c |
121 | +++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c |
122 | @@ -1191,9 +1191,8 @@ static int xemaclite_of_probe(struct platform_device *ofdev) |
123 | } |
124 | |
125 | dev_info(dev, |
126 | - "Xilinx EmacLite at 0x%08X mapped to 0x%08X, irq=%d\n", |
127 | - (unsigned int __force)ndev->mem_start, |
128 | - (unsigned int __force)lp->base_addr, ndev->irq); |
129 | + "Xilinx EmacLite at 0x%08X mapped to 0x%p, irq=%d\n", |
130 | + (unsigned int __force)ndev->mem_start, lp->base_addr, ndev->irq); |
131 | return 0; |
132 | |
133 | error: |
134 | diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c |
135 | index 61824bbb55887..b7e2b4a0f3c66 100644 |
136 | --- a/drivers/net/ppp/ppp_generic.c |
137 | +++ b/drivers/net/ppp/ppp_generic.c |
138 | @@ -283,7 +283,7 @@ static struct channel *ppp_find_channel(struct ppp_net *pn, int unit); |
139 | static int ppp_connect_channel(struct channel *pch, int unit); |
140 | static int ppp_disconnect_channel(struct channel *pch); |
141 | static void ppp_destroy_channel(struct channel *pch); |
142 | -static int unit_get(struct idr *p, void *ptr); |
143 | +static int unit_get(struct idr *p, void *ptr, int min); |
144 | static int unit_set(struct idr *p, void *ptr, int n); |
145 | static void unit_put(struct idr *p, int n); |
146 | static void *unit_find(struct idr *p, int n); |
147 | @@ -959,9 +959,20 @@ static int ppp_unit_register(struct ppp *ppp, int unit, bool ifname_is_set) |
148 | mutex_lock(&pn->all_ppp_mutex); |
149 | |
150 | if (unit < 0) { |
151 | - ret = unit_get(&pn->units_idr, ppp); |
152 | + ret = unit_get(&pn->units_idr, ppp, 0); |
153 | if (ret < 0) |
154 | goto err; |
155 | + if (!ifname_is_set) { |
156 | + while (1) { |
157 | + snprintf(ppp->dev->name, IFNAMSIZ, "ppp%i", ret); |
158 | + if (!__dev_get_by_name(ppp->ppp_net, ppp->dev->name)) |
159 | + break; |
160 | + unit_put(&pn->units_idr, ret); |
161 | + ret = unit_get(&pn->units_idr, ppp, ret + 1); |
162 | + if (ret < 0) |
163 | + goto err; |
164 | + } |
165 | + } |
166 | } else { |
167 | /* Caller asked for a specific unit number. Fail with -EEXIST |
168 | * if unavailable. For backward compatibility, return -EEXIST |
169 | @@ -3294,9 +3305,9 @@ static int unit_set(struct idr *p, void *ptr, int n) |
170 | } |
171 | |
172 | /* get new free unit number and associate pointer with it */ |
173 | -static int unit_get(struct idr *p, void *ptr) |
174 | +static int unit_get(struct idr *p, void *ptr, int min) |
175 | { |
176 | - return idr_alloc(p, ptr, 0, 0, GFP_KERNEL); |
177 | + return idr_alloc(p, ptr, min, 0, GFP_KERNEL); |
178 | } |
179 | |
180 | /* put unit number back to a pool */ |
181 | diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c |
182 | index 4b5069f88d786..3a54455d9ddff 100644 |
183 | --- a/drivers/tee/optee/call.c |
184 | +++ b/drivers/tee/optee/call.c |
185 | @@ -181,7 +181,7 @@ static struct tee_shm *get_msg_arg(struct tee_context *ctx, size_t num_params, |
186 | struct optee_msg_arg *ma; |
187 | |
188 | shm = tee_shm_alloc(ctx, OPTEE_MSG_GET_ARG_SIZE(num_params), |
189 | - TEE_SHM_MAPPED); |
190 | + TEE_SHM_MAPPED | TEE_SHM_PRIV); |
191 | if (IS_ERR(shm)) |
192 | return shm; |
193 | |
194 | diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c |
195 | index 432dd38921dd9..4bb4c8f28cbd7 100644 |
196 | --- a/drivers/tee/optee/core.c |
197 | +++ b/drivers/tee/optee/core.c |
198 | @@ -254,7 +254,8 @@ static void optee_release(struct tee_context *ctx) |
199 | if (!ctxdata) |
200 | return; |
201 | |
202 | - shm = tee_shm_alloc(ctx, sizeof(struct optee_msg_arg), TEE_SHM_MAPPED); |
203 | + shm = tee_shm_alloc(ctx, sizeof(struct optee_msg_arg), |
204 | + TEE_SHM_MAPPED | TEE_SHM_PRIV); |
205 | if (!IS_ERR(shm)) { |
206 | arg = tee_shm_get_va(shm, 0); |
207 | /* |
208 | diff --git a/drivers/tee/optee/rpc.c b/drivers/tee/optee/rpc.c |
209 | index b4ade54d1f280..aecf62016e7b8 100644 |
210 | --- a/drivers/tee/optee/rpc.c |
211 | +++ b/drivers/tee/optee/rpc.c |
212 | @@ -220,7 +220,7 @@ static void handle_rpc_func_cmd_shm_alloc(struct tee_context *ctx, |
213 | shm = cmd_alloc_suppl(ctx, sz); |
214 | break; |
215 | case OPTEE_MSG_RPC_SHM_TYPE_KERNEL: |
216 | - shm = tee_shm_alloc(ctx, sz, TEE_SHM_MAPPED); |
217 | + shm = tee_shm_alloc(ctx, sz, TEE_SHM_MAPPED | TEE_SHM_PRIV); |
218 | break; |
219 | default: |
220 | arg->ret = TEEC_ERROR_BAD_PARAMETERS; |
221 | @@ -405,7 +405,8 @@ void optee_handle_rpc(struct tee_context *ctx, struct optee_rpc_param *param, |
222 | |
223 | switch (OPTEE_SMC_RETURN_GET_RPC_FUNC(param->a0)) { |
224 | case OPTEE_SMC_RPC_FUNC_ALLOC: |
225 | - shm = tee_shm_alloc(ctx, param->a1, TEE_SHM_MAPPED); |
226 | + shm = tee_shm_alloc(ctx, param->a1, |
227 | + TEE_SHM_MAPPED | TEE_SHM_PRIV); |
228 | if (!IS_ERR(shm) && !tee_shm_get_pa(shm, 0, &pa)) { |
229 | reg_pair_from_64(¶m->a1, ¶m->a2, pa); |
230 | reg_pair_from_64(¶m->a4, ¶m->a5, |
231 | diff --git a/drivers/tee/optee/shm_pool.c b/drivers/tee/optee/shm_pool.c |
232 | index da06ce9b9313e..c41a9a501a6e9 100644 |
233 | --- a/drivers/tee/optee/shm_pool.c |
234 | +++ b/drivers/tee/optee/shm_pool.c |
235 | @@ -27,7 +27,11 @@ static int pool_op_alloc(struct tee_shm_pool_mgr *poolm, |
236 | shm->paddr = page_to_phys(page); |
237 | shm->size = PAGE_SIZE << order; |
238 | |
239 | - if (shm->flags & TEE_SHM_DMA_BUF) { |
240 | + /* |
241 | + * Shared memory private to the OP-TEE driver doesn't need |
242 | + * to be registered with OP-TEE. |
243 | + */ |
244 | + if (!(shm->flags & TEE_SHM_PRIV)) { |
245 | unsigned int nr_pages = 1 << order, i; |
246 | struct page **pages; |
247 | |
248 | @@ -60,7 +64,7 @@ err: |
249 | static void pool_op_free(struct tee_shm_pool_mgr *poolm, |
250 | struct tee_shm *shm) |
251 | { |
252 | - if (shm->flags & TEE_SHM_DMA_BUF) |
253 | + if (!(shm->flags & TEE_SHM_PRIV)) |
254 | optee_shm_unregister(shm->ctx, shm); |
255 | |
256 | free_pages((unsigned long)shm->kaddr, get_order(shm->size)); |
257 | diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c |
258 | index 1b4b4a1ba91d9..d6491e973fa4c 100644 |
259 | --- a/drivers/tee/tee_shm.c |
260 | +++ b/drivers/tee/tee_shm.c |
261 | @@ -117,7 +117,7 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx, |
262 | return ERR_PTR(-EINVAL); |
263 | } |
264 | |
265 | - if ((flags & ~(TEE_SHM_MAPPED | TEE_SHM_DMA_BUF))) { |
266 | + if ((flags & ~(TEE_SHM_MAPPED | TEE_SHM_DMA_BUF | TEE_SHM_PRIV))) { |
267 | dev_err(teedev->dev.parent, "invalid shm flags 0x%x", flags); |
268 | return ERR_PTR(-EINVAL); |
269 | } |
270 | @@ -233,7 +233,7 @@ EXPORT_SYMBOL_GPL(tee_shm_priv_alloc); |
271 | */ |
272 | struct tee_shm *tee_shm_alloc_kernel_buf(struct tee_context *ctx, size_t size) |
273 | { |
274 | - return tee_shm_alloc(ctx, size, TEE_SHM_MAPPED | TEE_SHM_DMA_BUF); |
275 | + return tee_shm_alloc(ctx, size, TEE_SHM_MAPPED); |
276 | } |
277 | EXPORT_SYMBOL_GPL(tee_shm_alloc_kernel_buf); |
278 | |
279 | diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c |
280 | index 03b444f753aa2..4f28122f1bb83 100644 |
281 | --- a/drivers/usb/dwc3/ep0.c |
282 | +++ b/drivers/usb/dwc3/ep0.c |
283 | @@ -197,7 +197,7 @@ int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request, |
284 | int ret; |
285 | |
286 | spin_lock_irqsave(&dwc->lock, flags); |
287 | - if (!dep->endpoint.desc) { |
288 | + if (!dep->endpoint.desc || !dwc->pullups_connected) { |
289 | dev_err(dwc->dev, "%s: can't queue to disabled endpoint\n", |
290 | dep->name); |
291 | ret = -ESHUTDOWN; |
292 | diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c |
293 | index 9cf66636b19d5..8a3752fcf7b46 100644 |
294 | --- a/drivers/usb/dwc3/gadget.c |
295 | +++ b/drivers/usb/dwc3/gadget.c |
296 | @@ -746,8 +746,6 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) |
297 | |
298 | trace_dwc3_gadget_ep_disable(dep); |
299 | |
300 | - dwc3_remove_requests(dwc, dep); |
301 | - |
302 | /* make sure HW endpoint isn't stalled */ |
303 | if (dep->flags & DWC3_EP_STALL) |
304 | __dwc3_gadget_ep_set_halt(dep, 0, false); |
305 | @@ -756,16 +754,18 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep) |
306 | reg &= ~DWC3_DALEPENA_EP(dep->number); |
307 | dwc3_writel(dwc->regs, DWC3_DALEPENA, reg); |
308 | |
309 | - dep->stream_capable = false; |
310 | - dep->type = 0; |
311 | - dep->flags = 0; |
312 | - |
313 | /* Clear out the ep descriptors for non-ep0 */ |
314 | if (dep->number > 1) { |
315 | dep->endpoint.comp_desc = NULL; |
316 | dep->endpoint.desc = NULL; |
317 | } |
318 | |
319 | + dwc3_remove_requests(dwc, dep); |
320 | + |
321 | + dep->stream_capable = false; |
322 | + dep->type = 0; |
323 | + dep->flags = 0; |
324 | + |
325 | return 0; |
326 | } |
327 | |
328 | @@ -1511,7 +1511,7 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req) |
329 | { |
330 | struct dwc3 *dwc = dep->dwc; |
331 | |
332 | - if (!dep->endpoint.desc) { |
333 | + if (!dep->endpoint.desc || !dwc->pullups_connected || !dwc->connected) { |
334 | dev_err(dwc->dev, "%s: can't queue to disabled endpoint\n", |
335 | dep->name); |
336 | return -ESHUTDOWN; |
337 | @@ -1931,6 +1931,21 @@ static int dwc3_gadget_set_selfpowered(struct usb_gadget *g, |
338 | return 0; |
339 | } |
340 | |
341 | +static void dwc3_stop_active_transfers(struct dwc3 *dwc) |
342 | +{ |
343 | + u32 epnum; |
344 | + |
345 | + for (epnum = 2; epnum < dwc->num_eps; epnum++) { |
346 | + struct dwc3_ep *dep; |
347 | + |
348 | + dep = dwc->eps[epnum]; |
349 | + if (!dep) |
350 | + continue; |
351 | + |
352 | + dwc3_remove_requests(dwc, dep); |
353 | + } |
354 | +} |
355 | + |
356 | static int dwc3_gadget_run_stop(struct dwc3 *dwc, int is_on, int suspend) |
357 | { |
358 | u32 reg; |
359 | @@ -1976,6 +1991,10 @@ static int dwc3_gadget_run_stop(struct dwc3 *dwc, int is_on, int suspend) |
360 | return 0; |
361 | } |
362 | |
363 | +static void dwc3_gadget_disable_irq(struct dwc3 *dwc); |
364 | +static void __dwc3_gadget_stop(struct dwc3 *dwc); |
365 | +static int __dwc3_gadget_start(struct dwc3 *dwc); |
366 | + |
367 | static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) |
368 | { |
369 | struct dwc3 *dwc = gadget_to_dwc(g); |
370 | @@ -1999,9 +2018,73 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) |
371 | } |
372 | } |
373 | |
374 | + /* |
375 | + * Avoid issuing a runtime resume if the device is already in the |
376 | + * suspended state during gadget disconnect. DWC3 gadget was already |
377 | + * halted/stopped during runtime suspend. |
378 | + */ |
379 | + if (!is_on) { |
380 | + pm_runtime_barrier(dwc->dev); |
381 | + if (pm_runtime_suspended(dwc->dev)) |
382 | + return 0; |
383 | + } |
384 | + |
385 | + /* |
386 | + * Check the return value for successful resume, or error. For a |
387 | + * successful resume, the DWC3 runtime PM resume routine will handle |
388 | + * the run stop sequence, so avoid duplicate operations here. |
389 | + */ |
390 | + ret = pm_runtime_get_sync(dwc->dev); |
391 | + if (!ret || ret < 0) { |
392 | + pm_runtime_put(dwc->dev); |
393 | + return 0; |
394 | + } |
395 | + |
396 | + /* |
397 | + * Synchronize and disable any further event handling while controller |
398 | + * is being enabled/disabled. |
399 | + */ |
400 | + disable_irq(dwc->irq_gadget); |
401 | + |
402 | spin_lock_irqsave(&dwc->lock, flags); |
403 | + |
404 | + if (!is_on) { |
405 | + u32 count; |
406 | + |
407 | + dwc->connected = false; |
408 | + /* |
409 | + * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a |
410 | + * Section 4.1.8 Table 4-7, it states that for a device-initiated |
411 | + * disconnect, the SW needs to ensure that it sends "a DEPENDXFER |
412 | + * command for any active transfers" before clearing the RunStop |
413 | + * bit. |
414 | + */ |
415 | + dwc3_stop_active_transfers(dwc); |
416 | + __dwc3_gadget_stop(dwc); |
417 | + |
418 | + /* |
419 | + * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a |
420 | + * Section 1.3.4, it mentions that for the DEVCTRLHLT bit, the |
421 | + * "software needs to acknowledge the events that are generated |
422 | + * (by writing to GEVNTCOUNTn) while it is waiting for this bit |
423 | + * to be set to '1'." |
424 | + */ |
425 | + count = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0)); |
426 | + count &= DWC3_GEVNTCOUNT_MASK; |
427 | + if (count > 0) { |
428 | + dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), count); |
429 | + dwc->ev_buf->lpos = (dwc->ev_buf->lpos + count) % |
430 | + dwc->ev_buf->length; |
431 | + } |
432 | + } else { |
433 | + __dwc3_gadget_start(dwc); |
434 | + } |
435 | + |
436 | ret = dwc3_gadget_run_stop(dwc, is_on, false); |
437 | spin_unlock_irqrestore(&dwc->lock, flags); |
438 | + enable_irq(dwc->irq_gadget); |
439 | + |
440 | + pm_runtime_put(dwc->dev); |
441 | |
442 | return ret; |
443 | } |
444 | @@ -2174,10 +2257,6 @@ static int dwc3_gadget_start(struct usb_gadget *g, |
445 | } |
446 | |
447 | dwc->gadget_driver = driver; |
448 | - |
449 | - if (pm_runtime_active(dwc->dev)) |
450 | - __dwc3_gadget_start(dwc); |
451 | - |
452 | spin_unlock_irqrestore(&dwc->lock, flags); |
453 | |
454 | return 0; |
455 | @@ -2203,13 +2282,6 @@ static int dwc3_gadget_stop(struct usb_gadget *g) |
456 | unsigned long flags; |
457 | |
458 | spin_lock_irqsave(&dwc->lock, flags); |
459 | - |
460 | - if (pm_runtime_suspended(dwc->dev)) |
461 | - goto out; |
462 | - |
463 | - __dwc3_gadget_stop(dwc); |
464 | - |
465 | -out: |
466 | dwc->gadget_driver = NULL; |
467 | spin_unlock_irqrestore(&dwc->lock, flags); |
468 | |
469 | @@ -2995,8 +3067,6 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc) |
470 | { |
471 | u32 reg; |
472 | |
473 | - dwc->connected = true; |
474 | - |
475 | /* |
476 | * Ideally, dwc3_reset_gadget() would trigger the function |
477 | * drivers to stop any active transfers through ep disable. |
478 | @@ -3038,6 +3108,14 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc) |
479 | } |
480 | |
481 | dwc3_reset_gadget(dwc); |
482 | + /* |
483 | + * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a |
484 | + * Section 4.1.2 Table 4-2, it states that during a USB reset, the SW |
485 | + * needs to ensure that it sends "a DEPENDXFER command for any active |
486 | + * transfers." |
487 | + */ |
488 | + dwc3_stop_active_transfers(dwc); |
489 | + dwc->connected = true; |
490 | |
491 | reg = dwc3_readl(dwc->regs, DWC3_DCTL); |
492 | reg &= ~DWC3_DCTL_TSTCTRL_MASK; |
493 | diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c |
494 | index 66713c2537653..774ccaa5aceea 100644 |
495 | --- a/drivers/usb/host/ehci-pci.c |
496 | +++ b/drivers/usb/host/ehci-pci.c |
497 | @@ -298,6 +298,9 @@ static int ehci_pci_setup(struct usb_hcd *hcd) |
498 | if (pdev->vendor == PCI_VENDOR_ID_STMICRO |
499 | && pdev->device == PCI_DEVICE_ID_STMICRO_USB_HOST) |
500 | ; /* ConneXT has no sbrn register */ |
501 | + else if (pdev->vendor == PCI_VENDOR_ID_HUAWEI |
502 | + && pdev->device == 0xa239) |
503 | + ; /* HUAWEI Kunpeng920 USB EHCI has no sbrn register */ |
504 | else |
505 | pci_read_config_byte(pdev, 0x60, &ehci->sbrn); |
506 | |
507 | diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h |
508 | index 7960359dbc700..cd77c0621a555 100644 |
509 | --- a/fs/btrfs/ctree.h |
510 | +++ b/fs/btrfs/ctree.h |
511 | @@ -504,11 +504,6 @@ enum { |
512 | * (device replace, resize, device add/delete, balance) |
513 | */ |
514 | BTRFS_FS_EXCL_OP, |
515 | - /* |
516 | - * To info transaction_kthread we need an immediate commit so it |
517 | - * doesn't need to wait for commit_interval |
518 | - */ |
519 | - BTRFS_FS_NEED_ASYNC_COMMIT, |
520 | /* |
521 | * Indicate that balance has been set up from the ioctl and is in the |
522 | * main phase. The fs_info::balance_ctl is initialized. |
523 | @@ -832,7 +827,10 @@ struct btrfs_fs_info { |
524 | */ |
525 | struct ulist *qgroup_ulist; |
526 | |
527 | - /* protect user change for quota operations */ |
528 | + /* |
529 | + * Protect user change for quota operations. If a transaction is needed, |
530 | + * it must be started before locking this lock. |
531 | + */ |
532 | struct mutex qgroup_ioctl_lock; |
533 | |
534 | /* list of dirty qgroups to be written at next commit */ |
535 | @@ -945,6 +943,8 @@ enum { |
536 | BTRFS_ROOT_DEAD_TREE, |
537 | /* The root has a log tree. Used only for subvolume roots. */ |
538 | BTRFS_ROOT_HAS_LOG_TREE, |
539 | + /* Qgroup flushing is in progress */ |
540 | + BTRFS_ROOT_QGROUP_FLUSHING, |
541 | }; |
542 | |
543 | /* |
544 | @@ -1097,6 +1097,7 @@ struct btrfs_root { |
545 | spinlock_t qgroup_meta_rsv_lock; |
546 | u64 qgroup_meta_rsv_pertrans; |
547 | u64 qgroup_meta_rsv_prealloc; |
548 | + wait_queue_head_t qgroup_flush_wait; |
549 | |
550 | /* Number of active swapfiles */ |
551 | atomic_t nr_swapfiles; |
552 | diff --git a/fs/btrfs/delalloc-space.c b/fs/btrfs/delalloc-space.c |
553 | index db9f2c58eb4af..f4f531c4aa960 100644 |
554 | --- a/fs/btrfs/delalloc-space.c |
555 | +++ b/fs/btrfs/delalloc-space.c |
556 | @@ -151,7 +151,7 @@ int btrfs_check_data_free_space(struct inode *inode, |
557 | return ret; |
558 | |
559 | /* Use new btrfs_qgroup_reserve_data to reserve precious data space. */ |
560 | - ret = btrfs_qgroup_reserve_data(inode, reserved, start, len); |
561 | + ret = btrfs_qgroup_reserve_data(BTRFS_I(inode), reserved, start, len); |
562 | if (ret < 0) |
563 | btrfs_free_reserved_data_space_noquota(inode, start, len); |
564 | else |
565 | diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c |
566 | index 3dccbbe4a6585..e96890475bac7 100644 |
567 | --- a/fs/btrfs/delayed-inode.c |
568 | +++ b/fs/btrfs/delayed-inode.c |
569 | @@ -627,7 +627,8 @@ static int btrfs_delayed_inode_reserve_metadata( |
570 | */ |
571 | if (!src_rsv || (!trans->bytes_reserved && |
572 | src_rsv->type != BTRFS_BLOCK_RSV_DELALLOC)) { |
573 | - ret = btrfs_qgroup_reserve_meta_prealloc(root, num_bytes, true); |
574 | + ret = btrfs_qgroup_reserve_meta(root, num_bytes, |
575 | + BTRFS_QGROUP_RSV_META_PREALLOC, true); |
576 | if (ret < 0) |
577 | return ret; |
578 | ret = btrfs_block_rsv_add(root, dst_rsv, num_bytes, |
579 | diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c |
580 | index 1d28333bb798c..dacd67dca43fe 100644 |
581 | --- a/fs/btrfs/disk-io.c |
582 | +++ b/fs/btrfs/disk-io.c |
583 | @@ -1154,6 +1154,7 @@ static void __setup_root(struct btrfs_root *root, struct btrfs_fs_info *fs_info, |
584 | mutex_init(&root->log_mutex); |
585 | mutex_init(&root->ordered_extent_mutex); |
586 | mutex_init(&root->delalloc_mutex); |
587 | + init_waitqueue_head(&root->qgroup_flush_wait); |
588 | init_waitqueue_head(&root->log_writer_wait); |
589 | init_waitqueue_head(&root->log_commit_wait[0]); |
590 | init_waitqueue_head(&root->log_commit_wait[1]); |
591 | @@ -1747,8 +1748,7 @@ static int transaction_kthread(void *arg) |
592 | } |
593 | |
594 | now = ktime_get_seconds(); |
595 | - if (cur->state < TRANS_STATE_BLOCKED && |
596 | - !test_bit(BTRFS_FS_NEED_ASYNC_COMMIT, &fs_info->flags) && |
597 | + if (cur->state < TRANS_STATE_COMMIT_START && |
598 | (now < cur->start_time || |
599 | now - cur->start_time < fs_info->commit_interval)) { |
600 | spin_unlock(&fs_info->trans_lock); |
601 | diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c |
602 | index f6308a7b761db..400b0717b9d44 100644 |
603 | --- a/fs/btrfs/file.c |
604 | +++ b/fs/btrfs/file.c |
605 | @@ -3149,7 +3149,7 @@ reserve_space: |
606 | &cached_state); |
607 | if (ret) |
608 | goto out; |
609 | - ret = btrfs_qgroup_reserve_data(inode, &data_reserved, |
610 | + ret = btrfs_qgroup_reserve_data(BTRFS_I(inode), &data_reserved, |
611 | alloc_start, bytes_to_reserve); |
612 | if (ret) { |
613 | unlock_extent_cached(&BTRFS_I(inode)->io_tree, lockstart, |
614 | @@ -3322,8 +3322,9 @@ static long btrfs_fallocate(struct file *file, int mode, |
615 | free_extent_map(em); |
616 | break; |
617 | } |
618 | - ret = btrfs_qgroup_reserve_data(inode, &data_reserved, |
619 | - cur_offset, last_byte - cur_offset); |
620 | + ret = btrfs_qgroup_reserve_data(BTRFS_I(inode), |
621 | + &data_reserved, cur_offset, |
622 | + last_byte - cur_offset); |
623 | if (ret < 0) { |
624 | cur_offset = last_byte; |
625 | free_extent_map(em); |
626 | diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c |
627 | index 8959d011aafa8..b044b1d910dec 100644 |
628 | --- a/fs/btrfs/inode.c |
629 | +++ b/fs/btrfs/inode.c |
630 | @@ -6375,7 +6375,7 @@ static int btrfs_dirty_inode(struct inode *inode) |
631 | return PTR_ERR(trans); |
632 | |
633 | ret = btrfs_update_inode(trans, root, inode); |
634 | - if (ret && ret == -ENOSPC) { |
635 | + if (ret && (ret == -ENOSPC || ret == -EDQUOT)) { |
636 | /* whoops, lets try again with the full transaction */ |
637 | btrfs_end_transaction(trans); |
638 | trans = btrfs_start_transaction(root, 1); |
639 | diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c |
640 | index 837bd5e29c8a0..bb034e19a2a8a 100644 |
641 | --- a/fs/btrfs/qgroup.c |
642 | +++ b/fs/btrfs/qgroup.c |
643 | @@ -11,7 +11,6 @@ |
644 | #include <linux/slab.h> |
645 | #include <linux/workqueue.h> |
646 | #include <linux/btrfs.h> |
647 | -#include <linux/sizes.h> |
648 | |
649 | #include "ctree.h" |
650 | #include "transaction.h" |
651 | @@ -887,6 +886,7 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info) |
652 | struct btrfs_key found_key; |
653 | struct btrfs_qgroup *qgroup = NULL; |
654 | struct btrfs_trans_handle *trans = NULL; |
655 | + struct ulist *ulist = NULL; |
656 | int ret = 0; |
657 | int slot; |
658 | |
659 | @@ -894,12 +894,27 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info) |
660 | if (fs_info->quota_root) |
661 | goto out; |
662 | |
663 | - fs_info->qgroup_ulist = ulist_alloc(GFP_KERNEL); |
664 | - if (!fs_info->qgroup_ulist) { |
665 | + ulist = ulist_alloc(GFP_KERNEL); |
666 | + if (!ulist) { |
667 | ret = -ENOMEM; |
668 | goto out; |
669 | } |
670 | |
671 | + /* |
672 | + * Unlock qgroup_ioctl_lock before starting the transaction. This is to |
673 | + * avoid lock acquisition inversion problems (reported by lockdep) between |
674 | + * qgroup_ioctl_lock and the vfs freeze semaphores, acquired when we |
675 | + * start a transaction. |
676 | + * After we started the transaction lock qgroup_ioctl_lock again and |
677 | + * check if someone else created the quota root in the meanwhile. If so, |
678 | + * just return success and release the transaction handle. |
679 | + * |
680 | + * Also we don't need to worry about someone else calling |
681 | + * btrfs_sysfs_add_qgroups() after we unlock and getting an error because |
682 | + * that function returns 0 (success) when the sysfs entries already exist. |
683 | + */ |
684 | + mutex_unlock(&fs_info->qgroup_ioctl_lock); |
685 | + |
686 | /* |
687 | * 1 for quota root item |
688 | * 1 for BTRFS_QGROUP_STATUS item |
689 | @@ -909,12 +924,20 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info) |
690 | * would be a lot of overkill. |
691 | */ |
692 | trans = btrfs_start_transaction(tree_root, 2); |
693 | + |
694 | + mutex_lock(&fs_info->qgroup_ioctl_lock); |
695 | if (IS_ERR(trans)) { |
696 | ret = PTR_ERR(trans); |
697 | trans = NULL; |
698 | goto out; |
699 | } |
700 | |
701 | + if (fs_info->quota_root) |
702 | + goto out; |
703 | + |
704 | + fs_info->qgroup_ulist = ulist; |
705 | + ulist = NULL; |
706 | + |
707 | /* |
708 | * initially create the quota tree |
709 | */ |
710 | @@ -1047,10 +1070,13 @@ out: |
711 | if (ret) { |
712 | ulist_free(fs_info->qgroup_ulist); |
713 | fs_info->qgroup_ulist = NULL; |
714 | - if (trans) |
715 | - btrfs_end_transaction(trans); |
716 | } |
717 | mutex_unlock(&fs_info->qgroup_ioctl_lock); |
718 | + if (ret && trans) |
719 | + btrfs_end_transaction(trans); |
720 | + else if (trans) |
721 | + ret = btrfs_end_transaction(trans); |
722 | + ulist_free(ulist); |
723 | return ret; |
724 | } |
725 | |
726 | @@ -1063,19 +1089,29 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) |
727 | mutex_lock(&fs_info->qgroup_ioctl_lock); |
728 | if (!fs_info->quota_root) |
729 | goto out; |
730 | + mutex_unlock(&fs_info->qgroup_ioctl_lock); |
731 | |
732 | /* |
733 | * 1 For the root item |
734 | * |
735 | * We should also reserve enough items for the quota tree deletion in |
736 | * btrfs_clean_quota_tree but this is not done. |
737 | + * |
738 | + * Also, we must always start a transaction without holding the mutex |
739 | + * qgroup_ioctl_lock, see btrfs_quota_enable(). |
740 | */ |
741 | trans = btrfs_start_transaction(fs_info->tree_root, 1); |
742 | + |
743 | + mutex_lock(&fs_info->qgroup_ioctl_lock); |
744 | if (IS_ERR(trans)) { |
745 | ret = PTR_ERR(trans); |
746 | + trans = NULL; |
747 | goto out; |
748 | } |
749 | |
750 | + if (!fs_info->quota_root) |
751 | + goto out; |
752 | + |
753 | clear_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags); |
754 | btrfs_qgroup_wait_for_completion(fs_info, false); |
755 | spin_lock(&fs_info->qgroup_lock); |
756 | @@ -1089,13 +1125,13 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) |
757 | ret = btrfs_clean_quota_tree(trans, quota_root); |
758 | if (ret) { |
759 | btrfs_abort_transaction(trans, ret); |
760 | - goto end_trans; |
761 | + goto out; |
762 | } |
763 | |
764 | ret = btrfs_del_root(trans, "a_root->root_key); |
765 | if (ret) { |
766 | btrfs_abort_transaction(trans, ret); |
767 | - goto end_trans; |
768 | + goto out; |
769 | } |
770 | |
771 | list_del("a_root->dirty_list); |
772 | @@ -1109,10 +1145,13 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) |
773 | free_extent_buffer(quota_root->commit_root); |
774 | kfree(quota_root); |
775 | |
776 | -end_trans: |
777 | - ret = btrfs_end_transaction(trans); |
778 | out: |
779 | mutex_unlock(&fs_info->qgroup_ioctl_lock); |
780 | + if (ret && trans) |
781 | + btrfs_end_transaction(trans); |
782 | + else if (trans) |
783 | + ret = btrfs_end_transaction(trans); |
784 | + |
785 | return ret; |
786 | } |
787 | |
788 | @@ -2840,20 +2879,8 @@ out: |
789 | return ret; |
790 | } |
791 | |
792 | -/* |
793 | - * Two limits to commit transaction in advance. |
794 | - * |
795 | - * For RATIO, it will be 1/RATIO of the remaining limit as threshold. |
796 | - * For SIZE, it will be in byte unit as threshold. |
797 | - */ |
798 | -#define QGROUP_FREE_RATIO 32 |
799 | -#define QGROUP_FREE_SIZE SZ_32M |
800 | -static bool qgroup_check_limits(struct btrfs_fs_info *fs_info, |
801 | - const struct btrfs_qgroup *qg, u64 num_bytes) |
802 | +static bool qgroup_check_limits(const struct btrfs_qgroup *qg, u64 num_bytes) |
803 | { |
804 | - u64 free; |
805 | - u64 threshold; |
806 | - |
807 | if ((qg->lim_flags & BTRFS_QGROUP_LIMIT_MAX_RFER) && |
808 | qgroup_rsv_total(qg) + (s64)qg->rfer + num_bytes > qg->max_rfer) |
809 | return false; |
810 | @@ -2862,32 +2889,6 @@ static bool qgroup_check_limits(struct btrfs_fs_info *fs_info, |
811 | qgroup_rsv_total(qg) + (s64)qg->excl + num_bytes > qg->max_excl) |
812 | return false; |
813 | |
814 | - /* |
815 | - * Even if we passed the check, it's better to check if reservation |
816 | - * for meta_pertrans is pushing us near limit. |
817 | - * If there is too much pertrans reservation or it's near the limit, |
818 | - * let's try commit transaction to free some, using transaction_kthread |
819 | - */ |
820 | - if ((qg->lim_flags & (BTRFS_QGROUP_LIMIT_MAX_RFER | |
821 | - BTRFS_QGROUP_LIMIT_MAX_EXCL))) { |
822 | - if (qg->lim_flags & BTRFS_QGROUP_LIMIT_MAX_EXCL) { |
823 | - free = qg->max_excl - qgroup_rsv_total(qg) - qg->excl; |
824 | - threshold = min_t(u64, qg->max_excl / QGROUP_FREE_RATIO, |
825 | - QGROUP_FREE_SIZE); |
826 | - } else { |
827 | - free = qg->max_rfer - qgroup_rsv_total(qg) - qg->rfer; |
828 | - threshold = min_t(u64, qg->max_rfer / QGROUP_FREE_RATIO, |
829 | - QGROUP_FREE_SIZE); |
830 | - } |
831 | - |
832 | - /* |
833 | - * Use transaction_kthread to commit transaction, so we no |
834 | - * longer need to bother nested transaction nor lock context. |
835 | - */ |
836 | - if (free < threshold) |
837 | - btrfs_commit_transaction_locksafe(fs_info); |
838 | - } |
839 | - |
840 | return true; |
841 | } |
842 | |
843 | @@ -2937,7 +2938,7 @@ static int qgroup_reserve(struct btrfs_root *root, u64 num_bytes, bool enforce, |
844 | |
845 | qg = unode_aux_to_qgroup(unode); |
846 | |
847 | - if (enforce && !qgroup_check_limits(fs_info, qg, num_bytes)) { |
848 | + if (enforce && !qgroup_check_limits(qg, num_bytes)) { |
849 | ret = -EDQUOT; |
850 | goto out; |
851 | } |
852 | @@ -3411,28 +3412,150 @@ btrfs_qgroup_rescan_resume(struct btrfs_fs_info *fs_info) |
853 | } |
854 | } |
855 | |
856 | +#define rbtree_iterate_from_safe(node, next, start) \ |
857 | + for (node = start; node && ({ next = rb_next(node); 1;}); node = next) |
858 | + |
859 | +static int qgroup_unreserve_range(struct btrfs_inode *inode, |
860 | + struct extent_changeset *reserved, u64 start, |
861 | + u64 len) |
862 | +{ |
863 | + struct rb_node *node; |
864 | + struct rb_node *next; |
865 | + struct ulist_node *entry = NULL; |
866 | + int ret = 0; |
867 | + |
868 | + node = reserved->range_changed.root.rb_node; |
869 | + while (node) { |
870 | + entry = rb_entry(node, struct ulist_node, rb_node); |
871 | + if (entry->val < start) |
872 | + node = node->rb_right; |
873 | + else if (entry) |
874 | + node = node->rb_left; |
875 | + else |
876 | + break; |
877 | + } |
878 | + |
879 | + /* Empty changeset */ |
880 | + if (!entry) |
881 | + return 0; |
882 | + |
883 | + if (entry->val > start && rb_prev(&entry->rb_node)) |
884 | + entry = rb_entry(rb_prev(&entry->rb_node), struct ulist_node, |
885 | + rb_node); |
886 | + |
887 | + rbtree_iterate_from_safe(node, next, &entry->rb_node) { |
888 | + u64 entry_start; |
889 | + u64 entry_end; |
890 | + u64 entry_len; |
891 | + int clear_ret; |
892 | + |
893 | + entry = rb_entry(node, struct ulist_node, rb_node); |
894 | + entry_start = entry->val; |
895 | + entry_end = entry->aux; |
896 | + entry_len = entry_end - entry_start + 1; |
897 | + |
898 | + if (entry_start >= start + len) |
899 | + break; |
900 | + if (entry_start + entry_len <= start) |
901 | + continue; |
902 | + /* |
903 | + * Now the entry is in [start, start + len), revert the |
904 | + * EXTENT_QGROUP_RESERVED bit. |
905 | + */ |
906 | + clear_ret = clear_extent_bits(&inode->io_tree, entry_start, |
907 | + entry_end, EXTENT_QGROUP_RESERVED); |
908 | + if (!ret && clear_ret < 0) |
909 | + ret = clear_ret; |
910 | + |
911 | + ulist_del(&reserved->range_changed, entry->val, entry->aux); |
912 | + if (likely(reserved->bytes_changed >= entry_len)) { |
913 | + reserved->bytes_changed -= entry_len; |
914 | + } else { |
915 | + WARN_ON(1); |
916 | + reserved->bytes_changed = 0; |
917 | + } |
918 | + } |
919 | + |
920 | + return ret; |
921 | +} |
922 | + |
923 | /* |
924 | - * Reserve qgroup space for range [start, start + len). |
925 | + * Try to free some space for qgroup. |
926 | * |
927 | - * This function will either reserve space from related qgroups or doing |
928 | - * nothing if the range is already reserved. |
929 | + * For qgroup, there are only 3 ways to free qgroup space: |
930 | + * - Flush nodatacow write |
931 | + * Any nodatacow write will free its reserved data space at run_delalloc_range(). |
932 | + * In theory, we should only flush nodatacow inodes, but it's not yet |
933 | + * possible, so we need to flush the whole root. |
934 | * |
935 | - * Return 0 for successful reserve |
936 | - * Return <0 for error (including -EQUOT) |
937 | + * - Wait for ordered extents |
938 | + * When ordered extents are finished, their reserved metadata is finally |
939 | + * converted to per_trans status, which can be freed by later commit |
940 | + * transaction. |
941 | * |
942 | - * NOTE: this function may sleep for memory allocation. |
943 | - * if btrfs_qgroup_reserve_data() is called multiple times with |
944 | - * same @reserved, caller must ensure when error happens it's OK |
945 | - * to free *ALL* reserved space. |
946 | + * - Commit transaction |
947 | + * This would free the meta_per_trans space. |
948 | + * In theory this shouldn't provide much space, but any more qgroup space |
949 | + * is needed. |
950 | */ |
951 | -int btrfs_qgroup_reserve_data(struct inode *inode, |
952 | +static int try_flush_qgroup(struct btrfs_root *root) |
953 | +{ |
954 | + struct btrfs_trans_handle *trans; |
955 | + int ret; |
956 | + bool can_commit = true; |
957 | + |
958 | + /* |
959 | + * We don't want to run flush again and again, so if there is a running |
960 | + * one, we won't try to start a new flush, but exit directly. |
961 | + */ |
962 | + if (test_and_set_bit(BTRFS_ROOT_QGROUP_FLUSHING, &root->state)) { |
963 | + wait_event(root->qgroup_flush_wait, |
964 | + !test_bit(BTRFS_ROOT_QGROUP_FLUSHING, &root->state)); |
965 | + return 0; |
966 | + } |
967 | + |
968 | + /* |
969 | + * If current process holds a transaction, we shouldn't flush, as we |
970 | + * assume all space reservation happens before a transaction handle is |
971 | + * held. |
972 | + * |
973 | + * But there are cases like btrfs_delayed_item_reserve_metadata() where |
974 | + * we try to reserve space with one transction handle already held. |
975 | + * In that case we can't commit transaction, but at least try to end it |
976 | + * and hope the started data writes can free some space. |
977 | + */ |
978 | + if (current->journal_info && |
979 | + current->journal_info != BTRFS_SEND_TRANS_STUB) |
980 | + can_commit = false; |
981 | + |
982 | + ret = btrfs_start_delalloc_snapshot(root); |
983 | + if (ret < 0) |
984 | + goto out; |
985 | + btrfs_wait_ordered_extents(root, U64_MAX, 0, (u64)-1); |
986 | + |
987 | + trans = btrfs_join_transaction(root); |
988 | + if (IS_ERR(trans)) { |
989 | + ret = PTR_ERR(trans); |
990 | + goto out; |
991 | + } |
992 | + |
993 | + if (can_commit) |
994 | + ret = btrfs_commit_transaction(trans); |
995 | + else |
996 | + ret = btrfs_end_transaction(trans); |
997 | +out: |
998 | + clear_bit(BTRFS_ROOT_QGROUP_FLUSHING, &root->state); |
999 | + wake_up(&root->qgroup_flush_wait); |
1000 | + return ret; |
1001 | +} |
1002 | + |
1003 | +static int qgroup_reserve_data(struct btrfs_inode *inode, |
1004 | struct extent_changeset **reserved_ret, u64 start, |
1005 | u64 len) |
1006 | { |
1007 | - struct btrfs_root *root = BTRFS_I(inode)->root; |
1008 | - struct ulist_node *unode; |
1009 | - struct ulist_iterator uiter; |
1010 | + struct btrfs_root *root = inode->root; |
1011 | struct extent_changeset *reserved; |
1012 | + bool new_reserved = false; |
1013 | u64 orig_reserved; |
1014 | u64 to_reserve; |
1015 | int ret; |
1016 | @@ -3445,6 +3568,7 @@ int btrfs_qgroup_reserve_data(struct inode *inode, |
1017 | if (WARN_ON(!reserved_ret)) |
1018 | return -EINVAL; |
1019 | if (!*reserved_ret) { |
1020 | + new_reserved = true; |
1021 | *reserved_ret = extent_changeset_alloc(); |
1022 | if (!*reserved_ret) |
1023 | return -ENOMEM; |
1024 | @@ -3452,15 +3576,15 @@ int btrfs_qgroup_reserve_data(struct inode *inode, |
1025 | reserved = *reserved_ret; |
1026 | /* Record already reserved space */ |
1027 | orig_reserved = reserved->bytes_changed; |
1028 | - ret = set_record_extent_bits(&BTRFS_I(inode)->io_tree, start, |
1029 | + ret = set_record_extent_bits(&inode->io_tree, start, |
1030 | start + len -1, EXTENT_QGROUP_RESERVED, reserved); |
1031 | |
1032 | /* Newly reserved space */ |
1033 | to_reserve = reserved->bytes_changed - orig_reserved; |
1034 | - trace_btrfs_qgroup_reserve_data(inode, start, len, |
1035 | + trace_btrfs_qgroup_reserve_data(&inode->vfs_inode, start, len, |
1036 | to_reserve, QGROUP_RESERVE); |
1037 | if (ret < 0) |
1038 | - goto cleanup; |
1039 | + goto out; |
1040 | ret = qgroup_reserve(root, to_reserve, true, BTRFS_QGROUP_RSV_DATA); |
1041 | if (ret < 0) |
1042 | goto cleanup; |
1043 | @@ -3468,23 +3592,49 @@ int btrfs_qgroup_reserve_data(struct inode *inode, |
1044 | return ret; |
1045 | |
1046 | cleanup: |
1047 | - /* cleanup *ALL* already reserved ranges */ |
1048 | - ULIST_ITER_INIT(&uiter); |
1049 | - while ((unode = ulist_next(&reserved->range_changed, &uiter))) |
1050 | - clear_extent_bit(&BTRFS_I(inode)->io_tree, unode->val, |
1051 | - unode->aux, EXTENT_QGROUP_RESERVED, 0, 0, NULL); |
1052 | - /* Also free data bytes of already reserved one */ |
1053 | - btrfs_qgroup_free_refroot(root->fs_info, root->root_key.objectid, |
1054 | - orig_reserved, BTRFS_QGROUP_RSV_DATA); |
1055 | - extent_changeset_release(reserved); |
1056 | + qgroup_unreserve_range(inode, reserved, start, len); |
1057 | +out: |
1058 | + if (new_reserved) { |
1059 | + extent_changeset_release(reserved); |
1060 | + kfree(reserved); |
1061 | + *reserved_ret = NULL; |
1062 | + } |
1063 | return ret; |
1064 | } |
1065 | |
1066 | +/* |
1067 | + * Reserve qgroup space for range [start, start + len). |
1068 | + * |
1069 | + * This function will either reserve space from related qgroups or do nothing |
1070 | + * if the range is already reserved. |
1071 | + * |
1072 | + * Return 0 for successful reservation |
1073 | + * Return <0 for error (including -EQUOT) |
1074 | + * |
1075 | + * NOTE: This function may sleep for memory allocation, dirty page flushing and |
1076 | + * commit transaction. So caller should not hold any dirty page locked. |
1077 | + */ |
1078 | +int btrfs_qgroup_reserve_data(struct btrfs_inode *inode, |
1079 | + struct extent_changeset **reserved_ret, u64 start, |
1080 | + u64 len) |
1081 | +{ |
1082 | + int ret; |
1083 | + |
1084 | + ret = qgroup_reserve_data(inode, reserved_ret, start, len); |
1085 | + if (ret <= 0 && ret != -EDQUOT) |
1086 | + return ret; |
1087 | + |
1088 | + ret = try_flush_qgroup(inode->root); |
1089 | + if (ret < 0) |
1090 | + return ret; |
1091 | + return qgroup_reserve_data(inode, reserved_ret, start, len); |
1092 | +} |
1093 | + |
1094 | /* Free ranges specified by @reserved, normally in error path */ |
1095 | -static int qgroup_free_reserved_data(struct inode *inode, |
1096 | +static int qgroup_free_reserved_data(struct btrfs_inode *inode, |
1097 | struct extent_changeset *reserved, u64 start, u64 len) |
1098 | { |
1099 | - struct btrfs_root *root = BTRFS_I(inode)->root; |
1100 | + struct btrfs_root *root = inode->root; |
1101 | struct ulist_node *unode; |
1102 | struct ulist_iterator uiter; |
1103 | struct extent_changeset changeset; |
1104 | @@ -3520,8 +3670,8 @@ static int qgroup_free_reserved_data(struct inode *inode, |
1105 | * EXTENT_QGROUP_RESERVED, we won't double free. |
1106 | * So not need to rush. |
1107 | */ |
1108 | - ret = clear_record_extent_bits(&BTRFS_I(inode)->io_tree, |
1109 | - free_start, free_start + free_len - 1, |
1110 | + ret = clear_record_extent_bits(&inode->io_tree, free_start, |
1111 | + free_start + free_len - 1, |
1112 | EXTENT_QGROUP_RESERVED, &changeset); |
1113 | if (ret < 0) |
1114 | goto out; |
1115 | @@ -3550,7 +3700,8 @@ static int __btrfs_qgroup_release_data(struct inode *inode, |
1116 | /* In release case, we shouldn't have @reserved */ |
1117 | WARN_ON(!free && reserved); |
1118 | if (free && reserved) |
1119 | - return qgroup_free_reserved_data(inode, reserved, start, len); |
1120 | + return qgroup_free_reserved_data(BTRFS_I(inode), reserved, |
1121 | + start, len); |
1122 | extent_changeset_init(&changeset); |
1123 | ret = clear_record_extent_bits(&BTRFS_I(inode)->io_tree, start, |
1124 | start + len -1, EXTENT_QGROUP_RESERVED, &changeset); |
1125 | @@ -3649,8 +3800,8 @@ static int sub_root_meta_rsv(struct btrfs_root *root, int num_bytes, |
1126 | return num_bytes; |
1127 | } |
1128 | |
1129 | -int __btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, |
1130 | - enum btrfs_qgroup_rsv_type type, bool enforce) |
1131 | +int btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, |
1132 | + enum btrfs_qgroup_rsv_type type, bool enforce) |
1133 | { |
1134 | struct btrfs_fs_info *fs_info = root->fs_info; |
1135 | int ret; |
1136 | @@ -3676,6 +3827,21 @@ int __btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, |
1137 | return ret; |
1138 | } |
1139 | |
1140 | +int __btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, |
1141 | + enum btrfs_qgroup_rsv_type type, bool enforce) |
1142 | +{ |
1143 | + int ret; |
1144 | + |
1145 | + ret = btrfs_qgroup_reserve_meta(root, num_bytes, type, enforce); |
1146 | + if (ret <= 0 && ret != -EDQUOT) |
1147 | + return ret; |
1148 | + |
1149 | + ret = try_flush_qgroup(root); |
1150 | + if (ret < 0) |
1151 | + return ret; |
1152 | + return btrfs_qgroup_reserve_meta(root, num_bytes, type, enforce); |
1153 | +} |
1154 | + |
1155 | void btrfs_qgroup_free_meta_all_pertrans(struct btrfs_root *root) |
1156 | { |
1157 | struct btrfs_fs_info *fs_info = root->fs_info; |
1158 | diff --git a/fs/btrfs/qgroup.h b/fs/btrfs/qgroup.h |
1159 | index b0420c4f5d0ef..0a2659685ad65 100644 |
1160 | --- a/fs/btrfs/qgroup.h |
1161 | +++ b/fs/btrfs/qgroup.h |
1162 | @@ -344,12 +344,13 @@ int btrfs_verify_qgroup_counts(struct btrfs_fs_info *fs_info, u64 qgroupid, |
1163 | #endif |
1164 | |
1165 | /* New io_tree based accurate qgroup reserve API */ |
1166 | -int btrfs_qgroup_reserve_data(struct inode *inode, |
1167 | +int btrfs_qgroup_reserve_data(struct btrfs_inode *inode, |
1168 | struct extent_changeset **reserved, u64 start, u64 len); |
1169 | int btrfs_qgroup_release_data(struct inode *inode, u64 start, u64 len); |
1170 | int btrfs_qgroup_free_data(struct inode *inode, |
1171 | struct extent_changeset *reserved, u64 start, u64 len); |
1172 | - |
1173 | +int btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, |
1174 | + enum btrfs_qgroup_rsv_type type, bool enforce); |
1175 | int __btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, |
1176 | enum btrfs_qgroup_rsv_type type, bool enforce); |
1177 | /* Reserve metadata space for pertrans and prealloc type */ |
1178 | diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c |
1179 | index d8e4e0bf3fc2d..e6cb95b81787f 100644 |
1180 | --- a/fs/btrfs/transaction.c |
1181 | +++ b/fs/btrfs/transaction.c |
1182 | @@ -27,7 +27,6 @@ |
1183 | |
1184 | static const unsigned int btrfs_blocked_trans_types[TRANS_STATE_MAX] = { |
1185 | [TRANS_STATE_RUNNING] = 0U, |
1186 | - [TRANS_STATE_BLOCKED] = __TRANS_START, |
1187 | [TRANS_STATE_COMMIT_START] = (__TRANS_START | __TRANS_ATTACH), |
1188 | [TRANS_STATE_COMMIT_DOING] = (__TRANS_START | |
1189 | __TRANS_ATTACH | |
1190 | @@ -388,7 +387,7 @@ int btrfs_record_root_in_trans(struct btrfs_trans_handle *trans, |
1191 | |
1192 | static inline int is_transaction_blocked(struct btrfs_transaction *trans) |
1193 | { |
1194 | - return (trans->state >= TRANS_STATE_BLOCKED && |
1195 | + return (trans->state >= TRANS_STATE_COMMIT_START && |
1196 | trans->state < TRANS_STATE_UNBLOCKED && |
1197 | !TRANS_ABORTED(trans)); |
1198 | } |
1199 | @@ -580,7 +579,7 @@ again: |
1200 | INIT_LIST_HEAD(&h->new_bgs); |
1201 | |
1202 | smp_mb(); |
1203 | - if (cur_trans->state >= TRANS_STATE_BLOCKED && |
1204 | + if (cur_trans->state >= TRANS_STATE_COMMIT_START && |
1205 | may_wait_transaction(fs_info, type)) { |
1206 | current->journal_info = h; |
1207 | btrfs_commit_transaction(h); |
1208 | @@ -797,7 +796,7 @@ int btrfs_should_end_transaction(struct btrfs_trans_handle *trans) |
1209 | struct btrfs_transaction *cur_trans = trans->transaction; |
1210 | |
1211 | smp_mb(); |
1212 | - if (cur_trans->state >= TRANS_STATE_BLOCKED || |
1213 | + if (cur_trans->state >= TRANS_STATE_COMMIT_START || |
1214 | cur_trans->delayed_refs.flushing) |
1215 | return 1; |
1216 | |
1217 | @@ -830,7 +829,6 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans, |
1218 | { |
1219 | struct btrfs_fs_info *info = trans->fs_info; |
1220 | struct btrfs_transaction *cur_trans = trans->transaction; |
1221 | - int lock = (trans->type != TRANS_JOIN_NOLOCK); |
1222 | int err = 0; |
1223 | |
1224 | if (refcount_read(&trans->use_count) > 1) { |
1225 | @@ -846,13 +844,6 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans, |
1226 | |
1227 | btrfs_trans_release_chunk_metadata(trans); |
1228 | |
1229 | - if (lock && READ_ONCE(cur_trans->state) == TRANS_STATE_BLOCKED) { |
1230 | - if (throttle) |
1231 | - return btrfs_commit_transaction(trans); |
1232 | - else |
1233 | - wake_up_process(info->transaction_kthread); |
1234 | - } |
1235 | - |
1236 | if (trans->type & __TRANS_FREEZABLE) |
1237 | sb_end_intwrite(info->sb); |
1238 | |
1239 | @@ -2306,7 +2297,6 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans) |
1240 | */ |
1241 | cur_trans->state = TRANS_STATE_COMPLETED; |
1242 | wake_up(&cur_trans->commit_wait); |
1243 | - clear_bit(BTRFS_FS_NEED_ASYNC_COMMIT, &fs_info->flags); |
1244 | |
1245 | spin_lock(&fs_info->trans_lock); |
1246 | list_del_init(&cur_trans->list); |
1247 | diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h |
1248 | index 7291a2a930751..d8a7d460e436a 100644 |
1249 | --- a/fs/btrfs/transaction.h |
1250 | +++ b/fs/btrfs/transaction.h |
1251 | @@ -13,7 +13,6 @@ |
1252 | |
1253 | enum btrfs_trans_state { |
1254 | TRANS_STATE_RUNNING, |
1255 | - TRANS_STATE_BLOCKED, |
1256 | TRANS_STATE_COMMIT_START, |
1257 | TRANS_STATE_COMMIT_DOING, |
1258 | TRANS_STATE_UNBLOCKED, |
1259 | @@ -208,20 +207,6 @@ int btrfs_clean_one_deleted_snapshot(struct btrfs_root *root); |
1260 | int btrfs_commit_transaction(struct btrfs_trans_handle *trans); |
1261 | int btrfs_commit_transaction_async(struct btrfs_trans_handle *trans, |
1262 | int wait_for_unblock); |
1263 | - |
1264 | -/* |
1265 | - * Try to commit transaction asynchronously, so this is safe to call |
1266 | - * even holding a spinlock. |
1267 | - * |
1268 | - * It's done by informing transaction_kthread to commit transaction without |
1269 | - * waiting for commit interval. |
1270 | - */ |
1271 | -static inline void btrfs_commit_transaction_locksafe( |
1272 | - struct btrfs_fs_info *fs_info) |
1273 | -{ |
1274 | - set_bit(BTRFS_FS_NEED_ASYNC_COMMIT, &fs_info->flags); |
1275 | - wake_up_process(fs_info->transaction_kthread); |
1276 | -} |
1277 | int btrfs_end_transaction_throttle(struct btrfs_trans_handle *trans); |
1278 | int btrfs_should_end_transaction(struct btrfs_trans_handle *trans); |
1279 | void btrfs_throttle(struct btrfs_fs_info *fs_info); |
1280 | diff --git a/fs/namespace.c b/fs/namespace.c |
1281 | index 76ea92994d26d..a092611d89e77 100644 |
1282 | --- a/fs/namespace.c |
1283 | +++ b/fs/namespace.c |
1284 | @@ -1861,6 +1861,20 @@ void drop_collected_mounts(struct vfsmount *mnt) |
1285 | namespace_unlock(); |
1286 | } |
1287 | |
1288 | +static bool has_locked_children(struct mount *mnt, struct dentry *dentry) |
1289 | +{ |
1290 | + struct mount *child; |
1291 | + |
1292 | + list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { |
1293 | + if (!is_subdir(child->mnt_mountpoint, dentry)) |
1294 | + continue; |
1295 | + |
1296 | + if (child->mnt.mnt_flags & MNT_LOCKED) |
1297 | + return true; |
1298 | + } |
1299 | + return false; |
1300 | +} |
1301 | + |
1302 | /** |
1303 | * clone_private_mount - create a private clone of a path |
1304 | * |
1305 | @@ -1875,14 +1889,27 @@ struct vfsmount *clone_private_mount(const struct path *path) |
1306 | struct mount *old_mnt = real_mount(path->mnt); |
1307 | struct mount *new_mnt; |
1308 | |
1309 | + down_read(&namespace_sem); |
1310 | if (IS_MNT_UNBINDABLE(old_mnt)) |
1311 | - return ERR_PTR(-EINVAL); |
1312 | + goto invalid; |
1313 | + |
1314 | + if (!check_mnt(old_mnt)) |
1315 | + goto invalid; |
1316 | + |
1317 | + if (has_locked_children(old_mnt, path->dentry)) |
1318 | + goto invalid; |
1319 | |
1320 | new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE); |
1321 | + up_read(&namespace_sem); |
1322 | + |
1323 | if (IS_ERR(new_mnt)) |
1324 | return ERR_CAST(new_mnt); |
1325 | |
1326 | return &new_mnt->mnt; |
1327 | + |
1328 | +invalid: |
1329 | + up_read(&namespace_sem); |
1330 | + return ERR_PTR(-EINVAL); |
1331 | } |
1332 | EXPORT_SYMBOL_GPL(clone_private_mount); |
1333 | |
1334 | @@ -2234,19 +2261,6 @@ static int do_change_type(struct path *path, int ms_flags) |
1335 | return err; |
1336 | } |
1337 | |
1338 | -static bool has_locked_children(struct mount *mnt, struct dentry *dentry) |
1339 | -{ |
1340 | - struct mount *child; |
1341 | - list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { |
1342 | - if (!is_subdir(child->mnt_mountpoint, dentry)) |
1343 | - continue; |
1344 | - |
1345 | - if (child->mnt.mnt_flags & MNT_LOCKED) |
1346 | - return true; |
1347 | - } |
1348 | - return false; |
1349 | -} |
1350 | - |
1351 | static struct mount *__do_loopback(struct path *old_path, int recurse) |
1352 | { |
1353 | struct mount *mnt = ERR_PTR(-EINVAL), *old = real_mount(old_path->mnt); |
1354 | diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h |
1355 | index 91677f2fa2e8b..cd15c1b7fae06 100644 |
1356 | --- a/include/linux/tee_drv.h |
1357 | +++ b/include/linux/tee_drv.h |
1358 | @@ -26,6 +26,7 @@ |
1359 | #define TEE_SHM_REGISTER BIT(3) /* Memory registered in secure world */ |
1360 | #define TEE_SHM_USER_MAPPED BIT(4) /* Memory mapped in user space */ |
1361 | #define TEE_SHM_POOL BIT(5) /* Memory allocated from pool */ |
1362 | +#define TEE_SHM_PRIV BIT(7) /* Memory private to TEE driver */ |
1363 | |
1364 | struct device; |
1365 | struct tee_device; |
1366 | diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c |
1367 | index db2b10c718ba2..e40712abe089e 100644 |
1368 | --- a/kernel/trace/trace_events_hist.c |
1369 | +++ b/kernel/trace/trace_events_hist.c |
1370 | @@ -66,7 +66,8 @@ |
1371 | C(INVALID_SUBSYS_EVENT, "Invalid subsystem or event name"), \ |
1372 | C(INVALID_REF_KEY, "Using variable references in keys not supported"), \ |
1373 | C(VAR_NOT_FOUND, "Couldn't find variable"), \ |
1374 | - C(FIELD_NOT_FOUND, "Couldn't find field"), |
1375 | + C(FIELD_NOT_FOUND, "Couldn't find field"), \ |
1376 | + C(INVALID_STR_OPERAND, "String type can not be an operand in expression"), |
1377 | |
1378 | #undef C |
1379 | #define C(a, b) HIST_ERR_##a |
1380 | @@ -3038,6 +3039,13 @@ static struct hist_field *parse_unary(struct hist_trigger_data *hist_data, |
1381 | ret = PTR_ERR(operand1); |
1382 | goto free; |
1383 | } |
1384 | + if (operand1->flags & HIST_FIELD_FL_STRING) { |
1385 | + /* String type can not be the operand of unary operator. */ |
1386 | + hist_err(file->tr, HIST_ERR_INVALID_STR_OPERAND, errpos(str)); |
1387 | + destroy_hist_field(operand1, 0); |
1388 | + ret = -EINVAL; |
1389 | + goto free; |
1390 | + } |
1391 | |
1392 | expr->flags |= operand1->flags & |
1393 | (HIST_FIELD_FL_TIMESTAMP | HIST_FIELD_FL_TIMESTAMP_USECS); |
1394 | @@ -3139,6 +3147,11 @@ static struct hist_field *parse_expr(struct hist_trigger_data *hist_data, |
1395 | operand1 = NULL; |
1396 | goto free; |
1397 | } |
1398 | + if (operand1->flags & HIST_FIELD_FL_STRING) { |
1399 | + hist_err(file->tr, HIST_ERR_INVALID_STR_OPERAND, errpos(operand1_str)); |
1400 | + ret = -EINVAL; |
1401 | + goto free; |
1402 | + } |
1403 | |
1404 | /* rest of string could be another expression e.g. b+c in a+b+c */ |
1405 | operand_flags = 0; |
1406 | @@ -3148,6 +3161,11 @@ static struct hist_field *parse_expr(struct hist_trigger_data *hist_data, |
1407 | operand2 = NULL; |
1408 | goto free; |
1409 | } |
1410 | + if (operand2->flags & HIST_FIELD_FL_STRING) { |
1411 | + hist_err(file->tr, HIST_ERR_INVALID_STR_OPERAND, errpos(str)); |
1412 | + ret = -EINVAL; |
1413 | + goto free; |
1414 | + } |
1415 | |
1416 | ret = check_expr_operands(file->tr, operand1, operand2); |
1417 | if (ret) |
1418 | diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c |
1419 | index a0d1561eeb532..f486e680aed1d 100644 |
1420 | --- a/sound/pci/hda/patch_realtek.c |
1421 | +++ b/sound/pci/hda/patch_realtek.c |
1422 | @@ -8122,6 +8122,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { |
1423 | SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC), |
1424 | SND_PCI_QUIRK(0x1043, 0x1740, "ASUS UX430UA", ALC295_FIXUP_ASUS_DACS), |
1425 | SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK), |
1426 | + SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK), |
1427 | SND_PCI_QUIRK(0x1043, 0x1881, "ASUS Zephyrus S/M", ALC294_FIXUP_ASUS_GX502_PINS), |
1428 | SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC), |
1429 | SND_PCI_QUIRK(0x1043, 0x18f1, "Asus FX505DT", ALC256_FIXUP_ASUS_HEADSET_MIC), |