lkml.org 
[lkml]   [2022]   [Sep]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    SubjectRe: Linux 5.4.215
    Date
    diff --git a/MAINTAINERS b/MAINTAINERS
    index f45d6548a4aa..973fcc9143d1 100644
    --- a/MAINTAINERS
    +++ b/MAINTAINERS
    @@ -17864,7 +17864,8 @@ S: Supported
    F: sound/xen/*

    XFS FILESYSTEM
    -M: Darrick J. Wong <darrick.wong@oracle.com>
    +M: Chandan Babu R <chandan.babu@oracle.com>
    +M: Darrick J. Wong <djwong@kernel.org>
    M: linux-xfs@vger.kernel.org
    L: linux-xfs@vger.kernel.org
    W: http://xfs.org/
    diff --git a/Makefile b/Makefile
    index 59f34d7f6f3b..0c501d2c6a3b 100644
    --- a/Makefile
    +++ b/Makefile
    @@ -1,7 +1,7 @@
    # SPDX-License-Identifier: GPL-2.0
    VERSION = 5
    PATCHLEVEL = 4
    -SUBLEVEL = 214
    +SUBLEVEL = 215
    EXTRAVERSION =
    NAME = Kleptomaniac Octopus

    diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts b/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts
    index a9f4d6d7d2b7..586351340da6 100644
    --- a/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts
    +++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts
    @@ -77,3 +77,8 @@
    };
    };
    };
    +
    +&wlan_host_wake_l {
    + /* Kevin has an external pull up, but Bob does not. */
    + rockchip,pins = <0 RK_PB0 RK_FUNC_GPIO &pcfg_pull_up>;
    +};
    diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi
    index 7cd6d470c1cb..7416db3d27a7 100644
    --- a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi
    +++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi
    @@ -237,6 +237,14 @@
    &edp {
    status = "okay";

    + /*
    + * eDP PHY/clk don't sync reliably at anything other than 24 MHz. Only
    + * set this here, because rk3399-gru.dtsi ensures we can generate this
    + * off GPLL=600MHz, whereas some other RK3399 boards may not.
    + */
    + assigned-clocks = <&cru PCLK_EDP>;
    + assigned-clock-rates = <24000000>;
    +
    ports {
    edp_out: port@1 {
    reg = <1>;
    @@ -397,6 +405,7 @@ ap_i2c_tp: &i2c5 {
    };

    wlan_host_wake_l: wlan-host-wake-l {
    + /* Kevin has an external pull up, but Bob does not */
    rockchip,pins = <0 RK_PB0 RK_FUNC_GPIO &pcfg_pull_none>;
    };
    };
    diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
    index 390b86ec6538..365fa9a3c5bf 100644
    --- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
    +++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
    @@ -102,7 +102,6 @@
    vcc5v0_host: vcc5v0-host-regulator {
    compatible = "regulator-fixed";
    gpio = <&gpio4 RK_PA3 GPIO_ACTIVE_LOW>;
    - enable-active-low;
    pinctrl-names = "default";
    pinctrl-0 = <&vcc5v0_host_en>;
    regulator-name = "vcc5v0_host";
    diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
    index 3ad1f76c063a..2d5e7b21d960 100644
    --- a/arch/mips/cavium-octeon/octeon-irq.c
    +++ b/arch/mips/cavium-octeon/octeon-irq.c
    @@ -127,6 +127,16 @@ static void octeon_irq_free_cd(struct irq_domain *d, unsigned int irq)
    static int octeon_irq_force_ciu_mapping(struct irq_domain *domain,
    int irq, int line, int bit)
    {
    + struct device_node *of_node;
    + int ret;
    +
    + of_node = irq_domain_get_of_node(domain);
    + if (!of_node)
    + return -EINVAL;
    + ret = irq_alloc_desc_at(irq, of_node_to_nid(of_node));
    + if (ret < 0)
    + return ret;
    +
    return irq_domain_associate(domain, irq, line << 6 | bit);
    }

    diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c
    index 7a623684d9b5..2d5a0bcb0cec 100644
    --- a/arch/mips/lantiq/clk.c
    +++ b/arch/mips/lantiq/clk.c
    @@ -50,6 +50,7 @@ struct clk *clk_get_io(void)
    {
    return &cpu_clk_generic[2];
    }
    +EXPORT_SYMBOL_GPL(clk_get_io);

    struct clk *clk_get_ppe(void)
    {
    diff --git a/arch/mips/loongson32/common/platform.c b/arch/mips/loongson32/common/platform.c
    index 794c96c2a4cd..311dc1580bbd 100644
    --- a/arch/mips/loongson32/common/platform.c
    +++ b/arch/mips/loongson32/common/platform.c
    @@ -98,7 +98,7 @@ int ls1x_eth_mux_init(struct platform_device *pdev, void *priv)
    if (plat_dat->bus_id) {
    __raw_writel(__raw_readl(LS1X_MUX_CTRL0) | GMAC1_USE_UART1 |
    GMAC1_USE_UART0, LS1X_MUX_CTRL0);
    - switch (plat_dat->interface) {
    + switch (plat_dat->phy_interface) {
    case PHY_INTERFACE_MODE_RGMII:
    val &= ~(GMAC1_USE_TXCLK | GMAC1_USE_PWM23);
    break;
    @@ -107,12 +107,12 @@ int ls1x_eth_mux_init(struct platform_device *pdev, void *priv)
    break;
    default:
    pr_err("unsupported mii mode %d\n",
    - plat_dat->interface);
    + plat_dat->phy_interface);
    return -ENOTSUPP;
    }
    val &= ~GMAC1_SHUT;
    } else {
    - switch (plat_dat->interface) {
    + switch (plat_dat->phy_interface) {
    case PHY_INTERFACE_MODE_RGMII:
    val &= ~(GMAC0_USE_TXCLK | GMAC0_USE_PWM01);
    break;
    @@ -121,7 +121,7 @@ int ls1x_eth_mux_init(struct platform_device *pdev, void *priv)
    break;
    default:
    pr_err("unsupported mii mode %d\n",
    - plat_dat->interface);
    + plat_dat->phy_interface);
    return -ENOTSUPP;
    }
    val &= ~GMAC0_SHUT;
    @@ -131,7 +131,7 @@ int ls1x_eth_mux_init(struct platform_device *pdev, void *priv)
    plat_dat = dev_get_platdata(&pdev->dev);

    val &= ~PHY_INTF_SELI;
    - if (plat_dat->interface == PHY_INTERFACE_MODE_RMII)
    + if (plat_dat->phy_interface == PHY_INTERFACE_MODE_RMII)
    val |= 0x4 << PHY_INTF_SELI_SHIFT;
    __raw_writel(val, LS1X_MUX_CTRL1);

    @@ -146,9 +146,9 @@ static struct plat_stmmacenet_data ls1x_eth0_pdata = {
    .bus_id = 0,
    .phy_addr = -1,
    #if defined(CONFIG_LOONGSON1_LS1B)
    - .interface = PHY_INTERFACE_MODE_MII,
    + .phy_interface = PHY_INTERFACE_MODE_MII,
    #elif defined(CONFIG_LOONGSON1_LS1C)
    - .interface = PHY_INTERFACE_MODE_RMII,
    + .phy_interface = PHY_INTERFACE_MODE_RMII,
    #endif
    .mdio_bus_data = &ls1x_mdio_bus_data,
    .dma_cfg = &ls1x_eth_dma_cfg,
    @@ -186,7 +186,7 @@ struct platform_device ls1x_eth0_pdev = {
    static struct plat_stmmacenet_data ls1x_eth1_pdata = {
    .bus_id = 1,
    .phy_addr = -1,
    - .interface = PHY_INTERFACE_MODE_MII,
    + .phy_interface = PHY_INTERFACE_MODE_MII,
    .mdio_bus_data = &ls1x_mdio_bus_data,
    .dma_cfg = &ls1x_eth_dma_cfg,
    .has_gmac = 1,
    diff --git a/arch/x86/include/asm/cpu_entry_area.h b/arch/x86/include/asm/cpu_entry_area.h
    index ea866c7bf31d..0d1d37d8b279 100644
    --- a/arch/x86/include/asm/cpu_entry_area.h
    +++ b/arch/x86/include/asm/cpu_entry_area.h
    @@ -133,7 +133,7 @@ extern void cea_set_pte(void *cea_vaddr, phys_addr_t pa, pgprot_t flags);

    extern struct cpu_entry_area *get_cpu_entry_area(int cpu);

    -static inline struct entry_stack *cpu_entry_stack(int cpu)
    +static __always_inline struct entry_stack *cpu_entry_stack(int cpu)
    {
    return &get_cpu_entry_area(cpu)->entry_stack_page.stack;
    }
    diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c
    index edba5e7a3743..c8a1ef872e0d 100644
    --- a/drivers/firmware/efi/libstub/secureboot.c
    +++ b/drivers/firmware/efi/libstub/secureboot.c
    @@ -19,7 +19,7 @@ static const efi_char16_t efi_SetupMode_name[] = L"SetupMode";

    /* SHIM variables */
    static const efi_guid_t shim_guid = EFI_SHIM_LOCK_GUID;
    -static const efi_char16_t shim_MokSBState_name[] = L"MokSBState";
    +static const efi_char16_t shim_MokSBState_name[] = L"MokSBStateRT";

    #define get_efi_var(name, vendor, ...) \
    efi_call_runtime(get_variable, \
    @@ -58,8 +58,8 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)

    /*
    * See if a user has put the shim into insecure mode. If so, and if the
    - * variable doesn't have the runtime attribute set, we might as well
    - * honor that.
    + * variable doesn't have the non-volatile attribute set, we might as
    + * well honor that.
    */
    size = sizeof(moksbstate);
    status = get_efi_var(shim_MokSBState_name, &shim_guid,
    @@ -68,7 +68,7 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)
    /* If it fails, we don't care why. Default to secure */
    if (status != EFI_SUCCESS)
    goto secure_boot_enabled;
    - if (!(attr & EFI_VARIABLE_RUNTIME_ACCESS) && moksbstate == 1)
    + if (!(attr & EFI_VARIABLE_NON_VOLATILE) && moksbstate == 1)
    return efi_secureboot_mode_disabled;

    secure_boot_enabled:
    diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
    index d72a3a5507b0..f3bf82efea8e 100644
    --- a/drivers/gpio/gpio-mpc8xxx.c
    +++ b/drivers/gpio/gpio-mpc8xxx.c
    @@ -190,6 +190,7 @@ static int mpc8xxx_irq_set_type(struct irq_data *d, unsigned int flow_type)

    switch (flow_type) {
    case IRQ_TYPE_EDGE_FALLING:
    + case IRQ_TYPE_LEVEL_LOW:
    raw_spin_lock_irqsave(&mpc8xxx_gc->lock, flags);
    gc->write_reg(mpc8xxx_gc->regs + GPIO_ICR,
    gc->read_reg(mpc8xxx_gc->regs + GPIO_ICR)
    diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
    index b588e0e409e7..d8687868407d 100644
    --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
    +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
    @@ -35,6 +35,7 @@
    #include <linux/pci.h>
    #include <linux/pm_runtime.h>
    #include <drm/drm_crtc_helper.h>
    +#include <drm/drm_damage_helper.h>
    #include <drm/drm_edid.h>
    #include <drm/drm_gem_framebuffer_helper.h>
    #include <drm/drm_fb_helper.h>
    @@ -495,6 +496,7 @@ bool amdgpu_display_ddc_probe(struct amdgpu_connector *amdgpu_connector,
    static const struct drm_framebuffer_funcs amdgpu_fb_funcs = {
    .destroy = drm_gem_fb_destroy,
    .create_handle = drm_gem_fb_create_handle,
    + .dirty = drm_atomic_helper_dirtyfb,
    };

    uint32_t amdgpu_display_supported_domains(struct amdgpu_device *adev,
    diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
    index e042d8ce05b4..22d105635e33 100644
    --- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
    +++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
    @@ -1486,6 +1486,7 @@ static void interpolate_user_regamma(uint32_t hw_points_num,
    struct fixed31_32 lut2;
    struct fixed31_32 delta_lut;
    struct fixed31_32 delta_index;
    + const struct fixed31_32 one = dc_fixpt_from_int(1);

    i = 0;
    /* fixed_pt library has problems handling too small values */
    @@ -1514,6 +1515,9 @@ static void interpolate_user_regamma(uint32_t hw_points_num,
    } else
    hw_x = coordinates_x[i].x;

    + if (dc_fixpt_le(one, hw_x))
    + hw_x = one;
    +
    norm_x = dc_fixpt_mul(norm_factor, hw_x);
    index = dc_fixpt_floor(norm_x);
    if (index < 0 || index > 255)
    diff --git a/drivers/gpu/drm/meson/meson_plane.c b/drivers/gpu/drm/meson/meson_plane.c
    index ed543227b00d..53f5d0581c35 100644
    --- a/drivers/gpu/drm/meson/meson_plane.c
    +++ b/drivers/gpu/drm/meson/meson_plane.c
    @@ -128,7 +128,7 @@ static void meson_plane_atomic_update(struct drm_plane *plane,

    /* Enable OSD and BLK0, set max global alpha */
    priv->viu.osd1_ctrl_stat = OSD_ENABLE |
    - (0xFF << OSD_GLOBAL_ALPHA_SHIFT) |
    + (0x100 << OSD_GLOBAL_ALPHA_SHIFT) |
    OSD_BLK0_ENABLE;

    canvas_id_osd1 = priv->canvas_id_osd1;
    diff --git a/drivers/gpu/drm/meson/meson_viu.c b/drivers/gpu/drm/meson/meson_viu.c
    index 9991f0a43b1a..8d0938525978 100644
    --- a/drivers/gpu/drm/meson/meson_viu.c
    +++ b/drivers/gpu/drm/meson/meson_viu.c
    @@ -91,7 +91,7 @@ static void meson_viu_set_g12a_osd1_matrix(struct meson_drm *priv,
    priv->io_base + _REG(VPP_WRAP_OSD1_MATRIX_COEF11_12));
    writel(((m[9] & 0x1fff) << 16) | (m[10] & 0x1fff),
    priv->io_base + _REG(VPP_WRAP_OSD1_MATRIX_COEF20_21));
    - writel((m[11] & 0x1fff) << 16,
    + writel((m[11] & 0x1fff),
    priv->io_base + _REG(VPP_WRAP_OSD1_MATRIX_COEF22));

    writel(((m[18] & 0xfff) << 16) | (m[19] & 0xfff),
    diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c
    index 8f299d76b69b..67dae1354aa6 100644
    --- a/drivers/gpu/drm/rockchip/cdn-dp-core.c
    +++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c
    @@ -275,8 +275,9 @@ static int cdn_dp_connector_get_modes(struct drm_connector *connector)
    return ret;
    }

    -static int cdn_dp_connector_mode_valid(struct drm_connector *connector,
    - struct drm_display_mode *mode)
    +static enum drm_mode_status
    +cdn_dp_connector_mode_valid(struct drm_connector *connector,
    + struct drm_display_mode *mode)
    {
    struct cdn_dp_device *dp = connector_to_dp(connector);
    struct drm_display_info *display_info = &dp->connector.display_info;
    diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
    index 56918274c48c..d4c5efc6e157 100644
    --- a/drivers/hv/vmbus_drv.c
    +++ b/drivers/hv/vmbus_drv.c
    @@ -2075,7 +2075,7 @@ int vmbus_allocate_mmio(struct resource **new, struct hv_device *device_obj,
    bool fb_overlap_ok)
    {
    struct resource *iter, *shadow;
    - resource_size_t range_min, range_max, start;
    + resource_size_t range_min, range_max, start, end;
    const char *dev_n = dev_name(&device_obj->device);
    int retval;

    @@ -2110,6 +2110,14 @@ int vmbus_allocate_mmio(struct resource **new, struct hv_device *device_obj,
    range_max = iter->end;
    start = (range_min + align - 1) & ~(align - 1);
    for (; start + size - 1 <= range_max; start += align) {
    + end = start + size - 1;
    +
    + /* Skip the whole fb_mmio region if not fb_overlap_ok */
    + if (!fb_overlap_ok && fb_mmio &&
    + (((start >= fb_mmio->start) && (start <= fb_mmio->end)) ||
    + ((end >= fb_mmio->start) && (end <= fb_mmio->end))))
    + continue;
    +
    shadow = __request_region(iter, start, size, NULL,
    IORESOURCE_BUSY);
    if (!shadow)
    diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
    index bf4ab30186af..abd2a57b18cb 100644
    --- a/drivers/net/can/usb/gs_usb.c
    +++ b/drivers/net/can/usb/gs_usb.c
    @@ -678,6 +678,7 @@ static int gs_can_open(struct net_device *netdev)
    flags |= GS_CAN_MODE_TRIPLE_SAMPLE;

    /* finally start device */
    + dev->can.state = CAN_STATE_ERROR_ACTIVE;
    dm->mode = cpu_to_le32(GS_CAN_MODE_START);
    dm->flags = cpu_to_le32(flags);
    rc = usb_control_msg(interface_to_usbdev(dev->iface),
    @@ -694,13 +695,12 @@ static int gs_can_open(struct net_device *netdev)
    if (rc < 0) {
    netdev_err(netdev, "Couldn't start device (err=%d)\n", rc);
    kfree(dm);
    + dev->can.state = CAN_STATE_STOPPED;
    return rc;
    }

    kfree(dm);

    - dev->can.state = CAN_STATE_ERROR_ACTIVE;
    -
    parent->active_channels++;
    if (!(dev->can.ctrlmode & CAN_CTRLMODE_LISTENONLY))
    netif_start_queue(netdev);
    diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
    index 2d01eaeb703a..15f177185d71 100644
    --- a/drivers/net/ethernet/intel/i40e/i40e_main.c
    +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
    @@ -5638,6 +5638,26 @@ static int i40e_get_link_speed(struct i40e_vsi *vsi)
    }
    }

    +/**
    + * i40e_bw_bytes_to_mbits - Convert max_tx_rate from bytes to mbits
    + * @vsi: Pointer to vsi structure
    + * @max_tx_rate: max TX rate in bytes to be converted into Mbits
    + *
    + * Helper function to convert units before send to set BW limit
    + **/
    +static u64 i40e_bw_bytes_to_mbits(struct i40e_vsi *vsi, u64 max_tx_rate)
    +{
    + if (max_tx_rate < I40E_BW_MBPS_DIVISOR) {
    + dev_warn(&vsi->back->pdev->dev,
    + "Setting max tx rate to minimum usable value of 50Mbps.\n");
    + max_tx_rate = I40E_BW_CREDIT_DIVISOR;
    + } else {
    + do_div(max_tx_rate, I40E_BW_MBPS_DIVISOR);
    + }
    +
    + return max_tx_rate;
    +}
    +
    /**
    * i40e_set_bw_limit - setup BW limit for Tx traffic based on max_tx_rate
    * @vsi: VSI to be configured
    @@ -5660,10 +5680,10 @@ int i40e_set_bw_limit(struct i40e_vsi *vsi, u16 seid, u64 max_tx_rate)
    max_tx_rate, seid);
    return -EINVAL;
    }
    - if (max_tx_rate && max_tx_rate < 50) {
    + if (max_tx_rate && max_tx_rate < I40E_BW_CREDIT_DIVISOR) {
    dev_warn(&pf->pdev->dev,
    "Setting max tx rate to minimum usable value of 50Mbps.\n");
    - max_tx_rate = 50;
    + max_tx_rate = I40E_BW_CREDIT_DIVISOR;
    }

    /* Tx rate credits are in values of 50Mbps, 0 is disabled */
    @@ -7591,9 +7611,9 @@ static int i40e_setup_tc(struct net_device *netdev, void *type_data)

    if (pf->flags & I40E_FLAG_TC_MQPRIO) {
    if (vsi->mqprio_qopt.max_rate[0]) {
    - u64 max_tx_rate = vsi->mqprio_qopt.max_rate[0];
    + u64 max_tx_rate = i40e_bw_bytes_to_mbits(vsi,
    + vsi->mqprio_qopt.max_rate[0]);

    - do_div(max_tx_rate, I40E_BW_MBPS_DIVISOR);
    ret = i40e_set_bw_limit(vsi, vsi->seid, max_tx_rate);
    if (!ret) {
    u64 credits = max_tx_rate;
    @@ -10247,10 +10267,10 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
    }

    if (vsi->mqprio_qopt.max_rate[0]) {
    - u64 max_tx_rate = vsi->mqprio_qopt.max_rate[0];
    + u64 max_tx_rate = i40e_bw_bytes_to_mbits(vsi,
    + vsi->mqprio_qopt.max_rate[0]);
    u64 credits = 0;

    - do_div(max_tx_rate, I40E_BW_MBPS_DIVISOR);
    ret = i40e_set_bw_limit(vsi, vsi->seid, max_tx_rate);
    if (ret)
    goto end_unlock;
    diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
    index 4080fdacca4c..16f5baafbbd5 100644
    --- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
    +++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
    @@ -1873,6 +1873,25 @@ static void i40e_del_qch(struct i40e_vf *vf)
    }
    }

    +/**
    + * i40e_vc_get_max_frame_size
    + * @vf: pointer to the VF
    + *
    + * Max frame size is determined based on the current port's max frame size and
    + * whether a port VLAN is configured on this VF. The VF is not aware whether
    + * it's in a port VLAN so the PF needs to account for this in max frame size
    + * checks and sending the max frame size to the VF.
    + **/
    +static u16 i40e_vc_get_max_frame_size(struct i40e_vf *vf)
    +{
    + u16 max_frame_size = vf->pf->hw.phy.link_info.max_frame_size;
    +
    + if (vf->port_vlan_id)
    + max_frame_size -= VLAN_HLEN;
    +
    + return max_frame_size;
    +}
    +
    /**
    * i40e_vc_get_vf_resources_msg
    * @vf: pointer to the VF info
    @@ -1973,6 +1992,7 @@ static int i40e_vc_get_vf_resources_msg(struct i40e_vf *vf, u8 *msg)
    vfres->max_vectors = pf->hw.func_caps.num_msix_vectors_vf;
    vfres->rss_key_size = I40E_HKEY_ARRAY_SIZE;
    vfres->rss_lut_size = I40E_VF_HLUT_ARRAY_SIZE;
    + vfres->max_mtu = i40e_vc_get_max_frame_size(vf);

    if (vf->lan_vsi_idx) {
    vfres->vsi_res[0].vsi_id = vf->lan_vsi_id;
    diff --git a/drivers/net/ethernet/intel/iavf/iavf_txrx.c b/drivers/net/ethernet/intel/iavf/iavf_txrx.c
    index c6905d1b6182..1f7b842c6763 100644
    --- a/drivers/net/ethernet/intel/iavf/iavf_txrx.c
    +++ b/drivers/net/ethernet/intel/iavf/iavf_txrx.c
    @@ -114,8 +114,11 @@ u32 iavf_get_tx_pending(struct iavf_ring *ring, bool in_sw)
    {
    u32 head, tail;

    + /* underlying hardware might not allow access and/or always return
    + * 0 for the head/tail registers so just use the cached values
    + */
    head = ring->next_to_clean;
    - tail = readl(ring->tail);
    + tail = ring->next_to_use;

    if (head != tail)
    return (head < tail) ?
    @@ -1371,7 +1374,7 @@ static struct sk_buff *iavf_build_skb(struct iavf_ring *rx_ring,
    #endif
    struct sk_buff *skb;

    - if (!rx_buffer)
    + if (!rx_buffer || !size)
    return NULL;
    /* prefetch first cache line of first page */
    va = page_address(rx_buffer->page) + rx_buffer->page_offset;
    @@ -1531,7 +1534,7 @@ static int iavf_clean_rx_irq(struct iavf_ring *rx_ring, int budget)
    /* exit if we failed to retrieve a buffer */
    if (!skb) {
    rx_ring->rx_stats.alloc_buff_failed++;
    - if (rx_buffer)
    + if (rx_buffer && size)
    rx_buffer->pagecnt_bias++;
    break;
    }
    diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
    index 4d471a6f2946..7a17694b6a0b 100644
    --- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
    +++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
    @@ -241,11 +241,14 @@ int iavf_get_vf_config(struct iavf_adapter *adapter)
    void iavf_configure_queues(struct iavf_adapter *adapter)
    {
    struct virtchnl_vsi_queue_config_info *vqci;
    - struct virtchnl_queue_pair_info *vqpi;
    + int i, max_frame = adapter->vf_res->max_mtu;
    int pairs = adapter->num_active_queues;
    - int i, max_frame = IAVF_MAX_RXBUFFER;
    + struct virtchnl_queue_pair_info *vqpi;
    size_t len;

    + if (max_frame > IAVF_MAX_RXBUFFER || !max_frame)
    + max_frame = IAVF_MAX_RXBUFFER;
    +
    if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
    /* bail because we already have a command pending */
    dev_err(&adapter->pdev->dev, "Cannot configure queues, command %d pending\n",
    diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c
    index 3133f903279c..dbbbb6ea9f2b 100644
    --- a/drivers/net/ethernet/sun/sunhme.c
    +++ b/drivers/net/ethernet/sun/sunhme.c
    @@ -2064,9 +2064,9 @@ static void happy_meal_rx(struct happy_meal *hp, struct net_device *dev)

    skb_reserve(copy_skb, 2);
    skb_put(copy_skb, len);
    - dma_sync_single_for_cpu(hp->dma_dev, dma_addr, len, DMA_FROM_DEVICE);
    + dma_sync_single_for_cpu(hp->dma_dev, dma_addr, len + 2, DMA_FROM_DEVICE);
    skb_copy_from_linear_data(skb, copy_skb->data, len);
    - dma_sync_single_for_device(hp->dma_dev, dma_addr, len, DMA_FROM_DEVICE);
    + dma_sync_single_for_device(hp->dma_dev, dma_addr, len + 2, DMA_FROM_DEVICE);
    /* Reuse original ring buffer. */
    hme_write_rxd(hp, this,
    (RXFLAG_OWN|((RX_BUF_ALLOC_SIZE-RX_OFFSET)<<16)),
    diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
    index 8801d093135c..a33149ee0ddc 100644
    --- a/drivers/net/ipvlan/ipvlan_core.c
    +++ b/drivers/net/ipvlan/ipvlan_core.c
    @@ -496,7 +496,6 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb)

    static int ipvlan_process_outbound(struct sk_buff *skb)
    {
    - struct ethhdr *ethh = eth_hdr(skb);
    int ret = NET_XMIT_DROP;

    /* The ipvlan is a pseudo-L2 device, so the packets that we receive
    @@ -506,6 +505,8 @@ static int ipvlan_process_outbound(struct sk_buff *skb)
    if (skb_mac_header_was_set(skb)) {
    /* In this mode we dont care about
    * multicast and broadcast traffic */
    + struct ethhdr *ethh = eth_hdr(skb);
    +
    if (is_multicast_ether_addr(ethh->h_dest)) {
    pr_debug_ratelimited(
    "Dropped {multi|broad}cast of type=[%x]\n",
    @@ -590,7 +591,7 @@ static int ipvlan_xmit_mode_l3(struct sk_buff *skb, struct net_device *dev)
    static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
    {
    const struct ipvl_dev *ipvlan = netdev_priv(dev);
    - struct ethhdr *eth = eth_hdr(skb);
    + struct ethhdr *eth = skb_eth_hdr(skb);
    struct ipvl_addr *addr;
    void *lyr3h;
    int addr_type;
    @@ -620,6 +621,7 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
    return dev_forward_skb(ipvlan->phy_dev, skb);

    } else if (is_multicast_ether_addr(eth->h_dest)) {
    + skb_reset_mac_header(skb);
    ipvlan_skb_crossing_ns(skb, NULL);
    ipvlan_multicast_enqueue(ipvlan->port, skb, true);
    return NET_XMIT_SUCCESS;
    diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
    index 0eb894b7c0bd..da74ec778b6e 100644
    --- a/drivers/net/team/team.c
    +++ b/drivers/net/team/team.c
    @@ -1270,10 +1270,12 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
    }
    }

    - netif_addr_lock_bh(dev);
    - dev_uc_sync_multiple(port_dev, dev);
    - dev_mc_sync_multiple(port_dev, dev);
    - netif_addr_unlock_bh(dev);
    + if (dev->flags & IFF_UP) {
    + netif_addr_lock_bh(dev);
    + dev_uc_sync_multiple(port_dev, dev);
    + dev_mc_sync_multiple(port_dev, dev);
    + netif_addr_unlock_bh(dev);
    + }

    port->index = -1;
    list_add_tail_rcu(&port->list, &team->port_list);
    @@ -1344,8 +1346,10 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
    netdev_rx_handler_unregister(port_dev);
    team_port_disable_netpoll(port);
    vlan_vids_del_by_dev(port_dev, dev);
    - dev_uc_unsync(port_dev, dev);
    - dev_mc_unsync(port_dev, dev);
    + if (dev->flags & IFF_UP) {
    + dev_uc_unsync(port_dev, dev);
    + dev_mc_unsync(port_dev, dev);
    + }
    dev_close(port_dev);
    team_port_leave(team, port);

    @@ -1694,6 +1698,14 @@ static int team_open(struct net_device *dev)

    static int team_close(struct net_device *dev)
    {
    + struct team *team = netdev_priv(dev);
    + struct team_port *port;
    +
    + list_for_each_entry(port, &team->port_list, list) {
    + dev_uc_unsync(port->dev, dev);
    + dev_mc_unsync(port->dev, dev);
    + }
    +
    return 0;
    }

    diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
    index 8ef0a013874c..cee90e505d17 100644
    --- a/drivers/net/usb/qmi_wwan.c
    +++ b/drivers/net/usb/qmi_wwan.c
    @@ -1046,6 +1046,7 @@ static const struct usb_device_id products[] = {
    {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */
    {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0620)}, /* Quectel EM160R-GL */
    {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL */
    + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0801)}, /* Quectel RM520N */

    /* 3. Combined interface devices matching on interface number */
    {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */
    diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
    index 943d2a60bfdf..6d519ef3c5da 100644
    --- a/drivers/of/fdt.c
    +++ b/drivers/of/fdt.c
    @@ -315,7 +315,7 @@ static int unflatten_dt_nodes(const void *blob,
    for (offset = 0;
    offset >= 0 && depth >= initial_depth;
    offset = fdt_next_node(blob, offset, &depth)) {
    - if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH))
    + if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH - 1))
    continue;

    if (!IS_ENABLED(CONFIG_OF_KOBJ) &&
    diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
    index 26ddb4cc675a..7a3de2b5de0c 100644
    --- a/drivers/of/of_mdio.c
    +++ b/drivers/of/of_mdio.c
    @@ -281,6 +281,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
    return 0;

    unregister:
    + of_node_put(child);
    mdiobus_unregister(mdio);
    return rc;
    }
    diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
    index 6209d58e9492..fdd302d0a1c9 100644
    --- a/drivers/parisc/ccio-dma.c
    +++ b/drivers/parisc/ccio-dma.c
    @@ -1544,6 +1544,7 @@ static int __init ccio_probe(struct parisc_device *dev)
    }
    ccio_ioc_init(ioc);
    if (ccio_init_resources(ioc)) {
    + iounmap(ioc->ioc_regs);
    kfree(ioc);
    return -ENOMEM;
    }
    diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
    index f873d97100e2..13609942d45c 100644
    --- a/drivers/regulator/pfuze100-regulator.c
    +++ b/drivers/regulator/pfuze100-regulator.c
    @@ -788,7 +788,7 @@ static int pfuze100_regulator_probe(struct i2c_client *client,
    ((pfuze_chip->chip_id == PFUZE3000) ? "3000" : "3001"))));

    memcpy(pfuze_chip->regulator_descs, pfuze_chip->pfuze_regulators,
    - sizeof(pfuze_chip->regulator_descs));
    + regulator_num * sizeof(struct pfuze_regulator));

    ret = pfuze_parse_regulators_dt(pfuze_chip);
    if (ret)
    diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
    index dc78a523a69f..b6b938aa6615 100644
    --- a/drivers/s390/block/dasd_alias.c
    +++ b/drivers/s390/block/dasd_alias.c
    @@ -675,12 +675,12 @@ int dasd_alias_remove_device(struct dasd_device *device)
    struct dasd_device *dasd_alias_get_start_dev(struct dasd_device *base_device)
    {
    struct dasd_eckd_private *alias_priv, *private = base_device->private;
    - struct alias_pav_group *group = private->pavgroup;
    struct alias_lcu *lcu = private->lcu;
    struct dasd_device *alias_device;
    + struct alias_pav_group *group;
    unsigned long flags;

    - if (!group || !lcu)
    + if (!lcu)
    return NULL;
    if (lcu->pav == NO_PAV ||
    lcu->flags & (NEED_UAC_UPDATE | UPDATE_PENDING))
    @@ -697,6 +697,11 @@ struct dasd_device *dasd_alias_get_start_dev(struct dasd_device *base_device)
    }

    spin_lock_irqsave(&lcu->lock, flags);
    + group = private->pavgroup;
    + if (!group) {
    + spin_unlock_irqrestore(&lcu->lock, flags);
    + return NULL;
    + }
    alias_device = group->next;
    if (!alias_device) {
    if (list_empty(&group->aliaslist)) {
    diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
    index 3b2c25bd2e06..3bd93558b443 100644
    --- a/drivers/tty/serial/atmel_serial.c
    +++ b/drivers/tty/serial/atmel_serial.c
    @@ -306,16 +306,16 @@ static int atmel_config_rs485(struct uart_port *port,

    mode = atmel_uart_readl(port, ATMEL_US_MR);

    - /* Resetting serial mode to RS232 (0x0) */
    - mode &= ~ATMEL_US_USMODE;
    -
    - port->rs485 = *rs485conf;
    -
    if (rs485conf->flags & SER_RS485_ENABLED) {
    dev_dbg(port->dev, "Setting UART to RS485\n");
    - atmel_port->tx_done_mask = ATMEL_US_TXEMPTY;
    + if (rs485conf->flags & SER_RS485_RX_DURING_TX)
    + atmel_port->tx_done_mask = ATMEL_US_TXRDY;
    + else
    + atmel_port->tx_done_mask = ATMEL_US_TXEMPTY;
    +
    atmel_uart_writel(port, ATMEL_US_TTGR,
    rs485conf->delay_rts_after_send);
    + mode &= ~ATMEL_US_USMODE;
    mode |= ATMEL_US_USMODE_RS485;
    } else {
    dev_dbg(port->dev, "Setting UART to RS232\n");
    @@ -832,7 +832,7 @@ static void atmel_tx_chars(struct uart_port *port)
    struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);

    if (port->x_char &&
    - (atmel_uart_readl(port, ATMEL_US_CSR) & atmel_port->tx_done_mask)) {
    + (atmel_uart_readl(port, ATMEL_US_CSR) & ATMEL_US_TXRDY)) {
    atmel_uart_write_char(port, port->x_char);
    port->icount.tx++;
    port->x_char = 0;
    @@ -840,8 +840,7 @@ static void atmel_tx_chars(struct uart_port *port)
    if (uart_circ_empty(xmit) || uart_tx_stopped(port))
    return;

    - while (atmel_uart_readl(port, ATMEL_US_CSR) &
    - atmel_port->tx_done_mask) {
    + while (atmel_uart_readl(port, ATMEL_US_CSR) & ATMEL_US_TXRDY) {
    atmel_uart_write_char(port, xmit->buf[xmit->tail]);
    xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
    port->icount.tx++;
    @@ -852,10 +851,20 @@ static void atmel_tx_chars(struct uart_port *port)
    if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
    uart_write_wakeup(port);

    - if (!uart_circ_empty(xmit))
    + if (!uart_circ_empty(xmit)) {
    + /* we still have characters to transmit, so we should continue
    + * transmitting them when TX is ready, regardless of
    + * mode or duplexity
    + */
    + atmel_port->tx_done_mask |= ATMEL_US_TXRDY;
    +
    /* Enable interrupts */
    atmel_uart_writel(port, ATMEL_US_IER,
    atmel_port->tx_done_mask);
    + } else {
    + if (atmel_uart_is_half_duplex(port))
    + atmel_port->tx_done_mask &= ~ATMEL_US_TXRDY;
    + }
    }

    static void atmel_complete_tx_dma(void *arg)
    @@ -2541,8 +2550,7 @@ static int atmel_init_port(struct atmel_uart_port *atmel_port,
    * Use TXEMPTY for interrupt when rs485 or ISO7816 else TXRDY or
    * ENDTX|TXBUFE
    */
    - if (port->rs485.flags & SER_RS485_ENABLED ||
    - port->iso7816.flags & SER_ISO7816_ENABLED)
    + if (atmel_uart_is_half_duplex(port))
    atmel_port->tx_done_mask = ATMEL_US_TXEMPTY;
    else if (atmel_use_pdc_tx(port)) {
    port->fifosize = PDC_BUFFER_SIZE;
    diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
    index 74c21152367a..c5f43cd39664 100644
    --- a/drivers/tty/serial/serial-tegra.c
    +++ b/drivers/tty/serial/serial-tegra.c
    @@ -519,7 +519,7 @@ static void tegra_uart_tx_dma_complete(void *args)
    count = tup->tx_bytes_requested - state.residue;
    async_tx_ack(tup->tx_dma_desc);
    spin_lock_irqsave(&tup->uport.lock, flags);
    - xmit->tail = (xmit->tail + count) & (UART_XMIT_SIZE - 1);
    + uart_xmit_advance(&tup->uport, count);
    tup->tx_in_progress = 0;
    if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
    uart_write_wakeup(&tup->uport);
    @@ -606,7 +606,6 @@ static unsigned int tegra_uart_tx_empty(struct uart_port *u)
    static void tegra_uart_stop_tx(struct uart_port *u)
    {
    struct tegra_uart_port *tup = to_tegra_uport(u);
    - struct circ_buf *xmit = &tup->uport.state->xmit;
    struct dma_tx_state state;
    unsigned int count;

    @@ -617,7 +616,7 @@ static void tegra_uart_stop_tx(struct uart_port *u)
    dmaengine_tx_status(tup->tx_dma_chan, tup->tx_cookie, &state);
    count = tup->tx_bytes_requested - state.residue;
    async_tx_ack(tup->tx_dma_desc);
    - xmit->tail = (xmit->tail + count) & (UART_XMIT_SIZE - 1);
    + uart_xmit_advance(&tup->uport, count);
    tup->tx_in_progress = 0;
    }

    diff --git a/drivers/tty/serial/tegra-tcu.c b/drivers/tty/serial/tegra-tcu.c
    index aaf8748a6147..31ae705aa38b 100644
    --- a/drivers/tty/serial/tegra-tcu.c
    +++ b/drivers/tty/serial/tegra-tcu.c
    @@ -101,7 +101,7 @@ static void tegra_tcu_uart_start_tx(struct uart_port *port)
    break;

    tegra_tcu_write(tcu, &xmit->buf[xmit->tail], count);
    - xmit->tail = (xmit->tail + count) & (UART_XMIT_SIZE - 1);
    + uart_xmit_advance(port, count);
    }

    uart_write_wakeup(port);
    diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c
    index 8bedf0504e92..d111cf81cece 100644
    --- a/drivers/usb/cdns3/gadget.c
    +++ b/drivers/usb/cdns3/gadget.c
    @@ -1259,6 +1259,7 @@ static int cdns3_check_ep_interrupt_proceed(struct cdns3_endpoint *priv_ep)
    ep_cfg &= ~EP_CFG_ENABLE;
    writel(ep_cfg, &priv_dev->regs->ep_cfg);
    priv_ep->flags &= ~EP_QUIRK_ISO_OUT_EN;
    + priv_ep->flags |= EP_UPDATE_EP_TRBADDR;
    }
    cdns3_transfer_completed(priv_dev, priv_ep);
    } else if (!(priv_ep->flags & EP_STALLED) &&
    diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
    index 68d860a3fd61..50c7df59f7e8 100644
    --- a/drivers/usb/core/hub.c
    +++ b/drivers/usb/core/hub.c
    @@ -5924,7 +5924,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
    *
    * Return: The same as for usb_reset_and_verify_device().
    * However, if a reset is already in progress (for instance, if a
    - * driver doesn't have pre_ or post_reset() callbacks, and while
    + * driver doesn't have pre_reset() or post_reset() callbacks, and while
    * being unbound or re-bound during the ongoing reset its disconnect()
    * or probe() routine tries to perform a second, nested reset), the
    * routine returns -EINPROGRESS.
    diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
    index f4655665a1b5..a9c49b2ce511 100644
    --- a/drivers/usb/dwc3/core.c
    +++ b/drivers/usb/dwc3/core.c
    @@ -227,7 +227,7 @@ u32 dwc3_core_fifo_space(struct dwc3_ep *dep, u8 type)
    * dwc3_core_soft_reset - Issues core soft reset and PHY reset
    * @dwc: pointer to our context structure
    */
    -static int dwc3_core_soft_reset(struct dwc3 *dwc)
    +int dwc3_core_soft_reset(struct dwc3 *dwc)
    {
    u32 reg;
    int retries = 1000;
    diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
    index da296f888f45..f320b989abd2 100644
    --- a/drivers/usb/dwc3/core.h
    +++ b/drivers/usb/dwc3/core.h
    @@ -994,6 +994,7 @@ struct dwc3_scratchpad_array {
    * @tx_max_burst_prd: max periodic ESS transmit burst size
    * @hsphy_interface: "utmi" or "ulpi"
    * @connected: true when we're connected to a host, false otherwise
    + * @softconnect: true when gadget connect is called, false when disconnect runs
    * @delayed_status: true when gadget driver asks for delayed status
    * @ep0_bounced: true when we used bounce buffer
    * @ep0_expect_in: true when we expect a DATA IN transfer
    @@ -1196,6 +1197,7 @@ struct dwc3 {
    const char *hsphy_interface;

    unsigned connected:1;
    + unsigned softconnect:1;
    unsigned delayed_status:1;
    unsigned ep0_bounced:1;
    unsigned ep0_expect_in:1;
    @@ -1420,6 +1422,8 @@ bool dwc3_has_imod(struct dwc3 *dwc);
    int dwc3_event_buffers_setup(struct dwc3 *dwc);
    void dwc3_event_buffers_cleanup(struct dwc3 *dwc);

    +int dwc3_core_soft_reset(struct dwc3 *dwc);
    +
    #if IS_ENABLED(CONFIG_USB_DWC3_HOST) || IS_ENABLED(CONFIG_USB_DWC3_DUAL_ROLE)
    int dwc3_host_init(struct dwc3 *dwc);
    void dwc3_host_exit(struct dwc3 *dwc);
    diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
    index 80fee7ea83ca..a40935f3592b 100644
    --- a/drivers/usb/dwc3/gadget.c
    +++ b/drivers/usb/dwc3/gadget.c
    @@ -2008,14 +2008,42 @@ static void dwc3_gadget_disable_irq(struct dwc3 *dwc);
    static void __dwc3_gadget_stop(struct dwc3 *dwc);
    static int __dwc3_gadget_start(struct dwc3 *dwc);

    +static int dwc3_gadget_soft_disconnect(struct dwc3 *dwc)
    +{
    + unsigned long flags;
    +
    + spin_lock_irqsave(&dwc->lock, flags);
    + dwc->connected = false;
    +
    + /*
    + * In the Synopsys DesignWare Cores USB3 Databook Rev. 3.30a
    + * Section 4.1.8 Table 4-7, it states that for a device-initiated
    + * disconnect, the SW needs to ensure that it sends "a DEPENDXFER
    + * command for any active transfers" before clearing the RunStop
    + * bit.
    + */
    + dwc3_stop_active_transfers(dwc);
    + __dwc3_gadget_stop(dwc);
    + spin_unlock_irqrestore(&dwc->lock, flags);
    +
    + /*
    + * Note: if the GEVNTCOUNT indicates events in the event buffer, the
    + * driver needs to acknowledge them before the controller can halt.
    + * Simply let the interrupt handler acknowledges and handle the
    + * remaining event generated by the controller while polling for
    + * DSTS.DEVCTLHLT.
    + */
    + return dwc3_gadget_run_stop(dwc, false, false);
    +}
    +
    static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
    {
    struct dwc3 *dwc = gadget_to_dwc(g);
    - unsigned long flags;
    int ret;

    is_on = !!is_on;

    + dwc->softconnect = is_on;
    /*
    * Per databook, when we want to stop the gadget, if a control transfer
    * is still in process, complete it and get the core into setup phase.
    @@ -2051,50 +2079,27 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
    return 0;
    }

    - /*
    - * Synchronize and disable any further event handling while controller
    - * is being enabled/disabled.
    - */
    - disable_irq(dwc->irq_gadget);
    -
    - spin_lock_irqsave(&dwc->lock, flags);
    + if (dwc->pullups_connected == is_on) {
    + pm_runtime_put(dwc->dev);
    + return 0;
    + }

    if (!is_on) {
    - u32 count;
    -
    - dwc->connected = false;
    + ret = dwc3_gadget_soft_disconnect(dwc);
    + } else {
    /*
    - * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a
    - * Section 4.1.8 Table 4-7, it states that for a device-initiated
    - * disconnect, the SW needs to ensure that it sends "a DEPENDXFER
    - * command for any active transfers" before clearing the RunStop
    - * bit.
    + * In the Synopsys DWC_usb31 1.90a programming guide section
    + * 4.1.9, it specifies that for a reconnect after a
    + * device-initiated disconnect requires a core soft reset
    + * (DCTL.CSftRst) before enabling the run/stop bit.
    */
    - dwc3_stop_active_transfers(dwc);
    - __dwc3_gadget_stop(dwc);
    + dwc3_core_soft_reset(dwc);

    - /*
    - * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a
    - * Section 1.3.4, it mentions that for the DEVCTRLHLT bit, the
    - * "software needs to acknowledge the events that are generated
    - * (by writing to GEVNTCOUNTn) while it is waiting for this bit
    - * to be set to '1'."
    - */
    - count = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0));
    - count &= DWC3_GEVNTCOUNT_MASK;
    - if (count > 0) {
    - dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), count);
    - dwc->ev_buf->lpos = (dwc->ev_buf->lpos + count) %
    - dwc->ev_buf->length;
    - }
    - } else {
    + dwc3_event_buffers_setup(dwc);
    __dwc3_gadget_start(dwc);
    + ret = dwc3_gadget_run_stop(dwc, true, false);
    }

    - ret = dwc3_gadget_run_stop(dwc, is_on, false);
    - spin_unlock_irqrestore(&dwc->lock, flags);
    - enable_irq(dwc->irq_gadget);
    -
    pm_runtime_put(dwc->dev);

    return ret;
    @@ -3791,7 +3796,7 @@ int dwc3_gadget_resume(struct dwc3 *dwc)
    {
    int ret;

    - if (!dwc->gadget_driver)
    + if (!dwc->gadget_driver || !dwc->softconnect)
    return 0;

    ret = __dwc3_gadget_start(dwc);
    diff --git a/drivers/usb/host/xhci-mtk-sch.c b/drivers/usb/host/xhci-mtk-sch.c
    index 8950d1f10a7f..86c4bc9df3b8 100644
    --- a/drivers/usb/host/xhci-mtk-sch.c
    +++ b/drivers/usb/host/xhci-mtk-sch.c
    @@ -25,6 +25,13 @@
    */
    #define TT_MICROFRAMES_MAX 9

    +/* schedule error type */
    +#define ESCH_SS_Y6 1001
    +#define ESCH_SS_OVERLAP 1002
    +#define ESCH_CS_OVERFLOW 1003
    +#define ESCH_BW_OVERFLOW 1004
    +#define ESCH_FIXME 1005
    +
    /* mtk scheduler bitmasks */
    #define EP_BPKTS(p) ((p) & 0x7f)
    #define EP_BCSCOUNT(p) (((p) & 0x7) << 8)
    @@ -32,6 +39,24 @@
    #define EP_BOFFSET(p) ((p) & 0x3fff)
    #define EP_BREPEAT(p) (((p) & 0x7fff) << 16)

    +static char *sch_error_string(int err_num)
    +{
    + switch (err_num) {
    + case ESCH_SS_Y6:
    + return "Can't schedule Start-Split in Y6";
    + case ESCH_SS_OVERLAP:
    + return "Can't find a suitable Start-Split location";
    + case ESCH_CS_OVERFLOW:
    + return "The last Complete-Split is greater than 7";
    + case ESCH_BW_OVERFLOW:
    + return "Bandwidth exceeds the maximum limit";
    + case ESCH_FIXME:
    + return "FIXME, to be resolved";
    + default:
    + return "Unknown";
    + }
    +}
    +
    static int is_fs_or_ls(enum usb_device_speed speed)
    {
    return speed == USB_SPEED_FULL || speed == USB_SPEED_LOW;
    @@ -375,7 +400,6 @@ static void update_bus_bw(struct mu3h_sch_bw_info *sch_bw,
    sch_ep->bw_budget_table[j];
    }
    }
    - sch_ep->allocated = used;
    }

    static int check_fs_bus_bw(struct mu3h_sch_ep_info *sch_ep, int offset)
    @@ -384,19 +408,20 @@ static int check_fs_bus_bw(struct mu3h_sch_ep_info *sch_ep, int offset)
    u32 num_esit, tmp;
    int base;
    int i, j;
    + u8 uframes = DIV_ROUND_UP(sch_ep->maxpkt, FS_PAYLOAD_MAX);

    num_esit = XHCI_MTK_MAX_ESIT / sch_ep->esit;
    +
    + if (sch_ep->ep_type == INT_IN_EP || sch_ep->ep_type == ISOC_IN_EP)
    + offset++;
    +
    for (i = 0; i < num_esit; i++) {
    base = offset + i * sch_ep->esit;

    - /*
    - * Compared with hs bus, no matter what ep type,
    - * the hub will always delay one uframe to send data
    - */
    - for (j = 0; j < sch_ep->cs_count; j++) {
    + for (j = 0; j < uframes; j++) {
    tmp = tt->fs_bus_bw[base + j] + sch_ep->bw_cost_per_microframe;
    if (tmp > FS_PAYLOAD_MAX)
    - return -ERANGE;
    + return -ESCH_BW_OVERFLOW;
    }
    }

    @@ -406,15 +431,11 @@ static int check_fs_bus_bw(struct mu3h_sch_ep_info *sch_ep, int offset)
    static int check_sch_tt(struct usb_device *udev,
    struct mu3h_sch_ep_info *sch_ep, u32 offset)
    {
    - struct mu3h_sch_tt *tt = sch_ep->sch_tt;
    u32 extra_cs_count;
    - u32 fs_budget_start;
    u32 start_ss, last_ss;
    u32 start_cs, last_cs;
    - int i;

    start_ss = offset % 8;
    - fs_budget_start = (start_ss + 1) % 8;

    if (sch_ep->ep_type == ISOC_OUT_EP) {
    last_ss = start_ss + sch_ep->cs_count - 1;
    @@ -424,11 +445,7 @@ static int check_sch_tt(struct usb_device *udev,
    * must never schedule Start-Split in Y6
    */
    if (!(start_ss == 7 || last_ss < 6))
    - return -ERANGE;
    -
    - for (i = 0; i < sch_ep->cs_count; i++)
    - if (test_bit(offset + i, tt->ss_bit_map))
    - return -ERANGE;
    + return -ESCH_SS_Y6;

    } else {
    u32 cs_count = DIV_ROUND_UP(sch_ep->maxpkt, FS_PAYLOAD_MAX);
    @@ -438,29 +455,24 @@ static int check_sch_tt(struct usb_device *udev,
    * must never schedule Start-Split in Y6
    */
    if (start_ss == 6)
    - return -ERANGE;
    + return -ESCH_SS_Y6;

    /* one uframe for ss + one uframe for idle */
    start_cs = (start_ss + 2) % 8;
    last_cs = start_cs + cs_count - 1;

    if (last_cs > 7)
    - return -ERANGE;
    + return -ESCH_CS_OVERFLOW;

    if (sch_ep->ep_type == ISOC_IN_EP)
    extra_cs_count = (last_cs == 7) ? 1 : 2;
    else /* ep_type : INTR IN / INTR OUT */
    - extra_cs_count = (fs_budget_start == 6) ? 1 : 2;
    + extra_cs_count = 1;

    cs_count += extra_cs_count;
    if (cs_count > 7)
    cs_count = 7; /* HW limit */

    - for (i = 0; i < cs_count + 2; i++) {
    - if (test_bit(offset + i, tt->ss_bit_map))
    - return -ERANGE;
    - }
    -
    sch_ep->cs_count = cs_count;
    /* one for ss, the other for idle */
    sch_ep->num_budget_microframes = cs_count + 2;
    @@ -482,28 +494,24 @@ static void update_sch_tt(struct usb_device *udev,
    struct mu3h_sch_tt *tt = sch_ep->sch_tt;
    u32 base, num_esit;
    int bw_updated;
    - int bits;
    int i, j;
    + int offset = sch_ep->offset;
    + u8 uframes = DIV_ROUND_UP(sch_ep->maxpkt, FS_PAYLOAD_MAX);

    num_esit = XHCI_MTK_MAX_ESIT / sch_ep->esit;
    - bits = (sch_ep->ep_type == ISOC_OUT_EP) ? sch_ep->cs_count : 1;

    if (used)
    bw_updated = sch_ep->bw_cost_per_microframe;
    else
    bw_updated = -sch_ep->bw_cost_per_microframe;

    - for (i = 0; i < num_esit; i++) {
    - base = sch_ep->offset + i * sch_ep->esit;
    + if (sch_ep->ep_type == INT_IN_EP || sch_ep->ep_type == ISOC_IN_EP)
    + offset++;

    - for (j = 0; j < bits; j++) {
    - if (used)
    - set_bit(base + j, tt->ss_bit_map);
    - else
    - clear_bit(base + j, tt->ss_bit_map);
    - }
    + for (i = 0; i < num_esit; i++) {
    + base = offset + i * sch_ep->esit;

    - for (j = 0; j < sch_ep->cs_count; j++)
    + for (j = 0; j < uframes; j++)
    tt->fs_bus_bw[base + j] += bw_updated;
    }

    @@ -513,21 +521,48 @@ static void update_sch_tt(struct usb_device *udev,
    list_del(&sch_ep->tt_endpoint);
    }

    +static int load_ep_bw(struct usb_device *udev, struct mu3h_sch_bw_info *sch_bw,
    + struct mu3h_sch_ep_info *sch_ep, bool loaded)
    +{
    + if (sch_ep->sch_tt)
    + update_sch_tt(udev, sch_ep, loaded);
    +
    + /* update bus bandwidth info */
    + update_bus_bw(sch_bw, sch_ep, loaded);
    + sch_ep->allocated = loaded;
    +
    + return 0;
    +}
    +
    +static u32 get_esit_boundary(struct mu3h_sch_ep_info *sch_ep)
    +{
    + u32 boundary = sch_ep->esit;
    +
    + if (sch_ep->sch_tt) { /* LS/FS with TT */
    + /*
    + * tune for CS, normally esit >= 8 for FS/LS,
    + * not add one for other types to avoid access array
    + * out of boundary
    + */
    + if (sch_ep->ep_type == ISOC_OUT_EP && boundary > 1)
    + boundary--;
    + }
    +
    + return boundary;
    +}
    +
    static int check_sch_bw(struct usb_device *udev,
    struct mu3h_sch_bw_info *sch_bw, struct mu3h_sch_ep_info *sch_ep)
    {
    u32 offset;
    - u32 esit;
    u32 min_bw;
    u32 min_index;
    u32 worst_bw;
    u32 bw_boundary;
    + u32 esit_boundary;
    u32 min_num_budget;
    u32 min_cs_count;
    - bool tt_offset_ok = false;
    - int ret;
    -
    - esit = sch_ep->esit;
    + int ret = 0;

    /*
    * Search through all possible schedule microframes.
    @@ -537,16 +572,15 @@ static int check_sch_bw(struct usb_device *udev,
    min_index = 0;
    min_cs_count = sch_ep->cs_count;
    min_num_budget = sch_ep->num_budget_microframes;
    - for (offset = 0; offset < esit; offset++) {
    - if (is_fs_or_ls(udev->speed)) {
    + esit_boundary = get_esit_boundary(sch_ep);
    + for (offset = 0; offset < sch_ep->esit; offset++) {
    + if (sch_ep->sch_tt) {
    ret = check_sch_tt(udev, sch_ep, offset);
    if (ret)
    continue;
    - else
    - tt_offset_ok = true;
    }

    - if ((offset + sch_ep->num_budget_microframes) > sch_ep->esit)
    + if ((offset + sch_ep->num_budget_microframes) > esit_boundary)
    break;

    worst_bw = get_max_bw(sch_bw, sch_ep, offset);
    @@ -569,35 +603,21 @@ static int check_sch_bw(struct usb_device *udev,

    /* check bandwidth */
    if (min_bw > bw_boundary)
    - return -ERANGE;
    + return ret ? ret : -ESCH_BW_OVERFLOW;

    sch_ep->offset = min_index;
    sch_ep->cs_count = min_cs_count;
    sch_ep->num_budget_microframes = min_num_budget;

    - if (is_fs_or_ls(udev->speed)) {
    - /* all offset for tt is not ok*/
    - if (!tt_offset_ok)
    - return -ERANGE;
    -
    - update_sch_tt(udev, sch_ep, 1);
    - }
    -
    - /* update bus bandwidth info */
    - update_bus_bw(sch_bw, sch_ep, 1);
    -
    - return 0;
    + return load_ep_bw(udev, sch_bw, sch_ep, true);
    }

    static void destroy_sch_ep(struct usb_device *udev,
    struct mu3h_sch_bw_info *sch_bw, struct mu3h_sch_ep_info *sch_ep)
    {
    /* only release ep bw check passed by check_sch_bw() */
    - if (sch_ep->allocated) {
    - update_bus_bw(sch_bw, sch_ep, 0);
    - if (sch_ep->sch_tt)
    - update_sch_tt(udev, sch_ep, 0);
    - }
    + if (sch_ep->allocated)
    + load_ep_bw(udev, sch_bw, sch_ep, false);

    if (sch_ep->sch_tt)
    drop_tt(udev);
    @@ -760,7 +780,8 @@ int xhci_mtk_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev)

    ret = check_sch_bw(udev, sch_bw, sch_ep);
    if (ret) {
    - xhci_err(xhci, "Not enough bandwidth!\n");
    + xhci_err(xhci, "Not enough bandwidth! (%s)\n",
    + sch_error_string(-ret));
    return -ENOSPC;
    }
    }
    diff --git a/drivers/usb/host/xhci-mtk.h b/drivers/usb/host/xhci-mtk.h
    index 985e7a19f6f6..2f702342de66 100644
    --- a/drivers/usb/host/xhci-mtk.h
    +++ b/drivers/usb/host/xhci-mtk.h
    @@ -20,14 +20,12 @@
    #define XHCI_MTK_MAX_ESIT 64

    /**
    - * @ss_bit_map: used to avoid start split microframes overlay
    * @fs_bus_bw: array to keep track of bandwidth already used for FS
    * @ep_list: Endpoints using this TT
    * @usb_tt: usb TT related
    * @tt_port: TT port number
    */
    struct mu3h_sch_tt {
    - DECLARE_BITMAP(ss_bit_map, XHCI_MTK_MAX_ESIT);
    u32 fs_bus_bw[XHCI_MTK_MAX_ESIT];
    struct list_head ep_list;
    struct usb_tt *usb_tt;
    diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    index cbe8ad3cd61f..14aa8500221b 100644
    --- a/drivers/usb/serial/option.c
    +++ b/drivers/usb/serial/option.c
    @@ -256,6 +256,7 @@ static void option_instat_callback(struct urb *urb);
    #define QUECTEL_PRODUCT_EM060K 0x030b
    #define QUECTEL_PRODUCT_EM12 0x0512
    #define QUECTEL_PRODUCT_RM500Q 0x0800
    +#define QUECTEL_PRODUCT_RM520N 0x0801
    #define QUECTEL_PRODUCT_EC200S_CN 0x6002
    #define QUECTEL_PRODUCT_EC200T 0x6026
    #define QUECTEL_PRODUCT_RM500K 0x7001
    @@ -1138,6 +1139,8 @@ static const struct usb_device_id option_ids[] = {
    { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0xff, 0xff),
    .driver_info = NUMEP2 },
    { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0, 0) },
    + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, 0x0203, 0xff), /* BG95-M3 */
    + .driver_info = ZLP },
    { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
    .driver_info = RSVD(4) },
    { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
    @@ -1159,6 +1162,9 @@ static const struct usb_device_id option_ids[] = {
    { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) },
    { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10),
    .driver_info = ZLP },
    + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0xff, 0x30) },
    + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0x40) },
    + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0) },
    { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) },
    { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) },
    { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) },
    diff --git a/drivers/video/fbdev/pxa3xx-gcu.c b/drivers/video/fbdev/pxa3xx-gcu.c
    index 7c4694d70dac..15162b37f302 100644
    --- a/drivers/video/fbdev/pxa3xx-gcu.c
    +++ b/drivers/video/fbdev/pxa3xx-gcu.c
    @@ -382,7 +382,7 @@ pxa3xx_gcu_write(struct file *file, const char *buff,
    struct pxa3xx_gcu_batch *buffer;
    struct pxa3xx_gcu_priv *priv = to_pxa3xx_gcu_priv(file);

    - int words = count / 4;
    + size_t words = count / 4;

    /* Does not need to be atomic. There's a lock in user space,
    * but anyhow, this is just for statistics. */
    diff --git a/fs/afs/misc.c b/fs/afs/misc.c
    index 5334f1bd2bca..5171d6d99031 100644
    --- a/fs/afs/misc.c
    +++ b/fs/afs/misc.c
    @@ -69,6 +69,7 @@ int afs_abort_to_error(u32 abort_code)
    /* Unified AFS error table */
    case UAEPERM: return -EPERM;
    case UAENOENT: return -ENOENT;
    + case UAEAGAIN: return -EAGAIN;
    case UAEACCES: return -EACCES;
    case UAEBUSY: return -EBUSY;
    case UAEEXIST: return -EEXIST;
    diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
    index 86bdebd2ece6..f8127edb8973 100644
    --- a/fs/cifs/connect.c
    +++ b/fs/cifs/connect.c
    @@ -791,9 +791,6 @@ cifs_readv_from_socket(struct TCP_Server_Info *server, struct msghdr *smb_msg)
    int length = 0;
    int total_read;

    - smb_msg->msg_control = NULL;
    - smb_msg->msg_controllen = 0;
    -
    for (total_read = 0; msg_data_left(smb_msg); total_read += length) {
    try_to_freeze();

    @@ -844,7 +841,7 @@ int
    cifs_read_from_socket(struct TCP_Server_Info *server, char *buf,
    unsigned int to_read)
    {
    - struct msghdr smb_msg;
    + struct msghdr smb_msg = {};
    struct kvec iov = {.iov_base = buf, .iov_len = to_read};
    iov_iter_kvec(&smb_msg.msg_iter, READ, &iov, 1, to_read);

    @@ -855,7 +852,7 @@ int
    cifs_read_page_from_socket(struct TCP_Server_Info *server, struct page *page,
    unsigned int page_offset, unsigned int to_read)
    {
    - struct msghdr smb_msg;
    + struct msghdr smb_msg = {};
    struct bio_vec bv = {
    .bv_page = page, .bv_len = to_read, .bv_offset = page_offset};
    iov_iter_bvec(&smb_msg.msg_iter, READ, &bv, 1, to_read);
    diff --git a/fs/cifs/file.c b/fs/cifs/file.c
    index 03c85beecec1..eb61cecf42d6 100644
    --- a/fs/cifs/file.c
    +++ b/fs/cifs/file.c
    @@ -3194,6 +3194,9 @@ static ssize_t __cifs_writev(

    ssize_t cifs_direct_writev(struct kiocb *iocb, struct iov_iter *from)
    {
    + struct file *file = iocb->ki_filp;
    +
    + cifs_revalidate_mapping(file->f_inode);
    return __cifs_writev(iocb, from, true);
    }

    diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
    index 61e7df4d9cb1..b98ae69edb8f 100644
    --- a/fs/cifs/transport.c
    +++ b/fs/cifs/transport.c
    @@ -209,10 +209,6 @@ smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg,

    *sent = 0;

    - smb_msg->msg_name = (struct sockaddr *) &server->dstaddr;
    - smb_msg->msg_namelen = sizeof(struct sockaddr);
    - smb_msg->msg_control = NULL;
    - smb_msg->msg_controllen = 0;
    if (server->noblocksnd)
    smb_msg->msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL;
    else
    @@ -324,7 +320,7 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
    sigset_t mask, oldmask;
    size_t total_len = 0, sent, size;
    struct socket *ssocket = server->ssocket;
    - struct msghdr smb_msg;
    + struct msghdr smb_msg = {};
    int val = 1;
    __be32 rfc1002_marker;

    diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
    index d5e649e578cb..ace8d6145253 100644
    --- a/fs/ext4/extents.c
    +++ b/fs/ext4/extents.c
    @@ -500,6 +500,10 @@ static int __ext4_ext_check(const char *function, unsigned int line,
    error_msg = "invalid eh_entries";
    goto corrupted;
    }
    + if (unlikely((eh->eh_entries == 0) && (depth > 0))) {
    + error_msg = "eh_entries is 0 but eh_depth is > 0";
    + goto corrupted;
    + }
    if (!ext4_valid_extent_entries(inode, eh, lblk, &pblk, depth)) {
    error_msg = "invalid extent entries";
    goto corrupted;
    diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
    index 83846cc81485..cbde5a096c7b 100644
    --- a/fs/ext4/ialloc.c
    +++ b/fs/ext4/ialloc.c
    @@ -500,7 +500,7 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent,
    goto fallback;
    }

    - max_dirs = ndirs / ngroups + inodes_per_group / 16;
    + max_dirs = ndirs / ngroups + inodes_per_group*flex_size / 16;
    min_inodes = avefreei - inodes_per_group*flex_size / 4;
    if (min_inodes < 1)
    min_inodes = 1;
    diff --git a/fs/nfs/super.c b/fs/nfs/super.c
    index a84df7d63403..ecc7277b3eda 100644
    --- a/fs/nfs/super.c
    +++ b/fs/nfs/super.c
    @@ -2375,22 +2375,31 @@ void nfs_fill_super(struct super_block *sb, struct nfs_mount_info *mount_info)
    if (data && data->bsize)
    sb->s_blocksize = nfs_block_size(data->bsize, &sb->s_blocksize_bits);

    - if (server->nfs_client->rpc_ops->version != 2) {
    - /* The VFS shouldn't apply the umask to mode bits. We will do
    - * so ourselves when necessary.
    + switch (server->nfs_client->rpc_ops->version) {
    + case 2:
    + sb->s_time_gran = 1000;
    + sb->s_time_min = 0;
    + sb->s_time_max = U32_MAX;
    + break;
    + case 3:
    + /*
    + * The VFS shouldn't apply the umask to mode bits.
    + * We will do so ourselves when necessary.
    */
    sb->s_flags |= SB_POSIXACL;
    sb->s_time_gran = 1;
    - sb->s_export_op = &nfs_export_ops;
    - } else
    - sb->s_time_gran = 1000;
    -
    - if (server->nfs_client->rpc_ops->version != 4) {
    sb->s_time_min = 0;
    sb->s_time_max = U32_MAX;
    - } else {
    + sb->s_export_op = &nfs_export_ops;
    + break;
    + case 4:
    + sb->s_flags |= SB_POSIXACL;
    + sb->s_time_gran = 1;
    sb->s_time_min = S64_MIN;
    sb->s_time_max = S64_MAX;
    + if (server->caps & NFS_CAP_ATOMIC_OPEN_V1)
    + sb->s_export_op = &nfs_export_ops;
    + break;
    }

    nfs_initialise_sb(sb);
    diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
    index 436f686a9891..084d39d8856b 100644
    --- a/fs/xfs/libxfs/xfs_alloc.c
    +++ b/fs/xfs/libxfs/xfs_alloc.c
    @@ -684,8 +684,10 @@ xfs_alloc_update_counters(

    xfs_trans_agblocks_delta(tp, len);
    if (unlikely(be32_to_cpu(agf->agf_freeblks) >
    - be32_to_cpu(agf->agf_length)))
    + be32_to_cpu(agf->agf_length))) {
    + xfs_buf_corruption_error(agbp);
    return -EFSCORRUPTED;
    + }

    xfs_alloc_log_agf(tp, agbp, XFS_AGF_FREEBLKS);
    return 0;
    @@ -751,6 +753,7 @@ xfs_alloc_ag_vextent_small(

    bp = xfs_btree_get_bufs(args->mp, args->tp, args->agno, fbno);
    if (!bp) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, args->mp);
    error = -EFSCORRUPTED;
    goto error;
    }
    @@ -1995,24 +1998,32 @@ xfs_alloc_longest_free_extent(
    return pag->pagf_flcount > 0 || pag->pagf_longest > 0;
    }

    +/*
    + * Compute the minimum length of the AGFL in the given AG. If @pag is NULL,
    + * return the largest possible minimum length.
    + */
    unsigned int
    xfs_alloc_min_freelist(
    struct xfs_mount *mp,
    struct xfs_perag *pag)
    {
    + /* AG btrees have at least 1 level. */
    + static const uint8_t fake_levels[XFS_BTNUM_AGF] = {1, 1, 1};
    + const uint8_t *levels = pag ? pag->pagf_levels : fake_levels;
    unsigned int min_free;

    + ASSERT(mp->m_ag_maxlevels > 0);
    +
    /* space needed by-bno freespace btree */
    - min_free = min_t(unsigned int, pag->pagf_levels[XFS_BTNUM_BNOi] + 1,
    + min_free = min_t(unsigned int, levels[XFS_BTNUM_BNOi] + 1,
    mp->m_ag_maxlevels);
    /* space needed by-size freespace btree */
    - min_free += min_t(unsigned int, pag->pagf_levels[XFS_BTNUM_CNTi] + 1,
    + min_free += min_t(unsigned int, levels[XFS_BTNUM_CNTi] + 1,
    mp->m_ag_maxlevels);
    /* space needed reverse mapping used space btree */
    if (xfs_sb_version_hasrmapbt(&mp->m_sb))
    - min_free += min_t(unsigned int,
    - pag->pagf_levels[XFS_BTNUM_RMAPi] + 1,
    - mp->m_rmap_maxlevels);
    + min_free += min_t(unsigned int, levels[XFS_BTNUM_RMAPi] + 1,
    + mp->m_rmap_maxlevels);

    return min_free;
    }
    @@ -2087,8 +2098,10 @@ xfs_free_agfl_block(
    return error;

    bp = xfs_btree_get_bufs(tp->t_mountp, tp, agno, agbno);
    - if (!bp)
    + if (!bp) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, tp->t_mountp);
    return -EFSCORRUPTED;
    + }
    xfs_trans_binval(tp, bp);

    return 0;
    diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
    index de33efc9b4f9..0c23127347ac 100644
    --- a/fs/xfs/libxfs/xfs_attr_leaf.c
    +++ b/fs/xfs/libxfs/xfs_attr_leaf.c
    @@ -2287,8 +2287,10 @@ xfs_attr3_leaf_lookup_int(
    leaf = bp->b_addr;
    xfs_attr3_leaf_hdr_from_disk(args->geo, &ichdr, leaf);
    entries = xfs_attr3_leaf_entryp(leaf);
    - if (ichdr.count >= args->geo->blksize / 8)
    + if (ichdr.count >= args->geo->blksize / 8) {
    + xfs_buf_corruption_error(bp);
    return -EFSCORRUPTED;
    + }

    /*
    * Binary search. (note: small blocks will skip this loop)
    @@ -2304,10 +2306,14 @@ xfs_attr3_leaf_lookup_int(
    else
    break;
    }
    - if (!(probe >= 0 && (!ichdr.count || probe < ichdr.count)))
    + if (!(probe >= 0 && (!ichdr.count || probe < ichdr.count))) {
    + xfs_buf_corruption_error(bp);
    return -EFSCORRUPTED;
    - if (!(span <= 4 || be32_to_cpu(entry->hashval) == hashval))
    + }
    + if (!(span <= 4 || be32_to_cpu(entry->hashval) == hashval)) {
    + xfs_buf_corruption_error(bp);
    return -EFSCORRUPTED;
    + }

    /*
    * Since we may have duplicate hashval's, find the first matching
    diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
    index c114d24be619..8d035842fe51 100644
    --- a/fs/xfs/libxfs/xfs_bmap.c
    +++ b/fs/xfs/libxfs/xfs_bmap.c
    @@ -729,6 +729,7 @@ xfs_bmap_extents_to_btree(
    xfs_trans_mod_dquot_byino(tp, ip, XFS_TRANS_DQ_BCOUNT, 1L);
    abp = xfs_btree_get_bufl(mp, tp, args.fsbno);
    if (!abp) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, mp);
    error = -EFSCORRUPTED;
    goto out_unreserve_dquot;
    }
    @@ -1084,6 +1085,7 @@ xfs_bmap_add_attrfork(
    if (XFS_IFORK_Q(ip))
    goto trans_cancel;
    if (ip->i_d.di_anextents != 0) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, mp);
    error = -EFSCORRUPTED;
    goto trans_cancel;
    }
    @@ -1374,7 +1376,8 @@ xfs_bmap_last_before(
    case XFS_DINODE_FMT_EXTENTS:
    break;
    default:
    - return -EIO;
    + ASSERT(0);
    + return -EFSCORRUPTED;
    }

    if (!(ifp->if_flags & XFS_IFEXTENTS)) {
    @@ -1474,8 +1477,10 @@ xfs_bmap_last_offset(
    return 0;

    if (XFS_IFORK_FORMAT(ip, whichfork) != XFS_DINODE_FMT_BTREE &&
    - XFS_IFORK_FORMAT(ip, whichfork) != XFS_DINODE_FMT_EXTENTS)
    - return -EIO;
    + XFS_IFORK_FORMAT(ip, whichfork) != XFS_DINODE_FMT_EXTENTS) {
    + ASSERT(0);
    + return -EFSCORRUPTED;
    + }

    error = xfs_bmap_last_extent(NULL, ip, whichfork, &rec, &is_empty);
    if (error || is_empty)
    @@ -5871,8 +5876,9 @@ xfs_bmap_insert_extents(
    XFS_WANT_CORRUPTED_GOTO(mp, !isnullstartblock(got.br_startblock),
    del_cursor);

    - if (stop_fsb >= got.br_startoff + got.br_blockcount) {
    - error = -EIO;
    + if (stop_fsb > got.br_startoff) {
    + ASSERT(0);
    + error = -EFSCORRUPTED;
    goto del_cursor;
    }

    diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
    index 71de937f9e64..a13a25e922ec 100644
    --- a/fs/xfs/libxfs/xfs_btree.c
    +++ b/fs/xfs/libxfs/xfs_btree.c
    @@ -1820,6 +1820,7 @@ xfs_btree_lookup_get_block(

    out_bad:
    *blkp = NULL;
    + xfs_buf_corruption_error(bp);
    xfs_trans_brelse(cur->bc_tp, bp);
    return -EFSCORRUPTED;
    }
    @@ -1867,8 +1868,10 @@ xfs_btree_lookup(
    XFS_BTREE_STATS_INC(cur, lookup);

    /* No such thing as a zero-level tree. */
    - if (cur->bc_nlevels == 0)
    + if (cur->bc_nlevels == 0) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, cur->bc_mp);
    return -EFSCORRUPTED;
    + }

    block = NULL;
    keyno = 0;
    diff --git a/fs/xfs/libxfs/xfs_da_btree.c b/fs/xfs/libxfs/xfs_da_btree.c
    index 4fd1223c1bd5..1e2dc65adeb8 100644
    --- a/fs/xfs/libxfs/xfs_da_btree.c
    +++ b/fs/xfs/libxfs/xfs_da_btree.c
    @@ -504,6 +504,7 @@ xfs_da3_split(
    node = oldblk->bp->b_addr;
    if (node->hdr.info.forw) {
    if (be32_to_cpu(node->hdr.info.forw) != addblk->blkno) {
    + xfs_buf_corruption_error(oldblk->bp);
    error = -EFSCORRUPTED;
    goto out;
    }
    @@ -516,6 +517,7 @@ xfs_da3_split(
    node = oldblk->bp->b_addr;
    if (node->hdr.info.back) {
    if (be32_to_cpu(node->hdr.info.back) != addblk->blkno) {
    + xfs_buf_corruption_error(oldblk->bp);
    error = -EFSCORRUPTED;
    goto out;
    }
    @@ -1541,8 +1543,10 @@ xfs_da3_node_lookup_int(
    break;
    }

    - if (magic != XFS_DA_NODE_MAGIC && magic != XFS_DA3_NODE_MAGIC)
    + if (magic != XFS_DA_NODE_MAGIC && magic != XFS_DA3_NODE_MAGIC) {
    + xfs_buf_corruption_error(blk->bp);
    return -EFSCORRUPTED;
    + }

    blk->magic = XFS_DA_NODE_MAGIC;

    @@ -1554,15 +1558,18 @@ xfs_da3_node_lookup_int(
    btree = dp->d_ops->node_tree_p(node);

    /* Tree taller than we can handle; bail out! */
    - if (nodehdr.level >= XFS_DA_NODE_MAXDEPTH)
    + if (nodehdr.level >= XFS_DA_NODE_MAXDEPTH) {
    + xfs_buf_corruption_error(blk->bp);
    return -EFSCORRUPTED;
    + }

    /* Check the level from the root. */
    if (blkno == args->geo->leafblk)
    expected_level = nodehdr.level - 1;
    - else if (expected_level != nodehdr.level)
    + else if (expected_level != nodehdr.level) {
    + xfs_buf_corruption_error(blk->bp);
    return -EFSCORRUPTED;
    - else
    + } else
    expected_level--;

    max = nodehdr.count;
    @@ -1612,12 +1619,17 @@ xfs_da3_node_lookup_int(
    }

    /* We can't point back to the root. */
    - if (blkno == args->geo->leafblk)
    + if (blkno == args->geo->leafblk) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW,
    + dp->i_mount);
    return -EFSCORRUPTED;
    + }
    }

    - if (expected_level != 0)
    + if (expected_level != 0) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, dp->i_mount);
    return -EFSCORRUPTED;
    + }

    /*
    * A leaf block that ends in the hashval that we are interested in
    diff --git a/fs/xfs/libxfs/xfs_dir2.c b/fs/xfs/libxfs/xfs_dir2.c
    index 867c5dee0751..452d04ae10ce 100644
    --- a/fs/xfs/libxfs/xfs_dir2.c
    +++ b/fs/xfs/libxfs/xfs_dir2.c
    @@ -600,8 +600,10 @@ xfs_dir2_isblock(
    if ((rval = xfs_bmap_last_offset(args->dp, &last, XFS_DATA_FORK)))
    return rval;
    rval = XFS_FSB_TO_B(args->dp->i_mount, last) == args->geo->blksize;
    - if (rval != 0 && args->dp->i_d.di_size != args->geo->blksize)
    + if (rval != 0 && args->dp->i_d.di_size != args->geo->blksize) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, args->dp->i_mount);
    return -EFSCORRUPTED;
    + }
    *vp = rval;
    return 0;
    }
    diff --git a/fs/xfs/libxfs/xfs_dir2_leaf.c b/fs/xfs/libxfs/xfs_dir2_leaf.c
    index a53e4585a2f3..388b5da12228 100644
    --- a/fs/xfs/libxfs/xfs_dir2_leaf.c
    +++ b/fs/xfs/libxfs/xfs_dir2_leaf.c
    @@ -1343,8 +1343,10 @@ xfs_dir2_leaf_removename(
    oldbest = be16_to_cpu(bf[0].length);
    ltp = xfs_dir2_leaf_tail_p(args->geo, leaf);
    bestsp = xfs_dir2_leaf_bests_p(ltp);
    - if (be16_to_cpu(bestsp[db]) != oldbest)
    + if (be16_to_cpu(bestsp[db]) != oldbest) {
    + xfs_buf_corruption_error(lbp);
    return -EFSCORRUPTED;
    + }
    /*
    * Mark the former data entry unused.
    */
    diff --git a/fs/xfs/libxfs/xfs_dir2_node.c b/fs/xfs/libxfs/xfs_dir2_node.c
    index 99d5b2ed67f2..35e698fa85fd 100644
    --- a/fs/xfs/libxfs/xfs_dir2_node.c
    +++ b/fs/xfs/libxfs/xfs_dir2_node.c
    @@ -374,8 +374,10 @@ xfs_dir2_leaf_to_node(
    leaf = lbp->b_addr;
    ltp = xfs_dir2_leaf_tail_p(args->geo, leaf);
    if (be32_to_cpu(ltp->bestcount) >
    - (uint)dp->i_d.di_size / args->geo->blksize)
    + (uint)dp->i_d.di_size / args->geo->blksize) {
    + xfs_buf_corruption_error(lbp);
    return -EFSCORRUPTED;
    + }

    /*
    * Copy freespace entries from the leaf block to the new block.
    @@ -446,8 +448,10 @@ xfs_dir2_leafn_add(
    * Quick check just to make sure we are not going to index
    * into other peoples memory
    */
    - if (index < 0)
    + if (index < 0) {
    + xfs_buf_corruption_error(bp);
    return -EFSCORRUPTED;
    + }

    /*
    * If there are already the maximum number of leaf entries in
    @@ -740,8 +744,10 @@ xfs_dir2_leafn_lookup_for_entry(
    ents = dp->d_ops->leaf_ents_p(leaf);

    xfs_dir3_leaf_check(dp, bp);
    - if (leafhdr.count <= 0)
    + if (leafhdr.count <= 0) {
    + xfs_buf_corruption_error(bp);
    return -EFSCORRUPTED;
    + }

    /*
    * Look up the hash value in the leaf entries.
    diff --git a/fs/xfs/libxfs/xfs_dir2_sf.c b/fs/xfs/libxfs/xfs_dir2_sf.c
    index ae16ca7c422a..f980c3f3d2f6 100644
    --- a/fs/xfs/libxfs/xfs_dir2_sf.c
    +++ b/fs/xfs/libxfs/xfs_dir2_sf.c
    @@ -944,6 +944,27 @@ xfs_dir2_sf_removename(
    return 0;
    }

    +/*
    + * Check whether the sf dir replace operation need more blocks.
    + */
    +static bool
    +xfs_dir2_sf_replace_needblock(
    + struct xfs_inode *dp,
    + xfs_ino_t inum)
    +{
    + int newsize;
    + struct xfs_dir2_sf_hdr *sfp;
    +
    + if (dp->i_d.di_format != XFS_DINODE_FMT_LOCAL)
    + return false;
    +
    + sfp = (struct xfs_dir2_sf_hdr *)dp->i_df.if_u1.if_data;
    + newsize = dp->i_df.if_bytes + (sfp->count + 1) * XFS_INO64_DIFF;
    +
    + return inum > XFS_DIR2_MAX_SHORT_INUM &&
    + sfp->i8count == 0 && newsize > XFS_IFORK_DSIZE(dp);
    +}
    +
    /*
    * Replace the inode number of an entry in a shortform directory.
    */
    @@ -980,17 +1001,14 @@ xfs_dir2_sf_replace(
    */
    if (args->inumber > XFS_DIR2_MAX_SHORT_INUM && sfp->i8count == 0) {
    int error; /* error return value */
    - int newsize; /* new inode size */

    - newsize = dp->i_df.if_bytes + (sfp->count + 1) * XFS_INO64_DIFF;
    /*
    * Won't fit as shortform, convert to block then do replace.
    */
    - if (newsize > XFS_IFORK_DSIZE(dp)) {
    + if (xfs_dir2_sf_replace_needblock(dp, args->inumber)) {
    error = xfs_dir2_sf_to_block(args);
    - if (error) {
    + if (error)
    return error;
    - }
    return xfs_dir2_block_replace(args);
    }
    /*
    diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c
    index 443cf33f6666..c3e0c2f61be4 100644
    --- a/fs/xfs/libxfs/xfs_ialloc.c
    +++ b/fs/xfs/libxfs/xfs_ialloc.c
    @@ -2854,3 +2854,67 @@ xfs_ialloc_setup_geometry(
    else
    igeo->ialloc_align = 0;
    }
    +
    +/* Compute the location of the root directory inode that is laid out by mkfs. */
    +xfs_ino_t
    +xfs_ialloc_calc_rootino(
    + struct xfs_mount *mp,
    + int sunit)
    +{
    + struct xfs_ino_geometry *igeo = M_IGEO(mp);
    + xfs_agblock_t first_bno;
    +
    + /*
    + * Pre-calculate the geometry of AG 0. We know what it looks like
    + * because libxfs knows how to create allocation groups now.
    + *
    + * first_bno is the first block in which mkfs could possibly have
    + * allocated the root directory inode, once we factor in the metadata
    + * that mkfs formats before it. Namely, the four AG headers...
    + */
    + first_bno = howmany(4 * mp->m_sb.sb_sectsize, mp->m_sb.sb_blocksize);
    +
    + /* ...the two free space btree roots... */
    + first_bno += 2;
    +
    + /* ...the inode btree root... */
    + first_bno += 1;
    +
    + /* ...the initial AGFL... */
    + first_bno += xfs_alloc_min_freelist(mp, NULL);
    +
    + /* ...the free inode btree root... */
    + if (xfs_sb_version_hasfinobt(&mp->m_sb))
    + first_bno++;
    +
    + /* ...the reverse mapping btree root... */
    + if (xfs_sb_version_hasrmapbt(&mp->m_sb))
    + first_bno++;
    +
    + /* ...the reference count btree... */
    + if (xfs_sb_version_hasreflink(&mp->m_sb))
    + first_bno++;
    +
    + /*
    + * ...and the log, if it is allocated in the first allocation group.
    + *
    + * This can happen with filesystems that only have a single
    + * allocation group, or very odd geometries created by old mkfs
    + * versions on very small filesystems.
    + */
    + if (mp->m_sb.sb_logstart &&
    + XFS_FSB_TO_AGNO(mp, mp->m_sb.sb_logstart) == 0)
    + first_bno += mp->m_sb.sb_logblocks;
    +
    + /*
    + * Now round first_bno up to whatever allocation alignment is given
    + * by the filesystem or was passed in.
    + */
    + if (xfs_sb_version_hasdalign(&mp->m_sb) && igeo->ialloc_align > 0)
    + first_bno = roundup(first_bno, sunit);
    + else if (xfs_sb_version_hasalign(&mp->m_sb) &&
    + mp->m_sb.sb_inoalignmt > 1)
    + first_bno = roundup(first_bno, mp->m_sb.sb_inoalignmt);
    +
    + return XFS_AGINO_TO_INO(mp, 0, XFS_AGB_TO_AGINO(mp, first_bno));
    +}
    diff --git a/fs/xfs/libxfs/xfs_ialloc.h b/fs/xfs/libxfs/xfs_ialloc.h
    index 323592d563d5..72b3468b97b1 100644
    --- a/fs/xfs/libxfs/xfs_ialloc.h
    +++ b/fs/xfs/libxfs/xfs_ialloc.h
    @@ -152,5 +152,6 @@ int xfs_inobt_insert_rec(struct xfs_btree_cur *cur, uint16_t holemask,

    int xfs_ialloc_cluster_alignment(struct xfs_mount *mp);
    void xfs_ialloc_setup_geometry(struct xfs_mount *mp);
    +xfs_ino_t xfs_ialloc_calc_rootino(struct xfs_mount *mp, int sunit);

    #endif /* __XFS_IALLOC_H__ */
    diff --git a/fs/xfs/libxfs/xfs_inode_fork.c b/fs/xfs/libxfs/xfs_inode_fork.c
    index 8fdd0424070e..15d6f947620f 100644
    --- a/fs/xfs/libxfs/xfs_inode_fork.c
    +++ b/fs/xfs/libxfs/xfs_inode_fork.c
    @@ -75,11 +75,15 @@ xfs_iformat_fork(
    error = xfs_iformat_btree(ip, dip, XFS_DATA_FORK);
    break;
    default:
    + xfs_inode_verifier_error(ip, -EFSCORRUPTED, __func__,
    + dip, sizeof(*dip), __this_address);
    return -EFSCORRUPTED;
    }
    break;

    default:
    + xfs_inode_verifier_error(ip, -EFSCORRUPTED, __func__, dip,
    + sizeof(*dip), __this_address);
    return -EFSCORRUPTED;
    }
    if (error)
    @@ -110,6 +114,8 @@ xfs_iformat_fork(
    error = xfs_iformat_btree(ip, dip, XFS_ATTR_FORK);
    break;
    default:
    + xfs_inode_verifier_error(ip, error, __func__, dip,
    + sizeof(*dip), __this_address);
    error = -EFSCORRUPTED;
    break;
    }
    diff --git a/fs/xfs/libxfs/xfs_refcount.c b/fs/xfs/libxfs/xfs_refcount.c
    index 9a7fadb1361c..78236bd6c64f 100644
    --- a/fs/xfs/libxfs/xfs_refcount.c
    +++ b/fs/xfs/libxfs/xfs_refcount.c
    @@ -1591,8 +1591,10 @@ xfs_refcount_recover_extent(
    struct list_head *debris = priv;
    struct xfs_refcount_recovery *rr;

    - if (be32_to_cpu(rec->refc.rc_refcount) != 1)
    + if (be32_to_cpu(rec->refc.rc_refcount) != 1) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, cur->bc_mp);
    return -EFSCORRUPTED;
    + }

    rr = kmem_alloc(sizeof(struct xfs_refcount_recovery), 0);
    xfs_refcount_btrec_to_irec(rec, &rr->rr_rrec);
    diff --git a/fs/xfs/libxfs/xfs_rtbitmap.c b/fs/xfs/libxfs/xfs_rtbitmap.c
    index 42085e70c01a..85f123b3dfcc 100644
    --- a/fs/xfs/libxfs/xfs_rtbitmap.c
    +++ b/fs/xfs/libxfs/xfs_rtbitmap.c
    @@ -15,7 +15,7 @@
    #include "xfs_bmap.h"
    #include "xfs_trans.h"
    #include "xfs_rtalloc.h"
    -
    +#include "xfs_error.h"

    /*
    * Realtime allocator bitmap functions shared with userspace.
    @@ -70,8 +70,10 @@ xfs_rtbuf_get(
    if (error)
    return error;

    - if (nmap == 0 || !xfs_bmap_is_real_extent(&map))
    + if (nmap == 0 || !xfs_bmap_is_real_extent(&map)) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, mp);
    return -EFSCORRUPTED;
    + }

    ASSERT(map.br_startblock != NULLFSBLOCK);
    error = xfs_trans_read_buf(mp, tp, mp->m_ddev_targp,
    diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c
    index 96d7071cfa46..3f2292c7835c 100644
    --- a/fs/xfs/xfs_acl.c
    +++ b/fs/xfs/xfs_acl.c
    @@ -12,6 +12,7 @@
    #include "xfs_inode.h"
    #include "xfs_attr.h"
    #include "xfs_trace.h"
    +#include "xfs_error.h"
    #include <linux/posix_acl_xattr.h>


    @@ -23,6 +24,7 @@

    STATIC struct posix_acl *
    xfs_acl_from_disk(
    + struct xfs_mount *mp,
    const struct xfs_acl *aclp,
    int len,
    int max_entries)
    @@ -32,11 +34,18 @@ xfs_acl_from_disk(
    const struct xfs_acl_entry *ace;
    unsigned int count, i;

    - if (len < sizeof(*aclp))
    + if (len < sizeof(*aclp)) {
    + XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, aclp,
    + len);
    return ERR_PTR(-EFSCORRUPTED);
    + }
    +
    count = be32_to_cpu(aclp->acl_cnt);
    - if (count > max_entries || XFS_ACL_SIZE(count) != len)
    + if (count > max_entries || XFS_ACL_SIZE(count) != len) {
    + XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, aclp,
    + len);
    return ERR_PTR(-EFSCORRUPTED);
    + }

    acl = posix_acl_alloc(count, GFP_KERNEL);
    if (!acl)
    @@ -145,7 +154,7 @@ xfs_get_acl(struct inode *inode, int type)
    if (error != -ENOATTR)
    acl = ERR_PTR(error);
    } else {
    - acl = xfs_acl_from_disk(xfs_acl, len,
    + acl = xfs_acl_from_disk(ip->i_mount, xfs_acl, len,
    XFS_ACL_MAX_ENTRIES(ip->i_mount));
    kmem_free(xfs_acl);
    }
    diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
    index a640a285cc52..766b1386402a 100644
    --- a/fs/xfs/xfs_attr_inactive.c
    +++ b/fs/xfs/xfs_attr_inactive.c
    @@ -22,6 +22,7 @@
    #include "xfs_attr_leaf.h"
    #include "xfs_quota.h"
    #include "xfs_dir2.h"
    +#include "xfs_error.h"

    /*
    * Look at all the extents for this logical region,
    @@ -208,8 +209,9 @@ xfs_attr3_node_inactive(
    * Since this code is recursive (gasp!) we must protect ourselves.
    */
    if (level > XFS_DA_NODE_MAXDEPTH) {
    + xfs_buf_corruption_error(bp);
    xfs_trans_brelse(*trans, bp); /* no locks for later trans */
    - return -EIO;
    + return -EFSCORRUPTED;
    }

    node = bp->b_addr;
    @@ -258,8 +260,9 @@ xfs_attr3_node_inactive(
    error = xfs_attr3_leaf_inactive(trans, dp, child_bp);
    break;
    default:
    - error = -EIO;
    + xfs_buf_corruption_error(child_bp);
    xfs_trans_brelse(*trans, child_bp);
    + error = -EFSCORRUPTED;
    break;
    }
    if (error)
    @@ -341,7 +344,8 @@ xfs_attr3_root_inactive(
    error = xfs_attr3_leaf_inactive(trans, dp, bp);
    break;
    default:
    - error = -EIO;
    + error = -EFSCORRUPTED;
    + xfs_buf_corruption_error(bp);
    xfs_trans_brelse(*trans, bp);
    break;
    }
    diff --git a/fs/xfs/xfs_attr_list.c b/fs/xfs/xfs_attr_list.c
    index 00758fdc2fec..8b9b500e75e8 100644
    --- a/fs/xfs/xfs_attr_list.c
    +++ b/fs/xfs/xfs_attr_list.c
    @@ -258,8 +258,10 @@ xfs_attr_node_list_lookup(
    return 0;

    /* We can't point back to the root. */
    - if (cursor->blkno == 0)
    + if (cursor->blkno == 0) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, mp);
    return -EFSCORRUPTED;
    + }
    }

    if (expected_level != 0)
    @@ -269,6 +271,7 @@ xfs_attr_node_list_lookup(
    return 0;

    out_corruptbuf:
    + xfs_buf_corruption_error(bp);
    xfs_trans_brelse(tp, bp);
    return -EFSCORRUPTED;
    }
    diff --git a/fs/xfs/xfs_bmap_item.c b/fs/xfs/xfs_bmap_item.c
    index 83d24e983d4c..243e5e0f82a3 100644
    --- a/fs/xfs/xfs_bmap_item.c
    +++ b/fs/xfs/xfs_bmap_item.c
    @@ -21,7 +21,7 @@
    #include "xfs_icache.h"
    #include "xfs_bmap_btree.h"
    #include "xfs_trans_space.h"
    -
    +#include "xfs_error.h"

    kmem_zone_t *xfs_bui_zone;
    kmem_zone_t *xfs_bud_zone;
    @@ -456,7 +456,7 @@ xfs_bui_recover(
    if (buip->bui_format.bui_nextents != XFS_BUI_MAX_FAST_EXTENTS) {
    set_bit(XFS_BUI_RECOVERED, &buip->bui_flags);
    xfs_bui_release(buip);
    - return -EIO;
    + return -EFSCORRUPTED;
    }

    /*
    @@ -490,7 +490,7 @@ xfs_bui_recover(
    */
    set_bit(XFS_BUI_RECOVERED, &buip->bui_flags);
    xfs_bui_release(buip);
    - return -EIO;
    + return -EFSCORRUPTED;
    }

    error = xfs_trans_alloc(mp, &M_RES(mp)->tr_itruncate,
    @@ -525,6 +525,7 @@ xfs_bui_recover(
    type = bui_type;
    break;
    default:
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, mp);
    error = -EFSCORRUPTED;
    goto err_inode;
    }
    diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
    index d6d78e127625..113bed28bc31 100644
    --- a/fs/xfs/xfs_bmap_util.c
    +++ b/fs/xfs/xfs_bmap_util.c
    @@ -1167,6 +1167,7 @@ xfs_prepare_shift(
    struct xfs_inode *ip,
    loff_t offset)
    {
    + struct xfs_mount *mp = ip->i_mount;
    int error;

    /*
    @@ -1179,6 +1180,17 @@ xfs_prepare_shift(
    return error;
    }

    + /*
    + * Shift operations must stabilize the start block offset boundary along
    + * with the full range of the operation. If we don't, a COW writeback
    + * completion could race with an insert, front merge with the start
    + * extent (after split) during the shift and corrupt the file. Start
    + * with the block just prior to the start to stabilize the boundary.
    + */
    + offset = round_down(offset, 1 << mp->m_sb.sb_blocklog);
    + if (offset)
    + offset -= (1 << mp->m_sb.sb_blocklog);
    +
    /*
    * Writeback and invalidate cache for the remainder of the file as we're
    * about to shift down every extent from offset to EOF.
    diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
    index d74fbd1e9d3e..b1452117e442 100644
    --- a/fs/xfs/xfs_buf_item.c
    +++ b/fs/xfs/xfs_buf_item.c
    @@ -956,7 +956,7 @@ xfs_buf_item_relse(
    struct xfs_buf_log_item *bip = bp->b_log_item;

    trace_xfs_buf_item_relse(bp, _RET_IP_);
    - ASSERT(!(bip->bli_item.li_flags & XFS_LI_IN_AIL));
    + ASSERT(!test_bit(XFS_LI_IN_AIL, &bip->bli_item.li_flags));

    bp->b_log_item = NULL;
    if (list_empty(&bp->b_li_list))
    diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
    index 3cbf248af51f..aa5084180270 100644
    --- a/fs/xfs/xfs_dquot.c
    +++ b/fs/xfs/xfs_dquot.c
    @@ -1125,7 +1125,7 @@ xfs_qm_dqflush(
    xfs_buf_relse(bp);
    xfs_dqfunlock(dqp);
    xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE);
    - return -EIO;
    + return -EFSCORRUPTED;
    }

    /* This is the only portion of data that needs to persist */
    diff --git a/fs/xfs/xfs_error.c b/fs/xfs/xfs_error.c
    index 849fd4476950..d8cdb27fe6ed 100644
    --- a/fs/xfs/xfs_error.c
    +++ b/fs/xfs/xfs_error.c
    @@ -329,7 +329,7 @@ xfs_corruption_error(
    const char *tag,
    int level,
    struct xfs_mount *mp,
    - void *buf,
    + const void *buf,
    size_t bufsize,
    const char *filename,
    int linenum,
    @@ -341,6 +341,27 @@ xfs_corruption_error(
    xfs_alert(mp, "Corruption detected. Unmount and run xfs_repair");
    }

    +/*
    + * Complain about the kinds of metadata corruption that we can't detect from a
    + * verifier, such as incorrect inter-block relationship data. Does not set
    + * bp->b_error.
    + */
    +void
    +xfs_buf_corruption_error(
    + struct xfs_buf *bp)
    +{
    + struct xfs_mount *mp = bp->b_mount;
    +
    + xfs_alert_tag(mp, XFS_PTAG_VERIFIER_ERROR,
    + "Metadata corruption detected at %pS, %s block 0x%llx",
    + __return_address, bp->b_ops->name, bp->b_bn);
    +
    + xfs_alert(mp, "Unmount and run xfs_repair");
    +
    + if (xfs_error_level >= XFS_ERRLEVEL_HIGH)
    + xfs_stack_trace();
    +}
    +
    /*
    * Warnings specifically for verifier errors. Differentiate CRC vs. invalid
    * values, and omit the stack trace unless the error level is tuned high.
    @@ -350,7 +371,7 @@ xfs_buf_verifier_error(
    struct xfs_buf *bp,
    int error,
    const char *name,
    - void *buf,
    + const void *buf,
    size_t bufsz,
    xfs_failaddr_t failaddr)
    {
    @@ -402,7 +423,7 @@ xfs_inode_verifier_error(
    struct xfs_inode *ip,
    int error,
    const char *name,
    - void *buf,
    + const void *buf,
    size_t bufsz,
    xfs_failaddr_t failaddr)
    {
    diff --git a/fs/xfs/xfs_error.h b/fs/xfs/xfs_error.h
    index 602aa7d62b66..c319379f7d1a 100644
    --- a/fs/xfs/xfs_error.h
    +++ b/fs/xfs/xfs_error.h
    @@ -12,16 +12,17 @@ extern void xfs_error_report(const char *tag, int level, struct xfs_mount *mp,
    const char *filename, int linenum,
    xfs_failaddr_t failaddr);
    extern void xfs_corruption_error(const char *tag, int level,
    - struct xfs_mount *mp, void *buf, size_t bufsize,
    + struct xfs_mount *mp, const void *buf, size_t bufsize,
    const char *filename, int linenum,
    xfs_failaddr_t failaddr);
    +void xfs_buf_corruption_error(struct xfs_buf *bp);
    extern void xfs_buf_verifier_error(struct xfs_buf *bp, int error,
    - const char *name, void *buf, size_t bufsz,
    + const char *name, const void *buf, size_t bufsz,
    xfs_failaddr_t failaddr);
    extern void xfs_verifier_error(struct xfs_buf *bp, int error,
    xfs_failaddr_t failaddr);
    extern void xfs_inode_verifier_error(struct xfs_inode *ip, int error,
    - const char *name, void *buf, size_t bufsz,
    + const char *name, const void *buf, size_t bufsz,
    xfs_failaddr_t failaddr);

    #define XFS_ERROR_REPORT(e, lvl, mp) \
    diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
    index e44efc41a041..a05a1074e8f8 100644
    --- a/fs/xfs/xfs_extfree_item.c
    +++ b/fs/xfs/xfs_extfree_item.c
    @@ -21,7 +21,7 @@
    #include "xfs_alloc.h"
    #include "xfs_bmap.h"
    #include "xfs_trace.h"
    -
    +#include "xfs_error.h"

    kmem_zone_t *xfs_efi_zone;
    kmem_zone_t *xfs_efd_zone;
    @@ -228,6 +228,7 @@ xfs_efi_copy_format(xfs_log_iovec_t *buf, xfs_efi_log_format_t *dst_efi_fmt)
    }
    return 0;
    }
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, NULL);
    return -EFSCORRUPTED;
    }

    @@ -624,7 +625,7 @@ xfs_efi_recover(
    */
    set_bit(XFS_EFI_RECOVERED, &efip->efi_flags);
    xfs_efi_release(efip);
    - return -EIO;
    + return -EFSCORRUPTED;
    }
    }

    diff --git a/fs/xfs/xfs_fsmap.c b/fs/xfs/xfs_fsmap.c
    index 01c0933a4d10..79e8af8f4669 100644
    --- a/fs/xfs/xfs_fsmap.c
    +++ b/fs/xfs/xfs_fsmap.c
    @@ -146,6 +146,7 @@ xfs_fsmap_owner_from_rmap(
    dest->fmr_owner = XFS_FMR_OWN_FREE;
    break;
    default:
    + ASSERT(0);
    return -EFSCORRUPTED;
    }
    return 0;
    diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
    index 7a9048c4c2f9..7b72c189cff0 100644
    --- a/fs/xfs/xfs_inode.c
    +++ b/fs/xfs/xfs_inode.c
    @@ -2149,8 +2149,10 @@ xfs_iunlink_update_bucket(
    * passed in because either we're adding or removing ourselves from the
    * head of the list.
    */
    - if (old_value == new_agino)
    + if (old_value == new_agino) {
    + xfs_buf_corruption_error(agibp);
    return -EFSCORRUPTED;
    + }

    agi->agi_unlinked[bucket_index] = cpu_to_be32(new_agino);
    offset = offsetof(struct xfs_agi, agi_unlinked) +
    @@ -2213,6 +2215,8 @@ xfs_iunlink_update_inode(
    /* Make sure the old pointer isn't garbage. */
    old_value = be32_to_cpu(dip->di_next_unlinked);
    if (!xfs_verify_agino_or_null(mp, agno, old_value)) {
    + xfs_inode_verifier_error(ip, -EFSCORRUPTED, __func__, dip,
    + sizeof(*dip), __this_address);
    error = -EFSCORRUPTED;
    goto out;
    }
    @@ -2224,8 +2228,11 @@ xfs_iunlink_update_inode(
    */
    *old_next_agino = old_value;
    if (old_value == next_agino) {
    - if (next_agino != NULLAGINO)
    + if (next_agino != NULLAGINO) {
    + xfs_inode_verifier_error(ip, -EFSCORRUPTED, __func__,
    + dip, sizeof(*dip), __this_address);
    error = -EFSCORRUPTED;
    + }
    goto out;
    }

    @@ -2276,8 +2283,10 @@ xfs_iunlink(
    */
    next_agino = be32_to_cpu(agi->agi_unlinked[bucket_index]);
    if (next_agino == agino ||
    - !xfs_verify_agino_or_null(mp, agno, next_agino))
    + !xfs_verify_agino_or_null(mp, agno, next_agino)) {
    + xfs_buf_corruption_error(agibp);
    return -EFSCORRUPTED;
    + }

    if (next_agino != NULLAGINO) {
    struct xfs_perag *pag;
    @@ -3215,6 +3224,7 @@ xfs_rename(
    struct xfs_trans *tp;
    struct xfs_inode *wip = NULL; /* whiteout inode */
    struct xfs_inode *inodes[__XFS_SORT_INODES];
    + int i;
    int num_inodes = __XFS_SORT_INODES;
    bool new_parent = (src_dp != target_dp);
    bool src_is_directory = S_ISDIR(VFS_I(src_ip)->i_mode);
    @@ -3326,6 +3336,30 @@ xfs_rename(
    }
    }

    + /*
    + * Lock the AGI buffers we need to handle bumping the nlink of the
    + * whiteout inode off the unlinked list and to handle dropping the
    + * nlink of the target inode. Per locking order rules, do this in
    + * increasing AG order and before directory block allocation tries to
    + * grab AGFs because we grab AGIs before AGFs.
    + *
    + * The (vfs) caller must ensure that if src is a directory then
    + * target_ip is either null or an empty directory.
    + */
    + for (i = 0; i < num_inodes && inodes[i] != NULL; i++) {
    + if (inodes[i] == wip ||
    + (inodes[i] == target_ip &&
    + (VFS_I(target_ip)->i_nlink == 1 || src_is_directory))) {
    + struct xfs_buf *bp;
    + xfs_agnumber_t agno;
    +
    + agno = XFS_INO_TO_AGNO(mp, inodes[i]->i_ino);
    + error = xfs_read_agi(mp, tp, agno, &bp);
    + if (error)
    + goto out_trans_cancel;
    + }
    + }
    +
    /*
    * Directory entry creation below may acquire the AGF. Remove
    * the whiteout from the unlinked list first to preserve correct
    diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
    index bb8f076805b9..726aa3bfd6e8 100644
    --- a/fs/xfs/xfs_inode_item.c
    +++ b/fs/xfs/xfs_inode_item.c
    @@ -17,6 +17,7 @@
    #include "xfs_trans_priv.h"
    #include "xfs_buf_item.h"
    #include "xfs_log.h"
    +#include "xfs_error.h"

    #include <linux/iversion.h>

    @@ -828,8 +829,10 @@ xfs_inode_item_format_convert(
    {
    struct xfs_inode_log_format_32 *in_f32 = buf->i_addr;

    - if (buf->i_len != sizeof(*in_f32))
    + if (buf->i_len != sizeof(*in_f32)) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, NULL);
    return -EFSCORRUPTED;
    + }

    in_f->ilf_type = in_f32->ilf_type;
    in_f->ilf_size = in_f32->ilf_size;
    diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
    index 239c9548b156..b6f85e488d5c 100644
    --- a/fs/xfs/xfs_iomap.c
    +++ b/fs/xfs/xfs_iomap.c
    @@ -765,6 +765,11 @@ xfs_iomap_write_unwritten(
    */
    resblks = XFS_DIOSTRAT_SPACE_RES(mp, 0) << 1;

    + /* Attach dquots so that bmbt splits are accounted correctly. */
    + error = xfs_qm_dqattach(ip);
    + if (error)
    + return error;
    +
    do {
    /*
    * Set up a transaction to convert the range of extents
    @@ -783,6 +788,11 @@ xfs_iomap_write_unwritten(
    xfs_ilock(ip, XFS_ILOCK_EXCL);
    xfs_trans_ijoin(tp, ip, 0);

    + error = xfs_trans_reserve_quota_nblks(tp, ip, resblks, 0,
    + XFS_QMOPT_RES_REGBLKS);
    + if (error)
    + goto error_on_bmapi_transaction;
    +
    /*
    * Modify the unwritten extent state of the buffer.
    */
    @@ -1055,6 +1065,13 @@ xfs_file_iomap_begin(
    trace_xfs_iomap_alloc(ip, offset, length, XFS_DATA_FORK, &imap);

    out_finish:
    + /*
    + * Writes that span EOF might trigger an IO size update on completion,
    + * so consider them to be dirty for the purposes of O_DSYNC even if
    + * there is no other metadata changes pending or have been made here.
    + */
    + if ((flags & IOMAP_WRITE) && offset + length > i_size_read(inode))
    + iomap->flags |= IOMAP_F_DIRTY;
    return xfs_bmbt_to_iomap(ip, iomap, &imap, shared);

    out_found:
    diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
    index ca8c763902b9..80dd05f8f1af 100644
    --- a/fs/xfs/xfs_iops.c
    +++ b/fs/xfs/xfs_iops.c
    @@ -20,6 +20,7 @@
    #include "xfs_symlink.h"
    #include "xfs_dir2.h"
    #include "xfs_iomap.h"
    +#include "xfs_error.h"

    #include <linux/xattr.h>
    #include <linux/posix_acl.h>
    @@ -470,17 +471,20 @@ xfs_vn_get_link_inline(
    struct inode *inode,
    struct delayed_call *done)
    {
    + struct xfs_inode *ip = XFS_I(inode);
    char *link;

    - ASSERT(XFS_I(inode)->i_df.if_flags & XFS_IFINLINE);
    + ASSERT(ip->i_df.if_flags & XFS_IFINLINE);

    /*
    * The VFS crashes on a NULL pointer, so return -EFSCORRUPTED if
    * if_data is junk.
    */
    - link = XFS_I(inode)->i_df.if_u1.if_data;
    - if (!link)
    + link = ip->i_df.if_u1.if_data;
    + if (!link) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, ip->i_mount);
    return ERR_PTR(-EFSCORRUPTED);
    + }
    return link;
    }

    diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
    index c1a514ffff55..248101876e1e 100644
    --- a/fs/xfs/xfs_log_recover.c
    +++ b/fs/xfs/xfs_log_recover.c
    @@ -471,7 +471,7 @@ xlog_find_verify_log_record(
    xfs_warn(log->l_mp,
    "Log inconsistent (didn't find previous header)");
    ASSERT(0);
    - error = -EIO;
    + error = -EFSCORRUPTED;
    goto out;
    }

    @@ -1347,10 +1347,11 @@ xlog_find_tail(
    error = xlog_rseek_logrec_hdr(log, *head_blk, *head_blk, 1, buffer,
    &rhead_blk, &rhead, &wrapped);
    if (error < 0)
    - return error;
    + goto done;
    if (!error) {
    xfs_warn(log->l_mp, "%s: couldn't find sync record", __func__);
    - return -EIO;
    + error = -EFSCORRUPTED;
    + goto done;
    }
    *tail_blk = BLOCK_LSN(be64_to_cpu(rhead->h_tail_lsn));

    @@ -3166,7 +3167,7 @@ xlog_recover_inode_pass2(
    default:
    xfs_warn(log->l_mp, "%s: Invalid flag", __func__);
    ASSERT(0);
    - error = -EIO;
    + error = -EFSCORRUPTED;
    goto out_release;
    }
    }
    @@ -3247,12 +3248,12 @@ xlog_recover_dquot_pass2(
    recddq = item->ri_buf[1].i_addr;
    if (recddq == NULL) {
    xfs_alert(log->l_mp, "NULL dquot in %s.", __func__);
    - return -EIO;
    + return -EFSCORRUPTED;
    }
    if (item->ri_buf[1].i_len < sizeof(xfs_disk_dquot_t)) {
    xfs_alert(log->l_mp, "dquot too small (%d) in %s.",
    item->ri_buf[1].i_len, __func__);
    - return -EIO;
    + return -EFSCORRUPTED;
    }

    /*
    @@ -3279,7 +3280,7 @@ xlog_recover_dquot_pass2(
    if (fa) {
    xfs_alert(mp, "corrupt dquot ID 0x%x in log at %pS",
    dq_f->qlf_id, fa);
    - return -EIO;
    + return -EFSCORRUPTED;
    }
    ASSERT(dq_f->qlf_len == 1);

    @@ -3537,6 +3538,7 @@ xfs_cui_copy_format(
    memcpy(dst_cui_fmt, src_cui_fmt, len);
    return 0;
    }
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, NULL);
    return -EFSCORRUPTED;
    }

    @@ -3601,8 +3603,10 @@ xlog_recover_cud_pass2(
    struct xfs_ail *ailp = log->l_ailp;

    cud_formatp = item->ri_buf[0].i_addr;
    - if (item->ri_buf[0].i_len != sizeof(struct xfs_cud_log_format))
    + if (item->ri_buf[0].i_len != sizeof(struct xfs_cud_log_format)) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, log->l_mp);
    return -EFSCORRUPTED;
    + }
    cui_id = cud_formatp->cud_cui_id;

    /*
    @@ -3654,6 +3658,7 @@ xfs_bui_copy_format(
    memcpy(dst_bui_fmt, src_bui_fmt, len);
    return 0;
    }
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, NULL);
    return -EFSCORRUPTED;
    }

    @@ -3677,8 +3682,10 @@ xlog_recover_bui_pass2(

    bui_formatp = item->ri_buf[0].i_addr;

    - if (bui_formatp->bui_nextents != XFS_BUI_MAX_FAST_EXTENTS)
    + if (bui_formatp->bui_nextents != XFS_BUI_MAX_FAST_EXTENTS) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, log->l_mp);
    return -EFSCORRUPTED;
    + }
    buip = xfs_bui_init(mp);
    error = xfs_bui_copy_format(&item->ri_buf[0], &buip->bui_format);
    if (error) {
    @@ -3720,8 +3727,10 @@ xlog_recover_bud_pass2(
    struct xfs_ail *ailp = log->l_ailp;

    bud_formatp = item->ri_buf[0].i_addr;
    - if (item->ri_buf[0].i_len != sizeof(struct xfs_bud_log_format))
    + if (item->ri_buf[0].i_len != sizeof(struct xfs_bud_log_format)) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, log->l_mp);
    return -EFSCORRUPTED;
    + }
    bui_id = bud_formatp->bud_bui_id;

    /*
    @@ -4018,7 +4027,7 @@ xlog_recover_commit_pass1(
    xfs_warn(log->l_mp, "%s: invalid item type (%d)",
    __func__, ITEM_TYPE(item));
    ASSERT(0);
    - return -EIO;
    + return -EFSCORRUPTED;
    }
    }

    @@ -4066,7 +4075,7 @@ xlog_recover_commit_pass2(
    xfs_warn(log->l_mp, "%s: invalid item type (%d)",
    __func__, ITEM_TYPE(item));
    ASSERT(0);
    - return -EIO;
    + return -EFSCORRUPTED;
    }
    }

    @@ -4187,7 +4196,7 @@ xlog_recover_add_to_cont_trans(
    ASSERT(len <= sizeof(struct xfs_trans_header));
    if (len > sizeof(struct xfs_trans_header)) {
    xfs_warn(log->l_mp, "%s: bad header length", __func__);
    - return -EIO;
    + return -EFSCORRUPTED;
    }

    xlog_recover_add_item(&trans->r_itemq);
    @@ -4243,13 +4252,13 @@ xlog_recover_add_to_trans(
    xfs_warn(log->l_mp, "%s: bad header magic number",
    __func__);
    ASSERT(0);
    - return -EIO;
    + return -EFSCORRUPTED;
    }

    if (len > sizeof(struct xfs_trans_header)) {
    xfs_warn(log->l_mp, "%s: bad header length", __func__);
    ASSERT(0);
    - return -EIO;
    + return -EFSCORRUPTED;
    }

    /*
    @@ -4285,7 +4294,7 @@ xlog_recover_add_to_trans(
    in_f->ilf_size);
    ASSERT(0);
    kmem_free(ptr);
    - return -EIO;
    + return -EFSCORRUPTED;
    }

    item->ri_total = in_f->ilf_size;
    @@ -4293,7 +4302,16 @@ xlog_recover_add_to_trans(
    kmem_zalloc(item->ri_total * sizeof(xfs_log_iovec_t),
    0);
    }
    - ASSERT(item->ri_total > item->ri_cnt);
    +
    + if (item->ri_total <= item->ri_cnt) {
    + xfs_warn(log->l_mp,
    + "log item region count (%d) overflowed size (%d)",
    + item->ri_cnt, item->ri_total);
    + ASSERT(0);
    + kmem_free(ptr);
    + return -EFSCORRUPTED;
    + }
    +
    /* Description region is ri_buf[0] */
    item->ri_buf[item->ri_cnt].i_addr = ptr;
    item->ri_buf[item->ri_cnt].i_len = len;
    @@ -4380,7 +4398,7 @@ xlog_recovery_process_trans(
    default:
    xfs_warn(log->l_mp, "%s: bad flag 0x%x", __func__, flags);
    ASSERT(0);
    - error = -EIO;
    + error = -EFSCORRUPTED;
    break;
    }
    if (error || freeit)
    @@ -4460,7 +4478,7 @@ xlog_recover_process_ophdr(
    xfs_warn(log->l_mp, "%s: bad clientid 0x%x",
    __func__, ohead->oh_clientid);
    ASSERT(0);
    - return -EIO;
    + return -EFSCORRUPTED;
    }

    /*
    @@ -4470,7 +4488,7 @@ xlog_recover_process_ophdr(
    if (dp + len > end) {
    xfs_warn(log->l_mp, "%s: bad length 0x%x", __func__, len);
    WARN_ON(1);
    - return -EIO;
    + return -EFSCORRUPTED;
    }

    trans = xlog_recover_ophdr_to_trans(rhash, rhead, ohead);
    @@ -5172,8 +5190,10 @@ xlog_recover_process(
    * If the filesystem is CRC enabled, this mismatch becomes a
    * fatal log corruption failure.
    */
    - if (xfs_sb_version_hascrc(&log->l_mp->m_sb))
    + if (xfs_sb_version_hascrc(&log->l_mp->m_sb)) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, log->l_mp);
    return -EFSCORRUPTED;
    + }
    }

    xlog_unpack_data(rhead, dp, log);
    @@ -5200,7 +5220,7 @@ xlog_valid_rec_header(
    (be32_to_cpu(rhead->h_version) & (~XLOG_VERSION_OKBITS))))) {
    xfs_warn(log->l_mp, "%s: unrecognised log version (%d).",
    __func__, be32_to_cpu(rhead->h_version));
    - return -EIO;
    + return -EFSCORRUPTED;
    }

    /* LR body must have data or it wouldn't have been written */
    @@ -5296,8 +5316,12 @@ xlog_do_recovery_pass(
    "invalid iclog size (%d bytes), using lsunit (%d bytes)",
    h_size, log->l_mp->m_logbsize);
    h_size = log->l_mp->m_logbsize;
    - } else
    - return -EFSCORRUPTED;
    + } else {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW,
    + log->l_mp);
    + error = -EFSCORRUPTED;
    + goto bread_err1;
    + }
    }

    if ((be32_to_cpu(rhead->h_version) & XLOG_VERSION_2) &&
    diff --git a/fs/xfs/xfs_message.c b/fs/xfs/xfs_message.c
    index 9804efe525a9..c57e8ad39712 100644
    --- a/fs/xfs/xfs_message.c
    +++ b/fs/xfs/xfs_message.c
    @@ -105,7 +105,7 @@ assfail(char *expr, char *file, int line)
    }

    void
    -xfs_hex_dump(void *p, int length)
    +xfs_hex_dump(const void *p, int length)
    {
    print_hex_dump(KERN_ALERT, "", DUMP_PREFIX_OFFSET, 16, 1, p, length, 1);
    }
    diff --git a/fs/xfs/xfs_message.h b/fs/xfs/xfs_message.h
    index 34447dca97d1..7f040b04b739 100644
    --- a/fs/xfs/xfs_message.h
    +++ b/fs/xfs/xfs_message.h
    @@ -60,6 +60,6 @@ do { \
    extern void assfail(char *expr, char *f, int l);
    extern void asswarn(char *expr, char *f, int l);

    -extern void xfs_hex_dump(void *p, int length);
    +extern void xfs_hex_dump(const void *p, int length);

    #endif /* __XFS_MESSAGE_H */
    diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
    index 5a0ce0c2c4bb..bbcf48a625b2 100644
    --- a/fs/xfs/xfs_mount.c
    +++ b/fs/xfs/xfs_mount.c
    @@ -31,7 +31,7 @@
    #include "xfs_reflink.h"
    #include "xfs_extent_busy.h"
    #include "xfs_health.h"
    -
    +#include "xfs_trace.h"

    static DEFINE_MUTEX(xfs_uuid_table_mutex);
    static int xfs_uuid_table_size;
    @@ -365,66 +365,119 @@ xfs_readsb(
    }

    /*
    - * Update alignment values based on mount options and sb values
    + * If the sunit/swidth change would move the precomputed root inode value, we
    + * must reject the ondisk change because repair will stumble over that.
    + * However, we allow the mount to proceed because we never rejected this
    + * combination before. Returns true to update the sb, false otherwise.
    + */
    +static inline int
    +xfs_check_new_dalign(
    + struct xfs_mount *mp,
    + int new_dalign,
    + bool *update_sb)
    +{
    + struct xfs_sb *sbp = &mp->m_sb;
    + xfs_ino_t calc_ino;
    +
    + calc_ino = xfs_ialloc_calc_rootino(mp, new_dalign);
    + trace_xfs_check_new_dalign(mp, new_dalign, calc_ino);
    +
    + if (sbp->sb_rootino == calc_ino) {
    + *update_sb = true;
    + return 0;
    + }
    +
    + xfs_warn(mp,
    +"Cannot change stripe alignment; would require moving root inode.");
    +
    + /*
    + * XXX: Next time we add a new incompat feature, this should start
    + * returning -EINVAL to fail the mount. Until then, spit out a warning
    + * that we're ignoring the administrator's instructions.
    + */
    + xfs_warn(mp, "Skipping superblock stripe alignment update.");
    + *update_sb = false;
    + return 0;
    +}
    +
    +/*
    + * If we were provided with new sunit/swidth values as mount options, make sure
    + * that they pass basic alignment and superblock feature checks, and convert
    + * them into the same units (FSB) that everything else expects. This step
    + * /must/ be done before computing the inode geometry.
    */
    STATIC int
    -xfs_update_alignment(xfs_mount_t *mp)
    +xfs_validate_new_dalign(
    + struct xfs_mount *mp)
    {
    - xfs_sb_t *sbp = &(mp->m_sb);
    + if (mp->m_dalign == 0)
    + return 0;

    - if (mp->m_dalign) {
    + /*
    + * If stripe unit and stripe width are not multiples
    + * of the fs blocksize turn off alignment.
    + */
    + if ((BBTOB(mp->m_dalign) & mp->m_blockmask) ||
    + (BBTOB(mp->m_swidth) & mp->m_blockmask)) {
    + xfs_warn(mp,
    + "alignment check failed: sunit/swidth vs. blocksize(%d)",
    + mp->m_sb.sb_blocksize);
    + return -EINVAL;
    + } else {
    /*
    - * If stripe unit and stripe width are not multiples
    - * of the fs blocksize turn off alignment.
    + * Convert the stripe unit and width to FSBs.
    */
    - if ((BBTOB(mp->m_dalign) & mp->m_blockmask) ||
    - (BBTOB(mp->m_swidth) & mp->m_blockmask)) {
    + mp->m_dalign = XFS_BB_TO_FSBT(mp, mp->m_dalign);
    + if (mp->m_dalign && (mp->m_sb.sb_agblocks % mp->m_dalign)) {
    xfs_warn(mp,
    - "alignment check failed: sunit/swidth vs. blocksize(%d)",
    - sbp->sb_blocksize);
    + "alignment check failed: sunit/swidth vs. agsize(%d)",
    + mp->m_sb.sb_agblocks);
    return -EINVAL;
    - } else {
    - /*
    - * Convert the stripe unit and width to FSBs.
    - */
    - mp->m_dalign = XFS_BB_TO_FSBT(mp, mp->m_dalign);
    - if (mp->m_dalign && (sbp->sb_agblocks % mp->m_dalign)) {
    - xfs_warn(mp,
    - "alignment check failed: sunit/swidth vs. agsize(%d)",
    - sbp->sb_agblocks);
    - return -EINVAL;
    - } else if (mp->m_dalign) {
    - mp->m_swidth = XFS_BB_TO_FSBT(mp, mp->m_swidth);
    - } else {
    - xfs_warn(mp,
    - "alignment check failed: sunit(%d) less than bsize(%d)",
    - mp->m_dalign, sbp->sb_blocksize);
    - return -EINVAL;
    - }
    - }
    -
    - /*
    - * Update superblock with new values
    - * and log changes
    - */
    - if (xfs_sb_version_hasdalign(sbp)) {
    - if (sbp->sb_unit != mp->m_dalign) {
    - sbp->sb_unit = mp->m_dalign;
    - mp->m_update_sb = true;
    - }
    - if (sbp->sb_width != mp->m_swidth) {
    - sbp->sb_width = mp->m_swidth;
    - mp->m_update_sb = true;
    - }
    + } else if (mp->m_dalign) {
    + mp->m_swidth = XFS_BB_TO_FSBT(mp, mp->m_swidth);
    } else {
    xfs_warn(mp,
    - "cannot change alignment: superblock does not support data alignment");
    + "alignment check failed: sunit(%d) less than bsize(%d)",
    + mp->m_dalign, mp->m_sb.sb_blocksize);
    return -EINVAL;
    }
    + }
    +
    + if (!xfs_sb_version_hasdalign(&mp->m_sb)) {
    + xfs_warn(mp,
    +"cannot change alignment: superblock does not support data alignment");
    + return -EINVAL;
    + }
    +
    + return 0;
    +}
    +
    +/* Update alignment values based on mount options and sb values. */
    +STATIC int
    +xfs_update_alignment(
    + struct xfs_mount *mp)
    +{
    + struct xfs_sb *sbp = &mp->m_sb;
    +
    + if (mp->m_dalign) {
    + bool update_sb;
    + int error;
    +
    + if (sbp->sb_unit == mp->m_dalign &&
    + sbp->sb_width == mp->m_swidth)
    + return 0;
    +
    + error = xfs_check_new_dalign(mp, mp->m_dalign, &update_sb);
    + if (error || !update_sb)
    + return error;
    +
    + sbp->sb_unit = mp->m_dalign;
    + sbp->sb_width = mp->m_swidth;
    + mp->m_update_sb = true;
    } else if ((mp->m_flags & XFS_MOUNT_NOALIGN) != XFS_MOUNT_NOALIGN &&
    xfs_sb_version_hasdalign(&mp->m_sb)) {
    - mp->m_dalign = sbp->sb_unit;
    - mp->m_swidth = sbp->sb_width;
    + mp->m_dalign = sbp->sb_unit;
    + mp->m_swidth = sbp->sb_width;
    }

    return 0;
    @@ -692,12 +745,12 @@ xfs_mountfs(
    }

    /*
    - * Check if sb_agblocks is aligned at stripe boundary
    - * If sb_agblocks is NOT aligned turn off m_dalign since
    - * allocator alignment is within an ag, therefore ag has
    - * to be aligned at stripe boundary.
    + * If we were given new sunit/swidth options, do some basic validation
    + * checks and convert the incore dalign and swidth values to the
    + * same units (FSB) that everything else uses. This /must/ happen
    + * before computing the inode geometry.
    */
    - error = xfs_update_alignment(mp);
    + error = xfs_validate_new_dalign(mp);
    if (error)
    goto out;

    @@ -708,6 +761,17 @@ xfs_mountfs(
    xfs_rmapbt_compute_maxlevels(mp);
    xfs_refcountbt_compute_maxlevels(mp);

    + /*
    + * Check if sb_agblocks is aligned at stripe boundary. If sb_agblocks
    + * is NOT aligned turn off m_dalign since allocator alignment is within
    + * an ag, therefore ag has to be aligned at stripe boundary. Note that
    + * we must compute the free space and rmap btree geometry before doing
    + * this.
    + */
    + error = xfs_update_alignment(mp);
    + if (error)
    + goto out;
    +
    /* enable fail_at_unmount as default */
    mp->m_fail_unmount = true;

    diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c
    index f63fe8d924a3..058af699e046 100644
    --- a/fs/xfs/xfs_pnfs.c
    +++ b/fs/xfs/xfs_pnfs.c
    @@ -147,11 +147,11 @@ xfs_fs_map_blocks(
    if (error)
    goto out_unlock;

    + ASSERT(!nimaps || imap.br_startblock != DELAYSTARTBLOCK);
    +
    if (write) {
    enum xfs_prealloc_flags flags = 0;

    - ASSERT(imap.br_startblock != DELAYSTARTBLOCK);
    -
    if (!nimaps || imap.br_startblock == HOLESTARTBLOCK) {
    /*
    * xfs_iomap_write_direct() expects to take ownership of
    diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
    index ecd8ce152ab1..66ea8e4fca86 100644
    --- a/fs/xfs/xfs_qm.c
    +++ b/fs/xfs/xfs_qm.c
    @@ -22,6 +22,7 @@
    #include "xfs_qm.h"
    #include "xfs_trace.h"
    #include "xfs_icache.h"
    +#include "xfs_error.h"

    /*
    * The global quota manager. There is only one of these for the entire
    @@ -754,11 +755,19 @@ xfs_qm_qino_alloc(
    if ((flags & XFS_QMOPT_PQUOTA) &&
    (mp->m_sb.sb_gquotino != NULLFSINO)) {
    ino = mp->m_sb.sb_gquotino;
    - ASSERT(mp->m_sb.sb_pquotino == NULLFSINO);
    + if (mp->m_sb.sb_pquotino != NULLFSINO) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW,
    + mp);
    + return -EFSCORRUPTED;
    + }
    } else if ((flags & XFS_QMOPT_GQUOTA) &&
    (mp->m_sb.sb_pquotino != NULLFSINO)) {
    ino = mp->m_sb.sb_pquotino;
    - ASSERT(mp->m_sb.sb_gquotino == NULLFSINO);
    + if (mp->m_sb.sb_gquotino != NULLFSINO) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW,
    + mp);
    + return -EFSCORRUPTED;
    + }
    }
    if (ino != NULLFSINO) {
    error = xfs_iget(mp, NULL, ino, 0, 0, ip);
    diff --git a/fs/xfs/xfs_refcount_item.c b/fs/xfs/xfs_refcount_item.c
    index 2328268e6245..d5708d40ad87 100644
    --- a/fs/xfs/xfs_refcount_item.c
    +++ b/fs/xfs/xfs_refcount_item.c
    @@ -17,7 +17,7 @@
    #include "xfs_refcount_item.h"
    #include "xfs_log.h"
    #include "xfs_refcount.h"
    -
    +#include "xfs_error.h"

    kmem_zone_t *xfs_cui_zone;
    kmem_zone_t *xfs_cud_zone;
    @@ -497,7 +497,7 @@ xfs_cui_recover(
    */
    set_bit(XFS_CUI_RECOVERED, &cuip->cui_flags);
    xfs_cui_release(cuip);
    - return -EIO;
    + return -EFSCORRUPTED;
    }
    }

    @@ -536,6 +536,7 @@ xfs_cui_recover(
    type = refc_type;
    break;
    default:
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, mp);
    error = -EFSCORRUPTED;
    goto abort_error;
    }
    diff --git a/fs/xfs/xfs_rmap_item.c b/fs/xfs/xfs_rmap_item.c
    index 8939e0ea09cd..02f84d9a511c 100644
    --- a/fs/xfs/xfs_rmap_item.c
    +++ b/fs/xfs/xfs_rmap_item.c
    @@ -17,7 +17,7 @@
    #include "xfs_rmap_item.h"
    #include "xfs_log.h"
    #include "xfs_rmap.h"
    -
    +#include "xfs_error.h"

    kmem_zone_t *xfs_rui_zone;
    kmem_zone_t *xfs_rud_zone;
    @@ -171,8 +171,10 @@ xfs_rui_copy_format(
    src_rui_fmt = buf->i_addr;
    len = xfs_rui_log_format_sizeof(src_rui_fmt->rui_nextents);

    - if (buf->i_len != len)
    + if (buf->i_len != len) {
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, NULL);
    return -EFSCORRUPTED;
    + }

    memcpy(dst_rui_fmt, src_rui_fmt, len);
    return 0;
    @@ -539,7 +541,7 @@ xfs_rui_recover(
    */
    set_bit(XFS_RUI_RECOVERED, &ruip->rui_flags);
    xfs_rui_release(ruip);
    - return -EIO;
    + return -EFSCORRUPTED;
    }
    }

    @@ -581,6 +583,7 @@ xfs_rui_recover(
    type = XFS_RMAP_FREE;
    break;
    default:
    + XFS_ERROR_REPORT(__func__, XFS_ERRLEVEL_LOW, NULL);
    error = -EFSCORRUPTED;
    goto abort_error;
    }
    diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
    index eaae275ed430..ffb398c1de69 100644
    --- a/fs/xfs/xfs_trace.h
    +++ b/fs/xfs/xfs_trace.h
    @@ -3609,6 +3609,27 @@ DEFINE_KMEM_EVENT(kmem_alloc_large);
    DEFINE_KMEM_EVENT(kmem_realloc);
    DEFINE_KMEM_EVENT(kmem_zone_alloc);

    +TRACE_EVENT(xfs_check_new_dalign,
    + TP_PROTO(struct xfs_mount *mp, int new_dalign, xfs_ino_t calc_rootino),
    + TP_ARGS(mp, new_dalign, calc_rootino),
    + TP_STRUCT__entry(
    + __field(dev_t, dev)
    + __field(int, new_dalign)
    + __field(xfs_ino_t, sb_rootino)
    + __field(xfs_ino_t, calc_rootino)
    + ),
    + TP_fast_assign(
    + __entry->dev = mp->m_super->s_dev;
    + __entry->new_dalign = new_dalign;
    + __entry->sb_rootino = mp->m_sb.sb_rootino;
    + __entry->calc_rootino = calc_rootino;
    + ),
    + TP_printk("dev %d:%d new_dalign %d sb_rootino %llu calc_rootino %llu",
    + MAJOR(__entry->dev), MINOR(__entry->dev),
    + __entry->new_dalign, __entry->sb_rootino,
    + __entry->calc_rootino)
    +)
    +
    #endif /* _TRACE_XFS_H */

    #undef TRACE_INCLUDE_PATH
    diff --git a/include/linux/iomap.h b/include/linux/iomap.h
    index 53b16f104081..74e05e7b67f5 100644
    --- a/include/linux/iomap.h
    +++ b/include/linux/iomap.h
    @@ -32,6 +32,8 @@ struct vm_fault;
    *
    * IOMAP_F_DIRTY indicates the inode has uncommitted metadata needed to access
    * written data and requires fdatasync to commit them to persistent storage.
    + * This needs to take into account metadata changes that *may* be made at IO
    + * completion, such as file size updates from direct IO.
    */
    #define IOMAP_F_NEW 0x01 /* blocks have been newly allocated */
    #define IOMAP_F_DIRTY 0x02 /* uncommitted metadata */
    diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h
    index d10150587d81..1009b6b5ce40 100644
    --- a/include/linux/sched/task_stack.h
    +++ b/include/linux/sched/task_stack.h
    @@ -16,7 +16,7 @@
    * try_get_task_stack() instead. task_stack_page will return a pointer
    * that could get freed out from under you.
    */
    -static inline void *task_stack_page(const struct task_struct *task)
    +static __always_inline void *task_stack_page(const struct task_struct *task)
    {
    return task->stack;
    }
    diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
    index 2b78cc734719..10f209d54f18 100644
    --- a/include/linux/serial_core.h
    +++ b/include/linux/serial_core.h
    @@ -297,6 +297,23 @@ struct uart_state {
    /* number of characters left in xmit buffer before we ask for more */
    #define WAKEUP_CHARS 256

    +/**
    + * uart_xmit_advance - Advance xmit buffer and account Tx'ed chars
    + * @up: uart_port structure describing the port
    + * @chars: number of characters sent
    + *
    + * This function advances the tail of circular xmit buffer by the number of
    + * @chars transmitted and handles accounting of transmitted bytes (into
    + * @up's icount.tx).
    + */
    +static inline void uart_xmit_advance(struct uart_port *up, unsigned int chars)
    +{
    + struct circ_buf *xmit = &up->state->xmit;
    +
    + xmit->tail = (xmit->tail + chars) & (UART_XMIT_SIZE - 1);
    + up->icount.tx += chars;
    +}
    +
    struct module;
    struct tty_driver;

    diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
    index aa7577b189e9..9e847e71cedd 100644
    --- a/kernel/cgroup/cgroup-v1.c
    +++ b/kernel/cgroup/cgroup-v1.c
    @@ -15,6 +15,7 @@
    #include <linux/pid_namespace.h>
    #include <linux/cgroupstats.h>
    #include <linux/fs_parser.h>
    +#include <linux/cpu.h>

    #include <trace/events/cgroup.h>

    @@ -62,6 +63,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)
    int retval = 0;

    mutex_lock(&cgroup_mutex);
    + cpus_read_lock();
    percpu_down_write(&cgroup_threadgroup_rwsem);
    for_each_root(root) {
    struct cgroup *from_cgrp;
    @@ -78,6 +80,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)
    break;
    }
    percpu_up_write(&cgroup_threadgroup_rwsem);
    + cpus_read_unlock();
    mutex_unlock(&cgroup_mutex);

    return retval;
    diff --git a/kernel/trace/trace_preemptirq.c b/kernel/trace/trace_preemptirq.c
    index 26b06b09c9f6..e9645f829b94 100644
    --- a/kernel/trace/trace_preemptirq.c
    +++ b/kernel/trace/trace_preemptirq.c
    @@ -56,14 +56,14 @@ __visible void trace_hardirqs_on_caller(unsigned long caller_addr)
    this_cpu_write(tracing_irq_cpu, 0);
    }

    - lockdep_hardirqs_on(CALLER_ADDR0);
    + lockdep_hardirqs_on(caller_addr);
    }
    EXPORT_SYMBOL(trace_hardirqs_on_caller);
    NOKPROBE_SYMBOL(trace_hardirqs_on_caller);

    __visible void trace_hardirqs_off_caller(unsigned long caller_addr)
    {
    - lockdep_hardirqs_off(CALLER_ADDR0);
    + lockdep_hardirqs_off(caller_addr);

    if (!this_cpu_read(tracing_irq_cpu)) {
    this_cpu_write(tracing_irq_cpu, 1);
    diff --git a/kernel/workqueue.c b/kernel/workqueue.c
    index e90f37e22202..dd96391b44de 100644
    --- a/kernel/workqueue.c
    +++ b/kernel/workqueue.c
    @@ -3049,10 +3049,8 @@ static bool __flush_work(struct work_struct *work, bool from_cancel)
    if (WARN_ON(!work->func))
    return false;

    - if (!from_cancel) {
    - lock_map_acquire(&work->lockdep_map);
    - lock_map_release(&work->lockdep_map);
    - }
    + lock_map_acquire(&work->lockdep_map);
    + lock_map_release(&work->lockdep_map);

    if (start_flush_work(work, &barr, from_cancel)) {
    wait_for_completion(&barr.done);
    diff --git a/mm/slub.c b/mm/slub.c
    index 5211496f6d24..17e663cf38f6 100644
    --- a/mm/slub.c
    +++ b/mm/slub.c
    @@ -5743,7 +5743,8 @@ static char *create_unique_id(struct kmem_cache *s)
    char *name = kmalloc(ID_STR_LENGTH, GFP_KERNEL);
    char *p = name;

    - BUG_ON(!name);
    + if (!name)
    + return ERR_PTR(-ENOMEM);

    *p++ = ':';
    /*
    @@ -5825,6 +5826,8 @@ static int sysfs_slab_add(struct kmem_cache *s)
    * for the symlinks.
    */
    name = create_unique_id(s);
    + if (IS_ERR(name))
    + return PTR_ERR(name);
    }

    s->kobj.kset = kset;
    diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
    index ddb988c339c1..f6853fc0fcc0 100644
    --- a/net/bridge/netfilter/ebtables.c
    +++ b/net/bridge/netfilter/ebtables.c
    @@ -999,8 +999,10 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl,
    goto free_iterate;
    }

    - if (repl->valid_hooks != t->valid_hooks)
    + if (repl->valid_hooks != t->valid_hooks) {
    + ret = -EINVAL;
    goto free_unlock;
    + }

    if (repl->num_counters && repl->num_counters != t->private->nentries) {
    ret = -EINVAL;
    diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
    index 344b2c22e75b..c353162e81ae 100644
    --- a/net/mac80211/scan.c
    +++ b/net/mac80211/scan.c
    @@ -431,10 +431,6 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
    scan_req = rcu_dereference_protected(local->scan_req,
    lockdep_is_held(&local->mtx));

    - if (scan_req != local->int_scan_req) {
    - local->scan_info.aborted = aborted;
    - cfg80211_scan_done(scan_req, &local->scan_info);
    - }
    RCU_INIT_POINTER(local->scan_req, NULL);

    scan_sdata = rcu_dereference_protected(local->scan_sdata,
    @@ -444,6 +440,13 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
    local->scanning = 0;
    local->scan_chandef.chan = NULL;

    + synchronize_rcu();
    +
    + if (scan_req != local->int_scan_req) {
    + local->scan_info.aborted = aborted;
    + cfg80211_scan_done(scan_req, &local->scan_info);
    + }
    +
    /* Set power back to normal operating levels. */
    ieee80211_hw_config(local, 0);

    diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
    index 26245419ef4a..65b5b05fe38d 100644
    --- a/net/netfilter/nf_conntrack_irc.c
    +++ b/net/netfilter/nf_conntrack_irc.c
    @@ -148,15 +148,37 @@ static int help(struct sk_buff *skb, unsigned int protoff,
    data = ib_ptr;
    data_limit = ib_ptr + skb->len - dataoff;

    - /* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24
    - * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */
    - while (data < data_limit - (19 + MINMATCHLEN)) {
    - if (memcmp(data, "\1DCC ", 5)) {
    + /* Skip any whitespace */
    + while (data < data_limit - 10) {
    + if (*data == ' ' || *data == '\r' || *data == '\n')
    + data++;
    + else
    + break;
    + }
    +
    + /* strlen("PRIVMSG x ")=10 */
    + if (data < data_limit - 10) {
    + if (strncasecmp("PRIVMSG ", data, 8))
    + goto out;
    + data += 8;
    + }
    +
    + /* strlen(" :\1DCC SENT t AAAAAAAA P\1\n")=26
    + * 7+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=26
    + */
    + while (data < data_limit - (21 + MINMATCHLEN)) {
    + /* Find first " :", the start of message */
    + if (memcmp(data, " :", 2)) {
    data++;
    continue;
    }
    + data += 2;
    +
    + /* then check that place only for the DCC command */
    + if (memcmp(data, "\1DCC ", 5))
    + goto out;
    data += 5;
    - /* we have at least (19+MINMATCHLEN)-5 bytes valid data left */
    + /* we have at least (21+MINMATCHLEN)-(2+5) bytes valid data left */

    iph = ip_hdr(skb);
    pr_debug("DCC found in master %pI4:%u %pI4:%u\n",
    @@ -172,7 +194,7 @@ static int help(struct sk_buff *skb, unsigned int protoff,
    pr_debug("DCC %s detected\n", dccprotos[i]);

    /* we have at least
    - * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid
    + * (21+MINMATCHLEN)-7-dccprotos[i].matchlen bytes valid
    * data left (== 14/13 bytes) */
    if (parse_dcc(data, data_limit, &dcc_ip,
    &dcc_port, &addr_beg_p, &addr_end_p)) {
    diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
    index b83dc9bf0a5d..78fd9122b70c 100644
    --- a/net/netfilter/nf_conntrack_sip.c
    +++ b/net/netfilter/nf_conntrack_sip.c
    @@ -477,7 +477,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr,
    return ret;
    if (ret == 0)
    break;
    - dataoff += *matchoff;
    + dataoff = *matchoff;
    }
    *in_header = 0;
    }
    @@ -489,7 +489,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct, const char *dptr,
    break;
    if (ret == 0)
    return ret;
    - dataoff += *matchoff;
    + dataoff = *matchoff;
    }

    if (in_header)
    diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
    index 79fbf37291f3..51e3953b414c 100644
    --- a/net/netfilter/nfnetlink_osf.c
    +++ b/net/netfilter/nfnetlink_osf.c
    @@ -269,6 +269,7 @@ bool nf_osf_find(const struct sk_buff *skb,
    struct nf_osf_hdr_ctx ctx;
    const struct tcphdr *tcp;
    struct tcphdr _tcph;
    + bool found = false;

    memset(&ctx, 0, sizeof(ctx));

    @@ -283,10 +284,11 @@ bool nf_osf_find(const struct sk_buff *skb,

    data->genre = f->genre;
    data->version = f->version;
    + found = true;
    break;
    }

    - return true;
    + return found;
    }
    EXPORT_SYMBOL_GPL(nf_osf_find);

    diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
    index 8574e7066d94..b5f173960725 100644
    --- a/net/rxrpc/call_event.c
    +++ b/net/rxrpc/call_event.c
    @@ -166,7 +166,7 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j)
    _enter("{%d,%d}", call->tx_hard_ack, call->tx_top);

    now = ktime_get_real();
    - max_age = ktime_sub(now, jiffies_to_usecs(call->peer->rto_j));
    + max_age = ktime_sub_us(now, jiffies_to_usecs(call->peer->rto_j));

    spin_lock_bh(&call->lock);

    diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
    index 01135e54d95d..fc784fcc3a94 100644
    --- a/net/rxrpc/local_object.c
    +++ b/net/rxrpc/local_object.c
    @@ -448,6 +448,9 @@ static void rxrpc_local_processor(struct work_struct *work)
    container_of(work, struct rxrpc_local, processor);
    bool again;

    + if (local->dead)
    + return;
    +
    trace_rxrpc_local(local->debug_id, rxrpc_local_processing,
    atomic_read(&local->usage), NULL);

    diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
    index 919c7fa5f02d..48a8c7daa635 100644
    --- a/net/sched/cls_api.c
    +++ b/net/sched/cls_api.c
    @@ -2098,6 +2098,7 @@ static int tc_new_tfilter(struct sk_buff *skb, struct nlmsghdr *n,
    }

    if (chain->tmplt_ops && chain->tmplt_ops != tp->ops) {
    + tfilter_put(tp, fh);
    NL_SET_ERR_MSG(extack, "Chain template is set to a different filter kind");
    err = -EINVAL;
    goto errout;
    diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
    index 4c26f7fb32b3..506ebae1f72c 100644
    --- a/net/sched/sch_taprio.c
    +++ b/net/sched/sch_taprio.c
    @@ -65,6 +65,7 @@ struct taprio_sched {
    u32 flags;
    enum tk_offsets tk_offset;
    int clockid;
    + bool offloaded;
    atomic64_t picos_per_byte; /* Using picoseconds because for 10Gbps+
    * speeds it's sub-nanoseconds per byte
    */
    @@ -1268,6 +1269,8 @@ static int taprio_enable_offload(struct net_device *dev,
    goto done;
    }

    + q->offloaded = true;
    +
    done:
    taprio_offload_free(offload);

    @@ -1282,12 +1285,9 @@ static int taprio_disable_offload(struct net_device *dev,
    struct tc_taprio_qopt_offload *offload;
    int err;

    - if (!FULL_OFFLOAD_IS_ENABLED(q->flags))
    + if (!q->offloaded)
    return 0;

    - if (!ops->ndo_setup_tc)
    - return -EOPNOTSUPP;
    -
    offload = taprio_offload_alloc(0);
    if (!offload) {
    NL_SET_ERR_MSG(extack,
    @@ -1303,6 +1303,8 @@ static int taprio_disable_offload(struct net_device *dev,
    goto out;
    }

    + q->offloaded = false;
    +
    out:
    taprio_offload_free(offload);

    @@ -1904,12 +1906,14 @@ static int taprio_dump(struct Qdisc *sch, struct sk_buff *skb)

    static struct Qdisc *taprio_leaf(struct Qdisc *sch, unsigned long cl)
    {
    - struct netdev_queue *dev_queue = taprio_queue_get(sch, cl);
    + struct taprio_sched *q = qdisc_priv(sch);
    + struct net_device *dev = qdisc_dev(sch);
    + unsigned int ntx = cl - 1;

    - if (!dev_queue)
    + if (ntx >= dev->num_tx_queues)
    return NULL;

    - return dev_queue->qdisc_sleeping;
    + return q->qdiscs[ntx];
    }

    static unsigned long taprio_find(struct Qdisc *sch, u32 classid)
    diff --git a/scripts/mksysmap b/scripts/mksysmap
    index 9aa23d15862a..ad8bbc52267d 100755
    --- a/scripts/mksysmap
    +++ b/scripts/mksysmap
    @@ -41,4 +41,4 @@
    # so we just ignore them to let readprofile continue to work.
    # (At least sparc64 has __crc_ in the middle).

    -$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( \.L\)' > $2
    +$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( \.L\)\|\( L0\)' > $2
    diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
    index ad4e0af2d0d0..51d2911366e9 100644
    --- a/sound/core/oss/pcm_oss.c
    +++ b/sound/core/oss/pcm_oss.c
    @@ -1661,13 +1661,14 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file)
    runtime = substream->runtime;
    if (atomic_read(&substream->mmap_count))
    goto __direct;
    - if ((err = snd_pcm_oss_make_ready(substream)) < 0)
    - return err;
    atomic_inc(&runtime->oss.rw_ref);
    if (mutex_lock_interruptible(&runtime->oss.params_lock)) {
    atomic_dec(&runtime->oss.rw_ref);
    return -ERESTARTSYS;
    }
    + err = snd_pcm_oss_make_ready_locked(substream);
    + if (err < 0)
    + goto unlock;
    format = snd_pcm_oss_format_from(runtime->oss.format);
    width = snd_pcm_format_physical_width(format);
    if (runtime->oss.buffer_used > 0) {
    diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
    index b8fe0ec5d624..5b892e7090dd 100644
    --- a/sound/pci/hda/hda_intel.c
    +++ b/sound/pci/hda/hda_intel.c
    @@ -2528,6 +2528,8 @@ static const struct pci_device_id azx_ids[] = {
    /* 5 Series/3400 */
    { PCI_DEVICE(0x8086, 0x3b56),
    .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM },
    + { PCI_DEVICE(0x8086, 0x3b57),
    + .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM },
    /* Poulsbo */
    { PCI_DEVICE(0x8086, 0x811b),
    .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE },
    diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c
    index 2971b34c87c1..e235c3ec634d 100644
    --- a/sound/pci/hda/hda_tegra.c
    +++ b/sound/pci/hda/hda_tegra.c
    @@ -428,7 +428,8 @@ MODULE_DEVICE_TABLE(of, hda_tegra_match);
    static int hda_tegra_probe(struct platform_device *pdev)
    {
    const unsigned int driver_flags = AZX_DCAPS_CORBRP_SELF_CLEAR |
    - AZX_DCAPS_PM_RUNTIME;
    + AZX_DCAPS_PM_RUNTIME |
    + AZX_DCAPS_4K_BDLE_BOUNDARY;
    struct snd_card *card;
    struct azx *chip;
    struct hda_tegra *hda;
    diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
    index 5128a5df16fd..169e74299987 100644
    --- a/sound/pci/hda/patch_hdmi.c
    +++ b/sound/pci/hda/patch_hdmi.c
    @@ -3703,6 +3703,7 @@ static int patch_tegra_hdmi(struct hda_codec *codec)
    if (err)
    return err;

    + codec->depop_delay = 10;
    codec->patch_ops.build_pcms = tegra_hdmi_build_pcms;
    spec = codec->spec;
    spec->chmap.ops.chmap_cea_alloc_validate_get_type =
    diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    index d925ae7f1b02..930bb040b403 100644
    --- a/sound/pci/hda/patch_realtek.c
    +++ b/sound/pci/hda/patch_realtek.c
    @@ -6484,6 +6484,8 @@ enum {
    ALC294_FIXUP_ASUS_GU502_HP,
    ALC294_FIXUP_ASUS_GU502_PINS,
    ALC294_FIXUP_ASUS_GU502_VERBS,
    + ALC294_FIXUP_ASUS_G513_PINS,
    + ALC285_FIXUP_ASUS_G533Z_PINS,
    ALC285_FIXUP_HP_GPIO_LED,
    ALC285_FIXUP_HP_MUTE_LED,
    ALC236_FIXUP_HP_GPIO_LED,
    @@ -7760,6 +7762,24 @@ static const struct hda_fixup alc269_fixups[] = {
    [ALC294_FIXUP_ASUS_GU502_HP] = {
    .type = HDA_FIXUP_FUNC,
    .v.func = alc294_fixup_gu502_hp,
    + },
    + [ALC294_FIXUP_ASUS_G513_PINS] = {
    + .type = HDA_FIXUP_PINS,
    + .v.pins = (const struct hda_pintbl[]) {
    + { 0x19, 0x03a11050 }, /* front HP mic */
    + { 0x1a, 0x03a11c30 }, /* rear external mic */
    + { 0x21, 0x03211420 }, /* front HP out */
    + { }
    + },
    + },
    + [ALC285_FIXUP_ASUS_G533Z_PINS] = {
    + .type = HDA_FIXUP_PINS,
    + .v.pins = (const struct hda_pintbl[]) {
    + { 0x14, 0x90170120 },
    + { }
    + },
    + .chained = true,
    + .chain_id = ALC294_FIXUP_ASUS_G513_PINS,
    },
    [ALC294_FIXUP_ASUS_COEF_1B] = {
    .type = HDA_FIXUP_VERBS,
    @@ -8118,6 +8138,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
    SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
    SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
    SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB),
    + SND_PCI_QUIRK(0x1028, 0x087d, "Dell Precision 5530", ALC289_FIXUP_DUAL_SPK),
    SND_PCI_QUIRK(0x1028, 0x08ad, "Dell WYSE AIO", ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE),
    SND_PCI_QUIRK(0x1028, 0x08ae, "Dell WYSE NB", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE),
    SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
    @@ -8229,10 +8250,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
    SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC),
    SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
    SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
    + SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK),
    + SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401),
    SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
    SND_PCI_QUIRK(0x1043, 0x1740, "ASUS UX430UA", ALC295_FIXUP_ASUS_DACS),
    SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK),
    - SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK),
    SND_PCI_QUIRK(0x1043, 0x1881, "ASUS Zephyrus S/M", ALC294_FIXUP_ASUS_GX502_PINS),
    SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC),
    SND_PCI_QUIRK(0x1043, 0x18f1, "Asus FX505DT", ALC256_FIXUP_ASUS_HEADSET_MIC),
    @@ -8247,14 +8269,16 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
    SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
    SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
    SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
    + SND_PCI_QUIRK(0x1043, 0x1c92, "ASUS ROG Strix G15", ALC285_FIXUP_ASUS_G533Z_PINS),
    SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
    + SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401),
    SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE),
    SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
    SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS),
    + SND_PCI_QUIRK(0x1043, 0x1e5e, "ASUS ROG Strix G513", ALC294_FIXUP_ASUS_G513_PINS),
    SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401),
    + SND_PCI_QUIRK(0x1043, 0x1c52, "ASUS Zephyrus G15 2022", ALC289_FIXUP_ASUS_GA401),
    SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401),
    - SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401),
    - SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401),
    SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
    SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
    SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC),
    @@ -8425,6 +8449,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
    SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
    SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
    SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS),
    + SND_PCI_QUIRK(0x19e5, 0x320f, "Huawei WRT-WX9 ", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
    SND_PCI_QUIRK(0x1b35, 0x1235, "CZC B20", ALC269_FIXUP_CZC_B20),
    SND_PCI_QUIRK(0x1b35, 0x1236, "CZC TMI", ALC269_FIXUP_CZC_TMI),
    SND_PCI_QUIRK(0x1b35, 0x1237, "CZC L101", ALC269_FIXUP_CZC_L101),
    diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
    index bfd3fe5eff31..04a89171327d 100644
    --- a/sound/pci/hda/patch_sigmatel.c
    +++ b/sound/pci/hda/patch_sigmatel.c
    @@ -209,6 +209,7 @@ struct sigmatel_spec {

    /* beep widgets */
    hda_nid_t anabeep_nid;
    + bool beep_power_on;

    /* SPDIF-out mux */
    const char * const *spdif_labels;
    @@ -4441,6 +4442,28 @@ static int stac_suspend(struct hda_codec *codec)
    stac_shutup(codec);
    return 0;
    }
    +
    +static int stac_check_power_status(struct hda_codec *codec, hda_nid_t nid)
    +{
    +#ifdef CONFIG_SND_HDA_INPUT_BEEP
    + struct sigmatel_spec *spec = codec->spec;
    +#endif
    + int ret = snd_hda_gen_check_power_status(codec, nid);
    +
    +#ifdef CONFIG_SND_HDA_INPUT_BEEP
    + if (nid == spec->gen.beep_nid && codec->beep) {
    + if (codec->beep->enabled != spec->beep_power_on) {
    + spec->beep_power_on = codec->beep->enabled;
    + if (spec->beep_power_on)
    + snd_hda_power_up_pm(codec);
    + else
    + snd_hda_power_down_pm(codec);
    + }
    + ret |= spec->beep_power_on;
    + }
    +#endif
    + return ret;
    +}
    #else
    #define stac_suspend NULL
    #endif /* CONFIG_PM */
    @@ -4453,6 +4476,7 @@ static const struct hda_codec_ops stac_patch_ops = {
    .unsol_event = snd_hda_jack_unsol_event,
    #ifdef CONFIG_PM
    .suspend = stac_suspend,
    + .check_power_status = stac_check_power_status,
    #endif
    .reboot_notify = stac_shutup,
    };
    diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c
    index c8ccfa2fff84..a95fe3fff1db 100644
    --- a/sound/soc/codecs/nau8824.c
    +++ b/sound/soc/codecs/nau8824.c
    @@ -1072,6 +1072,7 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream,
    struct snd_soc_component *component = dai->component;
    struct nau8824 *nau8824 = snd_soc_component_get_drvdata(component);
    unsigned int val_len = 0, osr, ctrl_val, bclk_fs, bclk_div;
    + int err = -EINVAL;

    nau8824_sema_acquire(nau8824, HZ);

    @@ -1088,7 +1089,7 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream,
    osr &= NAU8824_DAC_OVERSAMPLE_MASK;
    if (nau8824_clock_check(nau8824, substream->stream,
    nau8824->fs, osr))
    - return -EINVAL;
    + goto error;
    regmap_update_bits(nau8824->regmap, NAU8824_REG_CLK_DIVIDER,
    NAU8824_CLK_DAC_SRC_MASK,
    osr_dac_sel[osr].clk_src << NAU8824_CLK_DAC_SRC_SFT);
    @@ -1098,7 +1099,7 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream,
    osr &= NAU8824_ADC_SYNC_DOWN_MASK;
    if (nau8824_clock_check(nau8824, substream->stream,
    nau8824->fs, osr))
    - return -EINVAL;
    + goto error;
    regmap_update_bits(nau8824->regmap, NAU8824_REG_CLK_DIVIDER,
    NAU8824_CLK_ADC_SRC_MASK,
    osr_adc_sel[osr].clk_src << NAU8824_CLK_ADC_SRC_SFT);
    @@ -1119,7 +1120,7 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream,
    else if (bclk_fs <= 256)
    bclk_div = 0;
    else
    - return -EINVAL;
    + goto error;
    regmap_update_bits(nau8824->regmap,
    NAU8824_REG_PORT0_I2S_PCM_CTRL_2,
    NAU8824_I2S_LRC_DIV_MASK | NAU8824_I2S_BLK_DIV_MASK,
    @@ -1140,15 +1141,17 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream,
    val_len |= NAU8824_I2S_DL_32;
    break;
    default:
    - return -EINVAL;
    + goto error;
    }

    regmap_update_bits(nau8824->regmap, NAU8824_REG_PORT0_I2S_PCM_CTRL_1,
    NAU8824_I2S_DL_MASK, val_len);
    + err = 0;

    + error:
    nau8824_sema_release(nau8824);

    - return 0;
    + return err;
    }

    static int nau8824_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
    @@ -1157,8 +1160,6 @@ static int nau8824_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
    struct nau8824 *nau8824 = snd_soc_component_get_drvdata(component);
    unsigned int ctrl1_val = 0, ctrl2_val = 0;

    - nau8824_sema_acquire(nau8824, HZ);
    -
    switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
    case SND_SOC_DAIFMT_CBM_CFM:
    ctrl2_val |= NAU8824_I2S_MS_MASTER;
    @@ -1200,6 +1201,8 @@ static int nau8824_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
    return -EINVAL;
    }

    + nau8824_sema_acquire(nau8824, HZ);
    +
    regmap_update_bits(nau8824->regmap, NAU8824_REG_PORT0_I2S_PCM_CTRL_1,
    NAU8824_I2S_DF_MASK | NAU8824_I2S_BP_MASK |
    NAU8824_I2S_PCMB_EN, ctrl1_val);
    diff --git a/tools/perf/util/genelf.c b/tools/perf/util/genelf.c
    index 17b74aba8b9a..69744fd5db39 100644
    --- a/tools/perf/util/genelf.c
    +++ b/tools/perf/util/genelf.c
    @@ -256,6 +256,7 @@ jit_write_elf(int fd, uint64_t load_addr, const char *sym,
    Elf_Data *d;
    Elf_Scn *scn;
    Elf_Ehdr *ehdr;
    + Elf_Phdr *phdr;
    Elf_Shdr *shdr;
    uint64_t eh_frame_base_offset;
    char *strsym = NULL;
    @@ -290,6 +291,19 @@ jit_write_elf(int fd, uint64_t load_addr, const char *sym,
    ehdr->e_version = EV_CURRENT;
    ehdr->e_shstrndx= unwinding ? 4 : 2; /* shdr index for section name */

    + /*
    + * setup program header
    + */
    + phdr = elf_newphdr(e, 1);
    + phdr[0].p_type = PT_LOAD;
    + phdr[0].p_offset = 0;
    + phdr[0].p_vaddr = 0;
    + phdr[0].p_paddr = 0;
    + phdr[0].p_filesz = csize;
    + phdr[0].p_memsz = csize;
    + phdr[0].p_flags = PF_X | PF_R;
    + phdr[0].p_align = 8;
    +
    /*
    * setup text section
    */
    diff --git a/tools/perf/util/genelf.h b/tools/perf/util/genelf.h
    index d4137559be05..ac638945b4cb 100644
    --- a/tools/perf/util/genelf.h
    +++ b/tools/perf/util/genelf.h
    @@ -50,8 +50,10 @@ int jit_add_debug_info(Elf *e, uint64_t code_addr, void *debug, int nr_debug_ent

    #if GEN_ELF_CLASS == ELFCLASS64
    #define elf_newehdr elf64_newehdr
    +#define elf_newphdr elf64_newphdr
    #define elf_getshdr elf64_getshdr
    #define Elf_Ehdr Elf64_Ehdr
    +#define Elf_Phdr Elf64_Phdr
    #define Elf_Shdr Elf64_Shdr
    #define Elf_Sym Elf64_Sym
    #define ELF_ST_TYPE(a) ELF64_ST_TYPE(a)
    @@ -59,8 +61,10 @@ int jit_add_debug_info(Elf *e, uint64_t code_addr, void *debug, int nr_debug_ent
    #define ELF_ST_VIS(a) ELF64_ST_VISIBILITY(a)
    #else
    #define elf_newehdr elf32_newehdr
    +#define elf_newphdr elf32_newphdr
    #define elf_getshdr elf32_getshdr
    #define Elf_Ehdr Elf32_Ehdr
    +#define Elf_Phdr Elf32_Phdr
    #define Elf_Shdr Elf32_Shdr
    #define Elf_Sym Elf32_Sym
    #define ELF_ST_TYPE(a) ELF32_ST_TYPE(a)
    diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
    index a04a7dfb8ec0..f15258fbe9db 100644
    --- a/tools/perf/util/symbol-elf.c
    +++ b/tools/perf/util/symbol-elf.c
    @@ -1912,8 +1912,8 @@ static int kcore_copy__compare_file(const char *from_dir, const char *to_dir,
    * unusual. One significant peculiarity is that the mapping (start -> pgoff)
    * is not the same for the kernel map and the modules map. That happens because
    * the data is copied adjacently whereas the original kcore has gaps. Finally,
    - * kallsyms and modules files are compared with their copies to check that
    - * modules have not been loaded or unloaded while the copies were taking place.
    + * kallsyms file is compared with its copy to check that modules have not been
    + * loaded or unloaded while the copies were taking place.
    *
    * Return: %0 on success, %-1 on failure.
    */
    @@ -1976,9 +1976,6 @@ int kcore_copy(const char *from_dir, const char *to_dir)
    goto out_extract_close;
    }

    - if (kcore_copy__compare_file(from_dir, to_dir, "modules"))
    - goto out_extract_close;
    -
    if (kcore_copy__compare_file(from_dir, to_dir, "kallsyms"))
    goto out_extract_close;

    \
     
     \ /
      Last update: 2022-09-28 12:51    [W:8.635 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site