--- /dev/null
+From 739d0959fbed23838a96c48fbce01dd2f6fb2c5f Mon Sep 17 00:00:00 2001
+From: Luke D Jones <luke@ljones.dev>
+Date: Sat, 7 Aug 2021 14:58:05 +1200
+Subject: ALSA: hda: Add quirk for ASUS Flow x13
+
+From: Luke D Jones <luke@ljones.dev>
+
+commit 739d0959fbed23838a96c48fbce01dd2f6fb2c5f upstream.
+
+The ASUS GV301QH sound appears to work well with the quirk for
+ALC294_FIXUP_ASUS_DUAL_SPK.
+
+Signed-off-by: Luke D Jones <luke@ljones.dev>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210807025805.27321-1-luke@ljones.dev
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8390,6 +8390,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x1740, "ASUS UX430UA", ALC295_FIXUP_ASUS_DACS),
+ SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK),
++ SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK),
+ SND_PCI_QUIRK(0x1043, 0x1881, "ASUS Zephyrus S/M", ALC294_FIXUP_ASUS_GX502_PINS),
+ SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x18f1, "Asus FX505DT", ALC256_FIXUP_ASUS_HEADSET_MIC),
--- /dev/null
+From d07149aba2ef423eae94a9cc2a6365d0cdf6fd51 Mon Sep 17 00:00:00 2001
+From: Jeremy Szu <jeremy.szu@canonical.com>
+Date: Tue, 10 Aug 2021 18:08:45 +0800
+Subject: ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 650 G8 Notebook PC
+
+From: Jeremy Szu <jeremy.szu@canonical.com>
+
+commit d07149aba2ef423eae94a9cc2a6365d0cdf6fd51 upstream.
+
+The HP ProBook 650 G8 Notebook PC is using ALC236 codec which is
+using 0x02 to control mute LED and 0x01 to control micmute LED.
+Therefore, add a quirk to make it works.
+
+Signed-off-by: Jeremy Szu <jeremy.szu@canonical.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210810100846.65844-1-jeremy.szu@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8357,6 +8357,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x87f4, "HP", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x87f5, "HP", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x87f7, "HP Spectre x360 14", ALC245_FIXUP_HP_X360_AMP),
++ SND_PCI_QUIRK(0x103c, 0x8805, "HP ProBook 650 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x880d, "HP EliteBook 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8846, "HP EliteBook 850 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8847, "HP EliteBook x360 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
--- /dev/null
+From dc0dc8a73e8e4dc33fba93dfe23356cc5a500c57 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sun, 8 Aug 2021 09:01:16 +0200
+Subject: ALSA: pcm: Fix mmap breakage without explicit buffer setup
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit dc0dc8a73e8e4dc33fba93dfe23356cc5a500c57 upstream.
+
+The recent fix c4824ae7db41 ("ALSA: pcm: Fix mmap capability check")
+restricts the mmap capability only to the drivers that properly set up
+the buffers, but it caused a regression for a few drivers that manage
+the buffer on its own way.
+
+For those with UNKNOWN buffer type (i.e. the uninitialized / unused
+substream->dma_buffer), just assume that the driver handles the mmap
+properly and blindly trust the hardware info bit.
+
+Fixes: c4824ae7db41 ("ALSA: pcm: Fix mmap capability check")
+Reported-and-tested-by: Jeff Woods <jwoods@fnordco.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/s5him0gpghv.wl-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/pcm_native.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -251,7 +251,10 @@ static bool hw_support_mmap(struct snd_p
+
+ switch (substream->dma_buffer.dev.type) {
+ case SNDRV_DMA_TYPE_UNKNOWN:
+- return false;
++ /* we can't know the device, so just assume that the driver does
++ * everything right
++ */
++ return true;
+ case SNDRV_DMA_TYPE_CONTINUOUS:
+ case SNDRV_DMA_TYPE_VMALLOC:
+ return true;
--- /dev/null
+From foo@baz Fri Aug 13 10:46:26 AM CEST 2021
+From: Adam Ford <aford173@gmail.com>
+Date: Thu, 13 May 2021 06:46:15 -0500
+Subject: arm64: dts: renesas: beacon: Fix USB extal reference
+
+From: Adam Ford <aford173@gmail.com>
+
+commit 56bc54496f5d6bc638127bfc9df3742cbf0039e7 upstream
+
+The USB extal clock reference isn't associated to a crystal, it's
+associated to a programmable clock, so remove the extal reference,
+add the usb2_clksel. Since usb_extal is referenced by the versaclock,
+reference it here so the usb2_clksel can get the proper clock speed
+of 50MHz.
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Link: https://lore.kernel.org/r/20210513114617.30191-1-aford173@gmail.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi
++++ b/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi
+@@ -295,8 +295,10 @@
+ status = "okay";
+ };
+
+-&usb_extal_clk {
+- clock-frequency = <50000000>;
++&usb2_clksel {
++ clocks = <&cpg CPG_MOD 703>, <&cpg CPG_MOD 704>,
++ <&versaclock5 3>, <&usb3s0_clk>;
++ status = "okay";
+ };
+
+ &usb3s0_clk {
--- /dev/null
+From foo@baz Fri Aug 13 10:46:26 AM CEST 2021
+From: Adam Ford <aford173@gmail.com>
+Date: Thu, 13 May 2021 06:46:16 -0500
+Subject: arm64: dts: renesas: beacon: Fix USB ref clock references
+
+From: Adam Ford <aford173@gmail.com>
+
+commit ebc666f39ff67a01e748c34d670ddf05a9e45220 upstream
+
+The RZ/G2 boards expect there to be an external clock reference for
+USB2 EHCI controllers. For the Beacon boards, this reference clock
+is controlled by a programmable versaclock. Because the RZ/G2
+family has a special clock driver when using an external clock,
+the third clock reference in the EHCI node needs to point to this
+special clock, called usb2_clksel.
+
+Since the usb2_clksel does not keep the usb_extal clock enabled,
+the 4th clock entry for the EHCI nodes needs to reference it to
+keep the clock running and make USB functional.
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Link: https://lore.kernel.org/r/20210513114617.30191-2-aford173@gmail.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi
++++ b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi
+@@ -271,12 +271,12 @@
+ &ehci0 {
+ dr_mode = "otg";
+ status = "okay";
+- clocks = <&cpg CPG_MOD 703>, <&cpg CPG_MOD 704>;
++ clocks = <&cpg CPG_MOD 703>, <&cpg CPG_MOD 704>, <&usb2_clksel>, <&versaclock5 3>;
+ };
+
+ &ehci1 {
+ status = "okay";
+- clocks = <&cpg CPG_MOD 703>, <&cpg CPG_MOD 704>;
++ clocks = <&cpg CPG_MOD 703>, <&cpg CPG_MOD 704>, <&usb2_clksel>, <&versaclock5 3>;
+ };
+
+ &hdmi0 {
--- /dev/null
+From foo@baz Fri Aug 13 10:46:26 AM CEST 2021
+From: Adam Ford <aford173@gmail.com>
+Date: Mon, 28 Dec 2020 14:22:21 -0600
+Subject: arm64: dts: renesas: rzg2: Add usb2_clksel to RZ/G2 M/N/H
+
+From: Adam Ford <aford173@gmail.com>
+
+commit e1076ce07b7736aed269c5d8154f2442970d9137 upstream
+
+Per the reference manual for the RZ/G Series, 2nd Generation,
+the RZ/G2M, RZ/G2N, and RZ/G2H have a bit that can be set to
+choose between a crystal oscillator and an external oscillator.
+
+Because only boards that need this should enable it, it's marked
+as disabled by default for backwards compatibility with existing
+boards.
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Link: https://lore.kernel.org/r/20201228202221.2327468-2-aford173@gmail.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/renesas/r8a774a1.dtsi | 15 +++++++++++++++
+ arch/arm64/boot/dts/renesas/r8a774b1.dtsi | 15 +++++++++++++++
+ arch/arm64/boot/dts/renesas/r8a774e1.dtsi | 15 +++++++++++++++
+ 3 files changed, 45 insertions(+)
+
+--- a/arch/arm64/boot/dts/renesas/r8a774a1.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a774a1.dtsi
+@@ -836,6 +836,21 @@
+ status = "disabled";
+ };
+
++ usb2_clksel: clock-controller@e6590630 {
++ compatible = "renesas,r8a774a1-rcar-usb2-clock-sel",
++ "renesas,rcar-gen3-usb2-clock-sel";
++ reg = <0 0xe6590630 0 0x02>;
++ clocks = <&cpg CPG_MOD 703>, <&cpg CPG_MOD 704>,
++ <&usb_extal_clk>, <&usb3s0_clk>;
++ clock-names = "ehci_ohci", "hs-usb-if",
++ "usb_extal", "usb_xtal";
++ #clock-cells = <0>;
++ power-domains = <&sysc R8A774A1_PD_ALWAYS_ON>;
++ resets = <&cpg 703>, <&cpg 704>;
++ reset-names = "ehci_ohci", "hs-usb-if";
++ status = "disabled";
++ };
++
+ usb_dmac0: dma-controller@e65a0000 {
+ compatible = "renesas,r8a774a1-usb-dmac",
+ "renesas,usb-dmac";
+--- a/arch/arm64/boot/dts/renesas/r8a774b1.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a774b1.dtsi
+@@ -709,6 +709,21 @@
+ status = "disabled";
+ };
+
++ usb2_clksel: clock-controller@e6590630 {
++ compatible = "renesas,r8a774b1-rcar-usb2-clock-sel",
++ "renesas,rcar-gen3-usb2-clock-sel";
++ reg = <0 0xe6590630 0 0x02>;
++ clocks = <&cpg CPG_MOD 703>, <&cpg CPG_MOD 704>,
++ <&usb_extal_clk>, <&usb3s0_clk>;
++ clock-names = "ehci_ohci", "hs-usb-if",
++ "usb_extal", "usb_xtal";
++ #clock-cells = <0>;
++ power-domains = <&sysc R8A774B1_PD_ALWAYS_ON>;
++ resets = <&cpg 703>, <&cpg 704>;
++ reset-names = "ehci_ohci", "hs-usb-if";
++ status = "disabled";
++ };
++
+ usb_dmac0: dma-controller@e65a0000 {
+ compatible = "renesas,r8a774b1-usb-dmac",
+ "renesas,usb-dmac";
+--- a/arch/arm64/boot/dts/renesas/r8a774e1.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a774e1.dtsi
+@@ -890,6 +890,21 @@
+ status = "disabled";
+ };
+
++ usb2_clksel: clock-controller@e6590630 {
++ compatible = "renesas,r8a774e1-rcar-usb2-clock-sel",
++ "renesas,rcar-gen3-usb2-clock-sel";
++ reg = <0 0xe6590630 0 0x02>;
++ clocks = <&cpg CPG_MOD 703>, <&cpg CPG_MOD 704>,
++ <&usb_extal_clk>, <&usb3s0_clk>;
++ clock-names = "ehci_ohci", "hs-usb-if",
++ "usb_extal", "usb_xtal";
++ #clock-cells = <0>;
++ power-domains = <&sysc R8A774E1_PD_ALWAYS_ON>;
++ resets = <&cpg 703>, <&cpg 704>;
++ reset-names = "ehci_ohci", "hs-usb-if";
++ status = "disabled";
++ };
++
+ usb_dmac0: dma-controller@e65a0000 {
+ compatible = "renesas,r8a774e1-usb-dmac",
+ "renesas,usb-dmac";
--- /dev/null
+From 71330842ff93ae67a066c1fa68d75672527312fa Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Mon, 9 Aug 2021 21:45:32 +0200
+Subject: bpf: Add _kernel suffix to internal lockdown_bpf_read
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+commit 71330842ff93ae67a066c1fa68d75672527312fa upstream.
+
+Rename LOCKDOWN_BPF_READ into LOCKDOWN_BPF_READ_KERNEL so we have naming
+more consistent with a LOCKDOWN_BPF_WRITE_USER option that we are adding.
+
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/security.h | 2 +-
+ kernel/bpf/helpers.c | 4 ++--
+ kernel/trace/bpf_trace.c | 8 ++++----
+ security/security.c | 2 +-
+ 4 files changed, 8 insertions(+), 8 deletions(-)
+
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -123,7 +123,7 @@ enum lockdown_reason {
+ LOCKDOWN_INTEGRITY_MAX,
+ LOCKDOWN_KCORE,
+ LOCKDOWN_KPROBES,
+- LOCKDOWN_BPF_READ,
++ LOCKDOWN_BPF_READ_KERNEL,
+ LOCKDOWN_PERF,
+ LOCKDOWN_TRACEFS,
+ LOCKDOWN_XMON_RW,
+--- a/kernel/bpf/helpers.c
++++ b/kernel/bpf/helpers.c
+@@ -729,12 +729,12 @@ bpf_base_func_proto(enum bpf_func_id fun
+ case BPF_FUNC_probe_read_user:
+ return &bpf_probe_read_user_proto;
+ case BPF_FUNC_probe_read_kernel:
+- return security_locked_down(LOCKDOWN_BPF_READ) < 0 ?
++ return security_locked_down(LOCKDOWN_BPF_READ_KERNEL) < 0 ?
+ NULL : &bpf_probe_read_kernel_proto;
+ case BPF_FUNC_probe_read_user_str:
+ return &bpf_probe_read_user_str_proto;
+ case BPF_FUNC_probe_read_kernel_str:
+- return security_locked_down(LOCKDOWN_BPF_READ) < 0 ?
++ return security_locked_down(LOCKDOWN_BPF_READ_KERNEL) < 0 ?
+ NULL : &bpf_probe_read_kernel_str_proto;
+ case BPF_FUNC_snprintf_btf:
+ return &bpf_snprintf_btf_proto;
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -1281,19 +1281,19 @@ bpf_tracing_func_proto(enum bpf_func_id
+ case BPF_FUNC_probe_read_user:
+ return &bpf_probe_read_user_proto;
+ case BPF_FUNC_probe_read_kernel:
+- return security_locked_down(LOCKDOWN_BPF_READ) < 0 ?
++ return security_locked_down(LOCKDOWN_BPF_READ_KERNEL) < 0 ?
+ NULL : &bpf_probe_read_kernel_proto;
+ case BPF_FUNC_probe_read_user_str:
+ return &bpf_probe_read_user_str_proto;
+ case BPF_FUNC_probe_read_kernel_str:
+- return security_locked_down(LOCKDOWN_BPF_READ) < 0 ?
++ return security_locked_down(LOCKDOWN_BPF_READ_KERNEL) < 0 ?
+ NULL : &bpf_probe_read_kernel_str_proto;
+ #ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
+ case BPF_FUNC_probe_read:
+- return security_locked_down(LOCKDOWN_BPF_READ) < 0 ?
++ return security_locked_down(LOCKDOWN_BPF_READ_KERNEL) < 0 ?
+ NULL : &bpf_probe_read_compat_proto;
+ case BPF_FUNC_probe_read_str:
+- return security_locked_down(LOCKDOWN_BPF_READ) < 0 ?
++ return security_locked_down(LOCKDOWN_BPF_READ_KERNEL) < 0 ?
+ NULL : &bpf_probe_read_compat_str_proto;
+ #endif
+ #ifdef CONFIG_CGROUPS
+--- a/security/security.c
++++ b/security/security.c
+@@ -61,7 +61,7 @@ const char *const lockdown_reasons[LOCKD
+ [LOCKDOWN_INTEGRITY_MAX] = "integrity",
+ [LOCKDOWN_KCORE] = "/proc/kcore access",
+ [LOCKDOWN_KPROBES] = "use of kprobes",
+- [LOCKDOWN_BPF_READ] = "use of bpf to read kernel RAM",
++ [LOCKDOWN_BPF_READ_KERNEL] = "use of bpf to read kernel RAM",
+ [LOCKDOWN_PERF] = "unsafe use of perf",
+ [LOCKDOWN_TRACEFS] = "use of tracefs",
+ [LOCKDOWN_XMON_RW] = "xmon read and write access",
--- /dev/null
+From 51e1bb9eeaf7868db56e58f47848e364ab4c4129 Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Mon, 9 Aug 2021 12:43:17 +0200
+Subject: bpf: Add lockdown check for probe_write_user helper
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+commit 51e1bb9eeaf7868db56e58f47848e364ab4c4129 upstream.
+
+Back then, commit 96ae52279594 ("bpf: Add bpf_probe_write_user BPF helper
+to be called in tracers") added the bpf_probe_write_user() helper in order
+to allow to override user space memory. Its original goal was to have a
+facility to "debug, divert, and manipulate execution of semi-cooperative
+processes" under CAP_SYS_ADMIN. Write to kernel was explicitly disallowed
+since it would otherwise tamper with its integrity.
+
+One use case was shown in cf9b1199de27 ("samples/bpf: Add test/example of
+using bpf_probe_write_user bpf helper") where the program DNATs traffic
+at the time of connect(2) syscall, meaning, it rewrites the arguments to
+a syscall while they're still in userspace, and before the syscall has a
+chance to copy the argument into kernel space. These days we have better
+mechanisms in BPF for achieving the same (e.g. for load-balancers), but
+without having to write to userspace memory.
+
+Of course the bpf_probe_write_user() helper can also be used to abuse
+many other things for both good or bad purpose. Outside of BPF, there is
+a similar mechanism for ptrace(2) such as PTRACE_PEEK{TEXT,DATA} and
+PTRACE_POKE{TEXT,DATA}, but would likely require some more effort.
+Commit 96ae52279594 explicitly dedicated the helper for experimentation
+purpose only. Thus, move the helper's availability behind a newly added
+LOCKDOWN_BPF_WRITE_USER lockdown knob so that the helper is disabled under
+the "integrity" mode. More fine-grained control can be implemented also
+from LSM side with this change.
+
+Fixes: 96ae52279594 ("bpf: Add bpf_probe_write_user BPF helper to be called in tracers")
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/security.h | 1 +
+ kernel/trace/bpf_trace.c | 5 +++--
+ security/security.c | 1 +
+ 3 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -120,6 +120,7 @@ enum lockdown_reason {
+ LOCKDOWN_MMIOTRACE,
+ LOCKDOWN_DEBUGFS,
+ LOCKDOWN_XMON_WR,
++ LOCKDOWN_BPF_WRITE_USER,
+ LOCKDOWN_INTEGRITY_MAX,
+ LOCKDOWN_KCORE,
+ LOCKDOWN_KPROBES,
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -1272,12 +1272,13 @@ bpf_tracing_func_proto(enum bpf_func_id
+ return &bpf_get_numa_node_id_proto;
+ case BPF_FUNC_perf_event_read:
+ return &bpf_perf_event_read_proto;
+- case BPF_FUNC_probe_write_user:
+- return bpf_get_probe_write_proto();
+ case BPF_FUNC_current_task_under_cgroup:
+ return &bpf_current_task_under_cgroup_proto;
+ case BPF_FUNC_get_prandom_u32:
+ return &bpf_get_prandom_u32_proto;
++ case BPF_FUNC_probe_write_user:
++ return security_locked_down(LOCKDOWN_BPF_WRITE_USER) < 0 ?
++ NULL : bpf_get_probe_write_proto();
+ case BPF_FUNC_probe_read_user:
+ return &bpf_probe_read_user_proto;
+ case BPF_FUNC_probe_read_kernel:
+--- a/security/security.c
++++ b/security/security.c
+@@ -58,6 +58,7 @@ const char *const lockdown_reasons[LOCKD
+ [LOCKDOWN_MMIOTRACE] = "unsafe mmio",
+ [LOCKDOWN_DEBUGFS] = "debugfs access",
+ [LOCKDOWN_XMON_WR] = "xmon write access",
++ [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM",
+ [LOCKDOWN_INTEGRITY_MAX] = "integrity",
+ [LOCKDOWN_KCORE] = "/proc/kcore access",
+ [LOCKDOWN_KPROBES] = "use of kprobes",
--- /dev/null
+From rppt@kernel.org Fri Aug 13 10:41:57 2021
+From: Mike Rapoport <rppt@kernel.org>
+Date: Wed, 11 Aug 2021 16:41:39 +0300
+Subject: mm: make zone_to_nid() and zone_set_nid() available for DISCONTIGMEM
+To: stable@vger.kernel.org
+Cc: Geert Uytterhoeven <geert@linux-m68k.org>, Finn Thain <fthain@linux-m68k.org>, Mikael Pettersson <mikpelinux@gmail.com>, Mike Rapoport <rppt@kernel.org>, Mike Rapoport <rppt@linux.ibm.com>, linux-kernel@vger.kernel.org, linux-m68k@lists.linux-m68k.org
+Message-ID: <20210811134139.5451-1-rppt@kernel.org>
+
+From: Mike Rapoport <rppt@linux.ibm.com>
+
+Since the commit ce6ee46e0f39 ("mm/page_alloc: fix memory map
+initialization for descending nodes") initialization of the memory map
+relies on availability of zone_to_nid() and zone_set_nid methods to link
+struct page to a node.
+
+But in 5.10 zone_to_nid() is only defined for NUMA, but not for
+DISCONTIGMEM which causes crashes on m68k systems with two memory banks.
+
+For instance on ARAnyM with both ST-RAM and FastRAM atari_defconfig build
+produces the following crash:
+
+Unable to handle kernel access at virtual address (ptrval)
+Oops: 00000000
+Modules linked in:
+PC: [<0005fbbc>] bpf_prog_alloc_no_stats+0x5c/0xba
+SR: 2200 SP: (ptrval) a2: 016daa90
+d0: 0000000c d1: 00000200 d2: 00000001 d3: 00000cc0
+d4: 016d1f80 d5: 00034da6 a0: 305c2800 a1: 305c2a00
+Process swapper (pid: 1, task=(ptrval))
+Frame format=7 eff addr=31800000 ssw=0445 faddr=31800000
+wb 1 stat/addr/data: 0000 00000000 00000000
+wb 2 stat/addr/data: 0000 00000000 00000000
+wb 3 stat/addr/data: 00c5 31800000 00000001
+push data: 00000000 00000000 00000000 00000000
+Stack from 3058fec8:
+ 00000dc0 00000000 004addc2 3058ff16 0005fc34 00000238 00000000 00000210
+ 004addc2 3058ff16 00281ae0 00000238 00000000 00000000 004addc2 004bc7ec
+ 004aea9e 0048b0c0 3058ff16 00460042 004ba4d2 3058ff8c 004ade6a 0000007e
+ 0000210e 0000007e 00000002 016d1f80 00034da6 000020b4 00000000 004b4764
+ 004bc7ec 00000000 004b4760 004bc7c0 004b4744 001e4cb2 00010001 016d1fe5
+ 016d1ff0 004994d2 003e1589 016d1f80 00412b8c 0000007e 00000001 00000001
+Call Trace: [<004addc2>] sock_init+0x0/0xaa
+ [<0005fc34>] bpf_prog_alloc+0x1a/0x66
+ [<004addc2>] sock_init+0x0/0xaa
+ [<00281ae0>] bpf_prog_create+0x2e/0x7c
+ [<004addc2>] sock_init+0x0/0xaa
+ [<004aea9e>] ptp_classifier_init+0x22/0x44
+ [<004ade6a>] sock_init+0xa8/0xaa
+ [<0000210e>] do_one_initcall+0x5a/0x150
+ [<00034da6>] parse_args+0x0/0x208
+ [<000020b4>] do_one_initcall+0x0/0x150
+ [<001e4cb2>] strcpy+0x0/0x1c
+ [<00010001>] stwotoxd+0x5/0x1c
+ [<004994d2>] kernel_init_freeable+0x154/0x1a6
+ [<001e4cb2>] strcpy+0x0/0x1c
+ [<0049951a>] kernel_init_freeable+0x19c/0x1a6
+ [<004addc2>] sock_init+0x0/0xaa
+ [<00321510>] kernel_init+0x0/0xd8
+ [<00321518>] kernel_init+0x8/0xd8
+ [<00321510>] kernel_init+0x0/0xd8
+ [<00002890>] ret_from_kernel_thread+0xc/0x14
+
+Code: 204b 200b 4cdf 180c 4e75 700c e0aa 3682 <2748> 001c 214b 0140 022b
+ffbf 0002 206b 001c 2008 0680 0000 0108 2140 0108 2140
+Disabling lock debugging due to kernel taint
+Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
+
+Using CONFIG_NEED_MULTIPLE_NODES rather than CONFIG_NUMA to guard
+definitions of zone_to_nid() and zone_set_nid() fixes the issue.
+
+Reported-by: Mikael Pettersson <mikpelinux@gmail.com>
+Fixes: ce6ee46e0f39 ("mm/page_alloc: fix memory map initialization for descending nodes")
+Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
+Tested-by: Mikael Pettersson <mikpelinux@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/mmzone.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -445,7 +445,7 @@ struct zone {
+ */
+ long lowmem_reserve[MAX_NR_ZONES];
+
+-#ifdef CONFIG_NUMA
++#ifdef CONFIG_NEED_MULTIPLE_NODES
+ int node;
+ #endif
+ struct pglist_data *zone_pgdat;
+@@ -896,7 +896,7 @@ static inline bool populated_zone(struct
+ return zone->present_pages;
+ }
+
+-#ifdef CONFIG_NUMA
++#ifdef CONFIG_NEED_MULTIPLE_NODES
+ static inline int zone_to_nid(struct zone *zone)
+ {
+ return zone->node;
--- /dev/null
+From 427215d85e8d1476da1a86b8d67aceb485eb3631 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@redhat.com>
+Date: Mon, 9 Aug 2021 10:19:47 +0200
+Subject: ovl: prevent private clone if bind mount is not allowed
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+commit 427215d85e8d1476da1a86b8d67aceb485eb3631 upstream.
+
+Add the following checks from __do_loopback() to clone_private_mount() as
+well:
+
+ - verify that the mount is in the current namespace
+
+ - verify that there are no locked children
+
+Reported-by: Alois Wohlschlager <alois1@gmx-topmail.de>
+Fixes: c771d683a62e ("vfs: introduce clone_private_mount()")
+Cc: <stable@vger.kernel.org> # v3.18
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/namespace.c | 42 ++++++++++++++++++++++++++++--------------
+ 1 file changed, 28 insertions(+), 14 deletions(-)
+
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1919,6 +1919,20 @@ void drop_collected_mounts(struct vfsmou
+ namespace_unlock();
+ }
+
++static bool has_locked_children(struct mount *mnt, struct dentry *dentry)
++{
++ struct mount *child;
++
++ list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
++ if (!is_subdir(child->mnt_mountpoint, dentry))
++ continue;
++
++ if (child->mnt.mnt_flags & MNT_LOCKED)
++ return true;
++ }
++ return false;
++}
++
+ /**
+ * clone_private_mount - create a private clone of a path
+ *
+@@ -1933,10 +1947,19 @@ struct vfsmount *clone_private_mount(con
+ struct mount *old_mnt = real_mount(path->mnt);
+ struct mount *new_mnt;
+
++ down_read(&namespace_sem);
+ if (IS_MNT_UNBINDABLE(old_mnt))
+- return ERR_PTR(-EINVAL);
++ goto invalid;
++
++ if (!check_mnt(old_mnt))
++ goto invalid;
++
++ if (has_locked_children(old_mnt, path->dentry))
++ goto invalid;
+
+ new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE);
++ up_read(&namespace_sem);
++
+ if (IS_ERR(new_mnt))
+ return ERR_CAST(new_mnt);
+
+@@ -1944,6 +1967,10 @@ struct vfsmount *clone_private_mount(con
+ new_mnt->mnt_ns = MNT_NS_INTERNAL;
+
+ return &new_mnt->mnt;
++
++invalid:
++ up_read(&namespace_sem);
++ return ERR_PTR(-EINVAL);
+ }
+ EXPORT_SYMBOL_GPL(clone_private_mount);
+
+@@ -2295,19 +2322,6 @@ static int do_change_type(struct path *p
+ return err;
+ }
+
+-static bool has_locked_children(struct mount *mnt, struct dentry *dentry)
+-{
+- struct mount *child;
+- list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
+- if (!is_subdir(child->mnt_mountpoint, dentry))
+- continue;
+-
+- if (child->mnt.mnt_flags & MNT_LOCKED)
+- return true;
+- }
+- return false;
+-}
+-
+ static struct mount *__do_loopback(struct path *old_path, int recurse)
+ {
+ struct mount *mnt = ERR_PTR(-EINVAL), *old = real_mount(old_path->mnt);
--- /dev/null
+From 3125f26c514826077f2a4490b75e9b1c7a644c42 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Sat, 7 Aug 2021 18:00:50 +0200
+Subject: ppp: Fix generating ppp unit id when ifname is not specified
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+commit 3125f26c514826077f2a4490b75e9b1c7a644c42 upstream.
+
+When registering new ppp interface via PPPIOCNEWUNIT ioctl then kernel has
+to choose interface name as this ioctl API does not support specifying it.
+
+Kernel in this case register new interface with name "ppp<id>" where <id>
+is the ppp unit id, which can be obtained via PPPIOCGUNIT ioctl. This
+applies also in the case when registering new ppp interface via rtnl
+without supplying IFLA_IFNAME.
+
+PPPIOCNEWUNIT ioctl allows to specify own ppp unit id which will kernel
+assign to ppp interface, in case this ppp id is not already used by other
+ppp interface.
+
+In case user does not specify ppp unit id then kernel choose the first free
+ppp unit id. This applies also for case when creating ppp interface via
+rtnl method as it does not provide a way for specifying own ppp unit id.
+
+If some network interface (does not have to be ppp) has name "ppp<id>"
+with this first free ppp id then PPPIOCNEWUNIT ioctl or rtnl call fails.
+
+And registering new ppp interface is not possible anymore, until interface
+which holds conflicting name is renamed. Or when using rtnl method with
+custom interface name in IFLA_IFNAME.
+
+As list of allocated / used ppp unit ids is not possible to retrieve from
+kernel to userspace, userspace has no idea what happens nor which interface
+is doing this conflict.
+
+So change the algorithm how ppp unit id is generated. And choose the first
+number which is not neither used as ppp unit id nor in some network
+interface with pattern "ppp<id>".
+
+This issue can be simply reproduced by following pppd call when there is no
+ppp interface registered and also no interface with name pattern "ppp<id>":
+
+ pppd ifname ppp1 +ipv6 noip noauth nolock local nodetach pty "pppd +ipv6 noip noauth nolock local nodetach notty"
+
+Or by creating the one ppp interface (which gets assigned ppp unit id 0),
+renaming it to "ppp1" and then trying to create a new ppp interface (which
+will always fails as next free ppp unit id is 1, but network interface with
+name "ppp1" exists).
+
+This patch fixes above described issue by generating new and new ppp unit
+id until some non-conflicting id with network interfaces is generated.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ppp/ppp_generic.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -283,7 +283,7 @@ static struct channel *ppp_find_channel(
+ static int ppp_connect_channel(struct channel *pch, int unit);
+ static int ppp_disconnect_channel(struct channel *pch);
+ static void ppp_destroy_channel(struct channel *pch);
+-static int unit_get(struct idr *p, void *ptr);
++static int unit_get(struct idr *p, void *ptr, int min);
+ static int unit_set(struct idr *p, void *ptr, int n);
+ static void unit_put(struct idr *p, int n);
+ static void *unit_find(struct idr *p, int n);
+@@ -1045,9 +1045,20 @@ static int ppp_unit_register(struct ppp
+ mutex_lock(&pn->all_ppp_mutex);
+
+ if (unit < 0) {
+- ret = unit_get(&pn->units_idr, ppp);
++ ret = unit_get(&pn->units_idr, ppp, 0);
+ if (ret < 0)
+ goto err;
++ if (!ifname_is_set) {
++ while (1) {
++ snprintf(ppp->dev->name, IFNAMSIZ, "ppp%i", ret);
++ if (!__dev_get_by_name(ppp->ppp_net, ppp->dev->name))
++ break;
++ unit_put(&pn->units_idr, ret);
++ ret = unit_get(&pn->units_idr, ppp, ret + 1);
++ if (ret < 0)
++ goto err;
++ }
++ }
+ } else {
+ /* Caller asked for a specific unit number. Fail with -EEXIST
+ * if unavailable. For backward compatibility, return -EEXIST
+@@ -3378,9 +3389,9 @@ static int unit_set(struct idr *p, void
+ }
+
+ /* get new free unit number and associate pointer with it */
+-static int unit_get(struct idr *p, void *ptr)
++static int unit_get(struct idr *p, void *ptr, int min)
+ {
+- return idr_alloc(p, ptr, 0, 0, GFP_KERNEL);
++ return idr_alloc(p, ptr, min, 0, GFP_KERNEL);
+ }
+
+ /* put unit number back to a pool */
--- /dev/null
+From reinette.chatre@intel.com Fri Aug 13 10:41:08 2021
+From: Reinette Chatre <reinette.chatre@intel.com>
+Date: Wed, 11 Aug 2021 16:54:21 -0700
+Subject: Revert "selftests/resctrl: Use resctrl/info for feature detection"
+To: stable@vger.kernel.org
+Cc: fenghua.yu@intel.com, skhan@linuxfoundation.org, sashal@kernel.org, gregkh@linuxfoundation.org, xiaochen.shen@intel.com, tony.luck@intel.com, Reinette Chatre <reinette.chatre@intel.com>
+Message-ID: <dde8f92f6ea1c12b3d0f1c1d83a195e0dea781d1.1628725515.git.reinette.chatre@intel.com>
+
+From: Reinette Chatre <reinette.chatre@intel.com>
+
+This reverts commit 19eaad1400eab34e97ec4467cd2ab694d1caf20c which is
+ee0415681eb661efa1eb2db7acc263f2c7df1e23 upstream.
+
+This commit is not a stable candidate and was backported without needed
+dependencies that results in the resctrl tests unable to compile.
+
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/testing/selftests/resctrl/resctrl.h | 6 ---
+ tools/testing/selftests/resctrl/resctrlfs.c | 50 +++++-----------------------
+ 2 files changed, 11 insertions(+), 45 deletions(-)
+
+--- a/tools/testing/selftests/resctrl/resctrl.h
++++ b/tools/testing/selftests/resctrl/resctrl.h
+@@ -28,10 +28,6 @@
+ #define RESCTRL_PATH "/sys/fs/resctrl"
+ #define PHYS_ID_PATH "/sys/devices/system/cpu/cpu"
+ #define CBM_MASK_PATH "/sys/fs/resctrl/info"
+-#define L3_PATH "/sys/fs/resctrl/info/L3"
+-#define MB_PATH "/sys/fs/resctrl/info/MB"
+-#define L3_MON_PATH "/sys/fs/resctrl/info/L3_MON"
+-#define L3_MON_FEATURES_PATH "/sys/fs/resctrl/info/L3_MON/mon_features"
+
+ #define PARENT_EXIT(err_msg) \
+ do { \
+@@ -83,7 +79,7 @@ int remount_resctrlfs(bool mum_resctrlfs
+ int get_resource_id(int cpu_no, int *resource_id);
+ int umount_resctrlfs(void);
+ int validate_bw_report_request(char *bw_report);
+-bool validate_resctrl_feature_request(const char *resctrl_val);
++bool validate_resctrl_feature_request(char *resctrl_val);
+ char *fgrep(FILE *inf, const char *str);
+ int taskset_benchmark(pid_t bm_pid, int cpu_no);
+ void run_benchmark(int signum, siginfo_t *info, void *ucontext);
+--- a/tools/testing/selftests/resctrl/resctrlfs.c
++++ b/tools/testing/selftests/resctrl/resctrlfs.c
+@@ -616,56 +616,26 @@ char *fgrep(FILE *inf, const char *str)
+ * validate_resctrl_feature_request - Check if requested feature is valid.
+ * @resctrl_val: Requested feature
+ *
+- * Return: True if the feature is supported, else false
++ * Return: 0 on success, non-zero on failure
+ */
+-bool validate_resctrl_feature_request(const char *resctrl_val)
++bool validate_resctrl_feature_request(char *resctrl_val)
+ {
+- struct stat statbuf;
++ FILE *inf = fopen("/proc/cpuinfo", "r");
+ bool found = false;
+ char *res;
+- FILE *inf;
+
+- if (!resctrl_val)
++ if (!inf)
+ return false;
+
+- if (remount_resctrlfs(false))
+- return false;
+-
+- if (!strncmp(resctrl_val, CAT_STR, sizeof(CAT_STR))) {
+- if (!stat(L3_PATH, &statbuf))
+- return true;
+- } else if (!strncmp(resctrl_val, MBA_STR, sizeof(MBA_STR))) {
+- if (!stat(MB_PATH, &statbuf))
+- return true;
+- } else if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR)) ||
+- !strncmp(resctrl_val, CMT_STR, sizeof(CMT_STR))) {
+- if (!stat(L3_MON_PATH, &statbuf)) {
+- inf = fopen(L3_MON_FEATURES_PATH, "r");
+- if (!inf)
+- return false;
++ res = fgrep(inf, "flags");
+
+- if (!strncmp(resctrl_val, CMT_STR, sizeof(CMT_STR))) {
+- res = fgrep(inf, "llc_occupancy");
+- if (res) {
+- found = true;
+- free(res);
+- }
+- }
++ if (res) {
++ char *s = strchr(res, ':');
+
+- if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR))) {
+- res = fgrep(inf, "mbm_total_bytes");
+- if (res) {
+- free(res);
+- res = fgrep(inf, "mbm_local_bytes");
+- if (res) {
+- found = true;
+- free(res);
+- }
+- }
+- }
+- fclose(inf);
+- }
++ found = s && !strstr(s, resctrl_val);
++ free(res);
+ }
++ fclose(inf);
+
+ return found;
+ }
kvm-svm-fix-off-by-one-indexing-when-nullifying-last.patch
tee-correct-inappropriate-usage-of-tee_shm_dma_buf-f.patch
-usb-dwc3-gadget-use-list_replace_init-before-travers.patch
firmware-tee_bnxt-release-tee-shm-session-and-contex.patch
+bpf-add-_kernel-suffix-to-internal-lockdown_bpf_read.patch
+bpf-add-lockdown-check-for-probe_write_user-helper.patch
+revert-selftests-resctrl-use-resctrl-info-for-feature-detection.patch
+mm-make-zone_to_nid-and-zone_set_nid-available-for-discontigmem.patch
+arm64-dts-renesas-rzg2-add-usb2_clksel-to-rz-g2-m-n-h.patch
+arm64-dts-renesas-beacon-fix-usb-extal-reference.patch
+arm64-dts-renesas-beacon-fix-usb-ref-clock-references.patch
+vboxsf-honor-excl-flag-to-the-dir-inode-create-op.patch
+vboxsf-make-vboxsf_dir_create-return-the-handle-for-the-created-file.patch
+usb-ehci-fix-kunpeng920-ehci-hardware-problem.patch
+alsa-pcm-fix-mmap-breakage-without-explicit-buffer-setup.patch
+alsa-hda-realtek-fix-mute-micmute-leds-for-hp-probook-650-g8-notebook-pc.patch
+alsa-hda-add-quirk-for-asus-flow-x13.patch
+ppp-fix-generating-ppp-unit-id-when-ifname-is-not-specified.patch
+ovl-prevent-private-clone-if-bind-mount-is-not-allowed.patch
+++ /dev/null
-From c73f9064fdd78a34de47d939739b92cc54257c7c Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 29 Jul 2021 00:33:14 -0700
-Subject: usb: dwc3: gadget: Use list_replace_init() before traversing lists
-
-From: Wesley Cheng <wcheng@codeaurora.org>
-
-[ Upstream commit d25d85061bd856d6be221626605319154f9b5043 ]
-
-The list_for_each_entry_safe() macro saves the current item (n) and
-the item after (n+1), so that n can be safely removed without
-corrupting the list. However, when traversing the list and removing
-items using gadget giveback, the DWC3 lock is briefly released,
-allowing other routines to execute. There is a situation where, while
-items are being removed from the cancelled_list using
-dwc3_gadget_ep_cleanup_cancelled_requests(), the pullup disable
-routine is running in parallel (due to UDC unbind). As the cleanup
-routine removes n, and the pullup disable removes n+1, once the
-cleanup retakes the DWC3 lock, it references a request who was already
-removed/handled. With list debug enabled, this leads to a panic.
-Ensure all instances of the macro are replaced where gadget giveback
-is used.
-
-Example call stack:
-
-Thread#1:
-__dwc3_gadget_ep_set_halt() - CLEAR HALT
- -> dwc3_gadget_ep_cleanup_cancelled_requests()
- ->list_for_each_entry_safe()
- ->dwc3_gadget_giveback(n)
- ->dwc3_gadget_del_and_unmap_request()- n deleted[cancelled_list]
- ->spin_unlock
- ->Thread#2 executes
- ...
- ->dwc3_gadget_giveback(n+1)
- ->Already removed!
-
-Thread#2:
-dwc3_gadget_pullup()
- ->waiting for dwc3 spin_lock
- ...
- ->Thread#1 released lock
- ->dwc3_stop_active_transfers()
- ->dwc3_remove_requests()
- ->fetches n+1 item from cancelled_list (n removed by Thread#1)
- ->dwc3_gadget_giveback()
- ->dwc3_gadget_del_and_unmap_request()- n+1
-deleted[cancelled_list]
- ->spin_unlock
-
-Fix this condition by utilizing list_replace_init(), and traversing
-through a local copy of the current elements in the endpoint lists.
-This will also set the parent list as empty, so if another thread is
-also looping through the list, it will be empty on the next iteration.
-
-Fixes: d4f1afe5e896 ("usb: dwc3: gadget: move requests to cancelled_list")
-Cc: stable <stable@vger.kernel.org>
-Acked-by: Felipe Balbi <balbi@kernel.org>
-Signed-off-by: Wesley Cheng <wcheng@codeaurora.org>
-Link: https://lore.kernel.org/r/1627543994-20327-1-git-send-email-wcheng@codeaurora.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/dwc3/gadget.c | 18 ++++++++++++++++--
- 1 file changed, 16 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
-index 756839e0e91d..788bbb38cf79 100644
---- a/drivers/usb/dwc3/gadget.c
-+++ b/drivers/usb/dwc3/gadget.c
-@@ -1733,11 +1733,18 @@ static void dwc3_gadget_ep_cleanup_cancelled_requests(struct dwc3_ep *dep)
- {
- struct dwc3_request *req;
- struct dwc3_request *tmp;
-+ struct list_head local;
-
-- list_for_each_entry_safe(req, tmp, &dep->cancelled_list, list) {
-+restart:
-+ list_replace_init(&dep->cancelled_list, &local);
-+
-+ list_for_each_entry_safe(req, tmp, &local, list) {
- dwc3_gadget_ep_skip_trbs(dep, req);
- dwc3_gadget_giveback(dep, req, -ECONNRESET);
- }
-+
-+ if (!list_empty(&dep->cancelled_list))
-+ goto restart;
- }
-
- static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
-@@ -2867,8 +2874,12 @@ static void dwc3_gadget_ep_cleanup_completed_requests(struct dwc3_ep *dep,
- {
- struct dwc3_request *req;
- struct dwc3_request *tmp;
-+ struct list_head local;
-
-- list_for_each_entry_safe(req, tmp, &dep->started_list, list) {
-+restart:
-+ list_replace_init(&dep->started_list, &local);
-+
-+ list_for_each_entry_safe(req, tmp, &local, list) {
- int ret;
-
- ret = dwc3_gadget_ep_cleanup_completed_request(dep, event,
-@@ -2876,6 +2887,9 @@ static void dwc3_gadget_ep_cleanup_completed_requests(struct dwc3_ep *dep,
- if (ret)
- break;
- }
-+
-+ if (!list_empty(&dep->started_list))
-+ goto restart;
- }
-
- static bool dwc3_gadget_ep_should_continue(struct dwc3_ep *dep)
---
-2.30.2
-
--- /dev/null
+From 26b75952ca0b8b4b3050adb9582c8e2f44d49687 Mon Sep 17 00:00:00 2001
+From: Longfang Liu <liulongfang@huawei.com>
+Date: Fri, 9 Apr 2021 16:48:01 +0800
+Subject: USB:ehci:fix Kunpeng920 ehci hardware problem
+
+From: Longfang Liu <liulongfang@huawei.com>
+
+commit 26b75952ca0b8b4b3050adb9582c8e2f44d49687 upstream.
+
+Kunpeng920's EHCI controller does not have SBRN register.
+Reading the SBRN register when the controller driver is
+initialized will get 0.
+
+When rebooting the EHCI driver, ehci_shutdown() will be called.
+if the sbrn flag is 0, ehci_shutdown() will return directly.
+The sbrn flag being 0 will cause the EHCI interrupt signal to
+not be turned off after reboot. this interrupt that is not closed
+will cause an exception to the device sharing the interrupt.
+
+Therefore, the EHCI controller of Kunpeng920 needs to skip
+the read operation of the SBRN register.
+
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Longfang Liu <liulongfang@huawei.com>
+Link: https://lore.kernel.org/r/1617958081-17999-1-git-send-email-liulongfang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/ehci-pci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -297,6 +297,9 @@ static int ehci_pci_setup(struct usb_hcd
+ if (pdev->vendor == PCI_VENDOR_ID_STMICRO
+ && pdev->device == PCI_DEVICE_ID_STMICRO_USB_HOST)
+ ; /* ConneXT has no sbrn register */
++ else if (pdev->vendor == PCI_VENDOR_ID_HUAWEI
++ && pdev->device == 0xa239)
++ ; /* HUAWEI Kunpeng920 USB EHCI has no sbrn register */
+ else
+ pci_read_config_byte(pdev, 0x60, &ehci->sbrn);
+
--- /dev/null
+From foo@baz Fri Aug 13 10:47:09 AM CEST 2021
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 21 Jan 2021 10:08:59 +0100
+Subject: vboxsf: Honor excl flag to the dir-inode create op
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit cc3ddee97cff034cea4d095de4a484c92a219bf5 upstream
+
+Honor the excl flag to the dir-inode create op, instead of behaving
+as if it is always set.
+
+Note the old behavior still worked most of the time since a non-exclusive
+open only calls the create op, if there is a race and the file is created
+between the dentry lookup and the calling of the create call.
+
+While at it change the type of the is_dir parameter to the
+vboxsf_dir_create() helper from an int to a bool, to be consistent with
+the use of bool for the excl parameter.
+
+Fixes: 0fd169576648 ("fs: Add VirtualBox guest shared folder (vboxsf) support")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/vboxsf/dir.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/fs/vboxsf/dir.c
++++ b/fs/vboxsf/dir.c
+@@ -253,7 +253,7 @@ static int vboxsf_dir_instantiate(struct
+ }
+
+ static int vboxsf_dir_create(struct inode *parent, struct dentry *dentry,
+- umode_t mode, int is_dir)
++ umode_t mode, bool is_dir, bool excl)
+ {
+ struct vboxsf_inode *sf_parent_i = VBOXSF_I(parent);
+ struct vboxsf_sbi *sbi = VBOXSF_SBI(parent->i_sb);
+@@ -261,10 +261,12 @@ static int vboxsf_dir_create(struct inod
+ int err;
+
+ params.handle = SHFL_HANDLE_NIL;
+- params.create_flags = SHFL_CF_ACT_CREATE_IF_NEW |
+- SHFL_CF_ACT_FAIL_IF_EXISTS |
+- SHFL_CF_ACCESS_READWRITE |
+- (is_dir ? SHFL_CF_DIRECTORY : 0);
++ params.create_flags = SHFL_CF_ACT_CREATE_IF_NEW | SHFL_CF_ACCESS_READWRITE;
++ if (is_dir)
++ params.create_flags |= SHFL_CF_DIRECTORY;
++ if (excl)
++ params.create_flags |= SHFL_CF_ACT_FAIL_IF_EXISTS;
++
+ params.info.attr.mode = (mode & 0777) |
+ (is_dir ? SHFL_TYPE_DIRECTORY : SHFL_TYPE_FILE);
+ params.info.attr.additional = SHFLFSOBJATTRADD_NOTHING;
+@@ -291,13 +293,13 @@ static int vboxsf_dir_create(struct inod
+ static int vboxsf_dir_mkfile(struct inode *parent, struct dentry *dentry,
+ umode_t mode, bool excl)
+ {
+- return vboxsf_dir_create(parent, dentry, mode, 0);
++ return vboxsf_dir_create(parent, dentry, mode, false, excl);
+ }
+
+ static int vboxsf_dir_mkdir(struct inode *parent, struct dentry *dentry,
+ umode_t mode)
+ {
+- return vboxsf_dir_create(parent, dentry, mode, 1);
++ return vboxsf_dir_create(parent, dentry, mode, true, true);
+ }
+
+ static int vboxsf_dir_unlink(struct inode *parent, struct dentry *dentry)
--- /dev/null
+From foo@baz Fri Aug 13 10:47:09 AM CEST 2021
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 21 Jan 2021 10:22:27 +0100
+Subject: vboxsf: Make vboxsf_dir_create() return the handle for the created file
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit ab0c29687bc7a890d1a86ac376b0b0fd78b2d9b6 upstream
+
+Make vboxsf_dir_create() optionally return the vboxsf-handle for
+the created file. This is a preparation patch for adding atomic_open
+support.
+
+Fixes: 0fd169576648 ("fs: Add VirtualBox guest shared folder (vboxsf) support")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/vboxsf/dir.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+--- a/fs/vboxsf/dir.c
++++ b/fs/vboxsf/dir.c
+@@ -253,7 +253,7 @@ static int vboxsf_dir_instantiate(struct
+ }
+
+ static int vboxsf_dir_create(struct inode *parent, struct dentry *dentry,
+- umode_t mode, bool is_dir, bool excl)
++ umode_t mode, bool is_dir, bool excl, u64 *handle_ret)
+ {
+ struct vboxsf_inode *sf_parent_i = VBOXSF_I(parent);
+ struct vboxsf_sbi *sbi = VBOXSF_SBI(parent->i_sb);
+@@ -278,28 +278,32 @@ static int vboxsf_dir_create(struct inod
+ if (params.result != SHFL_FILE_CREATED)
+ return -EPERM;
+
+- vboxsf_close(sbi->root, params.handle);
+-
+ err = vboxsf_dir_instantiate(parent, dentry, ¶ms.info);
+ if (err)
+- return err;
++ goto out;
+
+ /* parent directory access/change time changed */
+ sf_parent_i->force_restat = 1;
+
+- return 0;
++out:
++ if (err == 0 && handle_ret)
++ *handle_ret = params.handle;
++ else
++ vboxsf_close(sbi->root, params.handle);
++
++ return err;
+ }
+
+ static int vboxsf_dir_mkfile(struct inode *parent, struct dentry *dentry,
+ umode_t mode, bool excl)
+ {
+- return vboxsf_dir_create(parent, dentry, mode, false, excl);
++ return vboxsf_dir_create(parent, dentry, mode, false, excl, NULL);
+ }
+
+ static int vboxsf_dir_mkdir(struct inode *parent, struct dentry *dentry,
+ umode_t mode)
+ {
+- return vboxsf_dir_create(parent, dentry, mode, true, true);
++ return vboxsf_dir_create(parent, dentry, mode, true, true, NULL);
+ }
+
+ static int vboxsf_dir_unlink(struct inode *parent, struct dentry *dentry)
projects / thirdparty / kernel / stable-queue.git / commitdiff
