--- /dev/null
+From 180dccb0dba4f5e84a4a70c1be1d34cbb6528b32 Mon Sep 17 00:00:00 2001
+From: Laibin Qiu <qiulaibin@huawei.com>
+Date: Thu, 13 Jan 2022 10:55:36 +0800
+Subject: blk-mq: fix tag_get wait task can't be awakened
+
+From: Laibin Qiu <qiulaibin@huawei.com>
+
+commit 180dccb0dba4f5e84a4a70c1be1d34cbb6528b32 upstream.
+
+In case of shared tags, there might be more than one hctx which
+allocates from the same tags, and each hctx is limited to allocate at
+most:
+ hctx_max_depth = max((bt->sb.depth + users - 1) / users, 4U);
+
+tag idle detection is lazy, and may be delayed for 30sec, so there
+could be just one real active hctx(queue) but all others are actually
+idle and still accounted as active because of the lazy idle detection.
+Then if wake_batch is > hctx_max_depth, driver tag allocation may wait
+forever on this real active hctx.
+
+Fix this by recalculating wake_batch when inc or dec active_queues.
+
+Fixes: 0d2602ca30e41 ("blk-mq: improve support for shared tags maps")
+Suggested-by: Ming Lei <ming.lei@redhat.com>
+Suggested-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Laibin Qiu <qiulaibin@huawei.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20220113025536.1479653-1-qiulaibin@huawei.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-mq-tag.c | 40 +++++++++++++++++++++++++++++++++-------
+ include/linux/sbitmap.h | 11 +++++++++++
+ lib/sbitmap.c | 25 ++++++++++++++++++++++---
+ 3 files changed, 66 insertions(+), 10 deletions(-)
+
+--- a/block/blk-mq-tag.c
++++ b/block/blk-mq-tag.c
+@@ -17,6 +17,21 @@
+ #include "blk-mq-tag.h"
+
+ /*
++ * Recalculate wakeup batch when tag is shared by hctx.
++ */
++static void blk_mq_update_wake_batch(struct blk_mq_tags *tags,
++ unsigned int users)
++{
++ if (!users)
++ return;
++
++ sbitmap_queue_recalculate_wake_batch(&tags->bitmap_tags,
++ users);
++ sbitmap_queue_recalculate_wake_batch(&tags->breserved_tags,
++ users);
++}
++
++/*
+ * If a previously inactive queue goes active, bump the active user count.
+ * We need to do this before try to allocate driver tag, then even if fail
+ * to get tag when first time, the other shared-tag users could reserve
+@@ -24,18 +39,26 @@
+ */
+ bool __blk_mq_tag_busy(struct blk_mq_hw_ctx *hctx)
+ {
++ unsigned int users;
++
+ if (blk_mq_is_shared_tags(hctx->flags)) {
+ struct request_queue *q = hctx->queue;
+
+- if (!test_bit(QUEUE_FLAG_HCTX_ACTIVE, &q->queue_flags) &&
+- !test_and_set_bit(QUEUE_FLAG_HCTX_ACTIVE, &q->queue_flags))
+- atomic_inc(&hctx->tags->active_queues);
++ if (test_bit(QUEUE_FLAG_HCTX_ACTIVE, &q->queue_flags) ||
++ test_and_set_bit(QUEUE_FLAG_HCTX_ACTIVE, &q->queue_flags)) {
++ return true;
++ }
+ } else {
+- if (!test_bit(BLK_MQ_S_TAG_ACTIVE, &hctx->state) &&
+- !test_and_set_bit(BLK_MQ_S_TAG_ACTIVE, &hctx->state))
+- atomic_inc(&hctx->tags->active_queues);
++ if (test_bit(BLK_MQ_S_TAG_ACTIVE, &hctx->state) ||
++ test_and_set_bit(BLK_MQ_S_TAG_ACTIVE, &hctx->state)) {
++ return true;
++ }
+ }
+
++ users = atomic_inc_return(&hctx->tags->active_queues);
++
++ blk_mq_update_wake_batch(hctx->tags, users);
++
+ return true;
+ }
+
+@@ -56,6 +79,7 @@ void blk_mq_tag_wakeup_all(struct blk_mq
+ void __blk_mq_tag_idle(struct blk_mq_hw_ctx *hctx)
+ {
+ struct blk_mq_tags *tags = hctx->tags;
++ unsigned int users;
+
+ if (blk_mq_is_shared_tags(hctx->flags)) {
+ struct request_queue *q = hctx->queue;
+@@ -68,7 +92,9 @@ void __blk_mq_tag_idle(struct blk_mq_hw_
+ return;
+ }
+
+- atomic_dec(&tags->active_queues);
++ users = atomic_dec_return(&tags->active_queues);
++
++ blk_mq_update_wake_batch(tags, users);
+
+ blk_mq_tag_wakeup_all(tags, false);
+ }
+--- a/include/linux/sbitmap.h
++++ b/include/linux/sbitmap.h
+@@ -416,6 +416,17 @@ static inline void sbitmap_queue_free(st
+ }
+
+ /**
++ * sbitmap_queue_recalculate_wake_batch() - Recalculate wake batch
++ * @sbq: Bitmap queue to recalculate wake batch.
++ * @users: Number of shares.
++ *
++ * Like sbitmap_queue_update_wake_batch(), this will calculate wake batch
++ * by depth. This interface is for HCTX shared tags or queue shared tags.
++ */
++void sbitmap_queue_recalculate_wake_batch(struct sbitmap_queue *sbq,
++ unsigned int users);
++
++/**
+ * sbitmap_queue_resize() - Resize a &struct sbitmap_queue.
+ * @sbq: Bitmap queue to resize.
+ * @depth: New number of bits to resize to.
+--- a/lib/sbitmap.c
++++ b/lib/sbitmap.c
+@@ -457,10 +457,9 @@ int sbitmap_queue_init_node(struct sbitm
+ }
+ EXPORT_SYMBOL_GPL(sbitmap_queue_init_node);
+
+-static void sbitmap_queue_update_wake_batch(struct sbitmap_queue *sbq,
+- unsigned int depth)
++static inline void __sbitmap_queue_update_wake_batch(struct sbitmap_queue *sbq,
++ unsigned int wake_batch)
+ {
+- unsigned int wake_batch = sbq_calc_wake_batch(sbq, depth);
+ int i;
+
+ if (sbq->wake_batch != wake_batch) {
+@@ -476,6 +475,26 @@ static void sbitmap_queue_update_wake_ba
+ }
+ }
+
++static void sbitmap_queue_update_wake_batch(struct sbitmap_queue *sbq,
++ unsigned int depth)
++{
++ unsigned int wake_batch;
++
++ wake_batch = sbq_calc_wake_batch(sbq, depth);
++ __sbitmap_queue_update_wake_batch(sbq, wake_batch);
++}
++
++void sbitmap_queue_recalculate_wake_batch(struct sbitmap_queue *sbq,
++ unsigned int users)
++{
++ unsigned int wake_batch;
++
++ wake_batch = clamp_val((sbq->sb.depth + users - 1) /
++ users, 4, SBQ_WAKE_BATCH);
++ __sbitmap_queue_update_wake_batch(sbq, wake_batch);
++}
++EXPORT_SYMBOL_GPL(sbitmap_queue_recalculate_wake_batch);
++
+ void sbitmap_queue_resize(struct sbitmap_queue *sbq, unsigned int depth)
+ {
+ sbitmap_queue_update_wake_batch(sbq, depth);
--- /dev/null
+From 429e3d123d9a50cc9882402e40e0ac912d88cfcf Mon Sep 17 00:00:00 2001
+From: Moshe Tal <moshet@nvidia.com>
+Date: Sun, 16 Jan 2022 19:39:29 +0200
+Subject: bonding: Fix extraction of ports from the packet headers
+
+From: Moshe Tal <moshet@nvidia.com>
+
+commit 429e3d123d9a50cc9882402e40e0ac912d88cfcf upstream.
+
+Wrong hash sends single stream to multiple output interfaces.
+
+The offset calculation was relative to skb->head, fix it to be relative
+to skb->data.
+
+Fixes: a815bde56b15 ("net, bonding: Refactor bond_xmit_hash for use with
+xdp_buff")
+Reviewed-by: Jussi Maki <joamaki@gmail.com>
+Reviewed-by: Saeed Mahameed <saeedm@nvidia.com>
+Reviewed-by: Gal Pressman <gal@nvidia.com>
+Signed-off-by: Moshe Tal <moshet@nvidia.com>
+Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/bonding/bond_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3872,8 +3872,8 @@ u32 bond_xmit_hash(struct bonding *bond,
+ skb->l4_hash)
+ return skb->hash;
+
+- return __bond_xmit_hash(bond, skb, skb->head, skb->protocol,
+- skb->mac_header, skb->network_header,
++ return __bond_xmit_hash(bond, skb, skb->data, skb->protocol,
++ skb_mac_offset(skb), skb_network_offset(skb),
+ skb_headlen(skb));
+ }
+
--- /dev/null
+From 22bf4047d26980807611b7e2030803db375afd87 Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@mailbox.org>
+Date: Thu, 23 Dec 2021 13:24:32 +0100
+Subject: dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property
+
+From: Alexander Stein <alexander.stein@mailbox.org>
+
+commit 22bf4047d26980807611b7e2030803db375afd87 upstream.
+
+This is used in meson-gx and meson-g12. Add the property to the binding.
+This fixes the dtschema warning:
+hdmi-tx@c883a000: 'sound-name-prefix' does not match any of the
+regexes: 'pinctrl-[0-9]+'
+
+Signed-off-by: Alexander Stein <alexander.stein@mailbox.org>
+Fixes: 376bf52deef5 ("dt-bindings: display: amlogic, meson-dw-hdmi: convert to yaml")
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211223122434.39378-2-alexander.stein@mailbox.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/display/amlogic,meson-dw-hdmi.yaml | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/Documentation/devicetree/bindings/display/amlogic,meson-dw-hdmi.yaml
++++ b/Documentation/devicetree/bindings/display/amlogic,meson-dw-hdmi.yaml
+@@ -10,6 +10,9 @@ title: Amlogic specific extensions to th
+ maintainers:
+ - Neil Armstrong <narmstrong@baylibre.com>
+
++allOf:
++ - $ref: /schemas/sound/name-prefix.yaml#
++
+ description: |
+ The Amlogic Meson Synopsys Designware Integration is composed of
+ - A Synopsys DesignWare HDMI Controller IP
+@@ -99,6 +102,8 @@ properties:
+ "#sound-dai-cells":
+ const: 0
+
++ sound-name-prefix: true
++
+ required:
+ - compatible
+ - reg
--- /dev/null
+From 640f35b871d29cd685ce0ea0762636381beeb98a Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@mailbox.org>
+Date: Sun, 19 Dec 2021 10:41:55 +0100
+Subject: dt-bindings: display: meson-vpu: Add missing amlogic,canvas property
+
+From: Alexander Stein <alexander.stein@mailbox.org>
+
+commit 640f35b871d29cd685ce0ea0762636381beeb98a upstream.
+
+This property was already mentioned in the old textual bindings
+amlogic,meson-vpu.txt, but got dropped during conversion.
+Adding it back similar to amlogic,gx-vdec.yaml.
+
+Fixes: 6b9ebf1e0e67 ("dt-bindings: display: amlogic, meson-vpu: convert to yaml")
+Signed-off-by: Alexander Stein <alexander.stein@mailbox.org>
+Acked-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211219094155.177206-1-alexander.stein@mailbox.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/display/amlogic,meson-vpu.yaml | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/Documentation/devicetree/bindings/display/amlogic,meson-vpu.yaml
++++ b/Documentation/devicetree/bindings/display/amlogic,meson-vpu.yaml
+@@ -78,6 +78,10 @@ properties:
+ interrupts:
+ maxItems: 1
+
++ amlogic,canvas:
++ description: should point to a canvas provider node
++ $ref: /schemas/types.yaml#/definitions/phandle
++
+ power-domains:
+ maxItems: 1
+ description: phandle to the associated power domain
+@@ -106,6 +110,7 @@ required:
+ - port@1
+ - "#address-cells"
+ - "#size-cells"
++ - amlogic,canvas
+
+ additionalProperties: false
+
+@@ -118,6 +123,7 @@ examples:
+ interrupts = <3>;
+ #address-cells = <1>;
+ #size-cells = <0>;
++ amlogic,canvas = <&canvas>;
+
+ /* CVBS VDAC output port */
+ port@0 {
--- /dev/null
+From 33950f9a36aca55c2b1e6062d9b29f3e97f91c40 Mon Sep 17 00:00:00 2001
+From: Sam Protsenko <semen.protsenko@linaro.org>
+Date: Sun, 21 Nov 2021 18:56:36 +0200
+Subject: dt-bindings: watchdog: Require samsung,syscon-phandle for Exynos7
+
+From: Sam Protsenko <semen.protsenko@linaro.org>
+
+commit 33950f9a36aca55c2b1e6062d9b29f3e97f91c40 upstream.
+
+Exynos7 watchdog driver is clearly indicating that its dts node must
+define syscon phandle property. That was probably forgotten, so add it.
+
+Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
+Fixes: 2b9366b66967 ("watchdog: s3c2410_wdt: Add support for Watchdog device on Exynos7")
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20211107202943.8859-2-semen.protsenko@linaro.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/watchdog/samsung-wdt.yaml | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/Documentation/devicetree/bindings/watchdog/samsung-wdt.yaml
++++ b/Documentation/devicetree/bindings/watchdog/samsung-wdt.yaml
+@@ -39,8 +39,8 @@ properties:
+ samsung,syscon-phandle:
+ $ref: /schemas/types.yaml#/definitions/phandle
+ description:
+- Phandle to the PMU system controller node (in case of Exynos5250
+- and Exynos5420).
++ Phandle to the PMU system controller node (in case of Exynos5250,
++ Exynos5420 and Exynos7).
+
+ required:
+ - compatible
+@@ -58,6 +58,7 @@ allOf:
+ enum:
+ - samsung,exynos5250-wdt
+ - samsung,exynos5420-wdt
++ - samsung,exynos7-wdt
+ then:
+ required:
+ - samsung,syscon-phandle
--- /dev/null
+From e073e5ef90298d2d6e5e7f04b545a0815e92110c Mon Sep 17 00:00:00 2001
+From: Andrey Konovalov <andreyknvl@google.com>
+Date: Wed, 19 Jan 2022 18:09:28 -0800
+Subject: lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test
+
+From: Andrey Konovalov <andreyknvl@google.com>
+
+commit e073e5ef90298d2d6e5e7f04b545a0815e92110c upstream.
+
+Make do_kmem_cache_size_bulk() destroy the cache it creates.
+
+Link: https://lkml.kernel.org/r/aced20a94bf04159a139f0846e41d38a1537debb.1640018297.git.andreyknvl@google.com
+Fixes: 03a9349ac0e0 ("lib/test_meminit: add a kmem_cache_alloc_bulk() test")
+Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
+Reviewed-by: Marco Elver <elver@google.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/test_meminit.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/lib/test_meminit.c
++++ b/lib/test_meminit.c
+@@ -337,6 +337,7 @@ static int __init do_kmem_cache_size_bul
+ if (num)
+ kmem_cache_free_bulk(c, num, objects);
+ }
++ kmem_cache_destroy(c);
+ *total_failures += fail;
+ return 1;
+ }
--- /dev/null
+From 99218cbf81bf21355a3de61cd46a706d36e900e6 Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Fri, 14 Jan 2022 06:57:24 +0000
+Subject: lib82596: Fix IRQ check in sni_82596_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+commit 99218cbf81bf21355a3de61cd46a706d36e900e6 upstream.
+
+platform_get_irq() returns negative error number instead 0 on failure.
+And the doc of platform_get_irq() provides a usage example:
+
+ int irq = platform_get_irq(pdev, 0);
+ if (irq < 0)
+ return irq;
+
+Fix the check of return value to catch errors correctly.
+
+Fixes: 115978859272 ("i825xx: Move the Intel 82586/82593/82596 based drivers")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/i825xx/sni_82596.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/i825xx/sni_82596.c
++++ b/drivers/net/ethernet/i825xx/sni_82596.c
+@@ -117,9 +117,10 @@ static int sni_82596_probe(struct platfo
+ netdevice->dev_addr[5] = readb(eth_addr + 0x06);
+ iounmap(eth_addr);
+
+- if (!netdevice->irq) {
++ if (netdevice->irq < 0) {
+ printk(KERN_ERR "%s: IRQ not found for i82596 at 0x%lx\n",
+ __FILE__, netdevice->base_addr);
++ retval = netdevice->irq;
+ goto probe_failed;
+ }
+
--- /dev/null
+From 87c01d57fa23de82fff593a7d070933d08755801 Mon Sep 17 00:00:00 2001
+From: Alistair Popple <apopple@nvidia.com>
+Date: Fri, 14 Jan 2022 14:09:31 -0800
+Subject: mm/hmm.c: allow VM_MIXEDMAP to work with hmm_range_fault
+
+From: Alistair Popple <apopple@nvidia.com>
+
+commit 87c01d57fa23de82fff593a7d070933d08755801 upstream.
+
+hmm_range_fault() can be used instead of get_user_pages() for devices
+which allow faulting however unlike get_user_pages() it will return an
+error when used on a VM_MIXEDMAP range.
+
+To make hmm_range_fault() more closely match get_user_pages() remove
+this restriction. This requires dealing with the !ARCH_HAS_PTE_SPECIAL
+case in hmm_vma_handle_pte(). Rather than replicating the logic of
+vm_normal_page() call it directly and do a check for the zero pfn
+similar to what get_user_pages() currently does.
+
+Also add a test to hmm selftest to verify functionality.
+
+Link: https://lkml.kernel.org/r/20211104012001.2555676-1-apopple@nvidia.com
+Fixes: da4c3c735ea4 ("mm/hmm/mirror: helper to snapshot CPU page table")
+Signed-off-by: Alistair Popple <apopple@nvidia.com>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Cc: Jerome Glisse <jglisse@redhat.com>
+Cc: John Hubbard <jhubbard@nvidia.com>
+Cc: Zi Yan <ziy@nvidia.com>
+Cc: Ralph Campbell <rcampbell@nvidia.com>
+Cc: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/test_hmm.c | 24 ++++++++++++++++++
+ mm/hmm.c | 5 ++-
+ tools/testing/selftests/vm/hmm-tests.c | 42 +++++++++++++++++++++++++++++++++
+ 3 files changed, 69 insertions(+), 2 deletions(-)
+
+--- a/lib/test_hmm.c
++++ b/lib/test_hmm.c
+@@ -1086,9 +1086,33 @@ static long dmirror_fops_unlocked_ioctl(
+ return 0;
+ }
+
++static int dmirror_fops_mmap(struct file *file, struct vm_area_struct *vma)
++{
++ unsigned long addr;
++
++ for (addr = vma->vm_start; addr < vma->vm_end; addr += PAGE_SIZE) {
++ struct page *page;
++ int ret;
++
++ page = alloc_page(GFP_KERNEL | __GFP_ZERO);
++ if (!page)
++ return -ENOMEM;
++
++ ret = vm_insert_page(vma, addr, page);
++ if (ret) {
++ __free_page(page);
++ return ret;
++ }
++ put_page(page);
++ }
++
++ return 0;
++}
++
+ static const struct file_operations dmirror_fops = {
+ .open = dmirror_fops_open,
+ .release = dmirror_fops_release,
++ .mmap = dmirror_fops_mmap,
+ .unlocked_ioctl = dmirror_fops_unlocked_ioctl,
+ .llseek = default_llseek,
+ .owner = THIS_MODULE,
+--- a/mm/hmm.c
++++ b/mm/hmm.c
+@@ -300,7 +300,8 @@ static int hmm_vma_handle_pte(struct mm_
+ * Since each architecture defines a struct page for the zero page, just
+ * fall through and treat it like a normal page.
+ */
+- if (pte_special(pte) && !pte_devmap(pte) &&
++ if (!vm_normal_page(walk->vma, addr, pte) &&
++ !pte_devmap(pte) &&
+ !is_zero_pfn(pte_pfn(pte))) {
+ if (hmm_pte_need_fault(hmm_vma_walk, pfn_req_flags, 0)) {
+ pte_unmap(ptep);
+@@ -518,7 +519,7 @@ static int hmm_vma_walk_test(unsigned lo
+ struct hmm_range *range = hmm_vma_walk->range;
+ struct vm_area_struct *vma = walk->vma;
+
+- if (!(vma->vm_flags & (VM_IO | VM_PFNMAP | VM_MIXEDMAP)) &&
++ if (!(vma->vm_flags & (VM_IO | VM_PFNMAP)) &&
+ vma->vm_flags & VM_READ)
+ return 0;
+
+--- a/tools/testing/selftests/vm/hmm-tests.c
++++ b/tools/testing/selftests/vm/hmm-tests.c
+@@ -1251,6 +1251,48 @@ TEST_F(hmm, anon_teardown)
+ /*
+ * Test memory snapshot without faulting in pages accessed by the device.
+ */
++TEST_F(hmm, mixedmap)
++{
++ struct hmm_buffer *buffer;
++ unsigned long npages;
++ unsigned long size;
++ unsigned char *m;
++ int ret;
++
++ npages = 1;
++ size = npages << self->page_shift;
++
++ buffer = malloc(sizeof(*buffer));
++ ASSERT_NE(buffer, NULL);
++
++ buffer->fd = -1;
++ buffer->size = size;
++ buffer->mirror = malloc(npages);
++ ASSERT_NE(buffer->mirror, NULL);
++
++
++ /* Reserve a range of addresses. */
++ buffer->ptr = mmap(NULL, size,
++ PROT_READ | PROT_WRITE,
++ MAP_PRIVATE,
++ self->fd, 0);
++ ASSERT_NE(buffer->ptr, MAP_FAILED);
++
++ /* Simulate a device snapshotting CPU pagetables. */
++ ret = hmm_dmirror_cmd(self->fd, HMM_DMIRROR_SNAPSHOT, buffer, npages);
++ ASSERT_EQ(ret, 0);
++ ASSERT_EQ(buffer->cpages, npages);
++
++ /* Check what the device saw. */
++ m = buffer->mirror;
++ ASSERT_EQ(m[0], HMM_DMIRROR_PROT_READ);
++
++ hmm_buffer_free(buffer);
++}
++
++/*
++ * Test memory snapshot without faulting in pages accessed by the device.
++ */
+ TEST_F(hmm2, snapshot)
+ {
+ struct hmm_buffer *buffer;
--- /dev/null
+From de2d807b294d3d2ce5e59043ae2634016765d076 Mon Sep 17 00:00:00 2001
+From: Maxim Mikityanskiy <maximmi@nvidia.com>
+Date: Wed, 12 Jan 2022 12:28:05 +0200
+Subject: sch_api: Don't skip qdisc attach on ingress
+
+From: Maxim Mikityanskiy <maximmi@nvidia.com>
+
+commit de2d807b294d3d2ce5e59043ae2634016765d076 upstream.
+
+The attach callback of struct Qdisc_ops is used by only a few qdiscs:
+mq, mqprio and htb. qdisc_graft() contains the following logic
+(pseudocode):
+
+ if (!qdisc->ops->attach) {
+ if (ingress)
+ do ingress stuff;
+ else
+ do egress stuff;
+ }
+ if (!ingress) {
+ ...
+ if (qdisc->ops->attach)
+ qdisc->ops->attach(qdisc);
+ } else {
+ ...
+ }
+
+As we see, the attach callback is not called if the qdisc is being
+attached to ingress (TC_H_INGRESS). That wasn't a problem for mq and
+mqprio, since they contain a check that they are attached to TC_H_ROOT,
+and they can't be attached to TC_H_INGRESS anyway.
+
+However, the commit cited below added the attach callback to htb. It is
+needed for the hardware offload, but in the non-offload mode it
+simulates the "do egress stuff" part of the pseudocode above. The
+problem is that when htb is attached to ingress, neither "do ingress
+stuff" nor attach() is called. It results in an inconsistency, and the
+following message is printed to dmesg:
+
+unregister_netdevice: waiting for lo to become free. Usage count = 2
+
+This commit addresses the issue by running "do ingress stuff" in the
+ingress flow even in the attach callback is present, which is fine,
+because attach isn't going to be called afterwards.
+
+The bug was found by syzbot and reported by Eric.
+
+Fixes: d03b195b5aa0 ("sch_htb: Hierarchical QoS hardware offload")
+Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
+Reported-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_api.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -1062,7 +1062,7 @@ static int qdisc_graft(struct net_device
+
+ qdisc_offload_graft_root(dev, new, old, extack);
+
+- if (new && new->ops->attach)
++ if (new && new->ops->attach && !ingress)
+ goto skip;
+
+ for (i = 0; i < num_q; i++) {
--- /dev/null
+From d8adf5b92a9d2205620874d498c39923ecea8749 Mon Sep 17 00:00:00 2001
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Date: Thu, 13 Jan 2022 09:19:18 +0100
+Subject: scripts/dtc: dtx_diff: remove broken example from help text
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+commit d8adf5b92a9d2205620874d498c39923ecea8749 upstream.
+
+dtx_diff suggests to use <(...) syntax to pipe two inputs into it, but
+this has never worked: The /proc/self/fds/... paths passed by the shell
+will fail the `[ -f "${dtx}" ] && [ -r "${dtx}" ]` check in compile_to_dts,
+but even with this check removed, the function cannot work: hexdump will
+eat up the DTB magic, making the subsequent dtc call fail, as a pipe
+cannot be rewound.
+
+Simply remove this broken example, as there is already an alternative one
+that works fine.
+
+Fixes: 10eadc253ddf ("dtc: create tool to diff device trees")
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Reviewed-by: Frank Rowand <frank.rowand@sony.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20220113081918.10387-1-matthias.schiffer@ew.tq-group.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/dtc/dtx_diff | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/scripts/dtc/dtx_diff
++++ b/scripts/dtc/dtx_diff
+@@ -59,12 +59,8 @@ Otherwise DTx is treated as a dts source
+ or '/include/' to be processed.
+
+ If DTx_1 and DTx_2 are in different architectures, then this script
+- may not work since \${ARCH} is part of the include path. Two possible
+- workarounds:
+-
+- `basename $0` \\
+- <(ARCH=arch_of_dtx_1 `basename $0` DTx_1) \\
+- <(ARCH=arch_of_dtx_2 `basename $0` DTx_2)
++ may not work since \${ARCH} is part of the include path. The following
++ workaround can be used:
+
+ `basename $0` ARCH=arch_of_dtx_1 DTx_1 >tmp_dtx_1.dts
+ `basename $0` ARCH=arch_of_dtx_2 DTx_2 >tmp_dtx_2.dts
net-cpsw-avoid-alignment-faults-by-taking-net_ip_align-into-account.patch
net-phy-micrel-use-kszphy_suspend-kszphy_resume-for-irq-aware-devices.patch
net-mscc-ocelot-fix-using-match-before-it-is-set.patch
+dt-bindings-display-meson-dw-hdmi-add-missing-sound-name-prefix-property.patch
+dt-bindings-display-meson-vpu-add-missing-amlogic-canvas-property.patch
+dt-bindings-watchdog-require-samsung-syscon-phandle-for-exynos7.patch
+sch_api-don-t-skip-qdisc-attach-on-ingress.patch
+blk-mq-fix-tag_get-wait-task-can-t-be-awakened.patch
+scripts-dtc-dtx_diff-remove-broken-example-from-help-text.patch
+lib82596-fix-irq-check-in-sni_82596_probe.patch
+mm-hmm.c-allow-vm_mixedmap-to-work-with-hmm_range_fault.patch
+bonding-fix-extraction-of-ports-from-the-packet-headers.patch
+lib-test_meminit-destroy-cache-in-kmem_cache_alloc_bulk-test.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
