diff --git a/config/kernel/linux-sunxi-current.config b/config/kernel/linux-sunxi-current.config index e0b8cc5c7a..5f7770daad 100644 --- a/config/kernel/linux-sunxi-current.config +++ b/config/kernel/linux-sunxi-current.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 5.10.18 Kernel Configuration +# Linux/arm 5.10.23 Kernel Configuration # CONFIG_CC_VERSION_TEXT="arm-linux-gnueabihf-gcc (GNU Toolchain for the A-profile Architecture 8.3-2019.03 (arm-rel-8.36)) 8.3.0" CONFIG_CC_IS_GCC=y @@ -214,6 +214,7 @@ CONFIG_BPF_SYSCALL=y # CONFIG_BPF_PRELOAD is not set # CONFIG_USERFAULTFD is not set CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y +CONFIG_KCMP=y CONFIG_RSEQ=y # CONFIG_DEBUG_RSEQ is not set # CONFIG_EMBEDDED is not set @@ -6744,7 +6745,6 @@ CONFIG_RESET_SUNXI=y # CONFIG_GENERIC_PHY=y CONFIG_GENERIC_PHY_MIPI_DPHY=y -# CONFIG_USB_LGM_PHY is not set CONFIG_PHY_SUN4I_USB=y CONFIG_PHY_SUN6I_MIPI_DPHY=y CONFIG_PHY_SUN9I_USB=y diff --git a/config/kernel/linux-sunxi-dev.config b/config/kernel/linux-sunxi-dev.config index 78e1005760..d7fb3c5434 100644 --- a/config/kernel/linux-sunxi-dev.config +++ b/config/kernel/linux-sunxi-dev.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 5.11.1 Kernel Configuration +# Linux/arm 5.11.6 Kernel Configuration # CONFIG_CC_VERSION_TEXT="arm-linux-gnueabihf-gcc (GNU Toolchain for the A-profile Architecture 8.3-2019.03 (arm-rel-8.36)) 8.3.0" CONFIG_CC_IS_GCC=y @@ -214,6 +214,7 @@ CONFIG_BPF_SYSCALL=y # CONFIG_BPF_PRELOAD is not set # CONFIG_USERFAULTFD is not set CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y +CONFIG_KCMP=y CONFIG_RSEQ=y # CONFIG_DEBUG_RSEQ is not set # CONFIG_EMBEDDED is not set @@ -6807,7 +6808,6 @@ CONFIG_RESET_SUNXI=y # CONFIG_GENERIC_PHY=y CONFIG_GENERIC_PHY_MIPI_DPHY=y -# CONFIG_USB_LGM_PHY is not set CONFIG_PHY_SUN4I_USB=y CONFIG_PHY_SUN6I_MIPI_DPHY=y CONFIG_PHY_SUN9I_USB=y diff --git a/config/kernel/linux-sunxi64-current.config b/config/kernel/linux-sunxi64-current.config index afd3beb000..7beaf8c8a6 100644 --- a/config/kernel/linux-sunxi64-current.config +++ b/config/kernel/linux-sunxi64-current.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 5.10.18 Kernel Configuration +# Linux/arm64 5.10.23 Kernel Configuration # CONFIG_CC_VERSION_TEXT="aarch64-linux-gnu-gcc (GNU Toolchain for the A-profile Architecture 8.3-2019.03 (arm-rel-8.36)) 8.3.0" CONFIG_CC_IS_GCC=y @@ -217,6 +217,7 @@ CONFIG_USERMODE_DRIVER=y # CONFIG_BPF_PRELOAD is not set # CONFIG_USERFAULTFD is not set CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y +CONFIG_KCMP=y CONFIG_RSEQ=y # CONFIG_EMBEDDED is not set CONFIG_HAVE_PERF_EVENTS=y @@ -6581,7 +6582,6 @@ CONFIG_RESET_SUNXI=y CONFIG_GENERIC_PHY=y CONFIG_GENERIC_PHY_MIPI_DPHY=y # CONFIG_PHY_XGENE is not set -# CONFIG_USB_LGM_PHY is not set CONFIG_PHY_SUN4I_USB=y CONFIG_PHY_SUN6I_MIPI_DPHY=y CONFIG_PHY_SUN9I_USB=y diff --git a/config/kernel/linux-sunxi64-dev.config b/config/kernel/linux-sunxi64-dev.config index bb1cb82bcc..f40416c9c5 100644 --- a/config/kernel/linux-sunxi64-dev.config +++ b/config/kernel/linux-sunxi64-dev.config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 5.11.1 Kernel Configuration +# Linux/arm64 5.11.6 Kernel Configuration # CONFIG_CC_VERSION_TEXT="aarch64-linux-gnu-gcc (GNU Toolchain for the A-profile Architecture 8.3-2019.03 (arm-rel-8.36)) 8.3.0" CONFIG_CC_IS_GCC=y @@ -217,6 +217,7 @@ CONFIG_USERMODE_DRIVER=y # CONFIG_BPF_PRELOAD is not set # CONFIG_USERFAULTFD is not set CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y +CONFIG_KCMP=y CONFIG_RSEQ=y # CONFIG_EMBEDDED is not set CONFIG_HAVE_PERF_EVENTS=y @@ -6648,7 +6649,6 @@ CONFIG_RESET_SUNXI=y CONFIG_GENERIC_PHY=y CONFIG_GENERIC_PHY_MIPI_DPHY=y # CONFIG_PHY_XGENE is not set -# CONFIG_USB_LGM_PHY is not set CONFIG_PHY_SUN4I_USB=y CONFIG_PHY_SUN6I_MIPI_DPHY=y CONFIG_PHY_SUN9I_USB=y diff --git a/patch/kernel/sunxi-current/patch-5.10.21-22.patch b/patch/kernel/sunxi-current/patch-5.10.21-22.patch new file mode 100644 index 0000000000..cb507f769c --- /dev/null +++ b/patch/kernel/sunxi-current/patch-5.10.21-22.patch @@ -0,0 +1,1550 @@ +diff --git a/Makefile b/Makefile +index 98ae9007e8a52..12a2a7271fcb0 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 10 +-SUBLEVEL = 21 ++SUBLEVEL = 22 + EXTRAVERSION = + NAME = Dare mighty things + +diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi +index 724ee179b316e..fae48efae83e9 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi +@@ -227,8 +227,6 @@ + "timing-adjustment"; + rx-fifo-depth = <4096>; + tx-fifo-depth = <2048>; +- resets = <&reset RESET_ETHERNET>; +- reset-names = "stmmaceth"; + status = "disabled"; + }; + +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +index a6127002573bd..959b299344e54 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +@@ -224,8 +224,6 @@ + "timing-adjustment"; + rx-fifo-depth = <4096>; + tx-fifo-depth = <2048>; +- resets = <&reset RESET_ETHERNET>; +- reset-names = "stmmaceth"; + status = "disabled"; + + mdio0: mdio { +diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +index 726b91d3a905a..0edd137151f89 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +@@ -13,7 +13,6 @@ + #include + #include + #include +-#include + #include + + / { +@@ -576,8 +575,6 @@ + interrupt-names = "macirq"; + rx-fifo-depth = <4096>; + tx-fifo-depth = <2048>; +- resets = <&reset RESET_ETHERNET>; +- reset-names = "stmmaceth"; + power-domains = <&pwrc PWRC_GXBB_ETHERNET_MEM_ID>; + status = "disabled"; + }; +diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c +index 00576a960f11f..b913844ab7404 100644 +--- a/arch/arm64/mm/init.c ++++ b/arch/arm64/mm/init.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -42,8 +43,6 @@ + #include + #include + +-#define ARM64_ZONE_DMA_BITS 30 +- + /* + * We need to be able to catch inadvertent references to memstart_addr + * that occur (potentially in generic code) before arm64_memblock_init() +@@ -188,8 +187,14 @@ static phys_addr_t __init max_zone_phys(unsigned int zone_bits) + static void __init zone_sizes_init(unsigned long min, unsigned long max) + { + unsigned long max_zone_pfns[MAX_NR_ZONES] = {0}; ++ unsigned int __maybe_unused acpi_zone_dma_bits; ++ unsigned int __maybe_unused dt_zone_dma_bits; + + #ifdef CONFIG_ZONE_DMA ++ acpi_zone_dma_bits = fls64(acpi_iort_dma_get_max_cpu_address()); ++ dt_zone_dma_bits = fls64(of_dma_get_max_cpu_address(NULL)); ++ zone_dma_bits = min3(32U, dt_zone_dma_bits, acpi_zone_dma_bits); ++ arm64_dma_phys_limit = max_zone_phys(zone_dma_bits); + max_zone_pfns[ZONE_DMA] = PFN_DOWN(arm64_dma_phys_limit); + #endif + #ifdef CONFIG_ZONE_DMA32 +@@ -376,18 +381,11 @@ void __init arm64_memblock_init(void) + + early_init_fdt_scan_reserved_mem(); + +- if (IS_ENABLED(CONFIG_ZONE_DMA)) { +- zone_dma_bits = ARM64_ZONE_DMA_BITS; +- arm64_dma_phys_limit = max_zone_phys(ARM64_ZONE_DMA_BITS); +- } +- + if (IS_ENABLED(CONFIG_ZONE_DMA32)) + arm64_dma32_phys_limit = max_zone_phys(32); + else + arm64_dma32_phys_limit = PHYS_MASK + 1; + +- reserve_crashkernel(); +- + reserve_elfcorehdr(); + + high_memory = __va(memblock_end_of_DRAM() - 1) + 1; +@@ -427,6 +425,12 @@ void __init bootmem_init(void) + sparse_init(); + zone_sizes_init(min, max); + ++ /* ++ * request_standard_resources() depends on crashkernel's memory being ++ * reserved, so do it here. ++ */ ++ reserve_crashkernel(); ++ + memblock_dump_all(); + } + +diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c +index 94f34109695c9..2494138a6905e 100644 +--- a/drivers/acpi/arm64/iort.c ++++ b/drivers/acpi/arm64/iort.c +@@ -1730,3 +1730,58 @@ void __init acpi_iort_init(void) + + iort_init_platform_devices(); + } ++ ++#ifdef CONFIG_ZONE_DMA ++/* ++ * Extract the highest CPU physical address accessible to all DMA masters in ++ * the system. PHYS_ADDR_MAX is returned when no constrained device is found. ++ */ ++phys_addr_t __init acpi_iort_dma_get_max_cpu_address(void) ++{ ++ phys_addr_t limit = PHYS_ADDR_MAX; ++ struct acpi_iort_node *node, *end; ++ struct acpi_table_iort *iort; ++ acpi_status status; ++ int i; ++ ++ if (acpi_disabled) ++ return limit; ++ ++ status = acpi_get_table(ACPI_SIG_IORT, 0, ++ (struct acpi_table_header **)&iort); ++ if (ACPI_FAILURE(status)) ++ return limit; ++ ++ node = ACPI_ADD_PTR(struct acpi_iort_node, iort, iort->node_offset); ++ end = ACPI_ADD_PTR(struct acpi_iort_node, iort, iort->header.length); ++ ++ for (i = 0; i < iort->node_count; i++) { ++ if (node >= end) ++ break; ++ ++ switch (node->type) { ++ struct acpi_iort_named_component *ncomp; ++ struct acpi_iort_root_complex *rc; ++ phys_addr_t local_limit; ++ ++ case ACPI_IORT_NODE_NAMED_COMPONENT: ++ ncomp = (struct acpi_iort_named_component *)node->node_data; ++ local_limit = DMA_BIT_MASK(ncomp->memory_address_limit); ++ limit = min_not_zero(limit, local_limit); ++ break; ++ ++ case ACPI_IORT_NODE_PCI_ROOT_COMPLEX: ++ if (node->revision < 1) ++ break; ++ ++ rc = (struct acpi_iort_root_complex *)node->node_data; ++ local_limit = DMA_BIT_MASK(rc->memory_address_limit); ++ limit = min_not_zero(limit, local_limit); ++ break; ++ } ++ node = ACPI_ADD_PTR(struct acpi_iort_node, node, node->length); ++ } ++ acpi_put_table(&iort->header); ++ return limit; ++} ++#endif +diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c +index bfda153b1a41d..87682dcb64ec3 100644 +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -325,22 +325,22 @@ static void rpm_put_suppliers(struct device *dev) + static int __rpm_callback(int (*cb)(struct device *), struct device *dev) + __releases(&dev->power.lock) __acquires(&dev->power.lock) + { +- int retval, idx; + bool use_links = dev->power.links_count > 0; ++ bool get = false; ++ int retval, idx; ++ bool put; + + if (dev->power.irq_safe) { + spin_unlock(&dev->power.lock); ++ } else if (!use_links) { ++ spin_unlock_irq(&dev->power.lock); + } else { ++ get = dev->power.runtime_status == RPM_RESUMING; ++ + spin_unlock_irq(&dev->power.lock); + +- /* +- * Resume suppliers if necessary. +- * +- * The device's runtime PM status cannot change until this +- * routine returns, so it is safe to read the status outside of +- * the lock. +- */ +- if (use_links && dev->power.runtime_status == RPM_RESUMING) { ++ /* Resume suppliers if necessary. */ ++ if (get) { + idx = device_links_read_lock(); + + retval = rpm_get_suppliers(dev); +@@ -355,24 +355,36 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev) + + if (dev->power.irq_safe) { + spin_lock(&dev->power.lock); +- } else { +- /* +- * If the device is suspending and the callback has returned +- * success, drop the usage counters of the suppliers that have +- * been reference counted on its resume. +- * +- * Do that if resume fails too. +- */ +- if (use_links +- && ((dev->power.runtime_status == RPM_SUSPENDING && !retval) +- || (dev->power.runtime_status == RPM_RESUMING && retval))) { +- idx = device_links_read_lock(); ++ return retval; ++ } + +- fail: +- rpm_put_suppliers(dev); ++ spin_lock_irq(&dev->power.lock); + +- device_links_read_unlock(idx); +- } ++ if (!use_links) ++ return retval; ++ ++ /* ++ * If the device is suspending and the callback has returned success, ++ * drop the usage counters of the suppliers that have been reference ++ * counted on its resume. ++ * ++ * Do that if the resume fails too. ++ */ ++ put = dev->power.runtime_status == RPM_SUSPENDING && !retval; ++ if (put) ++ __update_runtime_status(dev, RPM_SUSPENDED); ++ else ++ put = get && retval; ++ ++ if (put) { ++ spin_unlock_irq(&dev->power.lock); ++ ++ idx = device_links_read_lock(); ++ ++fail: ++ rpm_put_suppliers(dev); ++ ++ device_links_read_unlock(idx); + + spin_lock_irq(&dev->power.lock); + } +diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c +index 63f549889f875..5ac1881396afb 100644 +--- a/drivers/block/rsxx/core.c ++++ b/drivers/block/rsxx/core.c +@@ -165,15 +165,17 @@ static ssize_t rsxx_cram_read(struct file *fp, char __user *ubuf, + { + struct rsxx_cardinfo *card = file_inode(fp)->i_private; + char *buf; +- ssize_t st; ++ int st; + + buf = kzalloc(cnt, GFP_KERNEL); + if (!buf) + return -ENOMEM; + + st = rsxx_creg_read(card, CREG_ADD_CRAM + (u32)*ppos, cnt, buf, 1); +- if (!st) +- st = copy_to_user(ubuf, buf, cnt); ++ if (!st) { ++ if (copy_to_user(ubuf, buf, cnt)) ++ st = -EFAULT; ++ } + kfree(buf); + if (st) + return st; +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 431919d5f48af..a2e0395cbe618 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -707,12 +707,22 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip) + const char *desc = "attempting to generate an interrupt"; + u32 cap2; + cap_t cap; ++ int ret; + ++ /* TPM 2.0 */ + if (chip->flags & TPM_CHIP_FLAG_TPM2) + return tpm2_get_tpm_pt(chip, 0x100, &cap2, desc); +- else +- return tpm1_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc, +- 0); ++ ++ /* TPM 1.2 */ ++ ret = request_locality(chip, 0); ++ if (ret < 0) ++ return ret; ++ ++ ret = tpm1_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc, 0); ++ ++ release_locality(chip, 0); ++ ++ return ret; + } + + /* Register the IRQ and issue a command that will cause an interrupt. If an +@@ -1019,11 +1029,21 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + init_waitqueue_head(&priv->read_queue); + init_waitqueue_head(&priv->int_queue); + if (irq != -1) { +- /* Before doing irq testing issue a command to the TPM in polling mode ++ /* ++ * Before doing irq testing issue a command to the TPM in polling mode + * to make sure it works. May as well use that command to set the + * proper timeouts for the driver. + */ +- if (tpm_get_timeouts(chip)) { ++ ++ rc = request_locality(chip, 0); ++ if (rc < 0) ++ goto out_err; ++ ++ rc = tpm_get_timeouts(chip); ++ ++ release_locality(chip, 0); ++ ++ if (rc) { + dev_err(dev, "Could not get TPM timeouts and durations\n"); + rc = -ENODEV; + goto out_err; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +index 2d125b8b15ee1..00a190929b55c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +@@ -355,7 +355,7 @@ static ssize_t amdgpu_debugfs_regs_pcie_read(struct file *f, char __user *buf, + while (size) { + uint32_t value; + +- value = RREG32_PCIE(*pos >> 2); ++ value = RREG32_PCIE(*pos); + r = put_user(value, (uint32_t *)buf); + if (r) { + pm_runtime_mark_last_busy(adev_to_drm(adev)->dev); +@@ -422,7 +422,7 @@ static ssize_t amdgpu_debugfs_regs_pcie_write(struct file *f, const char __user + return r; + } + +- WREG32_PCIE(*pos >> 2, value); ++ WREG32_PCIE(*pos, value); + + result += 4; + buf += 4; +diff --git a/drivers/gpu/drm/amd/amdgpu/nv.c b/drivers/gpu/drm/amd/amdgpu/nv.c +index 8eeba8096493b..0af4774ddd613 100644 +--- a/drivers/gpu/drm/amd/amdgpu/nv.c ++++ b/drivers/gpu/drm/amd/amdgpu/nv.c +@@ -459,7 +459,8 @@ static bool nv_is_headless_sku(struct pci_dev *pdev) + { + if ((pdev->device == 0x731E && + (pdev->revision == 0xC6 || pdev->revision == 0xC7)) || +- (pdev->device == 0x7340 && pdev->revision == 0xC9)) ++ (pdev->device == 0x7340 && pdev->revision == 0xC9) || ++ (pdev->device == 0x7360 && pdev->revision == 0xC7)) + return true; + return false; + } +@@ -524,7 +525,8 @@ int nv_set_ip_blocks(struct amdgpu_device *adev) + if (adev->firmware.load_type == AMDGPU_FW_LOAD_DIRECT && + !amdgpu_sriov_vf(adev)) + amdgpu_device_ip_block_add(adev, &smu_v11_0_ip_block); +- amdgpu_device_ip_block_add(adev, &vcn_v2_0_ip_block); ++ if (!nv_is_headless_sku(adev->pdev)) ++ amdgpu_device_ip_block_add(adev, &vcn_v2_0_ip_block); + if (!amdgpu_sriov_vf(adev)) + amdgpu_device_ip_block_add(adev, &jpeg_v2_0_ip_block); + break; +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index 8e578f73a074c..bbba0cd42c89b 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -3650,6 +3650,7 @@ static int cm_send_sidr_rep_locked(struct cm_id_private *cm_id_priv, + struct ib_cm_sidr_rep_param *param) + { + struct ib_mad_send_buf *msg; ++ unsigned long flags; + int ret; + + lockdep_assert_held(&cm_id_priv->lock); +@@ -3675,12 +3676,12 @@ static int cm_send_sidr_rep_locked(struct cm_id_private *cm_id_priv, + return ret; + } + cm_id_priv->id.state = IB_CM_IDLE; +- spin_lock_irq(&cm.lock); ++ spin_lock_irqsave(&cm.lock, flags); + if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node)) { + rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table); + RB_CLEAR_NODE(&cm_id_priv->sidr_id_node); + } +- spin_unlock_irq(&cm.lock); ++ spin_unlock_irqrestore(&cm.lock, flags); + return 0; + } + +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index 26564e7d34572..efb9ec99b68bd 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -1973,8 +1973,10 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)( + + num_alloc_xa_entries++; + event_sub = kzalloc(sizeof(*event_sub), GFP_KERNEL); +- if (!event_sub) ++ if (!event_sub) { ++ err = -ENOMEM; + goto err; ++ } + + list_add_tail(&event_sub->event_list, &sub_list); + uverbs_uobject_get(&ev_file->uobj); +diff --git a/drivers/infiniband/sw/rxe/Kconfig b/drivers/infiniband/sw/rxe/Kconfig +index 4521490667925..06b8dc5093f77 100644 +--- a/drivers/infiniband/sw/rxe/Kconfig ++++ b/drivers/infiniband/sw/rxe/Kconfig +@@ -4,6 +4,7 @@ config RDMA_RXE + depends on INET && PCI && INFINIBAND + depends on INFINIBAND_VIRT_DMA + select NET_UDP_TUNNEL ++ select CRYPTO + select CRYPTO_CRC32 + help + This driver implements the InfiniBand RDMA transport over +diff --git a/drivers/iommu/intel/pasid.h b/drivers/iommu/intel/pasid.h +index 97dfcffbf495a..444c0bec221a4 100644 +--- a/drivers/iommu/intel/pasid.h ++++ b/drivers/iommu/intel/pasid.h +@@ -30,8 +30,8 @@ + #define VCMD_VRSP_IP 0x1 + #define VCMD_VRSP_SC(e) (((e) >> 1) & 0x3) + #define VCMD_VRSP_SC_SUCCESS 0 +-#define VCMD_VRSP_SC_NO_PASID_AVAIL 1 +-#define VCMD_VRSP_SC_INVALID_PASID 1 ++#define VCMD_VRSP_SC_NO_PASID_AVAIL 2 ++#define VCMD_VRSP_SC_INVALID_PASID 2 + #define VCMD_VRSP_RESULT_PASID(e) (((e) >> 8) & 0xfffff) + #define VCMD_CMD_OPERAND(e) ((e) << 8) + /* +diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c +index fce4cbf9529d6..50f3e673729c3 100644 +--- a/drivers/md/dm-bufio.c ++++ b/drivers/md/dm-bufio.c +@@ -1526,6 +1526,10 @@ EXPORT_SYMBOL_GPL(dm_bufio_get_block_size); + sector_t dm_bufio_get_device_size(struct dm_bufio_client *c) + { + sector_t s = i_size_read(c->bdev->bd_inode) >> SECTOR_SHIFT; ++ if (s >= c->start) ++ s -= c->start; ++ else ++ s = 0; + if (likely(c->sectors_per_block_bits >= 0)) + s >>= c->sectors_per_block_bits; + else +diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c +index fb41b4f23c489..66f4c6398f670 100644 +--- a/drivers/md/dm-verity-fec.c ++++ b/drivers/md/dm-verity-fec.c +@@ -61,19 +61,18 @@ static int fec_decode_rs8(struct dm_verity *v, struct dm_verity_fec_io *fio, + static u8 *fec_read_parity(struct dm_verity *v, u64 rsb, int index, + unsigned *offset, struct dm_buffer **buf) + { +- u64 position, block; ++ u64 position, block, rem; + u8 *res; + + position = (index + rsb) * v->fec->roots; +- block = position >> v->data_dev_block_bits; +- *offset = (unsigned)(position - (block << v->data_dev_block_bits)); ++ block = div64_u64_rem(position, v->fec->roots << SECTOR_SHIFT, &rem); ++ *offset = (unsigned)rem; + +- res = dm_bufio_read(v->fec->bufio, v->fec->start + block, buf); ++ res = dm_bufio_read(v->fec->bufio, block, buf); + if (IS_ERR(res)) { + DMERR("%s: FEC %llu: parity read failed (block %llu): %ld", + v->data_dev->name, (unsigned long long)rsb, +- (unsigned long long)(v->fec->start + block), +- PTR_ERR(res)); ++ (unsigned long long)block, PTR_ERR(res)); + *buf = NULL; + } + +@@ -155,7 +154,7 @@ static int fec_decode_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio, + + /* read the next block when we run out of parity bytes */ + offset += v->fec->roots; +- if (offset >= 1 << v->data_dev_block_bits) { ++ if (offset >= v->fec->roots << SECTOR_SHIFT) { + dm_bufio_release(buf); + + par = fec_read_parity(v, rsb, block_offset, &offset, &buf); +@@ -674,7 +673,7 @@ int verity_fec_ctr(struct dm_verity *v) + { + struct dm_verity_fec *f = v->fec; + struct dm_target *ti = v->ti; +- u64 hash_blocks; ++ u64 hash_blocks, fec_blocks; + int ret; + + if (!verity_fec_is_enabled(v)) { +@@ -744,15 +743,17 @@ int verity_fec_ctr(struct dm_verity *v) + } + + f->bufio = dm_bufio_client_create(f->dev->bdev, +- 1 << v->data_dev_block_bits, ++ f->roots << SECTOR_SHIFT, + 1, 0, NULL, NULL); + if (IS_ERR(f->bufio)) { + ti->error = "Cannot initialize FEC bufio client"; + return PTR_ERR(f->bufio); + } + +- if (dm_bufio_get_device_size(f->bufio) < +- ((f->start + f->rounds * f->roots) >> v->data_dev_block_bits)) { ++ dm_bufio_set_sector_offset(f->bufio, f->start << (v->data_dev_block_bits - SECTOR_SHIFT)); ++ ++ fec_blocks = div64_u64(f->rounds * f->roots, v->fec->roots << SECTOR_SHIFT); ++ if (dm_bufio_get_device_size(f->bufio) < fec_blocks) { + ti->error = "FEC device is too small"; + return -E2BIG; + } +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index cfcc3ac613189..b7d5eaa70a67b 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -2244,6 +2244,7 @@ static void rtl_pll_power_down(struct rtl8169_private *tp) + + switch (tp->mac_version) { + case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26: ++ case RTL_GIGA_MAC_VER_29 ... RTL_GIGA_MAC_VER_30: + case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33: + case RTL_GIGA_MAC_VER_37: + case RTL_GIGA_MAC_VER_39: +@@ -2271,6 +2272,7 @@ static void rtl_pll_power_up(struct rtl8169_private *tp) + { + switch (tp->mac_version) { + case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26: ++ case RTL_GIGA_MAC_VER_29 ... RTL_GIGA_MAC_VER_30: + case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33: + case RTL_GIGA_MAC_VER_37: + case RTL_GIGA_MAC_VER_39: +diff --git a/drivers/of/address.c b/drivers/of/address.c +index 1c3257a2d4e37..73ddf2540f3fe 100644 +--- a/drivers/of/address.c ++++ b/drivers/of/address.c +@@ -1024,6 +1024,48 @@ out: + } + #endif /* CONFIG_HAS_DMA */ + ++/** ++ * of_dma_get_max_cpu_address - Gets highest CPU address suitable for DMA ++ * @np: The node to start searching from or NULL to start from the root ++ * ++ * Gets the highest CPU physical address that is addressable by all DMA masters ++ * in the sub-tree pointed by np, or the whole tree if NULL is passed. If no ++ * DMA constrained device is found, it returns PHYS_ADDR_MAX. ++ */ ++phys_addr_t __init of_dma_get_max_cpu_address(struct device_node *np) ++{ ++ phys_addr_t max_cpu_addr = PHYS_ADDR_MAX; ++ struct of_range_parser parser; ++ phys_addr_t subtree_max_addr; ++ struct device_node *child; ++ struct of_range range; ++ const __be32 *ranges; ++ u64 cpu_end = 0; ++ int len; ++ ++ if (!np) ++ np = of_root; ++ ++ ranges = of_get_property(np, "dma-ranges", &len); ++ if (ranges && len) { ++ of_dma_range_parser_init(&parser, np); ++ for_each_of_range(&parser, &range) ++ if (range.cpu_addr + range.size > cpu_end) ++ cpu_end = range.cpu_addr + range.size - 1; ++ ++ if (max_cpu_addr > cpu_end) ++ max_cpu_addr = cpu_end; ++ } ++ ++ for_each_available_child_of_node(np, child) { ++ subtree_max_addr = of_dma_get_max_cpu_address(child); ++ if (max_cpu_addr > subtree_max_addr) ++ max_cpu_addr = subtree_max_addr; ++ } ++ ++ return max_cpu_addr; ++} ++ + /** + * of_dma_is_coherent - Check if device is coherent + * @np: device node +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index 06cc988faf78b..eb51bc1474401 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -869,6 +869,26 @@ static void __init of_unittest_changeset(void) + #endif + } + ++static void __init of_unittest_dma_get_max_cpu_address(void) ++{ ++ struct device_node *np; ++ phys_addr_t cpu_addr; ++ ++ if (!IS_ENABLED(CONFIG_OF_ADDRESS)) ++ return; ++ ++ np = of_find_node_by_path("/testcase-data/address-tests"); ++ if (!np) { ++ pr_err("missing testcase data\n"); ++ return; ++ } ++ ++ cpu_addr = of_dma_get_max_cpu_address(np); ++ unittest(cpu_addr == 0x4fffffff, ++ "of_dma_get_max_cpu_address: wrong CPU addr %pad (expecting %x)\n", ++ &cpu_addr, 0x4fffffff); ++} ++ + static void __init of_unittest_dma_ranges_one(const char *path, + u64 expect_dma_addr, u64 expect_paddr) + { +@@ -3266,6 +3286,7 @@ static int __init of_unittest(void) + of_unittest_changeset(); + of_unittest_parse_interrupts(); + of_unittest_parse_interrupts_extended(); ++ of_unittest_dma_get_max_cpu_address(); + of_unittest_parse_dma_ranges(); + of_unittest_pci_dma_ranges(); + of_unittest_match_node(); +diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c +index 9a5d652c1672e..c99e293b50f54 100644 +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -1229,6 +1229,11 @@ static int inc_block_group_ro(struct btrfs_block_group *cache, int force) + spin_lock(&sinfo->lock); + spin_lock(&cache->lock); + ++ if (cache->swap_extents) { ++ ret = -ETXTBSY; ++ goto out; ++ } ++ + if (cache->ro) { + cache->ro++; + ret = 0; +@@ -2274,7 +2279,7 @@ again: + } + + ret = inc_block_group_ro(cache, 0); +- if (!do_chunk_alloc) ++ if (!do_chunk_alloc || ret == -ETXTBSY) + goto unlock_out; + if (!ret) + goto out; +@@ -2283,6 +2288,8 @@ again: + if (ret < 0) + goto out; + ret = inc_block_group_ro(cache, 0); ++ if (ret == -ETXTBSY) ++ goto unlock_out; + out: + if (cache->flags & BTRFS_BLOCK_GROUP_SYSTEM) { + alloc_flags = btrfs_get_alloc_profile(fs_info, cache->flags); +@@ -3363,6 +3370,7 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info) + ASSERT(list_empty(&block_group->io_list)); + ASSERT(list_empty(&block_group->bg_list)); + ASSERT(refcount_read(&block_group->refs) == 1); ++ ASSERT(block_group->swap_extents == 0); + btrfs_put_block_group(block_group); + + spin_lock(&info->block_group_cache_lock); +@@ -3429,3 +3437,26 @@ void btrfs_unfreeze_block_group(struct btrfs_block_group *block_group) + __btrfs_remove_free_space_cache(block_group->free_space_ctl); + } + } ++ ++bool btrfs_inc_block_group_swap_extents(struct btrfs_block_group *bg) ++{ ++ bool ret = true; ++ ++ spin_lock(&bg->lock); ++ if (bg->ro) ++ ret = false; ++ else ++ bg->swap_extents++; ++ spin_unlock(&bg->lock); ++ ++ return ret; ++} ++ ++void btrfs_dec_block_group_swap_extents(struct btrfs_block_group *bg, int amount) ++{ ++ spin_lock(&bg->lock); ++ ASSERT(!bg->ro); ++ ASSERT(bg->swap_extents >= amount); ++ bg->swap_extents -= amount; ++ spin_unlock(&bg->lock); ++} +diff --git a/fs/btrfs/block-group.h b/fs/btrfs/block-group.h +index adfd7583a17b8..4c7614346f724 100644 +--- a/fs/btrfs/block-group.h ++++ b/fs/btrfs/block-group.h +@@ -181,6 +181,12 @@ struct btrfs_block_group { + */ + int needs_free_space; + ++ /* ++ * Number of extents in this block group used for swap files. ++ * All accesses protected by the spinlock 'lock'. ++ */ ++ int swap_extents; ++ + /* Record locked full stripes for RAID5/6 block group */ + struct btrfs_full_stripe_locks_tree full_stripe_locks_root; + }; +@@ -299,4 +305,7 @@ int btrfs_rmap_block(struct btrfs_fs_info *fs_info, u64 chunk_start, + u64 physical, u64 **logical, int *naddrs, int *stripe_len); + #endif + ++bool btrfs_inc_block_group_swap_extents(struct btrfs_block_group *bg); ++void btrfs_dec_block_group_swap_extents(struct btrfs_block_group *bg, int amount); ++ + #endif /* BTRFS_BLOCK_GROUP_H */ +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index b6884eda9ff67..bcc6848bb6d6a 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -522,6 +522,11 @@ struct btrfs_swapfile_pin { + * points to a struct btrfs_device. + */ + bool is_block_group; ++ /* ++ * Only used when 'is_block_group' is true and it is the number of ++ * extents used by a swapfile for this block group ('ptr' field). ++ */ ++ int bg_extent_count; + }; + + bool btrfs_pinned_by_swapfile(struct btrfs_fs_info *fs_info, void *ptr); +diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c +index 5aba81e161132..36e0de34ec68b 100644 +--- a/fs/btrfs/delayed-inode.c ++++ b/fs/btrfs/delayed-inode.c +@@ -649,7 +649,7 @@ static int btrfs_delayed_inode_reserve_metadata( + btrfs_ino(inode), + num_bytes, 1); + } else { +- btrfs_qgroup_free_meta_prealloc(root, fs_info->nodesize); ++ btrfs_qgroup_free_meta_prealloc(root, num_bytes); + } + return ret; + } +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index 4373da7bcc0d5..c81a20cc10dc8 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -3236,8 +3236,11 @@ reserve_space: + goto out; + ret = btrfs_qgroup_reserve_data(BTRFS_I(inode), &data_reserved, + alloc_start, bytes_to_reserve); +- if (ret) ++ if (ret) { ++ unlock_extent_cached(&BTRFS_I(inode)->io_tree, lockstart, ++ lockend, &cached_state); + goto out; ++ } + ret = btrfs_prealloc_file_range(inode, mode, alloc_start, + alloc_end - alloc_start, + i_blocksize(inode), +diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c +index ae4059ce2f84c..ba280707d5ec2 100644 +--- a/fs/btrfs/free-space-cache.c ++++ b/fs/btrfs/free-space-cache.c +@@ -2714,8 +2714,10 @@ static void __btrfs_return_cluster_to_free_space( + struct rb_node *node; + + spin_lock(&cluster->lock); +- if (cluster->block_group != block_group) +- goto out; ++ if (cluster->block_group != block_group) { ++ spin_unlock(&cluster->lock); ++ return; ++ } + + cluster->block_group = NULL; + cluster->window_start = 0; +@@ -2753,8 +2755,6 @@ static void __btrfs_return_cluster_to_free_space( + entry->offset, &entry->offset_index, bitmap); + } + cluster->root = RB_ROOT; +- +-out: + spin_unlock(&cluster->lock); + btrfs_put_block_group(block_group); + } +@@ -3034,8 +3034,6 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group *block_group, + entry->bytes -= bytes; + } + +- if (entry->bytes == 0) +- rb_erase(&entry->offset_index, &cluster->root); + break; + } + out: +@@ -3052,7 +3050,10 @@ out: + ctl->free_space -= bytes; + if (!entry->bitmap && !btrfs_free_space_trimmed(entry)) + ctl->discardable_bytes[BTRFS_STAT_CURR] -= bytes; ++ ++ spin_lock(&cluster->lock); + if (entry->bytes == 0) { ++ rb_erase(&entry->offset_index, &cluster->root); + ctl->free_extents--; + if (entry->bitmap) { + kmem_cache_free(btrfs_free_space_bitmap_cachep, +@@ -3065,6 +3066,7 @@ out: + kmem_cache_free(btrfs_free_space_cachep, entry); + } + ++ spin_unlock(&cluster->lock); + spin_unlock(&ctl->tree_lock); + + return ret; +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 4d85f3a6695d1..9b3df72ceffbb 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -9993,6 +9993,7 @@ static int btrfs_add_swapfile_pin(struct inode *inode, void *ptr, + sp->ptr = ptr; + sp->inode = inode; + sp->is_block_group = is_block_group; ++ sp->bg_extent_count = 1; + + spin_lock(&fs_info->swapfile_pins_lock); + p = &fs_info->swapfile_pins.rb_node; +@@ -10006,6 +10007,8 @@ static int btrfs_add_swapfile_pin(struct inode *inode, void *ptr, + (sp->ptr == entry->ptr && sp->inode > entry->inode)) { + p = &(*p)->rb_right; + } else { ++ if (is_block_group) ++ entry->bg_extent_count++; + spin_unlock(&fs_info->swapfile_pins_lock); + kfree(sp); + return 1; +@@ -10031,8 +10034,11 @@ static void btrfs_free_swapfile_pins(struct inode *inode) + sp = rb_entry(node, struct btrfs_swapfile_pin, node); + if (sp->inode == inode) { + rb_erase(&sp->node, &fs_info->swapfile_pins); +- if (sp->is_block_group) ++ if (sp->is_block_group) { ++ btrfs_dec_block_group_swap_extents(sp->ptr, ++ sp->bg_extent_count); + btrfs_put_block_group(sp->ptr); ++ } + kfree(sp); + } + node = next; +@@ -10093,7 +10099,8 @@ static int btrfs_swap_activate(struct swap_info_struct *sis, struct file *file, + sector_t *span) + { + struct inode *inode = file_inode(file); +- struct btrfs_fs_info *fs_info = BTRFS_I(inode)->root->fs_info; ++ struct btrfs_root *root = BTRFS_I(inode)->root; ++ struct btrfs_fs_info *fs_info = root->fs_info; + struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree; + struct extent_state *cached_state = NULL; + struct extent_map *em = NULL; +@@ -10144,13 +10151,27 @@ static int btrfs_swap_activate(struct swap_info_struct *sis, struct file *file, + "cannot activate swapfile while exclusive operation is running"); + return -EBUSY; + } ++ ++ /* ++ * Prevent snapshot creation while we are activating the swap file. ++ * We do not want to race with snapshot creation. If snapshot creation ++ * already started before we bumped nr_swapfiles from 0 to 1 and ++ * completes before the first write into the swap file after it is ++ * activated, than that write would fallback to COW. ++ */ ++ if (!btrfs_drew_try_write_lock(&root->snapshot_lock)) { ++ btrfs_exclop_finish(fs_info); ++ btrfs_warn(fs_info, ++ "cannot activate swapfile because snapshot creation is in progress"); ++ return -EINVAL; ++ } + /* + * Snapshots can create extents which require COW even if NODATACOW is + * set. We use this counter to prevent snapshots. We must increment it + * before walking the extents because we don't want a concurrent + * snapshot to run after we've already checked the extents. + */ +- atomic_inc(&BTRFS_I(inode)->root->nr_swapfiles); ++ atomic_inc(&root->nr_swapfiles); + + isize = ALIGN_DOWN(inode->i_size, fs_info->sectorsize); + +@@ -10247,6 +10268,17 @@ static int btrfs_swap_activate(struct swap_info_struct *sis, struct file *file, + goto out; + } + ++ if (!btrfs_inc_block_group_swap_extents(bg)) { ++ btrfs_warn(fs_info, ++ "block group for swapfile at %llu is read-only%s", ++ bg->start, ++ atomic_read(&fs_info->scrubs_running) ? ++ " (scrub running)" : ""); ++ btrfs_put_block_group(bg); ++ ret = -EINVAL; ++ goto out; ++ } ++ + ret = btrfs_add_swapfile_pin(inode, bg, true); + if (ret) { + btrfs_put_block_group(bg); +@@ -10285,6 +10317,8 @@ out: + if (ret) + btrfs_swap_deactivate(file); + ++ btrfs_drew_write_unlock(&root->snapshot_lock); ++ + btrfs_exclop_finish(fs_info); + + if (ret) +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index bd46e107f955e..f5135314e4b39 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -1914,7 +1914,10 @@ static noinline int btrfs_ioctl_snap_create_v2(struct file *file, + if (vol_args->flags & BTRFS_SUBVOL_RDONLY) + readonly = true; + if (vol_args->flags & BTRFS_SUBVOL_QGROUP_INHERIT) { +- if (vol_args->size > PAGE_SIZE) { ++ u64 nums; ++ ++ if (vol_args->size < sizeof(*inherit) || ++ vol_args->size > PAGE_SIZE) { + ret = -EINVAL; + goto free_args; + } +@@ -1923,6 +1926,20 @@ static noinline int btrfs_ioctl_snap_create_v2(struct file *file, + ret = PTR_ERR(inherit); + goto free_args; + } ++ ++ if (inherit->num_qgroups > PAGE_SIZE || ++ inherit->num_ref_copies > PAGE_SIZE || ++ inherit->num_excl_copies > PAGE_SIZE) { ++ ret = -EINVAL; ++ goto free_inherit; ++ } ++ ++ nums = inherit->num_qgroups + 2 * inherit->num_ref_copies + ++ 2 * inherit->num_excl_copies; ++ if (vol_args->size != struct_size(inherit, qgroups, nums)) { ++ ret = -EINVAL; ++ goto free_inherit; ++ } + } + + ret = __btrfs_ioctl_snap_create(file, vol_args->name, vol_args->fd, +diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c +index 255490f42b5d5..9d33bf0154abf 100644 +--- a/fs/btrfs/raid56.c ++++ b/fs/btrfs/raid56.c +@@ -2363,16 +2363,21 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio, + SetPageUptodate(p_page); + + if (has_qstripe) { ++ /* RAID6, allocate and map temp space for the Q stripe */ + q_page = alloc_page(GFP_NOFS | __GFP_HIGHMEM); + if (!q_page) { + __free_page(p_page); + goto cleanup; + } + SetPageUptodate(q_page); ++ pointers[rbio->real_stripes - 1] = kmap(q_page); + } + + atomic_set(&rbio->error, 0); + ++ /* Map the parity stripe just once */ ++ pointers[nr_data] = kmap(p_page); ++ + for_each_set_bit(pagenr, rbio->dbitmap, rbio->stripe_npages) { + struct page *p; + void *parity; +@@ -2382,16 +2387,8 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio, + pointers[stripe] = kmap(p); + } + +- /* then add the parity stripe */ +- pointers[stripe++] = kmap(p_page); +- + if (has_qstripe) { +- /* +- * raid6, add the qstripe and call the +- * library function to fill in our p/q +- */ +- pointers[stripe++] = kmap(q_page); +- ++ /* RAID6, call the library function to fill in our P/Q */ + raid6_call.gen_syndrome(rbio->real_stripes, PAGE_SIZE, + pointers); + } else { +@@ -2412,12 +2409,14 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio, + + for (stripe = 0; stripe < nr_data; stripe++) + kunmap(page_in_rbio(rbio, stripe, pagenr, 0)); +- kunmap(p_page); + } + ++ kunmap(p_page); + __free_page(p_page); +- if (q_page) ++ if (q_page) { ++ kunmap(q_page); + __free_page(q_page); ++ } + + writeback: + /* +diff --git a/fs/btrfs/reflink.c b/fs/btrfs/reflink.c +index a646af95dd100..c4f87df532833 100644 +--- a/fs/btrfs/reflink.c ++++ b/fs/btrfs/reflink.c +@@ -548,6 +548,24 @@ process_slot: + btrfs_release_path(path); + path->leave_spinning = 0; + ++ /* ++ * When using NO_HOLES and we are cloning a range that covers ++ * only a hole (no extents) into a range beyond the current ++ * i_size, punching a hole in the target range will not create ++ * an extent map defining a hole, because the range starts at or ++ * beyond current i_size. If the file previously had an i_size ++ * greater than the new i_size set by this clone operation, we ++ * need to make sure the next fsync is a full fsync, so that it ++ * detects and logs a hole covering a range from the current ++ * i_size to the new i_size. If the clone range covers extents, ++ * besides a hole, then we know the full sync flag was already ++ * set by previous calls to btrfs_replace_file_extents() that ++ * replaced file extent items. ++ */ ++ if (last_dest_end >= i_size_read(inode)) ++ set_bit(BTRFS_INODE_NEEDS_FULL_SYNC, ++ &BTRFS_I(inode)->runtime_flags); ++ + ret = btrfs_replace_file_extents(inode, path, last_dest_end, + destoff + len - 1, NULL, &trans); + if (ret) +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index e71e7586e9eb0..0392c556af601 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -3568,6 +3568,13 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx, + * commit_transactions. + */ + ro_set = 0; ++ } else if (ret == -ETXTBSY) { ++ btrfs_warn(fs_info, ++ "skipping scrub of block group %llu due to active swapfile", ++ cache->start); ++ scrub_pause_off(fs_info); ++ ret = 0; ++ goto skip_unfreeze; + } else { + btrfs_warn(fs_info, + "failed setting block group ro: %d", ret); +@@ -3657,7 +3664,7 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx, + } else { + spin_unlock(&cache->lock); + } +- ++skip_unfreeze: + btrfs_unfreeze_block_group(cache); + btrfs_put_block_group(cache); + if (ret) +diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c +index e51774201d53b..f1a60bcdb3db8 100644 +--- a/fs/btrfs/xattr.c ++++ b/fs/btrfs/xattr.c +@@ -229,11 +229,33 @@ int btrfs_setxattr_trans(struct inode *inode, const char *name, + { + struct btrfs_root *root = BTRFS_I(inode)->root; + struct btrfs_trans_handle *trans; ++ const bool start_trans = (current->journal_info == NULL); + int ret; + +- trans = btrfs_start_transaction(root, 2); +- if (IS_ERR(trans)) +- return PTR_ERR(trans); ++ if (start_trans) { ++ /* ++ * 1 unit for inserting/updating/deleting the xattr ++ * 1 unit for the inode item update ++ */ ++ trans = btrfs_start_transaction(root, 2); ++ if (IS_ERR(trans)) ++ return PTR_ERR(trans); ++ } else { ++ /* ++ * This can happen when smack is enabled and a directory is being ++ * created. It happens through d_instantiate_new(), which calls ++ * smack_d_instantiate(), which in turn calls __vfs_setxattr() to ++ * set the transmute xattr (XATTR_NAME_SMACKTRANSMUTE) on the ++ * inode. We have already reserved space for the xattr and inode ++ * update at btrfs_mkdir(), so just use the transaction handle. ++ * We don't join or start a transaction, as that will reset the ++ * block_rsv of the handle and trigger a warning for the start ++ * case. ++ */ ++ ASSERT(strncmp(name, XATTR_SECURITY_PREFIX, ++ XATTR_SECURITY_PREFIX_LEN) == 0); ++ trans = current->journal_info; ++ } + + ret = btrfs_setxattr(trans, inode, name, value, size, flags); + if (ret) +@@ -244,7 +266,8 @@ int btrfs_setxattr_trans(struct inode *inode, const char *name, + ret = btrfs_update_inode(trans, root, inode); + BUG_ON(ret); + out: +- btrfs_end_transaction(trans); ++ if (start_trans) ++ btrfs_end_transaction(trans); + return ret; + } + +diff --git a/fs/io_uring.c b/fs/io_uring.c +index d0172cc4f6427..691c998691439 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -5083,6 +5083,9 @@ static void __io_queue_proc(struct io_poll_iocb *poll, struct io_poll_table *pt, + pt->error = -EINVAL; + return; + } ++ /* double add on the same waitqueue head, ignore */ ++ if (poll->head == head) ++ return; + poll = kmalloc(sizeof(*poll), GFP_ATOMIC); + if (!poll) { + pt->error = -ENOMEM; +diff --git a/include/crypto/hash.h b/include/crypto/hash.h +index af2ff31ff619f..13f8a6a54ca87 100644 +--- a/include/crypto/hash.h ++++ b/include/crypto/hash.h +@@ -149,7 +149,7 @@ struct ahash_alg { + + struct shash_desc { + struct crypto_shash *tfm; +- void *__ctx[] CRYPTO_MINALIGN_ATTR; ++ void *__ctx[] __aligned(ARCH_SLAB_MINALIGN); + }; + + #define HASH_MAX_DIGESTSIZE 64 +@@ -162,9 +162,9 @@ struct shash_desc { + + #define HASH_MAX_STATESIZE 512 + +-#define SHASH_DESC_ON_STACK(shash, ctx) \ +- char __##shash##_desc[sizeof(struct shash_desc) + \ +- HASH_MAX_DESCSIZE] CRYPTO_MINALIGN_ATTR; \ ++#define SHASH_DESC_ON_STACK(shash, ctx) \ ++ char __##shash##_desc[sizeof(struct shash_desc) + HASH_MAX_DESCSIZE] \ ++ __aligned(__alignof__(struct shash_desc)); \ + struct shash_desc *shash = (struct shash_desc *)__##shash##_desc + + /** +diff --git a/include/linux/acpi_iort.h b/include/linux/acpi_iort.h +index 20a32120bb880..1a12baa58e409 100644 +--- a/include/linux/acpi_iort.h ++++ b/include/linux/acpi_iort.h +@@ -38,6 +38,7 @@ void iort_dma_setup(struct device *dev, u64 *dma_addr, u64 *size); + const struct iommu_ops *iort_iommu_configure_id(struct device *dev, + const u32 *id_in); + int iort_iommu_msi_get_resv_regions(struct device *dev, struct list_head *head); ++phys_addr_t acpi_iort_dma_get_max_cpu_address(void); + #else + static inline void acpi_iort_init(void) { } + static inline u32 iort_msi_map_id(struct device *dev, u32 id) +@@ -55,6 +56,9 @@ static inline const struct iommu_ops *iort_iommu_configure_id( + static inline + int iort_iommu_msi_get_resv_regions(struct device *dev, struct list_head *head) + { return 0; } ++ ++static inline phys_addr_t acpi_iort_dma_get_max_cpu_address(void) ++{ return PHYS_ADDR_MAX; } + #endif + + #endif /* __ACPI_IORT_H__ */ +diff --git a/include/linux/crypto.h b/include/linux/crypto.h +index ef90e07c9635c..e3abd1f8646a1 100644 +--- a/include/linux/crypto.h ++++ b/include/linux/crypto.h +@@ -151,9 +151,12 @@ + * The macro CRYPTO_MINALIGN_ATTR (along with the void * type in the actual + * declaration) is used to ensure that the crypto_tfm context structure is + * aligned correctly for the given architecture so that there are no alignment +- * faults for C data types. In particular, this is required on platforms such +- * as arm where pointers are 32-bit aligned but there are data types such as +- * u64 which require 64-bit alignment. ++ * faults for C data types. On architectures that support non-cache coherent ++ * DMA, such as ARM or arm64, it also takes into account the minimal alignment ++ * that is required to ensure that the context struct member does not share any ++ * cachelines with the rest of the struct. This is needed to ensure that cache ++ * maintenance for non-coherent DMA (cache invalidation in particular) does not ++ * affect data that may be accessed by the CPU concurrently. + */ + #define CRYPTO_MINALIGN ARCH_KMALLOC_MINALIGN + +diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h +index fb3bf696c05e8..9d0c454d23cd6 100644 +--- a/include/linux/mmzone.h ++++ b/include/linux/mmzone.h +@@ -354,26 +354,6 @@ enum zone_type { + * DMA mask is assumed when ZONE_DMA32 is defined. Some 64-bit + * platforms may need both zones as they support peripherals with + * different DMA addressing limitations. +- * +- * Some examples: +- * +- * - i386 and x86_64 have a fixed 16M ZONE_DMA and ZONE_DMA32 for the +- * rest of the lower 4G. +- * +- * - arm only uses ZONE_DMA, the size, up to 4G, may vary depending on +- * the specific device. +- * +- * - arm64 has a fixed 1G ZONE_DMA and ZONE_DMA32 for the rest of the +- * lower 4G. +- * +- * - powerpc only uses ZONE_DMA, the size, up to 2G, may vary +- * depending on the specific device. +- * +- * - s390 uses ZONE_DMA fixed to the lower 2G. +- * +- * - ia64 and riscv only use ZONE_DMA32. +- * +- * - parisc uses neither. + */ + #ifdef CONFIG_ZONE_DMA + ZONE_DMA, +diff --git a/include/linux/of.h b/include/linux/of.h +index af655d264f10f..0f4e81e6fb232 100644 +--- a/include/linux/of.h ++++ b/include/linux/of.h +@@ -558,6 +558,8 @@ int of_map_id(struct device_node *np, u32 id, + const char *map_name, const char *map_mask_name, + struct device_node **target, u32 *id_out); + ++phys_addr_t of_dma_get_max_cpu_address(struct device_node *np); ++ + #else /* CONFIG_OF */ + + static inline void of_core_init(void) +@@ -995,6 +997,11 @@ static inline int of_map_id(struct device_node *np, u32 id, + return -EINVAL; + } + ++static inline phys_addr_t of_dma_get_max_cpu_address(struct device_node *np) ++{ ++ return PHYS_ADDR_MAX; ++} ++ + #define of_match_ptr(_ptr) NULL + #define of_match_node(_matches, _node) NULL + #endif /* CONFIG_OF */ +diff --git a/include/sound/intel-nhlt.h b/include/sound/intel-nhlt.h +index 743c2f4422806..d0574805865f9 100644 +--- a/include/sound/intel-nhlt.h ++++ b/include/sound/intel-nhlt.h +@@ -112,6 +112,11 @@ struct nhlt_vendor_dmic_array_config { + /* TODO add vendor mic config */ + } __packed; + ++enum { ++ NHLT_CONFIG_TYPE_GENERIC = 0, ++ NHLT_CONFIG_TYPE_MIC_ARRAY = 1 ++}; ++ + enum { + NHLT_MIC_ARRAY_2CH_SMALL = 0xa, + NHLT_MIC_ARRAY_2CH_BIG = 0xb, +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index ddeb865706ba4..b12e5f4721ca7 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -2836,6 +2836,17 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer, + write_stamp, write_stamp - delta)) + return 0; + ++ /* ++ * It's possible that the event time delta is zero ++ * (has the same time stamp as the previous event) ++ * in which case write_stamp and before_stamp could ++ * be the same. In such a case, force before_stamp ++ * to be different than write_stamp. It doesn't ++ * matter what it is, as long as its different. ++ */ ++ if (!delta) ++ rb_time_set(&cpu_buffer->before_stamp, 0); ++ + /* + * If an event were to come in now, it would see that the + * write_stamp and the before_stamp are different, and assume +diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c +index b9c2ee7ab43fa..cce12e1971d85 100644 +--- a/scripts/recordmcount.c ++++ b/scripts/recordmcount.c +@@ -438,7 +438,7 @@ static int arm_is_fake_mcount(Elf32_Rel const *rp) + + static int arm64_is_fake_mcount(Elf64_Rel const *rp) + { +- return ELF64_R_TYPE(w(rp->r_info)) != R_AARCH64_CALL26; ++ return ELF64_R_TYPE(w8(rp->r_info)) != R_AARCH64_CALL26; + } + + /* 64-bit EM_MIPS has weird ELF64_Rela.r_info. +diff --git a/security/tomoyo/network.c b/security/tomoyo/network.c +index a89ed55d85d41..478f757ff8435 100644 +--- a/security/tomoyo/network.c ++++ b/security/tomoyo/network.c +@@ -613,7 +613,7 @@ static int tomoyo_check_unix_address(struct sockaddr *addr, + static bool tomoyo_kernel_service(void) + { + /* Nothing to do if I am a kernel service. */ +- return uaccess_kernel(); ++ return (current->flags & (PF_KTHREAD | PF_IO_WORKER)) == PF_KTHREAD; + } + + /** +diff --git a/sound/hda/intel-nhlt.c b/sound/hda/intel-nhlt.c +index 059aaf04f536a..d053beccfaec3 100644 +--- a/sound/hda/intel-nhlt.c ++++ b/sound/hda/intel-nhlt.c +@@ -31,18 +31,44 @@ int intel_nhlt_get_dmic_geo(struct device *dev, struct nhlt_acpi_table *nhlt) + struct nhlt_endpoint *epnt; + struct nhlt_dmic_array_config *cfg; + struct nhlt_vendor_dmic_array_config *cfg_vendor; ++ struct nhlt_fmt *fmt_configs; + unsigned int dmic_geo = 0; +- u8 j; ++ u16 max_ch = 0; ++ u8 i, j; + + if (!nhlt) + return 0; + +- epnt = (struct nhlt_endpoint *)nhlt->desc; ++ for (j = 0, epnt = nhlt->desc; j < nhlt->endpoint_count; j++, ++ epnt = (struct nhlt_endpoint *)((u8 *)epnt + epnt->length)) { + +- for (j = 0; j < nhlt->endpoint_count; j++) { +- if (epnt->linktype == NHLT_LINK_DMIC) { +- cfg = (struct nhlt_dmic_array_config *) +- (epnt->config.caps); ++ if (epnt->linktype != NHLT_LINK_DMIC) ++ continue; ++ ++ cfg = (struct nhlt_dmic_array_config *)(epnt->config.caps); ++ fmt_configs = (struct nhlt_fmt *)(epnt->config.caps + epnt->config.size); ++ ++ /* find max number of channels based on format_configuration */ ++ if (fmt_configs->fmt_count) { ++ dev_dbg(dev, "%s: found %d format definitions\n", ++ __func__, fmt_configs->fmt_count); ++ ++ for (i = 0; i < fmt_configs->fmt_count; i++) { ++ struct wav_fmt_ext *fmt_ext; ++ ++ fmt_ext = &fmt_configs->fmt_config[i].fmt_ext; ++ ++ if (fmt_ext->fmt.channels > max_ch) ++ max_ch = fmt_ext->fmt.channels; ++ } ++ dev_dbg(dev, "%s: max channels found %d\n", __func__, max_ch); ++ } else { ++ dev_dbg(dev, "%s: No format information found\n", __func__); ++ } ++ ++ if (cfg->device_config.config_type != NHLT_CONFIG_TYPE_MIC_ARRAY) { ++ dmic_geo = max_ch; ++ } else { + switch (cfg->array_type) { + case NHLT_MIC_ARRAY_2CH_SMALL: + case NHLT_MIC_ARRAY_2CH_BIG: +@@ -59,13 +85,23 @@ int intel_nhlt_get_dmic_geo(struct device *dev, struct nhlt_acpi_table *nhlt) + dmic_geo = cfg_vendor->nb_mics; + break; + default: +- dev_warn(dev, "undefined DMIC array_type 0x%0x\n", +- cfg->array_type); ++ dev_warn(dev, "%s: undefined DMIC array_type 0x%0x\n", ++ __func__, cfg->array_type); ++ } ++ ++ if (dmic_geo > 0) { ++ dev_dbg(dev, "%s: Array with %d dmics\n", __func__, dmic_geo); ++ } ++ if (max_ch > dmic_geo) { ++ dev_dbg(dev, "%s: max channels %d exceed dmic number %d\n", ++ __func__, max_ch, dmic_geo); + } + } +- epnt = (struct nhlt_endpoint *)((u8 *)epnt + epnt->length); + } + ++ dev_dbg(dev, "%s: dmic number %d max_ch %d\n", ++ __func__, dmic_geo, max_ch); ++ + return dmic_geo; + } + EXPORT_SYMBOL_GPL(intel_nhlt_get_dmic_geo); +diff --git a/sound/pci/ctxfi/cthw20k2.c b/sound/pci/ctxfi/cthw20k2.c +index fc1bc18caee98..85d1fc76f59e1 100644 +--- a/sound/pci/ctxfi/cthw20k2.c ++++ b/sound/pci/ctxfi/cthw20k2.c +@@ -991,7 +991,7 @@ static int daio_mgr_dao_init(void *blk, unsigned int idx, unsigned int conf) + + if (idx < 4) { + /* S/PDIF output */ +- switch ((conf & 0x7)) { ++ switch ((conf & 0xf)) { + case 1: + set_field(&ctl->txctl[idx], ATXCTL_NUC, 0); + break; +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 5f4f8c2d760f0..b47504fa8dfd0 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6408,6 +6408,7 @@ enum { + ALC236_FIXUP_DELL_AIO_HEADSET_MIC, + ALC282_FIXUP_ACER_DISABLE_LINEOUT, + ALC255_FIXUP_ACER_LIMIT_INT_MIC_BOOST, ++ ALC256_FIXUP_ACER_HEADSET_MIC, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -7864,6 +7865,16 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC255_FIXUP_ACER_MIC_NO_PRESENCE, + }, ++ [ALC256_FIXUP_ACER_HEADSET_MIC] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x02a1113c }, /* use as headset mic, without its own jack detect */ ++ { 0x1a, 0x90a1092f }, /* use as internal mic */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -7890,9 +7901,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x1246, "Acer Predator Helios 500", ALC299_FIXUP_PREDATOR_SPK), + SND_PCI_QUIRK(0x1025, 0x1247, "Acer vCopperbox", ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS), + SND_PCI_QUIRK(0x1025, 0x1248, "Acer Veriton N4660G", ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1025, 0x1269, "Acer SWIFT SF314-54", ALC256_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1025, 0x129c, "Acer SWIFT SF314-55", ALC256_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC), +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 81e987eaf0637..375cfb9c9ab7e 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -1301,6 +1301,17 @@ no_res_check: + /* totally crap, return an error */ + return -EINVAL; + } ++ } else { ++ /* if the max volume is too low, it's likely a bogus range; ++ * here we use -96dB as the threshold ++ */ ++ if (cval->dBmax <= -9600) { ++ usb_audio_info(cval->head.mixer->chip, ++ "%d:%d: bogus dB values (%d/%d), disabling dB reporting\n", ++ cval->head.id, mixer_ctrl_intf(cval->head.mixer), ++ cval->dBmin, cval->dBmax); ++ cval->dBmin = cval->dBmax = 0; ++ } + } + + return 0; +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index a7212f16660ec..646deb6244b15 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -536,6 +536,16 @@ static const struct usbmix_ctl_map usbmix_ctl_maps[] = { + .id = USB_ID(0x05a7, 0x1020), + .map = bose_companion5_map, + }, ++ { ++ /* Corsair Virtuoso SE (wired mode) */ ++ .id = USB_ID(0x1b1c, 0x0a3d), ++ .map = corsair_virtuoso_map, ++ }, ++ { ++ /* Corsair Virtuoso SE (wireless mode) */ ++ .id = USB_ID(0x1b1c, 0x0a3e), ++ .map = corsair_virtuoso_map, ++ }, + { + /* Corsair Virtuoso (wired mode) */ + .id = USB_ID(0x1b1c, 0x0a41), diff --git a/patch/kernel/sunxi-current/patch-5.10.22-23.patch b/patch/kernel/sunxi-current/patch-5.10.22-23.patch new file mode 100644 index 0000000000..975a160e9c --- /dev/null +++ b/patch/kernel/sunxi-current/patch-5.10.22-23.patch @@ -0,0 +1,2146 @@ +diff --git a/Makefile b/Makefile +index 12a2a7271fcb0..7fdb78b48f556 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 10 +-SUBLEVEL = 22 ++SUBLEVEL = 23 + EXTRAVERSION = + NAME = Dare mighty things + +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index afe4bc55d4eba..c1be64228327c 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -950,8 +950,9 @@ choice + that is selected here. + + config CPU_BIG_ENDIAN +- bool "Build big-endian kernel" +- help ++ bool "Build big-endian kernel" ++ depends on !LD_IS_LLD || LLD_VERSION >= 130000 ++ help + Say Y if you plan on running a kernel with a big-endian userspace. + + config CPU_LITTLE_ENDIAN +diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig +index 04dc17d52ac2d..14f3252f2da03 100644 +--- a/arch/parisc/Kconfig ++++ b/arch/parisc/Kconfig +@@ -201,9 +201,12 @@ config PREFETCH + def_bool y + depends on PA8X00 || PA7200 + ++config PARISC_HUGE_KERNEL ++ def_bool y if !MODULES || UBSAN || FTRACE || COMPILE_TEST ++ + config MLONGCALLS +- def_bool y if !MODULES || UBSAN || FTRACE +- bool "Enable the -mlong-calls compiler option for big kernels" if MODULES && !UBSAN && !FTRACE ++ def_bool y if PARISC_HUGE_KERNEL ++ bool "Enable the -mlong-calls compiler option for big kernels" if !PARISC_HUGE_KERNEL + depends on PA8X00 + help + If you configure the kernel to include many drivers built-in instead +diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c +index 76ab1ee0784ae..642f0da31ac4f 100644 +--- a/arch/x86/kvm/svm/svm.c ++++ b/arch/x86/kvm/svm/svm.c +@@ -1192,6 +1192,7 @@ static void init_vmcb(struct vcpu_svm *svm) + init_sys_seg(&save->ldtr, SEG_TYPE_LDT); + init_sys_seg(&save->tr, SEG_TYPE_BUSY_TSS16); + ++ svm_set_cr4(&svm->vcpu, 0); + svm_set_efer(&svm->vcpu, 0); + save->dr6 = 0xffff0ff0; + kvm_set_rflags(&svm->vcpu, 2); +diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h +index e7ca622a468f5..2249a7d7ca27f 100644 +--- a/arch/x86/kvm/x86.h ++++ b/arch/x86/kvm/x86.h +@@ -404,6 +404,8 @@ bool kvm_msr_allowed(struct kvm_vcpu *vcpu, u32 index, u32 type); + __reserved_bits |= X86_CR4_UMIP; \ + if (!__cpu_has(__c, X86_FEATURE_VMX)) \ + __reserved_bits |= X86_CR4_VMXE; \ ++ if (!__cpu_has(__c, X86_FEATURE_PCID)) \ ++ __reserved_bits |= X86_CR4_PCIDE; \ + __reserved_bits; \ + }) + +diff --git a/drivers/acpi/acpica/acobject.h b/drivers/acpi/acpica/acobject.h +index 9f0219a8cb985..dd7efafcb1034 100644 +--- a/drivers/acpi/acpica/acobject.h ++++ b/drivers/acpi/acpica/acobject.h +@@ -284,6 +284,7 @@ struct acpi_object_addr_handler { + acpi_adr_space_handler handler; + struct acpi_namespace_node *node; /* Parent device */ + void *context; ++ acpi_mutex context_mutex; + acpi_adr_space_setup setup; + union acpi_operand_object *region_list; /* Regions using this handler */ + union acpi_operand_object *next; +diff --git a/drivers/acpi/acpica/evhandler.c b/drivers/acpi/acpica/evhandler.c +index 5884eba047f73..3438dc187efb6 100644 +--- a/drivers/acpi/acpica/evhandler.c ++++ b/drivers/acpi/acpica/evhandler.c +@@ -489,6 +489,13 @@ acpi_ev_install_space_handler(struct acpi_namespace_node *node, + + /* Init handler obj */ + ++ status = ++ acpi_os_create_mutex(&handler_obj->address_space.context_mutex); ++ if (ACPI_FAILURE(status)) { ++ acpi_ut_remove_reference(handler_obj); ++ goto unlock_and_exit; ++ } ++ + handler_obj->address_space.space_id = (u8)space_id; + handler_obj->address_space.handler_flags = flags; + handler_obj->address_space.region_list = NULL; +diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c +index 738d4b231f34a..980efc9bd5ee7 100644 +--- a/drivers/acpi/acpica/evregion.c ++++ b/drivers/acpi/acpica/evregion.c +@@ -111,6 +111,8 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + union acpi_operand_object *region_obj2; + void *region_context = NULL; + struct acpi_connection_info *context; ++ acpi_mutex context_mutex; ++ u8 context_locked; + acpi_physical_address address; + + ACPI_FUNCTION_TRACE(ev_address_space_dispatch); +@@ -135,6 +137,8 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + } + + context = handler_desc->address_space.context; ++ context_mutex = handler_desc->address_space.context_mutex; ++ context_locked = FALSE; + + /* + * It may be the case that the region has never been initialized. +@@ -203,6 +207,23 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + handler = handler_desc->address_space.handler; + address = (region_obj->region.address + region_offset); + ++ ACPI_DEBUG_PRINT((ACPI_DB_OPREGION, ++ "Handler %p (@%p) Address %8.8X%8.8X [%s]\n", ++ ®ion_obj->region.handler->address_space, handler, ++ ACPI_FORMAT_UINT64(address), ++ acpi_ut_get_region_name(region_obj->region. ++ space_id))); ++ ++ if (!(handler_desc->address_space.handler_flags & ++ ACPI_ADDR_HANDLER_DEFAULT_INSTALLED)) { ++ /* ++ * For handlers other than the default (supplied) handlers, we must ++ * exit the interpreter because the handler *might* block -- we don't ++ * know what it will do, so we can't hold the lock on the interpreter. ++ */ ++ acpi_ex_exit_interpreter(); ++ } ++ + /* + * Special handling for generic_serial_bus and general_purpose_io: + * There are three extra parameters that must be passed to the +@@ -211,6 +232,11 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + * 2) Length of the above buffer + * 3) Actual access length from the access_as() op + * ++ * Since we pass these extra parameters via the context, which is ++ * shared between threads, we must lock the context to avoid these ++ * parameters being changed from another thread before the handler ++ * has completed running. ++ * + * In addition, for general_purpose_io, the Address and bit_width fields + * are defined as follows: + * 1) Address is the pin number index of the field (bit offset from +@@ -220,6 +246,14 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + if ((region_obj->region.space_id == ACPI_ADR_SPACE_GSBUS) && + context && field_obj) { + ++ status = ++ acpi_os_acquire_mutex(context_mutex, ACPI_WAIT_FOREVER); ++ if (ACPI_FAILURE(status)) { ++ goto re_enter_interpreter; ++ } ++ ++ context_locked = TRUE; ++ + /* Get the Connection (resource_template) buffer */ + + context->connection = field_obj->field.resource_buffer; +@@ -229,6 +263,14 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + if ((region_obj->region.space_id == ACPI_ADR_SPACE_GPIO) && + context && field_obj) { + ++ status = ++ acpi_os_acquire_mutex(context_mutex, ACPI_WAIT_FOREVER); ++ if (ACPI_FAILURE(status)) { ++ goto re_enter_interpreter; ++ } ++ ++ context_locked = TRUE; ++ + /* Get the Connection (resource_template) buffer */ + + context->connection = field_obj->field.resource_buffer; +@@ -238,28 +280,15 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + bit_width = field_obj->field.bit_length; + } + +- ACPI_DEBUG_PRINT((ACPI_DB_OPREGION, +- "Handler %p (@%p) Address %8.8X%8.8X [%s]\n", +- ®ion_obj->region.handler->address_space, handler, +- ACPI_FORMAT_UINT64(address), +- acpi_ut_get_region_name(region_obj->region. +- space_id))); +- +- if (!(handler_desc->address_space.handler_flags & +- ACPI_ADDR_HANDLER_DEFAULT_INSTALLED)) { +- /* +- * For handlers other than the default (supplied) handlers, we must +- * exit the interpreter because the handler *might* block -- we don't +- * know what it will do, so we can't hold the lock on the interpreter. +- */ +- acpi_ex_exit_interpreter(); +- } +- + /* Call the handler */ + + status = handler(function, address, bit_width, value, context, + region_obj2->extra.region_context); + ++ if (context_locked) { ++ acpi_os_release_mutex(context_mutex); ++ } ++ + if (ACPI_FAILURE(status)) { + ACPI_EXCEPTION((AE_INFO, status, "Returned by Handler for [%s]", + acpi_ut_get_region_name(region_obj->region. +@@ -276,6 +305,7 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + } + } + ++re_enter_interpreter: + if (!(handler_desc->address_space.handler_flags & + ACPI_ADDR_HANDLER_DEFAULT_INSTALLED)) { + /* +diff --git a/drivers/acpi/acpica/evxfregn.c b/drivers/acpi/acpica/evxfregn.c +index da97fd0c6b51e..3bb06f17a18b6 100644 +--- a/drivers/acpi/acpica/evxfregn.c ++++ b/drivers/acpi/acpica/evxfregn.c +@@ -201,6 +201,8 @@ acpi_remove_address_space_handler(acpi_handle device, + + /* Now we can delete the handler object */ + ++ acpi_os_release_mutex(handler_obj->address_space. ++ context_mutex); + acpi_ut_remove_reference(handler_obj); + goto unlock_and_exit; + } +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index 4f5463b2a2178..811d298637cb2 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -140,6 +140,13 @@ static const struct dmi_system_id video_detect_dmi_table[] = { + }, + { + .callback = video_detect_force_vendor, ++ .ident = "GIGABYTE GB-BXBT-2807", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "GB-BXBT-2807"), ++ }, ++ }, ++ { + .ident = "Sony VPCEH3U1E", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"), +diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c +index 5c26c7d941731..ad47ff0d55c2e 100644 +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -78,6 +78,7 @@ enum qca_flags { + + enum qca_capabilities { + QCA_CAP_WIDEBAND_SPEECH = BIT(0), ++ QCA_CAP_VALID_LE_STATES = BIT(1), + }; + + /* HCI_IBS transmit side sleep protocol states */ +@@ -1782,7 +1783,7 @@ static const struct qca_device_data qca_soc_data_wcn3991 = { + { "vddch0", 450000 }, + }, + .num_vregs = 4, +- .capabilities = QCA_CAP_WIDEBAND_SPEECH, ++ .capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES, + }; + + static const struct qca_device_data qca_soc_data_wcn3998 = { +@@ -2019,11 +2020,17 @@ static int qca_serdev_probe(struct serdev_device *serdev) + hdev->shutdown = qca_power_off; + } + +- /* Wideband speech support must be set per driver since it can't be +- * queried via hci. +- */ +- if (data && (data->capabilities & QCA_CAP_WIDEBAND_SPEECH)) +- set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); ++ if (data) { ++ /* Wideband speech support must be set per driver since it can't ++ * be queried via hci. Same with the valid le states quirk. ++ */ ++ if (data->capabilities & QCA_CAP_WIDEBAND_SPEECH) ++ set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, ++ &hdev->quirks); ++ ++ if (data->capabilities & QCA_CAP_VALID_LE_STATES) ++ set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); ++ } + + return 0; + } +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 92ecf1a78ec73..45f5530666d3f 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -1379,6 +1379,8 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = { + SYSC_QUIRK_CLKDM_NOAUTO), + SYSC_QUIRK("dwc3", 0x488c0000, 0, 0x10, -ENODEV, 0x500a0200, 0xffffffff, + SYSC_QUIRK_CLKDM_NOAUTO), ++ SYSC_QUIRK("gpmc", 0, 0, 0x10, 0x14, 0x00000060, 0xffffffff, ++ SYSC_QUIRK_GPMC_DEBUG), + SYSC_QUIRK("hdmi", 0, 0, 0x10, -ENODEV, 0x50030200, 0xffffffff, + SYSC_QUIRK_OPT_CLKS_NEEDED), + SYSC_QUIRK("hdq1w", 0, 0, 0x14, 0x18, 0x00000006, 0xffffffff, +@@ -1814,6 +1816,14 @@ static void sysc_init_module_quirks(struct sysc *ddata) + return; + } + ++#ifdef CONFIG_OMAP_GPMC_DEBUG ++ if (ddata->cfg.quirks & SYSC_QUIRK_GPMC_DEBUG) { ++ ddata->cfg.quirks |= SYSC_QUIRK_NO_RESET_ON_INIT; ++ ++ return; ++ } ++#endif ++ + if (ddata->cfg.quirks & SYSC_MODULE_QUIRK_I2C) { + ddata->pre_reset_quirk = sysc_pre_reset_quirk_i2c; + ddata->post_reset_quirk = sysc_post_reset_quirk_i2c; +diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +index 69ed2c6094665..5e11cdb207d83 100644 +--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +@@ -626,8 +626,6 @@ static int a5xx_hw_init(struct msm_gpu *gpu) + if (adreno_gpu->info->quirks & ADRENO_QUIRK_TWO_PASS_USE_WFI) + gpu_rmw(gpu, REG_A5XX_PC_DBG_ECO_CNTL, 0, (1 << 8)); + +- gpu_write(gpu, REG_A5XX_PC_DBG_ECO_CNTL, 0xc0200100); +- + /* Enable USE_RETENTION_FLOPS */ + gpu_write(gpu, REG_A5XX_CP_CHICKEN_DBG, 0x02000000); + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 94180c63571ed..06813f297dcca 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -359,6 +359,7 @@ + #define USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR 0x1803 + #define USB_DEVICE_ID_DRAGONRISE_GAMECUBE1 0x1843 + #define USB_DEVICE_ID_DRAGONRISE_GAMECUBE2 0x1844 ++#define USB_DEVICE_ID_DRAGONRISE_GAMECUBE3 0x1846 + + #define USB_VENDOR_ID_DWAV 0x0eef + #define USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER 0x0001 +@@ -638,6 +639,8 @@ + #define USB_DEVICE_ID_INNEX_GENESIS_ATARI 0x4745 + + #define USB_VENDOR_ID_ITE 0x048d ++#define I2C_VENDOR_ID_ITE 0x103c ++#define I2C_DEVICE_ID_ITE_VOYO_WINPAD_A15 0x184f + #define USB_DEVICE_ID_ITE_LENOVO_YOGA 0x8386 + #define USB_DEVICE_ID_ITE_LENOVO_YOGA2 0x8350 + #define I2C_DEVICE_ID_ITE_LENOVO_LEGION_Y720 0x837a +diff --git a/drivers/hid/hid-mf.c b/drivers/hid/hid-mf.c +index fc75f30f537c9..92d7ecd41a78f 100644 +--- a/drivers/hid/hid-mf.c ++++ b/drivers/hid/hid-mf.c +@@ -153,6 +153,8 @@ static const struct hid_device_id mf_devices[] = { + .driver_data = HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE2), + .driver_data = 0 }, /* No quirk required */ ++ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE3), ++ .driver_data = HID_QUIRK_MULTI_INPUT }, + { } + }; + MODULE_DEVICE_TABLE(hid, mf_devices); +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index bf7ecab5d9e5e..2e38340e19dfb 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -72,6 +72,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_REDRAGON_SEYMUR2), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE }, + { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE1), HID_QUIRK_MULTI_INPUT }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE3), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER), HID_QUIRK_MULTI_INPUT | HID_QUIRK_NOGET }, +@@ -484,6 +485,7 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR) }, + { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE1) }, + { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE2) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE3) }, + #endif + #if IS_ENABLED(CONFIG_HID_MICROSOFT) + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500) }, +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index aeff1ffb0c8b3..cb7758d59014e 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -171,6 +171,8 @@ static const struct i2c_hid_quirks { + I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV }, + { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288, + I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, ++ { I2C_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_VOYO_WINPAD_A15, ++ I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, + { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118, + I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, + { USB_VENDOR_ID_ELAN, HID_ANY_ID, +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index b9cf59443843b..5f1195791cb18 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -1503,6 +1503,10 @@ static bool increase_address_space(struct protection_domain *domain, + bool ret = true; + u64 *pte; + ++ pte = (void *)get_zeroed_page(gfp); ++ if (!pte) ++ return false; ++ + spin_lock_irqsave(&domain->lock, flags); + + amd_iommu_domain_get_pgtable(domain, &pgtable); +@@ -1514,10 +1518,6 @@ static bool increase_address_space(struct protection_domain *domain, + if (WARN_ON_ONCE(pgtable.mode == PAGE_MODE_6_LEVEL)) + goto out; + +- pte = (void *)get_zeroed_page(gfp); +- if (!pte) +- goto out; +- + *pte = PM_LEVEL_PDE(pgtable.mode, iommu_virt_to_phys(pgtable.root)); + + pgtable.root = pte; +@@ -1531,10 +1531,12 @@ static bool increase_address_space(struct protection_domain *domain, + */ + amd_iommu_domain_set_pgtable(domain, pte, pgtable.mode); + ++ pte = NULL; + ret = true; + + out: + spin_unlock_irqrestore(&domain->lock, flags); ++ free_page((unsigned long)pte); + + return ret; + } +diff --git a/drivers/media/pci/cx23885/cx23885-core.c b/drivers/media/pci/cx23885/cx23885-core.c +index 4b0c53f61fb7c..4e8132d4b2dfa 100644 +--- a/drivers/media/pci/cx23885/cx23885-core.c ++++ b/drivers/media/pci/cx23885/cx23885-core.c +@@ -2074,6 +2074,10 @@ static struct { + * 0x1451 is PCI ID for the IOMMU found on Ryzen + */ + { PCI_VENDOR_ID_AMD, 0x1451 }, ++ /* According to sudo lspci -nn, ++ * 0x1423 is the PCI ID for the IOMMU found on Kaveri ++ */ ++ { PCI_VENDOR_ID_AMD, 0x1423 }, + }; + + static bool cx23885_does_need_dma_reset(void) +diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c +index d92c4d2c521a3..6e5f544c9c737 100644 +--- a/drivers/misc/eeprom/eeprom_93xx46.c ++++ b/drivers/misc/eeprom/eeprom_93xx46.c +@@ -35,6 +35,10 @@ static const struct eeprom_93xx46_devtype_data atmel_at93c46d_data = { + EEPROM_93XX46_QUIRK_INSTRUCTION_LENGTH, + }; + ++static const struct eeprom_93xx46_devtype_data microchip_93lc46b_data = { ++ .quirks = EEPROM_93XX46_QUIRK_EXTRA_READ_CYCLE, ++}; ++ + struct eeprom_93xx46_dev { + struct spi_device *spi; + struct eeprom_93xx46_platform_data *pdata; +@@ -55,6 +59,11 @@ static inline bool has_quirk_instruction_length(struct eeprom_93xx46_dev *edev) + return edev->pdata->quirks & EEPROM_93XX46_QUIRK_INSTRUCTION_LENGTH; + } + ++static inline bool has_quirk_extra_read_cycle(struct eeprom_93xx46_dev *edev) ++{ ++ return edev->pdata->quirks & EEPROM_93XX46_QUIRK_EXTRA_READ_CYCLE; ++} ++ + static int eeprom_93xx46_read(void *priv, unsigned int off, + void *val, size_t count) + { +@@ -96,6 +105,11 @@ static int eeprom_93xx46_read(void *priv, unsigned int off, + dev_dbg(&edev->spi->dev, "read cmd 0x%x, %d Hz\n", + cmd_addr, edev->spi->max_speed_hz); + ++ if (has_quirk_extra_read_cycle(edev)) { ++ cmd_addr <<= 1; ++ bits += 1; ++ } ++ + spi_message_init(&m); + + t[0].tx_buf = (char *)&cmd_addr; +@@ -363,6 +377,7 @@ static void select_deassert(void *context) + static const struct of_device_id eeprom_93xx46_of_table[] = { + { .compatible = "eeprom-93xx46", }, + { .compatible = "atmel,at93c46d", .data = &atmel_at93c46d_data, }, ++ { .compatible = "microchip,93lc46b", .data = µchip_93lc46b_data, }, + {} + }; + MODULE_DEVICE_TABLE(of, eeprom_93xx46_of_table); +diff --git a/drivers/mmc/host/sdhci-of-dwcmshc.c b/drivers/mmc/host/sdhci-of-dwcmshc.c +index d90020ed36227..59d8d96ce206b 100644 +--- a/drivers/mmc/host/sdhci-of-dwcmshc.c ++++ b/drivers/mmc/host/sdhci-of-dwcmshc.c +@@ -112,6 +112,7 @@ static const struct sdhci_ops sdhci_dwcmshc_ops = { + static const struct sdhci_pltfm_data sdhci_dwcmshc_pdata = { + .ops = &sdhci_dwcmshc_ops, + .quirks = SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN, ++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, + }; + + static int dwcmshc_probe(struct platform_device *pdev) +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index 6a10ff0377a24..33cf952cc01d3 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -526,6 +526,8 @@ static void mwifiex_pcie_reset_prepare(struct pci_dev *pdev) + clear_bit(MWIFIEX_IFACE_WORK_DEVICE_DUMP, &card->work_flags); + clear_bit(MWIFIEX_IFACE_WORK_CARD_RESET, &card->work_flags); + mwifiex_dbg(adapter, INFO, "%s, successful\n", __func__); ++ ++ card->pci_reset_ongoing = true; + } + + /* +@@ -554,6 +556,8 @@ static void mwifiex_pcie_reset_done(struct pci_dev *pdev) + dev_err(&pdev->dev, "reinit failed: %d\n", ret); + else + mwifiex_dbg(adapter, INFO, "%s, successful\n", __func__); ++ ++ card->pci_reset_ongoing = false; + } + + static const struct pci_error_handlers mwifiex_pcie_err_handler = { +@@ -3142,7 +3146,19 @@ static void mwifiex_cleanup_pcie(struct mwifiex_adapter *adapter) + int ret; + u32 fw_status; + +- cancel_work_sync(&card->work); ++ /* Perform the cancel_work_sync() only when we're not resetting ++ * the card. It's because that function never returns if we're ++ * in reset path. If we're here when resetting the card, it means ++ * that we failed to reset the card (reset failure path). ++ */ ++ if (!card->pci_reset_ongoing) { ++ mwifiex_dbg(adapter, MSG, "performing cancel_work_sync()...\n"); ++ cancel_work_sync(&card->work); ++ mwifiex_dbg(adapter, MSG, "cancel_work_sync() done\n"); ++ } else { ++ mwifiex_dbg(adapter, MSG, ++ "skipped cancel_work_sync() because we're in card reset failure path\n"); ++ } + + ret = mwifiex_read_reg(adapter, reg->fw_status, &fw_status); + if (fw_status == FIRMWARE_READY_PCIE) { +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.h b/drivers/net/wireless/marvell/mwifiex/pcie.h +index 843d57eda8201..5ed613d657094 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.h ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.h +@@ -242,6 +242,8 @@ struct pcie_service_card { + struct mwifiex_msix_context share_irq_ctx; + struct work_struct work; + unsigned long work_flags; ++ ++ bool pci_reset_ongoing; + }; + + static inline int +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 4a33287371bda..99c59f93a0641 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3235,7 +3235,8 @@ static const struct pci_device_id nvme_id_table[] = { + { PCI_DEVICE(0x126f, 0x2263), /* Silicon Motion unidentified */ + .driver_data = NVME_QUIRK_NO_NS_DESC_LIST, }, + { PCI_DEVICE(0x1bb1, 0x0100), /* Seagate Nytro Flash Storage */ +- .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, }, ++ .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY | ++ NVME_QUIRK_NO_NS_DESC_LIST, }, + { PCI_DEVICE(0x1c58, 0x0003), /* HGST adapter */ + .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, }, + { PCI_DEVICE(0x1c58, 0x0023), /* WDC SN200 adapter */ +@@ -3249,6 +3250,9 @@ static const struct pci_device_id nvme_id_table[] = { + NVME_QUIRK_IGNORE_DEV_SUBNQN, }, + { PCI_DEVICE(0x1987, 0x5016), /* Phison E16 */ + .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, }, ++ { PCI_DEVICE(0x1b4b, 0x1092), /* Lexar 256 GB SSD */ ++ .driver_data = NVME_QUIRK_NO_NS_DESC_LIST | ++ NVME_QUIRK_IGNORE_DEV_SUBNQN, }, + { PCI_DEVICE(0x1d1d, 0x1f1f), /* LighNVM qemu device */ + .driver_data = NVME_QUIRK_LIGHTNVM, }, + { PCI_DEVICE(0x1d1d, 0x2807), /* CNEX WL */ +@@ -3264,6 +3268,8 @@ static const struct pci_device_id nvme_id_table[] = { + .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, }, + { PCI_DEVICE(0x15b7, 0x2001), /* Sandisk Skyhawk */ + .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, }, ++ { PCI_DEVICE(0x2646, 0x2262), /* KINGSTON SKC2000 NVMe SSD */ ++ .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, + { PCI_DEVICE(0x2646, 0x2263), /* KINGSTON A2000 NVMe SSD */ + .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, + { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001), +diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c +index 586b9d69fa5e2..d34ca0fda0f66 100644 +--- a/drivers/pci/controller/cadence/pci-j721e.c ++++ b/drivers/pci/controller/cadence/pci-j721e.c +@@ -63,6 +63,7 @@ enum j721e_pcie_mode { + + struct j721e_pcie_data { + enum j721e_pcie_mode mode; ++ bool quirk_retrain_flag; + }; + + static inline u32 j721e_pcie_user_readl(struct j721e_pcie *pcie, u32 offset) +@@ -270,6 +271,7 @@ static struct pci_ops cdns_ti_pcie_host_ops = { + + static const struct j721e_pcie_data j721e_pcie_rc_data = { + .mode = PCI_MODE_RC, ++ .quirk_retrain_flag = true, + }; + + static const struct j721e_pcie_data j721e_pcie_ep_data = { +@@ -378,6 +380,7 @@ static int j721e_pcie_probe(struct platform_device *pdev) + + bridge->ops = &cdns_ti_pcie_host_ops; + rc = pci_host_bridge_priv(bridge); ++ rc->quirk_retrain_flag = data->quirk_retrain_flag; + + cdns_pcie = &rc->pcie; + cdns_pcie->dev = dev; +diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c +index 1cb7cfc75d6e4..73dcf8cf98fbf 100644 +--- a/drivers/pci/controller/cadence/pcie-cadence-host.c ++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c +@@ -77,6 +77,68 @@ static struct pci_ops cdns_pcie_host_ops = { + .write = pci_generic_config_write, + }; + ++static int cdns_pcie_host_wait_for_link(struct cdns_pcie *pcie) ++{ ++ struct device *dev = pcie->dev; ++ int retries; ++ ++ /* Check if the link is up or not */ ++ for (retries = 0; retries < LINK_WAIT_MAX_RETRIES; retries++) { ++ if (cdns_pcie_link_up(pcie)) { ++ dev_info(dev, "Link up\n"); ++ return 0; ++ } ++ usleep_range(LINK_WAIT_USLEEP_MIN, LINK_WAIT_USLEEP_MAX); ++ } ++ ++ return -ETIMEDOUT; ++} ++ ++static int cdns_pcie_retrain(struct cdns_pcie *pcie) ++{ ++ u32 lnk_cap_sls, pcie_cap_off = CDNS_PCIE_RP_CAP_OFFSET; ++ u16 lnk_stat, lnk_ctl; ++ int ret = 0; ++ ++ /* ++ * Set retrain bit if current speed is 2.5 GB/s, ++ * but the PCIe root port support is > 2.5 GB/s. ++ */ ++ ++ lnk_cap_sls = cdns_pcie_readl(pcie, (CDNS_PCIE_RP_BASE + pcie_cap_off + ++ PCI_EXP_LNKCAP)); ++ if ((lnk_cap_sls & PCI_EXP_LNKCAP_SLS) <= PCI_EXP_LNKCAP_SLS_2_5GB) ++ return ret; ++ ++ lnk_stat = cdns_pcie_rp_readw(pcie, pcie_cap_off + PCI_EXP_LNKSTA); ++ if ((lnk_stat & PCI_EXP_LNKSTA_CLS) == PCI_EXP_LNKSTA_CLS_2_5GB) { ++ lnk_ctl = cdns_pcie_rp_readw(pcie, ++ pcie_cap_off + PCI_EXP_LNKCTL); ++ lnk_ctl |= PCI_EXP_LNKCTL_RL; ++ cdns_pcie_rp_writew(pcie, pcie_cap_off + PCI_EXP_LNKCTL, ++ lnk_ctl); ++ ++ ret = cdns_pcie_host_wait_for_link(pcie); ++ } ++ return ret; ++} ++ ++static int cdns_pcie_host_start_link(struct cdns_pcie_rc *rc) ++{ ++ struct cdns_pcie *pcie = &rc->pcie; ++ int ret; ++ ++ ret = cdns_pcie_host_wait_for_link(pcie); ++ ++ /* ++ * Retrain link for Gen2 training defect ++ * if quirk flag is set. ++ */ ++ if (!ret && rc->quirk_retrain_flag) ++ ret = cdns_pcie_retrain(pcie); ++ ++ return ret; ++} + + static int cdns_pcie_host_init_root_port(struct cdns_pcie_rc *rc) + { +@@ -399,23 +461,6 @@ static int cdns_pcie_host_init(struct device *dev, + return cdns_pcie_host_init_address_translation(rc); + } + +-static int cdns_pcie_host_wait_for_link(struct cdns_pcie *pcie) +-{ +- struct device *dev = pcie->dev; +- int retries; +- +- /* Check if the link is up or not */ +- for (retries = 0; retries < LINK_WAIT_MAX_RETRIES; retries++) { +- if (cdns_pcie_link_up(pcie)) { +- dev_info(dev, "Link up\n"); +- return 0; +- } +- usleep_range(LINK_WAIT_USLEEP_MIN, LINK_WAIT_USLEEP_MAX); +- } +- +- return -ETIMEDOUT; +-} +- + int cdns_pcie_host_setup(struct cdns_pcie_rc *rc) + { + struct device *dev = rc->pcie.dev; +@@ -458,7 +503,7 @@ int cdns_pcie_host_setup(struct cdns_pcie_rc *rc) + return ret; + } + +- ret = cdns_pcie_host_wait_for_link(pcie); ++ ret = cdns_pcie_host_start_link(rc); + if (ret) + dev_dbg(dev, "PCIe link never came up\n"); + +diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h +index feed1e3038f45..6705a5fedfbb0 100644 +--- a/drivers/pci/controller/cadence/pcie-cadence.h ++++ b/drivers/pci/controller/cadence/pcie-cadence.h +@@ -119,7 +119,7 @@ + * Root Port Registers (PCI configuration space for the root port function) + */ + #define CDNS_PCIE_RP_BASE 0x00200000 +- ++#define CDNS_PCIE_RP_CAP_OFFSET 0xc0 + + /* + * Address Translation Registers +@@ -290,6 +290,7 @@ struct cdns_pcie { + * @device_id: PCI device ID + * @avail_ib_bar: Satus of RP_BAR0, RP_BAR1 and RP_NO_BAR if it's free or + * available ++ * @quirk_retrain_flag: Retrain link as quirk for PCIe Gen2 + */ + struct cdns_pcie_rc { + struct cdns_pcie pcie; +@@ -298,6 +299,7 @@ struct cdns_pcie_rc { + u32 vendor_id; + u32 device_id; + bool avail_ib_bar[CDNS_PCIE_RP_MAX_IB]; ++ bool quirk_retrain_flag; + }; + + /** +@@ -413,6 +415,13 @@ static inline void cdns_pcie_rp_writew(struct cdns_pcie *pcie, + cdns_pcie_write_sz(addr, 0x2, value); + } + ++static inline u16 cdns_pcie_rp_readw(struct cdns_pcie *pcie, u32 reg) ++{ ++ void __iomem *addr = pcie->reg_base + CDNS_PCIE_RP_BASE + reg; ++ ++ return cdns_pcie_read_sz(addr, 0x2); ++} ++ + /* Endpoint Function register access */ + static inline void cdns_pcie_ep_fn_writeb(struct cdns_pcie *pcie, u8 fn, + u32 reg, u8 value) +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index fb1dc11e7cc52..b570f297e3ec1 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3998,6 +3998,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9183, + /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c46 */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x91a0, + quirk_dma_func1_alias); ++/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c135 */ ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9215, ++ quirk_dma_func1_alias); + /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c127 */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9220, + quirk_dma_func1_alias); +diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c +index 5592a929b5935..80983f9dfcd55 100644 +--- a/drivers/platform/x86/acer-wmi.c ++++ b/drivers/platform/x86/acer-wmi.c +@@ -30,6 +30,7 @@ + #include + #include + ++ACPI_MODULE_NAME(KBUILD_MODNAME); + MODULE_AUTHOR("Carlos Corbacho"); + MODULE_DESCRIPTION("Acer Laptop WMI Extras Driver"); + MODULE_LICENSE("GPL"); +@@ -80,7 +81,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026"); + + enum acer_wmi_event_ids { + WMID_HOTKEY_EVENT = 0x1, +- WMID_ACCEL_EVENT = 0x5, ++ WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5, + }; + + static const struct key_entry acer_wmi_keymap[] __initconst = { +@@ -128,7 +129,9 @@ struct event_return_value { + u8 function; + u8 key_num; + u16 device_state; +- u32 reserved; ++ u16 reserved1; ++ u8 kbd_dock_state; ++ u8 reserved2; + } __attribute__((packed)); + + /* +@@ -206,14 +209,13 @@ struct hotkey_function_type_aa { + /* + * Interface capability flags + */ +-#define ACER_CAP_MAILLED (1<<0) +-#define ACER_CAP_WIRELESS (1<<1) +-#define ACER_CAP_BLUETOOTH (1<<2) +-#define ACER_CAP_BRIGHTNESS (1<<3) +-#define ACER_CAP_THREEG (1<<4) +-#define ACER_CAP_ACCEL (1<<5) +-#define ACER_CAP_RFBTN (1<<6) +-#define ACER_CAP_ANY (0xFFFFFFFF) ++#define ACER_CAP_MAILLED BIT(0) ++#define ACER_CAP_WIRELESS BIT(1) ++#define ACER_CAP_BLUETOOTH BIT(2) ++#define ACER_CAP_BRIGHTNESS BIT(3) ++#define ACER_CAP_THREEG BIT(4) ++#define ACER_CAP_SET_FUNCTION_MODE BIT(5) ++#define ACER_CAP_KBD_DOCK BIT(6) + + /* + * Interface type flags +@@ -236,6 +238,7 @@ static int mailled = -1; + static int brightness = -1; + static int threeg = -1; + static int force_series; ++static int force_caps = -1; + static bool ec_raw_mode; + static bool has_type_aa; + static u16 commun_func_bitmap; +@@ -245,11 +248,13 @@ module_param(mailled, int, 0444); + module_param(brightness, int, 0444); + module_param(threeg, int, 0444); + module_param(force_series, int, 0444); ++module_param(force_caps, int, 0444); + module_param(ec_raw_mode, bool, 0444); + MODULE_PARM_DESC(mailled, "Set initial state of Mail LED"); + MODULE_PARM_DESC(brightness, "Set initial LCD backlight brightness"); + MODULE_PARM_DESC(threeg, "Set initial state of 3G hardware"); + MODULE_PARM_DESC(force_series, "Force a different laptop series"); ++MODULE_PARM_DESC(force_caps, "Force the capability bitmask to this value"); + MODULE_PARM_DESC(ec_raw_mode, "Enable EC raw mode"); + + struct acer_data { +@@ -319,6 +324,15 @@ static int __init dmi_matched(const struct dmi_system_id *dmi) + return 1; + } + ++static int __init set_force_caps(const struct dmi_system_id *dmi) ++{ ++ if (force_caps == -1) { ++ force_caps = (uintptr_t)dmi->driver_data; ++ pr_info("Found %s, set force_caps to 0x%x\n", dmi->ident, force_caps); ++ } ++ return 1; ++} ++ + static struct quirk_entry quirk_unknown = { + }; + +@@ -497,6 +511,33 @@ static const struct dmi_system_id acer_quirks[] __initconst = { + }, + .driver_data = &quirk_acer_travelmate_2490, + }, ++ { ++ .callback = set_force_caps, ++ .ident = "Acer Aspire Switch 10E SW3-016", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW3-016"), ++ }, ++ .driver_data = (void *)ACER_CAP_KBD_DOCK, ++ }, ++ { ++ .callback = set_force_caps, ++ .ident = "Acer Aspire Switch 10 SW5-012", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW5-012"), ++ }, ++ .driver_data = (void *)ACER_CAP_KBD_DOCK, ++ }, ++ { ++ .callback = set_force_caps, ++ .ident = "Acer One 10 (S1003)", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"), ++ }, ++ .driver_data = (void *)ACER_CAP_KBD_DOCK, ++ }, + {} + }; + +@@ -1253,10 +1294,8 @@ static void __init type_aa_dmi_decode(const struct dmi_header *header, void *d) + interface->capability |= ACER_CAP_THREEG; + if (type_aa->commun_func_bitmap & ACER_WMID3_GDS_BLUETOOTH) + interface->capability |= ACER_CAP_BLUETOOTH; +- if (type_aa->commun_func_bitmap & ACER_WMID3_GDS_RFBTN) { +- interface->capability |= ACER_CAP_RFBTN; ++ if (type_aa->commun_func_bitmap & ACER_WMID3_GDS_RFBTN) + commun_func_bitmap &= ~ACER_WMID3_GDS_RFBTN; +- } + + commun_fn_key_number = type_aa->commun_fn_key_number; + } +@@ -1520,7 +1559,7 @@ static int acer_gsensor_event(void) + struct acpi_buffer output; + union acpi_object out_obj[5]; + +- if (!has_cap(ACER_CAP_ACCEL)) ++ if (!acer_wmi_accel_dev) + return -1; + + output.length = sizeof(out_obj); +@@ -1543,6 +1582,71 @@ static int acer_gsensor_event(void) + return 0; + } + ++/* ++ * Switch series keyboard dock status ++ */ ++static int acer_kbd_dock_state_to_sw_tablet_mode(u8 kbd_dock_state) ++{ ++ switch (kbd_dock_state) { ++ case 0x01: /* Docked, traditional clamshell laptop mode */ ++ return 0; ++ case 0x04: /* Stand-alone tablet */ ++ case 0x40: /* Docked, tent mode, keyboard not usable */ ++ return 1; ++ default: ++ pr_warn("Unknown kbd_dock_state 0x%02x\n", kbd_dock_state); ++ } ++ ++ return 0; ++} ++ ++static void acer_kbd_dock_get_initial_state(void) ++{ ++ u8 *output, input[8] = { 0x05, 0x00, }; ++ struct acpi_buffer input_buf = { sizeof(input), input }; ++ struct acpi_buffer output_buf = { ACPI_ALLOCATE_BUFFER, NULL }; ++ union acpi_object *obj; ++ acpi_status status; ++ int sw_tablet_mode; ++ ++ status = wmi_evaluate_method(WMID_GUID3, 0, 0x2, &input_buf, &output_buf); ++ if (ACPI_FAILURE(status)) { ++ ACPI_EXCEPTION((AE_INFO, status, "Error getting keyboard-dock initial status")); ++ return; ++ } ++ ++ obj = output_buf.pointer; ++ if (!obj || obj->type != ACPI_TYPE_BUFFER || obj->buffer.length != 8) { ++ pr_err("Unexpected output format getting keyboard-dock initial status\n"); ++ goto out_free_obj; ++ } ++ ++ output = obj->buffer.pointer; ++ if (output[0] != 0x00 || (output[3] != 0x05 && output[3] != 0x45)) { ++ pr_err("Unexpected output [0]=0x%02x [3]=0x%02x getting keyboard-dock initial status\n", ++ output[0], output[3]); ++ goto out_free_obj; ++ } ++ ++ sw_tablet_mode = acer_kbd_dock_state_to_sw_tablet_mode(output[4]); ++ input_report_switch(acer_wmi_input_dev, SW_TABLET_MODE, sw_tablet_mode); ++ ++out_free_obj: ++ kfree(obj); ++} ++ ++static void acer_kbd_dock_event(const struct event_return_value *event) ++{ ++ int sw_tablet_mode; ++ ++ if (!has_cap(ACER_CAP_KBD_DOCK)) ++ return; ++ ++ sw_tablet_mode = acer_kbd_dock_state_to_sw_tablet_mode(event->kbd_dock_state); ++ input_report_switch(acer_wmi_input_dev, SW_TABLET_MODE, sw_tablet_mode); ++ input_sync(acer_wmi_input_dev); ++} ++ + /* + * Rfkill devices + */ +@@ -1770,8 +1874,9 @@ static void acer_wmi_notify(u32 value, void *context) + sparse_keymap_report_event(acer_wmi_input_dev, scancode, 1, true); + } + break; +- case WMID_ACCEL_EVENT: ++ case WMID_ACCEL_OR_KBD_DOCK_EVENT: + acer_gsensor_event(); ++ acer_kbd_dock_event(&return_value); + break; + default: + pr_warn("Unknown function number - %d - %d\n", +@@ -1894,8 +1999,6 @@ static int __init acer_wmi_accel_setup(void) + gsensor_handle = acpi_device_handle(adev); + acpi_dev_put(adev); + +- interface->capability |= ACER_CAP_ACCEL; +- + acer_wmi_accel_dev = input_allocate_device(); + if (!acer_wmi_accel_dev) + return -ENOMEM; +@@ -1921,11 +2024,6 @@ err_free_dev: + return err; + } + +-static void acer_wmi_accel_destroy(void) +-{ +- input_unregister_device(acer_wmi_accel_dev); +-} +- + static int __init acer_wmi_input_setup(void) + { + acpi_status status; +@@ -1943,6 +2041,9 @@ static int __init acer_wmi_input_setup(void) + if (err) + goto err_free_dev; + ++ if (has_cap(ACER_CAP_KBD_DOCK)) ++ input_set_capability(acer_wmi_input_dev, EV_SW, SW_TABLET_MODE); ++ + status = wmi_install_notify_handler(ACERWMID_EVENT_GUID, + acer_wmi_notify, NULL); + if (ACPI_FAILURE(status)) { +@@ -1950,6 +2051,9 @@ static int __init acer_wmi_input_setup(void) + goto err_free_dev; + } + ++ if (has_cap(ACER_CAP_KBD_DOCK)) ++ acer_kbd_dock_get_initial_state(); ++ + err = input_register_device(acer_wmi_input_dev); + if (err) + goto err_uninstall_notifier; +@@ -2080,7 +2184,7 @@ static int acer_resume(struct device *dev) + if (has_cap(ACER_CAP_BRIGHTNESS)) + set_u32(data->brightness, ACER_CAP_BRIGHTNESS); + +- if (has_cap(ACER_CAP_ACCEL)) ++ if (acer_wmi_accel_dev) + acer_gsensor_init(); + + return 0; +@@ -2181,7 +2285,7 @@ static int __init acer_wmi_init(void) + } + /* WMID always provides brightness methods */ + interface->capability |= ACER_CAP_BRIGHTNESS; +- } else if (!wmi_has_guid(WMID_GUID2) && interface && !has_type_aa) { ++ } else if (!wmi_has_guid(WMID_GUID2) && interface && !has_type_aa && force_caps == -1) { + pr_err("No WMID device detection method found\n"); + return -ENODEV; + } +@@ -2211,7 +2315,14 @@ static int __init acer_wmi_init(void) + if (acpi_video_get_backlight_type() != acpi_backlight_vendor) + interface->capability &= ~ACER_CAP_BRIGHTNESS; + +- if (wmi_has_guid(WMID_GUID3)) { ++ if (wmi_has_guid(WMID_GUID3)) ++ interface->capability |= ACER_CAP_SET_FUNCTION_MODE; ++ ++ if (force_caps != -1) ++ interface->capability = force_caps; ++ ++ if (wmi_has_guid(WMID_GUID3) && ++ (interface->capability & ACER_CAP_SET_FUNCTION_MODE)) { + if (ACPI_FAILURE(acer_wmi_enable_rf_button())) + pr_warn("Cannot enable RF Button Driver\n"); + +@@ -2270,8 +2381,8 @@ error_device_alloc: + error_platform_register: + if (wmi_has_guid(ACERWMID_EVENT_GUID)) + acer_wmi_input_destroy(); +- if (has_cap(ACER_CAP_ACCEL)) +- acer_wmi_accel_destroy(); ++ if (acer_wmi_accel_dev) ++ input_unregister_device(acer_wmi_accel_dev); + + return err; + } +@@ -2281,8 +2392,8 @@ static void __exit acer_wmi_exit(void) + if (wmi_has_guid(ACERWMID_EVENT_GUID)) + acer_wmi_input_destroy(); + +- if (has_cap(ACER_CAP_ACCEL)) +- acer_wmi_accel_destroy(); ++ if (acer_wmi_accel_dev) ++ input_unregister_device(acer_wmi_accel_dev); + + remove_debugfs(); + platform_device_unregister(acer_platform_device); +diff --git a/drivers/scsi/ufs/ufs-exynos.c b/drivers/scsi/ufs/ufs-exynos.c +index 5e6b95dbb578f..f54b494ca4486 100644 +--- a/drivers/scsi/ufs/ufs-exynos.c ++++ b/drivers/scsi/ufs/ufs-exynos.c +@@ -653,6 +653,11 @@ static int exynos_ufs_pre_pwr_mode(struct ufs_hba *hba, + } + } + ++ /* setting for three timeout values for traffic class #0 */ ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA0), 8064); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA1), 28224); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA2), 20160); ++ + return 0; + out: + return ret; +@@ -1249,7 +1254,9 @@ struct exynos_ufs_drv_data exynos_ufs_drvs = { + UFSHCI_QUIRK_BROKEN_HCE | + UFSHCI_QUIRK_SKIP_RESET_INTR_AGGR | + UFSHCD_QUIRK_BROKEN_OCS_FATAL_ERROR | +- UFSHCI_QUIRK_SKIP_MANUAL_WB_FLUSH_CTRL, ++ UFSHCI_QUIRK_SKIP_MANUAL_WB_FLUSH_CTRL | ++ UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING | ++ UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE, + .opts = EXYNOS_UFS_OPT_HAS_APB_CLK_CTRL | + EXYNOS_UFS_OPT_BROKEN_AUTO_CLK_CTRL | + EXYNOS_UFS_OPT_BROKEN_RX_SEL_IDX | +diff --git a/drivers/scsi/ufs/ufs-mediatek.c b/drivers/scsi/ufs/ufs-mediatek.c +index 914a827a93ee8..934713472ebce 100644 +--- a/drivers/scsi/ufs/ufs-mediatek.c ++++ b/drivers/scsi/ufs/ufs-mediatek.c +@@ -566,6 +566,7 @@ static int ufs_mtk_init(struct ufs_hba *hba) + + /* Enable WriteBooster */ + hba->caps |= UFSHCD_CAP_WB_EN; ++ hba->quirks |= UFSHCI_QUIRK_SKIP_MANUAL_WB_FLUSH_CTRL; + hba->vps->wb_flush_threshold = UFS_WB_BUF_REMAIN_PERCENT(80); + + /* +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 8132893284670..5a7cc2e42ffdf 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -4153,25 +4153,27 @@ static int ufshcd_change_power_mode(struct ufs_hba *hba, + ufshcd_dme_set(hba, UIC_ARG_MIB(PA_HSSERIES), + pwr_mode->hs_rate); + +- ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA0), +- DL_FC0ProtectionTimeOutVal_Default); +- ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA1), +- DL_TC0ReplayTimeOutVal_Default); +- ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA2), +- DL_AFC0ReqTimeOutVal_Default); +- ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA3), +- DL_FC1ProtectionTimeOutVal_Default); +- ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA4), +- DL_TC1ReplayTimeOutVal_Default); +- ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA5), +- DL_AFC1ReqTimeOutVal_Default); +- +- ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalFC0ProtectionTimeOutVal), +- DL_FC0ProtectionTimeOutVal_Default); +- ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalTC0ReplayTimeOutVal), +- DL_TC0ReplayTimeOutVal_Default); +- ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalAFC0ReqTimeOutVal), +- DL_AFC0ReqTimeOutVal_Default); ++ if (!(hba->quirks & UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING)) { ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA0), ++ DL_FC0ProtectionTimeOutVal_Default); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA1), ++ DL_TC0ReplayTimeOutVal_Default); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA2), ++ DL_AFC0ReqTimeOutVal_Default); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA3), ++ DL_FC1ProtectionTimeOutVal_Default); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA4), ++ DL_TC1ReplayTimeOutVal_Default); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA5), ++ DL_AFC1ReqTimeOutVal_Default); ++ ++ ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalFC0ProtectionTimeOutVal), ++ DL_FC0ProtectionTimeOutVal_Default); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalTC0ReplayTimeOutVal), ++ DL_TC0ReplayTimeOutVal_Default); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalAFC0ReqTimeOutVal), ++ DL_AFC0ReqTimeOutVal_Default); ++ } + + ret = ufshcd_uic_change_pwr_mode(hba, pwr_mode->pwr_rx << 4 + | pwr_mode->pwr_tx); +@@ -4746,6 +4748,8 @@ static int ufshcd_slave_configure(struct scsi_device *sdev) + struct request_queue *q = sdev->request_queue; + + blk_queue_update_dma_pad(q, PRDT_DATA_BYTE_COUNT_PAD - 1); ++ if (hba->quirks & UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE) ++ blk_queue_update_dma_alignment(q, PAGE_SIZE - 1); + + if (ufshcd_is_rpm_autosuspend_allowed(hba)) + sdev->rpm_autosuspend = 1; +diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h +index 6c62a281c8631..812aa348751eb 100644 +--- a/drivers/scsi/ufs/ufshcd.h ++++ b/drivers/scsi/ufs/ufshcd.h +@@ -544,6 +544,16 @@ enum ufshcd_quirks { + */ + UFSHCI_QUIRK_SKIP_MANUAL_WB_FLUSH_CTRL = 1 << 12, + ++ /* ++ * This quirk needs to disable unipro timeout values ++ * before power mode change ++ */ ++ UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING = 1 << 13, ++ ++ /* ++ * This quirk allows only sg entries aligned with page size. ++ */ ++ UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE = 1 << 14, + }; + + enum ufshcd_caps { +diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c +index 039ab5d2435eb..6eeb7ed8e91f3 100644 +--- a/drivers/usb/cdns3/core.c ++++ b/drivers/usb/cdns3/core.c +@@ -569,7 +569,8 @@ static int cdns3_probe(struct platform_device *pdev) + device_set_wakeup_capable(dev, true); + pm_runtime_set_active(dev); + pm_runtime_enable(dev); +- pm_runtime_forbid(dev); ++ if (!(cdns->pdata && (cdns->pdata->quirks & CDNS3_DEFAULT_PM_RUNTIME_ALLOW))) ++ pm_runtime_forbid(dev); + + /* + * The controller needs less time between bus and controller suspend, +diff --git a/drivers/usb/cdns3/core.h b/drivers/usb/cdns3/core.h +index 8a40d53d5edeb..3176f924293a1 100644 +--- a/drivers/usb/cdns3/core.h ++++ b/drivers/usb/cdns3/core.h +@@ -42,6 +42,8 @@ struct cdns3_role_driver { + struct cdns3_platform_data { + int (*platform_suspend)(struct device *dev, + bool suspend, bool wakeup); ++ unsigned long quirks; ++#define CDNS3_DEFAULT_PM_RUNTIME_ALLOW BIT(0) + }; + + /** +@@ -73,6 +75,7 @@ struct cdns3_platform_data { + * @wakeup_pending: wakeup interrupt pending + * @pdata: platform data from glue layer + * @lock: spinlock structure ++ * @xhci_plat_data: xhci private data structure pointer + */ + struct cdns3 { + struct device *dev; +@@ -106,6 +109,7 @@ struct cdns3 { + bool wakeup_pending; + struct cdns3_platform_data *pdata; + spinlock_t lock; ++ struct xhci_plat_priv *xhci_plat_data; + }; + + int cdns3_hw_role_switch(struct cdns3 *cdns); +diff --git a/drivers/usb/cdns3/host-export.h b/drivers/usb/cdns3/host-export.h +index ae11810f88261..26041718a086c 100644 +--- a/drivers/usb/cdns3/host-export.h ++++ b/drivers/usb/cdns3/host-export.h +@@ -9,9 +9,11 @@ + #ifndef __LINUX_CDNS3_HOST_EXPORT + #define __LINUX_CDNS3_HOST_EXPORT + ++struct usb_hcd; + #ifdef CONFIG_USB_CDNS3_HOST + + int cdns3_host_init(struct cdns3 *cdns); ++int xhci_cdns3_suspend_quirk(struct usb_hcd *hcd); + + #else + +@@ -21,6 +23,10 @@ static inline int cdns3_host_init(struct cdns3 *cdns) + } + + static inline void cdns3_host_exit(struct cdns3 *cdns) { } ++static inline int xhci_cdns3_suspend_quirk(struct usb_hcd *hcd) ++{ ++ return 0; ++} + + #endif /* CONFIG_USB_CDNS3_HOST */ + +diff --git a/drivers/usb/cdns3/host.c b/drivers/usb/cdns3/host.c +index b3e2cb69762cc..102977790d606 100644 +--- a/drivers/usb/cdns3/host.c ++++ b/drivers/usb/cdns3/host.c +@@ -14,6 +14,19 @@ + #include "drd.h" + #include "host-export.h" + #include ++#include "../host/xhci.h" ++#include "../host/xhci-plat.h" ++ ++#define XECP_PORT_CAP_REG 0x8000 ++#define XECP_AUX_CTRL_REG1 0x8120 ++ ++#define CFG_RXDET_P3_EN BIT(15) ++#define LPM_2_STB_SWITCH_EN BIT(25) ++ ++static const struct xhci_plat_priv xhci_plat_cdns3_xhci = { ++ .quirks = XHCI_SKIP_PHY_INIT, ++ .suspend_quirk = xhci_cdns3_suspend_quirk, ++}; + + static int __cdns3_host_init(struct cdns3 *cdns) + { +@@ -39,10 +52,25 @@ static int __cdns3_host_init(struct cdns3 *cdns) + goto err1; + } + ++ cdns->xhci_plat_data = kmemdup(&xhci_plat_cdns3_xhci, ++ sizeof(struct xhci_plat_priv), GFP_KERNEL); ++ if (!cdns->xhci_plat_data) { ++ ret = -ENOMEM; ++ goto err1; ++ } ++ ++ if (cdns->pdata && (cdns->pdata->quirks & CDNS3_DEFAULT_PM_RUNTIME_ALLOW)) ++ cdns->xhci_plat_data->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW; ++ ++ ret = platform_device_add_data(xhci, cdns->xhci_plat_data, ++ sizeof(struct xhci_plat_priv)); ++ if (ret) ++ goto free_memory; ++ + ret = platform_device_add(xhci); + if (ret) { + dev_err(cdns->dev, "failed to register xHCI device\n"); +- goto err1; ++ goto free_memory; + } + + /* Glue needs to access xHCI region register for Power management */ +@@ -51,13 +79,43 @@ static int __cdns3_host_init(struct cdns3 *cdns) + cdns->xhci_regs = hcd->regs; + + return 0; ++ ++free_memory: ++ kfree(cdns->xhci_plat_data); + err1: + platform_device_put(xhci); + return ret; + } + ++int xhci_cdns3_suspend_quirk(struct usb_hcd *hcd) ++{ ++ struct xhci_hcd *xhci = hcd_to_xhci(hcd); ++ u32 value; ++ ++ if (pm_runtime_status_suspended(hcd->self.controller)) ++ return 0; ++ ++ /* set usbcmd.EU3S */ ++ value = readl(&xhci->op_regs->command); ++ value |= CMD_PM_INDEX; ++ writel(value, &xhci->op_regs->command); ++ ++ if (hcd->regs) { ++ value = readl(hcd->regs + XECP_AUX_CTRL_REG1); ++ value |= CFG_RXDET_P3_EN; ++ writel(value, hcd->regs + XECP_AUX_CTRL_REG1); ++ ++ value = readl(hcd->regs + XECP_PORT_CAP_REG); ++ value |= LPM_2_STB_SWITCH_EN; ++ writel(value, hcd->regs + XECP_PORT_CAP_REG); ++ } ++ ++ return 0; ++} ++ + static void cdns3_host_exit(struct cdns3 *cdns) + { ++ kfree(cdns->xhci_plat_data); + platform_device_unregister(cdns->host_dev); + cdns->host_dev = NULL; + cdns3_drd_host_off(cdns); +diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c +index 36e0de34ec68b..4e2cce5ca7f6a 100644 +--- a/fs/btrfs/delayed-inode.c ++++ b/fs/btrfs/delayed-inode.c +@@ -627,7 +627,8 @@ static int btrfs_delayed_inode_reserve_metadata( + */ + if (!src_rsv || (!trans->bytes_reserved && + src_rsv->type != BTRFS_BLOCK_RSV_DELALLOC)) { +- ret = btrfs_qgroup_reserve_meta_prealloc(root, num_bytes, true); ++ ret = btrfs_qgroup_reserve_meta(root, num_bytes, ++ BTRFS_QGROUP_RSV_META_PREALLOC, true); + if (ret < 0) + return ret; + ret = btrfs_block_rsv_add(root, dst_rsv, num_bytes, +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 9b3df72ceffbb..cbeb0cdaca7af 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -5798,7 +5798,7 @@ static int btrfs_dirty_inode(struct inode *inode) + return PTR_ERR(trans); + + ret = btrfs_update_inode(trans, root, inode); +- if (ret && ret == -ENOSPC) { ++ if (ret && (ret == -ENOSPC || ret == -EDQUOT)) { + /* whoops, lets try again with the full transaction */ + btrfs_end_transaction(trans); + trans = btrfs_start_transaction(root, 1); +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index d504a9a207515..cd9b1a16489b4 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -3875,8 +3875,8 @@ static int sub_root_meta_rsv(struct btrfs_root *root, int num_bytes, + return num_bytes; + } + +-static int qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, +- enum btrfs_qgroup_rsv_type type, bool enforce) ++int btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, ++ enum btrfs_qgroup_rsv_type type, bool enforce) + { + struct btrfs_fs_info *fs_info = root->fs_info; + int ret; +@@ -3907,14 +3907,14 @@ int __btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, + { + int ret; + +- ret = qgroup_reserve_meta(root, num_bytes, type, enforce); ++ ret = btrfs_qgroup_reserve_meta(root, num_bytes, type, enforce); + if (ret <= 0 && ret != -EDQUOT) + return ret; + + ret = try_flush_qgroup(root); + if (ret < 0) + return ret; +- return qgroup_reserve_meta(root, num_bytes, type, enforce); ++ return btrfs_qgroup_reserve_meta(root, num_bytes, type, enforce); + } + + void btrfs_qgroup_free_meta_all_pertrans(struct btrfs_root *root) +diff --git a/fs/btrfs/qgroup.h b/fs/btrfs/qgroup.h +index 50dea9a2d8fbd..7283e4f549af7 100644 +--- a/fs/btrfs/qgroup.h ++++ b/fs/btrfs/qgroup.h +@@ -361,6 +361,8 @@ int btrfs_qgroup_release_data(struct btrfs_inode *inode, u64 start, u64 len); + int btrfs_qgroup_free_data(struct btrfs_inode *inode, + struct extent_changeset *reserved, u64 start, + u64 len); ++int btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, ++ enum btrfs_qgroup_rsv_type type, bool enforce); + int __btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, + enum btrfs_qgroup_rsv_type type, bool enforce); + /* Reserve metadata space for pertrans and prealloc type */ +diff --git a/include/linux/eeprom_93xx46.h b/include/linux/eeprom_93xx46.h +index eec7928ff8fe0..99580c22f91a4 100644 +--- a/include/linux/eeprom_93xx46.h ++++ b/include/linux/eeprom_93xx46.h +@@ -16,6 +16,8 @@ struct eeprom_93xx46_platform_data { + #define EEPROM_93XX46_QUIRK_SINGLE_WORD_READ (1 << 0) + /* Instructions such as EWEN are (addrlen + 2) in length. */ + #define EEPROM_93XX46_QUIRK_INSTRUCTION_LENGTH (1 << 1) ++/* Add extra cycle after address during a read */ ++#define EEPROM_93XX46_QUIRK_EXTRA_READ_CYCLE BIT(2) + + /* + * optional hooks to control additional logic +diff --git a/include/linux/platform_data/ti-sysc.h b/include/linux/platform_data/ti-sysc.h +index 240dce553a0bd..fafc1beea504a 100644 +--- a/include/linux/platform_data/ti-sysc.h ++++ b/include/linux/platform_data/ti-sysc.h +@@ -50,6 +50,7 @@ struct sysc_regbits { + s8 emufree_shift; + }; + ++#define SYSC_QUIRK_GPMC_DEBUG BIT(26) + #define SYSC_MODULE_QUIRK_ENA_RESETDONE BIT(25) + #define SYSC_MODULE_QUIRK_PRUSS BIT(24) + #define SYSC_MODULE_QUIRK_DSS_RESET BIT(23) +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 3af4cb87032ce..d56db9f34373e 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -437,6 +437,18 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, ++ { ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ARCHOS"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "ARCHOS 140 CESIUM"), ++ }, ++ .driver_data = (void *)(BYT_RT5640_IN1_MAP | ++ BYT_RT5640_JD_SRC_JD2_IN4N | ++ BYT_RT5640_OVCD_TH_2000UA | ++ BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index 0f1d845a0ccad..1d7677376e742 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -48,26 +48,14 @@ static int sof_sdw_quirk_cb(const struct dmi_system_id *id) + } + + static const struct dmi_system_id sof_sdw_quirk_table[] = { ++ /* CometLake devices */ + { + .callback = sof_sdw_quirk_cb, + .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"), +- DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0A3E") +- }, +- .driver_data = (void *)(SOF_SDW_TGL_HDMI | +- SOF_RT711_JD_SRC_JD2 | +- SOF_RT715_DAI_ID_FIX), +- }, +- { +- .callback = sof_sdw_quirk_cb, +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"), +- DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0A5E") ++ DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "CometLake Client"), + }, +- .driver_data = (void *)(SOF_SDW_TGL_HDMI | +- SOF_RT711_JD_SRC_JD2 | +- SOF_RT715_DAI_ID_FIX | +- SOF_SDW_FOUR_SPK), ++ .driver_data = (void *)SOF_SDW_PCH_DMIC, + }, + { + .callback = sof_sdw_quirk_cb, +@@ -98,7 +86,7 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + SOF_RT715_DAI_ID_FIX | + SOF_SDW_FOUR_SPK), + }, +- { ++ { + .callback = sof_sdw_quirk_cb, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"), +@@ -108,6 +96,16 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + SOF_RT715_DAI_ID_FIX | + SOF_SDW_FOUR_SPK), + }, ++ /* IceLake devices */ ++ { ++ .callback = sof_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Ice Lake Client"), ++ }, ++ .driver_data = (void *)SOF_SDW_PCH_DMIC, ++ }, ++ /* TigerLake devices */ + { + .callback = sof_sdw_quirk_cb, + .matches = { +@@ -123,18 +121,23 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + { + .callback = sof_sdw_quirk_cb, + .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), +- DMI_MATCH(DMI_PRODUCT_NAME, "Ice Lake Client"), ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0A3E") + }, +- .driver_data = (void *)SOF_SDW_PCH_DMIC, ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ SOF_RT711_JD_SRC_JD2 | ++ SOF_RT715_DAI_ID_FIX), + }, + { + .callback = sof_sdw_quirk_cb, + .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), +- DMI_MATCH(DMI_PRODUCT_NAME, "CometLake Client"), ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0A5E") + }, +- .driver_data = (void *)SOF_SDW_PCH_DMIC, ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ SOF_RT711_JD_SRC_JD2 | ++ SOF_RT715_DAI_ID_FIX | ++ SOF_SDW_FOUR_SPK), + }, + { + .callback = sof_sdw_quirk_cb, +@@ -156,7 +159,34 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + SOF_SDW_PCH_DMIC | + SOF_SDW_FOUR_SPK), + }, +- ++ { ++ /* ++ * this entry covers multiple HP SKUs. The family name ++ * does not seem robust enough, so we use a partial ++ * match that ignores the product name suffix ++ * (e.g. 15-eb1xxx, 14t-ea000 or 13-aw2xxx) ++ */ ++ .callback = sof_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Spectre x360 Convertible"), ++ }, ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ SOF_SDW_PCH_DMIC | ++ SOF_RT711_JD_SRC_JD2), ++ }, ++ /* TigerLake-SDCA devices */ ++ { ++ .callback = sof_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0A32") ++ }, ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ SOF_RT711_JD_SRC_JD2 | ++ SOF_RT715_DAI_ID_FIX | ++ SOF_SDW_FOUR_SPK), ++ }, + {} + }; + +diff --git a/sound/soc/sof/intel/Kconfig b/sound/soc/sof/intel/Kconfig +index de7ff2d097ab9..6708a2c5a8381 100644 +--- a/sound/soc/sof/intel/Kconfig ++++ b/sound/soc/sof/intel/Kconfig +@@ -84,7 +84,7 @@ config SND_SOC_SOF_BAYTRAIL + + config SND_SOC_SOF_BROADWELL_SUPPORT + bool "SOF support for Broadwell" +- depends on SND_SOC_INTEL_HASWELL=n ++ depends on SND_SOC_INTEL_CATPT=n + help + This adds support for Sound Open Firmware for Intel(R) platforms + using the Broadwell processors. +diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c +index df036a359f2fc..448de77f43fd8 100644 +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -2603,141 +2603,251 @@ static int snd_bbfpro_controls_create(struct usb_mixer_interface *mixer) + } + + /* +- * Pioneer DJ DJM-250MK2 and maybe other DJM models ++ * Pioneer DJ DJM Mixers + * +- * For playback, no duplicate mapping should be set. +- * There are three mixer stereo channels (CH1, CH2, AUX) +- * and three stereo sources (Playback 1-2, Playback 3-4, Playback 5-6). +- * Each channel should be mapped just once to one source. +- * If mapped multiple times, only one source will play on given channel +- * (sources are not mixed together). ++ * These devices generally have options for soft-switching the playback and ++ * capture sources in addition to the recording level. Although different ++ * devices have different configurations, there seems to be canonical values ++ * for specific capture/playback types: See the definitions of these below. + * +- * For recording, duplicate mapping is OK. We will get the same signal multiple times. +- * +- * Channels 7-8 are in both directions fixed to FX SEND / FX RETURN. +- * +- * See also notes in the quirks-table.h file. ++ * The wValue is masked with the stereo channel number. e.g. Setting Ch2 to ++ * capture phono would be 0x0203. Capture, playback and capture level have ++ * different wIndexes. + */ + +-struct snd_pioneer_djm_option { +- const u16 wIndex; +- const u16 wValue; ++// Capture types ++#define SND_DJM_CAP_LINE 0x00 ++#define SND_DJM_CAP_CDLINE 0x01 ++#define SND_DJM_CAP_DIGITAL 0x02 ++#define SND_DJM_CAP_PHONO 0x03 ++#define SND_DJM_CAP_PFADER 0x06 ++#define SND_DJM_CAP_XFADERA 0x07 ++#define SND_DJM_CAP_XFADERB 0x08 ++#define SND_DJM_CAP_MIC 0x09 ++#define SND_DJM_CAP_AUX 0x0d ++#define SND_DJM_CAP_RECOUT 0x0a ++#define SND_DJM_CAP_NONE 0x0f ++#define SND_DJM_CAP_CH1PFADER 0x11 ++#define SND_DJM_CAP_CH2PFADER 0x12 ++#define SND_DJM_CAP_CH3PFADER 0x13 ++#define SND_DJM_CAP_CH4PFADER 0x14 ++ ++// Playback types ++#define SND_DJM_PB_CH1 0x00 ++#define SND_DJM_PB_CH2 0x01 ++#define SND_DJM_PB_AUX 0x04 ++ ++#define SND_DJM_WINDEX_CAP 0x8002 ++#define SND_DJM_WINDEX_CAPLVL 0x8003 ++#define SND_DJM_WINDEX_PB 0x8016 ++ ++// kcontrol->private_value layout ++#define SND_DJM_VALUE_MASK 0x0000ffff ++#define SND_DJM_GROUP_MASK 0x00ff0000 ++#define SND_DJM_DEVICE_MASK 0xff000000 ++#define SND_DJM_GROUP_SHIFT 16 ++#define SND_DJM_DEVICE_SHIFT 24 ++ ++// device table index ++#define SND_DJM_250MK2_IDX 0x0 ++#define SND_DJM_750_IDX 0x1 ++#define SND_DJM_900NXS2_IDX 0x2 ++ ++ ++#define SND_DJM_CTL(_name, suffix, _default_value, _windex) { \ ++ .name = _name, \ ++ .options = snd_djm_opts_##suffix, \ ++ .noptions = ARRAY_SIZE(snd_djm_opts_##suffix), \ ++ .default_value = _default_value, \ ++ .wIndex = _windex } ++ ++#define SND_DJM_DEVICE(suffix) { \ ++ .controls = snd_djm_ctls_##suffix, \ ++ .ncontrols = ARRAY_SIZE(snd_djm_ctls_##suffix) } ++ ++ ++struct snd_djm_device { + const char *name; ++ const struct snd_djm_ctl *controls; ++ size_t ncontrols; + }; + +-static const struct snd_pioneer_djm_option snd_pioneer_djm_options_capture_level[] = { +- { .name = "-5 dB", .wValue = 0x0300, .wIndex = 0x8003 }, +- { .name = "-10 dB", .wValue = 0x0200, .wIndex = 0x8003 }, +- { .name = "-15 dB", .wValue = 0x0100, .wIndex = 0x8003 }, +- { .name = "-19 dB", .wValue = 0x0000, .wIndex = 0x8003 } ++struct snd_djm_ctl { ++ const char *name; ++ const u16 *options; ++ size_t noptions; ++ u16 default_value; ++ u16 wIndex; + }; + +-static const struct snd_pioneer_djm_option snd_pioneer_djm_options_capture_ch12[] = { +- { .name = "CH1 Control Tone PHONO", .wValue = 0x0103, .wIndex = 0x8002 }, +- { .name = "CH1 Control Tone LINE", .wValue = 0x0100, .wIndex = 0x8002 }, +- { .name = "Post CH1 Fader", .wValue = 0x0106, .wIndex = 0x8002 }, +- { .name = "Cross Fader A", .wValue = 0x0107, .wIndex = 0x8002 }, +- { .name = "Cross Fader B", .wValue = 0x0108, .wIndex = 0x8002 }, +- { .name = "MIC", .wValue = 0x0109, .wIndex = 0x8002 }, +- { .name = "AUX", .wValue = 0x010d, .wIndex = 0x8002 }, +- { .name = "REC OUT", .wValue = 0x010a, .wIndex = 0x8002 } ++static const char *snd_djm_get_label_caplevel(u16 wvalue) ++{ ++ switch (wvalue) { ++ case 0x0000: return "-19dB"; ++ case 0x0100: return "-15dB"; ++ case 0x0200: return "-10dB"; ++ case 0x0300: return "-5dB"; ++ default: return NULL; ++ } + }; + +-static const struct snd_pioneer_djm_option snd_pioneer_djm_options_capture_ch34[] = { +- { .name = "CH2 Control Tone PHONO", .wValue = 0x0203, .wIndex = 0x8002 }, +- { .name = "CH2 Control Tone LINE", .wValue = 0x0200, .wIndex = 0x8002 }, +- { .name = "Post CH2 Fader", .wValue = 0x0206, .wIndex = 0x8002 }, +- { .name = "Cross Fader A", .wValue = 0x0207, .wIndex = 0x8002 }, +- { .name = "Cross Fader B", .wValue = 0x0208, .wIndex = 0x8002 }, +- { .name = "MIC", .wValue = 0x0209, .wIndex = 0x8002 }, +- { .name = "AUX", .wValue = 0x020d, .wIndex = 0x8002 }, +- { .name = "REC OUT", .wValue = 0x020a, .wIndex = 0x8002 } ++static const char *snd_djm_get_label_cap(u16 wvalue) ++{ ++ switch (wvalue & 0x00ff) { ++ case SND_DJM_CAP_LINE: return "Control Tone LINE"; ++ case SND_DJM_CAP_CDLINE: return "Control Tone CD/LINE"; ++ case SND_DJM_CAP_DIGITAL: return "Control Tone DIGITAL"; ++ case SND_DJM_CAP_PHONO: return "Control Tone PHONO"; ++ case SND_DJM_CAP_PFADER: return "Post Fader"; ++ case SND_DJM_CAP_XFADERA: return "Cross Fader A"; ++ case SND_DJM_CAP_XFADERB: return "Cross Fader B"; ++ case SND_DJM_CAP_MIC: return "Mic"; ++ case SND_DJM_CAP_RECOUT: return "Rec Out"; ++ case SND_DJM_CAP_AUX: return "Aux"; ++ case SND_DJM_CAP_NONE: return "None"; ++ case SND_DJM_CAP_CH1PFADER: return "Post Fader Ch1"; ++ case SND_DJM_CAP_CH2PFADER: return "Post Fader Ch2"; ++ case SND_DJM_CAP_CH3PFADER: return "Post Fader Ch3"; ++ case SND_DJM_CAP_CH4PFADER: return "Post Fader Ch4"; ++ default: return NULL; ++ } + }; + +-static const struct snd_pioneer_djm_option snd_pioneer_djm_options_capture_ch56[] = { +- { .name = "REC OUT", .wValue = 0x030a, .wIndex = 0x8002 }, +- { .name = "Post CH1 Fader", .wValue = 0x0311, .wIndex = 0x8002 }, +- { .name = "Post CH2 Fader", .wValue = 0x0312, .wIndex = 0x8002 }, +- { .name = "Cross Fader A", .wValue = 0x0307, .wIndex = 0x8002 }, +- { .name = "Cross Fader B", .wValue = 0x0308, .wIndex = 0x8002 }, +- { .name = "MIC", .wValue = 0x0309, .wIndex = 0x8002 }, +- { .name = "AUX", .wValue = 0x030d, .wIndex = 0x8002 } ++static const char *snd_djm_get_label_pb(u16 wvalue) ++{ ++ switch (wvalue & 0x00ff) { ++ case SND_DJM_PB_CH1: return "Ch1"; ++ case SND_DJM_PB_CH2: return "Ch2"; ++ case SND_DJM_PB_AUX: return "Aux"; ++ default: return NULL; ++ } + }; + +-static const struct snd_pioneer_djm_option snd_pioneer_djm_options_playback_12[] = { +- { .name = "CH1", .wValue = 0x0100, .wIndex = 0x8016 }, +- { .name = "CH2", .wValue = 0x0101, .wIndex = 0x8016 }, +- { .name = "AUX", .wValue = 0x0104, .wIndex = 0x8016 } ++static const char *snd_djm_get_label(u16 wvalue, u16 windex) ++{ ++ switch (windex) { ++ case SND_DJM_WINDEX_CAPLVL: return snd_djm_get_label_caplevel(wvalue); ++ case SND_DJM_WINDEX_CAP: return snd_djm_get_label_cap(wvalue); ++ case SND_DJM_WINDEX_PB: return snd_djm_get_label_pb(wvalue); ++ default: return NULL; ++ } + }; + +-static const struct snd_pioneer_djm_option snd_pioneer_djm_options_playback_34[] = { +- { .name = "CH1", .wValue = 0x0200, .wIndex = 0x8016 }, +- { .name = "CH2", .wValue = 0x0201, .wIndex = 0x8016 }, +- { .name = "AUX", .wValue = 0x0204, .wIndex = 0x8016 } ++ ++// DJM-250MK2 ++static const u16 snd_djm_opts_cap_level[] = { ++ 0x0000, 0x0100, 0x0200, 0x0300 }; ++ ++static const u16 snd_djm_opts_250mk2_cap1[] = { ++ 0x0103, 0x0100, 0x0106, 0x0107, 0x0108, 0x0109, 0x010d, 0x010a }; ++ ++static const u16 snd_djm_opts_250mk2_cap2[] = { ++ 0x0203, 0x0200, 0x0206, 0x0207, 0x0208, 0x0209, 0x020d, 0x020a }; ++ ++static const u16 snd_djm_opts_250mk2_cap3[] = { ++ 0x030a, 0x0311, 0x0312, 0x0307, 0x0308, 0x0309, 0x030d }; ++ ++static const u16 snd_djm_opts_250mk2_pb1[] = { 0x0100, 0x0101, 0x0104 }; ++static const u16 snd_djm_opts_250mk2_pb2[] = { 0x0200, 0x0201, 0x0204 }; ++static const u16 snd_djm_opts_250mk2_pb3[] = { 0x0300, 0x0301, 0x0304 }; ++ ++static const struct snd_djm_ctl snd_djm_ctls_250mk2[] = { ++ SND_DJM_CTL("Capture Level", cap_level, 0, SND_DJM_WINDEX_CAPLVL), ++ SND_DJM_CTL("Ch1 Input", 250mk2_cap1, 2, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch2 Input", 250mk2_cap2, 2, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch3 Input", 250mk2_cap3, 0, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch1 Output", 250mk2_pb1, 0, SND_DJM_WINDEX_PB), ++ SND_DJM_CTL("Ch2 Output", 250mk2_pb2, 1, SND_DJM_WINDEX_PB), ++ SND_DJM_CTL("Ch3 Output", 250mk2_pb3, 2, SND_DJM_WINDEX_PB) + }; + +-static const struct snd_pioneer_djm_option snd_pioneer_djm_options_playback_56[] = { +- { .name = "CH1", .wValue = 0x0300, .wIndex = 0x8016 }, +- { .name = "CH2", .wValue = 0x0301, .wIndex = 0x8016 }, +- { .name = "AUX", .wValue = 0x0304, .wIndex = 0x8016 } ++ ++// DJM-750 ++static const u16 snd_djm_opts_750_cap1[] = { ++ 0x0101, 0x0103, 0x0106, 0x0107, 0x0108, 0x0109, 0x010a, 0x010f }; ++static const u16 snd_djm_opts_750_cap2[] = { ++ 0x0200, 0x0201, 0x0206, 0x0207, 0x0208, 0x0209, 0x020a, 0x020f }; ++static const u16 snd_djm_opts_750_cap3[] = { ++ 0x0300, 0x0301, 0x0306, 0x0307, 0x0308, 0x0309, 0x030a, 0x030f }; ++static const u16 snd_djm_opts_750_cap4[] = { ++ 0x0401, 0x0403, 0x0406, 0x0407, 0x0408, 0x0409, 0x040a, 0x040f }; ++ ++static const struct snd_djm_ctl snd_djm_ctls_750[] = { ++ SND_DJM_CTL("Capture Level", cap_level, 0, SND_DJM_WINDEX_CAPLVL), ++ SND_DJM_CTL("Ch1 Input", 750_cap1, 2, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch2 Input", 750_cap2, 2, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch3 Input", 750_cap3, 0, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch4 Input", 750_cap4, 0, SND_DJM_WINDEX_CAP) + }; + +-struct snd_pioneer_djm_option_group { +- const char *name; +- const struct snd_pioneer_djm_option *options; +- const size_t count; +- const u16 default_value; ++ ++// DJM-900NXS2 ++static const u16 snd_djm_opts_900nxs2_cap1[] = { ++ 0x0100, 0x0102, 0x0103, 0x0106, 0x0107, 0x0108, 0x0109, 0x010a }; ++static const u16 snd_djm_opts_900nxs2_cap2[] = { ++ 0x0200, 0x0202, 0x0203, 0x0206, 0x0207, 0x0208, 0x0209, 0x020a }; ++static const u16 snd_djm_opts_900nxs2_cap3[] = { ++ 0x0300, 0x0302, 0x0303, 0x0306, 0x0307, 0x0308, 0x0309, 0x030a }; ++static const u16 snd_djm_opts_900nxs2_cap4[] = { ++ 0x0400, 0x0402, 0x0403, 0x0406, 0x0407, 0x0408, 0x0409, 0x040a }; ++static const u16 snd_djm_opts_900nxs2_cap5[] = { ++ 0x0507, 0x0508, 0x0509, 0x050a, 0x0511, 0x0512, 0x0513, 0x0514 }; ++ ++static const struct snd_djm_ctl snd_djm_ctls_900nxs2[] = { ++ SND_DJM_CTL("Capture Level", cap_level, 0, SND_DJM_WINDEX_CAPLVL), ++ SND_DJM_CTL("Ch1 Input", 900nxs2_cap1, 2, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch2 Input", 900nxs2_cap2, 2, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch3 Input", 900nxs2_cap3, 2, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch4 Input", 900nxs2_cap4, 2, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch5 Input", 900nxs2_cap5, 3, SND_DJM_WINDEX_CAP) + }; + +-#define snd_pioneer_djm_option_group_item(_name, suffix, _default_value) { \ +- .name = _name, \ +- .options = snd_pioneer_djm_options_##suffix, \ +- .count = ARRAY_SIZE(snd_pioneer_djm_options_##suffix), \ +- .default_value = _default_value } +- +-static const struct snd_pioneer_djm_option_group snd_pioneer_djm_option_groups[] = { +- snd_pioneer_djm_option_group_item("Master Capture Level Capture Switch", capture_level, 0), +- snd_pioneer_djm_option_group_item("Capture 1-2 Capture Switch", capture_ch12, 2), +- snd_pioneer_djm_option_group_item("Capture 3-4 Capture Switch", capture_ch34, 2), +- snd_pioneer_djm_option_group_item("Capture 5-6 Capture Switch", capture_ch56, 0), +- snd_pioneer_djm_option_group_item("Playback 1-2 Playback Switch", playback_12, 0), +- snd_pioneer_djm_option_group_item("Playback 3-4 Playback Switch", playback_34, 1), +- snd_pioneer_djm_option_group_item("Playback 5-6 Playback Switch", playback_56, 2) ++ ++static const struct snd_djm_device snd_djm_devices[] = { ++ SND_DJM_DEVICE(250mk2), ++ SND_DJM_DEVICE(750), ++ SND_DJM_DEVICE(900nxs2) + }; + +-// layout of the kcontrol->private_value: +-#define SND_PIONEER_DJM_VALUE_MASK 0x0000ffff +-#define SND_PIONEER_DJM_GROUP_MASK 0xffff0000 +-#define SND_PIONEER_DJM_GROUP_SHIFT 16 + +-static int snd_pioneer_djm_controls_info(struct snd_kcontrol *kctl, struct snd_ctl_elem_info *info) ++static int snd_djm_controls_info(struct snd_kcontrol *kctl, ++ struct snd_ctl_elem_info *info) + { +- u16 group_index = kctl->private_value >> SND_PIONEER_DJM_GROUP_SHIFT; +- size_t count; ++ unsigned long private_value = kctl->private_value; ++ u8 device_idx = (private_value & SND_DJM_DEVICE_MASK) >> SND_DJM_DEVICE_SHIFT; ++ u8 ctl_idx = (private_value & SND_DJM_GROUP_MASK) >> SND_DJM_GROUP_SHIFT; ++ const struct snd_djm_device *device = &snd_djm_devices[device_idx]; + const char *name; +- const struct snd_pioneer_djm_option_group *group; ++ const struct snd_djm_ctl *ctl; ++ size_t noptions; + +- if (group_index >= ARRAY_SIZE(snd_pioneer_djm_option_groups)) ++ if (ctl_idx >= device->ncontrols) ++ return -EINVAL; ++ ++ ctl = &device->controls[ctl_idx]; ++ noptions = ctl->noptions; ++ if (info->value.enumerated.item >= noptions) ++ info->value.enumerated.item = noptions - 1; ++ ++ name = snd_djm_get_label(ctl->options[info->value.enumerated.item], ++ ctl->wIndex); ++ if (!name) + return -EINVAL; + +- group = &snd_pioneer_djm_option_groups[group_index]; +- count = group->count; +- if (info->value.enumerated.item >= count) +- info->value.enumerated.item = count - 1; +- name = group->options[info->value.enumerated.item].name; + strlcpy(info->value.enumerated.name, name, sizeof(info->value.enumerated.name)); + info->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED; + info->count = 1; +- info->value.enumerated.items = count; ++ info->value.enumerated.items = noptions; + return 0; + } + +-static int snd_pioneer_djm_controls_update(struct usb_mixer_interface *mixer, u16 group, u16 value) ++static int snd_djm_controls_update(struct usb_mixer_interface *mixer, ++ u8 device_idx, u8 group, u16 value) + { + int err; ++ const struct snd_djm_device *device = &snd_djm_devices[device_idx]; + +- if (group >= ARRAY_SIZE(snd_pioneer_djm_option_groups) +- || value >= snd_pioneer_djm_option_groups[group].count) ++ if ((group >= device->ncontrols) || value >= device->controls[group].noptions) + return -EINVAL; + + err = snd_usb_lock_shutdown(mixer->chip); +@@ -2748,63 +2858,76 @@ static int snd_pioneer_djm_controls_update(struct usb_mixer_interface *mixer, u1 + mixer->chip->dev, usb_sndctrlpipe(mixer->chip->dev, 0), + USB_REQ_SET_FEATURE, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- snd_pioneer_djm_option_groups[group].options[value].wValue, +- snd_pioneer_djm_option_groups[group].options[value].wIndex, ++ device->controls[group].options[value], ++ device->controls[group].wIndex, + NULL, 0); + + snd_usb_unlock_shutdown(mixer->chip); + return err; + } + +-static int snd_pioneer_djm_controls_get(struct snd_kcontrol *kctl, struct snd_ctl_elem_value *elem) ++static int snd_djm_controls_get(struct snd_kcontrol *kctl, ++ struct snd_ctl_elem_value *elem) + { +- elem->value.enumerated.item[0] = kctl->private_value & SND_PIONEER_DJM_VALUE_MASK; ++ elem->value.enumerated.item[0] = kctl->private_value & SND_DJM_VALUE_MASK; + return 0; + } + +-static int snd_pioneer_djm_controls_put(struct snd_kcontrol *kctl, struct snd_ctl_elem_value *elem) ++static int snd_djm_controls_put(struct snd_kcontrol *kctl, struct snd_ctl_elem_value *elem) + { + struct usb_mixer_elem_list *list = snd_kcontrol_chip(kctl); + struct usb_mixer_interface *mixer = list->mixer; + unsigned long private_value = kctl->private_value; +- u16 group = (private_value & SND_PIONEER_DJM_GROUP_MASK) >> SND_PIONEER_DJM_GROUP_SHIFT; ++ ++ u8 device = (private_value & SND_DJM_DEVICE_MASK) >> SND_DJM_DEVICE_SHIFT; ++ u8 group = (private_value & SND_DJM_GROUP_MASK) >> SND_DJM_GROUP_SHIFT; + u16 value = elem->value.enumerated.item[0]; + +- kctl->private_value = (group << SND_PIONEER_DJM_GROUP_SHIFT) | value; ++ kctl->private_value = ((device << SND_DJM_DEVICE_SHIFT) | ++ (group << SND_DJM_GROUP_SHIFT) | ++ value); + +- return snd_pioneer_djm_controls_update(mixer, group, value); ++ return snd_djm_controls_update(mixer, device, group, value); + } + +-static int snd_pioneer_djm_controls_resume(struct usb_mixer_elem_list *list) ++static int snd_djm_controls_resume(struct usb_mixer_elem_list *list) + { + unsigned long private_value = list->kctl->private_value; +- u16 group = (private_value & SND_PIONEER_DJM_GROUP_MASK) >> SND_PIONEER_DJM_GROUP_SHIFT; +- u16 value = (private_value & SND_PIONEER_DJM_VALUE_MASK); ++ u8 device = (private_value & SND_DJM_DEVICE_MASK) >> SND_DJM_DEVICE_SHIFT; ++ u8 group = (private_value & SND_DJM_GROUP_MASK) >> SND_DJM_GROUP_SHIFT; ++ u16 value = (private_value & SND_DJM_VALUE_MASK); + +- return snd_pioneer_djm_controls_update(list->mixer, group, value); ++ return snd_djm_controls_update(list->mixer, device, group, value); + } + +-static int snd_pioneer_djm_controls_create(struct usb_mixer_interface *mixer) ++static int snd_djm_controls_create(struct usb_mixer_interface *mixer, ++ const u8 device_idx) + { + int err, i; +- const struct snd_pioneer_djm_option_group *group; ++ u16 value; ++ ++ const struct snd_djm_device *device = &snd_djm_devices[device_idx]; ++ + struct snd_kcontrol_new knew = { + .iface = SNDRV_CTL_ELEM_IFACE_MIXER, + .access = SNDRV_CTL_ELEM_ACCESS_READWRITE, + .index = 0, +- .info = snd_pioneer_djm_controls_info, +- .get = snd_pioneer_djm_controls_get, +- .put = snd_pioneer_djm_controls_put ++ .info = snd_djm_controls_info, ++ .get = snd_djm_controls_get, ++ .put = snd_djm_controls_put + }; + +- for (i = 0; i < ARRAY_SIZE(snd_pioneer_djm_option_groups); i++) { +- group = &snd_pioneer_djm_option_groups[i]; +- knew.name = group->name; +- knew.private_value = (i << SND_PIONEER_DJM_GROUP_SHIFT) | group->default_value; +- err = snd_pioneer_djm_controls_update(mixer, i, group->default_value); ++ for (i = 0; i < device->ncontrols; i++) { ++ value = device->controls[i].default_value; ++ knew.name = device->controls[i].name; ++ knew.private_value = ( ++ (device_idx << SND_DJM_DEVICE_SHIFT) | ++ (i << SND_DJM_GROUP_SHIFT) | ++ value); ++ err = snd_djm_controls_update(mixer, device_idx, i, value); + if (err) + return err; +- err = add_single_ctl_with_resume(mixer, 0, snd_pioneer_djm_controls_resume, ++ err = add_single_ctl_with_resume(mixer, 0, snd_djm_controls_resume, + &knew, NULL); + if (err) + return err; +@@ -2917,7 +3040,13 @@ int snd_usb_mixer_apply_create_quirk(struct usb_mixer_interface *mixer) + err = snd_bbfpro_controls_create(mixer); + break; + case USB_ID(0x2b73, 0x0017): /* Pioneer DJ DJM-250MK2 */ +- err = snd_pioneer_djm_controls_create(mixer); ++ err = snd_djm_controls_create(mixer, SND_DJM_250MK2_IDX); ++ break; ++ case USB_ID(0x08e4, 0x017f): /* Pioneer DJ DJM-750 */ ++ err = snd_djm_controls_create(mixer, SND_DJM_750_IDX); ++ break; ++ case USB_ID(0x2b73, 0x000a): /* Pioneer DJ DJM-900NXS2 */ ++ err = snd_djm_controls_create(mixer, SND_DJM_900NXS2_IDX); + break; + } + diff --git a/patch/kernel/sunxi-dev/patch-5.11.3-4.patch b/patch/kernel/sunxi-dev/patch-5.11.3-4.patch new file mode 100644 index 0000000000..aa868ea328 --- /dev/null +++ b/patch/kernel/sunxi-dev/patch-5.11.3-4.patch @@ -0,0 +1,5114 @@ +diff --git a/Documentation/devicetree/bindings/net/btusb.txt b/Documentation/devicetree/bindings/net/btusb.txt +index b1ad6ee68e909..c51dd99dc0d3c 100644 +--- a/Documentation/devicetree/bindings/net/btusb.txt ++++ b/Documentation/devicetree/bindings/net/btusb.txt +@@ -38,7 +38,7 @@ Following example uses irq pin number 3 of gpio0 for out of band wake-on-bt: + compatible = "usb1286,204e"; + reg = <1>; + interrupt-parent = <&gpio0>; +- interrupt-name = "wakeup"; ++ interrupt-names = "wakeup"; + interrupts = <3 IRQ_TYPE_LEVEL_LOW>; + }; + }; +diff --git a/Documentation/devicetree/bindings/net/ethernet-controller.yaml b/Documentation/devicetree/bindings/net/ethernet-controller.yaml +index dac4aadb6e2e7..880e55f7a4b13 100644 +--- a/Documentation/devicetree/bindings/net/ethernet-controller.yaml ++++ b/Documentation/devicetree/bindings/net/ethernet-controller.yaml +@@ -205,6 +205,11 @@ properties: + Indicates that full-duplex is used. When absent, half + duplex is assumed. + ++ pause: ++ $ref: /schemas/types.yaml#definitions/flag ++ description: ++ Indicates that pause should be enabled. ++ + asym-pause: + $ref: /schemas/types.yaml#/definitions/flag + description: +diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst +index fa544e9037b99..1b7f8debada6a 100644 +--- a/Documentation/networking/ip-sysctl.rst ++++ b/Documentation/networking/ip-sysctl.rst +@@ -630,16 +630,15 @@ tcp_rmem - vector of 3 INTEGERs: min, default, max + + default: initial size of receive buffer used by TCP sockets. + This value overrides net.core.rmem_default used by other protocols. +- Default: 87380 bytes. This value results in window of 65535 with +- default setting of tcp_adv_win_scale and tcp_app_win:0 and a bit +- less for default tcp_app_win. See below about these variables. ++ Default: 131072 bytes. ++ This value results in initial window of 65535. + + max: maximal size of receive buffer allowed for automatically + selected receiver buffers for TCP socket. This value does not override + net.core.rmem_max. Calling setsockopt() with SO_RCVBUF disables + automatic tuning of that socket's receive buffer size, in which + case this value is ignored. +- Default: between 87380B and 6MB, depending on RAM size. ++ Default: between 131072 and 6MB, depending on RAM size. + + tcp_sack - BOOLEAN + Enable select acknowledgments (SACKS). +diff --git a/Makefile b/Makefile +index a8c1162de3a0b..cb9a8e8239511 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 11 +-SUBLEVEL = 3 ++SUBLEVEL = 4 + EXTRAVERSION = + NAME = 💕 Valentine's Day Edition 💕 + +diff --git a/arch/arm/xen/p2m.c b/arch/arm/xen/p2m.c +index fd6e3aafe2724..acb464547a54f 100644 +--- a/arch/arm/xen/p2m.c ++++ b/arch/arm/xen/p2m.c +@@ -93,12 +93,39 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops, + int i; + + for (i = 0; i < count; i++) { ++ struct gnttab_unmap_grant_ref unmap; ++ int rc; ++ + if (map_ops[i].status) + continue; +- if (unlikely(!set_phys_to_machine(map_ops[i].host_addr >> XEN_PAGE_SHIFT, +- map_ops[i].dev_bus_addr >> XEN_PAGE_SHIFT))) { +- return -ENOMEM; +- } ++ if (likely(set_phys_to_machine(map_ops[i].host_addr >> XEN_PAGE_SHIFT, ++ map_ops[i].dev_bus_addr >> XEN_PAGE_SHIFT))) ++ continue; ++ ++ /* ++ * Signal an error for this slot. This in turn requires ++ * immediate unmapping. ++ */ ++ map_ops[i].status = GNTST_general_error; ++ unmap.host_addr = map_ops[i].host_addr, ++ unmap.handle = map_ops[i].handle; ++ map_ops[i].handle = ~0; ++ if (map_ops[i].flags & GNTMAP_device_map) ++ unmap.dev_bus_addr = map_ops[i].dev_bus_addr; ++ else ++ unmap.dev_bus_addr = 0; ++ ++ /* ++ * Pre-populate the status field, to be recognizable in ++ * the log message below. ++ */ ++ unmap.status = 1; ++ ++ rc = HYPERVISOR_grant_table_op(GNTTABOP_unmap_grant_ref, ++ &unmap, 1); ++ if (rc || unmap.status != GNTST_okay) ++ pr_err_once("gnttab unmap failed: rc=%d st=%d\n", ++ rc, unmap.status); + } + + return 0; +diff --git a/arch/parisc/kernel/irq.c b/arch/parisc/kernel/irq.c +index 49cd6d2caefb7..1dfb439b06928 100644 +--- a/arch/parisc/kernel/irq.c ++++ b/arch/parisc/kernel/irq.c +@@ -373,7 +373,11 @@ static inline int eirr_to_irq(unsigned long eirr) + /* + * IRQ STACK - used for irq handler + */ ++#ifdef CONFIG_64BIT ++#define IRQ_STACK_SIZE (4096 << 4) /* 64k irq stack size */ ++#else + #define IRQ_STACK_SIZE (4096 << 3) /* 32k irq stack size */ ++#endif + + union irq_stack_union { + unsigned long stack[IRQ_STACK_SIZE/sizeof(unsigned long)]; +diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c +index f9f9568d689ef..f81f813b96031 100644 +--- a/arch/riscv/mm/init.c ++++ b/arch/riscv/mm/init.c +@@ -226,8 +226,6 @@ pgd_t swapper_pg_dir[PTRS_PER_PGD] __page_aligned_bss; + pgd_t trampoline_pg_dir[PTRS_PER_PGD] __page_aligned_bss; + pte_t fixmap_pte[PTRS_PER_PTE] __page_aligned_bss; + +-#define MAX_EARLY_MAPPING_SIZE SZ_128M +- + pgd_t early_pg_dir[PTRS_PER_PGD] __initdata __aligned(PAGE_SIZE); + + void __set_fixmap(enum fixed_addresses idx, phys_addr_t phys, pgprot_t prot) +@@ -302,13 +300,7 @@ static void __init create_pte_mapping(pte_t *ptep, + + pmd_t trampoline_pmd[PTRS_PER_PMD] __page_aligned_bss; + pmd_t fixmap_pmd[PTRS_PER_PMD] __page_aligned_bss; +- +-#if MAX_EARLY_MAPPING_SIZE < PGDIR_SIZE +-#define NUM_EARLY_PMDS 1UL +-#else +-#define NUM_EARLY_PMDS (1UL + MAX_EARLY_MAPPING_SIZE / PGDIR_SIZE) +-#endif +-pmd_t early_pmd[PTRS_PER_PMD * NUM_EARLY_PMDS] __initdata __aligned(PAGE_SIZE); ++pmd_t early_pmd[PTRS_PER_PMD] __initdata __aligned(PAGE_SIZE); + pmd_t early_dtb_pmd[PTRS_PER_PMD] __initdata __aligned(PAGE_SIZE); + + static pmd_t *__init get_pmd_virt_early(phys_addr_t pa) +@@ -330,11 +322,9 @@ static pmd_t *get_pmd_virt_late(phys_addr_t pa) + + static phys_addr_t __init alloc_pmd_early(uintptr_t va) + { +- uintptr_t pmd_num; ++ BUG_ON((va - PAGE_OFFSET) >> PGDIR_SHIFT); + +- pmd_num = (va - PAGE_OFFSET) >> PGDIR_SHIFT; +- BUG_ON(pmd_num >= NUM_EARLY_PMDS); +- return (uintptr_t)&early_pmd[pmd_num * PTRS_PER_PMD]; ++ return (uintptr_t)early_pmd; + } + + static phys_addr_t __init alloc_pmd_fixmap(uintptr_t va) +@@ -452,7 +442,7 @@ asmlinkage void __init setup_vm(uintptr_t dtb_pa) + uintptr_t va, pa, end_va; + uintptr_t load_pa = (uintptr_t)(&_start); + uintptr_t load_sz = (uintptr_t)(&_end) - load_pa; +- uintptr_t map_size = best_map_size(load_pa, MAX_EARLY_MAPPING_SIZE); ++ uintptr_t map_size; + #ifndef __PAGETABLE_PMD_FOLDED + pmd_t fix_bmap_spmd, fix_bmap_epmd; + #endif +@@ -464,12 +454,11 @@ asmlinkage void __init setup_vm(uintptr_t dtb_pa) + * Enforce boot alignment requirements of RV32 and + * RV64 by only allowing PMD or PGD mappings. + */ +- BUG_ON(map_size == PAGE_SIZE); ++ map_size = PMD_SIZE; + + /* Sanity check alignment and size */ + BUG_ON((PAGE_OFFSET % PGDIR_SIZE) != 0); + BUG_ON((load_pa % map_size) != 0); +- BUG_ON(load_sz > MAX_EARLY_MAPPING_SIZE); + + pt_ops.alloc_pte = alloc_pte_early; + pt_ops.get_pte_virt = get_pte_virt_early; +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index d4569bfa83e30..4faaef3a8f6c4 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -4397,6 +4397,9 @@ static const struct x86_cpu_desc isolation_ucodes[] = { + INTEL_CPU_DESC(INTEL_FAM6_BROADWELL_X, 2, 0x0b000014), + INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 3, 0x00000021), + INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 4, 0x00000000), ++ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 5, 0x00000000), ++ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 6, 0x00000000), ++ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 7, 0x00000000), + INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_L, 3, 0x0000007c), + INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE, 3, 0x0000007c), + INTEL_CPU_DESC(INTEL_FAM6_KABYLAKE, 9, 0x0000004e), +diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h +index 1a162e559753b..7068e4bb057d9 100644 +--- a/arch/x86/include/asm/xen/page.h ++++ b/arch/x86/include/asm/xen/page.h +@@ -86,6 +86,18 @@ clear_foreign_p2m_mapping(struct gnttab_unmap_grant_ref *unmap_ops, + } + #endif + ++/* ++ * The maximum amount of extra memory compared to the base size. The ++ * main scaling factor is the size of struct page. At extreme ratios ++ * of base:extra, all the base memory can be filled with page ++ * structures for the extra memory, leaving no space for anything ++ * else. ++ * ++ * 10x seems like a reasonable balance between scaling flexibility and ++ * leaving a practically usable system. ++ */ ++#define XEN_EXTRA_MEM_RATIO (10) ++ + /* + * Helper functions to write or read unsigned long values to/from + * memory, when the access may fault. +diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c +index 34b153cbd4acb..5e9a34b5bd741 100644 +--- a/arch/x86/kernel/module.c ++++ b/arch/x86/kernel/module.c +@@ -114,6 +114,7 @@ int apply_relocate(Elf32_Shdr *sechdrs, + *location += sym->st_value; + break; + case R_386_PC32: ++ case R_386_PLT32: + /* Add the value, subtract its position */ + *location += sym->st_value - (uint32_t)location; + break; +diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c +index efbaef8b4de98..b29657b76e3fa 100644 +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -477,6 +477,15 @@ static const struct dmi_system_id reboot_dmi_table[] __initconst = { + }, + }, + ++ { /* PCIe Wifi card isn't detected after reboot otherwise */ ++ .callback = set_pci_reboot, ++ .ident = "Zotac ZBOX CI327 nano", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "NA"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "ZBOX-CI327NANO-GS-01"), ++ }, ++ }, ++ + /* Sony */ + { /* Handle problems with rebooting on Sony VGN-Z540N */ + .callback = set_bios_reboot, +diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c +index ce7188cbdae58..1c3a1962cade6 100644 +--- a/arch/x86/tools/relocs.c ++++ b/arch/x86/tools/relocs.c +@@ -867,9 +867,11 @@ static int do_reloc32(struct section *sec, Elf_Rel *rel, Elf_Sym *sym, + case R_386_PC32: + case R_386_PC16: + case R_386_PC8: ++ case R_386_PLT32: + /* +- * NONE can be ignored and PC relative relocations don't +- * need to be adjusted. ++ * NONE can be ignored and PC relative relocations don't need ++ * to be adjusted. Because sym must be defined, R_386_PLT32 can ++ * be treated the same way as R_386_PC32. + */ + break; + +@@ -910,9 +912,11 @@ static int do_reloc_real(struct section *sec, Elf_Rel *rel, Elf_Sym *sym, + case R_386_PC32: + case R_386_PC16: + case R_386_PC8: ++ case R_386_PLT32: + /* +- * NONE can be ignored and PC relative relocations don't +- * need to be adjusted. ++ * NONE can be ignored and PC relative relocations don't need ++ * to be adjusted. Because sym must be defined, R_386_PLT32 can ++ * be treated the same way as R_386_PC32. + */ + break; + +diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c +index b5949e5a83ec8..a3cc33091f46c 100644 +--- a/arch/x86/xen/p2m.c ++++ b/arch/x86/xen/p2m.c +@@ -416,6 +416,9 @@ void __init xen_vmalloc_p2m_tree(void) + xen_p2m_last_pfn = xen_max_p2m_pfn; + + p2m_limit = (phys_addr_t)P2M_LIMIT * 1024 * 1024 * 1024 / PAGE_SIZE; ++ if (!p2m_limit && IS_ENABLED(CONFIG_XEN_UNPOPULATED_ALLOC)) ++ p2m_limit = xen_start_info->nr_pages * XEN_EXTRA_MEM_RATIO; ++ + vm.flags = VM_ALLOC; + vm.size = ALIGN(sizeof(unsigned long) * max(xen_max_p2m_pfn, p2m_limit), + PMD_SIZE * PMDS_PER_MID_PAGE); +@@ -652,10 +655,9 @@ bool __set_phys_to_machine(unsigned long pfn, unsigned long mfn) + pte_t *ptep; + unsigned int level; + +- if (unlikely(pfn >= xen_p2m_size)) { +- BUG_ON(mfn != INVALID_P2M_ENTRY); +- return true; +- } ++ /* Only invalid entries allowed above the highest p2m covered frame. */ ++ if (unlikely(pfn >= xen_p2m_size)) ++ return mfn == INVALID_P2M_ENTRY; + + /* + * The interface requires atomic updates on p2m elements. +@@ -710,6 +712,8 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops, + + for (i = 0; i < count; i++) { + unsigned long mfn, pfn; ++ struct gnttab_unmap_grant_ref unmap[2]; ++ int rc; + + /* Do not add to override if the map failed. */ + if (map_ops[i].status != GNTST_okay || +@@ -727,10 +731,46 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops, + + WARN(pfn_to_mfn(pfn) != INVALID_P2M_ENTRY, "page must be ballooned"); + +- if (unlikely(!set_phys_to_machine(pfn, FOREIGN_FRAME(mfn)))) { +- ret = -ENOMEM; +- goto out; ++ if (likely(set_phys_to_machine(pfn, FOREIGN_FRAME(mfn)))) ++ continue; ++ ++ /* ++ * Signal an error for this slot. This in turn requires ++ * immediate unmapping. ++ */ ++ map_ops[i].status = GNTST_general_error; ++ unmap[0].host_addr = map_ops[i].host_addr, ++ unmap[0].handle = map_ops[i].handle; ++ map_ops[i].handle = ~0; ++ if (map_ops[i].flags & GNTMAP_device_map) ++ unmap[0].dev_bus_addr = map_ops[i].dev_bus_addr; ++ else ++ unmap[0].dev_bus_addr = 0; ++ ++ if (kmap_ops) { ++ kmap_ops[i].status = GNTST_general_error; ++ unmap[1].host_addr = kmap_ops[i].host_addr, ++ unmap[1].handle = kmap_ops[i].handle; ++ kmap_ops[i].handle = ~0; ++ if (kmap_ops[i].flags & GNTMAP_device_map) ++ unmap[1].dev_bus_addr = kmap_ops[i].dev_bus_addr; ++ else ++ unmap[1].dev_bus_addr = 0; + } ++ ++ /* ++ * Pre-populate both status fields, to be recognizable in ++ * the log message below. ++ */ ++ unmap[0].status = 1; ++ unmap[1].status = 1; ++ ++ rc = HYPERVISOR_grant_table_op(GNTTABOP_unmap_grant_ref, ++ unmap, 1 + !!kmap_ops); ++ if (rc || unmap[0].status != GNTST_okay || ++ unmap[1].status != GNTST_okay) ++ pr_err_once("gnttab unmap failed: rc=%d st0=%d st1=%d\n", ++ rc, unmap[0].status, unmap[1].status); + } + + out: +diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c +index 7eab14d56369d..1a3b75652fa4f 100644 +--- a/arch/x86/xen/setup.c ++++ b/arch/x86/xen/setup.c +@@ -59,18 +59,6 @@ static struct { + } xen_remap_buf __initdata __aligned(PAGE_SIZE); + static unsigned long xen_remap_mfn __initdata = INVALID_P2M_ENTRY; + +-/* +- * The maximum amount of extra memory compared to the base size. The +- * main scaling factor is the size of struct page. At extreme ratios +- * of base:extra, all the base memory can be filled with page +- * structures for the extra memory, leaving no space for anything +- * else. +- * +- * 10x seems like a reasonable balance between scaling flexibility and +- * leaving a practically usable system. +- */ +-#define EXTRA_MEM_RATIO (10) +- + static bool xen_512gb_limit __initdata = IS_ENABLED(CONFIG_XEN_512GB); + + static void __init xen_parse_512gb(void) +@@ -790,20 +778,13 @@ char * __init xen_memory_setup(void) + extra_pages += max_pages - max_pfn; + + /* +- * Clamp the amount of extra memory to a EXTRA_MEM_RATIO +- * factor the base size. On non-highmem systems, the base +- * size is the full initial memory allocation; on highmem it +- * is limited to the max size of lowmem, so that it doesn't +- * get completely filled. ++ * Clamp the amount of extra memory to a XEN_EXTRA_MEM_RATIO ++ * factor the base size. + * + * Make sure we have no memory above max_pages, as this area + * isn't handled by the p2m management. +- * +- * In principle there could be a problem in lowmem systems if +- * the initial memory is also very large with respect to +- * lowmem, but we won't try to deal with that here. + */ +- extra_pages = min3(EXTRA_MEM_RATIO * min(max_pfn, PFN_DOWN(MAXMEM)), ++ extra_pages = min3(XEN_EXTRA_MEM_RATIO * min(max_pfn, PFN_DOWN(MAXMEM)), + extra_pages, max_pages - max_pfn); + i = 0; + addr = xen_e820_table.entries[0].addr; +diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c +index a647bb298fbce..a4a11d2b57bd8 100644 +--- a/crypto/tcrypt.c ++++ b/crypto/tcrypt.c +@@ -199,8 +199,8 @@ static int test_mb_aead_jiffies(struct test_mb_aead_data *data, int enc, + goto out; + } + +- pr_cont("%d operations in %d seconds (%ld bytes)\n", +- bcount * num_mb, secs, (long)bcount * blen * num_mb); ++ pr_cont("%d operations in %d seconds (%llu bytes)\n", ++ bcount * num_mb, secs, (u64)bcount * blen * num_mb); + + out: + kfree(rc); +@@ -471,8 +471,8 @@ static int test_aead_jiffies(struct aead_request *req, int enc, + return ret; + } + +- printk("%d operations in %d seconds (%ld bytes)\n", +- bcount, secs, (long)bcount * blen); ++ pr_cont("%d operations in %d seconds (%llu bytes)\n", ++ bcount, secs, (u64)bcount * blen); + return 0; + } + +@@ -764,8 +764,8 @@ static int test_mb_ahash_jiffies(struct test_mb_ahash_data *data, int blen, + goto out; + } + +- pr_cont("%d operations in %d seconds (%ld bytes)\n", +- bcount * num_mb, secs, (long)bcount * blen * num_mb); ++ pr_cont("%d operations in %d seconds (%llu bytes)\n", ++ bcount * num_mb, secs, (u64)bcount * blen * num_mb); + + out: + kfree(rc); +@@ -1201,8 +1201,8 @@ static int test_mb_acipher_jiffies(struct test_mb_skcipher_data *data, int enc, + goto out; + } + +- pr_cont("%d operations in %d seconds (%ld bytes)\n", +- bcount * num_mb, secs, (long)bcount * blen * num_mb); ++ pr_cont("%d operations in %d seconds (%llu bytes)\n", ++ bcount * num_mb, secs, (u64)bcount * blen * num_mb); + + out: + kfree(rc); +@@ -1441,8 +1441,8 @@ static int test_acipher_jiffies(struct skcipher_request *req, int enc, + return ret; + } + +- pr_cont("%d operations in %d seconds (%ld bytes)\n", +- bcount, secs, (long)bcount * blen); ++ pr_cont("%d operations in %d seconds (%llu bytes)\n", ++ bcount, secs, (u64)bcount * blen); + return 0; + } + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index e6ea5d344f87b..0f3bab47c0d6c 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -78,8 +78,7 @@ struct link_dead_args { + #define NBD_RT_HAS_PID_FILE 3 + #define NBD_RT_HAS_CONFIG_REF 4 + #define NBD_RT_BOUND 5 +-#define NBD_RT_DESTROY_ON_DISCONNECT 6 +-#define NBD_RT_DISCONNECT_ON_CLOSE 7 ++#define NBD_RT_DISCONNECT_ON_CLOSE 6 + + #define NBD_DESTROY_ON_DISCONNECT 0 + #define NBD_DISCONNECT_REQUESTED 1 +@@ -1924,12 +1923,21 @@ again: + if (info->attrs[NBD_ATTR_CLIENT_FLAGS]) { + u64 flags = nla_get_u64(info->attrs[NBD_ATTR_CLIENT_FLAGS]); + if (flags & NBD_CFLAG_DESTROY_ON_DISCONNECT) { +- set_bit(NBD_RT_DESTROY_ON_DISCONNECT, +- &config->runtime_flags); +- set_bit(NBD_DESTROY_ON_DISCONNECT, &nbd->flags); +- put_dev = true; ++ /* ++ * We have 1 ref to keep the device around, and then 1 ++ * ref for our current operation here, which will be ++ * inherited by the config. If we already have ++ * DESTROY_ON_DISCONNECT set then we know we don't have ++ * that extra ref already held so we don't need the ++ * put_dev. ++ */ ++ if (!test_and_set_bit(NBD_DESTROY_ON_DISCONNECT, ++ &nbd->flags)) ++ put_dev = true; + } else { +- clear_bit(NBD_DESTROY_ON_DISCONNECT, &nbd->flags); ++ if (test_and_clear_bit(NBD_DESTROY_ON_DISCONNECT, ++ &nbd->flags)) ++ refcount_inc(&nbd->refs); + } + if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) { + set_bit(NBD_RT_DISCONNECT_ON_CLOSE, +@@ -2100,15 +2108,13 @@ static int nbd_genl_reconfigure(struct sk_buff *skb, struct genl_info *info) + if (info->attrs[NBD_ATTR_CLIENT_FLAGS]) { + u64 flags = nla_get_u64(info->attrs[NBD_ATTR_CLIENT_FLAGS]); + if (flags & NBD_CFLAG_DESTROY_ON_DISCONNECT) { +- if (!test_and_set_bit(NBD_RT_DESTROY_ON_DISCONNECT, +- &config->runtime_flags)) ++ if (!test_and_set_bit(NBD_DESTROY_ON_DISCONNECT, ++ &nbd->flags)) + put_dev = true; +- set_bit(NBD_DESTROY_ON_DISCONNECT, &nbd->flags); + } else { +- if (test_and_clear_bit(NBD_RT_DESTROY_ON_DISCONNECT, +- &config->runtime_flags)) ++ if (test_and_clear_bit(NBD_DESTROY_ON_DISCONNECT, ++ &nbd->flags)) + refcount_inc(&nbd->refs); +- clear_bit(NBD_DESTROY_ON_DISCONNECT, &nbd->flags); + } + + if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) { +diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c +index 7be16a7f653bd..95ecd30e6619e 100644 +--- a/drivers/bluetooth/hci_h5.c ++++ b/drivers/bluetooth/hci_h5.c +@@ -906,6 +906,11 @@ static int h5_btrtl_setup(struct h5 *h5) + /* Give the device some time before the hci-core sends it a reset */ + usleep_range(10000, 20000); + ++ /* Enable controller to do both LE scan and BR/EDR inquiry ++ * simultaneously. ++ */ ++ set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &h5->hu->hdev->quirks); ++ + out_free: + btrtl_free(btrtl_dev); + +diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c +index f7087ddddb902..5754f429a8d2d 100644 +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -3342,10 +3342,13 @@ static struct amd64_family_type *per_family_init(struct amd64_pvt *pvt) + fam_type = &family_types[F15_M60H_CPUS]; + pvt->ops = &family_types[F15_M60H_CPUS].ops; + break; ++ /* Richland is only client */ ++ } else if (pvt->model == 0x13) { ++ return NULL; ++ } else { ++ fam_type = &family_types[F15_CPUS]; ++ pvt->ops = &family_types[F15_CPUS].ops; + } +- +- fam_type = &family_types[F15_CPUS]; +- pvt->ops = &family_types[F15_CPUS].ops; + break; + + case 0x16: +@@ -3539,6 +3542,7 @@ static int probe_one_instance(unsigned int nid) + pvt->mc_node_id = nid; + pvt->F3 = F3; + ++ ret = -ENODEV; + fam_type = per_family_init(pvt); + if (!fam_type) + goto err_enable; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +index 2d51b7694d1fd..572153d08ad11 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +@@ -560,10 +560,14 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev) + static void amdgpu_virt_update_vf2pf_work_item(struct work_struct *work) + { + struct amdgpu_device *adev = container_of(work, struct amdgpu_device, virt.vf2pf_work.work); ++ int ret; + +- amdgpu_virt_read_pf2vf_data(adev); ++ ret = amdgpu_virt_read_pf2vf_data(adev); ++ if (ret) ++ goto out; + amdgpu_virt_write_vf2pf_data(adev); + ++out: + schedule_delayed_work(&(adev->virt.vf2pf_work), adev->virt.vf2pf_update_interval_ms); + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/cz_ih.c b/drivers/gpu/drm/amd/amdgpu/cz_ih.c +index da37f8a900afb..307c01301c87a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/cz_ih.c ++++ b/drivers/gpu/drm/amd/amdgpu/cz_ih.c +@@ -194,19 +194,30 @@ static u32 cz_ih_get_wptr(struct amdgpu_device *adev, + + wptr = le32_to_cpu(*ih->wptr_cpu); + +- if (REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) { +- wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0); +- /* When a ring buffer overflow happen start parsing interrupt +- * from the last not overwritten vector (wptr + 16). Hopefully +- * this should allow us to catchup. +- */ +- dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n", +- wptr, ih->rptr, (wptr + 16) & ih->ptr_mask); +- ih->rptr = (wptr + 16) & ih->ptr_mask; +- tmp = RREG32(mmIH_RB_CNTL); +- tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1); +- WREG32(mmIH_RB_CNTL, tmp); +- } ++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) ++ goto out; ++ ++ /* Double check that the overflow wasn't already cleared. */ ++ wptr = RREG32(mmIH_RB_WPTR); ++ ++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) ++ goto out; ++ ++ wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0); ++ ++ /* When a ring buffer overflow happen start parsing interrupt ++ * from the last not overwritten vector (wptr + 16). Hopefully ++ * this should allow us to catchup. ++ */ ++ dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n", ++ wptr, ih->rptr, (wptr + 16) & ih->ptr_mask); ++ ih->rptr = (wptr + 16) & ih->ptr_mask; ++ tmp = RREG32(mmIH_RB_CNTL); ++ tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1); ++ WREG32(mmIH_RB_CNTL, tmp); ++ ++ ++out: + return (wptr & ih->ptr_mask); + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/iceland_ih.c b/drivers/gpu/drm/amd/amdgpu/iceland_ih.c +index 37d8b6ca4dab8..cc957471f31ea 100644 +--- a/drivers/gpu/drm/amd/amdgpu/iceland_ih.c ++++ b/drivers/gpu/drm/amd/amdgpu/iceland_ih.c +@@ -194,19 +194,29 @@ static u32 iceland_ih_get_wptr(struct amdgpu_device *adev, + + wptr = le32_to_cpu(*ih->wptr_cpu); + +- if (REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) { +- wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0); +- /* When a ring buffer overflow happen start parsing interrupt +- * from the last not overwritten vector (wptr + 16). Hopefully +- * this should allow us to catchup. +- */ +- dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n", +- wptr, ih->rptr, (wptr + 16) & ih->ptr_mask); +- ih->rptr = (wptr + 16) & ih->ptr_mask; +- tmp = RREG32(mmIH_RB_CNTL); +- tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1); +- WREG32(mmIH_RB_CNTL, tmp); +- } ++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) ++ goto out; ++ ++ /* Double check that the overflow wasn't already cleared. */ ++ wptr = RREG32(mmIH_RB_WPTR); ++ ++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) ++ goto out; ++ ++ wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0); ++ /* When a ring buffer overflow happen start parsing interrupt ++ * from the last not overwritten vector (wptr + 16). Hopefully ++ * this should allow us to catchup. ++ */ ++ dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n", ++ wptr, ih->rptr, (wptr + 16) & ih->ptr_mask); ++ ih->rptr = (wptr + 16) & ih->ptr_mask; ++ tmp = RREG32(mmIH_RB_CNTL); ++ tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1); ++ WREG32(mmIH_RB_CNTL, tmp); ++ ++ ++out: + return (wptr & ih->ptr_mask); + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/tonga_ih.c b/drivers/gpu/drm/amd/amdgpu/tonga_ih.c +index ce3319993b4bd..249fcbee7871c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/tonga_ih.c ++++ b/drivers/gpu/drm/amd/amdgpu/tonga_ih.c +@@ -196,19 +196,30 @@ static u32 tonga_ih_get_wptr(struct amdgpu_device *adev, + + wptr = le32_to_cpu(*ih->wptr_cpu); + +- if (REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) { +- wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0); +- /* When a ring buffer overflow happen start parsing interrupt +- * from the last not overwritten vector (wptr + 16). Hopefully +- * this should allow us to catchup. +- */ +- dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n", +- wptr, ih->rptr, (wptr + 16) & ih->ptr_mask); +- ih->rptr = (wptr + 16) & ih->ptr_mask; +- tmp = RREG32(mmIH_RB_CNTL); +- tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1); +- WREG32(mmIH_RB_CNTL, tmp); +- } ++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) ++ goto out; ++ ++ /* Double check that the overflow wasn't already cleared. */ ++ wptr = RREG32(mmIH_RB_WPTR); ++ ++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) ++ goto out; ++ ++ wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0); ++ ++ /* When a ring buffer overflow happen start parsing interrupt ++ * from the last not overwritten vector (wptr + 16). Hopefully ++ * this should allow us to catchup. ++ */ ++ ++ dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n", ++ wptr, ih->rptr, (wptr + 16) & ih->ptr_mask); ++ ih->rptr = (wptr + 16) & ih->ptr_mask; ++ tmp = RREG32(mmIH_RB_CNTL); ++ tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1); ++ WREG32(mmIH_RB_CNTL, tmp); ++ ++out: + return (wptr & ih->ptr_mask); + } + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index f4a2088ab1792..278ade3a90ccf 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -1470,6 +1470,11 @@ static bool dc_link_construct(struct dc_link *link, + goto ddc_create_fail; + } + ++ if (!link->ddc->ddc_pin) { ++ DC_ERROR("Failed to get I2C info for connector!\n"); ++ goto ddc_create_fail; ++ } ++ + link->ddc_hw_inst = + dal_ddc_get_line(dal_ddc_service_get_ddc_pin(link->ddc)); + +diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c +index d845657fd99cc..426f5fb20fadc 100644 +--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c ++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c +@@ -366,7 +366,6 @@ static void hibmc_pci_remove(struct pci_dev *pdev) + + drm_dev_unregister(dev); + hibmc_unload(dev); +- drm_dev_put(dev); + } + + static const struct pci_device_id hibmc_pci_table[] = { +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index 785cd1cf2a402..394c1f6822b90 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -496,7 +496,7 @@ static void rtrs_clt_recv_done(struct rtrs_clt_con *con, struct ib_wc *wc) + int err; + struct rtrs_clt_sess *sess = to_clt_sess(con->c.sess); + +- WARN_ON(sess->flags != RTRS_MSG_NEW_RKEY_F); ++ WARN_ON((sess->flags & RTRS_MSG_NEW_RKEY_F) == 0); + iu = container_of(wc->wr_cqe, struct rtrs_iu, + cqe); + err = rtrs_iu_post_recv(&con->c, iu); +@@ -516,7 +516,7 @@ static void rtrs_clt_rkey_rsp_done(struct rtrs_clt_con *con, struct ib_wc *wc) + u32 buf_id; + int err; + +- WARN_ON(sess->flags != RTRS_MSG_NEW_RKEY_F); ++ WARN_ON((sess->flags & RTRS_MSG_NEW_RKEY_F) == 0); + + iu = container_of(wc->wr_cqe, struct rtrs_iu, cqe); + +@@ -623,12 +623,12 @@ static void rtrs_clt_rdma_done(struct ib_cq *cq, struct ib_wc *wc) + } else if (imm_type == RTRS_HB_MSG_IMM) { + WARN_ON(con->c.cid); + rtrs_send_hb_ack(&sess->s); +- if (sess->flags == RTRS_MSG_NEW_RKEY_F) ++ if (sess->flags & RTRS_MSG_NEW_RKEY_F) + return rtrs_clt_recv_done(con, wc); + } else if (imm_type == RTRS_HB_ACK_IMM) { + WARN_ON(con->c.cid); + sess->s.hb_missed_cnt = 0; +- if (sess->flags == RTRS_MSG_NEW_RKEY_F) ++ if (sess->flags & RTRS_MSG_NEW_RKEY_F) + return rtrs_clt_recv_done(con, wc); + } else { + rtrs_wrn(con->c.sess, "Unknown IMM type %u\n", +@@ -656,7 +656,7 @@ static void rtrs_clt_rdma_done(struct ib_cq *cq, struct ib_wc *wc) + WARN_ON(!(wc->wc_flags & IB_WC_WITH_INVALIDATE || + wc->wc_flags & IB_WC_WITH_IMM)); + WARN_ON(wc->wr_cqe->done != rtrs_clt_rdma_done); +- if (sess->flags == RTRS_MSG_NEW_RKEY_F) { ++ if (sess->flags & RTRS_MSG_NEW_RKEY_F) { + if (wc->wc_flags & IB_WC_WITH_INVALIDATE) + return rtrs_clt_recv_done(con, wc); + +@@ -666,7 +666,6 @@ static void rtrs_clt_rdma_done(struct ib_cq *cq, struct ib_wc *wc) + case IB_WC_RDMA_WRITE: + /* + * post_send() RDMA write completions of IO reqs (read/write) +- * and hb + */ + break; + +@@ -682,7 +681,7 @@ static int post_recv_io(struct rtrs_clt_con *con, size_t q_size) + struct rtrs_clt_sess *sess = to_clt_sess(con->c.sess); + + for (i = 0; i < q_size; i++) { +- if (sess->flags == RTRS_MSG_NEW_RKEY_F) { ++ if (sess->flags & RTRS_MSG_NEW_RKEY_F) { + struct rtrs_iu *iu = &con->rsp_ius[i]; + + err = rtrs_iu_post_recv(&con->c, iu); +@@ -1567,7 +1566,7 @@ static int create_con_cq_qp(struct rtrs_clt_con *con) + sess->queue_depth * 3 + 1); + } + /* alloc iu to recv new rkey reply when server reports flags set */ +- if (sess->flags == RTRS_MSG_NEW_RKEY_F || con->c.cid == 0) { ++ if (sess->flags & RTRS_MSG_NEW_RKEY_F || con->c.cid == 0) { + con->rsp_ius = rtrs_iu_alloc(max_recv_wr, sizeof(*rsp), + GFP_KERNEL, sess->s.dev->ib_dev, + DMA_FROM_DEVICE, +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +index 3850d2a938f8e..d071809e3ed2f 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +@@ -820,7 +820,7 @@ static int process_info_req(struct rtrs_srv_con *con, + rwr[mri].wr.opcode = IB_WR_REG_MR; + rwr[mri].wr.wr_cqe = &local_reg_cqe; + rwr[mri].wr.num_sge = 0; +- rwr[mri].wr.send_flags = mri ? 0 : IB_SEND_SIGNALED; ++ rwr[mri].wr.send_flags = 0; + rwr[mri].mr = mr; + rwr[mri].key = mr->rkey; + rwr[mri].access = (IB_ACCESS_LOCAL_WRITE | +@@ -1244,7 +1244,6 @@ static void rtrs_srv_rdma_done(struct ib_cq *cq, struct ib_wc *wc) + case IB_WC_SEND: + /* + * post_send() RDMA write completions of IO reqs (read/write) +- * and hb + */ + atomic_add(srv->queue_depth, &con->sq_wr_avail); + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs.c b/drivers/infiniband/ulp/rtrs/rtrs.c +index da4ff764dd3f0..d13aff0aa8165 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs.c +@@ -310,7 +310,7 @@ void rtrs_send_hb_ack(struct rtrs_sess *sess) + + imm = rtrs_to_imm(RTRS_HB_ACK_IMM, 0); + err = rtrs_post_rdma_write_imm_empty(usr_con, sess->hb_cqe, imm, +- IB_SEND_SIGNALED, NULL); ++ 0, NULL); + if (err) { + sess->hb_err_handler(usr_con); + return; +@@ -339,7 +339,7 @@ static void hb_work(struct work_struct *work) + } + imm = rtrs_to_imm(RTRS_HB_MSG_IMM, 0); + err = rtrs_post_rdma_write_imm_empty(usr_con, sess->hb_cqe, imm, +- IB_SEND_SIGNALED, NULL); ++ 0, NULL); + if (err) { + sess->hb_err_handler(usr_con); + return; +diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c +index c8d63673e131d..5642595a057ec 100644 +--- a/drivers/media/rc/mceusb.c ++++ b/drivers/media/rc/mceusb.c +@@ -701,11 +701,18 @@ static void mceusb_dev_printdata(struct mceusb_dev *ir, u8 *buf, int buf_len, + data[0], data[1]); + break; + case MCE_RSP_EQIRCFS: ++ if (!data[0] && !data[1]) { ++ dev_dbg(dev, "%s: no carrier", inout); ++ break; ++ } ++ // prescaler should make sense ++ if (data[0] > 8) ++ break; + period = DIV_ROUND_CLOSEST((1U << data[0] * 2) * + (data[1] + 1), 10); + if (!period) + break; +- carrier = (1000 * 1000) / period; ++ carrier = USEC_PER_SEC / period; + dev_dbg(dev, "%s carrier of %u Hz (period %uus)", + inout, carrier, period); + break; +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index ddb9eaa11be71..5ad5282641350 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -1028,7 +1028,10 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id, + unsigned int i; + + extra_size = roundup(extra_size, sizeof(*entity->pads)); +- num_inputs = (type & UVC_TERM_OUTPUT) ? num_pads : num_pads - 1; ++ if (num_pads) ++ num_inputs = type & UVC_TERM_OUTPUT ? num_pads : num_pads - 1; ++ else ++ num_inputs = 0; + size = sizeof(*entity) + extra_size + sizeof(*entity->pads) * num_pads + + num_inputs; + entity = kzalloc(size, GFP_KERNEL); +@@ -1044,7 +1047,7 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id, + + for (i = 0; i < num_inputs; ++i) + entity->pads[i].flags = MEDIA_PAD_FL_SINK; +- if (!UVC_ENTITY_IS_OTERM(entity)) ++ if (!UVC_ENTITY_IS_OTERM(entity) && num_pads) + entity->pads[num_pads-1].flags = MEDIA_PAD_FL_SOURCE; + + entity->bNrInPins = num_inputs; +diff --git a/drivers/media/usb/zr364xx/zr364xx.c b/drivers/media/usb/zr364xx/zr364xx.c +index 1e1c6b4d1874b..d29b861367ea7 100644 +--- a/drivers/media/usb/zr364xx/zr364xx.c ++++ b/drivers/media/usb/zr364xx/zr364xx.c +@@ -1181,15 +1181,11 @@ out: + return err; + } + +-static void zr364xx_release(struct v4l2_device *v4l2_dev) ++static void zr364xx_board_uninit(struct zr364xx_camera *cam) + { +- struct zr364xx_camera *cam = +- container_of(v4l2_dev, struct zr364xx_camera, v4l2_dev); + unsigned long i; + +- v4l2_device_unregister(&cam->v4l2_dev); +- +- videobuf_mmap_free(&cam->vb_vidq); ++ zr364xx_stop_readpipe(cam); + + /* release sys buffers */ + for (i = 0; i < FRAMES; i++) { +@@ -1200,9 +1196,19 @@ static void zr364xx_release(struct v4l2_device *v4l2_dev) + cam->buffer.frame[i].lpvbits = NULL; + } + +- v4l2_ctrl_handler_free(&cam->ctrl_handler); + /* release transfer buffer */ + kfree(cam->pipe->transfer_buffer); ++} ++ ++static void zr364xx_release(struct v4l2_device *v4l2_dev) ++{ ++ struct zr364xx_camera *cam = ++ container_of(v4l2_dev, struct zr364xx_camera, v4l2_dev); ++ ++ videobuf_mmap_free(&cam->vb_vidq); ++ v4l2_ctrl_handler_free(&cam->ctrl_handler); ++ zr364xx_board_uninit(cam); ++ v4l2_device_unregister(&cam->v4l2_dev); + kfree(cam); + } + +@@ -1376,11 +1382,14 @@ static int zr364xx_board_init(struct zr364xx_camera *cam) + /* start read pipe */ + err = zr364xx_start_readpipe(cam); + if (err) +- goto err_free; ++ goto err_free_frames; + + DBG(": board initialized\n"); + return 0; + ++err_free_frames: ++ for (i = 0; i < FRAMES; i++) ++ vfree(cam->buffer.frame[i].lpvbits); + err_free: + kfree(cam->pipe->transfer_buffer); + cam->pipe->transfer_buffer = NULL; +@@ -1409,12 +1418,10 @@ static int zr364xx_probe(struct usb_interface *intf, + if (!cam) + return -ENOMEM; + +- cam->v4l2_dev.release = zr364xx_release; + err = v4l2_device_register(&intf->dev, &cam->v4l2_dev); + if (err < 0) { + dev_err(&udev->dev, "couldn't register v4l2_device\n"); +- kfree(cam); +- return err; ++ goto free_cam; + } + hdl = &cam->ctrl_handler; + v4l2_ctrl_handler_init(hdl, 1); +@@ -1423,7 +1430,7 @@ static int zr364xx_probe(struct usb_interface *intf, + if (hdl->error) { + err = hdl->error; + dev_err(&udev->dev, "couldn't register control\n"); +- goto fail; ++ goto unregister; + } + /* save the init method used by this camera */ + cam->method = id->driver_info; +@@ -1496,7 +1503,7 @@ static int zr364xx_probe(struct usb_interface *intf, + if (!cam->read_endpoint) { + err = -ENOMEM; + dev_err(&intf->dev, "Could not find bulk-in endpoint\n"); +- goto fail; ++ goto unregister; + } + + /* v4l */ +@@ -1507,10 +1514,11 @@ static int zr364xx_probe(struct usb_interface *intf, + + /* load zr364xx board specific */ + err = zr364xx_board_init(cam); +- if (!err) +- err = v4l2_ctrl_handler_setup(hdl); + if (err) +- goto fail; ++ goto unregister; ++ err = v4l2_ctrl_handler_setup(hdl); ++ if (err) ++ goto board_uninit; + + spin_lock_init(&cam->slock); + +@@ -1525,16 +1533,21 @@ static int zr364xx_probe(struct usb_interface *intf, + err = video_register_device(&cam->vdev, VFL_TYPE_VIDEO, -1); + if (err) { + dev_err(&udev->dev, "video_register_device failed\n"); +- goto fail; ++ goto free_handler; + } ++ cam->v4l2_dev.release = zr364xx_release; + + dev_info(&udev->dev, DRIVER_DESC " controlling device %s\n", + video_device_node_name(&cam->vdev)); + return 0; + +-fail: ++free_handler: + v4l2_ctrl_handler_free(hdl); ++board_uninit: ++ zr364xx_board_uninit(cam); ++unregister: + v4l2_device_unregister(&cam->v4l2_dev); ++free_cam: + kfree(cam); + return err; + } +diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c +index 5cbe0ffbf501f..9dc151431a5c6 100644 +--- a/drivers/media/v4l2-core/v4l2-ctrls.c ++++ b/drivers/media/v4l2-core/v4l2-ctrls.c +@@ -2165,7 +2165,8 @@ static int std_validate(const struct v4l2_ctrl *ctrl, u32 idx, + case V4L2_CTRL_TYPE_INTEGER_MENU: + if (ptr.p_s32[idx] < ctrl->minimum || ptr.p_s32[idx] > ctrl->maximum) + return -ERANGE; +- if (ctrl->menu_skip_mask & (1ULL << ptr.p_s32[idx])) ++ if (ptr.p_s32[idx] < BITS_PER_LONG_LONG && ++ (ctrl->menu_skip_mask & BIT_ULL(ptr.p_s32[idx]))) + return -EINVAL; + if (ctrl->type == V4L2_CTRL_TYPE_MENU && + ctrl->qmenu[ptr.p_s32[idx]][0] == '\0') +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index 038fe1036df23..7ab20a6b0d1db 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -9,6 +9,7 @@ + // + // Based on code originally by Andrey Volkov + ++#include + #include + #include + #include +@@ -17,6 +18,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -242,6 +244,8 @@ + #define FLEXCAN_QUIRK_SUPPORT_FD BIT(9) + /* support memory detection and correction */ + #define FLEXCAN_QUIRK_SUPPORT_ECC BIT(10) ++/* Setup stop mode with SCU firmware to support wakeup */ ++#define FLEXCAN_QUIRK_SETUP_STOP_MODE_SCFW BIT(11) + + /* Structure of the message buffer */ + struct flexcan_mb { +@@ -347,6 +351,7 @@ struct flexcan_priv { + u8 mb_count; + u8 mb_size; + u8 clk_src; /* clock source of CAN Protocol Engine */ ++ u8 scu_idx; + + u64 rx_mask; + u64 tx_mask; +@@ -358,6 +363,9 @@ struct flexcan_priv { + struct regulator *reg_xceiver; + struct flexcan_stop_mode stm; + ++ /* IPC handle when setup stop mode by System Controller firmware(scfw) */ ++ struct imx_sc_ipc *sc_ipc_handle; ++ + /* Read and Write APIs */ + u32 (*read)(void __iomem *addr); + void (*write)(u32 val, void __iomem *addr); +@@ -387,7 +395,7 @@ static const struct flexcan_devtype_data fsl_imx6q_devtype_data = { + static const struct flexcan_devtype_data fsl_imx8qm_devtype_data = { + .quirks = FLEXCAN_QUIRK_DISABLE_RXFG | FLEXCAN_QUIRK_ENABLE_EACEN_RRS | + FLEXCAN_QUIRK_USE_OFF_TIMESTAMP | FLEXCAN_QUIRK_BROKEN_PERR_STATE | +- FLEXCAN_QUIRK_SUPPORT_FD, ++ FLEXCAN_QUIRK_SUPPORT_FD | FLEXCAN_QUIRK_SETUP_STOP_MODE_SCFW, + }; + + static struct flexcan_devtype_data fsl_imx8mp_devtype_data = { +@@ -546,18 +554,42 @@ static void flexcan_enable_wakeup_irq(struct flexcan_priv *priv, bool enable) + priv->write(reg_mcr, ®s->mcr); + } + ++static int flexcan_stop_mode_enable_scfw(struct flexcan_priv *priv, bool enabled) ++{ ++ u8 idx = priv->scu_idx; ++ u32 rsrc_id, val; ++ ++ rsrc_id = IMX_SC_R_CAN(idx); ++ ++ if (enabled) ++ val = 1; ++ else ++ val = 0; ++ ++ /* stop mode request via scu firmware */ ++ return imx_sc_misc_set_control(priv->sc_ipc_handle, rsrc_id, ++ IMX_SC_C_IPG_STOP, val); ++} ++ + static inline int flexcan_enter_stop_mode(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->regs; + u32 reg_mcr; ++ int ret; + + reg_mcr = priv->read(®s->mcr); + reg_mcr |= FLEXCAN_MCR_SLF_WAK; + priv->write(reg_mcr, ®s->mcr); + + /* enable stop request */ +- regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr, +- 1 << priv->stm.req_bit, 1 << priv->stm.req_bit); ++ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_SETUP_STOP_MODE_SCFW) { ++ ret = flexcan_stop_mode_enable_scfw(priv, true); ++ if (ret < 0) ++ return ret; ++ } else { ++ regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr, ++ 1 << priv->stm.req_bit, 1 << priv->stm.req_bit); ++ } + + return flexcan_low_power_enter_ack(priv); + } +@@ -566,10 +598,17 @@ static inline int flexcan_exit_stop_mode(struct flexcan_priv *priv) + { + struct flexcan_regs __iomem *regs = priv->regs; + u32 reg_mcr; ++ int ret; + + /* remove stop request */ +- regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr, +- 1 << priv->stm.req_bit, 0); ++ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_SETUP_STOP_MODE_SCFW) { ++ ret = flexcan_stop_mode_enable_scfw(priv, false); ++ if (ret < 0) ++ return ret; ++ } else { ++ regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr, ++ 1 << priv->stm.req_bit, 0); ++ } + + reg_mcr = priv->read(®s->mcr); + reg_mcr &= ~FLEXCAN_MCR_SLF_WAK; +@@ -1867,7 +1906,7 @@ static void unregister_flexcandev(struct net_device *dev) + unregister_candev(dev); + } + +-static int flexcan_setup_stop_mode(struct platform_device *pdev) ++static int flexcan_setup_stop_mode_gpr(struct platform_device *pdev) + { + struct net_device *dev = platform_get_drvdata(pdev); + struct device_node *np = pdev->dev.of_node; +@@ -1912,11 +1951,6 @@ static int flexcan_setup_stop_mode(struct platform_device *pdev) + "gpr %s req_gpr=0x02%x req_bit=%u\n", + gpr_np->full_name, priv->stm.req_gpr, priv->stm.req_bit); + +- device_set_wakeup_capable(&pdev->dev, true); +- +- if (of_property_read_bool(np, "wakeup-source")) +- device_set_wakeup_enable(&pdev->dev, true); +- + return 0; + + out_put_node: +@@ -1924,6 +1958,58 @@ out_put_node: + return ret; + } + ++static int flexcan_setup_stop_mode_scfw(struct platform_device *pdev) ++{ ++ struct net_device *dev = platform_get_drvdata(pdev); ++ struct flexcan_priv *priv; ++ u8 scu_idx; ++ int ret; ++ ++ ret = of_property_read_u8(pdev->dev.of_node, "fsl,scu-index", &scu_idx); ++ if (ret < 0) { ++ dev_dbg(&pdev->dev, "failed to get scu index\n"); ++ return ret; ++ } ++ ++ priv = netdev_priv(dev); ++ priv->scu_idx = scu_idx; ++ ++ /* this function could be defered probe, return -EPROBE_DEFER */ ++ return imx_scu_get_handle(&priv->sc_ipc_handle); ++} ++ ++/* flexcan_setup_stop_mode - Setup stop mode for wakeup ++ * ++ * Return: = 0 setup stop mode successfully or doesn't support this feature ++ * < 0 fail to setup stop mode (could be defered probe) ++ */ ++static int flexcan_setup_stop_mode(struct platform_device *pdev) ++{ ++ struct net_device *dev = platform_get_drvdata(pdev); ++ struct flexcan_priv *priv; ++ int ret; ++ ++ priv = netdev_priv(dev); ++ ++ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_SETUP_STOP_MODE_SCFW) ++ ret = flexcan_setup_stop_mode_scfw(pdev); ++ else if (priv->devtype_data->quirks & FLEXCAN_QUIRK_SETUP_STOP_MODE_GPR) ++ ret = flexcan_setup_stop_mode_gpr(pdev); ++ else ++ /* return 0 directly if doesn't support stop mode feature */ ++ return 0; ++ ++ if (ret) ++ return ret; ++ ++ device_set_wakeup_capable(&pdev->dev, true); ++ ++ if (of_property_read_bool(pdev->dev.of_node, "wakeup-source")) ++ device_set_wakeup_enable(&pdev->dev, true); ++ ++ return 0; ++} ++ + static const struct of_device_id flexcan_of_match[] = { + { .compatible = "fsl,imx8qm-flexcan", .data = &fsl_imx8qm_devtype_data, }, + { .compatible = "fsl,imx8mp-flexcan", .data = &fsl_imx8mp_devtype_data, }, +@@ -2054,17 +2140,20 @@ static int flexcan_probe(struct platform_device *pdev) + goto failed_register; + } + ++ err = flexcan_setup_stop_mode(pdev); ++ if (err < 0) { ++ if (err != -EPROBE_DEFER) ++ dev_err(&pdev->dev, "setup stop mode failed\n"); ++ goto failed_setup_stop_mode; ++ } ++ + of_can_transceiver(dev); + devm_can_led_init(dev); + +- if (priv->devtype_data->quirks & FLEXCAN_QUIRK_SETUP_STOP_MODE_GPR) { +- err = flexcan_setup_stop_mode(pdev); +- if (err) +- dev_dbg(&pdev->dev, "failed to setup stop-mode\n"); +- } +- + return 0; + ++ failed_setup_stop_mode: ++ unregister_flexcandev(dev); + failed_register: + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); +diff --git a/drivers/net/ethernet/atheros/ag71xx.c b/drivers/net/ethernet/atheros/ag71xx.c +index dd5c8a9038bb7..a60ce90305819 100644 +--- a/drivers/net/ethernet/atheros/ag71xx.c ++++ b/drivers/net/ethernet/atheros/ag71xx.c +@@ -223,8 +223,6 @@ + #define AG71XX_REG_RX_SM 0x01b0 + #define AG71XX_REG_TX_SM 0x01b4 + +-#define ETH_SWITCH_HEADER_LEN 2 +- + #define AG71XX_DEFAULT_MSG_ENABLE \ + (NETIF_MSG_DRV \ + | NETIF_MSG_PROBE \ +@@ -933,7 +931,7 @@ static void ag71xx_hw_setup(struct ag71xx *ag) + + static unsigned int ag71xx_max_frame_len(unsigned int mtu) + { +- return ETH_SWITCH_HEADER_LEN + ETH_HLEN + VLAN_HLEN + mtu + ETH_FCS_LEN; ++ return ETH_HLEN + VLAN_HLEN + mtu + ETH_FCS_LEN; + } + + static void ag71xx_hw_set_macaddr(struct ag71xx *ag, unsigned char *mac) +diff --git a/drivers/net/ipa/ipa_reg.h b/drivers/net/ipa/ipa_reg.h +index e6b0827a244ec..732e691e9aa62 100644 +--- a/drivers/net/ipa/ipa_reg.h ++++ b/drivers/net/ipa/ipa_reg.h +@@ -408,15 +408,18 @@ enum ipa_cs_offload_en { + static inline u32 ipa_header_size_encoded(enum ipa_version version, + u32 header_size) + { ++ u32 size = header_size & field_mask(HDR_LEN_FMASK); + u32 val; + +- val = u32_encode_bits(header_size, HDR_LEN_FMASK); +- if (version < IPA_VERSION_4_5) ++ val = u32_encode_bits(size, HDR_LEN_FMASK); ++ if (version < IPA_VERSION_4_5) { ++ /* ipa_assert(header_size == size); */ + return val; ++ } + + /* IPA v4.5 adds a few more most-significant bits */ +- header_size >>= hweight32(HDR_LEN_FMASK); +- val |= u32_encode_bits(header_size, HDR_LEN_MSB_FMASK); ++ size = header_size >> hweight32(HDR_LEN_FMASK); ++ val |= u32_encode_bits(size, HDR_LEN_MSB_FMASK); + + return val; + } +@@ -425,15 +428,18 @@ static inline u32 ipa_header_size_encoded(enum ipa_version version, + static inline u32 ipa_metadata_offset_encoded(enum ipa_version version, + u32 offset) + { ++ u32 off = offset & field_mask(HDR_OFST_METADATA_FMASK); + u32 val; + +- val = u32_encode_bits(offset, HDR_OFST_METADATA_FMASK); +- if (version < IPA_VERSION_4_5) ++ val = u32_encode_bits(off, HDR_OFST_METADATA_FMASK); ++ if (version < IPA_VERSION_4_5) { ++ /* ipa_assert(offset == off); */ + return val; ++ } + + /* IPA v4.5 adds a few more most-significant bits */ +- offset >>= hweight32(HDR_OFST_METADATA_FMASK); +- val |= u32_encode_bits(offset, HDR_OFST_METADATA_MSB_FMASK); ++ off = offset >> hweight32(HDR_OFST_METADATA_FMASK); ++ val |= u32_encode_bits(off, HDR_OFST_METADATA_MSB_FMASK); + + return val; + } +diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c +index 20b91f5dfc6ed..4cf874fb5c5b4 100644 +--- a/drivers/net/phy/sfp-bus.c ++++ b/drivers/net/phy/sfp-bus.c +@@ -44,6 +44,17 @@ static void sfp_quirk_2500basex(const struct sfp_eeprom_id *id, + phylink_set(modes, 2500baseX_Full); + } + ++static void sfp_quirk_ubnt_uf_instant(const struct sfp_eeprom_id *id, ++ unsigned long *modes) ++{ ++ /* Ubiquiti U-Fiber Instant module claims that support all transceiver ++ * types including 10G Ethernet which is not truth. So clear all claimed ++ * modes and set only one mode which module supports: 1000baseX_Full. ++ */ ++ phylink_zero(modes); ++ phylink_set(modes, 1000baseX_Full); ++} ++ + static const struct sfp_quirk sfp_quirks[] = { + { + // Alcatel Lucent G-010S-P can operate at 2500base-X, but +@@ -63,6 +74,10 @@ static const struct sfp_quirk sfp_quirks[] = { + .vendor = "HUAWEI", + .part = "MA5671A", + .modes = sfp_quirk_2500basex, ++ }, { ++ .vendor = "UBNT", ++ .part = "UF-INSTANT", ++ .modes = sfp_quirk_ubnt_uf_instant, + }, + }; + +diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c +index f2b5e467a8001..7a680b5177f5e 100644 +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -273,8 +273,21 @@ static const struct sff_data sff_data = { + + static bool sfp_module_supported(const struct sfp_eeprom_id *id) + { +- return id->base.phys_id == SFF8024_ID_SFP && +- id->base.phys_ext_id == SFP_PHYS_EXT_ID_SFP; ++ if (id->base.phys_id == SFF8024_ID_SFP && ++ id->base.phys_ext_id == SFP_PHYS_EXT_ID_SFP) ++ return true; ++ ++ /* SFP GPON module Ubiquiti U-Fiber Instant has in its EEPROM stored ++ * phys id SFF instead of SFP. Therefore mark this module explicitly ++ * as supported based on vendor name and pn match. ++ */ ++ if (id->base.phys_id == SFF8024_ID_SFF_8472 && ++ id->base.phys_ext_id == SFP_PHYS_EXT_ID_SFP && ++ !memcmp(id->base.vendor_name, "UBNT ", 16) && ++ !memcmp(id->base.vendor_pn, "UF-INSTANT ", 16)) ++ return true; ++ ++ return false; + } + + static const struct sff_data sfp_data = { +diff --git a/drivers/net/tap.c b/drivers/net/tap.c +index 1f4bdd94407a9..f549d3a8e59c0 100644 +--- a/drivers/net/tap.c ++++ b/drivers/net/tap.c +@@ -1093,10 +1093,9 @@ static long tap_ioctl(struct file *file, unsigned int cmd, + return -ENOLINK; + } + ret = 0; +- u = tap->dev->type; ++ dev_get_mac_address(&sa, dev_net(tap->dev), tap->dev->name); + if (copy_to_user(&ifr->ifr_name, tap->dev->name, IFNAMSIZ) || +- copy_to_user(&ifr->ifr_hwaddr.sa_data, tap->dev->dev_addr, ETH_ALEN) || +- put_user(u, &ifr->ifr_hwaddr.sa_family)) ++ copy_to_user(&ifr->ifr_hwaddr, &sa, sizeof(sa))) + ret = -EFAULT; + tap_put_tap_dev(tap); + rtnl_unlock(); +@@ -1111,7 +1110,7 @@ static long tap_ioctl(struct file *file, unsigned int cmd, + rtnl_unlock(); + return -ENOLINK; + } +- ret = dev_set_mac_address(tap->dev, &sa, NULL); ++ ret = dev_set_mac_address_user(tap->dev, &sa, NULL); + tap_put_tap_dev(tap); + rtnl_unlock(); + return ret; +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index 978ac0981d160..5512418b7be0a 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -3113,15 +3113,14 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd, + + case SIOCGIFHWADDR: + /* Get hw address */ +- memcpy(ifr.ifr_hwaddr.sa_data, tun->dev->dev_addr, ETH_ALEN); +- ifr.ifr_hwaddr.sa_family = tun->dev->type; ++ dev_get_mac_address(&ifr.ifr_hwaddr, net, tun->dev->name); + if (copy_to_user(argp, &ifr, ifreq_len)) + ret = -EFAULT; + break; + + case SIOCSIFHWADDR: + /* Set hw address */ +- ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr, NULL); ++ ret = dev_set_mac_address_user(tun->dev, &ifr.ifr_hwaddr, NULL); + break; + + case TUNGETSNDBUF: +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 5a05add9b4e69..7410215e2a2e9 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1235,6 +1235,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x19d2, 0x1255, 4)}, + {QMI_FIXED_INTF(0x19d2, 0x1256, 4)}, + {QMI_FIXED_INTF(0x19d2, 0x1270, 5)}, /* ZTE MF667 */ ++ {QMI_FIXED_INTF(0x19d2, 0x1275, 3)}, /* ZTE P685M */ + {QMI_FIXED_INTF(0x19d2, 0x1401, 2)}, + {QMI_FIXED_INTF(0x19d2, 0x1402, 2)}, /* ZTE MF60 */ + {QMI_FIXED_INTF(0x19d2, 0x1424, 2)}, +diff --git a/drivers/net/wireless/ath/ath10k/ahb.c b/drivers/net/wireless/ath/ath10k/ahb.c +index 05a61975c83f4..869524852fbaa 100644 +--- a/drivers/net/wireless/ath/ath10k/ahb.c ++++ b/drivers/net/wireless/ath/ath10k/ahb.c +@@ -626,7 +626,7 @@ static int ath10k_ahb_hif_start(struct ath10k *ar) + { + ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot ahb hif start\n"); + +- napi_enable(&ar->napi); ++ ath10k_core_napi_enable(ar); + ath10k_ce_enable_interrupts(ar); + ath10k_pci_enable_legacy_irq(ar); + +@@ -644,8 +644,7 @@ static void ath10k_ahb_hif_stop(struct ath10k *ar) + ath10k_ahb_irq_disable(ar); + synchronize_irq(ar_ahb->irq); + +- napi_synchronize(&ar->napi); +- napi_disable(&ar->napi); ++ ath10k_core_napi_sync_disable(ar); + + ath10k_pci_flush(ar); + } +diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c +index eeb6ff6aa2e1e..a419ec7130f97 100644 +--- a/drivers/net/wireless/ath/ath10k/core.c ++++ b/drivers/net/wireless/ath/ath10k/core.c +@@ -2305,6 +2305,31 @@ void ath10k_core_start_recovery(struct ath10k *ar) + } + EXPORT_SYMBOL(ath10k_core_start_recovery); + ++void ath10k_core_napi_enable(struct ath10k *ar) ++{ ++ lockdep_assert_held(&ar->conf_mutex); ++ ++ if (test_bit(ATH10K_FLAG_NAPI_ENABLED, &ar->dev_flags)) ++ return; ++ ++ napi_enable(&ar->napi); ++ set_bit(ATH10K_FLAG_NAPI_ENABLED, &ar->dev_flags); ++} ++EXPORT_SYMBOL(ath10k_core_napi_enable); ++ ++void ath10k_core_napi_sync_disable(struct ath10k *ar) ++{ ++ lockdep_assert_held(&ar->conf_mutex); ++ ++ if (!test_bit(ATH10K_FLAG_NAPI_ENABLED, &ar->dev_flags)) ++ return; ++ ++ napi_synchronize(&ar->napi); ++ napi_disable(&ar->napi); ++ clear_bit(ATH10K_FLAG_NAPI_ENABLED, &ar->dev_flags); ++} ++EXPORT_SYMBOL(ath10k_core_napi_sync_disable); ++ + static void ath10k_core_restart(struct work_struct *work) + { + struct ath10k *ar = container_of(work, struct ath10k, restart_work); +diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h +index 51f7e960e2977..f4be6bfb25392 100644 +--- a/drivers/net/wireless/ath/ath10k/core.h ++++ b/drivers/net/wireless/ath/ath10k/core.h +@@ -868,6 +868,9 @@ enum ath10k_dev_flags { + + /* Indicates that ath10k device is during recovery process and not complete */ + ATH10K_FLAG_RESTARTING, ++ ++ /* protected by conf_mutex */ ++ ATH10K_FLAG_NAPI_ENABLED, + }; + + enum ath10k_cal_mode { +@@ -1308,6 +1311,8 @@ static inline bool ath10k_peer_stats_enabled(struct ath10k *ar) + + extern unsigned long ath10k_coredump_mask; + ++void ath10k_core_napi_sync_disable(struct ath10k *ar); ++void ath10k_core_napi_enable(struct ath10k *ar); + struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev, + enum ath10k_bus bus, + enum ath10k_hw_rev hw_rev, +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index e815aab412d7a..9a56a0a5f85da 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -3763,23 +3763,16 @@ bool ath10k_mac_tx_frm_has_freq(struct ath10k *ar) + static int ath10k_mac_tx_wmi_mgmt(struct ath10k *ar, struct sk_buff *skb) + { + struct sk_buff_head *q = &ar->wmi_mgmt_tx_queue; +- int ret = 0; +- +- spin_lock_bh(&ar->data_lock); + +- if (skb_queue_len(q) == ATH10K_MAX_NUM_MGMT_PENDING) { ++ if (skb_queue_len_lockless(q) >= ATH10K_MAX_NUM_MGMT_PENDING) { + ath10k_warn(ar, "wmi mgmt tx queue is full\n"); +- ret = -ENOSPC; +- goto unlock; ++ return -ENOSPC; + } + +- __skb_queue_tail(q, skb); ++ skb_queue_tail(q, skb); + ieee80211_queue_work(ar->hw, &ar->wmi_mgmt_tx_work); + +-unlock: +- spin_unlock_bh(&ar->data_lock); +- +- return ret; ++ return 0; + } + + static enum ath10k_mac_tx_path +diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c +index 2328df09875ce..e7fde635e0eef 100644 +--- a/drivers/net/wireless/ath/ath10k/pci.c ++++ b/drivers/net/wireless/ath/ath10k/pci.c +@@ -1958,7 +1958,7 @@ static int ath10k_pci_hif_start(struct ath10k *ar) + + ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif start\n"); + +- napi_enable(&ar->napi); ++ ath10k_core_napi_enable(ar); + + ath10k_pci_irq_enable(ar); + ath10k_pci_rx_post(ar); +@@ -2075,8 +2075,9 @@ static void ath10k_pci_hif_stop(struct ath10k *ar) + + ath10k_pci_irq_disable(ar); + ath10k_pci_irq_sync(ar); +- napi_synchronize(&ar->napi); +- napi_disable(&ar->napi); ++ ++ ath10k_core_napi_sync_disable(ar); ++ + cancel_work_sync(&ar_pci->dump_work); + + /* Most likely the device has HTT Rx ring configured. The only way to +diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c +index c415090d1f37c..b746052737e0b 100644 +--- a/drivers/net/wireless/ath/ath10k/sdio.c ++++ b/drivers/net/wireless/ath/ath10k/sdio.c +@@ -1859,7 +1859,7 @@ static int ath10k_sdio_hif_start(struct ath10k *ar) + struct ath10k_sdio *ar_sdio = ath10k_sdio_priv(ar); + int ret; + +- napi_enable(&ar->napi); ++ ath10k_core_napi_enable(ar); + + /* Sleep 20 ms before HIF interrupts are disabled. + * This will give target plenty of time to process the BMI done +@@ -1992,8 +1992,7 @@ static void ath10k_sdio_hif_stop(struct ath10k *ar) + + spin_unlock_bh(&ar_sdio->wr_async_lock); + +- napi_synchronize(&ar->napi); +- napi_disable(&ar->napi); ++ ath10k_core_napi_sync_disable(ar); + } + + #ifdef CONFIG_PM +diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c +index 1c3307e3b1085..af7ecef6bcde9 100644 +--- a/drivers/net/wireless/ath/ath10k/snoc.c ++++ b/drivers/net/wireless/ath/ath10k/snoc.c +@@ -915,8 +915,7 @@ static void ath10k_snoc_hif_stop(struct ath10k *ar) + if (!test_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags)) + ath10k_snoc_irq_disable(ar); + +- napi_synchronize(&ar->napi); +- napi_disable(&ar->napi); ++ ath10k_core_napi_sync_disable(ar); + ath10k_snoc_buffer_cleanup(ar); + ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif stop\n"); + } +@@ -926,7 +925,8 @@ static int ath10k_snoc_hif_start(struct ath10k *ar) + struct ath10k_snoc *ar_snoc = ath10k_snoc_priv(ar); + + bitmap_clear(ar_snoc->pending_ce_irqs, 0, CE_COUNT_MAX); +- napi_enable(&ar->napi); ++ ++ ath10k_core_napi_enable(ar); + ath10k_snoc_irq_enable(ar); + ath10k_snoc_rx_post(ar); + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c +index 4aa2561934d77..6d5188b78f2de 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c +@@ -40,6 +40,18 @@ static const struct brcmf_dmi_data pov_tab_p1006w_data = { + BRCM_CC_43340_CHIP_ID, 2, "pov-tab-p1006w-data" + }; + ++static const struct brcmf_dmi_data predia_basic_data = { ++ BRCM_CC_43341_CHIP_ID, 2, "predia-basic" ++}; ++ ++/* Note the Voyo winpad A15 tablet uses the same Ampak AP6330 module, with the ++ * exact same nvram file as the Prowise-PT301 tablet. Since the nvram for the ++ * Prowise-PT301 is already in linux-firmware we just point to that here. ++ */ ++static const struct brcmf_dmi_data voyo_winpad_a15_data = { ++ BRCM_CC_4330_CHIP_ID, 4, "Prowise-PT301" ++}; ++ + static const struct dmi_system_id dmi_platform_data[] = { + { + /* ACEPC T8 Cherry Trail Z8350 mini PC */ +@@ -111,6 +123,26 @@ static const struct dmi_system_id dmi_platform_data[] = { + }, + .driver_data = (void *)&pov_tab_p1006w_data, + }, ++ { ++ /* Predia Basic tablet (+ with keyboard dock) */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Insyde"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "CherryTrail"), ++ /* Mx.WT107.KUBNGEA02 with the version-nr dropped */ ++ DMI_MATCH(DMI_BIOS_VERSION, "Mx.WT107.KUBNGEA"), ++ }, ++ .driver_data = (void *)&predia_basic_data, ++ }, ++ { ++ /* Voyo winpad A15 tablet */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), ++ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"), ++ /* Above strings are too generic, also match on BIOS date */ ++ DMI_MATCH(DMI_BIOS_DATE, "11/20/2014"), ++ }, ++ .driver_data = (void *)&voyo_winpad_a15_data, ++ }, + {} + }; + +diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c +index 8280092066e77..503d0feb6bbc6 100644 +--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c ++++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c +@@ -635,6 +635,24 @@ const struct iwl_cfg iwl_cfg_snj_a0_mr_a0 = { + .num_rbds = IWL_NUM_RBDS_AX210_HE, + }; + ++const struct iwl_cfg iwl_cfg_so_a0_hr_a0 = { ++ .fw_name_pre = IWL_SO_A_HR_B_FW_PRE, ++ IWL_DEVICE_AX210, ++ .num_rbds = IWL_NUM_RBDS_AX210_HE, ++}; ++ ++const struct iwl_cfg iwl_cfg_quz_a0_hr_b0 = { ++ .fw_name_pre = IWL_QUZ_A_HR_B_FW_PRE, ++ IWL_DEVICE_22500, ++ /* ++ * This device doesn't support receiving BlockAck with a large bitmap ++ * so we need to restrict the size of transmitted aggregation to the ++ * HT size; mac80211 would otherwise pick the HE max (256) by default. ++ */ ++ .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT, ++ .num_rbds = IWL_NUM_RBDS_22000_HE, ++}; ++ + MODULE_FIRMWARE(IWL_QU_B_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_QNJ_B_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_QU_C_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h +index 86e1d57df65ed..c72d23d54d909 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h +@@ -418,6 +418,7 @@ struct iwl_cfg { + #define IWL_CFG_MAC_TYPE_QU 0x33 + #define IWL_CFG_MAC_TYPE_QUZ 0x35 + #define IWL_CFG_MAC_TYPE_QNJ 0x36 ++#define IWL_CFG_MAC_TYPE_SO 0x37 + #define IWL_CFG_MAC_TYPE_SNJ 0x42 + #define IWL_CFG_MAC_TYPE_MA 0x44 + +@@ -604,6 +605,8 @@ extern const struct iwl_cfg iwlax201_cfg_snj_hr_b0; + extern const struct iwl_cfg iwl_cfg_ma_a0_gf_a0; + extern const struct iwl_cfg iwl_cfg_ma_a0_mr_a0; + extern const struct iwl_cfg iwl_cfg_snj_a0_mr_a0; ++extern const struct iwl_cfg iwl_cfg_so_a0_hr_a0; ++extern const struct iwl_cfg iwl_cfg_quz_a0_hr_b0; + #endif /* CONFIG_IWLMVM */ + + #endif /* __IWL_CONFIG_H__ */ +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index ed3f5b7aa71e9..c55faa388948e 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -934,6 +934,11 @@ static const struct iwl_dev_info iwl_dev_info_table[] = { + IWL_CFG_RF_TYPE_HR1, IWL_CFG_ANY, + IWL_CFG_ANY, IWL_CFG_ANY, + iwl_quz_a0_hr1_b0, iwl_ax101_name), ++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY, ++ IWL_CFG_MAC_TYPE_QUZ, SILICON_B_STEP, ++ IWL_CFG_RF_TYPE_HR2, IWL_CFG_ANY, ++ IWL_CFG_NO_160, IWL_CFG_ANY, ++ iwl_cfg_quz_a0_hr_b0, iwl_ax203_name), + + /* Ma */ + _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY, +@@ -952,6 +957,27 @@ static const struct iwl_dev_info iwl_dev_info_table[] = { + IWL_CFG_ANY, IWL_CFG_ANY, + iwl_cfg_snj_a0_mr_a0, iwl_ma_name), + ++/* So with Hr */ ++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY, ++ IWL_CFG_MAC_TYPE_SO, IWL_CFG_ANY, ++ IWL_CFG_RF_TYPE_HR2, IWL_CFG_ANY, ++ IWL_CFG_NO_160, IWL_CFG_ANY, ++ iwl_cfg_so_a0_hr_a0, iwl_ax203_name), ++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY, ++ IWL_CFG_MAC_TYPE_SO, IWL_CFG_ANY, ++ IWL_CFG_RF_TYPE_HR2, IWL_CFG_ANY, ++ IWL_CFG_NO_160, IWL_CFG_ANY, ++ iwl_cfg_so_a0_hr_a0, iwl_ax203_name), ++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY, ++ IWL_CFG_MAC_TYPE_SO, IWL_CFG_ANY, ++ IWL_CFG_RF_TYPE_HR1, IWL_CFG_ANY, ++ IWL_CFG_160, IWL_CFG_ANY, ++ iwl_cfg_so_a0_hr_a0, iwl_ax101_name), ++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY, ++ IWL_CFG_MAC_TYPE_SO, IWL_CFG_ANY, ++ IWL_CFG_RF_TYPE_HR2, IWL_CFG_ANY, ++ IWL_CFG_160, IWL_CFG_ANY, ++ iwl_cfg_so_a0_hr_a0, iwl_ax201_name) + + #endif /* CONFIG_IWLMVM */ + }; +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +index 0f360be0b8851..fb10a6497ed05 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +@@ -2058,6 +2058,23 @@ void mt7615_dma_reset(struct mt7615_dev *dev) + } + EXPORT_SYMBOL_GPL(mt7615_dma_reset); + ++void mt7615_tx_token_put(struct mt7615_dev *dev) ++{ ++ struct mt76_txwi_cache *txwi; ++ int id; ++ ++ spin_lock_bh(&dev->token_lock); ++ idr_for_each_entry(&dev->token, txwi, id) { ++ mt7615_txp_skb_unmap(&dev->mt76, txwi); ++ if (txwi->skb) ++ dev_kfree_skb_any(txwi->skb); ++ mt76_put_txwi(&dev->mt76, txwi); ++ } ++ spin_unlock_bh(&dev->token_lock); ++ idr_destroy(&dev->token); ++} ++EXPORT_SYMBOL_GPL(mt7615_tx_token_put); ++ + void mt7615_mac_reset_work(struct work_struct *work) + { + struct mt7615_phy *phy2; +@@ -2101,6 +2118,9 @@ void mt7615_mac_reset_work(struct work_struct *work) + + mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_PDMA_STOPPED); + ++ mt7615_tx_token_put(dev); ++ idr_init(&dev->token); ++ + if (mt7615_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) { + mt7615_dma_reset(dev); + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h b/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h +index 99b8abdbb08f7..d697ff2ea56e8 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h +@@ -583,7 +583,7 @@ int mt7615_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, + struct mt76_tx_info *tx_info); + + void mt7615_tx_complete_skb(struct mt76_dev *mdev, struct mt76_queue_entry *e); +- ++void mt7615_tx_token_put(struct mt7615_dev *dev); + void mt7615_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q, + struct sk_buff *skb); + void mt7615_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps); +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c +index 27fcb1374685b..58a0ec1bf8d7b 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c +@@ -160,9 +160,7 @@ int mt7615_register_device(struct mt7615_dev *dev) + + void mt7615_unregister_device(struct mt7615_dev *dev) + { +- struct mt76_txwi_cache *txwi; + bool mcu_running; +- int id; + + mcu_running = mt7615_wait_for_mcu_init(dev); + +@@ -172,15 +170,7 @@ void mt7615_unregister_device(struct mt7615_dev *dev) + mt7615_mcu_exit(dev); + mt7615_dma_cleanup(dev); + +- spin_lock_bh(&dev->token_lock); +- idr_for_each_entry(&dev->token, txwi, id) { +- mt7615_txp_skb_unmap(&dev->mt76, txwi); +- if (txwi->skb) +- dev_kfree_skb_any(txwi->skb); +- mt76_put_txwi(&dev->mt76, txwi); +- } +- spin_unlock_bh(&dev->token_lock); +- idr_destroy(&dev->token); ++ mt7615_tx_token_put(dev); + + tasklet_disable(&dev->irq_tasklet); + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +index 102a8f14c22d4..2ec18aaa82807 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c +@@ -672,28 +672,12 @@ int mt7915_register_device(struct mt7915_dev *dev) + + void mt7915_unregister_device(struct mt7915_dev *dev) + { +- struct mt76_txwi_cache *txwi; +- int id; +- + mt7915_unregister_ext_phy(dev); + mt76_unregister_device(&dev->mt76); + mt7915_mcu_exit(dev); + mt7915_dma_cleanup(dev); + +- spin_lock_bh(&dev->token_lock); +- idr_for_each_entry(&dev->token, txwi, id) { +- mt7915_txp_skb_unmap(&dev->mt76, txwi); +- if (txwi->skb) { +- struct ieee80211_hw *hw; +- +- hw = mt76_tx_status_get_hw(&dev->mt76, txwi->skb); +- ieee80211_free_txskb(hw, txwi->skb); +- } +- mt76_put_txwi(&dev->mt76, txwi); +- dev->token_count--; +- } +- spin_unlock_bh(&dev->token_lock); +- idr_destroy(&dev->token); ++ mt7915_tx_token_put(dev); + + mt76_free_device(&dev->mt76); + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +index f504eeb221f95..1b4d65310b887 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +@@ -1485,6 +1485,27 @@ mt7915_dma_reset(struct mt7915_phy *phy) + MT_WFDMA1_GLO_CFG_TX_DMA_EN | MT_WFDMA1_GLO_CFG_RX_DMA_EN); + } + ++void mt7915_tx_token_put(struct mt7915_dev *dev) ++{ ++ struct mt76_txwi_cache *txwi; ++ int id; ++ ++ spin_lock_bh(&dev->token_lock); ++ idr_for_each_entry(&dev->token, txwi, id) { ++ mt7915_txp_skb_unmap(&dev->mt76, txwi); ++ if (txwi->skb) { ++ struct ieee80211_hw *hw; ++ ++ hw = mt76_tx_status_get_hw(&dev->mt76, txwi->skb); ++ ieee80211_free_txskb(hw, txwi->skb); ++ } ++ mt76_put_txwi(&dev->mt76, txwi); ++ dev->token_count--; ++ } ++ spin_unlock_bh(&dev->token_lock); ++ idr_destroy(&dev->token); ++} ++ + /* system error recovery */ + void mt7915_mac_reset_work(struct work_struct *work) + { +@@ -1525,6 +1546,9 @@ void mt7915_mac_reset_work(struct work_struct *work) + + mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_DMA_STOPPED); + ++ mt7915_tx_token_put(dev); ++ idr_init(&dev->token); ++ + if (mt7915_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) { + mt7915_dma_reset(&dev->phy); + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +index 0339abf360d3f..94bed8a3a050a 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +@@ -463,6 +463,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, + struct ieee80211_sta *sta, + struct mt76_tx_info *tx_info); + void mt7915_tx_complete_skb(struct mt76_dev *mdev, struct mt76_queue_entry *e); ++void mt7915_tx_token_put(struct mt7915_dev *dev); + int mt7915_init_tx_queues(struct mt7915_phy *phy, int idx, int n_desc); + void mt7915_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q, + struct sk_buff *skb); +diff --git a/drivers/net/wireless/microchip/wilc1000/netdev.c b/drivers/net/wireless/microchip/wilc1000/netdev.c +index 2a1fbbdd6a4bd..0c188310919e1 100644 +--- a/drivers/net/wireless/microchip/wilc1000/netdev.c ++++ b/drivers/net/wireless/microchip/wilc1000/netdev.c +@@ -737,7 +737,7 @@ netdev_tx_t wilc_mac_xmit(struct sk_buff *skb, struct net_device *ndev) + + vif->netstats.tx_packets++; + vif->netstats.tx_bytes += tx_data->size; +- queue_count = wilc_wlan_txq_add_net_pkt(ndev, (void *)tx_data, ++ queue_count = wilc_wlan_txq_add_net_pkt(ndev, tx_data, + tx_data->buff, tx_data->size, + wilc_tx_complete); + +diff --git a/drivers/net/wireless/microchip/wilc1000/wlan.c b/drivers/net/wireless/microchip/wilc1000/wlan.c +index c12f27be9f790..31d51385ba934 100644 +--- a/drivers/net/wireless/microchip/wilc1000/wlan.c ++++ b/drivers/net/wireless/microchip/wilc1000/wlan.c +@@ -408,7 +408,8 @@ static inline u8 ac_change(struct wilc *wilc, u8 *ac) + return 1; + } + +-int wilc_wlan_txq_add_net_pkt(struct net_device *dev, void *priv, u8 *buffer, ++int wilc_wlan_txq_add_net_pkt(struct net_device *dev, ++ struct tx_complete_data *tx_data, u8 *buffer, + u32 buffer_size, + void (*tx_complete_fn)(void *, int)) + { +@@ -420,27 +421,27 @@ int wilc_wlan_txq_add_net_pkt(struct net_device *dev, void *priv, u8 *buffer, + wilc = vif->wilc; + + if (wilc->quit) { +- tx_complete_fn(priv, 0); ++ tx_complete_fn(tx_data, 0); + return 0; + } + + tqe = kmalloc(sizeof(*tqe), GFP_ATOMIC); + + if (!tqe) { +- tx_complete_fn(priv, 0); ++ tx_complete_fn(tx_data, 0); + return 0; + } + tqe->type = WILC_NET_PKT; + tqe->buffer = buffer; + tqe->buffer_size = buffer_size; + tqe->tx_complete_func = tx_complete_fn; +- tqe->priv = priv; ++ tqe->priv = tx_data; + tqe->vif = vif; + +- q_num = ac_classify(wilc, priv); ++ q_num = ac_classify(wilc, tx_data->skb); + tqe->q_num = q_num; + if (ac_change(wilc, &q_num)) { +- tx_complete_fn(priv, 0); ++ tx_complete_fn(tx_data, 0); + kfree(tqe); + return 0; + } +@@ -451,7 +452,7 @@ int wilc_wlan_txq_add_net_pkt(struct net_device *dev, void *priv, u8 *buffer, + tcp_process(dev, tqe); + wilc_wlan_txq_add_to_tail(dev, q_num, tqe); + } else { +- tx_complete_fn(priv, 0); ++ tx_complete_fn(tx_data, 0); + kfree(tqe); + } + +diff --git a/drivers/net/wireless/microchip/wilc1000/wlan.h b/drivers/net/wireless/microchip/wilc1000/wlan.h +index 3d2104f198192..d55eb6b3a12a9 100644 +--- a/drivers/net/wireless/microchip/wilc1000/wlan.h ++++ b/drivers/net/wireless/microchip/wilc1000/wlan.h +@@ -399,7 +399,8 @@ int wilc_wlan_firmware_download(struct wilc *wilc, const u8 *buffer, + u32 buffer_size); + int wilc_wlan_start(struct wilc *wilc); + int wilc_wlan_stop(struct wilc *wilc, struct wilc_vif *vif); +-int wilc_wlan_txq_add_net_pkt(struct net_device *dev, void *priv, u8 *buffer, ++int wilc_wlan_txq_add_net_pkt(struct net_device *dev, ++ struct tx_complete_data *tx_data, u8 *buffer, + u32 buffer_size, + void (*tx_complete_fn)(void *, int)); + int wilc_wlan_handle_txq(struct wilc *wl, u32 *txq_count); +diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c +index 3c9c623bb4283..9d7dbfe7fe0c3 100644 +--- a/drivers/net/wireless/ti/wl12xx/main.c ++++ b/drivers/net/wireless/ti/wl12xx/main.c +@@ -635,7 +635,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl) + wl->quirks |= WLCORE_QUIRK_LEGACY_NVS | + WLCORE_QUIRK_DUAL_PROBE_TMPL | + WLCORE_QUIRK_TKIP_HEADER_SPACE | +- WLCORE_QUIRK_START_STA_FAILS | + WLCORE_QUIRK_AP_ZERO_SESSION_ID; + wl->sr_fw_name = WL127X_FW_NAME_SINGLE; + wl->mr_fw_name = WL127X_FW_NAME_MULTI; +@@ -659,7 +658,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl) + wl->quirks |= WLCORE_QUIRK_LEGACY_NVS | + WLCORE_QUIRK_DUAL_PROBE_TMPL | + WLCORE_QUIRK_TKIP_HEADER_SPACE | +- WLCORE_QUIRK_START_STA_FAILS | + WLCORE_QUIRK_AP_ZERO_SESSION_ID; + wl->plt_fw_name = WL127X_PLT_FW_NAME; + wl->sr_fw_name = WL127X_FW_NAME_SINGLE; +@@ -688,7 +686,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl) + wl->quirks |= WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN | + WLCORE_QUIRK_DUAL_PROBE_TMPL | + WLCORE_QUIRK_TKIP_HEADER_SPACE | +- WLCORE_QUIRK_START_STA_FAILS | + WLCORE_QUIRK_AP_ZERO_SESSION_ID; + + wlcore_set_min_fw_ver(wl, WL128X_CHIP_VER, +diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c +index 122c7a4b374f1..0f9cc3de6aebc 100644 +--- a/drivers/net/wireless/ti/wlcore/main.c ++++ b/drivers/net/wireless/ti/wlcore/main.c +@@ -2872,21 +2872,8 @@ static int wlcore_join(struct wl1271 *wl, struct wl12xx_vif *wlvif) + + if (is_ibss) + ret = wl12xx_cmd_role_start_ibss(wl, wlvif); +- else { +- if (wl->quirks & WLCORE_QUIRK_START_STA_FAILS) { +- /* +- * TODO: this is an ugly workaround for wl12xx fw +- * bug - we are not able to tx/rx after the first +- * start_sta, so make dummy start+stop calls, +- * and then call start_sta again. +- * this should be fixed in the fw. +- */ +- wl12xx_cmd_role_start_sta(wl, wlvif); +- wl12xx_cmd_role_stop_sta(wl, wlvif); +- } +- ++ else + ret = wl12xx_cmd_role_start_sta(wl, wlvif); +- } + + return ret; + } +diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h +index b7821311ac75b..81c94d390623b 100644 +--- a/drivers/net/wireless/ti/wlcore/wlcore.h ++++ b/drivers/net/wireless/ti/wlcore/wlcore.h +@@ -547,9 +547,6 @@ wlcore_set_min_fw_ver(struct wl1271 *wl, unsigned int chip, + /* Each RX/TX transaction requires an end-of-transaction transfer */ + #define WLCORE_QUIRK_END_OF_TRANSACTION BIT(0) + +-/* the first start_role(sta) sometimes doesn't work on wl12xx */ +-#define WLCORE_QUIRK_START_STA_FAILS BIT(1) +- + /* wl127x and SPI don't support SDIO block size alignment */ + #define WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN BIT(2) + +diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c +index 423667b837510..986b569709616 100644 +--- a/drivers/net/xen-netback/netback.c ++++ b/drivers/net/xen-netback/netback.c +@@ -1342,11 +1342,21 @@ int xenvif_tx_action(struct xenvif_queue *queue, int budget) + return 0; + + gnttab_batch_copy(queue->tx_copy_ops, nr_cops); +- if (nr_mops != 0) ++ if (nr_mops != 0) { + ret = gnttab_map_refs(queue->tx_map_ops, + NULL, + queue->pages_to_map, + nr_mops); ++ if (ret) { ++ unsigned int i; ++ ++ netdev_err(queue->vif->dev, "Map fail: nr %u ret %d\n", ++ nr_mops, ret); ++ for (i = 0; i < nr_mops; ++i) ++ WARN_ON_ONCE(queue->tx_map_ops[i].status == ++ GNTST_okay); ++ } ++ } + + work_done = xenvif_tx_submit(queue); + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index f13eb4ded95fa..129e2b6bd6d3f 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -371,6 +371,26 @@ bool nvme_cancel_request(struct request *req, void *data, bool reserved) + } + EXPORT_SYMBOL_GPL(nvme_cancel_request); + ++void nvme_cancel_tagset(struct nvme_ctrl *ctrl) ++{ ++ if (ctrl->tagset) { ++ blk_mq_tagset_busy_iter(ctrl->tagset, ++ nvme_cancel_request, ctrl); ++ blk_mq_tagset_wait_completed_request(ctrl->tagset); ++ } ++} ++EXPORT_SYMBOL_GPL(nvme_cancel_tagset); ++ ++void nvme_cancel_admin_tagset(struct nvme_ctrl *ctrl) ++{ ++ if (ctrl->admin_tagset) { ++ blk_mq_tagset_busy_iter(ctrl->admin_tagset, ++ nvme_cancel_request, ctrl); ++ blk_mq_tagset_wait_completed_request(ctrl->admin_tagset); ++ } ++} ++EXPORT_SYMBOL_GPL(nvme_cancel_admin_tagset); ++ + bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl, + enum nvme_ctrl_state new_state) + { +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 88a6b97247f50..a72f071810910 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -576,6 +576,8 @@ static inline bool nvme_is_aen_req(u16 qid, __u16 command_id) + + void nvme_complete_rq(struct request *req); + bool nvme_cancel_request(struct request *req, void *data, bool reserved); ++void nvme_cancel_tagset(struct nvme_ctrl *ctrl); ++void nvme_cancel_admin_tagset(struct nvme_ctrl *ctrl); + bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl, + enum nvme_ctrl_state new_state); + bool nvme_wait_reset(struct nvme_ctrl *ctrl); +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index b7ce4f221d990..746392eade455 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -919,12 +919,16 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl, + + error = nvme_init_identify(&ctrl->ctrl); + if (error) +- goto out_stop_queue; ++ goto out_quiesce_queue; + + return 0; + ++out_quiesce_queue: ++ blk_mq_quiesce_queue(ctrl->ctrl.admin_q); ++ blk_sync_queue(ctrl->ctrl.admin_q); + out_stop_queue: + nvme_rdma_stop_queue(&ctrl->queues[0]); ++ nvme_cancel_admin_tagset(&ctrl->ctrl); + out_cleanup_queue: + if (new) + blk_cleanup_queue(ctrl->ctrl.admin_q); +@@ -1001,8 +1005,10 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new) + + out_wait_freeze_timed_out: + nvme_stop_queues(&ctrl->ctrl); ++ nvme_sync_io_queues(&ctrl->ctrl); + nvme_rdma_stop_io_queues(ctrl); + out_cleanup_connect_q: ++ nvme_cancel_tagset(&ctrl->ctrl); + if (new) + blk_cleanup_queue(ctrl->ctrl.connect_q); + out_free_tag_set: +@@ -1144,10 +1150,18 @@ static int nvme_rdma_setup_ctrl(struct nvme_rdma_ctrl *ctrl, bool new) + return 0; + + destroy_io: +- if (ctrl->ctrl.queue_count > 1) ++ if (ctrl->ctrl.queue_count > 1) { ++ nvme_stop_queues(&ctrl->ctrl); ++ nvme_sync_io_queues(&ctrl->ctrl); ++ nvme_rdma_stop_io_queues(ctrl); ++ nvme_cancel_tagset(&ctrl->ctrl); + nvme_rdma_destroy_io_queues(ctrl, new); ++ } + destroy_admin: ++ blk_mq_quiesce_queue(ctrl->ctrl.admin_q); ++ blk_sync_queue(ctrl->ctrl.admin_q); + nvme_rdma_stop_queue(&ctrl->queues[0]); ++ nvme_cancel_admin_tagset(&ctrl->ctrl); + nvme_rdma_destroy_admin_queue(ctrl, new); + return ret; + } +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 881d28eb15e9d..30d24a5a5b826 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -1815,8 +1815,10 @@ static int nvme_tcp_configure_io_queues(struct nvme_ctrl *ctrl, bool new) + + out_wait_freeze_timed_out: + nvme_stop_queues(ctrl); ++ nvme_sync_io_queues(ctrl); + nvme_tcp_stop_io_queues(ctrl); + out_cleanup_connect_q: ++ nvme_cancel_tagset(ctrl); + if (new) + blk_cleanup_queue(ctrl->connect_q); + out_free_tag_set: +@@ -1878,12 +1880,16 @@ static int nvme_tcp_configure_admin_queue(struct nvme_ctrl *ctrl, bool new) + + error = nvme_init_identify(ctrl); + if (error) +- goto out_stop_queue; ++ goto out_quiesce_queue; + + return 0; + ++out_quiesce_queue: ++ blk_mq_quiesce_queue(ctrl->admin_q); ++ blk_sync_queue(ctrl->admin_q); + out_stop_queue: + nvme_tcp_stop_queue(ctrl, 0); ++ nvme_cancel_admin_tagset(ctrl); + out_cleanup_queue: + if (new) + blk_cleanup_queue(ctrl->admin_q); +@@ -2003,10 +2009,18 @@ static int nvme_tcp_setup_ctrl(struct nvme_ctrl *ctrl, bool new) + return 0; + + destroy_io: +- if (ctrl->queue_count > 1) ++ if (ctrl->queue_count > 1) { ++ nvme_stop_queues(ctrl); ++ nvme_sync_io_queues(ctrl); ++ nvme_tcp_stop_io_queues(ctrl); ++ nvme_cancel_tagset(ctrl); + nvme_tcp_destroy_io_queues(ctrl, new); ++ } + destroy_admin: ++ blk_mq_quiesce_queue(ctrl->admin_q); ++ blk_sync_queue(ctrl->admin_q); + nvme_tcp_stop_queue(ctrl, 0); ++ nvme_cancel_admin_tagset(ctrl); + nvme_tcp_destroy_admin_queue(ctrl, new); + return ret; + } +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 790393d1e3189..ba791165ed194 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -3596,7 +3596,14 @@ u32 pci_rebar_get_possible_sizes(struct pci_dev *pdev, int bar) + return 0; + + pci_read_config_dword(pdev, pos + PCI_REBAR_CAP, &cap); +- return (cap & PCI_REBAR_CAP_SIZES) >> 4; ++ cap &= PCI_REBAR_CAP_SIZES; ++ ++ /* Sapphire RX 5600 XT Pulse has an invalid cap dword for BAR 0 */ ++ if (pdev->vendor == PCI_VENDOR_ID_ATI && pdev->device == 0x731f && ++ bar == 0 && cap == 0x7000) ++ cap = 0x3f000; ++ ++ return cap >> 4; + } + + /** +diff --git a/drivers/phy/mediatek/phy-mtk-hdmi.c b/drivers/phy/mediatek/phy-mtk-hdmi.c +index 45be8aa724f3a..8313bd517e4cf 100644 +--- a/drivers/phy/mediatek/phy-mtk-hdmi.c ++++ b/drivers/phy/mediatek/phy-mtk-hdmi.c +@@ -201,6 +201,7 @@ static const struct of_device_id mtk_hdmi_phy_match[] = { + }, + {}, + }; ++MODULE_DEVICE_TABLE(of, mtk_hdmi_phy_match); + + static struct platform_driver mtk_hdmi_phy_driver = { + .probe = mtk_hdmi_phy_probe, +diff --git a/drivers/phy/mediatek/phy-mtk-mipi-dsi.c b/drivers/phy/mediatek/phy-mtk-mipi-dsi.c +index 18c481251f04a..9c7815bb90005 100644 +--- a/drivers/phy/mediatek/phy-mtk-mipi-dsi.c ++++ b/drivers/phy/mediatek/phy-mtk-mipi-dsi.c +@@ -233,6 +233,7 @@ static const struct of_device_id mtk_mipi_tx_match[] = { + .data = &mt8183_mipitx_data }, + { }, + }; ++MODULE_DEVICE_TABLE(of, mtk_mipi_tx_match); + + struct platform_driver mtk_mipi_tx_driver = { + .probe = mtk_mipi_tx_probe, +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index 4e668aafbcca0..1851015299b3a 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -3338,125 +3338,125 @@ int iscsi_session_get_param(struct iscsi_cls_session *cls_session, + + switch(param) { + case ISCSI_PARAM_FAST_ABORT: +- len = sprintf(buf, "%d\n", session->fast_abort); ++ len = sysfs_emit(buf, "%d\n", session->fast_abort); + break; + case ISCSI_PARAM_ABORT_TMO: +- len = sprintf(buf, "%d\n", session->abort_timeout); ++ len = sysfs_emit(buf, "%d\n", session->abort_timeout); + break; + case ISCSI_PARAM_LU_RESET_TMO: +- len = sprintf(buf, "%d\n", session->lu_reset_timeout); ++ len = sysfs_emit(buf, "%d\n", session->lu_reset_timeout); + break; + case ISCSI_PARAM_TGT_RESET_TMO: +- len = sprintf(buf, "%d\n", session->tgt_reset_timeout); ++ len = sysfs_emit(buf, "%d\n", session->tgt_reset_timeout); + break; + case ISCSI_PARAM_INITIAL_R2T_EN: +- len = sprintf(buf, "%d\n", session->initial_r2t_en); ++ len = sysfs_emit(buf, "%d\n", session->initial_r2t_en); + break; + case ISCSI_PARAM_MAX_R2T: +- len = sprintf(buf, "%hu\n", session->max_r2t); ++ len = sysfs_emit(buf, "%hu\n", session->max_r2t); + break; + case ISCSI_PARAM_IMM_DATA_EN: +- len = sprintf(buf, "%d\n", session->imm_data_en); ++ len = sysfs_emit(buf, "%d\n", session->imm_data_en); + break; + case ISCSI_PARAM_FIRST_BURST: +- len = sprintf(buf, "%u\n", session->first_burst); ++ len = sysfs_emit(buf, "%u\n", session->first_burst); + break; + case ISCSI_PARAM_MAX_BURST: +- len = sprintf(buf, "%u\n", session->max_burst); ++ len = sysfs_emit(buf, "%u\n", session->max_burst); + break; + case ISCSI_PARAM_PDU_INORDER_EN: +- len = sprintf(buf, "%d\n", session->pdu_inorder_en); ++ len = sysfs_emit(buf, "%d\n", session->pdu_inorder_en); + break; + case ISCSI_PARAM_DATASEQ_INORDER_EN: +- len = sprintf(buf, "%d\n", session->dataseq_inorder_en); ++ len = sysfs_emit(buf, "%d\n", session->dataseq_inorder_en); + break; + case ISCSI_PARAM_DEF_TASKMGMT_TMO: +- len = sprintf(buf, "%d\n", session->def_taskmgmt_tmo); ++ len = sysfs_emit(buf, "%d\n", session->def_taskmgmt_tmo); + break; + case ISCSI_PARAM_ERL: +- len = sprintf(buf, "%d\n", session->erl); ++ len = sysfs_emit(buf, "%d\n", session->erl); + break; + case ISCSI_PARAM_TARGET_NAME: +- len = sprintf(buf, "%s\n", session->targetname); ++ len = sysfs_emit(buf, "%s\n", session->targetname); + break; + case ISCSI_PARAM_TARGET_ALIAS: +- len = sprintf(buf, "%s\n", session->targetalias); ++ len = sysfs_emit(buf, "%s\n", session->targetalias); + break; + case ISCSI_PARAM_TPGT: +- len = sprintf(buf, "%d\n", session->tpgt); ++ len = sysfs_emit(buf, "%d\n", session->tpgt); + break; + case ISCSI_PARAM_USERNAME: +- len = sprintf(buf, "%s\n", session->username); ++ len = sysfs_emit(buf, "%s\n", session->username); + break; + case ISCSI_PARAM_USERNAME_IN: +- len = sprintf(buf, "%s\n", session->username_in); ++ len = sysfs_emit(buf, "%s\n", session->username_in); + break; + case ISCSI_PARAM_PASSWORD: +- len = sprintf(buf, "%s\n", session->password); ++ len = sysfs_emit(buf, "%s\n", session->password); + break; + case ISCSI_PARAM_PASSWORD_IN: +- len = sprintf(buf, "%s\n", session->password_in); ++ len = sysfs_emit(buf, "%s\n", session->password_in); + break; + case ISCSI_PARAM_IFACE_NAME: +- len = sprintf(buf, "%s\n", session->ifacename); ++ len = sysfs_emit(buf, "%s\n", session->ifacename); + break; + case ISCSI_PARAM_INITIATOR_NAME: +- len = sprintf(buf, "%s\n", session->initiatorname); ++ len = sysfs_emit(buf, "%s\n", session->initiatorname); + break; + case ISCSI_PARAM_BOOT_ROOT: +- len = sprintf(buf, "%s\n", session->boot_root); ++ len = sysfs_emit(buf, "%s\n", session->boot_root); + break; + case ISCSI_PARAM_BOOT_NIC: +- len = sprintf(buf, "%s\n", session->boot_nic); ++ len = sysfs_emit(buf, "%s\n", session->boot_nic); + break; + case ISCSI_PARAM_BOOT_TARGET: +- len = sprintf(buf, "%s\n", session->boot_target); ++ len = sysfs_emit(buf, "%s\n", session->boot_target); + break; + case ISCSI_PARAM_AUTO_SND_TGT_DISABLE: +- len = sprintf(buf, "%u\n", session->auto_snd_tgt_disable); ++ len = sysfs_emit(buf, "%u\n", session->auto_snd_tgt_disable); + break; + case ISCSI_PARAM_DISCOVERY_SESS: +- len = sprintf(buf, "%u\n", session->discovery_sess); ++ len = sysfs_emit(buf, "%u\n", session->discovery_sess); + break; + case ISCSI_PARAM_PORTAL_TYPE: +- len = sprintf(buf, "%s\n", session->portal_type); ++ len = sysfs_emit(buf, "%s\n", session->portal_type); + break; + case ISCSI_PARAM_CHAP_AUTH_EN: +- len = sprintf(buf, "%u\n", session->chap_auth_en); ++ len = sysfs_emit(buf, "%u\n", session->chap_auth_en); + break; + case ISCSI_PARAM_DISCOVERY_LOGOUT_EN: +- len = sprintf(buf, "%u\n", session->discovery_logout_en); ++ len = sysfs_emit(buf, "%u\n", session->discovery_logout_en); + break; + case ISCSI_PARAM_BIDI_CHAP_EN: +- len = sprintf(buf, "%u\n", session->bidi_chap_en); ++ len = sysfs_emit(buf, "%u\n", session->bidi_chap_en); + break; + case ISCSI_PARAM_DISCOVERY_AUTH_OPTIONAL: +- len = sprintf(buf, "%u\n", session->discovery_auth_optional); ++ len = sysfs_emit(buf, "%u\n", session->discovery_auth_optional); + break; + case ISCSI_PARAM_DEF_TIME2WAIT: +- len = sprintf(buf, "%d\n", session->time2wait); ++ len = sysfs_emit(buf, "%d\n", session->time2wait); + break; + case ISCSI_PARAM_DEF_TIME2RETAIN: +- len = sprintf(buf, "%d\n", session->time2retain); ++ len = sysfs_emit(buf, "%d\n", session->time2retain); + break; + case ISCSI_PARAM_TSID: +- len = sprintf(buf, "%u\n", session->tsid); ++ len = sysfs_emit(buf, "%u\n", session->tsid); + break; + case ISCSI_PARAM_ISID: +- len = sprintf(buf, "%02x%02x%02x%02x%02x%02x\n", ++ len = sysfs_emit(buf, "%02x%02x%02x%02x%02x%02x\n", + session->isid[0], session->isid[1], + session->isid[2], session->isid[3], + session->isid[4], session->isid[5]); + break; + case ISCSI_PARAM_DISCOVERY_PARENT_IDX: +- len = sprintf(buf, "%u\n", session->discovery_parent_idx); ++ len = sysfs_emit(buf, "%u\n", session->discovery_parent_idx); + break; + case ISCSI_PARAM_DISCOVERY_PARENT_TYPE: + if (session->discovery_parent_type) +- len = sprintf(buf, "%s\n", ++ len = sysfs_emit(buf, "%s\n", + session->discovery_parent_type); + else +- len = sprintf(buf, "\n"); ++ len = sysfs_emit(buf, "\n"); + break; + default: + return -ENOSYS; +@@ -3488,16 +3488,16 @@ int iscsi_conn_get_addr_param(struct sockaddr_storage *addr, + case ISCSI_PARAM_CONN_ADDRESS: + case ISCSI_HOST_PARAM_IPADDRESS: + if (sin) +- len = sprintf(buf, "%pI4\n", &sin->sin_addr.s_addr); ++ len = sysfs_emit(buf, "%pI4\n", &sin->sin_addr.s_addr); + else +- len = sprintf(buf, "%pI6\n", &sin6->sin6_addr); ++ len = sysfs_emit(buf, "%pI6\n", &sin6->sin6_addr); + break; + case ISCSI_PARAM_CONN_PORT: + case ISCSI_PARAM_LOCAL_PORT: + if (sin) +- len = sprintf(buf, "%hu\n", be16_to_cpu(sin->sin_port)); ++ len = sysfs_emit(buf, "%hu\n", be16_to_cpu(sin->sin_port)); + else +- len = sprintf(buf, "%hu\n", ++ len = sysfs_emit(buf, "%hu\n", + be16_to_cpu(sin6->sin6_port)); + break; + default: +@@ -3516,88 +3516,88 @@ int iscsi_conn_get_param(struct iscsi_cls_conn *cls_conn, + + switch(param) { + case ISCSI_PARAM_PING_TMO: +- len = sprintf(buf, "%u\n", conn->ping_timeout); ++ len = sysfs_emit(buf, "%u\n", conn->ping_timeout); + break; + case ISCSI_PARAM_RECV_TMO: +- len = sprintf(buf, "%u\n", conn->recv_timeout); ++ len = sysfs_emit(buf, "%u\n", conn->recv_timeout); + break; + case ISCSI_PARAM_MAX_RECV_DLENGTH: +- len = sprintf(buf, "%u\n", conn->max_recv_dlength); ++ len = sysfs_emit(buf, "%u\n", conn->max_recv_dlength); + break; + case ISCSI_PARAM_MAX_XMIT_DLENGTH: +- len = sprintf(buf, "%u\n", conn->max_xmit_dlength); ++ len = sysfs_emit(buf, "%u\n", conn->max_xmit_dlength); + break; + case ISCSI_PARAM_HDRDGST_EN: +- len = sprintf(buf, "%d\n", conn->hdrdgst_en); ++ len = sysfs_emit(buf, "%d\n", conn->hdrdgst_en); + break; + case ISCSI_PARAM_DATADGST_EN: +- len = sprintf(buf, "%d\n", conn->datadgst_en); ++ len = sysfs_emit(buf, "%d\n", conn->datadgst_en); + break; + case ISCSI_PARAM_IFMARKER_EN: +- len = sprintf(buf, "%d\n", conn->ifmarker_en); ++ len = sysfs_emit(buf, "%d\n", conn->ifmarker_en); + break; + case ISCSI_PARAM_OFMARKER_EN: +- len = sprintf(buf, "%d\n", conn->ofmarker_en); ++ len = sysfs_emit(buf, "%d\n", conn->ofmarker_en); + break; + case ISCSI_PARAM_EXP_STATSN: +- len = sprintf(buf, "%u\n", conn->exp_statsn); ++ len = sysfs_emit(buf, "%u\n", conn->exp_statsn); + break; + case ISCSI_PARAM_PERSISTENT_PORT: +- len = sprintf(buf, "%d\n", conn->persistent_port); ++ len = sysfs_emit(buf, "%d\n", conn->persistent_port); + break; + case ISCSI_PARAM_PERSISTENT_ADDRESS: +- len = sprintf(buf, "%s\n", conn->persistent_address); ++ len = sysfs_emit(buf, "%s\n", conn->persistent_address); + break; + case ISCSI_PARAM_STATSN: +- len = sprintf(buf, "%u\n", conn->statsn); ++ len = sysfs_emit(buf, "%u\n", conn->statsn); + break; + case ISCSI_PARAM_MAX_SEGMENT_SIZE: +- len = sprintf(buf, "%u\n", conn->max_segment_size); ++ len = sysfs_emit(buf, "%u\n", conn->max_segment_size); + break; + case ISCSI_PARAM_KEEPALIVE_TMO: +- len = sprintf(buf, "%u\n", conn->keepalive_tmo); ++ len = sysfs_emit(buf, "%u\n", conn->keepalive_tmo); + break; + case ISCSI_PARAM_LOCAL_PORT: +- len = sprintf(buf, "%u\n", conn->local_port); ++ len = sysfs_emit(buf, "%u\n", conn->local_port); + break; + case ISCSI_PARAM_TCP_TIMESTAMP_STAT: +- len = sprintf(buf, "%u\n", conn->tcp_timestamp_stat); ++ len = sysfs_emit(buf, "%u\n", conn->tcp_timestamp_stat); + break; + case ISCSI_PARAM_TCP_NAGLE_DISABLE: +- len = sprintf(buf, "%u\n", conn->tcp_nagle_disable); ++ len = sysfs_emit(buf, "%u\n", conn->tcp_nagle_disable); + break; + case ISCSI_PARAM_TCP_WSF_DISABLE: +- len = sprintf(buf, "%u\n", conn->tcp_wsf_disable); ++ len = sysfs_emit(buf, "%u\n", conn->tcp_wsf_disable); + break; + case ISCSI_PARAM_TCP_TIMER_SCALE: +- len = sprintf(buf, "%u\n", conn->tcp_timer_scale); ++ len = sysfs_emit(buf, "%u\n", conn->tcp_timer_scale); + break; + case ISCSI_PARAM_TCP_TIMESTAMP_EN: +- len = sprintf(buf, "%u\n", conn->tcp_timestamp_en); ++ len = sysfs_emit(buf, "%u\n", conn->tcp_timestamp_en); + break; + case ISCSI_PARAM_IP_FRAGMENT_DISABLE: +- len = sprintf(buf, "%u\n", conn->fragment_disable); ++ len = sysfs_emit(buf, "%u\n", conn->fragment_disable); + break; + case ISCSI_PARAM_IPV4_TOS: +- len = sprintf(buf, "%u\n", conn->ipv4_tos); ++ len = sysfs_emit(buf, "%u\n", conn->ipv4_tos); + break; + case ISCSI_PARAM_IPV6_TC: +- len = sprintf(buf, "%u\n", conn->ipv6_traffic_class); ++ len = sysfs_emit(buf, "%u\n", conn->ipv6_traffic_class); + break; + case ISCSI_PARAM_IPV6_FLOW_LABEL: +- len = sprintf(buf, "%u\n", conn->ipv6_flow_label); ++ len = sysfs_emit(buf, "%u\n", conn->ipv6_flow_label); + break; + case ISCSI_PARAM_IS_FW_ASSIGNED_IPV6: +- len = sprintf(buf, "%u\n", conn->is_fw_assigned_ipv6); ++ len = sysfs_emit(buf, "%u\n", conn->is_fw_assigned_ipv6); + break; + case ISCSI_PARAM_TCP_XMIT_WSF: +- len = sprintf(buf, "%u\n", conn->tcp_xmit_wsf); ++ len = sysfs_emit(buf, "%u\n", conn->tcp_xmit_wsf); + break; + case ISCSI_PARAM_TCP_RECV_WSF: +- len = sprintf(buf, "%u\n", conn->tcp_recv_wsf); ++ len = sysfs_emit(buf, "%u\n", conn->tcp_recv_wsf); + break; + case ISCSI_PARAM_LOCAL_IPADDR: +- len = sprintf(buf, "%s\n", conn->local_ipaddr); ++ len = sysfs_emit(buf, "%s\n", conn->local_ipaddr); + break; + default: + return -ENOSYS; +@@ -3615,13 +3615,13 @@ int iscsi_host_get_param(struct Scsi_Host *shost, enum iscsi_host_param param, + + switch (param) { + case ISCSI_HOST_PARAM_NETDEV_NAME: +- len = sprintf(buf, "%s\n", ihost->netdev); ++ len = sysfs_emit(buf, "%s\n", ihost->netdev); + break; + case ISCSI_HOST_PARAM_HWADDRESS: +- len = sprintf(buf, "%s\n", ihost->hwaddress); ++ len = sysfs_emit(buf, "%s\n", ihost->hwaddress); + break; + case ISCSI_HOST_PARAM_INITIATOR_NAME: +- len = sprintf(buf, "%s\n", ihost->initiatorname); ++ len = sysfs_emit(buf, "%s\n", ihost->initiatorname); + break; + default: + return -ENOSYS; +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index 2e68c0a876986..c53c3f9fa526a 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -132,7 +132,11 @@ show_transport_handle(struct device *dev, struct device_attribute *attr, + char *buf) + { + struct iscsi_internal *priv = dev_to_iscsi_internal(dev); +- return sprintf(buf, "%llu\n", (unsigned long long)iscsi_handle(priv->iscsi_transport)); ++ ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EACCES; ++ return sysfs_emit(buf, "%llu\n", ++ (unsigned long long)iscsi_handle(priv->iscsi_transport)); + } + static DEVICE_ATTR(handle, S_IRUGO, show_transport_handle, NULL); + +@@ -142,7 +146,7 @@ show_transport_##name(struct device *dev, \ + struct device_attribute *attr,char *buf) \ + { \ + struct iscsi_internal *priv = dev_to_iscsi_internal(dev); \ +- return sprintf(buf, format"\n", priv->iscsi_transport->name); \ ++ return sysfs_emit(buf, format"\n", priv->iscsi_transport->name);\ + } \ + static DEVICE_ATTR(name, S_IRUGO, show_transport_##name, NULL); + +@@ -183,7 +187,7 @@ static ssize_t + show_ep_handle(struct device *dev, struct device_attribute *attr, char *buf) + { + struct iscsi_endpoint *ep = iscsi_dev_to_endpoint(dev); +- return sprintf(buf, "%llu\n", (unsigned long long) ep->id); ++ return sysfs_emit(buf, "%llu\n", (unsigned long long) ep->id); + } + static ISCSI_ATTR(ep, handle, S_IRUGO, show_ep_handle, NULL); + +@@ -2883,6 +2887,9 @@ iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev) + struct iscsi_cls_session *session; + int err = 0, value = 0; + ++ if (ev->u.set_param.len > PAGE_SIZE) ++ return -EINVAL; ++ + session = iscsi_session_lookup(ev->u.set_param.sid); + conn = iscsi_conn_lookup(ev->u.set_param.sid, ev->u.set_param.cid); + if (!conn || !session) +@@ -3030,6 +3037,9 @@ iscsi_set_host_param(struct iscsi_transport *transport, + if (!transport->set_host_param) + return -ENOSYS; + ++ if (ev->u.set_host_param.len > PAGE_SIZE) ++ return -EINVAL; ++ + shost = scsi_host_lookup(ev->u.set_host_param.host_no); + if (!shost) { + printk(KERN_ERR "set_host_param could not find host no %u\n", +@@ -3617,6 +3627,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + { + int err = 0; + u32 portid; ++ u32 pdu_len; + struct iscsi_uevent *ev = nlmsg_data(nlh); + struct iscsi_transport *transport = NULL; + struct iscsi_internal *priv; +@@ -3624,6 +3635,9 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + struct iscsi_cls_conn *conn; + struct iscsi_endpoint *ep = NULL; + ++ if (!netlink_capable(skb, CAP_SYS_ADMIN)) ++ return -EPERM; ++ + if (nlh->nlmsg_type == ISCSI_UEVENT_PATH_UPDATE) + *group = ISCSI_NL_GRP_UIP; + else +@@ -3756,6 +3770,14 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + err = -EINVAL; + break; + case ISCSI_UEVENT_SEND_PDU: ++ pdu_len = nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev); ++ ++ if ((ev->u.send_pdu.hdr_size > pdu_len) || ++ (ev->u.send_pdu.data_size > (pdu_len - ev->u.send_pdu.hdr_size))) { ++ err = -EINVAL; ++ break; ++ } ++ + conn = iscsi_conn_lookup(ev->u.send_pdu.sid, ev->u.send_pdu.cid); + if (conn) { + mutex_lock(&conn_mutex); +@@ -3960,7 +3982,7 @@ static ssize_t show_conn_state(struct device *dev, + conn->state < ARRAY_SIZE(connection_state_names)) + state = connection_state_names[conn->state]; + +- return sprintf(buf, "%s\n", state); ++ return sysfs_emit(buf, "%s\n", state); + } + static ISCSI_CLASS_ATTR(conn, state, S_IRUGO, show_conn_state, + NULL); +@@ -4188,7 +4210,7 @@ show_priv_session_state(struct device *dev, struct device_attribute *attr, + char *buf) + { + struct iscsi_cls_session *session = iscsi_dev_to_session(dev->parent); +- return sprintf(buf, "%s\n", iscsi_session_state_name(session->state)); ++ return sysfs_emit(buf, "%s\n", iscsi_session_state_name(session->state)); + } + static ISCSI_CLASS_ATTR(priv_sess, state, S_IRUGO, show_priv_session_state, + NULL); +@@ -4197,7 +4219,7 @@ show_priv_session_creator(struct device *dev, struct device_attribute *attr, + char *buf) + { + struct iscsi_cls_session *session = iscsi_dev_to_session(dev->parent); +- return sprintf(buf, "%d\n", session->creator); ++ return sysfs_emit(buf, "%d\n", session->creator); + } + static ISCSI_CLASS_ATTR(priv_sess, creator, S_IRUGO, show_priv_session_creator, + NULL); +@@ -4206,7 +4228,7 @@ show_priv_session_target_id(struct device *dev, struct device_attribute *attr, + char *buf) + { + struct iscsi_cls_session *session = iscsi_dev_to_session(dev->parent); +- return sprintf(buf, "%d\n", session->target_id); ++ return sysfs_emit(buf, "%d\n", session->target_id); + } + static ISCSI_CLASS_ATTR(priv_sess, target_id, S_IRUGO, + show_priv_session_target_id, NULL); +@@ -4219,8 +4241,8 @@ show_priv_session_##field(struct device *dev, \ + struct iscsi_cls_session *session = \ + iscsi_dev_to_session(dev->parent); \ + if (session->field == -1) \ +- return sprintf(buf, "off\n"); \ +- return sprintf(buf, format"\n", session->field); \ ++ return sysfs_emit(buf, "off\n"); \ ++ return sysfs_emit(buf, format"\n", session->field); \ + } + + #define iscsi_priv_session_attr_store(field) \ +diff --git a/drivers/staging/fwserial/fwserial.c b/drivers/staging/fwserial/fwserial.c +index db83d34cd6779..c368082aae1aa 100644 +--- a/drivers/staging/fwserial/fwserial.c ++++ b/drivers/staging/fwserial/fwserial.c +@@ -2189,6 +2189,7 @@ static int fwserial_create(struct fw_unit *unit) + err = fw_core_add_address_handler(&port->rx_handler, + &fw_high_memory_region); + if (err) { ++ tty_port_destroy(&port->port); + kfree(port); + goto free_ports; + } +@@ -2271,6 +2272,7 @@ unregister_ttys: + + free_ports: + for (--i; i >= 0; --i) { ++ fw_core_remove_address_handler(&serial->ports[i]->rx_handler); + tty_port_destroy(&serial->ports[i]->port); + kfree(serial->ports[i]); + } +diff --git a/drivers/staging/most/sound/sound.c b/drivers/staging/most/sound/sound.c +index 3a1a590580427..45befb8c11268 100644 +--- a/drivers/staging/most/sound/sound.c ++++ b/drivers/staging/most/sound/sound.c +@@ -86,6 +86,8 @@ static void swap_copy24(u8 *dest, const u8 *source, unsigned int bytes) + { + unsigned int i = 0; + ++ if (bytes < 2) ++ return; + while (i < bytes - 2) { + dest[i] = source[i + 2]; + dest[i + 1] = source[i + 1]; +diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c +index 4c2cae99776b9..3703409715dab 100644 +--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c ++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c +@@ -224,7 +224,7 @@ int snd_bcm2835_new_ctl(struct bcm2835_chip *chip) + { + int err; + +- strcpy(chip->card->mixername, "Broadcom Mixer"); ++ strscpy(chip->card->mixername, "Broadcom Mixer", sizeof(chip->card->mixername)); + err = create_ctls(chip, ARRAY_SIZE(snd_bcm2835_ctl), snd_bcm2835_ctl); + if (err < 0) + return err; +@@ -261,7 +261,7 @@ static const struct snd_kcontrol_new snd_bcm2835_headphones_ctl[] = { + + int snd_bcm2835_new_headphones_ctl(struct bcm2835_chip *chip) + { +- strcpy(chip->card->mixername, "Broadcom Mixer"); ++ strscpy(chip->card->mixername, "Broadcom Mixer", sizeof(chip->card->mixername)); + return create_ctls(chip, ARRAY_SIZE(snd_bcm2835_headphones_ctl), + snd_bcm2835_headphones_ctl); + } +@@ -295,7 +295,7 @@ static const struct snd_kcontrol_new snd_bcm2835_hdmi[] = { + + int snd_bcm2835_new_hdmi_ctl(struct bcm2835_chip *chip) + { +- strcpy(chip->card->mixername, "Broadcom Mixer"); ++ strscpy(chip->card->mixername, "Broadcom Mixer", sizeof(chip->card->mixername)); + return create_ctls(chip, ARRAY_SIZE(snd_bcm2835_hdmi), + snd_bcm2835_hdmi); + } +diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c +index f783b632141b5..096f2c54258aa 100644 +--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c ++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c +@@ -334,7 +334,7 @@ int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, const char *name, + + pcm->private_data = chip; + pcm->nonatomic = true; +- strcpy(pcm->name, name); ++ strscpy(pcm->name, name, sizeof(pcm->name)); + if (!spdif) { + chip->dest = route; + chip->volume = 0; +diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c +index cf5f80f5ca6b0..c250fbef2fa3d 100644 +--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c ++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c +@@ -185,9 +185,9 @@ static int snd_add_child_device(struct device *dev, + goto error; + } + +- strcpy(card->driver, audio_driver->driver.name); +- strcpy(card->shortname, audio_driver->shortname); +- strcpy(card->longname, audio_driver->longname); ++ strscpy(card->driver, audio_driver->driver.name, sizeof(card->driver)); ++ strscpy(card->shortname, audio_driver->shortname, sizeof(card->shortname)); ++ strscpy(card->longname, audio_driver->longname, sizeof(card->longname)); + + err = audio_driver->newpcm(chip, audio_driver->shortname, + audio_driver->route, +diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c +index 0bd32ae8a269d..dce33405ecdb1 100644 +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -1945,31 +1945,27 @@ static inline int input_available_p(struct tty_struct *tty, int poll) + * Helper function to speed up n_tty_read. It is only called when + * ICANON is off; it copies characters straight from the tty queue. + * +- * It can be profitably called twice; once to drain the space from +- * the tail pointer to the (physical) end of the buffer, and once +- * to drain the space from the (physical) beginning of the buffer +- * to head pointer. +- * + * Called under the ldata->atomic_read_lock sem + * ++ * Returns true if it successfully copied data, but there is still ++ * more data to be had. ++ * + * n_tty_read()/consumer path: + * caller holds non-exclusive termios_rwsem + * read_tail published + */ + +-static int copy_from_read_buf(struct tty_struct *tty, ++static bool copy_from_read_buf(struct tty_struct *tty, + unsigned char **kbp, + size_t *nr) + + { + struct n_tty_data *ldata = tty->disc_data; +- int retval; + size_t n; + bool is_eof; + size_t head = smp_load_acquire(&ldata->commit_head); + size_t tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1); + +- retval = 0; + n = min(head - ldata->read_tail, N_TTY_BUF_SIZE - tail); + n = min(*nr, n); + if (n) { +@@ -1982,11 +1978,14 @@ static int copy_from_read_buf(struct tty_struct *tty, + /* Turn single EOF into zero-length read */ + if (L_EXTPROC(tty) && ldata->icanon && is_eof && + (head == ldata->read_tail)) +- n = 0; ++ return false; + *kbp += n; + *nr -= n; ++ ++ /* If we have more to copy, let the caller know */ ++ return head != ldata->read_tail; + } +- return retval; ++ return false; + } + + /** +@@ -2012,21 +2011,22 @@ static int copy_from_read_buf(struct tty_struct *tty, + * read_tail published + */ + +-static int canon_copy_from_read_buf(struct tty_struct *tty, +- unsigned char **kbp, +- size_t *nr) ++static bool canon_copy_from_read_buf(struct tty_struct *tty, ++ unsigned char **kbp, ++ size_t *nr) + { + struct n_tty_data *ldata = tty->disc_data; + size_t n, size, more, c; + size_t eol; +- size_t tail; ++ size_t tail, canon_head; + int found = 0; + + /* N.B. avoid overrun if nr == 0 */ + if (!*nr) +- return 0; ++ return false; + +- n = min(*nr + 1, smp_load_acquire(&ldata->canon_head) - ldata->read_tail); ++ canon_head = smp_load_acquire(&ldata->canon_head); ++ n = min(*nr + 1, canon_head - ldata->read_tail); + + tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1); + size = min_t(size_t, tail + n, N_TTY_BUF_SIZE); +@@ -2070,8 +2070,11 @@ static int canon_copy_from_read_buf(struct tty_struct *tty, + else + ldata->push = 0; + tty_audit_push(); ++ return false; + } +- return 0; ++ ++ /* No EOL found - do a continuation retry if there is more data */ ++ return ldata->read_tail != canon_head; + } + + /** +@@ -2135,6 +2138,30 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file, + int packet; + size_t tail; + ++ /* ++ * Is this a continuation of a read started earler? ++ * ++ * If so, we still hold the atomic_read_lock and the ++ * termios_rwsem, and can just continue to copy data. ++ */ ++ if (*cookie) { ++ if (ldata->icanon && !L_EXTPROC(tty)) { ++ if (canon_copy_from_read_buf(tty, &kb, &nr)) ++ return kb - kbuf; ++ } else { ++ if (copy_from_read_buf(tty, &kb, &nr)) ++ return kb - kbuf; ++ } ++ ++ /* No more data - release locks and stop retries */ ++ n_tty_kick_worker(tty); ++ n_tty_check_unthrottle(tty); ++ up_read(&tty->termios_rwsem); ++ mutex_unlock(&ldata->atomic_read_lock); ++ *cookie = NULL; ++ return kb - kbuf; ++ } ++ + c = job_control(tty, file); + if (c < 0) + return c; +@@ -2221,23 +2248,29 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file, + } + + if (ldata->icanon && !L_EXTPROC(tty)) { +- retval = canon_copy_from_read_buf(tty, &kb, &nr); +- if (retval) +- break; ++ if (canon_copy_from_read_buf(tty, &kb, &nr)) ++ goto more_to_be_read; + } else { +- int uncopied; +- + /* Deal with packet mode. */ + if (packet && kb == kbuf) { + *kb++ = TIOCPKT_DATA; + nr--; + } + +- uncopied = copy_from_read_buf(tty, &kb, &nr); +- uncopied += copy_from_read_buf(tty, &kb, &nr); +- if (uncopied) { +- retval = -EFAULT; +- break; ++ /* ++ * Copy data, and if there is more to be had ++ * and we have nothing more to wait for, then ++ * let's mark us for retries. ++ * ++ * NOTE! We return here with both the termios_sem ++ * and atomic_read_lock still held, the retries ++ * will release them when done. ++ */ ++ if (copy_from_read_buf(tty, &kb, &nr) && kb - kbuf >= minimum) { ++more_to_be_read: ++ remove_wait_queue(&tty->read_wait, &wait); ++ *cookie = cookie; ++ return kb - kbuf; + } + } + +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index 623738d8e32c8..5fd87941ac712 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -429,8 +429,7 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line) + EXPORT_SYMBOL_GPL(tty_find_polling_driver); + #endif + +-static ssize_t hung_up_tty_read(struct file *file, char __user *buf, +- size_t count, loff_t *ppos) ++static ssize_t hung_up_tty_read(struct kiocb *iocb, struct iov_iter *to) + { + return 0; + } +@@ -502,7 +501,7 @@ static const struct file_operations console_fops = { + + static const struct file_operations hung_up_tty_fops = { + .llseek = no_llseek, +- .read = hung_up_tty_read, ++ .read_iter = hung_up_tty_read, + .write_iter = hung_up_tty_write, + .poll = hung_up_tty_poll, + .unlocked_ioctl = hung_up_tty_ioctl, +@@ -859,13 +858,20 @@ static int iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty, + if (!size) + break; + +- /* +- * A ldisc read error return will override any previously copied +- * data (eg -EOVERFLOW from HDLC) +- */ + if (size < 0) { +- memzero_explicit(kernel_buf, sizeof(kernel_buf)); +- return size; ++ /* Did we have an earlier error (ie -EFAULT)? */ ++ if (retval) ++ break; ++ retval = size; ++ ++ /* ++ * -EOVERFLOW means we didn't have enough space ++ * for a whole packet, and we shouldn't return ++ * a partial result. ++ */ ++ if (retval == -EOVERFLOW) ++ offset = 0; ++ break; + } + + copied = copy_to_iter(kernel_buf, size, to); +@@ -921,8 +927,10 @@ static ssize_t tty_read(struct kiocb *iocb, struct iov_iter *to) + /* We want to wait for the line discipline to sort out in this + situation */ + ld = tty_ldisc_ref_wait(tty); ++ if (!ld) ++ return hung_up_tty_read(iocb, to); + i = -EIO; +- if (ld && ld->ops->read) ++ if (ld->ops->read) + i = iterate_tty_read(ld, tty, file, to); + tty_ldisc_deref(ld); + +diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c +index f7d015c67963d..d815ac98b39e3 100644 +--- a/drivers/tty/vt/consolemap.c ++++ b/drivers/tty/vt/consolemap.c +@@ -495,7 +495,7 @@ con_insert_unipair(struct uni_pagedir *p, u_short unicode, u_short fontpos) + + p2[unicode & 0x3f] = fontpos; + +- p->sum += (fontpos << 20) + unicode; ++ p->sum += (fontpos << 20U) + unicode; + + return 0; + } +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index 78bd28873945a..3dca6aab0f1f8 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -431,9 +432,11 @@ static int follow_fault_pfn(struct vm_area_struct *vma, struct mm_struct *mm, + unsigned long vaddr, unsigned long *pfn, + bool write_fault) + { ++ pte_t *ptep; ++ spinlock_t *ptl; + int ret; + +- ret = follow_pfn(vma, vaddr, pfn); ++ ret = follow_pte(vma->vm_mm, vaddr, &ptep, &ptl); + if (ret) { + bool unlocked = false; + +@@ -447,9 +450,17 @@ static int follow_fault_pfn(struct vm_area_struct *vma, struct mm_struct *mm, + if (ret) + return ret; + +- ret = follow_pfn(vma, vaddr, pfn); ++ ret = follow_pte(vma->vm_mm, vaddr, &ptep, &ptl); ++ if (ret) ++ return ret; + } + ++ if (write_fault && !pte_write(*ptep)) ++ ret = -EFAULT; ++ else ++ *pfn = pte_pfn(*ptep); ++ ++ pte_unmap_unlock(ptep, ptl); + return ret; + } + +diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c +index f9b3c1cb9530f..b9cdd02c10009 100644 +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -1017,6 +1017,7 @@ static void dlfb_ops_destroy(struct fb_info *info) + } + vfree(dlfb->backing_buffer); + kfree(dlfb->edid); ++ dlfb_free_urb_list(dlfb); + usb_put_dev(dlfb->udev); + kfree(dlfb); + +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index 6af7f2bf92de7..fbf93067642ac 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -1319,7 +1319,6 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans) + struct btrfs_root *gang[8]; + int i; + int ret; +- int err = 0; + + spin_lock(&fs_info->fs_roots_radix_lock); + while (1) { +@@ -1331,6 +1330,8 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans) + break; + for (i = 0; i < ret; i++) { + struct btrfs_root *root = gang[i]; ++ int ret2; ++ + radix_tree_tag_clear(&fs_info->fs_roots_radix, + (unsigned long)root->root_key.objectid, + BTRFS_ROOT_TRANS_TAG); +@@ -1350,17 +1351,17 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans) + root->node); + } + +- err = btrfs_update_root(trans, fs_info->tree_root, ++ ret2 = btrfs_update_root(trans, fs_info->tree_root, + &root->root_key, + &root->root_item); ++ if (ret2) ++ return ret2; + spin_lock(&fs_info->fs_roots_radix_lock); +- if (err) +- break; + btrfs_qgroup_free_meta_all_pertrans(root); + } + } + spin_unlock(&fs_info->fs_roots_radix_lock); +- return err; ++ return 0; + } + + /* +diff --git a/fs/erofs/super.c b/fs/erofs/super.c +index be10b16ea66ee..d5a6b9b888a56 100644 +--- a/fs/erofs/super.c ++++ b/fs/erofs/super.c +@@ -158,8 +158,8 @@ static int erofs_read_superblock(struct super_block *sb) + blkszbits = dsb->blkszbits; + /* 9(512 bytes) + LOG_SECTORS_PER_BLOCK == LOG_BLOCK_SIZE */ + if (blkszbits != LOG_BLOCK_SIZE) { +- erofs_err(sb, "blksize %u isn't supported on this platform", +- 1 << blkszbits); ++ erofs_err(sb, "blkszbits %u isn't supported on this platform", ++ blkszbits); + goto out; + } + +diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c +index 6edb1ab579a18..8878049685769 100644 +--- a/fs/f2fs/namei.c ++++ b/fs/f2fs/namei.c +@@ -855,7 +855,11 @@ static int __f2fs_tmpfile(struct inode *dir, struct dentry *dentry, + + if (whiteout) { + f2fs_i_links_write(inode, false); ++ ++ spin_lock(&inode->i_lock); + inode->i_state |= I_LINKABLE; ++ spin_unlock(&inode->i_lock); ++ + *whiteout = inode; + } else { + d_tmpfile(dentry, inode); +@@ -1041,7 +1045,11 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, + err = f2fs_add_link(old_dentry, whiteout); + if (err) + goto put_out_dir; ++ ++ spin_lock(&whiteout->i_lock); + whiteout->i_state &= ~I_LINKABLE; ++ spin_unlock(&whiteout->i_lock); ++ + iput(whiteout); + } + +diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h +index e81eb0748e2a9..229814b4f4a6c 100644 +--- a/fs/f2fs/segment.h ++++ b/fs/f2fs/segment.h +@@ -101,11 +101,11 @@ static inline void sanity_check_seg_type(struct f2fs_sb_info *sbi, + #define BLKS_PER_SEC(sbi) \ + ((sbi)->segs_per_sec * (sbi)->blocks_per_seg) + #define GET_SEC_FROM_SEG(sbi, segno) \ +- ((segno) / (sbi)->segs_per_sec) ++ (((segno) == -1) ? -1: (segno) / (sbi)->segs_per_sec) + #define GET_SEG_FROM_SEC(sbi, secno) \ + ((secno) * (sbi)->segs_per_sec) + #define GET_ZONE_FROM_SEC(sbi, secno) \ +- ((secno) / (sbi)->secs_per_zone) ++ (((secno) == -1) ? -1: (secno) / (sbi)->secs_per_zone) + #define GET_ZONE_FROM_SEG(sbi, segno) \ + GET_ZONE_FROM_SEC(sbi, GET_SEC_FROM_SEG(sbi, segno)) + +diff --git a/fs/jfs/jfs_filsys.h b/fs/jfs/jfs_filsys.h +index 1e899298f7f00..b5d702df7111a 100644 +--- a/fs/jfs/jfs_filsys.h ++++ b/fs/jfs/jfs_filsys.h +@@ -268,5 +268,6 @@ + * fsck() must be run to repair + */ + #define FM_EXTENDFS 0x00000008 /* file system extendfs() in progress */ ++#define FM_STATE_MAX 0x0000000f /* max value of s_state */ + + #endif /* _H_JFS_FILSYS */ +diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c +index 2935d4c776ec7..5d7d7170c03c0 100644 +--- a/fs/jfs/jfs_mount.c ++++ b/fs/jfs/jfs_mount.c +@@ -37,6 +37,7 @@ + #include + #include + #include ++#include + + #include "jfs_incore.h" + #include "jfs_filsys.h" +@@ -366,6 +367,15 @@ static int chkSuper(struct super_block *sb) + sbi->bsize = bsize; + sbi->l2bsize = le16_to_cpu(j_sb->s_l2bsize); + ++ /* check some fields for possible corruption */ ++ if (sbi->l2bsize != ilog2((u32)bsize) || ++ j_sb->pad != 0 || ++ le32_to_cpu(j_sb->s_state) > FM_STATE_MAX) { ++ rc = -EINVAL; ++ jfs_err("jfs_mount: Mount Failure: superblock is corrupt!"); ++ goto out; ++ } ++ + /* + * For now, ignore s_pbsize, l2bfactor. All I/O going through buffer + * cache. +diff --git a/fs/namei.c b/fs/namei.c +index 78443a85480a5..dd85e12ac85a6 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -669,17 +669,17 @@ static bool legitimize_root(struct nameidata *nd) + */ + + /** +- * unlazy_walk - try to switch to ref-walk mode. ++ * try_to_unlazy - try to switch to ref-walk mode. + * @nd: nameidata pathwalk data +- * Returns: 0 on success, -ECHILD on failure ++ * Returns: true on success, false on failure + * +- * unlazy_walk attempts to legitimize the current nd->path and nd->root ++ * try_to_unlazy attempts to legitimize the current nd->path and nd->root + * for ref-walk mode. + * Must be called from rcu-walk context. +- * Nothing should touch nameidata between unlazy_walk() failure and ++ * Nothing should touch nameidata between try_to_unlazy() failure and + * terminate_walk(). + */ +-static int unlazy_walk(struct nameidata *nd) ++static bool try_to_unlazy(struct nameidata *nd) + { + struct dentry *parent = nd->path.dentry; + +@@ -694,14 +694,14 @@ static int unlazy_walk(struct nameidata *nd) + goto out; + rcu_read_unlock(); + BUG_ON(nd->inode != parent->d_inode); +- return 0; ++ return true; + + out1: + nd->path.mnt = NULL; + nd->path.dentry = NULL; + out: + rcu_read_unlock(); +- return -ECHILD; ++ return false; + } + + /** +@@ -792,7 +792,7 @@ static int complete_walk(struct nameidata *nd) + */ + if (!(nd->flags & (LOOKUP_ROOT | LOOKUP_IS_SCOPED))) + nd->root.mnt = NULL; +- if (unlikely(unlazy_walk(nd))) ++ if (!try_to_unlazy(nd)) + return -ECHILD; + } + +@@ -1466,7 +1466,7 @@ static struct dentry *lookup_fast(struct nameidata *nd, + unsigned seq; + dentry = __d_lookup_rcu(parent, &nd->last, &seq); + if (unlikely(!dentry)) { +- if (unlazy_walk(nd)) ++ if (!try_to_unlazy(nd)) + return ERR_PTR(-ECHILD); + return NULL; + } +@@ -1567,10 +1567,8 @@ static inline int may_lookup(struct nameidata *nd) + { + if (nd->flags & LOOKUP_RCU) { + int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK); +- if (err != -ECHILD) ++ if (err != -ECHILD || !try_to_unlazy(nd)) + return err; +- if (unlazy_walk(nd)) +- return -ECHILD; + } + return inode_permission(nd->inode, MAY_EXEC); + } +@@ -1592,7 +1590,7 @@ static int reserve_stack(struct nameidata *nd, struct path *link, unsigned seq) + // unlazy even if we fail to grab the link - cleanup needs it + bool grabbed_link = legitimize_path(nd, link, seq); + +- if (unlazy_walk(nd) != 0 || !grabbed_link) ++ if (!try_to_unlazy(nd) != 0 || !grabbed_link) + return -ECHILD; + + if (nd_alloc_stack(nd)) +@@ -1634,7 +1632,7 @@ static const char *pick_link(struct nameidata *nd, struct path *link, + touch_atime(&last->link); + cond_resched(); + } else if (atime_needs_update(&last->link, inode)) { +- if (unlikely(unlazy_walk(nd))) ++ if (!try_to_unlazy(nd)) + return ERR_PTR(-ECHILD); + touch_atime(&last->link); + } +@@ -1651,11 +1649,8 @@ static const char *pick_link(struct nameidata *nd, struct path *link, + get = inode->i_op->get_link; + if (nd->flags & LOOKUP_RCU) { + res = get(NULL, inode, &last->done); +- if (res == ERR_PTR(-ECHILD)) { +- if (unlikely(unlazy_walk(nd))) +- return ERR_PTR(-ECHILD); ++ if (res == ERR_PTR(-ECHILD) && try_to_unlazy(nd)) + res = get(link->dentry, inode, &last->done); +- } + } else { + res = get(link->dentry, inode, &last->done); + } +@@ -2195,7 +2190,7 @@ OK: + } + if (unlikely(!d_can_lookup(nd->path.dentry))) { + if (nd->flags & LOOKUP_RCU) { +- if (unlazy_walk(nd)) ++ if (!try_to_unlazy(nd)) + return -ECHILD; + } + return -ENOTDIR; +@@ -3129,7 +3124,6 @@ static const char *open_last_lookups(struct nameidata *nd, + struct inode *inode; + struct dentry *dentry; + const char *res; +- int error; + + nd->flags |= op->intent; + +@@ -3153,9 +3147,8 @@ static const char *open_last_lookups(struct nameidata *nd, + } else { + /* create side of things */ + if (nd->flags & LOOKUP_RCU) { +- error = unlazy_walk(nd); +- if (unlikely(error)) +- return ERR_PTR(error); ++ if (!try_to_unlazy(nd)) ++ return ERR_PTR(-ECHILD); + } + audit_inode(nd->name, dir, AUDIT_INODE_PARENT); + /* trailing slashes? */ +@@ -3164,9 +3157,7 @@ static const char *open_last_lookups(struct nameidata *nd, + } + + if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) { +- error = mnt_want_write(nd->path.mnt); +- if (!error) +- got_write = true; ++ got_write = !mnt_want_write(nd->path.mnt); + /* + * do _not_ fail yet - we might not need that or fail with + * a different error; let lookup_open() decide; we'll be +diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c +index 67c8dc9de8aa4..f1e21b6cfa481 100644 +--- a/fs/xfs/xfs_iops.c ++++ b/fs/xfs/xfs_iops.c +@@ -846,7 +846,7 @@ xfs_setattr_size( + ASSERT(xfs_isilocked(ip, XFS_MMAPLOCK_EXCL)); + ASSERT(S_ISREG(inode->i_mode)); + ASSERT((iattr->ia_valid & (ATTR_UID|ATTR_GID|ATTR_ATIME|ATTR_ATIME_SET| +- ATTR_MTIME_SET|ATTR_KILL_PRIV|ATTR_TIMES_SET)) == 0); ++ ATTR_MTIME_SET|ATTR_TIMES_SET)) == 0); + + oldsize = inode->i_size; + newsize = iattr->ia_size; +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 5ff27c12ce688..fb79ac497794b 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -3918,6 +3918,9 @@ int dev_pre_changeaddr_notify(struct net_device *dev, const char *addr, + struct netlink_ext_ack *extack); + int dev_set_mac_address(struct net_device *dev, struct sockaddr *sa, + struct netlink_ext_ack *extack); ++int dev_set_mac_address_user(struct net_device *dev, struct sockaddr *sa, ++ struct netlink_ext_ack *extack); ++int dev_get_mac_address(struct sockaddr *sa, struct net *net, char *dev_name); + int dev_change_carrier(struct net_device *, bool new_carrier); + int dev_get_phys_port_id(struct net_device *dev, + struct netdev_phys_item_id *ppid); +diff --git a/include/linux/swap.h b/include/linux/swap.h +index 596bc2f4d9b03..55fe2f5b6f5ff 100644 +--- a/include/linux/swap.h ++++ b/include/linux/swap.h +@@ -482,6 +482,7 @@ struct backing_dev_info; + extern int init_swap_address_space(unsigned int type, unsigned long nr_pages); + extern void exit_swap_address_space(unsigned int type); + extern struct swap_info_struct *get_swap_device(swp_entry_t entry); ++sector_t swap_page_sector(struct page *page); + + static inline void put_swap_device(struct swap_info_struct *si) + { +diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h +index c1504aa3d9cfd..ba2f439bc04d3 100644 +--- a/include/net/bluetooth/hci.h ++++ b/include/net/bluetooth/hci.h +@@ -238,6 +238,14 @@ enum { + * don't actually support features declared there. + */ + HCI_QUIRK_BROKEN_LOCAL_EXT_FTR_MAX_PAGE, ++ ++ /* ++ * When this quirk is set, then the hci_suspend_notifier is not ++ * registered. This is intended for devices which drop completely ++ * from the bus on system-suspend and which will show up as a new ++ * HCI after resume. ++ */ ++ HCI_QUIRK_NO_SUSPEND_NOTIFIER, + }; + + /* HCI device flags */ +diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h +index ee95f42fb0ecf..88f4bf0047e7a 100644 +--- a/include/uapi/linux/pkt_cls.h ++++ b/include/uapi/linux/pkt_cls.h +@@ -591,6 +591,8 @@ enum { + TCA_FLOWER_KEY_CT_FLAGS_ESTABLISHED = 1 << 1, /* Part of an existing connection. */ + TCA_FLOWER_KEY_CT_FLAGS_RELATED = 1 << 2, /* Related to an established connection. */ + TCA_FLOWER_KEY_CT_FLAGS_TRACKED = 1 << 3, /* Conntrack has occurred. */ ++ ++ __TCA_FLOWER_KEY_CT_FLAGS_MAX, + }; + + enum { +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index ff74fca39ed21..fa1f83083a58b 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -355,8 +355,9 @@ static enum hrtimer_restart hrtick(struct hrtimer *timer) + static void __hrtick_restart(struct rq *rq) + { + struct hrtimer *timer = &rq->hrtick_timer; ++ ktime_t time = rq->hrtick_time; + +- hrtimer_start_expires(timer, HRTIMER_MODE_ABS_PINNED_HARD); ++ hrtimer_start(timer, time, HRTIMER_MODE_ABS_PINNED_HARD); + } + + /* +@@ -380,7 +381,6 @@ static void __hrtick_start(void *arg) + void hrtick_start(struct rq *rq, u64 delay) + { + struct hrtimer *timer = &rq->hrtick_timer; +- ktime_t time; + s64 delta; + + /* +@@ -388,9 +388,7 @@ void hrtick_start(struct rq *rq, u64 delay) + * doesn't make sense and can cause timer DoS. + */ + delta = max_t(s64, delay, 10000LL); +- time = ktime_add_ns(timer->base->get_time(), delta); +- +- hrtimer_set_expires(timer, time); ++ rq->hrtick_time = ktime_add_ns(timer->base->get_time(), delta); + + if (rq == this_rq()) + __hrtick_restart(rq); +@@ -3478,7 +3476,7 @@ out: + + /** + * try_invoke_on_locked_down_task - Invoke a function on task in fixed state +- * @p: Process for which the function is to be invoked. ++ * @p: Process for which the function is to be invoked, can be @current. + * @func: Function to invoke. + * @arg: Argument to function. + * +@@ -3496,12 +3494,11 @@ out: + */ + bool try_invoke_on_locked_down_task(struct task_struct *p, bool (*func)(struct task_struct *t, void *arg), void *arg) + { +- bool ret = false; + struct rq_flags rf; ++ bool ret = false; + struct rq *rq; + +- lockdep_assert_irqs_enabled(); +- raw_spin_lock_irq(&p->pi_lock); ++ raw_spin_lock_irqsave(&p->pi_lock, rf.flags); + if (p->on_rq) { + rq = __task_rq_lock(p, &rf); + if (task_rq(p) == rq) +@@ -3518,7 +3515,7 @@ bool try_invoke_on_locked_down_task(struct task_struct *p, bool (*func)(struct t + ret = func(p, arg); + } + } +- raw_spin_unlock_irq(&p->pi_lock); ++ raw_spin_unlock_irqrestore(&p->pi_lock, rf.flags); + return ret; + } + +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index bb09988451a04..282a6bbaacd73 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -1031,6 +1031,7 @@ struct rq { + call_single_data_t hrtick_csd; + #endif + struct hrtimer hrtick_timer; ++ ktime_t hrtick_time; + #endif + + #ifdef CONFIG_SCHEDSTATS +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 723e8d342c627..1690e8db5b0de 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -5304,21 +5304,23 @@ static bool vma_shareable(struct vm_area_struct *vma, unsigned long addr) + void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, + unsigned long *start, unsigned long *end) + { +- unsigned long a_start, a_end; ++ unsigned long v_start = ALIGN(vma->vm_start, PUD_SIZE), ++ v_end = ALIGN_DOWN(vma->vm_end, PUD_SIZE); + +- if (!(vma->vm_flags & VM_MAYSHARE)) ++ /* ++ * vma need span at least one aligned PUD size and the start,end range ++ * must at least partialy within it. ++ */ ++ if (!(vma->vm_flags & VM_MAYSHARE) || !(v_end > v_start) || ++ (*end <= v_start) || (*start >= v_end)) + return; + + /* Extend the range to be PUD aligned for a worst case scenario */ +- a_start = ALIGN_DOWN(*start, PUD_SIZE); +- a_end = ALIGN(*end, PUD_SIZE); ++ if (*start > v_start) ++ *start = ALIGN_DOWN(*start, PUD_SIZE); + +- /* +- * Intersect the range with the vma range, since pmd sharing won't be +- * across vma after all +- */ +- *start = max(vma->vm_start, a_start); +- *end = min(vma->vm_end, a_end); ++ if (*end < v_end) ++ *end = ALIGN(*end, PUD_SIZE); + } + + /* +diff --git a/mm/page_io.c b/mm/page_io.c +index 9bca17ecc4df1..21f3160d39a83 100644 +--- a/mm/page_io.c ++++ b/mm/page_io.c +@@ -273,11 +273,6 @@ out: + return ret; + } + +-static sector_t swap_page_sector(struct page *page) +-{ +- return (sector_t)__page_file_index(page) << (PAGE_SHIFT - 9); +-} +- + static inline void count_swpout_vm_event(struct page *page) + { + #ifdef CONFIG_TRANSPARENT_HUGEPAGE +diff --git a/mm/swapfile.c b/mm/swapfile.c +index 9fffc5af29d1b..348f6665c06c4 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -220,6 +220,19 @@ offset_to_swap_extent(struct swap_info_struct *sis, unsigned long offset) + BUG(); + } + ++sector_t swap_page_sector(struct page *page) ++{ ++ struct swap_info_struct *sis = page_swap_info(page); ++ struct swap_extent *se; ++ sector_t sector; ++ pgoff_t offset; ++ ++ offset = __page_file_index(page); ++ se = offset_to_swap_extent(sis, offset); ++ sector = se->start_block + (offset - se->start_page); ++ return sector << (PAGE_SHIFT - 9); ++} ++ + /* + * swap allocation tell device that a cluster of swap can now be discarded, + * to allow the swap device to optimize its wear-levelling. +diff --git a/net/bluetooth/amp.c b/net/bluetooth/amp.c +index 9c711f0dfae35..be2d469d6369d 100644 +--- a/net/bluetooth/amp.c ++++ b/net/bluetooth/amp.c +@@ -297,6 +297,9 @@ void amp_read_loc_assoc_final_data(struct hci_dev *hdev, + struct hci_request req; + int err; + ++ if (!mgr) ++ return; ++ + cp.phy_handle = hcon->handle; + cp.len_so_far = cpu_to_le16(0); + cp.max_len = cpu_to_le16(hdev->amp_assoc_size); +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 9f8573131b97e..6ea2e16c57bdf 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -3568,7 +3568,8 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action, + } + + /* Suspend notifier should only act on events when powered. */ +- if (!hdev_is_powered(hdev)) ++ if (!hdev_is_powered(hdev) || ++ hci_dev_test_flag(hdev, HCI_UNREGISTER)) + goto done; + + if (action == PM_SUSPEND_PREPARE) { +@@ -3829,10 +3830,12 @@ int hci_register_dev(struct hci_dev *hdev) + hci_sock_dev_event(hdev, HCI_DEV_REG); + hci_dev_hold(hdev); + +- hdev->suspend_notifier.notifier_call = hci_suspend_notifier; +- error = register_pm_notifier(&hdev->suspend_notifier); +- if (error) +- goto err_wqueue; ++ if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) { ++ hdev->suspend_notifier.notifier_call = hci_suspend_notifier; ++ error = register_pm_notifier(&hdev->suspend_notifier); ++ if (error) ++ goto err_wqueue; ++ } + + queue_work(hdev->req_workqueue, &hdev->power_on); + +@@ -3867,9 +3870,11 @@ void hci_unregister_dev(struct hci_dev *hdev) + + cancel_work_sync(&hdev->power_on); + +- hci_suspend_clear_tasks(hdev); +- unregister_pm_notifier(&hdev->suspend_notifier); +- cancel_work_sync(&hdev->suspend_prepare); ++ if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) { ++ hci_suspend_clear_tasks(hdev); ++ unregister_pm_notifier(&hdev->suspend_notifier); ++ cancel_work_sync(&hdev->suspend_prepare); ++ } + + hci_dev_do_close(hdev); + +diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c +index 7a59cdddd3ce3..5047e9c2333a2 100644 +--- a/net/bridge/br_sysfs_if.c ++++ b/net/bridge/br_sysfs_if.c +@@ -55,9 +55,8 @@ static BRPORT_ATTR(_name, 0644, \ + static int store_flag(struct net_bridge_port *p, unsigned long v, + unsigned long mask) + { +- unsigned long flags; +- +- flags = p->flags; ++ unsigned long flags = p->flags; ++ int err; + + if (v) + flags |= mask; +@@ -65,6 +64,10 @@ static int store_flag(struct net_bridge_port *p, unsigned long v, + flags &= ~mask; + + if (flags != p->flags) { ++ err = br_switchdev_set_port_flag(p, flags, mask); ++ if (err) ++ return err; ++ + p->flags = flags; + br_port_flags_change(p, mask); + } +diff --git a/net/core/dev.c b/net/core/dev.c +index 449b45b843d40..a5a1dbe66b762 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -8743,6 +8743,48 @@ int dev_set_mac_address(struct net_device *dev, struct sockaddr *sa, + } + EXPORT_SYMBOL(dev_set_mac_address); + ++static DECLARE_RWSEM(dev_addr_sem); ++ ++int dev_set_mac_address_user(struct net_device *dev, struct sockaddr *sa, ++ struct netlink_ext_ack *extack) ++{ ++ int ret; ++ ++ down_write(&dev_addr_sem); ++ ret = dev_set_mac_address(dev, sa, extack); ++ up_write(&dev_addr_sem); ++ return ret; ++} ++EXPORT_SYMBOL(dev_set_mac_address_user); ++ ++int dev_get_mac_address(struct sockaddr *sa, struct net *net, char *dev_name) ++{ ++ size_t size = sizeof(sa->sa_data); ++ struct net_device *dev; ++ int ret = 0; ++ ++ down_read(&dev_addr_sem); ++ rcu_read_lock(); ++ ++ dev = dev_get_by_name_rcu(net, dev_name); ++ if (!dev) { ++ ret = -ENODEV; ++ goto unlock; ++ } ++ if (!dev->addr_len) ++ memset(sa->sa_data, 0, size); ++ else ++ memcpy(sa->sa_data, dev->dev_addr, ++ min_t(size_t, size, dev->addr_len)); ++ sa->sa_family = dev->type; ++ ++unlock: ++ rcu_read_unlock(); ++ up_read(&dev_addr_sem); ++ return ret; ++} ++EXPORT_SYMBOL(dev_get_mac_address); ++ + /** + * dev_change_carrier - Change device carrier + * @dev: device +diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c +index db8a0ff86f366..478d032f34aca 100644 +--- a/net/core/dev_ioctl.c ++++ b/net/core/dev_ioctl.c +@@ -123,17 +123,6 @@ static int dev_ifsioc_locked(struct net *net, struct ifreq *ifr, unsigned int cm + ifr->ifr_mtu = dev->mtu; + return 0; + +- case SIOCGIFHWADDR: +- if (!dev->addr_len) +- memset(ifr->ifr_hwaddr.sa_data, 0, +- sizeof(ifr->ifr_hwaddr.sa_data)); +- else +- memcpy(ifr->ifr_hwaddr.sa_data, dev->dev_addr, +- min(sizeof(ifr->ifr_hwaddr.sa_data), +- (size_t)dev->addr_len)); +- ifr->ifr_hwaddr.sa_family = dev->type; +- return 0; +- + case SIOCGIFSLAVE: + err = -EINVAL; + break; +@@ -274,7 +263,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd) + case SIOCSIFHWADDR: + if (dev->addr_len > sizeof(struct sockaddr)) + return -EINVAL; +- return dev_set_mac_address(dev, &ifr->ifr_hwaddr, NULL); ++ return dev_set_mac_address_user(dev, &ifr->ifr_hwaddr, NULL); + + case SIOCSIFHWBROADCAST: + if (ifr->ifr_hwaddr.sa_family != dev->type) +@@ -418,6 +407,12 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c + */ + + switch (cmd) { ++ case SIOCGIFHWADDR: ++ dev_load(net, ifr->ifr_name); ++ ret = dev_get_mac_address(&ifr->ifr_hwaddr, net, ifr->ifr_name); ++ if (colon) ++ *colon = ':'; ++ return ret; + /* + * These ioctl calls: + * - can be done by all. +@@ -427,7 +422,6 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c + case SIOCGIFFLAGS: + case SIOCGIFMETRIC: + case SIOCGIFMTU: +- case SIOCGIFHWADDR: + case SIOCGIFSLAVE: + case SIOCGIFMAP: + case SIOCGIFINDEX: +diff --git a/net/core/pktgen.c b/net/core/pktgen.c +index 105978604ffdb..3fba429f1f57b 100644 +--- a/net/core/pktgen.c ++++ b/net/core/pktgen.c +@@ -3464,7 +3464,7 @@ static int pktgen_thread_worker(void *arg) + struct pktgen_dev *pkt_dev = NULL; + int cpu = t->cpu; + +- BUG_ON(smp_processor_id() != cpu); ++ WARN_ON(smp_processor_id() != cpu); + + init_waitqueue_head(&t->queue); + complete(&t->start_done); +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 3d6ab194d0f58..f7c3885133dd1 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -2660,7 +2660,7 @@ static int do_setlink(const struct sk_buff *skb, + sa->sa_family = dev->type; + memcpy(sa->sa_data, nla_data(tb[IFLA_ADDRESS]), + dev->addr_len); +- err = dev_set_mac_address(dev, sa, extack); ++ err = dev_set_mac_address_user(dev, sa, extack); + kfree(sa); + if (err) + goto errout; +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 785daff48030d..28b8242f18d79 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -3292,7 +3292,19 @@ EXPORT_SYMBOL(skb_split); + */ + static int skb_prepare_for_shift(struct sk_buff *skb) + { +- return skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC); ++ int ret = 0; ++ ++ if (skb_cloned(skb)) { ++ /* Save and restore truesize: pskb_expand_head() may reallocate ++ * memory where ksize(kmalloc(S)) != ksize(kmalloc(S)), but we ++ * cannot change truesize at this point. ++ */ ++ unsigned int save_truesize = skb->truesize; ++ ++ ret = pskb_expand_head(skb, 0, 0, GFP_ATOMIC); ++ skb->truesize = save_truesize; ++ } ++ return ret; + } + + /** +diff --git a/net/dsa/tag_rtl4_a.c b/net/dsa/tag_rtl4_a.c +index 2646abe5a69e8..c17d39b4a1a04 100644 +--- a/net/dsa/tag_rtl4_a.c ++++ b/net/dsa/tag_rtl4_a.c +@@ -12,9 +12,7 @@ + * + * The 2 bytes tag form a 16 bit big endian word. The exact + * meaning has been guessed from packet dumps from ingress +- * frames, as no working egress traffic has been available +- * we do not know the format of the egress tags or if they +- * are even supported. ++ * frames. + */ + + #include +@@ -36,17 +34,34 @@ + static struct sk_buff *rtl4a_tag_xmit(struct sk_buff *skb, + struct net_device *dev) + { +- /* +- * Just let it pass thru, we don't know if it is possible +- * to tag a frame with the 0x8899 ethertype and direct it +- * to a specific port, all attempts at reverse-engineering have +- * ended up with the frames getting dropped. +- * +- * The VLAN set-up needs to restrict the frames to the right port. +- * +- * If you have documentation on the tagging format for RTL8366RB +- * (tag type A) then please contribute. +- */ ++ struct dsa_port *dp = dsa_slave_to_port(dev); ++ u8 *tag; ++ u16 *p; ++ u16 out; ++ ++ /* Pad out to at least 60 bytes */ ++ if (unlikely(eth_skb_pad(skb))) ++ return NULL; ++ if (skb_cow_head(skb, RTL4_A_HDR_LEN) < 0) ++ return NULL; ++ ++ netdev_dbg(dev, "add realtek tag to package to port %d\n", ++ dp->index); ++ skb_push(skb, RTL4_A_HDR_LEN); ++ ++ memmove(skb->data, skb->data + RTL4_A_HDR_LEN, 2 * ETH_ALEN); ++ tag = skb->data + 2 * ETH_ALEN; ++ ++ /* Set Ethertype */ ++ p = (u16 *)tag; ++ *p = htons(RTL4_A_ETHERTYPE); ++ ++ out = (RTL4_A_PROTOCOL_RTL8366RB << 12) | (2 << 8); ++ /* The lower bits is the port numer */ ++ out |= (u8)dp->index; ++ p = (u16 *)(tag + 2); ++ *p = htons(out); ++ + return skb; + } + +diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c +index 5c97de4599057..805f974923b92 100644 +--- a/net/hsr/hsr_framereg.c ++++ b/net/hsr/hsr_framereg.c +@@ -164,8 +164,10 @@ static struct hsr_node *hsr_add_node(struct hsr_priv *hsr, + * as initialization. (0 could trigger an spurious ring error warning). + */ + now = jiffies; +- for (i = 0; i < HSR_PT_PORTS; i++) ++ for (i = 0; i < HSR_PT_PORTS; i++) { + new_node->time_in[i] = now; ++ new_node->time_out[i] = now; ++ } + for (i = 0; i < HSR_PT_PORTS; i++) + new_node->seq_out[i] = seq_out; + +@@ -411,9 +413,12 @@ void hsr_register_frame_in(struct hsr_node *node, struct hsr_port *port, + int hsr_register_frame_out(struct hsr_port *port, struct hsr_node *node, + u16 sequence_nr) + { +- if (seq_nr_before_or_eq(sequence_nr, node->seq_out[port->type])) ++ if (seq_nr_before_or_eq(sequence_nr, node->seq_out[port->type]) && ++ time_is_after_jiffies(node->time_out[port->type] + ++ msecs_to_jiffies(HSR_ENTRY_FORGET_TIME))) + return 1; + ++ node->time_out[port->type] = jiffies; + node->seq_out[port->type] = sequence_nr; + return 0; + } +diff --git a/net/hsr/hsr_framereg.h b/net/hsr/hsr_framereg.h +index 86b43f539f2cc..d9628e7a5f051 100644 +--- a/net/hsr/hsr_framereg.h ++++ b/net/hsr/hsr_framereg.h +@@ -75,6 +75,7 @@ struct hsr_node { + enum hsr_port_type addr_B_port; + unsigned long time_in[HSR_PT_PORTS]; + bool time_in_stale[HSR_PT_PORTS]; ++ unsigned long time_out[HSR_PT_PORTS]; + /* if the node is a SAN */ + bool san_a; + bool san_b; +diff --git a/net/hsr/hsr_main.h b/net/hsr/hsr_main.h +index a9c30a608e35d..80e976a8f28cd 100644 +--- a/net/hsr/hsr_main.h ++++ b/net/hsr/hsr_main.h +@@ -21,6 +21,7 @@ + #define HSR_LIFE_CHECK_INTERVAL 2000 /* ms */ + #define HSR_NODE_FORGET_TIME 60000 /* ms */ + #define HSR_ANNOUNCE_INTERVAL 100 /* ms */ ++#define HSR_ENTRY_FORGET_TIME 400 /* ms */ + + /* By how much may slave1 and slave2 timestamps of latest received frame from + * each node differ before we notify of communication problem? +diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c +index 882f028992c38..427a1abce0a8a 100644 +--- a/net/iucv/af_iucv.c ++++ b/net/iucv/af_iucv.c +@@ -2036,7 +2036,6 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev, + char nullstring[8]; + + if (!pskb_may_pull(skb, sizeof(*trans_hdr))) { +- WARN_ONCE(1, "AF_IUCV failed to receive skb, len=%u", skb->len); + kfree_skb(skb); + return NET_RX_SUCCESS; + } +diff --git a/net/mptcp/options.c b/net/mptcp/options.c +index e0d21c0607e53..2e26e39169b82 100644 +--- a/net/mptcp/options.c ++++ b/net/mptcp/options.c +@@ -401,6 +401,7 @@ static void clear_3rdack_retransmission(struct sock *sk) + } + + static bool mptcp_established_options_mp(struct sock *sk, struct sk_buff *skb, ++ bool snd_data_fin_enable, + unsigned int *size, + unsigned int remaining, + struct mptcp_out_options *opts) +@@ -418,9 +419,10 @@ static bool mptcp_established_options_mp(struct sock *sk, struct sk_buff *skb, + if (!skb) + return false; + +- /* MPC/MPJ needed only on 3rd ack packet */ +- if (subflow->fully_established || +- subflow->snd_isn != TCP_SKB_CB(skb)->seq) ++ /* MPC/MPJ needed only on 3rd ack packet, DATA_FIN and TCP shutdown take precedence */ ++ if (subflow->fully_established || snd_data_fin_enable || ++ subflow->snd_isn != TCP_SKB_CB(skb)->seq || ++ sk->sk_state != TCP_ESTABLISHED) + return false; + + if (subflow->mp_capable) { +@@ -492,6 +494,7 @@ static void mptcp_write_data_fin(struct mptcp_subflow_context *subflow, + } + + static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb, ++ bool snd_data_fin_enable, + unsigned int *size, + unsigned int remaining, + struct mptcp_out_options *opts) +@@ -499,13 +502,11 @@ static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb, + struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk); + struct mptcp_sock *msk = mptcp_sk(subflow->conn); + unsigned int dss_size = 0; +- u64 snd_data_fin_enable; + struct mptcp_ext *mpext; + unsigned int ack_size; + bool ret = false; + + mpext = skb ? mptcp_get_ext(skb) : NULL; +- snd_data_fin_enable = mptcp_data_fin_enabled(msk); + + if (!skb || (mpext && mpext->use_map) || snd_data_fin_enable) { + unsigned int map_size; +@@ -683,12 +684,15 @@ bool mptcp_established_options(struct sock *sk, struct sk_buff *skb, + unsigned int *size, unsigned int remaining, + struct mptcp_out_options *opts) + { ++ struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk); ++ struct mptcp_sock *msk = mptcp_sk(subflow->conn); + unsigned int opt_size = 0; ++ bool snd_data_fin; + bool ret = false; + + opts->suboptions = 0; + +- if (unlikely(mptcp_check_fallback(sk))) ++ if (unlikely(__mptcp_check_fallback(msk))) + return false; + + /* prevent adding of any MPTCP related options on reset packet +@@ -697,10 +701,10 @@ bool mptcp_established_options(struct sock *sk, struct sk_buff *skb, + if (unlikely(skb && TCP_SKB_CB(skb)->tcp_flags & TCPHDR_RST)) + return false; + +- if (mptcp_established_options_mp(sk, skb, &opt_size, remaining, opts)) ++ snd_data_fin = mptcp_data_fin_enabled(msk); ++ if (mptcp_established_options_mp(sk, skb, snd_data_fin, &opt_size, remaining, opts)) + ret = true; +- else if (mptcp_established_options_dss(sk, skb, &opt_size, remaining, +- opts)) ++ else if (mptcp_established_options_dss(sk, skb, snd_data_fin, &opt_size, remaining, opts)) + ret = true; + + /* we reserved enough space for the above options, and exceeding the +diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c +index f998a077c7dd0..b51872b9dd619 100644 +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -364,8 +364,6 @@ static void mptcp_check_data_fin_ack(struct sock *sk) + + /* Look for an acknowledged DATA_FIN */ + if (mptcp_pending_data_fin_ack(sk)) { +- mptcp_stop_timer(sk); +- + WRITE_ONCE(msk->snd_data_fin_enable, 0); + + switch (sk->sk_state) { +@@ -2299,6 +2297,7 @@ static void mptcp_worker(struct work_struct *work) + if (!test_and_clear_bit(MPTCP_WORK_RTX, &msk->flags)) + goto unlock; + ++ __mptcp_clean_una(sk); + dfrag = mptcp_rtx_head(sk); + if (!dfrag) + goto unlock; +diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h +index d67de793d363f..d6ca1a5b94fc0 100644 +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -325,20 +325,13 @@ static inline struct mptcp_data_frag *mptcp_pending_tail(const struct sock *sk) + return list_last_entry(&msk->rtx_queue, struct mptcp_data_frag, list); + } + +-static inline struct mptcp_data_frag *mptcp_rtx_tail(const struct sock *sk) ++static inline struct mptcp_data_frag *mptcp_rtx_head(const struct sock *sk) + { + struct mptcp_sock *msk = mptcp_sk(sk); + +- if (!before64(msk->snd_nxt, READ_ONCE(msk->snd_una))) ++ if (msk->snd_una == READ_ONCE(msk->snd_nxt)) + return NULL; + +- return list_last_entry(&msk->rtx_queue, struct mptcp_data_frag, list); +-} +- +-static inline struct mptcp_data_frag *mptcp_rtx_head(const struct sock *sk) +-{ +- struct mptcp_sock *msk = mptcp_sk(sk); +- + return list_first_entry_or_null(&msk->rtx_queue, struct mptcp_data_frag, list); + } + +diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c +index 278cbe3e539ea..9d28f6e3dc49a 100644 +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -1026,6 +1026,12 @@ static void subflow_data_ready(struct sock *sk) + + msk = mptcp_sk(parent); + if (state & TCPF_LISTEN) { ++ /* MPJ subflow are removed from accept queue before reaching here, ++ * avoid stray wakeups ++ */ ++ if (reqsk_queue_empty(&inet_csk(sk)->icsk_accept_queue)) ++ return; ++ + set_bit(MPTCP_DATA_READY, &msk->flags); + parent->sk_data_ready(parent); + return; +diff --git a/net/psample/psample.c b/net/psample/psample.c +index 33e238c965bd8..482c07f2766b1 100644 +--- a/net/psample/psample.c ++++ b/net/psample/psample.c +@@ -309,10 +309,10 @@ static int psample_tunnel_meta_len(struct ip_tunnel_info *tun_info) + unsigned short tun_proto = ip_tunnel_info_af(tun_info); + const struct ip_tunnel_key *tun_key = &tun_info->key; + int tun_opts_len = tun_info->options_len; +- int sum = 0; ++ int sum = nla_total_size(0); /* PSAMPLE_ATTR_TUNNEL */ + + if (tun_key->tun_flags & TUNNEL_KEY) +- sum += nla_total_size(sizeof(u64)); ++ sum += nla_total_size_64bit(sizeof(u64)); + + if (tun_info->mode & IP_TUNNEL_INFO_BRIDGE) + sum += nla_total_size(0); +diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c +index 84f932532db7d..46c1b3e9f66a5 100644 +--- a/net/sched/cls_flower.c ++++ b/net/sched/cls_flower.c +@@ -30,6 +30,11 @@ + + #include + ++#define TCA_FLOWER_KEY_CT_FLAGS_MAX \ ++ ((__TCA_FLOWER_KEY_CT_FLAGS_MAX - 1) << 1) ++#define TCA_FLOWER_KEY_CT_FLAGS_MASK \ ++ (TCA_FLOWER_KEY_CT_FLAGS_MAX - 1) ++ + struct fl_flow_key { + struct flow_dissector_key_meta meta; + struct flow_dissector_key_control control; +@@ -686,8 +691,10 @@ static const struct nla_policy fl_policy[TCA_FLOWER_MAX + 1] = { + [TCA_FLOWER_KEY_ENC_IP_TTL_MASK] = { .type = NLA_U8 }, + [TCA_FLOWER_KEY_ENC_OPTS] = { .type = NLA_NESTED }, + [TCA_FLOWER_KEY_ENC_OPTS_MASK] = { .type = NLA_NESTED }, +- [TCA_FLOWER_KEY_CT_STATE] = { .type = NLA_U16 }, +- [TCA_FLOWER_KEY_CT_STATE_MASK] = { .type = NLA_U16 }, ++ [TCA_FLOWER_KEY_CT_STATE] = ++ NLA_POLICY_MASK(NLA_U16, TCA_FLOWER_KEY_CT_FLAGS_MASK), ++ [TCA_FLOWER_KEY_CT_STATE_MASK] = ++ NLA_POLICY_MASK(NLA_U16, TCA_FLOWER_KEY_CT_FLAGS_MASK), + [TCA_FLOWER_KEY_CT_ZONE] = { .type = NLA_U16 }, + [TCA_FLOWER_KEY_CT_ZONE_MASK] = { .type = NLA_U16 }, + [TCA_FLOWER_KEY_CT_MARK] = { .type = NLA_U32 }, +@@ -1390,12 +1397,33 @@ static int fl_set_enc_opt(struct nlattr **tb, struct fl_flow_key *key, + return 0; + } + ++static int fl_validate_ct_state(u16 state, struct nlattr *tb, ++ struct netlink_ext_ack *extack) ++{ ++ if (state && !(state & TCA_FLOWER_KEY_CT_FLAGS_TRACKED)) { ++ NL_SET_ERR_MSG_ATTR(extack, tb, ++ "no trk, so no other flag can be set"); ++ return -EINVAL; ++ } ++ ++ if (state & TCA_FLOWER_KEY_CT_FLAGS_NEW && ++ state & TCA_FLOWER_KEY_CT_FLAGS_ESTABLISHED) { ++ NL_SET_ERR_MSG_ATTR(extack, tb, ++ "new and est are mutually exclusive"); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + static int fl_set_key_ct(struct nlattr **tb, + struct flow_dissector_key_ct *key, + struct flow_dissector_key_ct *mask, + struct netlink_ext_ack *extack) + { + if (tb[TCA_FLOWER_KEY_CT_STATE]) { ++ int err; ++ + if (!IS_ENABLED(CONFIG_NF_CONNTRACK)) { + NL_SET_ERR_MSG(extack, "Conntrack isn't enabled"); + return -EOPNOTSUPP; +@@ -1403,6 +1431,13 @@ static int fl_set_key_ct(struct nlattr **tb, + fl_set_key_val(tb, &key->ct_state, TCA_FLOWER_KEY_CT_STATE, + &mask->ct_state, TCA_FLOWER_KEY_CT_STATE_MASK, + sizeof(key->ct_state)); ++ ++ err = fl_validate_ct_state(mask->ct_state, ++ tb[TCA_FLOWER_KEY_CT_STATE_MASK], ++ extack); ++ if (err) ++ return err; ++ + } + if (tb[TCA_FLOWER_KEY_CT_ZONE]) { + if (!IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES)) { +diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c +index 5d44b7d258ef0..22ded2c26089c 100644 +--- a/security/smack/smackfs.c ++++ b/security/smack/smackfs.c +@@ -1167,7 +1167,7 @@ static ssize_t smk_write_net4addr(struct file *file, const char __user *buf, + return -EPERM; + if (*ppos != 0) + return -EINVAL; +- if (count < SMK_NETLBLADDRMIN) ++ if (count < SMK_NETLBLADDRMIN || count > PAGE_SIZE - 1) + return -EINVAL; + + data = memdup_user_nul(buf, count); +@@ -1427,7 +1427,7 @@ static ssize_t smk_write_net6addr(struct file *file, const char __user *buf, + return -EPERM; + if (*ppos != 0) + return -EINVAL; +- if (count < SMK_NETLBLADDRMIN) ++ if (count < SMK_NETLBLADDRMIN || count > PAGE_SIZE - 1) + return -EINVAL; + + data = memdup_user_nul(buf, count); +@@ -1834,6 +1834,10 @@ static ssize_t smk_write_ambient(struct file *file, const char __user *buf, + if (!smack_privileged(CAP_MAC_ADMIN)) + return -EPERM; + ++ /* Enough data must be present */ ++ if (count == 0 || count > PAGE_SIZE) ++ return -EINVAL; ++ + data = memdup_user_nul(buf, count); + if (IS_ERR(data)) + return PTR_ERR(data); +@@ -2005,6 +2009,9 @@ static ssize_t smk_write_onlycap(struct file *file, const char __user *buf, + if (!smack_privileged(CAP_MAC_ADMIN)) + return -EPERM; + ++ if (count > PAGE_SIZE) ++ return -EINVAL; ++ + data = memdup_user_nul(buf, count); + if (IS_ERR(data)) + return PTR_ERR(data); +@@ -2092,6 +2099,9 @@ static ssize_t smk_write_unconfined(struct file *file, const char __user *buf, + if (!smack_privileged(CAP_MAC_ADMIN)) + return -EPERM; + ++ if (count > PAGE_SIZE) ++ return -EINVAL; ++ + data = memdup_user_nul(buf, count); + if (IS_ERR(data)) + return PTR_ERR(data); +@@ -2648,6 +2658,10 @@ static ssize_t smk_write_syslog(struct file *file, const char __user *buf, + if (!smack_privileged(CAP_MAC_ADMIN)) + return -EPERM; + ++ /* Enough data must be present */ ++ if (count == 0 || count > PAGE_SIZE) ++ return -EINVAL; ++ + data = memdup_user_nul(buf, count); + if (IS_ERR(data)) + return PTR_ERR(data); +@@ -2740,10 +2754,13 @@ static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf, + return -EPERM; + + /* ++ * No partial write. + * Enough data must be present. + */ + if (*ppos != 0) + return -EINVAL; ++ if (count == 0 || count > PAGE_SIZE) ++ return -EINVAL; + + data = memdup_user_nul(buf, count); + if (IS_ERR(data)) +diff --git a/security/tomoyo/file.c b/security/tomoyo/file.c +index 051f7297877cb..1e6077568fdec 100644 +--- a/security/tomoyo/file.c ++++ b/security/tomoyo/file.c +@@ -362,14 +362,14 @@ static bool tomoyo_merge_path_acl(struct tomoyo_acl_info *a, + { + u16 * const a_perm = &container_of(a, struct tomoyo_path_acl, head) + ->perm; +- u16 perm = *a_perm; ++ u16 perm = READ_ONCE(*a_perm); + const u16 b_perm = container_of(b, struct tomoyo_path_acl, head)->perm; + + if (is_delete) + perm &= ~b_perm; + else + perm |= b_perm; +- *a_perm = perm; ++ WRITE_ONCE(*a_perm, perm); + return !perm; + } + +@@ -437,7 +437,7 @@ static bool tomoyo_merge_mkdev_acl(struct tomoyo_acl_info *a, + { + u8 *const a_perm = &container_of(a, struct tomoyo_mkdev_acl, + head)->perm; +- u8 perm = *a_perm; ++ u8 perm = READ_ONCE(*a_perm); + const u8 b_perm = container_of(b, struct tomoyo_mkdev_acl, head) + ->perm; + +@@ -445,7 +445,7 @@ static bool tomoyo_merge_mkdev_acl(struct tomoyo_acl_info *a, + perm &= ~b_perm; + else + perm |= b_perm; +- *a_perm = perm; ++ WRITE_ONCE(*a_perm, perm); + return !perm; + } + +@@ -517,14 +517,14 @@ static bool tomoyo_merge_path2_acl(struct tomoyo_acl_info *a, + { + u8 * const a_perm = &container_of(a, struct tomoyo_path2_acl, head) + ->perm; +- u8 perm = *a_perm; ++ u8 perm = READ_ONCE(*a_perm); + const u8 b_perm = container_of(b, struct tomoyo_path2_acl, head)->perm; + + if (is_delete) + perm &= ~b_perm; + else + perm |= b_perm; +- *a_perm = perm; ++ WRITE_ONCE(*a_perm, perm); + return !perm; + } + +@@ -655,7 +655,7 @@ static bool tomoyo_merge_path_number_acl(struct tomoyo_acl_info *a, + { + u8 * const a_perm = &container_of(a, struct tomoyo_path_number_acl, + head)->perm; +- u8 perm = *a_perm; ++ u8 perm = READ_ONCE(*a_perm); + const u8 b_perm = container_of(b, struct tomoyo_path_number_acl, head) + ->perm; + +@@ -663,7 +663,7 @@ static bool tomoyo_merge_path_number_acl(struct tomoyo_acl_info *a, + perm &= ~b_perm; + else + perm |= b_perm; +- *a_perm = perm; ++ WRITE_ONCE(*a_perm, perm); + return !perm; + } + +diff --git a/security/tomoyo/network.c b/security/tomoyo/network.c +index f9ff121d7e1eb..a89ed55d85d41 100644 +--- a/security/tomoyo/network.c ++++ b/security/tomoyo/network.c +@@ -233,14 +233,14 @@ static bool tomoyo_merge_inet_acl(struct tomoyo_acl_info *a, + { + u8 * const a_perm = + &container_of(a, struct tomoyo_inet_acl, head)->perm; +- u8 perm = *a_perm; ++ u8 perm = READ_ONCE(*a_perm); + const u8 b_perm = container_of(b, struct tomoyo_inet_acl, head)->perm; + + if (is_delete) + perm &= ~b_perm; + else + perm |= b_perm; +- *a_perm = perm; ++ WRITE_ONCE(*a_perm, perm); + return !perm; + } + +@@ -259,14 +259,14 @@ static bool tomoyo_merge_unix_acl(struct tomoyo_acl_info *a, + { + u8 * const a_perm = + &container_of(a, struct tomoyo_unix_acl, head)->perm; +- u8 perm = *a_perm; ++ u8 perm = READ_ONCE(*a_perm); + const u8 b_perm = container_of(b, struct tomoyo_unix_acl, head)->perm; + + if (is_delete) + perm &= ~b_perm; + else + perm |= b_perm; +- *a_perm = perm; ++ WRITE_ONCE(*a_perm, perm); + return !perm; + } + +diff --git a/security/tomoyo/util.c b/security/tomoyo/util.c +index 176b803ebcfc9..e89cac913583c 100644 +--- a/security/tomoyo/util.c ++++ b/security/tomoyo/util.c +@@ -1058,30 +1058,30 @@ bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r) + + if (ptr->is_deleted) + continue; ++ /* ++ * Reading perm bitmap might race with tomoyo_merge_*() because ++ * caller does not hold tomoyo_policy_lock mutex. But exceeding ++ * max_learning_entry parameter by a few entries does not harm. ++ */ + switch (ptr->type) { + case TOMOYO_TYPE_PATH_ACL: +- perm = container_of(ptr, struct tomoyo_path_acl, head) +- ->perm; ++ data_race(perm = container_of(ptr, struct tomoyo_path_acl, head)->perm); + break; + case TOMOYO_TYPE_PATH2_ACL: +- perm = container_of(ptr, struct tomoyo_path2_acl, head) +- ->perm; ++ data_race(perm = container_of(ptr, struct tomoyo_path2_acl, head)->perm); + break; + case TOMOYO_TYPE_PATH_NUMBER_ACL: +- perm = container_of(ptr, struct tomoyo_path_number_acl, +- head)->perm; ++ data_race(perm = container_of(ptr, struct tomoyo_path_number_acl, head) ++ ->perm); + break; + case TOMOYO_TYPE_MKDEV_ACL: +- perm = container_of(ptr, struct tomoyo_mkdev_acl, +- head)->perm; ++ data_race(perm = container_of(ptr, struct tomoyo_mkdev_acl, head)->perm); + break; + case TOMOYO_TYPE_INET_ACL: +- perm = container_of(ptr, struct tomoyo_inet_acl, +- head)->perm; ++ data_race(perm = container_of(ptr, struct tomoyo_inet_acl, head)->perm); + break; + case TOMOYO_TYPE_UNIX_ACL: +- perm = container_of(ptr, struct tomoyo_unix_acl, +- head)->perm; ++ data_race(perm = container_of(ptr, struct tomoyo_unix_acl, head)->perm); + break; + case TOMOYO_TYPE_MANUAL_TASK_ACL: + perm = 0; +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 1927605f0f7ed..5f4f8c2d760f0 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2532,6 +2532,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { + SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD), ++ SND_PCI_QUIRK(0x1462, 0xcc34, "MSI Godlike X570", ALC1220_FIXUP_GB_DUAL_CODECS), + SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS), + SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3), + SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX), +@@ -6396,6 +6397,7 @@ enum { + ALC269_FIXUP_LEMOTE_A1802, + ALC269_FIXUP_LEMOTE_A190X, + ALC256_FIXUP_INTEL_NUC8_RUGGED, ++ ALC256_FIXUP_INTEL_NUC10, + ALC255_FIXUP_XIAOMI_HEADSET_MIC, + ALC274_FIXUP_HP_MIC, + ALC274_FIXUP_HP_HEADSET_MIC, +@@ -7782,6 +7784,15 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC269_FIXUP_HEADSET_MODE + }, ++ [ALC256_FIXUP_INTEL_NUC10] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HEADSET_MODE ++ }, + [ALC255_FIXUP_XIAOMI_HEADSET_MIC] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -8128,6 +8139,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x8551, "System76 Gazelle (gaze14)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8560, "System76 Gazelle (gaze14)", ALC269_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1558, 0x8561, "System76 Gazelle (gaze14)", ALC269_FIXUP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1558, 0x8562, "Clevo NH[5|7][0-9]RZ[Q]", ALC269_FIXUP_DMIC), + SND_PCI_QUIRK(0x1558, 0x8668, "Clevo NP50B[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8680, "Clevo NJ50LU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8686, "Clevo NH50[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), +@@ -8222,6 +8234,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1c06, 0x2013, "Lemote A1802", ALC269_FIXUP_LEMOTE_A1802), + SND_PCI_QUIRK(0x1c06, 0x2015, "Lemote A190X", ALC269_FIXUP_LEMOTE_A190X), + SND_PCI_QUIRK(0x8086, 0x2080, "Intel NUC 8 Rugged", ALC256_FIXUP_INTEL_NUC8_RUGGED), ++ SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10), + + #if 0 + /* Below is a quirk table taken from the old code. +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 5520d7c800196..f00d4e417b6cf 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -71,6 +71,7 @@ enum { + #define BYT_RT5640_SSP0_AIF2 BIT(21) + #define BYT_RT5640_MCLK_EN BIT(22) + #define BYT_RT5640_MCLK_25MHZ BIT(23) ++#define BYT_RT5640_NO_SPEAKERS BIT(24) + + #define BYTCR_INPUT_DEFAULTS \ + (BYT_RT5640_IN3_MAP | \ +@@ -132,6 +133,8 @@ static void log_quirks(struct device *dev) + dev_info(dev, "quirk JD_NOT_INV enabled\n"); + if (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER) + dev_info(dev, "quirk MONO_SPEAKER enabled\n"); ++ if (byt_rt5640_quirk & BYT_RT5640_NO_SPEAKERS) ++ dev_info(dev, "quirk NO_SPEAKERS enabled\n"); + if (byt_rt5640_quirk & BYT_RT5640_DIFF_MIC) + dev_info(dev, "quirk DIFF_MIC enabled\n"); + if (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF1) { +@@ -399,6 +402,19 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, ++ { /* Acer One 10 S1002 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "One S1002"), ++ }, ++ .driver_data = (void *)(BYT_RT5640_IN1_MAP | ++ BYT_RT5640_JD_SRC_JD2_IN4N | ++ BYT_RT5640_OVCD_TH_2000UA | ++ BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_DIFF_MIC | ++ BYT_RT5640_SSP0_AIF2 | ++ BYT_RT5640_MCLK_EN), ++ }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), +@@ -524,6 +540,16 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_MONO_SPEAKER | + BYT_RT5640_MCLK_EN), + }, ++ { /* Estar Beauty HD MID 7316R */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Estar"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "eSTAR BEAUTY HD Intel Quad core"), ++ }, ++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | ++ BYT_RT5640_MONO_SPEAKER | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), +@@ -798,6 +824,20 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF2 | + BYT_RT5640_MCLK_EN), + }, ++ { /* Voyo Winpad A15 */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), ++ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"), ++ /* Above strings are too generic, also match on BIOS date */ ++ DMI_MATCH(DMI_BIOS_DATE, "11/20/2014"), ++ }, ++ .driver_data = (void *)(BYT_RT5640_IN1_MAP | ++ BYT_RT5640_JD_SRC_JD2_IN4N | ++ BYT_RT5640_OVCD_TH_2000UA | ++ BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_DIFF_MIC | ++ BYT_RT5640_MCLK_EN), ++ }, + { /* Catch-all for generic Insyde tablets, must be last */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Insyde"), +@@ -946,7 +986,7 @@ static int byt_rt5640_init(struct snd_soc_pcm_runtime *runtime) + ret = snd_soc_dapm_add_routes(&card->dapm, + byt_rt5640_mono_spk_map, + ARRAY_SIZE(byt_rt5640_mono_spk_map)); +- } else { ++ } else if (!(byt_rt5640_quirk & BYT_RT5640_NO_SPEAKERS)) { + ret = snd_soc_dapm_add_routes(&card->dapm, + byt_rt5640_stereo_spk_map, + ARRAY_SIZE(byt_rt5640_stereo_spk_map)); +@@ -1188,6 +1228,7 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + static const char * const map_name[] = { "dmic1", "dmic2", "in1", "in3" }; ++ __maybe_unused const char *spk_type; + const struct dmi_system_id *dmi_id; + struct byt_rt5640_private *priv; + struct snd_soc_acpi_mach *mach; +@@ -1196,7 +1237,7 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) + bool sof_parent; + int ret_val = 0; + int dai_index = 0; +- int i; ++ int i, cfg_spk; + + is_bytcr = false; + priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL); +@@ -1335,16 +1376,24 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) + } + } + ++ if (byt_rt5640_quirk & BYT_RT5640_NO_SPEAKERS) { ++ cfg_spk = 0; ++ spk_type = "none"; ++ } else if (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER) { ++ cfg_spk = 1; ++ spk_type = "mono"; ++ } else { ++ cfg_spk = 2; ++ spk_type = "stereo"; ++ } ++ + snprintf(byt_rt5640_components, sizeof(byt_rt5640_components), +- "cfg-spk:%s cfg-mic:%s", +- (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER) ? "1" : "2", ++ "cfg-spk:%d cfg-mic:%s", cfg_spk, + map_name[BYT_RT5640_MAP(byt_rt5640_quirk)]); + byt_rt5640_card.components = byt_rt5640_components; + #if !IS_ENABLED(CONFIG_SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES) + snprintf(byt_rt5640_long_name, sizeof(byt_rt5640_long_name), +- "bytcr-rt5640-%s-spk-%s-mic", +- (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER) ? +- "mono" : "stereo", ++ "bytcr-rt5640-%s-spk-%s-mic", spk_type, + map_name[BYT_RT5640_MAP(byt_rt5640_quirk)]); + byt_rt5640_card.long_name = byt_rt5640_long_name; + #endif +diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c +index f289ec8563a11..148b7b1bd3e8c 100644 +--- a/sound/soc/intel/boards/bytcr_rt5651.c ++++ b/sound/soc/intel/boards/bytcr_rt5651.c +@@ -435,6 +435,19 @@ static const struct dmi_system_id byt_rt5651_quirk_table[] = { + BYT_RT5651_SSP0_AIF1 | + BYT_RT5651_MONO_SPEAKER), + }, ++ { ++ /* Jumper EZpad 7 */ ++ .callback = byt_rt5651_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Jumper"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "EZpad"), ++ /* Jumper12x.WJ2012.bsBKRCP05 with the version dropped */ ++ DMI_MATCH(DMI_BIOS_VERSION, "Jumper12x.WJ2012.bsBKRCP"), ++ }, ++ .driver_data = (void *)(BYT_RT5651_DEFAULT_QUIRKS | ++ BYT_RT5651_IN2_MAP | ++ BYT_RT5651_JD_NOT_INV), ++ }, + { + /* KIANO SlimNote 14.2 */ + .callback = byt_rt5651_quirk_cb, +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index 152ea166eeaef..daca06dde99ba 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -126,9 +126,10 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, + "Tiger Lake Client Platform"), + }, +- .driver_data = (void *)(SOF_RT711_JD_SRC_JD1 | +- SOF_SDW_TGL_HDMI | SOF_SDW_PCH_DMIC | +- SOF_SSP_PORT(SOF_I2S_SSP2)), ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ SOF_RT711_JD_SRC_JD1 | ++ SOF_SDW_PCH_DMIC | ++ SOF_SSP_PORT(SOF_I2S_SSP2)), + }, + { + .callback = sof_sdw_quirk_cb, +@@ -152,7 +153,8 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + DMI_MATCH(DMI_SYS_VENDOR, "Google"), + DMI_MATCH(DMI_PRODUCT_NAME, "Volteer"), + }, +- .driver_data = (void *)(SOF_SDW_TGL_HDMI | SOF_SDW_PCH_DMIC | ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ SOF_SDW_PCH_DMIC | + SOF_SDW_FOUR_SPK), + }, + { +@@ -161,7 +163,8 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + DMI_MATCH(DMI_SYS_VENDOR, "Google"), + DMI_MATCH(DMI_PRODUCT_NAME, "Ripto"), + }, +- .driver_data = (void *)(SOF_SDW_TGL_HDMI | SOF_SDW_PCH_DMIC | ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ SOF_SDW_PCH_DMIC | + SOF_SDW_FOUR_SPK), + }, + +@@ -933,7 +936,7 @@ static int sof_card_dai_links_create(struct device *dev, + ctx->idisp_codec = true; + + /* enable dmic01 & dmic16k */ +- dmic_num = (sof_sdw_quirk & SOF_SDW_PCH_DMIC) ? 2 : 0; ++ dmic_num = (sof_sdw_quirk & SOF_SDW_PCH_DMIC || mach_params->dmic_num) ? 2 : 0; + comp_num += dmic_num; + + dev_dbg(dev, "sdw %d, ssp %d, dmic %d, hdmi %d", sdw_be_num, ssp_num, +diff --git a/sound/soc/intel/common/soc-intel-quirks.h b/sound/soc/intel/common/soc-intel-quirks.h +index b07df3059926d..a93987ab7f4d7 100644 +--- a/sound/soc/intel/common/soc-intel-quirks.h ++++ b/sound/soc/intel/common/soc-intel-quirks.h +@@ -11,6 +11,7 @@ + + #if IS_ENABLED(CONFIG_X86) + ++#include + #include + #include + #include +@@ -38,12 +39,36 @@ SOC_INTEL_IS_CPU(cml, KABYLAKE_L); + + static inline bool soc_intel_is_byt_cr(struct platform_device *pdev) + { ++ /* ++ * List of systems which: ++ * 1. Use a non CR version of the Bay Trail SoC ++ * 2. Contain at least 6 interrupt resources so that the ++ * platform_get_resource(pdev, IORESOURCE_IRQ, 5) check below ++ * succeeds ++ * 3. Despite 1. and 2. still have their IPC IRQ at index 0 rather then 5 ++ * ++ * This needs to be here so that it can be shared between the SST and ++ * SOF drivers. We rely on the compiler to optimize this out in files ++ * where soc_intel_is_byt_cr is not used. ++ */ ++ static const struct dmi_system_id force_bytcr_table[] = { ++ { /* Lenovo Yoga Tablet 2 series */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_FAMILY, "YOGATablet2"), ++ }, ++ }, ++ {} ++ }; + struct device *dev = &pdev->dev; + int status = 0; + + if (!soc_intel_is_byt()) + return false; + ++ if (dmi_check_system(force_bytcr_table)) ++ return true; ++ + if (iosf_mbi_available()) { + u32 bios_status; + +diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c +index 8e5415c9234f1..d55851d2049e2 100644 +--- a/sound/soc/qcom/lpass-cpu.c ++++ b/sound/soc/qcom/lpass-cpu.c +@@ -743,7 +743,6 @@ static void of_lpass_cpu_parse_dai_data(struct device *dev, + } + if (id == LPASS_DP_RX) { + data->hdmi_port_enable = 1; +- dev_err(dev, "HDMI Port is enabled: %d\n", id); + } else { + data->mi2s_playback_sd_mode[id] = + of_lpass_cpu_parse_sd_lines(dev, node, +diff --git a/sound/usb/implicit.c b/sound/usb/implicit.c +index bba54430e6d0b..11a85e66aa96d 100644 +--- a/sound/usb/implicit.c ++++ b/sound/usb/implicit.c +@@ -304,7 +304,8 @@ static int audioformat_implicit_fb_quirk(struct snd_usb_audio *chip, + /* Pioneer devices with vendor spec class */ + if (attr == USB_ENDPOINT_SYNC_ASYNC && + alts->desc.bInterfaceClass == USB_CLASS_VENDOR_SPEC && +- USB_ID_VENDOR(chip->usb_id) == 0x2b73 /* Pioneer */) { ++ (USB_ID_VENDOR(chip->usb_id) == 0x2b73 || /* Pioneer */ ++ USB_ID_VENDOR(chip->usb_id) == 0x08e4 /* Pioneer */)) { + if (skip_pioneer_sync_ep(chip, fmt, alts)) + return 1; + } +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index c8a4bdf18207c..1165a5ac60f22 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -3757,6 +3757,123 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + } + } + }, ++{ ++ /* ++ * Pioneer DJ DJM-750 ++ * 8 channels playback & 8 channels capture @ 44.1/48/96kHz S24LE ++ */ ++ USB_DEVICE_VENDOR_SPEC(0x08e4, 0x017f), ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_COMPOSITE, ++ .data = (const struct snd_usb_audio_quirk[]) { ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_FIXED_ENDPOINT, ++ .data = &(const struct audioformat) { ++ .formats = SNDRV_PCM_FMTBIT_S24_3LE, ++ .channels = 8, ++ .iface = 0, ++ .altsetting = 1, ++ .altset_idx = 1, ++ .endpoint = 0x05, ++ .ep_attr = USB_ENDPOINT_XFER_ISOC| ++ USB_ENDPOINT_SYNC_ASYNC, ++ .rates = SNDRV_PCM_RATE_44100| ++ SNDRV_PCM_RATE_48000| ++ SNDRV_PCM_RATE_96000, ++ .rate_min = 44100, ++ .rate_max = 96000, ++ .nr_rates = 3, ++ .rate_table = (unsigned int[]) { 44100, 48000, 96000 } ++ } ++ }, ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_FIXED_ENDPOINT, ++ .data = &(const struct audioformat) { ++ .formats = SNDRV_PCM_FMTBIT_S24_3LE, ++ .channels = 8, ++ .iface = 0, ++ .altsetting = 1, ++ .altset_idx = 1, ++ .endpoint = 0x86, ++ .ep_idx = 1, ++ .ep_attr = USB_ENDPOINT_XFER_ISOC| ++ USB_ENDPOINT_SYNC_ASYNC| ++ USB_ENDPOINT_USAGE_IMPLICIT_FB, ++ .rates = SNDRV_PCM_RATE_44100| ++ SNDRV_PCM_RATE_48000| ++ SNDRV_PCM_RATE_96000, ++ .rate_min = 44100, ++ .rate_max = 96000, ++ .nr_rates = 3, ++ .rate_table = (unsigned int[]) { 44100, 48000, 96000 } ++ } ++ }, ++ { ++ .ifnum = -1 ++ } ++ } ++ } ++}, ++{ ++ /* ++ * Pioneer DJ DJM-450 ++ * PCM is 8 channels out @ 48 fixed (endpoint 0x01) ++ * and 8 channels in @ 48 fixed (endpoint 0x82). ++ */ ++ USB_DEVICE_VENDOR_SPEC(0x2b73, 0x0013), ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_COMPOSITE, ++ .data = (const struct snd_usb_audio_quirk[]) { ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_FIXED_ENDPOINT, ++ .data = &(const struct audioformat) { ++ .formats = SNDRV_PCM_FMTBIT_S24_3LE, ++ .channels = 8, // outputs ++ .iface = 0, ++ .altsetting = 1, ++ .altset_idx = 1, ++ .endpoint = 0x01, ++ .ep_attr = USB_ENDPOINT_XFER_ISOC| ++ USB_ENDPOINT_SYNC_ASYNC, ++ .rates = SNDRV_PCM_RATE_48000, ++ .rate_min = 48000, ++ .rate_max = 48000, ++ .nr_rates = 1, ++ .rate_table = (unsigned int[]) { 48000 } ++ } ++ }, ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_FIXED_ENDPOINT, ++ .data = &(const struct audioformat) { ++ .formats = SNDRV_PCM_FMTBIT_S24_3LE, ++ .channels = 8, // inputs ++ .iface = 0, ++ .altsetting = 1, ++ .altset_idx = 1, ++ .endpoint = 0x82, ++ .ep_idx = 1, ++ .ep_attr = USB_ENDPOINT_XFER_ISOC| ++ USB_ENDPOINT_SYNC_ASYNC| ++ USB_ENDPOINT_USAGE_IMPLICIT_FB, ++ .rates = SNDRV_PCM_RATE_48000, ++ .rate_min = 48000, ++ .rate_max = 48000, ++ .nr_rates = 1, ++ .rate_table = (unsigned int[]) { 48000 } ++ } ++ }, ++ { ++ .ifnum = -1 ++ } ++ } ++ } ++}, + + #undef USB_DEVICE_VENDOR_SPEC + #undef USB_AUDIO_DEVICE +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index e196e364cef19..9ba4682ebc482 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1470,6 +1470,23 @@ static void set_format_emu_quirk(struct snd_usb_substream *subs, + subs->pkt_offset_adj = (emu_samplerate_id >= EMU_QUIRK_SR_176400HZ) ? 4 : 0; + } + ++static int pioneer_djm_set_format_quirk(struct snd_usb_substream *subs, ++ u16 windex) ++{ ++ unsigned int cur_rate = subs->data_endpoint->cur_rate; ++ u8 sr[3]; ++ // Convert to little endian ++ sr[0] = cur_rate & 0xff; ++ sr[1] = (cur_rate >> 8) & 0xff; ++ sr[2] = (cur_rate >> 16) & 0xff; ++ usb_set_interface(subs->dev, 0, 1); ++ // we should derive windex from fmt-sync_ep but it's not set ++ snd_usb_ctl_msg(subs->stream->chip->dev, ++ usb_rcvctrlpipe(subs->stream->chip->dev, 0), ++ 0x01, 0x22, 0x0100, windex, &sr, 0x0003); ++ return 0; ++} ++ + void snd_usb_set_format_quirk(struct snd_usb_substream *subs, + const struct audioformat *fmt) + { +@@ -1483,6 +1500,9 @@ void snd_usb_set_format_quirk(struct snd_usb_substream *subs, + case USB_ID(0x534d, 0x2109): /* MacroSilicon MS2109 */ + subs->stream_offset_adj = 2; + break; ++ case USB_ID(0x2b73, 0x0013): /* Pioneer DJM-450 */ ++ pioneer_djm_set_format_quirk(subs, 0x0082); ++ break; + } + } + +diff --git a/tools/testing/selftests/bpf/xdpxceiver.c b/tools/testing/selftests/bpf/xdpxceiver.c +index 1e722ee76b1fc..e7945b6246c82 100644 +--- a/tools/testing/selftests/bpf/xdpxceiver.c ++++ b/tools/testing/selftests/bpf/xdpxceiver.c +@@ -729,7 +729,6 @@ static void worker_pkt_validate(void) + u32 payloadseqnum = -2; + + while (1) { +- pkt_node_rx_q = malloc(sizeof(struct pkt)); + pkt_node_rx_q = TAILQ_LAST(&head, head_s); + if (!pkt_node_rx_q) + break; diff --git a/patch/kernel/sunxi-dev/patch-5.11.4-5.patch b/patch/kernel/sunxi-dev/patch-5.11.4-5.patch new file mode 100644 index 0000000000..cd533a89c7 --- /dev/null +++ b/patch/kernel/sunxi-dev/patch-5.11.4-5.patch @@ -0,0 +1,1526 @@ +diff --git a/Makefile b/Makefile +index cb9a8e8239511..1673c12fb4b35 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 11 +-SUBLEVEL = 4 ++SUBLEVEL = 5 + EXTRAVERSION = + NAME = 💕 Valentine's Day Edition 💕 + +diff --git a/arch/ia64/kernel/signal.c b/arch/ia64/kernel/signal.c +index e67b22fc3c60b..c1b299760bf7a 100644 +--- a/arch/ia64/kernel/signal.c ++++ b/arch/ia64/kernel/signal.c +@@ -341,7 +341,8 @@ ia64_do_signal (struct sigscratch *scr, long in_syscall) + * need to push through a forced SIGSEGV. + */ + while (1) { +- get_signal(&ksig); ++ if (!get_signal(&ksig)) ++ break; + + /* + * get_signal() may have run a debugger (via notify_parent()) +diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c +index bfda153b1a41d..87682dcb64ec3 100644 +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -325,22 +325,22 @@ static void rpm_put_suppliers(struct device *dev) + static int __rpm_callback(int (*cb)(struct device *), struct device *dev) + __releases(&dev->power.lock) __acquires(&dev->power.lock) + { +- int retval, idx; + bool use_links = dev->power.links_count > 0; ++ bool get = false; ++ int retval, idx; ++ bool put; + + if (dev->power.irq_safe) { + spin_unlock(&dev->power.lock); ++ } else if (!use_links) { ++ spin_unlock_irq(&dev->power.lock); + } else { ++ get = dev->power.runtime_status == RPM_RESUMING; ++ + spin_unlock_irq(&dev->power.lock); + +- /* +- * Resume suppliers if necessary. +- * +- * The device's runtime PM status cannot change until this +- * routine returns, so it is safe to read the status outside of +- * the lock. +- */ +- if (use_links && dev->power.runtime_status == RPM_RESUMING) { ++ /* Resume suppliers if necessary. */ ++ if (get) { + idx = device_links_read_lock(); + + retval = rpm_get_suppliers(dev); +@@ -355,24 +355,36 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev) + + if (dev->power.irq_safe) { + spin_lock(&dev->power.lock); +- } else { +- /* +- * If the device is suspending and the callback has returned +- * success, drop the usage counters of the suppliers that have +- * been reference counted on its resume. +- * +- * Do that if resume fails too. +- */ +- if (use_links +- && ((dev->power.runtime_status == RPM_SUSPENDING && !retval) +- || (dev->power.runtime_status == RPM_RESUMING && retval))) { +- idx = device_links_read_lock(); ++ return retval; ++ } + +- fail: +- rpm_put_suppliers(dev); ++ spin_lock_irq(&dev->power.lock); + +- device_links_read_unlock(idx); +- } ++ if (!use_links) ++ return retval; ++ ++ /* ++ * If the device is suspending and the callback has returned success, ++ * drop the usage counters of the suppliers that have been reference ++ * counted on its resume. ++ * ++ * Do that if the resume fails too. ++ */ ++ put = dev->power.runtime_status == RPM_SUSPENDING && !retval; ++ if (put) ++ __update_runtime_status(dev, RPM_SUSPENDED); ++ else ++ put = get && retval; ++ ++ if (put) { ++ spin_unlock_irq(&dev->power.lock); ++ ++ idx = device_links_read_lock(); ++ ++fail: ++ rpm_put_suppliers(dev); ++ ++ device_links_read_unlock(idx); + + spin_lock_irq(&dev->power.lock); + } +diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c +index 63f549889f875..5ac1881396afb 100644 +--- a/drivers/block/rsxx/core.c ++++ b/drivers/block/rsxx/core.c +@@ -165,15 +165,17 @@ static ssize_t rsxx_cram_read(struct file *fp, char __user *ubuf, + { + struct rsxx_cardinfo *card = file_inode(fp)->i_private; + char *buf; +- ssize_t st; ++ int st; + + buf = kzalloc(cnt, GFP_KERNEL); + if (!buf) + return -ENOMEM; + + st = rsxx_creg_read(card, CREG_ADD_CRAM + (u32)*ppos, cnt, buf, 1); +- if (!st) +- st = copy_to_user(ubuf, buf, cnt); ++ if (!st) { ++ if (copy_to_user(ubuf, buf, cnt)) ++ st = -EFAULT; ++ } + kfree(buf); + if (st) + return st; +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 431919d5f48af..a2e0395cbe618 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -707,12 +707,22 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip) + const char *desc = "attempting to generate an interrupt"; + u32 cap2; + cap_t cap; ++ int ret; + ++ /* TPM 2.0 */ + if (chip->flags & TPM_CHIP_FLAG_TPM2) + return tpm2_get_tpm_pt(chip, 0x100, &cap2, desc); +- else +- return tpm1_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc, +- 0); ++ ++ /* TPM 1.2 */ ++ ret = request_locality(chip, 0); ++ if (ret < 0) ++ return ret; ++ ++ ret = tpm1_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc, 0); ++ ++ release_locality(chip, 0); ++ ++ return ret; + } + + /* Register the IRQ and issue a command that will cause an interrupt. If an +@@ -1019,11 +1029,21 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + init_waitqueue_head(&priv->read_queue); + init_waitqueue_head(&priv->int_queue); + if (irq != -1) { +- /* Before doing irq testing issue a command to the TPM in polling mode ++ /* ++ * Before doing irq testing issue a command to the TPM in polling mode + * to make sure it works. May as well use that command to set the + * proper timeouts for the driver. + */ +- if (tpm_get_timeouts(chip)) { ++ ++ rc = request_locality(chip, 0); ++ if (rc < 0) ++ goto out_err; ++ ++ rc = tpm_get_timeouts(chip); ++ ++ release_locality(chip, 0); ++ ++ if (rc) { + dev_err(dev, "Could not get TPM timeouts and durations\n"); + rc = -ENODEV; + goto out_err; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +index 8155c54392c88..36a741d63ddcf 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +@@ -903,10 +903,11 @@ void amdgpu_acpi_fini(struct amdgpu_device *adev) + */ + bool amdgpu_acpi_is_s0ix_supported(struct amdgpu_device *adev) + { ++#if defined(CONFIG_AMD_PMC) + if (acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0) { + if (adev->flags & AMD_IS_APU) + return true; + } +- ++#endif + return false; + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +index a6667a2ca0db3..c2190c3e97f31 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +@@ -356,7 +356,7 @@ static ssize_t amdgpu_debugfs_regs_pcie_read(struct file *f, char __user *buf, + while (size) { + uint32_t value; + +- value = RREG32_PCIE(*pos >> 2); ++ value = RREG32_PCIE(*pos); + r = put_user(value, (uint32_t *)buf); + if (r) { + pm_runtime_mark_last_busy(adev_to_drm(adev)->dev); +@@ -423,7 +423,7 @@ static ssize_t amdgpu_debugfs_regs_pcie_write(struct file *f, const char __user + return r; + } + +- WREG32_PCIE(*pos >> 2, value); ++ WREG32_PCIE(*pos, value); + + result += 4; + buf += 4; +diff --git a/drivers/gpu/drm/amd/amdgpu/nv.c b/drivers/gpu/drm/amd/amdgpu/nv.c +index 6bee3677394ac..22b96b7d3647f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/nv.c ++++ b/drivers/gpu/drm/amd/amdgpu/nv.c +@@ -498,7 +498,8 @@ static bool nv_is_headless_sku(struct pci_dev *pdev) + { + if ((pdev->device == 0x731E && + (pdev->revision == 0xC6 || pdev->revision == 0xC7)) || +- (pdev->device == 0x7340 && pdev->revision == 0xC9)) ++ (pdev->device == 0x7340 && pdev->revision == 0xC9) || ++ (pdev->device == 0x7360 && pdev->revision == 0xC7)) + return true; + return false; + } +@@ -568,7 +569,8 @@ int nv_set_ip_blocks(struct amdgpu_device *adev) + if (adev->firmware.load_type == AMDGPU_FW_LOAD_DIRECT && + !amdgpu_sriov_vf(adev)) + amdgpu_device_ip_block_add(adev, &smu_v11_0_ip_block); +- amdgpu_device_ip_block_add(adev, &vcn_v2_0_ip_block); ++ if (!nv_is_headless_sku(adev->pdev)) ++ amdgpu_device_ip_block_add(adev, &vcn_v2_0_ip_block); + if (!amdgpu_sriov_vf(adev)) + amdgpu_device_ip_block_add(adev, &jpeg_v2_0_ip_block); + break; +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c +index 5aeb5f5a04478..9be8e1888daf4 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c +@@ -78,6 +78,9 @@ MODULE_FIRMWARE("amdgpu/dimgrey_cavefish_smc.bin"); + #define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE_MASK 0xC000 + #define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE__SHIFT 0xE + ++#define mmTHM_BACO_CNTL_ARCT 0xA7 ++#define mmTHM_BACO_CNTL_ARCT_BASE_IDX 0 ++ + static int link_width[] = {0, 1, 2, 4, 8, 12, 16}; + static int link_speed[] = {25, 50, 80, 160}; + +@@ -1581,9 +1584,15 @@ int smu_v11_0_baco_set_state(struct smu_context *smu, enum smu_baco_state state) + break; + default: + if (!ras || !ras->supported) { +- data = RREG32_SOC15(THM, 0, mmTHM_BACO_CNTL); +- data |= 0x80000000; +- WREG32_SOC15(THM, 0, mmTHM_BACO_CNTL, data); ++ if (adev->asic_type == CHIP_ARCTURUS) { ++ data = RREG32_SOC15(THM, 0, mmTHM_BACO_CNTL_ARCT); ++ data |= 0x80000000; ++ WREG32_SOC15(THM, 0, mmTHM_BACO_CNTL_ARCT, data); ++ } else { ++ data = RREG32_SOC15(THM, 0, mmTHM_BACO_CNTL); ++ data |= 0x80000000; ++ WREG32_SOC15(THM, 0, mmTHM_BACO_CNTL, data); ++ } + + ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_EnterBaco, 0, NULL); + } else { +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index be996dba040cc..3d194bb608405 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -3651,6 +3651,7 @@ static int cm_send_sidr_rep_locked(struct cm_id_private *cm_id_priv, + struct ib_cm_sidr_rep_param *param) + { + struct ib_mad_send_buf *msg; ++ unsigned long flags; + int ret; + + lockdep_assert_held(&cm_id_priv->lock); +@@ -3676,12 +3677,12 @@ static int cm_send_sidr_rep_locked(struct cm_id_private *cm_id_priv, + return ret; + } + cm_id_priv->id.state = IB_CM_IDLE; +- spin_lock_irq(&cm.lock); ++ spin_lock_irqsave(&cm.lock, flags); + if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node)) { + rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table); + RB_CLEAR_NODE(&cm_id_priv->sidr_id_node); + } +- spin_unlock_irq(&cm.lock); ++ spin_unlock_irqrestore(&cm.lock, flags); + return 0; + } + +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index ff8e17d7f7ca8..8161035eb7740 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -1970,8 +1970,10 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)( + + num_alloc_xa_entries++; + event_sub = kzalloc(sizeof(*event_sub), GFP_KERNEL); +- if (!event_sub) ++ if (!event_sub) { ++ err = -ENOMEM; + goto err; ++ } + + list_add_tail(&event_sub->event_list, &sub_list); + uverbs_uobject_get(&ev_file->uobj); +diff --git a/drivers/infiniband/sw/rxe/Kconfig b/drivers/infiniband/sw/rxe/Kconfig +index 4521490667925..06b8dc5093f77 100644 +--- a/drivers/infiniband/sw/rxe/Kconfig ++++ b/drivers/infiniband/sw/rxe/Kconfig +@@ -4,6 +4,7 @@ config RDMA_RXE + depends on INET && PCI && INFINIBAND + depends on INFINIBAND_VIRT_DMA + select NET_UDP_TUNNEL ++ select CRYPTO + select CRYPTO_CRC32 + help + This driver implements the InfiniBand RDMA transport over +diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c +index 4078358ed66ea..00fbc591a1425 100644 +--- a/drivers/iommu/dma-iommu.c ++++ b/drivers/iommu/dma-iommu.c +@@ -309,6 +309,11 @@ static void iommu_dma_flush_iotlb_all(struct iova_domain *iovad) + domain->ops->flush_iotlb_all(domain); + } + ++static bool dev_is_untrusted(struct device *dev) ++{ ++ return dev_is_pci(dev) && to_pci_dev(dev)->untrusted; ++} ++ + /** + * iommu_dma_init_domain - Initialise a DMA mapping domain + * @domain: IOMMU domain previously prepared by iommu_get_dma_cookie() +@@ -363,8 +368,9 @@ static int iommu_dma_init_domain(struct iommu_domain *domain, dma_addr_t base, + + init_iova_domain(iovad, 1UL << order, base_pfn); + +- if (!cookie->fq_domain && !iommu_domain_get_attr(domain, +- DOMAIN_ATTR_DMA_USE_FLUSH_QUEUE, &attr) && attr) { ++ if (!cookie->fq_domain && (!dev || !dev_is_untrusted(dev)) && ++ !iommu_domain_get_attr(domain, DOMAIN_ATTR_DMA_USE_FLUSH_QUEUE, &attr) && ++ attr) { + if (init_iova_flush_queue(iovad, iommu_dma_flush_iotlb_all, + iommu_dma_entry_dtor)) + pr_warn("iova flush queue initialization failed\n"); +@@ -521,11 +527,6 @@ static void __iommu_dma_unmap_swiotlb(struct device *dev, dma_addr_t dma_addr, + iova_align(iovad, size), dir, attrs); + } + +-static bool dev_is_untrusted(struct device *dev) +-{ +- return dev_is_pci(dev) && to_pci_dev(dev)->untrusted; +-} +- + static dma_addr_t __iommu_dma_map(struct device *dev, phys_addr_t phys, + size_t size, int prot, u64 dma_mask) + { +diff --git a/drivers/iommu/intel/pasid.h b/drivers/iommu/intel/pasid.h +index 97dfcffbf495a..444c0bec221a4 100644 +--- a/drivers/iommu/intel/pasid.h ++++ b/drivers/iommu/intel/pasid.h +@@ -30,8 +30,8 @@ + #define VCMD_VRSP_IP 0x1 + #define VCMD_VRSP_SC(e) (((e) >> 1) & 0x3) + #define VCMD_VRSP_SC_SUCCESS 0 +-#define VCMD_VRSP_SC_NO_PASID_AVAIL 1 +-#define VCMD_VRSP_SC_INVALID_PASID 1 ++#define VCMD_VRSP_SC_NO_PASID_AVAIL 2 ++#define VCMD_VRSP_SC_INVALID_PASID 2 + #define VCMD_VRSP_RESULT_PASID(e) (((e) >> 8) & 0xfffff) + #define VCMD_CMD_OPERAND(e) ((e) << 8) + /* +diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c +index 4a3f095a1c267..97eb62f667d22 100644 +--- a/drivers/iommu/tegra-smmu.c ++++ b/drivers/iommu/tegra-smmu.c +@@ -798,10 +798,70 @@ static phys_addr_t tegra_smmu_iova_to_phys(struct iommu_domain *domain, + return SMMU_PFN_PHYS(pfn) + SMMU_OFFSET_IN_PAGE(iova); + } + ++static struct tegra_smmu *tegra_smmu_find(struct device_node *np) ++{ ++ struct platform_device *pdev; ++ struct tegra_mc *mc; ++ ++ pdev = of_find_device_by_node(np); ++ if (!pdev) ++ return NULL; ++ ++ mc = platform_get_drvdata(pdev); ++ if (!mc) ++ return NULL; ++ ++ return mc->smmu; ++} ++ ++static int tegra_smmu_configure(struct tegra_smmu *smmu, struct device *dev, ++ struct of_phandle_args *args) ++{ ++ const struct iommu_ops *ops = smmu->iommu.ops; ++ int err; ++ ++ err = iommu_fwspec_init(dev, &dev->of_node->fwnode, ops); ++ if (err < 0) { ++ dev_err(dev, "failed to initialize fwspec: %d\n", err); ++ return err; ++ } ++ ++ err = ops->of_xlate(dev, args); ++ if (err < 0) { ++ dev_err(dev, "failed to parse SW group ID: %d\n", err); ++ iommu_fwspec_free(dev); ++ return err; ++ } ++ ++ return 0; ++} ++ + static struct iommu_device *tegra_smmu_probe_device(struct device *dev) + { +- struct tegra_smmu *smmu = dev_iommu_priv_get(dev); ++ struct device_node *np = dev->of_node; ++ struct tegra_smmu *smmu = NULL; ++ struct of_phandle_args args; ++ unsigned int index = 0; ++ int err; ++ ++ while (of_parse_phandle_with_args(np, "iommus", "#iommu-cells", index, ++ &args) == 0) { ++ smmu = tegra_smmu_find(args.np); ++ if (smmu) { ++ err = tegra_smmu_configure(smmu, dev, &args); ++ of_node_put(args.np); + ++ if (err < 0) ++ return ERR_PTR(err); ++ ++ break; ++ } ++ ++ of_node_put(args.np); ++ index++; ++ } ++ ++ smmu = dev_iommu_priv_get(dev); + if (!smmu) + return ERR_PTR(-ENODEV); + +@@ -1028,6 +1088,16 @@ struct tegra_smmu *tegra_smmu_probe(struct device *dev, + if (!smmu) + return ERR_PTR(-ENOMEM); + ++ /* ++ * This is a bit of a hack. Ideally we'd want to simply return this ++ * value. However the IOMMU registration process will attempt to add ++ * all devices to the IOMMU when bus_set_iommu() is called. In order ++ * not to rely on global variables to track the IOMMU instance, we ++ * set it here so that it can be looked up from the .probe_device() ++ * callback via the IOMMU device's .drvdata field. ++ */ ++ mc->smmu = smmu; ++ + size = BITS_TO_LONGS(soc->num_asids) * sizeof(long); + + smmu->asids = devm_kzalloc(dev, size, GFP_KERNEL); +diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c +index fce4cbf9529d6..50f3e673729c3 100644 +--- a/drivers/md/dm-bufio.c ++++ b/drivers/md/dm-bufio.c +@@ -1526,6 +1526,10 @@ EXPORT_SYMBOL_GPL(dm_bufio_get_block_size); + sector_t dm_bufio_get_device_size(struct dm_bufio_client *c) + { + sector_t s = i_size_read(c->bdev->bd_inode) >> SECTOR_SHIFT; ++ if (s >= c->start) ++ s -= c->start; ++ else ++ s = 0; + if (likely(c->sectors_per_block_bits >= 0)) + s >>= c->sectors_per_block_bits; + else +diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c +index fb41b4f23c489..66f4c6398f670 100644 +--- a/drivers/md/dm-verity-fec.c ++++ b/drivers/md/dm-verity-fec.c +@@ -61,19 +61,18 @@ static int fec_decode_rs8(struct dm_verity *v, struct dm_verity_fec_io *fio, + static u8 *fec_read_parity(struct dm_verity *v, u64 rsb, int index, + unsigned *offset, struct dm_buffer **buf) + { +- u64 position, block; ++ u64 position, block, rem; + u8 *res; + + position = (index + rsb) * v->fec->roots; +- block = position >> v->data_dev_block_bits; +- *offset = (unsigned)(position - (block << v->data_dev_block_bits)); ++ block = div64_u64_rem(position, v->fec->roots << SECTOR_SHIFT, &rem); ++ *offset = (unsigned)rem; + +- res = dm_bufio_read(v->fec->bufio, v->fec->start + block, buf); ++ res = dm_bufio_read(v->fec->bufio, block, buf); + if (IS_ERR(res)) { + DMERR("%s: FEC %llu: parity read failed (block %llu): %ld", + v->data_dev->name, (unsigned long long)rsb, +- (unsigned long long)(v->fec->start + block), +- PTR_ERR(res)); ++ (unsigned long long)block, PTR_ERR(res)); + *buf = NULL; + } + +@@ -155,7 +154,7 @@ static int fec_decode_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio, + + /* read the next block when we run out of parity bytes */ + offset += v->fec->roots; +- if (offset >= 1 << v->data_dev_block_bits) { ++ if (offset >= v->fec->roots << SECTOR_SHIFT) { + dm_bufio_release(buf); + + par = fec_read_parity(v, rsb, block_offset, &offset, &buf); +@@ -674,7 +673,7 @@ int verity_fec_ctr(struct dm_verity *v) + { + struct dm_verity_fec *f = v->fec; + struct dm_target *ti = v->ti; +- u64 hash_blocks; ++ u64 hash_blocks, fec_blocks; + int ret; + + if (!verity_fec_is_enabled(v)) { +@@ -744,15 +743,17 @@ int verity_fec_ctr(struct dm_verity *v) + } + + f->bufio = dm_bufio_client_create(f->dev->bdev, +- 1 << v->data_dev_block_bits, ++ f->roots << SECTOR_SHIFT, + 1, 0, NULL, NULL); + if (IS_ERR(f->bufio)) { + ti->error = "Cannot initialize FEC bufio client"; + return PTR_ERR(f->bufio); + } + +- if (dm_bufio_get_device_size(f->bufio) < +- ((f->start + f->rounds * f->roots) >> v->data_dev_block_bits)) { ++ dm_bufio_set_sector_offset(f->bufio, f->start << (v->data_dev_block_bits - SECTOR_SHIFT)); ++ ++ fec_blocks = div64_u64(f->rounds * f->roots, v->fec->roots << SECTOR_SHIFT); ++ if (dm_bufio_get_device_size(f->bufio) < fec_blocks) { + ti->error = "FEC device is too small"; + return -E2BIG; + } +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 470ff6b3ebef1..35b015c9ab025 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -2208,6 +2208,7 @@ static void rtl_pll_power_down(struct rtl8169_private *tp) + + switch (tp->mac_version) { + case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26: ++ case RTL_GIGA_MAC_VER_29 ... RTL_GIGA_MAC_VER_30: + case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33: + case RTL_GIGA_MAC_VER_37: + case RTL_GIGA_MAC_VER_39: +@@ -2235,6 +2236,7 @@ static void rtl_pll_power_up(struct rtl8169_private *tp) + { + switch (tp->mac_version) { + case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26: ++ case RTL_GIGA_MAC_VER_29 ... RTL_GIGA_MAC_VER_30: + case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_33: + case RTL_GIGA_MAC_VER_37: + case RTL_GIGA_MAC_VER_39: +diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c +index 3b1c387375a6b..3cf1b953f5236 100644 +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -1150,6 +1150,11 @@ static int inc_block_group_ro(struct btrfs_block_group *cache, int force) + spin_lock(&sinfo->lock); + spin_lock(&cache->lock); + ++ if (cache->swap_extents) { ++ ret = -ETXTBSY; ++ goto out; ++ } ++ + if (cache->ro) { + cache->ro++; + ret = 0; +@@ -2253,7 +2258,7 @@ again: + } + + ret = inc_block_group_ro(cache, 0); +- if (!do_chunk_alloc) ++ if (!do_chunk_alloc || ret == -ETXTBSY) + goto unlock_out; + if (!ret) + goto out; +@@ -2262,6 +2267,8 @@ again: + if (ret < 0) + goto out; + ret = inc_block_group_ro(cache, 0); ++ if (ret == -ETXTBSY) ++ goto unlock_out; + out: + if (cache->flags & BTRFS_BLOCK_GROUP_SYSTEM) { + alloc_flags = btrfs_get_alloc_profile(fs_info, cache->flags); +@@ -3345,6 +3352,7 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info) + ASSERT(list_empty(&block_group->io_list)); + ASSERT(list_empty(&block_group->bg_list)); + ASSERT(refcount_read(&block_group->refs) == 1); ++ ASSERT(block_group->swap_extents == 0); + btrfs_put_block_group(block_group); + + spin_lock(&info->block_group_cache_lock); +@@ -3411,3 +3419,26 @@ void btrfs_unfreeze_block_group(struct btrfs_block_group *block_group) + __btrfs_remove_free_space_cache(block_group->free_space_ctl); + } + } ++ ++bool btrfs_inc_block_group_swap_extents(struct btrfs_block_group *bg) ++{ ++ bool ret = true; ++ ++ spin_lock(&bg->lock); ++ if (bg->ro) ++ ret = false; ++ else ++ bg->swap_extents++; ++ spin_unlock(&bg->lock); ++ ++ return ret; ++} ++ ++void btrfs_dec_block_group_swap_extents(struct btrfs_block_group *bg, int amount) ++{ ++ spin_lock(&bg->lock); ++ ASSERT(!bg->ro); ++ ASSERT(bg->swap_extents >= amount); ++ bg->swap_extents -= amount; ++ spin_unlock(&bg->lock); ++} +diff --git a/fs/btrfs/block-group.h b/fs/btrfs/block-group.h +index 8f74a96074f7b..8a925741dc34a 100644 +--- a/fs/btrfs/block-group.h ++++ b/fs/btrfs/block-group.h +@@ -181,6 +181,12 @@ struct btrfs_block_group { + */ + int needs_free_space; + ++ /* ++ * Number of extents in this block group used for swap files. ++ * All accesses protected by the spinlock 'lock'. ++ */ ++ int swap_extents; ++ + /* Record locked full stripes for RAID5/6 block group */ + struct btrfs_full_stripe_locks_tree full_stripe_locks_root; + }; +@@ -301,4 +307,7 @@ int btrfs_rmap_block(struct btrfs_fs_info *fs_info, u64 chunk_start, + u64 physical, u64 **logical, int *naddrs, int *stripe_len); + #endif + ++bool btrfs_inc_block_group_swap_extents(struct btrfs_block_group *bg); ++void btrfs_dec_block_group_swap_extents(struct btrfs_block_group *bg, int amount); ++ + #endif /* BTRFS_BLOCK_GROUP_H */ +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index 4debdbdde2abb..0c8c55a41d7b2 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -523,6 +523,11 @@ struct btrfs_swapfile_pin { + * points to a struct btrfs_device. + */ + bool is_block_group; ++ /* ++ * Only used when 'is_block_group' is true and it is the number of ++ * extents used by a swapfile for this block group ('ptr' field). ++ */ ++ int bg_extent_count; + }; + + bool btrfs_pinned_by_swapfile(struct btrfs_fs_info *fs_info, void *ptr); +diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c +index 70c0340d839cb..f12e6a0aa3c70 100644 +--- a/fs/btrfs/delayed-inode.c ++++ b/fs/btrfs/delayed-inode.c +@@ -649,7 +649,7 @@ static int btrfs_delayed_inode_reserve_metadata( + btrfs_ino(inode), + num_bytes, 1); + } else { +- btrfs_qgroup_free_meta_prealloc(root, fs_info->nodesize); ++ btrfs_qgroup_free_meta_prealloc(root, num_bytes); + } + return ret; + } +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index 0e41459b8de66..f851a1a63833d 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -3264,8 +3264,11 @@ reserve_space: + goto out; + ret = btrfs_qgroup_reserve_data(BTRFS_I(inode), &data_reserved, + alloc_start, bytes_to_reserve); +- if (ret) ++ if (ret) { ++ unlock_extent_cached(&BTRFS_I(inode)->io_tree, lockstart, ++ lockend, &cached_state); + goto out; ++ } + ret = btrfs_prealloc_file_range(inode, mode, alloc_start, + alloc_end - alloc_start, + i_blocksize(inode), +diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c +index 71d0d14bc18b3..b64b88987367c 100644 +--- a/fs/btrfs/free-space-cache.c ++++ b/fs/btrfs/free-space-cache.c +@@ -2708,8 +2708,10 @@ static void __btrfs_return_cluster_to_free_space( + struct rb_node *node; + + spin_lock(&cluster->lock); +- if (cluster->block_group != block_group) +- goto out; ++ if (cluster->block_group != block_group) { ++ spin_unlock(&cluster->lock); ++ return; ++ } + + cluster->block_group = NULL; + cluster->window_start = 0; +@@ -2747,8 +2749,6 @@ static void __btrfs_return_cluster_to_free_space( + entry->offset, &entry->offset_index, bitmap); + } + cluster->root = RB_ROOT; +- +-out: + spin_unlock(&cluster->lock); + btrfs_put_block_group(block_group); + } +@@ -3028,8 +3028,6 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group *block_group, + entry->bytes -= bytes; + } + +- if (entry->bytes == 0) +- rb_erase(&entry->offset_index, &cluster->root); + break; + } + out: +@@ -3046,7 +3044,10 @@ out: + ctl->free_space -= bytes; + if (!entry->bitmap && !btrfs_free_space_trimmed(entry)) + ctl->discardable_bytes[BTRFS_STAT_CURR] -= bytes; ++ ++ spin_lock(&cluster->lock); + if (entry->bytes == 0) { ++ rb_erase(&entry->offset_index, &cluster->root); + ctl->free_extents--; + if (entry->bitmap) { + kmem_cache_free(btrfs_free_space_bitmap_cachep, +@@ -3059,6 +3060,7 @@ out: + kmem_cache_free(btrfs_free_space_cachep, entry); + } + ++ spin_unlock(&cluster->lock); + spin_unlock(&ctl->tree_lock); + + return ret; +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index ad34c5a09befc..40ccb8ddab23a 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -9993,6 +9993,7 @@ static int btrfs_add_swapfile_pin(struct inode *inode, void *ptr, + sp->ptr = ptr; + sp->inode = inode; + sp->is_block_group = is_block_group; ++ sp->bg_extent_count = 1; + + spin_lock(&fs_info->swapfile_pins_lock); + p = &fs_info->swapfile_pins.rb_node; +@@ -10006,6 +10007,8 @@ static int btrfs_add_swapfile_pin(struct inode *inode, void *ptr, + (sp->ptr == entry->ptr && sp->inode > entry->inode)) { + p = &(*p)->rb_right; + } else { ++ if (is_block_group) ++ entry->bg_extent_count++; + spin_unlock(&fs_info->swapfile_pins_lock); + kfree(sp); + return 1; +@@ -10031,8 +10034,11 @@ static void btrfs_free_swapfile_pins(struct inode *inode) + sp = rb_entry(node, struct btrfs_swapfile_pin, node); + if (sp->inode == inode) { + rb_erase(&sp->node, &fs_info->swapfile_pins); +- if (sp->is_block_group) ++ if (sp->is_block_group) { ++ btrfs_dec_block_group_swap_extents(sp->ptr, ++ sp->bg_extent_count); + btrfs_put_block_group(sp->ptr); ++ } + kfree(sp); + } + node = next; +@@ -10093,7 +10099,8 @@ static int btrfs_swap_activate(struct swap_info_struct *sis, struct file *file, + sector_t *span) + { + struct inode *inode = file_inode(file); +- struct btrfs_fs_info *fs_info = BTRFS_I(inode)->root->fs_info; ++ struct btrfs_root *root = BTRFS_I(inode)->root; ++ struct btrfs_fs_info *fs_info = root->fs_info; + struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree; + struct extent_state *cached_state = NULL; + struct extent_map *em = NULL; +@@ -10144,13 +10151,27 @@ static int btrfs_swap_activate(struct swap_info_struct *sis, struct file *file, + "cannot activate swapfile while exclusive operation is running"); + return -EBUSY; + } ++ ++ /* ++ * Prevent snapshot creation while we are activating the swap file. ++ * We do not want to race with snapshot creation. If snapshot creation ++ * already started before we bumped nr_swapfiles from 0 to 1 and ++ * completes before the first write into the swap file after it is ++ * activated, than that write would fallback to COW. ++ */ ++ if (!btrfs_drew_try_write_lock(&root->snapshot_lock)) { ++ btrfs_exclop_finish(fs_info); ++ btrfs_warn(fs_info, ++ "cannot activate swapfile because snapshot creation is in progress"); ++ return -EINVAL; ++ } + /* + * Snapshots can create extents which require COW even if NODATACOW is + * set. We use this counter to prevent snapshots. We must increment it + * before walking the extents because we don't want a concurrent + * snapshot to run after we've already checked the extents. + */ +- atomic_inc(&BTRFS_I(inode)->root->nr_swapfiles); ++ atomic_inc(&root->nr_swapfiles); + + isize = ALIGN_DOWN(inode->i_size, fs_info->sectorsize); + +@@ -10247,6 +10268,17 @@ static int btrfs_swap_activate(struct swap_info_struct *sis, struct file *file, + goto out; + } + ++ if (!btrfs_inc_block_group_swap_extents(bg)) { ++ btrfs_warn(fs_info, ++ "block group for swapfile at %llu is read-only%s", ++ bg->start, ++ atomic_read(&fs_info->scrubs_running) ? ++ " (scrub running)" : ""); ++ btrfs_put_block_group(bg); ++ ret = -EINVAL; ++ goto out; ++ } ++ + ret = btrfs_add_swapfile_pin(inode, bg, true); + if (ret) { + btrfs_put_block_group(bg); +@@ -10285,6 +10317,8 @@ out: + if (ret) + btrfs_swap_deactivate(file); + ++ btrfs_drew_write_unlock(&root->snapshot_lock); ++ + btrfs_exclop_finish(fs_info); + + if (ret) +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index dde49a791f3e2..0a4ab121c684b 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -1926,7 +1926,10 @@ static noinline int btrfs_ioctl_snap_create_v2(struct file *file, + if (vol_args->flags & BTRFS_SUBVOL_RDONLY) + readonly = true; + if (vol_args->flags & BTRFS_SUBVOL_QGROUP_INHERIT) { +- if (vol_args->size > PAGE_SIZE) { ++ u64 nums; ++ ++ if (vol_args->size < sizeof(*inherit) || ++ vol_args->size > PAGE_SIZE) { + ret = -EINVAL; + goto free_args; + } +@@ -1935,6 +1938,20 @@ static noinline int btrfs_ioctl_snap_create_v2(struct file *file, + ret = PTR_ERR(inherit); + goto free_args; + } ++ ++ if (inherit->num_qgroups > PAGE_SIZE || ++ inherit->num_ref_copies > PAGE_SIZE || ++ inherit->num_excl_copies > PAGE_SIZE) { ++ ret = -EINVAL; ++ goto free_inherit; ++ } ++ ++ nums = inherit->num_qgroups + 2 * inherit->num_ref_copies + ++ 2 * inherit->num_excl_copies; ++ if (vol_args->size != struct_size(inherit, qgroups, nums)) { ++ ret = -EINVAL; ++ goto free_inherit; ++ } + } + + ret = __btrfs_ioctl_snap_create(file, vol_args->name, vol_args->fd, +diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c +index 93fbf87bdc8d3..123b79672c63c 100644 +--- a/fs/btrfs/raid56.c ++++ b/fs/btrfs/raid56.c +@@ -2363,16 +2363,21 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio, + SetPageUptodate(p_page); + + if (has_qstripe) { ++ /* RAID6, allocate and map temp space for the Q stripe */ + q_page = alloc_page(GFP_NOFS | __GFP_HIGHMEM); + if (!q_page) { + __free_page(p_page); + goto cleanup; + } + SetPageUptodate(q_page); ++ pointers[rbio->real_stripes - 1] = kmap(q_page); + } + + atomic_set(&rbio->error, 0); + ++ /* Map the parity stripe just once */ ++ pointers[nr_data] = kmap(p_page); ++ + for_each_set_bit(pagenr, rbio->dbitmap, rbio->stripe_npages) { + struct page *p; + void *parity; +@@ -2382,16 +2387,8 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio, + pointers[stripe] = kmap(p); + } + +- /* then add the parity stripe */ +- pointers[stripe++] = kmap(p_page); +- + if (has_qstripe) { +- /* +- * raid6, add the qstripe and call the +- * library function to fill in our p/q +- */ +- pointers[stripe++] = kmap(q_page); +- ++ /* RAID6, call the library function to fill in our P/Q */ + raid6_call.gen_syndrome(rbio->real_stripes, PAGE_SIZE, + pointers); + } else { +@@ -2412,12 +2409,14 @@ static noinline void finish_parity_scrub(struct btrfs_raid_bio *rbio, + + for (stripe = 0; stripe < nr_data; stripe++) + kunmap(page_in_rbio(rbio, stripe, pagenr, 0)); +- kunmap(p_page); + } + ++ kunmap(p_page); + __free_page(p_page); +- if (q_page) ++ if (q_page) { ++ kunmap(q_page); + __free_page(q_page); ++ } + + writeback: + /* +diff --git a/fs/btrfs/reflink.c b/fs/btrfs/reflink.c +index b03e7891394e3..a3bc721bab7c8 100644 +--- a/fs/btrfs/reflink.c ++++ b/fs/btrfs/reflink.c +@@ -550,6 +550,24 @@ process_slot: + */ + btrfs_release_path(path); + ++ /* ++ * When using NO_HOLES and we are cloning a range that covers ++ * only a hole (no extents) into a range beyond the current ++ * i_size, punching a hole in the target range will not create ++ * an extent map defining a hole, because the range starts at or ++ * beyond current i_size. If the file previously had an i_size ++ * greater than the new i_size set by this clone operation, we ++ * need to make sure the next fsync is a full fsync, so that it ++ * detects and logs a hole covering a range from the current ++ * i_size to the new i_size. If the clone range covers extents, ++ * besides a hole, then we know the full sync flag was already ++ * set by previous calls to btrfs_replace_file_extents() that ++ * replaced file extent items. ++ */ ++ if (last_dest_end >= i_size_read(inode)) ++ set_bit(BTRFS_INODE_NEEDS_FULL_SYNC, ++ &BTRFS_I(inode)->runtime_flags); ++ + ret = btrfs_replace_file_extents(inode, path, last_dest_end, + destoff + len - 1, NULL, &trans); + if (ret) +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index 5f4f88a4d2c8a..c09a494be8c68 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -3630,6 +3630,13 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx, + * commit_transactions. + */ + ro_set = 0; ++ } else if (ret == -ETXTBSY) { ++ btrfs_warn(fs_info, ++ "skipping scrub of block group %llu due to active swapfile", ++ cache->start); ++ scrub_pause_off(fs_info); ++ ret = 0; ++ goto skip_unfreeze; + } else { + btrfs_warn(fs_info, + "failed setting block group ro: %d", ret); +@@ -3719,7 +3726,7 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx, + } else { + spin_unlock(&cache->lock); + } +- ++skip_unfreeze: + btrfs_unfreeze_block_group(cache); + btrfs_put_block_group(cache); + if (ret) +diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c +index 12d7d3be7cd45..8baa806f43d76 100644 +--- a/fs/btrfs/super.c ++++ b/fs/btrfs/super.c +@@ -1919,8 +1919,8 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data) + btrfs_resize_thread_pool(fs_info, + fs_info->thread_pool_size, old_thread_pool_size); + +- if (btrfs_test_opt(fs_info, FREE_SPACE_TREE) != +- btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE) && ++ if ((bool)btrfs_test_opt(fs_info, FREE_SPACE_TREE) != ++ (bool)btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE) && + (!sb_rdonly(sb) || (*flags & SB_RDONLY))) { + btrfs_warn(fs_info, + "remount supports changing free space tree only from ro to rw"); +diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c +index 582061c7b5471..f4ade821307d7 100644 +--- a/fs/btrfs/tree-checker.c ++++ b/fs/btrfs/tree-checker.c +@@ -1453,22 +1453,14 @@ static int check_extent_data_ref(struct extent_buffer *leaf, + return -EUCLEAN; + } + for (; ptr < end; ptr += sizeof(*dref)) { +- u64 root_objectid; +- u64 owner; + u64 offset; +- u64 hash; + ++ /* ++ * We cannot check the extent_data_ref hash due to possible ++ * overflow from the leaf due to hash collisions. ++ */ + dref = (struct btrfs_extent_data_ref *)ptr; +- root_objectid = btrfs_extent_data_ref_root(leaf, dref); +- owner = btrfs_extent_data_ref_objectid(leaf, dref); + offset = btrfs_extent_data_ref_offset(leaf, dref); +- hash = hash_extent_data_ref(root_objectid, owner, offset); +- if (unlikely(hash != key->offset)) { +- extent_err(leaf, slot, +- "invalid extent data ref hash, item has 0x%016llx key has 0x%016llx", +- hash, key->offset); +- return -EUCLEAN; +- } + if (unlikely(!IS_ALIGNED(offset, leaf->fs_info->sectorsize))) { + extent_err(leaf, slot, + "invalid extent data backref offset, have %llu expect aligned to %u", +diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c +index af6246f36a9e5..03135dbb318a5 100644 +--- a/fs/btrfs/xattr.c ++++ b/fs/btrfs/xattr.c +@@ -229,11 +229,33 @@ int btrfs_setxattr_trans(struct inode *inode, const char *name, + { + struct btrfs_root *root = BTRFS_I(inode)->root; + struct btrfs_trans_handle *trans; ++ const bool start_trans = (current->journal_info == NULL); + int ret; + +- trans = btrfs_start_transaction(root, 2); +- if (IS_ERR(trans)) +- return PTR_ERR(trans); ++ if (start_trans) { ++ /* ++ * 1 unit for inserting/updating/deleting the xattr ++ * 1 unit for the inode item update ++ */ ++ trans = btrfs_start_transaction(root, 2); ++ if (IS_ERR(trans)) ++ return PTR_ERR(trans); ++ } else { ++ /* ++ * This can happen when smack is enabled and a directory is being ++ * created. It happens through d_instantiate_new(), which calls ++ * smack_d_instantiate(), which in turn calls __vfs_setxattr() to ++ * set the transmute xattr (XATTR_NAME_SMACKTRANSMUTE) on the ++ * inode. We have already reserved space for the xattr and inode ++ * update at btrfs_mkdir(), so just use the transaction handle. ++ * We don't join or start a transaction, as that will reset the ++ * block_rsv of the handle and trigger a warning for the start ++ * case. ++ */ ++ ASSERT(strncmp(name, XATTR_SECURITY_PREFIX, ++ XATTR_SECURITY_PREFIX_LEN) == 0); ++ trans = current->journal_info; ++ } + + ret = btrfs_setxattr(trans, inode, name, value, size, flags); + if (ret) +@@ -244,7 +266,8 @@ int btrfs_setxattr_trans(struct inode *inode, const char *name, + ret = btrfs_update_inode(trans, root, BTRFS_I(inode)); + BUG_ON(ret); + out: +- btrfs_end_transaction(trans); ++ if (start_trans) ++ btrfs_end_transaction(trans); + return ret; + } + +diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c +index c388466590191..2f80de4403595 100644 +--- a/fs/btrfs/zoned.c ++++ b/fs/btrfs/zoned.c +@@ -152,7 +152,7 @@ int btrfs_get_dev_zone_info(struct btrfs_device *device) + sector_t sector = 0; + struct blk_zone *zones = NULL; + unsigned int i, nreported = 0, nr_zones; +- unsigned int zone_sectors; ++ sector_t zone_sectors; + int ret; + + if (!bdev_is_zoned(bdev)) +@@ -485,7 +485,7 @@ int btrfs_sb_log_location_bdev(struct block_device *bdev, int mirror, int rw, + u64 *bytenr_ret) + { + struct blk_zone zones[BTRFS_NR_SB_LOG_ZONES]; +- unsigned int zone_sectors; ++ sector_t zone_sectors; + u32 sb_zone; + int ret; + u64 zone_size; +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 4d0ede0418571..38bfd168ad3b7 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -5316,6 +5316,9 @@ static void __io_queue_proc(struct io_poll_iocb *poll, struct io_poll_table *pt, + pt->error = -EINVAL; + return; + } ++ /* double add on the same waitqueue head, ignore */ ++ if (poll->head == head) ++ return; + poll = kmalloc(sizeof(*poll), GFP_ATOMIC); + if (!poll) { + pt->error = -ENOMEM; +diff --git a/include/crypto/hash.h b/include/crypto/hash.h +index af2ff31ff619f..13f8a6a54ca87 100644 +--- a/include/crypto/hash.h ++++ b/include/crypto/hash.h +@@ -149,7 +149,7 @@ struct ahash_alg { + + struct shash_desc { + struct crypto_shash *tfm; +- void *__ctx[] CRYPTO_MINALIGN_ATTR; ++ void *__ctx[] __aligned(ARCH_SLAB_MINALIGN); + }; + + #define HASH_MAX_DIGESTSIZE 64 +@@ -162,9 +162,9 @@ struct shash_desc { + + #define HASH_MAX_STATESIZE 512 + +-#define SHASH_DESC_ON_STACK(shash, ctx) \ +- char __##shash##_desc[sizeof(struct shash_desc) + \ +- HASH_MAX_DESCSIZE] CRYPTO_MINALIGN_ATTR; \ ++#define SHASH_DESC_ON_STACK(shash, ctx) \ ++ char __##shash##_desc[sizeof(struct shash_desc) + HASH_MAX_DESCSIZE] \ ++ __aligned(__alignof__(struct shash_desc)); \ + struct shash_desc *shash = (struct shash_desc *)__##shash##_desc + + /** +diff --git a/include/linux/crypto.h b/include/linux/crypto.h +index ef90e07c9635c..e3abd1f8646a1 100644 +--- a/include/linux/crypto.h ++++ b/include/linux/crypto.h +@@ -151,9 +151,12 @@ + * The macro CRYPTO_MINALIGN_ATTR (along with the void * type in the actual + * declaration) is used to ensure that the crypto_tfm context structure is + * aligned correctly for the given architecture so that there are no alignment +- * faults for C data types. In particular, this is required on platforms such +- * as arm where pointers are 32-bit aligned but there are data types such as +- * u64 which require 64-bit alignment. ++ * faults for C data types. On architectures that support non-cache coherent ++ * DMA, such as ARM or arm64, it also takes into account the minimal alignment ++ * that is required to ensure that the context struct member does not share any ++ * cachelines with the rest of the struct. This is needed to ensure that cache ++ * maintenance for non-coherent DMA (cache invalidation in particular) does not ++ * affect data that may be accessed by the CPU concurrently. + */ + #define CRYPTO_MINALIGN ARCH_KMALLOC_MINALIGN + +diff --git a/include/sound/intel-nhlt.h b/include/sound/intel-nhlt.h +index 743c2f4422806..d0574805865f9 100644 +--- a/include/sound/intel-nhlt.h ++++ b/include/sound/intel-nhlt.h +@@ -112,6 +112,11 @@ struct nhlt_vendor_dmic_array_config { + /* TODO add vendor mic config */ + } __packed; + ++enum { ++ NHLT_CONFIG_TYPE_GENERIC = 0, ++ NHLT_CONFIG_TYPE_MIC_ARRAY = 1 ++}; ++ + enum { + NHLT_MIC_ARRAY_2CH_SMALL = 0xa, + NHLT_MIC_ARRAY_2CH_BIG = 0xb, +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index ec08f948dd80e..063f8ea6aad97 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -2821,6 +2821,17 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer, + write_stamp, write_stamp - delta)) + return 0; + ++ /* ++ * It's possible that the event time delta is zero ++ * (has the same time stamp as the previous event) ++ * in which case write_stamp and before_stamp could ++ * be the same. In such a case, force before_stamp ++ * to be different than write_stamp. It doesn't ++ * matter what it is, as long as its different. ++ */ ++ if (!delta) ++ rb_time_set(&cpu_buffer->before_stamp, 0); ++ + /* + * If an event were to come in now, it would see that the + * write_stamp and the before_stamp are different, and assume +diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c +index b9c2ee7ab43fa..cce12e1971d85 100644 +--- a/scripts/recordmcount.c ++++ b/scripts/recordmcount.c +@@ -438,7 +438,7 @@ static int arm_is_fake_mcount(Elf32_Rel const *rp) + + static int arm64_is_fake_mcount(Elf64_Rel const *rp) + { +- return ELF64_R_TYPE(w(rp->r_info)) != R_AARCH64_CALL26; ++ return ELF64_R_TYPE(w8(rp->r_info)) != R_AARCH64_CALL26; + } + + /* 64-bit EM_MIPS has weird ELF64_Rela.r_info. +diff --git a/security/tomoyo/network.c b/security/tomoyo/network.c +index a89ed55d85d41..478f757ff8435 100644 +--- a/security/tomoyo/network.c ++++ b/security/tomoyo/network.c +@@ -613,7 +613,7 @@ static int tomoyo_check_unix_address(struct sockaddr *addr, + static bool tomoyo_kernel_service(void) + { + /* Nothing to do if I am a kernel service. */ +- return uaccess_kernel(); ++ return (current->flags & (PF_KTHREAD | PF_IO_WORKER)) == PF_KTHREAD; + } + + /** +diff --git a/sound/hda/intel-nhlt.c b/sound/hda/intel-nhlt.c +index 059aaf04f536a..d053beccfaec3 100644 +--- a/sound/hda/intel-nhlt.c ++++ b/sound/hda/intel-nhlt.c +@@ -31,18 +31,44 @@ int intel_nhlt_get_dmic_geo(struct device *dev, struct nhlt_acpi_table *nhlt) + struct nhlt_endpoint *epnt; + struct nhlt_dmic_array_config *cfg; + struct nhlt_vendor_dmic_array_config *cfg_vendor; ++ struct nhlt_fmt *fmt_configs; + unsigned int dmic_geo = 0; +- u8 j; ++ u16 max_ch = 0; ++ u8 i, j; + + if (!nhlt) + return 0; + +- epnt = (struct nhlt_endpoint *)nhlt->desc; ++ for (j = 0, epnt = nhlt->desc; j < nhlt->endpoint_count; j++, ++ epnt = (struct nhlt_endpoint *)((u8 *)epnt + epnt->length)) { + +- for (j = 0; j < nhlt->endpoint_count; j++) { +- if (epnt->linktype == NHLT_LINK_DMIC) { +- cfg = (struct nhlt_dmic_array_config *) +- (epnt->config.caps); ++ if (epnt->linktype != NHLT_LINK_DMIC) ++ continue; ++ ++ cfg = (struct nhlt_dmic_array_config *)(epnt->config.caps); ++ fmt_configs = (struct nhlt_fmt *)(epnt->config.caps + epnt->config.size); ++ ++ /* find max number of channels based on format_configuration */ ++ if (fmt_configs->fmt_count) { ++ dev_dbg(dev, "%s: found %d format definitions\n", ++ __func__, fmt_configs->fmt_count); ++ ++ for (i = 0; i < fmt_configs->fmt_count; i++) { ++ struct wav_fmt_ext *fmt_ext; ++ ++ fmt_ext = &fmt_configs->fmt_config[i].fmt_ext; ++ ++ if (fmt_ext->fmt.channels > max_ch) ++ max_ch = fmt_ext->fmt.channels; ++ } ++ dev_dbg(dev, "%s: max channels found %d\n", __func__, max_ch); ++ } else { ++ dev_dbg(dev, "%s: No format information found\n", __func__); ++ } ++ ++ if (cfg->device_config.config_type != NHLT_CONFIG_TYPE_MIC_ARRAY) { ++ dmic_geo = max_ch; ++ } else { + switch (cfg->array_type) { + case NHLT_MIC_ARRAY_2CH_SMALL: + case NHLT_MIC_ARRAY_2CH_BIG: +@@ -59,13 +85,23 @@ int intel_nhlt_get_dmic_geo(struct device *dev, struct nhlt_acpi_table *nhlt) + dmic_geo = cfg_vendor->nb_mics; + break; + default: +- dev_warn(dev, "undefined DMIC array_type 0x%0x\n", +- cfg->array_type); ++ dev_warn(dev, "%s: undefined DMIC array_type 0x%0x\n", ++ __func__, cfg->array_type); ++ } ++ ++ if (dmic_geo > 0) { ++ dev_dbg(dev, "%s: Array with %d dmics\n", __func__, dmic_geo); ++ } ++ if (max_ch > dmic_geo) { ++ dev_dbg(dev, "%s: max channels %d exceed dmic number %d\n", ++ __func__, max_ch, dmic_geo); + } + } +- epnt = (struct nhlt_endpoint *)((u8 *)epnt + epnt->length); + } + ++ dev_dbg(dev, "%s: dmic number %d max_ch %d\n", ++ __func__, dmic_geo, max_ch); ++ + return dmic_geo; + } + EXPORT_SYMBOL_GPL(intel_nhlt_get_dmic_geo); +diff --git a/sound/pci/ctxfi/cthw20k2.c b/sound/pci/ctxfi/cthw20k2.c +index fc1bc18caee98..85d1fc76f59e1 100644 +--- a/sound/pci/ctxfi/cthw20k2.c ++++ b/sound/pci/ctxfi/cthw20k2.c +@@ -991,7 +991,7 @@ static int daio_mgr_dao_init(void *blk, unsigned int idx, unsigned int conf) + + if (idx < 4) { + /* S/PDIF output */ +- switch ((conf & 0x7)) { ++ switch ((conf & 0xf)) { + case 1: + set_field(&ctl->txctl[idx], ATXCTL_NUC, 0); + break; +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 5f4f8c2d760f0..b47504fa8dfd0 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6408,6 +6408,7 @@ enum { + ALC236_FIXUP_DELL_AIO_HEADSET_MIC, + ALC282_FIXUP_ACER_DISABLE_LINEOUT, + ALC255_FIXUP_ACER_LIMIT_INT_MIC_BOOST, ++ ALC256_FIXUP_ACER_HEADSET_MIC, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -7864,6 +7865,16 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC255_FIXUP_ACER_MIC_NO_PRESENCE, + }, ++ [ALC256_FIXUP_ACER_HEADSET_MIC] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x02a1113c }, /* use as headset mic, without its own jack detect */ ++ { 0x1a, 0x90a1092f }, /* use as internal mic */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -7890,9 +7901,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x1246, "Acer Predator Helios 500", ALC299_FIXUP_PREDATOR_SPK), + SND_PCI_QUIRK(0x1025, 0x1247, "Acer vCopperbox", ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS), + SND_PCI_QUIRK(0x1025, 0x1248, "Acer Veriton N4660G", ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1025, 0x1269, "Acer SWIFT SF314-54", ALC256_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1025, 0x129c, "Acer SWIFT SF314-55", ALC256_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC), +diff --git a/sound/usb/clock.c b/sound/usb/clock.c +index dc68ed65e4787..771b652329571 100644 +--- a/sound/usb/clock.c ++++ b/sound/usb/clock.c +@@ -646,10 +646,10 @@ static int set_sample_rate_v2v3(struct snd_usb_audio *chip, + cur_rate = prev_rate; + + if (cur_rate != rate) { +- usb_audio_warn(chip, +- "%d:%d: freq mismatch (RO clock): req %d, clock runs @%d\n", +- fmt->iface, fmt->altsetting, rate, cur_rate); +- return -ENXIO; ++ usb_audio_dbg(chip, ++ "%d:%d: freq mismatch: req %d, clock runs @%d\n", ++ fmt->iface, fmt->altsetting, rate, cur_rate); ++ /* continue processing */ + } + + validation: +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 12b15ed59eaa1..d5bdc9c4f452b 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -1301,6 +1301,17 @@ no_res_check: + /* totally crap, return an error */ + return -EINVAL; + } ++ } else { ++ /* if the max volume is too low, it's likely a bogus range; ++ * here we use -96dB as the threshold ++ */ ++ if (cval->dBmax <= -9600) { ++ usb_audio_info(cval->head.mixer->chip, ++ "%d:%d: bogus dB values (%d/%d), disabling dB reporting\n", ++ cval->head.id, mixer_ctrl_intf(cval->head.mixer), ++ cval->dBmin, cval->dBmax); ++ cval->dBmin = cval->dBmax = 0; ++ } + } + + return 0; +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index a7212f16660ec..646deb6244b15 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -536,6 +536,16 @@ static const struct usbmix_ctl_map usbmix_ctl_maps[] = { + .id = USB_ID(0x05a7, 0x1020), + .map = bose_companion5_map, + }, ++ { ++ /* Corsair Virtuoso SE (wired mode) */ ++ .id = USB_ID(0x1b1c, 0x0a3d), ++ .map = corsair_virtuoso_map, ++ }, ++ { ++ /* Corsair Virtuoso SE (wireless mode) */ ++ .id = USB_ID(0x1b1c, 0x0a3e), ++ .map = corsair_virtuoso_map, ++ }, + { + /* Corsair Virtuoso (wired mode) */ + .id = USB_ID(0x1b1c, 0x0a41), +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index bf5a0f3c1fade..e5311b6bb3f65 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -845,13 +845,19 @@ get_sync_ep_from_substream(struct snd_usb_substream *subs) + + list_for_each_entry(fp, &subs->fmt_list, list) { + ep = snd_usb_get_endpoint(chip, fp->endpoint); +- if (ep && ep->cur_rate) +- return ep; ++ if (ep && ep->cur_audiofmt) { ++ /* if EP is already opened solely for this substream, ++ * we still allow us to change the parameter; otherwise ++ * this substream has to follow the existing parameter ++ */ ++ if (ep->cur_audiofmt != subs->cur_audiofmt || ep->opened > 1) ++ return ep; ++ } + if (!fp->implicit_fb) + continue; + /* for the implicit fb, check the sync ep as well */ + ep = snd_usb_get_endpoint(chip, fp->sync_ep); +- if (ep && ep->cur_rate) ++ if (ep && ep->cur_audiofmt) + return ep; + } + return NULL; +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 9ba4682ebc482..737b2729c0d37 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1482,7 +1482,7 @@ static int pioneer_djm_set_format_quirk(struct snd_usb_substream *subs, + usb_set_interface(subs->dev, 0, 1); + // we should derive windex from fmt-sync_ep but it's not set + snd_usb_ctl_msg(subs->stream->chip->dev, +- usb_rcvctrlpipe(subs->stream->chip->dev, 0), ++ usb_sndctrlpipe(subs->stream->chip->dev, 0), + 0x01, 0x22, 0x0100, windex, &sr, 0x0003); + return 0; + } diff --git a/patch/kernel/sunxi-dev/patch-5.11.5-6.patch b/patch/kernel/sunxi-dev/patch-5.11.5-6.patch new file mode 100644 index 0000000000..a69ad3b428 --- /dev/null +++ b/patch/kernel/sunxi-dev/patch-5.11.5-6.patch @@ -0,0 +1,2204 @@ +diff --git a/Makefile b/Makefile +index 1673c12fb4b35..472136a7881e6 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 11 +-SUBLEVEL = 5 ++SUBLEVEL = 6 + EXTRAVERSION = + NAME = 💕 Valentine's Day Edition 💕 + +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index 3dfb25afa616f..e42da99db91fc 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -952,8 +952,9 @@ choice + that is selected here. + + config CPU_BIG_ENDIAN +- bool "Build big-endian kernel" +- help ++ bool "Build big-endian kernel" ++ depends on !LD_IS_LLD || LLD_VERSION >= 130000 ++ help + Say Y if you plan on running a kernel with a big-endian userspace. + + config CPU_LITTLE_ENDIAN +diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig +index 278462186ac47..22cf9da1e4a77 100644 +--- a/arch/parisc/Kconfig ++++ b/arch/parisc/Kconfig +@@ -201,9 +201,12 @@ config PREFETCH + def_bool y + depends on PA8X00 || PA7200 + ++config PARISC_HUGE_KERNEL ++ def_bool y if !MODULES || UBSAN || FTRACE || COMPILE_TEST ++ + config MLONGCALLS +- def_bool y if !MODULES || UBSAN || FTRACE +- bool "Enable the -mlong-calls compiler option for big kernels" if MODULES && !UBSAN && !FTRACE ++ def_bool y if PARISC_HUGE_KERNEL ++ bool "Enable the -mlong-calls compiler option for big kernels" if !PARISC_HUGE_KERNEL + depends on PA8X00 + help + If you configure the kernel to include many drivers built-in instead +diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c +index 825ef6d281c98..6a0670548125f 100644 +--- a/arch/x86/kvm/svm/svm.c ++++ b/arch/x86/kvm/svm/svm.c +@@ -1205,6 +1205,7 @@ static void init_vmcb(struct vcpu_svm *svm) + init_sys_seg(&save->ldtr, SEG_TYPE_LDT); + init_sys_seg(&save->tr, SEG_TYPE_BUSY_TSS16); + ++ svm_set_cr4(&svm->vcpu, 0); + svm_set_efer(&svm->vcpu, 0); + save->dr6 = 0xffff0ff0; + kvm_set_rflags(&svm->vcpu, 2); +diff --git a/drivers/acpi/acpica/acobject.h b/drivers/acpi/acpica/acobject.h +index 9f0219a8cb985..dd7efafcb1034 100644 +--- a/drivers/acpi/acpica/acobject.h ++++ b/drivers/acpi/acpica/acobject.h +@@ -284,6 +284,7 @@ struct acpi_object_addr_handler { + acpi_adr_space_handler handler; + struct acpi_namespace_node *node; /* Parent device */ + void *context; ++ acpi_mutex context_mutex; + acpi_adr_space_setup setup; + union acpi_operand_object *region_list; /* Regions using this handler */ + union acpi_operand_object *next; +diff --git a/drivers/acpi/acpica/evhandler.c b/drivers/acpi/acpica/evhandler.c +index 5884eba047f73..3438dc187efb6 100644 +--- a/drivers/acpi/acpica/evhandler.c ++++ b/drivers/acpi/acpica/evhandler.c +@@ -489,6 +489,13 @@ acpi_ev_install_space_handler(struct acpi_namespace_node *node, + + /* Init handler obj */ + ++ status = ++ acpi_os_create_mutex(&handler_obj->address_space.context_mutex); ++ if (ACPI_FAILURE(status)) { ++ acpi_ut_remove_reference(handler_obj); ++ goto unlock_and_exit; ++ } ++ + handler_obj->address_space.space_id = (u8)space_id; + handler_obj->address_space.handler_flags = flags; + handler_obj->address_space.region_list = NULL; +diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c +index a8a4c8c9b9efa..7701ae67e091a 100644 +--- a/drivers/acpi/acpica/evregion.c ++++ b/drivers/acpi/acpica/evregion.c +@@ -112,6 +112,8 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + union acpi_operand_object *region_obj2; + void *region_context = NULL; + struct acpi_connection_info *context; ++ acpi_mutex context_mutex; ++ u8 context_locked; + acpi_physical_address address; + + ACPI_FUNCTION_TRACE(ev_address_space_dispatch); +@@ -136,6 +138,8 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + } + + context = handler_desc->address_space.context; ++ context_mutex = handler_desc->address_space.context_mutex; ++ context_locked = FALSE; + + /* + * It may be the case that the region has never been initialized. +@@ -204,6 +208,23 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + handler = handler_desc->address_space.handler; + address = (region_obj->region.address + region_offset); + ++ ACPI_DEBUG_PRINT((ACPI_DB_OPREGION, ++ "Handler %p (@%p) Address %8.8X%8.8X [%s]\n", ++ ®ion_obj->region.handler->address_space, handler, ++ ACPI_FORMAT_UINT64(address), ++ acpi_ut_get_region_name(region_obj->region. ++ space_id))); ++ ++ if (!(handler_desc->address_space.handler_flags & ++ ACPI_ADDR_HANDLER_DEFAULT_INSTALLED)) { ++ /* ++ * For handlers other than the default (supplied) handlers, we must ++ * exit the interpreter because the handler *might* block -- we don't ++ * know what it will do, so we can't hold the lock on the interpreter. ++ */ ++ acpi_ex_exit_interpreter(); ++ } ++ + /* + * Special handling for generic_serial_bus and general_purpose_io: + * There are three extra parameters that must be passed to the +@@ -212,6 +233,11 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + * 2) Length of the above buffer + * 3) Actual access length from the access_as() op + * ++ * Since we pass these extra parameters via the context, which is ++ * shared between threads, we must lock the context to avoid these ++ * parameters being changed from another thread before the handler ++ * has completed running. ++ * + * In addition, for general_purpose_io, the Address and bit_width fields + * are defined as follows: + * 1) Address is the pin number index of the field (bit offset from +@@ -221,6 +247,14 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + if ((region_obj->region.space_id == ACPI_ADR_SPACE_GSBUS) && + context && field_obj) { + ++ status = ++ acpi_os_acquire_mutex(context_mutex, ACPI_WAIT_FOREVER); ++ if (ACPI_FAILURE(status)) { ++ goto re_enter_interpreter; ++ } ++ ++ context_locked = TRUE; ++ + /* Get the Connection (resource_template) buffer */ + + context->connection = field_obj->field.resource_buffer; +@@ -230,6 +264,14 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + if ((region_obj->region.space_id == ACPI_ADR_SPACE_GPIO) && + context && field_obj) { + ++ status = ++ acpi_os_acquire_mutex(context_mutex, ACPI_WAIT_FOREVER); ++ if (ACPI_FAILURE(status)) { ++ goto re_enter_interpreter; ++ } ++ ++ context_locked = TRUE; ++ + /* Get the Connection (resource_template) buffer */ + + context->connection = field_obj->field.resource_buffer; +@@ -239,28 +281,15 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + bit_width = field_obj->field.bit_length; + } + +- ACPI_DEBUG_PRINT((ACPI_DB_OPREGION, +- "Handler %p (@%p) Address %8.8X%8.8X [%s]\n", +- ®ion_obj->region.handler->address_space, handler, +- ACPI_FORMAT_UINT64(address), +- acpi_ut_get_region_name(region_obj->region. +- space_id))); +- +- if (!(handler_desc->address_space.handler_flags & +- ACPI_ADDR_HANDLER_DEFAULT_INSTALLED)) { +- /* +- * For handlers other than the default (supplied) handlers, we must +- * exit the interpreter because the handler *might* block -- we don't +- * know what it will do, so we can't hold the lock on the interpreter. +- */ +- acpi_ex_exit_interpreter(); +- } +- + /* Call the handler */ + + status = handler(function, address, bit_width, value, context, + region_obj2->extra.region_context); + ++ if (context_locked) { ++ acpi_os_release_mutex(context_mutex); ++ } ++ + if (ACPI_FAILURE(status)) { + ACPI_EXCEPTION((AE_INFO, status, "Returned by Handler for [%s]", + acpi_ut_get_region_name(region_obj->region. +@@ -277,6 +306,7 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj, + } + } + ++re_enter_interpreter: + if (!(handler_desc->address_space.handler_flags & + ACPI_ADDR_HANDLER_DEFAULT_INSTALLED)) { + /* +diff --git a/drivers/acpi/acpica/evxfregn.c b/drivers/acpi/acpica/evxfregn.c +index da97fd0c6b51e..3bb06f17a18b6 100644 +--- a/drivers/acpi/acpica/evxfregn.c ++++ b/drivers/acpi/acpica/evxfregn.c +@@ -201,6 +201,8 @@ acpi_remove_address_space_handler(acpi_handle device, + + /* Now we can delete the handler object */ + ++ acpi_os_release_mutex(handler_obj->address_space. ++ context_mutex); + acpi_ut_remove_reference(handler_obj); + goto unlock_and_exit; + } +diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +index a5af223eaf501..81506d2539b07 100644 +--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +@@ -626,8 +626,6 @@ static int a5xx_hw_init(struct msm_gpu *gpu) + if (adreno_gpu->info->quirks & ADRENO_QUIRK_TWO_PASS_USE_WFI) + gpu_rmw(gpu, REG_A5XX_PC_DBG_ECO_CNTL, 0, (1 << 8)); + +- gpu_write(gpu, REG_A5XX_PC_DBG_ECO_CNTL, 0xc0200100); +- + /* Enable USE_RETENTION_FLOPS */ + gpu_write(gpu, REG_A5XX_CP_CHICKEN_DBG, 0x02000000); + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 5ba0aa1d23353..b60279aaed438 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -641,6 +641,8 @@ + #define USB_DEVICE_ID_INNEX_GENESIS_ATARI 0x4745 + + #define USB_VENDOR_ID_ITE 0x048d ++#define I2C_VENDOR_ID_ITE 0x103c ++#define I2C_DEVICE_ID_ITE_VOYO_WINPAD_A15 0x184f + #define USB_DEVICE_ID_ITE_LENOVO_YOGA 0x8386 + #define USB_DEVICE_ID_ITE_LENOVO_YOGA2 0x8350 + #define I2C_DEVICE_ID_ITE_LENOVO_LEGION_Y720 0x837a +diff --git a/drivers/hid/hid-ite.c b/drivers/hid/hid-ite.c +index 22bfbebceaf44..14fc068affada 100644 +--- a/drivers/hid/hid-ite.c ++++ b/drivers/hid/hid-ite.c +@@ -23,11 +23,16 @@ static __u8 *ite_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int + hid_info(hdev, "Fixing up Acer Sw5-012 ITE keyboard report descriptor\n"); + rdesc[163] = HID_MAIN_ITEM_RELATIVE; + } +- /* For Acer One S1002 keyboard-dock */ ++ /* For Acer One S1002/S1003 keyboard-dock */ + if (*rsize == 188 && rdesc[185] == 0x81 && rdesc[186] == 0x02) { +- hid_info(hdev, "Fixing up Acer S1002 ITE keyboard report descriptor\n"); ++ hid_info(hdev, "Fixing up Acer S1002/S1003 ITE keyboard report descriptor\n"); + rdesc[186] = HID_MAIN_ITEM_RELATIVE; + } ++ /* For Acer Aspire Switch 10E (SW3-016) keyboard-dock */ ++ if (*rsize == 210 && rdesc[184] == 0x81 && rdesc[185] == 0x02) { ++ hid_info(hdev, "Fixing up Acer Aspire Switch 10E (SW3-016) ITE keyboard report descriptor\n"); ++ rdesc[185] = HID_MAIN_ITEM_RELATIVE; ++ } + } + + return rdesc; +@@ -114,7 +119,8 @@ static const struct hid_device_id ite_devices[] = { + /* ITE8910 USB kbd ctlr, with Synaptics touchpad connected to it. */ + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_SYNAPTICS, +- USB_DEVICE_ID_SYNAPTICS_ACER_ONE_S1003) }, ++ USB_DEVICE_ID_SYNAPTICS_ACER_ONE_S1003), ++ .driver_data = QUIRK_TOUCHPAD_ON_OFF_REPORT }, + { } + }; + MODULE_DEVICE_TABLE(hid, ite_devices); +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index bfe716d7ea441..c586acf2fc0b4 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -171,6 +171,8 @@ static const struct i2c_hid_quirks { + I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV }, + { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288, + I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, ++ { I2C_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_VOYO_WINPAD_A15, ++ I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, + { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118, + I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, + { USB_VENDOR_ID_ELAN, HID_ANY_ID, +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index f0adbc48fd179..9256f84f5ebf1 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -1502,6 +1502,10 @@ static bool increase_address_space(struct protection_domain *domain, + bool ret = true; + u64 *pte; + ++ pte = (void *)get_zeroed_page(gfp); ++ if (!pte) ++ return false; ++ + spin_lock_irqsave(&domain->lock, flags); + + amd_iommu_domain_get_pgtable(domain, &pgtable); +@@ -1513,10 +1517,6 @@ static bool increase_address_space(struct protection_domain *domain, + if (WARN_ON_ONCE(pgtable.mode == PAGE_MODE_6_LEVEL)) + goto out; + +- pte = (void *)get_zeroed_page(gfp); +- if (!pte) +- goto out; +- + *pte = PM_LEVEL_PDE(pgtable.mode, iommu_virt_to_phys(pgtable.root)); + + pgtable.root = pte; +@@ -1530,10 +1530,12 @@ static bool increase_address_space(struct protection_domain *domain, + */ + amd_iommu_domain_set_pgtable(domain, pte, pgtable.mode); + ++ pte = NULL; + ret = true; + + out: + spin_unlock_irqrestore(&domain->lock, flags); ++ free_page((unsigned long)pte); + + return ret; + } +diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c +index d92c4d2c521a3..6e5f544c9c737 100644 +--- a/drivers/misc/eeprom/eeprom_93xx46.c ++++ b/drivers/misc/eeprom/eeprom_93xx46.c +@@ -35,6 +35,10 @@ static const struct eeprom_93xx46_devtype_data atmel_at93c46d_data = { + EEPROM_93XX46_QUIRK_INSTRUCTION_LENGTH, + }; + ++static const struct eeprom_93xx46_devtype_data microchip_93lc46b_data = { ++ .quirks = EEPROM_93XX46_QUIRK_EXTRA_READ_CYCLE, ++}; ++ + struct eeprom_93xx46_dev { + struct spi_device *spi; + struct eeprom_93xx46_platform_data *pdata; +@@ -55,6 +59,11 @@ static inline bool has_quirk_instruction_length(struct eeprom_93xx46_dev *edev) + return edev->pdata->quirks & EEPROM_93XX46_QUIRK_INSTRUCTION_LENGTH; + } + ++static inline bool has_quirk_extra_read_cycle(struct eeprom_93xx46_dev *edev) ++{ ++ return edev->pdata->quirks & EEPROM_93XX46_QUIRK_EXTRA_READ_CYCLE; ++} ++ + static int eeprom_93xx46_read(void *priv, unsigned int off, + void *val, size_t count) + { +@@ -96,6 +105,11 @@ static int eeprom_93xx46_read(void *priv, unsigned int off, + dev_dbg(&edev->spi->dev, "read cmd 0x%x, %d Hz\n", + cmd_addr, edev->spi->max_speed_hz); + ++ if (has_quirk_extra_read_cycle(edev)) { ++ cmd_addr <<= 1; ++ bits += 1; ++ } ++ + spi_message_init(&m); + + t[0].tx_buf = (char *)&cmd_addr; +@@ -363,6 +377,7 @@ static void select_deassert(void *context) + static const struct of_device_id eeprom_93xx46_of_table[] = { + { .compatible = "eeprom-93xx46", }, + { .compatible = "atmel,at93c46d", .data = &atmel_at93c46d_data, }, ++ { .compatible = "microchip,93lc46b", .data = µchip_93lc46b_data, }, + {} + }; + MODULE_DEVICE_TABLE(of, eeprom_93xx46_of_table); +diff --git a/drivers/mmc/host/sdhci-of-dwcmshc.c b/drivers/mmc/host/sdhci-of-dwcmshc.c +index d90020ed36227..59d8d96ce206b 100644 +--- a/drivers/mmc/host/sdhci-of-dwcmshc.c ++++ b/drivers/mmc/host/sdhci-of-dwcmshc.c +@@ -112,6 +112,7 @@ static const struct sdhci_ops sdhci_dwcmshc_ops = { + static const struct sdhci_pltfm_data sdhci_dwcmshc_pdata = { + .ops = &sdhci_dwcmshc_ops, + .quirks = SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN, ++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, + }; + + static int dwcmshc_probe(struct platform_device *pdev) +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 6bad4d4dcdf07..806a5d071ef65 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3230,7 +3230,8 @@ static const struct pci_device_id nvme_id_table[] = { + { PCI_DEVICE(0x126f, 0x2263), /* Silicon Motion unidentified */ + .driver_data = NVME_QUIRK_NO_NS_DESC_LIST, }, + { PCI_DEVICE(0x1bb1, 0x0100), /* Seagate Nytro Flash Storage */ +- .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, }, ++ .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY | ++ NVME_QUIRK_NO_NS_DESC_LIST, }, + { PCI_DEVICE(0x1c58, 0x0003), /* HGST adapter */ + .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, }, + { PCI_DEVICE(0x1c58, 0x0023), /* WDC SN200 adapter */ +@@ -3244,6 +3245,9 @@ static const struct pci_device_id nvme_id_table[] = { + NVME_QUIRK_IGNORE_DEV_SUBNQN, }, + { PCI_DEVICE(0x1987, 0x5016), /* Phison E16 */ + .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, }, ++ { PCI_DEVICE(0x1b4b, 0x1092), /* Lexar 256 GB SSD */ ++ .driver_data = NVME_QUIRK_NO_NS_DESC_LIST | ++ NVME_QUIRK_IGNORE_DEV_SUBNQN, }, + { PCI_DEVICE(0x1d1d, 0x1f1f), /* LighNVM qemu device */ + .driver_data = NVME_QUIRK_LIGHTNVM, }, + { PCI_DEVICE(0x1d1d, 0x2807), /* CNEX WL */ +@@ -3261,6 +3265,8 @@ static const struct pci_device_id nvme_id_table[] = { + .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, }, + { PCI_DEVICE(0x1d97, 0x2263), /* SPCC */ + .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, }, ++ { PCI_DEVICE(0x2646, 0x2262), /* KINGSTON SKC2000 NVMe SSD */ ++ .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, + { PCI_DEVICE(0x2646, 0x2263), /* KINGSTON A2000 NVMe SSD */ + .driver_data = NVME_QUIRK_NO_DEEPEST_PS, }, + { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001), +diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c +index dac1ac8a76159..849f1e416ea57 100644 +--- a/drivers/pci/controller/cadence/pci-j721e.c ++++ b/drivers/pci/controller/cadence/pci-j721e.c +@@ -64,6 +64,7 @@ enum j721e_pcie_mode { + + struct j721e_pcie_data { + enum j721e_pcie_mode mode; ++ bool quirk_retrain_flag; + }; + + static inline u32 j721e_pcie_user_readl(struct j721e_pcie *pcie, u32 offset) +@@ -280,6 +281,7 @@ static struct pci_ops cdns_ti_pcie_host_ops = { + + static const struct j721e_pcie_data j721e_pcie_rc_data = { + .mode = PCI_MODE_RC, ++ .quirk_retrain_flag = true, + }; + + static const struct j721e_pcie_data j721e_pcie_ep_data = { +@@ -388,6 +390,7 @@ static int j721e_pcie_probe(struct platform_device *pdev) + + bridge->ops = &cdns_ti_pcie_host_ops; + rc = pci_host_bridge_priv(bridge); ++ rc->quirk_retrain_flag = data->quirk_retrain_flag; + + cdns_pcie = &rc->pcie; + cdns_pcie->dev = dev; +diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c +index 1cb7cfc75d6e4..73dcf8cf98fbf 100644 +--- a/drivers/pci/controller/cadence/pcie-cadence-host.c ++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c +@@ -77,6 +77,68 @@ static struct pci_ops cdns_pcie_host_ops = { + .write = pci_generic_config_write, + }; + ++static int cdns_pcie_host_wait_for_link(struct cdns_pcie *pcie) ++{ ++ struct device *dev = pcie->dev; ++ int retries; ++ ++ /* Check if the link is up or not */ ++ for (retries = 0; retries < LINK_WAIT_MAX_RETRIES; retries++) { ++ if (cdns_pcie_link_up(pcie)) { ++ dev_info(dev, "Link up\n"); ++ return 0; ++ } ++ usleep_range(LINK_WAIT_USLEEP_MIN, LINK_WAIT_USLEEP_MAX); ++ } ++ ++ return -ETIMEDOUT; ++} ++ ++static int cdns_pcie_retrain(struct cdns_pcie *pcie) ++{ ++ u32 lnk_cap_sls, pcie_cap_off = CDNS_PCIE_RP_CAP_OFFSET; ++ u16 lnk_stat, lnk_ctl; ++ int ret = 0; ++ ++ /* ++ * Set retrain bit if current speed is 2.5 GB/s, ++ * but the PCIe root port support is > 2.5 GB/s. ++ */ ++ ++ lnk_cap_sls = cdns_pcie_readl(pcie, (CDNS_PCIE_RP_BASE + pcie_cap_off + ++ PCI_EXP_LNKCAP)); ++ if ((lnk_cap_sls & PCI_EXP_LNKCAP_SLS) <= PCI_EXP_LNKCAP_SLS_2_5GB) ++ return ret; ++ ++ lnk_stat = cdns_pcie_rp_readw(pcie, pcie_cap_off + PCI_EXP_LNKSTA); ++ if ((lnk_stat & PCI_EXP_LNKSTA_CLS) == PCI_EXP_LNKSTA_CLS_2_5GB) { ++ lnk_ctl = cdns_pcie_rp_readw(pcie, ++ pcie_cap_off + PCI_EXP_LNKCTL); ++ lnk_ctl |= PCI_EXP_LNKCTL_RL; ++ cdns_pcie_rp_writew(pcie, pcie_cap_off + PCI_EXP_LNKCTL, ++ lnk_ctl); ++ ++ ret = cdns_pcie_host_wait_for_link(pcie); ++ } ++ return ret; ++} ++ ++static int cdns_pcie_host_start_link(struct cdns_pcie_rc *rc) ++{ ++ struct cdns_pcie *pcie = &rc->pcie; ++ int ret; ++ ++ ret = cdns_pcie_host_wait_for_link(pcie); ++ ++ /* ++ * Retrain link for Gen2 training defect ++ * if quirk flag is set. ++ */ ++ if (!ret && rc->quirk_retrain_flag) ++ ret = cdns_pcie_retrain(pcie); ++ ++ return ret; ++} + + static int cdns_pcie_host_init_root_port(struct cdns_pcie_rc *rc) + { +@@ -399,23 +461,6 @@ static int cdns_pcie_host_init(struct device *dev, + return cdns_pcie_host_init_address_translation(rc); + } + +-static int cdns_pcie_host_wait_for_link(struct cdns_pcie *pcie) +-{ +- struct device *dev = pcie->dev; +- int retries; +- +- /* Check if the link is up or not */ +- for (retries = 0; retries < LINK_WAIT_MAX_RETRIES; retries++) { +- if (cdns_pcie_link_up(pcie)) { +- dev_info(dev, "Link up\n"); +- return 0; +- } +- usleep_range(LINK_WAIT_USLEEP_MIN, LINK_WAIT_USLEEP_MAX); +- } +- +- return -ETIMEDOUT; +-} +- + int cdns_pcie_host_setup(struct cdns_pcie_rc *rc) + { + struct device *dev = rc->pcie.dev; +@@ -458,7 +503,7 @@ int cdns_pcie_host_setup(struct cdns_pcie_rc *rc) + return ret; + } + +- ret = cdns_pcie_host_wait_for_link(pcie); ++ ret = cdns_pcie_host_start_link(rc); + if (ret) + dev_dbg(dev, "PCIe link never came up\n"); + +diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h +index 30eba6cafe2c1..254d2570f8c91 100644 +--- a/drivers/pci/controller/cadence/pcie-cadence.h ++++ b/drivers/pci/controller/cadence/pcie-cadence.h +@@ -119,7 +119,7 @@ + * Root Port Registers (PCI configuration space for the root port function) + */ + #define CDNS_PCIE_RP_BASE 0x00200000 +- ++#define CDNS_PCIE_RP_CAP_OFFSET 0xc0 + + /* + * Address Translation Registers +@@ -291,6 +291,7 @@ struct cdns_pcie { + * @device_id: PCI device ID + * @avail_ib_bar: Satus of RP_BAR0, RP_BAR1 and RP_NO_BAR if it's free or + * available ++ * @quirk_retrain_flag: Retrain link as quirk for PCIe Gen2 + */ + struct cdns_pcie_rc { + struct cdns_pcie pcie; +@@ -299,6 +300,7 @@ struct cdns_pcie_rc { + u32 vendor_id; + u32 device_id; + bool avail_ib_bar[CDNS_PCIE_RP_MAX_IB]; ++ bool quirk_retrain_flag; + }; + + /** +@@ -414,6 +416,13 @@ static inline void cdns_pcie_rp_writew(struct cdns_pcie *pcie, + cdns_pcie_write_sz(addr, 0x2, value); + } + ++static inline u16 cdns_pcie_rp_readw(struct cdns_pcie *pcie, u32 reg) ++{ ++ void __iomem *addr = pcie->reg_base + CDNS_PCIE_RP_BASE + reg; ++ ++ return cdns_pcie_read_sz(addr, 0x2); ++} ++ + /* Endpoint Function register access */ + static inline void cdns_pcie_ep_fn_writeb(struct cdns_pcie *pcie, u8 fn, + u32 reg, u8 value) +diff --git a/drivers/scsi/ufs/ufs-exynos.c b/drivers/scsi/ufs/ufs-exynos.c +index a8770ff145883..267943a13a946 100644 +--- a/drivers/scsi/ufs/ufs-exynos.c ++++ b/drivers/scsi/ufs/ufs-exynos.c +@@ -640,6 +640,11 @@ static int exynos_ufs_pre_pwr_mode(struct ufs_hba *hba, + } + } + ++ /* setting for three timeout values for traffic class #0 */ ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA0), 8064); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA1), 28224); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA2), 20160); ++ + return 0; + out: + return ret; +@@ -1236,7 +1241,9 @@ struct exynos_ufs_drv_data exynos_ufs_drvs = { + UFSHCI_QUIRK_BROKEN_HCE | + UFSHCI_QUIRK_SKIP_RESET_INTR_AGGR | + UFSHCD_QUIRK_BROKEN_OCS_FATAL_ERROR | +- UFSHCI_QUIRK_SKIP_MANUAL_WB_FLUSH_CTRL, ++ UFSHCI_QUIRK_SKIP_MANUAL_WB_FLUSH_CTRL | ++ UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING | ++ UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE, + .opts = EXYNOS_UFS_OPT_HAS_APB_CLK_CTRL | + EXYNOS_UFS_OPT_BROKEN_AUTO_CLK_CTRL | + EXYNOS_UFS_OPT_BROKEN_RX_SEL_IDX | +diff --git a/drivers/scsi/ufs/ufs-mediatek.c b/drivers/scsi/ufs/ufs-mediatek.c +index 80618af7c8720..c55202b92a43a 100644 +--- a/drivers/scsi/ufs/ufs-mediatek.c ++++ b/drivers/scsi/ufs/ufs-mediatek.c +@@ -661,6 +661,7 @@ static int ufs_mtk_init(struct ufs_hba *hba) + + /* Enable WriteBooster */ + hba->caps |= UFSHCD_CAP_WB_EN; ++ hba->quirks |= UFSHCI_QUIRK_SKIP_MANUAL_WB_FLUSH_CTRL; + hba->vps->wb_flush_threshold = UFS_WB_BUF_REMAIN_PERCENT(80); + + if (host->caps & UFS_MTK_CAP_DISABLE_AH8) +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 728168cd18f55..428b9e0ac47e9 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -4220,25 +4220,27 @@ static int ufshcd_change_power_mode(struct ufs_hba *hba, + ufshcd_dme_set(hba, UIC_ARG_MIB(PA_HSSERIES), + pwr_mode->hs_rate); + +- ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA0), +- DL_FC0ProtectionTimeOutVal_Default); +- ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA1), +- DL_TC0ReplayTimeOutVal_Default); +- ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA2), +- DL_AFC0ReqTimeOutVal_Default); +- ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA3), +- DL_FC1ProtectionTimeOutVal_Default); +- ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA4), +- DL_TC1ReplayTimeOutVal_Default); +- ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA5), +- DL_AFC1ReqTimeOutVal_Default); +- +- ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalFC0ProtectionTimeOutVal), +- DL_FC0ProtectionTimeOutVal_Default); +- ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalTC0ReplayTimeOutVal), +- DL_TC0ReplayTimeOutVal_Default); +- ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalAFC0ReqTimeOutVal), +- DL_AFC0ReqTimeOutVal_Default); ++ if (!(hba->quirks & UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING)) { ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA0), ++ DL_FC0ProtectionTimeOutVal_Default); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA1), ++ DL_TC0ReplayTimeOutVal_Default); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA2), ++ DL_AFC0ReqTimeOutVal_Default); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA3), ++ DL_FC1ProtectionTimeOutVal_Default); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA4), ++ DL_TC1ReplayTimeOutVal_Default); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA5), ++ DL_AFC1ReqTimeOutVal_Default); ++ ++ ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalFC0ProtectionTimeOutVal), ++ DL_FC0ProtectionTimeOutVal_Default); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalTC0ReplayTimeOutVal), ++ DL_TC0ReplayTimeOutVal_Default); ++ ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalAFC0ReqTimeOutVal), ++ DL_AFC0ReqTimeOutVal_Default); ++ } + + ret = ufshcd_uic_change_pwr_mode(hba, pwr_mode->pwr_rx << 4 + | pwr_mode->pwr_tx); +@@ -4829,6 +4831,8 @@ static int ufshcd_slave_configure(struct scsi_device *sdev) + struct request_queue *q = sdev->request_queue; + + blk_queue_update_dma_pad(q, PRDT_DATA_BYTE_COUNT_PAD - 1); ++ if (hba->quirks & UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE) ++ blk_queue_update_dma_alignment(q, PAGE_SIZE - 1); + + if (ufshcd_is_rpm_autosuspend_allowed(hba)) + sdev->rpm_autosuspend = 1; +diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h +index aa9ea35523239..1885ec9126c44 100644 +--- a/drivers/scsi/ufs/ufshcd.h ++++ b/drivers/scsi/ufs/ufshcd.h +@@ -551,6 +551,16 @@ enum ufshcd_quirks { + */ + UFSHCI_QUIRK_SKIP_MANUAL_WB_FLUSH_CTRL = 1 << 12, + ++ /* ++ * This quirk needs to disable unipro timeout values ++ * before power mode change ++ */ ++ UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING = 1 << 13, ++ ++ /* ++ * This quirk allows only sg entries aligned with page size. ++ */ ++ UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE = 1 << 14, + }; + + enum ufshcd_caps { +diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c +index ddad5d274ee81..7bd9291c8d5f5 100644 +--- a/drivers/staging/media/sunxi/cedrus/cedrus.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c +@@ -34,56 +34,48 @@ static const struct cedrus_control cedrus_controls[] = { + .id = V4L2_CID_MPEG_VIDEO_MPEG2_SLICE_PARAMS, + }, + .codec = CEDRUS_CODEC_MPEG2, +- .required = true, + }, + { + .cfg = { + .id = V4L2_CID_MPEG_VIDEO_MPEG2_QUANTIZATION, + }, + .codec = CEDRUS_CODEC_MPEG2, +- .required = false, + }, + { + .cfg = { + .id = V4L2_CID_STATELESS_H264_DECODE_PARAMS, + }, + .codec = CEDRUS_CODEC_H264, +- .required = true, + }, + { + .cfg = { + .id = V4L2_CID_STATELESS_H264_SLICE_PARAMS, + }, + .codec = CEDRUS_CODEC_H264, +- .required = true, + }, + { + .cfg = { + .id = V4L2_CID_STATELESS_H264_SPS, + }, + .codec = CEDRUS_CODEC_H264, +- .required = true, + }, + { + .cfg = { + .id = V4L2_CID_STATELESS_H264_PPS, + }, + .codec = CEDRUS_CODEC_H264, +- .required = true, + }, + { + .cfg = { + .id = V4L2_CID_STATELESS_H264_SCALING_MATRIX, + }, + .codec = CEDRUS_CODEC_H264, +- .required = false, + }, + { + .cfg = { + .id = V4L2_CID_STATELESS_H264_PRED_WEIGHTS, + }, + .codec = CEDRUS_CODEC_H264, +- .required = false, + }, + { + .cfg = { +@@ -92,7 +84,6 @@ static const struct cedrus_control cedrus_controls[] = { + .def = V4L2_STATELESS_H264_DECODE_MODE_SLICE_BASED, + }, + .codec = CEDRUS_CODEC_H264, +- .required = false, + }, + { + .cfg = { +@@ -101,7 +92,6 @@ static const struct cedrus_control cedrus_controls[] = { + .def = V4L2_STATELESS_H264_START_CODE_NONE, + }, + .codec = CEDRUS_CODEC_H264, +- .required = false, + }, + /* + * We only expose supported profiles information, +@@ -120,28 +110,24 @@ static const struct cedrus_control cedrus_controls[] = { + BIT(V4L2_MPEG_VIDEO_H264_PROFILE_EXTENDED), + }, + .codec = CEDRUS_CODEC_H264, +- .required = false, + }, + { + .cfg = { + .id = V4L2_CID_MPEG_VIDEO_HEVC_SPS, + }, + .codec = CEDRUS_CODEC_H265, +- .required = true, + }, + { + .cfg = { + .id = V4L2_CID_MPEG_VIDEO_HEVC_PPS, + }, + .codec = CEDRUS_CODEC_H265, +- .required = true, + }, + { + .cfg = { + .id = V4L2_CID_MPEG_VIDEO_HEVC_SLICE_PARAMS, + }, + .codec = CEDRUS_CODEC_H265, +- .required = true, + }, + { + .cfg = { +@@ -150,7 +136,6 @@ static const struct cedrus_control cedrus_controls[] = { + .def = V4L2_MPEG_VIDEO_HEVC_DECODE_MODE_SLICE_BASED, + }, + .codec = CEDRUS_CODEC_H265, +- .required = false, + }, + { + .cfg = { +@@ -159,14 +144,12 @@ static const struct cedrus_control cedrus_controls[] = { + .def = V4L2_MPEG_VIDEO_HEVC_START_CODE_NONE, + }, + .codec = CEDRUS_CODEC_H265, +- .required = false, + }, + { + .cfg = { + .id = V4L2_CID_MPEG_VIDEO_VP8_FRAME_HEADER, + }, + .codec = CEDRUS_CODEC_VP8, +- .required = true, + }, + }; + +@@ -227,12 +210,8 @@ static int cedrus_init_ctrls(struct cedrus_dev *dev, struct cedrus_ctx *ctx) + static int cedrus_request_validate(struct media_request *req) + { + struct media_request_object *obj; +- struct v4l2_ctrl_handler *parent_hdl, *hdl; + struct cedrus_ctx *ctx = NULL; +- struct v4l2_ctrl *ctrl_test; + unsigned int count; +- unsigned int i; +- int ret = 0; + + list_for_each_entry(obj, &req->objects, list) { + struct vb2_buffer *vb; +@@ -259,34 +238,6 @@ static int cedrus_request_validate(struct media_request *req) + return -EINVAL; + } + +- parent_hdl = &ctx->hdl; +- +- hdl = v4l2_ctrl_request_hdl_find(req, parent_hdl); +- if (!hdl) { +- v4l2_info(&ctx->dev->v4l2_dev, "Missing codec control(s)\n"); +- return -ENOENT; +- } +- +- for (i = 0; i < CEDRUS_CONTROLS_COUNT; i++) { +- if (cedrus_controls[i].codec != ctx->current_codec || +- !cedrus_controls[i].required) +- continue; +- +- ctrl_test = v4l2_ctrl_request_hdl_ctrl_find(hdl, +- cedrus_controls[i].cfg.id); +- if (!ctrl_test) { +- v4l2_info(&ctx->dev->v4l2_dev, +- "Missing required codec control\n"); +- ret = -ENOENT; +- break; +- } +- } +- +- v4l2_ctrl_request_hdl_put(hdl); +- +- if (ret) +- return ret; +- + return vb2_request_validate(req); + } + +diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.h b/drivers/staging/media/sunxi/cedrus/cedrus.h +index c96077aaef493..251a6a6603516 100644 +--- a/drivers/staging/media/sunxi/cedrus/cedrus.h ++++ b/drivers/staging/media/sunxi/cedrus/cedrus.h +@@ -56,7 +56,6 @@ enum cedrus_h264_pic_type { + struct cedrus_control { + struct v4l2_ctrl_config cfg; + enum cedrus_codec codec; +- unsigned char required:1; + }; + + struct cedrus_h264_run { +diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c +index f12e6a0aa3c70..a09912cf1852d 100644 +--- a/fs/btrfs/delayed-inode.c ++++ b/fs/btrfs/delayed-inode.c +@@ -627,7 +627,8 @@ static int btrfs_delayed_inode_reserve_metadata( + */ + if (!src_rsv || (!trans->bytes_reserved && + src_rsv->type != BTRFS_BLOCK_RSV_DELALLOC)) { +- ret = btrfs_qgroup_reserve_meta_prealloc(root, num_bytes, true); ++ ret = btrfs_qgroup_reserve_meta(root, num_bytes, ++ BTRFS_QGROUP_RSV_META_PREALLOC, true); + if (ret < 0) + return ret; + ret = btrfs_block_rsv_add(root, dst_rsv, num_bytes, +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 40ccb8ddab23a..9b4f75568261e 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -5916,7 +5916,7 @@ static int btrfs_dirty_inode(struct inode *inode) + return PTR_ERR(trans); + + ret = btrfs_update_inode(trans, root, BTRFS_I(inode)); +- if (ret && ret == -ENOSPC) { ++ if (ret && (ret == -ENOSPC || ret == -EDQUOT)) { + /* whoops, lets try again with the full transaction */ + btrfs_end_transaction(trans); + trans = btrfs_start_transaction(root, 1); +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 808370ada8889..14ff388fd3bda 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -3841,8 +3841,8 @@ static int sub_root_meta_rsv(struct btrfs_root *root, int num_bytes, + return num_bytes; + } + +-static int qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, +- enum btrfs_qgroup_rsv_type type, bool enforce) ++int btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, ++ enum btrfs_qgroup_rsv_type type, bool enforce) + { + struct btrfs_fs_info *fs_info = root->fs_info; + int ret; +@@ -3873,14 +3873,14 @@ int __btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, + { + int ret; + +- ret = qgroup_reserve_meta(root, num_bytes, type, enforce); ++ ret = btrfs_qgroup_reserve_meta(root, num_bytes, type, enforce); + if (ret <= 0 && ret != -EDQUOT) + return ret; + + ret = try_flush_qgroup(root); + if (ret < 0) + return ret; +- return qgroup_reserve_meta(root, num_bytes, type, enforce); ++ return btrfs_qgroup_reserve_meta(root, num_bytes, type, enforce); + } + + void btrfs_qgroup_free_meta_all_pertrans(struct btrfs_root *root) +diff --git a/fs/btrfs/qgroup.h b/fs/btrfs/qgroup.h +index 50dea9a2d8fbd..7283e4f549af7 100644 +--- a/fs/btrfs/qgroup.h ++++ b/fs/btrfs/qgroup.h +@@ -361,6 +361,8 @@ int btrfs_qgroup_release_data(struct btrfs_inode *inode, u64 start, u64 len); + int btrfs_qgroup_free_data(struct btrfs_inode *inode, + struct extent_changeset *reserved, u64 start, + u64 len); ++int btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, ++ enum btrfs_qgroup_rsv_type type, bool enforce); + int __btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, + enum btrfs_qgroup_rsv_type type, bool enforce); + /* Reserve metadata space for pertrans and prealloc type */ +diff --git a/fs/file.c b/fs/file.c +index dab120b71e44d..f3a4bac2cbe91 100644 +--- a/fs/file.c ++++ b/fs/file.c +@@ -22,6 +22,8 @@ + #include + #include + ++#include "internal.h" ++ + unsigned int sysctl_nr_open __read_mostly = 1024*1024; + unsigned int sysctl_nr_open_min = BITS_PER_LONG; + /* our min() is unusable in constant expressions ;-/ */ +@@ -732,36 +734,48 @@ int __close_range(unsigned fd, unsigned max_fd, unsigned int flags) + } + + /* +- * variant of close_fd that gets a ref on the file for later fput. +- * The caller must ensure that filp_close() called on the file, and then +- * an fput(). ++ * See close_fd_get_file() below, this variant assumes current->files->file_lock ++ * is held. + */ +-int close_fd_get_file(unsigned int fd, struct file **res) ++int __close_fd_get_file(unsigned int fd, struct file **res) + { + struct files_struct *files = current->files; + struct file *file; + struct fdtable *fdt; + +- spin_lock(&files->file_lock); + fdt = files_fdtable(files); + if (fd >= fdt->max_fds) +- goto out_unlock; ++ goto out_err; + file = fdt->fd[fd]; + if (!file) +- goto out_unlock; ++ goto out_err; + rcu_assign_pointer(fdt->fd[fd], NULL); + __put_unused_fd(files, fd); +- spin_unlock(&files->file_lock); + get_file(file); + *res = file; + return 0; +- +-out_unlock: +- spin_unlock(&files->file_lock); ++out_err: + *res = NULL; + return -ENOENT; + } + ++/* ++ * variant of close_fd that gets a ref on the file for later fput. ++ * The caller must ensure that filp_close() called on the file, and then ++ * an fput(). ++ */ ++int close_fd_get_file(unsigned int fd, struct file **res) ++{ ++ struct files_struct *files = current->files; ++ int ret; ++ ++ spin_lock(&files->file_lock); ++ ret = __close_fd_get_file(fd, res); ++ spin_unlock(&files->file_lock); ++ ++ return ret; ++} ++ + void do_close_on_exec(struct files_struct *files) + { + unsigned i; +diff --git a/fs/internal.h b/fs/internal.h +index 77c50befbfbe9..c6c85f6ad598a 100644 +--- a/fs/internal.h ++++ b/fs/internal.h +@@ -132,6 +132,7 @@ extern struct file *do_file_open_root(struct dentry *, struct vfsmount *, + const char *, const struct open_flags *); + extern struct open_how build_open_how(int flags, umode_t mode); + extern int build_open_flags(const struct open_how *how, struct open_flags *op); ++extern int __close_fd_get_file(unsigned int fd, struct file **res); + + long do_sys_ftruncate(unsigned int fd, loff_t length, int small); + int chmod_common(const struct path *path, umode_t mode); +diff --git a/fs/io-wq.c b/fs/io-wq.c +index a564f36e260c1..63ef195b1acb1 100644 +--- a/fs/io-wq.c ++++ b/fs/io-wq.c +@@ -555,23 +555,21 @@ get_next: + + /* handle a whole dependent link */ + do { +- struct io_wq_work *old_work, *next_hashed, *linked; ++ struct io_wq_work *next_hashed, *linked; + unsigned int hash = io_get_work_hash(work); + + next_hashed = wq_next_work(work); + io_impersonate_work(worker, work); ++ wq->do_work(work); ++ io_assign_current_work(worker, NULL); + +- old_work = work; +- linked = wq->do_work(work); +- ++ linked = wq->free_work(work); + work = next_hashed; + if (!work && linked && !io_wq_is_hashed(linked)) { + work = linked; + linked = NULL; + } + io_assign_current_work(worker, work); +- wq->free_work(old_work); +- + if (linked) + io_wqe_enqueue(wqe, linked); + +@@ -850,11 +848,9 @@ static void io_run_cancel(struct io_wq_work *work, struct io_wqe *wqe) + struct io_wq *wq = wqe->wq; + + do { +- struct io_wq_work *old_work = work; +- + work->flags |= IO_WQ_WORK_CANCEL; +- work = wq->do_work(work); +- wq->free_work(old_work); ++ wq->do_work(work); ++ work = wq->free_work(work); + } while (work); + } + +@@ -944,7 +940,6 @@ static bool io_wq_worker_cancel(struct io_worker *worker, void *data) + */ + spin_lock_irqsave(&worker->lock, flags); + if (worker->cur_work && +- !(worker->cur_work->flags & IO_WQ_WORK_NO_CANCEL) && + match->fn(worker->cur_work, match->data)) { + send_sig(SIGINT, worker->task, 1); + match->nr_running++; +diff --git a/fs/io-wq.h b/fs/io-wq.h +index b158f8addcf3e..e37a0f217cc8b 100644 +--- a/fs/io-wq.h ++++ b/fs/io-wq.h +@@ -9,7 +9,6 @@ enum { + IO_WQ_WORK_CANCEL = 1, + IO_WQ_WORK_HASHED = 2, + IO_WQ_WORK_UNBOUND = 4, +- IO_WQ_WORK_NO_CANCEL = 8, + IO_WQ_WORK_CONCURRENT = 16, + + IO_WQ_WORK_FILES = 32, +@@ -107,8 +106,8 @@ static inline struct io_wq_work *wq_next_work(struct io_wq_work *work) + return container_of(work->list.next, struct io_wq_work, list); + } + +-typedef void (free_work_fn)(struct io_wq_work *); +-typedef struct io_wq_work *(io_wq_work_fn)(struct io_wq_work *); ++typedef struct io_wq_work *(free_work_fn)(struct io_wq_work *); ++typedef void (io_wq_work_fn)(struct io_wq_work *); + + struct io_wq_data { + struct user_struct *user; +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 38bfd168ad3b7..241313278e5a5 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -411,7 +411,6 @@ struct io_poll_remove { + + struct io_close { + struct file *file; +- struct file *put_file; + int fd; + }; + +@@ -908,8 +907,6 @@ static const struct io_op_def io_op_defs[] = { + IO_WQ_WORK_FS | IO_WQ_WORK_MM, + }, + [IORING_OP_CLOSE] = { +- .needs_file = 1, +- .needs_file_no_error = 1, + .work_flags = IO_WQ_WORK_FILES | IO_WQ_WORK_BLKCG, + }, + [IORING_OP_FILES_UPDATE] = { +@@ -996,9 +993,9 @@ enum io_mem_account { + ACCT_PINNED, + }; + +-static void __io_uring_cancel_task_requests(struct io_ring_ctx *ctx, +- struct task_struct *task); +- ++static void io_uring_try_cancel_requests(struct io_ring_ctx *ctx, ++ struct task_struct *task, ++ struct files_struct *files); + static void destroy_fixed_file_ref_node(struct fixed_file_ref_node *ref_node); + static struct fixed_file_ref_node *alloc_fixed_file_ref_node( + struct io_ring_ctx *ctx); +@@ -2172,6 +2169,16 @@ static int io_req_task_work_add(struct io_kiocb *req) + return ret; + } + ++static void io_req_task_work_add_fallback(struct io_kiocb *req, ++ void (*cb)(struct callback_head *)) ++{ ++ struct task_struct *tsk = io_wq_get_task(req->ctx->io_wq); ++ ++ init_task_work(&req->task_work, cb); ++ task_work_add(tsk, &req->task_work, TWA_NONE); ++ wake_up_process(tsk); ++} ++ + static void __io_req_task_cancel(struct io_kiocb *req, int error) + { + struct io_ring_ctx *ctx = req->ctx; +@@ -2191,7 +2198,9 @@ static void io_req_task_cancel(struct callback_head *cb) + struct io_kiocb *req = container_of(cb, struct io_kiocb, task_work); + struct io_ring_ctx *ctx = req->ctx; + ++ mutex_lock(&ctx->uring_lock); + __io_req_task_cancel(req, -ECANCELED); ++ mutex_unlock(&ctx->uring_lock); + percpu_ref_put(&ctx->refs); + } + +@@ -2229,14 +2238,8 @@ static void io_req_task_queue(struct io_kiocb *req) + percpu_ref_get(&req->ctx->refs); + + ret = io_req_task_work_add(req); +- if (unlikely(ret)) { +- struct task_struct *tsk; +- +- init_task_work(&req->task_work, io_req_task_cancel); +- tsk = io_wq_get_task(req->ctx->io_wq); +- task_work_add(tsk, &req->task_work, TWA_NONE); +- wake_up_process(tsk); +- } ++ if (unlikely(ret)) ++ io_req_task_work_add_fallback(req, io_req_task_cancel); + } + + static inline void io_queue_next(struct io_kiocb *req) +@@ -2354,13 +2357,8 @@ static void io_free_req_deferred(struct io_kiocb *req) + + init_task_work(&req->task_work, io_put_req_deferred_cb); + ret = io_req_task_work_add(req); +- if (unlikely(ret)) { +- struct task_struct *tsk; +- +- tsk = io_wq_get_task(req->ctx->io_wq); +- task_work_add(tsk, &req->task_work, TWA_NONE); +- wake_up_process(tsk); +- } ++ if (unlikely(ret)) ++ io_req_task_work_add_fallback(req, io_put_req_deferred_cb); + } + + static inline void io_put_req_deferred(struct io_kiocb *req, int refs) +@@ -2369,22 +2367,6 @@ static inline void io_put_req_deferred(struct io_kiocb *req, int refs) + io_free_req_deferred(req); + } + +-static struct io_wq_work *io_steal_work(struct io_kiocb *req) +-{ +- struct io_kiocb *nxt; +- +- /* +- * A ref is owned by io-wq in which context we're. So, if that's the +- * last one, it's safe to steal next work. False negatives are Ok, +- * it just will be re-punted async in io_put_work() +- */ +- if (refcount_read(&req->refs) != 1) +- return NULL; +- +- nxt = io_req_find_next(req); +- return nxt ? &nxt->work : NULL; +-} +- + static void io_double_put_req(struct io_kiocb *req) + { + /* drop both submit and complete references */ +@@ -3439,15 +3421,8 @@ static int io_async_buf_func(struct wait_queue_entry *wait, unsigned mode, + /* submit ref gets dropped, acquire a new one */ + refcount_inc(&req->refs); + ret = io_req_task_work_add(req); +- if (unlikely(ret)) { +- struct task_struct *tsk; +- +- /* queue just for cancelation */ +- init_task_work(&req->task_work, io_req_task_cancel); +- tsk = io_wq_get_task(req->ctx->io_wq); +- task_work_add(tsk, &req->task_work, TWA_NONE); +- wake_up_process(tsk); +- } ++ if (unlikely(ret)) ++ io_req_task_work_add_fallback(req, io_req_task_cancel); + return 1; + } + +@@ -4481,13 +4456,6 @@ static int io_statx(struct io_kiocb *req, bool force_nonblock) + + static int io_close_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) + { +- /* +- * If we queue this for async, it must not be cancellable. That would +- * leave the 'file' in an undeterminate state, and here need to modify +- * io_wq_work.flags, so initialize io_wq_work firstly. +- */ +- io_req_init_async(req); +- + if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL)) + return -EINVAL; + if (sqe->ioprio || sqe->off || sqe->addr || sqe->len || +@@ -4497,43 +4465,59 @@ static int io_close_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) + return -EBADF; + + req->close.fd = READ_ONCE(sqe->fd); +- if ((req->file && req->file->f_op == &io_uring_fops)) +- return -EBADF; +- +- req->close.put_file = NULL; + return 0; + } + + static int io_close(struct io_kiocb *req, bool force_nonblock, + struct io_comp_state *cs) + { ++ struct files_struct *files = current->files; + struct io_close *close = &req->close; ++ struct fdtable *fdt; ++ struct file *file; + int ret; + +- /* might be already done during nonblock submission */ +- if (!close->put_file) { +- ret = close_fd_get_file(close->fd, &close->put_file); +- if (ret < 0) +- return (ret == -ENOENT) ? -EBADF : ret; ++ file = NULL; ++ ret = -EBADF; ++ spin_lock(&files->file_lock); ++ fdt = files_fdtable(files); ++ if (close->fd >= fdt->max_fds) { ++ spin_unlock(&files->file_lock); ++ goto err; ++ } ++ file = fdt->fd[close->fd]; ++ if (!file) { ++ spin_unlock(&files->file_lock); ++ goto err; ++ } ++ ++ if (file->f_op == &io_uring_fops) { ++ spin_unlock(&files->file_lock); ++ file = NULL; ++ goto err; + } + + /* if the file has a flush method, be safe and punt to async */ +- if (close->put_file->f_op->flush && force_nonblock) { +- /* not safe to cancel at this point */ +- req->work.flags |= IO_WQ_WORK_NO_CANCEL; +- /* was never set, but play safe */ +- req->flags &= ~REQ_F_NOWAIT; +- /* avoid grabbing files - we don't need the files */ +- req->flags |= REQ_F_NO_FILE_TABLE; ++ if (file->f_op->flush && force_nonblock) { ++ spin_unlock(&files->file_lock); + return -EAGAIN; + } + ++ ret = __close_fd_get_file(close->fd, &file); ++ spin_unlock(&files->file_lock); ++ if (ret < 0) { ++ if (ret == -ENOENT) ++ ret = -EBADF; ++ goto err; ++ } ++ + /* No ->flush() or already async, safely close from here */ +- ret = filp_close(close->put_file, req->work.identity->files); ++ ret = filp_close(file, current->files); ++err: + if (ret < 0) + req_set_fail_links(req); +- fput(close->put_file); +- close->put_file = NULL; ++ if (file) ++ fput(file); + __io_req_complete(req, ret, 0, cs); + return 0; + } +@@ -5159,12 +5143,8 @@ static int __io_async_wake(struct io_kiocb *req, struct io_poll_iocb *poll, + */ + ret = io_req_task_work_add(req); + if (unlikely(ret)) { +- struct task_struct *tsk; +- + WRITE_ONCE(poll->canceled, true); +- tsk = io_wq_get_task(req->ctx->io_wq); +- task_work_add(tsk, &req->task_work, TWA_NONE); +- wake_up_process(tsk); ++ io_req_task_work_add_fallback(req, func); + } + return 1; + } +@@ -6384,7 +6364,7 @@ static int io_issue_sqe(struct io_kiocb *req, bool force_nonblock, + return 0; + } + +-static struct io_wq_work *io_wq_submit_work(struct io_wq_work *work) ++static void io_wq_submit_work(struct io_wq_work *work) + { + struct io_kiocb *req = container_of(work, struct io_kiocb, work); + struct io_kiocb *timeout; +@@ -6394,10 +6374,12 @@ static struct io_wq_work *io_wq_submit_work(struct io_wq_work *work) + if (timeout) + io_queue_linked_timeout(timeout); + +- /* if NO_CANCEL is set, we must still run the work */ +- if ((work->flags & (IO_WQ_WORK_CANCEL|IO_WQ_WORK_NO_CANCEL)) == +- IO_WQ_WORK_CANCEL) { +- ret = -ECANCELED; ++ if (work->flags & IO_WQ_WORK_CANCEL) { ++ /* io-wq is going to take down one */ ++ refcount_inc(&req->refs); ++ percpu_ref_get(&req->ctx->refs); ++ io_req_task_work_add_fallback(req, io_req_task_cancel); ++ return; + } + + if (!ret) { +@@ -6438,8 +6420,6 @@ static struct io_wq_work *io_wq_submit_work(struct io_wq_work *work) + if (lock_ctx) + mutex_unlock(&lock_ctx->uring_lock); + } +- +- return io_steal_work(req); + } + + static inline struct file *io_file_from_index(struct io_ring_ctx *ctx, +@@ -6506,9 +6486,10 @@ static enum hrtimer_restart io_link_timeout_fn(struct hrtimer *timer) + if (prev) { + req_set_fail_links(prev); + io_async_find_and_cancel(ctx, req, prev->user_data, -ETIME); +- io_put_req(prev); ++ io_put_req_deferred(prev, 1); + } else { +- io_req_complete(req, -ETIME); ++ io_cqring_add_event(req, -ETIME, 0); ++ io_put_req_deferred(req, 1); + } + return HRTIMER_NORESTART; + } +@@ -8070,12 +8051,12 @@ static int io_sqe_files_update(struct io_ring_ctx *ctx, void __user *arg, + return __io_sqe_files_update(ctx, &up, nr_args); + } + +-static void io_free_work(struct io_wq_work *work) ++static struct io_wq_work *io_free_work(struct io_wq_work *work) + { + struct io_kiocb *req = container_of(work, struct io_kiocb, work); + +- /* Consider that io_steal_work() relies on this ref */ +- io_put_req(req); ++ req = io_put_req_find_next(req); ++ return req ? &req->work : NULL; + } + + static int io_init_wq_offload(struct io_ring_ctx *ctx, +@@ -8779,7 +8760,7 @@ static void io_ring_exit_work(struct work_struct *work) + * as nobody else will be looking for them. + */ + do { +- __io_uring_cancel_task_requests(ctx, NULL); ++ io_uring_try_cancel_requests(ctx, NULL, NULL); + } while (!wait_for_completion_timeout(&ctx->ref_comp, HZ/20)); + io_ring_ctx_free(ctx); + } +@@ -8893,6 +8874,40 @@ static void io_cancel_defer_files(struct io_ring_ctx *ctx, + } + } + ++static void io_uring_try_cancel_requests(struct io_ring_ctx *ctx, ++ struct task_struct *task, ++ struct files_struct *files) ++{ ++ struct io_task_cancel cancel = { .task = task, .files = files, }; ++ ++ while (1) { ++ enum io_wq_cancel cret; ++ bool ret = false; ++ ++ if (ctx->io_wq) { ++ cret = io_wq_cancel_cb(ctx->io_wq, io_cancel_task_cb, ++ &cancel, true); ++ ret |= (cret != IO_WQ_CANCEL_NOTFOUND); ++ } ++ ++ /* SQPOLL thread does its own polling */ ++ if (!(ctx->flags & IORING_SETUP_SQPOLL) && !files) { ++ while (!list_empty_careful(&ctx->iopoll_list)) { ++ io_iopoll_try_reap_events(ctx); ++ ret = true; ++ } ++ } ++ ++ ret |= io_poll_remove_all(ctx, task, files); ++ ret |= io_kill_timeouts(ctx, task, files); ++ ret |= io_run_task_work(); ++ io_cqring_overflow_flush(ctx, true, task, files); ++ if (!ret) ++ break; ++ cond_resched(); ++ } ++} ++ + static int io_uring_count_inflight(struct io_ring_ctx *ctx, + struct task_struct *task, + struct files_struct *files) +@@ -8912,7 +8927,6 @@ static void io_uring_cancel_files(struct io_ring_ctx *ctx, + struct files_struct *files) + { + while (!list_empty_careful(&ctx->inflight_list)) { +- struct io_task_cancel cancel = { .task = task, .files = files }; + DEFINE_WAIT(wait); + int inflight; + +@@ -8920,49 +8934,17 @@ static void io_uring_cancel_files(struct io_ring_ctx *ctx, + if (!inflight) + break; + +- io_wq_cancel_cb(ctx->io_wq, io_cancel_task_cb, &cancel, true); +- io_poll_remove_all(ctx, task, files); +- io_kill_timeouts(ctx, task, files); +- io_cqring_overflow_flush(ctx, true, task, files); +- /* cancellations _may_ trigger task work */ +- io_run_task_work(); ++ io_uring_try_cancel_requests(ctx, task, files); + ++ if (ctx->sq_data) ++ io_sq_thread_unpark(ctx->sq_data); + prepare_to_wait(&task->io_uring->wait, &wait, + TASK_UNINTERRUPTIBLE); + if (inflight == io_uring_count_inflight(ctx, task, files)) + schedule(); + finish_wait(&task->io_uring->wait, &wait); +- } +-} +- +-static void __io_uring_cancel_task_requests(struct io_ring_ctx *ctx, +- struct task_struct *task) +-{ +- while (1) { +- struct io_task_cancel cancel = { .task = task, .files = NULL, }; +- enum io_wq_cancel cret; +- bool ret = false; +- +- if (ctx->io_wq) { +- cret = io_wq_cancel_cb(ctx->io_wq, io_cancel_task_cb, +- &cancel, true); +- ret |= (cret != IO_WQ_CANCEL_NOTFOUND); +- } +- +- /* SQPOLL thread does its own polling */ +- if (!(ctx->flags & IORING_SETUP_SQPOLL)) { +- while (!list_empty_careful(&ctx->iopoll_list)) { +- io_iopoll_try_reap_events(ctx); +- ret = true; +- } +- } +- +- ret |= io_poll_remove_all(ctx, task, NULL); +- ret |= io_kill_timeouts(ctx, task, NULL); +- ret |= io_run_task_work(); +- if (!ret) +- break; +- cond_resched(); ++ if (ctx->sq_data) ++ io_sq_thread_park(ctx->sq_data); + } + } + +@@ -8995,11 +8977,10 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx, + } + + io_cancel_defer_files(ctx, task, files); +- io_cqring_overflow_flush(ctx, true, task, files); + + io_uring_cancel_files(ctx, task, files); + if (!files) +- __io_uring_cancel_task_requests(ctx, task); ++ io_uring_try_cancel_requests(ctx, task, NULL); + + if ((ctx->flags & IORING_SETUP_SQPOLL) && ctx->sq_data) { + atomic_dec(&task->io_uring->in_idle); +diff --git a/include/linux/eeprom_93xx46.h b/include/linux/eeprom_93xx46.h +index eec7928ff8fe0..99580c22f91a4 100644 +--- a/include/linux/eeprom_93xx46.h ++++ b/include/linux/eeprom_93xx46.h +@@ -16,6 +16,8 @@ struct eeprom_93xx46_platform_data { + #define EEPROM_93XX46_QUIRK_SINGLE_WORD_READ (1 << 0) + /* Instructions such as EWEN are (addrlen + 2) in length. */ + #define EEPROM_93XX46_QUIRK_INSTRUCTION_LENGTH (1 << 1) ++/* Add extra cycle after address during a read */ ++#define EEPROM_93XX46_QUIRK_EXTRA_READ_CYCLE BIT(2) + + /* + * optional hooks to control additional logic +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index daca06dde99ba..1d7677376e742 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -48,37 +48,14 @@ static int sof_sdw_quirk_cb(const struct dmi_system_id *id) + } + + static const struct dmi_system_id sof_sdw_quirk_table[] = { ++ /* CometLake devices */ + { + .callback = sof_sdw_quirk_cb, + .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"), +- DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0A32") +- }, +- .driver_data = (void *)(SOF_SDW_TGL_HDMI | +- SOF_RT711_JD_SRC_JD2 | +- SOF_RT715_DAI_ID_FIX | +- SOF_SDW_FOUR_SPK), +- }, +- { +- .callback = sof_sdw_quirk_cb, +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"), +- DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0A3E") +- }, +- .driver_data = (void *)(SOF_SDW_TGL_HDMI | +- SOF_RT711_JD_SRC_JD2 | +- SOF_RT715_DAI_ID_FIX), +- }, +- { +- .callback = sof_sdw_quirk_cb, +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"), +- DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0A5E") ++ DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "CometLake Client"), + }, +- .driver_data = (void *)(SOF_SDW_TGL_HDMI | +- SOF_RT711_JD_SRC_JD2 | +- SOF_RT715_DAI_ID_FIX | +- SOF_SDW_FOUR_SPK), ++ .driver_data = (void *)SOF_SDW_PCH_DMIC, + }, + { + .callback = sof_sdw_quirk_cb, +@@ -109,7 +86,7 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + SOF_RT715_DAI_ID_FIX | + SOF_SDW_FOUR_SPK), + }, +- { ++ { + .callback = sof_sdw_quirk_cb, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"), +@@ -119,6 +96,16 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + SOF_RT715_DAI_ID_FIX | + SOF_SDW_FOUR_SPK), + }, ++ /* IceLake devices */ ++ { ++ .callback = sof_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Ice Lake Client"), ++ }, ++ .driver_data = (void *)SOF_SDW_PCH_DMIC, ++ }, ++ /* TigerLake devices */ + { + .callback = sof_sdw_quirk_cb, + .matches = { +@@ -134,18 +121,23 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + { + .callback = sof_sdw_quirk_cb, + .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), +- DMI_MATCH(DMI_PRODUCT_NAME, "Ice Lake Client"), ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0A3E") + }, +- .driver_data = (void *)SOF_SDW_PCH_DMIC, ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ SOF_RT711_JD_SRC_JD2 | ++ SOF_RT715_DAI_ID_FIX), + }, + { + .callback = sof_sdw_quirk_cb, + .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), +- DMI_MATCH(DMI_PRODUCT_NAME, "CometLake Client"), ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0A5E") + }, +- .driver_data = (void *)SOF_SDW_PCH_DMIC, ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ SOF_RT711_JD_SRC_JD2 | ++ SOF_RT715_DAI_ID_FIX | ++ SOF_SDW_FOUR_SPK), + }, + { + .callback = sof_sdw_quirk_cb, +@@ -167,7 +159,34 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + SOF_SDW_PCH_DMIC | + SOF_SDW_FOUR_SPK), + }, +- ++ { ++ /* ++ * this entry covers multiple HP SKUs. The family name ++ * does not seem robust enough, so we use a partial ++ * match that ignores the product name suffix ++ * (e.g. 15-eb1xxx, 14t-ea000 or 13-aw2xxx) ++ */ ++ .callback = sof_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Spectre x360 Convertible"), ++ }, ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ SOF_SDW_PCH_DMIC | ++ SOF_RT711_JD_SRC_JD2), ++ }, ++ /* TigerLake-SDCA devices */ ++ { ++ .callback = sof_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0A32") ++ }, ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ SOF_RT711_JD_SRC_JD2 | ++ SOF_RT715_DAI_ID_FIX | ++ SOF_SDW_FOUR_SPK), ++ }, + {} + }; + +diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c +index df036a359f2fc..448de77f43fd8 100644 +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -2603,141 +2603,251 @@ static int snd_bbfpro_controls_create(struct usb_mixer_interface *mixer) + } + + /* +- * Pioneer DJ DJM-250MK2 and maybe other DJM models ++ * Pioneer DJ DJM Mixers + * +- * For playback, no duplicate mapping should be set. +- * There are three mixer stereo channels (CH1, CH2, AUX) +- * and three stereo sources (Playback 1-2, Playback 3-4, Playback 5-6). +- * Each channel should be mapped just once to one source. +- * If mapped multiple times, only one source will play on given channel +- * (sources are not mixed together). ++ * These devices generally have options for soft-switching the playback and ++ * capture sources in addition to the recording level. Although different ++ * devices have different configurations, there seems to be canonical values ++ * for specific capture/playback types: See the definitions of these below. + * +- * For recording, duplicate mapping is OK. We will get the same signal multiple times. +- * +- * Channels 7-8 are in both directions fixed to FX SEND / FX RETURN. +- * +- * See also notes in the quirks-table.h file. ++ * The wValue is masked with the stereo channel number. e.g. Setting Ch2 to ++ * capture phono would be 0x0203. Capture, playback and capture level have ++ * different wIndexes. + */ + +-struct snd_pioneer_djm_option { +- const u16 wIndex; +- const u16 wValue; ++// Capture types ++#define SND_DJM_CAP_LINE 0x00 ++#define SND_DJM_CAP_CDLINE 0x01 ++#define SND_DJM_CAP_DIGITAL 0x02 ++#define SND_DJM_CAP_PHONO 0x03 ++#define SND_DJM_CAP_PFADER 0x06 ++#define SND_DJM_CAP_XFADERA 0x07 ++#define SND_DJM_CAP_XFADERB 0x08 ++#define SND_DJM_CAP_MIC 0x09 ++#define SND_DJM_CAP_AUX 0x0d ++#define SND_DJM_CAP_RECOUT 0x0a ++#define SND_DJM_CAP_NONE 0x0f ++#define SND_DJM_CAP_CH1PFADER 0x11 ++#define SND_DJM_CAP_CH2PFADER 0x12 ++#define SND_DJM_CAP_CH3PFADER 0x13 ++#define SND_DJM_CAP_CH4PFADER 0x14 ++ ++// Playback types ++#define SND_DJM_PB_CH1 0x00 ++#define SND_DJM_PB_CH2 0x01 ++#define SND_DJM_PB_AUX 0x04 ++ ++#define SND_DJM_WINDEX_CAP 0x8002 ++#define SND_DJM_WINDEX_CAPLVL 0x8003 ++#define SND_DJM_WINDEX_PB 0x8016 ++ ++// kcontrol->private_value layout ++#define SND_DJM_VALUE_MASK 0x0000ffff ++#define SND_DJM_GROUP_MASK 0x00ff0000 ++#define SND_DJM_DEVICE_MASK 0xff000000 ++#define SND_DJM_GROUP_SHIFT 16 ++#define SND_DJM_DEVICE_SHIFT 24 ++ ++// device table index ++#define SND_DJM_250MK2_IDX 0x0 ++#define SND_DJM_750_IDX 0x1 ++#define SND_DJM_900NXS2_IDX 0x2 ++ ++ ++#define SND_DJM_CTL(_name, suffix, _default_value, _windex) { \ ++ .name = _name, \ ++ .options = snd_djm_opts_##suffix, \ ++ .noptions = ARRAY_SIZE(snd_djm_opts_##suffix), \ ++ .default_value = _default_value, \ ++ .wIndex = _windex } ++ ++#define SND_DJM_DEVICE(suffix) { \ ++ .controls = snd_djm_ctls_##suffix, \ ++ .ncontrols = ARRAY_SIZE(snd_djm_ctls_##suffix) } ++ ++ ++struct snd_djm_device { + const char *name; ++ const struct snd_djm_ctl *controls; ++ size_t ncontrols; + }; + +-static const struct snd_pioneer_djm_option snd_pioneer_djm_options_capture_level[] = { +- { .name = "-5 dB", .wValue = 0x0300, .wIndex = 0x8003 }, +- { .name = "-10 dB", .wValue = 0x0200, .wIndex = 0x8003 }, +- { .name = "-15 dB", .wValue = 0x0100, .wIndex = 0x8003 }, +- { .name = "-19 dB", .wValue = 0x0000, .wIndex = 0x8003 } ++struct snd_djm_ctl { ++ const char *name; ++ const u16 *options; ++ size_t noptions; ++ u16 default_value; ++ u16 wIndex; + }; + +-static const struct snd_pioneer_djm_option snd_pioneer_djm_options_capture_ch12[] = { +- { .name = "CH1 Control Tone PHONO", .wValue = 0x0103, .wIndex = 0x8002 }, +- { .name = "CH1 Control Tone LINE", .wValue = 0x0100, .wIndex = 0x8002 }, +- { .name = "Post CH1 Fader", .wValue = 0x0106, .wIndex = 0x8002 }, +- { .name = "Cross Fader A", .wValue = 0x0107, .wIndex = 0x8002 }, +- { .name = "Cross Fader B", .wValue = 0x0108, .wIndex = 0x8002 }, +- { .name = "MIC", .wValue = 0x0109, .wIndex = 0x8002 }, +- { .name = "AUX", .wValue = 0x010d, .wIndex = 0x8002 }, +- { .name = "REC OUT", .wValue = 0x010a, .wIndex = 0x8002 } ++static const char *snd_djm_get_label_caplevel(u16 wvalue) ++{ ++ switch (wvalue) { ++ case 0x0000: return "-19dB"; ++ case 0x0100: return "-15dB"; ++ case 0x0200: return "-10dB"; ++ case 0x0300: return "-5dB"; ++ default: return NULL; ++ } + }; + +-static const struct snd_pioneer_djm_option snd_pioneer_djm_options_capture_ch34[] = { +- { .name = "CH2 Control Tone PHONO", .wValue = 0x0203, .wIndex = 0x8002 }, +- { .name = "CH2 Control Tone LINE", .wValue = 0x0200, .wIndex = 0x8002 }, +- { .name = "Post CH2 Fader", .wValue = 0x0206, .wIndex = 0x8002 }, +- { .name = "Cross Fader A", .wValue = 0x0207, .wIndex = 0x8002 }, +- { .name = "Cross Fader B", .wValue = 0x0208, .wIndex = 0x8002 }, +- { .name = "MIC", .wValue = 0x0209, .wIndex = 0x8002 }, +- { .name = "AUX", .wValue = 0x020d, .wIndex = 0x8002 }, +- { .name = "REC OUT", .wValue = 0x020a, .wIndex = 0x8002 } ++static const char *snd_djm_get_label_cap(u16 wvalue) ++{ ++ switch (wvalue & 0x00ff) { ++ case SND_DJM_CAP_LINE: return "Control Tone LINE"; ++ case SND_DJM_CAP_CDLINE: return "Control Tone CD/LINE"; ++ case SND_DJM_CAP_DIGITAL: return "Control Tone DIGITAL"; ++ case SND_DJM_CAP_PHONO: return "Control Tone PHONO"; ++ case SND_DJM_CAP_PFADER: return "Post Fader"; ++ case SND_DJM_CAP_XFADERA: return "Cross Fader A"; ++ case SND_DJM_CAP_XFADERB: return "Cross Fader B"; ++ case SND_DJM_CAP_MIC: return "Mic"; ++ case SND_DJM_CAP_RECOUT: return "Rec Out"; ++ case SND_DJM_CAP_AUX: return "Aux"; ++ case SND_DJM_CAP_NONE: return "None"; ++ case SND_DJM_CAP_CH1PFADER: return "Post Fader Ch1"; ++ case SND_DJM_CAP_CH2PFADER: return "Post Fader Ch2"; ++ case SND_DJM_CAP_CH3PFADER: return "Post Fader Ch3"; ++ case SND_DJM_CAP_CH4PFADER: return "Post Fader Ch4"; ++ default: return NULL; ++ } + }; + +-static const struct snd_pioneer_djm_option snd_pioneer_djm_options_capture_ch56[] = { +- { .name = "REC OUT", .wValue = 0x030a, .wIndex = 0x8002 }, +- { .name = "Post CH1 Fader", .wValue = 0x0311, .wIndex = 0x8002 }, +- { .name = "Post CH2 Fader", .wValue = 0x0312, .wIndex = 0x8002 }, +- { .name = "Cross Fader A", .wValue = 0x0307, .wIndex = 0x8002 }, +- { .name = "Cross Fader B", .wValue = 0x0308, .wIndex = 0x8002 }, +- { .name = "MIC", .wValue = 0x0309, .wIndex = 0x8002 }, +- { .name = "AUX", .wValue = 0x030d, .wIndex = 0x8002 } ++static const char *snd_djm_get_label_pb(u16 wvalue) ++{ ++ switch (wvalue & 0x00ff) { ++ case SND_DJM_PB_CH1: return "Ch1"; ++ case SND_DJM_PB_CH2: return "Ch2"; ++ case SND_DJM_PB_AUX: return "Aux"; ++ default: return NULL; ++ } + }; + +-static const struct snd_pioneer_djm_option snd_pioneer_djm_options_playback_12[] = { +- { .name = "CH1", .wValue = 0x0100, .wIndex = 0x8016 }, +- { .name = "CH2", .wValue = 0x0101, .wIndex = 0x8016 }, +- { .name = "AUX", .wValue = 0x0104, .wIndex = 0x8016 } ++static const char *snd_djm_get_label(u16 wvalue, u16 windex) ++{ ++ switch (windex) { ++ case SND_DJM_WINDEX_CAPLVL: return snd_djm_get_label_caplevel(wvalue); ++ case SND_DJM_WINDEX_CAP: return snd_djm_get_label_cap(wvalue); ++ case SND_DJM_WINDEX_PB: return snd_djm_get_label_pb(wvalue); ++ default: return NULL; ++ } + }; + +-static const struct snd_pioneer_djm_option snd_pioneer_djm_options_playback_34[] = { +- { .name = "CH1", .wValue = 0x0200, .wIndex = 0x8016 }, +- { .name = "CH2", .wValue = 0x0201, .wIndex = 0x8016 }, +- { .name = "AUX", .wValue = 0x0204, .wIndex = 0x8016 } ++ ++// DJM-250MK2 ++static const u16 snd_djm_opts_cap_level[] = { ++ 0x0000, 0x0100, 0x0200, 0x0300 }; ++ ++static const u16 snd_djm_opts_250mk2_cap1[] = { ++ 0x0103, 0x0100, 0x0106, 0x0107, 0x0108, 0x0109, 0x010d, 0x010a }; ++ ++static const u16 snd_djm_opts_250mk2_cap2[] = { ++ 0x0203, 0x0200, 0x0206, 0x0207, 0x0208, 0x0209, 0x020d, 0x020a }; ++ ++static const u16 snd_djm_opts_250mk2_cap3[] = { ++ 0x030a, 0x0311, 0x0312, 0x0307, 0x0308, 0x0309, 0x030d }; ++ ++static const u16 snd_djm_opts_250mk2_pb1[] = { 0x0100, 0x0101, 0x0104 }; ++static const u16 snd_djm_opts_250mk2_pb2[] = { 0x0200, 0x0201, 0x0204 }; ++static const u16 snd_djm_opts_250mk2_pb3[] = { 0x0300, 0x0301, 0x0304 }; ++ ++static const struct snd_djm_ctl snd_djm_ctls_250mk2[] = { ++ SND_DJM_CTL("Capture Level", cap_level, 0, SND_DJM_WINDEX_CAPLVL), ++ SND_DJM_CTL("Ch1 Input", 250mk2_cap1, 2, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch2 Input", 250mk2_cap2, 2, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch3 Input", 250mk2_cap3, 0, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch1 Output", 250mk2_pb1, 0, SND_DJM_WINDEX_PB), ++ SND_DJM_CTL("Ch2 Output", 250mk2_pb2, 1, SND_DJM_WINDEX_PB), ++ SND_DJM_CTL("Ch3 Output", 250mk2_pb3, 2, SND_DJM_WINDEX_PB) + }; + +-static const struct snd_pioneer_djm_option snd_pioneer_djm_options_playback_56[] = { +- { .name = "CH1", .wValue = 0x0300, .wIndex = 0x8016 }, +- { .name = "CH2", .wValue = 0x0301, .wIndex = 0x8016 }, +- { .name = "AUX", .wValue = 0x0304, .wIndex = 0x8016 } ++ ++// DJM-750 ++static const u16 snd_djm_opts_750_cap1[] = { ++ 0x0101, 0x0103, 0x0106, 0x0107, 0x0108, 0x0109, 0x010a, 0x010f }; ++static const u16 snd_djm_opts_750_cap2[] = { ++ 0x0200, 0x0201, 0x0206, 0x0207, 0x0208, 0x0209, 0x020a, 0x020f }; ++static const u16 snd_djm_opts_750_cap3[] = { ++ 0x0300, 0x0301, 0x0306, 0x0307, 0x0308, 0x0309, 0x030a, 0x030f }; ++static const u16 snd_djm_opts_750_cap4[] = { ++ 0x0401, 0x0403, 0x0406, 0x0407, 0x0408, 0x0409, 0x040a, 0x040f }; ++ ++static const struct snd_djm_ctl snd_djm_ctls_750[] = { ++ SND_DJM_CTL("Capture Level", cap_level, 0, SND_DJM_WINDEX_CAPLVL), ++ SND_DJM_CTL("Ch1 Input", 750_cap1, 2, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch2 Input", 750_cap2, 2, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch3 Input", 750_cap3, 0, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch4 Input", 750_cap4, 0, SND_DJM_WINDEX_CAP) + }; + +-struct snd_pioneer_djm_option_group { +- const char *name; +- const struct snd_pioneer_djm_option *options; +- const size_t count; +- const u16 default_value; ++ ++// DJM-900NXS2 ++static const u16 snd_djm_opts_900nxs2_cap1[] = { ++ 0x0100, 0x0102, 0x0103, 0x0106, 0x0107, 0x0108, 0x0109, 0x010a }; ++static const u16 snd_djm_opts_900nxs2_cap2[] = { ++ 0x0200, 0x0202, 0x0203, 0x0206, 0x0207, 0x0208, 0x0209, 0x020a }; ++static const u16 snd_djm_opts_900nxs2_cap3[] = { ++ 0x0300, 0x0302, 0x0303, 0x0306, 0x0307, 0x0308, 0x0309, 0x030a }; ++static const u16 snd_djm_opts_900nxs2_cap4[] = { ++ 0x0400, 0x0402, 0x0403, 0x0406, 0x0407, 0x0408, 0x0409, 0x040a }; ++static const u16 snd_djm_opts_900nxs2_cap5[] = { ++ 0x0507, 0x0508, 0x0509, 0x050a, 0x0511, 0x0512, 0x0513, 0x0514 }; ++ ++static const struct snd_djm_ctl snd_djm_ctls_900nxs2[] = { ++ SND_DJM_CTL("Capture Level", cap_level, 0, SND_DJM_WINDEX_CAPLVL), ++ SND_DJM_CTL("Ch1 Input", 900nxs2_cap1, 2, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch2 Input", 900nxs2_cap2, 2, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch3 Input", 900nxs2_cap3, 2, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch4 Input", 900nxs2_cap4, 2, SND_DJM_WINDEX_CAP), ++ SND_DJM_CTL("Ch5 Input", 900nxs2_cap5, 3, SND_DJM_WINDEX_CAP) + }; + +-#define snd_pioneer_djm_option_group_item(_name, suffix, _default_value) { \ +- .name = _name, \ +- .options = snd_pioneer_djm_options_##suffix, \ +- .count = ARRAY_SIZE(snd_pioneer_djm_options_##suffix), \ +- .default_value = _default_value } +- +-static const struct snd_pioneer_djm_option_group snd_pioneer_djm_option_groups[] = { +- snd_pioneer_djm_option_group_item("Master Capture Level Capture Switch", capture_level, 0), +- snd_pioneer_djm_option_group_item("Capture 1-2 Capture Switch", capture_ch12, 2), +- snd_pioneer_djm_option_group_item("Capture 3-4 Capture Switch", capture_ch34, 2), +- snd_pioneer_djm_option_group_item("Capture 5-6 Capture Switch", capture_ch56, 0), +- snd_pioneer_djm_option_group_item("Playback 1-2 Playback Switch", playback_12, 0), +- snd_pioneer_djm_option_group_item("Playback 3-4 Playback Switch", playback_34, 1), +- snd_pioneer_djm_option_group_item("Playback 5-6 Playback Switch", playback_56, 2) ++ ++static const struct snd_djm_device snd_djm_devices[] = { ++ SND_DJM_DEVICE(250mk2), ++ SND_DJM_DEVICE(750), ++ SND_DJM_DEVICE(900nxs2) + }; + +-// layout of the kcontrol->private_value: +-#define SND_PIONEER_DJM_VALUE_MASK 0x0000ffff +-#define SND_PIONEER_DJM_GROUP_MASK 0xffff0000 +-#define SND_PIONEER_DJM_GROUP_SHIFT 16 + +-static int snd_pioneer_djm_controls_info(struct snd_kcontrol *kctl, struct snd_ctl_elem_info *info) ++static int snd_djm_controls_info(struct snd_kcontrol *kctl, ++ struct snd_ctl_elem_info *info) + { +- u16 group_index = kctl->private_value >> SND_PIONEER_DJM_GROUP_SHIFT; +- size_t count; ++ unsigned long private_value = kctl->private_value; ++ u8 device_idx = (private_value & SND_DJM_DEVICE_MASK) >> SND_DJM_DEVICE_SHIFT; ++ u8 ctl_idx = (private_value & SND_DJM_GROUP_MASK) >> SND_DJM_GROUP_SHIFT; ++ const struct snd_djm_device *device = &snd_djm_devices[device_idx]; + const char *name; +- const struct snd_pioneer_djm_option_group *group; ++ const struct snd_djm_ctl *ctl; ++ size_t noptions; + +- if (group_index >= ARRAY_SIZE(snd_pioneer_djm_option_groups)) ++ if (ctl_idx >= device->ncontrols) ++ return -EINVAL; ++ ++ ctl = &device->controls[ctl_idx]; ++ noptions = ctl->noptions; ++ if (info->value.enumerated.item >= noptions) ++ info->value.enumerated.item = noptions - 1; ++ ++ name = snd_djm_get_label(ctl->options[info->value.enumerated.item], ++ ctl->wIndex); ++ if (!name) + return -EINVAL; + +- group = &snd_pioneer_djm_option_groups[group_index]; +- count = group->count; +- if (info->value.enumerated.item >= count) +- info->value.enumerated.item = count - 1; +- name = group->options[info->value.enumerated.item].name; + strlcpy(info->value.enumerated.name, name, sizeof(info->value.enumerated.name)); + info->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED; + info->count = 1; +- info->value.enumerated.items = count; ++ info->value.enumerated.items = noptions; + return 0; + } + +-static int snd_pioneer_djm_controls_update(struct usb_mixer_interface *mixer, u16 group, u16 value) ++static int snd_djm_controls_update(struct usb_mixer_interface *mixer, ++ u8 device_idx, u8 group, u16 value) + { + int err; ++ const struct snd_djm_device *device = &snd_djm_devices[device_idx]; + +- if (group >= ARRAY_SIZE(snd_pioneer_djm_option_groups) +- || value >= snd_pioneer_djm_option_groups[group].count) ++ if ((group >= device->ncontrols) || value >= device->controls[group].noptions) + return -EINVAL; + + err = snd_usb_lock_shutdown(mixer->chip); +@@ -2748,63 +2858,76 @@ static int snd_pioneer_djm_controls_update(struct usb_mixer_interface *mixer, u1 + mixer->chip->dev, usb_sndctrlpipe(mixer->chip->dev, 0), + USB_REQ_SET_FEATURE, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- snd_pioneer_djm_option_groups[group].options[value].wValue, +- snd_pioneer_djm_option_groups[group].options[value].wIndex, ++ device->controls[group].options[value], ++ device->controls[group].wIndex, + NULL, 0); + + snd_usb_unlock_shutdown(mixer->chip); + return err; + } + +-static int snd_pioneer_djm_controls_get(struct snd_kcontrol *kctl, struct snd_ctl_elem_value *elem) ++static int snd_djm_controls_get(struct snd_kcontrol *kctl, ++ struct snd_ctl_elem_value *elem) + { +- elem->value.enumerated.item[0] = kctl->private_value & SND_PIONEER_DJM_VALUE_MASK; ++ elem->value.enumerated.item[0] = kctl->private_value & SND_DJM_VALUE_MASK; + return 0; + } + +-static int snd_pioneer_djm_controls_put(struct snd_kcontrol *kctl, struct snd_ctl_elem_value *elem) ++static int snd_djm_controls_put(struct snd_kcontrol *kctl, struct snd_ctl_elem_value *elem) + { + struct usb_mixer_elem_list *list = snd_kcontrol_chip(kctl); + struct usb_mixer_interface *mixer = list->mixer; + unsigned long private_value = kctl->private_value; +- u16 group = (private_value & SND_PIONEER_DJM_GROUP_MASK) >> SND_PIONEER_DJM_GROUP_SHIFT; ++ ++ u8 device = (private_value & SND_DJM_DEVICE_MASK) >> SND_DJM_DEVICE_SHIFT; ++ u8 group = (private_value & SND_DJM_GROUP_MASK) >> SND_DJM_GROUP_SHIFT; + u16 value = elem->value.enumerated.item[0]; + +- kctl->private_value = (group << SND_PIONEER_DJM_GROUP_SHIFT) | value; ++ kctl->private_value = ((device << SND_DJM_DEVICE_SHIFT) | ++ (group << SND_DJM_GROUP_SHIFT) | ++ value); + +- return snd_pioneer_djm_controls_update(mixer, group, value); ++ return snd_djm_controls_update(mixer, device, group, value); + } + +-static int snd_pioneer_djm_controls_resume(struct usb_mixer_elem_list *list) ++static int snd_djm_controls_resume(struct usb_mixer_elem_list *list) + { + unsigned long private_value = list->kctl->private_value; +- u16 group = (private_value & SND_PIONEER_DJM_GROUP_MASK) >> SND_PIONEER_DJM_GROUP_SHIFT; +- u16 value = (private_value & SND_PIONEER_DJM_VALUE_MASK); ++ u8 device = (private_value & SND_DJM_DEVICE_MASK) >> SND_DJM_DEVICE_SHIFT; ++ u8 group = (private_value & SND_DJM_GROUP_MASK) >> SND_DJM_GROUP_SHIFT; ++ u16 value = (private_value & SND_DJM_VALUE_MASK); + +- return snd_pioneer_djm_controls_update(list->mixer, group, value); ++ return snd_djm_controls_update(list->mixer, device, group, value); + } + +-static int snd_pioneer_djm_controls_create(struct usb_mixer_interface *mixer) ++static int snd_djm_controls_create(struct usb_mixer_interface *mixer, ++ const u8 device_idx) + { + int err, i; +- const struct snd_pioneer_djm_option_group *group; ++ u16 value; ++ ++ const struct snd_djm_device *device = &snd_djm_devices[device_idx]; ++ + struct snd_kcontrol_new knew = { + .iface = SNDRV_CTL_ELEM_IFACE_MIXER, + .access = SNDRV_CTL_ELEM_ACCESS_READWRITE, + .index = 0, +- .info = snd_pioneer_djm_controls_info, +- .get = snd_pioneer_djm_controls_get, +- .put = snd_pioneer_djm_controls_put ++ .info = snd_djm_controls_info, ++ .get = snd_djm_controls_get, ++ .put = snd_djm_controls_put + }; + +- for (i = 0; i < ARRAY_SIZE(snd_pioneer_djm_option_groups); i++) { +- group = &snd_pioneer_djm_option_groups[i]; +- knew.name = group->name; +- knew.private_value = (i << SND_PIONEER_DJM_GROUP_SHIFT) | group->default_value; +- err = snd_pioneer_djm_controls_update(mixer, i, group->default_value); ++ for (i = 0; i < device->ncontrols; i++) { ++ value = device->controls[i].default_value; ++ knew.name = device->controls[i].name; ++ knew.private_value = ( ++ (device_idx << SND_DJM_DEVICE_SHIFT) | ++ (i << SND_DJM_GROUP_SHIFT) | ++ value); ++ err = snd_djm_controls_update(mixer, device_idx, i, value); + if (err) + return err; +- err = add_single_ctl_with_resume(mixer, 0, snd_pioneer_djm_controls_resume, ++ err = add_single_ctl_with_resume(mixer, 0, snd_djm_controls_resume, + &knew, NULL); + if (err) + return err; +@@ -2917,7 +3040,13 @@ int snd_usb_mixer_apply_create_quirk(struct usb_mixer_interface *mixer) + err = snd_bbfpro_controls_create(mixer); + break; + case USB_ID(0x2b73, 0x0017): /* Pioneer DJ DJM-250MK2 */ +- err = snd_pioneer_djm_controls_create(mixer); ++ err = snd_djm_controls_create(mixer, SND_DJM_250MK2_IDX); ++ break; ++ case USB_ID(0x08e4, 0x017f): /* Pioneer DJ DJM-750 */ ++ err = snd_djm_controls_create(mixer, SND_DJM_750_IDX); ++ break; ++ case USB_ID(0x2b73, 0x000a): /* Pioneer DJ DJM-900NXS2 */ ++ err = snd_djm_controls_create(mixer, SND_DJM_900NXS2_IDX); + break; + } +